license

type AllowList struct {
	Licenses []string `yaml:"licenses"`
}

type AnalysisResult struct {
	Mode      string            `json:"mode"`
	Packages  []PackageLicense  `json:"packages"`
	Conflicts []LicenseConflict `json:"conflicts"`
	Findings  []Finding         `json:"findings"`
	Summary   AnalysisSummary   `json:"summary"`
}

type AnalysisSummary struct {
	TotalPackages  int              `json:"totalPackages"`
	LicenseCounts  map[string]int   `json:"licenseCounts"`
	CategoryCounts map[Category]int `json:"categoryCounts"`
	ConflictCount  int              `json:"conflictCount"`
	FindingsBySev  map[string]int   `json:"findingsBySeverity"`
	OsiApproved    int              `json:"osiApproved"`
	FsfLibre       int              `json:"fsfLibre"`
	Deprecated     int              `json:"deprecated"`
	Unknown        int              `json:"unknown"`

	// Exempted is the count an approved exception covers, and Effective is what
	// remains. The same split VEX uses for vulnerabilities, for the same
	// reason: the number to act on is not the number found.
	Exempted  int `json:"exempted"`
	Effective int `json:"effective"`
	// ExpiredExceptions counts findings whose exception has lapsed. They are
	// live findings; the count exists so a lapse is visible rather than
	// arriving as an unexplained new violation.
	ExpiredExceptions int `json:"expiredExceptions"`
}

type Applied struct {
	// Exception is the governance metadata.
	Exception Exception
	// Kind is "blanket" or "package".
	Kind string
	// Match describes what the exception was written against.
	Match string
	// Expired reports that the exception has lapsed and did NOT apply.
	Expired bool
}

type BlanketException struct {
	// License is the SPDX id. Matching is by prefix, so an exception for
	// MPL-2.0 also covers MPL-2.0-no-copyleft-exception: they are the same
	// licence with a variation nobody writes a separate exception for.
	License   string `yaml:"license" json:"license"`
	Exception `yaml:",inline" json:",inline"`
}

type Category string

type ConflictSeverity struct {
	Severity       string
	Description    string
	Recommendation string
}

type EvalConfig struct {
	Mode              string   // "inclusive" or "individual"
	AllowedLicenses   []string // SPDX IDs; empty = no allow list
	SeverityThreshold string   // "critical", "high", "medium", "low"

	// Policy is the declarative licence policy. Nil falls back to
	// DefaultPolicy(), which reproduces the severities the evaluator used
	// before policies existed — so adopting one is a deliberate change rather
	// than something that arrives with an upgrade and turns a build red.
	Policy *Policy
	// Exceptions is the approved-exception set. Nil means no exceptions.
	Exceptions *ExceptionSet
	// Project selects per-project policy overrides, from --project.
	Project string
	// Now is the clock used for exception expiry. Zero means time.Now().
	Now time.Time
}

type EvidenceStep struct {
	Rule     string `json:"rule"`
	Input    string `json:"input"`
	Expected string `json:"expected,omitempty"`
	Actual   string `json:"actual,omitempty"`
	Result   string `json:"result"` // "PASS" or "FAIL"
}

type Exception struct {
	// ID is a stable identifier for referring to this exception in a report.
	ID string `yaml:"id,omitempty" json:"id,omitempty"`
	// Reason is why the exception exists. Required: an exception nobody can
	// explain is indistinguishable from a mistake.
	Reason string `yaml:"reason" json:"reason"`
	// Scope narrows the claim, e.g. "vendored, unmodified, dynamically linked".
	Scope string `yaml:"scope,omitempty" json:"scope,omitempty"`
	// Approver is who signed it off.
	Approver string `yaml:"approver,omitempty" json:"approver,omitempty"`
	// ApprovedDate is when, as YYYY-MM-DD.
	ApprovedDate string `yaml:"approvedDate,omitempty" json:"approvedDate,omitempty"`
	// Expires is when the exception lapses, as YYYY-MM-DD. Empty never expires.
	Expires string `yaml:"expires,omitempty" json:"expires,omitempty"`
	// Projects limits the exception to named projects. Empty applies everywhere.
	Projects []string `yaml:"projects,omitempty" json:"projects,omitempty"`
}

type ExceptionSet struct {
	APIVersion string `yaml:"apiVersion" json:"apiVersion"`
	Kind       string `yaml:"kind" json:"kind"`

	// Blanket exempts a licence everywhere it appears.
	Blanket []BlanketException `yaml:"blanket,omitempty" json:"blanket,omitempty"`
	// Packages exempts a specific package, optionally under a specific licence.
	Packages []PackageException `yaml:"packages,omitempty" json:"packages,omitempty"`
}

type Finding struct {
	ID              string         `json:"id"`
	Title           string         `json:"title"`
	Description     string         `json:"description"`
	Severity        string         `json:"severity"`
	Confidence      float64        `json:"confidence"`
	Package         PackageLicense `json:"package"`
	Category        string         `json:"category"` // rule category
	Evidence        []EvidenceStep `json:"evidence"`
	IntroducedPaths [][]string     `json:"introducedPaths,omitempty"`
	PathCount       int            `json:"pathCount,omitempty"`

	// Exempted marks a finding an approved exception covers. Exempted findings
	// are retained and badged, never dropped: a violation count that fell
	// because somebody wrote an exception is a different fact from one that
	// fell because the dependency was removed, and a report that cannot tell
	// them apart is not an audit trail.
	Exempted bool `json:"exempted,omitempty"`
	// ExemptionReason is why the exception exists.
	ExemptionReason string `json:"exemptionReason,omitempty"`
	// ExemptionLabel attributes the exception — its id, approver and expiry.
	ExemptionLabel string `json:"exemptionLabel,omitempty"`
	// ExemptionExpired marks a finding whose exception has lapsed. It is NOT
	// exempted; the field exists so the report can say why an exception the
	// user wrote is no longer working.
	ExemptionExpired bool `json:"exemptionExpired,omitempty"`
}

type LicenseConflict struct {
	Type           string     `json:"type"`     // "incompatible", "copyleft-mixing", "deprecated", "version-incompatible"
	Severity       string     `json:"severity"` // critical, high, medium, low
	License1       string     `json:"license1"`
	License2       string     `json:"license2"`
	Package1       string     `json:"package1"`
	Package2       string     `json:"package2"`
	Description    string     `json:"description"`
	Recommendation string     `json:"recommendation"`
	Package1Paths  [][]string `json:"package1Paths,omitempty"`
	Package2Paths  [][]string `json:"package2Paths,omitempty"`
}

type LicenseRecord struct {
	SpdxID        string   `json:"spdxId" yaml:"spdx_id"`
	Name          string   `json:"name" yaml:"name"`
	Category      Category `json:"category" yaml:"category"`
	IsOsiApproved bool     `json:"isOsiApproved" yaml:"osi_approved"`
	IsFsfLibre    bool     `json:"isFsfLibre" yaml:"fsf_libre"`
	IsDeprecated  bool     `json:"isDeprecated" yaml:"deprecated"`
}

type PackageException struct {
	// Purl matches the package, with '*' as a wildcard segment. A glob is the
	// useful form: an organisation vendoring every hashicorp module writes
	// pkg:golang/github.com/hashicorp/* once rather than an entry per module.
	Purl string `yaml:"purl,omitempty" json:"purl,omitempty"`
	// Name matches the package name as a substring, for ecosystems where the
	// short name and the fully-qualified module path are both in use.
	Name string `yaml:"name,omitempty" json:"name,omitempty"`
	// License narrows the exception to one licence. Empty exempts the package
	// whatever licence it turns out to carry, which is a broader claim and
	// should be rarer.
	License   string `yaml:"license,omitempty" json:"license,omitempty"`
	Exception `yaml:",inline" json:",inline"`
}

type PackageLicense struct {
	PackageName     string         `json:"packageName"`
	PackageVersion  string         `json:"packageVersion"`
	Ecosystem       string         `json:"ecosystem"`
	Scope           string         `json:"scope"`
	LicenseSpdxID   string         `json:"licenseSpdxId"`
	LicenseSource   string         `json:"licenseSource"` // "manifest", "lockfile", "embedded-db"
	SourceFile      string         `json:"sourceFile"`
	IsDirect        bool           `json:"isDirect"`
	GitHubURL       string         `json:"-"` // optional: "owner/repo" from manifest, used for license resolution
	Record          *LicenseRecord `json:"record,omitempty"`
	IntroducedPaths [][]string     `json:"introducedPaths,omitempty"`
	PathCount       int            `json:"pathCount,omitempty"`
}

type Policy struct {
	APIVersion string `yaml:"apiVersion" json:"apiVersion"`
	Kind       string `yaml:"kind" json:"kind"`

	// Categories reassigns SPDX ids to categories, overriding the embedded
	// classification. An organisation's counsel may classify a licence
	// differently from the default, and that decision belongs in their policy
	// rather than in a fork of this CLI.
	Categories map[Category][]string `yaml:"categories,omitempty" json:"categories,omitempty"`

	// Severity maps a category to the severity of a finding against it.
	Severity map[Category]string `yaml:"severity,omitempty" json:"severity,omitempty"`

	// Unknown says what to do about an unresolved licence.
	Unknown UnknownHandling `yaml:"unknown,omitempty" json:"unknown,omitempty"`

	// Scopes says how each dependency scope is treated.
	Scopes map[string]ScopeHandling `yaml:"scopes,omitempty" json:"scopes,omitempty"`

	// Projects holds per-project overrides, keyed on the --project label. A
	// monorepo's payment service and its docs site have different obligations,
	// and forcing them to share one threshold means the stricter one wins
	// everywhere or the looser one wins everywhere.
	Projects map[string]ProjectPolicy `yaml:"projects,omitempty" json:"projects,omitempty"`
	// contains filtered or unexported fields
}

type ProjectPolicy struct {
	Severity map[Category]string      `yaml:"severity,omitempty" json:"severity,omitempty"`
	Unknown  UnknownHandling          `yaml:"unknown,omitempty" json:"unknown,omitempty"`
	Scopes   map[string]ScopeHandling `yaml:"scopes,omitempty" json:"scopes,omitempty"`
}

type RepoLicenseHit struct {
	SPDXID      string `json:"spdxId,omitempty"`
	Name        string `json:"name,omitempty"`
	URL         string `json:"url,omitempty"`
	Source      string `json:"source,omitempty"`          // "file:LICENSE" | "manifest:package.json"
	Acknowledge string `json:"acknowledgement,omitempty"` // "declared" | "concluded"
	Text        string `json:"text,omitempty"`            // first N bytes of license text
}

type SARIFFinding struct {
	RuleID      string
	RuleName    string
	Message     string
	Severity    string
	Level       string
	ArtifactURI string
	PackagePurl string
	Fingerprint string
	Tags        []string
}

type SARIFRule struct {
	ID       string
	Name     string
	Severity string
	Tags     []string
}

type SPDXChecksum struct {
	Algorithm     string `json:"algorithm"`
	ChecksumValue string `json:"checksumValue"`
}

type SPDXCreationInfo struct {
	Created            string   `json:"created"`
	Creators           []string `json:"creators"`
	LicenseListVersion string   `json:"licenseListVersion,omitempty"`
	Comment            string   `json:"comment,omitempty"`
}

type SPDXDocument struct {
	SPDXVersion             string                 `json:"spdxVersion"`
	DataLicense             string                 `json:"dataLicense"`
	SPDXID                  string                 `json:"SPDXID"`
	Name                    string                 `json:"name"`
	DocumentNamespace       string                 `json:"documentNamespace"`
	CreationInfo            SPDXCreationInfo       `json:"creationInfo"`
	Packages                []SPDXPackage          `json:"packages"`
	Relationships           []SPDXRelationship     `json:"relationships,omitempty"`
	ExtractedLicensingInfos []SPDXExtractedLicense `json:"extractedLicensingInfos,omitempty"`
	DocumentDescribes       []string               `json:"documentDescribes,omitempty"`
	Comment                 string                 `json:"comment,omitempty"`
}

type SPDXExternalRef struct {
	ReferenceCategory string `json:"referenceCategory"`
	ReferenceType     string `json:"referenceType"`
	ReferenceLocator  string `json:"referenceLocator"`
}

type SPDXExtractedLicense struct {
	LicenseID     string `json:"licenseId"`
	ExtractedText string `json:"extractedText"`
	Name          string `json:"name"`
}

type SPDXPackage struct {
	SPDXID           string            `json:"SPDXID"`
	Name             string            `json:"name"`
	VersionInfo      string            `json:"versionInfo,omitempty"`
	DownloadLocation string            `json:"downloadLocation"`
	LicenseConcluded string            `json:"licenseConcluded"`
	LicenseDeclared  string            `json:"licenseDeclared"`
	CopyrightText    string            `json:"copyrightText"`
	FilesAnalyzed    bool              `json:"filesAnalyzed"`
	ExternalRefs     []SPDXExternalRef `json:"externalRefs,omitempty"`

	// Read-side fields — see the SPDXDocument doc comment.
	Supplier              string         `json:"supplier,omitempty"`
	Originator            string         `json:"originator,omitempty"`
	Homepage              string         `json:"homepage,omitempty"`
	Description           string         `json:"description,omitempty"`
	Summary               string         `json:"summary,omitempty"`
	SourceInfo            string         `json:"sourceInfo,omitempty"`
	PackageFileName       string         `json:"packageFileName,omitempty"`
	PrimaryPackagePurpose string         `json:"primaryPackagePurpose,omitempty"`
	Checksums             []SPDXChecksum `json:"checksums,omitempty"`
}

type SPDXRelationship struct {
	Element        string `json:"spdxElementId"`
	RelType        string `json:"relationshipType"`
	RelatedElement string `json:"relatedSpdxElement"`
	Comment        string `json:"comment,omitempty"`
}

type ScopeHandling string

type UnknownHandling string