Multi_Package_Manager.sh

#!/usr/bin/env bash
set -euo pipefail

# =============================================================================================================================================================
#  Multi Package Manager (MPM)
#  Skrypt do zarządzania instalacją, aktualizacją, reinstalacją i usuwaniem wielu pakietów na systemach Debian/Ubuntu.
#
#  Autor:             ${SCRIPT_AUTHOR}
#  GitHub:            ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
#  Postawienie kawy:  ${SCRIPT_SUPPORT_LINK} (w pełni opcjonalne wsparcie)
#
#  Aktualnie obsługiwane pakiety:
#    1. Discord              — gamingowy komunikator VoIP
#    2. Proton Authenticator — aplikacja 2FA od Proton AG
#    3. Proton Pass          — menedżer haseł od Proton AG
#    4. Yubico Authenticator — aplikacja do obsługi YubiKey
#
#  Źródła pobierania:
#    - Discord:     ${DISCORD_URL}
#    - Prot. Auth.: ${PROTON_AUTH_DEB_URL}
#    - Prot. Pass:  ${PROTON_PASS_DEB_URL}
#    - Yubico:      Delegowane do skryptu install-yubico-authenticator.sh
#
#  Stan weryfikacji sum kontrolnych przez ten skrypt:
#    - Discord:           BRAK (Discord nie publikuje oficjalnych sum kontrolnych)
#    - Proton Auth./Pass: SHA512 z pliku version.json (oficjalna metoda Proton AG)
#    - Yubico:            BRAK (Delegowane do skryptu zewnętrznego)
#
#  Katalogi i pliki używane przez skrypt:
#    /old						← backup poprzednich wersji skryptów (tworzony przez skrypt)
#    mpm.conf						← opcjonalny plik konfiguracji (dostarczany ze skryptem)
#    /var/lib/multi_package_manager_config_and_logs	← katalog logów i stanu (tworzony przez skrypt)
#      ├── multi_package_manager_logs.txt		← logi skryptu
#      └── yubico_software_installed_version.txt	← wersja zainstalowanego oprogramowania od Yubico
#
#  Konfiguracja:
#    Modyfikuj plik 'mpm.conf' znajdujący się w tym samym katalogu co ten skrypt.
#    Plik 'mpm.conf' musi znajdować się w tym samym katalogu co ten skrypt.
#    Więcej informacji znajdziesz w komentarzach wewnątrz pliku 'mpm.conf'.
#
#  Zgłaszanie błędów:
#    Jeśli znajdziesz błąd, otwórz issue na GitHub: ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}/issues
#
#  Wsparcie projektu:
#    Jeśli korzystasz z tego skryptu, rozważ nadanie gwiazdki na GitHub!
#    ⭐ ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
#
#  Wymagania systemowe:
#    - Dystrybucja oparta na Debian/Ubuntu
#    - Uprawnienia do polecenia sudo (skrypt nie może być pod żadnym pozorem uruchamiany z poleceniem "sudo nazwa_skryptu")
#    - Wykorzystywane narzędzia: curl, dpkg, grep, awk, jq, sha512sum, sha256sum, sudo, find, realpath, tar
# =============================================================================================================================================================

# =============================================================================================================================================================
#  Copyright 2026 https://www.github.com/fabiangamer2215
#  
#  LICENCJA:
#    - Użytkowanie jest dozwolone w celach własnych lub komercyjnych.
#    - Dozwolone są modyfikacje do użytku prywatnego lub modyfikacje do użytku wewnątrz własnej firmy.
#    - Dystrybucja oryginalnej wersji (bez naniesionych zmian) jest w pełni dozwolona.
#    - Dystrybucja zmodyfikowanej wersji (publiczna lub komercyjna) wymaga pisemnej zgody autora.
#    - Dozwolone jest sugerowanie zmian i cytowanie kodu na stronie GitHub autora.
# =============================================================================================================================================================
#  ZASTRZEŻENIA PRAWNE I ZNAKI HANDLOWE:
#
#  Ten skrypt jest projektem niezależnym i nie jest w żaden sposób powiązany z żadną z wymienionych w tym skrypcie firm ani ich produktami.
#  Autor skryptu nie jest pracownikiem, partnerem ani oficjalnym przedstawicielem którejkolwiek z tych firm.
#
#  Wszystkie nazwy plików, firm, produktów i usług użyte w tym skrypcie są znakami towarowymi należącymi do ich właścicieli.
#  Zostały one użyte wyłącznie w celu identyfikacji oprogramowania, którego zarządzaniem zajmuje się ten skrypt.
#  Użycie tych nazw nie sugeruje żadnego oficjalnego wsparcia, sponsorowania ani afiliacji.
#
#  Lista znaków towarowych i ich właścicieli:
#    • „Discord" jest znakiem towarowym firmy Discord Inc.
#    • „Proton", „Proton Authenticator" i „Proton Pass" są znakami towarowymi firmy Proton AG.
#    • „Yubico" i „YubiKey" są znakami towarowymi firmy Yubico AB.
#
#  Nazwy pakietów systemowych (np. „proton-pass", „proton-authenticator", „discord") użyte w skrypcie,
#  odpowiadają rzeczywistym nazwom pakietów .deb tworzonym przez odpowiednich producentów oprogramowania
#  i są używane wyłącznie do interakcji z systemem zarządzania pakietami (dpkg/apt).
#
#  Pobieranie odbywa się wyłącznie z oficjalnych źródeł dostarczonych przez producentów oprogramowania.
#  Skrypt nie modyfikuje ani nie redystrybuuje pobieranych pakietów — instaluje je w oryginalnej formie
#
#  Oprogramowanie install-yubico-authenticator.sh zostało stworzone przez firmę Yubico AB, do niej też należą prawa autorskie do tego pliku i jego zawartości.
#  "Multi Package Manager (MPM)" jedyne co robi z tym skryptem to jego wywołanie, weryfikacja postępu działań, weryfikacja istnienia tego pliku, etc..
#  Jest to zatem zależność dla "Multi Package Manager (MPM)".
# =============================================================================================================================================================
#  KONTAKT W SPRAWIE NARUSZEŃ PRAW AUTORSKICH:
#    - Jeśli uważasz, że ten projekt narusza twoje prawa autorskie, proszę o kontakt na oficjalnym GitHub projektu.
#
#    Proszę wtedy o dostarczenie:
#      - Linku do oryginalnego materiału
#      - Opisu naruszenia
#      - Twoich danych kontaktowych
#      - Oświadczenia o dobrej wierze
#  
#  OGRANICZENIE ODPOWIEDZIALNOŚCI:
#    - Kod jest dostarczany bez żadnych gwarancji. Autor nie ponosi odpowiedzialności za szkody wynikające z użycia tego oprogramowania.
# =============================================================================================================================================================

# ============================================================================
# === 1. KONFIGURACJA GŁÓWNA — Zmienne globalne i ścieżki ====================
# ============================================================================

SCRIPT_VERSION="1.0.0"
SCRIPT_AUTHOR="fabiangamer2215"
SCRIPT_GITHUB="https://github.com/fabiangamer2215"
SCRIPT_REPO_NAME="Multi_Package_Manager"
SCRIPT_SUPPORT_LINK="https://cuplink.to/fabiangamer2215"

# Adres API GitHub Releases używany przez self-update.
# Można go nadpisać zmienną środowiskową MPM_SELF_UPDATE_API_URL, np. do testów.
SELF_UPDATE_API_URL="${MPM_SELF_UPDATE_API_URL:-https://api.github.com/repos/${SCRIPT_AUTHOR}/${SCRIPT_REPO_NAME}/releases/latest}"

# Ścieżki do katalogu konfiguracyjnego, pliku logów oraz zapisu wersji Yubico
CONFIG_DIR="/var/lib/multi_package_manager_config_and_logs"
LOG_FILE="$CONFIG_DIR/multi_package_manager_logs.txt"
YUBICO_VERSION_FILE="$CONFIG_DIR/yubico_software_installed_version.txt"

# Tymczasowy katalog roboczy usuwany automatycznie przy wyjściu ze skryptu
TMP_BASE="$(mktemp -d -t mpm_XXXXXX)"
cleanup_tmp() {
    rm -rf "$TMP_BASE"
}
trap cleanup_tmp EXIT
trap 'cleanup_tmp; trap - EXIT; exit 130' INT
trap 'cleanup_tmp; trap - EXIT; exit 143' TERM

# Adresy URL i nazwy plików dla wspieranych aplikacji
DISCORD_URL="https://discord.com/api/download?platform=linux&format=deb"
PROTON_AUTH_DEB_URL="https://proton.me/download/authenticator/linux/ProtonAuthenticator.deb"
PROTON_AUTH_JSON_URL="https://proton.me/download/authenticator/linux/version.json"
PROTON_AUTH_DEB_FILENAME="ProtonAuthenticator.deb"
PROTON_PASS_DEB_URL="https://proton.me/download/pass/linux/ProtonPass.deb"
PROTON_PASS_JSON_URL="https://proton.me/download/pass/linux/version.json"
PROTON_PASS_DEB_FILENAME="ProtonPass.deb"
YUBICO_RELEASES_URL="https://developers.yubico.com/yubioath-flutter/Releases/"
YUBICO_SCRIPT_NAME="install-yubico-authenticator.sh"

# Automatyczne wykrywanie lokalizacji zewnętrznego skryptu instalacyjnego Yubico
SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
YUBICO_SCRIPT=""
if [[ -f "$SCRIPT_DIR/$YUBICO_SCRIPT_NAME" ]]; then
    YUBICO_SCRIPT="$SCRIPT_DIR/$YUBICO_SCRIPT_NAME"
fi

# Listy wspieranych pakietów oraz wymaganych zależności systemowych
SUPPORTED_PACKAGES=("discord" "proton-authenticator" "proton-pass" "yubico")
REQUIRED_DEPS=("curl" "dpkg" "grep" "awk" "jq" "sudo" "find" "sha512sum" "sha256sum" "realpath" "tar")

# Domyślne wartości konfiguracji (zostaną zastąpione przez mpm.conf)
declare -A CONFIG_DEFAULTS=(
    [LANGUAGE]="auto"
    [AUTO_UPDATE_CHECK]="true"
    [BACKUP_KEEP_COUNT]="1"
    [SHOW_GITHUB_PROMO]="true"
    [LOG_LEVEL]="full"
)

# Zmienne do przechowywania ustawień z pliku konfiguracyjnego
LANGUAGE_CODE="${CONFIG_DEFAULTS[LANGUAGE]}"
AUTO_UPDATE_CHECK="${CONFIG_DEFAULTS[AUTO_UPDATE_CHECK]}"
BACKUP_KEEP_COUNT="${CONFIG_DEFAULTS[BACKUP_KEEP_COUNT]}"
SHOW_GITHUB_PROMO="${CONFIG_DEFAULTS[SHOW_GITHUB_PROMO]}"
LOG_LEVEL="${CONFIG_DEFAULTS[LOG_LEVEL]}"
CONFIG_LOADED="false"

# Jeśli użytkownik poda --lang w CLI, ta zmienna przechowuje jawne nadpisanie.
CLI_LANGUAGE_OVERRIDE=""

# ============================================================================
# === 2. SYSTEM TŁUMACZEŃ — PL ↔ EN ==========================================
# ============================================================================

# Słownik tłumaczeń dla wszystkich komunikatów użytkownika (PL)
declare -A TXT_PL=(
    [BANNER_NOTE]="Ten skrypt jest obsługiwany TYLKO na systemach z rodziny Debian/Ubuntu."
    [CMD_CHECK]="Sprawdzenie wersji"
    [CMD_CHECK_SELF]="Sprawdzenie aktualizacji samego skryptu"
    [STATUS_DOWNLOADING]="Pobieranie..."
    [STATUS_INSTALLING]="Instalowanie..."
    [STATUS_REMOVING]="Usuwanie..."
    [STATUS_VERIFYING]="Weryfikowanie..."
    [STATUS_SUCCESS]="SUKCES"
    [STATUS_ERROR]="BŁĄD"
    [STATUS_WARNING]="⚠️ OSTRZEŻENIE"
    [STATUS_INFO]="INFO"
    [VER_INSTALLED]="Zainstalowana:"
    [VER_LATEST]="Najnowsza:"
    [VER_UNKNOWN]="nieznana"
    [VER_NONE]="brak"
    [OP_ALREADY_INSTALLED]="✔ JUŻ ZAINSTALOWANY"
    [OP_INSTALLING]="📥 INSTALACJA"
    [OP_UPDATING]="🔄 AKTUALIZACJA"
    [OP_LATEST]="✓ NAJNOWSZA WERSJA"
    [OP_REINSTALLING]="🔄 PRZEINSTALOWANIE"
    [OP_REMOVING]="🗑️ USUWANIE"
    [MSG_DL_DISCORD]="Discord z oficjalnego źródła..."
    [MSG_DL_PROTON_AUTH]="Proton Authenticator (.deb) z oficjalnego serwera..."
    [MSG_DL_VERSION_JSON]="version.json z sumą kontrolną SHA512..."
    [MSG_VERIFY_SHA512]="sumy kontrolnej SHA512..."
    [MSG_INST_PROTON_AUTH]="pakiet Proton Authenticator..."
    [MSG_DL_PROTON_PASS]="Proton Pass (.deb) z oficjalnego serwera..."
    [MSG_INST_PROTON_PASS]="pakiet Proton Pass..."
    [MSG_DL_YUBICO_VER]="informacji o wersji Yubico Authenticator..."
    [MSG_INST_YUBICO_EXT]="Yubico Authenticator przez zewnętrzny skrypt..."
    [PROTON_RETRIEVED]="Pobrano version.json z:"
    [PROTON_SOURCE]="Źródło:"
    [PROTON_CHECK_STRUCT]="Sprawdź strukturę JSON ze źródła:"
    [MSG_EXECUTING]="Wykonywanie"
    [MSG_ON_ALL_PACKAGES]="na wszystkich pakietach..."
    [MSG_COMPLETED]="Zakończono"
    [MSG_COMPLETED_SUFFIX]="na wszystkich pakietach."
    [MSG_ENCOUNTERED_ERRORS]="napotkała błędy w"
    [MSG_OPERATION]="Operacja"
    [MSG_PACKAGE_LOCATIVE]="pakiecie"
    [MSG_PACKAGES_LOCATIVE]="pakietach"
    [ERR_MISSING_CMD]="Nie znaleziono wymaganego polecenia:"
    [ERR_DOWNLOAD_FAIL]="Nie udało się pobrać!"
    [ERR_VERIFY_FAIL]="Weryfikacja sumy kontrolnej nie powiodła się!"
    [ERR_NOT_FOUND]="Nie znaleziono:"
    [ERR_UNKNOWN_ACTION]="Nieznana akcja"
    [ERR_UNKNOWN_PACKAGE]="Nieznany pakiet"
    [ERR_INSTALL_FAIL]="Nie udało się zainstalować pakietu: %s."
    [ERR_REMOVE_FAIL]="Nie udało się usunąć pakietu: %s."
    [ERR_DISTRO_UNSUPPORTED]="Ten skrypt obsługuje tylko systemy z rodziny Debian/Ubuntu."
    [ERR_INVALID_DEB]="Plik nie jest poprawnym pakietem .deb."
    [CFG_FILE_INFO]="Ładowanie konfiguracji z:"
    [CFG_LOAD_SUCCESS]="Konfiguracja załadowana pomyślnie."
    [INFO_SUDO_REQUIRED]="Do działania skryptu oraz tworzenia logów wymagane są uprawnienia administratora (sudo)."
    [CFG_NOT_FOUND]="Nie znaleziono pliku konfiguracyjnego w"
    [CFG_USING_DEFAULTS]="używam wartości domyślnych."
    [CFG_FORCE_LANG]="Wymuszenie języka:"
    [CFG_AUTO_LANG]="Auto-detekcja języka:"
    [CFG_INVALID_LANGUAGE_CODE]="Nieprawidłowy kod języka: %s (używam wykrytego/domyślnego)"
    [CFG_INVALID_VAL_DEFAULT]="Nieprawidłowa wartość %s: %s (używam domyślnej: %s)"
    [MIGRATE_HIDDEN_MSG]="Zalecane jest przeniesienie skryptu do ukrytego katalogu ~/.mpm/"
    [MIGRATE_HIDDEN_CMD]="Komenda migracji:"
    [MIGRATE_SUCCESS]="Migracja zakończona sukcesem!"
    [MIGRATE_SUCCESS_EXIT_COMMAND]="Aby użyć w tej sesji, wykonaj tę komendę (w przeciwnym razie uruchom ponownie terminal):"
    [MIGRATE_ALREADY_EXISTS]="Katalog %s już istnieje"
    [MIGRATE_CREATE_DIR]="Tworzę katalog: ~/.mpm/"
    [MIGRATE_MOVE]="Przenoszę skrypt do ~/.mpm/"
    [MIGRATE_HOW_RUN]="Od teraz uruchamiaj skrypt jedną z metod:"
    [SCRIPT_PATH]="Multi_Package_Manager.sh"
    [SCRIPT_NAME]="Multi_Package_Manager.sh"
    [GH_ISSUES_MSG]="Jeśli znajdziesz błąd, otwórz issue na GitHub:"
    [SELF_CHECKING]="Sprawdzanie aktualizacji samego skryptu..."
    [SELF_REMOTE_ERR]="Nie udało się pobrać informacji o wersji z GitHub."
    [SELF_NEW_VERSION]="Dostępna jest nowa wersja skryptu:"
    [SELF_UPDATE_IN_PROGRESS]="Pobieranie najnowszej wersji skryptu..."
    [SELF_UPDATE_FAIL]="Nie udało się pobrać nowego skryptu."
    [SELF_UPDATE_SUCCESS]="Skrypt został pomyślnie zaktualizowany!"
    [SELF_UPDATE_RESTART]="Uruchom skrypt ponownie."
    [SELF_FORCE_HINT]="Wymuszenie: MPM_FORCE_UPDATE=1 <komenda> --update-self"
    [SELF_UPDATE_COMMAND_HINT]="Aktualizuj poleceniem:"
    [SELF_DOWNLOAD_MAIN_FAIL]="Nie udało się pobrać głównego skryptu."
    [SELF_INVALID_MAIN]="Pobrany główny skrypt jest niepoprawny (brak SCRIPT_VERSION lub błąd składni)."
    [SELF_OVERWRITE_FAIL]="Nie udało się nadpisać głównego skryptu."
    [SELF_OVERWRITE_MAIN]="Nadpisywanie bieżącego głównego skryptu..."
    [SELF_INVALID_YUBICO]="Pobrany skrypt Yubico jest niepoprawny."
    [SELF_OVERWRITE_YUBICO_FAIL]="Nie udało się nadpisać skryptu Yubico."
    [SELF_MAIN_UPDATED_YUBICO_NOT]="Główny skrypt został zaktualizowany, ale skrypt Yubico nie został zaktualizowany."
    [SELF_ASSET_NOT_FOUND]="Nie znaleziono pliku %s w najnowszej wersji release."
    [SELF_VERSION_MISMATCH]="Wersja pobranego skryptu (%s) nie zgadza się z wersją release (%s)."
    [SELF_CHECKSUM_NOT_FOUND]="Nie znaleziono pliku SHA256SUMS w release. Aktualizacja przerwana — suma kontrolna jest wymagana."
    [SELF_CHECKSUM_OK]="Suma kontrolna SHA256 zgodna dla: %s"
    [SELF_CHECKSUM_MISMATCH]="Niezgodność sumy kontrolnej SHA256 dla: %s"
    [SELF_CHECKSUM_MISSING_ENTRY]="Brak wpisu sumy kontrolnej SHA256 dla: %s"
    [SELF_CHECKSUM_VERIFY_FAIL]="Nie udało się pobrać lub przetworzyć pliku SHA256SUMS. Aktualizacja przerwana — suma kontrolna jest wymagana."
    [YUBICO_NOT_FOUND]="Nie znaleziono skryptu Yubico!"
    [YUBICO_UPDATE_START]="Aktualizacja skryptu Yubico..."
    [YUBICO_UPDATE_SUCCESS]="Skrypt Yubico zaktualizowany wraz z głównym skryptem."
    [YUBICO_UPDATE_SKIP]="Nie znaleziono skryptu Yubico — pominięto jego aktualizację."
    [YUBICO_ALREADY_INSTALLED]="Yubico Authenticator jest już zainstalowany (wersja:"
    [YUBICO_FOUND]="Znaleziono skrypt Yubico:"
    [YUBICO_VER_SAVED]="Wersja Yubico zapisana w pliku stanu:"
    [YUBICO_EXT_SUCCESS]="Zewnętrzny skrypt Yubico zakończył działanie pomyślnie."
    [YUBICO_INST_SUCCESS_NO_VER]="Instalacja zakończona sukcesem, ale nie udało się wyodrębnić wersji z URL."
    [YUBICO_REMOVED]="Yubico Authenticator usunięty."
    [YUBICO_PLACE_FILE]="Umieść plik:"
    [DEPS_CHECKING]="Sprawdzanie zależności skryptu..."
    [DEPS_MISSING]="Brakujące zależności:"
    [DEPS_INSTALLING]="Instalowanie brakujących zależności przez apt..."
    [DEPS_DONE]="Zależności zainstalowane."
    [DEPS_ALL_OK]="Wszystkie zależności skryptu są dostępne."
    [DEPS_INSTALL_COREUTILS]="Zainstaluj pakiet coreutils."
    [DISTRO_DETECT_FAIL]="Nie można odczytać /etc/os-release. Nie można określić dystrybucji."
    [DISTRO_DETECTED_OK]="Wykryto system z rodziny Debian/Ubuntu:"
    [DISTRO_DETAILS]="Szczegóły dystrybucji:"
    [SEP_FULL]="═══════════════════════════════════════════════════════════════════════"
    [MIGRATE_RUN_HINT]="Po migracji uruchamiaj skrypt tak (w dowolnym katalogu terminala):"
    [LANG_INFO_POLISH]="Polski (wykryty automatycznie lub wymuszony)"
    [LANG_INFO_ENGLISH]="Angielski (domyślny fallback)"
    [MIGRATE_MOVE_CONF]="Przeniesiono mpm.conf"
    [MIGRATE_MOVE_YUBICO]="Przeniesiono install-yubico-authenticator.sh"
    [MIGRATE_MOVE_OLD]="Przeniesiono katalog /old"
    [MIGRATE_PATH_ADDED]="Dodano automatycznie wpis PATH do ~/.bashrc"
    [INFO_REFRESH_DB]="Odświeżanie bazy danych .desktop..."
    [ERR_MISSING_PKG_NAME]="Brak nazwy pakietu! Użycie:"
    [ERR_MISSING_PKG]="Brak nazwy pakietu!"
    [ERR_UNKNOWN_CMD]="Nieznana komenda:"
    [ERR_DISCORD_LATEST_FAIL]="Nie udało się pobrać informacji o najnowszej wersji Discord."
    [ERR_YUBICO_URL_FAIL]="Nie udało się pobrać adresu pobierania Yubico Authenticator."
    [ERR_YUBICO_SCRIPT_FAIL]="Zewnętrzny skrypt Yubico zakończył się błędem."
    [DISCORD_INSTALLED_OK]="Discord zainstalowany pomyślnie."
    [DISCORD_NO_CHECKSUM]="Discord nie udostępnia oficjalnych sum kontrolnych — weryfikacja pominięta."
    [DISCORD_REMOVED]="Discord został usunięty."
    [DISCORD_NOT_INSTALLED]="Discord nie jest zainstalowany."
    [DISCORD_ALREADY_INSTALLED]="Discord jest już zainstalowany (wersja:"
    [PROTON_AUTH_INSTALLED_OK]="Proton Authenticator zainstalowany pomyślnie."
    [PROTON_AUTH_NOT_INSTALLED]="Proton Authenticator nie jest zainstalowany."
    [PROTON_AUTH_REMOVED]="Proton Authenticator został usunięty."
    [PROTON_AUTH_ALREADY_INSTALLED]="Proton Authenticator jest już zainstalowany (wersja:"
    [PROTON_PASS_INSTALLED_OK]="Proton Pass zainstalowany pomyślnie."
    [PROTON_PASS_NOT_INSTALLED]="Proton Pass nie jest zainstalowany."
    [PROTON_PASS_REMOVED]="Proton Pass został usunięty."
    [PROTON_PASS_ALREADY_INSTALLED]="Proton Pass jest już zainstalowany (wersja:"
    [VERIFY_BLOCK_FAIL_CLOSED]="Instalacja zablokowana (Fail-Closed) z powodu braku możliwości weryfikacji pliku."
    [VERIFY_BLOCK_NO_CHECKSUM]="Instalacja zablokowana (Fail-Closed) z powodu braku sumy kontrolnej."
    [VERIFY_SHA_MATCH]="Suma kontrolna SHA512 zgadza się — plik jest autentyczny."
    [VERIFY_SHA_MISMATCH]="Niezgodność sumy kontrolnej SHA512!"
    [VERIFY_EXPECTED]="Oczekiwana:"
    [VERIFY_COMPUTED]="Wyliczona:"
    [VERIFY_CORRUPTED]="Plik może być uszkodzony lub zmodyfikowany. Instalacja przerwana."
    [ERR_EXTRACT_SHA]="Nie udało się wyciągnąć SHA512 z pliku JSON."
    [INFO_USE_REINSTALL]="Użyj opcji --reinstall aby zainstalować ponownie."
    [INFO_CANT_CHECK_VERSION]="Nie udało się sprawdzić najnowszej wersji online. Pobieram i instaluję najnowszy pakiet..."
    [VERIFY_APP_OK]="Weryfikacja: %s ZAINSTALOWANY (wersja: %s)"
    [VERIFY_APP_FAIL]="Weryfikacja: %s NIEZAINSTALOWANY"
    [CHECK_ALL_TITLE]="SPRAWDZANIE WSZYSTKICH PAKIETÓW"
    [MIGRATE_NO_SUDO]="Nie uruchamiaj --migrate-to-hidden przez sudo. Uruchom jako zwykły użytkownik."
    [MSG_INST_DISCORD]="pakiet Discord..."
    [INFO_SUPPORTED_PACKAGES]="Obsługiwane pakiety:"
    [SCRIPT_NAME_MISMATCH]="Niezgodna nazwa pliku: %s zamiast %s"
    [SCRIPT_NAME_RENAME_WARNING]="Zmiana nazwy skryptu może powodować błędy samodzielnej aktualizacji."
    [SCRIPT_NAME_RESTORE]="Przywróć oryginalną nazwę pliku: %s"
    [BACKUP_FILE]="Plik kopii zapasowej:"
    [BACKUP_REMOVING_OLD]="Usuwanie starego backupu:"
    [BACKUP_PREVIOUS_SAVED]="Poprzednie wersje zapisano w:"
    [BACKUP_RESTORE_HINT]="Aby przywrócić poprzednią wersję, sprawdź pliki w:"
    [ERR_ROOT_FORBIDDEN]="Ten skrypt nie może być uruchamiany z uprawnieniami roota (sudo). Uruchom go jako zwykły użytkownik."
)

# Słownik tłumaczeń dla wszystkich komunikatów użytkownika (EN)
declare -A TXT_EN=(
    [BANNER_NOTE]="This script only works on Debian/Ubuntu-based systems."
    [CMD_CHECK]="Check version"
    [CMD_CHECK_SELF]="Check script self-update"
    [STATUS_DOWNLOADING]="Downloading..."
    [STATUS_INSTALLING]="Installing..."
    [STATUS_REMOVING]="Removing..."
    [STATUS_VERIFYING]="Verifying..."
    [STATUS_SUCCESS]="SUCCESS"
    [STATUS_ERROR]="ERROR"
    [STATUS_WARNING]="⚠️ WARNING"
    [STATUS_INFO]="INFO"
    [VER_INSTALLED]="Installed:"
    [VER_LATEST]="Latest:"
    [VER_UNKNOWN]="unknown"
    [VER_NONE]="none"
    [OP_ALREADY_INSTALLED]="✔ ALREADY INSTALLED"
    [OP_INSTALLING]="📥 INSTALLATION"
    [OP_UPDATING]="🔄 UPDATE"
    [OP_LATEST]="✓ LATEST VERSION"
    [OP_REINSTALLING]="🔄 REINSTALLATION"
    [OP_REMOVING]="🗑️ REMOVING"
    [MSG_DL_DISCORD]="Discord from official source..."
    [MSG_DL_PROTON_AUTH]="Proton Authenticator (.deb) from official server..."
    [MSG_DL_VERSION_JSON]="version.json with SHA512 checksum..."
    [MSG_VERIFY_SHA512]="SHA512 checksum..."
    [MSG_INST_PROTON_AUTH]="Proton Authenticator package..."
    [MSG_DL_PROTON_PASS]="Proton Pass (.deb) from official server..."
    [MSG_INST_PROTON_PASS]="Proton Pass package..."
    [MSG_DL_YUBICO_VER]="Yubico Authenticator version information..."
    [MSG_INST_YUBICO_EXT]="Yubico Authenticator via external script..."
    [PROTON_RETRIEVED]="Retrieved version.json from:"
    [PROTON_SOURCE]="Source:"
    [PROTON_CHECK_STRUCT]="Check JSON structure from source:"
    [MSG_EXECUTING]="Executing"
    [MSG_ON_ALL_PACKAGES]="on all packages..."
    [MSG_COMPLETED]="Completed"
    [MSG_COMPLETED_SUFFIX]="on all packages."
    [MSG_ENCOUNTERED_ERRORS]="encountered errors in"
    [MSG_OPERATION]="Operation"
    [MSG_PACKAGE_LOCATIVE]="package"
    [MSG_PACKAGES_LOCATIVE]="packages"
    [ERR_MISSING_CMD]="Missing required command:"
    [ERR_DOWNLOAD_FAIL]="Failed to download!"
    [ERR_VERIFY_FAIL]="Checksum verification failed!"
    [ERR_NOT_FOUND]="Not found:"
    [ERR_UNKNOWN_ACTION]="Unknown action"
    [ERR_UNKNOWN_PACKAGE]="Unknown package"
    [ERR_INSTALL_FAIL]="Failed to install package: %s."
    [ERR_REMOVE_FAIL]="Failed to remove package: %s."
    [ERR_DISTRO_UNSUPPORTED]="This script only works on Debian/Ubuntu-based systems."
    [ERR_INVALID_DEB]="The file is not a valid .deb package."
    [CFG_FILE_INFO]="Loading config from:"
    [CFG_LOAD_SUCCESS]="Config loaded successfully."
    [INFO_SUDO_REQUIRED]="Administrator privileges (sudo) are required for script operation and log creation."
    [CFG_NOT_FOUND]="Config file not found at"
    [CFG_USING_DEFAULTS]="using defaults."
    [CFG_FORCE_LANG]="Force language:"
    [CFG_AUTO_LANG]="Auto-detected system language:"
    [CFG_INVALID_LANGUAGE_CODE]="Invalid language code: %s (using detected/default)"
    [CFG_INVALID_VAL_DEFAULT]="Invalid value %s: %s (using default: %s)"
    [MIGRATE_HIDDEN_MSG]="It is recommended that you move the script to the hidden directory ~/.mpm/"
    [MIGRATE_HIDDEN_CMD]="Migration command:"
    [MIGRATE_SUCCESS]="Migration completed successfully!"
    [MIGRATE_SUCCESS_EXIT_COMMAND]="To use it in this session, run this command (otherwise restart the terminal):"
    [MIGRATE_ALREADY_EXISTS]="Directory %s already exists"
    [MIGRATE_CREATE_DIR]="Creating directory: ~/.mpm/"
    [MIGRATE_MOVE]="Moving script to ~/.mpm/"
    [MIGRATE_HOW_RUN]="From now, run script with one of these methods:"
    [SCRIPT_PATH]="Multi_Package_Manager.sh"
    [SCRIPT_NAME]="Multi_Package_Manager.sh"
    [GH_ISSUES_MSG]="If you find a bug, open an issue on GitHub:"
    [SELF_CHECKING]="Checking script self-update..."
    [SELF_REMOTE_ERR]="Failed to get version information from GitHub."
    [SELF_NEW_VERSION]="New script version available:"
    [SELF_UPDATE_IN_PROGRESS]="Downloading latest script version..."
    [SELF_UPDATE_FAIL]="Failed to download new script."
    [SELF_UPDATE_SUCCESS]="Script updated successfully!"
    [SELF_UPDATE_RESTART]="Run script again."
    [SELF_FORCE_HINT]="Force with: MPM_FORCE_UPDATE=1 <command> --update-self"
    [SELF_UPDATE_COMMAND_HINT]="Update with:"
    [SELF_DOWNLOAD_MAIN_FAIL]="Failed to download the main script."
    [SELF_INVALID_MAIN]="Downloaded main script is invalid (missing SCRIPT_VERSION or syntax error)."
    [SELF_OVERWRITE_FAIL]="Failed to overwrite the main script."
    [SELF_OVERWRITE_MAIN]="Overwriting current main script..."
    [SELF_INVALID_YUBICO]="Downloaded Yubico script is invalid."
    [SELF_OVERWRITE_YUBICO_FAIL]="Failed to overwrite the Yubico script."
    [SELF_MAIN_UPDATED_YUBICO_NOT]="Main script was updated, but the Yubico script was not updated."
    [SELF_ASSET_NOT_FOUND]="Asset %s not found in latest release."
    [SELF_VERSION_MISMATCH]="Downloaded script version (%s) does not match release version (%s)."
    [SELF_CHECKSUM_NOT_FOUND]="SHA256SUMS asset not found in release. Update aborted — checksum verification is required."
    [SELF_CHECKSUM_OK]="SHA256 checksum matches for: %s"
    [SELF_CHECKSUM_MISMATCH]="SHA256 checksum mismatch for: %s"
    [SELF_CHECKSUM_MISSING_ENTRY]="No SHA256 checksum entry for: %s"
    [SELF_CHECKSUM_VERIFY_FAIL]="Failed to download or process SHA256SUMS file. Update aborted — checksum verification is required."
    [YUBICO_NOT_FOUND]="Yubico script not found!"
    [YUBICO_UPDATE_START]="Updating Yubico script..."
    [YUBICO_UPDATE_SUCCESS]="Yubico script updated along with main script."
    [YUBICO_UPDATE_SKIP]="Yubico script not found — skipping its update."
    [YUBICO_ALREADY_INSTALLED]="Yubico Authenticator is already installed (version:"
    [YUBICO_FOUND]="Yubico script found:"
    [YUBICO_VER_SAVED]="Yubico version saved to state file:"
    [YUBICO_EXT_SUCCESS]="External Yubico script completed successfully."
    [YUBICO_INST_SUCCESS_NO_VER]="Installation succeeded, but could not extract version from URL."
    [YUBICO_REMOVED]="Yubico Authenticator removed."
    [YUBICO_PLACE_FILE]="Place file:"
    [DEPS_CHECKING]="Checking script dependencies..."
    [DEPS_MISSING]="Missing dependencies:"
    [DEPS_INSTALLING]="Installing missing dependencies via apt..."
    [DEPS_DONE]="Dependencies installed."
    [DEPS_ALL_OK]="All script dependencies are available."
    [DEPS_INSTALL_COREUTILS]="Install the coreutils package."
    [DISTRO_DETECT_FAIL]="Cannot read /etc/os-release. Cannot determine distribution."
    [DISTRO_DETECTED_OK]="Detected Debian/Ubuntu family:"
    [DISTRO_DETAILS]="Distribution details:"
    [SEP_FULL]="═══════════════════════════════════════════════════════════════════════"
    [MIGRATE_RUN_HINT]="After migration, run the script like this (from any directory):"
    [LANG_INFO_POLISH]="Polish (auto-detected or forced)"
    [LANG_INFO_ENGLISH]="English (default fallback)"
    [MIGRATE_MOVE_CONF]="Moved mpm.conf"
    [MIGRATE_MOVE_YUBICO]="Moved install-yubico-authenticator.sh"
    [MIGRATE_MOVE_OLD]="Moved /old directory"
    [MIGRATE_PATH_ADDED]="Automatically added PATH entry to ~/.bashrc"
    [INFO_REFRESH_DB]="Refreshing .desktop database..."
    [ERR_MISSING_PKG_NAME]="Missing package name! Usage:"
    [ERR_MISSING_PKG]="Missing package name!"
    [ERR_UNKNOWN_CMD]="Unknown command:"
    [ERR_DISCORD_LATEST_FAIL]="Failed to download latest Discord version information."
    [ERR_YUBICO_URL_FAIL]="Failed to get Yubico Authenticator download URL."
    [ERR_YUBICO_SCRIPT_FAIL]="External Yubico script failed."
    [DISCORD_INSTALLED_OK]="Discord installed successfully."
    [DISCORD_NO_CHECKSUM]="Discord does not provide official checksums — verification skipped."
    [DISCORD_REMOVED]="Discord has been removed."
    [DISCORD_NOT_INSTALLED]="Discord is not installed."
    [DISCORD_ALREADY_INSTALLED]="Discord is already installed (version:"
    [PROTON_AUTH_INSTALLED_OK]="Proton Authenticator installed successfully."
    [PROTON_AUTH_NOT_INSTALLED]="Proton Authenticator is not installed."
    [PROTON_AUTH_REMOVED]="Proton Authenticator has been removed."
    [PROTON_AUTH_ALREADY_INSTALLED]="Proton Authenticator is already installed (version:"
    [PROTON_PASS_INSTALLED_OK]="Proton Pass installed successfully."
    [PROTON_PASS_NOT_INSTALLED]="Proton Pass is not installed."
    [PROTON_PASS_REMOVED]="Proton Pass has been removed."
    [PROTON_PASS_ALREADY_INSTALLED]="Proton Pass is already installed (version:"
    [VERIFY_BLOCK_FAIL_CLOSED]="Installation blocked (Fail-Closed) because the file could not be verified."
    [VERIFY_BLOCK_NO_CHECKSUM]="Installation blocked (Fail-Closed) due to missing checksum."
    [VERIFY_SHA_MATCH]="SHA512 checksum matches — file is authentic."
    [VERIFY_SHA_MISMATCH]="SHA512 checksum mismatch!"
    [VERIFY_EXPECTED]="Expected:"
    [VERIFY_COMPUTED]="Computed:"
    [VERIFY_CORRUPTED]="File may be corrupted or tampered. Installation aborted."
    [ERR_EXTRACT_SHA]="Could not extract SHA512 from JSON."
    [INFO_USE_REINSTALL]="Use --reinstall to reinstall."
    [INFO_CANT_CHECK_VERSION]="Could not check latest version online. Downloading and installing the latest package..."
    [VERIFY_APP_OK]="Verification: %s INSTALLED (version: %s)"
    [VERIFY_APP_FAIL]="Verification: %s NOT INSTALLED"
    [CHECK_ALL_TITLE]="CHECKING ALL PACKAGES"
    [MIGRATE_NO_SUDO]="Do not run --migrate-to-hidden with sudo. Run as a normal user."
    [MSG_INST_DISCORD]="Discord package..."
    [INFO_SUPPORTED_PACKAGES]="Supported packages:"
    [SCRIPT_NAME_MISMATCH]="Filename mismatch: %s instead of %s"
    [SCRIPT_NAME_RENAME_WARNING]="Renaming scripts may cause self-update failures."
    [SCRIPT_NAME_RESTORE]="Please restore original filename: %s"
    [BACKUP_FILE]="Backup file:"
    [BACKUP_REMOVING_OLD]="Removing old backup:"
    [BACKUP_PREVIOUS_SAVED]="Previous versions saved in:"
    [BACKUP_RESTORE_HINT]="To restore previous version, check files in:"
    [ERR_ROOT_FORBIDDEN]="This script must not be run as root (sudo). Run it as a normal user."
)

# Funkcja pobierająca przetłumaczony tekst
txt() {
    local key="$1"
    if [[ "$LANGUAGE_CODE" == "pl" ]]; then
        echo "${TXT_PL[$key]:-$key}"
    else
        echo "${TXT_EN[$key]:-$key}"
    fi
}

# Funkcja pobierająca przetłumaczony tekst z parametrami
txtf() {
    local key="$1"
    shift
    local fmt
    fmt="$(txt "$key")"
    printf "$fmt" "$@"
}

# ============================================================================
# === 3. FUNKCJE LOGOWANIA — Obsługa dziennika zdarzeń i wyjścia konsoli =====
# ============================================================================

ensure_config_dir() {
    if [[ ! -d "$CONFIG_DIR" ]]; then
        sudo mkdir -p "$CONFIG_DIR"
        sudo chmod 755 "$CONFIG_DIR"
    fi
    if [[ ! -f "$LOG_FILE" ]]; then
        sudo touch "$LOG_FILE"
        sudo chmod 644 "$LOG_FILE"
    fi
}

should_log() {
    local level="$1"
    case "$LOG_LEVEL" in
        full)
            return 0
            ;;
        debug)
            [[ "$level" == "debug" || "$level" == "info" || "$level" == "warn" || "$level" == "error" ]]
            return $?
            ;;
        info)
            [[ "$level" == "info" || "$level" == "warn" || "$level" == "error" ]]
            return $?
            ;;
        warn)
            [[ "$level" == "warn" || "$level" == "error" ]]
            return $?
            ;;
        error)
            [[ "$level" == "error" ]]
            return $?
            ;;
        *)
            return 1
            ;;
    esac
}

log_msg() {
    local msg="$1"
    local ts
    ts="$(date '+%F %T')"
    ensure_config_dir 2>/dev/null || true
    echo "[$ts] $msg" | sudo tee -a "$LOG_FILE" >/dev/null 2>&1 || true
}

info() {
    local msg="$1"
    if should_log "info"; then
        printf "%-7s | %s\n" "[INFO]" "$msg" >&2
        log_msg "[INFO] $msg"
    fi
}

debug() {
    local msg="$1"
    if should_log "debug"; then
        printf "%-7s | %s\n" "[DEBUG]" "$msg" >&2
        log_msg "[DEBUG] $msg"
    fi
}

err() {
    local msg="$1"
    printf "%-7s | %s\n" "[ERROR]" "$msg" >&2
    log_msg "[ERROR] $msg"
    if [[ "$SHOW_GITHUB_PROMO" == "true" ]]; then
        echo ""
        info "$(txt GH_ISSUES_MSG) $SCRIPT_GITHUB/$SCRIPT_REPO_NAME/issues"
        echo ""
    fi
}

warn() {
    local msg="$1"
    if should_log "warn"; then
        printf "%-7s | %s\n" "[WARN]" "$msg" >&2
        log_msg "[WARN] $msg"
    fi
}

ok() {
    local msg="$1"
    if should_log "info"; then
        printf "%-7s | %s\n" "[OK]" "$msg" >&2
        log_msg "[OK] $msg"
    fi
}

# ============================================================================
# === 4. FUNKCJE INTERFEJSU — Wizualne separatory w terminalu ================
# ============================================================================

show_separator_full() {
    txt SEP_FULL
}

# ============================================================================
# === 5. FUNKCJE KONFIGURACJI — Odczyt i walidacja pliku mpm.conf ============
# ============================================================================

load_config() {
    local config_file="$SCRIPT_DIR/mpm.conf"
    printf "%-7s | %s\n" "[INFO]" "$(txt INFO_SUDO_REQUIRED)"
    if [[ ! -f "$config_file" ]]; then
        debug "$(txt CFG_NOT_FOUND) $config_file — $(txt CFG_USING_DEFAULTS)"
        CONFIG_LOADED="false"
        return 0
    fi
    CONFIG_LOADED="true"
    info "$(txt CFG_FILE_INFO) $config_file"
    while IFS='=' read -r key value || [[ -n "$key" ]]; do
        if [[ -z "$key" || "$key" =~ ^[[:space:]]*# ]]; then
            continue
        fi
        key="${key//$'\r'/}"
        value="${value//$'\r'/}"
        # Obsługa ewentualnych komentarzy inline, np. LANGUAGE=auto # komentarz
        value="${value%%#*}"
        key="${key// /}"
        value="${value#\"}"
        value="${value%\"}"
        value="${value#\[}"
        value="${value%\]}"
        value="${value// /}"
        case "$key" in
            LANGUAGE)
                if [[ -n "$CLI_LANGUAGE_OVERRIDE" ]]; then
                    debug "$(txt STATUS_INFO) $(txt CFG_FORCE_LANG) $LANGUAGE_CODE"
                    continue
                fi
                if [[ "$value" == "pl" || "$value" == "en" ]]; then
                    LANGUAGE_CODE="$value"
                    debug "$(txt STATUS_INFO) $(txt CFG_FORCE_LANG) $value"
                elif [[ "$value" == "auto" ]]; then
                    debug "$(txt STATUS_INFO) $(txt CFG_AUTO_LANG)"
                else
                    warn "$(txtf CFG_INVALID_VAL_DEFAULT "LANGUAGE" "$value" "${CONFIG_DEFAULTS[LANGUAGE]}")"
                    if [[ "$LANGUAGE_CODE" != "pl" && "$LANGUAGE_CODE" != "en" ]]; then
                        LANGUAGE_CODE="en"
                    fi
                fi
                ;;
            AUTO_UPDATE_CHECK)
                if [[ "$value" == "true" || "$value" == "false" ]]; then
                    AUTO_UPDATE_CHECK="$value"
                else
                    warn "$(txtf CFG_INVALID_VAL_DEFAULT "AUTO_UPDATE_CHECK" "$value" "${CONFIG_DEFAULTS[AUTO_UPDATE_CHECK]}")"
                fi
                ;;
            BACKUP_KEEP_COUNT)
                if [[ "$value" =~ ^[1-9][0-9]*$ ]]; then
                    BACKUP_KEEP_COUNT="$value"
                else
                    warn "$(txtf CFG_INVALID_VAL_DEFAULT "BACKUP_KEEP_COUNT" "$value" "${CONFIG_DEFAULTS[BACKUP_KEEP_COUNT]}")"
                fi
                ;;
            SHOW_GITHUB_PROMO)
                if [[ "$value" == "true" || "$value" == "false" ]]; then
                    SHOW_GITHUB_PROMO="$value"
                else
                    warn "$(txtf CFG_INVALID_VAL_DEFAULT "SHOW_GITHUB_PROMO" "$value" "${CONFIG_DEFAULTS[SHOW_GITHUB_PROMO]}")"
                fi
                ;;
            LOG_LEVEL)
                if [[ "$value" == "full" || "$value" == "debug" || "$value" == "info" || "$value" == "warn" || "$value" == "error" ]]; then
                    LOG_LEVEL="$value"
                else
                    warn "$(txtf CFG_INVALID_VAL_DEFAULT "LOG_LEVEL" "$value" "${CONFIG_DEFAULTS[LOG_LEVEL]}")"
                fi
                ;;
        esac
    done <"$config_file"
    if [[ "$LANGUAGE_CODE" != "pl" && "$LANGUAGE_CODE" != "en" ]]; then
        LANGUAGE_CODE="en"
    fi
}

load_language_from_config() {
    local config_file="$SCRIPT_DIR/mpm.conf"
    [[ -f "$config_file" ]] || return 0
    if [[ -n "$CLI_LANGUAGE_OVERRIDE" ]]; then
        return 0
    fi
    local line key value
    while IFS= read -r line || [[ -n "$line" ]]; do
        line="${line//$'\r'/}"
        if [[ -z "$line" || "$line" =~ ^[[:space:]]*# ]]; then
            continue
        fi
        key="${line%%=*}"
        key="${key// /}"
        if [[ "$key" != "LANGUAGE" ]]; then
            continue
        fi
        value="${line#*=}"
        value="${value%%#*}"
        value="${value#\"}"
        value="${value%\"}"
        value="${value#\[}"
        value="${value%\]}"
        value="${value// /}"
        if [[ "$value" == "pl" || "$value" == "en" ]]; then
            LANGUAGE_CODE="$value"
        fi
        return 0
    done <"$config_file"
}

# ============================================================================
# === 6. FUNKCJE JĘZYKA — Auto-detekcja języka systemu ========================
# ============================================================================

detect_language() {
    local lang=""
    local cli_lang=""
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --lang | -l)
                if [[ "${2:-}" == "auto" || "${2:-}" == "pl" || "${2:-}" == "en" ]]; then
                    cli_lang="$2"
                    shift 2
                else
                    warn "$(txtf CFG_INVALID_LANGUAGE_CODE "${2:-}")"
                    shift
                fi
                ;;
            *)
                shift
                ;;
        esac
    done
    if [[ -n "$cli_lang" ]]; then
        CLI_LANGUAGE_OVERRIDE="$cli_lang"
        if [[ "$cli_lang" != "auto" ]]; then
            LANGUAGE_CODE="$cli_lang"
            return 0
        fi
    fi
    if [[ "$LANGUAGE_CODE" != "pl" && "$LANGUAGE_CODE" != "en" ]]; then
        lang="${LC_ALL:-${LC_MESSAGES:-${LANG:-}}}"
        if [[ -z "$lang" && -f /etc/default/locale ]]; then
            lang="$(grep '^LANG=' /etc/default/locale 2>/dev/null | cut -d'=' -f2- | tr -d '"' | head -n1 || true)"
        fi
        case "$lang" in
            pl* | PL*)
                LANGUAGE_CODE="pl"
                ;;
            *)
                LANGUAGE_CODE="en"
                ;;
        esac
    fi
}

show_language_info() {
    if [[ "$LANGUAGE_CODE" == "pl" ]]; then
        debug "$(txt LANG_INFO_POLISH)"
    else
        debug "$(txt LANG_INFO_ENGLISH)"
    fi
}

# ============================================================================
# === 7. FUNKCJE POMOCNICZE DLA PROTON — Parsowanie JSON i wersjonowanie ======
# ============================================================================

# Pobiera sumę SHA512 dla pliku .deb z oficjalnego pliku version.json Proton.
# Jeśli suma nie może zostać pobrana/wyodrębniona, funkcja zwraca błąd.
get_proton_sha512() {
    local json_url="$1"
    local json_file="$2"
    if [[ ! -f "$json_file" ]]; then
        err "$(txt ERR_NOT_FOUND) $json_file"
        err "$(txt PROTON_SOURCE) $json_url"
        return 1
    fi
    debug "$(txt PROTON_RETRIEVED) $json_url"
    local sha
    sha=$(jq -r '
([.Releases[]? | select(.CategoryName == "Stable") | .File[]? | select(.Url | test("\\.deb$")) | .Sha512CheckSum] | .[0]) //
(.Releases[0]? | .File[0]? | .Sha512CheckSum) //
.SHA512CheckSum //
.Sha512CheckSum //
.sha512 //
.SHA512 //
.checksum //
.Checksum //
.sha512sum //
empty
' "$json_file" 2>/dev/null | head -n1 || true)
    if [[ -z "$sha" || "$sha" == "null" ]]; then
        err "$(txt ERR_VERIFY_FAIL) $(txt ERR_EXTRACT_SHA)"
        err "$(txt STATUS_INFO) $(txt PROTON_CHECK_STRUCT) $json_url"
        return 1
    fi
    printf '%s' "$sha"
}

get_proton_version_from_json() {
    local json_file="$1"
    if [[ ! -f "$json_file" ]]; then
        return 1
    fi
    local ver
    ver=$(jq -r '
([.Releases[]? | select(.CategoryName == "Stable") | .Version] | .[0]) //
(.Releases[0]? | .Version) //
.version //
.Version //
.releaseVersion //
.tag //
empty
' "$json_file" 2>/dev/null | head -n1 || true)
    printf '%s' "$ver"
}

is_newer_version() {
    local old="$1"
    local new="$2"
    # Zwraca 0 (prawda), jeśli 'old' jest starsze niż 'new'.
    # Zwraca 1 (fałsz), jeśli wersje są równe lub 'old' jest nowsze.
    dpkg --compare-versions "$old" lt "$new" >/dev/null 2>&1
}

dpkg_installed() {
    local pkg="$1"
    local status
    status="$(dpkg-query -W -f='${Status}' "$pkg" 2>/dev/null || true)"
    [[ "$status" == "install ok installed" ]]
}

extract_yubico_version_from_url() {
    local url="$1"
    local token
    token="$(printf '%s' "$url" | grep -Eo 'yubico-authenticator-[0-9]+\.[0-9]+\.[0-9]+' | head -n1 || true)"
    if [[ -n "$token" ]]; then
        printf '%s' "${token#yubico-authenticator-}"
    fi
}

# ============================================================================
# === 8. FUNKCJE BACKUPU — Tworzenie kopii w /old ============================
# ============================================================================

# Tworzy kopię zapasową wskazanego pliku w katalogu "$SCRIPT_DIR/old".
# Odpowiada także za usunięcie najstarszych kopii zgodnie z BACKUP_KEEP_COUNT.
create_backup_in_old_folder() {
    local script_path="$1"
    local old_dir="$SCRIPT_DIR/old"
    local base
    local stamp
    local backup_path
    local count
    local oldest
    base="$(basename "$script_path")"
    stamp="$(date +%Y%m%d-%H%M%S)"
    backup_path="$old_dir/${base}.${stamp}"
    mkdir -p "$old_dir" 2>/dev/null || sudo mkdir -p "$old_dir"
    if [[ "$BACKUP_KEEP_COUNT" =~ ^[1-9][0-9]*$ ]] && ((BACKUP_KEEP_COUNT > 0)); then
        count="$(find "$old_dir" -maxdepth 1 -type f \( -name "$base" -o -name "${base}.*" \) 2>/dev/null | wc -l | tr -d '[:space:]' || true)"
        if [[ -z "$count" ]]; then
            count=0
        fi
        while ((count >= BACKUP_KEEP_COUNT)); do
            oldest="$(find "$old_dir" -maxdepth 1 -type f \( -name "$base" -o -name "${base}.*" \) -printf '%T@ %p\n' 2>/dev/null | sort -n | head -n1 | cut -d' ' -f2- || true)"
            if [[ -z "$oldest" ]]; then
                break
            fi
            info "$(txt BACKUP_REMOVING_OLD) $oldest"
            rm -f "$oldest" 2>/dev/null || sudo rm -f "$oldest"
            count="$(find "$old_dir" -maxdepth 1 -type f \( -name "$base" -o -name "${base}.*" \) 2>/dev/null | wc -l | tr -d '[:space:]' || true)"
            if [[ -z "$count" ]]; then
                count=0
            fi
        done
    fi
    info "$(txt BACKUP_FILE) $backup_path"
    cp "$script_path" "$backup_path" 2>/dev/null || sudo cp "$script_path" "$backup_path"
}

# ============================================================================
# === 8A. BEZPIECZNE INSTALOWANIE PLIKÓW — Własność i atomiczność ============
# ============================================================================

# Bezpiecznie instaluje plik pod docelową ścieżką: tworzy plik .new, a następnie podmienia go przez mv.
# Jeśli plik docelowy istnieje, podejmowana jest próba zachowania właściciela i grupy.
install_file_safe() {
    local src="$1"
    local dest="$2"
    local dest_new="${dest}.new"
    local owner_user=""
    local owner_group=""
    if [[ -e "$dest" ]]; then
        owner_user="$(stat -c '%U' "$dest" 2>/dev/null || true)"
        owner_group="$(stat -c '%G' "$dest" 2>/dev/null || true)"
    fi
    if [[ -z "$owner_user" ]]; then
        owner_user="${SUDO_USER:-${USER:-root}}"
    fi
    if [[ -z "$owner_group" ]]; then
        owner_group="$(id -gn "$owner_user" 2>/dev/null || id -gn)"
    fi
    if install -m 755 "$src" "$dest_new" 2>/dev/null && mv "$dest_new" "$dest" 2>/dev/null; then
        return 0
    fi
    if sudo install -o "$owner_user" -g "$owner_group" -m 755 "$src" "$dest_new" && sudo mv "$dest_new" "$dest"; then
        return 0
    fi
    rm -f "$dest_new" 2>/dev/null || sudo rm -f "$dest_new" 2>/dev/null || true
    return 1
}

# ============================================================================
# === 9. FUNKCJE MIGRACYJNE — Przenoszenie do ~/.mpm/ ========================
# ============================================================================

is_in_hidden_directory() {
    local current_dir
    current_dir="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
    if [[ "$current_dir" =~ /\.[^/]+ ]]; then
        return 0
    fi
    return 1
}

show_hidden_dir_suggestion() {
    if [[ $# -eq 0 ]] && ! is_in_hidden_directory; then
        echo ""
        info "$(txt MIGRATE_HIDDEN_MSG)"
        echo ""
        info "$(txt MIGRATE_HIDDEN_CMD) $(txt SCRIPT_PATH) --migrate-to-hidden"
        echo ""
        info "$(txt MIGRATE_RUN_HINT) $(txt SCRIPT_NAME)"
    fi
}

migrate_to_hidden() {
    local hidden_dir="$HOME/.mpm"
    local script_path
    script_path="$(realpath "${BASH_SOURCE[0]}")"
    local current_dir
    current_dir="$(dirname "$script_path")"
    if [[ "$current_dir" == "$hidden_dir" ]]; then
        ok "$(txtf MIGRATE_ALREADY_EXISTS "$hidden_dir")"
        exit 0
    fi
    if [[ ${EUID:-$(id -u)} -eq 0 ]]; then
        err "$(txt MIGRATE_NO_SUDO)"
        exit 1
    fi
    if [[ -d "$hidden_dir" ]]; then
        info "$(txtf MIGRATE_ALREADY_EXISTS "$hidden_dir")"
    else
        info "$(txt MIGRATE_CREATE_DIR)"
        mkdir -p "$hidden_dir"
    fi
    info "$(txt MIGRATE_MOVE)"
    if ! mv "$script_path" "$hidden_dir/" 2>/dev/null; then
        sudo mv "$script_path" "$hidden_dir/"
        if [[ -n "${SUDO_USER:-}" ]]; then
            sudo chown "$SUDO_USER" "$hidden_dir/$(basename "$script_path")" || true
        fi
    fi
    if [[ -f "$SCRIPT_DIR/mpm.conf" ]]; then
        if ! mv "$SCRIPT_DIR/mpm.conf" "$hidden_dir/" 2>/dev/null; then
            sudo mv "$SCRIPT_DIR/mpm.conf" "$hidden_dir/"
            if [[ -n "${SUDO_USER:-}" ]]; then
                sudo chown "$SUDO_USER" "$hidden_dir/mpm.conf" || true
            fi
        fi
        ok "$(txt MIGRATE_MOVE_CONF)"
    fi
    if [[ -f "$SCRIPT_DIR/install-yubico-authenticator.sh" ]]; then
        if ! mv "$SCRIPT_DIR/install-yubico-authenticator.sh" "$hidden_dir/" 2>/dev/null; then
            sudo mv "$SCRIPT_DIR/install-yubico-authenticator.sh" "$hidden_dir/"
            if [[ -n "${SUDO_USER:-}" ]]; then
                sudo chown "$SUDO_USER" "$hidden_dir/install-yubico-authenticator.sh" || true
            fi
        fi
        ok "$(txt MIGRATE_MOVE_YUBICO)"
    fi
    if [[ -d "$SCRIPT_DIR/old" ]]; then
    if [[ -d "$hidden_dir/old" ]]; then
        while IFS= read -r -d '' entry; do
            if ! mv "$entry" "$hidden_dir/old/" 2>/dev/null; then
                sudo mv "$entry" "$hidden_dir/old/"
            fi
        done < <(find "$SCRIPT_DIR/old" -mindepth 1 -maxdepth 1 -print0)

        if ! rmdir "$SCRIPT_DIR/old" 2>/dev/null; then
            sudo rmdir "$SCRIPT_DIR/old" 2>/dev/null || true
        fi
    else
        if ! mv "$SCRIPT_DIR/old" "$hidden_dir/" 2>/dev/null; then
            sudo mv "$SCRIPT_DIR/old" "$hidden_dir/"
            if [[ -n "${SUDO_USER:-}" ]]; then
                sudo chown -R "$SUDO_USER" "$hidden_dir/old" || true
            fi
        fi
    fi

    ok "$(txt MIGRATE_MOVE_OLD)"
	fi
    if ! grep -Fq "$HOME/.mpm" ~/.bashrc 2>/dev/null; then
        cp ~/.bashrc ~/.bashrc.bak.mpm."$(date +%Y%m%d%H%M%S)" 2>/dev/null || true
        echo "export PATH=\"$HOME/.mpm:\$PATH\"" >> ~/.bashrc
        ok "$(txt MIGRATE_PATH_ADDED)"
    fi
    ok "$(txt MIGRATE_SUCCESS)"
    echo ""
    info "$(txt MIGRATE_HOW_RUN)"
    echo "  1. $hidden_dir/$(txt SCRIPT_NAME)"
    echo "  2. $(txt SCRIPT_NAME) ($(txt MIGRATE_SUCCESS_EXIT_COMMAND) source ~/.bashrc)"
    echo ""
    exit 0
}

# ============================================================================
# === 10. FUNKCJE GITHUB — Informacje o projektach ===========================
# ============================================================================

show_github_info_pl() {
    cat <<GH_INFO
╔═══════════════════════════════════════════════════════════════════════╗
║                          INFORMACJE O GITHUB                          ║
╠═══════════════════════════════════════════════════════════════════════╣
║                                                                       ║
║   ZGŁASZANIE BŁĘDÓW:                                                  ║
║     Jeśli znajdziesz błąd, otwórz issue na GitHub:                    ║
║     ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}/issues   ║
║                                                                       ║
║   Wiadomości i zmiany:                                                ║
║     Śledź zmiany w moim repo na GitHub.                               ║
║                                                                       ║
║   Wsparcie projektu:                                                  ║
║     Jeśli korzystasz z tego skryptu, rozważ:                          ║
║     •  Nadanie gwiazdki na GitHub                                     ║
║     •  Testowanie i debugowanie                                       ║
║     •  Postawienie kawy: ${SCRIPT_SUPPORT_LINK}           ║
║                                                                       ║
╚═══════════════════════════════════════════════════════════════════════╝
GH_INFO
}

show_github_info_en() {
    cat <<GH_INFO
╔══════════════════════════════════════════════════════════════════════╗
║                          GITHUB INFORMATION                          ║
╠══════════════════════════════════════════════════════════════════════╣
║                                                                      ║
║   Bug Reports:                                                       ║
║     If you find a bug, open an issue on GitHub:                      ║
║     ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}/issues  ║
║                                                                      ║
║   News and Changes:                                                  ║
║     Follow changes in my GitHub repo.                                ║
║                                                                      ║
║   Support the Project:                                               ║
║     If you use this script, consider:                                ║
║     •  Giving it a star on GitHub                                    ║
║     •  Testing and debugging                                         ║
║     •  Buy coffee: ${SCRIPT_SUPPORT_LINK}                ║
║                                                                      ║
╚══════════════════════════════════════════════════════════════════════╝
GH_INFO
}

# ============================================================================
# === 11. FUNKCJE DLA DISCORD — Zarządzanie komunikatorem Discord ============
# ============================================================================

discord_get_installed_version() {
    if ! dpkg_installed discord; then
        txt VER_NONE
        return
    fi
    local ver
    ver=$(dpkg-query -W -f='${Version}' discord 2>/dev/null || true)
    if [[ -n "$ver" ]]; then
        echo "$ver"
    else
        txt VER_NONE
    fi
}

discord_get_latest_version() {
    local redirect_url
    redirect_url="$(curl -sL -o /dev/null -w '%{url_effective}' --connect-timeout 10 --retry 3 "$DISCORD_URL" 2>/dev/null || true)"
    if [[ -z "$redirect_url" ]]; then
        txt VER_UNKNOWN
        return
    fi
    local ver
    ver="$(echo "$redirect_url" | grep -Eo '[0-9]+(\.[0-9]+)+' | head -n1 || true)"
    echo "${ver:-$(txt VER_UNKNOWN)}"
}

# Pobiera i instaluje Discord. Zwraca błąd, jeśli instalacja się nie powiedzie.
discord_install() {
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_DISCORD)"
    mkdir -p "$TMP_BASE/discord"
    local deb_file="$TMP_BASE/discord/discord.deb"
    if ! curl -fL --retry 3 --connect-timeout 10 "$DISCORD_URL" -o "$deb_file"; then
        err "$(txt ERR_DOWNLOAD_FAIL) Discord!"
        return 1
    fi
    if ! dpkg-deb --info "$deb_file" >/dev/null 2>&1; then
        err "$(txt ERR_VERIFY_FAIL) Discord.deb"
        return 1
    fi
    warn "$(txt DISCORD_NO_CHECKSUM)"
    info "$(txt STATUS_INSTALLING) $(txt MSG_INST_DISCORD)"
    if sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y "$deb_file" ||
        sudo dpkg -i "$deb_file" ||
        sudo env DEBIAN_FRONTEND=noninteractive apt-get install -f -y; then
        ok "$(txt DISCORD_INSTALLED_OK)"
    else
        err "$(txtf ERR_INSTALL_FAIL "Discord")"
        return 1
    fi
}

# Usuwa Discord. Zwraca błąd, jeśli polecenie apt-get się nie powiedzie.
discord_remove() {
    if dpkg_installed discord; then
        info "$(txt STATUS_REMOVING) Discord..."
        if sudo env DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y discord; then
            ok "$(txt DISCORD_REMOVED)"
        else
            err "$(txtf ERR_REMOVE_FAIL "discord")"
            return 1
        fi
    else
        info "$(txt DISCORD_NOT_INSTALLED)"
    fi
}

discord_verify() {
    if dpkg_installed discord; then
        local ver
        ver=$(discord_get_installed_version)
        ok "$(txtf VERIFY_APP_OK "Discord" "$ver")"
        return 0
    fi
    err "$(txtf VERIFY_APP_FAIL "Discord")"
    return 1
}

discord_check_versions_with_result() {
    local result_text="$1"
    local installed latest
    installed=$(discord_get_installed_version)
    latest=$(discord_get_latest_version)
    printf '\n  ┌──────────────────────────────────────────────┐\n'
    printf "    DISCORD — %s\n" "$(txt CMD_CHECK)"
    printf '  ├──────────────────────────────────────────────┤\n'
    printf "     %s %-22s\n" "$(txt VER_INSTALLED)" "$installed"
    printf "     %s %-22s\n" "$(txt VER_LATEST)" "    $latest"
    if [[ -n "$result_text" ]]; then
        printf '  ├──────────────────────────────────────────────┤\n'
        printf "     %-48s\n" "$result_text"
    fi
    printf '  └──────────────────────────────────────────────┘\n'
}

discord_manage() {
    local action="$1"
    case "$action" in
        install)
            local installed
            installed=$(discord_get_installed_version)
            if [[ "$installed" != "$(txt VER_NONE)" ]]; then
                discord_check_versions_with_result "$(txt OP_ALREADY_INSTALLED)"
                info "$(txt DISCORD_ALREADY_INSTALLED) $installed)."
                info "$(txt STATUS_INFO) $(txt INFO_USE_REINSTALL)"
                return 0
            fi
            discord_check_versions_with_result "$(txt OP_INSTALLING)"
            discord_install && discord_verify
            ;;
        update)
            local installed latest
            installed=$(discord_get_installed_version)
            latest=$(discord_get_latest_version)
            if [[ "$installed" == "$(txt VER_NONE)" ]]; then
                discord_check_versions_with_result "$(txt OP_INSTALLING)"
                discord_install && discord_verify
            elif [[ "$latest" == "$(txt VER_UNKNOWN)" ]]; then
                discord_check_versions_with_result "$(txt STATUS_WARNING)"
                err "$(txt ERR_DISCORD_LATEST_FAIL)"
                return 1
            elif is_newer_version "$installed" "$latest"; then
                discord_check_versions_with_result "$(txt OP_UPDATING)"
                discord_install && discord_verify
            else
                discord_check_versions_with_result "$(txt OP_LATEST)"
            fi
            ;;
        reinstall)
            discord_check_versions_with_result "$(txt OP_REINSTALLING)"
            discord_remove
            discord_install && discord_verify
            ;;
        remove)
            discord_check_versions_with_result "$(txt OP_REMOVING)"
            discord_remove
            ;;
        check)
            discord_check_versions_with_result ""
            ;;
        *)
            err "$(txt ERR_UNKNOWN_ACTION) Discord: $action"
            return 1
            ;;
    esac
}

# ============================================================================
# === 12. FUNKCJE DLA PROTON AUTHENTICATOR — Zarządzanie aplikacją 2FA =======
# ============================================================================

proton_auth_get_installed_version() {
    local pkg ver
    for pkg in proton-authenticator protonauth proton-auth; do
        if dpkg_installed "$pkg"; then
            ver=$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null || true)
            if [[ -n "$ver" ]]; then
                echo "$ver"
                return
            fi
        fi
    done
    txt VER_NONE
}

proton_auth_is_installed() {
    local pkg
    for pkg in proton-authenticator protonauth proton-auth; do
        if dpkg_installed "$pkg"; then
            return 0
        fi
    done
    return 1
}

proton_auth_download_and_verify() {
    local dest_dir="$1"
    local deb_file="$dest_dir/$PROTON_AUTH_DEB_FILENAME"
    local json_file="$dest_dir/version.json"
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_PROTON_AUTH)"
    if ! curl -fL "$PROTON_AUTH_DEB_URL" -o "$deb_file"; then
        err "$(txt ERR_DOWNLOAD_FAIL) Proton Authenticator.deb!"
        return 1
    fi
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_VERSION_JSON)"
    if ! curl -fsSL "$PROTON_AUTH_JSON_URL" -o "$json_file"; then
        err "$(txt ERR_DOWNLOAD_FAIL) version.json!"
        err "$(txt VERIFY_BLOCK_FAIL_CLOSED)"
        return 1
    fi
    local expected_sha
    expected_sha=$(get_proton_sha512 "$PROTON_AUTH_JSON_URL" "$json_file")
    if [[ -z "$expected_sha" ]]; then
        err "$(txt ERR_VERIFY_FAIL) $(txt ERR_EXTRACT_SHA)"
        err "$(txt VERIFY_BLOCK_NO_CHECKSUM)"
        return 1
    fi
    info "$(txt STATUS_VERIFYING) $(txt MSG_VERIFY_SHA512)"
    local computed_sha
    computed_sha=$(sha512sum "$deb_file" | awk '{print $1}')
    if [[ "${computed_sha,,}" == "${expected_sha,,}" ]]; then
        ok "$(txt VERIFY_SHA_MATCH)"
        if ! dpkg-deb --info "$deb_file" >/dev/null 2>&1; then
            err "$(txt ERR_INVALID_DEB)"
            return 1
        fi
        echo "$deb_file"
        return 0
    else
        err "$(txt ERR_VERIFY_FAIL) $(txt VERIFY_SHA_MISMATCH)"
        err "$(txt VERIFY_EXPECTED) $expected_sha"
        err "$(txt VERIFY_COMPUTED) $computed_sha"
        err "$(txt VERIFY_CORRUPTED)"
        return 1
    fi
}

# Instaluje Proton Authenticator. Zwraca błąd, jeśli instalacja się nie powiedzie.
proton_auth_install() {
    mkdir -p "$TMP_BASE/proton-auth"
    local deb_file
    if ! deb_file=$(proton_auth_download_and_verify "$TMP_BASE/proton-auth"); then
        err "$(txt ERR_DOWNLOAD_FAIL) Proton Authenticator."
        return 1
    fi
    if [[ -z "$deb_file" ]]; then
        err "$(txt ERR_NOT_FOUND) $PROTON_AUTH_DEB_FILENAME"
        return 1
    fi
    info "$(txt STATUS_INSTALLING) $(txt MSG_INST_PROTON_AUTH)"
    if sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y "$deb_file" ||
        sudo dpkg -i "$deb_file" ||
        sudo env DEBIAN_FRONTEND=noninteractive apt-get install -f -y; then
        ok "$(txt PROTON_AUTH_INSTALLED_OK)"
    else
        err "$(txtf ERR_INSTALL_FAIL "Proton Authenticator")"
        return 1
    fi
}

# Usuwa Proton Authenticator. Zwraca błąd, jeśli polecenie apt-get się nie powiedzie.
proton_auth_remove() {
    local removed=0
    local pkg
    for pkg in proton-authenticator protonauth proton-auth; do
        if dpkg_installed "$pkg"; then
            info "$(txt STATUS_REMOVING) $pkg (Proton Authenticator)..."
            if sudo env DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y "$pkg"; then
                removed=1
            else
                err "$(txtf ERR_REMOVE_FAIL "$pkg")"
                return 1
            fi
        fi
    done
    if [[ "$removed" -eq 1 ]]; then
        ok "$(txt PROTON_AUTH_REMOVED)"
    else
        info "$(txt PROTON_AUTH_NOT_INSTALLED)"
    fi
}

proton_auth_verify() {
    if proton_auth_is_installed; then
        local ver
        ver=$(proton_auth_get_installed_version)
        ok "$(txtf VERIFY_APP_OK "Proton Authenticator" "$ver")"
        return 0
    fi
    err "$(txtf VERIFY_APP_FAIL "Proton Authenticator")"
    return 1
}

proton_auth_check_versions_with_result() {
    local result_text="$1"
    local installed
    local latest
    installed=$(proton_auth_get_installed_version)
    local tmp_json="$TMP_BASE/proton-auth-check.json"
    if curl -fsSL "$PROTON_AUTH_JSON_URL" -o "$tmp_json" 2>/dev/null; then
        latest=$(get_proton_version_from_json "$tmp_json")
        if [[ -z "$latest" ]]; then
            latest="$(txt VER_UNKNOWN)"
        fi
    else
        latest="$(txt VER_UNKNOWN)"
    fi
    printf '\n  ┌──────────────────────────────────────────────┐\n'
    printf "    PROTON AUTHENTICATOR — %s\n" "$(txt CMD_CHECK)"
    printf '  ├──────────────────────────────────────────────┤\n'
    printf "     %s %-30s\n" "$(txt VER_INSTALLED)" "$installed"
    printf "     %s %-30s\n" "$(txt VER_LATEST)" "    $latest"
    if [[ -n "$result_text" ]]; then
        printf '  ├──────────────────────────────────────────────┤\n'
        printf "     %-48s\n" "$result_text"
    fi
    printf '  └──────────────────────────────────────────────┘\n'
}

proton_auth_manage() {
    local action="$1"
    case "$action" in
        install)
            if proton_auth_is_installed; then
                proton_auth_check_versions_with_result "$(txt OP_ALREADY_INSTALLED)"
                local ver
                ver=$(proton_auth_get_installed_version)
                info "$(txt PROTON_AUTH_ALREADY_INSTALLED) $ver)."
                info "$(txt STATUS_INFO) $(txt INFO_USE_REINSTALL)"
                return 0
            fi
            proton_auth_check_versions_with_result "$(txt OP_INSTALLING)"
            proton_auth_install && proton_auth_verify
            ;;
        update)
            local installed
            local latest=""
            installed=$(proton_auth_get_installed_version)
            local tmp_json="$TMP_BASE/proton-auth-update.json"
            if curl -fsSL "$PROTON_AUTH_JSON_URL" -o "$tmp_json" 2>/dev/null; then
                latest=$(get_proton_version_from_json "$tmp_json")
            fi
            if ! proton_auth_is_installed; then
                proton_auth_check_versions_with_result "$(txt OP_INSTALLING)"
                proton_auth_install && proton_auth_verify
            elif [[ -n "$latest" && "$latest" != "$(txt VER_UNKNOWN)" ]]; then
                if is_newer_version "$installed" "$latest"; then
                    proton_auth_check_versions_with_result "$(txt OP_UPDATING)"
                    proton_auth_install && proton_auth_verify
                else
                    proton_auth_check_versions_with_result "$(txt OP_LATEST)"
                fi
            else
                proton_auth_check_versions_with_result "$(txt STATUS_WARNING)"
                info "$(txt STATUS_INFO) $(txt INFO_CANT_CHECK_VERSION)"
                proton_auth_install && proton_auth_verify
            fi
            ;;
        reinstall)
            proton_auth_check_versions_with_result "$(txt OP_REINSTALLING)"
            proton_auth_remove
            proton_auth_install && proton_auth_verify
            ;;
        remove)
            proton_auth_check_versions_with_result "$(txt OP_REMOVING)"
            proton_auth_remove
            ;;
        check)
            proton_auth_check_versions_with_result ""
            ;;
        *)
            err "$(txt ERR_UNKNOWN_ACTION) Proton Authenticator: $action"
            return 1
            ;;
    esac
}

# ============================================================================
# === 13. FUNKCJE DLA PROTON PASS — Zarządzanie menedżerem haseł Proton Pass =
# ============================================================================

proton_pass_get_installed_version() {
    local pkg ver
    for pkg in proton-pass protonpass proton-pass-desktop; do
        if dpkg_installed "$pkg"; then
            ver=$(dpkg-query -W -f='${Version}' "$pkg" 2>/dev/null || true)
            if [[ -n "$ver" ]]; then
                echo "$ver"
                return
            fi
        fi
    done
    txt VER_NONE
}

proton_pass_is_installed() {
    local pkg
    for pkg in proton-pass protonpass proton-pass-desktop; do
        if dpkg_installed "$pkg"; then
            return 0
        fi
    done
    return 1
}

proton_pass_download_and_verify() {
    local dest_dir="$1"
    local deb_file="$dest_dir/$PROTON_PASS_DEB_FILENAME"
    local json_file="$dest_dir/version.json"
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_PROTON_PASS)"
    if ! curl -fL "$PROTON_PASS_DEB_URL" -o "$deb_file"; then
        err "$(txt ERR_DOWNLOAD_FAIL) Proton Pass.deb!"
        return 1
    fi
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_VERSION_JSON)"
    if ! curl -fsSL "$PROTON_PASS_JSON_URL" -o "$json_file"; then
        err "$(txt ERR_DOWNLOAD_FAIL) version.json!"
        err "$(txt VERIFY_BLOCK_FAIL_CLOSED)"
        return 1
    fi
    local expected_sha
    expected_sha=$(get_proton_sha512 "$PROTON_PASS_JSON_URL" "$json_file")
    if [[ -z "$expected_sha" ]]; then
        err "$(txt ERR_VERIFY_FAIL) $(txt ERR_EXTRACT_SHA)"
        err "$(txt VERIFY_BLOCK_NO_CHECKSUM)"
        return 1
    fi
    info "$(txt STATUS_VERIFYING) $(txt MSG_VERIFY_SHA512)"
    local computed_sha
    computed_sha=$(sha512sum "$deb_file" | awk '{print $1}')
    if [[ "${computed_sha,,}" == "${expected_sha,,}" ]]; then
        ok "$(txt VERIFY_SHA_MATCH)"
        if ! dpkg-deb --info "$deb_file" >/dev/null 2>&1; then
            err "$(txt ERR_INVALID_DEB)"
            return 1
        fi
        echo "$deb_file"
        return 0
    else
        err "$(txt ERR_VERIFY_FAIL) $(txt VERIFY_SHA_MISMATCH)"
        err "$(txt VERIFY_EXPECTED) $expected_sha"
        err "$(txt VERIFY_COMPUTED) $computed_sha"
        err "$(txt VERIFY_CORRUPTED)"
        return 1
    fi
}

# Instaluje Proton Pass. Zwraca błąd, jeśli instalacja się nie powiedzie.
proton_pass_install() {
    mkdir -p "$TMP_BASE/proton-pass"
    local deb_file
    if ! deb_file=$(proton_pass_download_and_verify "$TMP_BASE/proton-pass"); then
        err "$(txt ERR_DOWNLOAD_FAIL) Proton Pass."
        return 1
    fi
    if [[ -z "$deb_file" ]]; then
        err "$(txt ERR_NOT_FOUND) $PROTON_PASS_DEB_FILENAME"
        return 1
    fi
    info "$(txt STATUS_INSTALLING) $(txt MSG_INST_PROTON_PASS)"
    if sudo env DEBIAN_FRONTEND=noninteractive apt-get install -y "$deb_file" ||
        sudo dpkg -i "$deb_file" ||
        sudo env DEBIAN_FRONTEND=noninteractive apt-get install -f -y; then
        ok "$(txt PROTON_PASS_INSTALLED_OK)"
    else
        err "$(txtf ERR_INSTALL_FAIL "Proton Pass")"
        return 1
    fi
}

# Usuwa Proton Pass. Zwraca błąd, jeśli polecenie apt-get się nie powiedzie.
proton_pass_remove() {
    local removed=0
    local pkg
    for pkg in proton-pass protonpass proton-pass-desktop; do
        if dpkg_installed "$pkg"; then
            info "$(txt STATUS_REMOVING) $pkg (Proton Pass)..."
            if sudo env DEBIAN_FRONTEND=noninteractive apt-get remove --purge -y "$pkg"; then
                removed=1
            else
                err "$(txtf ERR_REMOVE_FAIL "$pkg")"
                return 1
            fi
        fi
    done
    if [[ "$removed" -eq 1 ]]; then
        ok "$(txt PROTON_PASS_REMOVED)"
    else
        info "$(txt PROTON_PASS_NOT_INSTALLED)"
    fi
}

proton_pass_verify() {
    if proton_pass_is_installed; then
        local ver
        ver=$(proton_pass_get_installed_version)
        ok "$(txtf VERIFY_APP_OK "Proton Pass" "$ver")"
        return 0
    fi
    err "$(txtf VERIFY_APP_FAIL "Proton Pass")"
    return 1
}

proton_pass_check_versions_with_result() {
    local result_text="$1"
    local installed
    local latest
    installed=$(proton_pass_get_installed_version)
    local tmp_json="$TMP_BASE/proton-pass-check.json"
    if curl -fsSL "$PROTON_PASS_JSON_URL" -o "$tmp_json" 2>/dev/null; then
        latest=$(get_proton_version_from_json "$tmp_json")
        if [[ -z "$latest" ]]; then
            latest="$(txt VER_UNKNOWN)"
        fi
    else
        latest="$(txt VER_UNKNOWN)"
    fi
    printf '\n  ┌──────────────────────────────────────────────┐\n'
    printf "    PROTON PASS — %s\n" "$(txt CMD_CHECK)"
    printf '  ├──────────────────────────────────────────────┤\n'
    printf "     %s %-26s\n" "$(txt VER_INSTALLED)" "$installed"
    printf "     %s %-26s\n" "$(txt VER_LATEST)" "    $latest"
    if [[ -n "$result_text" ]]; then
        printf '  ├──────────────────────────────────────────────┤\n'
        printf "     %-46s\n" "$result_text"
    fi
    printf '  └──────────────────────────────────────────────┘\n'
}

proton_pass_manage() {
    local action="$1"
    case "$action" in
        install)
            if proton_pass_is_installed; then
                proton_pass_check_versions_with_result "$(txt OP_ALREADY_INSTALLED)"
                local ver
                ver=$(proton_pass_get_installed_version)
                info "$(txt PROTON_PASS_ALREADY_INSTALLED) $ver)."
                info "$(txt STATUS_INFO) $(txt INFO_USE_REINSTALL)"
                return 0
            fi
            proton_pass_check_versions_with_result "$(txt OP_INSTALLING)"
            proton_pass_install && proton_pass_verify
            ;;
        update)
            local installed
            local latest=""
            installed=$(proton_pass_get_installed_version)
            local tmp_json="$TMP_BASE/proton-pass-update.json"
            if curl -fsSL "$PROTON_PASS_JSON_URL" -o "$tmp_json" 2>/dev/null; then
                latest=$(get_proton_version_from_json "$tmp_json")
            fi
            if ! proton_pass_is_installed; then
                proton_pass_check_versions_with_result "$(txt OP_INSTALLING)"
                proton_pass_install && proton_pass_verify
            elif [[ -n "$latest" && "$latest" != "$(txt VER_UNKNOWN)" ]]; then
                if is_newer_version "$installed" "$latest"; then
                    proton_pass_check_versions_with_result "$(txt OP_UPDATING)"
                    proton_pass_install && proton_pass_verify
                else
                    proton_pass_check_versions_with_result "$(txt OP_LATEST)"
                fi
            else
                proton_pass_check_versions_with_result "$(txt STATUS_WARNING)"
                info "$(txt STATUS_INFO) $(txt INFO_CANT_CHECK_VERSION)"
                proton_pass_install && proton_pass_verify
            fi
            ;;
        reinstall)
            proton_pass_check_versions_with_result "$(txt OP_REINSTALLING)"
            proton_pass_remove
            proton_pass_install && proton_pass_verify
            ;;
        remove)
            proton_pass_check_versions_with_result "$(txt OP_REMOVING)"
            proton_pass_remove
            ;;
        check)
            proton_pass_check_versions_with_result ""
            ;;
        *)
            err "$(txt ERR_UNKNOWN_ACTION) Proton Pass: $action"
            return 1
            ;;
    esac
}

# ============================================================================
# === 14. FUNKCJE DLA YUBICO — Integracja z zewnętrznym skryptem Yubico ======
# ============================================================================

yubico_get_latest_tarball_url() {
    local releases_html tarball_url relative_path
    releases_html=$(curl -fsSL "$YUBICO_RELEASES_URL" 2>/dev/null || true)
    [[ -n "$releases_html" ]] || return 1
    tarball_url=$(echo "$releases_html" | grep -Eo 'https://[^"]+/yubico-authenticator-[0-9.]+-linux\.tar\.gz' | head -n1 || true)
    if [[ -z "$tarball_url" ]]; then
        relative_path=$(echo "$releases_html" | grep -Eo 'yubico-authenticator-[0-9.]+-linux\.tar\.gz' | head -n1 || true)
        if [[ -n "$relative_path" ]]; then
            tarball_url="${YUBICO_RELEASES_URL}${relative_path}"
        fi
    fi
    [[ -n "$tarball_url" ]] || return 1
    printf '%s' "$tarball_url"
}

check_yubico_script() {
    if [[ -z "$YUBICO_SCRIPT" ]]; then
        err "$(txt YUBICO_NOT_FOUND)"
        info "$(txt STATUS_INFO) $(txt YUBICO_PLACE_FILE) $YUBICO_SCRIPT_NAME"
        return 1
    fi
    if [[ ! -x "$YUBICO_SCRIPT" ]]; then
        sudo chmod +x "$YUBICO_SCRIPT" 2>/dev/null || true
    fi
    ok "$(txt YUBICO_FOUND) $YUBICO_SCRIPT"
    return 0
}

# Sprawdza, czy Yubico Authenticator jest zainstalowany.
# Aplikacja może być instalowana poza dpkg, dlatego sprawdzane są pliki w /opt oraz symlink.
yubico_is_installed() {
    if [[ -f "/opt/yubico-authenticator/authenticator" ]]; then
        return 0
    fi
    if [[ -L "/usr/local/bin/authenticator" ]]; then
        local target
        target="$(readlink -f /usr/local/bin/authenticator 2>/dev/null || true)"
        if [[ "$target" == /opt/yubico-authenticator/* ]]; then
            return 0
        fi
    fi
    local found_file
    found_file="$(find /opt/yubico-authenticator -maxdepth 3 -type f \( -name 'authenticator' -o -name 'Yubico Authenticator' -o -name '*.AppImage' \) -print -quit 2>/dev/null || true)"
    if [[ -n "$found_file" ]]; then
        return 0
    fi
    return 1
}

yubico_get_installed_version() {
    if [[ ! -d "/opt/yubico-authenticator" ]] && ! command -v authenticator &>/dev/null; then
        txt VER_NONE
        return
    fi
    if [[ -f "$YUBICO_VERSION_FILE" ]]; then
        local ver
        ver=$(cat "$YUBICO_VERSION_FILE" 2>/dev/null | tr -d '[:space:]' || true)
        if [[ -n "$ver" ]]; then
            echo "$ver"
            return
        fi
    fi
    txt VER_UNKNOWN
}

yubico_install() {
    check_yubico_script || return 1
    info "$(txt STATUS_DOWNLOADING) $(txt MSG_DL_YUBICO_VER)"
    local tarball_url=""
    tarball_url="$(yubico_get_latest_tarball_url || true)"
    if [[ -z "$tarball_url" ]]; then
        err "$(txt ERR_YUBICO_URL_FAIL)"
        return 1
    fi
    local extracted_version
    extracted_version="$(extract_yubico_version_from_url "$tarball_url")"
    if [[ -z "$extracted_version" ]]; then
        extracted_version="$(txt VER_UNKNOWN)"
    fi
    info "$(txt STATUS_INSTALLING) $(txt MSG_INST_YUBICO_EXT)"
    if bash "$YUBICO_SCRIPT"; then
        ok "$(txt YUBICO_EXT_SUCCESS)"
        ensure_config_dir
        if [[ "$extracted_version" != "$(txt VER_UNKNOWN)" ]]; then
            printf '%s\n' "$extracted_version" | sudo tee "$YUBICO_VERSION_FILE" >/dev/null
            ok "$(txt YUBICO_VER_SAVED) $extracted_version"
        else
            warn "$(txt YUBICO_INST_SUCCESS_NO_VER)"
        fi
        return 0
    else
        err "$(txt ERR_YUBICO_SCRIPT_FAIL)"
        return 1
    fi
}

yubico_remove() {
    info "$(txt STATUS_REMOVING) Yubico Authenticator..."
    if [[ -d "/opt/yubico-authenticator" ]]; then
        info "$(txt STATUS_REMOVING) /opt/yubico-authenticator directory..."
        sudo rm -rf /opt/yubico-authenticator
    fi
    if [[ -L "/usr/local/bin/authenticator" ]]; then
        info "$(txt STATUS_REMOVING) /usr/local/bin/authenticator link..."
        sudo rm -f /usr/local/bin/authenticator
    fi
    if [[ -f "/usr/share/applications/yubico-authenticator.desktop" ]]; then
        info "$(txt STATUS_REMOVING) .desktop file..."
        sudo rm -f /usr/share/applications/yubico-authenticator.desktop
    fi
    if [[ -f "/usr/local/share/pixmaps/yubico-authenticator.png" ]]; then
        info "$(txt STATUS_REMOVING) icon..."
        sudo rm -f /usr/local/share/pixmaps/yubico-authenticator.png
    fi
    if [[ -f "$YUBICO_VERSION_FILE" ]]; then
        sudo rm -f "$YUBICO_VERSION_FILE"
    fi
    if command -v update-desktop-database &>/dev/null; then
        info "$(txt INFO_REFRESH_DB)"
        sudo update-desktop-database /usr/share/applications >/dev/null 2>&1 || true
    fi
    ok "$(txt YUBICO_REMOVED)"
}

yubico_verify() {
    if yubico_is_installed; then
        local ver
        ver=$(yubico_get_installed_version)
        if [[ "$ver" != "$(txt VER_UNKNOWN)" && "$ver" != "$(txt VER_NONE)" ]]; then
            ensure_config_dir
            printf '%s\n' "$ver" | sudo tee "$YUBICO_VERSION_FILE" >/dev/null
        fi
        ok "$(txtf VERIFY_APP_OK "Yubico Authenticator" "$ver")"
        return 0
    fi
    err "$(txtf VERIFY_APP_FAIL "Yubico Authenticator")"
    return 1
}

yubico_check_versions_with_result() {
    local result_text="$1"
    local installed
    local latest
    latest="$(txt VER_UNKNOWN)"
    installed=$(yubico_get_installed_version)
    local tarball_url=""
    tarball_url="$(yubico_get_latest_tarball_url || true)"
    if [[ -n "$tarball_url" ]]; then
        latest="$(extract_yubico_version_from_url "$tarball_url")"
        if [[ -z "$latest" ]]; then
            latest="$(txt VER_UNKNOWN)"
        fi
    fi
    printf '\n  ┌──────────────────────────────────────────────┐\n'
    printf "    YUBICO AUTHENTICATOR — %s\n" "$(txt CMD_CHECK)"
    printf '  ├──────────────────────────────────────────────┤\n'
    printf "     %s %-26s\n" "$(txt VER_INSTALLED)" "$installed"
    printf "     %s %-26s\n" "$(txt VER_LATEST)" "    $latest"
    if [[ -n "$result_text" ]]; then
        printf '  ├──────────────────────────────────────────────┤\n'
        printf "     %-46s\n" "$result_text"
    fi
    printf '  └──────────────────────────────────────────────┘\n'
}

yubico_manage() {
    local action="$1"
    case "$action" in
        install)
            if yubico_is_installed; then
                yubico_check_versions_with_result "$(txt OP_ALREADY_INSTALLED)"
                local ver
                ver=$(yubico_get_installed_version)
                info "$(txt YUBICO_ALREADY_INSTALLED) $ver)."
                info "$(txt STATUS_INFO) $(txt INFO_USE_REINSTALL)"
                return 0
            fi
            yubico_check_versions_with_result "$(txt OP_INSTALLING)"
            yubico_install && yubico_verify
            ;;
        update)
            local installed
            local latest
            latest="$(txt VER_UNKNOWN)"
            installed=$(yubico_get_installed_version)
            local tarball_url=""
            tarball_url="$(yubico_get_latest_tarball_url || true)"
            if [[ -n "$tarball_url" ]]; then
                latest="$(extract_yubico_version_from_url "$tarball_url")"
                if [[ -z "$latest" ]]; then
                    latest="$(txt VER_UNKNOWN)"
                fi
            fi
            if [[ "$installed" == "$(txt VER_NONE)" ]]; then
                yubico_check_versions_with_result "$(txt OP_INSTALLING)"
                yubico_install && yubico_verify
            elif [[ "$latest" == "$(txt VER_UNKNOWN)" ]]; then
                yubico_check_versions_with_result "$(txt STATUS_WARNING)"
                info "$(txt STATUS_INFO) $(txt INFO_CANT_CHECK_VERSION)"
                yubico_install && yubico_verify
            elif [[ "$installed" == "$(txt VER_UNKNOWN)" ]]; then
                yubico_check_versions_with_result "$(txt STATUS_WARNING)"
                info "$(txt STATUS_INFO) $(txt INFO_CANT_CHECK_VERSION)"
                yubico_install && yubico_verify
            elif is_newer_version "$installed" "$latest"; then
                yubico_check_versions_with_result "$(txt OP_UPDATING)"
                yubico_install && yubico_verify
            else
                yubico_check_versions_with_result "$(txt OP_LATEST)"
            fi
            ;;
        reinstall)
            yubico_check_versions_with_result "$(txt OP_REINSTALLING)"
            yubico_remove
            yubico_install && yubico_verify
            ;;
        remove)
            yubico_check_versions_with_result "$(txt OP_REMOVING)"
            yubico_remove
            ;;
        check)
            yubico_check_versions_with_result ""
            ;;
        *)
            err "$(txt ERR_UNKNOWN_ACTION) Yubico: $action"
            return 1
            ;;
    esac
}

# ============================================================================
# === 15. FUNKCJA ZBIORCZA — Wykonywanie operacji na wszystkich pakietach ====
# ============================================================================

packages_locative() {
    local n="$1"
    if [[ "$n" == "1" ]]; then
        txt MSG_PACKAGE_LOCATIVE
    else
        txt MSG_PACKAGES_LOCATIVE
    fi
}

manage_all() {
    local action="$1"
    local fails=0
    info "$(txt MSG_EXECUTING) '$action' $(txt MSG_ON_ALL_PACKAGES)"
    show_separator_full
    discord_manage "$action" || fails=$((fails + 1))
    proton_auth_manage "$action" || fails=$((fails + 1))
    proton_pass_manage "$action" || fails=$((fails + 1))
    yubico_manage "$action" || fails=$((fails + 1))
    if [[ $fails -eq 0 ]]; then
        show_separator_full
        ok "$(txt STATUS_SUCCESS) $(txt MSG_COMPLETED) '$action' $(txt MSG_COMPLETED_SUFFIX)"
        return 0
    else
        show_separator_full
        err "$(txt STATUS_ERROR) — $(txt MSG_OPERATION) '$action' $(txt MSG_ENCOUNTERED_ERRORS) $fails $(packages_locative "$fails")."
        return 1
    fi
}

# ============================================================================
# === 16. SAMOAKTUALIZACJA I SPRAWDZANIE WERSJI SKRYPTU ======================
# ============================================================================

get_self_release_json() {
    curl -fsSL --connect-timeout 10 --retry 3 \
        -H "Accept: application/vnd.github+json" \
        -H "User-Agent: ${SCRIPT_REPO_NAME}/${SCRIPT_VERSION}" \
        "$SELF_UPDATE_API_URL" 2>/dev/null || true
}

get_release_tag() {
    local release_json="$1"
    [[ -n "$release_json" ]] || return 1
    jq -r '.tag_name // empty' <<<"$release_json" 2>/dev/null | head -n1 || true
}

get_release_asset_url() {
    local release_json="$1"
    local asset_name="$2"
    [[ -n "$release_json" ]] || return 1
    jq -r --arg name "$asset_name" '.assets[]? | select(.name == $name) | .browser_download_url // empty' <<<"$release_json" 2>/dev/null | head -n1 || true
}

# Weryfikuje sumę kontrolną SHA256 pobranego pliku na podstawie pliku SHA256SUMS.
verify_release_sha256() {
    local file="$1"
    local asset_name="$2"
    local sha_file="$3"
    local expected computed

    if [[ ! -f "$sha_file" ]]; then
        err "$(txt SELF_CHECKSUM_NOT_FOUND)"
        return 1
    fi

    if [[ ! -f "$file" ]]; then
        err "$(txt ERR_NOT_FOUND) $file"
        return 1
    fi

    if ! command -v sha256sum >/dev/null 2>&1; then
        err "$(txt ERR_MISSING_CMD) sha256sum"
        return 1
    fi

    expected="$(awk -v name="$asset_name" '
        {
            fname=$2;
            sub(/^\*/, "", fname);
            sub(/^\.\//, "", fname);
            gsub(/\r$/, "", fname);
            if (fname == name) {
                print $1;
                exit
            }
        }' "$sha_file" 2>/dev/null || true)"

    if [[ -z "$expected" ]]; then
        err "$(txtf SELF_CHECKSUM_MISSING_ENTRY "$asset_name")"
        return 1
    fi

    computed="$(sha256sum "$file" 2>/dev/null | awk '{print $1}' || true)"

    if [[ -z "$computed" ]]; then
        err "$(txt ERR_VERIFY_FAIL) $asset_name"
        return 1
    fi

    if [[ "${computed,,}" == "${expected,,}" ]]; then
        ok "$(txtf SELF_CHECKSUM_OK "$asset_name")"
        return 0
    fi

    err "$(txtf SELF_CHECKSUM_MISMATCH "$asset_name")"
    err "$(txt VERIFY_EXPECTED) $expected"
    err "$(txt VERIFY_COMPUTED) $computed"
    return 1
}

check_self_version() {
    local local_ver="$SCRIPT_VERSION"
    local remote_ver=""
    local release_json
    local title=""
    local pad=0
    info "$(txt SELF_CHECKING)"
    release_json="$(get_self_release_json)"
    if [[ -z "$release_json" ]]; then
        err "$(txt SELF_REMOTE_ERR)"
        return 1
    fi
    remote_ver="$(get_release_tag "$release_json" || true)"
    remote_ver="${remote_ver#v}"
    if [[ -z "$remote_ver" ]]; then
        err "$(txt SELF_REMOTE_ERR)"
        return 1
    fi
    title="$(txt CMD_CHECK_SELF)"
    pad=$((40 - ${#title}))
    if ((pad < 0)); then
        pad=0
    fi
    printf '\n  ┌──────────────────────────────────────────┐\n'
    printf "  │  %s%*s│\n" "$title" "$pad" ''
    printf '  ├──────────────────────────────────────────┤\n'
    printf "     %s %-22s\n" "$(txt VER_INSTALLED)" "$local_ver"
    printf "     %s %-22s\n" "$(txt VER_LATEST)" "$remote_ver"
    printf '  └──────────────────────────────────────────┘\n'
    if is_newer_version "$local_ver" "$remote_ver"; then
        warn "$(txt SELF_NEW_VERSION) $remote_ver"
        info "$(txt SELF_UPDATE_COMMAND_HINT) $(basename "${BASH_SOURCE[0]}") --update-self"
        return 0
    else
        ok "$(txt OP_LATEST)"
        return 0
    fi
}

# Aktualizuje główny skrypt oraz skrypt Yubico z GitHub release.
update_self() {
    local script_path
    script_path="$(realpath "${BASH_SOURCE[0]}" 2>/dev/null || true)"
    if [[ -z "$script_path" ]]; then
        script_path="${BASH_SOURCE[0]}"
    fi

    local script_filename
    script_filename="$(basename "$script_path")"
    local expected_name="$SCRIPT_REPO_NAME.sh"

    if [[ "$script_filename" != "$expected_name" ]]; then
        warn "$(txtf SCRIPT_NAME_MISMATCH "$script_filename" "$expected_name")"
        warn "$(txt SCRIPT_NAME_RENAME_WARNING)"
    fi

    local release_json
    release_json="$(get_self_release_json)"
    if [[ -z "$release_json" ]]; then
        err "$(txt SELF_REMOTE_ERR)"
        err "$(txt SELF_FORCE_HINT)"
        return 1
    fi

    local remote_ver=""
    remote_ver="$(get_release_tag "$release_json" || true)"
    remote_ver="${remote_ver#v}"

    if [[ -z "$remote_ver" ]]; then
        if [[ "${MPM_FORCE_UPDATE:-0}" == "1" ]]; then
            warn "$(txt SELF_REMOTE_ERR)"
        else
            err "$(txt SELF_REMOTE_ERR)"
            err "$(txt SELF_FORCE_HINT)"
            return 1
        fi
    elif [[ "${MPM_FORCE_UPDATE:-0}" != "1" ]]; then
        if ! is_newer_version "$SCRIPT_VERSION" "$remote_ver"; then
            ok "$(txt OP_LATEST)"
            info "$(txt VER_INSTALLED) $SCRIPT_VERSION"
            info "$(txt VER_LATEST) $remote_ver"
            info "$(txt SELF_FORCE_HINT)"
            return 0
        fi
    fi

    # ================================================================
    # 1. Pobierz obowiązkowy plik SHA256SUMS
    # ================================================================

    local sha_url
    local sha_file="$TMP_BASE/SHA256SUMS"

    sha_url="$(get_release_asset_url "$release_json" "SHA256SUMS" || true)"

    if [[ -z "$sha_url" ]]; then
        err "$(txt SELF_CHECKSUM_NOT_FOUND)"
        err "$(txt VERIFY_BLOCK_NO_CHECKSUM)"
        return 1
    fi

    if ! curl -fL --retry 3 --connect-timeout 10 "$sha_url" -o "$sha_file" 2>/dev/null; then
        err "$(txt SELF_CHECKSUM_VERIFY_FAIL)"
        return 1
    fi

    info "$(txt SELF_UPDATE_IN_PROGRESS)"

    # ================================================================
    # 2. Pobierz główny skrypt
    # ================================================================

    local main_url
    main_url="$(get_release_asset_url "$release_json" "$expected_name" || true)"

    if [[ -z "$main_url" ]]; then
        err "$(txtf SELF_ASSET_NOT_FOUND "$expected_name")"
        return 1
    fi

    local tmp_script="$TMP_BASE/new_main_script.sh"

    if ! curl -fL --retry 3 --connect-timeout 10 "$main_url" -o "$tmp_script"; then
        err "$(txt SELF_DOWNLOAD_MAIN_FAIL)"
        return 1
    fi

    # ================================================================
    # 3. Zweryfikuj sumę kontrolną głównego skryptu PRZED nadpisaniem
    # ================================================================

    if ! verify_release_sha256 "$tmp_script" "$expected_name" "$sha_file"; then
        err "$(txt VERIFY_BLOCK_FAIL_CLOSED)"
        return 1
    fi

    if ! grep -q '^SCRIPT_VERSION=' "$tmp_script" || ! bash -n "$tmp_script"; then
        err "$(txt SELF_INVALID_MAIN)"
        return 1
    fi

    local downloaded_ver=""
    downloaded_ver="$(grep -m1 '^SCRIPT_VERSION=' "$tmp_script" | cut -d'"' -f2 || true)"
    downloaded_ver="${downloaded_ver#v}"

    if [[ -n "$remote_ver" && "$downloaded_ver" != "$remote_ver" ]]; then
        err "$(txtf SELF_VERSION_MISMATCH "$downloaded_ver" "$remote_ver")"
        return 1
    fi

    # ================================================================
    # 4. Pobierz skrypt Yubico
    # ================================================================

    local yubi_url
    local tmp_yubi="$TMP_BASE/new_yubi_script.sh"

    yubi_url="$(get_release_asset_url "$release_json" "$YUBICO_SCRIPT_NAME" || true)"

    if [[ -z "$yubi_url" ]]; then
        err "$(txtf SELF_ASSET_NOT_FOUND "$YUBICO_SCRIPT_NAME")"
        return 1
    fi

    if ! curl -fL --retry 3 --connect-timeout 10 "$yubi_url" -o "$tmp_yubi"; then
        err "$(txt SELF_UPDATE_FAIL)"
        return 1
    fi

    # ================================================================
    # 5. Zweryfikuj sumę kontrolną skryptu Yubico PRZED nadpisaniem
    # ================================================================

    if ! verify_release_sha256 "$tmp_yubi" "$YUBICO_SCRIPT_NAME" "$sha_file"; then
        err "$(txt VERIFY_BLOCK_FAIL_CLOSED)"
        return 1
    fi

    if ! grep -q '#!/usr/bin/env bash' "$tmp_yubi" && ! grep -q '#!/bin/bash' "$tmp_yubi"; then
        err "$(txt SELF_INVALID_YUBICO)"
        return 1
    fi

    if ! bash -n "$tmp_yubi"; then
        err "$(txt SELF_INVALID_YUBICO)"
        return 1
    fi

    # ================================================================
    # 6. Dopiero teraz wykonuj backup i nadpisanie
    # ================================================================

    if [[ -f "$YUBICO_SCRIPT" ]]; then
        info "$(txt BACKUP_FILE) $YUBICO_SCRIPT"
        create_backup_in_old_folder "$YUBICO_SCRIPT" || return 1
    fi

    info "$(txt BACKUP_FILE) $script_path"
    create_backup_in_old_folder "$script_path" || return 1

    info "$(txt SELF_OVERWRITE_MAIN)"
    if ! install_file_safe "$tmp_script" "$script_path"; then
        err "$(txt SELF_OVERWRITE_FAIL)"
        return 1
    fi

    ok "$(txt SELF_UPDATE_SUCCESS)"

    local yubi_target="$SCRIPT_DIR/$YUBICO_SCRIPT_NAME"

    if ! install_file_safe "$tmp_yubi" "$yubi_target"; then
        err "$(txt SELF_OVERWRITE_YUBICO_FAIL)"
        err "$(txt SELF_MAIN_UPDATED_YUBICO_NOT)"
        return 1
    fi

    ok "$(txt YUBICO_UPDATE_SUCCESS)"

    echo ""
    info "$(txt BACKUP_PREVIOUS_SAVED) $SCRIPT_DIR/old/"
    info "$(txt BACKUP_RESTORE_HINT) $SCRIPT_DIR/old/"
    echo ""
    info "$(txt SELF_UPDATE_RESTART)"

    exit 0
}

# ============================================================================
# === 17. SPRAWDZANIE ZALEŻNOŚCI I DYSTRYBUCJI ===============================
# ============================================================================

check_dependencies() {
    info "$(txt DEPS_CHECKING)"
    local missing=()
    for dep in "${REQUIRED_DEPS[@]}"; do
        if ! command -v "$dep" &>/dev/null; then
            missing+=("$dep")
        fi
    done
    if [[ ${#missing[@]} -gt 0 ]]; then
        info "$(txt DEPS_MISSING) ${missing[*]}"
        info "$(txt DEPS_INSTALLING)"
        local apt_missing=()
        local pkg
        for m in "${missing[@]}"; do
            case "$m" in
                awk)
                    pkg="gawk"
                    ;;
                find)
                    pkg="findutils"
                    ;;
                sha512sum | sha256sum | realpath)
                    pkg="coreutils"
                    ;;
                *)
                    pkg="$m"
                    ;;
            esac
            if [[ ! " ${apt_missing[*]:-} " =~ [[:space:]]${pkg}[[:space:]] ]]; then
                apt_missing+=("$pkg")
            fi
        done
        sudo apt-get update -qq
        sudo apt-get install -y "${apt_missing[@]}"
        ok "$(txt DEPS_DONE)"
    else
        ok "$(txt DEPS_ALL_OK)"
    fi
    if ! command -v sha512sum &>/dev/null; then
        err "$(txt ERR_MISSING_CMD) sha512sum"
        err "$(txt DEPS_INSTALL_COREUTILS)"
        exit 1
    fi
}

check_distro() {
    if [[ ! -r /etc/os-release ]]; then
        err "$(txt DISTRO_DETECT_FAIL)"
        exit 1
    fi
    set +u
    . /etc/os-release
    set -u
    local os_id="${ID:-}"
    local os_like="${ID_LIKE:-}"
    if [[ "$os_id" == "debian" ]] || [[ "$os_id" == "ubuntu" ]] ||
        [[ "$os_id" == "linuxmint" ]] || [[ "$os_id" == "pop" ]]; then
        ok "$(txt DISTRO_DETECTED_OK): $os_id"
        return 0
    fi
    if [[ "$os_like" == *debian* ]] || [[ "$os_like" == *ubuntu* ]]; then
        ok "$(txt DISTRO_DETECTED_OK) Debian-based: $os_id (like: $os_like)"
        return 0
    fi
    err "$(txt ERR_DISTRO_UNSUPPORTED)"
    err "$(txt STATUS_ERROR) $(txt DISTRO_DETAILS) ID=$os_id, ID_LIKE=$os_like"
    exit 1
}

# ============================================================================
# === 18. BANNER I POMOC — Informacje użytkowe i instrukcje użycia ===========
# ============================================================================

show_banner_pl() {
    cat <<BANNER
╔══════════════════════════════════════════════════════════════════╗
║                                                                  ║
║                        __  __  ____  __  __                      ║
║                       |  \/  ||  _ \|  \/  |                     ║
║                       | |\/| || |_) | |\/| |                     ║
║                       | |  | ||  __/| |  | |                     ║
║                       |_|  |_||_|   |_|  |_|                     ║
║                                                                  ║
║               Multi Package Manager  •  VER: ${SCRIPT_VERSION}               ║
╚══════════════════════════════════════════════════════════════════╝

Autor  : ${SCRIPT_AUTHOR}
GitHub : ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
Język  : Polski

$(txt BANNER_NOTE)

AKTUALNIE OBSŁUGIWANE PAKIETY:
• Discord
• Proton Authenticator
• Proton Pass
• Yubico Authenticator

POMOC: $(basename "${BASH_SOURCE[0]}") --help
BANNER
}

show_banner_en() {
    cat <<BANNER
╔══════════════════════════════════════════════════════════════════╗
║                                                                  ║
║                        __  __  ____  __  __                      ║
║                       |  \/  ||  _ \|  \/  |                     ║
║                       | |\/| || |_) | |\/| |                     ║
║                       | |  | ||  __/| |  | |                     ║
║                       |_|  |_||_|   |_|  |_|                     ║
║                                                                  ║
║               Multi Package Manager  •  VER: ${SCRIPT_VERSION}               ║
╚══════════════════════════════════════════════════════════════════╝

Author   : ${SCRIPT_AUTHOR}
GitHub   : ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
Language : English

$(txt BANNER_NOTE)

CURRENTLY SUPPORTED PACKAGES:
• Discord
• Proton Authenticator
• Proton Pass
• Yubico Authenticator

HELP: $(basename "${BASH_SOURCE[0]}") --help
BANNER
}

show_banner() {
    if [[ "$LANGUAGE_CODE" == "pl" ]]; then
        show_banner_pl
        show_github_info_pl
    else
        show_banner_en
        show_github_info_en
    fi
}

show_help_pl() {
    cat <<HELP
╔═══════════════════════════════════════════════════════════════════╗
║                               POMOC                               ║
╠═══════════════════════════════════════════════════════════════════╣
║                                                                   ║
║  Wersja skryptu: ${SCRIPT_VERSION}                                            ║
║                                                                   ║
║  SKŁADNIA:                                                        ║
║    Multi_Package_Manager.sh <komenda> <pakiet|all>                ║
║                                                                   ║
║  KOMENDY:                                                         ║
║    --help, -h              Pomoc                                  ║
║    --check     <pkg|all>   Sprawdzenie wersji                     ║
║    --install   <pkg|all>   Instalacja pakietu(ów)                 ║
║    --update    <pkg|all>   Aktualizacja pakietu(ów)               ║
║    --reinstall <pkg|all>   Ponowna instalacja pakietu(ów)         ║
║    --remove    <pkg|all>   Usuwanie pakietu(ów)                   ║
║    --check-self            Sprawdzenie aktualizacji skryptu       ║
║    --update-self           Aktualizacja samego skryptu            ║
║    --migrate-to-hidden     Migracja do ukrytego katalogu ~/.mpm/  ║
║                                                                   ║
║  OBSŁUGIWANE PAKIETY:                                             ║
║    all                  — wszystkie poniższe pakiety              ║
║    discord              — Discord                                 ║
║    proton-authenticator — Proton Authenticator                    ║
║    proton-pass          — Proton Pass                             ║
║    yubico               — Yubico Authenticator                    ║
║                                                                   ║
║  PRZYKŁADY:                                                       ║
║    Multi_Package_Manager.sh --install discord                     ║
║    Multi_Package_Manager.sh --update proton-authenticator         ║
║    Multi_Package_Manager.sh --reinstall all                       ║
║    Multi_Package_Manager.sh --remove yubico                       ║
║    Multi_Package_Manager.sh --check all                           ║
║    Multi_Package_Manager.sh --check-self                          ║
║    Multi_Package_Manager.sh --migrate-to-hidden                   ║
║                                                                   ║
║  KONFIGURACJA:                                                    ║
║    mpm.conf         — plik konfiguracyjny                         ║
║    Edytuj mpm.conf w tym samym katalogu co ten skrypt.            ║
║    Szczegóły w komentarzach wewnątrz pliku mpm.conf.              ║
║                                                                   ║
╚═══════════════════════════════════════════════════════════════════╝
OSTRZEŻENIE:
Weryfikacja SHA512 dla pakietów Proton.
Discord — brak oficjalnych sum kontrolnych.
Yubico — zarządzane przez zewnętrzny skrypt.

ZGŁASZANIE BŁĘDÓW:
Jeśli znajdziesz błąd, otwórz issue na GitHub:
${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}/issues

WSPARCIE PROJEKTU:
Jeśli korzystasz z tego skryptu, rozważ nadanie gwiazdki!
⭐ ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
HELP
}

show_help_en() {
    cat <<HELP
╔══════════════════════════════════════════════════════════════════╗
║                               HELP                               ║
╠══════════════════════════════════════════════════════════════════╣
║                                                                  ║
║  Script version: ${SCRIPT_VERSION}                                           ║
║                                                                  ║
║  SYNTAX:                                                         ║
║    Multi_Package_Manager.sh <command> <package|all>              ║
║                                                                  ║
║  COMMANDS:                                                       ║
║    --help, -h              Help                                  ║
║    --check     <pkg|all>   Check version                         ║
║    --install   <pkg|all>   Install package(s)                    ║
║    --update    <pkg|all>   Update package(s)                     ║
║    --reinstall <pkg|all>   Reinstall package(s)                  ║
║    --remove    <pkg|all>   Remove package(s)                     ║
║    --check-self            Check script self-update              ║
║    --update-self           Update script itself                  ║
║    --migrate-to-hidden     Migrate to hidden directory ~/.mpm/   ║
║                                                                  ║
║  SUPPORTED PACKAGES:                                             ║
║    all                  — all packages below                     ║
║    discord              — Discord                                ║
║    proton-authenticator — Proton Authenticator                   ║
║    proton-pass          — Proton Pass                            ║
║    yubico               — Yubico Authenticator                   ║
║                                                                  ║
║  EXAMPLES:                                                       ║
║    Multi_Package_Manager.sh --install discord                    ║
║    Multi_Package_Manager.sh --update proton-authenticator        ║
║    Multi_Package_Manager.sh --reinstall all                      ║
║    Multi_Package_Manager.sh --remove yubico                      ║
║    Multi_Package_Manager.sh --check all                          ║
║    Multi_Package_Manager.sh --check-self                         ║
║    Multi_Package_Manager.sh --migrate-to-hidden                  ║
║                                                                  ║
║  CONFIGURATION:                                                  ║
║    mpm.conf         — local configuration file                   ║
║    Edit mpm.conf in the same directory as this script.           ║
║    See comments inside mpm.conf for all available options.       ║
║                                                                  ║
╚══════════════════════════════════════════════════════════════════╝
WARNING:
SHA512 checksum verification for Proton packages.
Discord — no official checksums available.
Yubico — managed by external script.

BUG REPORTS:
If you find a bug, open an issue on GitHub:
${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}/issues

PROJECT SUPPORT:
If you use this script, consider giving it a star!
⭐ ${SCRIPT_GITHUB}/${SCRIPT_REPO_NAME}
HELP
}

show_help() {
    if [[ "$LANGUAGE_CODE" == "pl" ]]; then
        show_help_pl
    else
        show_help_en
    fi
}

# ============================================================================
# === 19. SPRAWDZANIE NAZWY SKRYPTU ==========================================
# ============================================================================

check_script_name_consistency() {
    local expected_name="$SCRIPT_REPO_NAME.sh"
    local actual_name
    actual_name="$(basename "${BASH_SOURCE[0]}")"
    if [[ "$actual_name" != "$expected_name" ]]; then
        warn "$(txtf SCRIPT_NAME_MISMATCH "$actual_name" "$expected_name")"
        warn "$(txt SCRIPT_NAME_RENAME_WARNING)"
        warn "$(txtf SCRIPT_NAME_RESTORE "$expected_name")"
    fi
}

# ============================================================================
# === 20. FUNKCJA MAIN — Główny punkt wejścia i obsługa argumentów CLI =======
# ============================================================================

main() {
	detect_language "$@"
        load_language_from_config
    # Zabezpieczenie przed uruchomieniem jako root (wymuszenie użycia sudo tylko tam, gdzie to konieczne)
    if [[ ${EUID:-$(id -u)} -eq 0 ]]; then
        err "$(txt ERR_ROOT_FORBIDDEN)"
        exit 1
    fi
    if [[ "${1:-}" == "--help" || "${1:-}" == "-h" ]]; then
        show_help
        exit 0
    fi
    detect_language "$@"
    load_config
    local filtered=()
    while [[ $# -gt 0 ]]; do
        case "$1" in
            --lang | -l)
                shift
                if (($# > 0)) && [[ "$1" != --* ]]; then
                    shift
                fi
                ;;
            *)
                filtered+=("$1")
                shift
                ;;
        esac
    done
    set -- ${filtered[@]+"${filtered[@]}"}
    show_language_info
    if [[ "$CONFIG_LOADED" == "true" ]]; then
        ok "$(txt CFG_LOAD_SUCCESS)"
    fi
    check_script_name_consistency
    if [[ $# -eq 0 ]]; then
        show_banner
        show_hidden_dir_suggestion "$@"
        if [[ "$AUTO_UPDATE_CHECK" == "true" ]] && command -v curl >/dev/null 2>&1 && command -v jq >/dev/null 2>&1; then
            show_separator_full
            check_self_version || true
            show_separator_full
        fi
        exit 0
    fi
    if [[ "${1:-}" != "--help" && "${1:-}" != "-h" && "${1:-}" != "--migrate-to-hidden" ]]; then
        check_distro
        check_dependencies
    fi
    case "${1:-}" in
        --install | install | --update | update | --reinstall | reinstall | --remove | remove)
            if [[ $# -lt 2 ]]; then
                err "$(txt ERR_MISSING_PKG_NAME) $(basename "${BASH_SOURCE[0]}") $1 <package>"
                exit 1
            fi
            local action="${1#--}"
            local package="${2,,}"
            ensure_config_dir
            case "$package" in
                all | All)
                    manage_all "$action" || exit 1
                    ;;
                discord)
                    discord_manage "$action" || exit 1
                    ;;
                proton-authenticator)
                    proton_auth_manage "$action" || exit 1
                    ;;
                proton-pass)
                    proton_pass_manage "$action" || exit 1
                    ;;
                yubico)
                    yubico_manage "$action" || exit 1
                    ;;
                *)
                    err "$(txt ERR_UNKNOWN_PACKAGE) $package"
                    err "$(txt STATUS_INFO) $(txt INFO_SUPPORTED_PACKAGES) ${SUPPORTED_PACKAGES[*]}"
                    exit 1
                    ;;
            esac
            ;;
        --check | check)
            if [[ $# -lt 2 ]]; then
                err "$(txt ERR_MISSING_PKG)"
                exit 1
            fi
            local package="${2,,}"
            case "$package" in
                all | All)
                    show_separator_full
                    echo "                  $(txt CHECK_ALL_TITLE)"
                    show_separator_full
                    discord_check_versions_with_result ""
                    proton_auth_check_versions_with_result ""
                    proton_pass_check_versions_with_result ""
                    yubico_check_versions_with_result ""
                    ;;
                discord)
                    discord_check_versions_with_result ""
                    ;;
                proton-authenticator)
                    proton_auth_check_versions_with_result ""
                    ;;
                proton-pass)
                    proton_pass_check_versions_with_result ""
                    ;;
                yubico)
                    yubico_check_versions_with_result ""
                    ;;
                *)
                    err "$(txt ERR_UNKNOWN_PACKAGE) $package"
                    exit 1
                    ;;
            esac
            ;;
        --check-self)
            check_self_version
            ;;
        --update-self)
            update_self
            ;;
        --migrate-to-hidden)
            migrate_to_hidden
            ;;
        --help | -h)
            show_help
            ;;
        *)
            err "$(txt ERR_UNKNOWN_CMD) ${1:-}"
            show_banner
            show_help
            exit 1
            ;;
    esac
}
main "$@"