# Tsumi loader bootstrap. Consumers run:
#
#     irm https://loader.poi.army | iex
#
# Short on purpose — every line is readable before the user trusts this
# with elevation. The TLS cert is a public Let's Encrypt cert signed by
# ISRG Root X1, which Windows trusts out of the box — no cert pinning
# gymnastics needed on the user side. We still pin the LOADER EXE's
# SHA-256 so a VPS compromise can't swap in a tampered binary without
# re-pinning here first.
$ErrorActionPreference = 'Stop'

$ApiBase            = 'https://loader.poi.army'
$Dest               = Join-Path $env:TEMP 'tsumi-loader.exe'
$PinnedLoaderSha256 = '15d7f3573a1a974787394b45e9643e1aa168c4b07f6da7e09aa2bdcc3f42409f'

Write-Host 'Tsumi loader bootstrap' -ForegroundColor Cyan
Write-Host ''

# TLS 1.2+ (Win10 pre-1903 defaults to TLS 1.0/1.1)
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12 -bor [Net.SecurityProtocolType]::Tls13

Write-Host 'downloading loader...'
Invoke-WebRequest -Uri "$ApiBase/loader.exe" -OutFile $Dest -UseBasicParsing

Write-Host 'verifying...'
$actual = (Get-FileHash -Path $Dest -Algorithm SHA256).Hash.ToLower()
if ($actual -ne $PinnedLoaderSha256.ToLower()) {
    Remove-Item $Dest -Force -ErrorAction SilentlyContinue
    Write-Host 'SHA256 mismatch:' -ForegroundColor Red
    Write-Host "  expected $PinnedLoaderSha256"
    Write-Host "  got      $actual"
    Write-Host 'ABORTING - do NOT run this binary.' -ForegroundColor Red
    exit 1
}
Write-Host "ok (sha256 $actual)" -ForegroundColor Green

Write-Host 'launching...'
Start-Process -FilePath $Dest