v1alpha1

type FailureCounters struct {
	// +optional
	Reconcile int64 `json:"reconcile,omitempty"`

	// +optional
	Apply int64 `json:"apply,omitempty"`

	// +optional
	Prune int64 `json:"prune,omitempty"`

	// +optional
	Drift int64 `json:"drift,omitempty"`
}

type HistoryEntry struct {
	// +optional
	Sequence int64 `json:"sequence,omitempty"`

	// +optional
	Action string `json:"action,omitempty"`

	// +optional
	Phase string `json:"phase,omitempty"`

	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// +optional
	FinishedAt *metav1.Time `json:"finishedAt,omitempty"`

	// +optional
	SourceDigest string `json:"sourceDigest,omitempty"`

	// +optional
	ConfigDigest string `json:"configDigest,omitempty"`

	// +optional
	RenderDigest string `json:"renderDigest,omitempty"`

	// +optional
	InventoryDigest string `json:"inventoryDigest,omitempty"`

	// +optional
	InventoryCount int64 `json:"inventoryCount,omitempty"`

	// +optional
	Message string `json:"message,omitempty"`
}

type Inventory struct {
	// +optional
	Revision int64 `json:"revision,omitempty"`

	// +optional
	Digest string `json:"digest,omitempty"`

	// +optional
	Count int64 `json:"count,omitempty"`

	// +optional
	Entries []InventoryEntry `json:"entries,omitempty"`
}

type InventoryEntry struct {
	// +optional
	Group string `json:"group,omitempty"`

	Kind string `json:"kind"`

	// +optional
	Namespace string `json:"namespace,omitempty"`

	Name string `json:"name"`

	// +optional
	Version string `json:"v,omitempty"`

	// +optional
	Component string `json:"component,omitempty"`
}

type ModuleInstance struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of ModuleInstance
	// +required
	Spec ModuleInstanceSpec `json:"spec"`

	// status defines the observed state of ModuleInstance
	// +optional
	Status ModuleInstanceStatus `json:"status,omitzero"`
}

type ModuleInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ModuleInstance `json:"items"`
}

type ModuleInstanceSpec struct {
	// +optional
	Suspend bool `json:"suspend,omitempty"`

	// Owner identifies which actor manages this instance. An absent, empty, or
	// "operator" value means operator-managed: the controller reconciles
	// normally. Only an explicit "cli" makes the operator skip the instance
	// (no render/apply/prune, no finalizer) and record a single
	// ManagedExternally acknowledgement. There is no CRD default; the
	// reconciler carries the operator-managed default semantics.
	// +kubebuilder:validation:Enum=cli;operator
	// +optional
	Owner OwnerType `json:"owner,omitempty"`

	// Module identifies the CUE module to evaluate from the OCI registry.
	Module ModuleReference `json:"module"`

	// Values contains arbitrary release input values.
	// +optional
	Values *RawValues `json:"values,omitempty"`

	// +optional
	Prune bool `json:"prune,omitempty"`

	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// +optional
	Rollout *RolloutSpec `json:"rollout,omitempty"`
}

type ModuleInstanceStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// InstanceUUID is the globally-unique identity of the rendered ModuleInstance,
	// read from the `module-instance.opmodel.dev/uuid` label on rendered resources.
	// Populated on the first successful render; consumed by the prune ownership
	// guard (including the deletion path where a fresh render is not available).
	// +optional
	InstanceUUID string `json:"instanceUUID,omitempty"`

	// conditions represent the current state of the ModuleInstance resource.
	// Each condition has a unique type and reflects the status of a specific aspect of the resource.
	//
	// Standard condition types include:
	// - "Available": the resource is fully functional
	// - "Progressing": the resource is being created or updated
	// - "Degraded": the resource failed to reach or maintain its desired state
	//
	// The status of each condition is one of True, False, or Unknown.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// +optional
	LastAttemptedAction string `json:"lastAttemptedAction,omitempty"`

	// +optional
	LastAttemptedAt *metav1.Time `json:"lastAttemptedAt,omitempty"`

	// +optional
	LastAttemptedDuration *metav1.Duration `json:"lastAttemptedDuration,omitempty"`

	// +optional
	LastAttemptedSourceDigest string `json:"lastAttemptedSourceDigest,omitempty"`

	// +optional
	LastAttemptedConfigDigest string `json:"lastAttemptedConfigDigest,omitempty"`

	// +optional
	LastAttemptedRenderDigest string `json:"lastAttemptedRenderDigest,omitempty"`

	// +optional
	LastAppliedAt *metav1.Time `json:"lastAppliedAt,omitempty"`

	// +optional
	LastAppliedSourceDigest string `json:"lastAppliedSourceDigest,omitempty"`

	// +optional
	LastAppliedConfigDigest string `json:"lastAppliedConfigDigest,omitempty"`

	// +optional
	LastAppliedRenderDigest string `json:"lastAppliedRenderDigest,omitempty"`

	// +optional
	FailureCounters *FailureCounters `json:"failureCounters,omitempty"`

	// +optional
	Inventory *Inventory `json:"inventory,omitempty"`

	// +optional
	History []HistoryEntry `json:"history,omitempty"`

	// NextRetryAt indicates when the controller will next attempt reconciliation
	// after a transient or stalled failure. Nil when the resource is healthy or no-op.
	// +optional
	NextRetryAt *metav1.Time `json:"nextRetryAt,omitempty"`
}

type ModulePackage struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of ModulePackage
	// +required
	Spec ModulePackageSpec `json:"spec"`

	// status defines the observed state of ModulePackage
	// +optional
	Status ModulePackageStatus `json:"status,omitzero"`
}

type ModulePackageList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ModulePackage `json:"items"`
}

type ModulePackageSpec struct {
	// SourceRef references a Flux source (OCIRepository, GitRepository, or Bucket)
	// that provides the artifact containing the CUE package.
	SourceRef SourceReference `json:"sourceRef"`

	// Path is the directory within the artifact containing instance.cue.
	// Example: "releases/prod/minecraft".
	// +kubebuilder:validation:MinLength=1
	Path string `json:"path"`

	// Interval at which the reconciler re-evaluates the package to detect drift
	// and re-apply. Also the requeue interval after transient failures.
	// +optional
	Interval metav1.Duration `json:"interval,omitempty"`

	// DependsOn references other ModulePackage CRs that must be Ready=True before
	// this ModulePackage is reconciled. References are same-namespace only.
	// +optional
	DependsOn []fluxmeta.NamespacedObjectReference `json:"dependsOn,omitempty"`

	// Prune enables deletion of stale resources on reconcile and of all owned
	// resources on ModulePackage deletion.
	// +optional
	Prune bool `json:"prune,omitempty"`

	// Suspend halts reconciliation when true.
	// +optional
	Suspend bool `json:"suspend,omitempty"`

	// ServiceAccountName is the name of the ServiceAccount used to impersonate
	// during apply and prune. Empty means use the controller's identity.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// Rollout configures apply behavior.
	// +optional
	Rollout *RolloutSpec `json:"rollout,omitempty"`
}

type ModulePackageStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// conditions represent the current state of the ModulePackage resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Source is the resolved Flux source artifact metadata.
	// +optional
	Source *SourceStatus `json:"source,omitempty"`

	// +optional
	LastAttemptedAction string `json:"lastAttemptedAction,omitempty"`

	// +optional
	LastAttemptedAt *metav1.Time `json:"lastAttemptedAt,omitempty"`

	// +optional
	LastAttemptedDuration *metav1.Duration `json:"lastAttemptedDuration,omitempty"`

	// +optional
	LastAttemptedSourceDigest string `json:"lastAttemptedSourceDigest,omitempty"`

	// +optional
	LastAttemptedConfigDigest string `json:"lastAttemptedConfigDigest,omitempty"`

	// +optional
	LastAttemptedRenderDigest string `json:"lastAttemptedRenderDigest,omitempty"`

	// +optional
	LastAppliedAt *metav1.Time `json:"lastAppliedAt,omitempty"`

	// +optional
	LastAppliedSourceDigest string `json:"lastAppliedSourceDigest,omitempty"`

	// +optional
	LastAppliedConfigDigest string `json:"lastAppliedConfigDigest,omitempty"`

	// +optional
	LastAppliedRenderDigest string `json:"lastAppliedRenderDigest,omitempty"`

	// +optional
	FailureCounters *FailureCounters `json:"failureCounters,omitempty"`

	// +optional
	Inventory *Inventory `json:"inventory,omitempty"`

	// +optional
	History []HistoryEntry `json:"history,omitempty"`

	// NextRetryAt indicates when the controller will next attempt reconciliation
	// after a transient or stalled failure.
	// +optional
	NextRetryAt *metav1.Time `json:"nextRetryAt,omitempty"`
}

type ModuleReference struct {
	// Path is the CUE module import path.
	// Example: "opmodel.dev/modules/cert_manager@v0"
	// +kubebuilder:validation:MinLength=1
	Path string `json:"path"`

	// Version is the pinned module version to resolve from the registry.
	// Example: "v0.2.1"
	// +kubebuilder:validation:MinLength=1
	Version string `json:"version"`
}

type OwnerType string

type Platform struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of Platform
	// +required
	Spec PlatformSpec `json:"spec"`

	// status defines the observed state of Platform
	// +optional
	Status PlatformStatus `json:"status,omitzero"`
}

type PlatformList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []Platform `json:"items"`
}

type PlatformSpec struct {
	// Type is the informational discriminator for the platform (core
	// #Platform.type). It does not affect matching; it labels the platform
	// flavor for operators and downstream tooling.
	// +kubebuilder:validation:MinLength=1
	// +required
	Type string `json:"type"`

	// Registry is the set of catalog subscriptions keyed by major-suffixed
	// catalog CUE module path (e.g. "opmodel.dev/catalogs/opm@v2"), projecting
	// core #Platform.#registry. The key's major must agree with the major of
	// the subscribed version (enhancement 0010 D14).
	// +optional
	Registry map[string]Subscription `json:"registry,omitempty"`

	// SkewPolicy is the operator's response to catalog version skew: a
	// module whose cue.mod requires a newer build of an OPM-namespace path
	// (core or a catalog) than the platform pins (enhancement 0019 D7/D18).
	// "Warn" (the default when unset) renders against the platform's build
	// and reports the skew as a RenderWarning event on the workload; "Refuse"
	// refuses the render before evaluation and the workload reports
	// Ready=False with reason SkewRefused, naming the path and both versions.
	// The policy is not part of the generated platform module; it is recorded
	// beside it, so changing the field alone bumps the generation, regenerates
	// and re-enqueues the workloads.
	// +kubebuilder:validation:Enum=Warn;Refuse
	// +optional
	SkewPolicy *string `json:"skewPolicy,omitempty"`
}

type PlatformStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// conditions represent the current state of the Platform resource. The
	// PlatformReconciler summarizes module generation on the Ready condition:
	// Ready=True (reason Generated) when the generated platform module built,
	// Ready=False with reason BuildFailed (a pinned build does not exist, a
	// key disagrees with its imported catalog, or the module did not build;
	// the message names the dependency or entry) or GenerateFailed (the
	// module could not be written to the operator's disk).
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// operatorVersion is the version of the operator that last patched this
	// Platform's status, stamped on every reconcile regardless of outcome
	// (enhancement 0006 D24). The CLI reads it as the version-skew ceiling;
	// absence means no operator has reconciled the Platform (solo cluster).
	// +optional
	OperatorVersion string `json:"operatorVersion,omitempty"`
}

type ProviderReference struct {
	// Namespace of the claiming ModuleInstance.
	// +kubebuilder:validation:MinLength=1
	// +required
	Namespace string `json:"namespace"`

	// Name of the claiming ModuleInstance.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`
}

type RawValues struct {
	apiextensionsv1.JSON `json:",inline"`
}

type RolloutSpec struct {
	// Strategy controls how apply operations are performed.
	// +kubebuilder:validation:Enum=Apply
	// +optional
	Strategy string `json:"strategy,omitempty"`

	// ForceConflicts enables SSA force ownership when desired.
	// +optional
	ForceConflicts bool `json:"forceConflicts,omitempty"`
}

type SourceReference = fluxmeta.NamespacedObjectKindReference

type SourceStatus struct {
	// Ref is the resolved source reference.
	// +optional
	Ref *SourceReference `json:"ref,omitempty"`

	// ArtifactRevision is the revision reported by the source artifact.
	// +optional
	ArtifactRevision string `json:"artifactRevision,omitempty"`

	// ArtifactDigest is the digest reported by the source artifact.
	// +optional
	ArtifactDigest string `json:"artifactDigest,omitempty"`

	// ArtifactURL is the fetch URL reported by the source artifact.
	// +optional
	ArtifactURL string `json:"artifactURL,omitempty"`
}

type Subscription struct {
	// Enable toggles the subscription. A pointer so that an omitted value
	// defers to the schema default (true) rather than serializing as an
	// explicit false. A disabled subscription is still pinned and imported by
	// the generated module, with enable set to false on its entry.
	// +optional
	Enable *bool `json:"enable,omitempty"`

	// Version names exactly one published catalog build as a bare SemVer
	// string (e.g. "2.0.0-alpha.3") — the platform module IS the resolution
	// (enhancement 0010 D14); there is no range or allow/deny vocabulary. The
	// version's major must agree with the subscription key's `@vN` suffix.
	// The operator uses it twice: as the generated cue.mod pin and as the
	// entry's stamped expected version, which unifies with the imported
	// catalog's own version so wrong bytes fail the build naming the entry
	// (enhancement 0019 D13).
	// CRD-required is safe against the stored pre-reshape singleton: API
	// server validation ratcheting keeps status-subresource patches working
	// against a stored object lacking the field (measured in
	// test/integration/crdvalidation).
	// +kubebuilder:validation:MinLength=1
	// +required
	Version string `json:"version"`
}

type TransformerRegistration struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TransformerRegistration
	// +required
	Spec TransformerRegistrationSpec `json:"spec"`

	// status defines the observed state of TransformerRegistration
	// +optional
	Status TransformerRegistrationStatus `json:"status,omitzero"`
}

type TransformerRegistrationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TransformerRegistration `json:"items"`
}

type TransformerRegistrationSpec struct {
	// Catalog is the provider catalog's major-suffixed CUE module path
	// (e.g. "opmodel.dev/catalogs/k8up@v1"). It names a catalog, never a
	// module: a catalog is what carries transformers, so a claim naming a
	// module names nothing that could implement a contract. Acceptance
	// refuses a non-catalog artifact structurally (enhancement 0015 D10).
	// +kubebuilder:validation:MinLength=1
	// +required
	Catalog string `json:"catalog"`

	// Version is the released build of the named catalog, a bare SemVer
	// string (e.g. "1.0.0"). It pins the claim to one build, which is what
	// lets acceptance re-derive Provides from the artifact this names.
	// +kubebuilder:validation:MinLength=1
	// +required
	Version string `json:"version"`

	// Provides lists every provider-fulfilled contract FQN the named catalog
	// claims to implement.
	//
	// Required but MAY be empty. A provider catalog implementing no
	// provider-fulfilled contract is a claim acceptance refuses on its merits,
	// naming the catalog it re-derived from, not a malformed object. The CRD
	// is the wrong place to encode a rule the reconciler states better.
	// +required
	Provides []string `json:"provides"`

	// ProviderRef identifies the ModuleInstance that rendered this claim. It
	// is stamped from the rendering instance and never authored, so a module
	// cannot claim to be another provider (enhancement 0015 D11).
	// +required
	ProviderRef ProviderReference `json:"providerRef"`
}

type TransformerRegistrationStatus struct {
	// conditions represent the current state of the TransformerRegistration
	// resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// accepted reports whether the claim passed acceptance: the catalog
	// resolved, its Provides re-derived equal, and no other instance holds
	// the same provider.
	// +optional
	Accepted bool `json:"accepted,omitzero"`

	// active reports whether an accepted claim's provider is serving. An
	// accepted claim stays inactive until its ModulePackage is Ready.
	// +optional
	Active bool `json:"active,omitzero"`
}