@takodotid/circuit 0.18.5 → 0.20.0

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   isCidr,
   isGlobal,
   network
-} from "./chunks/index-ex1wcst7.js";
+} from "./chunks/index-xm9nma2t.js";
 import"./chunks/index-fq57hya4.js";
 
 // src/core/define.ts

package/dist/presets/index.js

@@ -1,6 +1,6 @@
 import {
   contains
-} from "../chunks/index-ex1wcst7.js";
+} from "../chunks/index-xm9nma2t.js";
 import"../chunks/index-fq57hya4.js";
 
 // src/presets/index.ts

package/dist/types/adapters/devices/derive.d.ts

@@ -3,3 +3,5 @@ import type { Device } from "../../schema";
 export declare function lagIds(device: Device): Map<string, number>;
 /** The IPv4 networks of a port's or an interface's addresses. */
 export declare function ipv4Networks(device: Device, iface: string): string[];
+/** Fields neither switch platform, VRP nor Raisecom ROS, expresses: a service's own sources or port, a user's description or keys, the IP stack's host settings, a point-to-point address, and offload per interface. */
+export declare function switchUnsupported(device: Device): string[];

package/dist/types/core/across.d.ts

@@ -0,0 +1,4 @@
+import type { Device } from "../schema";
+import type { Finding } from "./define";
+/** Every rule across devices. */
+export declare function checkAcross(devices: readonly Device[]): Finding[];

package/dist/types/core/addr.d.ts

@@ -14,6 +14,16 @@ export declare function isCidr(text: string): boolean;
 export declare function network(cidr: string): string;
 /** Is the address or prefix `inner` inside `outer`? */
 export declare function contains(outer: string, inner: string): boolean;
+/** A number back to the address it stands for. */
+export declare const formatAddress: (value: bigint, family: Family) => string;
+/** The first and last address of a prefix, as numbers. */
+export declare function rangeOf(cidr: string): {
+    first: bigint;
+    last: bigint;
+    family: Family;
+};
+/** The fewest prefixes that cover every address from `first` to `last` and nothing else. */
+export declare function prefixesBetween(first: bigint, last: bigint, family: Family): string[];
 /** `/25` to `255.255.255.128`. */
 export declare const netmask: (length: number) => string;
 /** `/24` to `0.0.0.255`, the inverted mask some ACLs take. */

package/dist/types/core/addresses.d.ts

@@ -0,0 +1,46 @@
+import type { Device } from "../schema";
+/** One address or range in a segment, and what holds it. */
+export type Use = {
+    /** An address, or `first-last` for a range. */
+    address: string;
+    what: string;
+};
+/** A prefix our devices have addresses in. */
+export type Segment = {
+    prefix: string;
+    uses: Use[];
+    /** How many addresses no one uses, as a number written out, since an IPv6 count does not fit a JavaScript number. */
+    free: string;
+    /** The lowest free address, when there is one. */
+    next?: string;
+};
+/** A prefix in use without being a segment: a loopback's address, or a block routed elsewhere. */
+export type Block = {
+    prefix: string;
+    what: string;
+};
+/** Space the network owns: a prefix it originates in BGP, or one asked for. Everything in use inside it, and what is free. */
+export type Space = {
+    prefix: string;
+    /** Why it is listed, such as `originated by edge-01`. */
+    owner: string;
+    segments: Segment[];
+    blocks: Block[];
+    /** The fewest prefixes that cover what nothing uses. */
+    free: string[];
+};
+export type AddressReport = {
+    spaces: Space[];
+    /** What is in use outside every space. Left out when a prefix is asked for. */
+    elsewhere: {
+        segments: Segment[];
+        blocks: Block[];
+    };
+};
+/** Every address in use, by segment, under the space the network owns. With `within`, only what falls inside that prefix, as the one space. */
+export declare function addressesOf(devices: readonly Device[], within?: string): AddressReport;
+/** Free prefixes of one length inside the free space, up to `limit`, and how many there are in all. */
+export declare function freeOfLength(free: readonly string[], length: number, limit: number): {
+    prefixes: string[];
+    total: bigint;
+};

package/dist/types/core/files.d.ts

@@ -0,0 +1,6 @@
+/** Every TypeScript file of the project, relative to its root, in name order. */
+export declare function projectSources(root: string, directory?: string): string[];
+/** Whether a file's text declares the device: it calls defineDevice and gives it the name, written out whole. */
+export declare function declaresDevice(text: string, name: string): boolean;
+/** The project files that declare the device, relative to the root. */
+export declare function deviceFiles(root: string, name: string, sources?: string[]): string[];

package/dist/types/core/graph.d.ts

@@ -0,0 +1,74 @@
+import type { Device, Routed } from "../schema";
+import type { Finding } from "./define";
+/** One view of the network. Every edge belongs to one. */
+export type Layer = "l1" | "l2" | "l3" | "bgp" | "ospf" | "tunnels";
+export declare const LAYERS: readonly Layer[];
+/** One of our devices, a segment several of them share, or something outside the network. */
+export type GraphNode = {
+    /** Unique among the nodes, such as `device:edge-01` or `as:64501`. */
+    id: string;
+    kind: "device" | "segment" | "outside";
+    /** A word or two, drawn on the node. */
+    label: string;
+    /** One fact per line, for a closer look. */
+    detail: string[];
+};
+/** A VLAN a cable carries. */
+export type CarriedVlan = {
+    name: string;
+    id: number;
+    /** Carried without a tag: the access VLAN, or a trunk's native VLAN. */
+    untagged: boolean;
+};
+export type GraphEdge = {
+    layer: Layer;
+    /** Node ids. */
+    from: string;
+    to: string;
+    /** A few words, drawn on the edge. */
+    label: string;
+    /** One fact per line, for a closer look. */
+    detail: string[];
+    /** Only one end declares it: the far device does not declare the cable, session or tunnel back. */
+    oneSided?: true;
+    /** On `l2`, the VLANs the cable carries. */
+    vlans?: CarriedVlan[];
+};
+export type Graph = {
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+};
+/** How a device compares with its last snapshot, found offline as `diff` finds it. */
+export type Drift = {
+    status: "matches" | "differs" | "no snapshot" | "cannot plan";
+    /** The plan `diff` would show, when it differs. */
+    lines: string[];
+};
+/** The graph with what `validate` found and how each device drawn compares with its snapshot. */
+export type Annotated = Graph & {
+    findings: Finding[];
+    /** By device name. */
+    drift: Record<string, Drift>;
+};
+/** An address one of the devices holds on a port or interface. */
+export type Holder = {
+    device: Device;
+    /** The port or interface. */
+    name: string;
+    /** With its length. */
+    address: string;
+    /** The far end of a point-to-point address. */
+    peer?: string;
+    vrrp: NonNullable<Routed<string>["vrrp"]>;
+};
+export declare const deviceId: (name: string) => string;
+/** An address as a key, so two spellings of one address compare equal. Undefined when it is not an address. */
+export declare function keyOf(address: string | undefined): string | undefined;
+/** Ports, then interfaces, that can hold an address. */
+export declare function routedOf(device: Device): [string, Routed<string>][];
+/** Every valid address the devices hold. An invalid one is left for `validate` to report. */
+export declare function holdersOf(devices: readonly Device[]): Holder[];
+/** The network as a graph. It reads the config only, never a device, and works on a config that does not validate. */
+export declare function graphOf(devices: readonly Device[]): Graph;
+/** Only the edges on these layers, and among those only the ones that touch these devices when any are named. Every device named stays. */
+export declare function only(graph: Graph, layers: readonly Layer[], deviceNames?: readonly string[]): Graph;

package/dist/types/core/schema-docs.d.ts

@@ -0,0 +1,16 @@
+/** The schema files in reading order, with the title each gets. */
+export declare const SCHEMA_FILES: readonly [readonly ["device.ts", "Device"], readonly ["interfaces.ts", "Ports and interfaces"], readonly ["routing.ts", "Routing"], readonly ["policy.ts", "Route policies"], readonly ["firewall.ts", "Firewall and ACLs"], readonly ["system.ts", "System and management"], readonly ["common.ts", "Common values"]];
+export type Field = {
+    path: string;
+    type: string;
+    description: string;
+};
+export type TypeDoc = {
+    name: string;
+    description: string;
+    definition?: string;
+    includes?: string[];
+    fields: Field[];
+};
+/** Every type in each schema file, in the order given. Every file is read first, so a type is known to take parameters wherever it is used. */
+export declare function schemaTypes(sources: readonly string[]): TypeDoc[][];

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.18.5",
+    "version": "0.20.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/derive.ts

@@ -25,3 +25,35 @@ export function ipv4Networks(device: Device, iface: string): string[] {
 
     return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
 }
+
+/** Services the switch platforms run. Each takes its sources from `management.allow`, on the protocol's own port. */
+const SWITCH_SERVICES = ["ssh", "telnet", "snmp"] as const;
+
+/** Fields neither switch platform, VRP nor Raisecom ROS, expresses: a service's own sources or port, a user's description or keys, the IP stack's host settings, a point-to-point address, and offload per interface. */
+export function switchUnsupported(device: Device): string[] {
+    const found: string[] = [];
+
+    for (const service of SWITCH_SERVICES) {
+        const settings = device.management?.[service];
+        if (settings?.allow) found.push(`management.${service}.allow, every service takes management.allow`);
+        if (settings?.port) found.push(`management.${service}.port`);
+    }
+
+    for (const [name, user] of Object.entries(device.users ?? {})) {
+        if (user.description) found.push(`users.${name}.description`);
+        if (user.ssh_keys?.length) found.push(`users.${name}.ssh_keys`);
+    }
+
+    if (device.system?.ip) found.push("system.ip");
+
+    for (const [name, port] of Object.entries(device.ports ?? {})) {
+        if (port?.hardware_offload !== undefined) found.push(`ports.${name}.hardware_offload`);
+    }
+
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.addresses?.some((entry) => typeof entry !== "string")) found.push(`interfaces.${name}.addresses with a peer`);
+        if (iface.hardware_offload !== undefined) found.push(`interfaces.${name}.hardware_offload`);
+    }
+
+    return found;
+}

package/src/adapters/devices/raisecom-ros/index.ts

@@ -9,7 +9,7 @@ import { offset } from "../../../core/time";
 import type { Device, Port, SnmpUser, Switched, Vrrp } from "../../../schema";
 import { connect, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
-import { ipv4Networks, lagIds } from "../derive";
+import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, entries, type Group, scrub, steps, vlanListChange } from "../lines";
 import type { DeviceAdapter, Plan, Step } from "../types";
 
@@ -387,7 +387,14 @@ export function unsupported(device: Device): string[] {
             continue;
         }
 
-        if (iface.vrf) found.push(`interfaces.${name}.vrf`);
+        for (const field of ["vrf", "description", "mtu", "ipv6_ra"] as const) {
+            if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}`);
+        }
+
+        for (const entry of iface.addresses ?? []) {
+            const address = typeof entry === "string" ? entry : entry.address;
+            if (familyOf(address) === "ipv6") found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
+        }
 
         for (const group of iface.vrrp ?? []) {
             if (familyOf(group.address) === "ipv6") found.push(`interfaces.${name}.vrrp for IPv6`);
@@ -412,7 +419,15 @@ export function unsupported(device: Device): string[] {
     }
 
     for (const route of routing?.static ?? []) {
-        if (!route.via || route.vrf) found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+        if (!route.via || route.vrf || familyOf(route.prefix) === "ipv6") {
+            found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+        }
+
+        if (route.description || route.distance) found.push(`routing.static ${route.prefix} description and distance`);
+    }
+
+    for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+        if (vlan.description) found.push(`vlans.${name}.description`);
     }
 
     const UNSUPPORTED_SECTIONS = [
@@ -443,6 +458,9 @@ export function unsupported(device: Device): string[] {
             found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
     }
 
+    if (management.snmp?.contact || management.snmp?.location) found.push("management.snmp.contact and location");
+    if (management.ssh?.weak_crypto) found.push("management.ssh.weak_crypto");
+
     if (device.lldp && device.lldp !== true) found.push("lldp.interfaces, LLDP is per device");
     if (device.stp?.mode && device.stp.mode !== "mstp") found.push("stp.mode other than mstp");
 
@@ -456,6 +474,8 @@ export function unsupported(device: Device): string[] {
         found.push("system.dns, logging, release_channel, banner and ntp.serve");
     }
 
+    found.push(...switchUnsupported(device));
+
     return found;
 }
 

package/src/adapters/devices/routeros/index.ts

@@ -99,6 +99,14 @@ export function unsupported(device: Device): string[] {
         }
     }
 
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "lag") continue;
+
+        for (const field of ["storm_control", "stp"] as const) {
+            if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}, on a LAG`);
+        }
+    }
+
     const bgp = device.routing?.bgp;
 
     for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
@@ -113,6 +121,8 @@ export function unsupported(device: Device): string[] {
     if (management?.console) found.push("management.console, the console uses the device's users");
     if (management?.privilege_password) found.push("management.privilege_password, the platform has no privileged mode");
 
+    if (management?.snmp?.port) found.push("management.snmp.port");
+
     if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
         found.push("management.ssh.auth_timeout and auth_retries");
     }

package/src/adapters/devices/vrp/index.ts

@@ -9,7 +9,7 @@ import { offset } from "../../../core/time";
 import type { Device, Interface, Port, Vrrp } from "../../../schema";
 import { connect, readUntil, send, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
-import { ipv4Networks, lagIds } from "../derive";
+import { ipv4Networks, lagIds, switchUnsupported } from "../derive";
 import { compare, type Dialect, scrub, steps, vlanListChange } from "../lines";
 import type { DeviceAdapter, Plan } from "../types";
 
@@ -608,9 +608,14 @@ export function unsupported(device: Device): string[] {
     for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
         if (iface.type !== "vlan" && iface.type !== "lag") found.push(`interfaces.${name}, a ${iface.type}`);
         if (iface.type === "lag" && iface.addresses?.length) found.push(`interfaces.${name}.addresses, LAGs are switched`);
+        if (iface.mtu !== undefined) found.push(`interfaces.${name}.mtu`);
         for (const group of iface.vrrp ?? []) if (familyOf(group.address) === "ipv6") found.push(`interfaces.${name}.vrrp for IPv6`);
     }
 
+    for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+        if (vrf.description) found.push(`vrfs.${name}.description`);
+    }
+
     const routing = device.routing;
     if (routing?.bgp) found.push("routing.bgp");
     if (routing?.rpki) found.push("routing.rpki");
@@ -644,6 +649,10 @@ export function unsupported(device: Device): string[] {
         found.push("system.dns, logging, release_channel and banner");
     }
 
+    if (system.transceiver_monitoring !== undefined) found.push("system.transceiver_monitoring");
+
+    found.push(...switchUnsupported(device));
+
     const flow = device.flow_export;
     if (flow && flow.protocol !== "sflow") found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
     const sampling = flow?.protocol === "sflow" ? flow.sampling : undefined;

package/src/cli/graph.ts

@@ -0,0 +1,89 @@
+// What `circuit graph` prints: the graph of the network with what `validate` found and how each device compares with its last snapshot, as Mermaid, DOT or JSON.
+
+import { type Annotated, deviceId, type GraphNode } from "../core/graph";
+
+/** `error` when validate found an error on the device, `warning` for a warning or a difference from its snapshot. */
+export function markOf(graph: Annotated, node: GraphNode): "error" | "warning" | undefined {
+    if (node.kind !== "device") return undefined;
+
+    const findings = graph.findings.filter((finding) => finding.device && deviceId(finding.device) === node.id);
+    if (findings.some((finding) => finding.level === "error")) return "error";
+
+    const drift = graph.drift[node.label]?.status;
+    if (findings.length || drift === "differs" || drift === "cannot plan") return "warning";
+
+    return undefined;
+}
+
+/** Mermaid, which GitHub draws wherever Markdown is shown. */
+export function mermaid(graph: Annotated): string {
+    const ids = new Map(graph.nodes.map((node, index) => [node.id, `n${index}`]));
+    // Lines of text, each escaped, as one quoted label.
+    const text = (...lines: string[]) =>
+        `"${lines.map((line) => line.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
+
+    const shapes: Record<GraphNode["kind"], (label: string) => string> = {
+        device: (label) => `[${label}]`,
+        segment: (label) => `([${label}])`,
+        outside: (label) => `{{${label}}}`,
+    };
+
+    const lines = ["graph LR"];
+
+    for (const node of graph.nodes) {
+        const label = node.kind === "device" ? text(node.label, node.detail[0] ?? "") : text(node.label);
+        lines.push(`    ${ids.get(node.id)}${shapes[node.kind](label)}`);
+    }
+
+    for (const edge of graph.edges) {
+        const arrow = edge.oneSided ? "-.-" : "---";
+        lines.push(`    ${ids.get(edge.from)} ${arrow}|${text(edge.label)}| ${ids.get(edge.to)}`);
+    }
+
+    lines.push(
+        "    classDef error stroke:#d1242f,stroke-width:3px",
+        "    classDef warning stroke:#bf8700,stroke-width:3px",
+        "    classDef outside stroke-dasharray:4 3"
+    );
+
+    for (const node of graph.nodes) {
+        const mark = markOf(graph, node) ?? (node.kind === "outside" ? "outside" : undefined);
+        if (mark) lines.push(`    class ${ids.get(node.id)} ${mark}`);
+    }
+
+    return lines.join("\n") + "\n";
+}
+
+/** DOT, which Graphviz turns into an image: `circuit graph --format=dot | dot -Tsvg > network.svg`. */
+export function dot(graph: Annotated): string {
+    const text = (value: string) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, '\\"')}"`;
+    const colors = { error: "#d1242f", warning: "#bf8700" };
+
+    const shapes: Record<GraphNode["kind"], string> = {
+        device: "shape=box, style=rounded",
+        segment: "shape=ellipse",
+        outside: "shape=box, style=dashed",
+    };
+
+    const lines = [
+        "graph network {",
+        "    rankdir=LR;",
+        '    node [fontname="Helvetica"];',
+        '    edge [fontname="Helvetica", fontsize=10];',
+    ];
+
+    for (const node of graph.nodes) {
+        const label = node.kind === "device" ? `${node.label}\n${node.detail[0] ?? ""}` : node.label;
+        const mark = markOf(graph, node);
+        const color = mark ? `, color=${text(colors[mark])}, penwidth=2` : "";
+        lines.push(`    ${text(node.id)} [label=${text(label)}, ${shapes[node.kind]}${color}];`);
+    }
+
+    for (const edge of graph.edges) {
+        const style = edge.oneSided ? ", style=dashed" : "";
+        lines.push(`    ${text(edge.from)} -- ${text(edge.to)} [label=${text(edge.label)}${style}];`);
+    }
+
+    lines.push("}");
+    return lines.join("\n") + "\n";
+}