param(
  [string]$ServerId,
  [string]$Token,
  [string]$ServerUrl,
  [string]$InstallDir
)
$cfgDir = Join-Path $env:ProgramData "vantage"
New-Item -ItemType Directory -Force -Path $cfgDir | Out-Null
$cfg = @"
server_url: "$ServerUrl"
server_id: "$ServerId"
pre_reg_token: "$Token"
agent_token: ""
poll_interval: 30s
tls: true
"@
Set-Content -Path (Join-Path $cfgDir "config.yaml") -Value $cfg -Encoding utf8
# Lock down ACL: SYSTEM + Administrators only
icacls (Join-Path $cfgDir "config.yaml") /inheritance:r /grant:r "SYSTEM:F" "Administrators:F" | Out-Null

$nssm = Join-Path $InstallDir "nssm.exe"
$exe  = Join-Path $InstallDir "vantage-agent.exe"
& $nssm install VantageAgent $exe
& $nssm set VantageAgent Start SERVICE_AUTO_START
& $nssm start VantageAgent