#!/bin/sh
set -eu
# HTTPS checksums protect initial install; subsequent updates additionally verify Ed25519.
base=https://ims.d1cloud.io
install_dir=${IMS_INSTALL_DIR:-"$HOME/.local/bin"}
case "$(uname -s)" in Darwin) os=darwin;; Linux) os=linux;; *) echo 'ims supports macOS and Linux.' >&2; exit 1;; esac
case "$(uname -m)" in arm64|aarch64) arch=arm64;; x86_64|amd64) arch=amd64;; *) echo 'Unsupported CPU architecture.' >&2; exit 1;; esac
command -v curl >/dev/null 2>&1 || { echo 'curl is required.' >&2; exit 1; }
tmp=$(mktemp -d)
trap 'rm -rf "$tmp"' EXIT HUP INT TERM
curl -fsSL --proto '=https' --tlsv1.2 "$base/releases/latest.txt" -o "$tmp/version"
version=$(cat "$tmp/version")
case "$version" in ''|*[!0-9.]*|.*|*..*) echo 'Invalid release version.' >&2; exit 1;; esac
asset="ims_${os}_${arch}"
curl -fsSL --proto '=https' --tlsv1.2 "$base/releases/$version/$asset" -o "$tmp/$asset"
curl -fsSL --proto '=https' --tlsv1.2 "$base/releases/$version/checksums.txt" -o "$tmp/checksums.txt"
expected=$(awk -v file="$asset" '$2==file {print $1}' "$tmp/checksums.txt")
if command -v sha256sum >/dev/null 2>&1; then actual=$(sha256sum "$tmp/$asset" | awk '{print $1}'); else actual=$(shasum -a 256 "$tmp/$asset" | awk '{print $1}'); fi
[ -n "$expected" ] && [ "$expected" = "$actual" ] || { echo 'Checksum verification failed.' >&2; exit 1; }
mkdir -p "$install_dir"
staged=$(mktemp "$install_dir/.ims-install.XXXXXX")
cp "$tmp/$asset" "$staged"
chmod 755 "$staged"
mv -f "$staged" "$install_dir/ims"
printf 'Installed ims %s at %s/ims\n' "$version" "$install_dir"
case ":$PATH:" in *":$install_dir:"*) ;; *) printf 'Add to your shell configuration: export PATH="%s:$PATH"\n' "$install_dir";; esac
printf 'Run ims login, then ims skill.\n'