sdk

type Affected struct {
	Ranges            []VersionRange `json:"ranges,omitempty"`
	Versions          []string       `json:"versions,omitempty"`
	EcosystemSpecific map[string]any `json:"ecosystem_specific,omitempty"`
	DatabaseSpecific  map[string]any `json:"database_specific,omitempty"`
}

type AffectedSymbol struct {
	Symbol     string          `json:"symbol,omitempty"`
	Kind       SymbolKind      `json:"kind,omitempty"`
	Package    string          `json:"package,omitempty"`
	Module     string          `json:"module,omitempty"`
	Definition *SourcePosition `json:"definition,omitempty"`
}

type AnalyzeRequest struct {
	ProjectPath     string           `json:"projectPath,omitempty"`
	ExecutionTarget ExecutionTarget  `json:"executionTarget"`
	SubprojectInfo  Subproject       `json:"subprojectInfo"`
	Ecosystem       Ecosystem        `json:"ecosystem,omitempty"`
	PackageManager  PackageManager   `json:"packageManager,omitempty"`
	Language        Language         `json:"language,omitempty"`
	Query           PackageQuery     `json:"query"`
	Graph           *Graph           `json:"graph,omitempty"`
	Registry        *PackageRegistry `json:"registry,omitempty"`
	Target          *Dependency      `json:"target,omitempty"`
	AnalyzerFilter  AnalyzerFilter   `json:"analyzerFilter"`
	Stderr          io.Writer        `json:"-"`
}

type AnalyzeResponse = AnalyzeResult

type AnalyzeResult struct {
	Registry      *PackageRegistry             `json:"registry,omitempty"`
	AnalyzerRuns  []string                     `json:"analyzerRuns,omitempty"`
	AnalyzerStats map[string]ReachabilityStats `json:"analyzerStats,omitempty"`
}

type Analyzer interface {
	Descriptor() AnalyzerDescriptor
	// Ready reports whether the analyzer can run for the given request. It
	// returns nil when ready and a non-nil error describing the reason
	// otherwise. Implementations may perform lightweight, cancellable I/O and
	// should honor ctx.
	Ready(context.Context, AnalyzeRequest) error
	Applicable(context.Context, AnalyzeRequest) (bool, error)
	Analyze(context.Context, AnalyzeRequest) (AnalyzeResult, error)
}

type AnalyzerDescriptor struct {
	Name                string           `json:"name"`
	DisplayName         string           `json:"displayName,omitempty"`
	Aliases             []string         `json:"aliases,omitempty"`
	Tags                []string         `json:"tags,omitempty"`
	SupportedEcosystems []Ecosystem      `json:"supportedEcosystems,omitempty"`
	SupportedManagers   []PackageManager `json:"supportedManagers,omitempty"`
	// SupportedLanguages is the analyzer's primary dispatch axis.
	SupportedLanguages []Language `json:"supportedLanguages,omitempty"`
	// SupportedTiers communicates the precision the analyzer can deliver.
	SupportedTiers []ReachabilityTier `json:"supportedTiers,omitempty"`
}

type AnalyzerFilter struct {
	Include []string
	Exclude []string
}

type ApplicableResponse struct {
	Applicable bool `json:"applicable"`
}

type AuditRequest struct {
	ProjectPath     string           `json:"projectPath,omitempty"`
	ExecutionTarget ExecutionTarget  `json:"executionTarget"`
	SubprojectInfo  Subproject       `json:"subprojectInfo"`
	Ecosystem       Ecosystem        `json:"ecosystem,omitempty"`
	PackageManager  PackageManager   `json:"packageManager,omitempty"`
	Query           PackageQuery     `json:"query"`
	Graph           *Graph           `json:"graph,omitempty"`
	BaselineGraph   *Graph           `json:"baselineGraph,omitempty"`
	Registry        *PackageRegistry `json:"registry,omitempty"`
	Target          *Dependency      `json:"target,omitempty"`
	AuditorFilter   AuditorFilter    `json:"auditorFilter"`
	Stderr          io.Writer        `json:"-"`
}

type AuditResponse = AuditResult

type AuditResult struct {
	Findings        []Finding      `json:"findings,omitempty"`
	RiskScores      []RiskScore    `json:"riskScores,omitempty"`
	AuditorRuns     []string       `json:"auditorRuns,omitempty"`
	AuditorFindings map[string]int `json:"auditorFindings,omitempty"`
}

type Auditor interface {
	Descriptor() AuditorDescriptor
	// Ready reports whether the auditor can run for the given request. It
	// returns nil when ready and a non-nil error describing the reason
	// otherwise. Implementations may perform lightweight, cancellable I/O and
	// should honor ctx.
	Ready(context.Context, AuditRequest) error
	Applicable(context.Context, AuditRequest) (bool, error)
	Audit(context.Context, AuditRequest) (AuditResult, error)
}

type AuditorDescriptor struct {
	Name                string           `json:"name"`
	DisplayName         string           `json:"displayName,omitempty"`
	Aliases             []string         `json:"aliases,omitempty"`
	Tags                []string         `json:"tags,omitempty"`
	SupportedEcosystems []Ecosystem      `json:"supportedEcosystems,omitempty"`
	SupportedManagers   []PackageManager `json:"supportedManagers,omitempty"`
}

type AuditorFilter struct {
	Include []string
	Exclude []string
}

type CVSSScore struct {
	Vector  string       `json:"vector,omitempty"`
	Score   float64      `json:"score,omitempty"`
	Version SeverityType `json:"version,omitempty"`
	Source  string       `json:"source,omitempty"`
}

type CWE struct {
	CVE    string `json:"cve,omitempty"`
	ID     string `json:"id,omitempty"`
	Source string `json:"source,omitempty"`
	Type   string `json:"type,omitempty"`
}

type CallFrame struct {
	Function string         `json:"function,omitempty"`
	Package  string         `json:"package,omitempty"`
	Receiver string         `json:"receiver,omitempty"`
	Position SourcePosition `json:"position,omitempty"`
}

type CallPath struct {
	Sink   AffectedSymbol `json:"sink"`
	Frames []CallFrame    `json:"frames,omitempty"`
}

type Client interface {
	DetectorDescriptor(context.Context) (*DetectorDescriptor, error)
	DetectorPackageManagerSupport(context.Context) ([]PackageManagerSupport, error)
	DetectorReady(context.Context, *DetectRequest) (*ReadyResponse, error)
	DetectorApplicable(context.Context, *DetectRequest) (*ApplicableResponse, error)
	DetectorInstall(context.Context, *DetectRequest) (*InstallResponse, error)
	Detect(context.Context, *DetectRequest) (*DetectResponse, error)
	MatcherDescriptor(context.Context) (*MatcherDescriptor, error)
	MatcherReady(context.Context, *MatchRequest) (*ReadyResponse, error)
	MatcherApplicable(context.Context, *MatchRequest) (*ApplicableResponse, error)
	Match(context.Context, *MatchRequest) (*MatchResponse, error)
	AuditorDescriptor(context.Context) (*AuditorDescriptor, error)
	AuditorReady(context.Context, *AuditRequest) (*ReadyResponse, error)
	AuditorApplicable(context.Context, *AuditRequest) (*ApplicableResponse, error)
	Audit(context.Context, *AuditRequest) (*AuditResponse, error)
}

type ComponentDescriptor struct {
	Name                string           `json:"name"`
	DisplayName         string           `json:"displayName,omitempty"`
	Aliases             []string         `json:"aliases,omitempty"`
	Tags                []string         `json:"tags,omitempty"`
	SupportedEcosystems []Ecosystem      `json:"supportedEcosystems,omitempty"`
	SupportedManagers   []PackageManager `json:"supportedManagers,omitempty"`
}

type ConsolidatedGraph struct {
	ExecutionTarget ExecutionTarget
	Graphs          *GraphContainer
	Manifests       []ConsolidatedManifest
	Subprojects     []ConsolidatedSubproject
}

type ConsolidatedManifest struct {
	Entry          GraphEntry
	Subproject     Subproject
	DetectorName   string
	Origin         DetectorOrigin
	Technique      DetectorTechnique
	RootManifestID string
}

type ConsolidatedSubproject struct {
	Subproject      Subproject
	DetectorName    string
	RootManifestIDs []string
}

type Coordinates struct {
	PURL           string         `json:"purl,omitempty"`
	Ecosystem      Ecosystem      `json:"ecosystem,omitempty"`
	PackageManager PackageManager `json:"package_manager,omitempty"`
	Type           PackageType    `json:"type,omitempty"`
	Org            string         `json:"org,omitempty"`
	Name           string         `json:"name,omitempty"`
	Version        string         `json:"version,omitempty"`
	Language       Language       `json:"language,omitempty"`

	// FirstParty marks a node as the scanned project's own artifact (its root
	// package, a workspace member, a reactor module) rather than a consumed
	// third-party package. Only detectors set it, when synthesizing or matching
	// nodes they know belong to the build itself; imported documents (SBOM
	// scans) never do, because a component's declared type is an artifact kind,
	// not proof of ownership. Enrichment skips first-party nodes.
	FirstParty bool `json:"first_party,omitempty"`
}

type Dependency struct {
	Coordinates
	ID           string                 `json:"id"`
	Relationship DependencyRelationship `json:"relationship,omitempty"`
	Source       DependencySource       `json:"source,omitempty"`
	Scopes       []Scope                `json:"scopes,omitempty"`
	Locations    []PackageLocation      `json:"locations,omitempty"`
	CPEs         []string               `json:"cpes,omitempty"`
	Digests      []Digest               `json:"digests,omitempty"`
	Copyright    string                 `json:"copyright,omitempty"`
	FoundBy      string                 `json:"found_by,omitempty"`
	ResolvedURL  string                 `json:"resolved_url,omitempty"`
	Metadata     map[string]any         `json:"metadata,omitempty"`

	// Matched is true when the referenced package was enriched by a matcher.
	Matched bool `json:"matched,omitempty"`
	// PackageRef is the PURL of this dependency's matching artifact.
	PackageRef string `json:"package_ref,omitempty"`
}

type DependencyEdge struct {
	FromID string `json:"fromId"`
	ToID   string `json:"toId"`
}

type DependencyQuery struct {
	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
}

type DependencyRelationship string

type DependencySource string

type DetectRequest = DetectionRequest

type DetectResponse = DetectionResult

type DetectionRequest struct {
	ProjectPath     string          `json:"projectPath,omitempty"`
	ExecutionTarget ExecutionTarget `json:"executionTarget"`
	Subproject      Subproject      `json:"subproject"`
	Ecosystem       Ecosystem       `json:"ecosystem,omitempty"`
	PackageManager  PackageManager  `json:"packageManager,omitempty"`
	// EnrichmentEnabled allows orchestration to request detector-time metadata
	// enrichment when a downstream command has opted into package enrichment.
	EnrichmentEnabled  bool            `json:"enrichmentEnabled,omitempty"`
	DetectorFilter     DetectorFilter  `json:"detectorFilter"`
	ScopeFilter        Scope           `json:"scopeFilter,omitempty"`
	Query              DependencyQuery `json:"query"`
	InstallFirst       bool            `json:"installFirst,omitempty"`
	InstallArgs        []string        `json:"installArgs,omitempty"`
	CoreVersion        string          `json:"coreVersion,omitempty"`
	AllowStdErrLogging bool            `json:"allowStdErrLogging,omitempty"`
	Stderr             io.Writer       `json:"-"`
	Verbose            bool            `json:"-"`
	// Logger is a request-scoped logger injected by the pipeline, already
	// bound to the subproject and detector this request targets. It lets a
	// detector instance that is shared across concurrently-resolved
	// subprojects emit log lines that identify which subproject they belong
	// to. It is process-local and never serialized. Use DetectorLogger to
	// read it with a safe fallback.
	Logger *zap.Logger `json:"-"`
}

type DetectionResult struct {
	SubprojectInfo      Subproject        `json:"subprojectInfo"`
	RootExecutionTarget ExecutionTarget   `json:"rootExecutionTarget"`
	DetectorName        string            `json:"detectorName,omitempty"`
	Origin              DetectorOrigin    `json:"origin,omitempty"`
	Technique           DetectorTechnique `json:"technique,omitempty"`
	// FallbackFrom names the planned primary detector that failed before a
	// fallback detector produced this result. Empty for routine applicability
	// hand-off between chained detectors.
	FallbackFrom string `json:"fallbackFrom,omitempty"`
	// FallbackReason is the human-readable cause of the primary detector's
	// failure, e.g. "not ready: java executable not found on PATH".
	FallbackReason string          `json:"fallbackReason,omitempty"`
	Graphs         *GraphContainer `json:"graphs,omitempty"`
}

type Detector interface {
	Descriptor() DetectorDescriptor
	PackageManagerSupport() []PackageManagerSupport
	// Ready reports whether the detector can run for the given request. It
	// returns nil when ready and a non-nil error describing the reason
	// (e.g. a missing toolchain) otherwise. Implementations may perform
	// lightweight, cancellable I/O (such as probing for a runtime) and should
	// honor ctx.
	Ready(context.Context, DetectionRequest) error
	Applicable(context.Context, DetectionRequest) (bool, error)
	ResolveGraph(context.Context, DetectionRequest) (DetectionResult, error)
}

type DetectorDescriptor struct {
	Name                  string                  `json:"name"`
	DisplayName           string                  `json:"displayName,omitempty"`
	Aliases               []string                `json:"aliases,omitempty"`
	Tags                  []string                `json:"tags,omitempty"`
	SupportedEcosystems   []Ecosystem             `json:"supportedEcosystems,omitempty"`
	SupportedManagers     []PackageManager        `json:"supportedManagers,omitempty"`
	Technique             DetectorTechnique       `json:"technique,omitempty"`
	PackageManagerSupport []PackageManagerSupport `json:"packageManagerSupport,omitempty"`
	FallbackDetectors     []string                `json:"fallbackDetectors,omitempty"`
	SupportsInstallFirst  bool                    `json:"supportsInstallFirst,omitempty"`
	// IgnoredDirectories lists directory basename globs (Go
	// path.Match syntax) that recursive subproject discovery must not descend
	// into because they hold third-party installs, vendored dependencies, or
	// build outputs for this detector's ecosystem (e.g. "node_modules",
	// "target"). Discovery aggregates these across every registered detector,
	// including external plugins. Optional; omitted by older plugins.
	IgnoredDirectories []string `json:"ignoredDirectories,omitempty"`
	// IgnoredDirectoryMarkers lists file names whose presence inside
	// a directory marks that directory as ignored during recursive discovery
	// regardless of its name (e.g. "pyvenv.cfg" identifies a Python
	// virtualenv). Optional; omitted by older plugins.
	IgnoredDirectoryMarkers []string `json:"ignoredDirectoryMarkers,omitempty"`
}

type DetectorFilter struct {
	Include []string
	Exclude []string
}

type DetectorInstaller interface {
	Install(context.Context, *DetectRequest) (*InstallResponse, error)
}

type DetectorOrigin string

type DetectorTechnique string

type Diff struct {
	Added   []*Dependency
	Removed []*Dependency
	Updated []VersionChange
}

type Digest struct {
	Algorithm DigestAlgorithm `json:"algorithm,omitempty"`
	Value     string          `json:"value,omitempty"`
}

type DigestAlgorithm string

type EPSSScore struct {
	CVE        string  `json:"cve,omitempty"`
	EPSS       float64 `json:"epss"`
	Percentile float64 `json:"percentile,omitempty"`
	Date       string  `json:"date,omitempty"`
}

type Ecosystem string

type EcosystemFilter struct {
	Include []Ecosystem
	Exclude []Ecosystem
}

type ExecutionTarget struct {
	Kind          ExecutionTargetKind `json:"kind,omitempty"`
	Location      string              `json:"location,omitempty"`
	RepositoryURL string              `json:"repositoryUrl,omitempty"`
	Ref           string              `json:"ref,omitempty"`
}

type ExecutionTargetKind string

type FailOnConstraint struct {
	Kind  FailOnKind
	Value string
}

type FailOnKind string

type FallbackDetector interface {
	FallbackDetector() Detector
}

type Finding struct {
	ID           string              `json:"id"`
	Kind         FindingKind         `json:"kind"`
	Title        string              `json:"title,omitempty"`
	Severity     SeverityLevel       `json:"severity,omitempty"`
	PolicyStatus FindingPolicyStatus `json:"policy_status,omitempty"`
	Reasons      []string            `json:"reasons,omitempty"`
	Source       string              `json:"source,omitempty"`
	Auditor      string              `json:"auditor,omitempty"`
	// RuleID is the stable auditor rule that produced the finding. Unlike ID,
	// it must not contain package versions or project-specific occurrence data.
	RuleID           string    `json:"rule_id,omitempty"`
	VexStatus        VEXStatus `json:"vex_status,omitempty"`
	VEXJustification string    `json:"vex_justification,omitempty"`
	// PackageRef is the PURL of the offending package in the registry.
	PackageRef string `json:"package_ref,omitempty"`
	// DependencyRefs are the dependency node IDs that introduced the package.
	DependencyRefs []string `json:"dependency_refs,omitempty"`
	// VulnerabilityID is the advisory id within the referenced package, set
	// for vulnerability-kind findings.
	VulnerabilityID string `json:"vulnerability_id,omitempty"`
}

type FindingKind string

type FindingPolicyDecision struct {
	Status FindingPolicyStatus
	Source string
	Reason string
}

type FindingPolicyResolver interface {
	ResolveFindingPolicy(context.Context, Finding, *PackageRegistry) (FindingPolicyDecision, bool)
}

type FindingPolicyStatus string

type FixAvailable struct {
	Version string           `json:"version,omitempty"`
	Date    string           `json:"date,omitempty"`
	Kind    FixAvailableKind `json:"kind,omitempty"`
}

type FixAvailableKind string

type FixState string

type Graph struct {
	// contains filtered or unexported fields
}

type GraphContainer struct {
	Entries []GraphEntry `json:"entries,omitempty"`
}

type GraphEntry struct {
	Graph    *Graph           `json:"graph,omitempty"`
	Manifest ManifestMetadata `json:"manifest"`
	Packages []*Package       `json:"packages,omitempty"`
}

type HTTPClientConfig struct {
	ProxyURL      string
	NoProxy       string
	ProxyType     string
	ProxyHost     string
	ProxyPort     int
	ProxyUsername string
	ProxyPassword string
	CACertFile    string
	Timeout       time.Duration
}

type HTTPClientProvider struct {
	// contains filtered or unexported fields
}

type InstallFirstDetector interface {
	Install(context.Context, DetectionRequest) error
}

type InstallResponse struct {
	Performed bool `json:"performed,omitempty"`
}

type KnownExploited struct {
	CVE                        string   `json:"cve,omitempty"`
	VendorProject              string   `json:"vendor_project,omitempty"`
	Product                    string   `json:"product,omitempty"`
	DateAdded                  string   `json:"date_added,omitempty"`
	RequiredAction             string   `json:"required_action,omitempty"`
	DueDate                    string   `json:"due_date,omitempty"`
	KnownRansomwareCampaignUse string   `json:"known_ransomware_campaign_use,omitempty"`
	Notes                      string   `json:"notes,omitempty"`
	URLs                       []string `json:"urls,omitempty"`
	CWEs                       []string `json:"cwes,omitempty"`
}

type Language string

type LicenseType string

type ManifestKind string

type ManifestMetadata struct {
	Path       string              `json:"path,omitempty"`
	Kind       ManifestKind        `json:"kind,omitempty"`
	Resolution *ResolutionMetadata `json:"resolution,omitempty"`
}

type MatchRequest struct {
	ProjectPath     string           `json:"projectPath,omitempty"`
	ExecutionTarget ExecutionTarget  `json:"executionTarget"`
	SubprojectInfo  Subproject       `json:"subprojectInfo"`
	Ecosystem       Ecosystem        `json:"ecosystem,omitempty"`
	PackageManager  PackageManager   `json:"packageManager,omitempty"`
	Query           PackageQuery     `json:"query"`
	Graph           *Graph           `json:"graph,omitempty"`
	Registry        *PackageRegistry `json:"registry,omitempty"`
	Target          *Dependency      `json:"target,omitempty"`
	MatcherFilter   MatcherFilter    `json:"matcherFilter"`
	Stderr          io.Writer        `json:"-"`
}

type MatchResponse = MatchResult

type MatchResult struct {
	Registry     *PackageRegistry `json:"registry,omitempty"`
	MatcherStats MatcherStats     `json:"matcherStats,omitempty"`
}

type Matcher interface {
	Descriptor() MatcherDescriptor
	// Ready reports whether the matcher can run for the given request. It
	// returns nil when ready and a non-nil error describing the reason
	// otherwise. Implementations may perform lightweight, cancellable I/O and
	// should honor ctx.
	Ready(context.Context, MatchRequest) error
	Applicable(context.Context, MatchRequest) (bool, error)
	Match(context.Context, MatchRequest) (MatchResult, error)
}

type MatcherDescriptor struct {
	Name                string           `json:"name"`
	DisplayName         string           `json:"displayName,omitempty"`
	Aliases             []string         `json:"aliases,omitempty"`
	Tags                []string         `json:"tags,omitempty"`
	SupportedEcosystems []Ecosystem      `json:"supportedEcosystems,omitempty"`
	SupportedManagers   []PackageManager `json:"supportedManagers,omitempty"`
}

type MatcherFilter struct {
	Include []string
	Exclude []string
}

type MatcherStats struct {
	Name              string `json:"name"`
	DisplayName       string `json:"displayName,omitempty"`
	MatchedPackages   int    `json:"matchedPackages,omitempty"`
	UnmatchedPackages int    `json:"unmatchedPackages,omitempty"`
	Licenses          int    `json:"licenses,omitempty"`
	Vulnerabilities   int    `json:"vulnerabilities,omitempty"`
}

type NPMPackageMetadata struct {
	Bundled                  bool              `json:"bundled,omitempty"`
	Extraneous               bool              `json:"extraneous,omitempty"`
	HasInstallScript         bool              `json:"hasInstallScript,omitempty"`
	PeerDependencies         map[string]string `json:"peerDependencies,omitempty"`
	OptionalPeerDependencies []string          `json:"optionalPeerDependencies,omitempty"`
	Engines                  map[string]string `json:"engines,omitempty"`
}

type Package struct {
	Coordinates
	// ID is the package registry identifier. It may be a database ID, PURL, or
	// another stable key chosen by the package registry.
	ID          string `json:"id,omitempty"`
	Copyright   string `json:"copyright,omitempty"`
	ResolvedURL string `json:"resolved_url,omitempty"`

	CPEs            []string          `json:"cpes,omitempty"`
	Digests         []Digest          `json:"digests,omitempty"`
	Licenses        []PackageLicense  `json:"licenses,omitempty"`
	Vulnerabilities []Vulnerability   `json:"vulnerabilities,omitempty"`
	Scorecard       *PackageScorecard `json:"scorecard,omitempty"`
	EOL             *PackageEOL       `json:"eol,omitempty"`

	// Matched indicates that this package was successfully matched by one or
	// more external enrichment sources.
	Matched bool `json:"matched,omitempty"`

	// Metadata holds per-ecosystem extensible data.
	Metadata map[string]any `json:"metadata,omitempty"`
}

type PackageEOL struct {
	Source        string `json:"source,omitempty"`
	Cycle         string `json:"cycle,omitempty"`
	EOL           bool   `json:"eol,omitempty"`
	EOLDate       string `json:"eol_date,omitempty"`
	LatestVersion string `json:"latest_version,omitempty"`
	ReleaseDate   string `json:"release_date,omitempty"`
	Supported     bool   `json:"supported,omitempty"`
}

type PackageLicense struct {
	Value          string      `json:"value,omitempty"`
	SPDXExpression string      `json:"spdx_expression,omitempty"`
	Type           LicenseType `json:"type,omitempty"`
}

type PackageLocation struct {
	RealPath   string `json:"real_path,omitempty"`
	AccessPath string `json:"access_path,omitempty"`
	// Position optionally points at the exact line / column in RealPath where
	// the package is declared. nil when unknown.
	Position *SourcePosition `json:"position,omitempty"`
}

type PackageManager string

type PackageManagerSupport struct {
	PackageManager   PackageManager `json:"packageManager"`
	EvidencePatterns []string       `json:"evidencePatterns,omitempty"`
	// MultiModule marks that the detector natively expands nested
	// workspace/reactor modules for this package manager from a root manifest
	// (Maven reactors, npm/pnpm/yarn workspaces, cargo workspace members,
	// ...). Recursive discovery prunes nested subprojects for the same
	// package manager below a directory where a native multi-module manager
	// was detected, so the same modules are not scanned twice. Optional;
	// omitted by older plugins.
	MultiModule bool `json:"multiModule,omitempty"`
}

type PackageManagerSupporter interface {
	PackageManagerSupport() []PackageManagerSupport
}

type PackageQuery struct {
	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
}

type PackageRegistry struct {
	// contains filtered or unexported fields
}

type PackageScorecard struct {
	// Source identifies where the data came from (e.g. "api.scorecard.dev").
	Source string `json:"source,omitempty"`
	// Repository is the canonical repo identifier scored, e.g.
	// "github.com/kubernetes/kubernetes".
	Repository string `json:"repository,omitempty"`
	// CommitSHA is the repo commit the run scored.
	CommitSHA string `json:"commitSha,omitempty"`
	// ScorecardVersion is the version of the Scorecard tool that produced
	// the run.
	ScorecardVersion string `json:"scorecardVersion,omitempty"`
	// RunDate is when the run was performed.
	RunDate time.Time `json:"runDate,omitempty"`
	// AggregateScore is the overall Scorecard aggregate, 0.0–10.0.
	// A negative value (typically -1) indicates "unscored".
	AggregateScore float64 `json:"aggregateScore"`
	// Checks holds per-check results in the order returned by Scorecard.
	Checks []PackageScorecardCheck `json:"checks,omitempty"`
}

type PackageScorecardCheck struct {
	// Name is the Scorecard check name, e.g. "Branch-Protection".
	Name string `json:"name"`
	// Score is 0–10, or -1 when the check is inconclusive.
	Score int `json:"score"`
	// Reason is the short summary Scorecard emits for the check.
	Reason string `json:"reason,omitempty"`
	// Documentation links to the canonical documentation page for the check.
	Documentation string `json:"documentation,omitempty"`
}

type PackageType string

type Path struct {
	Nodes   []*Dependency
	Cyclic  bool
	CycleTo string
}

type PluginKind string

type PluginTargetType string

type RangeEvent struct {
	Introduced   string `json:"introduced,omitempty"`
	Fixed        string `json:"fixed,omitempty"`
	LastAffected string `json:"last_affected,omitempty"`
	Limit        string `json:"limit,omitempty"`
}

type Reachability struct {
	Status                 ReachabilityStatus     `json:"status"`
	Tier                   ReachabilityTier       `json:"tier,omitempty"`
	Analyzer               string                 `json:"analyzer,omitempty"`
	Reason                 string                 `json:"reason,omitempty"`
	Symbols                []AffectedSymbol       `json:"symbols,omitempty"`
	CallPaths              []CallPath             `json:"call_paths,omitempty"`
	Hops                   *int                   `json:"hops,omitempty"`
	Confidence             ReachabilityConfidence `json:"confidence,omitempty"`
	DynamicImportsDetected bool                   `json:"dynamic_imports_detected,omitempty"`
	AnalyzedAt             string                 `json:"analyzed_at,omitempty"`
}

type ReachabilityConfidence string

type ReachabilityStats struct {
	Reachable     int `json:"reachable,omitempty"`
	Unreachable   int `json:"unreachable,omitempty"`
	Unknown       int `json:"unknown,omitempty"`
	NotApplicable int `json:"not_applicable,omitempty"`
}

type ReachabilityStatus string

type ReachabilityTier string

type ReadyResponse struct {
	Ready bool `json:"ready"`
	// Reason explains why the plugin is not ready. It is ignored when Ready is
	// true and surfaced to users (and resolution errors) when Ready is false.
	Reason string `json:"reason,omitempty"`
}

type Reference struct {
	URL  string        `json:"url,omitempty"`
	Type ReferenceType `json:"type,omitempty"`
}

type ReferenceType string

type ResolutionFallback struct {
	From   string `json:"from"`
	Reason string `json:"reason,omitempty"`
}

type ResolutionMetadata struct {
	Method            ResolutionMethod `json:"method,omitempty"`
	InstallExecuted   bool             `json:"install_executed"`
	InstallCommand    []string         `json:"install_command,omitempty"`
	InstallWorkingDir string           `json:"install_working_dir,omitempty"`
	// Fallback records that a fallback detector produced this graph after the
	// planned primary detector failed (not routine applicability hand-off).
	Fallback *ResolutionFallback `json:"fallback,omitempty"`
}

type ResolutionMethod string

type RiskBand string

type RiskScore struct {
	PackageRef string         `json:"package_ref,omitempty"`
	Score      int            `json:"score"`
	Band       RiskBand       `json:"band,omitempty"`
	Signals    map[string]any `json:"signals,omitempty"`
}

type Scope string

type ServedAuditor interface {
	Descriptor(context.Context) (*AuditorDescriptor, error)
	Ready(context.Context, *AuditRequest) (*ReadyResponse, error)
	Applicable(context.Context, *AuditRequest) (*ApplicableResponse, error)
	Audit(context.Context, *AuditRequest) (*AuditResponse, error)
}

type ServedDetector interface {
	Descriptor(context.Context) (*DetectorDescriptor, error)
	PackageManagerSupport(context.Context) ([]PackageManagerSupport, error)
	Ready(context.Context, *DetectRequest) (*ReadyResponse, error)
	Applicable(context.Context, *DetectRequest) (*ApplicableResponse, error)
	Detect(context.Context, *DetectRequest) (*DetectResponse, error)
}

type ServedMatcher interface {
	Descriptor(context.Context) (*MatcherDescriptor, error)
	Ready(context.Context, *MatchRequest) (*ReadyResponse, error)
	Applicable(context.Context, *MatchRequest) (*ApplicableResponse, error)
	Match(context.Context, *MatchRequest) (*MatchResponse, error)
}

type Severity struct {
	// Type is the OSV severity type, e.g. "CVSS_V3", "CVSS_V4".
	Type SeverityType `json:"type,omitempty"`
	// Score is the vector string or numeric score for Type.
	Score string `json:"score,omitempty"`
}

type SeverityLevel string

type SeverityType string

type SourcePosition struct {
	File    string `json:"file,omitempty"`
	Line    int    `json:"line,omitempty"`
	Column  int    `json:"column,omitempty"`
	EndLine int    `json:"end_line,omitempty"`
}

type Subproject struct {
	ExecutionTarget         ExecutionTarget  `json:"executionTarget"`
	RelativePath            string           `json:"relativePath,omitempty"`
	PrimaryDetector         string           `json:"primaryDetector,omitempty"`
	DetectedPackageManagers []PackageManager `json:"detectedPackageManagers,omitempty"`
	PlannedDetectors        []string         `json:"plannedDetectors,omitempty"`
	Ecosystem               Ecosystem        `json:"ecosystem,omitempty"`
}

type SymbolKind string

type VEXStatus string

type VersionChange struct {
	Before *Dependency
	After  *Dependency
}

type VersionRange struct {
	// Type is the OSV range type: "SEMVER", "ECOSYSTEM", or "GIT".
	Type   VersionRangeType `json:"type,omitempty"`
	Repo   string           `json:"repo,omitempty"`
	Events []RangeEvent     `json:"events,omitempty"`
}

type VersionRangeType string

type Vulnerability struct {
	// --- OSV-aligned core ---
	ID               string         `json:"id"`
	Aliases          []string       `json:"aliases,omitempty"`
	Related          []string       `json:"related,omitempty"`
	Summary          string         `json:"summary,omitempty"`
	Details          string         `json:"details,omitempty"`
	Severity         []Severity     `json:"severity,omitempty"`
	Affected         []Affected     `json:"affected,omitempty"`
	References       []Reference    `json:"references,omitempty"`
	Published        string         `json:"published,omitempty"`
	Modified         string         `json:"modified,omitempty"`
	Withdrawn        string         `json:"withdrawn,omitempty"`
	DatabaseSpecific map[string]any `json:"database_specific,omitempty"`

	// --- Bomly enrichment extensions ---
	Source               string           `json:"source,omitempty"`
	DataSource           string           `json:"data_source,omitempty"`
	Namespace            string           `json:"namespace,omitempty"`
	Title                string           `json:"title,omitempty"`
	Reasons              []string         `json:"reasons,omitempty"`
	ParsedSeverity       SeverityLevel    `json:"parsed_severity,omitempty"`
	SeveritySource       string           `json:"severity_source,omitempty"`
	CVSS                 []CVSSScore      `json:"cvss,omitempty"`
	EPSS                 []EPSSScore      `json:"epss,omitempty"`
	CWEs                 []CWE            `json:"cwes,omitempty"`
	KEVExploited         bool             `json:"kev_exploited,omitempty"`
	KnownExploited       []KnownExploited `json:"known_exploited,omitempty"`
	RiskScore            float64          `json:"risk_score,omitempty"`
	FixState             FixState         `json:"fix_state,omitempty"`
	FixedIn              string           `json:"fixed_in,omitempty"`
	FixedVersions        []string         `json:"fixed_versions,omitempty"`
	FixAvailable         []FixAvailable   `json:"fix_available,omitempty"`
	AffectedVersionRange string           `json:"affected_version_range,omitempty"`
	CPEs                 []string         `json:"cpes,omitempty"`
	AffectedSymbols      []AffectedSymbol `json:"affected_symbols,omitempty"`
	Reachability         *Reachability    `json:"reachability,omitempty"`
}