vuln

type Evidence struct {
	Component   sbom.Component
	Coord       vulndb.Coord
	UsedSymbols map[string]bool // symbols/imports observed in the artifact
	HaveSymbols bool            // whether symbol evidence was available at all
}

type Fix struct {
	// Type is "upgrade" when a fixed version exists, else "no-fix".
	Type      string `json:"type"`
	Ecosystem string `json:"ecosystem"`
	Package   string `json:"package"`
	From      string `json:"from"`
	To        string `json:"to,omitempty"`
	// Action is a terse imperative an agent can act on directly.
	Action string `json:"action"`
}

type MapSymbolSource map[string][]string

type Module struct {
	// contains filtered or unexported fields
}

type Options struct {
	// DB is the advisory source. When nil, the module loads DBPath if set,
	// otherwise the embedded bootstrap snapshot.
	DB     *vulndb.DB
	DBPath string

	// Now is the injected clock used for DB staleness and waiver expiry. Zero
	// disables both time-dependent behaviors, keeping analysis deterministic.
	Now time.Time

	// VEX holds OpenVEX statements that suppress not-affected/fixed findings.
	VEX []VEXStatement
	// Waivers are operator allowlist entries with a justification and expiry.
	Waivers []Waiver

	// Reachability, when set, judges whether a vulnerable symbol is plausibly
	// reached and can emit not_reachable VEX drafts. Nil means "always
	// reachable" — the safe default that suppresses nothing.
	Reachability Reachability
	// Symbols supplies per-component symbol evidence for reachability. Nil means
	// no evidence, so reachability never concludes not-reached (no false
	// negatives from a missing symbol table).
	Symbols SymbolSource
}

type Reachability interface {
	Reached(ev Evidence, adv vulndb.Advisory) Verdict
}

type SymbolReachability struct{}

type SymbolSource interface {
	// Symbols returns the set of symbols/imports observed for a component and
	// whether any symbol information was available.
	Symbols(c sbom.Component) (used map[string]bool, have bool)
}

type VEXStatement struct {
	Vuln          string   // CVE/GHSA id the statement is about
	Products      []string // product identifiers (PURLs); empty = applies to all
	Status        vexStatus
	Justification string
}

type Verdict struct {
	Reached    bool
	Reason     string
	Confidence string // "high" | "medium" | "low"
}

type Waiver struct {
	Vulnerability string    // CVE/GHSA id, or "*"/"" for any
	Package       string    // package name, or "*"/"" for any
	Reason        string    // required justification (audit trail)
	Expires       time.Time // zero = never expires
}