@termix-ssh/plugin-sdk 1.0.21 → 1.0.23

package/dist/operations.js

@@ -0,0 +1,650 @@
+/**
+ * The operations contract: what a plugin declares it can do, in one shape every
+ * surface reads (Automations, Fleets, AI, CLI, Mobile, palette, API, MCP).
+ *
+ * Declarations are data in the manifest, so a surface can list and describe an
+ * action without loading the plugin's code. Handlers are registered at
+ * activation with ctx.operations.register and must match a declaration.
+ *
+ * No Node imports: the frontend, the CLI and Mobile read this file too.
+ */
+import { coerceSettingValue, validateSettingValue } from "./settings.js";
+export const OPERATION_RISKS = ["read", "change", "destructive"];
+export const OPERATION_SCOPES = ["host", "resource", "server"];
+export const OPERATION_HOST_ACCESS = [
+    "connect",
+    "view",
+    "edit",
+    "manage",
+];
+export const OPERATION_DRY_RUN = ["native", "describe"];
+export const OPERATION_FIELD_TYPES = [
+    "boolean",
+    "string",
+    "number",
+    "select",
+    "multiselect",
+    "secret",
+    "textarea",
+    "json",
+    "resource",
+];
+export const OPERATION_SEVERITIES = ["info", "warning", "critical"];
+export const SIGNAL_KINDS = ["count", "gauge", "status", "list"];
+export const SIGNAL_STATUSES = ["ok", "warn", "fail", "unknown"];
+export const RESOURCE_COLUMN_TYPES = [
+    "text",
+    "status",
+    "bytes",
+    "percent",
+    "time",
+    "tags",
+];
+export const OPERATION_ID_PATTERN = /^[a-z0-9][a-z0-9-]*\.[a-z0-9][a-z0-9-]*$/;
+const FIELD_KEY_PATTERN = /^[a-zA-Z][a-zA-Z0-9_-]{0,63}$/;
+const INVOKE_PATTERN = /^(\*|[a-z0-9][a-z0-9-]*\.(\*|[a-z0-9][a-z0-9-]*))$/;
+export const MAX_OPERATION_TIMEOUT_MS = 3_600_000;
+export const REDACTED_VALUE = "[redacted]";
+const ALLOWED_OPERATIONS = [
+    "actions",
+    "events",
+    "resources",
+    "signals",
+    "invokes",
+];
+const ALLOWED_ACTION = [
+    "id",
+    "version",
+    "titleKey",
+    "descriptionKey",
+    "icon",
+    "scope",
+    "resource",
+    "inputs",
+    "outputs",
+    "risk",
+    "permission",
+    "hostAccess",
+    "dryRun",
+    "check",
+    "undo",
+    "idempotent",
+    "exclusive",
+    "timeoutMs",
+    "when",
+    "surfaces",
+];
+const ALLOWED_FIELD = [
+    "key",
+    "type",
+    "labelKey",
+    "descriptionKey",
+    "placeholderKey",
+    "default",
+    "options",
+    "min",
+    "max",
+    "requires",
+    "group",
+    "required",
+    "pattern",
+    "optionsFrom",
+    "resource",
+    "sensitive",
+];
+const ALLOWED_EVENT = [
+    "id",
+    "titleKey",
+    "descriptionKey",
+    "severity",
+    "scope",
+    "payload",
+];
+const ALLOWED_RESOURCE = [
+    "id",
+    "titleKey",
+    "icon",
+    "list",
+    "key",
+    "name",
+    "status",
+    "url",
+    "tab",
+    "columns",
+    "filters",
+];
+const ALLOWED_SIGNAL = [
+    "id",
+    "titleKey",
+    "read",
+    "scope",
+    "kind",
+    "refreshSec",
+    "fix",
+];
+const ALLOWED_SURFACES = [
+    "assistant",
+    "mcp",
+    "palette",
+    "automations",
+    "mobile",
+    "cli",
+];
+function isObject(value) {
+    return typeof value === "object" && value !== null && !Array.isArray(value);
+}
+function rejectUnknown(raw, allowed, where, errors) {
+    for (const key of Object.keys(raw)) {
+        if (!allowed.includes(key))
+            errors.push(`Unknown field "${key}" in ${where}`);
+    }
+}
+function requireEnum(value, allowed, where, errors) {
+    if (typeof value !== "string" || !allowed.includes(value)) {
+        errors.push(`${where} must be one of: ${allowed.join(", ")}`);
+    }
+}
+function requireText(value, where, errors) {
+    if (typeof value !== "string" || value.trim().length === 0) {
+        errors.push(`${where} must be a non-empty string`);
+    }
+}
+function optionalText(value, where, errors) {
+    if (value !== undefined)
+        requireText(value, where, errors);
+}
+function optionalBoolean(value, where, errors) {
+    if (value !== undefined && typeof value !== "boolean") {
+        errors.push(`${where} must be a boolean`);
+    }
+}
+function requireId(value, pluginId, where, seen, errors) {
+    if (typeof value !== "string" || !OPERATION_ID_PATTERN.test(value)) {
+        errors.push(`${where}.id must look like "<pluginId>.<name>" in lowercase`);
+        return;
+    }
+    if (pluginId && !value.startsWith(`${pluginId}.`)) {
+        errors.push(`${where}.id must start with "${pluginId}."`);
+    }
+    if (seen.has(value))
+        errors.push(`${where}.id "${value}" is declared twice`);
+    seen.add(value);
+}
+function eachObject(value, where, errors, each) {
+    if (value === undefined)
+        return;
+    if (!Array.isArray(value)) {
+        errors.push(`${where} must be an array`);
+        return;
+    }
+    value.forEach((raw, index) => {
+        const at = `${where}[${index}]`;
+        if (!isObject(raw)) {
+            errors.push(`${at} must be an object`);
+            return;
+        }
+        each(raw, at);
+    });
+}
+function validateFields(value, where, errors) {
+    const keys = new Set();
+    eachObject(value, where, errors, (raw, at) => {
+        rejectUnknown(raw, ALLOWED_FIELD, at, errors);
+        if (typeof raw.key !== "string" || !FIELD_KEY_PATTERN.test(raw.key)) {
+            errors.push(`${at}.key must be a short name starting with a letter`);
+        }
+        else if (keys.has(raw.key)) {
+            errors.push(`${at}.key "${raw.key}" is declared twice`);
+        }
+        else {
+            keys.add(raw.key);
+        }
+        requireEnum(raw.type, OPERATION_FIELD_TYPES, `${at}.type`, errors);
+        optionalText(raw.labelKey, `${at}.labelKey`, errors);
+        optionalText(raw.descriptionKey, `${at}.descriptionKey`, errors);
+        optionalText(raw.placeholderKey, `${at}.placeholderKey`, errors);
+        optionalText(raw.group, `${at}.group`, errors);
+        optionalText(raw.requires, `${at}.requires`, errors);
+        optionalText(raw.optionsFrom, `${at}.optionsFrom`, errors);
+        optionalBoolean(raw.required, `${at}.required`, errors);
+        optionalBoolean(raw.sensitive, `${at}.sensitive`, errors);
+        if (raw.type === "resource" && typeof raw.resource !== "string") {
+            errors.push(`${at}.resource is required for type "resource"`);
+        }
+        if (raw.resource !== undefined && raw.type !== "resource") {
+            errors.push(`${at}.resource needs type "resource"`);
+        }
+        if (raw.type === "secret" && raw.default !== undefined) {
+            errors.push(`${at}.default is not allowed on a secret`);
+        }
+        if ((raw.type === "select" || raw.type === "multiselect") &&
+            !raw.optionsFrom &&
+            (!Array.isArray(raw.options) || raw.options.length === 0)) {
+            errors.push(`${at} needs options or optionsFrom`);
+        }
+        for (const bound of ["min", "max"]) {
+            if (raw[bound] !== undefined && typeof raw[bound] !== "number") {
+                errors.push(`${at}.${bound} must be a number`);
+            }
+        }
+        if (raw.pattern !== undefined) {
+            if (typeof raw.pattern !== "string") {
+                errors.push(`${at}.pattern must be a string`);
+            }
+            else {
+                try {
+                    new RegExp(raw.pattern);
+                }
+                catch {
+                    errors.push(`${at}.pattern is not a valid regular expression`);
+                }
+            }
+        }
+    });
+}
+function validateWhen(value, at, errors) {
+    if (value === undefined)
+        return;
+    if (!isObject(value)) {
+        errors.push(`${at} must be an object`);
+        return;
+    }
+    rejectUnknown(value, ["settings", "os"], at, errors);
+    if (value.settings !== undefined && !isObject(value.settings)) {
+        errors.push(`${at}.settings must be an object`);
+    }
+    if (value.os !== undefined &&
+        (!Array.isArray(value.os) ||
+            value.os.some((entry) => typeof entry !== "string"))) {
+        errors.push(`${at}.os must be an array of strings`);
+    }
+}
+function validateAction(raw, at, errors) {
+    rejectUnknown(raw, ALLOWED_ACTION, at, errors);
+    requireText(raw.titleKey, `${at}.titleKey`, errors);
+    optionalText(raw.descriptionKey, `${at}.descriptionKey`, errors);
+    optionalText(raw.icon, `${at}.icon`, errors);
+    requireEnum(raw.scope, OPERATION_SCOPES, `${at}.scope`, errors);
+    requireEnum(raw.risk, OPERATION_RISKS, `${at}.risk`, errors);
+    requireText(raw.permission, `${at}.permission`, errors);
+    validateFields(raw.inputs, `${at}.inputs`, errors);
+    validateFields(raw.outputs, `${at}.outputs`, errors);
+    validateWhen(raw.when, `${at}.when`, errors);
+    optionalBoolean(raw.idempotent, `${at}.idempotent`, errors);
+    optionalBoolean(raw.exclusive, `${at}.exclusive`, errors);
+    if (raw.version !== undefined &&
+        (!Number.isInteger(raw.version) || raw.version < 1)) {
+        errors.push(`${at}.version must be a whole number from 1`);
+    }
+    if (raw.dryRun !== undefined) {
+        requireEnum(raw.dryRun, OPERATION_DRY_RUN, `${at}.dryRun`, errors);
+    }
+    if (raw.timeoutMs !== undefined &&
+        (typeof raw.timeoutMs !== "number" ||
+            raw.timeoutMs <= 0 ||
+            raw.timeoutMs > MAX_OPERATION_TIMEOUT_MS)) {
+        errors.push(`${at}.timeoutMs must be above 0 and at most 1 hour`);
+    }
+    if (raw.scope === "resource" && typeof raw.resource !== "string") {
+        errors.push(`${at}.resource is required for scope "resource"`);
+    }
+    if (raw.scope !== "resource" && raw.resource !== undefined) {
+        errors.push(`${at}.resource needs scope "resource"`);
+    }
+    if (raw.scope === "server" && raw.hostAccess !== undefined) {
+        errors.push(`${at}.hostAccess does not apply to scope "server"`);
+    }
+    if (raw.scope === "host" || raw.scope === "resource") {
+        requireEnum(raw.hostAccess, OPERATION_HOST_ACCESS, `${at}.hostAccess`, errors);
+        if (raw.risk === "destructive" &&
+            (raw.hostAccess === "connect" || raw.hostAccess === "view")) {
+            errors.push(`${at}.hostAccess must be edit or manage when destructive`);
+        }
+    }
+    if (raw.surfaces !== undefined) {
+        if (!isObject(raw.surfaces)) {
+            errors.push(`${at}.surfaces must be an object`);
+        }
+        else {
+            rejectUnknown(raw.surfaces, ALLOWED_SURFACES, `${at}.surfaces`, errors);
+            for (const [key, value] of Object.entries(raw.surfaces)) {
+                optionalBoolean(value, `${at}.surfaces.${key}`, errors);
+            }
+        }
+    }
+}
+function validateResource(raw, at, errors) {
+    rejectUnknown(raw, ALLOWED_RESOURCE, at, errors);
+    requireText(raw.titleKey, `${at}.titleKey`, errors);
+    requireText(raw.list, `${at}.list`, errors);
+    requireText(raw.key, `${at}.key`, errors);
+    requireText(raw.name, `${at}.name`, errors);
+    optionalText(raw.icon, `${at}.icon`, errors);
+    optionalText(raw.status, `${at}.status`, errors);
+    optionalText(raw.url, `${at}.url`, errors);
+    optionalText(raw.tab, `${at}.tab`, errors);
+    eachObject(raw.columns, `${at}.columns`, errors, (column, where) => {
+        rejectUnknown(column, ["key", "titleKey", "type"], where, errors);
+        requireText(column.key, `${where}.key`, errors);
+        requireText(column.titleKey, `${where}.titleKey`, errors);
+        if (column.type !== undefined) {
+            requireEnum(column.type, RESOURCE_COLUMN_TYPES, `${where}.type`, errors);
+        }
+    });
+    if (raw.filters !== undefined &&
+        (!Array.isArray(raw.filters) ||
+            raw.filters.some((entry) => typeof entry !== "string"))) {
+        errors.push(`${at}.filters must be an array of strings`);
+    }
+}
+/** Shape checks for contributes.operations, run by validateManifest. */
+export function validateOperations(value, pluginId, errors) {
+    if (value === undefined)
+        return;
+    const root = "contributes.operations";
+    if (!isObject(value)) {
+        errors.push(`Field "${root}" must be an object`);
+        return;
+    }
+    rejectUnknown(value, ALLOWED_OPERATIONS, `"${root}"`, errors);
+    const ids = new Set();
+    eachObject(value.actions, `${root}.actions`, errors, (raw, at) => {
+        requireId(raw.id, pluginId, at, ids, errors);
+        validateAction(raw, at, errors);
+    });
+    const eventIds = new Set();
+    eachObject(value.events, `${root}.events`, errors, (raw, at) => {
+        requireId(raw.id, pluginId, at, eventIds, errors);
+        rejectUnknown(raw, ALLOWED_EVENT, at, errors);
+        requireText(raw.titleKey, `${at}.titleKey`, errors);
+        optionalText(raw.descriptionKey, `${at}.descriptionKey`, errors);
+        requireEnum(raw.scope, ["host", "server"], `${at}.scope`, errors);
+        if (raw.severity !== undefined) {
+            requireEnum(raw.severity, OPERATION_SEVERITIES, `${at}.severity`, errors);
+        }
+        validateFields(raw.payload, `${at}.payload`, errors);
+    });
+    const resourceIds = new Set();
+    eachObject(value.resources, `${root}.resources`, errors, (raw, at) => {
+        requireId(raw.id, pluginId, at, resourceIds, errors);
+        validateResource(raw, at, errors);
+    });
+    const signalIds = new Set();
+    eachObject(value.signals, `${root}.signals`, errors, (raw, at) => {
+        requireId(raw.id, pluginId, at, signalIds, errors);
+        rejectUnknown(raw, ALLOWED_SIGNAL, at, errors);
+        requireText(raw.titleKey, `${at}.titleKey`, errors);
+        requireText(raw.read, `${at}.read`, errors);
+        requireEnum(raw.scope, ["host", "server"], `${at}.scope`, errors);
+        requireEnum(raw.kind, SIGNAL_KINDS, `${at}.kind`, errors);
+        optionalText(raw.fix, `${at}.fix`, errors);
+        if (raw.refreshSec !== undefined &&
+            (typeof raw.refreshSec !== "number" || raw.refreshSec < 10)) {
+            errors.push(`${at}.refreshSec must be at least 10`);
+        }
+    });
+    if (value.invokes !== undefined) {
+        if (!Array.isArray(value.invokes) ||
+            value.invokes.some((entry) => typeof entry !== "string" || !INVOKE_PATTERN.test(entry))) {
+            errors.push(`${root}.invokes must list action ids, "<pluginId>.*" or "*"`);
+        }
+    }
+}
+/**
+ * The cross-field rules: every id one declaration names must exist in this
+ * plugin, or a surface would offer a button that goes nowhere.
+ */
+export function checkOperationReferences(operations, capabilities, hasPermission, errors) {
+    if (!operations)
+        return;
+    const root = "contributes.operations";
+    const actions = new Map((operations.actions ?? []).map((action) => [action.id, action]));
+    const resources = new Set((operations.resources ?? []).map((r) => r.id));
+    const declaresAnything = actions.size > 0 ||
+        (operations.events?.length ?? 0) > 0 ||
+        resources.size > 0 ||
+        (operations.signals?.length ?? 0) > 0;
+    if (declaresAnything && !capabilities.includes("operations:provide")) {
+        errors.push(`${root} needs the "operations:provide" capability`);
+    }
+    if (operations.invokes?.length &&
+        !capabilities.includes("operations:invoke")) {
+        errors.push(`${root}.invokes needs the "operations:invoke" capability`);
+    }
+    const readAction = (id, where) => {
+        const target = actions.get(id);
+        if (!target)
+            errors.push(`${where} "${id}" is not a declared action`);
+        else if (target.risk !== "read") {
+            errors.push(`${where} "${id}" must be a read action`);
+        }
+    };
+    for (const action of actions.values()) {
+        const at = `${root}.actions["${action.id}"]`;
+        if (!hasPermission(action.permission)) {
+            errors.push(`${at}.permission "${action.permission}" is not declared in contributes.permissions`);
+        }
+        if (action.resource && !resources.has(action.resource)) {
+            errors.push(`${at}.resource "${action.resource}" is not declared`);
+        }
+        if (action.check)
+            readAction(action.check, `${at}.check`);
+        if (action.undo && !actions.has(action.undo)) {
+            errors.push(`${at}.undo "${action.undo}" is not a declared action`);
+        }
+        for (const field of action.inputs ?? []) {
+            if (field.optionsFrom) {
+                readAction(field.optionsFrom, `${at} input "${field.key}" optionsFrom`);
+            }
+            if (field.resource && !resources.has(field.resource)) {
+                errors.push(`${at} input "${field.key}" names an unknown resource`);
+            }
+        }
+    }
+    for (const resource of operations.resources ?? []) {
+        readAction(resource.list, `${root}.resources["${resource.id}"].list`);
+    }
+    for (const signal of operations.signals ?? []) {
+        const at = `${root}.signals["${signal.id}"]`;
+        readAction(signal.read, `${at}.read`);
+        if (signal.fix && !actions.has(signal.fix)) {
+            errors.push(`${at}.fix "${signal.fix}" is not a declared action`);
+        }
+    }
+}
+/** Whether a plugin's invokes list lets it run an action. */
+export function invokeAllowed(invokes, actionId) {
+    for (const entry of invokes ?? []) {
+        if (entry === "*" || entry === actionId)
+            return true;
+        if (entry.endsWith(".*") && actionId.startsWith(entry.slice(0, -1))) {
+            return true;
+        }
+    }
+    return false;
+}
+const RISK_RANK = {
+    read: 0,
+    change: 1,
+    destructive: 2,
+};
+export function riskRank(risk) {
+    return RISK_RANK[risk];
+}
+/** A surface's own switch. The assistant and MCP are opt in, the rest opt out. */
+export function onSurface(action, surface) {
+    const value = action.surfaces?.[surface];
+    if (surface === "assistant" || surface === "mcp")
+        return value === true;
+    return value !== false;
+}
+/** Whether an action applies to a host, from fields any client can read. */
+export function matchesWhen(when, host) {
+    if (!when)
+        return true;
+    for (const [key, expected] of Object.entries(when.settings ?? {})) {
+        if (host.settings?.[key] !== expected)
+            return false;
+    }
+    if (when.os?.length && host.os) {
+        if (!when.os.includes(host.os.toLowerCase()))
+            return false;
+    }
+    return true;
+}
+function asSettingsField(field) {
+    const type = field.type === "resource" ? "string" : field.type;
+    return { ...field, type };
+}
+function isEmpty(value) {
+    return value === undefined || value === null || value === "";
+}
+/**
+ * Turns raw input into validated values. Keys no field declares are refused,
+ * so nothing a handler did not ask for ever reaches it.
+ */
+export function parseOperationInput(fields, raw) {
+    const errors = [];
+    const values = {};
+    const list = fields ?? [];
+    if (raw !== undefined && raw !== null && !isObject(raw)) {
+        return { values, errors: ["Input must be an object"] };
+    }
+    const input = (raw ?? {});
+    for (const key of Object.keys(input)) {
+        if (!list.some((field) => field.key === key)) {
+            errors.push(`"${key}" is not an input of this action`);
+        }
+    }
+    for (const field of list) {
+        if (field.requires && input[field.requires] !== true)
+            continue;
+        let value = input[field.key];
+        if (isEmpty(value)) {
+            if (field.default !== undefined) {
+                values[field.key] = field.default;
+            }
+            else if (field.required) {
+                errors.push(`"${field.key}" is required`);
+            }
+            continue;
+        }
+        const settingsField = asSettingsField(field);
+        value = coerceSettingValue(settingsField, value);
+        if (field.type === "secret" && typeof value !== "string") {
+            errors.push(`"${field.key}" must be a string`);
+            continue;
+        }
+        if (field.type === "json" && typeof value === "string") {
+            try {
+                value = JSON.parse(value);
+            }
+            catch {
+                errors.push(`"${field.key}" must be valid JSON`);
+                continue;
+            }
+        }
+        // A list known only at run time is checked by the handler.
+        const skipChoices = field.optionsFrom &&
+            (field.type === "select" || field.type === "multiselect");
+        const problem = skipChoices
+            ? field.type === "select"
+                ? typeof value === "string"
+                    ? null
+                    : `"${field.key}" must be a string`
+                : Array.isArray(value)
+                    ? null
+                    : `"${field.key}" must be an array`
+            : validateSettingValue(settingsField, value);
+        if (problem) {
+            errors.push(problem);
+            continue;
+        }
+        if (field.pattern &&
+            typeof value === "string" &&
+            !new RegExp(`^(?:${field.pattern})$`).test(value)) {
+            errors.push(`"${field.key}" has the wrong format`);
+            continue;
+        }
+        values[field.key] = value;
+    }
+    return { values, errors };
+}
+/** A copy safe to store or show: secret and sensitive values are replaced. */
+export function redactFields(fields, values) {
+    if (!isObject(values))
+        return values;
+    const copy = { ...values };
+    for (const field of fields ?? []) {
+        if (field.type !== "secret" && !field.sensitive)
+            continue;
+        if (field.key in copy)
+            copy[field.key] = REDACTED_VALUE;
+    }
+    return copy;
+}
+/** Trims text to a byte-friendly length with a plain marker. */
+export function capText(text, maxLength) {
+    return text.length <= maxLength
+        ? text
+        : `${text.slice(0, maxLength)}\n[cut at ${maxLength} characters]`;
+}
+function fieldSchema(field) {
+    const schema = {};
+    if (field.default !== undefined)
+        schema.default = field.default;
+    const values = field.optionsFrom
+        ? undefined
+        : field.options?.map((option) => option.value);
+    switch (field.type) {
+        case "boolean":
+            schema.type = "boolean";
+            break;
+        case "number":
+            schema.type = "number";
+            if (field.min !== undefined)
+                schema.minimum = field.min;
+            if (field.max !== undefined)
+                schema.maximum = field.max;
+            break;
+        case "select":
+            schema.type = "string";
+            if (values)
+                schema.enum = values;
+            break;
+        case "multiselect":
+            schema.type = "array";
+            schema.items = values
+                ? { type: "string", enum: values }
+                : { type: "string" };
+            break;
+        case "json":
+            break;
+        default:
+            schema.type = "string";
+            if (field.pattern)
+                schema.pattern = `^(?:${field.pattern})$`;
+    }
+    if (field.type === "resource" && field.resource) {
+        schema["x-termix-resource"] = field.resource;
+    }
+    if (field.type === "secret")
+        schema.writeOnly = true;
+    return schema;
+}
+/** JSON Schema for a field list, for AI tools, MCP and OpenAPI. */
+export function toJsonSchema(fields, describe) {
+    const properties = {};
+    const required = [];
+    for (const field of fields ?? []) {
+        const schema = fieldSchema(field);
+        const description = describe?.(field);
+        if (description)
+            schema.description = description;
+        properties[field.key] = schema;
+        if (field.required && field.default === undefined && !field.requires) {
+            required.push(field.key);
+        }
+    }
+    return { type: "object", properties, required, additionalProperties: false };
+}

package/dist/testing.d.ts

@@ -23,7 +23,7 @@ export interface FakeWsRoute {
     options?: PluginWebSocketOptions;
 }
 import type { PluginLoginMethod, PluginVerifiedIdentity, PluginSecondFactor, PluginSshAuthProvider, PluginSshConnectOptions, PluginSshHost, PluginHostSummary, PluginShareableUser, PluginShareableRole, PluginSshKeyCredential, PluginSshKeyCredentialInput } from "./backend.js";
-import type { PluginSyncHost, SyncEntityRegistration } from "./backend.js";
+import type { PluginOperationHandler, PluginSyncHost, SyncEntityRegistration } from "./backend.js";
 import type { PluginDatabase } from "./backend.js";
 import type { PluginExternalClientRequest, PluginProtocolTarget, PluginHostProbeTarget, PluginHostStatusEntry, PluginActivityProvider, PluginHostLockProvider, PluginAuthPolicyProvider, PluginCredentialSummary, PluginHostShareGrant, PluginHostStatusProvider, PluginNotification, PluginNotificationChannel, PluginNotifyHub, PluginFetchInit, PluginBinarySpec, PluginTlsCertificateInfo, PluginTlsStatus, PluginSummary, PluginKeyboardInteractiveHandler, PluginProcessHandle, PluginProcessOptions } from "./backend.js";
 /** A timer registered through ctx.schedule, run by hand with runScheduled. */
@@ -262,6 +262,14 @@ export interface FakePluginContext {
     notifyHub: {
         current: PluginNotifyHub | null;
     };
+    /** Handlers from ctx.operations.register, by action id. */
+    operationHandlers: Map<string, PluginOperationHandler>;
+    /** Every ctx.operations.emit call. */
+    operationEvents: {
+        eventId: string;
+        payload: unknown;
+        hostId?: number;
+    }[];
     /** Backing store behind ctx.secrets.get/set, keyed "<userId>:<key>". */
     secretStore: Map<string, string>;
     /** Every ctx.fetch call, in order. */