<?php
/**
 * Local dev router for the UI audit.
 *
 * Mirrors the .htaccess rules: /public and /api are served as-is, everything
 * else falls through to index.php. Points at the real Supabase so scenes have
 * real data to lay out.
 *
 *   php -S 127.0.0.1:8080 tools/dev-server.php
 */
foreach ([
  'SUPABASE_URL' => 'https://safe-supabase-kong.caprover.al-arcade.com',
  'SUPABASE_ANON_KEY' => 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoiYW5vbiIsImlzcyI6InN1cGFiYXNlIiwiaWF0IjoxNzM1Njg5NjAwLCJleHAiOjE4OTM0NTYwMDB9.31PF6PvP-pSrvRuQwLFptQoejR0W1A7o53lZhEbnz84',
  'SUPABASE_SERVICE_KEY' => 'eyJhbGciOiJIUzI1NiIsInR5cCI6IkpXVCJ9.eyJyb2xlIjoic2VydmljZV9yb2xlIiwiaXNzIjoic3VwYWJhc2UiLCJpYXQiOjE3MzU2ODk2MDAsImV4cCI6MTg5MzQ1NjAwMH0.wNfmuJNkX-bZwD7RbjxOChlRf_3Xm4I7bswEYTcDCg4',
  'STOCKFISH_API' => 'https://stockfishapi.caprover.al-arcade.com',
] as $k => $v) putenv("$k=$v");

$root = dirname(__DIR__);
$path = parse_url($_SERVER['REQUEST_URI'], PHP_URL_PATH);

if (preg_match('#^/(public|api)/#', $path)) {
    $file = $root . $path;
    if (is_file($file)) {
        if (str_ends_with($file, '.php')) { require $file; return true; }
        return false;   // let the built-in server serve the static file
    }
    http_response_code(404);
    return true;
}
// Root-level static files (manifest.json, icons, logo) are served directly in
// production by the .htaccess "file exists" rule; mirror that here so the audit
// does not report a phantom manifest error.
$rootFile = $root . $path;
if ($path !== '/' && is_file($rootFile) && !str_ends_with($rootFile, '.php')) return false;

require $root . '/index.php';
