pluginkit

type ActionFunc func(in *wire.ActionRunInput) (*wire.ActionRunOutput, error)

type Asset struct {
	// Ref reads it: OpenInput(Ref) / ReadInput(Ref). No `files:read` needed.
	Ref  string `json:"ref"`
	Size int64  `json:"size"`
	// Cached is true when no network was used (it was already downloaded).
	Cached bool `json:"cached"`
}

type EngineRequest struct {
	Engine   string            `json:"engine"`
	Args     []string          `json:"args"`
	Inputs   map[string]string `json:"inputs,omitempty"`
	Outputs  []string          `json:"outputs,omitempty"`
	TimeoutS int               `json:"timeout_s,omitempty"`
}

type EngineResult struct {
	Exit       int              `json:"exit"`
	StdoutTail string           `json:"stdout_tail"`
	StderrTail string           `json:"stderr_tail"`
	Outputs    []wire.OutputRef `json:"outputs"`
	DurationMS int64            `json:"duration_ms"`
}

type HTTPRequest struct {
	Method   string            `json:"method,omitempty"`
	URL      string            `json:"url"`
	Headers  map[string]string `json:"headers,omitempty"`
	Body     []byte            `json:"-"`
	BodyB64  string            `json:"body_b64,omitempty"`
	TimeoutS int               `json:"timeout_s,omitempty"`
}

type HTTPResponse struct {
	Status  int               `json:"status"`
	Headers map[string]string `json:"headers"`
	BodyB64 string            `json:"body_b64"`
	Body    []byte            `json:"-"`
}

type HostError struct {
	Code    string
	Message string
}

type HostSigner struct {
	KeyRef string
	Cert   *x509.Certificate
	// contains filtered or unexported fields
}

type Input struct {
	// contains filtered or unexported fields
}

type IssuedCert struct {
	KeyRef   string `json:"key_ref"`
	CertPEM  string `json:"cert_pem"`
	ChainPEM string `json:"chain_pem"`
	NotAfter string `json:"not_after"`
}

type Notice struct {
	Title    wire.Text      `json:"title"`
	Body     wire.Text      `json:"body,omitempty"`
	Severity string         `json:"severity,omitempty"`
	Meta     map[string]any `json:"meta,omitempty"`
	// ToUserID addresses one person (their bell, push and — if they turned
	// it on — mail). 0 posts to the instance feed as before.
	ToUserID int64 `json:"to_user_id,omitempty"`
	// Target makes the notification clickable: a click opens the file and,
	// when Action or View is set, that screen of this plugin on it.
	Target *NoticeTarget `json:"target,omitempty"`
}

type NoticeTarget struct {
	Ref     string `json:"ref,omitempty"`
	Path    string `json:"path,omitempty"`
	Action  string `json:"action,omitempty"`
	View    string `json:"view,omitempty"`
	Section string `json:"section,omitempty"`
}

type Output struct {
	// contains filtered or unexported fields
}

type PageCreate struct {
	// PageID names the manifest page this link renders. EMPTY opens an
	// ordinary download share of the document instead — no surface, no
	// copies, the kind an administrator already revokes in Shares.
	PageID string `json:"page_id"`
	// Ref / Path name the document the link is about; empty means the call's
	// first input. ⚠ The host has read these since v3 and both documents
	// promise them, but this struct did not carry them — so a plugin could
	// not name any file but the first input, which is exactly what a
	// page-less link's refusal message asks it to do.
	Ref       string           `json:"ref,omitempty"`
	Path      string           `json:"path,omitempty"`
	Subject   string           `json:"subject,omitempty"`
	PIN       string           `json:"pin,omitempty"`
	TTLDays   int              `json:"ttl_days,omitempty"`
	MaxVisits int              `json:"max_visits,omitempty"`
	State     any              `json:"state,omitempty"`
	Files     []wire.OutputRef `json:"files,omitempty"`
	// Purpose says what THIS link is, in a list of links (My shares, the
	// admin's Shares) — the same shape a manifest page declares, and it wins
	// over the page's own. ⚠ A page-less link (no PageID: a plain share of a
	// file, e.g. a finished document handed to everybody) has no page to
	// declare one, so this is the only way it can say "Signed copy" instead
	// of reading as a share somebody made by hand.
	Purpose *wire.PagePurpose `json:"purpose,omitempty"`
}

type PageCreated struct {
	Token     string `json:"token"`
	URL       string `json:"url"`
	PIN       string `json:"pin,omitempty"`
	ExpiresAt string `json:"expires_at"`
}

type PageFunc func(in *wire.ViewEventInput) (*wire.Surface, error)

type Plugin struct {
	// Manifest is echoed by describe. It must equal the filex-app.json the
	// administrator installed (name, version, permissions); filex refuses the
	// plugin otherwise.
	Manifest wire.Manifest
	Actions  map[string]ActionFunc
	Views    map[string]ViewFunc
	Pages    map[string]PageFunc
	// Tick is the hourly wake-up. It is called only when the manifest asks
	// for the `schedule` permission AND the administrator granted it; an
	// app that leaves this nil but asks for the permission answers every
	// wake-up with an error, which lands in its log in the admin panel.
	Tick TickFunc
	// UI answers the app's own interface, by method name (`engine.call`).
	// An interface-only app has no module at all; an app with both registers
	// here what its interface may ask the module.
	UI map[string]UICallFunc
	// Thumbnail draws thumbnails of the kinds the manifest's `thumbnails`
	// block names. filex refuses to install a manifest with that block whose
	// module leaves this nil (the export answers an error then).
	Thumbnail ThumbnailFunc
}

type ShareFacts struct {
	Page    string `json:"page"`
	Subject string `json:"subject"`
	Visits  int    `json:"visits"`
	// ExpiresAt is when the link stops (nil: never). Revoking a link sets it
	// to the moment of the revoke, so a link that ends EARLIER than the day
	// the app was handed at share_create was ended by somebody.
	ExpiresAt *time.Time `json:"expires_at"`
	// Revoked says the link no longer opens: it ran out, reached its visit
	// ceiling, or somebody revoked it. ExpiresAt tells the three apart from
	// what the app recorded when it opened the link.
	Revoked bool `json:"revoked"`
	// HasPIN: the link is PIN-protected at all.
	HasPIN bool `json:"has_pin"`
	// PinRecoverable: the PIN can still be SHOWN to the person who made the
	// link (SharePIN). False on a link minted before the instance kept a
	// recoverable copy, on an instance with no secret key, and on one whose
	// key has been rotated away — the link still works, its PIN is simply
	// gone. ⚠ Offer "show the PIN" only when this is true; otherwise say so
	// and offer what does work, which is a new link.
	PinRecoverable bool `json:"pin_recoverable"`
}

type SignInfo struct {
	Available bool   `json:"available"`
	Reason    string `json:"reason,omitempty"`
	CACertPEM string `json:"ca_cert_pem,omitempty"`
	// CACertsPEM is every authority this tenant has signed with, retired
	// ones included, as one PEM bundle. Build a verifier's root pool from
	// THIS, not from CACertPEM: trusting only the live authority calls
	// every signature made before the last rotation untrusted.
	CACertsPEM string `json:"ca_certs_pem,omitempty"`
	Algorithm  string `json:"algorithm,omitempty"`
}

type StateItem struct {
	// Path is adapter-qualified (`docs://reports/nda.pdf`) — what a menu
	// action or a view takes.
	Path  string `json:"path"`
	Name  string `json:"name"`
	Key   string `json:"key"`
	Value string `json:"value"`
}

type ThumbnailFunc func(in *wire.ThumbnailInput) (*wire.ThumbnailOutput, error)

type TickFunc func(in *wire.TickInput) (*wire.TickOutput, error)

type UICallFunc func(in *wire.UICallInput) (any, error)

type UIError struct{ Text wire.Text }

type User struct {
	ID    int64  `json:"user_id"`
	Email string `json:"email"`
	Name  string `json:"name,omitempty"`
}

type ViewFunc func(in *wire.ViewEventInput) (*wire.Surface, error)