[CmdletBinding()]
param()
$ErrorActionPreference='Stop'
$root=[IO.Path]::GetFullPath((Join-Path $PSScriptRoot '..'))
$tools=Join-Path $root 'tools'
New-Item -ItemType Directory -Path $tools -Force | Out-Null
$archive=Join-Path $tools 'core.zip'
Invoke-WebRequest 'https://github.com/SagerNet/sing-box/releases/download/v1.14.2/sing-box-1.14.2-windows-amd64.zip' -OutFile $archive
if ((Get-FileHash -LiteralPath $archive -Algorithm SHA256).Hash -ne 'C2D8BFFF918755808781DFDEEB8581B6C91EB3A243D9A7B55483CFC0C0684D32') {throw 'VPN core archive hash mismatch'}
Expand-Archive -LiteralPath $archive -DestinationPath (Join-Path $tools 'core-unpacked') -Force
$rules=Join-Path $tools 'rules'
New-Item -ItemType Directory -Path $rules -Force | Out-Null
$sources=Get-Content (Join-Path $root 'research/rules-sources.json') -Raw | ConvertFrom-Json
foreach($source in $sources) {
    $target=Join-Path $rules $source.name
    Invoke-WebRequest $source.url -OutFile $target
    if((Get-FileHash -LiteralPath $target -Algorithm SHA256).Hash -ne $source.sha256) {throw "Routing rules hash mismatch: $($source.name)"}
}
Invoke-WebRequest 'https://github.com/SagerNet/sing-box/archive/refs/tags/v1.14.2.zip' -OutFile (Join-Path $tools 'sing-box-1.14.2-source.zip')
Write-Output 'Pinned core, routing rules and upstream source downloaded and checked.'