Add typed high-level ruleset and set API

tests/LibNftables.Tests/NftablesClientUnitTests.cs

@@ -64,6 +64,55 @@ public sealed class NftablesClientUnitTests
         Assert.Equal("ok", result.Output);
     }
 
+    [Fact]
+    public void ValidateRuleset_RendersTypedRulesetAndUsesDryRun()
+    {
+        var context = new FakeContext
+        {
+            OutputBuffer = "ok",
+            ErrorBuffer = string.Empty,
+        };
+        var client = CreateClient(() => context);
+
+        NftValidationResult result = client.ValidateRuleset(CreateTypedRuleset());
+
+        Assert.True(result.IsValid);
+        Assert.True(context.DryRun);
+        Assert.Equal(
+            "add table inet filter" + Environment.NewLine +
+            "add set inet filter blocked_ipv4 { type ipv4_addr; elements = { 10.0.0.1, 10.0.0.2 }; }" + Environment.NewLine,
+            context.LastCommandText);
+    }
+
+    [Fact]
+    public void ApplyRuleset_RendersTypedRulesetAndExecutesCommand()
+    {
+        var context = new FakeContext();
+        var client = CreateClient(() => context);
+
+        client.ApplyRuleset(CreateTypedRuleset());
+
+        Assert.False(context.DryRun);
+        Assert.Equal(
+            "add table inet filter" + Environment.NewLine +
+            "add set inet filter blocked_ipv4 { type ipv4_addr; elements = { 10.0.0.1, 10.0.0.2 }; }" + Environment.NewLine,
+            context.LastCommandText);
+    }
+
+    [Fact]
+    public async Task ApplyRulesetAsync_UsesTypedRulesetText()
+    {
+        var context = new FakeContext();
+        var client = CreateClient(() => context);
+
+        await client.ApplyRulesetAsync(CreateTypedRuleset());
+
+        Assert.Equal(
+            "add table inet filter" + Environment.NewLine +
+            "add set inet filter blocked_ipv4 { type ipv4_addr; elements = { 10.0.0.1, 10.0.0.2 }; }" + Environment.NewLine,
+            context.LastCommandText);
+    }
+
     [Fact]
     public void Apply_WithFileRequest_UsesFileExecutionPath()
     {
@@ -191,6 +240,26 @@ public sealed class NftablesClientUnitTests
         NftablesClientOptions? options = null)
         => new(options, contextFactory ?? (() => new FakeContext()), skipRuntimeGuard: true);
 
+    private static NftRuleset CreateTypedRuleset()
+    {
+        var ruleset = new NftRuleset();
+        var table = new NftTable
+        {
+            Family = NftFamily.Inet,
+            Name = "filter",
+        };
+        var set = new NftSet
+        {
+            Name = "blocked_ipv4",
+            Type = NftSetType.Ipv4Address,
+        };
+        set.Elements.Add("10.0.0.1");
+        set.Elements.Add("10.0.0.2");
+        table.Sets.Add(set);
+        ruleset.Tables.Add(table);
+        return ruleset;
+    }
+
     private sealed class FakeContext : INftContextHandle
     {
         public bool DryRun { get; set; }