#compdef termland-server

autoload -U is-at-least

_termland-server() {
    typeset -A opt_args
    typeset -a _arguments_options
    local ret=1

    if is-at-least 5.2; then
        _arguments_options=(-s -S -C)
    else
        _arguments_options=(-s -C)
    fi

    local context curcontext="$curcontext" state line
    _arguments "${_arguments_options[@]}" : \
'-p+[Listen on TCP port (default when not in subsystem mode)]:PORT:_default' \
'--port=[Listen on TCP port (default when not in subsystem mode)]:PORT:_default' \
'-b+[Bind address for TCP mode]:BIND:_default' \
'--bind=[Bind address for TCP mode]:BIND:_default' \
'--tls-cert=[Path to TLS certificate PEM file (implies --tls)]:TLS_CERT:_default' \
'--tls-key=[Path to TLS private key PEM file (implies --tls)]:TLS_KEY:_default' \
'--quic-port=[UDP port for the QUIC listener. Defaults to the same number as --port — that'\''s fine, they'\''re different protocols/sockets]:QUIC_PORT:_default' \
'--completions=[Generate shell completion script and exit. Usage\: termland-server --completions bash > /etc/bash_completion.d/termland-server]:SHELL:(bash elvish fish powershell zsh)' \
'*--close-session=[Close (terminate) one or more sessions by id and exit. Repeatable (--close-session a --close-session b) or comma-separated (--close-session a,b). Exits non-zero if any given id doesn'\''t correspond to a live session]:ID:_default' \
'--subsystem[Run as SSH subsystem (read/write protocol on stdin/stdout). Register in sshd_config\: Subsystem termland /usr/bin/termland-server --subsystem]' \
'--tls[Enable TLS for TCP connections. Auto-generates a self-signed cert in ~/.config/termland/ if no --tls-cert/--tls-key is provided]' \
'--auth[Require PAM authentication before session creation. Uses the "termland" PAM service, falling back to "login"]' \
'--quic[Also listen for QUIC (UDP) connections, alongside the TCP listener (Q1\: QUIC as a drop-in byte transport, see docs/quic-transport.md). Purely additive — the TCP listener keeps running unchanged. QUIC always requires TLS 1.3, so this reuses --tls-cert/--tls-key (or auto-generates a self-signed cert, same as --tls) regardless of whether --tls itself was also passed for the TCP side]' \
'--list-sessions[List active sessions on this host (session id, mode, size, age, pid, audio) and exit. Reads the session registry directly — no server process needs to be listening for this to work]' \
'-h[Print help]' \
'--help[Print help]' \
'-V[Print version]' \
'--version[Print version]' \
&& ret=0
}

(( $+functions[_termland-server_commands] )) ||
_termland-server_commands() {
    local commands; commands=()
    _describe -t commands 'termland-server commands' commands "$@"
}

if [ "$funcstack[1]" = "_termland-server" ]; then
    _termland-server "$@"
else
    compdef _termland-server termland-server
fi
