model

type Affected struct {
	Ranges            []VersionRange `json:"ranges,omitempty"`
	Versions          []string       `json:"versions,omitempty"`
	EcosystemSpecific map[string]any `json:"ecosystem_specific,omitempty"`
	DatabaseSpecific  map[string]any `json:"database_specific,omitempty"`
}

type AffectedSymbol struct {
	Symbol     string          `json:"symbol,omitempty"`
	Kind       SymbolKind      `json:"kind,omitempty"`
	Package    string          `json:"package,omitempty"`
	Module     string          `json:"module,omitempty"`
	Definition *SourcePosition `json:"definition,omitempty"`
}

type Assertions struct {
	// Description is the package's own summary of itself. SPDX
	// PackageDescription / CycloneDX component description.
	Description string `json:"description,omitempty"`
	// Homepage is the package's project page. SPDX PackageHomePage /
	// CycloneDX external reference of type website.
	Homepage string `json:"homepage,omitempty"`
	// Supplier is who distributed the package. SPDX PackageSupplier /
	// CycloneDX supplier.
	Supplier *Contact `json:"supplier,omitempty"`
	// Originator is who originally authored the package, which is often not
	// the supplier. SPDX PackageOriginator / CycloneDX author or publisher.
	Originator *Contact `json:"originator,omitempty"`
	// ExternalReferences are the references a source attached to the
	// package: advisories, repositories, package-manager coordinates. SPDX
	// externalRefs / CycloneDX externalReferences.
	ExternalReferences []ExternalReference `json:"external_references,omitempty"`
	// CPEs are the CPE identifiers a source asserted for the package.
	CPEs []string `json:"cpes,omitempty"`
	// Digests are the integrity claims a source made over the package's
	// artifact, source or metadata.
	Digests []Digest `json:"digests,omitempty"`
	// Licenses are the license claims a source made, each typed declared or
	// concluded.
	Licenses []PackageLicense `json:"licenses,omitempty"`
	// Copyright is the copyright text a source stated. Gate:
	// NormalizeCopyright -- trimmed and bounded, control characters other
	// than line breaks and tabs dropped, an over-long notice cleared rather
	// than truncated.
	Copyright string `json:"copyright,omitempty"`
}

type CVSSScore struct {
	Vector  string       `json:"vector,omitempty"`
	Score   float64      `json:"score,omitempty"`
	Version SeverityType `json:"version,omitempty"`
	Source  string       `json:"source,omitempty"`
}

type CWE struct {
	CVE    string `json:"cve,omitempty"`
	ID     string `json:"id,omitempty"`
	Source string `json:"source,omitempty"`
	Type   string `json:"type,omitempty"`
}

type CallFrame struct {
	Function string         `json:"function,omitempty"`
	Package  string         `json:"package,omitempty"`
	Receiver string         `json:"receiver,omitempty"`
	Position SourcePosition `json:"position,omitempty"`
}

type CallPath struct {
	Sink   AffectedSymbol `json:"sink"`
	Frames []CallFrame    `json:"frames,omitempty"`
}

type Contact struct {
	// Kind says whether the party is an organization or a person, or that
	// the document explicitly declined to say. Parsed by ParseContactKind;
	// an unrecognized kind is dropped to unknown, which has no valid SPDX
	// rendering and so omits the field rather than emitting a bad one.
	Kind ContactKind `json:"kind,omitempty"`
	// Name is the party's name as the source stated it, minus any email
	// address. Bounded, and rejected outright if it carries a control
	// character, which would corrupt SPDX's line-oriented tag form.
	Name string `json:"name,omitempty"`
	// URL is the party's own URL, when the source carried one. CycloneDX's
	// organizational entity has a url list; SPDX has no slot for it. Held to
	// URLFormReference and additionally refused when it carries an email
	// address, so the no-email rule above cannot be sidestepped through the
	// query or fragment. An unpublishable URL is cleared on its own; unlike
	// the name, it does not take the contact with it.
	URL string `json:"url,omitempty"`
}

type ContactKind string

type Coordinates struct {
	PURL           string         `json:"purl,omitempty"`
	Ecosystem      Ecosystem      `json:"ecosystem,omitempty"`
	PackageManager PackageManager `json:"package_manager,omitempty"`
	Type           PackageType    `json:"type,omitempty"`
	Org            string         `json:"org,omitempty"`
	Name           string         `json:"name,omitempty"`
	Version        string         `json:"version,omitempty"`
	Language       Language       `json:"language,omitempty"`
}

type DependencyDetailField string

type DependencyDetailReviewReason string

type DependencyDetailTransition struct {
	Before                 *DependencyNode         `json:"before,omitempty"`
	After                  *DependencyNode         `json:"after,omitempty"`
	ChangedFields          []DependencyDetailField `json:"changedFields,omitempty"`
	BeforeRelationship     DependencyRelationship  `json:"beforeRelationship,omitempty"`
	AfterRelationship      DependencyRelationship  `json:"afterRelationship,omitempty"`
	BeforeRegistryEligible bool                    `json:"beforeRegistryEligible"`
	AfterRegistryEligible  bool                    `json:"afterRegistryEligible"`
}

type DependencyEdge struct {
	FromID string   `json:"fromId"`
	ToID   string   `json:"toId"`
	Kind   EdgeKind `json:"kind,omitempty"`
}

type DependencyNode struct {
	Coordinates
	// Assertions are the component-level claims the detecting or ingesting
	// source made about this dependency: description, homepage, supplier,
	// originator, external references, CPEs, digests, licenses, copyright.
	// They live on the node as well as on Package because an ingested
	// document asserts them per component, before matching has produced a
	// registry package to hold them (ADR-0037); consolidation lifts them
	// into the registry package. See Assertions for the gates, applied on
	// both wire directions and again when a node seeds a package, and the
	// merge classes.
	Assertions
	Relationship DependencyRelationship
	Source       DependencySource
	Scopes       []Scope
	// SourceScope is the scope the source document asserted about this
	// component, in that document's own vocabulary -- "optional", for a
	// CycloneDX component -- when a document asserted one. It is a preserved
	// claim, never an input to filtering: Scopes is what filters read, and
	// ScopesFromCycloneDX derives it.
	//
	// The field exists because a projection cannot round-trip the word on its
	// own. A CycloneDX "optional" ingests as {development}, and projecting
	// that set alone writes "excluded" back out -- collapsing two distinct
	// source words the document had kept apart (ADR-0037). Holding the word
	// itself is what makes "optional" in, "optional" out possible;
	// CycloneDXScopeForExport is the one place that decides when the word is
	// re-emitted and when the projection is.
	//
	// Gate: NormalizeSourceScope, on both wire directions and when a
	// prototype is copied -- a single token, bounded, no control or
	// whitespace characters. Merge class: scalar, fill-gaps. Two documents
	// disagreeing about a component's scope is not resolved by picking one.
	SourceScope string
	Locations   []PackageLocation
	FoundBy     string
	// ResolvedURL is the manifest's resolution field verbatim — it may be a
	// pseudo-URL, a registry or index root, or a local path, and is never
	// published. It is raw evidence; Origins carry the validated assertions.
	ResolvedURL string
	// Origins is where this dependency was resolved from: metadata, never
	// identity (ADR-0041). Union-merged and deduplicated by normalized
	// value; the ADR-0033 publication gates are the only door in. A list
	// with more than one element is an observable fact — the shape of a
	// dependency-confusion signal — not a reason to split the node.
	Origins  []DependencyOrigin
	Metadata map[string]any
	// Matched is true when the referenced package was enriched by a matcher.
	Matched bool
	// PackageRef is the PURL of this dependency's matching artifact. It is
	// derived — seeding sets it to NodeID(), which is the same canonical
	// PURL — and retained for wire compatibility with older readers.
	PackageRef string
	// contains filtered or unexported fields
}

type DependencyOrigin struct {
	// ArtifactURL is the exact file the package was downloaded from.
	ArtifactURL string `json:"artifact_url,omitempty"`
	// Repository is the source repository the package was resolved from.
	Repository string `json:"repository,omitempty"`
	// Revision is the revision pinned in Repository, when the lockfile
	// recorded one. Never set without Repository.
	Revision string `json:"revision,omitempty"`
}

type DependencyQuery struct {
	Name string `json:"name,omitempty"`
	ID   string `json:"id,omitempty"`
}

type DependencyRelationship string

type DependencySource string

type Diff struct {
	Added       []*DependencyNode
	Removed     []*DependencyNode
	Updated     []VersionChange
	Transitions []DependencyDetailTransition
}

type Digest struct {
	Algorithm DigestAlgorithm `json:"algorithm,omitempty"`
	Value     string          `json:"value,omitempty"`
	// Subject says what the digest covers. Empty means the published artifact,
	// which is what most ecosystems record and what a consumer should assume.
	// It exists because some ecosystems record a hash that is not a hash of a
	// file: a Go module's "h1:" value is SHA-256 over a manifest of the source
	// tree's file hashes, not over the module zip, so a consumer that treats it
	// as an artifact digest and compares it against a downloaded file will
	// always find a mismatch.
	//
	// Gate: ParseDigestSubject, through Digest.Normalized. The vocabulary is
	// closed, and an unrecognized subject rejects the whole digest rather
	// than being cleared -- empty is itself a claim ("the published
	// artifact"), so treating an uninterpretable label as absent would
	// publish something the producer never said.
	//
	// Merge class: part of the digest's set identity. Two records with the
	// same algorithm and value but different subjects are distinct claims and
	// both survive a union, because they say different things about what was
	// hashed.
	Subject DigestSubject `json:"subject,omitempty"`
}

type DigestAlgorithm string

type DigestSubject string

type DocumentAssertions struct {
	// Identity is the document's own identifier: SPDX's documentNamespace, or
	// a CycloneDX BOM-Link ("urn:cdx:<serial>/<version>"). It is held to the
	// IRI rule rather than the web-URL rule, because a BOM-Link is a URN and
	// the web gate would reject the identifier a merged export links back to.
	Identity string `json:"identity,omitempty"`
	// Name is the document's stated name.
	Name string `json:"name,omitempty"`
	// DataLicense is the license of the document's own data, which SPDX
	// requires and CycloneDX does not model. Held to the same expression rule
	// as a package license, so an unparseable value is dropped rather than
	// written into a field consumers read as an SPDX expression.
	DataLicense string `json:"data_license,omitempty"`
	// Created is the document's timestamp, as the source stated it. Kept
	// verbatim: re-rendering a timestamp is a change to a claim, and the two
	// formats agree on RFC 3339 anyway.
	Created string `json:"created,omitempty"`
	// Creators are the parties credited with producing the document. Contact
	// carries no email, per ADR-0037's deferred privacy review.
	Creators []Contact `json:"creators,omitempty"`
	// Tools are the tools credited with producing the document.
	Tools []DocumentTool `json:"tools,omitempty"`
	// Comment is the document-level comment.
	Comment string `json:"comment,omitempty"`
	// Version is the document's own version number: CycloneDX's top-level
	// version, which a BOM-Link's "/<n>" tail repeats, and which SPDX 2.x
	// leaves implicit at 1. Zero means the source stated none; the default is
	// the exporting format's to apply, not this carrier's, so an entry that
	// never stated a version keeps writing the bytes it wrote before the
	// field existed.
	//
	// Gate: a positive integer, else absent. Merge class: fill-gaps, as one
	// provenance tuple with Identity and Checksum -- see
	// MergeDocumentAssertions.
	Version int `json:"version,omitempty"`
	// Checksum is a digest over the source document's original bytes,
	// computed at ingest while those bytes are in hand: it cannot be
	// recovered from the parsed model later, and an SPDX externalDocumentRef
	// is invalid without one, so a merged export that lacks it cannot name
	// its sources at all.
	//
	// Gate: Digest.Normalized, the same one a package digest passes, plus
	// the artifact subject: a digest over a source tree or a metadata record
	// is not a hash of the document's bytes, and the SPDX reference has no
	// slot to say so. Merge class: fill-gaps, as one provenance tuple with
	// Identity and Version --
	// a checksum is a claim about one document's bytes and never attaches
	// to another document's identity. See MergeDocumentAssertions.
	Checksum *Digest `json:"checksum,omitempty"`
	// Sources are the documents this one was built from, when it said so:
	// SPDX externalDocumentRefs, or CycloneDX external references of type
	// "bom". A merged export writes one link per source (ADR-0037); without
	// somewhere to read them back into, a single ingest of that export lost
	// every trace of its inputs.
	//
	// Gate: each entry passes DocumentSource.Normalized; entries with the
	// same (Identity, Version) key fold, the checksum filling a gap; the
	// list is sorted for byte-stable output and bounded by
	// maxDocumentSources, applied to the input before any work is done on
	// it. An entry naming this document itself -- the same identity and
	// the same known version exactly, per isSelfSource -- is dropped: a
	// document is not built from itself, and recording it would write a
	// cycle. Any other key of the same namespace, a prior version included,
	// is a different document and is kept, as is an unversioned entry while
	// the document's own version is still unknown.
	// Merge class: set, keyed by (Identity, Version) -- a document built
	// from a merged document inherits that document's sources beside its
	// own identity, so provenance survives more than one hop.
	Sources []DocumentSource `json:"sources,omitempty"`
	// Format is the format and specification version the source document was
	// decoded as -- the token package sbom names a decode target by, such as
	// "cyclonedx-1.6+json" or "spdx-2.3+json". It describes the source, so a
	// conversion never re-emits it: the target format's own header says what
	// the output is, and this field says what the input was.
	//
	// Gate: NormalizeDocumentFormat -- a single bounded token with no
	// whitespace or control characters, the same rule a source scope word
	// takes. Merge class: scalar, fill-gaps.
	Format string `json:"format,omitempty"`
}

type DocumentSource struct {
	// Identity is the source document's own identifier. Merge class: part
	// of the set key.
	Identity string `json:"identity,omitempty"`
	// Version is the source document's version, when the reference stated
	// it or a BOM-Link identity's tail carries it. Merge class: part of the
	// set key -- an unstated version is its own key, distinct from every
	// stated one, which for a BOM-Link cannot arise since the tail fills it.
	Version int `json:"version,omitempty"`
	// Checksum is a digest over the source document's original bytes, when
	// the reference carried one -- SPDX always does. Merge class: scalar,
	// fill-gaps within the key; the first stated digest stands.
	Checksum *Digest `json:"checksum,omitempty"`
}

type DocumentTool struct {
	// Vendor is the organization that publishes the tool. Optional.
	Vendor string `json:"vendor,omitempty"`
	// Name is the tool's name. A tool without one is not a tool.
	Name string `json:"name,omitempty"`
	// Version is the tool's version, when the document stated it.
	Version string `json:"version,omitempty"`
}

type EPSSScore struct {
	CVE        string  `json:"cve,omitempty"`
	EPSS       float64 `json:"epss"`
	Percentile float64 `json:"percentile,omitempty"`
	Date       string  `json:"date,omitempty"`
}

type Ecosystem string

type EcosystemFilter struct {
	Include []Ecosystem
	Exclude []Ecosystem
}

type EdgeKind string

type ExternalReference struct {
	// Category is SPDX's referenceCategory. Empty for a CycloneDX-sourced
	// reference, which has no such axis.
	Category ExternalReferenceCategory `json:"category,omitempty"`
	// Type is the reference type: SPDX's referenceType or CycloneDX's type.
	// The vocabulary is open -- both specifications add types, and a type
	// this build does not know still round-trips -- so it is bounded and
	// checked for shape rather than matched against a closed list.
	Type string `json:"type,omitempty"`
	// Locator is what the reference points at. Its shape is decided by
	// LocatorKindFor, not by inspecting the value: a locator that fails its
	// declared grammar is a rejected reference, not one to reclassify.
	Locator string `json:"locator,omitempty"`
	// Comment is the source document's note about this reference. SPDX has a
	// comment field; CycloneDX 1.6 has one too.
	Comment string `json:"comment,omitempty"`
	// Hashes are the reference's own integrity claims. CycloneDX carries
	// these natively; SPDX 2.3 has no slot for them, so a caller emitting
	// SPDX has nowhere to put them and omits them.
	//
	// Gate: Digest.Normalized, through mergeDigestSet. Merge class: set,
	// unioned by the digest's own identity.
	Hashes []Digest `json:"hashes,omitempty"`
}

type ExternalReferenceCategory string

type FailOnConstraint struct {
	Kind  FailOnKind
	Value string
}

type FailOnKind string

type Finding struct {
	ID           string              `json:"id"`
	Kind         FindingKind         `json:"kind"`
	Title        string              `json:"title,omitempty"`
	Severity     SeverityLevel       `json:"severity,omitempty"`
	PolicyStatus FindingPolicyStatus `json:"policy_status,omitempty"`
	Reasons      []string            `json:"reasons,omitempty"`
	Source       string              `json:"source,omitempty"`
	Auditor      string              `json:"auditor,omitempty"`
	// RuleID is the stable auditor rule that produced the finding. Unlike ID,
	// it must not contain package versions or project-specific occurrence data.
	RuleID           string    `json:"rule_id,omitempty"`
	VexStatus        VEXStatus `json:"vex_status,omitempty"`
	VEXJustification string    `json:"vex_justification,omitempty"`
	// PackageRef is the PURL of the offending package in the registry.
	PackageRef string `json:"package_ref,omitempty"`
	// DependencyRefs are the dependency node IDs that introduced the package.
	DependencyRefs []string `json:"dependency_refs,omitempty"`
	// VulnerabilityID is the advisory id within the referenced package, set
	// for vulnerability-kind findings.
	VulnerabilityID string `json:"vulnerability_id,omitempty"`
	// Decision records which resolver settled PolicyStatus and why, when one
	// did. PolicyStatus is what a consumer enforces; Decision is what it can
	// show. Gate and merge class: see FindingPolicyDecision. Optional;
	// omitted by auditors that carry no resolver.
	Decision *FindingPolicyDecision `json:"decision,omitempty"`
}

type FindingKind string

type FindingPolicyDecision struct {
	Status FindingPolicyStatus `json:"status,omitempty"`
	Source string              `json:"source,omitempty"`
	Reason string              `json:"reason,omitempty"`
}

type FindingPolicyResolver interface {
	ResolveFindingPolicy(context.Context, Finding, *PackageRegistry) (FindingPolicyDecision, bool)
}

type FindingPolicyStatus string

type FixAvailable struct {
	Version string           `json:"version,omitempty"`
	Date    string           `json:"date,omitempty"`
	Kind    FixAvailableKind `json:"kind,omitempty"`
}

type FixAvailableKind string

type FixState string

type Graph struct {
	// contains filtered or unexported fields
}

type GraphContainer struct {
	Entries []GraphEntry `json:"entries,omitempty"`
}

type GraphEntry struct {
	Graph    *Graph           `json:"graph,omitempty"`
	Manifest ManifestMetadata `json:"manifest"`
	Packages []*Package       `json:"packages,omitempty"`
	// Document carries the claims the source SBOM made about itself, when
	// this entry came from one. It lives here rather than on the scan because
	// an entry is what a document maps to: a scan that read three SBOMs read
	// three sets of these, and collapsing them loses which claim came from
	// where -- which is what a merged export links back to.
	Document *DocumentAssertions `json:"document,omitempty"`
}

type GraphNode interface {
	// NodeID returns the node's published graph ID: its identity.
	NodeID() string
	// Kind returns which member of the union this node is.
	Kind() NodeKind
	// NodeLocations returns the file locations that witnessed this node.
	NodeLocations() []PackageLocation
	// NodeWarnings returns the constructor-recorded recoverable conditions.
	NodeWarnings() []NodeWarning
	// CloneNode returns a deep copy of the node.
	CloneNode() GraphNode
	// contains filtered or unexported methods
}

type ImpactAnalysisJustification string

type ImpactAnalysisResponse string

type ImpactAnalysisState string

type KnownExploited struct {
	CVE                        string   `json:"cve,omitempty"`
	VendorProject              string   `json:"vendor_project,omitempty"`
	Product                    string   `json:"product,omitempty"`
	DateAdded                  string   `json:"date_added,omitempty"`
	RequiredAction             string   `json:"required_action,omitempty"`
	DueDate                    string   `json:"due_date,omitempty"`
	KnownRansomwareCampaignUse string   `json:"known_ransomware_campaign_use,omitempty"`
	Notes                      string   `json:"notes,omitempty"`
	URLs                       []string `json:"urls,omitempty"`
	CWEs                       []string `json:"cwes,omitempty"`
}

type Language string

type LicenseType string

type LocatorKind string

type ManifestKind string

type ManifestMetadata struct {
	Path       string              `json:"path,omitempty"`
	Kind       ManifestKind        `json:"kind,omitempty"`
	Resolution *ResolutionMetadata `json:"resolution,omitempty"`
}

type ManifestNode struct {
	// Path is the canonical repository-relative path (identity).
	Path string
	// FileKind classifies the manifest file, reusing the ManifestMetadata
	// vocabulary.
	FileKind ManifestKind
	// Metadata is the free-form escape hatch shared by all node kinds.
	Metadata map[string]any
	// contains filtered or unexported fields
}

type ModuleNode struct {
	Coordinates
	// DeclaringManifestPath is the canonical repository-relative path of
	// the manifest that declares this module — always part of the identity.
	DeclaringManifestPath string
	// Locations are the file locations that witnessed the module.
	Locations []PackageLocation
	// Metadata is the free-form escape hatch shared by all node kinds.
	Metadata map[string]any
	// contains filtered or unexported fields
}

type NPMPackageMetadata struct {
	Bundled                  bool              `json:"bundled,omitempty"`
	Extraneous               bool              `json:"extraneous,omitempty"`
	HasInstallScript         bool              `json:"hasInstallScript,omitempty"`
	PeerDependencies         map[string]string `json:"peerDependencies,omitempty"`
	OptionalPeerDependencies []string          `json:"optionalPeerDependencies,omitempty"`
	Engines                  map[string]string `json:"engines,omitempty"`
}

type NodeKind string

type NodeWarning struct {
	Code    NodeWarningCode
	Message string
}

type NodeWarningCode string

type Package struct {
	Coordinates
	// Assertions are the component-level claims sources made about the
	// package, seeded from the dependency node that matched it and enriched
	// by matchers. See Assertions for the gates and merge classes.
	Assertions
	// ID is the package registry identifier. It may be a database ID, PURL, or
	// another stable key chosen by the package registry.
	ID string `json:"id,omitempty"`
	// ResolvedURL is detection-time evidence carried onto the registry package
	// for matchers (repository resolution reads it). It is raw and never
	// published; the dependency's validated Origin stays on the graph node.
	ResolvedURL string `json:"resolved_url,omitempty"`
	// DetectedOrigins carries the graph node's vetted ADR-0033 origins onto
	// the seeded registry package, so matchers that resolved repositories
	// from the (now identity-stripped) URL-valued purl qualifiers receive
	// the relocated signal. Additive and optional; every element passes the
	// origin codecs' validation. Merge class: union by normalized value.
	DetectedOrigins []DependencyOrigin `json:"detected_origins,omitempty"`

	Vulnerabilities []Vulnerability      `json:"vulnerabilities,omitempty"`
	Attestations    []PackageAttestation `json:"attestations,omitempty"`
	Scorecard       *PackageScorecard    `json:"scorecard,omitempty"`
	EOL             *PackageEOL          `json:"eol,omitempty"`
	Remediation     *PackageRemediation  `json:"remediation,omitempty"`

	// Matched indicates that this package was successfully matched by one or
	// more external enrichment sources.
	Matched bool `json:"matched,omitempty"`

	// Metadata holds per-ecosystem extensible data.
	Metadata map[string]any `json:"metadata,omitempty"`
}

type PackageAttestation struct {
	// PredicateType identifies what the statement asserts, using the in-toto
	// predicate vocabulary (for example "https://slsa.dev/provenance/v1").
	PredicateType string `json:"predicate_type,omitempty"`
	// Source names the component or service that attached the statement, in
	// the same style as PackageScorecard.Source.
	Source string `json:"source,omitempty"`
	// URL is where the statement can be fetched.
	URL string `json:"url,omitempty"`
	// Digest identifies the statement itself, so two fetches of one URL can be
	// told apart.
	Digest *Digest `json:"digest,omitempty"`
	// Issuer is the identity that signed the statement -- an OIDC identity, a
	// key id, or a registry account -- as reported by whatever verified it.
	Issuer string `json:"issuer,omitempty"`
	// Verified records that the component attaching this statement checked its
	// signature. False means the statement was found but not verified, which is
	// weaker evidence rather than evidence of tampering; consumers must not
	// present an unverified statement as proof of provenance.
	Verified bool `json:"verified,omitempty"`
}

type PackageEOL struct {
	Source        string `json:"source,omitempty"`
	Cycle         string `json:"cycle,omitempty"`
	EOL           bool   `json:"eol,omitempty"`
	EOLDate       string `json:"eol_date,omitempty"`
	LatestVersion string `json:"latest_version,omitempty"`
	ReleaseDate   string `json:"release_date,omitempty"`
	Supported     bool   `json:"supported,omitempty"`
}

type PackageLicense struct {
	// Value is the license as the source stated it, unmodified.
	Value string `json:"value,omitempty"`
	// SPDXExpression is the validated SPDX expression form, when the value
	// has one. For a license that is not on the SPDX list, this is a minted
	// LicenseRef-* identifier whose text is carried in ExtractedText.
	SPDXExpression string `json:"spdx_expression,omitempty"`
	// Type is what kind of claim this is: declared by the package, or
	// concluded by an analysis. See LicenseType.
	Type LicenseType `json:"type,omitempty"`
	// Source names the component that supplied the claim -- a matcher name
	// such as "external-depsdev". It answers "who says so", which Type does
	// not: Type is a closed two-member vocabulary about the kind of claim,
	// and the two questions are independent. A deps.dev license is declared
	// *and* sourced from deps.dev.
	//
	// They were briefly the same field, which is how this one came to exist.
	// matcherkit.NormalizeLicenseSet wrote its matcher name into Type, so
	// once Type became a closed vocabulary the gate dropped the value --
	// silently emptying the "licenses[].source" field the CLI documents and
	// publishes. Two independent facts sharing one field is what made that
	// possible.
	//
	// Gate: PackageLicense.Normalized -- held to the component-name rule,
	// not a token rule. A component descriptor requires only a non-blank
	// name, so "My Matcher" and a name over 64 bytes are both valid
	// components; gating this as a single short token would silently erase
	// the source of a legitimately named matcher. What is enforced is what
	// publication actually needs: valid UTF-8, no control characters, and a
	// bound.
	// Merge class: scalar, fill-gaps *within* a claim. Source is deliberately
	// not part of the merge identity -- two matchers reporting one license
	// stay one claim -- so the witness that carries a source supplies it to
	// the one that does not, whichever arrived first.
	Source string `json:"source,omitempty"`
	// Name is the human-readable license name for a LicenseRef-* identifier.
	// SPDX's hasExtractedLicensingInfos carries one, and a reader given only
	// "LicenseRef-bomly-3f2a..." has nothing to go on.
	//
	// Gate: PackageLicense.Normalized (trimmed; cleared with the expression
	// when a reference cannot be published). Merge class: scalar, fill-gaps
	// *within* a claim -- Name is deliberately not part of the merge
	// identity, so two records naming one license stay one claim and the
	// witness that carries a name supplies it to the one that does not.
	Name string `json:"name,omitempty"`
	// ExtractedText is the original license text a LicenseRef-* identifier
	// names. Both formats require the text to accompany the reference -- an
	// SPDX document whose expression cites a LicenseRef without a matching
	// hasExtractedLicensingInfos entry is invalid -- so the pair travels
	// together on one record rather than in a side table that a merge or a
	// projection could separate it from (bomly-cli issue #410).
	//
	// The text is authoritative and the reference is derived from it, per
	// spdxkit.MintLicenseRef. Normalized re-mints rather than trusting a
	// reference that disagrees with its text.
	//
	// Gate: PackageLicense.Normalized -- bounded, and blank text is cleared
	// (it would otherwise mint the reference empty text mints, so every
	// package with a blank license file would share one citation).
	//
	// Merge class: set member, and part of the merge identity -- by what the
	// text mints rather than by its bytes, since whitespace-only differences
	// name one license. Two claims whose texts genuinely differ are both
	// kept, and if they arrived under one reference the later is re-minted so
	// the set never leaves one identifier naming two licenses.
	ExtractedText string `json:"extracted_text,omitempty"`
}

type PackageLocation struct {
	RealPath   string `json:"real_path,omitempty"`
	AccessPath string `json:"access_path,omitempty"`
	// Position optionally points at the exact line / column in RealPath where
	// the package is declared. nil when unknown.
	Position *SourcePosition `json:"position,omitempty"`

	// ModuleRoot is the module whose resolution produced this site: a
	// workspace member's directory, a Go main module, a Maven reactor
	// project. Empty when the producer did not attribute it.
	//
	// It is what makes the fields below answerable. "Is this package a direct
	// runtime dependency?" has no single answer for a workspace -- it can be
	// direct-in-development in one module and transitive-at-runtime in
	// another -- and a question with two answers can only be asked per module
	// root.
	ModuleRoot string `json:"module_root,omitempty"`
	// Scopes are the scopes this particular site was reached under, as
	// opposed to the union across every site, which is what the node carries.
	Scopes []Scope `json:"scopes,omitempty"`
	// Relationship is whether this site was declared directly by its module
	// root or reached through another dependency. Same reasoning as Scopes:
	// the node-level value is a union and cannot distinguish the sites.
	Relationship DependencyRelationship `json:"relationship,omitempty"`
}

type PackageManager string

type PackageNodeIndex map[string][]*DependencyNode

type PackageRegistry struct {
	// contains filtered or unexported fields
}

type PackageRemediation struct {
	Status             PackageRemediationStatus       `json:"status"`
	RecommendedVersion string                         `json:"recommended_version,omitempty"`
	Suggestions        []PackageRemediationSuggestion `json:"suggestions,omitempty"`
}

type PackageRemediationStatus string

type PackageRemediationSuggestion struct {
	AffectedDependencyRefs       []string          `json:"affected_dependency_refs"`
	SuggestedActionDependencyRef string            `json:"suggested_action_dependency_ref,omitempty"`
	ManifestPath                 string            `json:"manifest_path,omitempty"`
	Action                       RemediationAction `json:"action"`
	OverrideAdvice               string            `json:"override_advice,omitempty"`
}

type PackageScorecard struct {
	// Source identifies where the data came from (e.g. "api.scorecard.dev").
	Source string `json:"source,omitempty"`
	// Repository is the canonical repo identifier scored, e.g.
	// "github.com/kubernetes/kubernetes".
	Repository string `json:"repository,omitempty"`
	// CommitSHA is the repo commit the run scored.
	CommitSHA string `json:"commitSha,omitempty"`
	// ScorecardVersion is the version of the Scorecard tool that produced
	// the run.
	ScorecardVersion string `json:"scorecardVersion,omitempty"`
	// RunDate is when the run was performed.
	RunDate time.Time `json:"runDate,omitempty"`
	// AggregateScore is the overall Scorecard aggregate, 0.0–10.0.
	// A negative value (typically -1) indicates "unscored".
	AggregateScore float64 `json:"aggregateScore"`
	// Checks holds per-check results in the order returned by Scorecard.
	Checks []PackageScorecardCheck `json:"checks,omitempty"`
}

type PackageScorecardCheck struct {
	// Name is the Scorecard check name, e.g. "Branch-Protection".
	Name string `json:"name"`
	// Score is 0–10, or -1 when the check is inconclusive.
	Score int `json:"score"`
	// Reason is the short summary Scorecard emits for the check.
	Reason string `json:"reason,omitempty"`
	// Documentation links to the canonical documentation page for the check.
	Documentation string `json:"documentation,omitempty"`
}

type PackageType string

type Path struct {
	Nodes   []GraphNode
	Cyclic  bool
	CycleTo string
}

type RangeEvent struct {
	Introduced   string `json:"introduced,omitempty"`
	Fixed        string `json:"fixed,omitempty"`
	LastAffected string `json:"last_affected,omitempty"`
	Limit        string `json:"limit,omitempty"`
}

type Reachability struct {
	Status                 ReachabilityStatus     `json:"status"`
	Tier                   ReachabilityTier       `json:"tier,omitempty"`
	Analyzer               string                 `json:"analyzer,omitempty"`
	Reason                 string                 `json:"reason,omitempty"`
	Symbols                []AffectedSymbol       `json:"symbols,omitempty"`
	CallPaths              []CallPath             `json:"call_paths,omitempty"`
	Hops                   *int                   `json:"hops,omitempty"`
	Confidence             ReachabilityConfidence `json:"confidence,omitempty"`
	DynamicImportsDetected bool                   `json:"dynamic_imports_detected,omitempty"`
	AnalyzedAt             string                 `json:"analyzed_at,omitempty"`

	// Evidence is the per-module-root findings this annotation summarizes.
	// Empty when the analyzer made a single whole-scan claim, which is what
	// every analyzer emitted before the field existed -- so the annotation
	// stays the record when there is no evidence, and becomes derived from it
	// when there is. DeriveReachability builds the summary.
	Evidence []ReachabilityEvidence `json:"evidence,omitempty"`
}

type ReachabilityConfidence string

type ReachabilityEvidence struct {
	// ModuleRoot is the module this finding is about. Empty means the
	// analyzer did not attribute it, which is a whole-scan claim.
	ModuleRoot string `json:"module_root,omitempty"`
	// DependencyRefs optionally names the exact occurrence nodes the analyzer
	// could attribute the finding to, by node ID. Empty means the analyzer
	// could not narrow it below the module root, which is the common case --
	// so a consumer must treat it as "not stated", never as "no occurrence".
	DependencyRefs []string `json:"dependency_refs,omitempty"`

	Status                 ReachabilityStatus     `json:"status"`
	Tier                   ReachabilityTier       `json:"tier,omitempty"`
	Analyzer               string                 `json:"analyzer,omitempty"`
	Reason                 string                 `json:"reason,omitempty"`
	Symbols                []AffectedSymbol       `json:"symbols,omitempty"`
	CallPaths              []CallPath             `json:"call_paths,omitempty"`
	Hops                   *int                   `json:"hops,omitempty"`
	Confidence             ReachabilityConfidence `json:"confidence,omitempty"`
	DynamicImportsDetected bool                   `json:"dynamic_imports_detected,omitempty"`
	AnalyzedAt             string                 `json:"analyzed_at,omitempty"`
}

type ReachabilityStatus string

type ReachabilityTier string

type Reference struct {
	URL  string        `json:"url,omitempty"`
	Type ReferenceType `json:"type,omitempty"`
}

type ReferenceType string

type RemediationAction string

type ResolutionFallback struct {
	From   string `json:"from"`
	Reason string `json:"reason,omitempty"`
}

type ResolutionMetadata struct {
	Method            ResolutionMethod `json:"method,omitempty"`
	InstallExecuted   bool             `json:"install_executed"`
	InstallCommand    []string         `json:"install_command,omitempty"`
	InstallWorkingDir string           `json:"install_working_dir,omitempty"`
	// Fallback records that a fallback detector produced this graph after the
	// planned primary detector failed (not routine applicability hand-off).
	Fallback *ResolutionFallback `json:"fallback,omitempty"`
}

type ResolutionMethod string

type RiskBand string

type RiskScore struct {
	PackageRef string         `json:"package_ref,omitempty"`
	Score      int            `json:"score"`
	Band       RiskBand       `json:"band,omitempty"`
	Signals    map[string]any `json:"signals,omitempty"`
}

type RootAttribution int

type RootAttributor struct {
	// contains filtered or unexported fields
}

type Scope string

type ScopeFilterReport struct {
	// Unasserted are the IDs of the dependency nodes a runtime view kept
	// because their scope set named nothing this build can read, sorted and
	// deduplicated. Empty for every other view, and for a runtime view over
	// a graph whose dependencies all stated a scope.
	Unasserted []string
}

type ScopeSetDecoding struct {
	// Scopes are the recognized scopes, deduplicated and sorted, so
	// re-encoding them gives stable bytes.
	Scopes []Scope
	// Unknown are the tokens this build does not recognize, lowercased the
	// way ParseScope reads a token, in the order written, deduplicated.
	// Empty when every token was read. Each has the shape of a scope token
	// -- see isScopeTokenShaped -- because anything else is not a scope a
	// newer build might have written; it is a malformed carrier, and that
	// is an error rather than an entry here.
	Unknown []string
}

type Severity struct {
	// Type is the OSV severity type, e.g. "CVSS_V3", "CVSS_V4".
	Type SeverityType `json:"type,omitempty"`
	// Score is the vector string or numeric score for Type.
	Score string `json:"score,omitempty"`
}

type SeverityLevel string

type SeverityType string

type SourcePosition struct {
	File    string `json:"file,omitempty"`
	Line    int    `json:"line,omitempty"`
	Column  int    `json:"column,omitempty"`
	EndLine int    `json:"end_line,omitempty"`
}

type SymbolKind string

type URLForm int

type Usage struct {
	// ModuleRoot is the module this usage belongs to.
	ModuleRoot string
	// Location is the site itself.
	Location PackageLocation
	// Evidence is the reachability finding for this module root, or nil when
	// there is none.
	Evidence *ReachabilityEvidence
}

type UsageFilter struct {
	// Scope, when set, requires the usage's site to match it under
	// ScopeSetMatches -- so a runtime filter also keeps a site that asserted
	// no scope, since absence is not a statement that the site is outside
	// what ships. A site that has not migrated to per-site attribution
	// carries no scopes at all, which is exactly that case.
	Scope Scope
	// Relationship, when set, requires the site to have it.
	Relationship DependencyRelationship
	// Reachable, when true, requires reachability evidence for the usage's
	// module root that says reachable.
	Reachable bool
}

type VEXStatus string

type VersionChange struct {
	Before *DependencyNode
	After  *DependencyNode
}

type VersionRange struct {
	// Type is the OSV range type: "SEMVER", "ECOSYSTEM", or "GIT".
	Type   VersionRangeType `json:"type,omitempty"`
	Repo   string           `json:"repo,omitempty"`
	Events []RangeEvent     `json:"events,omitempty"`
}

type VersionRangeType string

type Vulnerability struct {
	// --- OSV-aligned core ---
	ID               string         `json:"id"`
	Aliases          []string       `json:"aliases,omitempty"`
	Related          []string       `json:"related,omitempty"`
	Summary          string         `json:"summary,omitempty"`
	Details          string         `json:"details,omitempty"`
	Severity         []Severity     `json:"severity,omitempty"`
	Affected         []Affected     `json:"affected,omitempty"`
	References       []Reference    `json:"references,omitempty"`
	Published        string         `json:"published,omitempty"`
	Modified         string         `json:"modified,omitempty"`
	Withdrawn        string         `json:"withdrawn,omitempty"`
	DatabaseSpecific map[string]any `json:"database_specific,omitempty"`

	// --- Bomly enrichment extensions ---
	Source               string           `json:"source,omitempty"`
	DataSource           string           `json:"data_source,omitempty"`
	Namespace            string           `json:"namespace,omitempty"`
	Title                string           `json:"title,omitempty"`
	Reasons              []string         `json:"reasons,omitempty"`
	ParsedSeverity       SeverityLevel    `json:"parsed_severity,omitempty"`
	SeveritySource       string           `json:"severity_source,omitempty"`
	CVSS                 []CVSSScore      `json:"cvss,omitempty"`
	EPSS                 []EPSSScore      `json:"epss,omitempty"`
	CWEs                 []CWE            `json:"cwes,omitempty"`
	KEVExploited         bool             `json:"kev_exploited,omitempty"`
	KnownExploited       []KnownExploited `json:"known_exploited,omitempty"`
	RiskScore            float64          `json:"risk_score,omitempty"`
	FixState             FixState         `json:"fix_state,omitempty"`
	FixedIn              string           `json:"fixed_in,omitempty"`
	FixedVersions        []string         `json:"fixed_versions,omitempty"`
	FixAvailable         []FixAvailable   `json:"fix_available,omitempty"`
	AffectedVersionRange string           `json:"affected_version_range,omitempty"`
	CPEs                 []string         `json:"cpes,omitempty"`
	AffectedSymbols      []AffectedSymbol `json:"affected_symbols,omitempty"`
	Reachability         *Reachability    `json:"reachability,omitempty"`
	// Analysis is the VEX impact analysis a source document attached to
	// this advisory for this package: whether it is affected, why not, and
	// what the responsible party intends to do. Preserved across ingest and
	// re-export through CycloneDX; SPDX has no slot for it. Gate and merge
	// class: see VulnerabilityAnalysis. Optional.
	Analysis *VulnerabilityAnalysis `json:"analysis,omitempty"`
	// Recommendation is the remediation guidance a source stated in its own
	// words (CycloneDX `recommendation`), kept apart from the fixed versions
	// an exporter can render advice from: a document that said "apply the
	// vendor patch" named no version, and losing the sentence would lose
	// the advice. Gate: NormalizeDescription, applied where a document is
	// read and where a package merges. Merge class: scalar, fill-gaps.
	Recommendation string `json:"recommendation,omitempty"`
}

type VulnerabilityAnalysis struct {
	State         ImpactAnalysisState         `json:"state,omitempty"`
	Justification ImpactAnalysisJustification `json:"justification,omitempty"`
	Response      []ImpactAnalysisResponse    `json:"response,omitempty"`
	// Detail is the detailed description of the impact including methods
	// used during assessment. If a vulnerability is not exploitable, this
	// field should include specific details on why the component or service
	// is not impacted by this vulnerability.
	Detail string `json:"detail,omitempty"`
	// FirstIssued is the date and time (timestamp) when the analysis was
	// first issued, as the source stated it.
	FirstIssued string `json:"first_issued,omitempty"`
	// LastUpdated is the date and time (timestamp) when the analysis was
	// last updated, as the source stated it.
	LastUpdated string `json:"last_updated,omitempty"`
}