bom

type BlastRadius struct {
	// Query is what was asked for.
	Query string `json:"query"`
	// Key is the package identity that matched.
	Key string `json:"key,omitempty"`
	// Name is the component's name as the documents spell it.
	Name string `json:"name,omitempty"`
	// Locations are every document containing it.
	Locations []Location `json:"locations"`
	// Versions are the distinct versions present, ordered.
	Versions []string `json:"versions"`
	// DirectCount and TransitiveCount split the locations by directness.
	// Unknown is where the document had no graph to answer from.
	DirectCount     int `json:"directCount"`
	TransitiveCount int `json:"transitiveCount"`
	UnknownCount    int `json:"unknownCount"`
}

type ChangeKind string

type CollectOptions struct {
	// Paths are files, directories or globs to read.
	Paths []string
	// Recursive walks directories to any depth. Off by default: a directory of
	// SBOMs is the normal shape, and recursing into a source tree would sweep
	// up every package.json it finds.
	Recursive bool
	// MaxDepth bounds a recursive walk. Zero means unlimited.
	MaxDepth int
}

type Collected struct {
	// Documents are the SBOMs that parsed.
	Documents []*Document
	// Skipped names files that were examined and were not SBOMs.
	Skipped []string
	// Failed names files that looked like SBOMs and could not be read, with
	// the reason. A corpus query over a partly-unreadable set must say so:
	// silently answering from fewer documents than the user pointed at is how
	// a "no results" answer becomes a wrong answer.
	Failed []FailedDocument
}

type ComponentChange struct {
	Kind ChangeKind `json:"kind"`
	// Name and Purl identify the component; Purl is empty when neither side had one.
	Name string `json:"name"`
	Purl string `json:"purl,omitempty"`
	// FromVersion and ToVersion are empty for the side that does not exist.
	FromVersion string `json:"fromVersion,omitempty"`
	ToVersion   string `json:"toVersion,omitempty"`
	// FromLicense and ToLicense are rendered licence expressions.
	FromLicense string `json:"fromLicense,omitempty"`
	ToLicense   string `json:"toLicense,omitempty"`
	// Direct reports whether the component is a direct dependency of the
	// subject on whichever side it exists. Nil when there is no dependency
	// graph to answer from — an unmeasurable fact stays null, never false.
	Direct *bool `json:"direct,omitempty"`
}

type ComponentHit struct {
	Key       string   `json:"key"`
	Name      string   `json:"name"`
	Versions  []string `json:"versions"`
	Documents int      `json:"documents"`
}

type Detection struct {
	Format        Format
	SpecVersion   string
	Envelope      Envelope
	PredicateType string
	// Supported reports whether this CLI can parse the document. An
	// unsupported document still reports its Format and SpecVersion, so the
	// caller can say *which* version it could not read.
	Supported bool
	// Payload is the inner SBOM bytes. It equals the input when no envelope
	// was unwrapped, so callers can parse Payload unconditionally.
	Payload []byte
}

type Diff struct {
	From       SourceInfo        `json:"from"`
	To         SourceInfo        `json:"to"`
	Identical  bool              `json:"identical"`
	Summary    DiffSummary       `json:"summary"`
	Components []ComponentChange `json:"components,omitempty"`
	Vulns      []VulnChange      `json:"vulnerabilities,omitempty"`
}

type DiffSummary struct {
	Added           int `json:"added"`
	Removed         int `json:"removed"`
	Upgraded        int `json:"upgraded"`
	Downgraded      int `json:"downgraded"`
	VersionChanged  int `json:"versionChanged"`
	LicenseChanged  int `json:"licenseChanged"`
	VulnsAdded      int `json:"vulnsAdded"`
	VulnsRemoved    int `json:"vulnsRemoved"`
	FromComponents  int `json:"fromComponents"`
	ToComponents    int `json:"toComponents"`
	GraphEdgesAdded int `json:"graphEdgesAdded"`
	GraphEdgesGone  int `json:"graphEdgesRemoved"`
}

type Document struct {
	BOM    *cdx.BOM   `json:"bom"`
	Source SourceInfo `json:"source"`
}

type DocumentSummary struct {
	Path            string                `json:"path"`
	Subject         string                `json:"subject,omitempty"`
	Version         string                `json:"version,omitempty"`
	Format          Format                `json:"format"`
	SpecVersion     string                `json:"specVersion,omitempty"`
	Components      int                   `json:"components"`
	Vulnerabilities int                   `json:"vulnerabilities"`
	Timestamp       string                `json:"timestamp,omitempty"`
	Deployment      cdx.DeploymentContext `json:"deployment,omitzero"`
}

type Entry struct {
	// Document is the SBOM the component was found in.
	Document *Document
	// Component is the component itself.
	Component *cdx.Component
	// Direct reports whether the document's subject depends on it directly.
	// Nil when the document has no dependency graph to answer from — an
	// unmeasurable fact stays null, never false.
	Direct *bool
}

type Envelope string

type ErrNoRoot struct{ Requested string }

type FailedDocument struct {
	Path   string `json:"path"`
	Reason string `json:"reason"`
}

type FieldReport struct {
	// Field is the stable machine name, e.g. "component.version".
	Field string `json:"field"`
	// Label is the human description shown in terminal output.
	Label string `json:"label"`
	// Present counts components (or 1/0 for document-level fields) carrying it.
	Present int `json:"present"`
	// Total is the denominator for Present.
	Total int `json:"total"`
	// Detail explains a shortfall, or is empty when the field is complete.
	Detail string `json:"detail,omitempty"`
}

type Format string

type Index struct {
	// contains filtered or unexported fields
}

type LicenseHit struct {
	License    string `json:"license"`
	Components int    `json:"components"`
}

type Location struct {
	Path       string                `json:"path"`
	Subject    string                `json:"subject,omitempty"`
	Version    string                `json:"version"`
	Direct     *bool                 `json:"direct,omitempty"`
	Deployment cdx.DeploymentContext `json:"deployment,omitzero"`
}

type QualityReport struct {
	// Document-level fields: author, timestamp, subject, unique identifier.
	Document []FieldReport `json:"document"`
	// Component-level fields, each scored across all components.
	Components []FieldReport `json:"components"`
	// ComponentCount is the number of components scored.
	ComponentCount int `json:"componentCount"`
	// Score is the unweighted mean of every field's ratio, 0–100. It is a
	// sorting key, not a grade.
	Score int `json:"score"`
}

type SearchResults struct {
	Query           string             `json:"query"`
	Components      []ComponentHit     `json:"components,omitempty"`
	Documents       []DocumentSummary  `json:"documents,omitempty"`
	Vulnerabilities []VulnerabilityHit `json:"vulnerabilities,omitempty"`
	Licenses        []LicenseHit       `json:"licenses,omitempty"`
	// Totals are the full counts per facet, before any limit was applied, so a
	// truncated result says how much it truncated.
	Totals map[string]int `json:"totals"`
}

type SkewEntry struct {
	Key      string        `json:"key"`
	Name     string        `json:"name"`
	Versions []SkewVersion `json:"versions"`
	// DocumentCount is how many documents carry it at any version.
	DocumentCount int `json:"documentCount"`
	// DirectCount is how many of those depend on it directly, which is where a
	// version can actually be changed.
	DirectCount int `json:"directCount"`
}

type SkewVersion struct {
	Version   string   `json:"version"`
	Documents []string `json:"documents"`
}

type SourceInfo struct {
	// Path is where the document was read from. Empty for stdin.
	Path string `json:"path,omitempty"`
	// Format and SpecVersion are the original serialisation.
	Format      Format `json:"format"`
	SpecVersion string `json:"specVersion,omitempty"`
	// Envelope and PredicateType are set when the SBOM arrived inside an
	// attestation wrapper.
	Envelope      Envelope `json:"envelope,omitempty"`
	PredicateType string   `json:"predicateType,omitempty"`
	// Digest is the SHA-256 of the bytes as supplied — the outer envelope
	// included, not the unwrapped payload, because that is the artefact a user
	// can point at on disk.
	Digest string `json:"digest"`
	// Size is the length in bytes of those same supplied bytes.
	Size int `json:"size"`
}

type TreeNode struct {
	Ref      string      `json:"ref"`
	Name     string      `json:"name"`
	Version  string      `json:"version,omitempty"`
	Purl     string      `json:"purl,omitempty"`
	Depth    int         `json:"depth"`
	Children []*TreeNode `json:"children,omitempty"`
	// Cycle marks a node whose subtree was elided because it repeats an
	// ancestor. Dependency graphs do contain cycles (Go modules and Maven both
	// permit them); eliding and saying so beats either infinite recursion or
	// silently truncating.
	Cycle bool `json:"cycle,omitempty"`
	// Elided marks a node whose children were cut off by the depth limit.
	Elided bool `json:"elided,omitempty"`
}

type TreeOptions struct {
	// Root selects the starting component by purl, bom-ref or name. Empty
	// starts from the document's subject.
	Root string
	// Invert builds the reverse tree: children are the components that depend
	// on the parent.
	Invert bool
	// MaxDepth caps traversal depth. Zero means unlimited.
	MaxDepth int
}

type UnsupportedError struct {
	Format      Format
	SpecVersion string
}

type VulnChange struct {
	Kind ChangeKind `json:"kind"` // ChangeAdded or ChangeRemoved
	ID   string     `json:"id"`
	// Severity is the highest severity rating carried on the entry, or "".
	Severity string `json:"severity,omitempty"`
	// Affects lists the component refs the entry points at.
	Affects []string `json:"affects,omitempty"`
}

type VulnerabilityHit struct {
	ID          string   `json:"id"`
	Severity    string   `json:"severity,omitempty"`
	Description string   `json:"description,omitempty"`
	Documents   []string `json:"documents"`
}