@takodotid/circuit 0.39.0 → 0.41.0

package/dist/helpers/index.js

@@ -40,16 +40,17 @@ class Bgp {
       { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" }
     ];
   }
-  static announce(prefixes) {
+  static announce(prefixes, options = {}) {
     return [
       ...prefixes.map(({ prefix, description }) => ({
         ...description ? { description } : {},
         match: { prefix },
         action: "accept"
       })),
-      { description: "Nothing else", action: "reject" }
+      ...options.reject === false ? [] : [Bgp.NOTHING_ELSE]
     ];
   }
+  static NOTHING_ELSE = { description: "Nothing else", action: "reject" };
   static learn(options = {}) {
     const { tag } = options;
     return [
@@ -57,12 +58,12 @@ class Bgp {
       ...options.sanity ? [{ call: options.sanity }] : Bgp.sanity(),
       ...(options.sources ?? []).map((source) => ({ set: { preferred_source: source } })),
       ...options.local_pref !== undefined ? [{ set: { local_pref: options.local_pref } }] : [],
-      ...tag === undefined ? [] : [typeof tag === "object" ? tag : Bgp.adding(tag)],
+      ...tag === undefined ? [] : ["standard" in tag ? Bgp.adding(tag.standard) : ("large" in tag) ? Bgp.adding(tag.large) : tag],
       { action: "accept" }
     ];
   }
   static defaultOnly(options = {}) {
-    return Bgp.DEFAULTS.map(({ family, prefix }) => {
+    const defaults = Bgp.DEFAULTS.map(({ family, prefix }) => {
       const source = options.sources?.find((address) => Address2.family(address) === family);
       const set = {
         ...options.local_pref !== undefined ? { local_pref: options.local_pref } : {},
@@ -75,6 +76,7 @@ class Bgp {
         action: "accept"
       };
     });
+    return options.reject ? [...defaults, Bgp.NOTHING_ELSE] : defaults;
   }
   static adding(community) {
     const large = community.split(":").length === 3;
@@ -142,58 +144,51 @@ class Bgp {
         action: "accept"
       }));
     };
-    const actions = (neighborAs) => {
-      const passOn = scheme.blackhole?.upstreams?.[neighborAs];
+    const passOnTo = (neighborAs) => scheme.blackhole?.upstreams?.[neighborAs];
+    const blackholeExport = (neighborAs) => {
+      if (scheme.blackhole === undefined)
+        return [];
+      const passOn = passOnTo(neighborAs);
+      const match = { large_community: community(scheme.blackhole.function, 0) };
+      return passOn ? [
+        {
+          description: `Blackhole passed on to AS${neighborAs}`,
+          match,
+          set: { remove_communities: ours.standard, remove_large_communities: ours.large, add_communities: [passOn] },
+          action: "accept"
+        }
+      ] : [{ description: "Blackholed here, never announced", match, action: "reject" }];
+    };
+    const rejectDoNotAnnounce = (neighborAs) => {
+      const fn = scheme.do_not_announce;
+      if (fn === undefined)
+        return [];
       return [
-        ...scheme.blackhole !== undefined && !passOn ? [
-          {
-            description: "Blackholed here, never announced",
-            match: { large_community: community(scheme.blackhole.function, 0) },
-            action: "reject"
-          }
-        ] : [],
-        ...scheme.do_not_announce !== undefined ? [
-          {
-            description: "Asked not to be announced anywhere",
-            match: { large_community: community(scheme.do_not_announce, 0) },
-            action: "reject"
-          },
-          {
-            description: `Asked not to be announced to AS${neighborAs}`,
-            match: { large_community: community(scheme.do_not_announce, neighborAs) },
-            action: "reject"
-          }
-        ] : [],
-        ...scheme.blackhole !== undefined && passOn ? [
-          {
-            description: `Blackhole passed on to AS${neighborAs}`,
-            match: { large_community: community(scheme.blackhole.function, 0) },
-            set: {
-              remove_communities: ours.standard,
-              remove_large_communities: ours.large,
-              add_communities: [passOn]
-            },
-            action: "accept"
-          }
-        ] : [],
-        ...Bgp.PREPENDS.flatMap(([name, times]) => {
-          const fn = scheme.prepend?.[name];
-          if (fn === undefined)
-            return [];
-          return [
-            {
-              description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
-              match: { large_community: community(fn, neighborAs) },
-              set: { prepend: times }
-            }
-          ];
-        }),
+        { description: "Asked not to be announced anywhere", match: { large_community: community(fn, 0) }, action: "reject" },
         {
-          description: "Our communities stay inside our network",
-          set: { remove_communities: ours.standard, remove_large_communities: ours.large }
+          description: `Asked not to be announced to AS${neighborAs}`,
+          match: { large_community: community(fn, neighborAs) },
+          action: "reject"
         }
       ];
     };
+    const prepends = (neighborAs) => Bgp.PREPENDS.flatMap(([name, times]) => {
+      const fn = scheme.prepend?.[name];
+      if (fn === undefined)
+        return [];
+      return [
+        {
+          description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
+          match: { large_community: community(fn, neighborAs) },
+          set: { prepend: times }
+        }
+      ];
+    });
+    const stripOurs = () => ({
+      description: "Our communities stay inside our network",
+      set: { remove_communities: ours.standard, remove_large_communities: ours.large }
+    });
+    const actions = (neighborAs) => passOnTo(neighborAs) ? [...rejectDoNotAnnounce(neighborAs), ...blackholeExport(neighborAs), ...prepends(neighborAs), stripOurs()] : [...blackholeExport(neighborAs), ...rejectDoNotAnnounce(neighborAs), ...prepends(neighborAs), stripOurs()];
     const catalogue = [
       ...Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
         community: written(scheme.learned_from.function, value),
@@ -222,7 +217,18 @@ class Bgp {
         }
       ] : []
     ];
-    return { community, learned_from: learnedFrom, tag, actions, blackhole, catalogue };
+    return {
+      community,
+      learned_from: learnedFrom,
+      tag,
+      actions,
+      blackholeExport,
+      rejectDoNotAnnounce,
+      prepends,
+      stripOurs,
+      blackhole,
+      catalogue
+    };
   }
   static article(word) {
     return /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
@@ -279,6 +285,22 @@ class Checks {
     }
     return findings;
   };
+  static importsEndInAcceptOrReject = (devices) => {
+    const findings = [];
+    for (const device of devices) {
+      for (const neighbor of Bgp.neighborPolicies(device)) {
+        const last = neighbor.import ? device.policies?.[neighbor.import]?.at(-1) : undefined;
+        if (neighbor.import && (!last?.action || last.match)) {
+          findings.push({
+            level: "error",
+            device: device.name,
+            message: `${neighbor.name}: import ${neighbor.import} does not end in an unconditional accept or reject`
+          });
+        }
+      }
+    }
+    return findings;
+  };
   static tunnelsOutsideOffered = (devices) => {
     const findings = [];
     for (const device of devices) {
@@ -664,69 +686,48 @@ class Filters {
   }
 }
 // src/helpers/upstreams.ts
-var DEFAULTS = {
-  vlan: "{key}",
-  native: "{key}-native",
-  interface: "{key}",
-  import: "{KEY}-IN",
-  export: "{KEY}-OUT",
-  group: "{key}"
-};
-
 class Upstreams {
   static define(catalog, options = {}) {
-    const names = options.names ?? {};
     const all = Object.entries(catalog);
     const nameOf = (key, upstream) => upstream.name ?? key;
-    const grouped = (upstream) => upstream.role === "rs" || Boolean(upstream.multihop);
-    const named = (field, key, upstream) => {
-      const given = names[field];
-      const pattern = given === undefined || typeof given === "string" ? given ?? DEFAULTS[field] : (upstream.tunnel && "tunnel" in given ? given.tunnel : given[upstream.role]) ?? DEFAULTS[field];
-      return pattern.replaceAll("{key}", key).replaceAll("{KEY}", key.toUpperCase()).replaceAll("{number}", () => {
-        const number = upstream.handoff?.number ?? upstream.tunnel?.number;
-        if (number === undefined)
-          throw new Error(`Upstreams: ${key} needs a number for ${field} name ${pattern}`);
-        return String(number);
-      });
-    };
-    for (const field of Object.keys(DEFAULTS)) {
+    const unique = (what, names) => {
       const taken = new Map;
-      for (const [key, upstream] of all) {
-        if (field === "native" && upstream.handoff?.native === undefined)
-          continue;
-        if (field === "import" && !upstream.import)
+      for (const [key, name] of names) {
+        if (name === undefined)
           continue;
-        if (field === "group" && !grouped(upstream))
-          continue;
-        if (field === "vlan" && !upstream.handoff || field === "interface" && !upstream.handoff && !upstream.tunnel)
-          continue;
-        const name = named(field, key, upstream);
         const other = taken.get(name);
         if (other)
-          throw new Error(`Upstreams: ${other} and ${key} both have the ${field} name ${name}`);
+          throw new Error(`Upstreams: ${other} and ${key} both have the ${what} ${name}`);
         taken.set(name, key);
       }
-    }
-    const vlan = (key, upstream) => named("vlan", key, upstream);
-    const native = (key, upstream) => named("native", key, upstream);
-    const policy = (direction, key, upstream) => named(direction, key, upstream);
+    };
+    unique("VLAN", [
+      ...all.map(([key, upstream]) => [key, upstream.handoff?.vlan.name]),
+      ...all.map(([key, upstream]) => [key, upstream.handoff?.native?.name])
+    ]);
+    unique("interface", all.map(([key, upstream]) => [key, upstream.handoff?.interface ?? upstream.tunnel?.interface]));
+    unique("policy", [
+      ...all.map(([key, upstream]) => [key, upstream.import?.name]),
+      ...all.map(([key, upstream]) => [key, upstream.export.name])
+    ]);
+    unique("BGP group", all.map(([key, upstream]) => [key, upstream.group]));
     const vlans = (device) => {
       const result = {};
       for (const [key, upstream] of all) {
         const handoff = upstream.handoff;
         if (!handoff || device !== undefined && handoff.port?.device !== device)
           continue;
-        result[vlan(key, upstream)] = { id: handoff.vlan, description: nameOf(key, upstream) };
-        if (device !== undefined && handoff.native !== undefined) {
-          result[native(key, upstream)] = {
-            id: handoff.native,
+        result[handoff.vlan.name] = { id: handoff.vlan.id, description: nameOf(key, upstream) };
+        if (handoff.native) {
+          result[handoff.native.name] = {
+            id: handoff.native.id,
             description: `Native toward ${nameOf(key, upstream)}, nothing else in it`
           };
         }
       }
       return result;
     };
-    const vlansOn = (device) => all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key, upstream]) => vlan(key, upstream));
+    const vlansOn = (device) => all.flatMap(([, upstream]) => upstream.handoff?.port?.device === device ? [upstream.handoff.vlan.name] : []);
     const ports = (device) => {
       const result = {};
       for (const [key, upstream] of all) {
@@ -734,10 +735,10 @@ class Upstreams {
         if (!handoff?.port || handoff.port.device !== device)
           continue;
         result[handoff.port.port] = {
-          description: names.port ? names.port(key, upstream) : nameOf(key, upstream),
-          ...handoff.native !== undefined ? { trunk_vlans: [vlan(key, upstream)], native_vlan: native(key, upstream) } : { access_vlan: vlan(key, upstream) },
-          lldp: false,
-          stp: false,
+          description: nameOf(key, upstream),
+          ...handoff.native ? { trunk_vlans: [handoff.vlan.name], native_vlan: handoff.native.name } : { access_vlan: handoff.vlan.name },
+          lldp: handoff.port.lldp ?? false,
+          stp: handoff.port.stp ?? false,
           ...handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}
         };
       }
@@ -747,82 +748,63 @@ class Upstreams {
       const result = {};
       for (const [key, upstream] of all) {
         const description = nameOf(key, upstream);
-        const name = named("interface", key, upstream);
         if (upstream.tunnel) {
-          const { local, remote, addresses, mtu } = upstream.tunnel;
+          const { interface: name, local, remote, addresses, mtu } = upstream.tunnel;
           result[name] = { type: "gre", description, local, remote, addresses, ...mtu ? { mtu } : {} };
         } else if (upstream.handoff) {
-          const { addresses, exchange } = upstream.handoff;
-          result[name] = { type: "vlan", vlan: vlan(key, upstream), description, addresses, ...exchange ? { exchange } : {} };
+          const { interface: name, vlan, addresses, exchange } = upstream.handoff;
+          result[name] = { type: "vlan", vlan: vlan.name, description, addresses, ...exchange ? { exchange } : {} };
         }
       }
       return result;
     };
-    const uplinks = () => all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => named("interface", key, upstream));
-    const settings = (key, upstream) => ({
-      remote_as: upstream.asn,
-      description: nameOf(key, upstream),
-      role: upstream.role,
-      ...upstream.import ? { import: policy("import", key, upstream) } : {},
-      export: policy("export", key, upstream)
-    });
-    const groups = () => Object.fromEntries(all.filter(([, upstream]) => grouped(upstream)).map(([key, upstream]) => {
+    const uplinks = () => all.flatMap(([, upstream]) => upstream.handoff ? [upstream.handoff.interface] : []);
+    const settings = (key, upstream) => {
       const multihop = upstream.multihop;
-      return [
-        named("group", key, upstream),
-        {
-          ...settings(key, upstream),
-          ...multihop ? {
-            local_address: multihop.local_address,
-            multihop: true,
-            ...multihop.families ? { families: multihop.families } : {},
-            ...multihop.password ? { password: multihop.password } : {}
-          } : {}
-        }
-      ];
-    }));
+      return {
+        remote_as: upstream.asn,
+        description: nameOf(key, upstream),
+        role: upstream.role,
+        ...upstream.import ? { import: upstream.import.name } : {},
+        export: upstream.export.name,
+        ...multihop ? {
+          local_address: multihop.local_address,
+          multihop: true,
+          ...multihop.families ? { families: multihop.families } : {},
+          ...multihop.password ? { password: multihop.password } : {}
+        } : {}
+      };
+    };
+    const groups = () => Object.fromEntries(all.flatMap(([key, upstream]) => upstream.group ? [[upstream.group, settings(key, upstream)]] : []));
     const neighbors = () => Object.fromEntries(all.flatMap(([key, upstream]) => Object.entries(upstream.sessions).map(([name, session]) => {
       const limit = upstream.limits?.[Address2.family(session.address)];
       return [
         name,
         {
+          ...upstream.group ? { group: upstream.group } : settings(key, upstream),
           ...session,
-          ...grouped(upstream) ? { group: named("group", key, upstream) } : settings(key, upstream),
           ...limit ? { max_prefixes: limit } : {}
         }
       ];
     })));
-    const policies = (options = {}) => {
+    const policies = () => {
       const result = {};
       for (const [key, upstream] of all) {
-        result[policy("export", key, upstream)] = [
-          ...options.actions?.(key, upstream) ?? [],
-          ...upstream.export ?? [],
-          ...Bgp.announce(upstream.announce)
-        ];
-        const taken = upstream.import;
-        if (!taken)
-          continue;
-        const tag = options.tag?.(key, upstream);
-        result[policy("import", key, upstream)] = [
-          ...taken.default ? Bgp.defaultOnly({ ...taken.default, ...options.sources ? { sources: options.sources } : {} }) : [],
-          ...taken.learn ? Bgp.learn({
-            ...taken.learn.before ? { before: taken.learn.before } : {},
-            ...options.sanity ? { sanity: options.sanity } : {},
-            ...options.sources ? { sources: options.sources } : {},
-            ...taken.learn.local_pref !== undefined ? { local_pref: taken.learn.local_pref } : {},
-            ...tag !== undefined ? { tag } : {}
-          }) : [{ description: "Nothing else", action: "reject" }]
-        ];
+        if (upstream.import) {
+          const rules = upstream.import.rules;
+          result[upstream.import.name] = options.mapImports ? options.mapImports(rules, key, upstream) : rules;
+        }
+        const rules = upstream.export.rules;
+        result[upstream.export.name] = options.mapExports ? options.mapExports(rules, key, upstream) : rules;
       }
       return result;
     };
     const untrusted = () => [
-      ...all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => vlan(key, upstream)),
+      ...all.flatMap(([, upstream]) => upstream.handoff ? [upstream.handoff.vlan.name] : []),
       ...natives()
     ];
-    const natives = () => all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key, upstream]) => native(key, upstream));
-    const privateDrops = () => all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key, upstream]) => vlan(key, upstream));
+    const natives = () => all.flatMap(([, upstream]) => upstream.handoff?.native ? [upstream.handoff.native.name] : []);
+    const privateDrops = () => all.flatMap(([, upstream]) => upstream.handoff && upstream.drop_private ? [upstream.handoff.vlan.name] : []);
     const tunnelRules = () => all.flatMap(([key, upstream]) => upstream.tunnel ? [
       {
         description: `GRE from ${nameOf(key, upstream)}`,

package/dist/types/core/validator.d.ts

@@ -2,6 +2,8 @@ import type { Finding, Network } from "./define.js";
 export declare class Validator {
     static run(network: Network): Finding[];
     private static checkDevice;
+    /** A management VDOM: FortiOS only, not `root`, with declared interfaces, and routes that leave through its own. */
+    private static checkVdoms;
     /** What the model's hardware holds, from the catalog. A LAG with too many members is an error; too many switch rules is a warning, since the limit is only roughly known. */
     private static checkLimits;
     private static checkVlans;

package/dist/types/helpers/bgp.d.ts

@@ -28,8 +28,12 @@ export type LearnOptions<P extends string> = {
     sources?: readonly IP[];
     /** Preference for the routes learned. Higher wins. */
     local_pref?: number;
-    /** Where the route came from: a community to add, or a rule, such as `communityScheme(...).tag(...)`. */
-    tag?: StandardCommunity | LargeCommunity | PolicyRule<never, never>;
+    /** Where the route came from: `{ standard: "64500:100" }` or `{ large: "64500:1:1" }` adds that community, and a rule, such as `communityScheme(...).tag(...)`, is used as it is. */
+    tag?: {
+        standard: StandardCommunity;
+    } | {
+        large: LargeCommunity;
+    } | PolicyRule<never, never>;
 };
 /** What `Bgp.defaultOnly` sets on the default routes it takes. */
 export type DefaultOnlyOptions = {
@@ -39,6 +43,13 @@ export type DefaultOnlyOptions = {
     description?: string;
     /** The source address for the default of its family, one per family. */
     sources?: readonly IP[];
+    /** End with `{ description: "Nothing else", action: "reject" }`, so the policy takes the default route only. Off by default: any other route goes on to the rules after these. */
+    reject?: boolean;
+};
+/** What `Bgp.announce` writes after the accepts. */
+export type AnnounceOptions = {
+    /** End with `{ description: "Nothing else", action: "reject" }`, so nothing else leaves. On by default: it stops a route leak when the reject is forgotten. Turn it off for an export that adds rules after these. */
+    reject?: boolean;
 };
 /** Kinds of neighbor and the number each is tagged with, such as `{ transit: 1, customer: 3 }`. */
 export type CommunityClasses = Readonly<Record<string, number>>;
@@ -89,16 +100,41 @@ export declare class Bgp {
     private static readonly DEFAULTS;
     /** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
     static sanity(lengths?: SanityLengths): PolicyRule<never, never>[];
-    /** An export policy that announces each prefix, at exactly its length, then rejects everything else. The last rule is the unconditional reject `Checks.exportsEndInReject` looks for. */
-    static announce(prefixes: readonly Announced[]): PolicyRule<never, never>[];
     /**
-     * An import policy that takes a neighbor's routes: `before` first, then the sanity rules, then each source address and the local preference, then the tag, then accept.
+     * An export that announces each prefix, at exactly its length. It returns, in order:
+     *
+     * 1. `{ description, match: { prefix }, action: "accept" }` for each prefix;
+     * 2. `{ description: "Nothing else", action: "reject" }`, the unconditional reject `Checks.exportsEndInReject` looks for.
      *
-     * `sanity` names a policy holding `Bgp.sanity()` to call, so several imports share one; without it, the sanity rules are written here. `tag` is a community to add, or a rule such as `communityScheme(...).tag(...)`. Each of `sources` is the source address for routes of its own family.
+     * The reject is there by default, so a forgotten one can't leak routes. `{ reject: false }` leaves it out, for an export that adds rules after these and ends in a reject of its own.
+     */
+    static announce(prefixes: readonly Announced[], options?: AnnounceOptions): PolicyRule<never, never>[];
+    /** The reject that ends a policy: nothing else gets through. */
+    private static readonly NOTHING_ELSE;
+    /**
+     * An import policy that takes a neighbor's routes. It returns these rules, in order, each only when its option is given:
+     *
+     * 1. the `before` rules, as written;
+     * 2. `{ call: sanity }`, or the rules of `Bgp.sanity()` written in when `sanity` is left out;
+     * 3. `{ set: { preferred_source: source } }` for each of `sources`, one per family;
+     * 4. `{ set: { local_pref } }`;
+     * 5. the tag: `{ description: "Tag 64500:1:1", set: { add_large_communities: ["64500:1:1"] } }` for `{ large: "64500:1:1" }`, `add_communities` for `{ standard }`, or the rule given;
+     * 6. `{ action: "accept" }`.
+     *
+     * So `Bgp.learn({ sanity: "SANITY", local_pref: 200, tag: { large: "64500:1:1" } })` is
+     * `[{ call: "SANITY" }, { set: { local_pref: 200 } }, { description: "Tag 64500:1:1", set: { add_large_communities: ["64500:1:1"] } }, { action: "accept" }]`.
+     *
+     * FortiOS refuses it: a route map stops at the first rule that matches, so it can't hold rules 3 to 5, which change a route and go on; and its sanity rules match RPKI, which FortiOS doesn't have. `validate` names each such rule. On FortiOS, write the import by hand with what rules 3 to 5 set in the rule that accepts.
      */
     static learn<const P extends string = never>(options?: LearnOptions<P>): PolicyRule<P, never>[];
     /**
-     * Import rules that take the default route, `0.0.0.0/0` and `::/0`, from a transit. Any other route reaches the next rule, or is rejected when there is none. Each of `sources` is the source address for the default of its own family.
+     * Import rules that take the default route from a transit. They are, in order:
+     *
+     * 1. `{ description, match: { prefix: "0.0.0.0/0" }, set: { local_pref, preferred_source }, action: "accept" }`;
+     * 2. the same for `::/0`;
+     * 3. with `{ reject: true }` only, `{ description: "Nothing else", action: "reject" }`.
+     *
+     * Without `reject`, any other route goes on to the rules after these, so `[...Bgp.defaultOnly(), ...Bgp.learn()]` takes both. Each of `sources` is the source address for the default of its own family; `set` holds only what is given.
      */
     static defaultOnly(options?: DefaultOnlyOptions): PolicyRule<never, never>[];
     /** A rule adding one community, standard or large. */
@@ -116,8 +152,12 @@ export declare class Bgp {
     /**
      * Policy rules and a catalogue from one community scheme, so the communities your routers set, the ones they act on, and the ones you publish never disagree.
      *
-     * - `tag(neighborClass, neighborAs, { site, trusted })`: a rule for an import policy. It removes your communities a neighbor set, then adds where the route was learned. A `trusted` neighbor keeps its requests: do not announce, prepend, blackhole. `site` is needed when the scheme has `learned_at`.
-     * - `actions(neighborAs, { blackhole })`: rules for an export policy toward one neighbor. They act on a customer's action communities, then remove all of yours. Place them before the rules that accept. A blackholed route goes no further, unless `blackhole` names the neighbor's own blackhole community: then it is passed on with it, so the neighbor drops the traffic too.
+     * - `tag(neighborClass, neighborAs, { site, trusted })`: one rule for an import policy, `{ description: "Learned from AS<n>", set }`. Its `set` removes your standard communities and your large ones (a `trusted` neighbor loses only the "where it came from" functions, so it keeps its requests: do not announce, prepend, blackhole), then adds `learned_from`, `learned_at` and `learned_from_as` where the scheme has them. `site` is needed when the scheme has `learned_at`.
+     * - `actions(neighborAs)`: the rules for an export policy toward one neighbor, before the rules that accept. They are `[...blackholeExport(n), ...rejectDoNotAnnounce(n), ...prepends(n), stripOurs()]`; toward a neighbor that takes blackholes (`blackhole.upstreams`), `rejectDoNotAnnounce(n)` comes first, so a route asked not to go there is never passed on as a blackhole.
+     * - `blackholeExport(neighborAs)`: a blackholed route goes no further, `Blackholed here, never announced`, unless `blackhole.upstreams` names the neighbor's own blackhole community: then it is passed on with it, so the neighbor drops the traffic too. Nothing without `blackhole`.
+     * - `rejectDoNotAnnounce(neighborAs)`: rejects a route asked not to be announced anywhere, then one asked not to be announced to this neighbor. Nothing without `do_not_announce`.
+     * - `prepends(neighborAs)`: prepends once, twice or three times toward this neighbor, where a route asks. Nothing without `prepend`.
+     * - `stripOurs()`: one rule removing every community of yours, `Our communities stay inside our network`.
      * - `blackhole(prefixSets)`: rules for the import policy of a neighbor you trust with blackholes, before anything that rejects long prefixes. They take a route the neighbor asked to blackhole, but only inside `prefixSets`, its own space, and drop traffic to it here. One rule per set, so one call covers both families.
      * - `catalogue`: every community, for `communities` in `defineNetwork`.
      * - `community(fn, parameter)`: one community of yours, for a rule of your own.
@@ -131,6 +171,10 @@ export declare class Bgp {
             trusted?: boolean;
         }) => PolicyRule<never, never>;
         actions: (neighborAs: number) => PolicyRule<never, never>[];
+        blackholeExport: (neighborAs: number) => PolicyRule<never, never>[];
+        rejectDoNotAnnounce: (neighborAs: number) => PolicyRule<never, never>[];
+        prepends: (neighborAs: number) => PolicyRule<never, never>[];
+        stripOurs: () => PolicyRule<never, never>;
         blackhole: <S extends string>(prefixSets: readonly S[]) => PolicyRule<never, S>[];
         catalogue: Community[];
     };

package/dist/types/helpers/checks.d.ts

@@ -16,6 +16,10 @@ export declare class Checks {
      * Every BGP export ends in a reject that matches everything, so nothing leaves by accident. An export to a neighbor whose `role` is `customer` is left out: sending a customer everything you know is what it pays for, and cannot leak a route to the rest of the internet.
      */
     static readonly exportsEndInReject: Check;
+    /**
+     * Every BGP import ends in a rule that decides for every route, an accept or a reject without a match, so what the import takes is written in it and not left to the platform's default.
+     */
+    static readonly importsEndInAcceptOrReject: Check;
     /** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
     static readonly tunnelsOutsideOffered: Check;
     /**

package/dist/types/helpers/index.d.ts

@@ -1,5 +1,5 @@
 export { Bgp } from "./bgp.js";
-export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
+export type { AnnounceOptions, Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
 export { Cables } from "./cables.js";
 export type { FarEnd } from "./cables.js";
 export { Checks } from "./checks.js";
@@ -9,6 +9,6 @@ export type { ExchangeMember, InternetExchange } from "./exchange.js";
 export { Filters } from "./filters.js";
 export { RouteServerConfig } from "./route-server.js";
 export { Upstreams } from "./upstreams.js";
-export type { Upstream, UpstreamCatalog, UpstreamPolicies } from "./upstreams.js";
+export type { NamedVlan, Upstream, UpstreamCatalog, UpstreamOptions, UpstreamPolicy } from "./upstreams.js";
 export type { RouteServer } from "./route-server.js";
 export type { AntiAmplificationOptions } from "./filters.js";