let validation = import "schemas/lib/validation.ncl" in
let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  Odoo = {
    name             | String,
    version          | String,
    image            | String,
    tenant           | String,
    namespace        | String,
    db_name          | String,
    db_host          | String | default = "postgresql.core-data.svc.cluster.local",
    db_port          | Number | default = 5432,
    db_user          | String | default = "odoo",
    db_filter        | String | default = "",
    domain           | String,
    dns_zone         | String | default = "",
    cf_secret_name   | String | default = "",
    acme_email       | String | default = "",
    gateway_fip      | validation.IpRef | default = "",
    gateway_ip       | validation.IpRef | default = "",
    storage_class    | String | default = "longhorn-retain",
    cluster_issuer   | String | default = "letsencrypt-prod",
    gateway_name     | String | default = "libre-wuji",
    gateway_ns       | String | default = "kube-system",
    workers          | Number | default = 0,
    max_cron_threads | Number | default = 1,
    mode             | [| 'cluster |] | default = 'cluster,
    pod_selector     | String | default = "odoo",
    # Filestore PVC name. New tenants get "odoo-filestore"; tenants whose durable
    # volume was provisioned under the legacy size-suffixed convention override
    # this (e.g. "odoo-filestore-2g"). PVC names are immutable — overriding tracks
    # the live volume without a destructive recreate.
    filestore_pvc    | String | default = "odoo-filestore",
    # Optional egress allowance for an in-cluster SMTP server reached via a
    # Cilium LB VIP. The default policy only permits world:443/80, so SMTP to a
    # cluster service (a LB-VIP endpoint, not `world`) is denied. Set this to the
    # mail backend pods + submission ports. Omit for external/relay SMTP (use the
    # world egress with the relevant ports instead).
    mail_egress      | { namespace | String, pod_name | String, ports | Array Number } | optional,
    oca_addons       | Array String | default = [],
    # Git ref applied to every OCA repo lacking an explicit entry in
    # oca_addons_refs. Branch (rolling), tag, or commit SHA. Tracking a branch
    # ("18.0") follows HEAD; the schema-sync init container reconciles the DB
    # whenever the resolved SHAs change. Pin to a tag/commit for reproducible
    # restarts (updates.policy = 'pinned).
    oca_addons_default_ref | String | default = "18.0",
    # Per-repo ref override: { "l10n-spain" = "<commit-sha>", ... }. Repos absent
    # here use oca_addons_default_ref.
    oca_addons_refs  | { _ : String } | default = {},
    python_packages  | Array String | default = [],

    requires | {
      storage | { size | String, persistent | Bool } | optional,
      ports   | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install   | Bool | default = true,
      update    | Bool | default = false,
      delete    | Bool | default = false,
      backup    | Bool | default = false,
      restore   | Bool | default = false,
      health    | Bool | default = false,
      restart   | Bool | default = false,
    } | default = {},

    # ServiceConcerns umbrella (ADR-008). Odoo ERP — backup typically enabled
    # at workspace level via odoo-stack BackupGroup with database scope +
    # filestore service_full scope.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}