install.sh

#!/bin/sh
# install.sh — Edgelet greenfield installer (binary-only, multi-OS)
#
# Usage:
#   curl -fsSL .../install.sh | sudo sh -s -- --version=vX.Y.Z
#   sudo ./install.sh --bin-path=build/edgelet-linux-amd64 --version=dev
#   sudo ./install.sh --airgap --bin-path=./edgelet-linux-amd64 --expected-sha256=...
#
# Options:
#   --version=VERSION          Release tag (default: latest)
#   --arch=ARCH                Override arch (amd64, arm64, arm, riscv64)
#   --container-engine=ENGINE  edgelet, docker, or podman
#                              (linux default: edgelet; darwin/windows: docker)
#   --airgap                   Do not download; use --bin-path
#   --bin-path=PATH            Local edgelet binary
#   --checksum-path=PATH       SHA256SUMS manifest for verification
#   --expected-sha256=HASH     Verify local binary SHA256
#   --upgrade / --rollback     In-place thin-binary OTA (linux)
#   --force-config             Replace config from sample
#   --with-sample-ca           Install sample controller CA if cert missing
#   --help, -h                 Show options and exit
#
# Environment: EDGELET_VERSION, EDGELET_GITHUB_REPO
#
# Provision after install: edgelet provision <key>  (not install.sh flags)

set -e

die() { echo "ERROR: $1" >&2; exit 1; }
info() { echo ">>> $1"; }

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)

# ── argument parsing ──────────────────────────────────────────────────────────
EDGELET_VERSION="${EDGELET_VERSION:-latest}"
CONTAINER_ENGINE=""
ACTION="install"
AIRGAP=false
BIN_PATH=""
FORCE_CONFIG=false
WITH_SAMPLE_CA=false
ARCH_OVERRIDE=""
CHECKSUM_FILE=""
EXPECTED_SHA256=""

for arg in "$@"; do
    case "${arg}" in
        --version=*)          EDGELET_VERSION="${arg#*=}" ;;
        --arch=*)             ARCH_OVERRIDE="${arg#*=}" ;;
        --container-engine=*) CONTAINER_ENGINE="${arg#*=}" ;;
        --bin-path=*)         BIN_PATH="${arg#*=}" ;;
        --checksum-path=*)    CHECKSUM_FILE="${arg#*=}" ;;
        --expected-sha256=*)  EXPECTED_SHA256="${arg#*=}" ;;
        --airgap)             AIRGAP=true ;;
        --upgrade)            ACTION="upgrade" ;;
        --rollback)           ACTION="rollback" ;;
        --force-config)       FORCE_CONFIG=true ;;
        --with-sample-ca)     WITH_SAMPLE_CA=true ;;
        --help|-h)
            cat <<EOF
Usage: $0 [options]

Options:
  --version=VERSION          Release tag (default: latest)
  --arch=ARCH                Override arch (amd64, arm64, arm, riscv64)
  --container-engine=ENGINE  edgelet, docker, or podman (linux default: edgelet)
  --airgap                   Do not download; use --bin-path
  --bin-path=PATH            Local edgelet binary
  --checksum-path=PATH       SHA256SUMS manifest for verification
  --expected-sha256=HASH     Verify local binary SHA256
  --upgrade / --rollback     In-place thin binary OTA (linux)
  --force-config             Replace config from sample
  --with-sample-ca           Install sample controller CA if cert missing

Environment:
  EDGELET_VERSION  EDGELET_GITHUB_REPO
EOF
            exit 0 ;;
        *) die "Unknown option: ${arg} (use --help)" ;;
    esac
done

if [ "$AIRGAP" = true ] && [ -z "$BIN_PATH" ]; then
    die "--airgap requires --bin-path"
fi

# ASSEMBLE:EMBEDDED_BEGIN
# GENERATED by scripts/assemble-install.sh — DO NOT EDIT
# Authoring inputs: scripts/lib/init-detect.sh, scripts/lib/init-edgelet.sh,
#   packaging/init/**, scripts/edgelet-shutdown


# OpenRC ships /sbin/openrc-run on Alpine even when PID 1 is busybox (Lima
# template:alpine). Require a running OpenRC supervisor, not merely openrc-run.
openrc_is_pid1() {
    [ -x /sbin/openrc-run ] || return 1
    if rc-status -s >/dev/null 2>&1; then
        return 0
    fi
    if [ -f /etc/inittab ] && grep -q '/sbin/openrc' /etc/inittab 2>/dev/null; then
        return 0
    fi
    _init="$(readlink -f /sbin/init 2>/dev/null || readlink /sbin/init 2>/dev/null || true)"
    case "${_init}" in
        *openrc*) return 0 ;;
    esac
    return 1
}

procd_is_openwrt() {
    [ -x /sbin/procd ] && [ -f /etc/rc.common ] || return 1
    return 0
}

detect_init() {
    if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
        echo "systemd"
        return 0
    fi
    if procd_is_openwrt; then
        echo "procd"
        return 0
    fi
    if openrc_is_pid1 && {
        command -v openrc >/dev/null 2>&1 \
            || [ -x /sbin/openrc-run ] \
            || [ -f /sbin/openrc ]
    }; then
        echo "openrc"
        return 0
    fi
    if command -v initctl >/dev/null 2>&1 && [ -d /etc/init ]; then
        echo "upstart"
        return 0
    fi
    if [ -d /etc/s6 ] || command -v s6-svc >/dev/null 2>&1; then
        echo "s6"
        return 0
    fi
    if command -v runsvdir >/dev/null 2>&1 || [ -d /etc/runit ]; then
        echo "runit"
        return 0
    fi
    if [ -f /etc/inittab ] || command -v update-rc.d >/dev/null 2>&1 || command -v chkconfig >/dev/null 2>&1; then
        echo "sysvinit"
        return 0
    fi
    echo "unknown"
}

EDGELET_LIBEXEC="/usr/libexec/edgelet"

init_packaging_root() {
    if [ -n "${EDGELET_INIT_DIR}" ] && [ -d "${EDGELET_INIT_DIR}" ]; then
        echo "${EDGELET_INIT_DIR}"
        return 0
    fi
    echo ""
}

install_shutdown_helper() {
    mkdir -p "${EDGELET_LIBEXEC}"
    cat > "/usr/libexec/edgelet/edgelet-shutdown" << 'EDGELET_SHUTDOWN_EOF'
#!/bin/sh
# edgelet-shutdown — shared control-plane stop entry for all init systems (Plan 10).
# Plan 11: v1 default skips MS drain on control stop (shutdownPolicy=leave-running for docker/podman;
# embedded split uses attach-only). shutdownGracePeriodSeconds applies to optional maintenance drain
# and data-plane (edgelet-containerd) stop — not control-plane MS drain by default.
set -e
EDGELET="${EDGELET_BIN:-/usr/local/bin/edgelet}"
exec "${EDGELET}" shutdown "$@"
EDGELET_SHUTDOWN_EOF
    chmod 755 "/usr/libexec/edgelet/edgelet-shutdown"
}
write_systemd_edgelet_service() {
    cat > "/etc/systemd/system/edgelet.service" << 'EDGELET_SYSTEMD_EDGELET_SERVICE_EOF'
[Unit]
Description=Edgelet daemon (control plane)
Documentation=https://github.com/eclipse-iofog/edgelet
Wants=network-online.target
After=network-online.target
StartLimitIntervalSec=300
StartLimitBurst=20

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'mountpoint -q /sys/fs/bpf || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true'
ExecStart=/usr/local/bin/edgelet daemon
ExecStop=/usr/libexec/edgelet/edgelet-shutdown
Restart=always
RestartSec=2s
# Default 120s = shutdownGracePeriodSeconds (90) + 30s buffer; edgelet-engine drop-in may override.
TimeoutStopSec=120s
KillMode=process
Delegate=yes
DelegateSubgroup=supervisor
KillSignal=SIGTERM
SendSIGKILL=yes
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=edgelet

# Embedded engine needs host paths under /etc/cni, /run, /var, /opt (monolithic unit).
# Tighten on edgelet-containerd.service after Plan 11 data-plane split.
NoNewPrivileges=no

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target
EDGELET_SYSTEMD_EDGELET_SERVICE_EOF
    chmod 644 "/etc/systemd/system/edgelet.service"
}
write_systemd_edgelet_containerd_service() {
    cat > "/etc/systemd/system/edgelet-containerd.service" << 'EDGELET_SYSTEMD_EDGELET_CONTAINERD_SERVICE_EOF'
# Edgelet embedded containerd (data plane) — Plan 11 workload continuity
[Unit]
Description=Edgelet embedded containerd (data plane)
Documentation=https://github.com/eclipse-iofog/edgelet
Before=edgelet.service
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=300
StartLimitBurst=5
# Intentionally NOT PartOf=edgelet.service: control restart/stop must not
# stop the data plane (Plan 11 attach-only). Full teardown: stop both units.

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'mountpoint -q /sys/fs/bpf || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true'
ExecStart=/usr/local/bin/edgelet runtime-bootstrap
ExecStopPost=-/usr/local/bin/edgelet runtime reap-orphans
Restart=always
RestartSec=5s
# Data-plane stop: drain MS via runtime-bootstrap SIGTERM handler + shutdownGracePeriodSeconds
TimeoutStopSec=120s
KillMode=process
KillSignal=SIGTERM
SendSIGKILL=yes
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=edgelet-containerd
Delegate=yes
DelegateSubgroup=containerd
NoNewPrivileges=no
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target
EDGELET_SYSTEMD_EDGELET_CONTAINERD_SERVICE_EOF
    chmod 644 "/etc/systemd/system/edgelet-containerd.service"
}
write_systemd_dropin_docker() {
    cat > "/etc/systemd/system/edgelet.service.d/docker.conf" << 'EDGELET_SYSTEMD_DROPIN_DOCKER_EOF'
# Engine ordering drop-in — docker (Plan 10). Installed when containerEngine=docker.
[Unit]
After=network-online.target docker.service
Wants=docker.service
EDGELET_SYSTEMD_DROPIN_DOCKER_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/docker.conf"
}
write_systemd_dropin_podman() {
    cat > "/etc/systemd/system/edgelet.service.d/podman.conf" << 'EDGELET_SYSTEMD_DROPIN_PODMAN_EOF'
# Engine ordering drop-in — podman (Plan 10). Installed when containerEngine=podman.
[Unit]
After=network-online.target podman.socket
Wants=podman.socket
EDGELET_SYSTEMD_DROPIN_PODMAN_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/podman.conf"
}
write_systemd_dropin_edgelet() {
    cat > "/etc/systemd/system/edgelet.service.d/edgelet.conf" << 'EDGELET_SYSTEMD_DROPIN_EDGELET_EOF'
# Engine ordering drop-in — embedded edgelet (Plan 11). Installed when containerEngine=edgelet.
[Unit]
Wants=edgelet-containerd.service
After=network-online.target edgelet-containerd.service

[Service]
Environment=EDGELET_RUNTIME_SPLIT=1
# Control-plane stop: default leave-running (skip MS drain). Grace + buffer matches shutdownGracePeriodSeconds default 90.
TimeoutStopSec=120s
EDGELET_SYSTEMD_DROPIN_EDGELET_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/edgelet.conf"
}
write_openrc_edgelet_init() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_OPENRC_EDGELET_INIT_EOF'
#!/sbin/openrc-run

name="edgelet"
description="Edgelet daemon (control plane)"
command="/usr/local/bin/edgelet"
command_args="daemon"
supervisor="supervise-daemon"
respawn_delay=2
respawn_max=0
respawn_period=3600
command_user="root"
pidfile="/run/${RC_SVCNAME}.pid"
output_log="/var/log/edgelet/daemon.log"
error_log="/var/log/edgelet/daemon.log"
shutdown="/usr/libexec/edgelet/edgelet-shutdown"

depend() {
    need net
    after firewall
%%EDGELET_ENGINE_NEED%%
}

wait_containerd_attach_socket() {
    _timeout="${EDGELET_ATTACH_WAIT_SEC:-120}"
    _elapsed=0
    _sock="/run/edgelet/containerd.sock"
    while [ "${_elapsed}" -lt "${_timeout}" ]; do
        if [ -S "${_sock}" ] || [ -S /var/run/edgelet/containerd.sock ]; then
            [ -S "${_sock}" ] || _sock="/var/run/edgelet/containerd.sock"
            _ctr=""
            if [ -x /var/lib/edgelet/data/current/bin/ctr ]; then
                _ctr=/var/lib/edgelet/data/current/bin/ctr
            elif command -v ctr >/dev/null 2>&1; then
                _ctr=ctr
            fi
            if [ -z "${_ctr}" ] || "${_ctr}" --address "${_sock}" version >/dev/null 2>&1; then
                return 0
            fi
        fi
        sleep 2
        _elapsed=$(( _elapsed + 2 ))
    done
    ewarn "data-plane containerd socket not ready after ${_timeout}s"
    return 1
}

start_pre() {
    /usr/local/bin/edgelet cgroup-preflight || return $?
    if [ -f /etc/init.d/edgelet-containerd ]; then
        export EDGELET_RUNTIME_SPLIT=1
        wait_containerd_attach_socket || return $?
    fi
}

stop_pre() {
    if [ -f /etc/init.d/edgelet-containerd ]; then
        export EDGELET_RUNTIME_SPLIT=1
    fi
}

stop() {
    ebegin "Stopping ${RC_SVCNAME}"
    if ! "${shutdown}"; then
        # Fallback when EdgeletAPI is down: single TERM/KILL, no SSD --retry (hangs after graceful stop).
        if [ -f "${pidfile}" ]; then
            _pid=$(cat "${pidfile}" 2>/dev/null || true)
            if [ -n "${_pid}" ] && kill -0 "${_pid}" 2>/dev/null; then
                kill -TERM "${_pid}" 2>/dev/null || true
                sleep 2
                kill -KILL "${_pid}" 2>/dev/null || true
            fi
        fi
        rm -f "${pidfile}" /run/edgelet/edgelet.pid 2>/dev/null || true
        eend 1
        return 1
    fi
    rm -f "${pidfile}" /run/edgelet/edgelet.pid 2>/dev/null || true
    # Plan 11 split: data-plane containerd is edgelet-containerd service — do not reap child here.
    if [ ! -f /etc/init.d/edgelet-containerd ]; then
        _pids=$(pgrep -f edgelet-containerd-child 2>/dev/null || true)
        for _p in ${_pids}; do kill -TERM "${_p}" 2>/dev/null || true; done
        sleep 2
        _pids=$(pgrep -f edgelet-containerd-child 2>/dev/null || true)
        for _p in ${_pids}; do kill -KILL "${_p}" 2>/dev/null || true; done
    fi
    eend 0
}
EDGELET_OPENRC_EDGELET_INIT_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_openrc_edgelet_containerd_init() {
    cat > "/etc/init.d/edgelet-containerd" << 'EDGELET_OPENRC_EDGELET_CONTAINERD_INIT_EOF'
#!/sbin/openrc-run

# Edgelet embedded containerd (data plane) — Plan 11 workload continuity
name="edgelet-containerd"
description="Edgelet embedded containerd (data plane)"
command="/usr/local/bin/edgelet"
command_args="runtime-bootstrap"
supervisor="supervise-daemon"
respawn_delay=5
respawn_max=5
respawn_period=300
command_user="root"
pidfile="/run/${RC_SVCNAME}.pid"
output_log="/var/log/edgelet/containerd.log"
error_log="/var/log/edgelet/containerd.log"

depend() {
    need net
    need edgelet-cgroup-prep
    before edgelet
}

start_pre() {
    # C3: light preflight only; primary cgroup bootstrap is in runtime-bootstrap (C1).
    mountpoint -q /sys/fs/bpf 2>/dev/null || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true
    /usr/local/bin/edgelet cgroup-preflight || return $?
}

start_post() {
    # Block dependency satisfaction until CRI socket answers (Plan 11 split).
    _timeout="${EDGELET_CONTAINERD_READY_SEC:-120}"
    _elapsed=0
    _sock="/run/edgelet/containerd.sock"
    while [ "${_elapsed}" -lt "${_timeout}" ]; do
        if [ -S "${_sock}" ] || [ -S /var/run/edgelet/containerd.sock ]; then
            [ -S "${_sock}" ] || _sock="/var/run/edgelet/containerd.sock"
            _ctr=""
            if [ -x /var/lib/edgelet/data/current/bin/ctr ]; then
                _ctr=/var/lib/edgelet/data/current/bin/ctr
            elif command -v ctr >/dev/null 2>&1; then
                _ctr=ctr
            fi
            if [ -z "${_ctr}" ] || "${_ctr}" --address "${_sock}" version >/dev/null 2>&1; then
                return 0
            fi
        fi
        sleep 2
        _elapsed=$(( _elapsed + 2 ))
    done
    ewarn "containerd socket not ready after ${_timeout}s"
    return 1
}

stop() {
    ebegin "Stopping ${RC_SVCNAME}"
    if [ -f "${pidfile}" ]; then
        _pid=$(cat "${pidfile}" 2>/dev/null || true)
        if [ -n "${_pid}" ] && kill -0 "${_pid}" 2>/dev/null; then
            kill -TERM "${_pid}" 2>/dev/null || true
            _grace="${EDGELET_CONTAINERD_STOP_SEC:-30}"
            _elapsed=0
            while kill -0 "${_pid}" 2>/dev/null; do
                if [ "${_elapsed}" -ge "${_grace}" ]; then
                    kill -KILL "${_pid}" 2>/dev/null || true
                    break
                fi
                sleep 2
                _elapsed=$(( _elapsed + 2 ))
            done
        fi
    fi
    rm -f "${pidfile}" 2>/dev/null || true
    /usr/local/bin/edgelet runtime reap-orphans || ewarn "orphan reap exited non-zero"
    eend 0
}
EDGELET_OPENRC_EDGELET_CONTAINERD_INIT_EOF
    chmod 755 "/etc/init.d/edgelet-containerd"
}
write_openrc_edgelet_cgroup_prep_init() {
    cat > "/etc/init.d/edgelet-cgroup-prep" << 'EDGELET_OPENRC_EDGELET_CGROUP_PREP_INIT_EOF'
#!/sbin/openrc-run

# Early cgroup v2 delegation for LXC/VM machine roots (OrbStack Alpine, etc.).
# Moby/dind-style reparent before enabling subtree_control on root and /.lxc.
name="edgelet-cgroup-prep"
description="Edgelet cgroup delegation prep (machine root)"

depend() {
    before edgelet-containerd edgelet
}

cgroup_delegate_controllers() {
    _dir="$1"
    _ctrl="${_dir}/cgroup.controllers"
    _sub="${_dir}/cgroup.subtree_control"
    [ -f "${_ctrl}" ] || return 0
    for _c in cpu memory pids; do
        grep -qw "${_c}" "${_ctrl}" 2>/dev/null || continue
        grep -qw "${_c}" "${_sub}" 2>/dev/null && continue
        echo "+${_c}" >> "${_sub}" 2>/dev/null || true
    done
}

cgroup_reparent_procs() {
    _from="$1"
    _to="$2"
    [ -f "${_from}/cgroup.procs" ] || return 0
    [ -s "${_from}/cgroup.procs" ] || return 0
    mkdir -p "${_to}"
    xargs -rn1 < "${_from}/cgroup.procs" > "${_to}/cgroup.procs" 2>/dev/null || true
}

start() {
    # No-op on bare-metal / systemd VM layouts without LXC machine cgroup.
    [ -d /sys/fs/cgroup/.lxc ] || return 0

    ebegin "Preparing cgroup delegation for machine root"
    _cg="/sys/fs/cgroup"

    cgroup_reparent_procs "${_cg}" "${_cg}/init"
    cgroup_delegate_controllers "${_cg}"

    cgroup_reparent_procs "${_cg}/.lxc" "${_cg}/.lxc/init"
    cgroup_delegate_controllers "${_cg}/.lxc"

    eend 0
}

stop() {
    return 0
}
EDGELET_OPENRC_EDGELET_CGROUP_PREP_INIT_EOF
    chmod 755 "/etc/init.d/edgelet-cgroup-prep"
}
write_procd_edgelet() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_PROCD_EDGELET_EOF'
#!/bin/sh /etc/rc.common
# Edgelet control plane (OpenWrt procd)

START=99
STOP=10
USE_PROCD=1

start_service() {
    /usr/local/bin/edgelet cgroup-preflight || return $?

    procd_open_instance
    procd_set_param command /usr/local/bin/edgelet
    procd_append_param command daemon
    procd_set_param respawn 3600 5 5
    procd_set_param stdout 1
    procd_set_param stderr 1
    procd_close_instance
}

stop_service() {
    /usr/libexec/edgelet/edgelet-shutdown
}
EDGELET_PROCD_EDGELET_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_sysvinit_edgelet() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_SYSVINIT_EDGELET_EOF'
#!/bin/sh
### BEGIN INIT INFO
# Provides:          edgelet
# Required-Start:    $network $remote_fs
# Required-Stop:     $network $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Edgelet daemon
### END INIT INFO

DAEMON=/usr/local/bin/edgelet
SHUTDOWN=/usr/libexec/edgelet/edgelet-shutdown
PIDFILE=/var/run/edgelet.pid
LOGFILE=/var/log/edgelet/daemon.log
KILLTIMEOUT=30

. /lib/lsb/init-functions

preflight() {
    "${DAEMON}" cgroup-preflight
}

case "$1" in
    start)
        log_daemon_msg "Starting edgelet"
        preflight || exit $?
        start-stop-daemon --start --background --make-pidfile --pidfile "$PIDFILE" \
            --exec "$DAEMON" -- daemon >>"$LOGFILE" 2>&1
        log_end_msg $?
        ;;
    stop)
        log_daemon_msg "Stopping edgelet"
        if [ -x "$SHUTDOWN" ]; then
            "$SHUTDOWN" && log_end_msg 0 && exit 0
        fi
        start-stop-daemon --stop --pidfile "$PIDFILE" --retry TERM/${KILLTIMEOUT}/KILL/5
        log_end_msg $?
        ;;
    restart|force-reload)
        $0 stop
        $0 start
        ;;
    status)
        status_of_proc -p "$PIDFILE" "$DAEMON" edgelet
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|status}"
        exit 1
        ;;
esac

exit 0
EDGELET_SYSVINIT_EDGELET_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_upstart_edgelet() {
    cat > "/etc/init/edgelet.conf" << 'EDGELET_UPSTART_EDGELET_EOF'
description "Edgelet daemon (control plane)"
author "Datasance"

start on runlevel [2345]
stop on runlevel [!2345]

respawn
respawn limit 20 300

pre-start script
    /usr/local/bin/edgelet cgroup-preflight || exit $?
end script

exec /usr/local/bin/edgelet daemon >> /var/log/edgelet/daemon.log 2>&1

post-stop script
    /usr/libexec/edgelet/edgelet-shutdown || true
end script
EDGELET_UPSTART_EDGELET_EOF
    chmod 644 "/etc/init/edgelet.conf"
}
write_s6_run() {
    cat > "/etc/s6/edgelet/run" << 'EDGELET_S6_RUN_EOF'
#!/bin/sh
exec 2>&1
/usr/local/bin/edgelet cgroup-preflight || exit $?
exec /usr/local/bin/edgelet daemon
EDGELET_S6_RUN_EOF
    chmod 755 "/etc/s6/edgelet/run"
}
write_s6_finish() {
    cat > "/etc/s6/edgelet/finish" << 'EDGELET_S6_FINISH_EOF'
#!/bin/sh
/usr/libexec/edgelet/edgelet-shutdown 2>/dev/null || true
exit "${1:-0}"
EDGELET_S6_FINISH_EOF
    chmod 755 "/etc/s6/edgelet/finish"
}
write_runit_run() {
    cat > "/etc/runit/edgelet/run" << 'EDGELET_RUNIT_RUN_EOF'
#!/bin/sh
LOG=/var/log/edgelet/daemon.log
exec 2>&1
/usr/local/bin/edgelet cgroup-preflight >>"$LOG" 2>&1 || exit $?
exec /usr/local/bin/edgelet daemon >>"$LOG" 2>&1
EDGELET_RUNIT_RUN_EOF
    chmod 755 "/etc/runit/edgelet/run"
}
write_runit_finish() {
    cat > "/etc/runit/edgelet/finish" << 'EDGELET_RUNIT_FINISH_EOF'
#!/bin/sh
/usr/libexec/edgelet/edgelet-shutdown 2>/dev/null || true
exit "${1:-0}"
EDGELET_RUNIT_FINISH_EOF
    chmod 755 "/etc/runit/edgelet/finish"
}

openrc_engine_need_line() {
    case "$1" in
        docker) printf '%s\n' '    need docker' ;;
        podman) printf '%s\n' '    need podman' ;;
        edgelet) printf '%s\n' '    need edgelet-containerd' ;;
        *)      printf '%s\n' '' ;;
    esac
}

apply_openrc_engine_deps() {
    _eng="$1"
    _dest="$2"
    _need="$(openrc_engine_need_line "${_eng}")"
    if [ -f "${_dest}" ]; then
        # shellcheck disable=SC2016
        awk -v need="${_need}" '
            /%%EDGELET_ENGINE_NEED%%/ {
                if (need != "") print need
                next
            }
            { print }
        ' "${_dest}" > "${_dest}.tmp" && mv "${_dest}.tmp" "${_dest}"
    fi
}

install_init_helpers() {
    install_shutdown_helper
}

# installed_embed_hash returns the basename of data/current (embed SHA256 prefix), or empty.
installed_embed_hash() {
    _link="/var/lib/edgelet/data/current"
    [ -L "$_link" ] || return 0
    basename "$(readlink -f "$_link" 2>/dev/null || readlink "$_link")"
}

# binary_embed_hash reads embed hash from a linux thin binary (edgelet version --verbose).
binary_embed_hash() {
    _bin="$1"
    [ -x "$_bin" ] || return 0
    "$_bin" version --verbose 2>/dev/null \
        | sed -n 's/^  embed hash: //p' \
        | head -1
}

# should_restart_data_plane is true when containerEngine=edgelet and the embed hash changed
# (or data/current is not yet set). Returns false for docker/podman or lite builds without embed.
should_restart_data_plane() {
    _eng="$1"
    _old="$2"
    _new="$3"
    [ "$_eng" = "edgelet" ] || return 1
    [ -n "$_new" ] || return 1
    [ -z "$_old" ] && return 0
    [ "$_old" != "$_new" ]
}

start_edgelet_containerd_unit() {
    _init="$1"
    _restart="$2"
    case "${_init}" in
        systemd)
            systemctl enable edgelet-containerd 2>/dev/null || true
            if [ "$_restart" = true ]; then
                info "Embedded bundle hash changed; restarting edgelet-containerd (data plane)"
                systemctl stop edgelet-containerd 2>/dev/null || true
                systemctl reset-failed edgelet-containerd 2>/dev/null || true
                systemctl start edgelet-containerd
            else
                systemctl start edgelet-containerd 2>/dev/null || true
            fi
            ;;
        openrc)
            rc-update add edgelet-containerd default 2>/dev/null || true
            if [ "$_restart" = true ]; then
                info "Embedded bundle hash changed; restarting edgelet-containerd (data plane)"
                rc-service edgelet-containerd stop 2>/dev/null || true
                rc-service edgelet-containerd start 2>/dev/null || true
            else
                rc-service edgelet-containerd start 2>/dev/null || true
            fi
            ;;
    esac
}

install_systemd_dropin() {
    _eng="$1"
    _root="$2"
    _dropdir="/etc/systemd/system/edgelet.service.d"
    mkdir -p "${_dropdir}"
    rm -f "${_dropdir}/docker.conf" "${_dropdir}/podman.conf" "${_dropdir}/edgelet.conf"
    if [ -n "${_root}" ]; then
        case "${_eng}" in
            docker)
                install -m 644 "${_root}/systemd/edgelet.service.d/docker.conf" "${_dropdir}/docker.conf"
                ;;
            podman)
                install -m 644 "${_root}/systemd/edgelet.service.d/podman.conf" "${_dropdir}/podman.conf"
                ;;
            edgelet)
                install -m 644 "${_root}/systemd/edgelet.service.d/edgelet.conf" "${_dropdir}/edgelet.conf"
                systemctl enable edgelet-containerd 2>/dev/null || true
                ;;
        esac
    else
        case "${_eng}" in
            docker)  write_systemd_dropin_docker ;;
            podman)  write_systemd_dropin_podman ;;
            edgelet)
                write_systemd_dropin_edgelet
                systemctl enable edgelet-containerd 2>/dev/null || true
                ;;
        esac
    fi
}

install_init_unit() {
    _init="$1"
    _eng="$2"
    _restart_dp="${3:-false}"
    _root="$(init_packaging_root)"
    mkdir -p /var/log/edgelet
    install_init_helpers

    case "${_init}" in
        systemd)
            mkdir -p /etc/cni/net.d /run/edgelet /run/containerd
            chmod 755 /run/edgelet /run/containerd 2>/dev/null || true
            if [ -n "${_root}" ]; then
                _unit="${_root}/systemd/edgelet.service"
                [ -f "$_unit" ] || die "Missing ${_unit}"
                install -m 644 "$_unit" /etc/systemd/system/edgelet.service
                _containerd="${_root}/systemd/edgelet-containerd.service"
                if [ -f "${_containerd}" ]; then
                    install -m 644 "${_containerd}" /etc/systemd/system/edgelet-containerd.service
                fi
            else
                write_systemd_edgelet_service
                write_systemd_edgelet_containerd_service
            fi
            install_systemd_dropin "${_eng}" "${_root}"
            systemctl daemon-reload
            if [ "${_eng}" = "edgelet" ]; then
                start_edgelet_containerd_unit "${_init}" "${_restart_dp}"
            fi
            systemctl enable edgelet
            systemctl stop edgelet 2>/dev/null || true
            systemctl reset-failed edgelet 2>/dev/null || true
            systemctl start edgelet
            info "systemd unit edgelet.service installed (engine=${_eng} drop-in)."
            ;;
        openrc)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/openrc/edgelet.init" /etc/init.d/edgelet
                if [ -f "${_root}/openrc/edgelet-cgroup-prep.init" ]; then
                    install -m 755 "${_root}/openrc/edgelet-cgroup-prep.init" /etc/init.d/edgelet-cgroup-prep
                    rc-update add edgelet-cgroup-prep sysinit 2>/dev/null || true
                fi
                if [ -f "${_root}/openrc/edgelet-containerd.init" ]; then
                    install -m 755 "${_root}/openrc/edgelet-containerd.init" /etc/init.d/edgelet-containerd
                fi
            else
                write_openrc_edgelet_init
                write_openrc_edgelet_cgroup_prep_init
                write_openrc_edgelet_containerd_init
                rc-update add edgelet-cgroup-prep sysinit 2>/dev/null || true
            fi
            apply_openrc_engine_deps "${_eng}" /etc/init.d/edgelet
            chmod 755 /etc/init.d/edgelet
            if [ "${_eng}" = "edgelet" ]; then
                start_edgelet_containerd_unit "${_init}" "${_restart_dp}"
            fi
            rc-update add edgelet default 2>/dev/null || true
            rc-service edgelet restart 2>/dev/null || rc-service edgelet start
            info "OpenRC service edgelet installed (engine=${_eng})."
            ;;
        procd)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/procd/edgelet" /etc/init.d/edgelet
            else
                write_procd_edgelet
            fi
            /etc/init.d/edgelet enable 2>/dev/null || true
            /etc/init.d/edgelet stop 2>/dev/null || true
            /etc/init.d/edgelet start
            info "procd init script edgelet installed (engine=${_eng})."
            ;;
        sysvinit)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/sysvinit/edgelet.init" /etc/init.d/edgelet
            else
                write_sysvinit_edgelet
            fi
            if command -v update-rc.d >/dev/null 2>&1; then
                update-rc.d edgelet defaults 2>/dev/null || true
            elif command -v chkconfig >/dev/null 2>&1; then
                chkconfig --add edgelet 2>/dev/null || true
            fi
            /etc/init.d/edgelet restart 2>/dev/null || /etc/init.d/edgelet start
            info "SysV init script edgelet installed."
            ;;
        upstart)
            if [ -n "${_root}" ]; then
                install -m 644 "${_root}/upstart/edgelet.conf" /etc/init/edgelet.conf
            else
                write_upstart_edgelet
            fi
            initctl reload-configuration 2>/dev/null || true
            initctl restart edgelet 2>/dev/null || initctl start edgelet
            info "Upstart job edgelet installed."
            ;;
        s6)
            mkdir -p /etc/s6/edgelet
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/s6/run" /etc/s6/edgelet/run
                install -m 755 "${_root}/s6/finish" /etc/s6/edgelet/finish
            else
                write_s6_run
                write_s6_finish
            fi
            if command -v s6-svc >/dev/null 2>&1 && [ -d /var/run/s6/services ]; then
                mkdir -p /var/run/s6/services/edgelet
                ln -sf /etc/s6/edgelet /var/run/s6/services/edgelet/supervise 2>/dev/null || true
                s6-svc -u /var/run/s6/services/edgelet 2>/dev/null || true
            fi
            info "s6 service installed under /etc/s6/edgelet (start via your s6 scan)."
            ;;
        runit)
            mkdir -p /etc/runit/edgelet
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/runit/run" /etc/runit/edgelet/run
                if [ -f "${_root}/runit/finish" ]; then
                    install -m 755 "${_root}/runit/finish" /etc/runit/edgelet/finish
                fi
            else
                write_runit_run
                write_runit_finish
            fi
            if [ -d /etc/runit ]; then
                ln -sf /etc/runit/edgelet /etc/service/edgelet 2>/dev/null || \
                    ln -sf /etc/runit/edgelet /var/service/edgelet 2>/dev/null || true
                sv restart edgelet 2>/dev/null || sv start edgelet 2>/dev/null || true
            fi
            info "runit service installed under /etc/runit/edgelet."
            ;;
        *)
            die "No supported init system detected (${_init}). Install systemd, procd, openrc, sysvinit, upstart, s6, or runit."
            ;;
    esac
}

stop_edgelet_service() {
    _init="${1:-$(detect_init)}"
    case "${_init}" in
        systemd) systemctl stop edgelet 2>/dev/null || true ;;
        openrc) rc-service edgelet stop 2>/dev/null || true ;;
        procd) /etc/init.d/edgelet stop 2>/dev/null || true ;;
        sysvinit) /etc/init.d/edgelet stop 2>/dev/null || true ;;
        upstart) initctl stop edgelet 2>/dev/null || true ;;
        s6) s6-svc -d /var/run/s6/services/edgelet 2>/dev/null || true ;;
        runit) sv down edgelet 2>/dev/null || true ;;
        *) "${EDGELET_LIBEXEC}/edgelet-shutdown" 2>/dev/null || pkill -f "/usr/local/bin/edgelet daemon" 2>/dev/null || true ;;
    esac
}

# ASSEMBLE:EMBEDDED_END

# ASSEMBLE:UNINSTALL_BEGIN
# GENERATED by scripts/assemble-install.sh — DO NOT EDIT
# Authoring input: uninstall.sh

write_embedded_uninstall() {
    _dest="$1"
    cat > "$_dest" << 'EDGELET_UNINSTALL_EOF'
#!/bin/sh
# uninstall.sh — Edgelet uninstaller
#
# Usage:
#   sudo sh uninstall.sh [--remove-data]
#
# --remove-data  also removes config, data, runtime, logs, and backup directories

set -e

die() { echo "ERROR: $1" >&2; exit 1; }
info() { echo ">>> $1"; }

detect_os() {
    _u=$(uname -s)
    case "${_u}" in
        Linux)  echo "linux" ;;
        Darwin) echo "darwin" ;;
        MINGW*|MSYS*|CYGWIN*|Windows_NT) echo "windows" ;;
        *) die "Unsupported OS: ${_u}" ;;
    esac
}

windows_program_data_edgelet() {
    echo "${ProgramData:-/c/ProgramData}/Edgelet"
}

share_dir_for_os() {
    case "$1" in
        linux)  echo "/usr/share/edgelet" ;;
        darwin) echo "/usr/local/share/edgelet" ;;
        windows) echo "$(windows_program_data_edgelet)/scripts" ;;
        *) die "Unsupported OS: $1" ;;
    esac
}

binary_path_for_os() {
    case "$1" in
        linux|darwin) echo "/usr/local/bin/edgelet" ;;
        windows)
            _pf="${ProgramFiles:-/c/Program Files}"
            echo "${_pf}/Edgelet/edgelet.exe"
            ;;
        *) die "Unsupported OS: $1" ;;
    esac
}

# OpenRC ships /sbin/openrc-run on Alpine even when PID 1 is busybox (Lima
# template:alpine). Require a running OpenRC supervisor, not merely openrc-run.
openrc_is_pid1() {
    [ -x /sbin/openrc-run ] || return 1
    if rc-status -s >/dev/null 2>&1; then
        return 0
    fi
    if [ -f /etc/inittab ] && grep -q '/sbin/openrc' /etc/inittab 2>/dev/null; then
        return 0
    fi
    _init="$(readlink -f /sbin/init 2>/dev/null || readlink /sbin/init 2>/dev/null || true)"
    case "${_init}" in
        *openrc*) return 0 ;;
    esac
    return 1
}

procd_is_openwrt() {
    [ -x /sbin/procd ] && [ -f /etc/rc.common ] || return 1
    return 0
}

detect_init() {
    if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
        echo "systemd"
        return 0
    fi
    if procd_is_openwrt; then
        echo "procd"
        return 0
    fi
    if openrc_is_pid1 && {
        command -v openrc >/dev/null 2>&1 \
            || [ -x /sbin/openrc-run ] \
            || [ -f /sbin/openrc ]
    }; then
        echo "openrc"
        return 0
    fi
    if command -v initctl >/dev/null 2>&1 && [ -d /etc/init ]; then
        echo "upstart"
        return 0
    fi
    if [ -d /etc/s6 ] || command -v s6-svc >/dev/null 2>&1; then
        echo "s6"
        return 0
    fi
    if command -v runsvdir >/dev/null 2>&1 || [ -d /etc/runit ]; then
        echo "runit"
        return 0
    fi
    if [ -f /etc/inittab ] || command -v update-rc.d >/dev/null 2>&1 || command -v chkconfig >/dev/null 2>&1; then
        echo "sysvinit"
        return 0
    fi
    echo "unknown"
}

[ "$(id -u)" -eq 0 ] || die "Must be run as root. Try: sudo $0 $*"

OS=$(detect_os)
SHARE_DIR=$(share_dir_for_os "$OS")
BINARY_PATH=$(binary_path_for_os "$OS")

REMOVE_DATA=false
for arg in "$@"; do
    case "${arg}" in
        --remove-data) REMOVE_DATA=true ;;
        --help|-h)
            echo "Usage: $0 [--remove-data]"
            echo ""
            echo "  --remove-data   also delete config, data, and backup directories"
            exit 0 ;;
        *) die "Unknown option: ${arg}" ;;
    esac
done

stop_systemd() {
    if systemctl is-active --quiet edgelet-containerd 2>/dev/null; then
        systemctl stop edgelet-containerd
    fi
    if systemctl is-active --quiet edgelet 2>/dev/null; then
        systemctl stop edgelet
    fi
    systemctl disable edgelet edgelet-containerd 2>/dev/null || true
    rm -f /etc/systemd/system/edgelet.service
    rm -f /etc/systemd/system/edgelet-containerd.service
    rm -rf /etc/systemd/system/edgelet.service.d
    systemctl daemon-reload 2>/dev/null || true
    info "systemd service removed."
}

stop_procd() {
    /etc/init.d/edgelet stop 2>/dev/null || true
    /etc/init.d/edgelet disable 2>/dev/null || true
    rm -f /etc/init.d/edgelet
    info "procd init script removed."
}

stop_openrc() {
    rc-service edgelet-containerd stop 2>/dev/null || true
    rc-service edgelet stop 2>/dev/null || true
    rc-update del edgelet-containerd default 2>/dev/null || true
    rc-update del edgelet default 2>/dev/null || true
    rm -f /etc/init.d/edgelet /etc/init.d/edgelet-containerd
    info "OpenRC service removed."
}

stop_sysvinit() {
    /etc/init.d/edgelet stop 2>/dev/null || true
    update-rc.d -f edgelet remove 2>/dev/null || true
    chkconfig --del edgelet 2>/dev/null || true
    rm -f /etc/init.d/edgelet
    info "SysV init service removed."
}

stop_upstart() {
    initctl stop edgelet 2>/dev/null || true
    rm -f /etc/init/edgelet.conf
    initctl reload-configuration 2>/dev/null || true
    info "Upstart service removed."
}

stop_s6() {
    s6-svc -d /var/run/s6/services/edgelet 2>/dev/null || true
    rm -rf /var/run/s6/services/edgelet
    rm -rf /etc/s6/edgelet
    info "s6 service removed."
}

stop_runit() {
    sv down edgelet 2>/dev/null || true
    rm -f /etc/service/edgelet /var/service/edgelet /service/edgelet 2>/dev/null || true
    rm -rf /etc/runit/edgelet
    info "runit service removed."
}

stop_fallback() {
    pkill -f "/usr/local/bin/edgelet daemon" 2>/dev/null || true
    pkill -f "edgelet daemon" 2>/dev/null || true
    info "Background edgelet processes stopped (if any)."
}

lazy_umount_edgelet() {
    if ! command -v umount >/dev/null 2>&1; then
        return 0
    fi
    mount 2>/dev/null | grep -E '/run/edgelet|/var/run/edgelet|/var/lib/edgelet' | awk '{print $3}' | \
        sort -r | while read -r mp; do
            [ -n "$mp" ] || continue
            umount -l "${mp}" 2>/dev/null || true
        done
}

remove_init_service() {
    _init=$(detect_init 2>/dev/null) || _init="unknown"
    if [ -f /etc/systemd/system/edgelet.service ]; then
        stop_systemd
    elif [ -f /etc/init.d/edgelet ] && [ -x /sbin/procd ]; then
        stop_procd
    elif [ -f /etc/init.d/edgelet ] && command -v openrc >/dev/null 2>&1; then
        stop_openrc
    elif [ -f /etc/init/edgelet.conf ]; then
        stop_upstart
    elif [ -f /etc/init.d/edgelet ]; then
        stop_sysvinit
    elif [ -d /etc/s6/edgelet ]; then
        stop_s6
    elif [ -d /etc/runit/edgelet ] || [ -L /var/service/edgelet ]; then
        stop_runit
    elif [ "$_init" != "" ] && [ "$_init" != "unknown" ]; then
        case "$_init" in
            systemd) stop_systemd ;;
            openrc) stop_openrc ;;
            procd) stop_procd ;;
            sysvinit) stop_sysvinit ;;
            upstart) stop_upstart ;;
            s6) stop_s6 ;;
            runit) stop_runit ;;
            *) stop_fallback ;;
        esac
    else
        stop_fallback
    fi
}

remove_init_service
lazy_umount_edgelet

rm -f "$BINARY_PATH"
info "Binary removed."

case "$OS" in
    linux)
        rm -rf /usr/libexec/edgelet
        info "Init helpers removed from /usr/libexec/edgelet/"
        ;;
esac

rm -rf "$SHARE_DIR"
info "Bundled scripts removed from ${SHARE_DIR}/"

if [ "${REMOVE_DATA}" = "true" ]; then
    info "Removing agent data directories..."
    lazy_umount_edgelet
    case "$OS" in
        linux)
            rm -rf /var/lib/edgelet
            rm -rf /var/lib/edgelet-containerd
            rm -rf /run/edgelet
            rm -rf /var/log/edgelet
            rm -rf /var/backups/edgelet
            rm -rf /etc/edgelet
            ;;
        darwin)
            rm -rf /var/lib/edgelet
            rm -rf /var/run/edgelet
            rm -rf /var/log/edgelet
            rm -rf /var/backups/edgelet
            rm -rf /etc/edgelet
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            rm -rf "${_pd}/data"
            rm -rf "${_pd}/config"
            rm -rf "${_pd}/run"
            rm -rf "${_pd}/log"
            rm -rf "${_pd}/scripts"
            rm -rf "${_pd}"
            ;;
    esac
    info "Data, backups, and configuration removed."
else
    info "Data directories preserved (use --remove-data to remove):"
    case "$OS" in
        linux)
            info "  /var/lib/edgelet"
            info "  /var/lib/edgelet-containerd"
            info "  /run/edgelet"
            info "  /var/log/edgelet"
            info "  /var/backups/edgelet"
            info "  /etc/edgelet"
            ;;
        darwin)
            info "  /var/lib/edgelet"
            info "  /var/run/edgelet"
            info "  /var/log/edgelet"
            info "  /var/backups/edgelet"
            info "  /etc/edgelet"
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            info "  ${_pd}/data"
            info "  ${_pd}/config"
            info "  ${_pd}/run"
            info "  ${_pd}/log"
            ;;
    esac
fi

info ""
info "Edgelet has been uninstalled."
EDGELET_UNINSTALL_EOF
    chmod 755 "$_dest"
}
# ASSEMBLE:UNINSTALL_END

# ASSEMBLE:INSTALL_SELF_BEGIN
# GENERATED by scripts/assemble-install.sh — DO NOT EDIT
# Authoring input: install.sh (excluding INSTALL_SELF region)

write_embedded_install() {
    _dest="$1"
    cat > "$_dest" << 'EDGELET_INSTALL_SELF_EOF'
#!/bin/sh
# install.sh — Edgelet greenfield installer (binary-only, multi-OS)
#
# Usage:
#   curl -fsSL .../install.sh | sudo sh -s -- --version=vX.Y.Z
#   sudo ./install.sh --bin-path=build/edgelet-linux-amd64 --version=dev
#   sudo ./install.sh --airgap --bin-path=./edgelet-linux-amd64 --expected-sha256=...
#
# Options:
#   --version=VERSION          Release tag (default: latest)
#   --arch=ARCH                Override arch (amd64, arm64, arm, riscv64)
#   --container-engine=ENGINE  edgelet, docker, or podman
#                              (linux default: edgelet; darwin/windows: docker)
#   --airgap                   Do not download; use --bin-path
#   --bin-path=PATH            Local edgelet binary
#   --checksum-path=PATH       SHA256SUMS manifest for verification
#   --expected-sha256=HASH     Verify local binary SHA256
#   --upgrade / --rollback     In-place thin-binary OTA (linux)
#   --force-config             Replace config from sample
#   --with-sample-ca           Install sample controller CA if cert missing
#   --help, -h                 Show options and exit
#
# Environment: EDGELET_VERSION, EDGELET_GITHUB_REPO
#
# Provision after install: edgelet provision <key>  (not install.sh flags)

set -e

die() { echo "ERROR: $1" >&2; exit 1; }
info() { echo ">>> $1"; }

SCRIPT_DIR=$(CDPATH= cd -- "$(dirname "$0")" && pwd)

# ── argument parsing ──────────────────────────────────────────────────────────
EDGELET_VERSION="${EDGELET_VERSION:-latest}"
CONTAINER_ENGINE=""
ACTION="install"
AIRGAP=false
BIN_PATH=""
FORCE_CONFIG=false
WITH_SAMPLE_CA=false
ARCH_OVERRIDE=""
CHECKSUM_FILE=""
EXPECTED_SHA256=""

for arg in "$@"; do
    case "${arg}" in
        --version=*)          EDGELET_VERSION="${arg#*=}" ;;
        --arch=*)             ARCH_OVERRIDE="${arg#*=}" ;;
        --container-engine=*) CONTAINER_ENGINE="${arg#*=}" ;;
        --bin-path=*)         BIN_PATH="${arg#*=}" ;;
        --checksum-path=*)    CHECKSUM_FILE="${arg#*=}" ;;
        --expected-sha256=*)  EXPECTED_SHA256="${arg#*=}" ;;
        --airgap)             AIRGAP=true ;;
        --upgrade)            ACTION="upgrade" ;;
        --rollback)           ACTION="rollback" ;;
        --force-config)       FORCE_CONFIG=true ;;
        --with-sample-ca)     WITH_SAMPLE_CA=true ;;
        --help|-h)
            cat <<EOF
Usage: $0 [options]

Options:
  --version=VERSION          Release tag (default: latest)
  --arch=ARCH                Override arch (amd64, arm64, arm, riscv64)
  --container-engine=ENGINE  edgelet, docker, or podman (linux default: edgelet)
  --airgap                   Do not download; use --bin-path
  --bin-path=PATH            Local edgelet binary
  --checksum-path=PATH       SHA256SUMS manifest for verification
  --expected-sha256=HASH     Verify local binary SHA256
  --upgrade / --rollback     In-place thin binary OTA (linux)
  --force-config             Replace config from sample
  --with-sample-ca           Install sample controller CA if cert missing

Environment:
  EDGELET_VERSION  EDGELET_GITHUB_REPO
EOF
            exit 0 ;;
        *) die "Unknown option: ${arg} (use --help)" ;;
    esac
done

if [ "$AIRGAP" = true ] && [ -z "$BIN_PATH" ]; then
    die "--airgap requires --bin-path"
fi

# ASSEMBLE:EMBEDDED_BEGIN
# GENERATED by scripts/assemble-install.sh — DO NOT EDIT
# Authoring inputs: scripts/lib/init-detect.sh, scripts/lib/init-edgelet.sh,
#   packaging/init/**, scripts/edgelet-shutdown


# OpenRC ships /sbin/openrc-run on Alpine even when PID 1 is busybox (Lima
# template:alpine). Require a running OpenRC supervisor, not merely openrc-run.
openrc_is_pid1() {
    [ -x /sbin/openrc-run ] || return 1
    if rc-status -s >/dev/null 2>&1; then
        return 0
    fi
    if [ -f /etc/inittab ] && grep -q '/sbin/openrc' /etc/inittab 2>/dev/null; then
        return 0
    fi
    _init="$(readlink -f /sbin/init 2>/dev/null || readlink /sbin/init 2>/dev/null || true)"
    case "${_init}" in
        *openrc*) return 0 ;;
    esac
    return 1
}

procd_is_openwrt() {
    [ -x /sbin/procd ] && [ -f /etc/rc.common ] || return 1
    return 0
}

detect_init() {
    if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
        echo "systemd"
        return 0
    fi
    if procd_is_openwrt; then
        echo "procd"
        return 0
    fi
    if openrc_is_pid1 && {
        command -v openrc >/dev/null 2>&1 \
            || [ -x /sbin/openrc-run ] \
            || [ -f /sbin/openrc ]
    }; then
        echo "openrc"
        return 0
    fi
    if command -v initctl >/dev/null 2>&1 && [ -d /etc/init ]; then
        echo "upstart"
        return 0
    fi
    if [ -d /etc/s6 ] || command -v s6-svc >/dev/null 2>&1; then
        echo "s6"
        return 0
    fi
    if command -v runsvdir >/dev/null 2>&1 || [ -d /etc/runit ]; then
        echo "runit"
        return 0
    fi
    if [ -f /etc/inittab ] || command -v update-rc.d >/dev/null 2>&1 || command -v chkconfig >/dev/null 2>&1; then
        echo "sysvinit"
        return 0
    fi
    echo "unknown"
}

EDGELET_LIBEXEC="/usr/libexec/edgelet"

init_packaging_root() {
    if [ -n "${EDGELET_INIT_DIR}" ] && [ -d "${EDGELET_INIT_DIR}" ]; then
        echo "${EDGELET_INIT_DIR}"
        return 0
    fi
    echo ""
}

install_shutdown_helper() {
    mkdir -p "${EDGELET_LIBEXEC}"
    cat > "/usr/libexec/edgelet/edgelet-shutdown" << 'EDGELET_SHUTDOWN_EOF'
#!/bin/sh
# edgelet-shutdown — shared control-plane stop entry for all init systems (Plan 10).
# Plan 11: v1 default skips MS drain on control stop (shutdownPolicy=leave-running for docker/podman;
# embedded split uses attach-only). shutdownGracePeriodSeconds applies to optional maintenance drain
# and data-plane (edgelet-containerd) stop — not control-plane MS drain by default.
set -e
EDGELET="${EDGELET_BIN:-/usr/local/bin/edgelet}"
exec "${EDGELET}" shutdown "$@"
EDGELET_SHUTDOWN_EOF
    chmod 755 "/usr/libexec/edgelet/edgelet-shutdown"
}
write_systemd_edgelet_service() {
    cat > "/etc/systemd/system/edgelet.service" << 'EDGELET_SYSTEMD_EDGELET_SERVICE_EOF'
[Unit]
Description=Edgelet daemon (control plane)
Documentation=https://github.com/eclipse-iofog/edgelet
Wants=network-online.target
After=network-online.target
StartLimitIntervalSec=300
StartLimitBurst=20

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'mountpoint -q /sys/fs/bpf || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true'
ExecStart=/usr/local/bin/edgelet daemon
ExecStop=/usr/libexec/edgelet/edgelet-shutdown
Restart=always
RestartSec=2s
# Default 120s = shutdownGracePeriodSeconds (90) + 30s buffer; edgelet-engine drop-in may override.
TimeoutStopSec=120s
KillMode=process
Delegate=yes
DelegateSubgroup=supervisor
KillSignal=SIGTERM
SendSIGKILL=yes
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=edgelet

# Embedded engine needs host paths under /etc/cni, /run, /var, /opt (monolithic unit).
# Tighten on edgelet-containerd.service after Plan 11 data-plane split.
NoNewPrivileges=no

# Resource limits
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target
EDGELET_SYSTEMD_EDGELET_SERVICE_EOF
    chmod 644 "/etc/systemd/system/edgelet.service"
}
write_systemd_edgelet_containerd_service() {
    cat > "/etc/systemd/system/edgelet-containerd.service" << 'EDGELET_SYSTEMD_EDGELET_CONTAINERD_SERVICE_EOF'
# Edgelet embedded containerd (data plane) — Plan 11 workload continuity
[Unit]
Description=Edgelet embedded containerd (data plane)
Documentation=https://github.com/eclipse-iofog/edgelet
Before=edgelet.service
After=network-online.target
Wants=network-online.target
StartLimitIntervalSec=300
StartLimitBurst=5
# Intentionally NOT PartOf=edgelet.service: control restart/stop must not
# stop the data plane (Plan 11 attach-only). Full teardown: stop both units.

[Service]
Type=simple
ExecStartPre=/bin/sh -c 'mountpoint -q /sys/fs/bpf || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true'
ExecStart=/usr/local/bin/edgelet runtime-bootstrap
ExecStopPost=-/usr/local/bin/edgelet runtime reap-orphans
Restart=always
RestartSec=5s
# Data-plane stop: drain MS via runtime-bootstrap SIGTERM handler + shutdownGracePeriodSeconds
TimeoutStopSec=120s
KillMode=process
KillSignal=SIGTERM
SendSIGKILL=yes
User=root
StandardOutput=journal
StandardError=journal
SyslogIdentifier=edgelet-containerd
Delegate=yes
DelegateSubgroup=containerd
NoNewPrivileges=no
LimitNOFILE=65536
LimitNPROC=4096

[Install]
WantedBy=multi-user.target
EDGELET_SYSTEMD_EDGELET_CONTAINERD_SERVICE_EOF
    chmod 644 "/etc/systemd/system/edgelet-containerd.service"
}
write_systemd_dropin_docker() {
    cat > "/etc/systemd/system/edgelet.service.d/docker.conf" << 'EDGELET_SYSTEMD_DROPIN_DOCKER_EOF'
# Engine ordering drop-in — docker (Plan 10). Installed when containerEngine=docker.
[Unit]
After=network-online.target docker.service
Wants=docker.service
EDGELET_SYSTEMD_DROPIN_DOCKER_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/docker.conf"
}
write_systemd_dropin_podman() {
    cat > "/etc/systemd/system/edgelet.service.d/podman.conf" << 'EDGELET_SYSTEMD_DROPIN_PODMAN_EOF'
# Engine ordering drop-in — podman (Plan 10). Installed when containerEngine=podman.
[Unit]
After=network-online.target podman.socket
Wants=podman.socket
EDGELET_SYSTEMD_DROPIN_PODMAN_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/podman.conf"
}
write_systemd_dropin_edgelet() {
    cat > "/etc/systemd/system/edgelet.service.d/edgelet.conf" << 'EDGELET_SYSTEMD_DROPIN_EDGELET_EOF'
# Engine ordering drop-in — embedded edgelet (Plan 11). Installed when containerEngine=edgelet.
[Unit]
Wants=edgelet-containerd.service
After=network-online.target edgelet-containerd.service

[Service]
Environment=EDGELET_RUNTIME_SPLIT=1
# Control-plane stop: default leave-running (skip MS drain). Grace + buffer matches shutdownGracePeriodSeconds default 90.
TimeoutStopSec=120s
EDGELET_SYSTEMD_DROPIN_EDGELET_EOF
    chmod 644 "/etc/systemd/system/edgelet.service.d/edgelet.conf"
}
write_openrc_edgelet_init() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_OPENRC_EDGELET_INIT_EOF'
#!/sbin/openrc-run

name="edgelet"
description="Edgelet daemon (control plane)"
command="/usr/local/bin/edgelet"
command_args="daemon"
supervisor="supervise-daemon"
respawn_delay=2
respawn_max=0
respawn_period=3600
command_user="root"
pidfile="/run/${RC_SVCNAME}.pid"
output_log="/var/log/edgelet/daemon.log"
error_log="/var/log/edgelet/daemon.log"
shutdown="/usr/libexec/edgelet/edgelet-shutdown"

depend() {
    need net
    after firewall
%%EDGELET_ENGINE_NEED%%
}

wait_containerd_attach_socket() {
    _timeout="${EDGELET_ATTACH_WAIT_SEC:-120}"
    _elapsed=0
    _sock="/run/edgelet/containerd.sock"
    while [ "${_elapsed}" -lt "${_timeout}" ]; do
        if [ -S "${_sock}" ] || [ -S /var/run/edgelet/containerd.sock ]; then
            [ -S "${_sock}" ] || _sock="/var/run/edgelet/containerd.sock"
            _ctr=""
            if [ -x /var/lib/edgelet/data/current/bin/ctr ]; then
                _ctr=/var/lib/edgelet/data/current/bin/ctr
            elif command -v ctr >/dev/null 2>&1; then
                _ctr=ctr
            fi
            if [ -z "${_ctr}" ] || "${_ctr}" --address "${_sock}" version >/dev/null 2>&1; then
                return 0
            fi
        fi
        sleep 2
        _elapsed=$(( _elapsed + 2 ))
    done
    ewarn "data-plane containerd socket not ready after ${_timeout}s"
    return 1
}

start_pre() {
    /usr/local/bin/edgelet cgroup-preflight || return $?
    if [ -f /etc/init.d/edgelet-containerd ]; then
        export EDGELET_RUNTIME_SPLIT=1
        wait_containerd_attach_socket || return $?
    fi
}

stop_pre() {
    if [ -f /etc/init.d/edgelet-containerd ]; then
        export EDGELET_RUNTIME_SPLIT=1
    fi
}

stop() {
    ebegin "Stopping ${RC_SVCNAME}"
    if ! "${shutdown}"; then
        # Fallback when EdgeletAPI is down: single TERM/KILL, no SSD --retry (hangs after graceful stop).
        if [ -f "${pidfile}" ]; then
            _pid=$(cat "${pidfile}" 2>/dev/null || true)
            if [ -n "${_pid}" ] && kill -0 "${_pid}" 2>/dev/null; then
                kill -TERM "${_pid}" 2>/dev/null || true
                sleep 2
                kill -KILL "${_pid}" 2>/dev/null || true
            fi
        fi
        rm -f "${pidfile}" /run/edgelet/edgelet.pid 2>/dev/null || true
        eend 1
        return 1
    fi
    rm -f "${pidfile}" /run/edgelet/edgelet.pid 2>/dev/null || true
    # Plan 11 split: data-plane containerd is edgelet-containerd service — do not reap child here.
    if [ ! -f /etc/init.d/edgelet-containerd ]; then
        _pids=$(pgrep -f edgelet-containerd-child 2>/dev/null || true)
        for _p in ${_pids}; do kill -TERM "${_p}" 2>/dev/null || true; done
        sleep 2
        _pids=$(pgrep -f edgelet-containerd-child 2>/dev/null || true)
        for _p in ${_pids}; do kill -KILL "${_p}" 2>/dev/null || true; done
    fi
    eend 0
}
EDGELET_OPENRC_EDGELET_INIT_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_openrc_edgelet_containerd_init() {
    cat > "/etc/init.d/edgelet-containerd" << 'EDGELET_OPENRC_EDGELET_CONTAINERD_INIT_EOF'
#!/sbin/openrc-run

# Edgelet embedded containerd (data plane) — Plan 11 workload continuity
name="edgelet-containerd"
description="Edgelet embedded containerd (data plane)"
command="/usr/local/bin/edgelet"
command_args="runtime-bootstrap"
supervisor="supervise-daemon"
respawn_delay=5
respawn_max=5
respawn_period=300
command_user="root"
pidfile="/run/${RC_SVCNAME}.pid"
output_log="/var/log/edgelet/containerd.log"
error_log="/var/log/edgelet/containerd.log"

depend() {
    need net
    need edgelet-cgroup-prep
    before edgelet
}

start_pre() {
    # C3: light preflight only; primary cgroup bootstrap is in runtime-bootstrap (C1).
    mountpoint -q /sys/fs/bpf 2>/dev/null || mount -t bpf bpf /sys/fs/bpf 2>/dev/null || true
    /usr/local/bin/edgelet cgroup-preflight || return $?
}

start_post() {
    # Block dependency satisfaction until CRI socket answers (Plan 11 split).
    _timeout="${EDGELET_CONTAINERD_READY_SEC:-120}"
    _elapsed=0
    _sock="/run/edgelet/containerd.sock"
    while [ "${_elapsed}" -lt "${_timeout}" ]; do
        if [ -S "${_sock}" ] || [ -S /var/run/edgelet/containerd.sock ]; then
            [ -S "${_sock}" ] || _sock="/var/run/edgelet/containerd.sock"
            _ctr=""
            if [ -x /var/lib/edgelet/data/current/bin/ctr ]; then
                _ctr=/var/lib/edgelet/data/current/bin/ctr
            elif command -v ctr >/dev/null 2>&1; then
                _ctr=ctr
            fi
            if [ -z "${_ctr}" ] || "${_ctr}" --address "${_sock}" version >/dev/null 2>&1; then
                return 0
            fi
        fi
        sleep 2
        _elapsed=$(( _elapsed + 2 ))
    done
    ewarn "containerd socket not ready after ${_timeout}s"
    return 1
}

stop() {
    ebegin "Stopping ${RC_SVCNAME}"
    if [ -f "${pidfile}" ]; then
        _pid=$(cat "${pidfile}" 2>/dev/null || true)
        if [ -n "${_pid}" ] && kill -0 "${_pid}" 2>/dev/null; then
            kill -TERM "${_pid}" 2>/dev/null || true
            _grace="${EDGELET_CONTAINERD_STOP_SEC:-30}"
            _elapsed=0
            while kill -0 "${_pid}" 2>/dev/null; do
                if [ "${_elapsed}" -ge "${_grace}" ]; then
                    kill -KILL "${_pid}" 2>/dev/null || true
                    break
                fi
                sleep 2
                _elapsed=$(( _elapsed + 2 ))
            done
        fi
    fi
    rm -f "${pidfile}" 2>/dev/null || true
    /usr/local/bin/edgelet runtime reap-orphans || ewarn "orphan reap exited non-zero"
    eend 0
}
EDGELET_OPENRC_EDGELET_CONTAINERD_INIT_EOF
    chmod 755 "/etc/init.d/edgelet-containerd"
}
write_openrc_edgelet_cgroup_prep_init() {
    cat > "/etc/init.d/edgelet-cgroup-prep" << 'EDGELET_OPENRC_EDGELET_CGROUP_PREP_INIT_EOF'
#!/sbin/openrc-run

# Early cgroup v2 delegation for LXC/VM machine roots (OrbStack Alpine, etc.).
# Moby/dind-style reparent before enabling subtree_control on root and /.lxc.
name="edgelet-cgroup-prep"
description="Edgelet cgroup delegation prep (machine root)"

depend() {
    before edgelet-containerd edgelet
}

cgroup_delegate_controllers() {
    _dir="$1"
    _ctrl="${_dir}/cgroup.controllers"
    _sub="${_dir}/cgroup.subtree_control"
    [ -f "${_ctrl}" ] || return 0
    for _c in cpu memory pids; do
        grep -qw "${_c}" "${_ctrl}" 2>/dev/null || continue
        grep -qw "${_c}" "${_sub}" 2>/dev/null && continue
        echo "+${_c}" >> "${_sub}" 2>/dev/null || true
    done
}

cgroup_reparent_procs() {
    _from="$1"
    _to="$2"
    [ -f "${_from}/cgroup.procs" ] || return 0
    [ -s "${_from}/cgroup.procs" ] || return 0
    mkdir -p "${_to}"
    xargs -rn1 < "${_from}/cgroup.procs" > "${_to}/cgroup.procs" 2>/dev/null || true
}

start() {
    # No-op on bare-metal / systemd VM layouts without LXC machine cgroup.
    [ -d /sys/fs/cgroup/.lxc ] || return 0

    ebegin "Preparing cgroup delegation for machine root"
    _cg="/sys/fs/cgroup"

    cgroup_reparent_procs "${_cg}" "${_cg}/init"
    cgroup_delegate_controllers "${_cg}"

    cgroup_reparent_procs "${_cg}/.lxc" "${_cg}/.lxc/init"
    cgroup_delegate_controllers "${_cg}/.lxc"

    eend 0
}

stop() {
    return 0
}
EDGELET_OPENRC_EDGELET_CGROUP_PREP_INIT_EOF
    chmod 755 "/etc/init.d/edgelet-cgroup-prep"
}
write_procd_edgelet() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_PROCD_EDGELET_EOF'
#!/bin/sh /etc/rc.common
# Edgelet control plane (OpenWrt procd)

START=99
STOP=10
USE_PROCD=1

start_service() {
    /usr/local/bin/edgelet cgroup-preflight || return $?

    procd_open_instance
    procd_set_param command /usr/local/bin/edgelet
    procd_append_param command daemon
    procd_set_param respawn 3600 5 5
    procd_set_param stdout 1
    procd_set_param stderr 1
    procd_close_instance
}

stop_service() {
    /usr/libexec/edgelet/edgelet-shutdown
}
EDGELET_PROCD_EDGELET_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_sysvinit_edgelet() {
    cat > "/etc/init.d/edgelet" << 'EDGELET_SYSVINIT_EDGELET_EOF'
#!/bin/sh
### BEGIN INIT INFO
# Provides:          edgelet
# Required-Start:    $network $remote_fs
# Required-Stop:     $network $remote_fs
# Default-Start:     2 3 4 5
# Default-Stop:      0 1 6
# Short-Description: Edgelet daemon
### END INIT INFO

DAEMON=/usr/local/bin/edgelet
SHUTDOWN=/usr/libexec/edgelet/edgelet-shutdown
PIDFILE=/var/run/edgelet.pid
LOGFILE=/var/log/edgelet/daemon.log
KILLTIMEOUT=30

. /lib/lsb/init-functions

preflight() {
    "${DAEMON}" cgroup-preflight
}

case "$1" in
    start)
        log_daemon_msg "Starting edgelet"
        preflight || exit $?
        start-stop-daemon --start --background --make-pidfile --pidfile "$PIDFILE" \
            --exec "$DAEMON" -- daemon >>"$LOGFILE" 2>&1
        log_end_msg $?
        ;;
    stop)
        log_daemon_msg "Stopping edgelet"
        if [ -x "$SHUTDOWN" ]; then
            "$SHUTDOWN" && log_end_msg 0 && exit 0
        fi
        start-stop-daemon --stop --pidfile "$PIDFILE" --retry TERM/${KILLTIMEOUT}/KILL/5
        log_end_msg $?
        ;;
    restart|force-reload)
        $0 stop
        $0 start
        ;;
    status)
        status_of_proc -p "$PIDFILE" "$DAEMON" edgelet
        ;;
    *)
        echo "Usage: $0 {start|stop|restart|status}"
        exit 1
        ;;
esac

exit 0
EDGELET_SYSVINIT_EDGELET_EOF
    chmod 755 "/etc/init.d/edgelet"
}
write_upstart_edgelet() {
    cat > "/etc/init/edgelet.conf" << 'EDGELET_UPSTART_EDGELET_EOF'
description "Edgelet daemon (control plane)"
author "Datasance"

start on runlevel [2345]
stop on runlevel [!2345]

respawn
respawn limit 20 300

pre-start script
    /usr/local/bin/edgelet cgroup-preflight || exit $?
end script

exec /usr/local/bin/edgelet daemon >> /var/log/edgelet/daemon.log 2>&1

post-stop script
    /usr/libexec/edgelet/edgelet-shutdown || true
end script
EDGELET_UPSTART_EDGELET_EOF
    chmod 644 "/etc/init/edgelet.conf"
}
write_s6_run() {
    cat > "/etc/s6/edgelet/run" << 'EDGELET_S6_RUN_EOF'
#!/bin/sh
exec 2>&1
/usr/local/bin/edgelet cgroup-preflight || exit $?
exec /usr/local/bin/edgelet daemon
EDGELET_S6_RUN_EOF
    chmod 755 "/etc/s6/edgelet/run"
}
write_s6_finish() {
    cat > "/etc/s6/edgelet/finish" << 'EDGELET_S6_FINISH_EOF'
#!/bin/sh
/usr/libexec/edgelet/edgelet-shutdown 2>/dev/null || true
exit "${1:-0}"
EDGELET_S6_FINISH_EOF
    chmod 755 "/etc/s6/edgelet/finish"
}
write_runit_run() {
    cat > "/etc/runit/edgelet/run" << 'EDGELET_RUNIT_RUN_EOF'
#!/bin/sh
LOG=/var/log/edgelet/daemon.log
exec 2>&1
/usr/local/bin/edgelet cgroup-preflight >>"$LOG" 2>&1 || exit $?
exec /usr/local/bin/edgelet daemon >>"$LOG" 2>&1
EDGELET_RUNIT_RUN_EOF
    chmod 755 "/etc/runit/edgelet/run"
}
write_runit_finish() {
    cat > "/etc/runit/edgelet/finish" << 'EDGELET_RUNIT_FINISH_EOF'
#!/bin/sh
/usr/libexec/edgelet/edgelet-shutdown 2>/dev/null || true
exit "${1:-0}"
EDGELET_RUNIT_FINISH_EOF
    chmod 755 "/etc/runit/edgelet/finish"
}

openrc_engine_need_line() {
    case "$1" in
        docker) printf '%s\n' '    need docker' ;;
        podman) printf '%s\n' '    need podman' ;;
        edgelet) printf '%s\n' '    need edgelet-containerd' ;;
        *)      printf '%s\n' '' ;;
    esac
}

apply_openrc_engine_deps() {
    _eng="$1"
    _dest="$2"
    _need="$(openrc_engine_need_line "${_eng}")"
    if [ -f "${_dest}" ]; then
        # shellcheck disable=SC2016
        awk -v need="${_need}" '
            /%%EDGELET_ENGINE_NEED%%/ {
                if (need != "") print need
                next
            }
            { print }
        ' "${_dest}" > "${_dest}.tmp" && mv "${_dest}.tmp" "${_dest}"
    fi
}

install_init_helpers() {
    install_shutdown_helper
}

# installed_embed_hash returns the basename of data/current (embed SHA256 prefix), or empty.
installed_embed_hash() {
    _link="/var/lib/edgelet/data/current"
    [ -L "$_link" ] || return 0
    basename "$(readlink -f "$_link" 2>/dev/null || readlink "$_link")"
}

# binary_embed_hash reads embed hash from a linux thin binary (edgelet version --verbose).
binary_embed_hash() {
    _bin="$1"
    [ -x "$_bin" ] || return 0
    "$_bin" version --verbose 2>/dev/null \
        | sed -n 's/^  embed hash: //p' \
        | head -1
}

# should_restart_data_plane is true when containerEngine=edgelet and the embed hash changed
# (or data/current is not yet set). Returns false for docker/podman or lite builds without embed.
should_restart_data_plane() {
    _eng="$1"
    _old="$2"
    _new="$3"
    [ "$_eng" = "edgelet" ] || return 1
    [ -n "$_new" ] || return 1
    [ -z "$_old" ] && return 0
    [ "$_old" != "$_new" ]
}

start_edgelet_containerd_unit() {
    _init="$1"
    _restart="$2"
    case "${_init}" in
        systemd)
            systemctl enable edgelet-containerd 2>/dev/null || true
            if [ "$_restart" = true ]; then
                info "Embedded bundle hash changed; restarting edgelet-containerd (data plane)"
                systemctl stop edgelet-containerd 2>/dev/null || true
                systemctl reset-failed edgelet-containerd 2>/dev/null || true
                systemctl start edgelet-containerd
            else
                systemctl start edgelet-containerd 2>/dev/null || true
            fi
            ;;
        openrc)
            rc-update add edgelet-containerd default 2>/dev/null || true
            if [ "$_restart" = true ]; then
                info "Embedded bundle hash changed; restarting edgelet-containerd (data plane)"
                rc-service edgelet-containerd stop 2>/dev/null || true
                rc-service edgelet-containerd start 2>/dev/null || true
            else
                rc-service edgelet-containerd start 2>/dev/null || true
            fi
            ;;
    esac
}

install_systemd_dropin() {
    _eng="$1"
    _root="$2"
    _dropdir="/etc/systemd/system/edgelet.service.d"
    mkdir -p "${_dropdir}"
    rm -f "${_dropdir}/docker.conf" "${_dropdir}/podman.conf" "${_dropdir}/edgelet.conf"
    if [ -n "${_root}" ]; then
        case "${_eng}" in
            docker)
                install -m 644 "${_root}/systemd/edgelet.service.d/docker.conf" "${_dropdir}/docker.conf"
                ;;
            podman)
                install -m 644 "${_root}/systemd/edgelet.service.d/podman.conf" "${_dropdir}/podman.conf"
                ;;
            edgelet)
                install -m 644 "${_root}/systemd/edgelet.service.d/edgelet.conf" "${_dropdir}/edgelet.conf"
                systemctl enable edgelet-containerd 2>/dev/null || true
                ;;
        esac
    else
        case "${_eng}" in
            docker)  write_systemd_dropin_docker ;;
            podman)  write_systemd_dropin_podman ;;
            edgelet)
                write_systemd_dropin_edgelet
                systemctl enable edgelet-containerd 2>/dev/null || true
                ;;
        esac
    fi
}

install_init_unit() {
    _init="$1"
    _eng="$2"
    _restart_dp="${3:-false}"
    _root="$(init_packaging_root)"
    mkdir -p /var/log/edgelet
    install_init_helpers

    case "${_init}" in
        systemd)
            mkdir -p /etc/cni/net.d /run/edgelet /run/containerd
            chmod 755 /run/edgelet /run/containerd 2>/dev/null || true
            if [ -n "${_root}" ]; then
                _unit="${_root}/systemd/edgelet.service"
                [ -f "$_unit" ] || die "Missing ${_unit}"
                install -m 644 "$_unit" /etc/systemd/system/edgelet.service
                _containerd="${_root}/systemd/edgelet-containerd.service"
                if [ -f "${_containerd}" ]; then
                    install -m 644 "${_containerd}" /etc/systemd/system/edgelet-containerd.service
                fi
            else
                write_systemd_edgelet_service
                write_systemd_edgelet_containerd_service
            fi
            install_systemd_dropin "${_eng}" "${_root}"
            systemctl daemon-reload
            if [ "${_eng}" = "edgelet" ]; then
                start_edgelet_containerd_unit "${_init}" "${_restart_dp}"
            fi
            systemctl enable edgelet
            systemctl stop edgelet 2>/dev/null || true
            systemctl reset-failed edgelet 2>/dev/null || true
            systemctl start edgelet
            info "systemd unit edgelet.service installed (engine=${_eng} drop-in)."
            ;;
        openrc)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/openrc/edgelet.init" /etc/init.d/edgelet
                if [ -f "${_root}/openrc/edgelet-cgroup-prep.init" ]; then
                    install -m 755 "${_root}/openrc/edgelet-cgroup-prep.init" /etc/init.d/edgelet-cgroup-prep
                    rc-update add edgelet-cgroup-prep sysinit 2>/dev/null || true
                fi
                if [ -f "${_root}/openrc/edgelet-containerd.init" ]; then
                    install -m 755 "${_root}/openrc/edgelet-containerd.init" /etc/init.d/edgelet-containerd
                fi
            else
                write_openrc_edgelet_init
                write_openrc_edgelet_cgroup_prep_init
                write_openrc_edgelet_containerd_init
                rc-update add edgelet-cgroup-prep sysinit 2>/dev/null || true
            fi
            apply_openrc_engine_deps "${_eng}" /etc/init.d/edgelet
            chmod 755 /etc/init.d/edgelet
            if [ "${_eng}" = "edgelet" ]; then
                start_edgelet_containerd_unit "${_init}" "${_restart_dp}"
            fi
            rc-update add edgelet default 2>/dev/null || true
            rc-service edgelet restart 2>/dev/null || rc-service edgelet start
            info "OpenRC service edgelet installed (engine=${_eng})."
            ;;
        procd)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/procd/edgelet" /etc/init.d/edgelet
            else
                write_procd_edgelet
            fi
            /etc/init.d/edgelet enable 2>/dev/null || true
            /etc/init.d/edgelet stop 2>/dev/null || true
            /etc/init.d/edgelet start
            info "procd init script edgelet installed (engine=${_eng})."
            ;;
        sysvinit)
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/sysvinit/edgelet.init" /etc/init.d/edgelet
            else
                write_sysvinit_edgelet
            fi
            if command -v update-rc.d >/dev/null 2>&1; then
                update-rc.d edgelet defaults 2>/dev/null || true
            elif command -v chkconfig >/dev/null 2>&1; then
                chkconfig --add edgelet 2>/dev/null || true
            fi
            /etc/init.d/edgelet restart 2>/dev/null || /etc/init.d/edgelet start
            info "SysV init script edgelet installed."
            ;;
        upstart)
            if [ -n "${_root}" ]; then
                install -m 644 "${_root}/upstart/edgelet.conf" /etc/init/edgelet.conf
            else
                write_upstart_edgelet
            fi
            initctl reload-configuration 2>/dev/null || true
            initctl restart edgelet 2>/dev/null || initctl start edgelet
            info "Upstart job edgelet installed."
            ;;
        s6)
            mkdir -p /etc/s6/edgelet
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/s6/run" /etc/s6/edgelet/run
                install -m 755 "${_root}/s6/finish" /etc/s6/edgelet/finish
            else
                write_s6_run
                write_s6_finish
            fi
            if command -v s6-svc >/dev/null 2>&1 && [ -d /var/run/s6/services ]; then
                mkdir -p /var/run/s6/services/edgelet
                ln -sf /etc/s6/edgelet /var/run/s6/services/edgelet/supervise 2>/dev/null || true
                s6-svc -u /var/run/s6/services/edgelet 2>/dev/null || true
            fi
            info "s6 service installed under /etc/s6/edgelet (start via your s6 scan)."
            ;;
        runit)
            mkdir -p /etc/runit/edgelet
            if [ -n "${_root}" ]; then
                install -m 755 "${_root}/runit/run" /etc/runit/edgelet/run
                if [ -f "${_root}/runit/finish" ]; then
                    install -m 755 "${_root}/runit/finish" /etc/runit/edgelet/finish
                fi
            else
                write_runit_run
                write_runit_finish
            fi
            if [ -d /etc/runit ]; then
                ln -sf /etc/runit/edgelet /etc/service/edgelet 2>/dev/null || \
                    ln -sf /etc/runit/edgelet /var/service/edgelet 2>/dev/null || true
                sv restart edgelet 2>/dev/null || sv start edgelet 2>/dev/null || true
            fi
            info "runit service installed under /etc/runit/edgelet."
            ;;
        *)
            die "No supported init system detected (${_init}). Install systemd, procd, openrc, sysvinit, upstart, s6, or runit."
            ;;
    esac
}

stop_edgelet_service() {
    _init="${1:-$(detect_init)}"
    case "${_init}" in
        systemd) systemctl stop edgelet 2>/dev/null || true ;;
        openrc) rc-service edgelet stop 2>/dev/null || true ;;
        procd) /etc/init.d/edgelet stop 2>/dev/null || true ;;
        sysvinit) /etc/init.d/edgelet stop 2>/dev/null || true ;;
        upstart) initctl stop edgelet 2>/dev/null || true ;;
        s6) s6-svc -d /var/run/s6/services/edgelet 2>/dev/null || true ;;
        runit) sv down edgelet 2>/dev/null || true ;;
        *) "${EDGELET_LIBEXEC}/edgelet-shutdown" 2>/dev/null || pkill -f "/usr/local/bin/edgelet daemon" 2>/dev/null || true ;;
    esac
}

# ASSEMBLE:EMBEDDED_END

# ASSEMBLE:UNINSTALL_BEGIN
# GENERATED by scripts/assemble-install.sh — DO NOT EDIT
# Authoring input: uninstall.sh

write_embedded_uninstall() {
    _dest="$1"
    cat > "$_dest" << 'EDGELET_UNINSTALL_EOF'
#!/bin/sh
# uninstall.sh — Edgelet uninstaller
#
# Usage:
#   sudo sh uninstall.sh [--remove-data]
#
# --remove-data  also removes config, data, runtime, logs, and backup directories

set -e

die() { echo "ERROR: $1" >&2; exit 1; }
info() { echo ">>> $1"; }

detect_os() {
    _u=$(uname -s)
    case "${_u}" in
        Linux)  echo "linux" ;;
        Darwin) echo "darwin" ;;
        MINGW*|MSYS*|CYGWIN*|Windows_NT) echo "windows" ;;
        *) die "Unsupported OS: ${_u}" ;;
    esac
}

windows_program_data_edgelet() {
    echo "${ProgramData:-/c/ProgramData}/Edgelet"
}

share_dir_for_os() {
    case "$1" in
        linux)  echo "/usr/share/edgelet" ;;
        darwin) echo "/usr/local/share/edgelet" ;;
        windows) echo "$(windows_program_data_edgelet)/scripts" ;;
        *) die "Unsupported OS: $1" ;;
    esac
}

binary_path_for_os() {
    case "$1" in
        linux|darwin) echo "/usr/local/bin/edgelet" ;;
        windows)
            _pf="${ProgramFiles:-/c/Program Files}"
            echo "${_pf}/Edgelet/edgelet.exe"
            ;;
        *) die "Unsupported OS: $1" ;;
    esac
}

# OpenRC ships /sbin/openrc-run on Alpine even when PID 1 is busybox (Lima
# template:alpine). Require a running OpenRC supervisor, not merely openrc-run.
openrc_is_pid1() {
    [ -x /sbin/openrc-run ] || return 1
    if rc-status -s >/dev/null 2>&1; then
        return 0
    fi
    if [ -f /etc/inittab ] && grep -q '/sbin/openrc' /etc/inittab 2>/dev/null; then
        return 0
    fi
    _init="$(readlink -f /sbin/init 2>/dev/null || readlink /sbin/init 2>/dev/null || true)"
    case "${_init}" in
        *openrc*) return 0 ;;
    esac
    return 1
}

procd_is_openwrt() {
    [ -x /sbin/procd ] && [ -f /etc/rc.common ] || return 1
    return 0
}

detect_init() {
    if command -v systemctl >/dev/null 2>&1 && [ -d /etc/systemd/system ]; then
        echo "systemd"
        return 0
    fi
    if procd_is_openwrt; then
        echo "procd"
        return 0
    fi
    if openrc_is_pid1 && {
        command -v openrc >/dev/null 2>&1 \
            || [ -x /sbin/openrc-run ] \
            || [ -f /sbin/openrc ]
    }; then
        echo "openrc"
        return 0
    fi
    if command -v initctl >/dev/null 2>&1 && [ -d /etc/init ]; then
        echo "upstart"
        return 0
    fi
    if [ -d /etc/s6 ] || command -v s6-svc >/dev/null 2>&1; then
        echo "s6"
        return 0
    fi
    if command -v runsvdir >/dev/null 2>&1 || [ -d /etc/runit ]; then
        echo "runit"
        return 0
    fi
    if [ -f /etc/inittab ] || command -v update-rc.d >/dev/null 2>&1 || command -v chkconfig >/dev/null 2>&1; then
        echo "sysvinit"
        return 0
    fi
    echo "unknown"
}

[ "$(id -u)" -eq 0 ] || die "Must be run as root. Try: sudo $0 $*"

OS=$(detect_os)
SHARE_DIR=$(share_dir_for_os "$OS")
BINARY_PATH=$(binary_path_for_os "$OS")

REMOVE_DATA=false
for arg in "$@"; do
    case "${arg}" in
        --remove-data) REMOVE_DATA=true ;;
        --help|-h)
            echo "Usage: $0 [--remove-data]"
            echo ""
            echo "  --remove-data   also delete config, data, and backup directories"
            exit 0 ;;
        *) die "Unknown option: ${arg}" ;;
    esac
done

stop_systemd() {
    if systemctl is-active --quiet edgelet-containerd 2>/dev/null; then
        systemctl stop edgelet-containerd
    fi
    if systemctl is-active --quiet edgelet 2>/dev/null; then
        systemctl stop edgelet
    fi
    systemctl disable edgelet edgelet-containerd 2>/dev/null || true
    rm -f /etc/systemd/system/edgelet.service
    rm -f /etc/systemd/system/edgelet-containerd.service
    rm -rf /etc/systemd/system/edgelet.service.d
    systemctl daemon-reload 2>/dev/null || true
    info "systemd service removed."
}

stop_procd() {
    /etc/init.d/edgelet stop 2>/dev/null || true
    /etc/init.d/edgelet disable 2>/dev/null || true
    rm -f /etc/init.d/edgelet
    info "procd init script removed."
}

stop_openrc() {
    rc-service edgelet-containerd stop 2>/dev/null || true
    rc-service edgelet stop 2>/dev/null || true
    rc-update del edgelet-containerd default 2>/dev/null || true
    rc-update del edgelet default 2>/dev/null || true
    rm -f /etc/init.d/edgelet /etc/init.d/edgelet-containerd
    info "OpenRC service removed."
}

stop_sysvinit() {
    /etc/init.d/edgelet stop 2>/dev/null || true
    update-rc.d -f edgelet remove 2>/dev/null || true
    chkconfig --del edgelet 2>/dev/null || true
    rm -f /etc/init.d/edgelet
    info "SysV init service removed."
}

stop_upstart() {
    initctl stop edgelet 2>/dev/null || true
    rm -f /etc/init/edgelet.conf
    initctl reload-configuration 2>/dev/null || true
    info "Upstart service removed."
}

stop_s6() {
    s6-svc -d /var/run/s6/services/edgelet 2>/dev/null || true
    rm -rf /var/run/s6/services/edgelet
    rm -rf /etc/s6/edgelet
    info "s6 service removed."
}

stop_runit() {
    sv down edgelet 2>/dev/null || true
    rm -f /etc/service/edgelet /var/service/edgelet /service/edgelet 2>/dev/null || true
    rm -rf /etc/runit/edgelet
    info "runit service removed."
}

stop_fallback() {
    pkill -f "/usr/local/bin/edgelet daemon" 2>/dev/null || true
    pkill -f "edgelet daemon" 2>/dev/null || true
    info "Background edgelet processes stopped (if any)."
}

lazy_umount_edgelet() {
    if ! command -v umount >/dev/null 2>&1; then
        return 0
    fi
    mount 2>/dev/null | grep -E '/run/edgelet|/var/run/edgelet|/var/lib/edgelet' | awk '{print $3}' | \
        sort -r | while read -r mp; do
            [ -n "$mp" ] || continue
            umount -l "${mp}" 2>/dev/null || true
        done
}

remove_init_service() {
    _init=$(detect_init 2>/dev/null) || _init="unknown"
    if [ -f /etc/systemd/system/edgelet.service ]; then
        stop_systemd
    elif [ -f /etc/init.d/edgelet ] && [ -x /sbin/procd ]; then
        stop_procd
    elif [ -f /etc/init.d/edgelet ] && command -v openrc >/dev/null 2>&1; then
        stop_openrc
    elif [ -f /etc/init/edgelet.conf ]; then
        stop_upstart
    elif [ -f /etc/init.d/edgelet ]; then
        stop_sysvinit
    elif [ -d /etc/s6/edgelet ]; then
        stop_s6
    elif [ -d /etc/runit/edgelet ] || [ -L /var/service/edgelet ]; then
        stop_runit
    elif [ "$_init" != "" ] && [ "$_init" != "unknown" ]; then
        case "$_init" in
            systemd) stop_systemd ;;
            openrc) stop_openrc ;;
            procd) stop_procd ;;
            sysvinit) stop_sysvinit ;;
            upstart) stop_upstart ;;
            s6) stop_s6 ;;
            runit) stop_runit ;;
            *) stop_fallback ;;
        esac
    else
        stop_fallback
    fi
}

remove_init_service
lazy_umount_edgelet

rm -f "$BINARY_PATH"
info "Binary removed."

case "$OS" in
    linux)
        rm -rf /usr/libexec/edgelet
        info "Init helpers removed from /usr/libexec/edgelet/"
        ;;
esac

rm -rf "$SHARE_DIR"
info "Bundled scripts removed from ${SHARE_DIR}/"

if [ "${REMOVE_DATA}" = "true" ]; then
    info "Removing agent data directories..."
    lazy_umount_edgelet
    case "$OS" in
        linux)
            rm -rf /var/lib/edgelet
            rm -rf /var/lib/edgelet-containerd
            rm -rf /run/edgelet
            rm -rf /var/log/edgelet
            rm -rf /var/backups/edgelet
            rm -rf /etc/edgelet
            ;;
        darwin)
            rm -rf /var/lib/edgelet
            rm -rf /var/run/edgelet
            rm -rf /var/log/edgelet
            rm -rf /var/backups/edgelet
            rm -rf /etc/edgelet
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            rm -rf "${_pd}/data"
            rm -rf "${_pd}/config"
            rm -rf "${_pd}/run"
            rm -rf "${_pd}/log"
            rm -rf "${_pd}/scripts"
            rm -rf "${_pd}"
            ;;
    esac
    info "Data, backups, and configuration removed."
else
    info "Data directories preserved (use --remove-data to remove):"
    case "$OS" in
        linux)
            info "  /var/lib/edgelet"
            info "  /var/lib/edgelet-containerd"
            info "  /run/edgelet"
            info "  /var/log/edgelet"
            info "  /var/backups/edgelet"
            info "  /etc/edgelet"
            ;;
        darwin)
            info "  /var/lib/edgelet"
            info "  /var/run/edgelet"
            info "  /var/log/edgelet"
            info "  /var/backups/edgelet"
            info "  /etc/edgelet"
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            info "  ${_pd}/data"
            info "  ${_pd}/config"
            info "  ${_pd}/run"
            info "  ${_pd}/log"
            ;;
    esac
fi

info ""
info "Edgelet has been uninstalled."
EDGELET_UNINSTALL_EOF
    chmod 755 "$_dest"
}
# ASSEMBLE:UNINSTALL_END


BACKUP_DIR="/var/backups/edgelet"
CACHE_DIR="${BACKUP_DIR}/cache"
RECEIPT_FILE="${BACKUP_DIR}/install-receipt"
PREVIOUS_FILE="${BACKUP_DIR}/previous-release"
GITHUB_REPO="${EDGELET_GITHUB_REPO:-eclipse-iofog/edgelet}"
SHARE_DIR="/usr/share/edgelet"
UNIT_NAME="edgelet"
CONFIG_DIR="/etc/edgelet"
CONFIG_FILE="${CONFIG_DIR}/config.yaml"
CERT_FILE="${CONFIG_DIR}/cert.crt"

windows_program_data_edgelet() {
    echo "${ProgramData:-/c/ProgramData}/Edgelet"
}

init_platform_paths() {
    _os="$1"
    case "${_os}" in
        linux)
            SHARE_DIR="/usr/share/edgelet"
            CONFIG_DIR="/etc/edgelet"
            ;;
        darwin)
            SHARE_DIR="/usr/local/share/edgelet"
            CONFIG_DIR="/etc/edgelet"
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            SHARE_DIR="${_pd}/scripts"
            CONFIG_DIR="${_pd}/config"
            ;;
        *) die "Unsupported OS for platform paths: ${_os}" ;;
    esac
    CONFIG_FILE="${CONFIG_DIR}/config.yaml"
    CERT_FILE="${CONFIG_DIR}/cert.crt"
}

detect_os() {
    _u=$(uname -s)
    case "${_u}" in
        Linux)  echo "linux" ;;
        Darwin) echo "darwin" ;;
        MINGW*|MSYS*|CYGWIN*|Windows_NT) echo "windows" ;;
        *) die "Unsupported OS: ${_u}" ;;
    esac
}

detect_arch() {
    MACHINE=$(uname -m)
    case "${MACHINE}" in
        x86_64|amd64)     echo "amd64" ;;
        aarch64|arm64)    echo "arm64" ;;
        armv7l|armv6l|arm) echo "arm" ;;
        riscv64)          echo "riscv64" ;;
        *) die "Unsupported architecture: ${MACHINE}" ;;
    esac
}

require_root() {
    OS=$(detect_os)
    if [ "$OS" = "windows" ]; then
        return 0
    fi
    [ "$(id -u)" -eq 0 ] || die "This script must be run as root. Try: sudo $0 $*"
}

binary_basename() {
    _os="$1" _arch="$2"
    case "${_os}" in
        windows) echo "edgelet-${_os}-${_arch}.exe" ;;
        *)       echo "edgelet-${_os}-${_arch}" ;;
    esac
}

binary_install_path() {
    _os="$1"
    case "${_os}" in
        linux|darwin) echo "/usr/local/bin/edgelet" ;;
        windows)
            _pf="${ProgramFiles:-/c/Program Files}"
            echo "${_pf}/Edgelet/edgelet.exe"
            ;;
        *) die "Unsupported OS for binary path" ;;
    esac
}

release_download_url() {
    _ver="$1" _os="$2" _arch="$3"
    _base="https://github.com/${GITHUB_REPO}/releases/download/${_ver}/$(binary_basename "$_os" "$_arch")"
    echo "$_base"
}

verify_binary_checksum() {
    _bin="$1"
    [ -f "$_bin" ] || die "Not a file: $_bin"
    if [ -n "$EXPECTED_SHA256" ]; then
        _sum=$(sha256sum "$_bin" | awk '{print $1}')
        [ "$_sum" = "$EXPECTED_SHA256" ] || die "SHA256 mismatch (expected $EXPECTED_SHA256 got $_sum)"
        info "SHA256 verified."
    elif [ -n "$CHECKSUM_FILE" ] && [ -f "$CHECKSUM_FILE" ]; then
        _bn=$(basename "$_bin")
        ( cd "$(dirname "$_bin")" && grep " ${_bn}\$" "$CHECKSUM_FILE" >/dev/null ) || \
            ( cd "$(dirname "$CHECKSUM_FILE")" && sha256sum -c "$CHECKSUM_FILE" ) || \
            die "Checksum file verification failed"
    fi
}

sha256_file() {
    sha256sum "$1" | awk '{print $1}'
}

kv_get() {
    _file="$1" _key="$2"
    [ -f "$_file" ] || { echo ""; return 0; }
    _line=$(grep "^${_key}=" "$_file" | head -1) || true
    [ -n "$_line" ] || { echo ""; return 0; }
    echo "$_line" | sed "s/^${_key}=//"
}

write_install_receipt() {
    _ver="$1" _os="$2" _arch="$3" _eng="$4" _url="$5" _sha="$6" _method="$7"
    mkdir -p "$BACKUP_DIR"
    _ts=$(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || date -u)
    {
        printf 'installed_version=%s\n' "$_ver"
        printf 'os=%s\n' "$_os"
        printf 'arch=%s\n' "$_arch"
        printf 'container_engine=%s\n' "$_eng"
        printf 'source_url=%s\n' "$_url"
        printf 'installed_at=%s\n' "$_ts"
        printf 'install_method=%s\n' "$_method"
        printf 'binary_sha256=%s\n' "$_sha"
    } >"$RECEIPT_FILE"
    chmod 600 "$RECEIPT_FILE" 2>/dev/null || true
}

write_previous_release() {
    _pv="$1" _pos="$2" _parch="$3" _peng="$4" _purl="$5" _psha="$6" _cfg="$7"
    mkdir -p "$BACKUP_DIR"
    {
        printf 'previous_version=%s\n' "$_pv"
        printf 'previous_os=%s\n' "$_pos"
        printf 'previous_arch=%s\n' "$_parch"
        printf 'previous_container_engine=%s\n' "$_peng"
        printf 'previous_download_url=%s\n' "$_purl"
        printf 'previous_binary_sha256=%s\n' "$_psha"
        printf 'config_backup_path=%s\n' "$_cfg"
    } >"$PREVIOUS_FILE"
    chmod 600 "$PREVIOUS_FILE" 2>/dev/null || true
}

cache_binary() {
    _ver="$1" _os="$2" _arch="$3" _src="$4"
    mkdir -p "$CACHE_DIR"
    _dest="${CACHE_DIR}/edgelet-${_ver}-${_os}-${_arch}"
    case "${_os}" in
        windows) _dest="${_dest}.exe" ;;
    esac
    cp "$_src" "$_dest"
    chmod 755 "$_dest" 2>/dev/null || true
    info "Cached binary at ${_dest}"
}

cached_binary_path() {
    _ver="$1" _os="$2" _arch="$3"
    _p="${CACHE_DIR}/edgelet-${_ver}-${_os}-${_arch}"
    case "${_os}" in
        windows) _p="${_p}.exe" ;;
    esac
    if [ -f "$_p" ]; then
        echo "$_p"
        return 0
    fi
    echo ""
}

packaging_etc_dir() {
    if [ -d "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet" ]; then
        echo "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet"
        return 0
    fi
    if [ -d "${SHARE_DIR}/etc/edgelet" ]; then
        echo "${SHARE_DIR}/etc/edgelet"
        return 0
    fi
    echo ""
}

install_config_samples() {
    _etc="$(packaging_etc_dir)"
    _sample_cfg=""
    _sample_ca=""
    if [ -n "$_etc" ]; then
        [ -f "${_etc}/config.default.yaml" ] && _sample_cfg="${_etc}/config.default.yaml"
        [ -f "${_etc}/controller-ca.sample.crt" ] && _sample_ca="${_etc}/controller-ca.sample.crt"
    fi
    if [ -f "${SHARE_DIR}/edgelet-config.yaml.sample" ]; then
        _sample_cfg="${SHARE_DIR}/edgelet-config.yaml.sample"
    fi
    if [ -f "${SHARE_DIR}/edgelet-controller-ca.crt.sample" ]; then
        _sample_ca="${SHARE_DIR}/edgelet-controller-ca.crt.sample"
    fi

    if [ ! -f "$CONFIG_FILE" ]; then
        if [ -n "$_sample_cfg" ]; then
            mkdir -p "$CONFIG_DIR"
            install -m 640 "$_sample_cfg" "$CONFIG_FILE"
            info "Config installed from sample."
        else
            write_default_config_if_missing
        fi
    elif [ "$FORCE_CONFIG" = true ]; then
        [ -n "$_sample_cfg" ] || die "--force-config requires a config sample"
        install -m 640 "$_sample_cfg" "$CONFIG_FILE"
        info "Config replaced (--force-config)."
    else
        info "Existing config preserved at ${CONFIG_FILE}"
    fi

    if [ "$WITH_SAMPLE_CA" = true ] && [ ! -f "$CERT_FILE" ]; then
        [ -n "$_sample_ca" ] || die "--with-sample-ca requires controller-ca sample"
        install -m 644 "$_sample_ca" "$CERT_FILE"
        info "Sample controller CA installed at ${CERT_FILE}"
    fi
}

default_container_engine_for_os() {
    case "$1" in
        linux) echo "edgelet" ;;
        *)     echo "docker" ;;
    esac
}

default_container_engine_url_for_engine() {
    _eng="$1"
    _os="${2:-linux}"
    case "${_eng}" in
        docker) echo "unix:///var/run/docker.sock" ;;
        podman) echo "unix:///run/podman/podman.sock" ;;
        edgelet) echo "unix:///run/edgelet/containerd.sock" ;;
        *) die "Unsupported engine: ${_eng}" ;;
    esac
}

default_data_dir_for_os() {
    case "$1" in
        windows) echo "$(windows_program_data_edgelet)/data/" ;;
        *)       echo "/var/lib/edgelet/" ;;
    esac
}

default_log_dir_for_os() {
    case "$1" in
        windows) echo "$(windows_program_data_edgelet)/log/" ;;
        *)       echo "/var/log/edgelet/" ;;
    esac
}

write_default_config_if_missing() {
    [ -f "$CONFIG_FILE" ] && return 0
    _eng="${CONTAINER_ENGINE}"
    if [ -z "$_eng" ]; then
        _eng=$(default_container_engine_for_os "$OS")
    fi
    _du=$(default_container_engine_url_for_engine "$_eng" "$OS")
    _disk=$(default_data_dir_for_os "$OS")
    _log_disk=$(default_log_dir_for_os "$OS")
    mkdir -p "$CONFIG_DIR"
    cat >"$CONFIG_FILE" <<YAML
currentProfile: production
profiles:
  production:
    controllerUrl: "http://localhost:54421/api/v3/"
    controllerCert: "${CERT_FILE}"
    arch: auto
    containerEngine: ${_eng}
    containerEngineUrl: ${_du}
    diskDirectory: ${_disk}
    logDirectory: ${_log_disk}
    logLevel: INFO
YAML
    chmod 640 "$CONFIG_FILE"
    info "Default config installed at ${CONFIG_FILE}"
}

stop_edgelet_daemon_desktop() {
    _os="$1"
    case "${_os}" in
        darwin|windows) ;;
        *) return 0 ;;
    esac
    if pgrep -f '[e]dgelet daemon' >/dev/null 2>&1; then
        pkill -f '[e]dgelet daemon' 2>/dev/null || true
        sleep 1
        info "edgelet daemon stopped."
    fi
    case "${_os}" in
        darwin) rm -f /var/run/edgelet/edgelet.pid ;;
        windows) rm -f "$(windows_program_data_edgelet)/run/edgelet.pid" ;;
    esac
}

start_edgelet_daemon_desktop() {
    _os="$1"
    _log_dir="/var/log/edgelet"
    _pid_file="/var/run/edgelet/edgelet.pid"
    case "${_os}" in
        darwin)
            mkdir -p "$_log_dir" /var/run/edgelet
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            _log_dir="${_pd}/log"
            _pid_file="${_pd}/run/edgelet.pid"
            mkdir -p "$_log_dir" "$(dirname "$_pid_file")"
            ;;
        *) return 0 ;;
    esac

    if pgrep -f '[e]dgelet daemon' >/dev/null 2>&1; then
        info "edgelet daemon already running"
        return 0
    fi

    nohup edgelet daemon &
    echo $! > "$_pid_file"
    info "edgelet daemon started in background (pid=$(cat "$_pid_file"))"
    info "  logs: ${_log_dir}/edgelet.0.log"
}

install_dirs() {
    OS="$1"
    case "${OS}" in
        linux)
            mkdir -p "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet /run/edgelet \
                /var/lib/edgelet-containerd "$BACKUP_DIR" "$CACHE_DIR" "$SHARE_DIR"
            chmod 750 "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet 2>/dev/null || true
            ;;
        darwin)
            mkdir -p "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet /var/run/edgelet \
                "$BACKUP_DIR" "$CACHE_DIR" "$SHARE_DIR"
            chmod 750 "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet 2>/dev/null || true
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            mkdir -p "${_pd}/data" "${_pd}/config" "${_pd}/run" "${_pd}/log" "${_pd}/scripts" 2>/dev/null || true
            ;;
    esac
}

install_script_to_share() {
    _dest="${SHARE_DIR}/install.sh"
    if [ -f "${SCRIPT_DIR}/install.sh" ]; then
        if [ "${SCRIPT_DIR}/install.sh" -ef "$_dest" ] 2>/dev/null \
            || [ "${SCRIPT_DIR}/install.sh" = "$_dest" ]; then
            return 0
        fi
        install -m 755 "${SCRIPT_DIR}/install.sh" "$_dest"
        return 0
    fi
    case "$0" in
        */install.sh)
            if [ -f "$0" ]; then
                if [ "$0" -ef "$_dest" ] 2>/dev/null || [ "$0" = "$_dest" ]; then
                    return 0
                fi
                install -m 755 "$0" "$_dest"
                return 0
            fi
            ;;
    esac
    write_embedded_install "$_dest"
}

uninstall_script_to_share() {
    _dest="${SHARE_DIR}/uninstall.sh"
    if [ -f "${SCRIPT_DIR}/uninstall.sh" ]; then
        if [ "${SCRIPT_DIR}/uninstall.sh" -ef "$_dest" ] 2>/dev/null \
            || [ "${SCRIPT_DIR}/uninstall.sh" = "$_dest" ]; then
            return 0
        fi
        install -m 755 "${SCRIPT_DIR}/uninstall.sh" "$_dest"
        return 0
    fi
    write_embedded_uninstall "$_dest"
}

copy_bundled_scripts() {
    OS="$1"
    mkdir -p "$SHARE_DIR"
    install_script_to_share
    uninstall_script_to_share
    if [ -d "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet" ]; then
        mkdir -p "${SHARE_DIR}/etc/edgelet"
        for _f in config.default.yaml controller-ca.sample.crt; do
            [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/${_f}" ] && \
                cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/${_f}" "${SHARE_DIR}/etc/edgelet/${_f}" 2>/dev/null || true
        done
        [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/config.default.yaml" ] && \
            cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/config.default.yaml" \
                "${SHARE_DIR}/edgelet-config.yaml.sample"
        [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/controller-ca.sample.crt" ] && \
            cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/controller-ca.sample.crt" \
                "${SHARE_DIR}/edgelet-controller-ca.crt.sample"
    fi
    info "Bundled install scripts at ${SHARE_DIR}/"
}

install_binary_file() {
    _src="$1" _dest="$2"
    _dir=$(dirname "$_dest")
    mkdir -p "$_dir"
    install -m 755 "$_src" "$_dest"
    info "Installed ${_dest}"
}

install_cli_completion() {
    command -v edgelet >/dev/null 2>&1 || return 0
    if [ -d /etc/bash_completion.d ]; then
        if edgelet completion bash >/etc/bash_completion.d/edgelet 2>/dev/null; then
            chmod 644 /etc/bash_completion.d/edgelet
            info "Bash completion installed."
        fi
    fi
}

apply_container_engine_to_config() {
    [ -f "$CONFIG_FILE" ] || return 0
    command -v sed >/dev/null 2>&1 || return 0
    sed -i "s|containerEngine:.*|containerEngine: ${CONTAINER_ENGINE}|" "$CONFIG_FILE" 2>/dev/null || true
    _durl=$(default_container_engine_url_for_engine "$CONTAINER_ENGINE" "$OS")
    sed -i "s|containerEngineUrl:.*|containerEngineUrl: ${_durl}|" "$CONFIG_FILE" 2>/dev/null || true
}

download_or_stage_binary() {
    _dest="$1"
    if [ -n "$BIN_PATH" ]; then
        [ -f "$BIN_PATH" ] || die "Local binary not found: $BIN_PATH"
        verify_binary_checksum "$BIN_PATH"
        cp "$BIN_PATH" "$_dest"
        info "Using local binary: ${BIN_PATH}"
        return 0
    fi
    if [ "$AIRGAP" = true ]; then
        die "--airgap requires --bin-path"
    fi
    _url=$(release_download_url "$EDGELET_VERSION" "$OS" "$ARCH")
    info "Downloading ${_url} ..."
    curl -fsSL -o "$_dest" "$_url" || die "Failed to download release binary"
}

compute_source_url() {
    if [ -n "$BIN_PATH" ]; then
        _real=$(cd "$(dirname "$BIN_PATH")" && pwd)/$(basename "$BIN_PATH")
        echo "file://${_real}"
    else
        release_download_url "$EDGELET_VERSION" "$OS" "$ARCH"
    fi
}

# ── main ──────────────────────────────────────────────────────────────────────
OS=$(detect_os)
init_platform_paths "$OS"
ARCH="${ARCH_OVERRIDE:-$(detect_arch)}"
BINARY_PATH=$(binary_install_path "$OS")

if [ "$OS" = "linux" ]; then
    INIT=$(detect_init)
else
    INIT="none"
fi

if [ "$ACTION" != "rollback" ]; then
    if [ -z "$CONTAINER_ENGINE" ]; then
        CONTAINER_ENGINE=$(default_container_engine_for_os "$OS")
    fi
    case "$CONTAINER_ENGINE" in
        edgelet)
            [ "$OS" = "linux" ] || die "containerEngine=edgelet is linux-only"
            ;;
        docker|podman) ;;
        *) die "Invalid --container-engine (use edgelet, docker, or podman)" ;;
    esac
fi

require_root

info "OS           : ${OS}"
info "Architecture : ${ARCH}"
info "Init system  : ${INIT}"
if [ "$ACTION" != "rollback" ]; then
    info "Engine       : ${CONTAINER_ENGINE}"
fi
info "Action       : ${ACTION}"

TMPDIR=$(mktemp -d)
trap 'rm -rf "${TMPDIR}"' EXIT

if [ "$AIRGAP" = false ] && [ "$EDGELET_VERSION" = "latest" ] && [ "$ACTION" != "rollback" ] && [ -z "$BIN_PATH" ]; then
    info "Fetching latest release tag..."
    EDGELET_VERSION=$(curl -fsSL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" \
        | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    [ -n "${EDGELET_VERSION}" ] || die "Failed to determine latest version"
fi

info "Version: ${EDGELET_VERSION}"

# ── rollback ──────────────────────────────────────────────────────────────────
if [ "$ACTION" = "rollback" ]; then
    [ -f "$PREVIOUS_FILE" ] || die "No ${PREVIOUS_FILE} found."
    _pv=$(kv_get "$PREVIOUS_FILE" "previous_version")
    _pos=$(kv_get "$PREVIOUS_FILE" "previous_os")
    _parch=$(kv_get "$PREVIOUS_FILE" "previous_arch")
    _peng=$(kv_get "$PREVIOUS_FILE" "previous_container_engine")
    _purl=$(kv_get "$PREVIOUS_FILE" "previous_download_url")
    _cfgbak=$(kv_get "$PREVIOUS_FILE" "config_backup_path")
    [ -n "$_pos" ] || _pos="$OS"
    [ -n "$_parch" ] || _parch="$ARCH"
    CONTAINER_ENGINE="${_peng:-edgelet}"
    EDGELET_VERSION="$_pv"
    _staged="${TMPDIR}/edgelet-bin"
    _cached=$(cached_binary_path "$_pv" "$_pos" "$_parch")
    if [ -n "$_cached" ]; then
        cp "$_cached" "$_staged"
        info "Rollback from cache: ${_cached}"
    elif [ -n "$BIN_PATH" ]; then
        verify_binary_checksum "$BIN_PATH"
        cp "$BIN_PATH" "$_staged"
    elif [ "$AIRGAP" = true ]; then
        die "rollback with --airgap requires --bin-path or a cached binary"
    else
        curl -fsSL -o "$_staged" "$_purl" || die "Failed to download rollback binary"
    fi
    _old_embed=""
    if [ "$OS" = "linux" ]; then
        _old_embed=$(installed_embed_hash)
    fi
    [ "$OS" = "linux" ] && stop_edgelet_service "$INIT"
    install_binary_file "$_staged" "$BINARY_PATH"
    install_dirs "$OS"
    if [ "$FORCE_CONFIG" != true ] && [ -f "$_cfgbak" ]; then
        install -m 640 "$_cfgbak" "$CONFIG_FILE"
    fi
    _restart_dp=false
    if [ "$OS" = "linux" ]; then
        _new_embed=$(binary_embed_hash "$BINARY_PATH")
        if should_restart_data_plane "$CONTAINER_ENGINE" "$_old_embed" "$_new_embed"; then
            _restart_dp=true
            info "Embed hash: ${_old_embed:-<none>} -> ${_new_embed}; data-plane restart required"
        fi
    fi
    if [ "$OS" = "linux" ]; then
        install_init_unit "$INIT" "$CONTAINER_ENGINE" "$_restart_dp"
    fi
    _sha=$(sha256_file "$BINARY_PATH")
    write_install_receipt "$EDGELET_VERSION" "$_pos" "$_parch" "$CONTAINER_ENGINE" "$_purl" "$_sha" "rollback"
    info "Rollback to ${EDGELET_VERSION} complete."
    exit 0
fi

# ── upgrade ───────────────────────────────────────────────────────────────────
if [ "$ACTION" = "upgrade" ]; then
    [ -f "$BINARY_PATH" ] || die "Edgelet not installed; run install first"
    [ -f "$RECEIPT_FILE" ] || die "Missing ${RECEIPT_FILE}"
    _cur_ver=$(kv_get "$RECEIPT_FILE" "installed_version")
    _cur_os=$(kv_get "$RECEIPT_FILE" "os")
    _cur_arch=$(kv_get "$RECEIPT_FILE" "arch")
    _cur_eng=$(kv_get "$RECEIPT_FILE" "container_engine")
    _cur_src=$(kv_get "$RECEIPT_FILE" "source_url")
    _cur_sha=$(kv_get "$RECEIPT_FILE" "binary_sha256")
    [ -n "$_cur_os" ] || _cur_os="$OS"
    [ -n "$_cur_arch" ] || _cur_arch="$ARCH"
    [ -n "$_cur_eng" ] || _cur_eng="$CONTAINER_ENGINE"
    if [ "$EDGELET_VERSION" = "latest" ] && [ -z "$BIN_PATH" ]; then
        EDGELET_VERSION=$(curl -fsSL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" \
            | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    fi
    _cfg_backup="${BACKUP_DIR}/config.yaml.$(date +%Y%m%d%H%M%S 2>/dev/null || date +%s)"
    cp "$CONFIG_FILE" "$_cfg_backup" 2>/dev/null || true
    _old_embed=""
    if [ "$OS" = "linux" ]; then
        _old_embed=$(installed_embed_hash)
    fi
    cache_binary "$_cur_ver" "$_cur_os" "$_cur_arch" "$BINARY_PATH"
    write_previous_release "$_cur_ver" "$_cur_os" "$_cur_arch" "$_cur_eng" "$_cur_src" "$_cur_sha" "$_cfg_backup"
    [ "$OS" = "linux" ] && stop_edgelet_service "$INIT"
    stop_edgelet_daemon_desktop "$OS"
    _staged="${TMPDIR}/edgelet-bin"
    download_or_stage_binary "$_staged"
    verify_binary_checksum "$_staged"
    install_binary_file "$_staged" "$BINARY_PATH"
    install_dirs "$OS"
    if [ "$FORCE_CONFIG" = true ]; then
        rm -f "$CONFIG_FILE"
        install_config_samples
    fi
    apply_container_engine_to_config
    _sha=$(sha256_file "$BINARY_PATH")
    _method="upgrade"
    [ "$AIRGAP" = true ] && _method="upgrade-airgap"
    write_install_receipt "$EDGELET_VERSION" "$OS" "$ARCH" "$CONTAINER_ENGINE" "$(compute_source_url)" "$_sha" "$_method"
    copy_bundled_scripts "$OS"
    _restart_dp=false
    if [ "$OS" = "linux" ]; then
        _new_embed=$(binary_embed_hash "$BINARY_PATH")
        if should_restart_data_plane "$CONTAINER_ENGINE" "$_old_embed" "$_new_embed"; then
            _restart_dp=true
            info "Embed hash: ${_old_embed:-<none>} -> ${_new_embed}; data-plane restart required"
        fi
    fi
    if [ "$OS" = "linux" ]; then
        install_init_unit "$INIT" "$CONTAINER_ENGINE" "$_restart_dp"
    else
        start_edgelet_daemon_desktop "$OS"
    fi
    info "Upgrade to ${EDGELET_VERSION} complete."
    exit 0
fi

# ── fresh install ─────────────────────────────────────────────────────────────
_staged="${TMPDIR}/edgelet-bin"
download_or_stage_binary "$_staged"
verify_binary_checksum "$_staged"
install_dirs "$OS"
install_binary_file "$_staged" "$BINARY_PATH"
install_config_samples
apply_container_engine_to_config
_sha=$(sha256_file "$BINARY_PATH")
_method="install"
[ "$AIRGAP" = true ] && _method="install-airgap"
write_install_receipt "$EDGELET_VERSION" "$OS" "$ARCH" "$CONTAINER_ENGINE" "$(compute_source_url)" "$_sha" "$_method"
copy_bundled_scripts "$OS"
if [ "$OS" = "linux" ]; then
    install_init_unit "$INIT" "$CONTAINER_ENGINE"
    install_cli_completion
else
    start_edgelet_daemon_desktop "$OS"
fi

info ""
info "edgelet ${EDGELET_VERSION} installed (os=${OS} engine=${CONTAINER_ENGINE})."
info "  Binary : ${BINARY_PATH}"
case "$OS" in
    linux)
        info "  Unit   : ${INIT}"
        info "  Config : ${CONFIG_FILE}"
        info "  Data   : /var/lib/edgelet/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
    darwin)
        info "  Config : ${CONFIG_FILE}"
        info "  Data   : /var/lib/edgelet/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
    windows)
        info "  Config : ${CONFIG_FILE}"
        _pd=$(windows_program_data_edgelet)
        info "  Data   : ${_pd}/data/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
esac
info ""
info "Check status: edgelet system status"
info "Configure Controller: edgelet config --a <controller-api-endpoint>"
info "Provision:    edgelet provision <key>"
EDGELET_INSTALL_SELF_EOF
    chmod 755 "$_dest"
}
# ASSEMBLE:INSTALL_SELF_END

BACKUP_DIR="/var/backups/edgelet"
CACHE_DIR="${BACKUP_DIR}/cache"
RECEIPT_FILE="${BACKUP_DIR}/install-receipt"
PREVIOUS_FILE="${BACKUP_DIR}/previous-release"
GITHUB_REPO="${EDGELET_GITHUB_REPO:-eclipse-iofog/edgelet}"
SHARE_DIR="/usr/share/edgelet"
UNIT_NAME="edgelet"
CONFIG_DIR="/etc/edgelet"
CONFIG_FILE="${CONFIG_DIR}/config.yaml"
CERT_FILE="${CONFIG_DIR}/cert.crt"

windows_program_data_edgelet() {
    echo "${ProgramData:-/c/ProgramData}/Edgelet"
}

init_platform_paths() {
    _os="$1"
    case "${_os}" in
        linux)
            SHARE_DIR="/usr/share/edgelet"
            CONFIG_DIR="/etc/edgelet"
            ;;
        darwin)
            SHARE_DIR="/usr/local/share/edgelet"
            CONFIG_DIR="/etc/edgelet"
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            SHARE_DIR="${_pd}/scripts"
            CONFIG_DIR="${_pd}/config"
            ;;
        *) die "Unsupported OS for platform paths: ${_os}" ;;
    esac
    CONFIG_FILE="${CONFIG_DIR}/config.yaml"
    CERT_FILE="${CONFIG_DIR}/cert.crt"
}

detect_os() {
    _u=$(uname -s)
    case "${_u}" in
        Linux)  echo "linux" ;;
        Darwin) echo "darwin" ;;
        MINGW*|MSYS*|CYGWIN*|Windows_NT) echo "windows" ;;
        *) die "Unsupported OS: ${_u}" ;;
    esac
}

detect_arch() {
    MACHINE=$(uname -m)
    case "${MACHINE}" in
        x86_64|amd64)     echo "amd64" ;;
        aarch64|arm64)    echo "arm64" ;;
        armv7l|armv6l|arm) echo "arm" ;;
        riscv64)          echo "riscv64" ;;
        *) die "Unsupported architecture: ${MACHINE}" ;;
    esac
}

require_root() {
    OS=$(detect_os)
    if [ "$OS" = "windows" ]; then
        return 0
    fi
    [ "$(id -u)" -eq 0 ] || die "This script must be run as root. Try: sudo $0 $*"
}

binary_basename() {
    _os="$1" _arch="$2"
    case "${_os}" in
        windows) echo "edgelet-${_os}-${_arch}.exe" ;;
        *)       echo "edgelet-${_os}-${_arch}" ;;
    esac
}

binary_install_path() {
    _os="$1"
    case "${_os}" in
        linux|darwin) echo "/usr/local/bin/edgelet" ;;
        windows)
            _pf="${ProgramFiles:-/c/Program Files}"
            echo "${_pf}/Edgelet/edgelet.exe"
            ;;
        *) die "Unsupported OS for binary path" ;;
    esac
}

release_download_url() {
    _ver="$1" _os="$2" _arch="$3"
    _base="https://github.com/${GITHUB_REPO}/releases/download/${_ver}/$(binary_basename "$_os" "$_arch")"
    echo "$_base"
}

verify_binary_checksum() {
    _bin="$1"
    [ -f "$_bin" ] || die "Not a file: $_bin"
    if [ -n "$EXPECTED_SHA256" ]; then
        _sum=$(sha256sum "$_bin" | awk '{print $1}')
        [ "$_sum" = "$EXPECTED_SHA256" ] || die "SHA256 mismatch (expected $EXPECTED_SHA256 got $_sum)"
        info "SHA256 verified."
    elif [ -n "$CHECKSUM_FILE" ] && [ -f "$CHECKSUM_FILE" ]; then
        _bn=$(basename "$_bin")
        ( cd "$(dirname "$_bin")" && grep " ${_bn}\$" "$CHECKSUM_FILE" >/dev/null ) || \
            ( cd "$(dirname "$CHECKSUM_FILE")" && sha256sum -c "$CHECKSUM_FILE" ) || \
            die "Checksum file verification failed"
    fi
}

sha256_file() {
    sha256sum "$1" | awk '{print $1}'
}

kv_get() {
    _file="$1" _key="$2"
    [ -f "$_file" ] || { echo ""; return 0; }
    _line=$(grep "^${_key}=" "$_file" | head -1) || true
    [ -n "$_line" ] || { echo ""; return 0; }
    echo "$_line" | sed "s/^${_key}=//"
}

write_install_receipt() {
    _ver="$1" _os="$2" _arch="$3" _eng="$4" _url="$5" _sha="$6" _method="$7"
    mkdir -p "$BACKUP_DIR"
    _ts=$(date -u '+%Y-%m-%dT%H:%M:%SZ' 2>/dev/null || date -u)
    {
        printf 'installed_version=%s\n' "$_ver"
        printf 'os=%s\n' "$_os"
        printf 'arch=%s\n' "$_arch"
        printf 'container_engine=%s\n' "$_eng"
        printf 'source_url=%s\n' "$_url"
        printf 'installed_at=%s\n' "$_ts"
        printf 'install_method=%s\n' "$_method"
        printf 'binary_sha256=%s\n' "$_sha"
    } >"$RECEIPT_FILE"
    chmod 600 "$RECEIPT_FILE" 2>/dev/null || true
}

write_previous_release() {
    _pv="$1" _pos="$2" _parch="$3" _peng="$4" _purl="$5" _psha="$6" _cfg="$7"
    mkdir -p "$BACKUP_DIR"
    {
        printf 'previous_version=%s\n' "$_pv"
        printf 'previous_os=%s\n' "$_pos"
        printf 'previous_arch=%s\n' "$_parch"
        printf 'previous_container_engine=%s\n' "$_peng"
        printf 'previous_download_url=%s\n' "$_purl"
        printf 'previous_binary_sha256=%s\n' "$_psha"
        printf 'config_backup_path=%s\n' "$_cfg"
    } >"$PREVIOUS_FILE"
    chmod 600 "$PREVIOUS_FILE" 2>/dev/null || true
}

cache_binary() {
    _ver="$1" _os="$2" _arch="$3" _src="$4"
    mkdir -p "$CACHE_DIR"
    _dest="${CACHE_DIR}/edgelet-${_ver}-${_os}-${_arch}"
    case "${_os}" in
        windows) _dest="${_dest}.exe" ;;
    esac
    cp "$_src" "$_dest"
    chmod 755 "$_dest" 2>/dev/null || true
    info "Cached binary at ${_dest}"
}

cached_binary_path() {
    _ver="$1" _os="$2" _arch="$3"
    _p="${CACHE_DIR}/edgelet-${_ver}-${_os}-${_arch}"
    case "${_os}" in
        windows) _p="${_p}.exe" ;;
    esac
    if [ -f "$_p" ]; then
        echo "$_p"
        return 0
    fi
    echo ""
}

packaging_etc_dir() {
    if [ -d "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet" ]; then
        echo "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet"
        return 0
    fi
    if [ -d "${SHARE_DIR}/etc/edgelet" ]; then
        echo "${SHARE_DIR}/etc/edgelet"
        return 0
    fi
    echo ""
}

install_config_samples() {
    _etc="$(packaging_etc_dir)"
    _sample_cfg=""
    _sample_ca=""
    if [ -n "$_etc" ]; then
        [ -f "${_etc}/config.default.yaml" ] && _sample_cfg="${_etc}/config.default.yaml"
        [ -f "${_etc}/controller-ca.sample.crt" ] && _sample_ca="${_etc}/controller-ca.sample.crt"
    fi
    if [ -f "${SHARE_DIR}/edgelet-config.yaml.sample" ]; then
        _sample_cfg="${SHARE_DIR}/edgelet-config.yaml.sample"
    fi
    if [ -f "${SHARE_DIR}/edgelet-controller-ca.crt.sample" ]; then
        _sample_ca="${SHARE_DIR}/edgelet-controller-ca.crt.sample"
    fi

    if [ ! -f "$CONFIG_FILE" ]; then
        if [ -n "$_sample_cfg" ]; then
            mkdir -p "$CONFIG_DIR"
            install -m 640 "$_sample_cfg" "$CONFIG_FILE"
            info "Config installed from sample."
        else
            write_default_config_if_missing
        fi
    elif [ "$FORCE_CONFIG" = true ]; then
        [ -n "$_sample_cfg" ] || die "--force-config requires a config sample"
        install -m 640 "$_sample_cfg" "$CONFIG_FILE"
        info "Config replaced (--force-config)."
    else
        info "Existing config preserved at ${CONFIG_FILE}"
    fi

    if [ "$WITH_SAMPLE_CA" = true ] && [ ! -f "$CERT_FILE" ]; then
        [ -n "$_sample_ca" ] || die "--with-sample-ca requires controller-ca sample"
        install -m 644 "$_sample_ca" "$CERT_FILE"
        info "Sample controller CA installed at ${CERT_FILE}"
    fi
}

default_container_engine_for_os() {
    case "$1" in
        linux) echo "edgelet" ;;
        *)     echo "docker" ;;
    esac
}

default_container_engine_url_for_engine() {
    _eng="$1"
    _os="${2:-linux}"
    case "${_eng}" in
        docker) echo "unix:///var/run/docker.sock" ;;
        podman) echo "unix:///run/podman/podman.sock" ;;
        edgelet) echo "unix:///run/edgelet/containerd.sock" ;;
        *) die "Unsupported engine: ${_eng}" ;;
    esac
}

default_data_dir_for_os() {
    case "$1" in
        windows) echo "$(windows_program_data_edgelet)/data/" ;;
        *)       echo "/var/lib/edgelet/" ;;
    esac
}

default_log_dir_for_os() {
    case "$1" in
        windows) echo "$(windows_program_data_edgelet)/log/" ;;
        *)       echo "/var/log/edgelet/" ;;
    esac
}

write_default_config_if_missing() {
    [ -f "$CONFIG_FILE" ] && return 0
    _eng="${CONTAINER_ENGINE}"
    if [ -z "$_eng" ]; then
        _eng=$(default_container_engine_for_os "$OS")
    fi
    _du=$(default_container_engine_url_for_engine "$_eng" "$OS")
    _disk=$(default_data_dir_for_os "$OS")
    _log_disk=$(default_log_dir_for_os "$OS")
    mkdir -p "$CONFIG_DIR"
    cat >"$CONFIG_FILE" <<YAML
currentProfile: production
profiles:
  production:
    controllerUrl: "http://localhost:54421/api/v3/"
    controllerCert: "${CERT_FILE}"
    arch: auto
    containerEngine: ${_eng}
    containerEngineUrl: ${_du}
    diskDirectory: ${_disk}
    logDirectory: ${_log_disk}
    logLevel: INFO
YAML
    chmod 640 "$CONFIG_FILE"
    info "Default config installed at ${CONFIG_FILE}"
}

stop_edgelet_daemon_desktop() {
    _os="$1"
    case "${_os}" in
        darwin|windows) ;;
        *) return 0 ;;
    esac
    if pgrep -f '[e]dgelet daemon' >/dev/null 2>&1; then
        pkill -f '[e]dgelet daemon' 2>/dev/null || true
        sleep 1
        info "edgelet daemon stopped."
    fi
    case "${_os}" in
        darwin) rm -f /var/run/edgelet/edgelet.pid ;;
        windows) rm -f "$(windows_program_data_edgelet)/run/edgelet.pid" ;;
    esac
}

start_edgelet_daemon_desktop() {
    _os="$1"
    _log_dir="/var/log/edgelet"
    _pid_file="/var/run/edgelet/edgelet.pid"
    case "${_os}" in
        darwin)
            mkdir -p "$_log_dir" /var/run/edgelet
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            _log_dir="${_pd}/log"
            _pid_file="${_pd}/run/edgelet.pid"
            mkdir -p "$_log_dir" "$(dirname "$_pid_file")"
            ;;
        *) return 0 ;;
    esac

    if pgrep -f '[e]dgelet daemon' >/dev/null 2>&1; then
        info "edgelet daemon already running"
        return 0
    fi

    nohup edgelet daemon &
    echo $! > "$_pid_file"
    info "edgelet daemon started in background (pid=$(cat "$_pid_file"))"
    info "  logs: ${_log_dir}/edgelet.0.log"
}

install_dirs() {
    OS="$1"
    case "${OS}" in
        linux)
            mkdir -p "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet /run/edgelet \
                /var/lib/edgelet-containerd "$BACKUP_DIR" "$CACHE_DIR" "$SHARE_DIR"
            chmod 750 "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet 2>/dev/null || true
            ;;
        darwin)
            mkdir -p "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet /var/run/edgelet \
                "$BACKUP_DIR" "$CACHE_DIR" "$SHARE_DIR"
            chmod 750 "$CONFIG_DIR" /var/log/edgelet /var/lib/edgelet 2>/dev/null || true
            ;;
        windows)
            _pd=$(windows_program_data_edgelet)
            mkdir -p "${_pd}/data" "${_pd}/config" "${_pd}/run" "${_pd}/log" "${_pd}/scripts" 2>/dev/null || true
            ;;
    esac
}

install_script_to_share() {
    _dest="${SHARE_DIR}/install.sh"
    if [ -f "${SCRIPT_DIR}/install.sh" ]; then
        if [ "${SCRIPT_DIR}/install.sh" -ef "$_dest" ] 2>/dev/null \
            || [ "${SCRIPT_DIR}/install.sh" = "$_dest" ]; then
            return 0
        fi
        install -m 755 "${SCRIPT_DIR}/install.sh" "$_dest"
        return 0
    fi
    case "$0" in
        */install.sh)
            if [ -f "$0" ]; then
                if [ "$0" -ef "$_dest" ] 2>/dev/null || [ "$0" = "$_dest" ]; then
                    return 0
                fi
                install -m 755 "$0" "$_dest"
                return 0
            fi
            ;;
    esac
    write_embedded_install "$_dest"
}

uninstall_script_to_share() {
    _dest="${SHARE_DIR}/uninstall.sh"
    if [ -f "${SCRIPT_DIR}/uninstall.sh" ]; then
        if [ "${SCRIPT_DIR}/uninstall.sh" -ef "$_dest" ] 2>/dev/null \
            || [ "${SCRIPT_DIR}/uninstall.sh" = "$_dest" ]; then
            return 0
        fi
        install -m 755 "${SCRIPT_DIR}/uninstall.sh" "$_dest"
        return 0
    fi
    write_embedded_uninstall "$_dest"
}

copy_bundled_scripts() {
    OS="$1"
    mkdir -p "$SHARE_DIR"
    install_script_to_share
    uninstall_script_to_share
    if [ -d "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet" ]; then
        mkdir -p "${SHARE_DIR}/etc/edgelet"
        for _f in config.default.yaml controller-ca.sample.crt; do
            [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/${_f}" ] && \
                cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/${_f}" "${SHARE_DIR}/etc/edgelet/${_f}" 2>/dev/null || true
        done
        [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/config.default.yaml" ] && \
            cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/config.default.yaml" \
                "${SHARE_DIR}/edgelet-config.yaml.sample"
        [ -f "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/controller-ca.sample.crt" ] && \
            cp "${SCRIPT_DIR}/packaging/edgelet/etc/edgelet/controller-ca.sample.crt" \
                "${SHARE_DIR}/edgelet-controller-ca.crt.sample"
    fi
    info "Bundled install scripts at ${SHARE_DIR}/"
}

install_binary_file() {
    _src="$1" _dest="$2"
    _dir=$(dirname "$_dest")
    mkdir -p "$_dir"
    install -m 755 "$_src" "$_dest"
    info "Installed ${_dest}"
}

install_cli_completion() {
    command -v edgelet >/dev/null 2>&1 || return 0
    if [ -d /etc/bash_completion.d ]; then
        if edgelet completion bash >/etc/bash_completion.d/edgelet 2>/dev/null; then
            chmod 644 /etc/bash_completion.d/edgelet
            info "Bash completion installed."
        fi
    fi
}

apply_container_engine_to_config() {
    [ -f "$CONFIG_FILE" ] || return 0
    command -v sed >/dev/null 2>&1 || return 0
    sed -i "s|containerEngine:.*|containerEngine: ${CONTAINER_ENGINE}|" "$CONFIG_FILE" 2>/dev/null || true
    _durl=$(default_container_engine_url_for_engine "$CONTAINER_ENGINE" "$OS")
    sed -i "s|containerEngineUrl:.*|containerEngineUrl: ${_durl}|" "$CONFIG_FILE" 2>/dev/null || true
}

download_or_stage_binary() {
    _dest="$1"
    if [ -n "$BIN_PATH" ]; then
        [ -f "$BIN_PATH" ] || die "Local binary not found: $BIN_PATH"
        verify_binary_checksum "$BIN_PATH"
        cp "$BIN_PATH" "$_dest"
        info "Using local binary: ${BIN_PATH}"
        return 0
    fi
    if [ "$AIRGAP" = true ]; then
        die "--airgap requires --bin-path"
    fi
    _url=$(release_download_url "$EDGELET_VERSION" "$OS" "$ARCH")
    info "Downloading ${_url} ..."
    curl -fsSL -o "$_dest" "$_url" || die "Failed to download release binary"
}

compute_source_url() {
    if [ -n "$BIN_PATH" ]; then
        _real=$(cd "$(dirname "$BIN_PATH")" && pwd)/$(basename "$BIN_PATH")
        echo "file://${_real}"
    else
        release_download_url "$EDGELET_VERSION" "$OS" "$ARCH"
    fi
}

# ── main ──────────────────────────────────────────────────────────────────────
OS=$(detect_os)
init_platform_paths "$OS"
ARCH="${ARCH_OVERRIDE:-$(detect_arch)}"
BINARY_PATH=$(binary_install_path "$OS")

if [ "$OS" = "linux" ]; then
    INIT=$(detect_init)
else
    INIT="none"
fi

if [ "$ACTION" != "rollback" ]; then
    if [ -z "$CONTAINER_ENGINE" ]; then
        CONTAINER_ENGINE=$(default_container_engine_for_os "$OS")
    fi
    case "$CONTAINER_ENGINE" in
        edgelet)
            [ "$OS" = "linux" ] || die "containerEngine=edgelet is linux-only"
            ;;
        docker|podman) ;;
        *) die "Invalid --container-engine (use edgelet, docker, or podman)" ;;
    esac
fi

require_root

info "OS           : ${OS}"
info "Architecture : ${ARCH}"
info "Init system  : ${INIT}"
if [ "$ACTION" != "rollback" ]; then
    info "Engine       : ${CONTAINER_ENGINE}"
fi
info "Action       : ${ACTION}"

TMPDIR=$(mktemp -d)
trap 'rm -rf "${TMPDIR}"' EXIT

if [ "$AIRGAP" = false ] && [ "$EDGELET_VERSION" = "latest" ] && [ "$ACTION" != "rollback" ] && [ -z "$BIN_PATH" ]; then
    info "Fetching latest release tag..."
    EDGELET_VERSION=$(curl -fsSL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" \
        | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    [ -n "${EDGELET_VERSION}" ] || die "Failed to determine latest version"
fi

info "Version: ${EDGELET_VERSION}"

# ── rollback ──────────────────────────────────────────────────────────────────
if [ "$ACTION" = "rollback" ]; then
    [ -f "$PREVIOUS_FILE" ] || die "No ${PREVIOUS_FILE} found."
    _pv=$(kv_get "$PREVIOUS_FILE" "previous_version")
    _pos=$(kv_get "$PREVIOUS_FILE" "previous_os")
    _parch=$(kv_get "$PREVIOUS_FILE" "previous_arch")
    _peng=$(kv_get "$PREVIOUS_FILE" "previous_container_engine")
    _purl=$(kv_get "$PREVIOUS_FILE" "previous_download_url")
    _cfgbak=$(kv_get "$PREVIOUS_FILE" "config_backup_path")
    [ -n "$_pos" ] || _pos="$OS"
    [ -n "$_parch" ] || _parch="$ARCH"
    CONTAINER_ENGINE="${_peng:-edgelet}"
    EDGELET_VERSION="$_pv"
    _staged="${TMPDIR}/edgelet-bin"
    _cached=$(cached_binary_path "$_pv" "$_pos" "$_parch")
    if [ -n "$_cached" ]; then
        cp "$_cached" "$_staged"
        info "Rollback from cache: ${_cached}"
    elif [ -n "$BIN_PATH" ]; then
        verify_binary_checksum "$BIN_PATH"
        cp "$BIN_PATH" "$_staged"
    elif [ "$AIRGAP" = true ]; then
        die "rollback with --airgap requires --bin-path or a cached binary"
    else
        curl -fsSL -o "$_staged" "$_purl" || die "Failed to download rollback binary"
    fi
    _old_embed=""
    if [ "$OS" = "linux" ]; then
        _old_embed=$(installed_embed_hash)
    fi
    [ "$OS" = "linux" ] && stop_edgelet_service "$INIT"
    install_binary_file "$_staged" "$BINARY_PATH"
    install_dirs "$OS"
    if [ "$FORCE_CONFIG" != true ] && [ -f "$_cfgbak" ]; then
        install -m 640 "$_cfgbak" "$CONFIG_FILE"
    fi
    _restart_dp=false
    if [ "$OS" = "linux" ]; then
        _new_embed=$(binary_embed_hash "$BINARY_PATH")
        if should_restart_data_plane "$CONTAINER_ENGINE" "$_old_embed" "$_new_embed"; then
            _restart_dp=true
            info "Embed hash: ${_old_embed:-<none>} -> ${_new_embed}; data-plane restart required"
        fi
    fi
    if [ "$OS" = "linux" ]; then
        install_init_unit "$INIT" "$CONTAINER_ENGINE" "$_restart_dp"
    fi
    _sha=$(sha256_file "$BINARY_PATH")
    write_install_receipt "$EDGELET_VERSION" "$_pos" "$_parch" "$CONTAINER_ENGINE" "$_purl" "$_sha" "rollback"
    info "Rollback to ${EDGELET_VERSION} complete."
    exit 0
fi

# ── upgrade ───────────────────────────────────────────────────────────────────
if [ "$ACTION" = "upgrade" ]; then
    [ -f "$BINARY_PATH" ] || die "Edgelet not installed; run install first"
    [ -f "$RECEIPT_FILE" ] || die "Missing ${RECEIPT_FILE}"
    _cur_ver=$(kv_get "$RECEIPT_FILE" "installed_version")
    _cur_os=$(kv_get "$RECEIPT_FILE" "os")
    _cur_arch=$(kv_get "$RECEIPT_FILE" "arch")
    _cur_eng=$(kv_get "$RECEIPT_FILE" "container_engine")
    _cur_src=$(kv_get "$RECEIPT_FILE" "source_url")
    _cur_sha=$(kv_get "$RECEIPT_FILE" "binary_sha256")
    [ -n "$_cur_os" ] || _cur_os="$OS"
    [ -n "$_cur_arch" ] || _cur_arch="$ARCH"
    [ -n "$_cur_eng" ] || _cur_eng="$CONTAINER_ENGINE"
    if [ "$EDGELET_VERSION" = "latest" ] && [ -z "$BIN_PATH" ]; then
        EDGELET_VERSION=$(curl -fsSL "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" \
            | grep '"tag_name"' | head -1 | sed 's/.*"tag_name": *"\([^"]*\)".*/\1/')
    fi
    _cfg_backup="${BACKUP_DIR}/config.yaml.$(date +%Y%m%d%H%M%S 2>/dev/null || date +%s)"
    cp "$CONFIG_FILE" "$_cfg_backup" 2>/dev/null || true
    _old_embed=""
    if [ "$OS" = "linux" ]; then
        _old_embed=$(installed_embed_hash)
    fi
    cache_binary "$_cur_ver" "$_cur_os" "$_cur_arch" "$BINARY_PATH"
    write_previous_release "$_cur_ver" "$_cur_os" "$_cur_arch" "$_cur_eng" "$_cur_src" "$_cur_sha" "$_cfg_backup"
    [ "$OS" = "linux" ] && stop_edgelet_service "$INIT"
    stop_edgelet_daemon_desktop "$OS"
    _staged="${TMPDIR}/edgelet-bin"
    download_or_stage_binary "$_staged"
    verify_binary_checksum "$_staged"
    install_binary_file "$_staged" "$BINARY_PATH"
    install_dirs "$OS"
    if [ "$FORCE_CONFIG" = true ]; then
        rm -f "$CONFIG_FILE"
        install_config_samples
    fi
    apply_container_engine_to_config
    _sha=$(sha256_file "$BINARY_PATH")
    _method="upgrade"
    [ "$AIRGAP" = true ] && _method="upgrade-airgap"
    write_install_receipt "$EDGELET_VERSION" "$OS" "$ARCH" "$CONTAINER_ENGINE" "$(compute_source_url)" "$_sha" "$_method"
    copy_bundled_scripts "$OS"
    _restart_dp=false
    if [ "$OS" = "linux" ]; then
        _new_embed=$(binary_embed_hash "$BINARY_PATH")
        if should_restart_data_plane "$CONTAINER_ENGINE" "$_old_embed" "$_new_embed"; then
            _restart_dp=true
            info "Embed hash: ${_old_embed:-<none>} -> ${_new_embed}; data-plane restart required"
        fi
    fi
    if [ "$OS" = "linux" ]; then
        install_init_unit "$INIT" "$CONTAINER_ENGINE" "$_restart_dp"
    else
        start_edgelet_daemon_desktop "$OS"
    fi
    info "Upgrade to ${EDGELET_VERSION} complete."
    exit 0
fi

# ── fresh install ─────────────────────────────────────────────────────────────
_staged="${TMPDIR}/edgelet-bin"
download_or_stage_binary "$_staged"
verify_binary_checksum "$_staged"
install_dirs "$OS"
install_binary_file "$_staged" "$BINARY_PATH"
install_config_samples
apply_container_engine_to_config
_sha=$(sha256_file "$BINARY_PATH")
_method="install"
[ "$AIRGAP" = true ] && _method="install-airgap"
write_install_receipt "$EDGELET_VERSION" "$OS" "$ARCH" "$CONTAINER_ENGINE" "$(compute_source_url)" "$_sha" "$_method"
copy_bundled_scripts "$OS"
if [ "$OS" = "linux" ]; then
    install_init_unit "$INIT" "$CONTAINER_ENGINE"
    install_cli_completion
else
    start_edgelet_daemon_desktop "$OS"
fi

info ""
info "edgelet ${EDGELET_VERSION} installed (os=${OS} engine=${CONTAINER_ENGINE})."
info "  Binary : ${BINARY_PATH}"
case "$OS" in
    linux)
        info "  Unit   : ${INIT}"
        info "  Config : ${CONFIG_FILE}"
        info "  Data   : /var/lib/edgelet/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
    darwin)
        info "  Config : ${CONFIG_FILE}"
        info "  Data   : /var/lib/edgelet/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
    windows)
        info "  Config : ${CONFIG_FILE}"
        _pd=$(windows_program_data_edgelet)
        info "  Data   : ${_pd}/data/"
        info "  Scripts: ${SHARE_DIR}/"
        ;;
esac
info ""
info "Check status: edgelet system status"
info "Configure Controller: edgelet config --a <controller-api-endpoint>"
info "Provision:    edgelet provision <key>"