export

type SARIFArtifactLocation struct {
	URI string `json:"uri"` // repo-relative path (GitHub matches it against the PR diff)
}

type SARIFConfig struct {
	Level string `json:"level"`
}

type SARIFDriver struct {
	Name           string      `json:"name"`
	Version        string      `json:"version"`
	InformationURI string      `json:"informationUri,omitempty"`
	Rules          []SARIFRule `json:"rules"`
}

type SARIFLocation struct {
	// A first-party finding (SAST/secret/misconfig) has a source file:line -> physicalLocation, so a
	// code-scanning UI annotates the exact line. An SCA finding is about a dependency, not a source
	// line -> logicalLocation module. Exactly one is set per location.
	PhysicalLocation *SARIFPhysicalLocation `json:"physicalLocation,omitempty"`
	LogicalLocations []SARIFLogicalLocation `json:"logicalLocations,omitempty"`
}

type SARIFLog struct {
	Schema  string     `json:"$schema"`
	Version string     `json:"version"`
	Runs    []SARIFRun `json:"runs"`
}

type SARIFLogicalLocation struct {
	Name string `json:"name"`
	Kind string `json:"kind,omitempty"`
}

type SARIFOptions struct {
	// Manifest returns the repo-relative manifest/lockfile that declares a dependency finding's
	// component, so the result gets a physical location a code-scanning UI can annotate. "" when unknown.
	Manifest func(finding.Finding) string
	// Fix returns the version that remediates a dependency finding. "" when there is no fix or it is unknown.
	Fix func(finding.Finding) string
	// AIGateExemption returns policy metadata only when the finding's exemption has already passed the
	// server-owned authorization re-check. SARIF renders it as an external accepted suppression while
	// retaining the result. Advisory or review-required opinions must return false.
	AIGateExemption func(finding.Finding) (ports.AIGateExemption, bool)
}

type SARIFPhysicalLocation struct {
	ArtifactLocation SARIFArtifactLocation `json:"artifactLocation"`
	Region           *SARIFRegion          `json:"region,omitempty"`
}

type SARIFRegion struct {
	StartLine int `json:"startLine"` // 1-based; SARIF requires >= 1
}

type SARIFResult struct {
	RuleID       string             `json:"ruleId"`
	Level        string             `json:"level"`
	Message      SARIFText          `json:"message"`
	Locations    []SARIFLocation    `json:"locations,omitempty"`
	Suppressions []SARIFSuppression `json:"suppressions,omitempty"`
	Properties   map[string]any     `json:"properties,omitempty"`
}

type SARIFRule struct {
	ID                   string       `json:"id"`
	ShortDescription     SARIFText    `json:"shortDescription"`
	HelpURI              string       `json:"helpUri,omitempty"`
	DefaultConfiguration *SARIFConfig `json:"defaultConfiguration,omitempty"`
}

type SARIFRun struct {
	Tool    SARIFTool     `json:"tool"`
	Results []SARIFResult `json:"results"`
}

type SARIFSuppression struct {
	Kind          string `json:"kind"`
	Status        string `json:"status,omitempty"`
	Justification string `json:"justification,omitempty"`
}

type SARIFText struct {
	Text string `json:"text"`
}

type SARIFTool struct {
	Driver SARIFDriver `json:"driver"`
}

type Service struct {
	// contains filtered or unexported fields
}

type VEXDoc struct {
	Context    string         `json:"@context"`
	ID         string         `json:"@id"`
	Author     string         `json:"author"`
	Timestamp  string         `json:"timestamp"`
	Version    int            `json:"version"`
	Tooling    string         `json:"tooling,omitempty"`
	Statements []VEXStatement `json:"statements"`
}

type VEXProduct struct {
	ID string `json:"@id"`
}

type VEXStatement struct {
	Vulnerability VEXVuln      `json:"vulnerability"`
	Products      []VEXProduct `json:"products"`
	Status        string       `json:"status"`
	Justification string       `json:"justification,omitempty"`
}

type VEXVuln struct {
	Name string `json:"name"`
}