vdb

type APIKeyResponse struct {
	Success bool   `json:"success"`
	OrgID   string `json:"orgId"`
	APIKey  string `json:"apiKey"`
	Error   string `json:"error,omitempty"`
}

type AttackTechniquesSearchParams struct {
	TechniqueIDs []string
	Tactics      []string
	CveIDs       []string
	Sources      []string
	CapecID      string
	Domain       string
	Subtechnique string
	DerivedBy    string
	Q            string
	Since        string
	Until        string
	Limit        int
	Offset       int
}

type CVEInfo struct {
	Data interface{} // Store full response for display (array or object)
}

type CliAIBOMRequest struct {
	SpecVersion    string          `json:"specVersion,omitempty"`
	CatalogVersion string          `json:"catalogVersion,omitempty"`
	BomJSON        string          `json:"bomJson,omitempty"`
	Detections     json.RawMessage `json:"detections,omitempty"`
}

type CliAIBOMResponse struct {
	Aibom *CliIngestionSnapshot `json:"aibom,omitempty"`
}

type CliAPIError struct {
	StatusCode int
	RetryAfter time.Duration // parsed from the Retry-After header; 0 if absent
	Message    string
}

type CliBinaryAnalyzeEntry struct {
	Path          string                  `json:"path"`
	Size          int64                   `json:"size"`
	ELFType       string                  `json:"elfType,omitempty"`
	ELFArch       string                  `json:"elfArch,omitempty"`
	ELFOSABI      string                  `json:"elfOSABI,omitempty"`
	Hashes        CliBinaryHashes         `json:"hashes"`
	Weaknesses    []string                `json:"weaknesses,omitempty"`
	Capabilities  []string                `json:"capabilities,omitempty"`
	Strings       []string                `json:"strings,omitempty"`
	Exif          map[string]any          `json:"exif,omitempty"`
	Hashlookup    *CliHashlookupResult    `json:"hashlookup,omitempty"`
	MalwareBazaar *CliMalwareBazaarResult `json:"malwareBazaar,omitempty"`
}

type CliBinaryAnalyzeRequest struct {
	ScannerRunUUID string                  `json:"scannerRunUuid"`
	Path           string                  `json:"path"`
	Binaries       []CliBinaryAnalyzeEntry `json:"binaries"`
}

type CliBinaryAnalyzeResponse struct {
	BinariesStored  int `json:"binariesStored"`
	FindingsCreated int `json:"findingsCreated"`
	MalwareHits     int `json:"malwareHits"`
	CveMatches      int `json:"cveMatches"`
}

type CliBinaryHashes struct {
	SHA256    string `json:"sha256"`
	MD5       string `json:"md5"`
	SHA1      string `json:"sha1"`
	SSDEEP    string `json:"ssdeep,omitempty"`
	TLSH      string `json:"tlsh,omitempty"`
	SHA256Raw string `json:"sha256Raw,omitempty"`
	MD5Raw    string `json:"md5Raw,omitempty"`
	SHA1Raw   string `json:"sha1Raw,omitempty"`
}

type CliCBOMRequest struct {
	SpecVersion    string          `json:"specVersion,omitempty"`
	CatalogVersion string          `json:"catalogVersion,omitempty"`
	BomJSON        string          `json:"bomJson,omitempty"`
	Detections     json.RawMessage `json:"detections,omitempty"`
}

type CliCBOMResponse struct {
	Cbom *CliIngestionSnapshot `json:"cbom,omitempty"`
}

type CliControlFlag struct {
	Flag  string `json:"flag"`
	Value string `json:"value"`
}

type CliCweGuidanceRequest struct {
	CweIDs []string `json:"cweIds"`
}

type CliEnv struct {
	CliVersion      string                `json:"cliVersion,omitempty"`
	Commit          string                `json:"commit,omitempty"`
	BuildDate       string                `json:"buildDate,omitempty"`
	Platform        string                `json:"platform,omitempty"`
	Arch            string                `json:"arch,omitempty"`
	OS              string                `json:"os,omitempty"`
	Hostname        string                `json:"hostname,omitempty"`
	Shell           string                `json:"shell,omitempty"`
	Git             *CliGitContext        `json:"git,omitempty"`
	PackageManagers []CliPackageMgr       `json:"packageManagers,omitempty"`
	MemoryPath      string                `json:"memoryPath,omitempty"`
	Licenses        []CliLicenseHit       `json:"licenses,omitempty"`
	Manifests       []CliManifestMetadata `json:"manifests,omitempty"`
	ToolMetadata    *CliSBOMToolMetadata  `json:"toolMetadata,omitempty"`
	Capabilities    []CliPMCapability     `json:"capabilities,omitempty"`
}

type CliFinalizeRequest struct {
	IngestionSnapshotUuid string           `json:"ingestionSnapshotUuid"`
	ExitCode              int              `json:"exitCode"`               // 0 = pass, 1 = break build
	BreakBuild            bool             `json:"breakBuild"`             // true when a gate breached
	Gates                 []CliGateResult  `json:"gates"`                  // per-gate breach detail (empty when clean)
	ControlFlags          []CliControlFlag `json:"controlFlags,omitempty"` // every control flag in effect (incl. non-breaching)
}

type CliFinalizeResponse struct {
	Persisted bool `json:"persisted"`
}

type CliFindingResult struct {
	FindingID      string                 `json:"findingId"`
	FindingUuid    string                 `json:"findingUuid"`
	PackageName    string                 `json:"packageName,omitempty"`
	PackageVersion string                 `json:"packageVersion,omitempty"`
	Purl           string                 `json:"purl,omitempty"`
	IntroducedVia  []CliIntroducedViaPath `json:"introducedVia,omitempty"`
}

type CliGateResult struct {
	Gate    string `json:"gate"`
	Count   int    `json:"count"`
	Message string `json:"message"`
}

type CliGitContext struct {
	Branch   string   `json:"branch,omitempty"`
	Commit   string   `json:"commit,omitempty"`
	Author   string   `json:"author,omitempty"`
	Remotes  []string `json:"remotes,omitempty"`
	Dirty    bool     `json:"dirty,omitempty"`
	RepoRoot string   `json:"repoRoot,omitempty"`
}

type CliHashlookupResult struct {
	FileName       string `json:"fileName,omitempty"`
	FileSize       string `json:"fileSize,omitempty"`
	MD5            string `json:"md5,omitempty"`
	SHA1           string `json:"sha1,omitempty"`
	SHA256         string `json:"sha256,omitempty"`
	SSDEEP         string `json:"ssdeep,omitempty"`
	TLSH           string `json:"tlsh,omitempty"`
	PackageName    string `json:"packageName,omitempty"`
	PackageVersion string `json:"packageVersion,omitempty"`
}

type CliIDsRequest struct {
	IDs []string `json:"ids"`
}

type CliIngestionSnapshot struct {
	Uuid      string `json:"uuid"`
	URL       string `json:"url"`
	CreatedAt int64  `json:"createdAt"`
}

type CliInsightsClassif struct {
	Label      string `json:"label,omitempty"`
	Thresholds string `json:"thresholds,omitempty"`
}

type CliInsightsCollector struct {
	Name            string  `json:"name"`
	Status          string  `json:"status"` // completed | skipped | failed
	Reason          string  `json:"reason,omitempty"`
	DurationSeconds float64 `json:"durationSeconds,omitempty"`
}

type CliInsightsCrossRepoEdge struct {
	ID             string          `json:"id"`
	LocalNodeID    string          `json:"localNodeId"`
	JoinKind       string          `json:"joinKind"`
	JoinKey        string          `json:"joinKey"`
	Role           string          `json:"role"`
	TargetRepoHint string          `json:"targetRepoHint,omitempty"`
	Confidence     *float64        `json:"confidence,omitempty"`
	Properties     json.RawMessage `json:"properties,omitempty"`
}

type CliInsightsDiag struct {
	Level     string `json:"level,omitempty"`
	Collector string `json:"collector,omitempty"`
	MetricID  string `json:"metricId,omitempty"`
	Message   string `json:"message,omitempty"`
	Caveat    bool   `json:"caveat,omitempty"`
}

type CliInsightsEdge struct {
	ID         string          `json:"id"`
	Kind       string          `json:"kind"`
	From       string          `json:"from"`
	To         string          `json:"to"`
	Confidence *float64        `json:"confidence,omitempty"`
	Resolution string          `json:"resolution,omitempty"`
	Properties json.RawMessage `json:"properties,omitempty"`
}

type CliInsightsEvidenceIn struct {
	Records []json.RawMessage `json:"records,omitempty"`
}

type CliInsightsEvidenceRef struct {
	Kind string `json:"kind"`

	RunIndex    *int `json:"runIndex,omitempty"`
	ResultIndex *int `json:"resultIndex,omitempty"`

	StatementIndex *int `json:"statementIndex,omitempty"`

	BomRef string `json:"bomRef,omitempty"`
	SpdxID string `json:"spdxId,omitempty"`

	Check       string `json:"check,omitempty"`
	DetailIndex *int   `json:"detailIndex,omitempty"`

	RecordID string `json:"recordId,omitempty"`
}

type CliInsightsGraph struct {
	Nodes          []CliInsightsNode          `json:"nodes,omitempty"`
	Edges          []CliInsightsEdge          `json:"edges,omitempty"`
	CrossRepoEdges []CliInsightsCrossRepoEdge `json:"crossRepoEdges,omitempty"`

	// Set only when the CLI capped the graph it built. Its absence is a claim — "this is
	// the whole graph" — so it must survive the wire rather than being quietly dropped.
	Truncation *CliInsightsGraphTruncation `json:"truncation,omitempty"`
}

type CliInsightsGraphTruncation struct {
	NodesOmitted int    `json:"nodesOmitted,omitempty"`
	EdgesOmitted int    `json:"edgesOmitted,omitempty"`
	FilesSkipped int    `json:"filesSkipped,omitempty"`
	Reason       string `json:"reason,omitempty"`
}

type CliInsightsMetric struct {
	ID         string `json:"id"`
	Family     string `json:"family"`
	Name       string `json:"name"`
	Definition string `json:"definition"`
	Unit       string `json:"unit,omitempty"`
	Statistic  string `json:"statistic,omitempty"`

	// nil means "not measured". Never 0 — that would claim we looked.
	Value any `json:"value"`

	Window         *CliInsightsMetricWindow `json:"window,omitempty"`
	Classification *CliInsightsClassif      `json:"classification,omitempty"`

	EvidenceSemantics    string `json:"evidenceSemantics"`
	EvidenceCompleteness string `json:"evidenceCompleteness"`
	PopulationSize       *int   `json:"populationSize,omitempty"`
	OmittedCount         int    `json:"omittedCount,omitempty"`
	TruncationReason     string `json:"truncationReason,omitempty"`

	EvidenceRefs []CliInsightsEvidenceRef `json:"evidenceRefs"`

	// The sources the metric's definition cites — the survey papers and reference
	// implementations its formula came from.
	References []CliInsightsReference `json:"references,omitempty"`
}

type CliInsightsMetricWindow struct {
	Since int64  `json:"since,omitempty"`
	Until int64  `json:"until,omitempty"`
	Label string `json:"label,omitempty"`
}

type CliInsightsNode struct {
	ID            string          `json:"id"`
	Kind          string          `json:"kind"`
	Name          string          `json:"name"`
	QualifiedName string          `json:"qualifiedName,omitempty"`
	Path          string          `json:"path,omitempty"`
	StartLine     int             `json:"startLine,omitempty"`
	EndLine       int             `json:"endLine,omitempty"`
	Language      string          `json:"language,omitempty"`
	Purl          string          `json:"purl,omitempty"`
	Exported      bool            `json:"exported,omitempty"`
	Properties    json.RawMessage `json:"properties,omitempty"`
}

type CliInsightsReference struct {
	Title string `json:"title,omitempty"`
	URL   string `json:"url"`
}

type CliInsightsRequest struct {
	// Set on chunks 1..N to append to a run created by chunk 0. Unused: a gzipped submission
	// fits one request, and one request is one transaction — a failure then stores nothing,
	// rather than leaving a half-run that reads as a whole one.
	InsightsRunUuid string `json:"insightsRunUuid,omitempty"`

	SchemaVersion string              `json:"schemaVersion,omitempty"`
	Tool          *CliInsightsTool    `json:"tool,omitempty"`
	Target        *CliInsightsTarget  `json:"target,omitempty"`
	Run           *CliInsightsRunMeta `json:"run,omitempty"`

	Graph    *CliInsightsGraph      `json:"graph,omitempty"`
	Metrics  []CliInsightsMetric    `json:"metrics,omitempty"`
	Evidence *CliInsightsEvidenceIn `json:"evidence,omitempty"`

	// The verbatim report, schema-valid, including its SARIF / OpenVEX / CycloneDX
	// attachments. Stored to S3 untouched; it is not the source of any row.
	ReportJSON  string            `json:"reportJson,omitempty"`
	Diagnostics []CliInsightsDiag `json:"diagnostics,omitempty"`
}

type CliInsightsResponse struct {
	Insights *CliInsightsSnapshot `json:"insights,omitempty"`

	// Skipped names a reason nothing was stored that is not a failure — "community". Absent
	// Insights with no Skipped is a failure, whatever the status code says.
	Skipped string `json:"skipped,omitempty"`
}

type CliInsightsRunMeta struct {
	// When the scan ran, by its own clock — the server's createdAt is when it was
	// stored, which on a slow upload or a retry is a different and later time. Epoch ms.
	StartedAt       int64   `json:"startedAt,omitempty"`
	CompletedAt     int64   `json:"completedAt,omitempty"`
	DurationSeconds float64 `json:"durationSeconds,omitempty"`

	HistoryWindow *CliInsightsWindow `json:"historyWindow,omitempty"`

	// The report's own account of what ran and what did not. A skipped forge collector
	// is why four metrics are null; without this the nulls have no story.
	Collectors []CliInsightsCollector `json:"collectors,omitempty"`
}

type CliInsightsSnapshot struct {
	Uuid      string `json:"uuid"`
	URL       string `json:"url,omitempty"`
	CreatedAt int64  `json:"createdAt"`

	MetricsStored        int `json:"metricsStored"`
	EvidenceStored       int `json:"evidenceStored"`
	NodesStored          int `json:"nodesStored"`
	EdgesStored          int `json:"edgesStored"`
	CrossRepoEdgesStored int `json:"crossRepoEdgesStored"`
}

type CliInsightsTarget struct {
	RepoID        string `json:"repoId,omitempty"`
	OrgKey        string `json:"orgKey,omitempty"`
	RemoteURL     string `json:"remoteUrl,omitempty"`
	DefaultBranch string `json:"defaultBranch,omitempty"`
	HeadCommit    string `json:"headCommit,omitempty"`

	// The head commit's own timestamp, epoch ms — "analysed as of when the code last
	// changed", which is the date a reader wants, not the upload date.
	HeadCommittedAt int64 `json:"headCommittedAt,omitempty"`
}

type CliInsightsTool struct {
	Name           string `json:"name,omitempty"`
	Version        string `json:"version,omitempty"`
	CatalogVersion string `json:"catalogVersion,omitempty"`
}

type CliInsightsWindow struct {
	Since         int64 `json:"since,omitempty"`
	Until         int64 `json:"until,omitempty"`
	CommitsWalked int   `json:"commitsWalked,omitempty"`
	CommitLimit   int   `json:"commitLimit,omitempty"`
}

type CliIntroducedViaPath struct {
	PathIndex      int      `json:"pathIndex"`
	PathLength     int      `json:"pathLength"`
	PackageManager string   `json:"packageManager"`
	ManifestFile   string   `json:"manifestFile"`
	DependencyPath string   `json:"dependencyPath"`
	DependencyKeys []string `json:"dependencyKeys"`
}

type CliLicenseHit struct {
	SPDXID      string `json:"spdxId,omitempty"`
	Name        string `json:"name,omitempty"`
	URL         string `json:"url,omitempty"`
	Source      string `json:"source,omitempty"`
	Acknowledge string `json:"acknowledgement,omitempty"`
	Text        string `json:"text,omitempty"`
}

type CliMalscanIOC struct {
	Type         string   `json:"type"`                   // domain|url|ipv4|ipv6|file-hash|exfil-endpoint|wallet|install-command|email|package-name
	Value        string   `json:"value"`                  // the observable
	Ecosystem    string   `json:"ecosystem,omitempty"`    // npm|pypi|cargo|… (selects the S3 processor prefix)
	FilePath     string   `json:"filePath,omitempty"`     // path (relative to scan root) the IOC was found in
	RuleID       string   `json:"ruleId,omitempty"`       // originating malscan rule/signal id
	Severity     string   `json:"severity,omitempty"`     // STIX severity, when known
	References   []string `json:"references,omitempty"`   // STIX external references / provenance URLs
	SampleSHA256 string   `json:"sampleSha256,omitempty"` // sha256 of the offending-file sample (S3 key component)
	SampleBase64 string   `json:"sampleBase64,omitempty"` // offending-file content (size-capped), base64-encoded
	SampleName   string   `json:"sampleName,omitempty"`   // original sample file name
}

type CliMalscanRequest struct {
	SARIF                 map[string]any    `json:"sarif"`
	Findings              []CliSARIFFinding `json:"findings"`
	IOCs                  []CliMalscanIOC   `json:"iocs,omitempty"`
	IngestionSnapshotUuid string            `json:"ingestionSnapshotUuid,omitempty"`
}

type CliMalscanResponse struct {
	IngestionSnapshot *CliIngestionSnapshot `json:"ingestionSnapshot,omitempty"`
	Findings          []CliFindingResult    `json:"findings,omitempty"`
	Stats             CliSARIFStats         `json:"stats"`
}

type CliMalwareBazaarResult struct {
	Malicious bool   `json:"malicious"`
	FileName  string `json:"fileName,omitempty"`
}

type CliManifestMetadata struct {
	Path        string `json:"path"`
	Ecosystem   string `json:"ecosystem,omitempty"`
	IsLock      bool   `json:"isLock,omitempty"`
	SHA256      string `json:"sha256,omitempty"`
	Size        int    `json:"size,omitempty"`
	ContentType string `json:"contentType,omitempty"`
	License     string `json:"license,omitempty"` // declared license from the manifest field
	Provider    string `json:"provider,omitempty"`
	Registry    string `json:"registry,omitempty"`
	Content     string `json:"content,omitempty"` // raw manifest body (chunk-0 only)
}

type CliPMCapability struct {
	Ecosystem      string  `json:"ecosystem"`
	CapabilityName string  `json:"capabilityName"`
	Supported      bool    `json:"supported"`
	Detected       bool    `json:"detected"`
	Confidence     float64 `json:"confidence,omitempty"`
	Evidence       string  `json:"evidence,omitempty"`
	FilePath       string  `json:"filePath,omitempty"`
	Binary         string  `json:"binary,omitempty"`
	BinaryPath     string  `json:"binaryPath,omitempty"`
	Version        string  `json:"version,omitempty"`
	VersionCommand string  `json:"versionCommand,omitempty"`
	Authoritative  bool    `json:"authoritative,omitempty"`
}

type CliPackageChecksum struct {
	Alg   string `json:"alg"`
	Value string `json:"value"`
}

type CliPackageEntry struct {
	Purl          string               `json:"purl"`
	Name          string               `json:"name,omitempty"`
	Version       string               `json:"version,omitempty"`
	Ecosystem     string               `json:"ecosystem,omitempty"`
	ManifestFile  string               `json:"manifestFile,omitempty"`
	Scope         string               `json:"scope,omitempty"`
	License       string               `json:"license,omitempty"`
	IntroducedVia [][]string           `json:"introducedVia,omitempty"`
	Checksums     []CliPackageChecksum `json:"checksums,omitempty"`
	// Discovery-source provenance: "manifest" (declared) | "installed" (found in
	// an install dir, not declared). InstalledPath is the root-relative install
	// location (e.g. "node_modules/lodash") for installed packages.
	SourceType    string `json:"sourceType,omitempty"`
	InstalledPath string `json:"installedPath,omitempty"`
}

type CliPackageFirewallConfigRequest struct {
	CvssThreshold   *float64 `json:"cvssThreshold,omitempty"`
	EpssThreshold   *float64 `json:"epssThreshold,omitempty"`
	CessThreshold   *float64 `json:"cessThreshold,omitempty"`
	BlockMalware    *bool    `json:"blockMalware,omitempty"`
	BlockEol        *bool    `json:"blockEol,omitempty"`
	BlockKev        *bool    `json:"blockKev,omitempty"`
	BlockWeaponized *bool    `json:"blockWeaponized,omitempty"`
	BlockActive     *bool    `json:"blockActive,omitempty"`
	BlockPoc        *bool    `json:"blockPoc,omitempty"`
	BlockBadActors  *bool    `json:"blockBadActors,omitempty"`
	CooldownDays    *int     `json:"cooldownDays,omitempty"`
	VersionLag      *int     `json:"versionLag,omitempty"`
}

type CliPackageFirewallMirrorRequest struct {
	Ecosystem string `json:"ecosystem"`
	URL       string `json:"url"`
	Priority  *int   `json:"priority,omitempty"`
	IsActive  *bool  `json:"isActive,omitempty"`
}

type CliPackageInsight struct {
	Purl           string                  `json:"purl"`
	Name           string                  `json:"name"`
	Version        string                  `json:"version"`
	Ecosystem      string                  `json:"ecosystem"`
	PublishedAt    *int64                  `json:"publishedAt,omitempty"`    // ms epoch — installed version (--cooldown)
	PublishSource  string                  `json:"publishSource,omitempty"`  // "db" | "deps.dev"
	LatestVersions []CliVersionStamp       `json:"latestVersions,omitempty"` // newest-first by publish date (--version-lag)
	SafeVersions   []CliSafeHarbourVersion `json:"safeVersions,omitempty"`
	SafeHarbour    *CliSafeHarbourSummary  `json:"safeHarbour,omitempty"`
	IsEOL          bool                    `json:"isEol,omitempty"`
	EOLFrom        string                  `json:"eolFrom,omitempty"`
	IsMalicious    bool                    `json:"isMalicious,omitempty"`
	MalwareSource  string                  `json:"malwareSource,omitempty"`
	// TransitiveFix is the server-resolved cross-ecosystem parent-upgrade for a
	// transitive vulnerable package. When present, --sca-autofix prefers it over a
	// deterministic override; the CLI no longer queries a registry directly.
	TransitiveFix *CliTransitiveFix `json:"transitiveFix,omitempty"`
}

type CliPackageInsightLite struct {
	Purl           string                `json:"purl"`
	Name           string                `json:"name,omitempty"`
	Version        string                `json:"version,omitempty"`
	Ecosystem      string                `json:"ecosystem,omitempty"`
	PublishedAt    *int64                `json:"publishedAt,omitempty"`
	LatestVersions []CliVersionStampLite `json:"latestVersions,omitempty"`
	SafeHarbour    *CliSafeHarbourLite   `json:"safeHarbour,omitempty"`
	IsEOL          bool                  `json:"isEOL,omitempty"`
	IsMalicious    bool                  `json:"isMalicious,omitempty"`
}

type CliPackageInsightsRequest struct {
	Purls   []string          `json:"purls"`
	Options CliSCAOptionsLite `json:"options,omitempty"`
}

type CliPackageInsightsResponse struct {
	InsightsByPurl map[string]CliPackageInsightLite `json:"insightsByPurl"`

	// Unparseable PURLs, returned rather than silently dropped: a caller that sent 200
	// and got 194 answers deserves to know which six, rather than concluding those six
	// are fine.
	Unparseable []string `json:"unparseable,omitempty"`
}

type CliPackageMgr struct {
	Ecosystem string `json:"ecosystem"`
	Manifest  string `json:"manifest,omitempty"`
	IsLock    bool   `json:"isLock,omitempty"`
}

type CliPurlsRequest struct {
	Purls []string `json:"purls"`
}

type CliQualityGateConfigRequest struct {
	EolNextQuarterSeverity  *string `json:"eolNextQuarterSeverity,omitempty"`
	EolThisQuarterSeverity  *string `json:"eolThisQuarterSeverity,omitempty"`
	EolWithin30DaysSeverity *string `json:"eolWithin30DaysSeverity,omitempty"`
	EolRetiredSeverity      *string `json:"eolRetiredSeverity,omitempty"`

	// Org-wide CLI scan enforcement settings (all nullable — a nil pointer means
	// the org did not set this, so the caller's flag / builtin default stands).
	// The upsert merges on conflict (COALESCE), so omitted fields preserve their
	// stored value; clearing a value is done via the website full-replace PUT.
	BlockEol               *bool   `json:"blockEol,omitempty"`
	BlockMalware           *bool   `json:"blockMalware,omitempty"`
	BlockUnpinned          *bool   `json:"blockUnpinned,omitempty"`
	Cooldown               *int    `json:"cooldown,omitempty"`
	VersionLag             *int    `json:"versionLag,omitempty"`
	ScaAutofixMaxMajorBump *int    `json:"scaAutofixMaxMajorBump,omitempty"`
	Exploits               *string `json:"exploits,omitempty"`
	Severity               *string `json:"severity,omitempty"`
	ScaAutofixStrategy     *string `json:"scaAutofixStrategy,omitempty"`

	// Clear lists camelCase enforcement field names to reset to NULL (unset) for
	// the org — distinct from an omitted field, which preserves its stored value.
	Clear []string `json:"clear,omitempty"`
}

type CliReachabilityHit struct {
	VulnID      string           `json:"vulnId"`
	Purl        string           `json:"purl,omitempty"`
	Source      string           `json:"source,omitempty"`
	Language    string           `json:"language"`
	Name        string           `json:"name"`
	QueryText   string           `json:"queryText"`
	QueryHash   string           `json:"queryHash,omitempty"`
	Description string           `json:"description,omitempty"`
	DerivedBy   string           `json:"derivedBy,omitempty"`
	Captures    []map[string]any `json:"captures,omitempty"`
	Predicates  []map[string]any `json:"predicates,omitempty"`
}

type CliReachabilityPayload struct {
	CveID                  string `json:"cveId"`
	FindingUuid            string `json:"findingUuid,omitempty"`
	PackageName            string `json:"packageName"`
	PackageVersion         string `json:"packageVersion,omitempty"`
	Purl                   string `json:"purl,omitempty"`
	Language               string `json:"language,omitempty"`
	Ecosystem              string `json:"ecosystem,omitempty"`
	Source                 string `json:"source"`
	Verdict                string `json:"verdict"`
	TreeSitterQueryUuid    string `json:"treeSitterQueryUuid,omitempty"`
	QueryHash              string `json:"queryHash,omitempty"`
	MatchedFile            string `json:"matchedFile,omitempty"`
	MatchedRoutine         string `json:"matchedRoutine,omitempty"`
	MatchedModule          string `json:"matchedModule,omitempty"`
	MatchStartLine         int    `json:"matchStartLine,omitempty"`
	MatchEndLine           int    `json:"matchEndLine,omitempty"`
	EvidenceJSON           string `json:"evidenceJSON,omitempty"`
	MemoryVexStatus        string `json:"memoryVexStatus,omitempty"`
	MemoryVexJustification string `json:"memoryVexJustification,omitempty"`
	MemoryVexAction        string `json:"memoryVexAction,omitempty"`
	Severity               string `json:"severity,omitempty"`
	FixedVersion           string `json:"fixedVersion,omitempty"`
}

type CliReachabilityRequest struct {
	IDs       []string `json:"ids"`
	Languages []string `json:"languages,omitempty"`
}

type CliRemediationRequest struct {
	IDs     []string          `json:"ids"`
	Context map[string]string `json:"context,omitempty"`
}

type CliResponse[T any] struct {
	Meta CliResponseMeta
	Data T
}

type CliResponseMeta struct {
	Tier            string          `json:"tier"`
	EndpointVersion string          `json:"endpointVersion"`
	RequestID       string          `json:"requestId"`
	Timestamp       int64           `json:"timestamp"`
	TierGated       map[string]bool `json:"tierGated,omitempty"`
}

type CliSARIFFinding struct {
	RuleID           string   `json:"ruleId"`
	RuleName         string   `json:"ruleName,omitempty"`
	Message          string   `json:"message,omitempty"`
	Severity         string   `json:"severity,omitempty"`
	Level            string   `json:"level,omitempty"`
	SecuritySeverity string   `json:"securitySeverity,omitempty"`
	File             string   `json:"file,omitempty"`
	PackagePurl      string   `json:"packagePurl,omitempty"`
	StartLine        int      `json:"startLine,omitempty"`
	EndLine          int      `json:"endLine,omitempty"`
	Fingerprint      string   `json:"fingerprint,omitempty"`
	CWEs             []int    `json:"cwes,omitempty"`
	Tags             []string `json:"tags,omitempty"`
	SARIFGuid        string   `json:"sarifGuid,omitempty"`

	Description      string `json:"description,omitempty"`
	CodeSnippet      string `json:"codeSnippet,omitempty"`
	SnippetStartLine int    `json:"snippetStartLine,omitempty"`
	SnippetEndLine   int    `json:"snippetEndLine,omitempty"`

	MemoryVexStatus        string `json:"memoryVexStatus,omitempty"`
	MemoryVexJustification string `json:"memoryVexJustification,omitempty"`
	MemoryVexAction        string `json:"memoryVexAction,omitempty"`
}

type CliSARIFRequest struct {
	SARIF    map[string]any    `json:"sarif"`
	Findings []CliSARIFFinding `json:"findings"`
	// IngestionSnapshotUuid is empty on chunk 0 (server creates the snapshot/run)
	// and set on chunks 1..N to the uuid chunk 0 returned, so the server appends
	// each chunk's findings under one snapshot/run instead of creating new ones.
	// Lets the CLI split a large SARIF submission into sub-8-MiB requests.
	IngestionSnapshotUuid string `json:"ingestionSnapshotUuid,omitempty"`
}

type CliSARIFResponse struct {
	IngestionSnapshot *CliIngestionSnapshot `json:"ingestionSnapshot,omitempty"`
	Findings          []CliFindingResult    `json:"findings,omitempty"`
	Stats             CliSARIFStats         `json:"stats"`
}

type CliSARIFStats struct {
	Findings   int            `json:"findings"`
	Rules      int            `json:"rules"`
	BySeverity map[string]int `json:"bySeverity"`
}

type CliSBOMToolMetadata struct {
	ToolName    string `json:"toolName,omitempty"`
	ToolVersion string `json:"toolVersion,omitempty"`
	ToolVendor  string `json:"toolVendor,omitempty"`
	ToolHash    string `json:"toolHash,omitempty"`
}

type CliSCAOptions struct {
	IncludeReachability *bool `json:"includeReachability,omitempty"`
	IncludeVEX          *bool `json:"includeVEX,omitempty"`
	// Gate-data toggles: request per-package policy signals (PackageInsights)
	// only when a `scan` gate is active, so a plain scan pays nothing extra.
	IncludeCooldown     bool `json:"includeCooldown,omitempty"`     // installed-version publish dates (--cooldown)
	IncludeVersionLag   bool `json:"includeVersionLag,omitempty"`   // full version list (--version-lag)
	IncludeSafeVersions bool `json:"includeSafeVersions,omitempty"` // ranked Safe-Harbour versions (--sca-autofix)
	IncludeEOL          bool `json:"includeEol,omitempty"`          // package-level EOL (--block-eol)
	IncludeMalware      bool `json:"includeMalware,omitempty"`      // malicious-package check (--block-malware)
}

type CliSCAOptionsLite struct {
	IncludeCooldown   bool `json:"includeCooldown,omitempty"`
	IncludeVersionLag bool `json:"includeVersionLag,omitempty"`
	IncludeEOL        bool `json:"includeEol,omitempty"`
	IncludeMalware    bool `json:"includeMalware,omitempty"`
}

type CliSCAReachabilityRequest struct {
	IngestionSnapshotUuid string                   `json:"ingestionSnapshotUuid"`
	Results               []CliReachabilityPayload `json:"results"`
}

type CliSCAReachabilityResponse struct {
	Persisted   int    `json:"persisted"`
	SBOMUrl     string `json:"sbomUrl,omitempty"`
	VEXUrl      string `json:"vexUrl,omitempty"`
	OpenVexUuid string `json:"openVexUuid,omitempty"`
}

type CliSCARequest struct {
	Purls    []string          `json:"purls"`
	Packages []CliPackageEntry `json:"packages,omitempty"`
	Options  CliSCAOptions     `json:"options,omitempty"`
	// IngestionSnapshotUuid is set on discovery chunks (i>0) to the snapshot UUID
	// chunk 0 returned, so the server appends each chunk's findings under one run
	// instead of persisting only chunk 0's. Empty on chunk 0.
	IngestionSnapshotUuid string `json:"ingestionSnapshotUuid,omitempty"`
}

type CliSCAResponse struct {
	CycloneDX         map[string]any        `json:"cyclonedx"`
	Reachability      []CliReachabilityHit  `json:"reachability"`
	Stats             CliSCAStats           `json:"stats"`
	IngestionSnapshot *CliIngestionSnapshot `json:"ingestionSnapshot,omitempty"`
	Findings          []CliFindingResult    `json:"findings,omitempty"`
	PackageInsights   []CliPackageInsight   `json:"packageInsights,omitempty"`
}

type CliSCAStats struct {
	PurlsRequested       int `json:"purlsRequested"`
	PurlsResolved        int `json:"purlsResolved"`
	VulnerabilitiesFound int `json:"vulnerabilitiesFound"`
	ReachabilityQueries  int `json:"reachabilityQueries"`
}

type CliSafeHarbourLite struct {
	Recommendation *CliSafeHarbourRecommendation `json:"recommendation,omitempty"`
}

type CliSafeHarbourRecommendation struct {
	Version string `json:"version,omitempty"`
	Reason  string `json:"reason,omitempty"`
}

type CliSafeHarbourSummary struct {
	RecommendedVersions []string                      `json:"recommendedVersions,omitempty"`
	HighestScore        float64                       `json:"highestScore,omitempty"`
	Recommendation      *CliSafeHarbourRecommendation `json:"recommendation,omitempty"`
}

type CliSafeHarbourVersion struct {
	Version            string   `json:"version,omitempty"`
	VulnerabilityCount int      `json:"vulnerabilityCount,omitempty"`
	SafeHarbourScore   float64  `json:"safeHarbourScore,omitempty"`
	IsMalware          bool     `json:"isMalware,omitempty"`
	ExploitCount       int      `json:"exploitCount,omitempty"`
	CveIds             []string `json:"cveIds,omitempty"`
}

type CliScanRequest struct {
	CliSCARequest
	ContainerImages []string `json:"containerImages,omitempty"`
	IaCFrameworks   []string `json:"iacFrameworks,omitempty"`
	Languages       []string `json:"languages,omitempty"`
}

type CliTransitiveFix struct {
	Method       string `json:"method"`
	ParentName   string `json:"parentName"`
	ParentTarget string `json:"parentTarget"`
	ChildName    string `json:"childName"`
	ChildTarget  string `json:"childTarget"`
	Ecosystem    string `json:"ecosystem"`
	Reason       string `json:"reason"`
}

type CliTriageRequest struct {
	Severity []string `json:"severity,omitempty"`
	MinCvss  float64  `json:"minCvss,omitempty"`
	MinEpss  float64  `json:"minEpss,omitempty"`
	InKev    *bool    `json:"inKev,omitempty"`
	Since    string   `json:"since,omitempty"`
	Limit    int      `json:"limit,omitempty"`
	Offset   int      `json:"offset,omitempty"`
}

type CliVersionStamp struct {
	Version     string `json:"version"`
	PublishedAt *int64 `json:"publishedAt,omitempty"`
}

type CliVersionStampLite struct {
	Version     string `json:"version"`
	PublishedAt *int64 `json:"publishedAt,omitempty"`
}

type CliVulnRequest struct {
	Identifier string `json:"identifier"`
}

type Client struct {
	BaseURL         string
	APIVersion      string
	OrgID           string
	SecretKey       string
	AuthMethod      auth.AuthMethod
	APIKey          string // hex digest for Direct API Key auth
	Token           string // Authentik API token for Bearer auth
	HTTPClient      *http.Client
	LastRateLimit   *RateLimitInfo
	LastCacheStatus string // "HIT", "MISS", "LOCAL", "REVALIDATED", or "" if no X-Cache header

	Cache         *cache.DiskCache
	NoCache       bool
	RefreshCache  bool
	FallbackCreds *auth.Credentials // community creds to use when quota exhausted; nil = disabled
	UsingFallback bool              // true after client switched to fallback (readable by cmd layer)
	// contains filtered or unexported fields
}

type CritLookupExploits struct {
	Count   int      `json:"count"`
	Sources []string `json:"sources,omitempty"`
}

type CritLookupKev struct {
	DateAdded                  string `json:"dateAdded"`
	DueDate                    string `json:"dueDate,omitempty"`
	KnownRansomwareCampaignUse string `json:"knownRansomwareCampaignUse,omitempty"`
	RequiredAction             string `json:"requiredAction,omitempty"`
}

type CritLookupMatch struct {
	Crit           CritRecord            `json:"crit"`
	VulnID         string                `json:"vuln_id"`
	Aliases        []string              `json:"aliases,omitempty"`
	Kev            *CritLookupKev        `json:"kev,omitempty"`
	ExploitSummary *CritLookupExploits   `json:"exploit_summary,omitempty"`
	SnortRules     []CritLookupSnortRule `json:"snort_rules,omitempty"`
}

type CritLookupResponse struct {
	Count   int               `json:"count"`
	Matches []CritLookupMatch `json:"matches"`
}

type CritLookupSnortRule struct {
	SnortID           string `json:"snortId"`
	Msg               string `json:"msg"`
	SignatureSeverity string `json:"signatureSeverity,omitempty"`
	RawText           string `json:"rawText,omitempty"`
}

type CritRecord struct {
	VectorString         string `json:"vectorString"`
	VulnID               string `json:"vuln_id"`
	Provider             string `json:"provider"`
	Service              string `json:"service"`
	ResourceType         string `json:"resource_type"`
	VexStatus            string `json:"vex_status"`
	SharedResponsibility string `json:"shared_responsibility"`
}

type EOLProductDetail struct {
	Name     string   `json:"name"`
	Label    string   `json:"label"`
	Category string   `json:"category"`
	Tags     []string `json:"tags"`
}

type EOLProductResponse struct {
	Timestamp int64              `json:"timestamp"`
	Product   EOLProductDetail   `json:"product"`
	Releases  []EOLReleaseDetail `json:"releases"`
}

type EOLReleaseDetail struct {
	Name             string  `json:"name"`
	Codename         *string `json:"codename,omitempty"`
	Label            string  `json:"label"`
	ReleaseDate      *string `json:"releaseDate,omitempty"`
	IsLts            bool    `json:"isLts"`
	LtsFrom          *string `json:"ltsFrom,omitempty"`
	IsEoas           bool    `json:"isEoas"`
	EoasFrom         *string `json:"eoasFrom,omitempty"`
	IsEol            bool    `json:"isEol"`
	EolFrom          *string `json:"eolFrom,omitempty"`
	IsEoes           *bool   `json:"isEoes,omitempty"`
	EoesFrom         *string `json:"eoesFrom,omitempty"`
	IsDiscontinued   *bool   `json:"isDiscontinued,omitempty"`
	DiscontinuedFrom *string `json:"discontinuedFrom,omitempty"`
	IsMaintained     bool    `json:"isMaintained"`
	LatestVersion    *string `json:"latestVersion,omitempty"`
	LatestDate       *string `json:"latestDate,omitempty"`
}

type EOLReleaseResponse struct {
	Timestamp   int64            `json:"timestamp"`
	ProductName string           `json:"productName"`
	Release     EOLReleaseDetail `json:"release"`
}

type Ecosystem struct {
	Name  string `json:"name"`
	Count int    `json:"count"`
}

type EcosystemsResponse struct {
	Timestamp  int64       `json:"timestamp"`
	Ecosystems []Ecosystem `json:"ecosystems"`
}

type ErrorResponse struct {
	Success bool   `json:"success"`
	Error   string `json:"error"`
	Details string `json:"details,omitempty"`
}

type ExploitSearchParams struct {
	Limit     int
	Offset    int
	Ecosystem string
	Source    string
	Severity  string
	Sort      string
	Query     string
	InKev     string
	MinEpss   string
}

type GCVEIssuanceIdentifier struct {
	GcveID        string `json:"gcveId"`
	CveID         string `json:"cveId"`
	DatePublished int64  `json:"datePublished"`
}

type GCVEIssuancesResponse struct {
	Timestamp   int64                    `json:"timestamp"`
	Year        int                      `json:"year"`
	Month       int                      `json:"month"`
	Total       int                      `json:"total"`
	Limit       int                      `json:"limit"`
	Offset      int                      `json:"offset"`
	HasMore     bool                     `json:"hasMore"`
	Identifiers []GCVEIssuanceIdentifier `json:"identifiers"`
}

type IOCSearchParams struct {
	CveIDs     []string
	Countries  []string
	ASNs       []int
	Behavior   string
	Reputation string
	Since      string
	Limit      int
	Offset     int
	Format     string // json | stix
}

type IdentifiersMonthResponse struct {
	Timestamp   int64    `json:"timestamp"`
	Year        int      `json:"year"`
	Month       int      `json:"month"`
	Total       int      `json:"total"`
	Limit       int      `json:"limit"`
	Offset      int      `json:"offset"`
	HasMore     bool     `json:"hasMore"`
	Identifiers []string `json:"identifiers"`
}

type IdentifiersSearchResponse struct {
	Timestamp   int64    `json:"timestamp"`
	Prefix      string   `json:"prefix"`
	Total       int      `json:"total"`
	Limit       int      `json:"limit"`
	Offset      int      `json:"offset"`
	HasMore     bool     `json:"hasMore"`
	Identifiers []string `json:"identifiers"`
}

type KevSearchParams struct {
	CveIDs    []string
	Sources   []string // CISA | vulnetix | enisa | vulncheck (repeat for OR; default = all four)
	Reason    string
	Since     string
	Until     string
	DueBefore string
	DueAfter  string
	Vendor    string
	Product   string
	Sort      string // due | added | cve
	Limit     int
	Offset    int
}

type NotFoundError struct {
	Message string
}

type ProductVersionsResponse struct {
	PackageName string          `json:"packageName"`
	Timestamp   int64           `json:"timestamp"`
	Total       int             `json:"total"`
	Limit       int             `json:"limit"`
	Offset      int             `json:"offset"`
	HasMore     bool            `json:"hasMore"`
	Versions    []VersionRecord `json:"versions"`
}

type RateLimitInfo struct {
	DayLimit   int    // RateLimit-DayLimit  (0 = unlimited)
	Remaining  int    // RateLimit-Remaining (-1 = unlimited)
	Reset      int    // RateLimit-Reset     (Unix epoch seconds)
	Plan       string // X-VDB-Plan          (community/pro/teams/enterprise)
	SoftLimits bool   // X-Softlimits        (true = advisory only, never blocked)
	Present    bool
}

type SnortSearchParams struct {
	CveIDs           []string
	Sources          []string
	Techniques       []string // MITRE ATT&CK T-id (any of)
	Tactics          []string // MITRE ATT&CK TA-id (any of)
	Classtype        string
	Severity         string
	Protocol         string
	Action           string
	DstPort          string
	SrcPort          string
	Disabled         string // "true" / "false" / ""
	Q                string // free-text on msg + rawText
	AffectedProducts []string
	Tags             []string
	Since            string // RFC3339
	Until            string // RFC3339
	Sort             string // recent | severity | id
	Limit            int
	Offset           int
}

type TimelineParams struct {
	Include     string // comma-separated event types to include
	Exclude     string // comma-separated event types to exclude
	Dates       string // comma-separated CVE date fields: published,modified,reserved
	ScoresLimit int    // max score-change events (default 30, max 365)
}

type TokenCache struct {
	Token     string
	ExpiresAt time.Time
}

type TokenResponse struct {
	Token string `json:"token"`
	Iss   string `json:"iss"`
	Sub   string `json:"sub"`
	Exp   int64  `json:"exp"`
}

type TreeSitterCapture struct {
	Name string `json:"name"`
	Kind string `json:"kind,omitempty"`
}

type TreeSitterFilters struct {
	Language  string `json:"language,omitempty"`
	Ecosystem string `json:"ecosystem,omitempty"`
	VulnID    string `json:"vulnId,omitempty"`
}

type TreeSitterPredicate struct {
	Kind    string   `json:"kind"`
	Name    string   `json:"name"`
	Negated bool     `json:"negated"`
	Args    []string `json:"args"`
}

type TreeSitterQuery struct {
	VulnID      string                `json:"vulnId,omitempty"`
	Source      string                `json:"source,omitempty"`
	Ecosystems  []string              `json:"ecosystems,omitempty"`
	Language    string                `json:"language"`
	Name        string                `json:"name"`
	Description string                `json:"description,omitempty"`
	QueryText   string                `json:"queryText"`
	QueryHash   string                `json:"queryHash,omitempty"`
	DerivedBy   string                `json:"derivedBy,omitempty"`
	CreatedAt   int64                 `json:"createdAt,omitempty"`
	Captures    []TreeSitterCapture   `json:"captures,omitempty"`
	Predicates  []TreeSitterPredicate `json:"predicates,omitempty"`
	Directives  []TreeSitterPredicate `json:"directives,omitempty"`
}

type TreeSitterResponse struct {
	Identifier string            `json:"identifier"`
	Filters    TreeSitterFilters `json:"filters"`
	Queries    []TreeSitterQuery `json:"queries"`
}

type TriageParams struct {
	MinEpss           *float64
	MinEpssPercentile *float64
	MinCess           *float64
	MinCvss           *float64
	Severity          string
	InKev             string // "true" / "false" / ""
	KevSources        []string
	CWEs              []string
	Vendor            string
	Product           string
	Since             string
	WindowDays        int // 0 = unset; 1..30
	Sort              string
	Limit             int
	Offset            int
}

type V2QueryParams struct {
	Ecosystem   string
	PackageName string
	Vendor      string
	Product     string
	Distro      string
	Purl        string
	Limit       int
	Offset      int
}

type V2RemediationParams struct {
	V2QueryParams
	CurrentVersion           string
	PackageManager           string
	ContainerImage           string
	OS                       string
	Registry                 string
	IncludeGuidance          bool
	IncludeVerificationSteps bool
}

type V2TimelineParams struct {
	Include     string // comma-separated event types to include
	Exclude     string // comma-separated event types to exclude
	Dates       string // comma-separated CVE date fields: published,modified,reserved
	ScoresLimit int    // max score-change events (default 30, max 365)
}

type V2TreeSitterParams struct {
	Language  string
	Ecosystem string
}

type VersionRecord struct {
	Version   string          `json:"version"`
	Ecosystem string          `json:"ecosystem"`
	Sources   []VersionSource `json:"sources"`
	CVEIDs    []string        `json:"cveIds,omitempty"`
}

type VersionSource struct {
	SourceTable string                 `json:"sourceTable"`
	SourceID    string                 `json:"sourceId"`
	Metadata    map[string]interface{} `json:"metadata,omitempty"`
}

type VexSearchParams struct {
	CveIDs   []string
	Status   string
	Supplier string
	Since    string
	Limit    int
	Offset   int
}

type VulnerabilitiesResponse struct {
	PackageName     string          `json:"packageName"`
	Timestamp       int64           `json:"timestamp"`
	TotalCVEs       int             `json:"totalCVEs"`
	Total           int             `json:"total"`
	Limit           int             `json:"limit"`
	Offset          int             `json:"offset"`
	HasMore         bool            `json:"hasMore"`
	Versions        []VersionRecord `json:"versions"`
	Vulnerabilities []VersionRecord `json:"vulnerabilities"` // alternative key used by some API paths
	RawData         interface{}     `json:"-"`               // full parsed response for fallback display
}

type VulnetixKevParams struct {
	Format            string   // "json" | "csv"
	Reasons           []string // filter by VulnetixKevReason enum values
	FilterMode        string   // "any" | "all" (default: any)
	Limit             int      // JSON pagination
	Offset            int      // JSON pagination
	IncludeReferences bool     // JSON-only; adds the `references` bucket per item
}

type YaraSearchParams struct {
	CveIDs      []string
	Sources     []string
	RuleName    string
	Tags        []string
	Imports     []string
	Author      string
	Q           string
	MatchString string
	MatchMeta   string
	Since       string
	Until       string
	Sort        string // recent | name
	Limit       int
	Offset      int
}