ctis

type ASNInput struct {
	Number  string // "AS13335" or "13335"
	Org     string
	Country string // ISO 3166-1 alpha-2
}

type ASVSInfo struct {
	// ASVS section (e.g., "V2: Authentication")
	Section string `json:"section,omitempty"`

	// Control ID (e.g., "2.1.1")
	ControlID string `json:"control_id,omitempty"`

	// Control URL (link to ASVS documentation)
	ControlURL string `json:"control_url,omitempty"`

	// ASVS level (1, 2, or 3)
	Level int `json:"level,omitempty"`
}

type AccessControlIssue struct {
	// Missing modifier
	MissingModifier string `json:"missing_modifier,omitempty"`

	// Unprotected function
	UnprotectedFunction string `json:"unprotected_function,omitempty"`

	// Can be called by
	CallableBy string `json:"callable_by,omitempty"` // anyone, owner_only, etc.

	// Privilege escalation path
	EscalationPath string `json:"escalation_path,omitempty"`

	// Missing role check
	MissingRoleCheck string `json:"missing_role_check,omitempty"`
}

type Advisory struct {
	// Advisory id (MS24-001, RHSA-2024:1234, DSA-5600-1).
	ID string `json:"id,omitempty"`

	// Advisory URL.
	URL string `json:"url,omitempty"`

	// Issuer (microsoft, redhat, debian, ...).
	Source string `json:"source,omitempty"`
}

type ArtifactLocation struct {
	// URI of the artifact
	URI string `json:"uri,omitempty"`

	// Base URI ID for resolution
	URIBaseID string `json:"uri_base_id,omitempty"`

	// Index within the artifacts array
	Index int `json:"index,omitempty"`
}

type Asset struct {
	// Unique identifier for this asset within the report
	ID string `json:"id,omitempty"`

	// Asset type (required): domain, ip_address, repository, certificate, etc.
	Type AssetType `json:"type"`

	// Primary value of the asset (required)
	// For domain: "example.com"
	// For ip_address: "192.168.1.1"
	// For repository: "github.com/org/repo"
	Value string `json:"value"`

	// Human-readable name
	Name string `json:"name,omitempty"`

	// Description
	Description string `json:"description,omitempty"`

	// Tags for categorization
	Tags []string `json:"tags,omitempty"`

	// Asset criticality: critical, high, medium, low, info
	Criticality Criticality `json:"criticality,omitempty"`

	// Confidence score 0-100 (how confident the source is about this asset)
	Confidence int `json:"confidence,omitempty"`

	// When this asset was discovered
	DiscoveredAt *time.Time `json:"discovered_at,omitempty"`

	// Asset-specific technical details
	Technical *AssetTechnical `json:"technical,omitempty"`

	// Related assets (by ID within this report)
	RelatedAssets []string `json:"related_assets,omitempty"`

	// CTEM: Compliance context for the asset
	Compliance *AssetCompliance `json:"compliance,omitempty"`

	// CTEM: Services running on this asset
	Services []ServiceInfo `json:"services,omitempty"`

	// CTEM: Is the asset directly accessible from the internet
	IsInternetAccessible bool `json:"is_internet_accessible,omitempty"`

	// Stable identifiers of the asset. A platform matches an incoming asset
	// to an existing one on these before it falls back to the name or an IP
	// address, so a renamed host or repository keeps its history.
	Identifiers *AssetIdentifiers `json:"identifiers,omitempty"`

	// What a scanner observed about the host that helps match it across
	// tools (FQDN, NetBIOS name, MACs, OS CPE, cloud id, agent id). Weaker
	// than Identifiers.
	IdentityHints *IdentityHints `json:"identity_hints,omitempty"`

	// Technologies the asset runs, as a fingerprinting tool identified
	// them (1.5). Replaces the untyped properties.technologies list.
	Technologies []Technology `json:"technologies,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type AssetCompliance struct {
	// Compliance frameworks this asset is in scope for: PCI-DSS, HIPAA, SOC2, GDPR, ISO27001
	Frameworks []string `json:"frameworks,omitempty"`

	// Data classification level: public, internal, confidential, restricted, secret
	DataClassification string `json:"data_classification,omitempty"`

	// Asset contains Personally Identifiable Information
	PIIExposed bool `json:"pii_exposed,omitempty"`

	// Asset contains Protected Health Information
	PHIExposed bool `json:"phi_exposed,omitempty"`

	// Regulatory owner email/username
	RegulatoryOwner string `json:"regulatory_owner,omitempty"`
}

type AssetIdentifiers struct {
	// Host ID read by a sensor on the host: /etc/machine-id on Linux,
	// MachineGuid on Windows, IOPlatformUUID on macOS.
	MachineID string `json:"machine_id,omitempty"`

	// Cloud instance ID (i-0abc...), VM ID or resource ARN.
	CloudResourceID string `json:"cloud_resource_id,omitempty"`

	// SMBIOS system UUID.
	BIOSUUID string `json:"bios_uuid,omitempty"`

	// Hardware serial number.
	SerialNumber string `json:"serial_number,omitempty"`

	// MAC addresses of the host's network interfaces. Receivers ignore
	// locally administered, multicast and known shared addresses.
	MACAddresses []string `json:"mac_addresses,omitempty"`

	// Repository ID assigned by the source-code host (the numeric GitHub
	// repository ID, the GitLab project ID). It survives renames and
	// transfers.
	SCMRepoID string `json:"scm_repo_id,omitempty"`
}

type AssetTechnical struct {
	// For domain assets
	Domain *DomainTechnical `json:"domain,omitempty"`

	// For IP address assets
	IPAddress *IPAddressTechnical `json:"ip_address,omitempty"`

	// For repository assets
	Repository *RepositoryTechnical `json:"repository,omitempty"`

	// For certificate assets
	Certificate *CertificateTechnical `json:"certificate,omitempty"`

	// For cloud assets
	Cloud *CloudTechnical `json:"cloud,omitempty"`

	// For service assets
	Service *ServiceTechnical `json:"service,omitempty"`

	// For Web3 assets (smart contracts, wallets, tokens, etc.)
	Web3 *Web3Technical `json:"web3,omitempty"`
}

type AssetType string

type Attachment struct {
	// Description of the attachment
	Description string `json:"description,omitempty"`

	// Artifact location
	ArtifactLocation *ArtifactLocation `json:"artifact_location,omitempty"`

	// Relevant regions within the artifact
	Regions []*FindingLocation `json:"regions,omitempty"`
}

type AuditReport struct {
	Auditor       string     `json:"auditor"`
	ReportURL     string     `json:"report_url,omitempty"`
	Date          *time.Time `json:"date,omitempty"`
	Scope         string     `json:"scope,omitempty"`
	CriticalCount int        `json:"critical_count,omitempty"`
	HighCount     int        `json:"high_count,omitempty"`
	MediumCount   int        `json:"medium_count,omitempty"`
	LowCount      int        `json:"low_count,omitempty"`
}

type BranchInfo struct {
	// Branch name (e.g., "main", "feature/xyz", "refs/heads/main")
	Name string `json:"name"`

	// Whether this is the default branch (main/master)
	// Auto-resolve only applies to default branch scans
	IsDefaultBranch bool `json:"is_default_branch"`

	// Commit SHA being scanned
	CommitSHA string `json:"commit_sha,omitempty"`

	// Base branch for PR/MR scans (e.g., "main" when scanning a PR targeting main)
	BaseBranch string `json:"base_branch,omitempty"`

	// PR/MR number if this is a pull request scan
	PullRequestNumber int `json:"pull_request_number,omitempty"`

	// PR/MR URL if this is a pull request scan
	PullRequestURL string `json:"pull_request_url,omitempty"`

	// Repository URL for context
	RepositoryURL string `json:"repository_url,omitempty"`
}

type BusinessImpact struct {
	// Data exposure risk: none, low, medium, high, critical
	DataExposureRisk string `json:"data_exposure_risk,omitempty"`

	// Has potential reputational impact
	ReputationalImpact bool `json:"reputational_impact,omitempty"`

	// Compliance frameworks impacted: PCI-DSS, HIPAA, SOC2, GDPR, ISO27001
	ComplianceImpact []string `json:"compliance_impact,omitempty"`
}

type CertificateTechnical struct {
	// Serial number
	SerialNumber string `json:"serial_number,omitempty"`

	// Subject common name
	SubjectCN string `json:"subject_cn,omitempty"`

	// Subject alternative names
	SANs []string `json:"sans,omitempty"`

	// Issuer common name
	IssuerCN string `json:"issuer_cn,omitempty"`

	// Issuer organization
	IssuerOrg string `json:"issuer_org,omitempty"`

	// Valid from
	NotBefore *time.Time `json:"not_before,omitempty"`

	// Valid until
	NotAfter *time.Time `json:"not_after,omitempty"`

	// Signature algorithm
	SignatureAlgorithm string `json:"signature_algorithm,omitempty"`

	// Key algorithm
	KeyAlgorithm string `json:"key_algorithm,omitempty"`

	// Key size in bits
	KeySize int `json:"key_size,omitempty"`

	// SHA-256 fingerprint
	Fingerprint string `json:"fingerprint,omitempty"`

	// Is self-signed
	SelfSigned bool `json:"self_signed,omitempty"`

	// Is expired
	Expired bool `json:"expired,omitempty"`

	// Is wildcard
	Wildcard bool `json:"wildcard,omitempty"`
}

type CloudTechnical struct {
	// Cloud provider: aws, gcp, azure
	Provider string `json:"provider,omitempty"`

	// Account/project ID
	AccountID string `json:"account_id,omitempty"`

	// Region
	Region string `json:"region,omitempty"`

	// Availability zone
	Zone string `json:"zone,omitempty"`

	// Resource type: ec2, s3, rds, etc.
	ResourceType string `json:"resource_type,omitempty"`

	// Resource ID
	ResourceID string `json:"resource_id,omitempty"`

	// Resource ARN (AWS)
	ARN string `json:"arn,omitempty"`

	// Resource tags
	Tags map[string]string `json:"tags,omitempty"`
}

type ComplianceDetails struct {
	// Framework: pci-dss, hipaa, soc2, cis, etc.
	Framework string `json:"framework,omitempty"`

	// Framework version
	FrameworkVersion string `json:"framework_version,omitempty"`

	// Control ID
	ControlID string `json:"control_id,omitempty"`

	// Control name
	ControlName string `json:"control_name,omitempty"`

	// Control description
	ControlDescription string `json:"control_description,omitempty"`

	// Result: pass, fail, manual, not_applicable
	Result string `json:"result,omitempty"`
}

type ContainerLayer struct {
	// Layer digest (e.g., "sha256:abc123...")
	Digest string `json:"digest,omitempty"`

	// Layer diff ID
	DiffID string `json:"diff_id,omitempty"`
}

type ContractLibrary struct {
	Name    string `json:"name"`
	Address string `json:"address"`
}

type ConvertOptions struct {
	// Asset to associate findings with
	AssetType  AssetType
	AssetValue string
	AssetID    string

	// Branch/commit info (legacy - use BranchInfo for full context)
	Branch    string
	CommitSHA string

	// Branch information for branch-aware finding lifecycle
	// Provides full CI/CD context for auto-resolve and expiry features
	BranchInfo *BranchInfo

	// Default confidence
	DefaultConfidence int

	// Tool type hints (for finding type detection)
	ToolType string // "sast", "sca", "secret", "iac", "web3"
}

type CoreContract struct {
	Name    string `json:"name"`
	Address string `json:"address"`
	Role    string `json:"role,omitempty"` // router, factory, vault, etc.
}

type Criticality string

type DNSRecord struct {
	Type  string `json:"type"`  // A, AAAA, CNAME, MX, TXT, etc.
	Name  string `json:"name"`  // Record name
	Value string `json:"value"` // Record value
	TTL   int    `json:"ttl,omitempty"`
}

type DNSRecordInput struct {
	Host       string
	RecordType string
	Values     []string
	TTL        int
	Resolver   string
	StatusCode string
}

type DataFlow struct {
	// Taint source locations (where untrusted data enters)
	Sources []DataFlowLocation `json:"sources,omitempty"`

	// Intermediate variable locations (propagation path)
	Intermediates []DataFlowLocation `json:"intermediates,omitempty"`

	// Taint sink location (where data reaches dangerous function)
	Sinks []DataFlowLocation `json:"sinks,omitempty"`

	// Sanitizers applied (functions that clean/escape data)
	Sanitizers []DataFlowLocation `json:"sanitizers,omitempty"`

	// Whether the data is still tainted at the sink
	// (false if properly sanitized before reaching sink)
	Tainted bool `json:"tainted"`

	// Type of taint: user_input, file_read, env_var, network, database
	TaintType string `json:"taint_type,omitempty"`

	// Vulnerability type this flow leads to: sqli, xss, ssrf, command_injection, etc.
	VulnerabilityType string `json:"vulnerability_type,omitempty"`

	// Flow confidence score (0-100)
	Confidence int `json:"confidence,omitempty"`

	// Is interprocedural (crosses function boundaries)
	Interprocedural bool `json:"interprocedural,omitempty"`

	// Is cross-file (data flows across multiple files)
	CrossFile bool `json:"cross_file,omitempty"`

	// Call graph path (function names in order)
	CallPath []string `json:"call_path,omitempty"`

	// Summary of the flow for human readability
	Summary string `json:"summary,omitempty"`
}

type DataFlowLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Line number (1-indexed)
	Line int `json:"line,omitempty"`

	// End line (for multi-line spans)
	EndLine int `json:"end_line,omitempty"`

	// Column number (1-indexed)
	Column int `json:"column,omitempty"`

	// End column
	EndColumn int `json:"end_column,omitempty"`

	// Code content at this location
	Content string `json:"content,omitempty"`

	// Variable or expression name
	Label string `json:"label,omitempty"`

	// Step index in the flow (for ordering, 0-indexed)
	Index int `json:"index,omitempty"`

	// Location type: source, sink, propagator, sanitizer, transform
	Type DataFlowLocationType `json:"type,omitempty"`

	// Function/method name containing this location
	Function string `json:"function,omitempty"`

	// Class/struct name (if applicable)
	Class string `json:"class,omitempty"`

	// Module/namespace
	Module string `json:"module,omitempty"`

	// The operation performed: assignment, call, return, parameter, concat, etc.
	Operation string `json:"operation,omitempty"`

	// For function calls: the function being called
	CalledFunction string `json:"called_function,omitempty"`

	// For parameters: the parameter index (0-indexed)
	ParameterIndex int `json:"parameter_index,omitempty"`

	// Taint state at this location: tainted, sanitized, unknown
	TaintState string `json:"taint_state,omitempty"`

	// Transformation applied: encode, decode, escape, hash, encrypt, etc.
	Transformation string `json:"transformation,omitempty"`

	// Notes for human understanding
	Notes string `json:"notes,omitempty"`
}

type DataFlowLocationType string

type DeFiDetails struct {
	// Protocol name: uniswap, aave, compound, etc.
	ProtocolName string `json:"protocol_name,omitempty"`

	// Protocol type: dex, lending, yield, bridge, derivatives, etc.
	ProtocolType string `json:"protocol_type,omitempty"`

	// Protocol version
	Version string `json:"version,omitempty"`

	// Total Value Locked (TVL) in USD
	TVLUSD float64 `json:"tvl_usd,omitempty"`

	// Supported chains
	SupportedChains []string `json:"supported_chains,omitempty"`

	// Core contracts
	CoreContracts []CoreContract `json:"core_contracts,omitempty"`

	// Governance token address
	GovernanceToken string `json:"governance_token,omitempty"`

	// Is audited
	Audited bool `json:"audited,omitempty"`

	// Audit reports
	AuditReports []AuditReport `json:"audit_reports,omitempty"`

	// Has bug bounty
	HasBugBounty bool `json:"has_bug_bounty,omitempty"`

	// Bug bounty platform: immunefi, hackerone, etc.
	BugBountyPlatform string `json:"bug_bounty_platform,omitempty"`

	// Max bug bounty payout
	MaxBountyUSD float64 `json:"max_bounty_usd,omitempty"`

	// Timelock duration (for governance)
	TimelockDuration int `json:"timelock_duration,omitempty"`

	// Is paused
	Paused bool `json:"paused,omitempty"`
}

type Dependency struct {
	// Unique identifier for this dependency
	ID string `json:"id,omitempty"`

	// Package name
	Name string `json:"name"`

	// Package version
	Version string `json:"version,omitempty"`

	// Package type: library, framework, application, os
	Type string `json:"type,omitempty"`

	// Ecosystem: npm, pypi, maven, gomod, etc.
	Ecosystem string `json:"ecosystem,omitempty"`

	// Package URL (PURL)
	PURL string `json:"purl,omitempty"`

	// Unique identifier from scanner (e.g., Trivy UID)
	UID string `json:"uid,omitempty"`

	// License information
	Licenses []string `json:"licenses,omitempty"`

	// Dependency relationship: direct, indirect, root, transit
	Relationship string `json:"relationship,omitempty"`

	// Dependencies (list of IDs or names this component depends on)
	DependsOn []string `json:"depends_on,omitempty"`

	// File path where this dependency is defined
	Path string `json:"path,omitempty"` // file path

	// Location in file (deprecated, use Locations)
	Location *FindingLocation `json:"location,omitempty"`

	// All locations where this dependency is defined
	Locations []DependencyLocation `json:"locations,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type DependencyLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Start line number
	StartLine int `json:"start_line,omitempty"`

	// End line number
	EndLine int `json:"end_line,omitempty"`

	// Start column number
	StartColumn int `json:"start_column,omitempty"`

	// End column number
	EndColumn int `json:"end_column,omitempty"`
}

type DetectionType string

type DiscoveredURLInput struct {
	URL        string
	Method     string
	Source     string
	StatusCode int
	Depth      int
	Parent     string
	Type       string
	Extension  string

	// ContentType of the response (1.6 endpoints).
	ContentType string

	// Params are parameters seen besides the query: form fields, JSON
	// members, headers. Names only.
	Params []EndpointParam
}

type DomainTechnical struct {
	// Registrar information
	Registrar string `json:"registrar,omitempty"`

	// Registration date
	RegisteredAt *time.Time `json:"registered_at,omitempty"`

	// Expiration date
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// Nameservers
	Nameservers []string `json:"nameservers,omitempty"`

	// DNS records
	DNSRecords []DNSRecord `json:"dns_records,omitempty"`

	// WHOIS data
	WHOIS map[string]string `json:"whois,omitempty"`
}

type Endpoint struct {
	// ID names the endpoint within the report (finding.web.endpoint_ref).
	ID string `json:"id,omitempty"`

	// Origin is the normalised origin, "https://api.example.com".
	Origin string `json:"origin"`

	// OriginRef names the http_service asset of the origin in this report.
	OriginRef string `json:"origin_ref,omitempty"`

	// Method is an HTTP method, or ANY when unknown.
	Method string `json:"method,omitempty"`

	// Path is the concrete path, without query or fragment.
	Path string `json:"path"`

	// Template is the producer's path template; a receiver recomputes it.
	Template string `json:"template,omitempty"`

	Kind   EndpointKind   `json:"kind,omitempty"`
	Source EndpointSource `json:"source,omitempty"`

	// Parent is the page the endpoint was found on, redacted (no query
	// values, user info or fragment).
	Parent string `json:"parent,omitempty"`

	StatusCode  int          `json:"status_code,omitempty"`
	ContentType string       `json:"content_type,omitempty"`
	Auth        EndpointAuth `json:"auth,omitempty"`

	Technologies []Technology `json:"technologies,omitempty"`

	// Params are the parameters the endpoint takes: names and hints,
	// never values.
	Params []EndpointParam `json:"params,omitempty"`
}

type EndpointAuth string

type EndpointKind string

type EndpointParam struct {
	Location ParamLocation `json:"location"`
	Name     string        `json:"name"`
	TypeHint string        `json:"type_hint,omitempty"`
	Required bool          `json:"required,omitempty"`
}

type EndpointSource string

type EvidenceArtifact struct {
	MediaType string `json:"media_type"`
	SHA256    string `json:"sha256"`
	Size      int64  `json:"size,omitempty"`
	Ref       string `json:"ref,omitempty"`
}

type EvidenceFile struct {
	Path      string `json:"path"`
	StartLine int    `json:"start_line,omitempty"`
	EndLine   int    `json:"end_line,omitempty"`
	Snippet   string `json:"snippet,omitempty"`
}

type EvidenceHTTP struct {
	Request  *EvidenceRequest  `json:"request,omitempty"`
	Response *EvidenceResponse `json:"response,omitempty"`
}

type EvidenceHeader struct {
	Name  string `json:"name"`
	Value string `json:"value"`
}

type EvidenceItem struct {
	// Kind is a known kind or another ^[a-z0-9][a-z0-9_.-]{0,63}$ name.
	Kind string `json:"kind"`

	// Version of the kind's body format (1).
	Version int `json:"version,omitempty"`

	Label      string     `json:"label,omitempty"`
	CapturedAt *time.Time `json:"captured_at,omitempty"`

	// ContentSHA256 is "sha256:<hex>" over the item as captured, before any
	// masking or truncation.
	ContentSHA256 string `json:"content_sha256,omitempty"`

	// http_exchange
	HTTP *EvidenceHTTP `json:"http,omitempty"`

	// Match locates what matched in the request or the response.
	Match []EvidenceMatch `json:"match,omitempty"`

	// Extracted are values the tool extracted (versions, banners).
	Extracted []string `json:"extracted,omitempty"`

	// Text is the content of raw_text, command_output and curl items.
	Text string `json:"text,omitempty"`

	// Protocol of raw_text ("dns", "tls", "ssh", "banner", "smtp", ...).
	Protocol string `json:"protocol,omitempty"`

	// command_output
	Command  string `json:"command,omitempty"`
	ExitCode *int   `json:"exit_code,omitempty"`

	// file_excerpt
	File *EvidenceFile `json:"file,omitempty"`

	// screenshot (and any binary evidence)
	Artifact *EvidenceArtifact `json:"artifact,omitempty"`

	// Data holds the fields of a kind this module does not know; empty for
	// known kinds.
	Data map[string]any `json:"data,omitempty"`

	// Sensitive marks the spans that hold secrets or personal data.
	Sensitive []SensitiveSpan `json:"sensitive,omitempty"`
}

type EvidenceMatch struct {
	Location string `json:"location"`
	Part     string `json:"part"`
	Start    *int   `json:"start,omitempty"`
	End      *int   `json:"end,omitempty"`
	Matcher  string `json:"matcher,omitempty"`
}

type EvidenceRequest struct {
	Method        string           `json:"method,omitempty"`
	URL           string           `json:"url,omitempty"`
	HTTPVersion   string           `json:"http_version,omitempty"`
	Headers       []EvidenceHeader `json:"headers,omitempty"`
	Body          string           `json:"body,omitempty"`
	BodyEncoding  string           `json:"body_encoding,omitempty"`
	BodyTruncated bool             `json:"body_truncated,omitempty"`
	BodySize      int64            `json:"body_size,omitempty"`
}

type EvidenceResponse struct {
	Status        int              `json:"status,omitempty"`
	Reason        string           `json:"reason,omitempty"`
	HTTPVersion   string           `json:"http_version,omitempty"`
	Headers       []EvidenceHeader `json:"headers,omitempty"`
	Body          string           `json:"body,omitempty"`
	BodyEncoding  string           `json:"body_encoding,omitempty"`
	BodyTruncated bool             `json:"body_truncated,omitempty"`
	BodySize      int64            `json:"body_size,omitempty"`
	TimeMs        int64            `json:"time_ms,omitempty"`
}

type Finding struct {
	// Unique identifier for this finding within the report
	ID string `json:"id,omitempty"`

	// Finding type (required): vulnerability, secret, misconfiguration, compliance
	Type FindingType `json:"type"`

	// Short title (required)
	Title string `json:"title"`

	// Detailed description
	Description string `json:"description,omitempty"`

	// Primary message to display (the main human-readable finding message)
	// This is distinct from Title (short) and Description (detailed)
	// If not set, Title will be used as the message
	Message string `json:"message,omitempty"`

	// Severity (required): critical, high, medium, low, info
	Severity Severity `json:"severity"`

	// Confidence score 0-100
	Confidence int `json:"confidence,omitempty"`

	// Impact level: critical, high, medium, low (for risk assessment)
	Impact string `json:"impact,omitempty"`

	// Likelihood level: high, medium, low (for risk assessment)
	Likelihood string `json:"likelihood,omitempty"`

	// Finding category/class
	Category string `json:"category,omitempty"`

	// Vulnerability class(es): SQL Injection, XSS, Command Injection, etc.
	VulnerabilityClass []string `json:"vulnerability_class,omitempty"`

	// Subcategory: audit, vuln, secure default, etc.
	Subcategory []string `json:"subcategory,omitempty"`

	// Rule/check ID that detected this finding
	RuleID string `json:"rule_id,omitempty"`

	// Rule name
	RuleName string `json:"rule_name,omitempty"`

	// Reference to asset ID within this report
	AssetRef string `json:"asset_ref,omitempty"`

	// Direct asset value (if not using AssetRef)
	AssetValue string `json:"asset_value,omitempty"`

	// Asset type (if using AssetValue)
	AssetType AssetType `json:"asset_type,omitempty"`

	// Location information (for code-based findings)
	Location *FindingLocation `json:"location,omitempty"`

	// Network location (for network/host findings, e.g. Nessus/Tenable): the
	// port/protocol/service the finding was observed on. Distinct from the
	// code-centric Location above.
	Network *NetworkLocation `json:"network,omitempty"`

	// Evidence is the scanner's raw proof/output for this finding (e.g. a Nessus
	// plugin_output, a probe response). Free text; redact secrets before display.
	Evidence string `json:"evidence,omitempty"`

	// Vulnerability-specific details
	Vulnerability *VulnerabilityDetails `json:"vulnerability,omitempty"`

	// Secret-specific details
	Secret *SecretDetails `json:"secret,omitempty"`

	// Misconfiguration-specific details
	Misconfiguration *MisconfigurationDetails `json:"misconfiguration,omitempty"`

	// Compliance-specific details
	Compliance *ComplianceDetails `json:"compliance,omitempty"`

	// Web3-specific details (smart contract vulnerabilities)
	Web3 *Web3VulnerabilityDetails `json:"web3,omitempty"`

	// Remediation guidance
	Remediation *Remediation `json:"remediation,omitempty"`

	// References (URLs)
	References []string `json:"references,omitempty"`

	// Tags
	Tags []string `json:"tags,omitempty"`

	// Fingerprint for deduplication
	Fingerprint string `json:"fingerprint,omitempty"`

	// Partial fingerprints - contributing identity components (SARIF partialFingerprints)
	PartialFingerprints map[string]string `json:"partial_fingerprints,omitempty"`

	// Correlation ID - groups logically identical results across runs (SARIF correlationGuid)
	CorrelationID string `json:"correlation_id,omitempty"`

	// Baseline state - status relative to previous scan (SARIF baselineState)
	// Values: new, unchanged, updated, absent
	BaselineState string `json:"baseline_state,omitempty"`

	// Kind - evaluation state of the finding (SARIF kind)
	// Values: not_applicable, pass, fail, review, open, informational
	Kind string `json:"kind,omitempty"`

	// Rank - priority/importance score 0-100 (SARIF rank)
	Rank float64 `json:"rank,omitempty"`

	// Occurrence count - number of times this result was observed (SARIF occurrenceCount)
	OccurrenceCount int `json:"occurrence_count,omitempty"`

	// Related locations - additional locations related to this finding (SARIF relatedLocations)
	RelatedLocations []*FindingLocation `json:"related_locations,omitempty"`

	// Stacks - call stacks relevant to the finding (SARIF stacks)
	Stacks []*StackTrace `json:"stacks,omitempty"`

	// Attachments - relevant artifacts or evidence (SARIF attachments)
	Attachments []*Attachment `json:"attachments,omitempty"`

	// Work item URIs - URIs of associated issues/tickets (SARIF workItemUris)
	WorkItemURIs []string `json:"work_item_uris,omitempty"`

	// Hosted viewer URI - URI to view in hosted viewer (SARIF hostedViewerUri)
	HostedViewerURI string `json:"hosted_viewer_uri,omitempty"`

	// First seen timestamp
	FirstSeenAt *time.Time `json:"first_seen_at,omitempty"`

	// Last seen timestamp
	LastSeenAt *time.Time `json:"last_seen_at,omitempty"`

	// Finding status: open, resolved, false_positive, accepted_risk, in_progress
	Status FindingStatus `json:"status,omitempty"`

	// Data flow trace for taint analysis (source -> intermediate -> sink)
	DataFlow *DataFlow `json:"data_flow,omitempty"`

	// Git author who introduced the finding
	Author string `json:"author,omitempty"`

	// Author email
	AuthorEmail string `json:"author_email,omitempty"`

	// Commit date when the finding was introduced
	CommitDate *time.Time `json:"commit_date,omitempty"`

	// Suppression information (if finding is suppressed)
	Suppression *Suppression `json:"suppression,omitempty"`

	// CTEM: Exposure information
	Exposure *FindingExposure `json:"exposure,omitempty"`

	// CTEM: Remediation context
	RemediationContext *RemediationContext `json:"remediation_context,omitempty"`

	// CTEM: Business impact assessment
	BusinessImpact *BusinessImpact `json:"business_impact,omitempty"`

	// The finding as the source tool names it: native id, severity, status,
	// detection type, credentialed flag, raw record reference.
	Native *NativeIdentity `json:"native,omitempty"`

	// Every score of the finding with its source and date (CVSS v3.1 and
	// v4.0 together, vendor scores, EPSS, SSVC). The vulnerability.cvss_*
	// members stay the primary CVSS score.
	Scores []Score `json:"scores,omitempty"`

	// Exploitability statement (VEX) about this finding's vulnerability.
	VEX *VEX `json:"vex,omitempty"`

	// The finding's history as the source tracks it.
	SourceLifecycle *SourceLifecycle `json:"source_lifecycle,omitempty"`

	// Source fields no CTIS member holds, as strings, so an importer drops
	// nothing silently. Bounded: at most 64 entries, keys of 128 and values
	// of 4096 bytes, 32 KiB in all. Use SetSourceExtra to stay within it.
	SourceExtra map[string]string `json:"source_extra,omitempty"`

	// MITRE ATT&CK techniques the finding enables an adversary to use
	// ("T1190"), at most 20 (1.5). A producer hint; receivers validate the
	// id format and never trust it for prioritization alone.
	Attack []string `json:"attack,omitempty"`

	// Web is where on a web origin the finding was observed: the redacted
	// URL, the method and the parameter (1.6).
	Web *WebLocation `json:"web,omitempty"`

	// EvidenceItems are typed evidence of the finding (1.6, at most 20):
	// HTTP exchanges, raw text, command output, file excerpts, screenshots.
	// They MAY carry sensitive values only inside spans marked in their
	// sensitive list; receivers mask those before display or forwarding.
	EvidenceItems []EvidenceItem `json:"evidence_items,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type FindingExposure struct {
	// Exposure vector: network, local, physical, adjacent_net
	Vector string `json:"vector,omitempty"`

	// Is the finding reachable from the network
	IsNetworkAccessible bool `json:"is_network_accessible,omitempty"`

	// Is the finding directly reachable from the internet
	IsInternetAccessible bool `json:"is_internet_accessible,omitempty"`

	// Prerequisites for exploitation: auth_required, mfa_required, local_access, etc.
	AttackPrerequisites string `json:"attack_prerequisites,omitempty"`
}

type FindingLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Start line number (1-indexed)
	StartLine int `json:"start_line,omitempty"`

	// End line number
	EndLine int `json:"end_line,omitempty"`

	// Start column
	StartColumn int `json:"start_column,omitempty"`

	// End column
	EndColumn int `json:"end_column,omitempty"`

	// Code snippet
	Snippet string `json:"snippet,omitempty"`

	// Branch name (for repository findings)
	Branch string `json:"branch,omitempty"`

	// Commit SHA
	CommitSHA string `json:"commit_sha,omitempty"`

	// Logical location (function, class, method name)
	LogicalLocation *LogicalLocation `json:"logical_location,omitempty"`

	// Context region (surrounding code for better understanding)
	ContextSnippet string `json:"context_snippet,omitempty"`

	// Context start line (for context_snippet)
	ContextStartLine int `json:"context_start_line,omitempty"`
}

type FindingStatus string

type FindingType string

type FixRegex struct {
	// Regular expression pattern to match
	Regex string `json:"regex,omitempty"`

	// Replacement string (may contain capture group references like $1, $2)
	Replacement string `json:"replacement,omitempty"`

	// Number of replacements to make (0 = all)
	Count int `json:"count,omitempty"`
}

type FlashLoanIssue struct {
	// Flash loan provider: aave, dydx, uniswap, balancer
	Provider string `json:"provider,omitempty"`

	// Attack type: price_manipulation, governance_attack, collateral_theft
	AttackType string `json:"attack_type,omitempty"`

	// Required capital for attack
	RequiredCapitalUSD float64 `json:"required_capital_usd,omitempty"`

	// Potential profit
	PotentialProfitUSD float64 `json:"potential_profit_usd,omitempty"`

	// Attack steps
	AttackSteps []string `json:"attack_steps,omitempty"`
}

type GasIssue struct {
	// Current gas cost
	CurrentGas int64 `json:"current_gas,omitempty"`

	// Optimized gas cost
	OptimizedGas int64 `json:"optimized_gas,omitempty"`

	// Gas savings percentage
	SavingsPercent float64 `json:"savings_percent,omitempty"`

	// Optimization suggestion
	Suggestion string `json:"suggestion,omitempty"`
}

type Geolocation struct {
	Latitude  float64 `json:"latitude"`
	Longitude float64 `json:"longitude"`
	Accuracy  float64 `json:"accuracy,omitempty"` // in meters
}

type IPAddressTechnical struct {
	// IP version: 4 or 6
	Version int `json:"version,omitempty"`

	// Hostname (if resolved)
	Hostname string `json:"hostname,omitempty"`

	// ASN information
	ASN int `json:"asn,omitempty"`

	// ASN organization
	ASNOrg string `json:"asn_org,omitempty"`

	// Country code
	Country string `json:"country,omitempty"`

	// City
	City string `json:"city,omitempty"`

	// Open ports
	Ports []PortInfo `json:"ports,omitempty"`

	// Geolocation
	Geolocation *Geolocation `json:"geolocation,omitempty"`
}

type IdentityHints struct {
	// Fully qualified DNS name the scanner resolved.
	FQDN string `json:"fqdn,omitempty"`

	// NetBIOS name.
	NetBIOSName string `json:"netbios_name,omitempty"`

	// MAC addresses observed.
	MACAddresses []string `json:"mac_addresses,omitempty"`

	// CPE of the detected operating system (cpe:/o:... or cpe:2.3:o:...).
	OSCPE string `json:"os_cpe,omitempty"`

	// Cloud resource id the scanner reported (instance id, ARN).
	CloudResourceID string `json:"cloud_resource_id,omitempty"`

	// Id of the scanner's own agent installed on the host (a Nessus or
	// Qualys agent UUID). Unique per scanner, not across scanners. The Go
	// name says whose agent it is, so it is not read as a receiver's own
	// endpoint software.
	ScannerAgentID string `json:"agent_id,omitempty"`
}

type LiveHostInput struct {
	URL           string
	Host          string
	IP            string
	Port          int
	Scheme        string
	StatusCode    int
	ContentLength int64
	Title         string
	WebServer     string
	ContentType   string
	Technologies  []string
	CDN           string
	TLSVersion    string
	Redirect      string
	ResponseTime  int64

	// CDNType is what CDN names: "cdn", "waf" or "cloud" (httpx cdn_type).
	CDNType string
	// TLS is the leaf certificate seen in the TLS handshake (httpx
	// -tls-grab); nil when the probe did not grab one.
	TLS *TLSLeafInput
	// FaviconMMH3 is the mmh3 hash of the favicon (httpx -favicon), as
	// Shodan prints it: a signed 32-bit decimal.
	FaviconMMH3 string
	// JARM is the JARM TLS server fingerprint (62 hex characters).
	JARM string
	// ASN is the autonomous system of the host's address (httpx -asn).
	ASN *ASNInput
}

type LogicalLocation struct {
	// Fully qualified name (e.g., "pkg.MyClass.myMethod")
	FullyQualifiedName string `json:"fully_qualified_name,omitempty"`

	// Function/method name
	Name string `json:"name,omitempty"`

	// Kind: function, method, class, module, namespace
	Kind string `json:"kind,omitempty"`

	// Parent logical location index (for nested locations)
	ParentIndex int `json:"parent_index,omitempty"`
}

type MisconfigurationDetails struct {
	// Policy/check ID
	PolicyID string `json:"policy_id,omitempty"`

	// Policy name
	PolicyName string `json:"policy_name,omitempty"`

	// Aqua Vulnerability Database ID (e.g., AVD-AWS-0001)
	AVDID string `json:"avd_id,omitempty"`

	// Resource type
	ResourceType string `json:"resource_type,omitempty"`

	// Resource name
	ResourceName string `json:"resource_name,omitempty"`

	// Cloud provider (e.g., AWS, GCP, Azure)
	Provider string `json:"provider,omitempty"`

	// Service (e.g., S3, EC2, IAM)
	Service string `json:"service,omitempty"`

	// Namespace (e.g., builtin.aws.s3)
	Namespace string `json:"namespace,omitempty"`

	// Rego query path
	Query string `json:"query,omitempty"`

	// Expected value
	Expected string `json:"expected,omitempty"`

	// Actual value
	Actual string `json:"actual,omitempty"`

	// Cause description
	Cause string `json:"cause,omitempty"`
}

type NFTCollectionDetails struct {
	// Collection name
	Name string `json:"name,omitempty"`

	// Collection symbol
	Symbol string `json:"symbol,omitempty"`

	// Token standard: erc721, erc1155
	Standard string `json:"standard,omitempty"`

	// Total supply
	TotalSupply int64 `json:"total_supply,omitempty"`

	// Max supply
	MaxSupply int64 `json:"max_supply,omitempty"`

	// Unique holders
	HolderCount int64 `json:"holder_count,omitempty"`

	// Floor price (in native token)
	FloorPrice string `json:"floor_price,omitempty"`

	// Floor price USD
	FloorPriceUSD float64 `json:"floor_price_usd,omitempty"`

	// Total volume (in native token)
	TotalVolume string `json:"total_volume,omitempty"`

	// Total volume USD
	TotalVolumeUSD float64 `json:"total_volume_usd,omitempty"`

	// Royalty percentage
	RoyaltyPercent float64 `json:"royalty_percent,omitempty"`

	// Royalty recipient
	RoyaltyRecipient string `json:"royalty_recipient,omitempty"`

	// Marketplace URLs
	Marketplaces []string `json:"marketplaces,omitempty"`

	// Is revealed
	Revealed bool `json:"revealed,omitempty"`

	// Base URI
	BaseURI string `json:"base_uri,omitempty"`

	// Metadata storage: ipfs, arweave, centralized
	MetadataStorage string `json:"metadata_storage,omitempty"`

	// Creator address
	Creator string `json:"creator,omitempty"`
}

type NativeIdentity struct {
	// Vocabulary of the native values below. Selects the mapping tables of
	// NormalizeNativeSeverity, NormalizeNativeStatus and
	// NormalizeDetectionType.
	Scheme NativeScheme `json:"scheme,omitempty"`

	// The tool's id of the vulnerability or check: a Nessus plugin ID, a
	// Qualys QID, a DefectDojo vuln_id_from_tool, a SARIF rule id.
	VulnID string `json:"vuln_id,omitempty"`

	// The tool's id of this occurrence (DefectDojo unique_id_from_tool, a
	// Tenable or Qualys detection id), when it has one.
	InstanceID string `json:"instance_id,omitempty"`

	// The tool's family or category of the check (Nessus plugin family,
	// Qualys vulnerability category).
	Family string `json:"family,omitempty"`

	// The tool's severity exactly as reported ("4", "5", "High", "error").
	// finding.severity holds the normalized level.
	Severity string `json:"severity,omitempty"`

	// The tool's status exactly as reported ("Re-Opened", "fixed",
	// "risk_accepted"). finding.status and source_lifecycle.state hold the
	// normalized values.
	Status string `json:"status,omitempty"`

	// Whether the tool confirmed the issue or only suspects it.
	DetectionType DetectionType `json:"detection_type,omitempty"`

	// Whether the scan that found it was authenticated on the target. Absent
	// means unknown; false means the scan ran without credentials.
	Credentialed *bool `json:"credentialed,omitempty"`

	// Where the raw record can be found again: a URL into the source, or a
	// locator inside the imported file. Informational; receivers never fetch
	// it.
	RawRef string `json:"raw_ref,omitempty"`
}

type NativeScheme string

type NetworkLocation struct {
	// Host the finding was observed on (IP or hostname). Optional when the
	// finding already references its host asset via AssetRef/AssetValue.
	Host string `json:"host,omitempty"`

	// Port number (0 = not port-specific / general host finding).
	Port int `json:"port,omitempty"`

	// Transport protocol: tcp, udp.
	Protocol string `json:"protocol,omitempty"`

	// Service / application protocol on the port: https, ssh, smb, mysql, etc.
	Service string `json:"service,omitempty"`
}

type OpenPortInput struct {
	Host     string
	IP       string
	Port     int
	Protocol string
	Service  string
	Version  string
	Banner   string
}

type OracleManipulationIssue struct {
	// Oracle type: chainlink, uniswap_twap, custom
	OracleType string `json:"oracle_type,omitempty"`

	// Oracle address
	OracleAddress string `json:"oracle_address,omitempty"`

	// Manipulation method: flash_loan, sandwich, time_manipulation
	ManipulationMethod string `json:"manipulation_method,omitempty"`

	// Price impact possible
	PriceImpactPercent float64 `json:"price_impact_percent,omitempty"`

	// Missing checks
	MissingChecks []string `json:"missing_checks,omitempty"`
}

type ParamLocation string

type PortInfo struct {
	Port     int    `json:"port"`
	Protocol string `json:"protocol,omitempty"` // tcp, udp
	State    string `json:"state,omitempty"`    // open, filtered, closed
	Service  string `json:"service,omitempty"`  // http, ssh, etc.
	Banner   string `json:"banner,omitempty"`
	Version  string `json:"version,omitempty"`
}

type Properties map[string]any

type ReconConverterOptions struct {
	// Source tracking
	DiscoverySource string // "agent", "integration", "manual"
	DiscoveryTool   string // Scanner name

	// Default values. DefaultCriticality is business context that a scanner
	// does not know (spec section 4.1); leave it empty unless the caller
	// really has it.
	DefaultCriticality Criticality
	DefaultConfidence  int // 0-100

	// Asset grouping
	GroupByDomain bool // Group subdomains under root domain asset
	GroupByIP     bool // Group ports under IP asset

	// Filtering
	MinConfidence int // Minimum confidence to include
}

type ReconToCTISInput struct {
	// Scanner info
	ScannerName    string
	ScannerVersion string
	ReconType      string // subdomain, dns, port, http_probe, url_crawl

	// Target
	Target string

	// Timing
	StartedAt  int64
	FinishedAt int64
	DurationMs int64

	// Results
	Subdomains   []SubdomainInput
	DNSRecords   []DNSRecordInput
	OpenPorts    []OpenPortInput
	LiveHosts    []LiveHostInput
	URLs         []DiscoveredURLInput
	Technologies []TechnologyInput
}

type ReentrancyIssue struct {
	// Reentrancy type: cross_function, cross_contract, read_only
	Type string `json:"type,omitempty"`

	// Vulnerable external call
	ExternalCall string `json:"external_call,omitempty"`

	// State variable modified after call
	StateModifiedAfterCall string `json:"state_modified_after_call,omitempty"`

	// Entry point function
	EntryPoint string `json:"entry_point,omitempty"`

	// Callback function
	Callback string `json:"callback,omitempty"`

	// Max reentrancy depth possible
	MaxDepth int `json:"max_depth,omitempty"`
}

type Relationship struct {
	Type    RelationshipType `json:"type"`
	FromRef string           `json:"from_ref"`
	ToRef   string           `json:"to_ref"`
}

type RelationshipType string

type Remediation struct {
	// Short recommendation
	Recommendation string `json:"recommendation,omitempty"`

	// Detailed fix steps
	Steps []string `json:"steps,omitempty"`

	// Effort estimate: trivial, low, medium, high
	Effort string `json:"effort,omitempty"`

	// Fix available
	FixAvailable bool `json:"fix_available,omitempty"`

	// Auto-fixable
	AutoFixable bool `json:"auto_fixable,omitempty"`

	// Suggested fix code - the actual code to replace the vulnerable code
	// For SAST tools like Semgrep that provide auto-fix suggestions
	FixCode string `json:"fix_code,omitempty"`

	// Regex-based fix pattern (for tools that provide regex replacements)
	FixRegex *FixRegex `json:"fix_regex,omitempty"`

	// Reference URLs
	References []string `json:"references,omitempty"`

	// Kind of fix: patch, upgrade, config, workaround, mitigation, no_fix.
	SolutionType SolutionType `json:"solution_type,omitempty"`

	// When the vendor published the patch.
	PatchPublishedAt *time.Time `json:"patch_published_at,omitempty"`

	// Vendor advisories that address the finding.
	Advisories []Advisory `json:"advisories,omitempty"`
}

type RemediationContext struct {
	// Remediation type: patch, upgrade, workaround, config_change, mitigate, accept_risk
	Type string `json:"type,omitempty"`

	// Estimated time to fix in minutes
	EstimatedMinutes int `json:"estimated_minutes,omitempty"`

	// Fix complexity: simple, moderate, complex
	Complexity string `json:"complexity,omitempty"`

	// Is a remedy (patch/fix) available
	RemedyAvailable bool `json:"remedy_available,omitempty"`
}

type Report struct {
	// Schema version (required)
	Version string `json:"version"`

	// Schema URL for validation (optional)
	Schema string `json:"$schema,omitempty"`

	// Report metadata
	Metadata ReportMetadata `json:"metadata"`

	// Tool information (for collector/scanner reports)
	Tool *Tool `json:"tool,omitempty"`

	// Assets discovered/collected
	Assets []Asset `json:"assets,omitempty"`

	// Findings discovered
	Findings []Finding `json:"findings,omitempty"`

	// Dependencies (SBOM)
	Dependencies []Dependency `json:"dependencies,omitempty"`

	// Typed relationships between assets of this report (1.5). Optional:
	// a receiver may also derive relationships from technical members.
	Relationships []Relationship `json:"relationships,omitempty"`

	// Endpoints are the methods and paths web origins serve, as a tool
	// saw them (1.6). Names of parameters only, never values.
	Endpoints []Endpoint `json:"endpoints,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type ReportMetadata struct {
	// Unique identifier for this report/scan (recommended)
	ID string `json:"id,omitempty"`

	// Timestamp when the report was generated (required)
	Timestamp time.Time `json:"timestamp"`

	// Duration of the scan/collection in milliseconds (optional)
	DurationMs int `json:"duration_ms,omitempty"`

	// Source type: scanner, collector, integration, manual
	SourceType string `json:"source_type,omitempty"`

	// External reference (job ID, scan ID)
	SourceRef string `json:"source_ref,omitempty"`

	// Coverage type: full, incremental, partial
	// - full: Complete scan of entire scope (enables auto-resolve)
	// - incremental: Diff scan of changed files only (no auto-resolve)
	// - partial: Partial scan of specific directories (no auto-resolve)
	CoverageType string `json:"coverage_type,omitempty"`

	// Branch information for git-based scans
	// Used for branch-aware finding lifecycle management
	Branch *BranchInfo `json:"branch,omitempty"`

	// Target scope of the scan/collection
	Scope *Scope `json:"scope,omitempty"`

	// The capability this report answers, "scan.ports@1" (1.5). A
	// producer claim: a receiver that bound the report to a command uses
	// the command's capability and treats this as a hint.
	Capability string `json:"capability,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type RepositoryTechnical struct {
	// SCM platform: github, gitlab, bitbucket
	Platform string `json:"platform,omitempty"`

	// Organization/owner
	Owner string `json:"owner,omitempty"`

	// Repository name
	Name string `json:"name,omitempty"`

	// Default branch
	DefaultBranch string `json:"default_branch,omitempty"`

	// Repository visibility: public, private, internal
	Visibility string `json:"visibility,omitempty"`

	// Repository URL
	URL string `json:"url,omitempty"`

	// Clone URL
	CloneURL string `json:"clone_url,omitempty"`

	// Language breakdown
	Languages map[string]int `json:"languages,omitempty"`

	// Stars count
	Stars int `json:"stars,omitempty"`

	// Forks count
	Forks int `json:"forks,omitempty"`

	// Last commit SHA
	LastCommitSHA string `json:"last_commit_sha,omitempty"`

	// Last commit date
	LastCommitAt *time.Time `json:"last_commit_at,omitempty"`
}

type SARIFArtifact struct {
	Location SARIFArtifactLocation `json:"location"`
}

type SARIFArtifactLocation struct {
	URI       string `json:"uri"`
	URIBaseId string `json:"uriBaseId,omitempty"`
}

type SARIFContent struct {
	Text   string `json:"text,omitempty"`
	Binary string `json:"binary,omitempty"`
}

type SARIFDriver struct {
	Name            string      `json:"name"`
	Version         string      `json:"version,omitempty"`
	SemanticVersion string      `json:"semanticVersion,omitempty"`
	InformationURI  string      `json:"informationUri,omitempty"`
	Rules           []SARIFRule `json:"rules,omitempty"`
}

type SARIFInvocation struct {
	ExecutionSuccessful bool   `json:"executionSuccessful"`
	CommandLine         string `json:"commandLine,omitempty"`
}

type SARIFLocation struct {
	PhysicalLocation *SARIFPhysicalLocation `json:"physicalLocation,omitempty"`
	LogicalLocations []SARIFLogicalLocation `json:"logicalLocations,omitempty"`
}

type SARIFLog struct {
	Version string     `json:"version"`
	Schema  string     `json:"$schema,omitempty"`
	Runs    []SARIFRun `json:"runs"`
}

type SARIFLogicalLocation struct {
	Name               string `json:"name,omitempty"`
	FullyQualifiedName string `json:"fullyQualifiedName,omitempty"`
	Kind               string `json:"kind,omitempty"`
}

type SARIFMessage struct {
	Text string `json:"text"`
}

type SARIFPhysicalLocation struct {
	ArtifactLocation *SARIFArtifactLocation `json:"artifactLocation,omitempty"`
	Region           *SARIFRegion           `json:"region,omitempty"`
}

type SARIFRegion struct {
	StartLine   int           `json:"startLine,omitempty"`
	EndLine     int           `json:"endLine,omitempty"`
	StartColumn int           `json:"startColumn,omitempty"`
	EndColumn   int           `json:"endColumn,omitempty"`
	Snippet     *SARIFSnippet `json:"snippet,omitempty"`
}

type SARIFReportingReference struct {
	ID    string `json:"id,omitempty"`
	Index *int   `json:"index,omitempty"`
}

type SARIFResult struct {
	RuleID string `json:"ruleId,omitempty"`
	// RuleIndex is the index of the rule in tool.driver.rules. Nil when the
	// result does not carry one (SARIF's default is -1, "absent").
	RuleIndex           *int                     `json:"ruleIndex,omitempty"`
	Rule                *SARIFReportingReference `json:"rule,omitempty"`
	Level               string                   `json:"level,omitempty"`
	Message             SARIFMessage             `json:"message"`
	Locations           []SARIFLocation          `json:"locations,omitempty"`
	Fingerprints        map[string]string        `json:"fingerprints,omitempty"`
	PartialFingerprints map[string]string        `json:"partialFingerprints,omitempty"`
	CorrelationGUID     string                   `json:"correlationGuid,omitempty"`
	BaselineState       string                   `json:"baselineState,omitempty"`
	// Kind is the evaluation state of the result: notApplicable, pass, fail,
	// review, open or informational (SARIF 2.1.0 section 3.27.9).
	Kind string `json:"kind,omitempty"`
	// Suppressions are the result's suppressions (SARIF 2.1.0 section
	// 3.27.23), e.g. a nosemgrep comment or a CodeQL alert suppression.
	Suppressions []SARIFSuppression `json:"suppressions,omitempty"`
	Properties   map[string]any     `json:"properties,omitempty"`
	// WebRequest and WebResponse are the HTTP exchange of a web result
	// (SARIF 2.1.0 sections 3.46 and 3.47).
	WebRequest  *SARIFWebRequest  `json:"webRequest,omitempty"`
	WebResponse *SARIFWebResponse `json:"webResponse,omitempty"`
}

type SARIFRule struct {
	ID                   string           `json:"id"`
	Name                 string           `json:"name,omitempty"`
	ShortDescription     *SARIFMessage    `json:"shortDescription,omitempty"`
	FullDescription      *SARIFMessage    `json:"fullDescription,omitempty"`
	HelpURI              string           `json:"helpUri,omitempty"`
	Help                 *SARIFMessage    `json:"help,omitempty"`
	DefaultConfiguration *SARIFRuleConfig `json:"defaultConfiguration,omitempty"`
	Properties           map[string]any   `json:"properties,omitempty"`
}

type SARIFRuleConfig struct {
	Level string `json:"level,omitempty"`
}

type SARIFRun struct {
	Tool        SARIFTool         `json:"tool"`
	Results     []SARIFResult     `json:"results"`
	Artifacts   []SARIFArtifact   `json:"artifacts,omitempty"`
	Invocations []SARIFInvocation `json:"invocations,omitempty"`
}

type SARIFSnippet struct {
	Text string `json:"text"`
}

type SARIFSuppression struct {
	// Kind is inSource or external.
	Kind string `json:"kind,omitempty"`
	// Status is accepted (the default when absent), underReview or rejected.
	Status        string `json:"status,omitempty"`
	Justification string `json:"justification,omitempty"`
}

type SARIFTool struct {
	Driver SARIFDriver `json:"driver"`
}

type SARIFWebRequest struct {
	Protocol string            `json:"protocol,omitempty"`
	Version  string            `json:"version,omitempty"`
	Target   string            `json:"target,omitempty"`
	Method   string            `json:"method,omitempty"`
	Headers  map[string]string `json:"headers,omitempty"`
	Body     *SARIFContent     `json:"body,omitempty"`
}

type SARIFWebResponse struct {
	Protocol           string            `json:"protocol,omitempty"`
	Version            string            `json:"version,omitempty"`
	StatusCode         int               `json:"statusCode,omitempty"`
	ReasonPhrase       string            `json:"reasonPhrase,omitempty"`
	Headers            map[string]string `json:"headers,omitempty"`
	Body               *SARIFContent     `json:"body,omitempty"`
	NoResponseReceived bool              `json:"noResponseReceived,omitempty"`
}

type Scope struct {
	// Scope name or identifier
	Name string `json:"name,omitempty"`

	// Scope type: domain, network, repository, cloud_account
	Type string `json:"type,omitempty"`

	// Included targets
	Includes []string `json:"includes,omitempty"`

	// Excluded targets
	Excludes []string `json:"excludes,omitempty"`
}

type Score struct {
	// Scoring system (required).
	System ScoreSystem `json:"system"`

	// System version: "2.0", "3.0", "3.1" or "4.0" for CVSS (required
	// there), the model version for EPSS, "2" for SSVC.
	Version string `json:"version,omitempty"`

	// Vector string ("CVSS:3.1/AV:N/...", an SSVC vector).
	Vector string `json:"vector,omitempty"`

	// Numeric value: 0-10 for cvss and vpr, 0-1 for epss and
	// epss_percentile (FIRST's fractions), absent for ssvc.
	Value *float64 `json:"value,omitempty"`

	// Qualitative rating as the source states it ("high", "Act").
	Label string `json:"label,omitempty"`

	// Who assigned it: nvd, ghsa, vendor, tenable, qualys, first, cisa, ...
	Source string `json:"source,omitempty"`

	// When the source assigned or last updated it.
	AsOf *time.Time `json:"as_of,omitempty"`
}

type ScoreSystem string

type SecretDetails struct {
	// Secret type: api_key, password, token, certificate, private_key, etc.
	SecretType string `json:"secret_type,omitempty"`

	// Service associated with the secret: aws, github, stripe, gcp, azure, etc.
	Service string `json:"service,omitempty"`

	// Masked value (first and last few chars)
	MaskedValue string `json:"masked_value,omitempty"`

	// Length of the secret
	Length int `json:"length,omitempty"`

	// Entropy score
	Entropy float64 `json:"entropy,omitempty"`

	// Is valid (if verification was performed)
	Valid *bool `json:"valid,omitempty"`

	// Verification timestamp
	VerifiedAt *time.Time `json:"verified_at,omitempty"`

	// Is revoked
	Revoked bool `json:"revoked,omitempty"`

	// When the secret was revoked
	RevokedAt *time.Time `json:"revoked_at,omitempty"`

	// Secret scope/permissions (e.g., "read:org", "repo", "admin")
	Scopes []string `json:"scopes,omitempty"`

	// Expiration date (if known)
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// Secret age (how long since creation, if known)
	AgeInDays int `json:"age_in_days,omitempty"`

	// Rotation recommended by date
	RotationDueAt *time.Time `json:"rotation_due_at,omitempty"`

	// Is the secret in git history only (not in current HEAD)
	InHistoryOnly bool `json:"in_history_only,omitempty"`

	// Commit count where this secret appears
	CommitCount int `json:"commit_count,omitempty"`
}

type SensitiveSpan struct {
	Pointer string `json:"pointer"`
	Start   *int   `json:"start,omitempty"`
	End     *int   `json:"end,omitempty"`
	Kind    string `json:"kind,omitempty"`
}

type ServiceInfo struct {
	// Port number
	Port int `json:"port"`

	// Transport protocol: tcp, udp
	Protocol string `json:"protocol,omitempty"`

	// Service type: http, https, ssh, ftp, mysql, postgresql, etc.
	ServiceType string `json:"service_type,omitempty"`

	// Product name: Apache, nginx, OpenSSH, etc.
	Product string `json:"product,omitempty"`

	// Product version
	Version string `json:"version,omitempty"`

	// Service banner
	Banner string `json:"banner,omitempty"`

	// Common Platform Enumeration identifier
	CPE string `json:"cpe,omitempty"`

	// Is this service publicly accessible from the internet
	IsPublic bool `json:"is_public,omitempty"`

	// TLS enabled
	TLSEnabled bool `json:"tls_enabled,omitempty"`

	// TLS version: TLS 1.2, TLS 1.3
	TLSVersion string `json:"tls_version,omitempty"`

	// Service state: active, inactive, filtered
	State string `json:"state,omitempty"`
}

type ServiceTechnical struct {
	// Service name
	Name string `json:"name,omitempty"`

	// Service version
	Version string `json:"version,omitempty"`

	// Port
	Port int `json:"port,omitempty"`

	// Protocol (application-layer): http, https, ssh, smtp, ftp, dns, ldap, smb, rdp, mysql, postgresql, mongodb, redis, etc.
	Protocol string `json:"protocol,omitempty"`

	// Transport: tcp, udp
	Transport string `json:"transport,omitempty"`

	// SSL/TLS enabled
	TLS bool `json:"tls,omitempty"`

	// TLS version: tls1.0, tls1.1, tls1.2, tls1.3
	TLSVersion string `json:"tls_version,omitempty"`

	// TLS certificate info (for services with TLS)
	TLSCertSubject string `json:"tls_cert_subject,omitempty"`
	TLSCertIssuer  string `json:"tls_cert_issuer,omitempty"`
	TLSCertExpiry  string `json:"tls_cert_expiry,omitempty"`

	// Banner/fingerprint
	Banner string `json:"banner,omitempty"`

	// Product name (e.g., "OpenSSH", "nginx", "Apache", "Postfix")
	Product string `json:"product,omitempty"`

	// CPE (Common Platform Enumeration) identifier
	CPE string `json:"cpe,omitempty"`

	// Extra info
	ExtraInfo string `json:"extra_info,omitempty"`

	// Service state: open, filtered, closed
	State string `json:"state,omitempty"`

	// Authentication required
	AuthRequired bool `json:"auth_required,omitempty"`

	// Authentication methods supported (e.g., ["password", "publickey"] for SSH)
	AuthMethods []string `json:"auth_methods,omitempty"`

	// Default credentials detected
	DefaultCredentials bool `json:"default_credentials,omitempty"`

	// Anonymous access allowed (for FTP, SMB, etc.)
	AnonymousAccess bool `json:"anonymous_access,omitempty"`

	// Response time in milliseconds
	ResponseTimeMs int `json:"response_time_ms,omitempty"`

	// Last seen timestamp
	LastSeen string `json:"last_seen,omitempty"`

	// Service-specific details (protocol-dependent)
	// For HTTP: methods, headers, etc.
	// For SMTP: EHLO response, supported extensions
	// For SSH: supported algorithms, host keys
	Details map[string]any `json:"details,omitempty"`
}

type Severity string

type SmartContractDetails struct {
	// Contract name
	Name string `json:"name,omitempty"`

	// Contract address
	Address string `json:"address,omitempty"`

	// Deployer address
	DeployerAddress string `json:"deployer_address,omitempty"`

	// Deployment transaction hash
	DeploymentTxHash string `json:"deployment_tx_hash,omitempty"`

	// Deployment block number
	DeploymentBlock int64 `json:"deployment_block,omitempty"`

	// Deployment timestamp
	DeployedAt *time.Time `json:"deployed_at,omitempty"`

	// Is verified on explorer (etherscan, etc.)
	Verified bool `json:"verified,omitempty"`

	// Compiler version
	CompilerVersion string `json:"compiler_version,omitempty"`

	// EVM version
	EVMVersion string `json:"evm_version,omitempty"`

	// Optimization enabled
	OptimizationEnabled bool `json:"optimization_enabled,omitempty"`

	// Optimization runs
	OptimizationRuns int `json:"optimization_runs,omitempty"`

	// Contract type: erc20, erc721, erc1155, proxy, multisig, defi, custom
	ContractType string `json:"contract_type,omitempty"`

	// Is proxy contract
	IsProxy bool `json:"is_proxy,omitempty"`

	// Implementation address (for proxy contracts)
	ImplementationAddress string `json:"implementation_address,omitempty"`

	// Proxy type: transparent, uups, beacon, diamond
	ProxyType string `json:"proxy_type,omitempty"`

	// Is upgradeable
	IsUpgradeable bool `json:"is_upgradeable,omitempty"`

	// Owner/admin address
	OwnerAddress string `json:"owner_address,omitempty"`

	// Has renounced ownership
	OwnershipRenounced bool `json:"ownership_renounced,omitempty"`

	// Source code URL (GitHub, etc.)
	SourceCodeURL string `json:"source_code_url,omitempty"`

	// ABI (JSON string or base64 encoded)
	ABI string `json:"abi,omitempty"`

	// Bytecode hash (keccak256)
	BytecodeHash string `json:"bytecode_hash,omitempty"`

	// Source code hash
	SourceCodeHash string `json:"source_code_hash,omitempty"`

	// License type: MIT, GPL, UNLICENSED, etc.
	License string `json:"license,omitempty"`

	// External libraries used
	Libraries []ContractLibrary `json:"libraries,omitempty"`

	// Implemented interfaces: ERC20, ERC721, etc.
	Interfaces []string `json:"interfaces,omitempty"`

	// Contract balance (in wei)
	Balance string `json:"balance,omitempty"`

	// Total transactions
	TxCount int64 `json:"tx_count,omitempty"`
}

type SolutionType string

type SourceLifecycle struct {
	// When the source first found it.
	FirstFound *time.Time `json:"first_found,omitempty"`

	// When the source last found it.
	LastFound *time.Time `json:"last_found,omitempty"`

	// When the source last saw it fixed.
	LastFixed *time.Time `json:"last_fixed,omitempty"`

	// How many times the source has found it.
	TimesFound int `json:"times_found,omitempty"`

	// The source state, normalized (native.status keeps the source's word).
	State SourceState `json:"state,omitempty"`
}

type SourceState string

type StackFrame struct {
	// Location of this frame
	Location *FindingLocation `json:"location,omitempty"`

	// Module/library name
	Module string `json:"module,omitempty"`

	// Thread ID
	ThreadID int `json:"thread_id,omitempty"`

	// Function parameters
	Parameters []string `json:"parameters,omitempty"`
}

type StackTrace struct {
	// Stack description/message
	Message string `json:"message,omitempty"`

	// Stack frames from innermost to outermost
	Frames []*StackFrame `json:"frames,omitempty"`
}

type SubdomainInput struct {
	Host   string
	Domain string
	Source string
	IPs    []string
}

type Suppression struct {
	// Suppression kind: in_source, external
	Kind string `json:"kind,omitempty"`

	// Suppression status: accepted, under_review, rejected
	Status string `json:"status,omitempty"`

	// Short reason code or phrase, e.g. "false_positive", "test_code",
	// "risk_accepted".
	Reason string `json:"reason,omitempty"`

	// Justification for suppression
	Justification string `json:"justification,omitempty"`

	// Who suppressed the finding
	SuppressedBy string `json:"suppressed_by,omitempty"`

	// When the finding was suppressed
	SuppressedAt *time.Time `json:"suppressed_at,omitempty"`

	// When the suppression stops applying. Empty means it does not expire.
	ExpiresAt *time.Time `json:"expires_at,omitempty"`
}

type TLSLeafInput struct {
	SubjectCN    string
	SANs         []string
	IssuerCN     string
	IssuerOrg    string
	SerialNumber string
	NotBefore    time.Time
	NotAfter     time.Time
	// FingerprintSHA256 is the SHA-256 of the DER certificate, hex, with or
	// without colons. It is the certificate's identity: a leaf without a
	// valid one is not converted.
	FingerprintSHA256 string
	SelfSigned        bool
	Expired           bool
	Wildcard          bool
	Mismatched        bool
}

type Technology struct {
	// Name of the product or framework ("nginx", "WordPress").
	Name string `json:"name"`

	// Version when the tool could tell.
	Version string `json:"version,omitempty"`

	// CPE 2.3 name when the tool could tell.
	CPE string `json:"cpe,omitempty"`

	// Categories the tool puts the technology in ("web-server", "cms").
	Categories []string `json:"categories,omitempty"`

	// How sure the tool is, 0-100.
	Confidence int `json:"confidence,omitempty"`
}

type TechnologyInput struct {
	Name       string
	Version    string
	Categories []string
	Confidence int
	Website    string
}

type TokenBalance struct {
	// Token contract address
	ContractAddress string `json:"contract_address"`

	// Token symbol
	Symbol string `json:"symbol,omitempty"`

	// Token name
	Name string `json:"name,omitempty"`

	// Token decimals
	Decimals int `json:"decimals,omitempty"`

	// Balance (raw value)
	Balance string `json:"balance"`

	// Balance formatted (human readable)
	BalanceFormatted string `json:"balance_formatted,omitempty"`

	// USD value
	USDValue float64 `json:"usd_value,omitempty"`
}

type TokenDetails struct {
	// Token standard: erc20, erc721, erc1155, bep20, spl
	Standard string `json:"standard,omitempty"`

	// Token symbol
	Symbol string `json:"symbol,omitempty"`

	// Token name
	Name string `json:"name,omitempty"`

	// Token decimals
	Decimals int `json:"decimals,omitempty"`

	// Total supply (raw value)
	TotalSupply string `json:"total_supply,omitempty"`

	// Max supply (if applicable)
	MaxSupply string `json:"max_supply,omitempty"`

	// Is mintable
	Mintable bool `json:"mintable,omitempty"`

	// Is burnable
	Burnable bool `json:"burnable,omitempty"`

	// Is pausable
	Pausable bool `json:"pausable,omitempty"`

	// Has blacklist/whitelist
	HasBlacklist bool `json:"has_blacklist,omitempty"`

	// Has transfer fee/tax
	HasTransferFee bool `json:"has_transfer_fee,omitempty"`

	// Transfer fee percentage
	TransferFeePercent float64 `json:"transfer_fee_percent,omitempty"`

	// Holder count
	HolderCount int64 `json:"holder_count,omitempty"`

	// Market cap USD
	MarketCapUSD float64 `json:"market_cap_usd,omitempty"`

	// Price USD
	PriceUSD float64 `json:"price_usd,omitempty"`

	// Liquidity USD
	LiquidityUSD float64 `json:"liquidity_usd,omitempty"`

	// Trading pairs
	TradingPairs []TradingPair `json:"trading_pairs,omitempty"`

	// Is honeypot
	IsHoneypot bool `json:"is_honeypot,omitempty"`

	// Honeypot reason
	HoneypotReason string `json:"honeypot_reason,omitempty"`
}

type Tool struct {
	// Tool name (required)
	Name string `json:"name"`

	// Tool version (recommended)
	Version string `json:"version,omitempty"`

	// Tool vendor/organization
	Vendor string `json:"vendor,omitempty"`

	// Tool information URL
	InfoURL string `json:"info_url,omitempty"`

	// Tool capabilities
	Capabilities []string `json:"capabilities,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type TradingPair struct {
	// DEX name: uniswap, sushiswap, pancakeswap, etc.
	DEX string `json:"dex"`

	// Pair address
	PairAddress string `json:"pair_address"`

	// Quote token symbol (WETH, USDT, etc.)
	QuoteToken string `json:"quote_token"`

	// Liquidity USD
	LiquidityUSD float64 `json:"liquidity_usd,omitempty"`
}

type VEX struct {
	// Status (required).
	Status VEXStatus `json:"status"`

	// Why the product is not affected. Only with status not_affected, which
	// needs a justification or a statement.
	Justification VEXJustification `json:"justification,omitempty"`

	// The justification as the source document states it (a CycloneDX
	// analysis.justification such as code_not_reachable).
	NativeJustification string `json:"native_justification,omitempty"`

	// Impact or action statement, plain text.
	Statement string `json:"statement,omitempty"`

	// Who made the statement: a document id or URL, a vendor, a team.
	Source string `json:"source,omitempty"`

	// When the statement was made.
	AsOf *time.Time `json:"as_of,omitempty"`
}

type VEXJustification string

type VEXStatus string

type VulnDataSource struct {
	// Data source ID (e.g., "nvd", "ghsa", "osv")
	ID string `json:"id,omitempty"`

	// Data source name
	Name string `json:"name,omitempty"`

	// Data source URL
	URL string `json:"url,omitempty"`
}

type VulnerabilityDetails struct {
	// CVE ID (primary, for single-CVE findings and backward compatibility)
	CVEID string `json:"cve_id,omitempty"`

	// CVE IDs (a finding may map to multiple CVEs — common for network
	// vulnerability scanners like Nessus/Tenable that group CVEs per plugin).
	CVEIDs []string `json:"cve_ids,omitempty"`

	// CWE IDs (can have multiple)
	CWEIDs []string `json:"cwe_ids,omitempty"`

	// CWE ID (single, for backward compatibility)
	CWEID string `json:"cwe_id,omitempty"`

	// OWASP IDs (e.g., "A01:2021", "A03:2021")
	OWASPIDs []string `json:"owasp_ids,omitempty"`

	// ASVS (Application Security Verification Standard) compliance info
	ASVS *ASVSInfo `json:"asvs,omitempty"`

	// CVSS version (2.0, 3.0, 3.1, 4.0)
	CVSSVersion string `json:"cvss_version,omitempty"`

	// CVSS score
	CVSSScore float64 `json:"cvss_score,omitempty"`

	// CVSS vector
	CVSSVector string `json:"cvss_vector,omitempty"`

	// CVSS data source: nvd, ghsa, redhat, bitnami
	CVSSSource string `json:"cvss_source,omitempty"`

	// Affected package
	Package string `json:"package,omitempty"`

	// Package URL (PURL spec) e.g., pkg:npm/lodash@4.17.20
	PURL string `json:"purl,omitempty"`

	// Affected version
	AffectedVersion string `json:"affected_version,omitempty"`

	// Affected version range (semver format)
	AffectedVersionRange string `json:"affected_version_range,omitempty"`

	// Fixed version
	FixedVersion string `json:"fixed_version,omitempty"`

	// All available fixed versions
	FixedVersions []string `json:"fixed_versions,omitempty"`

	// Ecosystem: npm, pip, maven, cargo, go, nuget, etc.
	Ecosystem string `json:"ecosystem,omitempty"`

	// Vulnerability published date
	PublishedAt *time.Time `json:"published_at,omitempty"`

	// Last modified date
	ModifiedAt *time.Time `json:"modified_at,omitempty"`

	// Exploit available
	ExploitAvailable bool `json:"exploit_available,omitempty"`

	// Exploit maturity: none, poc, functional, weaponized
	ExploitMaturity string `json:"exploit_maturity,omitempty"`

	// In CISA KEV (Known Exploited Vulnerabilities)
	InCISAKEV bool `json:"in_cisa_kev,omitempty"`

	// EPSS score (Exploit Prediction Scoring System)
	EPSSScore float64 `json:"epss_score,omitempty"`

	// EPSS percentile
	EPSSPercentile float64 `json:"epss_percentile,omitempty"`

	// VPR (Tenable Vulnerability Priority Rating), 0.0–10.0. Tenable's own
	// dynamic priority score, distinct from CVSS/EPSS; carried through so
	// prioritisation can use the source scanner's rating when present.
	VPRScore float64 `json:"vpr_score,omitempty"`

	// Affected CPE
	CPE string `json:"cpe,omitempty"`

	// Advisory URLs
	Advisories []string `json:"advisories,omitempty"`

	// Is direct dependency (vs transitive)
	IsDirect bool `json:"is_direct,omitempty"`

	// Dependency path for transitive vulnerabilities
	DependencyPath []string `json:"dependency_path,omitempty"`

	// Data source information (vulnerability database)
	DataSource *VulnDataSource `json:"data_source,omitempty"`

	// Severity source (who assigned the severity: nvd, ghsa, redhat, etc.)
	SeveritySource string `json:"severity_source,omitempty"`

	// Vendor-specific severity mapping (vendor -> severity level 1-5)
	VendorSeverity map[string]int `json:"vendor_severity,omitempty"`

	// Container layer information (for image scans)
	Layer *ContainerLayer `json:"layer,omitempty"`

	// Aqua Vulnerability Database ID (e.g., AVD-AWS-0001)
	AVDID string `json:"avd_id,omitempty"`

	// Vulnerability status: affected, fixed, under_investigation, will_not_fix
	VulnStatus string `json:"vuln_status,omitempty"`

	// Every id of the vulnerability with its namespace (CVE, GHSA, OSV,
	// vendor). cve_id and cve_ids stay as they are; producers that send
	// both keep them consistent.
	IDs []VulnerabilityID `json:"ids,omitempty"`
}

type VulnerabilityID struct {
	// Namespace (required).
	Type VulnerabilityIDType `json:"type"`

	// The identifier (required): CVE-2024-3094, GHSA-xxxx-xxxx-xxxx,
	// PYSEC-2021-1, RHSA-2024:1234.
	ID string `json:"id"`

	// Issuer of a vendor id (redhat, microsoft, ubuntu, ...).
	Source string `json:"source,omitempty"`
}

type VulnerabilityIDType string

type WalletDetails struct {
	// Wallet type: eoa, multisig, smart_wallet, mpc
	WalletType string `json:"wallet_type,omitempty"`

	// For multisig: required signatures
	RequiredSignatures int `json:"required_signatures,omitempty"`

	// For multisig: total owners
	TotalOwners int `json:"total_owners,omitempty"`

	// Owner addresses (for multisig)
	Owners []string `json:"owners,omitempty"`

	// Wallet provider: metamask, ledger, safe, argent, etc.
	Provider string `json:"provider,omitempty"`

	// Balance (native token, in wei)
	Balance string `json:"balance,omitempty"`

	// Token balances
	TokenBalances []TokenBalance `json:"token_balances,omitempty"`

	// NFT count
	NFTCount int `json:"nft_count,omitempty"`

	// First transaction timestamp
	FirstTxAt *time.Time `json:"first_tx_at,omitempty"`

	// Last transaction timestamp
	LastTxAt *time.Time `json:"last_tx_at,omitempty"`

	// Total transactions
	TxCount int64 `json:"tx_count,omitempty"`

	// ENS name (if applicable)
	ENSName string `json:"ens_name,omitempty"`

	// Labels (exchange, whale, hacker, etc.)
	Labels []string `json:"labels,omitempty"`
}

type Web3POC struct {
	// POC type: transaction, script, foundry_test, hardhat_test
	Type string `json:"type,omitempty"`

	// POC code or script
	Code string `json:"code,omitempty"`

	// POC transaction data
	TxData string `json:"tx_data,omitempty"`

	// Expected outcome
	ExpectedOutcome string `json:"expected_outcome,omitempty"`

	// Tested on: mainnet_fork, testnet, local
	TestedOn string `json:"tested_on,omitempty"`

	// Fork block number (for mainnet fork tests)
	ForkBlockNumber int64 `json:"fork_block_number,omitempty"`
}

type Web3Technical struct {
	// Blockchain network: ethereum, polygon, bsc, arbitrum, optimism, avalanche, solana, etc.
	Chain string `json:"chain,omitempty"`

	// Chain ID (EVM chains): 1 (mainnet), 137 (polygon), 56 (bsc), etc.
	ChainID int64 `json:"chain_id,omitempty"`

	// Network type: mainnet, testnet, devnet
	NetworkType string `json:"network_type,omitempty"`

	// Contract/wallet address
	Address string `json:"address,omitempty"`

	// For smart contracts
	Contract *SmartContractDetails `json:"contract,omitempty"`

	// For wallets
	Wallet *WalletDetails `json:"wallet,omitempty"`

	// For tokens (ERC-20, ERC-721, etc.)
	Token *TokenDetails `json:"token,omitempty"`

	// For DeFi protocols
	DeFi *DeFiDetails `json:"defi,omitempty"`

	// For NFT collections
	NFT *NFTCollectionDetails `json:"nft,omitempty"`
}

type Web3VulnerabilityClass string

type Web3VulnerabilityDetails struct {
	// Vulnerability class/category (SWC ID or custom)
	// Common: reentrancy, overflow, access_control, front_running, etc.
	VulnerabilityClass string `json:"vulnerability_class,omitempty"`

	// SWC Registry ID (e.g., SWC-107 for reentrancy)
	SWCID string `json:"swc_id,omitempty"`

	// Contract address affected
	ContractAddress string `json:"contract_address,omitempty"`

	// Chain ID
	ChainID int64 `json:"chain_id,omitempty"`

	// Chain name
	Chain string `json:"chain,omitempty"`

	// Affected function signature
	FunctionSignature string `json:"function_signature,omitempty"`

	// Affected function selector (4 bytes)
	FunctionSelector string `json:"function_selector,omitempty"`

	// Vulnerable code pattern
	VulnerablePattern string `json:"vulnerable_pattern,omitempty"`

	// Bytecode offset (if found in bytecode analysis)
	BytecodeOffset int `json:"bytecode_offset,omitempty"`

	// Is exploitable on mainnet
	ExploitableOnMainnet bool `json:"exploitable_on_mainnet,omitempty"`

	// Estimated impact in USD (if quantifiable)
	EstimatedImpactUSD float64 `json:"estimated_impact_usd,omitempty"`

	// Affected assets value in USD
	AffectedValueUSD float64 `json:"affected_value_usd,omitempty"`

	// Attack vector description
	AttackVector string `json:"attack_vector,omitempty"`

	// Proof of concept (if available)
	POC *Web3POC `json:"poc,omitempty"`

	// Related transaction hashes (if exploit occurred)
	RelatedTxHashes []string `json:"related_tx_hashes,omitempty"`

	// Attacker addresses (if known)
	AttackerAddresses []string `json:"attacker_addresses,omitempty"`

	// Tool that found this: slither, mythril, securify, manticore, etc.
	DetectionTool string `json:"detection_tool,omitempty"`

	// Detection confidence: high, medium, low
	DetectionConfidence string `json:"detection_confidence,omitempty"`

	// Is false positive
	IsFalsePositive bool `json:"is_false_positive,omitempty"`

	// Gas optimization issues (for gas-related findings)
	GasIssue *GasIssue `json:"gas_issue,omitempty"`

	// Access control details
	AccessControl *AccessControlIssue `json:"access_control,omitempty"`

	// Reentrancy details
	Reentrancy *ReentrancyIssue `json:"reentrancy,omitempty"`

	// Oracle manipulation details
	OracleManipulation *OracleManipulationIssue `json:"oracle_manipulation,omitempty"`

	// Flash loan attack details
	FlashLoan *FlashLoanIssue `json:"flash_loan,omitempty"`
}

type WebLocation struct {
	// URL is the redacted URL: no query values, user info or fragment.
	URL string `json:"url"`

	Method string `json:"method,omitempty"`

	// EndpointRef names an endpoint of this report.
	EndpointRef string `json:"endpoint_ref,omitempty"`

	// Parameter is the parameter the finding is about.
	Parameter *WebParameter `json:"parameter,omitempty"`

	// RequestRef names the evidence of the request ("sha256:<hex>" or an
	// attachment id).
	RequestRef string `json:"request_ref,omitempty"`

	StatusCode int `json:"status_code,omitempty"`
}

type WebParameter struct {
	Location ParamLocation `json:"location"`
	Name     string        `json:"name"`
}