@takodotid/circuit 0.34.2 → 0.35.0

package/dist/types/platforms/routeros/plan.d.ts

@@ -0,0 +1,54 @@
+import type { ApplyOptions, Plan } from "../platform";
+export declare class RouterOsPlan {
+    private readonly sendSecrets;
+    /** A plan line the apply handles itself: upload a certificate and its key, and import them. */
+    static readonly INSTALL_CERTIFICATE = "#install-certificate ";
+    /** Dependency order. A menu not listed sorts after all of these. The longest matching prefix decides. */
+    private static readonly ORDER;
+    /** Menus that also hold entries the device learned rather than was told. A selector must not match those. */
+    private static readonly DYNAMIC;
+    /** Menus where an entry that keeps its name but changes what it is known by is changed with a `set`, so what points at it by name, such as an address on a VLAN interface, stays attached. In every other menu it is removed and added again. */
+    private static readonly CHANGED_IN_PLACE;
+    /** The variable holding the old rules of an ordered menu while the new ones are added. Removed when the rewrite ends. */
+    private static readonly OLD_RULES;
+    /** What blocks an apply: something this plan cannot converge. */
+    private readonly problems;
+    /** Also send every secret, so a rotated value reaches the device. */
+    private constructor();
+    /** What it takes to go from `current` to `desired`. */
+    static of(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
+    private static rank;
+    /** Quote a value for a command. */
+    private static quote;
+    /** A value as a command takes it: bare when plain, quoted otherwise. A bare value is checked by `:parse` against the values the property takes; a quoted one is not (TRAPS.md). */
+    private static value;
+    /** In a `find`, a quoted `yes` is a string and matches no boolean, while an unquoted slash matches nothing. Plain words go bare, anything else quoted. */
+    private static findValue;
+    /** A selector for the entry with this identity. */
+    private static find;
+    /** A whole command as sent: menu, verb, selector, flags, then properties. */
+    private static line;
+    private static describe;
+    /** Group commands by menu. */
+    private static byMenu;
+    /**
+     * The properties to send so that the device's entry matches the rendered one. A property the device holds and the render does not state is reset to its default.
+     */
+    private changes;
+    /** Settings addressed by a selector: `set ftp ...`, `set [ find default=yes ] ...`. They are changed, never added or removed. */
+    private settings;
+    /** Entries, told apart by identity. New ones are added, changed ones set, and ones the render does not hold removed in the last phase. */
+    private entries;
+    /**
+     * Certificates are installed from the config when missing or different, after the old one of that name is removed. One the device holds under another name, with the same fingerprint and key, is renamed rather than imported a second time. One the config does not hold is removed in the last phase.
+     */
+    private static certificates;
+    /**
+     * An ordered menu is rewritten whole whenever it differs, so the device lists its rules in the order the render gives.
+     *
+     * The old rules are captured, the new ones added after them, then the captured ones removed. Until that moment the old rules keep deciding, so no chain is ever empty or half new.
+     *
+     * In a menu with chains, an old rule is removed in this step only if its chain is still wanted. A chain no longer wanted is removed in the last phase, after whatever pointed at it has been changed.
+     */
+    private static ordered;
+}

package/dist/types/platforms/routeros/render.d.ts

@@ -0,0 +1,240 @@
+import type { AclRule, Device, Ethertype, Interface, Port } from "../../schema";
+/** A property value as a command takes it. `undefined` and `false` leave the property out. */
+export type Value = string | number | undefined | false;
+export type AnyPort = Port<string, string, string, string>;
+/** One switch rule: the port it is on, the ACL rule it comes from, and the one source and destination port or range it takes. */
+export type SwitchRule = {
+    port: string;
+    rule: AclRule<string>;
+    srcPort?: string;
+    dstPort?: string;
+};
+export type AnyInterface = Interface<string, string>;
+type Speed = NonNullable<AnyPort["speed"]>;
+/** One device's render: the device, and the commands collected under their menu. */
+export declare class RouterOsRender {
+    private readonly device;
+    /** The bridge every switched port joins. One per device. */
+    private static readonly BRIDGE;
+    /** Destination of spanning tree BPDUs, so a filter can drop them on one port. */
+    private static readonly BPDU_DESTINATION;
+    /** The platform names a fixed speed by its medium: an optic in a cage, or copper. */
+    private static readonly MEDIUM;
+    /** Address lists holding the prefixes BGP originates. A session reads the one of its family. */
+    private static readonly NETWORKS;
+    /** A kind of frame as a switch rule's `mac-protocol` names it. */
+    private static readonly MAC_PROTOCOLS;
+    /** Helpers the platform has, all stated so that one the config does not list is off. */
+    private static readonly HELPERS;
+    private static readonly CHAINS;
+    /** The validator group every RPKI server joins. */
+    private static readonly RPKI_GROUP;
+    /** The chain a session without a policy uses, so that it learns or announces nothing. */
+    private static readonly REJECT_ALL;
+    private static readonly ROLES;
+    /** Neutral service name to the platform's. `native` is the platform's own desktop client. */
+    private static readonly SERVICES;
+    private static readonly USER_GROUPS;
+    private static readonly SNMP_AUTH;
+    private static readonly SNMP_PRIVACY;
+    /** Severity threshold to the topics the platform logs under, most severe first. */
+    private static readonly TOPICS;
+    private static readonly SEVERITY_ORDER;
+    private readonly ports;
+    private readonly interfaces;
+    /** Commands under their menu. */
+    private readonly menus;
+    private constructor();
+    /** The whole configuration the device should run. */
+    static of(device: Device): string;
+    /** The platform's name for a fixed speed on a port, or undefined when it has none. */
+    static medium(platformPortName: string, speed: Speed): string | undefined;
+    /** Quote a value when it holds anything but plain characters. */
+    private static quote;
+    /**
+     * A command: a verb such as `add` or `set [ find name=x ]`, then `property=value` for every property that has a value.
+     *
+     * Properties are written in the order given.
+     */
+    private static command;
+    /** `yes` or `no`. */
+    private static yesNo;
+    /** `V4` or `V6`, the suffix of a chain rendered for one family. */
+    private static familySuffix;
+    /** Each port or range of ports as the platform writes it: `53`, `0-52`. */
+    private static eachPort;
+    /** One port, a range, or a list of them, as `53,0-52`. */
+    private static portList;
+    /** Seconds as the platform writes a duration: `3600` becomes `1h`, `90` becomes `1m30s`. */
+    private static duration;
+    /** A rate as the switch chip takes it: `2G` becomes `2.0Gbps`. */
+    private static bitrate;
+    /** An IPv4 prefix with a dotted mask, as the switch chip takes it: `10.0.0.0/8` becomes `10.0.0.0/255.0.0.0`. */
+    private static dottedMask;
+    /** A community pattern with `*` as a regular expression the platform matches on: `64500:*:*` becomes `^64500:[0-9]+:[0-9]+$`. */
+    private static communityPattern;
+    /** The name of the VLAN interface under one with a MAC of its own, which takes the configured name itself. */
+    private static underMacvlan;
+    /** The interface holding one VRRP group. */
+    private static vrrpName;
+    /** `host:port` into its parts. The last colon separates them, so an IPv6 host keeps its own. */
+    private static splitEndpoint;
+    /** The chain a policy is rendered as for one family. A policy can test prefix lengths that mean different things per family, so each family gets its own. */
+    private static chainName;
+    /** The conditions of a rule, as the platform's filter language writes them. */
+    private static conditions;
+    /** What a rule does to a matching route, then its decision. */
+    private static actions;
+    /** One rule as the platform writes it: hand off, ask the validator, test, change, decide. */
+    private static ruleText;
+    /** SHA-256 of the certificate's DER encoding, lowercase hex, as the platform prints it. */
+    private static fingerprint;
+    /** Every topic at or above a severity. Emergency and alert are logged as critical; the platform has no notice topic. */
+    private static topicsFrom;
+    /** Add a line to a menu as it is. */
+    private addLine;
+    /** Add a command to a menu. */
+    private add;
+    /** The whole configuration as text. */
+    private text;
+    /** What the platform calls a port or an interface. A port is spelled by the model; an interface keeps its config name. */
+    private name;
+    /** The number of a VLAN, by its config name. */
+    private vlanId;
+    /** Ports and LAGs that are layer 2 members of a VLAN, with their settings. A port in a LAG is represented by the LAG. */
+    private switched;
+    /** VLAN interfaces, with their settings. */
+    private declaredVlanInterfaces;
+    /** Every port and interface that holds addresses or other layer 3 settings. Ports are named as the platform spells them. */
+    private routed;
+    private interfaceMenus;
+    /**
+     * Routing in the switch chip. With it on, routed traffic bypasses the forward chain unless its interface opts out.
+     *
+     * Restarting the offload after a failure, and offloading IPv6 too, follow the same switch.
+     */
+    private hardwareOffload;
+    /** One VLAN-filtering bridge carries every switched port. A loopback is a bridge with no ports, the platform's idiom for one. */
+    private bridge;
+    /** Every port of the model is stated. One the config does not declare is disabled. */
+    private ethernet;
+    /**
+     * Storm control in the switch chip. The platform takes one rate, in percent, and which kinds of flooded traffic it limits.
+     *
+     * `unsupported()` refuses packets per second and different percentages per kind, so here they are always one shared percent.
+     */
+    private switchPorts;
+    /** A LAG is a bonding interface. Its members are named as the platform spells them. */
+    private lags;
+    /**
+     * A VLAN interface sits on the bridge. When the device offloads, one that opts out is routed in software so the firewall applies.
+     *
+     * Every VLAN interface on the bridge has the bridge's MAC. One with a MAC of its own is a MACVLAN on top of the VLAN interface: the MACVLAN takes the configured name, so its addresses and every rule naming it land on it.
+     */
+    private vlanInterfaces;
+    private tunnels;
+    private wireguard;
+    /** Each VRRP group is an interface of its own, holding the shared address. Version 3 carries IPv6. */
+    private vrrp;
+    /** A switched port or LAG joins the bridge. Its untagged VLAN is its port VLAN ID. */
+    private bridgePorts;
+    /** A VLAN is tagged on every trunk carrying it, and on the bridge itself when the router has an interface in it. */
+    private bridgeVlans;
+    /** The platform cannot take a port out of spanning tree, so `stp: false` drops the BPDUs it would send and receive. */
+    private bridgeFilters;
+    /**
+     * Interface lists scope what works at layer 2: neighbor discovery, and the platform's own client over MAC. The IP firewall never sees either.
+     */
+    private interfaceLists;
+    /**
+     * Where LLDP runs, when it is limited to some ports. Undefined when it runs everywhere or nowhere, which the discovery settings say directly.
+     */
+    private lldpMembers;
+    /** A VRF lists its interfaces. */
+    private vrfs;
+    private addressing;
+    /** Every address goes on the menu of its family, with the interface's description as its comment. */
+    private addresses;
+    private dhcp;
+    private dns;
+    /**
+     * Address lists come from firewall address sets, prefix sets typed in the config, and what BGP originates.
+     *
+     * A prefix set fetched from a registry is filled by `refresh`, so only its name is marked, and the plan leaves its entries alone.
+     */
+    private addressLists;
+    private firewall;
+    /** Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made. */
+    private untracked;
+    /**
+     * The families a rule applies to. An address in the rule decides it; otherwise it applies to both.
+     *
+     * A rule naming an address set applies only to the families the set has members in.
+     */
+    private families;
+    /** The match properties of a rule, as the platform names them. */
+    private matchProperties;
+    private filter;
+    private nat;
+    private helpers;
+    /**
+     * ACLs run in the switch chip on the port traffic arrives on. The chip matches addresses with a dotted mask on IPv4, drops by forwarding to no port, and limits by rate. A rule takes one port or range, so a list becomes one rule for each.
+     */
+    private switchAcls;
+    /**
+     * A port that takes only some kinds of frame: a rule that lets each kind through, then one that drops the rest. The chip takes the first rule that matches on the port, so these come after the port's ACL, whose rules match only IPv4 or IPv6.
+     */
+    private ethertypeFilters;
+    /** The ports with an ethertype filter, with the kinds each takes. Each makes one switch rule per kind and one more. */
+    static ethertypeFilters(device: Device): {
+        port: string;
+        ethertypes: readonly Ethertype[];
+    }[];
+    /** Every switch rule the device's hardware ACLs make, in order: one for each port with an ACL, each rule of it, and each source and destination port or range of the rule. */
+    static switchRules(device: Device): SwitchRule[];
+    private routing;
+    private staticRoutes;
+    private rpki;
+    /** The default instance exists on every device; it is stated in the form the export prints it. */
+    private bgpInstance;
+    /** A neighbor's settings with its group's beneath them. */
+    private settingsOf;
+    /** The families a neighbor exchanges: the ones it states, or its address's. */
+    private familiesOf;
+    /** Does a rule belong on a family's chain? A rule naming a prefix, a family, or a prefix set of one family belongs only there. */
+    private appliesTo;
+    /**
+     * Policies become filter chains, one per family a session uses, plus every chain those call.
+     *
+     * A chain a session uses directly ends in a reject when its last rule does not decide, so a route nothing accepted is rejected on any platform default. A chain only called returns to its caller instead.
+     */
+    private policies;
+    /** One connection per neighbor. The platform carries one family per connection. */
+    private bgpConnections;
+    /** One instance per OSPF version, an area per area and instance, and a template per interface. */
+    private ospf;
+    /**
+     * BFD runs where a session or an OSPF interface asks for it, with the device's timers when it states them. One configuration covers every interface. A multihop session has no interface, and BFD for it is forbidden unless a configuration names its address, so each gets one of its own.
+     */
+    private bfd;
+    private management;
+    /** Every service the platform has is stated. One the config does not name is disabled. */
+    private services;
+    /** What works at layer 2: the platform's client over MAC, MAC ping, the bandwidth test server and neighbor discovery. */
+    private layerTwo;
+    /**
+     * The platform keeps one community it will not delete. With version 2c it becomes the read community; without, it is disabled. Version 3 users are communities of their own.
+     */
+    private snmp;
+    private users;
+    /**
+     * Certificates are not part of an export, so the reader lists them in this same form: a name, the SHA-256 fingerprint of the certificate, and whether the device holds its private key. A difference is installed from the config, not edited.
+     */
+    private certificates;
+    private system;
+    /** Local logging uses the platform's built-in disk action, number 1. Each remote collector gets an action of its own. */
+    private logging;
+    /** NetFlow version 9 and IPFIX through traffic flow. The platform has no sFlow, which `unsupported()` reports. */
+    private flowExport;
+}
+export {};

package/dist/types/platforms/vrp/index.d.ts

@@ -0,0 +1,83 @@
+import type { Neighbor } from "../../core/cabling";
+import type { Device } from "../../schema";
+import { type ConsoleDialect } from "../../transport/console";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+export declare class Vrp extends Platform {
+    /** How the console asks for a login: the same question to change the password, always answered no, a system view left with `return`, and the line's banner after a logout or a refused password answered with Enter. Not yet proved on a device. */
+    static readonly CONSOLE: ConsoleDialect;
+    /** Lines the device prints whatever is configured, or that describe the hardware rather than its configuration. */
+    private static readonly DEVICE_FACTS;
+    /** Lines whose removal takes only their keyword, not their value. */
+    private static readonly UNDO_BY_KEYWORD;
+    /** Lines a new line of the same kind replaces whole, so the old one is not undone first. */
+    private static readonly REPLACED_WHOLE;
+    private static readonly DIALECT;
+    /** The platform offers an ECDSA host key it then signs wrongly, so RSA is asked for. */
+    private static readonly HOST_KEYS;
+    /** What the device prints when it refuses a line. */
+    private static readonly REFUSED;
+    /** A setting whose password the platform asks for interactively: the command, then the password, then the password again. */
+    private static readonly INTERACTIVE;
+    private static readonly NOT_SAVED;
+    /** Commands that only read. A `?` sent by a script is run, not taken as help, so a line with one is refused. */
+    private static readonly READS;
+    readonly name = "vrp";
+    readonly os: OsSupport;
+    readonly extension = ".cfg";
+    readonly console: ConsoleDialect;
+    unsupported(device: Device): string[];
+    render(device: Device): string;
+    /** What the device runs, credentials scrubbed. */
+    read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
+    /**
+     * What changes, in the order the platform accepts.
+     *
+     * A VLAN list changes by ID. VLANs no longer used go first, with their VLAN interfaces, so their names and numbers are free before a new VLAN takes them: a VLAN name is unique, and a VLAN with an interface cannot be removed. The whole plan is one candidate, so going first leaves nothing half done.
+     */
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+    neighbors(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /**
+     * The neighbors in `display lldp neighbor`: a header per port, `10GE1/0/2 has 1 neighbor(s):`, then a block per neighbor where `Port ID` comes before `System name`. A port Circuit does not know, such as the management port, is left out.
+     */
+    static neighborsOf(device: Device, output: string): Neighbor[];
+    readOnly(command: string): boolean;
+    /** One shell for every command, as the platform takes commands only there. */
+    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    private static undo;
+    /** Secrets the device prints as ciphers and the render writes as markers compare equal. */
+    private static canon;
+    /** Blocks other blocks refer to come first: VRFs, VLANs, the ACL and users, then device-wide lines, then LAGs, ports, VLAN interfaces, OSPF and logins. */
+    private static order;
+    /**
+     * A log host the config no longer has is removed. One at the default level prints as `info-center loghost <address>`, whose head is the bare command, so a new log host would otherwise seem to replace it.
+     */
+    private static removeLoghosts;
+    /** An ACL rule sent over a rule of the same number merges into it: `rule 10 deny` over `rule 10 permit source A` leaves `rule 10 deny source A`. A changed rule is undone first. */
+    private static replaceRules;
+    /** A static route's BFD template sent again replaces the old one whole, options left out included, so the old one is not undone: a route still uses it. */
+    private static keepReplacedWhole;
+    /** `undo alarm` is not a command: the `alarm` view goes once each line in it is undone. */
+    private static emptyAlarmView;
+    /** The VLAN IDs of a `vlan batch` line: `vlan batch 10 20 to 30`. */
+    private static batchIds;
+    private static login;
+    /**
+     * An interactive shell at the user prompt, paging off.
+     *
+     * Every login asks whether to change the password. Answering yes replaces it at once and every stored credential with it, so the answer is always no. Anything sent before the question is answered is taken as the answer.
+     */
+    private static shell;
+    /** Log in on the console with paging off. Returns the console, a way to log in afresh, and how to let the console go. */
+    private static openConsole;
+    /** Log in on the console with paging off, run `work` with a way to log in afresh, and log out. */
+    private static onConsole;
+    /** The configuration in a dump, without the prompt or the stamp of the last change. */
+    private static configurationOf;
+    /** Send one line, answering a confirmation, and return what the device said. */
+    private static sendLine;
+    /** Send a plan into the candidate and commit it. A refused line clears the candidate, which leaves the device as it was. */
+    private static commitPlan;
+    /** Save what runs, so a reboot keeps it. */
+    private static save;
+}

package/dist/types/platforms/vrp/render.d.ts

@@ -0,0 +1,96 @@
+import type { Device } from "../../schema";
+/** Builds the configuration as blocks: a header line, its indented lines, then `#`. */
+export declare class VrpRender {
+    private readonly device;
+    /** The ACL that guards every management service. */
+    private static readonly MANAGEMENT_ACL;
+    /** The ACL that guards SNMP when it has sources of its own. */
+    private static readonly SNMP_ACL;
+    /** The channel that writes the log files on the device's own storage. */
+    private static readonly LOGFILE_CHANNEL;
+    /** How many log files the device keeps when the config sets none. It is not printed. */
+    private static readonly LOGFILES_DEFAULT;
+    /** The BFD multiplier the device uses when the config sets none. It is not printed. */
+    private static readonly BFD_MULTIPLIER;
+    /** The syslog port the device uses when the config sets none. It is not printed. */
+    private static readonly SYSLOG_PORT;
+    /** A severity as the platform spells it. `debugging` is the default for a log host and for the log files, and is not printed. */
+    private static readonly LOG_LEVEL;
+    /** The OSPF process number. One process per device. */
+    private static readonly OSPF_PROCESS;
+    /** The sFlow collectors are numbered from here, in the order the config lists them. */
+    private static readonly FIRST_COLLECTOR;
+    /** The SNMPv3 group every user joins, with read access to everything. */
+    private static readonly SNMP_GROUP;
+    /** An alarm severity as the platform prints it. */
+    private static readonly ALARM_SEVERITY;
+    private static readonly USER_LEVEL;
+    private static readonly SNMP_AUTH;
+    private static readonly SNMP_PRIVACY;
+    /** Layer 2 ACLs, one for each set of ethertypes a port takes, are numbered from here. */
+    private static readonly FIRST_L2_ACL;
+    /** An ethertype as the platform prints it in a layer 2 ACL rule: `0x0800` prints as `type ip`. */
+    private static readonly ETHERTYPE;
+    private readonly lines;
+    private readonly vlans;
+    private readonly interfaces;
+    private readonly lagNumbers;
+    /** The layer 2 ACL of each set of ethertypes the ports take, by the set written as `ipv4 ipv6 arp`. */
+    private readonly ethertypeAcls;
+    private constructor();
+    /** The whole configuration the device should run. Secrets appear as markers, never values. */
+    static of(device: Device): string;
+    /** `99 999 to 1000 2000`, the platform's compression of a VLAN list. */
+    static vlanBatch(ids: number[]): string;
+    private build;
+    private line;
+    /** A header and its lines. A block with nothing in it is still written, so that its header exists. */
+    private block;
+    private separator;
+    private text;
+    private vlanId;
+    /** What the platform calls a port, a LAG or a VLAN interface. */
+    private nameOf;
+    private system;
+    private vlanBlocks;
+    /** One ACL guards every management service: a permit per source, then an explicit deny. */
+    private managementAcl;
+    /** SNMP with sources of its own gets an ACL of its own, built the same way. */
+    private ethertypeAclBlocks;
+    private snmpAcl;
+    /** A permit per source, then an explicit deny. The platform prints the wildcard of a single address as `0`. */
+    private static aclRules;
+    private users;
+    private vrfs;
+    private static lagMode;
+    /** Layer 2 membership of a port or LAG. */
+    private switching;
+    private static vrrpLines;
+    private vlanInterface;
+    /** A port the config does not declare is shut down. A LAG member holds only its membership. */
+    private physicalPort;
+    /**
+     * Static routes. A route watched by BFD needs a BFD template for its next hop first, from the device's own address on that network, with the device's timers.
+     */
+    private staticRoutes;
+    /** The device's own IPv4 address on the network that holds `nextHop`. `unsupported()` refuses a watched route without one. */
+    static localAddressTo(device: Device, nextHop: string): string | undefined;
+    /** The BFD timers of `routing.bfd`, after `prefix`, or nothing for the platform's own. The platform does not print its default multiplier, 3. */
+    private bfdTimers;
+    /**
+     * OSPF for IPv4. An area announces the networks of its interfaces; a passive interface is silent. `unsupported()` refuses IPv6.
+     */
+    private ospf;
+    private wantsBfd;
+    /** sFlow from the management address, to each collector in order. */
+    private flowExport;
+    /** The log files' level and count, then each syslog collector. A default the device does not print is not written: level `debugging`, 200 files, port 514. */
+    private logging;
+    /** Alarms raised at another severity than the platform's own, in the `alarm` view. The platform prints a severity with a capital, `Warning`. */
+    private alarms;
+    /** SNMP version 2c with one read community, version 3 with users in one read-only group, or both. */
+    private snmp;
+    private ssh;
+    /** The console logs in with the device's users unless the config gives it a password of its own. Remote logins always use the users. */
+    private userInterfaces;
+}

package/dist/types/schema/common.d.ts

@@ -10,12 +10,18 @@ export type Secret = {
     /** Path of the file with the value, relative to the config file. */
     readonly secret_file: string;
 };
-/** An address without a length, IPv4 or IPv6, for example `10.0.0.1`. */
-export type IP = string;
-/** A network with its length, for example `10.0.0.0/24`. */
-export type Prefix = string;
-/** An interface address with its length, for example `10.0.0.1/24`. */
-export type Address = string;
+/** An IPv4 address, four numbers with dots between them, for example `10.0.0.1`. The type checks the shape; `circuit validate` checks each number is 0 to 255. */
+export type IPv4 = `${number}.${number}.${number}.${number}`;
+/** An IPv6 address, groups with colons between them, for example `2001:db8::1`. The type only checks there is a colon; `circuit validate` checks the rest. */
+export type IPv6 = `${string}:${string}`;
+/** An address without a length, IPv4 or IPv6, for example `10.0.0.1` or `2001:db8::1`. */
+export type IP = IPv4 | IPv6;
+/** A network with its length, for example `10.0.0.0/24` or `2001:db8::/32`. */
+export type Prefix = `${IP}/${number}`;
+/** An interface address with its length, for example `10.0.0.1/24` or `2001:db8::1/64`. */
+export type InterfaceAddress = `${IP}/${number}`;
+/** A MAC address, six pairs of hex digits with colons between them, for example `02:00:00:00:00:01`. */
+export type MacAddress = `${string}:${string}:${string}:${string}:${string}:${string}`;
 /** An address family. */
 export type Family = "ipv4" | "ipv6";
 /** Bits per second, for example `2G`, `500M` or `64k`. */

package/dist/types/schema/index.d.ts

@@ -5,3 +5,4 @@ export type * from "./interfaces";
 export type * from "./policy";
 export type * from "./routing";
 export type * from "./system";
+export type * from "./time-zones";

package/dist/types/schema/interfaces.d.ts

@@ -1,4 +1,4 @@
-import type { Address, IP, Prefix, Secret } from "./common";
+import type { InterfaceAddress, IP, MacAddress, Prefix, Secret } from "./common";
 /** A VLAN. Its key in `vlans` is its name. */
 export type Vlan = {
     /** The VLAN's number on the wire, 1 to 4094. */
@@ -12,6 +12,8 @@ export type Threshold = {
 } | {
     percent: number;
 };
+/** A kind of frame, by the ethertype in its header: `ipv4` is 0x0800, `ipv6` 0x86DD, `arp` 0x0806. */
+export type Ethertype = "ipv4" | "ipv6" | "arp";
 /** A virtual router address shared with other devices on the same segment, RFC 5798. */
 export type Vrrp = {
     /** Virtual router number, 1 to 255. The same on every device sharing the address. */
@@ -28,8 +30,8 @@ export type Vrrp = {
 /** Layer 3 settings shared by every interface that can have an address. */
 export type Routed<F extends string> = {
     /** Addresses with their length. Use `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
-    addresses?: readonly (Address | {
-        address: Address;
+    addresses?: readonly (InterfaceAddress | {
+        address: InterfaceAddress;
         peer: IP;
     })[];
     /** Send IPv6 router advertisements on this interface. Off when absent. */
@@ -77,6 +79,10 @@ export type Switched<V extends string> = {
         multicast?: Threshold;
         unknown_unicast?: Threshold;
     };
+    /** The most MAC addresses this port or LAG learns, 1 or more. Frames from any other source address are dropped. An exchange sets 1 on a member port, so each member sends from one router only. No limit when absent. */
+    mac_limit?: number;
+    /** The only kinds of frame this port or LAG takes in; any other kind is dropped. An exchange takes `ipv4`, `ipv6` and `arp` on a member port. Every kind when absent. */
+    ethertypes?: readonly Ethertype[];
 };
 /** The other end of a cable: another device and its port. Both ends must agree on how they are switched. */
 export type Link = {
@@ -117,7 +123,7 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     /**
      * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
      */
-    mac?: string;
+    mac?: MacAddress;
 };
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
 export type Loopback<F extends string> = Base<F> & {
@@ -151,8 +157,10 @@ export type Vxlan<F extends string> = Base<F> & {
     /** UDP port. 4789 when absent. */
     port?: number;
     /** Fixed MAC address, so a rebuild keeps the one the far side learned. */
-    mac?: string;
+    mac?: MacAddress;
 };
+/** A host and a UDP port, `host:port`, for example `203.0.113.10:51820` or `vpn.example.net:51820`. */
+export type Endpoint = `${string}:${number}`;
 /** One peer of a WireGuard interface. */
 export type WireGuardPeer = {
     /** Who or what the peer is. */
@@ -162,7 +170,7 @@ export type WireGuardPeer = {
     /** Addresses the peer may send from and that are routed to it. */
     allowed_addresses: readonly Prefix[];
     /** `host:port`, for a peer this side dials. The peer dials in when absent. */
-    endpoint?: string;
+    endpoint?: Endpoint;
     /** Seconds between keepalives, for a peer behind NAT. None when absent. */
     keepalive?: number;
     /** What a generated client config routes into the tunnel. Affects no forwarding here. */

package/dist/types/schema/policy.d.ts

@@ -1,4 +1,12 @@
 import type { Family, IP, Prefix } from "./common";
+/** A standard BGP community, `asn:value`, for example `64500:100`. Each part is 0 to 65535. */
+export type StandardCommunity = `${number}:${number}`;
+/** A large BGP community, `asn:function:parameter`, for example `64500:1:6939`. Each part is 0 to 4294967295. */
+export type LargeCommunity = `${number}:${number}:${number}`;
+/** A standard community to remove. `*` stands for any value of a part, as in `64500:*`. */
+export type StandardCommunityPattern = `${number | "*"}:${number | "*"}`;
+/** A large community to remove. `*` stands for any value of a part, as in `64500:*:*`. */
+export type LargeCommunityPattern = `${number | "*"}:${number | "*"}:${number | "*"}`;
 /** Registries a prefix set can be fetched from. */
 export type Registry = "ripe-stat";
 /** Prefixes listed here, or fetched from a registry by `refresh` and never typed by hand. */
@@ -38,9 +46,9 @@ export type Match<S extends string> = {
     /** The route's origin validation state. */
     rpki?: "valid" | "invalid" | "not-found";
     /** Has this standard community, `asn:value`. */
-    community?: string;
+    community?: StandardCommunity;
     /** Has this large community, `asn:function:parameter`. */
-    large_community?: string;
+    large_community?: LargeCommunity;
 };
 /** Changes to a route. In community lists to remove, `*` stands for any value of a field, as in `64500:*:*`. */
 export type Sets = {
@@ -51,17 +59,17 @@ export type Sets = {
     /** Prepend our own AS this many times, to make the path look longer. */
     prepend?: number;
     /** Replace the route's standard communities with these. */
-    communities?: readonly string[];
+    communities?: readonly StandardCommunity[];
     /** Add these standard communities. */
-    add_communities?: readonly string[];
-    /** Remove standard communities matching these. */
-    remove_communities?: readonly string[];
+    add_communities?: readonly StandardCommunity[];
+    /** Remove standard communities matching these. A part may be `*`. */
+    remove_communities?: readonly StandardCommunityPattern[];
     /** Replace the route's large communities with these. */
-    large_communities?: readonly string[];
+    large_communities?: readonly LargeCommunity[];
     /** Add these large communities. */
-    add_large_communities?: readonly string[];
-    /** Remove large communities matching these. */
-    remove_large_communities?: readonly string[];
+    add_large_communities?: readonly LargeCommunity[];
+    /** Remove large communities matching these. A part may be `*`. */
+    remove_large_communities?: readonly LargeCommunityPattern[];
     /** Next hop for the route. */
     next_hop?: IP;
     /** Source address for traffic the device itself sends to the route. Applies to routes of the same family as the address. */