scanossapi

type AttributionFile struct {
	// AttributionUrl URL to the full content of the attribution file.
	AttributionUrl string `json:"attribution_url"`

	// File Relative path of the attribution file within the component.
	File string `json:"file"`

	// FileId MD5 of the content — the same hash that is the last path segment
	// of `attribution_url`.
	FileId string `json:"file_id"`
}

type AttributionItem struct {
	AttributionFiles *[]AttributionFile `json:"attribution_files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url *string `json:"url,omitempty"`

	// Version Concrete version resolved from `requirement`.
	Version *string `json:"version,omitempty"`
}

type AttributionResponse struct {
	Components []AttributionItem `json:"components"`
	Status     BatchStatus       `json:"status"`
}

type BadRequest = ErrorBody

type BatchRequest struct {
	Components []Request `json:"components"`

	// Search Optional request-level search configuration applied to every component
	// in the batch (for GET endpoints the same knobs are query params). All
	// fields are optional; the defaults disable every fallback (strict version
	// matching, no related results). Honored by endpoints that support search
	// criteria — currently `/v3/license/evidence`.
	Search *SearchCriteria `json:"search,omitempty"`
}

type BatchStatus struct {
	Message string            `json:"message"`
	Status  BatchStatusStatus `json:"status"`
}

type BatchStatusStatus string

type CVSS struct {
	// Cvss CVSS vector string
	Cvss         *string  `json:"cvss,omitempty"`
	CvssScore    *float32 `json:"cvss_score,omitempty"`
	CvssSeverity *string  `json:"cvss_severity,omitempty"`
}

type CallArgument struct {
	// ArgumentExpression The exact argument expression as written in source.
	ArgumentExpression string            `json:"argument_expression"`
	ParameterIndex     int32             `json:"parameter_index"`
	SourceNodes        *[]DataFlowSource `json:"source_nodes,omitempty"`

	// Type Argument type inferred at the call site.
	Type string `json:"type"`

	// VariableName Variable name at the call site; empty for literals/expressions.
	VariableName *string `json:"variable_name,omitempty"`
}

type CallNode struct {
	CanonicalSignature string `json:"canonical_signature"`

	// EntryCall The call site where one node in a chain invokes the next.
	// Present on every chain node except the entry-point node.
	EntryCall    *CallSite `json:"entry_call,omitempty"`
	FilePath     *string   `json:"file_path,omitempty"`
	FunctionName string    `json:"function_name"`

	// IsFinal Present and true only on the last frame of each emitted call chain.
	IsFinal         *bool                    `json:"is_final,omitempty"`
	OwnerVisibility *CallNodeOwnerVisibility `json:"owner_visibility,omitempty"`
	ParameterTypes  []string                 `json:"parameter_types"`
	ReturnType      string                   `json:"return_type"`
	StartLine       *int32                   `json:"start_line,omitempty"`
	Visibility      *CallNodeVisibility      `json:"visibility,omitempty"`
}

type CallNodeOwnerVisibility string

type CallNodeVisibility string

type CallSite struct {
	CanonicalSignature string `json:"canonical_signature"`

	// FilePath File where the call expression appears.
	FilePath string `json:"file_path"`

	// FunctionName FQN of the invoked function.
	FunctionName   string          `json:"function_name"`
	Line           int32           `json:"line"`
	ParameterTypes []string        `json:"parameter_types"`
	Parameters     *[]CallArgument `json:"parameters,omitempty"`
	ReturnType     string          `json:"return_type"`
}

type Component struct {
	Name     *string             `json:"name,omitempty"`
	Purl     *string             `json:"purl,omitempty"`
	Url      *string             `json:"url,omitempty"`
	Versions *[]ComponentVersion `json:"versions,omitempty"`
}

type ComponentAlgorithms struct {
	Algorithms *[]CryptoAlgorithm `json:"algorithms,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentAlgorithmsInRange struct {
	Algorithms *[]CryptoAlgorithm `json:"algorithms,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Versions    *[]string `json:"versions,omitempty"`
}

type ComponentCpesInfo struct {
	Cpes        *[]string `json:"cpes,omitempty"`
	InfoCode    *string   `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentData struct {
	// ActualMinedVersion Present only when the requested exact version was not present in
	// `component_crypto_findings` and the server resolved to the highest mined version
	// in the same `major.minor` bucket, treating it as a representative for
	// the requested version. Absent on exact matches and on range-constraint
	// resolutions (those echo the original constraint in `requirement`).
	ActualMinedVersion *string `json:"actual_mined_version,omitempty"`

	// CryptoEntryPoints Per-block projection of the merged callgraph's `crypto_entry_points[]`
	// (callgraph 6.x schema), narrowed to entries whose `reachable_findings`
	// intersect this block's surviving assets. Passed through as raw JSON.
	// Populated only when `include_crypto_entry_points: true`.
	//
	// This field **replaced** the legacy `entry_point_index` present in
	// callgraph schemas prior to 6.x.
	CryptoEntryPoints *[]CryptoEntryPoint `json:"crypto_entry_points,omitempty"`

	// FindingCount Total cryptographic_assets count across all findings[] in this
	// block. POST-PRUNE — when a filter is active, reflects surviving
	// assets, NOT the unfiltered universe.
	FindingCount int32     `json:"finding_count"`
	Findings     []Finding `json:"findings"`
	Purl         string    `json:"purl"`

	// Requirement Echo of the request requirement string when known.
	Requirement *string `json:"requirement,omitempty"`

	// Schemas Source crypto-finder schema versions for this component block.
	Schemas *ComponentSchemas `json:"schemas,omitempty"`

	// SupportingCalls Deduped object-lifecycle calls (e.g. IV generation, key-size
	// initialisation) referenced by surviving assets in this block.
	// Passed through as raw JSON from the merged callgraph 6.x
	// `supporting_calls[]`. Populated only when
	// `include_supporting_calls: true`.
	//
	// Each entry is identified by `supporting_id`, which is the
	// foreign key referenced from:
	// - `cryptographic_asset.supporting_call_ids[]` (per-asset breadcrumb)
	// - `crypto_entry_points[].reachable_supporting_calls[].supporting_id`
	SupportingCalls *[]SupportingCall `json:"supporting_calls,omitempty"`
	Version         string            `json:"version"`
}

type ComponentHealth struct {
	// Detail Error message or extra context (present on error / when relevant).
	Detail *string               `json:"detail,omitempty"`
	Status ComponentHealthStatus `json:"status"`
}

type ComponentHealthStatus string

type ComponentHints struct {
	Hints *[]CryptoHint `json:"hints,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Requirement *string   `json:"requirement,omitempty"`
	Version     *string   `json:"version,omitempty"`
}

type ComponentHintsInRange struct {
	Hints *[]CryptoHint `json:"hints,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        *string   `json:"purl,omitempty"`
	Versions    *[]string `json:"versions,omitempty"`
}

type ComponentLicenseInfo struct {
	InfoCode    *string        `json:"info_code,omitempty"`
	InfoMessage *string        `json:"info_message,omitempty"`
	Licenses    *[]LicenseInfo `json:"licenses,omitempty"`
	Purl        *string        `json:"purl,omitempty"`
	Requirement *string        `json:"requirement,omitempty"`

	// Statement License IDs joined with " AND ".
	Statement *string `json:"statement,omitempty"`
	Url       *string `json:"url,omitempty"`
	Version   *string `json:"version,omitempty"`
}

type ComponentLicenseResponse struct {
	// Component Per-component license result. `info_code` is one of
	// `REQUIREMENT_NOT_MET`, `VERSION_NOT_FOUND`, `NO_INFO` (absent on an exact
	// match).
	Component *ComponentLicenseInfo `json:"component,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type ComponentLifecycleStatus struct {
	FirstIndexedDate *string `json:"first_indexed_date,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode         *InfoCode `json:"info_code,omitempty"`
	InfoMessage      *string   `json:"info_message,omitempty"`
	LastIndexedDate  *string   `json:"last_indexed_date,omitempty"`
	RepositoryStatus *string   `json:"repository_status,omitempty"`
	Status           *string   `json:"status,omitempty"`
	StatusChangeDate *string   `json:"status_change_date,omitempty"`
}

type ComponentLocation struct {
	// InfoCode INVALID_PURL | NO_INFO | TOO_MANY_CONTRIBUTORS
	InfoCode    *string        `json:"info_code,omitempty"`
	InfoMessage *string        `json:"info_message,omitempty"`
	Locations   *[]GeoLocation `json:"locations,omitempty"`
	Purl        *string        `json:"purl,omitempty"`
}

type ComponentLocationInfo struct {
	CuratedLocations  *[]GeoCuratedLocation  `json:"curated_locations,omitempty"`
	DeclaredLocations *[]GeoDeclaredLocation `json:"declared_locations,omitempty"`

	// InfoCode INVALID_PURL | NO_INFO | TOO_MANY_CONTRIBUTORS
	InfoCode    *string `json:"info_code,omitempty"`
	InfoMessage *string `json:"info_message,omitempty"`
	Purl        *string `json:"purl,omitempty"`
}

type ComponentReachabilityRequest struct {
	// EntryPointSignatures Optional exact-match filter on entry-point canonical signatures.
	// When non-empty, `assets[]` is **restricted to findings reachable
	// from at least one supplied entry point**. Findings unreachable
	// from any supplied entry are REMOVED entirely from `assets[]` —
	// they do NOT appear as `reachable=false` entries. An empty array
	// (or absent field) means no filter; all findings are returned.
	// Signatures that matched zero call chains are listed in
	// `unmatched_signatures` at the top level of the response
	// (diagnostic for typos).
	EntryPointSignatures *[]string `json:"entry_point_signatures,omitempty"`

	// IncludeCallChains When true, decorates each asset with its `call_chains[]` array
	// (raw callgraph 6.x frame arrays) and the `reachable` bool.
	// Default false produces a pure CBOM response (findings without
	// reachability decoration). Independent of `entry_point_signatures`
	// (which controls whether assets are PRUNED to reachable ones).
	// Independent of `include_crypto_entry_points` and
	// `include_supporting_calls`.
	IncludeCallChains *bool `json:"include_call_chains,omitempty"`

	// IncludeCryptoEntryPoints When true, populates `crypto_entry_points[]` at the top level
	// of each `ComponentData` block — the public reachability surface
	// (entry-point functions with their `reachable_findings[]`).
	// This is the projection that **replaced** the legacy
	// `entry_point_index` field.
	// Independent of `include_call_chains` and `include_supporting_calls`.
	IncludeCryptoEntryPoints *bool `json:"include_crypto_entry_points,omitempty"`

	// IncludeRawCallgraph When true, `callgraph` at the top level of the response carries
	// the unfiltered merged callgraph.
	IncludeRawCallgraph *bool `json:"include_raw_callgraph,omitempty"`

	// IncludeSupportingCalls When true, populates `supporting_calls[]` at the top level of
	// each `ComponentData` block (deduped object-lifecycle calls such
	// as IV generation and key-size initialisation) AND attaches
	// `supporting_call_ids[]` to each `cryptographic_asset` whose
	// finding graph references supporting calls. Each
	// `supporting_call_id` resolves to a `supporting_calls[].supporting_id`
	// in the same block.
	// Independent of `include_call_chains` and `include_crypto_entry_points`.
	IncludeSupportingCalls *bool `json:"include_supporting_calls,omitempty"`

	// MaxChainsPerAsset Per-asset cap on `call_chains[]` length. Hard cap 128.
	// `0` (the default) means no cap — all chains are returned. Use a
	// positive integer to limit chains per asset. Values above 128 are
	// rejected with HTTP 400.
	MaxChainsPerAsset *int32 `json:"max_chains_per_asset,omitempty"`
	Purl              string `json:"purl"`

	// Requirement Version constraint. Accepts exact versions (`1.5.2`, `=1.5.2`) or
	// SemVer constraint expressions (`>=1.5.0`, `^1.5.0`, `~1.5.0`,
	// `>=1.5.0,<2.0.0`). The leading `=` is optional. For range
	// expressions, the server resolves to the highest mined version
	// satisfying the constraint; no match → `VERSION_NOT_FOUND`.
	Requirement *string `json:"requirement,omitempty"`
}

type ComponentReachabilityResponse struct {
	// Callgraph Raw merged callgraph as JSON, populated only when the request set
	// `include_raw_callgraph: true`. Shape matches crypto-finder
	// callgraph schema 6.x verbatim.
	Callgraph *map[string]interface{} `json:"callgraph,omitempty"`
	Data      *[]ComponentData        `json:"data,omitempty"`

	// InfoCode One of:
	// - `READY` — reachability data computed successfully.
	// - `INVALID_PURL` — the supplied PURL could not be parsed.
	// - `INVALID_SEMVER` — the requirement is structurally invalid.
	// - `COMPONENT_NOT_FOUND` — the purl has no mining results at any version.
	// - `VERSION_NOT_FOUND` — no mined version matches the supplied requirement.
	// - `NO_INFO` — reachability data unavailable (stitch failed or timed out).
	InfoCode    string  `json:"info_code"`
	InfoMessage *string `json:"info_message,omitempty"`

	// RulesVersion Echoed on READY — the rules_version active for this row.
	RulesVersion *string `json:"rules_version,omitempty"`

	// Status Top-level outcome for the request as a whole.
	Status StatusResponse `json:"status"`

	// UnmatchedSignatures Signatures from `entry_point_signatures` that matched zero chains.
	UnmatchedSignatures *[]string `json:"unmatched_signatures,omitempty"`
}

type ComponentRequest struct {
	// Purl Package URL identifying the component.
	Purl string `json:"purl"`

	// Requirement Version constraint when the PURL has no explicit version. Accepts:
	// - Exact versions with or without leading `=`: `1.15`, `=1.15`
	// - SemVer constraint expressions: `>=1.10,<1.16`, `^1.5.0`, `~1.5.0`
	//
	// For range expressions, the server resolves to the highest mined
	// version that satisfies the constraint. Maven non-SemVer qualifiers
	// (e.g. `1.5.2.RELEASE`) are accepted as exact literals.
	Requirement *string `json:"requirement,omitempty"`
}

type ComponentResult struct {
	Component   string   `json:"component,omitempty"`
	File        string   `json:"file,omitempty"`
	Purls       []string `json:"purls,omitempty"`
	Rank        int      `json:"rank,omitempty"`
	ReleaseDate string   `json:"release_date,omitempty"`
	Url         string   `json:"url,omitempty"`
	Vendor      string   `json:"vendor,omitempty"`
	Version     string   `json:"version,omitempty"`
}

type ComponentSchemas struct {
	Callgraph *string `json:"callgraph,omitempty"`
	Findings  *string `json:"findings,omitempty"`
}

type ComponentSearchHit struct {
	Name *string `json:"name,omitempty"`
	Purl *string `json:"purl,omitempty"`

	// Url Project URL reconstructed from mine_id (may be empty).
	Url *string `json:"url,omitempty"`
}

type ComponentStatusResult struct {
	ComponentStatus *ComponentLifecycleStatus `json:"component_status,omitempty"`
	Name            *string                   `json:"name,omitempty"`
	Purl            *string                   `json:"purl,omitempty"`
	Requirement     *string                   `json:"requirement,omitempty"`
	VersionStatus   *ComponentVersionStatus   `json:"version_status,omitempty"`
}

type ComponentVersion struct {
	// Date Release date as reported by the upstream registry.
	Date     *string                    `json:"date,omitempty"`
	Licenses *[]ComponentVersionLicense `json:"licenses,omitempty"`
	Version  *string                    `json:"version,omitempty"`
}

type ComponentVersionLicense struct {
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Name           *string `json:"name,omitempty"`
	SpdxId         *string `json:"spdx_id,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type ComponentVersionStatus struct {
	IndexedDate *string `json:"indexed_date,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`

	// RepositoryStatus Raw status string reported by the registry.
	RepositoryStatus *string `json:"repository_status,omitempty"`

	// Status Canonical lifecycle (active / removed / deprecated / deleted).
	Status           *string `json:"status,omitempty"`
	StatusChangeDate *string `json:"status_change_date,omitempty"`
	Version          *string `json:"version,omitempty"`
}

type ComponentVersionsInRange struct {
	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode        *InfoCode `json:"info_code,omitempty"`
	InfoMessage     *string   `json:"info_message,omitempty"`
	Purl            *string   `json:"purl,omitempty"`
	VersionsWith    *[]string `json:"versions_with,omitempty"`
	VersionsWithout *[]string `json:"versions_without,omitempty"`
}

type ComponentVersionsResponse struct {
	Component Component   `json:"component"`
	Status    BatchStatus `json:"status"`
}

type ComponentVulnerabilityInfo struct {
	InfoCode        *string          `json:"info_code,omitempty"`
	InfoMessage     *string          `json:"info_message,omitempty"`
	Purl            *string          `json:"purl,omitempty"`
	Requirement     *string          `json:"requirement,omitempty"`
	Version         *string          `json:"version,omitempty"`
	Vulnerabilities *[]Vulnerability `json:"vulnerabilities,omitempty"`
}

type ComponentsLicenseResponse struct {
	Components *[]ComponentLicenseInfo `json:"components,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type ComponentsSearchResponse struct {
	Components []ComponentSearchHit `json:"components"`
	Status     BatchStatus          `json:"status"`
}

type ComponentsStatusResponse struct {
	Components []ComponentStatusResult `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type ContentIdPath = string

type CopyrightDetection struct {
	// Copyright Detected copyright statement (verbatim).
	Copyright string `json:"copyright"`

	// Detector Name of the detector that produced the evidence.
	Detector DetectorEnum `json:"detector"`

	// Evidence Line range or byte range of the evidence, depending on the server's
	// license-hints backend: 1-based inclusive **line numbers** with the
	// default `postgres` backend, or **byte offsets** with the `ldb` backend.
	// The content endpoints slice `?start=&end=` by the same unit.
	Evidence EvidenceRange `json:"evidence"`

	// Holder Holder parsed out of the raw statement (years / boilerplate
	// removed). Optional — absent when it could not be parsed.
	Holder *string `json:"holder,omitempty"`

	// Source Origin/category of the evidence. Today only `header_declared`,
	// `notice_declared` and `metadata_declared` are emitted (derived from
	// the file path); `spdx_tag` and `project_declared` are reserved for a
	// richer signal.
	Source SourceEnum `json:"source"`
}

type CopyrightEvidenceFile struct {
	Detections []CopyrightDetection `json:"detections"`
	File       string               `json:"file"`
	FileId     string               `json:"file_id"`
}

type CopyrightEvidenceItem struct {
	Files *[]CopyrightEvidenceFile `json:"files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url     *string `json:"url,omitempty"`
	Version *string `json:"version,omitempty"`
}

type CopyrightEvidenceResponse struct {
	Components []CopyrightEvidenceItem `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type CopyrightHolder struct {
	// Count Number of detections referencing this holder.
	Count  int    `json:"count"`
	Holder string `json:"holder"`
}

type CopyrightHoldersItem struct {
	Holders *[]CopyrightHolder `json:"holders,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url     *string `json:"url,omitempty"`
	Version *string `json:"version,omitempty"`
}

type CopyrightHoldersResponse struct {
	Components []CopyrightHoldersItem `json:"components"`
	Status     BatchStatus            `json:"status"`
}

type CpesResponse struct {
	Components []ComponentCpesInfo `json:"components"`
	Status     BatchStatus         `json:"status"`
}

type CryptoAlgorithm struct {
	Algorithm *string `json:"algorithm,omitempty"`
	Strength  *string `json:"strength,omitempty"`
}

type CryptoAlgorithmsInRangeResponse struct {
	Components []ComponentAlgorithmsInRange `json:"components"`
	Status     BatchStatus                  `json:"status"`
}

type CryptoAlgorithmsResponse struct {
	Components []ComponentAlgorithms `json:"components"`
	Status     BatchStatus           `json:"status"`
}

type CryptoAsset struct {
	// CallChains Ordered call chains from entry points to this asset, following
	// crypto-finder's callgraph 6.x schema. Each element is an array of
	// call-chain frame objects (see `CallNode`); this API adds
	// `is_final: true` to each chain's last frame. Present only when the
	// reachability endpoint was called with `include_call_chains: true`.
	CallChains *[][]CallNode `json:"call_chains,omitempty"`
	EndLine    int32         `json:"end_line"`

	// FindingId Stable hash of the detection. Use as primary key.
	FindingId string `json:"finding_id"`

	// Match Exact source line that triggered the detection.
	Match string `json:"match"`

	// Metadata Pass-through metadata block as emitted by crypto-finder's findings
	// envelope (v1.3). The shape is owned by crypto-finder, not by this
	// service. Keys are CAMEL CASE (e.g. `assetType`, `algorithmName`,
	// `protocolName`, `materialType`). `assetType` is the discriminator
	// used by consumers that want to branch on the variant. All other keys
	// are optional and depend on the variant — for `assetType: algorithm`
	// you'll see `algorithmName`, `algorithmFamily`, `algorithmPrimitive`,
	// `algorithmMode`, `algorithmPadding`, `algorithmParameterSetIdentifier`;
	// for `assetType: protocol` you'll see `protocolName`, `protocolStrength`;
	// for `assetType: certificate` you'll see `certificateFormat`,
	// `certificateAlgorithm`, `certificateType`, `certificateStoreType`;
	// for `assetType: related-crypto-material` you'll see `materialType`,
	// `materialAlgorithm`, `materialFormat`, `materialSize`.
	// Schema evolution (new fields, new variants) is forward-compatible —
	// this service does NOT re-curate or translate metadata.
	Metadata CryptoFinderMetadata `json:"metadata"`

	// Oid RFC 5280 / CBOM Object Identifier when applicable.
	Oid *string `json:"oid,omitempty"`

	// Reachable True iff at least one entry point reaches this asset. Present
	// only when the reachability endpoint was called with
	// `include_call_chains: true`.
	Reachable *bool             `json:"reachable,omitempty"`
	Source    CryptoAssetSource `json:"source"`
	StartLine int32             `json:"start_line"`

	// SupportingCallIds Foreign-key breadcrumb to the block-level `supporting_calls[]`
	// array. Each string value is a `supporting_calls[].supporting_id`.
	// Present only when `include_supporting_calls: true` and this
	// asset's finding graph references supporting calls.
	SupportingCallIds *[]string `json:"supporting_call_ids,omitempty"`
}

type CryptoAssetSource string

type CryptoEntryPoint struct {
	CanonicalSignature string  `json:"canonical_signature"`
	Class              string  `json:"class"`
	DisplaySymbol      *string `json:"display_symbol,omitempty"`

	// FunctionKey Stable internal key for this function in the callgraph.
	FunctionKey       string                           `json:"function_key"`
	FunctionName      string                           `json:"function_name"`
	Method            string                           `json:"method"`
	OwnerVisibility   *CryptoEntryPointOwnerVisibility `json:"owner_visibility,omitempty"`
	ParameterTypes    *[]string                        `json:"parameter_types,omitempty"`
	ReachableFindings []ReachableFinding               `json:"reachable_findings"`

	// ReachableSupportingCalls Supporting calls reachable from this entry point.
	ReachableSupportingCalls *[]ReachableSupportingCall  `json:"reachable_supporting_calls,omitempty"`
	ReturnType               *string                     `json:"return_type,omitempty"`
	Visibility               *CryptoEntryPointVisibility `json:"visibility,omitempty"`
}

type CryptoEntryPointOwnerVisibility string

type CryptoEntryPointVisibility string

type CryptoFinderMetadata struct {
	Api *string `json:"api,omitempty"`

	// AssetType Discriminator (camelCase from crypto-finder). Known values:
	// `algorithm`, `protocol`, `certificate`, `related-crypto-material`.
	// Unknown values are forwarded verbatim.
	AssetType            *string                `json:"assetType,omitempty"`
	Library              *string                `json:"library,omitempty"`
	Provider             *string                `json:"provider,omitempty"`
	AdditionalProperties map[string]interface{} `json:"-"`
}

type CryptoHint struct {
	Category    *string `json:"category,omitempty"`
	Description *string `json:"description,omitempty"`
	Id          *string `json:"id,omitempty"`
	Name        *string `json:"name,omitempty"`
	Purl        *string `json:"purl,omitempty"`
	Url         *string `json:"url,omitempty"`
}

type CryptoHintsInRangeResponse struct {
	Components []ComponentHintsInRange `json:"components"`
	Status     BatchStatus             `json:"status"`
}

type CryptoHintsResponse struct {
	Components []ComponentHints `json:"components"`
	Status     BatchStatus      `json:"status"`
}

type CryptoVersionsInRangeResponse struct {
	Components []ComponentVersionsInRange `json:"components"`
	Status     BatchStatus                `json:"status"`
}

type DataFlowSource struct {
	// CallTarget FQN of the callee for CALL_RESULT sources.
	CallTarget *string `json:"call_target,omitempty"`

	// DeclaredType Declared type of the source symbol.
	DeclaredType *string        `json:"declared_type,omitempty"`
	Location     SourceLocation `json:"location"`

	// Name Variable / field / parameter name.
	Name *string `json:"name,omitempty"`

	// ParameterIndex 0-based parameter index. Set on PARAMETER.
	ParameterIndex *int32             `json:"parameter_index,omitempty"`
	SourceNodes    *[]DataFlowSource  `json:"source_nodes,omitempty"`
	Type           DataFlowSourceType `json:"type"`

	// Value Source-code expression / literal text.
	Value *string `json:"value,omitempty"`
}

type DataFlowSourceType string

type DepTreeReachabilityRequest struct {
	// Dependencies Flat list of every (purl, version) to be stitched. Every entry
	// MUST carry a version, either as an exact pin (`=1.5.2`) or as a
	// SemVer constraint expression (`>=1.0`, `^2.0`, `~1.5`).
	// Range constraints resolve to the highest mined version satisfying
	// the constraint. The server does NOT auto-resolve transitive deps.
	Dependencies []ComponentRequest `json:"dependencies"`

	// EntryPointSignatures Optional exact-match filter on entry-point canonical signatures.
	// When non-empty, `findings[]` is **restricted to assets reachable
	// from at least one supplied entry point**. Findings unreachable
	// from any supplied entry are REMOVED entirely —
	// they do NOT appear as `reachable=false` entries. An empty array
	// (or absent field) means no filter; all findings are returned.
	// Signatures that matched zero call chains are listed in
	// `unmatched_signatures` at the top level of the response
	// (diagnostic for typos).
	EntryPointSignatures *[]string `json:"entry_point_signatures,omitempty"`

	// IncludeCallChains When true, decorates each asset with its `call_chains[]` array
	// (raw callgraph 6.x frame arrays) and the `reachable` bool.
	// Default false produces a pure CBOM response (findings without
	// reachability decoration). Independent of `entry_point_signatures`
	// (which controls whether assets are PRUNED to reachable ones).
	// Independent of `include_crypto_entry_points` and
	// `include_supporting_calls`.
	IncludeCallChains *bool `json:"include_call_chains,omitempty"`

	// IncludeCryptoEntryPoints When true, populates `crypto_entry_points[]` at the top level
	// of each `ComponentData` block — the public reachability surface
	// (entry-point functions with their `reachable_findings[]`).
	// This is the projection that **replaced** the legacy
	// `entry_point_index` field.
	// Independent of `include_call_chains` and `include_supporting_calls`.
	IncludeCryptoEntryPoints *bool `json:"include_crypto_entry_points,omitempty"`
	IncludeRawCallgraph      *bool `json:"include_raw_callgraph,omitempty"`

	// IncludeSupportingCalls When true, populates `supporting_calls[]` at the top level of
	// each `ComponentData` block (deduped object-lifecycle calls such
	// as IV generation and key-size initialisation) AND attaches
	// `supporting_call_ids[]` to each `cryptographic_asset` whose
	// finding graph references supporting calls. Each
	// `supporting_call_id` resolves to a `supporting_calls[].supporting_id`
	// in the same block.
	// Independent of `include_call_chains` and `include_crypto_entry_points`.
	IncludeSupportingCalls *bool `json:"include_supporting_calls,omitempty"`

	// MaxChainsPerAsset Per-asset cap on `call_chains[]` length. `0` (the default) = no cap.
	// Positive integer sets a per-asset limit. Hard cap 128.
	MaxChainsPerAsset *int32 `json:"max_chains_per_asset,omitempty"`
}

type DepTreeReachabilityResponse struct {
	// Callgraph Raw merged callgraph as JSON, populated only when
	// `include_raw_callgraph: true`. Shape: crypto-finder callgraph
	// 6.x verbatim.
	Callgraph *map[string]interface{} `json:"callgraph,omitempty"`
	Data      *[]ComponentData        `json:"data,omitempty"`

	// InfoCode One of:
	// - `READY` — reachability data computed successfully.
	// - `INVALID_PURL` — a supplied PURL could not be parsed.
	// - `INVALID_SEMVER` — a requirement is structurally invalid
	//   (e.g. empty string) or is a valid constraint but no mined
	//   version satisfies it (version not in catalog).
	// - `INVALID_REQUEST` — the request is structurally invalid in a
	//   way not covered by `INVALID_PURL` or `INVALID_SEMVER`
	//   (e.g. empty `dependencies` array).
	// - `NO_INFO` — reachability data unavailable (one or more deps
	//   unmined, stitch failed, or request timed out). When caused by
	//   missing deps, `missing_components` lists the unsatisfied entries.
	InfoCode    string  `json:"info_code"`
	InfoMessage *string `json:"info_message,omitempty"`

	// MissingComponents Subset of the request's `dependencies` that the service could not
	// satisfy from mining data. Each entry carries the resolved
	// `(purl, version)` pair — version is the value after stripping the
	// leading `=` from the original requirement. Present only when
	// `info_code=NO_INFO` and the cause was unmined or callgraph-less
	// dependencies.
	MissingComponents *[]struct {
		Purl    string `json:"purl"`
		Version string `json:"version"`
	} `json:"missing_components,omitempty"`

	// RulesVersion Highest `rules_version` among the dependency rows that contributed
	// to this response. Dependencies may have been mined at different
	// points in time under different rules_versions; this field reports
	// the most recent contributor (by mining `created_at`), NOT a
	// uniform "all deps under this version" guarantee. Use this when
	// comparing two dep-tree responses to detect whether new rules
	// have landed since the last call. Present only when `info_code=READY`.
	RulesVersion *string `json:"rules_version,omitempty"`

	// Status Top-level outcome for the request as a whole.
	Status StatusResponse `json:"status"`

	// UnmatchedSignatures Signatures from `entry_point_signatures` that matched zero chains
	// across the merged callgraph.
	UnmatchedSignatures *[]string `json:"unmatched_signatures,omitempty"`
}

type DependenciesResolveResponse struct {
	Components []Dependency `json:"components"`
	Status     BatchStatus  `json:"status"`
}

type Dependency struct {
	Comment   *string `json:"comment,omitempty"`
	Component *string `json:"component,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode            `json:"info_code,omitempty"`
	InfoMessage *string              `json:"info_message,omitempty"`
	Licenses    *[]DependencyLicense `json:"licenses,omitempty"`
	Purl        *string              `json:"purl,omitempty"`
	Requirement *string              `json:"requirement,omitempty"`
	Url         *string              `json:"url,omitempty"`
	Version     *string              `json:"version,omitempty"`
}

type DependencyLicense struct {
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Name           *string `json:"name,omitempty"`
	SpdxId         *string `json:"spdx_id,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type DetectorEnum string

type EPSS struct {
	Percentile  *float32 `json:"percentile,omitempty"`
	Probability *float32 `json:"probability,omitempty"`
}

type EndLineQuery = int

type EngineUnavailable = ErrorBody

type ErrorBody struct {
	Error struct {
		// Code Stable machine-readable error identifier. Possible values:
		//   - INVALID_BODY, INVALID_QUERY, INVALID_MD5, INVALID_RANGE
		//   - EMPTY_BATCH
		//   - INVALID_PURL, COMPONENT_NOT_FOUND, VERSION_NOT_FOUND
		//   - NOTICE_NOT_FOUND, FILE_NOT_FOUND, MZ_READ_FAILED
		//   - TIMEOUT, INTERNAL_ERROR
		Code    string `json:"code"`
		Message string `json:"message"`
	} `json:"error"`
	Status    ErrorBodyStatus `json:"status"`
	Timestamp time.Time       `json:"timestamp"`
}

type ErrorBodyStatus string

type EvidenceRange struct {
	// End Inclusive end (line or byte offset); 0 means whole-file evidence
	End int `json:"end"`

	// EvidenceUrl URL to the fragment backing the detection. The base endpoint is
	// chosen from the detection `source`:
	//   * `notice_declared`           → /v3/notice-contents/{id}
	//   * `header_declared`, `spdx_tag` → /v3/file-contents/{id}
	//   * `metadata_declared`         → /v3/metadata-contents/{id}
	// The `start`/`end` query string is omitted when both are 0.
	EvidenceUrl *string `json:"evidence_url,omitempty"`

	// Start Inclusive start (line or byte offset); 0 means whole-file evidence
	Start int `json:"start"`
}

type FileResult struct {
	// FileHash MD5 of the matched file: equals `source_hash` for a `file` match, the matched OSS file's MD5 for a `snippet` match (differs from `source_hash`), and empty for a `none` match.
	FileHash string `json:"file_hash"`

	// MatchType Full-file match, partial (snippet) match, or no match.
	MatchType FileResultMatchType `json:"match_type"`

	// Matches Matched KB entries for this file.
	Matches []MatchResult `json:"matches"`

	// Path The scanned file path.
	Path string `json:"path"`

	// SourceHash MD5 of the input file (from the WFP).
	SourceHash string `json:"source_hash"`
}

type FileResultMatchType string

type Finding struct {
	CryptographicAssets []CryptoAsset `json:"cryptographic_assets"`
	FilePath            string        `json:"file_path"`
	Language            string        `json:"language"`
}

type GeoContributorsResponse struct {
	ComponentsLocations []ComponentLocationInfo `json:"components_locations"`
	Status              BatchStatus             `json:"status"`
}

type GeoCuratedLocation struct {
	Count   *int    `json:"count,omitempty"`
	Country *string `json:"country,omitempty"`
}

type GeoDeclaredLocation struct {
	Location *string `json:"location,omitempty"`

	// Type owner | contributor
	Type *string `json:"type,omitempty"`
}

type GeoLocation struct {
	Name       *string  `json:"name,omitempty"`
	Percentage *float32 `json:"percentage,omitempty"`
}

type GeoOriginResponse struct {
	ComponentsLocations []ComponentLocation `json:"components_locations"`
	Status              BatchStatus         `json:"status"`
}

type GetComponentReachabilityJSONRequestBody = ComponentReachabilityRequest

type GetComponentStatusParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetComponentStatusParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetComponentStatusParamsOnVersionNotFound string

type GetComponentVersionsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl  PurlQuery `form:"purl" json:"purl"`
	Limit *int      `form:"limit,omitempty" json:"limit,omitempty"`
}

type GetFileContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetLicensesComponentParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetLicensesComponentParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetLicensesComponentParamsOnVersionNotFound string

type GetLicensesDetailsParams struct {
	// Id SPDX license identifier (e.g. `MIT`, `GPL-2.0-only`).
	Id string `form:"id" json:"id"`
}

type GetLicensesObligationsParams struct {
	// Id SPDX license identifier (e.g. `MIT`, `GPL-2.0-only`).
	Id string `form:"id" json:"id"`
}

type GetMetadataContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetNoticeContentParams struct {
	// Start 1-based inclusive start line. Defaults to 1 when omitted.
	Start *StartLineQuery `form:"start,omitempty" json:"start,omitempty"`

	// End 1-based inclusive end line. Defaults to last line when omitted.
	End *EndLineQuery `form:"end,omitempty" json:"end,omitempty"`
}

type GetReachabilityForDepTreeJSONRequestBody = DepTreeReachabilityRequest

type GetScanRawParams struct {
	// Md5 File hash — 32-char hex MD5 or 16-char hex CRC64, per the engine's key type.
	Md5 string `form:"md5" json:"md5"`
}

type GetV3CryptographyAlgorithmsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3CryptographyAlgorithmsParamsOnVersionNotFound string

type GetV3CryptographyAlgorithmsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3CryptographyAlgorithmsRangeParamsOnVersionNotFound string

type GetV3CryptographyAlgorithmsVersionsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyAlgorithmsVersionsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3CryptographyAlgorithmsVersionsRangeParamsOnVersionNotFound string

type GetV3CryptographyHintsParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyHintsParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3CryptographyHintsParamsOnVersionNotFound string

type GetV3CryptographyHintsRangeParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3CryptographyHintsRangeParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3CryptographyHintsRangeParamsOnVersionNotFound string

type GetV3DependenciesDependenciesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3DependenciesDependenciesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3DependenciesDependenciesParamsOnVersionNotFound string

type GetV3GeoprovenanceCountriesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3GeoprovenanceCountriesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3GeoprovenanceCountriesParamsOnVersionNotFound string

type GetV3GeoprovenanceOriginParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3GeoprovenanceOriginParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3GeoprovenanceOriginParamsOnVersionNotFound string

type GetV3VulnerabilitiesCpesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3VulnerabilitiesCpesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3VulnerabilitiesCpesParamsOnVersionNotFound string

type GetV3VulnerabilitiesVulnerabilitiesParams struct {
	// Purl Package URL (e.g. `pkg:github/scanoss/engine`)
	Purl PurlQuery `form:"purl" json:"purl"`

	// Requirement Optional version requirement (e.g. `v5.4.5`)
	Requirement *RequirementQuery `form:"requirement,omitempty" json:"requirement,omitempty"`

	// MaxResultsPerPurl Caps the per-purl result array. 0/absent = no limit.
	MaxResultsPerPurl *SearchMaxResults `form:"max_results_per_purl,omitempty" json:"max_results_per_purl,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *SearchShowRelated `form:"show_related_results,omitempty" json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in results (placeholder — data source TBD).
	ShowUrl *SearchShowURL `form:"show_url,omitempty" json:"show_url,omitempty"`

	// OnVersionNotFound Version fallback strategy (not applied to range endpoints).
	OnVersionNotFound *GetV3VulnerabilitiesVulnerabilitiesParamsOnVersionNotFound `form:"on_version_not_found,omitempty" json:"on_version_not_found,omitempty"`
}

type GetV3VulnerabilitiesVulnerabilitiesParamsOnVersionNotFound string

type InfoCode string

type InternalError = ErrorBody

type KnowledgeBase struct {
	// DailyVersion Daily KB delta version.
	DailyVersion string `json:"daily_version,omitempty"`

	// MonthlyVersion Monthly KB snapshot version.
	MonthlyVersion string `json:"monthly_version,omitempty"`
}

type LicenseDetails struct {
	FullName *string `json:"full_name,omitempty"`

	// Osadl OSADL compliance metadata for a license.
	Osadl *OSADLInfo `json:"osadl,omitempty"`

	// Spdx SPDX registry metadata for a license.
	Spdx *SPDXInfo `json:"spdx,omitempty"`
}

type LicenseDetailsResponse struct {
	License *LicenseDetails `json:"license,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type LicenseDetection struct {
	Confidence float32 `json:"confidence"`

	// Detector Name of the detector that produced the evidence.
	Detector DetectorEnum `json:"detector"`

	// Evidence Line range or byte range of the evidence, depending on the server's
	// license-hints backend: 1-based inclusive **line numbers** with the
	// default `postgres` backend, or **byte offsets** with the `ldb` backend.
	// The content endpoints slice `?start=&end=` by the same unit.
	Evidence  EvidenceRange `json:"evidence"`
	LicenseId string        `json:"license_id"`

	// Source Origin/category of the evidence. Today only `header_declared`,
	// `notice_declared` and `metadata_declared` are emitted (derived from
	// the file path); `spdx_tag` and `project_declared` are reserved for a
	// richer signal.
	Source SourceEnum `json:"source"`
}

type LicenseEvidenceFile struct {
	Detections []LicenseDetection `json:"detections"`
	File       string             `json:"file"`

	// FileId MD5 of the file content (used as the content endpoint id).
	FileId string `json:"file_id"`
}

type LicenseEvidenceItem struct {
	Files *[]LicenseEvidenceFile `json:"files,omitempty"`

	// InfoCode Per-item resolution outcome. `REQUIREMENT_NOT_MET` is informational
	// (a nearest-version was substituted); the others mark failures.
	InfoCode    *InfoCode `json:"info_code,omitempty"`
	InfoMessage *string   `json:"info_message,omitempty"`
	Purl        string    `json:"purl"`
	Requirement *string   `json:"requirement,omitempty"`

	// Url Present only when `search.show_url` is set (placeholder — not yet populated).
	Url *string `json:"url,omitempty"`

	// Version Concrete version resolved from `requirement`.
	Version *string `json:"version,omitempty"`
}

type LicenseEvidenceResponse struct {
	Components []LicenseEvidenceItem `json:"components"`
	Status     BatchStatus           `json:"status"`
}

type LicenseInfo struct {
	FullName       *string `json:"full_name,omitempty"`
	Id             *string `json:"id,omitempty"`
	IsSpdxApproved *bool   `json:"is_spdx_approved,omitempty"`
	Url            *string `json:"url,omitempty"`
}

type LineRange struct {
	// EndLine Last line of the matched range.
	EndLine int `json:"end_line"`

	// StartLine First line of the matched range.
	StartLine int `json:"start_line"`
}

type LookupStatusResponse struct {
	Message *string                     `json:"message,omitempty"`
	Status  *LookupStatusResponseStatus `json:"status,omitempty"`
}

type LookupStatusResponseStatus string

type MatchResult struct {
	// InputLineRanges Snippet matches only — matched line ranges in the input file.
	InputLineRanges []LineRange `json:"input_line_ranges,omitempty"`

	// MatchPercentage Snippet matches only; omitted for full-file matches.
	MatchPercentage int `json:"match_percentage,omitempty"`

	// OssFilePath Path of the matched file inside the OSS component.
	OssFilePath string `json:"oss_file_path,omitempty"`

	// OssLineRanges Snippet matches only — matched line ranges in the OSS file.
	OssLineRanges []LineRange `json:"oss_line_ranges,omitempty"`

	// UrlHash url_hash of the matched component release.
	UrlHash string `json:"url_hash"`
}

type MatchedOperation struct {
	Expression *string              `json:"expression,omitempty"`
	Kind       MatchedOperationKind `json:"kind"`
	Line       int32                `json:"line"`
	Symbol     string               `json:"symbol"`
}

type MatchedOperationKind string

type NotFound = ErrorBody

type OSADLInfo struct {
	Compatibility          *[]string `json:"compatibility,omitempty"`
	CopyleftClause         *bool     `json:"copyleft_clause,omitempty"`
	DependingCompatibility *[]string `json:"depending_compatibility,omitempty"`
	Incompatibility        *[]string `json:"incompatibility,omitempty"`
	PatentHints            *bool     `json:"patent_hints,omitempty"`
}

type ObligationsResponse struct {
	// Obligations OSADL compliance metadata for a license.
	Obligations *OSADLInfo `json:"obligations,omitempty"`

	// Status Outcome of a licenses-service call (papi common StatusResponse).
	Status *LookupStatusResponse `json:"status,omitempty"`
}

type PayloadTooLarge = ErrorBody

type PostComponentsStatusJSONRequestBody = BatchRequest

type PostCopyrightEvidenceJSONRequestBody = BatchRequest

type PostCopyrightHoldersJSONRequestBody = BatchRequest

type PostLicenseAttributionJSONRequestBody = BatchRequest

type PostLicenseEvidenceJSONRequestBody = BatchRequest

type PostLicensesComponentsJSONRequestBody = BatchRequest

type PostScanBatchParams struct {
	// XScanId Absent → Mode B (synchronous single-shot). Present → Mode A (chunked async): a client-generated canonical lowercase UUIDv7, sent on every block of the session.
	XScanId *openapi_types.UUID `json:"X-Scan-Id,omitempty"`

	// ContentRange Required in Mode A (`X-Scan-Id` present): byte range of this block, e.g. `bytes 0-8388607/26214400` (end inclusive, 0-based). Ignored in Mode B.
	ContentRange *string `json:"Content-Range,omitempty"`
}

type PostScanComponentsJSONRequestBody = ScanSbom

type PostScanComponentsParams struct {
	// Urlhash One urlhash, or several comma-separated (`h1,h2,h3`).
	Urlhash string `form:"urlhash" json:"urlhash"`
}

type PostScanDirectMultipartBody struct {
	File openapi_types.File `json:"file"`
}

type PostScanDirectMultipartRequestBody PostScanDirectMultipartBody

type PostScanSnippetsParams struct {
	// Threshold Minimum match threshold (percent).
	Threshold *int `form:"threshold,omitempty" json:"threshold,omitempty"`
}

type PostScanSnippetsTextBody = string

type PostScanSnippetsTextRequestBody = PostScanSnippetsTextBody

type PostV3CryptographyAlgorithmsJSONRequestBody = BatchRequest

type PostV3CryptographyAlgorithmsRangeJSONRequestBody = BatchRequest

type PostV3CryptographyAlgorithmsVersionsRangeJSONRequestBody = BatchRequest

type PostV3CryptographyHintsJSONRequestBody = BatchRequest

type PostV3CryptographyHintsRangeJSONRequestBody = BatchRequest

type PostV3DependenciesDependenciesJSONRequestBody = BatchRequest

type PostV3DependenciesTransitiveJSONRequestBody = TransitiveRequest

type PostV3GeoprovenanceCountriesJSONRequestBody = BatchRequest

type PostV3GeoprovenanceOriginJSONRequestBody = BatchRequest

type PostV3VulnerabilitiesCpesJSONRequestBody = BatchRequest

type PostV3VulnerabilitiesVulnerabilitiesJSONRequestBody = BatchRequest

type PurlQuery = string

type RangeConflict = ErrorBody

type RawScanResult map[string][]map[string]interface{}

type ReachableFinding struct {
	// ChainDepth Number of intermediate hops between the entry point and this finding.
	ChainDepth int32 `json:"chain_depth"`

	// FindingGraphRef Reference to the `finding_id` of the finding graph this was resolved from.
	FindingGraphRef string `json:"finding_graph_ref"`
	FindingId       string `json:"finding_id"`

	// MatchedOperation The cryptographic operation matched by a detection rule.
	MatchedOperation MatchedOperation `json:"matched_operation"`
}

type ReachableSupportingCall struct {
	ChainDepth        int32  `json:"chain_depth"`
	SupportingCallRef string `json:"supporting_call_ref"`
	SupportingId      string `json:"supporting_id"`
}

type ReadinessResponse struct {
	Checks map[string]ComponentHealth `json:"checks"`
	Status ReadinessResponseStatus    `json:"status"`
}

type ReadinessResponseStatus string

type Request struct {
	// Purl Package URL
	Purl string `json:"purl"`

	// Requirement Optional version requirement
	Requirement *string `json:"requirement,omitempty"`
}

type RequirementQuery = string

type SPDXInfo struct {
	DetailsUrl    *string   `json:"details_url,omitempty"`
	FullName      *string   `json:"full_name,omitempty"`
	Id            *string   `json:"id,omitempty"`
	IsDeprecated  *bool     `json:"is_deprecated,omitempty"`
	IsFsfLibre    *bool     `json:"is_fsf_libre,omitempty"`
	IsOsiApproved *bool     `json:"is_osi_approved,omitempty"`
	ReferenceUrl  *string   `json:"reference_url,omitempty"`
	SeeAlso       *[]string `json:"see_also,omitempty"`
}

type ScanComponentsResponse struct {
	Results *[]struct {
		Component *struct {
			ReleaseDate *string `json:"release_date,omitempty"`
			Version     *string `json:"version,omitempty"`
		} `json:"component,omitempty"`
		UrlHash *string `json:"url_hash,omitempty"`
	} `json:"results,omitempty"`
}

type ScanEnvelope struct {
	// Error Populated only when status is `failed`.
	Error string `json:"error,omitempty"`

	// FilesTotal File count of the report, filled in on completion.
	FilesTotal int `json:"files_total,omitempty"`

	// Phase Current pipeline pass while scanning, e.g. 'Pass 1: scan files'.
	Phase string `json:"phase,omitempty"`

	// PhaseDone Items processed in the current phase.
	PhaseDone int `json:"phase_done,omitempty"`

	// PhaseTotal Total items in the current phase.
	PhaseTotal int `json:"phase_total,omitempty"`

	// ReceivedBytes Bytes received so far (Mode A upload; omitted when 0).
	ReceivedBytes int `json:"received_bytes,omitempty"`

	// Result Populated only when status is `completed`. The batchScanner report — byte-identical whether obtained synchronously (Mode B) or by polling an async session to completion (Mode A).
	Result *ScanResult `json:"result,omitempty"`

	// ScanId Canonical lowercase UUIDv7 session id. In Mode A this is the client-supplied id; in Mode B it is a server-generated id for traceability only (no session is created).
	ScanId string             `json:"scan_id"`
	Status ScanEnvelopeStatus `json:"status"`

	// TotalBytes Declared total upload size (Mode A; omitted when 0).
	TotalBytes int `json:"total_bytes,omitempty"`

	// UploadPercent Exact upload progress percent (Mode A; omitted when 0).
	UploadPercent int `json:"upload_percent,omitempty"`
}

type ScanEnvelopeStatus string

type ScanExpired = ErrorBody

type ScanNotFound = ErrorBody

type ScanRawMatch struct {
	Purl *string `json:"purl,omitempty"`

	// Rank Engine match ordering; lower is a stronger match.
	Rank      *int      `json:"rank,omitempty"`
	UrlHashes *[]string `json:"url_hashes,omitempty"`
}

type ScanRawResponse struct {
	FileMd5 *string         `json:"file_md5,omitempty"`
	Matches *[]ScanRawMatch `json:"matches,omitempty"`
}

type ScanResult struct {
	// Components Resolved components keyed by url_hash. Extra fields may be present.
	Components map[string]ComponentResult `json:"components,omitempty"`

	// Files One entry per scanned file (order is unspecified).
	Files []FileResult `json:"files,omitempty"`

	// Server Optional run/server metadata passed through from the batchScanner pipeline when present; omitted otherwise.
	Server *ScanServer `json:"server,omitempty"`
}

type ScanSbom struct {
	Components *[]struct {
		Purl *string `json:"purl,omitempty"`
	} `json:"components,omitempty"`
}

type ScanServer struct {
	// ApiVersion batchScanner API version.
	ApiVersion string `json:"api_version,omitempty"`

	// ElapsedMs Scan wall-clock time
	ElapsedMs int `json:"elapsed_ms,omitempty"`

	// Hostname Host that ran the scan.
	Hostname      string         `json:"hostname,omitempty"`
	KnowledgeBase *KnowledgeBase `json:"knowledge_base,omitempty"`
}

type SearchComponentsParams struct {
	// Search Free-form search term. Overrides `vendor`/`component` when present.
	Search    *string `form:"search,omitempty" json:"search,omitempty"`
	Vendor    *string `form:"vendor,omitempty" json:"vendor,omitempty"`
	Component *string `form:"component,omitempty" json:"component,omitempty"`

	// PurlType purl type (github, npm, pypi, gem, maven, …). Defaults to github.
	PurlType *string `form:"purl_type,omitempty" json:"purl_type,omitempty"`
	Limit    *int    `form:"limit,omitempty" json:"limit,omitempty"`
	Offset   *int    `form:"offset,omitempty" json:"offset,omitempty"`
}

type SearchCriteria struct {
	// MaxResultsPerPurl Caps the per-purl result array in the output. 0 = no limit.
	MaxResultsPerPurl *int `json:"max_results_per_purl,omitempty"`

	// OnVersionNotFound Version fallback when the requested version has no data:
	// `strict` (no fallback), `show_latest`, `show_closest_lt`,
	// `show_closest_gt`, `show_any`. Not applied to range endpoints.
	OnVersionNotFound *SearchCriteriaOnVersionNotFound `json:"on_version_not_found,omitempty"`

	// ShowRelatedResults Enable the source-purl fallback lookup.
	ShowRelatedResults *bool `json:"show_related_results,omitempty"`

	// ShowUrl Include a `url` in each result (placeholder — data source TBD).
	ShowUrl *bool `json:"show_url,omitempty"`
}

type SearchCriteriaOnVersionNotFound string

type SearchMaxResults = int

type SearchOnVersionNotFound string

type SearchShowRelated = bool

type SearchShowURL = bool

type SnippetCandidate struct {
	FileMd5 *string `json:"file_md5,omitempty"`
	Hits    *int    `json:"hits,omitempty"`

	// InputLineRanges Comma-separated line ranges in the posted WFP, e.g. "12-148".
	InputLineRanges *string `json:"input_line_ranges,omitempty"`
	LinesMatched    *int    `json:"lines_matched,omitempty"`
	MatchedPercent  *int    `json:"matched_percent,omitempty"`

	// OssLineRanges Comma-separated line ranges in the KB component.
	OssLineRanges *string `json:"oss_line_ranges,omitempty"`
}

type SnippetGroup struct {
	Candidates *[]SnippetCandidate `json:"candidates,omitempty"`
	GroupIndex *int                `json:"group_index,omitempty"`
}

type SnippetResponse struct {
	FileMd5       *string         `json:"file_md5,omitempty"`
	FilePath      *string         `json:"file_path,omitempty"`
	FileSize      *int            `json:"file_size,omitempty"`
	SnippetGroups *[]SnippetGroup `json:"snippet_groups,omitempty"`
	TolerancePct  *float32        `json:"tolerance_pct,omitempty"`
	TotalLines    *int            `json:"total_lines,omitempty"`
}

type SourceEnum string

type SourceLocation struct {
	FilePath string `json:"file_path"`
	Line     int32  `json:"line"`
}

type StartLineQuery = int

type StatusResponse struct {
	Message *string               `json:"message,omitempty"`
	Status  *StatusResponseStatus `json:"status,omitempty"`
}

type StatusResponseStatus string

type SupportingCall struct {
	CanonicalSignature string `json:"canonical_signature"`

	// Category Semantic category of this supporting call. Known values include
	// `iv` (IV/nonce generation), `key` (key material setup), `param`
	// (cipher parameter initialisation). New categories may be added
	// as the schema evolves.
	Category      *string `json:"category,omitempty"`
	DisplaySymbol *string `json:"display_symbol,omitempty"`
	EndLine       *int32  `json:"end_line,omitempty"`
	FilePath      *string `json:"file_path,omitempty"`
	FunctionKey   *string `json:"function_key,omitempty"`
	FunctionName  string  `json:"function_name"`
	StartLine     *int32  `json:"start_line,omitempty"`

	// SupportingId Stable ID for this supporting call. Primary key for the foreign-key relationship.
	SupportingId string `json:"supporting_id"`
}

type Timeout = ErrorBody

type TransitiveDependency struct {
	Purl        *string `json:"purl,omitempty"`
	Requirement *string `json:"requirement,omitempty"`
	Version     *string `json:"version,omitempty"`
}

type TransitiveRequest struct {
	Components []Request `json:"components"`
	Depth      *int      `json:"depth,omitempty"`
	Limit      *int      `json:"limit,omitempty"`
}

type TransitiveResponse struct {
	Dependencies *[]TransitiveDependency `json:"dependencies,omitempty"`
	Status       BatchStatus             `json:"status"`
}

type VulnerabilitiesResponse struct {
	Components []ComponentVulnerabilityInfo `json:"components"`
	Status     BatchStatus                  `json:"status"`
}

type Vulnerability struct {
	Cve       *string              `json:"cve,omitempty"`
	Cvss      *[]CVSS              `json:"cvss,omitempty"`
	Epss      *EPSS                `json:"epss,omitempty"`
	Id        *string              `json:"id,omitempty"`
	Modified  *string              `json:"modified,omitempty"`
	Published *string              `json:"published,omitempty"`
	Severity  *string              `json:"severity,omitempty"`
	Source    *VulnerabilitySource `json:"source,omitempty"`
	Summary   *string              `json:"summary,omitempty"`
	Url       *string              `json:"url,omitempty"`
}

type VulnerabilitySource string