{
  nats | default = {
    name         | default = "nats",
    version      | default = "2.10",
    port         | default = 4222,
    monitor_port | default = 8222,
    mode         | default = 'cluster,
    data_dir     | default = "/data",
    image        | default = "nats:2.10-alpine",

    jetstream | default = {
      max_mem  = "256MB",
      max_file = "1GB",
    },

    nkey | default = {
      enabled         = false,
      allow_publish   = [],
      allow_subscribe = ["_INBOX.>"],
    },

    # Empty by default — only deployments that opt in get multi-user nkey auth.
    nkey_users | default = [],

    requires | default = {
      storage     = { size = "1Gi", persistent = true },
      ports       = [
        { port = 4222, exposure = 'private },
        { port = 8222, exposure = 'internal },
      ],
      credentials = ["NATS_USER", "NATS_PASS"],
    },

    provides | default = {
      service  = "nats",
      port     = 4222,
      protocol = "nats",
    },

    operations | default = {
      install = true,
      update  = true,
      delete  = true,
      backup  = true,
      restore = false,
      health  = true,
      restart = true,
    },

    live_check | default = {
      strategy = 'k8s_pods,
      scope    = 'cp_only,
    },

    # ServiceConcerns default — NATS/JetStream message bus; backup pending
    # until workspace declares BackupPolicy with stream/consumer state capture.
    concerns | default = {
      tls    = { kind = 'disabled, reason = "internal cluster service, mTLS handled by NKey signing per platform-nats" },
      dns    = { kind = 'disabled, reason = "internal cluster service, no public DNS records" },
      certs  = { kind = 'disabled, reason = "no ACME issuer required" },
      backup = {
        kind        = 'pending,
        reason      = "BackupPolicy with JetStream state capture declared at workspace level",
        backlog_ref = "BACKUP-NATS-001",
      },
      observability = { kind = 'pending, reason = "ObservabilityImpl iteration deferred", backlog_ref = "OBS-001" },
      security      = { kind = 'pending, reason = "SecurityImpl iteration deferred", backlog_ref = "SEC-001" },
    },
  },
}