param(
    [string]$ApiBaseUrl = "http://192.168.200.61:18121/api/v1",
    [string]$ClusterID = "cfc0743d-d960-49fb-9de8-96e063d5e4aa",
    [string]$ActorUserID = "f67d943f-5397-4b3a-a229-695fe67ad700",
    [string]$EntryNodeName = "test-1",
    [string]$ExitNodeName = "test-2",
    [string]$EntryBaseUrl = "http://192.168.200.61:19131",
    [string]$ResultPath = "artifacts\c19e-remote-workspace-frame-batch-contract-smoke-result.json"
)

Set-StrictMode -Version Latest
$ErrorActionPreference = "Stop"

$repoRoot = (Resolve-Path (Join-Path $PSScriptRoot "..\..")).ProviderPath
$runId = "c19e-" + (Get-Date -Format "yyyyMMdd-HHmmss")

function Invoke-Api {
    param([string]$Method, [string]$Path, [object]$Body = $null)
    $uri = "$ApiBaseUrl$Path"
    try {
        if ($null -eq $Body) {
            return Invoke-RestMethod -Method $Method -Uri $uri -TimeoutSec 30
        }
        return Invoke-RestMethod -Method $Method -Uri $uri -ContentType "application/json" -Body ($Body | ConvertTo-Json -Depth 80) -TimeoutSec 30
    }
    catch {
        $statusCode = $null
        if ($_.Exception.Response) { $statusCode = [int]$_.Exception.Response.StatusCode }
        $details = $_.ErrorDetails.Message
        if (-not $details) { $details = $_.Exception.Message }
        throw "$Method $Path failed with HTTP $statusCode`: $details"
    }
}

function Get-PropertyValue {
    param([object]$Item, [string]$Name, [object]$Default = $null)
    if ($null -eq $Item) { return $Default }
    $property = $Item.PSObject.Properties[$Name]
    if ($null -eq $property) { return $Default }
    return $property.Value
}

function ConvertTo-Base64UrlJson {
    param([object]$Value)
    if ($Value -is [string]) { $json = $Value } else { $json = $Value | ConvertTo-Json -Depth 80 -Compress }
    $bytes = [System.Text.Encoding]::UTF8.GetBytes($json)
    return [Convert]::ToBase64String($bytes).TrimEnd("=").Replace("+", "-").Replace("/", "_")
}

function Get-NodeByName {
    param([string]$Name)
    $nodes = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes?actor_user_id=$ActorUserID").nodes
    $node = @($nodes | Where-Object { $_.name -eq $Name }) | Select-Object -First 1
    if ($null -eq $node) { throw "Node '$Name' was not found in cluster $ClusterID" }
    return $node
}

function Wait-ForWorkloadStatus {
    param([string]$NodeID, [string]$ServiceType, [string]$ExpectedState, [int]$TimeoutSeconds = 90)
    $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
    $last = $null
    while ((Get-Date) -lt $deadline) {
        Start-Sleep -Seconds 5
        $statuses = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/nodes/$NodeID/workloads/status?actor_user_id=$ActorUserID").workload_statuses
        $last = @($statuses | Where-Object { $_.service_type -eq $ServiceType } | Select-Object -First 1)
        if ($null -ne $last -and [string]$last.reported_state -eq $ExpectedState) { return $last }
    }
    throw "Timed out waiting for $ServiceType=$ExpectedState. Last observed: $($last | ConvertTo-Json -Depth 20)"
}

function Disable-ExistingRemoteWorkspaceRoutes {
    param([string]$SourceNodeID, [string]$DestinationNodeID)
    $items = (Invoke-Api -Method GET -Path "/clusters/$ClusterID/mesh/route-intents?actor_user_id=$ActorUserID").route_intents
    foreach ($item in @($items)) {
        if ([string](Get-PropertyValue -Item $item -Name "status" -Default "") -ne "active") { continue }
        if ([string](Get-PropertyValue -Item $item -Name "service_class" -Default "") -ne "remote_workspace") { continue }
        $sourceSelector = Get-PropertyValue -Item $item -Name "source_selector" -Default $null
        $destinationSelector = Get-PropertyValue -Item $item -Name "destination_selector" -Default $null
        if ([string](Get-PropertyValue -Item $sourceSelector -Name "node_id" -Default "") -ne $SourceNodeID) { continue }
        if ([string](Get-PropertyValue -Item $destinationSelector -Name "node_id" -Default "") -ne $DestinationNodeID) { continue }
        [void](Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents/$($item.id)/disable" -Body @{
            actor_user_id = $ActorUserID
            reason = "c19e isolate remote workspace frame batch smoke"
        })
    }
}

function New-RemoteWorkspaceRouteIntent {
    param([string]$SourceNodeID, [string]$DestinationNodeID)
    $expiresAt = (Get-Date).ToUniversalTime().AddMinutes(5).ToString("o")
    return Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents" -Body @{
        actor_user_id = $ActorUserID
        source_selector = @{ node_id = $SourceNodeID }
        destination_selector = @{ node_id = $DestinationNodeID }
        service_class = "remote_workspace"
        priority = 2100000000
        policy = @{
            synthetic_enabled = $true
            route_version = "$runId-remote-workspace"
            policy_version = "$runId-remote-workspace"
            peer_directory_version = "$runId-remote-workspace"
            hops = @($SourceNodeID, $DestinationNodeID)
            allowed_channels = @("control", "interactive", "reliable", "bulk", "droppable")
            max_ttl = 8
            max_hops = 8
            expires_at = $expiresAt
            metadata = @{ smoke = "c19e_remote_workspace_frame_batch_contract"; run_id = $runId }
        }
    }
}

$entryNode = Get-NodeByName -Name $EntryNodeName
$exitNode = Get-NodeByName -Name $ExitNodeName

Invoke-Api -Method PUT -Path "/clusters/$ClusterID/nodes/$($entryNode.id)/workloads/rdp-worker/desired" -Body @{
    actor_user_id = $ActorUserID
    desired_state = "enabled"
    version = "c19e-remote-workspace-frame-batch-$runId"
    runtime_mode = "native"
    artifact_ref = "builtin:rdp-worker-adapter-contract-probe"
    config = @{ adapter_contract_probe = $true; service_class = "remote_workspace"; run_id = $runId }
    environment = @{}
} | Out-Null

$workloadStatus = Wait-ForWorkloadStatus -NodeID $entryNode.id -ServiceType "rdp-worker" -ExpectedState "running"
$workloadPayload = $workloadStatus.status_payload
$frameContract = Get-PropertyValue -Item $workloadPayload -Name "frame_batch_contract" -Default $null

Disable-ExistingRemoteWorkspaceRoutes -SourceNodeID $entryNode.id -DestinationNodeID $exitNode.id
$route = (New-RemoteWorkspaceRouteIntent -SourceNodeID $entryNode.id -DestinationNodeID $exitNode.id).route_intent
$routeID = [string]$route.id

$leaseResponse = Invoke-Api -Method POST -Path "/clusters/$ClusterID/fabric/service-channels/leases" -Body @{
    actor_user_id = $ActorUserID
    organization_id = "org-home"
    user_id = "user-m"
    resource_id = "$runId-remote-workspace"
    service_class = "remote_workspace"
    entry_node_ids = @([string]$entryNode.id)
    exit_node_ids = @([string]$exitNode.id)
    preferred_entry_node_id = [string]$entryNode.id
    preferred_exit_node_id = [string]$exitNode.id
    ttl_seconds = 120
    metadata = @{ smoke = "c19e_remote_workspace_frame_batch_contract"; run_id = $runId }
}
$lease = $leaseResponse.fabric_service_channel_lease
$authorityPayload = Get-PropertyValue -Item $lease -Name "authority_payload" -Default $null
if ($authorityPayload -is [string] -and $authorityPayload.Length -gt 0) { $decodedAuthority = $authorityPayload | ConvertFrom-Json } else { $decodedAuthority = $authorityPayload }

$frameBatch = [ordered]@{
    schema_version = "rap.remote_workspace_frame_batch.v1"
    probe_only = $true
    service_class = "remote_workspace"
    channel_class = "interactive"
    adapter_contract_id = "rap.rdp_worker.remote_workspace_adapter_contract_probe.v1"
    frames = @(
        @{ channel = "input"; direction = "client_to_adapter"; payload_encoding = "none"; payload_length = 0; droppable = $true },
        @{ channel = "display"; direction = "adapter_to_client"; payload_encoding = "none"; payload_length = 0; droppable = $true },
        @{ channel = "cursor"; direction = "adapter_to_client"; payload_encoding = "none"; payload_length = 0; droppable = $true }
    )
}

$ingressUrl = "$EntryBaseUrl/api/v1/clusters/$ClusterID/fabric/service-channels/$($lease.channel_id)/remote-workspaces/$($lease.resource_id)/streams/interactive"
$ingressResponse = Invoke-WebRequest -Method POST -Uri $ingressUrl -Headers @{
    "X-RAP-Service-Channel-Token" = [string]$lease.token.token
    "X-RAP-Fabric-Channel-ID" = [string]$lease.channel_id
    "X-RAP-Service-Channel-Authority-Payload" = ConvertTo-Base64UrlJson -Value $decodedAuthority
    "X-RAP-Service-Channel-Authority-Signature" = ConvertTo-Base64UrlJson -Value (Get-PropertyValue -Item $lease -Name "authority_signature" -Default $null)
    "X-RAP-Service-Class" = "remote_workspace"
    "X-RAP-Channel-Class" = "interactive"
} -Body ($frameBatch | ConvertTo-Json -Depth 40 -Compress) -ContentType "application/vnd.rap.remote-workspace-frame-batch.v1+json" -TimeoutSec 30
$ingressBody = $ingressResponse.Content | ConvertFrom-Json

$checks = [ordered]@{
    rdp_worker_probe_running = ([string]$workloadStatus.reported_state -eq "running")
    adapter_contract_reports_frame_batch = ($null -ne $frameContract -and [string]$frameContract.schema_version -eq "rap.remote_workspace_frame_batch.v1")
    adapter_contract_probe_only = ($null -ne $frameContract -and [bool]$frameContract.probe_only -and [string]$frameContract.payload_forwarding -eq "not_implemented")
    lease_ready = ([string]$lease.status -eq "ready")
    lease_uses_requested_route = ([string]$lease.primary_route.route_id -eq $routeID)
    ingress_accepts_signed_frame_probe = ([int]$ingressResponse.StatusCode -eq 202 -and [string]$ingressResponse.Headers["X-RAP-Service-Channel-Accepted-By"] -eq "signed")
    ingress_accepts_probe_only_batch = (@("validated_probe_only", "delivered_probe_only") -contains [string]$ingressBody.payload_flow)
    ingress_reports_frame_schema = ([string]$ingressBody.frame_batch_schema -eq "rap.remote_workspace_frame_batch.v1")
    ingress_reports_frame_count = ([int]$ingressBody.frame_count -eq 3)
    ingress_reports_adapter_contract_id = ([string]$ingressBody.adapter_contract_id -eq "rap.rdp_worker.remote_workspace_adapter_contract_probe.v1")
}
$failed = @($checks.GetEnumerator() | Where-Object { -not $_.Value } | ForEach-Object { $_.Key })

$result = [ordered]@{
    schema_version = "c19e.remote_workspace_frame_batch_contract_smoke.v1"
    run_id = $runId
    base_url = $ApiBaseUrl
    entry_base_url = $EntryBaseUrl
    cluster_id = $ClusterID
    entry_node = [ordered]@{ id = $entryNode.id; name = $entryNode.name }
    exit_node = [ordered]@{ id = $exitNode.id; name = $exitNode.name }
    workload_status = $workloadStatus
    channel_id = [string]$lease.channel_id
    route_id = $routeID
    ingress = [ordered]@{ url = $ingressUrl; status_code = [int]$ingressResponse.StatusCode; body = $ingressBody }
    checks = $checks
    failed_checks = $failed
    passed = ($failed.Count -eq 0)
}

$fullResultPath = Join-Path $repoRoot $ResultPath
$resultDir = Split-Path -Parent $fullResultPath
if ($resultDir) { New-Item -ItemType Directory -Force -Path $resultDir | Out-Null }
$result | ConvertTo-Json -Depth 80 | Set-Content -Encoding UTF8 -Path $fullResultPath

try {
    if ($routeID) { Invoke-Api -Method POST -Path "/clusters/$ClusterID/mesh/route-intents/$routeID/expire" -Body @{ actor_user_id = $ActorUserID } | Out-Null }
    Invoke-Api -Method POST -Path "/clusters/$ClusterID/fabric/service-channels/leases/cleanup" -Body @{ actor_user_id = $ActorUserID; limit = 100 } | Out-Null
} catch {
    Write-Warning "cleanup failed after c19e smoke: $($_.Exception.Message)"
}

if (-not $result.passed) {
    throw "C19E remote workspace frame-batch contract smoke failed. Result: $fullResultPath Failed: $($failed -join ', ')"
}

Write-Host "C19E remote workspace frame-batch contract smoke passed. Result: $fullResultPath"
$result