gemara

type AcceptedMethod struct {
	Id string `json:"id" yaml:"id"`

	Type MethodType `json:"type" yaml:"type"`

	Mode ModeType `json:"mode" yaml:"mode"`

	Required bool `json:"required" yaml:"required"`

	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	Executor Actor `json:"executor,omitempty" yaml:"executor,omitempty"`
}

type AcceptedRisk struct {
	// id allows this accepted risk entry to be referenced
	Id string `json:"id" yaml:"id"`

	// target-id optionally links this acceptance to a mitigated risk entry
	Target_id string `json:"target-id,omitempty" yaml:"target-id,omitempty"`

	// risk references the risk being accepted
	Risk EntryMapping `json:"risk" yaml:"risk"`

	// scope defines where the risk acceptance applies
	Scope Scope `json:"scope,omitempty" yaml:"scope,omitempty"`

	// justification explains why the risk is accepted
	Justification string `json:"justification,omitempty" yaml:"justification,omitempty"`
}

type ActionResult struct {
	// disposition is the enforcement action taken
	Disposition Disposition `json:"disposition" yaml:"disposition"`

	// method references the specific AcceptedMethod entry within the Policy being enforced
	Method EntryMapping `json:"method" yaml:"method"`

	// message provides additional context about the action
	Message *string `json:"message,omitempty" yaml:"message,omitempty"`

	// start is the timestamp when the enforcement action began
	Start Datetime `json:"start" yaml:"start"`

	// end is the timestamp when the enforcement action concluded
	End Datetime `json:"end,omitempty" yaml:"end,omitempty"`

	// steps references the code paths or addresses that carried out this enforcement action
	Steps []EnforcementStep `json:"steps" yaml:"steps"`

	// justification links the action to its assessment findings and any applicable exceptions
	Justification Justification `json:"justification" yaml:"justification"`
}

type Actor struct {
	// contact is contact information for the actor
	Contact Contact `json:"contact,omitempty" yaml:"contact,omitempty"`

	// id uniquely identifies the entity and allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// name is the name of the entity
	Name string `json:"name" yaml:"name"`

	// type specifies the type of entity interacting in the workflow
	Type EntityType `json:"type" yaml:"type"`

	// version is the version of the entity (for tools; if applicable)
	Version string `json:"version,omitempty" yaml:"version,omitempty"`

	// description provides additional context about the entity
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// uri is a general URI for the entity information
	Uri string `json:"uri,omitempty" yaml:"uri,omitempty"`
}

type Adherence struct {
	EvaluationMethods []AcceptedMethod `json:"evaluation-methods,omitempty" yaml:"evaluation-methods,omitempty"`

	AssessmentPlans []AssessmentPlan `json:"assessment-plans,omitempty" yaml:"assessment-plans,omitempty"`

	EnforcementMethods []AcceptedMethod `json:"enforcement-methods,omitempty" yaml:"enforcement-methods,omitempty"`

	NonCompliance string `json:"non-compliance,omitempty" yaml:"non-compliance,omitempty"`
}

type ArtifactMapping struct {
	// reference-id identifies an element from a MappingReference in the artifact's metadata
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	// remarks is prose regarding the mapped artifact or the mapping relationship
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type ArtifactType int

type AssessmentFinding struct {
	// result is the assessment outcome that triggered the enforcement action
	Result Result `json:"result" yaml:"result"`

	// requirement maps to the Layer 2 assessment requirement that was evaluated
	Requirement EntryMapping `json:"requirement,omitempty" yaml:"requirement,omitempty"`

	// plan maps to the Policy assessment plan that was executed
	Plan EntryMapping `json:"plan,omitempty" yaml:"plan,omitempty"`

	// log maps to the EvaluationLog entry containing the finding
	Log EntryMapping `json:"log" yaml:"log"`
}

type AssessmentLog struct {
	// Requirement should map to the assessment requirement for this assessment.
	Requirement EntryMapping `json:"requirement" yaml:"requirement"`

	// Plan maps to the policy assessment plan being executed.
	Plan *EntryMapping `json:"plan,omitempty" yaml:"plan,omitempty"`

	// Description provides a summary of the assessment procedure.
	Description string `json:"description" yaml:"description"`

	// Result is the overall outcome of the assessment procedure, matching the result of the last step that was run.
	Result Result `json:"result" yaml:"result"`

	// Message provides additional context about the assessment result.
	Message string `json:"message" yaml:"message"`

	// Applicability is elevated from the Layer 2 Assessment Requirement to aid in execution and reporting.
	Applicability []string `json:"applicability" yaml:"applicability"`

	// Steps are sequential actions taken as part of the assessment, which may halt the assessment if a failure occurs.
	Steps []AssessmentStep `json:"steps" yaml:"steps"`

	// Steps-executed is the number of steps that were executed as part of the assessment.
	StepsExecuted int64 `json:"steps-executed,omitempty" yaml:"steps-executed,omitempty"`

	// Start is the timestamp when the assessment began.
	Start Datetime `json:"start" yaml:"start"`

	// End is the timestamp when the assessment concluded.
	End Datetime `json:"end,omitempty" yaml:"end,omitempty"`

	// Recommendation provides guidance on how to address a failed assessment.
	Recommendation string `json:"recommendation,omitempty" yaml:"recommendation,omitempty"`

	// ConfidenceLevel indicates the evaluator's confidence level in this specific assessment result.
	ConfidenceLevel ConfidenceLevel `json:"confidence-level,omitempty" yaml:"confidence-level,omitempty"`

	// Evidence records the raw data cited to support this assessment's opinion.
	Evidence []Evidence `json:"evidence,omitempty" yaml:"evidence,omitempty"`
}

type AssessmentPlan struct {
	Id string `json:"id" yaml:"id"`

	RequirementId string `json:"requirement-id" yaml:"requirement-id"`

	Frequency string `json:"frequency" yaml:"frequency"`

	EvaluationMethods []AcceptedMethod `json:"evaluation-methods" yaml:"evaluation-methods"`

	EvidenceRequirements string `json:"evidence-requirements,omitempty" yaml:"evidence-requirements,omitempty"`

	Parameters []Parameter `json:"parameters,omitempty" yaml:"parameters,omitempty"`
}

type AssessmentRequirement struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// text is the body of the requirement, typically written as a MUST condition
	Text string `json:"text" yaml:"text"`

	// applicability is a list of strings describing the situations where this text functions as a requirement for its parent control
	Applicability []string `json:"applicability" yaml:"applicability"`

	// recommendation provides readers with non-binding suggestions to aid in evaluation or enforcement of the requirement
	Recommendation string `json:"recommendation,omitempty" yaml:"recommendation,omitempty"`

	// state is the lifecycle state of this assessment requirement
	State Lifecycle `json:"state" yaml:"state"`

	// replaced-by references the assessment requirement that supersedes this one when deprecated or retired
	ReplacedBy *EntryMapping `json:"replaced-by,omitempty" yaml:"replaced-by,omitempty"`
}

type AssessmentRequirementModifier struct {
	Id string `json:"id" yaml:"id"`

	TargetId string `json:"target-id" yaml:"target-id"`

	ModificationType ModType `json:"modification-type" yaml:"modification-type"`

	ModificationRationale string `json:"modification-rationale" yaml:"modification-rationale"`

	// The updated text of the assessment requirement
	Text string `json:"text,omitempty" yaml:"text,omitempty"`

	// The updated applicability of the assessment requirement
	Applicability []string `json:"applicability,omitempty" yaml:"applicability,omitempty"`

	// The updated recommendation for the assessment requirement
	Recommendation string `json:"recommendation,omitempty" yaml:"recommendation,omitempty"`
}

type AssessmentStep func(payload interface{}) (Result, string, ConfidenceLevel)

type AuditLog struct {
	// metadata provides detailed data about this log
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// owner defines the RACI roles responsible for managing the audit
	Owner RACI `json:"owner,omitempty" yaml:"owner,omitempty"`

	// summary provides the high-level conclusion
	Summary string `json:"summary" yaml:"summary"`

	// criteria defines the acceptable state for the audited resource
	Criteria []ArtifactMapping `json:"criteria" yaml:"criteria"`

	// results records audit results against the criteria
	Results []*AuditResult `json:"results" yaml:"results"`

	// target identifies the resource being evaluated
	Target Resource `json:"target" yaml:"target"`
}

type AuditResult struct {
	// id uniquely identifies this result
	Id string `json:"id" yaml:"id"`

	// title describes this result at a glance
	Title string `json:"title" yaml:"title"`

	// type classifies the nature of this result
	Type ResultType `json:"type" yaml:"type"`

	// description explains the result in detail
	Description string `json:"description" yaml:"description"`

	// criteria-reference maps this result to specific criteria entries
	CriteriaReference MultiEntryMapping `json:"criteria-reference" yaml:"criteria-reference"`

	// evidence records the data sources that support this result
	Evidence []Evidence `json:"evidence,omitempty" yaml:"evidence,omitempty"`

	// recommendations records corrective actions for this result
	Recommendations []Recommendation `json:"recommendations,omitempty" yaml:"recommendations,omitempty"`
}

type Capability struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes this capability at a glance
	Title string `json:"title" yaml:"title"`

	// description provides a detailed overview of this capability
	Description string `json:"description" yaml:"description"`

	// group references by id a catalog group that this capability belongs to
	Group string `json:"group" yaml:"group"`
}

type CapabilityCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// capabilities is a list of capabilities defined by this catalog
	Capabilities []Capability `json:"capabilities,omitempty" yaml:"capabilities,omitempty"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`
}

type Catalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`
}

type CatalogImport struct {
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	Exclusions []string `json:"exclusions,omitempty" yaml:"exclusions,omitempty"`

	Constraints []Constraint `json:"constraints,omitempty" yaml:"constraints,omitempty"`

	AssessmentRequirementModifications []AssessmentRequirementModifier `json:"assessment-requirement-modifications,omitempty" yaml:"assessment-requirement-modifications,omitempty"`
}

type Checklist struct {
	// PolicyId identifies the policy.
	PolicyId string
	// PolicyTitle is the title of the policy.
	PolicyTitle string
	// Author is the name of the policy author.
	Author string
	// AuthorVersion is the version of the authoring tool or system.
	AuthorVersion string
	// Sections are the requirement sections
	Sections []RequirementSection
}

type ChecklistItem struct {
	// PlanId is the assessment plan identifier this item belongs to.
	PlanId string
	// MethodDescription provides additional context or a summary about the method.
	MethodDescription string
	// MethodType defines the category the method falls into.
	MethodType string
	// Frequency indicates how often this assessment should be performed.
	Frequency string
	// EvidenceRequirements describes what evidence is required for this assessment.
	EvidenceRequirements string
}

type ConfidenceLevel int

type Constraint struct {
	// Unique ID for this constraint to enable Layer 5/6 tracking
	Id string `json:"id" yaml:"id"`

	// Links to the specific Guidance or Control being constrained
	TargetId string `json:"target-id" yaml:"target-id"`

	// The prescriptive requirement/constraint text
	Text string `json:"text" yaml:"text"`
}

type Contact struct {
	// name is the preferred descriptor for the contact entity
	Name string `json:"name" yaml:"name"`

	// affiliation is the organization with which the contact entity is associated, such as a team, school, or employer
	Affiliation *string `json:"affiliation,omitempty" yaml:"affiliation,omitempty"`

	// email is the preferred email address to reach the contact
	Email *Email `json:"email,omitempty" yaml:"email,omitempty"`

	// social is a social media handle or other profile for the contact, such as GitHub
	Social *string `json:"social,omitempty" yaml:"social,omitempty"`
}

type Control struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the purpose of this control at a glance
	Title string `json:"title" yaml:"title"`

	// objective is a unified statement of intent, which may encompass multiple situationally applicable requirements
	Objective string `json:"objective" yaml:"objective"`

	// group references by id a catalog group that this control belongs to
	Group string `json:"group" yaml:"group"`

	// assessment-requirements is a list of requirements that must be verified to confirm the control objective has been met
	AssessmentRequirements []AssessmentRequirement `json:"assessment-requirements" yaml:"assessment-requirements"`

	// guidelines documents relationships between this control and Layer 1 guideline artifacts
	Guidelines []MultiEntryMapping `json:"guidelines,omitempty" yaml:"guidelines,omitempty"`

	// threats documents relationships between this control and Layer 2 threat artifacts
	Threats []MultiEntryMapping `json:"threats,omitempty" yaml:"threats,omitempty"`

	// state is the lifecycle state of this control
	State Lifecycle `json:"state" yaml:"state"`

	// replaced-by references the control that supersedes this one when deprecated or retired
	ReplacedBy *EntryMapping `json:"replaced-by,omitempty" yaml:"replaced-by,omitempty"`
}

type ControlCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// controls is a list of unique controls defined by this catalog
	Controls []Control `json:"controls,omitempty" yaml:"controls,omitempty"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`
}

type ControlEvaluation struct {
	Name string `json:"name" yaml:"name"`

	Result Result `json:"result" yaml:"result"`

	Message string `json:"message" yaml:"message"`

	Control EntryMapping `json:"control" yaml:"control"`

	// Enforce that control reference and the assessments' references match
	// This formulation uses the control's reference if the assessment doesn't include a reference
	AssessmentLogs []*AssessmentLog `json:"assessment-logs" yaml:"assessment-logs"`
}

type Datetime string

type Dimensions struct {
	// technologies is an optional list of technology categories or services
	Technologies []string `json:"technologies,omitempty" yaml:"technologies,omitempty"`

	// geopolitical is an optional list of geopolitical regions
	Geopolitical []string `json:"geopolitical,omitempty" yaml:"geopolitical,omitempty"`

	// sensitivity is an optional list of data classification levels
	Sensitivity []string `json:"sensitivity,omitempty" yaml:"sensitivity,omitempty"`

	// users is an optional list of user roles
	Users []string `json:"users,omitempty" yaml:"users,omitempty"`

	Groups []string `json:"groups,omitempty" yaml:"groups,omitempty"`
}

type Disposition int

type Email string

type EnforcementLog struct {
	// metadata provides detailed data about this log
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// disposition is the aggregate enforcement disposition across all actions in this log
	Disposition Disposition `json:"disposition" yaml:"disposition"`

	// actions is the list of enforcement actions performed
	//
	// Enforce that Clear dispositions only contain Passed assessment results
	Actions []*ActionResult `json:"actions" yaml:"actions"`

	// target identifies the resource being evaluated
	Target Resource `json:"target" yaml:"target"`
}

type EnforcementStep string

type Entity struct {
	// id uniquely identifies the entity and allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// name is the name of the entity
	Name string `json:"name" yaml:"name"`

	// type specifies the type of entity interacting in the workflow
	Type EntityType `json:"type" yaml:"type"`

	// version is the version of the entity (for tools; if applicable)
	Version string `json:"version,omitempty" yaml:"version,omitempty"`

	// description provides additional context about the entity
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// uri is a general URI for the entity information
	Uri string `json:"uri,omitempty" yaml:"uri,omitempty"`
}

type EntityType int

type EntryMapping struct {
	// reference-id is the id for a MappingReference entry in the artifact's metadata
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	// entry-id is the identifier being mapped to in the referenced artifact
	EntryId string `json:"entry-id" yaml:"entry-id"`

	// remarks is prose describing the mapping relationship
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type EntryType int

type EvaluationLog struct {
	// metadata provides detailed data about this log
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// result is the aggregate outcome across all evaluations in this log
	Result Result `json:"result" yaml:"result"`

	Evaluations []*ControlEvaluation `json:"evaluations" yaml:"evaluations"`

	// target identifies the resource being evaluated
	Target Resource `json:"target" yaml:"target"`
}

type Evidence struct {
	// id uniquely identifies this evidence
	Id string `json:"id" yaml:"id"`

	// type categorizes the kind of evidence
	Type EvidenceType `json:"type" yaml:"type"`

	// collected-at is the timestamp when the evidence was gathered
	CollectedAt Datetime `json:"collected-at" yaml:"collected-at"`

	// payload is the raw evidence data collected
	Payload any `json:"payload,omitempty" yaml:"payload,omitempty"`

	// description explains what this evidence represents
	Description string `json:"description,omitempty" yaml:"description,omitempty"`
}

type EvidenceCollector struct {
	// contains filtered or unexported fields
}

type EvidenceType string

type Exemption struct {
	// description identifies who or what is exempt from the full guidance
	Description string `json:"description" yaml:"description"`

	// reason explains why the exemption is granted
	Reason string `json:"reason" yaml:"reason"`

	// redirect points to alternative guidelines or controls that should be followed instead
	Redirect *MultiEntryMapping `json:"redirect,omitempty" yaml:"redirect,omitempty"`
}

type Fetcher interface {
	Fetch(ctx context.Context, source string) (io.ReadCloser, error)
}

type Group struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the purpose of this group at a glance
	Title string `json:"title" yaml:"title"`

	// description explains the significance and traits of entries to this group
	Description string `json:"description" yaml:"description"`
}

type GuidanceCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`

	// type categorizes this document based on the intent of its contents
	GuidanceType GuidanceType `json:"type" yaml:"type"`

	// front-matter provides introductory text for the document to be used during rendering
	FrontMatter string `json:"front-matter,omitempty" yaml:"front-matter,omitempty"`

	// guidelines is a list of unique guidelines defined by this catalog
	Guidelines []Guideline `json:"guidelines,omitempty" yaml:"guidelines,omitempty"`

	// exemptions provides information about situations where this guidance is not applicable
	Exemptions []Exemption `json:"exemptions,omitempty" yaml:"exemptions,omitempty"`
}

type GuidanceImport struct {
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	Exclusions []string `json:"exclusions,omitempty" yaml:"exclusions,omitempty"`

	// Constraints allow policy authors to define ad hoc minimum requirements (e.g., "review at least annually").
	Constraints []Constraint `json:"constraints,omitempty" yaml:"constraints,omitempty"`
}

type GuidanceType int

type Guideline struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the contents of this guideline
	Title string `json:"title" yaml:"title"`

	// objective is a unified statement of intent, which may encompass multiple situationally applicable statements
	Objective string `json:"objective" yaml:"objective"`

	// group provides an id to the group that this guideline belongs to
	Group string `json:"group" yaml:"group"`

	// recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the guideline
	Recommendations []string `json:"recommendations,omitempty" yaml:"recommendations,omitempty"`

	// extends is an id for a guideline which this guideline adds to, in this document or elsewhere
	Extends *EntryMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	// applicability specifies the contexts in which this guideline applies
	Applicability []string `json:"applicability,omitempty" yaml:"applicability,omitempty"`

	// rationale provides the context for this guideline
	Rationale *Rationale `json:"rationale,omitempty" yaml:"rationale,omitempty"`

	// statements is a list of structural sub-requirements within a guideline
	Statements []Statement `json:"statements,omitempty" yaml:"statements,omitempty"`

	// principles documents the relationship between this guideline and one or more principles
	Principles []MultiEntryMapping `json:"principles,omitempty" yaml:"principles,omitempty"`

	// vector-mappings documents the relationship between this guideline and one or more vectors
	Vectors []MultiEntryMapping `json:"vectors,omitempty" yaml:"vectors,omitempty"`

	// see-also lists related guideline IDs within the same GuidanceCatalog
	SeeAlso []string `json:"see-also,omitempty" yaml:"see-also,omitempty"`

	// state is the lifecycle state of this guideline
	State Lifecycle `json:"state" yaml:"state"`

	// replaced-by references the guideline that supersedes this one when deprecated or retired
	ReplacedBy *EntryMapping `json:"replaced-by,omitempty" yaml:"replaced-by,omitempty"`
}

type HasEvidence interface {
	// GetEvidence returns the evidence recorded since the last clear.
	GetEvidence() []Evidence

	// AddEvidence appends a piece of evidence; it may be called more than once
	// within a single step.
	AddEvidence(evidence Evidence)

	// ClearEvidence empties the evidence location. The assessment calls it after
	// copying each step's evidence into the log, so a later step that records
	// nothing does not cause this step's evidence to be re-copied.
	ClearEvidence()
}

type ImplementationDetails struct {
	Start Datetime `json:"start" yaml:"start"`

	End Datetime `json:"end,omitempty" yaml:"end,omitempty"`

	Notes string `json:"notes" yaml:"notes"`
}

type ImplementationPlan struct {
	NotificationProcess string `json:"notification-process,omitempty" yaml:"notification-process,omitempty"`

	EvaluationTimeline ImplementationDetails `json:"evaluation-timeline" yaml:"evaluation-timeline"`

	EnforcementTimeline ImplementationDetails `json:"enforcement-timeline" yaml:"enforcement-timeline"`
}

type Imports struct {
	Policies []ArtifactMapping `json:"policies,omitempty" yaml:"policies,omitempty"`

	Catalogs []CatalogImport `json:"catalogs,omitempty" yaml:"catalogs,omitempty"`

	Guidance []GuidanceImport `json:"guidance,omitempty" yaml:"guidance,omitempty"`
}

type Justification struct {
	// assessments links the action to one or more Assessment Findings
	Assessments []AssessmentFinding `json:"assessments" yaml:"assessments"`

	// exceptions references approved Policy exceptions that authorize the action
	Exceptions []ArtifactMapping `json:"exceptions,omitempty" yaml:"exceptions,omitempty"`
}

type Lexicon struct {
	// title describes the purpose of this lexicon at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this document
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// terms is one or more defined entries for linking and rendering
	Terms []LexiconTerm `json:"terms" yaml:"terms"`
}

type LexiconReference struct {
	// citation identifies the source material in prose
	Citation string `json:"citation" yaml:"citation"`

	// url points to supporting material when available
	Url string `json:"url,omitempty" yaml:"url,omitempty"`
}

type LexiconTerm struct {
	// id allows this entry to be referenced for anchors and tooling
	Id string `json:"id" yaml:"id"`

	// title is the canonical name of the defined concept
	Title string `json:"title" yaml:"title"`

	// definition explains the meaning of the term
	Definition string `json:"definition" yaml:"definition"`

	// synonyms lists alternative labels that should resolve to this term for linking
	Synonyms []string `json:"synonyms,omitempty" yaml:"synonyms,omitempty"`

	// references cites external authorities supporting the definition
	References []LexiconReference `json:"references,omitempty" yaml:"references,omitempty"`
}

type Lifecycle int

type Log struct {
	// metadata provides detailed data about this log
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// target identifies the resource being evaluated
	Target Resource `json:"target" yaml:"target"`
}

type Mapping struct {
	// id allows this mapping to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// source identifies the entry being mapped from by its entry-id
	Source string `json:"source" yaml:"source"`

	// targets identifies the entries being mapped to; absent when relationship is no-match
	Targets []MappingTarget `json:"targets,omitempty" yaml:"targets,omitempty"`

	// relationship describes the nature of the mapping between source and all targets
	Relationship RelationshipType `json:"relationship" yaml:"relationship"`

	// remarks is general prose regarding this mapping
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type MappingDocument struct {
	// title describes the purpose of this mapping document at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this document
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// source-reference identifies the artifact being mapped from; must match a mapping-reference id
	SourceReference TypedMapping `json:"source-reference" yaml:"source-reference"`

	// target-reference identifies the artifact being mapped to; must match a mapping-reference id
	TargetReference TypedMapping `json:"target-reference" yaml:"target-reference"`

	// mappings is one or more atomic relationships between entries in the referenced artifacts
	Mappings []Mapping `json:"mappings" yaml:"mappings"`

	// remarks is prose regarding this mapping document
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type MappingReference struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the purpose of this mapping reference at a glance
	Title string `json:"title" yaml:"title"`

	// version is the version identifier of the artifact being mapped to
	Version string `json:"version" yaml:"version"`

	// description is prose regarding the artifact's purpose or content
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// url is the path where the artifact may be retrieved; preferrably responds with Gemara-compatible YAML/JSON
	Url string `json:"url,omitempty" yaml:"url,omitempty"`
}

type MappingTarget struct {
	// entry-id identifies the specific entry in the target artifact
	EntryId string `json:"entry-id" yaml:"entry-id"`

	// strength is the author's estimate of how completely the source satisfies this target; range 1-10
	Strength int64 `json:"strength,omitempty" yaml:"strength,omitempty"`

	ConfidenceLevel ConfidenceLevel `json:"confidence-level,omitempty" yaml:"confidence-level,omitempty"`

	// applicability constrains the contexts in which this target mapping holds
	Applicability []string `json:"applicability,omitempty" yaml:"applicability,omitempty"`

	// rationale explains why this relationship exists for this target
	Rationale string `json:"rationale,omitempty" yaml:"rationale,omitempty"`

	// remarks is general prose regarding this target mapping
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type Metadata struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// type identifies the kind of Gemara artifact for unambiguous parsing
	Type ArtifactType `json:"type" yaml:"type"`

	// gemara-version declares which version of the Gemara specification this artifact conforms to
	GemaraVersion string `json:"gemara-version" yaml:"gemara-version"`

	// version is the version identifier of this artifact
	Version string `json:"version,omitempty" yaml:"version,omitempty"`

	// date is the publication or effective date of this artifact
	Date Datetime `json:"date,omitempty" yaml:"date,omitempty"`

	// description provides a high-level summary of the artifact's purpose and scope
	Description string `json:"description" yaml:"description"`

	// author is the person or group primarily responsible for this artifact
	Author Actor `json:"author" yaml:"author"`

	// mapping-references is a list of external documents referenced within this artifact
	MappingReferences []MappingReference `json:"mapping-references,omitempty" yaml:"mapping-references,omitempty"`

	// applicability-groups is a list of groups used to classify within this artifact to specify scope
	ApplicabilityGroups []Group `json:"applicability-groups,omitempty" yaml:"applicability-groups,omitempty"`

	// draft indicates whether this artifact is a pre-release version; open to modification
	Draft bool `json:"draft,omitempty" yaml:"draft,omitempty"`

	// lexicon is a URI pointing to a controlled vocabulary or glossary relevant to this artifact
	Lexicon *ArtifactMapping `json:"lexicon,omitempty" yaml:"lexicon,omitempty"`
}

type MethodType int

type MitigatedRisk struct {
	// id allows this mitigated risk entry to be referenced by accepted risks
	Id string `json:"id" yaml:"id"`

	// risk references the risk being mitigated
	Risk EntryMapping `json:"risk" yaml:"risk"`
}

type ModType int

type ModeType int

type MultiEntryMapping struct {
	// entries is a list of mapping entries
	Entries []ArtifactMapping `json:"entries" yaml:"entries"`

	// reference-id identifies an element from a MappingReference in the artifact's metadata
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	// remarks is prose regarding the mapped artifact or the mapping relationship
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type Parameter struct {
	Id string `json:"id" yaml:"id"`

	Label string `json:"label" yaml:"label"`

	Description string `json:"description" yaml:"description"`

	AcceptedValues []string `json:"accepted-values,omitempty" yaml:"accepted-values,omitempty"`
}

type Policy struct {
	Title string `json:"title" yaml:"title"`

	Metadata Metadata `json:"metadata" yaml:"metadata"`

	Contacts RACI `json:"contacts" yaml:"contacts"`

	Scope Scope `json:"scope" yaml:"scope"`

	Imports Imports `json:"imports" yaml:"imports"`

	ImplementationPlan ImplementationPlan `json:"implementation-plan,omitempty" yaml:"implementation-plan,omitempty"`

	Risks Risks `json:"risks,omitempty" yaml:"risks,omitempty"`

	Adherence Adherence `json:"adherence" yaml:"adherence"`
}

type Principle struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the principle at a glance
	Title string `json:"title" yaml:"title"`

	// description explains the principle and its expected outcomes
	Description string `json:"description" yaml:"description"`

	// group references by id a catalog group that this principle belongs to
	Group string `json:"group" yaml:"group"`

	// rationale provides the context for this principle
	Rationale string `json:"rationale,omitempty" yaml:"rationale,omitempty"`
}

type PrincipleCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`

	// principles is a list of unique principles defined by this catalog
	Principles []Principle `json:"principles,omitempty" yaml:"principles,omitempty"`
}

type RACI struct {
	// responsible identifies the entities responsible for executing work to manage or mitigate the artifact
	Responsible []Contact `json:"responsible" yaml:"responsible"`

	// accountable identifies the entity ultimately accountable for the outcome
	Accountable []Contact `json:"accountable" yaml:"accountable"`

	// consulted identifies entities whose input is required when assessing or responding to the artifact
	Consulted []Contact `json:"consulted,omitempty" yaml:"consulted,omitempty"`

	// informed identifies entities that should be notified about changes to the artifact status
	Informed []Contact `json:"informed,omitempty" yaml:"informed,omitempty"`
}

type Rationale struct {
	// importance is an explanation of why this guideline matters
	Importance string `json:"importance" yaml:"importance"`

	// goals is a list of outcomes this guideline seeks to achieve
	Goals []string `json:"goals" yaml:"goals"`
}

type Recommendation struct {
	// id uniquely identifies this recommendation
	Id string `json:"id,omitempty" yaml:"id,omitempty"`

	// text describes the recommended corrective action
	Text string `json:"text" yaml:"text"`

	// required indicates whether this recommendation is a mandatory corrective action
	Required bool `json:"required" yaml:"required"`
}

type RelationshipType int

type RequirementSection struct {
	// RequirementId is the assessment requirement identifier (e.g., "OSPS-AC-01.01")
	RequirementId string
	// Items are the checklist items for this requirement
	Items []ChecklistItem
}

type Resource struct {
	// environment describes where the resource exists (e.g., production, staging, development, specific region)
	Environment string `json:"environment,omitempty" yaml:"environment,omitempty"`

	// id uniquely identifies the entity and allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// name is the name of the entity
	Name string `json:"name" yaml:"name"`

	// owner is the contact information for the person or group responsible for managing or owning this resource
	Owner Contact `json:"owner,omitempty" yaml:"owner,omitempty"`

	// type specifies the type of entity interacting in the workflow
	Type EntityType `json:"type" yaml:"type"`

	// version is the version of the entity (for tools; if applicable)
	Version string `json:"version,omitempty" yaml:"version,omitempty"`

	// description provides additional context about the entity
	Description string `json:"description,omitempty" yaml:"description,omitempty"`

	// uri is a general URI for the entity information
	Uri string `json:"uri,omitempty" yaml:"uri,omitempty"`
}

type Result int

type ResultType int

type Risk struct {
	// id allows this risk to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the risk
	Title string `json:"title" yaml:"title"`

	// description explains the risk scenario
	Description string `json:"description" yaml:"description"`

	// group references by id a catalog group that this risk belongs to
	Group string `json:"group" yaml:"group"`

	// severity describes the assessed level of this risk
	Severity Severity `json:"severity" yaml:"severity"`

	// rank optionally orders risks for the same catalog (e.g. when several share the same severity).
	// Lower values mean higher relative importance. Omitted when the four severity levels are enough.
	// When set, each value must be unique among all risks in the catalog that specify rank.
	Rank int64 `json:"rank,omitempty" yaml:"rank,omitempty"`

	// owner defines the RACI roles responsible for managing this risk
	Owner RACI `json:"owner,omitempty" yaml:"owner,omitempty"`

	// impact describes the business or operational impact
	Impact string `json:"impact,omitempty" yaml:"impact,omitempty"`

	// threats link this risk to Layer 2 threats
	Threats []MultiEntryMapping `json:"threats,omitempty" yaml:"threats,omitempty"`
}

type RiskAppetite int

type RiskCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups narrows the base groups to risk categories with appetite and severity boundaries
	//
	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []RiskCategory `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`

	// risks is a list of risks defined by this catalog
	Risks []Risk `json:"risks,omitempty" yaml:"risks,omitempty"`
}

type RiskCategory struct {
	// appetite defines the acceptable level of risk for this category
	Appetite RiskAppetite `json:"appetite" yaml:"appetite"`

	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// max-severity defines the risk tolerance boundary: the highest severity
	// the organization will accept within this category
	MaxSeverity Severity `json:"max-severity,omitempty" yaml:"max-severity,omitempty"`

	// title describes the purpose of this group at a glance
	Title string `json:"title" yaml:"title"`

	// description explains the significance and traits of entries to this group
	Description string `json:"description" yaml:"description"`
}

type Risks struct {
	// Mitigated risks only need reference-id and risk-id (no justification required)
	Mitigated []MitigatedRisk `json:"mitigated,omitempty" yaml:"mitigated,omitempty"`

	// Accepted risks require rationale (justification) and may include scope. Controls addressing these risks are implicitly identified through threat mappings.
	Accepted []AcceptedRisk `json:"accepted,omitempty" yaml:"accepted,omitempty"`
}

type SControl struct {
	Control
	// contains filtered or unexported fields
}

type SControlCatalog struct {
	ControlCatalog
	// contains filtered or unexported fields
}

type Scope struct {
	In Dimensions `json:"in" yaml:"in"`

	Out Dimensions `json:"out,omitempty" yaml:"out,omitempty"`
}

type Severity int

type Statement struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the contents of this statement
	Title string `json:"title,omitempty" yaml:"title,omitempty"`

	// text is the body of this statement
	Text string `json:"text" yaml:"text"`

	// recommendations is a list of non-binding suggestions to aid in evaluation or enforcement of the statement
	Recommendations []string `json:"recommendations,omitempty" yaml:"recommendations,omitempty"`
}

type Threat struct {
	// id allows this entry to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes this threat at a glance
	Title string `json:"title" yaml:"title"`

	// description provides a detailed explanation of an opportunity for negative impact
	Description string `json:"description" yaml:"description"`

	// group references by id a catalog group that this threat belongs to
	Group string `json:"group" yaml:"group"`

	// capabilities documents the relationship between this threat and a system capability
	Capabilities []MultiEntryMapping `json:"capabilities" yaml:"capabilities"`

	// vectors documents the relationship between this threat and one or more vectors
	Vectors []MultiEntryMapping `json:"vectors,omitempty" yaml:"vectors,omitempty"`

	// actors describes the relevant internal or external threat actors
	Actors []Actor `json:"actors,omitempty" yaml:"actors,omitempty"`
}

type ThreatCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`

	// threats is a list of threats defined by this catalog
	Threats []Threat `json:"threats,omitempty" yaml:"threats,omitempty"`
}

type TypeMeta struct {
	Metadata struct {
		Type ArtifactType `json:"type" yaml:"type"`
	} `json:"metadata" yaml:"metadata"`
}

type TypedMapping struct {
	// entry-type identifies the type of atomic unit entries in this direction
	EntryType EntryType `json:"entry-type" yaml:"entry-type"`

	// reference-id identifies an element from a MappingReference in the artifact's metadata
	ReferenceId string `json:"reference-id" yaml:"reference-id"`

	// remarks is prose regarding the mapped artifact or the mapping relationship
	Remarks string `json:"remarks,omitempty" yaml:"remarks,omitempty"`
}

type Vector struct {
	// id allows this vector to be referenced by other elements
	Id string `json:"id" yaml:"id"`

	// title describes the vector
	Title string `json:"title" yaml:"title"`

	// description explains how the attack vector works
	Description string `json:"description" yaml:"description"`

	// group references by id a catalog group that this vector belongs to
	Group string `json:"group" yaml:"group"`

	// applicability specifies the contexts in which this vector can manifest
	Applicability []string `json:"applicability,omitempty" yaml:"applicability,omitempty"`
}

type VectorCatalog struct {
	// title describes the purpose of this catalog at a glance
	Title string `json:"title" yaml:"title"`

	// metadata provides detailed data about this catalog
	Metadata Metadata `json:"metadata" yaml:"metadata"`

	// groups contains a list of groups that can be referenced by entries in this catalog
	Groups []Group `json:"groups,omitempty" yaml:"groups,omitempty"`

	// extends references catalogs that this catalog builds upon
	Extends []ArtifactMapping `json:"extends,omitempty" yaml:"extends,omitempty"`

	Imports []MultiEntryMapping `json:"imports,omitempty" yaml:"imports,omitempty"`

	// vectors is a list of attack vectors documented in this catalog
	Vectors []Vector `json:"vectors,omitempty" yaml:"vectors,omitempty"`
}