controller

type AggregationResult struct {
	// Rendered is the cloudflared config.yaml content.
	Rendered []byte
	// ConfigHash is sha256 of Rendered, hex-encoded.
	ConfigHash string
	// Decisions maps ruleKey -> per-rule verdict.
	Decisions map[types.NamespacedName]RuleDecision
}

type CloudflareDNSRecordReconciler struct {
	client.Client
	Scheme        *runtime.Scheme
	Recorder      record.EventRecorder
	ClientFactory *cfclient.ClientFactory
	IPResolver    *ipresolver.Resolver
	DNSClientFn   func(apiToken string) cfclient.DNSClient
	// Registry holds optional TXT-registry configuration. The zero value
	// (TxtOwnerID == "") disables all registry behaviour.
	Registry RegistryConfig
}

type CloudflareRulesetReconciler struct {
	client.Client
	Scheme          *runtime.Scheme
	Recorder        record.EventRecorder
	ClientFactory   *cfclient.ClientFactory
	RulesetClientFn func(apiToken string) cfclient.RulesetClient
}

type CloudflareTunnelReconciler struct {
	client.Client
	Scheme         *runtime.Scheme
	Recorder       record.EventRecorder
	ClientFactory  *cfclient.ClientFactory
	TunnelClientFn func(apiToken string) cfclient.TunnelClient
}

type CloudflareZoneConfigReconciler struct {
	client.Client
	Scheme        *runtime.Scheme
	Recorder      record.EventRecorder
	ClientFactory *cfclient.ClientFactory
	ZoneClientFn  func(apiToken string) cfclient.ZoneClient
}

type CloudflareZoneReconciler struct {
	client.Client
	Scheme                *runtime.Scheme
	Recorder              record.EventRecorder
	ClientFactory         *cfclient.ClientFactory
	ZoneLifecycleClientFn func(apiToken string) cfclient.ZoneLifecycleClient
}

type ConnectorResourceNames struct {
	Deployment     string
	ConfigMap      string
	ServiceAccount string
}

type HTTPRouteSourceReconciler struct {
	client.Client
	Recorder    record.EventRecorder
	TxtOwnerID  string
	AffixConfig cfclient.AffixConfig
}

type RegistryAction string

type RegistryConfig struct {
	// TxtOwnerID is the ownership token written into companion TXT records.
	// Required to enable registry behaviour. When empty, all registry checks
	// are skipped and the controller behaves identically to pre-registry releases.
	TxtOwnerID string

	// TxtImportOwners enumerates prior controllers (e.g. "external-dns") whose
	// TXT records this operator may adopt. A TXT whose payload.Owner appears in
	// this list, and whose payload is otherwise valid, results in
	// RegistryActionAdopt — this controller rewrites the TXT to claim the record.
	TxtImportOwners []string // restore — plan §11.3

	// AffixConfig controls companion-TXT name derivation.
	// The zero value matches external-dns's default affix scheme.
	AffixConfig cfclient.AffixConfig

	// TxtEncryptAESKey is an optional 32-byte AES-256 key.  When non-nil,
	// companion TXT payloads are AES-CBC encrypted before writing.
	// When nil (the default), payloads are written as plaintext.
	TxtEncryptAESKey []byte

	// TxtImportDecryptKeys is a list of AES-256 keys tried in order when
	// decoding an existing companion TXT. Supports key rotation: include the
	// old key here and the new key in TxtEncryptAESKey.
	// When empty/nil, only plaintext incoming TXTs can be read. Encrypted TXT
	// records will fail to decrypt and route to RefuseForeignOwner.
	TxtImportDecryptKeys [][]byte
}

type RuleDecision struct {
	Status          RuleDecisionStatus
	Message         string
	ResolvedBackend string // URL actually written to config.yaml; "" if not included
}

type RuleDecisionStatus string

type ServiceSourceReconciler struct {
	client.Client
	Recorder    record.EventRecorder
	TxtOwnerID  string
	AffixConfig cfclient.AffixConfig
}

type TargetKind string

type TargetSpec struct {
	Kind  TargetKind
	Name  string // populated when Kind=Tunnel
	CNAME string // populated when Kind=CNAME
}