@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/dist/index.js

@@ -1,28 +0,0 @@
-import {
-  Utils2,
-  Secrets2
-} from "./chunks/index-3b343xva.js";
-import {
-  Address2
-} from "./chunks/index-n7w3tg5y.js";
-
-// src/core/define.ts
-var secret = (name) => ({ secret: name });
-var secretFile = (path) => {
-  if (!/^[A-Za-z0-9_./-]+$/.test(path))
-    throw new Error(`secret file path ${path} may hold only letters, digits, _ . / and -`);
-  return { secret_file: path };
-};
-function defineDevice(device) {
-  return device;
-}
-var defineNetwork = (network) => network;
-export {
-  Address2 as Address,
-  Secrets2 as Secrets,
-  Utils2 as Utils,
-  defineDevice,
-  defineNetwork,
-  secret,
-  secretFile
-};

package/dist/types/core/address-space.d.ts

@@ -1,62 +0,0 @@
-import type { Device } from "../schema/index.js";
-/** One address or range in a segment, and what holds it. */
-export type Use = {
-    /** An address, or `first-last` for a range. */
-    address: string;
-    what: string;
-};
-/** A prefix our devices have addresses in. */
-export type Segment = {
-    prefix: string;
-    uses: Use[];
-    /** How many addresses no one uses, as a number written out, since an IPv6 count does not fit a JavaScript number. */
-    free: string;
-    /** The lowest free address, when there is one. */
-    next?: string;
-};
-/** A prefix in use without being a segment: a loopback's address, or a block routed elsewhere. */
-export type Block = {
-    prefix: string;
-    what: string;
-};
-/** Space the network owns: a prefix it originates in BGP, or one asked for. Everything in use inside it, and what is free. */
-export type Space = {
-    prefix: string;
-    /** Why it is listed, such as `originated by edge-01`. */
-    owner: string;
-    segments: Segment[];
-    blocks: Block[];
-    /** The fewest prefixes that cover what nothing uses. */
-    free: string[];
-};
-export type AddressReport = {
-    spaces: Space[];
-    /** What is in use outside every space. Left out when a prefix is asked for. */
-    elsewhere: {
-        segments: Segment[];
-        blocks: Block[];
-    };
-};
-export declare class AddressSpace {
-    private static isHostRoute;
-    private static numberOf;
-    /** Addresses a segment can give out: IPv4 leaves out the network and broadcast addresses below /31, and IPv6 the subnet-router anycast address. */
-    private static usable;
-    /** Ranges merged, so overlapping ones count once. */
-    private static merged;
-    /** What is inside `within` and not in any of the ranges. */
-    private static gaps;
-    /** `12` or, for a count too long to read, `about 2^64`, to the nearest power of two. */
-    private static count;
-    private static byAddress;
-    /** IPv4 before IPv6, then by first address. */
-    private static comparePrefixes;
-    private static byPrefix;
-    /** Every address in use, by segment, under the space the network owns. With `within`, only what falls inside that prefix, as the one space. */
-    static report(devices: readonly Device[], within?: string): AddressReport;
-    /** Free prefixes of one length inside the free space, up to `limit`, and how many there are in all. */
-    static freeOfLength(free: readonly string[], length: number, limit: number): {
-        prefixes: string[];
-        total: bigint;
-    };
-}

package/dist/types/core/address.d.ts

@@ -1,44 +0,0 @@
-import type { Family, IP, IPv4, Prefix } from "../schema/index.js";
-/** Address helpers, for checks of your own. */
-export declare class Address {
-    /** IPv4 space another network cannot reach: this host, private, shared, loopback, link-local and documentation, after RFC 6890. */
-    private static readonly NOT_GLOBAL_V4;
-    static family(address: string): Family;
-    /** How many bits an address of the family has: 32 or 128. */
-    static bits(family: Family): number;
-    /** An address as a number, or null when it is not one. */
-    static toNumber(address: string): bigint | null;
-    /** `10.0.0.1/24` to its parts. Throws when it is not an address with a length. */
-    static split(cidr: string): {
-        addr: string;
-        len: number;
-        family: Family;
-    };
-    static isValid(text: string): boolean;
-    static isCidr(text: string): boolean;
-    private static mask;
-    /** A number back to the address it stands for. */
-    static fromNumber(value: bigint, family: Family): IP;
-    /** An address, with or without its length, in one spelling: IPv6 as RFC 5952 writes it, so `2001:DB8:0:0::1` and `2001:db8::1` compare equal. Text that is not an address comes back as it is. */
-    static canonical(text: string): string;
-    /** `10.0.0.1/24` to `10.0.0.0/24`. */
-    static prefixOf(cidr: string): Prefix;
-    /** Is the address or prefix `inner` inside `outer`? */
-    static contains(outer: string, inner: string): boolean;
-    /** The first and last address of a prefix, as numbers. */
-    static range(cidr: string): {
-        first: bigint;
-        last: bigint;
-        family: Family;
-    };
-    /** The fewest prefixes that cover every address from `first` to `last` and nothing else. */
-    static prefixesBetween(first: bigint, last: bigint, family: Family): Prefix[];
-    /** `/25` to `255.255.255.128`. */
-    static netmask(length: number): IPv4;
-    /** `/24` to `0.0.0.255`, the inverted mask some ACLs take. */
-    static wildcard(length: number): IPv4;
-    /** The address with its length dropped. */
-    static host(cidr: string): IP;
-    /** Whether another network can reach the address. IPv6 is global only inside 2000::/3, less documentation space. */
-    static isGlobal(address: string): boolean;
-}

package/dist/types/core/cabling.d.ts

@@ -1,41 +0,0 @@
-import type { Device } from "../schema/index.js";
-import type { Finding } from "./define.js";
-/** A device one of our ports sees at the far end of its cable, over LLDP. */
-export type Neighbor = {
-    /** Our port, by Circuit's name, such as `10g-1`. */
-    port: string;
-    /** The system name the far device sends, its hostname. */
-    system: string;
-    /** The far device's port, as that device spells it, such as `XGigabitEthernet0/0/1`. */
-    remote_port: string;
-};
-export declare class Cabling {
-    /** The end of a state file that holds a device's LLDP neighbors, beside its config. */
-    static readonly SUFFIX = ".lldp.json";
-    /** The file a device's neighbors are saved in. */
-    static path(stateDirectory: string, device: string): string;
-    /** Save what a device sees, sorted, so a file changes only when a neighbor does. */
-    static save(stateDirectory: string, device: string, neighbors: readonly Neighbor[]): void;
-    /** Forget what a device saw, when its neighbors could not be read this time. */
-    static forget(stateDirectory: string, device: string): void;
-    /** What a device saw at its last snapshot, or undefined when its neighbors were never read. */
-    static load(stateDirectory: string, device: string): Neighbor[] | undefined;
-    private static order;
-    /** The device runs LLDP somewhere: on every port, on the interfaces it lists, or on a port that turns it on. */
-    static runsAnywhere(device: Device): boolean;
-    /** The port runs LLDP, by the port's own `lldp`, or else the device's. */
-    static runsOn(device: Device, port: string): boolean;
-    /**
-     * Warnings where LLDP and `link` disagree, from each device's own view: a cable in another port than `link` names, a cable `link` names that LLDP does not see, and another of our devices on a port without `link`.
-     *
-     * Only ports where both ends run LLDP, by the config, are compared, and only on devices whose neighbors were read. A link `through` a carrier is not compared. LLDP can be off at the far end, so each is a warning.
-     */
-    static compare(devices: readonly Device[], neighbors: ReadonlyMap<string, readonly Neighbor[]>): Finding[];
-    /** A system name is the device's name, alone or with a domain after it. */
-    private static isDevice;
-    private static deviceOf;
-    /** A port LLDP reports, as the far device spells it, is that device's port by Circuit's name. */
-    private static isPort;
-    /** Circuit's name for a port LLDP reports, or the report itself when no port of the device is spelled that way. */
-    private static portOf;
-}

package/dist/types/core/cross-checks.d.ts

@@ -1,28 +0,0 @@
-import type { Device } from "../schema/index.js";
-import type { Finding } from "./define.js";
-export declare class CrossChecks {
-    /** Every rule across devices. */
-    static run(devices: readonly Device[]): Finding[];
-    /** The VLAN ids a port or LAG carries, by how it carries them, so two ends can be compared across devices. */
-    private static carried;
-    /** How a port carries its VLANs, in words: "VLANs 10, 20 tagged and VLAN 30 untagged as native". */
-    private static describeCarried;
-    /** VLAN names by id, for the VLANs a port or LAG carries. */
-    private static vlanNames;
-    /** What a port's settings are kept on: the LAG when the port is a member of one, otherwise the port. */
-    private static carrierOf;
-    /** The plain addresses of one family on an interface, leaving out point-to-point ones. */
-    private static plainAddresses;
-    /** Why the two ends of a cable cannot reach each other by address, or undefined when they can. */
-    private static addressDisagreement;
-    /** A link names a device and port that exist, the far end links back through the same carrier, and both ends carry the same VLANs the same way, with the same MTU, speed and addresses. */
-    private static checkLinks;
-    /** No address is held by two devices in one VRF. Two loopbacks may hold one on purpose, for anycast, so that is a warning. */
-    private static checkAddresses;
-    /** A BGP session to an address another of our devices holds needs that device's session back, in the AS it expects, from the address it names. */
-    private static checkSessions;
-    /** On one segment, a VRRP id has one address and an address has one id, on every device. */
-    private static checkVrrp;
-    /** A GRE or VXLAN tunnel to another of our devices has a tunnel back there, with the endpoints mirrored and, for VXLAN, the same VNI and port. */
-    private static checkTunnels;
-}

package/dist/types/core/define.d.ts

@@ -1,79 +0,0 @@
-import type { ModelName, PlatformName, PortName } from "../platforms/catalog.js";
-import type { Device, Secret } from "../schema/index.js";
-/** A value resolved by name when a device is applied, from the environment or `.env` beside the config, and through 1Password when that value is an `op://` reference. Never the value itself. */
-export declare const secret: (name: string) => Secret;
-/** A value read from a file when a device is applied, such as a private key in PEM. The path is relative to the config file; keep the file out of git. */
-export declare const secretFile: (path: string) => Secret;
-/**
- * Declare one device.
- *
- * The names it declares (VLANs, interfaces, policies and the rest) are the only names its other fields accept, and the editor suggests them. The port names come from the model.
- */
-export declare function defineDevice<const Platform extends PlatformName, const Model extends ModelName<Platform>, const Vlans extends string = never, const Interfaces extends string = never, const Policies extends string = never, const PrefixSets extends string = never, const BgpGroups extends string = never, const Acls extends string = never, const AddressSets extends string = never, const Users extends string = never, const Vrfs extends string = never, const Certificates extends string = never, const Tables extends string = never>(device: Device<Platform, Model, PortName<Platform, Model>, Vlans, Interfaces, Policies, PrefixSets, BgpGroups, Acls, AddressSets, Users, Vrfs, Certificates, Tables>): Device;
-/** Something a check found. */
-export type Finding = {
-    /** An error stops `diff` and `apply`; a warning is reported only. */
-    level: "error" | "warning";
-    /** The device it is about, when it is about one. */
-    device?: string;
-    /** What is wrong, in a sentence. */
-    message: string;
-};
-/** A rule of your own design, run by `validate` beside the framework's. */
-export type Check = (devices: readonly Device[]) => readonly Finding[];
-/**
- * One BGP community the network defines, in the community description format of the NLNOG Ring looking glass, which bgp.tools also reads.
- *
- * `community` takes `nnn` for any number, `x` for one digit and `a-b` for a range, such as `65535:0:nnn`. `description` refers to what each wildcard matched as `$0`, `$1` and so on, such as `do not announce to AS$0`.
- */
-export type Community = {
-    community: string;
-    description: string;
-};
-/** The whole network. */
-export type Network = {
-    /** Every device the framework manages. */
-    devices: readonly Device[];
-    /** Rules of your own design. */
-    checks?: readonly Check[];
-    /** The AS the network operates, for what is published about it. */
-    asn?: number;
-    /** The BGP communities the network defines, printed by `circuit communities` for a looking glass or bgp.tools. */
-    communities?: readonly Community[];
-    /**
-     * The site each device is at, such as a data centre or an office, by name. Devices ignore it.
-     *
-     * `circuit netbox` puts the device on the NetBox site of that name, and `circuit librenms` puts it in a LibreNMS device group of that name.
-     */
-    site?: (device: Device) => string;
-    /** Keeps the network's PeeringDB record in step with the config: `circuit peeringdb`. Needs `asn`. */
-    peeringdb?: {
-        /** An API key with write access to the network's record. */
-        api_key: Secret;
-    };
-    /** Keeps LibreNMS monitoring every device, under its name, with its SNMP credentials and location, and in a group for its `site`: `circuit librenms`. */
-    librenms?: {
-        /** Where LibreNMS is, such as `https://librenms.example.com`. */
-        url: string;
-        /** An API token that can add and change devices and device groups. */
-        api_token: Secret;
-    };
-    /** Keeps NetBox in step with the config: `circuit netbox`. Needs `site`. */
-    netbox?: {
-        /** Where NetBox is, such as `https://netbox.example.com`. */
-        url: string;
-        /** An API token that can write. */
-        api_token: Secret;
-        /** What NetBox needs to know about a device that its config does not say. */
-        device: (device: Device) => NetBoxDevice;
-    };
-};
-/** What NetBox needs to know about a device that its config does not say. */
-export type NetBoxDevice = {
-    /** The device role's name in NetBox, such as `Core switch`. Circuit makes the role when NetBox has none of that name. */
-    role: string;
-    /** The device type's model name in NetBox, made by the platform's vendor. The device's `model` when absent. */
-    device_type?: string;
-};
-/** Declare the network, in `circuit.config.ts`. */
-export declare const defineNetwork: (network: Network) => Network;

package/dist/types/core/project-files.d.ts

@@ -1,12 +0,0 @@
-export declare class ProjectFiles {
-    /** Directories that hold no config of the project's own. */
-    private static readonly SKIPPED;
-    /** The first name written out after a call to defineDevice: the device's own, not that of another device a link, a peer or a tunnel names further on. */
-    private static readonly FIRST_NAME;
-    /** Every TypeScript file of the project, relative to its root, in name order. */
-    static sources(root: string, directory?: string): string[];
-    /** Whether a file's text declares the device: it calls defineDevice and gives it the name, written out whole. */
-    static declaresDevice(text: string, name: string): boolean;
-    /** The project files that declare the device, relative to the root. */
-    static deviceFiles(root: string, name: string, sources?: string[]): string[];
-}

package/dist/types/core/schema-docs.d.ts

@@ -1,25 +0,0 @@
-export type Field = {
-    path: string;
-    type: string;
-    description: string;
-};
-export type TypeDoc = {
-    name: string;
-    description: string;
-    definition?: string;
-    includes?: string[];
-    fields: Field[];
-};
-export declare class SchemaDocs {
-    /** The schema files in reading order, with the title each gets. */
-    static readonly FILES: readonly [readonly ["device.ts", "Device"], readonly ["interfaces.ts", "Ports and interfaces"], readonly ["routing.ts", "Routing"], readonly ["policy.ts", "Route policies"], readonly ["firewall.ts", "Firewall and ACLs"], readonly ["system.ts", "System and management"], readonly ["common.ts", "Common values"]];
-    /** The text of a JSDoc comment, without its markers, as one paragraph. */
-    private static commentText;
-    /** What a type parameter stands for, where it is not one of the device's names. */
-    private static readonly PARAMETER_MEANING;
-    /** A type as a reader needs it: "name" for each of the device's names, and no parameter list on the schema's own types. */
-    private static withoutGenerics;
-    private static parse;
-    /** Every type in each schema file, in the order given. Every file is read first, so a type is known to take parameters wherever it is used. */
-    static read(sources: readonly string[]): TypeDoc[][];
-}

package/dist/types/core/secrets.d.ts

@@ -1,62 +0,0 @@
-import type { Network } from "./define.js";
-import type { Console, Device, IP, Secret } from "../schema/index.js";
-/** How a device is logged in to: its management address and SSH port, its connection user and that user's password, and its console. */
-export type DeviceLogin = {
-    /** Absent for a device reached only through its console. */
-    host?: IP;
-    port: number;
-    user: string;
-    /** The value, not a reference. Never print it. */
-    password: string;
-    console?: Console;
-};
-export declare class Secrets {
-    /** The directory of the config file. `.env` and secret files are found from here. */
-    private static root;
-    private static envFile;
-    private static readonly fromOnePassword;
-    /** Every value read in this run, so `scrub` can hide it. */
-    private static readonly revealed;
-    /** What `scrub` puts where a secret was. */
-    static readonly REDACTED = "<redacted>";
-    /** A value in `.env` shorter than this is not hidden: `.env` can hold settings that are not secrets, and hiding a short one would garble the text. */
-    private static readonly SHORTEST_DOTENV_VALUE;
-    /** A marker anywhere in a command. Its group is the reference. */
-    static readonly MARKER: RegExp;
-    /** Find `.env` and secret files from this directory, the config file's, instead of the working directory. */
-    static useRoot(directory: string): void;
-    /** `.env` beside the config, read once. Node and Bun read it the same way they load `.env` themselves: a `#` starts a comment unless the value is quoted. */
-    private static dotenv;
-    /** An unquoted value is cut at a `#`. A `#` after a space is a comment, but one inside the value, as in `abc#def`, would cut a password short and send that to a device, so it stops the run and asks for quotes. */
-    private static refuseCutValues;
-    /** Read a 1Password reference with the 1Password CLI, `op`, once per run. */
-    private static readOnePassword;
-    static isSecret(value: unknown): value is Secret;
-    /** How a reference is written inside a marker: a variable's name, or `file:` and a path. */
-    static referenceOf(secret: Secret): string;
-    /** Where a reference's value comes from, such as `.env` or `1Password, through .env`, without reading it. Undefined when it is set nowhere. */
-    static sourceOf(reference: string): string | undefined;
-    /** The value behind a reference, as `referenceOf` writes it: one marker's reference, for a platform that takes a secret interactively. */
-    static valueOf(reference: string): string;
-    /** The value of a secret, or of a variable named directly: from the environment, `.env`, 1Password or a file. */
-    static reveal(secret: Secret | string): string;
-    /** Every secret reference in a value, however deep, such as a network or one device, as `referenceOf` writes it. */
-    static referencesIn(value: unknown, found?: Set<string>): Set<string>;
-    /**
-     * Text with every secret value Circuit knows replaced by `<redacted>`, before it is printed. Devices echo what they are sent, passwords too.
-     *
-     * Hidden are: each value in `.env` of at least six characters, each value read in this run (1Password reads and secret files among them), each secret of `network` that the environment, `.env` or a file holds, and `extra`. A 1Password reference not read in this run is not read for this.
-     */
-    static scrub(text: string, options?: {
-        network?: Network;
-        extra?: readonly string[];
-    }): string;
-    /** The value behind a reference when it can be had without asking anyone: a 1Password reference only once read in this run. Undefined otherwise. */
-    private static storedValueOf;
-    /** How Circuit logs in to a device: its address, port, connection user, that user's password revealed, and its console. */
-    static loginOf(device: Device): DeviceLogin;
-    /** How a secret appears in rendered config. Replaced with its value only when sent to a device. */
-    static marker(secret: Secret): string;
-    /** Replace every marker in a command with its value. */
-    static substitute(text: string): string;
-}

package/dist/types/core/topology.d.ts

@@ -1,96 +0,0 @@
-import type { Device, Routed } from "../schema/index.js";
-import type { Finding } from "./define.js";
-/** One view of the network. Every edge belongs to one. */
-export type Layer = "l1" | "l2" | "l3" | "bgp" | "ospf" | "tunnels";
-/** One of our devices, a segment several of them share, or something outside the network. */
-export type GraphNode = {
-    /** Unique among the nodes, such as `device:edge-01` or `as:64501`. */
-    id: string;
-    kind: "device" | "segment" | "outside";
-    /** A word or two, drawn on the node. */
-    label: string;
-    /** One fact per line, for a closer look. */
-    detail: string[];
-};
-/** A VLAN a cable carries. */
-export type CarriedVlan = {
-    name: string;
-    id: number;
-    /** Carried without a tag: the access VLAN, or a trunk's native VLAN. */
-    untagged: boolean;
-};
-export type GraphEdge = {
-    layer: Layer;
-    /** Node ids. */
-    from: string;
-    to: string;
-    /** A few words, drawn on the edge. */
-    label: string;
-    /** One fact per line, for a closer look. */
-    detail: string[];
-    /** Only one end declares it: the far device does not declare the cable, session or tunnel back. */
-    oneSided?: true;
-    /** On `l2`, the VLANs the cable carries. */
-    vlans?: CarriedVlan[];
-};
-export type Graph = {
-    nodes: GraphNode[];
-    edges: GraphEdge[];
-};
-/** How a device compares with its last snapshot, found offline as `diff` finds it. */
-export type Drift = {
-    status: "matches" | "differs" | "no snapshot" | "cannot plan";
-    /** The plan `diff` would show, when it differs. */
-    lines: string[];
-};
-/** The graph with what `validate` found and how each device drawn compares with its snapshot. */
-export type Annotated = Graph & {
-    findings: Finding[];
-    /** By device name. */
-    drift: Record<string, Drift>;
-};
-/** An address one of the devices holds on a port or interface. */
-export type Holder = {
-    device: Device;
-    /** The port or interface. */
-    name: string;
-    /** With its length. */
-    address: string;
-    /** The far end of a point-to-point address. */
-    peer?: string;
-    vrrp: NonNullable<Routed<string>["vrrp"]>;
-    /** The VRF the address is in. The default table when absent. */
-    vrf?: string;
-};
-export declare class Topology {
-    static readonly LAYERS: readonly Layer[];
-    static deviceId(name: string): string;
-    /** An address as a key, so two spellings of one address compare equal. Undefined when it is not an address. */
-    static keyOf(address: string | undefined): string | undefined;
-    private static isHostRoute;
-    /** Ports, then interfaces, that can hold an address. */
-    static routedOf(device: Device): [string, Routed<string>][];
-    /** Every valid address the devices hold. An invalid one is left for `validate` to report. */
-    static holders(devices: readonly Device[]): Holder[];
-    private static describeDevice;
-    /** The VLANs a port or LAG carries, by id. */
-    private static carriedBy;
-    private static vlanLabel;
-    /** `l1`, every cable, with a LAG's member cables as one edge; and `l2`, the VLANs each one carries. */
-    private static cables;
-    /** `l3`: prefixes several devices hold an address in, and point-to-point addresses whose far end is another device. */
-    private static segments;
-    /** `bgp`: sessions between our devices, matched by the address each names, and to every AS outside. */
-    private static sessions;
-    /** `ospf`: two devices with OSPF on interfaces in one area and one prefix, neither passive. */
-    private static adjacencies;
-    /** `host:port` or `[host]:port` to the host. */
-    private static endpointHost;
-    /** `tunnels`: GRE and VXLAN tunnels matched by their endpoints, and WireGuard peers matched to the device at the far end. */
-    private static tunnels;
-    private static wireguard;
-    /** The network as a graph. It reads the config only, never a device, and works on a config that does not validate. */
-    static of(devices: readonly Device[]): Graph;
-    /** Only the edges on these layers, and among those only the ones that touch these devices when any are named. Every device named stays. */
-    static only(graph: Graph, layers: readonly Layer[], deviceNames?: readonly string[]): Graph;
-}

package/dist/types/core/utils.d.ts

@@ -1,10 +0,0 @@
-type Merged<T extends readonly object[]> = T extends readonly [infer Head, ...infer Tail extends readonly object[]] ? Head & Merged<Tail> : unknown;
-export declare class Utils {
-    /** Combine records into one, such as a device's own interfaces and those a module derives for it. Unlike spreading them, a name two of them hold is an error rather than one silently replacing the other. */
-    static merge<const T extends readonly Record<string, unknown>[]>(...records: T): Merged<T>;
-    /** The table a route or a BGP session is in, beside the main one: `undefined` for the main table, written `main` or left out. */
-    static otherTable(table: string | undefined): string | undefined;
-    /** Minutes east of UTC an IANA zone is at now, for platforms that take an offset rather than a zone. */
-    static timeZoneOffset(zone: string): number;
-}
-export {};

package/dist/types/core/validator.d.ts

@@ -1,23 +0,0 @@
-import type { Finding, Network } from "./define.js";
-export declare class Validator {
-    static run(network: Network): Finding[];
-    private static checkDevice;
-    /** A management VDOM: FortiOS only, not `root`, with declared interfaces, and routes that leave through its own. */
-    private static checkVdoms;
-    /** What the model's hardware holds, from the catalog. A LAG with too many members is an error; too many switch rules is a warning, since the limit is only roughly known. */
-    private static checkLimits;
-    private static checkVlans;
-    /** Every address is valid, and no address sits on two interfaces of one routing table. Two VRFs may hold the same address. */
-    private static checkAddresses;
-    private static checkPorts;
-    /** A MAC limit is a whole number above 0, and an ethertype filter lets at least one kind in, each once. */
-    private static checkFrames;
-    private static checkInterfaces;
-    private static checkRouting;
-    /** Routing tables have names of their own and something installing routes in them, and rules name a table and can each be reached. */
-    private static checkTables;
-    private static checkPolicies;
-    private static checkFirewall;
-    private static checkServices;
-    private static checkCertificates;
-}