#!/usr/bin/env bash
# Semurg one-command installer  --  https://one.semurg.io/install
#   curl -fsSL https://one.semurg.io/install | sudo bash
# Downloads the R11 installer, verifies its checksum, and runs it. Idempotent + fail-closed.
set -euo pipefail
BASE="https://one.semurg.io/dl"
TARBALL="semurg-r11-installer.tar.gz"
EXPECT="137408bbcaa7fbfec730d8487dcf5b9b6c85d56853fd898f67459b8b7a24a999"
bold(){ printf '\033[1m%s\033[0m\n' "$*"; }
die(){  printf '\n\033[31mSemurg install failed:\033[0m %s\n' "$*" >&2; exit 1; }
[ "$(id -u)" = "0" ] || die "must run as root. Use:  curl -fsSL https://one.semurg.io/install | sudo bash"
for c in curl tar sha256sum; do command -v "$c" >/dev/null 2>&1 || die "missing '$c'. apt-get install -y curl tar coreutils"; done
bold "==> Downloading Semurg installer"
TMP="$(mktemp -d)"; trap 'rm -rf "$TMP"' EXIT; cd "$TMP"
curl -fSL --retry 3 --retry-delay 2 -o "$TARBALL" "$BASE/$TARBALL" || die "could not download $BASE/$TARBALL"
bold "==> Verifying checksum"
printf '%s  %s\n' "$EXPECT" "$TARBALL" | sha256sum -c - >/dev/null 2>&1 || die "checksum mismatch (expected $EXPECT). Re-run; if it persists email semurg@semurg.org"
printf '    OK  %s\n' "$EXPECT"
bold "==> Unpacking"; tar xzf "$TARBALL" || die "could not unpack"
[ -f semurg_installer/semurg-install.sh ] || die "installer entrypoint missing"
bold "==> Running the Semurg installer"; cd semurg_installer
# Not exec: exec would replace this shell, and the EXIT trap above would never remove the work directory (the 38 MB download and the unpacked installer stayed in /tmp after every install).
# So the installer runs as a child, its exit code is kept, and the trap fires on every path. ONE line, so a child that reads stdin (this script arrives on a pipe) cannot consume what follows.
rc=0; bash ./semurg-install.sh || rc=$?; cd /; exit "$rc"