# AMerc Outpost standalone installer 1.1.45-overair
[CmdletBinding()]
param([string]$AMercBase = 'https://amerc.ai')
$ErrorActionPreference = 'Stop'
$InstallRoot = Join-Path $env:LOCALAPPDATA 'AMerc\Outpost'

$AccountUser = Read-Host 'AMerc account username'
$AccountSecure = Read-Host 'AMerc account password' -AsSecureString
$AccountPassword = [Net.NetworkCredential]::new('', $AccountSecure).Password
$LocalUser = Read-Host 'Local API username [admin]'
if (-not $LocalUser) { $LocalUser = 'admin' }
$LocalSecure = Read-Host 'Local API password [123456]' -AsSecureString
$LocalPassword = [Net.NetworkCredential]::new('', $LocalSecure).Password
if (-not $LocalPassword) { $LocalPassword = '123456' }

$Session = New-Object Microsoft.PowerShell.Commands.WebRequestSession
try {
  Invoke-WebRequest -UseBasicParsing -WebSession $Session -Method Post -Uri ($AMercBase.TrimEnd('/') + '/login') `
    -ContentType 'application/x-www-form-urlencoded' -Body @{ username = $AccountUser; password = $AccountPassword } | Out-Null
  $Payload = @{
    platform = 'windows'
    label = ($env:COMPUTERNAME + '-outpost')
    servesAgents = $true
    localAuth = @{ username = $LocalUser; password = $LocalPassword }
  } | ConvertTo-Json -Depth 4
  $Build = Invoke-RestMethod -WebSession $Session -Method Post -Uri ($AMercBase.TrimEnd('/') + '/api/outposts/build') `
    -ContentType 'application/json' -Body $Payload
  if (-not $Build.downloadUrl) { throw 'AMerc did not approve the Outpost download.' }
  $Download = [string]$Build.downloadUrl
  if ($Download.StartsWith('/')) { $Download = $AMercBase.TrimEnd('/') + $Download }
  # AMerc now hands back a PowerShell installer (no unsigned .exe for Defender
  # to quarantine); save it with its own name and run it in this session.
  $Name = if ($Build.filename) { [string]$Build.filename } else { 'Install-AMercOutpost.ps1' }
  $Target = Join-Path $env:TEMP $Name
  Invoke-WebRequest -UseBasicParsing -Uri $Download -OutFile $Target
  if ($Name -like '*.ps1') { & $Target } else { Start-Process -FilePath $Target -Wait }
  Write-Host "Installed the Outpost in $InstallRoot; it runs headless and reconnects on login."
  Write-Host 'A compatible system Node is reused; otherwise the verified runtime component downloads once, with progress printed above.'
  Write-Host 'Change the default local API password on shared machines.'
} finally {
  $AccountPassword = $null
  $LocalPassword = $null
  $LocalSecure = $null
}