[CmdletBinding()]
param([Parameter(Mandatory=$true)][string]$EnrollmentToken,
      [string]$ProvisionUrl = "https://provision.atlascorporation.org")
$ErrorActionPreference = 'Stop'
if (-not ([Security.Principal.WindowsPrincipal] [Security.Principal.WindowsIdentity]::GetCurrent()).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)) { throw 'Run this bootstrapper as Administrator (UAC).' }

# This generic bootstrap contains NO device-management credentials. The API
# returns component policy only; server-side adapters issue short-lived vendor
# artifacts after claim verification.
$bios = Get-CimInstance Win32_BIOS
$cs = Get-CimInstance Win32_ComputerSystem
$device = @{ hostname=$env:COMPUTERNAME; manufacturer=$cs.Manufacturer; model=$cs.Model; bios_serial=$bios.SerialNumber; os=(Get-CimInstance Win32_OperatingSystem).Caption; collected_at=(Get-Date).ToUniversalTime().ToString('o') }
$payload = @{ token=$EnrollmentToken; device=$device } | ConvertTo-Json -Depth 4
$claim = Invoke-RestMethod -Method Post -Uri "$ProvisionUrl/v1/bootstrap/claim" -ContentType 'application/json' -Body $payload

New-Item -ItemType Directory -Force -Path "$env:ProgramData\Atlas\Provisioner" | Out-Null
$claim | ConvertTo-Json -Depth 6 | Set-Content -Encoding UTF8 "$env:ProgramData\Atlas\Provisioner\claim.json"
# Future adapters install only server-issued signed artifacts. Never substitute
# a shared MeshCentral URL, long-lived Tailscale auth key, or fallback IP here.
Write-Host "Claim accepted for client $($claim.client). Components approved: $($claim.components | ConvertTo-Json -Compress)"
Remove-Variable EnrollmentToken -ErrorAction SilentlyContinue