param(
  [Parameter(Mandatory = $true)]
  [string]$ConfirmValidatorAddress,
  [string]$InstallRoot = (Join-Path $env:LOCALAPPDATA 'PLAI Canonical QBFT Node')
)

$ErrorActionPreference = 'Stop'
$configPath = Join-Path $InstallRoot 'node-config.json'
if (-not (Test-Path -LiteralPath $configPath)) { throw "Node config is missing: $configPath" }
$config = Get-Content -LiteralPath $configPath -Raw | ConvertFrom-Json
if ($config.role -ne 'validator' -or -not $config.activationRequired) { throw 'This package is not a validator cutover package.' }
if ($ConfirmValidatorAddress.ToLowerInvariant() -ne ([string]$config.validatorAddress).ToLowerInvariant()) {
  throw 'Typed validator address does not match the package identity.'
}
$running = Get-CimInstance Win32_Process -Filter "Name = 'java.exe'" -ErrorAction SilentlyContinue |
  Where-Object { $_.CommandLine -like "*$InstallRoot*" }
if ($running) { throw 'A pre-sync or validator process is still running for this install root.' }

$approval = [ordered]@{
  nodeName = $config.nodeName
  validatorAddress = $config.validatorAddress
  genesisSha256 = $config.genesisSha256
  approvedBy = [Security.Principal.WindowsIdentity]::GetCurrent().Name
  approvedAt = [DateTime]::UtcNow.ToString('o')
}
$approvalPath = Join-Path $InstallRoot 'activation-approved.json'
[IO.File]::WriteAllText($approvalPath, ($approval | ConvertTo-Json -Depth 4) + [Environment]::NewLine, [Text.UTF8Encoding]::new($false))
Write-Host "Activation approved for $($config.nodeName). Start remains a separate action." -ForegroundColor Yellow
