#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]param([ValidateSet('Audit','Plan','Apply','Restore')][string]$Mode='Plan',[ValidateSet('Standard','Strict')][string]$Profile='Strict',[string]$Journal,[switch]$Json)
Set-StrictMode -Version Latest;$ErrorActionPreference='Stop';Import-Module (Join-Path $PSScriptRoot 'src/Wind.Core.psm1');Import-Module (Join-Path $PSScriptRoot 'src/MsPrivate.Services.psm1') -Force
$backend=New-MsPrivateServiceBackend
if($Mode-in@('Audit','Plan')){$plan=@(Get-MsPrivateServicePlan -Profile $Profile -Backend $backend);if($Json){[pscustomobject]@{Schema=1;Profile=$Profile;Claim='Local service state only; GDID suppression requires network capture validation.';Services=$plan}|ConvertTo-Json -Depth 8}else{$plan|Select-Object Id,Name,Status,Impact|Format-Table -Wrap};return}
Assert-WindMutationAllowed
$root=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'MsPrivate\services';[IO.Directory]::CreateDirectory($root)|Out-Null
if($Mode-eq'Apply'){$plan=@(Get-MsPrivateServicePlan -Profile $Profile -Backend $backend);$Journal=Join-Path $root ((Get-Date -Format 'yyyyMMdd-HHmmss')+'-'+[guid]::NewGuid().ToString('N')+'.json')}elseif([string]::IsNullOrWhiteSpace($Journal)){throw 'Restore requires -Journal.'}
if(-not$PSCmdlet.ShouldProcess('Selected Windows privacy services',$Mode)){return}
$journalWriter=Get-Command Save-MsPrivateServiceJournal -CommandType Function;$save={param($x)& $journalWriter -Journal $x -Path $Journal}.GetNewClosure()
if($Mode-eq'Apply'){$journal=$null;$journal=Invoke-MsPrivateServiceApply -Plan $plan -Backend $backend -Save $save}else{$journal=Get-Content -LiteralPath $Journal -Raw|ConvertFrom-Json;$journal=Restore-MsPrivateServices -Journal $journal -Backend $backend -Save $save}
$journal|Select-Object Kind,Status,CreatedUtc|Format-List;Write-Output "Service recovery journal: $Journal"