osv

type Affected struct {
	Versions []string `json:"versions"`
	Ranges   []Range  `json:"ranges"`
}

type BatchQuery struct {
	Package json.RawMessage `json:"package"`
	Version string          `json:"version,omitempty"`
}

type BatchRequest struct {
	Queries []BatchQuery `json:"queries"`
}

type BatchResponse struct {
	Results []BatchResult `json:"results"`
}

type BatchResult struct {
	Vulns []VulnRef `json:"vulns"`
}

type Client struct {
	// contains filtered or unexported fields
}

type ClientConfig struct {
	APIBase            string
	Timeout            time.Duration
	BatchSize          int
	HTTPClient         *http.Client
	HTTPClientProvider *sdk.HTTPClientProvider
}

type Config struct {
	// APIBase overrides the OSV API base URL. Defaults to https://api.osv.dev.
	APIBase string
	// CacheDir overrides the cache directory. Defaults to ~/.bomly/cache/osv.
	CacheDir string
	// CacheTTL is the time-to-live for cached results. Defaults to 24 hours.
	CacheTTL time.Duration
	// BypassCache forces a fresh fetch even when a cached result exists.
	BypassCache bool
	// EnableKEV enables the KEV enrichment pass. Defaults to true.
	EnableKEV bool
	// KEVCacheDir overrides the KEV cache directory. Defaults to ~/.bomly/cache/kev.
	KEVCacheDir string
	// KEVCacheTTL is the TTL for the cached KEV catalog. Defaults to 6 hours.
	KEVCacheTTL time.Duration
	// VulnDetailCacheDir overrides the vuln-detail cache directory.
	// Defaults to ~/.bomly/cache/osv-vulns.
	VulnDetailCacheDir string
	// VulnDetailCacheTTL is the TTL for cached per-vuln detail records.
	// Defaults to 7 days (vuln records seldom change once published).
	VulnDetailCacheTTL time.Duration
	// Logger receives diagnostic messages. Maybe nil (no-op).
	Logger *zap.Logger
	// Stderr is used for progress messages. Maybe nil.
	Stderr io.Writer
	// Client overrides the OSV HTTP client. Maybe nil.
	Client *http.Client
	// KEVClient overrides the CISA KEV HTTP client. Maybe nil.
	KEVClient *http.Client
	// HTTPClientProvider supplies shared HTTP clients when Client/KEVClient are nil.
	HTTPClientProvider *sdk.HTTPClientProvider
}

type DatabaseSpecific struct {
	CweIDs []string `json:"cwe_ids,omitempty"`
	// Severity is GitHub Security Advisory's textual rating (LOW / MODERATE /
	// HIGH / CRITICAL). GHSA-sourced OSV entries frequently omit a CVSS vector
	// in the top-level `severity` array, so this is the only severity signal
	// available for them.
	Severity string `json:"severity,omitempty"`
}

type Event struct {
	Introduced   string `json:"introduced,omitempty"`
	Fixed        string `json:"fixed,omitempty"`
	LastAffected string `json:"last_affected,omitempty"`
}

type KEVCatalog struct {
	// contains filtered or unexported fields
}

type Matcher struct {
	// contains filtered or unexported fields
}

type NamePackage struct {
	Name      string `json:"name"`
	Ecosystem string `json:"ecosystem"`
}

type PurlPackage struct {
	Purl string `json:"purl"`
}

type Range struct {
	Events []Event `json:"events"`
}

type Severity struct {
	Type  string `json:"type"`  // e.g. "CVSS_V3", "CVSS_V4"
	Score string `json:"score"` // vector string or numeric score
}

type VulnRef struct {
	ID       string `json:"id"`
	Modified string `json:"modified"`
}

type Vulnerability struct {
	ID               string            `json:"id"`
	Summary          string            `json:"summary"`
	Details          string            `json:"details"`
	Aliases          []string          `json:"aliases"`
	Severity         []Severity        `json:"severity"`
	Affected         []Affected        `json:"affected"`
	Published        string            `json:"published"`
	Modified         string            `json:"modified"`
	DatabaseSpecific *DatabaseSpecific `json:"database_specific,omitempty"`
}