<?php
declare(strict_types=1);
require __DIR__.'/common.php';
$path=parse_url($_SERVER['REQUEST_URI']??'',PHP_URL_PATH);$method=$_SERVER['REQUEST_METHOD']??'';
$allow=['/__poc_boundary'=>'GET','/api/Coupon/list'=>'GET','/api/MyCoupon/list'=>'GET','/api/MyCoupon/receive'=>'POST'];
if(($allow[$path]??null)!==$method){http_response_code(403);echo '{"coupon_allowlist":false}';return;}
$root=getenv('COUPON_APP_ROOT');$runtime=getenv('PILOT_RUNTIME');$_SERVER['SCRIPT_FILENAME']=$root.'/public/index.php';$_SERVER['SCRIPT_NAME']='/index.php';$_SERVER['PHP_SELF']='/index.php';
$externalAttempts=0;spl_autoload_register(static function($class)use(&$externalAttempts,$runtime):void{if(strpos(strtolower($class),'app\\common\\library\\storage\\')===0||in_array(strtolower($class),['app\\common\\library\\upload','app\\common\\library\\payment'],true)){++$externalAttempts;file_put_contents($runtime.'/external-private.jsonl',"{\"kind\":\"forbidden_class\"}\n",FILE_APPEND|LOCK_EX);throw new RuntimeException('External/file class forbidden');}},true,true);
try{
    $app=cpBootstrap($root,$runtime);$sha=hash_file('sha256',(new ReflectionClass(\app\api\model\Coupon::class))->getFileName());if($sha!=='17f35c7471ae9ffdd5e824a49a7da6ba4a3ee8f35d1445b8987348202ef131da'){throw new RuntimeException('Actual serializer drift');}
    if($path==='/__poc_boundary'){echo json_encode(['coupon_allowlist'=>true,'external_stubs'=>class_exists(\app\common\Serve::class,false)&&class_exists(\app\common\UserApi::class,false),'new_private_root'=>realpath(root_path())===realpath($root),'file_cache'=>strtolower($app->config->get('cache.default'))==='file','coupon_sha256'=>$sha]);return;}
    $scenario=$_SERVER['HTTP_X_PILOT_SCENARIO']??'';if(!preg_match('/^PILOT_CPN_[A-Z0-9_]{1,50}$/D',$scenario)){throw new RuntimeException('Scenario gate');}
    $map=json_decode((string)file_get_contents($runtime.'/fixture_map.json'),true);
    if(!hash_equals($map['token'],$_SERVER['HTTP_ACCESS_TOKEN']??'')){http_response_code(403);echo '{"private_token_guard":false}';return;}
    if($method==='POST'){
        $id=$_POST['couponId']??null;if(!is_scalar($id)||!ctype_digit((string)$id)||(int)$id!==$map['coupon_id']){http_response_code(403);echo '{"owned_coupon_guard":false}';return;}
        $own=cpRows(cpPdo(),'SELECT coupon_id FROM yoshop_coupon WHERE coupon_id=? AND name=? AND store_id=10001',[$map['coupon_id'],$map['marker']]);if(count($own)!==1){throw new RuntimeException('Owned coupon source gate');}
    }
    require __DIR__.'/SqlCoverageRecorder.php';$recorder=new SqlCoverageRecorder($runtime.'/queries.jsonl',realpath($root),$scenario);$app->db->listen(static function($sql,$time=null)use($recorder){if(strpos($sql,'CONNECT:')!==0){$recorder->observe($sql,$time);}});register_shutdown_function([$recorder,'finish']);
    register_shutdown_function(static function()use($runtime,$scenario,&$externalAttempts){file_put_contents($runtime.'/guards.jsonl',json_encode(['scenario'=>$scenario,'external_attempts'=>$externalAttempts])."\n",FILE_APPEND|LOCK_EX);});
    $http=$app->http;$response=$http->run();$response->send();$http->end($response);
}catch(Throwable $e){http_response_code(500);echo json_encode(['private_bootstrap_error'=>get_class($e),'file'=>basename($e->getFile()),'line'=>$e->getLine()]);file_put_contents($runtime.'/errors-private.jsonl',json_encode(['class'=>get_class($e),'file'=>basename($e->getFile()),'line'=>$e->getLine(),'message_sha256'=>hash('sha256',$e->getMessage())])."\n",FILE_APPEND|LOCK_EX);}