param(
    [ValidateSet("client")]
    [string]$Role = $(if ($env:DOSH_ROLE) { $env:DOSH_ROLE } else { "client" }),
    [string]$Repo = $env:DOSH_REPO,
    [string]$Server = $env:DOSH_SERVER,
    [string]$DoshHost = $(if ($env:DOSH_HOST) { $env:DOSH_HOST } else { $env:DOSH_DOSH_HOST }),
    [int]$Port = $(if ($env:DOSH_PORT) { [int]$env:DOSH_PORT } else { 50000 }),
    [string]$Prefix = $(if ($env:PREFIX) { $env:PREFIX } else { Join-Path $HOME ".local" }),
    [switch]$UsePrebuilt = $(-not $env:DOSH_USE_PREBUILT -or $env:DOSH_USE_PREBUILT -ne "0"),
    [string]$BinaryUrl = $env:DOSH_BINARY_URL,
    [string]$BinaryBase = $env:DOSH_BINARY_BASE,
    [string]$BinaryName = $env:DOSH_BINARY_NAME,
    [string]$BinaryVersion = $(if ($env:DOSH_BINARY_VERSION) { $env:DOSH_BINARY_VERSION } else { "latest" }),
    [switch]$BinaryRequired = $($env:DOSH_BINARY_REQUIRED -and $env:DOSH_BINARY_REQUIRED -ne "0"),
    [switch]$ForceConfig
)

$ErrorActionPreference = "Stop"

function Require-Command($Name) {
    if (-not (Get-Command $Name -ErrorAction SilentlyContinue)) {
        throw "missing required command: $Name"
    }
}

function Normalize-Arch {
    switch ($env:PROCESSOR_ARCHITECTURE) {
        "AMD64" { "x86_64"; break }
        "ARM64" { "aarch64"; break }
        default { $env:PROCESSOR_ARCHITECTURE.ToLowerInvariant() }
    }
}

function Release-ArtifactName {
    if ($BinaryName) {
        return $BinaryName
    }
    "dosh-windows-$(Normalize-Arch).zip"
}

function Repo-WebBase($Value) {
    if (-not $Value) {
        return $null
    }
    $base = $Value.TrimEnd("/")
    if ($base.EndsWith(".git")) {
        $base = $base.Substring(0, $base.Length - 4)
    }
    if ($base -notmatch "^https?://") {
        return $null
    }
    $base
}

function Release-DownloadUrl {
    if ($BinaryUrl) {
        return $BinaryUrl
    }
    $name = Release-ArtifactName
    if ($BinaryBase) {
        return "$($BinaryBase.TrimEnd('/'))/$name"
    }
    $web = Repo-WebBase $Repo
    if (-not $web) {
        return $null
    }
    if ($BinaryVersion -eq "latest") {
        return "$web/releases/latest/download/$name"
    }
    "$web/releases/download/$BinaryVersion/$name"
}

function Verify-ArchiveChecksum($Url, $Archive) {
    $checksumPath = "$Archive.sha256"
    try {
        Invoke-WebRequest -UseBasicParsing -Uri "$Url.sha256" -OutFile $checksumPath
    }
    catch {
        Write-Warning "prebuilt checksum unavailable; continuing without sidecar verification"
        return
    }
    $expected = ((Get-Content $checksumPath -Raw).Trim() -split "\s+")[0].ToLowerInvariant()
    $actual = (Get-FileHash -Algorithm SHA256 $Archive).Hash.ToLowerInvariant()
    if ($expected -ne $actual) {
        throw "prebuilt checksum mismatch for $Url"
    }
}

$bindir = Join-Path $Prefix "bin"
$configDir = Join-Path $HOME ".config\dosh"
New-Item -ItemType Directory -Force -Path $bindir, $configDir | Out-Null

function Install-Prebuilt {
    $url = Release-DownloadUrl
    if (-not $url) {
        return $false
    }
    $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("dosh-bin-" + [guid]::NewGuid())
    $zip = Join-Path $tmp (Release-ArtifactName)
    $extract = Join-Path $tmp "extract"
    try {
        New-Item -ItemType Directory -Force -Path $tmp, $extract | Out-Null
        Write-Host "Trying Dosh prebuilt $(Release-ArtifactName)"
        Invoke-WebRequest -UseBasicParsing -Uri $url -OutFile $zip
        Verify-ArchiveChecksum $url $zip
        Expand-Archive -Force -Path $zip -DestinationPath $extract
        foreach ($bin in @("dosh-client.exe", "dosh-bench.exe")) {
            $found = Get-ChildItem -Path $extract -Recurse -File -Filter $bin | Select-Object -First 1
            if (-not $found) {
                throw "prebuilt archive missing $bin"
            }
            Copy-Item $found.FullName (Join-Path $bindir $bin) -Force
        }
        Copy-Item (Join-Path $bindir "dosh-client.exe") (Join-Path $bindir "dosh.exe") -Force
        return $true
    }
    catch {
        Write-Warning "prebuilt install failed: $_"
        return $false
    }
    finally {
        if (Test-Path $tmp) {
            Remove-Item -Recurse -Force $tmp
        }
    }
}

function Install-FromSource {
    Require-Command cargo
    $tmp = $null
    if (Test-Path "Cargo.toml") {
        $src = (Get-Location).Path
    } else {
        if (-not $Repo) {
            throw "DOSH_REPO is required when running the installer from irm/iex"
        }
        Require-Command git
        $tmp = Join-Path ([System.IO.Path]::GetTempPath()) ("dosh-" + [guid]::NewGuid())
        git clone --depth 1 $Repo $tmp | Out-Null
        $src = $tmp
    }

    try {
        Push-Location $src
        cargo build --release --bin dosh-client --bin dosh-bench
        Copy-Item "target\release\dosh-client.exe" (Join-Path $bindir "dosh-client.exe") -Force
        Copy-Item "target\release\dosh-client.exe" (Join-Path $bindir "dosh.exe") -Force
        Copy-Item "target\release\dosh-bench.exe" (Join-Path $bindir "dosh-bench.exe") -Force
    }
    finally {
        Pop-Location
        if ($tmp) {
            Remove-Item -Recurse -Force $tmp
        }
    }
}

if ($UsePrebuilt) {
    $ok = Install-Prebuilt
    if (-not $ok) {
        if ($BinaryRequired) {
            throw "prebuilt install failed and DOSH_BINARY_REQUIRED=1"
        }
        Write-Host "Falling back to source build"
        Install-FromSource
    }
} else {
    Install-FromSource
}

$clientConfig = Join-Path $configDir "client.toml"
if ($ForceConfig -or -not (Test-Path $clientConfig)) {
    $defaultServer = if ($Server) { $Server } else { "user@example.com" }
    $updateRepo = if ($Repo) { $Repo } else { "https://git.palav.dev/Palav/dosh.git" }
    $doshHostLine = if ($DoshHost) { "dosh_host = `"$DoshHost`"" } else { "# dosh_host = `"public.example.com`"" }
    @"
update_repo = "$updateRepo"
update_port = $Port
server = "$defaultServer"
$doshHostLine
ssh_auth_command = "~/.local/bin/dosh-auth"
# ssh_port = 22
dosh_port = $Port
default_session = "new"
reconnect_timeout_secs = 5
view_only = false
predict = true
predict_mode = "experimental"
cache_attach_tickets = true
credential_cache = "~/.local/share/dosh/credentials"
escape_key = "^]"
"@ | Set-Content -NoNewline -Encoding utf8 $clientConfig
}

$userPath = [Environment]::GetEnvironmentVariable("Path", "User")
if (-not (($userPath -split ';') -contains $bindir)) {
    [Environment]::SetEnvironmentVariable("Path", "$userPath;$bindir", "User")
}

Write-Host "Installed Dosh client to $bindir"
Write-Host "Configured UDP port $Port"
Write-Host ""
$displayServer = if ($Server) { $Server } else { "user@host" }
Write-Host "Client commands:"
Write-Host "  $bindir\dosh.exe $displayServer"
Write-Host "  $bindir\dosh.exe setup <ssh-alias>"
Write-Host "  $bindir\dosh.exe update --check"
Write-Host ""
Write-Host "Client config:"
Write-Host "  $configDir\client.toml"
Write-Host ""
Write-Host "Open a new terminal for PATH changes to apply."