attest

type ActionInfo struct {
	// Type is the action class (e.g. "build", "deploy", "patch", "config-change").
	Type string `json:"type"`
	// Tool is the tool or API the agent invoked.
	Tool string `json:"tool,omitempty"`
	// Target is what the action affected (e.g. an image ref or resource name).
	Target string `json:"target,omitempty"`
}

type Agent struct {
	// ID is a stable identifier for the agent/automation (e.g.
	// "ci-bot@corp.example" or a service account).
	ID string `json:"id"`
	// Model names the model that drove the agent, if any (e.g. "claude-opus-4").
	Model string `json:"model,omitempty"`
	// Version is the agent software version.
	Version string `json:"version,omitempty"`
}

type AgentAction struct {
	Agent     Agent      `json:"agent"`
	Prompt    PromptRef  `json:"prompt"`
	Action    ActionInfo `json:"action"`
	Timestamp time.Time  `json:"timestamp"`
}

type BuildDefinition struct {
	// BuildType is a URI naming the build process convention.
	BuildType string `json:"buildType"`
	// ExternalParameters are the top-level, externally supplied inputs (e.g. the
	// source repo and ref).
	ExternalParameters map[string]string `json:"externalParameters,omitempty"`
	// ResolvedDependencies pins the materials the build consumed.
	ResolvedDependencies []ResourceDescriptor `json:"resolvedDependencies,omitempty"`
}

type BuildMeta struct {
	InvocationID string     `json:"invocationId,omitempty"`
	StartedOn    *time.Time `json:"startedOn,omitempty"`
	FinishedOn   *time.Time `json:"finishedOn,omitempty"`
}

type Builder struct {
	ID string `json:"id"`
}

type OpenVEX struct {
	Context    string         `json:"@context"`
	ID         string         `json:"@id"`
	Author     string         `json:"author"`
	Timestamp  time.Time      `json:"timestamp"`
	Version    int            `json:"version"`
	Statements []VEXStatement `json:"statements"`
}

type PromptRef struct {
	// SHA256 is the hex SHA-256 of the exact prompt/instruction bytes.
	SHA256 string `json:"sha256"`
	// Summary is an optional short, non-sensitive human description.
	Summary string `json:"summary,omitempty"`
}

type Requirement struct {
	// ExpectedDigest is the "sha256:<hex>" the statement's subject must match.
	// Required — an empty expected digest is a programming error, not "any".
	ExpectedDigest string
	// PredicateType, if set, is the exact predicate type that must be present.
	PredicateType string
	// Policy constrains the acceptable signer identity/issuer.
	Policy sig.Policy
}

type ResourceDescriptor struct {
	URI    string            `json:"uri,omitempty"`
	Digest map[string]string `json:"digest,omitempty"`
}

type Result struct {
	// Signer is the trust-root outcome (which key/identity vouched).
	Signer sig.VerifyResult
	// Statement is the verified in-toto statement (predicate available raw).
	Statement *Statement
}

type RunDetails struct {
	Builder    Builder    `json:"builder"`
	Metadata   BuildMeta  `json:"metadata,omitempty"`
	Byproducts []struct{} `json:"byproducts,omitempty"`
}

type SLSAProvenance struct {
	BuildDefinition BuildDefinition `json:"buildDefinition"`
	RunDetails      RunDetails      `json:"runDetails"`
}

type Statement struct {
	Type          string          `json:"_type"`
	Subject       []Subject       `json:"subject"`
	PredicateType string          `json:"predicateType"`
	Predicate     json.RawMessage `json:"predicate"`
}

type Subject struct {
	Name   string            `json:"name"`
	Digest map[string]string `json:"digest"`
}

type VEXStatement struct {
	Vulnerability VEXVuln   `json:"vulnerability"`
	Products      []string  `json:"products"`
	Status        VEXStatus `json:"status"`
	// Justification explains a not_affected status (e.g.
	// "vulnerable_code_not_in_execute_path").
	Justification string `json:"justification,omitempty"`
}

type VEXStatus string

type VEXVuln struct {
	Name string `json:"name"` // e.g. "CVE-2024-0001"
}

type VSA struct {
	Verifier           VSAVerifier   `json:"verifier"`
	TimeVerified       time.Time     `json:"timeVerified"`
	ResourceURI        string        `json:"resourceUri"`
	Policy             VSAPolicy     `json:"policy"`
	VerificationResult VerdictResult `json:"verificationResult"`
	// VerifiedLevels lists the properties that passed (e.g. "SIGNED",
	// "SLSA_PROVENANCE", "SBOM_PRESENT").
	VerifiedLevels []string `json:"verifiedLevels"`
}

type VSAPolicy struct {
	URI string `json:"uri,omitempty"`
}

type VSAVerifier struct {
	ID string `json:"id"`
}

type VerdictResult string