/**
 * MCP tool: server_evidence
 * Collects forensic evidence package from a server and returns the manifest.
 */
import { z } from "zod";
import { getServers } from "../../utils/config.js";
import { collectEvidence } from "../../core/evidence.js";
import { resolveServerForMcp, mcpSuccess, mcpError, } from "../utils.js";
import { getErrorMessage, sanitizeStderr } from "../../utils/errorMapper.js";
export const serverEvidenceSchema = {
    server: z
        .string()
        .optional()
        .describe("Server name or IP. Auto-selected if only one server exists."),
    name: z
        .string()
        .optional()
        .describe("Label for the evidence directory (e.g. 'pre-incident')."),
    lines: z
        .number()
        .default(500)
        .describe("Number of log lines to collect per file (default: 500)."),
    no_docker: z
        .boolean()
        .default(false)
        .describe("Skip Docker data collection."),
    no_sysinfo: z
        .boolean()
        .default(false)
        .describe("Skip system information collection."),
    force: z
        .boolean()
        .default(false)
        .describe("Overwrite existing evidence directory."),
};
// ─── Output Schema ────────────────────────────────────────────────────────────
export const serverEvidenceOutputSchema = z.object({
    result: z.object({
        evidenceDir: z.string(),
        serverName: z.string(),
        serverIp: z.string(),
        platform: z.string(),
        collectedAt: z.string(),
        totalFiles: z.number(),
        skippedFiles: z.number(),
        manifestPath: z.string(),
    }),
});
// ─── Handler ──────────────────────────────────────────────────────────────────
export async function handleServerEvidence(params) {
    try {
        const servers = getServers();
        if (servers.length === 0) {
            return mcpError("No servers found");
        }
        const server = resolveServerForMcp(params, servers);
        if (!server) {
            if (params.server) {
                return mcpError(`Server not found: ${params.server}`, `Available servers: ${servers.map((s) => s.name).join(", ")}`);
            }
            return mcpError("Multiple servers found. Specify which server to collect evidence from.", `Available: ${servers.map((s) => s.name).join(", ")}`);
        }
        const platform = server.platform ?? server.mode ?? "bare";
        const result = await collectEvidence(server.name, server.ip, platform, {
            name: params.name,
            lines: params.lines ?? 500,
            noDocker: params.no_docker ?? false,
            noSysinfo: params.no_sysinfo ?? false,
            force: params.force ?? false,
            json: false,
            quiet: true,
        });
        if (!result.success || !result.data) {
            return mcpError(result.error ?? "Evidence collection failed");
        }
        const { evidenceDir, serverName, serverIp, totalFiles, skippedFiles, collectedAt, manifestPath } = result.data;
        const data = {
            evidenceDir,
            serverName,
            serverIp,
            platform,
            collectedAt,
            totalFiles,
            skippedFiles,
            manifestPath,
        };
        return mcpSuccess(data, { largeResult: true });
    }
    catch (error) {
        return mcpError(sanitizeStderr(getErrorMessage(error)));
    }
}
//# sourceMappingURL=serverEvidence.js.map