modelhub

type Cell struct {
	Metadata CellMetadata
	Spec     CellSpec
	Status   CellStatus
}

type CellMetadata struct {
	Name   string
	Labels map[string]string
}

type CellNetworkStatus struct {
	BridgeName string
}

type CellSpec struct {
	ID              string
	RealmName       string
	SpaceName       string
	StackName       string
	RootContainerID string
	Tty             *CellTty
	Containers      []ContainerSpec
	// AutoDelete mirrors v1beta1.CellSpec.AutoDelete. See that type for
	// semantics; the field is round-tripped through cell metadata so the
	// daemon can re-derive the auto-delete intent after a restart.
	AutoDelete bool
	// NestedCgroupRuntime mirrors v1beta1.CellSpec.NestedCgroupRuntime. See
	// that type for semantics; the field is round-tripped through cell
	// metadata so the daemon can re-toggle the full subtree controller set
	// on the ensure-pass after a restart.
	NestedCgroupRuntime bool
}

type CellState int

type CellStatus struct {
	State      CellState
	CgroupPath string
	// SubtreeControllers records the cgroup-v2 controllers actually
	// delegated on this cell's own cgroup.subtree_control after the
	// effective filter against the host root's cgroup.controllers
	// (issue #328). For NestedCgroupRuntime cells this carries the full
	// host-available set; for ordinary cells it carries the kukeon
	// resource subset (cgroupcheck.CellResourceControllers).
	SubtreeControllers []string
	Network            CellNetworkStatus
	Containers         []ContainerStatus
	// ReadyObserved is a one-way latch set the first time the cell has
	// been observed Ready by ReconcileCell — either via the freshly
	// derived state or via a persisted Ready state from a prior
	// observation (or a synchronous Start that wrote Ready before the
	// reconciler got there). The latch gates Spec.AutoDelete cleanup so
	// a cell that has never been Ready (e.g. mid-creation, between
	// cgroup setup and root-container registration, where
	// GetContainerState reports Stopped for a not-yet-existing
	// container) cannot be reaped by the reconciler.
	ReadyObserved bool
}

type CellTty struct {
	Default string
}

type Container struct {
	Metadata ContainerMetadata
	Spec     ContainerSpec
	Status   ContainerStatus
}

type ContainerCapabilities struct {
	Drop []string
	Add  []string
}

type ContainerMetadata struct {
	Name   string
	Labels map[string]string
}

type ContainerResources struct {
	MemoryLimitBytes *int64
	CPUShares        *int64
	PidsLimit        *int64
}

type ContainerSecret struct {
	Name      string
	FromFile  string
	FromEnv   string
	MountPath string
}

type ContainerSpec struct {
	ID              string
	ContainerdID    string
	RealmName       string
	SpaceName       string
	StackName       string
	CellName        string
	Root            bool
	Image           string
	Command         string
	Args            []string
	WorkingDir      string
	Env             []string
	Ports           []string
	Volumes         []VolumeMount
	Networks        []string
	NetworksAliases []string
	Privileged      bool
	HostNetwork     bool
	HostPID         bool
	HostCgroup      bool
	// NestedCgroupRuntime mirrors the parent cell's
	// CellSpec.NestedCgroupRuntime opt-in (issue #314). When true and
	// !HostCgroup, BuildContainerSpec/BuildRootContainerSpec append a
	// cgroup2 mount at /sys/fs/cgroup so an inner runtime (dockerd,
	// podman, an inner containerd) can read the controller set that
	// the controller delegated host-side via
	// EnableCellAllSubtreeControllers (#318). Propagated by the runner
	// from cell.Spec.NestedCgroupRuntime at every BuildContainerSpec
	// call site; not part of the persisted container document.
	NestedCgroupRuntime    bool
	User                   string
	ReadOnlyRootFilesystem bool
	Capabilities           *ContainerCapabilities
	SecurityOpts           []string
	Tmpfs                  []ContainerTmpfsMount
	Resources              *ContainerResources
	Secrets                []ContainerSecret
	CNIConfigPath          string
	RestartPolicy          string
	Attachable             bool
	Tty                    *ContainerTty
	// CellCgroupPath is the absolute cgroup path of the parent cell (mirrors
	// Cell.Status.CgroupPath). When set, BuildContainerSpec emits an OCI
	// Linux.CgroupsPath rooted at <CellCgroupPath>/<containerd-id> so the
	// container task lands inside the cell's cgroup subtree instead of
	// containerd's runc-shim default placement. Populated by the runner at
	// container-create time; not part of the persisted cell document.
	CellCgroupPath string
	// EtcHostsPath is the host-side path of a kukeond-rendered /etc/hosts file
	// to bind-mount at /etc/hosts inside the container. Empty disables the
	// bind-mount, leaving the image's /etc/hosts in place. Mirrors Docker's
	// per-container hosts pattern; the source file lives under the cell's
	// metadata directory so cell teardown cleans it up. Populated by the
	// runner at container-create time; not part of the persisted document.
	EtcHostsPath string
	// EtcHostnamePath is the host-side path of a kukeond-rendered /etc/hostname
	// file (cell name) to bind-mount at /etc/hostname inside the container.
	// Empty disables the bind-mount. Same lifecycle and storage location as
	// EtcHostsPath; not part of the persisted document.
	EtcHostnamePath string
	// CellProfileName is the metadata.name of the CellProfile this container's
	// cell was materialized from (mirrors cell.Metadata.Labels
	// [cellprofile.LabelProfile]). When non-empty, BuildContainerSpec /
	// BuildRootContainerSpec emit it as KUKEON_CELL_PROFILE_NAME on the
	// container's OCI Process.Env so workloads can read their own profile
	// identity without relying on profile authors to hardcode it. Empty when
	// the cell was created from a plain CellDoc rather than a CellProfile.
	// Populated by the runner at container-create time; not part of the
	// persisted document. Issue #351.
	CellProfileName string
}

type ContainerState int

type ContainerStatus struct {
	Name         string // Container name/ID
	ID           string // Container ID (same as Name)
	State        ContainerState
	RestartCount int
	RestartTime  time.Time
	StartTime    time.Time
	FinishTime   time.Time
	ExitCode     int
	ExitSignal   string
}

type ContainerTmpfsMount struct {
	Path      string
	SizeBytes int64
	Options   []string
}

type ContainerTty struct {
	Prompt string
	OnInit []TtyStage
}

type EgressAllowRule struct {
	Host  string
	CIDR  string
	Ports []int
}

type EgressDefault string

type EgressPolicy struct {
	Default EgressDefault
	Allow   []EgressAllowRule
}

type Realm struct {
	Metadata RealmMetadata
	Spec     RealmSpec
	Status   RealmStatus
}

type RealmMetadata struct {
	Name   string
	Labels map[string]string
}

type RealmSpec struct {
	Namespace           string
	RegistryCredentials []RegistryCredentials
}

type RealmState int

type RealmStatus struct {
	State      RealmState
	CgroupPath string
	// SubtreeControllers records the cgroup-v2 controllers actually
	// delegated on this realm's own cgroup.subtree_control after the
	// effective filter against the host root's cgroup.controllers (issue
	// #328, surfacing the result of the helper landed by issue #327).
	SubtreeControllers []string
}

type RegistryCredentials struct {
	// Username is the registry username.
	Username string
	// Password is the registry password or token.
	Password string
	// ServerAddress is the registry server address (e.g., "docker.io", "registry.example.com").
	// If empty, credentials apply to the registry extracted from the image reference.
	ServerAddress string
}

type Space struct {
	Metadata SpaceMetadata
	Spec     SpaceSpec
	Status   SpaceStatus
}

type SpaceContainerDefaults struct {
	User                   string
	ReadOnlyRootFilesystem *bool
	Capabilities           *ContainerCapabilities
	SecurityOpts           []string
	Tmpfs                  []ContainerTmpfsMount
	Resources              *ContainerResources
}

type SpaceDefaults struct {
	Container *SpaceContainerDefaults
}

type SpaceMetadata struct {
	Name   string
	Labels map[string]string
}

type SpaceNetwork struct {
	Egress *EgressPolicy
}

type SpaceSpec struct {
	RealmName     string
	CNIConfigPath string
	Network       *SpaceNetwork
	Defaults      *SpaceDefaults
}

type SpaceState int

type SpaceStatus struct {
	State      SpaceState
	CgroupPath string
	// SubtreeControllers records the cgroup-v2 controllers actually
	// delegated on this space's own cgroup.subtree_control after the
	// effective filter against the host root's cgroup.controllers (issue
	// #328).
	SubtreeControllers []string
}

type Stack struct {
	Metadata StackMetadata
	Spec     StackSpec
	Status   StackStatus
}

type StackMetadata struct {
	Name   string
	Labels map[string]string
}

type StackSpec struct {
	ID        string
	RealmName string
	SpaceName string
}

type StackState int

type StackStatus struct {
	State      StackState
	CgroupPath string
	// SubtreeControllers records the cgroup-v2 controllers actually
	// delegated on this stack's own cgroup.subtree_control after the
	// effective filter against the host root's cgroup.controllers (issue
	// #328).
	SubtreeControllers []string
}

type TtyStage struct {
	Script string
}

type VolumeKind string

type VolumeMount struct {
	Kind     VolumeKind
	Source   string
	Target   string
	ReadOnly bool
	// SizeBytes is the tmpfs size= option in bytes. Only honored when
	// Kind == VolumeKindTmpfs; zero leaves the kernel default.
	SizeBytes int64
	// Mode is the tmpfs mode= option as a 4-digit octal value (e.g. 0755).
	// Only honored when Kind == VolumeKindTmpfs; zero leaves the kernel
	// default (01777).
	Mode uint32
}