"""Process entry point: ``python -m hux.server``.

Environment: ``HUX_DATA_ROOT`` (tenant PVC path, default /opt/data),
``HUX_BIND`` (default 127.0.0.1), ``HUX_PORT`` (default 8790), ``HUX_FLAGS``,
``HUX_RELAY_KEY``, ``HUX_WORKER_KEY``, ``HUX_BUILD_COMMIT``, ``HUX_IMAGE_DIGEST``.
"""

from __future__ import annotations

import importlib
import os
from pathlib import Path

from hux.http import Router, serve

FAMILIES = (
    "foundation", "events", "memory", "privacy", "organization", "artifacts",
    "modes", "research", "policy", "multimodal", "suggestions", "releases",
)


def build_router(data_root: Path, environ: dict[str, str] | None = None) -> Router:
    """Create a router with every required family registered and route-bound to its flag."""
    router = Router(data_root, environ)
    for name in FAMILIES:
        module = importlib.import_module(f"hux.{name}")
        module.register(router)
    router.bind_capability_routes()
    return router


def bind_address(env: dict[str, str]) -> str:
    """Loopback only: the router is in the same pod, nothing else may reach the service."""
    bind = env.get("HUX_BIND", "127.0.0.1")
    if bind not in {"127.0.0.1", "::1", "localhost"}:
        raise SystemExit(f"refusing to bind {bind}: hux-foundation is loopback-only")
    return bind


def main() -> None:
    """Run the server until killed."""
    env = dict(os.environ)
    router = build_router(Path(env.get("HUX_DATA_ROOT", "/opt/data")), env)
    server = serve(router, bind_address(env), int(env.get("HUX_PORT", "8790")))
    try:
        server.serve_forever()
    finally:
        server.server_close()


if __name__ == "__main__":  # pragma: no cover
    main()