package domains

// reservedSqids are the labels no account may ever be given as its sqid
// (#285, Paul's ruling 2026-10-14).
//
// Why: an account's apps live at <app>.<sqid>.<apps-domain>, and the
// deployment's own infrastructure also hangs labels directly under the apps
// domain. When the two meet, DNS answers for the infrastructure, not the
// account. On 2026-10-13 flagship gained `*.dev.oncarlos.com` pointing at the
// dev deployment's box, and Sqid(1168) is "dev": every app of account 1168
// would have resolved to dev's edge, and dev's edge would have tried to
// issue certificates for them.
//
// The alphabet and the offset stay frozen. Instead, NextAccountID steps over
// any id whose sqid is listed here, so the id is simply never handed out.
// Existing accounts are untouched: console.MaterializeAccounts logs any live
// account that holds a listed sqid, so adding a label that some account
// already has shows up on the next console start rather than silently.
//
// Only list labels that Sqid can actually produce. TestReservedSqidsAreProducible
// fails on any other entry, so dead entries cannot creep in. A label cannot
// be produced when it:
//   - contains i, l or o (not in the frozen alphabet): relay, platform,
//     console, mail, tunnel, static;
//   - has fewer than 3 letters (sqidOffset's floor): us, uk, au, eu;
//   - starts with "a" (base 23 has no leading zero digit): acme, app, api,
//     admin, assets, auth;
//   - contains anything but lowercase letters: eu-west-1, _acme-challenge.
//
// Extending: add the label with a comment naming where it comes from. The
// skip only matters for ids that have not been minted yet, so adding a label
// is always safe. Removing one is safe too, but once the allocator has
// passed its id that id stays unused for good (allocation is "one past the
// highest id in the bucket", so nothing goes back for it).
var reservedSqids = []string{
	// dev.oncarlos.com: the dev deployment's apps domain. Flagship's Route53
	// zone has `*.dev.oncarlos.com A <dev edge>` (carloku-infrastructure
	// dns53.tf, oncarlos_dev_wildcard, #9). Sqid(1168).
	"dev",
	// edge.<apps-domain>: the steering hostname the converger publishes and
	// health-checks on every armed edge (steering.ConvergeDeployment,
	// edge steeringprobe, console reservedDomains). Sqid(49868).
	"edge",
	// www.<apps-domain>: not served today, but it is the label anyone would
	// add next for the apps domain's own apex site, and a tenant holding it
	// would look like the platform's own website. Held back pre-emptively;
	// Sqid(9978).
	"www",
}

// ReservedSqids returns a copy of the labels no account may be given as its
// sqid. A copy, so no caller can change what the allocator skips.
func ReservedSqids() []string {
	return append([]string(nil), reservedSqids...)
}

// IsReservedSqid reports whether s is a label no account may be given.
func IsReservedSqid(s string) bool {
	for _, r := range reservedSqids {
		if s == r {
			return true
		}
	}
	return false
}

// skipReservedIDs returns id, or the first id after it whose sqid is not
// reserved. A pure function of the id and the list, which is what makes the
// skip safe without any stored state: every minter, on every box and after
// every restart, steps over exactly the same ids.
func skipReservedIDs(id int64) int64 {
	for IsReservedSqid(Sqid(id)) {
		id++
	}
	return id
}