insights

type Activation struct {
	// Whether the profile is active by default.
	ActiveByDefault string

	// The JDK requirement of the activation.
	JDK JDK

	// The operating system requirement of the activation.
	OS OS

	// The property requirement of the activation.
	Property struct {
		// The property requirement to activate the profile.
		// This can be a system property or CLI user property.
		Property Property
	}

	// The file requirement of the activation.
	File File
}

type Advisory struct {
	// The identifier for the security advisory.
	AdvisoryKey AdvisoryKey

	// The URL of the security advisory.
	URL string

	// A brief human-readable description.
	Title string

	// Other identifiers used for the advisory, including CVEs.
	Aliases []string

	// The severity of the advisory as a CVSS v3 score in the range [0,10].
	// A higher score represents greater severity.
	CVSS3Score float32

	// The severity of the advisory as a CVSS v3 vector string.
	CVSS3Vector string
}

type AdvisoryKey struct {
	// The OSV identifier for the security advisory.
	ID string
}

type Attestation struct {
	// The type of attestation.
	// One of https://slsa.dev/provenance/v0.2, https://slsa.dev/provenance/v1,
	// https://docs.pypi.org/attestations/publish/v1.
	Type string

	// The URL of the attestation if there is one.
	URL string

	// The attestation has been cryptographically verified by deps.dev.
	// For attestations distributed in a Sigstore bundle, this field indicates
	// the bundle was verified using the
	// [sigstore-go](https://github.com/sigstore/sigstore-go) library.
	Verified bool

	// Only set if type is https://slsa.dev/provenance/v0.2,
	// https://slsa.dev/provenance/v1,
	// https://docs.pypi.org/attestations/publish/v1.
	// The source code repository used to build the version.
	SourceRepository string

	// The commit of the source code repository the version was built from.
	Commit string
}

type Bundle struct {
	// The path inside the tarball where this dependency was found.
	Path string

	// The name of the bundled package, as declared inside the bundled
	// package.json.
	Name string

	// The version of this package, as declared inside the bundled
	// package.json.
	Version string

	// The dependency-related fields from the bundled package.json.
	Dependencies NPMDependencies
}

type Client struct {
	// Base URL for API requests.
	BaseURL *url.URL
}

type Dependencies struct {
	// The nodes of the dependency graph. The first node is the root of the graph.
	Nodes []Node

	// The edges of the dependency graph.
	Edges []Edge

	// Any error associated with the dependency graph that is not specific to a
	// node. An error here may imply the graph as a whole is incorrect.
	// This error message has no defined format and is intended for human
	// consumption.
	Error string
}

type Dependency struct {
	// The name of the package.
	Name string

	// The requirement of the package.
	Requirement string
}

type DependencyGroup struct {
	// The target framework that this dependency group is for.
	TargetFramework string

	// The requirements belonging to this dependency group.
	Dependencies []Dependency
}

type Edge struct {
	// The node declaring the dependency, specified as an index into the list of
	// nodes.
	FromNode int

	// The node resolving the dependency, specified as an index into the list of
	// nodes.
	ToNode int

	// The requirement resolved by this edge, as declared by the "from" node.
	// The meaning of this field is system-specific. As an example, in npm, the
	// requirement "^1.0.0" may be resolved by the version "1.2.3".
	Requirement string
}

type File struct {
	// The name of the file that its existence activates the profile.
	Exists string

	// The name of the file, activate the profile if the file is missing.
	Missing string
}

type JDK struct {
	// The JDK requirement to activate the profile.
	JDK string
}

type Link struct {
	// A label describing the resource that the link points to.
	Label string

	// The URL of the link.
	URL string
}

type Maven struct {
	// The direct parent of a package version.
	Parent VersionKey

	// The list of dependencies.
	Dependencies []MavenDependency

	// The list of dependency management.
	// The format is the same as dependencies.
	DependencyManagement []MavenDependency

	// The list of properties, used to resolve placeholders.
	Properties []Property

	// The list of repositories.
	Repositories []Repository

	// The list of profiles.
	Profiles []Profile
}

type MavenDependency struct {
	// The name of the package.
	Name string

	// The version requirement of the dependency.
	Version string

	// The classifier of the dependency, which distinguishes artifacts that
	// differ in content.
	Classifier string

	// The type of the dependency, defaults to jar.
	Type string

	// The scope of the dependency, specifies how to limit the transitivity
	// of a dependency.
	Scope string

	// Whether the dependency is optional or not.
	Optional string

	// The dependencies to be excluded, in the form of a list of package
	// names.
	// Exclusions may contain wildcards in both groupID and artifactID.
	Exclusions []string
}

type NPM struct {
	// The dependency-related fields declared in the requested package version's
	// package.json.
	Dependencies NPMDependencies

	// Contents of any additional package.json files found inside the
	// "node_modules" folder of the version's tarball, including nested
	// "node_modules".
	Bundled []Bundle
}

type NPMDependencies struct {
	// The "dependencies" field of a package.json, represented as a list of
	// name, requirement pairs.
	Dependencies []Dependency

	// The "devDependencies" field of a package.json. The format is the
	// same as "dependencies".
	DevDependencies []Dependency

	// The "optionalDependencies" field of a package.json. The format is
	// the same as "dependencies".
	OptionalDependencies []Dependency

	// The "peerDependencies" field of a package.json. The format is the
	// same as "dependencies".
	PeerDependencies []Dependency

	// The "bundleDependencies" field of a package.json: a list of package
	// names. In the package.json this may also just be the boolean value
	// "true", in which case this field will contain the names of all the
	// dependencies from the "dependencies" field.
	BundleDependencies []string
}

type Node struct {
	// The package version represented by this node. Note that the package and
	// version name may differ from the names in the request, if provided, due
	// to canonicalization.
	//
	// In some systems, a graph may contain multiple nodes for the same package
	// version.
	VersionKey VersionKey

	// If true, this is a bundled dependency.
	//
	// For bundled dependencies, the package name in the version key encodes
	// how the dependency is bundled. As an example, a bundled dependency with
	// a name like "a>1.2.3>b>c" is part of the dependency graph of package "a"
	// at version "1.2.3", and has the local name "c". It may or may not be the
	// same as a package with the global name "c".
	Bundled bool

	// Whether this node represents a direct or indirect dependency within this
	// dependency graph. Note that it's possible for a dependency to be both
	// direct and indirect; if so, it is marked as direct.
	//
	// Can be one of SELF, DIRECT, INDIRECT.
	Relation string

	// Errors associated with this node of the graph, such as an unresolved
	// dependency requirement. An error on a node may imply the graph as a
	// whole is incorrect. These error messages have no defined format and are
	// intended for human consumption.
	Errors []string
}

type NuGet struct {
	// The requirements grouped by target framework.
	DependencyGroups []DependencyGroup
}

type OS struct {
	// The name of the operating system.
	Name string

	// The family of the operating system.
	Family string

	// The CPU architecture of the operating system.
	Arch string

	// The version of the operating system.
	Version string
}

type OSSFuzzDetails struct {
	// The total number of lines of code in the project.
	LineCount int

	// The number of lines of code covered by fuzzing.
	LineCoverCount int

	// The date the fuzz test that produced the coverage information was run
	// against this project.
	// The time portion of this field is midnight UTC.
	Date string

	// The URL containing the configuration for the project in the
	// OSS-Fuzz repository.
	ConfigURL string
}

type Package struct {
	// The name of the package.
	PackageKey PackageKey

	// The available versions of the package.
	Versions []Version
}

type PackageKey struct {
	// The package management system containing the package.
	System string

	// The name of the package.
	Name string
}

type Profile struct {
	// The ID of the profile.
	ID string

	// The activation requirement of the profile.
	Activation Activation

	// The dependencies specified in the profile.
	Dependencies []MavenDependency

	// The dependency management specified in the profile.
	DependencyManagement []MavenDependency

	// The properties specified in the profile.
	Properties []Property

	// The repositories specified in the profile.
	Repositories []Repository
}

type Project struct {
	// The identifier for the project.
	ProjectKey ProjectKey

	// The number of open issues reported by the project host.
	// Only available for GitHub and GitLab.
	OpenIssuesCount int

	// The number of stars reported by the project host.
	// Only available for GitHub and GitLab.
	StarsCount int

	//The number of forks reported by the project host.
	//Only available for GitHub and GitLab.
	ForksCount int

	// The license reported by the project host.
	License string

	// The description reported by the project host
	Description string

	// The homepage reported by the project host.
	Homepage string

	// An [OpenSSF Scorecard](https://github.com/ossf/scorecard) for the project,
	// if one is available.
	Scorecard Scorecard

	// Details of this project's testing by the
	// [OSS-Fuzz service](https://google.github.io/oss-fuzz/).
	// Only set if the project is tested by OSS-Fuzz.
	OSSFuzz OSSFuzzDetails
}

type ProjectKey struct {
	// A project identifier of the form `github.com/user/repo`,
	// `gitlab.com/user/repo`, or `bitbucket.org/user/repo`.
	ID string
}

type ProjectPackageVersions struct {
	// The versions that were built from the source code contained in this project.
	Versions []struct {
		// The identifier for the version.
		VersionKey VersionKey
		// The SLSA provenance statements that link the version to the project. This
		// is only populated for npm package versions. See the 'attestations' field
		// for more attestations (including SLSA provenance) for all systems.
		SLSAProvenances []SLSAProvenance
		// Attestations that link the version to the project.
		Attestation []Attestation
		// What the relationship between the project and the package version is.
		// Can be one of SOURCE_REPO, ISSUE_TRACKER.
		RelationType string
		// How the mapping between project and package version was discovered.
		// Can be one of SLSA_ATTESTATION, GO_ORIGIN, PYPI_PUBLISH_ATTESTATION,
		// UNVERIFIED_METADATA.
		RelationProvenance string
	}
}

type Property struct {
	// The name of the property.
	Name string

	// The value of the property.
	Value string
}

type QueryOptions struct {
	// The function used to produce this hash.
	// Can be one of MD5, SHA1, SHA256, SHA512.
	HashType string `url:"hash.type,omitempty"`

	// A hash value.
	HashValue string `url:"hash.value,omitempty"`

	// The package management system containing the package.
	// Can be one of GO, NPM, CARGO, MAVEN, PYPI, NUGET.
	System string `url:"versionKey.system,omitempty"`

	// The name of the package.
	Name string `url:"versionKey.name,omitempty"`

	// The version of the package.
	Version string `url:"versionKey.version,omitempty"`
}

type QueryResult struct {
	// Results matching the query. At most 1000 results are returned.
	Results []Result
}

type Repository struct {
	// The ID of the repository.
	ID string

	// The URL of the repository.
	URL string

	// Whether the description of the repository follows a common layout.
	Layout string

	// Whether the repository is enabled for release downloads.
	ReleasesEnabled string

	// Whether the repository is enabled for snapshot downloads.
	SnapshotsEnabled string
}

type Requirements struct {
	// The NuGet-specific representation of the version's requirements.
	//
	// Note that the term "dependency" is used here to mean "a single unresolved
	// requirement" to be consistent with how the term is used in the NuGet
	// ecosystem. This is different to how it is used elsewhere in the deps.dev
	// API.
	NuGet NuGet

	// The npm-specific representation of the version's requirements.
	//
	// Note that the term "dependency" is used here to mean "a single unresolved
	// requirement" to be consistent with how the term is used in the npm
	// ecosystem. This is different to how it is used elsewhere in the deps.dev
	// API.
	NPM NPM

	// The Maven-specific representation of the version's requirements.
	//
	// Note that the term "dependency" is used here to mean "a single unresolved
	// requirement" to be consistent with how the term is used in the Maven
	// ecosystem. This is different to how it is used elsewhere in the deps.dev
	// API.
	//
	// This data is as it is declared in a version POM file. The data in parent
	// POMs are not merged.
	// Any string field may contain references to properties, and the properties
	// are not interpolated.
	Maven Maven
}

type Result struct {
	Version Version
}

type SLSAProvenance struct {
	// The source code repository used to build the version.
	SourceRepository string

	// The commit of the source code repository the version was built from.
	Commit string

	// The URL of the provenance statement if there is one.
	URL string

	// The Sigstore bundle containing this attestation was verified using the
	// [sigstore-go](https://github.com/sigstore/sigstore-go) library.
	Verified bool
}

type Scorecard struct {
	// The date at which the scorecard was produced.
	// The time portion of this field is midnight UTC.
	Date string

	// The source code repository and commit the scorecard was produced from.
	Repository struct {
		// The source code repository the scorecard was produced from.
		Name string

		// The source code commit the scorecard was produced from.
		Commit string
	}

	// The version and commit of the Scorecard program used to produce the
	// scorecard.
	Scorecard struct {
		// The version of the Scorecard program used to produce the scorecard.
		Version string

		// The commit of the Scorecard program used to produce the scorecard.
		Commit string
	}

	// The results of the
	// [Scorecard Checks](https://github.com/ossf/scorecard#scorecard-checks)
	// performed on the project.
	Checks []struct {
		// The name of the check.
		Name string

		// Human-readable documentation for the check.
		Documentation struct {
			// A short description of the check.
			ShortDescription string

			// A link to more details about the check.
			URL string
		}

		// A score in the range [0,10]. A higher score is better.
		// A negative score indicates that the check did not run successfully.
		Score int

		// The reason for the score.
		Reason string

		// Further details regarding the check.
		Details []string
	}

	// A weighted average score in the range [0,10]. A higher score is better.
	OverallScore float64

	// Additional metadata associated with the scorecard.
	Metadata []string
}

type Version struct {
	// The name of the version.
	VersionKey VersionKey

	// The time when this package version was published, if available, as
	// reported by the package management authority.
	PublishedAt string

	// If true, this is the default version of the package: the version that is
	// installed when no version is specified. The precise meaning of this is
	// system-specific, but it is commonly the version with the greatest
	// version number, ignoring pre-release versions.
	IsDefault bool

	// The licenses governing the use of this package version.
	//
	// We identify licenses as
	// [SPDX 2.1](https://spdx.dev/spdx-specification-21-web-version/)
	// expressions. When there is no associated SPDX identifier, we identify a
	// license as "non-standard". When we are unable to obtain license
	// information, this field is empty. When more than one license is listed,
	// their relationship is unspecified.
	//
	// For Cargo, Maven, npm, NuGet, and PyPI, license information is read from
	// the package metadata. For Go, license information is determined using the
	// [licensecheck](https://github.com/google/licensecheck) package.
	//
	// License information is not intended to be legal advice, and you should
	// independently verify the license or terms of any software for your own
	// needs.
	Licenses []string

	// Security advisories known to affect this package version directly. Further
	// information can be requested using the Advisory method.
	//
	// Note that this field does not include advisories that affect dependencies
	// of this package version.
	AdvisoryKeys []AdvisoryKey

	// Links declared by or derived from package version metadata, to external
	// web resources such as a homepage or source code repository. Note that
	// these links are not verified for correctness.
	Links []Link

	// SLSA provenance information for this package version. Extracted from a
	// SLSA provenance attestation. This is only populated for npm package
	// versions. See the 'attestations' field for more attestations (including
	// SLSA provenance) for all systems.
	SLSAProvenances []SLSAProvenance

	// Attestations for this package version.
	Attestations []Attestation

	// URLs for the package management registries this package version is
	// available from.
	// Only set for systems that use a central repository for package
	// distribution: Cargo, Maven, npm, NuGet, and PyPI.
	Registries []string

	// Projects that are related to this package version.
	RelatedProjects []struct {
		// The identifier for the project.
		ProjectKey ProjectKey

		// How the mapping between project and package version was discovered.
		//
		// Can be one of SLSA_ATTESTATION, GO_ORIGIN, PYPI_PUBLISH_ATTESTATION,
		// UNVERIFIED_METADATA.
		RelationProvenance string

		// What the relationship between the project and the package version is.
		//
		// Can be one of SOURCE_REPO, ISSUE_TRACKER.
		RelationType string
	}
}

type VersionKey struct {
	// The package management system containing the package.
	System string

	// The name of the package.
	Name string

	// The version of the package.
	Version string
}