# AERIS OS installer for Windows 10/11 x64 - E:MERGENCE LLC
# https://www.emergencerising.com/aerisOS  -  agent runbook: https://www.emergencerising.com/aerisOS/install.md
#
# Generated by scripts/aeris-front-door.py from the published channel manifest. Do not edit by hand.
#
#   irm https://www.emergencerising.com/aerisOS/install.ps1 | iex
#
# Environment switches (set before running):
#   $env:AERIS_DRY_RUN = '1'        show what would happen; download only the checksum list
#   $env:AERIS_DOWNLOAD_ONLY = '1'  download and verify only; the file stays in the current directory
#
# The installer runs only if its SHA-256 matches the published SHA256SUMS. It runs silently (/S).
& {
    $ErrorActionPreference = 'Stop'
    $ProgressPreference = 'SilentlyContinue'
    $Base = 'https://www.emergencerising.com'
    $SumsUrl = "$Base/aerisOS/windows/SHA256SUMS"
    $ChannelUrl = "$Base/aeris-os-downloads/windows"
    $PublishedVersion = '0.2.7'
    $DryRun = $env:AERIS_DRY_RUN -eq '1'
    $DownloadOnly = $env:AERIS_DOWNLOAD_ONLY -eq '1'

    function Say([string]$Message) { Write-Host "aeris-install: $Message" }
    function Fail([string]$Message) { Write-Host "aeris-install: error: $Message" -ForegroundColor Red; throw "AERIS OS install stopped: $Message" }

    try { [Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12 } catch {}

    Say "AERIS OS by E:MERGENCE - Windows installer (published version $PublishedVersion)"
    $onWindows = [Environment]::OSVersion.Platform -eq [PlatformID]::Win32NT
    if (-not $onWindows) {
        if ($DryRun) { Say 'dry run: this is not Windows; continuing so the plan can be shown' }
        else { Fail 'this installer is for Windows. Linux: curl -fsSL https://www.emergencerising.com/aerisOS/install.sh | sh' }
    } else {
        if (-not [Environment]::Is64BitOperatingSystem) { Fail 'AERIS OS needs 64-bit Windows 10 or 11' }
        if ([Environment]::OSVersion.Version.Major -lt 10) { Fail 'AERIS OS needs Windows 10 or 11' }
        if ($env:PROCESSOR_ARCHITECTURE -eq 'ARM64') { Say 'note: this is an ARM64 PC; the x64 build runs under Windows emulation' }
    }

    Say "checksums: $SumsUrl"
    $sums = [string](Invoke-RestMethod -UseBasicParsing -Uri $SumsUrl)
    $entries = @()
    foreach ($line in ($sums -split "`n")) {
        $m = [regex]::Match($line.Trim(), '^([0-9a-f]{64})\s+\*?(AERIS-OS-[^\s]*Setup\.exe)$')
        if ($m.Success) { $entries += [pscustomobject]@{ Sha = $m.Groups[1].Value; Name = $m.Groups[2].Value } }
    }
    $pick = $entries | Where-Object { $_.Name -match '^AERIS-OS-[0-9]' } | Select-Object -First 1
    if (-not $pick) { $pick = $entries | Select-Object -First 1 }
    if (-not $pick) { Fail 'SHA256SUMS lists no Windows installer' }
    $url = "$ChannelUrl/$($pick.Name)"

    if ($DryRun) {
        Say "dry run: would download $url"
        Say "dry run: would verify SHA-256 $($pick.Sha)"
        if ($DownloadOnly) { Say "dry run: would save it to $(Join-Path (Get-Location) $pick.Name)" }
        else { Say "dry run: would run $($pick.Name) /S" }
        Say 'dry run: nothing was downloaded or installed'
        return
    }

    $dir = Join-Path ([IO.Path]::GetTempPath()) ("aeris-os-install-" + [guid]::NewGuid().ToString('N'))
    New-Item -ItemType Directory -Path $dir | Out-Null
    try {
        $file = Join-Path $dir $pick.Name
        Say "downloading $url"
        Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $file
        $actual = (Get-FileHash -Algorithm SHA256 -Path $file).Hash.ToLowerInvariant()
        if ($actual -ne $pick.Sha) { Fail "SHA-256 mismatch for $($pick.Name): expected $($pick.Sha), got $actual. Nothing was installed." }
        Say "verified SHA-256 $actual"
        if ($DownloadOnly) {
            $dest = Join-Path (Get-Location) $pick.Name
            Copy-Item -Path $file -Destination $dest -Force
            Say "saved $dest (verified). Install with: Start-Process '$dest' -ArgumentList '/S' -Wait"
            return
        }
        Say 'running the installer silently (/S)'
        $proc = Start-Process -FilePath $file -ArgumentList '/S' -Wait -PassThru
        if ($proc.ExitCode -ne 0) { Fail "the installer exited with code $($proc.ExitCode)" }
        Say 'installed'
    } finally {
        Remove-Item -Recurse -Force -Path $dir -ErrorAction SilentlyContinue
    }

    Write-Host ''
    Write-Host 'AERIS OS is installed.'
    Write-Host ''
    Write-Host 'NEXT STEP - hand this to the person (an agent cannot do it):'
    Write-Host '  Open AERIS OS from the Start menu and sign in with an E:MERGENCE account.'
    Write-Host '  Sign-in needs a paid account: $19.99/month includes AERIS OS; the Free plan covers the mobile apps.'
    Write-Host "  Plans: $Base/pricing"
}