# HTTPS loader intended for the server's /install/shrx route.
# Publish only over TLS already trusted by the target Windows machine.
# Public deployment uses the normal Windows certificate trust store.
$ErrorActionPreference='Stop'
$ProgressPreference='SilentlyContinue'
# Deployment creates /ix and /ia variants by replacing this exact assignment.
$requestedArchitecture='amd64'
$principal=New-Object Security.Principal.WindowsPrincipal([Security.Principal.WindowsIdentity]::GetCurrent())
if(-not $principal.IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)){throw 'Open Administrator PowerShell and run the install command again.'}
# Set this before module loading (including ZIP extraction), not only when
# starting Install-WMK.ps1. Never change LocalMachine or CurrentUser policy.
try { Set-ExecutionPolicy -Scope Process -ExecutionPolicy Bypass -Force -ErrorAction Stop }
catch { throw ('WMK: Cannot apply process execution policy. Check Get-ExecutionPolicy -List; domain MachinePolicy/UserPolicy takes precedence. '+$_.Exception.Message) }
$base='https://manager.open-codex.app'
$releaseBase=$base+'/install/files'
$cpuArchitecture=(Get-CimInstance Win32_Processor | Select-Object -First 1).Architecture
$architecture=if($cpuArchitecture -eq 9){'amd64'}elseif($cpuArchitecture -eq 12){'arm64'}else{throw 'Unsupported CPU architecture.'}
if($requestedArchitecture -ne 'auto' -and $requestedArchitecture -ne $architecture){throw "This entry is for $requestedArchitecture; this computer is $architecture. Use /ix for x64 or /ia for ARM64."}
if(-not [Environment]::Is64BitProcess){throw 'Use native 64-bit Windows PowerShell.'}
$staging=Join-Path $env:TEMP ('WMK-Install-'+[guid]::NewGuid().ToString('N'))
New-Item -ItemType Directory -Path $staging | Out-Null
$release=Invoke-RestMethod -Uri ($releaseBase+'/release-'+$architecture+'.json')
if($release.version -notmatch '^\d+\.\d+\.\d+$' -or @($release.files).Count -gt 32){throw 'Invalid release manifest.'}
if($release.architecture -ne $architecture -or $release.package.name -ne "wmk-core-$($release.version)-windows-$architecture.zip" -or $release.package.sha256 -notmatch '^[a-f0-9]{64}$' -or $release.package.bytes -le 0 -or $release.package.bytes -gt 104857600){throw 'Invalid native package manifest.'}
$archive=Join-Path $staging 'package.zip'
Write-Output ('WMK: Downloading '+$architecture+' package ('+('{0:N2}' -f ($release.package.bytes/1000000))+' MB).')
Invoke-WebRequest -UseBasicParsing -Uri ($base+'/install/packages/'+$release.package.name) -OutFile $archive -TimeoutSec 180
if((Get-Item -LiteralPath $archive).Length -ne $release.package.bytes -or (Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash.ToLowerInvariant() -ne $release.package.sha256){throw 'Package checksum failed.'}
Write-Output 'WMK: Extracting and verifying package.'
Expand-Archive -LiteralPath $archive -DestinationPath $staging -Force
$seen=@{}
foreach($file in $release.files){
    if($file.name -notmatch '^[A-Za-z0-9_.-]+$' -or $file.name -eq '..' -or $seen.ContainsKey($file.name) -or $file.sha256 -notmatch '^[a-f0-9]{64}$'){throw 'Invalid release entry.'}
    $seen[$file.name]=$true
    $destination=Join-Path $staging $file.name
    if((Get-FileHash -LiteralPath $destination -Algorithm SHA256).Hash.ToLowerInvariant() -ne $file.sha256){throw 'Release hash mismatch.'}
}
[IO.File]::WriteAllText((Join-Path $staging 'release.json'),($release|ConvertTo-Json -Depth 8),(New-Object Text.UTF8Encoding($false)))
# OEM systems commonly default to Restricted. Scope the execution policy to
# this child process; organizational Group Policy still takes precedence.
# The child inherits the caller's elevated token and does not request UAC again.
$nativePowerShell=Join-Path $env:SystemRoot 'System32\WindowsPowerShell\v1.0\powershell.exe'
& $nativePowerShell -NoProfile -NonInteractive -ExecutionPolicy Bypass -File (Join-Path $staging 'Install-WMK.ps1') -SourceDirectory $staging -ServerUrl $base
if($LASTEXITCODE -ne 0){throw "WMK installer failed (exit $LASTEXITCODE). Staging files: $staging"}
# Keep the staging files for repair and diagnostic use.

# The user requested that a successful interactive bootstrap close its initiating
# administrator shell. Exiting here affects only this host, after the child's
# verified Core readiness; background components belong to the SYSTEM service.
# For diagnostics: $env:WMK_INSTALL_KEEP_OPEN='1'; irm .../ix | iex
if ($env:WMK_INSTALL_KEEP_OPEN -ne '1') { exit 0 }