-- NAT-tier resources: SNAT/masquerade, netmap, and 1:1 static NAT. These are the
-- "global-intent, device-resolved" tier — declared centrally, resolved per device
-- via bindings. Stored here so they are terraformable; compiler rendering of the
-- NAT tier into per-device configs is a tracked follow-up.

-- SNAT / masquerade. source is a zone name or CIDR; egress is a zone (resolved to
-- the device's egress interface via its binding). address+probability support
-- load-balanced SNAT.
CREATE TABLE snat (
    id          BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    action      TEXT NOT NULL CHECK (action IN ('masquerade', 'snat')),
    source      TEXT NOT NULL,
    egress      TEXT NOT NULL,
    address     TEXT NOT NULL DEFAULT '',
    probability REAL,
    comment     TEXT NOT NULL DEFAULT ''
);

-- Network-to-network mapping (netmap). Anchored at a device+binding or interface.
CREATE TABLE netmap (
    id      BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    type    TEXT NOT NULL CHECK (type IN ('dnat', 'snat')),
    from_net TEXT NOT NULL,
    to_net   TEXT NOT NULL,
    anchor   TEXT NOT NULL,               -- device:zone or device:interface
    comment  TEXT NOT NULL DEFAULT ''
);

-- One-to-one static NAT, bound to the device that owns the external IP.
CREATE TABLE nat (
    id        BIGINT GENERATED ALWAYS AS IDENTITY PRIMARY KEY,
    device    TEXT NOT NULL REFERENCES devices(name) ON DELETE CASCADE,
    external  TEXT NOT NULL,
    internal  TEXT NOT NULL,
    interface TEXT NOT NULL DEFAULT '',
    comment   TEXT NOT NULL DEFAULT ''
);