let Schema = import "schemas/providers/backup.ncl" in

{
  provider | Schema.BackupProvider | Schema.EncryptionRequired = {
    name   = "restic",
    binary = "restic",

    features = {
      tags        = true,
      ui          = false,
      verify      = true,
      mount       = true,
      encryption  = true,
      compression = true,
      dedup       = 'per_repo,
      streaming   = true,
    },

    mount_capable     = true,
    streaming_capable = true,

    env = {
      required = ["RESTIC_REPOSITORY"],
      optional = ["RESTIC_PASSWORD_FILE", "RESTIC_PASSWORD"],
    },

    connection = { required = false },

    commands = {
      backup = {
        subcmd            = "backup",
        repo_flag         = "-r",
        tag_flag          = "--tag",
        snapshot_id_regex = "snapshot (?P<id>[a-f0-9]+) saved",
      },
      restore = {
        subcmd      = "restore",
        repo_flag   = "-r",
        target_flag = "--target",
      },
      list = {
        subcmd    = "snapshots",
        repo_flag = "-r",
        tag_flag  = "--tag",
      },
      # restic forget: tag-scoped + inline retention flags + --prune in one call.
      forget = {
        subcmd             = "forget",
        repo_flag          = "-r",
        tag_flag           = "--tag",
        keep_last_flag     = "--keep-last",
        keep_monthly_flag  = "--keep-monthly",
        keep_yearly_flag   = "--keep-yearly",
        extra_flags        = ["--prune", "--quiet"],
      },
      verify = {
        subcmd    = "check",
        repo_flag = "-r",
      },
    },
  },
}