plugins

type DockerBackend interface {
	// Client returns the moby client for the target daemon. The transport
	// does not close it — Close (below) owns that.
	Client() *client.Client
	// ShimHostPath returns the path, on the daemon host, of the
	// honey-plugin-init binary to bind-mount as the container entrypoint.
	// Remote backends stage the binary onto the host here (idempotently).
	ShimHostPath(ctx context.Context) (string, error)
	// DialShim dials the shim's published loopback address on the daemon
	// host. Local dials directly; remote tunnels through SSH. The signature
	// matches http.Transport.DialContext so it can be wired straight in.
	DialShim(ctx context.Context, network, address string) (net.Conn, error)
	// Close releases backend-owned resources (the moby client, etc.). It
	// must not close a borrowed/shared SSH connection it does not own.
	Close() error
}

type DockerHostSession struct {
	// contains filtered or unexported fields
}

type DockerRestartConfig struct {
	MaxBackoff string `yaml:"max_backoff,omitempty"` // duration string, default "30s"
}

type DockerRuntime struct {
	Image      string              `yaml:"image"`
	PullPolicy string              `yaml:"pull_policy,omitempty"` // "if_not_present" (default) or "always"
	Restart    DockerRestartConfig `yaml:"restart,omitempty"`
	// Volumes are static bind mounts, Docker syntax ("host_path:container_path[:ro|rw]"),
	// same format container.HostConfig.Binds already takes. For plugins that need file
	// I/O (e.g. ffmpeg reading/writing files) under one predictable host root — not
	// per-call dynamic mounts.
	Volumes []string `yaml:"volumes,omitempty"`
	// Init selects who provides honey-plugin-init: "" or "bind" (default) —
	// honey bind-mounts the host binary and overrides the entrypoint; "embedded"
	// — the image already contains honey-plugin-init as its entrypoint, so no
	// host binary is needed (required for images distributed from a registry).
	Init string `yaml:"init,omitempty"`
	// InitPath is the in-image path of honey-plugin-init when Init=="embedded".
	// Defaults to defaultEmbeddedInitPath at load. Ignored in bind mode.
	InitPath string `yaml:"init_path,omitempty"`
	// Network selects the container network mode: "" (default, bridge — honey
	// publishes the shim port to a loopback host port) or "host" (container
	// shares the daemon host's network namespace to reach the host's loopback
	// directly). "host" is operator-gated by plugins.allow_host_network.
	Network string `yaml:"network,omitempty"`
}

type HostRunContext struct {
	SSHUser              string
	Record               hosts.Record
	RecipeDir            string
	Execute              bool
	SecretsDry           bool
	RunAs                string
	Env                  map[string]string
	Bridge               RemoteBridge
	Postgres             PostgresBridge
	TunnelCoord          TunnelCoordinator
	AllowedPaths         map[string]string
	RecipeSecrets        map[string]string
	ResolveSecret        SecretResolveFunc
	PluginID             string
	MaxPostgresTimeoutMS int
}

type Info struct {
	ID                   string            `json:"id"`
	Version              string            `json:"version"`
	Capabilities         []string          `json:"capabilities"`
	Path                 string            `json:"path"`
	SecretRefPrefixes    []string          `json:"secret_ref_prefixes,omitempty"`
	AllowHostExec        bool              `json:"allow_host_exec,omitempty"`
	AllowRemoteExec      bool              `json:"allow_remote_exec,omitempty"`
	AllowSFTP            bool              `json:"allow_sftp,omitempty"`
	AllowTemplateRender  bool              `json:"allow_template_render,omitempty"`
	AllowPostgres        bool              `json:"allow_postgres,omitempty"`
	AllowKV              bool              `json:"allow_kv,omitempty"`
	AllowedHosts         []string          `json:"allowed_hosts,omitempty"`
	AllowedPaths         map[string]string `json:"allowed_paths,omitempty"`
	AllowedEnv           []string          `json:"allowed_env,omitempty"`
	MaxHTTPResponseBytes int64             `json:"max_http_response_bytes,omitempty"`
}

type Manager struct {
	// contains filtered or unexported fields
}

type Manifest struct {
	ID                   string            `yaml:"id"`
	Version              string            `yaml:"version"`
	Capabilities         []string          `yaml:"capabilities"`
	SecretRefPrefixes    []string          `yaml:"secret_ref_prefixes,omitempty"`
	AllowK8sHTTP         bool              `yaml:"allow_k8s_http,omitempty"`
	AllowHostExec        bool              `yaml:"allow_host_exec,omitempty"`
	AllowRemoteExec      bool              `yaml:"allow_remote_exec,omitempty"`
	AllowSFTP            bool              `yaml:"allow_sftp,omitempty"`
	AllowTemplateRender  bool              `yaml:"allow_template_render,omitempty"`
	AllowPostgres        bool              `yaml:"allow_postgres,omitempty"`
	AllowKV              bool              `yaml:"allow_kv,omitempty"`
	AllowedEnv           []string          `yaml:"allowed_env,omitempty"`
	AllowedHosts         []string          `yaml:"allowed_hosts,omitempty"`
	AllowedPaths         map[string]string `yaml:"allowed_paths,omitempty"`
	Config               map[string]string `yaml:"config,omitempty"`
	MaxHTTPResponseBytes int64             `yaml:"max_http_response_bytes,omitempty"`
	Order                int               `yaml:"order,omitempty"`
	Runtime              string            `yaml:"runtime,omitempty"` // "wasm" (default) or "docker"
	Docker               *DockerRuntime    `yaml:"docker,omitempty"`
}

type PostgresBridge interface {
	Query(ctx context.Context, in apiv1.PostgresSQLInput) apiv1.PostgresOutput
	Exec(ctx context.Context, in apiv1.PostgresSQLInput) apiv1.PostgresOutput
	Migrate(ctx context.Context, in apiv1.PostgresMigrateInput) apiv1.PostgresOutput
}

type RemoteBridge interface {
	RemoteExec(ctx context.Context, in apiv1.RemoteExecInput) apiv1.RemoteExecOutput
	RemoteUpload(ctx context.Context, in apiv1.RemoteUploadInput) apiv1.RemoteUploadOutput
	RemoteDownload(ctx context.Context, in apiv1.RemoteDownloadInput) apiv1.RemoteDownloadOutput
	RemoteStat(ctx context.Context, in apiv1.RemoteStatInput) apiv1.RemoteStatOutput
	TemplateRender(ctx context.Context, in apiv1.TemplateRenderInput) apiv1.TemplateRenderOutput
}

type SecretBackend struct {
	// contains filtered or unexported fields
}

type SecretResolveFunc func(ctx context.Context, ref string) (string, error)

type TunnelCoordinator interface {
	LookupEndpoint(stepID, sshUser string, record hosts.Record) (host string, port int, ok bool)
}