<#
install.ps1 — installer for acp (agent-cred-proxy) on Windows.

  irm https://agent-cred-proxy.vikrantpogula.com/install.ps1 | iex

Downloads the right static acp.exe for your CPU, verifies its SHA-256 checksum,
installs it under %LOCALAPPDATA%\acp, and adds that directory to your user PATH.
No dependencies beyond PowerShell 5+.

Environment overrides:
  ACP_INSTALL_DIR   target directory (default: %LOCALAPPDATA%\acp)
  ACP_BASE_URL      download base (default: https://agent-cred-proxy.vikrantpogula.com)
#>

#Requires -Version 5
$ErrorActionPreference = 'Stop'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

function Info($m) { Write-Host "==> $m" -ForegroundColor Cyan }
function Warn($m) { Write-Host "warning: $m" -ForegroundColor Yellow }
function Die($m)  { Write-Host "error: $m" -ForegroundColor Red; exit 1 }

$Base = if ($env:ACP_BASE_URL) { $env:ACP_BASE_URL.TrimEnd('/') } else { 'https://agent-cred-proxy.vikrantpogula.com' }

# --- detect arch -------------------------------------------------------------
$archRaw = $env:PROCESSOR_ARCHITECTURE
switch -Wildcard ($archRaw) {
  'AMD64' { $Arch = 'amd64' }
  'ARM64' { $Arch = 'arm64' }
  'x86'   { $Arch = 'amd64' }  # 32-bit shell on 64-bit Windows; the amd64 build runs via WOW64
  default { Die "unsupported architecture '$archRaw'. See $Base/#downloads for manual options." }
}

$Asset  = "acp-windows-$Arch.exe"
$Url    = "$Base/dl/$Asset"
$SumUrl = "$Url.sha256"

# --- choose install dir ------------------------------------------------------
$Dir = if ($env:ACP_INSTALL_DIR) { $env:ACP_INSTALL_DIR } else { Join-Path $env:LOCALAPPDATA 'acp' }
New-Item -ItemType Directory -Force -Path $Dir | Out-Null
$Dest = Join-Path $Dir 'acp.exe'

# --- download ----------------------------------------------------------------
$Tmp = Join-Path $env:TEMP ("acp-" + [Guid]::NewGuid().ToString('N') + ".exe")
Info "downloading $Asset"
try {
  Invoke-WebRequest -Uri $Url -OutFile $Tmp -UseBasicParsing
} catch {
  Die "download failed: $Url ($($_.Exception.Message))"
}

# --- verify checksum (fail closed if the sum file exists) --------------------
try {
  $expected = (Invoke-WebRequest -Uri $SumUrl -UseBasicParsing).Content.Trim().Split()[0].ToLower()
} catch {
  $expected = $null
}
if ($expected) {
  $actual = (Get-FileHash -Path $Tmp -Algorithm SHA256).Hash.ToLower()
  if ($actual -ne $expected) {
    Remove-Item -Force $Tmp -ErrorAction SilentlyContinue
    Die "checksum mismatch (expected $expected, got $actual)"
  }
  Info "checksum verified"
} else {
  Warn "no checksum published for $Asset; skipping verification"
}

# --- install -----------------------------------------------------------------
Move-Item -Force -Path $Tmp -Destination $Dest
Info "installed acp -> $Dest"

# --- ensure on PATH (user scope) ---------------------------------------------
$userPath = [Environment]::GetEnvironmentVariable('Path', 'User')
if (-not ($userPath -split ';' | Where-Object { $_.TrimEnd('\') -ieq $Dir.TrimEnd('\') })) {
  $newPath = if ([string]::IsNullOrEmpty($userPath)) { $Dir } else { "$userPath;$Dir" }
  [Environment]::SetEnvironmentVariable('Path', $newPath, 'User')
  $env:Path = "$env:Path;$Dir"
  Warn "added $Dir to your user PATH — open a new terminal for it to take effect"
}

Write-Host ""
try { & $Dest version } catch { }
Write-Host ""
Info "Next: acp configure   (opens the setup UI)  then  acp start"