config

type AICRConfig struct {
	Kind       string   `yaml:"kind" json:"kind"`
	APIVersion string   `yaml:"apiVersion" json:"apiVersion"`
	Metadata   Metadata `yaml:"metadata" json:"metadata"`
	Spec       Spec     `yaml:"spec" json:"spec"`
}

type AttestationSpec struct {
	Enabled                   bool   `yaml:"enabled,omitempty" json:"enabled,omitempty"`
	CertificateIdentityRegexp string `yaml:"certificateIdentityRegexp,omitempty" json:"certificateIdentityRegexp,omitempty"`
	OIDCDeviceFlow            bool   `yaml:"oidcDeviceFlow,omitempty" json:"oidcDeviceFlow,omitempty"`
}

type BundleInputSpec struct {
	Recipe string `yaml:"recipe,omitempty" json:"recipe,omitempty"`
}

type BundleOutputSpec struct {
	// Target is a local directory path or an oci:// URI.
	Target    string `yaml:"target,omitempty" json:"target,omitempty"`
	ImageRefs string `yaml:"imageRefs,omitempty" json:"imageRefs,omitempty"`
}

type BundleResolved struct {
	// RecipeInput is spec.bundle.input.recipe.
	RecipeInput string

	// OutputTarget is the parsed spec.bundle.output.target. Nil when
	// config did not set a target. OutputTargetRaw preserves the original
	// string for log/error messages.
	OutputTarget    *oci.Reference
	OutputTargetRaw string

	// ImageRefs is spec.bundle.output.imageRefs.
	ImageRefs string

	// Deployer is the parsed spec.bundle.deployment.deployer. Empty
	// (zero) when config did not set a deployer.
	Deployer bundlercfg.DeployerType

	// Repo is spec.bundle.deployment.repo.
	Repo string

	// ValueOverrides is spec.bundle.deployment.set, parsed.
	// Nil if config did not set the field; non-nil (possibly empty) if
	// config provided an explicit list (including `set: []`).
	ValueOverrides []bundlercfg.ComponentPath

	// DynamicValues is spec.bundle.deployment.dynamic, parsed.
	// Same nil-vs-empty semantics as ValueOverrides.
	DynamicValues []bundlercfg.ComponentPath

	// SystemNodeSelector is spec.bundle.scheduling.systemNodeSelector.
	// Nil if config did not set it; non-nil empty if `{}` was explicit.
	SystemNodeSelector map[string]string

	// SystemNodeTolerations is spec.bundle.scheduling.systemNodeTolerations,
	// parsed. Nil if config did not set the field.
	SystemNodeTolerations []corev1.Toleration

	// AcceleratedNodeSelector is spec.bundle.scheduling.acceleratedNodeSelector.
	AcceleratedNodeSelector map[string]string

	// AcceleratedNodeTolerations is the parsed slice.
	AcceleratedNodeTolerations []corev1.Toleration

	// WorkloadGate is the parsed spec.bundle.scheduling.workloadGate taint.
	// Nil when config did not set it.
	WorkloadGate *corev1.Taint

	// WorkloadSelector is spec.bundle.scheduling.workloadSelector.
	WorkloadSelector map[string]string

	// Nodes is spec.bundle.scheduling.nodes; 0 when unset.
	Nodes int

	// StorageClass is spec.bundle.scheduling.storageClass.
	StorageClass string

	// Attest is spec.bundle.attestation.enabled.
	Attest bool

	// CertIDRegexp is spec.bundle.attestation.certificateIdentityRegexp.
	CertIDRegexp string

	// OIDCDeviceFlow is spec.bundle.attestation.oidcDeviceFlow.
	OIDCDeviceFlow bool

	// InsecureTLS is spec.bundle.registry.insecureTLS.
	InsecureTLS bool

	// PlainHTTP is spec.bundle.registry.plainHTTP.
	PlainHTTP bool

	// VendorCharts is spec.bundle.deployment.vendorCharts. When true,
	// upstream Helm chart bytes are pulled into the bundle at bundle time
	// so the resulting artifact is air-gap deployable. Off by default.
	VendorCharts bool
}

type BundleSpec struct {
	Input       *BundleInputSpec  `yaml:"input,omitempty" json:"input,omitempty"`
	Output      *BundleOutputSpec `yaml:"output,omitempty" json:"output,omitempty"`
	Deployment  *DeploymentSpec   `yaml:"deployment,omitempty" json:"deployment,omitempty"`
	Scheduling  *SchedulingSpec   `yaml:"scheduling,omitempty" json:"scheduling,omitempty"`
	Attestation *AttestationSpec  `yaml:"attestation,omitempty" json:"attestation,omitempty"`
	Registry    *RegistrySpec     `yaml:"registry,omitempty" json:"registry,omitempty"`
}

type CriteriaSpec struct {
	Service     string `yaml:"service,omitempty" json:"service,omitempty"`
	Accelerator string `yaml:"accelerator,omitempty" json:"accelerator,omitempty"`
	Intent      string `yaml:"intent,omitempty" json:"intent,omitempty"`
	OS          string `yaml:"os,omitempty" json:"os,omitempty"`
	Platform    string `yaml:"platform,omitempty" json:"platform,omitempty"`
	Nodes       int    `yaml:"nodes,omitempty" json:"nodes,omitempty"`
}

type DeploymentSpec struct {
	Deployer     string   `yaml:"deployer,omitempty" json:"deployer,omitempty"`
	Repo         string   `yaml:"repo,omitempty" json:"repo,omitempty"`
	Set          []string `yaml:"set,omitempty" json:"set,omitempty"`
	Dynamic      []string `yaml:"dynamic,omitempty" json:"dynamic,omitempty"`
	VendorCharts bool     `yaml:"vendorCharts,omitempty" json:"vendorCharts,omitempty"`
}

type EvidenceAttestationResolved struct {
	Out         string
	BOM         string
	Push        string
	PlainHTTP   bool
	InsecureTLS bool
}

type EvidenceAttestationSpec struct {
	// Setting Out enables the attestation path; empty leaves it off
	// even if other fields are populated.
	Out string `yaml:"out,omitempty" json:"out,omitempty"`

	BOM  string `yaml:"bom,omitempty" json:"bom,omitempty"`
	Push string `yaml:"push,omitempty" json:"push,omitempty"`

	// Pointer fields so the spec layer can distinguish nil (absent in
	// YAML/JSON) from &false (explicit opt-out). The resolved layer
	// flattens to plain bool — see EvidenceAttestationResolved.
	PlainHTTP   *bool `yaml:"plainHTTP,omitempty" json:"plainHTTP,omitempty"`
	InsecureTLS *bool `yaml:"insecureTLS,omitempty" json:"insecureTLS,omitempty"`
}

type EvidenceCNCFResolved struct {
	Dir            string
	CNCFSubmission bool
	Features       []string
}

type EvidenceCNCFSpec struct {
	Dir string `yaml:"dir,omitempty" json:"dir,omitempty"`

	// Requires Dir. Pointer so the spec layer can distinguish nil
	// (absent in YAML/JSON) from &false (explicit opt-out); the
	// resolved layer flattens to plain bool — see EvidenceCNCFResolved.
	CNCFSubmission *bool `yaml:"cncfSubmission,omitempty" json:"cncfSubmission,omitempty"`

	// Empty = all features. Only honored when CNCFSubmission is true.
	Features []string `yaml:"features,omitempty" json:"features,omitempty"`
}

type EvidenceSpec struct {
	CNCF        *EvidenceCNCFSpec        `yaml:"cncf,omitempty" json:"cncf,omitempty"`
	Attestation *EvidenceAttestationSpec `yaml:"attestation,omitempty" json:"attestation,omitempty"`
}

type Metadata struct {
	Name string `yaml:"name,omitempty" json:"name,omitempty"`
}

type RecipeInputSpec struct {
	Snapshot string `yaml:"snapshot,omitempty" json:"snapshot,omitempty"`
}

type RecipeOutputSpec struct {
	Path   string `yaml:"path,omitempty" json:"path,omitempty"`
	Format string `yaml:"format,omitempty" json:"format,omitempty"`
}

type RecipeSpec struct {
	Criteria *CriteriaSpec     `yaml:"criteria,omitempty" json:"criteria,omitempty"`
	Input    *RecipeInputSpec  `yaml:"input,omitempty" json:"input,omitempty"`
	Output   *RecipeOutputSpec `yaml:"output,omitempty" json:"output,omitempty"`
	Data     string            `yaml:"data,omitempty" json:"data,omitempty"`
}

type RegistrySpec struct {
	InsecureTLS bool `yaml:"insecureTLS,omitempty" json:"insecureTLS,omitempty"`
	PlainHTTP   bool `yaml:"plainHTTP,omitempty" json:"plainHTTP,omitempty"`
}

type SchedulingSpec struct {
	SystemNodeSelector         map[string]string `yaml:"systemNodeSelector,omitempty" json:"systemNodeSelector,omitempty"`
	SystemNodeTolerations      []string          `yaml:"systemNodeTolerations,omitempty" json:"systemNodeTolerations,omitempty"`
	AcceleratedNodeSelector    map[string]string `yaml:"acceleratedNodeSelector,omitempty" json:"acceleratedNodeSelector,omitempty"`
	AcceleratedNodeTolerations []string          `yaml:"acceleratedNodeTolerations,omitempty" json:"acceleratedNodeTolerations,omitempty"`
	WorkloadGate               string            `yaml:"workloadGate,omitempty" json:"workloadGate,omitempty"`
	WorkloadSelector           map[string]string `yaml:"workloadSelector,omitempty" json:"workloadSelector,omitempty"`
	Nodes                      int               `yaml:"nodes,omitempty" json:"nodes,omitempty"`
	StorageClass               string            `yaml:"storageClass,omitempty" json:"storageClass,omitempty"`
}

type Spec struct {
	Recipe   *RecipeSpec   `yaml:"recipe,omitempty" json:"recipe,omitempty"`
	Bundle   *BundleSpec   `yaml:"bundle,omitempty" json:"bundle,omitempty"`
	Validate *ValidateSpec `yaml:"validate,omitempty" json:"validate,omitempty"`
}

type ValidateAgentSpec struct {
	Namespace          string            `yaml:"namespace,omitempty" json:"namespace,omitempty"`
	Image              string            `yaml:"image,omitempty" json:"image,omitempty"`
	ImagePullSecrets   []string          `yaml:"imagePullSecrets,omitempty" json:"imagePullSecrets,omitempty"`
	JobName            string            `yaml:"jobName,omitempty" json:"jobName,omitempty"`
	ServiceAccountName string            `yaml:"serviceAccountName,omitempty" json:"serviceAccountName,omitempty"`
	NodeSelector       map[string]string `yaml:"nodeSelector,omitempty" json:"nodeSelector,omitempty"`
	Tolerations        []string          `yaml:"tolerations,omitempty" json:"tolerations,omitempty"`
	RequireGPU         bool              `yaml:"requireGpu,omitempty" json:"requireGpu,omitempty"`
}

type ValidateExecutionSpec struct {
	Phases      []string `yaml:"phases,omitempty" json:"phases,omitempty"`
	FailOnError *bool    `yaml:"failOnError,omitempty" json:"failOnError,omitempty"`
	NoCluster   bool     `yaml:"noCluster,omitempty" json:"noCluster,omitempty"`
	NoCleanup   bool     `yaml:"noCleanup,omitempty" json:"noCleanup,omitempty"`
	Timeout     string   `yaml:"timeout,omitempty" json:"timeout,omitempty"`
}

type ValidateInputSpec struct {
	Recipe   string `yaml:"recipe,omitempty" json:"recipe,omitempty"`
	Snapshot string `yaml:"snapshot,omitempty" json:"snapshot,omitempty"`
}

type ValidateResolved struct {
	// RecipePath is spec.validate.input.recipe.
	RecipePath string

	// SnapshotPath is spec.validate.input.snapshot.
	SnapshotPath string

	// Namespace is spec.validate.agent.namespace.
	Namespace string

	// Image is spec.validate.agent.image.
	Image string

	// ImagePullSecrets is spec.validate.agent.imagePullSecrets. Nil if
	// config did not set the field.
	ImagePullSecrets []string

	// JobName is spec.validate.agent.jobName.
	JobName string

	// ServiceAccountName is spec.validate.agent.serviceAccountName.
	ServiceAccountName string

	// NodeSelector is spec.validate.agent.nodeSelector. Nil if unset;
	// non-nil empty if `{}` was explicit.
	NodeSelector map[string]string

	// Tolerations is the parsed spec.validate.agent.tolerations slice.
	// Nil if config did not set the field.
	Tolerations []corev1.Toleration

	// RequireGPU is spec.validate.agent.requireGpu.
	RequireGPU bool

	// Phases is spec.validate.execution.phases. Nil if unset.
	Phases []string

	// FailOnError is spec.validate.execution.failOnError. Nil pointer
	// signals "config did not set the field" so the caller can defer to
	// the CLI flag's default.
	FailOnError *bool

	// NoCluster is spec.validate.execution.noCluster.
	NoCluster bool

	// NoCleanup is spec.validate.execution.noCleanup.
	NoCleanup bool

	// Timeout is the parsed spec.validate.execution.timeout. Nil pointer
	// signals "config did not set the field" so callers can fall through
	// to the CLI flag's default duration; non-nil preserves an explicit
	// "0s" / disabled-timeout value distinct from absence.
	Timeout *time.Duration

	// Nil when spec.validate.evidence.cncf is unset.
	EvidenceCNCF *EvidenceCNCFResolved

	// Nil when spec.validate.evidence.attestation is unset.
	EvidenceAttestation *EvidenceAttestationResolved
}

type ValidateSpec struct {
	Input     *ValidateInputSpec     `yaml:"input,omitempty" json:"input,omitempty"`
	Agent     *ValidateAgentSpec     `yaml:"agent,omitempty" json:"agent,omitempty"`
	Execution *ValidateExecutionSpec `yaml:"execution,omitempty" json:"execution,omitempty"`
	Evidence  *EvidenceSpec          `yaml:"evidence,omitempty" json:"evidence,omitempty"`
}