let _concerns_lib = import "schemas/lib/concerns.ncl" in

{
  # A declaratively-owned HTTPS (:443, Terminate) listener on the gateway.
  # Owning the listeners here is what stops a gateway apply from clobbering the
  # per-service listeners that consumers used to add by imperative patch.
  HttpsListener = {
    name          | String,
    hostname      | String,
    tls_secret    | String,
    tls_namespace | String,
  },

  PrivateGateway = {
    name       | String,
    namespace  | String,
    gateway_ip | String,
    cidr       | String,
    port       | Number,

    # HTTPS listeners owned by the gateway itself (declarative). Each consumer
    # service contributes one entry instead of patching the live Gateway.
    https_listeners | Array HttpsListener | optional,

    # ServiceConcerns umbrella (ADR-008). Cilium private gateway — infrastructure_glue preset.
    concerns | _concerns_lib.ServiceConcerns | optional,

    ..
  },
}