let mp = import "schemas/lib/manifest_plan.ncl" in

{
  manifest_plan | mp.ManifestPlan = {
    init = [
      { file = "namespace",              action = 'apply, skip_if_exists = true },
      # cert-manager PKI bootstrap (skipped if mtls.cert_manager.enabled = false — templates render empty)
      { file = "mtls-clusterissuer",     action = 'apply },
      { file = "mtls-ca-certificate",    action = 'apply },
      { file = "mtls-ca-issuer",         action = 'apply, delay = 2 },
      { file = "mtls-server-certificate", action = 'apply, delay = 2 },
      { action = 'create-credentials },
      # cache PVC (renders empty unless cache.enabled) — must exist before the Deployment mounts it
      { file = "pvc",                    action = 'apply, skip_if_exists = true },
      { file = "buildkitd-config",       action = 'apply },
      { file = "deployment",             action = 'apply },
      { file = "service",                action = 'apply },
      { file = "service-vpn",            action = 'apply },
      { action = 'wait-ready },
    ],
    update = [
      { file = "pvc",                    action = 'apply, skip_if_exists = true },
      { file = "mtls-ca-certificate",    action = 'apply },
      { file = "mtls-server-certificate", action = 'apply },
      { file = "buildkitd-config",       action = 'apply },
      { file = "deployment",             action = 'apply },
      { file = "service-vpn",            action = 'apply },
      { file = "deployment",             action = 'rollout-restart, delay = 3, post = [{ action = 'wait-ready }] },
    ],
    delete = [
      { file = "deployment",             action = 'delete },
      { file = "service",                action = 'delete },
      { file = "service-vpn",            action = 'delete },
      { file = "mtls-server-certificate", action = 'delete },
      { file = "mtls-ca-issuer",         action = 'delete },
      { file = "mtls-ca-certificate",    action = 'delete },
      # mtls-clusterissuer is cluster-scoped and may be shared — never delete it from a component teardown.
    ],
    restart = [
      { file = "deployment",             action = 'rollout-restart, post = [{ action = 'wait-ready }] },
    ],
  },
}