param(
    [string]$ApiBaseUrl = "http://192.168.200.61:18121/api/v1",
    [string]$ClusterID = "cfc0743d-d960-49fb-9de8-96e063d5e4aa",
    [string]$ActorUserID = "f67d943f-5397-4b3a-a229-695fe67ad700",
    [string]$EntryNodeName = "test-1",
    [string]$ExitNodeName = "test-2",
    [string]$EntryBaseUrl = "http://192.168.200.61:19131",
    [string]$ResultPath = "artifacts\c19t-remote-workspace-mailbox-consumer-checkpoint-smoke-result.json"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).ProviderPath
$runId = "c19t-" + (Get-Date -Format "yyyyMMdd-HHmmss")
$consumerID = "rdp-worker-probe"

function Invoke-Api {
    param([string]$Method, [string]$Path, [object]$Body = $null)
    $uri = "$ApiBaseUrl$Path"
    if ($null -eq $Body) { return Invoke-RestMethod -Method $Method -Uri $uri -TimeoutSec 30 }
    return Invoke-RestMethod -Method $Method -Uri $uri -ContentType "application/json" -Body ($Body | ConvertTo-Json -Depth 80) -TimeoutSec 30
}

function Get-PropertyValue {
    param([object]$Item, [string]$Name, [object]$Default = $null)
    if ($null -eq $Item) { return $Default }
    $property = $Item.PSObject.Properties[$Name]
    if ($null -eq $property) { return $Default }
    return $property.Value
}

function ConvertTo-Base64UrlJson {
    param([object]$Value)
    if ($Value -is [string]) { $json = $Value } else { $json = $Value | ConvertTo-Json -Depth 80 -Compress }
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($json)
    return [Convert]::ToBase64String($bytes).TrimEnd("=").Replace("+", "-").Replace("/", "_")
}

function Get-NodeByName {
    param([string]$Name)
    $nodes = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes?actor_user_id=$ActorUserID").nodes
    $node = @($nodes | Where-Object { $_.name -eq $Name }) | Select-Object -First 1
    if ($null -eq $node) { throw "Node '$Name' was not found in cluster $ClusterID" }
    return $node
}

function Disable-ExistingRemoteWorkspaceRoutes {
    param([string]$SourceNodeID, [string]$DestinationNodeID)
    $items = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/mesh/route-intents?actor_user_id=$ActorUserID").route_intents
    foreach ($item in @($items)) {
        if ([string](Get-PropertyValue -Item $item -Name "status" -Default "") -ne "active") { continue }
        if ([string](Get-PropertyValue -Item $item -Name "service_class" -Default "") -ne "remote_workspace") { continue }
        $sourceSelector = Get-PropertyValue -Item $item -Name "source_selector" -Default $null
        $destinationSelector = Get-PropertyValue -Item $item -Name "destination_selector" -Default $null
        if ([string](Get-PropertyValue -Item $sourceSelector -Name "node_id" -Default "") -ne $SourceNodeID) { continue }
        if ([string](Get-PropertyValue -Item $destinationSelector -Name "node_id" -Default "") -ne $DestinationNodeID) { continue }
        [void](Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents/$($item.id)/disable" -Body @{
            actor_user_id = $ActorUserID
            reason = "c19t isolate remote workspace mailbox consumer checkpoint smoke"
        })
    }
}

function New-RemoteWorkspaceRouteIntent {
    param([string]$SourceNodeID, [string]$DestinationNodeID)
    $expiresAt = (Get-Date).ToUniversalTime().AddMinutes(5).ToString("o")
    return Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents" -Body @{
        actor_user_id = $ActorUserID
        source_selector = @{ node_id = $SourceNodeID }
        destination_selector = @{ node_id = $DestinationNodeID }
        service_class = "remote_workspace"
        priority = 2100000000
        policy = @{
            synthetic_enabled = $true
            route_version = "$runId-remote-workspace"
            policy_version = "$runId-remote-workspace"
            peer_directory_version = "$runId-remote-workspace"
            hops = @($SourceNodeID, $DestinationNodeID)
            allowed_channels = @("control", "interactive", "reliable", "bulk", "droppable")
            max_ttl = 8
            max_hops = 8
            expires_at = $expiresAt
            metadata = @{ smoke = "c19t_remote_workspace_mailbox_consumer_checkpoint"; run_id = $runId }
        }
    }
}

function New-FrameBatch {
    param([int]$Index)
    return [ordered]@{
        schema_version = "rap.remote_workspace_frame_batch.v1"
        probe_only = $true
        service_class = "remote_workspace"
        channel_class = "interactive"
        adapter_contract_id = "rap.rdp_worker.remote_workspace_adapter_contract_probe.v1"
        frames = @(@{ channel = "display"; direction = "adapter_to_client"; payload_encoding = "none"; payload_length = $Index; droppable = $true })
    }
}

function Invoke-FrameBatch {
    param([object]$FrameBatch, [hashtable]$Headers, [string]$Url)
    $response = Invoke-WebRequest -Method POST -Uri $Url -Headers $Headers -Body ($FrameBatch | ConvertTo-Json -Depth 80 -Compress) -ContentType "application/vnd.rap.remote-workspace-frame-batch.v1+json" -TimeoutSec 30
    return [ordered]@{ status_code = [int]$response.StatusCode; body = ($response.Content | ConvertFrom-Json) }
}

function Invoke-Mailbox {
    param([string]$SessionID, [string]$Query = "")
    $url = "$EntryBaseUrl/mesh/v1/remote-workspace/adapter-sessions/$SessionID/mailbox$Query"
    $response = Invoke-WebRequest -Method GET -Uri $url -TimeoutSec 30
    $json = $null
    if ($response.Content) { $json = $response.Content | ConvertFrom-Json }
    return [ordered]@{ status_code = [int]$response.StatusCode; body = $response.Content; json = $json }
}

function Invoke-Control {
    param([string]$SessionID)
    $url = "$EntryBaseUrl/mesh/v1/remote-workspace/adapter-sessions/$SessionID/control"
    $body = @{ action = "close"; reason = "c19t mailbox consumer checkpoint close" } | ConvertTo-Json -Compress
    return Invoke-RestMethod -Method POST -Uri $url -ContentType "application/json" -Body $body -TimeoutSec 30
}

function Get-RemoteWorkspaceSinkReports {
    param([string]$NodeID)
    $workloadStatus = $null
    $workloadSink = $null
    $telemetry = $null
    $telemetrySink = $null
    $statuses = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes/$NodeID/workloads/status?actor_user_id=$ActorUserID").workload_statuses
    $workloadStatus = @($statuses | Where-Object { $_.service_type -eq "rdp-worker" } | Select-Object -First 1)
    if ($null -ne $workloadStatus) {
        $workloadSink = Get-PropertyValue -Item $workloadStatus.status_payload -Name "remote_workspace_adapter_sink" -Default $null
    }
    $telemetryItems = @((Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes/$NodeID/telemetry?actor_user_id=$ActorUserID&limit=10").telemetry)
    $telemetry = $telemetryItems | Select-Object -First 1
    if ($null -ne $telemetry) {
        $telemetryPayload = Get-PropertyValue -Item $telemetry -Name "payload" -Default $null
        $telemetrySink = Get-PropertyValue -Item $telemetryPayload -Name "remote_workspace_adapter_sink_report" -Default $null
    }
    return [ordered]@{
        workload_status = $workloadStatus
        workload_sink = $workloadSink
        telemetry = $telemetry
        telemetry_sink = $telemetrySink
    }
}

function Test-ConsumerReport {
    param(
        [object]$Sink,
        [object]$BaselineSink,
        [string]$AdapterSessionID,
        [int64]$AckSequence
    )
    if ($null -eq $Sink) { return $false }
    $baselineRead = [int64](Get-PropertyValue -Item $BaselineSink -Name "mailbox_consumer_read_total" -Default 0)
    $baselineAck = [int64](Get-PropertyValue -Item $BaselineSink -Name "mailbox_consumer_ack_total" -Default 0)
    return (
        [string](Get-PropertyValue -Item $Sink -Name "schema_version" -Default "") -eq "rap.remote_workspace_adapter_sink_report.v1" -and
        [string](Get-PropertyValue -Item $Sink -Name "payload_traffic" -Default "") -eq "none" -and
        [int64](Get-PropertyValue -Item $Sink -Name "mailbox_consumer_read_total" -Default 0) -ge ($baselineRead + 2) -and
        [int64](Get-PropertyValue -Item $Sink -Name "mailbox_consumer_ack_total" -Default 0) -ge ($baselineAck + 1) -and
        [string](Get-PropertyValue -Item $Sink -Name "last_mailbox_consumer_id" -Default "") -eq $consumerID -and
        [string](Get-PropertyValue -Item $Sink -Name "last_mailbox_consumer_adapter_session_id" -Default "") -eq $AdapterSessionID -and
        [int64](Get-PropertyValue -Item $Sink -Name "last_mailbox_consumer_checkpoint_sequence" -Default 0) -ge $AckSequence -and
        [int64](Get-PropertyValue -Item $Sink -Name "last_mailbox_consumer_ack_sequence" -Default 0) -eq $AckSequence
    )
}

$routeID = ""
try {
    $entryNode = Get-NodeByName -Name $EntryNodeName
    $exitNode = Get-NodeByName -Name $ExitNodeName
    $baseline = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
    $baselineSink = if ($null -ne $baseline.workload_sink) { $baseline.workload_sink } else { $baseline.telemetry_sink }
    Disable-ExistingRemoteWorkspaceRoutes -SourceNodeID $entryNode.id -DestinationNodeID $exitNode.id
    $route = (New-RemoteWorkspaceRouteIntent -SourceNodeID $entryNode.id -DestinationNodeID $exitNode.id).route_intent
    $routeID = [string]$route.id

    $leaseResponse = Invoke-Api -Method POST -Path "/clusters/$ClusterID/fabric/service-channels/leases" -Body @{
        actor_user_id = $ActorUserID
        organization_id = "org-home"
        user_id = "user-t"
        resource_id = "$runId-remote-workspace"
        service_class = "remote_workspace"
        entry_node_ids = @([string]$entryNode.id)
        exit_node_ids = @([string]$exitNode.id)
        preferred_entry_node_id = [string]$entryNode.id
        preferred_exit_node_id = [string]$exitNode.id
        ttl_seconds = 120
        metadata = @{ smoke = "c19t_remote_workspace_mailbox_consumer_checkpoint"; run_id = $runId }
    }
    $lease = $leaseResponse.fabric_service_channel_lease
    $authorityPayload = Get-PropertyValue -Item $lease -Name "authority_payload" -Default $null
    if ($authorityPayload -is [string] -and $authorityPayload.Length -gt 0) { $decodedAuthority = $authorityPayload | ConvertFrom-Json } else { $decodedAuthority = $authorityPayload }

    $ingressUrl = "$EntryBaseUrl/api/v1/clusters/$ClusterID/fabric/service-channels/$($lease.channel_id)/remote-workspaces/$($lease.resource_id)/streams/interactive"
    $headers = @{
        "X-RAP-Service-Channel-Token" = [string]$lease.token.token
        "X-RAP-Fabric-Channel-ID" = [string]$lease.channel_id
        "X-RAP-Service-Channel-Authority-Payload" = ConvertTo-Base64UrlJson -Value $decodedAuthority
        "X-RAP-Service-Channel-Authority-Signature" = ConvertTo-Base64UrlJson -Value (Get-PropertyValue -Item $lease -Name "authority_signature" -Default $null)
        "X-RAP-Service-Class" = "remote_workspace"
        "X-RAP-Channel-Class" = "interactive"
    }

    $firstDelivery = Invoke-FrameBatch -FrameBatch (New-FrameBatch -Index 1) -Headers $headers -Url $ingressUrl
    $adapterSessionID = [string](Get-PropertyValue -Item $firstDelivery.body -Name "adapter_session_id" -Default "")
    $secondDelivery = Invoke-FrameBatch -FrameBatch (New-FrameBatch -Index 2) -Headers $headers -Url $ingressUrl

    $checkpointMailbox = Invoke-Mailbox -SessionID $adapterSessionID -Query "?consumer_id=$consumerID&limit=10"
    $events = @(Get-PropertyValue -Item $checkpointMailbox.json -Name "events" -Default @())
    $checkpoint = [int64](Get-PropertyValue -Item $checkpointMailbox.json -Name "consumer_checkpoint_sequence" -Default 0)
    $ackMailbox = Invoke-Mailbox -SessionID $adapterSessionID -Query "?consumer_id=$consumerID&ack_sequence=$checkpoint&limit=10"
    $control = Invoke-Control -SessionID $adapterSessionID

    $observed = $null
    $deadline = (Get-Date).AddSeconds(90)
    while ((Get-Date) -lt $deadline) {
        Start-Sleep -Seconds 5
        $observed = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
        if (
            (Test-ConsumerReport -Sink $observed.workload_sink -BaselineSink $baselineSink -AdapterSessionID $adapterSessionID -AckSequence $checkpoint) -and
            (Test-ConsumerReport -Sink $observed.telemetry_sink -BaselineSink $baselineSink -AdapterSessionID $adapterSessionID -AckSequence $checkpoint)
        ) {
            break
        }
    }
    if ($null -eq $observed) {
        $observed = Get-RemoteWorkspaceSinkReports -NodeID $entryNode.id
    }

    $checks = [ordered]@{
        lease_ready = ([string]$lease.status -eq "ready")
        deliveries_accepted = ([int]$firstDelivery.status_code -eq 202 -and [int]$secondDelivery.status_code -eq 202 -and $adapterSessionID -match "^rap-rw-adapter-session-[0-9a-f]{24}$")
        checkpoint_visible = ([int]$checkpointMailbox.status_code -eq 200 -and [string]$checkpointMailbox.json.consumer_id -eq $consumerID -and [int64]$checkpointMailbox.json.consumer_read_total -eq 1 -and [int64]$checkpointMailbox.json.consumer_ack_total -eq 0 -and $checkpoint -ge 2 -and [int]$checkpointMailbox.json.consumer_lag_count -ge 2 -and $events.Count -ge 2)
        ack_visible = ([int]$ackMailbox.status_code -eq 200 -and [string]$ackMailbox.json.consumer_id -eq $consumerID -and [int64]$ackMailbox.json.consumer_read_total -eq 2 -and [int64]$ackMailbox.json.consumer_ack_total -eq 1 -and [int64]$ackMailbox.json.consumer_ack_sequence -eq $checkpoint -and [int]$ackMailbox.json.consumer_lag_count -eq 0)
        workload_consumer_telemetry_visible = (Test-ConsumerReport -Sink $observed.workload_sink -BaselineSink $baselineSink -AdapterSessionID $adapterSessionID -AckSequence $checkpoint)
        telemetry_consumer_telemetry_visible = (Test-ConsumerReport -Sink $observed.telemetry_sink -BaselineSink $baselineSink -AdapterSessionID $adapterSessionID -AckSequence $checkpoint)
        close_accepted = ([bool]$control.accepted -and [string]$control.session_state -eq "closed")
    }
    $failed = @($checks.GetEnumerator() | Where-Object { -not $_.Value } | ForEach-Object { $_.Key })

    $result = [ordered]@{
        schema_version = "c19t.remote_workspace_mailbox_consumer_checkpoint_smoke.v1"
        run_id = $runId
        cluster_id = $ClusterID
        entry_node = @{ id = $entryNode.id; name = $EntryNodeName }
        exit_node = @{ id = $exitNode.id; name = $ExitNodeName }
        channel_id = $lease.channel_id
        route_id = $routeID
        adapter_session_id = $adapterSessionID
        baseline = $baseline
        first_delivery = $firstDelivery
        second_delivery = $secondDelivery
        checkpoint_mailbox = $checkpointMailbox
        ack_mailbox = $ackMailbox
        control = $control
        observed = $observed
        checks = $checks
        failed_checks = $failed
        passed = ($failed.Count -eq 0)
    }
} finally {
    if ($routeID) {
        try {
            [void](Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents/$routeID/disable" -Body @{
                actor_user_id = $ActorUserID
                reason = "c19t mailbox consumer checkpoint cleanup"
            })
        } catch {
            Write-Warning "cleanup failed after c19t smoke: $($_.Exception.Message)"
        }
    }
}

$fullResultPath = Join-Path $repoRoot $ResultPath
$resultDir = Split-Path -Parent $fullResultPath
if ($resultDir) { New-Item -ItemType Directory -Force -Path $resultDir | Out-Null }
$result | ConvertTo-Json -Depth 100 | Set-Content -Encoding UTF8 -Path $fullResultPath

if (-not $result.passed) {
    throw "C19T remote workspace mailbox consumer checkpoint smoke failed. Result: $fullResultPath Failed: $($failed -join ', ')"
}

Write-Host "C19T remote workspace mailbox consumer checkpoint smoke passed. Result: $fullResultPath"
$result