@termix-ssh/plugin-sdk 1.0.0

package/dist/host/types/src/types/ui-types.d.ts

@@ -0,0 +1,260 @@
+import type { HostProtocolAuthSummary, HostSshOptions, HostTerminalConfig, SSHAuthType } from "./index.js";
+import type { HostAuthOverrides } from "./auth-protocols.js";
+import type { DefaultOverrides } from "./host-defaults.js";
+import type { QuickConnectLogin } from "@termix-ssh/plugin-sdk/frontend";
+export type Host = {
+    id: string;
+    name: string;
+    username: string;
+    ip: string;
+    port: number;
+    folder: string;
+    /** Sub-host nesting: the id of the host this one is organized under, if any. */
+    parentHostId?: string | null;
+    /**
+     * Sub-hosts nested under this host, populated client-side by buildHostTree.
+     * A host with children still renders and behaves as a normal, connectable
+     * HostItem row -- this only adds an expand/collapse chevron for its nested
+     * children, it never wraps the host in a synthetic folder node.
+     */
+    childHosts?: Host[];
+    online: boolean;
+    status?: "online" | "offline" | "unknown";
+    cpu: number | null;
+    ram: number | null;
+    lastAccess: string;
+    tags?: string[];
+    authType: SSHAuthType;
+    shareSshAuth?: boolean;
+    credentialId?: string;
+    overrideCredentialUsername?: boolean;
+    password?: string;
+    hasPassword?: boolean;
+    sudoPassword?: string;
+    hasSudoPassword?: boolean;
+    hasKey?: boolean;
+    hasKeyPassword?: boolean;
+    key?: string;
+    keyPassword?: string;
+    keyType?: string;
+    notes?: string;
+    pin?: boolean;
+    /** Quick connect only: core can save this host as-is. */
+    quickConnectSavable?: boolean;
+    /** A Quick Connect host's plugin protocol login, never saved. */
+    quickConnectLogin?: QuickConnectLogin;
+    sortOrder?: number | null;
+    /** Stable identity across a desktop/server sync pair. */
+    syncId?: string | null;
+    terminalConfig?: HostTerminalConfig;
+    sshOptions?: HostSshOptions;
+    useSocks5?: boolean;
+    socks5Host?: string;
+    socks5Port?: number;
+    connectionOrigin?: "local" | "remote" | null;
+    socks5Username?: string;
+    socks5Password?: string;
+    socks5ProxyChain?: {
+        host: string;
+        port: number;
+        type: 4 | 5 | "http" | "socks4" | "socks5";
+        username?: string;
+        password?: string;
+    }[];
+    /** hostid is a legacy lowercase spelling still present in stored rows. */
+    jumpHosts?: {
+        hostId: string;
+        hostid?: string;
+    }[];
+    portKnockSequence?: {
+        port: number;
+        protocol: "tcp" | "udp";
+        delay: number;
+    }[];
+    statusCheckEnabled?: boolean;
+    /** Seconds between status checks; null follows the global setting. */
+    statusCheckInterval?: number | null;
+    enableSsh: boolean;
+    sshPort: number;
+    /** Each plugin protocol's login, secrets left out. */
+    protocolAuth?: Record<string, HostProtocolAuthSummary>;
+    /** Host-scope plugin settings, keyed by plugin id. Secrets are redacted. */
+    pluginSettings?: Record<string, Record<string, unknown>>;
+    /** Host default keys this host sets itself, per namespace. */
+    defaultOverrides?: DefaultOverrides | null;
+    forceKeyboardInteractive?: boolean;
+    isShared?: boolean;
+    authOverrides?: HostAuthOverrides<string>;
+    permissionLevel?: SharePermissionLevel;
+    sharedExpiresAt?: string;
+    ownerUsername?: string;
+    /**
+     * A read-only copy of a host shared with the account this desktop is
+     * linked to. It arrives through sync and is managed on the server.
+     */
+    sharedCopy?: boolean;
+    /** Desktop only: kept on this device, never synced to the server. */
+    localOnly?: boolean;
+};
+export type SharePermissionLevel = "connect" | "view" | "edit" | "manage";
+export type Credential = {
+    id: string;
+    name: string;
+    username: string;
+    type: "password" | "key";
+    value?: string;
+    password?: string;
+    publicKey?: string;
+    passphrase?: string;
+    description?: string;
+    folder?: string;
+    tags?: string[];
+    pin?: boolean;
+    sortOrder?: number | null;
+    certPublicKey?: string;
+    /** Set when someone else owns this credential and shared it with you. */
+    isShared?: boolean;
+    ownerUsername?: string | null;
+    permissionLevel?: "use" | "manage";
+};
+export type HostFolder = {
+    name: string;
+    children: (Host | HostFolder)[];
+    path?: string;
+    color?: string;
+    icon?: string;
+    credentialId?: number | null;
+    sortOrder?: number | null;
+    localOnly?: boolean;
+};
+/** Core's own tab types. Plugins register theirs at runtime. */
+type KnownTabType = "dashboard" | "host-manager" | "settings" | "user-profile" | "admin-settings" | "split-screen";
+/**
+ * TabType covers every built-in tab plus any plugin-contributed tab id.
+ * `string & {}` (rather than plain `string`) keeps IDE autocomplete
+ * suggesting the known members while still accepting an arbitrary id, since
+ * a bare `string` would widen every literal and kill autocomplete entirely.
+ * Plugin tab ids are resolved at render time via the tab-component registry
+ * in tabUtils.tsx, not through this type.
+ */
+export type TabType = KnownTabType | (string & {});
+export type Tab = {
+    id: string;
+    instanceId: string;
+    type: TabType;
+    label: string;
+    customLabel?: string;
+    host?: Host;
+    openedAt: number;
+    restoredSessionId?: string | null;
+    /** Payload owned by the tab's plugin, e.g. which fleet or endpoint it shows. */
+    data?: Record<string, unknown>;
+    /** Present only on a split-screen container tab. Pane tab ids reference live child tabs. */
+    split?: SplitState;
+    /** Hides this session from the top-level tab bar while it belongs to a split tab. */
+    parentSplitTabId?: string;
+    terminalRef?: import("react").RefObject<{
+        disconnect?: () => void;
+        isConnected?: () => boolean;
+        sendInput?: (data: string) => void;
+        subscribeOutput?: (listener: (data: string) => void) => () => void;
+        paste?: (text: string) => void;
+        reconnect?: () => void;
+        /** Start a manual reconnect only when disconnected and idle; return whether it started. */
+        reconnectIfDisconnected?: () => boolean;
+        fit?: () => void;
+        notifyResize?: () => void;
+        refresh?: () => void;
+        getApplicationCursorKeysMode?: () => boolean;
+        focus?: () => void;
+        /** Asked before the tab closes; resolve false to keep it open. */
+        confirmClose?: () => boolean | Promise<boolean>;
+    } | null>;
+};
+/** Core cards are named here; plugin cards add their own ids. */
+export type DashboardCardId = "stats_bar" | "counters_bar" | "quick_actions" | "host_status" | "recent_activity" | (string & {});
+export type DashboardCardConfig = {
+    id: DashboardCardId;
+    label: string;
+    description: string;
+    defaultEnabled: boolean;
+};
+export type AdminSection = "general" | "users" | "sessions" | "roles" | "host-defaults" | "branding" | "database" | "api-keys" | "audit-log" | "ssl";
+export type ThemeId = "dark" | "light" | "system" | "dracula" | "catppuccin" | "nord" | "solarized" | "tokyo-night" | "one-dark" | "gruvbox";
+export type FontSizeId = "xs" | "sm" | "md" | "lg" | "xl";
+export type UiFontId = "jetbrains-mono" | "system-sans" | "fira-code" | "source-code-pro" | "caskaydia-cove";
+/** A tools panel view: a rail panel a plugin registered. */
+export type ToolsTab = string & {};
+/** "row" lays children side by side, "column" stacks them. */
+export type SplitDirection = "row" | "column";
+export interface PaneNode {
+    kind: "pane";
+    id: string;
+    tabId: string | null;
+}
+export interface SplitNode {
+    kind: "split";
+    id: string;
+    direction: SplitDirection;
+    children: LayoutNode[];
+    /** Percent of the parent per child, summing to 100. */
+    sizes: number[];
+}
+export type LayoutNode = PaneNode | SplitNode;
+/** The layout of one split tab. */
+export interface SplitState {
+    root: LayoutNode;
+    focusedPaneId: string;
+    /** A pane shown alone, filling the split, until unzoomed. */
+    zoomedPaneId?: string | null;
+}
+export type WorkspaceTabSnapshot = {
+    /** Stable key within the saved tab list, not the live Tab.id (which is regenerated on every open). */
+    slotId: string;
+    type: TabType;
+    /** Set for host-bound tab types, resolved by Host.syncId on apply. */
+    hostSyncId?: string | null;
+    /** Denormalized snapshot for display and graceful-skip messaging if the host is later deleted. */
+    hostNameSnapshot?: string | null;
+    label: string;
+    customLabel?: string;
+    /** Read from payloads saved before tabs carried `data`. */
+    initialFilePath?: string;
+    initialPath?: string;
+    fleetId?: number;
+    /** The tab's plugin payload. */
+    data?: Record<string, unknown>;
+};
+/** One dock's arrangement. `view` is a RailView, or null when the dock is closed. */
+type WorkspaceDockState = {
+    view: string | null;
+    open: boolean;
+    width: number;
+};
+/** One split tab in a saved layout, its pane tab ids swapped for slotIds. */
+export type WorkspaceSplitSnapshot = {
+    slotId: string;
+    label: string;
+    root: LayoutNode;
+    focusedPaneId: string;
+};
+export type WorkspacePayload = {
+    version: 1 | 2;
+    tabs: WorkspaceTabSnapshot[];
+    /** A tab's slotId, or a split's. */
+    activeSlotId: string | null;
+    /** Every split tab. Version 2 and later. */
+    splits?: WorkspaceSplitSnapshot[];
+    /** Version 1: the one split, as a fixed mode. */
+    splitMode?: string;
+    /** Version 1: indexed by the mode's pane order, holding slotIds. */
+    paneTabIds?: (string | null)[];
+    rowSizes?: number[];
+    rowColSizes?: number[][];
+    /** Sidebar arrangement, so a workspace restores the whole layout and not just tabs. */
+    sidebar?: {
+        left: WorkspaceDockState;
+        right: WorkspaceDockState;
+    };
+};
+export {};

package/dist/host/types/src/ui/api/admin-user-data-api.d.ts

@@ -0,0 +1,11 @@
+import type { SSHHost, SSHHostData } from "../../types/index";
+export declare function adminGetUserHosts(targetUserId: string): Promise<SSHHost[]>;
+export declare function adminCreateUserHost(targetUserId: string, hostData: SSHHostData): Promise<SSHHost>;
+export declare function adminUpdateUserHost(targetUserId: string, hostId: number, hostData: SSHHostData): Promise<SSHHost>;
+export declare function adminDeleteUserHost(targetUserId: string, hostId: number): Promise<Record<string, unknown>>;
+export declare function adminGetHostPassword(targetUserId: string, hostId: number, field?: "password" | "sudoPassword" | "key" | "keyPassword"): Promise<string | null>;
+export declare function adminGetUserCredentials(targetUserId: string): Promise<Record<string, unknown>[] | Record<string, unknown>>;
+export declare function adminGetUserCredentialDetails(targetUserId: string, credentialId: number): Promise<Record<string, unknown>>;
+export declare function adminCreateUserCredential(targetUserId: string, credentialData: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function adminUpdateUserCredential(targetUserId: string, credentialId: number, credentialData: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function adminDeleteUserCredential(targetUserId: string, credentialId: number): Promise<Record<string, unknown>>;

package/dist/host/types/src/ui/api/auth-methods-api.d.ts

@@ -0,0 +1,63 @@
+import { type AuthResponse } from "../main-axios";
+export interface PublicLoginMethod {
+    id: string;
+    pluginId: string;
+    kind: "redirect" | "form";
+    labelKey: string;
+    icon?: string;
+    instances: Array<{
+        id: string;
+        label: string;
+        autoStart?: boolean;
+    }>;
+}
+export interface SecondFactorRef {
+    id: string;
+    pluginId: string;
+    labelKey: string;
+}
+export type LoginResponse = AuthResponse & {
+    requires_second_factor?: boolean;
+    second_factors?: SecondFactorRef[];
+    userId?: string;
+};
+/** Enabled login methods for the login screen. Public. */
+export declare function getLoginMethods(): Promise<PublicLoginMethod[]>;
+export declare function submitLoginMethod(methodId: string, body: Record<string, unknown>, instanceId?: string): Promise<LoginResponse>;
+export declare function startLoginRedirect(methodId: string, params: {
+    instanceId?: string;
+    rememberMe?: boolean;
+    desktopCallbackPort?: number;
+}): Promise<string>;
+/**
+ * Answers a second factor. With no temp token the server reads the pending
+ * login cookie a redirect method left.
+ */
+export declare function verifySecondFactor(factorId: string, body: Record<string, unknown>): Promise<LoginResponse>;
+export declare function challengeSecondFactor(factorId: string, tempToken?: string): Promise<unknown>;
+export interface UserSecondFactorSummary {
+    pluginId: string;
+    factorId: string;
+    labelKey: string | null;
+    available: boolean;
+}
+export declare function getUserSecondFactors(userId: string): Promise<UserSecondFactorSummary[]>;
+export declare function resetUserSecondFactors(userId: string): Promise<void>;
+export interface SshAuthProviderSummary {
+    type: string;
+    labelKey: string;
+    descriptionKey?: string;
+    pluginId: string;
+    fields: Array<Record<string, unknown>>;
+    credentialType: boolean;
+    needsUserInteraction: boolean;
+    supportsBackground: boolean;
+    /** Offered in Quick Connect, for a host that is never saved. */
+    quickConnect?: boolean;
+    available: boolean;
+    missingPlugin?: {
+        id: string;
+        name: string;
+    };
+}
+export declare function getSshAuthProviders(): Promise<SshAuthProviderSummary[]>;

package/dist/host/types/src/ui/api/credential-sidebar-preferences-api.d.ts

@@ -0,0 +1,3 @@
+import { type CredentialSidebarPreferences } from "../../types/credential-sidebar-preferences";
+export declare function getCredentialSidebarPreferences(): Promise<CredentialSidebarPreferences>;
+export declare function saveCredentialSidebarPreferences(preferences: CredentialSidebarPreferences): Promise<void>;

package/dist/host/types/src/ui/api/credentials-api.d.ts

@@ -0,0 +1,56 @@
+import type { SSHFolder } from "../../types/index";
+export declare function getCredentials(): Promise<Record<string, unknown>[] | Record<string, unknown>>;
+export declare function getCredentialDetails(credentialId: number): Promise<Record<string, unknown>>;
+export declare function createCredential(credentialData: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function updateCredential(credentialId: number, credentialData: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function duplicateCredential(credentialId: number, data: Record<string, unknown>): Promise<Record<string, unknown>>;
+export declare function deleteCredential(credentialId: number): Promise<Record<string, unknown>>;
+export declare function getCredentialHosts(credentialId: number): Promise<Record<string, unknown>>;
+export declare function getCredentialFolders(): Promise<Record<string, unknown>>;
+export declare function getSSHHostWithCredentials(hostId: number): Promise<Record<string, unknown>>;
+export declare function getHostPassword(hostId: number, field?: "password" | "sudoPassword" | "key" | "keyPassword"): Promise<string | null>;
+export declare function applyCredentialToHost(hostId: number, credentialId: number): Promise<Record<string, unknown>>;
+export declare function removeCredentialFromHost(hostId: number): Promise<Record<string, unknown>>;
+export declare function migrateHostToCredential(hostId: number, credentialName: string): Promise<Record<string, unknown>>;
+export declare function getFoldersWithStats(): Promise<Record<string, unknown>>;
+export declare function renameFolder(oldName: string, newName: string): Promise<Record<string, unknown>>;
+export declare function getSSHFolders(): Promise<SSHFolder[]>;
+export declare function updateFolderMetadata(name: string, color?: string, icon?: string, credentialId?: number | null, localOnly?: boolean): Promise<void>;
+export declare function reorderFolders(positions: {
+    name: string;
+    sortOrder: number;
+}[]): Promise<{
+    updated: number;
+}>;
+export declare function deleteAllHostsInFolder(folderName: string): Promise<{
+    deletedCount: number;
+}>;
+export declare function renameCredentialFolder(oldName: string, newName: string): Promise<Record<string, unknown>>;
+export declare function reorderCredentials(positions: {
+    id: number;
+    sortOrder: number;
+}[]): Promise<{
+    updated: number;
+}>;
+export declare function detectKeyType(privateKey: string, keyPassword?: string): Promise<Record<string, unknown>>;
+export declare function detectPublicKeyType(publicKey: string): Promise<Record<string, unknown>>;
+export declare function validateKeyPair(privateKey: string, publicKey: string, keyPassword?: string): Promise<Record<string, unknown>>;
+export interface GeneratedPublicKey {
+    success?: boolean;
+    publicKey?: string;
+    error?: string;
+}
+export declare function generatePublicKeyFromPrivate(privateKey: string, keyPassword?: string): Promise<GeneratedPublicKey>;
+export interface GeneratedKeyPair {
+    success: boolean;
+    privateKey?: string;
+    publicKey?: string;
+    keyType?: string;
+    format?: string;
+    algorithm?: string;
+    keySize?: number;
+    curve?: string;
+    error?: string;
+}
+export declare function generateKeyPair(keyType: "ssh-ed25519" | "ssh-rsa" | "ecdsa-sha2-nistp256", keySize?: number, passphrase?: string): Promise<GeneratedKeyPair>;
+export declare function deployCredentialToHost(credentialId: number, targetHostId: number): Promise<Record<string, unknown>>;

package/dist/host/types/src/ui/api/dashboard-api.d.ts

@@ -0,0 +1,23 @@
+export interface UptimeInfo {
+    uptimeMs: number;
+    uptimeSeconds: number;
+    formatted: string;
+}
+export interface RecentActivityItem {
+    id: number;
+    userId: string;
+    /** The activity type; each plugin records its own. */
+    type: string;
+    hostId: number;
+    hostName: string;
+    timestamp: string;
+}
+export declare function getUptime(): Promise<UptimeInfo>;
+export declare function getRecentActivity(limit?: number): Promise<RecentActivityItem[]>;
+export declare function logActivity(type: string, hostId: number, hostName: string): Promise<{
+    message: string;
+    id: number | string;
+}>;
+export declare function resetRecentActivity(): Promise<{
+    message: string;
+}>;

package/dist/host/types/src/ui/api/external-account-api.d.ts

@@ -0,0 +1,8 @@
+export declare function linkExternalToPasswordAccount(externalUserId: string, targetUsername: string): Promise<{
+    success: boolean;
+    message: string;
+}>;
+export declare function unlinkExternalFromPasswordAccount(userId: string): Promise<{
+    success: boolean;
+    message: string;
+}>;

package/dist/host/types/src/ui/api/host-sidebar-preferences-api.d.ts

@@ -0,0 +1,3 @@
+import { type HostSidebarPreferences } from "../../types/host-sidebar-preferences";
+export declare function getHostSidebarPreferences(): Promise<HostSidebarPreferences>;
+export declare function saveHostSidebarPreferences(preferences: HostSidebarPreferences): Promise<void>;

package/dist/host/types/src/ui/api/host-status-api.d.ts

@@ -0,0 +1,11 @@
+import type { ServerStatus } from "../main-axios";
+/** Throws when the statuses could not be read, so callers keep what they had. */
+export declare function getAllServerStatuses(): Promise<Record<number, ServerStatus>>;
+export declare function getServerStatusById(id: number): Promise<ServerStatus>;
+export declare function refreshServerPolling(): Promise<void>;
+export declare function getStatusCheckSettings(): Promise<{
+    statusCheckInterval: number;
+}>;
+export declare function updateStatusCheckSettings(settings: {
+    statusCheckInterval: number;
+}): Promise<void>;

package/dist/host/types/src/ui/api/open-tabs-api.d.ts

@@ -0,0 +1,74 @@
+import type { CustomKeybinding } from "../../types/keybindings";
+export interface OpenTabRecord {
+    id: string;
+    userId: string;
+    tabType: string;
+    hostId: number | null;
+    label: string;
+    tabOrder: number;
+    backendSessionId: string | null;
+    createdAt: string;
+    updatedAt: string;
+}
+export interface OpenTabSyncPayload {
+    id: string;
+    tabType: string;
+    hostId?: number | null;
+    label: string;
+    tabOrder: number;
+    backendSessionId?: string | null;
+}
+export interface OpenTabUpsertPayload {
+    id: string;
+    tabType: string;
+    hostId?: number | null;
+    label: string;
+    tabOrder: number;
+    backendSessionId?: string | null;
+}
+export interface ActiveSessionInfo {
+    sessionId: string;
+    hostId: number;
+    hostName: string;
+    tabInstanceId: string | null;
+    isConnected: boolean;
+    createdAt: number;
+}
+export declare function getOpenTabs(): Promise<OpenTabRecord[]>;
+export declare function syncOpenTabs(tabs: OpenTabSyncPayload[]): Promise<void>;
+export declare function deleteOpenTab(instanceId: string): Promise<void>;
+export declare function patchOpenTab(instanceId: string, updates: Partial<Pick<OpenTabRecord, "hostId" | "label" | "tabOrder" | "backendSessionId">>): Promise<void>;
+export declare function addOpenTab(tab: OpenTabUpsertPayload): Promise<void>;
+/** The caller's own live sessions. */
+export declare function getActiveSessions(): Promise<ActiveSessionInfo[]>;
+/** How long a detached terminal session is kept, in minutes. */
+export declare function getSessionTimeoutMinutes(): Promise<number>;
+export interface UserPreferences {
+    reopenTabsOnLogin: boolean;
+    theme?: string | null;
+    fontSize?: string | null;
+    accentColor?: string | null;
+    language?: string | null;
+    storageMode?: string | null;
+    commandPaletteEnabled?: boolean | null;
+    showHostTags?: boolean | null;
+    hostTrayOnClick?: boolean | null;
+    pinAppRail?: boolean | null;
+    expandAppRailOnHover?: boolean | null;
+    showPinAppRailButton?: boolean | null;
+    disableUpdateCheck?: boolean | null;
+    confirmTabClose?: boolean | null;
+    hiddenRailTabs?: string | null;
+    compactHostView?: boolean | null;
+    statusColorScheme?: string | null;
+    customKeybindings?: string | null;
+}
+export declare function parseCustomKeybindings(raw?: string | null): CustomKeybinding[];
+/**
+ * Cached briefly so the loading gate's prefetch and the shell's own read on
+ * mount share one request instead of two, which is what let stale
+ * localStorage flags (hiddenRailTabs, pinAppRail) flash before the real
+ * values landed a moment after the shell first rendered.
+ */
+export declare function getUserPreferences(): Promise<UserPreferences>;
+export declare function saveUserPreferences(prefs: Partial<UserPreferences>): Promise<void>;

package/dist/host/types/src/ui/api/plugins-api.d.ts

@@ -0,0 +1,128 @@
+export interface PluginTabContribution {
+    id: string;
+    titleKey: string;
+    icon: string;
+    openFrom: string[];
+}
+export type PluginSettingsFieldType = "boolean" | "string" | "number" | "select" | "multiselect" | "secret" | "textarea" | "json" | "custom";
+export interface PluginSettingsField {
+    key: string;
+    type: PluginSettingsFieldType;
+    labelKey?: string;
+    descriptionKey?: string;
+    placeholderKey?: string;
+    default?: unknown;
+    options?: {
+        value: string;
+        labelKey: string;
+    }[];
+    min?: number;
+    max?: number;
+    requires?: string;
+    permission?: string;
+    group?: string;
+    component?: string;
+    hidden?: boolean;
+    defaultable?: boolean;
+    defaultLevels?: Array<"admin" | "user" | "folder">;
+    personal?: boolean;
+    secretKeys?: string[];
+    shareRead?: "connect" | "view" | "edit" | "manage";
+    ownerOnly?: boolean;
+}
+export interface PluginHostSettingsContribution {
+    enableKey?: string;
+    enableLabelKey?: string;
+    enableDescriptionKey?: string;
+    enableDefault?: boolean;
+    editorGroup?: "top" | "ssh";
+    editorOrder?: number;
+    fields: PluginSettingsField[];
+}
+/** A plugin's Appearance defaults for each interface preset. */
+export type PluginUiPresets = Record<"simple" | "balanced" | "advanced", Record<string, unknown>>;
+export interface PluginSettingsContribution {
+    admin?: PluginSettingsField[];
+    user?: PluginSettingsField[];
+    host?: PluginHostSettingsContribution;
+}
+/** A panel or dashboard card, declared so its owner is known while it is off. */
+export interface PluginViewContribution {
+    id: string;
+    titleKey: string;
+    icon?: string;
+}
+export interface PluginContributions {
+    tabs?: PluginTabContribution[];
+    panels?: PluginViewContribution[];
+    dashboardCards?: PluginViewContribution[];
+    /** The frontend also runs on anonymous guest pages. */
+    guest?: boolean;
+    settings?: PluginSettingsContribution;
+    permissions?: {
+        name: string;
+        titleKey: string;
+        descriptionKey: string;
+    }[];
+    uiPresets?: PluginUiPresets;
+}
+export { isRedactedSecret, type RedactedSecret, } from "@termix-ssh/plugin-sdk/settings";
+export type PluginSettingsValues = Record<string, unknown>;
+/** Per-field messages from a rejected PUT, keyed by field key. */
+export interface PluginSettingsErrors {
+    [key: string]: string;
+}
+export declare class PluginSettingsValidationError extends Error {
+    readonly errors: PluginSettingsErrors;
+    constructor(errors: PluginSettingsErrors);
+}
+export declare function getPluginAdminSettings(pluginId: string): Promise<PluginSettingsValues>;
+/** Tells the plugin's own frontend, through app.onSettingsChanged. */
+export declare const PLUGIN_SETTINGS_CHANGED_EVENT = "termix:plugin-settings-changed";
+export declare function updatePluginAdminSettings(pluginId: string, values: PluginSettingsValues): Promise<PluginSettingsValues>;
+export declare function getPluginUserSettings(pluginId: string): Promise<PluginSettingsValues>;
+export declare function updatePluginUserSettings(pluginId: string, values: PluginSettingsValues): Promise<PluginSettingsValues>;
+export declare function getPluginHostSettings(pluginId: string, hostId: number): Promise<PluginSettingsValues>;
+export declare function updatePluginHostSettings(pluginId: string, hostId: number, values: PluginSettingsValues): Promise<PluginSettingsValues>;
+/**
+ * What GET /plugins returns.
+ *
+ * The admin-only fields are absent for a caller without
+ * admin.plugins.manage: what a plugin may do, what it has been granted and
+ * why it failed are operational details the shell does not need.
+ */
+export interface PluginSummary {
+    id: string;
+    name: string;
+    version: string;
+    enabled: boolean;
+    /** enabled | disabled | blocked | failed, or the loader's live state. */
+    state: string;
+    contributes: PluginContributions | null;
+    /** Lucide icon name from the manifest. */
+    icon?: string;
+    dependencies?: Record<string, string>;
+    optionalDependencies?: Record<string, string>;
+    /** A built frontend bundle is served at /plugin-assets/<id>/frontend.js. */
+    frontend?: boolean;
+    /** A frontend.css sits beside the bundle. */
+    css?: boolean;
+    /** Cache key for the bundle; changes when it is rebuilt. */
+    assetVersion?: string | null;
+    /** "en" plus the xx_YY names of shipped translations. */
+    locales?: string[];
+    tier?: string;
+    source?: string;
+    /** Capabilities this plugin's manifest declares. Admins only. */
+    capabilities?: string[];
+    /** The subset of `capabilities` actually granted. Admins only. */
+    grantedCapabilities?: string[];
+    /** Why the plugin is blocked or failed. Admins only. */
+    lastError?: string | null;
+    /** Paths a running plugin serves without login. Admins only. */
+    publicRoutes?: {
+        http: string[];
+        ws: string[];
+    };
+}
+export declare function getPlugins(): Promise<PluginSummary[]>;