v1alpha1

type Action struct {
	Name     ObjectName      `json:"name"`
	On       ObjectName      `json:"on"`                 // the dependency (Dependency.Name) this fires on
	Workflow ObjectName      `json:"workflow,omitempty"` // start a WorkflowRun of this Workflow
	Function ObjectName      `json:"function,omitempty"` // invoke this Function with the CloudEvent
	Input    json.RawMessage `json:"input,omitempty"`    // object; literals or ${{ event.* }} (checked at reconcile)
}

type AssignmentEntry struct {
	Principal *PrincipalRef `json:"principal,omitempty"`
	RoleRef   RoleRef       `json:"roleRef"`
	Scope     *ScopeRef     `json:"scope,omitempty"`
}

type AuthMode string

type BlobEvent struct {
	Name   ObjectName      `json:"name"`
	Prefix string          `json:"prefix,omitempty"` // only objects under this key prefix fire ("" = whole bucket)
	On     []BlobEventType `json:"on,omitempty"`     // default [Created] (set in normalize); only Created supported in V1
}

type BlobEventType string

type BlobServiceSpec struct {
	Binding string `json:"binding" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type BlobSource struct {
	Bucket ObjectName  `json:"bucket"` // the ADR-0080 Bucket resource to watch (this namespace)
	Events []BlobEvent `json:"events"` // ≥1; unique names
}

type Bucket struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       BucketSpec `json:"spec"`
}

type BucketPrefix struct {
	// Name is the key prefix; a DNS-1123 label, unique within the bucket. The medallion layer.
	Name string `json:"name" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Owner is the single writer: a Function in this bucket's namespace. Empty ⇒ no writer (read-only).
	// Cross-resource validity (the owner exists) is an admission, not Validate.
	Owner ObjectName `json:"owner,omitempty"`
}

type BucketSpec struct {
	// Prefixes are the bucket's sub-domains (ADR-0080): the medallion layers, each a key prefix with a
	// single-writer Owner. Prefix names are unique within the bucket (so a prefix has exactly one owner
	// by construction). Empty ⇒ a bucket with no writable sub-domains.
	Prefixes []BucketPrefix `json:"prefixes"`
	// MaxObjectBytes is the per-object resource policy on THIS bucket (a write past it ⇒ PayloadTooLarge);
	// 0 ⇒ unset (no per-bucket cap; the daemon-wide s3gateway.maxUploadBytes still applies).
	MaxObjectBytes int64 `json:"maxObjectBytes,omitempty" minimum:"0"`
}

type BuiltinStep struct {
	// Wait is a timer: a Go duration string ("30s") or a ${{ }} goja Select expression evaluating
	// to a number of seconds. The step blocks in-engine for the duration (on the run context, so the
	// run-timeout interrupts it), then passes its flowing input through as output. A normal step —
	// Running then Succeeded; no special state.
	Wait string `json:"wait,omitempty"`
	// Pass is a ${{ }} goja Select expression over the step's flowing input + prior step outputs;
	// its result is the step's output. No dispatch.
	Pass string `json:"pass,omitempty"`
}

type CatalogIngress struct {
	// PathPrefix is the edge path the proxy is exposed at, e.g. "/catalog/lake". Required (leading "/").
	PathPrefix string `json:"pathPrefix"`
	// Host is an optional exact host match ("" = any host), mirroring gateway.Route.Host (V1).
	Host string `json:"host,omitempty"`
}

type CatalogRef struct {
	// Bucket is the name of a Bucket in this service's namespace.
	Bucket ObjectName `json:"bucket"`
	// Prefix is a sub-domain (BucketPrefix.name) of that bucket; a DNS-1123 label. The SQLite catalog
	// lives at <prefix>/_ducklake/catalog.db.
	Prefix string `json:"prefix" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type CatalogService struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       CatalogServiceSpec   `json:"spec"`
	Status     CatalogServiceStatus `json:"status,omitempty"`
}

type CatalogServiceSpec struct {
	// Blob binds the lakehouse buckets the engine may read/write — the SAME shape as
	// Function.spec.blob (ADR-0080), projected onto the backing Function so ADR-0085 injects the
	// per-fn keypair. The prefix the catalog lives under must be OWNED by this service's function
	// (single-writer).
	Blob []FunctionBlob `json:"blob"`
	// Catalog names the bound (bucket, prefix) the DuckLake catalog syncs under (a `_ducklake/` key);
	// the prefix must be OWNED by this service's function (single-writer). The SQLite catalog file
	// lives at <prefix>/_ducklake/catalog.db.
	Catalog CatalogRef `json:"catalog"`
	// Resources sizes the engine (cpu/mem); DuckDB is memory-hungry. The provider-runtime maps it
	// onto runtime.Limits when numerically parseable (ADR-0087), else it is recorded forward-compat.
	Resources ResourceSpec `json:"resources,omitempty"`
	// Secrets names the Secret resources in this namespace whose Data is injected into the engine
	// as env vars (ADR-0087, reusing the ADR-0057 FunctionSpec.Secrets convention verbatim): the
	// Quack token (QUACK_TOKEN). Each named Secret's Data keys become engine env-var names;
	// reserved FUNCD_* keys are never overridable. Only the NAMES are persisted; resolved values
	// live only in the engine's env. Resolution is PDP-authorized (ADR-0022/0057); an unauthorized
	// or missing Secret fails the service closed (not Ready). Empty ⇒ no secret injection.
	Secrets []ObjectName `json:"secrets,omitempty"`
	// Config names the ConfigMap resources in this namespace whose Data is injected into the engine
	// as env vars (ADR-0087): engine tuning (DUCKDB_*). Same env-injection shape as Secrets, but
	// from non-sensitive ConfigMap Data. Empty ⇒ no config injection.
	Config []ObjectName `json:"config,omitempty"`
	// Ingress declares OPT-IN external edge exposure of this catalog's catalog::query PEP proxy
	// (ADR-0138). Nil ⇒ internal-only (no edge route — today's default). Set ⇒ once Ready, the
	// reconciler programs an ingress route to the PEP PROXY (never the engine), so an external caller
	// is PEP'd on catalog::query exactly like an internal one. Exposure is a network path, not a grant:
	// default-deny is preserved (an external Identity still needs a RolesAssignment).
	Ingress *CatalogIngress `json:"ingress,omitempty"`
}

type CatalogServiceStatus struct {
	Status `json:",inline"`
	// Function is the materialized backing duckdb Function (computed by the reconciler).
	Function ObjectName `json:"function,omitempty"`
	// Endpoint is the published Quack URL — the backing function's ingress path (computed).
	Endpoint string `json:"endpoint,omitempty"`
	// ProxyPort is the port of the catalog's PEP proxy listener (ADR-0162), recorded so a restarted daemon binds the
	// same port again and the URL consumers hold keeps reaching this catalog (computed).
	ProxyPort int `json:"proxyPort,omitempty"`
}

type Condition struct {
	Type               ConditionType   `json:"type"`
	Status             ConditionStatus `json:"status"`
	ObservedGeneration int64           `json:"observedGeneration,omitempty"`
	LastTransitionTime time.Time       `json:"lastTransitionTime,omitempty"`
	Reason             string          `json:"reason,omitempty"`
	Message            string          `json:"message,omitempty"`
}

type ConditionStatus string

type ConditionType string

type Conditions []Condition

type ConfigMap struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       ConfigMapSpec `json:"spec"`
}

type ConfigMapSpec struct {
	Data map[string]string `json:"data,omitempty"`
}

type DeletionPolicy string

type Dependency struct {
	Name   ObjectName `json:"name"`
	Source ObjectName `json:"source"` // the EventSource name
	Event  ObjectName `json:"event"`  // the named event of that source
}

type EdgeAuth struct {
	Mode AuthMode `json:"mode,omitempty"`
}

type EdgeDefaults struct {
	// Auth is the namespace-default edge auth stance (ADR-0113, F77); a Route overrides it. nil ⇒
	// open (the phased default — a namespace opts into default-deny by setting Auth.Mode=authenticated).
	Auth *EdgeAuth `json:"auth,omitempty"`
}

type EgressPolicy struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       EgressPolicySpec `json:"spec"`
}

type EgressPolicySpec struct {
	// Rules is the allow-list; each grants egress to its `to` on its `ports`. At least one required.
	Rules []EgressRule `json:"rules"`
	// AppliesTo scopes every rule to these Functions (by name, this namespace); empty ⇒ the whole namespace.
	AppliesTo []ObjectName `json:"appliesTo,omitempty"`
}

type EgressRule struct {
	// To is the destination match; at least one of domains/cidrs is required (Validate enforces).
	To EgressTo `json:"to"`
	// Ports are the destination ports (1..65535); empty ⇒ any port to the matched destination.
	Ports []int `json:"ports,omitempty"`
}

type EgressTo struct {
	Domains []string `json:"domains,omitempty"`
	CIDRs   []string `json:"cidrs,omitempty"`
}

type EventSource struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       EventSourceSpec   `json:"spec"`
	Status     EventSourceStatus `json:"status,omitempty"`
}

type EventSourceSpec struct {
	// Timer is the timer source kind (V1): named events, each ticking on its own interval. The webhook
	// source kind is a named follow-on (it needs an eventing-ingress gateway decision).
	Timer *TimerSource `json:"timer,omitempty"`
	// Blob is the object-store source kind (ADR-0119, F83): named events that fire on object-created under
	// a watched Bucket prefix, detected by a poll watcher over the ADR-0007 blob.Bucket List seam.
	Blob *BlobSource `json:"blob,omitempty"`
}

type EventSourceStatus struct {
	Status `json:",inline"`
}

type ExposureMode string

type FieldDiff struct {
	Field string
	Want  string
	Got   string
}

type Function struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       FunctionSpec   `json:"spec"`
	Status     FunctionStatus `json:"status,omitempty"`
}

type FunctionBlob struct {
	// Alias is the local handle; a DNS-1123 label, unique within Blob.
	Alias string `json:"alias" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Bucket is the name of a Bucket in this function's namespace.
	Bucket ObjectName `json:"bucket"`
	// Prefix is a sub-domain (BucketPrefix.name) of that bucket; a DNS-1123 label.
	Prefix string `json:"prefix" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type FunctionCatalog struct {
	// Alias names the FUNCD_CATALOG_<ALIAS>_* env pair; a DNS-1123 label, unique within Catalogs.
	Alias string `json:"alias" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Catalog is the name of a CatalogService in this function's namespace.
	Catalog ObjectName `json:"catalog"`
}

type FunctionKV struct {
	// Alias is the local handle the handler passes to context.kv; a DNS-1123 label, unique within KV.
	Alias string `json:"alias" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Store is the name of a KVStore in this function's namespace.
	Store ObjectName `json:"store"`
	// Table is a sub-domain (KVStore.spec.tables[].name) of that store; a DNS-1123 label.
	Table string `json:"table" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type FunctionLink struct {
	// Alias is the local name the handler passes to invoke; a DNS-1123 label, unique within Links.
	Alias string `json:"alias" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Target is the name of a Function in this function's namespace.
	Target ObjectName `json:"target"`
	// Timeout bounds the synchronous wait (incl. a cold-start wake); int64 ns, 0 ⇒ platform
	// default, ≤5m.
	Timeout time.Duration `json:"timeout,omitempty" minimum:"0" maximum:"300000000000"`
}

type FunctionName string

type FunctionSpec struct {
	// Scaling configures scale-to-zero / idle reclaim (ADR-0016, F11). V1 honors
	// MinReplicas (0 enables scale-to-zero) and IdleTimeout (0 disables reclaim);
	// MaxReplicas is recorded for forward-compatibility (1→N autoscaling is V3).
	Scaling Scaling `json:"scaling,omitempty"`
	// Runtime is the runtime class / language image (e.g. "nodejs22", "python312") — F13/ADR-0020.
	// Typed RuntimeName so its DNS-1123 constraint reaches the OpenAPI schema (ADR-0048).
	Runtime RuntimeName `json:"runtime,omitempty"`
	// Handler is the entrypoint the shim resolves at materialization (e.g. "app.handler") — F13.
	Handler string `json:"handler,omitempty" pattern:"^[A-Za-z_][A-Za-z0-9_.]*$"`
	// Image is the source artifact OCI ref (oci-layout:// · file:// · a bare registry ref; the tag at the
	// string end), pulled + served by the runtime — F13/ADR-0020, flattened by ADR-0097 (was spec.artifact.uri).
	Image string `json:"image,omitempty"`
	// ImageDigest is the content digest pinned into the stamped Revision ("what was validated ships"),
	// system-set at materialization (ADR-0035) — ADR-0097 (was spec.artifact.digest).
	ImageDigest string `json:"imageDigest,omitempty" pattern:"^sha256:[a-f0-9]{64}$"`
	// Replicas is the manual replica count (>=0); the effective count also honors Scaling + the
	// activator's wake (ADR-0016/0020) — F13.
	Replicas int `json:"replicas,omitempty" minimum:"0" maximum:"15"`
	// Timeout bounds an external invoke until its response starts; 0 ⇒ invoke.defaultTimeout. External
	// invokes only: links and steps keep their own limits (ADR-0151).
	Timeout time.Duration `json:"timeout,omitempty" minimum:"0" maximum:"3600000000000"`
	// Pooling is the per-function worker-pooling opt-in (ADR-0046, F28). Empty ⇒ solo (own
	// worker, the default). Functions sharing (namespace, runtime, Pooling.Worker) and the same
	// access (bindings, owned data, grants) co-locate as handlers in one pool worker; status.pool
	// names it.
	Pooling Pooling `json:"pooling,omitempty"`
	// Secrets names the Secret resources in this function's namespace whose Data is injected
	// into the worker as env vars at materialization (ADR-0057, F15 last mile). Each named
	// Secret's Data keys become env-var names; reserved FUNCD_* keys are never overridable.
	// Empty ⇒ no secret injection. Only the NAMES are persisted; resolved values are never
	// stored on the Function (they live only in the worker's env). Resolution is PDP-authorized
	// (ADR-0022/0018); an unauthorized or missing Secret fails the function closed (not Ready).
	Secrets []ObjectName `json:"secrets,omitempty"`
	// Config names the ConfigMap resources in this function's namespace whose Data is injected
	// into the worker as env vars at materialization (ADR-0093), mirroring Secrets but for
	// NON-sensitive config (a plain store read, no PDP). Config is merged BEFORE Secrets, so a
	// bound Secret overrides a config default. Reserved FUNCD_* keys are never overridable.
	// Empty ⇒ no config injection. Fails closed (not Ready, ConfigResolveFailed) if a named
	// ConfigMap is missing.
	Config []ObjectName `json:"config,omitempty"`
	// Links declares synchronous fn-to-fn RPC dependencies (ADR-0064, F33): each binds a local
	// alias to a target Function in this namespace, callable from the handler as
	// context.invoke(alias, input). The alias is the capability — with no matching link, invoke
	// fails closed. Empty ⇒ no links. Cross-resource validity (target exists, acyclic) is an
	// admission (ADR-0063); only the structural rules are checked in Validate.
	Links []FunctionLink `json:"links,omitempty"`
	// KV declares this function's KV bindings (ADR-0073, F42): each binds a local alias to a (store,
	// table) sub-domain in this namespace, reachable from the handler as context.kv.<verb>(alias, …).
	// The binding IS the capability — with no matching entry, context.kv on that alias is Forbidden
	// (default-deny). Mirrors spec.links (wrangler-style: naming lives on the consumer). Empty ⇒ no
	// KV access. Cross-resource validity (the store/table exist) is an admission (ADR-0063); only the
	// structural rules (alias is a unique DNS-1123 label) are checked in Validate.
	KV []FunctionKV `json:"kv,omitempty"`
	// Blob declares this function's blob (S3) bindings (ADR-0080, F47): each binds a local alias to a
	// (bucket, prefix) sub-domain in this namespace, reachable from the handler / its DuckDB as
	// s3://<bucket>/<prefix>/…. The binding IS the read capability — with no matching entry, blob access
	// on that alias is Forbidden (default-deny); writes require this function to be the prefix's owner.
	// Mirrors spec.kv (wrangler-style: naming lives on the consumer). Empty ⇒ no blob access.
	// Cross-resource validity (the bucket/prefix exist) is an admission; only the structural rules
	// (alias is a unique DNS-1123 label) are checked in Validate.
	Blob []FunctionBlob `json:"blob,omitempty"`
	// Catalogs declares this function's CatalogService consumer bindings (ADR-0091, F61): each binds a
	// local alias to a CatalogService in this namespace, injected into the worker as
	// FUNCD_CATALOG_<ALIAS>_URL (the catalog's status.endpoint) + FUNCD_CATALOG_<ALIAS>_TOKEN (its
	// QUACK_TOKEN). Declaring the binding IS the grant — only a declaring function receives the token;
	// it is never surfaced in CatalogService.status. The reconcile requeues (fail-closed) until the
	// bound catalog is Ready. Empty ⇒ no catalog consumption. Cross-resource validity (the catalog
	// exists) is an admission; only the structural rules (alias is a unique DNS-1123 label) are Validate.
	Catalogs []FunctionCatalog `json:"catalogs,omitempty"`
}

type FunctionStatus struct {
	Status          `json:",inline"`
	Replicas        int    `json:"replicas,omitempty"`        // workers that listened and get calls (ADR-0161)
	CurrentRevision string `json:"currentRevision,omitempty"` // the latest stamped Revision name (ADR-0020)
	// ServingRevision is the Revision whose workers receive the calls (ADR-0143); empty until the first deploy serves,
	// and again once no replica is desired.
	ServingRevision string `json:"servingRevision,omitempty"`
	// DrainingRevision is the Revision demoted at the last switch while any of its workers remain, and DrainingSince
	// the time of that switch (ADR-0143); both are cleared together.
	DrainingRevision string     `json:"drainingRevision,omitempty"`
	DrainingSince    *time.Time `json:"drainingSince,omitempty"`
	// Pool is the pool worker a pooled Function runs in, "<runtime>/<worker>/<access>"; empty when solo.
	Pool string `json:"pool,omitempty"`
}

type FunctionStep struct {
	// Image is a full OCI artifact reference the workflow owns and materializes into a Function.
	Image string `json:"image,omitempty"`
	// Ref references an existing Function in the namespace (a shared service).
	Ref ObjectName `json:"ref,omitempty"`
	// Retry is the per-step retry policy; nil ⇒ the engine default.
	Retry *StepRetry `json:"retry,omitempty"`
	// Timeout is the per-step invocation bound; 0 ⇒ the engine default.
	Timeout time.Duration `json:"timeout,omitempty" minimum:"0" maximum:"86400000000000"`
	// Pooling overrides the workflow-level pooling for this step's materialized Function
	// (nil ⇒ inherit spec.pooling); image steps only.
	Pooling *WorkflowPooling `json:"pooling,omitempty"`
	// KV/Blob/Secrets/Config/Catalogs are the step's bindings (Function.spec shapes).
	KV       []FunctionKV      `json:"kv,omitempty"`
	Blob     []FunctionBlob    `json:"blob,omitempty"`
	Secrets  []ObjectName      `json:"secrets,omitempty"`
	Config   []ObjectName      `json:"config,omitempty"`
	Catalogs []FunctionCatalog `json:"catalogs,omitempty"`
}

type Gateway struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Status     GatewayStatus `json:"status,omitempty"`
}

type GatewayStatus struct {
	Status `json:",inline"`
}

type Grant struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       GrantSpec `json:"spec"`
}

type GrantSpec struct{}

type GroupVersionKind struct {
	Group   string
	Version string
	Kind    Kind
}

type HTTPMethod string

type Identity struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       IdentitySpec   `json:"spec"`
	Status     IdentityStatus `json:"status,omitempty"`
}

type IdentitySpec struct {
	// Type is the identity flavor. V1: only "external". Required.
	Type IdentityType `json:"type" enum:"external"`
	// CredentialSecretName is the owned Secret the issued keypair is written to. Empty ⇒ the Identity's
	// own name.
	CredentialSecretName ObjectName `json:"credentialSecretName,omitempty"`
	// Rotate, when incremented past status.observedRotate, forces the controller to reissue the secret
	// (rotation). The access key id is stable; only the secret changes.
	Rotate int64 `json:"rotate,omitempty"`
}

type IdentityStatus struct {
	Status `json:",inline"`
	// AccessKeyID is the issued, stable SigV4 access key id (the secret lives only in the owned Secret).
	AccessKeyID string `json:"accessKeyId,omitempty"`
	// ObservedRotate mirrors the spec.rotate the currently-issued secret corresponds to.
	ObservedRotate int64 `json:"observedRotate,omitempty"`
}

type IdentityType string

type Invocation struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Status     InvocationStatus `json:"status,omitempty"`
}

type InvocationStatus struct {
	Status    `json:",inline"`
	StartTime time.Time `json:"startTime,omitempty"`
	EndTime   time.Time `json:"endTime,omitempty"`
	Error     string    `json:"error,omitempty"`
}

type JoinMode string

type KVServiceSpec struct {
	Binding string `json:"binding" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type KVStore struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       KVStoreSpec   `json:"spec"`
	Status     KVStoreStatus `json:"status,omitempty"`
}

type KVStoreSpec struct {
	// MaxValueBytes caps a single value's size; 0 ⇒ DefaultMaxValueBytes (1 MiB); at most MaxValueBytesLimit.
	MaxValueBytes int64 `json:"maxValueBytes,omitempty" minimum:"0" maximum:"1048576"`
	// MaxKeyBytes caps a single key's size; 0 ⇒ DefaultMaxKeyBytes (1 KiB); at most MaxKeyBytesLimit.
	MaxKeyBytes int `json:"maxKeyBytes,omitempty" minimum:"0" maximum:"64000"`
	// Tables are the store's sub-domains (ADR-0073): each is a key space <ns>/<store>/<table>/ with a
	// single-writer Owner. Table names are unique within the store (so a table has exactly one owner by
	// construction). Empty ⇒ a store with no writable sub-domains.
	Tables []KVTable `json:"tables,omitempty"`
}

type KVStoreStatus struct {
	Status `json:",inline"`
	// Tables is the number of sub-domains declared on the store (computed by the reconciler).
	Tables int `json:"tables,omitempty"`
	// Bindings is the number of Function.spec.kv entries referencing this store (computed by the reconciler).
	Bindings int `json:"bindings,omitempty"`
}

type KVTable struct {
	// Name is the sub-domain name; a DNS-1123 label, unique within the store.
	Name string `json:"name" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Owner is the single writer: a Function in this store's namespace. Empty ⇒ no writer (read-only
	// through the facade). Cross-resource validity (the owner exists) is an admission, not Validate.
	Owner ObjectName `json:"owner,omitempty"`
}

type Kind string

type Namespace struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       NamespaceSpec   `json:"spec,omitempty"`
	Status     NamespaceStatus `json:"status,omitempty"`
}

type NamespaceName string

type NamespaceSpec struct {
	// DefaultExposure switches the public data-plane front door. Empty/absent ⇒ implicit.
	DefaultExposure ExposureMode `json:"defaultExposure,omitempty"`
	// EdgeDefaults carries the namespace-wide edge policy defaults merged under each Route
	// (F74–F78 add fields; empty in F79).
	EdgeDefaults *EdgeDefaults `json:"edgeDefaults,omitempty"`
}

type NamespaceStatus struct {
	Status `json:",inline"`
}

type OCIPlatform string

type Object interface {
	GroupVersionKind() GroupVersionKind
	GetObjectMeta() *ObjectMeta
	GetName() ObjectName
	GetNamespace() NamespaceName
	GetResourceGroup() ResourceGroupName
	GetGeneration() int64
	Validate() error
}

type ObjectMeta struct {
	// Name is the resource name. omitempty (not "required") so a create may omit it in favour of
	// GenerateName; the store still requires a non-empty Name (ObjectMeta.Validate) once assigned.
	Name ObjectName `json:"name,omitempty"`
	// GenerateName is an optional NAME PREFIX for server-side name generation (the k8s pattern): when Name
	// is empty and GenerateName is set, the create path fills Name = GenerateName + a random suffix
	// (GenerateObjectName), retrying on the rare collision. Ignored once Name is set. A plain prefix string
	// (a trailing '-' is idiomatic and allowed — the generated Name is what must be a valid label).
	GenerateName    string            `json:"generateName,omitempty" pattern:"^[a-z0-9][a-z0-9-]{0,62}$"`
	Namespace       NamespaceName     `json:"namespace,omitempty"`
	ResourceGroup   ResourceGroupName `json:"resourceGroup,omitempty"`
	Tags            Tags              `json:"tags,omitempty"`
	UID             UID               `json:"uid,omitempty"`
	Generation      int64             `json:"generation,omitempty"`
	ResourceVersion string            `json:"resourceVersion,omitempty"`
	CreationTime    time.Time         `json:"creationTimestamp,omitempty"`
	DeletionTime    *time.Time        `json:"deletionTimestamp,omitempty"`
	OwnerReferences []OwnerReference  `json:"ownerReferences,omitempty"`
	Finalizers      []string          `json:"finalizers,omitempty"`
}

type ObjectName string

type ObjectRef struct {
	Kind      Kind          `json:"kind"`
	Namespace NamespaceName `json:"namespace,omitempty"`
	Name      ObjectName    `json:"name"`
}

type OwnerReference struct {
	ObjectRef          `json:",inline"`
	UID                UID  `json:"uid"`
	Controller         bool `json:"controller,omitempty"`
	BlockOwnerDeletion bool `json:"blockOwnerDeletion,omitempty"`
}

type PathType string

type Phase string

type Policy struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       PolicySpec `json:"spec"`
}

type PolicySpec struct {
	// Cedar is one or more Cedar permit/forbid statements (validated by the policy-validity admission
	// against the curated action/entity schema — kv::read/kv::write; Function/KVStore/KVTable).
	Cedar string `json:"cedar"`
}

type Pooling struct {
	// Worker is an owner-chosen worker id. Empty ⇒ solo (own worker). Functions sharing
	// (namespace, runtime, Worker) co-locate as handlers in one worker_threads pool worker.
	Worker string `json:"worker,omitempty"`
}

type PoolingMode string

type PrincipalKind string

type PrincipalObject interface {
	// contains filtered or unexported methods
}

type PrincipalRef struct {
	Kind PrincipalKind `json:"kind" enum:"Function,Identity"`
	Name ObjectName    `json:"name"`
}

type ReplaySeed struct {
	// Run is the source run to replay (same namespace).
	Run ObjectName `json:"run"`
	// From is the step to re-run from; `from` and its descendants re-execute, upstream steps are reused.
	From ObjectName `json:"from"`
	// AllowDrift opts into re-running steps whose resolved artifact digest moved since the source run
	// (a re-materialized workflow) — "same data, current code". Default false ⇒ drift is rejected.
	AllowDrift bool `json:"allowDrift,omitempty"`
}

type ResourceGroup struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       ResourceGroupSpec   `json:"spec"`
	Status     ResourceGroupStatus `json:"status,omitempty"`
}

type ResourceGroupName string

type ResourceGroupSpec struct {
	Description string `json:"description,omitempty"`
}

type ResourceGroupStatus struct {
	Status `json:",inline"`
}

type ResourceSpec struct {
	// CPU is a recorded CPU request/limit hint (e.g. "2"); forward-compat only.
	CPU string `json:"cpu,omitempty"`
	// Memory is a recorded memory request/limit hint (e.g. "4Gi"); forward-compat only.
	Memory string `json:"memory,omitempty"`
}

type Revision struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       RevisionSpec   `json:"spec"`
	Status     RevisionStatus `json:"status,omitempty"`
}

type RevisionID string

type RevisionPin struct {
	Function    ObjectName `json:"function"`
	FunctionUID UID        `json:"functionUID"`
	Revision    ObjectName `json:"revision"`
	ImageDigest string     `json:"imageDigest,omitempty"` // empty only for a file:// artifact
}

type RevisionSpec struct {
	Function    ObjectRef   `json:"function"`
	Number      int64       `json:"number" minimum:"1"`
	Runtime     RuntimeName `json:"runtime,omitempty"`
	Handler     string      `json:"handler,omitempty" pattern:"^[A-Za-z_][A-Za-z0-9_.]*$"`
	Image       string      `json:"image,omitempty"`
	ImageDigest string      `json:"imageDigest,omitempty" pattern:"^sha256:[a-f0-9]{64}$"`
}

type RevisionStatus struct {
	Status `json:",inline"`
}

type Role struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       RoleSpec `json:"spec"`
}

type RoleRef struct {
	Kind RoleRefKind `json:"kind" enum:"BuiltinRole,Role"`
	Name string      `json:"name"`
}

type RoleRefKind string

type RoleSpec struct {
	Actions []string `json:"actions"`
}

type RolesAssignment struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       RolesAssignmentSpec `json:"spec"`
}

type RolesAssignmentSpec struct {
	Principal   *PrincipalRef     `json:"principal,omitempty"`
	Scope       *ScopeRef         `json:"scope,omitempty"`
	Assignments []AssignmentEntry `json:"assignments"`
}

type Route struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       RouteSpec   `json:"spec"`
	Status     RouteStatus `json:"status,omitempty"`
}

type RouteAuth struct {
	Mode AuthMode `json:"mode,omitempty"`
}

type RouteBackend struct {
	// Function is the target Function in this Route's namespace. Optional since F82: a static-only
	// rule sets no function (the `omitempty` reflects the union — exactly one arm is set).
	Function ObjectName `json:"function,omitempty"`
	// Static serves a Bucket-prefix static site directly through the edge (F82); nil ⇒ a function backend.
	Static *StaticBackend `json:"static,omitempty"`
}

type RouteRule struct {
	Path     string       `json:"path"`               // must begin "/"
	PathType PathType     `json:"pathType,omitempty"` // Exact | Prefix (default Prefix)
	Methods  []HTTPMethod `json:"methods,omitempty"`  // empty ⇒ all methods
	Backend  RouteBackend `json:"backend"`
}

type RouteSpec struct {
	// Host is an exact host match; "" matches any host. In an `explicit`-mode namespace the
	// reconciler requires a non-empty Host (the tenant discriminator, ADR-0110).
	Host string `json:"host,omitempty"`
	// Rules lists the path rules, matched longest-prefix-first. At least one is required.
	Rules []RouteRule `json:"rules"`
	// Auth is the edge authentication stance for this Route (ADR-0113, F77). nil ⇒ inherit the
	// namespace default; unset overall ⇒ open (phased). Applies to all Rules (per-rule auth is V2).
	Auth *RouteAuth `json:"auth,omitempty"`
}

type RouteStatus struct {
	Status `json:",inline"`
}

type RunPhase string

type RunStepStatus struct {
	Name     ObjectName `json:"name"`
	Phase    StepPhase  `json:"phase,omitempty"`
	Attempts int        `json:"attempts,omitempty"`
	Revision string     `json:"revision,omitempty"`
	// StartedAt/EndedAt (unix nanos) give the step duration; Error is the raw step-level failure
	// cause, capped — the full text lives in the step's span + logs (ADR-0106) — on a Failed step, or
	// the cancel on a step that was running when the run was cancelled (ADR-0146).
	StartedAt int64  `json:"startedAt,omitempty"`
	EndedAt   int64  `json:"endedAt,omitempty"`
	Error     string `json:"error,omitempty"`
}

type RuntimeClass struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       RuntimeClassSpec   `json:"spec"`
	Status     RuntimeClassStatus `json:"status,omitempty"`
}

type RuntimeClassSpec struct {
	Handler string `json:"handler,omitempty" pattern:"^[A-Za-z_][A-Za-z0-9_.]*$"`
}

type RuntimeClassStatus struct {
	Status `json:",inline"`
}

type RuntimeName string

type Scaling struct {
	MinReplicas int           `json:"minReplicas,omitempty" minimum:"0" maximum:"15"`             // 0 enables scale-to-zero
	MaxReplicas int           `json:"maxReplicas,omitempty" minimum:"0" maximum:"15"`             // recorded; 1→N enforcement is V3
	IdleTimeout time.Duration `json:"idleTimeout,omitempty" minimum:"0" maximum:"86400000000000"` // reclaim delay, int64 ns; 0≤≤24h, 0 disables
}

type SchemaView struct {
	Type     string
	Props    map[string]string          // property name → primitive type
	Defaults map[string]json.RawMessage // property name → declared default, for the properties that have one
	Required []string
}

type ScopeKind string

type ScopeRef struct {
	Kind ScopeKind `json:"kind" enum:"Namespace,BucketPrefix,KVStore,Catalog"`
	Name string    `json:"name,omitempty"`
}

type Secret struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       SecretSpec `json:"spec"`
}

type SecretSpec struct {
	Type SecretType        `json:"type,omitempty"`
	Data map[string][]byte `json:"data,omitempty"`
}

type SecretType string

type Sensor struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       SensorSpec   `json:"spec"`
	Status     SensorStatus `json:"status,omitempty"`
}

type SensorSpec struct {
	// On lists the named event dependencies this Sensor subscribes to (≥1, unique names).
	On []Dependency `json:"on"`
	// Do lists the named actions (≥1, unique names); each is bound to one dependency via On.
	Do []Action `json:"do"`
}

type SensorStatus struct {
	Status `json:",inline"`
}

type Service struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       ServiceSpec   `json:"spec"`
	Status     ServiceStatus `json:"status,omitempty"`
}

type ServiceSpec struct {
	Type ServiceType `json:"type,omitempty"`
	// KV is set when Type == ServiceTypeKV (ADR-0019, F14).
	KV *KVServiceSpec `json:"kv,omitempty"`
	// Blob is set when Type == ServiceTypeBlob (ADR-0021, F23).
	Blob *BlobServiceSpec `json:"blob,omitempty"`
}

type ServiceStatus struct {
	Status `json:",inline"`
}

type ServiceType string

type Site struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       SiteSpec   `json:"spec"`
	Status     SiteStatus `json:"status,omitempty"`
}

type SiteBucket struct {
	// Name is the Bucket name; a DNS-1123 label.
	Name ObjectName `json:"name"`
	// Deletion is "retain" (default — the Bucket outlives the Site). "delete" is rejected in V1.
	Deletion DeletionPolicy `json:"deletion,omitempty"`
	// Prefixes are additional sub-domains materialized on the Bucket verbatim (owners included). The
	// Site's own Prefix is added implicitly with NO owner and must not be repeated here.
	Prefixes []BucketPrefix `json:"prefixes,omitempty"`
}

type SiteIngress struct {
	// Host is the exact host match on the owned Route; "" matches any host (ADR-0110 requires a
	// non-empty host in an `explicit`-mode namespace).
	Host string `json:"host,omitempty"`
	// Path is the edge path the bundle is served at (ADR-0140). Empty ⇒ "/" when Host is set, else
	// "/site/<metadata.name>" — so several host-less Sites share one listener without colliding. It
	// begins "/" and carries no trailing slash unless it is exactly "/". Mutable: a change re-programs
	// the Route with no re-upload, but the bundle must be BUILT for the new base path (funcd never
	// rewrites served content).
	Path string `json:"path,omitempty"`
	// Public sets static.public on every compiled backend (ADR-0120 §4 precedence preserved).
	Public bool `json:"public,omitempty"`
	// Auth is the edge auth stance copied onto the owned Route; nil ⇒ inherit the namespace default.
	Auth *RouteAuth `json:"auth,omitempty"`
	// Rules are additional bucket prefixes served alongside the app (the data the app fetches). A rule
	// MAY nest under Path (e.g. /bi/data under /bi) — longest-path-first gives the nested rule priority.
	Rules []SiteRule `json:"rules,omitempty"`
}

type SiteRule struct {
	// Path is the edge path; must begin "/" and must not be "/" (that is the bundle's).
	Path string `json:"path"`
	// Bucket names a Bucket in this Site's namespace; "" ⇒ the Site's own Bucket.
	Bucket ObjectName `json:"bucket,omitempty"`
	// Prefix is the Bucket sub-domain served at Path.
	Prefix string `json:"prefix" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
}

type SiteSpec struct {
	// Image is the site bundle OCI ref (oci-layout://<dir>[:<tag>] or a registry ref; a tag or a
	// digest). A tag is resolved to a digest once per spec generation — the author never types one.
	Image string `json:"image"`
	// Bucket declares the Bucket the bundle materializes into: adopted if present, created if absent.
	Bucket SiteBucket `json:"bucket"`
	// Prefix is the Bucket sub-domain rooting the site; objects land under <Prefix>/<digest-slug>/.
	// Immutable after creation (the site-prefix-immutable admission).
	Prefix string `json:"prefix" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// Index is the document served for "/" / a directory / (when SPA) a miss. Default "index.html".
	Index string `json:"index,omitempty"`
	// SPA serves Index (200) for an un-matched path under the bundle rule so a client-side router owns
	// routing. It NEVER applies to a data mount (Ingress.Rules), whose miss is always 404.
	SPA bool `json:"spa,omitempty"`
	// Ingress declares the Site-owned Route (named after the Site). Required in V1.
	Ingress SiteIngress `json:"ingress"`
}

type SiteStatus struct {
	Status `json:",inline"`
	// Digest is the manifest digest the owned Route currently serves.
	Digest string `json:"digest,omitempty" pattern:"^sha256:[a-f0-9]{64}$"`
	// ServingPrefix is the digest-scoped key prefix the owned Route is programmed with.
	ServingPrefix string `json:"servingPrefix,omitempty"`
	// Objects and Bytes are the materialized bundle's observed size.
	Objects int   `json:"objects,omitempty"`
	Bytes   int64 `json:"bytes,omitempty"`
}

type StaticBackend struct {
	// Bucket is the Bucket in THIS Route's namespace whose objects are served (binding-as-grant:
	// the Route reads only this declared Bucket; the reconciler validates it exists → BucketNotFound).
	Bucket ObjectName `json:"bucket"`
	// Prefix is the key prefix within the Bucket that roots the site; it ends with "/" (e.g. "bi/") so it
	// never also matches a sibling prefix; "" ⇒ the bucket root.
	Prefix string `json:"prefix,omitempty"`
	// Index is the document served for "/" / a directory / (when SPA) a miss. Default "index.html".
	Index string `json:"index,omitempty"`
	// SPA, when true, serves Index (200) for any un-matched path so a client-side router owns routing;
	// when false, an un-matched path is 404.
	SPA bool `json:"spa,omitempty"`
	// Public, when true, serves this Route openly (stance relaxed to `open`, ADR-0113) when the
	// resolved stance is unset/default — a declared public site. It NEVER overrides an explicit
	// `authenticated` stance (that combination is rejected at admission). Default false ⇒ inherit.
	Public bool `json:"public,omitempty"`
}

type Status struct {
	Phase              Phase      `json:"phase,omitempty"`
	ObservedGeneration int64      `json:"observedGeneration,omitempty"`
	Conditions         Conditions `json:"conditions,omitempty"`
}

type StatusObject interface {
	Object
	GetStatus() *Status
}

type StepPhase string

type StepRetry struct {
	MaxAttempts int           `json:"maxAttempts,omitempty" minimum:"1" maximum:"100"`
	Backoff     time.Duration `json:"backoff,omitempty" minimum:"0" maximum:"3600000000000"`
}

type StepWhen struct {
	Condition string `json:"condition"`
}

type Tags map[string]string

type TimerEvent struct {
	Name ObjectName `json:"name"`
	// Interval is the tick period in int64 nanoseconds, bounded 100ms ≤ ≤ 24h (ADR-0023): the floor bars a
	// μs/ns fire-storm, the ceiling bars an unbounded one. The tag literals are the sole schema source; the
	// bounds are re-checked in Validate (which also runs at store.Create, bypassing the huma edge).
	Interval time.Duration `json:"interval" minimum:"100000000" maximum:"86400000000000"` // 100ms–24h
}

type TimerSource struct {
	Events []TimerEvent `json:"events"` // ≥1; unique names
}

type TypeMeta struct {
	APIVersion string `json:"apiVersion"`
	Kind       Kind   `json:"kind"`
}

type UID string

type WorkerNode struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Status     WorkerNodeStatus `json:"status,omitempty"`
}

type WorkerNodeStatus struct {
	Status `json:",inline"`
}

type Workflow struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       WorkflowSpec   `json:"spec"`
	Status     WorkflowStatus `json:"status,omitempty"`
}

type WorkflowContract struct {
	Dialect string          `json:"dialect,omitempty"`
	Input   json.RawMessage `json:"input,omitempty"`
	Output  json.RawMessage `json:"output,omitempty"`
}

type WorkflowKVStore struct {
	// Name is the store name; a DNS-1123 label.
	Name ObjectName `json:"name"`
	// Deletion is "retain" (default — the store outlives the workflow) or "delete".
	Deletion DeletionPolicy `json:"deletion,omitempty"`
	// Tables are the store's sub-domains; each Owner names a step.
	Tables []KVTable `json:"tables"`
}

type WorkflowPooling struct {
	// Mode is "shared" (default — image steps of the same runtime co-locate in one
	// worker pool, saving memory) or "isolated" (each step runs in its own solo
	// worker / container).
	Mode PoolingMode `json:"mode,omitempty"`
	// Worker names the shared pool when Mode is shared; empty ⇒ the workflow's name.
	// Steps of different runtimes never share a worker (the pool is per-runtime); this
	// is the logical pool name they group under.
	Worker string `json:"worker,omitempty" pattern:"^[a-z0-9]([a-z0-9-]{0,61}[a-z0-9])?$"`
	// MinReplicas keeps warm workers: 0 scales to zero (cold start on the first step of
	// the pool), ≥1 avoids the cold-start latency.
	MinReplicas int `json:"minReplicas,omitempty" minimum:"0" maximum:"15"`
}

type WorkflowRef struct {
	Ref ObjectName `json:"ref,omitempty"`
}

type WorkflowRun struct {
	TypeMeta   `json:",inline"`
	ObjectMeta `json:"metadata"`
	Spec       WorkflowRunSpec   `json:"spec"`
	Status     WorkflowRunStatus `json:"status,omitempty"`
}

type WorkflowRunLinks struct {
	Active    []ObjectName `json:"active,omitempty"`
	Succeeded int          `json:"succeeded,omitempty"`
	Failed    int          `json:"failed,omitempty"`
	Cancelled int          `json:"cancelled,omitempty"`
}

type WorkflowRunSpec struct {
	// Workflow names the Workflow in this run's namespace.
	Workflow ObjectName `json:"workflow"`
	// Input is the run input (validated against the workflow's cached contract at
	// admission); control-plane metadata, size-bounded by the engine.
	Input json.RawMessage `json:"input,omitempty"`
	// Paused requests a graceful pause: no new steps dispatch, in-flight steps finish
	// (set by `funcdctl workflow pause`, cleared by `resume`). Ignored once the run is already
	// terminal: the run keeps its phase.
	Paused bool `json:"paused,omitempty"`
	// Cancel requests cancellation (ADR-0094, ADR-0146): a declarative one-way intent, the same shape
	// as Paused. Set by `funcdctl workflow cancel`, it is observed by the run reconciler on
	// the controller workqueue (never a synchronous endpoint), which closes the in-flight step calls
	// (their late results are discarded), dispatches nothing more, runs no onFailure and terminates
	// the run Cancelled. Ignored once the run is already terminal.
	Cancel bool `json:"cancel,omitempty"`
	// Replay seeds this run from a finished source run's checkpoint (ADR-0107): the engine copies the
	// source's pinned spec/contract/input + the terminal steps outside the replay set, then re-runs
	// `from` + its descendants. When set, Input must be empty (the input comes from the source).
	Replay *ReplaySeed `json:"replay,omitempty"`
}

type WorkflowRunStatus struct {
	Status `json:",inline"`
	// Phase shadows the embedded Status.Phase: a run has its own phases (ADR-0094), not the resource ones.
	Phase RunPhase        `json:"phase,omitempty"`
	Steps []RunStepStatus `json:"steps,omitempty"`
	// TraceID is the run's W3C trace (ADR-0102), mirrored from the engine record (ADR-0100) so
	// `describe` shows it and `funcdctl workflow logs <run>` (ADR-0106) resolves a run to its logs.
	TraceID string `json:"traceId,omitempty"` // 32 lowercase hex; empty ⇒ a legacy/traceless run
	// Pins binds the run to the step Function revisions it started with (ADR-0190): written before the run starts,
	// they hold those revisions while the run is not terminal.
	Pins []RevisionPin `json:"pins,omitempty"`
	// WorkflowUID is the Workflow's UID at start (ADR-0190 Decision 10); empty for a run started before ADR-0190.
	WorkflowUID UID `json:"workflowUID,omitempty"`
}

type WorkflowSpec struct {
	// Steps are the workflow's steps. List order chains implicitly (no dependsOn ⇒
	// the previous step); dependsOn declares explicit edges.
	Steps []WorkflowStep `json:"steps"`
	// KV declares workflow-owned KVStores whose table owners name a step (materialized
	// to the owning Function). Empty ⇒ no owned stores.
	KV []WorkflowKVStore `json:"kv,omitempty"`
	// Contract is the optional declared I/O contract (ADR-0090 shape); nil ⇒ the
	// effective contract is derived (F65). Every optional property must carry a
	// default (the total-defaults rule).
	Contract *WorkflowContract `json:"contract,omitempty"`
	// Timeout is the wall-clock bound on a whole run (paused time excluded); 0 ⇒ none.
	Timeout time.Duration `json:"timeout,omitempty" minimum:"0" maximum:"604800000000000"`
	// OnFailure names a handler function step (defined in Steps, excluded from the DAG)
	// invoked once when the run ends Failed. Empty ⇒ no handler.
	OnFailure ObjectName `json:"onFailure,omitempty"`
	// Pooling configures how the workflow's materialized step Functions are pooled and
	// kept warm (ADR-0046 worker pooling + ADR-0016 scaling). Empty ⇒ the default: all
	// image steps share one pool. A step may override it with its own step.pooling.
	Pooling WorkflowPooling `json:"pooling,omitempty"`
}

type WorkflowStatus struct {
	Status   `json:",inline"`
	Contract *WorkflowContract    `json:"contract,omitempty"`
	Steps    []WorkflowStepStatus `json:"steps,omitempty"`
	Runs     *WorkflowRunLinks    `json:"runs,omitempty"`
}

type WorkflowStep struct {
	// Name is the step's name; a DNS-1123 label, unique within the workflow.
	Name ObjectName `json:"name"`
	// Function is a dispatched step: an owned image (materialized) or a ref to an existing Function.
	Function *FunctionStep `json:"function,omitempty"`
	// Builtin is an engine-native step (wait / pass) — run in-process, never dispatched.
	Builtin *BuiltinStep `json:"builtin,omitempty"`
	// Workflow runs a child Workflow as a step (a sub-workflow, F70/ADR-0099).
	Workflow *WorkflowRef `json:"workflow,omitempty"`
	// DependsOn names the parent steps; empty ⇒ follows the previous step in list order.
	DependsOn []ObjectName `json:"dependsOn,omitempty"`
	// Join is the fan-in mode: "all" (default) requires every parent Succeeded, "any"
	// requires one (exclusive-branch merges).
	Join JoinMode `json:"join,omitempty"`
	// When is an optional gate condition (ADR-0095 native-JS boolean); false ⇒ Skipped.
	When *StepWhen `json:"when,omitempty"`
	// Params is a static overlay merged over the step's flowing input (static wins). For a function
	// step it overlays the dispatched input; a pass expression sees the overlaid input; a wait
	// ignores it (output = input verbatim). The onFailure handler takes none (FailureContext only).
	Params json.RawMessage `json:"params,omitempty"`
}

type WorkflowStepStatus struct {
	Name     ObjectName        `json:"name"`
	Image    string            `json:"image,omitempty"`
	Contract *WorkflowContract `json:"contract,omitempty"`
}