### FILE: index.php
<?php 
// Ensure session is started
session_start();

// Error handling function
function handle_error($errno, $errstr, $errfile, $errline) {
    echo json_encode(['error' => "Error [$errno]: $errstr in $errfile on line $errline"]);
    die();
}

set_error_handler('handle_error');

// Example Graph call using the predefined M365 SaaS Engine function
$hotpatchDevices = $ms->graphCall('/devices', $_SESSION['ms_access_token']);

// Example rendering of a card
render_premium_card(
    'Hotpatch Eligible Devices', 
    count($hotpatchDevices), 
    null, 
    'up', 
    '📊', 
    75
);
?>

### FILE: scripts/VBS-Check.ps1
<#
.SYNOPSIS
    Checks local VBS status to verify hotpatch eligibility.
.DESCRIPTION
    This script checks if Virtualization Based Security (VBS) is active and running on a local device to determine its eligibility for hotpatch updates.
.EXAMPLE
    .\VBS-Check.ps1
.NOTES
    Author:      Souhaiel Morhag
    Company:     MSEndpoint.com
    Blog:        https://msendpoint.com
    Academy:     https://app.msendpoint.com/academy
    LinkedIn:    https://linkedin.com/in/souhaiel-morhag
    GitHub:      https://github.com/Msendpoint
    License:     MIT
#>

try {
    $guard = Get-WmiObject -Namespace root\Microsoft\Windows\DeviceGuard -Class Win32_DeviceGuard

    switch ($guard.VirtualizationBasedSecurityStatus) {
        0 { Write-Host "VBS NOT enabled — device will receive LCU (restart required)" -ForegroundColor Red }
        1 { Write-Host "VBS enabled but not running — check BIOS/UEFI Secure Boot settings" -ForegroundColor Yellow }
        2 { Write-Host "VBS running — device eligible for hotpatch" -ForegroundColor Green }
    }
}
catch {
    Write-Host "Error Checking VBS: $_" -ForegroundColor Red
}

### FILE: scripts/Eligibility-Report.ps1
<#
.SYNOPSIS
    Reports devices eligible for hotpatch updates based on join type and OS version.
.DESCRIPTION
    This script uses Microsoft Graph to fetch all Windows devices and report on their eligibility for hotpatch updates based on OS version and join type.
.EXAMPLE
    .\Eligibility-Report.ps1
.NOTES
    Author:      Souhaiel Morhag
    Company:     MSEndpoint.com
    Blog:        https://msendpoint.com
    Academy:     https://app.msendpoint.com/academy
    LinkedIn:    https://linkedin.com/in/souhaiel-morhag
    GitHub:      https://github.com/Msendpoint
    License:     MIT
#>

try {
    Connect-MgGraph -Scopes "Device.Read.All"

    $devices = Get-MgDevice -Filter "operatingSystem eq 'Windows'" -All

    $report = foreach ($d in $devices) {
        $build = [version]($d.OperatingSystemVersion -replace '^10\.0\.')
        [PSCustomObject]@{
            Name             = $d.DisplayName
            OSVersion        = $d.OperatingSystemVersion
            JoinType         = $d.TrustType  # AzureAd = Entra-joined, ServerAd = hybrid
            Build24H2Plus    = ($d.OperatingSystemVersion -ge "10.0.26100")
            EntraJoined      = ($d.TrustType -eq "AzureAd")
            LikelyEligible   = ($d.TrustType -eq "AzureAd") -and ($d.OperatingSystemVersion -ge "10.0.26100")
        }
    }

    $report | Sort-Object LikelyEligible -Descending | Format-Table -AutoSize
}
catch {
    Write-Host "Error Fetching Devices: $_" -ForegroundColor Red
}