@takodotid/circuit 0.4.3

package/src/adapters/devices/types.ts

@@ -0,0 +1,31 @@
+import type { Device, Family } from "../../schema";
+
+/** One part of a plan: what a reviewer reads, and what is sent. */
+export type Step = { title: string; show: string[]; send: string[] };
+
+/** The commands that turn what a device runs into what its config says. `problems` blocks an apply: something the adapter cannot converge. */
+export type Plan = { steps: Step[]; problems: string[] };
+
+export type ApplyOptions = {
+    /** Also send every secret, so a rotated value reaches the device. Secrets cannot be read back, so they are otherwise only sent when the object holding them is new. */
+    secrets: boolean;
+    /** Minutes before a platform that can restore itself does so, if the run does not prove access survived. */
+    rollback: number;
+};
+
+export type DeviceAdapter = {
+    /** File extension of a saved snapshot, for syntax highlighting. */
+    extension: string;
+    /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
+    unsupported(device: Device): string[];
+    /** The whole configuration the device should run. Secrets appear as markers, never values. */
+    render(device: Device): string;
+    /** What the device runs now, secrets removed, in the form `render` produces where the platform allows. */
+    read(device: Device, network: readonly Device[]): Promise<string>;
+    /** What it takes to go from `current` to `desired`. */
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    /** Replace the contents of a prefix set fetched from a registry. Absent on a platform that cannot hold one. */
+    fill?(device: Device, network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+    /** Send a plan, keeping the device reachable or restoring it. */
+    apply(device: Device, network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+};

package/src/adapters/devices/vrp/TRAPS.md

@@ -0,0 +1,22 @@
+# VRP traps
+
+Behaviour that looks like something else. Each one has been hit on a CE6855 running V200R005.
+
+- Changes stage in a candidate and apply at `commit`. `commit` does not write to flash; without `save` a reboot restores the old configuration. `save` asks `[Y/N]`.
+- An ACL bound to a service with no rules denies everything, including the session doing it. Rules and binding go in one commit.
+- The first login asks to change the password. Answering Y replaces it at once and invalidates every stored credential; always answer N.
+- SSH negotiates an ECDSA host key it then signs wrongly, so the handshake fails. Pin `ssh-rsa`.
+- Connections in quick succession are refused before authentication for a while. Connect one at a time.
+- Accounts lock after a few failures and the last ten passwords are refused. A retry loop locks the account out.
+- A `?` sent by a script is executed, not treated as help. Never send one.
+- `reset saved-configuration` erases the management address. Never over the network.
+- The prompt shows commit state: `[~host]` clean, `[*host]` uncommitted. Read `display configuration candidate` when in doubt.
+- LLDP is off by default. A port setting for LLDP is refused until it is on globally.
+- A trunk forwards its native VLAN's untagged frames only when that VLAN is also allowed; the adapter adds it.
+- The name `admin` is refused for a local user.
+- A port joins an Eth-Trunk only while it holds no other setting, including a description.
+- An empty block such as `bfd` enters its view; the next line sent goes into it unless the view is left.
+- SNMPv3 passwords are asked for interactively, twice. `authentication-mode` must come before `privacy-mode`.
+- `abort` is not a command here. `clear configuration candidate` discards uncommitted changes.
+- sFlow samples per port, `sflow sampling rate N`, N from 4096; the default is 8192 and an explicit 8192 is kept as written. A port names a collector only once the collector exists globally; until then it is refused with "collector does not exist".
+- `vlan batch` holds every VLAN on one line, and undoing a list that names a VLAN with an L3 interface is refused. A change sends only the VLANs added and `undo vlan batch` for the ones removed.