#!/data/data/com.termux/files/usr/bin/bash
# SN512A local-first, integrity-pinned installer.
set -eo pipefail
umask 077
EXPECTED='d6e28d9e2731c00b193afb68c4106a0b2774ac4895135231d3db697c021bfba5'
SOURCE='https://sn512a.synons.com/snctl.sh'
if [ -z "$PREFIX" ];then PREFIX='/data/data/com.termux/files/usr';fi
if [ ! -d "$PREFIX" ] || ! command -v pkg >/dev/null 2>&1;then
  echo 'Open the official Termux app and run this script there.' >&2;exit 1
fi
tmp="$(mktemp)";trap 'rm -f "$tmp"' EXIT
if [ -f "$(dirname "$0")/snctl.sh" ];then
  cp "$(dirname "$0")/snctl.sh" "$tmp"
else
  if command -v curl >/dev/null 2>&1;then
    curl -fL --proto '=https' --tlsv1.2 --retry 2 --connect-timeout 15 -o "$tmp" "$SOURCE"
  elif command -v wget >/dev/null 2>&1;then
    wget -q -O "$tmp" "$SOURCE"
  else echo 'Need an offline copy of snctl.sh or the Termux curl/wget package.' >&2;exit 1;fi
fi
printf '%s  %s\n' "$EXPECTED" "$tmp" | sha256sum -c - >/dev/null || {
  echo 'Integrity check failed. Controller NOT installed.' >&2;exit 1;
}
mkdir -p "$PREFIX/bin" "$HOME/.local/share/sn512a"
install -m 700 "$tmp" "$PREFIX/bin/snctl"
echo 'SN512A controller installed safely.'
echo 'Next: snctl onboard'
echo 'Then: snctl network, snctl dns, snctl vpn, snctl shizuku, snctl audit'
echo 'No changes made to firmware, carrier policies or Android management.'