cli

type AuthArtifact interface {
	Kind() AuthKind
	ArtifactOrigin() string
	// contains filtered or unexported methods
}

type AuthKind string

type AuthKinds uint8

type AuthOperation string

type BinaryUpdater interface {
	Apply(context.Context, updatecheck.Status) error
	// CheckReplaceable refuses before any state is written when this process
	// could not replace the running executable.
	CheckReplaceable() error
}

type Client struct {
	Entry TrustEntry
	HTTP  *http.Client
	// Bearer is the session artifact, presented only to Entry.Origin.
	Bearer string
	// UserAgent identifies the client class in the audit trail.
	UserAgent string
	// contains filtered or unexported fields
}

type Context struct {
	Name     string `json:"name"`
	Instance string `json:"instance"`
	Org      string `json:"org,omitempty"`
	Project  string `json:"project,omitempty"`
	Env      string `json:"env,omitempty"`
}

type CredentialRef string

type DeveloperCredentialArtifact struct {
	ID          string    `json:"id"`
	Origin      string    `json:"origin"`
	Org         string    `json:"org"`
	Project     string    `json:"project"`
	Environment string    `json:"environment"`
	Token       string    `json:"token"`
	ExpiresAt   time.Time `json:"expires_at"`
}

type Dimension string

type Env struct {
	Getenv func(string) string
}

type Error struct {
	Code int
	Err  error
}

type Flags struct {
	Context  string
	Instance string
	Org      string
	Project  string
	Env      string
}

type Format string

type HumanSession struct{ SessionArtifact }

type IO struct {
	Stdin   io.Reader
	Stdout  io.Writer
	Stderr  io.Writer
	Env     Env
	Workdir string
	// ReadPassword reads a secret from the controlling terminal with echo
	// off. Injected for tests; nil means the real terminal.
	ReadPassword func(prompt string) (string, error)
	// TerminalSession is the command-scoped controlling terminal. Platform
	// code constructs it once; Run closes it on every return path.
	TerminalSession *disclose.TerminalSession
	// TerminalError preserves a failed platform construction until a command
	// actually needs the terminal; non-interactive commands remain usable.
	TerminalError error
	// StderrIsTerminal reports whether Stderr is a TTY. `run
	// --use-human-session` requires it (api-cli-surface ADR: "stderr-is-a-TTY
	// (an additional refusal, never the control)"). Nil means false.
	StderrIsTerminal func() bool
	// OpenURL launches a browser without printing the opaque handoff state.
	// Nil uses the platform browser opener.
	OpenURL func(string) error
	// PrepareClipboard prepares a native protected clipboard destination before
	// disclosure. Nil uses the platform implementation; injected by tests.
	PrepareClipboard func() (func(context.Context, string) error, error)
	// Exec replaces the current process image with argv0 (unix syscall.Exec) or
	// spawns-waits-and-exits-with-the-child-code (windows). `hikyo run --` is the
	// only caller. Nil uses the real platform Exec (execRun, build-tagged). Tests
	// inject it to capture the child's argv/env without a real exec.
	Exec func(argv0 string, argv, env []string) error
	// Now is the clock the compose verbs read for snapshot expiry. Nil means
	// time.Now — there is deliberately no HIKYO_NOW env knob, because a clock a
	// hostile config file could set is the rollback surface the snapshot high-
	// water mark exists to bound.
	Now func() time.Time
	// Version is the linker-stamped Hikyo version used for update comparison.
	Version string
	// DefaultUpdateChannel is linker-stamped with the artifact's release track.
	// An empty value is fail-closed as off, matching a source build.
	DefaultUpdateChannel updatecheck.Channel
	// UpdateSource is injected by update tests. Nil uses Hikyo's pinned public
	// GitHub Releases source.
	UpdateSource updatecheck.Source
	// BinaryUpdater replaces the current executable after interactive consent.
	// Nil preserves notification-only behavior when no updater is configured.
	BinaryUpdater BinaryUpdater
}

type MachineCredential struct {
	Origin        string
	CredentialRef CredentialRef
}

type PinFile struct {
	Instance string `json:"instance,omitempty"`
	Org      string `json:"org,omitempty"`
	Project  string `json:"project,omitempty"`
	Env      string `json:"env,omitempty"`
}

type RateLimitedError struct {
	Message    string
	RetryAfter time.Duration
}

type Resolved struct {
	Values  map[Dimension]string
	Sources map[Dimension]Source
	// PinFilePath is the pin file that contributed, if any — named in the
	// echo so an operator can see what directed them.
	PinFilePath string
	// ContextName is the named context that contributed, if any.
	ContextName string
}

type SessionArtifact struct {
	Instance  string `json:"instance"`
	Origin    string `json:"origin"`
	Token     string `json:"token"`
	SessionID string `json:"session_id"`
	Principal string `json:"principal"`
	ExpiresAt string `json:"expires_at"`
}

type Source string

type State struct {
	// contains filtered or unexported fields
}

type TLSMode string

type Table struct {
	Columns []string
	Rows    [][]string
	// JSON is what `-o json` emits. It is the generated contract type, so the
	// machine shape is the API's shape rather than a hand-written echo of it.
	JSON any
}

type TenantScope struct {
	// contains filtered or unexported fields
}

type TenantScopeKind uint8

type TrustBundle struct {
	Name      string  `json:"name"`
	Origin    string  `json:"origin"`
	SPKIPin   string  `json:"spki_pin,omitempty"`
	TLSMode   TLSMode `json:"tls_mode,omitempty"`
	CLISocket string  `json:"cli_socket,omitempty"`
}

type TrustEntry struct {
	// Name is the local reference a pin file or context names. A repository
	// file may name a reference; it can never introduce an origin.
	Name string `json:"name"`
	// Origin is scheme+host+port, canonicalised. A credential is presented
	// only to this origin, and a redirect off it is never followed with one.
	Origin string `json:"origin"`
	// SPKIPin is base64(sha256(SubjectPublicKeyInfo)) of the certificate
	// identity seen at establishment. Empty for explicit system-ca trust or
	// a loopback HTTP origin carried over the same-user Unix socket below.
	SPKIPin string `json:"spki_pin,omitempty"`
	// TLSMode selects HTTPS verification. Omission preserves legacy SPKI trust.
	TLSMode TLSMode `json:"tls_mode,omitempty"`
	// CLISocket carries loopback HTTP without putting credentials on an
	// identity-free TCP listener. Its directory and socket are euid-owned 0700
	// and 0600, and both peers verify the other's kernel-reported UID.
	CLISocket string `json:"cli_socket,omitempty"`
}

type TrustStore struct {
	// contains filtered or unexported fields
}