let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      # Namespace first — all subsequent resources land here.
      { file = "namespace",      action = 'apply, skip_if_exists = true },

      # Credentials: K8s Secret with SECRET_KEY + DATABASE_URL (SQLite path).
      # Registry pull secret for reg.librecloud.online in the deployment namespace.
      { action = 'create-credentials' },

      # PVC for mutable data: SQLite analytics DB + dynamic public pages.
      # skip_if_exists preserves data on reinstall.
      { file = "pvc",            action = 'apply, skip_if_exists = true },

      # ConfigMap carrying non-secret env vars:
      # LEPTOS_SITE_ADDR, LEPTOS_ENV, LEPTOS_SITE_ROOT, BASE_URL, RUST_LOG.
      { file = "configmap",      action = 'apply },

      { file = "deployment",     action = 'apply },
      { file = "service",        action = 'apply },
      { file = "httproute",      action = 'apply },

      {
        action = 'wait-ready,
        post   = [
          # Lock the data PVC against accidental deletion via the ops controller.
          # No pvc param → the install method derives ${WEBSITE_NAME}-data per site
          # (rustelo_website-lib.sh _method_protect-volume), not a hardcoded name.
          { action = 'protect-volume },
        ],
      },
    ],

    update = [
      { file = "configmap",      action = 'apply },
      { file = "httproute",      action = 'apply },
      { file = "deployment",     action = 'apply },
      {
        file   = "deployment",
        action = 'rollout-restart,
        delay  = 3,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],

    delete = [
      { file = "httproute",      action = 'delete },
      { file = "deployment",     action = 'delete },
      { file = "service",        action = 'delete },
      { file = "configmap",      action = 'delete },
    ],

    restart = [
      {
        file   = "deployment",
        action = 'rollout-restart,
        post   = [
          { action = 'wait-ready },
        ],
      },
    ],
  },
}