# CryptoMesh VPN Windows installer. Review this file before running it.
# Read the manifest published atomically with each verified desktop release.
& {
    $ErrorActionPreference = 'Stop'
    if ($env:OS -ne 'Windows_NT') {
        throw 'This command requires Windows. Visit https://cryptomesh-vpn-prod.web.app/download for other platforms.'
    }
    if (-not [Environment]::Is64BitOperatingSystem) {
        throw 'CryptoMesh VPN requires 64-bit Windows.'
    }
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $workDir = Join-Path ([IO.Path]::GetTempPath()) ('cryptomesh-install-' + [Guid]::NewGuid())
    New-Item -ItemType Directory -Path $workDir | Out-Null
    try {
        $installer = Join-Path $workDir 'cryptomesh-vpn-windows-setup.exe'
        $release = Invoke-RestMethod -Uri 'https://cryptomesh-vpn-downloads.web.app/desktop-update.json'
        $artifact = $release.platforms.windows
        $schemaIsInteger = $release.schema_version -is [int] -or $release.schema_version -is [long]
        $buildIsInteger = $release.build -is [int] -or $release.build -is [long]
        $sizeIsInteger = $artifact.size -is [int] -or $artifact.size -is [long]
        $versionPattern = '\A(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\.(?:0|[1-9][0-9]*)\z'
        if (-not $schemaIsInteger -or $release.schema_version -ne 1 -or
            -not $buildIsInteger -or $release.build -lt 1 -or
            $release.version -isnot [string] -or $release.version -cnotmatch $versionPattern -or
            -not $sizeIsInteger -or $artifact.size -lt 1 -or
            $artifact.sha256 -isnot [string] -or $artifact.sha256 -cnotmatch '\A[a-f0-9]{64}\z' -or
            $artifact.url -cne ('https://cryptomesh-vpn-downloads.web.app/desktop-v' + $release.version + '/cryptomesh-vpn-windows-setup.exe')) {
            throw 'Release metadata verification failed. Installation stopped.'
        }
        Write-Host "Downloading CryptoMesh VPN $($release.version)..."
        Invoke-WebRequest -UseBasicParsing -Uri $artifact.url -OutFile $installer
        if ((Get-Item -LiteralPath $installer).Length -ne $artifact.size) {
            throw 'Release download size verification failed. Installation stopped.'
        }
        $expectedHash = $artifact.sha256
        if ((Get-FileHash -LiteralPath $installer -Algorithm SHA256).Hash -ne $expectedHash) {
            throw 'Release checksum verification failed. Installation stopped.'
        }
        if ((Get-AuthenticodeSignature -LiteralPath $installer).Status -ne 'Valid') {
            throw 'Windows signature verification failed. Installation stopped.'
        }
        # Preserve the normal installer UI, administrator approval, and prerequisites.
        # Wait only for Setup: -Wait also waits for the app launched by Finish.
        $process = Start-Process -FilePath $installer -PassThru
        $process.WaitForExit()
        if ($process.ExitCode -eq 3010) {
            Write-Host 'Installed. Restart Windows, then open CryptoMesh VPN and sign in.'
        } elseif ($process.ExitCode -eq 0) {
            Write-Host 'Installed. Open CryptoMesh VPN, sign in, and approve VPN permissions.'
        } else {
            throw "Installer stopped with exit code $($process.ExitCode)."
        }
    } finally {
        Remove-Item -LiteralPath $workDir -Recurse -Force
    }
}