{
  "openapi": "3.1.1",
  "info": {
    "title": "minimal.dev packages API",
    "version": "4.0.0",
    "description": "Read-only agent surface for the minimal.dev package catalog. These endpoints exist for AI agents, integrations, and curl-driven exploration — the webapp itself renders the same data server-side, and both paths flow through the same compose pipeline so they cannot drift.\n\nEvery endpoint is GET. Responses fall into two classes:\n\n- **Sha-pinned, authenticated** — URLs under `/api/pkgs/bundle/{sha}/…` need a signed-in session and answer 401 without one; see each operation's 401 response. Their bodies are content-addressed by commit sha and never change for a given URL, but because they are gated they carry `Cache-Control: private, no-store` and must not be shared-cached. Short-sha canonicalization runs ahead of the gate, so the 301/400/404 arms are unchanged for every caller.\n- **Floats-latest** — URLs without a sha are anonymous and identity-invariant, resolving the latest `gominimal/pkgs:main` commit at request time (`Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400`).\n\nEvery JSON payload carries a `schemaVersion` field; compare it against the major version of this document before trusting a cached body.\n\nThe same catalog is also exposed as an MCP server (streamable HTTP) at `https://minimal.dev/api/mcp` — attach it with `claude mcp add --transport http minimal-pkgs https://minimal.dev/api/mcp` to get typed tools (search_packages, get_package, get_advisories, get_sbom, diff_catalog, …) that return payloads produced by the same helpers. It cannot present the session the sha-pinned endpoints above require, so passing a `sha` to any tool, or calling diff_catalog at all, returns an error result until token auth lands."
  },
  "servers": [
    {
      "url": "https://minimal.dev"
    }
  ],
  "paths": {
    "/api/pkgs/{name}.json": {
      "get": {
        "summary": "Per-package record at the latest commit",
        "description": "Full composed record for one package — description, deps, archive, full advisory payloads, OpenSSF scorecard — wrapped in the `{schemaVersion, commitSha, pushedAt, package}` envelope. Floats with the latest `gominimal/pkgs:main` commit (the `commitSha` is resolved at request time), so the cache class is floats-latest: `Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400`. Byte-identical to the `<script id=\"pkgs-detail\">` inline envelope on `/pkgs/<name>`. `transitiveAdvisories` is omitted (the BFS rollup is bundle-level; see `/api/pkgs/bundle/{sha}/full.json` for records that include it).",
        "parameters": [
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Per-package envelope at the latest commit.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PerPackagePayload"
                }
              }
            }
          },
          "404": {
            "description": "Unknown package name or charset-violating segment, or vulndb unavailable. `Cache-Control: private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/{name}/sbom.json": {
      "get": {
        "summary": "SBOM at the latest commit",
        "description": "Software bill of materials with the transitive build + runtime closure and a vulnerabilities block, for agents that want \"the SBOM as of now\". Default format is CycloneDX 1.5; `?format=spdx` returns SPDX 2.3 JSON. Floats with `lockStateLatest()`: `Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400`. For a reproducible point-in-time SBOM use the sha-pinned sibling `/api/pkgs/bundle/{sha}/{name}/sbom.json`.",
        "parameters": [
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          },
          {
            "name": "format",
            "in": "query",
            "required": false,
            "description": "SBOM format. `spdx` returns SPDX 2.3 JSON (`application/spdx+json`); anything else — including omitting the parameter — falls back to the CycloneDX 1.5 default (`application/vnd.cyclonedx+json`). Never 400s; the response `Content-Type` reflects the resolved format.",
            "schema": {
              "type": "string",
              "default": "cyclonedx"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "SBOM at the latest commit, in the format the `format` param resolved to.",
            "content": {
              "application/vnd.cyclonedx+json": {
                "schema": {
                  "$ref": "#/components/schemas/CycloneDxSbom"
                }
              },
              "application/spdx+json": {
                "schema": {
                  "$ref": "#/components/schemas/SpdxSbom"
                }
              }
            }
          },
          "404": {
            "description": "Unknown package name or charset-violating segment, or vulndb unavailable. `Cache-Control: private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/{name}/badge.svg": {
      "get": {
        "summary": "Score / advisory SVG badge",
        "description": "Shields-style flat SVG badge embeddable in a README/wiki/runbook via `![minimal score](https://minimal.dev/api/pkgs/{name}/badge.svg)`. The default `metric=score` renders the package's OpenSSF overall normalized to 0–100, colored by score band; `metric=advisories` renders the active direct-advisory count, colored by max active severity. Floats with `lockStateLatest()`: `Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400`. Composed via the same per-package path as `/api/pkgs/{name}.json`, so the badge numbers can't drift from the JSON record.",
        "parameters": [
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          },
          {
            "name": "metric",
            "in": "query",
            "required": false,
            "description": "Which metric the badge renders. `advisories` shows the active direct-advisory count; anything else — including omitting the parameter — falls back to the `score` default (the OpenSSF overall, normalized to 0–100). Never 400s.",
            "schema": {
              "type": "string",
              "enum": [
                "score",
                "advisories"
              ],
              "default": "score"
            }
          }
        ],
        "responses": {
          "200": {
            "description": "SVG badge for the resolved metric.",
            "content": {
              "image/svg+xml": {
                "schema": {
                  "$ref": "#/components/schemas/SvgBadge"
                }
              }
            }
          },
          "404": {
            "description": "Unknown package name or charset-violating segment, or vulndb unavailable. `Cache-Control: private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/recent-commits.json": {
      "get": {
        "summary": "Recent commits on gominimal/pkgs:main",
        "description": "Last N distinct commits, newest-first, each with its first-line commit subject (`message` is null when unrecoverable). Floats with the live `main` tip: a non-empty success carries `Cache-Control: public, max-age=60, s-maxage=3600, stale-while-revalidate=86400`. Degrades gracefully — an upstream error OR a genuinely empty history responds `200 []` with `Cache-Control: no-store` (never a 5xx), so an empty list is indistinguishable from a transient failure by design.",
        "parameters": [
          {
            "name": "limit",
            "in": "query",
            "required": false,
            "description": "Maximum commits to return. Defaults to 30; clamped into [1, 50]. Non-numeric values fall back to the default.",
            "schema": {
              "type": "integer",
              "minimum": 1,
              "maximum": 50,
              "default": 30
            }
          }
        ],
        "responses": {
          "200": {
            "description": "Recent commits, newest-first. Empty array on error or empty history.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/RecentCommitsPayload"
                }
              }
            }
          }
        }
      }
    },
    "/api/pkgs/bundle/latest.json": {
      "get": {
        "summary": "Redirect to the latest sha-pinned listing bundle",
        "description": "302-redirects to `/api/pkgs/bundle/{sha}.json` for the latest `gominimal/pkgs:main` commit. The short-cached alias (`Cache-Control: public, max-age=60`) keeps edge storage bounded — follow the redirect to fetch the bundle itself.\n\nThe alias itself is anonymous, but its target is one of the six auth-gated sha-pinned endpoints, so following the `Location` without a session answers 401.",
        "responses": {
          "302": {
            "description": "Redirect to the current sha-pinned listing bundle URL.",
            "headers": {
              "Location": {
                "description": "`/api/pkgs/bundle/<canonical-sha>.json` for the latest commit.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "404": {
            "description": "vulndb has no commits (preview env, fresh deploy), or vulndb unavailable. `Cache-Control: private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}.json": {
      "get": {
        "summary": "Listing-tier bundle at a sha",
        "description": "Card-only projection of every package at the given commit (name, version, categories, stars, slim advisories) plus the derived `allCategories`. Sha-keyed URLs are content-addressed, but the response is auth-gated and so uncacheable: `Cache-Control: private, no-store`. Byte-identical to the `<script id=\"pkgs-bundle\">` inline payload on `/pkgs/search`. For full per-package records at the same sha use `/api/pkgs/bundle/{sha}/full.json`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Listing-tier bundle at the requested sha.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PkgsListingBundle"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown or malformed sha, or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}/full.json": {
      "get": {
        "summary": "Full-tier bundle at a sha",
        "description": "Every composed package record at the given commit — description, deps, archive, full advisory payloads, and the BFS-derived `transitiveAdvisories` rollup that single-package compose paths can't compute. One request for everything at a snapshot instead of `1 + N` round-trips (listing bundle + per-package). Each `transitiveAdvisories` entry is a de-duped `{ advisoryId, culpritPath }` reference; resolve `advisoryId` against the response's top-level `advisories` map (advisory id → full object) to reconstitute the advisory. Auth-gated, so uncacheable: `Cache-Control: private, no-store`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Full-tier bundle at the requested sha.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/PkgsFullBundlePayload"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown or malformed sha, or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}/diff/{base}.json": {
      "get": {
        "summary": "Catalog diff between two commits",
        "description": "What changed in the catalog FROM `base` (older commit) TO `sha` (newer commit): packages added and removed, version upgrades, and advisory deltas (count changes and severity transitions, with `fromSeverity`). JSON twin of the `/pkgs/changes` HTML page — both project through the same `diffCatalog` helper, so they can't drift. The `(sha, base)` pair is content-addressed, but the response is auth-gated and so uncacheable: `Cache-Control: private, no-store`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          },
          {
            "name": "base",
            "in": "path",
            "required": true,
            "description": "The OLDER commit of the diff pair. Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main` — same grammar and canonicalization as `sha`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique (one segment per hop, so a doubly-short URL canonicalizes in at most two redirects); an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Catalog diff between the two requested commits.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/CatalogDiffPayload"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown sha or base, a malformed segment, or no lock state at either commit, or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}/{name}/deps.json": {
      "get": {
        "summary": "Direct dependencies of a package at a sha",
        "description": "The focal package's DIRECT build + runtime dependencies as of the given commit, each enriched with the dep's own version, license, and active-advisory rollup at that sha. Content-addressed by `(sha, name)`, but auth-gated and so uncacheable: `Cache-Control: private, no-store`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          },
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Enriched direct-dependency list at the requested sha.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/DepsPayload"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown sha, a charset-violating name segment, or the package has no lock-state row at this sha (unknown name, or a package that didn't exist yet at this commit), or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}/{name}/versions.json": {
      "get": {
        "summary": "Version-history timeline of a package at a sha",
        "description": "Every version the package has shipped up to (and including) the given commit, newest-first, with per-version file/line diff stats and dependency name sets. Content-addressed by `(sha, name)`, but auth-gated and so uncacheable: `Cache-Control: private, no-store`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          },
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "Version-history timeline at the requested sha.",
            "content": {
              "application/json": {
                "schema": {
                  "$ref": "#/components/schemas/VersionsPayload"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown sha, a charset-violating name segment, or a name with no history at this sha, or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    },
    "/api/pkgs/bundle/{sha}/{name}/sbom.json": {
      "get": {
        "summary": "SBOM at a sha (reproducible)",
        "description": "Sha-pinned software bill of materials — the reproducible point-in-time variant of `/api/pkgs/{name}/sbom.json`. Default format is CycloneDX 1.5; `?format=spdx` returns SPDX 2.3 JSON. `(sha, name, format)` is content-addressed (the ETag carries the format suffix so conditional GETs can't cross-talk between formats), but auth-gated and so uncacheable: `Cache-Control: private, no-store`.",
        "parameters": [
          {
            "name": "sha",
            "in": "path",
            "required": true,
            "description": "Canonical 40-hex lowercase commit sha on `gominimal/pkgs:main`. Short prefixes (7–39 hex chars) are accepted and 301-redirect to the canonical URL when unique; an ambiguous prefix returns 400, an unknown or malformed sha returns 404.",
            "schema": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            }
          },
          {
            "name": "name",
            "in": "path",
            "required": true,
            "description": "Package name. Charset per the `SAFE_NAME` rule (case-insensitive): a leading alphanumeric, then alphanumerics plus `.`, `_`, `-` (`^[a-z0-9][a-z0-9._-]*$` with the `i` flag). Violating segments return 404.",
            "schema": {
              "type": "string",
              "pattern": "^[a-zA-Z0-9][a-zA-Z0-9._-]*$"
            }
          },
          {
            "name": "format",
            "in": "query",
            "required": false,
            "description": "SBOM format. `spdx` returns SPDX 2.3 JSON (`application/spdx+json`); anything else — including omitting the parameter — falls back to the CycloneDX 1.5 default (`application/vnd.cyclonedx+json`). Never 400s; the response `Content-Type` reflects the resolved format.",
            "schema": {
              "type": "string",
              "default": "cyclonedx"
            }
          }
        ],
        "security": [
          {
            "sessionCookie": []
          }
        ],
        "responses": {
          "200": {
            "description": "SBOM at the requested sha, in the format the `format` param resolved to.",
            "content": {
              "application/vnd.cyclonedx+json": {
                "schema": {
                  "$ref": "#/components/schemas/CycloneDxSbom"
                }
              },
              "application/spdx+json": {
                "schema": {
                  "$ref": "#/components/schemas/SpdxSbom"
                }
              }
            }
          },
          "301": {
            "description": "Unique short-sha prefix — `Location` carries the canonical 40-hex URL (query params preserved). Cached `public, max-age=3600` for prefixes ≥12 hex chars, `private, no-store` for shorter ones.",
            "headers": {
              "Location": {
                "description": "Canonical 40-hex form of the requested URL.",
                "schema": {
                  "type": "string"
                }
              }
            }
          },
          "400": {
            "description": "Ambiguous short-sha prefix (matches more than one commit). Body: `{\"error\":\"ambiguous sha\"}`."
          },
          "401": {
            "description": "No signed-in session. Sign in at `https://minimal.dev/auth/login` and send the session cookie. Body: `{\"error\":\"auth_required\",\"message\":…}`, `Cache-Control: private, no-store`. No `WWW-Authenticate` challenge is offered — the credential is a cookie, not an HTTP auth scheme. The 301/400/404 canonicalization arms answer every caller unchanged."
          },
          "404": {
            "description": "Unknown sha, a charset-violating name segment, or an unknown package name at this sha, or vulndb unavailable. A well-formed-but-nonexistent sha (`miss`) carries `Cache-Control: public, max-age=0, s-maxage=300` (short edge negative-cache, #425); a malformed sha and every other 404 stay `private, no-store`."
          }
        }
      }
    }
  },
  "components": {
    "schemas": {
      "PerPackagePayload": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "commitSha": {
            "type": "string",
            "pattern": "^[a-f0-9]{40}$"
          },
          "pushedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
          },
          "package": {
            "type": "object",
            "properties": {
              "name": {
                "type": "string",
                "pattern": "^[a-z0-9][a-z0-9._-]*$"
              },
              "description": {
                "type": "string"
              },
              "homepage": {
                "type": "string",
                "format": "uri"
              },
              "githubStars": {
                "type": "number"
              },
              "githubTopics": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "githubLastPush": {
                "type": "string",
                "format": "date-time",
                "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
              },
              "ownerAvatar": {
                "type": "string",
                "format": "uri"
              },
              "isPrebuilt": {
                "type": "boolean"
              },
              "isCollection": {
                "type": "boolean"
              },
              "sourceUrl": {
                "type": "string",
                "format": "uri"
              },
              "sourceCategory": {
                "type": "string",
                "enum": [
                  "GithubRepo",
                  "Gitlab",
                  "GnuProject",
                  "Sourceforge",
                  "Website"
                ]
              },
              "sourceOwner": {
                "type": "string"
              },
              "sourceRepo": {
                "type": "string"
              },
              "sourceName": {
                "type": "string"
              },
              "repologyProject": {
                "type": "string"
              },
              "categories": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "runtimeSubsetOfDeps": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "outputs": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    }
                  },
                  "required": [
                    "name",
                    "outputs"
                  ],
                  "additionalProperties": false
                }
              },
              "buildSubsetOfDeps": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "outputs": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    }
                  },
                  "required": [
                    "name",
                    "outputs"
                  ],
                  "additionalProperties": false
                }
              },
              "outputs": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "type": {
                      "type": "string",
                      "enum": [
                        "binary",
                        "library",
                        "data"
                      ]
                    }
                  },
                  "required": [
                    "name",
                    "type"
                  ],
                  "additionalProperties": false
                }
              },
              "version": {
                "type": "string"
              },
              "specHash": {
                "type": "string"
              },
              "sourceArchive": {
                "type": "object",
                "properties": {
                  "url": {
                    "type": "string",
                    "format": "uri"
                  },
                  "sha256": {
                    "type": "string"
                  }
                },
                "required": [
                  "url",
                  "sha256"
                ],
                "additionalProperties": false
              },
              "buildDepCount": {
                "type": "integer",
                "minimum": 0,
                "maximum": 9007199254740991
              },
              "runtimeDepCount": {
                "type": "integer",
                "minimum": 0,
                "maximum": 9007199254740991
              },
              "buildDepNames": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "runtimeDepNames": {
                "type": "array",
                "items": {
                  "type": "string"
                }
              },
              "advisories": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "id": {
                      "type": "string"
                    },
                    "aliases": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "severity": {
                      "type": "string",
                      "enum": [
                        "CRITICAL",
                        "HIGH",
                        "MEDIUM",
                        "LOW",
                        "UNKNOWN"
                      ]
                    },
                    "cvssScore": {
                      "anyOf": [
                        {
                          "type": "number"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "cvssVector": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "summary": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "published": {
                      "anyOf": [
                        {
                          "type": "string",
                          "format": "date-time",
                          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "modified": {
                      "anyOf": [
                        {
                          "type": "string",
                          "format": "date-time",
                          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "ingestedAt": {
                      "anyOf": [
                        {
                          "type": "string",
                          "format": "date-time",
                          "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "references": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "type": {
                            "type": "string"
                          },
                          "url": {
                            "type": "string",
                            "format": "uri"
                          }
                        },
                        "required": [
                          "type",
                          "url"
                        ],
                        "additionalProperties": false
                      }
                    },
                    "fixedVersion": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "fixStatus": {
                      "anyOf": [
                        {
                          "type": "string",
                          "enum": [
                            "fixed",
                            "unfixed_by_design",
                            "unknown_fix"
                          ]
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "affectedRanges": {
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    },
                    "vulnerableVersionRange": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "affectedPackage": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string"
                        },
                        "version": {
                          "type": "string"
                        },
                        "state": {
                          "type": "string",
                          "const": "affected"
                        },
                        "lifecycle": {
                          "anyOf": [
                            {
                              "type": "object",
                              "properties": {
                                "firstDetectedVersion": {
                                  "type": "string"
                                },
                                "lastDetectedVersion": {
                                  "type": "string"
                                },
                                "status": {
                                  "type": "string",
                                  "enum": [
                                    "under_investigation",
                                    "resolved"
                                  ]
                                },
                                "resolvedAtVersion": {
                                  "anyOf": [
                                    {
                                      "type": "string"
                                    },
                                    {
                                      "type": "null"
                                    }
                                  ]
                                }
                              },
                              "required": [
                                "status"
                              ],
                              "additionalProperties": false
                            },
                            {
                              "type": "null"
                            }
                          ]
                        }
                      },
                      "required": [
                        "name",
                        "version",
                        "state",
                        "lifecycle"
                      ],
                      "additionalProperties": false
                    }
                  },
                  "required": [
                    "id",
                    "aliases",
                    "severity",
                    "cvssScore",
                    "cvssVector",
                    "summary",
                    "published",
                    "modified",
                    "references",
                    "fixedVersion",
                    "fixStatus",
                    "affectedRanges",
                    "vulnerableVersionRange",
                    "affectedPackage"
                  ],
                  "additionalProperties": false
                }
              },
              "transitiveAdvisories": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "advisory": {
                      "type": "object",
                      "properties": {
                        "id": {
                          "type": "string"
                        },
                        "aliases": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        },
                        "severity": {
                          "type": "string",
                          "enum": [
                            "CRITICAL",
                            "HIGH",
                            "MEDIUM",
                            "LOW",
                            "UNKNOWN"
                          ]
                        },
                        "cvssScore": {
                          "anyOf": [
                            {
                              "type": "number"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "cvssVector": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "summary": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "published": {
                          "anyOf": [
                            {
                              "type": "string",
                              "format": "date-time",
                              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "modified": {
                          "anyOf": [
                            {
                              "type": "string",
                              "format": "date-time",
                              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "ingestedAt": {
                          "anyOf": [
                            {
                              "type": "string",
                              "format": "date-time",
                              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "references": {
                          "type": "array",
                          "items": {
                            "type": "object",
                            "properties": {
                              "type": {
                                "type": "string"
                              },
                              "url": {
                                "type": "string",
                                "format": "uri"
                              }
                            },
                            "required": [
                              "type",
                              "url"
                            ],
                            "additionalProperties": false
                          }
                        },
                        "fixedVersion": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "fixStatus": {
                          "anyOf": [
                            {
                              "type": "string",
                              "enum": [
                                "fixed",
                                "unfixed_by_design",
                                "unknown_fix"
                              ]
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "affectedRanges": {
                          "type": "array",
                          "items": {
                            "type": "string"
                          }
                        },
                        "vulnerableVersionRange": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "affectedPackage": {
                          "type": "object",
                          "properties": {
                            "name": {
                              "type": "string"
                            },
                            "version": {
                              "type": "string"
                            },
                            "state": {
                              "type": "string",
                              "const": "affected"
                            },
                            "lifecycle": {
                              "anyOf": [
                                {
                                  "type": "object",
                                  "properties": {
                                    "firstDetectedVersion": {
                                      "type": "string"
                                    },
                                    "lastDetectedVersion": {
                                      "type": "string"
                                    },
                                    "status": {
                                      "type": "string",
                                      "enum": [
                                        "under_investigation",
                                        "resolved"
                                      ]
                                    },
                                    "resolvedAtVersion": {
                                      "anyOf": [
                                        {
                                          "type": "string"
                                        },
                                        {
                                          "type": "null"
                                        }
                                      ]
                                    }
                                  },
                                  "required": [
                                    "status"
                                  ],
                                  "additionalProperties": false
                                },
                                {
                                  "type": "null"
                                }
                              ]
                            }
                          },
                          "required": [
                            "name",
                            "version",
                            "state",
                            "lifecycle"
                          ],
                          "additionalProperties": false
                        }
                      },
                      "required": [
                        "id",
                        "aliases",
                        "severity",
                        "cvssScore",
                        "cvssVector",
                        "summary",
                        "published",
                        "modified",
                        "references",
                        "fixedVersion",
                        "fixStatus",
                        "affectedRanges",
                        "vulnerableVersionRange",
                        "affectedPackage"
                      ],
                      "additionalProperties": false
                    },
                    "culpritPath": {
                      "minItems": 1,
                      "type": "array",
                      "items": {
                        "type": "string"
                      }
                    }
                  },
                  "required": [
                    "advisory",
                    "culpritPath"
                  ],
                  "additionalProperties": false
                }
              },
              "categoryScores": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "id": {
                      "type": "string",
                      "enum": [
                        "supply-chain",
                        "advisories",
                        "quality",
                        "maintenance",
                        "licence"
                      ]
                    },
                    "value": {
                      "anyOf": [
                        {
                          "type": "number"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "band": {
                      "type": "string",
                      "enum": [
                        "perfect",
                        "good",
                        "mid",
                        "low",
                        "na"
                      ]
                    },
                    "checks": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string"
                          },
                          "value": {
                            "anyOf": [
                              {
                                "type": "number"
                              },
                              {
                                "type": "null"
                              }
                            ]
                          },
                          "rawScore": {
                            "anyOf": [
                              {
                                "type": "number"
                              },
                              {
                                "type": "null"
                              }
                            ]
                          },
                          "reason": {
                            "type": "string"
                          }
                        },
                        "required": [
                          "name",
                          "value",
                          "rawScore",
                          "reason"
                        ],
                        "additionalProperties": false
                      }
                    },
                    "advisoryBreakdown": {
                      "type": "object",
                      "properties": {
                        "direct": {
                          "type": "object",
                          "properties": {
                            "activeCount": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 9007199254740991
                            },
                            "activeBySeverity": {
                              "type": "object",
                              "properties": {
                                "CRITICAL": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "HIGH": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "MEDIUM": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "LOW": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "UNKNOWN": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                }
                              },
                              "required": [
                                "CRITICAL",
                                "HIGH",
                                "MEDIUM",
                                "LOW",
                                "UNKNOWN"
                              ],
                              "additionalProperties": false
                            }
                          },
                          "required": [
                            "activeCount",
                            "activeBySeverity"
                          ],
                          "additionalProperties": false
                        },
                        "transitive": {
                          "type": "object",
                          "properties": {
                            "activeCount": {
                              "type": "integer",
                              "minimum": 0,
                              "maximum": 9007199254740991
                            },
                            "activeBySeverity": {
                              "type": "object",
                              "properties": {
                                "CRITICAL": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "HIGH": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "MEDIUM": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "LOW": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                },
                                "UNKNOWN": {
                                  "type": "integer",
                                  "minimum": 0,
                                  "maximum": 9007199254740991
                                }
                              },
                              "required": [
                                "CRITICAL",
                                "HIGH",
                                "MEDIUM",
                                "LOW",
                                "UNKNOWN"
                              ],
                              "additionalProperties": false
                            }
                          },
                          "required": [
                            "activeCount",
                            "activeBySeverity"
                          ],
                          "additionalProperties": false
                        }
                      },
                      "required": [
                        "direct",
                        "transitive"
                      ],
                      "additionalProperties": false
                    }
                  },
                  "required": [
                    "id",
                    "value",
                    "band",
                    "checks"
                  ],
                  "additionalProperties": false
                }
              },
              "scorecard": {
                "type": "object",
                "properties": {
                  "overall": {
                    "anyOf": [
                      {
                        "type": "number"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "date": {
                    "anyOf": [
                      {
                        "type": "string"
                      },
                      {
                        "type": "null"
                      }
                    ]
                  },
                  "checks": {
                    "type": "array",
                    "items": {
                      "type": "object",
                      "properties": {
                        "name": {
                          "type": "string"
                        },
                        "score": {
                          "type": "number"
                        },
                        "reason": {
                          "type": "string"
                        }
                      },
                      "required": [
                        "name",
                        "score",
                        "reason"
                      ],
                      "additionalProperties": false
                    }
                  },
                  "source": {
                    "type": "string"
                  },
                  "secondaryScore": {
                    "type": "object",
                    "properties": {
                      "label": {
                        "type": "string"
                      },
                      "value": {
                        "type": "number"
                      },
                      "max": {
                        "type": "number"
                      }
                    },
                    "required": [
                      "label",
                      "value",
                      "max"
                    ],
                    "additionalProperties": false
                  },
                  "license": {
                    "type": "object",
                    "properties": {
                      "spdx": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "isOsiApproved": {
                        "anyOf": [
                          {
                            "type": "boolean"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "spdxUrl": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      }
                    },
                    "required": [
                      "spdx",
                      "isOsiApproved",
                      "spdxUrl"
                    ],
                    "additionalProperties": false
                  },
                  "isEol": {
                    "type": "boolean"
                  }
                },
                "required": [
                  "overall",
                  "date",
                  "checks"
                ],
                "additionalProperties": false
              }
            },
            "required": [
              "name",
              "isPrebuilt",
              "isCollection",
              "categories",
              "outputs",
              "buildDepCount",
              "runtimeDepCount",
              "buildDepNames",
              "runtimeDepNames"
            ],
            "additionalProperties": false
          }
        },
        "required": [
          "schemaVersion",
          "commitSha",
          "pushedAt",
          "package"
        ],
        "additionalProperties": false
      },
      "PkgsListingBundle": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "commitSha": {
            "type": "string",
            "pattern": "^[a-f0-9]{40}$"
          },
          "pushedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
          },
          "packages": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "pattern": "^[a-z0-9][a-z0-9._-]*$"
                },
                "version": {
                  "type": "string"
                },
                "categories": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "githubTopics": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "githubStars": {
                  "type": "number"
                },
                "githubLastPush": {
                  "type": "string",
                  "format": "date-time",
                  "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                },
                "ownerAvatar": {
                  "type": "string",
                  "format": "uri"
                },
                "isPrebuilt": {
                  "type": "boolean"
                },
                "advisories": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "id": {
                        "type": "string"
                      },
                      "severity": {
                        "type": "string",
                        "enum": [
                          "CRITICAL",
                          "HIGH",
                          "MEDIUM",
                          "LOW",
                          "UNKNOWN"
                        ]
                      },
                      "fixStatus": {
                        "anyOf": [
                          {
                            "type": "string",
                            "enum": [
                              "fixed",
                              "unfixed_by_design",
                              "unknown_fix"
                            ]
                          },
                          {
                            "type": "null"
                          }
                        ]
                      }
                    },
                    "required": [
                      "id",
                      "severity",
                      "fixStatus"
                    ],
                    "additionalProperties": false
                  }
                },
                "activeAdvisoryCount": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 9007199254740991
                },
                "maxActiveSeverity": {
                  "anyOf": [
                    {
                      "type": "string",
                      "enum": [
                        "CRITICAL",
                        "HIGH",
                        "MEDIUM",
                        "LOW",
                        "UNKNOWN"
                      ]
                    },
                    {
                      "type": "null"
                    }
                  ]
                }
              },
              "required": [
                "name",
                "categories",
                "isPrebuilt",
                "advisories",
                "activeAdvisoryCount",
                "maxActiveSeverity"
              ],
              "additionalProperties": false
            }
          },
          "allCategories": {
            "type": "array",
            "items": {
              "type": "string"
            }
          }
        },
        "required": [
          "schemaVersion",
          "commitSha",
          "pushedAt",
          "packages",
          "allCategories"
        ],
        "additionalProperties": false
      },
      "PkgsFullBundlePayload": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "commitSha": {
            "type": "string",
            "pattern": "^[a-f0-9]{40}$"
          },
          "pushedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
          },
          "packages": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string",
                  "pattern": "^[a-z0-9][a-z0-9._-]*$"
                },
                "description": {
                  "type": "string"
                },
                "homepage": {
                  "type": "string",
                  "format": "uri"
                },
                "githubStars": {
                  "type": "number"
                },
                "githubTopics": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "githubLastPush": {
                  "type": "string",
                  "format": "date-time",
                  "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                },
                "ownerAvatar": {
                  "type": "string",
                  "format": "uri"
                },
                "isPrebuilt": {
                  "type": "boolean"
                },
                "isCollection": {
                  "type": "boolean"
                },
                "sourceUrl": {
                  "type": "string",
                  "format": "uri"
                },
                "sourceCategory": {
                  "type": "string",
                  "enum": [
                    "GithubRepo",
                    "Gitlab",
                    "GnuProject",
                    "Sourceforge",
                    "Website"
                  ]
                },
                "sourceOwner": {
                  "type": "string"
                },
                "sourceRepo": {
                  "type": "string"
                },
                "sourceName": {
                  "type": "string"
                },
                "repologyProject": {
                  "type": "string"
                },
                "categories": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "runtimeSubsetOfDeps": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string"
                      },
                      "outputs": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    },
                    "required": [
                      "name",
                      "outputs"
                    ],
                    "additionalProperties": false
                  }
                },
                "buildSubsetOfDeps": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string"
                      },
                      "outputs": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    },
                    "required": [
                      "name",
                      "outputs"
                    ],
                    "additionalProperties": false
                  }
                },
                "outputs": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "name": {
                        "type": "string"
                      },
                      "type": {
                        "type": "string",
                        "enum": [
                          "binary",
                          "library",
                          "data"
                        ]
                      }
                    },
                    "required": [
                      "name",
                      "type"
                    ],
                    "additionalProperties": false
                  }
                },
                "version": {
                  "type": "string"
                },
                "specHash": {
                  "type": "string"
                },
                "sourceArchive": {
                  "type": "object",
                  "properties": {
                    "url": {
                      "type": "string",
                      "format": "uri"
                    },
                    "sha256": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "url",
                    "sha256"
                  ],
                  "additionalProperties": false
                },
                "buildDepCount": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 9007199254740991
                },
                "runtimeDepCount": {
                  "type": "integer",
                  "minimum": 0,
                  "maximum": 9007199254740991
                },
                "buildDepNames": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "runtimeDepNames": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "advisories": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "id": {
                        "type": "string"
                      },
                      "aliases": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      },
                      "severity": {
                        "type": "string",
                        "enum": [
                          "CRITICAL",
                          "HIGH",
                          "MEDIUM",
                          "LOW",
                          "UNKNOWN"
                        ]
                      },
                      "cvssScore": {
                        "anyOf": [
                          {
                            "type": "number"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "cvssVector": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "summary": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "published": {
                        "anyOf": [
                          {
                            "type": "string",
                            "format": "date-time",
                            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "modified": {
                        "anyOf": [
                          {
                            "type": "string",
                            "format": "date-time",
                            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "ingestedAt": {
                        "anyOf": [
                          {
                            "type": "string",
                            "format": "date-time",
                            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "references": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "properties": {
                            "type": {
                              "type": "string"
                            },
                            "url": {
                              "type": "string",
                              "format": "uri"
                            }
                          },
                          "required": [
                            "type",
                            "url"
                          ],
                          "additionalProperties": false
                        }
                      },
                      "fixedVersion": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "fixStatus": {
                        "anyOf": [
                          {
                            "type": "string",
                            "enum": [
                              "fixed",
                              "unfixed_by_design",
                              "unknown_fix"
                            ]
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "affectedRanges": {
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      },
                      "vulnerableVersionRange": {
                        "anyOf": [
                          {
                            "type": "string"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "affectedPackage": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string"
                          },
                          "version": {
                            "type": "string"
                          },
                          "state": {
                            "type": "string",
                            "const": "affected"
                          },
                          "lifecycle": {
                            "anyOf": [
                              {
                                "type": "object",
                                "properties": {
                                  "firstDetectedVersion": {
                                    "type": "string"
                                  },
                                  "lastDetectedVersion": {
                                    "type": "string"
                                  },
                                  "status": {
                                    "type": "string",
                                    "enum": [
                                      "under_investigation",
                                      "resolved"
                                    ]
                                  },
                                  "resolvedAtVersion": {
                                    "anyOf": [
                                      {
                                        "type": "string"
                                      },
                                      {
                                        "type": "null"
                                      }
                                    ]
                                  }
                                },
                                "required": [
                                  "status"
                                ],
                                "additionalProperties": false
                              },
                              {
                                "type": "null"
                              }
                            ]
                          }
                        },
                        "required": [
                          "name",
                          "version",
                          "state",
                          "lifecycle"
                        ],
                        "additionalProperties": false
                      }
                    },
                    "required": [
                      "id",
                      "aliases",
                      "severity",
                      "cvssScore",
                      "cvssVector",
                      "summary",
                      "published",
                      "modified",
                      "references",
                      "fixedVersion",
                      "fixStatus",
                      "affectedRanges",
                      "vulnerableVersionRange",
                      "affectedPackage"
                    ],
                    "additionalProperties": false
                  }
                },
                "transitiveAdvisories": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "advisoryId": {
                        "type": "string"
                      },
                      "culpritPath": {
                        "minItems": 1,
                        "type": "array",
                        "items": {
                          "type": "string"
                        }
                      }
                    },
                    "required": [
                      "advisoryId",
                      "culpritPath"
                    ],
                    "additionalProperties": false
                  }
                },
                "categoryScores": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "id": {
                        "type": "string",
                        "enum": [
                          "supply-chain",
                          "advisories",
                          "quality",
                          "maintenance",
                          "licence"
                        ]
                      },
                      "value": {
                        "anyOf": [
                          {
                            "type": "number"
                          },
                          {
                            "type": "null"
                          }
                        ]
                      },
                      "band": {
                        "type": "string",
                        "enum": [
                          "perfect",
                          "good",
                          "mid",
                          "low",
                          "na"
                        ]
                      },
                      "checks": {
                        "type": "array",
                        "items": {
                          "type": "object",
                          "properties": {
                            "name": {
                              "type": "string"
                            },
                            "value": {
                              "anyOf": [
                                {
                                  "type": "number"
                                },
                                {
                                  "type": "null"
                                }
                              ]
                            },
                            "rawScore": {
                              "anyOf": [
                                {
                                  "type": "number"
                                },
                                {
                                  "type": "null"
                                }
                              ]
                            },
                            "reason": {
                              "type": "string"
                            }
                          },
                          "required": [
                            "name",
                            "value",
                            "rawScore",
                            "reason"
                          ],
                          "additionalProperties": false
                        }
                      },
                      "advisoryBreakdown": {
                        "type": "object",
                        "properties": {
                          "direct": {
                            "type": "object",
                            "properties": {
                              "activeCount": {
                                "type": "integer",
                                "minimum": 0,
                                "maximum": 9007199254740991
                              },
                              "activeBySeverity": {
                                "type": "object",
                                "properties": {
                                  "CRITICAL": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "HIGH": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "MEDIUM": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "LOW": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "UNKNOWN": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  }
                                },
                                "required": [
                                  "CRITICAL",
                                  "HIGH",
                                  "MEDIUM",
                                  "LOW",
                                  "UNKNOWN"
                                ],
                                "additionalProperties": false
                              }
                            },
                            "required": [
                              "activeCount",
                              "activeBySeverity"
                            ],
                            "additionalProperties": false
                          },
                          "transitive": {
                            "type": "object",
                            "properties": {
                              "activeCount": {
                                "type": "integer",
                                "minimum": 0,
                                "maximum": 9007199254740991
                              },
                              "activeBySeverity": {
                                "type": "object",
                                "properties": {
                                  "CRITICAL": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "HIGH": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "MEDIUM": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "LOW": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  },
                                  "UNKNOWN": {
                                    "type": "integer",
                                    "minimum": 0,
                                    "maximum": 9007199254740991
                                  }
                                },
                                "required": [
                                  "CRITICAL",
                                  "HIGH",
                                  "MEDIUM",
                                  "LOW",
                                  "UNKNOWN"
                                ],
                                "additionalProperties": false
                              }
                            },
                            "required": [
                              "activeCount",
                              "activeBySeverity"
                            ],
                            "additionalProperties": false
                          }
                        },
                        "required": [
                          "direct",
                          "transitive"
                        ],
                        "additionalProperties": false
                      }
                    },
                    "required": [
                      "id",
                      "value",
                      "band",
                      "checks"
                    ],
                    "additionalProperties": false
                  }
                },
                "scorecard": {
                  "type": "object",
                  "properties": {
                    "overall": {
                      "anyOf": [
                        {
                          "type": "number"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "date": {
                      "anyOf": [
                        {
                          "type": "string"
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "checks": {
                      "type": "array",
                      "items": {
                        "type": "object",
                        "properties": {
                          "name": {
                            "type": "string"
                          },
                          "score": {
                            "type": "number"
                          },
                          "reason": {
                            "type": "string"
                          }
                        },
                        "required": [
                          "name",
                          "score",
                          "reason"
                        ],
                        "additionalProperties": false
                      }
                    },
                    "source": {
                      "type": "string"
                    },
                    "secondaryScore": {
                      "type": "object",
                      "properties": {
                        "label": {
                          "type": "string"
                        },
                        "value": {
                          "type": "number"
                        },
                        "max": {
                          "type": "number"
                        }
                      },
                      "required": [
                        "label",
                        "value",
                        "max"
                      ],
                      "additionalProperties": false
                    },
                    "license": {
                      "type": "object",
                      "properties": {
                        "spdx": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "isOsiApproved": {
                          "anyOf": [
                            {
                              "type": "boolean"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        },
                        "spdxUrl": {
                          "anyOf": [
                            {
                              "type": "string"
                            },
                            {
                              "type": "null"
                            }
                          ]
                        }
                      },
                      "required": [
                        "spdx",
                        "isOsiApproved",
                        "spdxUrl"
                      ],
                      "additionalProperties": false
                    },
                    "isEol": {
                      "type": "boolean"
                    }
                  },
                  "required": [
                    "overall",
                    "date",
                    "checks"
                  ],
                  "additionalProperties": false
                }
              },
              "required": [
                "name",
                "isPrebuilt",
                "isCollection",
                "categories",
                "outputs",
                "buildDepCount",
                "runtimeDepCount",
                "buildDepNames",
                "runtimeDepNames"
              ],
              "additionalProperties": false
            }
          },
          "advisories": {
            "type": "object",
            "propertyNames": {
              "type": "string"
            },
            "additionalProperties": {
              "type": "object",
              "properties": {
                "id": {
                  "type": "string"
                },
                "aliases": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "severity": {
                  "type": "string",
                  "enum": [
                    "CRITICAL",
                    "HIGH",
                    "MEDIUM",
                    "LOW",
                    "UNKNOWN"
                  ]
                },
                "cvssScore": {
                  "anyOf": [
                    {
                      "type": "number"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "cvssVector": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "summary": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "published": {
                  "anyOf": [
                    {
                      "type": "string",
                      "format": "date-time",
                      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "modified": {
                  "anyOf": [
                    {
                      "type": "string",
                      "format": "date-time",
                      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "ingestedAt": {
                  "anyOf": [
                    {
                      "type": "string",
                      "format": "date-time",
                      "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "references": {
                  "type": "array",
                  "items": {
                    "type": "object",
                    "properties": {
                      "type": {
                        "type": "string"
                      },
                      "url": {
                        "type": "string",
                        "format": "uri"
                      }
                    },
                    "required": [
                      "type",
                      "url"
                    ],
                    "additionalProperties": false
                  }
                },
                "fixedVersion": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "fixStatus": {
                  "anyOf": [
                    {
                      "type": "string",
                      "enum": [
                        "fixed",
                        "unfixed_by_design",
                        "unknown_fix"
                      ]
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "affectedRanges": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "vulnerableVersionRange": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "affectedPackage": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "version": {
                      "type": "string"
                    },
                    "state": {
                      "type": "string",
                      "const": "affected"
                    },
                    "lifecycle": {
                      "anyOf": [
                        {
                          "type": "object",
                          "properties": {
                            "firstDetectedVersion": {
                              "type": "string"
                            },
                            "lastDetectedVersion": {
                              "type": "string"
                            },
                            "status": {
                              "type": "string",
                              "enum": [
                                "under_investigation",
                                "resolved"
                              ]
                            },
                            "resolvedAtVersion": {
                              "anyOf": [
                                {
                                  "type": "string"
                                },
                                {
                                  "type": "null"
                                }
                              ]
                            }
                          },
                          "required": [
                            "status"
                          ],
                          "additionalProperties": false
                        },
                        {
                          "type": "null"
                        }
                      ]
                    }
                  },
                  "required": [
                    "name",
                    "version",
                    "state",
                    "lifecycle"
                  ],
                  "additionalProperties": false
                }
              },
              "required": [
                "id",
                "aliases",
                "severity",
                "cvssScore",
                "cvssVector",
                "summary",
                "published",
                "modified",
                "references",
                "fixedVersion",
                "fixStatus",
                "affectedRanges",
                "vulnerableVersionRange",
                "affectedPackage"
              ],
              "additionalProperties": false
            }
          }
        },
        "required": [
          "schemaVersion",
          "commitSha",
          "pushedAt",
          "packages",
          "advisories"
        ],
        "additionalProperties": false
      },
      "CatalogDiffPayload": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "fromSha": {
            "type": "string",
            "pattern": "^[a-f0-9]{40}$"
          },
          "toSha": {
            "type": "string",
            "pattern": "^[a-f0-9]{40}$"
          },
          "fromPushedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
          },
          "toPushedAt": {
            "type": "string",
            "format": "date-time",
            "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
          },
          "diff": {
            "type": "object",
            "properties": {
              "added": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "version": {
                      "type": "string"
                    },
                    "activeAdvisoryCount": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 9007199254740991
                    },
                    "maxActiveSeverity": {
                      "anyOf": [
                        {
                          "type": "string",
                          "enum": [
                            "CRITICAL",
                            "HIGH",
                            "MEDIUM",
                            "LOW",
                            "UNKNOWN"
                          ]
                        },
                        {
                          "type": "null"
                        }
                      ]
                    }
                  },
                  "required": [
                    "name",
                    "activeAdvisoryCount",
                    "maxActiveSeverity"
                  ],
                  "additionalProperties": false
                }
              },
              "removed": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "version": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "name"
                  ],
                  "additionalProperties": false
                }
              },
              "upgraded": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "fromVersion": {
                      "type": "string"
                    },
                    "toVersion": {
                      "type": "string"
                    }
                  },
                  "required": [
                    "name"
                  ],
                  "additionalProperties": false
                }
              },
              "advisoryChanges": {
                "type": "array",
                "items": {
                  "type": "object",
                  "properties": {
                    "name": {
                      "type": "string"
                    },
                    "fromCount": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 9007199254740991
                    },
                    "toCount": {
                      "type": "integer",
                      "minimum": 0,
                      "maximum": 9007199254740991
                    },
                    "fromSeverity": {
                      "anyOf": [
                        {
                          "type": "string",
                          "enum": [
                            "CRITICAL",
                            "HIGH",
                            "MEDIUM",
                            "LOW",
                            "UNKNOWN"
                          ]
                        },
                        {
                          "type": "null"
                        }
                      ]
                    },
                    "maxActiveSeverity": {
                      "anyOf": [
                        {
                          "type": "string",
                          "enum": [
                            "CRITICAL",
                            "HIGH",
                            "MEDIUM",
                            "LOW",
                            "UNKNOWN"
                          ]
                        },
                        {
                          "type": "null"
                        }
                      ]
                    }
                  },
                  "required": [
                    "name",
                    "fromCount",
                    "toCount",
                    "fromSeverity",
                    "maxActiveSeverity"
                  ],
                  "additionalProperties": false
                }
              },
              "totals": {
                "type": "object",
                "properties": {
                  "added": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 9007199254740991
                  },
                  "removed": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 9007199254740991
                  },
                  "upgraded": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 9007199254740991
                  },
                  "advisoryChanges": {
                    "type": "integer",
                    "minimum": 0,
                    "maximum": 9007199254740991
                  }
                },
                "required": [
                  "added",
                  "removed",
                  "upgraded",
                  "advisoryChanges"
                ],
                "additionalProperties": false
              }
            },
            "required": [
              "added",
              "removed",
              "upgraded",
              "advisoryChanges",
              "totals"
            ],
            "additionalProperties": false
          }
        },
        "required": [
          "schemaVersion",
          "fromSha",
          "toSha",
          "fromPushedAt",
          "toPushedAt",
          "diff"
        ],
        "additionalProperties": false
      },
      "DepsPayload": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "commitSha": {
            "type": "string"
          },
          "pkgName": {
            "type": "string"
          },
          "version": {
            "anyOf": [
              {
                "type": "string"
              },
              {
                "type": "null"
              }
            ]
          },
          "dependencies": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "name": {
                  "type": "string"
                },
                "kind": {
                  "type": "string",
                  "enum": [
                    "build",
                    "runtime",
                    "both"
                  ]
                },
                "version": {
                  "type": "string"
                },
                "license": {
                  "anyOf": [
                    {
                      "type": "string"
                    },
                    {
                      "type": "null"
                    }
                  ]
                },
                "activeAdvisoryCount": {
                  "type": "number"
                },
                "maxActiveSeverity": {
                  "anyOf": [
                    {
                      "type": "string",
                      "enum": [
                        "CRITICAL",
                        "HIGH",
                        "MEDIUM",
                        "LOW",
                        "UNKNOWN"
                      ]
                    },
                    {
                      "type": "null"
                    }
                  ]
                }
              },
              "required": [
                "name",
                "kind",
                "activeAdvisoryCount",
                "maxActiveSeverity"
              ],
              "additionalProperties": false
            }
          }
        },
        "required": [
          "schemaVersion",
          "commitSha",
          "pkgName",
          "version",
          "dependencies"
        ],
        "additionalProperties": false
      },
      "VersionsPayload": {
        "type": "object",
        "properties": {
          "schemaVersion": {
            "type": "number",
            "const": 4
          },
          "commitSha": {
            "type": "string"
          },
          "pkgName": {
            "type": "string"
          },
          "versions": {
            "type": "array",
            "items": {
              "type": "object",
              "properties": {
                "sha": {
                  "type": "string"
                },
                "version": {
                  "type": "string"
                },
                "committedAt": {
                  "type": "string",
                  "format": "date-time",
                  "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
                },
                "filesChanged": {
                  "type": "number"
                },
                "linesAdded": {
                  "type": "number"
                },
                "linesRemoved": {
                  "type": "number"
                },
                "buildDepNames": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                },
                "runtimeDepNames": {
                  "type": "array",
                  "items": {
                    "type": "string"
                  }
                }
              },
              "required": [
                "sha",
                "version",
                "committedAt"
              ],
              "additionalProperties": false
            }
          }
        },
        "required": [
          "schemaVersion",
          "commitSha",
          "pkgName",
          "versions"
        ],
        "additionalProperties": false
      },
      "RecentCommitsPayload": {
        "type": "array",
        "items": {
          "type": "object",
          "properties": {
            "sha": {
              "type": "string",
              "pattern": "^[0-9a-f]{40}$"
            },
            "message": {
              "anyOf": [
                {
                  "type": "string"
                },
                {
                  "type": "null"
                }
              ]
            },
            "committedAt": {
              "type": "string",
              "format": "date-time",
              "pattern": "^(?:(?:\\d\\d[2468][048]|\\d\\d[13579][26]|\\d\\d0[48]|[02468][048]00|[13579][26]00)-02-29|\\d{4}-(?:(?:0[13578]|1[02])-(?:0[1-9]|[12]\\d|3[01])|(?:0[469]|11)-(?:0[1-9]|[12]\\d|30)|(?:02)-(?:0[1-9]|1\\d|2[0-8])))T(?:(?:[01]\\d|2[0-3]):[0-5]\\d(?::[0-5]\\d(?:\\.\\d+)?)?(?:Z))$"
            }
          },
          "required": [
            "sha",
            "message",
            "committedAt"
          ],
          "additionalProperties": false
        }
      },
      "CycloneDxSbom": {
        "type": "object",
        "description": "CycloneDX 1.5 BOM with the transitive build + runtime closure and a `vulnerabilities` block. Externally specified; validate against the CycloneDX 1.5 JSON schema.",
        "externalDocs": {
          "description": "CycloneDX 1.5 JSON reference",
          "url": "https://cyclonedx.org/docs/1.5/json/"
        }
      },
      "SpdxSbom": {
        "type": "object",
        "description": "SPDX 2.3 JSON document. Externally specified; validate against the SPDX 2.3 specification.",
        "externalDocs": {
          "description": "SPDX 2.3 specification",
          "url": "https://spdx.github.io/spdx-spec/v2.3/"
        }
      },
      "SvgBadge": {
        "type": "string",
        "description": "Shields-style flat badge as an SVG document (`image/svg+xml`). Not a JSON payload — the body is SVG markup keyed on the requested metric. Externally specified.",
        "externalDocs": {
          "description": "SVG 1.1 specification",
          "url": "https://www.w3.org/TR/SVG11/"
        }
      }
    },
    "securitySchemes": {
      "sessionCookie": {
        "type": "apiKey",
        "in": "cookie",
        "name": "__Secure-better-auth.session_token",
        "description": "Better Auth session cookie, obtained by signing in at `https://minimal.dev/auth/login`. A browser sends it automatically; a non-browser client replays it from its cookie jar. Over plain HTTP (local dev) the same cookie is named `better-auth.session_token`, without the `__Secure-` prefix. There are no API tokens yet."
      }
    }
  }
}