#!/usr/bin/env bash
# ─────────────────────────────────────────────────────────────────────
# ◆ AXIOM — Join the Mesh
# ─────────────────────────────────────────────────────────────────────
# curl -sL https://axiom.farm/join | bash
#
# Installs ax-netd + avs, generates an identity, connects to the mesh.
# Works on: macOS (arm64/x86_64), Linux (amd64/aarch64), Alpine (musl).
# ─────────────────────────────────────────────────────────────────────
set -euo pipefail

# ── Branding ─────────────────────────────────────────────────────────
TEAL='\033[38;2;126;224;201m'
DIM='\033[2m'
BOLD='\033[1m'
NC='\033[0m'

banner() {
    echo ""
    echo -e "  ${TEAL}◆${NC} ${BOLD}AXIOM${NC}"
    echo -e "  ${DIM}joining the mesh${NC}"
    echo ""
}

info()  { echo -e "  ${TEAL}▸${NC} $*"; }
ok()    { echo -e "  ${TEAL}✓${NC} $*"; }
warn()  { echo -e "  \033[0;33m!${NC} $*"; }
fail()  { echo -e "  \033[0;31m✗${NC} $*"; exit 1; }

banner

INSTALL_USER=false
INSTALL_APPSTORE=false
INSTALL_SERVER=false
INSTALL_LAB=false

# Simple arg parsing
while [[ $# -gt 0 ]]; do
    case "$1" in
        -u|--user)     INSTALL_USER=true; shift ;;
        -a|--appstore) INSTALL_APPSTORE=true; shift ;;
        -s|--server)   INSTALL_SERVER=true; shift ;;
        -l|--lab)      INSTALL_LAB=true; shift ;;
        *)             shift ;; # Ignore other/unexpected flags
    esac
done

# ── Detect platform ─────────────────────────────────────────────────
OS=$(uname -s | tr '[:upper:]' '[:lower:]')
ARCH=$(uname -m)

case "$OS" in
    darwin) PLATFORM="macos" ;;
    linux)
        if [ -f /etc/alpine-release ]; then
            PLATFORM="alpine"
        else
            PLATFORM="linux"
        fi
        ;;
    *) fail "Unsupported OS: $OS" ;;
esac

case "$ARCH" in
    x86_64|amd64)   ARCH="x86_64" ;;
    arm64|aarch64)   ARCH="aarch64" ;;
    *)               fail "Unsupported arch: $ARCH" ;;
esac

info "Platform: ${PLATFORM}/${ARCH}"

# ── Alpine prerequisites ────────────────────────────────────────────
if [ "$PLATFORM" = "alpine" ]; then
    # 'file' command is needed to validate downloaded binaries (ELF check)
    # but is not installed by default on Alpine
    if ! command -v file &>/dev/null; then
        apk add --no-cache file >/dev/null 2>&1 || true
    fi
fi

# ── Handle OS/App Store installs ───────────────────────────────────
if [ "$INSTALL_USER" = true ] || [ "$INSTALL_APPSTORE" = true ] || [ "$INSTALL_SERVER" = true ] || [ "$INSTALL_LAB" = true ]; then
    AXIOM_HOME="${HOME}/.axiom"
    mkdir -p "$AXIOM_HOME"
    
    # Clean up stale arche-dev directory
    if [ -d "${AXIOM_HOME}/arche-dev" ]; then
        rm -rf "${AXIOM_HOME}/arche-dev"
    fi

    BASE_URL="https://dist.axiom.farm"

    dl() {
        local url="$1" dest="$2"
        if command -v curl &>/dev/null; then
            curl -k -fsSL "$url" -o "$dest" 2>/dev/null
        elif command -v wget &>/dev/null; then
            wget --no-check-certificate -q "$url" -O "$dest" 2>/dev/null
        else
            fail "Need curl or wget"
        fi
    }

    TMPDIR=$(mktemp -d)
    trap "rm -rf $TMPDIR" EXIT

    info "Downloading AXIOM repository archive..."
    if dl "${BASE_URL}/arche-dev-latest.tar.gz?v=$(date +%s)" "$TMPDIR/arche-dev.tar.gz"; then
        cd "$TMPDIR"
        tar xzf arche-dev.tar.gz
        cd arche-dev

        # ── Pre-built binaries injection hotfix (for fast deployment) ──
        if [ -d "/tmp/prebuilt" ]; then
            info "Pre-built binaries detected at /tmp/prebuilt. Injecting into build tree..."
            mkdir -p target/release
            mkdir -p bridge/user-os/target/release
            cp -r /tmp/prebuilt/* target/release/
            cp -r /tmp/prebuilt/* bridge/user-os/target/release/
        fi

        # ── macOS hotfix: patch install.sh in-flight ──
        # Guarantees macOS compatibility even if tarball is stale/cached.
        # Uses temp file instead of sed -i to avoid BSD/GNU incompatibility.
        if [ "$PLATFORM" = "macos" ] && [ -f bridge/user-os/install.sh ]; then
            _inst=bridge/user-os/install.sh
            sed \
                -e 's|AXIOM_HOME=\$(eval echo "~\$AXIOM_USER")|AXIOM_HOME="$HOME"|g' \
                -e 's|install -d -m 755 \$INSTALL_OWNER_OPTS|mkdir -p|g' \
                -e 's|echo "\$AXIOM_USER")|echo "staff")|g' \
                "$_inst" > "${_inst}.patched"
            mv "${_inst}.patched" "$_inst"
        fi

        # Helper: run as root — use sudo if needed and available, skip if already root
        run_as_root() {
            if [ "$(id -u)" = "0" ]; then
                "$@"
            elif command -v sudo >/dev/null 2>&1; then
                sudo "$@"
            elif command -v doas >/dev/null 2>&1; then
                doas "$@"
            else
                fail "Need root privileges. Install sudo/doas or run as root."
            fi
        }

        if [ "$INSTALL_USER" = true ]; then
            info "Launching User-OS installer..."
            if [ "$PLATFORM" = "macos" ]; then
                bash bridge/user-os/install.sh
            else
                run_as_root bash bridge/user-os/install.sh
            fi
        elif [ "$INSTALL_APPSTORE" = true ]; then
            info "Launching App Store installer..."
            if [ "$PLATFORM" = "macos" ]; then
                bash bridge/user-os/install.sh --appstore
            else
                run_as_root bash bridge/user-os/install.sh --appstore
            fi
        elif [ "$INSTALL_SERVER" = true ]; then
            info "Launching Server-OS installer..."
            if [ "$PLATFORM" = "macos" ]; then
                fail "Server-OS is supported on Linux only."
            else
                run_as_root bash bridge/server-os/install.sh
            fi
        elif [ "$INSTALL_LAB" = true ]; then
            info "Launching Lab-OS provisioner..."
            if [ "$PLATFORM" = "macos" ]; then
                fail "Lab-OS is supported on Linux only."
            else
                run_as_root env -i HOME="$HOME" PATH="$PATH" bash bridge/lab-os/provision.sh
            fi
        fi
        exit 0
    else
        fail "Cannot download AXIOM archive. Check network."
    fi
fi

# ── Dirs ─────────────────────────────────────────────────────────────
AXIOM_HOME="${HOME}/.axiom"
mkdir -p "$AXIOM_HOME"
AXIOM_BIN="${AXIOM_HOME}/bin"
AXIOM_DATA="${AXIOM_HOME}/data"
AXIOM_CHAIN="${AXIOM_DATA}/chain"
AXIOM_NET="${AXIOM_HOME}/nets/default"

mkdir -p "$AXIOM_BIN" "$AXIOM_DATA" "$AXIOM_CHAIN" "$AXIOM_NET"

# Clean up stale arche-dev directory from old join script
if [ -d "${AXIOM_HOME}/arche-dev" ]; then
    rm -rf "${AXIOM_HOME}/arche-dev"
fi

# Clean up stale/conflicting cargo-installed axiom binary if present
if [ -f "${HOME}/.cargo/bin/axiom" ]; then
    info "Detected conflicting cargo-installed axiom binary at ~/.cargo/bin/axiom. Removing it..."
    rm -f "${HOME}/.cargo/bin/axiom"
    if command -v cargo &>/dev/null; then
        cargo uninstall axiom >/dev/null 2>&1 || true
    fi
    warn "Please run 'hash -r' or start a new shell session before using 'axiom' to clear any cached paths."
fi

# ── Download helper ──────────────────────────────────────────────────
BASE_URL="https://dist.axiom.farm"

dl() {
    local url="$1" dest="$2"
    if command -v curl &>/dev/null; then
        curl -k -fsSL "$url" -o "$dest" 2>/dev/null
    elif command -v wget &>/dev/null; then
        wget --no-check-certificate -q "$url" -O "$dest" 2>/dev/null
    else
        fail "Need curl or wget"
    fi
}

# ── Try pre-built binaries first ─────────────────────────────────────
HAVE_BINARIES=true
for bin in ax-netd avs; do
    info "Downloading ${bin}..."
    if dl "${BASE_URL}/${PLATFORM}-${ARCH}/${bin}" "${AXIOM_BIN}/${bin}"; then
        chmod +x "${AXIOM_BIN}/${bin}"
        # Verify it's actually an executable, not an HTML 404 page
        if file "${AXIOM_BIN}/${bin}" 2>/dev/null | grep -qiE "executable|Mach-O|ELF"; then
            ok "${bin}"
        else
            rm -f "${AXIOM_BIN}/${bin}"
            HAVE_BINARIES=false
            info "${bin}: not a valid binary, will build from source"
        fi
    else
        HAVE_BINARIES=false
        info "${bin}: download failed, will build from source"
    fi
done

# ── Fallback: build from source tarball ──────────────────────────────
if [ "$HAVE_BINARIES" = false ]; then
    info "Building from source..."

    # Check for Rust
    if ! command -v cargo &>/dev/null; then
        if [ -d "${HOME}/.axiom/toolchain/bin" ]; then
            export PATH="${HOME}/.axiom/toolchain/bin:${PATH}"
        elif [ -d "/opt/axiom/toolchain/bin" ]; then
            export PATH="/opt/axiom/toolchain/bin:${PATH}"
        elif [ -f "${HOME}/.cargo/env" ]; then
            source "${HOME}/.cargo/env"
        fi
    fi

    if ! command -v cargo &>/dev/null; then
        info "Rust not found. Installing AXIOM Rust toolchain..."
        TOOLCHAIN_TAR="axiom-rust-1.96.0-${PLATFORM}-${ARCH}.tar.gz"
        mkdir -p "${HOME}/.axiom/toolchain"
        if dl "${BASE_URL}/toolchain/${TOOLCHAIN_TAR}" "/tmp/${TOOLCHAIN_TAR}"; then
            tar -xzf "/tmp/${TOOLCHAIN_TAR}" -C "${HOME}/.axiom/toolchain" --strip-components=1
            export PATH="${HOME}/.axiom/toolchain/bin:${PATH}"
            rm -f "/tmp/${TOOLCHAIN_TAR}"
            ok "AXIOM Rust toolchain installed"
        else
            info "AXIOM Rust toolchain not available for ${PLATFORM}-${ARCH}."
            info "You can install upstream Rust as a bridge-era fallback."
            printf "  Install upstream Rust via rustup? [y/N] "
            read -r REPLY < /dev/tty 2>/dev/null || REPLY="y"  # default yes in non-interactive
            case "$REPLY" in
                [yY]|[yY][eE][sS])
                    info "Installing upstream Rust (bridge-era fallback)..."
                    if command -v curl &>/dev/null; then
                        curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal 2>&1 | tail -5
                    elif command -v wget &>/dev/null; then
                        wget -qO- https://sh.rustup.rs | sh -s -- -y --default-toolchain stable --profile minimal 2>&1 | tail -5
                    else
                        fail "Cannot install Rust. Need curl or wget."
                    fi
                    source "${HOME}/.cargo/env"
                    ok "Upstream Rust installed (bridge-era fallback): $(rustc --version)"
                    ;;
                *)
                    fail "Cannot proceed without Rust toolchain."
                    ;;
            esac
        fi
    fi

    ok "Rust: $(cargo --version 2>/dev/null || echo 'installed')"

    # ── Alpine build dependencies ────────────────────────────────────
    if [ "$PLATFORM" = "alpine" ]; then
        info "Installing Alpine build dependencies..."
        apk add --no-cache build-base openssl-dev musl-dev linux-headers perl pkgconfig 2>/dev/null || true
    fi

    # Download minimal source tarball (172K, just the 10 crates needed)
    TMPDIR=$(mktemp -d)
    trap "rm -rf $TMPDIR" EXIT

    info "Downloading source (172K)..."
    if dl "${BASE_URL}/axiom-mesh-src.tar.gz" "$TMPDIR/src.tar.gz"; then
        cd "$TMPDIR"
        tar xzf src.tar.gz
        cd axiom-mesh

        info "Building ax-netd + avs (this takes ~1-2 min)..."
        cargo build --release -p avs 2>&1 | tail -2
        cargo build --release -p ax-meshd --bin ax-netd 2>&1 | tail -2

        cp target/release/ax-netd "$AXIOM_BIN/"
        cp target/release/avs "$AXIOM_BIN/"
        chmod +x "$AXIOM_BIN/ax-netd" "$AXIOM_BIN/avs"
        ok "Built from source"
    else
        fail "Cannot download source tarball. Check network."
    fi

    cd "$HOME"
fi

# ── Add to PATH ──────────────────────────────────────────────────────
add_to_path() {
    local shell_rc="$1"
    # Create the file if it doesn't exist (fresh servers, containers, etc.)
    touch "$shell_rc" 2>/dev/null || true
    if [ -f "$shell_rc" ]; then
        if ! grep -q 'axiom/bin' "$shell_rc" 2>/dev/null; then
            echo '' >> "$shell_rc"
            echo '# AXIOM mesh' >> "$shell_rc"
            echo 'export PATH="${HOME}/.axiom/bin:${PATH}"' >> "$shell_rc"
            ok "Added ~/.axiom/bin to PATH in $(basename "$shell_rc")"
        fi
        if ! grep -q 'toolchain/bin' "$shell_rc" 2>/dev/null; then
            echo '' >> "$shell_rc"
            echo '# AXIOM Rust toolchain' >> "$shell_rc"
            echo 'if [ -d "${HOME}/.axiom/toolchain/bin" ]; then' >> "$shell_rc"
            echo '    export PATH="${HOME}/.axiom/toolchain/bin:${PATH}"' >> "$shell_rc"
            echo 'fi' >> "$shell_rc"
            ok "Added ~/.axiom/toolchain/bin to PATH in $(basename "$shell_rc")"
        fi
    fi
}

case "${SHELL:-/bin/sh}" in
    */zsh)  add_to_path "${HOME}/.zshrc" ;;
    */bash) add_to_path "${HOME}/.bashrc" ;;
    *)      add_to_path "${HOME}/.profile" ;;
esac

# Always symlink axiom CLI to /usr/local/bin for immediate system-wide access.
# This ensures 'axiom' works in new shells without sourcing rc files first.
if [ -d /usr/local/bin ] && [ -w /usr/local/bin ]; then
    ln -sf "${AXIOM_BIN}/axiom" /usr/local/bin/axiom 2>/dev/null || true
fi

# On Linux servers: also add to /etc/profile.d for all users
if [ "$(uname -s)" = "Linux" ] && [ -d /etc/profile.d ] && [ -w /etc/profile.d ]; then
    cat > /etc/profile.d/axiom.sh << 'PROF'
# AXIOM mesh — add CLI and toolchain to PATH for all users
if [ -d "${HOME}/.axiom/bin" ]; then
    export PATH="${HOME}/.axiom/bin:${PATH}"
fi
if [ -d "${HOME}/.axiom/toolchain/bin" ]; then
    export PATH="${HOME}/.axiom/toolchain/bin:${PATH}"
fi
PROF
    chmod 644 /etc/profile.d/axiom.sh
fi

export PATH="${AXIOM_BIN}:${PATH}"

# ── Create default network profile ──────────────────────────────────
PROFILE="${AXIOM_NET}/profile.toml"
if [ ! -f "$PROFILE" ]; then
    cat > "$PROFILE" << 'TOML'
# AXIOM mesh — default network profile
name = "axiomnet"
relay = "relay.axiom.farm:443"
bind = "0.0.0.0:7700"
dns_bind = "127.0.0.1:1053"
proxy_port = 8000
keypair = "~/.axiom/node.axkey"
chain_dir = "~/.axiom/data/chain"
TOML
    ok "Network profile: ${PROFILE}"
fi

# ── Generate cell identifier (for metadata only) ────────────────────
# NOTE: The cryptographic keypair (node.axkey) is generated by ax-netd
# on first run using proper hybrid ed25519+SLH-DSA. We only generate
# a human-readable cell identifier here for metadata tracking.
CELL_ID_FILE="${AXIOM_HOME}/cell-id"
if [ ! -f "$CELL_ID_FILE" ]; then
    _cell_material="$(hostname -f 2>/dev/null || hostname):$(date +%s%N 2>/dev/null || date +%s):$$:$RANDOM"
    if command -v openssl >/dev/null 2>&1; then
        CELL_ID=$(echo -n "$_cell_material" | openssl dgst -sha256 | awk '{print $NF}' | head -c 32)
    else
        CELL_ID=$(echo -n "$_cell_material" | sha256sum 2>/dev/null | head -c 32 || echo "cell-$(hostname -s)-$$")
    fi
    echo "$CELL_ID" > "$CELL_ID_FILE"
    ok "Cell identifier: ${CELL_ID}"
else
    CELL_ID=$(cat "$CELL_ID_FILE" 2>/dev/null | head -1)
fi

# ── Cell metadata ────────────────────────────────────────────────────
CELL_META="${AXIOM_HOME}/cell.toml"
cat > "$CELL_META" << CELLMETA
# AXIOM Cell Metadata — auto-generated by join installer
[cell]
id = "${CELL_ID}"
hostname = "$(hostname -f 2>/dev/null || hostname)"
platform = "${PLATFORM}"
arch = "${ARCH}"
joined = "$(date -u +%Y-%m-%dT%H:%M:%SZ)"
role = "node"

[hardware]
cpus = $(nproc 2>/dev/null || sysctl -n hw.ncpu 2>/dev/null || echo 1)
memory_mb = $(free -m 2>/dev/null | awk '/^Mem:/{print $2}' || sysctl -n hw.memsize 2>/dev/null | awk '{printf "%d", $1/1048576}' || echo 0)
CELLMETA

# Detect GPU
if command -v nvidia-smi >/dev/null 2>&1; then
    _gpu_name=$(nvidia-smi --query-gpu=name --format=csv,noheader 2>/dev/null | head -1 || echo "unknown")
    _gpu_mem=$(nvidia-smi --query-gpu=memory.total --format=csv,noheader,nounits 2>/dev/null | head -1 || echo "0")
    _gpu_count=$(nvidia-smi --list-gpus 2>/dev/null | wc -l || echo "1")
    cat >> "$CELL_META" << GPUMETA

[gpu]
name = "${_gpu_name}"
memory_mb = ${_gpu_mem}
count = ${_gpu_count}
cuda = true
GPUMETA
fi
ok "Cell metadata: ${CELL_META}"

# ── Auto-start mesh daemon ───────────────────────────────────────────
# ax-netd generates a proper hybrid ed25519+SLH-DSA keypair at node.axkey
# on first run if one doesn't exist yet.
if [ -x "${AXIOM_BIN}/ax-netd" ]; then
    if ! pgrep -x "ax-netd" >/dev/null 2>&1; then
        mkdir -p "${AXIOM_HOME}/cell"
        nohup "${AXIOM_BIN}/ax-netd" --profile "$PROFILE" > "${AXIOM_HOME}/cell/ax-netd.log" 2>&1 &
        NETD_PID=$!
        # Give ax-netd a moment to generate identity and start
        sleep 1
        if kill -0 "$NETD_PID" 2>/dev/null; then
            ok "Mesh daemon started (PID: ${NETD_PID})"
            # Read back the handle ax-netd generated
            HANDLE=$(grep -o 'Handle: [a-f0-9]*' "${AXIOM_HOME}/cell/ax-netd.log" 2>/dev/null | tail -1 | awk '{print $2}')
            if [ -n "$HANDLE" ]; then
                ok "Identity handle: ${HANDLE}"
            fi
        else
            info "Mesh daemon exited (check ~/.axiom/cell/ax-netd.log)"
            tail -3 "${AXIOM_HOME}/cell/ax-netd.log" 2>/dev/null | while read -r line; do
                info "  $line"
            done
        fi
    else
        ok "Mesh daemon already running"
    fi
fi

# ── Create axiom CLI helper ──────────────────────────────────────────
CLI_HELPER="${AXIOM_BIN}/axiom"
cat > "$CLI_HELPER" << 'EOF'
#!/usr/bin/env bash
# AXIOM CLI Control Center
set -euo pipefail

TEAL='\033[38;2;126;224;201m'
DIM='\033[2m'
BOLD='\033[1m'
WARN='\033[0;31m'
NC='\033[0m'

show_help() {
    echo -e "  ${TEAL}◆ AXIOM${NC} · control center"
    echo ""
    echo -e "  ${BOLD}USAGE:${NC}"
    echo -e "    axiom <command> [options]"
    echo ""
    echo -e "  ${BOLD}COMMANDS:${NC}"
    echo -e "    ${TEAL}status${NC}       Show AXIOM mesh status & active components"
    echo -e "    ${TEAL}start${NC}        Start the ax-netd mesh daemon"
    echo -e "    ${TEAL}stop${NC}         Stop the ax-netd mesh daemon"
    echo -e "    ${TEAL}logs${NC}         Tail the ax-netd daemon logs"
    echo -e "    ${TEAL}install${NC}      Install target AXIOM components"
    echo -e "    ${TEAL}help${NC}         Show this help information"
    echo ""
    echo -e "  ${BOLD}INSTALLABLE COMPONENTS:${NC}"
    echo -e "    ${TEAL}--appstore${NC}   AXIOM App Store (Tauri app store client)"
    echo -e "    ${TEAL}--user${NC}       User-OS (Desktop apps & settings panel)"
    echo -e "    ${TEAL}--server${NC}     Server-OS (Headless mesh node / server)"
    echo -e "    ${TEAL}--lab${NC}        Lab-OS (Machine learning workstation)"
    echo ""
    echo -e "  ${DIM}◆ AXIOM · ratchet v0.1 · AVS v0.1.0${NC}"
    echo -e "  ${DIM}content-addressed · client-verified · no root${NC}"
    echo ""
}

show_status() {
    echo -e "  ${TEAL}◆ AXIOM Mesh Cell Status${NC}"
    echo ""
    if pgrep -x "ax-netd" >/dev/null; then
        echo -e "  · Mesh Daemon (ax-netd):     ${TEAL}Running${NC}"
    else
        echo -e "  · Mesh Daemon (ax-netd):     ${WARN}Stopped${NC}"
    fi
    
    if command -v avs >/dev/null 2>&1; then
        echo -e "  · AVS Client (avs):          ${TEAL}Available${NC} ($(avs --version 2>/dev/null | head -1 || echo 'unknown'))"
    else
        echo -e "  · AVS Client (avs):          ${WARN}Not Found${NC}"
    fi

    if [[ -d "$HOME/.axiom/arche-dev" ]]; then
        echo -e "  · Repository Workspace:      ${TEAL}Present${NC}"
    else
        echo -e "  · Repository Workspace:      ${DIM}Not Found${NC}"
    fi
    echo ""
    echo -e "  Use ${TEAL}axiom start${NC} to start mesh networking, or ${TEAL}axiom install --appstore${NC} to install the App Store."
    echo ""
}

do_install() {
    if [[ $# -eq 0 ]]; then
        echo -e "  ${WARN}Error: Specify a component to install.${NC}"
        echo -e "  Example: ${TEAL}axiom install --appstore${NC}"
        exit 1
    fi
    
    local flag=""
    case "$1" in
        --appstore|-a) flag="--appstore" ;;
        --user|-u)     flag="--user" ;;
        --server|-s)   flag="--server" ;;
        --lab|-l)      flag="--lab" ;;
        *)
            echo -e "  ${WARN}Unknown component: $1${NC}"
            echo -e "  Valid components: --appstore, --user, --server, --lab"
            exit 1
            ;;
    esac

    echo -e "  ${TEAL}▸ Calling AXIOM bootstrap installer with $flag...${NC}"
    curl -sL https://axiom.farm/join | bash -s -- "$flag"
}

do_start() {
    if pgrep -x "ax-netd" >/dev/null; then
        echo -e "  ${TEAL}ax-netd${NC} is already running."
        exit 0
    fi
    echo -e "  ${TEAL}▸ Starting ax-netd daemon...${NC}"
    mkdir -p "$HOME/.axiom/cell"
    nohup "$HOME/.axiom/bin/ax-netd" --profile "$HOME/.axiom/nets/default/profile.toml" > "$HOME/.axiom/cell/ax-netd.log" 2>&1 &
    echo -e "  ${TEAL}✓${NC} Started (PID: $!). Log at ~/.axiom/cell/ax-netd.log"
}

do_stop() {
    if ! pgrep -x "ax-netd" >/dev/null; then
        echo -e "  ${TEAL}ax-netd${NC} is not running."
        exit 0
    fi
    echo -e "  ${TEAL}▸ Stopping ax-netd daemon...${NC}"
    pkill -x "ax-netd"
    echo -e "  ${TEAL}✓${NC} Stopped."
}

do_logs() {
    local logfile="$HOME/.axiom/cell/ax-netd.log"
    if [[ ! -f "$logfile" ]]; then
        echo -e "  ${WARN}No log file found at $logfile${NC}"
        exit 1
    fi
    tail -n 50 -f "$logfile"
}

CMD="${1:-status}"
shift || true

case "$CMD" in
    status) show_status ;;
    start)  do_start ;;
    stop)   do_stop ;;
    logs)   do_logs ;;
    install) do_install "$@" ;;
    help|-h|--help) show_help ;;
    *)
        echo -e "  ${WARN}Unknown command: $CMD${NC}"
        show_help
        exit 1
        ;;
esac
EOF
chmod +x "$CLI_HELPER"
ok "Created AXIOM CLI command: ${CLI_HELPER}"

# ── Verify binaries ─────────────────────────────────────────────────
echo ""
AX_NETD_VER=$("${AXIOM_BIN}/ax-netd" --version 2>/dev/null | head -1 || echo "unknown")
AVS_VER=$("${AXIOM_BIN}/avs" --version 2>/dev/null | head -1 || echo "unknown")

echo -e "  ${TEAL}◆${NC} ${BOLD}AXIOM installed successfully${NC}"
echo ""
echo -e "  ${DIM}ax-netd:${NC}   ${AX_NETD_VER}"
echo -e "  ${DIM}avs:${NC}       ${AVS_VER}"
echo -e "  ${DIM}Profile:${NC}   ${PROFILE}"
echo -e "  ${DIM}Identity:${NC}  ~/.axiom/node.axkey (generated on first run)"
echo ""
echo -e "  ${BOLD}AXIOM CLI Control Center:${NC}"
echo -e "  We installed a unified ${TEAL}axiom${NC} CLI tool under ${TEAL}~/.axiom/bin/axiom${NC}."
echo -e "  Run it to manage the daemon or install components:"
echo -e "    ${TEAL}axiom status${NC}     - View cell status"
echo -e "    ${TEAL}axiom start${NC}      - Start the mesh daemon"
echo -e "    ${TEAL}axiom stop${NC}       - Stop the mesh daemon"
echo -e "    ${TEAL}axiom logs${NC}       - View/tail logs"
echo ""
echo -e "  ${BOLD}Available components to install next:${NC}"
echo -e "  · ${BOLD}App Store${NC} (--appstore / -a)"
echo -e "    Discover and manage mesh-native applications via Tauri UI."
echo -e "    Install: ${TEAL}axiom install --appstore${NC}"
echo ""
echo -e "  · ${BOLD}User-OS${NC} (--user / -u)"
echo -e "    Full Desktop OS client with settings panel, workspace, and native apps."
echo -e "    Install: ${TEAL}axiom install --user${NC}"
echo ""
echo -e "  · ${BOLD}Server-OS${NC} (--server / -s)"
echo -e "    Headless server node configurations."
echo -e "    Install: ${TEAL}axiom install --server${NC}"
echo ""
echo -e "  · ${BOLD}Lab-OS${NC} (--lab / -l)"
echo -e "    Machine learning / CUDA cell setup."
echo -e "    Install: ${TEAL}axiom install --lab${NC}"
echo ""
echo -e "  ${DIM}◆ AXIOM · ratchet v0.1 · AVS v0.1.0${NC}"
echo -e "  ${DIM}content-addressed · client-verified · quantum-proof hybrid-signed · mesh-native · no root${NC}"
echo ""