From 6377798d4593d89dcf788a01f97203ee6fe0120e Mon Sep 17 00:00:00 2001
From: LukeGus <bugattiguy527@gmail.com>
Date: Mon, 19 Oct 2026 23:27:58 -0500
Subject: [PATCH] feat: client cert on the sync link types (sdk 1.0.18)

---
 packages/plugin-sdk/CHANGELOG.md    |  8 ++++++++
 packages/plugin-sdk/PLUGIN-GUIDE.md |  2 +-
 packages/plugin-sdk/package.json    |  2 +-
 packages/plugin-sdk/src/backend.ts  | 21 ++++++++++++++++++++-
 packages/plugin-sdk/src/manifest.ts |  2 +-
 5 files changed, 31 insertions(+), 4 deletions(-)

diff --git a/packages/plugin-sdk/CHANGELOG.md b/packages/plugin-sdk/CHANGELOG.md
index 4c76081be..dc7d125d7 100644
--- a/packages/plugin-sdk/CHANGELOG.md
+++ b/packages/plugin-sdk/CHANGELOG.md
@@ -1,5 +1,13 @@
 # Changelog
 
+## 1.0.18
+
+Plugin API 1.10.0.
+
+### Added
+
+- `clientCert` on the sync link, link patch and remote target, and the `client_cert` remote error kind, so a sync plugin can link to a server that needs mutual TLS
+
 ## 1.0.17
 
 Plugin API 1.9.0.
diff --git a/packages/plugin-sdk/PLUGIN-GUIDE.md b/packages/plugin-sdk/PLUGIN-GUIDE.md
index 9341f28d7..dacad73d8 100644
--- a/packages/plugin-sdk/PLUGIN-GUIDE.md
+++ b/packages/plugin-sdk/PLUGIN-GUIDE.md
@@ -1,6 +1,6 @@
 # Termix plugin guide
 
-SDK 1.0.17 | Plugin API 1.9.0
+SDK 1.0.18 | Plugin API 1.10.0
 
 This guide is for anyone, person or AI coding tool, building a Termix plugin. It ships inside
 `@termix-ssh/plugin-sdk`, so the copy in your `node_modules` always matches the SDK you have installed.
diff --git a/packages/plugin-sdk/package.json b/packages/plugin-sdk/package.json
index 7cb15ca04..577f2e152 100644
--- a/packages/plugin-sdk/package.json
+++ b/packages/plugin-sdk/package.json
@@ -1,6 +1,6 @@
 {
   "name": "@termix-ssh/plugin-sdk",
-  "version": "1.0.17",
+  "version": "1.0.18",
   "description": "The contract between Termix core and a plugin: types, the capability catalog and the manifest schema.",
   "license": "Apache-2.0",
   "repository": {
diff --git a/packages/plugin-sdk/src/backend.ts b/packages/plugin-sdk/src/backend.ts
index c7dfd214a..bf1ccfab6 100644
--- a/packages/plugin-sdk/src/backend.ts
+++ b/packages/plugin-sdk/src/backend.ts
@@ -308,6 +308,15 @@ export interface SyncBasicAuth {
   password: string;
 }
 
+/** A client certificate for a server that asks for mutual TLS. */
+export interface SyncClientCert {
+  /** Base64 of the PFX/P12 file. */
+  pfx: string;
+  passphrase: string;
+  /** The file name, to show which certificate is saved. */
+  name: string | null;
+}
+
 /** Extra per server connection options. Kept open so new ones need no migration. */
 export type SyncLinkOptions = Record<string, unknown>;
 
@@ -323,6 +332,7 @@ export interface SyncLinkInfo {
   customHeaders: SyncProxyHeader[];
   basicAuth: SyncBasicAuth | null;
   allowInvalidCertificate: boolean;
+  clientCert: SyncClientCert | null;
   remoteUserId: string | null;
   remoteUsername: string | null;
   account: {
@@ -352,6 +362,7 @@ export interface SyncLinkCreate {
   customHeaders?: SyncProxyHeader[];
   basicAuth?: SyncBasicAuth | null;
   allowInvalidCertificate?: boolean;
+  clientCert?: SyncClientCert | null;
   remoteUserId?: string | null;
   remoteUsername?: string | null;
 }
@@ -365,6 +376,7 @@ export type SyncLinkPatch = Partial<
     | "customHeaders"
     | "basicAuth"
     | "allowInvalidCertificate"
+    | "clientCert"
     | "remoteUserId"
     | "remoteUsername"
     | "account"
@@ -379,7 +391,13 @@ export type SyncLinkPatch = Partial<
 >;
 
 export type SyncRemoteErrorKind =
-  "offline" | "tls" | "proxy" | "basic_auth" | "signed_out" | "server";
+  | "offline"
+  | "tls"
+  | "client_cert"
+  | "proxy"
+  | "basic_auth"
+  | "signed_out"
+  | "server";
 
 export interface SyncRemoteError extends Error {
   readonly kind: SyncRemoteErrorKind;
@@ -392,6 +410,7 @@ export interface SyncRemoteTarget {
   customHeaders?: SyncProxyHeader[];
   basicAuth?: SyncBasicAuth | null;
   allowInvalidCertificate?: boolean;
+  clientCert?: SyncClientCert | null;
 }
 
 export interface SyncRemoteRequest {
diff --git a/packages/plugin-sdk/src/manifest.ts b/packages/plugin-sdk/src/manifest.ts
index 8f75161ae..6e659c06d 100644
--- a/packages/plugin-sdk/src/manifest.ts
+++ b/packages/plugin-sdk/src/manifest.ts
@@ -37,7 +37,7 @@ export {
  * "^1.2" needs 1.2 or later). engine.termix is checked against the core
  * version by the server.
  */
-export const PLUGIN_API_VERSION = "1.9.0";
+export const PLUGIN_API_VERSION = "1.10.0";
 
 /** The API major, the default engine.api for a new plugin. */
 export const SUPPORTED_PLUGIN_API_VERSION = String(