#!/bin/bash

set -euo pipefail
umask 077

fail() {
  printf '%s\n' "$1" >&2
  exit 1
}

[[ "$(uname -s)" == "Darwin" ]] || fail "Visual Standard / Motion Graphics Creator supports macOS only."
command -v curl >/dev/null 2>&1 || fail "curl is required."
command -v shasum >/dev/null 2>&1 || fail "shasum is required."
command -v tar >/dev/null 2>&1 || fail "tar is required."
command -v node >/dev/null 2>&1 || fail "Node.js 20 or newer is required before installing Visual Standard / Motion Graphics Creator."
command -v npm >/dev/null 2>&1 || fail "npm is required before installing Visual Standard / Motion Graphics Creator."
command -v claude >/dev/null 2>&1 || fail "Claude Code must be installed, signed in, and available on PATH."

NODE_MAJOR="$(node -p 'process.versions.node.split(".")[0]')"
[[ "$NODE_MAJOR" =~ ^[0-9]+$ ]] && (( NODE_MAJOR >= 20 )) || fail "Node.js 20 or newer is required."

BOOTSTRAP_URL="https://install.visualstandard.io/visual-standard-bootstrap-1.0.0.tgz"
BOOTSTRAP_SHA256="8f5683e5c57344eff51ff52010ca224ca7a4f3433398cdcb2e2a610ab4692c61"
API_BASE_URL="https://beta.visualstandard.io"
RELEASE_CHANNEL="founding-beta"
[[ "$BOOTSTRAP_URL" == https://* ]] || fail "The approved public bootstrap URL is not configured."
[[ "$BOOTSTRAP_SHA256" =~ ^[a-f0-9]{64}$ ]] || fail "The approved public bootstrap checksum is not configured."
[[ "$API_BASE_URL" == https://* && "$API_BASE_URL" != *.invalid ]] || fail "The approved TEST API URL is not configured."
[[ "$RELEASE_CHANNEL" =~ ^[a-z0-9][a-z0-9-]{1,62}$ ]] || fail "The approved release channel is not configured."

TEMP_DIR="$(mktemp -d)"
SECRET_FILE="$TEMP_DIR/license-key"
TTY_HIDDEN=0
cleanup() {
  if [[ "$TTY_HIDDEN" == "1" ]]; then
    stty echo < /dev/tty 2>/dev/null || true
  fi
  rm -rf "$TEMP_DIR"
}
trap cleanup EXIT HUP INT TERM

ARCHIVE="$TEMP_DIR/bootstrap.tgz"
curl -fsSL --proto '=https' --tlsv1.2 "$BOOTSTRAP_URL" -o "$ARCHIVE"
ACTUAL_SHA256="$(shasum -a 256 "$ARCHIVE" | awk '{print $1}')"
[[ "$ACTUAL_SHA256" == "$BOOTSTRAP_SHA256" ]] || fail "Public bootstrap checksum verification failed."

while IFS= read -r ENTRY; do
  [[ "$ENTRY" == package/* ]] || fail "Public bootstrap archive has an unsafe path."
  [[ "$ENTRY" != /* && "$ENTRY" != *"/../"* && "$ENTRY" != ../* && "$ENTRY" != */.. ]] || fail "Public bootstrap archive has path traversal."
done < <(tar -tzf "$ARCHIVE")
tar -tvzf "$ARCHIVE" | awk 'substr($0,1,1)!="-" && substr($0,1,1)!="d" {exit 1}' || fail "Public bootstrap archive contains links or special files."
tar -xzf "$ARCHIVE" -C "$TEMP_DIR"

if stty -g < /dev/tty >/dev/null 2>&1; then
  printf 'Visual Standard license key (VS1): ' > /dev/tty
  stty -echo < /dev/tty
  TTY_HIDDEN=1
  IFS= read -r LICENSE_KEY < /dev/tty || true
  stty echo < /dev/tty
  TTY_HIDDEN=0
  printf '\n' > /dev/tty
elif command -v osascript >/dev/null 2>&1; then
  LICENSE_KEY="$(osascript -e 'text returned of (display dialog "Enter your Visual Standard license key (VS1)." default answer "" with hidden answer buttons {"Cancel", "Continue"} default button "Continue" cancel button "Cancel" with title "Motion Graphics Creator")')" || fail "License entry was cancelled."
else
  fail "Secure license entry requires either an interactive terminal or the macOS dialog service."
fi
[[ ${#LICENSE_KEY} -ge 12 && ${#LICENSE_KEY} -le 128 && "$LICENSE_KEY" =~ ^VS1-[A-Z0-9][A-Z0-9-]*[A-Z0-9]$ ]] || fail "License key format is invalid. Expected a VS1 key."
printf '%s\n' "$LICENSE_KEY" > "$SECRET_FILE"
unset LICENSE_KEY
chmod 600 "$SECRET_FILE"

VISUAL_STANDARD_LICENSE_FILE="$SECRET_FILE" VISUAL_STANDARD_API_BASE_URL="$API_BASE_URL" VISUAL_STANDARD_RELEASE_CHANNEL="$RELEASE_CHANNEL" node "$TEMP_DIR/package/alpha/bootstrap.mjs" "$@"