// Global hostname claims — the desired-state object behind attaching an
// extra hostname to a route (#151). A claim lives at ClaimKey(host), the
// SAME key regardless of which account or app is asking, so the bucket key
// itself is the cross-account uniqueness gate: two accounts racing for the
// same host cannot both win, because there is only ever one object to Put.
// Later tasks derive registry rows from these claims; nothing here talks to
// the registry.
package domains

import (
	"context"
	"crypto/sha256"
	"encoding/hex"
	"encoding/json"
	"errors"
	"fmt"
	"log"
	"os"
	"regexp"
	"strings"
	"time"

	"github.com/carlosframework/platform/internal/release"
)

// ClaimsPrefix is where every hostname claim lives.
const ClaimsPrefix = "domains/"

// ClaimKey is the bucket key for host's claim.
func ClaimKey(host string) string { return ClaimsPrefix + host + ".json" }

// Claim is the wire shape at ClaimKey(Host) — the global record of who owns
// an extra hostname attached to a route. Route is omitempty because a claim
// can exist ahead of the route it will back (reserved but not yet wired);
// CreatedBy is omitempty because a claim minted by a box-side process, not a
// human door, has no operator to name.
type Claim struct {
	Acquisition       string `json:"acq,omitempty"`
	RecordIncarnation string `json:"incarnation,omitempty"`
	OwnershipState    string `json:"ownership_state,omitempty"`
	Schema            int    `json:"schema"` // 1
	Host              string `json:"host"`
	Account           string `json:"account"`
	App               string `json:"app"`
	Route             string `json:"route,omitempty"`
	CreatedAt         string `json:"created_at"`
	CreatedBy         string `json:"created_by,omitempty"`
	// Wildcard and Catchall are the woodstar-carloku branch's two claim
	// capabilities (its migration spec §4-5 gives them meaning; nothing in
	// this package acts on either). They are deliberately orthogonal:
	// Wildcard opts the domain into a delegated-ACME wildcard cert (one
	// *.<host> cert covering named aliases, no per-host CT-logged certs);
	// Catchall derives the *.<host> catch-all alias entry to the primary
	// route, and the attach surface refuses it without Wildcard (a
	// catch-all nobody can serve TLS for is a config error, not a state).
	// Both are declared here so a converge rewrite by this binary
	// round-trips them instead of stripping fields it doesn't know — the
	// additive-wire rule applied to writers, not just readers. Converge
	// preserves only DECLARED fields (json.Unmarshal drops unknown ones),
	// which is exactly why any future claim field must be added here in
	// the same change that first writes it.
	Wildcard bool `json:"wildcard,omitempty"`
	Catchall bool `json:"catchall,omitempty"`
	// Paths splits this hostname's traffic by leading URL segment: a bare
	// first segment ("paulca", never "/paulca") mapped to the HOSTNAME of the
	// route that serves it. Absent or empty means this host routes by
	// hostname alone — the behaviour of every host today, and the reason this
	// field is additive in the strongest sense: no row, no map, no change.
	//
	// This is a THIRD claim capability alongside Wildcard/Catchall, and it is
	// declared here for the reason stated above them — converge preserves only
	// DECLARED fields, so an undeclared field would be stripped by any binary
	// that rewrote the claim.
	//
	// The writer is the tenant's own platform, publishing the whole map
	// regenerated from its own database. Deltas were rejected deliberately: a
	// lost delta desyncs the two systems silently, whereas a wholesale
	// republish is always a full repair.
	Paths map[string]string `json:"paths,omitempty"`
	// Instances marks an instance catch-all: a claim whose Host is
	// "*.<parent>" (InstanceCatchallHost) and which serves each of its
	// app's instances at <label>.<parent>, where <label> is the instance
	// host's own first label. The box derives one ordinary alias row per
	// local instance (ReconcileAliases); nothing else about such a claim is
	// used — it never names a Route, a Wildcard, a Catchall or Paths.
	//
	// Additive, and inert on a binary that predates it, by construction
	// rather than by luck: such a binary decodes this claim as one with no
	// Route (no alias), no Wildcard (no cert parent, no catch-all) and no
	// Paths — the shape every pass already skips. No door accepts a "*" in
	// a hostname (NormalizeAliasHost), so an older console cannot rewrite or
	// detach it either. Declared here for the round-trip reason above.
	Instances bool `json:"instances,omitempty"`
	// Pending marks a claim whose writer has not yet proved control of the
	// hostname (#215): no TXT record carrying ChallengeToken was found at
	// ChallengeName(Host) when it was written. A pending claim is a
	// reservation and nothing more. ReconcileAliases derives no row from it,
	// so it is not routed and no certificate is ever ordered for it, and it
	// does not hold the name against anyone who CAN prove control
	// (AttachClaimProven supersedes it) or against anyone at all once
	// PendingUntil has passed.
	//
	// The polarity is the additive-wire rule at work: every claim written
	// before this field existed carries no "pending" key and therefore reads
	// as verified, which is what those claims have been all along. The
	// converse matters at roll time: a box running a binary from before this
	// field would decode a pending claim as live and route it, so boxes roll
	// before the console that starts writing them.
	Pending bool `json:"pending,omitempty"`
	// PendingUntil is when a pending claim stops reserving its hostname
	// (RFC3339, UTC). Meaningless on a verified claim, and cleared when the
	// claim is verified.
	PendingUntil string `json:"pending_until,omitempty"`
}

// InstanceCatchallHost is the claim host of parent's instance catch-all:
// "*.<parent>". Using the star as the key is what makes the catch-all
// globally unique per parent through the same bucket key gate every other
// claim uses, and no attach door can produce it (NormalizeAliasHost refuses
// "*"), so it cannot collide with an ordinary claim.
func InstanceCatchallHost(parent string) string { return "*." + parent }

// ParseInstanceCatchallHost reports whether raw names an instance catch-all
// ("*.<parent>", case and one trailing dot forgiven) and returns the
// normalised parent. The parent is held to NormalizeAliasHost's rules, so it
// has an interior dot: "*.dev" is never a catch-all.
func ParseInstanceCatchallHost(raw string) (parent string, ok bool) {
	rest, ok := strings.CutPrefix(strings.ToLower(raw), "*.")
	if !ok {
		return "", false
	}
	return NormalizeAliasHost(rest)
}

// instanceRecordsPrefix is where an app's instance records live:
// provision.RecordsPrefix, spelled here for the import-cycle reason
// hostLabelRe gives (internal/provision imports this package).
func instanceRecordsPrefix(account, app string) string {
	return release.AppPrefix(account, app) + "instances/"
}

// InstanceLabelCounts counts the app's instance records by the first label
// of their host, from the record KEYS alone (one listing, no bodies): the
// deployment-wide view of which labels the app's instances use, whatever
// box serves them and whatever instance domain each was created under.
// Replica records are counted too; they have labels of their own, so they
// never inflate another instance's count.
func InstanceLabelCounts(ctx context.Context, s release.Store, account, app string) (map[string]int, error) {
	prefix := instanceRecordsPrefix(account, app)
	keys, err := s.List(ctx, prefix)
	if err != nil {
		return nil, err
	}
	counts := map[string]int{}
	for _, key := range keys {
		host, ok := strings.CutSuffix(strings.TrimPrefix(key, prefix), ".json")
		if !ok || host == "" || strings.Contains(host, "/") {
			continue
		}
		label, _, _ := strings.Cut(host, ".")
		counts[label]++
	}
	return counts, nil
}

// CatchallProofName and CatchallProofValue are the TXT record that proves an
// account controls an instance catch-all's parent in DNS:
// _carlos-catchall.<parent> = "carlos-catchall-account=<sqid>". The value
// names the account, so one account's proof is no use to another — the same
// shape as the mail ownership proof (internal/mail, #216). With it, the
// catch-all reserves every one-label name under the parent at the attach
// door, not only the names of instances that already exist.
func CatchallProofName(parent string) string { return "_carlos-catchall." + parent }

func CatchallProofValue(account string) string { return "carlos-catchall-account=" + account }

// ErrParentNotHeld is returned by AttachInstanceCatchall when parent itself
// is not claimed by the caller's account. One error for both "nobody holds
// it" and "another account holds it", so this door says nothing the attach
// door would not.
var ErrParentNotHeld = errors.New("parent hostname not held by this account")

// AttachInstanceCatchall writes parent's instance catch-all for account's
// app, create-only by key like AttachClaim. The same app asking again is an
// idempotent no-op; anyone else (another account, or another app of this
// one) gets ErrHostUnavailable.
//
// The parent must be claimed by the SAME account, by any of its apps. With
// wildcard DNS pointing at the edge, a catch-all is a claim on every
// unclaimed name under parent at once, so it may only be made by whoever
// already holds parent. The box re-checks this on every pass
// (ReconcileAliases), so a catch-all whose parent claim is later released
// goes inert rather than outliving it.
//
// The check and the write are two objects and not atomic. The race it
// leaves is the parent claim being released between them, which the box
// check answers.
func claimRawAttachInstanceCatchall(ctx context.Context, s release.Store, parent, account, app, createdAt, createdBy string) (created bool, err error) {
	apex, err := GetClaim(ctx, s, parent)
	if errors.Is(err, os.ErrNotExist) {
		return false, ErrParentNotHeld
	} else if err != nil {
		return false, err
	}
	if apex.Account != account || apex.Pending {
		// A pending parent (#215) is a reservation, not a holding.
		return false, ErrParentNotHeld
	}
	host := InstanceCatchallHost(parent)
	body, err := json.Marshal(Claim{
		Schema: 1, Host: host, Account: account, App: app,
		CreatedAt: createdAt, CreatedBy: createdBy, Instances: true,
	})
	if err != nil {
		return false, err
	}
	for attempt := 0; ; attempt++ {
		cur, etag, err := getClaimETag(ctx, s, host)
		if errors.Is(err, os.ErrNotExist) {
			etag = ""
		} else if err != nil {
			return false, err
		} else if cur.Account == account && cur.App == app && cur.Instances {
			return false, nil
		} else if cur.Instances && cur.Account == apex.Account {
			// Live: its account still holds the parent. Ours to refuse.
			return false, ErrHostUnavailable
		} else if !cur.Instances {
			return false, ErrHostUnavailable // not a catch-all: no door writes this key otherwise
		}
		// Absent, or a catch-all left behind by an account that no longer
		// holds the parent. The second is inert everywhere already (the box
		// and ForeignInstanceCatchall both re-check the parent), so the new
		// holder of the parent replaces it rather than meeting a squat.
		if _, err := s.Put(ctx, ClaimKey(host), body, etag); err == nil {
			return true, nil
		} else if errors.Is(err, release.ErrCASConflict) && attempt == 0 {
			continue // lost a race — re-read and judge the winner
		} else {
			return false, err
		}
	}
}

// ForeignInstanceCatchall returns the live instance catch-all, held by an
// account OTHER than account, whose parent is one label above host — or nil.
// The attach doors use it to refuse such a host when the catch-all's app
// actually runs an instance at that label (the console checks the record;
// this package cannot import provision). Without that refusal another
// account could claim a live instance's public name, and its exact claim
// would beat the derived alias.
//
// Only one label under the parent, because that is all a catch-all serves.
// Deeper names are ordinary names, open to anyone as they always were.
//
// "Live" is the box's rule: the catch-all's account still holds the parent.
// A catch-all whose parent was released, or moved to another account,
// serves nothing and is reported as nil.
//
// One GET (usually a 404), and a second only when another account's
// catch-all sits over the name. A read failure is returned rather than
// answered either way: the door turns it into a retryable error, never a
// refusal that reads as "someone holds this" or a pass that skips the guard.
func ForeignInstanceCatchall(ctx context.Context, s release.Store, host, account string) (*Claim, error) {
	_, parent, ok := strings.Cut(host, ".")
	if !ok || !strings.Contains(parent, ".") {
		return nil, nil
	}
	c, err := GetClaim(ctx, s, InstanceCatchallHost(parent))
	if errors.Is(err, os.ErrNotExist) {
		return nil, nil
	} else if err != nil {
		return nil, err
	}
	if !c.Instances || c.Account == account {
		return nil, nil
	}
	apex, err := GetClaim(ctx, s, parent)
	if errors.Is(err, os.ErrNotExist) {
		return nil, nil
	} else if err != nil {
		return nil, err
	}
	if apex.Account != c.Account || apex.Pending {
		return nil, nil // a pending parent (#215) lends the catch-all nothing
	}
	return c, nil
}

// ClaimPendingTTL is how long an unproven claim reserves its hostname. Long
// enough for a person to get a TXT record through a slow DNS provider, short
// enough that a name claimed by someone who never could prove it comes free
// on its own. It only ever blocks other UNPROVEN attaches: a writer who can
// prove control supersedes a pending claim at any time.
const ClaimPendingTTL = 7 * 24 * time.Hour

// pendingLive reports whether c is pending and still reserving its hostname
// at now. A pending claim with no readable expiry is hand-written or damaged,
// and is treated as expired: the conservative direction for a reservation
// nobody proved is to let it go.
func (c Claim) pendingLive(now time.Time) bool {
	if !c.Pending {
		return false
	}
	until, err := time.Parse(time.RFC3339, c.PendingUntil)
	return err == nil && now.Before(until)
}

// ChallengeLabel is the DNS label a claimant proves control under: a TXT
// record at ChallengeName(host) carrying ChallengeToken. The name the
// domain-attach spec reserved for this (2026-08-12 §2).
const ChallengeLabel = "_carlos-challenge"

// ChallengeName is where host's ownership TXT record lives.
func ChallengeName(host string) string { return ChallengeLabel + "." + host }

// ChallengeToken is the TXT value that proves account controls host on the
// deployment named by deployment (the console's own hostname).
//
// Derived, not stored, and deliberately not secret. What the record proves
// is that whoever controls host's DNS chose THIS account on THIS deployment,
// and that only needs the value to differ per account and per deployment:
// another account's token for the same host is a different string, so a
// record published for one account can never be replayed by another, and a
// record published for an account on one CARLOS deployment proves nothing on
// another that happens to reuse the sqid. Knowing a token helps nobody who
// cannot write the zone. Deriving it means there is nothing to look up
// before a claim exists, which is what lets a claimant who has already
// published the record attach and verify in one call, and lets a proven
// claimant supersede someone else's pending reservation.
func ChallengeToken(deployment, account, host string) string {
	sum := sha256.Sum256([]byte("carlos-domain-challenge\x00" + deployment + "\x00" + account + "\x00" + host))
	return "carlos-verify=" + hex.EncodeToString(sum[:16])
}

// ErrHostUnavailable is returned by AttachClaim when host is already claimed
// by a different account or app. Deliberately neutral: it never names the
// current holder, so a caller cannot use this door to discover who owns a
// hostname they do not.
var ErrHostUnavailable = errors.New("hostname unavailable")

// getClaimETag reads and parses host's claim, carrying the etag it was read
// under. Not-found stays os.ErrNotExist-wrapped. A schema newer than this
// binary understands is refused rather than silently truncated by
// json.Unmarshal — the GetManifestETag precedent (provision.go).
func getClaimETag(ctx context.Context, s release.Store, host string) (*Claim, string, error) {
	raw, etag, err := s.Get(ctx, ClaimKey(host))
	if err != nil {
		return nil, "", err
	}
	var c Claim
	if err := json.Unmarshal(raw, &c); err != nil {
		return nil, "", fmt.Errorf("domains: claim %s: %w", host, err)
	}
	if c.Schema > 1 {
		return nil, "", fmt.Errorf("domains: claim %s: schema %d is newer than this binary understands — upgrade carlos", host, c.Schema)
	}
	return &c, etag, nil
}

// GetClaim reads host's claim. Not-found stays os.ErrNotExist-wrapped.
func GetClaim(ctx context.Context, s release.Store, host string) (*Claim, error) {
	c, _, err := getClaimETag(ctx, s, host)
	return c, err
}

// AttachClaim writes host's global claim, create-only by key: the bucket
// key IS the cross-account uniqueness gate. Same owner re-attaching is
// idempotent (converging Route in place); any other owner gets
// ErrHostUnavailable — deliberately neutral, never naming the holder.
//
// The claim it writes is VERIFIED: AttachClaim is AttachClaimProven with a
// writer that needs no proof. That is right for callers whose authority over
// the name was settled before they got here; a member's door asks for proof
// through AttachClaimProven instead.
//
// created reports that this call brought the claim into existence; changed
// reports that it WROTE — a create or a route converge, and false for the
// pure no-op where the stored claim already said what the caller asked for.
// The two are separate answers because they drive different things: created
// is what the door tells the caller, changed is what the door audits and
// bumps control/serial on. Callers that re-attach on a loop (titogo's router
// re-attaches every hostname on each reload pass) make no-op attaches the
// steady state, and a serial that moved for a call that wrote nothing would
// send every box in the fleet looking for a change that isn't there.
func AttachClaim(ctx context.Context, s release.Store, c Claim) (created, changed bool, err error) {
	created, changed, _, err = AttachClaimProven(ctx, s, c, time.Now(), nil)
	return created, changed, err
}

// AttachClaimProven is AttachClaim for a writer that may or may not control
// host (#215). prove answers "does the caller control this hostname right
// now?" — in practice a TXT lookup at ChallengeName(host) — and nil means
// the caller's authority is already settled (a proof of true).
//
// prove is asked at most once, and only when the answer can change the
// outcome: there is no claim yet, the caller's own claim is still pending,
// or another owner's claim is pending. A re-attach of a verified claim this
// caller already holds never asks, which is what keeps a router that
// re-attaches every hostname on every pass from turning into a DNS lookup
// per hostname per pass.
//
// The rules, in the order they apply:
//
//   - no claim: written, pending unless proven;
//   - another owner's VERIFIED claim: ErrHostUnavailable, exactly as before;
//   - another owner's PENDING claim: superseded by a proven caller at any
//     time, and by anyone once it has expired; otherwise ErrHostUnavailable,
//     byte-identical to the verified case;
//   - the caller's own claim: converged — a pending one becomes verified
//     once proven (its expiry is never pushed back) — and Route repointed.
//
// Verification is one-way and sticky: nothing here ever turns a verified
// claim back into a pending one. pending reports the state of the claim as
// stored after the call (false whenever err is non-nil).
func AttachClaimProven(ctx context.Context, s release.Store, c Claim, now time.Time, prove func() bool) (created, changed, pending bool, err error) {
	c.Schema = 1
	c.Pending, c.PendingUntil = false, ""
	asked, proven := false, true
	isProven := func() bool {
		if prove == nil {
			return true
		}
		if !asked {
			asked, proven = true, prove()
		}
		return proven
	}
	// fresh is the caller's claim as a brand-new object: verified when
	// proven, otherwise a reservation that runs out ClaimPendingTTL from now.
	fresh := func() Claim {
		out := c
		if !isProven() {
			out.Pending = true
			out.PendingUntil = now.UTC().Add(ClaimPendingTTL).Format(time.RFC3339)
		}
		return out
	}
	for attempt := 0; ; attempt++ {
		cur, etag, err := getClaimETag(ctx, s, c.Host)
		if errors.Is(err, os.ErrNotExist) {
			next := fresh()
			body, err := json.Marshal(next)
			if err != nil {
				return false, false, false, err
			}
			if _, err := s.Put(ctx, ClaimKey(c.Host), body, ""); err == nil {
				return true, true, next.Pending, nil
			} else if errors.Is(err, release.ErrCASConflict) && attempt == 0 {
				continue // lost the create race — re-read and judge the winner
			} else {
				return false, false, false, err
			}
		} else if err != nil {
			return false, false, false, err
		}
		if cur.Account != c.Account || cur.App != c.App {
			// A verified claim is the holder's, full stop. A pending one is
			// only a reservation: it yields to a caller who can prove
			// control, and to anyone once it has run out. Both refusals are
			// the same ErrHostUnavailable, so the answer still never says
			// whether the name is held, or how firmly.
			if !cur.Pending || (cur.pendingLive(now) && !isProven()) {
				return false, false, false, ErrHostUnavailable
			}
			next := fresh()
			body, err := json.Marshal(next)
			if err != nil {
				return false, false, false, err
			}
			if _, err := s.Put(ctx, ClaimKey(c.Host), body, etag); err == nil {
				// From the caller's side this IS a new claim: nothing of the
				// previous holder's survives it — not its route, its
				// capabilities, or its prefix map.
				return true, true, next.Pending, nil
			} else if errors.Is(err, release.ErrCASConflict) && attempt == 0 {
				continue
			} else {
				return false, false, false, err
			}
		}
		// Converge repoints Route and settles the pending state, and nothing
		// else: the stored claim keeps its CreatedAt (the claim's age) and
		// Wildcard (TLS opt-in state a route repoint has no business
		// clearing). Writing the caller's whole claim here would strip both.
		next := *cur
		next.Route = c.Route
		// A reservation is never renewed: PendingUntil stays where the first
		// attach put it, so whoever reserved a name has ClaimPendingTTL from
		// then to prove it, however often they re-attach (and `carlos
		// deploy` re-attaches on every run). Proof still verifies an expired
		// reservation of one's own, as long as nobody has taken it meanwhile.
		if cur.Pending && isProven() {
			next.Pending, next.PendingUntil = false, ""
		}
		if next.Route == cur.Route && next.Pending == cur.Pending && next.PendingUntil == cur.PendingUntil {
			return false, false, cur.Pending, nil // nothing to write: this call is a no-op
		}
		nbody, err := json.Marshal(next)
		if err != nil {
			return false, false, false, err
		}
		if _, err := s.Put(ctx, ClaimKey(c.Host), nbody, etag); err == nil {
			return false, true, next.Pending, nil // not a create, but a real write
		} else if errors.Is(err, release.ErrCASConflict) && attempt == 0 {
			continue // converge race — one retry, then surface
		} else {
			return false, false, false, err
		}
	}
}

// DetachClaim removes host's claim, but only for the owner that holds it:
// a mismatched account/app is quietly ignored (removed=false, nil error)
// rather than erroring, the same neutrality AttachClaim's ErrHostUnavailable
// observes — a caller must not learn who the real owner is by probing
// detach. An already-absent claim is likewise quiet: detach is idempotent.
//
// An instance catch-all is deleted only at the revision this call read
// (release.DeleteIfMatch). It is the one claim that can change hands in
// place — AttachInstanceCatchall replaces a dead one for the parent's new
// holder — so an old owner's detach that read its own claim must not land
// after that replacement and delete the new owner's. A changed claim
// answers removed=false, like any claim that is not the caller's.
func claimRawDetachClaim(ctx context.Context, s release.Store, host, account, app string) (bool, error) {
	cur, etag, err := getClaimETag(ctx, s, host)
	if errors.Is(err, os.ErrNotExist) {
		return false, nil
	}
	if err != nil {
		return false, err
	}
	if cur.Account != account || cur.App != app {
		return false, nil
	}
	if cur.Instances {
		err := release.DeleteIfMatch(ctx, s, ClaimKey(host), etag)
		if errors.Is(err, release.ErrCASConflict) {
			return false, nil
		}
		if err != nil {
			return false, err
		}
		return true, nil
	}
	if err := s.Delete(ctx, ClaimKey(host)); err != nil {
		return false, err
	}
	return true, nil
}

// ListClaims returns every valid claim in the bucket. An unparseable or
// newer-schema object is logged and skipped — one bad claim must never take
// the whole listing down.
func ListClaims(ctx context.Context, s release.Store) ([]Claim, error) {
	keys, err := s.List(ctx, ClaimsPrefix)
	if err != nil {
		return nil, fmt.Errorf("domains: list claims: %w", err)
	}
	var claims []Claim
	for _, key := range keys {
		if c, ok, _ := readClaim(ctx, s, key); ok {
			claims = append(claims, c)
		}
	}
	return claims, nil
}

// readClaim reads and decodes one claim object. Every refusal is a skip and
// never an error to the caller: one unparseable or too-new object under the
// prefix must not take down the whole fold.
//
// The two failure kinds are told apart, and the distinction is load-bearing
// for ClaimCache. A DECODE refusal (unparseable, or a schema this binary
// does not understand) is deterministic — the same bytes will refuse the
// same way next pass — so it is safe to remember. A READ failure is a
// network blip and is not: remembering it would hide a perfectly good claim
// until something unrelated moved its bucket stamp, which for a claim that
// nobody edits is indistinguishable from forever. So a read failure reports
// firm=false and the cache declines to keep it.
//
// Shared with ClaimCache so the two folds cannot drift into different ideas
// of what counts as a claim — which would show up as a hostname that appears
// on a cached read and vanishes on an uncached one.
func readClaim(ctx context.Context, s release.Store, key string) (c Claim, ok, firm bool) {
	raw, _, err := s.Get(ctx, key)
	if err != nil {
		// Not-found is quiet: a claim detached between the listing and this
		// read, or, through the fleet store door, another account's claim,
		// whose NAME the door lists but whose body it withholds (#215). The
		// listing still counts it as claimed (listWithHosts).
		if !errors.Is(err, os.ErrNotExist) {
			log.Printf("domains: claim %s: %v", key, err)
		}
		return Claim{}, false, false
	}
	if err := json.Unmarshal(raw, &c); err != nil {
		log.Printf("domains: claim %s: unparseable: %v", key, err)
		return Claim{}, false, true
	}
	if c.Schema > 1 {
		log.Printf("domains: claim %s: schema %d is newer than this binary understands, skipping", key, c.Schema)
		return Claim{}, false, true
	}
	return c, true, true
}

// hostLabelRe mirrors provision.labelRe (which itself mirrors
// domains.accountNameRe — see that var's comment) — pinned HERE rather than
// imported from internal/provision, because internal/provision/reconcile.go
// already imports internal/domains for account/route materialization;
// importing provision.ValidHostShape back would be a cycle. Same DNS label
// rule: lowercase a-z, 0-9, hyphen, no leading/trailing hyphen, 1-63 chars.
var hostLabelRe = regexp.MustCompile(`^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$`)

// validHostShape is provision.ValidHostShape's check, duplicated for the
// import-cycle reason hostLabelRe explains: every label of host must match
// hostLabelRe, and the whole host must fit in the DNS 253-character ceiling.
func validHostShape(host string) bool {
	if host == "" || len(host) > 253 {
		return false
	}
	for _, label := range strings.Split(host, ".") {
		if !hostLabelRe.MatchString(label) {
			return false
		}
	}
	return true
}

// NormalizeAliasHost lowercases raw, strips one trailing dot, and validates
// the result: validHostShape (the same label rules a route host is held to)
// AND at least one interior dot — a bare label like "localhost" is never a
// public hostname, however it parses.
func NormalizeAliasHost(raw string) (string, bool) {
	h := strings.ToLower(raw)
	h = strings.TrimSuffix(h, ".")
	if !validHostShape(h) || !strings.Contains(h, ".") {
		return "", false
	}
	return h, true
}

// HostDenied reports whether host equals any entry in deny, or is a
// subdomain of one (ends in "."+entry). Empty entries are skipped, so a
// deny list padded with "" (e.g. from a blank config line) can never match
// every host.
func HostDenied(host string, deny []string) bool {
	for _, entry := range deny {
		if entry == "" {
			continue
		}
		if host == entry || strings.HasSuffix(host, "."+entry) {
			return true
		}
	}
	return false
}

// ErrCatchallNeedsWildcard is returned by SetClaimCapabilities for a
// catchall request without wildcard: a catch-all nobody can serve TLS for
// is a config error, not a state — refused at the write path, never stored.
var ErrCatchallNeedsWildcard = errors.New("catchall requires wildcard (no cert could serve the catch-all)")

// SetClaimCapabilities is the ONLY writer of a claim's Wildcard/Catchall
// fields. AttachClaim's converge deliberately repoints Route and nothing
// else — it can preserve these fields but never set them (#151's ruling) —
// so capability changes go through this CAS read-modify-write, which
// preserves every other field. Owner-gated: a caller who does not hold the
// claim gets the same neutral ErrHostUnavailable the attach door uses, and
// a missing claim answers identically (no existence oracle).
func claimRawSetClaimCapabilities(ctx context.Context, s release.Store, host, account, app string, wildcard, catchall bool) (changed bool, err error) {
	if catchall && !wildcard {
		return false, ErrCatchallNeedsWildcard
	}
	for attempt := 0; ; attempt++ {
		cur, etag, err := getClaimETag(ctx, s, host)
		if errors.Is(err, os.ErrNotExist) {
			return false, ErrHostUnavailable
		} else if err != nil {
			return false, err
		}
		// An instance catch-all has no capabilities to set: it answers as a
		// claim the caller does not hold. No door reaches this with a "*"
		// host; the check keeps it true for any caller that ever does.
		if cur.Account != account || cur.App != app || cur.Instances {
			return false, ErrHostUnavailable
		}
		if cur.Wildcard == wildcard && cur.Catchall == catchall {
			return false, nil
		}
		next := *cur
		next.Wildcard = wildcard
		next.Catchall = catchall
		body, err := json.Marshal(next)
		if err != nil {
			return false, err
		}
		if _, err := s.Put(ctx, ClaimKey(host), body, etag); err == nil {
			return true, nil
		} else if errors.Is(err, release.ErrCASConflict) && attempt < 3 {
			continue
		} else {
			return false, err
		}
	}
}

// MaxPathsPerClaim bounds a claim's prefix map. Unlike maxWildcardDomains
// this defends no external budget — there is no ACME equivalent for a path
// row — it bounds the claim object's size and the per-box fold that reads it
// every fast-converge tick. At roughly 40 bytes an entry this is a ~400KB
// object refolded every couple of seconds, which is comfortable; sharding a
// host's map across objects is deliberately not built until a real host
// approaches this number.
const MaxPathsPerClaim = 10000

// ErrTooManyPaths is returned by SetClaimPaths for a map above
// MaxPathsPerClaim. Refused whole: a silently truncated map would route a
// subset of accounts and look successful.
var ErrTooManyPaths = errors.New("too many path prefixes")

// ErrBadPathPrefix is returned by SetClaimPaths for a key that is not a bare
// single path segment.
var ErrBadPathPrefix = errors.New("path prefix must be a single bare segment")

// ErrBadPathTarget is returned by SetClaimPaths for a VALUE that is not a
// normalised hostname. A sentinel rather than a bare fmt.Errorf so the API
// door above can answer it as the caller's error (422, naming the entry) —
// without it, the only way to tell a malformed target from a store failure
// would be to match on the message text.
var ErrBadPathTarget = errors.New("path target is not a normalised hostname")

// validPathPrefix reports whether p is a bare first path segment: non-empty,
// no slashes, and nothing that would not survive a URL path intact. The edge
// matches the request's first segment by EQUALITY, so anything that cannot be
// a first segment could never match and must not be stored.
func validPathPrefix(p string) bool {
	if p == "" || len(p) > 255 {
		return false
	}
	for i := 0; i < len(p); i++ {
		c := p[i]
		switch {
		case c >= 'a' && c <= 'z', c >= 'A' && c <= 'Z', c >= '0' && c <= '9':
		case c == '-' || c == '_' || c == '.' || c == '~':
		default:
			return false
		}
	}
	// "." and ".." would be normalised away by any path cleaner between the
	// browser and here, so a row keyed on either is unreachable by
	// construction.
	return p != "." && p != ".."
}

// SetClaimPaths is the ONLY writer of a claim's Paths field, the same
// single-writer discipline SetClaimCapabilities holds over Wildcard/Catchall
// and for the same reason: AttachClaim's converge repoints Route and nothing
// else, so it can preserve this map but must never invent or strip it.
//
// The write is WHOLESALE — paths replaces the stored map rather than merging
// into it. That is the contract the caller's platform relies on: it
// regenerates the map from its own database and publishes the result, so an
// entry it no longer lists must disappear. Merging would make rollback
// impossible to express.
//
// Owner-gated exactly as SetClaimCapabilities is: a caller who does not hold
// the claim gets the neutral ErrHostUnavailable, and a missing claim answers
// identically, so this door is not an existence oracle.
func claimRawSetClaimPaths(ctx context.Context, s release.Store, host, account, app string, paths map[string]string) (changed bool, err error) {
	if len(paths) > MaxPathsPerClaim {
		return false, ErrTooManyPaths
	}
	for prefix, target := range paths {
		if !validPathPrefix(prefix) {
			return false, ErrBadPathPrefix
		}
		// The target must be a plausible hostname. Whether it is a route this
		// account owns is decided by the reconcile pass, which — unlike this
		// door — can see the registry.
		if n, ok := NormalizeAliasHost(target); !ok || n != target {
			return false, fmt.Errorf("domains: path prefix %q: target %q: %w", prefix, target, ErrBadPathTarget)
		}
	}
	for attempt := 0; ; attempt++ {
		cur, etag, err := getClaimETag(ctx, s, host)
		if errors.Is(err, os.ErrNotExist) {
			return false, ErrHostUnavailable
		} else if err != nil {
			return false, err
		}
		// Nor prefix maps: the same answer, for the same reason.
		if cur.Account != account || cur.App != app || cur.Instances {
			return false, ErrHostUnavailable
		}
		if samePaths(cur.Paths, paths) {
			return false, nil
		}
		next := *cur
		if len(paths) == 0 {
			next.Paths = nil // omitempty: an empty map and no map are one state
		} else {
			next.Paths = make(map[string]string, len(paths))
			for k, v := range paths {
				next.Paths[k] = v
			}
		}
		body, err := json.Marshal(next)
		if err != nil {
			return false, err
		}
		if _, err := s.Put(ctx, ClaimKey(host), body, etag); err == nil {
			return true, nil
		} else if errors.Is(err, release.ErrCASConflict) && attempt < 3 {
			continue
		} else {
			return false, err
		}
	}
}

// samePaths reports whether two prefix maps are equal, treating nil and empty
// as the same state. Republishing an unchanged map is the COMMON case — the
// caller republishes wholesale as a repair — so this is what keeps a repair
// from costing a bucket write and a fleet-wide edge reload.
func samePaths(a, b map[string]string) bool {
	if len(a) != len(b) {
		return false
	}
	for k, v := range a {
		if b[k] != v {
			return false
		}
	}
	return true
}
func AttachInstanceCatchall(ctx context.Context, s release.Store, parent, account, app, createdAt, createdBy string) (claimResult0 bool, claimResult1 error) {
	claimResult1 = release.WithAppMutation(ctx, s, account, app, "domains.AttachInstanceCatchall", func(claimContext context.Context) error {
		claimResult0, claimResult1 = claimRawAttachInstanceCatchall(claimContext, s, parent, account, app, createdAt, createdBy)
		return claimResult1
	})
	return
}
func DetachClaim(ctx context.Context, s release.Store, host, account, app string) (claimResult0 bool, claimResult1 error) {
	claimResult1 = release.WithAppMutation(ctx, s, account, app, "domains.DetachClaim", func(claimContext context.Context) error {
		claimResult0, claimResult1 = claimRawDetachClaim(claimContext, s, host, account, app)
		return claimResult1
	})
	return
}
func SetClaimCapabilities(ctx context.Context, s release.Store, host, account, app string, wildcard, catchall bool) (claimResult0 bool, claimResult1 error) {
	claimResult1 = release.WithAppMutation(ctx, s, account, app, "domains.SetClaimCapabilities", func(claimContext context.Context) error {
		claimResult0, claimResult1 = claimRawSetClaimCapabilities(claimContext, s, host, account, app, wildcard, catchall)
		return claimResult1
	})
	return
}
func SetClaimPaths(ctx context.Context, s release.Store, host, account, app string, paths map[string]string) (claimResult0 bool, claimResult1 error) {
	claimResult1 = release.WithAppMutation(ctx, s, account, app, "domains.SetClaimPaths", func(claimContext context.Context) error {
		claimResult0, claimResult1 = claimRawSetClaimPaths(claimContext, s, host, account, app, paths)
		return claimResult1
	})
	return
}