import {
  sanitizePath
} from "./chunk-W6Y7ZW3Y.js";

// src/mcp/tools/security.ts
import * as path from "path";
import { execSync } from "child_process";
var runSecurityScanDefinition = {
  name: "run_security_scan",
  description: "Run the built-in security scanner on a project or specific files. Detects secrets, injection, XSS, weak crypto, and other vulnerabilities.",
  inputSchema: {
    type: "object",
    properties: {
      path: { type: "string", description: "Path to project root" },
      files: {
        type: "array",
        items: { type: "string" },
        description: "Optional list of specific files to scan. If omitted, scans all source files."
      },
      strict: {
        type: "boolean",
        description: "Override strict mode \u2014 promotes all warnings to errors"
      }
    },
    required: ["path"]
  }
};
async function handleRunSecurityScan(input) {
  try {
    const core = await import("./dist-I4LWG3IN.js");
    const projectRoot = sanitizePath(input.path);
    let configData = {};
    try {
      const fs = await import("fs");
      const configPath = path.join(projectRoot, "harness.config.json");
      if (fs.existsSync(configPath)) {
        const raw = fs.readFileSync(configPath, "utf-8");
        const parsed = JSON.parse(raw);
        configData = parsed.security ?? {};
      }
    } catch {
    }
    if (input.strict !== void 0) {
      configData.strict = input.strict;
    }
    const securityConfig = core.parseSecurityConfig(configData);
    const scanner = new core.SecurityScanner(securityConfig);
    scanner.configureForProject(projectRoot);
    let filesToScan;
    if (input.files && input.files.length > 0) {
      filesToScan = input.files.map((f) => path.resolve(projectRoot, f));
    } else {
      const { globFiles } = await import("./glob-helper-FZPPTGJN.js");
      filesToScan = await globFiles(projectRoot, securityConfig.exclude);
    }
    const result = await scanner.scanFiles(filesToScan);
    try {
      const commitHash = execSync("git rev-parse HEAD", {
        cwd: projectRoot,
        encoding: "utf-8"
      }).trim();
      const timelineManager = new core.SecurityTimelineManager(projectRoot);
      timelineManager.capture(result, commitHash);
      timelineManager.updateLifecycles(result.findings, commitHash);
    } catch {
    }
    return {
      content: [
        {
          type: "text",
          text: JSON.stringify({
            ...result,
            summary: {
              errors: result.findings.filter((f) => f.severity === "error").length,
              warnings: result.findings.filter(
                (f) => f.severity === "warning"
              ).length,
              info: result.findings.filter((f) => f.severity === "info").length
            }
          })
        }
      ]
    };
  } catch (error) {
    return {
      content: [
        {
          type: "text",
          text: `Error: ${error instanceof Error ? error.message : String(error)}`
        }
      ],
      isError: true
    };
  }
}
var getSecurityTrendsDefinition = {
  name: "get_security_trends",
  description: "Get security posture trends showing how security score, findings, and supply chain metrics are changing over time.",
  inputSchema: {
    type: "object",
    properties: {
      path: { type: "string", description: "Path to project root" },
      last: {
        type: "number",
        description: "Return trends from the last N snapshots"
      },
      since: {
        type: "string",
        description: "Return trends since this ISO date (e.g. 2025-01-01)"
      }
    },
    required: ["path"]
  }
};
async function handleGetSecurityTrends(input) {
  try {
    const core = await import("./dist-I4LWG3IN.js");
    const projectRoot = sanitizePath(input.path);
    const manager = new core.SecurityTimelineManager(projectRoot);
    const trendOptions = {};
    if (input.last !== void 0) trendOptions.last = input.last;
    if (input.since !== void 0) trendOptions.since = input.since;
    const trends = manager.trends(trendOptions);
    return {
      content: [
        {
          type: "text",
          text: JSON.stringify(trends)
        }
      ]
    };
  } catch (error) {
    return {
      content: [
        {
          type: "text",
          text: `Error: ${error instanceof Error ? error.message : String(error)}`
        }
      ],
      isError: true
    };
  }
}

export {
  runSecurityScanDefinition,
  handleRunSecurityScan,
  getSecurityTrendsDefinition,
  handleGetSecurityTrends
};
