plugin

type Catalog interface {
	All() []*Plugin
	ByName(name string) (*Plugin, bool)
}

type ErrUnknownKind struct {
	Got Kind
}

type ErrUnsupportedAPIVersion struct {
	Got  string
	Want string
}

type Kind string

type Manifest struct {
	APIVersion string `json:"apiVersion" yaml:"apiVersion"`
	Name       string `json:"name" yaml:"name"`
	Version    string `json:"version" yaml:"version"`
	Author     string `json:"author,omitempty" yaml:"author,omitempty"`
	Homepage   string `json:"homepage,omitempty" yaml:"homepage,omitempty"`
	License    string `json:"license,omitempty" yaml:"license,omitempty"`

	Kinds []Kind `json:"kinds" yaml:"kinds"`

	// RequiredScopes is the auth.Scope set the plugin must hold to
	// run. Plugins requesting ScopeAdmin must be re-confirmed at
	// install time — the daemon's installer prompts the operator
	// before granting wildcard scope to third-party code.
	RequiredScopes []string `json:"required_scopes,omitempty" yaml:"required_scopes,omitempty"`

	// DeclaredEgress is the per-plugin allow-list of upstream hosts
	// the plugin is permitted to dial. Empty list = no egress
	// permitted (the plugin must run fully against in-process state
	// the daemon hands it). Each entry is a host[:port] string;
	// wildcard subdomains via "*.example.com" are honored.
	DeclaredEgress []string `json:"declared_egress,omitempty" yaml:"declared_egress,omitempty"`

	// Entrypoint is the relative path to the plugin's executable
	// inside the plugin directory. The daemon execs it with the
	// hashicorp/go-plugin handshake; absence + a Rego-only plugin
	// means the daemon hot-loads the Rego packs from rego/*.rego
	// directly without spinning a subprocess.
	Entrypoint string `json:"entrypoint,omitempty" yaml:"entrypoint,omitempty"`

	// RegoPacks lists the relative paths under rego/ that contain
	// Rego policies the daemon should load. When set, the plugin
	// extends the v0.16 policy registry without a subprocess.
	RegoPacks []string `json:"rego_packs,omitempty" yaml:"rego_packs,omitempty"`

	// Description is operator-facing copy displayed in the catalog UI
	// + the CLI's `plugins list` command.
	Description string `json:"description,omitempty" yaml:"description,omitempty"`
}

type Plugin struct {
	Manifest Manifest

	// Path is the absolute filesystem path of the plugin directory
	// the manifest was loaded from. Useful for the catalog UI's
	// "open in finder" affordance.
	Path string

	// SignatureValid is true when the plugin's signature.sig
	// validated against either the keyless Sigstore trust root or a
	// pinned operator-supplied verifier key. False when the daemon
	// was launched with --allow-unsigned-plugins.
	SignatureValid bool

	// InstalledAt is the wall-clock time the daemon first observed
	// the plugin on disk.
	InstalledAt time.Time

	// Generation increments on every hot-reload of the plugin's Rego
	// packs. In-flight scans cache the generation they started with
	// so a mid-scan reload doesn't shuffle their policy set.
	Generation int
}