network

type NFTInputRule struct {
	// Interface, when set, scopes the rule to traffic arriving on that inbound
	// interface (rendered as `iifname "<name>"`). It is how a trusted overlay
	// zone (wireguard, tailscale) is accepted without widening the public
	// surface. Empty means "any inbound interface".
	Interface   string
	SourceCIDRs []string
	Protocol    string
	Ports       []int
	Action      string
	Comment     string
}

type NFTPlan struct {
	InterfaceName string `json:"interface_name"`
	WireGuardCIDR string `json:"wireguard_cidr"`
	PublicTCP     []int  `json:"public_tcp"`
	PublicUDP     []int  `json:"public_udp"`
	WireGuardTCP  []int  `json:"wireguard_tcp"`
	WireGuardUDP  []int  `json:"wireguard_udp"`

	// InputRules are server-composed policy rules folded into the single
	// lattice_guard input chain. They are intentionally not part of the public
	// JSON API for raw Network Guard inputs; callers must pass structured,
	// validated intent through server-owned compilers.
	InputRules []NFTInputRule `json:"-"`
}