#Requires -Version 5.1
Set-StrictMode -Version Latest
$ErrorActionPreference = 'Stop'

# Shim: delegates to the Python ci_orchestrator CLI (`build run`).
# Original PS implementation moved to git history; see plans/A3-closeout.md.
#
# Typed parameters (`[PSCredential]`, `[hashtable]`, `[switch]`) cannot cross
# a process boundary as-is; this shim translates them. Credentials are pulled
# inside Python via keyring (`--credential-target`), so the bound `-Credential`
# is intentionally discarded — callers should set `-CredentialTarget` instead
# (or rely on the default `BuildVMGuest` resolved by the Python CLI).

[CmdletBinding()]
param(
    [Parameter(Mandatory)]
    [string] $IPAddress,

    [Parameter()]
    [System.Management.Automation.PSCredential] $Credential,

    [string] $HostSourceDir = '',
    [string] $CloneUrl = '',
    [string] $CloneBranch = 'main',
    [string] $CloneCommit = '',
    [switch] $CloneSubmodules,
    [string] $GiteaCredentialTarget = 'GiteaPAT',
    [string] $Configuration = 'Release',
    [string] $BuildCommand = '',
    [string] $GuestArtifactSource = 'dist',
    [string] $GuestWorkDir = 'C:\CI\build',
    [string] $GuestArtifactZip = 'C:\CI\output\artifacts.zip',
    [switch] $UseSharedCache,
    [switch] $SkipArtifact,

    [ValidateSet('Windows', 'Linux')]
    [string] $GuestOS = 'Windows',

    [string] $SshKeyPath = 'F:\CI\keys\ci_linux',
    [string] $SshUser = 'ci_build',
    [string] $SshKnownHostsFile = '',
    [string] $GuestLinuxWorkDir = '/opt/ci/build',
    [string] $GuestLinuxOutputDir = '/opt/ci/output',

    [hashtable] $ExtraGuestEnv = @{},

    # Optional override for the Credential Manager target (overrides any
    # fallback resolved by Python). Discards $Credential.
    [string] $CredentialTarget = ''
)

$pyArgs = @(
    '--ip-address', $IPAddress,
    '--guest-os', $GuestOS.ToLower(),
    '--ssh-user', $SshUser,
    '--ssh-key-path', $SshKeyPath,
    '--clone-branch', $CloneBranch,
    '--gitea-credential-target', $GiteaCredentialTarget,
    '--configuration', $Configuration,
    '--guest-work-dir', $GuestWorkDir,
    '--guest-artifact-zip', $GuestArtifactZip,
    '--guest-linux-work-dir', $GuestLinuxWorkDir,
    '--guest-linux-output-dir', $GuestLinuxOutputDir,
    '--guest-artifact-source', $GuestArtifactSource
)

if ($HostSourceDir)     { $pyArgs += @('--host-source-dir', $HostSourceDir) }
if ($CloneUrl)          { $pyArgs += @('--clone-url', $CloneUrl) }
if ($CloneCommit)       { $pyArgs += @('--clone-commit', $CloneCommit) }
if ($BuildCommand)      { $pyArgs += @('--build-command', $BuildCommand) }
if ($SshKnownHostsFile) { $pyArgs += @('--ssh-known-hosts-file', $SshKnownHostsFile) }
if ($CredentialTarget)  { $pyArgs += @('--credential-target', $CredentialTarget) }

if ($CloneSubmodules.IsPresent) { $pyArgs += '--clone-submodules' }
if ($UseSharedCache.IsPresent)  { $pyArgs += '--use-shared-cache' }
if ($SkipArtifact.IsPresent)    { $pyArgs += '--skip-artifact' }

if ($ExtraGuestEnv -and $ExtraGuestEnv.Count -gt 0) {
    foreach ($key in $ExtraGuestEnv.Keys) {
        $pyArgs += @('--extra-env', "$key=$($ExtraGuestEnv[$key])")
    }
}

if ($Credential) {
    Write-Host '[Invoke-RemoteBuild] -Credential ignored; Python CLI uses keyring (set -CredentialTarget to override target name).'
}

$venvPython = $env:CI_VENV_PYTHON
if (-not $venvPython) {
    # $IsWindows exists only on PS 6+; absent on PS 5.1 (always Windows)
    if ($null -ne $IsWindows -and $IsWindows -eq $false) {
        $venvPython = '/opt/ci/venv/bin/python'
    } else {
        $venvPython = 'F:\CI\python\venv\Scripts\python.exe'
    }
}
& $venvPython -m ci_orchestrator build run @pyArgs
exit $LASTEXITCODE