evidence

type Bundle struct {
	Type          string    `json:"_type"`
	Subject       []Subject `json:"subject"`
	PredicateType string    `json:"predicateType"`
	Predicate     Predicate `json:"predicate"`
}

type Check struct {
	Name   string `json:"name"`
	OK     bool   `json:"ok"`
	Detail string `json:"detail,omitempty"`
}

type Digest struct {
	SHA256 string `json:"sha256"`
}

type Entry struct {
	Position int    `json:"position"`
	URI      string `json:"uri"`
	// Ref is the "@<tag>" the entry was mounted by ("" for a plain URI).
	// Descriptive only — it is deliberately NOT part of the Merkle leaf, so
	// roots stay stable for manifests recorded before tags existed.
	Ref               string            `json:"ref,omitempty"`
	SnapshotID        string            `json:"snapshot_id"`
	MaterializationID string            `json:"materialization_id"`
	ContentHash       string            `json:"content_hash"`
	SourceRevision    string            `json:"source_revision"`
	ObservedAt        time.Time         `json:"observed_at"`
	ContentType       string            `json:"content_type"`
	Bytes             int64             `json:"bytes"`
	Provenance        map[string]string `json:"provenance"`
	// ContentB64 is populated only with Options.WithContent. Without it a
	// bundle is metadata-only: safe to hand to an auditor who is allowed
	// to know what the agent read but not to read it.
	ContentB64 string `json:"content_b64,omitempty"`
}

type Exporter struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type FilesystemConfig struct {
	Path string `json:"path"`
}

type GitHubConfig struct {
	Owner string `json:"owner"`
	Repo  string `json:"repo"`
	Path  string `json:"path"`
	Ref   string `json:"ref"`
}

type HTTPConfig struct {
	URL     string            `json:"url"`
	Headers map[string]string `json:"headers,omitempty"`
}

type Merkle struct {
	Algorithm string `json:"algorithm"`
	Leaf      string `json:"leaf"`
	Root      string `json:"root"`
}

type Options struct {
	// WithContent embeds each entry's replayed bytes as base64. Off by
	// default: the metadata-only bundle is the shareable one.
	WithContent bool
	// Now overrides the clock for generated_at / replay.verified_at so
	// tests can produce byte-stable bundles.
	Now func() time.Time
}

type Policy struct {
	Strategy         string `json:"strategy"`
	MaxAgeSeconds    int64  `json:"max_age_seconds,omitempty"`
	PinnedSnapshotID string `json:"pinned_snapshot_id,omitempty"`
}

type Predicate struct {
	RunID             string     `json:"run_id"`
	ManifestID        string     `json:"manifest_id"`
	ManifestCreatedAt time.Time  `json:"manifest_created_at"`
	GeneratedAt       time.Time  `json:"generated_at"`
	Exporter          Exporter   `json:"exporter"`
	Merkle            Merkle     `json:"merkle"`
	Entries           []Entry    `json:"entries"`
	Resources         []Resource `json:"resources"`
	Replay            Replay     `json:"replay"`
}

type Replay struct {
	VerifiedAt time.Time     `json:"verified_at"`
	AllMatch   bool          `json:"all_match"`
	Entries    []ReplayEntry `json:"entries"`
	// Error is set when replay could not run at all (e.g. a blob is gone).
	// The export still succeeds — an un-replayable manifest is precisely
	// the situation an auditor needs a durable record of.
	Error string `json:"error,omitempty"`
}

type ReplayEntry struct {
	Position     int    `json:"position"`
	Match        bool   `json:"match"`
	ExpectedHash string `json:"expected_hash"`
	ActualHash   string `json:"actual_hash"`
	Error        string `json:"error,omitempty"`
}

type Report struct {
	OK             bool    `json:"ok"`
	Checks         []Check `json:"checks"`
	Entries        int     `json:"entries"`
	MerkleRoot     string  `json:"merkle_root"`
	ContentChecked int     `json:"content_checked"`
	ReplayChecked  bool    `json:"replay_checked"`
	ReplayMatched  int     `json:"replay_matched"`
	ReplayTotal    int     `json:"replay_total"`
}

type Resource struct {
	URI       string `json:"uri"`
	Namespace string `json:"namespace"`
	Path      string `json:"path"`
	Source    Source `json:"source"`
	Policy    Policy `json:"policy"`
	// Missing marks a URI whose resource definition no longer exists.
	// Recorded rather than fatal: a manifest stays replayable after its
	// resource is deregistered, and the evidence should say exactly that.
	Missing bool `json:"missing,omitempty"`
}

type Source struct {
	Kind   string       `json:"kind"`
	Config SourceConfig `json:"config"`
}

type SourceConfig struct {
	Filesystem *FilesystemConfig `json:"filesystem,omitempty"`
	GitHub     *GitHubConfig     `json:"github,omitempty"`
	HTTP       *HTTPConfig       `json:"http,omitempty"`
}

type Subject struct {
	Name   string `json:"name"`
	Digest Digest `json:"digest"`
}

type VerifyOptions struct {
	// Client, when non-nil, adds the store cross-check: the manifest is
	// replayed again now and its hashes are compared with the ones the
	// bundle recorded. Leave nil for a fully offline verification.
	Client client.Client
	// Context is used for those Client calls. The Verify signature is
	// fixed by the evidence API, so the context rides along here instead
	// of being the first argument; nil means context.Background().
	Context context.Context
}