bom

type ComponentResult struct {
	Name        string   // component identifier, e.g., "gpu-operator"
	DisplayName string   // human-readable name
	Type        string   // "helm", "kustomize", or "manifest"
	Repository  string   // chart repository URL (helm only)
	Chart       string   // chart name (helm only)
	Version     string   // chart version if pinned
	Namespace   string   // default namespace
	Pinned      bool     // whether the chart version is pinned in the recipe
	Images      []string // sorted, deduplicated image references
	Warnings    []string // non-fatal issues to attach as properties
}

type ImageRef struct {
	Raw        string // original string
	Registry   string // host[:port], e.g., "nvcr.io" or "docker.io"
	Repository string // path after registry, e.g., "nvidia/gpu-operator"
	Tag        string // ":tag" portion if present
	Digest     string // "@sha256:..." portion if present
}

type Metadata struct {
	Name        string // e.g., "aicr" or "recipe-h100-eks-ubuntu-training"
	Version     string // e.g., "v0.12.1" or recipe version
	Description string
	Supplier    string // organization name; defaults to "NVIDIA Corporation"
	ToolName    string // tool that generated the BOM; defaults to "aicr"
	ToolVersion string // version of the generating tool

	// Deterministic suppresses run-specific metadata so the artifact can
	// be diffed across runs. Affects both WriteMarkdown (the "_Generated
	// <timestamp>..._" line is omitted) and BuildBOM (a deterministic
	// SerialNumber is derived from Name+Version and Timestamp is omitted).
	// Use for committed doc artifacts, SLSA-style reproducible builds,
	// and any other bit-for-bit reproducible output path.
	Deterministic bool

	// SerialNumber, if non-empty, overrides the BOM serial number. When
	// empty and Deterministic is false, BuildBOM generates a random UUID.
	// When empty and Deterministic is true, BuildBOM derives a serial
	// from Name+Version. Use to inject a caller-supplied identifier
	// (e.g., commit SHA) without forcing the Deterministic mode.
	SerialNumber string

	// Timestamp, if non-empty, overrides the BOM metadata timestamp
	// (RFC3339). When empty and Deterministic is false, BuildBOM uses
	// time.Now().UTC(). When empty and Deterministic is true, the
	// timestamp is omitted entirely.
	Timestamp string

	// NoTitle suppresses the H1 title line in WriteMarkdown so the body
	// can be embedded as a section of a larger document (e.g., the
	// auto-generated middle of docs/user/container-images.md, where the
	// title and surrounding prose are hand-edited).
	NoTitle bool
}