ctis

type ASVSInfo struct {
	// ASVS section (e.g., "V2: Authentication")
	Section string `json:"section,omitempty"`

	// Control ID (e.g., "2.1.1")
	ControlID string `json:"control_id,omitempty"`

	// Control URL (link to ASVS documentation)
	ControlURL string `json:"control_url,omitempty"`

	// ASVS level (1, 2, or 3)
	Level int `json:"level,omitempty"`
}

type AccessControlIssue struct {
	// Missing modifier
	MissingModifier string `json:"missing_modifier,omitempty"`

	// Unprotected function
	UnprotectedFunction string `json:"unprotected_function,omitempty"`

	// Can be called by
	CallableBy string `json:"callable_by,omitempty"` // anyone, owner_only, etc.

	// Privilege escalation path
	EscalationPath string `json:"escalation_path,omitempty"`

	// Missing role check
	MissingRoleCheck string `json:"missing_role_check,omitempty"`
}

type ArtifactLocation struct {
	// URI of the artifact
	URI string `json:"uri,omitempty"`

	// Base URI ID for resolution
	URIBaseID string `json:"uri_base_id,omitempty"`

	// Index within the artifacts array
	Index int `json:"index,omitempty"`
}

type Asset struct {
	// Unique identifier for this asset within the report
	ID string `json:"id,omitempty"`

	// Asset type (required): domain, ip_address, repository, certificate, etc.
	Type AssetType `json:"type"`

	// Primary value of the asset (required)
	// For domain: "example.com"
	// For ip_address: "192.168.1.1"
	// For repository: "github.com/org/repo"
	Value string `json:"value"`

	// Human-readable name
	Name string `json:"name,omitempty"`

	// Description
	Description string `json:"description,omitempty"`

	// Tags for categorization
	Tags []string `json:"tags,omitempty"`

	// Asset criticality: critical, high, medium, low, info
	Criticality Criticality `json:"criticality,omitempty"`

	// Confidence score 0-100 (how confident the source is about this asset)
	Confidence int `json:"confidence,omitempty"`

	// When this asset was discovered
	DiscoveredAt *time.Time `json:"discovered_at,omitempty"`

	// Asset-specific technical details
	Technical *AssetTechnical `json:"technical,omitempty"`

	// Related assets (by ID within this report)
	RelatedAssets []string `json:"related_assets,omitempty"`

	// CTEM: Compliance context for the asset
	Compliance *AssetCompliance `json:"compliance,omitempty"`

	// CTEM: Services running on this asset
	Services []ServiceInfo `json:"services,omitempty"`

	// CTEM: Is the asset directly accessible from the internet
	IsInternetAccessible bool `json:"is_internet_accessible,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type AssetCompliance struct {
	// Compliance frameworks this asset is in scope for: PCI-DSS, HIPAA, SOC2, GDPR, ISO27001
	Frameworks []string `json:"frameworks,omitempty"`

	// Data classification level: public, internal, confidential, restricted, secret
	DataClassification string `json:"data_classification,omitempty"`

	// Asset contains Personally Identifiable Information
	PIIExposed bool `json:"pii_exposed,omitempty"`

	// Asset contains Protected Health Information
	PHIExposed bool `json:"phi_exposed,omitempty"`

	// Regulatory owner email/username
	RegulatoryOwner string `json:"regulatory_owner,omitempty"`
}

type AssetTechnical struct {
	// For domain assets
	Domain *DomainTechnical `json:"domain,omitempty"`

	// For IP address assets
	IPAddress *IPAddressTechnical `json:"ip_address,omitempty"`

	// For repository assets
	Repository *RepositoryTechnical `json:"repository,omitempty"`

	// For certificate assets
	Certificate *CertificateTechnical `json:"certificate,omitempty"`

	// For cloud assets
	Cloud *CloudTechnical `json:"cloud,omitempty"`

	// For service assets
	Service *ServiceTechnical `json:"service,omitempty"`

	// For Web3 assets (smart contracts, wallets, tokens, etc.)
	Web3 *Web3Technical `json:"web3,omitempty"`
}

type AssetType string

type Attachment struct {
	// Description of the attachment
	Description string `json:"description,omitempty"`

	// Artifact location
	ArtifactLocation *ArtifactLocation `json:"artifact_location,omitempty"`

	// Relevant regions within the artifact
	Regions []*FindingLocation `json:"regions,omitempty"`
}

type AuditReport struct {
	Auditor       string     `json:"auditor"`
	ReportURL     string     `json:"report_url,omitempty"`
	Date          *time.Time `json:"date,omitempty"`
	Scope         string     `json:"scope,omitempty"`
	CriticalCount int        `json:"critical_count,omitempty"`
	HighCount     int        `json:"high_count,omitempty"`
	MediumCount   int        `json:"medium_count,omitempty"`
	LowCount      int        `json:"low_count,omitempty"`
}

type BranchInfo struct {
	// Branch name (e.g., "main", "feature/xyz", "refs/heads/main")
	Name string `json:"name"`

	// Whether this is the default branch (main/master)
	// Auto-resolve only applies to default branch scans
	IsDefaultBranch bool `json:"is_default_branch"`

	// Commit SHA being scanned
	CommitSHA string `json:"commit_sha,omitempty"`

	// Base branch for PR/MR scans (e.g., "main" when scanning a PR targeting main)
	BaseBranch string `json:"base_branch,omitempty"`

	// PR/MR number if this is a pull request scan
	PullRequestNumber int `json:"pull_request_number,omitempty"`

	// PR/MR URL if this is a pull request scan
	PullRequestURL string `json:"pull_request_url,omitempty"`

	// Repository URL for context
	RepositoryURL string `json:"repository_url,omitempty"`
}

type BusinessImpact struct {
	// Data exposure risk: none, low, medium, high, critical
	DataExposureRisk string `json:"data_exposure_risk,omitempty"`

	// Has potential reputational impact
	ReputationalImpact bool `json:"reputational_impact,omitempty"`

	// Compliance frameworks impacted: PCI-DSS, HIPAA, SOC2, GDPR, ISO27001
	ComplianceImpact []string `json:"compliance_impact,omitempty"`
}

type CertificateTechnical struct {
	// Serial number
	SerialNumber string `json:"serial_number,omitempty"`

	// Subject common name
	SubjectCN string `json:"subject_cn,omitempty"`

	// Subject alternative names
	SANs []string `json:"sans,omitempty"`

	// Issuer common name
	IssuerCN string `json:"issuer_cn,omitempty"`

	// Issuer organization
	IssuerOrg string `json:"issuer_org,omitempty"`

	// Valid from
	NotBefore *time.Time `json:"not_before,omitempty"`

	// Valid until
	NotAfter *time.Time `json:"not_after,omitempty"`

	// Signature algorithm
	SignatureAlgorithm string `json:"signature_algorithm,omitempty"`

	// Key algorithm
	KeyAlgorithm string `json:"key_algorithm,omitempty"`

	// Key size in bits
	KeySize int `json:"key_size,omitempty"`

	// SHA-256 fingerprint
	Fingerprint string `json:"fingerprint,omitempty"`

	// Is self-signed
	SelfSigned bool `json:"self_signed,omitempty"`

	// Is expired
	Expired bool `json:"expired,omitempty"`

	// Is wildcard
	Wildcard bool `json:"wildcard,omitempty"`
}

type CloudTechnical struct {
	// Cloud provider: aws, gcp, azure
	Provider string `json:"provider,omitempty"`

	// Account/project ID
	AccountID string `json:"account_id,omitempty"`

	// Region
	Region string `json:"region,omitempty"`

	// Availability zone
	Zone string `json:"zone,omitempty"`

	// Resource type: ec2, s3, rds, etc.
	ResourceType string `json:"resource_type,omitempty"`

	// Resource ID
	ResourceID string `json:"resource_id,omitempty"`

	// Resource ARN (AWS)
	ARN string `json:"arn,omitempty"`

	// Resource tags
	Tags map[string]string `json:"tags,omitempty"`
}

type ComplianceDetails struct {
	// Framework: pci-dss, hipaa, soc2, cis, etc.
	Framework string `json:"framework,omitempty"`

	// Framework version
	FrameworkVersion string `json:"framework_version,omitempty"`

	// Control ID
	ControlID string `json:"control_id,omitempty"`

	// Control name
	ControlName string `json:"control_name,omitempty"`

	// Control description
	ControlDescription string `json:"control_description,omitempty"`

	// Result: pass, fail, manual, not_applicable
	Result string `json:"result,omitempty"`
}

type ContainerLayer struct {
	// Layer digest (e.g., "sha256:abc123...")
	Digest string `json:"digest,omitempty"`

	// Layer diff ID
	DiffID string `json:"diff_id,omitempty"`
}

type ContractLibrary struct {
	Name    string `json:"name"`
	Address string `json:"address"`
}

type ConvertOptions struct {
	// Asset to associate findings with
	AssetType  AssetType
	AssetValue string
	AssetID    string

	// Branch/commit info (legacy - use BranchInfo for full context)
	Branch    string
	CommitSHA string

	// Branch information for branch-aware finding lifecycle
	// Provides full CI/CD context for auto-resolve and expiry features
	BranchInfo *BranchInfo

	// Default confidence
	DefaultConfidence int

	// Tool type hints (for finding type detection)
	ToolType string // "sast", "sca", "secret", "iac", "web3"
}

type CoreContract struct {
	Name    string `json:"name"`
	Address string `json:"address"`
	Role    string `json:"role,omitempty"` // router, factory, vault, etc.
}

type Criticality string

type DNSRecord struct {
	Type  string `json:"type"`  // A, AAAA, CNAME, MX, TXT, etc.
	Name  string `json:"name"`  // Record name
	Value string `json:"value"` // Record value
	TTL   int    `json:"ttl,omitempty"`
}

type DNSRecordInput struct {
	Host       string
	RecordType string
	Values     []string
	TTL        int
	Resolver   string
	StatusCode string
}

type DataFlow struct {
	// Taint source locations (where untrusted data enters)
	Sources []DataFlowLocation `json:"sources,omitempty"`

	// Intermediate variable locations (propagation path)
	Intermediates []DataFlowLocation `json:"intermediates,omitempty"`

	// Taint sink location (where data reaches dangerous function)
	Sinks []DataFlowLocation `json:"sinks,omitempty"`

	// Sanitizers applied (functions that clean/escape data)
	Sanitizers []DataFlowLocation `json:"sanitizers,omitempty"`

	// Whether the data is still tainted at the sink
	// (false if properly sanitized before reaching sink)
	Tainted bool `json:"tainted"`

	// Type of taint: user_input, file_read, env_var, network, database
	TaintType string `json:"taint_type,omitempty"`

	// Vulnerability type this flow leads to: sqli, xss, ssrf, command_injection, etc.
	VulnerabilityType string `json:"vulnerability_type,omitempty"`

	// Flow confidence score (0-100)
	Confidence int `json:"confidence,omitempty"`

	// Is interprocedural (crosses function boundaries)
	Interprocedural bool `json:"interprocedural,omitempty"`

	// Is cross-file (data flows across multiple files)
	CrossFile bool `json:"cross_file,omitempty"`

	// Call graph path (function names in order)
	CallPath []string `json:"call_path,omitempty"`

	// Summary of the flow for human readability
	Summary string `json:"summary,omitempty"`
}

type DataFlowLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Line number (1-indexed)
	Line int `json:"line,omitempty"`

	// End line (for multi-line spans)
	EndLine int `json:"end_line,omitempty"`

	// Column number (1-indexed)
	Column int `json:"column,omitempty"`

	// End column
	EndColumn int `json:"end_column,omitempty"`

	// Code content at this location
	Content string `json:"content,omitempty"`

	// Variable or expression name
	Label string `json:"label,omitempty"`

	// Step index in the flow (for ordering, 0-indexed)
	Index int `json:"index,omitempty"`

	// Location type: source, sink, propagator, sanitizer, transform
	Type DataFlowLocationType `json:"type,omitempty"`

	// Function/method name containing this location
	Function string `json:"function,omitempty"`

	// Class/struct name (if applicable)
	Class string `json:"class,omitempty"`

	// Module/namespace
	Module string `json:"module,omitempty"`

	// The operation performed: assignment, call, return, parameter, concat, etc.
	Operation string `json:"operation,omitempty"`

	// For function calls: the function being called
	CalledFunction string `json:"called_function,omitempty"`

	// For parameters: the parameter index (0-indexed)
	ParameterIndex int `json:"parameter_index,omitempty"`

	// Taint state at this location: tainted, sanitized, unknown
	TaintState string `json:"taint_state,omitempty"`

	// Transformation applied: encode, decode, escape, hash, encrypt, etc.
	Transformation string `json:"transformation,omitempty"`

	// Notes for human understanding
	Notes string `json:"notes,omitempty"`
}

type DataFlowLocationType string

type DeFiDetails struct {
	// Protocol name: uniswap, aave, compound, etc.
	ProtocolName string `json:"protocol_name,omitempty"`

	// Protocol type: dex, lending, yield, bridge, derivatives, etc.
	ProtocolType string `json:"protocol_type,omitempty"`

	// Protocol version
	Version string `json:"version,omitempty"`

	// Total Value Locked (TVL) in USD
	TVLUSD float64 `json:"tvl_usd,omitempty"`

	// Supported chains
	SupportedChains []string `json:"supported_chains,omitempty"`

	// Core contracts
	CoreContracts []CoreContract `json:"core_contracts,omitempty"`

	// Governance token address
	GovernanceToken string `json:"governance_token,omitempty"`

	// Is audited
	Audited bool `json:"audited,omitempty"`

	// Audit reports
	AuditReports []AuditReport `json:"audit_reports,omitempty"`

	// Has bug bounty
	HasBugBounty bool `json:"has_bug_bounty,omitempty"`

	// Bug bounty platform: immunefi, hackerone, etc.
	BugBountyPlatform string `json:"bug_bounty_platform,omitempty"`

	// Max bug bounty payout
	MaxBountyUSD float64 `json:"max_bounty_usd,omitempty"`

	// Timelock duration (for governance)
	TimelockDuration int `json:"timelock_duration,omitempty"`

	// Is paused
	Paused bool `json:"paused,omitempty"`
}

type Dependency struct {
	// Unique identifier for this dependency
	ID string `json:"id,omitempty"`

	// Package name
	Name string `json:"name"`

	// Package version
	Version string `json:"version,omitempty"`

	// Package type: library, framework, application, os
	Type string `json:"type,omitempty"`

	// Ecosystem: npm, pypi, maven, gomod, etc.
	Ecosystem string `json:"ecosystem,omitempty"`

	// Package URL (PURL)
	PURL string `json:"purl,omitempty"`

	// Unique identifier from scanner (e.g., Trivy UID)
	UID string `json:"uid,omitempty"`

	// License information
	Licenses []string `json:"licenses,omitempty"`

	// Dependency relationship: direct, indirect, root, transit
	Relationship string `json:"relationship,omitempty"`

	// Dependencies (list of IDs or names this component depends on)
	DependsOn []string `json:"depends_on,omitempty"`

	// File path where this dependency is defined
	Path string `json:"path,omitempty"` // file path

	// Location in file (deprecated, use Locations)
	Location *FindingLocation `json:"location,omitempty"`

	// All locations where this dependency is defined
	Locations []DependencyLocation `json:"locations,omitempty"`
}

type DependencyLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Start line number
	StartLine int `json:"start_line,omitempty"`

	// End line number
	EndLine int `json:"end_line,omitempty"`

	// Start column number
	StartColumn int `json:"start_column,omitempty"`

	// End column number
	EndColumn int `json:"end_column,omitempty"`
}

type DiscoveredURLInput struct {
	URL        string
	Method     string
	Source     string
	StatusCode int
	Depth      int
	Parent     string
	Type       string
	Extension  string
}

type DomainTechnical struct {
	// Registrar information
	Registrar string `json:"registrar,omitempty"`

	// Registration date
	RegisteredAt *time.Time `json:"registered_at,omitempty"`

	// Expiration date
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// Nameservers
	Nameservers []string `json:"nameservers,omitempty"`

	// DNS records
	DNSRecords []DNSRecord `json:"dns_records,omitempty"`

	// WHOIS data
	WHOIS map[string]string `json:"whois,omitempty"`
}

type Finding struct {
	// Unique identifier for this finding within the report
	ID string `json:"id,omitempty"`

	// Finding type (required): vulnerability, secret, misconfiguration, compliance
	Type FindingType `json:"type"`

	// Short title (required)
	Title string `json:"title"`

	// Detailed description
	Description string `json:"description,omitempty"`

	// Primary message to display (the main human-readable finding message)
	// This is distinct from Title (short) and Description (detailed)
	// If not set, Title will be used as the message
	Message string `json:"message,omitempty"`

	// Severity (required): critical, high, medium, low, info
	Severity Severity `json:"severity"`

	// Confidence score 0-100
	Confidence int `json:"confidence,omitempty"`

	// Impact level: critical, high, medium, low (for risk assessment)
	Impact string `json:"impact,omitempty"`

	// Likelihood level: high, medium, low (for risk assessment)
	Likelihood string `json:"likelihood,omitempty"`

	// Finding category/class
	Category string `json:"category,omitempty"`

	// Vulnerability class(es): SQL Injection, XSS, Command Injection, etc.
	VulnerabilityClass []string `json:"vulnerability_class,omitempty"`

	// Subcategory: audit, vuln, secure default, etc.
	Subcategory []string `json:"subcategory,omitempty"`

	// Rule/check ID that detected this finding
	RuleID string `json:"rule_id,omitempty"`

	// Rule name
	RuleName string `json:"rule_name,omitempty"`

	// Reference to asset ID within this report
	AssetRef string `json:"asset_ref,omitempty"`

	// Direct asset value (if not using AssetRef)
	AssetValue string `json:"asset_value,omitempty"`

	// Asset type (if using AssetValue)
	AssetType AssetType `json:"asset_type,omitempty"`

	// Location information (for code-based findings)
	Location *FindingLocation `json:"location,omitempty"`

	// Vulnerability-specific details
	Vulnerability *VulnerabilityDetails `json:"vulnerability,omitempty"`

	// Secret-specific details
	Secret *SecretDetails `json:"secret,omitempty"`

	// Misconfiguration-specific details
	Misconfiguration *MisconfigurationDetails `json:"misconfiguration,omitempty"`

	// Compliance-specific details
	Compliance *ComplianceDetails `json:"compliance,omitempty"`

	// Web3-specific details (smart contract vulnerabilities)
	Web3 *Web3VulnerabilityDetails `json:"web3,omitempty"`

	// Remediation guidance
	Remediation *Remediation `json:"remediation,omitempty"`

	// References (URLs)
	References []string `json:"references,omitempty"`

	// Tags
	Tags []string `json:"tags,omitempty"`

	// Fingerprint for deduplication
	Fingerprint string `json:"fingerprint,omitempty"`

	// Partial fingerprints - contributing identity components (SARIF partialFingerprints)
	PartialFingerprints map[string]string `json:"partial_fingerprints,omitempty"`

	// Correlation ID - groups logically identical results across runs (SARIF correlationGuid)
	CorrelationID string `json:"correlation_id,omitempty"`

	// Baseline state - status relative to previous scan (SARIF baselineState)
	// Values: new, unchanged, updated, absent
	BaselineState string `json:"baseline_state,omitempty"`

	// Kind - evaluation state of the finding (SARIF kind)
	// Values: not_applicable, pass, fail, review, open, informational
	Kind string `json:"kind,omitempty"`

	// Rank - priority/importance score 0-100 (SARIF rank)
	Rank float64 `json:"rank,omitempty"`

	// Occurrence count - number of times this result was observed (SARIF occurrenceCount)
	OccurrenceCount int `json:"occurrence_count,omitempty"`

	// Related locations - additional locations related to this finding (SARIF relatedLocations)
	RelatedLocations []*FindingLocation `json:"related_locations,omitempty"`

	// Stacks - call stacks relevant to the finding (SARIF stacks)
	Stacks []*StackTrace `json:"stacks,omitempty"`

	// Attachments - relevant artifacts or evidence (SARIF attachments)
	Attachments []*Attachment `json:"attachments,omitempty"`

	// Work item URIs - URIs of associated issues/tickets (SARIF workItemUris)
	WorkItemURIs []string `json:"work_item_uris,omitempty"`

	// Hosted viewer URI - URI to view in hosted viewer (SARIF hostedViewerUri)
	HostedViewerURI string `json:"hosted_viewer_uri,omitempty"`

	// First seen timestamp
	FirstSeenAt *time.Time `json:"first_seen_at,omitempty"`

	// Last seen timestamp
	LastSeenAt *time.Time `json:"last_seen_at,omitempty"`

	// Finding status: open, resolved, false_positive, accepted_risk, in_progress
	Status FindingStatus `json:"status,omitempty"`

	// Data flow trace for taint analysis (source -> intermediate -> sink)
	DataFlow *DataFlow `json:"data_flow,omitempty"`

	// Git author who introduced the finding
	Author string `json:"author,omitempty"`

	// Author email
	AuthorEmail string `json:"author_email,omitempty"`

	// Commit date when the finding was introduced
	CommitDate *time.Time `json:"commit_date,omitempty"`

	// Suppression information (if finding is suppressed)
	Suppression *Suppression `json:"suppression,omitempty"`

	// CTEM: Exposure information
	Exposure *FindingExposure `json:"exposure,omitempty"`

	// CTEM: Remediation context
	RemediationContext *RemediationContext `json:"remediation_context,omitempty"`

	// CTEM: Business impact assessment
	BusinessImpact *BusinessImpact `json:"business_impact,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type FindingExposure struct {
	// Exposure vector: network, local, physical, adjacent_net
	Vector string `json:"vector,omitempty"`

	// Is the finding reachable from the network
	IsNetworkAccessible bool `json:"is_network_accessible,omitempty"`

	// Is the finding directly reachable from the internet
	IsInternetAccessible bool `json:"is_internet_accessible,omitempty"`

	// Prerequisites for exploitation: auth_required, mfa_required, local_access, etc.
	AttackPrerequisites string `json:"attack_prerequisites,omitempty"`
}

type FindingLocation struct {
	// File path
	Path string `json:"path,omitempty"`

	// Start line number (1-indexed)
	StartLine int `json:"start_line,omitempty"`

	// End line number
	EndLine int `json:"end_line,omitempty"`

	// Start column
	StartColumn int `json:"start_column,omitempty"`

	// End column
	EndColumn int `json:"end_column,omitempty"`

	// Code snippet
	Snippet string `json:"snippet,omitempty"`

	// Branch name (for repository findings)
	Branch string `json:"branch,omitempty"`

	// Commit SHA
	CommitSHA string `json:"commit_sha,omitempty"`

	// Logical location (function, class, method name)
	LogicalLocation *LogicalLocation `json:"logical_location,omitempty"`

	// Context region (surrounding code for better understanding)
	ContextSnippet string `json:"context_snippet,omitempty"`

	// Context start line (for context_snippet)
	ContextStartLine int `json:"context_start_line,omitempty"`
}

type FindingStatus string

type FindingType string

type FixRegex struct {
	// Regular expression pattern to match
	Regex string `json:"regex,omitempty"`

	// Replacement string (may contain capture group references like $1, $2)
	Replacement string `json:"replacement,omitempty"`

	// Number of replacements to make (0 = all)
	Count int `json:"count,omitempty"`
}

type FlashLoanIssue struct {
	// Flash loan provider: aave, dydx, uniswap, balancer
	Provider string `json:"provider,omitempty"`

	// Attack type: price_manipulation, governance_attack, collateral_theft
	AttackType string `json:"attack_type,omitempty"`

	// Required capital for attack
	RequiredCapitalUSD float64 `json:"required_capital_usd,omitempty"`

	// Potential profit
	PotentialProfitUSD float64 `json:"potential_profit_usd,omitempty"`

	// Attack steps
	AttackSteps []string `json:"attack_steps,omitempty"`
}

type GasIssue struct {
	// Current gas cost
	CurrentGas int64 `json:"current_gas,omitempty"`

	// Optimized gas cost
	OptimizedGas int64 `json:"optimized_gas,omitempty"`

	// Gas savings percentage
	SavingsPercent float64 `json:"savings_percent,omitempty"`

	// Optimization suggestion
	Suggestion string `json:"suggestion,omitempty"`
}

type Geolocation struct {
	Latitude  float64 `json:"latitude"`
	Longitude float64 `json:"longitude"`
	Accuracy  float64 `json:"accuracy,omitempty"` // in meters
}

type IPAddressTechnical struct {
	// IP version: 4 or 6
	Version int `json:"version,omitempty"`

	// Hostname (if resolved)
	Hostname string `json:"hostname,omitempty"`

	// ASN information
	ASN int `json:"asn,omitempty"`

	// ASN organization
	ASNOrg string `json:"asn_org,omitempty"`

	// Country code
	Country string `json:"country,omitempty"`

	// City
	City string `json:"city,omitempty"`

	// Open ports
	Ports []PortInfo `json:"ports,omitempty"`

	// Geolocation
	Geolocation *Geolocation `json:"geolocation,omitempty"`
}

type LiveHostInput struct {
	URL           string
	Host          string
	IP            string
	Port          int
	Scheme        string
	StatusCode    int
	ContentLength int64
	Title         string
	WebServer     string
	ContentType   string
	Technologies  []string
	CDN           string
	TLSVersion    string
	Redirect      string
	ResponseTime  int64
}

type LogicalLocation struct {
	// Fully qualified name (e.g., "pkg.MyClass.myMethod")
	FullyQualifiedName string `json:"fully_qualified_name,omitempty"`

	// Function/method name
	Name string `json:"name,omitempty"`

	// Kind: function, method, class, module, namespace
	Kind string `json:"kind,omitempty"`

	// Parent logical location index (for nested locations)
	ParentIndex int `json:"parent_index,omitempty"`
}

type MisconfigurationDetails struct {
	// Policy/check ID
	PolicyID string `json:"policy_id,omitempty"`

	// Policy name
	PolicyName string `json:"policy_name,omitempty"`

	// Aqua Vulnerability Database ID (e.g., AVD-AWS-0001)
	AVDID string `json:"avd_id,omitempty"`

	// Resource type
	ResourceType string `json:"resource_type,omitempty"`

	// Resource name
	ResourceName string `json:"resource_name,omitempty"`

	// Cloud provider (e.g., AWS, GCP, Azure)
	Provider string `json:"provider,omitempty"`

	// Service (e.g., S3, EC2, IAM)
	Service string `json:"service,omitempty"`

	// Namespace (e.g., builtin.aws.s3)
	Namespace string `json:"namespace,omitempty"`

	// Rego query path
	Query string `json:"query,omitempty"`

	// Expected value
	Expected string `json:"expected,omitempty"`

	// Actual value
	Actual string `json:"actual,omitempty"`

	// Cause description
	Cause string `json:"cause,omitempty"`
}

type NFTCollectionDetails struct {
	// Collection name
	Name string `json:"name,omitempty"`

	// Collection symbol
	Symbol string `json:"symbol,omitempty"`

	// Token standard: erc721, erc1155
	Standard string `json:"standard,omitempty"`

	// Total supply
	TotalSupply int64 `json:"total_supply,omitempty"`

	// Max supply
	MaxSupply int64 `json:"max_supply,omitempty"`

	// Unique holders
	HolderCount int64 `json:"holder_count,omitempty"`

	// Floor price (in native token)
	FloorPrice string `json:"floor_price,omitempty"`

	// Floor price USD
	FloorPriceUSD float64 `json:"floor_price_usd,omitempty"`

	// Total volume (in native token)
	TotalVolume string `json:"total_volume,omitempty"`

	// Total volume USD
	TotalVolumeUSD float64 `json:"total_volume_usd,omitempty"`

	// Royalty percentage
	RoyaltyPercent float64 `json:"royalty_percent,omitempty"`

	// Royalty recipient
	RoyaltyRecipient string `json:"royalty_recipient,omitempty"`

	// Marketplace URLs
	Marketplaces []string `json:"marketplaces,omitempty"`

	// Is revealed
	Revealed bool `json:"revealed,omitempty"`

	// Base URI
	BaseURI string `json:"base_uri,omitempty"`

	// Metadata storage: ipfs, arweave, centralized
	MetadataStorage string `json:"metadata_storage,omitempty"`

	// Creator address
	Creator string `json:"creator,omitempty"`
}

type OpenPortInput struct {
	Host     string
	IP       string
	Port     int
	Protocol string
	Service  string
	Version  string
	Banner   string
}

type OracleManipulationIssue struct {
	// Oracle type: chainlink, uniswap_twap, custom
	OracleType string `json:"oracle_type,omitempty"`

	// Oracle address
	OracleAddress string `json:"oracle_address,omitempty"`

	// Manipulation method: flash_loan, sandwich, time_manipulation
	ManipulationMethod string `json:"manipulation_method,omitempty"`

	// Price impact possible
	PriceImpactPercent float64 `json:"price_impact_percent,omitempty"`

	// Missing checks
	MissingChecks []string `json:"missing_checks,omitempty"`
}

type PortInfo struct {
	Port     int    `json:"port"`
	Protocol string `json:"protocol,omitempty"` // tcp, udp
	State    string `json:"state,omitempty"`    // open, filtered, closed
	Service  string `json:"service,omitempty"`  // http, ssh, etc.
	Banner   string `json:"banner,omitempty"`
	Version  string `json:"version,omitempty"`
}

type Properties map[string]any

type ReconConverterOptions struct {
	// Source tracking
	DiscoverySource string // "agent", "integration", "manual"
	DiscoveryTool   string // Scanner name

	// Default values
	DefaultCriticality Criticality
	DefaultConfidence  int // 0-100

	// Asset grouping
	GroupByDomain bool // Group subdomains under root domain asset
	GroupByIP     bool // Group ports under IP asset

	// Filtering
	MinConfidence int // Minimum confidence to include
}

type ReconToCTISInput struct {
	// Scanner info
	ScannerName    string
	ScannerVersion string
	ReconType      string // subdomain, dns, port, http_probe, url_crawl

	// Target
	Target string

	// Timing
	StartedAt  int64
	FinishedAt int64
	DurationMs int64

	// Results
	Subdomains   []SubdomainInput
	DNSRecords   []DNSRecordInput
	OpenPorts    []OpenPortInput
	LiveHosts    []LiveHostInput
	URLs         []DiscoveredURLInput
	Technologies []TechnologyInput
}

type ReentrancyIssue struct {
	// Reentrancy type: cross_function, cross_contract, read_only
	Type string `json:"type,omitempty"`

	// Vulnerable external call
	ExternalCall string `json:"external_call,omitempty"`

	// State variable modified after call
	StateModifiedAfterCall string `json:"state_modified_after_call,omitempty"`

	// Entry point function
	EntryPoint string `json:"entry_point,omitempty"`

	// Callback function
	Callback string `json:"callback,omitempty"`

	// Max reentrancy depth possible
	MaxDepth int `json:"max_depth,omitempty"`
}

type Remediation struct {
	// Short recommendation
	Recommendation string `json:"recommendation,omitempty"`

	// Detailed fix steps
	Steps []string `json:"steps,omitempty"`

	// Effort estimate: trivial, low, medium, high
	Effort string `json:"effort,omitempty"`

	// Fix available
	FixAvailable bool `json:"fix_available,omitempty"`

	// Auto-fixable
	AutoFixable bool `json:"auto_fixable,omitempty"`

	// Suggested fix code - the actual code to replace the vulnerable code
	// For SAST tools like Semgrep that provide auto-fix suggestions
	FixCode string `json:"fix_code,omitempty"`

	// Regex-based fix pattern (for tools that provide regex replacements)
	FixRegex *FixRegex `json:"fix_regex,omitempty"`

	// Reference URLs
	References []string `json:"references,omitempty"`
}

type RemediationContext struct {
	// Remediation type: patch, upgrade, workaround, config_change, mitigate, accept_risk
	Type string `json:"type,omitempty"`

	// Estimated time to fix in minutes
	EstimatedMinutes int `json:"estimated_minutes,omitempty"`

	// Fix complexity: simple, moderate, complex
	Complexity string `json:"complexity,omitempty"`

	// Is a remedy (patch/fix) available
	RemedyAvailable bool `json:"remedy_available,omitempty"`
}

type Report struct {
	// Schema version (required)
	Version string `json:"version"`

	// Schema URL for validation (optional)
	Schema string `json:"$schema,omitempty"`

	// Report metadata
	Metadata ReportMetadata `json:"metadata"`

	// Tool information (for collector/scanner reports)
	Tool *Tool `json:"tool,omitempty"`

	// Assets discovered/collected
	Assets []Asset `json:"assets,omitempty"`

	// Findings discovered
	Findings []Finding `json:"findings,omitempty"`

	// Dependencies (SBOM)
	Dependencies []Dependency `json:"dependencies,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type ReportMetadata struct {
	// Unique identifier for this report/scan (recommended)
	ID string `json:"id,omitempty"`

	// Timestamp when the report was generated (required)
	Timestamp time.Time `json:"timestamp"`

	// Duration of the scan/collection in milliseconds (optional)
	DurationMs int `json:"duration_ms,omitempty"`

	// Source type: scanner, collector, integration, manual
	SourceType string `json:"source_type,omitempty"`

	// External reference (job ID, scan ID)
	SourceRef string `json:"source_ref,omitempty"`

	// Coverage type: full, incremental, partial
	// - full: Complete scan of entire scope (enables auto-resolve)
	// - incremental: Diff scan of changed files only (no auto-resolve)
	// - partial: Partial scan of specific directories (no auto-resolve)
	CoverageType string `json:"coverage_type,omitempty"`

	// Branch information for git-based scans
	// Used for branch-aware finding lifecycle management
	Branch *BranchInfo `json:"branch,omitempty"`

	// Target scope of the scan/collection
	Scope *Scope `json:"scope,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type RepositoryTechnical struct {
	// SCM platform: github, gitlab, bitbucket
	Platform string `json:"platform,omitempty"`

	// Organization/owner
	Owner string `json:"owner,omitempty"`

	// Repository name
	Name string `json:"name,omitempty"`

	// Default branch
	DefaultBranch string `json:"default_branch,omitempty"`

	// Repository visibility: public, private, internal
	Visibility string `json:"visibility,omitempty"`

	// Repository URL
	URL string `json:"url,omitempty"`

	// Clone URL
	CloneURL string `json:"clone_url,omitempty"`

	// Language breakdown
	Languages map[string]int `json:"languages,omitempty"`

	// Stars count
	Stars int `json:"stars,omitempty"`

	// Forks count
	Forks int `json:"forks,omitempty"`

	// Last commit SHA
	LastCommitSHA string `json:"last_commit_sha,omitempty"`

	// Last commit date
	LastCommitAt *time.Time `json:"last_commit_at,omitempty"`
}

type SARIFArtifact struct {
	Location SARIFArtifactLocation `json:"location"`
}

type SARIFArtifactLocation struct {
	URI       string `json:"uri"`
	URIBaseId string `json:"uriBaseId,omitempty"`
}

type SARIFDriver struct {
	Name            string      `json:"name"`
	Version         string      `json:"version,omitempty"`
	SemanticVersion string      `json:"semanticVersion,omitempty"`
	InformationURI  string      `json:"informationUri,omitempty"`
	Rules           []SARIFRule `json:"rules,omitempty"`
}

type SARIFInvocation struct {
	ExecutionSuccessful bool   `json:"executionSuccessful"`
	CommandLine         string `json:"commandLine,omitempty"`
}

type SARIFLocation struct {
	PhysicalLocation *SARIFPhysicalLocation `json:"physicalLocation,omitempty"`
}

type SARIFLog struct {
	Version string     `json:"version"`
	Schema  string     `json:"$schema,omitempty"`
	Runs    []SARIFRun `json:"runs"`
}

type SARIFMessage struct {
	Text string `json:"text"`
}

type SARIFPhysicalLocation struct {
	ArtifactLocation *SARIFArtifactLocation `json:"artifactLocation,omitempty"`
	Region           *SARIFRegion           `json:"region,omitempty"`
}

type SARIFRegion struct {
	StartLine   int           `json:"startLine,omitempty"`
	EndLine     int           `json:"endLine,omitempty"`
	StartColumn int           `json:"startColumn,omitempty"`
	EndColumn   int           `json:"endColumn,omitempty"`
	Snippet     *SARIFSnippet `json:"snippet,omitempty"`
}

type SARIFResult struct {
	RuleID       string            `json:"ruleId"`
	RuleIndex    int               `json:"ruleIndex,omitempty"`
	Level        string            `json:"level,omitempty"`
	Message      SARIFMessage      `json:"message"`
	Locations    []SARIFLocation   `json:"locations,omitempty"`
	Fingerprints map[string]string `json:"fingerprints,omitempty"`
	Properties   map[string]any    `json:"properties,omitempty"`
}

type SARIFRule struct {
	ID                   string           `json:"id"`
	Name                 string           `json:"name,omitempty"`
	ShortDescription     *SARIFMessage    `json:"shortDescription,omitempty"`
	FullDescription      *SARIFMessage    `json:"fullDescription,omitempty"`
	HelpURI              string           `json:"helpUri,omitempty"`
	Help                 *SARIFMessage    `json:"help,omitempty"`
	DefaultConfiguration *SARIFRuleConfig `json:"defaultConfiguration,omitempty"`
	Properties           map[string]any   `json:"properties,omitempty"`
}

type SARIFRuleConfig struct {
	Level string `json:"level,omitempty"`
}

type SARIFRun struct {
	Tool        SARIFTool         `json:"tool"`
	Results     []SARIFResult     `json:"results"`
	Artifacts   []SARIFArtifact   `json:"artifacts,omitempty"`
	Invocations []SARIFInvocation `json:"invocations,omitempty"`
}

type SARIFSnippet struct {
	Text string `json:"text"`
}

type SARIFTool struct {
	Driver SARIFDriver `json:"driver"`
}

type Scope struct {
	// Scope name or identifier
	Name string `json:"name,omitempty"`

	// Scope type: domain, network, repository, cloud_account
	Type string `json:"type,omitempty"`

	// Included targets
	Includes []string `json:"includes,omitempty"`

	// Excluded targets
	Excludes []string `json:"excludes,omitempty"`
}

type SecretDetails struct {
	// Secret type: api_key, password, token, certificate, private_key, etc.
	SecretType string `json:"secret_type,omitempty"`

	// Service associated with the secret: aws, github, stripe, gcp, azure, etc.
	Service string `json:"service,omitempty"`

	// Masked value (first and last few chars)
	MaskedValue string `json:"masked_value,omitempty"`

	// Length of the secret
	Length int `json:"length,omitempty"`

	// Entropy score
	Entropy float64 `json:"entropy,omitempty"`

	// Is valid (if verification was performed)
	Valid *bool `json:"valid,omitempty"`

	// Verification timestamp
	VerifiedAt *time.Time `json:"verified_at,omitempty"`

	// Is revoked
	Revoked bool `json:"revoked,omitempty"`

	// When the secret was revoked
	RevokedAt *time.Time `json:"revoked_at,omitempty"`

	// Secret scope/permissions (e.g., "read:org", "repo", "admin")
	Scopes []string `json:"scopes,omitempty"`

	// Expiration date (if known)
	ExpiresAt *time.Time `json:"expires_at,omitempty"`

	// Secret age (how long since creation, if known)
	AgeInDays int `json:"age_in_days,omitempty"`

	// Rotation recommended by date
	RotationDueAt *time.Time `json:"rotation_due_at,omitempty"`

	// Is the secret in git history only (not in current HEAD)
	InHistoryOnly bool `json:"in_history_only,omitempty"`

	// Commit count where this secret appears
	CommitCount int `json:"commit_count,omitempty"`
}

type ServiceInfo struct {
	// Port number
	Port int `json:"port"`

	// Transport protocol: tcp, udp
	Protocol string `json:"protocol,omitempty"`

	// Service type: http, https, ssh, ftp, mysql, postgresql, etc.
	ServiceType string `json:"service_type,omitempty"`

	// Product name: Apache, nginx, OpenSSH, etc.
	Product string `json:"product,omitempty"`

	// Product version
	Version string `json:"version,omitempty"`

	// Service banner
	Banner string `json:"banner,omitempty"`

	// Common Platform Enumeration identifier
	CPE string `json:"cpe,omitempty"`

	// Is this service publicly accessible from the internet
	IsPublic bool `json:"is_public,omitempty"`

	// TLS enabled
	TLSEnabled bool `json:"tls_enabled,omitempty"`

	// TLS version: TLS 1.2, TLS 1.3
	TLSVersion string `json:"tls_version,omitempty"`

	// Service state: active, inactive, filtered
	State string `json:"state,omitempty"`
}

type ServiceTechnical struct {
	// Service name
	Name string `json:"name,omitempty"`

	// Service version
	Version string `json:"version,omitempty"`

	// Port
	Port int `json:"port,omitempty"`

	// Protocol (application-layer): http, https, ssh, smtp, ftp, dns, ldap, smb, rdp, mysql, postgresql, mongodb, redis, etc.
	Protocol string `json:"protocol,omitempty"`

	// Transport: tcp, udp
	Transport string `json:"transport,omitempty"`

	// SSL/TLS enabled
	TLS bool `json:"tls,omitempty"`

	// TLS version: tls1.0, tls1.1, tls1.2, tls1.3
	TLSVersion string `json:"tls_version,omitempty"`

	// TLS certificate info (for services with TLS)
	TLSCertSubject string `json:"tls_cert_subject,omitempty"`
	TLSCertIssuer  string `json:"tls_cert_issuer,omitempty"`
	TLSCertExpiry  string `json:"tls_cert_expiry,omitempty"`

	// Banner/fingerprint
	Banner string `json:"banner,omitempty"`

	// Product name (e.g., "OpenSSH", "nginx", "Apache", "Postfix")
	Product string `json:"product,omitempty"`

	// CPE (Common Platform Enumeration) identifier
	CPE string `json:"cpe,omitempty"`

	// Extra info
	ExtraInfo string `json:"extra_info,omitempty"`

	// Service state: open, filtered, closed
	State string `json:"state,omitempty"`

	// Authentication required
	AuthRequired bool `json:"auth_required,omitempty"`

	// Authentication methods supported (e.g., ["password", "publickey"] for SSH)
	AuthMethods []string `json:"auth_methods,omitempty"`

	// Default credentials detected
	DefaultCredentials bool `json:"default_credentials,omitempty"`

	// Anonymous access allowed (for FTP, SMB, etc.)
	AnonymousAccess bool `json:"anonymous_access,omitempty"`

	// Response time in milliseconds
	ResponseTimeMs int `json:"response_time_ms,omitempty"`

	// Last seen timestamp
	LastSeen string `json:"last_seen,omitempty"`

	// Service-specific details (protocol-dependent)
	// For HTTP: methods, headers, etc.
	// For SMTP: EHLO response, supported extensions
	// For SSH: supported algorithms, host keys
	Details map[string]any `json:"details,omitempty"`
}

type Severity string

type SmartContractDetails struct {
	// Contract name
	Name string `json:"name,omitempty"`

	// Contract address
	Address string `json:"address,omitempty"`

	// Deployer address
	DeployerAddress string `json:"deployer_address,omitempty"`

	// Deployment transaction hash
	DeploymentTxHash string `json:"deployment_tx_hash,omitempty"`

	// Deployment block number
	DeploymentBlock int64 `json:"deployment_block,omitempty"`

	// Deployment timestamp
	DeployedAt *time.Time `json:"deployed_at,omitempty"`

	// Is verified on explorer (etherscan, etc.)
	Verified bool `json:"verified,omitempty"`

	// Compiler version
	CompilerVersion string `json:"compiler_version,omitempty"`

	// EVM version
	EVMVersion string `json:"evm_version,omitempty"`

	// Optimization enabled
	OptimizationEnabled bool `json:"optimization_enabled,omitempty"`

	// Optimization runs
	OptimizationRuns int `json:"optimization_runs,omitempty"`

	// Contract type: erc20, erc721, erc1155, proxy, multisig, defi, custom
	ContractType string `json:"contract_type,omitempty"`

	// Is proxy contract
	IsProxy bool `json:"is_proxy,omitempty"`

	// Implementation address (for proxy contracts)
	ImplementationAddress string `json:"implementation_address,omitempty"`

	// Proxy type: transparent, uups, beacon, diamond
	ProxyType string `json:"proxy_type,omitempty"`

	// Is upgradeable
	IsUpgradeable bool `json:"is_upgradeable,omitempty"`

	// Owner/admin address
	OwnerAddress string `json:"owner_address,omitempty"`

	// Has renounced ownership
	OwnershipRenounced bool `json:"ownership_renounced,omitempty"`

	// Source code URL (GitHub, etc.)
	SourceCodeURL string `json:"source_code_url,omitempty"`

	// ABI (JSON string or base64 encoded)
	ABI string `json:"abi,omitempty"`

	// Bytecode hash (keccak256)
	BytecodeHash string `json:"bytecode_hash,omitempty"`

	// Source code hash
	SourceCodeHash string `json:"source_code_hash,omitempty"`

	// License type: MIT, GPL, UNLICENSED, etc.
	License string `json:"license,omitempty"`

	// External libraries used
	Libraries []ContractLibrary `json:"libraries,omitempty"`

	// Implemented interfaces: ERC20, ERC721, etc.
	Interfaces []string `json:"interfaces,omitempty"`

	// Contract balance (in wei)
	Balance string `json:"balance,omitempty"`

	// Total transactions
	TxCount int64 `json:"tx_count,omitempty"`
}

type StackFrame struct {
	// Location of this frame
	Location *FindingLocation `json:"location,omitempty"`

	// Module/library name
	Module string `json:"module,omitempty"`

	// Thread ID
	ThreadID int `json:"thread_id,omitempty"`

	// Function parameters
	Parameters []string `json:"parameters,omitempty"`
}

type StackTrace struct {
	// Stack description/message
	Message string `json:"message,omitempty"`

	// Stack frames from innermost to outermost
	Frames []*StackFrame `json:"frames,omitempty"`
}

type SubdomainInput struct {
	Host   string
	Domain string
	Source string
	IPs    []string
}

type Suppression struct {
	// Suppression kind: in_source, external
	Kind string `json:"kind,omitempty"`

	// Suppression status: accepted, under_review, rejected
	Status string `json:"status,omitempty"`

	// Justification for suppression
	Justification string `json:"justification,omitempty"`

	// Who suppressed the finding
	SuppressedBy string `json:"suppressed_by,omitempty"`

	// When the finding was suppressed
	SuppressedAt *time.Time `json:"suppressed_at,omitempty"`
}

type TechnologyInput struct {
	Name       string
	Version    string
	Categories []string
	Confidence int
	Website    string
}

type TokenBalance struct {
	// Token contract address
	ContractAddress string `json:"contract_address"`

	// Token symbol
	Symbol string `json:"symbol,omitempty"`

	// Token name
	Name string `json:"name,omitempty"`

	// Token decimals
	Decimals int `json:"decimals,omitempty"`

	// Balance (raw value)
	Balance string `json:"balance"`

	// Balance formatted (human readable)
	BalanceFormatted string `json:"balance_formatted,omitempty"`

	// USD value
	USDValue float64 `json:"usd_value,omitempty"`
}

type TokenDetails struct {
	// Token standard: erc20, erc721, erc1155, bep20, spl
	Standard string `json:"standard,omitempty"`

	// Token symbol
	Symbol string `json:"symbol,omitempty"`

	// Token name
	Name string `json:"name,omitempty"`

	// Token decimals
	Decimals int `json:"decimals,omitempty"`

	// Total supply (raw value)
	TotalSupply string `json:"total_supply,omitempty"`

	// Max supply (if applicable)
	MaxSupply string `json:"max_supply,omitempty"`

	// Is mintable
	Mintable bool `json:"mintable,omitempty"`

	// Is burnable
	Burnable bool `json:"burnable,omitempty"`

	// Is pausable
	Pausable bool `json:"pausable,omitempty"`

	// Has blacklist/whitelist
	HasBlacklist bool `json:"has_blacklist,omitempty"`

	// Has transfer fee/tax
	HasTransferFee bool `json:"has_transfer_fee,omitempty"`

	// Transfer fee percentage
	TransferFeePercent float64 `json:"transfer_fee_percent,omitempty"`

	// Holder count
	HolderCount int64 `json:"holder_count,omitempty"`

	// Market cap USD
	MarketCapUSD float64 `json:"market_cap_usd,omitempty"`

	// Price USD
	PriceUSD float64 `json:"price_usd,omitempty"`

	// Liquidity USD
	LiquidityUSD float64 `json:"liquidity_usd,omitempty"`

	// Trading pairs
	TradingPairs []TradingPair `json:"trading_pairs,omitempty"`

	// Is honeypot
	IsHoneypot bool `json:"is_honeypot,omitempty"`

	// Honeypot reason
	HoneypotReason string `json:"honeypot_reason,omitempty"`
}

type Tool struct {
	// Tool name (required)
	Name string `json:"name"`

	// Tool version (recommended)
	Version string `json:"version,omitempty"`

	// Tool vendor/organization
	Vendor string `json:"vendor,omitempty"`

	// Tool information URL
	InfoURL string `json:"info_url,omitempty"`

	// Tool capabilities
	Capabilities []string `json:"capabilities,omitempty"`

	// Custom properties
	Properties Properties `json:"properties,omitempty"`
}

type TradingPair struct {
	// DEX name: uniswap, sushiswap, pancakeswap, etc.
	DEX string `json:"dex"`

	// Pair address
	PairAddress string `json:"pair_address"`

	// Quote token symbol (WETH, USDT, etc.)
	QuoteToken string `json:"quote_token"`

	// Liquidity USD
	LiquidityUSD float64 `json:"liquidity_usd,omitempty"`
}

type VulnDataSource struct {
	// Data source ID (e.g., "nvd", "ghsa", "osv")
	ID string `json:"id,omitempty"`

	// Data source name
	Name string `json:"name,omitempty"`

	// Data source URL
	URL string `json:"url,omitempty"`
}

type VulnerabilityDetails struct {
	// CVE ID
	CVEID string `json:"cve_id,omitempty"`

	// CWE IDs (can have multiple)
	CWEIDs []string `json:"cwe_ids,omitempty"`

	// CWE ID (single, for backward compatibility)
	CWEID string `json:"cwe_id,omitempty"`

	// OWASP IDs (e.g., "A01:2021", "A03:2021")
	OWASPIDs []string `json:"owasp_ids,omitempty"`

	// ASVS (Application Security Verification Standard) compliance info
	ASVS *ASVSInfo `json:"asvs,omitempty"`

	// CVSS version (2.0, 3.0, 3.1, 4.0)
	CVSSVersion string `json:"cvss_version,omitempty"`

	// CVSS score
	CVSSScore float64 `json:"cvss_score,omitempty"`

	// CVSS vector
	CVSSVector string `json:"cvss_vector,omitempty"`

	// CVSS data source: nvd, ghsa, redhat, bitnami
	CVSSSource string `json:"cvss_source,omitempty"`

	// Affected package
	Package string `json:"package,omitempty"`

	// Package URL (PURL spec) e.g., pkg:npm/lodash@4.17.20
	PURL string `json:"purl,omitempty"`

	// Affected version
	AffectedVersion string `json:"affected_version,omitempty"`

	// Affected version range (semver format)
	AffectedVersionRange string `json:"affected_version_range,omitempty"`

	// Fixed version
	FixedVersion string `json:"fixed_version,omitempty"`

	// All available fixed versions
	FixedVersions []string `json:"fixed_versions,omitempty"`

	// Ecosystem: npm, pip, maven, cargo, go, nuget, etc.
	Ecosystem string `json:"ecosystem,omitempty"`

	// Vulnerability published date
	PublishedAt *time.Time `json:"published_at,omitempty"`

	// Last modified date
	ModifiedAt *time.Time `json:"modified_at,omitempty"`

	// Exploit available
	ExploitAvailable bool `json:"exploit_available,omitempty"`

	// Exploit maturity: none, poc, functional, weaponized
	ExploitMaturity string `json:"exploit_maturity,omitempty"`

	// In CISA KEV (Known Exploited Vulnerabilities)
	InCISAKEV bool `json:"in_cisa_kev,omitempty"`

	// EPSS score (Exploit Prediction Scoring System)
	EPSSScore float64 `json:"epss_score,omitempty"`

	// EPSS percentile
	EPSSPercentile float64 `json:"epss_percentile,omitempty"`

	// Affected CPE
	CPE string `json:"cpe,omitempty"`

	// Advisory URLs
	Advisories []string `json:"advisories,omitempty"`

	// Is direct dependency (vs transitive)
	IsDirect bool `json:"is_direct,omitempty"`

	// Dependency path for transitive vulnerabilities
	DependencyPath []string `json:"dependency_path,omitempty"`

	// Data source information (vulnerability database)
	DataSource *VulnDataSource `json:"data_source,omitempty"`

	// Severity source (who assigned the severity: nvd, ghsa, redhat, etc.)
	SeveritySource string `json:"severity_source,omitempty"`

	// Vendor-specific severity mapping (vendor -> severity level 1-5)
	VendorSeverity map[string]int `json:"vendor_severity,omitempty"`

	// Container layer information (for image scans)
	Layer *ContainerLayer `json:"layer,omitempty"`

	// Aqua Vulnerability Database ID (e.g., AVD-AWS-0001)
	AVDID string `json:"avd_id,omitempty"`

	// Vulnerability status: affected, fixed, under_investigation, will_not_fix
	VulnStatus string `json:"vuln_status,omitempty"`
}

type WalletDetails struct {
	// Wallet type: eoa, multisig, smart_wallet, mpc
	WalletType string `json:"wallet_type,omitempty"`

	// For multisig: required signatures
	RequiredSignatures int `json:"required_signatures,omitempty"`

	// For multisig: total owners
	TotalOwners int `json:"total_owners,omitempty"`

	// Owner addresses (for multisig)
	Owners []string `json:"owners,omitempty"`

	// Wallet provider: metamask, ledger, safe, argent, etc.
	Provider string `json:"provider,omitempty"`

	// Balance (native token, in wei)
	Balance string `json:"balance,omitempty"`

	// Token balances
	TokenBalances []TokenBalance `json:"token_balances,omitempty"`

	// NFT count
	NFTCount int `json:"nft_count,omitempty"`

	// First transaction timestamp
	FirstTxAt *time.Time `json:"first_tx_at,omitempty"`

	// Last transaction timestamp
	LastTxAt *time.Time `json:"last_tx_at,omitempty"`

	// Total transactions
	TxCount int64 `json:"tx_count,omitempty"`

	// ENS name (if applicable)
	ENSName string `json:"ens_name,omitempty"`

	// Labels (exchange, whale, hacker, etc.)
	Labels []string `json:"labels,omitempty"`
}

type Web3POC struct {
	// POC type: transaction, script, foundry_test, hardhat_test
	Type string `json:"type,omitempty"`

	// POC code or script
	Code string `json:"code,omitempty"`

	// POC transaction data
	TxData string `json:"tx_data,omitempty"`

	// Expected outcome
	ExpectedOutcome string `json:"expected_outcome,omitempty"`

	// Tested on: mainnet_fork, testnet, local
	TestedOn string `json:"tested_on,omitempty"`

	// Fork block number (for mainnet fork tests)
	ForkBlockNumber int64 `json:"fork_block_number,omitempty"`
}

type Web3Technical struct {
	// Blockchain network: ethereum, polygon, bsc, arbitrum, optimism, avalanche, solana, etc.
	Chain string `json:"chain,omitempty"`

	// Chain ID (EVM chains): 1 (mainnet), 137 (polygon), 56 (bsc), etc.
	ChainID int64 `json:"chain_id,omitempty"`

	// Network type: mainnet, testnet, devnet
	NetworkType string `json:"network_type,omitempty"`

	// Contract/wallet address
	Address string `json:"address,omitempty"`

	// For smart contracts
	Contract *SmartContractDetails `json:"contract,omitempty"`

	// For wallets
	Wallet *WalletDetails `json:"wallet,omitempty"`

	// For tokens (ERC-20, ERC-721, etc.)
	Token *TokenDetails `json:"token,omitempty"`

	// For DeFi protocols
	DeFi *DeFiDetails `json:"defi,omitempty"`

	// For NFT collections
	NFT *NFTCollectionDetails `json:"nft,omitempty"`
}

type Web3VulnerabilityClass string

type Web3VulnerabilityDetails struct {
	// Vulnerability class/category (SWC ID or custom)
	// Common: reentrancy, overflow, access_control, front_running, etc.
	VulnerabilityClass string `json:"vulnerability_class,omitempty"`

	// SWC Registry ID (e.g., SWC-107 for reentrancy)
	SWCID string `json:"swc_id,omitempty"`

	// Contract address affected
	ContractAddress string `json:"contract_address,omitempty"`

	// Chain ID
	ChainID int64 `json:"chain_id,omitempty"`

	// Chain name
	Chain string `json:"chain,omitempty"`

	// Affected function signature
	FunctionSignature string `json:"function_signature,omitempty"`

	// Affected function selector (4 bytes)
	FunctionSelector string `json:"function_selector,omitempty"`

	// Vulnerable code pattern
	VulnerablePattern string `json:"vulnerable_pattern,omitempty"`

	// Bytecode offset (if found in bytecode analysis)
	BytecodeOffset int `json:"bytecode_offset,omitempty"`

	// Is exploitable on mainnet
	ExploitableOnMainnet bool `json:"exploitable_on_mainnet,omitempty"`

	// Estimated impact in USD (if quantifiable)
	EstimatedImpactUSD float64 `json:"estimated_impact_usd,omitempty"`

	// Affected assets value in USD
	AffectedValueUSD float64 `json:"affected_value_usd,omitempty"`

	// Attack vector description
	AttackVector string `json:"attack_vector,omitempty"`

	// Proof of concept (if available)
	POC *Web3POC `json:"poc,omitempty"`

	// Related transaction hashes (if exploit occurred)
	RelatedTxHashes []string `json:"related_tx_hashes,omitempty"`

	// Attacker addresses (if known)
	AttackerAddresses []string `json:"attacker_addresses,omitempty"`

	// Tool that found this: slither, mythril, securify, manticore, etc.
	DetectionTool string `json:"detection_tool,omitempty"`

	// Detection confidence: high, medium, low
	DetectionConfidence string `json:"detection_confidence,omitempty"`

	// Is false positive
	IsFalsePositive bool `json:"is_false_positive,omitempty"`

	// Gas optimization issues (for gas-related findings)
	GasIssue *GasIssue `json:"gas_issue,omitempty"`

	// Access control details
	AccessControl *AccessControlIssue `json:"access_control,omitempty"`

	// Reentrancy details
	Reentrancy *ReentrancyIssue `json:"reentrancy,omitempty"`

	// Oracle manipulation details
	OracleManipulation *OracleManipulationIssue `json:"oracle_manipulation,omitempty"`

	// Flash loan attack details
	FlashLoan *FlashLoanIssue `json:"flash_loan,omitempty"`
}