v1alpha1

type AgentFileConfig struct {
	// Content is the raw markdown content of the agent file.
	Content string `json:"content"`
}

type ClaudeConfig struct {
	// Model specifies the Claude model to use.
	// +optional
	Model string `json:"model,omitempty"`

	// MaxTurns limits the number of agentic turns. 0 means unlimited.
	// +optional
	MaxTurns *int `json:"maxTurns,omitempty"`

	// PermissionMode controls tool permission handling.
	// +kubebuilder:default=bypassPermissions
	// +optional
	PermissionMode PermissionMode `json:"permissionMode,omitempty"`

	// SystemPrompt overrides the default system prompt.
	// +optional
	SystemPrompt string `json:"systemPrompt,omitempty"`

	// AppendSystemPrompt appends text to the default system prompt.
	// +optional
	AppendSystemPrompt string `json:"appendSystemPrompt,omitempty"`

	// MCPServers defines inline MCP server configuration (free-form map rendered to .mcp.json).
	// +optional
	MCPServers map[string]runtime.RawExtension `json:"mcpServers,omitempty"`

	// MCPServerSecrets defines secret references for ${VAR} expansion in MCP config.
	// +optional
	MCPServerSecrets []MCPServerSecret `json:"mcpServerSecrets,omitempty"`

	// MCPTimeout sets the MCP_TIMEOUT env var (milliseconds).
	// +optional
	MCPTimeout *int `json:"mcpTimeout,omitempty"`

	// MaxMCPOutputTokens sets MAX_MCP_OUTPUT_TOKENS.
	// +optional
	MaxMCPOutputTokens *int `json:"maxMcpOutputTokens,omitempty"`

	// StrictMCPConfig prevents loading MCP configs from user/project/local sources.
	// +kubebuilder:default=true
	// +optional
	StrictMCPConfig *bool `json:"strictMcpConfig,omitempty"`

	// MaxBudgetUSD sets the maximum spend per session in USD.
	// +optional
	MaxBudgetUSD *float64 `json:"maxBudgetUSD,omitempty"`

	// Effort controls thinking effort level (low, medium, high).
	// +optional
	Effort EffortLevel `json:"effort,omitempty"`

	// FallbackModel specifies a fallback model if the primary is unavailable.
	// +optional
	FallbackModel string `json:"fallbackModel,omitempty"`

	// JSONSchema defines structured output schema.
	// +optional
	JSONSchema string `json:"jsonSchema,omitempty"`

	// SettingsFile path to a custom settings file. Mutually exclusive with Hooks.
	// +optional
	SettingsFile string `json:"settingsFile,omitempty"`

	// SettingSources controls which settings sources are loaded.
	// +optional
	SettingSources string `json:"settingSources,omitempty"`

	// Tools specifies tools to enable.
	// +optional
	Tools []string `json:"tools,omitempty"`

	// AllowedTools restricts which tools can be used.
	// +optional
	AllowedTools []string `json:"allowedTools,omitempty"`

	// DisallowedTools prevents specific tools from being used.
	// +optional
	DisallowedTools []string `json:"disallowedTools,omitempty"`

	// Agents defines JSON-format subagent configurations.
	// +optional
	Agents map[string]runtime.RawExtension `json:"agents,omitempty"`

	// ActiveAgent selects the top-level agent.
	// +optional
	ActiveAgent string `json:"activeAgent,omitempty"`

	// Mode selects the instance process mode.
	// "agent" (default): autonomous coding, new process per prompt, no session persistence.
	// "chat": interactive conversation, persistent process, sessions saved.
	// +kubebuilder:validation:Enum=agent;chat
	// +optional
	Mode *string `json:"mode,omitempty"`

	// IncludePartialMessages enables streaming partial messages.
	// +optional
	IncludePartialMessages *bool `json:"includePartialMessages,omitempty"`
}

type EffortLevel string

type GitSecretReference struct {
	// Name is the name of the Kubernetes Secret in the operator namespace.
	Name string `json:"name"`

	// Key is the key in the Secret data containing the access token. Defaults to "token".
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9._-]+$`
	// +optional
	Key string `json:"key,omitempty"`
}

type InstanceMode string

type InstanceState string

type KlausInstance struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   KlausInstanceSpec   `json:"spec,omitempty"`
	Status KlausInstanceStatus `json:"status,omitempty"`
}

type KlausInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KlausInstance `json:"items"`
}

type KlausInstanceSpec struct {
	// Owner is the user identity (email) that owns this instance.
	// Used for access control and namespace isolation.
	Owner string `json:"owner"`

	// Personality is an OCI reference to a personality artifact that provides
	// default configuration for this instance. The artifact must contain a
	// personality.yaml file describing plugins, image overrides, and system prompts.
	// Example: "gsoci.azurecr.io/giantswarm/personalities/go-dev:latest"
	// +optional
	Personality string `json:"personality,omitempty"`

	// Image overrides the container image for this instance.
	// Takes precedence over personality image and the operator default.
	// +optional
	Image string `json:"image,omitempty"`

	// Claude contains all Claude Code agent configuration.
	// +optional
	Claude ClaudeConfig `json:"claude,omitempty"`

	// Plugins defines OCI image references rendered as Kubernetes image volumes.
	// +optional
	Plugins []PluginReference `json:"plugins,omitempty"`

	// PluginDirs specifies additional user-provided plugin directory paths.
	// These are merged with the OCI plugin mount paths into CLAUDE_PLUGIN_DIRS.
	// +optional
	PluginDirs []string `json:"pluginDirs,omitempty"`

	// ImagePullSecrets specifies pull secrets for private registries used by plugins.
	// These are set on the instance pod spec.
	// +optional
	ImagePullSecrets []string `json:"imagePullSecrets,omitempty"`

	// MCPServers references shared KlausMCPServer CRDs by name.
	// +optional
	MCPServers []MCPServerReference `json:"mcpServers,omitempty"`

	// Skills defines inline skill configurations rendered as SKILL.md files.
	// +optional
	Skills map[string]SkillConfig `json:"skills,omitempty"`

	// AgentFiles defines inline markdown-format subagent definitions.
	// +optional
	AgentFiles map[string]AgentFileConfig `json:"agentFiles,omitempty"`

	// Hooks defines lifecycle hooks rendered to settings.json.
	// Mutually exclusive with Claude.SettingsFile.
	// +optional
	Hooks map[string]runtime.RawExtension `json:"hooks,omitempty"`

	// HookScripts defines executable scripts mounted at /etc/klaus/hooks/.
	// +optional
	HookScripts map[string]string `json:"hookScripts,omitempty"`

	// AddDirs specifies additional directories to load.
	// +optional
	AddDirs []string `json:"addDirs,omitempty"`

	// LoadAdditionalDirsMemory enables CLAUDE_CODE_ADDITIONAL_DIRECTORIES_CLAUDE_MD.
	// +optional
	LoadAdditionalDirsMemory *bool `json:"loadAdditionalDirsMemory,omitempty"`

	// Workspace configures persistent storage for the instance.
	// +optional
	Workspace *WorkspaceConfig `json:"workspace,omitempty"`

	// Resources specifies compute resource requirements for the instance pod.
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`

	// Telemetry configures OpenTelemetry and Prometheus metrics.
	// +optional
	Telemetry *TelemetryConfig `json:"telemetry,omitempty"`

	// Muster configures MCPServer CRD registration in the muster namespace.
	// +optional
	Muster *MusterConfig `json:"muster,omitempty"`

	// Stopped indicates that the instance should be scaled to zero replicas.
	// When true, the controller sets the Deployment replicas to 0 and the
	// instance status transitions to Stopped. Setting this back to false
	// causes the controller to scale the Deployment back to 1 replica.
	// +optional
	Stopped bool `json:"stopped"`
}

type KlausInstanceStatus struct {
	// State is the current lifecycle state.
	// +optional
	State InstanceState `json:"state,omitempty"`

	// Endpoint is the internal service URL for the instance.
	// +optional
	Endpoint string `json:"endpoint,omitempty"`

	// Mode indicates the process mode (agent or chat).
	// +optional
	Mode InstanceMode `json:"mode,omitempty"`

	// LastActivity is the timestamp of the last activity.
	// +optional
	LastActivity *metav1.Time `json:"lastActivity,omitempty"`

	// Personality is the OCI reference of the resolved personality artifact.
	// +optional
	Personality string `json:"personality,omitempty"`

	// PluginCount is the number of plugins loaded.
	// +optional
	PluginCount int `json:"pluginCount,omitempty"`

	// MCPServerCount is the number of MCP servers configured.
	// +optional
	MCPServerCount int `json:"mcpServerCount,omitempty"`

	// Conditions represent the latest available observations of the instance's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ObservedGeneration is the most recent generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Toolchain is the resolved container image name when different from the default.
	// +optional
	Toolchain string `json:"toolchain,omitempty"`
}

type KlausMCPServer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   KlausMCPServerSpec   `json:"spec,omitempty"`
	Status KlausMCPServerStatus `json:"status,omitempty"`
}

type KlausMCPServerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []KlausMCPServer `json:"items"`
}

type KlausMCPServerSpec struct {
	// Type is the transport type (e.g. "streamable-http", "sse", "stdio").
	Type string `json:"type"`

	// URL for HTTP-based MCP servers.
	// +optional
	URL string `json:"url,omitempty"`

	// Command for stdio-based MCP servers.
	// +optional
	Command string `json:"command,omitempty"`

	// Args for stdio-based MCP servers.
	// +optional
	Args []string `json:"args,omitempty"`

	// Env contains static environment variables for the MCP server process.
	// Values support ${VAR} expansion -- the referenced variables are resolved
	// from SecretRefs at pod startup.
	// These are included in the .mcp.json config.
	// +optional
	Env map[string]string `json:"env,omitempty"`

	// Headers contains HTTP headers for HTTP-based MCP servers.
	// Values support ${VAR} expansion -- the referenced variables are resolved
	// from SecretRefs at pod startup.
	// These are included in the .mcp.json config.
	// +optional
	Headers map[string]string `json:"headers,omitempty"`

	// SecretRefs defines Kubernetes Secret references for credential injection.
	// Each entry maps environment variable names to Secret keys, enabling
	// ${VAR} expansion in the MCP config. Secrets must exist in the operator
	// namespace; they are copied to instance user namespaces at reconcile time.
	// +optional
	SecretRefs []MCPServerSecret `json:"secretRefs,omitempty"`
}

type KlausMCPServerStatus struct {
	// Conditions represent the latest available observations of the server's state.
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// InstanceCount is the number of KlausInstance resources referencing this server.
	// +optional
	InstanceCount int `json:"instanceCount,omitempty"`

	// ObservedGeneration is the most recent generation observed by the controller.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
}

type MCPServerReference struct {
	// Name is the name of the KlausMCPServer resource.
	Name string `json:"name"`
}

type MCPServerSecret struct {
	// SecretName is the name of the Kubernetes Secret.
	SecretName string `json:"secretName"`

	// Env maps environment variable names to Secret keys.
	Env map[string]string `json:"env"`
}

type MusterConfig struct {
	// Namespace is the namespace where the MCPServer CRD will be created.
	// +kubebuilder:default=muster
	// +optional
	Namespace string `json:"namespace,omitempty"`

	// ToolPrefix is prepended to tool names in the MCPServer registration.
	// +optional
	ToolPrefix string `json:"toolPrefix,omitempty"`
}

type OTLPConfig struct {
	// Protocol is the OTLP protocol (e.g. "grpc", "http/protobuf").
	// +optional
	Protocol string `json:"protocol,omitempty"`

	// Endpoint is the OTLP endpoint URL.
	// +optional
	Endpoint string `json:"endpoint,omitempty"`

	// Headers are additional OTLP headers.
	// +optional
	Headers string `json:"headers,omitempty"`
}

type PermissionMode string

type PluginReference struct {
	// Repository is the OCI image repository.
	Repository string `json:"repository"`

	// Tag is the image tag. Mutually exclusive with Digest.
	// +optional
	Tag string `json:"tag,omitempty"`

	// Digest is the image digest (sha256:...). Mutually exclusive with Tag.
	// +optional
	Digest string `json:"digest,omitempty"`
}

type SkillConfig struct {
	// Description is the skill description in frontmatter.
	// +optional
	Description string `json:"description,omitempty"`

	// Content is the body text of the SKILL.md file.
	Content string `json:"content"`

	// DisableModelInvocation prevents the model from invoking this skill.
	// +optional
	DisableModelInvocation *bool `json:"disableModelInvocation,omitempty"`

	// UserInvocable allows users to invoke this skill via slash commands.
	// +optional
	UserInvocable *bool `json:"userInvocable,omitempty"`

	// AllowedTools restricts which tools this skill can use.
	// +optional
	AllowedTools []string `json:"allowedTools,omitempty"`

	// Model overrides the model for this skill.
	// +optional
	Model string `json:"model,omitempty"`

	// Context provides additional context configuration.
	// +optional
	Context *runtime.RawExtension `json:"context,omitempty"`

	// Agent assigns this skill to a specific agent.
	// +optional
	Agent string `json:"agent,omitempty"`

	// ArgumentHint provides input hints for the skill.
	// +optional
	ArgumentHint string `json:"argumentHint,omitempty"`
}

type TelemetryConfig struct {
	// Enabled enables telemetry collection.
	// +optional
	Enabled *bool `json:"enabled,omitempty"`

	// MetricsExporter specifies the metrics exporter (e.g. "otlp").
	// +optional
	MetricsExporter string `json:"metricsExporter,omitempty"`

	// LogsExporter specifies the logs exporter (e.g. "otlp").
	// +optional
	LogsExporter string `json:"logsExporter,omitempty"`

	// OTLP contains OTLP exporter configuration.
	// +optional
	OTLP *OTLPConfig `json:"otlp,omitempty"`

	// MetricExportIntervalMs sets the metric export interval in milliseconds.
	// +optional
	MetricExportIntervalMs *int `json:"metricExportIntervalMs,omitempty"`

	// LogsExportIntervalMs sets the logs export interval in milliseconds.
	// +optional
	LogsExportIntervalMs *int `json:"logsExportIntervalMs,omitempty"`

	// LogUserPrompts enables logging of user prompts.
	// +optional
	LogUserPrompts *bool `json:"logUserPrompts,omitempty"`

	// LogToolDetails enables logging of tool details.
	// +optional
	LogToolDetails *bool `json:"logToolDetails,omitempty"`

	// IncludeSessionID includes session ID in telemetry.
	// +optional
	IncludeSessionID *bool `json:"includeSessionId,omitempty"`

	// IncludeVersion includes version in telemetry.
	// +optional
	IncludeVersion *bool `json:"includeVersion,omitempty"`

	// IncludeAccountUUID includes account UUID in telemetry.
	// +optional
	IncludeAccountUUID *bool `json:"includeAccountUuid,omitempty"`

	// ResourceAttributes sets OTEL_RESOURCE_ATTRIBUTES.
	// +optional
	ResourceAttributes string `json:"resourceAttributes,omitempty"`
}

type WorkspaceConfig struct {
	// StorageClass is the storage class for the PVC.
	// +optional
	StorageClass string `json:"storageClass,omitempty"`

	// Size is the requested storage size.
	// +kubebuilder:default="5Gi"
	// +optional
	Size *resource.Quantity `json:"size,omitempty"`

	// GitRepo is a git repository URL to clone into the workspace.
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9@._:/%+~-]+$`
	// +optional
	GitRepo string `json:"gitRepo,omitempty"`

	// GitRef is the git ref to checkout.
	// +kubebuilder:validation:Pattern=`^[a-zA-Z0-9._/^~-]+$`
	// +optional
	GitRef string `json:"gitRef,omitempty"`

	// GitSecretRef references a Secret containing an HTTPS access token for cloning
	// private repositories. The operator copies the Secret to the user namespace and
	// configures the git-clone init container to authenticate using the token.
	// The repository URL must use HTTPS (e.g., https://github.com/org/repo.git).
	// +optional
	GitSecretRef *GitSecretReference `json:"gitSecretRef,omitempty"`
}