pack

type AdvisoryFinding struct {
	ID         string   `json:"id"`
	Package    string   `json:"package"`
	Version    string   `json:"version"`
	Severity   string   `json:"severity"`
	Summary    string   `json:"summary"`
	FixedIn    string   `json:"fixed_in,omitempty"`
	References []string `json:"references,omitempty"`
}

type AdvisoryReport struct {
	Total     int               `json:"total"`
	Critical  int               `json:"critical"`
	High      int               `json:"high"`
	Medium    int               `json:"medium"`
	Low       int               `json:"low"`
	Findings  []AdvisoryFinding `json:"findings"`
	Scanned   bool              `json:"scanned"`
	RawOutput string            `json:"raw_output,omitempty"`
}

type AgentLock struct {
	// SchemaVersion is the agent.lock schema version (currently 1).
	SchemaVersion int `json:"schema_version"`
	// AgentName is the agent name from agent.yaml.
	AgentName string `json:"agent_name"`
	// AgentVersion is the agent version from agent.yaml.
	AgentVersion string `json:"agent_version"`
	// Runtime is the detected/explicit runtime type (python, langgraph, crewai).
	Runtime string `json:"runtime"`
	// Platform is the target platform (e.g. "linux/arm64").
	Platform string `json:"platform"`
	// BaseImageDigest is the digest-pinned distroless base image.
	BaseImageDigest string `json:"base_image_digest"`
	// HarnessVersion is the version of the harness binary embedded as PID 1.
	HarnessVersion string `json:"harness_version"`
	// BuildInputDigest is the SHA-256 over the canonical build context.
	BuildInputDigest string `json:"build_input_digest"`
	// ImageDigest is the SHA-256 digest of the built OCI image.
	ImageDigest string `json:"image_digest"`
	// SBOMDigest is the SHA-256 digest of the SBOM (SPDX-json).
	SBOMDigest string `json:"sbom_digest"`
	// PolicyDigest is the SHA-256 digest of the policy.yaml.
	// Computed at pack time from the project's policy.yaml.
	PolicyDigest string `json:"policy_digest"`
	// PackageAID is the Agent Identity Document - the public key PEM.
	PackageAID string `json:"package_aid"`
	// PublicKeyFingerprint is the SHA-256 fingerprint of the public key.
	PublicKeyFingerprint string `json:"public_key_fingerprint"`
	// SBOMReferrer is the OCI referrer path for the SBOM artifact.
	SBOMReferrer string `json:"sbom_referrer,omitempty"`
	// SignatureReferrer is the OCI referrer path for the cosign signature.
	SignatureReferrer string `json:"signature_referrer,omitempty"`
	// Reproducibility holds build reproducibility metadata.
	Reproducibility ReproducibilityMeta `json:"reproducibility"`
	// LockfileSignature is the ECDSA signature over the canonical JSON
	// of this struct (with LockfileSignature omitted). Base64-encoded.
	LockfileSignature string `json:"lockfile_signature"`
	// CreatedAt is the wall-clock time the lockfile was created.
	// For reproducibility, this is set to SOURCE_DATE_EPOCH, not time.Now().
	CreatedAt time.Time `json:"created_at"`
	// AgentYAML is the parsed agent.yaml (including LLM config). Stored as part
	// of the lockfile for runtime LLM credential resolution. nil when absent.
	AgentYAML *AgentYAML `json:"agent_yaml,omitempty"`
}

type AgentYAML struct {
	Name        string    `yaml:"name"`
	Version     string    `yaml:"version"`
	Runtime     string    `yaml:"runtime"`
	Entry       string    `yaml:"entry"`
	Description string    `yaml:"description"`
	LLM         LLMConfig `yaml:"llm"`
	Metadata    struct {
		Name        string `yaml:"name"`
		Version     string `yaml:"version"`
		Description string `yaml:"description"`
	} `yaml:"metadata"`
	Spec struct {
		Runtime    string `yaml:"runtime"`
		Entrypoint string `yaml:"entrypoint"`
		Entry      string `yaml:"entry"`
	} `yaml:"spec"`
}

type AuditAppender = audit.AuditAppender

type BuildConfig struct {
	// ProjectDir is the agent project directory to build.
	ProjectDir string
	// Runtime is the detected/explicit runtime type.
	Runtime RuntimeType
	// BaseImage is the distroless base image ref (digest-pinned).
	// Default: "gcr.io/distroless/python3-debian12@sha256:2fdb05402a2cf21cf78fdb3ba4c5db167241e9e498140f5bf689d7efb773731f"
	BaseImage string
	// HarnessPath is the path to the pre-built harness binary to embed as PID 1.
	// If empty, uses the standard harness binary location.
	HarnessPath string
	// SourceDateEpoch is the fixed timestamp for reproducible builds.
	// Default: time.Unix(0, 0) (epoch).
	SourceDateEpoch time.Time
	// NonRootUID is the uid for the non-root user. Default: 64000.
	NonRootUID int
	// ImageTag is the tag for the built image (e.g. "agentpaas/myagent:0.1.0").
	ImageTag string
}

type BuildResult struct {
	ImageDigest string    `json:"image_digest"`
	ImageRef    string    `json:"image_ref"`
	BuildTime   time.Time `json:"build_time"`
	// BuildInputDigest is the SHA-256 over the canonical build context
	// (sorted file list + file contents). Same input -> same digest -> same image.
	BuildInputDigest string `json:"build_input_digest"`
	// DepsLocked is the resolved/locked dependency list from uv.
	DepsLocked []string `json:"deps_locked"`
}

type DeployedAgent struct {
	AgentName    string    `json:"agent_name"`
	ImageDigest  string    `json:"image_digest"`
	SourceDigest string    `json:"source_digest"`
	LockfileSig  string    `json:"lockfile_signature"`
	DeployedAt   time.Time `json:"deployed_at"`
}

type DetectionResult struct {
	Runtime         RuntimeType `json:"runtime"`
	HasAgentYAML    bool        `json:"has_agent_yaml"`
	ProjectDir      string      `json:"project_dir"`
	ExplicitRuntime bool        `json:"explicit_runtime"`
}

type IgnoreMatcher struct {
	// contains filtered or unexported fields
}

type LLMConfig struct {
	Provider   string `yaml:"provider"`   // openai|anthropic|xai
	Model      string `yaml:"model"`      // e.g. "gpt-4o", "claude-sonnet-4", "grok-beta"
	Credential string `yaml:"credential"` // Keychain secret name (e.g. "openai-key")
}

type LockConfig struct {
	// BuildResult is the result from BuildImage (T02).
	BuildResult *BuildResult
	// ScanResult is the result from ScanSecrets (T03).
	ScanResult *ScanResult
	// AgentYAML is the parsed agent.yaml.
	AgentYAML *AgentYAML
	// Runtime is the detected runtime type.
	Runtime RuntimeType
	// BaseImageDigest is the digest-pinned base image.
	BaseImageDigest string
	// HarnessVersion is the harness binary version.
	HarnessVersion string
	// Platform is the target platform.
	Platform string
	// SourceDateEpoch is the fixed timestamp.
	SourceDateEpoch time.Time
	// KeyStore is the identity keystore for package identity key signing.
	KeyStore identityKeyStore
	// KeyID is the package identity key ID to use for signing.
	KeyID string
	// PolicyYAML is the raw policy.yaml file contents. If nil/empty (no policy.yaml
	// in the project), the lockfile's PolicyDigest is left empty for backward compat.
	PolicyYAML []byte
}

type OCILayoutError struct {
	Path   string
	Reason string
	Hint   string
	Cause  error
}

type ReproducibilityMeta struct {
	// SourceDateEpoch is the fixed timestamp used for the build.
	SourceDateEpoch time.Time `json:"source_date_epoch"`
	// BaseImagePinned is true if the base image is digest-pinned.
	BaseImagePinned bool `json:"base_image_pinned"`
	// DepsLocked is true if dependencies were locked via uv.
	DepsLocked bool `json:"deps_locked"`
	// TarOrder is "sorted" for deterministic tar order.
	TarOrder string `json:"tar_order"`
}

type RuntimeType string

type ScanConfig struct {
	// ProjectDir is the agent project directory to scan.
	ProjectDir string
	// Ignore is the .agentpaasignore matcher (from T01).
	Ignore *IgnoreMatcher
	// AllowPatterns are regex patterns for secrets that are explicitly allowed.
	// Each requires a successful audit append (see AuditAppend below).
	AllowPatterns []string
	// AuditAppend is called to record an allow-pattern justification.
	// If nil, --allow-secret-pattern aborts with an error.
	AuditAppend AuditAppender
}

type ScanResult struct {
	// Findings from source tree scan.
	SourceFindings []SecretFinding `json:"source_findings"`
	// Findings from build context scan (after .agentpaasignore applied).
	ContextFindings []SecretFinding `json:"context_findings"`
	// ContextSize is the total build context size in bytes.
	ContextSize int64 `json:"context_size"`
	// ContextSizeWarning is true if ContextSize > 100MB.
	ContextSizeWarning bool `json:"context_size_warning"`
}

type SecretFinding struct {
	// File is the relative path from ProjectDir.
	File string `json:"file"`
	// Line is the 1-based line number.
	Line int `json:"line"`
	// Rule is the gitleaks rule ID that matched.
	Rule string `json:"rule"`
	// Secret is the masked secret value (first 4 chars + *** + last 4 chars).
	Secret string `json:"secret"`
	// contains filtered or unexported fields
}