v1

type AgentCatalog struct {
	metav1.TypeMeta `json:",inline"`

	// Spec holds the catalog configuration.
	// +required
	Spec AgentCatalogSpec `json:"spec"`

	// Status holds the catalog status.
	// +optional
	Status AgentCatalogStatus `json:"status,omitempty"`
}

type AgentCatalogInventoryEntry struct {
	// ID is the Adler-32 checksum of the source repository URL.
	// +required
	ID string `json:"id"`

	// URL is the OCI artifact URL including tag.
	// +required
	URL string `json:"url"`

	// Digest is the OCI artifact digest.
	// +required
	Digest string `json:"digest"`

	// LastUpdateAt is the timestamp of the last update.
	// +required
	LastUpdateAt string `json:"lastUpdateAt"`

	// Annotations holds the OCI artifact manifest annotations.
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Skills is the list of skills provided by this source.
	// +optional
	Skills []AgentCatalogSkill `json:"skills,omitempty"`
}

type AgentCatalogSkill struct {
	// Name is the skill name.
	// +required
	Name string `json:"name"`

	// Checksum is the directory hash of the installed skill contents.
	// +required
	Checksum string `json:"checksum"`
}

type AgentCatalogSource struct {
	// Repository is the OCI repository URL.
	// +required
	Repository string `json:"repository"`

	// Tag is the OCI artifact tag.
	// +required
	Tag string `json:"tag"`

	// Verify holds the signature verification configuration.
	// +optional
	Verify *AgentCatalogVerify `json:"verify,omitempty"`

	// TargetAgents is the list of agent IDs for which skill symlinks are managed.
	// +optional
	TargetAgents []string `json:"targetAgents,omitempty"`

	// TargetSkills is the list of skill names to install from this source.
	// When empty, all skills from the artifact are installed.
	// +optional
	TargetSkills []string `json:"targetSkills,omitempty"`
}

type AgentCatalogSpec struct {
	// Sources is the list of OCI repositories providing skills.
	// +optional
	Sources []AgentCatalogSource `json:"sources,omitempty"`
}

type AgentCatalogStatus struct {
	// Inventory is the list of installed skill sources.
	// +optional
	Inventory []AgentCatalogInventoryEntry `json:"inventory,omitempty"`
}

type AgentCatalogVerify struct {
	// Provider is the verification provider (e.g. "cosign").
	// +required
	Provider string `json:"provider"`

	// MatchOIDCIdentity is the list of OIDC identity matchers.
	// +optional
	MatchOIDCIdentity []OIDCIdentity `json:"matchOIDCIdentity,omitempty"`
}

type AnonymousAuthenticationSpec struct {
	// Username is used for Kubernetes User RBAC impersonation.
	// +optional
	Username string `json:"username"`

	// Groups is used for Kubernetes Group RBAC impersonation.
	// +optional
	Groups []string `json:"groups"`
}

type AuthenticationSpec struct {
	// Type is the authentication type.
	// +kubebuilder:validation:Enum=Anonymous;OAuth2
	// +required
	Type string `json:"type"`

	// Anonymous holds the Anonymous authentication configuration.
	// +optional
	Anonymous *AnonymousAuthenticationSpec `json:"anonymous"`

	// OAuth2 holds the OAuth2 authentication configuration.
	// +optional
	OAuth2 *OAuth2AuthenticationSpec `json:"oauth2"`

	// SessionDuration is the duration of the user session.
	// Defaults to one week.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +optional
	SessionDuration *metav1.Duration `json:"sessionDuration"`

	// UserCacheSize is the size of the user cache in number of users.
	// Defaults to 100.
	// +optional
	UserCacheSize int `json:"userCacheSize"`
}

type ClaimsProcessorSpec struct {
	// Variables is a list of CEL expressions to extract information from the ID token claims
	// into named variables that can be reused in other expressions, e.g. "variables.username".
	// +optional
	Variables []VariableSpec `json:"variables"`

	// Validations is a list of CEL expressions that validate the ID token claims and extracted
	// variables. Each expression must return the type bool. If the expression evaluates to false,
	// the message is returned as an error.
	// +optional
	Validations []ValidationSpec `json:"validations"`

	// Profile contains CEL expressions to extract user profile information from the ID token
	// claims and extracted variables for populating the user profile.
	// Defaults to ProfileSpec{
	//   Name:  "has(claims.name) ? claims.name : (has(claims.email) ? claims.email : ”)",
	// }
	// +optional
	Profile *ProfileSpec `json:"profile"`

	// Impersonation is a pair of CEL expressions that extract the username and groups
	// from the ID token claims and extracted variables for Kubernetes RBAC impersonation.
	// The username expression must return the type string, while the groups expression
	// must return the type []string.
	// Defaults to ImpersonationSpec{
	//   Username: "has(claims.email) ? claims.email : ”",
	//   Groups:   "has(claims.groups) ? claims.groups : []",
	// }
	// +optional
	Impersonation *ImpersonationSpec `json:"impersonation"`
}

type Cluster struct {
	// Domain is the cluster domain used for generating the FQDN of services.
	// Defaults to 'cluster.local'.
	// +kubebuilder:default:=cluster.local
	// +optional
	Domain string `json:"domain,omitempty"`

	// Multitenant enables the multitenancy lockdown. Defaults to false.
	// +kubebuilder:default:=false
	// +optional
	Multitenant bool `json:"multitenant,omitempty"`

	// MultitenantWorkloadIdentity enables the multitenancy lockdown for
	// workload identity. Defaults to false.
	// +kubebuilder:default:=false
	// +optional
	MultitenantWorkloadIdentity bool `json:"multitenantWorkloadIdentity,omitempty"`

	// TenantDefaultServiceAccount is the name of the service account
	// to use as default when the multitenant lockdown is enabled, for
	// kustomize-controller and helm-controller.
	// This field will also be used for multitenant workload identity
	// lockdown for source-controller, notification-controller,
	// image-reflector-controller and image-automation-controller.
	// Defaults to the 'default' service account from the tenant namespace.
	// +optional
	TenantDefaultServiceAccount string `json:"tenantDefaultServiceAccount,omitempty"`

	// TenantDefaultDecryptionServiceAccount is the name of the service account
	// to use as default for kustomize-controller SOPS decryption when the
	// multitenant lockdown for workload identity is enabled. Defaults to the
	// 'default' service account from the tenant namespace.
	// +optional
	TenantDefaultDecryptionServiceAccount string `json:"tenantDefaultDecryptionServiceAccount,omitempty"`

	// TenantDefaultKubeConfigServiceAccount is the name of the service account
	// to use as default for kustomize-controller and helm-controller remote
	// cluster access via spec.kubeConfig.configMapRef when the multitenant
	// lockdown for workload identity is enabled. Defaults to the 'default'
	// service account from the tenant namespace.
	// +optional
	TenantDefaultKubeConfigServiceAccount string `json:"tenantDefaultKubeConfigServiceAccount,omitempty"`

	// ObjectLevelWorkloadIdentity enables the feature gate
	// required for object-level workload identity.
	// This feature is only available in Flux v2.6.0 and later.
	// +optional
	ObjectLevelWorkloadIdentity bool `json:"objectLevelWorkloadIdentity,omitempty"`

	// NetworkPolicy restricts network access to the current namespace.
	// Defaults to true.
	// +kubebuilder:default:=true
	// +optional
	NetworkPolicy bool `json:"networkPolicy"`

	// Type specifies the distro of the Kubernetes cluster.
	// Defaults to 'kubernetes'.
	// +kubebuilder:validation:Enum:=kubernetes;openshift;aws;azure;gcp
	// +kubebuilder:default:=kubernetes
	// +optional
	Type string `json:"type,omitempty"`

	// Size defines the vertical scaling profile of the Flux controllers.
	// The size is used to determine the concurrency and CPU/Memory limits for the Flux controllers.
	// Accepted values are: 'small', 'medium' and 'large'.
	// +kubebuilder:validation:Enum:=small;medium;large
	// +optional
	Size string `json:"size,omitempty"`
}

type ClusterInfo struct {
	// ServerVersion is the version of the Kubernetes API server.
	// +required
	ServerVersion string `json:"serverVersion"`

	// Platform is the os/arch of the Kubernetes control plane.
	// +required
	Platform string `json:"platform"`

	// Nodes is the number of nodes in the Kubernetes cluster.
	// +optional
	Nodes int `json:"nodes,omitempty"`
}

type CommonMetadata struct {
	// Annotations to be added to the object's metadata.
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`

	// Labels to be added to the object's metadata.
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
}

type Component string

type ComponentImage struct {
	// Name of the component.
	// +required
	Name string `json:"name"`

	// Repository address of the container image.
	// +required
	Repository string `json:"repository"`

	// Tag of the container image.
	// +required
	Tag string `json:"tag"`

	// Digest of the container image.
	// +optional
	Digest string `json:"digest,omitempty"`
}

type Dependency struct {
	// APIVersion of the resource to depend on.
	// +required
	APIVersion string `json:"apiVersion"`

	// Kind of the resource to depend on.
	// +required
	Kind string `json:"kind"`

	// Name of the resource to depend on.
	// +required
	Name string `json:"name"`

	// Namespace of the resource to depend on.
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// Ready checks if the resource Ready status condition is true.
	// +optional
	Ready bool `json:"ready,omitempty"`

	// ReadyExpr checks if the resource satisfies the given CEL expression.
	// The expression replaces the default readiness check and
	// is only evaluated if Ready is set to 'true'.
	// +optional
	ReadyExpr string `json:"readyExpr,omitempty"`
}

type Distribution struct {
	// Version semver expression e.g. '2.x', '2.3.x'.
	// +required
	Version string `json:"version"`

	// Registry address to pull the distribution images from
	// e.g. 'ghcr.io/fluxcd'.
	// +required
	Registry string `json:"registry"`

	// Variant specifies the Flux distribution flavor stored
	// in the registry.
	// +kubebuilder:validation:Enum=upstream-alpine;enterprise-alpine;enterprise-distroless;enterprise-distroless-fips
	// +optional
	Variant string `json:"variant,omitempty"`

	// ImagePullSecret is the name of the Kubernetes secret
	// to use for pulling images.
	// +optional
	ImagePullSecret string `json:"imagePullSecret,omitempty"`

	// Artifact is the URL to the OCI artifact containing
	// the latest Kubernetes manifests for the distribution,
	// e.g. 'oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests:latest'.
	// +kubebuilder:validation:Pattern="^oci://.*$"
	// +optional
	Artifact string `json:"artifact,omitempty"`

	// ArtifactPullSecret is the name of the Kubernetes secret
	// to use for pulling the Kubernetes manifests for the distribution specified in the Artifact field.
	// +optional
	ArtifactPullSecret string `json:"artifactPullSecret,omitempty"`
}

type FluxComponentStatus struct {
	// Name is the name of the Flux component.
	// +required
	Name string `json:"name"`

	// Ready is the readiness status of the Flux component.
	// +required
	Ready bool `json:"ready"`

	// Status is a human-readable message indicating details
	// about the Flux component observed state.
	// +required
	Status string `json:"status"`

	// Image is the container image of the Flux component.
	// +required
	Image string `json:"image"`
}

type FluxDistributionStatus struct {
	// Entitlement is the entitlement verification status.
	// +required
	Entitlement string `json:"entitlement"`

	// Status is a human-readable message indicating details
	// about the distribution observed state.
	// +required
	Status string `json:"status"`

	// Version is the version of the Flux instance.
	// +optional
	Version string `json:"version,omitempty"`

	// ManagedBy is the name of the operator managing the Flux instance.
	// +optional
	ManagedBy string `json:"managedBy,omitempty"`
}

type FluxInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FluxInstanceSpec   `json:"spec,omitempty"`
	Status FluxInstanceStatus `json:"status,omitempty"`
}

type FluxInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FluxInstance `json:"items"`
}

type FluxInstanceSpec struct {
	// Distribution specifies the version and container registry to pull images from.
	// +required
	Distribution Distribution `json:"distribution"`

	// Components is the list of controllers to install.
	// Defaults to the core Flux controllers:
	//   - source-controller
	//   - kustomize-controller
	//   - helm-controller
	//   - notification-controller
	// +optional
	Components []Component `json:"components,omitempty"`

	// CommonMetadata specifies the common labels and annotations that are
	// applied to all resources. Any existing label or annotation will be
	// overridden if its key matches a common one.
	// +optional
	CommonMetadata *CommonMetadata `json:"commonMetadata,omitempty"`

	// Cluster holds the specification of the Kubernetes cluster.
	// +optional
	Cluster *Cluster `json:"cluster,omitempty"`

	// Sharding holds the specification of the sharding configuration.
	// +optional
	Sharding *Sharding `json:"sharding,omitempty"`

	// Storage holds the specification of the source-controller
	// persistent volume claim.
	// +optional
	Storage *Storage `json:"storage,omitempty"`

	// Kustomize holds a set of patches that can be applied to the
	// Flux installation, to customize the way Flux operates.
	// +optional
	Kustomize *Kustomize `json:"kustomize,omitempty"`

	// Wait instructs the controller to check the health of all the reconciled
	// resources. Defaults to true.
	// +kubebuilder:default:=true
	// +optional
	Wait *bool `json:"wait,omitempty"`

	// MigrateResources instructs the controller to migrate the Flux custom resources
	// from the previous version to the latest API version specified in the CRD.
	// Defaults to true.
	// +kubebuilder:default:=true
	// +optional
	MigrateResources *bool `json:"migrateResources,omitempty"`

	// Sync specifies the source for the cluster sync operation.
	// When set, a Flux source (GitRepository, OCIRepository or Bucket)
	// and Flux Kustomization are created to sync the cluster state
	// with the source repository.
	// +optional
	Sync *Sync `json:"sync,omitempty"`
}

type FluxInstanceStatus struct {
	meta.ReconcileRequestStatus `json:",inline"`
	meta.ForceRequestStatus     `json:",inline"`

	// Conditions contains the readiness conditions of the object.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// LastAttemptedRevision is the version and digest of the
	// distribution config that was last attempted to reconcile.
	// +optional
	LastAttemptedRevision string `json:"lastAttemptedRevision,omitempty"`

	// LastAppliedRevision is the version and digest of the
	// distribution config that was last reconcile.
	// +optional
	LastAppliedRevision string `json:"lastAppliedRevision,omitempty"`

	// LastArtifactRevision is the digest of the last pulled
	// distribution artifact.
	// +optional
	LastArtifactRevision string `json:"lastArtifactRevision,omitempty"`

	// Components contains the container images used by the components.
	// +optional
	Components []ComponentImage `json:"components,omitempty"`

	// Inventory contains a list of Kubernetes resource object references
	// last applied on the cluster.
	// +optional
	Inventory *ResourceInventory `json:"inventory,omitempty"`

	// History contains the reconciliation history of the FluxInstance
	// as a list of snapshots ordered by the last reconciled time.
	History History `json:"history,omitempty"`
}

type FluxKindInfo struct {
	// Name is the singular name of the resource kind.
	Name string

	// Plural is the plural name of the resource kind used for RBAC.
	Plural string

	// ShortName is a short alias for the resource kind.
	ShortName string

	// Reconcilable indicates if the resource kind supports reconciliation operations.
	Reconcilable bool
}

type FluxObject interface {
	client.Object

	// GetConditions returns a slice of metav1.Condition.
	GetConditions() []metav1.Condition

	// SetConditions sets the status conditions on the object.
	SetConditions([]metav1.Condition)

	// SetLastHandledReconcileAt sets the last handled reconcile time in the status.
	SetLastHandledReconcileAt(value string)

	// IsDisabled returns true if the object has the reconcile annotation set to 'disabled'.
	IsDisabled() bool

	// GetInterval returns the interval at which the object should be reconciled.
	GetInterval() time.Duration
}

type FluxReconcilerStats struct {
	// Running is the number of reconciled
	// resources in the Running state.
	// +required
	Running int `json:"running"`

	// Failing is the number of reconciled
	// resources in the Failing state and not Suspended.
	// +required
	Failing int `json:"failing"`

	// Suspended is the number of reconciled
	// resources in the Suspended state.
	// +required
	Suspended int `json:"suspended"`

	// TotalSize is the total size of the artifacts in storage.
	// +optional
	TotalSize string `json:"totalSize,omitempty"`
}

type FluxReconcilerStatus struct {
	// APIVersion is the API version of the Flux resource.
	// +required
	APIVersion string `json:"apiVersion"`

	// Kind is the kind of the Flux resource.
	// +required
	Kind string `json:"kind"`

	// Stats is the reconcile statics of the Flux resource kind.
	// +optional
	Stats FluxReconcilerStats `json:"stats,omitempty"`
}

type FluxReport struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   FluxReportSpec   `json:"spec,omitempty"`
	Status FluxReportStatus `json:"status,omitempty"`
}

type FluxReportList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []FluxReport `json:"items"`
}

type FluxReportSpec struct {
	// Distribution is the version information of the Flux installation.
	// +required
	Distribution FluxDistributionStatus `json:"distribution"`

	// Cluster is the version information of the Kubernetes cluster.
	// +optional
	Cluster *ClusterInfo `json:"cluster,omitempty"`

	// Operator is the version information of the Flux Operator.
	// +optional
	Operator *OperatorInfo `json:"operator,omitempty"`

	// ComponentsStatus is the status of the Flux controller deployments.
	// +optional
	ComponentsStatus []FluxComponentStatus `json:"components,omitempty"`

	// ReconcilersStatus is the list of Flux reconcilers and
	// their statistics grouped by API kind.
	// +optional
	ReconcilersStatus []FluxReconcilerStatus `json:"reconcilers,omitempty"`

	// SyncStatus is the status of the cluster sync
	// Source and Kustomization resources.
	// +optional
	SyncStatus *FluxSyncStatus `json:"sync,omitempty"`
}

type FluxReportStatus struct {
	meta.ReconcileRequestStatus `json:",inline"`

	// Conditions contains the readiness conditions of the object.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type FluxSyncStatus struct {
	// ID is the identifier of the sync.
	// +required
	ID string `json:"id"`

	// Path is the kustomize path of the sync.
	// +optional
	Path string `json:"path,omitempty"`

	// Ready is the readiness status of the sync.
	// +required
	Ready bool `json:"ready"`

	// Status is a human-readable message indicating details
	// about the sync observed state.
	// +required
	Status string `json:"status"`

	// Source is the URL of the source repository.
	// +optional
	Source string `json:"source,omitempty"`
}

type History []Snapshot

type ImpersonationSpec struct {
	// Username is a CEL expression that extracts the username from the ID token claims
	// and extracted variables. This expression must return the type string.
	// Defaults to "has(claims.email) ? claims.email : ”".
	// +optional
	Username string `json:"username"`

	// Groups is a CEL expression that extracts the groups from the ID token claims
	// and extracted variables. This expression must return the type []string.
	// Defaults to "has(claims.groups) ? claims.groups : []".
	// +optional
	Groups string `json:"groups"`
}

type InputProvider interface {
	GetInputs() ([]map[string]any, error)
	GetNamespace() string
	GetName() string
	GroupVersionKind() schema.GroupVersionKind
}

type InputProviderReference struct {
	// APIVersion of the input provider resource.
	// When not set, the APIVersion of the ResourceSet is used.
	// +kubebuilder:validation:Enum=fluxcd.controlplane.io/v1
	// +optional
	APIVersion string `json:"apiVersion,omitempty"`

	// Kind of the input provider resource.
	// +kubebuilder:validation:Enum=ResourceSetInputProvider
	// +optional
	Kind string `json:"kind,omitempty"`

	// Name of the input provider resource. Cannot be set
	// when the Selector field is set.
	// +optional
	Name string `json:"name,omitempty"`

	// Selector is a label selector to filter the input provider resources
	// as an alternative to the Name field.
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type InputStrategySpec struct {
	// Name defines how the inputs are combined when multiple
	// input provider objects are used. Supported values are:
	// - Flatten: all inputs sets from all input provider objects are
	//   flattened into a single list of input sets.
	// - Permute: all inputs sets from all input provider objects are
	//   combined using a Cartesian product, resulting in a list of input sets
	//   that contains every possible combination of input values.
	//   For example, if provider A has inputs [{x: 1}, {x: 2}] and provider B has
	//   inputs [{y: "a"}, {y: "b"}], the resulting input sets will be:
	//   [{x: 1, y: "a"}, {x: 1, y: "b"}, {x: 2, y: "a"}, {x: 2, y: "b"}].
	//   This strategy can lead to a large number of input sets and should be
	//   used with caution. Users should use filtering features from
	//   ResourceSetInputProvider to limit the amount of exported inputs.
	// +kubebuilder:validation:Enum=Flatten;Permute
	// +required
	Name string `json:"name,omitempty"`

	// IncludeEmptyProviders controls how input providers that export no
	// inputs are treated. Only applies when Name is Permute. When true, if
	// any provider has zero inputs the resulting permutation set is empty
	// (mathematically correct Cartesian product behavior). When false or
	// unset (default), providers with zero inputs are silently skipped and
	// the remaining providers still permute among themselves.
	// +optional
	IncludeEmptyProviders bool `json:"includeEmptyProviders,omitempty"`
}

type Kustomize struct {
	// Strategic merge and JSON patches, defined as inline YAML objects,
	// capable of targeting objects based on kind, label and annotation selectors.
	// +optional
	Patches []kustomize.Patch `json:"patches,omitempty"`
}

type NextSchedule struct {
	// Schedule has the configuration of the next schedule.
	Schedule `json:",inline"`

	// When is the next time the schedule will run.
	// +required
	When metav1.Time `json:"when"`
}

type OAuth2AuthenticationSpec struct {
	// Provider is the OAuth2 provider name.
	// +kubebuilder:validation:Enum=OIDC
	// +required
	Provider string `json:"provider"`

	// ClientID is the OAuth2 client identifier.
	// +required
	ClientID string `json:"clientID"`

	// ClientSecret is the OAuth2 client secret.
	// +required
	ClientSecret string `json:"clientSecret"`

	// Scopes is the list of OAuth2 scopes to request.
	// Each provider may have different default scopes.
	// +optional
	Scopes []string `json:"scopes"`

	// AuthURLParams is a map of additional query parameters
	// to include in the authorization URL when redirecting
	// the user to the OAuth2 provider for authentication.
	// This can be used to set provider-specific parameters,
	// such as "access_type=offline" and "prompt=consent".
	// +optional
	AuthURLParams map[string]string `json:"authURLParams"`

	// AutoLogin redirects unauthenticated users straight to the OAuth2
	// provider instead of showing the login page. Default: false.
	// +optional
	AutoLogin bool `json:"autoLogin,omitempty"`

	// IssuerURL is used for OIDC provider discovery.
	// Required for the OIDC provider.
	// Used only by the OIDC provider.
	// +optional
	IssuerURL string `json:"issuerURL"`

	// ClaimsProcessorSpec holds the configuration for processing claims with CEL expressions.
	// Used only by the OIDC provider.
	// +optional
	ClaimsProcessorSpec `json:",inline"`
}

type OIDCIdentity struct {
	// Issuer is the OIDC issuer URL.
	// +required
	Issuer string `json:"issuer"`

	// Subject is the OIDC subject regexp.
	// +required
	Subject string `json:"subject"`
}

type OperatorInfo struct {
	// APIVersion is the API version of the Flux Operator.
	// +required
	APIVersion string `json:"apiVersion"`

	// Version is the version number of Flux Operator.
	// +required
	Version string `json:"version"`

	// Platform is the os/arch of Flux Operator.
	// +required
	Platform string `json:"platform"`
}

type ProfileSpec struct {
	// Name is a CEL expression that extracts the user's full name from the ID token claims
	// and extracted variables. This expression must return the type string.
	// Defaults to "has(claims.name) ? claims.name : (has(claims.email) ? claims.email : ”)".
	// +optional
	Name string `json:"name"`
}

type ResourceInventory struct {
	// Entries of Kubernetes resource object references.
	Entries []ResourceRef `json:"entries"`
}

type ResourceRef struct {
	// ID is the string representation of the Kubernetes resource object's metadata,
	// in the format '<namespace>_<name>_<group>_<kind>'.
	ID string `json:"id"`

	// Version is the API version of the Kubernetes resource object's kind.
	Version string `json:"v"`
}

type ResourceSet struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ResourceSetSpec   `json:"spec,omitempty"`
	Status ResourceSetStatus `json:"status,omitempty"`
}

type ResourceSetInput map[string]*apiextensionsv1.JSON

type ResourceSetInputFilter struct {
	// IncludeBranch specifies the regular expression to filter the branches
	// that the input provider should include.
	// +optional
	IncludeBranch string `json:"includeBranch,omitempty"`

	// ExcludeBranch specifies the regular expression to filter the branches
	// that the input provider should exclude.
	// +optional
	ExcludeBranch string `json:"excludeBranch,omitempty"`

	// IncludeTag specifies the regular expression to filter the tags
	// that the input provider should include.
	// +optional
	IncludeTag string `json:"includeTag,omitempty"`

	// ExcludeTag specifies the regular expression to filter the tags
	// that the input provider should exclude.
	// +optional
	ExcludeTag string `json:"excludeTag,omitempty"`

	// IncludeEnvironment specifies the regular expression to filter the environments
	// that the input provider should include.
	// +optional
	IncludeEnvironment string `json:"includeEnvironment,omitempty"`

	// ExcludeEnvironment specifies the regular expression to filter the environments
	// that the input provider should exclude.
	// +optional
	ExcludeEnvironment string `json:"excludeEnvironment,omitempty"`

	// Labels specifies the list of labels to filter the input provider response.
	// +optional
	Labels []string `json:"labels,omitempty"`

	// Limit specifies the maximum number of input sets to return.
	// When not set, the default limit is 100.
	// +kubebuilder:default:=100
	// +optional
	Limit int `json:"limit,omitempty"`

	// Semver specifies a semantic version range to filter and sort the tags.
	// If this field is not specified, the tags will be sorted in reverse
	// alphabetical order.
	// Supported only for tags at the moment.
	// +optional
	Semver string `json:"semver,omitempty"`
}

type ResourceSetInputProvider struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ResourceSetInputProviderSpec   `json:"spec,omitempty"`
	Status ResourceSetInputProviderStatus `json:"status,omitempty"`
}

type ResourceSetInputProviderList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ResourceSetInputProvider `json:"items"`
}

type ResourceSetInputProviderSpec struct {
	// Type specifies the type of the input provider.
	// +kubebuilder:validation:Enum=Static;GitHubBranch;GitHubTag;GitHubPullRequest;GitLabBranch;GitLabTag;GitLabMergeRequest;GitLabEnvironment;AzureDevOpsBranch;AzureDevOpsTag;AzureDevOpsPullRequest;AWSCodeCommitBranch;AWSCodeCommitTag;AWSCodeCommitPullRequest;GiteaBranch;GiteaTag;GiteaPullRequest;OCIArtifactTag;ACRArtifactTag;ECRArtifactTag;GARArtifactTag;ExternalService
	// +required
	Type string `json:"type"`

	// URL specifies the HTTP/S or OCI address of the input provider API.
	// When connecting to a Git provider, the URL should point to the repository address.
	// When connecting to an OCI provider, the URL should point to the OCI repository address.
	// +kubebuilder:validation:Pattern="^((http|https|oci)://.*){0,1}$"
	// +optional
	URL string `json:"url,omitempty"`

	// ServiceAccountName specifies the name of the Kubernetes ServiceAccount
	// used for authentication with AWS, Azure or GCP services through
	// workload identity federation features. If not specified, the
	// authentication for these cloud providers will use the ServiceAccount
	// of the operator (or any other environment authentication configuration).
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// SecretRef specifies the Kubernetes Secret containing the credentials
	// to access the input provider.
	// When connecting to a Git provider, the secret must contain the keys
	// 'username' and 'password', and the password should be a personal access token
	// that grants read-only access to the repository.
	// When connecting to an OCI provider, the secret must contain a Kubernetes
	// Image Pull Secret, as if created by `kubectl create secret docker-registry`.
	// When connecting to an ExternalService provider, the secret must contain either
	// a 'token' key for bearer token authentication, or 'username' and 'password'
	// keys for basic authentication.
	// +optional
	SecretRef *meta.LocalObjectReference `json:"secretRef,omitempty"`

	// CertSecretRef specifies the Kubernetes Secret containing either or both of
	//
	// - a PEM-encoded CA certificate (`ca.crt`)
	// - a PEM-encoded client certificate (`tls.crt`) and private key (`tls.key`)
	//
	// When connecting to a Git, OCI, or ExternalService provider that uses self-signed certificates,
	// the CA certificate must be set in the Secret under the 'ca.crt' key to establish the trust relationship.
	// When connecting to a provider that supports client certificates (mTLS), the client certificate
	// and private key must be set in the Secret under the 'tls.crt' and 'tls.key' keys, respectively.
	// +optional
	CertSecretRef *meta.LocalObjectReference `json:"certSecretRef,omitempty"`

	// Insecure allows connecting to an ExternalService or OCIArtifactTag provider
	// over plain HTTP without TLS. When not set, the URL must use HTTPS.
	// +optional
	Insecure bool `json:"insecure,omitempty"`

	// DefaultValues contains the default values for the inputs.
	// These values are used to populate the inputs when the provider
	// response does not contain them.
	// +optional
	DefaultValues ResourceSetInput `json:"defaultValues,omitempty"`

	// Filter defines the filter to apply to the input provider response.
	// +optional
	Filter *ResourceSetInputFilter `json:"filter,omitempty"`

	// Skip defines whether we need to skip input provider response updates.
	// +optional
	Skip *ResourceSetInputSkip `json:"skip,omitempty"`

	// Schedule defines the schedules for the input provider to run.
	// +optional
	Schedule []Schedule `json:"schedule,omitempty"`
}

type ResourceSetInputProviderStatus struct {
	meta.ReconcileRequestStatus `json:",inline"`
	meta.ForceRequestStatus     `json:",inline"`

	// Conditions contains the readiness conditions of the object.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ExportedInputs contains the list of inputs exported by the provider.
	// +optional
	ExportedInputs []ResourceSetInput `json:"exportedInputs,omitempty"`

	// LastExportedRevision is the digest of the
	// inputs that were last reconcile.
	// +optional
	LastExportedRevision string `json:"lastExportedRevision,omitempty"`

	// NextSchedule is the next schedule when the input provider will run.
	// +optional
	NextSchedule *NextSchedule `json:"nextSchedule,omitempty"`
}

type ResourceSetInputSkip struct {
	// Labels specifies list of labels to skip input provider response when any of the label conditions matched.
	// When prefixed with !, input provider response will be skipped if it does not have this label.
	// +optional
	Labels []string `json:"labels,omitempty"`
}

type ResourceSetList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ResourceSet `json:"items"`
}

type ResourceSetSpec struct {
	// CommonMetadata specifies the common labels and annotations that are
	// applied to all resources. Any existing label or annotation will be
	// overridden if its key matches a common one.
	// +optional
	CommonMetadata *CommonMetadata `json:"commonMetadata,omitempty"`

	// InputStrategy defines how the inputs are combined when multiple
	// input provider objects are used. Defaults to flattening all inputs
	// from all providers into a single list of input sets.
	// +optional
	InputStrategy *InputStrategySpec `json:"inputStrategy,omitempty"`

	// Inputs contains the list of ResourceSet inputs.
	// +optional
	Inputs []ResourceSetInput `json:"inputs,omitempty"`

	// InputsFrom contains the list of references to input providers.
	// When set, the inputs are fetched from the providers and concatenated
	// with the in-line inputs defined in the ResourceSet.
	// +optional
	InputsFrom []InputProviderReference `json:"inputsFrom,omitempty"`

	// Resources contains the list of Kubernetes resources to reconcile.
	// +kubebuilder:validation:items:Type=object
	// +optional
	Resources []*apiextensionsv1.JSON `json:"resources,omitempty"`

	// ResourcesTemplate is a Go template that generates the list of
	// Kubernetes resources to reconcile. The template is rendered
	// as multi-document YAML, the resources should be separated by '---'.
	// When both Resources and ResourcesTemplate are set, the resulting
	// objects are merged and deduplicated, with the ones from Resources taking precedence.
	// +optional
	ResourcesTemplate string `json:"resourcesTemplate,omitempty"`

	// Steps contains an ordered list of named steps to reconcile in sequence.
	// Each step's resources are applied and health-checked before the next
	// step starts. Mutually exclusive with Resources and ResourcesTemplate.
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:validation:MaxItems=20
	// +kubebuilder:validation:XValidation:rule="self.all(s, self.exists_one(t, t.name == s.name))",message="step names must be unique"
	// +optional
	Steps []ResourceSetStep `json:"steps,omitempty"`

	// DependsOn specifies the list of Kubernetes resources that must
	// exist on the cluster before the reconciliation process starts.
	// +optional
	DependsOn []Dependency `json:"dependsOn,omitempty"`

	// The name of the Kubernetes service account to impersonate
	// when reconciling the generated resources.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// Wait instructs the controller to check the health
	// of all the reconciled resources.
	// +optional
	Wait bool `json:"wait,omitempty"`
}

type ResourceSetStatus struct {
	meta.ReconcileRequestStatus `json:",inline"`

	// Conditions contains the readiness conditions of the object.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Inventory contains a list of Kubernetes resource object references
	// last applied on the cluster.
	// +optional
	Inventory *ResourceInventory `json:"inventory,omitempty"`

	// LastAppliedRevision is the digest of the
	// generated resources that were last reconcile.
	// +optional
	LastAppliedRevision string `json:"lastAppliedRevision,omitempty"`

	// ExternalChecksumRefs lists the ConfigMap and Secret references
	// discovered in checksumFrom annotations on the last reconciliation
	// that point to objects not rendered by this ResourceSet. Each entry
	// has the form "Kind/namespace/name". It is used to trigger a
	// reconciliation when one of the referenced objects changes.
	// +optional
	ExternalChecksumRefs []string `json:"externalChecksumRefs,omitempty"`

	// History contains the reconciliation history of the ResourceSet
	// as a list of snapshots ordered by the last reconciled time.
	History History `json:"history,omitempty"`
}

type ResourceSetStep struct {
	// Name of the step, must be unique within the ResourceSet.
	// +kubebuilder:validation:Pattern=`^[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +kubebuilder:validation:MaxLength=63
	// +required
	Name string `json:"name"`

	// Resources contains the list of Kubernetes resources to reconcile.
	// +kubebuilder:validation:items:Type=object
	// +optional
	Resources []*apiextensionsv1.JSON `json:"resources,omitempty"`

	// ResourcesTemplate is a Go template that generates the list of
	// Kubernetes resources to reconcile. The template is rendered
	// as multi-document YAML, the resources should be separated by '---'.
	// When both Resources and ResourcesTemplate are set, the resulting
	// objects are merged and deduplicated, with the ones from Resources taking precedence.
	// +optional
	ResourcesTemplate string `json:"resourcesTemplate,omitempty"`

	// Timeout is the maximum time to wait for the step's resources to
	// become ready. When not set, the ResourceSet reconciliation
	// timeout is used.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type Schedule struct {
	// Cron specifies the cron expression for the schedule.
	// +required
	Cron string `json:"cron"`

	// TimeZone specifies the time zone for the cron schedule. Defaults to UTC.
	// +kubebuilder:default:="UTC"
	// +optional
	TimeZone string `json:"timeZone,omitempty"`

	// Window defines the time window during which the execution is allowed.
	// Defaults to 0s, meaning no window is applied.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +kubebuilder:default:="0s"
	// +optional
	Window metav1.Duration `json:"window"`
}

type SearchSpec struct {
	// Cached enables serving resource listings from the cached search index
	// instead of querying the Kubernetes API in realtime. When enabled, the
	// /api/v1/resources endpoint returns data from the periodically refreshed
	// in-memory index, reducing API server load and improving response latency.
	// The cache is updated on the same interval as the report cache.
	// +optional
	Cached bool `json:"cached"`
}

type Sharding struct {
	// Key is the label key used to shard the resources.
	// +kubebuilder:default:=sharding.fluxcd.io/key
	// +optional
	Key string `json:"key,omitempty"`

	// Shards is the list of shard names.
	// +kubebuilder:validation:MinItems=1
	// +required
	Shards []string `json:"shards"`

	// Storage defines if the source-controller shards
	// should use an emptyDir or a persistent volume claim for storage.
	// Accepted values are 'ephemeral' or 'persistent', defaults to 'ephemeral'.
	// When set to 'persistent', the '.spec.storage' field must be set.
	// +kubebuilder:validation:Enum:=ephemeral;persistent
	// +optional
	Storage string `json:"storage,omitempty"`
}

type Snapshot struct {
	// Digest is the checksum in the format `<algo>:<hex>` of the resources in this snapshot.
	// +required
	Digest string `json:"digest"`

	// FirstReconciled is the time when this revision was first reconciled to the cluster.
	// +required
	FirstReconciled metav1.Time `json:"firstReconciled"`

	// LastReconciled is the time when this revision was last reconciled to the cluster.
	// +required
	LastReconciled metav1.Time `json:"lastReconciled"`

	// LastReconciledDuration is time it took to reconcile the resources in this revision.
	// +kubebuilder:validation:Type=string
	// +required
	LastReconciledDuration metav1.Duration `json:"lastReconciledDuration"`

	// LastReconciledStatus is the status of the last reconciliation.
	// +required
	LastReconciledStatus string `json:"lastReconciledStatus"`

	// TotalReconciliations is the total number of reconciliations that have occurred for this snapshot.
	// + required
	TotalReconciliations int64 `json:"totalReconciliations"`

	// Metadata contains additional information about the snapshot.
	// +optional
	Metadata map[string]string `json:"metadata,omitempty"`
}

type Storage struct {
	// Class is the storage class to use for the PVC.
	// +required
	Class string `json:"class"`

	// Size is the size of the PVC.
	// +required
	Size string `json:"size"`
}

type Sync struct {
	// Name is the name of the Flux source and kustomization resources.
	// When not specified, the name is set to the namespace name of the FluxInstance.
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="Sync name is immutable"
	// +kubebuilder:validation:MaxLength=63
	// +optional
	Name string `json:"name,omitempty"`

	// Interval is the time between syncs.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +kubebuilder:default:="1m"
	// +optional
	Interval *metav1.Duration `json:"interval,omitempty"`

	// Kind is the kind of the source.
	// +kubebuilder:validation:Enum=OCIRepository;GitRepository;Bucket
	// +required
	Kind string `json:"kind"`

	// URL is the source URL, can be a Git repository HTTP/S or SSH address,
	// an OCI repository address or a Bucket endpoint.
	// +required
	URL string `json:"url"`

	// Ref is the source reference, can be a Git ref name e.g. 'refs/heads/main',
	// an OCI tag e.g. 'latest' or a bucket name e.g. 'flux'.
	// +required
	Ref string `json:"ref"`

	// Path is the path to the source directory containing
	// the kustomize overlay or plain Kubernetes manifests.
	// +required
	Path string `json:"path"`

	// PullSecret specifies the Kubernetes Secret containing the
	// authentication credentials for the source.
	// For Git over HTTP/S sources, the secret must contain username and password fields.
	// For Git over SSH sources, the secret must contain known_hosts and identity fields.
	// For OCI sources, the secret must be of type kubernetes.io/dockerconfigjson.
	// For Bucket sources, the secret must contain accesskey and secretkey fields.
	// +optional
	PullSecret string `json:"pullSecret,omitempty"`

	// Provider specifies OIDC provider for source authentication.
	// For OCIRepository and Bucket the provider can be set to 'aws', 'azure' or 'gcp'.
	// For GitRepository the provider can be set to 'aws' (requires Flux 2.9 or later),
	// 'azure' or 'github'.
	// To disable OIDC authentication the provider can be set to 'generic' or left empty.
	// +kubebuilder:validation:Enum=generic;aws;azure;gcp;github
	// +optional
	Provider string `json:"provider,omitempty"`
}

type UserActionsSpec struct {
	// Audit is a list of actions to be audited.
	// If the field is empty or omitted, no actions are audited.
	// The special value ["*"] can be used to audit all actions.
	// +optional
	Audit []string `json:"audit"`

	// Access determines how GitOps actions are authorized and performed.
	//
	// When set to "Impersonated" (the default), an action requires both the
	// custom per-action RBAC verb (e.g. "suspend") and the native Kubernetes
	// verbs (e.g. "patch"), because the action is performed by impersonating
	// the user.
	//
	// When set to "FineGrained", an action requires only the custom per-action
	// RBAC verb. The action itself is performed using the Flux Operator Web UI's
	// own privileges instead of impersonating the user. This enables stricter
	// least-privilege setups where a user can be granted access to a single action
	// (e.g. only "suspend") without also gaining the broader native verbs.
	// +kubebuilder:validation:Enum=Impersonated;FineGrained
	// +optional
	Access string `json:"access"`
}

type ValidationSpec struct {
	// Expression is the CEL expression that defines the validation.
	// The expression must return the type bool.
	// +required
	Expression string `json:"expression"`

	// Message is the error message returned if the validation fails.
	// +required
	Message string `json:"message"`
}

type VariableSpec struct {
	// Name is the name of the variable.
	// +required
	Name string `json:"name"`

	// Expression is the CEL expression that defines the variable.
	// +required
	Expression string `json:"expression"`
}

type WebConfig struct {
	metav1.TypeMeta `json:",inline"`

	// Spec holds the Flux Status Page configuration.
	// +required
	Spec WebConfigSpec `json:"spec"`
}

type WebConfigSpec struct {
	// Version is a unique identifier for the configuration.
	// This field is set internally when the configuration
	// is loaded and is not part of the API.
	// +required
	Version string `json:"-"`

	// BaseURL is the base URL for constructing the Flux Status Page URLs.
	// Some features may require this to be set.
	// +optional
	BaseURL string `json:"baseURL"`

	// Insecure indicates whether to use insecure settings across the web application.
	// +optional
	Insecure bool `json:"insecure"`

	// Search holds the search configuration.
	// +optional
	Search *SearchSpec `json:"search"`

	// UserActions holds the user actions configuration. Defaults to enabling all actions if not set.
	// Note that, by default, actions are only available when authentication is configured with the
	// OAuth2 type.
	// +optional
	UserActions *UserActionsSpec `json:"userActions"`

	// Authentication holds the authentication configuration.
	// If Authentication.Type is set to OAuth2, BaseURL must be set.
	// +optional
	Authentication *AuthenticationSpec `json:"authentication"`
}