import type { PackagedPluginManifestV2, PluginPermission } from '@thortiq/plugin-api';

export interface PluginPackageFile {
  readonly path: string;
  readonly kind?: 'file' | 'symlink' | 'directory' | 'other';
  readonly bytes?: Uint8Array | null;
  readonly escapesPackageRoot?: boolean;
}

export interface PluginPackageDiagnostic {
  readonly code: string;
  readonly severity: 'error';
  readonly path: string;
  readonly message: string;
}

export type PluginPackageValidationResult =
  | {
    readonly ok: true;
    readonly manifest: PackagedPluginManifestV2;
    readonly digest: `sha256:${string}`;
    readonly totalBytes: number;
    readonly files: readonly { readonly path: string; readonly bytes: Uint8Array }[];
    readonly permissions: readonly PluginPermission[];
    readonly watchedPaths: readonly string[];
  }
  | {
    readonly ok: false;
    readonly diagnostics: readonly PluginPackageDiagnostic[];
  };

export function isForbiddenPluginPackagePath(path: string): boolean;
export function validatePluginPackageFiles(
  files: readonly PluginPackageFile[],
  options?: {
    readonly platform?: string;
    readonly expectedPluginId?: string | null;
    readonly sha256?: (bytes: Uint8Array) => Promise<string>;
  },
): Promise<PluginPackageValidationResult>;
export function createDeterministicPluginArchive(files: readonly PluginPackageFile[]): Uint8Array;
export function readDeterministicPluginArchive(bytes: Uint8Array | ArrayBuffer): readonly PluginPackageFile[];
export function samePluginPackageGeneration(
  left: readonly PluginPackageFile[],
  right: readonly PluginPackageFile[],
): boolean;
