v1alpha1

type AgentConnectionStatus struct {
	// Connected indicates whether any cluster agent is currently connected
	Connected bool `json:"connected"`

	// ConnectedAgents is the number of cluster agents currently connected
	ConnectedAgents int `json:"connectedAgents"`

	// LastConnectedTime is when an agent last successfully connected
	// +optional
	LastConnectedTime *metav1.Time `json:"lastConnectedTime,omitempty"`

	// LastDisconnectedTime is when the last agent disconnected
	// +optional
	LastDisconnectedTime *metav1.Time `json:"lastDisconnectedTime,omitempty"`

	// LastHeartbeatTime is when the control plane last received any communication from an agent
	// +optional
	LastHeartbeatTime *metav1.Time `json:"lastHeartbeatTime,omitempty"`

	// Message provides additional information about the agent connection status
	// +optional
	Message string `json:"message,omitempty"`
}

type AuthzClusterRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzClusterRoleSpec `json:"spec,omitempty"`
}

type AuthzClusterRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzClusterRoleBindingSpec `json:"spec,omitempty"`
}

type AuthzClusterRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzClusterRoleBinding `json:"items"`
}

type AuthzClusterRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleRef references the AuthzClusterRole to bind
	// NOTE: AuthzClusterRoleBinding can ONLY reference AuthzClusterRole
	// +required
	RoleRef RoleRef `json:"roleRef"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type AuthzClusterRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzClusterRole `json:"items"`
}

type AuthzClusterRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type AuthzRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleSpec `json:"spec,omitempty"`
}

type AuthzRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleBindingSpec `json:"spec,omitempty"`
}

type AuthzRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRoleBinding `json:"items"`
}

type AuthzRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleRef references the role to bind
	// Can reference AuthzClusterRole (platform-wide) or AuthzRole (same namespace only)
	// +required
	RoleRef RoleRef `json:"roleRef"`

	// TargetPath defines which resources this binding applies to within the ownership hierarchy
	// All fields are optional - omitted fields mean "all" at that level
	// +optional
	TargetPath TargetPath `json:"targetPath,omitempty"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type AuthzRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRole `json:"items"`
}

type AuthzRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type Build struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BuildSpec   `json:"spec,omitempty"`
	Status BuildStatus `json:"status,omitempty"`
}

type BuildConfiguration struct {
	// Docker specifies the Docker-specific build configuration
	Docker *DockerConfiguration `json:"docker,omitempty"`
	// Buildpack specifies the buildpack to use
	Buildpack *BuildpackConfiguration `json:"buildpack,omitempty"`
}

type BuildList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Build `json:"items"`
}

type BuildOwner struct {
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type BuildPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BuildPlaneSpec   `json:"spec,omitempty"`
	Status BuildPlaneStatus `json:"status,omitempty"`
}

type BuildPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BuildPlane `json:"items"`
}

type BuildPlaneRef struct {
	// Kind is the kind of build plane (BuildPlane or ClusterBuildPlane)
	// +required
	Kind BuildPlaneRefKind `json:"kind"`

	// Name is the name of the build plane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`
}

type BuildPlaneRefKind string

type BuildPlaneSpec struct {

	// PlaneID identifies the logical plane this CR connects to.
	// Multiple BuildPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// If not specified, defaults to the CR name for backwards compatibility.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-builder", "ci-cluster", "us-west-2"
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID,omitempty"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all build planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ObservabilityPlane or ClusterObservabilityPlane for this BuildPlane.
	// If not specified, defaults to an ObservabilityPlane named "default" in the same namespace.
	// +optional
	ObservabilityPlaneRef *ObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type BuildPlaneStatus struct {

	// ObservedGeneration is the generation observed by the controller
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the BuildPlane's state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this build plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type BuildSpec struct {
	Owner BuildOwner `json:"owner"`

	// Repository contains the source repository configuration
	Repository Repository `json:"repository"`

	// TemplateRef contains the build template reference and parameters
	TemplateRef TemplateRef `json:"templateRef"`
}

type BuildStatus struct {
	// Conditions represent the latest available observations of the build's current state
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ImageStatus contains information about the built image
	ImageStatus Image `json:"imageStatus,omitempty"`
}

type BuildTemplateSpec struct {
	// Branch specifies the Git branch to use
	Branch string `json:"branch"`
	// Path specifies the repository path to use
	Path string `json:"path"`
	// BuildConfiguration specifies the build settings
	BuildConfiguration *BuildConfiguration `json:"buildConfiguration,omitempty"`
}

type BuildpackConfiguration struct {
	Name    BuildpackName `json:"name"`
	Version string        `json:"version,omitempty"`
}

type BuildpackName string

type ClusterAgentConfig struct {
	// ClientCA contains the CA certificate used to verify the agent's client certificate
	// This allows per-plane CA configuration for enhanced security
	ClientCA ValueFrom `json:"clientCA"`
}

type ClusterBuildPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterBuildPlaneSpec   `json:"spec,omitempty"`
	Status ClusterBuildPlaneStatus `json:"status,omitempty"`
}

type ClusterBuildPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterBuildPlane `json:"items"`
}

type ClusterBuildPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterBuildPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-builder", "ci-cluster", "us-west-2"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all build planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the build plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterBuildPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the controller defaults to a ClusterObservabilityPlane named "default"
	// - If the "default" ClusterObservabilityPlane does not exist, reconciliation fails with an error
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterBuildPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterBuildPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterBuildPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterBuildPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this build plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterDataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterDataPlaneSpec   `json:"spec,omitempty"`
	Status ClusterDataPlaneStatus `json:"status,omitempty"`
}

type ClusterDataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterDataPlane `json:"items"`
}

type ClusterDataPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterDataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	Gateway GatewaySpec `json:"gateway"`

	// ImagePullSecretRefs contains references to SecretReference resources
	// These will be converted to ExternalSecrets and added as imagePullSecrets to all deployments
	// +optional
	ImagePullSecretRefs []string `json:"imagePullSecretRefs,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterDataPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the system looks for a ClusterObservabilityPlane named "default"
	// - If "default" ClusterObservabilityPlane doesn't exist, observability features are disabled
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterDataPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterDataPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterDataPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterDataPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterObservabilityPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterObservabilityPlaneSpec   `json:"spec,omitempty"`
	Status ClusterObservabilityPlaneStatus `json:"status,omitempty"`
}

type ClusterObservabilityPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterObservabilityPlane `json:"items"`
}

type ClusterObservabilityPlaneRef struct {
	// Kind is the kind of observability plane. Must be ClusterObservabilityPlane.
	// +required
	Kind ClusterObservabilityPlaneRefKind `json:"kind"`

	// Name is the name of the ClusterObservabilityPlane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	Name string `json:"name"`
}

type ClusterObservabilityPlaneRefKind string

type ClusterObservabilityPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterObservabilityPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-obs", "monitoring-cluster", "eu-central-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all observability planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// ObserverURL is the base URL of the Observer API in the observability plane cluster
	// +required
	ObserverURL string `json:"observerURL"`

	// RCAAgentURL is the base URL of the RCA Agent API in the observability plane cluster
	// +optional
	RCAAgentURL string `json:"rcaAgentURL,omitempty"`
}

type ClusterObservabilityPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterObservabilityPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterObservabilityPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this observability plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type Component struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentSpec   `json:"spec,omitempty"`
	Status ComponentStatus `json:"status,omitempty"`
}

type ComponentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Component `json:"items"`
}

type ComponentOwner struct {
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`
}

type ComponentProfile struct {
	// Parameters from ComponentType (oneOf schema based on componentType)
	// This is the merged schema of parameters + envOverrides from the ComponentType
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits to compose into this component
	// Each trait can be instantiated multiple times with different instanceNames
	// +optional
	Traits []ComponentTrait `json:"traits,omitempty"`
}

type ComponentRelease struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentReleaseSpec   `json:"spec,omitempty"`
	Status ComponentReleaseStatus `json:"status,omitempty"`
}

type ComponentReleaseList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentRelease `json:"items"`
}

type ComponentReleaseOwner struct {
	// ProjectName is the name of the project that owns this component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`

	// ComponentName is the name of the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type ComponentReleaseSpec struct {
	// Owner identifies the component and project this ComponentRelease belongs to
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentReleaseOwner `json:"owner"`

	// ComponentType is a full embedded copy of the ComponentType
	// This ensures the ComponentRelease has an immutable snapshot of the ComponentType at the time of component release
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType is immutable"
	ComponentType ComponentTypeSpec `json:"componentType"`

	// Traits maps trait names to their frozen specifications
	// at the time of ComponentRelease, ensuring immutability
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.traits is immutable"
	Traits map[string]TraitSpec `json:"traits,omitempty"`

	// ComponentProfile contains the immutable snapshot of parameter values and trait configs
	// specified for this component at release time
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentProfile is immutable"
	ComponentProfile *ComponentProfile `json:"componentProfile,omitempty"`

	// Workload is a full embedded copy of the Workload
	// This preserves the workload spec with the built image
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workload is immutable"
	Workload WorkloadTemplateSpec `json:"workload"`
}

type ComponentReleaseStatus struct {
}

type ComponentSource struct {
	// GitRepository specifies the configuration for the component source to be a Git repository indicating
	// that the component should be built from the source code.
	// This field is mutually exclusive with the other source types.
	GitRepository *GitRepository `json:"gitRepository,omitempty"`

	// ContainerRegistry specifies the configuration for the component source to be a container image indicating
	// that the component should be deployed using the provided image.
	// This field is mutually exclusive with the other source types.
	ContainerRegistry *ContainerRegistry `json:"containerRegistry,omitempty"`
}

type ComponentSpec struct {
	// Owner defines the ownership information for the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentOwner `json:"owner"`

	// Type specifies the component type (e.g., Service, WebApplication, etc.)
	// LEGACY FIELD: Use componentType instead for new components with ComponentTypes
	// +optional
	Type DefinedComponentType `json:"type,omitempty"`

	// ComponentType specifies the component type in the format: {workloadType}/{componentTypeName}
	// Example: "deployment/web-app", "cronjob/scheduled-task"
	// This field is used with ComponentTypes (new model)
	// +optional
	// +kubebuilder:validation:Pattern=`^(deployment|statefulset|cronjob|job|proxy)/[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType cannot be changed after creation"
	ComponentType string `json:"componentType,omitempty"`

	// AutoDeploy indicates whether the component should be deployed automatically when created
	// When not specified, defaults to false (zero value)
	// +optional
	AutoDeploy bool `json:"autoDeploy,omitempty"`

	// AutoBuild enables automatic builds when code is pushed to the repository
	// When enabled, webhook events will trigger builds automatically
	// Users must manually configure webhooks in their Git provider
	// +optional
	AutoBuild *bool `json:"autoBuild,omitempty"`

	// Parameters from ComponentType (oneOf schema based on componentType)
	// This is the merged schema of parameters + envOverrides from the ComponentType
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits to compose into this component
	// Each trait can be instantiated multiple times with different instanceNames
	// +optional
	Traits []ComponentTrait `json:"traits,omitempty"`

	// Workflow defines the component workflow configuration for building the component.
	// This references a ComponentWorkflow CR and provides both system parameters (repository info)
	// and developer-configured parameter values.
	// The ComponentWorkflow must be in the allowedWorkflows list of the ComponentType.
	// +optional
	Workflow *ComponentWorkflowRunConfig `json:"workflow,omitempty"`
}

type ComponentStatus struct {
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
	// LatestRelease keeps the information of the latest ComponentRelease created for this component
	// This is used to make sure the component's latest ComponentRelease is always
	// deployed to the first environment, if the autoDeploy flag is set to true
	// +optional
	LatestRelease *LatestRelease `json:"latestRelease,omitempty"`
}

type ComponentTrait struct {
	// Name is the name of the Trait resource to use
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance within the component
	// Allows the same trait to be used multiple times with different configurations
	// Must be unique across all traits in the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains the trait parameter values
	// The schema for this config is defined in the Trait's schema.parameters and schema.envOverrides
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentType struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentTypeSpec   `json:"spec,omitempty"`
	Status ComponentTypeStatus `json:"status,omitempty"`
}

type ComponentTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentType `json:"items"`
}

type ComponentTypeSchema struct {
	// Types defines reusable type definitions that can be referenced in schema fields
	// This is a nested map structure where keys are type names and values are type definitions
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Types *runtime.RawExtension `json:"types,omitempty"`

	// Parameters are static across environments and exposed as inputs to developers
	// when creating a Component of this type. This is a nested map structure where
	// keys are field names and values are either nested maps or type definition strings.
	// Type definition format: "type | default=value | required=true | enum=val1,val2"
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvOverrides can be overridden per environment via ReleaseBinding by platform engineers.
	// Same nested map structure and type definition format as Parameters.
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	EnvOverrides *runtime.RawExtension `json:"envOverrides,omitempty"`
}

type ComponentTypeSpec struct {
	// WorkloadType must be one of: deployment, statefulset, cronjob, job, proxy
	// This determines the primary workload resource type for this component type
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=deployment;statefulset;cronjob;job;proxy
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workloadType cannot be changed after creation"
	WorkloadType string `json:"workloadType"`

	// AllowedWorkflows restricts which ComponentWorkflow CRs developers can use
	// for building components of this type. If empty, no ComponentWorkflows are allowed.
	// References must point to ComponentWorkflow resources, not generic Workflow resources.
	// +optional
	AllowedWorkflows []string `json:"allowedWorkflows,omitempty"`

	// Schema defines what developers can configure when creating components of this type
	// +optional
	Schema ComponentTypeSchema `json:"schema,omitempty"`

	// Traits are pre-configured trait instances embedded in the ComponentType.
	// The PE binds trait parameters using concrete values or CEL expressions
	// referencing the ComponentType schema (e.g., "${parameters.storage.mountPath}").
	// These traits are automatically applied to all Components of this type.
	// +optional
	Traits []ComponentTypeTrait `json:"traits,omitempty"`

	// AllowedTraits restricts which Trait CRs developers can attach to Components of this type.
	// Trait names listed here must not overlap with traits already embedded in spec.traits.
	// +optional
	AllowedTraits []string `json:"allowedTraits,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Resources are templates that generate Kubernetes resources dynamically
	// At least one resource must be defined with an id matching the workloadType
	// +kubebuilder:validation:MinItems=1
	Resources []ResourceTemplate `json:"resources"`
}

type ComponentTypeStatus struct {
}

type ComponentTypeTrait struct {
	// Name is the name of the Trait resource to use.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance.
	// Must be unique across all embedded traits in the ComponentType
	// and must not collide with any component-level trait instance names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains trait parameter bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${parameters.storage.mountPath}" or "app-data" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvOverrides contains trait environment override bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${envOverrides.storage.size}" or "local-path" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	EnvOverrides *runtime.RawExtension `json:"envOverrides,omitempty"`
}

type ComponentWorkflow struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ComponentWorkflow
	// +required
	Spec ComponentWorkflowSpec `json:"spec"`

	// status defines the observed state of ComponentWorkflow
	// +optional
	Status ComponentWorkflowStatus `json:"status,omitempty,omitzero"`
}

type ComponentWorkflowImage struct {
	// Image is the fully qualified image name (e.g., registry.example.com/myapp:v1.0.0)
	// +optional
	Image string `json:"image,omitempty"`
}

type ComponentWorkflowList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentWorkflow `json:"items"`
}

type ComponentWorkflowOwner struct {
	// ProjectName is the name of the owning Project
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`

	// ComponentName is the name of the owning Component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type ComponentWorkflowResource struct {
	// ID uniquely identifies this resource within the component workflow.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ID string `json:"id"`

	// IncludeWhen is a CEL expression that determines whether this resource should be rendered.
	// If the expression evaluates to false, the resource is skipped.
	// If empty, the resource is always included.
	// Example: has(systemParameters.secretRef)
	// +optional
	IncludeWhen string `json:"includeWhen,omitempty"`

	// Template contains the Kubernetes resource with CEL expressions.
	// CEL expressions are enclosed in ${...} and will be evaluated at runtime.
	// +kubebuilder:validation:Required
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Template *runtime.RawExtension `json:"template"`
}

type ComponentWorkflowRun struct {
	metav1.TypeMeta `json:",inline"`

	// metadata is a standard object metadata
	// +optional
	metav1.ObjectMeta `json:"metadata,omitempty,omitzero"`

	// spec defines the desired state of ComponentWorkflowRun
	// +required
	Spec ComponentWorkflowRunSpec `json:"spec"`

	// status defines the observed state of ComponentWorkflowRun
	// +optional
	Status ComponentWorkflowRunStatus `json:"status,omitempty,omitzero"`
}

type ComponentWorkflowRunConfig struct {
	// Name references the ComponentWorkflow CR to use for this execution.
	// The ComponentWorkflow CR contains the schema definition and resource template.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// SystemParameters contains the actual repository information values.
	// This must conform to the required system parameters structure:
	//   - repository.url
	//   - repository.revision.branch
	//   - repository.revision.commit
	//   - repository.appPath
	// +kubebuilder:validation:Required
	SystemParameters SystemParametersValues `json:"systemParameters"`

	// Parameters contains the developer-provided values for the flexible parameter schema
	// defined in the referenced ComponentWorkflow CR.
	//
	// These values are validated against the ComponentWorkflow's parameter schema.
	//
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentWorkflowRunList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentWorkflowRun `json:"items"`
}

type ComponentWorkflowRunSpec struct {
	// Owner identifies the Component that owns this ComponentWorkflowRun.
	// This is required for component workflow executions.
	// +kubebuilder:validation:Required
	Owner ComponentWorkflowOwner `json:"owner"`

	// Workflow configuration referencing the ComponentWorkflow CR and providing parameter values.
	// +kubebuilder:validation:Required
	Workflow ComponentWorkflowRunConfig `json:"workflow"`

	// TTLAfterCompletion defines the time-to-live for this workflow run after completion.
	// This value is copied from the ComponentWorkflow template.
	// Format: duration string supporting days, hours, minutes, seconds without spaces (e.g., "90d", "10d1h30m", "1h30m")
	// Examples: "90d", "10d", "1h30m", "30m", "1d12h30m15s"
	// +optional
	// +kubebuilder:validation:Pattern=`^(\d+d)?(\d+h)?(\d+m)?(\d+s)?$`
	TTLAfterCompletion string `json:"ttlAfterCompletion,omitempty"`
}

type ComponentWorkflowRunStatus struct {
	// Conditions represent the current state of the ComponentWorkflowRun resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ImageStatus contains information about the built container image from the workflow execution.
	// This is populated when the workflow produces a container image.
	// +optional
	ImageStatus ComponentWorkflowImage `json:"imageStatus,omitempty"`

	// RunReference contains a reference to the workflow run resource that was applied to the build plane cluster.
	// This tracks the actual workflow execution instance (e.g., Argo Workflow) in the target cluster.
	// +optional
	RunReference *ResourceReference `json:"runReference,omitempty"`

	// Resources contains references to additional resources applied to the build plane cluster.
	// These are tracked for cleanup when the ComponentWorkflowRun is deleted.
	// +optional
	Resources *[]ResourceReference `json:"resources,omitempty"`

	// Tasks contains the list of workflow tasks with their execution status.
	// This provides a vendor-neutral view of the workflow steps regardless of the underlying
	// workflow engine (e.g., Argo Workflows, Tekton).
	// Tasks are ordered by their execution sequence.
	// +optional
	Tasks []WorkflowTask `json:"tasks,omitempty"`

	// StartedAt is the timestamp when this workflow run started execution.
	// +optional
	StartedAt *metav1.Time `json:"startedAt,omitempty"`

	// CompletedAt is the timestamp when this workflow run finished execution (succeeded or failed).
	// This is used together with TTLAfterCompletion to determine when to delete the workflow run.
	// +optional
	CompletedAt *metav1.Time `json:"completedAt,omitempty"`
}

type ComponentWorkflowSchema struct {
	// Types defines reusable type definitions that can be referenced in schema fields.
	// This is a nested map structure where keys are type names and values are type definitions.
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Types *runtime.RawExtension `json:"types,omitempty"`

	// SystemParameters defines the required structured schema for repository information.
	// This schema must follow a specific structure to enable build-specific platform features.
	// Platform Engineers can customize defaults, enums, and descriptions within each field,
	// but must maintain the field names, nesting structure, and types (all must be string).
	// +kubebuilder:validation:Required
	SystemParameters SystemParametersSchema `json:"systemParameters"`

	// Parameters defines the flexible PE-defined schema for additional build configuration.
	// Platform Engineers have complete freedom to define any structure, types, and validation rules.
	//
	// This is a nested map structure where keys are field names and values are type definitions.
	// Type definition format: "type | default=value enum=val1,val2 minimum=N maximum=N"
	//
	// Supported types: string, integer, boolean, array<type>, object
	//
	// Example:
	//   parameters:
	//     version: 'integer | default=1 description="Build version"'
	//     testMode: "string | enum=unit,integration,none default=unit"
	//     resources:
	//       cpuCores: "integer | default=1 minimum=1 maximum=8"
	//       memoryGb: "integer | default=2 minimum=1 maximum=32"
	//     cache:
	//       enabled: "boolean | default=true"
	//       paths: "array<string> | default=["/root/.cache"]"
	//
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentWorkflowSpec struct {
	// Schema defines the parameter schemas for this component workflow.
	// It includes both required system parameters (for repository information)
	// and flexible developer parameters (PE-defined).
	// +kubebuilder:validation:Required
	Schema ComponentWorkflowSchema `json:"schema"`

	// RunTemplate is the Kubernetes resource template to be rendered and applied to the build plane.
	// Template variables are substituted with context and parameter values.
	// Supported template variables:
	//   ${metadata.workflowRunName}  - ComponentWorkflowRun CR name
	//   ${metadata.componentName}    - Component name
	//   ${metadata.projectName}      - Project name
	//   ${metadata.namespaceName}    - Namespace
	//   ${systemParameters.*}        - System parameter values
	//   ${parameters.*}              - Developer parameter values
	// +kubebuilder:validation:Required
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	RunTemplate *runtime.RawExtension `json:"runTemplate"`

	// Resources are additional templates that generate Kubernetes resources dynamically
	// to be deployed alongside the workflow run (e.g., secrets, configmaps).
	// Template variables are substituted with context and parameter values.
	// +optional
	Resources []ComponentWorkflowResource `json:"resources,omitempty"`

	// TTLAfterCompletion defines the time-to-live for ComponentWorkflowRun instances after completion.
	// Once a ComponentWorkflowRun completes, it will be automatically deleted after this duration.
	// Format: duration string supporting days, hours, minutes, seconds without spaces (e.g., "90d", "10d1h30m", "1h30m")
	// Examples: "90d", "10d", "1h30m", "30m", "1d12h30m15s"
	// If empty, workflow runs are not automatically deleted.
	// +optional
	// +kubebuilder:validation:Pattern=`^(\d+d)?(\d+h)?(\d+m)?(\d+s)?$`
	TTLAfterCompletion string `json:"ttlAfterCompletion,omitempty"`
}

type ComponentWorkflowStatus struct {

	// conditions represent the current state of the ComponentWorkflow resource.
	// Each condition has a unique type and reflects the status of a specific aspect of the resource.
	//
	// Standard condition types include:
	// - "Available": the resource is fully functional
	// - "Progressing": the resource is being created or updated
	// - "Degraded": the resource failed to reach or maintain its desired state
	//
	// The status of each condition is one of True, False, or Unknown.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type ConfigurationGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConfigurationGroupSpec   `json:"spec,omitempty"`
	Status ConfigurationGroupStatus `json:"status,omitempty"`
}

type ConfigurationGroupConfiguration struct {
	// Key of the configuration parameter.
	//
	// +required
	// +immutable
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// List of values for the configuration parameter.
	// These values can be applicable either to a specific environment or an environment group.
	// The value for each specified key may be either a config or a secret. These can be mixed across environments.
	// e.g. use a config value for dev and a secret for prod.
	//
	// +required
	Values []ConfigurationValue `json:"values"`
}

type ConfigurationGroupKeyRef struct {
	// +required
	Name string `json:"name"`
	// +required
	Key string `json:"key"`
}

type ConfigurationGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConfigurationGroup `json:"items"`
}

type ConfigurationGroupSpec struct {
	// Scope of the configuration group.
	// TODO need to define hierarchy when scope is specific
	//
	// +optional
	// +kubebuilder:default={}
	Scope map[string]string `json:"scope,omitempty"`

	// Environment groups that the configuration group is applicable.
	// This will be used when there are multiple similar environments to avoid repetition.
	//
	// +optional
	EnvironmentGroups []EnvironmentGroup `json:"environmentGroups,omitempty"`

	// Configuration parameters of the configuration group.
	//
	// +required
	Configurations []ConfigurationGroupConfiguration `json:"configurations"`
}

type ConfigurationGroupStatus struct {

	// Conditions represent the latest available observations of the ConfigurationGroup's state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type ConfigurationValue struct {
	// Reference to the environment group to which this configuration parameter is applicable.
	//
	// This field is mutually exclusive with environment field.
	//
	// +optional
	EnvironmentGroupRef string `json:"environmentGroupRef,omitempty"`

	// Reference to the environment to which this configuration parameter is applicable.
	//
	// This field is mutually exclusive with environmentGroupRef field.
	//
	// +optional
	Environment string `json:"environment,omitempty"`

	// Value of the configuration parameter.
	//
	// This field is mutually exclusive with vaultKey.
	//
	// +optional
	Value string `json:"value,omitempty"`

	// Reference to the secret vault key that contains the value for this configuration parameter.
	//
	// This field is mutually exclusive with value.
	//
	// +optional
	VaultKey string `json:"vaultKey,omitempty"`
}

type Container struct {
	// OCI image to run (digest or tag).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image"`

	// Container entrypoint & args.
	// +optional
	Command []string `json:"command,omitempty"`
	// +optional
	Args []string `json:"args,omitempty"`

	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerOverride struct {
	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerRegistry struct {
	// Image name of the container image. Format: <registry>/<image> without the tag.
	// Example: docker.io/library/nginx
	ImageName string `json:"imageName,omitempty"`
	// Authentication information to access the container registry.
	Authentication *RegistryAuthentication `json:"authentication,omitempty"`
}

type DataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DataPlaneSpec   `json:"spec,omitempty"`
	Status DataPlaneStatus `json:"status,omitempty"`
}

type DataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DataPlane `json:"items"`
}

type DataPlaneRef struct {
	// Kind is the kind of data plane (DataPlane or ClusterDataPlane)
	// +required
	Kind DataPlaneRefKind `json:"kind"`

	// Name is the name of the data plane resource
	// +required
	Name string `json:"name"`
}

type DataPlaneRefKind string

type DataPlaneSpec struct {

	// PlaneID identifies the logical plane this CR connects to.
	// Multiple DataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// If not specified, defaults to the CR name for backwards compatibility.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID,omitempty"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	Gateway GatewaySpec `json:"gateway"`

	// ImagePullSecretRefs contains references to SecretReference resources
	// These will be converted to ExternalSecrets and added as imagePullSecrets to all deployments
	// +optional
	ImagePullSecretRefs []string `json:"imagePullSecretRefs,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ObservabilityPlane or ClusterObservabilityPlane for this DataPlane.
	// If not specified, defaults to an ObservabilityPlane named "default" in the same namespace.
	// +optional
	ObservabilityPlaneRef *ObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type DataPlaneStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type DefinedComponentType string

type DeploymentPipeline struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentPipelineSpec   `json:"spec,omitempty"`
	Status DeploymentPipelineStatus `json:"status,omitempty"`
}

type DeploymentPipelineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentPipeline `json:"items"`
}

type DeploymentPipelineSpec struct {

	// PromotionPaths defines the available paths for promotion between environments
	PromotionPaths []PromotionPath `json:"promotionPaths,omitempty"`
}

type DeploymentPipelineStatus struct {

	// ObservedGeneration represents the .metadata.generation that the condition was set based upon
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Conditions represent the latest available observations of an object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DeploymentTrack struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentTrackSpec   `json:"spec,omitempty"`
	Status DeploymentTrackStatus `json:"status,omitempty"`
}

type DeploymentTrackList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentTrack `json:"items"`
}

type DeploymentTrackSpec struct {

	// AutoDeploy defines whether deployment should be triggered automatically
	AutoDeploy bool `json:"autoDeploy,omitempty"`

	// BuildTemplateSpec defines the build template configuration
	BuildTemplateSpec *BuildTemplateSpec `json:"buildTemplateSpec,omitempty"`
}

type DeploymentTrackStatus struct {
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
}

type DockerConfiguration struct {
	// Context specifies the build context path
	Context string `json:"context"`
	// DockerfilePath specifies the path to the Dockerfile
	DockerfilePath string `json:"dockerfilePath"`
}

type EffectType string

type EmailConfig struct {
	// From is the sender email address
	// Required when type is "email"
	// +kubebuilder:validation:Required
	From string `json:"from"`

	// To is the list of recipient email addresses
	// Required when type is "email"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	To []string `json:"to"`

	// SMTP configuration for sending emails
	// Required when type is "email"
	// +kubebuilder:validation:Required
	SMTP SMTPConfig `json:"smtp"`

	// Template defines the email template using CEL expressions
	// +kubebuilder:validation:Required
	Template *EmailTemplate `json:"template"`
}

type EmailTemplate struct {
	// Subject is the email subject line template using CEL expressions
	// Example: "[${alert.severity}] - ${alert.name} Triggered"
	// +kubebuilder:validation:Required
	Subject string `json:"subject"`

	// Body is the email body template using CEL expressions
	// Example: "Alert: ${alert.name} triggered at ${alert.startsAt}.\nSummary: ${alert.description}"
	// +kubebuilder:validation:Required
	Body string `json:"body"`
}

type EndpointAccess struct {
	// Host is the hostname or service name
	Host string `json:"host"`

	// Port is the port number
	Port int32 `json:"port"`

	// Scheme is the connection scheme (http, https, grpc, tcp)
	// +optional
	Scheme string `json:"scheme,omitempty"`

	// BasePath is the base URL path (for HTTP-based endpoints)
	// +optional
	BasePath string `json:"basePath,omitempty"`

	// URI is the computed URI for connecting to the endpoint
	// This field is automatically generated from host, port, scheme, and basePath
	// Examples: https://api.example.com:8080/v1, grpc://service:5050, tcp://localhost:9000
	// +optional
	URI string `json:"uri,omitempty"`
}

type EndpointStatus struct {
	// Name is the endpoint identifier matching spec.endpoints
	Name string `json:"name"`

	// Type is the endpoint type (uses EndpointType from endpoint_types.go)
	Type EndpointType `json:"type"`

	// Project contains access info for project-level visibility
	// +optional
	Project *EndpointAccess `json:"project,omitempty"`

	// Organization contains access info for organization-level visibility
	// +optional
	Organization *EndpointAccess `json:"organization,omitempty"`

	// Public contains access info for public visibility
	// +optional
	Public *EndpointAccess `json:"public,omitempty"`
}

type EndpointType string

type EndpointURLStatus struct {
	// Name is the endpoint name as defined in the Workload spec.
	Name string `json:"name"`

	// InvokeURL is the resolved public URL for this endpoint, derived from the
	// rendered HTTPRoute whose backendRef port matches the endpoint port.
	InvokeURL string `json:"invokeURL"`
}

type EndpointVisibility string

type EntitlementClaim struct {
	// Claim is the JWT claim name (e.g., "groups", "sub", "email")
	// +required
	Claim string `json:"claim"`

	// Value is the entitlement value to match
	// +required
	Value string `json:"value"`
}