scanossapi

type AppliedDependencyOverride struct {
	// AppliedVersion The version actually used during expansion — the pin, or the
	// highest serveable patch of the pin's bucket.
	AppliedVersion string `json:"applied_version"`

	// Fallback `true` iff `applied_version` differs from `requested_version`.
	Fallback bool   `json:"fallback"`
	Purl     string `json:"purl"`

	// RequestedVersion The version the client pinned for this purl.
	RequestedVersion string `json:"requested_version"`

	// StoredVersion The version `component_deps` recorded at mining time.
	StoredVersion string `json:"stored_version"`
}

type AttributionFile struct {
	// AttributionUrl URL to the full content of the attribution file.
	AttributionUrl string `json:"attribution_url"`

	// File Relative path of the attribution file within the component.
	File string `json:"file"`

	// FileId MD5 of the content — the same hash that is the last path segment
	// of `attribution_url`.
	FileId string `json:"file_id"`
}

type AttributionItem struct {
	AttributionFiles *[]AttributionFile `json:"attribution_files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url *string `json:"url,omitempty"`

	// Version Concrete version resolved from `requirement`.
	Version *string `json:"version,omitempty"`
}

type AttributionResponse struct {
	Components []AttributionItem `json:"components"`
	Status     BatchStatus       `json:"status"`
}

type BadRequest = ErrorBody

type BatchRequest struct {
	Components []Request `json:"components"`

	// Search Optional request-level search configuration applied to every component
	// in the batch (for GET endpoints the same knobs are query params). All
	// fields are optional; the defaults disable every fallback (strict version
	// matching, no related results). Honored by endpoints that support search
	// criteria — currently `/v3/license/evidence`.
	Search *SearchCriteria `json:"search,omitempty"`
}

type BatchStatus struct {
	Message string            `json:"message"`
	Status  BatchStatusStatus `json:"status"`
}

type BatchStatusStatus string

type CVSS struct {
	// Cvss CVSS vector string
	Cvss         *string  `json:"cvss,omitempty"`
	CvssScore    *float32 `json:"cvss_score,omitempty"`
	CvssSeverity *string  `json:"cvss_severity,omitempty"`
}

type CallArgument struct {
	// ArgumentExpression The exact argument expression as written in source.
	ArgumentExpression string `json:"argument_expression"`
	ParameterIndex     int32  `json:"parameter_index"`

	// ResolvedValue Statically resolved argument value when available.
	ResolvedValue *string           `json:"resolved_value,omitempty"`
	SourceNodes   *[]DataFlowSource `json:"source_nodes,omitempty"`

	// Type Argument type inferred at the call site.
	Type string `json:"type"`

	// VariableName Variable name at the call site; empty for literals/expressions.
	VariableName *string `json:"variable_name,omitempty"`
}

type CallNode struct {
	CanonicalSignature string `json:"canonical_signature"`

	// DependencyInfo Component that owns this frame, present when the frame belongs to a
	// dependency rather than the queried component.
	DependencyInfo *ForwardCallDependency `json:"dependency_info,omitempty"`

	// EntryCall The call site where one node in a chain invokes the next.
	// Present on every chain node except the entry-point node.
	EntryCall *CallSite `json:"entry_call,omitempty"`

	// EntryDeclaredType The static type the arriving call was written against, present when
	// `entry_resolution` is a dispatch kind: it names what the analysis
	// could not narrow. Absent otherwise.
	EntryDeclaredType *string `json:"entry_declared_type,omitempty"`

	// EntryResolution How the call that arrives at this frame was established. `exact` when
	// the callee is certain; a dispatch kind when the analysis could not
	// narrow the receiver and considered every compatible implementation.
	// Absent on the first frame of a chain, which no call arrives at, and on
	// frames served from data mined before callgraph `6.13`.
	//
	// A route is selected by minimum length, so a dispatch edge that happens
	// to be spurious is exactly the kind of hop a shortest route prefers.
	// Read this to keep the certain part of a route and treat the rest as
	// indicative rather than as a claim about execution.
	EntryResolution *CallNodeEntryResolution `json:"entry_resolution,omitempty"`
	FilePath        *string                  `json:"file_path,omitempty"`
	FunctionName    string                   `json:"function_name"`
	OwnerVisibility *CallNodeOwnerVisibility `json:"owner_visibility,omitempty"`
	ParameterTypes  []string                 `json:"parameter_types"`
	ReturnType      string                   `json:"return_type"`
	StartLine       *int32                   `json:"start_line,omitempty"`
	Visibility      *CallNodeVisibility      `json:"visibility,omitempty"`
}

type CallNodeEntryResolution string

type CallNodeOwnerVisibility string

type CallNodeVisibility string

type CallSite struct {
	CanonicalSignature string `json:"canonical_signature"`

	// FilePath File where the call expression appears.
	FilePath string `json:"file_path"`

	// FunctionName FQN of the invoked function.
	FunctionName   string          `json:"function_name"`
	Line           int32           `json:"line"`
	ParameterTypes []string        `json:"parameter_types"`
	Parameters     *[]CallArgument `json:"parameters,omitempty"`
	ReturnType     string          `json:"return_type"`
}

type Component struct {
	Name     *string             `json:"name,omitempty"`
	Purl     *string             `json:"purl,omitempty"`
	Url      *string             `json:"url,omitempty"`
	Versions *[]ComponentVersion `json:"versions,omitempty"`
}

type ComponentAlgorithms struct {
	Algorithms *[]CryptoAlgorithm `json:"algorithms,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentAlgorithmsInRange struct {
	Algorithms *[]CryptoAlgorithm `json:"algorithms,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Versions    *[]string `json:"versions,omitempty"`
}

type ComponentCpesInfo struct {
	Cpes        *[]string `json:"cpes,omitempty"`
	InfoCode    *string   `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentData struct {
	// ActualMinedVersion Pre-existing fallback signal, emitted exactly as previous releases
	// on BOTH endpoints: present only when the served version differs
	// from the requested exact version, carrying the same value as
	// `version`. Absent on exact matches and range resolutions.
	ActualMinedVersion *string `json:"actual_mined_version,omitempty"`

	// AppliedDependencyOverrides Closure nodes whose stored version was replaced by a version the
	// client pinned elsewhere in the same `/dep-tree` request. `READY`
	// blocks only, present only when non-empty — the only way to see
	// that a pin reached inside this root's dependency closure.
	AppliedDependencyOverrides *[]AppliedDependencyOverride `json:"applied_dependency_overrides,omitempty"`

	// CryptoEntryPoints Per-block projection of the merged callgraph's `crypto_entry_points[]`
	// signature-indexed reachability map (callgraph 6.x schema), narrowed
	// to entries whose `reachable_findings` intersect this block's surviving
	// assets. Operation-only catalog records are not retained or recreated.
	// Populated only when `include_crypto_entry_points: true`.
	//
	// This field **replaced** the legacy `entry_point_index` present in
	// callgraph schemas prior to 6.x.
	CryptoEntryPoints *[]CryptoEntryPoint `json:"crypto_entry_points,omitempty"`

	// DependencyResolutionErrors Client-pinned dependency versions this root's closure needs but
	// that have no serveable patch in their bucket. Makes only this
	// block `DEPENDENCY_UNRESOLVED`; sibling blocks are unaffected.
	// These blocks are NOT listed in `missing_components`.
	DependencyResolutionErrors *[]DependencyResolutionError `json:"dependency_resolution_errors,omitempty"`

	// Fallback ALWAYS present on `/dep-tree` blocks whose resolution produced a
	// served version: `true` iff that version differs from the requested
	// exact pin; explicit `false` on exact matches and range resolutions.
	// Omitted only when resolution never produced a version.
	Fallback *bool `json:"fallback,omitempty"`

	// FindingCount Total cryptographic_assets count across all findings[] in this
	// block. POST-PRUNE — when a filter is active, reflects surviving
	// assets, NOT the unfiltered universe.
	FindingCount int32     `json:"finding_count"`
	Findings     []Finding `json:"findings"`

	// InfoCode This block's own outcome. `/dep-tree` only — `/component` carries
	// the outcome on its envelope, exactly as previous releases.
	InfoCode *ReachabilityInfoCode `json:"info_code,omitempty"`

	// InfoMessage Human-readable detail for this block's outcome.
	InfoMessage *string `json:"info_message,omitempty"`

	// Method How the served version was selected (`/dep-tree` only). `exact` —
	// the requested version was served. `range` — a semver constraint
	// resolved to a mined version inside it.
	// `highest_patch_same_major_minor` — the requested exact version was
	// not serveable and the highest serveable patch in the same
	// `major.minor` bucket was served instead (paired with
	// `fallback: true`; the block stays `READY`).
	Method *ComponentDataMethod `json:"method,omitempty"`
	Purl   string               `json:"purl"`

	// RequestedVersion What the client asked for — the exact version on a pin, or the
	// requirement string itself on a range. `/dep-tree` only.
	RequestedVersion *string `json:"requested_version,omitempty"`

	// Requirement Echo of the request requirement string when known.
	Requirement *string `json:"requirement,omitempty"`

	// ResolvedVersion Issue #69's name for the served version; same value as `version`.
	// Present on `/dep-tree` blocks whose resolution produced a served
	// version.
	ResolvedVersion *string `json:"resolved_version,omitempty"`

	// Schemas Source crypto-finder schema versions for this component block. The
	// server returns `UNSUPPORTED_SCHEMA` rather than rendering producer data
	// from a newer schema version than this deployment understands.
	Schemas *ComponentSchemas `json:"schemas,omitempty"`

	// SupportingCalls Deduped object-lifecycle calls (e.g. IV generation, key-size
	// initialisation) referenced by surviving assets in this block.
	// Passed through as raw JSON from the merged callgraph 6.x
	// `supporting_calls[]`. Populated only when
	// `include_supporting_calls: true`.
	//
	// Each entry is identified by `supporting_id`, which is the
	// foreign key referenced from:
	// - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb)
	// - `crypto_entry_points[].reachable_supporting_calls[].supporting_id`
	SupportingCalls *[]SupportingCall `json:"supporting_calls,omitempty"`

	// Version The version actually served — unchanged in name and meaning from
	// previous releases (issue #69 refers to this value as
	// `resolved_version`, shipped alongside on `/dep-tree` blocks).
	Version string `json:"version"`
}

type ComponentDataMethod string

type ComponentHealth struct {
	// Detail Error message or extra context (present on error / when relevant).
	Detail *string               `json:"detail,omitempty"`
	Status ComponentHealthStatus `json:"status"`
}

type ComponentHealthStatus string

type ComponentHints struct {
	Hints *[]CryptoHint `json:"hints,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentHintsInRange struct {
	Hints *[]CryptoHint `json:"hints,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Versions    *[]string `json:"versions,omitempty"`
}

type ComponentLicenseInfo struct {
	InfoCode    *string        `json:"info_code,omitempty"`
	InfoMessage *string        `json:"info_message,omitempty"`
	Licenses    *[]LicenseInfo `json:"licenses,omitempty"`
	Purl        *string        `json:"purl,omitempty"`
	Requirement *string        `json:"requirement,omitempty"`

	// Statement License IDs joined with " AND ".
	Statement *string `json:"statement,omitempty"`
	Url       *string `json:"url,omitempty"`
	Version   *string `json:"version,omitempty"`
}

type ComponentLicenseResponse struct {
	// Component Per-component license result. `info_code` is one of
	// `REQUIREMENT_NOT_MET`, `VERSION_NOT_FOUND`, `NO_INFO` (absent on an exact
	// match).
	Component *ComponentLicenseInfo `json:"component,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type ComponentLifecycleStatus struct {
	FirstIndexedDate *string `json:"first_indexed_date,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode         *InfoCode `json:"info_code,omitempty"`
	InfoMessage      *string   `json:"info_message,omitempty"`
	LastIndexedDate  *string   `json:"last_indexed_date,omitempty"`
	RepositoryStatus *string   `json:"repository_status,omitempty"`
	Status           *string   `json:"status,omitempty"`
	StatusChangeDate *string   `json:"status_change_date,omitempty"`
}

type ComponentLocation struct {
	// InfoCode INVALID_PURL | NO_INFO | TOO_MANY_CONTRIBUTORS
	InfoCode    *string        `json:"info_code,omitempty"`
	InfoMessage *string        `json:"info_message,omitempty"`
	Locations   *[]GeoLocation `json:"locations,omitempty"`
	Purl        *string        `json:"purl,omitempty"`
}

type ComponentLocationInfo struct {
	CuratedLocations  *[]GeoCuratedLocation  `json:"curated_locations,omitempty"`
	DeclaredLocations *[]GeoDeclaredLocation `json:"declared_locations,omitempty"`

	// InfoCode INVALID_PURL | NO_INFO | TOO_MANY_CONTRIBUTORS
	InfoCode    *string `json:"info_code,omitempty"`
	InfoMessage *string `json:"info_message,omitempty"`
	Purl        *string `json:"purl,omitempty"`
}

type ComponentReachabilityRequest struct {
	// EntryPointSignatures Optional exact-match filter on entry-point canonical signatures.
	// When non-empty, `assets[]` is **restricted to findings reachable
	// from at least one supplied entry point**. Findings unreachable
	// from any supplied entry are REMOVED entirely from `assets[]` —
	// they do NOT appear as `reachability: unreachable` entries. An
	// empty array (or absent field) means no filter; all findings are
	// returned.
	//
	// Matching is against `crypto_entry_points[].canonical_signature`,
	// so every entry point the service can publish is a usable filter
	// value — including the majority that head none of the emitted
	// `call_chains[]`. Supply the signature exactly as that field
	// spells it, spaces included.
	//
	// With `include_call_chains: true` a surviving asset's
	// `call_chains[]` carries routes that START at a supplied entry: the
	// traversal is rooted at them, so the per-finding chain budget is
	// spent reaching what you asked about instead of on whichever entries
	// the walk happened to meet first.
	//
	// Signatures matching no entry point in the component are listed in
	// `unmatched_signatures` at the top level of the response
	// (diagnostic for typos).
	EntryPointSignatures *[]string `json:"entry_point_signatures,omitempty"`

	// IncludeCallChains When true, decorates each asset with its `call_chains[]` array
	// (raw callgraph 6.x frame arrays) and the `reachability` verdict.
	// Default false produces a pure CBOM response (findings without
	// reachability decoration). Independent of `entry_point_signatures`
	// (which controls whether assets are PRUNED to reachable ones).
	// Independent of `include_crypto_entry_points` and
	// `include_supporting_calls`.
	IncludeCallChains *bool `json:"include_call_chains,omitempty"`

	// IncludeCryptoEntryPoints When true, populates `crypto_entry_points[]` at the top level
	// of each `ComponentData` block — the public reachability surface
	// (entry-point functions with their `reachable_findings[]`).
	// This is the projection that **replaced** the legacy
	// `entry_point_index` field.
	// Independent of `include_call_chains` and `include_supporting_calls`.
	IncludeCryptoEntryPoints *bool `json:"include_crypto_entry_points,omitempty"`

	// IncludeForwardCalls When true, attaches a bounded `forward_calls` graph to each asset.
	// Forward traversal follows only real implementation edges and keeps
	// argument expressions, resolved values, inferred types, provenance,
	// candidate evidence, and explicit truncation state. When false or
	// absent, responses retain their previous shape.
	IncludeForwardCalls *bool `json:"include_forward_calls,omitempty"`

	// IncludeRawCallgraph When true, `callgraph` at the top level of the response carries
	// the unfiltered merged callgraph.
	IncludeRawCallgraph *bool `json:"include_raw_callgraph,omitempty"`

	// IncludeSupportingCalls When true, populates `supporting_calls[]` at the top level of
	// each `ComponentData` block (deduped object-lifecycle calls such
	// as IV generation and key-size initialisation) AND attaches
	// `supporting_call_ids[]` to each `cryptographic_asset` whose
	// finding graph references supporting calls. Each
	// `supporting_call_id` resolves to a `supporting_calls[].supporting_id`
	// in the same block.
	// Independent of `include_call_chains` and `include_crypto_entry_points`.
	IncludeSupportingCalls *bool `json:"include_supporting_calls,omitempty"`

	// MaxChainsPerAsset Per-asset cap on `call_chains[]` length. Hard cap 128.
	// `0` (the default) applies no cap HERE — it does not mean every route
	// that exists is returned: the traversal that produces the chains
	// already bounds them at 128 per finding, so 128 is the ceiling either
	// way. Use a positive integer to ask for fewer. Values above 128 are
	// rejected with HTTP 400.
	//
	// A finding at that ceiling has more routes than were emitted, and
	// `analysis.call_chains` does not currently report it — treat exactly
	// 128 chains as "sampled", and read
	// `crypto_entry_points[].reachable_findings[].chain_depth` for the
	// distance from an entry the chains do not cover.
	MaxChainsPerAsset *int32 `json:"max_chains_per_asset,omitempty"`

	// MaxForwardDepth Optional forward traversal depth. Applies only when
	// `include_forward_calls: true`. When omitted, the producer default
	// of 4 is used. Values outside 1..16 are rejected with HTTP 400.
	MaxForwardDepth *int32 `json:"max_forward_depth,omitempty"`
	Purl            string `json:"purl"`

	// Requirement Version constraint. Accepts exact versions (`1.5.2`, `=1.5.2`) or
	// SemVer constraint expressions (`>=1.5.0`, `^1.5.0`, `~1.5.0`,
	// `>=1.5.0,<2.0.0`). The leading `=` is optional. For range
	// expressions, the server resolves to the highest mined version
	// satisfying the constraint; no match → `VERSION_NOT_FOUND`.
	Requirement *string `json:"requirement,omitempty"`
}

type ComponentReachabilityResponse struct {
	// Callgraph Raw merged callgraph as JSON, populated only when the request set
	// `include_raw_callgraph: true`. Shape matches crypto-finder
	// callgraph schema 6.x verbatim.
	Callgraph *map[string]interface{} `json:"callgraph,omitempty"`
	Data      *[]ComponentData        `json:"data,omitempty"`

	// InfoCode Outcome for this single component, exactly as previous releases —
	// a bucket-fallback result stays `READY` with `actual_mined_version`
	// set. `DEPENDENCY_UNRESOLVED` and `INVALID_REQUEST` are not used by
	// this endpoint.
	InfoCode    ReachabilityInfoCode `json:"info_code"`
	InfoMessage *string              `json:"info_message,omitempty"`

	// RulesVersion Echoed on READY — the rules_version active for this row.
	RulesVersion *string `json:"rules_version,omitempty"`

	// Status Top-level outcome for the request as a whole.
	Status StatusResponse `json:"status"`

	// UnmatchedSignatures Signatures from `entry_point_signatures` that matched zero chains.
	UnmatchedSignatures *[]string `json:"unmatched_signatures,omitempty"`
}

type ComponentRequest struct {
	// Purl Package URL identifying the component.
	Purl string `json:"purl"`

	// Requirement Version constraint when the PURL has no explicit version. Accepts:
	// - Exact versions with or without leading `=`: `1.15`, `=1.15`
	// - SemVer constraint expressions: `>=1.10,<1.16`, `^1.5.0`, `~1.5.0`
	//
	// For range expressions, the server resolves to the highest mined
	// version that satisfies the constraint. Maven non-SemVer qualifiers
	// (e.g. `1.5.2.RELEASE`) are accepted as exact literals.
	Requirement *string `json:"requirement,omitempty"`
}

type ComponentResult struct {
	Component   string   `json:"component,omitempty"`
	File        string   `json:"file,omitempty"`
	Purls       []string `json:"purls,omitempty"`
	Rank        int      `json:"rank,omitempty"`
	ReleaseDate string   `json:"release_date,omitempty"`
	Url         string   `json:"url,omitempty"`
	Vendor      string   `json:"vendor,omitempty"`
	Version     string   `json:"version,omitempty"`
}

type ComponentSchemas struct {
	Callgraph *string `json:"callgraph,omitempty"`
	Findings  *string `json:"findings,omitempty"`
}

type ComponentSearchHit struct {
	Name *string `json:"name,omitempty"`
	Purl *string `json:"purl,omitempty"`

	// Url Project URL reconstructed from mine_id (may be empty).
	Url *string `json:"url,omitempty"`
}

type ComponentStatusResult struct {
	ComponentStatus *ComponentLifecycleStatus `json:"component_status,omitempty"`
	Name            *string                   `json:"name,omitempty"`
	Purl            *string                   `json:"purl,omitempty"`
	Requirement     *string                   `json:"requirement,omitempty"`
	VersionStatus   *ComponentVersionStatus   `json:"version_status,omitempty"`
}

type ComponentVersion struct {
	// Date Release date as reported by the upstream registry.
	Date     *string                    `json:"date,omitempty"`
	Licenses *[]ComponentVersionLicense `json:"licenses,omitempty"`
	Version  *string                    `json:"version,omitempty"`
}

type ComponentVersionLicense struct {
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Name           *string `json:"name,omitempty"`
	SpdxId         *string `json:"spdx_id,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type ComponentVersionStatus struct {
	IndexedDate *string `json:"indexed_date,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`

	// RepositoryStatus Raw status string reported by the registry.
	RepositoryStatus *string `json:"repository_status,omitempty"`

	// Status Canonical lifecycle (active / removed / deprecated / deleted).
	Status           *string `json:"status,omitempty"`
	StatusChangeDate *string `json:"status_change_date,omitempty"`
	Version          *string `json:"version,omitempty"`
}

type ComponentVersionsInRange struct {
	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode        *InfoCode `json:"info_code,omitempty"`
	InfoMessage     *string   `json:"info_message,omitempty"`
	Purl            *string   `json:"purl,omitempty"`
	VersionsWith    *[]string `json:"versions_with,omitempty"`
	VersionsWithout *[]string `json:"versions_without,omitempty"`
}

type ComponentVersionsResponse struct {
	Component Component   `json:"component"`
	Status    BatchStatus `json:"status"`
}

type ComponentVulnerabilityInfo struct {
	InfoCode        *string          `json:"info_code,omitempty"`
	InfoMessage     *string          `json:"info_message,omitempty"`
	Purl            *string          `json:"purl,omitempty"`
	Requirement     *string          `json:"requirement,omitempty"`
	Version         *string          `json:"version,omitempty"`
	Vulnerabilities *[]Vulnerability `json:"vulnerabilities,omitempty"`
}

type ComponentsLicenseResponse struct {
	Components *[]ComponentLicenseInfo `json:"components,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type ComponentsSearchResponse struct {
	Components []ComponentSearchHit `json:"components"`
	Status     BatchStatus          `json:"status"`
}

type ComponentsStatusResponse struct {
	Components []ComponentStatusResult `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type ContentIdPath = string

type CopyrightDetection struct {
	// Copyright Detected copyright statement (verbatim).
	Copyright string `json:"copyright"`

	// Detector Name of the detector that produced the evidence.
	Detector DetectorEnum `json:"detector"`

	// Evidence Line range or byte range of the evidence, depending on the server's
	// license-hints backend: 1-based inclusive **line numbers** with the
	// default `postgres` backend, or **byte offsets** with the `ldb` backend.
	// The content endpoints slice `?start=&end=` by the same unit.
	Evidence EvidenceRange `json:"evidence"`

	// Holder Holder parsed out of the raw statement (years / boilerplate
	// removed). Optional — absent when it could not be parsed.
	Holder *string `json:"holder,omitempty"`

	// Source Origin/category of the evidence. Today only `header_declared`,
	// `notice_declared` and `metadata_declared` are emitted (derived from
	// the file path); `spdx_tag` and `project_declared` are reserved for a
	// richer signal.
	Source SourceEnum `json:"source"`
}

type CopyrightEvidenceFile struct {
	Detections []CopyrightDetection `json:"detections"`
	File       string               `json:"file"`
	FileId     string               `json:"file_id"`
}

type CopyrightEvidenceItem struct {
	Files *[]CopyrightEvidenceFile `json:"files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url     *string `json:"url,omitempty"`
	Version *string `json:"version,omitempty"`
}

type CopyrightEvidenceResponse struct {
	Components []CopyrightEvidenceItem `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type CopyrightHolder struct {
	// Count Number of detections referencing this holder.
	Count  int    `json:"count"`
	Holder string `json:"holder"`
}

type CopyrightHoldersItem struct {
	Holders *[]CopyrightHolder `json:"holders,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url     *string `json:"url,omitempty"`
	Version *string `json:"version,omitempty"`
}

type CopyrightHoldersResponse struct {
	Components []CopyrightHoldersItem `json:"components"`
	Status     BatchStatus            `json:"status"`
}

type CpesResponse struct {
	Components []ComponentCpesInfo `json:"components"`
	Status     BatchStatus         `json:"status"`
}

type CryptoAlgorithm struct {
	Algorithm *string `json:"algorithm,omitempty"`
	Strength  *string `json:"strength,omitempty"`
}

type CryptoAlgorithmsInRangeResponse struct {
	Components []ComponentAlgorithmsInRange `json:"components"`
	Status     BatchStatus                  `json:"status"`
}

type CryptoAlgorithmsResponse struct {
	Components []ComponentAlgorithms `json:"components"`
	Status     BatchStatus           `json:"status"`
}

type CryptoAsset struct {
	// Analysis How complete the reachability evidence for this asset is. Present
	// only when the reachability endpoint was called with
	// `include_call_chains: true`. A `partial` value is why `reachability`
	// may read `unknown`.
	Analysis *struct {
		// CallChains `partial` when a bound truncated the traversal, so `call_chains`
		// carries a subset of the routes that exist.
		CallChains *CryptoAssetAnalysisCallChains `json:"call_chains,omitempty"`

		// Parameters How many exported call-site parameters resolved to a value or a
		// data-flow source. `unavailable` when no parameter provenance was
		// exported at all.
		Parameters *CryptoAssetAnalysisParameters `json:"parameters,omitempty"`
	} `json:"analysis,omitempty"`

	// CallChains Ordered call chains from entry points to this asset, following
	// crypto-finder's callgraph 6.x schema. Each element is an ordered
	// array of call-chain frame objects (see `CallNode`). Present only when the
	// reachability endpoint was called with `include_call_chains: true`.
	CallChains *[][]CallNode `json:"call_chains,omitempty"`
	EndLine    int32         `json:"end_line"`

	// FindingId Stable hash of the detection. Use as primary key.
	FindingId string `json:"finding_id"`

	// ForwardCalls Bounded forward call graph rooted at the function containing a finding.
	// Only producer-resolved implementation edges are included. Unresolved
	// dispatch candidates remain explicit in `ambiguous_calls`; the server
	// never invents a target. `truncated` is true only when the depth, node,
	// or edge budget prevents a complete traversal, independently of ambiguity.
	ForwardCalls *ForwardCalls `json:"forward_calls,omitempty"`

	// Match Exact source line that triggered the detection.
	Match string `json:"match"`

	// Metadata Pass-through metadata block as emitted by crypto-finder's findings
	// envelope (v1.4). The shape is owned by crypto-finder, not by this
	// service. Keys are CAMEL CASE (e.g. `assetType`, `algorithmName`,
	// `protocolName`, `materialType`). `assetType` is the discriminator
	// used by consumers that want to branch on the variant. All other keys
	// are optional and depend on the variant — for `assetType: algorithm`
	// you'll see `algorithmName`, `algorithmFamily`, `algorithmPrimitive`,
	// `algorithmMode`, `algorithmPadding`, `algorithmParameterSetIdentifier`;
	// for `assetType: protocol` you'll see `protocolName`, `protocolStrength`;
	// for `assetType: certificate` you'll see `certificateFormat`,
	// `certificateAlgorithm`, `certificateType`, `certificateStoreType`;
	// for `assetType: related-crypto-material` you'll see `materialType`,
	// `materialAlgorithm`, `materialFormat`, `materialSize`.
	// Schema evolution (new fields, new variants) is forward-compatible —
	// this service does NOT re-curate or translate metadata. Unknown keys and
	// explicit provider evidence are preserved unchanged; the service does
	// not synthesize provider or crypto-module claims.
	Metadata CryptoFinderMetadata `json:"metadata"`

	// OccurrenceKey Structural identity of the occurrence, `v1:` followed by 16 lowercase
	// hex characters (findings schema `1.5+`).
	//
	// It is derived from AST anchors and deliberately excludes rules, source
	// text, metadata, reachability and severity, so it survives reformatting
	// and rule changes that `finding_id` does not. Use `(finding_id,
	// occurrence_key)` to recognise the same occurrence across scans; fall
	// back to `finding_id` alone when it is absent, which is the case for
	// components mined under an older schema and for detections with no AST
	// call evidence.
	OccurrenceKey *string `json:"occurrence_key,omitempty"`

	// Oid RFC 5280 / CBOM Object Identifier when applicable.
	Oid *string `json:"oid,omitempty"`

	// ParameterConditions Structured producer-owned parameter predicates.
	ParameterConditions *[]ParameterCondition `json:"parameter_conditions,omitempty"`

	// Reachability Whether an entry point reaches this asset, and how confidently.
	// Replaced the legacy `reachable` boolean, which a three-state answer
	// could not express. Present only when the reachability endpoint was
	// called with `include_call_chains: true`.
	//
	// * `reachable` — a chain from an entry point to this asset was
	//   established. A self-chain (the containing function alone) never
	//   counts.
	// * `unreachable` — no entry point reaches it.
	// * `unknown` — the traversal could not settle the question: an
	//   ambiguous dispatch was suppressed, or a bound truncated the walk.
	//   Investigate rather than reading it as unreachable.
	// * `not_applicable` — the question does not apply, because the
	//   component was scanned on its own and there is no consumer code to
	//   be reached from.
	Reachability *CryptoAssetReachability `json:"reachability,omitempty"`
	Source       CryptoAssetSource        `json:"source"`
	StartLine    int32                    `json:"start_line"`

	// SupportingCallIds Foreign-key breadcrumb to the block-level `supporting_calls[]`
	// array. Each string value is a `supporting_calls[].supporting_id`.
	// Present only when `include_supporting_calls: true` and this
	// asset's finding graph references supporting calls.
	SupportingCallIds *[]string `json:"supporting_call_ids,omitempty"`
}

type CryptoAssetAnalysisCallChains string

type CryptoAssetAnalysisParameters string

type CryptoAssetReachability string

type CryptoAssetSource string

type CryptoCall struct {
	Aliases            *[]string        `json:"aliases,omitempty"`
	CanonicalSignature *string          `json:"canonical_signature,omitempty"`
	DisplaySymbol      *string          `json:"display_symbol,omitempty"`
	FunctionName       string           `json:"function_name"`
	Line               int32            `json:"line"`
	ParameterRoles     *[]ParameterRole `json:"parameter_roles,omitempty"`
	ParameterTypes     *[]string        `json:"parameter_types,omitempty"`
	Parameters         *[]CallArgument  `json:"parameters,omitempty"`
	ReturnType         *string          `json:"return_type,omitempty"`
}

type CryptoEntryPoint struct {
	CanonicalSignature string  `json:"canonical_signature"`
	Class              string  `json:"class"`
	DisplaySymbol      *string `json:"display_symbol,omitempty"`

	// FunctionKey Stable internal key for this function in the callgraph.
	FunctionKey       string                           `json:"function_key"`
	FunctionName      string                           `json:"function_name"`
	Method            string                           `json:"method"`
	OwnerVisibility   *CryptoEntryPointOwnerVisibility `json:"owner_visibility,omitempty"`
	ParameterRoles    *[]ParameterRole                 `json:"parameter_roles,omitempty"`
	ParameterTypes    *[]string                        `json:"parameter_types,omitempty"`
	ReachableFindings []ReachableFinding               `json:"reachable_findings"`

	// ReachableSupportingCalls Supporting calls reachable from this entry point.
	ReachableSupportingCalls *[]ReachableSupportingCall `json:"reachable_supporting_calls,omitempty"`
	ReturnType               *string                    `json:"return_type,omitempty"`

	// Root True when this entry point is where a chain starts — the first
	// root-module caller when dependencies were scanned, or a function with
	// no caller in the component's own graph when it was scanned alone.
	//
	// The index itself is deliberately broader: it lists every function
	// from which a finding is reachable, so most entries are not roots.
	// Omitted when false.
	Root       *bool                       `json:"root,omitempty"`
	Visibility *CryptoEntryPointVisibility `json:"visibility,omitempty"`
}

type CryptoEntryPointOwnerVisibility string

type CryptoEntryPointVisibility string

type CryptoFinderMetadata struct {
	Api *string `json:"api,omitempty"`

	// AssetType Discriminator (camelCase from crypto-finder). Known values:
	// `algorithm`, `protocol`, `certificate`, `related-crypto-material`.
	// Unknown values are forwarded verbatim.
	AssetType            *string                `json:"assetType,omitempty"`
	Library              *string                `json:"library,omitempty"`
	Provider             *string                `json:"provider,omitempty"`
	AdditionalProperties map[string]interface{} `json:"-"`
}

type CryptoHint struct {
	Category    *string `json:"category,omitempty"`
	Description *string `json:"description,omitempty"`
	Id          *string `json:"id,omitempty"`
	Name        *string `json:"name,omitempty"`
	Purl        *string `json:"purl,omitempty"`
	Url         *string `json:"url,omitempty"`
}

type CryptoHintsInRangeResponse struct {
	Components []ComponentHintsInRange `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type CryptoHintsResponse struct {
	Components []ComponentHints `json:"components"`
	Status     BatchStatus      `json:"status"`
}

type CryptoVersionsInRangeResponse struct {
	Components []ComponentVersionsInRange `json:"components"`
	Status     BatchStatus                `json:"status"`
}

type DataFlowSource struct {
	// CallTarget FQN of the callee for CALL_RESULT sources.
	CallTarget *string `json:"call_target,omitempty"`

	// DeclaredType Declared type of the source symbol.
	DeclaredType *string        `json:"declared_type,omitempty"`
	Location     SourceLocation `json:"location"`

	// Name Variable / field / parameter name.
	Name *string `json:"name,omitempty"`

	// ParameterIndex 0-based parameter index. Set on PARAMETER.
	ParameterIndex *int32             `json:"parameter_index,omitempty"`
	SourceNodes    *[]DataFlowSource  `json:"source_nodes,omitempty"`
	Type           DataFlowSourceType `json:"type"`

	// Value Source-code expression / literal text.
	Value *string `json:"value,omitempty"`
}

type DataFlowSourceType string

type DepTreeReachabilityRequest struct {
	// Dependencies Flat list of every (purl, version) to be stitched. Every entry
	// MUST carry a version, either as an exact pin (`=1.5.2`) or as a
	// SemVer constraint expression (`>=1.0`, `^2.0`, `~1.5`).
	// Range constraints resolve to the highest mined version satisfying
	// the constraint. The server does NOT auto-resolve transitive deps.
	Dependencies []ComponentRequest `json:"dependencies"`

	// EntryPointSignatures Optional exact-match filter on entry-point canonical signatures.
	// When non-empty, `findings[]` is **restricted to assets reachable
	// from at least one supplied entry point**. Findings unreachable
	// from any supplied entry are REMOVED entirely — they do NOT appear
	// as `reachability: unreachable` entries. An empty array (or absent
	// field) means no filter; all findings are returned.
	//
	// Matching is against `crypto_entry_points[].canonical_signature`,
	// so every entry point the service can publish is a usable filter
	// value — including the majority that head none of the emitted
	// `call_chains[]`. Supply the signature exactly as that field
	// spells it, spaces included.
	//
	// Signatures matching no entry point in any block are listed in
	// `unmatched_signatures` at the top level of the response
	// (diagnostic for typos).
	EntryPointSignatures *[]string `json:"entry_point_signatures,omitempty"`

	// IncludeCallChains When true, decorates each asset with its `call_chains[]` array
	// (raw callgraph 6.x frame arrays) and the `reachability` verdict.
	// Default false produces a pure CBOM response (findings without
	// reachability decoration). Independent of `entry_point_signatures`
	// (which controls whether assets are PRUNED to reachable ones).
	// Independent of `include_crypto_entry_points` and
	// `include_supporting_calls`.
	IncludeCallChains *bool `json:"include_call_chains,omitempty"`

	// IncludeCryptoEntryPoints When true, populates `crypto_entry_points[]` at the top level
	// of each `ComponentData` block — the public reachability surface
	// (entry-point functions with their `reachable_findings[]`).
	// This is the projection that **replaced** the legacy
	// `entry_point_index` field.
	// Independent of `include_call_chains` and `include_supporting_calls`.
	IncludeCryptoEntryPoints *bool `json:"include_crypto_entry_points,omitempty"`

	// IncludeForwardCalls When true, attaches a bounded `forward_calls` graph to each asset.
	// When false or absent, responses retain their previous shape.
	IncludeForwardCalls *bool `json:"include_forward_calls,omitempty"`
	IncludeRawCallgraph *bool `json:"include_raw_callgraph,omitempty"`

	// IncludeSupportingCalls When true, populates `supporting_calls[]` at the top level of
	// each `ComponentData` block (deduped object-lifecycle calls such
	// as IV generation and key-size initialisation) AND attaches
	// `supporting_call_ids[]` to each `cryptographic_asset` whose
	// finding graph references supporting calls. Each
	// `supporting_call_id` resolves to a `supporting_calls[].supporting_id`
	// in the same block.
	// Independent of `include_call_chains` and `include_crypto_entry_points`.
	IncludeSupportingCalls *bool `json:"include_supporting_calls,omitempty"`

	// MaxChainsPerAsset Per-asset cap on `call_chains[]` length. Hard cap 128. `0` (the
	// default) applies no cap here, but the traversal already bounds chains
	// at 128 per finding, so 128 is the ceiling either way. Positive
	// integer asks for fewer.
	MaxChainsPerAsset *int32 `json:"max_chains_per_asset,omitempty"`

	// MaxForwardDepth Optional forward traversal depth. Applies only when
	// `include_forward_calls: true`. When omitted, the producer default
	// of 4 is used. Values outside 1..16 are rejected with HTTP 400.
	MaxForwardDepth *int32 `json:"max_forward_depth,omitempty"`
}

type DepTreeReachabilityResponse struct {
	// Callgraph Raw merged callgraph as JSON, populated only when
	// `include_raw_callgraph: true`. Shape: crypto-finder callgraph
	// 6.x verbatim.
	Callgraph *map[string]interface{} `json:"callgraph,omitempty"`
	Data      *[]ComponentData        `json:"data,omitempty"`

	// InfoCode **Envelope summary only — read `data[].info_code` for outcomes.**
	//
	// - `READY` — at least one block is `READY` (bucket-fallback
	//   results are `READY` blocks and count).
	// - `NO_INFO` — the request was well-formed but no block carries
	//   data.
	// - `INVALID_REQUEST` — empty `dependencies` array, or two different
	//   exact versions supplied for the same component.
	//
	// Per-dependency conditions never appear here and never reject the
	// request. Whole-request rejection is reserved for malformed
	// requests and conflicting client version authority.
	InfoCode ReachabilityInfoCode `json:"info_code"`

	// InfoMessage Summary of how many dependencies returned data, e.g.
	// `"3 of 4 dependencies returned data"`.
	InfoMessage *string `json:"info_message,omitempty"`

	// MissingComponents Convenience summary listing the resolved `(purl, version)` of
	// exactly those dependencies whose block carries
	// `info_code: NO_INFO`. The per-block `info_code` is authoritative —
	// this list is a shortcut, not a separate verdict, and it does not
	// cover blocks that failed for other reasons
	// (`VERSION_NOT_FOUND`, `UNSUPPORTED_SCHEMA`, `INVALID_PURL`).
	MissingComponents *[]struct {
		Purl    string `json:"purl"`
		Version string `json:"version"`
	} `json:"missing_components,omitempty"`

	// RulesVersion Highest `rules_version` among the dependency rows that contributed
	// to this response. Dependencies may have been mined at different
	// points in time under different rules_versions; this field reports
	// the most recent contributor (by mining `created_at`), NOT a
	// uniform "all deps under this version" guarantee. Use this when
	// comparing two dep-tree responses to detect whether new rules
	// have landed since the last call. Present only when at least one
	// block is data-bearing.
	RulesVersion *string `json:"rules_version,omitempty"`

	// Status Top-level outcome for the request as a whole.
	Status StatusResponse `json:"status"`

	// UnmatchedSignatures Signatures from `entry_point_signatures` that matched zero chains
	// in EVERY data-bearing block.
	UnmatchedSignatures *[]string `json:"unmatched_signatures,omitempty"`
}

type DependenciesResolveResponse struct {
	Components []Dependency `json:"components"`
	Status     BatchStatus  `json:"status"`
}

type Dependency struct {
	Comment   *string `json:"comment,omitempty"`
	Component *string `json:"component,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode            `json:"info_code,omitempty"`
	InfoMessage *string              `json:"info_message,omitempty"`
	Licenses    *[]DependencyLicense `json:"licenses,omitempty"`
	Purl        *string              `json:"purl,omitempty"`
	Requirement *string              `json:"requirement,omitempty"`
	Url         *string              `json:"url,omitempty"`
	Version     *string              `json:"version,omitempty"`
}

type DependencyLicense struct {
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Name           *string `json:"name,omitempty"`
	SpdxId         *string `json:"spdx_id,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type DependencyResolutionError struct {
	Purl             string `json:"purl"`
	Reason           string `json:"reason"`
	RequestedVersion string `json:"requested_version"`
}

type DetectorEnum string

type EPSS struct {
	Percentile  *float32 `json:"percentile,omitempty"`
	Probability *float32 `json:"probability,omitempty"`
}

type EndLineQuery = int

type EngineUnavailable = ErrorBody

type ErrorBody struct {
	Error struct {
		// Code Stable machine-readable error identifier. Possible values:
		//   - INVALID_BODY, INVALID_QUERY, INVALID_FILE_HASH, INVALID_RANGE
		//   - EMPTY_BATCH
		//   - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND
		//   - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED
		//   - TIMEOUT, INTERNAL_ERROR
		Code    string `json:"code"`
		Message string `json:"message"`
	} `json:"error"`
	Status    ErrorBodyStatus `json:"status"`
	Timestamp time.Time       `json:"timestamp"`
}

type ErrorBodyStatus string

type EvidenceRange struct {
	// End Inclusive end (line or byte offset); 0 means whole-file evidence
	End int `json:"end"`

	// EvidenceUrl URL to the fragment backing the detection. The base endpoint is
	// chosen from the detection `source`:
	//   * `notice_declared`           → /v3/notice-contents/{id}
	//   * `header_declared`, `spdx_tag` → /v3/file-contents/{id}
	//   * `metadata_declared`         → /v3/metadata-contents/{id}
	// The `start`/`end` query string is omitted when both are 0.
	EvidenceUrl *string `json:"evidence_url,omitempty"`

	// Start Inclusive start (line or byte offset); 0 means whole-file evidence
	Start int `json:"start"`
}

type FileResult struct {
	// FileHash MD5 of the matched file: equals `source_hash` for a `file` match, the matched OSS file's MD5 for a `snippet` match (differs from `source_hash`), and empty for a `none` match.
	FileHash string `json:"file_hash"`

	// MatchType Full-file match, partial (snippet) match, or no match.
	MatchType FileResultMatchType `json:"match_type"`

	// Matches Matched KB entries for this file.
	Matches []MatchResult `json:"matches"`

	// Path The scanned file path.
	Path string `json:"path"`

	// SourceHash MD5 of the input file (from the WFP).
	SourceHash string `json:"source_hash"`
}

type FileResultMatchType string

type Finding struct {
	CryptographicAssets []CryptoAsset `json:"cryptographic_assets"`
	FilePath            string        `json:"file_path"`
	Language            string        `json:"language"`
}

type ForwardAmbiguousCall struct {
	// CallSite Source invocation shared by every candidate in an unresolved dispatch group.
	CallSite   ForwardAmbiguousCallSite    `json:"call_site"`
	Candidates []ForwardAmbiguousCandidate `json:"candidates"`

	// Completeness Whether call-site and candidate identities are complete.
	Completeness ForwardAmbiguousCallCompleteness `json:"completeness"`

	// GroupId Stable identifier for this call-site ambiguity group.
	GroupId string                     `json:"group_id"`
	Reason  ForwardAmbiguousCallReason `json:"reason"`
}

type ForwardAmbiguousCallCompleteness string

type ForwardAmbiguousCallReason string

type ForwardAmbiguousCallSite struct {
	Arity                    int32   `json:"arity"`
	CallerCanonicalSignature *string `json:"caller_canonical_signature,omitempty"`
	CallerFunctionKey        string  `json:"caller_function_key"`
	CallerFunctionName       *string `json:"caller_function_name,omitempty"`
	EndCol                   *int32  `json:"end_col,omitempty"`
	Line                     *int32  `json:"line,omitempty"`
	MethodName               string  `json:"method_name"`
	StartCol                 *int32  `json:"start_col,omitempty"`
}

type ForwardAmbiguousCandidate struct {
	CandidateId        string  `json:"candidate_id"`
	CanonicalSignature *string `json:"canonical_signature,omitempty"`
	DeclaringType      *string `json:"declaring_type,omitempty"`

	// DependencyInfo Dependency component that owns a function.
	DependencyInfo *ForwardCallDependency `json:"dependency_info,omitempty"`

	// EntryCall Callable identity and argument data flow for a forward edge or candidate.
	EntryCall      *ForwardCallSite `json:"entry_call,omitempty"`
	FunctionKey    string           `json:"function_key"`
	FunctionName   *string          `json:"function_name,omitempty"`
	ParameterTypes []string         `json:"parameter_types"`
	ReturnType     *string          `json:"return_type,omitempty"`
}

type ForwardCallAnchor struct {
	DisplaySymbol *string `json:"display_symbol,omitempty"`
	FunctionKey   string  `json:"function_key"`
	FunctionName  *string `json:"function_name,omitempty"`
}

type ForwardCallDependency struct {
	Module string `json:"module"`

	// Purl Canonical package URL for the owning component, so a consumer can key
	// it the same way this API is queried instead of rebuilding it from
	// `module` and `version` per ecosystem (callgraph schema `6.10+`).
	//
	// Present for known ecosystems (Java, Python, Go, Rust) and omitted for
	// the rest. A dependency with no resolved version yields a versionless
	// purl. It is derived from fields the fragment already carried, so
	// components mined under an older schema also gain it.
	Purl    *string `json:"purl,omitempty"`
	Version *string `json:"version,omitempty"`
}

type ForwardCallEdge struct {
	// EntryCall Callable identity and argument data flow for a forward edge or candidate.
	EntryCall *ForwardCallSite `json:"entry_call,omitempty"`

	// From Caller function key.
	From string `json:"from"`

	// To Callee function key.
	To string `json:"to"`
}

type ForwardCallNode struct {
	CryptoRelevant *bool `json:"crypto_relevant,omitempty"`

	// DependencyInfo Dependency component that owns a function.
	DependencyInfo *ForwardCallDependency `json:"dependency_info,omitempty"`
	Depth          int32                  `json:"depth"`
	DisplaySymbol  *string                `json:"display_symbol,omitempty"`
	FilePath       *string                `json:"file_path,omitempty"`
	FunctionKey    string                 `json:"function_key"`
	FunctionName   *string                `json:"function_name,omitempty"`

	// SupportingCategory Known supporting-call category when the function is catalogued.
	SupportingCategory *string `json:"supporting_category,omitempty"`
}

type ForwardCallSite struct {
	Aliases            *[]string       `json:"aliases,omitempty"`
	CanonicalSignature *string         `json:"canonical_signature,omitempty"`
	DisplaySymbol      *string         `json:"display_symbol,omitempty"`
	FunctionName       *string         `json:"function_name,omitempty"`
	Line               *int32          `json:"line,omitempty"`
	ParameterTypes     *[]string       `json:"parameter_types,omitempty"`
	Parameters         *[]CallArgument `json:"parameters,omitempty"`
	ReturnType         *string         `json:"return_type,omitempty"`
}

type ForwardCalls struct {
	AmbiguousCalls *[]ForwardAmbiguousCall `json:"ambiguous_calls,omitempty"`

	// Anchor The finding function from which forward traversal starts.
	Anchor ForwardCallAnchor  `json:"anchor"`
	Edges  *[]ForwardCallEdge `json:"edges,omitempty"`

	// MaxDepth Applied traversal depth budget, not the deepest observed node.
	MaxDepth  int32              `json:"max_depth"`
	Nodes     *[]ForwardCallNode `json:"nodes,omitempty"`
	Truncated bool               `json:"truncated"`
}

type GeoContributorsResponse struct {
	ComponentsLocations []ComponentLocationInfo `json:"components_locations"`
	Status              BatchStatus             `json:"status"`
}

type GeoCuratedLocation struct {
	Count   *int    `json:"count,omitempty"`
	Country *string `json:"country,omitempty"`
}

type GeoDeclaredLocation struct {
	Location *string `json:"location,omitempty"`

	// Type owner | contributor
	Type *string `json:"type,omitempty"`
}

type GeoLocation struct {
	Name       *string  `json:"name,omitempty"`
	Percentage *float32 `json:"percentage,omitempty"`
}

type GeoOriginResponse struct {
	ComponentsLocations []ComponentLocation `json:"components_locations"`
	Status              BatchStatus         `json:"status"`
}

type GetComponentReachabilityJSONRequestBody = ComponentReachabilityRequest

type GetComponentReleasesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetComponentReleasesParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
	Limit   *int                               `form:"limit,omitempty" json:"limit,omitempty"`
	Offset  *int                               `form:"offset,omitempty" json:"offset,omitempty"`
}

type GetComponentReleasesParamsEncoded string

type GetComponentStatusParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetComponentStatusParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetComponentStatusParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetComponentStatusParamsEncoded string

type GetComponentStatusParamsOnVersionNotFound string

type GetComponentVersionsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl  PurlQuery `form:"purl" json:"purl"`
	Limit *int      `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetFileContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetLicensesComponentParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetLicensesComponentParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetLicensesComponentParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetLicensesComponentParamsEncoded string

type GetLicensesComponentParamsOnVersionNotFound string

type GetLicensesDetailsParams struct {
	// Id SPDX license identifier (e.g. `MIT`, `GPL-2.0-only`).
	Id string `form:"id" json:"id"`
}

type GetLicensesObligationsParams struct {
	// Id SPDX license identifier (e.g. `MIT`, `GPL-2.0-only`).
	Id string `form:"id" json:"id"`
}

type GetMetadataContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetNoticeContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetReachabilityForDepTreeJSONRequestBody = DepTreeReachabilityRequest

type GetScanRawParams struct {
	// Hash File hash — 32-char hex MD5 or 16-char hex CRC64, per the engine's key type. The legacy `md5` parameter is still accepted during rollout (`hash` takes priority); prefer `hash`.
	Hash string `form:"hash" json:"hash"`

	// Flags Engine flags bitmask (-F). Gate: allow_flags_override.
	Flags *int `form:"flags,omitempty" json:"flags,omitempty"`

	// Ranking Max component rank (-r). Gate: ranking_allowed.
	Ranking *int `form:"ranking,omitempty" json:"ranking,omitempty"`

	// MinSnippetHits Minimum snippet ID hits (--min-snippet-hits). Gate: match_config_allowed.
	MinSnippetHits *int `form:"min_snippet_hits,omitempty" json:"min_snippet_hits,omitempty"`

	// MinSnippetLines Minimum matched lines (--min-snippet-lines). Gate: match_config_allowed.
	MinSnippetLines *int `form:"min_snippet_lines,omitempty" json:"min_snippet_lines,omitempty"`

	// IgnoreFileExt Ignore file extension in snippet matching (--ignore-file-ext). Gate: match_config_allowed.
	IgnoreFileExt *bool `form:"ignore_file_ext,omitempty" json:"ignore_file_ext,omitempty"`
}

type GetV3CryptographyAlgorithmsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3CryptographyAlgorithmsParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3CryptographyAlgorithmsParamsEncoded string

type GetV3CryptographyAlgorithmsParamsOnVersionNotFound string

type GetV3CryptographyAlgorithmsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3CryptographyAlgorithmsRangeParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3CryptographyAlgorithmsRangeParamsEncoded string

type GetV3CryptographyAlgorithmsRangeParamsOnVersionNotFound string

type GetV3CryptographyAlgorithmsVersionsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsVersionsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3CryptographyAlgorithmsVersionsRangeParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3CryptographyAlgorithmsVersionsRangeParamsEncoded string

type GetV3CryptographyAlgorithmsVersionsRangeParamsOnVersionNotFound string

type GetV3CryptographyHintsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyHintsParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3CryptographyHintsParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3CryptographyHintsParamsEncoded string

type GetV3CryptographyHintsParamsOnVersionNotFound string

type GetV3CryptographyHintsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyHintsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3CryptographyHintsRangeParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3CryptographyHintsRangeParamsEncoded string

type GetV3CryptographyHintsRangeParamsOnVersionNotFound string

type GetV3DependenciesDependenciesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3DependenciesDependenciesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3DependenciesDependenciesParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3DependenciesDependenciesParamsEncoded string

type GetV3DependenciesDependenciesParamsOnVersionNotFound string

type GetV3GeoprovenanceCountriesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3GeoprovenanceCountriesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3GeoprovenanceCountriesParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3GeoprovenanceCountriesParamsEncoded string

type GetV3GeoprovenanceCountriesParamsOnVersionNotFound string

type GetV3GeoprovenanceOriginParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3GeoprovenanceOriginParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3GeoprovenanceOriginParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3GeoprovenanceOriginParamsEncoded string

type GetV3GeoprovenanceOriginParamsOnVersionNotFound string

type GetV3VulnerabilitiesCpesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3VulnerabilitiesCpesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3VulnerabilitiesCpesParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3VulnerabilitiesCpesParamsEncoded string

type GetV3VulnerabilitiesCpesParamsOnVersionNotFound string

type GetV3VulnerabilitiesVulnerabilitiesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3VulnerabilitiesVulnerabilitiesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`

	// Encoded Output encoding for content string values (`none` default, `url_encoded`, `base64_encoded`); control fields and object keys are never encoded.
	Encoded *GetV3VulnerabilitiesVulnerabilitiesParamsEncoded `form:"encoded,omitempty" json:"encoded,omitempty"`
}

type GetV3VulnerabilitiesVulnerabilitiesParamsEncoded string

type GetV3VulnerabilitiesVulnerabilitiesParamsOnVersionNotFound string

type InfoCode string

type InternalError = ErrorBody

type KnowledgeBase struct {
	// DailyVersion Daily KB delta version.
	DailyVersion string `json:"daily_version,omitempty"`

	// MonthlyVersion Monthly KB snapshot version.
	MonthlyVersion string `json:"monthly_version,omitempty"`
}

type LicenseDetails struct {
	FullName *string `json:"full_name,omitempty"`

	// Osadl OSADL compliance metadata for a license.
	Osadl *OSADLInfo `json:"osadl,omitempty"`

	// Spdx SPDX registry metadata for a license.
	Spdx *SPDXInfo `json:"spdx,omitempty"`
}

type LicenseDetailsResponse struct {
	License *LicenseDetails `json:"license,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type LicenseDetection struct {
	Confidence float32 `json:"confidence"`

	// Detector Name of the detector that produced the evidence.
	Detector DetectorEnum `json:"detector"`

	// Evidence Line range or byte range of the evidence, depending on the server's
	// license-hints backend: 1-based inclusive **line numbers** with the
	// default `postgres` backend, or **byte offsets** with the `ldb` backend.
	// The content endpoints slice `?start=&end=` by the same unit.
	Evidence  EvidenceRange `json:"evidence"`
	LicenseId string        `json:"license_id"`

	// Source Origin/category of the evidence. Today only `header_declared`,
	// `notice_declared` and `metadata_declared` are emitted (derived from
	// the file path); `spdx_tag` and `project_declared` are reserved for a
	// richer signal.
	Source SourceEnum `json:"source"`
}

type LicenseEvidenceFile struct {
	Detections []LicenseDetection `json:"detections"`
	File       string             `json:"file"`

	// FileId MD5 of the file content (used as the content endpoint id).
	FileId string `json:"file_id"`
}

type LicenseEvidenceItem struct {
	Files *[]LicenseEvidenceFile `json:"files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url *string `json:"url,omitempty"`

	// Version Concrete version resolved from `requirement`.
	Version *string `json:"version,omitempty"`
}

type LicenseEvidenceResponse struct {
	Components []LicenseEvidenceItem `json:"components"`
	Status     BatchStatus           `json:"status"`
}

type LicenseInfo struct {
	FullName       *string `json:"full_name,omitempty"`
	Id             *string `json:"id,omitempty"`
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type LineRange struct {
	// EndLine Last line of the matched range.
	EndLine int `json:"end_line"`

	// StartLine First line of the matched range.
	StartLine int `json:"start_line"`
}

type LookupStatusResponse struct {
	Message *string                     `json:"message,omitempty"`
	Status  *LookupStatusResponseStatus `json:"status,omitempty"`
}

type LookupStatusResponseStatus string

type MatchResult struct {
	// InputLineRanges Snippet matches only — matched line ranges in the input file.
	InputLineRanges []LineRange `json:"input_line_ranges,omitempty"`

	// MatchPercentage Snippet matches only; omitted for full-file matches.
	MatchPercentage int `json:"match_percentage,omitempty"`

	// OssFilePath Path of the matched file inside the OSS component.
	OssFilePath string `json:"oss_file_path,omitempty"`

	// OssLineRanges Snippet matches only — matched line ranges in the OSS file.
	OssLineRanges []LineRange `json:"oss_line_ranges,omitempty"`

	// UrlHash url_hash of the matched component release.
	UrlHash string `json:"url_hash"`
}

type MatchedOperation struct {
	Expression *string              `json:"expression,omitempty"`
	Kind       MatchedOperationKind `json:"kind"`
	Line       int32                `json:"line"`
	Symbol     string               `json:"symbol"`
}

type MatchedOperationKind string

type NotFound = ErrorBody

type OSADLInfo struct {
	Compatibility          *[]string `json:"compatibility,omitempty"`
	CopyleftClause         *bool     `json:"copyleft_clause,omitempty"`
	DependingCompatibility *[]string `json:"depending_compatibility,omitempty"`
	Incompatibility        *[]string `json:"incompatibility,omitempty"`
	PatentHints            *bool     `json:"patent_hints,omitempty"`
}

type ObligationsResponse struct {
	// Obligations OSADL compliance metadata for a license.
	Obligations *OSADLInfo `json:"obligations,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type ParameterCondition struct {
	Match    ParameterConditionMatch    `json:"match"`
	Operator ParameterConditionOperator `json:"operator"`

	// Raw Original predicate text.
	Raw string `json:"raw"`

	// Selector Argument selected by a structured parameter condition.
	Selector ParameterSelector `json:"selector"`
	Value    string            `json:"value"`
}

type ParameterConditionMatch string

type ParameterConditionOperator string

type ParameterContribution struct {
	Derivation *ParameterContributionDerivation `json:"derivation,omitempty"`
	Property   *string                          `json:"property,omitempty"`
}

type ParameterContributionDerivation string

type ParameterRole struct {
	Contributes *ParameterContribution `json:"contributes,omitempty"`
	Index       int32                  `json:"index"`
	Name        *string                `json:"name,omitempty"`
	Role        ParameterRoleKind      `json:"role"`
}

type ParameterRoleKind string

type ParameterSelector struct {
	// Index Zero-based positional index; null for a name-only selector.
	Index *int32 `json:"index"`

	// Name Parameter name; null for an index-only selector.
	Name *string `json:"name"`
}

type PayloadTooLarge = ErrorBody

type PostComponentsReleasesJSONRequestBody = BatchRequest

type PostComponentsStatusJSONRequestBody = BatchRequest

type PostCopyrightEvidenceJSONRequestBody = BatchRequest

type PostCopyrightHoldersJSONRequestBody = BatchRequest

type PostLicenseAttributionJSONRequestBody = BatchRequest

type PostLicenseEvidenceJSONRequestBody = BatchRequest

type PostLicensesComponentsJSONRequestBody = BatchRequest

type PostScanBatchParams struct {
	// XScanId Absent → Mode B (synchronous single-shot). Present → Mode A (chunked async): a client-generated canonical lowercase UUIDv7, sent on every block of the session.
	XScanId *openapi_types.UUID `json:"X-Scan-Id,omitempty"`

	// ContentRange Required in Mode A (`X-Scan-Id` present): byte range of this block, e.g. `bytes 0-8388607/26214400` (end inclusive, 0-based). Ignored in Mode B.
	ContentRange *string `json:"Content-Range,omitempty"`
}

type PostScanComponentsJSONRequestBody = ScanSbom

type PostScanComponentsParams struct {
	// Urlhash One urlhash, or several comma-separated (`h1,h2,h3`).
	Urlhash string `form:"urlhash" json:"urlhash"`

	// Flags Engine flags bitmask (-F). Gate: allow_flags_override.
	Flags *int `form:"flags,omitempty" json:"flags,omitempty"`
}

type PostScanDirectMultipartBody struct {
	File openapi_types.File `json:"file"`
}

type PostScanDirectMultipartRequestBody PostScanDirectMultipartBody

type PostScanSnippetsParams struct {
	// Threshold Minimum match threshold (percent).
	Threshold *int `form:"threshold,omitempty" json:"threshold,omitempty"`

	// Flags Engine flags bitmask (-F). Gate: allow_flags_override. (Snippet/ranking tuning applies to /v3/raw/scan only.)
	Flags *int `form:"flags,omitempty" json:"flags,omitempty"`
}

type PostScanSnippetsTextBody = string

type PostScanSnippetsTextRequestBody = PostScanSnippetsTextBody

type PostV3CryptographyAlgorithmsJSONRequestBody = BatchRequest

type PostV3CryptographyAlgorithmsRangeJSONRequestBody = BatchRequest

type PostV3CryptographyAlgorithmsVersionsRangeJSONRequestBody = BatchRequest

type PostV3CryptographyHintsJSONRequestBody = BatchRequest

type PostV3CryptographyHintsRangeJSONRequestBody = BatchRequest

type PostV3DependenciesDependenciesJSONRequestBody = BatchRequest

type PostV3DependenciesTransitiveJSONRequestBody = TransitiveRequest

type PostV3GeoprovenanceCountriesJSONRequestBody = BatchRequest

type PostV3GeoprovenanceOriginJSONRequestBody = BatchRequest

type PostV3VulnerabilitiesCpesJSONRequestBody = BatchRequest

type PostV3VulnerabilitiesVulnerabilitiesJSONRequestBody = BatchRequest

type PurlQuery = string

type RangeConflict = ErrorBody

type RawScanResult map[string][]map[string]interface{}

type ReachabilityInfoCode = string

type ReachableFinding struct {
	// ChainDepth Number of intermediate hops between the entry point and this finding.
	ChainDepth int32 `json:"chain_depth"`

	// FindingGraphRef Reference to the `finding_id` of the finding graph this was resolved from.
	FindingGraphRef string `json:"finding_graph_ref"`
	FindingId       string `json:"finding_id"`

	// MatchedOperation The cryptographic operation matched by a detection rule.
	MatchedOperation MatchedOperation `json:"matched_operation"`
}

type ReachableSupportingCall struct {
	ChainDepth        int32  `json:"chain_depth"`
	SupportingCallRef string `json:"supporting_call_ref"`
	SupportingId      string `json:"supporting_id"`
}

type ReadinessResponse struct {
	Checks map[string]ComponentHealth `json:"checks"`
	Status ReadinessResponseStatus    `json:"status"`
}

type ReadinessResponseStatus string

type Release struct {
	Date         *string `json:"date,omitempty"`
	ReleaseNotes *string `json:"release_notes,omitempty"`
	Url          *string `json:"url,omitempty"`
	Version      *string `json:"version,omitempty"`
}

type ReleaseBatchItem struct {
	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`

	// Release One version's changelog entry (raw notes text + all_urls metadata).
	Release     *Release `json:"release,omitempty"`
	Requirement *string  `json:"requirement,omitempty"`
	Version     *string  `json:"version,omitempty"`
}

type ReleaseComponent struct {
	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ReleasesBatchResponse struct {
	Components []ReleaseBatchItem `json:"components"`
	Status     BatchStatus        `json:"status"`
}

type ReleasesResponse struct {
	// Component The {purl, requirement, version} block echoed on the releases responses.
	Component ReleaseComponent `json:"component"`
	Releases  []Release        `json:"releases"`
	Status    BatchStatus      `json:"status"`
}

type Request struct {
	// Purl Package URL
	Purl string `json:"purl"`

	// Requirement Optional version requirement
	Requirement *string `json:"requirement,omitempty"`
}

type RequirementQuery = string

type SPDXInfo struct {
	DetailsUrl    *string   `json:"details_url,omitempty"`
	FullName      *string   `json:"full_name,omitempty"`
	Id            *string   `json:"id,omitempty"`
	IsDeprecated  *bool     `json:"is_deprecated,omitempty"`
	IsFsfLibre    *bool     `json:"is_fsf_libre,omitempty"`
	IsOsiApproved *bool     `json:"is_osi_approved,omitempty"`
	ReferenceUrl  *string   `json:"reference_url,omitempty"`
	SeeAlso       *[]string `json:"see_also,omitempty"`
}

type ScanComponentsResponse struct {
	Results *[]struct {
		Component *struct {
			ReleaseDate *string `json:"release_date,omitempty"`
			Version     *string `json:"version,omitempty"`
		} `json:"component,omitempty"`
		UrlHash *string `json:"url_hash,omitempty"`
	} `json:"results,omitempty"`
}

type ScanEnvelope struct {
	// Error Populated only when status is `failed`.
	Error string `json:"error,omitempty"`

	// FilesTotal File count of the report, filled in on completion.
	FilesTotal int `json:"files_total,omitempty"`

	// Phase Current pipeline pass while scanning, e.g. 'Pass 1: scan files'.
	Phase string `json:"phase,omitempty"`

	// PhaseDone Items processed in the current phase.
	PhaseDone int `json:"phase_done,omitempty"`

	// PhaseTotal Total items in the current phase.
	PhaseTotal int `json:"phase_total,omitempty"`

	// ReceivedBytes Bytes received so far (Mode A upload; omitted when 0).
	ReceivedBytes int `json:"received_bytes,omitempty"`

	// Result Populated only when status is `completed`. The batchScanner report — byte-identical whether obtained synchronously (Mode B) or by polling an async session to completion (Mode A).
	Result *ScanResult `json:"result,omitempty"`

	// ScanId Canonical lowercase UUIDv7 session id. In Mode A this is the client-supplied id; in Mode B it is a server-generated id for traceability only (no session is created).
	ScanId string             `json:"scan_id"`
	Status ScanEnvelopeStatus `json:"status"`

	// TotalBytes Declared total upload size (Mode A; omitted when 0).
	TotalBytes int `json:"total_bytes,omitempty"`

	// UploadPercent Exact upload progress percent (Mode A; omitted when 0).
	UploadPercent int `json:"upload_percent,omitempty"`
}

type ScanEnvelopeStatus string

type ScanExpired = ErrorBody

type ScanNotFound = ErrorBody

type ScanRawMatch struct {
	Purl *string `json:"purl,omitempty"`

	// Rank Engine match ordering; lower is a stronger match.
	Rank      *int      `json:"rank,omitempty"`
	UrlHashes *[]string `json:"url_hashes,omitempty"`
}

type ScanRawResponse struct {
	FileHash *string         `json:"file_hash,omitempty"`
	Matches  *[]ScanRawMatch `json:"matches,omitempty"`
}

type ScanResult struct {
	// Components Resolved components keyed by url_hash. Extra fields may be present.
	Components map[string]ComponentResult `json:"components,omitempty"`

	// Files One entry per scanned file (order is unspecified).
	Files []FileResult `json:"files,omitempty"`

	// Server Optional run/server metadata passed through from the batchScanner pipeline when present; omitted otherwise.
	Server *ScanServer `json:"server,omitempty"`
}

type ScanSbom struct {
	Components *[]struct {
		Purl *string `json:"purl,omitempty"`
	} `json:"components,omitempty"`
}

type ScanServer struct {
	// ApiVersion batchScanner API version.
	ApiVersion string `json:"api_version,omitempty"`

	// ElapsedMs Scan wall-clock time
	ElapsedMs int `json:"elapsed_ms,omitempty"`

	// Hostname Host that ran the scan.
	Hostname      string         `json:"hostname,omitempty"`
	KnowledgeBase *KnowledgeBase `json:"knowledge_base,omitempty"`
}

type SearchComponentsParams struct {
	// Search Free-form search term. Overrides `vendor`/`component` when present.
	Search    *string `form:"search,omitempty" json:"search,omitempty"`
	Vendor    *string `form:"vendor,omitempty" json:"vendor,omitempty"`
	Component *string `form:"component,omitempty" json:"component,omitempty"`

	// PurlType purl type (github, npm, pypi, gem, maven, …). Defaults to github.
	PurlType *string `form:"purl_type,omitempty" json:"purl_type,omitempty"`
	Limit    *int    `form:"limit,omitempty" json:"limit,omitempty"`
	Offset   *int    `form:"offset,omitempty" json:"offset,omitempty"`
}

type SearchCriteria struct {
	// Encoded Output encoding for content string values of the response
	// (`none` default, `url_encoded`, `base64_encoded`). Control fields
	// (`info_code`, `info_message`, `status`, `message`, `requirement`)
	// and object keys are never encoded.
	Encoded *SearchCriteriaEncoded `json:"encoded,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array in the output. 0 = no limit.
	MaxResultsPerPurl *int `json:"max_results_per_purl,omitempty"`

	// OnVersionNotFound Version fallback when the requested version has no data:
	// `strict` (no fallback), `show_latest`, `show_closest_lt`,
	// `show_closest_gt`, `show_any`. Not applied to range endpoints.
	OnVersionNotFound *SearchCriteriaOnVersionNotFound `json:"on_version_not_found,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *bool `json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in each result (placeholder — data source TBD).
	ShowUrl *bool `json:"show_url,omitempty"`
}

type SearchCriteriaEncoded string

type SearchCriteriaOnVersionNotFound string

type SearchEncoded string

type SearchMaxResults = int

type SearchOnVersionNotFound string

type SearchShowRelated = bool

type SearchShowURL = bool

type SnippetCandidate struct {
	FileHash *string `json:"file_hash,omitempty"`
	Hits     *int    `json:"hits,omitempty"`

	// InputLineRanges Comma-separated line ranges in the posted WFP, e.g. "12-148".
	InputLineRanges *string `json:"input_line_ranges,omitempty"`
	LinesMatched    *int    `json:"lines_matched,omitempty"`
	MatchedPercent  *int    `json:"matched_percent,omitempty"`

	// OssLineRanges Comma-separated line ranges in the KB component.
	OssLineRanges *string `json:"oss_line_ranges,omitempty"`
}

type SnippetGroup struct {
	Candidates *[]SnippetCandidate `json:"candidates,omitempty"`
	GroupIndex *int                `json:"group_index,omitempty"`
}

type SnippetResponse struct {
	FileHash      *string         `json:"file_hash,omitempty"`
	FilePath      *string         `json:"file_path,omitempty"`
	FileSize      *int            `json:"file_size,omitempty"`
	SnippetGroups *[]SnippetGroup `json:"snippet_groups,omitempty"`
	TolerancePct  *float32        `json:"tolerance_pct,omitempty"`
	TotalLines    *int            `json:"total_lines,omitempty"`
}

type SourceEnum string

type SourceLocation struct {
	FilePath string `json:"file_path"`
	Line     int32  `json:"line"`
}

type StartLineQuery = int

type StatusResponse struct {
	Message *string               `json:"message,omitempty"`
	Status  *StatusResponseStatus `json:"status,omitempty"`
}

type StatusResponseStatus string

type SupportingCall struct {
	CanonicalSignature string `json:"canonical_signature"`

	// Category Producer-owned semantic category. Contract lifecycle values are
	// `factory`, `config`, `operation`, and `output`; other producer
	// categories remain forward-compatible.
	Category      *string `json:"category,omitempty"`
	DisplaySymbol *string `json:"display_symbol,omitempty"`
	EndLine       *int32  `json:"end_line,omitempty"`
	FilePath      *string `json:"file_path,omitempty"`
	FunctionKey   *string `json:"function_key,omitempty"`
	FunctionName  string  `json:"function_name"`

	// MatchedOperation The cryptographic operation matched by a detection rule.
	MatchedOperation *MatchedOperation `json:"matched_operation,omitempty"`
	StartLine        *int32            `json:"start_line,omitempty"`

	// SupportingCall Canonical callable and argument contract for a crypto or supporting call.
	SupportingCall *CryptoCall `json:"supporting_call,omitempty"`

	// SupportingId Stable ID for this supporting call. Primary key for the foreign-key relationship.
	SupportingId string `json:"supporting_id"`
}

type Timeout = ErrorBody

type TransitiveDependency struct {
	Purl        *string `json:"purl,omitempty"`
	Requirement *string `json:"requirement,omitempty"`
	Version     *string `json:"version,omitempty"`
}

type TransitiveRequest struct {
	Components []Request `json:"components"`
	Depth      *int      `json:"depth,omitempty"`
	Limit      *int      `json:"limit,omitempty"`
}

type TransitiveResponse struct {
	Dependencies *[]TransitiveDependency `json:"dependencies,omitempty"`
	Status       BatchStatus             `json:"status"`
}

type VulnerabilitiesResponse struct {
	Components []ComponentVulnerabilityInfo `json:"components"`
	Status     BatchStatus                  `json:"status"`
}

type Vulnerability struct {
	Cve       *string              `json:"cve,omitempty"`
	Cvss      *[]CVSS              `json:"cvss,omitempty"`
	Epss      *EPSS                `json:"epss,omitempty"`
	Id        *string              `json:"id,omitempty"`
	Modified  *string              `json:"modified,omitempty"`
	Published *string              `json:"published,omitempty"`
	Severity  *string              `json:"severity,omitempty"`
	Source    *VulnerabilitySource `json:"source,omitempty"`
	Summary   *string              `json:"summary,omitempty"`
	Url       *string              `json:"url,omitempty"`
}

type VulnerabilitySource string