#!/bin/sh
	DEFAULT_DNSMASQ_CFGID="$(uci -q show "dhcp.@dnsmasq[0]" | awk 'NR==1 {split($0, conf, /[.=]/); print conf[2]}' 2>/dev/null)"
	if [ -f "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID" ]; then
	   DNSMASQ_CONF_DIR="$(awk -F '=' '/^conf-dir=/ {print $2}' "/tmp/etc/dnsmasq.conf.$DEFAULT_DNSMASQ_CFGID" 2>/dev/null)"
	else
	   DNSMASQ_CONF_DIR="/tmp/dnsmasq.d"
	fi
	DNSMASQ_CONF_DIR=${DNSMASQ_CONF_DIR%*/}
	rm -rf /etc/wycloud >/dev/null 2>&1
	rm -rf /etc/config/wycloud >/dev/null 2>&1
	rm -rf /tmp/wycloud.log /tmp/wycloud_start.log >/dev/null 2>&1
	rm -rf /tmp/wycloud_last_version /tmp/wycloud.change >/dev/null 2>&1
	rm -rf /usr/share/wycloud >/dev/null 2>&1
	rm -rf ${DNSMASQ_CONF_DIR}/dnsmasq_wycloud_custom_domain.conf >/dev/null 2>&1
	rm -rf ${DNSMASQ_CONF_DIR}/dnsmasq_wycloud_chnroute_pass.conf >/dev/null 2>&1
	rm -rf ${DNSMASQ_CONF_DIR}/dnsmasq_wycloud_chnroute6_pass.conf >/dev/null 2>&1
	rm -rf /tmp/etc/wycloud >/dev/null 2>&1
	rm -rf /www/luci-static/resources/wycloud >/dev/null 2>&1
	# Uninstall (not upgrade): wipe staged restore copies + sysupgrade keep list
	if [ "$1" != "upgrade" ]; then
		rm -rf /tmp/wycloud.bak /tmp/wycloud /tmp/wycloud_ui /tmp/wycloud_pac /tmp/wycloud_data >/dev/null 2>&1
		rm -f /lib/upgrade/keep.d/luci-app-wycloud >/dev/null 2>&1
	fi
	# Remove brand-only network.lua helpers (marker rewritten at inject time)
	sed -i '/wycloud Append/,/wycloud Append End/d' "/usr/lib/lua/luci/model/network.lua" >/dev/null 2>&1
	uci -q delete firewall.wycloud
	uci -q commit firewall
	[ -f "/etc/config/ucitrack" ] && {
	uci -q delete ucitrack.@wycloud[-1]
	uci -q commit ucitrack
	}

	# --- emergency: restore DNS if still hijacked to dead local resolver ---
	for __s in $(uci -q get dhcp.@dnsmasq[0].server 2>/dev/null); do
		case "$__s" in
			127.0.0.1#*|::1#*) uci -q del_list dhcp.@dnsmasq[0].server="$__s" ;;
		esac
	done
	if [ "$(uci -q get dhcp.@dnsmasq[0].noresolv)" = "1" ] && [ -z "$(uci -q get dhcp.@dnsmasq[0].server 2>/dev/null)" ]; then
		uci -q set dhcp.@dnsmasq[0].noresolv=0
		if [ -s /tmp/resolv.conf.d/resolv.conf.auto ]; then
			uci -q set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.d/resolv.conf.auto
		elif [ -s /tmp/resolv.conf.auto ]; then
			uci -q set dhcp.@dnsmasq[0].resolvfile=/tmp/resolv.conf.auto
		fi
		uci -q set dhcp.@dnsmasq[0].localuse=1
	fi
	uci -q commit dhcp
	/etc/init.d/dnsmasq restart >/dev/null 2>&1 || true
	# --- emergency: strip leftover nft/iptables jumps for this pkg_tag ---
	if command -v nft >/dev/null 2>&1; then
		for __nft in input forward output dstnat srcnat nat_output mangle_prerouting mangle_output; do
			for __h in $(nft -a list chain inet fw4 $__nft 2>/dev/null | grep -E "wycloud" | awk -F '# handle ' '{print $2}'); do
				nft delete rule inet fw4 $__nft handle $__h >/dev/null 2>&1 || true
			done
		done
		for __h in $(nft -a list chains 2>/dev/null | grep -E "chain wycloud" | awk -F '# handle ' '{print $2}'); do
			nft delete chain inet fw4 handle $__h >/dev/null 2>&1 || true
		done
	fi
	ip rule del fwmark 0x262 table 0x262 >/dev/null 2>&1 || true
	ip route del local 0.0.0.0/0 dev lo table 0x262 >/dev/null 2>&1 || true
	ip -6 rule del fwmark 0x262 table 0x262 >/dev/null 2>&1 || true
	ip -6 route del local ::/0 dev lo table 0x262 >/dev/null 2>&1 || true

	rm -rf /tmp/luci-indexcache /tmp/luci-indexcache.* /var/luci-indexcache /var/luci-indexcache.* >/dev/null 2>&1
	rm -rf /tmp/luci-modulecache /var/luci-modulecache >/dev/null 2>&1
	exit 0
