plugin

type Action struct {
	Method   string
	Action   string // read, write, execute, delete
	Resource string // e.g., "stack:web", "container:nginx"
}

type AuditEntry struct {
	Timestamp      time.Time
	AgentID        string
	Identity       *Identity
	Action         string
	Resource       string
	Result         string
	Duration       time.Duration
	Metadata       map[string]string
	TranscriptHash string // For terminal sessions
}

type AuditFilter struct {
	AgentID   string
	UserID    string
	Action    string
	StartTime *time.Time
	EndTime   *time.Time
	Limit     int
}

type AuditPlugin interface {
	Plugin

	// Log writes an audit entry (must not fail)
	Log(ctx context.Context, entry *AuditEntry)

	// Query retrieves audit logs
	Query(ctx context.Context, filter *AuditFilter) ([]AuditEntry, error)
}

type AuthPlugin interface {
	Plugin

	// Authenticate validates credentials and returns identity
	Authenticate(ctx context.Context, req *AuthRequest) (*Identity, error)

	// Authorize checks if identity can perform action
	Authorize(ctx context.Context, identity *Identity, action *Action) error
}

type AuthRequest struct {
	Identity *Identity
	Method   string
	Token    string
}

type Capability string

type Identity struct {
	UserID      string
	DeviceID    string
	Roles       []string
	Attributes  map[string]string
	Certificate []byte
}

type Plugin interface {
	// Name returns unique plugin identifier
	Name() string

	// Version returns semantic version
	Version() string

	// Init is called once during plugin load
	Init(ctx context.Context, config map[string]interface{}) error

	// Shutdown gracefully stops the plugin
	Shutdown(ctx context.Context) error

	// Capabilities returns what this plugin provides
	Capabilities() []Capability
}

type PolicyDecision struct {
	Allowed     bool
	Reason      string
	Obligations []string // Additional requirements
}

type PolicyPlugin interface {
	Plugin

	// Evaluate checks if action is permitted
	Evaluate(ctx context.Context, req *PolicyRequest) (*PolicyDecision, error)
}

type PolicyRequest struct {
	Identity *Identity
	Action   *Action
	Resource *Resource
	Context  map[string]interface{}
}

type Registry struct {
	// contains filtered or unexported fields
}

type Resource struct {
	Type       string // stack, container, image, file
	Identifier string
	Labels     map[string]string
}

type SecretsPlugin interface {
	Plugin

	// Get retrieves a secret by key
	Get(ctx context.Context, key string) ([]byte, error)

	// Set stores a secret
	Set(ctx context.Context, key string, value []byte) error

	// Delete removes a secret
	Delete(ctx context.Context, key string) error

	// InjectEnv injects secrets into environment map
	InjectEnv(ctx context.Context, env map[string]string) error
}