v1alpha1

type FailureCounters struct {
	// +optional
	Reconcile int64 `json:"reconcile,omitempty"`

	// +optional
	Apply int64 `json:"apply,omitempty"`

	// +optional
	Prune int64 `json:"prune,omitempty"`

	// +optional
	Drift int64 `json:"drift,omitempty"`
}

type HistoryEntry struct {
	// +optional
	Sequence int64 `json:"sequence,omitempty"`

	// +optional
	Action string `json:"action,omitempty"`

	// +optional
	Phase string `json:"phase,omitempty"`

	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// +optional
	FinishedAt *metav1.Time `json:"finishedAt,omitempty"`

	// +optional
	SourceDigest string `json:"sourceDigest,omitempty"`

	// +optional
	ConfigDigest string `json:"configDigest,omitempty"`

	// +optional
	RenderDigest string `json:"renderDigest,omitempty"`

	// +optional
	InventoryDigest string `json:"inventoryDigest,omitempty"`

	// +optional
	InventoryCount int64 `json:"inventoryCount,omitempty"`

	// +optional
	Message string `json:"message,omitempty"`
}

type Inventory struct {
	// +optional
	Revision int64 `json:"revision,omitempty"`

	// +optional
	Digest string `json:"digest,omitempty"`

	// +optional
	Count int64 `json:"count,omitempty"`

	// +optional
	Entries []InventoryEntry `json:"entries,omitempty"`
}

type InventoryEntry struct {
	// +optional
	Group string `json:"group,omitempty"`

	Kind string `json:"kind"`

	// +optional
	Namespace string `json:"namespace,omitempty"`

	Name string `json:"name"`

	// +optional
	Version string `json:"v,omitempty"`

	// +optional
	Component string `json:"component,omitempty"`
}

type ModuleInstance struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of ModuleInstance
	// +required
	Spec ModuleInstanceSpec `json:"spec"`

	// status defines the observed state of ModuleInstance
	// +optional
	Status ModuleInstanceStatus `json:"status,omitzero"`
}

type ModuleInstanceList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ModuleInstance `json:"items"`
}

type ModuleInstanceSpec struct {
	// +optional
	Suspend bool `json:"suspend,omitempty"`

	// Owner identifies which actor manages this instance. An absent, empty, or
	// "operator" value means operator-managed: the controller reconciles
	// normally. Only an explicit "cli" makes the operator skip the instance
	// (no render/apply/prune, no finalizer) and record a single
	// ManagedExternally acknowledgement. There is no CRD default; the
	// reconciler carries the operator-managed default semantics.
	// +kubebuilder:validation:Enum=cli;operator
	// +optional
	Owner OwnerType `json:"owner,omitempty"`

	// Module identifies the CUE module to evaluate from the OCI registry.
	Module ModuleReference `json:"module"`

	// Values contains arbitrary release input values.
	// +optional
	Values *RawValues `json:"values,omitempty"`

	// +optional
	Prune bool `json:"prune,omitempty"`

	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// +optional
	Rollout *RolloutSpec `json:"rollout,omitempty"`
}

type ModuleInstanceStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// InstanceUUID is the globally-unique identity of the rendered ModuleInstance,
	// read from the `module-instance.opmodel.dev/uuid` label on rendered resources.
	// Populated on the first successful render; consumed by the prune ownership
	// guard (including the deletion path where a fresh render is not available).
	// +optional
	InstanceUUID string `json:"instanceUUID,omitempty"`

	// conditions represent the current state of the ModuleInstance resource.
	// Each condition has a unique type and reflects the status of a specific aspect of the resource.
	//
	// Standard condition types include:
	// - "Available": the resource is fully functional
	// - "Progressing": the resource is being created or updated
	// - "Degraded": the resource failed to reach or maintain its desired state
	//
	// The status of each condition is one of True, False, or Unknown.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// +optional
	LastAttemptedAction string `json:"lastAttemptedAction,omitempty"`

	// +optional
	LastAttemptedAt *metav1.Time `json:"lastAttemptedAt,omitempty"`

	// +optional
	LastAttemptedDuration *metav1.Duration `json:"lastAttemptedDuration,omitempty"`

	// +optional
	LastAttemptedSourceDigest string `json:"lastAttemptedSourceDigest,omitempty"`

	// +optional
	LastAttemptedConfigDigest string `json:"lastAttemptedConfigDigest,omitempty"`

	// +optional
	LastAttemptedRenderDigest string `json:"lastAttemptedRenderDigest,omitempty"`

	// +optional
	LastAppliedAt *metav1.Time `json:"lastAppliedAt,omitempty"`

	// +optional
	LastAppliedSourceDigest string `json:"lastAppliedSourceDigest,omitempty"`

	// +optional
	LastAppliedConfigDigest string `json:"lastAppliedConfigDigest,omitempty"`

	// +optional
	LastAppliedRenderDigest string `json:"lastAppliedRenderDigest,omitempty"`

	// +optional
	FailureCounters *FailureCounters `json:"failureCounters,omitempty"`

	// +optional
	Inventory *Inventory `json:"inventory,omitempty"`

	// RequiredContracts lists every contract FQN this instance's components
	// declare, sorted and deduplicated, as the last successful render
	// reported them. It is the instance side of the removal guard
	// (0015:D3, D16): a TransformerRegistration counts its
	// dependents by intersecting this with its own spec.provides, so a
	// provider cannot be deleted, or shrink its provides, out from under
	// the instances still demanding what it serves.
	//
	// Derived, never authored. The contracts are read off the synthesized
	// instance's components, which is the same keyspace the render's
	// matching compares, so nothing a module author writes into spec can
	// raise or lower the count. A reconcile that does not render — a failed
	// render, a suspended instance, a CLI-owned one — leaves the previous
	// value: a stale entry over-reports demand and blocks a deletion that
	// could have proceeded, which is the safe direction for a guard.
	// +listType=atomic
	// +optional
	RequiredContracts []string `json:"requiredContracts,omitempty"`

	// +optional
	History []HistoryEntry `json:"history,omitempty"`

	// NextRetryAt indicates when the controller will next attempt reconciliation
	// after a transient or stalled failure. Nil when the resource is healthy or no-op.
	// +optional
	NextRetryAt *metav1.Time `json:"nextRetryAt,omitempty"`
}

type ModulePackage struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of ModulePackage
	// +required
	Spec ModulePackageSpec `json:"spec"`

	// status defines the observed state of ModulePackage
	// +optional
	Status ModulePackageStatus `json:"status,omitzero"`
}

type ModulePackageList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []ModulePackage `json:"items"`
}

type ModulePackageSpec struct {
	// SourceRef references a Flux source (OCIRepository, GitRepository, or Bucket)
	// that provides the artifact containing the CUE package.
	SourceRef SourceReference `json:"sourceRef"`

	// Path is the directory within the artifact containing instance.cue.
	// Example: "releases/prod/minecraft".
	// +kubebuilder:validation:MinLength=1
	Path string `json:"path"`

	// Interval at which the reconciler re-evaluates the package to detect drift
	// and re-apply. Also the requeue interval after transient failures.
	// +optional
	Interval metav1.Duration `json:"interval,omitempty"`

	// DependsOn references other ModulePackage CRs that must be Ready=True before
	// this ModulePackage is reconciled. References are same-namespace only.
	// +optional
	DependsOn []fluxmeta.NamespacedObjectReference `json:"dependsOn,omitempty"`

	// Prune enables deletion of stale resources on reconcile and of all owned
	// resources on ModulePackage deletion.
	// +optional
	Prune bool `json:"prune,omitempty"`

	// Suspend halts reconciliation when true.
	// +optional
	Suspend bool `json:"suspend,omitempty"`

	// ServiceAccountName is the name of the ServiceAccount used to impersonate
	// during apply and prune. Empty means use the controller's identity.
	// +optional
	ServiceAccountName string `json:"serviceAccountName,omitempty"`

	// Rollout configures apply behavior.
	// +optional
	Rollout *RolloutSpec `json:"rollout,omitempty"`
}

type ModulePackageStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// conditions represent the current state of the ModulePackage resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// Source is the resolved Flux source artifact metadata.
	// +optional
	Source *SourceStatus `json:"source,omitempty"`

	// +optional
	LastAttemptedAction string `json:"lastAttemptedAction,omitempty"`

	// +optional
	LastAttemptedAt *metav1.Time `json:"lastAttemptedAt,omitempty"`

	// +optional
	LastAttemptedDuration *metav1.Duration `json:"lastAttemptedDuration,omitempty"`

	// +optional
	LastAttemptedSourceDigest string `json:"lastAttemptedSourceDigest,omitempty"`

	// +optional
	LastAttemptedConfigDigest string `json:"lastAttemptedConfigDigest,omitempty"`

	// +optional
	LastAttemptedRenderDigest string `json:"lastAttemptedRenderDigest,omitempty"`

	// +optional
	LastAppliedAt *metav1.Time `json:"lastAppliedAt,omitempty"`

	// +optional
	LastAppliedSourceDigest string `json:"lastAppliedSourceDigest,omitempty"`

	// +optional
	LastAppliedConfigDigest string `json:"lastAppliedConfigDigest,omitempty"`

	// +optional
	LastAppliedRenderDigest string `json:"lastAppliedRenderDigest,omitempty"`

	// +optional
	FailureCounters *FailureCounters `json:"failureCounters,omitempty"`

	// +optional
	Inventory *Inventory `json:"inventory,omitempty"`

	// +optional
	History []HistoryEntry `json:"history,omitempty"`

	// NextRetryAt indicates when the controller will next attempt reconciliation
	// after a transient or stalled failure.
	// +optional
	NextRetryAt *metav1.Time `json:"nextRetryAt,omitempty"`
}

type ModuleReference struct {
	// Path is the CUE module import path.
	// Example: "opmodel.dev/modules/cert_manager@v0"
	// +kubebuilder:validation:MinLength=1
	Path string `json:"path"`

	// Version is the pinned module version to resolve from the registry.
	// Example: "v0.2.1"
	// +kubebuilder:validation:MinLength=1
	Version string `json:"version"`
}

type OwnerType string

type Platform struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of Platform
	// +required
	Spec PlatformSpec `json:"spec"`

	// status defines the observed state of Platform
	// +optional
	Status PlatformStatus `json:"status,omitzero"`
}

type PlatformList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []Platform `json:"items"`
}

type PlatformSpec struct {
	// Type is the informational discriminator for the platform (core
	// #Platform.type). It does not affect matching; it labels the platform
	// flavor for operators and downstream tooling.
	// +kubebuilder:validation:MinLength=1
	// +required
	Type string `json:"type"`

	// Registry is the set of catalog subscriptions keyed by major-suffixed
	// catalog CUE module path (e.g. "opmodel.dev/catalogs/opm@v2"), projecting
	// core #Platform.#registry. The key's major must agree with the major of
	// the subscribed version (0010:D14).
	// +optional
	Registry map[string]Subscription `json:"registry,omitempty"`

	// SkewPolicy is the operator's response to catalog version skew: a
	// module whose cue.mod requires a newer build of an OPM-namespace path
	// (core or a catalog) than the platform pins (0019:D7/D18).
	// "Warn" (the default when unset) renders against the platform's build
	// and reports the skew as a RenderWarning event on the workload; "Refuse"
	// refuses the render before evaluation and the workload reports
	// Ready=False with reason SkewRefused, naming the path and both versions.
	// The policy is not part of the generated platform module; it is recorded
	// beside it, so changing the field alone bumps the generation, regenerates
	// and re-enqueues the workloads.
	// +kubebuilder:validation:Enum=Warn;Refuse
	// +optional
	SkewPolicy *string `json:"skewPolicy,omitempty"`
}

type PlatformStatus struct {
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// packageIdentity identifies the generated platform package by the two
	// inputs it is a function of (0015:D13): this CR's
	// generation and the sorted set of active claims' catalog coordinates.
	// The same inputs always produce the same value and any change to either
	// produces a different one.
	//
	// This, not status.active on a TransformerRegistration, is the
	// authoritative answer to what a render is building against. The claim
	// reconciler writes the verdict on the claim and this reconciler folds
	// the verdict into the package, so the two are eventually consistent: an
	// observer can see a claim active for a moment before a package
	// containing its catalog exists. Generation is level-computed, so the
	// next regeneration catches up; until it lands, an active claim is a
	// promise about the next package, not a statement about the current one.
	// +optional
	PackageIdentity string `json:"packageIdentity,omitempty"`

	// registry is the resolved union of the registry the platform is
	// running: the subscriptions spec.registry authored plus the catalogs
	// active TransformerRegistrations contributed, each entry recording
	// which. It makes the effective set enumerable from the Platform rather
	// than only by listing every claim, and it is rewritten on every
	// generation, so it follows the active set in both directions.
	// +listType=map
	// +listMapKey=catalog
	// +optional
	Registry []ResolvedRegistryEntry `json:"registry,omitempty"`

	// conditions represent the current state of the Platform resource. The
	// PlatformReconciler summarizes module generation on the Ready condition:
	// Ready=True (reason Generated) when the generated platform module built
	// and its contract inventory was accepted, Ready=False with reason
	// BuildFailed (a pinned build does not exist, a key disagrees with its
	// imported catalog, the module did not build, or its contract inventory
	// could not be read; the message names the dependency, the entry or the
	// field), GenerateFailed (the module could not be written to the
	// operator's disk), OverSubscribedContracts (the module built, but a
	// provider-fulfilled contract is provided by more than one enabled
	// registry entry, counted per entry so two majors of one catalog are
	// two, and whether or not its defining catalog is enabled; the platform
	// cannot route it, and the message names each contract, its defining
	// catalog when one is enabled and the providing registry entries) or
	// ComparablePredicates (the module built, but two enabled transformers
	// have comparable match predicates over a shared catalog-fulfilled
	// contract, so both would render every component the narrower matches;
	// the message names each pair and the contracts it shares). A refused
	// module is not recorded: the last good package keeps serving renders.
	//
	// The ContractsFulfilled condition is a separate, non-gating report on
	// the package renders are consuming, written whenever one is recorded:
	// False with reason UnfulfilledContracts when the package defines
	// provider-fulfilled contracts nothing on the platform implements (the
	// message names each and its defining catalog), True with reason
	// ContractsFulfilled when every defined contract has a provider, and True
	// with reason NoContractsDefined when the enabled catalogs list no
	// contract at all, so nothing was verified. It never moves Ready.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// operatorVersion is the version of the operator that last patched this
	// Platform's status, stamped on every reconcile regardless of outcome
	// (0006:D24). The CLI reads it as the version-skew ceiling;
	// absence means no operator has reconciled the Platform (solo cluster).
	// +optional
	OperatorVersion string `json:"operatorVersion,omitempty"`
}

type ProviderReference struct {
	// Namespace of the claiming ModuleInstance.
	// +kubebuilder:validation:MinLength=1
	// +required
	Namespace string `json:"namespace"`

	// Name of the claiming ModuleInstance.
	// +kubebuilder:validation:MinLength=1
	// +required
	Name string `json:"name"`
}

type RawValues struct {
	apiextensionsv1.JSON `json:",inline"`
}

type RegistryEntrySource string

type ResolvedRegistryEntry struct {
	// catalog is the major-suffixed CUE module path of the catalog.
	// +kubebuilder:validation:MinLength=1
	// +required
	Catalog string `json:"catalog"`

	// version is the bare SemVer build the generated platform module pins
	// the catalog at.
	// +kubebuilder:validation:MinLength=1
	// +required
	Version string `json:"version"`

	// enabled reports whether the catalog's transformers register. A
	// disabled subscription is still pinned and imported by the generated
	// module, so it belongs in the resolved registry, but it contributes no
	// transformer; reading the list without this field would overstate what
	// the platform runs. Every catalog an active claim contributed is
	// enabled.
	// +optional
	Enabled bool `json:"enabled,omitzero"`

	// source records which of the two transformer paths put the catalog
	// here, so an operator can tell an authored subscription from one a
	// provider registered.
	// +required
	Source RegistryEntrySource `json:"source"`
}

type RolloutSpec struct {
	// Strategy controls how apply operations are performed.
	// +kubebuilder:validation:Enum=Apply
	// +optional
	Strategy string `json:"strategy,omitempty"`

	// ForceConflicts enables SSA force ownership when desired.
	// +optional
	ForceConflicts bool `json:"forceConflicts,omitempty"`
}

type SourceReference = fluxmeta.NamespacedObjectKindReference

type SourceStatus struct {
	// Ref is the resolved source reference.
	// +optional
	Ref *SourceReference `json:"ref,omitempty"`

	// ArtifactRevision is the revision reported by the source artifact.
	// +optional
	ArtifactRevision string `json:"artifactRevision,omitempty"`

	// ArtifactDigest is the digest reported by the source artifact.
	// +optional
	ArtifactDigest string `json:"artifactDigest,omitempty"`

	// ArtifactURL is the fetch URL reported by the source artifact.
	// +optional
	ArtifactURL string `json:"artifactURL,omitempty"`
}

type Subscription struct {
	// Enable toggles the subscription. A pointer so that an omitted value
	// defers to the schema default (true) rather than serializing as an
	// explicit false. A disabled subscription is still pinned and imported by
	// the generated module, with enable set to false on its entry.
	// +optional
	Enable *bool `json:"enable,omitempty"`

	// Version names exactly one published catalog build as a bare SemVer
	// string (e.g. "2.0.0-alpha.3") — the platform module IS the resolution
	// (0010:D14); there is no range or allow/deny vocabulary. The
	// version's major must agree with the subscription key's `@vN` suffix.
	// The operator uses it twice: as the generated cue.mod pin and as the
	// entry's stamped expected version, which unifies with the imported
	// catalog's own version so wrong bytes fail the build naming the entry
	// (0019:D13).
	// CRD-required is safe against the stored pre-reshape singleton: API
	// server validation ratcheting keeps status-subresource patches working
	// against a stored object lacking the field (measured in
	// test/integration/crdvalidation).
	// +kubebuilder:validation:MinLength=1
	// +required
	Version string `json:"version"`
}

type TransformerRegistration struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitzero"`

	// spec defines the desired state of TransformerRegistration
	// +required
	Spec TransformerRegistrationSpec `json:"spec"`

	// status defines the observed state of TransformerRegistration
	// +optional
	Status TransformerRegistrationStatus `json:"status,omitzero"`
}

type TransformerRegistrationList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []TransformerRegistration `json:"items"`
}

type TransformerRegistrationSpec struct {
	// Catalog is the provider catalog's major-suffixed CUE module path
	// (e.g. "opmodel.dev/catalogs/k8up@v1"). It names a catalog, never a
	// module: a catalog is what carries transformers, so a claim naming a
	// module names nothing that could implement a contract. Acceptance
	// refuses a non-catalog artifact structurally (0015:D10).
	// +kubebuilder:validation:MinLength=1
	// +required
	Catalog string `json:"catalog"`

	// Version is the released build of the named catalog, a bare SemVer
	// string (e.g. "1.0.0"). It pins the claim to one build, which is what
	// lets acceptance re-derive Provides from the artifact this names.
	// +kubebuilder:validation:MinLength=1
	// +required
	Version string `json:"version"`

	// Provides lists every provider-fulfilled contract FQN the named catalog
	// claims to implement.
	//
	// Required but MAY be empty. A provider catalog implementing no
	// provider-fulfilled contract is a claim acceptance refuses on its merits,
	// naming the catalog it re-derived from, not a malformed object. The CRD
	// is the wrong place to encode a rule the reconciler states better.
	// +required
	Provides []string `json:"provides"`

	// ProviderRef identifies the ModuleInstance that rendered this claim. It
	// is stamped from the rendering instance and never authored, so a module
	// cannot claim to be another provider (0015:D11).
	// +required
	ProviderRef ProviderReference `json:"providerRef"`
}

type TransformerRegistrationStatus struct {
	// observedGeneration is the .metadata.generation this claim was last
	// reconciled for, whether or not that reconcile reached a verdict: a claim
	// waiting on the platform or on its provider's inventory records the
	// generation it observed rather than reading as un-reconciled. A claim
	// whose generation is ahead of this has been edited since, so whatever
	// conditions report is stale.
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// conditions represent the current state of the TransformerRegistration
	// resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// accepted reports whether the claim passed acceptance: the catalog
	// resolved, its Provides re-derived equal, and no other instance holds
	// the same provider.
	// +optional
	Accepted bool `json:"accepted,omitzero"`

	// active reports whether an accepted claim's provider is serving. An
	// accepted claim stays inactive until its ModulePackage is Ready.
	// +optional
	Active bool `json:"active,omitzero"`
}