<#
.SYNOPSIS
    Elevated helper: set up (or tear down) service mode in ONE UAC prompt,
    not two.

.DESCRIPTION
    "Run as a background service" is two things -- the boot-time Scheduled
    Task and the firewall rules -- and needs one elevation, not one each.
    build/installer.nsh runs this single script via ExecShellWait "runas"
    for both the install-time choice and the uninstaller's cleanup, instead
    of elevating service.ps1 and firewall.ps1 separately.

    Each stays a script of its own rather than being folded together, so both
    remain independently callable and testable -- the CLI does, through
    meshbay-node service, and so does a later "just fix the firewall rules"
    retry that has nothing to do with the service task.

    Logs to the same file firewall.ps1 already uses, so both are visible in
    one place: %TEMP%\meshbay-firewall.log.

.PARAMETER Action
    install  service.ps1 install, then firewall.ps1 add
    remove   service.ps1 remove,  then firewall.ps1 remove
#>
[CmdletBinding()]
param(
    [ValidateSet("install", "remove")]
    [string]$Action = "install"
)

$here = $PSScriptRoot
$log = Join-Path $env:TEMP "meshbay-firewall.log"
$firewallAction = if ($Action -eq "install") { "add" } else { "remove" }
$failed = $false

"[{0}] service-mode {1}" -f (Get-Date -Format s), $Action | Add-Content $log

try {
    & (Join-Path $here "service.ps1") $Action
}
catch {
    "  service $Action failed: $_" | Add-Content $log
    $failed = $true
}

try {
    & (Join-Path $here "firewall.ps1") $firewallAction
}
catch {
    "  firewall $firewallAction failed: $_" | Add-Content $log
    $failed = $true
}

if ($failed) { exit 1 }
exit 0