# registry-access domain contract v0.1.0
#
# OCI registry endpoint and per-namespace access policy.
# Credentials (username, password, token) arrive via secret-delivery.

let _AccessMode = [| 'read_only, 'read_write, 'append_only |] in

let _NamespaceAccess = {
  name   | String
         | doc "Registry namespace path (e.g. 'images', 'cache', 'crates')",
  access | _AccessMode,
} in

let _RegistryAccessContext = {
  schema_version | String | default = "0.1.0",
  workspace      | String,
  mode_id        | String,
  endpoint       | String
                 | doc "Base HTTPS URL of the OCI registry (e.g. 'https://reg.librecloud.online')",
  namespaces     | Array _NamespaceAccess | optional
                 | doc "Per-namespace access policy; absent means no namespace restrictions",
  insecure       | Bool
                 | doc "Allow plain HTTP (only for local/test registries)"
                 | default = false,
} in

{
  AccessMode           = _AccessMode,
  NamespaceAccess      = _NamespaceAccess,
  RegistryAccessContext = _RegistryAccessContext,
}