v1alpha1

type Agent struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentSpec   `json:"spec,omitempty"`
	Status AgentStatus `json:"status,omitempty"`
}

type AgentGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentGatewaySpec   `json:"spec,omitempty"`
	Status AgentGatewayStatus `json:"status,omitempty"`
}

type AgentGatewayClass struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentGatewayClassSpec   `json:"spec,omitempty"`
	Status AgentGatewayClassStatus `json:"status,omitempty"`
}

type AgentGatewayClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentGatewayClass `json:"items"`
}

type AgentGatewayClassSpec struct {
	// Controller is the name of the controller that should handle this gateway class
	// +kubebuilder:validation:Required
	Controller string `json:"controller"`
}

type AgentGatewayClassStatus struct {
	// Conditions represent the latest available observations of the gateway class's state
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type AgentGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentGateway `json:"items"`
}

type AgentGatewaySpec struct {
	// AgentGatewayClassName specifies which AgentGatewayClass to use for this gateway instance.
	// This is only needed if multiple gateway classes are defined in the cluster.
	AgentGatewayClassName string `json:"agentGatewayClassName,omitempty"`

	// Replicas is the number of gateway replicas
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=1
	Replicas *int32 `json:"replicas,omitempty"`

	// Timeout specifies the gateway timeout for requests
	// +kubebuilder:default="360s"
	Timeout *metav1.Duration `json:"timeout,omitempty"`

	// Environment variables to pass to the AgentGateway container.
	// These can include configuration values, credentials, or feature flags.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// List of sources to populate environment variables in the AgentGateway container.
	// This allows loading variables from ConfigMaps and Secrets.
	// +optional
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`

	// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
	// resources created for this gateway, as well as the pod template.
	// +optional
	CommonMetadata *EmbeddedMetadata `json:"commonMetadata,omitempty"`

	// PodMetadata defines labels and annotations to be applied only to the pod template
	// of the Deployment created for this gateway.
	// +optional
	PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`

	// Guardrails lists the Guard resources to be applied to traffic through this gateway.
	// Guards are applied in the order they are listed.
	// +optional
	Guardrails []corev1.ObjectReference `json:"guardrails,omitempty"`
}

type AgentGatewayStatus struct {
	// Conditions represent the latest available observations of the gateway's state
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type AgentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Agent `json:"items"`
}

type AgentProtocol struct {
	// Name is the name of the port
	// +kubebuilder:default=“
	Name string `json:"name,omitempty"`

	// Type of the protocol used by the agent
	// +kubebuilder:validation:Enum=A2A
	Type string `json:"type"`

	// Port is the port number, defaults to the default port for the protocol
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port,omitempty"`

	// Path is the path used for HTTP-based protocols
	// +kubebuilder:validation:Pattern=`^/[a-zA-Z0-9/_-]*$`
	Path string `json:"path,omitempty"`
}

type AgentRuntimeConfiguration struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentRuntimeConfigurationSpec   `json:"spec,omitempty"`
	Status AgentRuntimeConfigurationStatus `json:"status,omitempty"`
}

type AgentRuntimeConfigurationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgentRuntimeConfiguration `json:"items"`
}

type AgentRuntimeConfigurationSpec struct {
	// DefaultFramework defines the default agent framework to use when an Agent resource
	// does not specify a framework. When this value changes, all agents without an explicit
	// framework will be updated to use the new default.
	// If not specified, the operator defaults to "google-adk".
	// +kubebuilder:validation:Enum=google-adk;msaf
	// +optional
	DefaultFramework string `json:"defaultFramework,omitempty"`

	// AgentTemplateImages defines the default template images for different agent frameworks.
	// These images are used when an Agent resource does not specify a custom image.
	// +optional
	AgentTemplateImages *AgentTemplateImages `json:"agentTemplateImages,omitempty"`
}

type AgentRuntimeConfigurationStatus struct {
	// Conditions represent the latest available observations of the configuration's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type"`
}

type AgentSpec struct {
	// Framework defines the supported agent frameworks
	// +kubebuilder:validation:Enum=google-adk;msaf;custom
	// +optional
	Framework string `json:"framework,omitempty"`

	// Replicas is the number of replicas for the microservice deployment
	// +kubebuilder:validation:Minimum=0
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`

	// Image is the Docker image and tag to use for the microservice deployment.
	// When not specified, the operator will use a framework-specific template image.
	// +optional
	Image string `json:"image,omitempty"`

	// Description provides a description of the agent.
	// This is passed as AGENT_DESCRIPTION environment variable to the agent.
	// +optional
	Description string `json:"description,omitempty"`

	// Instruction defines the system instruction/prompt for the agent when using template images.
	// This is passed as AGENT_INSTRUCTION environment variable to the agent.
	// +optional
	Instruction string `json:"instruction,omitempty"`

	// Model specifies the language model to use for the agent.
	// This is passed as AGENT_MODEL environment variable to the agent.
	// Defaults to the agents default model if not specified.
	// +optional
	Model string `json:"model,omitempty"`

	// SubAgents defines configuration for connecting to cluster or remote agents.
	// This is converted to JSON and passed as SUB_AGENTS environment variable to the agent.
	// +optional
	SubAgents []SubAgent `json:"subAgents,omitempty"`

	// Tools defines configuration for integrating MCP (Model Context Protocol) tools.
	// This is converted to JSON and passed as AGENT_TOOLS environment variable to the agent.
	// +optional
	Tools []AgentTool `json:"tools,omitempty"`

	// Protocols defines the protocols supported by the agent
	// +patchMergeKey=name
	// +patchStrategy=merge
	// +listType=atomic
	Protocols []AgentProtocol `json:"protocols,omitempty"`

	// Exposed indicates whether this agent should be exposed via the AgentGateway
	// +kubebuilder:default=false
	Exposed bool `json:"exposed,omitempty"`

	// AiGatewayRef references an AiGateway resource that this agent should use for model routing.
	// If not specified, the operator will attempt to find the default AiGateway in the cluster.
	// If no default AiGateway exists, the agent will run without an AI Gateway.
	// If Namespace is not specified, defaults to the same namespace as the Agent.
	// +optional
	AiGatewayRef *corev1.ObjectReference `json:"aiGatewayRef,omitempty"`

	// Env defines additional environment variables to be injected into the agent container.
	// These are take precedence over operator-managed environment variables.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// EnvFrom defines sources to populate environment variables from.
	// +optional
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`

	// VolumeMounts defines volume mounts to be added to the agent container.
	// +optional
	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`

	// Volumes defines volumes to be added to the agent pod.
	// Volume names starting with "agent-operator-" are reserved for operator use and will be rejected.
	// +optional
	Volumes []corev1.Volume `json:"volumes,omitempty"`

	// Resources defines the compute resource requirements for the agent container.
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
	// resources created for this agent, as well as the pod template.
	// +optional
	CommonMetadata *EmbeddedMetadata `json:"commonMetadata,omitempty"`

	// PodMetadata defines labels and annotations to be applied only to the pod template
	// of the Deployment created for this agent.
	// +optional
	PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`
}

type AgentStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Url is the cluster-local URL where this agent can be accessed via A2A protocol.
	// This is automatically populated by the controller when the agent has an A2A protocol configured.
	// Format: http://{name}.{namespace}.svc.cluster.local:{port}/.well-known/agent-card.json
	// +optional
	Url string `json:"url,omitempty"`

	// AiGatewayRef references the AiGateway resource that this agent is connected to.
	// This field is automatically populated by the controller when an AI Gateway is being used.
	// If nil, the agent is not connected to any AI Gateway.
	// +optional
	AiGatewayRef *corev1.ObjectReference `json:"aiGatewayRef,omitempty"`
}

type AgentTemplateImages struct {
	// GoogleAdk is the template image for the Google ADK framework.
	// If not specified, the operator's built-in default will be used.
	// +optional
	GoogleAdk string `json:"googleAdk,omitempty"`

	// Msaf is the template image for the Microsoft Agent Framework (MSAF).
	// If not specified, the operator's built-in default will be used.
	// +optional
	Msaf string `json:"msaf,omitempty"`
}

type AgentTool struct {
	// Name is the unique identifier for this tool within the agent.
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Upstream specifies how to reach the MCP server.
	// Exactly one of toolRouteRef, toolServerRef, or external must be set.
	// +kubebuilder:validation:Required
	Upstream AgentToolUpstream `json:"upstream"`

	// PropagatedHeaders is a list of HTTP header names that should be propagated from incoming
	// A2A requests to the MCP tool server. Header names are case-insensitive.
	// If not specified or empty, no headers are propagated.
	// +optional
	PropagatedHeaders []string `json:"propagatedHeaders,omitempty"`
}

type AgentToolUpstream struct {
	// ToolRouteRef references a ToolRoute that exposes the MCP server via a gateway.
	// Namespace defaults to the agent's namespace if not specified.
	// +optional
	ToolRouteRef *corev1.ObjectReference `json:"toolRouteRef,omitempty"`

	// ToolServerRef references a cluster-local ToolServer directly, bypassing any gateway.
	// Namespace defaults to the agent's namespace if not specified.
	// +optional
	ToolServerRef *corev1.ObjectReference `json:"toolServerRef,omitempty"`

	// External describes a remote MCP server reachable at an HTTP URL, bypassing any gateway.
	// +optional
	External *ExternalUpstream `json:"external,omitempty"`
}

type AgenticWorkforce struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgenticWorkforceSpec   `json:"spec,omitempty"`
	Status AgenticWorkforceStatus `json:"status,omitempty"`
}

type AgenticWorkforceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AgenticWorkforce `json:"items"`
}

type AgenticWorkforceSpec struct {
	// Name is the human-readable name of the workforce
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Description provides details about the workforce's purpose and capabilities
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Description string `json:"description"`

	// Owner is the email address or identifier of the workforce owner
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Owner string `json:"owner"`

	// Tags is a list of labels for categorizing and organizing workforces
	// +optional
	Tags []string `json:"tags,omitempty"`

	// EntryPointAgents defines references to the entry-point agents for this workforce.
	// Uses standard Kubernetes ObjectReference. Only Name and Namespace fields are used.
	// Namespace defaults to the AgenticWorkforce's namespace if not specified.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	EntryPointAgents []*corev1.ObjectReference `json:"entryPointAgents"`
}

type AgenticWorkforceStatus struct {
	// Conditions represent the latest available observations of the workforce's state
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// TransitiveAgents contains all agents (both cluster and remote) discovered from entry-point agents
	// +optional
	TransitiveAgents []TransitiveAgent `json:"transitiveAgents,omitempty"`

	// TransitiveTools contains all tools discovered from all transitive agents
	// +optional
	TransitiveTools []string `json:"transitiveTools,omitempty"`
}

type AiGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AiGatewaySpec   `json:"spec,omitempty"`
	Status AiGatewayStatus `json:"status,omitempty"`
}

type AiGatewayClass struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AiGatewayClassSpec   `json:"spec,omitempty"`
	Status AiGatewayClassStatus `json:"status,omitempty"`
}

type AiGatewayClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AiGatewayClass `json:"items"`
}

type AiGatewayClassSpec struct {
	// Controller is the name of the controller that should handle this gateway class
	// +kubebuilder:validation:Required
	Controller string `json:"controller"`
}

type AiGatewayClassStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type AiGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []AiGateway `json:"items"`
}

type AiGatewaySpec struct {
	// AiGatewayClassName specifies which AiGatewayClass to use for this AI gateway instance.
	// This is only needed if multiple AI gateway classes are defined in the cluster.
	AiGatewayClassName string `json:"aiGatewayClassName,omitempty"`

	// Port on which the AI gateway will be exposed.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	// +kubebuilder:default=80
	Port int32 `json:"port,omitempty"`

	// List of AI models to be made available through the gateway.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:Required
	AiModels []AiModel `json:"aiModels,omitempty"`

	// Environment variables to pass to the AI gateway container.
	// These can include configuration values, credentials, or feature flags.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// List of sources to populate environment variables in the AI gateway container.
	// This allows loading variables from ConfigMaps and Secrets.
	// +optional
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`

	// Guardrails lists the Guard resources to be applied to requests through this AI gateway.
	// Guards are applied in the order they are listed.
	// +optional
	Guardrails []corev1.ObjectReference `json:"guardrails,omitempty"`

	// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
	// resources created for this gateway, as well as the pod template.
	// +optional
	CommonMetadata *EmbeddedMetadata `json:"commonMetadata,omitempty"`

	// PodMetadata defines labels and annotations to be applied only to the pod template
	// of the Deployment created for this gateway.
	// +optional
	PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`
}

type AiGatewayStatus struct {
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type AiModel struct {
	// Name is the identifier for the AI model (e.g., "gpt-4", "claude-3-opus")
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// Provider specifies the AI provider (e.g., "openai", "anthropic", "azure")
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Provider string `json:"provider"`
}

type BedrockGuardConfig struct {
	// GuardrailId is the identifier of the Bedrock guardrail.
	GuardrailId string `json:"guardrailId"`

	// GuardrailVersion is the version of the Bedrock guardrail.
	// +optional
	GuardrailVersion string `json:"guardrailVersion,omitempty"`
}

type BedrockProviderConfig struct {
	// Region is the AWS region for the Bedrock service.
	Region string `json:"region"`

	// CredentialsSecretRef references a secret containing AWS credentials.
	// The secret should contain "aws-access-key-id" and "aws-secret-access-key" keys.
	// When omitted, uses IRSA or pod identity for authentication.
	// +optional
	CredentialsSecretRef *corev1.SecretReference `json:"credentialsSecretRef,omitempty"`
}

type EmbeddedMetadata struct {
	// Labels is a map of key/value pairs to be applied to the resource.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`

	// Annotations is a map of key/value pairs to be applied to the resource.
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

type ExternalUpstream struct {
	// Url is the HTTP/HTTPS endpoint of the external MCP server.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Format=uri
	// +kubebuilder:validation:Pattern=`^https?://.+`
	Url string `json:"url"`
}

type Guard struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GuardSpec   `json:"spec,omitempty"`
	Status GuardStatus `json:"status,omitempty"`
}

type GuardList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Guard `json:"items"`
}

type GuardMode string

type GuardSpec struct {
	// Mode defines when the guard is applied relative to the LLM call.
	// Multiple modes can be specified to apply the guard at multiple points.
	// +kubebuilder:validation:MinItems=1
	// +listType=set
	Mode []GuardMode `json:"mode"`

	// Description provides a human-readable description of the guard's purpose.
	// This field is for documentation purposes only and has no effect on the guard's behavior.
	// +optional
	Description string `json:"description,omitempty"`

	// ProviderRef references the GuardrailProvider that hosts this guard.
	// If Namespace is not specified, defaults to the same namespace as the Guard.
	ProviderRef corev1.ObjectReference `json:"providerRef"`

	// OpenAIModeration holds guard-level configuration for the OpenAI Moderation API.
	// +optional
	OpenAIModeration *OpenAIModerationGuardConfig `json:"openaiModeration,omitempty"`

	// Bedrock holds guard-level configuration for the AWS Bedrock Guardrails API.
	// +optional
	Bedrock *BedrockGuardConfig `json:"bedrock,omitempty"`

	// Presidio holds guard-level configuration for the Presidio API.
	// +optional
	Presidio *PresidioGuardConfig `json:"presidio,omitempty"`
}

type GuardStatus struct {
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type GuardrailProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   GuardrailProviderSpec   `json:"spec,omitempty"`
	Status GuardrailProviderStatus `json:"status,omitempty"`
}

type GuardrailProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []GuardrailProvider `json:"items"`
}

type GuardrailProviderSpec struct {
	// Type defines the guardrail API type implemented by this provider.
	// Each type corresponds to a specific guardrail API contract.
	// +kubebuilder:validation:Enum=openai-moderation-api;bedrock-api;presidio-api
	Type string `json:"type"`

	// OpenAIModeration holds configuration for providers implementing the OpenAI Moderation API.
	// Required when type is "openai-moderation-api".
	// +optional
	OpenAIModeration *OpenAIModerationProviderConfig `json:"openaiModeration,omitempty"`

	// Bedrock holds configuration for providers implementing the AWS Bedrock Guardrails API.
	// Required when type is "bedrock-api".
	// +optional
	Bedrock *BedrockProviderConfig `json:"bedrock,omitempty"`

	// Presidio holds configuration for providers implementing the Presidio API.
	// Required when type is "presidio-api".
	// +optional
	Presidio *PresidioProviderConfig `json:"presidio,omitempty"`
}

type GuardrailProviderStatus struct {
	// +operator-sdk:csv:customresourcedefinitions:type=status
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type OpenAIModerationGuardConfig struct {
	// Model specifies the moderation model to use (e.g., "omni-moderation-latest").
	// When omitted, the provider's default model is used.
	// +optional
	Model string `json:"model,omitempty"`
}

type OpenAIModerationProviderConfig struct {
	// BaseUrl overrides the default OpenAI moderation endpoint.
	// When omitted, the official OpenAI moderation API is used.
	// Can also point to a custom service implementing the same API contract.
	// +optional
	// +kubebuilder:validation:Format=uri
	BaseUrl string `json:"baseUrl,omitempty"`

	// ApiKeySecretRef references the secret containing the API key.
	// +optional
	ApiKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
}

type PresidioGuardConfig struct {
	// Language specifies the language of the text to analyze (e.g., "en").
	// Defaults to "en" when omitted.
	// +optional
	Language string `json:"language,omitempty"`

	// ScoreThresholds maps entity types to minimum confidence scores (0.0 to 1.0).
	// Use "ALL" as key to set a default threshold for all entity types.
	// Per-entity thresholds override the "ALL" key.
	// Example: {"ALL": "0.5", "EMAIL_ADDRESS": "0.8", "PHONE_NUMBER": "0.6"}
	// +optional
	ScoreThresholds map[string]string `json:"scoreThresholds,omitempty"`

	// EntityActions maps PII entity types to actions to take when detected.
	// Supported actions are "MASK" (redact the entity) and "BLOCK" (reject the request).
	// When omitted, detected entities are blocked by default.
	// The keys also determine which entity types are detected.
	// When omitted entirely, all supported entities are detected.
	// Example: {"EMAIL_ADDRESS": "MASK", "CREDIT_CARD": "BLOCK", "PHONE_NUMBER": "MASK"}
	// +optional
	EntityActions map[string]string `json:"entityActions,omitempty"`
}

type PresidioProviderConfig struct {
	// BaseUrl is the Presidio analyzer service endpoint.
	// +kubebuilder:validation:Format=uri
	BaseUrl string `json:"baseUrl"`

	// ApiKeySecretRef references the secret containing the API key for the Presidio service.
	// +optional
	ApiKeySecretRef *corev1.SecretKeySelector `json:"apiKeySecretRef,omitempty"`
}

type SubAgent struct {
	// Name is a descriptive identifier for this sub-agent connection
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// AgentRef references an Agent resource in the cluster.
	// When specified, the operator will resolve the Agent's service URL automatically.
	// Only Name and Namespace fields are used; other fields (Kind, APIVersion, etc.) are ignored.
	// If Namespace is not specified, defaults to the same namespace as the current Agent.
	// Mutually exclusive with Url - exactly one must be specified.
	// +optional
	AgentRef *corev1.ObjectReference `json:"agentRef,omitempty"`

	// Url is the HTTP/HTTPS endpoint URL for a remote agent outside the cluster.
	// It refers to the agent's well-known agent card URL, e.g. https://agent.example.com/.well-known/agent-card.json
	// Mutually exclusive with AgentRef - exactly one must be specified.
	// +optional
	// +kubebuilder:validation:Format=uri
	Url string `json:"url,omitempty"`

	// InteractionType specifies how the agent should interact with this sub-agent.
	// +optional
	// +kubebuilder:validation:Enum=transfer;tool_call
	// +kubebuilder:default="tool_call"
	InteractionType string `json:"interactionType,omitempty"`
}

type ToolFilter struct {
	// Allow is an allowlist of tool names and glob patterns.
	// If non-empty, only matching tools are exposed.
	// If empty or nil, all tools are candidates (subject to Deny).
	// +optional
	Allow []string `json:"allow,omitempty"`

	// Deny is a denylist of tool names and glob patterns.
	// Applied after Allow; Deny wins on conflict.
	// +optional
	Deny []string `json:"deny,omitempty"`
}

type ToolGateway struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ToolGatewaySpec   `json:"spec,omitempty"`
	Status ToolGatewayStatus `json:"status,omitempty"`
}

type ToolGatewayClass struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ToolGatewayClassSpec   `json:"spec,omitempty"`
	Status ToolGatewayClassStatus `json:"status,omitempty"`
}

type ToolGatewayClassList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ToolGatewayClass `json:"items"`
}

type ToolGatewayClassSpec struct {
	// Controller is the name of the controller that should handle this gateway class
	// +kubebuilder:validation:Required
	Controller string `json:"controller"`
}

type ToolGatewayClassStatus struct {
	// Conditions represent the latest available observations of the gateway class's state
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type ToolGatewayList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ToolGateway `json:"items"`
}

type ToolGatewaySpec struct {
	// ToolGatewayClassName specifies which ToolGatewayClass to use for this gateway instance.
	// This is only needed if multiple gateway classes are defined in the cluster.
	ToolGatewayClassName string `json:"toolGatewayClassName,omitempty"`

	// Environment variables to pass to the ToolGateway container.
	// These can include configuration values, credentials, or feature flags.
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// List of sources to populate environment variables in the ToolGateway container.
	// This allows loading variables from ConfigMaps and Secrets.
	// +optional
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`

	// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
	// resources created for this gateway, as well as the pod template.
	// +optional
	CommonMetadata *EmbeddedMetadata `json:"commonMetadata,omitempty"`

	// PodMetadata defines labels and annotations to be applied only to the pod template
	// of the Deployment created for this gateway.
	// +optional
	PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`

	// Guardrails lists the Guard resources to be applied to traffic through this tool gateway.
	// Guards are applied in the order they are listed.
	// +optional
	Guardrails []corev1.ObjectReference `json:"guardrails,omitempty"`
}

type ToolGatewayStatus struct {
	// Conditions represent the latest available observations of the gateway's state
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Url is the cluster-local URL where this tool gateway can be accessed
	// +optional
	Url string `json:"url,omitempty"`
}

type ToolRoute struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ToolRouteSpec   `json:"spec,omitempty"`
	Status ToolRouteStatus `json:"status,omitempty"`
}

type ToolRouteList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ToolRoute `json:"items"`
}

type ToolRouteSpec struct {
	// ToolGatewayRef identifies the ToolGateway hosting this route.
	// Namespace defaults to the ToolRoute's namespace if not specified.
	// If not specified, any installed tool-gateway operator may attempt to find the default ToolGateway in the cluster.
	// +optional
	ToolGatewayRef *corev1.ObjectReference `json:"toolGatewayRef,omitempty"`

	// Upstream specifies the MCP server this route proxies.
	// Exactly one of ToolServerRef or External must be set.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="(has(self.toolServerRef) ? 1 : 0) + (has(self.external) ? 1 : 0) == 1",message="exactly one of toolServerRef or external must be set"
	Upstream ToolRouteUpstream `json:"upstream"`

	// ToolFilter restricts which tools are exposed through this route.
	// If nil, all tools pass through unfiltered.
	// +optional
	ToolFilter *ToolFilter `json:"toolFilter,omitempty"`
}

type ToolRouteStatus struct {
	// Url is the reachable URL assigned by the gateway implementation.
	// Agents consume this URL verbatim.
	// +optional
	Url string `json:"url,omitempty"`

	// Conditions represent the latest available observations of the route's state.
	// Known condition types: Accepted, Ready, ResolutionFailed.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`
}

type ToolRouteUpstream struct {
	// ToolServerRef references a cluster-local ToolServer.
	// Namespace defaults to the ToolRoute's namespace if not specified.
	// Mutually exclusive with External.
	// +optional
	ToolServerRef *corev1.ObjectReference `json:"toolServerRef,omitempty"`

	// External describes a remote MCP server reachable at an HTTP URL.
	// Mutually exclusive with ToolServerRef.
	// +optional
	External *ExternalUpstream `json:"external,omitempty"`
}

type ToolServer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ToolServerSpec   `json:"spec,omitempty"`
	Status ToolServerStatus `json:"status,omitempty"`
}

type ToolServerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ToolServer `json:"items"`
}

type ToolServerSpec struct {
	// Protocol defines the tool server protocol (e.g., "mcp" for Model Context Protocol)
	// +kubebuilder:validation:Enum=mcp
	// +kubebuilder:default=mcp
	Protocol string `json:"protocol"`

	// TransportType defines how the tool server communicates
	// - http: HTTP transport with standalone deployment and service
	// - sse: Server-Sent Events transport with standalone deployment and service
	// +kubebuilder:validation:Enum=http;sse
	// +kubebuilder:default=http
	TransportType string `json:"transportType"`

	// Image is the container image for the tool server
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image"`

	// ImagePullSecrets is a list of references to secrets for pulling the tool server container image.
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`

	// Command overrides the container's ENTRYPOINT.
	// If not specified, the container image's ENTRYPOINT is used.
	// Follows the same semantics as Kubernetes Pod containers.
	// +optional
	Command []string `json:"command,omitempty"`

	// Args overrides the container's CMD.
	// If not specified, the container image's CMD is used.
	// Follows the same semantics as Kubernetes Pod containers.
	// +optional
	Args []string `json:"args,omitempty"`

	// Port is the port number for http/sse transports
	// Required for http and sse transports
	// +optional
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:validation:Maximum=65535
	Port int32 `json:"port,omitempty"`

	// Path is the URL path for http/sse transports
	// Defaults to "/mcp" for http and "/sse" for sse if not specified
	// Must start with "/" if specified
	// +optional
	// +kubebuilder:validation:Pattern=`^/.*`
	Path string `json:"path,omitempty"`

	// Replicas is the number of replicas for http/sse transports
	// Only applicable for http and sse transports
	// +optional
	// +kubebuilder:validation:Minimum=0
	Replicas *int32 `json:"replicas,omitempty"`

	// Env defines additional environment variables to be injected into the tool server container
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`

	// EnvFrom defines sources to populate environment variables from
	// +optional
	EnvFrom []corev1.EnvFromSource `json:"envFrom,omitempty"`

	// Resources defines the compute resource requirements for the tool server container.
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// CommonMetadata defines labels and annotations to be applied to the Deployment and Service
	// resources created for this tool server, as well as the pod template.
	// +optional
	CommonMetadata *EmbeddedMetadata `json:"commonMetadata,omitempty"`

	// PodMetadata defines labels and annotations to be applied only to the pod template
	// of the Deployment created for this tool server.
	// +optional
	PodMetadata *EmbeddedMetadata `json:"podMetadata,omitempty"`
}

type ToolServerStatus struct {
	Conditions []metav1.Condition `json:"conditions,omitempty" patchStrategy:"merge" patchMergeKey:"type" protobuf:"bytes,1,rep,name=conditions"`

	// Url is the cluster-local URL where this tool server can be accessed
	// Only populated for http and sse transports
	// Format: http://{name}.{namespace}.svc.cluster.local:{port}{path}
	// +optional
	Url string `json:"url,omitempty"`
}

type TransitiveAgent struct {
	// Name is a descriptive identifier for this transitive agent connection
	Name string `json:"name"`

	// Namespace specifies the Kubernetes namespace where the agent resides.
	// Only used for cluster agents (when Url is not specified).
	// For remote agents accessed via Url, this field should be omitted.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Url is the HTTP/HTTPS endpoint URL for a remote agent outside the cluster.
	// It refers to the agent's well-known agent card URL, e.g. https://agent.example.com/.well-known/agent-card.json
	// +optional
	// +kubebuilder:validation:Format=uri
	Url string `json:"url,omitempty"`
}