gateway

type Applier interface {
	ApplyConfig(*config.Config) error
}

type Config struct {
	// Namespaces, when non-empty, restricts which namespaces' Gateways/HTTPRoutes are
	// served (informers still watch cluster-wide; reconcile filters). Empty ⇒ all.
	Namespaces []string
	// ResyncDebounce is the quiet window after the last watched change before a reconcile
	// (default 250ms).
	ResyncDebounce time.Duration
	// Kubeconfig is the explicit kubeconfig path for the resolver client (out-of-cluster).
	Kubeconfig string
	// LeaderElection enables the leader-elected status writer. When false the writer runs
	// unconditionally (single-replica / tests). Mirrors the Ingress controller; serving is
	// never gated by leadership.
	LeaderElection  bool
	LeaderNamespace string
	LeaderName      string
	// Identity uniquely names this replica for leader election (e.g. the pod name).
	Identity string
}

type Controller struct {
	// contains filtered or unexported fields
}

type Inputs struct {
	Classes  []*gatewayv1.GatewayClass
	Gateways []*gatewayv1.Gateway
	Routes   []*gatewayv1.HTTPRoute
	Grants   []*gatewayv1.ReferenceGrant
	// contains filtered or unexported fields
}

type Reject struct {
	Kind   string // "GatewayClass" | "Gateway" | "HTTPRoute"
	Object string // "ns/name" (or "name" for the cluster-scoped GatewayClass)
	Reason string
}

type Result struct {
	Sites          []ingress.RenderedSite
	Rejects        []Reject
	AttachedRoutes map[string]int
	// AttachedRoutesByListener maps "gwKey\x00listenerName" → the number of routes attached
	// to THAT listener (honoring the listener's hostname / a route's sectionName scoping),
	// used for the per-listener status.attachedRoutes (GW2). The per-Gateway AttachedRoutes
	// total is NOT a correct per-listener count when listeners are hostname-scoped.
	AttachedRoutesByListener map[string]int
	AcceptedRoutes           map[string]bool
	ResolvedRoutes           map[string]bool
	// RefNotPermittedRoutes is the subset of routes whose ResolvedRefs failure was a
	// cross-namespace ref refused for lack of a ReferenceGrant (status reason
	// RefNotPermitted vs the generic BackendNotFound).
	RefNotPermittedRoutes map[string]bool
	// HostOwnedRoutes is the subset of routes rejected because (some of) their hosts'
	// ROUTING is owned by another namespace (Fix #3 cross-ns hijack guard). The status
	// writer reports Accepted=False with reason NotAllowedByListeners for a route that
	// retained no host. (A route that kept at least one host stays Accepted; this set is
	// still recorded for the per-host Event.)
	HostOwnedRoutes map[string]bool
	// ProgrammedGateways is the set of Gateway "ns/name" with at least one programmed
	// listener (an HTTP listener, or an HTTPS listener whose cert was registered).
	ProgrammedGateways map[string]bool
	// ProgrammedListeners maps "gwKey\x00listenerName" → true for each listener that is
	// Programmed (HTTP always; HTTPS only when its BYO cert was registered).
	ProgrammedListeners map[string]bool
	// ListenerRejects maps "gwKey\x00listenerName" → a reason when a listener was NOT
	// programmed (e.g. an HTTPS listener with a missing/mismatched cert), for per-listener
	// status conditions.
	ListenerRejects map[string]string
	// SecretRefs are the BYO TLS Secrets to load (deduped by ns/name, hosts unioned), for
	// the controller's Server.SetDynamicCerts injection — the SAME path Ingress uses.
	SecretRefs []SecretRef
	// TLSHosts is the set of hostnames cadish terminates TLS for (HTTPS listener hosts with
	// a registered cert), so the controller can drive the redirect/Programmed posture.
	TLSHosts []string
}

type SecretRef = ingress.SecretRef

type Stats struct {
	WatchedRoutes   int
	LastAppliedHash string
	Rejects         int
	LastError       string
	IsLeader        bool
}

type TLSInjector interface {
	SetDynamicCerts([]tlsacme.DynamicCert) error
}

type Warmer interface {
	MarkWarm()
}