#!/bin/sh
# HeliosDB Installer — Early Adopters Program
# curl -sSf https://install.heliosdb.com | sh
#
# Invoked via `curl | sh`, so this stays POSIX sh (no bashisms) and fails
# closed: -e aborts on any error, -u aborts on an unset variable. This is a
# supply-chain entry point — never download-and-exec without verification.
# When the Q3-2026 native binary installer lands, route every download through
# fetch_verified() below; do NOT add a bare `curl ... | sh` or `chmod +x`.

set -eu

# ---- Pinned release (single source of truth; bump on each release) ----
HELIOS_VERSION="${HELIOS_VERSION:-}"          # e.g. v3.58.1 — empty until binaries ship
HELIOS_BASE_URL="https://install.heliosdb.com/releases"
# minisign public key for HeliosDB release artifacts. Pinned here so a
# compromised origin cannot swap signatures along with the binary.
HELIOS_MINISIGN_PUBKEY="${HELIOS_MINISIGN_PUBKEY:-}"   # populate at first signed release

# fetch_verified <artifact-filename>
#   Downloads <artifact>, its SHA256SUMS, and SHA256SUMS.minisig from the
#   pinned, versioned release URL into a temp dir; verifies the signature over
#   SHA256SUMS (minisign), then verifies the artifact's checksum against it.
#   Prints the verified artifact path on stdout. Aborts (set -e) on any failure.
#   Intentionally dormant until HELIOS_VERSION + HELIOS_MINISIGN_PUBKEY are set.
fetch_verified() {
    artifact="$1"
    [ -n "$HELIOS_VERSION" ] || { echo "fetch_verified: HELIOS_VERSION not pinned" >&2; return 1; }
    [ -n "$HELIOS_MINISIGN_PUBKEY" ] || { echo "fetch_verified: signing key not pinned" >&2; return 1; }
    command -v minisign >/dev/null 2>&1 || { echo "fetch_verified: minisign required" >&2; return 1; }
    command -v sha256sum >/dev/null 2>&1 || { echo "fetch_verified: sha256sum required" >&2; return 1; }

    base="$HELIOS_BASE_URL/$HELIOS_VERSION"
    tmp="$(mktemp -d)"
    trap 'rm -rf "$tmp"' EXIT

    # --fail makes curl exit non-zero on HTTP errors (avoids saving error pages);
    # --proto '=https' --tlsv1.2 refuse plaintext/downgraded transports.
    for f in "$artifact" "SHA256SUMS" "SHA256SUMS.minisig"; do
        curl -fsSL --proto '=https' --tlsv1.2 -o "$tmp/$f" "$base/$f"
    done

    # 1) signature over the checksum file, 2) checksum over the artifact.
    minisign -Vm "$tmp/SHA256SUMS" -P "$HELIOS_MINISIGN_PUBKEY" >/dev/null
    ( cd "$tmp" && grep " $artifact\$" SHA256SUMS | sha256sum -c - >/dev/null )

    echo "$tmp/$artifact"
}

CYAN='\033[0;36m'
PURPLE='\033[0;35m'
GREEN='\033[0;32m'
YELLOW='\033[1;33m'
WHITE='\033[1;37m'
DIM='\033[2m'
BOLD='\033[1m'
NC='\033[0m'

clear 2>/dev/null || true

echo ""
echo -e "${CYAN}"
cat << 'LOGO'

    ██╗  ██╗███████╗██╗     ██╗ ██████╗ ███████╗██████╗ ██████╗
    ██║  ██║██╔════╝██║     ██║██╔═══██╗██╔════╝██╔══██╗██╔══██╗
    ███████║█████╗  ██║     ██║██║   ██║███████╗██║  ██║██████╔╝
    ██╔══██║██╔══╝  ██║     ██║██║   ██║╚════██║██║  ██║██╔══██╗
    ██║  ██║███████╗███████╗██║╚██████╔╝███████║██████╔╝██████╔╝
    ╚═╝  ╚═╝╚══════╝╚══════╝╚═╝ ╚═════╝ ╚══════╝╚═════╝ ╚═════╝

LOGO
echo -e "${NC}"

echo -e "${WHITE}${BOLD}  The Database Platform for the Next Generation${NC}"
echo -e "${DIM}  PostgreSQL-compatible • Native Vector Search • Database Branching • Time-Travel${NC}"
echo ""
echo -e "  ${PURPLE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo -e "  ${YELLOW}${BOLD}⚡ Thank you for your interest in HeliosDB!${NC}"
echo ""
echo -e "  Binary downloads are coming soon. In the meantime, you can:"
echo ""
echo -e "  ${GREEN}●${NC} ${WHITE}Try instantly via BaaS${NC} ${DIM}(no install needed)${NC}"
echo -e "    ${CYAN}curl -X POST https://cloud.heliosdb.com/api/v1/quick-start \\${NC}"
echo -e "    ${CYAN}  -H 'Content-Type: application/json' \\${NC}"
echo -e "    ${CYAN}  -d '{\"email\":\"you@app.com\",\"password\":\"...\",\"username\":\"dev\",\"org_name\":\"MyApp\",\"db_name\":\"main\"}'${NC}"
echo ""
echo -e "  ${GREEN}●${NC} ${WHITE}Run via Docker${NC}"
echo -e "    ${CYAN}docker pull heliosdb/nano${NC}"
echo -e "    ${CYAN}docker run -p 5432:5432 heliosdb/nano${NC}"
echo ""
echo -e "  ${GREEN}●${NC} ${WHITE}Explore the SQL Playground${NC}"
echo -e "    ${CYAN}https://cloud.heliosdb.com/playground${NC}"
echo ""
echo -e "  ${PURPLE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo -e "  ${YELLOW}${BOLD}🚀 JOIN THE EARLY ADOPTERS PROGRAM${NC}"
echo ""
echo -e "  Be among the first to shape the future of HeliosDB."
echo -e "  Early Adopters get:"
echo ""
echo -e "  ${GREEN}✓${NC} Priority access to new releases and private betas"
echo -e "  ${GREEN}✓${NC} Direct line to the engineering team for feedback"
echo -e "  ${GREEN}✓${NC} ${WHITE}Trusted Free Tier${NC} — 7x storage, 10x queries, 20 branches"
echo -e "  ${GREEN}✓${NC} Logo placement on heliosdb.com (if you ship with us)"
echo -e "  ${GREEN}✓${NC} Input on the roadmap — your use case shapes our priorities"
echo ""
echo -e "  ${CYAN}${BOLD}→ Sign up: https://www.heliosdb.com/early-adopters.html${NC}"
echo ""
echo -e "  ${PURPLE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo -e "  ${WHITE}${BOLD}📋 ROADMAP${NC}"
echo ""
echo -e "  ${DIM}Q2 2026${NC}  ${WHITE}BaaS General Availability${NC} — instant provisioning, API keys,"
echo -e "           branching & time-travel REST API, MCP agent discovery"
echo -e "  ${DIM}Q3 2026${NC}  ${WHITE}Native Binary Installer${NC} — this script will download HeliosDB"
echo -e "           directly: minisign-signed artifacts, SHA256-pinned, version-locked"
echo -e "  ${DIM}Q3 2026${NC}  ${WHITE}HeliosDB Lite GA${NC} — parallel query engine, HeliosProxy,"
echo -e "           HeliosCore for distributed deployments"
echo -e "  ${DIM}Q4 2026${NC}  ${WHITE}HeliosDB Full GA${NC} — multi-primary replication, sharding,"
echo -e "           cross-region, enterprise features"
echo -e "  ${DIM}2027${NC}     ${WHITE}Edge-to-Cloud Sync${NC} — Nano embedded in your app syncing"
echo -e "           to Lite/Full clusters automatically"
echo ""
echo -e "  ${PURPLE}━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━━${NC}"
echo ""
echo -e "  ${DIM}Website:    https://www.heliosdb.com${NC}"
echo -e "  ${DIM}GitHub:     https://github.com/HeliosDatabase/HeliosDB-Nano${NC}"
echo -e "  ${DIM}BaaS Docs:  https://www.heliosdb.com/baas.html${NC}"
echo -e "  ${DIM}OpenAPI:    https://cloud.heliosdb.com/api/v1/openapi.json${NC}"
echo -e "  ${DIM}MCP:        POST https://cloud.heliosdb.com/api/v1/mcp${NC}"
echo ""
echo -e "  ${WHITE}Let's build the future together. ${YELLOW}⚡${NC}"
echo ""