Type finite SDK fields

Add string-backed SDK enum types for severity, vulnerability metadata, fix states, VEX status, risk bands, package identity, licenses, digests, and manifest kinds.

Convert PackageManager from an iota-backed enum to a string-backed type while preserving the existing JSON wire values. Propagate typed values through detectors, analyzers, matchers, SBOM transforms, engine consolidation, command output DTOs, SARIF, TUI, MCP fix targets, plugin tests, and smoke fixtures.

Keep open/custom external values explicit at ingestion and rendering boundaries with typed casts or parser helpers. Regenerate schema/docs outputs after the type changes; generated content remains wire-compatible.

Validation: go test ./...; make generate; make test; git diff --check.

Author: bomly-guy

docs/MODELS.md

@@ -24,7 +24,7 @@ findings (reference-style) ─(PackageRef + VulnerabilityID)─┘
 ```go
 type Dependency struct {
     // Identity
-    ID, Name, Version, PURL, Ecosystem, Type, Org, BuildSystem, Language string
+    ID, Name, Version, PURL, Ecosystem, Type, Org, PackageManager, Language string
 
     // Detection metadata
     Scopes      []Scope             // runtime / development / unknown; supports multiple

internal/analyzers/govulncheck/analyzer.go

@@ -391,13 +391,13 @@ func isGoPackage(pkg *model.Dependency) bool {
 	if pkg == nil {
 		return false
 	}
-	if strings.EqualFold(pkg.Ecosystem, string(model.EcosystemGo)) {
+	if pkg.Ecosystem == model.EcosystemGo {
 		return true
 	}
-	if strings.EqualFold(pkg.BuildSystem, "gomod") || strings.EqualFold(pkg.BuildSystem, "go") {
+	if pkg.PackageManager == model.PackageManagerGoMod {
 		return true
 	}
-	if strings.EqualFold(pkg.Language, string(model.LanguageGo)) {
+	if pkg.Language == model.LanguageGo {
 		return true
 	}
 	return false

internal/analyzers/govulncheck/analyzer_test.go

@@ -40,11 +40,11 @@ func newGoModuleDir(t *testing.T) string {
 func newGoGraph(moduleDir string, vulns ...model.Vulnerability) (*model.Graph, *model.PackageRegistry) {
 	g := model.New()
 	dep := model.NewDependency(model.Dependency{
-		Name:        "example.com/lib",
-		Version:     "v1.0.0",
-		Ecosystem:   "go",
-		BuildSystem: "gomod",
-		Locations:   []model.PackageLocation{{RealPath: filepath.Join(moduleDir, "go.sum")}},
+		Name:           "example.com/lib",
+		Version:        "v1.0.0",
+		Ecosystem:      "go",
+		PackageManager: "gomod",
+		Locations:      []model.PackageLocation{{RealPath: filepath.Join(moduleDir, "go.sum")}},
 	})
 	purl := model.CanonicalPackageURLFromDependency(dep)
 	dep.PackageRef = purl
@@ -215,7 +215,7 @@ func TestAnalyzerApplicableRequiresGoVulns(t *testing.T) {
 	// build a graph+registry where dep's package carries the given vulns.
 	build := func(name, ecosystem string, vulns ...model.Vulnerability) (*model.Graph, *model.PackageRegistry) {
 		g := model.New()
-		dep := model.NewDependency(model.Dependency{Name: name, Ecosystem: ecosystem})
+		dep := model.NewDependency(model.Dependency{Name: name, Ecosystem: model.Ecosystem(ecosystem)})
 		purl := model.CanonicalPackageURLFromDependency(dep)
 		dep.PackageRef = purl
 		_ = g.AddNode(dep)

internal/analyzers/govulncheck/parse.go

@@ -152,12 +152,12 @@ func positionToSDK(p *position) model.SourcePosition {
 	return model.SourcePosition{File: p.Filename, Line: p.Line, Column: p.Column}
 }
 
-func symbolKind(t traceEntry) string {
+func symbolKind(t traceEntry) model.SymbolKind {
 	if t.Receiver != "" {
-		return "method"
+		return model.SymbolKindMethod
 	}
 	if t.Function != "" {
-		return "function"
+		return model.SymbolKindFunction
 	}
 	return ""
 }

internal/analyzers/govulncheck/testdata_test.go

@@ -25,7 +25,7 @@ func TestDiscoverModuleRootsFromTestdata(t *testing.T) {
 	g := model.New()
 	pkg := model.NewDependency(model.Dependency{
 		Name:      "example.com/lib",
-		Ecosystem: string(model.EcosystemGo),
+		Ecosystem: model.EcosystemGo,
 		Locations: []model.PackageLocation{{RealPath: filepath.Join(root, "nested", "file.go")}},
 	})
 	if err := g.AddNode(pkg); err != nil {
@@ -122,7 +122,7 @@ func TestGovulncheckAnalyzerMarksUnknownWithoutModuleRoot(t *testing.T) {
 	g := model.New()
 	pkg := model.NewDependency(model.Dependency{
 		Name:      "example.com/lib",
-		Ecosystem: string(model.EcosystemGo),
+		Ecosystem: model.EcosystemGo,
 		PURL:      purl,
 	})
 	if err := g.AddNode(pkg); err != nil {

internal/analyzers/jsreach/analyzer_test.go

@@ -49,12 +49,12 @@ func newNPMProjectDir(t *testing.T) string {
 func addNPMDep(t *testing.T, g *model.Graph, reg *model.PackageRegistry, projectDir, org, name, version string, vulns ...model.Vulnerability) *model.Dependency {
 	t.Helper()
 	dep := model.NewDependency(model.Dependency{
-		Name:        name,
-		Org:         org,
-		Version:     version,
-		Ecosystem:   "npm",
-		BuildSystem: "npm",
-		Locations:   []model.PackageLocation{{RealPath: filepath.Join(projectDir, "package-lock.json")}},
+		Name:           name,
+		Org:            org,
+		Version:        version,
+		Ecosystem:      "npm",
+		PackageManager: "npm",
+		Locations:      []model.PackageLocation{{RealPath: filepath.Join(projectDir, "package-lock.json")}},
 	})
 	purl := model.CanonicalPackageURLFromDependency(dep)
 	dep.PackageRef = purl

internal/analyzers/jsreach/discover.go

@@ -327,15 +327,15 @@ func isNPMPackage(pkg *model.Dependency) bool {
 	if pkg == nil {
 		return false
 	}
-	if strings.EqualFold(pkg.Ecosystem, string(model.EcosystemNPM)) {
+	if pkg.Ecosystem == model.EcosystemNPM {
 		return true
 	}
-	switch strings.ToLower(strings.TrimSpace(pkg.BuildSystem)) {
-	case "npm", "pnpm", "yarn":
+	switch pkg.PackageManager {
+	case model.PackageManagerNPM, model.PackageManagerPNPM, model.PackageManagerYarn:
 		return true
 	}
-	switch strings.ToLower(strings.TrimSpace(pkg.Language)) {
-	case "javascript", "typescript":
+	switch pkg.Language {
+	case model.LanguageJavaScript, model.LanguageTypeScript:
 		return true
 	}
 	return false

internal/analyzers/jvmreach/analyzer_test.go

@@ -58,12 +58,12 @@ func newSeed() (*model.Graph, *model.PackageRegistry) {
 func addJVMDep(t *testing.T, g *model.Graph, reg *model.PackageRegistry, projectDir, group, artifact, version string, vulns ...model.Vulnerability) *model.Dependency {
 	t.Helper()
 	dep := model.NewDependency(model.Dependency{
-		Name:        artifact,
-		Org:         group,
-		Version:     version,
-		Ecosystem:   string(model.EcosystemMaven),
-		BuildSystem: "maven",
-		Locations:   []model.PackageLocation{{RealPath: filepath.Join(projectDir, "pom.xml")}},
+		Name:           artifact,
+		Org:            group,
+		Version:        version,
+		Ecosystem:      model.EcosystemMaven,
+		PackageManager: "maven",
+		Locations:      []model.PackageLocation{{RealPath: filepath.Join(projectDir, "pom.xml")}},
 	})
 	purl := model.CanonicalPackageURLFromDependency(dep)
 	dep.PackageRef = purl
@@ -194,8 +194,8 @@ func TestAnalyzerMarksTransitiveDepReachable(t *testing.T) {
 
 func TestComputeReachablePackageHopsHandlesCycles(t *testing.T) {
 	g := model.New()
-	a := model.NewDependency(model.Dependency{Name: "a", Org: "g", Version: "1", Ecosystem: string(model.EcosystemMaven)})
-	b := model.NewDependency(model.Dependency{Name: "b", Org: "g", Version: "1", Ecosystem: string(model.EcosystemMaven)})
+	a := model.NewDependency(model.Dependency{Name: "a", Org: "g", Version: "1", Ecosystem: model.EcosystemMaven})
+	b := model.NewDependency(model.Dependency{Name: "b", Org: "g", Version: "1", Ecosystem: model.EcosystemMaven})
 	if err := g.AddNode(a); err != nil {
 		t.Fatal(err)
 	}
@@ -221,7 +221,7 @@ func TestAnalyzerApplicableRequiresJVMVulns(t *testing.T) {
 	a := Analyzer{}
 
 	g, reg := newSeed()
-	pyDep := model.NewDependency(model.Dependency{Name: "requests", Ecosystem: string(model.EcosystemPython)})
+	pyDep := model.NewDependency(model.Dependency{Name: "requests", Ecosystem: model.EcosystemPython})
 	pyDep.PackageRef = model.CanonicalPackageURLFromDependency(pyDep)
 	_ = g.AddNode(pyDep)
 	reg.Ensure(pyDep.PackageRef).Vulnerabilities = []model.Vulnerability{{ID: "x"}}

internal/analyzers/jvmreach/discover.go

@@ -339,16 +339,16 @@ func isJVMPackage(pkg *model.Dependency) bool {
 	if pkg == nil {
 		return false
 	}
-	switch strings.ToLower(pkg.Ecosystem) {
-	case string(model.EcosystemMaven), string(model.EcosystemScala):
+	switch pkg.Ecosystem {
+	case model.EcosystemMaven, model.EcosystemScala:
 		return true
 	}
-	switch strings.ToLower(strings.TrimSpace(pkg.BuildSystem)) {
-	case "maven", "gradle", "sbt":
+	switch pkg.PackageManager {
+	case model.PackageManagerMaven, model.PackageManagerGradle, model.PackageManagerSBT:
 		return true
 	}
-	switch strings.ToLower(strings.TrimSpace(pkg.Language)) {
-	case string(model.LanguageJava), string(model.LanguageKotlin), string(model.LanguageScala), string(model.LanguageGroovy):
+	switch pkg.Language {
+	case model.LanguageJava, model.LanguageKotlin, model.LanguageScala, model.LanguageGroovy:
 		return true
 	}
 	return false

internal/analyzers/jvmreach/runner_testdata_test.go

@@ -68,7 +68,7 @@ func TestJVMStandaloneApplyRunnerResult(t *testing.T) {
 	pkg := model.NewDependency(model.Dependency{
 		Name:      "jackson-databind",
 		Org:       "com.fasterxml.jackson.core",
-		Ecosystem: string(model.EcosystemMaven),
+		Ecosystem: model.EcosystemMaven,
 		PURL:      purl,
 	})
 	if err := g.AddNode(pkg); err != nil {