# SciMesh installer for Windows: downloads the coordinator binary for this
# machine from the latest GitHub release and installs it under %LOCALAPPDATA%.
#
#   powershell -ExecutionPolicy Bypass -c "irm https://raw.githubusercontent.com/emil28092005/SciMesh/main/install.ps1 | iex"
#
# Then run:
#
#   coordinator serve --open
$ErrorActionPreference = "Stop"

# Public half of the Ed25519 key that signs SHA256SUMS.txt in releases (see
# install.sh). Verification needs the openssl binary; without it the installer
# falls back to checksum verification with a warning.
$ScimeshSigningPubKey = "MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKCAQEA01rjmCme4W4zAgBwbO00LvwgnB1srlg0LbooRG8ej7iNxzOtJ8vjRFR2Cu7z7OKjoDo9/0GW3pvcwB+ndBB6yUwht33IRwdsnbioBI4M7LL+yC1ubi4fJ5bigOgZ9VsVqKdU3T9GYxmrfJF1UexiOg6HjoRLO3V4Id+3e/CiI5Sr8UMfJMXUfO3uiEs9RpstxpP1V/UU4YDicTF0QjkOESimEwwXBG4z3VcVmQtqkb7Q3413iekTdQ13093GKAKp0Q2ia1TpB2su6ELUhHAqhmK88cJ73Opy1uEVye0twov4BFTu5GkxgazNTuU//aYVWVpd/NAlD+VVSmpDsbfBBQIDAQAB"

$Repo = "emil28092005/SciMesh"
$Component = if ($env:SCIMESH_COMPONENT) { $env:SCIMESH_COMPONENT } else { "coordinator" }
$Version = if ($env:SCIMESH_VERSION) { $env:SCIMESH_VERSION } else { "latest" }
$InstallDir = if ($env:SCIMESH_INSTALL_DIR) {
    $env:SCIMESH_INSTALL_DIR
} else {
    Join-Path $env:LOCALAPPDATA "SciMesh"
}
# Auto-start the component right after install and open its UI (the control
# room for the coordinator, the local setup wizard for the worker). Set
# SCIMESH_AUTO_START=0 to install only.
$AutoStart = if ($env:SCIMESH_AUTO_START) { $env:SCIMESH_AUTO_START } else { "1" }

switch ($Component) {
    "coordinator" { $Binary = "coordinator" }
    "worker"      { $Binary = "worker-agent" }
    default       { throw "unknown component: $Component (use 'coordinator' or 'worker')" }
}

$Arch = switch ($env:PROCESSOR_ARCHITECTURE) {
    "AMD64" { "amd64" }
    "ARM64" { "arm64" }
    default { throw "unsupported architecture: $env:PROCESSOR_ARCHITECTURE" }
}

if ($Version -eq "latest") {
    Write-Host "Resolving the newest SciMesh release (including pre-releases)..."
    # /releases/latest only sees stable releases; the API list is newest-first
    # across all channels.
    try {
        $Releases = Invoke-RestMethod -Uri "https://api.github.com/repos/$Repo/releases?per_page=1"
        if ($Releases -and $Releases[0].tag_name) {
            $Version = $Releases[0].tag_name
            Write-Host "  -> $Version"
        } else {
            Write-Host "  -> falling back to the stable latest release"
        }
    } catch {
        Write-Host "  -> falling back to the stable latest release"
    }
}

$Url = "https://github.com/$Repo/releases/download/$Version/$Binary-windows-$Arch.exe"

New-Item -ItemType Directory -Force -Path $InstallDir | Out-Null
$Target = Join-Path $InstallDir "$Binary.exe"

Write-Host "Downloading $Url"
Invoke-WebRequest -Uri $Url -OutFile "$Target.tmp"

# Verify the SHA-256 checksum from the release before installing (see
# install.sh for the caveats). $env:SCIMESH_SKIP_VERIFY -eq "1" bypasses.
if ($env:SCIMESH_SKIP_VERIFY -ne "1") {
    try {
        $SumUrl = "https://github.com/$Repo/releases/download/$Version/SHA256SUMS.txt"

        # Ed25519 signature over the checksum file, when openssl is present.
        # Both files are fetched with -OutFile so their bytes match the
        # release exactly (string pipelines would rewrite line endings).
        $openssl = Get-Command openssl -ErrorAction SilentlyContinue
        if ($env:SCIMESH_SKIP_SIGNATURE -ne "1" -and $openssl) {
            $PubFile = Join-Path $env:TEMP "scimesh-signing-pub.pem"
            $SumFile = Join-Path $env:TEMP ("scimesh-sums-" + [guid]::NewGuid().ToString("N") + ".txt")
            $SigFile = "$SumFile.sig"
            Set-Content -Path $PubFile -Value @("-----BEGIN PUBLIC KEY-----", $ScimeshSigningPubKey, "-----END PUBLIC KEY-----")
            try {
                Invoke-WebRequest -Uri $SumUrl -OutFile $SumFile
                Invoke-WebRequest -Uri "$SumUrl.sig" -OutFile $SigFile
                & $openssl.Source dgst -sha256 -verify $PubFile -signature $SigFile $SumFile 2>&1 | Out-Null
                if ($LASTEXITCODE -eq 0) {
                    Write-Host "Signature verified (RSA-2048/SHA-256)"
                } else {
                    Remove-Item -Force "$Target.tmp"
                    throw "the release signature does not verify; the download channel may be tampered with"
                }
            } catch {
                Remove-Item -Force "$Target.tmp"
                throw "signature verification failed: $($_.Exception.Message)"
            } finally {
                Remove-Item -Force $PubFile, $SumFile, $SigFile -ErrorAction SilentlyContinue
            }
        } elseif ($env:SCIMESH_SKIP_SIGNATURE -ne "1") {
            Write-Host "WARNING: openssl not found; falling back to checksum verification only"
        }

        $BinaryName = Split-Path $Url -Leaf
        $SumFileCheck = Join-Path $env:TEMP ("scimesh-sums-check-" + [guid]::NewGuid().ToString("N") + ".txt")
        Invoke-WebRequest -Uri $SumUrl -OutFile $SumFileCheck
        $Line = (Get-Content $SumFileCheck -Raw -ErrorAction SilentlyContinue -split "`n") | Where-Object { $_.Trim().EndsWith("  " + $BinaryName) } | Select-Object -First 1
        if ($Line) {
            $Expected = ($Line -split "\s+")[0]
            $Actual = (Get-FileHash -Algorithm SHA256 -Path "$Target.tmp").Hash.ToLower()
            if ($Actual -ne $Expected.ToLower()) {
                Remove-Item -Force "$Target.tmp", $SumFileCheck
                throw "checksum mismatch for $Binary (got $Actual, want $Expected)"
            }
            Write-Host "Checksum verified ($($Expected.Substring(0,12))...)"
        } else {
            Write-Host "WARNING: no checksum entry for $Binary; skipping verification"
            Remove-Item -Force $SumFileCheck -ErrorAction SilentlyContinue
        }
    } catch {
        Write-Host "WARNING: could not verify checksum ($($_.Exception.Message)); continuing"
    }
}

Move-Item -Force "$Target.tmp" $Target

Write-Host ""
Write-Host "SciMesh $Component installed: $Target"
& $Target --version
Write-Host ""
if ($Component -eq "coordinator") {
    if ($AutoStart -eq "1") {
        Write-Host "Starting the platform and opening the admin console in your browser..."
        Write-Host "(stop it with Ctrl-C; it keeps your data in ~\.scimesh)"
        Write-Host ""
        & $Target serve --open
    } else {
        Write-Host "Start the platform (one command, everything embedded):"
        Write-Host "  $Target serve --open"
        Write-Host ""
        Write-Host "Your data lives in ~\.scimesh. The admin login is printed on first start."
    }
} else {
    if ($AutoStart -eq "1") {
        Write-Host "Starting the local setup wizard in your browser..."
        Write-Host "(stop it with Ctrl-C; it keeps the configuration in ~\.scimesh-worker)"
        Write-Host ""
        & $Target setup
    } else {
        Write-Host "The worker needs Python 3 with the scimesh package, then a coordinator"
        Write-Host "to connect to. Point the local wizard at it:"
        Write-Host ""
        Write-Host "  $Target setup"
        Write-Host ""
        Write-Host "Or run it with environment variables:"
        Write-Host ""
        Write-Host "  set COORDINATOR_URL=http://COORDINATOR_HOST:8080"
        Write-Host "  set WORKER_AUTH_TOKEN=<worker token from the coordinator>"
        Write-Host "  set WORK_DIR=%USERPROFILE%\scimesh-worker"
        Write-Host "  $Target"
        Write-Host ""
        Write-Host "For a coordinator started with 'coordinator serve', the worker token is"
        Write-Host "in ~\.scimesh\worker.token on that machine. Set SCIMESH_PIP_PACKAGE to"
        Write-Host "install scimesh into a managed venv, or install it yourself:"
        Write-Host "  set SCIMESH_PIP_PACKAGE=<your wheel or index>"
        Write-Host "  $Target setup"
    }
}