<#
    Delarosa Family PC Tune-Up  —  v1
    ==================================================================
    The family's reviewed, reversible Windows debloat.

    It runs Raphire/Win11Debloat (https://github.com/Raphire/Win11Debloat)
    with a PINNED set of settings, never with the script's own "Default
    Mode" — upstream is free to change its defaults between releases, and a
    tool that quietly changes what it does is not something we hand to the
    family. Everything here is listed, versioned and reversible.

    WHAT IT DOES, IN ORDER
      1. Checks it is running as administrator, on Windows 10/11.
      2. Prints the whole plan, then waits for you to type YES.
      3. Creates a Windows System Restore point. Win11Debloat creates one of
         its own as well, so there is always a rollback.
      4. Downloads the pinned Win11Debloat release and checks the file it is
         about to run against the SHA256 we reviewed. A mismatch stops the
         run — it does not warn and continue.
      5. Applies the settings (and removes the 76 bundled apps listed below).
      6. Writes a log next to the report and prints how to undo everything.

    WHAT IT NEVER DOES
      * Never removes Microsoft Edge or the WebView2 runtime — native apps,
        installers and Microsoft's own repair flows render through them.
      * Never removes the Microsoft Store (the one removal with no clean way
        back) and never removes Photos, Paint, Notepad, Snipping Tool,
        Calculator, Camera, Terminal or the Xbox app.
      * Never removes Xbox gaming services or Game Bar — the Xbox app and
        Game Bar keep working.
      * Never disables notifications, Location Services or Find My Device,
        and never disables Windows Update — it only stops updates from
        arriving ASAP and from rebooting the PC while someone is signed in.
      * Never silently installs anything else.

    HOW TO UNDO IT
      * Settings: Win11Debloat ships an Undo registry file for every change,
        and keeps a backup of the registry keys it touched. See the wiki:
        https://github.com/Raphire/Win11Debloat/wiki/Reverting-Changes
      * Apps: reinstall from the Microsoft Store. Everything removed here is
        available there.
      * Last resort: System Restore, to the "FamPC tune-up (before)" point.

    USAGE
      powershell -ExecutionPolicy Bypass -File .\fam-pc-setup-v1.ps1
      powershell -ExecutionPolicy Bypass -File .\fam-pc-setup-v1.ps1 -Unattended
      powershell -ExecutionPolicy Bypass -File .\fam-pc-setup-v1.ps1 -SettingsOnly
#>

[CmdletBinding()]
param(
    # Skip the YES prompt. For imaging or a scripted run.
    [switch] $Unattended,
    # Apply every setting but remove no apps at all.
    [switch] $SettingsOnly,
    # The Win11Debloat release this profile was reviewed against.
    [string] $Tag = '2026.08.24',
    # SHA256 of that release's Win11Debloat.ps1. Update only with a re-review.
    [string] $ScriptHash = '1ACE81FC73C227F403D8F20A86D7EB0FA7F34985A017379BF141E04941D2CAAD'
)

$ErrorActionPreference = 'Stop'
[Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12

# --------------------------------------------------------------------------
# The profile. Every switch below exists in Win11Debloat $Tag — the profile is
# checked against that release by the site's own test suite before it ships.
# --------------------------------------------------------------------------
$ProfileSwitches = @(
    # Safety rails
    '-CreateRestorePoint',
    '-Silent',
    # Telemetry, tracking, ads and suggestions
    '-DisableTelemetry',
    '-DisableSearchHistory',
    '-DisableSuggestions',
    '-DisableLockscreenTips',
    '-DisableSettings365Ads',
    '-DisableBing',
    '-DisableSearchHighlights',
    '-DisableStoreSearchSuggestions',
    '-DisableEdgeAds',
    '-DisableWidgets',
    # AI surfaces
    '-DisableCopilot',
    '-DisableRecall',
    '-DisableClickToDo',
    '-DisableAISvcAutoStart',
    '-DisableEdgeAI',
    '-DisablePaintAI',
    '-DisableNotepadAI',
    # Interface tidying
    '-RevertContextMenu',
    '-TaskbarAlignLeft',
    '-HideChat',
    '-HideTaskview',
    '-EnableEndTask',
    '-ShowKnownFileExt',
    '-HideGallery',
    '-ExplorerToThisPC',
    '-DisableStartRecommended',
    '-DisableStartPhoneLink',
    '-DisableDragTray',
    '-DisableBraveBloat',
    # Windows Update: keep patching, stop the nagging
    '-DisableUpdateASAP',
    '-PreventUpdateAutoReboot',
    '-DisableDeliveryOptimization',
    '-DisableDeviceAutoAppDownload',
    # Machine hygiene
    '-DisableFastStartup',
    '-DisableStickyKeys',
    '-DisableModernStandbyNetworking'
)

# The 76 bundled apps this profile removes: Win11Debloat's own default app
# selection (every entry upstream marks "safe" to remove) MINUS the eight we
# deliberately keep — the ones a household actually opens:
#   Alarms & Clock, Sound Recorder, Sticky Notes, Microsoft To Do, OneNote,
#   Quick Assist, Windows Maps, Microsoft Teams.
# Photos, Paint, Notepad, Snipping Tool, Calculator, Camera, Terminal, the
# Microsoft Store, Edge and the Xbox app are not in this list and never were.
$RemoveApps = @(
    'Clipchamp.Clipchamp', 'Microsoft.3DBuilder', 'Microsoft.549981C3F5F10',
    'Microsoft.BingFinance', 'Microsoft.BingFoodAndDrink', 'Microsoft.BingHealthAndFitness',
    'Microsoft.BingNews', 'Microsoft.BingSports', 'Microsoft.BingTranslator',
    'Microsoft.BingTravel', 'Microsoft.BingWeather', 'XP9CXNGPPJ97XX',
    'Microsoft.Windows.AIHub', 'Microsoft.PCManager', 'Microsoft.Getstarted',
    'Microsoft.Messaging', 'Microsoft.Microsoft3DViewer', 'Microsoft.MicrosoftJournal',
    'Microsoft.MicrosoftOfficeHub', 'Microsoft.MicrosoftPowerBIForWindows',
    'Microsoft.MicrosoftSolitaireCollection', 'Microsoft.MixedReality.Portal',
    'Microsoft.NetworkSpeedTest', 'Microsoft.News', 'Microsoft.Office.Sway',
    'Microsoft.OneConnect', 'Microsoft.Print3D', 'Microsoft.PowerAutomateDesktop',
    'Microsoft.SkypeApp', 'Microsoft.Windows.DevHome', 'Microsoft.WindowsFeedbackHub',
    'Microsoft.XboxApp', 'Microsoft.ZuneVideo', 'MicrosoftCorporationII.MicrosoftFamily',
    'MicrosoftTeams', 'ACGMediaPlayer', 'ActiproSoftwareLLC',
    'AdobeSystemsIncorporated.AdobePhotoshopExpress', 'Amazon.com.Amazon',
    'AmazonVideo.PrimeVideo', 'Asphalt8Airborne', 'AutodeskSketchBook',
    'CaesarsSlotsFreeCasino', 'COOKINGFEVER', 'CyberLinkMediaSuiteEssentials',
    'DisneyMagicKingdoms', 'Disney.37853FC22B2CE', 'DrawboardPDF',
    'Duolingo-LearnLanguagesforFree', 'EclipseManager', 'FACEBOOK.FACEBOOK',
    'FarmVille2CountryEscape', 'Flipboard', 'HiddenCity', 'HULULLC.HULUPLUS',
    'iHeartRadio', 'Facebook.Instagram', 'king.com.BubbleWitch3Saga',
    'king.com.CandyCrushSaga', 'king.com.CandyCrushSodaSaga', 'LinkedInforWindows',
    'MarchofEmpires', '4DF9E0F8.Netflix', 'NYTCrossword', 'OneCalendar',
    'PandoraMediaInc', 'PhototasticCollage', 'PicsArt-PhotoStudio',
    'PolarrPhotoEditorAcademicEdition', 'flaregamesGmbH.RoyalRevolt',
    'Sidia.LiveWallpaper', 'SlingTV', 'SpotifyAB.SpotifyMusic',
    'BytedancePte.Ltd.TikTok', 'TuneInRadio', 'WinZipUniversal'
)

# --------------------------------------------------------------------------
# 1. Preflight
# --------------------------------------------------------------------------
function Write-Head($text) {
    Write-Host ''
    Write-Host "== $text" -ForegroundColor Cyan
}

$isAdmin = ([Security.Principal.WindowsPrincipal] `
        [Security.Principal.WindowsIdentity]::GetCurrent()
).IsInRole([Security.Principal.WindowsBuiltInRole]::Administrator)

if (-not $isAdmin) {
    Write-Host 'This needs to run as administrator.' -ForegroundColor Red
    Write-Host 'Right-click PowerShell (or Windows Terminal) and pick "Run as administrator", then run this file again.'
    Read-Host 'Press Enter to close'
    exit 1
}

if ($env:OS -ne 'Windows_NT') {
    Write-Host 'This is a Windows tool — nothing was changed.' -ForegroundColor Red
    exit 1
}

$osVersion = [Environment]::OSVersion.Version
if ($osVersion.Major -lt 10) {
    Write-Host "Windows 10 or 11 is required (this PC reports $osVersion). Nothing was changed." -ForegroundColor Red
    exit 1
}

if ($ExecutionContext.SessionState.LanguageMode -ne 'FullLanguage') {
    Write-Host 'PowerShell is restricted by a security policy on this PC, so the script cannot run.' -ForegroundColor Red
    Write-Host 'Nothing was changed.'
    exit 1
}

$logDir  = Join-Path $env:USERPROFILE 'Desktop'
$stamp   = Get-Date -Format 'yyyyMMdd-HHmmss'
$logPath = Join-Path $logDir "FamPC-tune-up-$stamp.log"

try {
    Start-Transcript -Path $logPath -Force | Out-Null
} catch {
    Write-Warning "Could not start the log file at $logPath — continuing without it."
}

# --------------------------------------------------------------------------
# 2. The plan
# --------------------------------------------------------------------------
Write-Host ''
Write-Host '==================================================================' -ForegroundColor Cyan
Write-Host ' Delarosa Family PC Tune-Up  —  v1' -ForegroundColor Cyan
Write-Host " Windows debloat, pinned to Win11Debloat $Tag" -ForegroundColor Cyan
Write-Host '==================================================================' -ForegroundColor Cyan

Write-Head 'Settings this will change'
foreach ($sw in $ProfileSwitches) { Write-Host "   $sw" }

Write-Head 'Apps this will remove'
if ($SettingsOnly) {
    Write-Host '   (skipped — you asked for settings only)'
} else {
    Write-Host ("   {0} bundled apps: games, shopping, streaming, the discontinued " -f $RemoveApps.Count)
    Write-Host '   Bing apps, Clipchamp, Feedback Hub, old Skype/Messaging and friends.'
    Write-Host '   Every one of them can be reinstalled from the Microsoft Store.'
}

Write-Head 'Kept on purpose'
Write-Host '   Microsoft Store, Edge and WebView2, Photos, Paint, Notepad, Snipping Tool,'
Write-Host '   Calculator, Camera, Terminal, the Xbox app and Game Bar, Alarms & Clock,'
Write-Host '   Sound Recorder, Sticky Notes, To Do, OneNote, Quick Assist, Maps, Teams.'
Write-Host '   Notifications and Windows Update keep working normally.'

Write-Head 'Safety'
Write-Host '   A System Restore point is created first (plus Win11Debloat''s own),'
Write-Host '   and every setting has a documented undo file.'

# --------------------------------------------------------------------------
# 3. Consent
# --------------------------------------------------------------------------
if (-not $Unattended) {
    Write-Host ''
    $answer = Read-Host 'Type YES to continue (anything else cancels)'
    if ($answer -ne 'YES') {
        Write-Host 'Cancelled — nothing was changed.'
        try { Stop-Transcript | Out-Null } catch { }
        exit 0
    }
}

# --------------------------------------------------------------------------
# 4. Restore point
# --------------------------------------------------------------------------
Write-Head 'Creating a System Restore point'
$restorePointOk = $false
try {
    Enable-ComputerRestore -Drive "$env:SystemDrive\" -ErrorAction Stop
} catch {
    Write-Warning 'System Protection could not be enabled on this drive; the restore point may not be created.'
}
try {
    Checkpoint-Computer -Description 'FamPC tune-up (before)' -RestorePointType 'MODIFY_SETTINGS' -ErrorAction Stop
    $restorePointOk = $true
    Write-Host '   Restore point "FamPC tune-up (before)" created.'
} catch {
    Write-Warning "No restore point was created: $($_.Exception.Message)"
    Write-Warning 'Windows only allows one restore point per 24 hours, so a recent one may already cover this.'
    if (-not $Unattended) {
        $go = Read-Host 'Continue without a fresh restore point? Type YES to continue'
        if ($go -ne 'YES') {
            Write-Host 'Cancelled — nothing was changed.'
            try { Stop-Transcript | Out-Null } catch { }
            exit 0
        }
    }
}

# --------------------------------------------------------------------------
# 5. Fetch the pinned release and verify it
# --------------------------------------------------------------------------
Write-Head "Fetching Win11Debloat $Tag"
$workRoot = Join-Path $env:TEMP "FamPC-$Tag"
$zipPath  = Join-Path $env:TEMP "FamPC-$Tag.zip"
$zipUrl   = "https://github.com/Raphire/Win11Debloat/archive/refs/tags/$Tag.zip"

if (Test-Path $workRoot) { Remove-Item $workRoot -Recurse -Force }
New-Item -ItemType Directory -Path $workRoot -Force | Out-Null

try {
    Invoke-WebRequest -Uri $zipUrl -OutFile $zipPath -UseBasicParsing
} catch {
    Write-Host "Could not download Win11Debloat from GitHub: $($_.Exception.Message)" -ForegroundColor Red
    Write-Host 'Check the internet connection and run this file again. Nothing was changed past the restore point.'
    try { Stop-Transcript | Out-Null } catch { }
    exit 1
}

Expand-Archive -Path $zipPath -DestinationPath $workRoot -Force
$scriptFile = Get-ChildItem -Path $workRoot -Filter 'Win11Debloat.ps1' -Recurse |
    Select-Object -First 1

if ($null -eq $scriptFile) {
    Write-Host 'The download did not contain Win11Debloat.ps1 — stopping.' -ForegroundColor Red
    try { Stop-Transcript | Out-Null } catch { }
    exit 1
}

$actualHash = (Get-FileHash -Path $scriptFile.FullName -Algorithm SHA256).Hash
if ($actualHash -ne $ScriptHash) {
    Write-Host ''
    Write-Host 'STOPPING: the script we downloaded is not the one this profile was reviewed against.' -ForegroundColor Red
    Write-Host "   expected $ScriptHash"
    Write-Host "   got      $actualHash"
    Write-Host 'Nothing was changed. Ask Darren or Wilee for a re-reviewed profile.' -ForegroundColor Yellow
    try { Stop-Transcript | Out-Null } catch { }
    exit 1
}
Write-Host '   Verified: the release matches the reviewed build.'

# --------------------------------------------------------------------------
# 6. Run it
# --------------------------------------------------------------------------
$argumentList = @()
$argumentList += $ProfileSwitches
if (-not $SettingsOnly) {
    $argumentList += '-RemoveApps'
    $argumentList += '-Apps'
    $argumentList += ($RemoveApps -join ',')
    $argumentList += '-AppRemovalTarget'
    $argumentList += 'AllUsers'
}
$argumentList += '-LogPath'
$argumentList += $workRoot

Write-Head 'Applying the profile'
Write-Host '   This takes a few minutes. Leave the window open.'
& $scriptFile.FullName @argumentList
$exitCode = $LASTEXITCODE

# --------------------------------------------------------------------------
# 7. The report
# --------------------------------------------------------------------------
Write-Host ''
Write-Host '==================================================================' -ForegroundColor Cyan
if ($exitCode -eq 0 -or $null -eq $exitCode) {
    Write-Host ' Done.' -ForegroundColor Green
} else {
    Write-Host " Finished with exit code $exitCode — read the log before retrying." -ForegroundColor Yellow
}
Write-Host " Log: $logPath"
Write-Host ' Win11Debloat log folder: ' -NoNewline; Write-Host $workRoot
Write-Host ''
Write-Host ' To undo a setting: https://github.com/Raphire/Win11Debloat/wiki/Reverting-Changes'
Write-Host ' To undo everything: System Restore -> "FamPC tune-up (before)"'
if ($restorePointOk) {
    Write-Host ' (restore point confirmed)' -ForegroundColor Green
} else {
    Write-Host ' (no fresh restore point was created on this run)' -ForegroundColor Yellow
}
Write-Host ' Restart the PC when convenient so every change takes hold.'
Write-Host '==================================================================' -ForegroundColor Cyan

try { Stop-Transcript | Out-Null } catch { }
exit 0