@takodotid/circuit 0.37.0 → 0.39.0

package/src/helpers/bgp.ts

@@ -1,5 +1,15 @@
+import { Address } from "../core/address";
 import type { Community } from "../core/define";
-import type { Device, LargeCommunityPattern, PolicyRule, Prefix, StandardCommunity, StandardCommunityPattern } from "../schema";
+import type {
+    Device,
+    IP,
+    LargeCommunity,
+    LargeCommunityPattern,
+    PolicyRule,
+    Prefix,
+    StandardCommunity,
+    StandardCommunityPattern,
+} from "../schema";
 
 /** The prefix lengths a BGP import accepts. */
 export type SanityLengths = {
@@ -9,6 +19,33 @@ export type SanityLengths = {
     ipv6?: { min: number; max: number };
 };
 
+/** A prefix we announce, and what it is. */
+export type Announced = { prefix: Prefix; description?: string };
+
+/** What `Bgp.learn` builds an import from. */
+export type LearnOptions<P extends string> = {
+    /** Rules of your own, first. */
+    before?: readonly PolicyRule<P, never>[];
+    /** A policy holding `Bgp.sanity()` to call. The sanity rules are written in the import itself when absent. */
+    sanity?: P;
+    /** The source address for routes of its family, one per family. */
+    sources?: readonly IP[];
+    /** Preference for the routes learned. Higher wins. */
+    local_pref?: number;
+    /** Where the route came from: a community to add, or a rule, such as `communityScheme(...).tag(...)`. */
+    tag?: StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+};
+
+/** What `Bgp.defaultOnly` sets on the default routes it takes. */
+export type DefaultOnlyOptions = {
+    /** Preference for the default route. Higher wins. */
+    local_pref?: number;
+    /** Shown beside each rule. `Default route, ipv4` and `Default route, ipv6` when absent. */
+    description?: string;
+    /** The source address for the default of its family, one per family. */
+    sources?: readonly IP[];
+};
+
 /** Kinds of neighbor and the number each is tagged with, such as `{ transit: 1, customer: 3 }`. */
 export type CommunityClasses = Readonly<Record<string, number>>;
 
@@ -45,7 +82,7 @@ export type CommunityScheme<
 /** The class names a scheme declares, or any name when it declares none. */
 type ClassName<Classes extends CommunityClasses> = {} extends Classes ? string : Extract<keyof Classes, string>;
 
-/** BGP policy: an import sanity policy, a community scheme, and helpers that read a device's BGP neighbors. */
+/** BGP policy: an import sanity policy, the shapes most imports and exports take, a community scheme, and helpers that read a device's BGP neighbors. */
 export class Bgp {
     private static readonly PREPENDS = [
         ["once", 1],
@@ -53,6 +90,12 @@ export class Bgp {
         ["three_times", 3],
     ] as const;
 
+    /** The default route of each family. */
+    private static readonly DEFAULTS = [
+        { family: "ipv4", prefix: "0.0.0.0/0" },
+        { family: "ipv6", prefix: "::/0" },
+    ] as const;
+
     /** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
     static sanity(lengths: SanityLengths = {}): PolicyRule<never, never>[] {
         const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
@@ -83,6 +126,65 @@ export class Bgp {
         ];
     }
 
+    /** An export policy that announces each prefix, at exactly its length, then rejects everything else. The last rule is the unconditional reject `Checks.exportsEndInReject` looks for. */
+    static announce(prefixes: readonly Announced[]): PolicyRule<never, never>[] {
+        return [
+            ...prefixes.map(({ prefix, description }) => ({
+                ...(description ? { description } : {}),
+                match: { prefix },
+                action: "accept" as const,
+            })),
+            { description: "Nothing else", action: "reject" },
+        ];
+    }
+
+    /**
+     * An import policy that takes a neighbor's routes: `before` first, then the sanity rules, then each source address and the local preference, then the tag, then accept.
+     *
+     * `sanity` names a policy holding `Bgp.sanity()` to call, so several imports share one; without it, the sanity rules are written here. `tag` is a community to add, or a rule such as `communityScheme(...).tag(...)`. Each of `sources` is the source address for routes of its own family.
+     */
+    static learn<const P extends string = never>(options: LearnOptions<P> = {}): PolicyRule<P, never>[] {
+        const { tag } = options;
+
+        return [
+            ...(options.before ?? []),
+            ...(options.sanity ? [{ call: options.sanity }] : Bgp.sanity()),
+            ...(options.sources ?? []).map((source) => ({ set: { preferred_source: source } })),
+            ...(options.local_pref !== undefined ? [{ set: { local_pref: options.local_pref } }] : []),
+            ...(tag === undefined ? [] : [typeof tag === "object" ? tag : Bgp.adding(tag)]),
+            { action: "accept" },
+        ];
+    }
+
+    /**
+     * Import rules that take the default route, `0.0.0.0/0` and `::/0`, from a transit. Any other route reaches the next rule, or is rejected when there is none. Each of `sources` is the source address for the default of its own family.
+     */
+    static defaultOnly(options: DefaultOnlyOptions = {}): PolicyRule<never, never>[] {
+        return Bgp.DEFAULTS.map(({ family, prefix }) => {
+            const source = options.sources?.find((address) => Address.family(address) === family);
+            const set = {
+                ...(options.local_pref !== undefined ? { local_pref: options.local_pref } : {}),
+                ...(source ? { preferred_source: source } : {}),
+            };
+
+            return {
+                description: options.description ?? `Default route, ${family}`,
+                match: { prefix },
+                ...(Object.keys(set).length ? { set } : {}),
+                action: "accept" as const,
+            };
+        });
+    }
+
+    /** A rule adding one community, standard or large. */
+    private static adding(community: StandardCommunity | LargeCommunity): PolicyRule<never, never> {
+        const large = community.split(":").length === 3;
+        return {
+            description: `Tag ${community}`,
+            set: large ? { add_large_communities: [community as LargeCommunity] } : { add_communities: [community as StandardCommunity] },
+        };
+    }
+
     /** Each BGP neighbor's own policies and role, or its group's. */
     static neighborPolicies(device: Device) {
         const bgp = device.routing?.bgp;

package/src/helpers/cables.ts

@@ -0,0 +1,69 @@
+/** The far end of a port, for a description of your own: the device and its port by Circuit's name. */
+export type FarEnd = { device: string; port: string };
+
+/** What every cable of one entry shares. */
+type Shared = {
+    /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
+    through?: string;
+    /** A port's description from its far end. When absent, Circuit writes the far device and the far port as printed on it, such as `firewall-1 port6`, from the far device's own file. */
+    describe?: (far: FarEnd) => string;
+};
+
+/** A port a cable builds: the other end, the LAG it is in, and a description when `describe` gives one. */
+type CablePort<L extends string> = {
+    link: { device: string; port: string; through?: string };
+    lag?: L;
+    description?: string;
+};
+
+/** Ports for both ends of the cables between two of our devices, each cable written once. */
+export class Cables {
+    /**
+     * One cable, both ends. Spread each end into its device's `ports`:
+     *
+     * ```ts
+     * const uplink = Cables.link({ a: { device: "router-1", port: "25g-1" }, b: { device: "switch-1", port: "10g-48" } });
+     * // router-1: ports: { ...uplink.a }
+     * ```
+     */
+    static link<const NA extends string, const NB extends string>(
+        spec: Shared & { a: { device: string; port: NA }; b: { device: string; port: NB } }
+    ) {
+        return {
+            a: { [spec.a.port]: Cables.end(spec, spec.b.device, spec.b.port) } as Record<NA, CablePort<never>>,
+            b: { [spec.b.port]: Cables.end(spec, spec.a.device, spec.a.port) } as Record<NB, CablePort<never>>,
+        };
+    }
+
+    /**
+     * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
+     */
+    static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(
+        spec: Shared & { a: { device: string; lag: LA }; b: { device: string; lag: LB }; cables: C }
+    ) {
+        const pairs = Object.entries(spec.cables);
+
+        const taken = new Map<string, string>();
+        for (const [near, far] of pairs) {
+            const other = taken.get(far);
+            if (other) throw new Error(`Cables.lag: ${spec.b.device} ${far} is cabled to both ${other} and ${near} on ${spec.a.device}`);
+            taken.set(far, near);
+        }
+
+        const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b.device, far), lag: spec.a.lag }]));
+        const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a.device, near), lag: spec.b.lag }]));
+
+        return {
+            a: a as Record<keyof C & string, CablePort<LA>>,
+            b: b as Record<C[keyof C], CablePort<LB>>,
+        };
+    }
+
+    /** A port facing `port` on the far device. */
+    private static end(shared: Shared, device: string, port: string): CablePort<never> {
+        return {
+            link: { device, port, ...(shared.through ? { through: shared.through } : {}) },
+            ...(shared.describe ? { description: shared.describe({ device, port }) } : {}),
+        };
+    }
+}

package/src/helpers/index.ts

@@ -1,12 +1,16 @@
-// Building blocks most networks write the same way: address lists, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
+// Building blocks most networks write the same way: address lists, cables written once for both ends, edge filters, a BGP import sanity policy, an exchange's member ports and route servers, upstreams written once, checks, and helpers for checks of your own. Each returns plain config to place where it belongs, so nothing here applies itself.
 
 export { Bgp } from "./bgp";
-export type { CommunityScheme, SanityLengths } from "./bgp";
+export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp";
+export { Cables } from "./cables";
+export type { FarEnd } from "./cables";
 export { Checks } from "./checks";
 export type { TrustBoundary } from "./checks";
 export { Exchange } from "./exchange";
 export type { ExchangeMember, InternetExchange } from "./exchange";
 export { Filters } from "./filters";
 export { RouteServerConfig } from "./route-server";
+export { Upstreams } from "./upstreams";
+export type { Upstream, UpstreamCatalog, UpstreamPolicies } from "./upstreams";
 export type { RouteServer } from "./route-server";
 export type { AntiAmplificationOptions } from "./filters";

package/src/helpers/upstreams.ts

@@ -0,0 +1,439 @@
+import { Address } from "../core/address";
+import type {
+    Exchange as ExchangeLan,
+    Family,
+    FilterRule,
+    Gre,
+    InterfaceAddress,
+    IP,
+    LargeCommunity,
+    Neighbor,
+    NeighborSettings,
+    PolicyRule,
+    Port,
+    Prefix,
+    Secret,
+    StandardCommunity,
+    Vlan,
+    VlanInterface,
+} from "../schema";
+import { Bgp, type Announced } from "./bgp";
+
+/** One network we exchange routes with: a transit we buy, an exchange's route servers, or a peer. */
+export type Upstream = {
+    /** Its name as people write it, for descriptions: `Transit A`. The key when absent. */
+    name?: string;
+    asn: number;
+    /** What it is to us: `provider` for a transit, `rs` for an exchange's route servers, `peer` for a direct session. */
+    role: "provider" | "rs" | "peer";
+    /** Where it lands on our side: a VLAN, our addresses on it, and the switch port it arrives on. A peer over a tunnel, or over an exchange's VLAN, has none. */
+    handoff?: {
+        /** The VLAN's ID. */
+        vlan: number;
+        /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
+        native?: number;
+        /** Its number in names with `{number}`, such as `core-ipt01-transita`. Written here, so removing another upstream renumbers nothing. */
+        number?: number;
+        /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
+        addresses: readonly (InterfaceAddress | { address: InterfaceAddress; peer: IP })[];
+        /** The switch port it arrives on. */
+        port?: { device: string; port: string; storm_control?: Port<string, string, string, string>["storm_control"] };
+        /** An exchange's LAN, for `circuit peeringdb`. */
+        exchange?: ExchangeLan;
+    };
+    /** A GRE tunnel to it. `number` is its number in names with `{number}`. */
+    tunnel?: { local: IP; remote: IP; addresses: readonly InterfaceAddress[]; mtu?: number; number?: number };
+    /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
+    sessions: Readonly<Record<string, { address: IP; local_address?: IP }>>;
+    /** The sessions are more than one hop away, from this address of ours. They share a group. */
+    multihop?: { local_address: IP; families?: readonly Family[]; password?: Secret };
+    /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
+    limits?: { ipv4?: number; ipv6?: number };
+    /** What we take. Nothing when absent. */
+    import?: {
+        /** Its default route, at this preference. */
+        default?: { local_pref?: number; description?: string };
+        /** Its routes, through `Bgp.learn`: the `before` rules, sanity, this preference, the tag. Only the default when absent. */
+        learn?: { local_pref?: number; before?: readonly PolicyRule<never, never>[] };
+    };
+    /** Rules of yours in its export, between the community actions and what we announce, such as a prepend. */
+    export?: readonly PolicyRule<never, never>[];
+    /** What we announce to it. Everything else is rejected. */
+    announce: readonly Announced[];
+    /** Drop RFC 1918 sources arriving from it. `privateDrops()` lists the VLANs. */
+    drop_private?: true;
+};
+
+/** Upstreams by key. The key names everything built from it. */
+export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
+
+/** A name made from an upstream: `{key}` is its key, `{KEY}` the key in capitals, `{number}` its `handoff.number` or `tunnel.number`. */
+type Pattern = string;
+/** A pattern for every upstream, or one per role. A role left out takes the default. */
+type ByRole = Pattern | { readonly provider?: Pattern; readonly rs?: Pattern; readonly peer?: Pattern };
+
+/** How the names built from each upstream are made. Each one left out takes its default. */
+export type UpstreamNames = {
+    /** The VLAN a handoff is on. `{key}` when absent. */
+    vlan?: ByRole;
+    /** The native VLAN of a handoff sent tagged. `{key}-native` when absent. */
+    native?: Pattern;
+    /** The router's interface: per role, and `tunnel` for one reached over a tunnel. `{key}` when absent. */
+    interface?: Pattern | { readonly provider?: Pattern; readonly rs?: Pattern; readonly peer?: Pattern; readonly tunnel?: Pattern };
+    /** The import policy. `{KEY}-IN` when absent. */
+    import?: Pattern;
+    /** The export policy. `{KEY}-OUT` when absent. */
+    export?: Pattern;
+    /** The BGP group of an exchange's route servers or of multihop sessions. `{key}` when absent. */
+    group?: Pattern;
+    /** The description of a handoff's switch port. Its `name` when absent. No device names it, so it may be any function. */
+    port?: (key: string, upstream: Upstream) => string;
+};
+
+/** How each upstream's policies are written: shared by every upstream of a catalog. */
+export type UpstreamPolicies<P extends string> = {
+    /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
+    sanity?: P;
+    /** Where a route came from, by upstream: a community or a rule, such as `communityScheme(...).tag(...)`. Nothing is tagged when absent. */
+    tag?: (key: string, upstream: Upstream) => StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+    /** Rules first in each export, such as `communityScheme(...).actions(upstream.asn)`. */
+    actions?: (key: string, upstream: Upstream) => readonly PolicyRule<never, never>[];
+    /** The source address for routes of its family, one per family. */
+    sources?: readonly IP[];
+};
+
+/** The names a device can refer to, and their patterns when the project gives none. */
+const DEFAULTS = {
+    vlan: "{key}",
+    native: "{key}-native",
+    interface: "{key}",
+    import: "{KEY}-IN",
+    export: "{KEY}-OUT",
+    group: "{key}",
+} as const;
+
+type Defaults = typeof DEFAULTS;
+type Field = keyof Defaults;
+
+type Key<C> = keyof C & string;
+/** The upstreams that land on a VLAN of ours. */
+type Landed<C> = { [K in Key<C>]: C[K] extends { handoff: object } ? K : never }[Key<C>];
+/** The upstreams that send their VLAN tagged. */
+type Tagged<C> = { [K in Key<C>]: C[K] extends { handoff: { native: number } } ? K : never }[Key<C>];
+/** The upstreams reached over a tunnel. */
+type Tunneled<C> = { [K in Key<C>]: C[K] extends { tunnel: object } ? K : never }[Key<C>];
+/** The upstreams whose sessions share a group: an exchange's route servers, or multihop sessions. */
+type Grouped<C> = { [K in Key<C>]: C[K] extends { role: "rs" } | { multihop: object } ? K : never }[Key<C>];
+/** The upstreams we take routes from. */
+type Importing<C> = { [K in Key<C>]: C[K] extends { import: object } ? K : never }[Key<C>];
+
+/** The project's pattern for a name, or the default. */
+type PatternOf<N, F extends Field> = N extends { [X in F]: infer P } ? P : Defaults[F];
+/** The pattern an upstream takes: the only one, its tunnel's, its role's, or the default. */
+type Chosen<P, U, F extends Field> = P extends string
+    ? P
+    : U extends { tunnel: object }
+      ? P extends { tunnel: infer T extends string }
+          ? T
+          : Defaults[F]
+      : U extends { role: infer R extends string }
+        ? P extends { [X in R]: infer T extends string }
+            ? T
+            : Defaults[F]
+        : Defaults[F];
+/** Every `From` in `S` replaced. */
+type Replace<S extends string, From extends string, To extends string> = S extends `${infer A}${From}${infer B}`
+    ? `${A}${To}${Replace<B, From, To>}`
+    : S;
+/** An upstream's `handoff.number` or `tunnel.number`. */
+type NumberOf<U> = U extends { handoff: { number: infer N extends number } }
+    ? N
+    : U extends { tunnel: { number: infer N extends number } }
+      ? N
+      : number;
+/** The name built for upstream `K`: its pattern with the key, the key in capitals and its number filled in. */
+type Named<C, N, F extends Field, K extends Key<C>> = Replace<
+    Replace<Replace<Chosen<PatternOf<N, F>, C[K], F>, "{key}", K>, "{KEY}", Uppercase<K>>,
+    "{number}",
+    `${NumberOf<C[K]>}`
+>;
+/** Each of these upstreams' names. */
+type Names<C, N, F extends Field, Ks extends Key<C>> = { [K in Ks]: Named<C, N, F, K> }[Ks];
+
+/** The catalog as written, with any key the shape does not have refused, at every level. */
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown)
+    ? T
+    : { [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never };
+
+/** The names as written, with a name or a role Upstreams does not make refused. */
+type ExactNames<N> = {
+    [F in keyof N]: F extends keyof UpstreamNames
+        ? N[F] extends string | ((...args: never[]) => unknown)
+            ? N[F]
+            : { [R in keyof N[F]]: R extends "provider" | "rs" | "peer" | "tunnel" ? N[F][R] : never }
+        : never;
+};
+
+/** A network's upstreams written once, and each device's part built from them. */
+export class Upstreams {
+    /**
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked. By default:
+     *
+     * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
+     * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
+     *
+     * `names` gives patterns of your own, such as `{ interface: { provider: "core-ipt0{number}-{key}" } }`; see `UpstreamNames`.
+     *
+     * On the router: `vlans()`, `interfaces()`, `uplinks()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     */
+    static define<const C extends UpstreamCatalog, const N extends UpstreamNames = {}>(
+        catalog: C & { [K in keyof C]: Exact<Upstream, C[K]> },
+        options: { names?: N & ExactNames<N> } = {}
+    ) {
+        type V = Names<C, N, "vlan", Landed<C>>;
+        type T = Names<C, N, "native", Tagged<C>>;
+        type I = Names<C, N, "interface", Landed<C>>;
+        type G = Names<C, N, "interface", Tunneled<C>>;
+        type PolicyName = Names<C, N, "import", Importing<C>> | Names<C, N, "export", Key<C>>;
+        type Group = Names<C, N, "group", Grouped<C>>;
+
+        const names: UpstreamNames = options.names ?? {};
+        const all = Object.entries(catalog) as [Key<C>, Upstream][];
+        const nameOf = (key: string, upstream: Upstream) => upstream.name ?? key;
+        const grouped = (upstream: Upstream) => upstream.role === "rs" || Boolean(upstream.multihop);
+
+        /** The name built for one upstream: its pattern with the key, the key in capitals and its number filled in. */
+        const named = (field: Field, key: string, upstream: Upstream): string => {
+            const given = names[field];
+            const pattern =
+                given === undefined || typeof given === "string"
+                    ? (given ?? DEFAULTS[field])
+                    : ((upstream.tunnel && "tunnel" in given ? given.tunnel : given[upstream.role]) ?? DEFAULTS[field]);
+
+            return pattern
+                .replaceAll("{key}", key)
+                .replaceAll("{KEY}", key.toUpperCase())
+                .replaceAll("{number}", () => {
+                    const number = upstream.handoff?.number ?? upstream.tunnel?.number;
+                    if (number === undefined) throw new Error(`Upstreams: ${key} needs a number for ${field} name ${pattern}`);
+                    return String(number);
+                });
+        };
+
+        // Two upstreams under one name would replace each other on the device.
+        for (const field of Object.keys(DEFAULTS) as Field[]) {
+            const taken = new Map<string, string>();
+
+            for (const [key, upstream] of all) {
+                if (field === "native" && upstream.handoff?.native === undefined) continue;
+                if (field === "import" && !upstream.import) continue;
+                if (field === "group" && !grouped(upstream)) continue;
+                if ((field === "vlan" && !upstream.handoff) || (field === "interface" && !upstream.handoff && !upstream.tunnel)) continue;
+
+                const name = named(field, key, upstream);
+                const other = taken.get(name);
+                if (other) throw new Error(`Upstreams: ${other} and ${key} both have the ${field} name ${name}`);
+                taken.set(name, key);
+            }
+        }
+
+        const vlan = (key: string, upstream: Upstream) => named("vlan", key, upstream) as V;
+        const native = (key: string, upstream: Upstream) => named("native", key, upstream) as T;
+        const policy = (direction: "import" | "export", key: string, upstream: Upstream) => named(direction, key, upstream) as PolicyName;
+
+        /** Each landed upstream's VLAN; with a device, the VLANs and natives of those arriving on its ports. */
+        const vlans = <const D extends string | undefined = undefined>(device?: D) => {
+            const result: Record<string, Vlan> = {};
+
+            for (const [key, upstream] of all) {
+                const handoff = upstream.handoff;
+                if (!handoff || (device !== undefined && handoff.port?.device !== device)) continue;
+
+                result[vlan(key, upstream)] = { id: handoff.vlan, description: nameOf(key, upstream) };
+                if (device !== undefined && handoff.native !== undefined) {
+                    result[native(key, upstream)] = {
+                        id: handoff.native,
+                        description: `Native toward ${nameOf(key, upstream)}, nothing else in it`,
+                    };
+                }
+            }
+
+            return result as D extends string ? { [K in V]: Vlan } & { [K in T]: Vlan } : { [K in V]: Vlan };
+        };
+
+        const vlansOn = (device: string) =>
+            all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key, upstream]) => vlan(key, upstream));
+
+        const ports = (device: string) => {
+            const result: Record<string, Port<V | T, never, never, never>> = {};
+
+            for (const [key, upstream] of all) {
+                const handoff = upstream.handoff;
+                if (!handoff?.port || handoff.port.device !== device) continue;
+
+                result[handoff.port.port] = {
+                    description: names.port ? names.port(key, upstream) : nameOf(key, upstream),
+                    ...(handoff.native !== undefined
+                        ? { trunk_vlans: [vlan(key, upstream)], native_vlan: native(key, upstream) }
+                        : { access_vlan: vlan(key, upstream) }),
+                    lldp: false,
+                    stp: false,
+                    ...(handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}),
+                };
+            }
+
+            return result;
+        };
+
+        const interfaces = () => {
+            const result: Record<string, VlanInterface<V, never> | Gre<never>> = {};
+
+            for (const [key, upstream] of all) {
+                const description = nameOf(key, upstream);
+                const name = named("interface", key, upstream);
+
+                if (upstream.tunnel) {
+                    const { local, remote, addresses, mtu } = upstream.tunnel;
+                    result[name] = { type: "gre", description, local, remote, addresses, ...(mtu ? { mtu } : {}) };
+                } else if (upstream.handoff) {
+                    const { addresses, exchange } = upstream.handoff;
+                    result[name] = { type: "vlan", vlan: vlan(key, upstream), description, addresses, ...(exchange ? { exchange } : {}) };
+                }
+            }
+
+            return result as { [K in I]: VlanInterface<V, never> } & { [K in G]: Gre<never> };
+        };
+
+        /** The router's interfaces toward the internet: every landed upstream's, for NAT and lists like it. */
+        const uplinks = () =>
+            all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => named("interface", key, upstream) as I);
+
+        /** What a session or its group takes from its upstream. */
+        const settings = (key: string, upstream: Upstream): NeighborSettings<PolicyName> => ({
+            remote_as: upstream.asn,
+            description: nameOf(key, upstream),
+            role: upstream.role,
+            ...(upstream.import ? { import: policy("import", key, upstream) } : {}),
+            export: policy("export", key, upstream),
+        });
+
+        const groups = () =>
+            Object.fromEntries(
+                all
+                    .filter(([, upstream]) => grouped(upstream))
+                    .map(([key, upstream]) => {
+                        const multihop = upstream.multihop;
+                        return [
+                            named("group", key, upstream),
+                            {
+                                ...settings(key, upstream),
+                                ...(multihop
+                                    ? {
+                                          local_address: multihop.local_address,
+                                          multihop: true,
+                                          ...(multihop.families ? { families: multihop.families } : {}),
+                                          ...(multihop.password ? { password: multihop.password } : {}),
+                                      }
+                                    : {}),
+                            },
+                        ];
+                    })
+            ) as Record<Group, NeighborSettings<PolicyName>>;
+
+        const neighbors = () =>
+            Object.fromEntries(
+                all.flatMap(([key, upstream]) =>
+                    Object.entries(upstream.sessions).map(([name, session]) => {
+                        const limit = upstream.limits?.[Address.family(session.address)];
+                        return [
+                            name,
+                            {
+                                ...session,
+                                ...(grouped(upstream) ? { group: named("group", key, upstream) } : settings(key, upstream)),
+                                ...(limit ? { max_prefixes: limit } : {}),
+                            },
+                        ];
+                    })
+                )
+            ) as Record<string, Neighbor<PolicyName, Group>>;
+
+        const policies = <const P extends string = never>(options: UpstreamPolicies<P> = {}) => {
+            const result: Record<string, PolicyRule<P, never>[]> = {};
+
+            for (const [key, upstream] of all) {
+                result[policy("export", key, upstream)] = [
+                    ...(options.actions?.(key, upstream) ?? []),
+                    ...(upstream.export ?? []),
+                    ...Bgp.announce(upstream.announce),
+                ];
+
+                const taken = upstream.import;
+                if (!taken) continue;
+
+                const tag = options.tag?.(key, upstream);
+                result[policy("import", key, upstream)] = [
+                    ...(taken.default
+                        ? Bgp.defaultOnly({ ...taken.default, ...(options.sources ? { sources: options.sources } : {}) })
+                        : []),
+                    ...(taken.learn
+                        ? Bgp.learn<P>({
+                              ...(taken.learn.before ? { before: taken.learn.before } : {}),
+                              ...(options.sanity ? { sanity: options.sanity } : {}),
+                              ...(options.sources ? { sources: options.sources } : {}),
+                              ...(taken.learn.local_pref !== undefined ? { local_pref: taken.learn.local_pref } : {}),
+                              ...(tag !== undefined ? { tag } : {}),
+                          })
+                        : [{ description: "Nothing else", action: "reject" as const }]),
+                ];
+            }
+
+            return result as Record<PolicyName, PolicyRule<P, never>[]>;
+        };
+
+        /** The VLANs straight off an upstream, natives included: `untrusted` for `Checks.trustBoundary`. */
+        const untrusted = () => [
+            ...all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => vlan(key, upstream)),
+            ...natives(),
+        ];
+
+        const natives = () =>
+            all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key, upstream]) => native(key, upstream));
+
+        const privateDrops = () =>
+            all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key, upstream]) => vlan(key, upstream));
+
+        const tunnelRules = (): FilterRule<never, never>[] =>
+            all.flatMap(([key, upstream]) =>
+                upstream.tunnel
+                    ? [
+                          {
+                              description: `GRE from ${nameOf(key, upstream)}`,
+                              match: {
+                                  protocol: "gre" as const,
+                                  src: `${upstream.tunnel.remote}/${Address.bits(Address.family(upstream.tunnel.remote))}` as Prefix,
+                              },
+                              action: "accept" as const,
+                          },
+                      ]
+                    : []
+            );
+
+        const addresses = () => all.flatMap(([, upstream]) => Object.values(upstream.sessions).map((session) => session.address));
+
+        return {
+            vlans,
+            vlansOn,
+            ports,
+            interfaces,
+            uplinks,
+            groups,
+            neighbors,
+            policies,
+            untrusted,
+            natives,
+            privateDrops,
+            tunnelRules,
+            addresses,
+        };
+    }
+}