cmd

type AIBOMPassOptions struct {
	RootPath         string
	Depth            int
	Ignore           []string
	CatalogPath      string
	NoBuiltinCatalog bool
	// Passes selects which detection passes run; the zero value runs none, so
	// callers must be explicit.
	Passes           aibomPasses
	IncludeHome      bool
	CommitMax        int
	RespectGitignore bool
	// SpecVersion defaults to 1.7.
	SpecVersion string
	// Upload submits the AIBOM to the backend when authenticated.
	Upload bool
	GitCtx *gitctx.GitContext
}

type AIBOMPassResult struct {
	Detections  cyclonedx.AIDetections
	BOM         []byte
	SpecVersion string
}

type CBOMPassOptions struct {
	RootPath         string
	Depth            int
	Ignore           []string
	CatalogPath      string
	NoBuiltinCatalog bool
	// Passes selects which detection passes run; the zero value runs none.
	Passes           cbomPasses
	RespectGitignore bool
	// SpecVersion defaults to 1.7.
	SpecVersion string
	// Upload submits the CBOM to the backend when authenticated.
	Upload bool
	GitCtx *gitctx.GitContext
}

type CBOMPassResult struct {
	Detections  cyclonedx.CryptoDetections
	BOM         []byte
	SpecVersion string
}

type CommandManifest struct {
	Commands map[string]ManifestCommand `json:"commands"`
}

type EcoGroups struct {
	Configured []EcoStatus
	Available  []EcoStatus
}

type EcoStatus struct {
	Ecosystem pfw.Ecosystem
	Path      string
}

type ExitCodeError interface {
	error
	ExitCode() int
}

type GateBreach struct {
	Gate    string // "malware" | "exploits" | "severity" | "eol"
	Count   int
	Message string // pre-formatted, ready to print
}

type JailRunOptions struct {
	Mode string

	RootPath  string
	Repo      string
	Branch    string
	RuleUuids []string

	// KnownSnapshotUuids names scanner runs the caller just created, so a
	// scan-then-gate in one invocation is not defeated by read-replica lag.
	KnownSnapshotUuids []string

	// Artefacts
	VexPath    string
	VexFormat  string
	SarifPath  string
	WriteVex   bool
	WriteSarif bool

	// Gate behaviour
	NoFail          bool
	StalenessDays   int
	OnStale         string
	MaxLookbackDays int

	// Exempt mode
	ExemptRuleUuid         string
	ExemptReason           string
	ExemptExpires          time.Duration
	ExemptDeactivate       string
	ExemptDeactivateReason string

	BaseURL string
	Output  string
	Timeout time.Duration
	Stdout  io.Writer
	Stderr  io.Writer
}

type JailRunResult struct {
	Response  *vdb.CliJailResponse
	Exemption *vdb.CliJailExemptResponse
	Artefacts []string
	ExitCode  int
}

type JailUsageError struct {
	// contains filtered or unexported fields
}

type JailVerdictError struct {
	Verdict string
	Code    int
	Summary vdb.CliJailSummary
}

type LicensePolicyFlags struct {
	Mode      string
	AllowCSV  string
	AllowFile string
}

type LicenseRunOptions struct {
	RootPath string
	// Mode is the license.EvalConfig mode ("inclusive" or "individual"). Empty
	// defaults to inclusive.
	Mode string
	// AllowCSV / AllowFile are the two spellings of the allow list; AllowFile
	// wins when both are set.
	AllowCSV  string
	AllowFile string
	// SeverityThreshold filters findings below the given severity.
	SeverityThreshold string
	// Packages are the parsed manifest packages to analyse.
	Packages []scan.ScopedPackage
	// ManifestGroups carries the dependency graph used for introduced-via chains.
	ManifestGroups []scan.ManifestGroup
	// LicensedPackages lets a caller reuse an earlier license.DetectLicenses
	// result (the scan pipeline resolves licenses before its SCA round-trip so
	// the payload can carry them). Empty means "detect now".
	LicensedPackages []license.PackageLicense
	// Memory, when non-nil, receives this run's findings and the resolution of
	// findings that have disappeared. The caller owns saving it.
	Memory *memory.Memory
	GitCtx *gitctx.GitContext
	// Stderr receives warnings; nil means os.Stderr.
	Stderr io.Writer
}

type LicenseRunResult struct {
	Result           *license.AnalysisResult
	LicensedPackages []license.PackageLicense
	// FindingVulnerabilities are this run's open license findings as CycloneDX
	// vulnerability entries.
	FindingVulnerabilities []cdx.Vulnerability
	// VEXVulnerabilities are the resolution attestations read back from memory.
	// They are kept separate from the findings because the scan pipeline feeds
	// them through cdx.ApplyVEXAnalysis (which annotates an existing entry rather
	// than appending a twin), while the license command merges both into the BOM
	// in one call.
	VEXVulnerabilities []cdx.Vulnerability
	// StateChanges are the memory transitions this run produced (new findings,
	// resolutions). Empty when Options.Memory was nil.
	StateChanges []memory.StateChange
}

type ManifestCommand struct {
	Short      string   `json:"short"`
	Flags      []string `json:"flags"`
	Deprecated []string `json:"deprecatedFlags,omitempty"`
	Subs       []string `json:"subcommands,omitempty"`
}

type MultiPolicyBreachError struct {
	Breaches []GateBreach
}

type PolicyBreachError interface {
	error
	// contains filtered or unexported methods
}

type SeverityBreachError struct {
	// contains filtered or unexported fields
}