v1alpha1

type BlockClearanceDetails struct {
	// ClearedAt is the timestamp when the block was cleared
	// +optional
	ClearedAt metav1.Time `json:"clearedAt"`

	// ClearedBy is the Kubernetes user who cleared the block
	// Extracted from request context (if available) or annotation value
	// Format: username@domain or service-account:namespace:name
	// Example: "admin@kubernaut.ai" or "service-account:kubernaut-system:operator"
	ClearedBy string `json:"clearedBy"`

	// ClearReason is the operator-provided reason for clearing
	// Required for audit trail accountability
	// Example: "manual investigation complete, cluster state verified"
	ClearReason string `json:"clearReason"`

	// ClearMethod indicates how the block was cleared
	// Annotation: Via kubernaut.ai/clear-execution-block annotation
	// APIEndpoint: Via dedicated clearing API endpoint (future)
	// StatusField: Via direct status field update (future)
	// +kubebuilder:validation:Enum=Annotation;APIEndpoint;StatusField
	ClearMethod string `json:"clearMethod"`
}

type ExecutionConfig struct {
	// Timeout for the entire workflow (Tekton PipelineRun timeout)
	// Default: use global timeout from RemediationRequest or 30m
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
}

type ExecutionStatusSummary struct {
	// Status of the execution resource (Unknown, True, False)
	Status corev1.ConditionStatus `json:"status"`

	// Reason from the execution resource (e.g., "Succeeded", "Failed", "Running")
	// +optional
	Reason string `json:"reason,omitempty"`

	// Message from the execution resource
	// +optional
	Message string `json:"message,omitempty"`

	// CompletedTasks count
	// +optional
	CompletedTasks int `json:"completedTasks,omitempty"`

	// TotalTasks count (from pipeline spec)
	// +optional
	TotalTasks int `json:"totalTasks,omitempty"`
}

type FailureDetails struct {
	// FailedTaskIndex is 0-indexed position of failed task in pipeline
	FailedTaskIndex int `json:"failedTaskIndex"`

	// FailedTaskName is the name of the failed Tekton Task
	FailedTaskName string `json:"failedTaskName"`

	// FailedStepName is the name of the failed step within the task (if available)
	// Tekton tasks can have multiple steps; this identifies the specific step
	// +optional
	FailedStepName string `json:"failedStepName,omitempty"`

	// Reason is a Kubernetes-style reason code
	// Used for deterministic failure classification by RO
	// +kubebuilder:validation:Enum=OOMKilled;DeadlineExceeded;Forbidden;ResourceExhausted;ConfigurationError;ImagePullBackOff;TaskFailed;UnsupportedEngine;Unknown
	Reason string `json:"reason"`

	// Message is human-readable error message (for logging/UI/notifications)
	Message string `json:"message"`

	// ExitCode from container (if applicable)
	// Useful for script-based tasks that return specific exit codes
	// +optional
	ExitCode *int32 `json:"exitCode,omitempty"`

	// FailedAt is the timestamp when the failure occurred
	FailedAt metav1.Time `json:"failedAt"`

	// ExecutionTimeBeforeFailure is how long the workflow ran before failing
	// +optional
	ExecutionTimeBeforeFailure *metav1.Duration `json:"executionTimeBeforeFailure,omitempty"`

	// NaturalLanguageSummary is a human/LLM-readable failure description
	// Generated by WE controller from structured data above
	// Used by:
	//   - RO: Included in failure notifications
	//   - Notification: Included in user-facing failure alerts
	NaturalLanguageSummary string `json:"naturalLanguageSummary"`

	// WasExecutionFailure indicates whether the failure occurred during workflow execution
	// true = workflow RAN and failed (non-idempotent actions may have occurred)
	// false = workflow failed BEFORE execution (validation, image pull, quota, etc.)
	// CRITICAL: Execution failures (true) block ALL future retries for this target
	//           Pre-execution failures (false) get exponential backoff
	// +optional
	WasExecutionFailure bool `json:"wasExecutionFailure,omitempty"`
}

type WorkflowExecution struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   WorkflowExecutionSpec   `json:"spec,omitempty"`
	Status WorkflowExecutionStatus `json:"status,omitempty"`
}

type WorkflowExecutionList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []WorkflowExecution `json:"items"`
}

type WorkflowExecutionSpec struct {
	// RemediationRequestRef references the parent RemediationRequest CRD
	RemediationRequestRef corev1.ObjectReference `json:"remediationRequestRef"`

	// WorkflowRef contains the workflow catalog reference
	// Resolved from AIAnalysis.Status.SelectedWorkflow by RemediationOrchestrator
	WorkflowRef WorkflowRef `json:"workflowRef"`

	// TargetResource identifies the K8s resource being remediated
	// Used for resource locking (DD-WE-001) - prevents parallel workflows on same target
	// Format: "namespace/kind/name" for namespaced resources
	//         "kind/name" for cluster-scoped resources
	// Example: "payment/deployment/payment-api", "node/worker-node-1"
	TargetResource string `json:"targetResource"`

	// Parameters from LLM selection (per DD-WORKFLOW-003)
	// Keys are UPPER_SNAKE_CASE for Tekton PipelineRun params
	// +optional
	Parameters map[string]string `json:"parameters,omitempty"`

	// Confidence score from LLM (for audit trail)
	// +optional
	Confidence float64 `json:"confidence,omitempty"`

	// Rationale from LLM (for audit trail)
	// +optional
	Rationale string `json:"rationale,omitempty"`

	// ExecutionConfig contains minimal execution settings
	// +optional
	ExecutionConfig *ExecutionConfig `json:"executionConfig,omitempty"`
}

type WorkflowExecutionStatus struct {
	// ObservedGeneration is the most recent generation observed by the controller.
	// Used to prevent duplicate reconciliations and ensure idempotency.
	// Per DD-CONTROLLER-001: Standard pattern for all Kubernetes controllers.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Phase tracks current execution stage
	// V1.0: Skipped phase removed - RO makes routing decisions before WFE creation
	// +kubebuilder:validation:Enum=Pending;Running;Completed;Failed
	// +optional
	Phase string `json:"phase,omitempty"`

	// StartTime when execution started
	// +optional
	StartTime *metav1.Time `json:"startTime,omitempty"`

	// CompletionTime when execution completed (success or failure)
	// +optional
	CompletionTime *metav1.Time `json:"completionTime,omitempty"`

	// Duration of the execution
	// +optional
	Duration *metav1.Duration `json:"duration,omitempty"`

	// ExecutionRef references the created execution resource (PipelineRun or Job)
	// +optional
	ExecutionRef *corev1.LocalObjectReference `json:"executionRef,omitempty"`

	// ExecutionStatus mirrors key execution resource status fields
	// +optional
	ExecutionStatus *ExecutionStatusSummary `json:"executionStatus,omitempty"`

	// FailureReason explains why execution failed (if applicable)
	// DEPRECATED: Use FailureDetails for structured failure information
	// +optional
	FailureReason string `json:"failureReason,omitempty"`

	// FailureDetails contains structured failure information
	// Populated when Phase=Failed
	// +optional
	FailureDetails *FailureDetails `json:"failureDetails,omitempty"`

	// BlockClearance tracks the clearing of PreviousExecutionFailed blocks
	// When set, allows new executions despite previous execution failure
	// Preserves audit trail of WHO cleared the block and WHY
	// +optional
	BlockClearance *BlockClearanceDetails `json:"blockClearance,omitempty"`

	// EphemeralCredentialIDs stores AWX credential IDs created by the ansible
	// executor for cleanup after execution (BR-WE-015). Written via the status
	// subresource to avoid violating spec immutability (ADR-001).
	// +optional
	EphemeralCredentialIDs []int `json:"ephemeralCredentialIDs,omitempty"`

	// ExecutionEngine is the backend engine resolved from the DS workflow catalog
	// at runtime by the WE controller. Set once during Pending phase via
	// WorkflowQuerier.GetWorkflowExecutionEngine; immutable thereafter.
	// Values: "tekton", "job", "ansible".
	// +optional
	ExecutionEngine string `json:"executionEngine,omitempty"`

	// ServiceAccountName is the pre-existing ServiceAccount resolved from the
	// DS workflow catalog at runtime by the WE controller (Issue #650).
	// Set once during Pending phase via ResolveWorkflowCatalogMetadata; immutable
	// thereafter. If empty, K8s assigns the namespace's default SA (Job/Tekton)
	// or the Ansible executor falls back to the controller's in-cluster credentials.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// Conditions provide detailed status information
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type WorkflowRef struct {
	// WorkflowID is the catalog lookup key
	WorkflowID string `json:"workflowId"`

	// Version of the workflow
	Version string `json:"version"`

	// ExecutionBundle resolved from workflow catalog (Data Storage API)
	// OCI bundle reference for Tekton PipelineRun
	ExecutionBundle string `json:"executionBundle"`

	// ExecutionBundleDigest for audit trail and reproducibility
	// +optional
	ExecutionBundleDigest string `json:"executionBundleDigest,omitempty"`

	// EngineConfig holds engine-specific configuration (BR-WE-016).
	// For ansible: {"playbookPath": "...", "jobTemplateName": "...", "inventoryName": "..."}
	// For tekton/job: nil.
	// +kubebuilder:pruning:PreserveUnknownFields
	// +optional
	EngineConfig *apiextensionsv1.JSON `json:"engineConfig,omitempty"`
}