@takodotid/circuit 0.18.1 → 0.18.3

package/dist/cli/index.js

@@ -1086,7 +1086,6 @@ function normal(command) {
   return result;
 }
 var IDENTITY = {
-  "/interface wireguard peers": ["public-key"],
   "/interface list member": ["list", "interface"],
   "/ip firewall address-list": ["list", "address"],
   "/ipv6 firewall address-list": ["list", "address"],
@@ -2279,6 +2278,7 @@ function bgpConnections(out, ctx) {
       connect: settings.passive ? "no" : undefined,
       "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
       "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+      instance: "default",
       [`input.limit-process-routes-${family}`]: settings.max_prefixes,
       "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
       listen: settings.passive ? "yes" : undefined,

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.1",
+    "version": "0.18.3",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/routeros/TRAPS.md

@@ -7,12 +7,14 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `[find address=X/Y]` unquoted matches nothing, silently. Every selector the plan builds is quoted.
 - `~` in `find` has no anchors. Match exactly.
 - A property of the same group is printed as a bare suffix, `output.filter-chain=X .network=Y`, which only reads back inside that command. The parser expands it before building a `set`.
-- `/routing bgp connection add` without `local.role` is refused, so the render always states one.
+- `/routing bgp connection add` without `local.role` is refused, so the render always states one. On 7.23 one without `instance` is refused too, `missing value(s) of argument(s) instance`, although the export never prints `instance=default`.
 - A connection without `input.filter` accepts everything. A neighbor without a policy is given `REJECT-ALL`.
 - A session edited repeatedly can stick: SYN both ways, no RST, no log. Remove the connection and add it again.
 - A session that never established is missing from `/routing bgp session print`; look at `/routing bgp connection print`.
 - `tcp-md5-key` set from the CLI has been seen discarded without an error, and a mismatch logs nothing. Confirm with `/tool sniffer quick port=179`.
 - Incoming GRE is subject to the input chain. Accept it before testing the tunnel.
+- A WireGuard peer's name is unique on the device, and a new key under the same name is refused as a new peer, `entry with this name already exists`. The plan finds a peer by name, so a new key is a `set`.
+- `monitor-traffic` on a VLAN interface counts only what the CPU handles, and not consistently: during a flood a VLAN showed 14 Mbps leaving while its physical port sent 0.45 Mbps. Measure on the physical port, `/interface ethernet print stats`, which the switch chip counts.
 - Switch-chip rules have no address lists and no connection state. A drop is an empty `new-dst-ports`.
 - A switch-chip rule's `rate` did not limit traffic the CPU routes. On a CCR2216 on 7.23.5, under a 12 Gbps flood, a rule at `2G` and then at `100M` changed nothing that reached the CPU, while a drop with the same match left 3 Mbps. Drop what you can recognise instead of limiting it.
 - The switch chip reads a UDP fragment after the first as port 0. `src-port=0` drops the rest of a fragmented flood whose first fragments another rule dropped by port; without it they reach the CPU, which holds them waiting for a first fragment that never comes.

package/src/adapters/devices/routeros/export.ts

@@ -254,7 +254,6 @@ export function normal(command: Command): Record<string, string> {
 
 /** Properties that tell two `add` entries of a menu apart. `name` where the menu is not listed. */
 const IDENTITY: Record<string, string[]> = {
-    "/interface wireguard peers": ["public-key"],
     "/interface list member": ["list", "interface"],
     "/ip firewall address-list": ["list", "address"],
     "/ipv6 firewall address-list": ["list", "address"],

package/src/adapters/devices/routeros/render.ts

@@ -1141,6 +1141,8 @@ function bgpConnections(out: Output, ctx: Context): void {
                 connect: settings.passive ? "no" : undefined,
                 "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
                 "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+                // The one instance bgpInstance adds. 7.23 refuses a new connection without it.
+                instance: "default",
                 [`input.limit-process-routes-${family}`]: settings.max_prefixes,
                 "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
                 listen: settings.passive ? "yes" : undefined,