core

type APIKeyHinter interface {
	APIKeyHint() string
}

type Adapter interface {
	// Name returns the adapter name (e.g., "sarif", "cyclonedx")
	Name() string

	// InputFormats returns supported input formats
	InputFormats() []string

	// OutputFormat returns the output format (usually "ctis")
	OutputFormat() string

	// CanConvert checks if the input can be converted
	CanConvert(input []byte) bool

	// Convert transforms input to CTIS Report
	Convert(ctx context.Context, input []byte, opts *AdapterOptions) (*ctis.Report, error)
}

type AdapterOptions struct {
	// Source information
	SourceName string `yaml:"source_name" json:"source_name"`
	SourceType string `yaml:"source_type" json:"source_type"`

	// Target repository/asset info
	Repository string `yaml:"repository" json:"repository"`
	Branch     string `yaml:"branch" json:"branch"`
	CommitSHA  string `yaml:"commit_sha" json:"commit_sha"`

	// Filtering
	MinSeverity string `yaml:"min_severity" json:"min_severity"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type AssetResolver func(scanner, target string) (ctis.AssetType, string)

type AuthGate struct {
	// contains filtered or unexported fields
}

type AuthGateConfig struct {
	// BackoffBase is the first re-check delay after a rejection.
	BackoffBase time.Duration
	// BackoffMax caps the re-check delay.
	BackoffMax time.Duration
	// Logger receives the state changes. Nil logs to stderr with timestamps.
	Logger *log.Logger
}

type BaseCollector struct {
	// contains filtered or unexported fields
}

type BaseCollectorConfig struct {
	Name       string            `yaml:"name" json:"name"`
	SourceType string            `yaml:"source_type" json:"source_type"`
	BaseURL    string            `yaml:"base_url" json:"base_url"`
	APIKey     string            `yaml:"api_key" json:"api_key"`
	Headers    map[string]string `yaml:"headers" json:"headers"`
	Timeout    time.Duration     `yaml:"timeout" json:"timeout"`
	Verbose    bool              `yaml:"verbose" json:"verbose"`
}

type BaseParser struct {
	// contains filtered or unexported fields
}

type BaseProcessor struct {
	// contains filtered or unexported fields
}

type BaseScanner struct {
	// contains filtered or unexported fields
}

type BaseScannerConfig struct {
	Name         string            `yaml:"name" json:"name"`
	Version      string            `yaml:"version" json:"version"`
	Binary       string            `yaml:"binary" json:"binary"`
	DefaultArgs  []string          `yaml:"default_args" json:"default_args"`
	Timeout      time.Duration     `yaml:"timeout" json:"timeout"`
	OKExitCodes  []int             `yaml:"ok_exit_codes" json:"ok_exit_codes"`
	Capabilities []string          `yaml:"capabilities" json:"capabilities"`
	WorkDir      string            `yaml:"work_dir" json:"work_dir"`
	Env          map[string]string `yaml:"env" json:"env"`
	Verbose      bool              `yaml:"verbose" json:"verbose"`
}

type BaseSensor struct {
	// contains filtered or unexported fields
}

type BaseSensorConfig struct {
	Name              string        `yaml:"name" json:"name"`
	Version           string        `yaml:"version" json:"version"`
	Region            string        `yaml:"region" json:"region"` // Deployment region (e.g., "us-east-1", "ap-southeast-1")
	ScanInterval      time.Duration `yaml:"scan_interval" json:"scan_interval"`
	CollectInterval   time.Duration `yaml:"collect_interval" json:"collect_interval"`
	HeartbeatInterval time.Duration `yaml:"heartbeat_interval" json:"heartbeat_interval"`
	Targets           []string      `yaml:"targets" json:"targets"`
	Verbose           bool          `yaml:"verbose" json:"verbose"`
}

type CVSSData struct {
	Source CVSSSource `json:"source"`
	Score  float64    `json:"score"`
	Vector string     `json:"vector"`
}

type CVSSSource string

type CacheStats struct {
	TemplateCount int            `json:"template_count"`
	TotalSize     int64          `json:"total_size"`
	TenantCount   map[string]int `json:"tenant_count"`
	TypeCount     map[string]int `json:"type_count"`
	OldestEntry   time.Time      `json:"oldest_entry"`
	NewestEntry   time.Time      `json:"newest_entry"`
}

type CachedTemplateMetadata struct {
	ID           string    `json:"id"`
	Name         string    `json:"name"`
	TemplateType string    `json:"template_type"`
	ContentHash  string    `json:"content_hash"`
	TenantID     string    `json:"tenant_id"`
	FilePath     string    `json:"file_path"`
	Size         int64     `json:"size"`
	CachedAt     time.Time `json:"cached_at"`
	LastUsedAt   time.Time `json:"last_used_at"`
}

type CollectCommandPayload struct {
	Collector    string                 `json:"collector"`
	SourceConfig map[string]interface{} `json:"source_config,omitempty"`
}

type CollectOptions struct {
	// Source configuration
	SourceURL string            `yaml:"source_url" json:"source_url"`
	APIKey    string            `yaml:"api_key" json:"api_key"`
	Headers   map[string]string `yaml:"headers" json:"headers"`
	Query     map[string]string `yaml:"query" json:"query"`

	// Filtering
	Since      int64    `yaml:"since" json:"since"` // Unix timestamp
	Repository string   `yaml:"repository" json:"repository"`
	Branches   []string `yaml:"branches" json:"branches"`

	// Pagination
	PageSize int `yaml:"page_size" json:"page_size"`
	MaxPages int `yaml:"max_pages" json:"max_pages"`
}

type CollectResult struct {
	// Source info
	SourceName string `json:"source_name"`
	SourceType string `json:"source_type"`

	// Collection timing
	CollectedAt int64 `json:"collected_at"`
	DurationMs  int64 `json:"duration_ms"`

	// Results
	Reports    []*ctis.Report `json:"reports"`
	TotalItems int            `json:"total_items"`
	ErrorItems int            `json:"error_items"`

	// Cursor for pagination
	NextCursor string `json:"next_cursor,omitempty"`
	HasMore    bool   `json:"has_more"`
}

type Collector interface {
	// Name returns the collector name
	Name() string

	// Type returns the source type (e.g., "github", "gitlab", "api")
	Type() string

	// Collect pulls data from the external source
	Collect(ctx context.Context, opts *CollectOptions) (*CollectResult, error)

	// TestConnection verifies the connection to the external source
	TestConnection(ctx context.Context) error
}

type Command struct {
	ID        string          `json:"id"`
	Type      string          `json:"type"`
	Priority  string          `json:"priority"`
	Payload   json.RawMessage `json:"payload"`
	CreatedAt time.Time       `json:"created_at"`
	ExpiresAt time.Time       `json:"expires_at"`
}

type CommandClient interface {
	GetCommands(ctx context.Context) (*GetCommandsResponse, error)
	AcknowledgeCommand(ctx context.Context, cmdID string) error
	StartCommand(ctx context.Context, cmdID string) error
	ReportCommandResult(ctx context.Context, cmdID string, result *CommandResult) error
	ReportCommandProgress(ctx context.Context, cmdID string, progress int, message string) error
}

type CommandExecutionResult struct {
	DurationMs    int64
	FindingsCount int
	ExitCode      int
	Metadata      map[string]interface{}
}

type CommandExecutor interface {
	Execute(ctx context.Context, cmd *Command) (*CommandExecutionResult, error)
}

type CommandPoller struct {
	// contains filtered or unexported fields
}

type CommandPollerConfig struct {
	PollInterval  time.Duration `yaml:"poll_interval" json:"poll_interval"`
	MaxConcurrent int           `yaml:"max_concurrent" json:"max_concurrent"`
	AllowedTypes  []string      `yaml:"allowed_types" json:"allowed_types"`
	Verbose       bool          `yaml:"verbose" json:"verbose"`
	// DoorbellSafetyPoll is how often the poller still polls on its own
	// while the heartbeat doorbell is active. Default 5m.
	DoorbellSafetyPoll time.Duration `yaml:"doorbell_safety_poll" json:"doorbell_safety_poll"`
}

type CommandResult struct {
	Status        string                 `json:"status"`
	CompletedAt   time.Time              `json:"completed_at"`
	DurationMs    int64                  `json:"duration_ms"`
	ExitCode      int                    `json:"exit_code"`
	FindingsCount int                    `json:"findings_count"`
	Error         string                 `json:"error,omitempty"`
	Metadata      map[string]interface{} `json:"metadata,omitempty"`
}

type Connector interface {
	// Name returns the connector name (e.g., "github", "gitlab")
	Name() string

	// Type returns the connector type (e.g., "scm", "cloud", "ticketing")
	Type() string

	// Connect establishes connection to the external system
	Connect(ctx context.Context) error

	// Close closes the connection
	Close() error

	// IsConnected returns true if connected
	IsConnected() bool

	// TestConnection verifies the connection is working
	TestConnection(ctx context.Context) error

	// HTTPClient returns the configured HTTP client (with auth headers)
	HTTPClient() *http.Client

	// RateLimited returns true if rate limiting is enabled
	RateLimited() bool

	// WaitForRateLimit blocks until rate limit allows next request
	WaitForRateLimit(ctx context.Context) error
}

type ConnectorConfig struct {
	// Authentication
	APIKey      string       `yaml:"api_key" json:"api_key"`
	Token       string       `yaml:"token" json:"token"`
	Username    string       `yaml:"username" json:"username"`
	Password    string       `yaml:"password" json:"password"`
	OAuthConfig *OAuthConfig `yaml:"oauth" json:"oauth,omitempty"`

	// Connection
	BaseURL string        `yaml:"base_url" json:"base_url"`
	Timeout time.Duration `yaml:"timeout" json:"timeout"`

	// Rate limiting
	RateLimit  int `yaml:"rate_limit" json:"rate_limit"`   // requests per hour
	BurstLimit int `yaml:"burst_limit" json:"burst_limit"` // burst size

	// Retry
	MaxRetries int           `yaml:"max_retries" json:"max_retries"`
	RetryDelay time.Duration `yaml:"retry_delay" json:"retry_delay"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type DNSRecord struct {
	Host       string   `json:"host"`                  // Hostname
	RecordType string   `json:"record_type"`           // A, AAAA, CNAME, MX, NS, TXT, SOA
	Values     []string `json:"values"`                // Record values
	TTL        int      `json:"ttl,omitempty"`         // Time to live
	Resolver   string   `json:"resolver,omitempty"`    // Resolver used
	StatusCode string   `json:"status_code,omitempty"` // NOERROR, NXDOMAIN, etc.
}

type DefaultCommandExecutor struct {
	// contains filtered or unexported fields
}

type DefaultLogger struct {
	// contains filtered or unexported fields
}

type DiscoveredURL struct {
	URL        string `json:"url"`              // Full URL
	Method     string `json:"method,omitempty"` // HTTP method (GET, POST, etc.)
	Source     string `json:"source,omitempty"` // Discovery source (crawl, js, archive)
	StatusCode int    `json:"status_code,omitempty"`
	Depth      int    `json:"depth,omitempty"`     // Crawl depth
	Parent     string `json:"parent,omitempty"`    // Parent URL
	Type       string `json:"type,omitempty"`      // endpoint, form, api, static
	Extension  string `json:"extension,omitempty"` // File extension
}

type Doorbell struct {
	// contains filtered or unexported fields
}

type DoorbellConfig struct {
	// OnRotateKey is called (in its own goroutine) when the platform sends
	// rotate_key, e.g. platform.KeyRenewManager.RenewNow. Nil: rotate_key is
	// logged and otherwise ignored.
	OnRotateKey func()
	// Logger receives the doorbell's state changes. Nil logs to stderr with
	// timestamps.
	Logger *log.Logger
	// Verbose also logs every heartbeat's hints.
	Verbose bool
}

type DoorbellPusher interface {
	SendHeartbeatWithHints(ctx context.Context, status *SensorStatus) (*HeartbeatHints, error)
}

type EmbeddedTemplate struct {
	ID           string `json:"id"`
	Name         string `json:"name"`
	TemplateType string `json:"template_type"` // nuclei, semgrep, betterleaks
	Content      string `json:"content"`       // Base64-encoded template content (YAML/TOML)
	ContentHash  string `json:"content_hash"`  // SHA256 hash of decoded content for verification
}

type Enricher interface {
	// Name returns the enricher name (e.g., "epss", "kev", "nvd")
	Name() string

	// Enrich adds threat intel to a single finding
	Enrich(ctx context.Context, finding *ctis.Finding) (*ctis.Finding, error)

	// EnrichBatch adds threat intel to multiple findings
	EnrichBatch(ctx context.Context, findings []ctis.Finding) ([]ctis.Finding, error)
}

type EnricherConfig struct {
	// API endpoint (optional, for custom sources)
	Endpoint string `yaml:"endpoint" json:"endpoint"`

	// Cache duration
	CacheTTL time.Duration `yaml:"cache_ttl" json:"cache_ttl"`

	// Rate limiting
	RateLimit int `yaml:"rate_limit" json:"rate_limit"`

	// Debug
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ExecConfig struct {
	Binary  string            // Scanner binary path
	Args    []string          // Command arguments
	WorkDir string            // Working directory
	Env     map[string]string // Extra environment variables (added to the allowlisted base, see ScannerEnviron)
	Timeout time.Duration     // Execution timeout
	Verbose bool              // Stream output to logs
}

type ExecResult struct {
	ExitCode   int
	Stdout     []byte
	Stderr     []byte
	DurationMs int64
	Error      error
}

type GetCommandsResponse struct {
	Commands            []*Command `json:"commands"`
	PollIntervalSeconds int        `json:"poll_interval_seconds,omitempty"`
}

type GitHubAlertInstance struct {
	Ref      string              `json:"ref"`
	State    string              `json:"state"`
	Location GitHubAlertLocation `json:"location"`
	Message  GitHubAlertMessage  `json:"message"`
}

type GitHubAlertLocation struct {
	Path        string `json:"path"`
	StartLine   int    `json:"start_line"`
	EndLine     int    `json:"end_line"`
	StartColumn int    `json:"start_column"`
	EndColumn   int    `json:"end_column"`
}

type GitHubAlertMessage struct {
	Text string `json:"text"`
}

type GitHubAlertRule struct {
	ID                    string   `json:"id"`
	Severity              string   `json:"severity"`
	SecuritySeverityLevel string   `json:"security_severity_level"`
	Description           string   `json:"description"`
	Tags                  []string `json:"tags"`
}

type GitHubAlertTool struct {
	Name    string `json:"name"`
	Version string `json:"version"`
}

type GitHubCodeScanningAlert struct {
	Number             int                 `json:"number"`
	State              string              `json:"state"`
	HTMLURL            string              `json:"html_url"`
	Rule               GitHubAlertRule     `json:"rule"`
	Tool               GitHubAlertTool     `json:"tool"`
	MostRecentInstance GitHubAlertInstance `json:"most_recent_instance"`
	CreatedAt          string              `json:"created_at"`
}

type GitHubCollector struct {
	*BaseCollector
	// contains filtered or unexported fields
}

type GitHubCollectorConfig struct {
	Token   string `yaml:"token" json:"token"`
	Owner   string `yaml:"owner" json:"owner"`
	Repo    string `yaml:"repo" json:"repo"`
	Verbose bool   `yaml:"verbose" json:"verbose"`
}

type HeartbeatAction string

type HeartbeatHints struct {
	// Present is true when the response carried at least one doorbell field.
	// A server that knows the doorbell answers every heartbeat of a
	// doorbell-aware sensor with at least next_heartbeat_seconds.
	Present bool
	// PendingJobs is the number of jobs this sensor could claim now (0..100).
	PendingJobs int
	// NextHeartbeat is the advised delay before the next heartbeat, already
	// clamped to [MinDoorbellHeartbeatInterval, MaxDoorbellHeartbeatInterval].
	// Zero when not advised.
	NextHeartbeat time.Duration
	// Actions are the actions the server sent, unfiltered. Doorbell.Handle
	// acts only on the known ones.
	Actions []HeartbeatAction
	// ConfigVersion is the opaque version of what the platform governs about
	// this sensor, or "" when absent or malformed.
	ConfigVersion string
}

type JSONParser struct{}

type LiveHost struct {
	URL           string   `json:"url"`                      // Full URL (https://example.com)
	Host          string   `json:"host"`                     // Hostname
	IP            string   `json:"ip,omitempty"`             // Resolved IP
	Port          int      `json:"port,omitempty"`           // Port number
	Scheme        string   `json:"scheme"`                   // http or https
	StatusCode    int      `json:"status_code"`              // HTTP status code
	ContentLength int64    `json:"content_length,omitempty"` // Response size
	Title         string   `json:"title,omitempty"`          // Page title
	WebServer     string   `json:"web_server,omitempty"`     // Server header
	ContentType   string   `json:"content_type,omitempty"`   // Content-Type header
	Technologies  []string `json:"technologies,omitempty"`   // Detected technologies
	CDN           string   `json:"cdn,omitempty"`            // CDN provider
	TLSVersion    string   `json:"tls_version,omitempty"`    // TLS version
	Redirect      string   `json:"redirect,omitempty"`       // Final redirect URL
	ResponseTime  int64    `json:"response_time_ms"`         // Response time in ms
}

type LogLevel int

type Logger interface {
	// Debug logs a debug message
	Debug(format string, args ...interface{})

	// Info logs an info message
	Info(format string, args ...interface{})

	// Warn logs a warning message
	Warn(format string, args ...interface{})

	// Error logs an error message
	Error(format string, args ...interface{})
}

type MultiTargetScanner interface {
	Scanner
	ScanTargets(ctx context.Context, targets []string, opts *ScanOptions) (*ScanResult, error)
}

type NopLogger struct{}

type OAuthConfig struct {
	ClientID     string   `yaml:"client_id" json:"client_id"`
	ClientSecret string   `yaml:"client_secret" json:"client_secret"`
	TokenURL     string   `yaml:"token_url" json:"token_url"`
	Scopes       []string `yaml:"scopes" json:"scopes"`
}

type OpenPort struct {
	Host     string `json:"host"`               // IP or hostname
	IP       string `json:"ip,omitempty"`       // IP address
	Port     int    `json:"port"`               // Port number
	Protocol string `json:"protocol,omitempty"` // tcp, udp
	Service  string `json:"service,omitempty"`  // Detected service name
	Version  string `json:"version,omitempty"`  // Service version
	Banner   string `json:"banner,omitempty"`   // Service banner
}

type OutputHandler func(line string, isError bool)

type Package struct {
	ID       string   `json:"id"`       // Package URL or unique identifier
	Name     string   `json:"name"`     // Package name
	Version  string   `json:"version"`  // Installed version
	Type     string   `json:"type"`     // npm, maven, pip, etc.
	Licenses []string `json:"licenses"` // License identifiers
	PURL     string   `json:"purl"`     // Package URL (purl spec)
}

type PackageDependency struct {
	PackageID    string   `json:"package_id"`   // Parent package
	Dependencies []string `json:"dependencies"` // Child package IDs
}

type PackageType string

type ParseOptions struct {
	// Tool information
	ToolName string `json:"tool_name"`
	ToolType string `json:"tool_type"` // sast, sca, secret, iac, web3

	// Asset information
	AssetType  ctis.AssetType `json:"asset_type"`
	AssetValue string         `json:"asset_value"`
	AssetID    string         `json:"asset_id"`

	// Git information (legacy - use BranchInfo for full context)
	Branch    string `json:"branch"`
	CommitSHA string `json:"commit_sha"`

	// Branch information for branch-aware finding lifecycle
	// Provides full CI/CD context for auto-resolve and expiry features
	BranchInfo *ctis.BranchInfo `json:"branch_info,omitempty"`

	// BasePath is the root directory of the scanned codebase.
	// Used to resolve relative file paths when reading snippets from source files.
	BasePath string `json:"base_path,omitempty"`

	// Defaults
	DefaultConfidence int `json:"default_confidence"`
}

type Parser interface {
	// Name returns the parser name (e.g., "sarif", "json", "custom-trivy")
	Name() string

	// SupportedFormats returns the output formats this parser can handle
	SupportedFormats() []string

	// Parse converts raw output to CTIS report
	Parse(ctx context.Context, data []byte, opts *ParseOptions) (*ctis.Report, error)

	// CanParse checks if the parser can handle the given data
	CanParse(data []byte) bool
}

type ParserRegistry struct {
	// contains filtered or unexported fields
}

type PrintfLogger struct {
	// contains filtered or unexported fields
}

type ProcessOptions struct {
	// Scan options
	ScanOptions *ScanOptions `yaml:"scan" json:"scan"`

	// Parse options
	ParseOptions *ParseOptions `yaml:"parse" json:"parse"`

	// Push options
	Push      bool   `yaml:"push" json:"push"`
	SaveLocal bool   `yaml:"save_local" json:"save_local"`
	OutputDir string `yaml:"output_dir" json:"output_dir"`

	// Retry
	MaxRetries int `yaml:"max_retries" json:"max_retries"`
	RetryDelay int `yaml:"retry_delay_seconds" json:"retry_delay_seconds"`
}

type ProcessResult struct {
	// Scanner info
	ScannerName string `json:"scanner_name"`

	// Scan result
	ScanResult *ScanResult `json:"scan_result"`

	// Parsed report
	Report *ctis.Report `json:"report,omitempty"`

	// Push result
	PushResult *PushResult `json:"push_result,omitempty"`

	// Local file if saved
	LocalFile string `json:"local_file,omitempty"`

	// Error
	Error string `json:"error,omitempty"`
}

type Processor interface {
	// Process runs a complete scan workflow
	Process(ctx context.Context, scanner Scanner, opts *ProcessOptions) (*ProcessResult, error)

	// ProcessBatch runs multiple scanners in parallel
	ProcessBatch(ctx context.Context, scanners []Scanner, opts *ProcessOptions) ([]*ProcessResult, error)
}

type Provider interface {
	// Name returns the provider name (e.g., "github", "aws")
	Name() string

	// Connector returns the underlying connector
	Connector() Connector

	// ListCollectors returns all available collectors
	ListCollectors() []Collector

	// GetCollector returns a specific collector by name
	GetCollector(name string) (Collector, error)

	// Initialize sets up the provider with configuration
	Initialize(ctx context.Context, config *ProviderConfig) error

	// TestConnection tests the provider connection
	TestConnection(ctx context.Context) error

	// Close closes the provider and all collectors
	Close() error
}

type ProviderConfig struct {
	// Connector config
	Connector ConnectorConfig `yaml:"connector" json:"connector"`

	// Provider-specific settings
	Settings map[string]any `yaml:"settings" json:"settings"`

	// Which collectors to enable (empty = all)
	EnabledCollectors []string `yaml:"enabled_collectors" json:"enabled_collectors"`
}

type PushResult struct {
	Success         bool   `json:"success"`
	Message         string `json:"message,omitempty"`
	FindingsCreated int    `json:"findings_created"`
	FindingsUpdated int    `json:"findings_updated"`
	AssetsCreated   int    `json:"assets_created"`
	AssetsUpdated   int    `json:"assets_updated"`

	// Queued: the results are durably stored in the outbox and will be
	// delivered when the platform is reachable; the counts above are not
	// known yet.
	Queued bool `json:"queued,omitempty"`
	// ReportID is the protocol v2 report id the results travel under ("" on
	// v1).
	ReportID string `json:"report_id,omitempty"`
}

type Pusher interface {
	// PushFindings sends findings to OpenCTEM
	PushFindings(ctx context.Context, report *ctis.Report) (*PushResult, error)

	// PushAssets sends assets to OpenCTEM
	PushAssets(ctx context.Context, report *ctis.Report) (*PushResult, error)

	// SendHeartbeat sends a heartbeat to OpenCTEM
	SendHeartbeat(ctx context.Context, status *SensorStatus) error

	// TestConnection tests the API connection
	TestConnection(ctx context.Context) error
}

type ReconOptions struct {
	// Target configuration
	Target     string   `yaml:"target" json:"target"`           // Domain, IP, or CIDR
	InputFile  string   `yaml:"input_file" json:"input_file"`   // File with multiple targets
	OutputFile string   `yaml:"output_file" json:"output_file"` // Output file path
	ExtraArgs  []string `yaml:"extra_args" json:"extra_args"`   // Additional CLI args

	// Performance
	Threads   int           `yaml:"threads" json:"threads"`       // Concurrency
	RateLimit int           `yaml:"rate_limit" json:"rate_limit"` // Rate limit (requests/second)
	Timeout   time.Duration `yaml:"timeout" json:"timeout"`       // Scan timeout

	// DNS configuration
	Resolvers []string `yaml:"resolvers" json:"resolvers"` // Custom DNS resolvers

	// Environment
	Env map[string]string `yaml:"env" json:"env"` // Environment variables

	// Output
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ReconResult struct {
	// Scanner info
	ScannerName    string    `json:"scanner_name"`
	ScannerVersion string    `json:"scanner_version"`
	ReconType      ReconType `json:"recon_type"`

	// Target
	Target string `json:"target"`

	// Timing
	StartedAt  int64 `json:"started_at"`
	FinishedAt int64 `json:"finished_at"`
	DurationMs int64 `json:"duration_ms"`

	// Results (populated based on ReconType)
	Subdomains   []Subdomain     `json:"subdomains,omitempty"`
	DNSRecords   []DNSRecord     `json:"dns_records,omitempty"`
	OpenPorts    []OpenPort      `json:"open_ports,omitempty"`
	LiveHosts    []LiveHost      `json:"live_hosts,omitempty"`
	URLs         []DiscoveredURL `json:"urls,omitempty"`
	Technologies []Technology    `json:"technologies,omitempty"`

	// Raw output
	RawOutput []byte `json:"raw_output,omitempty"`
	ExitCode  int    `json:"exit_code"`
	Error     string `json:"error,omitempty"`
}

type ReconScanner interface {
	// Name returns the scanner name (e.g., "subfinder", "naabu")
	Name() string

	// Version returns the scanner version
	Version() string

	// Type returns the recon type this scanner performs
	Type() ReconType

	// Scan performs reconnaissance on the target and returns results
	Scan(ctx context.Context, target string, opts *ReconOptions) (*ReconResult, error)

	// IsInstalled checks if the underlying tool is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ReconType string

type SARIFParser struct{}

type ScaResult struct {
	// Packages discovered
	Packages []Package `json:"packages"`

	// Dependency relationships
	PackageDependencies []PackageDependency `json:"package_dependencies"`

	// Vulnerabilities found
	Vulnerabilities []Vulnerability `json:"vulnerabilities"`

	// Timing
	DurationMs int64 `json:"duration_ms"`
}

type ScaScanOptions struct {
	// Target
	TargetDir string `yaml:"target_dir" json:"target_dir"`

	// Scan configuration
	SkipDBUpdate   bool `yaml:"skip_db_update" json:"skip_db_update"`
	IgnoreUnfixed  bool `yaml:"ignore_unfixed" json:"ignore_unfixed"`
	IncludeDevDeps bool `yaml:"include_dev_deps" json:"include_dev_deps"`

	// Output
	GenerateSBOM bool   `yaml:"generate_sbom" json:"generate_sbom"`
	SBOMFormat   string `yaml:"sbom_format" json:"sbom_format"` // cyclonedx, spdx

	// Verbose
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ScaScanner interface {
	// Name returns the scanner name (e.g., "trivy", "snyk")
	Name() string

	// Type returns the scanner type
	Type() ScannerType

	// Scan performs SCA scan and returns results
	Scan(ctx context.Context, target string, opts *ScaScanOptions) (*ScaResult, error)

	// IsInstalled checks if the scanner is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ScanCommandPayload struct {
	Scanner string `json:"scanner"`
	// Target is the single scan target. The platform omits it when a job has
	// several targets for a list-capable scanner (nuclei) and sends only
	// Targets; when both are set, Target is the job.
	Target string `json:"target"`
	// Targets is the full target list (protocol v1, additive).
	Targets         []string               `json:"targets,omitempty"`
	Config          map[string]interface{} `json:"config,omitempty"`
	TimeoutSeconds  int                    `json:"timeout_seconds,omitempty"`
	ReportProgress  bool                   `json:"report_progress,omitempty"`
	CustomTemplates []EmbeddedTemplate     `json:"custom_templates,omitempty"`
}

type ScanOptions struct {
	// Target configuration
	TargetDir  string            `yaml:"target_dir" json:"target_dir"`
	Include    []string          `yaml:"include" json:"include"`
	Exclude    []string          `yaml:"exclude" json:"exclude"`
	ConfigFile string            `yaml:"config_file" json:"config_file"`
	ExtraArgs  []string          `yaml:"extra_args" json:"extra_args"`
	Env        map[string]string `yaml:"env" json:"env"`

	// Custom templates directory (written from embedded templates)
	// Used by Nuclei (-t), Semgrep (--config), Betterleaks (--config)
	CustomTemplateDir string `yaml:"custom_template_dir" json:"custom_template_dir"`

	// Asset information for linking findings
	RepoURL   string `yaml:"repo_url" json:"repo_url"`
	Branch    string `yaml:"branch" json:"branch"`
	CommitSHA string `yaml:"commit_sha" json:"commit_sha"`

	// Output
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type ScanResult struct {
	// Scanner info
	ScannerName    string `json:"scanner_name"`
	ScannerVersion string `json:"scanner_version"`

	// Timing
	StartedAt  int64 `json:"started_at"`
	FinishedAt int64 `json:"finished_at"`
	DurationMs int64 `json:"duration_ms"`

	// Output
	ExitCode  int    `json:"exit_code"`
	RawOutput []byte `json:"raw_output,omitempty"`
	Stderr    string `json:"stderr,omitempty"`

	// Error (if scan failed)
	Error string `json:"error,omitempty"`
}

type ScanTargetPolicy struct {
	// AllowedRoots confines filesystem targets. When non-empty, a path target
	// must resolve (after following symlinks) to one of these directories or
	// a descendant. When empty, filesystem targets are allowed anywhere
	// except the filesystem root, sensitive system directories (/etc, /proc,
	// /root, ...) and credential directories in the user's home (~/.ssh,
	// ~/.aws, ...). Configuring roots is strongly recommended.
	AllowedRoots []string

	// AllowPrivate permits network targets in RFC1918 (10/8, 172.16/12,
	// 192.168/16) and IPv6 ULA (fc00::/7) space, for sensors that scan an
	// internal network. Loopback, link-local (incl. 169.254.169.254 IMDS),
	// CGNAT, multicast, unspecified and reserved ranges stay blocked
	// regardless.
	AllowPrivate bool

	// AllowLoopback permits 127.0.0.0/8 and ::1. Test-only; mirrors
	// httpsec.AllowLoopback.
	AllowLoopback bool

	// Disabled turns validation off entirely. Only for callers that validate
	// targets themselves before the executor sees the command.
	Disabled bool

	// LookupIP resolves a hostname; nil uses net.DefaultResolver. Exposed
	// for tests.
	LookupIP func(ctx context.Context, host string) ([]net.IP, error)
	// contains filtered or unexported fields
}

type Scanner interface {
	// Name returns the scanner name (e.g., "semgrep", "trivy")
	Name() string

	// Version returns the scanner version
	Version() string

	// Capabilities returns what the scanner can detect
	Capabilities() []string

	// Scan performs a scan on the target and returns raw output
	Scan(ctx context.Context, target string, opts *ScanOptions) (*ScanResult, error)

	// IsInstalled checks if the underlying tool is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type ScannerType string

type SecretFinding struct {
	// Identity
	RuleID      string `json:"rule_id"`     // Detection rule ID
	Fingerprint string `json:"fingerprint"` // For deduplication

	// Classification
	SecretType string `json:"secret_type"` // api_key, password, token, etc.
	Service    string `json:"service"`     // AWS, GitHub, Stripe, etc.

	// Location
	File        string `json:"file"`
	StartLine   int    `json:"start_line"`
	EndLine     int    `json:"end_line"`
	StartColumn int    `json:"start_column"`
	EndColumn   int    `json:"end_column"`

	// Content
	Match       string `json:"match"`        // Full matched line
	MaskedValue string `json:"masked_value"` // Redacted secret

	// Metadata
	Entropy float64 `json:"entropy,omitempty"` // Entropy score
	Valid   *bool   `json:"valid,omitempty"`   // If verified
	Author  string  `json:"author,omitempty"`  // Git author
	Commit  string  `json:"commit,omitempty"`  // Git commit
	Date    string  `json:"date,omitempty"`    // Commit date
}

type SecretResult struct {
	// Secrets found
	Secrets []SecretFinding `json:"secrets"`

	// Timing
	DurationMs int64 `json:"duration_ms"`
}

type SecretScanOptions struct {
	// Target
	TargetDir string `yaml:"target_dir" json:"target_dir"`

	// Scan configuration
	ConfigFile string   `yaml:"config_file" json:"config_file"` // Custom rules file
	Exclude    []string `yaml:"exclude" json:"exclude"`         // Paths to exclude
	NoGit      bool     `yaml:"no_git" json:"no_git"`           // Don't use git history

	// Verification
	Verify bool `yaml:"verify" json:"verify"` // Verify secrets are valid

	// Verbose
	Verbose bool `yaml:"verbose" json:"verbose"`
}

type SecretScanner interface {
	// Name returns the scanner name (e.g., "betterleaks", "trufflehog")
	Name() string

	// Type returns the scanner type
	Type() ScannerType

	// Scan performs secret detection and returns results
	Scan(ctx context.Context, target string, opts *SecretScanOptions) (*SecretResult, error)

	// IsInstalled checks if the scanner is available
	IsInstalled(ctx context.Context) (bool, string, error)
}

type Sensor interface {
	// Name returns the sensor name
	Name() string

	// Start starts the sensor
	Start(ctx context.Context) error

	// Stop gracefully stops the sensor
	Stop(ctx context.Context) error

	// Status returns the current sensor status
	Status() *SensorStatus

	// AddScanner adds a scanner to the sensor
	AddScanner(scanner Scanner) error

	// AddCollector adds a collector to the sensor
	AddCollector(collector Collector) error

	// RemoveScanner removes a scanner by name
	RemoveScanner(name string) error

	// RemoveCollector removes a collector by name
	RemoveCollector(name string) error
}

type SensorState string

type SensorStatus struct {
	Name          string      `json:"name"`
	Status        SensorState `json:"status"`
	StartedAt     int64       `json:"started_at,omitempty"`
	Uptime        int64       `json:"uptime_seconds,omitempty"`
	Scanners      []string    `json:"scanners"`
	Collectors    []string    `json:"collectors"`
	LastScan      int64       `json:"last_scan,omitempty"`
	LastCollect   int64       `json:"last_collect,omitempty"`
	TotalScans    int64       `json:"total_scans"`
	TotalFindings int64       `json:"total_findings"`
	Errors        int64       `json:"errors"`
	Message       string      `json:"message,omitempty"`

	// System Metrics (collected from sensor)
	CPUPercent    float64 `json:"cpu_percent,omitempty"`
	MemoryPercent float64 `json:"memory_percent,omitempty"`
	ActiveJobs    int     `json:"active_jobs,omitempty"`
	Region        string  `json:"region,omitempty"`

	// Version and Hostname identify the running sensor to the platform (shown
	// on the Sensors page). Both are sent with every heartbeat.
	Version  string `json:"version,omitempty"`
	Hostname string `json:"hostname,omitempty"`
}

type Subdomain struct {
	Host   string   `json:"host"`             // Full subdomain (e.g., api.example.com)
	Domain string   `json:"domain"`           // Root domain (e.g., example.com)
	Source string   `json:"source,omitempty"` // Discovery source (crtsh, hackertarget, etc.)
	IPs    []string `json:"ips,omitempty"`    // Resolved IP addresses
}

type Technology struct {
	Name       string   `json:"name"`                 // Technology name
	Version    string   `json:"version,omitempty"`    // Version if detected
	Categories []string `json:"categories,omitempty"` // Category (framework, cms, etc.)
	Confidence int      `json:"confidence,omitempty"` // Detection confidence (0-100)
	Website    string   `json:"website,omitempty"`    // Technology website
}

type TemplateCache struct {
	// contains filtered or unexported fields
}

type TemplateCacheConfig struct {
	// CacheDir is the base directory for cached templates.
	// Default: ~/.openctem/templates
	CacheDir string

	// MaxCacheAge is the maximum age of cached templates before cleanup.
	// Default: 7 days
	MaxCacheAge time.Duration

	// MaxCacheSize is the maximum total size of the cache in bytes.
	// Default: 100MB
	MaxCacheSize int64

	// CleanupInterval is how often to run cleanup.
	// Default: 1 hour
	CleanupInterval time.Duration

	// Verbose enables verbose logging.
	Verbose bool
}

type ValidationError struct {
	Field   string
	Message string
}

type ValidationErrors []ValidationError

type Validator struct {
	// contains filtered or unexported fields
}

type Vulnerability struct {
	// Identity
	ID          string `json:"id"`          // CVE ID or advisory ID
	Fingerprint string `json:"fingerprint"` // For deduplication

	// Package info
	PkgID      string `json:"pkg_id"`      // Affected package ID
	PkgName    string `json:"pkg_name"`    // Package name
	PkgVersion string `json:"pkg_version"` // Installed version

	// Vulnerability info
	Name         string `json:"name"`          // Short title
	Description  string `json:"description"`   // Full description
	Severity     string `json:"severity"`      // critical, high, medium, low
	FixedVersion string `json:"fixed_version"` // Version with fix

	// Metadata
	Metadata *VulnerabilityMetadata `json:"metadata,omitempty"`
}

type VulnerabilityMetadata struct {
	CWEs       []string `json:"cwes,omitempty"`        // CWE identifiers
	References []string `json:"references,omitempty"`  // Advisory URLs
	CVSSScore  float64  `json:"cvss_score,omitempty"`  // CVSS score
	CVSSVector string   `json:"cvss_vector,omitempty"` // CVSS vector string
	Source     string   `json:"source,omitempty"`      // NVD, GHSA, etc.
}

type WebhookCollector struct {
	*BaseCollector
	// contains filtered or unexported fields
}

type WebhookCollectorConfig struct {
	ListenAddr string `yaml:"listen_addr" json:"listen_addr"`
	Secret     string `yaml:"secret" json:"secret"`
	Verbose    bool   `yaml:"verbose" json:"verbose"`
}