let build_spec = import "schemas/lib/build_spec.ncl" in
let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  LianNode = {
    name    | String,
    version | String,
    mode    | [| 'persistent_vm |],

    # Logical fleet identity — what id does this node carry inside its fleet declaration.
    logical_id | String,

    # Physical Hetzner identity — what hostname did we provision in hcloud.
    target_server | String,

    # Network position — pinned private IP in the workspace's private network.
    private_ip | String,

    # Buildkit version pinned for reproducibility. Bumped per major release after smoke test.
    buildkit_version | String | default = "v0.29.0",
    sccache_version  | String | default = "v0.9.1",
    nushell_version  | String | default = "0.112.2",
    just_version     | String | default = "1.51.0",
    oras_version     | String | default = "1.3.2",

    # TLS — REQUIRED. Buildkit must be served with TLS. Certs are delivered by
    # fleet-agent's install_tls command (cert-manager source, per adr-009).
    # Material lands at /etc/buildkit/tls/{ca.crt,server.crt,server.key}.
    tls | {
      domain           | String,
      cert_path        | String,
      ca_path          | String,
      key_path         | String,
      tcp_listen_port  | Number | default = 1234,
      reload_hook      | String | default = "systemctl reload-or-restart buildkitd",
    },

    default_size | {
      cpu       | build_spec.BoundedCpu,
      memory_gb | build_spec.PositiveNumber,
      disk_gb   | build_spec.PositiveNumber,
    },

    # Persistent storage IS allowed here — that is the whole point. Disk survives across
    # builds; sccache hot cache + buildkit OCI layers stay warm. Cleaning policy is per-fleet.
    storage | {
      persistent | Bool | default = true,
      sccache_disk_path | String | default = "/var/cache/sccache",
      buildkit_root     | String | default = "/var/lib/buildkit",
    },

    hcloud | {
      server_type | String,
      location    | String | default = "fsn1",
      firewall    | String | optional,
    },

    ssh | {
      # Public key authorized for buildkit clients (operator workstation + remote services).
      # Refers to a sops path resolvable at deploy time.
      authorized_keys_secret | String,
    },

    # Sccache backend — when configured the install script sets /etc/sccache.env globally.
    # Absent = sccache binary present but no global backend (per-build env still works).
    sccache_backend | {
      kind     | [| 's3, 'redis, 'local |],
      endpoint | String | optional,
      bucket   | String | optional,
      region   | String | optional,
      creds_ref | String | optional,
    } | optional,

    # Optional registry refs so cargo-chef/buildkit can authenticate at build time.
    registries | Array {
      name        | String,
      endpoint    | String,
      creds_ref   | String | optional,
    } | default = [],

    # Swap policy for build workload nodes. Standalone buildkit on a small
    # instance (cax11: 4GB RAM) benefits from swap as an overflow buffer
    # during linker peaks (mold/lld peaks easily hit 2–3 GB transient on
    # release builds). Cluster-worker mode disables swap (kubelet historically
    # requires it off; modern feature gate is opt-in).
    #
    # modes:
    #   'file       — fallocate /swapfile, mkswap, swapon, persist via fstab
    #   'disabled   — swapoff -a, remove fstab entries (cluster-worker prep)
    #   'preserve   — no-op (leave whatever state the node has)
    swap | {
      mode               | [| 'file, 'disabled, 'preserve |] | default = 'preserve,
      size_gb            | Number | default = 8,
      path               | String | default = "/swapfile",
      swappiness         | Number | default = 10,
      vfs_cache_pressure | Number | default = 50,
    } | default = {},

    requires | {
      credentials  | Array String | default = [],
      capabilities | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      interface | String | optional,
    } | default = {},

    operations | {
      install | Bool | default = true,
      update  | Bool | default = true,
      delete  | Bool | default = false,
      health  | Bool | default = true,
    } | default = {},

    # ServiceConcerns umbrella (ADR-008). Persistent node — disk + cache survive,
    # so backups become relevant (unlike buildkit_runner which is ephemeral).
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}