@takodotid/circuit 0.34.3 → 0.35.0

package/src/schema/interfaces.ts

@@ -1,4 +1,4 @@
-import type { Address, IP, Prefix, Secret } from "./common";
+import type { InterfaceAddress, IP, MacAddress, Prefix, Secret } from "./common";
 
 /** A VLAN. Its key in `vlans` is its name. */
 export type Vlan = {
@@ -11,6 +11,9 @@ export type Vlan = {
 /** A storm-control threshold: packets per second, or percent of the link's speed. */
 export type Threshold = { pps: number } | { percent: number };
 
+/** A kind of frame, by the ethertype in its header: `ipv4` is 0x0800, `ipv6` 0x86DD, `arp` 0x0806. */
+export type Ethertype = "ipv4" | "ipv6" | "arp";
+
 /** A virtual router address shared with other devices on the same segment, RFC 5798. */
 export type Vrrp = {
     /** Virtual router number, 1 to 255. The same on every device sharing the address. */
@@ -28,7 +31,7 @@ export type Vrrp = {
 /** Layer 3 settings shared by every interface that can have an address. */
 export type Routed<F extends string> = {
     /** Addresses with their length. Use `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
-    addresses?: readonly (Address | { address: Address; peer: IP })[];
+    addresses?: readonly (InterfaceAddress | { address: InterfaceAddress; peer: IP })[];
     /** Send IPv6 router advertisements on this interface. Off when absent. */
     ipv6_ra?: boolean;
     /** Overrides the device's `hardware_offload` for traffic routed through this interface. Software forwarding is what makes the firewall apply. */
@@ -77,6 +80,10 @@ export type Switched<V extends string> = {
         multicast?: Threshold;
         unknown_unicast?: Threshold;
     };
+    /** The most MAC addresses this port or LAG learns, 1 or more. Frames from any other source address are dropped. An exchange sets 1 on a member port, so each member sends from one router only. No limit when absent. */
+    mac_limit?: number;
+    /** The only kinds of frame this port or LAG takes in; any other kind is dropped. An exchange takes `ipv4`, `ipv6` and `arp` on a member port. Every kind when absent. */
+    ethertypes?: readonly Ethertype[];
 };
 
 /** The other end of a cable: another device and its port. Both ends must agree on how they are switched. */
@@ -122,7 +129,7 @@ export type VlanInterface<V extends string, F extends string> = Base<F> & {
     /**
      * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
      */
-    mac?: string;
+    mac?: MacAddress;
 };
 
 /** An interface that is always up and is on no link, for addresses that must not depend on one. */
@@ -159,9 +166,12 @@ export type Vxlan<F extends string> = Base<F> & {
     /** UDP port. 4789 when absent. */
     port?: number;
     /** Fixed MAC address, so a rebuild keeps the one the far side learned. */
-    mac?: string;
+    mac?: MacAddress;
 };
 
+/** A host and a UDP port, `host:port`, for example `203.0.113.10:51820` or `vpn.example.net:51820`. */
+export type Endpoint = `${string}:${number}`;
+
 /** One peer of a WireGuard interface. */
 export type WireGuardPeer = {
     /** Who or what the peer is. */
@@ -171,7 +181,7 @@ export type WireGuardPeer = {
     /** Addresses the peer may send from and that are routed to it. */
     allowed_addresses: readonly Prefix[];
     /** `host:port`, for a peer this side dials. The peer dials in when absent. */
-    endpoint?: string;
+    endpoint?: Endpoint;
     /** Seconds between keepalives, for a peer behind NAT. None when absent. */
     keepalive?: number;
     /** What a generated client config routes into the tunnel. Affects no forwarding here. */

package/src/schema/policy.ts

@@ -1,5 +1,17 @@
 import type { Family, IP, Prefix } from "./common";
 
+/** A standard BGP community, `asn:value`, for example `64500:100`. Each part is 0 to 65535. */
+export type StandardCommunity = `${number}:${number}`;
+
+/** A large BGP community, `asn:function:parameter`, for example `64500:1:6939`. Each part is 0 to 4294967295. */
+export type LargeCommunity = `${number}:${number}:${number}`;
+
+/** A standard community to remove. `*` stands for any value of a part, as in `64500:*`. */
+export type StandardCommunityPattern = `${number | "*"}:${number | "*"}`;
+
+/** A large community to remove. `*` stands for any value of a part, as in `64500:*:*`. */
+export type LargeCommunityPattern = `${number | "*"}:${number | "*"}:${number | "*"}`;
+
 /** Registries a prefix set can be fetched from. */
 export type Registry = "ripe-stat";
 
@@ -37,9 +49,9 @@ export type Match<S extends string> = {
     /** The route's origin validation state. */
     rpki?: "valid" | "invalid" | "not-found";
     /** Has this standard community, `asn:value`. */
-    community?: string;
+    community?: StandardCommunity;
     /** Has this large community, `asn:function:parameter`. */
-    large_community?: string;
+    large_community?: LargeCommunity;
 };
 
 /** Changes to a route. In community lists to remove, `*` stands for any value of a field, as in `64500:*:*`. */
@@ -51,17 +63,17 @@ export type Sets = {
     /** Prepend our own AS this many times, to make the path look longer. */
     prepend?: number;
     /** Replace the route's standard communities with these. */
-    communities?: readonly string[];
+    communities?: readonly StandardCommunity[];
     /** Add these standard communities. */
-    add_communities?: readonly string[];
-    /** Remove standard communities matching these. */
-    remove_communities?: readonly string[];
+    add_communities?: readonly StandardCommunity[];
+    /** Remove standard communities matching these. A part may be `*`. */
+    remove_communities?: readonly StandardCommunityPattern[];
     /** Replace the route's large communities with these. */
-    large_communities?: readonly string[];
+    large_communities?: readonly LargeCommunity[];
     /** Add these large communities. */
-    add_large_communities?: readonly string[];
-    /** Remove large communities matching these. */
-    remove_large_communities?: readonly string[];
+    add_large_communities?: readonly LargeCommunity[];
+    /** Remove large communities matching these. A part may be `*`. */
+    remove_large_communities?: readonly LargeCommunityPattern[];
     /** Next hop for the route. */
     next_hop?: IP;
     /** Source address for traffic the device itself sends to the route. Applies to routes of the same family as the address. */

package/src/schema/routing.ts

@@ -10,6 +10,8 @@ export type StaticRoute<I extends string, F extends string> = {
     interface?: I;
     /** Discard matching traffic. The usual way to originate an aggregate. */
     blackhole?: true;
+    /** Withdraw the route while BFD finds `via` dead, and put it back once `via` answers again. Needs `via`. */
+    bfd?: true;
     /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
     distance?: number;
     /** The VRF the route is in. The default table when absent. */
@@ -75,6 +77,14 @@ export type Bgp<P extends string, G extends string> = {
     neighbors?: Record<string, Neighbor<P, G>>;
 };
 
+/** How fast BFD notices a dead neighbor: after `multiplier` packets in a row are missed, so in `interval` times `multiplier` milliseconds. */
+export type Bfd = {
+    /** Milliseconds between the packets this device sends, and the shortest gap it asks of the neighbor. */
+    interval: number;
+    /** How many packets in a row may be missed before the neighbor is declared down. */
+    multiplier: number;
+};
+
 /** A route origin validation server, RFC 8210. */
 export type RpkiServer = {
     /** Where the validator listens. */
@@ -97,12 +107,15 @@ export type OspfInterface = {
     bfd?: boolean;
 };
 
+/** An OSPF area ID, written as four numbers with dots between them, for example `0.0.0.0` for the backbone. */
+export type OspfAreaId = `${number}.${number}.${number}.${number}`;
+
 /** OSPF, version 2 for IPv4 and version 3 for IPv6. */
 export type Ospf<I extends string> = {
     /** Which versions run. IPv4 when absent. */
     families?: readonly Family[];
     /** Areas keyed by area ID, for example `0.0.0.0`, each with the interfaces in it. */
-    areas: Record<string, { interfaces: Partial<Record<I, OspfInterface>> }>;
+    areas: Record<OspfAreaId, { interfaces: Partial<Record<I, OspfInterface>> }>;
     /** Routes from other sources announced into OSPF. */
     redistribute?: readonly ("connected" | "static")[];
 };
@@ -119,4 +132,6 @@ export type Routing<P extends string, G extends string, I extends string, F exte
     ospf?: Ospf<I>;
     /** Validators answering route origin validation. */
     rpki?: readonly RpkiServer[];
+    /** BFD timers for every BFD session on the device: BGP, OSPF and static routes. The platform's own when absent; Junos has none, so Circuit sends every 300 ms there. Both ends of a link should agree. */
+    bfd?: Bfd;
 };

package/src/schema/system.ts

@@ -1,9 +1,16 @@
-import type { IP, Prefix, Secret, Severity } from "./common";
+import type { IP, MacAddress, Prefix, Secret, Severity } from "./common";
+import type { TimeZone } from "./time-zones";
+
+/** A software release track, as RouterOS names them. `long-term` changes least; `development` is the newest and least tested. */
+export type ReleaseChannel = "long-term" | "stable" | "testing" | "development";
+
+/** How bad an alarm is, most severe first, as ITU-T X.733 ranks them. */
+export type AlarmSeverity = "critical" | "major" | "minor" | "warning";
 
 /** Device-wide settings. */
 export type System = {
-    /** IANA zone, for example `Asia/Jakarta`. UTC when absent. */
-    timezone?: string;
+    /** IANA zone, for example `Asia/Jakarta`. The editor suggests every name. UTC when absent. */
+    timezone?: TimeZone;
     /** Shown at login. */
     banner?: string;
     /** Resolvers the device uses. */
@@ -40,8 +47,10 @@ export type System = {
             level: Severity;
         }[];
     };
-    /** Software release track the device updates from. */
-    release_channel?: string;
+    /** Software release track the device updates from. `stable` when absent. */
+    release_channel?: ReleaseChannel;
+    /** Alarms raised at another severity than the platform's own, keyed by the alarm's name as the platform spells it, such as `hwOpticalUnAuthorized` on VRP. */
+    alarms?: Record<string, { severity: AlarmSeverity }>;
     /** Read optic temperature, power and voltage. */
     transceiver_monitoring?: boolean;
     /** Host behaviour of the IP stack. */
@@ -154,7 +163,8 @@ export type DhcpServer<I extends string> = {
     /** Addresses fixed to a MAC. */
     reservations?: readonly {
         address: IP;
-        mac: string;
+        /** The client's MAC address. */
+        mac: MacAddress;
         /** Whose address it is. */
         description?: string;
     }[];