v1alpha1

type AllowlistEgress struct {
	// CIDRs are stable destination ranges rendered as NetworkPolicy ipBlock
	// egress rules. Use for an in-cluster VM, a cloud private-endpoint subnet,
	// or a known API VIP. Validation rejects 0.0.0.0/0 and any range covering
	// the metadata IP.
	// +optional
	CIDRs []string `json:"cidrs,omitempty"`
	// ClusterPeers are in-cluster destinations rendered as namespace/pod-selector
	// egress rules (e.g. an in-cluster embedder Service's pods).
	// +optional
	ClusterPeers []ClusterPeer `json:"clusterPeers,omitempty"`
	// OpenInternet, when true, renders broad egress (0.0.0.0/0 minus RFC1918 and
	// minus the metadata IP) on the declared ports. Host-exactness is DELEGATED
	// to operator infrastructure (cloud egress firewall / managed-CNI FQDN
	// policy). The explicit escape hatch for a target that cannot be reduced to
	// a CIDR (public-SaaS model APIs).
	// +optional
	OpenInternet bool `json:"openInternet,omitempty"`
	// Ports the egress rules apply to. Defaults to TCP/443 when empty.
	// +optional
	Ports []int32 `json:"ports,omitempty"`
}

type ClusterPeer struct {
	// NamespaceSelector matches destination namespaces by label. When empty,
	// the rule is not namespace-scoped (matches pods in any namespace by the
	// PodSelector).
	// +optional
	NamespaceSelector map[string]string `json:"namespaceSelector,omitempty"`
	// PodSelector matches destination pods by label.
	// +optional
	PodSelector map[string]string `json:"podSelector,omitempty"`
	// Ports the rule applies to. Defaults to TCP/443 when empty.
	// +optional
	Ports []int32 `json:"ports,omitempty"`
}

type EgressPosture string

type InputMode string

type ScalingSpec struct {
	// +kubebuilder:validation:Minimum=0
	MinReplicas int32 `json:"minReplicas"`
	// +kubebuilder:validation:Minimum=1
	MaxReplicas int32 `json:"maxReplicas"`
	// QueueDepthTarget is the JetStream pending-message count per replica
	// KEDA scales toward.
	// +kubebuilder:validation:Minimum=1
	QueueDepthTarget int32 `json:"queueDepthTarget"`
}

type ScratchVolume struct {
	// MountPath is where the emptyDir is mounted in the worker container.
	MountPath string `json:"mountPath"`
	// SizeLimit caps the emptyDir (e.g. "512Mi"). Serialized as a string
	// in YAML; validated as a Kubernetes quantity at admission time.
	SizeLimit resource.Quantity `json:"sizeLimit"`
}

type SecretRef struct {
	// Name is the logical name the worker uses to find this secret.
	Name string `json:"name"`
	// SecretName is the Kubernetes Secret object name.
	SecretName string `json:"secretName"`
	// SecretKey is the key within that Secret.
	SecretKey string `json:"secretKey"`
}

type TMIComponent struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   TMIComponentSpec   `json:"spec,omitempty"`
	Status TMIComponentStatus `json:"status,omitempty"`
}

type TMIComponentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []TMIComponent `json:"items"`
}

type TMIComponentSpec struct {
	// Image is the worker container image.
	Image string `json:"image"`
	// JobSubjects are the JetStream subjects this component consumes.
	// +kubebuilder:validation:MinItems=1
	JobSubjects []string `json:"jobSubjects"`
	// InputMode declares how the component receives job input.
	InputMode InputMode `json:"inputMode"`
	// Egress is the network posture; drives the rendered NetworkPolicy.
	Egress EgressPosture `json:"egress"`
	// Allowlist is required when Egress is "allowlist", ignored otherwise.
	// +optional
	Allowlist *AllowlistEgress `json:"allowlist,omitempty"`
	// Config holds non-secret component-local config values, passed to the
	// worker as environment variables.
	// +optional
	Config map[string]string `json:"config,omitempty"`
	// SecretRefs reference Kubernetes Secrets wired into the worker pod.
	// +optional
	SecretRefs []SecretRef `json:"secretRefs,omitempty"`
	// Resources sets the worker pod CPU/memory limits (the cgroup caps).
	Resources corev1.ResourceRequirements `json:"resources"`
	// ScratchVolume optionally requests a writable emptyDir.
	// +optional
	ScratchVolume *ScratchVolume `json:"scratchVolume,omitempty"`
	// Scaling configures KEDA autoscaling.
	Scaling ScalingSpec `json:"scaling"`
}

type TMIComponentStatus struct {
	// Conditions follows the standard Kubernetes condition pattern.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
	// ObservedGeneration is the .metadata.generation last reconciled.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}