[CmdletBinding()]
param(
  [Parameter(Mandatory = $true)]
  [string]$StableSourceRoot,
  [Parameter(Mandatory = $true)]
  [string]$UserUploadDir,
  [Parameter(Mandatory = $true)]
  [string]$ManifestStateDir,
  [Parameter(Mandatory = $true)]
  [string]$UserUploadWriteFreezePath,
  [Parameter(Mandatory = $true)]
  [ValidateRange(0, 2147483647)]
  [int]$ExpectedReferenceCount,
  [Parameter(Mandatory = $true)]
  [ValidateRange(1, 2147483647)]
  [int]$ExpectedPreservedObjectCount,
  [Parameter(Mandatory = $true)]
  [ValidateRange(1, 9223372036854775807)]
  [long]$ExpectedPreservedTotalSizeBytes,
  [Parameter(Mandatory = $true)]
  [ValidatePattern("^[0-9a-f]{64}$")]
  [string]$ExpectedPreservedInventorySha256,
  [Parameter(Mandatory = $true)]
  [ValidateNotNullOrEmpty()]
  [string[]]$SourceUploadDir,
  [string]$OfflineQuiescenceCaptureBase64 = "",
  [ValidatePattern("^$|^[0-9a-f]{40}$")]
  [string]$ExpectedOfflineSourceCommit = "",
  [ValidatePattern("^$|^[0-9a-f]{40}$")]
  [string]$ExpectedOfflineSourceTree = "",
  [string]$PythonPath = "",
  [string]$HealthUrl = "http://127.0.0.1:8001/health",
  [ValidateRange(1, 300)]
  [int]$FreezeTimeoutSeconds = 30
)

$ErrorActionPreference = "Stop"
[Console]::OutputEncoding = [System.Text.UTF8Encoding]::new($false)
$OutputEncoding = [System.Text.UTF8Encoding]::new($false)

function Assert-StableInitializerSourceProvenance {
  param(
    [Parameter(Mandatory = $true)]
    [string]$Root
  )

  $gitTopLevelOutput = @(& git.exe -C $Root rev-parse --show-toplevel)
  if ($LASTEXITCODE -ne 0 -or $gitTopLevelOutput.Count -eq 0) {
    throw "Upload initializer source is not a Git worktree"
  }
  $gitTopLevel = (Resolve-Path -LiteralPath ((@($gitTopLevelOutput) -join "").Trim())).Path
  if (-not [string]::Equals(
      $gitTopLevel,
      $Root,
      [System.StringComparison]::OrdinalIgnoreCase
  )) {
    throw "Upload initializer source must be its Git toplevel"
  }

  $symbolicRefOutput = @(& git.exe -C $Root symbolic-ref -q HEAD)
  $symbolicRefExit = $LASTEXITCODE
  if ($symbolicRefExit -eq 0 -or $symbolicRefOutput.Count -gt 0) {
    throw "Upload initializer source must use a detached HEAD"
  }
  if ($symbolicRefExit -ne 1) {
    throw "Upload initializer could not prove detached HEAD"
  }

  $statusOutput = @(& git.exe -C $Root status --porcelain=v1 --untracked-files=all)
  if ($LASTEXITCODE -ne 0) {
    throw "Upload initializer could not prove source cleanliness"
  }
  if ($statusOutput.Count -gt 0) {
    throw "Upload initializer source must be completely clean"
  }

  foreach ($relativePath in @(
    "scripts/initialize-public-runtime-upload-root.ps1",
    "scripts/initialize-public-runtime-upload-root.py",
    "scripts/public_runtime_database_identity.py",
    "scripts/public-runtime-upload-root.ps1",
    "apps/api/app/config.py",
    "apps/api/app/upload_storage.py"
  )) {
    $trackedOutput = @(& git.exe -C $Root ls-files --error-unmatch -- $relativePath)
    if ($LASTEXITCODE -ne 0 -or $trackedOutput.Count -ne 1) {
      throw "Upload initializer source chain must be tracked"
    }
  }
}

function Resolve-PrivateStateDirectory {
  param(
    [Parameter(Mandatory = $true)]
    [string]$Path,
    [Parameter(Mandatory = $true)]
    [string]$PublicRoot,
    [Parameter(Mandatory = $true)]
    [string]$GitRoot
  )

  $driveAbsolute = $Path -match '^[A-Za-z]:[\\/]'
  $uncAbsolute = $Path -match '^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)'
  if (-not $driveAbsolute -and -not $uncAbsolute) {
    throw "Private upload state directory must be absolute"
  }
  $fullPath = Get-PublicRuntimeCanonicalPath -Path $Path
  $filesystemRoot = [System.IO.Path]::GetPathRoot($fullPath)
  if ([string]::Equals(
      $fullPath.TrimEnd('\', '/'),
      $filesystemRoot.TrimEnd('\', '/'),
      [System.StringComparison]::OrdinalIgnoreCase
  )) {
    throw "Private upload state directory cannot be a filesystem root"
  }
  if (
    (Test-PublicRuntimePathIsSameOrChild -Candidate $fullPath -Parent $PublicRoot) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $PublicRoot -Parent $fullPath) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $fullPath -Parent $GitRoot) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $GitRoot -Parent $fullPath)
  ) {
    throw "Private upload state must be disjoint from public and source roots"
  }
  Assert-PublicRuntimePathHasNoReparsePoint -Path $fullPath
  if (-not (Test-Path -LiteralPath $fullPath)) {
    [System.IO.Directory]::CreateDirectory($fullPath) | Out-Null
  }
  if (-not (Test-Path -LiteralPath $fullPath -PathType Container)) {
    throw "Private upload state directory is unavailable"
  }
  Assert-PublicRuntimePathHasNoReparsePoint -Path $fullPath
  return (Resolve-Path -LiteralPath $fullPath).Path
}

function Remove-OwnedWriteFreeze {
  param(
    [Parameter(Mandatory = $true)]
    [string]$Path,
    [Parameter(Mandatory = $true)]
    [string]$OwnedToken
  )

  if (-not [System.IO.File]::Exists($Path)) {
    return $true
  }
  try {
    $payload = Get-Content -LiteralPath $Path -Raw -Encoding UTF8 | ConvertFrom-Json
    if (
      $null -eq $payload -or
      $payload.schema_version -ne "vignette.public-upload-write-freeze.v1" -or
      $payload.token -ne $OwnedToken
    ) {
      return $false
    }
    [System.IO.File]::Delete($Path)
    return -not [System.IO.File]::Exists($Path)
  } catch {
    return $false
  }
}

function Assert-OnlineUploadWritesRecovered {
  param(
    [Parameter(Mandatory = $true)]
    [string]$Uri,
    [ValidateRange(1, 300)]
    [int]$TimeoutSeconds = 30
  )

  $deadline = (Get-Date).AddSeconds($TimeoutSeconds)
  do {
    $health = $null
    try {
      $health = Invoke-RestMethod `
        -Uri $Uri `
        -Method Get `
        -TimeoutSec 5 `
        -UseBasicParsing
    } catch {
      $health = $null
    }
    $freeze = $null
    if ($null -ne $health) {
      $freeze = $health.upload_write_freeze
    }
    if (
      $null -ne $freeze -and
      $freeze.capable -eq $true -and
      $freeze.active -eq $false -and
      $freeze.valid -eq $true -and
      [int]$freeze.in_flight -eq 0
    ) {
      return
    }
    Start-Sleep -Milliseconds 250
  } while ((Get-Date) -lt $deadline)

  throw "Upload initialization cleanup could not prove write availability"
}

$resolvedStableSourceRoot = (Resolve-Path -LiteralPath $StableSourceRoot).Path
$uploadRootContract = Join-Path $resolvedStableSourceRoot "scripts\public-runtime-upload-root.ps1"
$initializerWorker = Join-Path $resolvedStableSourceRoot "scripts\initialize-public-runtime-upload-root.py"
$databaseIdentityHelper = Join-Path $resolvedStableSourceRoot "scripts\public_runtime_database_identity.py"
foreach ($requiredFile in @($uploadRootContract, $initializerWorker, $databaseIdentityHelper)) {
  if (-not (Test-Path -LiteralPath $requiredFile -PathType Leaf)) {
    throw "Upload initializer prerequisite is unavailable"
  }
}
Assert-StableInitializerSourceProvenance -Root $resolvedStableSourceRoot
. $uploadRootContract

$resolvedUserUploadDir = Resolve-PublicRuntimeUploadRoot `
  -SourceRoot $resolvedStableSourceRoot `
  -UploadRoot $UserUploadDir `
  -CreateIfMissing `
  -ProbeWritable
$resolvedManifestStateDir = Resolve-PrivateStateDirectory `
  -Path $ManifestStateDir `
  -PublicRoot $resolvedUserUploadDir `
  -GitRoot $resolvedStableSourceRoot

$freezeDriveAbsolute = $UserUploadWriteFreezePath -match '^[A-Za-z]:[\\/]'
$freezeUncAbsolute = $UserUploadWriteFreezePath -match '^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)'
if (-not $freezeDriveAbsolute -and -not $freezeUncAbsolute) {
  throw "Upload write-freeze path must be absolute"
}
$fullFreezePath = Get-PublicRuntimeCanonicalPath -Path $UserUploadWriteFreezePath
$freezeParent = [System.IO.Path]::GetDirectoryName($fullFreezePath)
if (-not [string]::Equals(
    $freezeParent.TrimEnd('\', '/'),
    $resolvedManifestStateDir.TrimEnd('\', '/'),
    [System.StringComparison]::OrdinalIgnoreCase
)) {
  throw "Upload write-freeze must be a direct child of private state"
}
Assert-PublicRuntimePathHasNoReparsePoint -Path $fullFreezePath

if ([string]::IsNullOrWhiteSpace($PythonPath)) {
  $PythonPath = Join-Path $resolvedStableSourceRoot "apps\api\.venv\Scripts\python.exe"
}
if (-not (Test-Path -LiteralPath $PythonPath -PathType Leaf)) {
  throw "Upload initializer Python runtime is unavailable"
}
$resolvedPythonPath = (Resolve-Path -LiteralPath $PythonPath).Path

$resolvedSources = @()
foreach ($sourceRoot in $SourceUploadDir) {
  $sourceDriveAbsolute = $sourceRoot -match '^[A-Za-z]:[\\/]'
  $sourceUncAbsolute = $sourceRoot -match '^\\\\[^\\/]+[\\/][^\\/]+(?:[\\/]|$)'
  if (-not $sourceDriveAbsolute -and -not $sourceUncAbsolute) {
    throw "Source upload directory must be absolute"
  }
  Assert-PublicRuntimePathHasNoReparsePoint -Path $sourceRoot
  if (-not (Test-Path -LiteralPath $sourceRoot -PathType Container)) {
    throw "Source upload directory is unavailable"
  }
  $resolvedSource = (Resolve-Path -LiteralPath $sourceRoot).Path
  if (
    (Test-PublicRuntimePathIsSameOrChild -Candidate $resolvedSource -Parent $resolvedUserUploadDir) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $resolvedUserUploadDir -Parent $resolvedSource) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $resolvedSource -Parent $resolvedManifestStateDir) -or
    (Test-PublicRuntimePathIsSameOrChild -Candidate $resolvedManifestStateDir -Parent $resolvedSource)
  ) {
    throw "Source upload directories must be disjoint from target and private state"
  }
  $resolvedSources += $resolvedSource
}

$freezeToken = (
  [Guid]::NewGuid().ToString("N") +
  [Guid]::NewGuid().ToString("N")
)
$freezePayload = @{
  schema_version = "vignette.public-upload-write-freeze.v1"
  token = $freezeToken
} | ConvertTo-Json -Compress
$freezeBytes = [System.Text.UTF8Encoding]::new($false).GetBytes($freezePayload)
$freezeStream = $null
$freezeOwned = $false
$freezePublished = $false
$offlineQuiescenceMode = -not [string]::IsNullOrWhiteSpace(
  $OfflineQuiescenceCaptureBase64
)
$offlineSourcePinsPresent = (
  -not [string]::IsNullOrWhiteSpace($ExpectedOfflineSourceCommit) -and
  -not [string]::IsNullOrWhiteSpace($ExpectedOfflineSourceTree)
)
if ($offlineQuiescenceMode -ne $offlineSourcePinsPresent) {
  throw "Offline quiescence capture and lowercase source commit/tree pins are required together"
}
try {
  try {
    $freezeStream = [System.IO.File]::Open(
      $fullFreezePath,
      [System.IO.FileMode]::CreateNew,
      [System.IO.FileAccess]::Write,
      [System.IO.FileShare]::None
    )
    $freezeOwned = $true
    $freezeStream.Write($freezeBytes, 0, $freezeBytes.Length)
    $freezeStream.Flush($true)
    $freezePublished = $true
  } finally {
    if ($null -ne $freezeStream) {
      $freezeStream.Dispose()
    }
  }
  $workerArgs = @(
    "-X", "utf8", "-B", $initializerWorker,
    "--upload-root", $resolvedUserUploadDir,
    "--manifest-state-dir", $resolvedManifestStateDir,
    "--write-freeze-path", $fullFreezePath,
    "--expected-reference-count", $ExpectedReferenceCount.ToString(),
    "--expected-preserved-object-count", $ExpectedPreservedObjectCount.ToString(),
    "--expected-preserved-total-size-bytes", $ExpectedPreservedTotalSizeBytes.ToString(),
    "--expected-preserved-inventory-sha256", $ExpectedPreservedInventorySha256,
    "--health-url", $HealthUrl,
    "--freeze-timeout-seconds", $FreezeTimeoutSeconds.ToString()
  )
  foreach ($resolvedSource in $resolvedSources) {
    $workerArgs += @("--source-root", $resolvedSource)
  }
  if ($offlineQuiescenceMode) {
    if ($OfflineQuiescenceCaptureBase64 -notmatch '^[A-Za-z0-9+/]+={0,2}$') {
      throw "Offline quiescence capture is not canonical base64"
    }
    $workerArgs += @(
      "--offline-quiescence-capture-base64",
      $OfflineQuiescenceCaptureBase64,
      "--expected-offline-source-commit",
      $ExpectedOfflineSourceCommit,
      "--expected-offline-source-tree",
      $ExpectedOfflineSourceTree
    )
  }

  Push-Location (Join-Path $resolvedStableSourceRoot "apps\api")
  try {
    $workerOutput = @(& $resolvedPythonPath @workerArgs)
    $workerExitCode = $LASTEXITCODE
  } finally {
    Pop-Location
  }
  $serializedOutput = (@($workerOutput) -join "").Trim()
  $parsedOutput = $null
  if (-not [string]::IsNullOrWhiteSpace($serializedOutput)) {
    try {
      $parsedOutput = $serializedOutput | ConvertFrom-Json
    } catch {
      $parsedOutput = $null
    }
  }
  if (
    $workerExitCode -ne 0 -or
    $null -eq $parsedOutput -or
    $parsedOutput.status -ne "initialized" -or
    [long]$parsedOutput.preserved_total_size_bytes -ne
    $ExpectedPreservedTotalSizeBytes
  ) {
    throw "Public avatar upload initialization failed"
  }
  Write-Output $serializedOutput
} catch {
  if ($freezeOwned) {
    if ($freezePublished) {
      $freezeRemoved = Remove-OwnedWriteFreeze `
        -Path $fullFreezePath `
        -OwnedToken $freezeToken
    } else {
      $freezeRemoved = $false
    }
    if (-not $freezePublished -and [System.IO.File]::Exists($fullFreezePath)) {
      # CreateNew 뒤 sentinel payload를 완성하기 전에 실패했다면 이 경로는 아직
      # 다른 프로세스에 공개되지 않은 이 호출 소유 파일이다.
      try {
        [System.IO.File]::Delete($fullFreezePath)
        $freezeRemoved = -not [System.IO.File]::Exists($fullFreezePath)
      } catch {
        $freezeRemoved = $false
      }
    } elseif (-not $freezePublished) {
      $freezeRemoved = $true
    }
    if (-not $freezeRemoved) {
      throw "Upload initialization failed and owned write freeze could not be removed"
    }
    if (-not $offlineQuiescenceMode) {
      Assert-OnlineUploadWritesRecovered `
        -Uri $HealthUrl `
        -TimeoutSeconds $FreezeTimeoutSeconds
    }
  }
  throw
}