scanv1

type DependencyGraph struct {

	// Nodes are all packages in the dependency graph.
	Nodes []*v16.Node `protobuf:"bytes,1,rep,name=nodes,proto3" json:"nodes,omitempty"`
	// Edges represent dependency relationships.
	Edges []*v16.Edge `protobuf:"bytes,2,rep,name=edges,proto3" json:"edges,omitempty"`
	// Roots are PURLs of direct dependencies (depth 0).
	Roots []string `protobuf:"bytes,3,rep,name=roots,proto3" json:"roots,omitempty"`
	// Stats summarizes the graph.
	Stats *v16.GraphStats `protobuf:"bytes,4,opt,name=stats,proto3" json:"stats,omitempty"`
	// contains filtered or unexported fields
}

type EnrichOptions struct {

	// Enabled controls whether to enrich vulnerabilities with threat intel.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// IncludeEpss adds EPSS scores to findings.
	IncludeEpss bool `protobuf:"varint,2,opt,name=include_epss,json=includeEpss,proto3" json:"include_epss,omitempty"`
	// IncludeKev adds CISA KEV catalog data to findings.
	IncludeKev bool `protobuf:"varint,3,opt,name=include_kev,json=includeKev,proto3" json:"include_kev,omitempty"`
	// contains filtered or unexported fields
}

type GraphOptions struct {

	// Enabled controls whether to build the dependency graph.
	Enabled bool `protobuf:"varint,1,opt,name=enabled,proto3" json:"enabled,omitempty"`
	// UseProxy enables fetching module metadata from package registries.
	UseProxy bool `protobuf:"varint,2,opt,name=use_proxy,json=useProxy,proto3" json:"use_proxy,omitempty"`
	// UseGit enables cloning repositories for private module resolution.
	UseGit bool `protobuf:"varint,3,opt,name=use_git,json=useGit,proto3" json:"use_git,omitempty"`
	// PrivatePatterns specifies glob patterns for private modules.
	// Maximum 100 patterns to prevent abuse. Each pattern limited to 256 chars.
	PrivatePatterns []string `protobuf:"bytes,4,rep,name=private_patterns,json=privatePatterns,proto3" json:"private_patterns,omitempty"`
	// contains filtered or unexported fields
}

type Healthcheck struct {

	// Test is the health check command.
	Test []string `protobuf:"bytes,1,rep,name=test,proto3" json:"test,omitempty"`
	// Interval is time between checks (Go duration format).
	Interval string `protobuf:"bytes,2,opt,name=interval,proto3" json:"interval,omitempty"`
	// Timeout is timeout for each check.
	Timeout string `protobuf:"bytes,3,opt,name=timeout,proto3" json:"timeout,omitempty"`
	// Retries is consecutive failures before unhealthy.
	Retries int32 `protobuf:"varint,4,opt,name=retries,proto3" json:"retries,omitempty"`
	// contains filtered or unexported fields
}

type HistoryEntry struct {

	// CreatedBy is the command that created this layer.
	CreatedBy string `protobuf:"bytes,1,opt,name=created_by,json=createdBy,proto3" json:"created_by,omitempty"`
	// Created is when this layer was created.
	Created *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=created,proto3" json:"created,omitempty"`
	// EmptyLayer indicates this is a metadata-only layer.
	EmptyLayer bool `protobuf:"varint,3,opt,name=empty_layer,json=emptyLayer,proto3" json:"empty_layer,omitempty"`
	// contains filtered or unexported fields
}

type ImageConfig struct {

	// User to run as (empty = root).
	User string `protobuf:"bytes,1,opt,name=user,proto3" json:"user,omitempty"`
	// IsRoot indicates whether running as root.
	IsRoot bool `protobuf:"varint,2,opt,name=is_root,json=isRoot,proto3" json:"is_root,omitempty"`
	// Env are environment variables.
	Env []string `protobuf:"bytes,3,rep,name=env,proto3" json:"env,omitempty"`
	// SensitiveEnv are env vars that may contain secrets.
	SensitiveEnv []string `protobuf:"bytes,4,rep,name=sensitive_env,json=sensitiveEnv,proto3" json:"sensitive_env,omitempty"`
	// Entrypoint is the container entrypoint command.
	Entrypoint []string `protobuf:"bytes,5,rep,name=entrypoint,proto3" json:"entrypoint,omitempty"`
	// Cmd are default command arguments.
	Cmd []string `protobuf:"bytes,6,rep,name=cmd,proto3" json:"cmd,omitempty"`
	// ExposedPorts are exposed ports.
	ExposedPorts []string `protobuf:"bytes,7,rep,name=exposed_ports,json=exposedPorts,proto3" json:"exposed_ports,omitempty"`
	// Volumes are defined volumes.
	Volumes []string `protobuf:"bytes,8,rep,name=volumes,proto3" json:"volumes,omitempty"`
	// Labels are image labels.
	Labels map[string]string `` /* 139-byte string literal not displayed */
	// WorkingDir is the working directory.
	WorkingDir string `protobuf:"bytes,10,opt,name=working_dir,json=workingDir,proto3" json:"working_dir,omitempty"`
	// Healthcheck configuration if defined.
	Healthcheck *Healthcheck `protobuf:"bytes,11,opt,name=healthcheck,proto3" json:"healthcheck,omitempty"`
	// contains filtered or unexported fields
}

type ImageInfo struct {

	// Config contains the image configuration.
	Config *ImageConfig `protobuf:"bytes,1,opt,name=config,proto3" json:"config,omitempty"`
	// Metadata contains image metadata.
	Metadata *ImageMetadata `protobuf:"bytes,2,opt,name=metadata,proto3" json:"metadata,omitempty"`
	// History contains build history entries.
	History []*HistoryEntry `protobuf:"bytes,3,rep,name=history,proto3" json:"history,omitempty"`
	// contains filtered or unexported fields
}

type ImageMetadata struct {

	// Architecture is the CPU architecture.
	Architecture string `protobuf:"bytes,1,opt,name=architecture,proto3" json:"architecture,omitempty"`
	// Os is the operating system.
	Os string `protobuf:"bytes,2,opt,name=os,proto3" json:"os,omitempty"`
	// LayerCount is the number of layers.
	LayerCount int32 `protobuf:"varint,3,opt,name=layer_count,json=layerCount,proto3" json:"layer_count,omitempty"`
	// Size is total size in bytes.
	Size int64 `protobuf:"varint,4,opt,name=size,proto3" json:"size,omitempty"`
	// Created is when the image was created.
	Created *timestamppb.Timestamp `protobuf:"bytes,5,opt,name=created,proto3" json:"created,omitempty"`
	// Digest is the image digest.
	Digest string `protobuf:"bytes,6,opt,name=digest,proto3" json:"digest,omitempty"`
	// contains filtered or unexported fields
}

type ScanOptions struct {

	// Ecosystems filters scanning to specific package ecosystems.
	// Empty means scan all detected ecosystems.
	// Maximum 50 ecosystems to prevent abuse.
	Ecosystems []string `protobuf:"bytes,1,rep,name=ecosystems,proto3" json:"ecosystems,omitempty"`
	// PublishedBefore filters to vulnerabilities published before this timestamp.
	PublishedBefore *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=published_before,json=publishedBefore,proto3" json:"published_before,omitempty"`
	// PublishedAfter filters to vulnerabilities published after this timestamp.
	PublishedAfter *timestamppb.Timestamp `protobuf:"bytes,3,opt,name=published_after,json=publishedAfter,proto3" json:"published_after,omitempty"`
	// GraphOptions configures dependency graph resolution.
	GraphOptions *GraphOptions `protobuf:"bytes,4,opt,name=graph_options,json=graphOptions,proto3" json:"graph_options,omitempty"`
	// EnrichOptions configures vulnerability enrichment.
	EnrichOptions *EnrichOptions `protobuf:"bytes,5,opt,name=enrich_options,json=enrichOptions,proto3" json:"enrich_options,omitempty"`
	// PolicyPaths are paths to policy files to evaluate.
	// Maximum 20 policy paths to prevent abuse. Each path limited to 1024 chars.
	PolicyPaths []string `protobuf:"bytes,6,rep,name=policy_paths,json=policyPaths,proto3" json:"policy_paths,omitempty"`
	// Ref is a Git reference to scan (branch, tag, commit).
	// Only applies to git/repository targets.
	// Maximum length accommodates SHA-256 commit hashes and long branch names.
	Ref string `protobuf:"bytes,7,opt,name=ref,proto3" json:"ref,omitempty"`
	// Platform specifies the target platform for container images (e.g., "linux/amd64").
	// Only applies to container image targets.
	Platform string `protobuf:"bytes,8,opt,name=platform,proto3" json:"platform,omitempty"`
	// IncludeSecrets enables secret scanning alongside vulnerability scanning.
	IncludeSecrets bool `protobuf:"varint,9,opt,name=include_secrets,json=includeSecrets,proto3" json:"include_secrets,omitempty"`
	// TargetHint provides disambiguation when the target string is ambiguous.
	// The scanner auto-detects target type from the target string in most cases:
	//   - "pkg:golang/..." -> PURL
	//   - "docker://...", "ghcr.io/..." -> container image
	//   - "./path", "/path" -> directory or SBOM file
	//   - "github.com/owner/repo" -> git repository
	//
	// Use TargetHint only when auto-detection fails or is ambiguous.
	TargetHint *TargetHint `protobuf:"bytes,10,opt,name=target_hint,json=targetHint,proto3" json:"target_hint,omitempty"`
	// DetectBaseImage enables base image detection for container image scans.
	// When enabled, queries deps.dev to determine if layers belong to known base images,
	// populating layer_details.in_base_image in the response packages.
	// Only applies to container image targets. Requires network access and adds latency.
	DetectBaseImage bool `protobuf:"varint,11,opt,name=detect_base_image,json=detectBaseImage,proto3" json:"detect_base_image,omitempty"`
	// contains filtered or unexported fields
}

type ScanPhase int32

type ScanProgress struct {

	// Phase indicates the current scan phase.
	Phase ScanPhase `protobuf:"varint,1,opt,name=phase,proto3,enum=deputy.scan.v1.ScanPhase" json:"phase,omitempty"`
	// Message provides human-readable progress information.
	Message string `protobuf:"bytes,2,opt,name=message,proto3" json:"message,omitempty"`
	// Progress is the completion percentage (0-100) for the current phase.
	Progress int32 `protobuf:"varint,3,opt,name=progress,proto3" json:"progress,omitempty"`
	// PackagesFound is the running count of discovered packages.
	PackagesFound int32 `protobuf:"varint,4,opt,name=packages_found,json=packagesFound,proto3" json:"packages_found,omitempty"`
	// VulnerabilitiesFound is the running count of discovered vulnerabilities.
	VulnerabilitiesFound int32 `protobuf:"varint,5,opt,name=vulnerabilities_found,json=vulnerabilitiesFound,proto3" json:"vulnerabilities_found,omitempty"`
	// Result is populated only in the final message when phase is SCAN_PHASE_COMPLETE.
	Result *ScanResponse `protobuf:"bytes,10,opt,name=result,proto3" json:"result,omitempty"`
	// Error is populated if the scan failed.
	Error string `protobuf:"bytes,11,opt,name=error,proto3" json:"error,omitempty"`
	// contains filtered or unexported fields
}

type ScanRequest struct {

	// Target is the scan target (path, URL, image reference, etc.).
	// When empty, defaults to current working directory.
	// Maximum length prevents denial-of-service via excessively long strings.
	Target string `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// Options configure scan behavior.
	Options *ScanOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type ScanResponse struct {

	// Target describes what was scanned.
	Target *v1.Target `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// GeneratedAt is when this report was generated.
	GeneratedAt *timestamppb.Timestamp `protobuf:"bytes,2,opt,name=generated_at,json=generatedAt,proto3" json:"generated_at,omitempty"`
	// PackagesScanned is the count of packages analyzed.
	PackagesScanned int32 `protobuf:"varint,3,opt,name=packages_scanned,json=packagesScanned,proto3" json:"packages_scanned,omitempty"`
	// Packages lists all discovered packages.
	Packages []*v11.Package `protobuf:"bytes,4,rep,name=packages,proto3" json:"packages,omitempty"`
	// Findings lists all vulnerability occurrences.
	Findings []*v12.Finding `protobuf:"bytes,5,rep,name=findings,proto3" json:"findings,omitempty"`
	// Advisories maps advisory IDs to full advisory details.
	// This deduplicates advisory data when multiple packages share vulnerabilities.
	Advisories map[string]*v12.Advisory `` /* 147-byte string literal not displayed */
	// Stats summarizes vulnerability counts by severity.
	Stats *v12.Stats `protobuf:"bytes,7,opt,name=stats,proto3" json:"stats,omitempty"`
	// PolicyActions lists policy evaluation outcomes.
	PolicyActions []*v13.Action `protobuf:"bytes,8,rep,name=policy_actions,json=policyActions,proto3" json:"policy_actions,omitempty"`
	// Warnings contains non-fatal issues encountered during scanning.
	Warnings []string `protobuf:"bytes,9,rep,name=warnings,proto3" json:"warnings,omitempty"`
	// ImageInfo contains container image configuration when scanning images.
	ImageInfo *ImageInfo `protobuf:"bytes,10,opt,name=image_info,json=imageInfo,proto3" json:"image_info,omitempty"`
	// SecretFindings lists detected secrets when include_secrets is enabled.
	SecretFindings []*v14.Finding `protobuf:"bytes,11,rep,name=secret_findings,json=secretFindings,proto3" json:"secret_findings,omitempty"`
	// SecretStats summarizes secret scan results when include_secrets is enabled.
	SecretStats *v14.Stats `protobuf:"bytes,12,opt,name=secret_stats,json=secretStats,proto3" json:"secret_stats,omitempty"`
	// Graph contains the resolved dependency graph when graph_options.enabled is true.
	// Enables path-based analysis like "why is this vulnerable package in my dependencies?"
	Graph *DependencyGraph `protobuf:"bytes,13,opt,name=graph,proto3" json:"graph,omitempty"`
	// DockerfileInfo contains parsed Dockerfile data when scanning Dockerfiles.
	DockerfileInfo *v15.DockerfileInfo `protobuf:"bytes,14,opt,name=dockerfile_info,json=dockerfileInfo,proto3" json:"dockerfile_info,omitempty"`
	// contains filtered or unexported fields
}

type StreamScanRequest struct {

	// Target is the scan target (path, URL, image reference, etc.).
	// Maximum length prevents denial-of-service via excessively long strings.
	Target string `protobuf:"bytes,1,opt,name=target,proto3" json:"target,omitempty"`
	// Options configure scan behavior.
	Options *ScanOptions `protobuf:"bytes,2,opt,name=options,proto3" json:"options,omitempty"`
	// contains filtered or unexported fields
}

type TargetHint struct {

	// Kind explicitly specifies the target type.
	Kind v1.TargetKind `protobuf:"varint,1,opt,name=kind,proto3,enum=deputy.target.v1.TargetKind" json:"kind,omitempty"`
	// ImageTransport specifies how to fetch container images.
	// Only used when kind is TARGET_KIND_CONTAINER_IMAGE.
	// Values: "remote" (default), "daemon", "tarball", "oci-archive", "oci-layout".
	//
	// Security: "daemon", "tarball", "oci-archive", and "oci-layout" are only
	// available in in-process or local daemon mode. Remote servers reject these.
	ImageTransport string `protobuf:"bytes,2,opt,name=image_transport,json=imageTransport,proto3" json:"image_transport,omitempty"`
	// contains filtered or unexported fields
}