#!/usr/bin/env bash
set -euo pipefail

SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
source "$SCRIPT_DIR/lib/common.sh"

PROJECT_ENV=""
ARTIFACT_ROOT=""
APPROVAL_FILE=""
APPLY=0
while [ "$#" -gt 0 ]; do
  case "$1" in
    --project-env) PROJECT_ENV="$2"; shift 2 ;;
    --artifact-root) ARTIFACT_ROOT="$2"; shift 2 ;;
    --approval-file) APPROVAL_FILE="$2"; shift 2 ;;
    --apply) APPLY=1; shift ;;
    *) die "unknown argument: $1" ;;
  esac
done

[ -n "$PROJECT_ENV" ] || die "--project-env is required"
[ -n "$ARTIFACT_ROOT" ] || die "--artifact-root is required"
load_env_file "$PROJECT_ENV"
assert_no_placeholders "$PROJECT_ENV"

LNMP="$ARTIFACT_ROOT/runtime/lnmp2.2-from-git-20260706.tar.gz"
verify_sha256 "$LNMP" "9cdc130f859bfca6cbd138950128fda358b88fb1ebadad4f937ebc4560fe990b"

log "PLAN install Kylin Desktop build dependencies with apt-get"
log "PLAN unpack locked LNMP 2.2 and run its interactive lnmp + mphp flows"
log "PLAN install Nginx, MySQL 5.6.51, PHP 7.3.33 and PHP 7.4.33 on the host"
log "PLAN install Redis 5.x, Supervisor 4.3.0 and Cron runtime"
log "PLAN keep project data, backup and evidence under ${DATA_ROOT}"
log "PLAN leave existing Docker untouched and unused"
log "PLAN defer Supervisor programs and Cron entries to the project code package"
log "PLAN no SSH change, cloud credential write, database initialization or code release in this action"

[ "$APPLY" -eq 1 ] || {
  log "SHADOW_ONLY: add --apply and an exact approval file only after materials confirmation"
  exit 0
}

[ "$(id -u)" -eq 0 ] || die "runtime installation requires root after sudo -i"
[ -n "$APPROVAL_FILE" ] || die "--approval-file is required with --apply"
require_apply_authorization "install-runtime" "$APPROVAL_FILE" "$TARGET_HOST_REF"
[ "${ALLOW_EOL_RUNTIME:-false}" = "true" ] || die "EOL runtime exception is not approved in project.env"
grep -q '^ID=kylin$' /etc/os-release || die "target OS is not Kylin"
grep -q '^VERSION_ID="\?V10"\?$' /etc/os-release || die "target Kylin version is not V10"
[ "$(uname -m)" = "$CPU_ARCH" ] || die "target architecture mismatch"
require_cmd apt-get

SUPERVISOR_WHEEL="$ARTIFACT_ROOT/runtime/supervisor-4.3.0-py2.py3-none-any.whl"
verify_sha256 "$SUPERVISOR_WHEEL" "0bcb763fddafba410f35cbde226aa7f8514b9fb82eb05a0c85f6588d1c13f8db"

apt-get update
DEBIAN_FRONTEND=noninteractive apt-get install -y \
  tar gzip bzip2 xz-utils curl wget unzip rsync git \
  build-essential autoconf automake libtool cmake pkg-config \
  libssl-dev libcurl4-openssl-dev libxml2-dev libsqlite3-dev \
  libmosquitto-dev python3 python3-pip cron redis-server

mkdir -p /opt/zhct-install/lnmp2.2 "$BACKUP_ROOT" "$EVIDENCE_ROOT" \
  "$(dirname "$STORE_ROOT")" "$(dirname "$AI_API_ROOT")"
tar -xzf "$LNMP" -C /opt/zhct-install/lnmp2.2
test -f /opt/zhct-install/lnmp2.2/install.sh

log "LNMP installer is interactive. Select the frozen compatibility baseline:"
log "MySQL 5.6.51, PHP 7.3.33; then add PHP 7.4.33 with install.sh mphp."
(
  cd /opt/zhct-install/lnmp2.2
  bash install.sh lnmp
  bash install.sh mphp
)

python3 -m pip install --disable-pip-version-check --no-index "$SUPERVISOR_WHEEL"
mkdir -p /etc/supervisor/conf.d /var/log/supervisor
systemctl enable --now cron
log "Supervisor executable and Cron runtime installed; no project programs or crontab entries were created"
log "RUNTIME_INSTALL_STEP_COMPLETE: run exact version, service and PHP extension checks next"