model

type Asset struct {
	Name   string
	Digest string
	URL    string
	APIURL string
}

type Candidate struct {
	// Version is the raw tag or release name as published, e.g. "v1.27.0" or
	// "1.27-alpine". It is what include/exclude match against and what style
	// preservation reads.
	Version string

	// Semver is Version parsed for comparison, or nil when it is not
	// semver-shaped (calver, a commit pin) and so cannot be ordered.
	Semver *version.Version

	// Prerelease marks a version the upstream declares a prerelease out of band
	// of its tag - e.g. a GitHub release flagged pre-release on a clean tag.
	// Selection excludes it like a semver prerelease unless prereleases are
	// allowed. Providers with no such signal leave it false.
	Prerelease bool

	// PublishedAt is when the version was released, used by cooldown. Zero when
	// the provider's listing does not carry a timestamp.
	PublishedAt time.Time

	// Commit is the commit SHA the version points at, when the provider exposes
	// one (e.g. a GitHub tag or release target).
	Commit string

	// Ref is the upstream reference the version came from, e.g. the tag name a
	// release was cut from.
	Ref string

	// Digest is the content digest the version resolves to (e.g. an OCI image's
	// sha256 manifest digest), for secure-pin rewriting. Empty until resolved.
	Digest string

	// Assets are the downloadable files the version publishes (e.g. a GitHub
	// release's assets), the source for auto-sourcing a follower's sha256.
	Assets []Asset

	// Meta holds provider-specific values that do not warrant a typed field.
	Meta map[string]string
}