diff --git a/.gitignore b/.gitignore
index 2d88c0ee..c9bff312 100644
--- a/.gitignore
+++ b/.gitignore
@@ -7,3 +7,4 @@ ehthumbs.db
 Thumbs.db
 vendor/
 node_modules/
+tmp/
diff --git a/cue.mod/gen/kargo.akuity.io/freight/v1alpha1/types_gen.cue b/cue.mod/gen/kargo.akuity.io/freight/v1alpha1/types_gen.cue
new file mode 100644
index 00000000..355adb9d
--- /dev/null
+++ b/cue.mod/gen/kargo.akuity.io/freight/v1alpha1/types_gen.cue
@@ -0,0 +1,154 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f projects/argocd/components/kargo/vendor/1.0.3/kargo/resources/crds/kargo.akuity.io_freights.yaml
+
+package v1alpha1
+
+import "strings"
+
+// Freight represents a collection of versioned artifacts.
+#Freight: {
+	// Alias is a human-friendly alias for a piece of Freight. This is
+	// an optional
+	// field. A defaulting webhook will sync this field with the value
+	// of the
+	// kargo.akuity.io/alias label. When the alias label is not
+	// present or differs
+	// from the value of this field, the defaulting webhook will set
+	// the label to
+	// the value of this field. If the alias label is present and this
+	// field is
+	// empty, the defaulting webhook will set the value of this field
+	// to the value
+	// of the alias label. If this field is empty and the alias label
+	// is not
+	// present, the defaulting webhook will choose an available alias
+	// and assign
+	// it to both the field and label.
+	alias?: string
+
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "kargo.akuity.io/v1alpha1"
+
+	// Charts describes specific versions of specific Helm charts.
+	charts?: [...{
+		// Name specifies the name of the chart.
+		name?: string
+
+		// RepoURL specifies the URL of a Helm chart repository. Classic
+		// chart
+		// repositories (using HTTP/S) can contain differently named
+		// charts. When this
+		// field points to such a repository, the Name field will specify
+		// the name of
+		// the chart within the repository. In the case of a repository
+		// within an OCI
+		// registry, the URL implicitly points to a specific chart and the
+		// Name field
+		// will be empty.
+		repoURL?: string
+
+		// Version specifies a particular version of the chart.
+		version?: string
+	}]
+
+	// Commits describes specific Git repository commits.
+	commits?: [...{
+		// Author is the author of the commit.
+		author?: string
+
+		// Branch denotes the branch of the repository where this commit
+		// was found.
+		branch?: string
+
+		// Committer is the person who committed the commit.
+		committer?: string
+
+		// ID is the ID of a specific commit in the Git repository
+		// specified by
+		// RepoURL.
+		id?: string
+
+		// Message is the message associated with the commit. At present,
+		// this only
+		// contains the first line (subject) of the commit message.
+		message?: string
+
+		// RepoURL is the URL of a Git repository.
+		repoURL?: string
+
+		// Tag denotes a tag in the repository that matched selection
+		// criteria and
+		// resolved to this commit.
+		tag?: string
+	}]
+
+	// Images describes specific versions of specific container
+	// images.
+	images?: [...{
+		// Digest identifies a specific version of the image in the
+		// repository
+		// specified by RepoURL. This is a more precise identifier than
+		// Tag.
+		digest?: string
+
+		// GitRepoURL specifies the URL of a Git repository that contains
+		// the source
+		// code for the image repository referenced by the RepoURL field
+		// if Kargo was
+		// able to infer it.
+		gitRepoURL?: string
+
+		// RepoURL describes the repository in which the image can be
+		// found.
+		repoURL?: string
+
+		// Tag identifies a specific version of the image in the
+		// repository specified
+		// by RepoURL.
+		tag?: string
+	}]
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Freight"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// Origin describes a kind of Freight in terms of its origin.
+	origin: {
+		// Kind is the kind of resource from which Freight may have
+		// originated. At
+		// present, this can only be "Warehouse".
+		kind: "Warehouse"
+
+		// Name is the name of the resource of the kind indicated by the
+		// Kind field
+		// from which Freight may originated.
+		name: string
+	}
+}
diff --git a/cue.mod/gen/kargo.akuity.io/project/v1alpha1/types_gen.cue b/cue.mod/gen/kargo.akuity.io/project/v1alpha1/types_gen.cue
new file mode 100644
index 00000000..0c3a6ef8
--- /dev/null
+++ b/cue.mod/gen/kargo.akuity.io/project/v1alpha1/types_gen.cue
@@ -0,0 +1,72 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f projects/argocd/components/kargo/vendor/1.0.3/kargo/resources/crds/kargo.akuity.io_projects.yaml
+
+package v1alpha1
+
+import "strings"
+
+// Project is a resource type that reconciles to a specially
+// labeled namespace
+// and other TODO: TBD project-level resources.
+#Project: {
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "kargo.akuity.io/v1alpha1"
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Project"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace?: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// Spec describes a Project.
+	spec!: #ProjectSpec
+}
+#ProjectSpec: {
+	// PromotionPolicies defines policies governing the promotion of
+	// Freight to
+	// specific Stages within this Project.
+	promotionPolicies?: [...{
+		// AutoPromotionEnabled indicates whether new Freight can
+		// automatically be
+		// promoted into the Stage referenced by the Stage field. Note:
+		// There are may
+		// be other conditions also required for an auto-promotion to
+		// occur. This
+		// field defaults to false, but is commonly set to true for Stages
+		// that
+		// subscribe to Warehouses instead of other, upstream Stages. This
+		// allows
+		// users to define Stages that are automatically updated as soon
+		// as new
+		// artifacts are detected.
+		autoPromotionEnabled?: bool
+		stage: strings.MinRunes(1) & {
+			=~"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+		}
+	}]
+}
diff --git a/cue.mod/gen/kargo.akuity.io/promotion/v1alpha1/types_gen.cue b/cue.mod/gen/kargo.akuity.io/promotion/v1alpha1/types_gen.cue
new file mode 100644
index 00000000..5b93cf94
--- /dev/null
+++ b/cue.mod/gen/kargo.akuity.io/promotion/v1alpha1/types_gen.cue
@@ -0,0 +1,83 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f projects/argocd/components/kargo/vendor/1.0.3/kargo/resources/crds/kargo.akuity.io_promotions.yaml
+
+package v1alpha1
+
+import "strings"
+
+// Promotion represents a request to transition a particular Stage
+// into a
+// particular Freight.
+#Promotion: {
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "kargo.akuity.io/v1alpha1"
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Promotion"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// Spec describes the desired transition of a specific Stage into
+	// a specific
+	// Freight.
+	spec!: #PromotionSpec
+}
+
+// Spec describes the desired transition of a specific Stage into
+// a specific
+// Freight.
+#PromotionSpec: {
+	// Freight specifies the piece of Freight to be promoted into the
+	// Stage
+	// referenced by the Stage field.
+	freight: strings.MinRunes(1)
+
+	// Stage specifies the name of the Stage to which this Promotion
+	// applies. The Stage referenced by this field MUST be in the same
+	// namespace as the Promotion.
+	stage: strings.MinRunes(1) & {
+		=~"^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+	}
+
+	// Steps specifies the directives to be executed as part of this
+	// Promotion.
+	// The order in which the directives are executed is the order in
+	// which they
+	// are listed in this field.
+	steps?: [...{
+		// As is the alias this step can be referred to as.
+		as?: string
+
+		// Config is the configuration for the directive.
+		config?: _
+
+		// Uses identifies a runner that can execute this step.
+		uses: strings.MinRunes(1)
+	}]
+}
diff --git a/cue.mod/gen/kargo.akuity.io/stage/v1alpha1/types_gen.cue b/cue.mod/gen/kargo.akuity.io/stage/v1alpha1/types_gen.cue
new file mode 100644
index 00000000..6daeeee8
--- /dev/null
+++ b/cue.mod/gen/kargo.akuity.io/stage/v1alpha1/types_gen.cue
@@ -0,0 +1,179 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f projects/argocd/components/kargo/vendor/1.0.3/kargo/resources/crds/kargo.akuity.io_stages.yaml
+
+package v1alpha1
+
+import "strings"
+
+// Stage is the Kargo API's main type.
+#Stage: {
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "kargo.akuity.io/v1alpha1"
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Stage"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// Spec describes sources of Freight used by the Stage and how to
+	// incorporate
+	// Freight into the Stage.
+	spec!: #StageSpec
+}
+
+// Spec describes sources of Freight used by the Stage and how to
+// incorporate
+// Freight into the Stage.
+#StageSpec: {
+	promotionTemplate?: {
+		spec: {
+			// Steps specifies the directives to be executed as part of a
+			// Promotion.
+			// The order in which the directives are executed is the order in
+			// which they
+			// are listed in this field.
+			steps?: [...{
+				// As is the alias this step can be referred to as.
+				as?: string
+
+				// Config is the configuration for the directive.
+				config?: _
+
+				// Uses identifies a runner that can execute this step.
+				uses: strings.MinRunes(1)
+			}] & [_, ...]
+		}
+	}
+
+	// RequestedFreight expresses the Stage's need for certain pieces
+	// of Freight,
+	// each having originated from a particular Warehouse. This list
+	// must be
+	// non-empty. In the common case, a Stage will request Freight
+	// having
+	// originated from just one specific Warehouse. In advanced cases,
+	// requesting
+	// Freight from multiple Warehouses provides a method of advancing
+	// new
+	// artifacts of different types through parallel pipelines at
+	// different
+	// speeds. This can be useful, for instance, if a Stage is home to
+	// multiple
+	// microservices that are independently versioned.
+	requestedFreight: [...{
+		// Origin specifies from where the requested Freight must have
+		// originated.
+		// This is a required field.
+		origin: {
+			// Kind is the kind of resource from which Freight may have
+			// originated. At
+			// present, this can only be "Warehouse".
+			kind: "Warehouse"
+
+			// Name is the name of the resource of the kind indicated by the
+			// Kind field
+			// from which Freight may originated.
+			name: string
+		}
+
+		// Sources describes where the requested Freight may be obtained
+		// from. This is
+		// a required field.
+		sources: {
+			// Direct indicates the requested Freight may be obtained directly
+			// from the
+			// Warehouse from which it originated. If this field's value is
+			// false, then
+			// the value of the Stages field must be non-empty. i.e. Between
+			// the two
+			// fields, at least one source must be specified.
+			direct?: bool
+
+			// Stages identifies other "upstream" Stages as potential sources
+			// of the
+			// requested Freight. If this field's value is empty, then the
+			// value of the
+			// Direct field must be true. i.e. Between the two fields, at
+			// least on source
+			// must be specified.
+			stages?: [...string]
+		}
+	}] & [_, ...]
+
+	// Shard is the name of the shard that this Stage belongs to. This
+	// is an
+	// optional field. If not specified, the Stage will belong to the
+	// default
+	// shard. A defaulting webhook will sync the value of the
+	// kargo.akuity.io/shard label with the value of this field. When
+	// this field
+	// is empty, the webhook will ensure that label is absent.
+	shard?: string
+
+	// Verification describes how to verify a Stage's current Freight
+	// is fit for
+	// promotion downstream.
+	verification?: {
+		// AnalysisRunMetadata contains optional metadata that should be
+		// applied to
+		// all AnalysisRuns.
+		analysisRunMetadata?: {
+			// Additional annotations to apply to an AnalysisRun.
+			annotations?: {
+				[string]: string
+			}
+
+			// Additional labels to apply to an AnalysisRun.
+			labels?: {
+				[string]: string
+			}
+		}
+
+		// AnalysisTemplates is a list of AnalysisTemplates from which
+		// AnalysisRuns
+		// should be created to verify a Stage's current Freight is fit to
+		// be promoted
+		// downstream.
+		analysisTemplates?: [...{
+			// Name is the name of the AnalysisTemplate in the same
+			// project/namespace as
+			// the Stage.
+			name: string
+		}]
+
+		// Args lists arguments that should be added to all AnalysisRuns.
+		args?: [...{
+			// Name is the name of the argument.
+			name: string
+
+			// Value is the value of the argument.
+			value: string
+		}]
+	}
+}
diff --git a/cue.mod/gen/kargo.akuity.io/warehouse/v1alpha1/types_gen.cue b/cue.mod/gen/kargo.akuity.io/warehouse/v1alpha1/types_gen.cue
new file mode 100644
index 00000000..43fbdb46
--- /dev/null
+++ b/cue.mod/gen/kargo.akuity.io/warehouse/v1alpha1/types_gen.cue
@@ -0,0 +1,399 @@
+// Code generated by timoni. DO NOT EDIT.
+
+//timoni:generate timoni vendor crd -f projects/argocd/components/kargo/vendor/1.0.3/kargo/resources/crds/kargo.akuity.io_warehouses.yaml
+
+package v1alpha1
+
+import "strings"
+
+// Warehouse is a source of Freight.
+#Warehouse: {
+	// APIVersion defines the versioned schema of this representation
+	// of an object.
+	// Servers should convert recognized schemas to the latest
+	// internal value, and
+	// may reject unrecognized values.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#resources
+	apiVersion: "kargo.akuity.io/v1alpha1"
+
+	// Kind is a string value representing the REST resource this
+	// object represents.
+	// Servers may infer this from the endpoint the client submits
+	// requests to.
+	// Cannot be updated.
+	// In CamelCase.
+	// More info:
+	// https://git.k8s.io/community/contributors/devel/sig-architecture/api-conventions.md#types-kinds
+	kind: "Warehouse"
+	metadata!: {
+		name!: strings.MaxRunes(253) & strings.MinRunes(1) & {
+			string
+		}
+		namespace!: strings.MaxRunes(63) & strings.MinRunes(1) & {
+			string
+		}
+		labels?: {
+			[string]: string
+		}
+		annotations?: {
+			[string]: string
+		}
+	}
+
+	// Spec describes sources of artifacts.
+	spec!: #WarehouseSpec
+}
+
+// Spec describes sources of artifacts.
+#WarehouseSpec: {
+	// FreightCreationPolicy describes how Freight is created by this
+	// Warehouse.
+	// This field is optional. When left unspecified, the field is
+	// implicitly
+	// treated as if its value were "Automatic".
+	freightCreationPolicy?: "Automatic" | "Manual" | *"Automatic"
+
+	// Interval is the reconciliation interval for this Warehouse. On
+	// each
+	// reconciliation, the Warehouse will discover new artifacts and
+	// optionally
+	// produce new Freight. This field is optional. When left
+	// unspecified, the
+	// field is implicitly treated as if its value were "5m0s".
+	interval: =~"^([0-9]+(\\.[0-9]+)?(s|m|h))+$" | *"5m0s"
+
+	// Shard is the name of the shard that this Warehouse belongs to.
+	// This is an
+	// optional field. If not specified, the Warehouse will belong to
+	// the default
+	// shard. A defaulting webhook will sync this field with the value
+	// of the
+	// kargo.akuity.io/shard label. When the shard label is not
+	// present or differs
+	// from the value of this field, the defaulting webhook will set
+	// the label to
+	// the value of this field. If the shard label is present and this
+	// field is
+	// empty, the defaulting webhook will set the value of this field
+	// to the value
+	// of the shard label.
+	shard?: string
+
+	// Subscriptions describes sources of artifacts to be included in
+	// Freight
+	// produced by this Warehouse.
+	subscriptions: [...{
+		// Chart describes a subscription to a Helm chart repository.
+		chart?: {
+			// DiscoveryLimit is an optional limit on the number of chart
+			// versions that
+			// can be discovered for this subscription. The limit is applied
+			// after
+			// filtering charts based on the SemverConstraint field.
+			// When left unspecified, the field is implicitly treated as if
+			// its value
+			// were "20". The upper limit for this field is 100.
+			discoveryLimit?: int & <=100 & >=1 | *20
+
+			// Name specifies the name of a Helm chart to subscribe to within
+			// a classic
+			// chart repository specified by the RepoURL field. This field is
+			// required
+			// when the RepoURL field points to a classic chart repository and
+			// MUST
+			// otherwise be empty.
+			name?: string
+
+			// RepoURL specifies the URL of a Helm chart repository. It may be
+			// a classic
+			// chart repository (using HTTP/S) OR a repository within an OCI
+			// registry.
+			// Classic chart repositories can contain differently named
+			// charts. When this
+			// field points to such a repository, the Name field MUST also be
+			// used
+			// to specify the name of the desired chart within that
+			// repository. In the
+			// case of a repository within an OCI registry, the URL implicitly
+			// points to
+			// a specific chart and the Name field MUST NOT be used. The
+			// RepoURL field is
+			// required.
+			repoURL: strings.MinRunes(1) & {
+				=~"^(((https?)|(oci))://)([\\w\\d\\.\\-]+)(:[\\d]+)?(/.*)*$"
+			}
+
+			// SemverConstraint specifies constraints on what new chart
+			// versions are
+			// permissible. This field is optional. When left unspecified,
+			// there will be
+			// no constraints, which means the latest version of the chart
+			// will always be
+			// used. Care should be taken with leaving this field unspecified,
+			// as it can
+			// lead to the unanticipated rollout of breaking changes.
+			// More info:
+			// https://github.com/masterminds/semver#checking-version-constraints
+			semverConstraint?: string
+		}
+
+		// Git describes a subscriptions to a Git repository.
+		git?: {
+			// AllowTags is a regular expression that can optionally be used
+			// to limit the
+			// tags that are considered in determining the newest commit of
+			// interest. The
+			// value in this field only has any effect when the
+			// CommitSelectionStrategy is
+			// Lexical, NewestTag, or SemVer. This field is optional.
+			allowTags?: string
+
+			// Branch references a particular branch of the repository. The
+			// value in this
+			// field only has any effect when the CommitSelectionStrategy is
+			// NewestFromBranch or left unspecified (which is implicitly the
+			// same as
+			// NewestFromBranch). This field is optional. When left
+			// unspecified, (and the
+			// CommitSelectionStrategy is NewestFromBranch or unspecified),
+			// the
+			// subscription is implicitly to the repository's default branch.
+			branch?: strings.MinRunes(1) & {
+				=~"^\\w+([-/]\\w+)*$"
+			}
+
+			// CommitSelectionStrategy specifies the rules for how to identify
+			// the newest
+			// commit of interest in the repository specified by the RepoURL
+			// field. This
+			// field is optional. When left unspecified, the field is
+			// implicitly treated
+			// as if its value were "NewestFromBranch".
+			commitSelectionStrategy?: "Lexical" | "NewestFromBranch" | "NewestTag" | "SemVer" | *"NewestFromBranch"
+
+			// DiscoveryLimit is an optional limit on the number of commits
+			// that can be
+			// discovered for this subscription. The limit is applied after
+			// filtering
+			// commits based on the AllowTags and IgnoreTags fields.
+			// When left unspecified, the field is implicitly treated as if
+			// its value
+			// were "20". The upper limit for this field is 100.
+			discoveryLimit?: int & <=100 & >=1 | *20
+
+			// ExcludePaths is a list of selectors that designate paths in the
+			// repository
+			// that should NOT trigger the production of new Freight when
+			// changes are
+			// detected therein. When specified, changes in the identified
+			// paths will not
+			// trigger Freight production. When not specified, paths that
+			// should trigger
+			// Freight production will be defined solely by IncludePaths.
+			// Selectors may be
+			// defined using:
+			// 1. Exact paths to files or directories (ex. "charts/foo")
+			// 2. Glob patterns (prefix the pattern with "glob:"; ex.
+			// "glob:*.yaml")
+			// 3. Regular expressions (prefix the pattern with "regex:" or
+			// "regexp:";
+			// ex. "regexp:^.*\.yaml$")
+			// Paths selected by IncludePaths may be unselected by
+			// ExcludePaths. This
+			// is a useful method for including a broad set of paths and then
+			// excluding a
+			// subset of them.
+			excludePaths?: [...string]
+
+			// IgnoreTags is a list of tags that must be ignored when
+			// determining the
+			// newest commit of interest. No regular expressions or glob
+			// patterns are
+			// supported yet. The value in this field only has any effect when
+			// the
+			// CommitSelectionStrategy is Lexical, NewestTag, or SemVer. This
+			// field is
+			// optional.
+			ignoreTags?: [...string]
+
+			// IncludePaths is a list of selectors that designate paths in the
+			// repository
+			// that should trigger the production of new Freight when changes
+			// are detected
+			// therein. When specified, only changes in the identified paths
+			// will trigger
+			// Freight production. When not specified, changes in any path
+			// will trigger
+			// Freight production. Selectors may be defined using:
+			// 1. Exact paths to files or directories (ex. "charts/foo")
+			// 2. Glob patterns (prefix the pattern with "glob:"; ex.
+			// "glob:*.yaml")
+			// 3. Regular expressions (prefix the pattern with "regex:" or
+			// "regexp:";
+			// ex. "regexp:^.*\.yaml$")
+			// Paths selected by IncludePaths may be unselected by
+			// ExcludePaths. This
+			// is a useful method for including a broad set of paths and then
+			// excluding a
+			// subset of them.
+			includePaths?: [...string]
+
+			// InsecureSkipTLSVerify specifies whether certificate
+			// verification errors
+			// should be ignored when connecting to the repository. This
+			// should be enabled
+			// only with great caution.
+			insecureSkipTLSVerify?: bool
+
+			// URL is the repository's URL. This is a required field.
+			repoURL: strings.MinRunes(1) & {
+				=~"(?:^(https?)://(?:([\\w-]+):(.+)@)?([\\w-]+(?:\\.[\\w-]+)*)(?::(\\d{1,5}))?(/.*)$)|(?:^([\\w-]+)@([\\w+]+(?:\\.[\\w-]+)*):(/?.*))"
+			}
+
+			// SemverConstraint specifies constraints on what new tagged
+			// commits are
+			// considered in determining the newest commit of interest. The
+			// value in this
+			// field only has any effect when the CommitSelectionStrategy is
+			// SemVer. This
+			// field is optional. When left unspecified, there will be no
+			// constraints,
+			// which means the latest semantically tagged commit will always
+			// be used. Care
+			// should be taken with leaving this field unspecified, as it can
+			// lead to the
+			// unanticipated rollout of breaking changes.
+			semverConstraint?: string
+
+			// StrictSemvers specifies whether only "strict" semver tags
+			// should be
+			// considered. A "strict" semver tag is one containing ALL of
+			// major, minor,
+			// and patch version components. This is enabled by default, but
+			// only has any
+			// effect when the CommitSelectionStrategy is SemVer. This should
+			// be disabled
+			// cautiously, as it creates the potential for any tag containing
+			// numeric
+			// characters only to be mistaken for a semver string containing
+			// the major
+			// version number only.
+			strictSemvers: bool | *true
+		}
+
+		// Image describes a subscription to container image repository.
+		image?: {
+			// AllowTags is a regular expression that can optionally be used
+			// to limit the
+			// image tags that are considered in determining the newest
+			// version of an
+			// image. This field is optional.
+			allowTags?: string
+
+			// DiscoveryLimit is an optional limit on the number of image
+			// references
+			// that can be discovered for this subscription. The limit is
+			// applied after
+			// filtering images based on the AllowTags and IgnoreTags fields.
+			// When left unspecified, the field is implicitly treated as if
+			// its value
+			// were "20". The upper limit for this field is 100.
+			discoveryLimit?: int & <=100 & >=1 | *20
+
+			// GitRepoURL optionally specifies the URL of a Git repository
+			// that contains
+			// the source code for the image repository referenced by the
+			// RepoURL field.
+			// When this is specified, Kargo MAY be able to infer and link to
+			// the exact
+			// revision of that source code that was used to build the image.
+			gitRepoURL?: =~"^https?://(\\w+([\\.-]\\w+)*@)?\\w+([\\.-]\\w+)*(:[\\d]+)?(/.*)?$"
+
+			// IgnoreTags is a list of tags that must be ignored when
+			// determining the
+			// newest version of an image. No regular expressions or glob
+			// patterns are
+			// supported yet. This field is optional.
+			ignoreTags?: [...string]
+
+			// ImageSelectionStrategy specifies the rules for how to identify
+			// the newest version
+			// of the image specified by the RepoURL field. This field is
+			// optional. When
+			// left unspecified, the field is implicitly treated as if its
+			// value were
+			// "SemVer".
+			imageSelectionStrategy?: "Digest" | "Lexical" | "NewestBuild" | "SemVer" | *"SemVer"
+
+			// InsecureSkipTLSVerify specifies whether certificate
+			// verification errors
+			// should be ignored when connecting to the repository. This
+			// should be enabled
+			// only with great caution.
+			insecureSkipTLSVerify?: bool
+
+			// Platform is a string of the form <os>/<arch> that limits the
+			// tags that can
+			// be considered when searching for new versions of an image. This
+			// field is
+			// optional. When left unspecified, it is implicitly equivalent to
+			// the
+			// OS/architecture of the Kargo controller. Care should be taken
+			// to set this
+			// value correctly in cases where the image referenced by this
+			// ImageRepositorySubscription will run on a Kubernetes node with
+			// a different
+			// OS/architecture than the Kargo controller. At present this is
+			// uncommon, but
+			// not unheard of.
+			platform?: string
+
+			// RepoURL specifies the URL of the image repository to subscribe
+			// to. The
+			// value in this field MUST NOT include an image tag. This field
+			// is required.
+			repoURL: strings.MinRunes(1) & {
+				=~"^(\\w+([\\.-]\\w+)*(:[\\d]+)?/)?(\\w+([\\.-]\\w+)*)(/\\w+([\\.-]\\w+)*)*$"
+			}
+
+			// SemverConstraint specifies constraints on what new image
+			// versions are
+			// permissible. The value in this field only has any effect when
+			// the
+			// ImageSelectionStrategy is SemVer or left unspecified (which is
+			// implicitly
+			// the same as SemVer). This field is also optional. When left
+			// unspecified,
+			// (and the ImageSelectionStrategy is SemVer or unspecified),
+			// there will be no
+			// constraints, which means the latest semantically tagged version
+			// of an image
+			// will always be used. Care should be taken with leaving this
+			// field
+			// unspecified, as it can lead to the unanticipated rollout of
+			// breaking
+			// changes. Refer to Image Updater documentation for more details.
+			// More info:
+			// https://github.com/masterminds/semver#checking-version-constraints
+			semverConstraint?: string
+
+			// StrictSemvers specifies whether only "strict" semver tags
+			// should be
+			// considered. A "strict" semver tag is one containing ALL of
+			// major, minor,
+			// and patch version components. This is enabled by default, but
+			// only has any
+			// effect when the ImageSelectionStrategy is SemVer. This should
+			// be disabled
+			// cautiously, as it is not uncommon to tag container images with
+			// short Git
+			// commit hashes, which have the potential to contain numeric
+			// characters only
+			// and could be mistaken for a semver string containing the major
+			// version
+			// number only.
+			strictSemvers: bool | *true
+		}
+	}] & [_, ...]
+}