let _concerns_lib = import "schemas/lib/concerns.ncl" in
let _context_lib  = import "schemas/catalog/context.ncl" in

{
  Zot = {
    # Ontological context — what/how/why + governance.
    # Declared per infra deployment in infra/<workspace>/components/zot.ncl.
    context | _context_lib.ComponentContext | optional,
    name          | String,
    version       | String,
    image         | String | default = "ghcr.io/project-zot/zot-linux-arm64:v2.1.18",
    namespace     | String | default = "data",
    port          | Number | default = 5000,
    data_dir      | String | default = "/var/lib/data/zot",
    storage_class | String | optional,
    mode          | [| 'taskserv, 'cluster, 'container |] | default = 'cluster,

    storage_backend | {
      kind       | String | default = "local",
      bucket     | String | optional,
      region     | String | optional,
      endpoint   | String | optional,
      path_style | Bool   | optional,
      cache_dir  | String | optional,
    } | optional,

    multi_tenant | {
      enabled        | Bool,
      namespaces     | Array String | default = [],
      policies       | { _ : { read : Array String, write : Array String, anonymous_read : Bool } } | optional,
      default_policy | String | default = "unauthenticated_read",
    } | optional,

    tls_secret     | String | optional,
    tls_namespace  | String | optional,
    cluster_issuer | String | optional,
    gateway_scope  | [| 'public, 'private, 'internal |] | optional,
    gateway_namespace | String | optional,
    gateway_public_name      | String | optional,
    gateway_public_namespace | String | optional,

    requires | {
      storage | { size | String, persistent | Bool } | optional,
      ports   | Array {
        port     | Number,
        protocol | String | default = "TCP",
        exposure | [| 'public, 'private, 'internal |] | default = 'internal,
      } | default = [],
      credentials | Array String | default = [],
    } | default = {},

    provides | {
      service   | String | optional,
      port      | Number | optional,
      databases | Array String | default = [],
      endpoints | Array String | default = [],
    } | default = {},

    operations | {
      install   | Bool | default = true,
      update    | Bool | default = false,
      reinstall | Bool | default = false,
      delete    | Bool | default = false,
      backup    | Bool | default = false,
      restore   | Bool | default = false,
      health    | Bool | default = false,
      config    | Bool | default = false,
      scripts   | Bool | default = false,
      restart   | Bool | default = false,
    } | default = {},

    # ServiceConcerns umbrella (ADR-008). Defaults populated via the
    # tls_endpoint_with_acme preset in defaults.ncl.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}