@takodotid/circuit 0.23.0 → 0.25.0

package/dist/presets/index.js

@@ -332,6 +332,7 @@ function internetExchange(exchange, members) {
     const findings = [];
     const error = (message, device) => findings.push({ level: "error", ...device ? { device } : {}, message });
     const taken = new Map((exchange.reserved ?? []).map((address) => [address, "reserved"]));
+    const portHolders = new Map;
     members.forEach((member, index) => {
       for (const other of members.slice(index + 1)) {
         if (other.name === member.name)
@@ -353,6 +354,10 @@ function internetExchange(exchange, members) {
         taken.set(address, member.name);
       }
       for (const [deviceName, portName] of Object.entries(member.ports)) {
+        const holder = portHolders.get(`${deviceName} ${portName}`);
+        if (holder)
+          error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
+        portHolders.set(`${deviceName} ${portName}`, member.name);
         const device = devices.find((candidate) => candidate.name === deviceName);
         const port = device?.ports?.[portName];
         const carried = port ? vlansOf(port) : [];

package/dist/types/adapters/devices/catalog.d.ts

@@ -39,6 +39,20 @@ export declare const catalog: {
             };
         };
     };
+    readonly junos: {
+        readonly "QFX5100-48S-6Q": {
+            readonly ports: {
+                readonly "40g": 6;
+                readonly "10g": 48;
+                readonly "1g": 2;
+            };
+            readonly spelling: {
+                readonly "40g": "et-0/0/{n+47}";
+                readonly "10g": "xe-0/0/{n-1}";
+                readonly "1g": "em{n-1}";
+            };
+        };
+    };
 };
 export type Catalog = typeof catalog;
 export type PlatformName = keyof Catalog;

package/dist/types/adapters/devices/junos/bgp.d.ts

@@ -0,0 +1,11 @@
+import type { Device, Neighbor, NeighborSettings } from "../../../schema";
+import { type Statements } from "./render";
+type AnyNeighbor = Neighbor<string, string>;
+/** The policy a session uses when it states none, so that it learns or announces nothing. */
+export declare const REJECT_ALL = "circuit-reject-all";
+/** A comment in the render naming a path whose statements `refresh` fills, so the plan keeps what the device holds there. */
+export declare const GENERATED = "# generated ";
+/** A neighbor's settings with its group's beneath them. */
+export declare function settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string>;
+export declare function renderBgp(out: Statements, device: Device): void;
+export {};

package/dist/types/adapters/devices/junos/index.d.ts

@@ -0,0 +1,39 @@
+import type { Client, ClientChannel } from "ssh2";
+import type { Device, Family } from "../../../schema";
+import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+/** A statement's words; a quoted value is one word with its quotes. */
+export declare function wordsOf(statement: string): string[];
+/** The device prints a password as a hash, an SNMP key as a reversible cipher, and a community as itself. None leave the read. */
+export declare function scrub(text: string): string;
+/** The configuration's statements from what `show configuration | display set` printed. */
+export declare function clean(output: string): string;
+/**
+ * What changes, by section.
+ *
+ * A statement the render holds and the device does not is set. One the device holds and the render does not is deleted at the shortest path that holds nothing the render wants, so a removed port goes as a whole and a changed value goes alone. A hidden value ends a path by its name alone; a hidden name in a list, such as a community, stays `<redacted>` and the session names each entry when it sends the plan. A statement the device holds deactivated is activated when the render wants it.
+ *
+ * A policy, a filter or an import or export chain is ordered, so when anything in one changes it is deleted and set again whole, in the render's order. A path the render marks as generated, such as a prefix list `refresh` fills, keeps what the device holds.
+ */
+export declare function plan(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
+export declare function login(device: Device): Promise<Client>;
+export declare function read(device: Device): Promise<string>;
+/** An interactive CLI with paging off. Root lands in a shell and starts the CLI from there. */
+export declare function openCli(channel: ClientChannel): Promise<void>;
+/** How a commit that could cut access is guarded: it rolls back after `minutes` unless `prove` shows access survived. */
+export type Guard = {
+    minutes: number;
+    prove: () => Promise<void>;
+};
+/**
+ * Load the plan into an exclusive candidate and check it. With a guard, commit it to roll back after `minutes`, prove access, then confirm; without one, commit it outright.
+ *
+ * Deletions go before the statements that are set, so a path deleted and set again in one plan ends up set.
+ */
+export declare function configure(channel: ClientChannel, plan: Plan, guard?: Guard): Promise<void>;
+export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+export declare function unsupported(device: Device): string[];
+/** The plan that replaces a prefix list's entries with what a registry returned. */
+export declare function fillPlan(set: string, prefixes: string[]): Plan;
+/** Replace a prefix list `refresh` fetched. It cannot cut access, so it is committed without a rollback. */
+export declare function fill(device: Device, _network: readonly Device[], set: string, _family: Family, prefixes: string[]): Promise<void>;
+export declare const junos: DeviceAdapter;

package/dist/types/adapters/devices/junos/models.d.ts

@@ -0,0 +1,14 @@
+export declare const models: {
+    readonly "QFX5100-48S-6Q": {
+        readonly ports: {
+            readonly "40g": 6;
+            readonly "10g": 48;
+            readonly "1g": 2;
+        };
+        readonly spelling: {
+            readonly "40g": "et-0/0/{n+47}";
+            readonly "10g": "xe-0/0/{n-1}";
+            readonly "1g": "em{n-1}";
+        };
+    };
+};

package/dist/types/adapters/devices/junos/render.d.ts

@@ -0,0 +1,52 @@
+import type { Device, Interface, Port, Vrrp } from "../../../schema";
+type AnyPort = Port<string, string, string, string>;
+type AnyInterface = Interface<string, string>;
+type LagInterface = Extract<AnyInterface, {
+    type: "lag";
+}>;
+type Switched = AnyPort | LagInterface;
+/** The statement each kind of public key is written under, by the key's own prefix. */
+export declare const KEY_STATEMENT: Record<string, string>;
+/** Detection under a second: three missed packets 300 ms apart. */
+export declare const BFD_INTERVAL = 300;
+/** Quote a value unless it is a plain word. Quoting more than the platform would is harmless: the comparison ignores quotes. */
+export declare function quote(value: string): string;
+/** Collects `set` statements, and comments the plan reads. */
+export declare class Statements {
+    private readonly lines;
+    private readonly notes;
+    set(...words: (string | number)[]): void;
+    note(comment: string): void;
+    /** The statements as the device prints them: each once, and none that another one extends, because the platform prints only the longest. */
+    text(): string;
+}
+/** What the platform calls a port, a LAG, a VLAN interface or a loopback. */
+export declare class Names {
+    private readonly device;
+    readonly lags: Map<string, number>;
+    readonly loopbacks: Map<string, number>;
+    readonly tunnels: Map<string, number>;
+    constructor(device: Device);
+    /** A physical port. A 10G cage holding a 1G optic is `ge-`, not `xe-`. */
+    port(port: string): string;
+    /** The physical interface a port or a LAG is: `xe-0/0/1`, `ae1`. */
+    physical(name: string): string;
+    /** The logical interface that holds addresses: `xe-0/0/1.0`, `ae1.0`, `irb.10`, `lo0.0`. */
+    unit(name: string): string;
+    /** The physical ports behind a port or a LAG. */
+    members(name: string): string[];
+}
+/** The address a VRRP group sits on: the one whose network holds the virtual address. */
+export declare function vrrpAddress(addresses: readonly string[], group: Vrrp): string | undefined;
+/**
+ * The storm-control profile a port or LAG names. A profile holds one threshold for every kind it limits, so a port's kinds must share one in percent; `unsupported()` refuses any other.
+ */
+export declare function stormProfile(settings: Switched): {
+    name: string;
+    percent: number;
+    left: string[];
+} | undefined;
+export declare function render(device: Device): string;
+/** The size a port's frames may reach for an IP MTU: the Ethernet header, and a VLAN tag when the port switches. */
+export declare const frameSize: (mtu: number, switched: boolean) => number;
+export {};

package/dist/types/core/graph.d.ts

@@ -60,6 +60,8 @@ export type Holder = {
     /** The far end of a point-to-point address. */
     peer?: string;
     vrrp: NonNullable<Routed<string>["vrrp"]>;
+    /** The VRF the address is in. The default table when absent. */
+    vrf?: string;
 };
 export declare const deviceId: (name: string) => string;
 /** An address as a key, so two spellings of one address compare equal. Undefined when it is not an address. */

package/dist/types/presets/index.d.ts

@@ -171,7 +171,7 @@ export type InternetExchange<V extends string> = {
  * Member ports and a check for an internet exchange's fabric.
  *
  * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through.
- * - `check`: members never share a name, an AS or an address; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
+ * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
  */
 export declare function internetExchange<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]): {
     ports: (device: string) => Record<string, Port<V, string, string, string>>;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.23.0",
+    "version": "0.25.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",
@@ -13,7 +13,9 @@
         "mikrotik",
         "vrp",
         "huawei",
-        "raisecom"
+        "raisecom",
+        "junos",
+        "juniper"
     ],
     "homepage": "https://circuit.tako.id",
     "bugs": {

package/src/adapters/devices/catalog.ts

@@ -1,10 +1,11 @@
 // Every model each platform supports. Types read from here, so a model or port name that does not exist fails to compile.
 
+import { models as junos } from "./junos/models";
 import { models as raisecom } from "./raisecom-ros/models";
 import { models as routeros } from "./routeros/models";
 import { models as vrp } from "./vrp/models";
 
-export const catalog = { routeros, vrp, "raisecom-ros": raisecom } as const;
+export const catalog = { routeros, vrp, "raisecom-ros": raisecom, junos } as const;
 
 export type Catalog = typeof catalog;
 export type PlatformName = keyof Catalog;
@@ -34,5 +35,6 @@ export function spell(platform: string, model: string, port: string): string {
     const template = parts && spec?.spelling[parts[1]!];
     if (!template) throw new Error(`${model} has no port ${port}`);
 
-    return template.replace("{n}", parts[2]!);
+    // A platform that counts from 0, or numbers one class after another, shifts the position: `{n-1}`, `{n+47}`.
+    return template.replace(/\{n([+-]\d+)?\}/, (_, shift?: string) => String(Number(parts[2]) + Number(shift ?? 0)));
 }

package/src/adapters/devices/index.ts

@@ -1,7 +1,8 @@
+import { junos } from "./junos";
 import { raisecom } from "./raisecom-ros";
 import { routeros } from "./routeros";
 import type { DeviceAdapter } from "./types";
 import { vrp } from "./vrp";
 
 /** Every platform the framework can render and apply, by name. */
-export const adapters: Record<string, DeviceAdapter> = { routeros, vrp, "raisecom-ros": raisecom };
+export const adapters: Record<string, DeviceAdapter> = { routeros, vrp, "raisecom-ros": raisecom, junos };

package/src/adapters/devices/junos/TRAPS.md

@@ -0,0 +1,31 @@
+# Junos traps
+
+Behaviour that looks like something else. Each one has been hit on a QFX5100-48S-6Q running Junos 21.4R3.
+
+- Changes stage in a candidate and apply at `commit`. `commit confirmed N` applies them and rolls them back after N minutes unless another `commit` confirms them. `commit` also saves: there is no separate save.
+- The device counts ports from 0, and the 40G ports follow the 10G ones: `10g-1` is `xe-0/0/0`, `10g-48` is `xe-0/0/47`, `40g-1` is `et-0/0/48`. The two management ports, `em0` and `em1`, are `1g-1` and `1g-2`.
+- `load set terminal` reports a refused statement as `terminal:12:(8) syntax error: ...`, then says `load complete` and keeps every statement it accepted. Circuit discards the whole candidate on any refusal.
+- A value is cut at `(`, `&` or `|` unless it is quoted: `description a|b` is stored as `a`, with an error. The render quotes every value that is not a plain word.
+- The device decides for itself which values it prints in quotes: `noc@example.com` comes back quoted, `"Router"` comes back plain. The plan compares values without their quotes.
+- The device prints only the longest form of a statement. `set protocols rstp interface xe-0/0/0` disappears once `... xe-0/0/0 edge` is set, so the render leaves it out too.
+- A delete cannot stop at a list whose entries are named: `delete interfaces xe-0/0/1 unit` is refused with `syntax error, expecting <identifier>`, while `unit 0` works. `show` refuses the same way. A list of plain values, such as `vlan members` or `ciphers`, can go whole.
+- `delete` with a value removes the statement only when the value matches; otherwise it says `warning: statement not found` and changes nothing.
+- A `?` shows help and is not executed, but the Enter after it sends the line typed so far, which may be a complete command.
+- `operator`, `daemon`, `bind`, `kmem`, `nobody`, `sshd`, `tty` and `uucp` are system accounts. A user with one of those names fails the commit check: `user name is used by a system account`.
+- Root logs in to a shell, `root@:RE:0%`, and reaches the CLI with `cli`. Every other user lands in the CLI.
+- A password set with `plain-text-password-value` prints as a `$6$` hash. SNMPv3 passwords print as `$9$` keys, which can be turned back into the password. The read redacts both.
+- An SNMP community prints in clear, and its value is also its name, so a new value is a second community. A new value is sent after the old communities are deleted, each by its name, which Circuit looks up during the apply and never prints.
+- A firewall filter name is unique across families. The filter guarding the device's services is `circuit-services` for IPv4 and `circuit-services-v6` for IPv6.
+- A VLAN interface's MTU above what its ports carry commits with only a warning, `mtu 9000 is bigger than member link`.
+- There is no `protocols stp`. Plain STP is RSTP held back with `force-version stp`.
+- sFlow interfaces print with their unit, `xe-0/0/0.0`.
+- The factory VLAN `default` can be deleted.
+- BGP without a licence commits with only a warning, `requires 'bgp' license`, and sessions establish. The same holds for the other licensed features.
+- Junos accepts and announces every route over eBGP unless a policy says otherwise: `Default eBGP mode: advertise - accept, receive - accept`. A session without a policy is given `circuit-reject-all`.
+- An export policy sees every active route, not only BGP's. Every export starts with `circuit-bgp-origin`, which passes on BGP's routes and the prefixes in `routing.bgp.networks` and rejects the rest.
+- A policy's or a filter's terms are kept in order, and `set` adds a new term at the end. A change to one rewrites it whole.
+- One policy term cannot filter IPv4 and IPv6 prefixes together: `invalid prefix ::/0 for family inet`. A rule for both families becomes a term for each.
+- A port filter cannot match the VLAN a frame is switched in: `learn-vlan-id not supported on ingress interface`.
+- IPv4 routes over an IPv6 session need a local IPv4 address under the family: `Local IPv4 address must be configured`.
+- A DHCP server and a DHCP relay cannot share an interface: `Interface irb.10 already configured`.
+- A port's MTU counts the Ethernet header. `mtu 9018` carries 9000-byte packets with a VLAN tag, and a VLAN interface's 9000 then commits without a warning.

package/src/adapters/devices/junos/bgp.ts

@@ -0,0 +1,263 @@
+// BGP, route policies, prefix sets and route origin validation, as Junos `set` statements.
+
+import { familyOf, host } from "../../../core/addr";
+import { marker } from "../../../core/secrets";
+import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../../schema";
+import { BFD_INTERVAL, quote, type Statements } from "./render";
+
+type AnyRule = PolicyRule<string, string>;
+type AnyNeighbor = Neighbor<string, string>;
+
+/** The policy a session uses when it states none, so that it learns or announces nothing. */
+export const REJECT_ALL = "circuit-reject-all";
+
+/** The policy every export starts with. BGP's own routes and the prefixes the device originates go on to the session's policy; the device's other routes never reach it. */
+const ORIGIN = "circuit-bgp-origin";
+
+/** The validator group every RPKI server joins. */
+const RPKI_GROUP = "circuit";
+
+/** A comment in the render naming a path whose statements `refresh` fills, so the plan keeps what the device holds there. */
+export const GENERATED = "# generated ";
+
+const FAMILY = { ipv4: "inet", ipv6: "inet6" } as const;
+
+const VALIDATION = { valid: "valid", invalid: "invalid", "not-found": "unknown" } as const;
+
+/** A neighbor's settings with its group's beneath them. */
+export function settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string> {
+    const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+    return { ...group, ...neighbor };
+}
+
+/** A name made of a value's words, for a community or a path-length list: `64500:*` becomes `64500-any`. */
+const slug = (value: string) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
+
+/** A community as the platform writes a member: a large community carries the `large:` prefix. */
+const member = (community: string, large: boolean) => (large ? `large:${community}` : community);
+
+export function renderBgp(out: Statements, device: Device): void {
+    prefixSets(out, device);
+    rpki(out, device);
+
+    const bgp = device.routing?.bgp;
+    if (!bgp) return;
+
+    out.set("routing-options autonomous-system", bgp.asn);
+
+    const used = new Set<string>();
+    let rejectAll = false;
+    let exports = false;
+
+    // One group per session: a group holds one type, internal or external, and the config's groups are only shared settings.
+    for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
+        const settings = settingsOf(device, neighbor);
+        const group = `protocols bgp group ${name}`;
+
+        out.set(group, "type", settings.remote_as === bgp.asn ? "internal" : "external");
+        out.set(group, "peer-as", settings.remote_as!);
+        if (settings.description) out.set(group, "description", quote(settings.description));
+        if (settings.local_address) out.set(group, "local-address", settings.local_address);
+        if (settings.multihop) out.set(group, "multihop");
+        if (settings.passive) out.set(group, "passive");
+        if (settings.hold_time !== undefined) out.set(group, "hold-time", settings.hold_time);
+        if (settings.password) out.set(group, "authentication-key", marker(settings.password));
+        if (settings.bfd) out.set(group, "bfd-liveness-detection minimum-interval", BFD_INTERVAL);
+
+        out.set(group, "import", settings.import ?? REJECT_ALL);
+
+        if (settings.export) {
+            exports = true;
+            out.set(group, "export", ORIGIN);
+            out.set(group, "export", settings.export);
+        } else out.set(group, "export", REJECT_ALL);
+
+        for (const policy of [settings.import, settings.export]) {
+            if (policy) used.add(policy);
+            else rejectAll = true;
+        }
+
+        for (const family of settings.families ?? [familyOf(neighbor.address)]) {
+            const nlri = `${group} family ${FAMILY[family]} unicast`;
+            out.set(nlri);
+
+            // A session over its limit stays down until it is cleared by hand.
+            if (settings.max_prefixes !== undefined) {
+                out.set(nlri, "prefix-limit maximum", settings.max_prefixes);
+                out.set(nlri, "prefix-limit teardown idle-timeout forever");
+            }
+        }
+
+        out.set(group, "neighbor", neighbor.address);
+    }
+
+    if (rejectAll) out.set(`policy-options policy-statement ${REJECT_ALL} then reject`);
+
+    if (exports) origin(out, device);
+
+    for (const policy of [...used].sort()) policyStatement(out, device, policy);
+}
+
+/** BGP's routes and the originated prefixes go on to the session's policy; anything else is rejected. */
+function origin(out: Statements, device: Device): void {
+    const statement = `policy-options policy-statement ${ORIGIN}`;
+    out.set(statement, "term bgp from protocol bgp");
+    out.set(statement, "term bgp then next policy");
+
+    const networks = device.routing?.bgp?.networks ?? [];
+    for (const prefix of networks) out.set(statement, "term networks from route-filter", prefix, "exact");
+    if (networks.length) out.set(statement, "term networks then next policy");
+
+    out.set(statement, "term others then reject");
+}
+
+function prefixSets(out: Statements, device: Device): void {
+    for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+        const list = `policy-options prefix-list ${name}`;
+
+        if ("prefixes" in set && set.prefixes.length) for (const prefix of set.prefixes) out.set(list, prefix);
+        else out.set(list);
+
+        if ("source" in set) out.note(`${GENERATED}${list}`);
+    }
+}
+
+function rpki(out: Statements, device: Device): void {
+    for (const server of device.routing?.rpki ?? []) {
+        out.set(`routing-options validation group ${RPKI_GROUP} session`, server.address, "port", server.port);
+    }
+}
+
+/** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
+function familyOfRule(device: Device, rule: AnyRule): Family | undefined {
+    const match = rule.match;
+    if (match?.family) return match.family;
+
+    if (match?.prefix) return familyOf(host(match.prefix));
+
+    const set = match?.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+    if (set && "source" in set) return set.source.family;
+
+    if (set?.prefixes[0]) return familyOf(host(set.prefixes[0]));
+
+    return undefined;
+}
+
+/** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller, as it does on every platform. */
+function flatten(device: Device, policy: string, label: string, seen: string[]): { label: string; rule: AnyRule }[] {
+    const rules = device.policies?.[policy] ?? [];
+    const flat: { label: string; rule: AnyRule }[] = [];
+
+    rules.forEach((rule, index) => {
+        const here = label ? `${label}.${index + 1}` : `${index + 1}`;
+
+        if (rule.call && !seen.includes(rule.call)) flat.push(...flatten(device, rule.call, here, [...seen, rule.call]));
+
+        if (rule.match || rule.set || rule.action) flat.push({ label: here, rule });
+    });
+
+    return flat;
+}
+
+/** A term's name: its place, then the rule's description so a reader sees it on the device. */
+const termName = (label: string, rule: AnyRule) => quote(rule.description ? `${label} ${rule.description}` : label);
+
+/** One policy as a policy statement: a term per rule, then a reject when the last rule does not decide on every route. */
+function policyStatement(out: Statements, device: Device, policy: string): void {
+    const statement = `policy-options policy-statement ${policy}`;
+    const flat = flatten(device, policy, "", [policy]);
+
+    for (const { label, rule } of flat) {
+        const family = familyOfRule(device, rule);
+        // A next hop only means something to routes of its own family, and one term cannot filter prefixes of both, so a rule for both families splits into a term for each.
+        const split = !family && (rule.set?.next_hop || rule.match?.prefix_length) ? (["ipv4", "ipv6"] as const) : [family];
+
+        for (const part of split) {
+            const name = split.length > 1 ? termName(`${label}-${part === "ipv4" ? "v4" : "v6"}`, rule) : termName(label, rule);
+            term(out, device, `${statement} term ${name}`, rule, part, split.length > 1);
+        }
+    }
+
+    const last = flat.at(-1)?.rule;
+    const decides = last !== undefined && !last.match && last.action !== undefined;
+    if (!decides) out.set(statement, "term circuit-default then reject");
+}
+
+function term(out: Statements, device: Device, term: string, rule: AnyRule, family: Family | undefined, splitFamily: boolean): void {
+    const match = rule.match ?? {};
+    const set = rule.set ?? {};
+    const from: (string | number)[][] = [];
+    const then: (string | number)[][] = [];
+
+    if (match.family || splitFamily) from.push(["family", FAMILY[(match.family ?? family)!]]);
+    if (match.prefix) from.push(["route-filter", match.prefix, "exact"]);
+    if (match.prefix_set) from.push(["prefix-list-filter", match.prefix_set, "orlonger"]);
+
+    if (match.prefix_length) {
+        const families = family ? [family] : (["ipv4", "ipv6"] as const);
+
+        for (const each of families) {
+            const longest = each === "ipv4" ? 32 : 128;
+            const range = `/${match.prefix_length.min ?? 0}-/${match.prefix_length.max ?? longest}`;
+            from.push(["route-filter", each === "ipv4" ? "0.0.0.0/0" : "::/0", "prefix-length-range", range]);
+        }
+    }
+
+    if (match.as_path_length) {
+        const { min = 0, max } = match.as_path_length;
+        const name = `circuit-path-length-${min}-${max ?? "any"}`;
+        out.set(`policy-options as-path ${name}`, quote(`.{${min},${max ?? ""}}`));
+        from.push(["as-path", name]);
+    }
+
+    if (match.rpki) from.push(["validation-database", VALIDATION[match.rpki]]);
+
+    // Members of one named community must all be present, so a rule matching both kinds names them together.
+    const wanted = [
+        ...(match.community ? [member(match.community, false)] : []),
+        ...(match.large_community ? [member(match.large_community, true)] : []),
+    ];
+
+    if (wanted.length) from.push(["community", community(out, "match", wanted)]);
+
+    if (set.local_pref !== undefined) then.push(["local-preference", set.local_pref]);
+    if (set.med !== undefined) then.push(["metric", set.med]);
+
+    if (set.prepend !== undefined) {
+        const asn = device.routing!.bgp!.asn;
+        then.push(["as-path-prepend", quote(Array(set.prepend).fill(asn).join(" "))]);
+    }
+
+    // Replacing communities of one kind is removing every one of that kind, then adding the new ones.
+    const removed = [
+        ...(set.communities ? ["*:*"] : (set.remove_communities ?? [])).map((pattern) => member(pattern, false)),
+        ...(set.large_communities ? ["*:*:*"] : (set.remove_large_communities ?? [])).map((pattern) => member(pattern, true)),
+    ];
+
+    const added = [
+        ...(set.communities ?? set.add_communities ?? []).map((value) => member(value, false)),
+        ...(set.large_communities ?? set.add_large_communities ?? []).map((value) => member(value, true)),
+    ];
+
+    if (set.communities && set.add_communities) added.push(...set.add_communities.map((value) => member(value, false)));
+    if (set.large_communities && set.add_large_communities) added.push(...set.add_large_communities.map((value) => member(value, true)));
+
+    for (const pattern of removed) then.push(["community delete", community(out, "remove", [pattern])]);
+    if (added.length) then.push(["community add", community(out, "add", added)]);
+
+    if (set.next_hop && (!family || familyOf(set.next_hop) === family)) then.push(["next-hop", set.next_hop]);
+    if (set.blackhole) then.push(["next-hop discard"]);
+    if (rule.action) then.push([rule.action]);
+
+    for (const words of from) out.set(term, "from", ...words);
+    for (const words of then) out.set(term, "then", ...words);
+
+    if (!from.length && !then.length) out.set(term);
+}
+
+/** A named community holding these members, named after them. */
+function community(out: Statements, purpose: string, members: string[]): string {
+    const name = `circuit-${purpose}-${slug(members.join(" "))}`;
+    for (const value of members) out.set(`policy-options community ${name} members`, quote(value));
+    return name;
+}