<?php

declare(strict_types=1);

// One clock everywhere (default Asia/Kathmandu) — so the installer's timestamps
// match the console's. PP_TIMEZONE also aligns the MySQL session in core/DB.php.
$__tz = (string) (((array) (is_file(__DIR__ . '/config/app.php') ? require __DIR__ . '/config/app.php' : []))['timezone'] ?? 'Asia/Kathmandu');
if ($__tz !== '') { @date_default_timezone_set($__tz); if (!defined('PP_TIMEZONE')) define('PP_TIMEZONE', $__tz); }

// If already installed, redirect to admin
if (file_exists(__DIR__ . '/config/database.php')) {
    header('Location: public/');
    exit;
}

// The installer now composes schemas owned by several modular core services.
// Register the same core namespace loader used by the application so a clean
// installation can resolve every schema provider before config/database.php
// exists.
require_once __DIR__ . '/core/Autoloader.php';

$autoloader = new \PpPhp\Core\Autoloader();
$autoloader->addNamespace('PpPhp\\Core\\', __DIR__ . '/core/');
$autoloader->register();

// Authenticity gate — before installing, a bundled build proves it is a genuine,
// unmodified copy from our source. A shipped bundle carries `release.json` + an
// Ed25519-signed integrity manifest (`core/licence-integrity.json`); if the files
// have been altered or the signature does not verify, the installer refuses. A
// plain source checkout / authority build ships no `release.json`, so the vendor
// can still install from source. (Runtime is separately guarded by LicenseGate.)
if (is_file(__DIR__ . '/release.json') && class_exists('\PpPhp\Core\Licensing\CodeIntegrity')) {
    // The signature check needs the PHP `sodium` extension. On a host without it,
    // the verify() call would hit an undefined constant/function and fatal with a
    // BLANK 500 — so check first and explain exactly how to fix it.
    if (!extension_loaded('sodium') || !function_exists('sodium_crypto_sign_verify_detached')) {
        http_response_code(500);
        header('Content-Type: text/plain; charset=utf-8');
        exit("PPPHP installer: the PHP \"sodium\" extension is required to verify this build's signature, but it is not enabled on this server.\n\n"
            . "Fix: in cPanel/Plesk open \"Select PHP Version\" → Extensions → tick \"sodium\" (libsodium), save, then reload install.php.\n"
            . "If you cannot enable it, ask your host to turn on the PHP sodium extension.\n");
    }
    try {
        $integrity = \PpPhp\Core\Licensing\CodeIntegrity::verify(__DIR__);
    } catch (\Throwable $e) {
        http_response_code(500);
        header('Content-Type: text/plain; charset=utf-8');
        exit("PPPHP installer: the build signature could not be checked on this server.\n\nDetail: " . $e->getMessage() . "\n");
    }
    if (($integrity['status'] ?? '') !== 'ok') {
        http_response_code(403);
        header('Content-Type: text/plain; charset=utf-8');
        exit("This copy of PPPHP could not be verified as a genuine, unmodified build from the vendor, so installation has been stopped.\n"
            . "Reason: " . (($integrity['reason'] ?? '') ?: 'integrity check failed') . "\n"
            . "Please download the official installer again from your vendor.\n");
    }
}

use PpPhp\Core\Installer\Controller;
use PpPhp\Core\Config;

// Base URL for asset linking (adjust accordingly)
$baseUrl = rtrim(dirname($_SERVER['SCRIPT_NAME']), '/');

$controller = new Controller(__DIR__, $baseUrl);
$controller->run();
