installruntime

type Consumer struct {
	RuntimeRoot  string
	Registration string
	Commands     []string
}

type File struct {
	// WindowsReplacementID binds the evacuated preimage used by Windows redo.
	WindowsReplacementID string
	Parents              []PathAnchor
	BeforeData           []byte
	Link                 string
	Path                 string
	Before               Identity
	Data                 []byte
	Mode                 uint32
	Remove               bool
	DataSHA256           string `json:",omitempty"`
	BeforeDataSHA256     string `json:",omitempty"`
}

type Identity struct {
	Link   string
	Exists bool
	SHA256 string
	Mode   uint32
}

type InstalledSnapshot struct {
	Ledger   Ledger
	Recovery bool
	Enabled  bool
}

type Ledger struct {
	WriterFloor      int
	Enabled          bool
	Native           *NativeRecord
	Schema           int
	ID               string
	Owner            string
	RuntimeRoot      string
	Generation       uint64
	PolicyGeneration uint64
	Consumers        map[string]Consumer
	Files            map[string]Identity
	DecoderFloor     int
	PendingMutation  *PendingMutation `json:",omitempty"`
}

type NativeChange struct {
	Parents       []PathAnchor
	PurgeTrees    []PurgeTree
	Staged        string
	StagedID      string
	Before, After NativeRecord
	Purge         bool
	Retire        bool
}

type NativeGeneration struct {
	DirectoryID, Path, SHA256 string
	DecoderFloor              int
	Attestation               []byte
	InstalledTreeSHA256       string
}

type NativeRecord struct {
	DirectoryID, PreviousDirectoryID string
	// Attestation stores the external post-signing package evidence durably,
	// outside the signed bundle. InstalledTreeSHA256 binds it to bundle bytes.
	Attestation                                []byte
	InstalledTreeSHA256                        string
	Path, SHA256, PreviousPath, PreviousSHA256 string
	DecoderFloor                               int
	Published                                  []NativeGeneration
}

type PathAnchor struct{ Path, Identity string }

type PendingMutation struct {
	ID        string
	Owner     string
	IntentRef string
}

type PolicySnapshot struct {
	// Preimage identifies exactly the bytes parsed into Fields, not a later
	// fingerprint. Setup may pass it unchanged as Request.ExpectedPolicy.
	Preimage     Identity
	Installation InstalledSnapshot
	Policy       UserPolicy
	Fields       map[string]json.RawMessage
}

type PurgeEntry struct {
	ObjectID  string
	Directory string
	File      Identity
}

type PurgeTree struct {
	Path    string
	Entries map[string]PurgeEntry
}

type Request struct {
	// RevokeOpenCode permits only the exact desktop/webhook false policy patch
	// when delivery assets are damaged. It still requires a registered consumer,
	// generation and policy CAS; no asset, native or other policy mutation is allowed.
	RevokeOpenCode bool
	// RevokeGemini permits only Gemini's exact desktop/webhook false patch.
	// Damaged assets do not prevent revocation; ownership and CAS still apply.
	RevokeGemini bool
	// PolicyOnly requires an already-managed runtime and existing kernel locks.
	// It refuses recovery and asset/consumer mutations; setup cannot accidentally
	// promote native or rewrite hooks from an unrelated pending transaction.
	PolicyOnly bool
	// PolicyEnabled changes explicit intent; nil preserves it. Mutations require
	// an expected generation and share component/config locking and recovery.
	PolicyEnabled *bool
	// PolicyFields merges installer-owned route/rates and setupState ownership
	// members into the same
	// policy CAS transaction. Nil preserves all existing fields.
	PolicyFields map[string]json.RawMessage
	// ExpectedPolicy optionally fences the exact setup policy preimage, including
	// manual config edits that do not increment the installation generation.
	ExpectedPolicy *Identity
	// RefreshOnly updates an already registered runtime without adding a consumer.
	RefreshOnly bool
	// RelocateVersionedCache explicitly moves only the existing Claude hooks
	// consumer between sibling, versioned Claude plugin cache directories.
	// Other consumers and their runtime roots are never moved implicitly.
	RelocateVersionedCache bool
	// RollbackPending explicitly reverses a pending transaction using per-file CAS.
	RollbackPending bool
	Native          *NativeChange
	PurgeNative     bool
	// RetireNative removes only the drained predecessor, retaining the stable reader.
	// Requires ExpectedGeneration; may not be combined with native promotion/removal.
	RetireNative                                bool
	ControlRoot, Owner, RuntimeRoot, ConsumerID string
	Consumer                                    Consumer
	RemoveConsumer                              bool
	ExpectedGeneration                          *uint64
	Files                                       []File
	ConfigPaths                                 []string
	Prepare                                     func() ([]File, error)
	// RecoverOnly replays a pending journal and returns without refresh, install,
	// or consumer registration. It does not require owner/runtime/package.
	RecoverOnly bool
	// Reservation publishes or continues a kernel-owned pending mutation.
	Reservation *PendingMutation
	// ClearReservation removes a matching pending mutation. Floor/schema stay.
	ClearReservation bool
	// Fault is a test seam; returning an error intentionally leaves recovery data.
	Fault func(string) error
}

type RevocationSnapshot struct {
	Generation uint64
	Preimage   Identity
}

type UserPolicy struct {
	SchemaVersion int  `json:"schemaVersion"`
	Enabled       bool `json:"enabled"`
}