@takodotid/circuit 0.40.0 → 0.42.0

package/dist/types/helpers/cables.d.ts

@@ -1,13 +1,20 @@
-/** The far end of a port, for a description of your own: the device and its port by Circuit's name. */
+/** The far end of a port, for a description of your own: the device, its port by Circuit's name, and the port as printed on the device when that end names its platform and model. */
 export type FarEnd = {
     device: string;
     port: string;
+    label?: string;
+};
+/** One end of a cable entry: the device, and its platform and model if a description should name its ports as printed on it. */
+type End = {
+    device: string;
+    platform?: string;
+    model?: string;
 };
 /** What every cable of one entry shares. */
 type Shared = {
     /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
     through?: string;
-    /** A port's description from its far end. When absent, Circuit writes the far device and the far port as printed on it, such as `firewall-1 port6`, from the far device's own file. */
+    /** A port's description from its far end, such as `(far) => \`${far.device} ${far.label}\``. No description when absent. */
     describe?: (far: FarEnd) => string;
 };
 /** A port a cable builds: the other end, the LAG it is in, and a description when `describe` gives one. */
@@ -31,12 +38,10 @@ export declare class Cables {
      * ```
      */
     static link<const NA extends string, const NB extends string>(spec: Shared & {
-        a: {
-            device: string;
+        a: End & {
             port: NA;
         };
-        b: {
-            device: string;
+        b: End & {
             port: NB;
         };
     }): {
@@ -47,12 +52,10 @@ export declare class Cables {
      * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
      */
     static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(spec: Shared & {
-        a: {
-            device: string;
+        a: End & {
             lag: LA;
         };
-        b: {
-            device: string;
+        b: End & {
             lag: LB;
         };
         cables: C;
@@ -60,7 +63,7 @@ export declare class Cables {
         a: Record<keyof C & string, CablePort<LA>>;
         b: Record<C[keyof C], CablePort<LB>>;
     };
-    /** A port facing `port` on the far device. */
+    /** A port facing `port` on the far end. */
     private static end;
 }
 export {};

package/dist/types/helpers/checks.d.ts

@@ -16,6 +16,10 @@ export declare class Checks {
      * Every BGP export ends in a reject that matches everything, so nothing leaves by accident. An export to a neighbor whose `role` is `customer` is left out: sending a customer everything you know is what it pays for, and cannot leak a route to the rest of the internet.
      */
     static readonly exportsEndInReject: Check;
+    /**
+     * Every BGP import ends in a rule that decides for every route, an accept or a reject without a match, so what the import takes is written in it and not left to the platform's default.
+     */
+    static readonly importsEndInAcceptOrReject: Check;
     /** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
     static readonly tunnelsOutsideOffered: Check;
     /**

package/dist/types/helpers/exchange.d.ts

@@ -29,13 +29,19 @@ export type InternetExchange<V extends string> = {
     mac_limit?: number;
     /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
     ethertypes?: readonly Ethertype[];
+    /** LLDP on member ports. Off when absent: a member's router has no business learning the fabric. */
+    lldp?: boolean;
+    /** Spanning tree on member ports. Off when absent: a member's port faces a router, which must not join the fabric's spanning tree. */
+    stp?: boolean;
 };
 /** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
 export declare class Exchange {
     /**
      * Member ports and a check for an internet exchange's fabric.
      *
-     * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through. With `mac_limit` and `ethertypes`, it also learns that many MAC addresses at most and takes in only those kinds of frame.
+     * - `ports(device)`: every member's port on one switch, each written as
+     *   `{ description: "<name>, AS<asn>", access_vlan: vlan, stp: false, lldp: false, storm_control: { broadcast, multicast, unknown_unicast: { percent: storm_percent } } }`,
+     *   plus `mac_limit` and `ethertypes` when the exchange sets them. `stp` and `lldp` are the exchange's own when it sets them, and storm control is 1 % when `storm_percent` is absent.
      * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
      * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
      * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.

package/dist/types/helpers/index.d.ts

@@ -1,5 +1,5 @@
 export { Bgp } from "./bgp.js";
-export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
+export type { AnnounceOptions, Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
 export { Cables } from "./cables.js";
 export type { FarEnd } from "./cables.js";
 export { Checks } from "./checks.js";
@@ -9,6 +9,6 @@ export type { ExchangeMember, InternetExchange } from "./exchange.js";
 export { Filters } from "./filters.js";
 export { RouteServerConfig } from "./route-server.js";
 export { Upstreams } from "./upstreams.js";
-export type { Upstream, UpstreamCatalog, UpstreamPolicies } from "./upstreams.js";
+export type { NamedVlan, Upstream, UpstreamCatalog, UpstreamOptions, UpstreamPolicy } from "./upstreams.js";
 export type { RouteServer } from "./route-server.js";
 export type { AntiAmplificationOptions } from "./filters.js";

package/dist/types/helpers/upstreams.d.ts

@@ -1,237 +1,179 @@
-import type { Exchange as ExchangeLan, Family, FilterRule, Gre, InterfaceAddress, IP, LargeCommunity, Neighbor, NeighborSettings, PolicyRule, Port, Secret, StandardCommunity, Vlan, VlanInterface } from "../schema/index.js";
-import { type Announced } from "./bgp.js";
-/** One network we exchange routes with: a transit we buy, an exchange's route servers, or a peer. */
+import type { Exchange as ExchangeLan, Family, FilterRule, Gre, InterfaceAddress, IP, Neighbor, NeighborSettings, PolicyRule, Port, Secret, Vlan, VlanInterface } from "../schema/index.js";
+/** A route policy an upstream's sessions use: its name on the device, and its rules, in order. */
+export type UpstreamPolicy = {
+    /** The policy's name, as the device carries it. */
+    name: string;
+    /** Its rules, in order. Nothing is added to them unless `mapImports` or `mapExports` adds it. */
+    rules: readonly PolicyRule<string, string>[];
+};
+/** A VLAN by its name and its ID. */
+export type NamedVlan = {
+    name: string;
+    id: number;
+};
+/** One network we exchange routes with: a transit we buy, an exchange's route servers, or a peer. Every name it puts on a device is written here. */
 export type Upstream = {
     /** Its name as people write it, for descriptions: `Transit A`. The key when absent. */
     name?: string;
     asn: number;
     /** What it is to us: `provider` for a transit, `rs` for an exchange's route servers, `peer` for a direct session. */
     role: "provider" | "rs" | "peer";
-    /** Where it lands on our side: a VLAN, our addresses on it, and the switch port it arrives on. A peer over a tunnel, or over an exchange's VLAN, has none. */
+    /** Where it lands on our side: a VLAN, the router's interface on it, and the switch port it arrives on. A peer over a tunnel, or over an exchange's VLAN, has none. */
     handoff?: {
-        /** The VLAN's ID. */
-        vlan: number;
-        /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
-        native?: number;
-        /** Its number in names with `{number}`, such as `core-ipt01-transita`. Written here, so removing another upstream renumbers nothing. */
-        number?: number;
+        /** The VLAN it arrives on. */
+        vlan: NamedVlan;
+        /** It sends its VLAN tagged: its switch port gets this native VLAN, which nothing else is in. Untagged when absent. */
+        native?: NamedVlan;
+        /** The router's VLAN interface on it. */
+        interface: string;
         /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
         addresses: readonly (InterfaceAddress | {
             address: InterfaceAddress;
             peer: IP;
         })[];
-        /** The switch port it arrives on. */
+        /**
+         * The switch port it arrives on. LLDP and spanning tree are off there unless `lldp` or `stp` says otherwise: an upstream's port faces someone else's network, which should neither learn ours nor join our spanning tree.
+         */
         port?: {
             device: string;
             port: string;
             storm_control?: Port<string, string, string, string>["storm_control"];
+            /** LLDP on the port. Off when absent. */
+            lldp?: boolean;
+            /** Spanning tree on the port. Off when absent. */
+            stp?: boolean;
         };
         /** An exchange's LAN, for `circuit peeringdb`. */
         exchange?: ExchangeLan;
     };
-    /** A GRE tunnel to it. `number` is its number in names with `{number}`. */
+    /** A GRE tunnel to it, and the router's interface for it. */
     tunnel?: {
+        interface: string;
         local: IP;
         remote: IP;
         addresses: readonly InterfaceAddress[];
         mtu?: number;
-        number?: number;
     };
     /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
     sessions: Readonly<Record<string, {
         address: IP;
         local_address?: IP;
     }>>;
-    /** The sessions are more than one hop away, from this address of ours. They share a group. */
+    /** A BGP group its sessions share, by this name: the group holds the AS, role, policies, table and multihop settings, and each session names it. Each session holds them itself when absent. */
+    group?: string;
+    /** The sessions are more than one hop away, from this address of ours. */
     multihop?: {
         local_address: IP;
         families?: readonly Family[];
         password?: Secret;
     };
+    /** The routing table its sessions install the routes they learn in, one of the router's `routing.tables`: a transit that carries only one block's traffic out. The main table when absent. */
+    table?: string;
     /** The most prefixes a session may send, by its family: about twice what it sends. Over it, the session closes until it is cleared. */
     limits?: {
         ipv4?: number;
         ipv6?: number;
     };
-    /** What we take. Nothing when absent. */
-    import?: {
-        /** Its default route, at this preference. */
-        default?: {
-            local_pref?: number;
-            description?: string;
-        };
-        /** Its routes, through `Bgp.learn`: the `before` rules, sanity, this preference, the tag. Only the default when absent. */
-        learn?: {
-            local_pref?: number;
-            before?: readonly PolicyRule<never, never>[];
-        };
-    };
-    /** Rules of yours in its export, between the community actions and what we announce, such as a prepend. */
-    export?: readonly PolicyRule<never, never>[];
-    /** What we announce to it. Everything else is rejected. */
-    announce: readonly Announced[];
-    /** Drop RFC 1918 sources arriving from it. `privateDrops()` lists the VLANs. */
+    /** What we take, as its policy. Nothing when absent. */
+    import?: UpstreamPolicy;
+    /** What we send it, as its policy. */
+    export: UpstreamPolicy;
+    /** Its VLAN is listed by `privateDrops()`, for an ACL that drops RFC 1918 sources arriving from it. Nothing else is done with it. */
     drop_private?: true;
 };
-/** Upstreams by key. The key names everything built from it. */
+/** Upstreams by key. */
 export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
-/** A name made from an upstream: `{key}` is its key, `{KEY}` the key in capitals, `{number}` its `handoff.number` or `tunnel.number`. */
-type Pattern = string;
-/** A pattern for every upstream, or one per role. A role left out takes the default. */
-type ByRole = Pattern | {
-    readonly provider?: Pattern;
-    readonly rs?: Pattern;
-    readonly peer?: Pattern;
+/** What every upstream's policies share, written once: plain functions over each policy's rules. */
+export type UpstreamOptions = {
+    /** Each import's rules as the device gets them, from the rules the upstream writes. The rules as written when absent. */
+    mapImports?: (rules: readonly PolicyRule<string, string>[], key: string, upstream: Upstream) => readonly PolicyRule<string, string>[];
+    /** Each export's rules as the device gets them, from the rules the upstream writes. The rules as written when absent. */
+    mapExports?: (rules: readonly PolicyRule<string, string>[], key: string, upstream: Upstream) => readonly PolicyRule<string, string>[];
 };
-/** How the names built from each upstream are made. Each one left out takes its default. */
-export type UpstreamNames = {
-    /** The VLAN a handoff is on. `{key}` when absent. */
-    vlan?: ByRole;
-    /** The native VLAN of a handoff sent tagged. `{key}-native` when absent. */
-    native?: Pattern;
-    /** The router's interface: per role, and `tunnel` for one reached over a tunnel. `{key}` when absent. */
-    interface?: Pattern | {
-        readonly provider?: Pattern;
-        readonly rs?: Pattern;
-        readonly peer?: Pattern;
-        readonly tunnel?: Pattern;
-    };
-    /** The import policy. `{KEY}-IN` when absent. */
-    import?: Pattern;
-    /** The export policy. `{KEY}-OUT` when absent. */
-    export?: Pattern;
-    /** The BGP group of an exchange's route servers or of multihop sessions. `{key}` when absent. */
-    group?: Pattern;
-    /** The description of a handoff's switch port. Its `name` when absent. No device names it, so it may be any function. */
-    port?: (key: string, upstream: Upstream) => string;
-};
-/** How each upstream's policies are written: shared by every upstream of a catalog. */
-export type UpstreamPolicies<P extends string> = {
-    /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
-    sanity?: P;
-    /** Where a route came from, by upstream: a community or a rule, such as `communityScheme(...).tag(...)`. Nothing is tagged when absent. */
-    tag?: (key: string, upstream: Upstream) => StandardCommunity | LargeCommunity | PolicyRule<never, never>;
-    /** Rules first in each export, such as `communityScheme(...).actions(upstream.asn)`. */
-    actions?: (key: string, upstream: Upstream) => readonly PolicyRule<never, never>[];
-    /** The source address for routes of its family, one per family. */
-    sources?: readonly IP[];
-};
-/** The names a device can refer to, and their patterns when the project gives none. */
-declare const DEFAULTS: {
-    readonly vlan: "{key}";
-    readonly native: "{key}-native";
-    readonly interface: "{key}";
-    readonly import: "{KEY}-IN";
-    readonly export: "{KEY}-OUT";
-    readonly group: "{key}";
-};
-type Defaults = typeof DEFAULTS;
-type Field = keyof Defaults;
-type Key<C> = keyof C & string;
-/** The upstreams that land on a VLAN of ours. */
-type Landed<C> = {
-    [K in Key<C>]: C[K] extends {
-        handoff: object;
-    } ? K : never;
-}[Key<C>];
-/** The upstreams that send their VLAN tagged. */
-type Tagged<C> = {
-    [K in Key<C>]: C[K] extends {
+type Values<T> = T[keyof T];
+/** Each VLAN name the catalog writes. */
+type VlanName<C> = Values<{
+    [K in keyof C]: C[K] extends {
         handoff: {
-            native: number;
+            vlan: {
+                name: infer N extends string;
+            };
         };
-    } ? K : never;
-}[Key<C>];
-/** The upstreams reached over a tunnel. */
-type Tunneled<C> = {
-    [K in Key<C>]: C[K] extends {
-        tunnel: object;
-    } ? K : never;
-}[Key<C>];
-/** The upstreams whose sessions share a group: an exchange's route servers, or multihop sessions. */
-type Grouped<C> = {
-    [K in Key<C>]: C[K] extends {
-        role: "rs";
-    } | {
-        multihop: object;
-    } ? K : never;
-}[Key<C>];
-/** The upstreams we take routes from. */
-type Importing<C> = {
-    [K in Key<C>]: C[K] extends {
-        import: object;
-    } ? K : never;
-}[Key<C>];
-/** The project's pattern for a name, or the default. */
-type PatternOf<N, F extends Field> = N extends {
-    [X in F]: infer P;
-} ? P : Defaults[F];
-/** The pattern an upstream takes: the only one, its tunnel's, its role's, or the default. */
-type Chosen<P, U, F extends Field> = P extends string ? P : U extends {
-    tunnel: object;
-} ? P extends {
-    tunnel: infer T extends string;
-} ? T : Defaults[F] : U extends {
-    role: infer R extends string;
-} ? P extends {
-    [X in R]: infer T extends string;
-} ? T : Defaults[F] : Defaults[F];
-/** Every `From` in `S` replaced. */
-type Replace<S extends string, From extends string, To extends string> = S extends `${infer A}${From}${infer B}` ? `${A}${To}${Replace<B, From, To>}` : S;
-/** An upstream's `handoff.number` or `tunnel.number`. */
-type NumberOf<U> = U extends {
-    handoff: {
-        number: infer N extends number;
-    };
-} ? N : U extends {
-    tunnel: {
-        number: infer N extends number;
-    };
-} ? N : number;
-/** The name built for upstream `K`: its pattern with the key, the key in capitals and its number filled in. */
-type Named<C, N, F extends Field, K extends Key<C>> = Replace<Replace<Replace<Chosen<PatternOf<N, F>, C[K], F>, "{key}", K>, "{KEY}", Uppercase<K>>, "{number}", `${NumberOf<C[K]>}`>;
-/** Each of these upstreams' names. */
-type Names<C, N, F extends Field, Ks extends Key<C>> = {
-    [K in Ks]: Named<C, N, F, K>;
-}[Ks];
-/** The catalog as written, with any key the shape does not have refused, at every level. */
-type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown) ? T : S extends unknown ? {
-    [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never;
-} : never;
-/** The names as written, with a name or a role Upstreams does not make refused. */
-type ExactNames<N> = {
-    [F in keyof N]: F extends keyof UpstreamNames ? N[F] extends string | ((...args: never[]) => unknown) ? N[F] : {
-        [R in keyof N[F]]: R extends "provider" | "rs" | "peer" | "tunnel" ? N[F][R] : never;
-    } : never;
-};
+    } ? N : never;
+}>;
+/** Each native VLAN name. */
+type NativeName<C> = Values<{
+    [K in keyof C]: C[K] extends {
+        handoff: {
+            native: {
+                name: infer N extends string;
+            };
+        };
+    } ? N : never;
+}>;
+/** Each router interface on a handoff. */
+type HandoffInterface<C> = Values<{
+    [K in keyof C]: C[K] extends {
+        handoff: {
+            interface: infer N extends string;
+        };
+    } ? N : never;
+}>;
+/** Each router interface for a tunnel. */
+type TunnelInterface<C> = Values<{
+    [K in keyof C]: C[K] extends {
+        tunnel: {
+            interface: infer N extends string;
+        };
+    } ? N : never;
+}>;
+/** Each policy name. */
+type PolicyName<C> = Values<{
+    [K in keyof C]: (C[K] extends {
+        import: {
+            name: infer N extends string;
+        };
+    } ? N : never) | (C[K] extends {
+        export: {
+            name: infer N extends string;
+        };
+    } ? N : never);
+}>;
+/** Each BGP group name. */
+type GroupName<C> = Values<{
+    [K in keyof C]: C[K] extends {
+        group: infer N extends string;
+    } ? N : never;
+}>;
+/** Each routing table name. */
+type TableName<C> = Values<{
+    [K in keyof C]: C[K] extends {
+        table: infer N extends string;
+    } ? N : never;
+}>;
 /** A network's upstreams written once, and each device's part built from them. */
 export declare class Upstreams {
     /**
-     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked. By default:
-     *
-     * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
-     * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policies, and every name it puts on a device. Everything a device needs is built from it:
      *
-     * `names` gives patterns of your own, such as `{ interface: { provider: "core-ipt0{number}-{key}" } }`; see `UpstreamNames`.
+     * - On the router: `vlans()`, `interfaces()`, `uplinks()`, `groups()`, `neighbors()`, `policies()`, `tunnelRules()`, `addresses()`.
+     * - On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`.
+     * - For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`.
      *
-     * On the router: `vlans()`, `interfaces()`, `uplinks()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     * An import or export is the rules the upstream writes, in order, passed through `mapImports` or `mapExports` when given: what every upstream shares, such as a call to a sanity policy or the community actions, goes there. Nothing else is added. Lists follow the catalog's order, where order counts on a device. A key the shape doesn't have is refused by the type, by its name.
      */
-    static define<const C extends UpstreamCatalog, const N extends UpstreamNames = {}>(catalog: C & {
-        [K in keyof C]: Exact<Upstream, C[K]>;
-    }, options?: {
-        names?: N & ExactNames<N>;
-    }): {
-        vlans: <const D extends string | undefined = undefined>(device?: D) => D extends string ? { [K in Names<C, N, "vlan", Landed<C>>]: Vlan; } & { [K in Names<C, N, "native", Tagged<C>>]: Vlan; } : { [K in Names<C, N, "vlan", Landed<C>>]: Vlan; };
-        vlansOn: (device: string) => Names<C, N, "vlan", Landed<C>>[];
-        ports: (device: string) => Record<string, Port<Names<C, N, "native", Tagged<C>> | Names<C, N, "vlan", Landed<C>>, never, never, never>>;
-        interfaces: () => { [K in Names<C, N, "interface", Landed<C>>]: VlanInterface<Names<C, N, "vlan", Landed<C>>, never>; } & { [K in Names<C, N, "interface", Tunneled<C>>]: Gre<never>; };
-        uplinks: () => Names<C, N, "interface", Landed<C>>[];
-        groups: () => Record<Names<C, N, "group", Grouped<C>>, NeighborSettings<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>>>;
-        neighbors: () => Record<string, Neighbor<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>, Names<C, N, "group", Grouped<C>>>>;
-        policies: <const P extends string = never>(options?: UpstreamPolicies<P>) => Record<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>, PolicyRule<P, never>[]>;
-        untrusted: () => (Names<C, N, "native", Tagged<C>> | Names<C, N, "vlan", Landed<C>>)[];
-        natives: () => Names<C, N, "native", Tagged<C>>[];
-        privateDrops: () => Names<C, N, "vlan", Landed<C>>[];
+    static define<const C extends UpstreamCatalog>(catalog: C & UpstreamCatalog, options?: UpstreamOptions): {
+        vlans: (device?: string) => { [K in VlanName<C> | NativeName<C>]: Vlan; };
+        vlansOn: (device: string) => VlanName<C>[];
+        ports: (device: string) => Record<string, Port<NativeName<C> | VlanName<C>, never, never, never>>;
+        interfaces: () => { [K in HandoffInterface<C>]: VlanInterface<VlanName<C>, never>; } & { [K in TunnelInterface<C>]: Gre<never>; };
+        uplinks: () => HandoffInterface<C>[];
+        groups: () => Record<GroupName<C>, NeighborSettings<PolicyName<C>, TableName<C>>>;
+        neighbors: () => Record<string, Neighbor<PolicyName<C>, GroupName<C>, TableName<C>>>;
+        policies: () => Record<PolicyName<C>, PolicyRule<never, never>[]>;
+        untrusted: () => (NativeName<C> | VlanName<C>)[];
+        natives: () => NativeName<C>[];
+        privateDrops: () => VlanName<C>[];
         tunnelRules: () => FilterRule<never, never>[];
         addresses: () => IP[];
     };

package/dist/types/platforms/derive.d.ts

@@ -1,6 +1,6 @@
 import type { Device } from "../schema/index.js";
 /** A feature a platform renders once proved on one of its devices. */
-export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
+export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom" | "routing-tables";
 export declare class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
     static lagIds(device: Device): Map<string, number>;

package/dist/types/platforms/fortios/routing.d.ts

@@ -1,7 +1,7 @@
 import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema/index.js";
 import { FortiOsBlock } from "./tree.js";
 type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 /** The lengths a prefix list's rule takes within its prefix. */
 type Lengths = {
     ge?: number;
@@ -23,7 +23,7 @@ export declare class FortiOsRouting {
         readonly ipv6: 128;
     };
     /** A neighbor's settings with its group's beneath them. */
-    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string>;
+    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string>;
     /** The families a session carries: its own, or the family of its address. */
     static familiesOfNeighbor(device: Device, neighbor: AnyNeighbor): Family[];
     /** Whether a static route, OSPF or BGP detects a dead neighbor with BFD, which the device then runs. */

package/dist/types/platforms/junos/bgp.d.ts

@@ -1,6 +1,6 @@
 import type { Device, Neighbor, NeighborSettings } from "../../schema/index.js";
 import { type JunosStatements } from "./render.js";
-type AnyNeighbor = Neighbor<string, string>;
+type AnyNeighbor = Neighbor<string, string, string>;
 /** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
 export declare class JunosBgp {
     private readonly out;
@@ -19,7 +19,7 @@ export declare class JunosBgp {
     /** Add the device's prefix sets, RPKI servers, BGP sessions and the policies they use. */
     static render(out: JunosStatements, device: Device): void;
     /** A neighbor's settings with its group's beneath them. */
-    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string>;
+    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string>;
     /** A name made of a value's words, for a community or a path-length list: `64500:*` becomes `64500-any`. */
     private static slug;
     /** A community as the platform writes a member: a large community carries the `large:` prefix. */

package/dist/types/platforms/routeros/render.d.ts

@@ -199,6 +199,10 @@ export declare class RouterOsRender {
     /** Every switch rule the device's hardware ACLs make, in order: one for each port with an ACL, each rule of it, and each source and destination port or range of the rule. */
     static switchRules(device: Device): SwitchRule[];
     private routing;
+    /** A table beside the main one. `fib` puts its routes in the forwarding table, so traffic can be routed by them. */
+    private routingTables;
+    /** Rules in the order written. `lookup-only-in-table` drops what the table has no route for, and `lookup` falls back to the main table. */
+    private routingRules;
     private staticRoutes;
     private rpki;
     /** The default instance exists on every device; it is stated in the form the export prints it. */

package/dist/types/schema/device.d.ts

@@ -65,9 +65,9 @@ export type Vrf = {
 /**
  * Everything one device runs. What is not written here is removed from the device or returned to its default.
  *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
  */
-export type Device<Pl extends string = string, M extends string = string, N extends string = string, V extends string = string, I extends string = string, P extends string = string, S extends string = string, G extends string = string, A extends string = string, AS extends string = string, U extends string = string, F extends string = string, C extends string = string> = {
+export type Device<Pl extends string = string, M extends string = string, N extends string = string, V extends string = string, I extends string = string, P extends string = string, S extends string = string, G extends string = string, A extends string = string, AS extends string = string, U extends string = string, F extends string = string, C extends string = string, T extends string = string> = {
     /** Hostname. */
     name: string;
     /** Operating system. It decides which adapter renders and applies the device. */
@@ -92,8 +92,8 @@ export type Device<Pl extends string = string, M extends string = string, N exte
     interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
     /** Separate routing tables, keyed by name. */
     vrfs?: Record<F, Vrf>;
-    /** Static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
     /** Route policies, keyed by name. */
     policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
     /** Prefix sets that policies match on, keyed by name. */

package/dist/types/schema/firewall.d.ts

@@ -96,7 +96,11 @@ export type Firewall<I extends string, AS extends string> = {
     };
     /** Helpers that run. None when absent. */
     helpers?: readonly Helper[];
-    /** Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. An address NAT uses inside one stays tracked, or its replies would never be translated back. Everything is tracked when absent. */
+    /**
+     * Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. Everything is tracked when absent.
+     *
+     * Each address NAT uses inside one of these prefixes (a source translation's `to`, a destination translation's `to` or matched `dst`) stays tracked: Circuit writes two accept rules for it, one for traffic to it and one for traffic from it, before the untracked rules. Without them, a reply to that address would skip tracking and never be translated back.
+     */
     untracked?: readonly Prefix[];
 };
 /** A stateless rule evaluated in hardware where traffic arrives, before routing. */

package/dist/types/schema/interfaces.d.ts

@@ -109,7 +109,7 @@ export type Port<V extends string, A extends string, L extends string, F extends
     acl?: A;
     /** The LAG this port is in. Every other setting goes on the LAG. */
     lag?: L;
-    /** Another of our devices at the other end of the cable. Without a `description`, the port is described from it: the far device and the far port as printed on it, such as `firewall-1 port6`. */
+    /** Another of our devices at the other end of the cable. */
     link?: Link;
 };
 /** Settings every interface that is not a physical port shares. */