v1alpha3

type AgeEncryptionSpec struct {
	// Enabled turns on age encryption: resolving recipients, and creating a key
	// when asked. Defaults to false.
	// +optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// Recipients says where the age recipients come from.
	// +optional
	Recipients AgeRecipientsSpec `json:"recipients,omitempty"`
}

type AgeRecipientsSpec struct {
	// PublicKeys is a fixed list of age recipients ("age1...").
	// +optional
	// +kubebuilder:validation:items:MinLength=1
	PublicKeys []string `json:"publicKeys,omitempty"`

	// ExtractFromSecret adds the recipient of every *.agekey entry in
	// encryption.secretRef. Defaults to false.
	// +optional
	// +kubebuilder:default=false
	ExtractFromSecret bool `json:"extractFromSecret,omitempty"`

	// GenerateWhenMissing creates a date-named *.agekey entry in
	// encryption.secretRef when it has none. Defaults to false.
	// +optional
	// +kubebuilder:default=false
	GenerateWhenMissing bool `json:"generateWhenMissing,omitempty"`
}

type ApplierClaim interface {
	metav1.Object
	runtime.Object

	// ClaimKind is the applier claim's kind (ApplierClaimKind*).
	ClaimKind() string
	// KubeProviderKey is the KubeProvider whose cluster holds the applier.
	KubeProviderKey() types.NamespacedName
	// ApplierKind is the kind of applier the applier claim holds (ApplierKind*).
	ApplierKind() string
	// Applier is the object the applier claim holds, its namespace defaulted to the applier claim's own.
	Applier() types.NamespacedName
	// SourceBinding is the repository and branch the applier applies, as the applier claim last read
	// them, and false when it has not read them.
	SourceBinding() (repositoryURL, branch string, known bool)
	// SharedSource is the source object the applier reads, which other appliers may read too, and
	// false when the applier has none it shares this way or the applier claim has not read it. Appliers
	// sharing one have one operation at a time.
	SharedSource() (source types.NamespacedName, known bool)
	// CatchUpAfter is spec.catchUpAfter, or the kind's default when it is omitted: how long
	// the applier may stay behind the branch after a push of GitOps Reverser's own. Zero never
	// converges for that reason.
	CatchUpAfter() time.Duration
	// Operation is status.operation, and SetOperation replaces it and status.repairPending.
	Operation() *ApplyOperation
	RepairPending() bool
	SetOperation(operation *ApplyOperation, repairPending bool)
	// PreviousSuspendState is status.previousSuspendState, and SetPreviousSuspendState replaces it.
	PreviousSuspendState() SuspendState
	SetPreviousSuspendState(state SuspendState)
	// StatusConditions returns the condition set, and SetObservedGeneration stamps the generation.
	StatusConditions() *[]metav1.Condition
	SetObservedGeneration(generation int64)
}

type ApplierClaimReference struct {
	// Kind is the applier claim's kind: "FluxClaim" or "ArgoCDClaim".
	// +required
	// +kubebuilder:validation:Enum=FluxClaim;ArgoCDClaim
	Kind string `json:"kind"`

	// Name is the applier claim's name.
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ApplyOperation struct {
	// Phase is where the operation stands. Requested, Running, Settling (Flux
	// only: applied, and the Kustomization not yet suspended again) and Unresolved
	// (overdue, still followed) are in flight: the applier can still revert an
	// edit to an object it applies, and is asked for nothing else. Succeeded and
	// Failed are complete; Failed may have applied part of the commit.
	// +required
	Phase ApplyOperationPhase `json:"phase"`

	// Reason is why the apply was asked for: ForeignCommit (a commit GitOps
	// Reverser did not push), Refusal (a refused edit under spec.onRefusal:
	// "Reapply"), Repair (an earlier apply reverted a newer API edit), or CatchUp
	// (adopting objects the API created, and once at startup or when a GitTarget
	// first names the claim). With several GitTargets on the claim, it is the
	// strongest of their reasons.
	// +optional
	Reason ApplyReason `json:"reason,omitempty"`

	// Commit is the commit the applier was asked to apply. Empty when the remote
	// did not carry the branch.
	// +optional
	Commit string `json:"commit,omitempty"`

	// Token identifies the request in the applier's own status: the
	// reconcile.fluxcd.io/requestedAt value on a Flux object, or the
	// "gitops-reverser request" entry in an Argo CD operation's info.
	// +optional
	Token string `json:"token,omitempty"`

	// SuspendToken is the reconcile.fluxcd.io/requestedAt value of the suspend
	// that follows the apply. Once the Kustomization reports it handled, nothing
	// started before the suspend is still running. Flux only.
	// +optional
	SuspendToken string `json:"suspendToken,omitempty"`

	// AppliedRevision is the revision the applier reports applying when the
	// operation completes. It can differ from commit when the branch moved between
	// the check and the apply.
	// +optional
	AppliedRevision string `json:"appliedRevision,omitempty"`

	// RequestedAt is when the applier was asked.
	// +required
	RequestedAt metav1.Time `json:"requestedAt"`

	// FinishedAt is when the operation was seen to complete.
	// +optional
	FinishedAt *metav1.Time `json:"finishedAt,omitempty"`

	// Message says why a Failed operation failed, or why an Unresolved one is
	// overdue.
	// +optional
	Message string `json:"message,omitempty"`
}

type ApplyOperationPhase string

type ApplyReason string

type ArgoCDClaim struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ArgoCDClaim.
	// +required
	Spec ArgoCDClaimSpec `json:"spec"`

	// status defines the observed state of ArgoCDClaim.
	// +optional
	Status ArgoCDClaimStatus `json:"status,omitempty,omitzero"`
}

type ArgoCDClaimList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ArgoCDClaim `json:"items"`
}

type ArgoCDClaimSource struct {
	// RepoURL is the Application's spec.source.repoURL.
	// +optional
	RepoURL string `json:"repoURL,omitempty"`

	// TargetRevision is the Application's spec.source.targetRevision, as written:
	// a branch name, or refs/heads/ and the name. Empty means Argo CD's HEAD.
	// +optional
	TargetRevision string `json:"targetRevision,omitempty"`
}

type ArgoCDClaimSpec struct {

	// KubeProviderRef names the KubeProvider of the cluster that runs the
	// Application, such as a management cluster running Argo CD. An omitted
	// namespace means this ArgoCDClaim's namespace. The KubeProvider's
	// spec.allowedApplierClaims must admit this namespace, with the Application's
	// namespace in applierNamespaces, and its identity needs get, update and patch
	// on the Application. Immutable: delete and recreate the ArgoCDClaim to change
	// it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.kubeProviderRef.name must not be empty"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.kubeProviderRef is immutable; delete and recreate the ArgoCDClaim to hold an Application elsewhere"
	KubeProviderRef meta.NamespacedObjectReference `json:"kubeProviderRef"`

	// ApplicationRef names the Argo CD Application that syncs the folders of the
	// GitTargets naming this ArgoCDClaim. It must have a single spec.source whose
	// targetRevision names a branch.
	//
	// The ArgoCDClaim keeps its automated sync off by applying
	// spec.syncPolicy.automated.enabled: false, switches it off again when
	// somebody switches it on, and gives the switch up when it lets go;
	// automated.prune still applies to the syncs GitOps Reverser starts. An
	// Application that an ApplicationSet generates, or whose switch another field
	// manager applies, must have automated sync off already. Each sync is pinned
	// to the commit GitOps Reverser checked, and a running operation is never
	// replaced.
	//
	// An omitted namespace means this ArgoCDClaim's namespace. Immutable: delete
	// and recreate the ArgoCDClaim to change it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.applicationRef is immutable; delete and recreate the ArgoCDClaim to hold another Application"
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.applicationRef.name must not be empty"
	ApplicationRef meta.NamespacedObjectReference `json:"applicationRef"`

	// CatchUpAfter is how long the Application stays behind the branch after
	// a push of GitOps Reverser's own before a sync of the tip is asked for,
	// as a Go duration ("5m"). Such a push changes nothing on the cluster,
	// which already holds the edit, but leaves the Application's last sync at
	// the commit before it. The interval starts when the Application is first
	// seen behind, so a burst of saves costs one sync, hooks included, and one
	// at the tip costs none. The sync can still wait for startup, a retry
	// backoff or edits being published. "0s" never asks for this reason, and
	// drops a sync it asked for that has not started. Otherwise at least "10s"
	// and at most "24h". Defaults to "0s".
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="0s"
	// +kubebuilder:validation:XValidation:rule="duration(self) == duration('0s') || (duration(self) >= duration('10s') && duration(self) <= duration('24h'))",message="spec.catchUpAfter must be 0s, or a Go duration from 10s to 24h"
	CatchUpAfter *metav1.Duration `json:"catchUpAfter,omitempty"`
}

type ArgoCDClaimStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this ArgoCDClaim's state. Ready,
	// Reconciling and Stalled follow kstatus.
	//
	// Configured is True when an eligible GitTarget names this ArgoCDClaim, and
	// the Application exists, syncs a single source, has automated sync off or a
	// switch this ArgoCDClaim may hold, may be written, and no other ArgoCDClaim
	// holds it. An eligible GitTarget is in this namespace, is admitted by its
	// KubeProviders, and writes the branch the Application syncs. Of several
	// ArgoCDClaims for one Application, the one holding it already holds it, then
	// the oldest; the others are Configured=False, reason HeldByAnotherClaim.
	//
	// InControl says whether GitOps Reverser decides when the Application
	// syncs:
	//
	// - True, reason AutomatedSyncOff: automated sync is off and GitOps
	//   Reverser starts every sync, also when another field manager owns the
	//   switch and keeps it off.
	// - False, reason Releasing or Revoking: the ArgoCDClaim is handing the
	//   Application back.
	// - False, reason NotReferenced: no GitTarget names this ArgoCDClaim.
	// - False, reason NotConfigured: another field manager owns the switch and
	//   has turned automated sync on.
	// - False, reason ArgoCDVersionNotSupported: the Application has no
	//   spec.syncPolicy.automated.enabled field (Argo CD before 3.1).
	// - Unknown, reason NotConfigured: Configured is not True, or another
	//   ArgoCDClaim holds the Application.
	//
	// A failed read of the Application keeps the previous InControl value. An
	// ArgoCDClaim no GitTarget names reads nothing and is Ready=True, reason
	// NotReferenced.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Source is the Application's spec.source, as last read. It is published while
	// an eligible GitTarget names this ArgoCDClaim, and that GitTarget must write
	// the repository it syncs, on the branch its targetRevision names.
	// +optional
	Source *ArgoCDClaimSource `json:"source,omitempty"`

	// Operation is the sync GitOps Reverser started on the Application: the one in
	// flight, or the last one. Absent until the first.
	// +optional
	Operation *ApplyOperation `json:"operation,omitempty"`

	// RepairPending is true while a Repair sync is pending: a sync ran a commit
	// older than an edit made through the API and reverted it on the cluster. Git
	// holds the edit, and the cluster runs the older value until the next sync.
	// +optional
	RepairPending bool `json:"repairPending,omitempty"`

	// PreviousSuspendState is how the Application stood before this ArgoCDClaim
	// first switched its automated sync off, and what handing it back restores:
	// NotSuspended (automated sync on) or Suspended (off). It is cleared once the
	// Application is handed back. Absent, handing it back leaves what the
	// Application's own spec says. A switch that an ApplicationSet or another
	// field manager owns keeps that owner's value either way.
	// +optional
	PreviousSuspendState SuspendState `json:"previousSuspendState,omitempty"`
}

type AttachPolicy string

type BranchPattern string

type CatchUpPolicy string

type ClusterResourceIdentity string

type ClusterResourceRule struct {
	// APIGroups are the API groups to match: "" is the core group, and "*" is
	// every group, as in ["rbac.authorization.k8s.io"] or ["*"]. Omitted, each
	// resource name is looked up across the served groups and must be served by
	// exactly one.
	// +optional
	APIGroups []string `json:"apiGroups,omitempty"`

	// APIVersions are the versions to match, or "*" for every served version.
	// Omitted, each resource's preferred version is used.
	// +optional
	APIVersions []string `json:"apiVersions,omitempty"`

	// Resources are the resource types to match, by plural name ("nodes",
	// "clusterroles"), or "*" for every type. Matching is exact and
	// case-insensitive; partial wildcards such as "cluster*" match nothing, and
	// subresources ("nodes/status") are rejected.
	// +required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:Pattern=`^[^/]*$`
	Resources []string `json:"resources"`

	// ObjectSelector mirrors only the objects whose labels match, as a
	// standard label selector. Omitted or {} selects every object.
	//
	// An object that stops matching is handled like a deleted one: the
	// GitTarget's spec.prune.mode decides whether its document is removed.
	// With prune mode "Always", a resync also removes documents of the type
	// that the selector does not match.
	//
	// Two rules on one GitTarget that select the same type must use the same
	// selector. The older rule keeps the type, and the newer one is refused
	// with ResourcesResolved=False, reason CollectionOverlap. A selector that
	// does not parse refuses the whole rule with ResourcesResolved=False,
	// reason InvalidObjectSelector.
	// +optional
	ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty"`
}

type ClusterWatchRule struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ClusterWatchRule.
	// +required
	Spec ClusterWatchRuleSpec `json:"spec"`

	// status defines the observed state of ClusterWatchRule.
	// +optional
	Status ClusterWatchRuleStatus `json:"status,omitempty"`
}

type ClusterWatchRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []ClusterWatchRule `json:"items"`
}

type ClusterWatchRuleSpec struct {
	// GitTargetRef names the GitTarget that mirrors what this ClusterWatchRule
	// selects. The namespace is required, because a ClusterWatchRule has none to
	// default to.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.gitTargetRef.name must not be empty"
	// +kubebuilder:validation:XValidation:rule="has(self.namespace) && self.namespace != ”",message="spec.gitTargetRef.namespace is required: a ClusterWatchRule has no namespace to default to"
	GitTargetRef meta.NamespacedObjectReference `json:"gitTargetRef"`

	// Rules select the cluster-scoped resources to mirror. A resource matching any
	// rule is mirrored. A rule that resolves to no cluster-scoped type mirrors
	// nothing; use a WatchRule for namespaced resources.
	// +required
	// +kubebuilder:validation:MinItems=1
	Rules []ClusterResourceRule `json:"rules"`
}

type ClusterWatchRuleStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this ClusterWatchRule's state.
	// Ready, Reconciling and Stalled follow kstatus; ResourcesResolved and
	// StreamsRunning say which check holds the rule back.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Streams counts the types this ClusterWatchRule resolves, by watch state.
	// +optional
	Streams *StreamsStatus `json:"streams,omitempty"`
}

type CommitMessageSpec struct {
	// LiveTemplate is the Go template for the message of a commit made from
	// live edits, whatever its size. Omitted, a built-in template is used.
	//
	// The template receives:
	//
	// - Author: the username, which may be empty.
	// - GitTarget: the GitTarget's name.
	// - Count: the number of edits after coalescing, before comparing with Git.
	// - Operations: the number of edits per operation.
	// - Resources: one entry per resource in the commit.
	// - LabelValues "key": the distinct values of one label across Resources.
	// - LabelValue "key": the value of one label that every resource shares,
	//   or empty when they differ.
	//
	// Each resource has Operation, Group, Version, Resource, Kind, Namespace,
	// Name, APIVersion, ResourceVersion, Generation and Labels. Namespace is
	// "_cluster" for a cluster-scoped resource. Read one label with
	// {{.Label "key"}}; {{.Labels.key}} fails the commit for a resource without
	// that label. Kind and Labels are empty for a deletion, ResourceVersion
	// can be empty, and Generation is 0 for a kind without a spec, so guard
	// them with {{with}}.
	//
	// A CommitRequest's message replaces this template without changing the
	// author; spec.commit.message.requestTemplate can wrap that message.
	// +optional
	LiveTemplate string `json:"liveTemplate,omitempty"`

	// RequestTemplate is the Go template that frames a CommitRequest's message. It
	// is used only for a commit whose CommitRequest supplied a message, and gets
	// liveTemplate's fields plus RequestMessage, the message as written; template
	// syntax inside the message stays literal. Omitted, the message is committed
	// as written. A template that never renders RequestMessage is rejected, and
	// one that fails at commit time commits the message as written.
	// +optional
	RequestTemplate string `json:"requestTemplate,omitempty"`

	// ReconcileTemplate is the Go template for the message of a snapshot or resync
	// commit. Fields: Count, GitTarget, Group, Version, Resource, APIVersion,
	// Namespace and ResourceVersion (the list's, not one object's). The type and
	// namespace fields are empty for a snapshot of the whole folder, and
	// ResourceVersion can be empty, so guard them. A template naming Revision,
	// renamed to ResourceVersion, is rejected.
	// +optional
	ReconcileTemplate string `json:"reconcileTemplate,omitempty"`
}

type CommitRequest struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of CommitRequest. It is immutable after
	// creation.
	// +required
	Spec CommitRequestSpec `json:"spec"`

	// status defines the observed state of CommitRequest.
	// +optional
	Status CommitRequestStatus `json:"status,omitempty,omitzero"`
}

type CommitRequestList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []CommitRequest `json:"items"`
}

type CommitRequestSpec struct {
	// GitTargetRef names the GitTarget whose commit window this request
	// attaches to: in this namespace, or namespace names another. The
	// GitTarget's spec.allowedCommitRequests must admit this namespace, or the
	// request fails with reason "NotAllowed".
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.gitTargetRef.name must not be empty"
	GitTargetRef meta.NamespacedObjectReference `json:"gitTargetRef"`

	// Message is the commit message this request asks for. Omitted, the
	// GitTarget's spec.commit.message.liveTemplate words the commit.
	//
	// The text is never evaluated as a template. If the GitTarget sets
	// spec.commit.message.requestTemplate, that template wraps this text;
	// otherwise the text is committed as written.
	//
	// It is 1–1024 characters and must contain a non-whitespace character.
	// Newlines are allowed, for a subject and body; tabs and other control
	// characters are rejected.
	// +optional
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=1024
	// +kubebuilder:validation:Pattern=`^[^\x00-\x09\x0B-\x1F\x7F]*$`
	// +kubebuilder:validation:XValidation:rule="self.matches(r'[^\\s\\x{0085}\\x{00A0}\\x{1680}\\x{2000}-\\x{200A}\\x{2028}\\x{2029}\\x{202F}\\x{205F}\\x{3000}]')",message="message must contain a non-whitespace character"
	Message string `json:"message,omitempty"`

	// Window says which commit window this request attaches to, how long it waits
	// for one, and the timers that close the window once it has. They replace the
	// GitTarget's timers for that window. A request never opens a window: only a
	// write does. Omitted, the request attaches to the author's current or next
	// window within 5s and closes it 2s later.
	// +optional
	// +kubebuilder:default={attach: "CurrentOrNext", attachTimeout: "5s", maxDuration: "2s"}
	Window *CommitRequestWindow `json:"window,omitempty"`

	// WhenNothingToCommit decides what happens when the request ends with nothing
	// to commit: attachTimeout ran out with no window, or the window closed
	// without changing Git. "Resolve" finishes without a commit; "CommitEmpty"
	// records spec.message in an empty commit. The Ready reason says which case
	// happened. A window that belonged to another author never gets an empty
	// commit, and a request on a GitTarget that may not be written (suspended, or
	// render fidelity not established) fails either way. Defaults to "Resolve".
	// +optional
	// +kubebuilder:validation:Enum=Resolve;CommitEmpty
	// +kubebuilder:default=Resolve
	WhenNothingToCommit NothingToCommitAction `json:"whenNothingToCommit,omitempty"`

	// CatchUp decides when the GitTarget's applier is asked to apply the branch
	// after this request pushes a commit. "AsDefinedOnClaim" leaves it to the
	// applier claim's spec.catchUpAfter. "AfterPush" asks right after the push.
	// The apply takes the latest branch tip, which may hold later commits, and
	// saves pushed close together can share one apply; the Applied condition
	// reports how it went. The cluster already holds the saved objects:
	// the apply brings the applier's own state, such as a Kustomization's
	// status.lastAppliedRevision, to the tip. Defaults to "AsDefinedOnClaim".
	// +optional
	// +kubebuilder:validation:Enum=AsDefinedOnClaim;AfterPush
	// +kubebuilder:default=AsDefinedOnClaim
	CatchUp CatchUpPolicy `json:"catchUp,omitempty"`
}

type CommitRequestStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Author is who created this request, as the audit events of the cluster
	// it was created on name them. Empty when they name nobody, or when author
	// attribution is off: then the request saves only writes that name nobody
	// either.
	// +optional
	Author string `json:"author,omitempty"`

	// Conditions are the latest observations of this CommitRequest's state.
	// Reconciling and Stalled follow kstatus.
	//
	// Three conditions say how far the save got:
	//
	// - Ready (kstatus): Unknown while the save runs. True once the request
	//   ended without error, with a pushed commit or with nothing to save; it
	//   never waits for an apply. False when it failed: reason NotAllowed,
	//   GitTargetNotFound, SaveInProgress or FinalizeFailed.
	// - Pushed: True once the commit is on the remote.
	// - Applied: set only with spec.catchUp "AfterPush", once Ready is True.
	//
	// Applied says whether the cluster's applier caught up with the commit:
	//
	// - Unknown, reason Applying or Retrying: the apply runs, or did not
	//   complete and is asked again; the message says why.
	// - True, reason Applied: the applier applied a revision that holds the
	//   commit, named in status.appliedRevision.
	// - True, reason NothingToApply, NoApplierClaim or ApplierGone: no apply
	//   was needed. The request pushed no commit, or the GitTarget names no
	//   applier claim, or stopped naming the one asked; the cluster already
	//   holds the saved objects.
	// - False, reason CommitDropped: the branch no longer holds the commit;
	//   its history was rewritten after the push. Only this is False.
	// - Unknown, reason TimedOut: the apply did not settle within 10 minutes
	//   of Ready, so the request stopped following it. The commit stays
	//   pushed; the message says where the apply last stood.
	// - Unknown, reason Lost: GitOps Reverser restarted before it knew.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchStrategy=merge
	// +patchMergeKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// GitTargetUID is the UID of the GitTarget whose spec.allowedCommitRequests
	// admitted this request. A GitTarget with another UID, such as one created
	// after the request under the same name, must admit it again.
	// +optional
	GitTargetUID string `json:"gitTargetUID,omitempty"`

	// Branch is the branch the commit is made on. Set once the request ends.
	// +optional
	Branch string `json:"branch,omitempty"`

	// Commit is the commit hash. Set once the commit is pushed (Pushed=True).
	// +optional
	Commit string `json:"commit,omitempty"`

	// AppliedRevision is the revision the GitTarget's applier reported applying
	// for this request, as in a Kustomization's status.lastAppliedRevision. It
	// holds the request's commit, and may be a later one. Set once Applied is
	// True with reason Applied.
	// +optional
	AppliedRevision string `json:"appliedRevision,omitempty"`
}

type CommitRequestWindow struct {
	// Attach selects the window. "CurrentOrNext" attaches to the author's open
	// window, or to the next one a write opens. "Next" closes the author's open
	// window under its own message first, and attaches to the next one; it
	// separates earlier writes from later ones, but cannot prove a write was made
	// after the request. Defaults to "CurrentOrNext".
	// +optional
	// +kubebuilder:validation:Enum=CurrentOrNext;Next
	// +kubebuilder:default=CurrentOrNext
	Attach AttachPolicy `json:"attach,omitempty"`

	// AttachTimeout is how long the request waits for a window, as a Go duration,
	// from when GitOps Reverser picks the request up, which is after its own
	// author was found. "0s" attaches only to a window already open. A request
	// whose wait ran out never takes a later window. At most "5m". Defaults to
	// "5s", which covers a write's wait for its audit event.
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="5s"
	// +kubebuilder:validation:XValidation:rule="duration(self) <= duration('5m')",message="spec.window.attachTimeout must not exceed 5m"
	AttachTimeout *metav1.Duration `json:"attachTimeout,omitempty"`

	// IdleTimeout closes the attached window this long after its last write, as a
	// Go duration. Omitted, only maxDuration closes it. At most "5m", and not more
	// than maxDuration.
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:validation:XValidation:rule="duration(self) <= duration('5m')",message="spec.window.idleTimeout must not exceed 5m"
	IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty"`

	// MaxDuration closes the attached window this long after the request attached,
	// however many writes keep arriving, as a Go duration. "0s" commits right
	// after attaching. At most "5m". Defaults to "2s".
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="2s"
	// +kubebuilder:validation:XValidation:rule="duration(self) <= duration('5m')",message="spec.window.maxDuration must not exceed 5m"
	MaxDuration *metav1.Duration `json:"maxDuration,omitempty"`
}

type CommitRequestsPolicy string

type CommitSigningSpec struct {
	// SecretRef names the Secret, in this namespace, that holds the SSH signing
	// key.
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="commit.signing.secretRef.name must not be empty"
	SecretRef meta.LocalObjectReference `json:"secretRef"`

	// GenerateWhenMissing creates a signing key in the Secret when it holds none.
	// Defaults to false.
	// +optional
	// +kubebuilder:default=false
	GenerateWhenMissing bool `json:"generateWhenMissing,omitempty"`
}

type CommitSpec struct {
	// Committer is the identity written as each commit's committer. With signing
	// enabled, its email must be a verified address of the account that owns the
	// signing key.
	// +optional
	Committer *CommitterSpec `json:"committer,omitempty"`

	// Signing configures SSH commit signing.
	// +optional
	Signing *CommitSigningSpec `json:"signing,omitempty"`
}

type CommitWindow struct {
	// IdleTimeout closes the window this long after its last write, as a Go
	// duration ("5s", "750ms"). "0s" makes one commit per write. At most "24h".
	// Defaults to "5s".
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="5s"
	// +kubebuilder:validation:XValidation:rule="duration(self) <= duration('24h')",message="spec.commit.window.idleTimeout must be a Go duration of at most 24h"
	IdleTimeout *metav1.Duration `json:"idleTimeout,omitempty"`

	// MaxDuration closes the window this long after it opened, however many writes
	// keep arriving, as a Go duration ("1m", "90s"). "0s" closes it right after
	// the write that opened it. At most "24h". Defaults to "1m".
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="1m"
	// +kubebuilder:validation:XValidation:rule="duration(self) <= duration('24h')",message="spec.commit.window.maxDuration must be a Go duration of at most 24h"
	MaxDuration *metav1.Duration `json:"maxDuration,omitempty"`
}

type CommitterSpec struct {
	// Name is the committer name. Defaults to "GitOps Reverser".
	// +optional
	// +kubebuilder:default="GitOps Reverser"
	Name string `json:"name,omitempty"`

	// Email is the committer email. Defaults to "noreply@configbutler.ai".
	// +optional
	// +kubebuilder:default="noreply@configbutler.ai"
	Email string `json:"email,omitempty"`
}

type ConsumerNamespaces struct {
	// From selects which namespaces this grant allows consumers from:
	//
	// - "Same": the namespace of the object that holds the grant.
	// - "Names": the namespaces listed in names.
	// - "Selector": the namespaces whose labels match selector.
	// - "All": every namespace.
	// +required
	From GrantFrom `json:"from"`

	// Names are the namespaces allowed with from: "Names", by exact name.
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	Names []GrantNamespace `json:"names,omitempty"`

	// Selector matches the labels of the namespaces allowed with from:
	// "Selector". It must not be empty: to allow every namespace, use from:
	// "All".
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type EncryptionSpec struct {
	// Provider is the encryption tool. Only "sops" is supported. Defaults to
	// "sops".
	// +kubebuilder:default=sops
	// +kubebuilder:validation:Enum=sops
	Provider string `json:"provider"`

	// SecretRef names the Secret, in this namespace, that holds the provider's
	// keys.
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="encryption.secretRef.name must not be empty"
	// +optional
	SecretRef meta.LocalObjectReference `json:"secretRef,omitempty"`

	// Age configures age recipients for SOPS.
	// +optional
	Age *AgeEncryptionSpec `json:"age,omitempty"`
}

type FluxClaim struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of FluxClaim.
	// +required
	Spec FluxClaimSpec `json:"spec"`

	// status defines the observed state of FluxClaim.
	// +optional
	Status FluxClaimStatus `json:"status,omitempty,omitzero"`
}

type FluxClaimList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []FluxClaim `json:"items"`
}

type FluxClaimSource struct {
	// GitRepository is the Kustomization's spec.sourceRef, with its namespace
	// filled in.
	// +required
	GitRepository meta.NamespacedObjectReference `json:"gitRepository"`

	// URL is the GitRepository's spec.url.
	// +optional
	URL string `json:"url,omitempty"`

	// Branch is the GitRepository's spec.ref.branch.
	// +optional
	Branch string `json:"branch,omitempty"`

	// AlsoAppliedBy lists the other objects that apply this GitRepository and that
	// no FluxClaim holds: Kustomizations, and HelmReleases whose chart comes from
	// it. Each applies a new commit as soon as Flux fetches it. Information only;
	// it never affects Ready.
	// +optional
	// +listType=atomic
	AlsoAppliedBy []meta.NamespacedObjectKindReference `json:"alsoAppliedBy,omitempty"`
}

type FluxClaimSpec struct {

	// KubeProviderRef names the KubeProvider of the cluster that runs the
	// Kustomization, such as a management cluster running Flux. An omitted
	// namespace means this FluxClaim's namespace. The KubeProvider's
	// spec.allowedApplierClaims must admit this namespace, with the
	// Kustomization's namespace in applierNamespaces, and its identity needs get
	// and patch on the Kustomization and its GitRepository. Immutable: delete and
	// recreate the FluxClaim to change it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.kubeProviderRef.name must not be empty"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.kubeProviderRef is immutable; delete and recreate the FluxClaim to hold a Kustomization elsewhere"
	KubeProviderRef meta.NamespacedObjectReference `json:"kubeProviderRef"`

	// KustomizationRef names the Flux Kustomization that applies the folders of
	// the GitTargets naming this FluxClaim. Its spec.sourceRef must be a
	// GitRepository that follows a branch. An omitted namespace means this
	// FluxClaim's namespace. Immutable: delete and recreate the FluxClaim to
	// change it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.kustomizationRef is immutable; delete and recreate the FluxClaim to hold another Kustomization"
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.kustomizationRef.name must not be empty"
	KustomizationRef meta.NamespacedObjectReference `json:"kustomizationRef"`

	// CatchUpAfter is how long the Kustomization stays behind the branch after
	// a push of GitOps Reverser's own before an apply of the tip is asked for,
	// as a Go duration ("1m", "90s"). Such a push changes nothing on the
	// cluster, which already holds the edit, but leaves
	// status.lastAppliedRevision and the GitRepository's artifact at the commit
	// before it. The interval starts when the Kustomization is first seen
	// behind, so a burst of saves costs one apply, and one at the tip costs
	// none. The apply can still wait for startup, a retry backoff or edits
	// being published. "0s" never asks for this reason, and drops an apply it
	// asked for that has not started. Otherwise at least "10s" and at most
	// "24h". Defaults to "1m".
	// +optional
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ns|us|µs|μs|ms|s|m|h))+$"
	// +kubebuilder:default="1m"
	// +kubebuilder:validation:XValidation:rule="duration(self) == duration('0s') || (duration(self) >= duration('10s') && duration(self) <= duration('24h'))",message="spec.catchUpAfter must be 0s, or a Go duration from 10s to 24h"
	CatchUpAfter *metav1.Duration `json:"catchUpAfter,omitempty"`
}

type FluxClaimStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this FluxClaim's state. Ready,
	// Reconciling and Stalled follow kstatus.
	//
	// Configured is True when an eligible GitTarget names this FluxClaim, and the
	// Kustomization exists, applies a GitRepository that follows a branch, may be
	// patched, and no other FluxClaim holds it. An eligible GitTarget is in this
	// namespace, is admitted by its KubeProviders, and writes the branch the
	// GitRepository fetches. Of several FluxClaims for one Kustomization, the one
	// with an apply in flight holds it, then the one holding it already, then the
	// oldest; the others are Configured=False, reason HeldByAnotherClaim.
	//
	// InControl says whether GitOps Reverser decides when the Kustomization
	// applies:
	//
	// - True, reason Suspended: the Kustomization is suspended, and GitOps
	//   Reverser starts every apply.
	// - True, reason Applying: an apply GitOps Reverser started is running;
	//   the Kustomization is suspended again when it ends.
	// - False, reason Suspending: Flux has not yet handled the suspend.
	// - False, reason Releasing or Revoking: the FluxClaim is handing the
	//   Kustomization back.
	// - False, reason NotReferenced: no GitTarget names this FluxClaim.
	// - Unknown, reason NotConfigured: Configured is not True, or another
	//   FluxClaim holds the Kustomization.
	//
	// A FluxClaim no GitTarget names reads nothing and is Ready=True, reason
	// NotReferenced.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Source is the GitRepository the Kustomization applies, as last read. It is
	// published while an eligible GitTarget names this FluxClaim, and that
	// GitTarget must write the repository and branch it fetches.
	// +optional
	Source *FluxClaimSource `json:"source,omitempty"`

	// Operation is the apply GitOps Reverser started on the Kustomization: the one
	// in flight, or the last one. Absent until the first.
	// +optional
	Operation *ApplyOperation `json:"operation,omitempty"`

	// RepairPending is true while a Repair apply is pending: an apply ran a commit
	// older than an edit made through the API and reverted it on the cluster. Git
	// holds the edit, and the cluster runs the older value until the next apply.
	// +optional
	RepairPending bool `json:"repairPending,omitempty"`

	// PreviousSuspendState is how the Kustomization stood before this FluxClaim
	// first suspended it, and what handing it back restores: one that was
	// Suspended stays suspended, one that was NotSuspended is resumed. It is
	// cleared once the Kustomization is handed back. Absent, handing it back
	// resumes the Kustomization.
	// +optional
	PreviousSuspendState SuspendState `json:"previousSuspendState,omitempty"`
}

type GitBranch struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of GitBranch.
	// +required
	Spec GitBranchSpec `json:"spec"`

	// status defines the observed state of GitBranch.
	// +optional
	Status GitBranchStatus `json:"status,omitempty,omitzero"`
}

type GitBranchAdmission struct {
	// Admitted reports whether some grant admits the GitBranch's namespace.
	Admitted bool
	// BranchPatterns are the patterns the admitting grants give the GitBranch,
	// consumer variables expanded.
	BranchPatterns []string
	// Allowed reports whether the namespace is admitted and the branch matches one
	// of BranchPatterns.
	Allowed bool
}

type GitBranchGitTargetGrant struct {
	// ConsumerNamespaces are the namespaces whose GitTargets this grant admits.
	// from: "Same" is this GitBranch's namespace.
	// +required
	ConsumerNamespaces ConsumerNamespaces `json:"consumerNamespaces"`
}

type GitBranchList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []GitBranch `json:"items"`
}

type GitBranchParentState string

type GitBranchParentStatus struct {
	// State is what the branch would be created from: "Found" (the parent branch's
	// tip), "Missing" (the parent branch is not on the remote, so nothing is
	// written) or "Unborn" (an empty repository and no spec.parentBranch, so the
	// first commit has no history).
	// +required
	State GitBranchParentState `json:"state"`

	// Branch is the parent branch: spec.parentBranch, or the remote's default
	// branch when that is omitted. Empty when state is "Unborn", and when the
	// remote names no default branch.
	// +optional
	Branch string `json:"branch,omitempty"`

	// Commit is the commit hash the parent branch is at on the remote, which the
	// branch's first commit would build on. Set only when state is "Found".
	// +optional
	Commit string `json:"commit,omitempty"`
}

type GitBranchRemoteStatus struct {
	// Commit is the commit hash the branch is at on the remote. Empty means the
	// branch is not on the remote yet, which is not an error: a branch nothing has
	// written to does not exist.
	// +optional
	Commit string `json:"commit,omitempty"`

	// LastVerifiedAt is when the remote was last observed.
	// +optional
	LastVerifiedAt *metav1.Time `json:"lastVerifiedAt,omitempty"`

	// VerifiedBy is how commit was learned: "Push" means the remote accepted a
	// push from GitOps Reverser, and "Fetch" means a fetch found it. "Fetch" next
	// to a commit GitOps Reverser did not make means somebody else pushed to the
	// branch.
	// +optional
	// +kubebuilder:validation:Enum=Push;Fetch
	VerifiedBy string `json:"verifiedBy,omitempty"`

	// Parent is what the branch would be created from. Set only while the branch
	// is not on the remote.
	// +optional
	Parent *GitBranchParentStatus `json:"parent,omitempty"`
}

type GitBranchSpec struct {
	// GitProviderRef names the GitProvider whose repository and credential write
	// this branch. An omitted namespace means this GitBranch's namespace. The
	// GitProvider's spec.allowedGitBranches must admit this namespace and
	// spec.branch. Immutable: delete and recreate the GitBranch to change it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.gitProviderRef.name must not be empty"
	GitProviderRef meta.NamespacedObjectReference `json:"gitProviderRef"`

	// Branch is the branch on the remote that this GitBranch writes. It must match
	// a branch pattern that the GitProvider's spec.allowedGitBranches give this
	// namespace. Only one GitBranch holds a repository branch: the oldest admitted
	// one whose credential can open a push session. Any other reports Stalled,
	// reason BranchConflict. Immutable: delete and recreate the GitBranch to
	// change it.
	// +required
	// +kubebuilder:validation:MinLength=1
	Branch string `json:"branch"`

	// ParentBranch is the branch spec.branch is created from, and compared
	// against while spec.branch does not exist on the remote. Omitted, it is the
	// remote's default branch, or no history at all in an empty repository.
	//
	// When set, it must exist on the remote for spec.branch to be created;
	// otherwise this GitBranch reports Stalled=True, reason ParentBranchNotFound,
	// and writes nothing. Once spec.branch exists, the parent branch is no
	// longer followed. It is only read, so the GitProvider's
	// spec.allowedGitBranches need not allow it.
	//
	// Immutable, including adding or removing it: delete and recreate the
	// GitBranch to change it.
	// +optional
	// +kubebuilder:validation:MinLength=1
	ParentBranch string `json:"parentBranch,omitempty"`

	// AllowedGitTargets says which GitTargets may write through this GitBranch:
	//
	// - Omitted: the GitTargets in this GitBranch's namespace, as one grant
	//   with from: "Same".
	// - Empty list ([]): no GitTarget.
	// - A list of grants: the GitTargets that at least one grant allows.
	//
	// A list replaces the default: the GitTargets in this namespace keep access
	// only if at least one grant allows them.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:default={{consumerNamespaces: {from: Same}}}
	AllowedGitTargets []GitBranchGitTargetGrant `json:"allowedGitTargets"`
}

type GitBranchStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this GitBranch's state: whether it
	// holds its repository branch and can write it. Ready, Reconciling and Stalled
	// follow kstatus.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Repository is the GitProvider's repository URL, normalized to host and path
	// with no scheme, user or ".git" suffix. With spec.branch it is what only one
	// GitBranch may hold, so two GitProviders that spell one repository
	// differently still conflict.
	// +optional
	Repository string `json:"repository,omitempty"`

	// LastPushNoticeAt is when a GitReceiver last delivered a push for this
	// branch. It records that the delivery arrived; status.remote says what the
	// remote holds. Absent means no delivery has reached this branch: no
	// GitReceiver is set up or reachable, the delivery names the repository by a
	// URL other than the GitProvider's spec.url, or no GitTarget references this
	// GitBranch. It advances at most once a minute.
	// +optional
	LastPushNoticeAt *metav1.Time `json:"lastPushNoticeAt,omitempty"`

	// Remote is where this branch is on the Git remote, and when that was last
	// checked by a push or a fetch. It is updated at most once a minute. Absent
	// until the first check, and again after the GitProvider is recreated for
	// another repository.
	// +optional
	Remote *GitBranchRemoteStatus `json:"remote,omitempty"`

	// GitTargetCount is how many GitTargets, in any namespace, reference this
	// GitBranch. Each one reports its own folder's health in its own conditions.
	// +optional
	GitTargetCount int32 `json:"gitTargetCount"`
}

type GitProvider struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of GitProvider.
	// +required
	Spec GitProviderSpec `json:"spec"`

	// status defines the observed state of GitProvider.
	// +optional
	Status GitProviderStatus `json:"status,omitempty,omitzero"`
}

type GitProviderGitBranchGrant struct {
	// ConsumerNamespaces are the namespaces whose GitBranches this grant admits.
	// from: "Same" is this GitProvider's namespace.
	// +required
	ConsumerNamespaces ConsumerNamespaces `json:"consumerNamespaces"`

	// BranchPatterns are the branches an admitted GitBranch may claim, each
	// matched against the whole branch name. "*" matches any characters, "/"
	// included, so "*" alone is every branch and "main" is only main.
	// "{consumer.namespace}" and "{consumer.name}" are the GitBranch's namespace
	// and name, each a whole path segment: "teams/{consumer.namespace}/*".
	// "{consumer.name}" needs "{consumer.namespace}" in the same pattern, because
	// a GitBranch picks its own name. There is no escaping, "?" or character
	// class.
	// +required
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	BranchPatterns []BranchPattern `json:"branchPatterns"`
}

type GitProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []GitProvider `json:"items"`
}

type GitProviderSpec struct {
	// URL is the repository's URL, over HTTPS or SSH. Immutable: delete and
	// recreate the GitProvider to change it.
	// +kubebuilder:validation:MinLength=1
	URL string `json:"url"`

	// SecretRef names the Secret, in this namespace, that holds the credentials
	// for the repository. Omitted means anonymous access.
	// +optional
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.secretRef.name must not be empty; omit secretRef entirely for anonymous access"
	SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`

	// KnownHostsRef names a ConfigMap or Secret, in this namespace, holding SSH
	// known_hosts, so several GitProviders on one host can share them. SSH only.
	//
	// Host keys come from the first of these that has any:
	//
	// 1. the known_hosts key of the credentials Secret, spec.secretRef;
	// 2. this reference;
	// 3. the installation's default.
	//
	// Without host keys, SSH fails unless the installation sets
	// --insecure-allow-missing-known-hosts.
	// +optional
	KnownHostsRef *KnownHostsReference `json:"knownHostsRef,omitempty"`

	// AllowedGitBranches says which GitBranches may claim a branch of this
	// repository through this GitProvider: a grant must admit the GitBranch's
	// namespace, and one of its branchPatterns must match the GitBranch's
	// spec.branch. Grants combine by union. Unlike the grant lists of GitBranch
	// and KubeProvider it has no default: omitted or empty, no GitBranch may claim
	// through it, including in this namespace.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	AllowedGitBranches []GitProviderGitBranchGrant `json:"allowedGitBranches,omitempty"`

	// Commit sets the committer identity and commit signing. Commit messages are
	// set on the GitTarget, in spec.commit.message.
	// +optional
	Commit *CommitSpec `json:"commit,omitempty"`
}

type GitProviderStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this GitProvider's state: whether
	// the repository answers with its credential, and whether commit signing is
	// ready. Ready, Reconciling and Stalled follow kstatus.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// SigningPublicKey is the SSH public key commits are signed with, in
	// authorized_keys format. Register it as a signing key with your Git host. Set
	// only when spec.commit.signing is configured and its key is available.
	// +optional
	SigningPublicKey string `json:"signingPublicKey,omitempty"`

	// LastVerifiedAt is the time of the last successful connectivity check
	// against the repository, using this GitProvider's credentials, or
	// anonymous access when spec.secretRef is omitted. It is never cleared, and
	// a failure leaves it unchanged, so it does not show when a failure began.
	// status.conditions gives the reason the GitProvider is not ready.
	// +optional
	LastVerifiedAt *metav1.Time `json:"lastVerifiedAt,omitempty"`
}

type GitReceiver struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of GitReceiver.
	// +required
	Spec GitReceiverSpec `json:"spec"`

	// status defines the observed state of GitReceiver.
	// +optional
	Status GitReceiverStatus `json:"status,omitempty,omitzero"`
}

type GitReceiverList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []GitReceiver `json:"items"`
}

type GitReceiverSpec struct {
	// Type is the payload and signature format the Git host sends:
	//
	// - "github": GitHub's payload, signed in X-Hub-Signature-256.
	// - "gitlab": GitLab's payload, with the secret in X-Gitlab-Token.
	// - "gitea": Gitea's payload, signed in X-Gitea-Signature.
	// - "generic-hmac": a relay of your own. It sends a JSON object with
	//   repository, branch and after fields, signed in X-Signature as
	//   sha256=<hex HMAC of the body>.
	// +required
	// +kubebuilder:validation:Enum=github;gitlab;gitea;generic-hmac
	Type ReceiverType `json:"type"`

	// SecretRef names the Secret, in this namespace, whose "token" key is the
	// webhook secret. The token also determines status.webhookPath, so rotating it
	// moves the path: register the new path with the new secret.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.secretRef.name must not be empty"
	SecretRef meta.LocalObjectReference `json:"secretRef"`
}

type GitReceiverStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this GitReceiver's state. Ready,
	// Reconciling and Stalled follow kstatus; Ready is True once the token is
	// readable and the receiver listener is on.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// WebhookPath is the path this GitReceiver is served on, under the receiver
	// listener: /git-push/ and an HMAC of its namespace and name, keyed by the
	// token. Point the Git host's push webhook at the listener's address plus this
	// path. Empty while the token is missing.
	// +optional
	WebhookPath string `json:"webhookPath,omitempty"`
}

type GitTarget struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of GitTarget.
	// +required
	Spec GitTargetSpec `json:"spec"`

	// status defines the observed state of GitTarget.
	// +optional
	Status GitTargetStatus `json:"status,omitempty,omitzero"`
}

type GitTargetCommitRequestGrant struct {
	// ConsumerNamespaces are the namespaces, on the cluster GitOps Reverser
	// runs in, whose CommitRequests this grant admits. from: "Same" is this
	// GitTarget's namespace. It admits requests only for a GitTarget whose
	// KubeProvider sets spec.inCluster.
	// +optional
	ConsumerNamespaces *ConsumerNamespaces `json:"consumerNamespaces,omitempty"`

	// SourceNamespaces are the namespaces, on the cluster spec.kubeProviderRef
	// names, whose CommitRequests this grant admits: exact names, or "*" for
	// every namespace this GitTarget may mirror. Variables are refused. A
	// namespace the KubeProvider does not lend this GitTarget in
	// spec.allowedGitTargets is never admitted. It admits requests only for a
	// GitTarget whose KubeProvider names a kubeconfig.
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	SourceNamespaces []SourceNamespace `json:"sourceNamespaces,omitempty"`
}

type GitTargetCommitSpec struct {

	// Window sets when this GitTarget's commit windows close. A window opens on an
	// author's first write and collects that author's writes until idleTimeout
	// passes without one, or maxDuration after it opened, whichever comes first. A
	// change applies to windows opened afterward. A CommitRequest attached to a
	// window replaces both timers for that window.
	// +optional
	Window *CommitWindow `json:"window,omitempty"`

	// Message sets the commit message templates. A template left empty uses the
	// built-in one.
	// +optional
	Message *CommitMessageSpec `json:"message,omitempty"`
}

type GitTargetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []GitTarget `json:"items"`
}

type GitTargetPlacementSpec struct {
	// ByType maps a resource type, written "{group}/{version}/{resource}"
	// ("apps/v1/deployments", or "v1/configmaps" for the core group), to the path
	// template for new resources of that type. The template of a sensitive type,
	// such as Secrets, must contain the resource's whole identity, so two of them
	// never share a file.
	// +optional
	ByType map[string]string `json:"byType,omitempty"`

	// Default is the path template for a new resource whose type has no byType
	// entry. Omitted, a new document goes next to the folder's kustomization when
	// exactly one governs the folder, and otherwise to
	// {namespace}/{group}/{resource}/{name}.yaml. That path has no version, so add
	// {version} to a template to keep two versions of one resource apart. A
	// bundling template such as "all.yaml" is valid only when every sensitive type
	// has its own byType entry.
	// +optional
	Default string `json:"default,omitempty"`

	// UseKustomize makes GitOps Reverser create a kustomization.yaml at spec.path
	// when no kustomization governs the folder yet. The first new document creates
	// it, listing every managed document already in the folder and the new one,
	// and nothing else: no namespace:. It has no effect on a folder that already
	// has a kustomization. A new file is always added to the kustomization
	// governing it, and a template that places a document outside that
	// kustomization is refused. Defaults to false.
	// +optional
	UseKustomize bool `json:"useKustomize,omitempty"`
}

type GitTargetPlacementStatus struct {
	// Mode is how this folder is written.
	//
	// "Plain": no kustomization governs the folder. Documents are written and
	// removed, and nothing else is touched.
	//
	// "KustomizeRoot": one kustomization governs the folder and renders nothing
	// outside it. A new document is also added to its resources:, a removed one is
	// dropped from it, and every write is checked by rendering, so kustomize can
	// refuse one.
	//
	// "KustomizeOverlay": as KustomizeRoot, and the folder also renders a base
	// outside it (readOnlyBases). An edit to a field the base sets is written into
	// the overlay where it can be (images:, replicas:) and refused with
	// WriteBoundaryRefused otherwise. Deleting an object the base supplies writes
	// a $patch: delete into the overlay.
	//
	// Empty when the folder holds more than one kustomize root
	// (LayoutResolved=Ambiguous): no new document is placed until spec.path points
	// at one of them.
	// +optional
	// +kubebuilder:validation:Enum=Plain;KustomizeRoot;KustomizeOverlay
	Mode PlacementMode `json:"mode,omitempty"`

	// RenderRoot is the kustomization directory that governs new documents,
	// relative to spec.path ("." is the folder itself). Empty for Plain, and when
	// the layout is Ambiguous.
	// +optional
	RenderRoot string `json:"renderRoot,omitempty"`

	// ReadOnlyBases are the kustomization directories this folder renders but may
	// not write, relative to spec.path, so they start with "../". Set only for
	// KustomizeOverlay. An edit to a document under one of them is refused with
	// WriteBoundaryRefused unless the overlay can express it.
	// +optional
	ReadOnlyBases []string `json:"readOnlyBases,omitempty"`

	// ResolvedAtCommit is the commit at which this layout was first seen. It does
	// not move while the layout stays the same, so a commit older than the branch
	// head means the layout has not changed since. Empty until the branch has a
	// commit.
	// +optional
	ResolvedAtCommit string `json:"resolvedAtCommit,omitempty"`

	// ResolvedAt is when this layout was first seen. Like resolvedAtCommit, it
	// does not move while the layout stays the same.
	// +optional
	ResolvedAt *metav1.Time `json:"resolvedAt,omitempty"`
}

type GitTargetRetentionStatus struct {
	// Mode is the spec.prune.mode these counts were taken under, with the default
	// applied.
	// +optional
	// +kubebuilder:validation:Enum=Never;OnEvent;Always
	Mode PruneMode `json:"mode,omitempty"`

	// RetainedDocuments is how many documents the prune policy kept that have no
	// resource on the cluster. Zero means a resync found nothing to keep. An
	// absent retention block means no resync has reported yet.
	RetainedDocuments int32 `json:"retainedDocuments"`

	// LastChangedAt is when the count or the mode last changed. A resync that
	// reports the same count leaves it alone, so it does not say when retention
	// was last measured.
	// +optional
	LastChangedAt *metav1.Time `json:"lastChangedAt,omitempty"`
}

type GitTargetSpec struct {
	// GitBranchRef names the GitBranch this GitTarget writes to: the repository
	// branch and the credential that writes it. An omitted namespace means this
	// GitTarget's namespace. The GitBranch's spec.allowedGitTargets must admit
	// this namespace. Several GitTargets may share one GitBranch. Immutable:
	// delete and recreate the GitTarget to change it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.gitBranchRef.name must not be empty"
	GitBranchRef meta.NamespacedObjectReference `json:"gitBranchRef"`

	// Path is the folder this GitTarget writes, relative to the repository root.
	// Use "." for the root itself. A leading "/" and ".." are rejected, and a
	// trailing "/" is dropped. Immutable: delete and recreate the GitTarget to
	// change it.
	// +required
	// +kubebuilder:validation:MinLength=1
	Path string `json:"path"`

	// Encryption configures how Secrets are encrypted before they are written to
	// Git.
	// +optional
	Encryption *EncryptionSpec `json:"encryption,omitempty"`

	// ApplierClaimRef names the FluxClaim or ArgoCDClaim, in this namespace, that
	// holds the applier of this folder: the Flux Kustomization or Argo CD
	// Application that applies it. With it set, GitOps Reverser decides when that
	// applier runs, and runs it only after the edits it holds are published.
	// Objects another applier owns are not mirrored into the folder. The applier
	// must apply this GitTarget's repository and branch; the ApplierClaimReady
	// condition reports whether it does. Several GitTargets may name one applier
	// claim.
	// +optional
	ApplierClaimRef *ApplierClaimReference `json:"applierClaimRef,omitempty"`

	// OnRefusal decides what happens when a live edit is refused because it has no
	// valid place in the folder. A refusal makes no commit, so the edit stays on
	// the cluster until something applies Git over it.
	//
	// "Ignore" (the default) reports the refusal in conditions and events and does
	// nothing else.
	//
	// "Reapply" asks the applier in spec.applierClaimRef, which it requires, to
	// apply the branch once the pending edits are published, which reverts the
	// refused edit. It fires only for an edit to a document the folder already
	// holds, in a write that removes no document, and never for a refusal of the
	// whole folder, such as unparseable YAML. A refusal that stands is reapplied
	// once, not on every recheck.
	// +optional
	// +kubebuilder:validation:Enum=Ignore;Reapply
	// +kubebuilder:default=Ignore
	OnRefusal RefusalAction `json:"onRefusal,omitempty"`

	// Placement decides where a new resource is written: one with no document
	// in the folder yet. A resource that already has a document is updated
	// where that document is. So a change here affects only resources created
	// afterward, and labeling a resource later never moves its file.
	//
	// byType and default are path templates over the resource's identity:
	// {namespace}, {name}, {group}, {version}, {resource}, {kind} and more. They
	// may read a label: "{label:app.kubernetes.io/instance}/configmaps.yaml".
	//
	// Two variables can be absent, and each then renders a built-in value:
	//
	// - "{label:key}" renders "_unlabeled" for a resource without the label.
	// - "{namespace}" renders "_cluster" for a cluster-scoped resource.
	//
	// Append "|fallback" to either to choose that value instead:
	// "{label:team|unassigned}", "{namespace|_global}". A fallback is up to 63
	// characters of [A-Za-z0-9._-], is not "." or "..", and may be empty to
	// drop the path segment. A {namespace} fallback that names a real namespace
	// files cluster-scoped resources in that namespace's folder. A fallback on
	// any other variable is rejected.
	// +optional
	Placement *GitTargetPlacementSpec `json:"placement,omitempty"`

	// SerializeNamespace decides whether a namespaced resource's document
	// carries metadata.namespace. It applies to every write, not just the
	// first, and is ignored for cluster-scoped resources.
	//
	// - Omitted: decided per document. The namespace is left out only when the
	//   kustomization governing the document's path sets namespace: to that
	//   same namespace. This suits a folder of nested kustomize roots that each
	//   set their own namespace.
	// - true: always written. Use it for a flat folder applied as is.
	// - false: never written, for a folder whose namespace something else
	//   supplies: a Flux Kustomization's targetNamespace, an Argo CD
	//   Application's destination.namespace, or a kustomization.
	//
	// With false, the folder holds one source namespace. A WatchRule bringing a
	// second one is refused with GitPathAccepted=False, reason
	// MultipleSourceNamespaces.
	// +optional
	SerializeNamespace *bool `json:"serializeNamespace,omitempty"`

	// KubeProviderRef names the KubeProvider this GitTarget mirrors from: the
	// source cluster and the credential that reads it. An omitted namespace means
	// this GitTarget's namespace. The KubeProvider's spec.allowedGitTargets must
	// admit this namespace. Immutable: delete and recreate the GitTarget to change
	// it.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.kubeProviderRef.name must not be empty"
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.kubeProviderRef is immutable; delete and recreate the GitTarget to change the cluster it mirrors"
	KubeProviderRef meta.NamespacedObjectReference `json:"kubeProviderRef"`

	// Prune decides which deletions remove documents from this folder: a delete
	// observed on the source cluster, and a document a resync finds no resource
	// for. Omitted, mode is "OnEvent": observed deletes are mirrored, and a resync
	// removes nothing.
	// +optional
	Prune *PrunePolicy `json:"prune,omitempty"`

	// Commit configures how this GitTarget's writes are batched into commits and
	// how the commits are worded. Omitted, a commit window closes 5s after its
	// last write or 1m after it opened, and the built-in message templates are
	// used.
	// +optional
	Commit *GitTargetCommitSpec `json:"commit,omitempty"`

	// AllowedCommitRequests says which CommitRequests may save this GitTarget's
	// commit windows. Each grant sets one of:
	//
	// - consumerNamespaces: namespaces of the cluster GitOps Reverser runs
	//   in. They admit requests only when spec.kubeProviderRef names an
	//   inCluster KubeProvider.
	// - sourceNamespaces: namespaces of the cluster spec.kubeProviderRef
	//   names, which must set spec.commitRequests. They admit requests only
	//   when that KubeProvider names a kubeconfig.
	//
	// Omitted, the CommitRequests in this GitTarget's namespace are admitted,
	// as one grant with consumerNamespaces from: "Same". An empty list ([])
	// admits none. A list replaces the default. A request no grant admits
	// fails with reason "NotAllowed".
	//
	// An admitted request saves its creator's whole commit window on this
	// GitTarget, writes outside the request's namespace included.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:default={{consumerNamespaces: {from: Same}}}
	AllowedCommitRequests []GitTargetCommitRequestGrant `json:"allowedCommitRequests"`

	// Suspend stops this GitTarget from making new commits, without deleting
	// it. Defaults to false.
	//
	// While it is set, watches keep running and status.placement stays current,
	// but status.retention is not published.
	//
	// A commit already made locally is still pushed, so one more commit can
	// appear seconds after it is set: suspend stops the next write and does not
	// undo the last one.
	//
	// Clearing it resumes from the current cluster state at the next resync.
	// Writes skipped while suspended are not replayed.
	// +optional
	Suspend bool `json:"suspend,omitempty"`
}

type GitTargetStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this GitTarget's state. Ready,
	// Reconciling and Stalled follow kstatus; the others say which check holds the
	// GitTarget back.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Streams counts the types this GitTarget watches, by watch state.
	// +optional
	Streams *StreamsStatus `json:"streams,omitempty"`

	// Retention counts the documents a resync kept because spec.prune.mode did not
	// allow removing them. A delete observed on the cluster and not mirrored under
	// "Never" is not counted, so a "Never" folder can report zero. It is
	// information only and changes no condition.
	// +optional
	Retention *GitTargetRetentionStatus `json:"retention,omitempty"`

	// Placement is this folder's layout as the last scan resolved it: whether a
	// kustomization governs new documents, which one, and which bases the folder
	// renders but may not write. The LayoutResolved condition gives the verdict.
	// +optional
	Placement *GitTargetPlacementStatus `json:"placement,omitempty"`
}

type GrantFrom string

type GrantNamespace string

type KnownHostsReference struct {
	// Kind is "ConfigMap" or "Secret". Defaults to "ConfigMap".
	// +optional
	// +kubebuilder:validation:Enum=ConfigMap;Secret
	// +kubebuilder:default=ConfigMap
	Kind string `json:"kind,omitempty"`

	// Name is the name of the ConfigMap or Secret. Its "known_hosts" key is read,
	// or "ssh_known_hosts" (the key Argo CD's argocd-ssh-known-hosts-cm uses) when
	// that is absent.
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type KubeProvider struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata.
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of KubeProvider.
	// +required
	Spec KubeProviderSpec `json:"spec"`

	// status defines the observed state of KubeProvider.
	// +optional
	Status KubeProviderStatus `json:"status,omitempty,omitzero"`
}

type KubeProviderApplierClaimGrant struct {
	// ConsumerNamespaces are the namespaces whose FluxClaims and ArgoCDClaims this
	// grant admits. from: "Same" is this KubeProvider's namespace.
	// +required
	ConsumerNamespaces ConsumerNamespaces `json:"consumerNamespaces"`

	// ApplierNamespaces are the namespaces, in this KubeProvider's cluster, where
	// the Kustomization or Application of an admitted applier claim may be: exact
	// names, "{consumer.namespace}" for the namespace named like the claim's, or
	// "*" for every namespace. The scope is the union over every grant admitting
	// the claim, checked when the claim reconciles and when a grant changes. An
	// applier outside it is refused (ApplierNamespaceNotAllowed), and a claim
	// holding it hands it back.
	// +required
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	ApplierNamespaces []ScopeNamespace `json:"applierNamespaces"`
}

type KubeProviderApplierClaimScope struct {
	// Admitted reports whether some grant admits the applier claim's namespace.
	Admitted bool
	// ApplierNamespaces is the union of the admitting grants' applierNamespaces,
	// consumer variables expanded. "*" is every namespace.
	ApplierNamespaces []string
}

type KubeProviderAttribution struct {
	// AuditRoute is the route this cluster's audit events arrive on: the <route>
	// in the API server's audit webhook URL, /audit-webhook/<route>. When several
	// logical clusters share one webhook backend, it is instead the value of the
	// audit-event annotation that --author-attribution-audit-route-annotation-key
	// names. KubeProviders with the same route read the same cluster's
	// attribution facts.
	//
	// Empty means <namespace>.<name>. Set it when several KubeProviders in this
	// namespace connect to one cluster, since an API server posts under one
	// route.
	//
	// A route belongs to one namespace:
	//
	// - the namespace the route starts with (<namespace>.), when a KubeProvider
	//   there carries it;
	// - otherwise, the namespace of the oldest KubeProvider carrying it.
	//
	// KubeProviders in another namespace that carry the route report
	// Stalled=True, reason AuditRouteConflict, and are not used.
	// +optional
	// +kubebuilder:validation:MaxLength=253
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$`
	AuditRoute string `json:"auditRoute,omitempty"`
}

type KubeProviderClient struct {
	// QPS is the sustained request rate to this cluster, in queries per second.
	// Defaults to 20.
	// +optional
	// +kubebuilder:validation:Minimum=1
	QPS *int32 `json:"qps,omitempty"`

	// Burst is how many requests to this cluster may exceed qps at once. Defaults
	// to 30.
	// +optional
	// +kubebuilder:validation:Minimum=1
	Burst *int32 `json:"burst,omitempty"`
}

type KubeProviderCommitRequestsStatus struct {
	// Namespaces are the namespaces whose CommitRequests are watched: the ones
	// this KubeProvider lends the GitTargets that mirror through it. "*" is
	// every namespace, in one watch.
	// +optional
	// +listType=set
	Namespaces []string `json:"namespaces,omitempty"`
}

type KubeProviderGitTargetGrant struct {
	// ConsumerNamespaces are the namespaces whose GitTargets this grant admits.
	// from: "Same" is this KubeProvider's namespace.
	// +required
	ConsumerNamespaces ConsumerNamespaces `json:"consumerNamespaces"`

	// SourceNamespaces are the source-cluster namespaces that the WatchRules of an
	// admitted GitTarget may read, in rules[].sourceNamespace: exact names,
	// "{consumer.namespace}" for the namespace named like the GitTarget's, or "*".
	// Omitted, this grant gives none.
	//
	// The scope is the union over every grant admitting the GitTarget. It permits
	// and selects nothing: a namespace is read only when a WatchRule names it. A
	// rule with sourceNamespace "*" needs "*" in a grant, and is refused, not
	// narrowed, without it. A WatchRule with any rule outside the scope is refused
	// as a whole (SourceNamespaceNotAllowed) when it reconciles or a grant
	// changes. The credential's RBAC still applies inside the scope.
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	SourceNamespaces []ScopeNamespace `json:"sourceNamespaces,omitempty"`

	// ClusterResources are the cluster-scoped types that the ClusterWatchRules of
	// an admitted GitTarget may mirror: resource.group
	// ("clusterroles.rbac.authorization.k8s.io"), a bare resource for the core
	// group ("nodes"), or "*" for every type, including CRDs installed later. Each
	// covers every served version. Omitted, this grant gives none.
	//
	// The scope is the union over every grant admitting the GitTarget, and mirrors
	// nothing until a ClusterWatchRule asks for a type. A rule with "*" in
	// apiGroups or resources needs "*" in a grant, and is refused, not narrowed,
	// without it. A ClusterWatchRule asking for any type outside the scope is
	// refused as a whole (ClusterResourceNotAllowed) when it reconciles.
	// +optional
	// +listType=set
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=64
	ClusterResources []ClusterResourceIdentity `json:"clusterResources,omitempty"`
}

type KubeProviderGitTargetScope struct {
	// Admitted reports whether some grant admits the GitTarget's namespace.
	Admitted bool
	// SourceNamespaces is the union of the admitting grants' sourceNamespaces,
	// consumer variables expanded. "*" is every namespace.
	SourceNamespaces []string
	// ClusterResources is the union of the admitting grants' clusterResources. "*"
	// is every cluster-scoped resource.
	ClusterResources []string
}

type KubeProviderInCluster struct{}

type KubeProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []KubeProvider `json:"items"`
}

type KubeProviderSpec struct {
	// SecretRef names the Secret, in this namespace, that holds a kubeconfig for
	// the cluster. With no key, the kubeconfig is read from "value", then
	// "value.yaml". A kubeconfig that uses exec auth, insecure-skip-tls-verify or
	// credentials named by file path is refused with Validated=False unless the
	// installation allows it. Set exactly one of secretRef and inCluster.
	// Immutable: delete and recreate the KubeProvider to change it.
	// +optional
	// +kubebuilder:validation:XValidation:rule="size(self.name) > 0",message="spec.secretRef.name must not be empty"
	SecretRef *meta.SecretKeyReference `json:"secretRef,omitempty"`

	// InCluster makes this KubeProvider use the operator's own identity in the
	// cluster it runs in. It is honored only for a KubeProvider the installation
	// lists in --in-cluster-kube-providers; any other reports Stalled=True, reason
	// InClusterNotAuthorized, and is never used. Set exactly one of secretRef and
	// inCluster. Immutable: delete and recreate the KubeProvider to change it.
	// +optional
	InCluster *KubeProviderInCluster `json:"inCluster,omitempty"`

	// AllowedGitTargets says which GitTargets may mirror through this
	// KubeProvider, and what. Each grant allows the GitTargets of some
	// namespaces, bounds which source namespaces their WatchRules may read
	// (sourceNamespaces), and lists the cluster-scoped types their
	// ClusterWatchRules may mirror (clusterResources).
	//
	// - Omitted: the GitTargets in this KubeProvider's namespace, reading only
	//   the source namespace of the same name and no cluster-scoped type.
	// - Empty list ([]): no GitTarget.
	// - A list of grants: the GitTargets that at least one grant allows, with
	//   what every grant that allows them permits.
	//
	// A list replaces the default: the GitTargets in this namespace keep access
	// only if at least one grant allows them.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:default={{consumerNamespaces: {from: Same}, sourceNamespaces: {"{consumer.namespace}"}}}
	AllowedGitTargets []KubeProviderGitTargetGrant `json:"allowedGitTargets"`

	// AllowedApplierClaims says which FluxClaims and ArgoCDClaims may hold an
	// applier through this KubeProvider, and in which namespaces that applier
	// may be (applierNamespaces). A namespace in allowedGitTargets gets no
	// applier access from that.
	//
	// - Omitted: the claims in this KubeProvider's namespace, holding appliers
	//   in the namespace of the same name.
	// - Empty list ([]): no claim.
	// - A list of grants: the claims that at least one grant allows, holding
	//   appliers in the applierNamespaces of every grant that allows them.
	//
	// A list replaces the default: the claims in this namespace keep access
	// only if at least one grant allows them.
	// +optional
	// +listType=atomic
	// +kubebuilder:validation:MaxItems=64
	// +kubebuilder:default={{consumerNamespaces: {from: Same}, applierNamespaces: {"{consumer.namespace}"}}}
	AllowedApplierClaims []KubeProviderApplierClaimGrant `json:"allowedApplierClaims"`

	// Client sets the request rate limits for this cluster. Omitted, they are 20
	// QPS with a burst of 30. Refused beside inCluster.
	// +optional
	Client *KubeProviderClient `json:"client,omitempty"`

	// Attribution configures how commit authors are found from this cluster's
	// audit events.
	// +optional
	Attribution *KubeProviderAttribution `json:"attribution,omitempty"`

	// CommitRequests says whether GitOps Reverser serves the CommitRequests
	// created on this cluster, for the GitTargets that mirror through this
	// KubeProvider:
	//
	// - "Ignore": they are left alone.
	// - "Reconcile": the requests in the namespaces this KubeProvider lends
	//   its GitTargets in spec.allowedGitTargets are served, and their status
	//   is written. A finished request stays.
	// - "ReconcileAndDeleteFinished": as "Reconcile", and a finished request
	//   is annotated configbutler.ai/delete-after and deleted once that time
	//   has passed.
	//
	// Defaults to "Ignore". Only "Ignore" goes with inCluster: the
	// CommitRequests of the cluster GitOps Reverser runs in are always served.
	//
	// The credential needs get, list and watch on commitrequests, and update
	// on commitrequests/status, in the configbutler.ai group, in each lent
	// namespace; "ReconcileAndDeleteFinished" also needs patch and delete on
	// commitrequests. The CommitRequest CRD must be installed on the cluster.
	// The CommitRequestsServed condition reports how it goes.
	// +optional
	// +kubebuilder:validation:Enum=Ignore;Reconcile;ReconcileAndDeleteFinished
	// +kubebuilder:default=Ignore
	CommitRequests CommitRequestsPolicy `json:"commitRequests,omitempty"`
}

type KubeProviderStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// AuditRoute is the route in use: spec.attribution.auditRoute, or
	// <namespace>.<name> when that is empty. The AuditFactsReceived condition
	// describes this route, and starts over when it changes.
	// +optional
	AuditRoute string `json:"auditRoute,omitempty"`

	// CommitRequests is what this KubeProvider serves of its cluster's
	// CommitRequests. Absent while spec.commitRequests is "Ignore".
	// +optional
	CommitRequests *KubeProviderCommitRequestsStatus `json:"commitRequests,omitempty"`

	// Conditions are the latest observations of this KubeProvider's state. Ready,
	// Reconciling and Stalled follow kstatus; Stalled=True with reason
	// InClusterNotAuthorized or AuditRouteConflict means the KubeProvider is not
	// used at all. Validated says whether the credential is safe and readable,
	// checked without connecting.
	//
	// AuditFactsReceived, which is not part of Ready, says whether an attribution
	// fact has ever arrived on status.auditRoute. It is True (Received) from the
	// first one on and never goes back. Until then it is Unknown, and the reason
	// says where to look: TransportUnavailable (the fact store refuses writes),
	// NoAuditDelivery (no audit events arrive at all), or RouteUnused (audit
	// events arrive, but never on this route). It is absent when author
	// attribution is off.
	//
	// CommitRequestsServed, which is not part of Ready either, says whether
	// this cluster's CommitRequests are served. It is absent while
	// spec.commitRequests is "Ignore". Each reason that is not True ends with
	// its fix:
	//
	// - True, Watching: watched in status.commitRequests.namespaces.
	// - True, NothingToWatch: no GitTarget mirroring through this KubeProvider
	//   is lent a namespace.
	// - False, CRDNotInstalled: the cluster serves no CommitRequest CRD.
	// - False, VersionNotServed: the CRD does not serve v1alpha3.
	// - False, Forbidden: the credential may not list or watch them.
	// - Unknown, Unreachable: the cluster's API could not be read.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type NothingToCommitAction string

type PlacementMode string

type PruneMode string

type PrunePolicy struct {

	// Mode decides which deletions are mirrored. Defaults to "OnEvent".
	//
	// - "OnEvent": mirrors a delete observed on the source cluster; a resync
	//   removes nothing.
	// - "Never": removes nothing.
	// - "Always": as "OnEvent", and a resync also removes a document that has
	//   no resource on the cluster.
	// +optional
	// +kubebuilder:validation:Enum=Never;OnEvent;Always
	// +kubebuilder:default=OnEvent
	Mode PruneMode `json:"mode,omitempty"`
}

type ReceiverType string

type RefusalAction string

type ResourceRule struct {
	// APIGroups are the API groups to match: "" is the core group, and "*" is
	// every group, as in ["", "apps"] or ["*"]. Omitted, each resource name is
	// looked up across the served groups and must be served by exactly one.
	// +optional
	APIGroups []string `json:"apiGroups,omitempty"`

	// APIVersions are the versions to match, or "*" for every served version.
	// Omitted, each resource's preferred version is used. The built-in Git path
	// has no version, so two versions of one object share a file unless the
	// GitTarget's placement template includes {version}.
	// +optional
	APIVersions []string `json:"apiVersions,omitempty"`

	// Resources are the resource types to match, by plural name ("configmaps",
	// "deployments"), or "*" for every type. Matching is exact and
	// case-insensitive; partial wildcards such as "pod*" match nothing, and
	// subresources ("pods/log") are rejected. For a custom resource whose name
	// more than one group serves, set apiGroups.
	// +required
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:items:MinLength=1
	// +kubebuilder:validation:items:Pattern=`^[^/]*$`
	Resources []string `json:"resources"`

	// ObjectSelector mirrors only the objects whose labels match, as a
	// standard label selector. Omitted or {} selects every object.
	//
	// An object that stops matching is handled like a deleted one: the
	// GitTarget's spec.prune.mode decides whether its document is removed.
	// With prune mode "Always", a resync also removes documents of the type
	// that the selector does not match.
	//
	// Two rules on one GitTarget that select the same type in overlapping
	// namespaces must use the same selector. The older rule keeps the type,
	// and the newer one is refused with ResourcesResolved=False, reason
	// CollectionOverlap. A selector that does not parse refuses the whole rule
	// with ResourcesResolved=False, reason InvalidObjectSelector.
	// +optional
	ObjectSelector *metav1.LabelSelector `json:"objectSelector,omitempty"`

	// SourceNamespace is the source-cluster namespace this rule reads: omitted for
	// this WatchRule's own namespace, a name for another one, or "*" for every
	// namespace the KubeProvider's credential can read. Git placement follows each
	// object's own namespace, not this field.
	//
	// The KubeProvider's spec.allowedGitTargets must allow the namespace, through
	// the sourceNamespaces of a grant admitting the GitTarget; "*" needs "*"
	// there. One rule outside the grants refuses the whole WatchRule
	// (SourceNamespaceNotAllowed), checked when it reconciles.
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=`^(\*|[a-z0-9]([-a-z0-9]*[a-z0-9])?)$`
	SourceNamespace string `json:"sourceNamespace,omitempty"`
}

type ResourceScope string

type ScopeNamespace string

type SourceNamespace string

type StreamsStatus struct {

	// Summary is ready/total for display, such as "3/4". Read ready and total
	// instead of parsing it.
	// +optional
	Summary string `json:"summary,omitempty"`

	// Total is how many types are watched.
	Total int32 `json:"total"`

	// Ready is how many of them are streaming events.
	Ready int32 `json:"ready"`

	// Replaying is how many of them are still receiving their initial list.
	Replaying int32 `json:"replaying"`

	// Blocked is how many of them cannot be watched right now.
	Blocked int32 `json:"blocked"`

	// PendingSample names up to five types that are not ready yet.
	// +optional
	// +kubebuilder:validation:MaxItems=5
	PendingSample []string `json:"pendingSample,omitempty"`
}

type SuspendState string

type WatchRule struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of WatchRule.
	// +required
	Spec WatchRuleSpec `json:"spec"`

	// status defines the observed state of WatchRule.
	// +optional
	Status WatchRuleStatus `json:"status,omitempty"`
}

type WatchRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`

	Items []WatchRule `json:"items"`
}

type WatchRuleSpec struct {
	// GitTargetRef names the GitTarget, in this namespace, that mirrors what this
	// WatchRule selects.
	// +required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="spec.gitTargetRef.name must not be empty"
	GitTargetRef meta.LocalObjectReference `json:"gitTargetRef"`

	// Rules select the resources to mirror. A resource matching any rule is
	// mirrored. Each rule names resource types, optionally narrowed by API group,
	// version, source namespace and labels. The GitTarget's spec.prune.mode
	// decides whether a removal on the cluster deletes the Git document.
	// +required
	// +kubebuilder:validation:MinItems=1
	Rules []ResourceRule `json:"rules"`
}

type WatchRuleStatus struct {
	// ObservedGeneration is the latest generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions are the latest observations of this WatchRule's state. Ready,
	// Reconciling and Stalled follow kstatus; ResourcesResolved,
	// SourceNamespaceAuthorized and StreamsRunning say which check holds the rule
	// back.
	// +optional
	// +listType=map
	// +listMapKey=type
	// +patchMergeKey=type
	// +patchStrategy=merge
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`

	// Streams counts the types this WatchRule resolves, by watch state.
	// +optional
	Streams *StreamsStatus `json:"streams,omitempty"`
}