dataplane

type Backend interface {
	Participant
	// EnsureWG converges the WireGuard device to cfg and returns the changes it made, one line
	// each, for the log.
	EnsureWG(cfg WGConfig) ([]string, error)
	// WGStatus returns the device and its peers (endpoint, last handshake, counters).
	WGStatus() (*wgtypes.Device, error)
	// Converge closes established flows the committed Plan no longer admits and returns how many
	// it closed (design.md 6.1, 6.3, 7a.3 節). It runs after the Runtime's Commit.
	Converge(p planner.Plan) (int, error)
	// ReadDrops reads the drop counters of the current dataplane. The kernel backend only reads:
	// its counters are reset by the next successful table replacement, so if that replacement
	// fails, the next ReadDrops returns the same counts again. The userspace backend drains its
	// counters on read. Phase 4 ties reading the counters to the commit.
	ReadDrops() ([]Drop, error)
	// Dial connects to addr (an agent's wg address and port) through the tunnel.
	Dial(network, addr string) (net.Conn, error)
}

type Desired struct {
	Plan planner.Plan
	// RelayListening is the set of Relay ports the frontend will be listening on once it commits:
	// the listeners it keeps plus the ones its Prepare newly opened. Ports being removed and ports
	// that failed to bind are not in it (design.md 6.1, 7a.4 節: ingress rows only for ports wgft
	// actually listens on). nil when the Runtime has no frontend.
	RelayListening map[uint16]bool
}

type Drop struct {
	RuleID  string
	Kind    string // deny | allow | per_source | src_flow | new_flow | packet
	Packets uint64
	Bytes   uint64
}

type Participant interface {
	// Prepare stages d without publishing it. The contract of design.md 7a.2 節 is that everything
	// that can fail belongs here; the kernel backend meets it, the userspace backend does not yet
	// (see Prepared.Commit). An error means nothing was staged and the caller rolls back the
	// frontend.
	Prepare(d Desired) (Prepared, error)
}

type Peer struct {
	PublicKey wgtypes.Key
	Address   netip.Addr
}

type Prepared interface {
	// Commit publishes the staged change. Success is the point of no return (design.md 7a.2 節).
	// The kernel backend publishes as one atomic step (one nftables transaction): on error nothing
	// of it is published and the previous state keeps forwarding, so the Runtime can still roll
	// back. The userspace backend does not give that guarantee yet: to keep the behaviour from
	// before the Backend existed, its Commit binds and starts serving each listener, and a port
	// that fails to bind is logged and retried rather than failing the Commit, so the change can
	// be applied partly without an error. Phase 4 (design.md 7a.3, 7a.8 節) moves binding into
	// Prepare so every backend meets the atomic contract.
	Commit() error
	// Rollback releases what Prepare staged. It is called when Commit was not reached or failed,
	// never after a successful Commit, and cannot fail.
	Rollback()
}

type WGConfig struct {
	PrivateKey wgtypes.Key
	ListenPort int
	Address    netip.Prefix // the server's address and the wg network, e.g. 10.200.0.1/24
	MTU        int
	Peers      []Peer
}