let transport_kind_def = std.contract.custom (fun _label => fun value =>
  let valid = ["nats", "http", "nats+http"] in
  if std.array.any (fun x => x == value) valid then 'Ok value
  else 'Error {
    message = "Invalid transport '%{value}'.\nValid values: nats | http | nats+http"
  }
) in

let auth_kind_def = std.contract.custom (fun _label => fun value =>
  let valid = ["nkey", "jwt", "mtls", "none"] in
  if std.array.any (fun x => x == value) valid then 'Ok value
  else 'Error {
    message = "Invalid auth kind '%{value}'.\nValid values: nkey | jwt | mtls | none"
  }
) in

let auth_ref_def = {
  kind | auth_kind_def,
  creds_ref | String | optional,
  account | String | optional,
} in

let fleet_endpoint_def = {
  fleet_ref | String,
  host_workspace | String,
  transport | transport_kind_def | default = "nats",
  nats_url | String | optional,
  http_url | String | optional,
  subject_prefix | String | default = "fleet",
  auth | auth_ref_def,
} in

let network_reservation_def = {
  fleet_ref | String,
  reserved_cidr | String,
  network_ref | String | optional,
  notes | String | optional,
} in

let consumer_claims_def = {
  consumer_workspace | String,
  can_claim_from | Array fleet_endpoint_def,
  network_reservations | Array network_reservation_def | default = [],
} in

{
  TransportKind       | not_exported = transport_kind_def,
  AuthKind            | not_exported = auth_kind_def,
  AuthRef             | not_exported = auth_ref_def,
  FleetEndpoint       | not_exported = fleet_endpoint_def,
  NetworkReservation  | not_exported = network_reservation_def,
  ConsumerClaims      | not_exported = consumer_claims_def,

  version = {
    schema_id      = "provisioning/infra_agreement",
    schema_version = "0.1.0",
  },
}