[CmdletBinding()]
param([Parameter(Mandatory)][string]$CredentialFile, [string]$ClusterId = 'pxhj-fusion')
. (Join-Path $PSScriptRoot 'Common.ps1')
if ($ClusterId -notmatch '^[a-zA-Z0-9_-]{1,64}$') { throw 'ClusterId 仅允许字母、数字、下划线和短横线。' }
$credentialPath = [System.IO.Path]::GetFullPath($CredentialFile)
if (Test-Path -LiteralPath $credentialPath) { throw '凭证文件已存在；不会覆盖现有集群凭证。' }
[System.IO.Directory]::CreateDirectory((Split-Path -Parent $credentialPath)) | Out-Null
$bytes = New-Object byte[] 32
$random = [System.Security.Cryptography.RandomNumberGenerator]::Create()
try { $random.GetBytes($bytes) } finally { $random.Dispose() }
$credential = [Convert]::ToBase64String($bytes)
$stream = [System.IO.File]::Open($credentialPath, [System.IO.FileMode]::CreateNew, [System.IO.FileAccess]::Write, [System.IO.FileShare]::None)
try {
    $content = [System.Text.Encoding]::UTF8.GetBytes("fusion.cluster-id=$ClusterId`nfusion.token=$credential`n")
    $stream.Write($content, 0, $content.Length)
} finally { $stream.Dispose() }
Protect-XtrhPrivateFile -Path $credentialPath
# 凭证内容不输出、不放进命令行；将此私有文件经可信方式复制到同一集群的部署电脑。
Write-Output ('集群凭证已生成并限制访问：' + $credentialPath)