{
  LianBuild = {
    workspace       | String,
    image           | String,
    context_src      | String,
    context_src_dirs | Array String,
    ctx_type         | [| 'leptos, 'plain, 'siblings |],
    dockerfile       | String,
    ssh_key            | String,
    secrets_base       | String,
    lian_build_root    | String,
    runner_ssh_key_ref | String,
    runner_script      | String,
    runner_image_ref   | String,

    registry | {
      endpoint        | String,
      credential_path | String,
    },

    sccache | {
      bucket          | String,
      endpoint        | String,
      credential_path | String,
    },

    # Optional: declare lian-build's identity at the BuildKit Lite (in-cluster, mTLS)
    # buildkitd. When enabled, a Certificate CR is applied to ca_issuer_namespace
    # referencing the namespace-scoped CA Issuer owned by buildkit_lite. cert-manager
    # rotates the leaf cert automatically. The resulting Secret (in ca_issuer_namespace)
    # holds ca.crt/tls.crt/tls.key which lian-build mounts/reads when adapter.kind = 'k8s_local
    # and the buildkitd Service has mtls.enabled = true.
    buildkit_client | {
      enabled              | Bool | doc "Apply a Certificate CR for lian-build identity at the buildkit CA Issuer." | default = false,
      client_name          | String | doc "Subject CN and Secret suffix; uniquely identifies this lian-build instance." | default = "lian-build",
      ca_issuer_namespace  | String | doc "Namespace where the buildkit CA Issuer lives (where the Cert CR must be applied)." | default = "build-system",
      ca_issuer_name       | String | doc "Name of the namespace-scoped CA Issuer." | default = "buildkit-ca-issuer",
      duration             | String | doc "Leaf cert validity." | default = "2160h",
      renew_before         | String | doc "Renewal lead time." | default = "360h",
      export_to_workstation | Bool | doc "After applying, dump ca.crt/tls.crt/tls.key to local workstation_export_dir for buildctl use." | default = false,
      workstation_export_dir | String | doc "Local path on the operator workstation where the dumped client material lands." | default = "~/.lian-build/buildkit-client",
    } | default = {},

    ..
  },
}