v1alpha2

type AccessAppLauncherCustomization struct {
	// LandingPageDesign configures the landing page appearance.
	// +kubebuilder:validation:Optional
	LandingPageDesign *AccessLandingPageDesign `json:"landingPageDesign,omitempty"`

	// AppLauncherLogoURL is the URL of the app launcher logo.
	// +kubebuilder:validation:Optional
	AppLauncherLogoURL string `json:"appLauncherLogoUrl,omitempty"`

	// HeaderBackgroundColor is the header background color (hex format).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^#[0-9a-fA-F]{6}$`
	HeaderBackgroundColor string `json:"headerBackgroundColor,omitempty"`

	// BackgroundColor is the background color (hex format).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^#[0-9a-fA-F]{6}$`
	BackgroundColor string `json:"backgroundColor,omitempty"`

	// FooterLinks is a list of footer links.
	// +kubebuilder:validation:Optional
	FooterLinks []AccessFooterLink `json:"footerLinks,omitempty"`

	// SkipAppLauncherLoginPage skips the app launcher login page.
	// +kubebuilder:validation:Optional
	SkipAppLauncherLoginPage *bool `json:"skipAppLauncherLoginPage,omitempty"`
}

type AccessApplication struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessApplicationSpec   `json:"spec,omitempty"`
	Status AccessApplicationStatus `json:"status,omitempty"`
}

type AccessApplicationCorsHeaders struct {
	// AllowedMethods is a list of allowed HTTP methods.
	// +kubebuilder:validation:Optional
	AllowedMethods []string `json:"allowedMethods,omitempty"`

	// AllowedOrigins is a list of allowed origins.
	// +kubebuilder:validation:Optional
	AllowedOrigins []string `json:"allowedOrigins,omitempty"`

	// AllowedHeaders is a list of allowed headers.
	// +kubebuilder:validation:Optional
	AllowedHeaders []string `json:"allowedHeaders,omitempty"`

	// AllowAllMethods allows all HTTP methods.
	// +kubebuilder:validation:Optional
	AllowAllMethods bool `json:"allowAllMethods,omitempty"`

	// AllowAllHeaders allows all headers.
	// +kubebuilder:validation:Optional
	AllowAllHeaders bool `json:"allowAllHeaders,omitempty"`

	// AllowAllOrigins allows all origins.
	// +kubebuilder:validation:Optional
	AllowAllOrigins bool `json:"allowAllOrigins,omitempty"`

	// AllowCredentials allows credentials.
	// +kubebuilder:validation:Optional
	AllowCredentials bool `json:"allowCredentials,omitempty"`

	// MaxAge is the maximum age for CORS preflight cache in seconds.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=86400
	MaxAge int `json:"maxAge,omitempty"`
}

type AccessApplicationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessApplication `json:"items"`
}

type AccessApplicationSCIMConfig struct {
	// Enabled enables SCIM provisioning.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty"`

	// RemoteURI is the remote SCIM endpoint URI.
	// +kubebuilder:validation:Optional
	RemoteURI string `json:"remoteUri,omitempty"`

	// Authentication configures SCIM authentication.
	// +kubebuilder:validation:Optional
	Authentication *SCIMAuthentication `json:"authentication,omitempty"`

	// IDPUID is the identity provider UID for SCIM.
	// +kubebuilder:validation:Optional
	IDPUID string `json:"idpUid,omitempty"`

	// DeactivateOnDelete deactivates users on delete instead of deleting.
	// +kubebuilder:validation:Optional
	DeactivateOnDelete *bool `json:"deactivateOnDelete,omitempty"`

	// Mappings defines SCIM attribute mappings.
	// +kubebuilder:validation:Optional
	Mappings []SCIMMapping `json:"mappings,omitempty"`
}

type AccessApplicationSpec struct {
	// Name of the Access Application in Cloudflare.
	// If not specified, the Kubernetes resource name will be used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Domain is the primary domain/URL for the application.
	// +kubebuilder:validation:Required
	Domain string `json:"domain"`

	// SelfHostedDomains is a list of additional domains for the application.
	// This allows protecting multiple domains with a single Access Application.
	// Each domain should be a fully qualified domain name (e.g., "app.example.com" or "app.example.com/path").
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxItems=50
	SelfHostedDomains []string `json:"selfHostedDomains,omitempty"`

	// Destinations specifies the destination configurations for the application.
	// This is more flexible than SelfHostedDomains and supports both public and private destinations.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxItems=50
	Destinations []AccessDestination `json:"destinations,omitempty"`

	// DomainType specifies the type of domain (public or private).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=public;private
	DomainType string `json:"domainType,omitempty"`

	// PrivateAddress is the private address for private applications.
	// +kubebuilder:validation:Optional
	PrivateAddress string `json:"privateAddress,omitempty"`

	// Type is the application type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=self_hosted;saas;ssh;vnc;app_launcher;warp;biso;bookmark;dash_sso;infrastructure
	// +kubebuilder:default=self_hosted
	Type string `json:"type"`

	// SessionDuration is the amount of time that the token is valid for.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="24h"
	SessionDuration string `json:"sessionDuration,omitempty"`

	// AllowedIdps is the list of identity provider IDs allowed for this application.
	// +kubebuilder:validation:Optional
	AllowedIdps []string `json:"allowedIdps,omitempty"`

	// AllowedIdpRefs references AccessIdentityProvider resources by name.
	// +kubebuilder:validation:Optional
	AllowedIdpRefs []AccessIdentityProviderRef `json:"allowedIdpRefs,omitempty"`

	// AutoRedirectToIdentity enables automatic redirect to the identity provider.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	AutoRedirectToIdentity bool `json:"autoRedirectToIdentity,omitempty"`

	// EnableBindingCookie enables the binding cookie.
	// +kubebuilder:validation:Optional
	EnableBindingCookie *bool `json:"enableBindingCookie,omitempty"`

	// HttpOnlyCookieAttribute sets the HttpOnly attribute on the cookie.
	// +kubebuilder:validation:Optional
	HttpOnlyCookieAttribute *bool `json:"httpOnlyCookieAttribute,omitempty"`

	// PathCookieAttribute sets the Path attribute on the cookie.
	// +kubebuilder:validation:Optional
	PathCookieAttribute *bool `json:"pathCookieAttribute,omitempty"`

	// SameSiteCookieAttribute sets the SameSite attribute on the cookie.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=strict;lax;none
	SameSiteCookieAttribute string `json:"sameSiteCookieAttribute,omitempty"`

	// LogoURL is the URL of the application logo.
	// +kubebuilder:validation:Optional
	LogoURL string `json:"logoUrl,omitempty"`

	// SkipInterstitial skips the interstitial page.
	// +kubebuilder:validation:Optional
	SkipInterstitial *bool `json:"skipInterstitial,omitempty"`

	// OptionsPreflightBypass allows CORS preflight requests to bypass Access authentication.
	// +kubebuilder:validation:Optional
	OptionsPreflightBypass *bool `json:"optionsPreflightBypass,omitempty"`

	// AppLauncherVisible shows the application in the App Launcher.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AppLauncherVisible *bool `json:"appLauncherVisible,omitempty"`

	// ServiceAuth401Redirect redirects unauthorized service auth requests.
	// +kubebuilder:validation:Optional
	ServiceAuth401Redirect *bool `json:"serviceAuth401Redirect,omitempty"`

	// CustomDenyMessage is a custom message shown when access is denied.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1024
	CustomDenyMessage string `json:"customDenyMessage,omitempty"`

	// CustomDenyURL is a custom URL to redirect to when access is denied.
	// +kubebuilder:validation:Optional
	CustomDenyURL string `json:"customDenyUrl,omitempty"`

	// CustomNonIdentityDenyURL is a custom URL for non-identity deny.
	// +kubebuilder:validation:Optional
	CustomNonIdentityDenyURL string `json:"customNonIdentityDenyUrl,omitempty"`

	// AllowAuthenticateViaWarp allows authentication via WARP.
	// +kubebuilder:validation:Optional
	AllowAuthenticateViaWarp *bool `json:"allowAuthenticateViaWarp,omitempty"`

	// Tags are custom tags for the application.
	// +kubebuilder:validation:Optional
	Tags []string `json:"tags,omitempty"`

	// CustomPages is a list of custom page IDs to use for the application.
	// +kubebuilder:validation:Optional
	CustomPages []string `json:"customPages,omitempty"`

	// GatewayRules is a list of Gateway rule IDs associated with the application.
	// +kubebuilder:validation:Optional
	GatewayRules []string `json:"gatewayRules,omitempty"`

	// CorsHeaders configures Cross-Origin Resource Sharing (CORS) for the application.
	// +kubebuilder:validation:Optional
	CorsHeaders *AccessApplicationCorsHeaders `json:"corsHeaders,omitempty"`

	// SaasApp configures the SaaS application settings (for type=saas).
	// +kubebuilder:validation:Optional
	SaasApp *SaasApplicationConfig `json:"saasApp,omitempty"`

	// SCIMConfig configures SCIM provisioning for the application.
	// +kubebuilder:validation:Optional
	SCIMConfig *AccessApplicationSCIMConfig `json:"scimConfig,omitempty"`

	// AppLauncherCustomization configures the appearance of the app launcher.
	// +kubebuilder:validation:Optional
	AppLauncherCustomization *AccessAppLauncherCustomization `json:"appLauncherCustomization,omitempty"`

	// TargetContexts specifies the target criteria for infrastructure applications.
	// +kubebuilder:validation:Optional
	TargetContexts []AccessInfrastructureTargetContext `json:"targetContexts,omitempty"`

	// Policies defines the access policies for this application.
	// +kubebuilder:validation:Optional
	Policies []AccessPolicyRef `json:"policies,omitempty"`

	// Cloudflare contains the Cloudflare API credentials and account information.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessApplicationStatus struct {
	// ApplicationID is the Cloudflare ID of the Access Application.
	// +kubebuilder:validation:Optional
	ApplicationID string `json:"applicationId,omitempty"`

	// AUD is the Application Audience (AUD) Tag.
	// +kubebuilder:validation:Optional
	AUD string `json:"aud,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// Domain is the primary configured domain.
	// +kubebuilder:validation:Optional
	Domain string `json:"domain,omitempty"`

	// SelfHostedDomains is the list of all configured domains (from Cloudflare API response).
	// +kubebuilder:validation:Optional
	SelfHostedDomains []string `json:"selfHostedDomains,omitempty"`

	// State indicates the current state of the application.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// SaasAppClientID is the OIDC client ID (for SaaS applications with OIDC).
	// +kubebuilder:validation:Optional
	SaasAppClientID string `json:"saasAppClientId,omitempty"`

	// ResolvedPolicies contains the resolved policy information for each policy.
	// This helps with debugging and understanding policy state.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=precedence
	ResolvedPolicies []ResolvedPolicyStatus `json:"resolvedPolicies,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessDestination struct {
	// Type specifies the destination type (public or private).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=public;private
	Type string `json:"type"`

	// URI is the destination URI for public destinations.
	// Required for public destinations.
	// +kubebuilder:validation:Optional
	URI string `json:"uri,omitempty"`

	// Hostname is the destination hostname for private destinations.
	// +kubebuilder:validation:Optional
	Hostname string `json:"hostname,omitempty"`

	// CIDR is the destination CIDR for private destinations.
	// +kubebuilder:validation:Optional
	CIDR string `json:"cidr,omitempty"`

	// PortRange specifies the port range for private destinations (e.g., "80", "80-443").
	// +kubebuilder:validation:Optional
	PortRange string `json:"portRange,omitempty"`

	// L4Protocol specifies the Layer 4 protocol for private destinations.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=tcp;udp
	L4Protocol string `json:"l4Protocol,omitempty"`

	// VnetID is the Virtual Network ID for private destinations.
	// +kubebuilder:validation:Optional
	VnetID string `json:"vnetId,omitempty"`
}

type AccessFooterLink struct {
	// Name is the display name of the link.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name"`

	// URL is the link URL.
	// +kubebuilder:validation:Required
	URL string `json:"url"`
}

type AccessGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessGroupSpec   `json:"spec,omitempty"`
	Status AccessGroupStatus `json:"status,omitempty"`
}

type AccessGroupAuthContextRule struct {
	// ID is the Azure Authentication Context ID.
	ID string `json:"id"`
	// AcID is the Azure AD Conditional Access Policy ID.
	AcID string `json:"acId"`
	// IdentityProviderID is the Cloudflare ID of the Azure identity provider.
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupAuthMethodRule struct {
	// AuthMethod is the authentication method type (e.g., "mfa").
	AuthMethod string `json:"authMethod"`
}

type AccessGroupAzureRule struct {
	ID                 string `json:"id"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupCommonNameRule struct {
	CommonName string `json:"commonName"`
}

type AccessGroupCountryRule struct {
	Country []string `json:"country"`
}

type AccessGroupDevicePostureRule struct {
	IntegrationUID string `json:"integrationUid"`
}

type AccessGroupEmailDomainRule struct {
	Domain string `json:"domain"`
}

type AccessGroupEmailListRule struct {
	// ID is the Cloudflare ID of the email list.
	ID string `json:"id"`
}

type AccessGroupEmailRule struct {
	Email string `json:"email"`
}

type AccessGroupExternalEvaluationRule struct {
	EvaluateURL string `json:"evaluateUrl"`
	KeysURL     string `json:"keysUrl"`
}

type AccessGroupGSuiteRule struct {
	Email              string `json:"email"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupGitHubRule struct {
	Name               string   `json:"name"`
	IdentityProviderID string   `json:"identityProviderId"`
	Teams              []string `json:"teams,omitempty"`
}

type AccessGroupGroupRule struct {
	ID string `json:"id"`
}

type AccessGroupIPListRule struct {
	// ID is the Cloudflare ID of the IP list.
	ID string `json:"id"`
}

type AccessGroupIPRangesRule struct {
	IP []string `json:"ip"`
}

type AccessGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessGroup `json:"items"`
}

type AccessGroupLoginMethodRule struct {
	// ID is the Cloudflare ID of the identity provider.
	ID string `json:"id"`
}

type AccessGroupOIDCRule struct {
	ClaimName          string `json:"claimName"`
	ClaimValue         string `json:"claimValue"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupOktaRule struct {
	// Name is the Okta group name.
	Name string `json:"name"`
	// IdentityProviderID is the Cloudflare ID of the Okta identity provider.
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupRule struct {
	// Email matches a specific email address.
	// +kubebuilder:validation:Optional
	Email *AccessGroupEmailRule `json:"email,omitempty"`

	// EmailDomain matches all emails from a domain.
	// +kubebuilder:validation:Optional
	EmailDomain *AccessGroupEmailDomainRule `json:"emailDomain,omitempty"`

	// EmailList matches emails from a predefined list.
	// +kubebuilder:validation:Optional
	EmailList *AccessGroupEmailListRule `json:"emailList,omitempty"`

	// Everyone matches all users.
	// +kubebuilder:validation:Optional
	Everyone bool `json:"everyone,omitempty"`

	// IPRanges matches users from specific IP ranges.
	// +kubebuilder:validation:Optional
	IPRanges *AccessGroupIPRangesRule `json:"ipRanges,omitempty"`

	// IPList matches users from a predefined IP list.
	// +kubebuilder:validation:Optional
	IPList *AccessGroupIPListRule `json:"ipList,omitempty"`

	// Country matches users from specific countries.
	// +kubebuilder:validation:Optional
	Country *AccessGroupCountryRule `json:"country,omitempty"`

	// Group matches users in a specific IdP group.
	// +kubebuilder:validation:Optional
	Group *AccessGroupGroupRule `json:"group,omitempty"`

	// ServiceToken matches requests with a specific service token.
	// +kubebuilder:validation:Optional
	ServiceToken *AccessGroupServiceTokenRule `json:"serviceToken,omitempty"`

	// AnyValidServiceToken matches any valid service token.
	// +kubebuilder:validation:Optional
	AnyValidServiceToken bool `json:"anyValidServiceToken,omitempty"`

	// Certificate matches requests with a valid mTLS certificate.
	// +kubebuilder:validation:Optional
	Certificate bool `json:"certificate,omitempty"`

	// CommonName matches mTLS certificates with a specific common name.
	// +kubebuilder:validation:Optional
	CommonName *AccessGroupCommonNameRule `json:"commonName,omitempty"`

	// DevicePosture matches devices that pass posture checks.
	// +kubebuilder:validation:Optional
	DevicePosture *AccessGroupDevicePostureRule `json:"devicePosture,omitempty"`

	// GSUITE matches users from Google Workspace.
	// +kubebuilder:validation:Optional
	GSuite *AccessGroupGSuiteRule `json:"gsuite,omitempty"`

	// GitHub matches users from GitHub organizations.
	// +kubebuilder:validation:Optional
	GitHub *AccessGroupGitHubRule `json:"github,omitempty"`

	// Azure matches users from Azure AD groups.
	// +kubebuilder:validation:Optional
	Azure *AccessGroupAzureRule `json:"azure,omitempty"`

	// Okta matches users from Okta groups.
	// +kubebuilder:validation:Optional
	Okta *AccessGroupOktaRule `json:"okta,omitempty"`

	// OIDC matches users based on OIDC claims.
	// +kubebuilder:validation:Optional
	OIDC *AccessGroupOIDCRule `json:"oidc,omitempty"`

	// SAML matches users based on SAML attributes.
	// +kubebuilder:validation:Optional
	SAML *AccessGroupSAMLRule `json:"saml,omitempty"`

	// AuthMethod enforces different MFA options.
	// +kubebuilder:validation:Optional
	AuthMethod *AccessGroupAuthMethodRule `json:"authMethod,omitempty"`

	// AuthContext matches Azure Authentication Context.
	// +kubebuilder:validation:Optional
	AuthContext *AccessGroupAuthContextRule `json:"authContext,omitempty"`

	// LoginMethod matches a specific identity provider.
	// +kubebuilder:validation:Optional
	LoginMethod *AccessGroupLoginMethodRule `json:"loginMethod,omitempty"`

	// ExternalEvaluation calls an external endpoint for evaluation.
	// +kubebuilder:validation:Optional
	ExternalEvaluation *AccessGroupExternalEvaluationRule `json:"externalEvaluation,omitempty"`
}

type AccessGroupSAMLRule struct {
	AttributeName      string `json:"attributeName"`
	AttributeValue     string `json:"attributeValue"`
	IdentityProviderID string `json:"identityProviderId"`
}

type AccessGroupServiceTokenRule struct {
	TokenID string `json:"tokenId"`
}

type AccessGroupSpec struct {
	// Name of the Access Group in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Include defines rules that users must match to be included (OR logic).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	Include []AccessGroupRule `json:"include"`

	// Exclude defines rules that exclude users even if they match include rules (NOT logic).
	// +kubebuilder:validation:Optional
	Exclude []AccessGroupRule `json:"exclude,omitempty"`

	// Require defines rules that all users must match in addition to include rules (AND logic).
	// +kubebuilder:validation:Optional
	Require []AccessGroupRule `json:"require,omitempty"`

	// IsDefault indicates whether this is the default group.
	// +kubebuilder:validation:Optional
	IsDefault *bool `json:"isDefault,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessGroupStatus struct {
	// GroupID is the Cloudflare ID of the Access Group.
	// +kubebuilder:validation:Optional
	GroupID string `json:"groupId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessIdentityProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessIdentityProviderSpec   `json:"spec,omitempty"`
	Status AccessIdentityProviderStatus `json:"status,omitempty"`
}

type AccessIdentityProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessIdentityProvider `json:"items"`
}

type AccessIdentityProviderRef struct {
	// Name is the name of the AccessIdentityProvider resource.
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type AccessIdentityProviderSpec struct {
	// Name of the Identity Provider in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Type is the identity provider type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=onetimepin;azureAD;saml;centrify;facebook;github;google-apps;google;linkedin;oidc;okta;onelogin;pingone;yandex
	Type string `json:"type"`

	// Config contains provider-specific configuration.
	// +kubebuilder:validation:Optional
	Config *IdentityProviderConfig `json:"config,omitempty"`

	// ConfigSecretRef references a Secret containing sensitive config values.
	// +kubebuilder:validation:Optional
	ConfigSecretRef *SecretKeySelector `json:"configSecretRef,omitempty"`

	// ScimConfig contains SCIM provisioning configuration.
	// +kubebuilder:validation:Optional
	ScimConfig *IdentityProviderScimConfig `json:"scimConfig,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessIdentityProviderStatus struct {
	// ProviderID is the Cloudflare ID.
	// +kubebuilder:validation:Optional
	ProviderID string `json:"providerId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type AccessInfrastructureTargetContext struct {
	// TargetAttributes is a map of target attribute names to their allowed values.
	// +kubebuilder:validation:Required
	TargetAttributes map[string][]string `json:"targetAttributes"`

	// Port is the target port.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int `json:"port"`

	// Protocol is the target protocol (SSH, RDP, etc.).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=SSH;RDP
	Protocol string `json:"protocol"`
}

type AccessLandingPageDesign struct {
	// Title is the landing page title.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Title string `json:"title,omitempty"`

	// Message is the landing page message.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1024
	Message string `json:"message,omitempty"`

	// ImageURL is the URL of the landing page image.
	// +kubebuilder:validation:Optional
	ImageURL string `json:"imageUrl,omitempty"`

	// ButtonColor is the button color (hex format).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^#[0-9a-fA-F]{6}$`
	ButtonColor string `json:"buttonColor,omitempty"`

	// ButtonTextColor is the button text color (hex format).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^#[0-9a-fA-F]{6}$`
	ButtonTextColor string `json:"buttonTextColor,omitempty"`
}

type AccessPolicyRef struct {
	// Name is the name of an AccessGroup resource (Kubernetes) to use as a policy.
	// If specified, the controller will look up the AccessGroup CR and use its GroupID.
	// Mutually exclusive with groupId and cloudflareGroupName.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=253
	Name string `json:"name,omitempty"`

	// GroupID is the UUID of an existing Cloudflare Access Group.
	// Use this to directly reference a Cloudflare-managed Access Group
	// without creating a corresponding Kubernetes AccessGroup resource.
	// Mutually exclusive with name and cloudflareGroupName.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Pattern=`^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$`
	GroupID string `json:"groupId,omitempty"`

	// CloudflareGroupName is the display name of an existing Cloudflare Access Group.
	// The controller will resolve this name to a GroupID via the Cloudflare API.
	// Use this when you want to reference a Cloudflare Access Group by name
	// (e.g., groups created via Terraform or the Cloudflare dashboard).
	// Mutually exclusive with name and groupId.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	CloudflareGroupName string `json:"cloudflareGroupName,omitempty"`

	// Decision is the policy decision (allow, deny, bypass, non_identity).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=allow;deny;bypass;non_identity
	// +kubebuilder:default=allow
	Decision string `json:"decision,omitempty"`

	// Precedence is the order of evaluation. Lower numbers are evaluated first.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	Precedence int `json:"precedence,omitempty"`

	// PolicyName is the name for this policy in Cloudflare.
	// If not specified, a name will be auto-generated based on the AccessApplication name and precedence.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	PolicyName string `json:"policyName,omitempty"`

	// SessionDuration overrides the application's session duration for this policy.
	// +kubebuilder:validation:Optional
	SessionDuration string `json:"sessionDuration,omitempty"`
}

type AccessServiceToken struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AccessServiceTokenSpec   `json:"spec,omitempty"`
	Status AccessServiceTokenStatus `json:"status,omitempty"`
}

type AccessServiceTokenList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AccessServiceToken `json:"items"`
}

type AccessServiceTokenSpec struct {
	// Name of the Service Token in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Duration is the validity duration (e.g., "8760h" for 1 year, "forever").
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="8760h"
	Duration string `json:"duration,omitempty"`

	// SecretRef is where to store the generated token credentials.
	// +kubebuilder:validation:Required
	SecretRef ServiceTokenSecretRef `json:"secretRef"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type AccessServiceTokenStatus struct {
	// TokenID is the Cloudflare Service Token ID.
	// +kubebuilder:validation:Optional
	TokenID string `json:"tokenId,omitempty"`

	// ClientID is the Service Token Client ID.
	// +kubebuilder:validation:Optional
	ClientID string `json:"clientId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// ExpiresAt is when the token expires.
	// +kubebuilder:validation:Optional
	ExpiresAt string `json:"expiresAt,omitempty"`

	// CreatedAt is when the token was created.
	// +kubebuilder:validation:Optional
	CreatedAt string `json:"createdAt,omitempty"`

	// UpdatedAt is when the token was last updated.
	// +kubebuilder:validation:Optional
	UpdatedAt string `json:"updatedAt,omitempty"`

	// LastSeenAt is when the token was last used.
	// +kubebuilder:validation:Optional
	LastSeenAt string `json:"lastSeenAt,omitempty"`

	// ClientSecretVersion is the current version of the client secret.
	// +kubebuilder:validation:Optional
	ClientSecretVersion int64 `json:"clientSecretVersion,omitempty"`

	// SecretName is the name of the Secret containing credentials.
	// +kubebuilder:validation:Optional
	SecretName string `json:"secretName,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type ActivityLogSettings struct {
	Enabled bool `json:"enabled"`
}

type AntiVirusSettings struct {
	Enabled              bool                  `json:"enabled"`
	EnabledDownloadPhase bool                  `json:"enabledDownloadPhase,omitempty"`
	EnabledUploadPhase   bool                  `json:"enabledUploadPhase,omitempty"`
	FailClosed           bool                  `json:"failClosed,omitempty"`
	NotificationSettings *NotificationSettings `json:"notificationSettings,omitempty"`
}

type AuditSSHSettings struct {
	CommandLogging bool `json:"commandLogging"`
}

type AuthenticatedOriginPullConfig struct {
	// Enabled enables authenticated origin pulls (mTLS)
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// CertificateSecretRef references a Secret containing custom client certificate
	// If not specified, Cloudflare's default certificate will be used
	// +kubebuilder:validation:Optional
	CertificateSecretRef *SecretReference `json:"certificateSecretRef,omitempty"`
}

type AutoPopulateConfig struct {
	// Enabled enables automatic population from NetworkRoute resources.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`

	// LabelSelector selects which NetworkRoute resources to include.
	// If empty, all NetworkRoute resources are included.
	// +kubebuilder:validation:Optional
	LabelSelector *metav1.LabelSelector `json:"labelSelector,omitempty"`

	// DescriptionPrefix is prepended to auto-generated descriptions.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default="Auto-populated from NetworkRoute: "
	DescriptionPrefix string `json:"descriptionPrefix,omitempty"`
}

type BISOAdminControls struct {
	DisablePrinting             *bool `json:"disablePrinting,omitempty"`
	DisableCopyPaste            *bool `json:"disableCopyPaste,omitempty"`
	DisableDownload             *bool `json:"disableDownload,omitempty"`
	DisableUpload               *bool `json:"disableUpload,omitempty"`
	DisableKeyboard             *bool `json:"disableKeyboard,omitempty"`
	DisableClipboardRedirection *bool `json:"disableClipboardRedirection,omitempty"`
}

type BlockPageSettings struct {
	Enabled         bool   `json:"enabled"`
	Name            string `json:"name,omitempty"`
	FooterText      string `json:"footerText,omitempty"`
	HeaderText      string `json:"headerText,omitempty"`
	LogoPath        string `json:"logoPath,omitempty"`
	BackgroundColor string `json:"backgroundColor,omitempty"`
	MailtoAddress   string `json:"mailtoAddress,omitempty"`
	MailtoSubject   string `json:"mailtoSubject,omitempty"`
	SuppressFooter  bool   `json:"suppressFooter,omitempty"`
}

type BodyScanningSettings struct {
	InspectionMode string `json:"inspectionMode,omitempty"` // deep, shallow
}

type BrowserIsolationSettings struct {
	URLBrowserIsolationEnabled bool `json:"urlBrowserIsolationEnabled,omitempty"`
	NonIdentityEnabled         bool `json:"nonIdentityEnabled,omitempty"`
}

type CacheConfig struct {
	// BrowserTTL sets the browser cache TTL in seconds
	// Minimum: 0 (respect origin), Maximum: 31536000 (1 year)
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=31536000
	BrowserTTL *int `json:"browserTTL,omitempty"`

	// DevelopmentMode temporarily bypasses cache for development
	// Automatically disables after 3 hours
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	DevelopmentMode bool `json:"developmentMode,omitempty"`

	// CacheLevel sets the cache level
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=aggressive
	CacheLevel CacheLevel `json:"cacheLevel,omitempty"`

	// TieredCache configures tiered caching
	// +kubebuilder:validation:Optional
	TieredCache *TieredCacheConfig `json:"tieredCache,omitempty"`

	// CacheReserve configures persistent cache storage
	// +kubebuilder:validation:Optional
	CacheReserve *CacheReserveConfig `json:"cacheReserve,omitempty"`

	// AlwaysOnline serves stale content when origin is unavailable
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AlwaysOnline *bool `json:"alwaysOnline,omitempty"`

	// CacheByDeviceType caches content separately for mobile/desktop
	// Requires Enterprise plan
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	CacheByDeviceType bool `json:"cacheByDeviceType,omitempty"`

	// SortQueryStringForCache treats query strings with same parameters
	// but different order as the same for caching purposes
	// Requires Enterprise plan
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	SortQueryStringForCache bool `json:"sortQueryStringForCache,omitempty"`
}

type CacheLevel string

type CacheReserveConfig struct {
	// Enabled enables Cache Reserve
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Enabled bool `json:"enabled,omitempty"`
}

type CertificateRequestType string

type CertificateValidity int

type CloudflareAuthType string

type CloudflareCredentials struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareCredentialsSpec   `json:"spec,omitempty"`
	Status CloudflareCredentialsStatus `json:"status,omitempty"`
}

type CloudflareCredentialsList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareCredentials `json:"items"`
}

type CloudflareCredentialsRef struct {
	// Name of the CloudflareCredentials resource to use
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type CloudflareCredentialsSpec struct {
	// AccountID is the Cloudflare Account ID
	// +kubebuilder:validation:Required
	AccountID string `json:"accountId"`

	// AccountName is an optional human-readable account name (for reference only)
	// +kubebuilder:validation:Optional
	AccountName string `json:"accountName,omitempty"`

	// AuthType specifies the authentication method
	// +kubebuilder:validation:Required
	// +kubebuilder:default:="apiToken"
	AuthType CloudflareAuthType `json:"authType"`

	// SecretRef references the secret containing the API credentials
	// +kubebuilder:validation:Required
	SecretRef SecretReference `json:"secretRef"`

	// DefaultDomain is the default domain for resources using these credentials
	// +kubebuilder:validation:Optional
	DefaultDomain string `json:"defaultDomain,omitempty"`

	// IsDefault marks this as the default credentials for resources that don't specify credentials
	// Only one CloudflareCredentials can be marked as default
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	IsDefault bool `json:"isDefault,omitempty"`
}

type CloudflareCredentialsStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the credentials
	// +optional
	State string `json:"state,omitempty"`

	// Validated indicates whether the credentials have been validated
	// +optional
	Validated bool `json:"validated,omitempty"`

	// LastValidatedTime is the last time credentials were validated
	// +optional
	LastValidatedTime *metav1.Time `json:"lastValidatedTime,omitempty"`

	// AccountName is the account name retrieved from Cloudflare API
	// +optional
	AccountName string `json:"accountName,omitempty"`
}

type CloudflareDetails struct {
	// +kubebuilder:validation:Optional
	// CredentialsRef references a CloudflareCredentials resource for API authentication.
	// When specified, this takes precedence over inline credential fields.
	// This is the recommended way to configure credentials.
	CredentialsRef *CloudflareCredentialsRef `json:"credentialsRef,omitempty"`

	// +kubebuilder:validation:Optional
	// Cloudflare Domain to which this tunnel belongs to.
	// Required if not using credentialsRef with a defaultDomain.
	Domain string `json:"domain,omitempty"`

	// +kubebuilder:validation:Optional
	// ZoneId is the Cloudflare Zone ID for DNS operations.
	// If not specified, it will be looked up via CloudflareDomain or the domain field.
	// Specifying this directly is useful for multi-zone scenarios.
	ZoneId string `json:"zoneId,omitempty"`

	// +kubebuilder:validation:Optional
	// Secret containing Cloudflare API key/token (legacy, use credentialsRef instead)
	Secret string `json:"secret,omitempty"`

	// +kubebuilder:validation:Optional
	// Account Name in Cloudflare. AccountName and AccountId cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountName string `json:"accountName,omitempty"`

	// +kubebuilder:validation:Optional
	// Account ID in Cloudflare. AccountId and AccountName cannot be both empty. If both are provided, Account ID is used if valid, else falls back to Account Name.
	AccountId string `json:"accountId,omitempty"`

	// +kubebuilder:validation:Optional
	// Email to use along with API Key for Delete operations for new tunnels only, or as an alternate to API Token
	Email string `json:"email,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_KEY
	// Key in the secret to use for Cloudflare API Key, defaults to CLOUDFLARE_API_KEY. Needs Email also to be provided.
	// For Delete operations for new tunnels only, or as an alternate to API Token
	CLOUDFLARE_API_KEY string `json:"CLOUDFLARE_API_KEY,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_API_TOKEN
	// Key in the secret to use for Cloudflare API token, defaults to CLOUDFLARE_API_TOKEN
	CLOUDFLARE_API_TOKEN string `json:"CLOUDFLARE_API_TOKEN,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	// Key in the secret to use as credentials.json for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_FILE
	CLOUDFLARE_TUNNEL_CREDENTIAL_FILE string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_FILE,omitempty"`

	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	// Key in the secret to use as tunnel secret for an existing tunnel, defaults to CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET
	CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET string `json:"CLOUDFLARE_TUNNEL_CREDENTIAL_SECRET,omitempty"`
}

type CloudflareDomain struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   CloudflareDomainSpec   `json:"spec,omitempty"`
	Status CloudflareDomainStatus `json:"status,omitempty"`
}

type CloudflareDomainList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []CloudflareDomain `json:"items"`
}

type CloudflareDomainSpec struct {
	// Domain is the domain name (e.g., "example.com")
	// This should be the apex domain registered in Cloudflare
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?(\.[a-zA-Z0-9]([a-zA-Z0-9-]*[a-zA-Z0-9])?)*$`
	Domain string `json:"domain"`

	// CredentialsRef references a CloudflareCredentials resource for API access.
	// If not specified, the default CloudflareCredentials will be used.
	// +kubebuilder:validation:Optional
	CredentialsRef *CredentialsReference `json:"credentialsRef,omitempty"`

	// IsDefault marks this domain as the default for resources that don't specify a domain.
	// Only one CloudflareDomain can be marked as default.
	// When multiple hostnames need zone lookup, the longest suffix match is used.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default:=false
	IsDefault bool `json:"isDefault,omitempty"`

	// ZoneID allows manual specification of the Cloudflare Zone ID.
	// If provided, the controller will skip zone lookup and use this value directly.
	// This is useful for advanced scenarios or when automatic lookup fails.
	// +kubebuilder:validation:Optional
	ZoneID string `json:"zoneId,omitempty"`

	// SSL configures SSL/TLS settings for this domain
	// +kubebuilder:validation:Optional
	SSL *SSLConfig `json:"ssl,omitempty"`

	// Cache configures caching settings for this domain
	// +kubebuilder:validation:Optional
	Cache *CacheConfig `json:"cache,omitempty"`

	// Security configures security settings for this domain
	// +kubebuilder:validation:Optional
	Security *SecurityConfig `json:"security,omitempty"`

	// Performance configures performance settings for this domain
	// +kubebuilder:validation:Optional
	Performance *PerformanceConfig `json:"performance,omitempty"`
}

type CloudflareDomainState string

type CloudflareDomainStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the domain
	// +optional
	State CloudflareDomainState `json:"state,omitempty"`

	// ZoneID is the Cloudflare Zone ID for this domain
	// +optional
	ZoneID string `json:"zoneId,omitempty"`

	// ZoneName is the zone name as returned by Cloudflare API
	// +optional
	ZoneName string `json:"zoneName,omitempty"`

	// AccountID is the Cloudflare Account ID associated with this zone
	// +optional
	AccountID string `json:"accountId,omitempty"`

	// NameServers are the Cloudflare name servers for this zone
	// +optional
	NameServers []string `json:"nameServers,omitempty"`

	// ZoneStatus is the status of the zone in Cloudflare (active, pending, etc.)
	// +optional
	ZoneStatus string `json:"zoneStatus,omitempty"`

	// LastVerifiedTime is the last time the zone was verified with Cloudflare API
	// +optional
	LastVerifiedTime *metav1.Time `json:"lastVerifiedTime,omitempty"`

	// Message provides additional information about the current state
	// +optional
	Message string `json:"message,omitempty"`

	// ConfigSyncStatus represents the sync status of zone settings
	// +optional
	ConfigSyncStatus *ConfigSyncStatus `json:"configSyncStatus,omitempty"`
}

type ClusterTunnel struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TunnelSpec   `json:"spec,omitempty"`
	Status TunnelStatus `json:"status,omitempty"`
}

type ClusterTunnelList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterTunnel `json:"items"`
}

type ConfigMapKeyRef struct {
	// Name is the ConfigMap name.
	// +kubebuilder:validation:Required
	Name string `json:"name"`

	// Key is the key in the ConfigMap.
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// Namespace is the ConfigMap namespace.
	// +kubebuilder:validation:Optional
	Namespace string `json:"namespace,omitempty"`
}

type ConfigSyncState string

type ConfigSyncStatus struct {
	// SSL sync status
	// +kubebuilder:validation:Optional
	SSL ConfigSyncState `json:"ssl,omitempty"`

	// Cache sync status
	// +kubebuilder:validation:Optional
	Cache ConfigSyncState `json:"cache,omitempty"`

	// Security sync status
	// +kubebuilder:validation:Optional
	Security ConfigSyncState `json:"security,omitempty"`

	// Performance sync status
	// +kubebuilder:validation:Optional
	Performance ConfigSyncState `json:"performance,omitempty"`

	// LastSyncTime is the last time any configuration was synced
	// +kubebuilder:validation:Optional
	LastSyncTime *string `json:"lastSyncTime,omitempty"`

	// ErrorMessage contains error details if any sync failed
	// +kubebuilder:validation:Optional
	ErrorMessage string `json:"errorMessage,omitempty"`
}

type CredentialsReference struct {
	// Name of the CloudflareCredentials resource
	// +kubebuilder:validation:Required
	Name string `json:"name"`
}

type CustomCertificateSettings struct {
	Enabled bool   `json:"enabled"`
	ID      string `json:"id,omitempty"`
}

type DNSManagementMode string

type DNSRecord struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DNSRecordSpec   `json:"spec,omitempty"`
	Status DNSRecordStatus `json:"status,omitempty"`
}

type DNSRecordData struct {
	// For SRV records
	// +kubebuilder:validation:Optional
	Service string `json:"service,omitempty"`

	// +kubebuilder:validation:Optional
	Proto string `json:"proto,omitempty"`

	// +kubebuilder:validation:Optional
	Weight int `json:"weight,omitempty"`

	// +kubebuilder:validation:Optional
	Port int `json:"port,omitempty"`

	// +kubebuilder:validation:Optional
	Target string `json:"target,omitempty"`

	// For CAA records
	// +kubebuilder:validation:Optional
	Flags int `json:"flags,omitempty"`

	// +kubebuilder:validation:Optional
	Tag string `json:"tag,omitempty"`

	// +kubebuilder:validation:Optional
	Value string `json:"value,omitempty"`

	// For CERT/SSHFP/TLSA records
	// +kubebuilder:validation:Optional
	Algorithm int `json:"algorithm,omitempty"`

	// +kubebuilder:validation:Optional
	Certificate string `json:"certificate,omitempty"`

	// +kubebuilder:validation:Optional
	KeyTag int `json:"keyTag,omitempty"`

	// +kubebuilder:validation:Optional
	Usage int `json:"usage,omitempty"`

	// +kubebuilder:validation:Optional
	Selector int `json:"selector,omitempty"`

	// +kubebuilder:validation:Optional
	MatchingType int `json:"matchingType,omitempty"`

	// For LOC records
	// +kubebuilder:validation:Optional
	LatDegrees int `json:"latDegrees,omitempty"`

	// +kubebuilder:validation:Optional
	LatMinutes int `json:"latMinutes,omitempty"`

	// +kubebuilder:validation:Optional
	LatSeconds string `json:"latSeconds,omitempty"`

	// +kubebuilder:validation:Optional
	LatDirection string `json:"latDirection,omitempty"`

	// +kubebuilder:validation:Optional
	LongDegrees int `json:"longDegrees,omitempty"`

	// +kubebuilder:validation:Optional
	LongMinutes int `json:"longMinutes,omitempty"`

	// +kubebuilder:validation:Optional
	LongSeconds string `json:"longSeconds,omitempty"`

	// +kubebuilder:validation:Optional
	LongDirection string `json:"longDirection,omitempty"`

	// +kubebuilder:validation:Optional
	Altitude string `json:"altitude,omitempty"`

	// +kubebuilder:validation:Optional
	Size string `json:"size,omitempty"`

	// +kubebuilder:validation:Optional
	PrecisionHorz string `json:"precisionHorz,omitempty"`

	// +kubebuilder:validation:Optional
	PrecisionVert string `json:"precisionVert,omitempty"`

	// For URI records
	// +kubebuilder:validation:Optional
	ContentURI string `json:"content,omitempty"`
}

type DNSRecordList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DNSRecord `json:"items"`
}

type DNSRecordSpec struct {
	// Name is the DNS record name (e.g., "www" or "www.example.com").
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name"`

	// Type is the DNS record type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=A;AAAA;CNAME;TXT;MX;NS;SRV;CAA;CERT;DNSKEY;DS;HTTPS;LOC;NAPTR;SMIMEA;SSHFP;SVCB;TLSA;URI
	Type string `json:"type"`

	// Content is the record content/value.
	// +kubebuilder:validation:Required
	Content string `json:"content"`

	// TTL is the Time To Live (1 = automatic).
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	TTL int `json:"ttl,omitempty"`

	// Proxied enables Cloudflare proxy for this record.
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=false
	Proxied bool `json:"proxied,omitempty"`

	// Priority for MX/SRV records.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Minimum=0
	// +kubebuilder:validation:Maximum=65535
	Priority *int `json:"priority,omitempty"`

	// Comment is an optional comment.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=100
	Comment string `json:"comment,omitempty"`

	// Tags for the record.
	// +kubebuilder:validation:Optional
	Tags []string `json:"tags,omitempty"`

	// Data contains additional record-specific data (for SRV, CAA, etc.).
	// +kubebuilder:validation:Optional
	Data *DNSRecordData `json:"data,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DNSRecordStatus struct {
	// RecordID is the Cloudflare DNS Record ID.
	// +kubebuilder:validation:Optional
	RecordID string `json:"recordId,omitempty"`

	// ZoneID is the Cloudflare Zone ID.
	// +kubebuilder:validation:Optional
	ZoneID string `json:"zoneId,omitempty"`

	// FQDN is the fully qualified domain name.
	// +kubebuilder:validation:Optional
	FQDN string `json:"fqdn,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DNSResolverEntry struct {
	// IP is the resolver IP address.
	IP string `json:"ip"`

	// Port is the resolver port.
	// +kubebuilder:validation:Optional
	Port int `json:"port,omitempty"`

	// VNetID is the virtual network ID.
	// +kubebuilder:validation:Optional
	VNetID string `json:"vnetId,omitempty"`

	// RouteThroughPrivateNetwork routes through private network.
	// +kubebuilder:validation:Optional
	RouteThroughPrivateNetwork *bool `json:"routeThroughPrivateNetwork,omitempty"`
}

type DNSResolversSettings struct {
	// IPv4 resolvers.
	// +kubebuilder:validation:Optional
	IPv4 []DNSResolverEntry `json:"ipv4,omitempty"`

	// IPv6 resolvers.
	// +kubebuilder:validation:Optional
	IPv6 []DNSResolverEntry `json:"ipv6,omitempty"`
}

type DevicePostureInput struct {
	// ID is a generic identifier for integrations.
	// +kubebuilder:validation:Optional
	ID string `json:"id,omitempty"`

	// Path is the file path to check.
	// +kubebuilder:validation:Optional
	Path string `json:"path,omitempty"`

	// Exists checks if file exists.
	// +kubebuilder:validation:Optional
	Exists *bool `json:"exists,omitempty"`

	// Sha256 is the expected file hash.
	// +kubebuilder:validation:Optional
	Sha256 string `json:"sha256,omitempty"`

	// Thumbprint is the certificate thumbprint.
	// +kubebuilder:validation:Optional
	Thumbprint string `json:"thumbprint,omitempty"`

	// Running checks if application is running.
	// +kubebuilder:validation:Optional
	Running *bool `json:"running,omitempty"`

	// RequireAll requires all conditions to match.
	// +kubebuilder:validation:Optional
	RequireAll *bool `json:"requireAll,omitempty"`

	// Enabled checks if feature is enabled.
	// +kubebuilder:validation:Optional
	Enabled *bool `json:"enabled,omitempty"`

	// Version is the minimum version.
	// +kubebuilder:validation:Optional
	Version string `json:"version,omitempty"`

	// Operator is the version comparison operator.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	Operator string `json:"operator,omitempty"`

	// Domain is the expected domain for domain-joined checks.
	// +kubebuilder:validation:Optional
	Domain string `json:"domain,omitempty"`

	// ComplianceStatus is the Intune compliance status.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=compliant;noncompliant;unknown;notapplicable;ingraceperiod;error
	ComplianceStatus string `json:"complianceStatus,omitempty"`

	// ConnectionID is the third-party integration connection ID.
	// +kubebuilder:validation:Optional
	ConnectionID string `json:"connectionId,omitempty"`

	// LastSeen is the maximum time since device was last seen.
	// +kubebuilder:validation:Optional
	LastSeen string `json:"lastSeen,omitempty"`

	// EidLastSeen is for enterprise ID last seen time.
	// +kubebuilder:validation:Optional
	EidLastSeen string `json:"eidLastSeen,omitempty"`

	// ActiveThreats is the maximum active threat count.
	// +kubebuilder:validation:Optional
	ActiveThreats *int `json:"activeThreats,omitempty"`

	// Infected checks if device is infected.
	// +kubebuilder:validation:Optional
	Infected *bool `json:"infected,omitempty"`

	// IsActive checks if the device is active.
	// +kubebuilder:validation:Optional
	IsActive *bool `json:"isActive,omitempty"`

	// NetworkStatus checks for network connection.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=connected;disconnected;disconnecting;connecting
	NetworkStatus string `json:"networkStatus,omitempty"`

	// SensorConfig checks sensor configuration.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=active;disabled;not_configured
	SensorConfig string `json:"sensorConfig,omitempty"`

	// VersionOperator for CrowdStrike version checks.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	VersionOperator string `json:"versionOperator,omitempty"`

	// CountOperator for count comparisons.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	CountOperator string `json:"countOperator,omitempty"`

	// ScoreOperator for score comparisons.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=<;<=;>;>=;==
	ScoreOperator string `json:"scoreOperator,omitempty"`

	// IssueCount is the number of issues for SentinelOne.
	// +kubebuilder:validation:Optional
	IssueCount *int `json:"issueCount,omitempty"`

	// Score for risk/posture scoring.
	// +kubebuilder:validation:Optional
	Score *int `json:"score,omitempty"`

	// TotalScore for total risk scoring.
	// +kubebuilder:validation:Optional
	TotalScore *int `json:"totalScore,omitempty"`

	// RiskLevel for risk assessment.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=low;medium;high;critical
	RiskLevel string `json:"riskLevel,omitempty"`

	// Overall risk assessment.
	// +kubebuilder:validation:Optional
	Overall string `json:"overall,omitempty"`

	// State for device state checks.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// OperationalState for device operational state.
	// +kubebuilder:validation:Optional
	OperationalState string `json:"operationalState,omitempty"`

	// OSDistroName is the OS distribution name.
	// +kubebuilder:validation:Optional
	OSDistroName string `json:"osDistroName,omitempty"`

	// OSDistroRevision is the OS distribution revision.
	// +kubebuilder:validation:Optional
	OSDistroRevision string `json:"osDistroRevision,omitempty"`

	// OSVersionExtra for additional OS version info.
	// +kubebuilder:validation:Optional
	OSVersionExtra string `json:"osVersionExtra,omitempty"`

	// OS for operating system checks.
	// +kubebuilder:validation:Optional
	OS string `json:"os,omitempty"`

	// OperatingSystem for operating system name.
	// +kubebuilder:validation:Optional
	OperatingSystem string `json:"operatingSystem,omitempty"`

	// CertificateID for client certificate checks.
	// +kubebuilder:validation:Optional
	CertificateID string `json:"certificateId,omitempty"`

	// CommonName (CN) for client certificate checks.
	// +kubebuilder:validation:Optional
	CommonName string `json:"commonName,omitempty"`

	// Cn is an alias for CommonName.
	// +kubebuilder:validation:Optional
	Cn string `json:"cn,omitempty"`

	// CheckPrivateKey checks if private key is present.
	// +kubebuilder:validation:Optional
	CheckPrivateKey *bool `json:"checkPrivateKey,omitempty"`

	// ExtendedKeyUsage for certificate key usage.
	// +kubebuilder:validation:Optional
	ExtendedKeyUsage []string `json:"extendedKeyUsage,omitempty"`

	// Locations for location-based checks.
	// +kubebuilder:validation:Optional
	Locations []DevicePostureLocation `json:"locations,omitempty"`

	// CheckDisks specifies which disks to check encryption.
	// +kubebuilder:validation:Optional
	CheckDisks []string `json:"checkDisks,omitempty"`
}

type DevicePostureLocation struct {
	// Paths for location paths.
	// +kubebuilder:validation:Optional
	Paths []string `json:"paths,omitempty"`

	// TrustStores for trust store locations.
	// +kubebuilder:validation:Optional
	TrustStores []string `json:"trustStores,omitempty"`
}

type DevicePostureMatch struct {
	// Platform is the OS platform.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=windows;mac;linux;android;ios;chromeos
	Platform string `json:"platform,omitempty"`
}

type DevicePostureRule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DevicePostureRuleSpec   `json:"spec,omitempty"`
	Status DevicePostureRuleStatus `json:"status,omitempty"`
}

type DevicePostureRuleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DevicePostureRule `json:"items"`
}

type DevicePostureRuleSpec struct {
	// Name of the Device Posture Rule in Cloudflare.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=255
	Name string `json:"name,omitempty"`

	// Type is the posture rule type.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=file;application;serial_number;tanium;gateway;warp;disk_encryption;sentinelone;carbonblack;firewall;os_version;domain_joined;client_certificate;client_certificate_v2;unique_client_id;kolide;tanium_s2s;crowdstrike_s2s;sentinelone_s2s;intune;workspace_one;custom_s2s
	Type string `json:"type"`

	// Description is a human-readable description.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:MaxLength=1000
	Description string `json:"description,omitempty"`

	// Schedule determines how often the rule is evaluated.
	// +kubebuilder:validation:Optional
	Schedule string `json:"schedule,omitempty"`

	// Expiration is when the rule expires.
	// +kubebuilder:validation:Optional
	Expiration string `json:"expiration,omitempty"`

	// Match defines which devices this rule applies to.
	// +kubebuilder:validation:Optional
	Match []DevicePostureMatch `json:"match,omitempty"`

	// Input contains the rule-specific configuration.
	// +kubebuilder:validation:Optional
	Input *DevicePostureInput `json:"input,omitempty"`

	// Cloudflare contains the Cloudflare API credentials.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DevicePostureRuleStatus struct {
	// RuleID is the Cloudflare Device Posture Rule ID.
	// +kubebuilder:validation:Optional
	RuleID string `json:"ruleId,omitempty"`

	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// State indicates the current state.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DeviceSettingsPolicy struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeviceSettingsPolicySpec   `json:"spec,omitempty"`
	Status DeviceSettingsPolicyStatus `json:"status,omitempty"`
}

type DeviceSettingsPolicyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeviceSettingsPolicy `json:"items"`
}

type DeviceSettingsPolicySpec struct {
	// SplitTunnelMode determines how split tunneling is configured.
	// "exclude" means traffic to listed addresses bypasses the tunnel (default WARP behavior).
	// "include" means only traffic to listed addresses goes through the tunnel.
	// +kubebuilder:validation:Optional
	// +kubebuilder:validation:Enum=exclude;include
	// +kubebuilder:default=exclude
	SplitTunnelMode string `json:"splitTunnelMode,omitempty"`

	// SplitTunnelExclude lists addresses/hosts to exclude from the tunnel.
	// Only used when SplitTunnelMode is "exclude".
	// +kubebuilder:validation:Optional
	SplitTunnelExclude []SplitTunnelEntry `json:"splitTunnelExclude,omitempty"`

	// SplitTunnelInclude lists addresses/hosts to include in the tunnel.
	// Only used when SplitTunnelMode is "include".
	// +kubebuilder:validation:Optional
	SplitTunnelInclude []SplitTunnelEntry `json:"splitTunnelInclude,omitempty"`

	// FallbackDomains lists domains that should use the specified DNS servers
	// instead of Gateway DNS.
	// +kubebuilder:validation:Optional
	FallbackDomains []FallbackDomainEntry `json:"fallbackDomains,omitempty"`

	// AutoPopulateFromRoutes automatically populates split tunnel entries
	// from NetworkRoute resources in the cluster.
	// +kubebuilder:validation:Optional
	AutoPopulateFromRoutes *AutoPopulateConfig `json:"autoPopulateFromRoutes,omitempty"`

	// Cloudflare contains the Cloudflare API credentials and account information.
	// +kubebuilder:validation:Required
	Cloudflare CloudflareDetails `json:"cloudflare"`
}

type DeviceSettingsPolicyStatus struct {
	// AccountID is the Cloudflare Account ID.
	// +kubebuilder:validation:Optional
	AccountID string `json:"accountId,omitempty"`

	// SplitTunnelExcludeCount is the number of exclude entries configured.
	// +kubebuilder:validation:Optional
	SplitTunnelExcludeCount int `json:"splitTunnelExcludeCount,omitempty"`

	// SplitTunnelIncludeCount is the number of include entries configured.
	// +kubebuilder:validation:Optional
	SplitTunnelIncludeCount int `json:"splitTunnelIncludeCount,omitempty"`

	// FallbackDomainsCount is the number of fallback domain entries configured.
	// +kubebuilder:validation:Optional
	FallbackDomainsCount int `json:"fallbackDomainsCount,omitempty"`

	// AutoPopulatedRoutesCount is the number of routes auto-populated from NetworkRoutes.
	// +kubebuilder:validation:Optional
	AutoPopulatedRoutesCount int `json:"autoPopulatedRoutesCount,omitempty"`

	// State indicates the current state of the policy.
	// +kubebuilder:validation:Optional
	State string `json:"state,omitempty"`

	// Conditions represent the latest available observations of the DeviceSettingsPolicy's state.
	// +kubebuilder:validation:Optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed by the controller.
	// +kubebuilder:validation:Optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type DomainConfiguration struct {
	// AutoRenew enables automatic domain renewal
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	AutoRenew bool `json:"autoRenew,omitempty"`

	// Privacy enables WHOIS privacy protection
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	Privacy bool `json:"privacy,omitempty"`

	// Locked prevents unauthorized transfers
	// +kubebuilder:validation:Optional
	// +kubebuilder:default=true
	Locked bool `json:"locked,omitempty"`

	// NameServers specifies custom nameservers (optional)
	// If not specified, Cloudflare nameservers will be used
	// +kubebuilder:validation:Optional
	NameServers []string `json:"nameServers,omitempty"`
}

type DomainRegistration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DomainRegistrationSpec   `json:"spec,omitempty"`
	Status DomainRegistrationStatus `json:"status,omitempty"`
}

type DomainRegistrationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DomainRegistration `json:"items"`
}

type DomainRegistrationSpec struct {
	// DomainName is the domain name to manage
	// This domain must already be registered with Cloudflare Registrar
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9][a-zA-Z0-9-]{0,61}[a-zA-Z0-9]\.[a-zA-Z]{2,}$`
	DomainName string `json:"domainName"`

	// Configuration contains domain settings
	// +kubebuilder:validation:Optional
	Configuration *DomainConfiguration `json:"configuration,omitempty"`

	// RegistrantContact contains the registrant contact information
	// If not specified, existing contact information will be preserved
	// +kubebuilder:validation:Optional
	RegistrantContact *RegistrantContact `json:"registrantContact,omitempty"`

	// CredentialsRef references a CloudflareCredentials resource
	// If not specified, the default CloudflareCredentials will be used
	// +kubebuilder:validation:Optional
	CredentialsRef *CredentialsReference `json:"credentialsRef,omitempty"`
}

type DomainRegistrationState string

type DomainRegistrationStatus struct {
	// Conditions represent the latest available observations
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// State represents the current state of the domain
	// +optional
	State DomainRegistrationState `json:"state,omitempty"`

	// DomainID is the Cloudflare domain ID
	// +optional
	DomainID string `json:"domainId,omitempty"`

	// CurrentRegistrar is the current registrar name
	// +optional
	CurrentRegistrar string `json:"currentRegistrar,omitempty"`

	// RegistryStatuses contains the registry status codes
	// +optional
	RegistryStatuses string `json:"registryStatuses,omitempty"`

	// ExpiresAt is when the domain registration expires
	// +optional
	ExpiresAt *metav1.Time `json:"expiresAt,omitempty"`

	// CreatedAt is when the domain was registered
	// +optional
	CreatedAt *metav1.Time `json:"createdAt,omitempty"`

	// AutoRenew indicates if auto-renewal is enabled
	// +optional
	AutoRenew bool `json:"autoRenew,omitempty"`

	// Privacy indicates if WHOIS privacy is enabled
	// +optional
	Privacy bool `json:"privacy,omitempty"`

	// Locked indicates if the domain is locked
	// +optional
	Locked bool `json:"locked,omitempty"`

	// TransferInStatus contains transfer status if applicable
	// +optional
	TransferInStatus string `json:"transferInStatus,omitempty"`

	// Message provides additional information about the current state
	// +optional
	Message string `json:"message,omitempty"`
}

type EgressSettings struct {
	IPv4         string `json:"ipv4,omitempty"`
	IPv6         string `json:"ipv6,omitempty"`
	IPv4Fallback string `json:"ipv4Fallback,omitempty"`
}