#!/bin/sh
# Bolt Installer — https://sparcle.app/install.sh
# Works on macOS and Linux.
#
# CANONICAL SOURCE OF TRUTH for the consumer `curl | sh` installer: THIS file,
# bolt-native/scripts/install/install.sh. sparcle-site/public/install.sh is the
# published copy that sparcle.app actually serves, and it must be brought back to
# byte-identical with this one — `scripts/install/check-installer-sync.sh` (run by
# scripts/preflight.sh) fails the ship otherwise. Publishing the site copy is a
# PUBLIC change and needs review before it is deployed. (An earlier version of
# this comment claimed the opposite direction — that this file was the mirror —
# which contradicted the gate that enforces it.)
#
# Usage:
#   curl -fsSL https://sparcle.app/install.sh | sh                          # Bolt (free), latest
#   curl -fsSL https://sparcle.app/install.sh | sh -s -- personal 0.1.18    # Specific version (positional)
#   BOLT_VERSION=0.1.18 curl -fsSL https://sparcle.app/install.sh | sh      # Specific version (env)
#
# Backwards-compat: `personal`, `free`, `trial`, and `enterprise` are all
# accepted as the edition argument and resolve to the same free Bolt build.
#
# What this does:
#   1. Detects your OS and architecture
#   2. Resolves the target version (BOLT_VERSION env > positional arg > /releases/latest)
#   3. Downloads the correct installer from GitHub Releases (with on-disk cache)
#   4. On Linux, auto-falls-back to the most recent release that ships Linux artifacts
#      (if BOLT_VERSION is not pinned by the user)
#   5. Installs to /Applications (admin macOS) or ~/Applications (non-admin macOS), and ~/.local/bin on Linux
#   6. Marks the app as trusted for your OS to launch safely
#   7. Launches the app
#
# Re-runs are network-free when the cached download still matches the remote
# (per-version cache at ~/.cache/bolt-installer/v<version>/ — override with
# BOLT_INSTALLER_CACHE_DIR).
#
# What you SEE vs. what is RECORDED:
#   The screen shows one line saying the install started, then ONE live line
#   underneath it that is rewritten in place while the work happens —
#
#     Downloading  [##############····················]  42%   68 MB / 163 MB
#
#   — and finally the result. The live line is erased when it is done, so the
#   finished screen is four lines and no paths. Every step, every command's
#   output and every diagnostic is written to the log instead:
#     macOS  ~/Library/Logs/Bolt/install-<version>.log
#     Linux  ~/.local/state/bolt/install-<version>.log
#   The progress line is NEVER written to the log — a log full of carriage
#   returns is unreadable — and with no terminal (`curl … | sh` in CI, output
#   redirected to a file) it degrades to one plain line per phase.
#   BOLT_VERBOSE=1 puts the full detail back on the screen as well. Nothing is
#   dropped in either mode — the log is written the same way both times.
#   BOLT_NO_PROGRESS=1 turns the live line off entirely.
#
# No password required. Safe to re-run — overwrites previous installation.
set -e

# fd 3 is the SCREEN, kept aside before stdout/stderr are pointed at the log by
# setup_logging. `say` is the only thing that writes to it, so a subcommand can
# never leak raw output onto a first-time user's terminal.
exec 3>&1

# ── Config ───────────────────────────────────────────────────────────────────
FALLBACK_VERSION="0.1.0"
GITHUB_REPO="SparcleHQ/sparcle.app"
DEFAULT_BOLT_PG_RELEASES_URL="https://github.com/SparcleHQ/sparcle.app"
DEFAULT_BOLT_PG_FALLBACK_RELEASES_URL="https://github.com/theseus-rs/postgresql-binaries"
DEFAULT_BOLT_PG_PREWARM_REQUIRED="1"
DEFAULT_BOLT_PG_VERSION="18.3.0"
DEFAULT_BOLT_API_PORT_BASE="13018"
DEFAULT_BOLT_API_PORT_RANGE="10"
DOWNLOAD_RETRY_MAX="5"
DOWNLOAD_RETRY_DELAY="2"
CACHE_BASE_DIR="${BOLT_INSTALLER_CACHE_DIR:-${HOME}/.cache/bolt-installer}"
CACHE_KEEP_VERSIONS="2"
# How many candidate releases the per-platform walk-back will try before giving
# up. More than one because a release can LIST an asset it cannot actually serve
# (a truncated or failed upload), and the next-newest release usually can.
WALKBACK_MAX_TRIES="4"

# ── Screen vs. log ───────────────────────────────────────────────────────────
# QUIET_SCREEN=1 (the default) means stdout/stderr go to the log file and the
# screen only ever sees `say`. BOLT_VERBOSE=1 flips it: the same stream is teed
# to both. Every other helper below writes to stdout, so it lands wherever this
# one decision sent it — there is no second place that decides what is visible.
QUIET_SCREEN=1
[ "${BOLT_VERBOSE:-0}" = "1" ] && QUIET_SCREEN=0
LOG_DIR=""
LOG_FILE=""
LOG_FIFO=""
LOG_TEE_PID=""
# Lines appended to the closing summary — for things that changed WHAT the user
# got (a different version, a degraded install location), which they need even
# though the step that caused it is only in the log.
SUMMARY_NOTES=""

# ── Helpers ──────────────────────────────────────────────────────────────────
# say  — the user-facing voice. Screen + log, plain language, no colour codes.
# info/ok/warn — detail. Log only, unless BOLT_VERBOSE=1.
# note — a warn that ALSO earns a line in the closing summary.
# fail — the end of the road: full text to the log, human sentence to the screen.
say()   { progress_clear; if [ "$QUIET_SCREEN" = "1" ]; then printf '%s\n' "$1" >&3; fi; printf '%s\n' "$1"; }
info()  { printf '==>  %s\n' "$1"; }
ok()    { printf ' ok  %s\n' "$1"; }
warn()  { printf ' !   %s\n' "$1"; }
note()  {
  warn "$1"
  if [ -n "$SUMMARY_NOTES" ]; then SUMMARY_NOTES="${SUMMARY_NOTES}
  $1"; else SUMMARY_NOTES="  $1"; fi
}
fail()  {
  progress_done
  # Full text to wherever detail goes: the log in quiet mode, the terminal in
  # verbose mode or before setup_logging has run.
  printf 'FAILED: %b\n' "$1"
  # The screen copy is needed ONLY when stdout is not already the screen —
  # otherwise the user reads the same sentence twice.
  if [ "$QUIET_SCREEN" = "1" ] && [ -n "$LOG_FILE" ]; then
    printf '\n  %b\n' "$1" >&3
  fi
  # Paths appear HERE and nowhere else on the screen. A successful install does
  # not need to tell anyone where the bundle went — but a failed one does: these
  # two are the "what do I look at / what do I delete" answer, and asking the
  # user to open the log first to find them is one hop too many.
  [ -n "${INSTALL_APP_PATH:-}" ] && printf '  Install path: %s\n' "${INSTALL_APP_PATH}" >&3
  [ -n "${DL_PATH:-}" ] && printf '  Downloaded file: %s\n' "${DL_PATH}" >&3
  [ -n "$LOG_FILE" ] && printf '  Details: %s\n' "$LOG_FILE" >&3
  printf '\n' >&3
  exit 1
}

# ── Live progress: one line, rewritten in place, SCREEN ONLY ─────────────────
# The dominant wait is a ~160 MB download that `curl -o` runs completely
# silently. A multi-minute silent install reads as a hang, so one line is drawn
# on the screen (fd 3) and rewritten with a carriage return:
#
#   Downloading  [##############······················]  42%   68 MB / 163 MB
#
# It is erased before anything else is printed, so the finished screen is the
# header line plus the result — the bar leaves no trace.
#
# It NEVER goes to the log. A log full of \r frames is unreadable, and the log
# already carries a detailed line per step.
#
# Three modes, decided once by progress_init:
#   bar    quiet mode on a real terminal — the in-place bar above
#   plain  quiet mode with no terminal (`curl … | sh` in CI, stdout redirected
#          to a file, TERM=dumb): one line per phase plus a percentage line
#          every 20%. Readable when captured, and still visibly moving.
#   off    BOLT_VERBOSE=1 — every step is already narrated on the screen.
#
# Honesty rule: a percentage is only ever shown when a real denominator exists
# (bytes against Content-Length, or step N of a known N). Everything else uses
# the moving block, which claims nothing.
PROGRESS_MODE="off"
PROGRESS_WIDTH=34
PROGRESS_PAD_TO=79
PROGRESS_BLANK=""
PROGRESS_LABEL=""
PROGRESS_PULSE=0
PROGRESS_MARK=-1
PROGRESS_STEP=0
PROGRESS_STEPS=0
PROGRESS_FILL="#"
PROGRESS_DOT="."
PROGRESS_TICK="1"

# Terminal width, best effort. stdin is the script itself under `curl | sh`, so
# the terminal has to be reached through /dev/tty rather than fd 0.
progress_term_cols() {
  _tc="${COLUMNS:-}"
  if [ -z "$_tc" ] && [ -r /dev/tty ]; then
    _tc=$(stty size < /dev/tty 2>/dev/null | awk '{print $2}' || true)
  fi
  [ -n "$_tc" ] || _tc=$(tput cols 2>/dev/null || true)
  case "$_tc" in ''|*[!0-9]*) _tc=80 ;; esac
  printf '%s' "$_tc"
  return 0
}

progress_repeat() { # <char> <count> -> _PR
  _pr_c="$1"; _pr_n="$2"; _PR=""
  while [ "$_pr_n" -gt 0 ]; do _PR="${_PR}${_pr_c}"; _pr_n=$(( _pr_n - 1 )); done
  return 0
}

progress_init() {
  PROGRESS_MODE="off"
  [ "${BOLT_NO_PROGRESS:-0}" = "1" ] && return 0
  # Verbose mode already prints every step; a rewriting bar would fight it.
  [ "$QUIET_SCREEN" = "1" ] || return 0

  PROGRESS_MODE="plain"
  if [ -t 3 ]; then
    case "${TERM:-}" in
      ""|dumb|unknown) ;;
      *) PROGRESS_MODE="bar" ;;
    esac
  fi

  # Sub-second sleep is not POSIX. Probe once: a strict `sleep` that rejects it
  # must not turn every frame into an error message.
  if sleep 0.2 2>/dev/null; then PROGRESS_TICK="0.2"; else PROGRESS_TICK="1"; fi

  [ "$PROGRESS_MODE" = "bar" ] || return 0

  # The unfilled cell is U+00B7 MIDDLE DOT, which needs a UTF-8 terminal to
  # occupy one column. On a non-UTF-8 locale it would render as two mojibake
  # bytes per cell and wreck the line, so fall back to ASCII there.
  case "${LC_ALL:-${LC_CTYPE:-${LANG:-}}}" in
    *UTF-8*|*utf-8*|*UTF8*|*utf8*) PROGRESS_DOT="·" ;;
    *) PROGRESS_DOT="." ;;
  esac

  _pi_cols=$(progress_term_cols)
  PROGRESS_PAD_TO=$(( _pi_cols - 1 ))
  [ "$PROGRESS_PAD_TO" -gt 100 ] && PROGRESS_PAD_TO=100
  [ "$PROGRESS_PAD_TO" -lt 1 ] && PROGRESS_PAD_TO=1
  # Everything except the bar costs 45 columns (indent + label + percentage +
  # the widest detail). A terminal too narrow for a bar still gets the label,
  # the percentage and the megabytes — just no bar.
  _pi_room=$(( _pi_cols - 45 ))
  if [ "$_pi_room" -lt 10 ]; then
    PROGRESS_WIDTH=0
  elif [ "$_pi_room" -lt "$PROGRESS_WIDTH" ]; then
    PROGRESS_WIDTH="$_pi_room"
  fi

  progress_repeat " " "$PROGRESS_PAD_TO"
  PROGRESS_BLANK="$_PR"
  return 0
}

# Build "[###···]  " into _PB. <fill> < 0 means the indeterminate moving block.
progress_bar() {
  _pb_n="$1"
  _PB=""
  [ "$PROGRESS_WIDTH" -gt 0 ] || return 0
  if [ "$_pb_n" -lt 0 ]; then
    _pb_span=$(( PROGRESS_WIDTH - 3 ))
    [ "$_pb_span" -lt 1 ] && _pb_span=1
    _pb_p=$(( PROGRESS_PULSE % (_pb_span * 2) ))
    [ "$_pb_p" -gt "$_pb_span" ] && _pb_p=$(( _pb_span * 2 - _pb_p ))
    _pb_hi=$(( _pb_p + 3 ))
  else
    _pb_p=0
    _pb_hi="$_pb_n"
  fi
  _pb_i=0
  while [ "$_pb_i" -lt "$PROGRESS_WIDTH" ]; do
    if [ "$_pb_i" -ge "$_pb_p" ] && [ "$_pb_i" -lt "$_pb_hi" ]; then
      _PB="${_PB}${PROGRESS_FILL}"
    else
      _PB="${_PB}${PROGRESS_DOT}"
    fi
    _pb_i=$(( _pb_i + 1 ))
  done
  _PB="[${_PB}]  "
  return 0
}

# Draw one frame. <pct> < 0 draws the moving block and NO percentage.
# The line is padded to the terminal width every frame, so a shorter line can
# never leave the tail of a longer one behind — and no ANSI erase is needed.
progress_draw() {
  [ "$PROGRESS_MODE" = "bar" ] || return 0
  _pd_pct="$1"; _pd_detail="$2"
  if [ "$_pd_pct" -ge 0 ]; then progress_bar $(( _pd_pct * PROGRESS_WIDTH / 100 )); else progress_bar -1; fi
  if [ "$PROGRESS_WIDTH" -gt 0 ]; then _pd_bw=$(( PROGRESS_WIDTH + 4 )); else _pd_bw=0; fi
  # 2 indent + 11 label + 2 + bar + 4 percentage + 3 + detail (detail is ASCII,
  # so ${#…} is its column count; the bar's width is known, never measured —
  # the middle dot is 2 bytes and 1 column).
  _pd_len=$(( 2 + 11 + 2 + _pd_bw + 4 + 3 + ${#_pd_detail} ))
  _pd_pad=$(( PROGRESS_PAD_TO - _pd_len ))
  [ "$_pd_pad" -lt 0 ] && _pd_pad=0
  progress_repeat " " "$_pd_pad"
  if [ "$_pd_pct" -ge 0 ]; then
    printf '\r  %-11s  %s%3d%%   %s%s' "$PROGRESS_LABEL" "$_PB" "$_pd_pct" "$_pd_detail" "$_PR" >&3
  else
    printf '\r  %-11s  %s       %s%s' "$PROGRESS_LABEL" "$_PB" "$_pd_detail" "$_PR" >&3
  fi
  return 0
}

# Wipe the bar line and put the cursor back at column 0. Unconditional (not
# gated on "did we draw?") because the drawing can happen inside a command
# substitution, whose variable updates never come back to this shell.
progress_clear() {
  [ "$PROGRESS_MODE" = "bar" ] || return 0
  printf '\r%s\r' "$PROGRESS_BLANK" >&3
  return 0
}

progress_done() {
  progress_clear
  PROGRESS_LABEL=""
  return 0
}

# Start a phase. <label> must be 11 characters or fewer so the bar never shifts
# sideways between phases. <total-steps> is optional: give it ONLY when the
# number of steps is genuinely known.
progress_phase() {
  PROGRESS_LABEL="$1"
  PROGRESS_PULSE=0
  PROGRESS_MARK=-1
  PROGRESS_STEP=0
  PROGRESS_STEPS="${2:-0}"
  case "$PROGRESS_MODE" in
    bar)   progress_draw -1 "" ;;
    plain) printf '  %s\n' "$1" >&3 ;;
  esac
  return 0
}

progress_pct() { # <pct> <detail>
  _pp_pct="$1"
  [ "$_pp_pct" -gt 100 ] && _pp_pct=100
  [ "$_pp_pct" -lt 0 ] && _pp_pct=0
  case "$PROGRESS_MODE" in
    bar) progress_draw "$_pp_pct" "$2" ;;
    plain)
      # One line per 20% — enough to prove movement in a captured log, few
      # enough that the log stays readable.
      _pp_mark=$(( _pp_pct / 20 ))
      if [ "$_pp_mark" -gt "$PROGRESS_MARK" ]; then
        PROGRESS_MARK="$_pp_mark"
        printf '    %3d%%   %s\n' "$_pp_pct" "$2" >&3
      fi
      ;;
  esac
  return 0
}

progress_step() { # <detail> — one of the phase's declared steps is done
  PROGRESS_STEP=$(( PROGRESS_STEP + 1 ))
  if [ "$PROGRESS_STEPS" -gt 0 ]; then
    progress_pct $(( PROGRESS_STEP * 100 / PROGRESS_STEPS )) "${1:-}"
  else
    progress_tick "${1:-}"
  fi
  return 0
}

progress_tick() { # <detail> — motion with no honest denominator to report
  PROGRESS_PULSE=$(( PROGRESS_PULSE + 1 ))
  case "$PROGRESS_MODE" in
    bar) progress_draw -1 "${1:-}" ;;
    plain)
      # Nothing to count, so speak rarely: a line roughly every 15 ticks keeps
      # a captured log alive without filling it.
      if [ -n "${1:-}" ] && [ $(( PROGRESS_PULSE % 15 )) -eq 0 ]; then
        printf '    %s\n' "$1" >&3
      fi
      ;;
  esac
  return 0
}

progress_status() { # <detail> — a fact, not a measurement (e.g. "cached")
  case "$PROGRESS_MODE" in
    bar)   progress_draw -1 "$1" ;;
    plain) printf '    %s\n' "$1" >&3 ;;
  esac
  return 0
}

human_bytes() { # <bytes> -> _HB
  _hb="$1"
  case "$_hb" in ''|*[!0-9]*) _hb=0 ;; esac
  if [ "$_hb" -ge 1048576 ]; then _HB="$(( (_hb + 524288) / 1048576 )) MB"
  elif [ "$_hb" -ge 1024 ]; then _HB="$(( (_hb + 512) / 1024 )) KB"
  else _HB="${_hb} B"
  fi
  return 0
}

# Poll until <rcfile> appears, keeping the bar moving. The rc FILE — not
# `kill -0` — is the completion signal: an unreaped background child is a
# zombie that `kill -0` still reports as alive, which would spin forever. The
# pid check is only a safety net for a child that dies without writing one.
progress_wait() { # <pid> <rcfile> <detail>
  _pw_pid="$1"; _pw_rc="$2"; _pw_detail="$3"; _pw_grace=0
  while [ ! -f "$_pw_rc" ]; do
    progress_tick "$_pw_detail"
    if ! kill -0 "$_pw_pid" 2>/dev/null; then
      _pw_grace=$(( _pw_grace + 1 ))
      [ "$_pw_grace" -ge 10 ] && break
    fi
    sleep "$PROGRESS_TICK"
  done
  wait "$_pw_pid" 2>/dev/null || true
  return 0
}

# Run a slow command with its output in <logfile> while the bar keeps moving.
# Returns the command's own exit status. `if cmd; then …` rather than `cmd; rc=$?`
# because `set -e` would abort the subshell before the status could be recorded.
watch_run() { # <logfile> <detail> <cmd…>
  _wr_log="$1"; shift
  _wr_detail="$1"; shift
  _wr_rcf="${_wr_log}.rc"
  rm -f "$_wr_rcf" "${_wr_rcf}.tmp" 2>/dev/null || true
  (
    if "$@" >"$_wr_log" 2>&1; then _wr_c=0; else _wr_c=$?; fi
    printf '%s' "$_wr_c" > "${_wr_rcf}.tmp" 2>/dev/null
    mv -f "${_wr_rcf}.tmp" "$_wr_rcf" 2>/dev/null
  ) &
  _wr_pid=$!
  progress_wait "$_wr_pid" "$_wr_rcf" "$_wr_detail"
  _wr_status=$(cat "$_wr_rcf" 2>/dev/null || printf '1')
  rm -f "$_wr_rcf" 2>/dev/null || true
  case "$_wr_status" in ''|*[!0-9]*) _wr_status=1 ;; esac
  return "$_wr_status"
}

progress_init

# Point stdout/stderr at the log. Called as early as the platform is known, so
# that everything after it — including a subcommand that writes straight to fd 1
# — is captured rather than shown. The log is named for the version once one is
# resolved (see name_log_for_version); until then it carries the PID.
setup_logging() {
  case "$PLATFORM" in
    macos) LOG_DIR="${HOME}/Library/Logs/Bolt" ;;
    *)     LOG_DIR="${XDG_STATE_HOME:-${HOME}/.local/state}/bolt" ;;
  esac
  mkdir -p "$LOG_DIR" 2>/dev/null || LOG_DIR=""
  [ -n "$LOG_DIR" ] || LOG_DIR="${TMPDIR:-/tmp}"
  LOG_FILE="${LOG_DIR}/install-$$.log"
  if ! : > "$LOG_FILE" 2>/dev/null; then
    LOG_DIR="${TMPDIR:-/tmp}"
    LOG_FILE="${LOG_DIR}/bolt-install-$$.log"
    : > "$LOG_FILE" 2>/dev/null || { LOG_FILE=""; return 0; }
  fi
  printf 'Bolt installer — %s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo unknown)" >> "$LOG_FILE"

  if [ "$QUIET_SCREEN" = "1" ]; then
    exec >>"$LOG_FILE" 2>&1
    return 0
  fi

  # Verbose: same stream, two destinations. A FIFO + tee keeps this POSIX (no
  # process substitution). If mkfifo is unavailable the screen still gets
  # everything and only the log loses the raw subcommand output.
  LOG_FIFO="${LOG_FILE}.fifo"
  if mkfifo "$LOG_FIFO" 2>/dev/null; then
    tee -a "$LOG_FILE" <"$LOG_FIFO" >&3 2>/dev/null &
    LOG_TEE_PID=$!
    exec >"$LOG_FIFO" 2>&1
  else
    LOG_FIFO=""
  fi
}

# Rename the log to install-<version>.log. `mv` keeps the inode, so the already
# open fd 1 (and tee's fd) keep writing into the renamed file.
name_log_for_version() {
  [ -n "$LOG_FILE" ] && [ -n "$VERSION" ] || return 0
  _nl_new="${LOG_DIR}/install-${VERSION}.log"
  [ "$_nl_new" = "$LOG_FILE" ] && return 0
  mv -f "$LOG_FILE" "$_nl_new" 2>/dev/null && LOG_FILE="$_nl_new"
  return 0
}

wait_for_api_readiness() {
  timeout_seconds="${1:-90}"
  port_base="${BOLT_API_PORT_BASE:-$DEFAULT_BOLT_API_PORT_BASE}"
  port_range="${BOLT_API_PORT_RANGE:-$DEFAULT_BOLT_API_PORT_RANGE}"
  port_end=$((port_base + port_range - 1))
  api_url=""
  elapsed=0

  # Try plaintext http:// first; fall back to https:// (with -k for the
  # locally-generated sidecar cert) since the API may be in TLS mode.
  while [ "$elapsed" -lt "$timeout_seconds" ]; do
    for port in $(seq "$port_base" "$port_end"); do
      for path in /api/health /health; do
        if curl -fsS --max-time 1 "http://127.0.0.1:${port}${path}" >/dev/null 2>&1; then
          api_url="http://127.0.0.1:${port}${path}"
          printf '%s\n' "$api_url"
          return 0
        fi
        if curl -fskS --max-time 1 "https://127.0.0.1:${port}${path}" >/dev/null 2>&1; then
          api_url="https://127.0.0.1:${port}${path}"
          printf '%s\n' "$api_url"
          return 0
        fi
      done
    done
    # Nothing here is a fraction of anything known — the app either answers or
    # it does not — so this moves the block, never a percentage.
    progress_tick "waiting for the app"
    sleep 1
    elapsed=$((elapsed + 1))
  done

  return 1
}

verify_runtime_contract() {
  timeout_seconds="${BOLT_API_READY_TIMEOUT:-90}"
  port_base="${BOLT_API_PORT_BASE:-$DEFAULT_BOLT_API_PORT_BASE}"
  port_range="${BOLT_API_PORT_RANGE:-$DEFAULT_BOLT_API_PORT_RANGE}"
  port_end=$((port_base + port_range - 1))
  if [ "${BOLT_SKIP_API_HEALTH_CHECK:-0}" = "1" ]; then
    warn "Skipping API health verification (BOLT_SKIP_API_HEALTH_CHECK=1)"
    BOLT_LAUNCHED=1
    return 0
  fi

  info "Verifying API runtime readiness..."
  progress_phase "Starting"
  if api_url=$(wait_for_api_readiness "$timeout_seconds"); then
    ok "API is healthy at ${api_url}"
    BOLT_LAUNCHED=1
    return 0
  fi

  fail "${APP_NAME} was installed, but its background service did not start within ${timeout_seconds} seconds."
}

select_release_asset() {
  desired_ext="$1"
  FILE_NAME="${FILE_PREFIX}-${VERSION}-${RUST_TRIPLE}.${desired_ext}"
  FILE_URL="${BASE_URL}/${FILE_NAME}"
  EXT="${FILE_NAME##*.}"
}

# HEAD the URL and probe size + etag of the final redirect target.
# Side effects: sets REMOTE_SIZE and REMOTE_ETAG (either may be empty).
probe_remote_asset() {
  url="$1"
  REMOTE_SIZE=""
  REMOTE_ETAG=""
  headers=$(curl -fsILS --max-time 30 "$url" 2>/dev/null || true)
  [ -n "$headers" ] || return 1
  REMOTE_SIZE=$(printf '%s\n' "$headers" | awk 'BEGIN{IGNORECASE=1} tolower($1)=="content-length:" {gsub(/\r/,""); v=$2} END{print v}')
  REMOTE_ETAG=$(printf '%s\n' "$headers" | awk 'BEGIN{IGNORECASE=1} tolower($1)=="etag:" {gsub(/\r/,""); v=$2; for(i=3;i<=NF;i++) v=v" "$i} END{print v}')
  [ -n "$REMOTE_SIZE" ] || return 1
  return 0
}

# Returns 0 (skip download) if the cached file matches the remote.
# Requires probe_remote_asset to have been run first.
is_cache_fresh() {
  cached="$1"
  meta="$2"
  [ -f "$cached" ] || return 1
  local_size=$(wc -c < "$cached" 2>/dev/null | tr -d ' ')
  [ -n "$local_size" ] && [ "$local_size" -gt 1000 ] || return 1
  [ -n "$REMOTE_SIZE" ] || return 1
  [ "$local_size" = "$REMOTE_SIZE" ] || return 1
  if [ -f "$meta" ] && [ -n "$REMOTE_ETAG" ]; then
    saved_etag=$(awk -F'\t' '$1=="etag" {sub(/^etag\t/,""); print; exit}' "$meta")
    if [ -n "$saved_etag" ] && [ "$saved_etag" != "$REMOTE_ETAG" ]; then
      return 1
    fi
  fi
  return 0
}

write_cache_meta() {
  meta="$1"
  {
    printf 'size\t%s\n' "$REMOTE_SIZE"
    [ -n "$REMOTE_ETAG" ] && printf 'etag\t%s\n' "$REMOTE_ETAG"
    printf 'fetched_at\t%s\n' "$(date -u +%Y-%m-%dT%H:%M:%SZ 2>/dev/null || echo "")"
  } > "$meta" 2>/dev/null || true
}

gc_cache() {
  [ -d "$CACHE_BASE_DIR" ] || return 0
  current="v${VERSION}"
  # Keep the current version + the most-recent (CACHE_KEEP_VERSIONS - 1) others.
  ls -1t "$CACHE_BASE_DIR" 2>/dev/null | while IFS= read -r entry; do
    case "$entry" in
      v*) printf '%s\n' "$entry" ;;
    esac
  done | awk -v cur="$current" -v keep="$CACHE_KEEP_VERSIONS" '
    $0==cur {next}
    {others[++n]=$0}
    END {
      # Keep (keep-1) most-recent non-current; delete the rest.
      drop_from = keep
      for (i=drop_from; i<=n; i++) print others[i]
    }
  ' | while IFS= read -r stale; do
    [ -n "$stale" ] || continue
    rm -rf "${CACHE_BASE_DIR}/${stale}" 2>/dev/null || true
  done
}

configure_pg_runtime_sources() {
  # Allow operators to override via exported env vars before running installer.
  if [ -z "${BOLT_PG_RELEASES_URL:-}" ]; then
    export BOLT_PG_RELEASES_URL="$DEFAULT_BOLT_PG_RELEASES_URL"
  fi

  if [ -z "${BOLT_PG_FALLBACK_RELEASES_URL:-}" ] && [ -n "$DEFAULT_BOLT_PG_FALLBACK_RELEASES_URL" ]; then
    export BOLT_PG_FALLBACK_RELEASES_URL="$DEFAULT_BOLT_PG_FALLBACK_RELEASES_URL"
  fi

  info "PostgreSQL source (primary): ${BOLT_PG_RELEASES_URL}"
  if [ -n "${BOLT_PG_FALLBACK_RELEASES_URL:-}" ]; then
    info "PostgreSQL source (fallback): ${BOLT_PG_FALLBACK_RELEASES_URL}"
  else
    info "PostgreSQL source (fallback): <not configured>"
  fi
}

persist_pg_runtime_sources() {
  app_identifier="$1"
  config_dir=""

  case "$PLATFORM" in
    macos)
      config_dir="${HOME}/Library/Application Support/${app_identifier}/embedded-postgres"
      ;;
    linux)
      config_dir="${XDG_DATA_HOME:-${HOME}/.local/share}/${app_identifier}/embedded-postgres"
      ;;
    *)
      return 0
      ;;
  esac

  mkdir -p "$config_dir" 2>/dev/null || return 0
  config_file="${config_dir}/sources.env"

  {
    echo "# Generated by Bolt installer"
    echo "BOLT_PG_RELEASES_URL=${BOLT_PG_RELEASES_URL}"
    if [ -n "${BOLT_PG_FALLBACK_RELEASES_URL:-}" ]; then
      echo "BOLT_PG_FALLBACK_RELEASES_URL=${BOLT_PG_FALLBACK_RELEASES_URL}"
    fi
  } > "$config_file"

  info "Persisted PostgreSQL sources config: ${config_file}"
}

persist_database_runtime_config() {
  app_identifier="$1"
  config_dir=""

  case "$PLATFORM" in
    macos)
      config_dir="${HOME}/Library/Application Support/${app_identifier}"
      ;;
    linux)
      config_dir="${XDG_DATA_HOME:-${HOME}/.local/share}/${app_identifier}"
      ;;
    *)
      return 0
      ;;
  esac

  mkdir -p "$config_dir" 2>/dev/null || return 0
  config_file="${config_dir}/database.env"

  if [ "${BOLT_DATABASE_MODE:-}" != "external" ] && [ "${BOLT_SKIP_EMBEDDED_PG:-}" != "1" ]; then
    rm -f "$config_file" 2>/dev/null || true
    return 0
  fi

  [ -n "${APP__DATABASE__POSTGRES__HOST:-}" ] || fail "External DB mode requires APP__DATABASE__POSTGRES__HOST"
  [ -n "${APP__DATABASE__POSTGRES__PORT:-}" ] || fail "External DB mode requires APP__DATABASE__POSTGRES__PORT"
  [ -n "${APP__DATABASE__POSTGRES__DATABASE:-}" ] || fail "External DB mode requires APP__DATABASE__POSTGRES__DATABASE"
  [ -n "${APP__DATABASE__POSTGRES__USERNAME:-}" ] || fail "External DB mode requires APP__DATABASE__POSTGRES__USERNAME"
  [ -n "${DATABASE_PASSWORD:-}" ] || fail "External DB mode requires DATABASE_PASSWORD"

  {
    echo "# Generated by Bolt installer"
    echo "BOLT_DATABASE_MODE=external"
    echo "BOLT_SKIP_EMBEDDED_PG=1"
    echo "APP__DATABASE__POSTGRES__HOST=${APP__DATABASE__POSTGRES__HOST}"
    echo "APP__DATABASE__POSTGRES__PORT=${APP__DATABASE__POSTGRES__PORT}"
    echo "APP__DATABASE__POSTGRES__DATABASE=${APP__DATABASE__POSTGRES__DATABASE}"
    echo "APP__DATABASE__POSTGRES__USERNAME=${APP__DATABASE__POSTGRES__USERNAME}"
    echo "DATABASE_PASSWORD=${DATABASE_PASSWORD}"
    if [ -n "${APP__DATABASE__POSTGRES__SSL_MODE:-}" ]; then
      echo "APP__DATABASE__POSTGRES__SSL_MODE=${APP__DATABASE__POSTGRES__SSL_MODE}"
    fi
  } > "$config_file"

  chmod 600 "$config_file" 2>/dev/null || true
  info "Persisted external database config: ${config_file}"
}

runtime_asset_triple() {
  case "$RUST_TRIPLE" in
    aarch64-apple-darwin) echo "aarch64-apple-darwin" ;;
    x86_64-apple-darwin) echo "x86_64-apple-darwin" ;;
    x86_64-unknown-linux-gnu) echo "x86_64-unknown-linux-gnu" ;;
    *) echo "" ;;
  esac
}

runtime_repo_from_url() {
  url="$1"
  repo=$(printf '%s' "$url" | sed -E 's#^https?://(www\.)?github\.com/##' | sed -E 's#/$##')
  owner=$(printf '%s' "$repo" | cut -d/ -f1)
  name=$(printf '%s' "$repo" | cut -d/ -f2)
  if [ -n "$owner" ] && [ -n "$name" ] && [ "$owner" != "$repo" ]; then
    echo "$owner/$name"
  else
    echo ""
  fi
}

seed_embedded_postgres_runtime() {
  app_identifier="$1"

  if [ "${BOLT_DATABASE_MODE:-}" = "external" ] || [ "${BOLT_SKIP_EMBEDDED_PG:-}" = "1" ]; then
    return 0
  fi

  runtime_version="${BOLT_PG_VERSION:-$DEFAULT_BOLT_PG_VERSION}"
  triple=$(runtime_asset_triple)
  [ -n "$triple" ] || return 0

  # If the installed package BUNDLES a PostgreSQL payload, skip the network
  # download entirely — the app's own prewarm seeds from that bundle (fully
  # offline install). Detection is version-AGNOSTIC (any <ver>.tar.gz under the
  # app's embedded-postgres resources), so this same installer works across
  # releases: fat packages skip the download, and old/lean packages with no
  # bundle fall through and download as before. The app is the authority on which
  # version it needs — if the bundle can't satisfy it, prewarm downloads anyway.
  if [ "$PLATFORM" = "macos" ] && [ -n "${INSTALL_APP_PATH:-}" ]; then
    bundled_res="${INSTALL_APP_PATH}/Contents/Resources/embedded-postgres"
    if [ -d "$bundled_res" ] && ls "$bundled_res"/*/*.tar.gz >/dev/null 2>&1; then
      info "Package bundles PostgreSQL, skipping download (offline seed on first launch)"
      return 0
    fi
  fi
  if [ "$PLATFORM" = "linux" ]; then
    # Tauri .deb installs resources to /usr/lib/<ProductName>/embedded-postgres/<key>/
    if ls /usr/lib/*/embedded-postgres/*/*.tar.gz >/dev/null 2>&1; then
      info "Package bundles PostgreSQL, skipping download (offline seed on first launch)"
      return 0
    fi
  fi

  case "$PLATFORM" in
    macos)
      base_dir="${HOME}/Library/Application Support/${app_identifier}"
      ;;
    linux)
      base_dir="${XDG_DATA_HOME:-${HOME}/.local/share}/${app_identifier}"
      ;;
    *)
      return 0
      ;;
  esac

  install_root="${base_dir}/embedded-postgres/installation"
  target_dir="${install_root}/${runtime_version}"
  pg_ctl_path="${target_dir}/bin/pg_ctl"

  if [ -x "$pg_ctl_path" ]; then
    info "Embedded PostgreSQL runtime already present: ${target_dir}"
    return 0
  fi

  mkdir -p "$install_root"
  tmp_dir=$(mktemp -d)
  asset="postgresql-${runtime_version}-${triple}.tar.gz"

  primary_repo=$(runtime_repo_from_url "${BOLT_PG_RELEASES_URL}")
  fallback_repo=$(runtime_repo_from_url "${BOLT_PG_FALLBACK_RELEASES_URL:-}")

  c1=""
  c2=""
  c3=""
  c4=""
  if [ -n "$primary_repo" ]; then
    c1="https://github.com/${primary_repo}/releases/download/v${runtime_version}/${asset}"
    c2="https://github.com/${primary_repo}/releases/download/${runtime_version}/${asset}"
  fi
  if [ -n "$fallback_repo" ]; then
    c3="https://github.com/${fallback_repo}/releases/download/v${runtime_version}/${asset}"
    c4="https://github.com/${fallback_repo}/releases/download/${runtime_version}/${asset}"
  fi

  archive_path="${tmp_dir}/${asset}"
  downloaded=0
  for url in "$c1" "$c2" "$c3" "$c4"; do
    [ -n "$url" ] || continue
    info "Seeding PostgreSQL runtime from ${url}"
    if curl -fSL -o "$archive_path" "$url" 2>/dev/null; then
      downloaded=1
      break
    fi
  done

  if [ "$downloaded" -ne 1 ]; then
    rm -rf "$tmp_dir"
    warn "Could not pre-seed PostgreSQL runtime archive. Prewarm will attempt runtime download."
    return 0
  fi

  staging_dir="${install_root}/.seed-${runtime_version}-$$"
  rm -rf "$staging_dir"
  mkdir -p "$staging_dir"

  if ! tar -xzf "$archive_path" -C "$staging_dir"; then
    rm -rf "$tmp_dir" "$staging_dir"
    warn "Failed to extract PostgreSQL runtime archive during pre-seed."
    return 0
  fi

  if [ ! -x "${staging_dir}/bin/pg_ctl" ]; then
    chmod -R u+rwX "$staging_dir" 2>/dev/null || true
    chmod 755 "${staging_dir}/bin"/* 2>/dev/null || true
  fi

  if [ "$PLATFORM" = "macos" ]; then
    libpq_path="${staging_dir}/lib/postgresql/libpq.5.dylib"
    if [ -f "$libpq_path" ]; then
      install_name_tool -id "$libpq_path" "$libpq_path" >/dev/null 2>&1 || true
      for target in "${staging_dir}/bin"/* "${staging_dir}/lib/postgresql"/*.dylib; do
        [ -f "$target" ] || continue
        install_name_tool -change "/opt/homebrew/Cellar/postgresql@18/18.3/lib/postgresql/libpq.5.dylib" "$libpq_path" "$target" >/dev/null 2>&1 || true
        install_name_tool -change "/opt/homebrew/opt/postgresql@18/lib/postgresql/libpq.5.dylib" "$libpq_path" "$target" >/dev/null 2>&1 || true
      done
    fi
  fi

  if [ "$PLATFORM" = "macos" ]; then
    xattr -cr "$staging_dir" 2>/dev/null || true
    find "$staging_dir" -type f \( -name "*.dylib" -o -path "*/bin/*" \) -print0 | \
      xargs -0 -I{} /usr/bin/codesign --force --sign - "{}" >/dev/null 2>&1 || true
  fi

  rm -rf "$target_dir"
  mv "$staging_dir" "$target_dir"
  rm -rf "$tmp_dir"
  info "Pre-seeded embedded PostgreSQL runtime: ${target_dir}"
}

stop_running_linux_app() {
  target_path="$1"

  command -v pgrep >/dev/null 2>&1 || return 0

  pgrep -f -- "$target_path" 2>/dev/null | while IFS= read -r pid; do
    [ -n "$pid" ] || continue
    [ "$pid" = "$$" ] && continue

    exe_path=$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)
    exe_name=$(basename "$exe_path" 2>/dev/null || printf '')

    case "$exe_name" in
      sh|dash|bash|zsh|curl|wget|env|nohup|pkill|pgrep)
        continue
        ;;
    esac

    kill "$pid" 2>/dev/null || true
  done

  sleep 1
}

# Print PIDs of running .deb-installed Bolt processes — the GUI binary `bolt`
# and the sidecar `bolt-api`. A Tauri .deb names its binaries after the Cargo
# package (`bolt`), NOT the productName ("Bolt Enterprise"), so we match by the
# /proc/<pid>/exe basename rather than a cmdline substring. Excludes self.
running_bolt_deb_pids() {
  command -v pgrep >/dev/null 2>&1 || return 0
  pgrep -f -- '/bolt' 2>/dev/null | while IFS= read -r pid; do
    [ -n "$pid" ] || continue
    [ "$pid" = "$$" ] && continue
    exe_base=$(basename "$(readlink -f "/proc/$pid/exe" 2>/dev/null || true)" 2>/dev/null || printf '')
    case "$exe_base" in
      bolt|bolt-api) printf '%s\n' "$pid" ;;
    esac
  done
}

# Stop the installed .deb's running processes BEFORE dpkg swaps the binaries.
# The old stop logic targeted the AppImage path and `pkill -f "Bolt-Enterprise"`,
# neither of which matches a running `/usr/bin/bolt`, so an upgrade never killed
# the old app: it stayed frontmost, kept serving :13018 (so the health check
# passed on STALE code → "is running!" while showing the old version), and
# tauri-plugin-single-instance swallowed the fresh launch by focusing the old
# window. TERM → poll to exit → SIGKILL, mirroring the macOS bundle-replace path;
# killing bolt-api also frees the embedded Postgres cluster for the fresh launch.
stop_installed_deb_processes() {
  pids=$(running_bolt_deb_pids)
  [ -n "$pids" ] || return 0
  for pid in $pids; do kill "$pid" 2>/dev/null || true; done
  _stop_deadline=$(( $(date +%s) + 8 ))
  while :; do
    remaining=$(running_bolt_deb_pids)
    [ -n "$remaining" ] || break
    if [ "$(date +%s)" -ge "$_stop_deadline" ]; then
      for pid in $remaining; do kill -9 "$pid" 2>/dev/null || true; done
      break
    fi
    sleep 0.3
  done
  sleep 0.5
}

launch_linux_app() {
  app_path="$1"
  app_name="$2"
  launch_log=$(mktemp)

  # If FUSE is usable, try native AppImage launch first.
  if fuse_usable; then
    nohup "$app_path" >"$launch_log" 2>&1 &
    launch_pid=$!
    sleep 2
    if kill -0 "$launch_pid" 2>/dev/null; then
      rm -f "$launch_log"
      return 0
    fi
    # FUSE appeared available but launch still failed — check if it's a
    # FUSE mount error (user namespaces disabled, etc.) before giving up.
    if ! grep -qi 'fuse\|Cannot mount AppImage\|user namespace' "$launch_log"; then
      warn "${app_name} did not stay running after launch."
      warn "Try manually: ${app_path}"
      sed 's/^/   /' "$launch_log" | head -20
      rm -f "$launch_log"
      return 1
    fi
  fi

  # FUSE not available (or FUSE mount failed) — use extract-and-run.
  # This is transparent to the user; the app runs identically.
  APPIMAGE_EXTRACT_AND_RUN=1 nohup "$app_path" >"$launch_log" 2>&1 &
  launch_pid=$!
  sleep 2
  if kill -0 "$launch_pid" 2>/dev/null; then
    rm -f "$launch_log"
    return 0
  fi

  warn "${app_name} did not stay running after launch."
  warn "Try manually: APPIMAGE_EXTRACT_AND_RUN=1 ${app_path}"
  sed 's/^/   /' "$launch_log" | head -20
  rm -f "$launch_log"
  return 1
}

cleanup_legacy_linux_native_install() {
  app_file_name="$1"
  rm -rf "${HOME}/.local/opt/${app_file_name}" 2>/dev/null || true
  rm -f "${HOME}/.local/bin/${app_file_name}" 2>/dev/null || true
  rm -f "${HOME}/.local/share/applications/${app_file_name}.desktop" 2>/dev/null || true
  rm -f "${HOME}/.local/share/icons/hicolor/256x256/apps/${app_file_name}.png" 2>/dev/null || true
}

# Returns 0 if FUSE is usable for AppImage mounting, 1 otherwise.
# Checks: /dev/fuse exists, is readable by the current user, and fusermount/fusermount3 is in PATH.
fuse_usable() {
  [ -e /dev/fuse ] && [ -r /dev/fuse ] && \
    { command -v fusermount >/dev/null 2>&1 || command -v fusermount3 >/dev/null 2>&1; }
}

# Idempotently add a directory to PATH in common shell rc files.
add_to_path() {
  dir="$1"
  line="export PATH=\"${dir}:\${PATH}\""
  added=0
  for rc in "${HOME}/.bashrc" "${HOME}/.zshrc" "${HOME}/.profile"; do
    [ -f "$rc" ] || continue
    grep -qF "${dir}" "$rc" 2>/dev/null && continue
    printf '\n# Added by Bolt installer\n%s\n' "$line" >> "$rc"
    ok "Added ${dir} to PATH in $(basename "$rc") — restart shell or: source $rc"
    added=1
  done
  if [ "$added" -eq 0 ]; then
    warn "${dir} is not in your PATH. Add it: ${line}"
  fi
}

prewarm_embedded_postgres() {
  app_bin="$1"
  app_identifier="$2"

  if [ "${BOLT_DATABASE_MODE:-}" = "external" ] || [ "${BOLT_SKIP_EMBEDDED_PG:-}" = "1" ]; then
    info "Skipping embedded PostgreSQL prewarm (external database mode enabled)"
    return 0
  fi

  prewarm_required="${BOLT_PG_PREWARM_REQUIRED:-$DEFAULT_BOLT_PG_PREWARM_REQUIRED}"

  [ -x "$app_bin" ] || {
    warn "Skipping PostgreSQL prewarm: executable not found at ${app_bin}"
    return 0
  }

  info "Prewarming embedded PostgreSQL (user-space, one-time setup)..."
  prewarm_log=$(mktemp)

  if [ "${PLATFORM}" = "linux" ] && echo "$app_bin" | grep -q '\.AppImage$'; then
    if watch_run "$prewarm_log" "database setup" env BOLT_APP_IDENTIFIER="$app_identifier" APPIMAGE_EXTRACT_AND_RUN=1 "$app_bin" prewarm-postgres; then
      ok "Embedded PostgreSQL prewarm complete"
    else
      if [ "$prewarm_required" = "1" ] || [ "$prewarm_required" = "true" ] || [ "$prewarm_required" = "TRUE" ] || [ "$prewarm_required" = "yes" ] || [ "$prewarm_required" = "YES" ]; then
        warn "Embedded PostgreSQL prewarm failed (strict mode enabled)"
        sed 's/^/   /' "$prewarm_log" | tail -40
        rm -f "$prewarm_log"
        fail "${APP_NAME} could not set up its local database.\n  Check your internet connection and run the installer again."
      fi
      warn "Embedded PostgreSQL prewarm failed (app will retry on first launch)"
      sed 's/^/   /' "$prewarm_log" | tail -20
    fi
  else
    if watch_run "$prewarm_log" "database setup" env BOLT_APP_IDENTIFIER="$app_identifier" "$app_bin" prewarm-postgres; then
      ok "Embedded PostgreSQL prewarm complete"
    else
      if [ "$prewarm_required" = "1" ] || [ "$prewarm_required" = "true" ] || [ "$prewarm_required" = "TRUE" ] || [ "$prewarm_required" = "yes" ] || [ "$prewarm_required" = "YES" ]; then
        warn "Embedded PostgreSQL prewarm failed (strict mode enabled)"
        sed 's/^/   /' "$prewarm_log" | tail -40
        rm -f "$prewarm_log"
        fail "${APP_NAME} could not set up its local database.\n  Check your internet connection and run the installer again."
      fi
      warn "Embedded PostgreSQL prewarm failed (app will retry on first launch)"
      sed 's/^/   /' "$prewarm_log" | tail -20
    fi
  fi

  rm -f "$prewarm_log"
}

resolve_macos_executable() {
  app_path="$1"
  plist_path="$app_path/Contents/Info.plist"
  macos_dir="$app_path/Contents/MacOS"

  if [ -f "$plist_path" ]; then
    exec_name=$(/usr/libexec/PlistBuddy -c "Print :CFBundleExecutable" "$plist_path" 2>/dev/null || true)
    if [ -n "$exec_name" ] && [ -x "$macos_dir/$exec_name" ]; then
      echo "$macos_dir/$exec_name"
      return 0
    fi
  fi

  first_exec=$(find "$macos_dir" -maxdepth 1 -type f -perm -111 2>/dev/null | head -1 || true)
  if [ -n "$first_exec" ]; then
    echo "$first_exec"
    return 0
  fi

  echo "$macos_dir/bolt"
}
# ── Pre-flight checks ───────────────────────────────────────────────────────
# Set to 1 only once the app is confirmed launched+healthy (see
# verify_runtime_contract) so the closing banner never claims "running" when the
# app was merely installed but not started.
BOLT_LAUNCHED=0
OS="$(uname)"
case "$OS" in
  Darwin) PLATFORM="macos" ;;
  Linux)  PLATFORM="linux" ;;
  *)      fail "Bolt does not run on $OS. See https://sparcle.app/download for the supported systems." ;;
esac

# From here on the screen is quiet: everything goes to the log.
setup_logging

command -v curl >/dev/null 2>&1 || fail "This installer needs the 'curl' command, which is not installed on this computer."
configure_pg_runtime_sources

# ── Cleanup trap ─────────────────────────────────────────────────────────────
# Note: the download cache under $CACHE_BASE_DIR persists across runs so that
# re-running this installer with the same version skips the download entirely.
# Only ephemeral state (DMG mount point, .partial residue from a failed
# download) is cleaned up on exit.
TMPDIR_MOUNT=""
PARTIAL_PATH=""
cleanup() {
  progress_clear
  if [ -n "${TMPDIR_MOUNT}" ] && [ -d "${TMPDIR_MOUNT}" ]; then
    if [ "$PLATFORM" = "macos" ]; then
      hdiutil detach "${TMPDIR_MOUNT}" -quiet 2>/dev/null || true
    fi
    rm -rf "${TMPDIR_MOUNT}"
  fi
  # Drop any partial download that didn't finish; never touch the cache file.
  if [ -n "${PARTIAL_PATH}" ] && [ -f "${PARTIAL_PATH}" ]; then
    rm -f "${PARTIAL_PATH}" 2>/dev/null || true
  fi
  # The download's own status side-files, if it was interrupted mid-flight.
  [ -n "${DL_CODE_PATH:-}" ] && rm -f "${DL_CODE_PATH}" 2>/dev/null
  [ -n "${DL_RC_PATH:-}" ] && rm -f "${DL_RC_PATH}" "${DL_RC_PATH}.tmp" 2>/dev/null
  # Close the tee'd stream (verbose mode only) so nothing is lost on exit.
  if [ -n "${LOG_FIFO}" ]; then
    exec >&3 2>&3
    [ -n "${LOG_TEE_PID}" ] && wait "${LOG_TEE_PID}" 2>/dev/null
    rm -f "${LOG_FIFO}" 2>/dev/null || true
    LOG_FIFO=""
  fi
  return 0
}
trap cleanup EXIT

# ── Parse edition argument ───────────────────────────────────────────────────
# Bolt is one product (Bolt Enterprise) shipped as one binary per platform,
# free to download for everyone. The legacy `personal`, `free`, and `trial`
# argument values are still accepted as no-op aliases so any bookmarked curl
# one-liner keeps working. Bundle id and installed-app folder are
# `app.sparcle.bolt.enterprise` — existing "Bolt Enterprise" installs (incl.
# the old "trial" build) upgrade in place; older "Bolt Personal" installs
# are not migrated (those users re-curl-install if they care).
EDITION="${1:-enterprise}"
case "$EDITION" in
  enterprise|personal|free|trial)
    # USER-FACING name. Must equal `productName` in src-tauri/tauri.conf.json —
    # this script is served over `curl | sh` from a published release, so it
    # cannot source scripts/product-name.sh and has to inline the value. That
    # is exactly the kind of restatement that drifts, so it is pinned by
    # `the_curl_installer_agrees_with_the_owner` in src-tauri/src/product_name.rs.
    APP_NAME="Bolt"
    # INTERNAL. The release asset filenames stay "Bolt-Enterprise-*" forever:
    # the updater endpoints and every published release key off them. This is
    # NOT a leftover from the rename — see the split documented in
    # scripts/product-name.sh.
    FILE_PREFIX="Bolt-Enterprise"
    ;;
  *)
    fail "Unknown edition: $EDITION. Bolt is free; just run without arguments."
    ;;
esac

# ── Detect architecture ─────────────────────────────────────────────────────
# Resolved BEFORE the version, because every version question below is really a
# per-architecture question: which "latest" pointer to read, and which asset a
# release has to contain to count. It also means an unsupported machine is told
# so before any network round-trip.
ARCH=$(uname -m)
case "$PLATFORM-$ARCH" in
  macos-arm64)   RUST_TRIPLE="aarch64-apple-darwin" ; EXT="dmg" ; ARCH_LABEL="Mac (Apple silicon)" ;;
  macos-x86_64)  RUST_TRIPLE="x86_64-apple-darwin" ; EXT="dmg" ; ARCH_LABEL="Mac (Intel)" ;;
  linux-x86_64)  RUST_TRIPLE="x86_64-unknown-linux-gnu" ; EXT="AppImage" ; ARCH_LABEL="Linux (64-bit)" ;;
  linux-aarch64) fail "Bolt is not available for Linux on ARM64 yet.\n  The Bolt command-line tool is: curl -fsSL https://sparcle.app/install-cli.sh | sh" ;;
  *)             fail "Bolt is not available for $PLATFORM $ARCH. See https://sparcle.app/download for the supported systems." ;;
esac

# ── Per-platform release lookups ────────────────────────────────────────────
# ONE definition of "which releases can this machine actually install", used by
# both the initial version resolution and the walk-back below, so the two can
# never disagree about what this architecture is called.

# The channel-stable pointer for THIS os/arch. Each architecture advances
# independently as its build publishes, so a release that shipped only Apple
# silicon never drags an Intel Mac forward onto a version it has no build for.
# Lives on the release CDN, not the rate-limited API.
platform_pointer_version() {
  case "$PLATFORM" in macos) _pp_os=darwin ;; *) _pp_os=linux ;; esac
  case "$ARCH" in arm64|aarch64) _pp_arch=aarch64 ;; *) _pp_arch=x86_64 ;; esac
  curl -fsSL --max-time 5 \
    "https://github.com/${GITHUB_REPO}/releases/download/${CHANNEL_TAG:-channel-stable}/bolt-latest-${_pp_os}-${_pp_arch}.json" 2>/dev/null \
    | sed -n 's/.*"version"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p' | head -1 | sed 's/^v//'
}

# The regex suffix an asset name must end with to be installable on this
# machine. Derived from RUST_TRIPLE, so Intel and Apple silicon are covered by
# the same line rather than by two that can drift apart.
#
# The dot is escaped TWICE on purpose: this string is handed to `awk -v`, which
# processes escape sequences on assignment, so `\\.` arrives inside awk as `\.`
# and matches a literal dot. A single `\.` here would reach awk as a bare `.`
# (gawk warns and treats it as "any character") — still matching in practice,
# which is exactly why the mistake would go unnoticed.
platform_asset_suffix() {
  case "$PLATFORM" in
    linux) printf '%s' '-'"${RUST_TRIPLE}"'\\.(deb|AppImage)' ;;
    *)     printf '%s' '-'"${RUST_TRIPLE}"'\\.dmg' ;;
  esac
}

# releases_with_asset(suffix_regex)
# Prints the tag (without leading v) of EVERY recent release that ships an asset
# for this machine, newest first. All of them, not just the newest: a release can
# list an asset it cannot actually serve (a truncated or failed upload), and the
# caller then tries the next one instead of failing the install.
releases_with_asset() {
  suffix_re="$1"
  api_resp=$(curl -fsSL --max-time 10 "https://api.github.com/repos/${GITHUB_REPO}/releases?per_page=30" 2>/dev/null || true)
  [ -n "$api_resp" ] || return 1
  printf '%s\n' "$api_resp" | awk -v prefix="$FILE_PREFIX" -v suffix="$suffix_re" '
    /"tag_name":/ {
      tag = $0
      sub(/.*"tag_name": *"/, "", tag); sub(/".*/, "", tag)
      matched = 0
    }
    /"name":/ {
      if (matched) next
      name = $0
      sub(/.*"name": *"/, "", name); sub(/".*/, "", name)
      pat = "^" prefix "-[0-9][0-9.]*" suffix "$"
      if (name ~ pat) {
        t = tag
        sub(/^v/, "", t)
        print t
        matched = 1
      }
    }
  '
}

# ── Resolve version (env > positional arg > per-platform pointer > latest) ───
# VERSION_PINNED=1 means the user explicitly chose a version, which changes only
# the WORDING of the walk-back notice below — a pinned version with no build for
# this machine still degrades to one that has a build, rather than hard-failing.
VERSION=""
VERSION_PINNED=0
if [ -n "${BOLT_VERSION:-}" ]; then
  VERSION="$(printf '%s' "$BOLT_VERSION" | sed 's/^v//')"
  VERSION_PINNED=1
elif [ -n "${2:-}" ]; then
  VERSION="$(printf '%s' "$2" | sed 's/^v//')"
  VERSION_PINNED=1
fi

if [ -z "$VERSION" ]; then
  PTR_V=$(platform_pointer_version || true)
  if [ -n "$PTR_V" ]; then
    VERSION="$PTR_V"
    info "Per-platform pointer for ${RUST_TRIPLE}: v${VERSION}"
  else
    LATEST_URL="https://api.github.com/repos/${GITHUB_REPO}/releases/latest"
    API_RESP=$(curl -fsSL --max-time 5 "$LATEST_URL" 2>/dev/null || true)
    V=$(echo "$API_RESP" | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/' | sed 's/^v//' || true)
    if [ -n "$V" ]; then
      VERSION="$V"
      info "No per-platform pointer — using the latest release: v${VERSION}"
    else
      VERSION="$FALLBACK_VERSION"
      warn "Could not fetch latest version — using v${VERSION}"
    fi
  fi
fi
BASE_URL="https://github.com/${GITHUB_REPO}/releases/download/v${VERSION}"
name_log_for_version

# ── Can this user obtain root at all? ────────────────────────────────────
# Used to choose an install path the user can actually complete, rather than one
# that prompts for a password they do not have. Three ways to answer yes:
# already root; passwordless sudo; or membership of a group that sudoers grants
# root to on the mainstream distros (sudo on Debian/Ubuntu, wheel on RHEL/Arch/
# SUSE, admin on some derivatives).
#
# A false negative is safe — it picks the rootless AppImage, which works for
# everyone. A false positive costs one password prompt, which is what happens
# today unconditionally.
can_sudo() {
  [ "$(id -u)" = "0" ] && return 0
  command -v sudo >/dev/null 2>&1 || return 1
  sudo -n true 2>/dev/null && return 0
  id -Gn 2>/dev/null | tr ' ' '\n' | grep -qxE 'sudo|wheel|admin'
}

# ── Prefer .deb on Debian/Ubuntu (better desktop integration) ────────────
# The .deb is installed with `dpkg -i`, which requires root. A user who cannot
# become root gets the AppImage instead: it installs into ~/.local/bin and needs
# no privilege at all. That is the whole difference — same app, same updater.
# BOLT_INSTALL_APPIMAGE=1 forces the rootless path for anyone who wants it.
USE_DEB=0
if [ "$PLATFORM" = "linux" ] && [ -z "${BOLT_INSTALL_APPIMAGE:-}" ] \
   && command -v dpkg >/dev/null 2>&1 && can_sudo; then
  USE_DEB=1
  EXT="deb"
fi

select_release_asset "$EXT"

info "Target: ${APP_NAME} v${VERSION} — ${PLATFORM} ${ARCH} (${RUST_TRIPLE}), asset ${FILE_NAME}"
say ""
say "  Installing ${APP_NAME} ${VERSION} for ${ARCH_LABEL}"
say ""
# From here on the screen carries exactly one live line, rewritten in place,
# until the result replaces it. "This takes a few minutes" is gone because the
# bar now says so continuously, and more precisely.
progress_phase "Preparing"

# ── Download (with per-version cache) ────────────────────────────────────────
# fetch_with_cache: populates $DL_PATH from $FILE_URL, reusing the cached file
# when its size+ETag match the remote. Returns 0 on success, 1 if the asset is
# not available on the server (so the caller can fall through to a fallback
# asset like AppImage when .deb is missing).
fetch_with_cache() {
  progress_phase "Downloading"
  CACHE_DIR="${CACHE_BASE_DIR}/v${VERSION}"
  mkdir -p "$CACHE_DIR" 2>/dev/null || true
  DL_PATH="${CACHE_DIR}/${FILE_NAME}"
  META_PATH="${DL_PATH}.meta"
  PARTIAL_PATH="${DL_PATH}.partial"

  # Probe remote first so we know what "fresh" means. If HEAD fails (network
  # blip, server doesn't allow HEAD) we fall through to the normal download.
  probe_ok=0
  if probe_remote_asset "$FILE_URL"; then
    probe_ok=1
    if is_cache_fresh "$DL_PATH" "$META_PATH"; then
      ok "Using cached ${FILE_NAME} ($(du -h "$DL_PATH" | cut -f1 | tr -d ' ')) — skipping download"
      # No bar for a download that is not happening. A cache hit is instant, and
      # animating one would be theatre.
      human_bytes "$REMOTE_SIZE"
      progress_status "cached (${_HB})"
      return 0
    fi
  fi

  info "Downloading ${FILE_NAME}..."
  rm -f "$PARTIAL_PATH" 2>/dev/null || true

  # The download runs in the background and the file it is writing IS the
  # progress source: bytes on disk against the Content-Length the HEAD probe
  # already fetched. Nothing about curl's own output is parsed, so -f/-S/-L,
  # the retries and the cache logic are untouched; -s only suppresses curl's
  # own meter, which would fight this one (-S keeps its error text, and that
  # text goes to the log like every other detail).
  DL_CODE_PATH="${PARTIAL_PATH}.code"
  DL_RC_PATH="${PARTIAL_PATH}.rc"
  rm -f "$DL_CODE_PATH" "$DL_RC_PATH" "${DL_RC_PATH}.tmp" 2>/dev/null || true
  (
    if curl -fsSL \
      --retry "${DOWNLOAD_RETRY_MAX}" \
      --retry-all-errors \
      --retry-delay "${DOWNLOAD_RETRY_DELAY}" \
      --connect-timeout 15 \
      --max-time 300 \
      -w '%{http_code}' \
      -o "${PARTIAL_PATH}" \
      "${FILE_URL}" > "$DL_CODE_PATH"
    then _dl_c=0; else _dl_c=$?; fi
    printf '%s' "$_dl_c" > "${DL_RC_PATH}.tmp" 2>/dev/null
    mv -f "${DL_RC_PATH}.tmp" "$DL_RC_PATH" 2>/dev/null
  ) &
  DL_PID=$!

  # A denominator is only used when the server actually gave one. Without a
  # Content-Length the bytes so far are shown against a moving block and no
  # percentage at all — an invented total would be a lie that looks like a fact.
  dl_total="${REMOTE_SIZE:-}"
  case "$dl_total" in ''|*[!0-9]*) dl_total=0 ;; esac
  dl_grace=0
  while [ ! -f "$DL_RC_PATH" ]; do
    if [ "$PROGRESS_MODE" != "off" ]; then
      dl_now=$(wc -c < "${PARTIAL_PATH}" 2>/dev/null | tr -d ' ' || true)
      case "$dl_now" in ''|*[!0-9]*) dl_now=0 ;; esac
      human_bytes "$dl_now"; dl_now_h="$_HB"
      if [ "$dl_total" -gt 0 ]; then
        human_bytes "$dl_total"
        progress_pct $(( dl_now * 100 / dl_total )) "${dl_now_h} / ${_HB}"
      else
        progress_tick "${dl_now_h} downloaded"
      fi
    fi
    if ! kill -0 "$DL_PID" 2>/dev/null; then
      dl_grace=$(( dl_grace + 1 ))
      [ "$dl_grace" -ge 10 ] && break
    fi
    sleep "$PROGRESS_TICK"
  done
  wait "$DL_PID" 2>/dev/null || true
  HTTP_CODE=$(cat "$DL_CODE_PATH" 2>/dev/null || true)
  DL_STATUS=$(cat "$DL_RC_PATH" 2>/dev/null || printf '1')
  case "$DL_STATUS" in ''|*[!0-9]*) DL_STATUS=1 ;; esac
  rm -f "$DL_CODE_PATH" "$DL_RC_PATH" 2>/dev/null || true
  DL_CODE_PATH=""
  DL_RC_PATH=""

  # curl's own exit status is now available (running it in the background is
  # what made it capturable) and it is BELIEVED. It has to be: a connection that
  # drops at 50% leaves a large, plausible-looking file that sails past a
  # ">1000 bytes" test, gets published into the cache as if it were the real
  # artifact, and is then caught by the SHA-256 check — which tells the user their
  # download "has been tampered with". A dropped connection is not an attack, and
  # a half-file must never reach the cache. -f/--retry are unchanged: a nonzero
  # status here means every retry was already spent.
  if [ "$DL_STATUS" -ne 0 ] || [ ! -f "${PARTIAL_PATH}" ] \
     || [ "$(wc -c < "${PARTIAL_PATH}" | tr -d ' ')" -lt 1000 ]; then
    # The HTTP status is the only thing that distinguishes "this release does not
    # have the asset" (404 → walk back) from "the network broke" (000/5xx), so it
    # goes in the log rather than being captured and then discarded.
    warn "${FILE_NAME} could not be downloaded (HTTP ${HTTP_CODE:-none}, curl exit ${DL_STATUS})"
    rm -f "${PARTIAL_PATH}" 2>/dev/null || true
    PARTIAL_PATH=""
    return 1
  fi

  # Atomic publish into the cache.
  mv -f "${PARTIAL_PATH}" "${DL_PATH}"
  PARTIAL_PATH=""

  # Persist metadata so the next run can decide cache-fresh without a HEAD
  # round-trip ambiguity. Probe again if we didn't earlier, so the size we
  # record actually corresponds to the bytes on disk.
  if [ "$probe_ok" -ne 1 ]; then
    probe_remote_asset "$FILE_URL" || true
  fi
  # Authoritative size = bytes on disk (server-reported can be stripped by
  # proxies; what we just wrote is what we'll compare next time).
  REMOTE_SIZE=$(wc -c < "${DL_PATH}" | tr -d ' ')
  write_cache_meta "$META_PATH"

  human_bytes "$REMOTE_SIZE"
  progress_pct 100 "${_HB} / ${_HB}"
  ok "Downloaded $(du -h "${DL_PATH}" | cut -f1 | tr -d ' ')"
  return 0
}

# download_for_platform tries the preferred extension and (on Linux) falls
# back from .deb to .AppImage within the SAME version. Returns 0 on success,
# 1 if neither asset is available on the server for this version+platform.
download_for_platform() {
  select_release_asset "$EXT"
  if fetch_with_cache; then
    return 0
  fi
  if [ "$USE_DEB" -eq 1 ]; then
    warn ".deb package not available — falling back to AppImage..."
    USE_DEB=0
    select_release_asset "AppImage"
    fetch_with_cache && return 0
  fi
  return 1
}

if ! download_for_platform; then
  # Per-platform walk-back: if the requested VERSION's release is missing this
  # machine's artifact (a partial ship still in flight, a single-file upload that
  # silently 502'd from GitHub, or a version that simply never shipped this
  # arch), install the most recent release that DOES ship the right artifact for
  # THIS platform/arch. This applies EVEN to an explicitly pinned version: a
  # pinned version with no build for the user's arch degrades to the newest
  # version that has one rather than hard-failing, so the install still works
  # (with a clear notice).
  #
  # Candidates are TRIED IN ORDER rather than taken as one answer, because a
  # release listing an asset is not proof it can serve it — a truncated upload
  # appears in the API exactly like a good one, and used to turn the whole
  # walk-back into a single-shot guess. Sources, in order:
  #   1. every recent release with an asset for this arch (newest first)
  #   2. the channel-stable per-platform pointer — reachable when the GitHub API
  #      is rate-limited (60/hr per IP, unauthenticated), which is the one
  #      failure mode that would otherwise leave source 1 with nothing to say.
  requested_version="$VERSION"
  candidates=$(releases_with_asset "$(platform_asset_suffix)" 2>/dev/null || true)
  if [ -z "$candidates" ]; then
    candidates=$(platform_pointer_version 2>/dev/null || true)
    [ -n "$candidates" ] && info "GitHub release list unavailable — falling back to the ${RUST_TRIPLE} pointer: v${candidates}"
  fi
  info "Walk-back candidates for ${RUST_TRIPLE}: $(printf '%s' "$candidates" | tr '\n' ' ')"

  walkback_ok=0
  tries=0
  for candidate in $candidates; do
    [ "$candidate" = "$requested_version" ] && continue
    tries=$((tries + 1))
    [ "$tries" -gt "$WALKBACK_MAX_TRIES" ] && break

    VERSION="$candidate"
    BASE_URL="https://github.com/${GITHUB_REPO}/releases/download/v${VERSION}"
    if [ "$PLATFORM" = "linux" ]; then
      USE_DEB=0
      if command -v dpkg >/dev/null 2>&1 && can_sudo; then USE_DEB=1; EXT="deb"; else EXT="AppImage"; fi
    else
      EXT="dmg"
    fi
    info "Trying v${VERSION} instead of v${requested_version}..."
    if download_for_platform; then
      walkback_ok=1
      break
    fi
    warn "v${VERSION} lists a ${ARCH} build but could not serve it — trying the next release."
  done

  if [ "$walkback_ok" -ne 1 ]; then
    VERSION="$requested_version"
    fail "There is no version of ${APP_NAME} for your ${ARCH_LABEL} yet.\n  See https://sparcle.app/download for the systems Bolt supports today."
  fi

  name_log_for_version
  note "Version ${requested_version} has no build for your ${ARCH_LABEL}, so ${VERSION} was installed."
fi

# Prune old version caches in the background of the user's awareness.
gc_cache

# ══════════════════════════════════════════════════════════════════════════════
# Remove a bundle left behind by a PREVIOUS product name.
#
# The app used to install as "Bolt Enterprise.app" and now installs as
# "Bolt.app". Without this the user is left with two bundles in /Applications,
# both with bundle id app.sparcle.bolt.enterprise, both launching a sidecar that
# wants port 13018 and the same embedded Postgres cluster. That state is not
# theoretical — it happened on the founder's own machine, where the STALE
# 0.1.147 "Bolt Enterprise.app" was the one actually running while the fresh
# 0.1.150 "Bolt.app" sat unused beside it.
#
# ── THIS DELETES AN APPLICATION, SO IT PROVES IDENTITY FIRST ─────────────────
#
# Never by name. `$HOME/Applications/Bolt Safari.app` exists on that same
# machine and matches any naive "Bolt*" glob. A bundle is removed ONLY when:
#
#   1. Its CFBundleIdentifier is exactly ours, AND
#   2. Its code signature's TeamIdentifier is ours — or it has no signature at
#      all (an ad-hoc local dev build, which is still genuinely ours).
#
# It is announced, never silent. It is best-effort: if anything about the
# removal fails the install still succeeds and the user is told how to finish
# by hand. Leaving a stale app behind is untidy; failing an install over it
# would be worse.
# ══════════════════════════════════════════════════════════════════════════════
LEGACY_APP_BUNDLES="Bolt Enterprise.app
Bolt Personal.app"

_bundle_is_ours() { # <path/to/Foo.app>
  _bio_app="$1"
  [ -d "${_bio_app}" ] || return 1
  _bio_id=$(defaults read "${_bio_app}/Contents/Info.plist" CFBundleIdentifier 2>/dev/null || true)
  [ "${_bio_id}" = "app.sparcle.bolt.enterprise" ] || return 1
  _bio_team=$(codesign -dv --verbose=4 "${_bio_app}" 2>&1 \
    | sed -n 's/^TeamIdentifier=//p' | head -1)
  case "${_bio_team}" in
    ""|"not set")     return 0 ;;   # unsigned / ad-hoc local build — still ours
    "4VSW7NBZ2S")     return 0 ;;
    *)                return 1 ;;
  esac
}

remove_legacy_bundles() {
  [ "${PLATFORM}" = "macos" ] || return 0

  printf '%s\n' "${LEGACY_APP_BUNDLES}" | while IFS= read -r _legacy_name; do
    [ -n "${_legacy_name}" ] || continue
    for _dir in "/Applications" "${HOME}/Applications"; do
      _old="${_dir}/${_legacy_name}"
      [ -d "${_old}" ] || continue

      # Never remove the bundle we just installed (covers the case where the
      # product name is reverted to a legacy value in some future release).
      [ "${_old}" = "${INSTALL_APP_PATH}" ] && continue

      if ! _bundle_is_ours "${_old}"; then
        warn "Left ${_old} alone — it is not a Sparcle-signed Bolt bundle."
        continue
      fi

      # Never delete a running app out from under the user.
      if pgrep -f "${_legacy_name}/Contents/MacOS" >/dev/null 2>&1; then
        info "Quitting the previous ${_legacy_name%.app}..."
        pkill -f "${_legacy_name}/Contents/MacOS" 2>/dev/null || true
        _rl_deadline=$(( $(date +%s) + 8 ))
        while pgrep -f "${_legacy_name}/Contents/MacOS" >/dev/null 2>&1; do
          if [ "$(date +%s)" -ge "${_rl_deadline}" ]; then
            pkill -9 -f "${_legacy_name}/Contents/MacOS" 2>/dev/null || true
            sleep 0.5
            break
          fi
          sleep 0.3
        done
      fi

      if rm -rf "${_old}" 2>/dev/null; then
        ok "Removed the previous ${_legacy_name} — Bolt has been renamed."
      elif [ -r /dev/tty ] && sudo rm -rf "${_old}" 2>/dev/null < /dev/tty; then
        ok "Removed the previous ${_legacy_name} — Bolt has been renamed."
      else
        warn "Could not remove ${_old}. Bolt is installed and working; drag the old app to the Trash when convenient:"
        printf '        sudo rm -rf "%s"\n' "${_old}"
      fi
    done
  done
  return 0
}

# ══════════════════════════════════════════════════════════════════════════════
# macOS: mount DMG → copy .app → trust → launch
# ══════════════════════════════════════════════════════════════════════════════
install_macos() {
  # Fresh, isolated mount point for hdiutil — never inside the persistent
  # download cache (we don't want the mount to live beyond this process).
  TMPDIR_MOUNT=$(mktemp -d)
  MOUNT_POINT="${TMPDIR_MOUNT}"

  info "Installing ${APP_NAME}..."
  # Seven steps, counted — not timed. The percentage is "how many of the known
  # steps are behind us", which is a fact; a clock-driven bar would not be.
  progress_phase "Installing" 7
  hdiutil attach "${DL_PATH}" -quiet -nobrowse -mountpoint "${MOUNT_POINT}" 2>/dev/null \
    || fail "The ${APP_NAME} download could not be opened — it looks incomplete.\n  Run the installer again."

  progress_step "opening"
  SOURCE_APP=$(find "${MOUNT_POINT}" -maxdepth 1 -name "*.app" | head -1)
  [ -n "${SOURCE_APP}" ] || { hdiutil detach "${MOUNT_POINT}" -quiet 2>/dev/null; fail "The ${APP_NAME} download does not contain the application.\n  Run the installer again."; }

  # Fully stop any running Bolt before replacing the bundle. A bare `sleep 1`
  # let bolt-api linger: macOS `cp` then silently skips the in-use binary (the
  # "upgrade" keeps running OLD code), and a lingering sidecar holding the
  # embedded Postgres cluster contends with the fresh launch. Send TERM, poll
  # until the processes actually exit, then SIGKILL any straggler.
  #
  # Stop the CURRENT name AND every legacy name. Before the rename this pattern
  # was built from ${APP_NAME} alone, so once the bundle became "Bolt.app" an
  # still-running "Bolt Enterprise.app" was never stopped — it kept holding port
  # 13018 and the embedded Postgres cluster while the "upgrade" installed
  # alongside it. Match on the bundle-relative suffix for each known name.
  for _b in "${APP_NAME}.app" "Bolt Enterprise.app" "Bolt Personal.app"; do
    pkill -f "${_b}/Contents/MacOS" 2>/dev/null || true
  done
  _bolt_stop_deadline=$(( $(date +%s) + 8 ))
  while pgrep -f "\.app/Contents/MacOS/bolt" >/dev/null 2>&1; do
    if [ "$(date +%s)" -ge "${_bolt_stop_deadline}" ]; then
      for _b in "${APP_NAME}.app" "Bolt Enterprise.app" "Bolt Personal.app"; do
        pkill -9 -f "${_b}/Contents/MacOS" 2>/dev/null || true
      done
      break
    fi
    sleep 0.3
  done
  sleep 0.5
  progress_step "stopping the old app"

  INSTALL_BASE="/Applications"
  # The installed bundle is named by whatever is INSIDE the DMG, never by a
  # name this script guesses.
  #
  # This is the bug that put two Bolts in /Applications. INSTALL_APP_PATH used
  # to be "${INSTALL_BASE}/${APP_NAME}.app" while the copy below is
  # `cp -R "${SOURCE_APP}"`, which lands under the DMG's own name. The day the
  # DMG started containing "Bolt.app" while APP_NAME was still "Bolt Enterprise"
  # the two silently diverged: the `rm -rf` cleared nothing, the new bundle
  # landed as Bolt.app, the old Bolt Enterprise.app was left untouched, and
  # every step afterwards — xattr, stapler, the CLI symlink, `open` — operated
  # on a path that did not exist. Deriving the path from SOURCE_APP makes this
  # correct for any future rename without touching this script again.
  INSTALL_APP_BASENAME=$(basename "${SOURCE_APP}")
  INSTALL_APP_PATH="${INSTALL_BASE}/${INSTALL_APP_BASENAME}"
  installed=0

  # First try system Applications without elevation.
  rm -rf "${INSTALL_APP_PATH}" 2>/dev/null || true
  if cp -R "${SOURCE_APP}" "${INSTALL_BASE}/" 2>/dev/null; then
    installed=1
  fi

  # If needed, escalate — but ONLY for a user who can actually succeed.
  #
  # `sudo` used to be attempted whenever a tty existed. For a standard (non-
  # admin) user that is three "Sorry, try again" password rejections followed by
  # "<user> is not in the sudoers file", and only then the per-user fallback that
  # was always going to be the answer. The user has done nothing wrong, cannot
  # help, and is shown an authentication failure as their first experience of
  # Bolt. Asking a question whose answer cannot change the outcome is the
  # definition of a nag.
  #
  # `id -Gn` lists the invoking user's group names; membership of `admin` is what
  # macOS actually consults for /Applications write access and for sudoers. A
  # non-admin skips straight to ~/Applications, silently and successfully.
  if [ "$installed" -ne 1 ] && [ -r /dev/tty ] && id -Gn 2>/dev/null | tr ' ' '\n' | grep -qx admin; then
    say "  Your Mac password is needed to install into the Applications folder."
    sudo rm -rf "${INSTALL_APP_PATH}" 2>/dev/null < /dev/tty || true
    if sudo cp -R "${SOURCE_APP}" "${INSTALL_BASE}/" < /dev/tty; then
      installed=1
    fi
  fi

  # Per-user fallback: ~/Applications. Reached by a non-admin without any prompt
  # at all, and by an admin who declined the password.
  #
  # DEGRADED, NOT BROKEN, and the user is told which: a bundle outside
  # /Applications cannot activate the macOS system extension, so the network
  # filter (egress control / DLP enforcement) is unavailable. Everything else —
  # launcher, search, clipboard history, AI, local utilities — is unaffected.
  # `sysext.rs` enforces the /Applications requirement at activation time; it is
  # Apple's rule, not ours.
  if [ "$installed" -ne 1 ]; then
    INSTALL_BASE="${HOME}/Applications"
    INSTALL_APP_PATH="${INSTALL_BASE}/${INSTALL_APP_BASENAME}"
    info "Installing to ${INSTALL_BASE} (no administrator rights needed)"
    note "Installed to ${INSTALL_BASE}, so the network filter is unavailable. Everything else works."
    mkdir -p "${INSTALL_BASE}" || { hdiutil detach "${MOUNT_POINT}" -quiet 2>/dev/null; fail "${APP_NAME} could not be installed: ${INSTALL_BASE} could not be created."; }
    rm -rf "${INSTALL_APP_PATH}" 2>/dev/null || true
    cp -R "${SOURCE_APP}" "${INSTALL_BASE}/" \
      || { hdiutil detach "${MOUNT_POINT}" -quiet 2>/dev/null; fail "${APP_NAME} could not be copied into ${INSTALL_BASE}."; }
    installed=1
  fi

  [ "$installed" -eq 1 ] || { hdiutil detach "${MOUNT_POINT}" -quiet 2>/dev/null; fail "${APP_NAME} could not be copied into the Applications folder."; }
  progress_step "copying"
  ok "Installed to ${INSTALL_APP_PATH}"

  # Gatekeeper. Two eras, one code path, no installer change on the day the
  # Apple Developer ID cert lands (enrollment JMFF8KMF5W):
  #
  #   NOT notarized (today, self-signed cert) — strip com.apple.quarantine so
  #     Gatekeeper never evaluates the app. Without this the user gets
  #     "cannot be opened because the developer cannot be verified".
  #   NOTARIZED (once the Apple cert ships) — do NOT strip. The stapled ticket
  #     is what we want Gatekeeper to see: it's the whole point of notarizing,
  #     it keeps the quarantine provenance macOS uses for later checks, and a
  #     blanket `xattr -cr` would throw away the trust we just paid for.
  #
  # `stapler validate` is the honest test — it passes only when a real Apple
  # ticket is stapled to THIS bundle, so the branch flips by itself the first
  # time a notarized build is installed.
  if xcrun stapler validate "${INSTALL_APP_PATH}" >/dev/null 2>&1; then
    ok "Notarized by Apple — Gatekeeper will verify it natively"
  else
    info "Marking ${APP_NAME} as trusted..."
    if ! xattr -cr "${INSTALL_APP_PATH}" 2>/dev/null; then
      if [ -r /dev/tty ]; then
        sudo xattr -cr "${INSTALL_APP_PATH}" 2>/dev/null < /dev/tty || true
      fi
    fi
    ok "App trusted — ready to launch"
  fi

  progress_step "trusting"

  APP_IDENTIFIER="app.sparcle.bolt.enterprise"
  persist_pg_runtime_sources "$APP_IDENTIFIER"
  seed_embedded_postgres_runtime "$APP_IDENTIFIER"
  persist_database_runtime_config "$APP_IDENTIFIER"
  progress_step "configuring"
  APP_EXECUTABLE=$(resolve_macos_executable "${INSTALL_APP_PATH}")
  prewarm_embedded_postgres "$APP_EXECUTABLE" "$APP_IDENTIFIER"
  progress_step "database"

  # Remove a bundle left behind by the pre-rename name. See remove_legacy_bundles.
  remove_legacy_bundles

  # Link CLI.
  #
  # The target is the bundle's REAL executable (CFBundleExecutable, which is
  # `bolt`), resolved just above. It used to be ".../Contents/MacOS/${APP_NAME}",
  # a file that has never existed under any product name — so every install
  # produced a DANGLING `~/.local/bin/bolt` and the `bolt` CLI simply did not
  # work. Confirmed on the founder's machine: the symlink pointed at
  # "/Applications/Bolt Enterprise.app/Contents/MacOS/Bolt Enterprise".
  mkdir -p "${HOME}/.local/bin"
  ln -sf "${APP_EXECUTABLE}" "${HOME}/.local/bin/bolt" 2>/dev/null || true
  case ":${PATH}:" in
    *":${HOME}/.local/bin:"*) ;;
    *) add_to_path "${HOME}/.local/bin" ;;
  esac

  hdiutil detach "${MOUNT_POINT}" -quiet 2>/dev/null || true
  progress_step "finishing"

  info "Launching ${APP_NAME}..."
  progress_phase "Starting"
  open "${INSTALL_APP_PATH}"
  verify_runtime_contract
}

# ══════════════════════════════════════════════════════════════════════════════
# Linux (.deb): install via dpkg → launch
# ══════════════════════════════════════════════════════════════════════════════
install_linux_deb() {
  APP_FILE_NAME=$(echo "${APP_NAME}" | tr ' ' '-')

  info "Installing ${APP_NAME} via .deb package..."
  progress_phase "Installing" 5

  cleanup_legacy_linux_native_install "${APP_FILE_NAME}"

  # Stop any running instance BEFORE dpkg swaps the on-disk binaries. Two cases:
  #  - migrating from a prior AppImage install at ~/.local/bin (stop_running_linux_app)
  #  - upgrading an existing .deb whose real processes are `bolt` + `bolt-api`
  #    (stop_installed_deb_processes). The old `pkill -f "${APP_FILE_NAME}"` matched
  #    neither — the running cmdline is `/usr/bin/bolt`, which contains no
  #    "Bolt-Enterprise" — so the old app was never stopped and the "upgrade"
  #    kept running old in-memory code (see stop_installed_deb_processes).
  APPIMAGE_PATH="${HOME}/.local/bin/${APP_FILE_NAME}.AppImage"
  stop_running_linux_app "${APPIMAGE_PATH}"
  stop_installed_deb_processes

  # Remove old AppImage if switching to .deb
  rm -f "${APPIMAGE_PATH}" 2>/dev/null || true

  # Wipe stale WebKitGTK cache dirs on upgrade so the freshly-installed
  # PWA bundle is what the WebView serves on first launch. Without this,
  # an upgrade install (e.g. 0.1.35 → 0.1.38) leaves caches.delete /
  # indexedDB.deleteDatabase unable to evict the cached service-worker
  # bundle, and the in-app "Build ID mismatch — Self-heal did not stick"
  # error fires on every launch (see bolt-pwa build-id-watcher.ts).
  # Fresh installs no-op (dirs don't exist yet). Run as the invoking user
  # (NOT under sudo) because the dirs are user-owned in $HOME.
  CACHE_IDENTIFIER="app.sparcle.bolt.enterprise"
  CACHE_BASE="${HOME}/.local/share/${CACHE_IDENTIFIER}"
  for cache_dir in CacheStorage WebKitCache databases localstorage mediakeys storage; do
    rm -rf "${CACHE_BASE}/${cache_dir}" 2>/dev/null || true
  done
  rm -f "${CACHE_BASE}/hsts-storage.sqlite" 2>/dev/null || true
  rm -f "${CACHE_BASE}/.last-build-id" 2>/dev/null || true
  progress_step "stopping the old app"

  # Announced on the SCREEN, not just the log: sudo is about to ask for a
  # password, and a prompt with no explanation in front of it is alarming.
  if ! sudo -n true 2>/dev/null; then
    say "  Your password is needed to install ${APP_NAME}."
  fi
  sudo dpkg -i "${DL_PATH}" < /dev/tty \
    || { sudo apt-get install -f -y < /dev/tty 2>/dev/null || true; sudo dpkg -i "${DL_PATH}" < /dev/tty; } \
    || fail "The ${APP_NAME} package could not be installed.\n  You can install it by hand with: sudo dpkg -i ${DL_PATH}"
  progress_step "unpacking"
  ok "Installed ${APP_NAME} via dpkg"

  # Find and launch the installed binary. The Tauri .deb names the main GUI
  # binary after the Cargo package (`bolt`) — NOT the productName — and installs
  # the sidecar next to it as `bolt-api`. So the old guesses (`Bolt-Enterprise`)
  # never matched, and the fallback passed a .deb FILENAME to `dpkg -L` (which
  # wants a package NAME), so nothing resolved: the app was never launched and
  # the installer still printed "is running!". Resolve the real path from dpkg's
  # file list for the actual package, excluding the sidecar.
  LAUNCH_BIN=""
  for candidate in "/usr/bin/bolt" "/usr/local/bin/bolt" \
                   "/usr/bin/${APP_FILE_NAME}" "/usr/local/bin/${APP_FILE_NAME}"; do
    [ -x "$candidate" ] && LAUNCH_BIN="$candidate" && break
  done
  if [ -z "$LAUNCH_BIN" ]; then
    PKG_NAME=$(dpkg-deb -f "${DL_PATH}" Package 2>/dev/null || true)
    [ -n "$PKG_NAME" ] || PKG_NAME="bolt-enterprise"
    LAUNCH_BIN=$(dpkg -L "$PKG_NAME" 2>/dev/null \
      | grep -E '/usr(/local)?/bin/' | grep -vE '/bolt-api$' \
      | while IFS= read -r p; do [ -x "$p" ] && [ ! -d "$p" ] && printf '%s\n' "$p" && break; done)
  fi

  if [ -n "$LAUNCH_BIN" ] && [ -x "$LAUNCH_BIN" ]; then
    APP_IDENTIFIER="app.sparcle.bolt.enterprise"
    persist_pg_runtime_sources "$APP_IDENTIFIER"
    seed_embedded_postgres_runtime "$APP_IDENTIFIER"
    persist_database_runtime_config "$APP_IDENTIFIER"
    progress_step "configuring"
    prewarm_embedded_postgres "$LAUNCH_BIN" "$APP_IDENTIFIER"
    progress_step "database"

    info "Launching ${APP_NAME}..."
    progress_phase "Starting"
    nohup "$LAUNCH_BIN" >/dev/null 2>&1 &
    verify_runtime_contract
  else
    info "Installed — launch ${APP_NAME} from your application menu."
  fi
}

# ══════════════════════════════════════════════════════════════════════════════
# Linux (AppImage): install AppImage → make executable → launch
# ══════════════════════════════════════════════════════════════════════════════
install_linux_appimage() {
  if ! command -v fusermount >/dev/null 2>&1 && ! command -v fusermount3 >/dev/null 2>&1; then
    warn "FUSE not found — AppImage needs it to run."
    # Installing FUSE needs root. This branch is now reachable BY a user who has
    # no root (that is the point of choosing the AppImage), so ask only when the
    # answer can succeed — otherwise print the one command an administrator has
    # to run and carry on. Carrying on is safe because `launch_linux_app` already
    # falls back to extract-and-run when `fuse_usable` says no, so a FUSE-less
    # machine still ends up with a running app.
    # Announced on the SCREEN before the branch that can prompt: sudo is about to
    # ask for a password, and a prompt with no explanation in front of it is
    # alarming.
    if can_sudo; then
      sudo -n true 2>/dev/null || say "  Your password is needed to install a system component (FUSE)."
    fi
    if ! can_sudo; then
      warn "FUSE must be installed by an administrator. Ask them to run one of:"
      warn "  sudo apt install libfuse2   |   sudo dnf install fuse-libs   |   sudo pacman -S fuse2"
    elif command -v apt-get >/dev/null 2>&1; then
      info "Detected Ubuntu/Debian — installing libfuse2..."
      sudo apt-get update -qq < /dev/tty || true
      sudo apt-get install -y -qq libfuse2 < /dev/tty \
        && ok "libfuse2 installed" \
        || warn "Could not install libfuse2. You may need to run: sudo apt install libfuse2"
    elif command -v dnf >/dev/null 2>&1; then
      info "Detected Fedora/RHEL — installing fuse-libs..."
      sudo dnf install -y -q fuse-libs < /dev/tty \
        && ok "fuse-libs installed" \
        || warn "Could not install fuse-libs. You may need to run: sudo dnf install fuse-libs"
    elif command -v pacman >/dev/null 2>&1; then
      info "Detected Arch — installing fuse2..."
      sudo pacman -S --noconfirm fuse2 < /dev/tty \
        && ok "fuse2 installed" \
        || warn "Could not install fuse2. You may need to run: sudo pacman -S fuse2"
    else
      warn "Could not detect package manager. Install FUSE manually for AppImage support."
    fi
  fi

  INSTALL_DIR="${HOME}/.local/bin"
  mkdir -p "${INSTALL_DIR}"

  APP_FILE_NAME=$(echo "${APP_NAME}" | tr ' ' '-')
  DEST="${INSTALL_DIR}/${APP_FILE_NAME}.AppImage"

  info "Installing ${APP_NAME} to ${DEST}..."
  progress_phase "Installing" 5

  cleanup_legacy_linux_native_install "${APP_FILE_NAME}"
  stop_running_linux_app "${DEST}"
  progress_step "stopping the old app"

  # Copy (not move) so the cache survives for the next re-run.
  cp -f "${DL_PATH}" "${DEST}"
  chmod +x "${DEST}"
  progress_step "copying"
  ok "Installed to ${DEST}"

  # ── Desktop integration: .desktop file + icon ──────────────────────────────
  ICON_DIR="${HOME}/.local/share/icons/hicolor/256x256/apps"
  ICON_PATH="${ICON_DIR}/${APP_FILE_NAME}.png"
  DESKTOP_DIR="${HOME}/.local/share/applications"
  DESKTOP_FILE="${DESKTOP_DIR}/${APP_FILE_NAME}.desktop"

  mkdir -p "${ICON_DIR}" "${DESKTOP_DIR}"

  # Extract icon from AppImage (Tauri embeds .DirIcon as PNG)
  EXTRACT_TMP=$(mktemp -d)
  if cd "${EXTRACT_TMP}" && "${DEST}" --appimage-extract "*.png" >/dev/null 2>&1; then
    EXTRACTED_ICON=$(find "${EXTRACT_TMP}/squashfs-root" -name "*.png" -type f 2>/dev/null | head -1)
    if [ -n "${EXTRACTED_ICON}" ]; then
      cp "${EXTRACTED_ICON}" "${ICON_PATH}" 2>/dev/null && ok "Icon installed"
    fi
  fi
  rm -rf "${EXTRACT_TMP}"
  cd "${INSTALL_DIR}" 2>/dev/null || true

  cat > "${DESKTOP_FILE}" <<DESKTOP_EOF
[Desktop Entry]
Type=Application
Name=${APP_NAME}
Exec=${DEST}
Icon=${APP_FILE_NAME}
Comment=Bolt — AI-powered productivity
Categories=Office;Productivity;
Terminal=false
StartupNotify=true
DESKTOP_EOF
  chmod +x "${DESKTOP_FILE}"
  progress_step "desktop entry"
  ok "Desktop shortcut created — ${APP_NAME} will appear in your application menu"

  case ":${PATH}:" in
    *":${INSTALL_DIR}:"*) ;;
    *) add_to_path "${INSTALL_DIR}" ;;
  esac

  APP_IDENTIFIER="app.sparcle.bolt.enterprise"
  persist_pg_runtime_sources "$APP_IDENTIFIER"
  seed_embedded_postgres_runtime "$APP_IDENTIFIER"
  persist_database_runtime_config "$APP_IDENTIFIER"
  progress_step "configuring"
  prewarm_embedded_postgres "$DEST" "$APP_IDENTIFIER"
  progress_step "database"

  info "Launching ${APP_NAME}..."
  progress_phase "Starting"
  launch_linux_app "${DEST}" "${APP_NAME}" || return 1
  verify_runtime_contract
}

# ══════════════════════════════════════════════════════════════════════════════
# Linux: dispatch to .deb or AppImage installer
# ══════════════════════════════════════════════════════════════════════════════
install_linux() {
  if [ "$USE_DEB" -eq 1 ]; then
    install_linux_deb
  else
    install_linux_appimage
  fi
}

# ══════════════════════════════════════════════════════════════════════════════
# Integrity verification of the downloaded artifact
# ══════════════════════════════════════════════════════════════════════════════
# Defends the curl|sh path against corrupted or tampered downloads. Two layers
# with graceful degradation:
#   1. SHA-256 (zero new deps): recompute the file's hash and compare against the
#      release's SHA256SUMS, fetched over HTTPS from the same release.
#   2. minisign (authenticity, stronger): when `minisign` is installed, verify the
#      artifact's detached .sig against the key baked into THIS installer (the
#      Tauri updater public key). Linux .AppImage/.deb and Windows .msi/.exe ship
#      a .sig; macOS .dmg will once the release pipeline signs it. Tauri writes
#      the .sig base64-WRAPPED (its bytes are the base64 of a raw minisign
#      .minisig), so we base64-decode before `minisign -V` (which needs the raw
#      form) — see decode_tauri_sig.
# A mismatch ALWAYS aborts and deletes the file. "Neither available" (an older
# release, or no minisign + no SHA256SUMS) warns and continues so existing
# releases still install — unless BOLT_REQUIRE_VERIFICATION=1, which makes
# verification mandatory (recommended for locked-down/MDM fleets).
BOLT_MINISIGN_PUBKEY="RWSd12rmLcdOLGl9yZ2hL7tigihN0ZGT923La8KNXaLQfW3lsSsPom0Q"

sha256_of() {
  if command -v shasum >/dev/null 2>&1; then
    shasum -a 256 "$1" 2>/dev/null | awk '{print $1}'
  elif command -v sha256sum >/dev/null 2>&1; then
    sha256sum "$1" 2>/dev/null | awk '{print $1}'
  fi
}

# Decode a Tauri-format detached signature ($1) into a raw minisign .minisig
# file ($2). Tauri writes the .sig base64-ENCODED; `minisign -V` needs the
# decoded raw form (starts with "untrusted comment:"). Tries GNU `-d`, BSD `-D`,
# then openssl for macOS/Linux portability, and validates the result actually
# looks like a minisign file. Returns non-zero WITHOUT writing a usable file if
# no decoder works — callers MUST then skip the minisign check (never feed the
# wrapped file to `minisign -V`, which would false-abort a genuine signature).
decode_tauri_sig() {
  in="$1"; out="$2"
  if head -c 18 "$in" 2>/dev/null | grep -q '^untrusted comment:'; then
    cp "$in" "$out" 2>/dev/null   # already raw (defensive; future releases may ship raw)
  else
    base64 -d "$in" > "$out" 2>/dev/null \
      || base64 -D "$in" > "$out" 2>/dev/null \
      || openssl base64 -d -A -in "$in" -out "$out" 2>/dev/null \
      || return 1
  fi
  [ -s "$out" ] && head -c 18 "$out" 2>/dev/null | grep -q '^untrusted comment:'
}

verify_download() {
  [ -f "$DL_PATH" ] || fail "The ${APP_NAME} download disappeared before it could be checked. Run the installer again."
  fname=$(basename "$DL_PATH")
  verified=0
  method=""

  # Layer 1 — SHA-256 against the release's SHA256SUMS.
  sums_path="${CACHE_DIR}/SHA256SUMS-${VERSION}"
  if curl -fsSL --max-time 30 -o "$sums_path" "${BASE_URL}/SHA256SUMS" 2>/dev/null && [ -s "$sums_path" ]; then
    expected=$(awk -v f="$fname" '($2==f)||($2=="*"f){print $1; exit}' "$sums_path")
    if [ -n "$expected" ]; then
      actual=$(sha256_of "$DL_PATH" || true)   # `|| true`: under `set -e`, a host with neither shasum nor sha256sum must fail-soft (warn), not abort the installer
      if [ -z "$actual" ]; then
        warn "No SHA-256 tool (shasum/sha256sum) found — skipping checksum verification."
      elif [ "$expected" = "$actual" ]; then
        verified=1; method="SHA-256"
      else
        rm -f "$DL_PATH" 2>/dev/null || true
        fail "Integrity check FAILED for ${fname}.\n  expected ${expected}\n  got      ${actual:-none}\n  The download is corrupted or has been tampered with — do not run it.\n  Re-download from https://sparcle.app/download; if it fails again, contact security@sparcle.app."
      fi
    fi
  fi

  progress_step "checksum"

  # Layer 2 — minisign authenticity (best-effort; stronger than a checksum).
  # Tauri ships the .sig base64-wrapped, so decode it to a raw minisign file
  # first. If decoding fails, SKIP minisign (Layer 1/SHA-256 still stands) rather
  # than feed a wrapped file to `minisign -V` and false-abort a valid signature.
  if command -v minisign >/dev/null 2>&1; then
    sig_path="${DL_PATH}.sig"
    if curl -fsSL --max-time 30 -o "$sig_path" "${BASE_URL}/${fname}.sig" 2>/dev/null && [ -s "$sig_path" ]; then
      minisig_path="${sig_path}.minisig"
      if decode_tauri_sig "$sig_path" "$minisig_path"; then
        if minisign -V -P "$BOLT_MINISIGN_PUBKEY" -m "$DL_PATH" -x "$minisig_path" >/dev/null 2>&1; then
          if [ -n "$method" ]; then method="${method} + minisign"; else method="minisign"; fi
          verified=1
        else
          rm -f "$DL_PATH" 2>/dev/null || true
          fail "Signature verification FAILED for ${fname} — it is NOT authentically signed by Sparcle.\n  Do not run it. Re-download from https://sparcle.app/download or contact security@sparcle.app."
        fi
      else
        warn "Could not decode signature for ${fname} — skipping minisign check (SHA-256 result stands)."
      fi
    fi
  fi

  progress_step "signature"

  if [ "$verified" -eq 1 ]; then
    ok "Verified ${fname} (${method})"
  else
    warn "Could not verify ${fname}: no signature/checksum available for this release."
    if ! command -v minisign >/dev/null 2>&1; then
      warn "Install 'minisign' (brew install minisign / apt install minisign) for signature verification."
    fi
    if [ "${BOLT_REQUIRE_VERIFICATION:-0}" = "1" ]; then
      rm -f "$DL_PATH" 2>/dev/null || true
      fail "BOLT_REQUIRE_VERIFICATION=1 is set but ${fname} could not be verified — aborting."
    fi
  fi
}

# Verify before we mount/install/run anything from the download.
# Two layers, so two real steps — the percentage counts them, it does not
# estimate anything.
progress_phase "Verifying" 2
verify_download

# ── Run platform installer ───────────────────────────────────────────────────
case "$PLATFORM" in
  macos) install_macos ;;
  linux) install_linux || fail "${APP_NAME} ${VERSION} was installed but would not start." ;;
esac

# ── The result ───────────────────────────────────────────────────────────────
# One line for what happened, one line per thing that is different from what the
# user asked for, one line to the log. Everything else is in the log.
progress_done
if [ "${BOLT_LAUNCHED:-0}" = "1" ]; then
  say "  ${APP_NAME} ${VERSION} is installed and running."
else
  say "  ${APP_NAME} ${VERSION} is installed. Open it from your applications."
fi
[ -n "$SUMMARY_NOTES" ] && say "$SUMMARY_NOTES"
[ -n "$LOG_FILE" ] && say "  Details: ${LOG_FILE}"
say ""