Module types 

Verdict + ancillary response types per Client spec rev1 §2.4 + App Rev 4 §4.1 Vector verdict shape.

All fields default-tolerant via #[serde(default)] so the SDK can consume partial responses during cycle-3 → cycle-N spec evolution without forcing a recompile-and-redeploy on every App-side schema widening.

Structs

AuditEntry

One audit log entry returned from GET /v1/audit.

AuditResponse

Response from GET /v1/audit. Mirrors the App-side AuditResponse in cleanlib-app::verbs. See AuditEntry for the CLEANLIB-366 field-name alignment note.

AuditWindow

Query-window echo returned inside AuditResponse::window. Mirrors the App-side AuditWindow — echoes the caller’s since / until filter values verbatim (or None when the filter was omitted).

AvailabilityBlock

Cycle-15 honesty signal block on the SDK Verdict shape. Mirrors the App wire-shape cleanlib_core::AvailabilityBlock. Option<bool>-style passthrough for degraded_stale so pre-cycle-15 payloads (without the block) deserialize cleanly.

Axes

CLEANLIB-780: the per-axis result envelope (mirrors the App’s axes on CustomerVerdictResponse). Each plane is reported SEPARATELY so the client renders honest per-axis language. Tolerant: struct-level #[serde(default)] + Default, no deny_unknown_fields, so a partial or future-extended envelope never fails the reader.

AxisAdvisory

CLEANLIB-780 advisory (CVE cross-reference) axis. result is the App’s closed enum clean | vulnerable | never_consulted — DERIVED, never a false clean. sources_consulted lists ONLY sources proven to have contributed data and is ABSENT on a clean/empty result (the App does not fabricate a source list), so the client must render only the sources present and never a hardcoded set.

AxisAvailability

CLEANLIB-780 availability (byte-serve fingerprint) axis. Not evaluated on the verdict path, so ran is honestly false — a scope statement, not a failure.

AxisThreat

CLEANLIB-780 threat (behavioral / Vector triage) axis — the empirical split from advisory. result is malicious | blocked | clean | never_consulted. CVE findings are the ADVISORY axis and are NOT counted here.

Coverage

CLEANLIB-652 (CX-3) part 3b / CLEANLIB-647 (DD-1): the App’s per-request coverage block on the POST /v1/scan response — how many coordinates were assessed vs not, plus the per-coordinate attribution the client required (652 c767287) so DD-1 can populate error on each never-evaluated coordinate.

Finding

CLEANLIB-613: one CVE finding inside TopFindings. Only the fields the CLI consumes are typed; the App may add more (tolerated — no deny_unknown_fields).

Freshness

CLEANLIB-652 (CX-3) part 2: the App’s nested per-axis freshness block (mirrors verbs::Freshness). Each axis age is Option — under precedence composition only the producing axis carries a timestamp and the others are null; overall_as_of = MIN of the non-null axis ages (the verdict is only as fresh as its stalest input). All-optional + #[serde(default)] for tolerant, forward-compatible parsing.

NotAssessedReason

CLEANLIB-652 (CX-3) part 3b / CLEANLIB-647 (DD-1): one per-coordinate not-assessed reason from the App’s per-request coverage block. The App emits this for every coordinate it returned but could NOT assess (see Coverage::not_assessed_reasons); the client joins it into the per-decision error field so scan --output json can distinguish a NEVER-EVALUATED coordinate from one that was evaluated and warned.

PackageRef

One package identity for policy-preview / scan requests.

PolicyDecision

Per-package decision returned from /v1/policy/preview or embedded in audit entries.

PolicyPreviewRequest

Body of POST /v1/policy/preview — packages + optional hypothetical policy override (JSON-shaped; YAML-source customers convert client-side).

PolicyPreviewResponse

Response from POST /v1/policy/preview.

PreviousVerdict

Prior-verdict comparison. Surfaces when the CleanLibrary App has a stored prior verdict for the same (ecosystem, package, version) that differs from the current one — useful for AI agents and dashboards that want to flag verdict-state changes since the last fetch. Sister-shape with cleanlib_sdk_go::PreviousVerdict and cleanlib-core::PreviousVerdict in the App.

Remediation

CLEANLIB-652 (CX-3) part 3a: structured remediation (mirrors App verbs::Remediation) — the single upgrade target + a per-ecosystem copy-paste command. target_version is engine-clean (the composite’s effective fix version). All-string + #[serde(default)] for tolerant, forward-compat parse.

RichData

CLEANLIB-601: typed subset of the App’s rich_data block. Carries the recommended_version upgrade target for the CLI fix command. #[serde(default)]

ScanRequest

Body of POST /v1/scan — a batch of package coordinates, no policy.

ScanResponse

Response from POST /v1/scan. One ScanResult per requested package.

ScanResult

One entry of the POST /v1/scan response. Mirrors the App’s verbs::ScanResult wire shape: the package coordinate is flattened (ecosystem / package / version) alongside an optional verdict (present on success) or error string (per-package partial failure — the App resolves each package independently and never fails the whole batch on one miss).

TopFindings

CLEANLIB-613: the App’s top_findings block on a customer verdict — the per-CVE findings that back a VECTOR_VERDICT/DENY, plus the KEV / ransomware flags. Modeled so the CLI fix command can reach each finding’s structured fixed_version (the App’s always-populated remediation target). Tolerant: #[serde(default)], all-optional, no deny_unknown_fields.

Verdict