/**
 * get-event-log-recent — last 50 errors+warnings from System and
 * Application logs in the past 24h. Asset-self.
 *
 * Useful for retroactive diagnosis — "what was screaming on this server
 * around the time the ticket came in?"
 */

import { type RmmScript, parseJsonOutput } from './types';

export const getEventLogRecent: RmmScript = {
  id: 'get-event-log-recent',
  name: 'Recent event-log errors',
  description:
    'Last 24h of Errors + Warnings from System + Application logs (capped at 50).',
  target_type: 'asset_self',
  expected_runtime_seconds: 25,
  version: 1,
  body: `
$ErrorActionPreference = 'Stop'
$since = (Get-Date).AddHours(-24)
$entries = Get-WinEvent -FilterHashtable @{
  LogName = @('System','Application')
  Level   = @(1,2,3)  # 1=Critical, 2=Error, 3=Warning
  StartTime = $since
} -MaxEvents 50 -ErrorAction SilentlyContinue |
  Select-Object @{n='time';e={$_.TimeCreated.ToUniversalTime().ToString("o")}},
                LogName, Id, LevelDisplayName, ProviderName,
                @{n='message';e={ ($_.Message -replace '\\s+',' ').Trim().Substring(0, [Math]::Min(500, $_.Message.Length)) }}
@{
  hostname = $env:COMPUTERNAME
  captured_at_utc = (Get-Date).ToUniversalTime().ToString("o")
  since_utc = $since.ToUniversalTime().ToString("o")
  count = ($entries | Measure-Object).Count
  entries = $entries
} | ConvertTo-Json -Depth 4 -Compress
`.trim(),
  parseOutput: (stdout) => parseJsonOutput(stdout),
};
