@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/dist/types/helpers/bgp.d.ts

@@ -1,195 +0,0 @@
-import type { Community } from "../core/define.js";
-import type { Device, IP, LargeCommunity, PolicyRule, Prefix, StandardCommunity } from "../schema/index.js";
-/** The prefix lengths a BGP import accepts. */
-export type SanityLengths = {
-    /** Shortest and longest IPv4 prefix accepted. /8 to /24 when absent. */
-    ipv4?: {
-        min: number;
-        max: number;
-    };
-    /** Shortest and longest IPv6 prefix accepted. /16 to /48 when absent. */
-    ipv6?: {
-        min: number;
-        max: number;
-    };
-};
-/** A prefix we announce, and what it is. */
-export type Announced = {
-    prefix: Prefix;
-    description?: string;
-};
-/** What `Bgp.learn` builds an import from. */
-export type LearnOptions<P extends string> = {
-    /** Rules of your own, first. */
-    before?: readonly PolicyRule<P, never>[];
-    /** A policy holding `Bgp.sanity()` to call. The sanity rules are written in the import itself when absent. */
-    sanity?: P;
-    /** The source address for routes of its family, one per family. */
-    sources?: readonly IP[];
-    /** Preference for the routes learned. Higher wins. */
-    local_pref?: number;
-    /** Where the route came from: `{ standard: "64500:100" }` or `{ large: "64500:1:1" }` adds that community, and a rule, such as `communityScheme(...).tag(...)`, is used as it is. */
-    tag?: {
-        standard: StandardCommunity;
-    } | {
-        large: LargeCommunity;
-    } | PolicyRule<never, never>;
-};
-/** What `Bgp.defaultOnly` sets on the default routes it takes. */
-export type DefaultOnlyOptions = {
-    /** Preference for the default route. Higher wins. */
-    local_pref?: number;
-    /** Shown beside each rule. `Default route, ipv4` and `Default route, ipv6` when absent. */
-    description?: string;
-    /** The source address for the default of its family, one per family. */
-    sources?: readonly IP[];
-    /** End with `{ description: "Nothing else", action: "reject" }`, so the policy takes the default route only. Off by default: any other route goes on to the rules after these. */
-    reject?: boolean;
-};
-/** What `Bgp.announce` writes after the accepts. */
-export type AnnounceOptions = {
-    /** End with `{ description: "Nothing else", action: "reject" }`, so nothing else leaves. On by default: it stops a route leak when the reject is forgotten. Turn it off for an export that adds rules after these. */
-    reject?: boolean;
-};
-/** Kinds of neighbor and the number each is tagged with, such as `{ transit: 1, customer: 3 }`. */
-export type CommunityClasses = Readonly<Record<string, number>>;
-/**
- * A BGP community scheme of large communities, `asn:function:parameter`, in the style of RFC 8195. Each field names the function number your network uses for it; leave out what your network does not offer.
- *
- * The type parameters keep the exact numbers you write, so the communities `Bgp.communityScheme` gives back show them in the editor: Asn your AS, LearnedFrom the function of `learned_from`, Classes its classes.
- */
-export type CommunityScheme<Asn extends number = number, LearnedFrom extends number = number, Classes extends CommunityClasses = CommunityClasses> = {
-    /** Your AS. It is the first part of every community. */
-    asn: Asn;
-    /** Set on import: the kind of neighbor a route came from, `asn:function:class`. */
-    learned_from?: {
-        function: LearnedFrom;
-        classes: Classes;
-    };
-    /** Set on import: the site a route was learned at, `asn:function:site`. `sites` names the sites, for the catalogue. */
-    learned_at?: {
-        function: number;
-        sites?: Readonly<Record<number, string>>;
-    };
-    /** Set on import: the AS a route was learned from, `asn:function:asn`. */
-    learned_from_as?: number;
-    /** A neighbor asks: do not announce the route to an AS, `asn:function:asn`, or to anyone, `asn:function:0`. */
-    do_not_announce?: number;
-    /** A neighbor asks: prepend toward an AS once, twice or three times, `asn:function:asn`. */
-    prepend?: {
-        once?: number;
-        twice?: number;
-        three_times?: number;
-    };
-    /**
-     * A neighbor asks: drop all traffic to this route, `asn:function:0`, usually one address under attack. Your router drops it. An upstream whose own blackhole community you know (`communities.blackhole` on the neighbor you pass to `actions`) receives the route with it and drops the traffic too; any other never receives the route.
-     */
-    blackhole?: {
-        function: number;
-    };
-};
-/** The communities another network offers us, as its NOC gives them: what it does with a route we send it. */
-export type NeighborCommunities = {
-    /** It drops traffic to a route we send it with this community. */
-    blackhole?: StandardCommunity | LargeCommunity;
-    /** It does not pass a route we send it with this community to the AS given, such as an exchange's route servers' `rs-asn:0:peer-asn`. */
-    do_not_announce_to?: (asn: number) => StandardCommunity | LargeCommunity;
-};
-/** A neighbor an export goes to: its AS, or its AS and the communities it offers. */
-export type ExportNeighbor = number | {
-    asn: number;
-    communities?: NeighborCommunities;
-};
-/** The class names a scheme declares, or any name when it declares none. */
-type ClassName<Classes extends CommunityClasses> = {} extends Classes ? string : Extract<keyof Classes, string>;
-/** BGP policy: an import sanity policy, the shapes most imports and exports take, a community scheme, and helpers that read a device's BGP neighbors. */
-export declare class Bgp {
-    private static readonly PREPENDS;
-    /** The default route of each family. */
-    private static readonly DEFAULTS;
-    /** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
-    static sanity(lengths?: SanityLengths): PolicyRule<never, never>[];
-    /**
-     * An export that announces each prefix, at exactly its length. It returns, in order:
-     *
-     * 1. `{ description, match: { prefix }, action: "accept" }` for each prefix;
-     * 2. `{ description: "Nothing else", action: "reject" }`, the unconditional reject `Checks.exportsEndInReject` looks for.
-     *
-     * The reject is there by default, so a forgotten one can't leak routes. `{ reject: false }` leaves it out, for an export that adds rules after these and ends in a reject of its own.
-     */
-    static announce(prefixes: readonly Announced[], options?: AnnounceOptions): PolicyRule<never, never>[];
-    /** The reject that ends a policy: nothing else gets through. */
-    private static readonly NOTHING_ELSE;
-    /**
-     * An import policy that takes a neighbor's routes. It returns these rules, in order, each only when its option is given:
-     *
-     * 1. the `before` rules, as written;
-     * 2. `{ call: sanity }`, or the rules of `Bgp.sanity()` written in when `sanity` is left out;
-     * 3. `{ set: { preferred_source: source } }` for each of `sources`, one per family;
-     * 4. `{ set: { local_pref } }`;
-     * 5. the tag: `{ description: "Tag 64500:1:1", set: { add_large_communities: ["64500:1:1"] } }` for `{ large: "64500:1:1" }`, `add_communities` for `{ standard }`, or the rule given;
-     * 6. `{ action: "accept" }`.
-     *
-     * So `Bgp.learn({ sanity: "SANITY", local_pref: 200, tag: { large: "64500:1:1" } })` is
-     * `[{ call: "SANITY" }, { set: { local_pref: 200 } }, { description: "Tag 64500:1:1", set: { add_large_communities: ["64500:1:1"] } }, { action: "accept" }]`.
-     *
-     * FortiOS refuses it: a route map stops at the first rule that matches, so it can't hold rules 3 to 5, which change a route and go on; and its sanity rules match RPKI, which FortiOS doesn't have. `validate` names each such rule. On FortiOS, write the import by hand with what rules 3 to 5 set in the rule that accepts.
-     */
-    static learn<const P extends string = never>(options?: LearnOptions<P>): PolicyRule<P, never>[];
-    /**
-     * Import rules that take the default route from a transit. They are, in order:
-     *
-     * 1. `{ description, match: { prefix: "0.0.0.0/0" }, set: { local_pref, preferred_source }, action: "accept" }`;
-     * 2. the same for `::/0`;
-     * 3. with `{ reject: true }` only, `{ description: "Nothing else", action: "reject" }`.
-     *
-     * Without `reject`, any other route goes on to the rules after these, so `[...Bgp.defaultOnly(), ...Bgp.learn()]` takes both. Each of `sources` is the source address for the default of its own family; `set` holds only what is given.
-     */
-    static defaultOnly(options?: DefaultOnlyOptions): PolicyRule<never, never>[];
-    /** A rule adding one community, standard or large. */
-    private static adding;
-    /** Each BGP neighbor's own policies and role, or its group's. */
-    static neighborPolicies(device: Device): {
-        name: string;
-        address: IP;
-        role: import("../index.js").BgpRole | undefined;
-        import: string | undefined;
-        export: string | undefined;
-    }[];
-    /** The prefixes an export policy accepts by name. */
-    static offered(device: Device, policy: string | undefined): Prefix[];
-    /**
-     * Policy rules and a catalogue from one community scheme, so the communities your routers set, the ones they act on, and the ones you publish never disagree.
-     *
-     * - `tag(neighborClass, neighborAs, { site, trusted })`: one rule for an import policy, `{ description: "Learned from AS<n>", set }`. Its `set` removes your standard communities and your large ones (a `trusted` neighbor loses only the "where it came from" functions, so it keeps its requests: do not announce, prepend, blackhole), then adds `learned_from`, `learned_at` and `learned_from_as` where the scheme has them. `site` is needed when the scheme has `learned_at`.
-     * Each export helper takes the neighbor: its AS, or `{ asn, communities }` with the communities it offers, such as an `Upstreams.catalog` entry.
-     *
-     * - `actions(neighbor)`: the rules for an export policy toward one neighbor, before the rules that accept. They are `[...blackholeExport(n), ...rejectDoNotAnnounce(n), ...prepends(n), stripOurs()]`; toward a neighbor that takes blackholes (`communities.blackhole`), `rejectDoNotAnnounce(n)` comes first, so a route asked not to go there is never passed on as a blackhole.
-     * - `blackholeExport(neighbor)`: a blackholed route goes no further, `Blackholed here, never announced`, unless the neighbor has `communities.blackhole`: then it is passed on with it, so the neighbor drops the traffic too. Nothing without `blackhole` in the scheme.
-     * - `rejectDoNotAnnounce(neighbor)`: rejects a route asked not to be announced anywhere, then one asked not to be announced to this neighbor. Nothing without `do_not_announce`.
-     * - `prepends(neighbor)`: prepends once, twice or three times toward this neighbor, where a route asks. Nothing without `prepend`.
-     * - `stripOurs()`: one rule removing every community of yours, `Our communities stay inside our network`.
-     * - `blackhole(prefixSets)`: rules for the import policy of a neighbor you trust with blackholes, before anything that rejects long prefixes. They take a route the neighbor asked to blackhole, but only inside `prefixSets`, its own space, and drop traffic to it here. One rule per set, so one call covers both families.
-     * - `catalogue`: every community, for `communities` in `defineNetwork`.
-     * - `community(fn, parameter)`: one community of yours, for a rule of your own.
-     * - `learned_from`: the community each class is tagged with, by class name, such as `learned_from.customer`.
-     */
-    static communityScheme<const Asn extends number, const LearnedFrom extends number = number, const Classes extends CommunityClasses = {}>(scheme: CommunityScheme<Asn, LearnedFrom, Classes>): {
-        community: <const Fn extends number, const Parameter extends number>(fn: Fn, parameter: Parameter) => `${Asn}:${Fn}:${Parameter}`;
-        learned_from: { readonly [Name in keyof Classes]: `${Asn}:${LearnedFrom}:${Classes[Name]}`; };
-        tag: (neighborClass: ClassName<Classes>, neighborAs: number, options?: {
-            site?: number;
-            trusted?: boolean;
-        }) => PolicyRule<never, never>;
-        actions: (neighbor: ExportNeighbor) => PolicyRule<never, never>[];
-        blackholeExport: (neighbor: ExportNeighbor) => PolicyRule<never, never>[];
-        rejectDoNotAnnounce: (neighbor: ExportNeighbor) => PolicyRule<never, never>[];
-        prepends: (neighbor: ExportNeighbor) => PolicyRule<never, never>[];
-        stripOurs: () => PolicyRule<never, never>;
-        blackhole: <S extends string>(prefixSets: readonly S[]) => PolicyRule<never, S>[];
-        catalogue: Community[];
-    };
-    /** A word with its article: "a customer", "an upstream". */
-    private static article;
-}
-export {};

package/dist/types/helpers/cables.d.ts

@@ -1,69 +0,0 @@
-/** The far end of a port, for a description of your own: the device, its port by Circuit's name, and the port as printed on the device when that end names its platform and model. */
-export type FarEnd = {
-    device: string;
-    port: string;
-    label?: string;
-};
-/** One end of a cable entry: the device, and its platform and model if a description should name its ports as printed on it. */
-type End = {
-    device: string;
-    platform?: string;
-    model?: string;
-};
-/** What every cable of one entry shares. */
-type Shared = {
-    /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
-    through?: string;
-    /** A port's description from its far end, such as `(far) => \`${far.device} ${far.label}\``. No description when absent. */
-    describe?: (far: FarEnd) => string;
-};
-/** A port a cable builds: the other end, the LAG it is in, and a description when `describe` gives one. */
-type CablePort<L extends string> = {
-    link: {
-        device: string;
-        port: string;
-        through?: string;
-    };
-    lag?: L;
-    description?: string;
-};
-/** Ports for both ends of the cables between two of our devices, each cable written once. */
-export declare class Cables {
-    /**
-     * One cable, both ends. Spread each end into its device's `ports`:
-     *
-     * ```ts
-     * const uplink = Cables.link({ a: { device: "router-1", port: "25g-1" }, b: { device: "switch-1", port: "10g-48" } });
-     * // router-1: ports: { ...uplink.a }
-     * ```
-     */
-    static link<const NA extends string, const NB extends string>(spec: Shared & {
-        a: End & {
-            port: NA;
-        };
-        b: End & {
-            port: NB;
-        };
-    }): {
-        a: Record<NA, CablePort<never>>;
-        b: Record<NB, CablePort<never>>;
-    };
-    /**
-     * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
-     */
-    static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(spec: Shared & {
-        a: End & {
-            lag: LA;
-        };
-        b: End & {
-            lag: LB;
-        };
-        cables: C;
-    }): {
-        a: Record<keyof C & string, CablePort<LA>>;
-        b: Record<C[keyof C], CablePort<LB>>;
-    };
-    /** A port facing `port` on the far end. */
-    private static end;
-}
-export {};

package/dist/types/helpers/checks.d.ts

@@ -1,36 +0,0 @@
-import type { Check } from "../core/define.js";
-/** Where traffic from outside, before anything filters it, may go. Every VLAN not listed as untrusted is trusted, so a VLAN added later is protected without being listed. */
-export type TrustBoundary = {
-    /** VLANs carrying traffic straight from outside: transits, exchanges, an ISP handoff. */
-    untrusted: readonly string[];
-    /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
-    routers: readonly string[];
-    /**
-     * Links between two switches that may carry both kinds, each named by its two devices: a site's switch extended to another building, with an exchange's VLAN and its own management on one cable. Neither end gives an untrusted VLAN an address.
-     */
-    extended?: readonly (readonly [string, string])[];
-};
-/** Checks for `checks` in `defineNetwork`, and helpers for checks of your own. */
-export declare class Checks {
-    /**
-     * Every BGP export ends in a reject that matches everything, so nothing leaves by accident. An export to a neighbor whose `role` is `customer` is left out: sending a customer everything you know is what it pays for, and cannot leak a route to the rest of the internet.
-     */
-    static readonly exportsEndInReject: Check;
-    /**
-     * Every BGP import ends in a rule that decides for every route, an accept or a reject without a match, so what the import takes is written in it and not left to the platform's default.
-     */
-    static readonly importsEndInAcceptOrReject: Check;
-    /** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
-    static readonly tunnelsOutsideOffered: Check;
-    /**
-     * A native VLAN is a dead end: native on one trunk (a port or a LAG) of a device at most, and never an access VLAN or a tagged VLAN anywhere on that device. On a switch, a native VLAN is an untagged member of every trunk it is native on, so one native VLAN shared by two trunks joins them: every untagged frame from one leaves on the other.
-     */
-    static readonly nativeVlansAreDeadEnds: Check;
-    /** The VLANs a port carries, untagged or tagged. */
-    static vlansOf(port: {
-        access_vlan?: string;
-        trunk_vlans?: readonly string[];
-    }): string[];
-    /** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
-    static trustBoundary(boundary: TrustBoundary): Check;
-}

package/dist/types/helpers/exchange.d.ts

@@ -1,55 +0,0 @@
-import type { Check } from "../core/define.js";
-import type { Ethertype, IP, Port, Prefix } from "../schema/index.js";
-import { type RouteServer } from "./route-server.js";
-/** A member of an internet exchange: a network with a port on the fabric and an address on the peering LAN. */
-export type ExchangeMember = {
-    /** Lowercase, and never reused. */
-    name: string;
-    asn: number;
-    /** The member's port on each fabric switch, by switch name. */
-    ports: Readonly<Record<string, string>>;
-    /** Its addresses on the peering LAN. The route servers peer with these. */
-    ipv4?: IP;
-    ipv6?: IP;
-};
-/** An internet exchange's peering LAN, as its fabric carries it. */
-export type InternetExchange<V extends string> = {
-    /** The peering VLAN, by the name the fabric switches give it. */
-    vlan: V;
-    /** The peering LAN's subnets. */
-    lan: {
-        ipv4?: Prefix;
-        ipv6?: Prefix;
-    };
-    /** Addresses on the peering LAN no member may take, such as the route servers'. */
-    reserved?: readonly IP[];
-    /** How much broadcast, multicast and unknown unicast a member port lets through, in percent of its speed. 1 when absent. */
-    storm_percent?: number;
-    /** The most MAC addresses a member port learns, usually 1. No limit when absent. No platform renders it yet, so `validate` refuses it. */
-    mac_limit?: number;
-    /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
-    ethertypes?: readonly Ethertype[];
-    /** LLDP on member ports. Off when absent: a member's router has no business learning the fabric. */
-    lldp?: boolean;
-    /** Spanning tree on member ports. Off when absent: a member's port faces a router, which must not join the fabric's spanning tree. */
-    stp?: boolean;
-};
-/** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
-export declare class Exchange {
-    /**
-     * Member ports and a check for an internet exchange's fabric.
-     *
-     * - `ports(device)`: every member's port on one switch, each written as
-     *   `{ description: "<name>, AS<asn>", access_vlan: vlan, stp: false, lldp: false, storm_control: { broadcast, multicast, unknown_unicast: { percent: storm_percent } } }`,
-     *   plus `mac_limit` and `ethertypes` when the exchange sets them. `stp` and `lldp` are the exchange's own when it sets them, and storm control is 1 % when `storm_percent` is absent.
-     * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
-     * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
-     * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.
-     */
-    static build<const V extends string>(exchange: InternetExchange<V>, members: readonly ExchangeMember[]): {
-        ports: (device: string) => Record<string, Port<V, string, string, string>>;
-        check: Check;
-        bird: (server: RouteServer) => string;
-        openbgpd: (server: RouteServer) => string;
-    };
-}

package/dist/types/helpers/filters.d.ts

@@ -1,51 +0,0 @@
-import type { AclRule, FilterRule, Prefix } from "../schema/index.js";
-/** What `Filters.antiAmplification` leaves alone. */
-export type AntiAmplificationOptions = {
-    /** Prefixes inside the destinations whose UDP fragments pass: for a host that receives UDP too large for one packet, such as SIP or some VPNs. Every fragment after the first is dropped when absent. */
-    keep_fragments?: readonly Prefix[];
-};
-/** Address lists and edge filters: hardware ACL rules and firewall rules for traffic from outside. */
-export declare class Filters {
-    /** IPv4 sources that never arrive from the internet: loopback, link-local and "this network", after RFC 6890. */
-    static readonly MARTIANS: readonly ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
-    /** IPv4 private space, RFC 1918. */
-    static readonly PRIVATE_RANGES: readonly ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
-    /** UDP ports of services that answer a small request with a much larger reply, which attackers use to reflect floods at a victim. A reflected flood arrives from these ports. */
-    static readonly AMPLIFIERS: {
-        readonly qotd: 17;
-        readonly chargen: 19;
-        readonly dns: 53;
-        readonly portmap: 111;
-        readonly ntp: 123;
-        readonly netbios: 137;
-        readonly snmp: 161;
-        readonly cldap: 389;
-        readonly slp: 427;
-        readonly rip: 520;
-        readonly "ms-sql": 1434;
-        readonly ssdp: 1900;
-        readonly ard: 3283;
-        readonly "ws-discovery": 3702;
-        readonly mdns: 5353;
-        readonly coap: 5683;
-        readonly ubiquiti: 10001;
-        readonly memcached: 11211;
-        readonly dvr: 37810;
-    };
-    /** Of the amplifiers, the services hosts do ask across the internet: resolvers, time servers, monitoring. A reply to a real request goes back to the asking port, 1024 or above, or to the service's own port when two servers talk. */
-    private static readonly ASKED;
-    /** TCP flag combinations no legitimate packet carries: name, flags set, flags unset. */
-    private static readonly BAD_TCP_FLAGS;
-    /** Hardware ACL rules dropping traffic arriving on a VLAN from sources that cannot be there: your own space, martians, private ranges. One rule per source. */
-    static antiSpoofing<V extends string>(vlan: V, sources: readonly Prefix[]): AclRule<V>[];
-    /**
-     * Hardware ACL rules dropping reflected UDP floods toward `destinations`, in the switch chip, without limiting anything else.
-     *
-     * - Replies from an amplifier no host asks across the internet are dropped.
-     * - Replies from DNS, NTP and SNMP are dropped only toward a port below 1024 that is not the service's own. A host that runs its own resolver, time server or monitoring keeps its answers. The service's own port passes first, so every drop takes the one range 0 to 1023: a switch chip has few port-range checkers, and on RouterOS a rule past them is invalid with every rule after it.
-     * - The fragments after the first carry no port, and a switch chip reads them as port 0. They are dropped, but toward `keep_fragments`.
-     */
-    static antiAmplification(destinations: readonly Prefix[], options?: AntiAmplificationOptions): AclRule<never>[];
-    /** Firewall rules dropping packets with a TCP flag combination no legitimate packet carries, for a forward chain. */
-    static badTcpFlags(): FilterRule<never, never>[];
-}

package/dist/types/helpers/index.d.ts

@@ -1,14 +0,0 @@
-export { Bgp } from "./bgp.js";
-export type { AnnounceOptions, Announced, CommunityScheme, DefaultOnlyOptions, ExportNeighbor, LearnOptions, NeighborCommunities, SanityLengths, } from "./bgp.js";
-export { Cables } from "./cables.js";
-export type { FarEnd } from "./cables.js";
-export { Checks } from "./checks.js";
-export type { TrustBoundary } from "./checks.js";
-export { Exchange } from "./exchange.js";
-export type { ExchangeMember, InternetExchange } from "./exchange.js";
-export { Filters } from "./filters.js";
-export { RouteServerConfig } from "./route-server.js";
-export { Upstreams } from "./upstreams.js";
-export type { NamedVlan, Upstream, UpstreamCatalog, UpstreamOptions, UpstreamPolicy } from "./upstreams.js";
-export type { RouteServer } from "./route-server.js";
-export type { AntiAmplificationOptions } from "./filters.js";

package/dist/types/helpers/route-server.d.ts

@@ -1,52 +0,0 @@
-import type { Family, IPv4, IPv6, Prefix } from "../schema/index.js";
-import type { ExchangeMember } from "./exchange.js";
-/** A route server on an exchange's peering LAN: a server running BIRD 2 or OpenBGPD that passes every member's routes to every other member. */
-export type RouteServer = {
-    /** Its name, such as `rs1`, written at the top of its config. */
-    name: string;
-    /** Its own AS. Members peer with it, but it never adds itself to a path, so members see each other's paths as they were sent. */
-    asn: number;
-    /** Its BGP router ID, an IPv4 address of the server. Its address on the peering LAN is the usual pick. */
-    router_id: IPv4;
-    /** Its IPv4 address on the peering LAN. Every member with an IPv4 address gets an IPv4 session from it. */
-    ipv4?: IPv4;
-    /** Its IPv6 address on the peering LAN. Every member with an IPv6 address gets an IPv6 session from it. */
-    ipv6?: IPv6;
-};
-/** A route server's config, written from an exchange's member list. Circuit writes the file; it never logs in to the server. */
-export declare class RouteServerConfig {
-    /** The shortest and longest prefix a member may send, by family. */
-    static readonly LENGTHS: Readonly<Record<Family, {
-        shortest: number;
-        longest: number;
-    }>>;
-    /** The rules a route must pass, the same in every config. */
-    private static readonly RULES;
-    /**
-     * The BIRD 2 config of one route server: one session per member and family, each passing on only the routes the member may send.
-     *
-     * Throws when the server has no address on the peering LAN, has one outside it, or two members would get sessions of one name.
-     */
-    static bird(server: RouteServer, lan: {
-        ipv4?: Prefix;
-        ipv6?: Prefix;
-    }, members: readonly ExchangeMember[]): string;
-    /**
-     * The OpenBGPD config (`bgpd.conf`) of one route server: one session per member and family, in one group per family, and filter rules that pass on only the routes each member may send.
-     *
-     * Throws when the server has no address on the peering LAN, or has one outside it.
-     */
-    static openbgpd(server: RouteServer, lan: {
-        ipv4?: Prefix;
-        ipv6?: Prefix;
-    }, members: readonly ExchangeMember[]): string;
-    /** The families the server has an address in, each checked to be inside the peering LAN. */
-    private static families;
-    /** A BIRD symbol: letters, digits and underscores, starting with a letter. */
-    private static protocolName;
-    /** A member's name and AS, safe inside double quotes. */
-    private static description;
-    private static birdSession;
-    /** One family's sessions: a group holding every member with an address in that family. */
-    private static openbgpdGroup;
-}