#requires -Version 7.0
[CmdletBinding()]
param([string]$SubscriptionId,[string]$Location='westeurope',[string]$VmSize='Standard_B1s')
. "$PSScriptRoot/MonitorPrivateLink.Common.ps1"
Initialize-Context $PSScriptRoot $SubscriptionId $Location $VmSize 30
Assert-Ownership
Require-Stage Validate
# Export ONLY intentionally constructed evidence. Raw HTTP results and ARM objects never enter this bundle.
$safe=[ordered]@{Workshop='Azure Monitor Private Link Deep Dive';VerifiedUtc=[datetime]::UtcNow.ToString('o');EvidenceType='Observed live Azure tests';ScreenshotsIncluded=$false;Tests=[ordered]@{}}
foreach ($name in @('PublicBaseline','PrivateLink','Lockdown','AMA','TestBoundary','TestDnsRecovery','Validate')) {
    $proof=$script:State.Evidence[$name]
    if (-not $proof -or -not $proof.Passed) { throw "Missing proof: $name" }
    $safe.Tests[$name]=$proof
}
$json=$safe | ConvertTo-Json -Depth 30
$patterns=@('(?i)\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}\b','\b(?:\d{1,3}\.){3}\d{1,3}\b','(?i)/subscriptions/|/resourcegroups/|bearer\s|BEGIN .*PRIVATE KEY|ssh-rsa\s|https?://')
foreach ($pattern in $patterns) { if ($json -match $pattern) { throw 'Public evidence privacy scan failed.' } }
$folder=Join-Path $PSScriptRoot 'evidence'
$null=New-Item -ItemType Directory -Path $folder -Force
[IO.File]::WriteAllText((Join-Path $folder 'verified.json'),$json,[Text.UTF8Encoding]::new($false))
$lines=@('# Live-test report','','All assertions below are backed by observed Azure execution. Raw payloads remain private.','')
foreach ($name in $safe.Tests.Keys) {
    $lines+=@("## $name",'', '```json',($safe.Tests[$name] | ConvertTo-Json -Depth 15),'```','')
}
[IO.File]::WriteAllText((Join-Path $PSScriptRoot 'live-test-report.md'),($lines -join "`n"),[Text.UTF8Encoding]::new($false))
Write-Host 'PASS: sanitized evidence and live-test report exported.'
