analyzer

type Analyzer struct {
	// contains filtered or unexported fields
}

type Ecosystem string

type Finding struct {
	RuleID   string   `json:"rule_id"`
	Severity Severity `json:"severity"`
	Title    string   `json:"title"`
	// Detail explains why this matters, referencing real attack patterns.
	Detail string `json:"detail"`
	// File is the path inside the package archive where the signal was found
	// (empty for metadata findings).
	File string `json:"file,omitempty"`
	// Evidence is a short redacted excerpt of the matching content.
	Evidence string `json:"evidence,omitempty"`
}

type Options struct {
	Workers        int           // 0 = auto (2×CPU, capped at 16)
	PackageTimeout time.Duration // per-package budget, 0 = 90s
	// Suppress filters findings accepted in a baseline file. Suppressed
	// findings are dropped from the verdict but counted in Result.Suppressed.
	Suppress func(Package, Finding) bool
}

type Package struct {
	Ecosystem Ecosystem `json:"ecosystem"`
	Name      string    `json:"name"`
	Version   string    `json:"version"`
	// Source is where the dependency was discovered (lockfile path or "cli").
	Source string `json:"source,omitempty"`
}

type Result struct {
	Package    Package       `json:"package"`
	Risk       RiskLevel     `json:"risk"`
	Score      int           `json:"score"`
	Findings   []Finding     `json:"findings,omitempty"`
	Err        string        `json:"error,omitempty"`
	Elapsed    time.Duration `json:"-"`
	DurationMS int64         `json:"duration_ms"`
	// FilesScanned is how many files inside the archive were inspected.
	FilesScanned int `json:"files_scanned"`
	// Suppressed counts findings accepted by the baseline file.
	Suppressed int `json:"suppressed,omitempty"`
}

type RiskLevel int

type Rule interface {
	ID() string
	Check(a *registry.Artifact) []Finding
}

type Severity int