#!/bin/sh
# Ream Desktop installer — https://ream.design
#
# What this script does, and nothing else:
#   1. downloads the latest Ream release for your Mac (Apple Silicon or Intel)
#   2. verifies the download against its published sha256 checksum
#   3. installs Ream.app into /Applications (replacing a previous version)
#   4. launches the app
#
# Why a script instead of a plain download: the app is not yet notarized by
# Apple, so a browser-downloaded copy is quarantined by macOS and refuses to
# open. curl does not set the quarantine flag, so this install runs without
# any warnings.
set -eu

cleanup() {
  if [ -n "${mount:-}" ]; then hdiutil detach "$mount" -quiet >/dev/null 2>&1 || true; fi
  if [ -n "${tmp:-}" ]; then rm -rf "$tmp"; fi
}

main() {
  if [ "$(uname -s)" != "Darwin" ]; then
    echo "This installer is for macOS. Other builds: https://ream.design/downloads" >&2
    exit 1
  fi

  arch="$(uname -m)"
  # A terminal running under Rosetta reports x86_64 even on Apple Silicon.
  if [ "$arch" = "x86_64" ] && [ "$(sysctl -n sysctl.proc_translated 2>/dev/null || echo 0)" = "1" ]; then
    arch="arm64"
  fi
  case "$arch" in
    arm64) url="https://releases.ream.design/download/mac-arm" ;;
    *) url="https://releases.ream.design/download/mac-intel" ;;
  esac

  if [ ! -w /Applications ]; then
    echo "/Applications is not writable. Re-run from an administrator account." >&2
    exit 1
  fi

  tmp="$(mktemp -d "${TMPDIR:-/tmp}/ream-install.XXXXXX")"
  mount=""
  trap cleanup EXIT INT TERM

  echo "Downloading Ream…"
  curl -fL --retry 3 --progress-bar "$url" -o "$tmp/Ream.dmg"

  # CI publishes the sha256 of every build next to it; a missing checksum is
  # as fatal as a mismatch — no unverified installs.
  expected="$(curl -fsL --retry 3 "$url.sha256" | awk '{ print $1 }')"
  actual="$(shasum -a 256 "$tmp/Ream.dmg" | awk '{ print $1 }')"
  if [ -z "$expected" ] || [ "$actual" != "$expected" ]; then
    echo "Checksum verification failed: the download is corrupted, or a new release is being published right now. Please re-run the installer." >&2
    exit 1
  fi

  # </dev/null: when piped into sh, stdin is the script itself — nothing
  # inside may read it. -mountrandom avoids /Volumes name collisions.
  mount="$(hdiutil attach "$tmp/Ream.dmg" -nobrowse -readonly -mountrandom "$tmp" </dev/null | awk -F'\t' 'END { print $NF }')"
  app="$(find "$mount" -maxdepth 1 -name '*.app' -print -quit)"
  if [ -z "$app" ]; then
    echo "Could not find Ream.app inside the downloaded image." >&2
    exit 1
  fi

  echo "Installing into /Applications…"
  # Remove first, never copy over an existing bundle: the kernel caches the
  # code signature per file, and overwriting in place ends in "Killed: 9".
  rm -rf /Applications/Ream.app
  ditto "$app" /Applications/Ream.app

  hdiutil detach "$mount" -quiet >/dev/null 2>&1 || true
  mount=""

  # Defensive: this download carries no quarantine flag, but the command may
  # be re-run over a copy that was downloaded with a browser earlier.
  xattr -cr /Applications/Ream.app 2>/dev/null || true

  echo "Done — launching Ream."
  open /Applications/Ream.app
}

# The call lives on the last line so a truncated download executes nothing:
# until this point the script has only defined functions.
main