@echo off
REM ===========================================================================
REM  SilverMetal Enhanced - Windows : first-boot entry point.
REM  Windows runs %WINDIR%\Setup\Scripts\SetupComplete.cmd automatically (as
REM  SYSTEM) at the end of setup. It hands off to Invoke-Hardening.ps1 via -File
REM  to avoid cmd/PowerShell quoting fragility (an inline -Command one-liner
REM  here previously failed to parse, so the §A-H modules never ran).
REM
REM  Design: ../../iso-builder.md   Controls: ../../hardening-spec.md
REM ===========================================================================

set LOG=C:\Windows\Setup\Scripts\silvermetal-firstboot.log
set HARD=C:\Windows\Setup\Scripts\hardening

echo [%DATE% %TIME%] SilverMetal first-boot start >> "%LOG%"

REM Re-apply branding ONLINE (lock screen / wallpaper / OEM / FVE). Windows resets
REM the offline-baked personalization during OOBE, so re-assert it here (post-OOBE,
REM as SYSTEM) where it sticks. Idempotent with the offline bake.
if exist "%~dp0branding\Apply-Branding.ps1" (
  echo [%DATE% %TIME%] re-applying SilverMetal branding (online) >> "%LOG%"
  powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0branding\Apply-Branding.ps1" -Mode Online >> "%LOG%" 2>&1
)

if exist "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe" (
  echo [%DATE% %TIME%] configuring onboarding kiosk >> "%LOG%"
  powershell -NoProfile -ExecutionPolicy Bypass -File "%~dp0Configure-Kiosk.ps1" >> "%LOG%" 2>&1
)

if exist "C:\Program Files\SilverOS\Welcome\SilverOS.Welcome.App.exe" (
  echo [%DATE% %TIME%] hardening deferred to SilverOS Welcome >> "%LOG%"
) else (
  powershell -NoProfile -ExecutionPolicy Bypass -File "%HARD%\Invoke-Hardening.ps1" >> "%LOG%" 2>&1
)

REM Plaintext-password hygiene: delete the cached answer file that holds the
REM local account password in clear text. Runs as SYSTEM after accounts exist.
del /f /q "%WINDIR%\Panther\unattend.xml" 2>nul
del /f /q "%WINDIR%\Panther\Unattend\unattend.xml" 2>nul

echo [%DATE% %TIME%] SilverMetal first-boot done >> "%LOG%"
exit /b 0