v1alpha1

type AgentConnectionStatus struct {
	// Connected indicates whether any cluster agent is currently connected
	Connected bool `json:"connected"`

	// ConnectedAgents is the number of cluster agents currently connected
	ConnectedAgents int `json:"connectedAgents"`

	// LastConnectedTime is when an agent last successfully connected
	// +optional
	LastConnectedTime *metav1.Time `json:"lastConnectedTime,omitempty"`

	// LastDisconnectedTime is when the last agent disconnected
	// +optional
	LastDisconnectedTime *metav1.Time `json:"lastDisconnectedTime,omitempty"`

	// LastHeartbeatTime is when the control plane last received any communication from an agent
	// +optional
	LastHeartbeatTime *metav1.Time `json:"lastHeartbeatTime,omitempty"`

	// Message provides additional information about the agent connection status
	// +optional
	Message string `json:"message,omitempty"`
}

type AuthzClusterRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzClusterRoleSpec `json:"spec,omitempty"`
}

type AuthzClusterRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzClusterRoleBindingSpec `json:"spec,omitempty"`
}

type AuthzClusterRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzClusterRoleBinding `json:"items"`
}

type AuthzClusterRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleRef references the AuthzClusterRole to bind
	// NOTE: AuthzClusterRoleBinding can ONLY reference AuthzClusterRole
	// +required
	RoleRef RoleRef `json:"roleRef"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type AuthzClusterRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzClusterRole `json:"items"`
}

type AuthzClusterRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type AuthzRole struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleSpec `json:"spec,omitempty"`
}

type AuthzRoleBinding struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`
	Spec              AuthzRoleBindingSpec `json:"spec,omitempty"`
}

type AuthzRoleBindingList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRoleBinding `json:"items"`
}

type AuthzRoleBindingSpec struct {
	// Entitlement defines the subject (from JWT claims) to grant the role to
	// +required
	Entitlement EntitlementClaim `json:"entitlement"`

	// RoleRef references the role to bind
	// Can reference AuthzClusterRole (platform-wide) or AuthzRole (same namespace only)
	// +required
	RoleRef RoleRef `json:"roleRef"`

	// TargetPath defines which resources this binding applies to within the ownership hierarchy
	// All fields are optional - omitted fields mean "all" at that level
	// +optional
	TargetPath TargetPath `json:"targetPath,omitempty"`

	// Effect indicates whether this binding allows or denies access (default: allow)
	// +kubebuilder:default=allow
	// +optional
	Effect EffectType `json:"effect,omitempty"`
}

type AuthzRoleList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitzero"`
	Items           []AuthzRole `json:"items"`
}

type AuthzRoleSpec struct {
	// Actions is the list of actions this role can perform
	// +kubebuilder:validation:MinItems=1
	// +kubebuilder:example:={"component:create"}
	// +required
	Actions []string `json:"actions"`

	// Description is a human-readable description of the role
	// +optional
	Description string `json:"description,omitempty"`
}

type Build struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BuildSpec   `json:"spec,omitempty"`
	Status BuildStatus `json:"status,omitempty"`
}

type BuildConfiguration struct {
	// Docker specifies the Docker-specific build configuration
	Docker *DockerConfiguration `json:"docker,omitempty"`
	// Buildpack specifies the buildpack to use
	Buildpack *BuildpackConfiguration `json:"buildpack,omitempty"`
}

type BuildList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Build `json:"items"`
}

type BuildOwner struct {
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type BuildPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   BuildPlaneSpec   `json:"spec,omitempty"`
	Status BuildPlaneStatus `json:"status,omitempty"`
}

type BuildPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []BuildPlane `json:"items"`
}

type BuildPlaneRef struct {
	// Kind is the kind of build plane (BuildPlane or ClusterBuildPlane)
	// +required
	Kind BuildPlaneRefKind `json:"kind"`

	// Name is the name of the build plane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	Name string `json:"name"`
}

type BuildPlaneRefKind string

type BuildPlaneSpec struct {

	// PlaneID identifies the logical plane this CR connects to.
	// Multiple BuildPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// If not specified, defaults to the CR name for backwards compatibility.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-builder", "ci-cluster", "us-west-2"
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID,omitempty"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all build planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ObservabilityPlane or ClusterObservabilityPlane for this BuildPlane.
	// If not specified, defaults to an ObservabilityPlane named "default" in the same namespace.
	// +optional
	ObservabilityPlaneRef *ObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type BuildPlaneStatus struct {

	// ObservedGeneration is the generation observed by the controller
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the BuildPlane's state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this build plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type BuildSpec struct {
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner BuildOwner `json:"owner"`

	// Repository contains the source repository configuration
	Repository Repository `json:"repository"`

	// TemplateRef contains the build template reference and parameters
	TemplateRef TemplateRef `json:"templateRef"`
}

type BuildStatus struct {
	// Conditions represent the latest available observations of the build's current state
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// ImageStatus contains information about the built image
	ImageStatus Image `json:"imageStatus,omitempty"`
}

type BuildTemplateSpec struct {
	// Branch specifies the Git branch to use
	Branch string `json:"branch"`
	// Path specifies the repository path to use
	Path string `json:"path"`
	// BuildConfiguration specifies the build settings
	BuildConfiguration *BuildConfiguration `json:"buildConfiguration,omitempty"`
}

type BuildpackConfiguration struct {
	Name    BuildpackName `json:"name"`
	Version string        `json:"version,omitempty"`
}

type BuildpackName string

type ClusterAgentConfig struct {
	// ClientCA contains the CA certificate used to verify the agent's client certificate
	// This allows per-plane CA configuration for enhanced security
	ClientCA ValueFrom `json:"clientCA"`
}

type ClusterBuildPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterBuildPlaneSpec   `json:"spec,omitempty"`
	Status ClusterBuildPlaneStatus `json:"status,omitempty"`
}

type ClusterBuildPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterBuildPlane `json:"items"`
}

type ClusterBuildPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterBuildPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-builder", "ci-cluster", "us-west-2"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all build planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the build plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterBuildPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the controller defaults to a ClusterObservabilityPlane named "default"
	// - If the "default" ClusterObservabilityPlane does not exist, reconciliation fails with an error
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterBuildPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterBuildPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterBuildPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterBuildPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this build plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterComponentType struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterComponentTypeSpec   `json:"spec,omitempty"`
	Status ClusterComponentTypeStatus `json:"status,omitempty"`
}

type ClusterComponentTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterComponentType `json:"items"`
}

type ClusterComponentTypeSpec struct {
	// WorkloadType must be one of: deployment, statefulset, cronjob, job, proxy
	// This determines the primary workload resource type for this component type
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=deployment;statefulset;cronjob;job;proxy
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workloadType cannot be changed after creation"
	WorkloadType string `json:"workloadType"`

	// AllowedWorkflows restricts which Workflow CRs developers can use
	// for building components of this type. If empty, no Workflows are allowed.
	// References must point to Workflow resources.
	// +optional
	AllowedWorkflows []WorkflowRef `json:"allowedWorkflows,omitempty"`

	// Schema defines what developers can configure when creating components of this type
	// +optional
	Schema ComponentTypeSchema `json:"schema,omitempty"`

	// Traits are pre-configured trait instances embedded in the ClusterComponentType.
	// Only ClusterTrait references are allowed since ClusterComponentType is cluster-scoped.
	// The PE binds trait parameters using concrete values or CEL expressions
	// referencing the ComponentType schema (e.g., "${parameters.storage.mountPath}").
	// These traits are automatically applied to all Components of this type.
	// +optional
	Traits []ClusterComponentTypeTrait `json:"traits,omitempty"`

	// AllowedTraits restricts which ClusterTrait CRs developers can attach to Components of this type.
	// When specified, only ClusterTraits listed here (matched by name) may be attached beyond those already embedded in spec.traits.
	// ClusterTrait references listed here must not overlap with traits already embedded in spec.traits.
	// If empty or omitted, no additional component-level traits are allowed.
	// +optional
	AllowedTraits []ClusterTraitRef `json:"allowedTraits,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Resources are templates that generate Kubernetes resources dynamically.
	// At least one resource template is required. For non-proxy workload types,
	// one resource must have an id matching the workloadType. When workloadType
	// is "proxy", a matching resource id is not required.
	// +kubebuilder:validation:MinItems=1
	Resources []ResourceTemplate `json:"resources"`
}

type ClusterComponentTypeStatus struct {
}

type ClusterComponentTypeTrait struct {
	// Kind is the kind of trait. Must be ClusterTrait.
	// +kubebuilder:default=ClusterTrait
	Kind ClusterTraitRefKind `json:"kind,omitempty"`

	// Name is the name of the ClusterTrait resource to use.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance.
	// Must be unique across all embedded traits in the ClusterComponentType
	// and must not collide with any component-level trait instance names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains trait parameter bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${parameters.storage.mountPath}" or "app-data" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvOverrides contains trait environment override bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${envOverrides.storage.size}" or "local-path" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	EnvOverrides *runtime.RawExtension `json:"envOverrides,omitempty"`
}

type ClusterDataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterDataPlaneSpec   `json:"spec,omitempty"`
	Status ClusterDataPlaneStatus `json:"status,omitempty"`
}

type ClusterDataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterDataPlane `json:"items"`
}

type ClusterDataPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterDataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	// +optional
	Gateway GatewaySpec `json:"gateway,omitempty"`

	// ImagePullSecretRefs contains references to SecretReference resources
	// These will be converted to ExternalSecrets and added as imagePullSecrets to all deployments
	// +optional
	ImagePullSecretRefs []string `json:"imagePullSecretRefs,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ClusterObservabilityPlane for this ClusterDataPlane.
	// Since this is a cluster-scoped resource, it can only reference cluster-scoped ClusterObservabilityPlane.
	// Namespace-scoped ObservabilityPlane references are NOT supported for cluster-scoped resources.
	//
	// Default behavior:
	// - If not specified, the system looks for a ClusterObservabilityPlane named "default"
	// - If "default" ClusterObservabilityPlane doesn't exist, observability features are disabled
	//
	// The kind field must be "ClusterObservabilityPlane".
	// +optional
	// +kubebuilder:validation:XValidation:rule="!has(self.kind) || self.kind == 'ClusterObservabilityPlane'",message="ClusterDataPlane can only reference ClusterObservabilityPlane"
	ObservabilityPlaneRef *ClusterObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type ClusterDataPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterDataPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterDataPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterObservabilityPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterObservabilityPlaneSpec   `json:"spec,omitempty"`
	Status ClusterObservabilityPlaneStatus `json:"status,omitempty"`
}

type ClusterObservabilityPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterObservabilityPlane `json:"items"`
}

type ClusterObservabilityPlaneRef struct {
	// Kind is the kind of observability plane. Must be ClusterObservabilityPlane.
	// +required
	Kind ClusterObservabilityPlaneRefKind `json:"kind"`

	// Name is the name of the ClusterObservabilityPlane resource
	// +required
	// +kubebuilder:validation:MinLength=1
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	Name string `json:"name"`
}

type ClusterObservabilityPlaneRefKind string

type ClusterObservabilityPlaneSpec struct {
	// PlaneID identifies the logical plane this CR connects to.
	// Multiple ClusterObservabilityPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// This field is required and must uniquely identify the physical cluster agent connection.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "shared-obs", "monitoring-cluster", "eu-central-1"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all observability planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// ObserverURL is the base URL of the Observer API in the observability plane cluster
	// +required
	ObserverURL string `json:"observerURL"`

	// RCAAgentURL is the base URL of the RCA Agent API in the observability plane cluster
	// +optional
	RCAAgentURL string `json:"rcaAgentURL,omitempty"`
}

type ClusterObservabilityPlaneStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ClusterObservabilityPlane.
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the current state of the ClusterObservabilityPlane resource.
	// +listType=map
	// +listMapKey=type
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this observability plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type ClusterTrait struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ClusterTraitSpec   `json:"spec,omitempty"`
	Status ClusterTraitStatus `json:"status,omitempty"`
}

type ClusterTraitList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ClusterTrait `json:"items"`
}

type ClusterTraitRef struct {
	// Kind is the kind of trait. Must be ClusterTrait.
	// +required
	Kind ClusterTraitRefKind `json:"kind"`

	// Name is the name of the ClusterTrait resource
	// +required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`
}

type ClusterTraitRefKind string

type ClusterTraitSpec struct {
	// Schema defines trait parameters
	// +optional
	Schema TraitSchema `json:"schema,omitempty"`

	// Creates defines new Kubernetes resources to create when this trait is applied
	// +optional
	Creates []TraitCreate `json:"creates,omitempty"`

	// Patches defines modifications to existing resources generated by the ComponentType
	// +optional
	Patches []TraitPatch `json:"patches,omitempty"`
}

type ClusterTraitStatus struct {
}

type Component struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentSpec   `json:"spec,omitempty"`
	Status ComponentStatus `json:"status,omitempty"`
}

type ComponentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Component `json:"items"`
}

type ComponentOwner struct {
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`
}

type ComponentProfile struct {
	// Parameters from ComponentType (oneOf schema based on componentType)
	// This is the merged schema of parameters + envOverrides from the ComponentType
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits to compose into this component
	// Each trait can be instantiated multiple times with different instanceNames
	// +optional
	Traits []ComponentTrait `json:"traits,omitempty"`
}

type ComponentRelease struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentReleaseSpec   `json:"spec,omitempty"`
	Status ComponentReleaseStatus `json:"status,omitempty"`
}

type ComponentReleaseList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentRelease `json:"items"`
}

type ComponentReleaseOwner struct {
	// ProjectName is the name of the project that owns this component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ProjectName string `json:"projectName"`

	// ComponentName is the name of the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	ComponentName string `json:"componentName"`
}

type ComponentReleaseSpec struct {
	// Owner identifies the component and project this ComponentRelease belongs to
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentReleaseOwner `json:"owner"`

	// ComponentType is a full embedded copy of the ComponentType
	// This ensures the ComponentRelease has an immutable snapshot of the ComponentType at the time of component release
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType is immutable"
	ComponentType ComponentTypeSpec `json:"componentType"`

	// Traits maps trait names to their frozen specifications
	// at the time of ComponentRelease, ensuring immutability
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.traits is immutable"
	Traits map[string]TraitSpec `json:"traits,omitempty"`

	// ComponentProfile contains the immutable snapshot of parameter values and trait configs
	// specified for this component at release time
	// +optional
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentProfile is immutable"
	ComponentProfile *ComponentProfile `json:"componentProfile,omitempty"`

	// Workload is a full embedded copy of the Workload
	// This preserves the workload spec with the built image
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workload is immutable"
	Workload WorkloadTemplateSpec `json:"workload"`
}

type ComponentReleaseStatus struct {
}

type ComponentSource struct {
	// GitRepository specifies the configuration for the component source to be a Git repository indicating
	// that the component should be built from the source code.
	// This field is mutually exclusive with the other source types.
	GitRepository *GitRepository `json:"gitRepository,omitempty"`

	// ContainerRegistry specifies the configuration for the component source to be a container image indicating
	// that the component should be deployed using the provided image.
	// This field is mutually exclusive with the other source types.
	ContainerRegistry *ContainerRegistry `json:"containerRegistry,omitempty"`
}

type ComponentSpec struct {
	// Owner defines the ownership information for the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.owner is immutable"
	Owner ComponentOwner `json:"owner"`

	// ComponentType specifies the component type reference with kind and name.
	// Name is in the format: {workloadType}/{componentTypeName}
	// Example: kind=ComponentType, name="deployment/web-app"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.componentType cannot be changed after creation"
	ComponentType ComponentTypeRef `json:"componentType"`

	// AutoDeploy indicates whether the component should be deployed automatically when created
	// When not specified, defaults to false (zero value)
	// +optional
	AutoDeploy bool `json:"autoDeploy,omitempty"`

	// AutoBuild enables automatic builds when code is pushed to the repository
	// When enabled, webhook events will trigger builds automatically
	// Users must manually configure webhooks in their Git provider
	// +optional
	AutoBuild *bool `json:"autoBuild,omitempty"`

	// Parameters from ComponentType (oneOf schema based on componentType)
	// This is the merged schema of parameters + envOverrides from the ComponentType
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// Traits to compose into this component
	// Each trait can be instantiated multiple times with different instanceNames
	// +optional
	Traits []ComponentTrait `json:"traits,omitempty"`

	// Workflow defines the workflow configuration for building the component.
	// This references a Workflow CR and provides parameter values.
	// The Workflow must be in the allowedWorkflows list of the ComponentType.
	// +optional
	Workflow *WorkflowRunConfig `json:"workflow,omitempty"`
}

type ComponentStatus struct {
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
	// LatestRelease keeps the information of the latest ComponentRelease created for this component
	// This is used to make sure the component's latest ComponentRelease is always
	// deployed to the first environment, if the autoDeploy flag is set to true
	// +optional
	LatestRelease *LatestRelease `json:"latestRelease,omitempty"`
}

type ComponentTrait struct {
	// Kind is the kind of trait (Trait or ClusterTrait)
	// +optional
	// +kubebuilder:default=Trait
	Kind TraitRefKind `json:"kind,omitempty"`

	// Name is the name of the Trait resource to use
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance within the component
	// Allows the same trait to be used multiple times with different configurations
	// Must be unique across all traits in the component
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains the trait parameter values
	// The schema for this config is defined in the Trait's schema.parameters and schema.envOverrides
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`
}

type ComponentType struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ComponentTypeSpec   `json:"spec,omitempty"`
	Status ComponentTypeStatus `json:"status,omitempty"`
}

type ComponentTypeList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ComponentType `json:"items"`
}

type ComponentTypeRef struct {
	// Kind is the kind of component type (ComponentType or ClusterComponentType)
	// +optional
	// +kubebuilder:default=ComponentType
	Kind ComponentTypeRefKind `json:"kind,omitempty"`

	// Name is the component type reference in format: {workloadType}/{componentTypeName}
	// +required
	// +kubebuilder:validation:Pattern=`^(deployment|statefulset|cronjob|job|proxy)/[a-z0-9]([-a-z0-9]*[a-z0-9])?$`
	Name string `json:"name"`
}

type ComponentTypeRefKind string

type ComponentTypeSchema struct {
	// Types defines reusable type definitions that can be referenced in schema fields
	// This is a nested map structure where keys are type names and values are type definitions
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Types *runtime.RawExtension `json:"types,omitempty"`

	// Parameters are static across environments and exposed as inputs to developers
	// when creating a Component of this type. This is a nested map structure where
	// keys are field names and values are either nested maps or type definition strings.
	// Type definition format: "type | default=value | enum=val1,val2"
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvOverrides can be overridden per environment via ReleaseBinding by platform engineers.
	// Same nested map structure and type definition format as Parameters.
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Type=object
	EnvOverrides *runtime.RawExtension `json:"envOverrides,omitempty"`
}

type ComponentTypeSpec struct {
	// WorkloadType must be one of: deployment, statefulset, cronjob, job, proxy
	// This determines the primary workload resource type for this component type
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:Enum=deployment;statefulset;cronjob;job;proxy
	// +kubebuilder:validation:XValidation:rule="self == oldSelf",message="spec.workloadType cannot be changed after creation"
	WorkloadType string `json:"workloadType"`

	// AllowedWorkflows restricts which Workflow CRs developers can use
	// for building components of this type. If empty, no Workflows are allowed.
	// References must point to Workflow resources.
	// +optional
	AllowedWorkflows []WorkflowRef `json:"allowedWorkflows,omitempty"`

	// Schema defines what developers can configure when creating components of this type
	// +optional
	Schema ComponentTypeSchema `json:"schema,omitempty"`

	// Traits are pre-configured trait instances embedded in the ComponentType.
	// The PE binds trait parameters using concrete values or CEL expressions
	// referencing the ComponentType schema (e.g., "${parameters.storage.mountPath}").
	// These traits are automatically applied to all Components of this type.
	// +optional
	Traits []ComponentTypeTrait `json:"traits,omitempty"`

	// AllowedTraits restricts which Trait or ClusterTrait CRs developers can attach to Components of this type.
	// When specified, only traits listed here (matched by kind and name) may be attached beyond those already embedded in spec.traits.
	// Trait references listed here must not overlap with traits already embedded in spec.traits.
	// If empty or omitted, no additional component-level traits are allowed.
	// +optional
	AllowedTraits []TraitRef `json:"allowedTraits,omitempty"`

	// Validations are CEL-based rules evaluated during rendering.
	// All rules must evaluate to true for rendering to proceed.
	// +optional
	Validations []ValidationRule `json:"validations,omitempty"`

	// Resources are templates that generate Kubernetes resources dynamically.
	// At least one resource template is required. For non-proxy workload types,
	// one resource must have an id matching the workloadType. When workloadType
	// is "proxy", a matching resource id is not required.
	// +kubebuilder:validation:MinItems=1
	Resources []ResourceTemplate `json:"resources"`
}

type ComponentTypeStatus struct {
}

type ComponentTypeTrait struct {
	// Kind is the kind of trait (Trait or ClusterTrait)
	// +optional
	// +kubebuilder:default=Trait
	Kind TraitRefKind `json:"kind,omitempty"`

	// Name is the name of the Trait resource to use.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Name string `json:"name"`

	// InstanceName uniquely identifies this trait instance.
	// Must be unique across all embedded traits in the ComponentType
	// and must not collide with any component-level trait instance names.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	InstanceName string `json:"instanceName"`

	// Parameters contains trait parameter bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${parameters.storage.mountPath}" or "app-data" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	Parameters *runtime.RawExtension `json:"parameters,omitempty"`

	// EnvOverrides contains trait environment override bindings.
	// Values can be concrete (locked by PE) or CEL expressions referencing
	// the ComponentType schema using ${...} syntax.
	// Example: "${envOverrides.storage.size}" or "local-path" (locked)
	// +optional
	// +kubebuilder:pruning:PreserveUnknownFields
	// +kubebuilder:validation:Schemaless
	EnvOverrides *runtime.RawExtension `json:"envOverrides,omitempty"`
}

type ConfigurationGroup struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ConfigurationGroupSpec   `json:"spec,omitempty"`
	Status ConfigurationGroupStatus `json:"status,omitempty"`
}

type ConfigurationGroupConfiguration struct {
	// Key of the configuration parameter.
	//
	// +required
	// +immutable
	// +kubebuilder:validation:Required
	Key string `json:"key"`

	// List of values for the configuration parameter.
	// These values can be applicable either to a specific environment or an environment group.
	// The value for each specified key may be either a config or a secret. These can be mixed across environments.
	// e.g. use a config value for dev and a secret for prod.
	//
	// +required
	Values []ConfigurationValue `json:"values"`
}

type ConfigurationGroupKeyRef struct {
	// +required
	Name string `json:"name"`
	// +required
	Key string `json:"key"`
}

type ConfigurationGroupList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ConfigurationGroup `json:"items"`
}

type ConfigurationGroupSpec struct {
	// Scope of the configuration group.
	// TODO need to define hierarchy when scope is specific
	//
	// +optional
	// +kubebuilder:default={}
	Scope map[string]string `json:"scope,omitempty"`

	// Environment groups that the configuration group is applicable.
	// This will be used when there are multiple similar environments to avoid repetition.
	//
	// +optional
	EnvironmentGroups []EnvironmentGroup `json:"environmentGroups,omitempty"`

	// Configuration parameters of the configuration group.
	//
	// +required
	Configurations []ConfigurationGroupConfiguration `json:"configurations"`
}

type ConfigurationGroupStatus struct {

	// Conditions represent the latest available observations of the ConfigurationGroup's state
	// +optional
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type ConfigurationValue struct {
	// Reference to the environment group to which this configuration parameter is applicable.
	//
	// This field is mutually exclusive with environment field.
	//
	// +optional
	EnvironmentGroupRef string `json:"environmentGroupRef,omitempty"`

	// Reference to the environment to which this configuration parameter is applicable.
	//
	// This field is mutually exclusive with environmentGroupRef field.
	//
	// +optional
	Environment string `json:"environment,omitempty"`

	// Value of the configuration parameter.
	//
	// This field is mutually exclusive with vaultKey.
	//
	// +optional
	Value string `json:"value,omitempty"`

	// Reference to the secret vault key that contains the value for this configuration parameter.
	//
	// This field is mutually exclusive with value.
	//
	// +optional
	VaultKey string `json:"vaultKey,omitempty"`
}

type ConnectionEnvBindings struct {
	// Address is the env var name for the protocol-appropriate connection string.
	// For HTTP/HTTPS/WS/WSS: scheme://host:port/basePath
	// For gRPC/TCP/UDP: host:port
	// +optional
	Address string `json:"address,omitempty"`

	// Host is the optional env var name for just the hostname.
	// +optional
	Host string `json:"host,omitempty"`

	// Port is the optional env var name for just the port number.
	// +optional
	Port string `json:"port,omitempty"`

	// BasePath is the optional env var name for just the base path.
	// +optional
	BasePath string `json:"basePath,omitempty"`
}

type ConnectionTarget struct {
	// Namespace is the control plane namespace of the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Namespace string `json:"namespace"`

	// Project is the name of the project that owns the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Project string `json:"project"`

	// Component is the name of the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Component string `json:"component"`

	// Endpoint is the name of the endpoint on the target component.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Endpoint string `json:"endpoint"`

	// Visibility is the desired visibility level for resolving the endpoint URL.
	// +kubebuilder:validation:Required
	Visibility EndpointVisibility `json:"visibility"`

	// Environment is the resolved target environment name for this connection.
	// For project/namespace visibility, this matches the consumer's environment.
	// For internal visibility, this may differ based on environmentMapping.
	// +optional
	Environment string `json:"environment,omitempty"`
}

type Container struct {
	// OCI image to run (digest or tag).
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image"`

	// Container entrypoint & args.
	// +optional
	Command []string `json:"command,omitempty"`
	// +optional
	Args []string `json:"args,omitempty"`

	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerOverride struct {
	// Explicit environment variables.
	// +optional
	Env []EnvVar `json:"env,omitempty"`

	// File configurations.
	// +optional
	Files []FileVar `json:"files,omitempty"`
}

type ContainerRegistry struct {
	// Image name of the container image. Format: <registry>/<image> without the tag.
	// Example: docker.io/library/nginx
	ImageName string `json:"imageName,omitempty"`
	// Authentication information to access the container registry.
	Authentication *RegistryAuthentication `json:"authentication,omitempty"`
}

type DataPlane struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DataPlaneSpec   `json:"spec,omitempty"`
	Status DataPlaneStatus `json:"status,omitempty"`
}

type DataPlaneList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DataPlane `json:"items"`
}

type DataPlaneRef struct {
	// Kind is the kind of data plane (DataPlane or ClusterDataPlane)
	// +required
	Kind DataPlaneRefKind `json:"kind"`

	// Name is the name of the data plane resource
	// +required
	Name string `json:"name"`
}

type DataPlaneRefKind string

type DataPlaneSpec struct {

	// PlaneID identifies the logical plane this CR connects to.
	// Multiple DataPlane CRs can share the same planeID to connect to the same physical cluster
	// while maintaining separate configurations for multi-tenancy scenarios.
	// If not specified, defaults to the CR name for backwards compatibility.
	// Format: lowercase alphanumeric characters, hyphens allowed, max 63 characters.
	// Examples: "prod-cluster", "shared-dataplane", "us-east-1"
	// +optional
	// +kubebuilder:validation:MaxLength=63
	// +kubebuilder:validation:Pattern=^[a-z0-9]([-a-z0-9]*[a-z0-9])?$
	PlaneID string `json:"planeID,omitempty"`

	// ClusterAgent specifies the configuration for cluster agent-based communication
	// The cluster agent establishes a WebSocket connection to the control plane's cluster gateway
	// This field is mandatory - all data planes must use cluster agent communication
	ClusterAgent ClusterAgentConfig `json:"clusterAgent"`

	// Gateway specifies the configuration for the API gateway in this DataPlane.
	// +optional
	Gateway GatewaySpec `json:"gateway,omitempty"`

	// ImagePullSecretRefs contains references to SecretReference resources
	// These will be converted to ExternalSecrets and added as imagePullSecrets to all deployments
	// +optional
	ImagePullSecretRefs []string `json:"imagePullSecretRefs,omitempty"`

	// SecretStoreRef specifies the ESO ClusterSecretStore to use in the data plane
	// +optional
	SecretStoreRef *SecretStoreRef `json:"secretStoreRef,omitempty"`

	// ObservabilityPlaneRef specifies the ObservabilityPlane or ClusterObservabilityPlane for this DataPlane.
	// If not specified, defaults to an ObservabilityPlane named "default" in the same namespace.
	// +optional
	ObservabilityPlaneRef *ObservabilityPlaneRef `json:"observabilityPlaneRef,omitempty"`
}

type DataPlaneStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`

	// AgentConnection tracks the status of cluster agent connections to this data plane
	// +optional
	AgentConnection *AgentConnectionStatus `json:"agentConnection,omitempty"`
}

type DeploymentPipeline struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentPipelineSpec   `json:"spec,omitempty"`
	Status DeploymentPipelineStatus `json:"status,omitempty"`
}

type DeploymentPipelineList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentPipeline `json:"items"`
}

type DeploymentPipelineSpec struct {

	// PromotionPaths defines the available paths for promotion between environments
	PromotionPaths []PromotionPath `json:"promotionPaths,omitempty"`
}

type DeploymentPipelineStatus struct {

	// ObservedGeneration represents the .metadata.generation that the condition was set based upon
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`
	// Conditions represent the latest available observations of an object's state
	Conditions []metav1.Condition `json:"conditions,omitempty"`
}

type DeploymentTrack struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   DeploymentTrackSpec   `json:"spec,omitempty"`
	Status DeploymentTrackStatus `json:"status,omitempty"`
}

type DeploymentTrackList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []DeploymentTrack `json:"items"`
}

type DeploymentTrackSpec struct {

	// AutoDeploy defines whether deployment should be triggered automatically
	AutoDeploy bool `json:"autoDeploy,omitempty"`

	// BuildTemplateSpec defines the build template configuration
	BuildTemplateSpec *BuildTemplateSpec `json:"buildTemplateSpec,omitempty"`
}

type DeploymentTrackStatus struct {
	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
}

type DockerConfiguration struct {
	// Context specifies the build context path
	Context string `json:"context"`
	// DockerfilePath specifies the path to the Dockerfile
	DockerfilePath string `json:"dockerfilePath"`
}

type EffectType string

type EmailConfig struct {
	// From is the sender email address
	// Required when type is "email"
	// +kubebuilder:validation:Required
	From string `json:"from"`

	// To is the list of recipient email addresses
	// Required when type is "email"
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinItems=1
	To []string `json:"to"`

	// SMTP configuration for sending emails
	// Required when type is "email"
	// +kubebuilder:validation:Required
	SMTP SMTPConfig `json:"smtp"`

	// Template defines the email template using CEL expressions
	// +kubebuilder:validation:Required
	Template *EmailTemplate `json:"template"`
}

type EmailTemplate struct {
	// Subject is the email subject line template using CEL expressions
	// Example: "[${alert.severity}] - ${alert.name} Triggered"
	// +kubebuilder:validation:Required
	Subject string `json:"subject"`

	// Body is the email body template using CEL expressions
	// Example: "Alert: ${alert.name} triggered at ${alert.startsAt}.\nSummary: ${alert.description}"
	// +kubebuilder:validation:Required
	Body string `json:"body"`
}

type EndpointAccess struct {
	// Host is the hostname or service name
	Host string `json:"host"`

	// Port is the port number
	Port int32 `json:"port"`

	// Scheme is the connection scheme (http, https, grpc, tcp)
	// +optional
	Scheme string `json:"scheme,omitempty"`

	// BasePath is the base URL path (for HTTP-based endpoints)
	// +optional
	BasePath string `json:"basePath,omitempty"`

	// URI is the computed URI for connecting to the endpoint
	// This field is automatically generated from host, port, scheme, and basePath
	// Examples: https://api.example.com:8080/v1, grpc://service:5050, tcp://localhost:9000
	// +optional
	URI string `json:"uri,omitempty"`
}

type EndpointGatewayURLs struct {
	// HTTP is the HTTP gateway URL.
	// +optional
	HTTP *EndpointURL `json:"http,omitempty"`

	// HTTPS is the HTTPS gateway URL.
	// +optional
	HTTPS *EndpointURL `json:"https,omitempty"`

	// TLS is the TLS gateway URL.
	// +optional
	TLS *EndpointURL `json:"tls,omitempty"`
}

type EndpointStatus struct {
	// Name is the endpoint identifier matching spec.endpoints
	Name string `json:"name"`

	// Type is the endpoint type (uses EndpointType from endpoint_types.go)
	Type EndpointType `json:"type"`

	// Project contains access info for project-level visibility
	// +optional
	Project *EndpointAccess `json:"project,omitempty"`

	// Organization contains access info for organization-level visibility
	// +optional
	Organization *EndpointAccess `json:"organization,omitempty"`

	// Public contains access info for public visibility
	// +optional
	Public *EndpointAccess `json:"public,omitempty"`
}

type EndpointType string

type EndpointURL struct {
	// Scheme is the URL scheme (e.g., http, https, tcp, udp, ws, wss, tls).
	// +optional
	Scheme string `json:"scheme,omitempty"`

	// Host is the hostname or IP address.
	// +kubebuilder:validation:Required
	// +kubebuilder:validation:MinLength=1
	Host string `json:"host"`

	// Port is the port number.
	// +optional
	Port int32 `json:"port,omitempty"`

	// Path is the URL path.
	// +optional
	Path string `json:"path,omitempty"`
}

type EndpointURLStatus struct {
	// Name is the endpoint name as defined in the Workload spec.
	Name string `json:"name"`

	// Type is the endpoint type (HTTP, REST, gRPC, GraphQL, Websocket, TCP, UDP).
	// +optional
	Type EndpointType `json:"type,omitempty"`

	// ServiceURL is the in-cluster service URL for this endpoint.
	// +optional
	ServiceURL *EndpointURL `json:"serviceURL,omitempty"`

	// InvokeURL is the resolved public URL for this endpoint, derived from the
	// rendered HTTPRoute whose backendRef port matches the endpoint port.
	// +optional
	InvokeURL string `json:"invokeURL,omitempty"`

	// InternalURLs holds the resolved internal gateway URLs.
	// +optional
	InternalURLs *EndpointGatewayURLs `json:"internalURLs,omitempty"`

	// ExternalURLs holds the resolved external gateway URLs.
	// +optional
	ExternalURLs *EndpointGatewayURLs `json:"externalURLs,omitempty"`
}

type EndpointVisibility string

type EntitlementClaim struct {
	// Claim is the JWT claim name (e.g., "groups", "sub", "email")
	// +required
	Claim string `json:"claim"`

	// Value is the entitlement value to match
	// +required
	Value string `json:"value"`
}