plantypes

type ActionWorkflowRunPlan struct {
	ID        string `json:"id"`
	InstallID string `json:"install_id"`

	Attrs map[string]string `json:"attrs"`

	Steps           []*ActionWorkflowRunStepPlan `json:"steps"`
	BuiltinEnvVars  map[string]string            `json:"builtin_env_vars"`
	OverrideEnvVars map[string]string            `json:"override_env_vars"`
	Timeout         time.Duration                `json:"timeout,omitempty" swaggertype:"primitive,integer"`

	ClusterInfo *kube.ClusterInfo        `json:"cluster_info,block"`
	AWSAuth     *awscredentials.Config   `json:"aws_auth,omitempty"`
	AzureAuth   *azurecredentials.Config `json:"azure_auth,omitempty"`
	GCPAuth     *gcpcredentials.Config   `json:"gcp_auth,omitempty"`

	// Image-backed actions: SourceImage is the rendered app-authored ref
	// (e.g. ghcr.io/acme/tools:v1); ImageRegistry/ImageTag point at the
	// install-registry mirror the runner pulls from.
	SourceImage   string                         `json:"source_image,omitempty"`
	ImageRegistry *configs.OCIRegistryRepository `json:"image_registry,omitempty"`
	ImageTag      string                         `json:"image_tag,omitempty"`
	// ImageDigestRef is the digest-pinned pull reference resolved by the mirror
	// job (<login_server>/<repository>@sha256:...). When set, the runner pulls
	// this exact manifest instead of the mutable tag, binding execution to the
	// content that was mirrored.
	ImageDigestRef string `json:"image_digest_ref,omitempty"`

	MinSandboxMode
}

type ActionWorkflowRunStepPlan struct {
	ID string `json:"run_id"`

	Attrs                      map[string]string `json:"attrs"`
	InterpolatedEnvVars        map[string]string `json:"interpolated_env_vars"`
	GitSource                  *GitSource        `json:"git_source"`
	InterpolatedInlineContents string            `json:"interpolated_inline_contents"`
	InterpolatedCommand        string            `json:"interpolated_command"`
}

type BuildPlan struct {
	ComponentID      string `json:"component_id"`
	ComponentBuildID string `json:"component_build_id"`

	Src *GitSource `json:"git_source"`

	Dst    *configs.OCIRegistryRepository `json:"dst_registry" validate:"required"`
	DstTag string                         `json:"dst_tag" validate:"required"`

	HelmBuildPlan               *HelmBuildPlan               `json:"helm_build_plan,omitempty"`
	TerraformBuildPlan          *TerraformBuildPlan          `json:"terraform_build_plan,omitempty"`
	DockerBuildPlan             *DockerBuildPlan             `json:"docker_build_plan,omitempty"`
	ContainerImagePullPlan      *ContainerImagePullPlan      `json:"container_image_pull_plan,omitempty"`
	KubernetesManifestBuildPlan *KubernetesManifestBuildPlan `json:"kubernetes_manifest_build_plan,omitempty"`
	PulumiBuildPlan             *PulumiBuildPlan             `json:"pulumi_build_plan,omitempty"`

	MinSandboxMode
}

type CompositePlan struct {
	BuildPlan              *BuildPlan              `json:"build_plan,omitempty"`
	DeployPlan             *DeployPlan             `json:"deploy_plan,omitempty"`
	ActionWorkflowRunPlan  *ActionWorkflowRunPlan  `json:"action_workflow_run_plan,omitempty"`
	SyncSecretsPlan        *SyncSecretsPlan        `json:"sync_secrets_plan,omitempty"`
	SyncOCIPlan            *SyncOCIPlan            `json:"sync_oci_plan,omitempty"`
	FetchImageMetadataPlan *FetchImageMetadataPlan `json:"fetch_image_metadata_plan,omitempty"`
	SandboxRunPlan         *SandboxRunPlan         `json:"sandbox_run_plan,omitempty"`
}

type ContainerImagePullPlan struct {
	Image string `json:"image"`
	Tag   string `json:"tag"`

	// UpdatePolicy is an optional Masterminds-compatible semver constraint
	// (e.g. "~1.25.0") propagated from the user's component config. When
	// non-empty, the runner lists tags from the source registry, filters to
	// those satisfying the constraint, and selects the highest matching
	// tag at build time. Tag is then ignored as the source ref.
	//
	// Empty for components that don't use update_policy.
	UpdatePolicy string                  `json:"update_policy,omitempty"`
	Verification *signature.Verification `json:"verification,omitempty"`

	RepoCfg *configs.OCIRegistryRepository `json:"repo_config"`

	// PreviousSourceDigest is the SourceDigest of the most recent prior Active
	// ComponentBuild for the same component, used by the runner as a dedup
	// hint. When the resolver returns a manifest descriptor whose digest matches
	// this value, the runner skips the Copy step and reports NoOp=true.
	//
	// Empty when there is no prior active build, or when the prior build has
	// no SourceDigest recorded (legacy builds).
	PreviousSourceDigest string `json:"previous_source_digest,omitempty"`
}

type DeployPlan struct {
	InstallID     string `json:"install_id"`
	AppID         string `json:"app_id"`
	AppConfigID   string `json:"app_config_id"`
	ComponentID   string `json:"component_id"`
	ComponentName string `json:"component_name"`
	InputsDigest  string `json:"inputs_digest,omitempty"`

	Src    *configs.OCIRegistryRepository `json:"src_registry" validate:"required"`
	SrcTag string                         `json:"src_tag" validate:"required"`
	// SrcDigest is the manifest digest of the source artifact in the install
	// registry, e.g. "sha256:abc...". Populated for image-type component
	// builds with source identity recorded; empty for
	// non-image builds and legacy image builds. When non-empty, runners
	// should prefer this over SrcTag for content-addressed pulls and for
	// rendering digest-pinned image references in pod specs.
	SrcDigest string `json:"src_digest,omitzero,omitempty"`

	HelmDeployPlan               *HelmDeployPlan               `json:"helm"`
	TerraformDeployPlan          *TerraformDeployPlan          `json:"terraform"`
	KubernetesManifestDeployPlan *KubernetesManifestDeployPlan `json:"kubernetes_manifest"`
	NoopDeployPlan               *NoopDeployPlan               `json:"noop"`
	PulumiDeployPlan             *PulumiDeployPlan             `json:"pulumi"`

	// The following field is for applying a plan that is already save
	ApplyPlanContents string `json:"apply_plan_contents"`
	// This field is for storing a human legible plan or corollary representation
	ApplyPlanDisplay string `json:"apply_plan_display"`

	SandboxMode *SandboxMode `json:"sandbox_mode,omitzero,omitempty"`

	// Teardown is only set on plans for teardown deploys.
	Teardown *TeardownPlan `json:"teardown,omitzero,omitempty"`
}

type DockerBuildPlan struct {
	BuildArgs  map[string]*string `json:"build_args"`
	Target     string             `json:"target"`
	Context    string             `json:"context"`
	Dockerfile string             `json:"dockerfile"`
}

type FetchImageMetadataPlan struct {
	// Registry configuration for the source image
	Registry *configs.OCIRegistryRepository `json:"registry" validate:"required"`

	// Tag is the image tag to fetch metadata for
	Tag string `json:"tag" validate:"required"`

	// Options for metadata fetching
	IncludeIndex                bool `json:"include_index"`
	IncludeAttestationManifests bool `json:"include_attestation_manifests"`
	IncludeAttestationLayers    bool `json:"include_attestation_layers"`

	MinSandboxMode
}

type GitSource struct {
	URL  string `json:"url" validate:"required"`
	Ref  string `json:"ref" validate:"required"`
	Path string `json:"path" validate:"required"`

	RecurseSubmodules bool `json:"recurse_submodules"`
}

type HelmBuildPlan struct {
	Labels         map[string]string
	HelmRepoConfig *config.HelmRepoConfig
	ValuesFiles    []string
	Values         []HelmValue
}

type HelmDeployPlan struct {
	ClusterInfo *kube.ClusterInfo `json:"cluster_info,block"`

	// Auth for cloud providers
	AWSAuth   *awscredentials.Config   `json:"aws_auth,omitempty"`
	AzureAuth *azurecredentials.Config `json:"azure_auth,omitempty"`
	GCPAuth   *gcpcredentials.Config   `json:"gcp_auth,omitempty"`

	// NOTE(jm): these fields should probably just come from the app config, however we keep them around for
	// debuggability
	Name            string `json:"name,attr"`
	Namespace       string `json:"namespace"`
	CreateNamespace bool   `json:"create_namespace"`
	StorageDriver   string `json:"storage_driver"`
	HelmChartID     string `json:"helm_chart_id"`

	ValuesFiles   []string    `json:"values_files"`
	Values        []HelmValue `json:"values"`
	TakeOwnership bool        `json:"take_ownership"`
	SkipCRDs      bool        `json:"skip_crds,omitempty"`

	// ValuesOverride is the install-level Helm values override (raw YAML). It is
	// merged as the highest-precedence layer at deploy time, winning over both
	// ValuesFiles and Values. Empty means no override (exact no-op).
	ValuesOverride string `json:"values_override,omitempty"`

	// Must stay a bool: go-swagger renders a documented $ref field as an inline
	// struct value, which decodes non-nil on every deploy.
	RecoverRelease bool `json:"recover_release,omitempty"`
}

type HelmSandboxMode struct {
	PlanContents        string `json:"plan_contents"`
	PlanDisplayContents string `json:"plan_display_contents"`
}

type HelmValue struct {
	Name  string `json:"name"`
	Value string `json:"value"`
	Type  string `json:"type,optional"`
}

type KubernetesManifestBuildPlan struct {
	// Labels for the OCI artifact
	Labels map[string]string `json:"labels,omitempty"`

	// SourceType indicates how manifests are sourced: "inline" or "kustomize"
	SourceType string `json:"source_type"`

	// InlineManifest contains the raw manifest YAML (for inline source type)
	InlineManifest string `json:"inline_manifest,omitempty"`

	// KustomizePath is the path to the kustomization directory (for kustomize source type)
	// Relative to the repository root
	KustomizePath string `json:"kustomize_path,omitempty"`

	// KustomizeConfig contains additional kustomize build options
	KustomizeConfig *KustomizeBuildConfig `json:"kustomize_config,omitempty"`
}

type KubernetesManifestDeployPlan struct {
	ClusterInfo *kube.ClusterInfo `json:"cluster_info,block"`

	// Auth for cloud providers
	AWSAuth   *awscredentials.Config   `json:"aws_auth,omitempty"`
	AzureAuth *azurecredentials.Config `json:"azure_auth,omitempty"`
	GCPAuth   *gcpcredentials.Config   `json:"gcp_auth,omitempty"`

	Namespace string `json:"namespace"`

	// Manifest is populated at runtime from the OCI artifact.
	// This field is no longer set during plan creation - it's populated by the runner
	// after pulling the OCI artifact during Initialize().
	Manifest string `json:"manifest,omitempty"`

	// OCIArtifact reference (set during plan creation, used by runner to pull manifest)
	OCIArtifact *OCIArtifactReference `json:"oci_artifact,omitempty"`

	// State carries the install state the runner needs to interpolate
	// nuon template placeholders into the kustomize-produced manifest.yaml
	// after pulling the OCI artifact. Nil for inline-manifest deploys,
	// which are pre-rendered planner-side and short-circuit the OCI pull
	// on the runner. Same shape as SandboxRunPlan.State.
	State *state.State `json:"state,omitempty"`
}

type KubernetesSandboxMode struct {
	PlanContents        string `json:"plan_contents"`
	PlanDisplayContents string `json:"plan_display_contents"`
}

type KubernetesSecretSync struct {
	SecretARN             string `json:"secret_arn"`
	GCPSecretName         string `json:"gcp_secret_name"`           // projects/{project}/secrets/{id}/versions/latest
	AzureKeyVaultSecretID string `json:"azure_key_vault_secret_id"` // https://{vault-name}.vault.azure.net/secrets/{secret-name}
	SecretName            string `json:"secret_name"`               // the name of the secret from the config

	// v1 destination (single). Used when Targets is empty.
	Namespace string `json:"namespace"`
	Name      string `json:"name"`
	KeyName   string `json:"key_name"`

	// v2 destinations: when len(Targets) > 0 the runner uses the v2 path and fans the shared source out across each
	// target's namespaces. The v1 fields above are ignored in that case.
	Targets []KubernetesSecretSyncTarget `json:"targets,omitempty"`

	// NOTE(jm): this should probably come from the app config, but for now we just use string parsing to avoid
	// updating the runner job and save time.
	Format string `json:"format"`
}

type KubernetesSecretSyncTarget struct {
	Namespaces []string `json:"namespaces"`
	Name       string   `json:"name"`
	Key        string   `json:"key"`
}

type KustomizeBuildConfig struct {
	// Patches are additional patch files to apply after kustomize build
	Patches []string `json:"patches,omitempty"`

	// EnableHelm enables Helm chart inflation during kustomize build
	EnableHelm bool `json:"enable_helm,omitempty"`

	// Ignored by the runner, which pins rootOnly so app config cannot widen worker file access
	LoadRestrictor string `json:"load_restrictor,omitempty"`
}

type MinSandboxMode struct {
	SandboxMode *SandboxMode `json:"sandbox_mode,omitzero,omitempty"`
}

type NoopDeployPlan struct {
}

type OCIArtifactReference struct {
	// URL is the full artifact URL (e.g., registry.nuon.co/org_id/app_id)
	URL string `json:"url"`

	// Tag is the artifact tag (typically the build ID)
	Tag string `json:"tag,omitempty"`

	// Digest is the immutable artifact digest (e.g., sha256:abc123...)
	Digest string `json:"digest,omitempty"`
}

type OCISource struct {
	Registry *configs.OCIRegistryRepository `json:"registry"`
	Tag      string                         `json:"tag"`
}

type PulumiBackend struct {
	WorkspaceID   string            `json:"workspace_id" validate:"required"`
	StackName     string            `json:"stack_name" validate:"required"`
	Runtime       string            `json:"runtime" validate:"required"`
	PulumiVersion string            `json:"pulumi_version,omitempty"`
	Config        map[string]string `json:"config,omitempty"`
	UpdatePlans   bool              `json:"update_plans,omitempty"`
}

type PulumiBuildPlan struct {
	Labels map[string]string `json:"labels,omitempty"`
}

type PulumiDeployPlan struct {
	Config  map[string]string `json:"config" faker:"-"`
	EnvVars map[string]string `json:"env_vars"`

	Runtime       string `json:"runtime"`
	PulumiVersion string `json:"pulumi_version"`
	StackName     string `json:"stack_name"`

	// Reuse workspace concept for state storage
	WorkspaceID string `json:"workspace_id"`

	AzureAuth *azurecredentials.Config `json:"azure_auth"`
	AWSAuth   *awscredentials.Config   `json:"aws_auth"`
	GCPAuth   *gcpcredentials.Config   `json:"gcp_auth"`

	ClusterInfo *kube.ClusterInfo `json:"cluster_info,block"`

	State *state.State `json:"state" faker:"-"`

	// Destroy indicates this is a teardown operation (pulumi destroy instead of up)
	Destroy bool `json:"destroy"`

	UpdatePlans bool `json:"update_plans,omitempty"`

	PlanJSON []byte `json:"plan_json"`
}

type PulumiSandboxMode struct {
	WorkspaceID         string `json:"workspace_id"`
	PlanContents        string `json:"plan_contents"`
	PlanDisplayContents string `json:"plan_display_contents"`
}

type SandboxMode struct {
	Enabled bool `json:"enabled"`

	Outputs map[string]any `json:"outputs"`

	Terraform          *TerraformSandboxMode  `json:"terraform,omitzero,omitempty"`
	Helm               *HelmSandboxMode       `json:"helm,omitzero,omitempty"`
	KubernetesManifest *KubernetesSandboxMode `json:"kubernetes_manifest,omitzero,omitempty"`
	Pulumi             *PulumiSandboxMode     `json:"pulumi,omitzero,omitempty"`
}

type SandboxRunPlan struct {
	InstallID    string `json:"install_id"`
	AppID        string `json:"app_id"`
	AppConfigID  string `json:"app_config_id"`
	InputsDigest string `json:"inputs_digest,omitempty"`

	Vars             map[string]any         `json:"vars" faker:"-"`
	EnvVars          map[string]string      `json:"env_vars"`
	VarsFiles        []string               `json:"vars_files"`
	GitSource        *GitSource             `json:"git_source"`
	OCISource        *OCISource             `json:"oci_source,omitempty"`
	LocalArchive     *TerraformLocalArchive `json:"local_archive"`
	TerraformBackend *TerraformBackend      `json:"terraform_backend"`
	PulumiBackend    *PulumiBackend         `json:"pulumi_backend,omitempty"`

	AzureAuth *azurecredentials.Config `json:"azure_auth"`
	AWSAuth   *awscredentials.Config   `json:"aws_auth"`
	GCPAuth   *gcpcredentials.Config   `json:"gcp_auth"`

	Hooks *TerraformDeployHooks `json:"hooks"`

	Policies           map[string]string `json:"policies"`
	KyvernoPoliciesDir string            `json:"kyverno_policies_dir,omitempty"`

	State *state.State `json:"state"`

	// The following field is for applying a plan that is already saved
	ApplyPlanContents string `json:"apply_plan_contents,omitempty"`
	// This field is for storing a human legible plan or corollary representation
	ApplyPlanDisplay []byte `json:"apply_plan_display,omitempty,omitzero"`

	SandboxMode *SandboxMode `json:"sandbox_mode,omitzero,omitempty"`
}

type SyncOCIPlan struct {
	Src    *configs.OCIRegistryRepository `json:"src_registry" validate:"required"`
	SrcTag string                         `json:"src_tag" validate:"required"`

	Dst    *configs.OCIRegistryRepository `json:"dst_registry" validate:"required"`
	DstTag string                         `json:"dst_tag" validate:"required"`

	MinSandboxMode
}

type SyncSecretsPlan struct {
	KubernetesSecrets []KubernetesSecretSync `json:"kubernetes_secrets"`

	ClusterInfo *kube.ClusterInfo        `json:"cluster_info,block"`
	AWSAuth     *awscredentials.Config   `json:"aws_auth"`
	AzureAuth   *azurecredentials.Config `json:"azure_auth"`
	GCPAuth     *gcpcredentials.Config   `json:"gcp_auth"`

	MinSandboxMode
}

type TeardownPlan struct {
	// Retain holds rendered resource addresses that are removed from state
	// instead of destroyed.
	Retain []string `json:"retain,omitempty"`
}

type TerraformBackend struct {
	WorkspaceID string `validate:"required"`
}

type TerraformBuildPlan struct {
	Labels map[string]string

	// VendorProviders enables build-time vendoring of terraform providers
	// via `terraform providers mirror`. The install runner auto-detects
	// whether a mirror is present in the OCI artifact.
	VendorProviders bool `json:"vendor_providers,omitempty"`

	// TerraformVersion is the version of the terraform CLI the build runner
	// should install in order to vendor providers via
	// `terraform providers mirror`. When empty the build runner falls back
	// to a sane default. Should mirror the version configured for the
	// component's deploy plan so init resolves the same provider bytes the
	// build vendored. Only consulted when VendorProviders is true.
	TerraformVersion string `json:"terraform_version,omitempty"`
}

type TerraformDeployHooks struct {
	Enabled bool               `hcl:"enabled"`
	EnvVars map[string]string  `hcl:"env_vars"`
	RunAuth credentials.Config `hcl:"run_auth,block"`
}

type TerraformDeployPlan struct {
	Vars      map[string]any    `json:"vars" faker:"-"`
	EnvVars   map[string]string `json:"env_vars"`
	VarsFiles []string          `json:"vars_files"`

	TerraformBackend *TerraformBackend `json:"terraform_backend"`

	AzureAuth *azurecredentials.Config `json:"azure_auth"`
	AWSAuth   *awscredentials.Config   `json:"aws_auth"`
	GCPAuth   *gcpcredentials.Config   `json:"gcp_auth"`

	Hooks *TerraformDeployHooks `json:"hooks"`

	ClusterInfo *kube.ClusterInfo `json:"cluster_info,block"`

	Policies map[string]string `json:"policies"`
	State    *state.State      `json:"state" faker:"-"`

	PlanJSON []byte `json:"plan_json"`
}

type TerraformLocalArchive struct {
	Path string `json:"local_archive"`
}

type TerraformRunPlan struct {
	InstallID   string `json:"install_id"`
	AppID       string `json:"app_id"`
	AppConfigID string `json:"app_config_id"`

	Vars             map[string]any           `json:"vars" faker:"-"`
	EnvVars          map[string]string        `json:"env_vars"`
	GitSource        *GitSource               `json:"git_source"`
	LocalArchive     *TerraformLocalArchive   `json:"local_archive"`
	TerraformBackend *TerraformBackend        `json:"terraform_backend"`
	AzureAuth        *azurecredentials.Config `json:"azure_auth"`
	AWSAuth          *awscredentials.Config   `json:"aws_auth"`
	Hooks            *TerraformDeployHooks    `json:"hooks"`

	Policies map[string]string `json:"policies"`

	State *state.State `json:"state"`
}

type TerraformRunType string

type TerraformSandboxMode struct {
	// needs to be the outputs of `terraform show -json`
	StateJSON   []byte `json:"state_json" swaggertype:"primitive,string"`
	WorkspaceID string `json:"workspace_id"`

	// create the plan output
	PlanContents        string `json:"plan_contents"`
	PlanDisplayContents string `json:"plan_display_contents"`
}