v1alpha2

type A2AConfig struct {
	// +kubebuilder:validation:MinItems=1
	Skills []AgentSkill `json:"skills,omitempty"`
}

type Agent struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   AgentSpec   `json:"spec,omitempty"`
	Status AgentStatus `json:"status,omitempty"`
}

type AgentList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []Agent `json:"items"`
}

type AgentSkill server.AgentSkill

type AgentSpec struct {
	// +kubebuilder:validation:Enum=Declarative;BYO
	// +kubebuilder:default=Declarative
	Type AgentType `json:"type"`

	// +optional
	BYO *BYOAgentSpec `json:"byo,omitempty"`
	// +optional
	Declarative *DeclarativeAgentSpec `json:"declarative,omitempty"`

	// +optional
	Description string `json:"description,omitempty"`

	// Skills to load into the agent. They will be pulled from the specified container images.
	// and made available to the agent under the `/skills` folder.
	// +optional
	Skills *SkillForAgent `json:"skills,omitempty"`

	// AllowedNamespaces defines which namespaces are allowed to reference this Agent as a tool.
	// This follows the Gateway API pattern for cross-namespace route attachments.
	// If not specified, only Agents in the same namespace can reference this Agent as a tool.
	// This field only applies when this Agent is used as a tool by another Agent.
	// See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-routing
	// +optional
	AllowedNamespaces *AllowedNamespaces `json:"allowedNamespaces,omitempty"`
}

type AgentStatus struct {
	ObservedGeneration int64              `json:"observedGeneration"`
	Conditions         []metav1.Condition `json:"conditions,omitempty"`
}

type AgentType string

type AllowedNamespaces struct {
	// From indicates where references to this resource can originate.
	// Possible values are:
	// * All: References from all namespaces are allowed.
	// * Same: Only references from the same namespace are allowed (default).
	// * Selector: References from namespaces matching the selector are allowed.
	// +kubebuilder:default=Same
	// +optional
	From FromNamespaces `json:"from,omitempty"`

	// Selector is a label selector for namespaces that are allowed to reference this resource.
	// Only used when From is set to "Selector".
	// +optional
	Selector *metav1.LabelSelector `json:"selector,omitempty"`
}

type AnthropicConfig struct {
	// Base URL for the Anthropic API (overrides default)
	// +optional
	BaseURL string `json:"baseUrl,omitempty"`

	// Maximum tokens to generate
	// +optional
	MaxTokens int `json:"maxTokens,omitempty"`

	// Temperature for sampling
	// +optional
	Temperature string `json:"temperature,omitempty"`

	// Top-p sampling parameter
	// +optional
	TopP string `json:"topP,omitempty"`

	// Top-k sampling parameter
	// +optional
	TopK int `json:"topK,omitempty"`
}

type AnthropicVertexAIConfig struct {
	BaseVertexAIConfig `json:",inline"`

	// Maximum tokens to generate
	// +optional
	MaxTokens int `json:"maxTokens,omitempty"`
}

type AzureOpenAIConfig struct {
	// Endpoint for the Azure OpenAI API
	// +required
	Endpoint string `json:"azureEndpoint,omitempty"`

	// API version for the Azure OpenAI API
	// +required
	APIVersion string `json:"apiVersion,omitempty"`

	// Deployment name for the Azure OpenAI API
	// +optional
	DeploymentName string `json:"azureDeployment,omitempty"`

	// Azure AD token for authentication
	// +optional
	AzureADToken string `json:"azureAdToken,omitempty"`

	// Temperature for sampling
	// +optional
	Temperature string `json:"temperature,omitempty"`

	// Maximum tokens to generate
	// +optional
	MaxTokens *int `json:"maxTokens,omitempty"`

	// Top-p sampling parameter
	// +optional
	TopP string `json:"topP,omitempty"`
}

type BYOAgentSpec struct {
	// Trust relationship to the agent.
	// +optional
	Deployment *ByoDeploymentSpec `json:"deployment,omitempty"`
}

type BaseVertexAIConfig struct {
	// The project ID
	// +required
	ProjectID string `json:"projectID"`

	// The project location
	// +required
	Location string `json:"location,omitempty"`

	// Temperature
	// +optional
	Temperature string `json:"temperature,omitempty"`

	// Top-p sampling parameter
	// +optional
	TopP string `json:"topP,omitempty"`

	// Top-k sampling parameter
	// +optional
	TopK string `json:"topK,omitempty"`

	// Stop sequences
	// +optional
	StopSequences []string `json:"stopSequences,omitempty"`
}

type BedrockConfig struct {
	// AWS region where the Bedrock model is available (e.g., us-east-1, us-west-2)
	// +required
	Region string `json:"region"`
}

type ByoDeploymentSpec struct {
	// +kubebuilder:validation:MinLength=1
	Image string `json:"image,omitempty"`
	// +optional
	Cmd *string `json:"cmd,omitempty"`
	// +optional
	Args []string `json:"args,omitempty"`

	SharedDeploymentSpec `json:",inline"`
}

type ContextCompressionConfig struct {
	// The number of *new* user-initiated invocations that, once fully represented in the session's events, will trigger a compaction.
	// +optional
	// +kubebuilder:default=5
	// +kubebuilder:validation:Minimum=1
	CompactionInterval *int `json:"compactionInterval,omitempty"`
	// The number of preceding invocations to include from the end of the last compacted range. This creates an overlap between consecutive compacted summaries, maintaining context.
	// +optional
	// +kubebuilder:default=2
	// +kubebuilder:validation:Minimum=0
	OverlapSize *int `json:"overlapSize,omitempty"`
	// Summarizer configures an LLM-based summarizer for event compaction.
	// If not specified, compacted events are dropped from the context without summarization.
	// +optional
	Summarizer *ContextSummarizerConfig `json:"summarizer,omitempty"`
	// Post-invocation token threshold trigger. If set, ADK will attempt a post-invocation compaction when the most recently
	// observed prompt token count meets or exceeds this threshold.
	// +optional
	TokenThreshold *int `json:"tokenThreshold,omitempty"`
	// EventRetentionSize is the number of most recent events to always retain.
	// +optional
	EventRetentionSize *int `json:"eventRetentionSize,omitempty"`
}

type ContextConfig struct {
	// Compaction configures event history compaction.
	// When enabled, older events in the conversation are compacted (compressed/summarized)
	// to reduce context size while preserving key information.
	// +optional
	Compaction *ContextCompressionConfig `json:"compaction,omitempty"`
}

type ContextSummarizerConfig struct {
	// ModelConfig is the name of a ModelConfig resource to use for summarization.
	// Must be in the same namespace as the Agent.
	// If not specified, uses the agent's own model.
	// +optional
	ModelConfig *string `json:"modelConfig,omitempty"`
	// PromptTemplate is a custom prompt template for the summarizer.
	// See the ADK LlmEventSummarizer for template details:
	// https://github.com/google/adk-python/blob/main/src/google/adk/apps/llm_event_summarizer.py
	// +optional
	PromptTemplate *string `json:"promptTemplate,omitempty"`
}

type DeclarativeAgentSpec struct {
	// SystemMessage is a string specifying the system message for the agent.
	// When PromptTemplate is set, this field is treated as a Go text/template
	// with access to an include("source/key") function and agent context variables
	// such as .AgentName, .AgentNamespace, .Description, .ToolNames, and .SkillNames.
	// +optional
	SystemMessage string `json:"systemMessage,omitempty"`
	// SystemMessageFrom is a reference to a ConfigMap or Secret containing the system message.
	// When PromptTemplate is set, the resolved value is treated as a Go text/template.
	// +optional
	SystemMessageFrom *ValueSource `json:"systemMessageFrom,omitempty"`
	// PromptTemplate enables Go text/template processing on the systemMessage field.
	// When set, systemMessage is treated as a Go template with access to the include function
	// and agent context variables.
	// +optional
	PromptTemplate *PromptTemplateSpec `json:"promptTemplate,omitempty"`
	// The name of the model config to use.
	// If not specified, the default value is "default-model-config".
	// Must be in the same namespace as the Agent.
	// +optional
	ModelConfig string `json:"modelConfig,omitempty"`
	// Whether to stream the response from the model.
	// If not specified, the default value is false.
	// +optional
	Stream bool `json:"stream,omitempty"`
	// +kubebuilder:validation:MaxItems=20
	Tools []*Tool `json:"tools,omitempty"`
	// A2AConfig instantiates an A2A server for this agent,
	// served on the HTTP port of the kagent kubernetes
	// controller (default 8083).
	// The A2A server URL will be served at
	// <kagent-controller-ip>:8083/api/a2a/<agent-namespace>/<agent-name>
	// Read more about the A2A protocol here: https://github.com/google/A2A
	// +optional
	A2AConfig *A2AConfig `json:"a2aConfig,omitempty"`

	// +optional
	Deployment *DeclarativeDeploymentSpec `json:"deployment,omitempty"`

	// Allow code execution for python code blocks with this agent.
	// If true, the agent will automatically execute python code blocks in the LLM responses.
	// Code will be executed in a sandboxed environment.
	// +optional
	// due to a bug in adk (https://github.com/google/adk-python/issues/3921), this field is ignored for now.
	ExecuteCodeBlocks *bool `json:"executeCodeBlocks,omitempty"`

	// Memory configuration for the agent.
	// +optional
	Memory *MemorySpec `json:"memory,omitempty"`

	// Context configures context management for this agent.
	// This includes event compaction (compression) and context caching.
	// +optional
	Context *ContextConfig `json:"context,omitempty"`
}

type DeclarativeDeploymentSpec struct {
	// +optional
	ImageRegistry string `json:"imageRegistry,omitempty"`

	SharedDeploymentSpec `json:",inline"`
}

type FromNamespaces string

type GeminiConfig struct{}

type GeminiVertexAIConfig struct {
	BaseVertexAIConfig `json:",inline"`

	// Maximum output tokens
	// +optional
	MaxOutputTokens int `json:"maxOutputTokens,omitempty"`

	// Candidate count
	// +optional
	CandidateCount int `json:"candidateCount,omitempty"`

	// Response mime type
	// +optional
	ResponseMimeType string `json:"responseMimeType,omitempty"`
}

type GitRepo struct {
	// URL of the git repository (HTTPS or SSH).
	// +kubebuilder:validation:Required
	URL string `json:"url"`

	// Git reference: branch name, tag, or commit SHA.
	// +optional
	// +kubebuilder:default="main"
	Ref string `json:"ref,omitempty"`

	// Subdirectory within the repo to use as the skill root.
	// +optional
	Path string `json:"path,omitempty"`

	// Name for the skill directory under /skills. Defaults to the repo name.
	// +optional
	Name string `json:"name,omitempty"`
}

type MCPTool struct {
	Name        string `json:"name"`
	Description string `json:"description"`
}

type McpServerTool struct {
	// The reference to the ToolServer that provides the tool.
	// +optional
	TypedReference `json:",inline"`

	// The names of the tools to be provided by the ToolServer
	// For a list of all the tools provided by the server,
	// the client can query the status of the ToolServer object after it has been created
	ToolNames []string `json:"toolNames,omitempty"`

	// AllowedHeaders specifies which headers from the A2A request should be
	// propagated to MCP tool calls. Header names are case-insensitive.
	//
	// Authorization header behavior:
	// - Authorization headers CAN be propagated if explicitly listed in allowedHeaders
	// - When STS token propagation is enabled, STS-generated Authorization headers
	//   will take precedence and replace any Authorization header from the A2A request
	// - This is a security measure to prevent request headers from overwriting
	//   authentication tokens generated by the STS integration
	//
	// Example: ["x-user-email", "x-tenant-id"]
	// +optional
	AllowedHeaders []string `json:"allowedHeaders,omitempty"`
}

type MemorySpec struct {
	// ModelConfig is the name of the ModelConfig object whose embedding
	// provider will be used to generate memory vectors.
	// +kubebuilder:validation:Required
	ModelConfig string `json:"modelConfig"`

	// TTLDays controls how many days a stored memory entry remains valid before
	// it is eligible for pruning. Defaults to 15 days when unset or zero.
	// +optional
	// +kubebuilder:validation:Minimum=1
	TTLDays int `json:"ttlDays,omitempty"`
}

type ModelConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ModelConfigSpec   `json:"spec,omitempty"`
	Status ModelConfigStatus `json:"status,omitempty"`
}

type ModelConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ModelConfig `json:"items"`
}

type ModelConfigSpec struct {
	Model string `json:"model"`

	// The name of the secret that contains the API key. Must be a reference to the name of a secret in the same namespace as the referencing ModelConfig
	// +optional
	APIKeySecret string `json:"apiKeySecret"`

	// The key in the secret that contains the API key
	// +optional
	APIKeySecretKey string `json:"apiKeySecretKey"`

	// APIKeyPassthrough enables forwarding the Bearer token from incoming A2A requests
	// directly to the LLM provider as the API key. This is useful for organizations
	// with federated identity that want to avoid separate secret management.
	// Mutually exclusive with apiKeySecret.
	// +optional
	APIKeyPassthrough bool `json:"apiKeyPassthrough,omitempty"`

	// +optional
	DefaultHeaders map[string]string `json:"defaultHeaders,omitempty"`

	// The provider of the model
	// +kubebuilder:default=OpenAI
	Provider ModelProvider `json:"provider"`

	// OpenAI-specific configuration
	// +optional
	OpenAI *OpenAIConfig `json:"openAI,omitempty"`

	// Anthropic-specific configuration
	// +optional
	Anthropic *AnthropicConfig `json:"anthropic,omitempty"`

	// Azure OpenAI-specific configuration
	// +optional
	AzureOpenAI *AzureOpenAIConfig `json:"azureOpenAI,omitempty"`

	// Ollama-specific configuration
	// +optional
	Ollama *OllamaConfig `json:"ollama,omitempty"`

	// Gemini-specific configuration
	// +optional
	Gemini *GeminiConfig `json:"gemini,omitempty"`

	// Gemini Vertex AI-specific configuration
	// +optional
	GeminiVertexAI *GeminiVertexAIConfig `json:"geminiVertexAI,omitempty"`

	// Anthropic-specific configuration
	// +optional
	AnthropicVertexAI *AnthropicVertexAIConfig `json:"anthropicVertexAI,omitempty"`

	// AWS Bedrock-specific configuration
	// +optional
	Bedrock *BedrockConfig `json:"bedrock,omitempty"`

	// TLS configuration for provider connections.
	// Enables agents to connect to internal LiteLLM gateways or other providers
	// that use self-signed certificates or custom certificate authorities.
	// +optional
	TLS *TLSConfig `json:"tls,omitempty"`
}

type ModelConfigStatus struct {
	Conditions         []metav1.Condition `json:"conditions"`
	ObservedGeneration int64              `json:"observedGeneration"`
	// The secret hash stores a hash of any secrets required by the model config (i.e. api key, tls cert) to ensure agents referencing this model config detect changes to these secrets and restart if necessary.
	SecretHash string `json:"secretHash,omitempty"`
}

type ModelProvider string

type ModelProviderConfig struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   ModelProviderConfigSpec   `json:"spec,omitempty"`
	Status ModelProviderConfigStatus `json:"status,omitempty"`
}

type ModelProviderConfigList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []ModelProviderConfig `json:"items"`
}

type ModelProviderConfigSpec struct {
	// Type is the model provider type (OpenAI, Anthropic, etc.)
	// +required
	// +kubebuilder:validation:Required
	Type ModelProvider `json:"type"`

	// Endpoint is the API endpoint URL for the provider.
	// If not specified, the default endpoint for the provider type will be used.
	// +optional
	// +kubebuilder:validation:Pattern=`^https?://.*`
	Endpoint string `json:"endpoint,omitempty"`

	// SecretRef references the Kubernetes Secret containing the API key.
	// Optional for providers that don't require authentication (e.g., local Ollama).
	// +optional
	SecretRef *SecretReference `json:"secretRef,omitempty"`
}

type ModelProviderConfigStatus struct {
	// ObservedGeneration reflects the generation of the most recently observed ModelProviderConfig spec
	// +optional
	ObservedGeneration int64 `json:"observedGeneration,omitempty"`

	// Conditions represent the latest available observations of the ModelProviderConfig's state
	// +optional
	// +listType=map
	// +listMapKey=type
	Conditions []metav1.Condition `json:"conditions,omitempty"`

	// DiscoveredModels is the cached list of model IDs available from this model provider
	// +optional
	DiscoveredModels []string `json:"discoveredModels,omitempty"`

	// ModelCount is the number of discovered models (for kubectl display)
	// +optional
	ModelCount int `json:"modelCount,omitempty"`

	// LastDiscoveryTime is the timestamp of the last successful model discovery
	// +optional
	LastDiscoveryTime *metav1.Time `json:"lastDiscoveryTime,omitempty"`

	// SecretHash is a hash of the referenced secret data, used to detect secret changes
	// +optional
	SecretHash string `json:"secretHash,omitempty"`
}

type OllamaConfig struct {
	// Host for the Ollama API
	// +optional
	Host string `json:"host,omitempty"`

	// Options for the Ollama API
	// +optional
	Options map[string]string `json:"options,omitempty"`
}

type OpenAIConfig struct {
	// Base URL for the OpenAI API (overrides default)
	// +optional
	BaseURL string `json:"baseUrl,omitempty"`

	// Organization ID for the OpenAI API
	// +optional
	Organization string `json:"organization,omitempty"`

	// Temperature for sampling
	// +optional
	Temperature string `json:"temperature,omitempty"`

	// Maximum tokens to generate
	// +optional
	MaxTokens int `json:"maxTokens,omitempty"`

	// Top-p sampling parameter
	// +optional
	TopP string `json:"topP,omitempty"`

	// Frequency penalty
	// +optional
	FrequencyPenalty string `json:"frequencyPenalty,omitempty"`

	// Presence penalty
	// +optional
	PresencePenalty string `json:"presencePenalty,omitempty"`

	// Seed value
	// +optional
	Seed *int `json:"seed,omitempty"`

	// N value
	N *int `json:"n,omitempty"`

	// Timeout
	Timeout *int `json:"timeout,omitempty"`

	// Reasoning effort
	// +optional
	ReasoningEffort *OpenAIReasoningEffort `json:"reasoningEffort,omitempty"`
}

type OpenAIReasoningEffort string

type PromptSource struct {
	// Inline reference to the Kubernetes resource.
	// For ConfigMaps: kind=ConfigMap, apiGroup="" (empty for core API group).
	TypedLocalReference `json:",inline"`

	// Alias is an optional short identifier for use in include directives.
	// If set, use include("alias/key") instead of include("name/key").
	// +optional
	Alias string `json:"alias,omitempty"`
}

type PromptTemplateSpec struct {
	// DataSources defines the ConfigMaps whose keys can be included in the systemMessage
	// using Go template syntax, e.g. include("alias/key") or include("name/key").
	// +optional
	// +kubebuilder:validation:MaxItems=20
	DataSources []PromptSource `json:"dataSources,omitempty"`
}

type RemoteMCPServer struct {
	metav1.TypeMeta   `json:",inline"`
	metav1.ObjectMeta `json:"metadata,omitempty"`

	Spec   RemoteMCPServerSpec   `json:"spec,omitempty"`
	Status RemoteMCPServerStatus `json:"status,omitempty"`
}

type RemoteMCPServerList struct {
	metav1.TypeMeta `json:",inline"`
	metav1.ListMeta `json:"metadata,omitempty"`
	Items           []RemoteMCPServer `json:"items"`
}

type RemoteMCPServerProtocol string

type RemoteMCPServerSpec struct {
	Description string `json:"description"`
	// +kubebuilder:default=STREAMABLE_HTTP
	// +optional
	Protocol RemoteMCPServerProtocol `json:"protocol"`
	// +kubebuilder:validation:MinLength=1
	URL string `json:"url"`
	// +optional
	HeadersFrom []ValueRef `json:"headersFrom,omitempty"`
	// +optional
	Timeout *metav1.Duration `json:"timeout,omitempty"`
	// +optional
	SseReadTimeout *metav1.Duration `json:"sseReadTimeout,omitempty"`
	// +optional
	// +kubebuilder:default=true
	TerminateOnClose *bool `json:"terminateOnClose,omitempty"`

	// AllowedNamespaces defines which namespaces are allowed to reference this RemoteMCPServer.
	// This follows the Gateway API pattern for cross-namespace route attachments.
	// If not specified, only Agents in the same namespace can reference this RemoteMCPServer.
	// See: https://gateway-api.sigs.k8s.io/guides/multiple-ns/#cross-namespace-routing
	// +optional
	AllowedNamespaces *AllowedNamespaces `json:"allowedNamespaces,omitempty"`
}

type RemoteMCPServerStatus struct {
	// INSERT ADDITIONAL STATUS FIELD - define observed state of cluster
	// Important: Run "make" to regenerate code after modifying this file
	ObservedGeneration int64              `json:"observedGeneration"`
	Conditions         []metav1.Condition `json:"conditions"`
	// +kubebuilder:validation:Optional
	DiscoveredTools []*MCPTool `json:"discoveredTools"`
}

type SecretReference struct {
	// Name is the name of the secret in the same namespace as the ModelProviderConfig.
	// +required
	Name string `json:"name"`
}

type ServiceAccountConfig struct {
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
}

type SharedDeploymentSpec struct {
	// +optional
	Replicas *int32 `json:"replicas,omitempty"`
	// +optional
	ImagePullSecrets []corev1.LocalObjectReference `json:"imagePullSecrets,omitempty"`
	// +optional
	Volumes []corev1.Volume `json:"volumes,omitempty"`
	// +optional
	VolumeMounts []corev1.VolumeMount `json:"volumeMounts,omitempty"`
	// +optional
	Labels map[string]string `json:"labels,omitempty"`
	// +optional
	Annotations map[string]string `json:"annotations,omitempty"`
	// +optional
	Env []corev1.EnvVar `json:"env,omitempty"`
	// +optional
	ImagePullPolicy corev1.PullPolicy `json:"imagePullPolicy,omitempty"`
	// +optional
	Resources *corev1.ResourceRequirements `json:"resources,omitempty"`
	// +optional
	Tolerations []corev1.Toleration `json:"tolerations,omitempty"`
	// +optional
	Affinity *corev1.Affinity `json:"affinity,omitempty"`
	// +optional
	NodeSelector map[string]string `json:"nodeSelector,omitempty"`
	// +optional
	SecurityContext *corev1.SecurityContext `json:"securityContext,omitempty"`
	// +optional
	PodSecurityContext *corev1.PodSecurityContext `json:"podSecurityContext,omitempty"`
	// ServiceAccountName specifies the name of an existing ServiceAccount to use.
	// If this field is set, the Agent controller will not create a ServiceAccount for the agent.
	// This field is mutually exclusive with ServiceAccountConfig.
	// +optional
	ServiceAccountName *string `json:"serviceAccountName,omitempty"`
	// ServiceAccountConfig configures the ServiceAccount created by the Agent controller.
	// This field can only be used when ServiceAccountName is not set.
	// If ServiceAccountName is not set, a default ServiceAccount (named after the agent)
	// is created, and this config will be applied to it.
	// +optional
	ServiceAccountConfig *ServiceAccountConfig `json:"serviceAccountConfig,omitempty"`
}

type SkillForAgent struct {
	// Fetch images insecurely from registries (allowing HTTP and skipping TLS verification).
	// Meant for development and testing purposes only.
	// +optional
	InsecureSkipVerify bool `json:"insecureSkipVerify,omitempty"`

	// The list of skill images to fetch.
	// +kubebuilder:validation:MaxItems=20
	// +kubebuilder:validation:MinItems=1
	// +optional
	Refs []string `json:"refs,omitempty"`

	// Reference to a Secret containing git credentials.
	// Applied to all gitRefs entries.
	// The secret should contain a `token` key for HTTPS auth,
	// or `ssh-privatekey` for SSH auth.
	// +optional
	GitAuthSecretRef *corev1.LocalObjectReference `json:"gitAuthSecretRef,omitempty"`

	// Git repositories to fetch skills from.
	// +kubebuilder:validation:MaxItems=20
	// +kubebuilder:validation:MinItems=1
	// +optional
	GitRefs []GitRepo `json:"gitRefs,omitempty"`
}

type TLSConfig struct {
	// DisableVerify disables SSL certificate verification entirely.
	// When false (default), SSL certificates are verified.
	// When true, SSL certificate verification is disabled.
	// WARNING: This should ONLY be used in development/testing environments.
	// Production deployments MUST use proper certificates.
	// +optional
	// +kubebuilder:default=false
	DisableVerify bool `json:"disableVerify,omitempty"`

	// CACertSecretRef is a reference to a Kubernetes Secret containing
	// CA certificate(s) in PEM format. The Secret must be in the same
	// namespace as the ModelConfig.
	// When set, the certificate will be used to verify the provider's SSL certificate.
	// This field follows the same pattern as APIKeySecret.
	// +optional
	CACertSecretRef string `json:"caCertSecretRef,omitempty"`

	// CACertSecretKey is the key within the Secret that contains the CA certificate data.
	// This field follows the same pattern as APIKeySecretKey.
	// Required when CACertSecretRef is set (unless DisableVerify is true).
	// +optional
	CACertSecretKey string `json:"caCertSecretKey,omitempty"`

	// DisableSystemCAs disables the use of system CA certificates.
	// When false (default), system CA certificates are used for verification (safe behavior).
	// When true, only the custom CA from CACertSecretRef is trusted.
	// This allows strict security policies where only corporate CAs should be trusted.
	// +optional
	// +kubebuilder:default=false
	DisableSystemCAs bool `json:"disableSystemCAs,omitempty"`
}

type Tool struct {
	// +kubebuilder:validation:Enum=McpServer;Agent
	Type ToolProviderType `json:"type,omitempty"`
	// +optional
	McpServer *McpServerTool `json:"mcpServer,omitempty"`
	// +optional
	Agent *TypedReference `json:"agent,omitempty"`

	// HeadersFrom specifies a list of configuration values to be added as
	// headers to requests sent to the Tool from this agent. The value of
	// each header is resolved from either a Secret or ConfigMap in the same
	// namespace as the Agent. Headers specified here will override any
	// headers of the same name/key specified on the tool.
	// +optional
	HeadersFrom []ValueRef `json:"headersFrom,omitempty"`
}

type ToolProviderType string

type TypedLocalReference struct {
	// +optional
	Kind string `json:"kind"`
	// +optional
	ApiGroup string `json:"apiGroup"`
	Name     string `json:"name"`
}

type TypedReference struct {
	// +optional
	Kind string `json:"kind"`
	// +optional
	ApiGroup string `json:"apiGroup"`
	Name     string `json:"name"`
	// +optional
	Namespace string `json:"namespace,omitempty"`
}

type ValueRef struct {
	Name string `json:"name"`
	// +optional
	Value string `json:"value,omitempty"`
	// +optional
	ValueFrom *ValueSource `json:"valueFrom,omitempty"`
}

type ValueSource struct {
	// +kubebuilder:validation:Enum=ConfigMap;Secret
	Type ValueSourceType `json:"type"`
	// The name of the ConfigMap or Secret.
	Name string `json:"name"`
	// The key of the ConfigMap or Secret.
	Key string `json:"key"`
}

type ValueSourceType string