# Wyxen bootstrap installer
#
#     irm https://get.wyxen.app | iex
#
# Served as text/plain from get.wyxen.app. Deployed to
# /var/www/wyxen-cdn/get/install.ps1 by deploy/wyxen.sh.
#
# Downloads through https://api.wyxen.app/download/latest rather than straight
# from the CDN, so a PowerShell install is counted exactly like a click on the
# website button. Counting only browser clicks would quietly understate real
# installs, and the number that matters most is the gap between downloads and
# first launches.

#Requires -Version 5.1

$ErrorActionPreference = 'Stop'

$DownloadUrl = 'https://api.wyxen.app/download/latest'
$ManifestUrl = 'https://api.wyxen.app/v1/releases/latest'

function Write-Step { param($m) Write-Host "  $m" -ForegroundColor Cyan }
function Write-Ok   { param($m) Write-Host "  $m" -ForegroundColor Green }
function Write-Bad  { param($m) Write-Host "  $m" -ForegroundColor Yellow }

Write-Host ""
Write-Host "  Wyxen" -ForegroundColor White
Write-Host "  ─────" -ForegroundColor DarkGray

# Windows 11 only. Build 22000 is the 11 boundary; anything lower is 10 or older.
$build = [int](Get-CimInstance Win32_OperatingSystem).BuildNumber
if ($build -lt 22000) {
    Write-Bad "Wyxen targets Windows 11. This machine reports build $build."
    Write-Bad "Install anyway at your own risk from https://wyxen.app"
    return
}

if ([Environment]::Is64BitOperatingSystem -eq $false) {
    Write-Bad "Wyxen is 64-bit only."
    return
}

# TLS 1.2 for Windows PowerShell 5.1, which still defaults to SSL3/TLS1.0 and
# would otherwise fail the handshake outright.
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

$expectedHash = $null
$version = $null
try {
    Write-Step "Checking the current release..."
    $manifest = Invoke-RestMethod -Uri $ManifestUrl -TimeoutSec 20
    $expectedHash = $manifest.sha256
    $version = $manifest.version
    if ($version) { Write-Ok "Latest version: $version" }
} catch {
    # Not fatal. Without the manifest we cannot verify the checksum, and the
    # script says so rather than pretending it did.
    Write-Bad "Could not read the release manifest; continuing without checksum verification."
}

$dest = Join-Path $env:TEMP "WyxenSetup.exe"
if (Test-Path $dest) { Remove-Item $dest -Force }

Write-Step "Downloading the installer..."
try {
    Invoke-WebRequest -Uri $DownloadUrl -OutFile $dest -UseBasicParsing -TimeoutSec 300
} catch {
    Write-Bad "Download failed: $($_.Exception.Message)"
    Write-Bad "Download it manually from https://wyxen.app"
    return
}

$sizeMb = [math]::Round((Get-Item $dest).Length / 1MB, 1)
Write-Ok "Downloaded $sizeMb MB"

if ($expectedHash) {
    Write-Step "Verifying checksum..."
    $actual = (Get-FileHash -Path $dest -Algorithm SHA256).Hash
    if ($actual -ine $expectedHash) {
        # Refuse, loudly, and delete it. A checksum that is checked and then
        # ignored on failure is worse than no checksum at all.
        Remove-Item $dest -Force -ErrorAction SilentlyContinue
        Write-Host ""
        Write-Host "  CHECKSUM MISMATCH — the file was NOT installed." -ForegroundColor Red
        Write-Host "    expected  $expectedHash" -ForegroundColor DarkGray
        Write-Host "    got       $actual" -ForegroundColor DarkGray
        Write-Host "  Report this at https://wyxen.app" -ForegroundColor Red
        Write-Host ""
        return
    }
    Write-Ok "Checksum matches"
}

Write-Step "Starting the installer (it will ask for administrator rights)..."
try {
    Start-Process -FilePath $dest -Verb RunAs
    Write-Host ""
    Write-Ok "Installer launched. Follow the prompts."
    Write-Host ""
} catch {
    Write-Bad "Could not launch the installer: $($_.Exception.Message)"
    Write-Bad "Run it yourself: $dest"
}