policy

type OPAEvaluator struct {
	// contains filtered or unexported fields
}

type PolicyResult struct {
	Result     string                 `json:"result"` // "PASSED" or "FAILED"
	Violations []PolicyViolation      `json:"violations"`
	Details    map[string]interface{} `json:"details"`
	Timestamp  time.Time              `json:"timestamp"`
}

type PolicyViolation struct {
	Policy  string `json:"policy"`
	Message string `json:"message"`
}

type ResolveOptions struct {
	// DefaultAsset is the default asset name used for ghrel:// resolution
	// (e.g., "bundle.tar.gz", "schemas.tar.gz"). Stabilizing this on the
	// dispatcher signature lets new schemes (OCI, ghrel) be added as
	// independent cases without changing resolveBundlePath's signature.
	// Consumed by the ghrel:// case to pick the release asset when the
	// reference omits an explicit ?asset= query.
	DefaultAsset string
	// ExpectedDigest, when non-empty, pins the SHA-256 of the downloaded
	// ghrel:// bundle archive (sha256:hex or bare hex). The ghrel resolver
	// hard-fails on a mismatch. It is an opt-in integrity check on the archive
	// bytes, distinct from the SLSA-aligned digest of the extracted contents
	// computed by CalculateDigest, and is only set for the bundle path (never
	// the schemas asset).
	ExpectedDigest string
}