v1beta1

type CellDoc struct {
	APIVersion Version      `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind         `json:"kind"       yaml:"kind"`
	Metadata   CellMetadata `json:"metadata"   yaml:"metadata"`
	Spec       CellSpec     `json:"spec"       yaml:"spec"`
	Status     CellStatus   `json:"status"     yaml:"status"`
}

type CellMetadata struct {
	Name   string            `json:"name"   yaml:"name"`
	Labels map[string]string `json:"labels" yaml:"labels"`
}

type CellNetworkStatus struct {
	BridgeName string `json:"bridgeName,omitempty" yaml:"bridgeName,omitempty"`
}

type CellProfileDoc struct {
	APIVersion Version             `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind                `json:"kind"       yaml:"kind"`
	Metadata   CellProfileMetadata `json:"metadata"   yaml:"metadata"`
	Spec       CellProfileSpec     `json:"spec"       yaml:"spec"`
}

type CellProfileMetadata struct {
	Name   string            `json:"name"             yaml:"name"`
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
}

type CellProfileParameter struct {
	Name        string  `json:"name"                  yaml:"name"`
	Description string  `json:"description,omitempty" yaml:"description,omitempty"`
	Default     *string `json:"default,omitempty"     yaml:"default,omitempty"`
	Required    bool    `json:"required,omitempty"    yaml:"required,omitempty"`
}

type CellProfileSpec struct {
	Realm      string                 `json:"realm,omitempty"      yaml:"realm,omitempty"`
	Space      string                 `json:"space,omitempty"      yaml:"space,omitempty"`
	Stack      string                 `json:"stack,omitempty"      yaml:"stack,omitempty"`
	Prefix     string                 `json:"prefix,omitempty"     yaml:"prefix,omitempty"`
	Parameters []CellProfileParameter `json:"parameters,omitempty" yaml:"parameters,omitempty"`
	Cell       CellSpec               `json:"cell"                 yaml:"cell"`
}

type CellSpec struct {
	ID              string          `json:"id"                        yaml:"id"`
	RealmID         string          `json:"realmId"                   yaml:"realmId"`
	SpaceID         string          `json:"spaceId"                   yaml:"spaceId"`
	StackID         string          `json:"stackId"                   yaml:"stackId"`
	RootContainerID string          `json:"rootContainerId,omitempty" yaml:"rootContainerId,omitempty"`
	Tty             *CellTty        `json:"tty,omitempty"             yaml:"tty,omitempty"`
	Containers      []ContainerSpec `json:"containers"                yaml:"containers"`
	// AutoDelete asks kukeond to delete this cell best-effort after its root
	// container's task exits (any rc). Set by `kuke run --rm`. Cleanup is
	// scoped to the cell only — never cascades to stack/space/realm.
	// Cleanup is driven by kukeond's reconcile loop: the next pass that
	// observes the root task as Stopped/Failed runs KillCell+DeleteCell on
	// the cell. Latency is bounded by the reconcile interval, and the
	// trigger survives daemon restarts (no per-cell goroutine needs to be
	// re-installed on startup).
	AutoDelete bool `json:"autoDelete,omitempty"      yaml:"autoDelete,omitempty"`
	// NestedCgroupRuntime opts the cell into delegating the full
	// host-available cgroup-v2 controller set on its cgroup.subtree_control,
	// rather than the kukeon resource subset (cpu/memory/io/pids). This is
	// the knob a cell that hosts a nested cgroup runtime — an inner
	// containerd, runc, or systemd that places its own children in
	// sub-cgroups under the cell — needs so the inner runtime can in turn
	// delegate any controller it wants to its workloads. Default false
	// keeps the existing cell-as-leaf semantics (issue #312) untouched.
	NestedCgroupRuntime bool `json:"nestedCgroupRuntime,omitempty" yaml:"nestedCgroupRuntime,omitempty"`
}

type CellState int

type CellStatus struct {
	State      CellState `json:"state"                        yaml:"state"`
	CgroupPath string    `json:"cgroupPath"                   yaml:"cgroupPath"`
	// SubtreeControllers is the cgroup-v2 controller set actually
	// delegated on this cell's own cgroup.subtree_control after the
	// host-root filter (issue #328). For NestedCgroupRuntime cells this
	// is the full host-available set; for ordinary cells it's the
	// kukeon resource subset (cpu/memory/io/pids).
	SubtreeControllers []string          `json:"subtreeControllers,omitempty" yaml:"subtreeControllers,omitempty"`
	Network            CellNetworkStatus `json:"network,omitempty"            yaml:"network,omitempty"`
	Containers         []ContainerStatus `json:"containers"                   yaml:"containers"`
	// ReadyObserved is the persisted form of the one-way latch the
	// reconciler uses to gate Spec.AutoDelete cleanup. Once a cell has
	// been observed Ready it stays true across daemon restarts so that
	// cleanup of a `kuke run --rm` cell that was already Ready at
	// shutdown still fires on the next tick after restart.
	ReadyObserved bool `json:"readyObserved,omitempty" yaml:"readyObserved,omitempty"`
	// Lifecycle and runtime-health fields — see RealmStatus for the
	// per-field contract; the semantics carry across all four kinds.
	CreatedAt   time.Time `json:"createdAt,omitempty"     yaml:"createdAt,omitempty"`
	UpdatedAt   time.Time `json:"updatedAt,omitempty"     yaml:"updatedAt,omitempty"`
	ReadyAt     time.Time `json:"readyAt,omitempty"       yaml:"readyAt,omitempty"`
	Reason      string    `json:"reason,omitempty"        yaml:"reason,omitempty"`
	Message     string    `json:"message,omitempty"       yaml:"message,omitempty"`
	CgroupReady bool      `json:"cgroupReady,omitempty"   yaml:"cgroupReady,omitempty"`
}

type CellTty struct {
	// Default names the attachable container the post-start attach
	// (`kuke run`'s default mode) selects when no --container flag is
	// given. Must reference an existing container in this cell whose
	// Attachable=true (or be empty).
	Default string `json:"default,omitempty" yaml:"default,omitempty"`
}

type ClientConfigurationDoc struct {
	APIVersion Version                     `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind                        `json:"kind"       yaml:"kind"`
	Metadata   ClientConfigurationMetadata `json:"metadata"   yaml:"metadata"`
	Spec       ClientConfigurationSpec     `json:"spec"       yaml:"spec"`
}

type ClientConfigurationMetadata struct {
	Name   string            `json:"name"             yaml:"name"`
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
}

type ClientConfigurationSpec struct {
	// Host is the kukeond endpoint kuke dials by default
	// (`unix:///run/kukeon/kukeond.sock` or `ssh://user@host`).
	Host string `json:"host,omitempty"             yaml:"host,omitempty"`
	// RunPath is the kukeon runtime root used by `--no-daemon` operations
	// that read /opt/kukeon directly instead of going through kukeond.
	RunPath string `json:"runPath,omitempty"          yaml:"runPath,omitempty"`
	// ContainerdSocket is the containerd unix socket `--no-daemon`
	// operations connect to.
	ContainerdSocket string `json:"containerdSocket,omitempty" yaml:"containerdSocket,omitempty"`
	// LogLevel is the client log level when `--verbose` is on
	// (debug, info, warn, error).
	LogLevel string `json:"logLevel,omitempty"         yaml:"logLevel,omitempty"`
}

type ContainerCapabilities struct {
	Drop []string `json:"drop,omitempty" yaml:"drop,omitempty"`
	Add  []string `json:"add,omitempty"  yaml:"add,omitempty"`
}

type ContainerDoc struct {
	APIVersion Version           `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind              `json:"kind"       yaml:"kind"`
	Metadata   ContainerMetadata `json:"metadata"   yaml:"metadata"`
	Spec       ContainerSpec     `json:"spec"       yaml:"spec"`
	Status     ContainerStatus   `json:"status"     yaml:"status"`
}

type ContainerMetadata struct {
	Name   string            `json:"name"   yaml:"name"`
	Labels map[string]string `json:"labels" yaml:"labels"`
}

type ContainerResources struct {
	MemoryLimitBytes *int64 `json:"memoryLimitBytes,omitempty" yaml:"memoryLimitBytes,omitempty"`
	CPUShares        *int64 `json:"cpuShares,omitempty"        yaml:"cpuShares,omitempty"`
	PidsLimit        *int64 `json:"pidsLimit,omitempty"        yaml:"pidsLimit,omitempty"`
}

type ContainerSecret struct {
	Name      string `json:"name"                yaml:"name"`
	FromFile  string `json:"fromFile,omitempty"  yaml:"fromFile,omitempty"`
	FromEnv   string `json:"fromEnv,omitempty"   yaml:"fromEnv,omitempty"`
	MountPath string `json:"mountPath,omitempty" yaml:"mountPath,omitempty"`
}

type ContainerSpec struct {
	ID           string   `json:"id"                               yaml:"id"`
	ContainerdID string   `json:"containerdId,omitempty"           yaml:"containerdId,omitempty"`
	RealmID      string   `json:"realmId"                          yaml:"realmId"`
	SpaceID      string   `json:"spaceId"                          yaml:"spaceId"`
	StackID      string   `json:"stackId"                          yaml:"stackId"`
	CellID       string   `json:"cellId"                           yaml:"cellId"`
	Root         bool     `json:"root,omitempty"                   yaml:"root,omitempty"`
	Image        string   `json:"image"                            yaml:"image"`
	Command      string   `json:"command"                          yaml:"command"`
	Args         []string `json:"args"                             yaml:"args"`
	// WorkingDir sets the cwd of the spawned container process — OCI
	// process.cwd, Docker WORKDIR, K8s Container.workingDir. Empty falls
	// back to the image's WORKDIR (no behavior change for existing specs).
	WorkingDir      string        `json:"workingDir,omitempty"             yaml:"workingDir,omitempty"`
	Env             []string      `json:"env"                              yaml:"env"`
	Ports           []string      `json:"ports"                            yaml:"ports"`
	Volumes         []VolumeMount `json:"volumes"                          yaml:"volumes"`
	Networks        []string      `json:"networks"                         yaml:"networks"`
	NetworksAliases []string      `json:"networksAliases"                  yaml:"networksAliases"`
	Privileged      bool          `json:"privileged"                       yaml:"privileged"`
	// HostNetwork opts the container into the host's network namespace.
	// When true, the runner omits the network LinuxNamespace from the OCI
	// spec (containerd's WithHostNamespace) and does not invoke CNI attach,
	// since a host-netns container has no per-container veth to wire up.
	// Used by the kukeond bootstrap so daemon-installed bridges, veths, and
	// iptables rules land in host scope where kubelet-style CNI plumbing
	// belongs. Default false — no behavior change for existing specs.
	HostNetwork bool `json:"hostNetwork,omitempty"            yaml:"hostNetwork,omitempty"`
	// HostPID opts the container into the host's PID namespace. When true,
	// the runner omits the PID LinuxNamespace from the OCI spec so /proc
	// inside the container reflects host PIDs. Used by the kukeond bootstrap
	// so the CNI bridge plugin running inside the daemon can resolve the
	// host PIDs containerd returns from task.Pid() — without this, attaching
	// user cells to a network fails with `Statfs /proc/<host-pid>/ns/net:
	// no such file or directory`. Default false — no behavior change for
	// existing specs.
	HostPID bool `json:"hostPID,omitempty"                yaml:"hostPID,omitempty"`
	// HostCgroup, when true, opts the container into its parent's cgroup
	// namespace. Default false unshares the cgroup-ns: the container sees
	// its own cgroup as / and any nested runtime (containerd, runc,
	// dockerd, kuke init) writes its cgroup tree under the cell — which
	// is the property that lets a nested kuke init complete the runc
	// task-create step that otherwise trips the "cgroup not empty"
	// precheck.
	//
	// Set true only for kukeond-style cells that need to write cgroups
	// *outside* their own subtree to manage user workloads. For ordinary
	// workload containers, leave false.
	//
	// Translates to omitting the LinuxNamespace{Type: cgroup} entry from
	// the OCI spec when true; appending it when false.
	HostCgroup             bool                   `json:"hostCgroup,omitempty"             yaml:"hostCgroup,omitempty"`
	User                   string                 `json:"user,omitempty"                   yaml:"user,omitempty"`
	ReadOnlyRootFilesystem bool                   `json:"readOnlyRootFilesystem,omitempty" yaml:"readOnlyRootFilesystem,omitempty"`
	Capabilities           *ContainerCapabilities `json:"capabilities,omitempty"           yaml:"capabilities,omitempty"`
	SecurityOpts           []string               `json:"securityOpts,omitempty"           yaml:"securityOpts,omitempty"`
	Tmpfs                  []ContainerTmpfsMount  `json:"tmpfs,omitempty"                  yaml:"tmpfs,omitempty"`
	Resources              *ContainerResources    `json:"resources,omitempty"              yaml:"resources,omitempty"`
	Secrets                []ContainerSecret      `json:"secrets,omitempty"                yaml:"secrets,omitempty"`
	CNIConfigPath          string                 `json:"cniConfigPath,omitempty"          yaml:"cniConfigPath,omitempty"`
	RestartPolicy          string                 `json:"restartPolicy"                    yaml:"restartPolicy"`
	// Attachable opts the container into sbsh-wrapper injection. When true,
	// the daemon prepends `sbsh terminal --run-path /run/kukeon/tty …` to
	// process.args, bind-mounts the sbsh binary read-only at /.kukeon/bin/sbsh,
	// and bind-mounts a per-container tty directory at /run/kukeon/tty (sbsh
	// owns its socket, capture, and log files inside it). The host-visible
	// peer of that directory lives in the per-container metadata dir and its
	// `socket` entry is what `kuke attach` connects to. Default false — no
	// behavior change for existing specs.
	Attachable bool `json:"attachable,omitempty"             yaml:"attachable,omitempty"`
	// Tty configures shell-UX (prompt, init scripts) for the sbsh wrapper
	// when Attachable=true. The container model already owns command, args,
	// workingDir, and env, so Tty intentionally only adds layers the
	// container model can't express. Setting any tty field with
	// Attachable=false is a validation error.
	Tty *ContainerTty `json:"tty,omitempty"                    yaml:"tty,omitempty"`
}

type ContainerState int

type ContainerStatus struct {
	Name         string         `json:"name"         yaml:"name"`
	ID           string         `json:"id"           yaml:"id"`
	State        ContainerState `json:"state"        yaml:"state"`
	RestartCount int            `json:"restartCount" yaml:"restartCount"`
	RestartTime  time.Time      `json:"restartTime"  yaml:"restartTime"`
	StartTime    time.Time      `json:"startTime"    yaml:"startTime"`
	FinishTime   time.Time      `json:"finishTime"   yaml:"finishTime"`
	ExitCode     int            `json:"exitCode"     yaml:"exitCode"`
	ExitSignal   string         `json:"exitSignal"   yaml:"exitSignal"`
}

type ContainerTmpfsMount struct {
	Path      string   `json:"path"                yaml:"path"`
	SizeBytes int64    `json:"sizeBytes,omitempty" yaml:"sizeBytes,omitempty"`
	Options   []string `json:"options,omitempty"   yaml:"options,omitempty"`
}

type ContainerTty struct {
	// Prompt is the literal prompt expression sbsh stamps onto
	// TerminalSpec.Prompt and flips SetPrompt on for. Empty leaves
	// SetPrompt off (sbsh's wrapper skips PS1 injection).
	Prompt string `json:"prompt,omitempty"  yaml:"prompt,omitempty"`
	// OnInit are scripts run once when the wrapped shell starts, in
	// order. Forwarded to TerminalSpec.Stages.OnInit via sbsh's
	// WithOnInit; an empty slice leaves Stages.OnInit zero.
	OnInit []TtyStage `json:"onInit,omitempty"  yaml:"onInit,omitempty"`
	// LogFile is the in-container path where sbsh's runner writes its
	// runtime/debug log. Empty (the default) means sbsh's runner skips
	// log-writer setup entirely. Set this to a path inside the kuketty
	// tty bind mount (e.g. "/run/kukeon/tty/log") if the operator wants
	// the log file host-visible through the directory bind mount; any
	// other in-container path is accepted and just stays inside the
	// container's overlay. Mode and GID are not user-configurable here
	// — the daemon applies its system-wide AttachableLogFileMode and
	// the kukeon-group GID, gated on the kukeon group being configured
	// (matches the SocketMode/CaptureMode treatment).
	LogFile string `json:"logFile,omitempty" yaml:"logFile,omitempty"`
}

type EgressAllowRule struct {
	Host  string `json:"host,omitempty"  yaml:"host,omitempty"`
	CIDR  string `json:"cidr,omitempty"  yaml:"cidr,omitempty"`
	Ports []int  `json:"ports,omitempty" yaml:"ports,omitempty"`
}

type EgressDefault string

type EgressPolicy struct {
	Default EgressDefault     `json:"default"         yaml:"default"`
	Allow   []EgressAllowRule `json:"allow,omitempty" yaml:"allow,omitempty"`
}

type Kind string

type RealmDoc struct {
	APIVersion Version       `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind          `json:"kind"       yaml:"kind"`
	Metadata   RealmMetadata `json:"metadata"   yaml:"metadata"`
	Spec       RealmSpec     `json:"spec"       yaml:"spec"`
	Status     RealmStatus   `json:"status"     yaml:"status"`
}

type RealmMetadata struct {
	Name   string            `json:"name"   yaml:"name"`
	Labels map[string]string `json:"labels" yaml:"labels"`
}

type RealmSpec struct {
	Namespace           string                `json:"namespace"                     yaml:"namespace"`
	RegistryCredentials []RegistryCredentials `json:"registryCredentials,omitempty" yaml:"registryCredentials,omitempty"`
}

type RealmState int

type RealmStatus struct {
	State      RealmState `json:"state"                              yaml:"state"`
	CgroupPath string     `json:"cgroupPath,omitempty"         yaml:"cgroupPath,omitempty"`
	// SubtreeControllers is the cgroup-v2 controller set actually
	// delegated on this realm's own cgroup.subtree_control after the
	// host-root filter (issue #328).
	SubtreeControllers []string `json:"subtreeControllers,omitempty" yaml:"subtreeControllers,omitempty"`
	// CreatedAt is the wall-clock time of the first persist for this
	// realm. Bumped only when zero so the value never moves once set.
	CreatedAt time.Time `json:"createdAt,omitempty"          yaml:"createdAt,omitempty"`
	// UpdatedAt is the wall-clock time of the most recent persist.
	UpdatedAt time.Time `json:"updatedAt,omitempty"          yaml:"updatedAt,omitempty"`
	// ReadyAt is the wall-clock time of the first State==Ready persist.
	// Set-once: never overwritten by subsequent Ready transitions or
	// state flaps, so it serves as an immutable "first reached Ready"
	// marker.
	ReadyAt time.Time `json:"readyAt,omitempty"            yaml:"readyAt,omitempty"`
	// Reason is a short reason code summarizing why State is in its
	// current value. Empty when no reason has been recorded.
	Reason string `json:"reason,omitempty"             yaml:"reason,omitempty"`
	// Message is the human-readable detail backing Reason; especially
	// valuable on State==Failed where it captures the immediate cause.
	Message string `json:"message,omitempty"            yaml:"message,omitempty"`
	// CgroupReady reports whether CgroupPath actually exists on the
	// host filesystem as of the last status write. The CgroupPath
	// field records the intent (the path where the cgroup should
	// live); this re-verifies presence so callers can distinguish
	// "configured" from "still mounted".
	CgroupReady bool `json:"cgroupReady,omitempty"        yaml:"cgroupReady,omitempty"`
	// ContainerdNamespaceReady reports whether the containerd
	// namespace recorded in Spec.Namespace was actually present as of
	// the last status write. Like CgroupReady, this separates intent
	// from observation.
	ContainerdNamespaceReady bool `json:"containerdNamespaceReady,omitempty" yaml:"containerdNamespaceReady,omitempty"`
}

type RegistryCredentials struct {
	// Username is the registry username.
	Username string `json:"username"                yaml:"username"`
	// Password is the registry password or token.
	Password string `json:"password"                yaml:"password"`
	// ServerAddress is the registry server address (e.g., "docker.io", "registry.example.com").
	// If empty, credentials apply to the registry extracted from the image reference.
	ServerAddress string `json:"serverAddress,omitempty" yaml:"serverAddress,omitempty"`
}

type ServerConfigurationDoc struct {
	APIVersion Version                     `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind                        `json:"kind"       yaml:"kind"`
	Metadata   ServerConfigurationMetadata `json:"metadata"   yaml:"metadata"`
	Spec       ServerConfigurationSpec     `json:"spec"       yaml:"spec"`
}

type ServerConfigurationMetadata struct {
	Name   string            `json:"name"             yaml:"name"`
	Labels map[string]string `json:"labels,omitempty" yaml:"labels,omitempty"`
}

type ServerConfigurationSpec struct {
	// Socket is the unix socket path the daemon listens on.
	Socket string `json:"socket,omitempty"                    yaml:"socket,omitempty"`
	// SocketGID is the numeric group ID the daemon chowns its listener
	// socket to (mode 0o660 with group). Zero means root-only access.
	SocketGID int `json:"socketGID,omitempty"                 yaml:"socketGID,omitempty"`
	// RunPath is the kukeon runtime root (e.g. /opt/kukeon).
	RunPath string `json:"runPath,omitempty"                   yaml:"runPath,omitempty"`
	// ContainerdSocket is the path to the containerd unix socket the
	// daemon connects to.
	ContainerdSocket string `json:"containerdSocket,omitempty"          yaml:"containerdSocket,omitempty"`
	// LogLevel is the daemon log level (debug, info, warn, error).
	LogLevel string `json:"logLevel,omitempty"                  yaml:"logLevel,omitempty"`
	// ReconcileInterval is the period of the daemon's background cell
	// reconciliation loop, expressed as a Go time.Duration string (e.g.
	// "30s", "1m"). Empty falls back to the in-binary default. A zero or
	// negative duration disables the loop.
	ReconcileInterval string `json:"reconcileInterval,omitempty"         yaml:"reconcileInterval,omitempty"`
	// KukeondImage is the container image `kuke init` provisions for the
	// kukeond system cell. Read by `kuke init` only; the daemon ignores it.
	KukeondImage string `json:"kukeondImage,omitempty"              yaml:"kukeondImage,omitempty"`
	// ContainerdNamespaceSuffix is the suffix appended to every realm name
	// to form its containerd namespace. Realm "default" + suffix
	// "kukeon.io" -> namespace "default.kukeon.io". Lets two kukeon
	// instances coexist on the same host under disjoint namespaces.
	// Default: kukeon.io.
	ContainerdNamespaceSuffix string `json:"containerdNamespaceSuffix,omitempty" yaml:"containerdNamespaceSuffix,omitempty"`
	// CgroupRoot is the cgroup root under which all realms / spaces /
	// stacks / cells live (e.g. /kukeon-dev for a parallel dev instance on
	// the same host). Default: /kukeon.
	CgroupRoot string `json:"cgroupRoot,omitempty"                yaml:"cgroupRoot,omitempty"`
}

type SpaceContainerDefaults struct {
	User                   string                 `json:"user,omitempty"                   yaml:"user,omitempty"`
	ReadOnlyRootFilesystem *bool                  `json:"readOnlyRootFilesystem,omitempty" yaml:"readOnlyRootFilesystem,omitempty"`
	Capabilities           *ContainerCapabilities `json:"capabilities,omitempty"           yaml:"capabilities,omitempty"`
	SecurityOpts           []string               `json:"securityOpts,omitempty"           yaml:"securityOpts,omitempty"`
	Tmpfs                  []ContainerTmpfsMount  `json:"tmpfs,omitempty"                  yaml:"tmpfs,omitempty"`
	Resources              *ContainerResources    `json:"resources,omitempty"              yaml:"resources,omitempty"`
}

type SpaceDefaults struct {
	Container *SpaceContainerDefaults `json:"container,omitempty" yaml:"container,omitempty"`
}

type SpaceDoc struct {
	APIVersion Version       `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind          `json:"kind"       yaml:"kind"`
	Metadata   SpaceMetadata `json:"metadata"   yaml:"metadata"`
	Spec       SpaceSpec     `json:"spec"       yaml:"spec"`
	Status     SpaceStatus   `json:"status"     yaml:"status"`
}

type SpaceMetadata struct {
	Name   string            `json:"name"   yaml:"name"`
	Labels map[string]string `json:"labels" yaml:"labels"`
}

type SpaceNetwork struct {
	Egress *EgressPolicy `json:"egress,omitempty" yaml:"egress,omitempty"`
}

type SpaceSpec struct {
	RealmID       string         `json:"realmId"                 yaml:"realmId"`
	CNIConfigPath string         `json:"cniConfigPath,omitempty" yaml:"cniConfigPath,omitempty"`
	Network       *SpaceNetwork  `json:"network,omitempty"       yaml:"network,omitempty"`
	Defaults      *SpaceDefaults `json:"defaults,omitempty"      yaml:"defaults,omitempty"`
}

type SpaceState int

type SpaceStatus struct {
	State      SpaceState `json:"state"                        yaml:"state"`
	CgroupPath string     `json:"cgroupPath,omitempty"         yaml:"cgroupPath,omitempty"`
	// SubtreeControllers is the cgroup-v2 controller set actually
	// delegated on this space's own cgroup.subtree_control after the
	// host-root filter (issue #328).
	SubtreeControllers []string `json:"subtreeControllers,omitempty" yaml:"subtreeControllers,omitempty"`
	// Lifecycle and runtime-health fields — see RealmStatus for the
	// per-field contract; the semantics carry across all four kinds.
	CreatedAt   time.Time `json:"createdAt,omitempty"          yaml:"createdAt,omitempty"`
	UpdatedAt   time.Time `json:"updatedAt,omitempty"          yaml:"updatedAt,omitempty"`
	ReadyAt     time.Time `json:"readyAt,omitempty"            yaml:"readyAt,omitempty"`
	Reason      string    `json:"reason,omitempty"             yaml:"reason,omitempty"`
	Message     string    `json:"message,omitempty"            yaml:"message,omitempty"`
	CgroupReady bool      `json:"cgroupReady,omitempty"        yaml:"cgroupReady,omitempty"`
}

type StackDoc struct {
	APIVersion Version       `json:"apiVersion" yaml:"apiVersion"`
	Kind       Kind          `json:"kind"       yaml:"kind"`
	Metadata   StackMetadata `json:"metadata"   yaml:"metadata"`
	Spec       StackSpec     `json:"spec"       yaml:"spec"`
	Status     StackStatus   `json:"status"     yaml:"status"`
}

type StackMetadata struct {
	Name   string            `json:"name"   yaml:"name"`
	Labels map[string]string `json:"labels" yaml:"labels"`
}

type StackSpec struct {
	ID      string `json:"id"      yaml:"id"`
	RealmID string `json:"realmId" yaml:"realmId"`
	SpaceID string `json:"spaceId" yaml:"spaceId"`
}

type StackState int

type StackStatus struct {
	State      StackState `json:"state"                        yaml:"state"`
	CgroupPath string     `json:"cgroupPath"                   yaml:"cgroupPath"`
	// SubtreeControllers is the cgroup-v2 controller set actually
	// delegated on this stack's own cgroup.subtree_control after the
	// host-root filter (issue #328).
	SubtreeControllers []string `json:"subtreeControllers,omitempty" yaml:"subtreeControllers,omitempty"`
	// Lifecycle and runtime-health fields — see RealmStatus for the
	// per-field contract; the semantics carry across all four kinds.
	CreatedAt   time.Time `json:"createdAt,omitempty"          yaml:"createdAt,omitempty"`
	UpdatedAt   time.Time `json:"updatedAt,omitempty"          yaml:"updatedAt,omitempty"`
	ReadyAt     time.Time `json:"readyAt,omitempty"            yaml:"readyAt,omitempty"`
	Reason      string    `json:"reason,omitempty"             yaml:"reason,omitempty"`
	Message     string    `json:"message,omitempty"            yaml:"message,omitempty"`
	CgroupReady bool      `json:"cgroupReady,omitempty"        yaml:"cgroupReady,omitempty"`
}

type TtyStage struct {
	Script string `json:"script,omitempty" yaml:"script,omitempty"`
}

type Version string

type VolumeKind string

type VolumeMount struct {
	Kind      VolumeKind `json:"kind,omitempty"      yaml:"kind,omitempty"`
	Source    string     `json:"source,omitempty"    yaml:"source,omitempty"`
	Target    string     `json:"target"              yaml:"target"`
	ReadOnly  bool       `json:"readOnly,omitempty"  yaml:"readOnly,omitempty"`
	SizeBytes int64      `json:"sizeBytes,omitempty" yaml:"sizeBytes,omitempty"`
	Mode      uint32     `json:"mode,omitempty"      yaml:"mode,omitempty"`
}