/**
 * loglift-eventlogs — comprehensive Windows event log + system context
 * collection. Asset-self.
 *
 * The collector PowerShell is deployed as a separate Datto RMM component
 * (registered in the Wulf tenant; auto-discovered via /loglift/i pattern)
 * because the payload is too large for Overshell stdout — typically tens
 * of MB of gzipped JSON. The collector uploads to a Backblaze B2 bucket
 * and POSTs a metadata webhook to Pulse, which downloads, decompresses,
 * slims, and persists.
 *
 * This registry entry exists so:
 *   1. The picker UI can offer LogLift to admins on Configuration pages.
 *   2. The executor knows transport='b2_upload' and dispatches the
 *      LogLift component (not Overshell) with the right variables.
 *   3. The audit-context loader can list latest LogLift evidence per
 *      asset alongside other RMM scripts.
 */

import type { RmmScript } from './types';

export const logliftEventLogs: RmmScript = {
  id: 'loglift-eventlogs',
  name: 'LogLift event-log collection',
  description:
    'Comprehensive Windows event-log + system-context capture. Uploads gzipped JSON to Backblaze B2; Pulse downloads, slims to top events + system context, and surfaces it as live audit evidence.',
  target_type: 'asset_self',
  transport: 'b2_upload',
  expected_runtime_seconds: 120,
  version: 1,
  // Deployed externally as the LogLift Datto component. Pulse never sends
  // PowerShell over Overshell for this script.
  body: '',
  // Payload arrives from B2 (parsed in the webhook handler), not stdout.
  parseOutput: () => ({}),
};
