; Verae Print Stamp — Windows DEBUG installer.
; One interactive, elevated install: files, Verae key (detect / sign in / create
; account / paste / skip), IPP printer + Local Port fallback printer, helper as the
; logged-in user (scheduled task), autostart, diagnostics on failure, per-step
; results on the finish page. All scripts run hidden (nsExec); secrets are passed
; only through files in $PLUGINSDIR that are deleted immediately and are never logged.
!ifndef VERSION
  !define VERSION "0.3.0-debug"
!endif
!ifndef ARCH
  !define ARCH "amd64"
!endif
!ifndef SRCDIR
  !define SRCDIR "."
!endif
!ifndef OUTDIR
  !define OUTDIR "."
!endif

!define PRODUCT_NAME "Verae Print Stamp (debug)"
!define UNINST_KEY "Software\Microsoft\Windows\CurrentVersion\Uninstall\VeraePrintStampDebug"
!define PORTAL_URL "https://customer.verae.ai/portal/"

Name "${PRODUCT_NAME} ${VERSION}"
OutFile "${OUTDIR}\VeraePrintStamp-windows-${ARCH}-${VERSION}-setup.exe"
InstallDir "$PROGRAMFILES64\Verae\PrintStamp"
RequestExecutionLevel admin
Unicode true
SetCompressor /SOLID lzma
ShowInstDetails show
ShowUninstDetails show
BrandingText "Verae TimeStamp PDF ${VERSION}"

!include "MUI2.nsh"
!include "nsDialogs.nsh"
!include "x64.nsh"
!include "LogicLib.nsh"
!include "FileFunc.nsh"
!include "WinMessages.nsh"

Var LogDir
Var LogFile
Var PS
Var Exe
; key page state
Var TargetUser
Var KeyPresent
Var KeyMasked
Var KeyCheck
Var KeyChoice      ; keep|login|create|paste|skip
Var TokenReady     ; 1 when $PLUGINSDIR\newtoken.txt holds a key to save
Var TokenMasked
Var PendingId
Var PolicyText
Var InstallApi
Var Checked
; controls
Var Dlg
Var hR1
Var hR2
Var hR3
Var hR4
Var hR5
Var hName
Var hEmail
Var hPass
Var hConfirm
Var hTotp
Var hCode
Var hKey
; results
Var FinishTitle
Var FinishText

!define MUI_ABORTWARNING
!define MUI_FINISHPAGE_TITLE "$FinishTitle"
!define MUI_FINISHPAGE_TEXT "$FinishText"
!define MUI_FINISHPAGE_TEXT_LARGE
!define MUI_FINISHPAGE_LINK "Open the logs folder"
!define MUI_FINISHPAGE_LINK_LOCATION "$LogDir"
!define MUI_FINISHPAGE_SHOWREADME "$INSTDIR\README-TEST.txt"
!define MUI_FINISHPAGE_SHOWREADME_TEXT "Open test instructions"
!define MUI_FINISHPAGE_SHOWREADME_NOTCHECKED
!define MUI_FINISHPAGE_NOREBOOTSUPPORT

!insertmacro MUI_PAGE_WELCOME
!insertmacro MUI_PAGE_LICENSE "${SRCDIR}\LICENSE.txt"
Page custom KeyPageCreate KeyPageLeave
Page custom LoginPageCreate LoginPageLeave
Page custom CreatePageCreate CreatePageLeave
Page custom VerifyPageCreate VerifyPageLeave
Page custom PastePageCreate PastePageLeave
!insertmacro MUI_PAGE_INSTFILES
!insertmacro MUI_PAGE_FINISH
!insertmacro MUI_UNPAGE_CONFIRM
!insertmacro MUI_UNPAGE_INSTFILES
!insertmacro MUI_LANGUAGE "English"

; ---------- logging (never pass secrets to these) ----------
!macro LOG text
  Push `${text}`
  Call WriteLog
!macroend
!define LOG "!insertmacro LOG"

Function WriteLog
  Exch $0
  Push $1
  Push $2
  ${GetTime} "" "L" $R1 $R2 $R3 $R4 $R5 $R6 $R7
  FileOpen $1 $LogFile a
  ${If} $1 != ""
    FileSeek $1 0 END
    FileWriteUTF16LE $1 "$R3-$R2-$R1 $R5:$R6:$R7 $0$\r$\n"
    FileClose $1
  ${EndIf}
  Pop $2
  Pop $1
  Pop $0
FunctionEnd

; Copy the install details list (incl. nsExec output) to a file.
!ifndef LVM_GETITEMCOUNT
!define LVM_GETITEMCOUNT 0x1004
!endif
!ifndef LVM_GETITEMTEXTW
!define LVM_GETITEMTEXTW 0x1073
!endif
Function DumpLog
  Exch $5
  Push $0
  Push $1
  Push $2
  Push $3
  Push $4
  Push $6
  FindWindow $0 "#32770" "" $HWNDPARENT
  GetDlgItem $0 $0 1016
  StrCmp $0 0 dl_exit
  FileOpen $5 $5 "w"
  StrCmp $5 "" dl_exit
  FileWriteWord $5 0xFEFF
  SendMessage $0 ${LVM_GETITEMCOUNT} 0 0 $6
  System::Call '*(&t${NSIS_MAX_STRLEN})p.r3'
  StrCpy $2 0
  System::Call "*(i, i, i, i, i, p, i, i, i) p (0, 0, 0, 0, 0, r3, ${NSIS_MAX_STRLEN}) .r1"
  dl_loop:
    StrCmp $2 $6 dl_done
    System::Call "User32::SendMessage(p, i, p, p) p ($0, ${LVM_GETITEMTEXTW}, $2, r1)"
    System::Call "*$3(&t${NSIS_MAX_STRLEN} .r4)"
    FileWriteUTF16LE $5 "$4$\r$\n"
    IntOp $2 $2 + 1
    Goto dl_loop
  dl_done:
    FileClose $5
    System::Free $1
    System::Free $3
  dl_exit:
  Pop $6
  Pop $4
  Pop $3
  Pop $2
  Pop $1
  Pop $0
  Pop $5
FunctionEnd

; write "Key=Value" request lines (UTF-16LE + BOM) — values may contain any chars
!macro REQ_OPEN path
  FileOpen $9 `${path}` w
  FileWriteWord $9 0xFEFF
!macroend
!macro REQ_KV key val
  FileWriteUTF16LE $9 `${key}=${val}$\r$\n`
!macroend
!macro REQ_CLOSE
  FileClose $9
!macroend

Function .onInit
  ${IfNot} ${RunningX64}
    MessageBox MB_ICONSTOP "This build targets 64-bit Windows."
    Abort
  ${EndIf}
  SetRegView 64
  SetShellVarContext all
  ReadEnvStr $LogDir "ProgramData"
  StrCpy $LogDir "$LogDir\Verae\logs"
  CreateDirectory $LogDir
  ${GetTime} "" "L" $R1 $R2 $R3 $R4 $R5 $R6 $R7
  StrCpy $LogFile "$LogDir\installer-$R3$R2$R1-$R5$R6$R7.log"
  StrCpy $PS '"$WINDIR\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden'
  InitPluginsDir
  SetOutPath $PLUGINSDIR
  File "${SRCDIR}\verae-print.exe"
  File "${SRCDIR}\scripts\common.ps1"
  File "${SRCDIR}\scripts\user-token.ps1"
  StrCpy $Exe "$PLUGINSDIR\verae-print.exe"
  StrCpy $Checked 0
  StrCpy $TokenReady 0
  StrCpy $KeyChoice "skip"
  ${LOG} "installer ${VERSION} start; elevated process; logdir=$LogDir"
FunctionEnd

Function un.onInit
  SetRegView 64
  SetShellVarContext all
FunctionEnd

; ======================= Page: Verae key status / choice =======================
Function KeyPageCreate
  !insertmacro MUI_HEADER_TEXT "Verae signing key" "Timestamps are registered with your Verae account."
  ${If} $Checked == 0
    Banner::show /NOUNLOAD "Checking for an existing Verae key..."
    nsExec::Exec '$PS -File "$PLUGINSDIR\user-token.ps1" -Mode status -IniOut "$PLUGINSDIR\tok.ini"'
    Pop $0
    nsExec::Exec '"$Exe" installer-account --op capabilities --out "$PLUGINSDIR\caps.ini"'
    Pop $1
    Banner::destroy
    ReadINIStr $TargetUser "$PLUGINSDIR\tok.ini" token account
    ReadINIStr $KeyPresent "$PLUGINSDIR\tok.ini" token present
    ReadINIStr $KeyMasked "$PLUGINSDIR\tok.ini" token masked
    ReadINIStr $KeyCheck "$PLUGINSDIR\tok.ini" token check
    ReadINIStr $PolicyText "$PLUGINSDIR\caps.ini" account policyText
    ReadINIStr $InstallApi "$PLUGINSDIR\caps.ini" account installApi
    ${LOG} "key status: user=$TargetUser present=$KeyPresent key=$KeyMasked check=$KeyCheck (ps exit $0); installApi=$InstallApi (exit $1)"
    StrCpy $Checked 1
  ${EndIf}

  nsDialogs::Create 1018
  Pop $Dlg
  ${NSD_CreateLabel} 0 0 100% 12u "Windows user: $TargetUser"
  Pop $0
  ${If} $KeyPresent == "1"
    ${If} $KeyCheck == "valid"
      StrCpy $1 "An existing Verae key was found: $KeyMasked (verified with Verae)."
    ${ElseIf} $KeyCheck == "invalid"
      StrCpy $1 "A saved key was found ($KeyMasked) but Verae REJECTED it. Please sign in or paste a new key."
    ${Else}
      StrCpy $1 "An existing Verae key was found: $KeyMasked (could not verify right now: $KeyCheck)."
    ${EndIf}
  ${Else}
    StrCpy $1 "No Verae key was found for this user. You need one to timestamp documents."
  ${EndIf}
  ${NSD_CreateLabel} 0 14u 100% 20u "$1"
  Pop $0

  ${NSD_CreateRadioButton} 10u 38u 95% 12u "Keep the existing key ($KeyMasked)"
  Pop $hR1
  ${NSD_CreateRadioButton} 10u 52u 95% 12u "Sign in to my Verae account (email + password) and create a key"
  Pop $hR2
  ${NSD_CreateRadioButton} 10u 66u 95% 12u "Create a new Verae account"
  Pop $hR3
  ${NSD_CreateRadioButton} 10u 80u 95% 12u "I already have an xVerae- key - paste it"
  Pop $hR4
  ${NSD_CreateRadioButton} 10u 94u 95% 12u "Skip for now (the printer will ask for a key on first print)"
  Pop $hR5
  ${NSD_CreateLabel} 0 112u 100% 24u "Your password is sent only to customer.verae.ai over HTTPS and is never stored; only the issued key is saved in $TargetUser's profile (.verae\xverae-token)."
  Pop $0

  ${If} $KeyPresent == "1"
  ${AndIf} $KeyCheck != "invalid"
    ${NSD_Check} $hR1
  ${Else}
    EnableWindow $hR1 0
    ${NSD_Check} $hR2
  ${EndIf}
  nsDialogs::Show
FunctionEnd

Function KeyPageLeave
  ${NSD_GetState} $hR1 $0
  ${NSD_GetState} $hR2 $1
  ${NSD_GetState} $hR3 $2
  ${NSD_GetState} $hR4 $3
  ${If} $0 == ${BST_CHECKED}
    StrCpy $KeyChoice "keep"
  ${ElseIf} $1 == ${BST_CHECKED}
    StrCpy $KeyChoice "login"
  ${ElseIf} $2 == ${BST_CHECKED}
    StrCpy $KeyChoice "create"
  ${ElseIf} $3 == ${BST_CHECKED}
    StrCpy $KeyChoice "paste"
  ${Else}
    StrCpy $KeyChoice "skip"
    MessageBox MB_YESNO|MB_ICONEXCLAMATION "Continue without a Verae key?$\r$\n$\r$\nThe printer will be installed, but documents cannot be timestamped until you add a key. On your first print you will be asked for one (or use Start > Verae > Setup signing key)." IDYES +2
    Abort
  ${EndIf}
  StrCpy $TokenReady 0
  StrCpy $PendingId ""
  ${LOG} "key choice: $KeyChoice"
FunctionEnd

; ======================= Page: sign in =======================
Function LoginPageCreate
  ${If} $KeyChoice != "login"
    Abort
  ${EndIf}
  !insertmacro MUI_HEADER_TEXT "Sign in to Verae" "A new signing key will be created for this PC."
  nsDialogs::Create 1018
  Pop $Dlg
  ${NSD_CreateLabel} 0 0 30% 12u "Email"
  Pop $0
  ${NSD_CreateText} 30% 0 70% 12u ""
  Pop $hEmail
  ${NSD_CreateLabel} 0 18u 30% 12u "Password"
  Pop $0
  ${NSD_CreatePassword} 30% 18u 70% 12u ""
  Pop $hPass
  ${NSD_CreateLabel} 0 36u 30% 12u "Authenticator code"
  Pop $0
  ${NSD_CreateText} 30% 36u 30% 12u ""
  Pop $hTotp
  ${NSD_CreateLabel} 62% 37u 38% 12u "(only if you use 2FA)"
  Pop $0
  ${NSD_CreateLabel} 0 60u 100% 24u "Forgot your password or prefer the website? Open the customer portal, create an xVerae- key under Security, then go Back and choose 'paste it'."
  Pop $0
  ${NSD_CreateLink} 0 86u 100% 12u "Open customer.verae.ai in your browser"
  Pop $0
  ${NSD_OnClick} $0 OpenPortal
  ${NSD_SetFocus} $hEmail
  nsDialogs::Show
FunctionEnd

Function OpenPortal
  Pop $0
  ExecShell "open" "${PORTAL_URL}"
FunctionEnd

Function LoginPageLeave
  ${NSD_GetText} $hEmail $1
  ${NSD_GetText} $hPass $2
  ${NSD_GetText} $hTotp $3
  ${If} $1 == ""
  ${OrIf} $2 == ""
    MessageBox MB_ICONEXCLAMATION "Please enter your email and password."
    Abort
  ${EndIf}
  !insertmacro REQ_OPEN "$PLUGINSDIR\req.txt"
  !insertmacro REQ_KV "Email" "$1"
  !insertmacro REQ_KV "Password" "$2"
  !insertmacro REQ_KV "Totp" "$3"
  !insertmacro REQ_CLOSE
  StrCpy $2 ""
  ${LOG} "sign-in attempt"
  Banner::show /NOUNLOAD "Signing in to Verae..."
  nsExec::Exec '"$Exe" installer-account --op login --in "$PLUGINSDIR\req.txt" --out "$PLUGINSDIR\acct.ini" --token-out "$PLUGINSDIR\newtoken.txt"'
  Pop $0
  Banner::destroy
  Delete "$PLUGINSDIR\req.txt"
  Call HandleAccountResult
FunctionEnd

; reads acct.ini; on success sets TokenReady, else Abort (stay on page)
Function HandleAccountResult
  ReadINIStr $4 "$PLUGINSDIR\acct.ini" account result
  ReadINIStr $5 "$PLUGINSDIR\acct.ini" account detail
  ReadINIStr $TokenMasked "$PLUGINSDIR\acct.ini" account masked
  Delete "$PLUGINSDIR\acct.ini"
  ${LOG} "account result: $4 ($5)"
  ${If} $4 == "ok"
    StrCpy $TokenReady 1
    MessageBox MB_ICONINFORMATION "A new Verae key was created for this PC.$\r$\nIt will be saved for $TargetUser."
  ${ElseIf} $4 == "code_sent"
    ; handled by caller
  ${ElseIf} $4 == "totp_required"
    MessageBox MB_ICONINFORMATION "$5"
    ${NSD_SetFocus} $hTotp
    Abort
  ${Else}
    ${If} $4 == ""
      StrCpy $5 "No response from the helper (exit $0)."
    ${EndIf}
    MessageBox MB_ICONEXCLAMATION "Verae said: $5"
    Abort
  ${EndIf}
FunctionEnd

; ======================= Page: create account =======================
Function CreatePageCreate
  ${If} $KeyChoice != "create"
    Abort
  ${EndIf}
  !insertmacro MUI_HEADER_TEXT "Create a Verae account" "Your account holds your timestamps and signing keys."
  nsDialogs::Create 1018
  Pop $Dlg
  ${NSD_CreateLabel} 0 0 30% 12u "Name"
  Pop $0
  ${NSD_CreateText} 30% 0 70% 12u ""
  Pop $hName
  ${NSD_CreateLabel} 0 16u 30% 12u "Email"
  Pop $0
  ${NSD_CreateText} 30% 16u 70% 12u ""
  Pop $hEmail
  ${NSD_CreateLabel} 0 32u 30% 12u "Password"
  Pop $0
  ${NSD_CreatePassword} 30% 32u 70% 12u ""
  Pop $hPass
  ${NSD_CreateLabel} 0 48u 30% 12u "Confirm password"
  Pop $0
  ${NSD_CreatePassword} 30% 48u 70% 12u ""
  Pop $hConfirm
  ${If} $PolicyText == ""
    StrCpy $PolicyText "Password: at least 10 characters, a letter and a number"
  ${EndIf}
  ${NSD_CreateLabel} 30% 64u 70% 20u "$PolicyText"
  Pop $0
  ${If} $InstallApi == "1"
    StrCpy $1 "We will email you a 6-digit code to verify your address."
  ${Else}
    StrCpy $1 "Your account is created immediately (this Verae server does not send verification codes yet)."
  ${EndIf}
  ${NSD_CreateLabel} 0 88u 100% 20u "$1"
  Pop $0
  ${NSD_SetFocus} $hName
  nsDialogs::Show
FunctionEnd

Function CreatePageLeave
  ${NSD_GetText} $hName $1
  ${NSD_GetText} $hEmail $2
  ${NSD_GetText} $hPass $3
  ${NSD_GetText} $hConfirm $6
  ${If} $3 != $6
    MessageBox MB_ICONEXCLAMATION "The passwords do not match."
    Abort
  ${EndIf}
  !insertmacro REQ_OPEN "$PLUGINSDIR\req.txt"
  !insertmacro REQ_KV "Name" "$1"
  !insertmacro REQ_KV "Email" "$2"
  !insertmacro REQ_KV "Password" "$3"
  !insertmacro REQ_KV "Confirm" "$6"
  !insertmacro REQ_CLOSE
  StrCpy $3 ""
  StrCpy $6 ""
  ${LOG} "create-account attempt"
  Banner::show /NOUNLOAD "Creating your Verae account..."
  nsExec::Exec '"$Exe" installer-account --op register --in "$PLUGINSDIR\req.txt" --out "$PLUGINSDIR\acct.ini" --token-out "$PLUGINSDIR\newtoken.txt"'
  Pop $0
  Banner::destroy
  Delete "$PLUGINSDIR\req.txt"
  ReadINIStr $4 "$PLUGINSDIR\acct.ini" account result
  ${If} $4 == "code_sent"
    ReadINIStr $PendingId "$PLUGINSDIR\acct.ini" account pendingId
    ReadINIStr $5 "$PLUGINSDIR\acct.ini" account detail
    ${LOG} "verification code sent"
    Delete "$PLUGINSDIR\acct.ini"
  ${Else}
    Call HandleAccountResult
  ${EndIf}
FunctionEnd

; ======================= Page: email verification code =======================
Function VerifyPageCreate
  ${If} $PendingId == ""
    Abort
  ${EndIf}
  !insertmacro MUI_HEADER_TEXT "Verify your email" "Enter the code we sent you."
  nsDialogs::Create 1018
  Pop $Dlg
  ${NSD_CreateLabel} 0 0 100% 24u "We emailed a 6-digit verification code to the address you entered. It may take a minute; check your spam folder."
  Pop $0
  ${NSD_CreateLabel} 0 30u 30% 12u "Code"
  Pop $0
  ${NSD_CreateText} 30% 30u 30% 12u ""
  Pop $hCode
  ${NSD_CreateButton} 30% 50u 30% 14u "Send a new code"
  Pop $0
  ${NSD_OnClick} $0 ResendCode
  ${NSD_SetFocus} $hCode
  nsDialogs::Show
FunctionEnd

Function ResendCode
  Pop $0
  !insertmacro REQ_OPEN "$PLUGINSDIR\req.txt"
  !insertmacro REQ_KV "PendingId" "$PendingId"
  !insertmacro REQ_CLOSE
  nsExec::Exec '"$Exe" installer-account --op resend --in "$PLUGINSDIR\req.txt" --out "$PLUGINSDIR\acct.ini"'
  Pop $0
  ReadINIStr $5 "$PLUGINSDIR\acct.ini" account detail
  Delete "$PLUGINSDIR\acct.ini"
  MessageBox MB_ICONINFORMATION "$5"
FunctionEnd

Function VerifyPageLeave
  ${NSD_GetText} $hCode $1
  !insertmacro REQ_OPEN "$PLUGINSDIR\req.txt"
  !insertmacro REQ_KV "PendingId" "$PendingId"
  !insertmacro REQ_KV "Code" "$1"
  !insertmacro REQ_CLOSE
  Banner::show /NOUNLOAD "Verifying..."
  nsExec::Exec '"$Exe" installer-account --op verify --in "$PLUGINSDIR\req.txt" --out "$PLUGINSDIR\acct.ini" --token-out "$PLUGINSDIR\newtoken.txt"'
  Pop $0
  Banner::destroy
  Delete "$PLUGINSDIR\req.txt"
  Call HandleAccountResult
FunctionEnd

; ======================= Page: paste key =======================
Function PastePageCreate
  ${If} $KeyChoice != "paste"
    Abort
  ${EndIf}
  !insertmacro MUI_HEADER_TEXT "Paste your Verae key" "Keys start with xVerae- and are shown once when created."
  nsDialogs::Create 1018
  Pop $Dlg
  ${NSD_CreateLabel} 0 0 100% 30u "1. Click the button to open the Verae customer portal and sign in.$\r$\n2. Open Security and create an xVerae- token (it is shown only once).$\r$\n3. Copy it and paste it below, then click Next."
  Pop $0
  ${NSD_CreateButton} 0 34u 60% 14u "Open customer.verae.ai"
  Pop $0
  ${NSD_OnClick} $0 OpenPortal
  ${NSD_CreateLabel} 0 56u 100% 12u "xVerae- key"
  Pop $0
  ${NSD_CreatePassword} 0 70u 100% 12u ""
  Pop $hKey
  ${NSD_SetFocus} $hKey
  nsDialogs::Show
FunctionEnd

Function PastePageLeave
  ${NSD_GetText} $hKey $1
  ${If} $1 == ""
    MessageBox MB_ICONEXCLAMATION "Please paste your key (or go Back and choose Skip)."
    Abort
  ${EndIf}
  FileOpen $9 "$PLUGINSDIR\newtoken.txt" w
  FileWriteWord $9 0xFEFF
  FileWriteUTF16LE $9 "$1"
  FileClose $9
  StrCpy $1 ""
  Banner::show /NOUNLOAD "Checking the key with Verae..."
  nsExec::Exec '"$Exe" validate-key --token-file "$PLUGINSDIR\newtoken.txt" --out "$PLUGINSDIR\val.ini"'
  Pop $0
  Banner::destroy
  ReadINIStr $4 "$PLUGINSDIR\val.ini" validate result
  ReadINIStr $5 "$PLUGINSDIR\val.ini" validate detail
  ReadINIStr $TokenMasked "$PLUGINSDIR\val.ini" validate masked
  Delete "$PLUGINSDIR\val.ini"
  ${LOG} "pasted key $TokenMasked: $4 ($5)"
  ${If} $4 == "valid"
    StrCpy $TokenReady 1
  ${ElseIf} $4 == "invalid"
    Delete "$PLUGINSDIR\newtoken.txt"
    MessageBox MB_ICONEXCLAMATION "Verae rejected this key ($5). Please check it and paste again."
    Abort
  ${ElseIf} $4 == "badformat"
    Delete "$PLUGINSDIR\newtoken.txt"
    MessageBox MB_ICONEXCLAMATION "That does not look like a Verae key: $5"
    Abort
  ${Else}
    MessageBox MB_YESNO|MB_ICONQUESTION "Could not reach Verae to check the key ($5).$\r$\nSave it anyway?" IDYES +3
    Delete "$PLUGINSDIR\newtoken.txt"
    Abort
    StrCpy $TokenReady 1
  ${EndIf}
FunctionEnd

; ======================= Install =======================
!macro STEP_RESULT label value
  StrCpy $FinishText "$FinishText${label}: ${value}$\r$\n"
!macroend

Section "Verae Print Stamp + printer" SecMain
  SectionIn RO
  SetDetailsPrint both
  DetailPrint "Installer log: $LogFile"
  ${LOG} "section start; target=$TargetUser keyChoice=$KeyChoice tokenReady=$TokenReady"

  DetailPrint "Stopping running helper (if any)"
  nsExec::ExecToLog 'schtasks /End /TN "Verae Print Helper"'
  Pop $0
  nsExec::ExecToLog 'taskkill /F /IM verae-printhelper.exe'
  Pop $0

  StrCpy $R9 "OK"
  ClearErrors
  SetOutPath "$INSTDIR\bin"
  File "${SRCDIR}\verae-print.exe"
  File "${SRCDIR}\verae-printhelper.exe"
  SetOutPath "$INSTDIR\scripts"
  File "${SRCDIR}\scripts\common.ps1"
  File "${SRCDIR}\scripts\user-token.ps1"
  File "${SRCDIR}\scripts\install-printer.ps1"
  File "${SRCDIR}\scripts\uninstall-printer.ps1"
  File "${SRCDIR}\scripts\verae-diag.ps1"
  SetOutPath "$INSTDIR"
  File "${SRCDIR}\README-TEST.txt"
  File "${SRCDIR}\LICENSE.txt"
  WriteUninstaller "$INSTDIR\Uninstall.exe"
  ${If} ${Errors}
    StrCpy $R9 "FAIL"
  ${EndIf}
  ${LOG} "files: $R9"
  WriteRegStr HKLM "${UNINST_KEY}" "DisplayName" "${PRODUCT_NAME} ${VERSION}"
  WriteRegStr HKLM "${UNINST_KEY}" "UninstallString" '"$INSTDIR\Uninstall.exe"'
  WriteRegStr HKLM "${UNINST_KEY}" "DisplayVersion" "${VERSION}"
  WriteRegStr HKLM "${UNINST_KEY}" "Publisher" "Verae"

  CreateDirectory "$SMPROGRAMS\Verae"
  CreateShortCut "$SMPROGRAMS\Verae\Verae - Setup signing key.lnk" "$INSTDIR\bin\verae-printhelper.exe" "key-dialog"
  CreateShortCut "$SMPROGRAMS\Verae\Verae - Start print helper.lnk" "$INSTDIR\bin\verae-printhelper.exe"
  CreateShortCut "$SMPROGRAMS\Verae\Verae - Logs folder.lnk" "$WINDIR\explorer.exe" '"$LogDir"'
  CreateShortCut "$SMPROGRAMS\Verae\Verae - Collect diagnostics.lnk" "$WINDIR\System32\WindowsPowerShell\v1.0\powershell.exe" '-NoProfile -ExecutionPolicy Bypass -File "$INSTDIR\scripts\verae-diag.ps1"'
  CreateShortCut "$SMPROGRAMS\Verae\Uninstall Verae Print Stamp (debug).lnk" "$INSTDIR\Uninstall.exe"

  StrCpy $FinishText ""
  !insertmacro STEP_RESULT "Program files" "$R9"

  ; ---- key ----
  ${If} $TokenReady == "1"
    DetailPrint "Saving Verae key ($TokenMasked) for $TargetUser"
    nsExec::ExecToLog '$PS -File "$INSTDIR\scripts\user-token.ps1" -Mode save -TokenFile "$PLUGINSDIR\newtoken.txt" -IniOut "$PLUGINSDIR\save.ini"'
    Pop $0
    Delete "$PLUGINSDIR\newtoken.txt"
    ReadINIStr $1 "$PLUGINSDIR\save.ini" save result
    ReadINIStr $2 "$PLUGINSDIR\save.ini" save path
    ReadINIStr $3 "$PLUGINSDIR\save.ini" save detail
    ${LOG} "key save: $1 $2 $3"
    !insertmacro STEP_RESULT "Verae key" "$1 - $TokenMasked saved to $2 $3"
  ${ElseIf} $KeyChoice == "keep"
    !insertmacro STEP_RESULT "Verae key" "OK - kept existing $KeyMasked"
  ${Else}
    !insertmacro STEP_RESULT "Verae key" "SKIPPED - you will be asked on first print"
  ${EndIf}

  ; ---- printers + helper ----
  DetailPrint "Installing printers and starting the helper (transcript in $LogDir)"
  nsExec::ExecToLog '$PS -File "$INSTDIR\scripts\install-printer.ps1" -InstallDir "$INSTDIR" -ResultIni "$PLUGINSDIR\printer.ini"'
  Pop $0
  ${LOG} "install-printer.ps1 exit=$0"
  ReadINIStr $1 "$PLUGINSDIR\printer.ini" printer task
  ReadINIStr $2 "$PLUGINSDIR\printer.ini" printer helper
  ReadINIStr $3 "$PLUGINSDIR\printer.ini" printer ipp
  ReadINIStr $4 "$PLUGINSDIR\printer.ini" printer fallback
  ReadINIStr $5 "$PLUGINSDIR\printer.ini" printer overall
  ReadINIStr $6 "$PLUGINSDIR\printer.ini" printer spooler
  ReadINIStr $7 "$PLUGINSDIR\printer.ini" printer oplog
  ${If} $5 == ""
    StrCpy $5 "FAIL"
    StrCpy $3 "FAIL - script did not report (exit $0)"
  ${EndIf}
  !insertmacro STEP_RESULT "Print Spooler" "$6"
  !insertmacro STEP_RESULT "PrintService log" "$7"
  !insertmacro STEP_RESULT "Helper autostart task" "$1"
  !insertmacro STEP_RESULT "Helper running as you" "$2"
  !insertmacro STEP_RESULT "Printer 'Verae TimeStamp PDF'" "$3"
  !insertmacro STEP_RESULT "Printer '(Local Port)'" "$4"
  ${LOG} "results: spooler=$6 oplog=$7 task=$1 helper=$2 ipp=$3 fallback=$4 overall=$5"

  ${If} $5 == "OK"
    StrCpy $FinishTitle "Verae TimeStamp PDF is installed"
    StrCpy $FinishText "$FinishText$\r$\nPrint from any app and choose 'Verae TimeStamp PDF'. Results go to Documents\Verae Timestamps."
  ${Else}
    StrCpy $FinishTitle "Installed with problems"
    DetailPrint "Problem detected - collecting diagnostics"
    nsExec::ExecToLog '$PS -File "$INSTDIR\scripts\verae-diag.ps1" -OutDir "$LogDir"'
    Pop $0
    ${LOG} "diagnostics collected (exit $0)"
    StrCpy $FinishText "$FinishText$\r$\nA diagnostics zip (verae-diag-*.zip) was saved in the logs folder. Please send it to support."
  ${EndIf}
  ${LOG} "section end"
  ${GetTime} "" "L" $R1 $R2 $R3 $R4 $R5 $R6 $R7
  Push "$LogDir\installer-details-$R3$R2$R1-$R5$R6$R7.log"
  Call DumpLog
SectionEnd

Section "Uninstall"
  nsExec::ExecToLog '"$WINDIR\Sysnative\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -NonInteractive -ExecutionPolicy Bypass -WindowStyle Hidden -File "$INSTDIR\scripts\uninstall-printer.ps1"'
  Pop $0
  nsExec::ExecToLog 'taskkill /F /IM verae-printhelper.exe'
  Pop $0
  Delete "$INSTDIR\bin\verae-print.exe"
  Delete "$INSTDIR\bin\verae-printhelper.exe"
  RMDir "$INSTDIR\bin"
  Delete "$INSTDIR\scripts\*.ps1"
  RMDir "$INSTDIR\scripts"
  Delete "$INSTDIR\README-TEST.txt"
  Delete "$INSTDIR\LICENSE.txt"
  Delete "$INSTDIR\Uninstall.exe"
  RMDir "$INSTDIR"
  Delete "$SMPROGRAMS\Verae\*.lnk"
  RMDir "$SMPROGRAMS\Verae"
  DeleteRegKey HKLM "${UNINST_KEY}"
  DeleteRegKey HKLM "Software\Verae\PrintStamp"
  ; logs and the user's .verae\xverae-token are kept on purpose
SectionEnd