[CmdletBinding()]
param(
    [string]$ConnectorToken = $env:MECGOD_CONNECTOR_TOKEN,
    [string]$ConnectorTokenFile = "",
    [string]$CloudBaseUrl = "https://mecgod.fugue.pro",
    [string]$InstallerUrl = "",
    [string]$InstallerSha256Url = "",
    [switch]$KeepInstaller
)

$ErrorActionPreference = "Stop"
[Net.ServicePointManager]::SecurityProtocol = [Net.ServicePointManager]::SecurityProtocol -bor [Net.SecurityProtocolType]::Tls12

function Write-DeploymentStep {
    param([string]$Message)
    Write-Host "[MecGod] $Message"
}

try {
    if ($ConnectorTokenFile) {
        if (-not (Test-Path -LiteralPath $ConnectorTokenFile)) {
            throw "Connector token file was not found: $ConnectorTokenFile"
        }
        $ConnectorToken = (Get-Content -LiteralPath $ConnectorTokenFile -Raw).Trim()
    }
    if (-not $ConnectorToken -or $ConnectorToken -notmatch '^[A-Za-z0-9_-]{40,64}$') {
        throw "A valid account-specific MecGod connector token is required."
    }

    $baseUrl = $CloudBaseUrl.TrimEnd('/')
    if (-not $InstallerUrl) {
        $InstallerUrl = "$baseUrl/downloads/MecGodConnectorSetup.exe"
    }
    if (-not $InstallerSha256Url) {
        $InstallerSha256Url = "$baseUrl/downloads/MecGodConnectorSetup.exe.sha256"
    }

    $deploymentRoot = Join-Path $env:TEMP "MecGodConnectorDeployment"
    $installerPath = Join-Path $deploymentRoot "MecGodConnectorSetup.exe"
    New-Item -ItemType Directory -Force -Path $deploymentRoot | Out-Null

    Write-DeploymentStep "Downloading the connector installer."
    Invoke-WebRequest -UseBasicParsing -Uri $InstallerUrl -OutFile $installerPath -TimeoutSec 300

    Write-DeploymentStep "Verifying the installer SHA-256 digest."
    $digestResponse = Invoke-WebRequest -UseBasicParsing -Uri $InstallerSha256Url -TimeoutSec 30
    $expectedDigest = (($digestResponse.Content -split '\s+')[0]).Trim().ToUpperInvariant()
    if ($expectedDigest -notmatch '^[A-F0-9]{64}$') {
        throw "The cloud installer digest is invalid."
    }
    $actualDigest = (Get-FileHash -LiteralPath $installerPath -Algorithm SHA256).Hash.ToUpperInvariant()
    if ($actualDigest -ne $expectedDigest) {
        throw "Connector installer verification failed. Expected $expectedDigest but received $actualDigest."
    }

    Write-DeploymentStep "Installing and pairing the current Windows user without prompts."
    $installerArguments = @(
        "/VERYSILENT"
        "/SUPPRESSMSGBOXES"
        "/NORESTART"
        "/CLOSEAPPLICATIONS"
        "/CONNECTORTOKEN=$ConnectorToken"
    )
    $process = Start-Process -FilePath $installerPath -ArgumentList $installerArguments -Wait -PassThru
    if ($process.ExitCode -ne 0) {
        throw "MecGod Connector installation failed with exit code $($process.ExitCode)."
    }

    $installRoot = Join-Path $env:LOCALAPPDATA "MecGod\Connector"
    $heartbeatLog = Join-Path $installRoot "storage\logs\cloud-connector-heartbeat.log"
    $deadline = (Get-Date).AddSeconds(30)
    $heartbeatConfirmed = $false
    while ((Get-Date) -lt $deadline) {
        if (Test-Path -LiteralPath $heartbeatLog) {
            $recentLog = Get-Content -LiteralPath $heartbeatLog -Tail 30 -ErrorAction SilentlyContinue
            if ($recentLog -match "heartbeat sent:") {
                $heartbeatConfirmed = $true
                break
            }
        }
        Start-Sleep -Seconds 1
    }
    if (-not $heartbeatConfirmed) {
        throw "The connector was installed but its cloud heartbeat was not confirmed. Inspect $heartbeatLog."
    }

    Write-DeploymentStep "Deployment completed. The workstation is paired and online."
    exit 0
} catch {
    Write-Error $_.Exception.Message
    exit 1
} finally {
    $ConnectorToken = ""
    if (-not $KeepInstaller -and $installerPath -and (Test-Path -LiteralPath $installerPath)) {
        Remove-Item -LiteralPath $installerPath -Force -ErrorAction SilentlyContinue
    }
}