# write_access.ps1 — write the access-control config as valid JSON (array for allow, no BOM).
# Called by the installer so a single allowed folder is still a JSON array and json.load never
# chokes on a byte-order mark.
param(
    [Parameter(Mandatory = $true)][string]$DataDir,
    [string]$Mode = "personal",
    [string]$Allow = ""
)
$m = if ($Mode -eq "work") { "work" } else { "personal" }
$items = @()
if ($Allow) { $items = @($Allow -split '\|' | Where-Object { $_ }) }
$aj = ($items | ForEach-Object { '"' + ($_ -replace '\\', '\\') + '"' }) -join ','
$json = '{"mode":"' + $m + '","allow":[' + $aj + '],"deny":[]}'
if (-not (Test-Path $DataDir)) { New-Item -ItemType Directory -Force -Path $DataDir | Out-Null }
[System.IO.File]::WriteAllText((Join-Path $DataDir 'lattice_access.json'), $json)
Write-Host "access config written: mode=$m allow=$($items.Count) folder(s)"
