# Serve the trapos-server gateway (port 4444) for remote/in-game attachment using
# repo-local .env secrets. Mirrors `opencode-serve`. Both TRAPOS_SERVER_PASSWORD and
# OPENCODE_SERVER_PASSWORD are required: an empty one would run the gateway
# unauthenticated, so a missing secret is a fatal error (see also the guard in index.ts).
# This serves plain ws:// — front it with TLS/wss in production (see docs/public-ports.md).
[positional-arguments]
serve *args:
    #!/usr/bin/env bash
    set -euo pipefail
    repo='{{justfile_directory()}}'
    if [ -f "$repo/.env" ]; then set -a; . "$repo/.env"; set +a; fi
    for var in TRAPOS_SERVER_PASSWORD OPENCODE_SERVER_PASSWORD; do
        if [ -z "${!var:-}" ]; then
            printf '%s\n' "serve: $var is empty or unset in .env — refusing to start (run \`just install\` to generate secrets)" >&2
            exit 1
        fi
    done
    export TRAPOS_SERVER_PASSWORD
    export OPENCODE_SERVER_PASSWORD
    export OPENCODE_URL="${OPENCODE_URL:-http://127.0.0.1:4242}"
    export TRAPOS_SERVER_HOST="${TRAPOS_SERVER_HOST:-0.0.0.0}"
    export TRAPOS_SERVER_PORT="${TRAPOS_SERVER_PORT:-4444}"
    exec npm run dev --prefix tools/trapos-server -- "$@"