asm

type CertChange struct {
	Before TLSCert `json:"before"`
	After  TLSCert `json:"after"`
}

type CertDiff struct {
	SetDiff[TLSCert]
	Changed []CertChange `json:"changed"`
}

type DNSRecord struct {
	Host  string `json:"host"`
	Type  string `json:"type"`
	Value string `json:"value"`
}

type Diff struct {
	Subdomains SubdomainDiff      `json:"subdomains"`
	DNSRecords SetDiff[DNSRecord] `json:"dns_records"`
	TLSCerts   CertDiff           `json:"tls_certs"`
	IPInfo     IPInfoDiff         `json:"ip_info"`
}

type FieldChange struct {
	Field  string `json:"field"`
	Before string `json:"before"`
	After  string `json:"after"`
}

type IPInfo struct {
	IP    string          `json:"ip"`
	Data  json.RawMessage `json:"data"`
	Error string          `json:"error,omitempty"`
}

type IPInfoChange struct {
	IP     string        `json:"ip"`
	Fields []FieldChange `json:"fields"`
}

type IPInfoDiff struct {
	// Compared is false when the previous scan predates IP lookups, so there
	// is no baseline and nothing else in the diff is meaningful.
	Compared bool `json:"compared"`
	SetDiff[IPInfo]
	Changed []IPInfoChange `json:"changed"`
}

type OpenPort struct {
	Port     int    `json:"port"`
	Protocol string `json:"protocol"`
}

type Options struct {
	// SubfinderProviderConfig is the path to a subfinder provider-config.yaml
	// holding API keys for passive sources. Optional.
	SubfinderProviderConfig string
	// SubfinderMaxTime caps passive enumeration time.
	SubfinderMaxTime time.Duration
	// Resolvers overrides the DNS resolvers used by dnsx ("udp:1.1.1.1:53").
	// When empty, dnsx's public resolvers are used, falling back to the
	// system resolver if they are unreachable.
	Resolvers []string
	// DNSConcurrency is the number of hosts resolved in parallel.
	DNSConcurrency int
	// TLSConcurrency is the number of hosts probed for TLS in parallel.
	TLSConcurrency int
	// TLSPorts are the ports probed for certificates.
	TLSPorts []int
	// TLSTimeout is the per-connection timeout.
	TLSTimeout time.Duration
	// IPInfoToken authenticates ipinfo.io lookups. Optional: without it the
	// free tier's lower rate limits apply.
	IPInfoToken string
	// IPInfoBaseURL defaults to https://ipinfo.io.
	IPInfoBaseURL string
	// IPInfoConcurrency is the number of ipinfo lookups in flight.
	IPInfoConcurrency int
	// HTTPClient is used for ipinfo lookups.
	HTTPClient *http.Client
	// PortScan enables the naabu port-scanning stage. A full SYN scan of all
	// TCP ports is heavy and needs raw-socket privileges, so it is opt-in.
	PortScan bool
	// SkipIPDR disables the IPDR stage (IP data records via ipinfo.io).
	SkipIPDR bool
	// SkipCerts disables the certificate stage (TLS inspection via tlsx).
	SkipCerts bool
	// PortScanType selects the naabu scan mode: "syn" (half-open, needs raw
	// sockets, libpcap and a routable interface) or "connect" (full TCP
	// connect, works through NAT such as a Docker bridge / WSL2). Defaults to
	// "syn".
	PortScanType string
	// PortScanPorts is the naabu port spec; "-" means all 65535 TCP ports.
	PortScanPorts string
	// PortScanRate is packets per second.
	PortScanRate int
	// PortScanRetries is the per-port retry count.
	PortScanRetries int
	// PortScanThreads is naabu's worker count.
	PortScanThreads int
	// PortScanTimeout is the per-port timeout.
	PortScanTimeout time.Duration
	// Logger receives stage diagnostics. Defaults to slog.Default().
	Logger *slog.Logger
}

type PortScan struct {
	IP    string     `json:"ip"`
	Hosts []string   `json:"hosts"`
	Ports []OpenPort `json:"ports"`
}

type ProgressFunc func(Stage)

type Result struct {
	Domain     string      `json:"domain"`
	Subdomains []Subdomain `json:"subdomains"`
	DNSRecords []DNSRecord `json:"dns_records"`
	TLSCerts   []TLSCert   `json:"tls_certs"`
	IPInfo     []IPInfo    `json:"ip_info"`
	PortScans  []PortScan  `json:"port_scans"`
}

type Scanner struct {
	// contains filtered or unexported fields
}

type SetDiff[T any] struct {
	Added   []T `json:"added"`
	Removed []T `json:"removed"`
}

type Stage string

type Subdomain struct {
	Host    string   `json:"host"`
	Sources []string `json:"sources"`
	// CarriedOver is true when no source reported the host in this scan and
	// it was kept from an earlier one (subdomains are append-only).
	CarriedOver bool `json:"carried_over"`
}

type SubdomainDiff struct {
	SetDiff[Subdomain]
	NoLongerReported []Subdomain `json:"no_longer_reported"`
}

type TLSCert struct {
	Host              string    `json:"host"`
	IP                string    `json:"ip"`
	Port              int       `json:"port"`
	TLSVersion        string    `json:"tls_version"`
	Cipher            string    `json:"cipher"`
	SubjectCN         string    `json:"subject_cn"`
	SubjectOrg        []string  `json:"subject_org"`
	SANs              []string  `json:"sans"`
	IssuerCN          string    `json:"issuer_cn"`
	IssuerOrg         []string  `json:"issuer_org"`
	Serial            string    `json:"serial"`
	NotBefore         time.Time `json:"not_before"`
	NotAfter          time.Time `json:"not_after"`
	Expired           bool      `json:"expired"`
	SelfSigned        bool      `json:"self_signed"`
	Mismatched        bool      `json:"mismatched"`
	Wildcard          bool      `json:"wildcard"`
	FingerprintSHA256 string    `json:"fingerprint_sha256"`
}

type Target struct {
	Domain string
	// KnownSubdomains are subdomains found by earlier scans of Domain. They
	// are kept in the result even if passive sources no longer report them,
	// and still go through DNS and TLS so their current state is captured.
	KnownSubdomains []Subdomain
}