ir

type Actor struct {
	// ID is the unique identifier.
	ID string `json:"id"`

	// Label is the display name.
	Label string `json:"label"`

	// Type identifies the actor type (for styling).
	Type ElementType `json:"type,omitempty"`

	// Malicious indicates if this is an attacker-controlled actor.
	Malicious bool `json:"malicious,omitempty"`
}

type AgentCapabilities struct {
	// Tools lists the tools available to the agent.
	Tools []AgentTool `json:"tools,omitempty"`

	// Permissions lists the permissions granted to the agent.
	Permissions []AgentPermission `json:"permissions,omitempty"`

	// SandboxLevel indicates the agent's isolation level.
	SandboxLevel AgentSandboxLevel `json:"sandboxLevel,omitempty"`

	// RequiresApproval indicates which actions require human approval.
	RequiresApproval []string `json:"requiresApproval,omitempty"`

	// ApprovalBypassable indicates whether approval requirements can be bypassed.
	// This is a critical security control for agentic systems.
	ApprovalBypassable bool `json:"approvalBypassable,omitempty"`

	// MaxExecutionTime is the maximum execution time per action (e.g., "30s", "5m").
	MaxExecutionTime string `json:"maxExecutionTime,omitempty"`

	// ResourceLimits describes resource constraints.
	ResourceLimits *AgentResourceLimits `json:"resourceLimits,omitempty"`

	// NetworkRestrictions describes network access limitations.
	NetworkRestrictions *AgentNetworkRestrictions `json:"networkRestrictions,omitempty"`

	// IntegratedServices lists external services the agent can access.
	IntegratedServices []AgentIntegration `json:"integratedServices,omitempty"`

	// EscalationPaths describes how the agent's capabilities could be escalated.
	EscalationPaths []AgentEscalationPath `json:"escalationPaths,omitempty"`
}

type AgentCapabilityType string

type AgentEscalationPath struct {
	// Name is a short name for this escalation path.
	Name string `json:"name"`

	// Description describes how escalation could occur.
	Description string `json:"description,omitempty"`

	// SourceCapability is the starting capability.
	SourceCapability AgentCapabilityType `json:"sourceCapability"`

	// TargetCapability is the escalated capability.
	TargetCapability AgentCapabilityType `json:"targetCapability"`

	// Mechanism describes the escalation mechanism.
	Mechanism string `json:"mechanism,omitempty"`

	// Mitigations lists controls that prevent this escalation.
	Mitigations []string `json:"mitigations,omitempty"`

	// ASIIds lists applicable OWASP Agentic Security categories.
	ASIIds []string `json:"asiIds,omitempty"`
}

type AgentIntegration struct {
	// Service is the service name (e.g., "slack", "github", "jira").
	Service string `json:"service"`

	// Permissions lists the permissions granted for this integration.
	Permissions []string `json:"permissions,omitempty"`

	// CredentialID links to the credential used for this integration.
	CredentialID string `json:"credentialId,omitempty"`

	// Scopes lists the OAuth scopes or API permissions.
	Scopes []string `json:"scopes,omitempty"`
}

type AgentNetworkRestrictions struct {
	// AllowedHosts lists hosts the agent can connect to.
	// Empty list with InternetAccess=true means unrestricted.
	AllowedHosts []string `json:"allowedHosts,omitempty"`

	// BlockedHosts lists hosts the agent cannot connect to.
	BlockedHosts []string `json:"blockedHosts,omitempty"`

	// AllowedPorts lists ports the agent can connect to.
	AllowedPorts []int `json:"allowedPorts,omitempty"`

	// InternetAccess indicates whether the agent can access the internet.
	InternetAccess bool `json:"internetAccess,omitempty"`

	// LocalhostAccess indicates whether the agent can access localhost.
	LocalhostAccess bool `json:"localhostAccess,omitempty"`

	// InternalNetworkAccess indicates whether the agent can access internal networks.
	InternalNetworkAccess bool `json:"internalNetworkAccess,omitempty"`
}

type AgentPermission struct {
	// Resource is the resource being accessed (e.g., "filesystem", "network", "api:slack").
	Resource string `json:"resource"`

	// Actions lists the permitted actions (e.g., "read", "write", "execute").
	Actions []string `json:"actions,omitempty"`

	// Scope limits the permission scope (e.g., "/home/user/workspace/*").
	Scope string `json:"scope,omitempty"`

	// Conditions describes conditions that must be met.
	Conditions string `json:"conditions,omitempty"`
}

type AgentResourceLimits struct {
	// MaxMemoryMB is the maximum memory in megabytes.
	MaxMemoryMB int `json:"maxMemoryMb,omitempty"`

	// MaxCPUPercent is the maximum CPU percentage.
	MaxCPUPercent int `json:"maxCpuPercent,omitempty"`

	// MaxDiskMB is the maximum disk space in megabytes.
	MaxDiskMB int `json:"maxDiskMb,omitempty"`

	// MaxOpenFiles is the maximum number of open file descriptors.
	MaxOpenFiles int `json:"maxOpenFiles,omitempty"`

	// MaxProcesses is the maximum number of spawned processes.
	MaxProcesses int `json:"maxProcesses,omitempty"`
}

type AgentSandboxLevel string

type AgentTool struct {
	// Name is the tool name (e.g., "system.run", "file.read", "web.browse").
	Name string `json:"name"`

	// Description describes what the tool does.
	Description string `json:"description,omitempty"`

	// CapabilityType categorizes the tool's capability.
	CapabilityType AgentCapabilityType `json:"capabilityType"`

	// Enabled indicates whether the tool is currently enabled.
	Enabled bool `json:"enabled,omitempty"`

	// RequiresApproval indicates whether using this tool requires human approval.
	RequiresApproval bool `json:"requiresApproval,omitempty"`

	// RiskLevel indicates the risk associated with this tool.
	RiskLevel RiskLevel `json:"riskLevel,omitempty"`

	// Parameters describes the tool's parameters.
	Parameters []AgentToolParameter `json:"parameters,omitempty"`

	// ASIIds lists applicable OWASP Agentic Security categories.
	ASIIds []string `json:"asiIds,omitempty"`
}

type AgentToolParameter struct {
	// Name is the parameter name.
	Name string `json:"name"`

	// Type is the parameter type (e.g., "string", "file-path", "url").
	Type string `json:"type,omitempty"`

	// Required indicates whether the parameter is required.
	Required bool `json:"required,omitempty"`

	// Validation describes validation rules applied to this parameter.
	Validation string `json:"validation,omitempty"`

	// SensitiveData indicates whether this parameter may contain sensitive data.
	SensitiveData bool `json:"sensitiveData,omitempty"`
}

type AlertThreshold struct {
	// Metric is the metric being monitored.
	Metric string `json:"metric"`

	// Threshold is the threshold value.
	Threshold string `json:"threshold"`

	// Window is the time window for evaluation (e.g., "5m", "1h").
	Window string `json:"window,omitempty"`

	// Severity is the alert severity when threshold is exceeded.
	Severity string `json:"severity,omitempty"`

	// Description explains this threshold.
	Description string `json:"description,omitempty"`
}

type Asset struct {
	// ID is the unique identifier for the asset.
	ID string `json:"id"`

	// Name is the human-readable asset name.
	Name string `json:"name"`

	// Description provides details about the asset.
	Description string `json:"description,omitempty"`

	// Type categorizes the asset.
	Type AssetType `json:"type,omitempty"`

	// Classification indicates the sensitivity level.
	Classification SensitivityLevel `json:"classification"`

	// Owner is the person or team responsible for the asset.
	Owner string `json:"owner,omitempty"`

	// ElementIDs links the asset to diagram elements that contain or process it.
	ElementIDs []string `json:"elementIds,omitempty"`

	// DataTypes describes what kind of data this asset contains.
	// Examples: "PII", "PHI", "financial", "credentials", "source-code"
	DataTypes []string `json:"dataTypes,omitempty"`

	// ComplianceFrameworks lists regulations that govern this asset.
	// Examples: "GDPR", "HIPAA", "PCI-DSS", "SOC2"
	ComplianceFrameworks []string `json:"complianceFrameworks,omitempty"`

	// Value describes the business value or impact if compromised.
	Value string `json:"value,omitempty"`

	// RetentionPeriod indicates how long the asset is retained.
	RetentionPeriod string `json:"retentionPeriod,omitempty"`
}

type AssetClassification string

type AssetType string

type Assumption struct {
	// ID is the unique identifier for the assumption.
	ID string `json:"id"`

	// Title is a brief statement of the assumption.
	Title string `json:"title"`

	// Description provides detailed context about the assumption.
	Description string `json:"description,omitempty"`

	// Type categorizes the assumption.
	Type AssumptionType `json:"type,omitempty"`

	// Rationale explains why this assumption is made.
	Rationale string `json:"rationale,omitempty"`

	// Impact describes what happens if the assumption is violated.
	Impact string `json:"impact,omitempty"`

	// ImpactSeverity rates the impact severity (critical, high, medium, low).
	ImpactSeverity string `json:"impactSeverity,omitempty"`

	// ValidationStatus indicates whether the assumption has been validated.
	ValidationStatus ValidationStatus `json:"validationStatus,omitempty"`

	// ValidationMethod describes how the assumption can be or was validated.
	ValidationMethod string `json:"validationMethod,omitempty"`

	// ValidatedDate is when the assumption was validated (RFC 3339 format).
	ValidatedDate string `json:"validatedDate,omitempty"`

	// Owner is the person or team responsible for validating this assumption.
	Owner string `json:"owner,omitempty"`

	// RelatedComponentIDs lists components that depend on this assumption.
	RelatedComponentIDs []string `json:"relatedComponentIds,omitempty"`

	// Notes provides additional context or caveats.
	Notes string `json:"notes,omitempty"`
}

type AssumptionType string

type AtomicTestMapping struct {
	// TechniqueID is the MITRE ATT&CK technique ID (e.g., "T1059.001").
	TechniqueID string `json:"techniqueId"`

	// AtomicTests lists specific Atomic test IDs (e.g., ["T1059.001-1", "T1059.001-2"]).
	AtomicTests []string `json:"atomicTests,omitempty"`

	// Validated indicates if the tests have been validated in the environment.
	Validated bool `json:"validated,omitempty"`

	// LastRun is the timestamp of the last test execution (ISO 8601).
	LastRun string `json:"lastRun,omitempty"`

	// Result is the outcome of the last test run.
	Result AtomicTestResult `json:"result,omitempty"`

	// Notes provides additional context about the test execution.
	Notes string `json:"notes,omitempty"`

	// Platform specifies the target platform (windows, linux, macos).
	Platform string `json:"platform,omitempty"`

	// ExecutionTime is the time taken to run the tests (in seconds).
	ExecutionTime int `json:"executionTime,omitempty"`
}

type AtomicTestResult string

type AtomicTestSummary struct {
	TotalTests int     `json:"totalTests"`
	Passed     int     `json:"passed"`
	Failed     int     `json:"failed"`
	Blocked    int     `json:"blocked"`
	Skipped    int     `json:"skipped"`
	Errors     int     `json:"errors"`
	PassRate   float64 `json:"passRate"`
	BlockRate  float64 `json:"blockRate"`
}

type Attack struct {
	// Step is the sequence number (1, 2, 3...).
	Step int `json:"step"`

	// From is the source element ID.
	From string `json:"from"`

	// To is the destination element ID.
	To string `json:"to"`

	// Label describes the attack step.
	Label string `json:"label"`

	// Action describes what the attacker does in this step.
	// More specific than Label when both are provided.
	Action string `json:"action,omitempty"`

	// Outcome describes the result of this attack step.
	Outcome string `json:"outcome,omitempty"`

	// MITRETactic is the MITRE ATT&CK tactic ID.
	MITRETactic MITRETactic `json:"mitreTactic,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID (e.g., T1110).
	MITRETechnique string `json:"mitreTechnique,omitempty"`

	// ATLASTechnique is the MITRE ATLAS technique ID for AI/ML-specific attacks.
	ATLASTechnique string `json:"atlasTechnique,omitempty"`

	// OWASPIds lists applicable OWASP categories (e.g., "API01", "LLM01", "A01:2021").
	// Supports multiple IDs as one step may map to several OWASP categories.
	OWASPIds []string `json:"owaspIds,omitempty"`

	// ASIIds lists applicable OWASP Agentic Security categories (e.g., "ASI02:2026", "ASI03:2026").
	// Supports multiple IDs as one step may map to several ASI categories.
	ASIIds []string `json:"asiIds,omitempty"`

	// STRIDEThreats lists applicable STRIDE threats.
	STRIDEThreats []STRIDEThreat `json:"strideThreats,omitempty"`

	// LINDDUNThreats lists applicable LINDDUN privacy threats.
	LINDDUNThreats []LINDDUNThreat `json:"linddunThreats,omitempty"`

	// Description provides additional context.
	Description string `json:"description,omitempty"`

	// RedTeamNotes provides exploitation guidance for this specific step.
	RedTeamNotes string `json:"redTeamNotes,omitempty"`

	// BlueTeamNotes provides detection guidance for this specific step.
	BlueTeamNotes string `json:"blueTeamNotes,omitempty"`

	// RemediationNote provides fix guidance for this specific step.
	RemediationNote string `json:"remediationNote,omitempty"`

	// TestRef links this attack step to an app-test-spec test case.
	TestRef *TestReference `json:"testRef,omitempty"`

	// ComponentRefs links this attack step to vulnerable software components.
	ComponentRefs []ComponentReference `json:"componentRefs,omitempty"`
}

type AttackGraph struct {
	// ID is the unique identifier for this graph
	ID string `json:"id,omitempty"`

	// ThreatModelID links to the source threat model
	ThreatModelID string `json:"threatModelId,omitempty"`

	// Nodes contains all nodes in the graph
	Nodes []GraphNode `json:"nodes"`

	// Edges contains all edges in the graph
	Edges []GraphEdge `json:"edges"`

	// EntryPoints lists node IDs that are potential entry points
	EntryPoints []string `json:"entryPoints,omitempty"`

	// Targets lists node IDs that are high-value targets
	Targets []string `json:"targets,omitempty"`
	// contains filtered or unexported fields
}

type AttackPath struct {
	// Nodes contains the ordered list of node IDs in the path
	Nodes []string `json:"nodes"`

	// Edges contains the edge IDs traversed (len = len(Nodes) - 1)
	Edges []string `json:"edges,omitempty"`

	// TotalWeight is the sum of all edge weights in the path
	TotalWeight float64 `json:"totalWeight"`

	// RiskScore is the cumulative risk score for the path
	RiskScore float64 `json:"riskScore"`

	// Length is the number of edges (hops) in the path
	Length int `json:"length"`
}

type AttackPattern struct {
	// ID is the unique identifier for this pattern.
	ID string `json:"id"`

	// Name is the human-readable pattern name.
	Name string `json:"name"`

	// Type categorizes the attack pattern.
	Type AttackPatternType `json:"type"`

	// Description provides an overview of the attack pattern.
	Description string `json:"description,omitempty"`

	// Prerequisites lists conditions required for this attack.
	Prerequisites []string `json:"prerequisites,omitempty"`

	// AttackSteps provides the template attack chain.
	AttackSteps []AttackPatternStep `json:"attackSteps,omitempty"`

	// VulnerablePatterns contains code patterns that are vulnerable.
	VulnerablePatterns []PatternCodeExample `json:"vulnerablePatterns,omitempty"`

	// SecurePatterns contains secure code patterns.
	SecurePatterns []PatternCodeExample `json:"securePatterns,omitempty"`

	// DetectionPatterns contains patterns for detecting this attack.
	DetectionPatterns []PatternDetection `json:"detectionPatterns,omitempty"`

	// CWEIDs lists applicable CWE identifiers.
	CWEIDs []string `json:"cweIds,omitempty"`

	// MITRETechniques lists applicable MITRE ATT&CK techniques.
	MITRETechniques []string `json:"mitreTechniques,omitempty"`

	// OWASPIds lists applicable OWASP categories.
	OWASPIds []string `json:"owaspIds,omitempty"`

	// ASIIds lists applicable OWASP Agentic Security categories.
	ASIIds []string `json:"asiIds,omitempty"`

	// References contains links to additional information.
	References []Reference `json:"references,omitempty"`
}

type AttackPatternStep struct {
	// Step is the sequence number.
	Step int `json:"step"`

	// Name is a short name for this step.
	Name string `json:"name"`

	// Description describes what happens in this step.
	Description string `json:"description,omitempty"`

	// Action is the specific action taken.
	Action string `json:"action,omitempty"`

	// Outcome is the expected result.
	Outcome string `json:"outcome,omitempty"`

	// MITRETactic is the MITRE ATT&CK tactic.
	MITRETactic MITRETactic `json:"mitreTactic,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID.
	MITRETechnique string `json:"mitreTechnique,omitempty"`

	// CWEIDs lists applicable CWE identifiers.
	CWEIDs []string `json:"cweIds,omitempty"`
}

type AttackPatternType string

type AttackTree struct {
	// RootID is the ID of the root goal node.
	RootID string `json:"rootId"`

	// Nodes contains all nodes in the attack tree.
	Nodes []AttackTreeNode `json:"nodes"`
}

type AttackTreeNode struct {
	// ID is the unique identifier for the node.
	ID string `json:"id"`

	// Label is the display name or goal description.
	Label string `json:"label"`

	// NodeType identifies the logic type (AND, OR, LEAF).
	NodeType AttackTreeNodeType `json:"nodeType"`

	// Description provides additional context about this attack step.
	Description string `json:"description,omitempty"`

	// Children contains the child node IDs (for AND/OR nodes).
	Children []string `json:"children,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID (for leaf nodes).
	MITRETechnique string `json:"mitreTechnique,omitempty"`

	// STRIDEThreats lists applicable STRIDE threats.
	STRIDEThreats []STRIDEThreat `json:"strideThreats,omitempty"`

	// Probability is the estimated probability of success (0.0 - 1.0).
	Probability float64 `json:"probability,omitempty"`

	// Cost estimates the attacker cost (low, medium, high).
	Cost string `json:"cost,omitempty"`

	// Difficulty estimates the attack difficulty (trivial, low, medium, high, expert).
	Difficulty string `json:"difficulty,omitempty"`

	// Countermeasure describes how to prevent this attack step.
	Countermeasure string `json:"countermeasure,omitempty"`

	// Mitigated indicates if this attack path is mitigated.
	Mitigated bool `json:"mitigated,omitempty"`
}

type AttackTreeNodeType string

type Author struct {
	// Name is the author's name.
	Name string `json:"name"`

	// Email is the author's email address.
	Email string `json:"email,omitempty"`

	// URL is a link to the author's profile or website.
	URL string `json:"url,omitempty"`
}

type Boundary struct {
	// ID is the unique identifier for the boundary.
	ID string `json:"id"`

	// Label is the display name.
	Label string `json:"label"`

	// Type identifies the boundary type.
	Type BoundaryType `json:"type"`

	// ParentID is the ID of a containing boundary (for nested boundaries).
	ParentID string `json:"parentId,omitempty"`

	// Description provides additional context.
	Description string `json:"description,omitempty"`

	// ImplicitlyTrusted indicates whether elements inside this boundary
	// are implicitly trusted without validation. This is common for localhost
	// boundaries where services assume local connections are safe.
	ImplicitlyTrusted bool `json:"implicitlyTrusted,omitempty"`

	// TrustAssumption describes the security assumption for this boundary.
	// Example: "Localhost connections are trusted without authentication"
	TrustAssumption string `json:"trustAssumption,omitempty"`

	// TrustViolationRisk describes how the trust assumption could be violated.
	// Example: "Cross-Site WebSocket Hijacking can bypass localhost restriction"
	TrustViolationRisk string `json:"trustViolationRisk,omitempty"`

	// BreachVector describes how this boundary was/could be breached.
	// Applicable when Type is "breached" or for threat modeling.
	BreachVector string `json:"breachVector,omitempty"`

	// AuthenticationRequired indicates whether authentication is required
	// to cross this boundary.
	AuthenticationRequired bool `json:"authenticationRequired,omitempty"`

	// AuthorizationEnforced indicates whether authorization is checked
	// at this boundary.
	AuthorizationEnforced bool `json:"authorizationEnforced,omitempty"`
}

type BoundaryType string

type BrowserExecutionInfo struct {
	// Origin is the JavaScript origin (e.g., "https://example.com").
	Origin string `json:"origin,omitempty"`

	// SameSite indicates the SameSite cookie attribute.
	SameSite string `json:"sameSite,omitempty"`

	// CrossOriginIsolated indicates whether the context is cross-origin isolated.
	CrossOriginIsolated bool `json:"crossOriginIsolated,omitempty"`

	// ServiceWorker indicates whether this is a service worker context.
	ServiceWorker bool `json:"serviceWorker,omitempty"`

	// WebWorker indicates whether this is a web worker context.
	WebWorker bool `json:"webWorker,omitempty"`

	// LocalStorageAccess indicates whether local storage is accessible.
	LocalStorageAccess bool `json:"localStorageAccess,omitempty"`

	// CookieAccess indicates whether cookies are accessible.
	CookieAccess bool `json:"cookieAccess,omitempty"`

	// LocalhostAccess indicates whether localhost can be accessed.
	// This is relevant for Cross-Site WebSocket Hijacking attacks.
	LocalhostAccess bool `json:"localhostAccess,omitempty"`
}

type BusinessImpact struct {
	// Financial impacts
	RevenueImpact *LossEstimate `json:"revenueImpact,omitempty"` // Direct revenue loss

	// Non-financial impacts (descriptive)
	CustomerImpact    string `json:"customerImpact,omitempty"`    // Impact on customers
	RegulatoryImpact  string `json:"regulatoryImpact,omitempty"`  // Regulatory/compliance impact
	ReputationImpact  string `json:"reputationImpact,omitempty"`  // Brand/reputation impact
	OperationalImpact string `json:"operationalImpact,omitempty"` // Business operations impact
	LegalImpact       string `json:"legalImpact,omitempty"`       // Legal liability impact

	// Severity classification
	Criticality Criticality `json:"criticality,omitempty"` // Overall criticality level

	// Recovery estimates
	RecoveryTimeEstimate *Duration `json:"recoveryTimeEstimate,omitempty"` // Estimated time to recover
}

type CISControlMapping struct {
	// ControlID is the control number (e.g., "1", "2", "16").
	ControlID string `json:"controlId"`

	// ControlName is the control title (e.g., "Inventory and Control of Enterprise Assets").
	ControlName string `json:"controlName,omitempty"`

	// SafeguardID is the specific safeguard ID (e.g., "1.1", "16.4").
	SafeguardID string `json:"safeguardId,omitempty"`

	// SafeguardName is the safeguard description.
	SafeguardName string `json:"safeguardName,omitempty"`

	// ImplementationGroup indicates the implementation group (IG1, IG2, IG3).
	ImplementationGroup string `json:"implementationGroup,omitempty"`

	// AssetType indicates the asset type (Devices, Software, Network, Data, Users).
	AssetType string `json:"assetType,omitempty"`

	// SecurityFunction indicates the security function (Identify, Protect, Detect, Respond, Recover).
	SecurityFunction string `json:"securityFunction,omitempty"`

	// Description explains how this control applies to the threat model.
	Description string `json:"description,omitempty"`

	// URL is a link to the CIS Controls documentation.
	URL string `json:"url,omitempty"`
}

type CVEMapping struct {
	// ID is the CVE ID (e.g., "CVE-2024-12345").
	ID string `json:"id"`

	// Description provides a summary of the vulnerability.
	Description string `json:"description,omitempty"`

	// AffectedComponents lists the component IDs affected by this CVE.
	AffectedComponents []string `json:"affectedComponents,omitempty"`

	// AffectedVersions lists the software versions affected.
	AffectedVersions []string `json:"affectedVersions,omitempty"`

	// CVSS contains the CVSS score for this CVE.
	CVSS *CVSSMapping `json:"cvss,omitempty"`

	// URL is the link to the CVE page.
	URL string `json:"url,omitempty"`

	// References provides additional URLs related to this CVE.
	References []string `json:"references,omitempty"`
}

type CVSSMapping struct {
	// Version is the CVSS version (e.g., "3.1", "4.0").
	Version string `json:"version"`

	// Vector is the CVSS vector string (e.g., "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N").
	Vector string `json:"vector"`

	// BaseScore is the calculated base score (0.0 - 10.0).
	BaseScore float64 `json:"baseScore"`

	// Severity is the qualitative severity rating.
	Severity CVSSSeverity `json:"severity"`

	// Description provides context for the scoring.
	Description string `json:"description,omitempty"`
}

type CVSSSeverity string

type CWEMapping struct {
	// ID is the CWE ID (e.g., "CWE-346").
	ID string `json:"id"`

	// Name is the human-readable name (e.g., "Origin Validation Error").
	Name string `json:"name,omitempty"`

	// Description explains how this weakness applies.
	Description string `json:"description,omitempty"`

	// URL is the link to the CWE page.
	URL string `json:"url,omitempty"`
}

type ChecklistItem struct {
	// Item is the checklist item description.
	Item string `json:"item"`

	// Required indicates if this item is required for the fix to be complete.
	Required bool `json:"required,omitempty"`

	// Notes provides additional context for reviewers.
	Notes string `json:"notes,omitempty"`

	// Category categorizes the item (e.g., "validation", "authentication", "logging").
	Category string `json:"category,omitempty"`

	// Severity indicates how critical this item is (critical, high, medium, low).
	Severity string `json:"severity,omitempty"`
}

type CloudInfo struct {
	// Provider is the cloud provider (aws, gcp, azure, etc.).
	Provider string `json:"provider,omitempty"`

	// Region is the cloud region.
	Region string `json:"region,omitempty"`

	// VPC is the VPC/VNet identifier.
	VPC string `json:"vpc,omitempty"`

	// Subnet is the subnet identifier.
	Subnet string `json:"subnet,omitempty"`

	// ResourceID is the cloud resource identifier.
	ResourceID string `json:"resourceId,omitempty"`
}

type CodePattern struct {
	// Language is the programming language (e.g., "go", "python", "javascript").
	Language string `json:"language"`

	// Description explains this code pattern.
	Description string `json:"description"`

	// Code is the actual code snippet.
	Code string `json:"code"`

	// Explanation provides detailed explanation of why this is vulnerable/secure.
	Explanation string `json:"explanation,omitempty"`

	// CWE is the CWE ID for the vulnerability type (for vulnerable patterns).
	CWE string `json:"cwe,omitempty"`

	// Framework specifies the framework (e.g., "net/http", "gin", "express").
	Framework string `json:"framework,omitempty"`

	// FilePath suggests where this pattern typically appears.
	FilePath string `json:"filePath,omitempty"`

	// LineRange indicates relevant line numbers (e.g., "45-60").
	LineRange string `json:"lineRange,omitempty"`
}

type ComplianceFramework string

type ComplianceMapping struct {
	// Framework identifies the compliance framework.
	Framework ComplianceFramework `json:"framework"`

	// RequirementID is the specific requirement or control reference.
	// Examples: "CC6.1" (SOC 2), "3.5.1" (PCI-DSS), "164.312(a)(1)" (HIPAA).
	RequirementID string `json:"requirementId"`

	// RequirementName is the human-readable requirement title.
	RequirementName string `json:"requirementName,omitempty"`

	// Category groups related requirements (e.g., "Common Criteria", "Access Control").
	Category string `json:"category,omitempty"`

	// Description explains how this requirement applies to the threat model.
	Description string `json:"description,omitempty"`

	// Status indicates compliance status (compliant, non-compliant, partial, not-assessed).
	Status string `json:"status,omitempty"`

	// Evidence provides references to compliance evidence or documentation.
	Evidence string `json:"evidence,omitempty"`

	// URL is a link to the compliance documentation.
	URL string `json:"url,omitempty"`
}

type ComponentReference struct {
	// ID is the component identifier from the SBOM (purl, cpe, or internal ID)
	ID string `json:"id,omitempty"`

	// PURL is the Package URL for the component (e.g., pkg:npm/lodash@4.17.21)
	PURL string `json:"purl,omitempty"`

	// CPE is the Common Platform Enumeration for the component
	CPE string `json:"cpe,omitempty"`

	// Name is the human-readable component name
	Name string `json:"name,omitempty"`

	// Version is the component version
	Version string `json:"version,omitempty"`

	// Supplier is the component supplier/vendor
	Supplier string `json:"supplier,omitempty"`

	// License is the component license (SPDX identifier)
	License string `json:"license,omitempty"`

	// VulnerabilityIDs lists CVE or other vulnerability IDs affecting this component
	VulnerabilityIDs []string `json:"vulnerabilityIds,omitempty"`
}

type Confidence string

type ConfigChange struct {
	// Setting is the configuration setting name.
	Setting string `json:"setting"`

	// Value is the recommended value.
	Value string `json:"value"`

	// Description explains why this change is needed.
	Description string `json:"description,omitempty"`

	// Platform specifies the platform or application this applies to.
	Platform string `json:"platform,omitempty"`

	// File is the configuration file path.
	File string `json:"file,omitempty"`

	// CurrentValue shows the vulnerable/default value (for comparison).
	CurrentValue string `json:"currentValue,omitempty"`

	// Impact describes the impact of this change.
	Impact string `json:"impact,omitempty"`

	// RestartRequired indicates if a restart is needed.
	RestartRequired bool `json:"restartRequired,omitempty"`
}

type Contact struct {
	// Name is the contact name.
	Name string `json:"name"`

	// Role is the contact's role (e.g., "Security Lead", "On-Call Engineer").
	Role string `json:"role,omitempty"`

	// Email is the contact's email address.
	Email string `json:"email,omitempty"`

	// Phone is the contact's phone number.
	Phone string `json:"phone,omitempty"`

	// Slack is the contact's Slack handle or channel.
	Slack string `json:"slack,omitempty"`

	// PagerDuty is the PagerDuty schedule or escalation policy.
	PagerDuty string `json:"pagerDuty,omitempty"`

	// Availability describes when this contact is available.
	Availability string `json:"availability,omitempty"`

	// Primary indicates if this is the primary contact.
	Primary bool `json:"primary,omitempty"`
}

type ContainerExecutionInfo struct {
	// Runtime is the container runtime (docker, containerd, podman, etc.).
	Runtime string `json:"runtime,omitempty"`

	// Image is the container image.
	Image string `json:"image,omitempty"`

	// Privileged indicates whether the container runs in privileged mode.
	Privileged bool `json:"privileged,omitempty"`

	// HostPID indicates whether the container shares the host PID namespace.
	HostPID bool `json:"hostPid,omitempty"`

	// HostNetwork indicates whether the container shares the host network.
	HostNetwork bool `json:"hostNetwork,omitempty"`

	// Volumes lists mounted volumes.
	Volumes []string `json:"volumes,omitempty"`

	// ReadOnlyRootFS indicates whether the root filesystem is read-only.
	ReadOnlyRootFS bool `json:"readOnlyRootFs,omitempty"`

	// DropCapabilities lists dropped Linux capabilities.
	DropCapabilities []string `json:"dropCapabilities,omitempty"`
}

type ControlFramework string

type Controls struct {
	// NISTCSF contains NIST Cybersecurity Framework mappings.
	NISTCSF []NISTCSFMapping `json:"nistCsf,omitempty"`

	// CIS contains CIS Critical Security Controls mappings.
	CIS []CISControlMapping `json:"cis,omitempty"`

	// ISO27001 contains ISO/IEC 27001 control mappings.
	ISO27001 []ISO27001Mapping `json:"iso27001,omitempty"`
}

type CoverageLevel string

type CoverageSummary struct {
	// TotalTechniques is the total number of techniques assessed.
	TotalTechniques int `json:"totalTechniques"`

	// CoveredFull is the count of techniques with full coverage.
	CoveredFull int `json:"coveredFull"`

	// CoveredSubstantial is the count with substantial coverage.
	CoveredSubstantial int `json:"coveredSubstantial"`

	// CoveredPartial is the count with partial coverage.
	CoveredPartial int `json:"coveredPartial"`

	// CoveredMinimal is the count with minimal coverage.
	CoveredMinimal int `json:"coveredMinimal"`

	// NotCovered is the count of techniques with no coverage.
	NotCovered int `json:"notCovered"`

	// CoveragePercent is the percentage of techniques with any coverage.
	CoveragePercent float64 `json:"coveragePercent"`

	// EffectiveCoveragePercent weights coverage levels (full=100%, substantial=75%, partial=50%, minimal=25%).
	EffectiveCoveragePercent float64 `json:"effectiveCoveragePercent"`

	// GapsByTactic groups uncovered techniques by MITRE tactic.
	GapsByTactic map[string]int `json:"gapsByTactic,omitempty"`
}

type CredentialFlow struct {
	// ID is the unique identifier for this credential flow.
	ID string `json:"id"`

	// Name is a human-readable name for the credential.
	Name string `json:"name"`

	// Description provides details about the credential.
	Description string `json:"description,omitempty"`

	// Type categorizes the credential.
	Type CredentialType `json:"type"`

	// AssetID links to the Asset definition for this credential.
	AssetID string `json:"assetId,omitempty"`

	// Stages tracks the credential through its lifecycle.
	Stages []CredentialFlowEvent `json:"stages,omitempty"`

	// ExpirationDuration is how long the credential is valid (e.g., "24h", "7d").
	ExpirationDuration string `json:"expirationDuration,omitempty"`

	// Revocable indicates whether the credential can be revoked.
	Revocable bool `json:"revocable,omitempty"`

	// RotationPolicy describes how often credentials are rotated.
	RotationPolicy string `json:"rotationPolicy,omitempty"`

	// Scope describes what the credential grants access to.
	Scope []string `json:"scope,omitempty"`

	// RiskLevel indicates the risk if this credential is compromised.
	RiskLevel RiskLevel `json:"riskLevel,omitempty"`
}

type CredentialFlowEvent struct {
	// Stage identifies the lifecycle stage.
	Stage CredentialFlowStage `json:"stage"`

	// ElementID is the diagram element where this event occurs.
	ElementID string `json:"elementId,omitempty"`

	// Description provides context about this event.
	Description string `json:"description,omitempty"`

	// TransportProtocol describes how the credential is transmitted (if applicable).
	// Examples: "https", "wss", "ws", "http"
	TransportProtocol string `json:"transportProtocol,omitempty"`

	// TransportMechanism describes the transport mechanism.
	// Examples: "header", "cookie", "query-param", "body", "websocket-message"
	TransportMechanism string `json:"transportMechanism,omitempty"`

	// Encrypted indicates whether the credential is encrypted at this stage.
	Encrypted bool `json:"encrypted,omitempty"`

	// AttackStep links to an attack step if this is part of an attack chain.
	AttackStep int `json:"attackStep,omitempty"`

	// Vulnerability describes any vulnerability associated with this event.
	Vulnerability string `json:"vulnerability,omitempty"`

	// CWEIDs lists applicable CWE identifiers for vulnerabilities.
	CWEIDs []string `json:"cweIds,omitempty"`
}

type CredentialFlowStage string

type CredentialType string

type Criticality string

type Currency struct {
	Amount float64 `json:"amount"`           // Monetary amount
	Code   string  `json:"code,omitempty"`   // ISO 4217 currency code (default: USD)
	Symbol string  `json:"symbol,omitempty"` // Currency symbol for display (e.g., "$")
}

type DataCategory string

type DataSourceType string

type DefenseGuidance struct {
	// DetectionRules contains detection rules in various formats.
	DetectionRules []DetectionRule `json:"detectionRules,omitempty"`

	// IOCs contains Indicators of Compromise.
	IOCs []IOC `json:"iocs,omitempty"`

	// LogSources lists log sources useful for detection.
	LogSources []LogSource `json:"logSources,omitempty"`

	// HuntingQueries provides proactive threat hunting queries.
	HuntingQueries []HuntingQuery `json:"huntingQueries,omitempty"`

	// MonitoringRecommendations provides general monitoring guidance.
	MonitoringRecommendations []string `json:"monitoringRecommendations,omitempty"`

	// AlertThresholds describes when to trigger alerts.
	AlertThresholds []AlertThreshold `json:"alertThresholds,omitempty"`

	// Notes provides additional guidance for SOC analysts.
	Notes string `json:"notes,omitempty"`
}

type DependencyRisk struct {
	// ComponentRef references the component in the SBOM
	ComponentRef ComponentReference `json:"componentRef,omitempty"`

	// RiskLevel is the overall risk level (critical, high, medium, low)
	RiskLevel RiskLevel `json:"riskLevel,omitempty"`

	// VulnerabilityCount is the number of known vulnerabilities
	VulnerabilityCount int `json:"vulnerabilityCount,omitempty"`

	// CriticalCount is the number of critical severity vulnerabilities
	CriticalCount int `json:"criticalCount,omitempty"`

	// HighCount is the number of high severity vulnerabilities
	HighCount int `json:"highCount,omitempty"`

	// OutdatedBy indicates how many versions behind the latest
	OutdatedBy int `json:"outdatedBy,omitempty"`

	// LastUpdated is when the component was last updated
	LastUpdated string `json:"lastUpdated,omitempty"`

	// Deprecated indicates if the component is deprecated
	Deprecated bool `json:"deprecated,omitempty"`

	// Unmaintained indicates if the component appears unmaintained
	Unmaintained bool `json:"unmaintained,omitempty"`

	// DirectDependency indicates if this is a direct or transitive dependency
	DirectDependency bool `json:"directDependency,omitempty"`

	// Notes provides additional context about the dependency risk
	Notes string `json:"notes,omitempty"`
}

type Detection struct {
	// ID is the unique identifier for the detection.
	ID string `json:"id"`

	// Title is a brief description of what is detected.
	Title string `json:"title"`

	// Description provides detailed information about the detection.
	Description string `json:"description,omitempty"`

	// ThreatIDs lists the IDs of threats this detection covers.
	ThreatIDs []string `json:"threatIds,omitempty"`

	// AttackSteps lists the attack step numbers this detection covers.
	AttackSteps []int `json:"attackSteps,omitempty"`

	// MITRETechniques lists MITRE ATT&CK techniques this detection covers.
	MITRETechniques []string `json:"mitreTechniques,omitempty"`

	// Method describes how the threat is detected.
	Method string `json:"method,omitempty"`

	// DataSources lists the data sources used for detection.
	DataSources []DataSourceType `json:"dataSources,omitempty"`

	// Coverage indicates the detection coverage level.
	Coverage DetectionCoverage `json:"coverage"`

	// LatencySeconds is the typical time to detect (in seconds).
	LatencySeconds int `json:"latencySeconds,omitempty"`

	// FalsePositiveRate describes the expected false positive rate (high, medium, low).
	FalsePositiveRate string `json:"falsePositiveRate,omitempty"`

	// DetectionLogic contains the query, rule, or signature logic.
	DetectionLogic string `json:"detectionLogic,omitempty"`

	// Tool identifies the detection tool or platform.
	Tool string `json:"tool,omitempty"`

	// PlaybookID references a response playbook for this detection.
	PlaybookID string `json:"playbookId,omitempty"`

	// AlertSeverity indicates the alert severity when triggered.
	AlertSeverity string `json:"alertSeverity,omitempty"`

	// Enabled indicates if this detection is currently active.
	Enabled bool `json:"enabled,omitempty"`
}

type DetectionCoverage string

type DetectionCoverageMatrix struct {
	// Techniques contains coverage data for each technique.
	Techniques []TechniqueCoverage `json:"techniques"`

	// Summary provides aggregate statistics.
	Summary *CoverageSummary `json:"summary,omitempty"`

	// LastUpdated is the timestamp when coverage was last calculated.
	LastUpdated string `json:"lastUpdated,omitempty"`

	// Source identifies where the coverage data came from.
	Source string `json:"source,omitempty"`
}

type DetectionEfficiency struct {
	// AlertsPerIncident is the average number of alerts per incident.
	AlertsPerIncident float64 `json:"alertsPerIncident,omitempty"`

	// Precision is the ratio of true positives to all positive predictions.
	Precision float64 `json:"precision,omitempty"`

	// Recall is the ratio of true positives to all actual positives (same as DetectionRate).
	Recall float64 `json:"recall,omitempty"`

	// F1Score is the harmonic mean of precision and recall.
	F1Score float64 `json:"f1Score,omitempty"`
}

type DetectionFormat string

type DetectionRule struct {
	// ID is the unique identifier for this rule.
	ID string `json:"id"`

	// Name is the rule name.
	Name string `json:"name"`

	// Format identifies the rule format (sigma, yara, splunk, etc.).
	Format DetectionFormat `json:"format"`

	// Rule is the actual detection rule content.
	Rule string `json:"rule"`

	// Description explains what this rule detects.
	Description string `json:"description,omitempty"`

	// Severity indicates the alert severity (informational, low, medium, high, critical).
	Severity string `json:"severity,omitempty"`

	// FalsePositives lists known false positive scenarios.
	FalsePositives []string `json:"falsePositives,omitempty"`

	// References lists external resources about this detection.
	References []string `json:"references,omitempty"`

	// MITRETechniques lists MITRE ATT&CK techniques this rule detects.
	MITRETechniques []string `json:"mitreTechniques,omitempty"`

	// Tags are metadata tags for categorization.
	Tags []string `json:"tags,omitempty"`

	// Status indicates the rule status (experimental, testing, stable, deprecated).
	Status string `json:"status,omitempty"`

	// Author is the rule author.
	Author string `json:"author,omitempty"`

	// Date is the rule creation or update date.
	Date string `json:"date,omitempty"`

	// TestRefs links to app-test-spec tests that validate this detection.
	TestRefs []TestReference `json:"testRefs,omitempty"`
}

type DiagramIR struct {
	// Type identifies the diagram type (dfd, attack-chain, sequence).
	Type DiagramType `json:"type"`

	// Title is the diagram title.
	Title string `json:"title"`

	// Description provides additional context about the diagram.
	Description string `json:"description,omitempty"`

	// Direction specifies the layout direction (right, down, etc.).
	Direction Direction `json:"direction,omitempty"`

	// Legend controls whether to show the legend.
	Legend *Legend `json:"legend,omitempty"`

	// Mappings contains references to external security frameworks
	// (MITRE ATT&CK, ATLAS, OWASP, CWE, CVSS, STRIDE).
	Mappings *Mappings `json:"mappings,omitempty"`

	// Elements are the DFD elements (processes, datastores, external entities).
	Elements []Element `json:"elements,omitempty"`

	// Boundaries are the trust boundaries containing elements.
	Boundaries []Boundary `json:"boundaries,omitempty"`

	// Flows are the data flows between elements (for DFD).
	Flows []Flow `json:"flows,omitempty"`

	// Attacks are the attack steps (for attack-chain type).
	Attacks []Attack `json:"attacks,omitempty"`

	// Targets are the high-value assets being targeted.
	Targets []Target `json:"targets,omitempty"`

	// Actors are the lifelines in a sequence diagram.
	Actors []Actor `json:"actors,omitempty"`

	// Phases group messages into logical attack phases.
	Phases []Phase `json:"phases,omitempty"`

	// Messages are the interactions between actors (for sequence type).
	Messages []Message `json:"messages,omitempty"`

	// AttackTree contains the attack tree structure (for attack-tree type).
	AttackTree *AttackTree `json:"attackTree,omitempty"`

	// Threats contains identified threats with status tracking.
	Threats []ThreatEntry `json:"threats,omitempty"`

	// Mitigations contains countermeasures addressing identified threats.
	Mitigations []Mitigation `json:"mitigations,omitempty"`

	// Detections contains detection capabilities for threats and attacks.
	Detections []Detection `json:"detections,omitempty"`

	// ResponseActions contains incident response actions.
	ResponseActions []ResponseAction `json:"responseActions,omitempty"`
}

type DiagramType string

type DiagramView struct {
	// Type identifies the diagram type (dfd, attack-chain, sequence).
	Type DiagramType `json:"type"`

	// Title is the diagram-specific title. If empty, inherits from ThreatModel.
	Title string `json:"title,omitempty"`

	// Description provides diagram-specific context.
	Description string `json:"description,omitempty"`

	// Direction specifies the layout direction (right, down, etc.).
	Direction Direction `json:"direction,omitempty"`

	// Legend controls whether to show the legend.
	Legend *Legend `json:"legend,omitempty"`

	// Mappings contains diagram-specific framework mappings.
	// If nil, the diagram inherits from the parent ThreatModel.
	// If set, these mappings apply only to this diagram view.
	Mappings *Mappings `json:"mappings,omitempty"`

	// Elements are the DFD elements (processes, datastores, external entities).
	Elements []Element `json:"elements,omitempty"`

	// Boundaries are the trust boundaries containing elements.
	Boundaries []Boundary `json:"boundaries,omitempty"`

	// Flows are the data flows between elements (for DFD).
	Flows []Flow `json:"flows,omitempty"`

	// Attacks are the attack steps (for attack-chain type).
	Attacks []Attack `json:"attacks,omitempty"`

	// Targets are the high-value assets being targeted.
	Targets []Target `json:"targets,omitempty"`

	// Actors are the lifelines in a sequence diagram.
	Actors []Actor `json:"actors,omitempty"`

	// Phases group messages into logical attack phases.
	Phases []Phase `json:"phases,omitempty"`

	// Messages are the interactions between actors (for sequence type).
	Messages []Message `json:"messages,omitempty"`

	// AttackTree contains the attack tree structure for attack-tree type.
	AttackTree *AttackTree `json:"attackTree,omitempty"`

	// Threats contains identified threats with status tracking.
	Threats []ThreatEntry `json:"threats,omitempty"`

	// Mitigations contains countermeasures addressing identified threats.
	Mitigations []Mitigation `json:"mitigations,omitempty"`

	// Detections contains detection capabilities for threats and attacks.
	Detections []Detection `json:"detections,omitempty"`

	// ResponseActions contains incident response actions.
	ResponseActions []ResponseAction `json:"responseActions,omitempty"`
}

type Direction string

type Duration struct {
	Value int          `json:"value"` // Numeric value
	Unit  DurationUnit `json:"unit"`  // Time unit
}

type DurationUnit string

type EPSSCatalog struct {
	Entries     map[string]EPSSData `json:"entries"`               // CVE ID -> EPSS data
	LastUpdated string              `json:"lastUpdated,omitempty"` // Date catalog was last updated
	Source      string              `json:"source,omitempty"`      // Data source (e.g., "FIRST EPSS API")
}

type EPSSData struct {
	CVE        string  `json:"cve"`                  // CVE identifier (e.g., "CVE-2024-1234")
	EPSSScore  float64 `json:"epssScore"`            // EPSS probability score (0.0 to 1.0)
	Percentile float64 `json:"percentile"`           // Percentile rank (0.0 to 100.0)
	DateScored string  `json:"dateScored,omitempty"` // Date the score was calculated (ISO 8601)
}

type EPSSRiskLevel string

type Element struct {
	// ID is the unique identifier for the element.
	ID string `json:"id"`

	// Label is the display name.
	Label string `json:"label"`

	// Type identifies the element type.
	Type ElementType `json:"type"`

	// ParentID is the ID of the containing boundary (if any).
	ParentID string `json:"parentId,omitempty"`

	// Classification indicates the asset value/sensitivity.
	Classification AssetClassification `json:"classification,omitempty"`

	// STRIDEThreats lists applicable STRIDE threats.
	STRIDEThreats []STRIDEThreat `json:"strideThreats,omitempty"`

	// Description provides additional context.
	Description string `json:"description,omitempty"`

	// Network contains optional network topology details.
	Network *NetworkInfo `json:"network,omitempty"`

	// AssetIDs links this element to Asset definitions.
	AssetIDs []string `json:"assetIds,omitempty"`

	// AgentCapabilities describes the capabilities of an AI agent element.
	// Only applicable when Type is "agent".
	AgentCapabilities *AgentCapabilities `json:"agentCapabilities,omitempty"`

	// ExecutionContext describes the execution environment for this element.
	// Useful for understanding RCE impact and sandbox escape potential.
	ExecutionContext *ExecutionContext `json:"executionContext,omitempty"`
}

type ElementType string

type EscapeVector struct {
	// Name is a short name for this escape vector.
	Name string `json:"name"`

	// Description describes how the escape could occur.
	Description string `json:"description,omitempty"`

	// SourceContext is the starting execution context type.
	SourceContext ExecutionEnvironmentType `json:"sourceContext"`

	// TargetContext is the escaped-to execution context type.
	TargetContext ExecutionEnvironmentType `json:"targetContext"`

	// TargetPrivilegeLevel is the privilege level after escape.
	TargetPrivilegeLevel ExecutionPrivilegeLevel `json:"targetPrivilegeLevel,omitempty"`

	// Mechanism describes the technical mechanism of escape.
	Mechanism string `json:"mechanism,omitempty"`

	// Prerequisites lists conditions required for the escape.
	Prerequisites []string `json:"prerequisites,omitempty"`

	// CWEIDs lists applicable CWE identifiers.
	CWEIDs []string `json:"cweIds,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID.
	MITRETechnique string `json:"mitreTechnique,omitempty"`

	// Mitigations lists controls that prevent this escape.
	Mitigations []string `json:"mitigations,omitempty"`
}

type ExecutionContext struct {
	// EnvironmentType indicates where the code executes.
	EnvironmentType ExecutionEnvironmentType `json:"environmentType"`

	// PrivilegeLevel indicates the execution privileges.
	PrivilegeLevel ExecutionPrivilegeLevel `json:"privilegeLevel"`

	// User is the user account under which code executes.
	User string `json:"user,omitempty"`

	// Groups lists the groups the execution context belongs to.
	Groups []string `json:"groups,omitempty"`

	// ProcessName is the name of the executing process.
	ProcessName string `json:"processName,omitempty"`

	// WorkingDirectory is the working directory for execution.
	WorkingDirectory string `json:"workingDirectory,omitempty"`

	// EnvironmentVariables lists environment variables available.
	EnvironmentVariables []string `json:"environmentVariables,omitempty"`

	// Capabilities lists Linux capabilities (if applicable).
	Capabilities []string `json:"capabilities,omitempty"`

	// SELinuxContext is the SELinux context (if applicable).
	SELinuxContext string `json:"selinuxContext,omitempty"`

	// AppArmorProfile is the AppArmor profile (if applicable).
	AppArmorProfile string `json:"appArmorProfile,omitempty"`

	// SeccompProfile indicates the seccomp profile (if applicable).
	SeccompProfile string `json:"seccompProfile,omitempty"`

	// ContainerInfo contains container-specific details.
	ContainerInfo *ContainerExecutionInfo `json:"containerInfo,omitempty"`

	// BrowserInfo contains browser-specific details.
	BrowserInfo *BrowserExecutionInfo `json:"browserInfo,omitempty"`

	// NetworkAccess describes network access from this context.
	NetworkAccess *ExecutionNetworkAccess `json:"networkAccess,omitempty"`

	// FilesystemAccess describes filesystem access from this context.
	FilesystemAccess *ExecutionFilesystemAccess `json:"filesystemAccess,omitempty"`

	// EscapeVectors describes potential escape paths from this context.
	EscapeVectors []EscapeVector `json:"escapeVectors,omitempty"`
}

type ExecutionEnvironmentType string

type ExecutionFilesystemAccess struct {
	// ReadPaths lists paths with read access.
	ReadPaths []string `json:"readPaths,omitempty"`

	// WritePaths lists paths with write access.
	WritePaths []string `json:"writePaths,omitempty"`

	// ExecutePaths lists paths with execute access.
	ExecutePaths []string `json:"executePaths,omitempty"`

	// MountPoints lists accessible mount points.
	MountPoints []string `json:"mountPoints,omitempty"`

	// TempDirectory is the temporary directory path.
	TempDirectory string `json:"tempDirectory,omitempty"`
}

type ExecutionNetworkAccess struct {
	// CanAccessInternet indicates whether the context can reach the internet.
	CanAccessInternet bool `json:"canAccessInternet,omitempty"`

	// CanAccessLocalhost indicates whether the context can access localhost.
	CanAccessLocalhost bool `json:"canAccessLocalhost,omitempty"`

	// CanAccessInternalNetwork indicates whether internal networks are reachable.
	CanAccessInternalNetwork bool `json:"canAccessInternalNetwork,omitempty"`

	// AllowedPorts lists ports that can be accessed.
	AllowedPorts []int `json:"allowedPorts,omitempty"`

	// BlockedPorts lists ports that are blocked.
	BlockedPorts []int `json:"blockedPorts,omitempty"`

	// DNSAccess indicates whether DNS resolution is available.
	DNSAccess bool `json:"dnsAccess,omitempty"`
}

type ExecutionPrivilegeLevel string

type ExploitDifficulty string

type ExploitationGuidance struct {
	// Prerequisites lists conditions that must be true for exploitation.
	// Example: "Target must have WebSocket gateway enabled on localhost:9999"
	Prerequisites []string `json:"prerequisites,omitempty"`

	// ExploitationSteps provides ordered steps for exploiting the vulnerability.
	ExploitationSteps []ExploitationStep `json:"exploitationSteps,omitempty"`

	// Tools lists offensive security tools useful for testing.
	Tools []OffensiveTool `json:"tools,omitempty"`

	// PayloadPatterns provides generic payload templates for testing.
	// Note: These are patterns, not actual exploits.
	PayloadPatterns []PayloadPattern `json:"payloadPatterns,omitempty"`

	// SuccessIndicators describes how to verify successful exploitation.
	SuccessIndicators []string `json:"successIndicators,omitempty"`

	// Difficulty indicates the overall exploitation difficulty.
	Difficulty ExploitDifficulty `json:"difficulty,omitempty"`

	// TestRefs links to app-test-spec test cases for automated validation.
	TestRefs []TestReference `json:"testRefs,omitempty"`

	// Notes provides additional guidance for penetration testers.
	Notes string `json:"notes,omitempty"`

	// TimeToExploit is an estimate of exploitation time (e.g., "< 1 minute").
	TimeToExploit string `json:"timeToExploit,omitempty"`

	// SkillLevel indicates the required attacker skill level.
	SkillLevel string `json:"skillLevel,omitempty"`
}

type ExploitationStep struct {
	// Step is the sequence number (1, 2, 3...).
	Step int `json:"step"`

	// Action describes what the attacker does.
	Action string `json:"action"`

	// Description provides detailed explanation of this step.
	Description string `json:"description,omitempty"`

	// Tool identifies the tool used for this step (if any).
	Tool string `json:"tool,omitempty"`

	// Example provides a concrete command or code example.
	// Note: Examples should be educational, not weaponized.
	Example string `json:"example,omitempty"`

	// ExpectedResult describes what should happen after this step.
	ExpectedResult string `json:"expectedResult,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID (e.g., T1110).
	MITRETechnique string `json:"mitreTechnique,omitempty"`
}

type FAIRAssessment struct {
	// Loss Event Frequency (LEF) components
	ThreatEventFrequency *FrequencyEstimate `json:"threatEventFrequency,omitempty"`
	Vulnerability        *Percentage        `json:"vulnerability,omitempty"`

	// Loss Magnitude (LM) components
	PrimaryLoss   *LossEstimate `json:"primaryLoss,omitempty"`
	SecondaryLoss *LossEstimate `json:"secondaryLoss,omitempty"`

	// Derived values (can be calculated or provided)
	AnnualizedLossExpectancy *Currency `json:"annualizedLossExpectancy,omitempty"`
	RiskScore                float64   `json:"riskScore,omitempty"`

	// Metadata
	AssessmentDate string `json:"assessmentDate,omitempty"`
	Assessor       string `json:"assessor,omitempty"`
	Notes          string `json:"notes,omitempty"`
}

type Flow struct {
	// From is the source element ID.
	From string `json:"from"`

	// To is the destination element ID.
	To string `json:"to"`

	// Label describes the flow.
	Label string `json:"label,omitempty"`

	// Type identifies the flow type (normal, attack, exfil).
	Type FlowType `json:"type,omitempty"`

	// Bidirectional indicates if the flow goes both ways.
	Bidirectional bool `json:"bidirectional,omitempty"`

	// Protocol specifies the transport protocol (http, https, ws, wss, grpc, tcp, etc.).
	Protocol string `json:"protocol,omitempty"`

	// Encrypted indicates whether the flow is encrypted.
	Encrypted bool `json:"encrypted,omitempty"`

	// Authenticated indicates whether the flow requires authentication.
	Authenticated bool `json:"authenticated,omitempty"`

	// CrossOrigin indicates whether this is a cross-origin flow.
	// Relevant for browser-initiated flows like WebSocket connections.
	CrossOrigin bool `json:"crossOrigin,omitempty"`

	// CredentialFlowID links this flow to a CredentialFlow for token tracking.
	CredentialFlowID string `json:"credentialFlowId,omitempty"`

	// DataClassification indicates the sensitivity of data in this flow.
	DataClassification AssetClassification `json:"dataClassification,omitempty"`

	// CWEIDs lists applicable CWE identifiers if this flow has vulnerabilities.
	CWEIDs []string `json:"cweIds,omitempty"`
}

type FlowType string

type FrequencyEstimate struct {
	Min        float64    `json:"min"`                  // Minimum expected occurrences per year
	Max        float64    `json:"max"`                  // Maximum expected occurrences per year
	MostLikely float64    `json:"mostLikely"`           // Most likely occurrences per year
	Confidence Confidence `json:"confidence,omitempty"` // Confidence level in the estimate
}

type GraphEdge struct {
	// ID is the unique identifier for this edge
	ID string `json:"id"`

	// Source is the ID of the source node
	Source string `json:"source"`

	// Target is the ID of the target node
	Target string `json:"target"`

	// Type identifies the edge relationship type
	Type GraphEdgeType `json:"type"`

	// Label describes the edge
	Label string `json:"label,omitempty"`

	// Weight represents the traversal cost/risk (higher = more costly/risky)
	Weight float64 `json:"weight,omitempty"`

	// Properties contains additional edge-specific data
	Properties map[string]interface{} `json:"properties,omitempty"`
}

type GraphEdgeType string

type GraphNode struct {
	// ID is the unique identifier for this node
	ID string `json:"id"`

	// Type identifies what kind of node this is
	Type GraphNodeType `json:"type"`

	// Label is the human-readable name
	Label string `json:"label"`

	// RiskScore is the node's inherent risk (0-10)
	RiskScore float64 `json:"riskScore,omitempty"`

	// Properties contains additional node-specific data
	Properties map[string]interface{} `json:"properties,omitempty"`
}

type GraphNodeType string

type HuntingQuery struct {
	// Name is the query name.
	Name string `json:"name"`

	// Description explains what this query hunts for.
	Description string `json:"description,omitempty"`

	// Platform identifies the query platform (splunk, elastic, kql, etc.).
	Platform DetectionFormat `json:"platform"`

	// Query is the actual query string.
	Query string `json:"query"`

	// Hypothesis describes the threat hypothesis being tested.
	Hypothesis string `json:"hypothesis,omitempty"`

	// DataSources lists required data sources.
	DataSources []string `json:"dataSources,omitempty"`

	// MITRETechniques lists related MITRE ATT&CK techniques.
	MITRETechniques []string `json:"mitreTechniques,omitempty"`

	// ExpectedResults describes what results indicate a positive finding.
	ExpectedResults string `json:"expectedResults,omitempty"`

	// Author is the query author.
	Author string `json:"author,omitempty"`
}

type IOC struct {
	// Type identifies the IOC type (ip, domain, hash, etc.).
	Type IOCType `json:"type"`

	// Value is the IOC value.
	Value string `json:"value"`

	// Description explains what this IOC indicates.
	Description string `json:"description,omitempty"`

	// Confidence indicates the confidence level (high, medium, low).
	Confidence string `json:"confidence,omitempty"`

	// ValidUntil is the expiration date for this IOC (ISO 8601 format).
	ValidUntil string `json:"validUntil,omitempty"`

	// Source identifies where this IOC came from.
	Source string `json:"source,omitempty"`

	// MalwareFamily identifies the associated malware family (if any).
	MalwareFamily string `json:"malwareFamily,omitempty"`

	// ThreatActor identifies the associated threat actor (if any).
	ThreatActor string `json:"threatActor,omitempty"`

	// Tags are metadata tags for categorization.
	Tags []string `json:"tags,omitempty"`
}

type IOCType string

type ISO27001Mapping struct {
	// ControlID is the control reference (e.g., "A.5.1", "A.9.2.3").
	ControlID string `json:"controlId"`

	// ControlName is the control title.
	ControlName string `json:"controlName,omitempty"`

	// Domain is the control domain (e.g., "A.5 Information security policies").
	Domain string `json:"domain,omitempty"`

	// Objective is the control objective.
	Objective string `json:"objective,omitempty"`

	// Description explains how this control applies to the threat model.
	Description string `json:"description,omitempty"`

	// URL is a link to the ISO 27001 documentation.
	URL string `json:"url,omitempty"`
}

type IncidentPlaybook struct {
	// ID is the unique identifier for this playbook.
	ID string `json:"id"`

	// Name is the playbook name.
	Name string `json:"name"`

	// Description provides an overview of this playbook.
	Description string `json:"description,omitempty"`

	// ThreatType identifies the type of threat this playbook addresses.
	ThreatType string `json:"threatType,omitempty"`

	// Severity indicates the incident severity this playbook handles.
	Severity string `json:"severity,omitempty"`

	// Steps contains the ordered response steps.
	Steps []PlaybookStep `json:"steps,omitempty"`

	// Contacts lists people/teams to contact during the incident.
	Contacts []Contact `json:"contacts,omitempty"`

	// Tools lists tools needed for incident response.
	Tools []string `json:"tools,omitempty"`

	// References lists external resources.
	References []string `json:"references,omitempty"`

	// MITRETechniques lists MITRE ATT&CK techniques this playbook addresses.
	MITRETechniques []string `json:"mitreTechniques,omitempty"`

	// SLAMinutes is the expected response time SLA in minutes.
	SLAMinutes int `json:"slaMinutes,omitempty"`

	// LastReviewed is the date this playbook was last reviewed.
	LastReviewed string `json:"lastReviewed,omitempty"`

	// Owner is the team or person responsible for this playbook.
	Owner string `json:"owner,omitempty"`

	// Tags are metadata tags for categorization.
	Tags []string `json:"tags,omitempty"`
}

type KEVCatalog struct {
	Entries       map[string]KEVEntry `json:"entries"`                 // CVE ID -> KEV entry
	CatalogDate   string              `json:"catalogDate,omitempty"`   // Date of catalog snapshot
	CatalogSource string              `json:"catalogSource,omitempty"` // Source URL or identifier
	Count         int                 `json:"count,omitempty"`         // Total number of entries
}

type KEVEntry struct {
	CVEID             string `json:"cveId"`                      // CVE identifier (e.g., "CVE-2024-1234")
	VendorProject     string `json:"vendorProject"`              // Vendor or project name
	Product           string `json:"product"`                    // Product name
	VulnerabilityName string `json:"vulnerabilityName"`          // Brief vulnerability name
	DateAdded         string `json:"dateAdded"`                  // Date added to KEV catalog (YYYY-MM-DD)
	ShortDescription  string `json:"shortDescription"`           // Brief vulnerability description
	RequiredAction    string `json:"requiredAction"`             // Required remediation action
	DueDate           string `json:"dueDate"`                    // Federal agency due date for remediation (YYYY-MM-DD)
	KnownRansomware   bool   `json:"knownRansomwareCampaignUse"` // Used in ransomware campaigns
	Notes             string `json:"notes,omitempty"`            // Additional notes
}

type KEVStatus struct {
	InKEV           bool   `json:"inKev"`                     // Whether the CVE is in KEV
	KnownRansomware bool   `json:"knownRansomware,omitempty"` // Used in ransomware campaigns
	DateAdded       string `json:"dateAdded,omitempty"`       // Date added to KEV
	DueDate         string `json:"dueDate,omitempty"`         // Remediation due date
	IsPastDue       bool   `json:"isPastDue,omitempty"`       // Whether past due date
	RequiredAction  string `json:"requiredAction,omitempty"`  // Required action
}

type LINDDUNMapping struct {
	// Category is the LINDDUN category (L, I, N, D, Di, U, Nc).
	Category LINDDUNThreat `json:"category"`

	// Name is the full name (e.g., "Linkability", "Identifiability").
	Name string `json:"name,omitempty"`

	// Description explains how this privacy threat applies.
	Description string `json:"description,omitempty"`

	// AffectedDataTypes lists the types of personal data affected.
	// Examples: "PII", "PHI", "financial", "biometric", "location".
	AffectedDataTypes []string `json:"affectedDataTypes,omitempty"`

	// AffectedComponents lists the component IDs affected by this threat.
	AffectedComponents []string `json:"affectedComponents,omitempty"`

	// DataSubjects identifies the categories of data subjects affected.
	// Examples: "customers", "employees", "patients", "minors".
	DataSubjects []string `json:"dataSubjects,omitempty"`

	// PrivacyPrinciple identifies the privacy principle violated.
	// Examples: "data minimization", "purpose limitation", "consent".
	PrivacyPrinciple string `json:"privacyPrinciple,omitempty"`
}

type LINDDUNThreat string

type Legend struct {
	// Show controls whether the legend is displayed.
	Show bool `json:"show"`

	// ShowSTRIDE includes STRIDE threat legend.
	ShowSTRIDE bool `json:"showStride,omitempty"`

	// ShowLINDDUN includes LINDDUN privacy threat legend.
	ShowLINDDUN bool `json:"showLinddun,omitempty"`

	// ShowMITRE includes MITRE ATT&CK tactic legend.
	ShowMITRE bool `json:"showMitre,omitempty"`

	// ShowAssets includes asset classification legend.
	ShowAssets bool `json:"showAssets,omitempty"`

	// ShowElements includes element type legend.
	ShowElements bool `json:"showElements,omitempty"`

	// ShowBoundaries includes boundary type legend.
	ShowBoundaries bool `json:"showBoundaries,omitempty"`

	// ShowMitigations includes mitigation status legend.
	ShowMitigations bool `json:"showMitigations,omitempty"`
}

type Library struct {
	// Name is the library name (e.g., "validator", "helmet", "sanitize-html").
	Name string `json:"name"`

	// Language is the programming language.
	Language string `json:"language"`

	// Purpose describes what the library helps with.
	Purpose string `json:"purpose"`

	// URL is a link to the library's website or repository.
	URL string `json:"url,omitempty"`

	// Examples shows example usage of the library.
	Examples []string `json:"examples,omitempty"`

	// Version is the recommended minimum version.
	Version string `json:"version,omitempty"`

	// InstallCommand shows how to install the library.
	InstallCommand string `json:"installCommand,omitempty"`

	// License is the library's license.
	License string `json:"license,omitempty"`

	// Alternatives lists alternative libraries.
	Alternatives []string `json:"alternatives,omitempty"`
}

type LogSource struct {
	// Name is the log source name.
	Name string `json:"name"`

	// Description explains what this log source contains.
	Description string `json:"description,omitempty"`

	// EventIDs lists relevant event IDs (e.g., Windows Event IDs).
	EventIDs []string `json:"eventIds,omitempty"`

	// Fields lists important fields to examine in logs.
	Fields []string `json:"fields,omitempty"`

	// Category categorizes the log source (e.g., "webserver", "authentication", "process").
	Category string `json:"category,omitempty"`

	// Platform indicates the platform (e.g., "windows", "linux", "cloud").
	Platform string `json:"platform,omitempty"`

	// RetentionDays is the recommended log retention period.
	RetentionDays int `json:"retentionDays,omitempty"`
}

type LossEstimate struct {
	Min        float64  `json:"min"`                // Minimum expected loss
	Max        float64  `json:"max"`                // Maximum expected loss
	MostLikely float64  `json:"mostLikely"`         // Most likely loss
	Currency   Currency `json:"currency,omitempty"` // Currency for loss values (defaults to USD)
}

type MITREATLASMapping struct {
	// TacticID is the tactic ID (e.g., "AML.TA0002").
	TacticID string `json:"tacticId"`

	// TacticName is the human-readable tactic name.
	TacticName string `json:"tacticName,omitempty"`

	// TechniqueID is the technique ID (e.g., "AML.T0024").
	TechniqueID string `json:"techniqueId"`

	// TechniqueName is the human-readable technique name.
	TechniqueName string `json:"techniqueName,omitempty"`

	// Description explains how this technique applies.
	Description string `json:"description,omitempty"`

	// URL is the link to the ATLAS page.
	URL string `json:"url,omitempty"`
}

type MITREAttackMapping struct {
	// TacticID is the tactic ID (e.g., "TA0001").
	TacticID string `json:"tacticId"`

	// TacticName is the human-readable tactic name (e.g., "Initial Access").
	TacticName string `json:"tacticName,omitempty"`

	// TechniqueID is the technique ID (e.g., "T1189").
	TechniqueID string `json:"techniqueId"`

	// TechniqueName is the human-readable technique name (e.g., "Drive-by Compromise").
	TechniqueName string `json:"techniqueName,omitempty"`

	// SubTechniqueID is the sub-technique ID (e.g., "T1189.001"), if applicable.
	SubTechniqueID string `json:"subTechniqueId,omitempty"`

	// Description explains how this technique applies to the threat model.
	Description string `json:"description,omitempty"`

	// URL is the link to the ATT&CK page.
	URL string `json:"url,omitempty"`
}

type MITRETactic string

type Mappings struct {
	// MITREAttack contains MITRE ATT&CK technique mappings.
	MITREAttack []MITREAttackMapping `json:"mitreAttack,omitempty"`

	// MITREATLAS contains MITRE ATLAS (AI-specific) technique mappings.
	MITREATLAS []MITREATLASMapping `json:"mitreAtlas,omitempty"`

	// OWASP contains OWASP Top 10 mappings (API, LLM, Web).
	OWASP []OWASPMapping `json:"owasp,omitempty"`

	// CWE contains Common Weakness Enumeration mappings.
	CWE []CWEMapping `json:"cwe,omitempty"`

	// CVE contains Common Vulnerabilities and Exposures references.
	CVE []CVEMapping `json:"cve,omitempty"`

	// CVSS contains the CVSS vector string and score.
	CVSS *CVSSMapping `json:"cvss,omitempty"`

	// STRIDE contains STRIDE threat category mappings.
	STRIDE []STRIDEMapping `json:"stride,omitempty"`

	// LINDDUN contains LINDDUN privacy threat mappings.
	LINDDUN []LINDDUNMapping `json:"linddun,omitempty"`

	// Controls contains security control framework mappings (NIST CSF, CIS, ISO 27001).
	Controls *Controls `json:"controls,omitempty"`

	// Compliance contains regulatory compliance framework mappings.
	Compliance []ComplianceMapping `json:"compliance,omitempty"`
}

type Message struct {
	// Seq is the sequence number (1, 2, 3...).
	Seq int `json:"seq"`

	// From is the source actor ID.
	From string `json:"from"`

	// To is the destination actor ID.
	To string `json:"to"`

	// Label describes the message.
	Label string `json:"label"`

	// Type identifies the message type (normal, attack, exfil).
	Type FlowType `json:"type,omitempty"`

	// MITRETechnique is the MITRE ATT&CK technique ID (if applicable).
	MITRETechnique string `json:"mitreTechnique,omitempty"`

	// Note is a self-message note (when From == To).
	Note bool `json:"note,omitempty"`
}

type MetricDuration struct {
	// Value is the numeric duration value.
	Value float64 `json:"value"`

	// Unit is the time unit.
	Unit MetricTimeUnit `json:"unit"`

	// Source describes where this measurement came from.
	Source string `json:"source,omitempty"`

	// Confidence indicates confidence in the measurement.
	Confidence string `json:"confidence,omitempty"`
}

type MetricTimeUnit string

type MetricsBenchmark struct {
	// Category describes the industry/organization type.
	Category string `json:"category"`

	// AverageMTTD is the industry average MTTD.
	AverageMTTD *MetricDuration `json:"averageMttd,omitempty"`

	// AverageMTTR is the industry average MTTR.
	AverageMTTR *MetricDuration `json:"averageMttr,omitempty"`

	// Source is the source of benchmark data.
	Source string `json:"source,omitempty"`

	// Year is the year of the benchmark data.
	Year int `json:"year,omitempty"`
}

type MetricsComparison struct {
	// MTTDDelta is the difference from benchmark (negative = better).
	MTTDDelta float64 `json:"mttdDelta,omitempty"`

	// MTTDBetterThanAverage indicates if MTTD is better than benchmark.
	MTTDBetterThanAverage bool `json:"mttdBetterThanAverage,omitempty"`

	// MTTRDelta is the difference from benchmark (negative = better).
	MTTRDelta float64 `json:"mttrDelta,omitempty"`

	// MTTRBetterThanAverage indicates if MTTR is better than benchmark.
	MTTRBetterThanAverage bool `json:"mttrBetterThanAverage,omitempty"`
}

type Mitigation struct {
	// ID is the unique identifier for the mitigation.
	ID string `json:"id"`

	// Title is a brief description of the mitigation.
	Title string `json:"title"`

	// Description provides detailed information about the mitigation.
	Description string `json:"description,omitempty"`

	// ThreatIDs lists the IDs of threats this mitigation addresses.
	// These can reference Attack steps, Flow IDs, or Element IDs.
	ThreatIDs []string `json:"threatIds,omitempty"`

	// STRIDECategories lists the STRIDE categories this mitigation addresses.
	STRIDECategories []STRIDEThreat `json:"strideCategories,omitempty"`

	// ControlID references the security control implementing this mitigation.
	// Can reference NIST CSF, CIS, or ISO 27001 control IDs.
	ControlID string `json:"controlId,omitempty"`

	// Status indicates the current implementation status.
	Status MitigationStatus `json:"status"`

	// Owner is the person or team responsible for the mitigation.
	Owner string `json:"owner,omitempty"`

	// VerifiedDate is when the mitigation was verified as effective (RFC 3339 format).
	VerifiedDate string `json:"verifiedDate,omitempty"`

	// Effectiveness describes how effective the mitigation is (high, medium, low).
	Effectiveness string `json:"effectiveness,omitempty"`

	// Notes provides additional context or implementation details.
	Notes string `json:"notes,omitempty"`
}

type MitigationStatus string

type ModelPhase string

type Motivation string

type NISTCSFFunction string

type NISTCSFMapping struct {
	// Function is the CSF function (Identify, Protect, Detect, Respond, Recover).
	Function NISTCSFFunction `json:"function"`

	// Category is the category ID (e.g., "ID.AM", "PR.AC").
	Category string `json:"category"`

	// CategoryName is the human-readable category name (e.g., "Asset Management").
	CategoryName string `json:"categoryName,omitempty"`

	// Subcategory is the subcategory ID (e.g., "ID.AM-1", "PR.AC-1").
	Subcategory string `json:"subcategory,omitempty"`

	// SubcategoryName is the human-readable subcategory description.
	SubcategoryName string `json:"subcategoryName,omitempty"`

	// Description explains how this control applies to the threat model.
	Description string `json:"description,omitempty"`

	// URL is a link to the NIST CSF documentation.
	URL string `json:"url,omitempty"`
}

type NetworkInfo struct {
	// Host is the hostname, IP address, or service name.
	Host string `json:"host,omitempty"`

	// Ports lists the ports exposed by this element.
	Ports []int `json:"ports,omitempty"`

	// Protocols lists the protocols used (HTTP, HTTPS, gRPC, TCP, etc.).
	Protocols []string `json:"protocols,omitempty"`

	// Zone indicates the network zone (dmz, internal, cloud, public, etc.).
	Zone string `json:"zone,omitempty"`

	// CIDR is the network CIDR block if applicable.
	CIDR string `json:"cidr,omitempty"`

	// Cloud contains cloud-specific identifiers.
	Cloud *CloudInfo `json:"cloud,omitempty"`

	// WebSocket contains WebSocket-specific security configuration.
	// Use this when the element is a WebSocket endpoint.
	WebSocket *WebSocketConfig `json:"webSocket,omitempty"`

	// AllowedOrigins lists origins permitted to connect.
	// Applicable to WebSocket and CORS-enabled HTTP endpoints.
	AllowedOrigins []string `json:"allowedOrigins,omitempty"`

	// OriginValidation indicates whether origin validation is enforced.
	OriginValidation bool `json:"originValidation,omitempty"`

	// RateLimitRPS is the rate limit in requests per second (0 = no limit).
	RateLimitRPS int `json:"rateLimitRps,omitempty"`

	// RateLimitConnections is the max concurrent connections (0 = no limit).
	RateLimitConnections int `json:"rateLimitConnections,omitempty"`
}

type OWASPCategory string

type OWASPEntry struct {
	ID          string        `json:"id"`
	Name        string        `json:"name"`
	Description string        `json:"description"`
	Category    OWASPCategory `json:"category"`
	URL         string        `json:"url"`
}

type OWASPMapping struct {
	// Category identifies which OWASP list (api, llm, web).
	Category OWASPCategory `json:"category"`

	// ID is the OWASP ID (e.g., "API2:2023", "LLM06:2025", "A01:2021").
	ID string `json:"id"`

	// Name is the human-readable name (e.g., "Broken Authentication").
	Name string `json:"name,omitempty"`

	// Description explains how this applies to the threat model.
	Description string `json:"description,omitempty"`

	// URL is the link to the OWASP page.
	URL string `json:"url,omitempty"`
}

type OffensiveTool struct {
	// Name is the tool name (e.g., "Burp Suite", "sqlmap", "nuclei").
	Name string `json:"name"`

	// Purpose describes what the tool is used for.
	Purpose string `json:"purpose,omitempty"`

	// URL is a link to the tool's website or repository.
	URL string `json:"url,omitempty"`

	// Template provides a command template or configuration snippet.
	Template string `json:"template,omitempty"`

	// Category categorizes the tool (e.g., "scanner", "proxy", "fuzzer").
	Category string `json:"category,omitempty"`

	// License indicates the tool's license (e.g., "open-source", "commercial").
	License string `json:"license,omitempty"`
}

type PathAnalysisResult struct {
	// AllPaths contains all paths found between source and target
	AllPaths []AttackPath `json:"allPaths,omitempty"`

	// ShortestPath is the path with minimum weight
	ShortestPath *AttackPath `json:"shortestPath,omitempty"`

	// CriticalPaths are paths with highest risk scores
	CriticalPaths []AttackPath `json:"criticalPaths,omitempty"`

	// ReachableNodes lists all nodes reachable from entry points
	ReachableNodes []string `json:"reachableNodes,omitempty"`

	// UnreachableTargets lists targets that cannot be reached
	UnreachableTargets []string `json:"unreachableTargets,omitempty"`
}

type PatternCodeExample struct {
	// Language is the programming language.
	Language string `json:"language"`

	// Framework is the framework (if applicable).
	Framework string `json:"framework,omitempty"`

	// Description describes the code example.
	Description string `json:"description,omitempty"`

	// Code is the example code.
	Code string `json:"code"`

	// Explanation provides detailed explanation.
	Explanation string `json:"explanation,omitempty"`
}

type PatternDetection struct {
	// Name is the detection rule name.
	Name string `json:"name"`

	// Format is the detection format (sigma, yara, etc.).
	Format DetectionFormat `json:"format,omitempty"`

	// Rule is the detection rule.
	Rule string `json:"rule,omitempty"`

	// Description describes what this detects.
	Description string `json:"description,omitempty"`

	// FalsePositives lists known false positive scenarios.
	FalsePositives []string `json:"falsePositives,omitempty"`
}

type PayloadPattern struct {
	// Type categorizes the payload (e.g., "sqli", "xss", "ssrf", "websocket").
	Type string `json:"type"`

	// Pattern is the payload pattern or template.
	// Use placeholders like {TARGET}, {INPUT}, {PAYLOAD} for customization.
	Pattern string `json:"pattern"`

	// Description explains what this payload tests for.
	Description string `json:"description,omitempty"`

	// Variants lists variations of this payload pattern.
	Variants []string `json:"variants,omitempty"`

	// Encoding specifies any encoding applied (e.g., "base64", "url", "none").
	Encoding string `json:"encoding,omitempty"`

	// BypassTarget describes what defense this payload attempts to bypass.
	BypassTarget string `json:"bypassTarget,omitempty"`
}

type Percentage struct {
	Min        float64    `json:"min"`                  // Minimum probability (0.0 to 1.0)
	Max        float64    `json:"max"`                  // Maximum probability (0.0 to 1.0)
	MostLikely float64    `json:"mostLikely"`           // Most likely probability (0.0 to 1.0)
	Confidence Confidence `json:"confidence,omitempty"` // Confidence level in the estimate
}

type Phase struct {
	// Name is the phase name.
	Name string `json:"name"`

	// MITRETactic is the MITRE ATT&CK tactic for this phase.
	MITRETactic MITRETactic `json:"mitreTactic,omitempty"`

	// Description provides additional context.
	Description string `json:"description,omitempty"`

	// StartMessage is the first message index in this phase.
	StartMessage int `json:"startMessage"`

	// EndMessage is the last message index in this phase.
	EndMessage int `json:"endMessage"`
}

type PlaybookPhase string

type PlaybookStep struct {
	// Step is the sequence number (1, 2, 3...).
	Step int `json:"step"`

	// Phase is the incident response phase (identification, containment, etc.).
	Phase PlaybookPhase `json:"phase,omitempty"`

	// Action describes what to do in this step.
	Action string `json:"action"`

	// Description provides detailed instructions.
	Description string `json:"description,omitempty"`

	// Owner is the team or role responsible for this step.
	Owner string `json:"owner,omitempty"`

	// Automated indicates if this step can be automated.
	Automated bool `json:"automated,omitempty"`

	// AutomationScript is the script or tool to run for automated steps.
	AutomationScript string `json:"automationScript,omitempty"`

	// TimeMinutes is the estimated time for this step in minutes.
	TimeMinutes int `json:"timeMinutes,omitempty"`

	// Dependencies lists step numbers that must complete before this one.
	Dependencies []int `json:"dependencies,omitempty"`

	// EscalationTrigger describes when to escalate from this step.
	EscalationTrigger string `json:"escalationTrigger,omitempty"`

	// Notes provides additional context.
	Notes string `json:"notes,omitempty"`

	// Commands lists specific commands to run.
	Commands []string `json:"commands,omitempty"`

	// Checklist provides items to verify during this step.
	Checklist []string `json:"checklist,omitempty"`
}

type Prerequisite struct {
	// ID is the unique identifier for the prerequisite.
	ID string `json:"id"`

	// Title is a brief description of the prerequisite.
	Title string `json:"title"`

	// Description provides detailed information about the prerequisite.
	Description string `json:"description,omitempty"`

	// Type categorizes the prerequisite.
	Type AssumptionType `json:"type,omitempty"`

	// Required indicates if this prerequisite is mandatory.
	Required bool `json:"required,omitempty"`

	// Status indicates if the prerequisite is met (met, not-met, partial, unknown).
	Status string `json:"status,omitempty"`

	// DependsOn lists other prerequisite IDs that must be met first.
	DependsOn []string `json:"dependsOn,omitempty"`

	// RelatedThreatIDs lists threats that require this prerequisite.
	RelatedThreatIDs []string `json:"relatedThreatIds,omitempty"`

	// Notes provides additional context.
	Notes string `json:"notes,omitempty"`
}

type Reference struct {
	// Title is the reference title.
	Title string `json:"title"`

	// URL is the link to the resource.
	URL string `json:"url"`

	// Type categorizes the reference (e.g., "advisory", "blog", "paper", "cve").
	Type string `json:"type,omitempty"`
}

type RemediationGuidance struct {
	// VulnerablePatterns shows code patterns that are vulnerable.
	VulnerablePatterns []CodePattern `json:"vulnerablePatterns,omitempty"`

	// SecurePatterns shows secure code patterns that fix the vulnerability.
	SecurePatterns []CodePattern `json:"securePatterns,omitempty"`

	// ReviewChecklist provides items to check during code review.
	ReviewChecklist []ChecklistItem `json:"reviewChecklist,omitempty"`

	// RecommendedLibraries lists libraries that help mitigate the vulnerability.
	RecommendedLibraries []Library `json:"recommendedLibraries,omitempty"`

	// ConfigurationChanges lists configuration changes to fix the vulnerability.
	ConfigurationChanges []ConfigChange `json:"configurationChanges,omitempty"`

	// TestingApproach describes how to verify the fix is effective.
	TestingApproach *TestingApproach `json:"testingApproach,omitempty"`

	// TimeToFix estimates how long the fix will take (e.g., "2-4 hours").
	TimeToFix string `json:"timeToFix,omitempty"`

	// Complexity indicates fix complexity (trivial, low, medium, high).
	Complexity string `json:"complexity,omitempty"`

	// BreakingChanges notes any breaking changes introduced by the fix.
	BreakingChanges []string `json:"breakingChanges,omitempty"`

	// Notes provides additional guidance for developers.
	Notes string `json:"notes,omitempty"`
}

type ResourceLevel string

type ResponseAction struct {
	// ID is the unique identifier for the response action.
	ID string `json:"id"`

	// Title is a brief description of the response action.
	Title string `json:"title"`

	// Description provides detailed information about the response.
	Description string `json:"description,omitempty"`

	// TriggerDetectionIDs lists detection IDs that trigger this response.
	TriggerDetectionIDs []string `json:"triggerDetectionIds,omitempty"`

	// ActionType categorizes the response (isolate, block, alert, investigate, contain).
	ActionType string `json:"actionType,omitempty"`

	// Automated indicates if the response is automated.
	Automated bool `json:"automated,omitempty"`

	// PlaybookURL links to the response playbook.
	PlaybookURL string `json:"playbookUrl,omitempty"`

	// Owner is the team or person responsible for the response.
	Owner string `json:"owner,omitempty"`

	// EscalationPath describes the escalation procedure.
	EscalationPath string `json:"escalationPath,omitempty"`

	// SLAMinutes is the expected response time SLA in minutes.
	SLAMinutes int `json:"slaMinutes,omitempty"`
}

type RiskAssessment struct {
	// Likelihood of exploitation (1-5 scale).
	// 1=Rare, 2=Unlikely, 3=Possible, 4=Likely, 5=Almost Certain
	Likelihood int `json:"likelihood"`

	// Impact if exploited (1-5 scale).
	// 1=Negligible, 2=Minor, 3=Moderate, 4=Major, 5=Severe
	Impact int `json:"impact"`

	// Score is Likelihood × Impact (1-25, can be calculated or provided).
	Score int `json:"score,omitempty"`

	// Level is the categorical risk level (can be calculated from score).
	Level RiskLevel `json:"level,omitempty"`

	// LikelihoodRationale explains why this likelihood was chosen.
	LikelihoodRationale string `json:"likelihoodRationale,omitempty"`

	// ImpactRationale explains why this impact was chosen.
	ImpactRationale string `json:"impactRationale,omitempty"`
}

type RiskLevel string

type SBOMFormat string

type SBOMReference struct {
	// Format specifies the SBOM format (cyclonedx, spdx)
	Format SBOMFormat `json:"format,omitempty"`

	// Version of the SBOM specification (e.g., "1.5" for CycloneDX, "2.3" for SPDX)
	Version string `json:"version,omitempty"`

	// URI is the location of the SBOM document
	URI string `json:"uri,omitempty"`

	// SerialNumber is the unique identifier for the SBOM (CycloneDX)
	SerialNumber string `json:"serialNumber,omitempty"`

	// DocumentNamespace is the unique identifier for the SBOM (SPDX)
	DocumentNamespace string `json:"documentNamespace,omitempty"`

	// Components lists the software components referenced in this threat model
	Components []ComponentReference `json:"components,omitempty"`
}

type SOC2TrustServiceCategory string

type SSVCAssessment struct {
	// VulnerabilityID is the CVE or other vulnerability identifier
	VulnerabilityID string `json:"vulnerabilityId,omitempty"`

	// Exploitation status (none, poc, active)
	Exploitation SSVCExploitation `json:"exploitation,omitempty"`

	// Automatable indicates if exploitation can be automated (no, yes)
	Automatable SSVCAutomatable `json:"automatable,omitempty"`

	// TechnicalImpact of successful exploitation (partial, total)
	TechnicalImpact SSVCTechnicalImpact `json:"technicalImpact,omitempty"`

	// MissionPrevalence indicates mission/business criticality (minimal, support, essential)
	MissionPrevalence SSVCMissionPrevalence `json:"missionPrevalence,omitempty"`

	// PublicWellBeing indicates impact on public safety (minimal, material, irreversible)
	PublicWellBeing SSVCPublicWellBeing `json:"publicWellBeing,omitempty"`

	// Decision is the calculated SSVC decision (track, track*, attend, act)
	Decision SSVCDecision `json:"decision,omitempty"`

	// Notes provides additional context for the assessment
	Notes string `json:"notes,omitempty"`

	// AssessedAt is when this assessment was made
	AssessedAt string `json:"assessedAt,omitempty"`

	// AssessedBy is who performed this assessment
	AssessedBy string `json:"assessedBy,omitempty"`
}

type SSVCAutomatable string

type SSVCDecision string

type SSVCExploitation string

type SSVCMissionPrevalence string

type SSVCPublicWellBeing string

type SSVCTechnicalImpact string

type STIXAttackPattern struct {
	Type               string                  `json:"type"`
	SpecVersion        string                  `json:"spec_version"`
	ID                 string                  `json:"id"`
	Created            string                  `json:"created"`
	Modified           string                  `json:"modified"`
	CreatedByRef       string                  `json:"created_by_ref,omitempty"`
	Name               string                  `json:"name"`
	Description        string                  `json:"description,omitempty"`
	KillChainPhases    []STIXKillChainPhase    `json:"kill_chain_phases,omitempty"`
	ExternalReferences []STIXExternalReference `json:"external_references,omitempty"`
}

type STIXBundle struct {
	Type    string        `json:"type"`
	ID      string        `json:"id"`
	Objects []interface{} `json:"objects"`
}