@takodotid/circuit 0.4.3

package/src/schema/device.ts

@@ -0,0 +1,95 @@
+import type { IP } from "./common";
+import type { AclRule, Firewall } from "./firewall";
+import type { Interface, Port, Vlan } from "./interfaces";
+import type { PrefixSet, RoutePolicy } from "./policy";
+import type { Routing } from "./routing";
+import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
+
+/** How the framework reaches the device. */
+export type Connection<U extends string> = {
+    /** Management address. */
+    host: IP;
+    /** One of the device's `users`. Its password is the login. */
+    user: U;
+    /** SSH port. 22 when absent. */
+    port?: number;
+};
+
+/** A separate routing table, with the interfaces that route in it. */
+export type Vrf = {
+    /** What the VRF is for. */
+    description?: string;
+};
+
+/**
+ * Everything one device runs. What is not written here is removed from the device or returned to its default.
+ *
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ */
+export type Device<
+    Pl extends string = string,
+    M extends string = string,
+    N extends string = string,
+    V extends string = string,
+    I extends string = string,
+    P extends string = string,
+    S extends string = string,
+    G extends string = string,
+    A extends string = string,
+    AS extends string = string,
+    U extends string = string,
+    F extends string = string,
+    C extends string = string,
+> = {
+    /** Hostname. */
+    name: string;
+    /** Operating system, which decides the adapter that renders and applies the device. */
+    platform: Pl;
+    /** Hardware model. Decides which port names exist. */
+    model: M;
+    /** How the framework logs in. */
+    connection: Connection<NoInfer<U>>;
+    /** Device-wide settings. */
+    system?: System;
+    /** Logins, keyed by user name. Users not listed are removed. */
+    users?: Record<U, User>;
+    /** Ways in, and who may use them. */
+    management?: Management<NoInfer<I | N>, NoInfer<C>>;
+    /** Certificates, keyed by name. */
+    certificates?: Record<C, Certificate>;
+    /** VLANs, keyed by name. */
+    vlans?: Record<V, Vlan>;
+    /** Physical ports, keyed by `<speed>-<position>`. */
+    ports?: Partial<Record<N, Port<NoInfer<V>, NoInfer<A>, NoInfer<I>, NoInfer<F>>>>;
+    /** Interfaces that are not physical ports, keyed by name. */
+    interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
+    /** Separate routing tables, keyed by name. */
+    vrfs?: Record<F, Vrf>;
+    /** Static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Route policies, keyed by name. */
+    policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
+    /** Prefix sets that policies match on, keyed by name. */
+    prefix_sets?: Record<S, PrefixSet>;
+    /** Packet filtering and address translation. */
+    firewall?: Firewall<NoInfer<I | N>, AS>;
+    /** Hardware ACLs, keyed by name, applied to a port with `acl`. */
+    acls?: Record<A, readonly AclRule<NoInfer<V>>[]>;
+    /** DHCP servers, keyed by name. */
+    dhcp?: Record<string, DhcpServer<NoInfer<I | N>>>;
+    /** DHCP relays, keyed by name. */
+    dhcp_relay?: Record<string, DhcpRelay<NoInfer<I | N>>>;
+    /** Flow records or packet samples sent to collectors. */
+    flow_export?: FlowExport<NoInfer<I | N>>;
+    /** Advertise and learn neighbors with LLDP on every port, or only on the interfaces listed. A port may override it. */
+    lldp?: true | { interfaces: readonly NoInfer<I | N>[] };
+    /** Spanning tree on every switched port. A port may override it. */
+    stp?: {
+        /** Which variant runs. RSTP when absent. */
+        mode?: "stp" | "rstp" | "mstp";
+        /** Bridge priority, 0 to 61440 in steps of 4096. Lower wins the root election. */
+        priority?: number;
+    };
+    /** Forward in hardware where the platform can. An interface may override it. */
+    hardware_offload?: boolean;
+};

package/src/schema/firewall.ts

@@ -0,0 +1,128 @@
+import type { Family, IP, Prefix, Rate } from "./common";
+
+/** An IP protocol. `icmp` means ICMPv6 in an IPv6 rule. */
+export type Protocol = "tcp" | "udp" | "icmp" | "gre" | "esp" | "ah" | "ospf" | "vrrp";
+
+/** The state connection tracking assigns a packet. */
+export type ConnectionState = "new" | "established" | "related" | "untracked" | "invalid";
+
+/** A TCP header flag. */
+export type TcpFlag = "fin" | "syn" | "rst" | "psh" | "ack" | "urg";
+
+/** Conditions on a packet. All must hold. A rule with addresses of one family applies to that family only. */
+export type FilterMatch<I extends string, AS extends string> = {
+    /** Only packets of this family. */
+    family?: Family;
+    /** IP protocol. */
+    protocol?: Protocol;
+    /** Source address or prefix. */
+    src?: Prefix;
+    /** Destination address or prefix. */
+    dst?: Prefix;
+    /** Source is in this address set. */
+    src_set?: AS;
+    /** Destination is in this address set. */
+    dst_set?: AS;
+    /** Source port, or any of several. TCP and UDP only. */
+    src_port?: number | readonly number[];
+    /** Destination port, or any of several. TCP and UDP only. */
+    dst_port?: number | readonly number[];
+    /** Arrived on this interface. */
+    in_interface?: I;
+    /** Leaves through this interface. */
+    out_interface?: I;
+    /** Connection tracking state, any of these. */
+    state?: readonly ConnectionState[];
+    /** TCP flags that must be set, and flags that must not be. */
+    tcp_flags?: { set?: readonly TcpFlag[]; unset?: readonly TcpFlag[] };
+};
+
+/** One firewall rule. */
+export type FilterRule<I extends string, AS extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets the rule applies to. Every packet when absent. */
+    match?: FilterMatch<I, AS>;
+    /** What happens to a matching packet. `reject` answers the sender, `drop` does not. */
+    action: "accept" | "drop" | "reject";
+    /** Hand the rest of an accepted flow to the fast path, past the remaining rules. */
+    offload?: true;
+};
+
+/** Rules evaluated in order, first match wins, then `default`. */
+export type Chain<I extends string, AS extends string> = {
+    /** What happens to a packet no rule matched. Accept when absent. */
+    default?: "accept" | "drop";
+    /** Evaluated in order. */
+    rules?: readonly FilterRule<I, AS>[];
+};
+
+/** One address translation. */
+export type NatRule<I extends string, AS extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets are translated. Every packet when absent. */
+    match?: FilterMatch<I, AS>;
+} & (
+    | {
+          /** Use the address of the outgoing interface. */
+          action: "masquerade";
+      }
+    | {
+          /** `snat` rewrites the source, `dnat` the destination. */
+          action: "snat" | "dnat";
+          /** The address to rewrite to. */
+          to: IP;
+          /** The port to rewrite to. Unchanged when absent. */
+          to_port?: number;
+      }
+);
+
+/** Connection-tracking helpers that rewrite application payloads. None run unless listed. */
+export type Helper = "ftp" | "tftp" | "sip" | "h323" | "pptp" | "rtsp" | "irc";
+
+/** What the device filters and translates. */
+export type Firewall<I extends string, AS extends string> = {
+    /** Named groups of addresses and prefixes, of either family, that rules match on. */
+    address_sets?: Record<AS, readonly (IP | Prefix)[]>;
+    /** Traffic to the device, through it, and from it. */
+    filter?: {
+        input?: Chain<I, NoInfer<AS>>;
+        forward?: Chain<I, NoInfer<AS>>;
+        output?: Chain<I, NoInfer<AS>>;
+    };
+    /** Source translation on the way out, destination translation on the way in. */
+    nat?: {
+        source?: readonly NatRule<I, NoInfer<AS>>[];
+        destination?: readonly NatRule<I, NoInfer<AS>>[];
+    };
+    /** Helpers that run. None when absent. */
+    helpers?: readonly Helper[];
+};
+
+/** A stateless rule evaluated in hardware where traffic arrives, before routing. */
+export type AclRule<V extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets the rule applies to. Every packet when absent. */
+    match?: {
+        /** Only packets of this family. */
+        family?: Family;
+        /** IP protocol. */
+        protocol?: Protocol;
+        /** Source prefix. */
+        src?: Prefix;
+        /** Destination prefix. */
+        dst?: Prefix;
+        /** Source port, or any of several. */
+        src_port?: number | readonly number[];
+        /** Destination port, or any of several. */
+        dst_port?: number | readonly number[];
+        /** Carried in this VLAN. */
+        vlan?: V;
+    };
+    /** What happens to a matching packet. */
+    action: "accept" | "drop";
+    /** Accepted traffic above this rate is dropped. */
+    rate?: Rate;
+};

package/src/schema/index.ts

@@ -0,0 +1,7 @@
+export type * from "./common";
+export type * from "./device";
+export type * from "./firewall";
+export type * from "./interfaces";
+export type * from "./policy";
+export type * from "./routing";
+export type * from "./system";

package/src/schema/interfaces.ts

@@ -0,0 +1,192 @@
+import type { Address, IP, Prefix, Secret } from "./common";
+
+/** A VLAN. The key it is declared under is its name. */
+export type Vlan = {
+    /** The number carried on the wire, 1 to 4094. */
+    id: number;
+    /** What the VLAN is for. */
+    description?: string;
+};
+
+/** A storm-control threshold: packets per second, or percent of the link's speed. */
+export type Threshold = { pps: number } | { percent: number };
+
+/** A virtual router address shared with other devices on the same segment, RFC 5798. */
+export type Vrrp = {
+    /** Virtual router number, 1 to 255. The same on every device sharing the address. */
+    id: number;
+    /** The shared address, without a length. */
+    address: IP;
+    /** Higher wins the master election, 1 to 254. 100 when absent. */
+    priority?: number;
+    /** Take mastership back from a lower priority device when this one returns. Off when absent. */
+    preempt?: boolean;
+    /** Seconds between advertisements. 1 when absent. */
+    interval?: number;
+};
+
+/** Layer 3 settings shared by every interface that can hold an address. */
+export type Routed<F extends string> = {
+    /** Addresses with their length. Use `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
+    addresses?: readonly (Address | { address: Address; peer: IP })[];
+    /** Send IPv6 router advertisements on this interface. Off when absent. */
+    ipv6_ra?: boolean;
+    /** Overrides the device's `hardware_offload` for traffic routed through this interface. Software forwarding is what makes the firewall apply. */
+    hardware_offload?: boolean;
+    /** Virtual router addresses held on this interface. */
+    vrrp?: readonly Vrrp[];
+    /** The VRF this interface routes in. The default table when absent. */
+    vrf?: F;
+    /** This interface is the network's presence at an internet exchange. Devices ignore it; `circuit peeringdb` publishes it. */
+    exchange?: Exchange;
+};
+
+/** Presence at an internet exchange, as a registry lists it. The addresses are the interface's own. */
+export type Exchange = {
+    /** The exchange's name, for output. */
+    name: string;
+    /** Capacity toward the exchange, in Mbit/s. */
+    speed: number;
+    /** The exchange LAN's id at PeeringDB, its `ixlan_id`. */
+    peeringdb_ixlan?: number;
+};
+
+/** Spanning tree settings for one port. */
+export type PortStp = {
+    /** The port faces a host, never a switch, so it forwards at once. */
+    edge?: boolean;
+    /** Path cost. Lower is preferred. Derived from speed when absent. */
+    cost?: number;
+    /** Port priority, 0 to 240 in steps of 16. Lower is preferred. */
+    priority?: number;
+};
+
+/** Layer 2 membership. A port or LAG with none of these is routed. */
+export type Switched<V extends string> = {
+    /** Untagged member of one VLAN. */
+    access_vlan?: V;
+    /** Tagged member of these VLANs. */
+    trunk_vlans?: readonly V[];
+    /** Untagged frames on a trunk belong to this VLAN. Only with `trunk_vlans`. */
+    native_vlan?: V;
+    /** Overrides the device's `stp` for this port. `false` stops it sending or acting on BPDUs. */
+    stp?: boolean | PortStp;
+    /** Drop flooded traffic above these thresholds. */
+    storm_control?: {
+        broadcast?: Threshold;
+        multicast?: Threshold;
+        unknown_unicast?: Threshold;
+    };
+};
+
+/** The other end of a cable: another device and its port. Both ends must agree on how they are switched. */
+export type Link = {
+    /** Name of the device at the other end. */
+    device: string;
+    /** The port on that device. */
+    port: string;
+};
+
+/** A physical port. Ports a device does not declare are shut down. */
+export type Port<V extends string, A extends string, L extends string, F extends string> = Routed<F> &
+    Switched<V> & {
+        /** What is plugged in. */
+        description?: string;
+        /** Largest IP packet, in bytes. 1500 when absent. */
+        mtu?: number;
+        /** Fixed speed, for an optic slower than the cage. Negotiated when absent. */
+        speed?: "100m" | "1g" | "10g" | "25g" | "40g" | "50g" | "100g";
+        /** Overrides the device's `lldp` for this port. */
+        lldp?: boolean;
+        /** Hardware ACL applied to traffic arriving on this port. */
+        acl?: A;
+        /** Member of this LAG. The LAG holds every other setting. */
+        lag?: L;
+        /** Another of our devices at the other end of the cable. */
+        link?: Link;
+    };
+
+/** Settings every interface that is not a physical port shares. */
+type Base<F extends string> = Routed<F> & {
+    /** What the interface is for. */
+    description?: string;
+    /** Largest IP packet, in bytes. */
+    mtu?: number;
+};
+
+/** A layer 3 interface on a VLAN. */
+export type VlanInterface<V extends string, F extends string> = Base<F> & {
+    type: "vlan";
+    /** The VLAN it sits on. */
+    vlan: V;
+};
+
+/** An interface that is always up and belongs to no link, for addresses that must not depend on one. */
+export type Loopback<F extends string> = Base<F> & { type: "loopback" };
+
+/** A link aggregation. Member ports name it with `lag`. */
+export type Lag<V extends string, F extends string> = Base<F> &
+    Switched<V> & {
+        type: "lag";
+        /** LACP negotiates membership with the far end; static bundles without asking. LACP when absent. */
+        mode?: "lacp" | "static";
+        /** Number on platforms that name a LAG by number. Its position among the device's LAGs when absent. */
+        id?: number;
+    };
+
+/** A GRE tunnel. */
+export type Gre<F extends string> = Base<F> & {
+    type: "gre";
+    /** Our tunnel endpoint. */
+    local: IP;
+    /** The far tunnel endpoint. */
+    remote: IP;
+};
+
+/** A point-to-point VXLAN tunnel. */
+export type Vxlan<F extends string> = Base<F> & {
+    type: "vxlan";
+    /** Segment identifier, the same on both ends. */
+    vni: number;
+    /** Our tunnel endpoint. */
+    local: IP;
+    /** The far tunnel endpoint. */
+    remote: IP;
+    /** UDP port. 4789 when absent. */
+    port?: number;
+    /** Fixed MAC address, so a rebuild keeps the one the far side learned. */
+    mac?: string;
+};
+
+/** One peer of a WireGuard interface. */
+export type WireGuardPeer = {
+    /** Who or what the peer is. */
+    name: string;
+    /** The peer's public key. Public keys are not secrets. */
+    public_key: string;
+    /** Addresses the peer may send from and that are routed to it. */
+    allowed_addresses: readonly Prefix[];
+    /** `host:port`, for a peer this side dials. The peer dials in when absent. */
+    endpoint?: string;
+    /** Seconds between keepalives, for a peer behind NAT. None when absent. */
+    keepalive?: number;
+    /** What a generated client config routes into the tunnel. Affects no forwarding here. */
+    client_allowed_addresses?: readonly Prefix[];
+};
+
+/** A WireGuard interface. */
+export type WireGuard<F extends string> = Base<F> & {
+    type: "wireguard";
+    /** UDP port peers connect to. */
+    listen_port: number;
+    /** The address clients connect to, for generated client configs. */
+    endpoint?: IP;
+    /** This interface's private key. Its public key is derived from it. */
+    private_key: Secret;
+    /** Who may connect. */
+    peers?: readonly WireGuardPeer[];
+};
+
+/** Any interface that is not a physical port. */
+export type Interface<V extends string, F extends string> =
+    VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;

package/src/schema/policy.ts

@@ -0,0 +1,88 @@
+import type { Family, IP, Prefix } from "./common";
+
+/** Registries a prefix set can be fetched from. */
+export type Registry = "ripe-stat";
+
+/** Prefixes listed here, or fetched from a registry by `refresh` and never typed by hand. */
+export type PrefixSet =
+    | {
+          /** The prefixes, of one family. */
+          prefixes: readonly Prefix[];
+      }
+    | {
+          source: {
+              /** Where the prefixes come from. */
+              registry: Registry;
+              /** What to ask for, for example `AS7713`. */
+              query: string;
+              /** Which family to keep. */
+              family: Family;
+          };
+      };
+
+/** Conditions on a route. All must hold. An empty match holds for every route. */
+export type Match<S extends string> = {
+    /** Only routes of this family. */
+    family?: Family;
+    /** Exactly this prefix. */
+    prefix?: Prefix;
+    /** Any prefix in this set. */
+    prefix_set?: S;
+    /** Prefix length within this range, inclusive. */
+    prefix_length?: { min?: number; max?: number };
+    /** AS path length within this range, inclusive. Every AS counts, prepends included. */
+    as_path_length?: { min?: number; max?: number };
+    /** The route's origin validation state. */
+    rpki?: "valid" | "invalid" | "not-found";
+    /** Carries this standard community, `asn:value`. */
+    community?: string;
+    /** Carries this large community, `asn:function:parameter`. */
+    large_community?: string;
+};
+
+/** Changes to a route. In community lists to remove, `*` stands for any value of a field, as in `64500:*:*`. */
+export type Sets = {
+    /** Preference among routes to the same prefix within our AS. Higher wins. */
+    local_pref?: number;
+    /** Multi-exit discriminator offered to the neighbor. Lower wins. */
+    med?: number;
+    /** Prepend our own AS this many times, to make the path look longer. */
+    prepend?: number;
+    /** Replace the route's standard communities with these. */
+    communities?: readonly string[];
+    /** Add these standard communities. */
+    add_communities?: readonly string[];
+    /** Remove standard communities matching these. */
+    remove_communities?: readonly string[];
+    /** Replace the route's large communities with these. */
+    large_communities?: readonly string[];
+    /** Add these large communities. */
+    add_large_communities?: readonly string[];
+    /** Remove large communities matching these. */
+    remove_large_communities?: readonly string[];
+    /** Next hop for the route. */
+    next_hop?: IP;
+    /** Source address for traffic the device itself sends to the route. Applies to routes of the same family as the address. */
+    preferred_source?: IP;
+};
+
+/**
+ * One step of a route policy. Evaluated in this order: `call`, then `match`, then `set`, then `action`.
+ *
+ * A rule without `action` changes the route and moves on to the next rule.
+ */
+export type PolicyRule<P extends string, S extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Evaluate another policy first. A route it accepts or rejects stops there. */
+    call?: P;
+    /** Which routes the rule applies to. Every route when absent. */
+    match?: Match<S>;
+    /** What to change on a matching route. */
+    set?: Sets;
+    /** Accept or reject a matching route, ending the policy for it. */
+    action?: "accept" | "reject";
+};
+
+/** Rules evaluated in order, first decision wins. A route no rule accepts is rejected. */
+export type RoutePolicy<P extends string, S extends string> = readonly PolicyRule<P, S>[];

package/src/schema/routing.ts

@@ -0,0 +1,120 @@
+import type { Family, IP, Prefix, Secret } from "./common";
+
+/** A route the device carries without learning it. */
+export type StaticRoute<I extends string, F extends string> = {
+    /** Destination. */
+    prefix: Prefix;
+    /** Next-hop address. */
+    via?: IP;
+    /** Next-hop interface, for a link without a next-hop address. */
+    interface?: I;
+    /** Discard matching traffic. The usual way to originate an aggregate. */
+    blackhole?: true;
+    /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
+    distance?: number;
+    /** The VRF the route belongs to. The default table when absent. */
+    vrf?: F;
+    /** Why the route exists. */
+    description?: string;
+};
+
+/** Our side of the relationship, as RFC 9234 defines it. */
+export type BgpRole = "provider" | "customer" | "peer" | "rs" | "rs-client";
+
+/** Settings a BGP neighbor can state itself or take from its group. */
+export type NeighborSettings<P extends string> = {
+    /** The neighbor's AS. Our own AS makes the session internal. */
+    remote_as?: number;
+    /** Who the neighbor is. */
+    description?: string;
+    /** Source address for the session. The outgoing interface's address when absent. */
+    local_address?: IP;
+    /** Policy for routes learned. Nothing is accepted when absent. */
+    import?: P;
+    /** Policy for routes announced. Nothing is announced when absent. */
+    export?: P;
+    /** Our role toward this neighbor, which lets both sides reject a leak. */
+    local_role?: BgpRole;
+    /** The neighbor is more than one hop away. */
+    multihop?: boolean;
+    /** TCP MD5 password shared with the neighbor. */
+    password?: Secret;
+    /** Close the session when the neighbor announces more prefixes than this. It stays closed until cleared by hand, on RouterOS with `/routing bgp session clear <session> flag=limit-exceeded`. */
+    max_prefixes?: number;
+    /** Seconds without a message before the session is declared down. */
+    hold_time?: number;
+    /** Seconds between keepalive messages. */
+    keepalive?: number;
+    /** Families exchanged. The family of the neighbor's address when absent. */
+    families?: readonly Family[];
+    /** Wait for the neighbor to connect instead of connecting to it. */
+    passive?: boolean;
+    /** Detect a dead link in under a second with BFD. */
+    bfd?: boolean;
+};
+
+/** One BGP session. Settings it does not state come from its group. */
+export type Neighbor<P extends string, G extends string> = NeighborSettings<P> & {
+    /** The neighbor's address. */
+    address: IP;
+    /** Group whose settings this neighbor takes where it states none. */
+    group?: NoInfer<G>;
+};
+
+/** BGP on this device. */
+export type Bgp<P extends string, G extends string> = {
+    /** Our AS number. */
+    asn: number;
+    /** Prefixes this device originates. Each needs a route, for example a static blackhole. Export policy still decides who receives them. */
+    networks?: readonly Prefix[];
+    /** Settings shared by several neighbors, keyed by group name. */
+    groups?: Record<G, NeighborSettings<P>>;
+    /** Sessions keyed by name. */
+    neighbors?: Record<string, Neighbor<P, G>>;
+};
+
+/** A route origin validation server, RFC 8210. */
+export type RpkiServer = {
+    /** Where the validator listens. */
+    address: IP;
+    /** Its RTR port, often 323 or 8282. */
+    port: number;
+    /** Who runs it, or why it is here. */
+    description?: string;
+};
+
+/** OSPF on one interface. */
+export type OspfInterface = {
+    /** Cost of sending through this interface. Lower is preferred. Derived from speed when absent. */
+    cost?: number;
+    /** Advertise the interface's network but form no adjacency on it. */
+    passive?: boolean;
+    /** How the link is treated. Broadcast when absent. */
+    network?: "broadcast" | "point-to-point";
+    /** Detect a dead neighbor in under a second with BFD. */
+    bfd?: boolean;
+};
+
+/** OSPF, version 2 for IPv4 and version 3 for IPv6. */
+export type Ospf<I extends string> = {
+    /** Which versions run. IPv4 when absent. */
+    families?: readonly Family[];
+    /** Areas keyed by area ID, for example `0.0.0.0`, each with the interfaces in it. */
+    areas: Record<string, { interfaces: Partial<Record<I, OspfInterface>> }>;
+    /** Routes from other sources announced into OSPF. */
+    redistribute?: readonly ("connected" | "static")[];
+};
+
+/** Routing on this device. */
+export type Routing<P extends string, G extends string, I extends string, F extends string> = {
+    /** Identifies this router to its neighbors. */
+    router_id?: IP;
+    /** Routes the device carries without learning them. */
+    static?: readonly StaticRoute<I, F>[];
+    /** BGP sessions and what they exchange. */
+    bgp?: Bgp<P, G>;
+    /** OSPF areas and interfaces. */
+    ospf?: Ospf<I>;
+    /** Validators answering route origin validation. */
+    rpki?: readonly RpkiServer[];
+};