report

type ArtifactGroup struct {
	Manager string
	Entries []string
}

type ManifestContext struct {
	Sources   []ManifestGroup
	Artifacts []ArtifactGroup
}

type ManifestEntry struct {
	Path   string
	Groups []string
}

type ManifestGroup struct {
	Manager string
	Entries []ManifestEntry
}

type PolicyFinding struct {
	// Source is the name of the policy that generated this finding.
	Source string `json:"source"`
	// Action is the policy decision type (e.g., "deny", "warn", "allow").
	Action string `json:"action"`
	// Reason explains why the policy triggered this action.
	Reason string `json:"reason,omitempty"`
	// Message provides additional context or details about the finding.
	Message string `json:"message,omitempty"`
	// Remediation suggests steps to resolve the policy violation.
	Remediation string `json:"remediation,omitempty"`
	// Status is an optional HTTP status code suggestion for proxy mode.
	Status *int `json:"status,omitempty"`
	// Code is a machine-readable identifier for the finding type.
	Code string `json:"code,omitempty"`
}

type Summary struct {
	HasVulnerabilities   bool
	Stats                vulnerabilityv1.Stats
	CriticalHighCount    int
	FixAvailableCount    int
	UnfixedCount         int
	StdlibRecommendation string
	Commands             []remediation.Command
	CommandsHeader       string
}

type Target struct {
	Repo   string `json:"repo"`
	Ref    string `json:"ref,omitempty"`
	Commit string `json:"commit,omitempty"`
}

type TriagePackageSummary struct {
	Package            string                           `json:"package"`
	Version            string                           `json:"version"`
	Severity           string                           `json:"severity"`
	SeverityType       string                           `json:"severity_type"`
	FixVersion         string                           `json:"fix_version,omitempty"`
	IsDirect           bool                             `json:"is_direct"`
	Summary            string                           `json:"summary,omitempty"`
	SampleIDs          []string                         `json:"sample_ids,omitempty"`
	AffectedImports    []vulnerabilityv1.AffectedImport `json:"affected_imports,omitempty"`
	DatabaseSpecific   map[string]string                `json:"database_specific,omitempty"`
	VulnerabilityCount int                              `json:"vulnerability_count"`
	SeverityCounts     map[string]int                   `json:"severity_counts,omitempty"`
}

type TriageReport struct {
	Target            Target                 `json:"target"`
	Stats             vulnerabilityv1.Stats  `json:"stats"`
	TopPackages       []TriagePackageSummary `json:"top_packages"`
	PackagesWithVulns int                    `json:"packages_with_vulns"`
}

type Vulnerability struct {
	ID               string                           `json:"id"`
	Aliases          []string                         `json:"aliases,omitempty"`
	Summary          string                           `json:"summary,omitempty"`
	Details          string                           `json:"details,omitempty"`
	CVE              string                           `json:"cve,omitempty"`
	Severity         string                           `json:"severity,omitempty"`
	SeverityType     string                           `json:"severity_type,omitempty"`
	Package          string                           `json:"package"`
	Version          string                           `json:"version,omitempty"`
	IsDirect         bool                             `json:"is_direct,omitempty"`
	Ecosystem        string                           `json:"ecosystem,omitempty"`
	PURL             string                           `json:"purl,omitempty"`
	Published        string                           `json:"published,omitempty"`
	Modified         string                           `json:"modified,omitempty"`
	References       []string                         `json:"references,omitempty"`
	FixedVersions    []string                         `json:"fixed_versions,omitempty"`
	Affected         bool                             `json:"affected,omitempty"`
	Locations        []string                         `json:"locations,omitempty"`
	ManifestRefs     []dependencyv1.ManifestRef       `json:"manifest_refs,omitempty"`
	AffectedImports  []vulnerabilityv1.AffectedImport `json:"affected_imports,omitempty"`
	DatabaseSpecific map[string]string                `json:"database_specific,omitempty"`
	// LayerDetails contains information about the container image layer where
	// the vulnerable package was found. Nil for non-container-image scans.
	LayerDetails *containerv1.LayerDetails `json:"layer_details,omitempty"`

	// CWEs contains Common Weakness Enumeration identifiers for this vulnerability.
	// Extracted from OSV database_specific.cwe_ids (primarily from GHSA records).
	// Example: ["CWE-79", "CWE-89"]
	CWEs []string `json:"cwes,omitempty"`

	// EPSS is the Exploit Prediction Scoring System score (0.0-1.0).
	// Represents the probability of exploitation in the next 30 days.
	// Only populated when EPSS enrichment is enabled.
	EPSS *float64 `json:"epss,omitempty"`

	// EPSSPercentile indicates what percentage of CVEs have a lower EPSS score.
	// Only populated when EPSS enrichment is enabled.
	EPSSPercentile *float64 `json:"epss_percentile,omitempty"`

	// InKEV indicates whether this CVE is in CISA's Known Exploited Vulnerabilities catalog.
	// Only populated when KEV enrichment is enabled.
	InKEV *bool `json:"in_kev,omitempty"`

	// KEVDateAdded is when this CVE was added to the KEV catalog (YYYY-MM-DD).
	// Only populated when KEV enrichment is enabled and InKEV is true.
	KEVDateAdded string `json:"kev_date_added,omitempty"`

	// KEVDueDate is the compliance deadline for federal agencies (YYYY-MM-DD).
	// Only populated when KEV enrichment is enabled and InKEV is true.
	KEVDueDate string `json:"kev_due_date,omitempty"`

	// KEVRequiredAction is the required remediation action from CISA.
	// Only populated when KEV enrichment is enabled and InKEV is true.
	KEVRequiredAction string `json:"kev_required_action,omitempty"`

	// KEVKnownRansomwareCampaignUse indicates ransomware involvement ("Known" or "Unknown").
	// Only populated when KEV enrichment is enabled and InKEV is true.
	KEVKnownRansomwareCampaignUse string `json:"kev_known_ransomware_campaign_use,omitempty"`

	// Path contains the dependency chain from root to the vulnerable package.
	// Example: ["myapp", "go-git/v5", "x/crypto"]
	// Only populated for indirect dependencies when graph resolution is enabled.
	Path []string `json:"path,omitempty"`

	// Depth is the distance from root to the vulnerable package (0 = direct, 1+ = transitive).
	// Only populated when graph resolution is enabled.
	Depth *int `json:"depth,omitempty"`
}