let build_spec = import "schemas/lib/build_spec.ncl" in
let _concerns_lib = import "schemas/lib/concerns.ncl" in

let NoPersistentStorage =
  std.contract.custom (
    fun _label =>
      fun value =>
        if value == false then
          'Ok value
        else
          'Error {
            message = "storage.persistent MUST be false — ADR-039 constraint buildkit-runner-no-persistent-storage: all state is ephemeral"
          }
  )
in

{
  BuildkitRunner = {
    name    | String,
    version | String,
    mode    | [| 'ephemeral_vm |],

    golden_image_name         | String | default = "buildkit-runner-golden",
    golden_image_rebuild_cron | String | default = "0 3 * * 0",

    default_size | {
      cpu       | build_spec.BoundedCpu,
      memory_gb | build_spec.PositiveNumber,
      disk_gb   | build_spec.PositiveNumber,
    },

    storage | {
      persistent | NoPersistentStorage,
    },

    hcloud | {
      server_type_pool | Array String,
      location         | String | default = "fsn1",
    },

    ssh | {
      orchestrator_pubkey_secret | String,
    },

    lease | {
      max_duration_min | Number,
    },

    requires | {
      credentials  | Array String | default = [],
      capabilities | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      interface | String | optional,
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = false,
      delete  | Bool | default = false,
      health  | Bool | default = false,
    } | default = {},

    # ServiceConcerns umbrella (ADR-008). Build runner — ephemeral by design
    # (ADR-039); SystemBackupDef.builder_env captures any external state.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}