sshclient

type ApplyOutcome struct {
	Changed       bool
	Created       bool
	BeforeSHA256  string
	AfterSHA256   string
	BackupPath    string
	Mode          string
	PayloadSHA256 string
	ExpectSHA256  string
	// PreconditionSHA256 is the latest guard observation; BeforeSHA256 remains
	// the original snapshot used to verify the backup.
	PreconditionSHA256 string
	PreconditionStatus string
	ChangeState        string
	// Executed describes target publication, not preparatory backup writes.
	// Nil means publication may have occurred without acknowledgement.
	Executed       *bool
	Verified       bool
	Verification   string
	BackupVerified bool
	UID, GID       *uint32
	CleanupPending []string
	ReplaceMethod  string
}

type ApplyRequest struct {
	RemotePath     string
	Payload        []byte
	ExpectSHA256   string
	Backup         bool
	BackupDir      string
	StageDir       string
	Force          bool
	UseSudo        bool
	SudoConfigured bool
}

type AuthMethod string

type BoundaryError struct {
	Kind string
	Op   string
	Err  error
}

type CacheDialer struct {
	Cache   *JumpCache
	Context context.Context
}

type CommandBlockedError struct {
	Command string
	Reason  string
}

type Config struct {
	// Context owns the complete transport lifetime. Nil means Background.
	Context          context.Context
	HostTimeout      time.Duration
	GlobalTimeout    time.Duration
	ExpectPlan       string
	PlanHash         string
	ExecutionID      string
	Risk             string
	MaxFailures      int
	AuditExecutionID string
	// KnownHostsData, when nonnil, is the admitted immutable trust snapshot.
	KnownHostsData         []byte
	ExpectedKeyFingerprint string
	// PreparedPayload distinguishes an admitted empty payload from legacy I/O.
	PreparedPayload     []byte
	TransferSource      *Config
	TransferDestination *Config
	Host                string
	Port                string
	User                string
	Password            string
	SudoPassword        string
	KeyPath             string
	UseKeyAuth          bool
	SudoKey             string
	SudoKeyConfigured   bool
	// SudoKeySet is true when -pk/--password-key/--sudo-password-key was
	// present on the command line, including an explicit empty value.
	// Host inventory must persist the key only when this is set; the
	// runtime default "master" is an execution fallback, not inventory.
	SudoKeySet  bool
	Command     string
	Mode        string
	DialTimeout time.Duration
	// Timeout bounds the execution of a single remote command. Zero means no
	// command timeout (the dial timeout still applies).
	Timeout time.Duration
	// JSONOutput emits a single structured JSON result instead of streaming
	// human-readable output. It implies clean, separated stdout/stderr capture.
	JSONOutput bool
	// UsePTY requests a pseudo-terminal for command execution. It is off by
	// default because a PTY merges stderr into stdout and injects terminal
	// control characters; it is ignored in JSON/capture mode.
	UsePTY bool
	// DryRun emits a local execution plan without connecting, executing, reading
	// keyring secrets, or mutating local/remote state.
	DryRun bool
	// AuditEnabled controls whether sshx writes a local structured audit event.
	AuditEnabled bool
	// AuditOutput overrides the directory where audit JSONL files are written.
	AuditOutput string

	SafetyCheck bool
	Force       bool
	// AcceptUnknownHost controls whether sshx will automatically add
	// previously unseen host keys to the user's known_hosts file.
	AcceptUnknownHost bool
	// AllowInsecureHostKey controls whether sshx may fall back to
	// ssh.InsecureIgnoreHostKey (legacy behavior). Disabled by default.
	AllowInsecureHostKey bool
	// KnownHostsPath allows overriding the path to the known_hosts file.
	KnownHostsPath string

	SftpAction string
	LocalPath  string
	RemotePath string

	// Server-to-server transfer fields (Mode == "transfer").
	TransferSrcHost string
	TransferSrcPath string
	TransferDstHost string
	TransferDstPath string

	PasswordAction string
	PasswordKey    string
	PasswordValue  string

	// Host management fields
	HostAction      string
	HostName        string
	HostDescription string
	HostType        string
	// HostImportNames is a comma-separated list of ssh_config aliases to
	// import non-interactively (HostAction == "import"). Empty means
	// interactive selection.
	HostImportNames string
	// SSHConfigPath overrides the OpenSSH client config file read by
	// --host-import (default ~/.ssh/config).
	SSHConfigPath string

	// Plugin lifecycle fields (Mode == "plugin").
	PluginAction    string
	PluginID        string
	PluginRunner    string
	PluginPlatform  string
	PluginPrivilege string
	PluginTemplate  string
	PluginFixture   string
	// PluginSource is the install positional: the local plugin directory that
	// `sshx plugin install` publishes into the runtime plugin root.
	PluginSource string
	// PluginTrust trusts the installed digest in the same install step.
	PluginTrust   bool
	PluginReplace bool

	// Agent skill lifecycle fields (Mode == "skill").
	SkillAction string
	SkillDir    string

	// Inspection fields (Mode == "inspect").
	InspectCapability  string
	InspectCacheMode   string
	InspectRefresh     bool
	InspectMaxAge      time.Duration
	InspectAllowStale  bool
	InspectUseSudo     bool
	HostKeyFingerprint string
	ArgumentError      string
	ReportedErrorKind  string
	ReportedError      string

	// Run-mode execution contract fields (Mode == "run").
	RequestID      string
	RunTargets     []string
	RunGroups      []string
	RunTags        map[string]string
	RunAllHosts    bool
	RunAddress     string
	RunActionKind  string
	RunIntent      string
	RunUseSudo     bool
	RunConcurrency int
	FailureMode    string
	BypassReason   string
	ScriptFile     string
	ScriptStdin    bool
	// ScriptShell overrides the interpreter used for --script-file /
	// --script-stdin payloads. Empty means: follow the payload's shebang, or
	// fall back to sh.
	ScriptShell     string
	JSONLOutput     bool
	MaxOutputBytes  int
	MaxPayloadBytes int
	SSHPasswordKey  string

	// Guarded SQL execution fields (Mode == "sql").
	SQLStatement string
	// SQLStatementFile is a local file holding the statement, used when no
	// positional statement is given (--statement-file=PATH).
	SQLStatementFile string
	// SQLEngine names the database engine: "postgres" (default) or "sqlite".
	SQLEngine   string
	SQLDatabase string
	// SQLFile is the --db-file path for --engine=sqlite. Copied into
	// SQLDatabase after validation so JSON/audit keep a single identity field.
	SQLFile string
	// SQLUser is the database role (-U), distinct from the SSH user.
	SQLUser string
	// SQLHost/SQLPort locate the database as seen from the remote host.
	// SQLHost defaults to the local socket, or 127.0.0.1 when a password key
	// is used (password auth implies TCP).
	SQLHost string
	SQLPort string
	// SQLPasswordKey names the keyring entry holding the database password.
	// The secret is delivered on the remote command's stdin, never in argv.
	SQLPasswordKey string
	// SQLRowThreshold switches from a row-level CSV snapshot to a full table
	// dump when the EXPLAIN row estimate exceeds it (0 = package default).
	SQLRowThreshold int64
	// SQLAllowFullTable permits UPDATE/DELETE without a top-level WHERE.
	SQLAllowFullTable bool
	// SQLAllowFullTableBackup permits whole-table before-images for a
	// row-filtered mutation when sshx cannot safely reproduce the selected rows.
	SQLAllowFullTableBackup bool
	// SQLNoBackup skips pre-change backups; requires Force.
	SQLNoBackup bool
	// SQLExplainOnly stops after the remote EXPLAIN gate.
	SQLExplainOnly bool
	// SQLBackupDir overrides the remote backup directory.
	SQLBackupDir string
	// SQLDockerContainer runs psql inside this container via
	// `docker exec -i` for databases deployed with Docker.
	SQLDockerContainer string
	// SQLCredFrom resolves database credentials on the remote host instead of
	// the local keyring: "docker:<container>" or "env-file:<path>".
	SQLCredFrom string
	// SQLCredCacheTTL keeps remotely resolved credentials reusable in the OS
	// keyring for this duration (0 = caching disabled).
	SQLCredCacheTTL time.Duration
	// SQLCredRefresh forces re-resolution, replacing any cached entry.
	SQLCredRefresh bool
	// SQLUseSudo runs the remote database client via sudo -S. Use it when the
	// SSH user cannot read or write the database file (typical for service-
	// owned SQLite). The sudo password is delivered on stdin ahead of SQL.
	SQLUseSudo bool

	// Audit query/export fields (Mode == "audit").
	AuditAction     string
	AuditSince      string
	AuditUntil      string
	AuditFilterHost string
	AuditFilterAct  string
	AuditRunID      string
	AuditErrorKind  string
	AuditBypassOnly bool
	AuditExportPath string

	// Guarded file apply fields (Mode == "apply").
	ApplyExpectSHA256 string
	ApplyNoBackup     bool
	ApplyStageDir     string
	ApplyBackupDir    string
	ApplyUseSudo      bool

	// Text dissection fields (Mode == "text").
	TextJournal      string
	TextSince        string
	TextUntil        string
	TextPresets      []string
	TextPattern      string
	TextContext      int
	TextAroundLine   int
	TextOffset       int
	TextLimit        int
	TextTail         int
	TextScan         string
	TextMaxHits      int
	TextMaxBytes     int
	TextMaxScanBytes int64
	TextUseSudo      bool
	TextRedact       bool

	// HelpVerb is the subcommand whose usage document was requested with
	// `sshx <verb> --help`. It short-circuits parsing and execution: the verb's
	// own usage is printed instead of running anything.
	HelpVerb string

	// ShowUsage requests the global `sshx --help` surface. It is answered before
	// any mode runs, so a usage request never resolves a host, connects, or
	// writes trust state.
	ShowUsage bool

	// Quiet suppresses human notices on stderr (deprecation warnings, narration
	// log lines). It never changes stdout, the exit code, or the machine result,
	// so a caller that merges stderr under --json can still parse stdout.
	Quiet bool

	// Interactive login fields (Mode == "login").
	LoginUseSudo     bool
	LoginLiteralHost bool

	// RouterOS execution fields (Mode == "ros").
	ROSAction          string
	ROSTokens          []string
	ROSAllowWrite      bool
	ROSRouterOSVersion string
	ROSRaw             bool
	ROSSource          string
	ROSCleanup         bool
	ROSCompact         bool
	ROSBackupName      string
	ROSIncludeRemote   bool

	// Bind is a local source address: a literal IP or a network interface name.
	// BindSet distinguishes "flag not provided" from an explicit empty --bind=
	// that must clear a named host's persisted bind.
	Bind    string
	BindSet bool
	// Via is the named next hop. ViaSet distinguishes omit from --via=.
	Via    string
	ViaSet bool
	// HostAlias is the named-host identity used in hop audit/plan records.
	HostAlias string
	// JumpChain is the bastion path, outermost first. Each hop has no nested chain.
	JumpChain []*Config
}

type ExecResult struct {
	ExitCode        int
	Stdout          string
	Stderr          string
	StdoutTruncated bool
	StderrTruncated bool
	Started         bool
	ExitObserved    bool
	// StartAttempted without Started means the exec request may have reached
	// the peer but no positive acknowledgement was observed.
	StartAttempted bool
}

type FileOutcome struct {
	SourcePath         string  `json:"source_path,omitempty"`
	Path               string  `json:"path"`
	Type               string  `json:"type"`
	Size               int64   `json:"size"`
	Mode               string  `json:"mode,omitempty"`
	UID                *uint32 `json:"uid,omitempty"`
	GID                *uint32 `json:"gid,omitempty"`
	BytesTransferred   int64   `json:"bytes_transferred"`
	SHA256             string  `json:"sha256,omitempty"`
	SourceSHA256       string  `json:"source_sha256,omitempty"`
	Started            bool    `json:"started"`
	Published          bool    `json:"published"`
	Publication        string  `json:"publication,omitempty"`
	ChangeState        string  `json:"change_state"`
	Verified           bool    `json:"verified"`
	Verification       string  `json:"verification"`
	VerificationMethod string  `json:"verification_method,omitempty"`
	ModifiedAt         string  `json:"modified_at,omitempty"`
	StagingPath        string  `json:"staging_path,omitempty"`
	CleanupError       string  `json:"cleanup_error,omitempty"`
	// contains filtered or unexported fields
}

type HopError struct {
	Role  string
	Alias string
	Err   error
}

type HopIdentity struct {
	Role               string
	Alias              string
	Address            string
	Port               string
	User               string
	PeerAddress        string
	HostKeyFingerprint string
	AuthMethod         string
	Closed             bool
	CloseError         string
}

type JumpCache struct {
	// contains filtered or unexported fields
}

type RemoteTextMeta struct {
	Size        int64
	StartByte   int64
	SkipPartial bool
}

type SFTPOutcome struct {
	Action          string `json:"action"`
	SourcePath      string `json:"source_path,omitempty"`
	DestinationPath string `json:"destination_path,omitempty"`
	Started         bool   `json:"started"`
	Phase           string `json:"phase"`
	Completion      string `json:"completion"`
	// Executed describes acknowledged destination effects (or listing reads),
	// not preparatory staging writes. Nil means an effect is unconfirmed.
	Executed           *bool         `json:"executed"`
	ChangeState        string        `json:"change_state"`
	Verified           bool          `json:"verified"`
	Verification       string        `json:"verification"`
	VerificationMethod string        `json:"verification_method"`
	BytesTransferred   int64         `json:"bytes_transferred"`
	Partial            bool          `json:"partial"`
	DirectoryAtomic    bool          `json:"directory_atomic"`
	Entries            []FileOutcome `json:"entries"`
	// contains filtered or unexported fields
}

type SSHClient struct {
	// contains filtered or unexported fields
}