#!/usr/bin/env bash
set -Eeuo pipefail
umask 077
fail() { printf '%s\n' "$*" >&2; exit 1; }
if [[ "${1:-}" == --help ]]; then
  echo 'Carrier MCP 0.2.0 Linux systemd installer. Options: --dry-run, --port, --public-url, --tls-cert, --tls-key, --ca-file (forwarded to server installer).'; exit 0
fi
[[ "$(uname -s)" == Linux ]] || fail '服务器安装需要 Linux；桌面系统请参阅 /docs/carrier-mcp/'
case "$(uname -m)" in
  x86_64) arch=amd64 ;;
  aarch64|arm64) arch=arm64 ;;
  *) fail '支持 Linux amd64 / arm64' ;;
esac
# Check the service environment before changing any packages.
dry_run=false
for arg in "$@"; do [[ "$arg" != --dry-run ]] || dry_run=true; done
[[ -d /run/systemd/system ]] || fail '当前主机未运行 systemd；请在完整 Linux 服务器上安装'
missing=()
for cmd in curl sha256sum tar gzip mktemp install ss flock file openssl systemctl systemd-analyze useradd runuser getent; do
  command -v "$cmd" >/dev/null 2>&1 || missing+=("$cmd")
done
[[ -s /etc/ssl/certs/ca-certificates.crt || -s /etc/pki/tls/certs/ca-bundle.crt ]] || missing+=(ca-certificates)
if ((${#missing[@]})); then
  printf '缺少依赖：%s\n' "${missing[*]}"
  manager=''
  for candidate in apt-get dnf yum zypper; do
    if command -v "$candidate" >/dev/null 2>&1; then manager=$candidate; break; fi
  done
  [[ -n "$manager" ]] || fail '未识别包管理器；支持 apt-get、dnf、yum、zypper，请手动安装上述依赖'
  packages=()
  for cmd in "${missing[@]}"; do
    case "$cmd" in
      sha256sum|mktemp|install) package=coreutils ;;
      ss) if [[ "$manager" == apt-get || "$manager" == zypper ]]; then package=iproute2; else package=iproute; fi ;;
      flock|runuser) package=util-linux ;;
      useradd) if [[ "$manager" == apt-get ]]; then package=passwd; else package=shadow-utils; [[ "$manager" != zypper ]] || package=shadow; fi ;;
      getent) if [[ "$manager" == apt-get ]]; then package=libc-bin; else package=glibc; [[ "$manager" != zypper ]] || package=glibc-utils; fi ;;
      systemctl|systemd-analyze) package=systemd ;;
      *) package=$cmd ;;
    esac
    duplicate=false
    for existing in "${packages[@]-}"; do [[ "$existing" != "$package" ]] || duplicate=true; done
    "$duplicate" || packages+=("$package")
  done
  printf '将通过 %s 安装：%s\n' "$manager" "${packages[*]}"
  if "$dry_run"; then
    echo '预览结束：未安装依赖、未下载程序、未修改服务。'; exit 0
  fi
  ((EUID == 0)) || fail '自动安装依赖需要 root，请使用 sudo bash 执行'
  case "$manager" in
    apt-get) apt-get update && DEBIAN_FRONTEND=noninteractive apt-get install -y --no-install-recommends "${packages[@]}" ;;
    dnf|yum) "$manager" install -y "${packages[@]}" ;;
    zypper) zypper --non-interactive install --no-recommends "${packages[@]}" ;;
  esac
  for cmd in "${missing[@]}"; do
    if [[ "$cmd" == ca-certificates ]]; then
      [[ -s /etc/ssl/certs/ca-certificates.crt || -s /etc/pki/tls/certs/ca-bundle.crt ]] || fail 'CA 证书安装后仍不可用'
    else
      command -v "$cmd" >/dev/null 2>&1 || fail "安装后仍缺少：$cmd"
    fi
  done
else
  echo '系统依赖齐全，跳过安装。'
fi
case "$arch" in
  amd64) url='https://intostore.oss-cn-qingdao.aliyuncs.com/carrier/artifact/carrier-team/carrier-mcp/blobs/sha256/fcc76751bf7faeeef8b5b334099199b474115309bf6105a753fa286a7b81af4e'; sha='fcc76751bf7faeeef8b5b334099199b474115309bf6105a753fa286a7b81af4e' ;;
  arm64) url='https://intostore.oss-cn-qingdao.aliyuncs.com/carrier/artifact/carrier-team/carrier-mcp/blobs/sha256/0e67a99a0efc383189402fdf45cff581b03d38d6678f048632571a500cebc2b4'; sha='0e67a99a0efc383189402fdf45cff581b03d38d6678f048632571a500cebc2b4' ;;
esac
stage=$(mktemp -d)
trap 'rm -rf -- "$stage"' EXIT
curl --fail --location --proto '=https' --proto-redir '=https' --retry 3 --connect-timeout 15 --max-time 300 "$url" -o "$stage/package.tar.gz"
printf '%s  %s\n' "$sha" "$stage/package.tar.gz" | sha256sum -c -
tar -xzf "$stage/package.tar.gz" -C "$stage"
bash "$stage/carrier-mcp_0.2.0_linux_${arch}/install-server.sh" "$@"