#!/bin/sh
# OpenTusk installer — https://get.opentusk.ai
#
#   curl -fsSL https://get.opentusk.ai | sh
#
# Options (environment variables):
#   TUSKD_VERSION      pin a release, e.g. TUSKD_VERSION=v0.5.0 (default: latest)
#   TUSKD_INSTALL_DIR  install destination (default: ~/.local/bin)
#
# Releases are published on GitHub (github.com/mindfulagents/tuskd). The
# script detects your platform, downloads the release tarball, verifies its
# SHA-256 checksum against the published .sha256 file, and installs the
# single `tuskd` binary. It never uses sudo.

set -u

REPO="${TUSKD_REPO:-mindfulagents/tuskd}"
BASE="${TUSKD_BASE_URL:-https://github.com/$REPO/releases}"
INSTALL_DIR="${TUSKD_INSTALL_DIR:-$HOME/.local/bin}"

say()  { printf '%s\n' "$*" >&2; }
fail() { say "install.sh: error: $*"; exit 1; }

command -v curl >/dev/null 2>&1 || fail "curl is required"
command -v tar  >/dev/null 2>&1 || fail "tar is required"

# ── Platform detection ────────────────────────────────────────────────
OS=$(uname -s)
ARCH=$(uname -m)
case "$OS-$ARCH" in
  Darwin-arm64)              TARGET="aarch64-apple-darwin" ;;
  Darwin-x86_64)             TARGET="x86_64-apple-darwin" ;;
  Linux-x86_64)              TARGET="x86_64-unknown-linux-musl" ;;
  Linux-aarch64|Linux-arm64) TARGET="aarch64-unknown-linux-musl" ;;
  *)                         fail "unsupported platform: $OS/$ARCH" ;;
esac

# ── Checksum tool ─────────────────────────────────────────────────────
if command -v shasum >/dev/null 2>&1; then
  sha256() { shasum -a 256 "$1" | awk '{print $1}'; }
elif command -v sha256sum >/dev/null 2>&1; then
  sha256() { sha256sum "$1" | awk '{print $1}'; }
else
  fail "need shasum or sha256sum to verify the download"
fi

# ── Resolve URL ───────────────────────────────────────────────────────
# Release assets are named without the version (tuskd-<target>.tar.gz),
# so "latest" needs no version lookup at all.
TARBALL="tuskd-$TARGET.tar.gz"
VERSION="${TUSKD_VERSION:-}"
if [ -z "$VERSION" ]; then
  LABEL="latest"
  URL="$BASE/latest/download/$TARBALL"
else
  VERSION="v${VERSION#v}"
  LABEL="$VERSION"
  URL="$BASE/download/$VERSION/$TARBALL"
fi

# ── Download and verify ───────────────────────────────────────────────
TMP=$(mktemp -d) || fail "mktemp failed"
trap 'rm -rf "$TMP"' EXIT INT TERM

say "opentusk: downloading tuskd $LABEL ($TARGET)"
curl -fsSL -o "$TMP/$TARBALL" "$URL" \
  || fail "download failed: $URL (is $LABEL a published release? v0.5.0 is the oldest with this layout)"
curl -fsSL -o "$TMP/$TARBALL.sha256" "$URL.sha256" \
  || fail "checksum file missing: $URL.sha256"

# Accept both "<hash>" and "<hash>  <filename>" checksum formats
WANT=$(awk '{print $1; exit}' "$TMP/$TARBALL.sha256")
GOT=$(sha256 "$TMP/$TARBALL")
[ -n "$WANT" ] && [ "$GOT" = "$WANT" ] \
  || fail "SHA-256 verification FAILED — refusing to install"
say "opentusk: checksum verified"

tar -xzf "$TMP/$TARBALL" -C "$TMP" || fail "could not extract $TARBALL"
BIN="$TMP/tuskd"
[ -f "$BIN" ] || BIN=$(find "$TMP" -type f -name tuskd 2>/dev/null | head -n 1)
[ -n "$BIN" ] && [ -f "$BIN" ] || fail "tarball did not contain the tuskd binary"

# ── Install ───────────────────────────────────────────────────────────
mkdir -p "$INSTALL_DIR" || fail "cannot create $INSTALL_DIR"
install -m 0755 "$BIN" "$INSTALL_DIR/tuskd" 2>/dev/null \
  || { cp "$BIN" "$INSTALL_DIR/tuskd" && chmod 0755 "$INSTALL_DIR/tuskd"; } \
  || fail "cannot write to $INSTALL_DIR"

say "opentusk: installed $INSTALL_DIR/tuskd ($LABEL)"

case ":$PATH:" in
  *":$INSTALL_DIR:"*) ;;
  *) say ""
     say "  $INSTALL_DIR is not on your PATH. Add it with:"
     say "    export PATH=\"$INSTALL_DIR:\$PATH\""
     say "" ;;
esac

say "opentusk: get started →  mkdir my-vault && cd my-vault && tuskd setup"
say "opentusk: docs        →  https://opentusk.ai/docs"