update

type CVECacheEntry struct {
	ID             string      `json:"id"`
	Ecosystem      string      `json:"ecosystem"`
	PackageName    string      `json:"package_name"`
	PackageVersion string      `json:"package_version"`
	CVEID          string      `json:"cve_id"`
	CVSSScore      float64     `json:"cvss_score"`
	CVSSVector     string      `json:"cvss_vector"`
	Severity       CVESeverity `json:"severity"`
	Summary        string      `json:"summary"`
	FixedIn        string      `json:"fixed_in"`
	ReferencesJSON string      `json:"references_json"`
	FetchedAt      time.Time   `json:"fetched_at"`
	ExpiresAt      time.Time   `json:"expires_at"`
}

type CVEClient struct {
	// contains filtered or unexported fields
}

type CVEEvaluation struct {
	ContainerID    string              `json:"container_id"`
	Status         CVEEvaluationStatus `json:"status"`
	EvaluatedAt    time.Time           `json:"evaluated_at"`
	Ecosystem      string              `json:"ecosystem,omitempty"`
	PackageName    string              `json:"package_name,omitempty"`
	PackageVersion string              `json:"package_version,omitempty"`
	Error          string              `json:"error,omitempty"`
}

type CVEEvaluationStatus string

type CVESeverity string

type CVSSMetrics struct {
	Version string
	AV      string
	AC      string
	PR      string
	UI      string
	S       string
	C       string
	I       string
	A       string
}

type ChangelogResolver struct {
	// contains filtered or unexported fields
}

type ContainerCVE struct {
	ID              string      `json:"id"`
	ContainerID     string      `json:"container_id"`
	CVEID           string      `json:"cve_id"`
	Severity        CVESeverity `json:"severity"`
	CVSSScore       float64     `json:"cvss_score"`
	Summary         string      `json:"summary"`
	FixedIn         string      `json:"fixed_in"`
	FirstDetectedAt time.Time   `json:"first_detected_at"`
	ResolvedAt      *time.Time  `json:"resolved_at,omitempty"`
}

type ContainerInfo struct {
	UID                string // canonical store PK (uid.Container) — used as alert EntityID
	ExternalID         string
	Name               string
	Image              string
	Labels             map[string]string
	OrchestrationGroup string
	OrchestrationUnit  string
	RuntimeType        string
	ControllerKind     string
	ComposeWorkingDir  string
}

type ContainerLister interface {
	ListContainerInfos(ctx context.Context) ([]ContainerInfo, error)
}

type ContainerServiceAdapter struct {
	// contains filtered or unexported fields
}

type Deps struct {
	Store         UpdateStore        // required
	Scanner       *Scanner           // required
	Containers    ContainerLister    // required
	Logger        *slog.Logger       // required
	Enricher      Enricher           // optional — defaults to no-op
	EventCallback EventCallback      // optional — nil-safe
	AlertChan     chan<- interface{} // optional — nil-safe
}

type DigestBaseline struct {
	ContainerID  string    `json:"container_id"`
	Image        string    `json:"image"`
	Tag          string    `json:"tag"`
	RemoteDigest string    `json:"remote_digest"`
	CheckedAt    time.Time `json:"checked_at"`
}

type DigestReport struct {
	Critical    []ImageUpdate `json:"critical"`
	Recommended []ImageUpdate `json:"recommended"`
	Available   []ImageUpdate `json:"available"`
	UpToDate    int           `json:"up_to_date"`
	Untracked   int           `json:"untracked"`
	TotalCVEs   int           `json:"total_cves"`
}

type EcosystemResolver struct {
	// contains filtered or unexported fields
}

type EcosystemResult struct {
	PackageName     string `json:"package_name"`
	Ecosystem       string `json:"ecosystem"`
	DetectionMethod string `json:"detection_method"`
}

type Enricher interface {
	Enrich(ctx context.Context, results []UpdateResult) error
}

type EventCallback func(eventType string, data interface{})

type ExclusionType string

type ImageCVEQuery struct {
	ContainerID string
	PackageName string
	Ecosystem   string
	Version     string
}

type ImageUpdate struct {
	ID                 string     `json:"id"`
	ScanID             string     `json:"scan_id"`
	ContainerID        string     `json:"container_id"`
	ContainerName      string     `json:"container_name"`
	Image              string     `json:"image"`
	CurrentTag         string     `json:"current_tag"`
	CurrentDigest      string     `json:"current_digest"`
	Registry           string     `json:"registry"`
	LatestTag          string     `json:"latest_tag,omitempty"`
	LatestDigest       string     `json:"latest_digest,omitempty"`
	UpdateType         UpdateType `json:"update_type,omitempty"`
	PublishedAt        *time.Time `json:"published_at,omitempty"`
	ChangelogURL       string     `json:"changelog_url,omitempty"`
	ChangelogSummary   string     `json:"changelog_summary,omitempty"`
	HasBreakingChanges bool       `json:"has_breaking_changes"`
	RiskScore          int        `json:"risk_score"`
	PreviousDigest     string     `json:"previous_digest,omitempty"`
	SourceURL          string     `json:"source_url,omitempty"`
	Status             Status     `json:"status"`
	DetectedAt         time.Time  `json:"detected_at"`
}

type LabelFetcher interface {
	FetchLabels(ctx context.Context) (map[string]map[string]string, error)
}

type ListCVEsOpts struct {
	Severity    string
	ContainerID string
}

type ListImageUpdatesOpts struct {
	Status     string
	UpdateType string
	MinRisk    int
}

type ProEnricher struct {
	// contains filtered or unexported fields
}

type RegistryClient struct{}

type ReleaseInfo struct {
	TagName            string    `json:"tag_name"`
	Name               string    `json:"name"`
	Body               string    `json:"body"`
	PublishedAt        time.Time `json:"published_at"`
	HTMLURL            string    `json:"html_url"`
	HasBreakingChanges bool      `json:"has_breaking_changes"`
}

type RiskContext struct {
	HasEndpointCheck bool
	RestartCount     int
	DependentCount   int
	Criticality      string // from maintenant.severity label
}

type RiskEngine struct{}

type RiskFactor struct {
	Label string `json:"label"`
	Score int    `json:"score"`
}

type RiskLevel string

type RiskScore struct {
	ContainerID string                `json:"container_id"`
	Score       int                   `json:"score"`
	Level       RiskLevel             `json:"level"`
	Factors     map[string]RiskFactor `json:"factors"`
}

type RiskScoreRecord struct {
	ID          string    `json:"id"`
	ContainerID string    `json:"container_id"`
	Score       int       `json:"score"`
	FactorsJSON string    `json:"factors_json"`
	RecordedAt  time.Time `json:"recorded_at"`
}

type ScanError struct {
	ContainerID   string
	ContainerName string
	Image         string
	Error         error
}

type ScanRecord struct {
	ID                string     `json:"id"`
	StartedAt         time.Time  `json:"started_at"`
	CompletedAt       *time.Time `json:"completed_at,omitempty"`
	ContainersScanned int        `json:"containers_scanned"`
	UpdatesFound      int        `json:"updates_found"`
	Errors            int        `json:"errors"`
	Status            ScanStatus `json:"status"`
}

type ScanStatus string

type Scanner struct {
	// contains filtered or unexported fields
}

type Service struct {
	// contains filtered or unexported fields
}

type StaleImageUpdate struct {
	ContainerID   string
	ContainerName string
	// ContainerUID is the maintenant id, filled for findings whose container is
	// gone from the scan set and can no longer be looked up by the caller. Empty
	// when the container row itself has been deleted.
	ContainerUID string
}

type Status string

type TagFilter struct {
	// contains filtered or unexported fields
}

type UpdateConfig struct {
	Enabled     bool
	Track       string // "major", "minor", "patch", "digest"
	Pin         string // pinned tag
	IgnoreMajor bool
	Registry    string // override registry
	AlertOn     string // "all", "critical", "none"
	DigestOnly  bool
	TagInclude  *regexp.Regexp // compiled tag-include regex, nil if absent/invalid
	TagExclude  *regexp.Regexp // compiled tag-exclude regex, nil if absent/invalid
}

type UpdateExclusion struct {
	ID          string        `json:"id"`
	Pattern     string        `json:"pattern"`
	PatternType ExclusionType `json:"pattern_type"`
	CreatedAt   time.Time     `json:"created_at"`
}

type UpdateResult struct {
	ContainerID        string
	ContainerName      string
	Image              string
	CurrentTag         string
	CurrentDigest      string
	Registry           string
	LatestTag          string
	LatestDigest       string
	UpdateType         UpdateType
	HasUpdate          bool
	ChangelogURL       string
	ChangelogSummary   string
	HasBreakingChanges bool
	SourceURL          string
	PreviousDigest     string
}

type UpdateStore interface {
	// Scan records
	InsertScanRecord(ctx context.Context, r *ScanRecord) (string, error)
	UpdateScanRecord(ctx context.Context, r *ScanRecord) error
	GetScanRecord(ctx context.Context, id string) (*ScanRecord, error)
	GetLatestScanRecord(ctx context.Context) (*ScanRecord, error)

	// Image updates
	InsertImageUpdate(ctx context.Context, u *ImageUpdate) (string, error)
	UpdateImageUpdate(ctx context.Context, u *ImageUpdate) error
	GetImageUpdate(ctx context.Context, id string) (*ImageUpdate, error)
	GetImageUpdateByContainer(ctx context.Context, containerID string) (*ImageUpdate, error)
	ListImageUpdates(ctx context.Context, opts ListImageUpdatesOpts) ([]*ImageUpdate, error)
	GetUpdateSummary(ctx context.Context) (*UpdateSummary, error)
	DeleteImageUpdatesByContainer(ctx context.Context, containerID string) error
	DeleteStaleImageUpdates(ctx context.Context, scanID string, scannedContainerNames []string) (int64, error)
	ListStaleImageUpdates(ctx context.Context, scanID string, scannedContainerNames []string) ([]StaleImageUpdate, error)
	ListOrphanImageUpdates(ctx context.Context) ([]StaleImageUpdate, error)
	DeleteOrphanImageUpdates(ctx context.Context) (int64, error)

	// Version pins
	InsertVersionPin(ctx context.Context, p *VersionPin) (string, error)
	GetVersionPin(ctx context.Context, containerID string) (*VersionPin, error)
	DeleteVersionPin(ctx context.Context, containerID string) error

	// Update exclusions
	InsertExclusion(ctx context.Context, e *UpdateExclusion) (string, error)
	ListExclusions(ctx context.Context) ([]*UpdateExclusion, error)
	DeleteExclusion(ctx context.Context, id string) error

	// CVE cache
	InsertCVECacheEntry(ctx context.Context, e *CVECacheEntry) (string, error)
	GetCVECacheEntries(ctx context.Context, ecosystem, packageName, packageVersion string) ([]*CVECacheEntry, error)
	IsCVECacheFresh(ctx context.Context, ecosystem, packageName, packageVersion string) (bool, error)

	// Container CVEs
	UpsertContainerCVE(ctx context.Context, c *ContainerCVE) error
	ListContainerCVEs(ctx context.Context, containerID string) ([]*ContainerCVE, error)
	ListAllActiveCVEs(ctx context.Context, opts ListCVEsOpts) ([]*ContainerCVE, error)
	ResolveContainerCVE(ctx context.Context, containerID, cveID string) error
	DeleteContainerCVEs(ctx context.Context, containerID string) error
	GetCVESummaryCounts(ctx context.Context) (map[string]int, error)

	// CVE evaluations
	UpsertCVEEvaluation(ctx context.Context, e *CVEEvaluation) error
	GetCVEEvaluation(ctx context.Context, containerID string) (*CVEEvaluation, error)
	DeleteCVEEvaluation(ctx context.Context, containerID string) error

	// Digest baselines (non-semver tags)
	UpsertDigestBaseline(ctx context.Context, b *DigestBaseline) error
	GetDigestBaseline(ctx context.Context, containerID string) (*DigestBaseline, error)

	// Risk score history
	InsertRiskScoreRecord(ctx context.Context, r *RiskScoreRecord) (string, error)
	ListRiskScoreHistory(ctx context.Context, containerID string, from, to time.Time) ([]*RiskScoreRecord, error)

	// Retention cleanup
	CleanupExpired(ctx context.Context, olderThan time.Time) (int64, error)
}

type UpdateSummary struct {
	Critical    int `json:"critical"`
	Recommended int `json:"recommended"`
	Available   int `json:"available"`
	UpToDate    int `json:"up_to_date"`
	Untracked   int `json:"untracked"`
	Pinned      int `json:"pinned"`
}

type UpdateType string

type VersionPin struct {
	ID           string    `json:"id"`
	ContainerID  string    `json:"container_id"`
	Image        string    `json:"image"`
	PinnedTag    string    `json:"pinned_tag"`
	PinnedDigest string    `json:"pinned_digest"`
	Reason       string    `json:"reason,omitempty"`
	PinnedAt     time.Time `json:"pinned_at"`
}