config

type Chart struct {
	// Name is a helm-repo chart (repo/chart) or an OCI ref (oci://host/chart).
	Name string `json:"name" yaml:"name"`
	// Version is a chart version or constraint.
	Version string `json:"version" yaml:"version"`
}

type Config struct {
	// Project is a free-form name for the whole platform.
	Project string `json:"project" yaml:"project"`
	// Repositories are chart sources keyed by alias/host. Helm repos (https://)
	// and OCI registries (oci://) live together, distinguished by URL scheme;
	// a value may be a bare URL string or a full object (see Repository).
	Repositories map[string]Repository `json:"repositories" yaml:"repositories"`
	// Releases are the units nelmwave deploys, keyed by release name.
	Releases map[string]Release `json:"releases" yaml:"releases"`
	// contains filtered or unexported fields
}

type FileRef struct {
	// Src is a datasource reference: a local path, or a URL with any gomplate
	// datasource scheme (env:, vault://, s3://, http(s)://, git://, ...).
	// Behaviour is chosen by extension: *.yml/*.yaml are copied, *.yml.tpl are
	// rendered through gomplate, *.sops is decrypted with sops (and *.tpl.sops
	// is decrypted, then rendered).
	Src string `json:"src" yaml:"src"`
	// Name names the resolved artifact file under .nelmwave/ (values or store).
	// Empty means nelmwave derives an index-prefixed basename automatically.
	Name string `json:"name" yaml:"name,omitempty"`
	// Optional skips a source that does not exist instead of failing the build.
	// It covers "the file is not there" (os.ErrNotExist) — a datasource that
	// exists but errors (HTTP 500, a broken template) still fails.
	Optional bool `json:"optional" yaml:"optional,omitempty"`
}

type LabelSelectorRequirement struct {
	Key      string   `json:"key" yaml:"key"`
	Operator string   `json:"operator" yaml:"operator"`
	Values   []string `json:"values" yaml:"values,omitempty"`
}

type Namespace struct {
	// Create makes nelmwave ensure the namespace exists before applying
	// (nelm's NoCreateNamespace = !Create).
	Create bool `json:"create" yaml:"create" default:"true"`
	// Delete removes the namespace after the release is uninstalled (nelm's
	// DeleteReleaseNamespace). It is deliberately not the mirror of Create: the
	// namespace is not owned by the release, so deleting it takes everything
	// else living there with it. Off unless asked for.
	Delete bool `json:"delete" yaml:"delete,omitempty"`
	// Annotations are applied to the namespace itself. They are merged into
	// whatever is already there; nelmwave never removes annotations it does not
	// manage.
	Annotations map[string]string `json:"annotations" yaml:"annotations,omitempty"`
	// Labels are applied to the namespace itself, with the same merge semantics
	// as Annotations. Useful for policy selectors such as
	// pod-security.kubernetes.io/enforce or istio-injection.
	Labels map[string]string `json:"labels" yaml:"labels,omitempty"`
}

type NeedRelease struct {
	// Optional lets the run proceed when this dependency is filtered out of the
	// selection: the edge is dropped with a warning instead of failing. By
	// default a declared dependency is required, matching what `optional` means
	// for values and stores.
	Optional bool `json:"optional" yaml:"optional,omitempty"`
}

type Needs struct {
	// Releases lists explicit dependencies keyed by uniqname
	// ("name[@namespace[@kubecontext]]"). The value carries per-dependency
	// options (currently Optional); it is a struct so more can be added.
	Releases map[string]NeedRelease `json:"releases" yaml:"releases,omitempty"`
	// MatchLabels selects dependency releases by exact label match.
	MatchLabels map[string]string `json:"matchLabels" yaml:"matchLabels,omitempty"`
	// MatchLabelsExpressions selects dependency releases by set-based label
	// requirements (operators In, NotIn, Exists, DoesNotExist).
	MatchLabelsExpressions []LabelSelectorRequirement `json:"matchLabelsExpressions" yaml:"matchLabelsExpressions,omitempty"`
}

type Release struct {
	// Labels are used for k8s-style selection (-l) and are free-form. They also
	// end up on the release storage object (see release.Spec.Labels).
	Labels map[string]string `json:"labels" yaml:"labels"`
	// Annotations are stored with each revision of the release (nelm's
	// ReleaseInfoAnnotations) and read back via `nelm release get`. Unlike
	// Labels they cannot be selected on, and unlike Kubernetes annotations they
	// are not attached to any object — so pipeline URLs, commit messages and
	// other things too long or too punctuated to be a label fit here.
	//
	// These describe the release, not its resources: annotations for every
	// rendered resource are a separate concern (nelm's ExtraAnnotations).
	Annotations map[string]string `json:"annotations" yaml:"annotations,omitempty"`
	// Needs declares the releases that must be applied before this one (DAG
	// edges), by explicit uniqname and/or by label selector.
	Needs Needs `json:"needs" yaml:"needs,omitempty"`

	// Chart points at a helm-repo or OCI chart. Always required: nelmwave
	// orchestrates external charts only and ships no templates of its own.
	Chart Chart `json:"chart" yaml:"chart"`

	// Values are per-release value sources, merged on top of global Values.
	Values []FileRef `json:"values" yaml:"values"`
	// Sets are inline chart value overrides applied on top of Values (highest
	// precedence). Keys are dotted paths (like helm --set, e.g. "image.tag");
	// values keep their YAML type (int/string/bool/...). Passed to nelm as
	// type-preserving JSON overrides.
	Sets map[string]any `json:"sets" yaml:"sets,omitempty"`
	// Stores are companion files resolved and stored alongside the plan.
	Stores []FileRef `json:"stores" yaml:"stores"`

	// Namespace configures the release's namespace — not which namespace it is
	// (that comes from the release key), but whether nelmwave creates it and what
	// metadata it carries.
	Namespace Namespace `json:"namespace" yaml:"namespace,omitempty"`

	// Timeout bounds the operation, e.g. "5m". Empty means nelm's default.
	Timeout string `json:"timeout" yaml:"timeout,omitempty"`
	// AutoRollback rolls back to the last deployed revision on failure
	// (nelm AutoRollback, akin to helm --atomic).
	AutoRollback bool `json:"autoRollback" yaml:"autoRollback,omitempty"`

	// ForceAdoption takes over a resource that another Helm release claims via
	// meta.helm.sh/release-name. Without it nelm refuses to touch it, which is
	// what you want everywhere except migrations and release renames.
	ForceAdoption bool `json:"forceAdoption" yaml:"forceAdoption,omitempty"`
	// RemoveManualChanges reclaims fields added to a resource by hand (kubectl
	// edit) that the manifest does not mention. On by default, as in nelm; set
	// it to false to leave such fields alone.
	RemoveManualChanges bool `json:"removeManualChanges" yaml:"removeManualChanges" default:"true"`
	// InstallCRDs installs the CRDs shipped in the chart's crds/ directory. On
	// by default; turn it off where CRDs are managed by a separate pipeline.
	InstallCRDs bool `json:"installCRDs" yaml:"installCRDs" default:"true"`
	// DeletePropagation is the default deletion strategy for this release's
	// resources: Foreground (nelm's default), Background or Orphan. A single
	// resource can still override it with werf.io/delete-propagation.
	DeletePropagation string `json:"deletePropagation" yaml:"deletePropagation,omitempty"`
	// HistoryLimit caps how many revisions of this release are kept in storage.
	// 0 leaves nelm's default of 10.
	HistoryLimit int `json:"historyLimit" yaml:"historyLimit,omitempty"`
	// DriverURL says where the release's state is kept, as a URL:
	// kubernetes://secrets (the default), kubernetes://configmaps, or
	// psql://user@host/db. See ParseDriverURL.
	//
	// Usually set once in the top-level Release: block — a manifest whose
	// releases keep state in different places is a good way to lose one.
	DriverURL string `json:"driverURL" yaml:"driverURL,omitempty"`
}

type Repository struct {
	// URL is the repository index URL (https://...) or OCI registry
	// (oci://... / oci+http://...).
	URL string `json:"url" yaml:"url"`
	// Username / Password are optional basic-auth credentials.
	Username string `json:"username" yaml:"username,omitempty"`
	Password string `json:"password" yaml:"password,omitempty"`
	// InsecureSkipTLSVerify disables TLS verification for this repo.
	InsecureSkipTLSVerify bool `json:"insecureSkipTLSVerify" yaml:"insecureSkipTLSVerify,omitempty"`
	// PassCredentials forwards credentials to all domains, not just the repo host.
	PassCredentials bool `json:"passCredentials" yaml:"passCredentials,omitempty"`
	// CAFile is a path to a CA bundle for this repo.
	CAFile string `json:"caFile" yaml:"caFile,omitempty"`
	// CertFile / KeyFile are the client TLS certificate and key presented to the
	// repository (mTLS). CAFile says whom we trust; these say who we are.
	CertFile string `json:"certFile" yaml:"certFile,omitempty"`
	KeyFile  string `json:"keyFile" yaml:"keyFile,omitempty"`
	// SkipUpdate stops the chart's declared dependencies from being refreshed
	// against the repository before they are pulled. It only affects charts with
	// a dependencies: section — the chart itself is fetched either way.
	SkipUpdate bool `json:"skipUpdate" yaml:"skipUpdate,omitempty"`
	// RequestTimeout bounds a single request to the repository, e.g. "30s".
	// Empty means no per-request limit (the release timeout still applies).
	RequestTimeout string `json:"requestTimeout" yaml:"requestTimeout,omitempty"`
	// ProvenanceStrategy decides whether a chart's PGP signature (its .prov
	// file) is verified before the chart is used: never (nelm's default),
	// if-possible, always, later. Empty means never.
	ProvenanceStrategy string `json:"provenanceStrategy" yaml:"provenanceStrategy,omitempty"`
	// ProvenanceKeyring is the path to a keyring with the public keys the
	// signature is checked against. Empty leaves helm's default
	// (~/.gnupg/pubring.gpg).
	ProvenanceKeyring string `json:"provenanceKeyring" yaml:"provenanceKeyring,omitempty"`
}

type ResolvedNeed struct {
	Uniqname string
	Optional bool
}

type StorageDriver struct {
	// Driver is nelm's ReleaseStorageDriver ("secrets", "configmaps", "sql").
	// Empty means the manifest said nothing and nelm's default applies.
	Driver string
	// SQLConnection is the libpq connection string, set only for sql.
	SQLConnection string
	// HasPassword reports whether the URL embedded a password. Callers warn
	// about it: a password in the manifest is written to the planfile as-is.
	HasPassword bool
}

type Uniqname struct {
	Name        string
	Namespace   string
	KubeContext string
}