@takodotid/circuit 0.36.0 → 0.38.0

package/dist/types/core/address-space.d.ts

@@ -1,4 +1,4 @@
-import type { Device } from "../schema";
+import type { Device } from "../schema/index.js";
 /** One address or range in a segment, and what holds it. */
 export type Use = {
     /** An address, or `first-last` for a range. */

package/dist/types/core/address.d.ts

@@ -1,4 +1,4 @@
-import type { Family, IP, IPv4, Prefix } from "../schema";
+import type { Family, IP, IPv4, Prefix } from "../schema/index.js";
 /** Address helpers, for checks of your own. */
 export declare class Address {
     /** IPv4 space another network cannot reach: this host, private, shared, loopback, link-local and documentation, after RFC 6890. */

package/dist/types/core/cabling.d.ts

@@ -1,5 +1,5 @@
-import type { Device } from "../schema";
-import type { Finding } from "./define";
+import type { Device } from "../schema/index.js";
+import type { Finding } from "./define.js";
 /** A device one of our ports sees at the far end of its cable, over LLDP. */
 export type Neighbor = {
     /** Our port, by Circuit's name, such as `10g-1`. */
@@ -28,7 +28,7 @@ export declare class Cabling {
     /**
      * Warnings where LLDP and `link` disagree, from each device's own view: a cable in another port than `link` names, a cable `link` names that LLDP does not see, and another of our devices on a port without `link`.
      *
-     * Only ports where both ends run LLDP, by the config, are compared, and only on devices whose neighbors were read. LLDP can be off at the far end, so each is a warning.
+     * Only ports where both ends run LLDP, by the config, are compared, and only on devices whose neighbors were read. A link `through` a carrier is not compared. LLDP can be off at the far end, so each is a warning.
      */
     static compare(devices: readonly Device[], neighbors: ReadonlyMap<string, readonly Neighbor[]>): Finding[];
     /** A system name is the device's name, alone or with a domain after it. */

package/dist/types/core/cross-checks.d.ts

@@ -1,5 +1,5 @@
-import type { Device } from "../schema";
-import type { Finding } from "./define";
+import type { Device } from "../schema/index.js";
+import type { Finding } from "./define.js";
 export declare class CrossChecks {
     /** Every rule across devices. */
     static run(devices: readonly Device[]): Finding[];
@@ -15,7 +15,7 @@ export declare class CrossChecks {
     private static plainAddresses;
     /** Why the two ends of a cable cannot reach each other by address, or undefined when they can. */
     private static addressDisagreement;
-    /** A link names a device and port that exist, the far end links back, and both ends carry the same VLANs the same way, with the same MTU, speed and addresses. */
+    /** A link names a device and port that exist, the far end links back through the same carrier, and both ends carry the same VLANs the same way, with the same MTU, speed and addresses. */
     private static checkLinks;
     /** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
     private static checkAddresses;

package/dist/types/core/define.d.ts

@@ -1,5 +1,5 @@
-import type { ModelName, PlatformName, PortName } from "../platforms/catalog";
-import type { Device, Secret } from "../schema";
+import type { ModelName, PlatformName, PortName } from "../platforms/catalog.js";
+import type { Device, Secret } from "../schema/index.js";
 /** A value resolved by name when a device is applied, from the environment or `.env` beside the config, and through 1Password when that value is an `op://` reference. Never the value itself. */
 export declare const secret: (name: string) => Secret;
 /** A value read from a file when a device is applied, such as a private key in PEM. The path is relative to the config file; keep the file out of git. */

package/dist/types/core/secrets.d.ts

@@ -1,5 +1,5 @@
-import type { Network } from "./define";
-import type { Console, Device, IP, Secret } from "../schema";
+import type { Network } from "./define.js";
+import type { Console, Device, IP, Secret } from "../schema/index.js";
 /** How a device is logged in to: its management address and SSH port, its connection user and that user's password, and its console. */
 export type DeviceLogin = {
     /** Absent for a device reached only through its console. */

package/dist/types/core/topology.d.ts

@@ -1,5 +1,5 @@
-import type { Device, Routed } from "../schema";
-import type { Finding } from "./define";
+import type { Device, Routed } from "../schema/index.js";
+import type { Finding } from "./define.js";
 /** One view of the network. Every edge belongs to one. */
 export type Layer = "l1" | "l2" | "l3" | "bgp" | "ospf" | "tunnels";
 /** One of our devices, a segment several of them share, or something outside the network. */

package/dist/types/core/validator.d.ts

@@ -1,4 +1,4 @@
-import type { Finding, Network } from "./define";
+import type { Finding, Network } from "./define.js";
 export declare class Validator {
     static run(network: Network): Finding[];
     private static checkDevice;

package/dist/types/helpers/bgp.d.ts

@@ -1,5 +1,5 @@
-import type { Community } from "../core/define";
-import type { Device, PolicyRule, Prefix, StandardCommunity } from "../schema";
+import type { Community } from "../core/define.js";
+import type { Device, IP, LargeCommunity, PolicyRule, Prefix, StandardCommunity } from "../schema/index.js";
 /** The prefix lengths a BGP import accepts. */
 export type SanityLengths = {
     /** Shortest and longest IPv4 prefix accepted. /8 to /24 when absent. */
@@ -13,6 +13,33 @@ export type SanityLengths = {
         max: number;
     };
 };
+/** A prefix we announce, and what it is. */
+export type Announced = {
+    prefix: Prefix;
+    description?: string;
+};
+/** What `Bgp.learn` builds an import from. */
+export type LearnOptions<P extends string> = {
+    /** Rules of your own, first. */
+    before?: readonly PolicyRule<P, never>[];
+    /** A policy holding `Bgp.sanity()` to call. The sanity rules are written in the import itself when absent. */
+    sanity?: P;
+    /** The source address for routes of its family, one per family. */
+    sources?: readonly IP[];
+    /** Preference for the routes learned. Higher wins. */
+    local_pref?: number;
+    /** Where the route came from: a community to add, or a rule, such as `communityScheme(...).tag(...)`. */
+    tag?: StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+};
+/** What `Bgp.defaultOnly` sets on the default routes it takes. */
+export type DefaultOnlyOptions = {
+    /** Preference for the default route. Higher wins. */
+    local_pref?: number;
+    /** Shown beside each rule. `Default route, ipv4` and `Default route, ipv6` when absent. */
+    description?: string;
+    /** The source address for the default of its family, one per family. */
+    sources?: readonly IP[];
+};
 /** Kinds of neighbor and the number each is tagged with, such as `{ transit: 1, customer: 3 }`. */
 export type CommunityClasses = Readonly<Record<string, number>>;
 /**
@@ -55,16 +82,32 @@ export type CommunityScheme<Asn extends number = number, LearnedFrom extends num
 };
 /** The class names a scheme declares, or any name when it declares none. */
 type ClassName<Classes extends CommunityClasses> = {} extends Classes ? string : Extract<keyof Classes, string>;
-/** BGP policy: an import sanity policy, a community scheme, and helpers that read a device's BGP neighbors. */
+/** BGP policy: an import sanity policy, the shapes most imports and exports take, a community scheme, and helpers that read a device's BGP neighbors. */
 export declare class Bgp {
     private static readonly PREPENDS;
+    /** The default route of each family. */
+    private static readonly DEFAULTS;
     /** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
     static sanity(lengths?: SanityLengths): PolicyRule<never, never>[];
+    /** An export policy that announces each prefix, at exactly its length, then rejects everything else. The last rule is the unconditional reject `Checks.exportsEndInReject` looks for. */
+    static announce(prefixes: readonly Announced[]): PolicyRule<never, never>[];
+    /**
+     * An import policy that takes a neighbor's routes: `before` first, then the sanity rules, then each source address and the local preference, then the tag, then accept.
+     *
+     * `sanity` names a policy holding `Bgp.sanity()` to call, so several imports share one; without it, the sanity rules are written here. `tag` is a community to add, or a rule such as `communityScheme(...).tag(...)`. Each of `sources` is the source address for routes of its own family.
+     */
+    static learn<const P extends string = never>(options?: LearnOptions<P>): PolicyRule<P, never>[];
+    /**
+     * Import rules that take the default route, `0.0.0.0/0` and `::/0`, from a transit. Any other route reaches the next rule, or is rejected when there is none. Each of `sources` is the source address for the default of its own family.
+     */
+    static defaultOnly(options?: DefaultOnlyOptions): PolicyRule<never, never>[];
+    /** A rule adding one community, standard or large. */
+    private static adding;
     /** Each BGP neighbor's own policies and role, or its group's. */
     static neighborPolicies(device: Device): {
         name: string;
-        address: import("..").IP;
-        role: import("..").BgpRole | undefined;
+        address: IP;
+        role: import("../index.js").BgpRole | undefined;
         import: string | undefined;
         export: string | undefined;
     }[];

package/dist/types/helpers/cables.d.ts

@@ -0,0 +1,70 @@
+import { type ModelName, type PlatformName, type PortName } from "../platforms/catalog.js";
+/** One end of a cable: the device, and its platform and model, which name its ports. */
+export type CableEnd<P extends PlatformName, M extends ModelName<P>> = {
+    device: string;
+    platform: P;
+    model: M;
+};
+/** The far end of a port, for its description: the device, the port by Circuit's name, and by the name printed on the device. */
+export type FarEnd = {
+    device: string;
+    port: string;
+    label: string;
+};
+/** What every cable of one entry shares. */
+type Shared = {
+    /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
+    through?: string;
+    /** A port's description from its far end. The far device and the far port's label when absent, such as `firewall-1 port6`. */
+    describe?: (far: FarEnd) => string;
+};
+/** A port a cable builds: what it is, the LAG it is in, and the other end. */
+type CablePort<L extends string> = {
+    description: string;
+    link: {
+        device: string;
+        port: string;
+        through?: string;
+    };
+    lag?: L;
+};
+/** Ports for both ends of the cables between two of our devices, each cable written once. */
+export declare class Cables {
+    /**
+     * One cable, both ends. Spread each end into its device's `ports`:
+     *
+     * ```ts
+     * const uplink = Cables.link({ a: { device: "router-1", platform: "routeros", model: "CCR2216-1G-12XS-2XQ", port: "25g-1" }, b: { ... } });
+     * // router-1: ports: { ...uplink.a }
+     * ```
+     */
+    static link<const PA extends PlatformName, const MA extends ModelName<PA>, const NA extends PortName<PA, MA>, const PB extends PlatformName, const MB extends ModelName<PB>, const NB extends PortName<PB, MB>>(spec: Shared & {
+        a: CableEnd<PA, MA> & {
+            port: NA;
+        };
+        b: CableEnd<PB, MB> & {
+            port: NB;
+        };
+    }): {
+        a: Record<NA, CablePort<never>>;
+        b: Record<NB, CablePort<never>>;
+    };
+    /**
+     * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
+     */
+    static lag<const PA extends PlatformName, const MA extends ModelName<PA>, const LA extends string, const PB extends PlatformName, const MB extends ModelName<PB>, const LB extends string, const C extends Partial<Record<PortName<PA, MA>, PortName<PB, MB>>>>(spec: Shared & {
+        a: CableEnd<PA, MA> & {
+            lag: LA;
+        };
+        b: CableEnd<PB, MB> & {
+            lag: LB;
+        };
+        cables: C;
+    }): {
+        a: Record<keyof C & string, CablePort<LA>>;
+        b: Record<NonNullable<C[keyof C]> & string, CablePort<LB>>;
+    };
+    /** A port facing `port` on the far device. */
+    private static end;
+}
+export {};

package/dist/types/helpers/checks.d.ts

@@ -1,4 +1,4 @@
-import type { Check } from "../core/define";
+import type { Check } from "../core/define.js";
 /** Where traffic from outside, before anything filters it, may go. Every VLAN not listed as untrusted is trusted, so a VLAN added later is protected without being listed. */
 export type TrustBoundary = {
     /** VLANs carrying traffic straight from outside: transits, exchanges, an ISP handoff. */

package/dist/types/helpers/exchange.d.ts

@@ -1,6 +1,6 @@
-import type { Check } from "../core/define";
-import type { Ethertype, IP, Port, Prefix } from "../schema";
-import { type RouteServer } from "./route-server";
+import type { Check } from "../core/define.js";
+import type { Ethertype, IP, Port, Prefix } from "../schema/index.js";
+import { type RouteServer } from "./route-server.js";
 /** A member of an internet exchange: a network with a port on the fabric and an address on the peering LAN. */
 export type ExchangeMember = {
     /** Lowercase, and never reused. */

package/dist/types/helpers/filters.d.ts

@@ -1,4 +1,4 @@
-import type { AclRule, FilterRule, Prefix } from "../schema";
+import type { AclRule, FilterRule, Prefix } from "../schema/index.js";
 /** What `Filters.antiAmplification` leaves alone. */
 export type AntiAmplificationOptions = {
     /** Prefixes inside the destinations whose UDP fragments pass: for a host that receives UDP too large for one packet, such as SIP or some VPNs. Every fragment after the first is dropped when absent. */

package/dist/types/helpers/index.d.ts

@@ -1,10 +1,14 @@
-export { Bgp } from "./bgp";
-export type { CommunityScheme, SanityLengths } from "./bgp";
-export { Checks } from "./checks";
-export type { TrustBoundary } from "./checks";
-export { Exchange } from "./exchange";
-export type { ExchangeMember, InternetExchange } from "./exchange";
-export { Filters } from "./filters";
-export { RouteServerConfig } from "./route-server";
-export type { RouteServer } from "./route-server";
-export type { AntiAmplificationOptions } from "./filters";
+export { Bgp } from "./bgp.js";
+export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
+export { Cables } from "./cables.js";
+export type { CableEnd, FarEnd } from "./cables.js";
+export { Checks } from "./checks.js";
+export type { TrustBoundary } from "./checks.js";
+export { Exchange } from "./exchange.js";
+export type { ExchangeMember, InternetExchange } from "./exchange.js";
+export { Filters } from "./filters.js";
+export { RouteServerConfig } from "./route-server.js";
+export { Upstreams } from "./upstreams.js";
+export type { Upstream, UpstreamCatalog, UpstreamPolicies } from "./upstreams.js";
+export type { RouteServer } from "./route-server.js";
+export type { AntiAmplificationOptions } from "./filters.js";

package/dist/types/helpers/route-server.d.ts

@@ -1,5 +1,5 @@
-import type { Family, IPv4, IPv6, Prefix } from "../schema";
-import type { ExchangeMember } from "./exchange";
+import type { Family, IPv4, IPv6, Prefix } from "../schema/index.js";
+import type { ExchangeMember } from "./exchange.js";
 /** A route server on an exchange's peering LAN: a server running BIRD 2 or OpenBGPD that passes every member's routes to every other member. */
 export type RouteServer = {
     /** Its name, such as `rs1`, written at the top of its config. */

package/dist/types/helpers/upstreams.d.ts

@@ -0,0 +1,156 @@
+import type { Exchange as ExchangeLan, Family, FilterRule, Gre, InterfaceAddress, IP, LargeCommunity, Neighbor, NeighborSettings, PolicyRule, Port, Secret, StandardCommunity, Vlan, VlanInterface } from "../schema/index.js";
+import { type Announced } from "./bgp.js";
+/** One network we exchange routes with: a transit we buy, an exchange's route servers, or a peer. */
+export type Upstream = {
+    /** Its name as people write it, for descriptions: `Transit A`. The key when absent. */
+    name?: string;
+    asn: number;
+    /** What it is to us: `provider` for a transit, `rs` for an exchange's route servers, `peer` for a direct session. */
+    role: "provider" | "rs" | "peer";
+    /** Where it lands on our side: a VLAN, our addresses on it, and the switch port it arrives on. A peer over a tunnel, or over an exchange's VLAN, has none. */
+    handoff?: {
+        /** The VLAN's ID. */
+        vlan: number;
+        /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
+        native?: number;
+        /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
+        addresses: readonly (InterfaceAddress | {
+            address: InterfaceAddress;
+            peer: IP;
+        })[];
+        /** The switch port it arrives on. */
+        port?: {
+            device: string;
+            port: string;
+            storm_control?: Port<string, string, string, string>["storm_control"];
+        };
+        /** An exchange's LAN, for `circuit peeringdb`. */
+        exchange?: ExchangeLan;
+    };
+    /** A GRE tunnel to it. */
+    tunnel?: {
+        local: IP;
+        remote: IP;
+        addresses: readonly InterfaceAddress[];
+        mtu?: number;
+    };
+    /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
+    sessions: Readonly<Record<string, {
+        address: IP;
+        local_address?: IP;
+    }>>;
+    /** The sessions are more than one hop away, from this address of ours. They share a group. */
+    multihop?: {
+        local_address: IP;
+        families?: readonly Family[];
+        password?: Secret;
+    };
+    /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
+    limits?: {
+        ipv4?: number;
+        ipv6?: number;
+    };
+    /** What we take. Nothing when absent. */
+    import?: {
+        /** Its default route, at this preference. */
+        default?: {
+            local_pref?: number;
+            description?: string;
+        };
+        /** Its routes, through `Bgp.learn`: the `before` rules, sanity, this preference, the tag. Only the default when absent. */
+        learn?: {
+            local_pref?: number;
+            before?: readonly PolicyRule<never, never>[];
+        };
+    };
+    /** Rules of yours in its export, between the community actions and what we announce, such as a prepend. */
+    export?: readonly PolicyRule<never, never>[];
+    /** What we announce to it. Everything else is rejected. */
+    announce: readonly Announced[];
+    /** Drop RFC 1918 sources arriving from it. `privateDrops()` lists the VLANs. */
+    drop_private?: true;
+};
+/** Upstreams by key. The key names everything built from it. */
+export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
+/** How each upstream's policies are written: shared by every upstream of a catalog. */
+export type UpstreamPolicies<P extends string> = {
+    /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
+    sanity?: P;
+    /** Where a route came from, by upstream: a community or a rule, such as `communityScheme(...).tag(...)`. Nothing is tagged when absent. */
+    tag?: (key: string, upstream: Upstream) => StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+    /** Rules first in each export, such as `communityScheme(...).actions(upstream.asn)`. */
+    actions?: (key: string, upstream: Upstream) => readonly PolicyRule<never, never>[];
+    /** The source address for routes of its family, one per family. */
+    sources?: readonly IP[];
+};
+type Key<C> = keyof C & string;
+/** The upstreams that land on a VLAN of ours. */
+type Landed<C> = {
+    [K in Key<C>]: C[K] extends {
+        handoff: object;
+    } ? K : never;
+}[Key<C>];
+/** The upstreams that send their VLAN tagged. */
+type Tagged<C> = {
+    [K in Key<C>]: C[K] extends {
+        handoff: {
+            native: number;
+        };
+    } ? K : never;
+}[Key<C>];
+/** The upstreams reached over a tunnel. */
+type Tunneled<C> = {
+    [K in Key<C>]: C[K] extends {
+        tunnel: object;
+    } ? K : never;
+}[Key<C>];
+/** The upstreams whose sessions share a group: an exchange's route servers, or multihop sessions. */
+type Grouped<C> = {
+    [K in Key<C>]: C[K] extends {
+        role: "rs";
+    } | {
+        multihop: object;
+    } ? K : never;
+}[Key<C>];
+/** The upstreams we take routes from. */
+type Importing<C> = {
+    [K in Key<C>]: C[K] extends {
+        import: object;
+    } ? K : never;
+}[Key<C>];
+/** A native VLAN's name. */
+type Native<K extends string> = `${K}-native`;
+/** Each upstream's policies: `TRANSIT_A-IN` and `TRANSIT_A-OUT`. */
+type PolicyName<C> = `${Uppercase<Importing<C>>}-IN` | `${Uppercase<Key<C>>}-OUT`;
+/** The catalog as written, with any key the shape does not have refused, at every level. */
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret ? T : {
+    [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never;
+};
+/** A network's upstreams written once, and each device's part built from them. */
+export declare class Upstreams {
+    /**
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked:
+     *
+     * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
+     * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
+     *
+     * On the router: `vlans()`, `interfaces()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     */
+    static define<const C extends UpstreamCatalog>(catalog: C & {
+        [K in keyof C]: Exact<Upstream, C[K]>;
+    }): {
+        vlans: <const D extends string | undefined = undefined>(device?: D) => D extends string ? { [K in Landed<C>]: Vlan; } & { [K in Tagged<C> as Native<K>]: Vlan; } : { [K in Landed<C>]: Vlan; };
+        vlansOn: (device: string) => Landed<C>[];
+        ports: (device: string) => Record<string, Port<`${Tagged<C>}-native` | Landed<C>, never, never, never>>;
+        interfaces: () => { [K in Landed<C>]: VlanInterface<Landed<C>, never>; } & { [K in Tunneled<C>]: Gre<never>; };
+        groups: () => Record<Grouped<C>, NeighborSettings<PolicyName<C>>>;
+        neighbors: () => Record<string, Neighbor<PolicyName<C>, Grouped<C>>>;
+        policies: <const P extends string = never>(options?: UpstreamPolicies<P>) => Record<PolicyName<C>, PolicyRule<P, never>[]>;
+        untrusted: () => (`${Tagged<C>}-native` | Landed<C>)[];
+        natives: () => `${Tagged<C>}-native`[];
+        privateDrops: () => Landed<C>[];
+        tunnelRules: () => FilterRule<never, never>[];
+        addresses: () => IP[];
+    };
+}
+export {};

package/dist/types/index.d.ts

@@ -1,8 +1,10 @@
-export { defineDevice, defineNetwork, secret, secretFile } from "./core/define";
-export { Utils } from "./core/utils";
-export type { Check, Community, Finding, NetBoxDevice, Network } from "./core/define";
-export type * from "./schema";
+export { defineDevice, defineNetwork, secret, secretFile } from "./core/define.js";
+export { Utils } from "./core/utils.js";
+export type { Check, Community, Finding, NetBoxDevice, Network } from "./core/define.js";
+export type * from "./schema/index.js";
+/** The platforms, their models and each model's ports, for types of your own: `PortName<"junos", "QFX5100-48S-6Q">` is each port of that model, such as `"10g-1"` or `"40g-6"`. */
+export type { ModelName, PlatformName, PortName } from "./platforms/catalog.js";
 /** Address helpers, for checks of your own. */
-export { Address } from "./core/address";
+export { Address } from "./core/address.js";
 /** Secrets, for tools of your own: a secret's value, text with every secret hidden, and how Circuit logs in to a device. */
-export { Secrets } from "./core/secrets";
+export { Secrets } from "./core/secrets.js";

package/dist/types/integrations/librenms.d.ts

@@ -1,5 +1,5 @@
-import type { Network } from "../core/define";
-import type { Device } from "../schema";
+import type { Network } from "../core/define.js";
+import type { Device } from "../schema/index.js";
 /** A device LibreNMS monitors whose settings differ from its config. */
 export type LibreNmsChange = {
     device: Device;

package/dist/types/integrations/netbox.d.ts

@@ -1,4 +1,4 @@
-import type { Network } from "../core/define";
+import type { Network } from "../core/define.js";
 /** Each kind of object Circuit writes, in the order they are made: each refers only to kinds before it, or waits for the next pass. */
 export type NetBoxKind = "tag" | "site" | "manufacturer" | "platform" | "device-type" | "role" | "vrf" | "vlan" | "device" | "interface" | "prefix" | "ip-range" | "ip" | "cable";
 /** One object to make, change or delete. */

package/dist/types/integrations/peeringdb.d.ts

@@ -1,4 +1,4 @@
-import type { Network } from "../core/define";
+import type { Network } from "../core/define.js";
 /** A change to send. `id` is set when the record exists and is updated in place. */
 export type PeeringDbChange = {
     summary: string;

package/dist/types/integrations/prometheus.d.ts

@@ -1,5 +1,5 @@
-import type { Network } from "../core/define";
-import type { Device } from "../schema";
+import type { Network } from "../core/define.js";
+import type { Device } from "../schema/index.js";
 export type PrometheusTarget = {
     targets: string[];
     labels: Record<string, string>;

package/dist/types/integrations/registries.d.ts

@@ -1,5 +1,5 @@
-import type { Family } from "../schema";
-import type { Registry } from "../schema/policy";
+import type { Family } from "../schema/index.js";
+import type { Registry } from "../schema/policy.js";
 export declare class Registries {
     /** The prefixes of one family a registry gives for a query. */
     static prefixes(name: Registry, query: string, family: Family): Promise<string[]>;

package/dist/types/platforms/bgp-wait.d.ts

@@ -1,4 +1,4 @@
-import type { BgpSession } from "./platform";
+import type { BgpSession } from "./platform.js";
 /** How long to wait, and how often to read again, both in seconds. */
 export type WaitLimits = {
     seconds: number;
@@ -15,4 +15,10 @@ export declare class BgpWait {
     static until(read: () => Promise<BgpSession[]>, enough: (sessions: BgpSession[]) => boolean, limits: WaitLimits, waiting?: (sessions: BgpSession[]) => void): Promise<BgpSession[]>;
     /** How many of these sessions are established. */
     static upCount(sessions: readonly BgpSession[]): number;
+    /** Sessions closed on their limit within this many minutes of each other are one burst. */
+    static readonly BURST_MINUTES = 5;
+    /**
+     * Groups of two or more sessions closed on their limit within `BURST_MINUTES` of each other, earliest first. Several limits at once is usually a leak upstream, not growth, so raising them is the wrong fix.
+     */
+    static limitBursts(sessions: readonly BgpSession[]): BgpSession[][];
 }

package/dist/types/platforms/derive.d.ts

@@ -1,4 +1,4 @@
-import type { Device } from "../schema";
+import type { Device } from "../schema/index.js";
 /** A feature a platform renders once proved on one of its devices. */
 export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
 export declare class Derive {

package/dist/types/platforms/fortios/firewall.d.ts

@@ -1,5 +1,5 @@
-import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../schema";
-import { FortiOsBlock } from "./tree";
+import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../schema/index.js";
+import { FortiOsBlock } from "./tree.js";
 export declare class FortiOsFirewall {
     /** IP protocol numbers, for a protocol the platform names only by number. */
     static readonly PROTOCOL_NUMBER: Record<Protocol, number>;

package/dist/types/platforms/fortios/index.d.ts

@@ -1,7 +1,7 @@
-import type { Neighbor } from "../../core/cabling";
-import type { Device, Family } from "../../schema";
-import { type ConsoleDialect } from "../../transport/console";
-import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+import type { Neighbor } from "../../core/cabling.js";
+import type { Device, Family } from "../../schema/index.js";
+import { type ConsoleDialect } from "../../transport/console.js";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform.js";
 /** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
 export type Channel = {
     write(data: string): unknown;

package/dist/types/platforms/fortios/names.d.ts

@@ -1,4 +1,4 @@
-import type { Device, Family } from "../../schema";
+import type { Device, Family } from "../../schema/index.js";
 type Addressed = {
     addresses?: readonly (string | {
         address: string;

package/dist/types/platforms/fortios/plan.d.ts

@@ -1,4 +1,4 @@
-import type { ApplyOptions, Plan } from "../platform";
+import type { ApplyOptions, Plan } from "../platform.js";
 export declare class FortiOsPlan {
     /** Objects every FortiGate running 6.2 is shipped with, which policies and profiles of the factory name. */
     private static readonly FACTORY_ADDRESSES;

package/dist/types/platforms/fortios/render.d.ts

@@ -1,4 +1,4 @@
-import type { Device, Helper, Severity } from "../../schema";
+import type { Device, Helper, Severity } from "../../schema/index.js";
 export type Section = (typeof FortiOsRender.SECTIONS)[number];
 export declare class FortiOsRender {
     /** Where the pre-login banner's text is kept. */

package/dist/types/platforms/fortios/routing.d.ts

@@ -1,5 +1,5 @@
-import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema";
-import { FortiOsBlock } from "./tree";
+import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema/index.js";
+import { FortiOsBlock } from "./tree.js";
 type AnyRule = PolicyRule<string, string>;
 type AnyNeighbor = Neighbor<string, string>;
 /** The lengths a prefix list's rule takes within its prefix. */

package/dist/types/platforms/index.d.ts

@@ -1,4 +1,4 @@
-import type { Platform } from "./platform";
+import type { Platform } from "./platform.js";
 /** Every platform the framework can render and apply, by name. */
 export declare class Platforms {
     private static readonly BY_NAME;

package/dist/types/platforms/junos/bgp.d.ts

@@ -1,5 +1,5 @@
-import type { Device, Neighbor, NeighborSettings } from "../../schema";
-import { type JunosStatements } from "./render";
+import type { Device, Neighbor, NeighborSettings } from "../../schema/index.js";
+import { type JunosStatements } from "./render.js";
 type AnyNeighbor = Neighbor<string, string>;
 /** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
 export declare class JunosBgp {

package/dist/types/platforms/junos/index.d.ts

@@ -1,7 +1,7 @@
-import type { Neighbor } from "../../core/cabling";
-import type { Device, Family } from "../../schema";
-import { type ConsoleDialect } from "../../transport/console";
-import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+import type { Neighbor } from "../../core/cabling.js";
+import type { Device, Family } from "../../schema/index.js";
+import { type ConsoleDialect } from "../../transport/console.js";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform.js";
 /** How a commit that could cut access is guarded: it rolls back after `minutes` unless `prove` shows access survived. */
 export type Guard = {
     minutes: number;

package/dist/types/platforms/junos/render.d.ts

@@ -1,4 +1,4 @@
-import type { Device, Interface, Port, Vrrp } from "../../schema";
+import type { Device, Interface, Port, Vrrp } from "../../schema/index.js";
 type AnyPort = Port<string, string, string, string>;
 type AnyInterface = Interface<string, string>;
 type LagInterface = Extract<AnyInterface, {