# Koyd per-user installer. Inspect: https://koyd.app/cli/windows
# Save and review this file, then run: .\install.ps1
# Optional: .\install.ps1 --no-address (skip local hostname/certificate setup).
# Respect company policy. Do not bypass script, certificate, or download blocks.
& {
    $ErrorActionPreference = 'Stop'
    $ProgressPreference = 'SilentlyContinue'
    $runtimeVersion = '24.20.0'
    $runtimeHashes = @{ x64 = '5c976096e04e5c2c1f091938926234cc9fbebfe9787ddd149351b3b0ecc707b5'; arm64 = '92949e7764e56e305cb84ea3d575912e822c79e85599362e8d408b04b9ffd326' }
    $architecture = if ($env:PROCESSOR_ARCHITEW6432) { $env:PROCESSOR_ARCHITEW6432 } else { $env:PROCESSOR_ARCHITECTURE }
    $architecture = switch ($architecture) { 'AMD64' { 'x64' } 'ARM64' { 'arm64' } default { throw 'Koyd requires 64-bit Windows (x64 or ARM64).' } }
    $scratch = Join-Path ([IO.Path]::GetTempPath()) ('koyd-get-' + [Guid]::NewGuid().ToString('N'))
    $oldTls = [Net.ServicePointManager]::SecurityProtocol
    $oldOptions = $env:NODE_OPTIONS
    $oldPath = $env:NODE_PATH
    $oldSystemCa = $env:NODE_USE_SYSTEM_CA
    $oldEnvProxy = $env:NODE_USE_ENV_PROXY
    try {
        if ($env:NODE_TLS_REJECT_UNAUTHORIZED -eq '0') { throw 'Koyd installation requires TLS certificate verification. Remove NODE_TLS_REJECT_UNAUTHORIZED=0 and retry.' }
        [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
        New-Item -ItemType Directory -Path $scratch -ErrorAction Stop | Out-Null
        function Get-KoydFile([string] $Address, [string] $Destination, [string] $Hash) {
            try { Invoke-WebRequest -UseBasicParsing -Uri $Address -OutFile $Destination -MaximumRedirection 0 -TimeoutSec 900 }
            catch { throw "Could not download $Address. A network, certificate, proxy, or company policy error stopped the request. Ask IT to review this URL and the block notification; keep security checks enabled." }
            $stream = [IO.File]::OpenRead($Destination)
            $sha256 = [Security.Cryptography.SHA256]::Create()
            try { $actual = [BitConverter]::ToString($sha256.ComputeHash($stream)).Replace('-', '').ToLowerInvariant() }
            finally { $stream.Dispose(); $sha256.Dispose() }
            if ($actual -ne $Hash) { throw "Download checksum mismatch for $Address. Nothing was installed. A gateway may have returned a block page or changed the file. Ask IT to review the download; do not run it." }
        }
        Write-Host ''
        Write-Host '  K O Y D'
        Write-Host '  Preparing your installation'
        Write-Host '  --------------------------------------------------'
        Write-Host '  Installs the app and koyd command for your account.'
        Write-Host '  Local HTTPS setup will request system approval.'
        Write-Host ''
        function Show-KoydPreparation([string] $Status, [int] $Percent) {
            if (-not [Console]::IsOutputRedirected -and -not $env:NO_COLOR) {
                $ProgressPreference = 'Continue'
                Write-Progress -Id 947 -Activity 'Preparing Koyd' -Status $Status -PercentComplete $Percent
            }
        }
        $runtime = Join-Path $scratch 'node.exe'
        $bootstrap = Join-Path $scratch 'bootstrap.cjs'
        Show-KoydPreparation 'Downloading and checking the runtime' 15
        Get-KoydFile "https://nodejs.org/dist/v$runtimeVersion/win-$architecture/node.exe" $runtime $runtimeHashes[$architecture]
        Write-Host '  OK  Private runtime verified'
        Show-KoydPreparation 'Downloading and checking the installer' 75
        Get-KoydFile 'https://koyd.app/install/bootstrap-a667366243327727b9ade991cde65c13e029bf79a30639c982fc34beb82ecb5d.cjs' $bootstrap 'a667366243327727b9ade991cde65c13e029bf79a30639c982fc34beb82ecb5d'
        Write-Host '  OK  Secure installer verified'
        Show-KoydPreparation 'Ready' 100
        & { $ProgressPreference = 'Continue'; Write-Progress -Id 947 -Activity 'Preparing Koyd' -Completed }
        $env:NODE_OPTIONS = ''
        $env:NODE_PATH = ''
        # Use existing OS trust and IT-configured proxies. TLS verification stays on.
        # Explicit settings, including opt-outs, are preserved and inherited by setup.
        if ($null -eq $oldSystemCa) { $env:NODE_USE_SYSTEM_CA = '1' }
        if ($null -eq $oldEnvProxy) { $env:NODE_USE_ENV_PROXY = '1' }
        & $runtime --disable-warning=ExperimentalWarning $bootstrap @args
        if ($LASTEXITCODE -ne 0) { throw 'Koyd installation did not complete. See the message above.' }
    } finally {
        & { $ProgressPreference = 'Continue'; Write-Progress -Id 947 -Activity 'Preparing Koyd' -Completed }
        $env:NODE_OPTIONS = $oldOptions
        $env:NODE_PATH = $oldPath
        $env:NODE_USE_SYSTEM_CA = $oldSystemCa
        $env:NODE_USE_ENV_PROXY = $oldEnvProxy
        [Net.ServicePointManager]::SecurityProtocol = $oldTls
        $resolvedScratch = [IO.Path]::GetFullPath($scratch)
        $tempPrefix = [IO.Path]::GetFullPath([IO.Path]::GetTempPath()).TrimEnd('\') + '\koyd-get-'
        if ($resolvedScratch.StartsWith($tempPrefix, [StringComparison]::OrdinalIgnoreCase) -and (Test-Path -LiteralPath $resolvedScratch)) { Remove-Item -LiteralPath $resolvedScratch -Recurse -Force }
    }
} @args