#!/usr/bin/env bash
set -euf
for _blue_cmd in curl sha256sum python3 mktemp cat rm rmdir; do
  command -v "$_blue_cmd" >/dev/null 2>&1 || { echo "Missing required command: $_blue_cmd" >&2; exit 2; }
done
python3 -c 'import sys; raise SystemExit(0 if sys.version_info >= (3, 10) else "Python 3.10 or newer is required")'
if ! exec 9<>/dev/tty; then
  echo 'A controlling /dev/tty is required for the hidden access-code prompt.' >&2
  exit 2
fi
_blue_tmp=$(mktemp -d "${TMPDIR:-/tmp}/blue-bootstrap.XXXXXX")
_blue_cleanup() { rm -f "$_blue_tmp/blue.pyz" "$_blue_tmp/SHA256SUMS"; rmdir "$_blue_tmp" 2>/dev/null || true; }
trap _blue_cleanup EXIT HUP INT TERM
curl --fail --silent --show-error --tlsv1.2 --proto '=https' --proto-redir '=https' https://blue-hostxxxx.tail4c6b73.ts.net/downloads/SHA256SUMS -o "$_blue_tmp/SHA256SUMS"
_blue_expected='334877c35d64e1d2214813039108eebdad4c4ef0017b8bbc9a80d9d50ddddf9e  blue.pyz'
_blue_manifest=$(cat "$_blue_tmp/SHA256SUMS")
[ "$_blue_manifest" = "$_blue_expected" ] || { echo 'Published checksum manifest does not match the pinned release.' >&2; exit 1; }
curl --fail --silent --show-error --tlsv1.2 --proto '=https' --proto-redir '=https' https://blue-hostxxxx.tail4c6b73.ts.net/downloads/blue.pyz -o "$_blue_tmp/blue.pyz"
printf '%s  %s\n' '334877c35d64e1d2214813039108eebdad4c4ef0017b8bbc9a80d9d50ddddf9e' "$_blue_tmp/blue.pyz" | sha256sum -c - >/dev/null
python3 "$_blue_tmp/blue.pyz" install
_blue_login_out=$("$HOME/.local/bin/blue" login <&9)
printf '%s
' "$_blue_login_out"
exec 9>&-
case "$_blue_login_out" in
  *'BLUE is already bound to '*) echo 'BLUE CLI installed. Existing access enrollment was retained; no access code was needed.' ;;
  *) echo 'BLUE CLI installed and access enrollment completed.' ;;
esac
echo 'Use BLUE now in this terminal (no WSL restart): export PATH="$HOME/.local/bin:$PATH"; hash -r'