oci

type HelmChartOptions struct {
	// SourceDir is the directory containing the Helm chart (Chart.yaml,
	// values.yaml, templates/, etc.). Mirrors PackageOptions.SourceDir.
	SourceDir string
	// OutputDir is where the temporary OCI Image Layout is created;
	// callers usually pass the bundle output directory so cleanup is
	// scoped to one tree.
	OutputDir string
	// Reference is the OCI registry reference. The reference's Tag MUST
	// match the chart version that helm install / helm pull will look
	// for; the push flow rewrites the in-source Chart.yaml so this
	// invariant holds even when the recipe metadata version differs
	// from the user-supplied --output tag.
	Reference *Reference
	// PlainHTTP uses HTTP instead of HTTPS (local test registries).
	PlainHTTP bool
	// InsecureTLS skips TLS certificate verification.
	InsecureTLS bool
	// Version threads the AICR CLI version into manifest annotations
	// alongside the chart-derived ones. Pure metadata; not consulted
	// by Helm at install time.
	Version string
}

type OutputConfig struct {
	// SourceDir is the directory containing artifacts to package.
	SourceDir string
	// OutputDir is where temporary OCI artifacts will be created.
	OutputDir string
	// Reference contains the parsed OCI registry reference.
	Reference *Reference
	// Version is used for OCI annotations (org.opencontainers.image.version).
	Version string
	// PlainHTTP uses HTTP instead of HTTPS for the registry connection.
	PlainHTTP bool
	// InsecureTLS skips TLS certificate verification.
	InsecureTLS bool
	// Annotations are additional manifest annotations to include.
	// If nil, default AICR annotations will be used.
	Annotations map[string]string
}

type PackageAndPushResult struct {
	// Digest is the SHA256 digest of the pushed artifact.
	Digest string
	// MediaType is the manifest media type.
	MediaType string
	// Size is the manifest's byte length. Surfaced for OCI Referrers
	// attachment, which needs a full subject descriptor.
	Size int64
	// Reference is the full image reference (registry/repository:tag).
	Reference string
	// StorePath is the path to the local OCI Image Layout directory.
	StorePath string
}

type PackageOptions struct {
	// SourceDir is the directory containing artifacts to package.
	SourceDir string
	// OutputDir is where the OCI Image Layout will be created.
	OutputDir string
	// Registry is the OCI registry host for the reference (e.g., "ghcr.io").
	Registry string
	// Repository is the image repository path (e.g., "nvidia/aicr").
	Repository string
	// Tag is the image tag (e.g., "v1.0.0", "latest").
	Tag string
	// SubDir optionally limits packaging to a subdirectory within SourceDir.
	SubDir string
	// Annotations are additional manifest annotations to include.
	// Standard OCI annotations (org.opencontainers.image.*) are recommended.
	Annotations map[string]string
}

type PackageResult struct {
	// Digest is the SHA256 digest of the packaged artifact.
	Digest string
	// MediaType is the manifest media type
	// (typically application/vnd.oci.image.manifest.v1+json).
	MediaType string
	// Size is the manifest's byte length. Surfaced so callers can
	// construct an OCI subject descriptor for the Referrers API
	// without re-fetching the manifest from the registry.
	Size int64
	// Reference is the full image reference (registry/repository:tag).
	Reference string
	// StorePath is the path to the OCI Image Layout directory.
	StorePath string
}

type PushOptions struct {
	// SourceDir is the directory containing artifacts to push.
	SourceDir string
	// Registry is the OCI registry host (e.g., "ghcr.io", "localhost:5000").
	Registry string
	// Repository is the image repository path (e.g., "nvidia/aicr").
	Repository string
	// Tag is the image tag (e.g., "v1.0.0", "latest").
	Tag string
	// PlainHTTP uses HTTP instead of HTTPS for the registry connection.
	PlainHTTP bool
	// InsecureTLS skips TLS certificate verification.
	InsecureTLS bool
}

type PushResult struct {
	// Digest is the SHA256 digest of the pushed artifact.
	Digest string
	// MediaType is the manifest media type.
	MediaType string
	// Size is the manifest's byte length. Surfaced so the caller can
	// build a subject descriptor for OCI Referrers attachment without
	// re-fetching the manifest.
	Size int64
	// Reference is the full image reference (registry/repository:tag).
	Reference string
}

type Reference struct {
	// IsOCI indicates whether this is an OCI registry reference (true) or local path (false).
	IsOCI bool
	// Registry is the OCI registry host (e.g., "ghcr.io", "localhost:5000").
	// Only populated when IsOCI is true.
	Registry string
	// Repository is the image repository path (e.g., "nvidia/bundle").
	// Only populated when IsOCI is true.
	Repository string
	// Tag is the image tag (e.g., "v1.0.0").
	// Empty string means no tag was specified; caller should apply a default.
	// Only populated when IsOCI is true.
	Tag string
	// LocalPath is the local directory path for non-OCI output.
	// Only populated when IsOCI is false.
	LocalPath string
}

type ReferrerOptions struct {
	// Registry is the OCI registry host (e.g., "ghcr.io").
	Registry string
	// Repository is the same repository the subject artifact lives in.
	Repository string
	// PlainHTTP forces HTTP (used for local registry tests).
	PlainHTTP bool
	// InsecureTLS disables TLS verification for self-signed registries.
	InsecureTLS bool

	// ArtifactType identifies the referrer manifest's purpose, e.g.
	// "application/vnd.dev.sigstore.bundle.v0.3+json". The same value
	// is used as the layer media type so a referrer with one blob is
	// self-describing.
	ArtifactType string
	// LayerContent is the single blob the referrer wraps.
	LayerContent []byte

	// Subject is the descriptor of the artifact this referrer points
	// at. cosign's /v2/<name>/referrers/<digest> discovery uses
	// Subject.Digest to match.
	Subject ociv1.Descriptor

	// Annotations apply to the referrer manifest.
	Annotations map[string]string
}