#Requires -Version 5.1
[CmdletBinding(SupportsShouldProcess)]param([ValidateSet('Audit','Plan','Apply','OpenSettings')][string]$Mode='Plan',[ValidateSet('Consumer','AllAppAccounts')][string]$Scope='AllAppAccounts',[switch]$AcknowledgeAccountDataDeletion,[switch]$Json)
Set-StrictMode -Version Latest;$ErrorActionPreference='Stop';Import-Module (Join-Path $PSScriptRoot 'src/Wind.Core.psm1');Import-Module (Join-Path $PSScriptRoot 'src/MsPrivate.Accounts.psm1') -Force
if($Mode-eq'OpenSettings'){Start-Process 'ms-settings:emailandaccounts';Start-Process 'ms-settings:workplace';return}
$backend=New-MsPrivateAccountBackend;$plan=@(Get-MsPrivateAccountPlan -Scope $Scope -Backend $backend)
if($Mode-in@('Audit','Plan')){$safe=@($plan|Select-Object Id,Kind,Label,Status,Impact);if($Json){[pscustomobject]@{Schema=1;Scope=$Scope;Warning='Package reset deletes current-user app data and sign-in details. Credential targets and secrets are omitted.';Items=$safe}|ConvertTo-Json -Depth 6}else{$safe|Format-Table -Wrap};return}
if(-not$AcknowledgeAccountDataDeletion){throw 'Apply requires -AcknowledgeAccountDataDeletion. App data, tokens and matching stored credentials cannot be restored by ms-private.'}
Assert-WindMutationAllowed
if(-not$PSCmdlet.ShouldProcess('Current-user Microsoft application accounts and matching stored credentials','Permanently sign out and delete local account data')){return}
$root=Join-Path ([Environment]::GetFolderPath('LocalApplicationData')) 'MsPrivate\accounts';[IO.Directory]::CreateDirectory($root)|Out-Null;$reportPath=Join-Path $root ((Get-Date -Format 'yyyyMMdd-HHmmss')+'-'+[guid]::NewGuid().ToString('N')+'.json');$save={param($x)Save-MsPrivateAccountReport -Report $x -Path $reportPath}.GetNewClosure()
try{$report=Invoke-MsPrivateAccountPurge -Scope $Scope -Backend $backend -Save $save}catch{throw "Account purge stopped after a partial failure. Inspect the redacted report at $reportPath. $($_.Exception.Message)"}
$report|Select-Object Kind,Scope,Status,CreatedUtc|Format-List;Write-Output "Account-purge report (no account names or secrets): $reportPath";Write-Output 'Restart Windows. Existing organizational registration and the Windows logon identity were not removed.'