export

type CSAFDoc struct {
	Document CSAFDocument `json:"document"`
	// product_tree and vulnerabilities are omitted when empty rather than emitted as `[]`, which CSAF
	// rejects (its arrays must be non-empty when present).
	ProductTree     *CSAFProductTree    `json:"product_tree,omitempty"`
	Vulnerabilities []CSAFVulnerability `json:"vulnerabilities,omitempty"`
}

type CSAFDocument struct {
	Category    string        `json:"category"`
	CSAFVersion string        `json:"csaf_version"`
	Publisher   CSAFPublisher `json:"publisher"`
	Title       string        `json:"title"`
	Tracking    CSAFTracking  `json:"tracking"`
}

type CSAFEngine struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type CSAFFlag struct {
	Label      string   `json:"label"`
	ProductIDs []string `json:"product_ids"`
}

type CSAFGenerator struct {
	Engine CSAFEngine `json:"engine"`
}

type CSAFProductName struct {
	ProductID string `json:"product_id"`
	Name      string `json:"name"`
}

type CSAFProductStatus struct {
	KnownAffected      []string `json:"known_affected,omitempty"`
	KnownNotAffected   []string `json:"known_not_affected,omitempty"`
	Fixed              []string `json:"fixed,omitempty"`
	UnderInvestigation []string `json:"under_investigation,omitempty"`
}

type CSAFProductTree struct {
	FullProductNames []CSAFProductName `json:"full_product_names"`
}

type CSAFPublisher struct {
	Category  string `json:"category"`
	Name      string `json:"name"`
	Namespace string `json:"namespace"`
}

type CSAFRevision struct {
	Number  string `json:"number"`
	Date    string `json:"date"`
	Summary string `json:"summary"`
}

type CSAFTracking struct {
	ID                 string         `json:"id"`
	Status             string         `json:"status"`
	Version            string         `json:"version"`
	InitialReleaseDate string         `json:"initial_release_date"`
	CurrentReleaseDate string         `json:"current_release_date"`
	Generator          CSAFGenerator  `json:"generator"`
	RevisionHistory    []CSAFRevision `json:"revision_history"`
}

type CSAFVulnID struct {
	SystemName string `json:"system_name"`
	Text       string `json:"text"`
}

type CSAFVulnerability struct {
	CVE           string            `json:"cve,omitempty"`
	IDs           []CSAFVulnID      `json:"ids,omitempty"`
	Flags         []CSAFFlag        `json:"flags,omitempty"`
	ProductStatus CSAFProductStatus `json:"product_status"`
}

type ReachabilityEvidence struct {
	Source string                    `json:"source"` // always "reachability"
	Label  ReachabilityLabel         `json:"label"`
	Tier   judgment.ReachabilityTier `json:"tier,omitempty"`
	Path   []string                  `json:"path,omitempty"`
}

type ReachabilityLabel string

type SARIFArtifactLocation struct {
	URI string `json:"uri"` // repo-relative path (GitHub matches it against the PR diff)
}

type SARIFCodeFlow struct {
	ThreadFlows []SARIFThreadFlow `json:"threadFlows"`
}

type SARIFConfig struct {
	Level string `json:"level"`
}

type SARIFDriver struct {
	Name           string      `json:"name"`
	Version        string      `json:"version"`
	InformationURI string      `json:"informationUri,omitempty"`
	Rules          []SARIFRule `json:"rules"`
}

type SARIFLocation struct {
	// A first-party finding (SAST/secret/misconfig) has a source file:line -> physicalLocation, so a
	// code-scanning UI annotates the exact line. An SCA finding is about a dependency, not a source
	// line -> logicalLocation module. Exactly one is set per location.
	PhysicalLocation *SARIFPhysicalLocation `json:"physicalLocation,omitempty"`
	LogicalLocations []SARIFLogicalLocation `json:"logicalLocations,omitempty"`
}

type SARIFLog struct {
	Schema  string     `json:"$schema"`
	Version string     `json:"version"`
	Runs    []SARIFRun `json:"runs"`
}

type SARIFLogicalLocation struct {
	Name string `json:"name"`
	Kind string `json:"kind,omitempty"`
}

type SARIFMultiformatText struct {
	Text     string `json:"text"`
	Markdown string `json:"markdown,omitempty"`
}

type SARIFOptions struct {
	// Manifest returns the repo-relative manifest/lockfile that declares a dependency finding's
	// component, so the result gets a physical location a code-scanning UI can annotate. "" when unknown.
	Manifest func(finding.Finding) string
	// Fix returns the version that remediates a dependency finding. "" when there is no fix or it is unknown.
	Fix func(finding.Finding) string
	// AIGateExemption returns policy metadata only when the finding's exemption has already passed the
	// server-owned authorization re-check. SARIF renders it as an external accepted suppression while
	// retaining the result. Advisory or review-required opinions must return false.
	AIGateExemption func(finding.Finding) (ports.AIGateExemption, bool)
	// RuleMeta returns the catalog entry for a rule id. Without it a result carries only an id, a title
	// and a level, which is what made the output hard to act on: no rule link, no rationale, no fix.
	// Returning false leaves the rule with just the fields derived from the finding.
	RuleMeta func(ruleID string) (SARIFRuleMeta, bool)
}

type SARIFPhysicalLocation struct {
	ArtifactLocation SARIFArtifactLocation `json:"artifactLocation"`
	Region           *SARIFRegion          `json:"region,omitempty"`
}

type SARIFRegion struct {
	StartLine   int `json:"startLine"` // 1-based; SARIF requires >= 1
	StartColumn int `json:"startColumn,omitempty"`
}

type SARIFResult struct {
	RuleID       string             `json:"ruleId"`
	Level        string             `json:"level"`
	Message      SARIFText          `json:"message"`
	Locations    []SARIFLocation    `json:"locations,omitempty"`
	CodeFlows    []SARIFCodeFlow    `json:"codeFlows,omitempty"`
	Suppressions []SARIFSuppression `json:"suppressions,omitempty"`
	Properties   map[string]any     `json:"properties,omitempty"`
}

type SARIFRule struct {
	ID               string     `json:"id"`
	Name             string     `json:"name,omitempty"`
	ShortDescription SARIFText  `json:"shortDescription"`
	FullDescription  *SARIFText `json:"fullDescription,omitempty"`
	// Help is what a code-scanning UI shows when a reader opens the alert, so the remediation goes here
	// rather than only in the message.
	Help                 *SARIFMultiformatText `json:"help,omitempty"`
	HelpURI              string                `json:"helpUri,omitempty"`
	DefaultConfiguration *SARIFConfig          `json:"defaultConfiguration,omitempty"`
	Properties           map[string]any        `json:"properties,omitempty"`
}

type SARIFRuleMeta struct {
	Name        string   // catalog name, when it is more precise than the finding title
	Description string   // what the rule checks -> fullDescription
	Rationale   string   // why it matters -> help
	Remediation string   // how to fix it -> help
	HelpURI     string   // a page that resolves today -> helpUri
	Tags        []string // language / category tags -> properties.tags
	CWE         []string
	OWASP       []string
	Precision   string // "high" | "medium" | "low", when the catalog states it
}

type SARIFRun struct {
	Tool    SARIFTool     `json:"tool"`
	Results []SARIFResult `json:"results"`
}

type SARIFSuppression struct {
	Kind          string `json:"kind"`
	Status        string `json:"status,omitempty"`
	Justification string `json:"justification,omitempty"`
}

type SARIFText struct {
	Text string `json:"text"`
}

type SARIFThreadFlow struct {
	Locations []SARIFThreadFlowLocation `json:"locations"`
}

type SARIFThreadFlowLocation struct {
	Location SARIFLocation `json:"location"`
}

type SARIFTool struct {
	Driver SARIFDriver `json:"driver"`
}

type Service struct {
	// contains filtered or unexported fields
}

type VEXDoc struct {
	Context    string         `json:"@context"`
	ID         string         `json:"@id"`
	Author     string         `json:"author"`
	Timestamp  string         `json:"timestamp"`
	Version    int            `json:"version"`
	Tooling    string         `json:"tooling,omitempty"`
	Supersedes []VEXDocRef    `json:"supersedes,omitempty"`
	Statements []VEXStatement `json:"statements"`
}

type VEXDocRef struct {
	ID string `json:"@id"`
}

type VEXProduct struct {
	ID string `json:"@id"`
}

type VEXStatement struct {
	Vulnerability VEXVuln      `json:"vulnerability"`
	Products      []VEXProduct `json:"products"`
	Status        string       `json:"status"`
	Justification string       `json:"justification,omitempty"`
	// Timestamp is the per-statement assertion time (when the finding's status was last evaluated). Per the
	// OpenVEX spec a statement without one inherits the document timestamp; emitting it explicitly lets a
	// consumer age each assertion independently.
	Timestamp string `json:"timestamp,omitempty"`
}

type VEXVuln struct {
	Name string `json:"name"`
}