core

type APIKeyHinter interface {
	APIKeyHint() string
}

type Adapter interface {
	// Name returns the adapter name (e.g., "sarif", "cyclonedx")
	Name() string

	// InputFormats returns supported input formats
	InputFormats() []string

	// OutputFormat returns the output format (usually "ctis")
	OutputFormat() string

	// CanConvert checks if the input can be converted
	CanConvert(input []byte) bool

	// Convert transforms input to CTIS Report
	Convert(ctx context.Context, input []byte, opts *AdapterOptions) (*ctis.Report, error)
}

type AdapterOptions struct {
	// Source information
	SourceName string `yaml:"source_name" json:"source_name"`
	SourceType string `yaml:"source_type" json:"source_type"`

	// Target repository/asset info
	Repository string `yaml:"repository" json:"repository"`
	Branch     string `yaml:"branch" json:"branch"`
	CommitSHA  string `yaml:"commit_sha" json:"commit_sha"`

	// Filtering
	MinSeverity string `yaml:"min_severity" json:"min_severity"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type AssetResolver func(scanner, target string) (ctis.AssetType, string)

type AuthGate struct {
	// contains filtered or unexported fields
}

type AuthGateConfig struct {
	// BackoffBase is the first re-check delay after a rejection.
	BackoffBase time.Duration
	// BackoffMax caps the re-check delay.
	BackoffMax time.Duration
	// Logger receives the state changes. Nil logs to stderr with timestamps.
	Logger *log.Logger
}

type BaseCollector struct {
	// contains filtered or unexported fields
}

type BaseCollectorConfig struct {
	Name       string            `yaml:"name" json:"name"`
	SourceType string            `yaml:"source_type" json:"source_type"`
	BaseURL    string            `yaml:"base_url" json:"base_url"`
	APIKey     string            `yaml:"api_key" json:"api_key"`
	Headers    map[string]string `yaml:"headers" json:"headers"`
	Timeout    time.Duration     `yaml:"timeout" json:"timeout"`
	Verbose    bool              `yaml:"verbose" json:"verbose"`
}

type BaseParser struct {
	// contains filtered or unexported fields
}

type BaseProcessor struct {
	// contains filtered or unexported fields
}

type BaseScanner struct {
	// contains filtered or unexported fields
}

type BaseScannerConfig struct {
	Name         string            `yaml:"name" json:"name"`
	Version      string            `yaml:"version" json:"version"`
	Binary       string            `yaml:"binary" json:"binary"`
	DefaultArgs  []string          `yaml:"default_args" json:"default_args"`
	Timeout      time.Duration     `yaml:"timeout" json:"timeout"`
	OKExitCodes  []int             `yaml:"ok_exit_codes" json:"ok_exit_codes"`
	Capabilities []string          `yaml:"capabilities" json:"capabilities"`
	WorkDir      string            `yaml:"work_dir" json:"work_dir"`
	Env          map[string]string `yaml:"env" json:"env"`
	Verbose      bool              `yaml:"verbose" json:"verbose"`
}

type BaseSensor struct {
	// contains filtered or unexported fields
}

type BaseSensorConfig struct {
	Name    string `yaml:"name" json:"name"`
	Version string `yaml:"version" json:"version"`
	// ProductName, Commit and BuildTime describe the sensor binary on every
	// heartbeat ("sensor"); all optional. ProductName defaults to the name
	// given to useragent.SetProduct, then to the executable's name;
	// BuildTime is RFC 3339.
	ProductName       string        `yaml:"product_name" json:"product_name"`
	Commit            string        `yaml:"commit" json:"commit"`
	BuildTime         string        `yaml:"build_time" json:"build_time"`
	Region            string        `yaml:"region" json:"region"` // Deployment region (e.g., "us-east-1", "ap-southeast-1")
	ScanInterval      time.Duration `yaml:"scan_interval" json:"scan_interval"`
	CollectInterval   time.Duration `yaml:"collect_interval" json:"collect_interval"`
	HeartbeatInterval time.Duration `yaml:"heartbeat_interval" json:"heartbeat_interval"`
	Targets           []string      `yaml:"targets" json:"targets"`
	Verbose           bool          `yaml:"verbose" json:"verbose"`
}

type CVSSData struct {
	Source CVSSSource `json:"source"`
	Score  float64    `json:"score"`
	Vector string     `json:"vector"`
}

type CVSSSource string

type CacheStats struct {
	TemplateCount int            `json:"template_count"`
	TotalSize     int64          `json:"total_size"`
	TenantCount   map[string]int `json:"tenant_count"`
	TypeCount     map[string]int `json:"type_count"`
	OldestEntry   time.Time      `json:"oldest_entry"`
	NewestEntry   time.Time      `json:"newest_entry"`
}

type CachedTemplateMetadata struct {
	ID           string    `json:"id"`
	Name         string    `json:"name"`
	TemplateType string    `json:"template_type"`
	ContentHash  string    `json:"content_hash"`
	TenantID     string    `json:"tenant_id"`
	FilePath     string    `json:"file_path"`
	Size         int64     `json:"size"`
	CachedAt     time.Time `json:"cached_at"`
	LastUsedAt   time.Time `json:"last_used_at"`
}

type CapabilityReport struct {
	// Tools is the tool inventory. nil reports nothing (the platform keeps
	// using its administrator's list); an empty, non-nil slice reports that
	// no tool is available.
	Tools []ToolInfo
	// Capabilities are the capability names the sensor serves ("validate",
	// a tool name, "sast"). nil reports nothing, as for Tools.
	Capabilities []string
	// MaxConcurrentJobs is how many jobs the sensor runs at once; 0 reports
	// nothing.
	MaxConcurrentJobs int
}

type CapabilityReporter interface {
	CapabilityReport(ctx context.Context) CapabilityReport
}

type CapabilityReporterFunc func(ctx context.Context) CapabilityReport

type CollectCommandPayload struct {
	Collector    string                 `json:"collector"`
	SourceConfig map[string]interface{} `json:"source_config,omitempty"`
}

type CollectOptions struct {
	// Source configuration
	SourceURL string            `yaml:"source_url" json:"source_url"`
	APIKey    string            `yaml:"api_key" json:"api_key"`
	Headers   map[string]string `yaml:"headers" json:"headers"`
	Query     map[string]string `yaml:"query" json:"query"`

	// Filtering
	Since      int64    `yaml:"since" json:"since"` // Unix timestamp
	Repository string   `yaml:"repository" json:"repository"`
	Branches   []string `yaml:"branches" json:"branches"`

	// Pagination
	PageSize int `yaml:"page_size" json:"page_size"`
	MaxPages int `yaml:"max_pages" json:"max_pages"`
}

type CollectResult struct {
	// Source info
	SourceName string `json:"source_name"`
	SourceType string `json:"source_type"`

	// Collection timing
	CollectedAt int64 `json:"collected_at"`
	DurationMs  int64 `json:"duration_ms"`

	// Results
	Reports    []*ctis.Report `json:"reports"`
	TotalItems int            `json:"total_items"`
	ErrorItems int            `json:"error_items"`

	// Cursor for pagination
	NextCursor string `json:"next_cursor,omitempty"`
	HasMore    bool   `json:"has_more"`
}

type Collector interface {
	// Name returns the collector name
	Name() string

	// Type returns the source type (e.g., "github", "gitlab", "api")
	Type() string

	// Collect pulls data from the external source
	Collect(ctx context.Context, opts *CollectOptions) (*CollectResult, error)

	// TestConnection verifies the connection to the external source
	TestConnection(ctx context.Context) error
}

type Command struct {
	ID        string          `json:"id"`
	Type      string          `json:"type"`
	Priority  string          `json:"priority"`
	Payload   json.RawMessage `json:"payload"`
	CreatedAt time.Time       `json:"created_at"`
	ExpiresAt time.Time       `json:"expires_at"`
}

type CommandClient interface {
	GetCommands(ctx context.Context) (*GetCommandsResponse, error)
	AcknowledgeCommand(ctx context.Context, cmdID string) error
	StartCommand(ctx context.Context, cmdID string) error
	ReportCommandResult(ctx context.Context, cmdID string, result *CommandResult) error
	ReportCommandProgress(ctx context.Context, cmdID string, progress int, message string) error
}

type CommandExecutionResult struct {
	DurationMs    int64
	FindingsCount int
	ExitCode      int
	Metadata      map[string]interface{}
}

type CommandExecutor interface {
	Execute(ctx context.Context, cmd *Command) (*CommandExecutionResult, error)
}

type CommandPoller struct {
	// contains filtered or unexported fields
}

type CommandPollerConfig struct {
	PollInterval  time.Duration `yaml:"poll_interval" json:"poll_interval"`
	MaxConcurrent int           `yaml:"max_concurrent" json:"max_concurrent"`
	AllowedTypes  []string      `yaml:"allowed_types" json:"allowed_types"`
	Verbose       bool          `yaml:"verbose" json:"verbose"`
	// DoorbellSafetyPoll is how often the poller still polls on its own
	// while the heartbeat doorbell is active. Default 5m.
	DoorbellSafetyPoll time.Duration `yaml:"doorbell_safety_poll" json:"doorbell_safety_poll"`
	// DrainGrace is how long a stopping poller lets running commands finish
	// before it cancels them and releases them to the platform. Default 30s.
	DrainGrace time.Duration `yaml:"drain_grace" json:"drain_grace"`
}

type CommandResult struct {
	Status        string                 `json:"status"`
	CompletedAt   time.Time              `json:"completed_at"`
	DurationMs    int64                  `json:"duration_ms"`
	ExitCode      int                    `json:"exit_code"`
	FindingsCount int                    `json:"findings_count"`
	Error         string                 `json:"error,omitempty"`
	Metadata      map[string]interface{} `json:"metadata,omitempty"`
}

type Connector interface {
	// Name returns the connector name (e.g., "github", "gitlab")
	Name() string

	// Type returns the connector type (e.g., "scm", "cloud", "ticketing")
	Type() string

	// Connect establishes connection to the external system
	Connect(ctx context.Context) error

	// Close closes the connection
	Close() error

	// IsConnected returns true if connected
	IsConnected() bool

	// TestConnection verifies the connection is working
	TestConnection(ctx context.Context) error

	// HTTPClient returns the configured HTTP client (with auth headers)
	HTTPClient() *http.Client

	// RateLimited returns true if rate limiting is enabled
	RateLimited() bool

	// WaitForRateLimit blocks until rate limit allows next request
	WaitForRateLimit(ctx context.Context) error
}

type ConnectorConfig struct {
	// Authentication
	APIKey      string       `yaml:"api_key" json:"api_key"`
	Token       string       `yaml:"token" json:"token"`
	Username    string       `yaml:"username" json:"username"`
	Password    string       `yaml:"password" json:"password"`
	OAuthConfig *OAuthConfig `yaml:"oauth" json:"oauth,omitempty"`

	// Connection
	BaseURL string        `yaml:"base_url" json:"base_url"`
	Timeout time.Duration `yaml:"timeout" json:"timeout"`

	// Rate limiting
	RateLimit  int `yaml:"rate_limit" json:"rate_limit"`   // requests per hour
	BurstLimit int `yaml:"burst_limit" json:"burst_limit"` // burst size

	// Retry
	MaxRetries int           `yaml:"max_retries" json:"max_retries"`
	RetryDelay time.Duration `yaml:"retry_delay" json:"retry_delay"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ContentInfo struct {
	// Name is the content's name (ContentTrivyDB, ContentNucleiTemplates, ...).
	Name string `json:"name"`
	// Version identifies the content: a release tag for templates, the
	// build time for a database, a digest prefix for a rules bundle. Empty
	// when the sensor has none.
	Version string `json:"version,omitempty"`
	// UpdatedAt is when the content was published (the database's build
	// time, the templates' release date); the platform measures staleness
	// from it. nil when unknown.
	UpdatedAt *time.Time `json:"updated_at,omitempty"`
	// FetchedAt is when this sensor installed it.
	FetchedAt *time.Time `json:"fetched_at,omitempty"`
	// CheckedAt is when the sensor last confirmed with its source that this
	// is still the newest version (or the pinned one). Content that is old
	// because its publisher has released nothing newer is not stale: see
	// Stale.
	CheckedAt *time.Time `json:"checked_at,omitempty"`
	// Source is where it came from: a registry repository, a URL, "image"
	// for content baked into the sensor image, or the tool's own fetch.
	Source string `json:"source,omitempty"`
	// Digest is the content's digest ("sha256:..."): the OCI manifest digest
	// of a database, the archive digest of a template release.
	Digest string `json:"digest,omitempty"`
	// Managed is true when the sensor controls the content (it refreshes,
	// verifies and swaps it, and scans use exactly this version); false
	// when the tool fetches its content by itself.
	Managed bool `json:"managed"`
	// Error is the last refresh failure, if the last refresh failed (the
	// sensor keeps scanning with the version above). Short, no secrets.
	Error string `json:"error,omitempty"`
}

type ContentPin struct {
	// MaxAgeHours: content older than this is stale. The sensor refreshes
	// it on its next check and the platform reports the sensor degraded
	// while it stays stale. 0: no limit.
	MaxAgeHours int `json:"max_age_hours,omitempty"`
	// Version pins the content: an OCI digest ("sha256:...") for a
	// database, a release tag ("v10.4.9") for templates. Empty: the
	// newest the source has.
	Version string `json:"version,omitempty"`
	// Rulesets (semgrep-rules only) are the registry rulesets the sensor
	// fetches, verifies and pins ("p/default"). Empty: semgrep fetches its
	// rules itself on every scan (--config auto).
	Rulesets []string `json:"rulesets,omitempty"`
}

type ContentPolicy struct {
	// RefreshIntervalHours is how often the sensor checks for new content;
	// 0 leaves the sensor's own setting.
	RefreshIntervalHours int `json:"refresh_interval_hours,omitempty"`
	// Content is the per-content policy, keyed by content name.
	Content map[string]ContentPin `json:"content,omitempty"`
}

type DNSRecord struct {
	Host       string   `json:"host"`                  // Hostname
	RecordType string   `json:"record_type"`           // A, AAAA, CNAME, MX, NS, TXT, SOA
	Values     []string `json:"values"`                // Record values
	TTL        int      `json:"ttl,omitempty"`         // Time to live
	Resolver   string   `json:"resolver,omitempty"`    // Resolver used
	StatusCode string   `json:"status_code,omitempty"` // NOERROR, NXDOMAIN, etc.
}

type DefaultCommandExecutor struct {
	// contains filtered or unexported fields
}

type DefaultLogger struct {
	// contains filtered or unexported fields
}

type DiscoveredURL struct {
	URL        string `json:"url"`              // Full URL
	Method     string `json:"method,omitempty"` // HTTP method (GET, POST, etc.)
	Source     string `json:"source,omitempty"` // Discovery source (crawl, js, archive)
	StatusCode int    `json:"status_code,omitempty"`
	Depth      int    `json:"depth,omitempty"`     // Crawl depth
	Parent     string `json:"parent,omitempty"`    // Parent URL
	Type       string `json:"type,omitempty"`      // endpoint, form, api, static
	Extension  string `json:"extension,omitempty"` // File extension
}

type Doorbell struct {
	// contains filtered or unexported fields
}

type DoorbellConfig struct {
	// OnRotateKey is called (in its own goroutine) when the platform sends
	// rotate_key, e.g. platform.KeyRenewManager.RenewNow. Nil: rotate_key is
	// logged and otherwise ignored.
	OnRotateKey func()
	// Logger receives the doorbell's state changes. Nil logs to stderr with
	// timestamps.
	Logger *log.Logger
	// Verbose also logs every heartbeat's hints.
	Verbose bool
}

type DoorbellPusher interface {
	SendHeartbeatWithHints(ctx context.Context, status *SensorStatus) (*HeartbeatHints, error)
}

type EmbeddedTemplate struct {
	ID           string `json:"id"`
	Name         string `json:"name"`
	TemplateType string `json:"template_type"` // nuclei, semgrep, betterleaks
	Content      string `json:"content"`       // Base64-encoded template content (YAML/TOML)
	ContentHash  string `json:"content_hash"`  // SHA256 hash of decoded content for verification
}

type Enricher interface {
	// Name returns the enricher name (e.g., "epss", "kev", "nvd")
	Name() string

	// Enrich adds threat intel to a single finding
	Enrich(ctx context.Context, finding *ctis.Finding) (*ctis.Finding, error)

	// EnrichBatch adds threat intel to multiple findings
	EnrichBatch(ctx context.Context, findings []ctis.Finding) ([]ctis.Finding, error)
}

type EnricherConfig struct {
	// API endpoint (optional, for custom sources)
	Endpoint string `yaml:"endpoint" json:"endpoint"`

	// Cache duration
	CacheTTL time.Duration `yaml:"cache_ttl" json:"cache_ttl"`

	// Rate limiting
	RateLimit int `yaml:"rate_limit" json:"rate_limit"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ExecConfig struct {
	Binary  string            // Scanner binary path
	Args    []string          // Command arguments
	WorkDir string            // Working directory
	Env     map[string]string // Extra environment variables (added to the allowlisted base, see ScannerEnviron)
	Timeout time.Duration     // Execution timeout
	Verbose bool              // Stream output to logs
}

type ExecResult struct {
	ExitCode   int
	Stdout     []byte
	Stderr     []byte
	DurationMs int64
	Error      error
}

type GetCommandsResponse struct {
	Commands            []*Command `json:"commands"`
	PollIntervalSeconds int        `json:"poll_interval_seconds,omitempty"`
}

type GitHubAlertInstance struct {
	Ref      string              `json:"ref"`
	State    string              `json:"state"`
	Location GitHubAlertLocation `json:"location"`
	Message  GitHubAlertMessage  `json:"message"`
}

type GitHubAlertLocation struct {
	Path        string `json:"path"`
	StartLine   int    `json:"start_line"`
	EndLine     int    `json:"end_line"`
	StartColumn int    `json:"start_column"`
	EndColumn   int    `json:"end_column"`
}

type GitHubAlertMessage struct {
	Text string `json:"text"`
}

type GitHubAlertRule struct {
	ID                    string   `json:"id"`
	Severity              string   `json:"severity"`
	SecuritySeverityLevel string   `json:"security_severity_level"`
	Description           string   `json:"description"`
	Tags                  []string `json:"tags"`
}

type GitHubAlertTool struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type GitHubCodeScanningAlert struct {
	Number             int                 `json:"number"`
	State              string              `json:"state"`
	HTMLURL            string              `json:"html_url"`
	Rule               GitHubAlertRule     `json:"rule"`
	Tool               GitHubAlertTool     `json:"tool"`
	MostRecentInstance GitHubAlertInstance `json:"most_recent_instance"`
	CreatedAt          string              `json:"created_at"`
}

type GitHubCollector struct {
	*BaseCollector
	// contains filtered or unexported fields
}

type GitHubCollectorConfig struct {
	Token   string `yaml:"token" json:"token"`
	Owner   string `yaml:"owner" json:"owner"`
	Repo    string `yaml:"repo" json:"repo"`
	Verbose bool   `yaml:"verbose" json:"verbose"`
}

type HeartbeatAction string

type HeartbeatHints struct {
	// Present is true when the response carried at least one doorbell field.
	// A server that knows the doorbell answers every heartbeat of a
	// doorbell-aware sensor with at least next_heartbeat_seconds.
	Present bool
	// PendingJobs is the number of jobs this sensor could claim now (0..100).
	PendingJobs int
	// NextHeartbeat is the advised delay before the next heartbeat, already
	// clamped to [MinDoorbellHeartbeatInterval, MaxDoorbellHeartbeatInterval].
	// Zero when not advised.
	NextHeartbeat time.Duration
	// Actions are the actions the server sent, unfiltered. Doorbell.Handle
	// acts only on the known ones.
	Actions []HeartbeatAction
	// ConfigVersion is the opaque version of what the platform governs about
	// this sensor, or "" when absent or malformed.
	ConfigVersion string
	// CancelCommandIDs are commands the platform canceled that this sensor
	// may hold (cancel_command_ids, api RFC-030 §5.4): the poller stops
	// them and releases them.
	CancelCommandIDs []string
}

type JSONParser struct{}

type LimitedCommandClient interface {
	GetCommandsLimit(ctx context.Context, limit int) (*GetCommandsResponse, error)
}

type LiveHost struct {
	URL           string   `json:"url"`                      // Full URL (https://example.com)
	Host          string   `json:"host"`                     // Hostname
	IP            string   `json:"ip,omitempty"`             // Resolved IP
	Port          int      `json:"port,omitempty"`           // Port number
	Scheme        string   `json:"scheme"`                   // http or https
	StatusCode    int      `json:"status_code"`              // HTTP status code
	ContentLength int64    `json:"content_length,omitempty"` // Response size
	Title         string   `json:"title,omitempty"`          // Page title
	WebServer     string   `json:"web_server,omitempty"`     // Server header
	ContentType   string   `json:"content_type,omitempty"`   // Content-Type header
	Technologies  []string `json:"technologies,omitempty"`   // Detected technologies
	CDN           string   `json:"cdn,omitempty"`            // CDN provider
	TLSVersion    string   `json:"tls_version,omitempty"`    // TLS version
	Redirect      string   `json:"redirect,omitempty"`       // Final redirect URL
	ResponseTime  int64    `json:"response_time_ms"`         // Response time in ms
}

type LoadReporter interface {
	ActiveJobs() int
	MaxJobs() int
}

type LogLevel int

type Logger interface {
	// Debug logs a debug message
	Debug(format string, args ...interface{})

	// Info logs an info message
	Info(format string, args ...interface{})

	// Warn logs a warning message
	Warn(format string, args ...interface{})

	// Error logs an error message
	Error(format string, args ...interface{})
}

type MultiTargetScanner interface {
	Scanner
	ScanTargets(ctx context.Context, targets []string, opts *ScanOptions) (*ScanResult, error)
}

type NopLogger struct{}

type OAuthConfig struct {
	ClientID     string   `yaml:"client_id" json:"client_id"`
	ClientSecret string   `yaml:"client_secret" json:"client_secret"`
	TokenURL     string   `yaml:"token_url" json:"token_url"`
	Scopes       []string `yaml:"scopes" json:"scopes"`
}

type OpenPort struct {
	Host     string `json:"host"`               // IP or hostname
	IP       string `json:"ip,omitempty"`       // IP address
	Port     int    `json:"port"`               // Port number
	Protocol string `json:"protocol,omitempty"` // tcp, udp
	Service  string `json:"service,omitempty"`  // Detected service name
	Version  string `json:"version,omitempty"`  // Service version
	Banner   string `json:"banner,omitempty"`   // Service banner
}

type OutputHandler func(line string, isError bool)

type Package struct {
	ID       string   `json:"id"`       // Package URL or unique identifier
	Name     string   `json:"name"`     // Package name
	Version  string   `json:"version"`  // Installed version
	Type     string   `json:"type"`     // npm, maven, pip, etc.
	Licenses []string `json:"licenses"` // License identifiers
	PURL     string   `json:"purl"`     // Package URL (purl spec)
}

type PackageDependency struct {
	PackageID    string   `json:"package_id"`   // Parent package
	Dependencies []string `json:"dependencies"` // Child package IDs
}

type PackageType string

type ParseOptions struct {
	// Tool information
	ToolName string `json:"tool_name"`
	ToolType string `json:"tool_type"` // sast, sca, secret, iac, web3

	// Asset information
	AssetType  ctis.AssetType `json:"asset_type"`
	AssetValue string         `json:"asset_value"`
	AssetID    string         `json:"asset_id"`

	// Git information (legacy - use BranchInfo for full context)
	Branch    string `json:"branch"`
	CommitSHA string `json:"commit_sha"`

	// Branch information for branch-aware finding lifecycle
	// Provides full CI/CD context for auto-resolve and expiry features
	BranchInfo *ctis.BranchInfo `json:"branch_info,omitempty"`

	// BasePath is the root directory of the scanned codebase.
	// Used to resolve relative file paths when reading snippets from source files.
	BasePath string `json:"base_path,omitempty"`

	// Defaults
	DefaultConfidence int `json:"default_confidence"`
}

type Parser interface {
	// Name returns the parser name (e.g., "sarif", "json", "custom-trivy")
	Name() string

	// SupportedFormats returns the output formats this parser can handle
	SupportedFormats() []string

	// Parse converts raw output to CTIS report
	Parse(ctx context.Context, data []byte, opts *ParseOptions) (*ctis.Report, error)

	// CanParse checks if the parser can handle the given data
	CanParse(data []byte) bool
}

type ParserRegistry struct {
	// contains filtered or unexported fields
}

type PrintfLogger struct {
	// contains filtered or unexported fields
}

type ProcessOptions struct {
	// Scan options
	ScanOptions *ScanOptions `yaml:"scan" json:"scan"`

	// Parse options
	ParseOptions *ParseOptions `yaml:"parse" json:"parse"`

	// Push options
	Push      bool   `yaml:"push" json:"push"`
	SaveLocal bool   `yaml:"save_local" json:"save_local"`
	OutputDir string `yaml:"output_dir" json:"output_dir"`

	// Retry
	MaxRetries int `yaml:"max_retries" json:"max_retries"`
	RetryDelay int `yaml:"retry_delay_seconds" json:"retry_delay_seconds"`
}

type ProcessResult struct {
	// Scanner info
	ScannerName string `json:"scanner_name"`

	// Scan result
	ScanResult *ScanResult `json:"scan_result"`

	// Parsed report
	Report *ctis.Report `json:"report,omitempty"`

	// Push result
	PushResult *PushResult `json:"push_result,omitempty"`

	// Local file if saved
	LocalFile string `json:"local_file,omitempty"`

	// Error
	Error string `json:"error,omitempty"`
}

type Processor interface {
	// Process runs a complete scan workflow
	Process(ctx context.Context, scanner Scanner, opts *ProcessOptions) (*ProcessResult, error)

	// ProcessBatch runs multiple scanners in parallel
	ProcessBatch(ctx context.Context, scanners []Scanner, opts *ProcessOptions) ([]*ProcessResult, error)
}

type Provider interface {
	// Name returns the provider name (e.g., "github", "aws")
	Name() string

	// Connector returns the underlying connector
	Connector() Connector

	// ListCollectors returns all available collectors
	ListCollectors() []Collector

	// GetCollector returns a specific collector by name
	GetCollector(name string) (Collector, error)

	// Initialize sets up the provider with configuration
	Initialize(ctx context.Context, config *ProviderConfig) error

	// TestConnection tests the provider connection
	TestConnection(ctx context.Context) error

	// Close closes the provider and all collectors
	Close() error
}

type ProviderConfig struct {
	// Connector config
	Connector ConnectorConfig `yaml:"connector" json:"connector"`

	// Provider-specific settings
	Settings map[string]any `yaml:"settings" json:"settings"`

	// Which collectors to enable (empty = all)
	EnabledCollectors []string `yaml:"enabled_collectors" json:"enabled_collectors"`
}

type PushResult struct {
	Success         bool   `json:"success"`
	Message         string `json:"message,omitempty"`
	FindingsCreated int    `json:"findings_created"`
	FindingsUpdated int    `json:"findings_updated"`
	AssetsCreated   int    `json:"assets_created"`
	AssetsUpdated   int    `json:"assets_updated"`

	// Queued: the results are durably stored in the outbox and will be
	// delivered when the platform is reachable; the counts above are not
	// known yet.
	Queued bool `json:"queued,omitempty"`
	// ReportID is the protocol v2 report id the results travel under ("" on
	// v1).
	ReportID string `json:"report_id,omitempty"`
}

type Pusher interface {
	// PushFindings sends findings to OpenCTEM
	PushFindings(ctx context.Context, report *ctis.Report) (*PushResult, error)

	// PushAssets sends assets to OpenCTEM
	PushAssets(ctx context.Context, report *ctis.Report) (*PushResult, error)

	// SendHeartbeat sends a heartbeat to OpenCTEM
	SendHeartbeat(ctx context.Context, status *SensorStatus) error

	// TestConnection tests the API connection
	TestConnection(ctx context.Context) error
}

type QueueStats struct {
	// Claimed is the commands this sensor holds (claimed and not finished).
	Claimed int `json:"claimed"`
	// Running is those it is executing.
	Running int `json:"running"`
	// QueuedLocal is those claimed and not started yet.
	QueuedLocal int `json:"queued_local"`
	// OldestAgeSeconds is how long the oldest held command has been held.
	OldestAgeSeconds int64 `json:"oldest_age_seconds"`
}

type ReconOptions struct {
	// Target configuration
	Target     string   `yaml:"target" json:"target"`           // Domain, IP, or CIDR
	InputFile  string   `yaml:"input_file" json:"input_file"`   // File with multiple targets
	OutputFile string   `yaml:"output_file" json:"output_file"` // Output file path
	ExtraArgs  []string `yaml:"extra_args" json:"extra_args"`   // Additional CLI args

	// Performance
	Threads   int           `yaml:"threads" json:"threads"`       // Concurrency
	RateLimit int           `yaml:"rate_limit" json:"rate_limit"` // Rate limit (requests/second)
	Timeout   time.Duration `yaml:"timeout" json:"timeout"`       // Scan timeout

	// DNS configuration
	Resolvers []string `yaml:"resolvers" json:"resolvers"` // Custom DNS resolvers

	// Environment
	Env map[string]string `yaml:"env" json:"env"` // Environment variables

	// Output
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ReconResult struct {
	// Scanner info
	ScannerName    string    `json:"scanner_name"`
	ScannerVersion string    `json:"scanner_version"`
	ReconType      ReconType `json:"recon_type"`

	// Target
	Target string `json:"target"`

	// Timing
	StartedAt  int64 `json:"started_at"`
	FinishedAt int64 `json:"finished_at"`
	DurationMs int64 `json:"duration_ms"`

	// Results (populated based on ReconType)
	Subdomains   []Subdomain     `json:"subdomains,omitempty"`
	DNSRecords   []DNSRecord     `json:"dns_records,omitempty"`
	OpenPorts    []OpenPort      `json:"open_ports,omitempty"`
	LiveHosts    []LiveHost      `json:"live_hosts,omitempty"`
	URLs         []DiscoveredURL `json:"urls,omitempty"`
	Technologies []Technology    `json:"technologies,omitempty"`

	// Raw output
	RawOutput []byte `json:"raw_output,omitempty"`
	ExitCode  int    `json:"exit_code"`
	Error     string `json:"error,omitempty"`
}

type ReconScanner interface {
	// Name returns the scanner name (e.g., "subfinder", "naabu")
	Name() string

	// Version returns the scanner version
	Version() string

	// Type returns the recon type this scanner performs
	Type() ReconType

	// Scan performs reconnaissance on the target and returns results
	Scan(ctx context.Context, target string, opts *ReconOptions) (*ReconResult, error)

	// IsInstalled checks if the underlying tool is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ReconType string

type RefreshContentRequest struct {
	// Content names the content to refresh; empty refreshes all managed
	// content.
	Content []string `json:"content,omitempty"`
	// Force refreshes even content that is still fresh.
	Force bool `json:"force,omitempty"`
	// Policy, when present, replaces the policy the sensor applies (it
	// keeps it for its scheduled refreshes).
	Policy *ContentPolicy `json:"policy,omitempty"`
}

type ReleasingCommandClient interface {
	ReleaseCommand(ctx context.Context, cmdID, reason string) error
}

type SARIFParser struct{}

type SDKInfo struct {
	// Name is "openctem-sdk-go".
	Name string `json:"name"`
	// Version is the SDK version linked into the binary, without a leading
	// "v" (useragent.SDKVersion: from the build info, so a release tag sets
	// it; "<sdk.Version>-devel" for a local checkout).
	Version string `json:"version"`
}

type ScaResult struct {
	// Packages discovered
	Packages []Package `json:"packages"`

	// Dependency relationships
	PackageDependencies []PackageDependency `json:"package_dependencies"`

	// Vulnerabilities found
	Vulnerabilities []Vulnerability `json:"vulnerabilities"`

	// Timing
	DurationMs int64 `json:"duration_ms"`
}

type ScaScanOptions struct {
	// Target
	TargetDir string `yaml:"target_dir" json:"target_dir"`

	// Scan configuration
	SkipDBUpdate   bool `yaml:"skip_db_update" json:"skip_db_update"`
	IgnoreUnfixed  bool `yaml:"ignore_unfixed" json:"ignore_unfixed"`
	IncludeDevDeps bool `yaml:"include_dev_deps" json:"include_dev_deps"`

	// Output
	GenerateSBOM bool   `yaml:"generate_sbom" json:"generate_sbom"`
	SBOMFormat   string `yaml:"sbom_format" json:"sbom_format"` // cyclonedx, spdx

	// Verbose
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ScaScanner interface {
	// Name returns the scanner name (e.g., "trivy", "snyk")
	Name() string

	// Type returns the scanner type
	Type() ScannerType

	// Scan performs SCA scan and returns results
	Scan(ctx context.Context, target string, opts *ScaScanOptions) (*ScaResult, error)

	// IsInstalled checks if the scanner is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ScanCommandPayload struct {
	Scanner string `json:"scanner"`
	// Target is the single scan target. The platform omits it when a job has
	// several targets for a list-capable scanner (nuclei) and sends only
	// Targets; when both are set, Target is the job.
	Target string `json:"target"`
	// Targets is the full target list (protocol v1, additive).
	Targets         []string               `json:"targets,omitempty"`
	Config          map[string]interface{} `json:"config,omitempty"`
	TimeoutSeconds  int                    `json:"timeout_seconds,omitempty"`
	ReportProgress  bool                   `json:"report_progress,omitempty"`
	CustomTemplates []EmbeddedTemplate     `json:"custom_templates,omitempty"`
}

type ScanOptions struct {
	// Target configuration
	TargetDir  string            `yaml:"target_dir" json:"target_dir"`
	Include    []string          `yaml:"include" json:"include"`
	Exclude    []string          `yaml:"exclude" json:"exclude"`
	ConfigFile string            `yaml:"config_file" json:"config_file"`
	ExtraArgs  []string          `yaml:"extra_args" json:"extra_args"`
	Env        map[string]string `yaml:"env" json:"env"`

	// Custom templates directory (written from embedded templates)
	// Used by Nuclei (-t), Semgrep (--config), Betterleaks (--config)
	CustomTemplateDir string `yaml:"custom_template_dir" json:"custom_template_dir"`

	// Asset information for linking findings
	RepoURL   string `yaml:"repo_url" json:"repo_url"`
	Branch    string `yaml:"branch" json:"branch"`
	CommitSHA string `yaml:"commit_sha" json:"commit_sha"`

	// Output
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ScanResult struct {
	// Scanner info
	ScannerName    string `json:"scanner_name"`
	ScannerVersion string `json:"scanner_version"`

	// Timing
	StartedAt  int64 `json:"started_at"`
	FinishedAt int64 `json:"finished_at"`
	DurationMs int64 `json:"duration_ms"`

	// Output
	ExitCode  int    `json:"exit_code"`
	RawOutput []byte `json:"raw_output,omitempty"`
	Stderr    string `json:"stderr,omitempty"`

	// Error (if scan failed)
	Error string `json:"error,omitempty"`
}

type ScanTargetPolicy struct {
	// AllowedRoots confines filesystem targets. When non-empty, a path target
	// must resolve (after following symlinks) to one of these directories or
	// a descendant. When empty, filesystem targets are allowed anywhere
	// except the filesystem root, sensitive system directories (/etc, /proc,
	// /root, ...) and credential directories in the user's home (~/.ssh,
	// ~/.aws, ...). Configuring roots is strongly recommended.
	AllowedRoots []string

	// AllowPrivate permits network targets in RFC1918 (10/8, 172.16/12,
	// 192.168/16) and IPv6 ULA (fc00::/7) space, for sensors that scan an
	// internal network. Loopback, link-local (incl. 169.254.169.254 IMDS),
	// CGNAT, multicast, unspecified and reserved ranges stay blocked
	// regardless.
	AllowPrivate bool

	// AllowLoopback permits 127.0.0.0/8 and ::1. Test-only; mirrors
	// httpsec.AllowLoopback.
	AllowLoopback bool

	// Disabled turns validation off entirely. Only for callers that validate
	// targets themselves before the executor sees the command.
	Disabled bool

	// LookupIP resolves a hostname; nil uses net.DefaultResolver. Exposed
	// for tests.
	LookupIP func(ctx context.Context, host string) ([]net.IP, error)
	// contains filtered or unexported fields
}

type Scanner interface {
	// Name returns the scanner name (e.g., "semgrep", "trivy")
	Name() string

	// Version returns the scanner version
	Version() string

	// Capabilities returns what the scanner can detect
	Capabilities() []string

	// Scan performs a scan on the target and returns raw output
	Scan(ctx context.Context, target string, opts *ScanOptions) (*ScanResult, error)

	// IsInstalled checks if the underlying tool is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ScannerType string

type SecretFinding struct {
	// Identity
	RuleID      string `json:"rule_id"`     // Detection rule ID
	Fingerprint string `json:"fingerprint"` // For deduplication

	// Classification
	SecretType string `json:"secret_type"` // api_key, password, token, etc.
	Service    string `json:"service"`     // AWS, GitHub, Stripe, etc.

	// Location
	File        string `json:"file"`
	StartLine   int    `json:"start_line"`
	EndLine     int    `json:"end_line"`
	StartColumn int    `json:"start_column"`
	EndColumn   int    `json:"end_column"`

	// Content
	Match       string `json:"match"`        // Full matched line
	MaskedValue string `json:"masked_value"` // Redacted secret

	// Metadata
	Entropy float64 `json:"entropy,omitempty"` // Entropy score
	Valid   *bool   `json:"valid,omitempty"`   // If verified
	Author  string  `json:"author,omitempty"`  // Git author
	Commit  string  `json:"commit,omitempty"`  // Git commit
	Date    string  `json:"date,omitempty"`    // Commit date
}

type SecretResult struct {
	// Secrets found
	Secrets []SecretFinding `json:"secrets"`

	// Timing
	DurationMs int64 `json:"duration_ms"`
}

type SecretScanOptions struct {
	// Target
	TargetDir string `yaml:"target_dir" json:"target_dir"`

	// Scan configuration
	ConfigFile string   `yaml:"config_file" json:"config_file"` // Custom rules file
	Exclude    []string `yaml:"exclude" json:"exclude"`         // Paths to exclude
	NoGit      bool     `yaml:"no_git" json:"no_git"`           // Don't use git history

	// Verification
	Verify bool `yaml:"verify" json:"verify"` // Verify secrets are valid

	// Verbose
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type SecretScanner interface {
	// Name returns the scanner name (e.g., "betterleaks", "trufflehog")
	Name() string

	// Type returns the scanner type
	Type() ScannerType

	// Scan performs secret detection and returns results
	Scan(ctx context.Context, target string, opts *SecretScanOptions) (*SecretResult, error)

	// IsInstalled checks if the scanner is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type Sensor interface {
	// Name returns the sensor name
	Name() string

	// Start starts the sensor
	Start(ctx context.Context) error

	// Stop gracefully stops the sensor
	Stop(ctx context.Context) error

	// Status returns the current sensor status
	Status() *SensorStatus

	// AddScanner adds a scanner to the sensor
	AddScanner(scanner Scanner) error

	// AddCollector adds a collector to the sensor
	AddCollector(collector Collector) error

	// RemoveScanner removes a scanner by name
	RemoveScanner(name string) error

	// RemoveCollector removes a collector by name
	RemoveCollector(name string) error
}

type SensorBuild struct {
	// Name is the product name (BaseSensorConfig.ProductName, else the
	// name given to useragent.SetProduct, else the executable's name).
	Name string `json:"name"`
	// Version is the sensor's version, without a leading "v"; "" when the
	// sensor does not say.
	Version string `json:"version,omitempty"`
	// Commit is the source revision the binary was built from (optional).
	Commit string `json:"commit,omitempty"`
	// BuildTime is when the binary was built, RFC 3339 in UTC (optional).
	BuildTime string `json:"build_time,omitempty"`
}

type SensorState string

type SensorStatus struct {
	Name          string      `json:"name"`
	Status        SensorState `json:"status"`
	StartedAt     int64       `json:"started_at,omitempty"`
	Uptime        int64       `json:"uptime_seconds,omitempty"`
	Scanners      []string    `json:"scanners"`
	Collectors    []string    `json:"collectors"`
	LastScan      int64       `json:"last_scan,omitempty"`
	LastCollect   int64       `json:"last_collect,omitempty"`
	TotalScans    int64       `json:"total_scans"`
	TotalFindings int64       `json:"total_findings"`
	Errors        int64       `json:"errors"`
	Message       string      `json:"message,omitempty"`

	// System Metrics (collected from sensor)
	CPUPercent    float64 `json:"cpu_percent,omitempty"`
	MemoryPercent float64 `json:"memory_percent,omitempty"`
	ActiveJobs    int     `json:"active_jobs,omitempty"`
	Region        string  `json:"region,omitempty"`
	// ActiveJobsReported is true when ActiveJobs is a measured value (the
	// sensor has a LoadReporter): the heartbeat then sends active_jobs even
	// when it is 0, so the platform can tell "idle" from "not reported".
	ActiveJobsReported bool `json:"-"`

	// Version and Hostname identify the running sensor to the platform (shown
	// on the Sensors page). Both are sent with every heartbeat.
	Version  string `json:"version,omitempty"`
	Hostname string `json:"hostname,omitempty"`

	// What the sensor reports it can do (see CapabilityReport): its tool
	// inventory, the capabilities it serves and how many jobs it runs at
	// once. nil / 0 report nothing. BaseSensor fills them from its
	// CapabilityReporter (SetCapabilityReporter).
	Tools             []ToolInfo `json:"tools,omitzero"`
	Capabilities      []string   `json:"capabilities,omitzero"`
	MaxConcurrentJobs int        `json:"max_concurrent_jobs,omitempty"`
	// OS and Arch are the sensor's platform (runtime.GOOS, runtime.GOARCH);
	// BaseSensor sets them.
	OS   string `json:"os,omitempty"`
	Arch string `json:"arch,omitempty"`

	// What the sensor's work looks like now (api RFC-030); nil reports
	// nothing. A CommandPoller fills them (StatusReporter): the resources
	// it may use, its slots and per-tool costs, its local queue, and the
	// ids of the commands it holds (the lease list: a platform with leases
	// renews exactly these).
	// SDK and Sensor name the SDK and the sensor binary (every heartbeat;
	// BaseSensor fills them, and the API client fills what is missing).
	SDK    *SDKInfo     `json:"sdk,omitempty"`
	Sensor *SensorBuild `json:"sensor,omitempty"`

	Resources       *resource.HostResources `json:"resources,omitempty"`
	Capacity        *resource.Capacity      `json:"capacity,omitempty"`
	Queue           *QueueStats             `json:"queue,omitempty"`
	RunningCommands []string                `json:"running,omitzero"`
}

type StatusReporter interface {
	ReportStatus(status *SensorStatus)
}

type Subdomain struct {
	Host   string   `json:"host"`             // Full subdomain (e.g., api.example.com)
	Domain string   `json:"domain"`           // Root domain (e.g., example.com)
	Source string   `json:"source,omitempty"` // Discovery source (crtsh, hackertarget, etc.)
	IPs    []string `json:"ips,omitempty"`    // Resolved IP addresses
}

type Technology struct {
	Name       string   `json:"name"`                 // Technology name
	Version    string   `json:"version,omitempty"`    // Version if detected
	Categories []string `json:"categories,omitempty"` // Category (framework, cms, etc.)
	Confidence int      `json:"confidence,omitempty"` // Detection confidence (0-100)
	Website    string   `json:"website,omitempty"`    // Technology website
}

type TemplateCache struct {
	// contains filtered or unexported fields
}

type TemplateCacheConfig struct {
	// CacheDir is the base directory for cached templates.
	// Default: ~/.openctem/templates
	CacheDir string

	// MaxCacheAge is the maximum age of cached templates before cleanup.
	// Default: 7 days
	MaxCacheAge time.Duration

	// MaxCacheSize is the maximum total size of the cache in bytes.
	// Default: 100MB
	MaxCacheSize int64

	// CleanupInterval is how often to run cleanup.
	// Default: 1 hour
	CleanupInterval time.Duration

	// Verbose enables verbose logging.
	Verbose bool
}

type ToolInfo struct {
	// Name is the tool's catalog name ("semgrep", "nuclei", "trivy").
	Name string `json:"name"`
	// Kind is what the tool does (scanner or collector); empty when the
	// sensor does not say.
	Kind ToolKind `json:"kind,omitempty"`
	// Version is the installed version, when known.
	Version string `json:"version,omitempty"`
	// Installed is false for a tool the sensor is configured to run but
	// cannot find (or cannot run). The platform does not dispatch jobs for
	// it and shows it as not installed.
	Installed bool `json:"installed"`
	// Content is the data the tool scans with (vulnerability database,
	// templates, rules) and how fresh it is; see ContentInfo. nil reports
	// nothing (the platform shows no content for the tool).
	Content []ContentInfo `json:"content,omitzero"`
}

type ToolKind string

type ToolProbe func(ctx context.Context) (installed bool, version string, err error)

type ToolRegistry struct {
	// contains filtered or unexported fields
}

type ToolSpec struct {
	// Name is the tool's catalog name ("nuclei", "semgrep"): lowercase
	// letters, digits, '.', '_' and '-', at most 64 characters (it is
	// lowercased and trimmed). The platform keeps only names in its tool
	// catalog.
	Name string
	// Kind defaults to ToolKindScanner.
	Kind ToolKind
	// Version is reported when the probe gives none (or there is no probe).
	Version string
	// Capabilities the tool serves when it is usable, besides its own name
	// (the platform dispatches a scan with the tool's name as the required
	// capability). Words the platform does not know are dropped there.
	Capabilities []string
	// Probe checks the tool; nil means it is always usable (an in-process
	// tool).
	Probe ToolProbe
	// Cost is an optional estimate of one job's cost, the prior of the
	// resource manager until it has learned the tool (see CostHints).
	Cost *resource.ToolCostHint
}

type ValidationError struct {
	Field   string
	Message string
}

type ValidationErrors []ValidationError

type Validator struct {
	// contains filtered or unexported fields
}

type Vulnerability struct {
	// Identity
	ID          string `json:"id"`          // CVE ID or advisory ID
	Fingerprint string `json:"fingerprint"` // For deduplication

	// Package info
	PkgID      string `json:"pkg_id"`      // Affected package ID
	PkgName    string `json:"pkg_name"`    // Package name
	PkgVersion string `json:"pkg_version"` // Installed version

	// Vulnerability info
	Name         string `json:"name"`          // Short title
	Description  string `json:"description"`   // Full description
	Severity     string `json:"severity"`      // critical, high, medium, low
	FixedVersion string `json:"fixed_version"` // Version with fix

	// Metadata
	Metadata *VulnerabilityMetadata `json:"metadata,omitempty"`
}

type VulnerabilityMetadata struct {
	CWEs       []string `json:"cwes,omitempty"`        // CWE identifiers
	References []string `json:"references,omitempty"`  // Advisory URLs
	CVSSScore  float64  `json:"cvss_score,omitempty"`  // CVSS score
	CVSSVector string   `json:"cvss_vector,omitempty"` // CVSS vector string
	Source     string   `json:"source,omitempty"`      // NVD, GHSA, etc.
}

type WebhookCollector struct {
	*BaseCollector
	// contains filtered or unexported fields
}

type WebhookCollectorConfig struct {
	ListenAddr string `yaml:"listen_addr" json:"listen_addr"`
	Secret     string `yaml:"secret" json:"secret"`
	Verbose    bool   `yaml:"verbose" json:"verbose"`
}