function Initialize-NuGetProvider {
    [CmdletBinding()]
    param()

    # Silent defaults
    [Net.ServicePointManager]::SecurityProtocol = [Net.SecurityProtocolType]::Tls12
    $ProgressPreference = 'SilentlyContinue'
    $ConfirmPreference  = 'None'

    # Extra guardrails for "ShouldContinue" style prompts
    $PSDefaultParameterValues['*:Confirm'] = $false

    # Ensure provider folders exist (CurrentUser and AllUsers locations)
    $userProvPath = Join-Path $env:LOCALAPPDATA 'PackageManagement\ProviderAssemblies'
    $allProvPath  = Join-Path ${env:ProgramFiles} 'PackageManagement\ProviderAssemblies'

    foreach ($p in @($userProvPath, $allProvPath)) {
        try {
            if ($p -and -not (Test-Path $p)) {
                New-Item -Path $p -ItemType Directory -Force -ErrorAction Stop | Out-Null
                Write-LogHybrid "Ensured provider folder exists: $p" Info Bootstrap -LogToEvent
            }
        } catch {
            # AllUsers path can fail without admin. That's OK.
            Write-LogHybrid "Could not create provider folder: $p ($($_.Exception.Message))" Warning Bootstrap -LogToEvent
        }
    }

    # 1) Install NuGet provider FIRST, silently, so Install-Module never prompts
    try {
        $existing = Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue |
                    Sort-Object Version -Descending | Select-Object -First 1

        if (-not $existing -or $existing.Version -lt [Version]'2.8.5.201') {

            Write-LogHybrid "Installing NuGet provider (min 2.8.5.201)..." Info Bootstrap -LogToEvent

            # ForceBootstrap helps avoid interactive bootstrap prompts
            Install-PackageProvider -Name NuGet -MinimumVersion 2.8.5.201 `
                -Force -ForceBootstrap -Confirm:$false `
                -Scope CurrentUser -ErrorAction Stop | Out-Null

            $existing = Get-PackageProvider -Name NuGet -ListAvailable -ErrorAction SilentlyContinue |
                        Sort-Object Version -Descending | Select-Object -First 1
        }

        if ($existing) {
            Import-PackageProvider -Name NuGet -Force -ErrorAction Stop | Out-Null
            Write-LogHybrid "NuGet provider ready (v$($existing.Version))" Success Bootstrap -LogToEvent
        } else {
            throw "NuGet provider still not available after install attempt."
        }
    }
    catch {
        Write-LogHybrid "NuGet provider install/import failed: $($_.Exception.Message)" Error Bootstrap -LogToEvent
        throw
    }

    # 2) Now it is safe to update / install modules without NuGet prompts
    try {
        Import-Module PackageManagement -Force -ErrorAction SilentlyContinue | Out-Null
        Import-Module PowerShellGet     -Force -ErrorAction SilentlyContinue | Out-Null

        $pkgMgmtVersion = (Get-Module PackageManagement -ListAvailable | Sort-Object Version -Descending | Select-Object -First 1).Version
        if ($pkgMgmtVersion -and $pkgMgmtVersion -lt [Version]'1.3.1') {
            Install-Module PackageManagement -Force -AllowClobber -Confirm:$false -ErrorAction Stop
            Write-LogHybrid "Updated PackageManagement to latest version" Info Bootstrap -LogToEvent
        }

        if (-not (Get-Module PowerShellGet -ListAvailable)) {
            Install-Module PowerShellGet -Force -AllowClobber -Confirm:$false -ErrorAction Stop
            Write-LogHybrid "Installed PowerShellGet module" Info Bootstrap -LogToEvent
        }

        # Trust PSGallery (optional, but common)
        $gallery = Get-PSRepository -Name PSGallery -ErrorAction SilentlyContinue
        if ($gallery -and $gallery.InstallationPolicy -ne 'Trusted') {
            Set-PSRepository -Name PSGallery -InstallationPolicy Trusted -ErrorAction Stop
            Write-LogHybrid "PSGallery marked as Trusted" Info Bootstrap -LogToEvent
        }
    }
    catch {
        Write-LogHybrid "PackageManagement/PowerShellGet setup failed: $($_.Exception.Message)" Warning Bootstrap -LogToEvent
        # You can choose to throw here if you want hard-fail behavior
    }
}

#region App handlers

    function Invoke-Install1Password {
        param($Context)

        try {
            # Default if called without suboptions
            $selected = @('desktop')

            # If JS POSTs { checkedValues: [...] }, use that
            if ($Context -and $Context.Request -and $Context.Request.HttpMethod -eq 'POST') {
                $raw = (New-Object IO.StreamReader $Context.Request.InputStream).ReadToEnd()
                if (-not [string]::IsNullOrWhiteSpace($raw)) {
                    $data = $raw | ConvertFrom-Json
                    if ($data.checkedValues) { $selected = @($data.checkedValues) }
                }
            }

            # Extension IDs from official store listings
            $chromeExtId = 'aeblfdkhhhdcdjpifhhbdiojplfjncoa' # Chrome Web Store :contentReference[oaicite:1]{index=1}
            $edgeExtId   = 'dppgmdbiimibapkepcbdbmkaabgiofem' # Edge Add-ons :contentReference[oaicite:2]{index=2}

            if ($selected -contains 'desktop') {
                winget install -e --id AgileBits.1Password --silent --accept-package-agreements --accept-source-agreements
                Write-LogHybrid "Installed 1Password desktop app via winget" Success SVSApps -LogToEvent
            }

            if ($selected -contains 'chromeExt') {
                $chromeKey = "HKLM:\SOFTWARE\Policies\Google\Chrome\ExtensionInstallForcelist"
                New-Item -Path $chromeKey -Force | Out-Null
                New-ItemProperty -Path $chromeKey -Name "1" -PropertyType String -Force `
                -Value "$chromeExtId;https://clients2.google.com/service/update2/crx" | Out-Null
                Write-LogHybrid "Forced 1Password extension install for Chrome" Success SVSApps -LogToEvent
            }

            if ($selected -contains 'edgeExt') {
                $edgeKey = "HKLM:\SOFTWARE\Policies\Microsoft\Edge\ExtensionInstallForcelist"
                New-Item -Path $edgeKey -Force | Out-Null
                New-ItemProperty -Path $edgeKey -Name "1" -PropertyType String -Force `
                -Value "$edgeExtId;https://edge.microsoft.com/extensionwebstorebase/v1/crx" | Out-Null
                Write-LogHybrid "Forced 1Password extension install for Edge" Success SVSApps -LogToEvent
            }

            Send-Text $Context "1Password processed: $($selected -join ', ')"
        }
        catch {
            Write-LogHybrid "1Password install failed: $($_.Exception.Message)" Error SVSApps -LogToEvent
            Send-Text $Context "ERROR: $($_.Exception.Message)"
        }
    }

    function Invoke-DisableAnimations {
        param($Context)

        try {
            $selected = @()

            if ($Context -and $Context.Request -and $Context.Request.HttpMethod -eq 'POST') {
                $raw = (New-Object IO.StreamReader $Context.Request.InputStream).ReadToEnd()
                if (-not [string]::IsNullOrWhiteSpace($raw)) {
                    $data = $raw | ConvertFrom-Json
                    if ($data.checkedValues) { $selected = @($data.checkedValues) }
                }
            }

            # If nothing selected, you decide the default.
            # I usually default to "all", since the master checkbox implies intent.
            if ($selected.Count -eq 0) {
                $selected = @('window','taskbar','menus')
            }

            # If you already have a single function that disables everything:
            # you can just call it when any suboption is selected.
            # OR implement per-suboption logic if you want true granularity.
            Disable-Animations

            Write-LogHybrid "Disable Animations applied. Selected: $($selected -join ', ')" Success Tweaks -LogToEvent
            Send-Text $Context "Disable Animations applied: $($selected -join ', ')"
        }
        catch {
            Write-LogHybrid "Disable Animations failed: $($_.Exception.Message)" Error Tweaks -LogToEvent
            Send-Text $Context "ERROR: $($_.Exception.Message)"
        }
    }

#endregion App handlers