discovery

type FreshnessConfig struct {
	Sources       SourceConfig   `json:"sources"`
	Severity      SeverityConfig `json:"severity"`
	Vulnerability VulnConfig     `json:"vulnerability"`
	Registries    RegistryConfig `json:"registries"`
	Ignore        []string       `json:"ignore"`
	PackageRules  []PackageRule  `json:"package_rules"`
	Groups        []Group        `json:"groups"`
	Timeout       int            `json:"timeout"`   // HTTP timeout in seconds (default 10)
	CacheTTLSecs  int            `json:"cache_ttl"` // cache TTL in seconds (default 300; 0 = cache forever; <0 = never cache)

	// MinReleaseAge is a supply-chain cooldown: freshness will not recommend (and so
	// stagefreight will not auto-adopt) a release published more recently than this window.
	// Most malicious npm publishes — compromised maintainer tokens, typosquats — are caught
	// and yanked within hours to days, so a cooldown sidesteps that exposure window. Accepts
	// "7d", "2w", "72h", or any Go duration. Empty/0 = disabled. Implemented for npm (the
	// registry exposes per-version publish times); other ecosystems ignore it until wired.
	MinReleaseAge string `json:"min_release_age"`

	// FetchVersionLists is a capability flag (NOT a policy): when set, resolvers that
	// would otherwise fetch only the latest version also retrieve the full published
	// version list into Dependency.AvailableVersions. The deps layer enables it solely
	// under a patch-lock ceiling — the only case that re-targets to a lower in-range
	// version and thus needs the list — so the default path pays no extra network. A
	// resolver that already has the list for free (cargo) populates it regardless.
	FetchVersionLists bool `json:"fetch_version_lists"`
}

type Group struct {
	Name                string `json:"name"`
	CommitMessagePrefix string `json:"commit_message_prefix"`
	Automerge           *bool  `json:"automerge"`      // group-level automerge default
	SeparateMajor       bool   `json:"separate_major"` // split major bumps into own MR
}

type PackageRule struct {
	// Pattern matching — all specified fields must match (AND logic).
	MatchPackages      []string `json:"match_packages"`      // glob patterns on dependency name
	MatchEcosystems    []string `json:"match_ecosystems"`    // ecosystem constants (docker-image, gomod, etc.)
	MatchUpdateTypes   []string `json:"match_update_types"`  // "major", "minor", "patch"
	MatchVulnerability *bool    `json:"match_vulnerability"` // true = only match deps with known CVEs

	// Overrides applied when matched.
	Enabled  *bool           `json:"enabled"`  // false = skip this dependency entirely
	Severity *SeverityConfig `json:"severity"` // override severity/tolerance for matched deps
	Group    string          `json:"group"`    // assign to a named group (for future MR batching)

	// Future update-mode fields (wired later, config-shape reserved now).
	Automerge *bool `json:"automerge"` // auto-merge MR if CI passes
}

type RegistryConfig struct {
	Docker *RegistryEndpoint `json:"docker"`
	Go     *RegistryEndpoint `json:"go"`
	Npm    *RegistryEndpoint `json:"npm"`
	PyPI   *RegistryEndpoint `json:"pypi"`
	Crates *RegistryEndpoint `json:"crates"`
	Alpine *RegistryEndpoint `json:"alpine"`
	Debian *RegistryEndpoint `json:"debian"`
	Ubuntu *RegistryEndpoint `json:"ubuntu"`
	GitHub *RegistryEndpoint `json:"github"` // GitHub API for tool version checks
}

type RegistryEndpoint struct {
	URL     string `json:"url"`      // base URL (e.g. "https://jcr.pcfae.com/v2")
	AuthEnv string `json:"auth_env"` // env var name holding auth token (Bearer)
}

type Resolver struct {
	// contains filtered or unexported fields
}

type SeverityConfig struct {
	Major int `json:"major"` // 0=info, 1=warning, 2=critical (default: 2)
	Minor int `json:"minor"` // default: 1
	Patch int `json:"patch"` // default: 0

	MajorTolerance int `json:"major_tolerance"` // default: 0
	MinorTolerance int `json:"minor_tolerance"` // default: 0
	PatchTolerance int `json:"patch_tolerance"` // default: 1
}

type SourceConfig struct {
	DockerImages   *bool `json:"docker_images"`
	GitHubReleases *bool `json:"github_releases"`
	GoModules      *bool `json:"go_modules"`
	RustCrates     *bool `json:"rust_crates"`
	NpmPackages    *bool `json:"npm_packages"`
	AlpineAPK      *bool `json:"alpine_apk"`
	DebianAPT      *bool `json:"debian_apt"`
	PipPackages    *bool `json:"pip_packages"`
}

type VulnConfig struct {
	Enabled          *bool  `json:"enabled"`           // default true
	MinSeverity      string `json:"min_severity"`      // "low", "moderate", "high", "critical" (default: "moderate")
	SeverityOverride *bool  `json:"severity_override"` // CVE-affected deps escalate to critical (default: true)
}