param(
    [string]$RemoteHost = "root@192.168.10.150",
    [string]$RemotePath = "/mnt/user/appdata/geointel",
    [string]$RemoteBranch = "main",
    [string]$RemoteRepo = "gitea-widefrog:NuklearRabbit/geointel.git",
    [string]$SshKey = "$HOME/.ssh/widefrog_unraid_deploy",
    [string]$FrontendUrl = "http://192.168.10.150:1202",
    [string]$InstallAi = $(if ($env:GEOINTEL_INSTALL_AI) { $env:GEOINTEL_INSTALL_AI } else { "" }),
    [switch]$Bootstrap
)

$ErrorActionPreference = "Stop"

$bootstrapValue = if ($Bootstrap) { "1" } else { "0" }

$remoteScript = @'
set -euo pipefail
git config --global --add safe.directory "$REMOTE_PATH"
cd "$REMOTE_PATH"

if [ ! -d .git ]; then
  if [ "$DEPLOY_BOOTSTRAP" != '1' ]; then
    echo "No git checkout found in $REMOTE_PATH."
    echo 'Re-run with -Bootstrap for the first deployment bootstrap.'
    exit 2
  fi
  git init
  git remote add origin "$REMOTE_REPO"
fi

git remote get-url origin >/dev/null 2>&1 || git remote add origin "$REMOTE_REPO"
git fetch origin "$REMOTE_BRANCH"
git reset --hard "origin/$REMOTE_BRANCH"
git branch -M "$REMOTE_BRANCH"
chmod +x scripts/*.sh backend/docker_start.sh deploy/unraid/*.sh || true

if [ -f .env ]; then
  set -a
  . ./.env
  set +a
fi

if [ -n "${DEPLOY_GEOINTEL_INSTALL_AI:-}" ]; then
  GEOINTEL_INSTALL_AI="$DEPLOY_GEOINTEL_INSTALL_AI"
fi
GEOINTEL_INSTALL_AI="${GEOINTEL_INSTALL_AI:-false}"

docker compose -f docker-compose.unraid.yml config >/dev/null
docker build --build-arg GEOINTEL_INSTALL_AI="$GEOINTEL_INSTALL_AI" -f deploy/unraid/Dockerfile.all-in-one -t geointel-all-in-one:latest .
bash deploy/unraid/run-dockerman-container.sh

wait_for_geointel_health() {
  local status=''
  for attempt in $(seq 1 90); do
    status="$(docker inspect --format '{{if .State.Health}}{{.State.Health.Status}}{{else}}{{.State.Status}}{{end}}' geointel 2>/dev/null || true)"
    if [ "$status" = 'healthy' ]; then
      echo "GeoIntel container is healthy after attempt $attempt."
      return 0
    fi
    if [ "$status" = 'unhealthy' ] || [ "$status" = 'exited' ] || [ "$status" = 'dead' ]; then
      echo "GeoIntel container entered terminal state: $status" >&2
      docker logs --tail 120 geointel >&2 || true
      return 1
    fi
    sleep 2
  done
  echo "GeoIntel container did not become healthy (last state: ${status:-missing})." >&2
  docker logs --tail 120 geointel >&2 || true
  return 1
}

# Container startup owns the migration. Waiting here prevents the validation
# smoke from racing a concurrent `alembic upgrade head` against the same DB.
wait_for_geointel_health

if [ -x scripts/live_migration_smoke.sh ]; then
  LIVE_SMOKE_CONTAINER=geointel bash scripts/live_migration_smoke.sh
fi

if [ -x scripts/verify_browser_runtime.sh ]; then
  bash scripts/verify_browser_runtime.sh "$FRONTEND_URL"
fi
'@

$utf8NoBom = [System.Text.UTF8Encoding]::new($false)
$localScriptPath = [System.IO.Path]::GetTempFileName()
$remoteScriptPath = "/tmp/geointel-deploy-$([System.Guid]::NewGuid().ToString('N')).sh"

try {
    [System.IO.File]::WriteAllText($localScriptPath, $remoteScript, $utf8NoBom)

    $scpArgs = @(
        "-o", "BatchMode=yes",
        "-o", "StrictHostKeyChecking=accept-new",
        "-i", $SshKey,
        $localScriptPath,
        "${RemoteHost}:$remoteScriptPath"
    )
    & scp @scpArgs
    if ($LASTEXITCODE -ne 0) {
        exit $LASTEXITCODE
    }

    $remoteRunCommand = "REMOTE_PATH='$RemotePath' REMOTE_BRANCH='$RemoteBranch' REMOTE_REPO='$RemoteRepo' FRONTEND_URL='$FrontendUrl' DEPLOY_BOOTSTRAP='$bootstrapValue' DEPLOY_GEOINTEL_INSTALL_AI='$InstallAi' bash '$remoteScriptPath'; status=`$?; rm -f '$remoteScriptPath'; exit `$status"
    $sshRunArgs = @(
        "-o", "BatchMode=yes",
        "-o", "StrictHostKeyChecking=accept-new",
        "-i", $SshKey,
        $RemoteHost,
        $remoteRunCommand
    )
    & ssh @sshRunArgs
    if ($LASTEXITCODE -ne 0) {
        exit $LASTEXITCODE
    }
} finally {
    Remove-Item -LiteralPath $localScriptPath -Force -ErrorAction SilentlyContinue
}