@takodotid/circuit 0.34.3 → 0.35.0

package/dist/helpers/index.js

@@ -0,0 +1,594 @@
+import {
+  Address2
+} from "../chunks/index-n7w3tg5y.js";
+
+// src/helpers/bgp.ts
+class Bgp {
+  static PREPENDS = [
+    ["once", 1],
+    ["twice", 2],
+    ["three_times", 3]
+  ];
+  static sanity(lengths = {}) {
+    const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
+    const ipv6 = lengths.ipv6 ?? { min: 16, max: 48 };
+    return [
+      {
+        description: `IPv4 shorter than /${ipv4.min}`,
+        match: { family: "ipv4", prefix_length: { max: ipv4.min - 1 } },
+        action: "reject"
+      },
+      {
+        description: `IPv4 longer than /${ipv4.max}`,
+        match: { family: "ipv4", prefix_length: { min: ipv4.max + 1 } },
+        action: "reject"
+      },
+      {
+        description: `IPv6 shorter than /${ipv6.min}`,
+        match: { family: "ipv6", prefix_length: { max: ipv6.min - 1 } },
+        action: "reject"
+      },
+      {
+        description: `IPv6 longer than /${ipv6.max}`,
+        match: { family: "ipv6", prefix_length: { min: ipv6.max + 1 } },
+        action: "reject"
+      },
+      { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" }
+    ];
+  }
+  static neighborPolicies(device) {
+    const bgp = device.routing?.bgp;
+    return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+      const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+      return {
+        name,
+        address: neighbor.address,
+        role: neighbor.role ?? group?.role,
+        import: neighbor.import ?? group?.import,
+        export: neighbor.export ?? group?.export
+      };
+    });
+  }
+  static offered(device, policy) {
+    const rules = policy ? device.policies?.[policy] ?? [] : [];
+    return rules.filter((rule) => rule.action === "accept" && rule.match?.prefix).map((rule) => rule.match.prefix);
+  }
+  static communityScheme(scheme) {
+    const { asn } = scheme;
+    const community = (fn, parameter) => `${asn}:${fn}:${parameter}`;
+    const anyOf = (fn) => `${asn}:${fn}:*`;
+    const written = (fn, parameter) => `${asn}:${fn}:${parameter}`;
+    const ours = {
+      standard: [`${asn}:*`],
+      large: [`${asn}:*:*`]
+    };
+    const learnedFrom = Object.fromEntries(Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => [
+      name,
+      community(scheme.learned_from.function, value)
+    ]));
+    const information = [scheme.learned_from?.function, scheme.learned_at?.function, scheme.learned_from_as].filter((fn) => fn !== undefined);
+    const tag = (neighborClass, neighborAs, options = {}) => {
+      const { site, trusted = false } = options;
+      if (scheme.learned_at && site === undefined)
+        throw new Error(`Bgp.communityScheme: tag for AS${neighborAs} needs a site, for learned_at`);
+      return {
+        description: `Learned from AS${neighborAs}`,
+        set: {
+          remove_communities: ours.standard,
+          remove_large_communities: trusted ? information.map(anyOf) : ours.large,
+          add_large_communities: [
+            ...scheme.learned_from ? [community(scheme.learned_from.function, scheme.learned_from.classes[neighborClass])] : [],
+            ...scheme.learned_at ? [community(scheme.learned_at.function, site)] : [],
+            ...scheme.learned_from_as !== undefined ? [community(scheme.learned_from_as, neighborAs)] : []
+          ]
+        }
+      };
+    };
+    const blackhole = (prefixSets) => {
+      const fn = scheme.blackhole?.function;
+      if (fn === undefined)
+        throw new Error("Bgp.communityScheme: blackhole needs a function number in the scheme");
+      return prefixSets.map((prefixSet) => ({
+        description: "Blackhole, asked by the neighbor",
+        match: { large_community: community(fn, 0), prefix_set: prefixSet },
+        set: { blackhole: true },
+        action: "accept"
+      }));
+    };
+    const actions = (neighborAs) => {
+      const passOn = scheme.blackhole?.upstreams?.[neighborAs];
+      return [
+        ...scheme.blackhole !== undefined && !passOn ? [
+          {
+            description: "Blackholed here, never announced",
+            match: { large_community: community(scheme.blackhole.function, 0) },
+            action: "reject"
+          }
+        ] : [],
+        ...scheme.do_not_announce !== undefined ? [
+          {
+            description: "Asked not to be announced anywhere",
+            match: { large_community: community(scheme.do_not_announce, 0) },
+            action: "reject"
+          },
+          {
+            description: `Asked not to be announced to AS${neighborAs}`,
+            match: { large_community: community(scheme.do_not_announce, neighborAs) },
+            action: "reject"
+          }
+        ] : [],
+        ...scheme.blackhole !== undefined && passOn ? [
+          {
+            description: `Blackhole passed on to AS${neighborAs}`,
+            match: { large_community: community(scheme.blackhole.function, 0) },
+            set: {
+              remove_communities: ours.standard,
+              remove_large_communities: ours.large,
+              add_communities: [passOn]
+            },
+            action: "accept"
+          }
+        ] : [],
+        ...Bgp.PREPENDS.flatMap(([name, times]) => {
+          const fn = scheme.prepend?.[name];
+          if (fn === undefined)
+            return [];
+          return [
+            {
+              description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
+              match: { large_community: community(fn, neighborAs) },
+              set: { prepend: times }
+            }
+          ];
+        }),
+        {
+          description: "Our communities stay inside our network",
+          set: { remove_communities: ours.standard, remove_large_communities: ours.large }
+        }
+      ];
+    };
+    const catalogue = [
+      ...Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
+        community: written(scheme.learned_from.function, value),
+        description: `Learned from ${Bgp.article(name)}`
+      })),
+      ...scheme.learned_at ? [
+        ...Object.entries(scheme.learned_at.sites ?? {}).map(([site, name]) => ({
+          community: written(scheme.learned_at.function, site),
+          description: `Learned in ${name}`
+        })),
+        { community: written(scheme.learned_at.function, "nnn"), description: "Learned at site $0" }
+      ] : [],
+      ...scheme.learned_from_as !== undefined ? [{ community: written(scheme.learned_from_as, "nnn"), description: "Learned from AS$0" }] : [],
+      ...scheme.do_not_announce !== undefined ? [
+        { community: written(scheme.do_not_announce, 0), description: "Do not announce to anyone" },
+        { community: written(scheme.do_not_announce, "nnn"), description: "Do not announce to AS$0" }
+      ] : [],
+      ...Bgp.PREPENDS.flatMap(([name]) => {
+        const fn = scheme.prepend?.[name];
+        return fn === undefined ? [] : [{ community: written(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
+      }),
+      ...scheme.blackhole !== undefined ? [
+        {
+          community: written(scheme.blackhole.function, 0),
+          description: Object.keys(scheme.blackhole.upstreams ?? {}).length ? `Blackhole: dropped in AS${asn} and by its upstreams that take it` : `Blackhole: dropped in AS${asn}, not announced further`
+        }
+      ] : []
+    ];
+    return { community, learned_from: learnedFrom, tag, actions, blackhole, catalogue };
+  }
+  static article(word) {
+    return /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
+  }
+}
+// src/helpers/checks.ts
+class Checks {
+  static exportsEndInReject = (devices) => {
+    const findings = [];
+    for (const device of devices) {
+      for (const neighbor of Bgp.neighborPolicies(device)) {
+        if (neighbor.role === "customer")
+          continue;
+        const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
+        if (neighbor.export && (last?.action !== "reject" || last.match)) {
+          findings.push({
+            level: "error",
+            device: device.name,
+            message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`
+          });
+        }
+      }
+    }
+    return findings;
+  };
+  static tunnelsOutsideOffered = (devices) => {
+    const findings = [];
+    for (const device of devices) {
+      for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+        if (iface.type !== "gre" && iface.type !== "vxlan")
+          continue;
+        const subnets = (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+        for (const neighbor of Bgp.neighborPolicies(device)) {
+          if (!subnets.some((subnet) => Address2.contains(subnet, neighbor.address)))
+            continue;
+          for (const prefix of Bgp.offered(device, neighbor.export)) {
+            if (Address2.contains(prefix, iface.local)) {
+              findings.push({
+                level: "error",
+                device: device.name,
+                message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`
+              });
+            }
+          }
+        }
+      }
+    }
+    return findings;
+  };
+  static nativeVlansAreDeadEnds = (devices) => {
+    const findings = [];
+    for (const device of devices) {
+      const carriers = [
+        ...Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ what: `port ${name}`, settings: port }] : []),
+        ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [{ what: `LAG ${name}`, settings: iface }] : [])
+      ];
+      const nativeOn = new Map;
+      for (const { what, settings } of carriers) {
+        if (settings.native_vlan)
+          nativeOn.set(settings.native_vlan, [...nativeOn.get(settings.native_vlan) ?? [], what]);
+      }
+      for (const [vlan, trunks] of nativeOn) {
+        const report = (message) => findings.push({ level: "error", device: device.name, message: `native VLAN ${vlan} ${message}` });
+        if (trunks.length > 1)
+          report(`is native on ${trunks.join(", ")}: give each trunk its own`);
+        const members = carriers.filter(({ settings }) => Checks.vlansOf(settings).includes(vlan));
+        for (const { what } of members)
+          report(`is also an access or tagged VLAN on ${what}`);
+      }
+    }
+    return findings;
+  };
+  static vlansOf(port) {
+    return [port.access_vlan, ...port.trunk_vlans ?? []].filter((vlan) => vlan !== undefined);
+  }
+  static trustBoundary(boundary) {
+    return (devices) => {
+      const untrusted = new Set(boundary.untrusted);
+      const routers = new Set(boundary.routers);
+      const extended = (a, b) => (boundary.extended ?? []).some(([x, y]) => x === a && y === b || x === b && y === a);
+      const findings = [];
+      for (const device of devices) {
+        const isRouter = routers.has(device.name);
+        const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ name, port }] : []);
+        const carriers = [
+          ...ports.filter(({ port }) => !port.lag).map(({ name, port }) => ({
+            what: `port ${name}`,
+            carried: Checks.vlansOf(port),
+            faces: port.link ? [port.link.device] : []
+          })),
+          ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [
+            {
+              what: `LAG ${name}`,
+              carried: Checks.vlansOf(iface),
+              faces: ports.filter(({ port }) => port.lag === name && port.link).map(({ port }) => port.link.device)
+            }
+          ] : [])
+        ];
+        for (const { what, carried, faces } of carriers) {
+          const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
+          const facesRouter = isRouter || faces.some((name) => routers.has(name));
+          const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
+          if (mixes && !facesRouter && !isExtension) {
+            findings.push({
+              level: "error",
+              device: device.name,
+              message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`
+            });
+          }
+        }
+        if (isRouter)
+          continue;
+        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+          if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
+            findings.push({
+              level: "error",
+              device: device.name,
+              message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`
+            });
+          }
+        }
+      }
+      return findings;
+    };
+  }
+}
+// src/helpers/route-server.ts
+class RouteServerConfig {
+  static LENGTHS = {
+    ipv4: { shortest: 8, longest: 24 },
+    ipv6: { shortest: 12, longest: 48 }
+  };
+  static RULES = [
+    "# 1. the first AS in its path is the member's own,",
+    "# 2. its next hop is the member's own address on the peering LAN,",
+    "# 3. it is not inside the peering LAN,",
+    `# 4. it is /${RouteServerConfig.LENGTHS.ipv4.shortest} to /${RouteServerConfig.LENGTHS.ipv4.longest} long for IPv4, /${RouteServerConfig.LENGTHS.ipv6.shortest} to /${RouteServerConfig.LENGTHS.ipv6.longest} for IPv6.`
+  ];
+  static bird(server, lan, members) {
+    const families = RouteServerConfig.families(server, lan);
+    const sessions = [];
+    const names = new Map;
+    for (const member of members) {
+      for (const family of families) {
+        const neighbor = member[family];
+        if (!neighbor)
+          continue;
+        const name = RouteServerConfig.protocolName(member.name, family);
+        const holder = names.get(name);
+        if (holder)
+          throw new Error(`members ${holder} and ${member.name} would both have session ${name}`);
+        names.set(name, member.name);
+        sessions.push(RouteServerConfig.birdSession(name, server, member, family, neighbor, lan[family]));
+      }
+    }
+    const header = [
+      `# ${server.name}, a route server of the exchange, for BIRD 2.`,
+      "# Circuit wrote it from the member list: change the list, not this file.",
+      "",
+      `router id ${server.router_id};`,
+      "",
+      "# Learns the server's interfaces and addresses. It sends no route anywhere.",
+      "protocol device {",
+      "}",
+      "",
+      "# One session per member and family. A route a member sends is kept only when:",
+      ...RouteServerConfig.RULES,
+      "# Every member gets every route the others sent, as they sent it.",
+      "# A route that is not kept stays visible: birdc show route filtered."
+    ];
+    return [...header, ...sessions.flatMap((session) => ["", session])].join(`
+`) + `
+`;
+  }
+  static openbgpd(server, lan, members) {
+    const families = RouteServerConfig.families(server, lan).filter((family) => members.some((member) => member[family]));
+    const lines = [
+      `# ${server.name}, a route server of the exchange, for OpenBGPD.`,
+      "# Circuit wrote it from the member list: change the list, not this file.",
+      "",
+      `AS ${server.asn}`,
+      `router-id ${server.router_id}`,
+      "",
+      "# The server passes routes on and carries no traffic, so it keeps them out of its own routing table.",
+      "fib-update no",
+      "",
+      "# Members see each other's paths as they were sent: the server never adds its own AS, and passes MED and communities on untouched.",
+      "transparent-as yes",
+      "",
+      "# A route that is not kept stays visible: bgpctl show rib filtered.",
+      "rde rib Loc-RIB include filtered"
+    ];
+    for (const family of families) {
+      lines.push("", ...RouteServerConfig.openbgpdGroup(server, family, members));
+    }
+    lines.push("", "# A route a member sends is kept only when:", ...RouteServerConfig.RULES);
+    lines.push("# The last rule a route matches decides, and a route no rule allows is dropped.");
+    for (const family of families) {
+      const { shortest, longest } = RouteServerConfig.LENGTHS[family];
+      const any = family === "ipv4" ? "0.0.0.0/0" : "::/0";
+      lines.push(`allow from group "${family} members" peer-as neighbor-as nexthop neighbor prefix ${any} prefixlen ${shortest} - ${longest}`);
+    }
+    for (const family of families) {
+      lines.push(`deny from any prefix ${Address2.prefixOf(lan[family])} or-longer`);
+    }
+    lines.push("", "# Every member gets every route the others sent, as they sent it.", "allow to any");
+    return lines.join(`
+`) + `
+`;
+  }
+  static families(server, lan) {
+    const families = ["ipv4", "ipv6"].filter((family) => server[family]);
+    if (!families.length)
+      throw new Error(`route server ${server.name} has no address on the peering LAN`);
+    for (const family of families) {
+      const prefix = lan[family];
+      const address = server[family];
+      if (!prefix || !Address2.contains(prefix, address))
+        throw new Error(`${address} of route server ${server.name} is outside the peering LAN`);
+    }
+    return families;
+  }
+  static protocolName(member, family) {
+    const name = `${member.toLowerCase().replace(/[^a-z0-9_]/g, "_")}_${family}`;
+    return /^[a-z]/.test(name) ? name : `m_${name}`;
+  }
+  static description(member) {
+    return `"${member.name.replace(/["\\]/g, "")}, AS${member.asn}"`;
+  }
+  static birdSession(name, server, member, family, neighbor, lan) {
+    const { shortest, longest } = RouteServerConfig.LENGTHS[family];
+    return [
+      `protocol bgp ${name} {`,
+      `    description ${RouteServerConfig.description(member)};`,
+      `    local ${server[family]} as ${server.asn};`,
+      `    neighbor ${neighbor} as ${member.asn};`,
+      "    rs client;",
+      `    ${family} {`,
+      "        import keep filtered on;",
+      "        import filter {",
+      `            if bgp_path.first != ${member.asn} then reject;`,
+      `            if bgp_next_hop != ${neighbor} then reject;`,
+      `            if net ~ [ ${Address2.prefixOf(lan)}+ ] then reject;`,
+      `            if net.len < ${shortest} || net.len > ${longest} then reject;`,
+      "            accept;",
+      "        };",
+      "        export all;",
+      "    };",
+      "}"
+    ].join(`
+`);
+  }
+  static openbgpdGroup(server, family, members) {
+    const lines = [
+      `# One session per member with an ${family === "ipv4" ? "IPv4" : "IPv6"} address.`,
+      `group "${family} members" {`,
+      `    local-address ${server[family]}`,
+      "    # A route whose first AS is not the member's own is dropped by the rules below. The default would close the whole session.",
+      "    enforce neighbor-as no"
+    ];
+    for (const member of members) {
+      const neighbor = member[family];
+      if (!neighbor)
+        continue;
+      lines.push(`    neighbor ${neighbor} {`, `        remote-as ${member.asn}`, `        descr ${RouteServerConfig.description(member)}`, "    }");
+    }
+    lines.push("}");
+    return lines;
+  }
+}
+
+// src/helpers/exchange.ts
+class Exchange {
+  static build(exchange, members) {
+    const percent = exchange.storm_percent ?? 1;
+    const ports = (device) => {
+      const result = {};
+      for (const member of members) {
+        const port = member.ports[device];
+        if (!port)
+          continue;
+        result[port] = {
+          description: `${member.name}, AS${member.asn}`,
+          access_vlan: exchange.vlan,
+          stp: false,
+          lldp: false,
+          storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
+          ...exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {},
+          ...exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}
+        };
+      }
+      return result;
+    };
+    const check = (devices) => {
+      const findings = [];
+      const error = (message, device) => findings.push({ level: "error", ...device ? { device } : {}, message });
+      const taken = new Map((exchange.reserved ?? []).map((address) => [address, "reserved"]));
+      const portHolders = new Map;
+      members.forEach((member, index) => {
+        for (const other of members.slice(index + 1)) {
+          if (other.name === member.name)
+            error(`member ${member.name} is declared twice`);
+          if (other.asn === member.asn)
+            error(`members ${member.name} and ${other.name} share AS${member.asn}`);
+        }
+        for (const [address, lan] of [
+          [member.ipv4, exchange.lan.ipv4],
+          [member.ipv6, exchange.lan.ipv6]
+        ]) {
+          if (!address)
+            continue;
+          if (!lan || !Address2.contains(lan, address))
+            error(`${address} of ${member.name} is outside the peering LAN`);
+          const holder = taken.get(address);
+          if (holder)
+            error(`${address} of ${member.name} is already ${holder === "reserved" ? "reserved" : `${holder}'s`}`);
+          taken.set(address, member.name);
+        }
+        for (const [deviceName, portName] of Object.entries(member.ports)) {
+          const holder = portHolders.get(`${deviceName} ${portName}`);
+          if (holder)
+            error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
+          portHolders.set(`${deviceName} ${portName}`, member.name);
+          const device = devices.find((candidate) => candidate.name === deviceName);
+          const port = device?.ports?.[portName];
+          const carried = port ? Checks.vlansOf(port) : [];
+          if (carried.length !== 1 || carried[0] !== exchange.vlan) {
+            error(`port ${portName} of ${member.name} does not carry the peering VLAN alone`, deviceName);
+          }
+        }
+      });
+      return findings;
+    };
+    const bird = (server) => RouteServerConfig.bird(server, exchange.lan, members);
+    const openbgpd = (server) => RouteServerConfig.openbgpd(server, exchange.lan, members);
+    return { ports, check, bird, openbgpd };
+  }
+}
+// src/helpers/filters.ts
+class Filters {
+  static MARTIANS = ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
+  static PRIVATE_RANGES = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+  static AMPLIFIERS = {
+    qotd: 17,
+    chargen: 19,
+    dns: 53,
+    portmap: 111,
+    ntp: 123,
+    netbios: 137,
+    snmp: 161,
+    cldap: 389,
+    slp: 427,
+    rip: 520,
+    "ms-sql": 1434,
+    ssdp: 1900,
+    ard: 3283,
+    "ws-discovery": 3702,
+    mdns: 5353,
+    coap: 5683,
+    ubiquiti: 10001,
+    memcached: 11211,
+    dvr: 37810
+  };
+  static ASKED = new Set([Filters.AMPLIFIERS.dns, Filters.AMPLIFIERS.ntp, Filters.AMPLIFIERS.snmp]);
+  static BAD_TCP_FLAGS = [
+    ["FIN+SYN", ["fin", "syn"], []],
+    ["SYN+RST", ["syn", "rst"], []],
+    ["FIN+RST", ["fin", "rst"], []],
+    ["FIN without ACK", ["fin"], ["ack"]],
+    ["FIN+URG", ["fin", "urg"], []],
+    ["Xmas scan", ["fin", "syn", "psh", "urg"], []]
+  ];
+  static antiSpoofing(vlan, sources) {
+    return sources.map((src) => ({
+      description: `${vlan}: drop source ${src}`,
+      match: { vlan, src },
+      action: "drop"
+    }));
+  }
+  static antiAmplification(destinations, options = {}) {
+    return destinations.flatMap((dst) => [
+      ...(options.keep_fragments ?? []).filter((prefix) => Address2.contains(dst, prefix)).map((prefix) => ({
+        description: `UDP fragments to ${prefix} kept`,
+        match: { protocol: "udp", dst: prefix, src_port: 0 },
+        action: "accept"
+      })),
+      { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
+      ...Object.entries(Filters.AMPLIFIERS).flatMap(([name, port]) => Filters.ASKED.has(port) ? [
+        {
+          description: `UDP to ${dst} from ${name}, between two servers`,
+          match: { protocol: "udp", dst, src_port: port, dst_port: port },
+          action: "accept"
+        },
+        {
+          description: `UDP to ${dst} from ${name}, to a port below 1024`,
+          match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
+          action: "drop"
+        }
+      ] : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }])
+    ]);
+  }
+  static badTcpFlags() {
+    return Filters.BAD_TCP_FLAGS.map(([name, set, unset]) => ({
+      description: `Bad flags ${name}`,
+      match: { protocol: "tcp", tcp_flags: { set, unset } },
+      action: "drop"
+    }));
+  }
+}
+export {
+  Bgp,
+  Checks,
+  Exchange,
+  Filters,
+  RouteServerConfig
+};

package/dist/index.js

@@ -1,12 +1,10 @@
 import {
-  familyOf2,
-  isAddress2,
-  isCidr2,
-  network,
-  contains2,
-  host2,
-  isGlobal2
-} from "./chunks/index-v8zgr7wm.js";
+  Utils2,
+  Secrets2
+} from "./chunks/index-20kcjxjg.js";
+import {
+  Address2
+} from "./chunks/index-n7w3tg5y.js";
 
 // src/core/define.ts
 var secret = (name) => ({ secret: name });
@@ -19,29 +17,12 @@ function defineDevice(device) {
   return device;
 }
 var defineNetwork = (network) => network;
-// src/core/merge.ts
-function merge(...records) {
-  const result = {};
-  for (const record of records) {
-    for (const [key, value] of Object.entries(record)) {
-      if (key in result)
-        throw new Error(`merge: ${key} is declared twice`);
-      result[key] = value;
-    }
-  }
-  return result;
-}
 export {
-  contains2 as contains,
+  Address2 as Address,
+  Secrets2 as Secrets,
+  Utils2 as Utils,
   defineDevice,
   defineNetwork,
-  familyOf2 as familyOf,
-  host2 as host,
-  isAddress2 as isAddress,
-  isCidr2 as isCidr,
-  isGlobal2 as isGlobal,
-  merge,
-  network as prefixOf,
   secret,
   secretFile
 };

package/dist/types/core/{addresses.d.ts → address-space.d.ts}

@@ -37,10 +37,26 @@ export type AddressReport = {
         blocks: Block[];
     };
 };
-/** Every address in use, by segment, under the space the network owns. With `within`, only what falls inside that prefix, as the one space. */
-export declare function addressesOf(devices: readonly Device[], within?: string): AddressReport;
-/** Free prefixes of one length inside the free space, up to `limit`, and how many there are in all. */
-export declare function freeOfLength(free: readonly string[], length: number, limit: number): {
-    prefixes: string[];
-    total: bigint;
-};
+export declare class AddressSpace {
+    private static isHostRoute;
+    private static numberOf;
+    /** Addresses a segment can give out: IPv4 leaves out the network and broadcast addresses below /31, and IPv6 the subnet-router anycast address. */
+    private static usable;
+    /** Ranges merged, so overlapping ones count once. */
+    private static merged;
+    /** What is inside `within` and not in any of the ranges. */
+    private static gaps;
+    /** `12` or, for a count too long to read, `about 2^64`, to the nearest power of two. */
+    private static count;
+    private static byAddress;
+    /** IPv4 before IPv6, then by first address. */
+    private static comparePrefixes;
+    private static byPrefix;
+    /** Every address in use, by segment, under the space the network owns. With `within`, only what falls inside that prefix, as the one space. */
+    static report(devices: readonly Device[], within?: string): AddressReport;
+    /** Free prefixes of one length inside the free space, up to `limit`, and how many there are in all. */
+    static freeOfLength(free: readonly string[], length: number, limit: number): {
+        prefixes: string[];
+        total: bigint;
+    };
+}