model

type CPE struct {
	// Value is the CPE string identifier.
	Value string `json:"cpe"`

	// Source is the source where this CPE was obtained or generated from.
	Source string `json:"source,omitempty"`
}

type Descriptor struct {
	// Name is the name of the tool that generated this SBOM (e.g., "syft").
	Name string `json:"name"`

	// Version is the version of the tool that generated this SBOM.
	Version string `json:"version"`

	// Configuration contains the tool configuration used during SBOM generation.
	Configuration any `json:"configuration,omitempty"`
}

type Document struct {
	Artifacts             []Package      `json:"artifacts"` // Artifacts is the list of packages discovered and placed into the catalog
	ArtifactRelationships []Relationship `json:"artifactRelationships"`
	Files                 []File         `json:"files,omitempty"` // note: must have omitempty
	Source                Source         `json:"source"`          // Source represents the original object that was cataloged
	Distro                LinuxRelease   `json:"distro"`          // Distro represents the Linux distribution that was detected from the source
	Descriptor            Descriptor     `json:"descriptor"`      // Descriptor is a block containing self-describing information about syft
	Schema                Schema         `json:"schema"`          // Schema is a block reserved for defining the version for the shape of this JSON document and where to find the schema document to validate the shape
}

type File struct {
	// ID is a unique identifier for this file within the SBOM.
	ID string `json:"id"`

	// Location is the file path and layer information where this file was found.
	Location file.Coordinates `json:"location"`

	// Metadata contains filesystem metadata such as permissions, ownership, and file type.
	Metadata *FileMetadataEntry `json:"metadata,omitempty"`

	// Contents is the file contents for small files.
	Contents string `json:"contents,omitempty"`

	// Digests contains cryptographic hashes of the file contents.
	Digests []file.Digest `json:"digests,omitempty"`

	// Licenses contains license information discovered within this file.
	Licenses []FileLicense `json:"licenses,omitempty"`

	// Executable contains executable metadata if this file is a binary.
	Executable *file.Executable `json:"executable,omitempty"`

	// Unknowns contains unknown fields for forward compatibility.
	Unknowns []string `json:"unknowns,omitempty"`
}

type FileLicense struct {
	// Value is the raw license identifier or text as found in the file.
	Value string `json:"value"`

	// SPDXExpression is the parsed SPDX license expression.
	SPDXExpression string `json:"spdxExpression"`

	// Type is the license type classification (e.g., declared, concluded, discovered).
	Type license.Type `json:"type"`

	// Evidence contains supporting evidence for this license detection.
	Evidence *FileLicenseEvidence `json:"evidence,omitempty"`
}

type FileLicenseEvidence struct {
	// Confidence is the confidence score for this license detection (0-100).
	Confidence int `json:"confidence"`

	// Offset is the byte offset where the license text starts in the file.
	Offset int `json:"offset"`

	// Extent is the length of the license text in bytes.
	Extent int `json:"extent"`
}

type FileMetadataEntry struct {
	// Mode is the Unix file permission mode in octal format.
	Mode int `json:"mode"`

	// Type is the file type (e.g., "RegularFile", "Directory", "SymbolicLink").
	Type string `json:"type"`

	// LinkDestination is the target path for symbolic links.
	LinkDestination string `json:"linkDestination,omitempty"`

	// UserID is the file owner user ID.
	UserID int `json:"userID"`

	// GroupID is the file owner group ID.
	GroupID int `json:"groupID"`

	// MIMEType is the MIME type of the file contents.
	MIMEType string `json:"mimeType"`

	// Size is the file size in bytes.
	Size int64 `json:"size"`
}

type IDLikes []string

type License struct {
	// Value is the raw license identifier or expression as found.
	Value string `json:"value"`

	// SPDXExpression is the parsed SPDX license expression.
	SPDXExpression string `json:"spdxExpression"`

	// Type is the license type classification (e.g., declared, concluded, discovered).
	Type license.Type `json:"type"`

	// URLs are URLs where license text or information can be found.
	URLs []string `json:"urls"`

	// Locations are file locations where this license was discovered.
	Locations []file.Location `json:"locations"`

	// Contents is the full license text content.
	Contents string `json:"contents,omitempty"`
}

type LinuxRelease struct {
	// PrettyName is a human-readable operating system name with version.
	PrettyName string `json:"prettyName,omitempty"`

	// Name is the operating system name without version information.
	Name string `json:"name,omitempty"`

	// ID is the lower-case operating system identifier (e.g., "ubuntu", "rhel").
	ID string `json:"id,omitempty"`

	// IDLike is a list of operating system IDs this distribution is similar to or derived from.
	IDLike IDLikes `json:"idLike,omitempty"`

	// Version is the operating system version including codename if available.
	Version string `json:"version,omitempty"`

	// VersionID is the operating system version number or identifier.
	VersionID string `json:"versionID,omitempty"`

	// VersionCodename is the operating system release codename (e.g., "jammy", "bullseye").
	VersionCodename string `json:"versionCodename,omitempty"`

	// BuildID is a build identifier for the operating system.
	BuildID string `json:"buildID,omitempty"`

	// ImageID is an identifier for container or cloud images.
	ImageID string `json:"imageID,omitempty"`

	// ImageVersion is the version for container or cloud images.
	ImageVersion string `json:"imageVersion,omitempty"`

	// Variant is the operating system variant name (e.g., "Server", "Workstation").
	Variant string `json:"variant,omitempty"`

	// VariantID is the lower-case operating system variant identifier.
	VariantID string `json:"variantID,omitempty"`

	// HomeURL is the homepage URL for the operating system.
	HomeURL string `json:"homeURL,omitempty"`

	// SupportURL is the support or help URL for the operating system.
	SupportURL string `json:"supportURL,omitempty"`

	// BugReportURL is the bug reporting URL for the operating system.
	BugReportURL string `json:"bugReportURL,omitempty"`

	// PrivacyPolicyURL is the privacy policy URL for the operating system.
	PrivacyPolicyURL string `json:"privacyPolicyURL,omitempty"`

	// CPEName is the Common Platform Enumeration name for the operating system.
	CPEName string `json:"cpeName,omitempty"`

	// SupportEnd is the end of support date or version identifier.
	SupportEnd string `json:"supportEnd,omitempty"`

	// ExtendedSupport indicates whether extended security or support is available.
	ExtendedSupport bool `json:"extendedSupport,omitempty"`
}

type Package struct {
	PackageBasicData
	PackageCustomData
}

type PackageBasicData struct {
	ID        string          `json:"id"`
	Name      string          `json:"name"`
	Version   string          `json:"version"`
	Type      pkg.Type        `json:"type"`
	FoundBy   string          `json:"foundBy"`
	Locations []file.Location `json:"locations"`
	Licenses  licenses        `json:"licenses"`
	Language  pkg.Language    `json:"language"`
	CPEs      cpes            `json:"cpes"`
	PURL      string          `json:"purl"`
}

type PackageCustomData struct {
	MetadataType string `json:"metadataType,omitempty"`
	Metadata     any    `json:"metadata,omitempty"`
}

type Relationship struct {
	// Parent is the ID of the parent artifact in this relationship.
	Parent string `json:"parent"`

	// Child is the ID of the child artifact in this relationship.
	Child string `json:"child"`

	// Type is the relationship type (e.g., "contains", "dependency-of", "ancestor-of").
	Type string `json:"type"`

	// Metadata contains additional relationship-specific metadata.
	Metadata any `json:"metadata,omitempty"`
}

type Schema struct {
	// Version is the JSON schema version for this document format.
	Version string `json:"version"`

	// URL is the URL to the JSON schema definition document.
	URL string `json:"url"`
}

type Secrets struct {
	Location file.Coordinates    `json:"location"`
	Secrets  []file.SearchResult `json:"secrets"`
}

type Source struct {
	// ID is a unique identifier for the analyzed source artifact.
	ID string `json:"id"`

	// Name is the name of the analyzed artifact (e.g., image name, directory path).
	Name string `json:"name"`

	// Version is the version of the analyzed artifact (e.g., image tag).
	Version string `json:"version"`

	// Supplier is supplier information, which can be user-provided for NTIA minimum elements compliance.
	Supplier string `json:"supplier,omitempty"`

	// Type is the source type (e.g., "image", "directory", "file").
	Type string `json:"type"`

	// Metadata contains additional source-specific metadata.
	Metadata any `json:"metadata"`
}