triage

type Alert struct {
	// Number or ID of the alert in the provider system
	Number string
	// State: "open", "dismissed", "fixed"
	State string
	// CVE identifier
	CVE string
	// Severity: "critical", "high", "medium", "low"
	Severity string
	// Package name (e.g. "lodash", "express")
	Package string
	// Current vulnerable version
	Version string
	// Ecosystem as reported by the provider (needs mapping to VDB format)
	Ecosystem string
	// Path to the manifest file containing the vulnerable dependency
	Manifest string
	// URL to the alert in the provider's UI
	URL string
	// Dismissal reason if state is "dismissed"
	DismissalReason string
	// CWE identifier if available
	CWE string
}

type CDXBOM struct {
	Vulnerabilities []CDXVuln      `json:"vulnerabilities,omitempty"`
	Components      []CDXComponent `json:"components,omitempty"`
}

type CDXComponent struct {
	Name    string `json:"name,omitempty"`
	Version string `json:"version,omitempty"`
	PURL    string `json:"purl,omitempty"`
	BOMRef  string `json:"bom-ref,omitempty"`
}

type CDXVuln struct {
	ID string `json:"id"`
}

type CWSSData struct {
	Score    float64            `json:"score"`
	Priority string             `json:"priority,omitempty"`
	Factors  map[string]float64 `json:"factors,omitempty"`
}

type EnrichedAlert struct {
	Alert       Alert           `json:"alert"`
	Remediation *map[string]any `json:"remediation,omitempty"`
	Fixes       *FixesMerged    `json:"fixes,omitempty"`
	Error       string          `json:"error,omitempty"`
}

type FetchOptions struct {
	IncludeDismissed bool
	Repo             string
}

type FixesMerged struct {
	Registry      map[string]any
	Distributions map[string]any
	Source        map[string]any
}

type GHStatus struct {
	BinaryFound   bool   `json:"binary_found"`
	BinaryPath    string `json:"binary_path,omitempty"`
	Authenticated bool   `json:"authenticated"`
	User          string `json:"user,omitempty"`
	Host          string `json:"host,omitempty"`
	TokenSource   string `json:"token_source,omitempty"`
	RepoDetected  bool   `json:"repo_detected"`
	Repo          string `json:"repo,omitempty"`
	BinaryError   string `json:"binary_error,omitempty"`
	AuthError     string `json:"auth_error,omitempty"`
}

type GitHubClient struct {
	// contains filtered or unexported fields
}

type GitHubMultiProvider struct {
	Client *GitHubClient
	Kinds  []string // subset of "dependabot", "codeql", "secrets"
}

type OpenVEXOptions struct {
	// ID is the document identifier. If empty, a URN is generated.
	ID string
	// Author is the document author.
	Author string
	// Tooling identifies the tool that generated the document.
	Tooling string
}

type Provider interface {
	// FetchAlerts retrieves vulnerability alerts from the provider.
	FetchAlerts(ctx context.Context, opts FetchOptions) ([]Alert, error)
}

type ThreatModel struct {
	Techniques         []string `json:"techniques,omitempty"`
	Tactics            []string `json:"tactics,omitempty"`
	AttackVector       string   `json:"attack_vector,omitempty"`
	AttackComplexity   string   `json:"attack_complexity,omitempty"`
	PrivilegesRequired string   `json:"privileges_required,omitempty"`
	UserInteraction    string   `json:"user_interaction,omitempty"`
	Reachability       string   `json:"reachability,omitempty"`
	Exposure           string   `json:"exposure,omitempty"`
}

type TriageFinding struct {
	CVEID          string
	Package        string
	Ecosystem      string
	InstalledVer   string
	FixedVer       string
	Status         string // not_affected | affected | fixed | under_investigation
	Justification  string // VEX justification for not_affected
	ActionResponse string // VEX action for affected
	Severity       string // critical | high | medium | low | unknown
	SafeHarbour    float64
	ThreatModel    *ThreatModel
	CWSS           *CWSSData
	Decision       *memory.Decision
	History        []memory.HistoryEntry
	Source         string // "vulnetix" | "github"
	ExploitCount   int
	InKEV          bool
}

type TriageProvider interface {
	Provider
	// TriageCVE fetches full vulnerability intelligence for a single CVE and
	// maps it to a TriageFinding (with CWSS, threat model, VEX status).
	TriageCVE(ctx context.Context, cveID string, pkgName, pkgVersion, ecosystem string, existing *memory.FindingRecord) (*TriageFinding, error)
}

type VulnetixProvider struct {
	// contains filtered or unexported fields
}