jvmreach

type Analyzer struct {
	Runner       Runner
	Logger       *zap.Logger
	CacheDir     string
	CacheTTL     time.Duration
	DisableCache bool
}

type Runner interface {
	// Name returns a stable identifier (e.g. "library") used in
	// telemetry and Reason fields.
	Name() string
	// Version returns the runner schema version. The result cache
	// folds it into its key so scanner upgrades invalidate prior
	// entries automatically.
	Version() string
	// Run walks projectDir and returns the imported-artifact set.
	// projectDir must look like a JVM project root (pom.xml,
	// build.gradle(.kts), build.sbt, or settings.gradle(.kts)).
	Run(ctx context.Context, projectDir string) (RunnerResult, error)
}

type RunnerResult struct {
	// ImportedArtifacts is the set of Maven coordinates ("group:artifact",
	// lowercase) that the prefix map resolved from source-level
	// imports. The analyzer matches graph packages against this set
	// before walking transitive deps.
	ImportedArtifacts map[string]struct{}
	// RawImports is the set of source-level fully qualified imports.
	// The analyzer uses it to resolve references between local modules.
	RawImports map[string]struct{}
	// SourceFiles is the count of project source files visited
	// (.java / .kt / .kts / .scala / .groovy).
	SourceFiles int
	// SkippedDirs lists directory names skipped during the walk
	// (target/, build/, .gradle/, etc.) for debug logging.
	SkippedDirs []string
	// DynamicImportsDetected is true when the runner observed
	// reflection-based class loading the static scanner cannot
	// follow: Class.forName(name) on a variable, ClassLoader.loadClass,
	// ServiceLoader.load, ResourceBundle.getBundle on a variable. When
	// true, an "unreachable" verdict is necessarily incomplete and the
	// per-vuln Reachability.DynamicImportsDetected flag is set.
	DynamicImportsDetected bool
}