[CmdletBinding()]
param(
    [Parameter(Mandatory = $true)]
    [string]$PackageRoot,
    [string]$OutputRoot = "D:\NDC_MISSIONCORE\runtime\derived\e38-baseline",
    [string]$ContainerImage = "nvcr.io/nvidia/tritonserver:26.06-py3@sha256:58df7489c3f2276f9591d500a012dee03e23d35543ce3c390b4c001e6bf90794",
    [ValidateRange(1, 1000)]
    [int]$FreeGiBFloor = 300
)

$ErrorActionPreference = "Stop"
$ProgressPreference = "SilentlyContinue"

function Assert-LastExitCode([string]$Operation) {
    if ($LASTEXITCODE -ne 0) {
        throw "$Operation failed with exit code $LASTEXITCODE"
    }
}

function Resolve-DDirectory([string]$Path, [string]$Label) {
    $item = Get-Item -LiteralPath (Resolve-Path -LiteralPath $Path).Path -Force
    $root = [IO.Path]::GetPathRoot($item.FullName).TrimEnd("\")
    if (
        -not $item.PSIsContainer -or
        ($item.Attributes -band [IO.FileAttributes]::ReparsePoint) -or
        $root -ine "D:"
    ) {
        throw "$Label must be a real D: directory"
    }
    return $item.FullName
}

function Convert-ToDockerPath([string]$Path) {
    return $Path.Replace("\", "/")
}

function Assert-FreeSpace([string]$Phase) {
    $free = [int64](Get-PSDrive -Name D).Free
    $floor = [int64]$FreeGiBFloor * 1GB
    Write-Host (
        "DISK_GUARD PHASE={0} DRIVE=D FREE_BYTES={1} FREE_GIB={2} FLOOR_GIB={3}" -f
        $Phase, $free, [math]::Round($free / 1GB, 3), $FreeGiBFloor
    )
    if ($free -lt ($floor + 1GB)) {
        throw "D: lacks the guarded E38 reserve during $Phase"
    }
    return $free
}

$package = Resolve-DDirectory $PackageRoot "E38 package"
$packageManifestPath = Join-Path $package "manifest.json"
if (-not (Test-Path -LiteralPath $packageManifestPath -PathType Leaf)) {
    throw "E38 package manifest is missing"
}
$packageManifest = Get-Content -LiteralPath $packageManifestPath -Raw |
    ConvertFrom-Json
if (
    $packageManifest.schema_version -ne "missioncore.e38-worker-package/v1" -or
    $packageManifest.package_id -ne (Split-Path $package -Leaf) -or
    $packageManifest.package_id -notmatch "^e38-worker-package-[a-f0-9]{64}$"
) {
    throw "E38 package manifest is incompatible"
}

if (-not (Test-Path -LiteralPath $OutputRoot)) {
    $null = New-Item -ItemType Directory -Path $OutputRoot
}
$output = Resolve-DDirectory $OutputRoot "E38 output root"
$freeBefore = Assert-FreeSpace "preflight"

& docker image inspect $ContainerImage *> $null
Assert-LastExitCode "Pinned E38 container image inspection"

$dockerPackage = Convert-ToDockerPath $package
$dockerOutput = Convert-ToDockerPath $output
$packageName = Split-Path $package -Leaf
$containerPackage = "/opt/e38-input/$packageName"
$command = @(
    "run", "--rm",
    "--name", "ndc-mission-core-e38-baseline",
    "--network", "none",
    "--read-only",
    "--security-opt", "no-new-privileges:true",
    "--cap-drop", "ALL",
    "--pids-limit", "128",
    "--memory", "512m",
    "--memory-swap", "512m",
    "--cpus", "2",
    "--tmpfs", "/tmp:rw,noexec,nosuid,size=64m",
    "-e", "PYTHONDONTWRITEBYTECODE=1",
    "-e", ("PYTHONPATH={0}/runtime" -f $containerPackage),
    "-e", ("E38_WORKER_NODE={0}" -f $env:COMPUTERNAME),
    "-v", ("{0}:{1}:ro" -f $dockerPackage, $containerPackage),
    "-v", ("{0}:/output:rw" -f $dockerOutput),
    "--entrypoint", "python3",
    $ContainerImage,
    ("{0}/runtime/run_e38_perception_baseline.py" -f $containerPackage),
    "--package", $containerPackage,
    "--output-root", "/output"
)

Write-Output ("PACKAGE_ID={0}" -f $packageManifest.package_id)
Write-Output ("PACKAGE_IDENTITY_SHA256={0}" -f $packageManifest.identity_sha256)
Write-Output ("CONTAINER_IMAGE={0}" -f $ContainerImage)
& docker @command
Assert-LastExitCode "E38 perception baseline"

$matches = @(
    Get-ChildItem -LiteralPath $output -Directory -Filter "e38-perception-baseline-*" |
        Where-Object {
            $manifestPath = Join-Path $_.FullName "manifest.json"
            if (-not (Test-Path -LiteralPath $manifestPath -PathType Leaf)) {
                return $false
            }
            $manifest = Get-Content -LiteralPath $manifestPath -Raw |
                ConvertFrom-Json
            return (
                $manifest.schema_version -eq
                    "missioncore.e38-perception-baseline/v1" -and
                $manifest.acceptance_state -eq
                    "completed-r1-source-scoped-baseline" -and
                $manifest.identity.execution.worker_node -eq $env:COMPUTERNAME
            )
        }
)
if ($matches.Count -ne 1) {
    throw "E38 immutable result could not be resolved uniquely"
}
$resultRoot = $matches[0].FullName
$resultManifest = Get-Content -LiteralPath (
    Join-Path $resultRoot "manifest.json"
) -Raw | ConvertFrom-Json
$freeAfter = Assert-FreeSpace "completed"
Write-Output ("RESULT_ROOT={0}" -f $resultRoot)
Write-Output ("RESULT_ID={0}" -f $resultManifest.result_id)
Write-Output ("QUALITY_GATE_PASSED={0}" -f $resultManifest.quality_gate_passed)
Write-Output ("DISK_FREE_BYTES_BEFORE={0}" -f $freeBefore)
Write-Output ("DISK_FREE_BYTES_AFTER={0}" -f $freeAfter)