#!/usr/bin/env bash
# ════════════════════════════════════════════════════════════════════════════
# install.sh — RADHIKACHAIN OS · Unified One-Command Installer
# Krittika Phase · RadhikaChain L1 + DharmaGate + Atomic Swap + AgentCore
#
# One-line install (full stack):
#   curl -fsSL https://radhikachain.xyz/install | sudo bash
#
# Or with options:
#   curl -fsSL https://radhikachain.xyz/install | sudo bash -s -- --node-only
#   curl -fsSL https://radhikachain.xyz/install | sudo bash -s -- --stack-only
#   curl -fsSL https://radhikachain.xyz/install | sudo bash -s -- --agentcore
#   ./install.sh --full                       # Install everything (default)
#   ./install.sh --node-only                  # L1 node only
#   ./install.sh --stack-only                # Docker stack + Workers + Swap
#   ./install.sh --agentcore                 # AI engine only
#   ./install.sh --uninstall                 # Remove everything
#
# RADHIKACHAIN OS / A.L.I.C.E. · Krittika Phase
# ════════════════════════════════════════════════════════════════════════════

set -euo pipefail

RED='\033[0;31m'; GREEN='\033[0;32m'; YELLOW='\033[1;33m'
CYAN='\033[0;36m'; BOLD='\033[1m'; RESET='\033[0m'

ok()     { echo -e "  ${GREEN}✓${RESET} $*"; }
fail()   { echo -e "  ${RED}✗${RESET} $*"; ERRORS=$((ERRORS+1)); }
warn()   { echo -e "  ${YELLOW}⚠${RESET} $*"; }
info()   { echo -e "  ${CYAN}→${RESET} $*"; }
section() { echo -e "\n${BOLD}$*${RESET}"; echo "  $(printf '─%.0s' {1..72})"; }

ERRORS=0

# Root check — requiere sudo (usa sudo internamente para Docker, systemd, etc.)
if [[ $EUID -ne 0 ]]; then
  echo -e "  ${RED}✗${RESET} Este script requiere permisos de root."
  echo -e "  ${CYAN}→${RESET} Usa: curl -fsSL https://radhikachain.xyz/install | sudo bash"
  echo -e "  ${CYAN}→${RESET} O:   sudo ./install.sh [--flags]"
  exit 1
fi
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"

# ── DEFAULTS ──────────────────────────────────────────────────────────────────
MODE="full"
INSTALL_NODE=false
INSTALL_STACK=false
INSTALL_AGENTCORE=false
INSTALL_ZERO_TRUST=false
UNINSTALL=false
DRY_RUN=false

# ── PARSE ARGS ──────────────────────────────────────────────────────────────
for arg in "$@"; do
  case $arg in
    --node|-n)      MODE="node"; INSTALL_NODE=true ;;
    --stack|-s)     MODE="stack"; INSTALL_STACK=true ;;
    --agentcore|-a) MODE="agentcore"; INSTALL_AGENTCORE=true ;;
    --full|-f)      MODE="full"; INSTALL_NODE=true; INSTALL_STACK=true; INSTALL_AGENTCORE=true ;;
    --node-only|-N) MODE="node-only"; INSTALL_NODE=true ;;
    --stack-only|-S) MODE="stack-only"; INSTALL_STACK=true ;;
    --zero-trust|-z) MODE="zero-trust"; INSTALL_ZERO_TRUST=true ;;
    --uninstall|-u) UNINSTALL=true ;;
    --dry-run)      DRY_RUN=true ;;
    --help|-h)
      echo "Usage: $0 [OPTIONS]"
      echo ""
      echo "  Installation modes:"
      echo "    --full|-f          Full install (node + stack + agentcore) [default]"
      echo "    --node-only|-N     L1 node only"
      echo "    --stack-only|-S    Docker stack + Workers + Swap"
      echo "    --agentcore|-a     AI engine only"
      echo "    --zero-trust|-z    Zero Trust + Mesh + Post-Quantum"
      echo "    --node|-n          Install node (can be combined)"
      echo "    --stack|-s         Install stack (can be combined)"
      echo ""
      echo "  Other options:"
      echo "    --uninstall|-u     Remove everything"
      echo "    --dry-run          Simulate without executing"
      echo "    --help|-h          Show this help"
      echo ""
      echo "Examples:"
      echo '  curl -fsSL https://radhikachain.xyz/install | sudo bash'
      echo '  sudo ./install.sh --node-only --ecr'
      echo '  sudo ./install.sh --stack-only'
      echo '  sudo ./install.sh --full --dry-run'
      echo '  sudo ./install.sh --zero-trust'
      exit 0
      ;;
    *) ;;
  esac
done

# ── DERIVE MODE ─────────────────────────────────────────────────────────────
if [[ "${1:-}" != -* ]] && [[ -n "${1:-}" ]]; then
  MODE="$1"; shift
fi

case "$MODE" in
  full|all)        INSTALL_NODE=true; INSTALL_STACK=true; INSTALL_AGENTCORE=true ;;
  node-only|node)  INSTALL_NODE=true ;;
  stack-only|stack) INSTALL_STACK=true ;;
  agentcore)       INSTALL_AGENTCORE=true ;;
esac

# ── UNINSTALL ───────────────────────────────────────────────────────────────
if [[ "$UNINSTALL" == true ]]; then
  section "🗑️  UNINSTALLING RADHIKACHAIN OS"
  if [[ -f "$SCRIPT_DIR/install-node.sh" ]]; then
    info "Running install-node.sh --uninstall..."
    bash "$SCRIPT_DIR/install-node.sh" --uninstall || true
  fi
  if [[ -f "$SCRIPT_DIR/uninstall-agentcore.sh" ]]; then
    bash "$SCRIPT_DIR/uninstall-agentcore.sh" || true
  fi
  warn "Remove Docker networks, volumes, and .env manually if needed"
  ok "Uninstall complete"
  exit 0
fi

# ── HEADER ──────────────────────────────────────────────────────────────────
echo ""
echo -e "${BOLD}  🌕 RADHIKACHAIN OS — Unified Installer — Krittika Phase${RESET}"
echo -e "  ${CYAN}$(date '+%Y-%m-%d %H:%M:%S')${RESET}"
echo ""

# Detect OS
if [[ -f /etc/os-release ]]; then
  . /etc/os-release
  OS="$ID"
  VER="$VERSION_ID"
  ok "OS: $NAME $VER"
else
  OS=$(uname -s | tr '[:upper:]' '[:lower:]')
  ver "OS: $OS"
fi

# Architecture
ARCH=$(uname -m)
info "Architecture: $ARCH"

# ── DRY RUN MODE ──────────────────────────────────────────────────────────────
if [[ "$DRY_RUN" == true ]]; then
  section "🔍  DRY-RUN MODE — No changes will be made"
  info "Would install node:      $INSTALL_NODE"
  info "Would install stack:     $INSTALL_STACK"
  info "Would install AgentCore: $INSTALL_AGENTCORE"
  echo ""
  echo "  Commands that would run:"
  if [[ "$INSTALL_NODE" == true ]]; then
    echo "    → $SCRIPT_DIR/install-node.sh"
  fi
  if [[ "$INSTALL_STACK" == true ]]; then
    echo "    → $SCRIPT_DIR/deploy-full.sh"
  fi
  if [[ "$INSTALL_AGENTCORE" == true ]]; then
    echo "    → $SCRIPT_DIR/install-agentcore.sh"
    echo "    → cd agent-core && npm run deploy"
  fi
  echo ""
  ok "Dry-run complete. Run without --dry-run to install."
  exit 0
fi

# ── STEP 1: PREREQUISITES ───────────────────────────────────────────────────
section "STEP 1/4 — PREREQUISITES"

# Check for root (only if installing node or stack)
if [[ "$INSTALL_NODE" == true || "$INSTALL_STACK" == true ]]; then
  if [[ $EUID -ne 0 ]]; then
    fail "Root/sudo required for node or stack install"
    exit 1
  fi
  ok "Running as root"
fi

# Check Docker
if [[ "$INSTALL_NODE" == true || "$INSTALL_STACK" == true ]]; then
  if command -v docker &>/dev/null; then
    ok "Docker $(docker --version | awk '{print $3}' | sed 's/,//')"
  else
    info "Installing Docker..."
    curl -fsSL https://get.docker.com | sh
    systemctl enable --now docker 2>/dev/null || true
    ok "Docker installed"
  fi

  # Docker Compose
  if docker compose version &>/dev/null; then
    ok "Docker Compose available"
  elif command -v docker-compose &>/dev/null; then
    ok "docker-compose available"
  else
    info "Installing Docker Compose plugin..."
    apt-get update -qq && apt-get install -y docker-compose-plugin 2>/dev/null || {
      # fallback
      DOCKER_COMPOSE_VERSION=$(curl -sL https://api.github.com/repos/docker/compose/releases/latest | grep -oP '"tag_name":\s*"\K[^"]+')
      curl -fsSL "https://github.com/docker/compose/releases/download/${DOCKER_COMPOSE_VERSION}/docker-compose-Linux-x86_64" -o /usr/local/bin/docker-compose
      chmod +x /usr/local/bin/docker-compose
    }
    ok "Docker Compose installed"
  fi
fi

# Check Node.js
if [[ "$INSTALL_AGENTCORE" == true ]]; then
  if command -v node &>/dev/null; then
    NODE_VER=$(node -v | sed 's/v//')
    NODE_MAJOR=$(echo "$NODE_VER" | cut -d. -f1)
    if [[ "$NODE_MAJOR" -ge 20 ]]; then
      ok "Node.js $NODE_VER"
    else
      warn "Node.js >= 20 recommended (got $NODE_VER)"
    fi
  else
    info "Installing Node.js..."
    curl -fsSL https://deb.nodesource.com/setup_20.x | bash -
    apt-get install -y nodejs 2>/dev/null || brew install node 2>/dev/null || {
      fail "Could not install Node.js"
      exit 1
    }
    ok "Node.js installed"
  fi
fi

# Check git, curl
for cmd in git curl; do
  command -v "$cmd" &>/dev/null && ok "$cmd available" || fail "$cmd not found"
done

if [[ $ERRORS -gt 0 ]]; then
  fail "Prerequisite check failed. Fix errors above."
  exit 1
fi

# ── STEP 2: NODE INSTALL ────────────────────────────────────────────────────
if [[ "$INSTALL_NODE" == true ]]; then
  section "STEP 2/4 — L1 NODE (install-node.sh)"

  if [[ ! -f "$SCRIPT_DIR/install-node.sh" ]]; then
    fail "install-node.sh not found in $SCRIPT_DIR"
    exit 1
  fi

  info "Running install-node.sh..."
  bash "$SCRIPT_DIR/install-node.sh" "$@" || {
    fail "Node installation failed"
    exit 1
  }

  ok "L1 Node installed"
  echo ""
  echo "  Service:   systemctl status radhika-node"
  echo "  Logs:      docker logs -f radhika-seed"
  echo "  Config:    /etc/radhika/radhika.conf"
  echo "  RPC:       http://127.0.0.1:8332"
fi

# ── STEP 3: STACK INSTALL ───────────────────────────────────────────────────
if [[ "$INSTALL_STACK" == true ]]; then
  section "STEP 3/4 — FULL STACK (deploy-full.sh)"

  if [[ ! -f "$SCRIPT_DIR/deploy-full.sh" ]]; then
    fail "deploy-full.sh not found in $SCRIPT_DIR"
    exit 1
  fi

  # Ensure .env exists
  if [[ ! -f "$SCRIPT_DIR/.env" ]]; then
    warn ".env not found — stack deployment requires environment variables"
    info "Create $SCRIPT_DIR/.env from the template:"
    cat << 'ENVTEMPLATE'
# Minimal .env for RadhikaChain
CF_API_TOKEN=your_cf_api_token
CF_ACCOUNT_ID=your_cf_account_id
CF_ZONE_ID=your_cf_zone_id
RADHIKA_RPC_USER=radhika
RADHIKA_RPC_PASS=your_secure_password
DHARMA_HMAC_SECRET=your_hmac_secret
BRIDGE_API_KEY=your_bridge_key
ENVTEMPLATE
    exit 1
  fi

  info "Running deploy-full.sh..."
  bash "$SCRIPT_DIR/deploy-full.sh" || {
    fail "Stack deployment failed. Check logs above."
    exit 1
  }

  ok "Full stack deployed"
  echo ""
  echo "  Workers:   https://dharma.radhikachain.xyz"
  echo "  Checkout:  https://checkout.radhikachain.xyz"
  echo "  Swap:      http://localhost:4000"
  echo "  ZMQ:       tcp://127.0.0.1:28332...28335"
fi

# ── STEP 4: AGENTCORE INSTALL ───────────────────────────────────────────────
if [[ "$INSTALL_AGENTCORE" == true ]]; then
  section "STEP 4/5 — AGENTCORE (install-agentcore.sh)"

  if [[ ! -f "$SCRIPT_DIR/install-agentcore.sh" ]]; then
    warn "install-agentcore.sh not found — skipping"
  else
    bash "$SCRIPT_DIR/install-agentcore.sh" || {
      fail "AgentCore installation failed"
      # Don't exit — AgentCore is optional
      warn "Continuing without AgentCore"
    }

    # Deploy AgentCore Worker
    if [[ -d "$SCRIPT_DIR/agent-core" ]]; then
      info "Deploying AgentCore Worker..."
      cd "$SCRIPT_DIR/agent-core"
      npm run deploy 2>/dev/null && ok "AgentCore Worker deployed" || warn "AgentCore deploy had warnings"
    fi

    info "AgentCore:    Edge-routed.     No data stored.       User owns everything."
    info "Registry:   https://dharma.radhikachain.xyz/agentcore-status"
  fi
fi

# ── STEP 5: ZERO TRUST + MESH + POST-QUANTUM ────────────────────────────────
if [[ "$INSTALL_ZERO_TRUST" == true ]]; then
  section "STEP 5/5 — ZERO TRUST + MESH + POST-QUANTUM"

  if [[ ! -f "$SCRIPT_DIR/setup-zero-trust.sh" ]]; then
    warn "setup-zero-trust.sh not found — skipping"
  else
    bash "$SCRIPT_DIR/setup-zero-trust.sh" || {
      fail "Zero Trust setup failed"
      warn "Continuing without Zero Trust"
    }

    info "Zero Trust:   GitHub auth. Mesh network. Post-Quantum Encryption."
    info "Privacy:      Public by default. Per-citizen sovereignty."
  fi
fi

# ── VERIFICATION ────────────────────────────────────────────────────────────
section "🔍  POST-INSTALL VERIFICATION"

SUCCESS=0
TOTAL=0

check_service() {
  TOTAL=$((TOTAL+1))
  if systemctl is-active --quiet "$1" 2>/dev/null; then
    ok "Service: $1"
    SUCCESS=$((SUCCESS+1))
  elif docker ps --format '{{.Names}}' | grep -q "$1" 2>/dev/null; then
    ok "Container: $1"
    SUCCESS=$((SUCCESS+1))
  else
    fail "Service/Container: $1"
  fi
}

check_url() {
  TOTAL=$((TOTAL+1))
  URL="$1"
  EXPECTED="${2:-200}"
  CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 "$URL" 2>/dev/null || echo "000")
  if [[ "$CODE" == "$EXPECTED" ]]; then
    ok "Endpoint: $URL ($CODE)"
    SUCCESS=$((SUCCESS+1))
  else
    fail "Endpoint: $URL (got $CODE, expected $EXPECTED)"
  fi
}

if [[ "$INSTALL_NODE" == true ]]; then
  check_service "radhika-seed"

  # Genesis hash check
  GENESIS=$(docker exec radhika-seed radhika-cli \
    -rpcuser="${RADHIKA_RPC_USER:-radhika}" \
    -rpcpassword="${RADHIKA_RPC_PASS:-$(cat /etc/radhika/credentials.env 2>/dev/null | grep RPC_PASS | cut -d= -f2)}" \
    getblockhash 0 2>/dev/null || true)
  if [[ "$GENESIS" == "00000000367efa345a130ec8944e80fe3cc3d675543f8500c0f085184a4be5a7" ]]; then
    ok "Genesis hash verified ✓"
  else
    warn "Genesis hash: ${GENESIS:-'N/A'}"
  fi
fi

if [[ "$INSTALL_STACK" == true ]]; then
  check_url "https://dharma.radhikachain.xyz/status" "200"
  check_url "https://checkout.radhikachain.xyz/status" "200"

  # Zero Trust RPC
  ZT_CODE=$(curl -s -o /dev/null -w "%{http_code}" --max-time 5 \
    "https://rpc.radhikachain.xyz" 2>/dev/null || echo "000")
  if [[ "$ZT_CODE" == "403" ]]; then
    ok "Zero Trust RPC: 403 ✓"
  else
    warn "Zero Trust RPC: $ZT_CODE (expected 403)"
  fi
fi

echo ""
echo "  $(printf '─%.0s' {1..72})"
if [[ $SUCCESS -eq $TOTAL ]]; then
  echo -e "  ${GREEN}${BOLD}✅  ALL SYSTEMS NOMINAL — $SUCCESS/$TOTAL checks passed${RESET}"
else
  echo -e "  ${YELLOW}${BOLD}⚠️   $SUCCESS/$TOTAL checks passed — some services may need time to start${RESET}"
fi
echo ""

# ── SUMMARY ─────────────────────────────────────────────────────────────────
section "📋  INSTALLATION SUMMARY"

echo ""
echo -e "  ${BOLD}Install mode:${RESET}       $MODE"
echo -e "  ${BOLD}Node:${RESET}               $([ "$INSTALL_NODE" == true ] && echo "✅ installed" || echo "❌ skipped")"
echo -e "  ${BOLD}Stack:${RESET}              $([ "$INSTALL_STACK" == true ] && echo "✅ deployed" || echo "❌ skipped")"
echo -e "  ${BOLD}AgentCore:${RESET}          $([ "$INSTALL_AGENTCORE" == true ] && echo "✅ installed" || echo "❌ skipped")"
echo -e "  ${BOLD}Zero Trust:${RESET}         $([ "$INSTALL_ZERO_TRUST" == true ] && echo "✅ configured" || echo "❌ skipped")"
echo ""
echo -e "  ${BOLD}Monitoring:${RESET}"
echo "    systemctl status radhika-node"
echo "    docker logs -f radhika-seed"
echo "    docker ps"
echo ""
echo -e "  ${BOLD}Audit:${RESET}              ./test-audit.sh --build"
echo -e "  ${BOLD}Production audit:${RESET}   ./audit-production.sh"
echo -e "  ${BOLD}Zero Trust verify:${RESET}  ./verify-pqc.sh"
echo ""
echo -e "  ${CYAN}Public by default. Privacy is per-citizen.${RESET}"
echo -e "  ${CYAN}We store WHAT was done, not WHO did it.${RESET}"
echo -e "  ${CYAN}User owns everything. Engine stores nothing. Edge-routed AI.${RESET}"
echo ""