agenttypes

type AgentExpectResponse struct {
	Status       []int  `json:"status,omitempty"`
	BodyContains string `json:"body_contains,omitempty"`
}

type AgentExtensionsOutput struct {
	Extensions []GeneratedExtension `json:"extensions"`
	// These fields may appear in the same JSON block (from swarm plan output)
	QuickChecks []QuickCheck `json:"quick_checks,omitempty"`
	Snippets    []Snippet    `json:"snippets,omitempty"`
}

type AgentExtractRule struct {
	Source  string `json:"source"`             // "cookie", "json", "header", "regex"
	Name    string `json:"name,omitempty"`     // cookie name or header name
	Path    string `json:"path,omitempty"`     // JSONPath for json source
	ApplyAs string `json:"apply_as,omitempty"` // e.g. "Authorization: Bearer {value}"
	Pattern string `json:"pattern,omitempty"`  // regex pattern (source: "regex")
	Group   int    `json:"group,omitempty"`    // capture group index (source: "regex")
}

type AgentFinding struct {
	Title       string   `json:"title"`
	Description string   `json:"description"`
	Severity    string   `json:"severity"`
	Confidence  string   `json:"confidence,omitempty"`
	File        string   `json:"file,omitempty"`
	Line        int      `json:"line,omitempty"`
	Snippet     string   `json:"snippet,omitempty"`
	CWE         string   `json:"cwe,omitempty"`
	Tags        []string `json:"tags,omitempty"`
}

type AgentFindingsOutput struct {
	Findings []AgentFinding `json:"findings"`
}

type AgentHTTPRecord struct {
	Method  string            `json:"method"`
	URL     string            `json:"url"`
	Headers map[string]string `json:"headers,omitempty"`
	Body    string            `json:"body,omitempty"`
	Notes   string            `json:"notes,omitempty"`
}

type AgentHTTPRecordsOutput struct {
	HTTPRecords []AgentHTTPRecord `json:"http_records"`
}

type AgentLoginFlow struct {
	URL         string             `json:"url"`
	Method      string             `json:"method"`
	ContentType string             `json:"content_type,omitempty"`
	Body        string             `json:"body,omitempty"`
	Extract     []AgentExtractRule `json:"extract,omitempty"`
	// Shorthand: type + token_path expand into extract rules.
	Type      string `json:"type,omitempty"`       // "bearer" or "cookie"
	TokenPath string `json:"token_path,omitempty"` // JSONPath for bearer type
	// Response validation.
	Expect *AgentExpectResponse `json:"expect,omitempty"`
}

type AgentSessionConfig struct {
	Sessions []AgentSessionEntry `json:"sessions"`
}

type AgentSessionEntry struct {
	Name    string            `json:"name"`
	Role    string            `json:"role"`              // "primary" or "compare"
	Headers map[string]string `json:"headers,omitempty"` // static auth headers
	Login   *AgentLoginFlow   `json:"login,omitempty"`   // login-based auth
}

type AppIntent struct {
	Target          string                `json:"target,omitempty"`            // URL if mentioned
	SourcePath      string                `json:"source_path,omitempty"`       // filesystem path if mentioned
	Focus           string                `json:"focus,omitempty"`             // vulnerability focus if mentioned
	Instruction     string                `json:"instruction,omitempty"`       // leftover context
	Discover        bool                  `json:"discover,omitempty"`          // implied by target + source combo
	CodeAudit       bool                  `json:"code_audit,omitempty"`        // implied by source-only
	Audit           string                `json:"audit,omitempty"`             // "lite", "balanced", "deep", or "" (background vigolium-audit)
	Piolium         string                `json:"piolium,omitempty"`           // piolium mode: "lite", "balanced", "deep", "longshot", etc., or "" (auto-pick / unset)
	Diff            string                `json:"diff,omitempty"`              // PR URL, git ref range (main...branch), or HEAD~N
	Files           []string              `json:"files,omitempty"`             // specific files to focus on (relative to source)
	Browser         bool                  `json:"browser,omitempty"`           // enable browser-based interaction
	MaxCommands     int                   `json:"max_commands,omitempty"`      // command limit override
	Timeout         string                `json:"timeout,omitempty"`           // duration string (e.g. "2h", "30m")
	Intensity       string                `json:"intensity,omitempty"`         // "quick", "balanced", "deep"
	Credentials     string                `json:"credentials,omitempty"`       // compact credential hint, e.g. "admin/admin123"
	CredentialSets  []IntentCredentialSet `json:"credential_sets,omitempty"`   // structured roles/accounts
	AuthRequired    bool                  `json:"auth_required,omitempty"`     // explicit auth intent from prompt
	RequiresBrowser bool                  `json:"requires_browser,omitempty"`  // explicit browser requirement from prompt
	BrowserStartURL string                `json:"browser_start_url,omitempty"` // explicit login/start URL
	FocusRoutes     []string              `json:"focus_routes,omitempty"`      // explicit auth/browser focus routes
}

type AttackPlan struct {
	ModuleTags []string          `json:"module_tags,omitempty"`
	ModuleIDs  []string          `json:"module_ids,omitempty"`
	FocusAreas []string          `json:"focus_areas,omitempty"`
	SkipPaths  []string          `json:"skip_paths,omitempty"`
	Endpoints  []PlannedEndpoint `json:"endpoints,omitempty"`
	Notes      string            `json:"notes,omitempty"`
}

type AuditAgentConfig struct {
	// Harness selects the audit harness flavor. Zero-valued (empty Name)
	// is treated as the audit harness for backward compatibility.
	Harness HarnessSpec

	Mode        string // "deep", "balanced", "lite", "merge", "revisit", etc.
	Platform    string // "audit" (embedded vigolium-audit binary) or "pi" (piolium)
	SourcePath  string
	SessionDir  string
	ProjectUUID string
	ScanUUID    string

	// Modes is the mode chain for this run. Empty (or single-element)
	// behaves exactly like the legacy single-Mode path. With >1 element:
	//   - audit: rendered as `--modes a,b,c` (audit owns the sequential
	//     execution, stop-on-non-complete, and aggregate cost cap).
	//   - piolium: the chain is driven by PioliumChainScanner, which runs
	//     one `pi` subprocess per supported mode in the same source dir and
	//     collapses them into a single aggregated AgenticScan row.
	// EffectiveModes() normalizes this to always return at least one mode.
	Modes []string

	// ForceAgenticScanUUID, when non-empty, overrides the UUID the runner
	// would otherwise derive. Set by PioliumChainScanner so every per-mode
	// inner runner imports its findings under the one aggregated child row.
	ForceAgenticScanUUID string

	// SuppressAgenticScanRow makes the runner skip AgenticScan row
	// create/progress/finalize bookkeeping while STILL importing findings
	// (under the shared UUID) and computing the cost summary. Used for the
	// per-mode inner runners of a piolium chain — the chain scanner owns
	// the single aggregated row instead.
	SuppressAgenticScanRow bool

	// KeepSourceOutputDir suppresses the per-run cleanup of
	// <source>/<harness>/ after the subprocess exits. The piolium chain
	// sets it on every mode except the last so a later confirm/revisit
	// mode can read the prior mode's on-disk audit-state.json.
	KeepSourceOutputDir bool

	// KeepRaw maps to vigolium-audit's `--keep-raw` flag: opt out of the
	// deep/confirm auto-prune of raw scanner output, draft findings, and
	// intermediate workspaces so the operator can review them under
	// <source>/vigolium-results/ (and the synced session copy). Audit-only;
	// ignored for the piolium harness.
	KeepRaw bool

	// AuditDriverInvocation carries the `--agent` + auth-override args the
	// vigolium-audit binary needs. Resolved by callers from OliumConfig (or a
	// CLI override) and passed through to buildAuditAgentCommand.
	// Empty Agent falls back to claude (vigolium-audit's own default).
	// Ignored for the piolium harness.
	AuditDriverInvocation AuditDriverInvocation

	// ParentAgenticScanUUID is the autopilot/swarm AgenticScan UUID that spawned this audit.
	ParentAgenticScanUUID string

	SyncInterval time.Duration // how often to sync audit-state.json (default: 30s)
	StreamWriter io.Writer     // optional: stream audit output in real-time

	// Stream enables Claude's stream-json output format and live rendering via
	// the claudestream package. Only meaningful for the "claude" platform and
	// when StreamWriter is non-nil. Other platforms ignore this flag.
	Stream bool

	// ShowThinking opts into rendering the agent's internal thinking blocks
	// (audit NDJSON `thinking` events) to the live stream. Off by default
	// because thinking is very noisy and chains often hundreds of blocks
	// per phase. The CLI flag `--show-thinking` (and the equivalent REST
	// field) sets this.
	ShowThinking bool

	// CommitScanLimit caps deep-mode commit archaeology to at most N commits.
	// 0 keeps the upstream default (500).
	CommitScanLimit int
	// CommitScanSince caps deep-mode commit archaeology to commits since this
	// git date expression. Empty keeps the upstream default ("60 days ago").
	CommitScanSince string

	// AdditionalArgs are appended verbatim to the agent process argv after
	// the harness-specific args. Used by piolium for --plm-* passthroughs
	// (e.g. --plm-phase-retries, --plm-longshot-limit). Ignored for audit.
	AdditionalArgs []string

	// PiProvider and PiModel, when set, are passed to `pi` as
	// `--provider <name> --model <id>` so a single audit run can override
	// the user's defaultProvider/defaultModel from ~/.pi/agent/settings.json.
	// Only consumed by the pi platform; ignored for audit.
	PiProvider string
	PiModel    string

	// StreamDecoder, when non-nil, decodes the agent process's stdout as
	// line-oriented JSON and renders it to render. Raw lines are mirrored
	// to raw (typically <sessionDir>/audit-stream.jsonl) for replay.
	// Claude has a built-in default; piolium passes pistream.Stream.
	StreamDecoder func(stream io.Reader, render io.Writer, raw io.Writer) error

	// AuthOverride carries per-run BYOK creds (api key, oauth token, or
	// codex cred file) supplied via the audit CLI flags or REST body. It
	// has already been folded into AuditDriverInvocation by the resolver, so
	// the audit launch path does NOT consult this field directly. The
	// piolium launcher reads it to (a) inject ANTHROPIC_API_KEY /
	// CLAUDE_CODE_OAUTH_TOKEN / OPENAI_API_KEY env on the pi subprocess
	// and (b) stage a codex cred file at <pi-agent-dir>/auth.json for
	// the duration of the run. Empty = no override (inherit ambient
	// auth from agent.olium.* / pi settings).
	AuthOverride AuthOverride
}

type AuditAgentStatus struct {
	Running         bool   `json:"running"`
	Status          string `json:"status"`
	Mode            string `json:"mode"`
	Phase           string `json:"current_phase"`
	CompletedPhases int    `json:"completed_phases"`
	TotalPhases     int    `json:"total_phases"`
}

type AuditDriverAgent string

type AuditDriverAuthFlags struct {
	APIKey        string // --api-key
	OAuthToken    string // --oauth-token
	OAuthCredFile string // --oauth-cred-file
}

type AuditDriverIntensityPreset struct {
	Mode        string
	Modes       []string
	Timeout     time.Duration
	CommitDepth int // git clone --depth (0 = full history, used for deep commit archaeology)
}

type AuditDriverInvocation struct {
	Agent AuditDriverAgent
	Auth  AuditDriverAuthFlags
}

type AuthOverride struct {
	APIKey        string
	OAuthToken    string
	OAuthCredFile string
	Agent         string
}

type AutopilotIntensityPreset struct {
	MaxCommands     int
	Timeout         time.Duration
	AuditDriverMode string
	Browser         bool
	// NativeScanStrategy is the scanning_strategy passed to the pre-scan
	// kicked off in target-only autopilot runs (no --source). Maps onto the
	// runner.LaunchParams.ScanningStrategy enum: "lite"|"balanced"|"deep".
	// The pre-scan seeds http_records and findings into the DB before the
	// operator agent loop starts, so the agent has real traffic to reason
	// about and richer raw material for custom JS extensions.
	NativeScanStrategy string
	// NoPrescan disables the autopilot pre-scan entirely. Default false;
	// flipped true via the --no-prescan flag for operators who already ran
	// a scan or want a cold-start blackbox session.
	NoPrescan bool
}

type AutopilotPipelineResult struct {
	FindingsCount         int
	FindingsSaved         int
	FindingsBySeverity    map[string]int
	OperatorFindingsCount int // findings reported by the autonomous operator via report_finding
	VerifiedFindingCount  int
	Degraded              bool
	Warnings              []string
	BrowserDecision       string
	ArtifactsDir          string
	Duration              time.Duration
	SessionDir            string
	// Reentries counts how many post-halt coverage-verify re-prompts fired.
	Reentries int
}

type BatchProvenance struct {
	ModuleTags map[string]int `json:"module_tags,omitempty"` // tag -> batch number
	ModuleIDs  map[string]int `json:"module_ids,omitempty"`  // id -> batch number
	Extensions map[string]int `json:"extensions,omitempty"`  // filename -> batch number
	FocusAreas map[string]int `json:"focus_areas,omitempty"` // focus area -> batch number
}

type DiffContext struct {
	ChangedFiles []string `json:"changed_files"`           // changed file paths relative to source root
	PatchContent string   `json:"patch_content,omitempty"` // unified diff patch content
	DiffRef      string   `json:"diff_ref"`                // original ref/URL for display (e.g. "origin/main...feature")
}

type ExploitationEvidence struct {
	FindingRef  string   `json:"finding_ref"`
	Status      string   `json:"status"` // "exploited", "blocked", "false_positive"
	VulnClass   string   `json:"vuln_class"`
	Payload     string   `json:"payload"`
	Request     string   `json:"request"`
	Response    string   `json:"response"`
	Impact      string   `json:"impact"`
	Screenshots []string `json:"screenshots,omitempty"`
	Confidence  string   `json:"confidence"` // "proven", "likely", "unconfirmed"
	Notes       string   `json:"notes,omitempty"`
}

type FollowUpScan struct {
	URL        string   `json:"url"`
	Method     string   `json:"method,omitempty"`
	ModuleTags []string `json:"module_tags,omitempty"`
	ModuleIDs  []string `json:"module_ids,omitempty"`
	Rationale  string   `json:"rationale,omitempty"`
	TargetURLs []string `json:"target_urls,omitempty"` // specific URLs to rescan (preserves URL-to-module mapping)
}

type GeneratedExtension struct {
	Filename string `json:"filename"`
	Code     string `json:"code"`
	Reason   string `json:"reason"`
}

type HarnessSpec struct {
	// Name is the harness identifier. "audit" and "piolium" are recognized.
	// An empty Name defaults to audit for backward compatibility.
	Name string
	// SourceFolder is the directory the harness writes under <source>/ during
	// the run (e.g. "audit", "piolium").
	SourceFolder string
	// SessionSubdir is where vigolium syncs the harness output under the
	// session dir (e.g. "vigolium-results", "piolium").
	SessionSubdir string
	// EnvPrefix is the prefix for env vars exported to the agent process
	// (e.g. "ARCHON_", "PIOLIUM_").
	EnvPrefix string
	// DBMode populates database.AgenticScan.Mode (e.g. "audit", "piolium").
	DBMode string
	// DBAgentName populates database.AgenticScan.AgentName (e.g. "vigolium-audit",
	// "piolium").
	DBAgentName string
	// DBInputType populates database.AgenticScan.InputType.
	DBInputType string
	// FindingIDPrefix is the module_id prefix on imported findings (e.g.
	// "audit" → "audit:c1-...", "piolium" → "piolium:c1-...").
	FindingIDPrefix string
	// FindingTag is added to every imported finding's tag list.
	FindingTag string
}

type InputType string

type Intensity string

type IntentCredentialSet struct {
	Name     string `json:"name,omitempty"`
	Role     string `json:"role,omitempty"` // "primary" or "compare"
	Username string `json:"username,omitempty"`
	Password string `json:"password,omitempty"`
}

type IntentParseConfig struct {
	SessionsDir string
}

type IntentParseOption func(*IntentParseConfig)

type InvalidExtension struct {
	Extension GeneratedExtension
	Err       error
}

type Options struct {
	// AgentName is a label retained for DB bookkeeping; dispatch goes
	// through olium regardless of value.
	AgentName string

	// Prompt mode: template-based or inline
	PromptTemplate string // template ID (e.g. "security-code-review")
	PromptFile     string // path to a prompt file
	PromptInline   string // inline prompt string
	Stdin          bool   // read prompt from stdin

	// Context
	SourcePath  string   // path to source code repository (--source flag)
	Files       []string // specific files to include (relative to SourcePath)
	Source      string   // source identifier for findings
	Append      string   // extra text appended to the rendered prompt
	Instruction string   // user-provided custom instruction appended to the prompt
	TargetURL   string   // target URL for scanning context
	Hostname    string   // target hostname (derived from TargetURL if empty)

	// Output
	OutputPath  string // write agent output to this file
	DryRun      bool   // render prompt and print it, don't execute agent
	ShowPrompt  bool   // print rendered prompt to stderr before executing
	ScanUUID    string // scan UUID to attach findings to
	ProjectUUID string // project UUID for data scoping
	// EnableBurpBridgeTools exposes only the live read-only Burp search and
	// inspect tools on a fresh agent session. It does not enable replay tools.
	EnableBurpBridgeTools bool      `json:"-"`
	StreamWriter          io.Writer `json:"-"` // when non-nil, agent output is streamed here in real-time
	SessionDir            string    `json:"-"` // session directory for artifacts (transcripts, generated extensions, etc.)
	Verbose               bool      `json:"-"` // when true, the toollog renders a per-tool result preview alongside the standard one-liner

	// Extra template data (injected into {{.Extra}} in prompt templates)
	Extra map[string]string `json:"-"`

	// Retry: when non-nil, retries transient agent failures with exponential backoff.
	Retry *RetryConfig `json:"-"`
}

type PlannedEndpoint struct {
	URL       string   `json:"url"`
	Method    string   `json:"method,omitempty"`
	Priority  string   `json:"priority"` // high, medium, low
	Rationale string   `json:"rationale,omitempty"`
	Tags      []string `json:"tags,omitempty"`
}

type ProgressEvent struct {
	Phase        string `json:"phase"`
	SubPhase     string `json:"sub_phase,omitempty"`
	Current      int    `json:"current,omitempty"`
	Total        int    `json:"total,omitempty"`
	FindingCount int    `json:"finding_count,omitempty"`
	Message      string `json:"message,omitempty"`
}

type PromptTemplate struct {
	ID           string   `yaml:"id"`
	Name         string   `yaml:"name"`
	Description  string   `yaml:"description"`
	OutputSchema string   `yaml:"output_schema"` // "findings" or "http_records"
	Variables    []string `yaml:"variables"`
	Body         string   `yaml:"-"`
	Source       string   `yaml:"-"` // "embedded", "user", "config"
}

type QuickCheck struct {
	ID       string              `json:"id"`
	Severity string              `json:"severity,omitempty"` // default: "medium"
	Scan     string              `json:"scan"`               // "per_insertion_point", "per_request", "per_host"
	Payloads []string            `json:"payloads,omitempty"` // for per_insertion_point: payloads to inject
	Requests []QuickCheckRequest `json:"requests,omitempty"` // for per_request/per_host: requests to send
	Match    QuickCheckMatch     `json:"match"`
}

type QuickCheckLintIssue struct {
	Severity string // "error" or "warning"
	Message  string
}

type QuickCheckMatch struct {
	BodyContains   string `json:"body_contains,omitempty"`
	BodyRegex      string `json:"body_regex,omitempty"`
	Status         int    `json:"status,omitempty"`
	HeaderContains string `json:"header_contains,omitempty"`
}

type QuickCheckRequest struct {
	Method  string            `json:"method"`
	Path    string            `json:"path"`
	Headers map[string]string `json:"headers,omitempty"`
	Body    string            `json:"body,omitempty"`
}

type RepairConfig struct {
	AgentName    string
	ShowPrompt   bool
	TargetURL    string   // target URL for regeneration context
	FocusAreas   []string // focus areas from the swarm plan
	ModuleTags   []string // module tags from the swarm plan
	ExploreNotes string   // session explore notes for context-aware session repair (optional)
}

type ResolvedSource struct {
	LocalPath string // absolute local filesystem path to source
}

type Result struct {
	AgentName      string                 `json:"agent_name"`
	TemplateID     string                 `json:"template_id,omitempty"`
	RawOutput      string                 `json:"raw_output"`
	RenderedPrompt string                 `json:"-"` // rendered prompt sent to agent (not serialized)
	Findings       []AgentFinding         `json:"findings,omitempty"`
	HTTPRecords    []AgentHTTPRecord      `json:"http_records,omitempty"`
	Evidence       []ExploitationEvidence `json:"evidence,omitempty"`
	OutputSchema   string                 `json:"output_schema,omitempty"` // "findings" or "http_records"
	SavedCount     int                    `json:"saved_count"`
	SkippedCount   int                    `json:"skipped_count"`
	DryRun         bool                   `json:"dry_run,omitempty"`

	// TokenUsage carries the cumulative input/output token counts reported by
	// the provider for this single agent call (sum across all turns of the
	// multi-turn loop). Aggregated upward by SwarmRunner / autopilot.
	TokenUsage TokenUsage `json:"token_usage,omitempty"`

	// ParseError, when non-nil, signals that the LLM produced output but
	// the parser couldn't extract structured findings/records from it.
	// Distinguishes "model returned nothing" (RawOutput empty) from
	// "model returned garbage / template regression" (RawOutput populated,
	// ParseError set). Callers should retry, surface a warning, or fail
	// loudly rather than silently dropping the parse failure.
	ParseError string `json:"parse_error,omitempty"`
}

type RetryConfig struct {
	MaxRetries    int           // maximum number of retries (default: 2)
	InitialDelay  time.Duration // initial backoff delay (default: 2s)
	MaxDelay      time.Duration // maximum backoff delay (default: 30s)
	BackoffFactor float64       // exponential backoff multiplier (default: 2.0)
}

type ScanFunc func(ctx context.Context, req ScanRequest) error

type ScanIntent struct {
	Apps    []AppIntent   `json:"apps"`
	Raw     string        `json:"raw"`
	Cleanup *SetupCleanup `json:"cleanup,omitempty"` // resources created during SDK-based setup
}

type ScanRequest struct {
	ModuleTags   []string // module tags from the agent's plan
	ModuleIDs    []string // explicit module IDs from the agent's plan
	ExtensionDir string   // path to generated JS extensions (empty if none)
	IsRescan     bool     // true for triage-driven targeted rescans
	TargetURLs   []string // optional: restrict rescan to these URLs only
	// ScanUUID is the run-unique native scan_uuid the pipeline owns. Scan
	// callbacks tag the native scan's findings with it so the pipeline can
	// attribute them to this run (agentic_scan_uuid) and scope finding counts
	// to the run instead of the whole project. Empty falls back to the
	// callback's own configured scan_uuid.
	ScanUUID string
}

type SetupCleanup struct {
	DockerProjects []string `json:"docker_projects,omitempty"`
	Containers     []string `json:"containers,omitempty"`
	CloneDirs      []string `json:"-"` // populated locally, not from JSON
}

type Snippet struct {
	ID       string `json:"id"`
	Severity string `json:"severity,omitempty"` // default: "medium"
	Scan     string `json:"scan"`               // "per_insertion_point", "per_request", "per_host"
	Body     string `json:"body"`               // JS function body
}

type SourceAnalysisConfig struct {
	AgentName      string
	TargetURL      string
	SourcePath     string
	Files          []string
	Instruction    string // user-provided custom instruction appended to the prompt
	DryRun         bool
	ShowPrompt     bool // print rendered prompt to stderr before executing
	ScanUUID       string
	ProjectUUID    string
	StreamWriter   io.Writer
	SessionDir     string // when set, per-phase prompt/output files are written here
	MaxConcurrency int    // max parallel sub-agents in RunSourceAnalysisParallel (0 = default 3)
}

type SourceAnalysisResult struct {
	HTTPRecords   []AgentHTTPRecord    `json:"http_records"`
	SessionConfig *AgentSessionConfig  `json:"session_config,omitempty"`
	Extensions    []GeneratedExtension `json:"extensions,omitempty"`
	// SessionExploreNotes carries the raw explore-phase notes about auth/credentials/sessions.
	// Not serialized — used internally to provide context for session config repair.
	SessionExploreNotes string `json:"-"`
}

type SwarmCheckpoint struct {
	CompletedPhases  []string          `json:"completed_phases"`
	TargetURL        string            `json:"target_url"`
	RecordCount      int               `json:"record_count"`
	Plan             *SwarmPlan        `json:"plan,omitempty"`
	ExtensionDir     string            `json:"extension_dir,omitempty"`
	Timestamp        time.Time         `json:"timestamp"`
	TriageRound      int               `json:"triage_round,omitempty"`      // last completed triage round (0-indexed)
	ExtensionRenames map[string]string `json:"extension_renames,omitempty"` // original filename -> renamed filename
	LastFindingID    int64             `json:"last_finding_id,omitempty"`
	Warnings         []string          `json:"warnings,omitempty"`
	InitialRecords   int               `json:"initial_records,omitempty"`
	SourceRecords    int               `json:"source_records,omitempty"`
	DiscoveryRecords int               `json:"discovery_records,omitempty"`
}

type SwarmIntensityPreset struct {
	Discover         bool
	CodeAudit        bool // applied only when source is provided
	Triage           bool
	MaxIterations    int
	Audit            string // audit mode when source is provided; empty = disabled
	MaxPlanRecords   int
	MasterBatchSize  int
	BatchConcurrency int
	ProbeConcurrency int
	Browser          bool
	Auth             bool // applied only when browser is enabled
	SwarmDuration    time.Duration
}

type SwarmPlan struct {
	ModuleTags  []string             `json:"module_tags,omitempty"`
	ModuleIDs   []string             `json:"module_ids,omitempty"`
	Extensions  []GeneratedExtension `json:"extensions,omitempty"`
	QuickChecks []QuickCheck         `json:"quick_checks,omitempty"`
	Snippets    []Snippet            `json:"snippets,omitempty"`
	FocusAreas  []string             `json:"focus_areas,omitempty"`
	// RecommendedSkills is the planner's context-driven selection of skill
	// names (from the <available_skills> menu) that the triage phase should
	// load for confirmation/escalation. Unioned with the always-on set and any
	// operator override before the triage engine is built.
	RecommendedSkills     []string `json:"recommended_skills,omitempty"`
	Notes                 string   `json:"notes,omitempty"`
	NeedsExtensions       bool     `json:"needs_extensions,omitempty"`
	NeedsExtensionsReason string   `json:"needs_extensions_reason,omitempty"`
	ExtensionAgentError   string   `json:"extension_agent_error,omitempty"`
}

type SwarmResult struct {
	SwarmPlan       *SwarmPlan               `json:"swarm_plan,omitempty"`
	TriageResults   []*TriageResult          `json:"triage_results,omitempty"`
	TotalFindings   int                      `json:"total_findings"`
	TotalRecords    int                      `json:"total_records"`
	SeverityCounts  map[string]int           `json:"severity_counts,omitempty"` // critical, high, medium, low, info
	Confirmed       int                      `json:"confirmed"`
	FalsePositives  int                      `json:"false_positives"`
	Iterations      int                      `json:"iterations"`
	Duration        time.Duration            `json:"duration"`
	AgenticScanUUID string                   `json:"agentic_scan_uuid"`
	SessionDir      string                   `json:"session_dir,omitempty"`
	PhaseTimings    map[string]time.Duration `json:"phase_timings,omitempty"`
	TokenUsage      TokenUsage               `json:"token_usage,omitempty"`
	BatchProvenance *BatchProvenance         `json:"batch_provenance,omitempty"` // only set when plan was merged from multiple batches
	Degraded        bool                     `json:"degraded,omitempty"`
	Warnings        []string                 `json:"warnings,omitempty"`
}

type TemplateData struct {
	SourceCode          string
	Language            string
	Framework           string
	FilePath            string
	SourcePath          string
	DirectoryTree       string
	SkipGuidance        string
	SourceHint          string
	TargetURL           string
	Hostname            string
	Endpoints           string
	Extra               map[string]string
	PreviousFindings    string // JSON array of findings from DB
	DiscoveredEndpoints string // JSON array of HTTP records from DB
	HighRiskEndpoints   string // JSON array of top risk-scored HTTP records from DB
	ModuleList          string // JSON array of available scanner modules
	ModuleTags          string // JSON array of unique module tags
	ModuleCatalog       string // human-readable, categorized list of module tags + total count
	ScanStats           string // JSON object of scan statistics
	AvailableCommands   string // hardcoded CLI command reference
}

type TokenUsage struct {
	InputTokens  int `json:"input_tokens"`
	OutputTokens int `json:"output_tokens"`
}

type TriageConfirmResult struct {
	Verdict   string `json:"verdict"`   // one of TriageVerdictConfirmed, TriageVerdictFalsePositive
	Reasoning string `json:"reasoning"` // free-form explanation of how the verdict was reached
	Notes     string `json:"notes,omitempty"`
}

type TriageResult struct {
	Confirmed      []TriagedFinding `json:"confirmed"`
	FalsePositives []TriagedFinding `json:"false_positives"`
	FollowUps      []FollowUpScan   `json:"follow_up_scans,omitempty"`
	Verdict        string           `json:"verdict"` // "done" or "rescan"
	Notes          string           `json:"notes,omitempty"`
}

type TriagedFinding struct {
	Title       string `json:"title"`
	ModuleID    string `json:"module_id,omitempty"`
	URL         string `json:"url,omitempty"`
	FindingHash string `json:"finding_hash,omitempty"`
	Reason      string `json:"reason,omitempty"`
}