@spec build_inputs(Path.t(), map() | nil) :: [rel_path()]

Plugin-relative paths of every file the native build reads from the plugin, sorted. The signer lists all of them; a verifier seeing the coverage marker refuses a signature that omits any.

Derived from the same MobDev.Plugin.Merge gatherers the build uses, called with an empty plugin dir so they return the declared relative paths:

• priv/mob_plugin.exs itself (evaluated by every consumer).
• ios.swift_files, android.bridge_kt, android.res_files.
• Every compiled C-family source: each C / ObjC / Zig NIF's primary source (<native_dir>/<module>.<ext>, default native_dir applied), android.jni_source, and lang: :cpp_archive sources: — and every file under each one's directory, whatever its extension, because a quoted #include/@import resolves there first.
• migrations.migrations_dir/*.exs (copied into the host and run on device), assets.fonts, assets.images, default_font.file.

Not covered: {:dep, app, path} entries (another package's files) and cpp_archive includes: roots. An include root can be provisioned on the host at build time rather than shipped — mob_nx_eigen's eigen-3.4.0 is downloaded into the plugin's own tree by its Mix compiler — so its contents cannot be signed, and requiring them listed would refuse the plugin on every host that has compiled it. Headers a plugin ships belong beside its sources, where they are covered.

Directory expansion skips dotfiles: they are editor/OS litter (.DS_Store appears on hosts that browse deps/ in Finder), and requiring them listed would fail verification for a harmless file. A symlink is listed as an entry and never followed. priv/mob_plugin.sig is never an input.

@spec build_payload(file_hashes()) :: map()

Builds the canonical payload term that gets signed.

Shape:

%{
  file_hashes: [{rel_path, sha256}, ...],
  envelope_version: 2
}

Authoritative for what's inside the signature — any new field added here needs both author and host updates.

Note that the payload no longer includes the manifest term itself (see MOB-74). The manifest is one of the files hashed in file_hashes, so its bytes are covered — and dropping the map from the payload lets Verify recompute the payload without eval'ing the manifest first.

@spec compute_file_hashes(Path.t(), map() | nil) :: file_hashes()

Returns the relative-path-sorted {relative_path, sha256} list a new signature carries: every build_inputs/2 file plus the coverage marker.

Missing files hash as empty bytes (see sha256!/1) — Validator.validate_plugin/3 refuses to publish a plugin with missing declared paths, and a missing file that later appears no longer matches.

@spec declares_build_input_coverage?(file_hashes()) :: boolean()

True when a signed file_hashes list carries the build-input coverage marker, i.e. the signer listed every build_inputs/2 file.

@spec envelope_version() :: integer()

Current signing envelope version.

@spec manifest_path(Path.t()) :: Path.t()

Relative path inside a plugin dir where the manifest lives.

@spec sign_plugin(Path.t(), MobDev.Plugin.Crypto.priv_key()) :: :ok | {:error, term()}

Signs plugin_dir and writes priv/mob_plugin.sig.

Orchestrates the full author workflow: loads the manifest (to know which files it references), computes file hashes (including the manifest bytes themselves), builds the v2 payload, signs it, wraps the signature and the file_hashes list in the envelope binary, and writes the file. Returns :ok on success or {:error, reason} if the manifest is missing/invalid.

The envelope carries file_hashes on disk so Verify.verify_plugin/1 can check tampering without needing to Code.eval_file the manifest first — see MOB-74.

@spec signature_path(Path.t()) :: Path.t()

Relative path inside a plugin dir where the signature lives.