v1alpha1

type BlockedRelease struct {
	// Tag is the image tag of the blocked release candidate.
	// +kubebuilder:validation:Required
	// +required
	Tag string `json:"tag"`

	// RequiredVersion is the version constraint the candidate places on the
	// provider's contract, verbatim from its requires annotation.
	// +optional
	RequiredVersion *string `json:"requiredVersion,omitempty"`

	// Reason is a short, machine-readable reason the candidate is blocked.
	// +optional
	Reason string `json:"reason,omitempty"`
}

type ClusterRolloutSchedule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterRolloutScheduleSpec   `json:"spec,omitempty"`
	Status ClusterRolloutScheduleStatus `json:"status,omitempty"`
}

type ClusterRolloutScheduleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterRolloutSchedule `json:"items"`
}

type ClusterRolloutScheduleSpec struct {
	// RolloutSelector is a label selector to match Rollouts across namespaces.
	// +required
	RolloutSelector *metav1.LabelSelector `json:"rolloutSelector"`

	// NamespaceSelector is a label selector to match namespaces.
	// If empty, applies to all namespaces.
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`

	// Rules is a list of schedule rules.
	// The schedule is active if ANY rule matches the current time/date.
	// +required
	// +kubebuilder:validation:MinItems=1
	Rules []ScheduleRule `json:"rules"`

	// Timezone is the IANA timezone for the schedule (e.g., "America/New_York").
	// Defaults to "UTC" if not specified.
	// +kubebuilder:default="UTC"
	// +optional
	Timezone string `json:"timezone,omitempty"`

	// Action defines what to do when the schedule is active.
	// - "Allow": Gate passes when active, blocks when inactive
	// - "Deny": Gate blocks when active, passes when inactive
	// +kubebuilder:default="Deny"
	// +optional
	Action RolloutScheduleAction `json:"action,omitempty"`
}

type ClusterRolloutScheduleStatus struct {
	// Active indicates if the schedule is currently active (any rule matches).
	// +optional
	Active bool `json:"active,omitempty"`

	// ActiveRules is a list of rule names that are currently active.
	// +optional
	ActiveRules []string `json:"activeRules,omitempty"`

	// NextTransition is the timestamp when the active state will next change.
	// +optional
	NextTransition *metav1.Time `json:"nextTransition,omitempty"`

	// ManagedGates is a list of RolloutGate names being managed by this schedule.
	// Format: "namespace/name"
	// +optional
	ManagedGates []string `json:"managedGates,omitempty"`

	// MatchingRollouts is the count of rollouts currently matched by the selectors.
	// +optional
	MatchingRollouts int `json:"matchingRollouts,omitempty"`

	// Conditions represents the current state of the schedule.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DateRange struct {
	// Start date in YYYY-MM-DD format
	// +kubebuilder:validation:Pattern=`^\d{4}-\d{2}-\d{2}$`
	// +required
	Start string `json:"start"`

	// End date in YYYY-MM-DD format
	// +kubebuilder:validation:Pattern=`^\d{4}-\d{2}-\d{2}$`
	// +required
	End string `json:"end"`
}

type DayOfWeek string

type DeploymentHistoryEntry struct {
	// ID is a unique auto-incrementing identifier for this history entry.
	// +optional
	ID *int64 `json:"id,omitempty"`

	// Version is the version information that was deployed.
	// +kubebuilder:validation:Required
	// +required
	Version VersionInfo `json:"version"`

	// Timestamp is the time when the deployment occurred.
	// +kubebuilder:validation:Required
	// +required
	Timestamp metav1.Time `json:"timestamp"`

	// Message provides a descriptive message about this deployment entry
	// This field contains human-readable information about the deployment context.
	// For automatic deployments, it includes information about gate bypass and failed bake unblock.
	// For manual deployments (when wantedVersion is specified), it can contain a custom message
	// provided via the "rollout.kuberik.com/deployment-message" annotation, or defaults to "Manual deployment".
	// +optional
	Message *string `json:"message,omitempty"`

	// TriggeredBy indicates what triggered this deployment.
	// Kind can be "User" for manual deployments triggered by a user, or "System" for automatic deployments.
	// Name contains the name of the user or system that triggered the deployment.
	// For user-triggered deployments, this is extracted from the "rollout.kuberik.com/deploy-user" annotation.
	// For system-triggered deployments, this is typically "rollout-controller".
	// +optional
	TriggeredBy *TriggeredByInfo `json:"triggeredBy,omitempty"`

	// BakeStatus tracks the bake state for this deployment (e.g., None, InProgress, Succeeded, Failed, Cancelled)
	// The bake process ensures that the deployment is stable and healthy before marking as successful.
	// +optional
	BakeStatus *string `json:"bakeStatus,omitempty"`

	// BakeStatusMessage provides details about the bake state for this deployment
	// This field contains human-readable information about why the bake status is what it is.
	// +optional
	BakeStatusMessage *string `json:"bakeStatusMessage,omitempty"`

	// BakeStartTime is the time when the bake period started for this deployment
	// This is when the rollout controller began monitoring the deployment for stability.
	// +optional
	BakeStartTime *metav1.Time `json:"bakeStartTime,omitempty"`

	// BakeEndTime is the time when the bake period ended for this deployment
	// This is when the bake process completed (either successfully or with failure).
	// +optional
	BakeEndTime *metav1.Time `json:"bakeEndTime,omitempty"`

	// FailedHealthChecks contains all health checks that failed during bake.
	// This field is populated when bake fails due to health check errors.
	// +optional
	FailedHealthChecks []FailedHealthCheck `json:"failedHealthChecks,omitempty"`

	// LastRetryTimestamp is the time when a retry was most recently requested for this deployment.
	// When set, downstream controllers (health checks, kruise rollout step gates) use this as a
	// cutoff: stale failure conditions with LastTransitionTime older than LastRetryTimestamp are
	// ignored as they reflect the pre-retry state.
	// +optional
	LastRetryTimestamp *metav1.Time `json:"lastRetryTimestamp,omitempty"`
}

type FailedHealthCheck struct {
	// Name is the name of the health check.
	// +kubebuilder:validation:Required
	// +required
	Name string `json:"name"`

	// Namespace is the namespace of the health check.
	// +kubebuilder:validation:Required
	// +required
	Namespace string `json:"namespace"`

	// Message is the error message from the health check.
	// +optional
	Message *string `json:"message,omitempty"`
}

type HealthCheck struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   HealthCheckSpec   `json:"spec,omitempty"`
	Status HealthCheckStatus `json:"status,omitempty"`
}

type HealthCheckList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []HealthCheck `json:"items"`
}

type HealthCheckSelectorConfig struct {
	// Selector specifies the label selector for matching HealthChecks
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`

	// NamespaceSelector specifies the namespace selector for matching HealthChecks
	// If not specified, only HealthChecks in the same namespace as the Rollout will be considered
	// +optional
	NamespaceSelector *metav1.LabelSelector `json:"namespaceSelector,omitempty"`
}

type HealthCheckSpec struct {
	// Class specifies the type of health check (e.g., 'kustomization')
	// +optional
	Class *string `json:"class,omitempty"`
}

type HealthCheckStatus struct {
	// Status indicates the health state of the check (e.g., 'Healthy', 'Unhealthy', 'Pending')
	// +optional
	Status HealthStatus `json:"status,omitempty"`

	// LastErrorTime is the timestamp of the most recent error state
	// +optional
	LastErrorTime *metav1.Time `json:"lastErrorTime,omitempty"`

	// Message provides additional details about the health status
	// +optional
	Message *string `json:"message,omitempty"`

	// LastChangeTime is the timestamp when the health status last changed
	// +optional
	LastChangeTime *metav1.Time `json:"lastChangeTime,omitempty"`
}

type HealthStatus string

type ProviderRolloutReference struct {
	// Name is the name of the providing Rollout.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`

	// Namespace is the namespace of the providing Rollout.
	// Defaults to the namespace of the RolloutDependency.
	// +optional
	Namespace *string `json:"namespace,omitempty"`
}

type Repository struct {
	// The URL of the repository
	// +kubebuilder:validation:Required
	// +required
	URL string `json:"url,omitempty"`

	// The secret name containing the authentication credentials
	// +optional
	Auth *corev1.LocalObjectReference `json:"secretRef,omitempty"`
}

type Rollout struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RolloutSpec   `json:"spec,omitempty"`
	Status RolloutStatus `json:"status,omitempty"`
}

type RolloutDependency struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of RolloutDependency
	// +required
	Spec RolloutDependencySpec `json:"spec"`

	// status defines the observed state of RolloutDependency
	// +optional
	Status RolloutDependencyStatus `json:"status,omitzero"`
}

type RolloutDependencyList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []RolloutDependency `json:"items"`
}

type RolloutDependencySpec struct {
	// RolloutRef references the consumer Rollout that this dependency gates.
	// The Rollout must live in the same namespace as this RolloutDependency.
	//
	// The name is validated here because corev1.LocalObjectReference defaults it
	// to the empty string, which would otherwise be admitted and then fail every
	// lookup.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self.name != ”",message="rolloutRef.name must not be empty"
	// +required
	RolloutRef corev1.LocalObjectReference `json:"rolloutRef"`

	// ProviderRef references the Rollout that provides the contract.
	// +kubebuilder:validation:Required
	// +required
	ProviderRef ProviderRolloutReference `json:"providerRef"`

	// Contract is the contract name matched against the consumer's
	// "com.kuberik.rollout.requires.<contract>" annotations.
	// Defaults to the name of the provider Rollout.
	// +optional
	Contract *string `json:"contract,omitempty"`
}

type RolloutDependencyStatus struct {
	// conditions represent the current state of the RolloutDependency resource.
	//
	// Condition types:
	// - "Ready": the dependency was evaluated and its gate is in sync
	// - "Satisfied": no release the consumer could deploy next is held back by
	//   this dependency
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ProvidedVersion is the contract version currently deployed by the provider
	// Rollout, taken from the OCI version annotation of its deployed release with
	// the numeric per-build ordinal stripped. A real pre-release identifier
	// ("2.0.0-alpha.1") is preserved, because it means the triple has not
	// shipped.
	// +optional
	ProvidedVersion *string `json:"providedVersion,omitempty"`

	// ProvidedTag is the image tag of the provider release that ProvidedVersion
	// was read from.
	// +optional
	ProvidedTag *string `json:"providedTag,omitempty"`

	// AdmittedVersions lists the consumer release candidate tags admitted by this
	// dependency. This is the allow list published to the managed RolloutGate.
	// Named for symmetry with RolloutGate.allowedVersions, which also holds tags.
	// Capped at the newest entries; see maxPublishedReleases.
	// +kubebuilder:validation:MaxItems=50
	// +optional
	AdmittedVersions []string `json:"admittedVersions,omitempty"`

	// BlockedReleases lists the consumer release candidates held back by this
	// dependency, with the constraint each places on the contract.
	// Capped at the newest entries; see maxPublishedReleases.
	// +kubebuilder:validation:MaxItems=50
	// +optional
	BlockedReleases []BlockedRelease `json:"blockedReleases,omitempty"`

	// GateName is the name of the RolloutGate managed by this dependency.
	// +optional
	GateName string `json:"gateName,omitempty"`
}

type RolloutGate struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RolloutGateSpec   `json:"spec,omitempty"`
	Status RolloutGateStatus `json:"status,omitempty"`
}

type RolloutGateList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RolloutGate `json:"items"`
}

type RolloutGateSpec struct {
	// +required
	RolloutRef *corev1.LocalObjectReference `json:"rolloutRef"`

	// Passing is true if the RolloutGate is passing.
	// +required
	// +default=true
	Passing *bool `json:"passing,omitempty"`

	// AllowedVersions is a list of versions that Rollout can be updated to.
	// +optional
	AllowedVersions *[]string `json:"allowedVersions,omitempty"`
}

type RolloutGateStatus struct {
}

type RolloutGateStatusSummary struct {
	// Name is the name of the gate.
	// +kubebuilder:validation:Required
	// +required
	Name string `json:"name"`

	// Passing is true if the gate is passing, false if it is blocking.
	// +optional
	Passing *bool `json:"passing,omitempty"`

	// AllowedVersions is a list of versions that are allowed by the gate.
	// +optional
	AllowedVersions []string `json:"allowedVersions"`

	// Message is a message describing the status of the gate.
	// +optional
	Message string `json:"message,omitempty"`

	// BypassGates indicates whether this gate was bypassed for the current deployment.
	// +kubebuilder:validation:Optional
	// +optional
	BypassGates bool `json:"bypassGates,omitempty"`
}

type RolloutList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Rollout `json:"items"`
}

type RolloutSchedule struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RolloutScheduleSpec   `json:"spec,omitempty"`
	Status RolloutScheduleStatus `json:"status,omitempty"`
}

type RolloutScheduleAction string

type RolloutScheduleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RolloutSchedule `json:"items"`
}

type RolloutScheduleSpec struct {
	// RolloutSelector is a label selector to match Rollouts in the same namespace.
	// +required
	RolloutSelector *metav1.LabelSelector `json:"rolloutSelector"`

	// Rules is a list of schedule rules.
	// The schedule is active if ANY rule matches the current time/date.
	// +required
	// +kubebuilder:validation:MinItems=1
	Rules []ScheduleRule `json:"rules"`

	// Timezone is the IANA timezone for the schedule (e.g., "America/New_York").
	// Defaults to "UTC" if not specified.
	// +kubebuilder:default="UTC"
	// +optional
	Timezone string `json:"timezone,omitempty"`

	// Action defines what to do when the schedule is active.
	// - "Allow": Gate passes when active, blocks when inactive
	// - "Deny": Gate blocks when active, passes when inactive
	// +kubebuilder:default="Deny"
	// +optional
	Action RolloutScheduleAction `json:"action,omitempty"`
}

type RolloutScheduleStatus struct {
	// Active indicates if the schedule is currently active (any rule matches).
	// +optional
	Active bool `json:"active,omitempty"`

	// ActiveRules is a list of rule names that are currently active.
	// +optional
	ActiveRules []string `json:"activeRules,omitempty"`

	// NextTransition is the timestamp when the active state will next change.
	// +optional
	NextTransition *metav1.Time `json:"nextTransition,omitempty"`

	// ManagedGates is a list of RolloutGate names being managed by this schedule.
	// +optional
	ManagedGates []string `json:"managedGates,omitempty"`

	// MatchingRollouts is the count of rollouts currently matched by the selector.
	// +optional
	MatchingRollouts int `json:"matchingRollouts,omitempty"`

	// Conditions represents the current state of the schedule.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type RolloutSpec struct {
	// ReleasesImagePolicy specifies the ImagePolicy that provides available releases
	// +kubebuilder:validation:Required
	// +required
	ReleasesImagePolicy corev1.LocalObjectReference `json:"releasesImagePolicy,omitempty"`

	// WantedVersion specifies a specific version to deploy, overriding the automatic version selection
	// +optional
	WantedVersion *string `json:"wantedVersion,omitempty"`

	// VersionHistoryLimit defines the maximum number of entries to keep in the deployment history
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=10
	// +optional
	VersionHistoryLimit *int32 `json:"versionHistoryLimit,omitempty"`

	// AvailableReleasesRetentionDays defines how many days of available releases to keep based on creation timestamp
	// When history is full, releases older than this retention period may be removed.
	// Defaults to 7 days if not specified.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=7
	// +optional
	AvailableReleasesRetentionDays *int32 `json:"availableReleasesRetentionDays,omitempty"`

	// AvailableReleasesMinCount defines the minimum number of available releases to always keep
	// When history is full, at least this many releases will be retained regardless of other criteria.
	// Defaults to 30 if not specified.
	// +kubebuilder:validation:Minimum=1
	// +kubebuilder:default=30
	// +optional
	AvailableReleasesMinCount *int32 `json:"availableReleasesMinCount,omitempty"`

	// BakeTime specifies how long to wait after bake starts before marking as successful
	// If no errors happen within the bake time, the rollout is baked successfully.
	// If not specified, no bake time is enforced.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +optional
	BakeTime *metav1.Duration `json:"bakeTime,omitempty"`

	// DeployTimeout specifies the maximum time to wait for bake to start before marking as failed
	// If bake doesn't start within deployTimeout (i.e., health checks don't become healthy),
	// the rollout should be marked as failed.
	// If not specified, the rollout will wait indefinitely for bake to start.
	// +kubebuilder:validation:Type=string
	// +kubebuilder:validation:Pattern="^([0-9]+(\\.[0-9]+)?(ms|s|m|h))+$"
	// +optional
	DeployTimeout *metav1.Duration `json:"deployTimeout,omitempty"`

	// HealthCheckSelector specifies how to select HealthChecks for this rollout
	// +optional
	HealthCheckSelector *HealthCheckSelectorConfig `json:"healthCheckSelector,omitempty"`
}

type RolloutStatus struct {
	// Conditions represents the current state of the rollout process.
	// +optional
	// +patchMergeKey=type
	// +patchStrategy=merge
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// History tracks the deployment history of this Rollout.
	// Each entry contains the version deployed and the timestamp of the deployment.
	// +optional
	History []DeploymentHistoryEntry `json:"history,omitempty"`

	// AvailableReleases is a list of all releases available in the releases repository.
	// +optional
	AvailableReleases []VersionInfo `json:"availableReleases,omitempty"`

	// ReleaseCandidates is a list of releases that are candidates for the next deployment.
	// These are filtered from AvailableReleases based on deployment history and version ordering.
	// +optional
	ReleaseCandidates []VersionInfo `json:"releaseCandidates,omitempty"`

	// GatedReleaseCandidates is a list of release candidates that have passed through all gates.
	// This shows which versions are actually available for deployment after gate evaluation.
	// +optional
	GatedReleaseCandidates []VersionInfo `json:"gatedReleaseCandidates,omitempty"`

	// Gates summarizes the status of each gate relevant to this rollout.
	// +optional
	Gates []RolloutGateStatusSummary `json:"gates,omitempty"`

	// ArtifactType is the media/artifact type of the image extracted from the manifest.
	// This includes OCI artifact types, container image types, and other media types.
	// This field is set once for the entire rollout based on the latest available release.
	// +optional
	ArtifactType *string `json:"artifactType,omitempty"`

	// Source is the source information extracted from OCI annotations.
	// This typically contains the repository URL or source code location.
	// This field is set once for the entire rollout based on the latest available release.
	// +optional
	Source *string `json:"source,omitempty"`

	// Title is the title of the image extracted from OCI annotations.
	// This field is set once for the entire rollout based on the latest available release.
	// +optional
	Title *string `json:"title,omitempty"`

	// Description is the description of the image extracted from OCI annotations.
	// This field is set once for the entire rollout based on the latest available release.
	// +optional
	Description *string `json:"description,omitempty"`
}

type ScheduleRule struct {
	// Name is an optional identifier for this rule
	// +optional
	Name string `json:"name,omitempty"`

	// TimeRange restricts the rule to specific times of day
	// +optional
	TimeRange *TimeRange `json:"timeRange,omitempty"`

	// DaysOfWeek restricts the rule to specific days of the week
	// +optional
	DaysOfWeek []DayOfWeek `json:"daysOfWeek,omitempty"`

	// DateRange restricts the rule to specific date range
	// +optional
	DateRange *DateRange `json:"dateRange,omitempty"`
}

type TimeRange struct {
	// Start time in HH:MM format (24-hour)
	// +kubebuilder:validation:Pattern=`^([01]\d|2[0-3]):[0-5]\d$`
	// +required
	Start string `json:"start"`

	// End time in HH:MM format (24-hour)
	// +kubebuilder:validation:Pattern=`^([01]\d|2[0-3]):[0-5]\d$`
	// +required
	End string `json:"end"`
}

type TriggeredByInfo struct {
	// Kind indicates the type of trigger: "User" for manual deployments triggered by a user,
	// or "System" for automatic deployments triggered by the rollout controller.
	// +kubebuilder:validation:Enum=User;System
	// +kubebuilder:validation:Required
	// +required
	Kind string `json:"kind"`

	// Name contains the name of the user or system that triggered the deployment.
	// For user-triggered deployments, this is extracted from the "rollout.kuberik.com/deploy-user" annotation.
	// For system-triggered deployments, this is typically "rollout-controller".
	// +kubebuilder:validation:Required
	// +required
	Name string `json:"name"`
}

type VersionInfo struct {
	// Tag is the image tag (e.g., "v1.2.3", "latest").
	// +kubebuilder:validation:Required
	// +required
	Tag string `json:"tag"`

	// Digest is the image digest if available from the ImagePolicy.
	// +optional
	Digest *string `json:"digest,omitempty"`

	// Version is the semantic version extracted from OCI annotations if available.
	// +optional
	Version *string `json:"version,omitempty"`

	// Revision is the revision information extracted from OCI annotations if available.
	// +optional
	Revision *string `json:"revision,omitempty"`

	// Created is the creation timestamp extracted from OCI annotations if available.
	// +optional
	Created *metav1.Time `json:"created,omitempty"`

	// Requires maps a contract name to what this release requires of that
	// contract, extracted from "com.kuberik.rollout.requires.<contract>" OCI
	// annotations. Values are version constraints as defined by
	// github.com/Masterminds/semver, applied verbatim — note that a bare version
	// is an exact match there, not a floor.
	// RolloutDependency uses these to gate this release on the deployed version of
	// the Rollout providing each contract.
	//
	// Bounded because it is populated from image annotations, which are outside
	// this controller's trust boundary, and is stored on every release and every
	// history entry.
	// +kubebuilder:validation:MaxProperties=32
	// +optional
	Requires map[string]string `json:"requires,omitempty"`

	// MetadataUnresolved is true when this release's OCI manifest could not be
	// read, so Requires and the version fields say nothing about the image.
	// A RolloutDependency blocks such a release rather than reading the absent
	// annotations as "declares no requirement", which would open the gate
	// whenever the registry is unreachable.
	// +optional
	MetadataUnresolved bool `json:"metadataUnresolved,omitempty"`
}