policyv1

type Action struct {

	// Type is the action type (allow, deny, warn).
	Type ActionType `protobuf:"varint,1,opt,name=type,proto3,enum=deputy.policy.v1.ActionType" json:"type,omitempty"`
	// PolicyName is the name of the policy that triggered this action.
	PolicyName string `protobuf:"bytes,2,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
	// RuleName is the name of the specific rule within the policy.
	RuleName string `protobuf:"bytes,3,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// Reason explains why this action was triggered.
	Reason string `protobuf:"bytes,4,opt,name=reason,proto3" json:"reason,omitempty"`
	// Remediation suggests how to resolve the issue.
	Remediation string `protobuf:"bytes,5,opt,name=remediation,proto3" json:"remediation,omitempty"`
	// Entrypoint is the policy entrypoint that evaluated this action.
	Entrypoint string `protobuf:"bytes,6,opt,name=entrypoint,proto3" json:"entrypoint,omitempty"`
	// contains filtered or unexported fields
}

type ActionType int32

type ContainerConfigDiff struct {
	UserChanged       bool     `protobuf:"varint,1,opt,name=user_changed,json=userChanged,proto3" json:"user_changed,omitempty"`
	BaseUser          string   `protobuf:"bytes,2,opt,name=base_user,json=baseUser,proto3" json:"base_user,omitempty"`
	TargetUser        string   `protobuf:"bytes,3,opt,name=target_user,json=targetUser,proto3" json:"target_user,omitempty"`
	RootChanged       bool     `protobuf:"varint,4,opt,name=root_changed,json=rootChanged,proto3" json:"root_changed,omitempty"`
	BaseIsRoot        bool     `protobuf:"varint,5,opt,name=base_is_root,json=baseIsRoot,proto3" json:"base_is_root,omitempty"`
	TargetIsRoot      bool     `protobuf:"varint,6,opt,name=target_is_root,json=targetIsRoot,proto3" json:"target_is_root,omitempty"`
	PortsChanged      bool     `protobuf:"varint,7,opt,name=ports_changed,json=portsChanged,proto3" json:"ports_changed,omitempty"`
	PortsAdded        []string `protobuf:"bytes,8,rep,name=ports_added,json=portsAdded,proto3" json:"ports_added,omitempty"`
	PortsRemoved      []string `protobuf:"bytes,9,rep,name=ports_removed,json=portsRemoved,proto3" json:"ports_removed,omitempty"`
	EntrypointChanged bool     `protobuf:"varint,10,opt,name=entrypoint_changed,json=entrypointChanged,proto3" json:"entrypoint_changed,omitempty"`
	BaseEntrypoint    []string `protobuf:"bytes,11,rep,name=base_entrypoint,json=baseEntrypoint,proto3" json:"base_entrypoint,omitempty"`
	TargetEntrypoint  []string `protobuf:"bytes,12,rep,name=target_entrypoint,json=targetEntrypoint,proto3" json:"target_entrypoint,omitempty"`
	// contains filtered or unexported fields
}

type ContainerDiffChangePolicyInput struct {
	Change *ContainerPackageChange `protobuf:"bytes,1,opt,name=change,proto3" json:"change,omitempty"`
	Env    *Environment            `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type ContainerDiffConfigPolicyInput struct {
	ConfigDiff *ContainerConfigDiff `protobuf:"bytes,1,opt,name=config_diff,json=configDiff,proto3" json:"config_diff,omitempty"`
	Env        *Environment         `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type ContainerDiffLayerPolicyInput struct {
	LayerChange *LayerChange `protobuf:"bytes,1,opt,name=layer_change,json=layerChange,proto3" json:"layer_change,omitempty"`
	Env         *Environment `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type ContainerDiffReportPolicyInput struct {

	// PackageChanges lists all package changes between images.
	PackageChanges []*ContainerPackageChange `protobuf:"bytes,1,rep,name=package_changes,json=packageChanges,proto3" json:"package_changes,omitempty"`
	// VulnerabilityChanges lists vulnerability changes.
	VulnerabilityChanges []*ContainerVulnerabilityChange `protobuf:"bytes,2,rep,name=vulnerability_changes,json=vulnerabilityChanges,proto3" json:"vulnerability_changes,omitempty"`
	// ConfigChanges describes configuration differences.
	ConfigChanges *ContainerConfigDiff `protobuf:"bytes,3,opt,name=config_changes,json=configChanges,proto3" json:"config_changes,omitempty"`
	// BaseImage describes the baseline image.
	BaseImage *ContainerImageRef `protobuf:"bytes,4,opt,name=base_image,json=baseImage,proto3" json:"base_image,omitempty"`
	// TargetImage describes the target image.
	TargetImage *ContainerImageRef `protobuf:"bytes,5,opt,name=target_image,json=targetImage,proto3" json:"target_image,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,6,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type ContainerDiffVulnerabilityPolicyInput struct {
	VulnerabilityChange *ContainerVulnerabilityChange `protobuf:"bytes,1,opt,name=vulnerability_change,json=vulnerabilityChange,proto3" json:"vulnerability_change,omitempty"`
	Env                 *Environment                  `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type ContainerImageRef struct {
	Reference  string `protobuf:"bytes,1,opt,name=reference,proto3" json:"reference,omitempty"`
	Registry   string `protobuf:"bytes,2,opt,name=registry,proto3" json:"registry,omitempty"`
	Repository string `protobuf:"bytes,3,opt,name=repository,proto3" json:"repository,omitempty"`
	Tag        string `protobuf:"bytes,4,opt,name=tag,proto3" json:"tag,omitempty"`
	Digest     string `protobuf:"bytes,5,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

type ContainerPackageChange struct {
	Name               string            `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	Ecosystem          string            `protobuf:"bytes,2,opt,name=ecosystem,proto3" json:"ecosystem,omitempty"`
	ChangeKind         string            `protobuf:"bytes,3,opt,name=change_kind,json=changeKind,proto3" json:"change_kind,omitempty"`
	BaseVersion        string            `protobuf:"bytes,4,opt,name=base_version,json=baseVersion,proto3" json:"base_version,omitempty"`
	TargetVersion      string            `protobuf:"bytes,5,opt,name=target_version,json=targetVersion,proto3" json:"target_version,omitempty"`
	IsDirect           bool              `protobuf:"varint,6,opt,name=is_direct,json=isDirect,proto3" json:"is_direct,omitempty"`
	BaseLayerDetails   *v13.LayerDetails `protobuf:"bytes,7,opt,name=base_layer_details,json=baseLayerDetails,proto3" json:"base_layer_details,omitempty"`
	TargetLayerDetails *v13.LayerDetails `protobuf:"bytes,8,opt,name=target_layer_details,json=targetLayerDetails,proto3" json:"target_layer_details,omitempty"`
	// contains filtered or unexported fields
}

type ContainerVulnerabilityChange struct {
	Id            string   `protobuf:"bytes,1,opt,name=id,proto3" json:"id,omitempty"`
	ChangeKind    string   `protobuf:"bytes,2,opt,name=change_kind,json=changeKind,proto3" json:"change_kind,omitempty"`
	Severity      string   `protobuf:"bytes,3,opt,name=severity,proto3" json:"severity,omitempty"`
	PackageName   string   `protobuf:"bytes,4,opt,name=package_name,json=packageName,proto3" json:"package_name,omitempty"`
	Ecosystem     string   `protobuf:"bytes,5,opt,name=ecosystem,proto3" json:"ecosystem,omitempty"`
	BaseVersion   string   `protobuf:"bytes,6,opt,name=base_version,json=baseVersion,proto3" json:"base_version,omitempty"`
	TargetVersion string   `protobuf:"bytes,7,opt,name=target_version,json=targetVersion,proto3" json:"target_version,omitempty"`
	FixedVersions []string `protobuf:"bytes,8,rep,name=fixed_versions,json=fixedVersions,proto3" json:"fixed_versions,omitempty"`
	Summary       string   `protobuf:"bytes,9,opt,name=summary,proto3" json:"summary,omitempty"`
	// contains filtered or unexported fields
}

type DependencyChange struct {

	// Pkg is the changed package.
	Pkg *v11.Package `protobuf:"bytes,1,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// ChangeKind is the type of change (added, removed, upgraded, downgraded).
	ChangeKind string `protobuf:"bytes,2,opt,name=change_kind,json=changeKind,proto3" json:"change_kind,omitempty"`
	// BaseVersion is the version in the base target.
	BaseVersion string `protobuf:"bytes,3,opt,name=base_version,json=baseVersion,proto3" json:"base_version,omitempty"`
	// TargetVersion is the version in the target.
	TargetVersion string `protobuf:"bytes,4,opt,name=target_version,json=targetVersion,proto3" json:"target_version,omitempty"`
	// IsDirect indicates if this is a direct dependency.
	IsDirect bool `protobuf:"varint,5,opt,name=is_direct,json=isDirect,proto3" json:"is_direct,omitempty"`
	// contains filtered or unexported fields
}

type DiffDependencyChangePolicyInput struct {

	// Change is the current dependency change.
	Change *DependencyChange `protobuf:"bytes,1,opt,name=change,proto3" json:"change,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type DiffReportPolicyInput struct {

	// Changes lists all dependency changes between refs.
	Changes []*DependencyChange `protobuf:"bytes,1,rep,name=changes,proto3" json:"changes,omitempty"`
	// BaseTarget is the baseline (older) target.
	BaseTarget *v12.Target `protobuf:"bytes,2,opt,name=base_target,json=baseTarget,proto3" json:"base_target,omitempty"`
	// TargetTarget is the target (newer) being compared.
	TargetTarget *v12.Target `protobuf:"bytes,3,opt,name=target_target,json=targetTarget,proto3" json:"target_target,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,4,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type DiffVulnerabilityPolicyInput struct {

	// Vulnerability is the vulnerability finding.
	Vulnerability *v1.Finding `protobuf:"bytes,1,opt,name=vulnerability,proto3" json:"vulnerability,omitempty"`
	// ChangeKind indicates if this is "added" or "removed".
	ChangeKind string `protobuf:"bytes,2,opt,name=change_kind,json=changeKind,proto3" json:"change_kind,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type DockerfileAnalysis struct {
	StageCount          int32    `protobuf:"varint,1,opt,name=stage_count,json=stageCount,proto3" json:"stage_count,omitempty"`
	HasMultiStage       bool     `protobuf:"varint,2,opt,name=has_multi_stage,json=hasMultiStage,proto3" json:"has_multi_stage,omitempty"`
	BuilderStageCount   int32    `protobuf:"varint,3,opt,name=builder_stage_count,json=builderStageCount,proto3" json:"builder_stage_count,omitempty"`
	FinalStageIsRoot    bool     `protobuf:"varint,4,opt,name=final_stage_is_root,json=finalStageIsRoot,proto3" json:"final_stage_is_root,omitempty"`
	FinalStageIsScratch bool     `protobuf:"varint,5,opt,name=final_stage_is_scratch,json=finalStageIsScratch,proto3" json:"final_stage_is_scratch,omitempty"`
	SensitiveEnvVars    []string `protobuf:"bytes,6,rep,name=sensitive_env_vars,json=sensitiveEnvVars,proto3" json:"sensitive_env_vars,omitempty"`
	HasAddUrl           bool     `protobuf:"varint,7,opt,name=has_add_url,json=hasAddUrl,proto3" json:"has_add_url,omitempty"`
	// contains filtered or unexported fields
}

type DockerfileInfo struct {
	Path       string             `protobuf:"bytes,1,opt,name=path,proto3" json:"path,omitempty"`
	Stages     []*DockerfileStage `protobuf:"bytes,2,rep,name=stages,proto3" json:"stages,omitempty"`
	FinalStage *DockerfileStage   `protobuf:"bytes,3,opt,name=final_stage,json=finalStage,proto3" json:"final_stage,omitempty"`
	Args       map[string]string  `` /* 135-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DockerfileReportPolicyInput struct {

	// Dockerfile contains the parsed Dockerfile data.
	Dockerfile *DockerfileInfo `protobuf:"bytes,1,opt,name=dockerfile,proto3" json:"dockerfile,omitempty"`
	// DockerfileAnalysis contains static analysis results.
	DockerfileAnalysis *DockerfileAnalysis `protobuf:"bytes,2,opt,name=dockerfile_analysis,json=dockerfileAnalysis,proto3" json:"dockerfile_analysis,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type DockerfileStage struct {
	Index             int32             `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
	Name              string            `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	BaseImage         string            `protobuf:"bytes,3,opt,name=base_image,json=baseImage,proto3" json:"base_image,omitempty"`
	BaseImageResolved *ImageReference   `protobuf:"bytes,4,opt,name=base_image_resolved,json=baseImageResolved,proto3" json:"base_image_resolved,omitempty"`
	Platform          string            `protobuf:"bytes,5,opt,name=platform,proto3" json:"platform,omitempty"`
	IsScratch         bool              `protobuf:"varint,6,opt,name=is_scratch,json=isScratch,proto3" json:"is_scratch,omitempty"`
	IsBuilderStage    bool              `protobuf:"varint,7,opt,name=is_builder_stage,json=isBuilderStage,proto3" json:"is_builder_stage,omitempty"`
	User              string            `protobuf:"bytes,8,opt,name=user,proto3" json:"user,omitempty"`
	IsRoot            bool              `protobuf:"varint,9,opt,name=is_root,json=isRoot,proto3" json:"is_root,omitempty"`
	Workdir           string            `protobuf:"bytes,10,opt,name=workdir,proto3" json:"workdir,omitempty"`
	EnvVars           map[string]string `` /* 157-byte string literal not displayed */
	SensitiveEnv      []string          `protobuf:"bytes,12,rep,name=sensitive_env,json=sensitiveEnv,proto3" json:"sensitive_env,omitempty"`
	ExposedPorts      []string          `protobuf:"bytes,13,rep,name=exposed_ports,json=exposedPorts,proto3" json:"exposed_ports,omitempty"`
	Labels            map[string]string `` /* 140-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DockerfileStagePolicyInput struct {
	Stage      *DockerfileStage `protobuf:"bytes,1,opt,name=stage,proto3" json:"stage,omitempty"`
	Dockerfile *DockerfileInfo  `protobuf:"bytes,2,opt,name=dockerfile,proto3" json:"dockerfile,omitempty"`
	Env        *Environment     `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type EntrypointInfo struct {

	// Name is the entrypoint identifier (e.g., "scan_vulnerability").
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Category groups related entrypoints (e.g., "scan", "proxy", "graph").
	Category string `protobuf:"bytes,2,opt,name=category,proto3" json:"category,omitempty"`
	// Description explains when this entrypoint is evaluated.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Variables available in CEL expressions at this entrypoint.
	Variables []*VariableInfo `protobuf:"bytes,4,rep,name=variables,proto3" json:"variables,omitempty"`
	// Helpers lists custom functions available at this entrypoint.
	Helpers []string `protobuf:"bytes,5,rep,name=helpers,proto3" json:"helpers,omitempty"`
	// contains filtered or unexported fields
}

type Environment struct {

	// Command is the deputy command being executed (e.g., "scan", "proxy").
	Command string `protobuf:"bytes,1,opt,name=command,proto3" json:"command,omitempty"`
	// Entrypoint is the policy entrypoint being evaluated.
	Entrypoint string `protobuf:"bytes,2,opt,name=entrypoint,proto3" json:"entrypoint,omitempty"`
	// contains filtered or unexported fields
}

type EvaluateRequest struct {

	// Policies to evaluate. Can be inline YAML or file paths.
	// When using file paths, the service must be in local mode.
	Policies []*PolicySource `protobuf:"bytes,1,rep,name=policies,proto3" json:"policies,omitempty"`
	// Input for evaluation - exactly one must be set.
	//
	// Types that are valid to be assigned to Input:
	//
	//	*EvaluateRequest_ScanVulnerability
	//	*EvaluateRequest_ScanReport
	//	*EvaluateRequest_GoArtifactRequest
	//	*EvaluateRequest_NpmArtifactRequest
	//	*EvaluateRequest_PypiArtifactRequest
	//	*EvaluateRequest_OciArtifactRequest
	//	*EvaluateRequest_CustomPayload
	Input isEvaluateRequest_Input `protobuf_oneof:"input"`
	// Entrypoints to evaluate. If empty, evaluates all matching entrypoints.
	Entrypoints []string `protobuf:"bytes,20,rep,name=entrypoints,proto3" json:"entrypoints,omitempty"`
	// contains filtered or unexported fields
}

type EvaluateRequest_CustomPayload struct {
	// Generic payload for custom entrypoints.
	CustomPayload []byte `protobuf:"bytes,99,opt,name=custom_payload,json=customPayload,proto3,oneof"`
}

type EvaluateRequest_GoArtifactRequest struct {
	// GoArtifactRequest input for Go proxy evaluation.
	GoArtifactRequest *GoArtifactRequestPolicyInput `protobuf:"bytes,12,opt,name=go_artifact_request,json=goArtifactRequest,proto3,oneof"`
}

type EvaluateRequest_NpmArtifactRequest struct {
	// NpmArtifactRequest input for npm proxy evaluation.
	NpmArtifactRequest *NpmArtifactRequestPolicyInput `protobuf:"bytes,13,opt,name=npm_artifact_request,json=npmArtifactRequest,proto3,oneof"`
}

type EvaluateRequest_OciArtifactRequest struct {
	// OciArtifactRequest input for OCI proxy evaluation.
	OciArtifactRequest *OciArtifactRequestPolicyInput `protobuf:"bytes,15,opt,name=oci_artifact_request,json=ociArtifactRequest,proto3,oneof"`
}

type EvaluateRequest_PypiArtifactRequest struct {
	// PypiArtifactRequest input for PyPI proxy evaluation.
	PypiArtifactRequest *PypiArtifactRequestPolicyInput `protobuf:"bytes,14,opt,name=pypi_artifact_request,json=pypiArtifactRequest,proto3,oneof"`
}

type EvaluateRequest_ScanReport struct {
	// ScanReport input for report-level evaluation.
	ScanReport *ScanReportPolicyInput `protobuf:"bytes,11,opt,name=scan_report,json=scanReport,proto3,oneof"`
}

type EvaluateRequest_ScanVulnerability struct {
	// ScanVulnerability input for per-vulnerability evaluation.
	ScanVulnerability *ScanVulnerabilityPolicyInput `protobuf:"bytes,10,opt,name=scan_vulnerability,json=scanVulnerability,proto3,oneof"`
}

type EvaluateResponse struct {

	// Actions triggered by policy evaluation.
	Actions []*Action `protobuf:"bytes,1,rep,name=actions,proto3" json:"actions,omitempty"`
	// Overall outcome based on triggered actions.
	// DENY if any deny action, WARN if any warn action, ALLOW otherwise.
	Outcome ActionType `protobuf:"varint,2,opt,name=outcome,proto3,enum=deputy.policy.v1.ActionType" json:"outcome,omitempty"`
	// Errors encountered during evaluation (syntax errors, missing vars, etc).
	Errors []*PolicyError `protobuf:"bytes,3,rep,name=errors,proto3" json:"errors,omitempty"`
	// contains filtered or unexported fields
}

type FieldInfo struct {

	// Name is the field path (e.g., "advisory.severity.level").
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Type is the field type.
	Type string `protobuf:"bytes,2,opt,name=type,proto3" json:"type,omitempty"`
	// Description explains what the field contains.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// contains filtered or unexported fields
}

type FixPlanPolicyInput struct {

	// Commands are the remediation steps.
	Commands []*RemediationCommand `protobuf:"bytes,1,rep,name=commands,proto3" json:"commands,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// Target describes what was analyzed.
	Target *v12.Target `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
	// contains filtered or unexported fields
}

type FixPlanStepPolicyInput struct {
	Step *RemediationCommand `protobuf:"bytes,1,opt,name=step,proto3" json:"step,omitempty"`
	Env  *Environment        `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type GoArtifactRequestPolicyInput struct {

	// Request contains the package request details.
	Request *ProxyRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
	// Jwt contains verified JWT claims (if authenticated).
	Jwt *JWTClaims `protobuf:"bytes,2,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// Vulnerabilities associated with the requested package.
	Vulnerabilities []*v1.Finding `protobuf:"bytes,4,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// Pkg is the requested package (synthesized from request).
	Pkg *v11.Package `protobuf:"bytes,5,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// contains filtered or unexported fields
}

type GraphEdge struct {
	From       string `protobuf:"bytes,1,opt,name=from,proto3" json:"from,omitempty"`
	To         string `protobuf:"bytes,2,opt,name=to,proto3" json:"to,omitempty"`
	Constraint string `protobuf:"bytes,3,opt,name=constraint,proto3" json:"constraint,omitempty"`
	Scope      string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"`
	// contains filtered or unexported fields
}

type GraphEdgePolicyInput struct {
	Edge     *GraphEdge   `protobuf:"bytes,1,opt,name=edge,proto3" json:"edge,omitempty"`
	FromNode *GraphNode   `protobuf:"bytes,2,opt,name=from_node,json=fromNode,proto3" json:"from_node,omitempty"`
	ToNode   *GraphNode   `protobuf:"bytes,3,opt,name=to_node,json=toNode,proto3" json:"to_node,omitempty"`
	Env      *Environment `protobuf:"bytes,4,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type GraphNode struct {
	Purl            string        `protobuf:"bytes,1,opt,name=purl,proto3" json:"purl,omitempty"`
	Name            string        `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"`
	Version         string        `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
	Ecosystem       string        `protobuf:"bytes,4,opt,name=ecosystem,proto3" json:"ecosystem,omitempty"`
	Direct          bool          `protobuf:"varint,5,opt,name=direct,proto3" json:"direct,omitempty"`
	Depth           int32         `protobuf:"varint,6,opt,name=depth,proto3" json:"depth,omitempty"`
	Locations       []string      `protobuf:"bytes,7,rep,name=locations,proto3" json:"locations,omitempty"`
	Vulnerabilities []*v1.Finding `protobuf:"bytes,8,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// contains filtered or unexported fields
}

type GraphNodePolicyInput struct {
	Node *GraphNode   `protobuf:"bytes,1,opt,name=node,proto3" json:"node,omitempty"`
	Env  *Environment `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// contains filtered or unexported fields
}

type GraphReportPolicyInput struct {

	// Nodes are all packages in the dependency graph.
	Nodes []*GraphNode `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
	// Edges are dependency relationships.
	Edges []*GraphEdge `protobuf:"bytes,2,rep,name=edges,proto3" json:"edges,omitempty"`
	// Roots are PURLs of direct dependencies.
	Roots []string `protobuf:"bytes,3,rep,name=roots,proto3" json:"roots,omitempty"`
	// Stats summarizes the graph.
	Stats *GraphStats `protobuf:"bytes,4,opt,name=stats,proto3" json:"stats,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,5,opt,name=env,proto3" json:"env,omitempty"`
	// Target describes what was analyzed.
	Target *v12.Target `protobuf:"bytes,6,opt,name=target,proto3" json:"target,omitempty"`
	// contains filtered or unexported fields
}

type GraphStats struct {
	TotalNodes      int32            `protobuf:"varint,1,opt,name=total_nodes,json=totalNodes,proto3" json:"total_nodes,omitempty"`
	DirectNodes     int32            `protobuf:"varint,2,opt,name=direct_nodes,json=directNodes,proto3" json:"direct_nodes,omitempty"`
	TransitiveNodes int32            `protobuf:"varint,3,opt,name=transitive_nodes,json=transitiveNodes,proto3" json:"transitive_nodes,omitempty"`
	MaxDepth        int32            `protobuf:"varint,4,opt,name=max_depth,json=maxDepth,proto3" json:"max_depth,omitempty"`
	VulnerableNodes int32            `protobuf:"varint,5,opt,name=vulnerable_nodes,json=vulnerableNodes,proto3" json:"vulnerable_nodes,omitempty"`
	Ecosystems      map[string]int32 `` /* 148-byte string literal not displayed */
	// contains filtered or unexported fields
}

type ImageReference struct {
	Registry   string `protobuf:"bytes,1,opt,name=registry,proto3" json:"registry,omitempty"`
	Repository string `protobuf:"bytes,2,opt,name=repository,proto3" json:"repository,omitempty"`
	Tag        string `protobuf:"bytes,3,opt,name=tag,proto3" json:"tag,omitempty"`
	Digest     string `protobuf:"bytes,4,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

type JWTClaims struct {

	// Anonymous is true if no token was provided.
	Anonymous bool `protobuf:"varint,1,opt,name=anonymous,proto3" json:"anonymous,omitempty"`
	// Sub is the subject (user/service ID).
	Sub string `protobuf:"bytes,2,opt,name=sub,proto3" json:"sub,omitempty"`
	// Iss is the token issuer.
	Iss string `protobuf:"bytes,3,opt,name=iss,proto3" json:"iss,omitempty"`
	// Aud contains the audiences.
	Aud []string `protobuf:"bytes,4,rep,name=aud,proto3" json:"aud,omitempty"`
	// Exp is the expiration timestamp (Unix).
	Exp int64 `protobuf:"varint,5,opt,name=exp,proto3" json:"exp,omitempty"`
	// Iat is the issued-at timestamp (Unix).
	Iat int64 `protobuf:"varint,6,opt,name=iat,proto3" json:"iat,omitempty"`
	// Nbf is the not-before timestamp (Unix).
	Nbf int64 `protobuf:"varint,7,opt,name=nbf,proto3" json:"nbf,omitempty"`
	// Jti is the JWT ID.
	Jti string `protobuf:"bytes,8,opt,name=jti,proto3" json:"jti,omitempty"`
	// CustomClaims contains any additional claims from the token.
	CustomClaims map[string]string `` /* 171-byte string literal not displayed */
	// contains filtered or unexported fields
}

type LayerChange struct {
	Index         int32  `protobuf:"varint,1,opt,name=index,proto3" json:"index,omitempty"`
	ChangeKind    string `protobuf:"bytes,2,opt,name=change_kind,json=changeKind,proto3" json:"change_kind,omitempty"`
	BaseCommand   string `protobuf:"bytes,3,opt,name=base_command,json=baseCommand,proto3" json:"base_command,omitempty"`
	TargetCommand string `protobuf:"bytes,4,opt,name=target_command,json=targetCommand,proto3" json:"target_command,omitempty"`
	// contains filtered or unexported fields
}

type ListEntrypointsRequest struct {

	// Category filters to specific entrypoint categories.
	// Empty returns all entrypoints.
	Category string `protobuf:"bytes,1,opt,name=category,proto3" json:"category,omitempty"`
	// contains filtered or unexported fields
}

type ListEntrypointsResponse struct {

	// Entrypoints lists all available policy entrypoints.
	Entrypoints []*EntrypointInfo `protobuf:"bytes,1,rep,name=entrypoints,proto3" json:"entrypoints,omitempty"`
	// contains filtered or unexported fields
}

type NpmArtifactRequestPolicyInput struct {

	// Request contains the package request details.
	Request *ProxyRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
	// Jwt contains verified JWT claims (if authenticated).
	Jwt *JWTClaims `protobuf:"bytes,2,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// Vulnerabilities associated with the requested package.
	Vulnerabilities []*v1.Finding `protobuf:"bytes,4,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// Pkg is the requested package (synthesized from request).
	Pkg *v11.Package `protobuf:"bytes,5,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// contains filtered or unexported fields
}

type OciArtifactRequestPolicyInput struct {

	// Request contains the image request details.
	Request *ProxyRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
	// Jwt contains verified JWT claims (if authenticated).
	Jwt *JWTClaims `protobuf:"bytes,2,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// Vulnerabilities found in the container image.
	Vulnerabilities []*v1.Finding `protobuf:"bytes,4,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// Image contains the container image configuration and metadata.
	Image *v13.ImageInfo `protobuf:"bytes,5,opt,name=image,proto3" json:"image,omitempty"`
	// contains filtered or unexported fields
}

type PolicyError struct {

	// PolicyName is the name of the policy with the error.
	PolicyName string `protobuf:"bytes,1,opt,name=policy_name,json=policyName,proto3" json:"policy_name,omitempty"`
	// RuleName is the rule with the error (if applicable).
	RuleName string `protobuf:"bytes,2,opt,name=rule_name,json=ruleName,proto3" json:"rule_name,omitempty"`
	// Message describes the error.
	Message string `protobuf:"bytes,3,opt,name=message,proto3" json:"message,omitempty"`
	// Line number in policy source (if known).
	Line int32 `protobuf:"varint,4,opt,name=line,proto3" json:"line,omitempty"`
	// Column in policy source (if known).
	Column int32 `protobuf:"varint,5,opt,name=column,proto3" json:"column,omitempty"`
	// contains filtered or unexported fields
}

type PolicySource struct {

	// Types that are valid to be assigned to Source:
	//
	//	*PolicySource_Inline
	//	*PolicySource_Path
	//	*PolicySource_Url
	Source isPolicySource_Source `protobuf_oneof:"source"`
	// contains filtered or unexported fields
}

type PolicySource_Inline struct {
	// Inline YAML policy content.
	Inline string `protobuf:"bytes,1,opt,name=inline,proto3,oneof"`
}

type PolicySource_Path struct {
	// File path to policy YAML (local mode only).
	Path string `protobuf:"bytes,2,opt,name=path,proto3,oneof"`
}

type PolicySource_Url struct {
	// URL to fetch policy from (remote-accessible only).
	Url string `protobuf:"bytes,3,opt,name=url,proto3,oneof"`
}

type PolicySummary struct {

	// Name of the policy.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// Description of the policy.
	Description string `protobuf:"bytes,2,opt,name=description,proto3" json:"description,omitempty"`
	// Entrypoints this policy applies to.
	Entrypoints []string `protobuf:"bytes,3,rep,name=entrypoints,proto3" json:"entrypoints,omitempty"`
	// RuleCount is the number of rules in the policy.
	RuleCount int32 `protobuf:"varint,4,opt,name=rule_count,json=ruleCount,proto3" json:"rule_count,omitempty"`
	// Variables defined in the policy.
	Variables []string `protobuf:"bytes,5,rep,name=variables,proto3" json:"variables,omitempty"`
	// contains filtered or unexported fields
}

type ProxyRequest struct {

	// Package is the name of the package being requested.
	Package string `protobuf:"bytes,1,opt,name=package,proto3" json:"package,omitempty"`
	// Module is the Go module path (for Go ecosystem).
	Module string `protobuf:"bytes,2,opt,name=module,proto3" json:"module,omitempty"`
	// Version is the version being requested.
	Version string `protobuf:"bytes,3,opt,name=version,proto3" json:"version,omitempty"`
	// Ecosystem identifies the package ecosystem.
	Ecosystem string `protobuf:"bytes,4,opt,name=ecosystem,proto3" json:"ecosystem,omitempty"`
	// Operation describes what's being requested (e.g., "download", "info").
	Operation string `protobuf:"bytes,5,opt,name=operation,proto3" json:"operation,omitempty"`
	// contains filtered or unexported fields
}

type PypiArtifactRequestPolicyInput struct {

	// Request contains the package request details.
	Request *ProxyRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
	// Jwt contains verified JWT claims (if authenticated).
	Jwt *JWTClaims `protobuf:"bytes,2,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// Vulnerabilities associated with the requested package.
	Vulnerabilities []*v1.Finding `protobuf:"bytes,4,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// Pkg is the requested package (synthesized from request).
	Pkg *v11.Package `protobuf:"bytes,5,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// contains filtered or unexported fields
}

type RemediationCommand struct {
	Manager    string `protobuf:"bytes,1,opt,name=manager,proto3" json:"manager,omitempty"`
	Command    string `protobuf:"bytes,2,opt,name=command,proto3" json:"command,omitempty"`
	Path       string `protobuf:"bytes,3,opt,name=path,proto3" json:"path,omitempty"`
	Hint       string `protobuf:"bytes,4,opt,name=hint,proto3" json:"hint,omitempty"`
	IsDirect   bool   `protobuf:"varint,5,opt,name=is_direct,json=isDirect,proto3" json:"is_direct,omitempty"`
	Executable bool   `protobuf:"varint,6,opt,name=executable,proto3" json:"executable,omitempty"`
	// contains filtered or unexported fields
}

type RubygemsArtifactRequestPolicyInput struct {

	// Request contains the package request details.
	Request *ProxyRequest `protobuf:"bytes,1,opt,name=request,proto3" json:"request,omitempty"`
	// Jwt contains verified JWT claims (if authenticated).
	Jwt *JWTClaims `protobuf:"bytes,2,opt,name=jwt,proto3" json:"jwt,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,3,opt,name=env,proto3" json:"env,omitempty"`
	// Vulnerabilities associated with the requested package.
	Vulnerabilities []*v1.Finding `protobuf:"bytes,4,rep,name=vulnerabilities,proto3" json:"vulnerabilities,omitempty"`
	// Pkg is the requested package (synthesized from request).
	Pkg *v11.Package `protobuf:"bytes,5,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// contains filtered or unexported fields
}

type SbomComponentPolicyInput struct {

	// Pkg is the current component (aliased as "pkg" for CEL consistency).
	Pkg *v11.Package `protobuf:"bytes,1,opt,name=pkg,proto3" json:"pkg,omitempty"`
	// Env provides execution environment context.
	Env *Environment `protobuf:"bytes,2,opt,name=env,proto3" json:"env,omitempty"`
	// Target describes what was analyzed.
	Target *v12.Target `protobuf:"bytes,3,opt,name=target,proto3" json:"target,omitempty"`
	// contains filtered or unexported fields
}