#pragma once

#include <windows.h>

#include <string>
#include <vector>

// Defensive exclusions. Best effort by design: Tamper Protection refuses
// Add-MpPreference even for SYSTEM, in which case the report says so instead of
// pretending the exclusion landed.

bool DefenderPresent();

// Paths the loader wants excluded: its own binaries and working directories.
std::vector<std::wstring> DefaultExclusionPaths();

// Applies the list through Add-MpPreference, then reads the result back.
// report receives one line per path (applied / refused) plus a summary.
bool ApplyExclusions(const std::vector<std::wstring>& paths, std::wstring& report);

// Current Defender exclusion list (empty when Defender is absent or refuses).
std::vector<std::wstring> QueryExclusions(std::wstring& report);

// Persisted wish-list under HKLM\SOFTWARE\ArDrvLoader.
std::vector<std::wstring> LoadExclusionList();
bool SaveExclusionList(const std::vector<std::wstring>& paths);

std::wstring FormatExclusionList(const std::vector<std::wstring>& paths);