# Konsoliduje vse co vyzaduje admin v jednom UAC promptu:
#  1. Hosts file: pridat 8x *.amemor-ai.lan -> 127.0.0.1 (clean, bez duplicit)
#  2. Root CA -> LocalMachine\Root (browsery overi cert pro vsechny uzivatele)
#  3. Sentinel soubor signalizuje smart-install ze je hotovo
$ErrorActionPreference = "Stop"
Write-Host "==================================================" -ForegroundColor Cyan
Write-Host "  Amemor.ai final setup (admin-only steps)" -ForegroundColor Cyan
Write-Host "==================================================" -ForegroundColor Cyan
Write-Host ""

# 1) Hosts file
Write-Host "[1/3] Hosts file..." -ForegroundColor Yellow
$hosts = "$env:WINDIR\System32\drivers\etc\hosts"
$content = Get-Content $hosts
$cleaned = $content | Where-Object {
    $_ -notmatch 'amemor-ai\.lan' -and $_ -notmatch 'UAML local web stack'
}
$block = @(
    "",
    "# UAML local web stack",
    "127.0.0.1 studio.amemor-ai.lan",
    "127.0.0.1 auth.amemor-ai.lan",
    "127.0.0.1 todo.amemor-ai.lan",
    "127.0.0.1 uaml.amemor-ai.lan",
    "127.0.0.1 hermes.amemor-ai.lan",
    "127.0.0.1 paperclip.amemor-ai.lan",
    "127.0.0.1 admin.amemor-ai.lan",
    "127.0.0.1 security.amemor-ai.lan"
)
Set-Content -Path $hosts -Value ($cleaned + $block) -Encoding ASCII
Write-Host "      OK - 8 entries written, duplicates removed." -ForegroundColor Green

# 2) Root CA -> LocalMachine\Root (system-wide)
Write-Host "[2/3] Root CA do system-wide trust..." -ForegroundColor Yellow
$cert = Join-Path $PSScriptRoot "uaml-amemor-ai-lan-root.crt"
if (-not (Test-Path $cert)) {
    Write-Host "      ! Cert file missing: $cert" -ForegroundColor Red
    exit 1
}
Import-Certificate -FilePath $cert -CertStoreLocation Cert:\LocalMachine\Root | Out-Null
Write-Host "      OK - root CA imported to LocalMachine\Root" -ForegroundColor Green

# 3) Sentinel
Write-Host "[3/3] Sentinel..." -ForegroundColor Yellow
$sentinel = Join-Path $env:USERPROFILE ".amemor-ai-setup-done"
"done $(Get-Date -Format 'yyyy-MM-ddTHH:mm:ssZ')" | Set-Content -Path $sentinel
Write-Host "      OK - $sentinel" -ForegroundColor Green

Write-Host ""
Write-Host "Hotovo. Restartuj Chrome a otevri https://studio.amemor-ai.lan/" -ForegroundColor Cyan
Write-Host "Toto okno se zavre za 5 sekund."
Start-Sleep -Seconds 5
