@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/dist/types/platforms/vrp/render.d.ts

@@ -1,96 +0,0 @@
-import type { Device } from "../../schema/index.js";
-/** Builds the configuration as blocks: a header line, its indented lines, then `#`. */
-export declare class VrpRender {
-    private readonly device;
-    /** The ACL that guards every management service. */
-    private static readonly MANAGEMENT_ACL;
-    /** The ACL that guards SNMP when it has sources of its own. */
-    private static readonly SNMP_ACL;
-    /** The channel that writes the log files on the device's own storage. */
-    private static readonly LOGFILE_CHANNEL;
-    /** How many log files the device keeps when the config sets none. It is not printed. */
-    private static readonly LOGFILES_DEFAULT;
-    /** The BFD multiplier the device uses when the config sets none. It is not printed. */
-    private static readonly BFD_MULTIPLIER;
-    /** The syslog port the device uses when the config sets none. It is not printed. */
-    private static readonly SYSLOG_PORT;
-    /** A severity as the platform spells it. `debugging` is the default for a log host and for the log files, and is not printed. */
-    private static readonly LOG_LEVEL;
-    /** The OSPF process number. One process per device. */
-    private static readonly OSPF_PROCESS;
-    /** The sFlow collectors are numbered from here, in the order the config lists them. */
-    private static readonly FIRST_COLLECTOR;
-    /** The SNMPv3 group every user joins, with read access to everything. */
-    private static readonly SNMP_GROUP;
-    /** An alarm severity as the platform prints it. */
-    private static readonly ALARM_SEVERITY;
-    private static readonly USER_LEVEL;
-    private static readonly SNMP_AUTH;
-    private static readonly SNMP_PRIVACY;
-    /** Layer 2 ACLs, one for each set of ethertypes a port takes, are numbered from here. */
-    private static readonly FIRST_L2_ACL;
-    /** An ethertype as the platform prints it in a layer 2 ACL rule: `0x0800` prints as `type ip`. */
-    private static readonly ETHERTYPE;
-    private readonly lines;
-    private readonly vlans;
-    private readonly interfaces;
-    private readonly lagNumbers;
-    /** The layer 2 ACL of each set of ethertypes the ports take, by the set written as `ipv4 ipv6 arp`. */
-    private readonly ethertypeAcls;
-    private constructor();
-    /** The whole configuration the device should run. Secrets appear as markers, never values. */
-    static of(device: Device): string;
-    /** `99 999 to 1000 2000`, the platform's compression of a VLAN list. */
-    static vlanBatch(ids: number[]): string;
-    private build;
-    private line;
-    /** A header and its lines. A block with nothing in it is still written, so that its header exists. */
-    private block;
-    private separator;
-    private text;
-    private vlanId;
-    /** What the platform calls a port, a LAG or a VLAN interface. */
-    private nameOf;
-    private system;
-    private vlanBlocks;
-    /** One ACL guards every management service: a permit per source, then an explicit deny. */
-    private managementAcl;
-    /** SNMP with sources of its own gets an ACL of its own, built the same way. */
-    private ethertypeAclBlocks;
-    private snmpAcl;
-    /** A permit per source, then an explicit deny. The platform prints the wildcard of a single address as `0`. */
-    private static aclRules;
-    private users;
-    private vrfs;
-    private static lagMode;
-    /** Layer 2 membership of a port or LAG. */
-    private switching;
-    private static vrrpLines;
-    private vlanInterface;
-    /** A port the config does not declare is shut down. A LAG member holds only its membership. */
-    private physicalPort;
-    /**
-     * Static routes. A route watched by BFD needs a BFD template for its next hop first, from the device's own address on that network, with the device's timers.
-     */
-    private staticRoutes;
-    /** The device's own IPv4 address on the network that holds `nextHop`. `unsupported()` refuses a watched route without one. */
-    static localAddressTo(device: Device, nextHop: string): string | undefined;
-    /** The BFD timers of `routing.bfd`, after `prefix`, or nothing for the platform's own. The platform does not print its default multiplier, 3. */
-    private bfdTimers;
-    /**
-     * OSPF for IPv4. An area announces the networks of its interfaces; a passive interface is silent. `unsupported()` refuses IPv6.
-     */
-    private ospf;
-    private wantsBfd;
-    /** sFlow from the management address, to each collector in order. */
-    private flowExport;
-    /** The log files' level and count, then each syslog collector. A default the device does not print is not written: level `debugging`, 200 files, port 514. */
-    private logging;
-    /** Alarms raised at another severity than the platform's own, in the `alarm` view. The platform prints a severity with a capital, `Warning`. */
-    private alarms;
-    /** SNMP version 2c with one read community, version 3 with users in one read-only group, or both. */
-    private snmp;
-    private ssh;
-    /** The console logs in with the device's users unless the config gives it a password of its own. Remote logins always use the users. */
-    private userInterfaces;
-}

package/dist/types/schema/common.d.ts

@@ -1,30 +0,0 @@
-/**
- * A value kept out of the repository and resolved only when a device is applied.
- *
- * `secret("NAME")` reads a variable from the environment or `.env` beside the config; a value written as `op://vault/item/field` is read from 1Password. `secretFile("path")` reads a file, relative to the config file, for a value that spans lines such as a private key in PEM. Keep that file out of git.
- */
-export type Secret = {
-    /** Name of the value in the environment or in `.env`. */
-    readonly secret: string;
-} | {
-    /** Path of the file with the value, relative to the config file. */
-    readonly secret_file: string;
-};
-/** An IPv4 address, four numbers with dots between them, for example `10.0.0.1`. The type checks the shape; `circuit validate` checks each number is 0 to 255. */
-export type IPv4 = `${number}.${number}.${number}.${number}`;
-/** An IPv6 address, groups with colons between them, for example `2001:db8::1`. The type only checks there is a colon; `circuit validate` checks the rest. */
-export type IPv6 = `${string}:${string}`;
-/** An address without a length, IPv4 or IPv6, for example `10.0.0.1` or `2001:db8::1`. */
-export type IP = IPv4 | IPv6;
-/** A network with its length, for example `10.0.0.0/24` or `2001:db8::/32`. */
-export type Prefix = `${IP}/${number}`;
-/** An interface address with its length, for example `10.0.0.1/24` or `2001:db8::1/64`. */
-export type InterfaceAddress = `${IP}/${number}`;
-/** A MAC address, six pairs of hex digits with colons between them, for example `02:00:00:00:00:01`. */
-export type MacAddress = `${string}:${string}:${string}:${string}:${string}:${string}`;
-/** An address family. */
-export type Family = "ipv4" | "ipv6";
-/** Bits per second, for example `2G`, `500M` or `64k`. */
-export type Rate = `${number}${"k" | "M" | "G"}`;
-/** A log severity, most severe first. A threshold includes everything above it. */
-export type Severity = "emergency" | "alert" | "critical" | "error" | "warning" | "notice" | "info" | "debug";

package/dist/types/schema/device.d.ts

@@ -1,126 +0,0 @@
-import type { IP, Secret } from "./common.js";
-import type { AclRule, Firewall } from "./firewall.js";
-import type { Interface, Port, Vlan } from "./interfaces.js";
-import type { PrefixSet, RoutePolicy } from "./policy.js";
-import type { Routing, StaticRoute } from "./routing.js";
-import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system.js";
-/** How the framework reaches the device. */
-export type Connection<U extends string> = {
-    /** Management address. Absent for a device reached only through its console, `console`. */
-    host?: IP;
-    /** One of the device's `users`. Its password is the login. */
-    user: U;
-    /** SSH port. 22 when absent. */
-    port?: number;
-    /** The device's serial console, for `--console`: the way in before the device has a management address, or when its management network is down. */
-    console?: Console;
-};
-/** A computer with SSH that holds the serial consoles of devices, such as a laptop beside the rack. It runs Python 3. */
-export type Jump = {
-    /** Its address or name. */
-    host: string;
-    /** The user Circuit logs in as. It must be allowed to open the serial ports. */
-    user: string;
-    /** The user's password. */
-    password: Secret;
-    /** SSH port. 22 when absent. */
-    port?: number;
-    /** The jump host is reached through a Cloudflare Tunnel, so Circuit connects with `cloudflared access ssh`, which must be installed. */
-    cloudflared?: true;
-};
-/** A serial console, on a jump host or on the computer Circuit runs on. */
-export type Console = {
-    /** The jump host the console cable is plugged into. When absent, the cable is plugged into the computer Circuit runs on. */
-    jump?: Jump;
-    /** The serial port: on Linux or macOS a path under `/dev`, where a path under `/dev/serial/by-path/` stays the same when two adapters swap names; on Windows a COM port, such as `COM3`. */
-    port: string;
-    /** Line speed in bits per second, such as 9600 or 115200. */
-    baud: number;
-    /** The console asks only for a password, with no name first. Circuit then types no name; `connection.user` still picks the password. */
-    passwordOnly?: true;
-};
-/**
- * Virtual domains, on FortiOS: the device's own traffic kept apart from the traffic it routes. Everything is in `root` when absent.
- *
- * Multi-VDOM mode is turned on by hand, not by a plan: it moves the whole configuration into `root` and ends every session.
- */
-export type Vdoms<I extends string> = {
-    /**
-     * A VDOM for the device's own traffic: FortiGuard, NTP, DNS and logging leave from it, by its own routes, so they never follow the routed traffic's default route. Everything not listed here stays in `root`.
-     */
-    management: {
-        /** Its name, such as `mgmt`. Not `root`. */
-        name: string;
-        /** The ports and interfaces in it, by name. A LAG's member ports go with the LAG. */
-        interfaces: readonly I[];
-        /** Its static routes, such as its own default route. */
-        static?: readonly StaticRoute<I, never>[];
-    };
-};
-/** A separate routing table, with the interfaces that route in it. */
-export type Vrf = {
-    /** What the VRF is for. */
-    description?: string;
-};
-/**
- * Everything one device runs. What is not written here is removed from the device or returned to its default.
- *
- * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates, T routing tables.
- */
-export type Device<Pl extends string = string, M extends string = string, N extends string = string, V extends string = string, I extends string = string, P extends string = string, S extends string = string, G extends string = string, A extends string = string, AS extends string = string, U extends string = string, F extends string = string, C extends string = string, T extends string = string> = {
-    /** Hostname. */
-    name: string;
-    /** Operating system. It decides which adapter renders and applies the device. */
-    platform: Pl;
-    /** Hardware model. Decides which port names exist. */
-    model: M;
-    /** How the framework logs in. */
-    connection: Connection<NoInfer<U>>;
-    /** Device-wide settings. */
-    system?: System;
-    /** Logins, keyed by user name. Users not listed are removed. */
-    users?: Record<U, User>;
-    /** Ways in, and who may use them. */
-    management?: Management<NoInfer<I | N>, NoInfer<C>>;
-    /** Certificates, keyed by name. */
-    certificates?: Record<C, Certificate>;
-    /** VLANs, keyed by name. */
-    vlans?: Record<V, Vlan>;
-    /** Physical ports, keyed by `<speed>-<position>`. */
-    ports?: Partial<Record<N, Port<NoInfer<V>, NoInfer<A>, NoInfer<I>, NoInfer<F>>>>;
-    /** Interfaces that are not physical ports, keyed by name. */
-    interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
-    /** Separate routing tables, keyed by name. */
-    vrfs?: Record<F, Vrf>;
-    /** Routing tables and rules, static routes, BGP, OSPF and route validation. */
-    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>, T>;
-    /** Route policies, keyed by name. */
-    policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
-    /** Prefix sets that policies match on, keyed by name. */
-    prefix_sets?: Record<S, PrefixSet>;
-    /** Packet filtering and address translation. */
-    firewall?: Firewall<NoInfer<I | N>, AS>;
-    /** Hardware ACLs, keyed by name, applied to a port with `acl`. */
-    acls?: Record<A, readonly AclRule<NoInfer<V>>[]>;
-    /** DHCP servers, keyed by name. */
-    dhcp?: Record<string, DhcpServer<NoInfer<I | N>>>;
-    /** DHCP relays, keyed by name. */
-    dhcp_relay?: Record<string, DhcpRelay<NoInfer<I | N>>>;
-    /** Flow records or packet samples sent to collectors. */
-    flow_export?: FlowExport<NoInfer<I | N>>;
-    /** Advertise and learn neighbors with LLDP on every port, or only on the interfaces listed. A port may override it. */
-    lldp?: true | {
-        interfaces: readonly NoInfer<I | N>[];
-    };
-    /** Spanning tree on every switched port. A port may override it. */
-    stp?: {
-        /** Which variant runs. RSTP when absent. */
-        mode?: "stp" | "rstp" | "mstp";
-        /** Bridge priority, 0 to 61440 in steps of 4096. Lower wins the root election. */
-        priority?: number;
-    };
-    /** Forward in hardware where the platform can. An interface may override it. */
-    hardware_offload?: boolean;
-    /** Virtual domains, on FortiOS only: a management VDOM apart from the routed traffic. */
-    vdoms?: Vdoms<NoInfer<I | N>>;
-};

package/dist/types/schema/firewall.d.ts

@@ -1,131 +0,0 @@
-import type { Family, IP, Prefix, Rate } from "./common.js";
-/** An IP protocol. `icmp` means ICMPv6 in an IPv6 rule. */
-export type Protocol = "tcp" | "udp" | "icmp" | "gre" | "esp" | "ah" | "ospf" | "vrrp";
-/** The state connection tracking assigns a packet. */
-export type ConnectionState = "new" | "established" | "related" | "untracked" | "invalid";
-/** Ports from `min` to `max`, both included. */
-export type PortRange = {
-    min: number;
-    max: number;
-};
-/** A port, a range of ports, or any of several. */
-export type Ports = number | PortRange | readonly (number | PortRange)[];
-/** A TCP header flag. */
-export type TcpFlag = "fin" | "syn" | "rst" | "psh" | "ack" | "urg";
-/** Conditions on a packet. All must be true. A rule with addresses of one family applies to that family only. */
-export type FilterMatch<I extends string, AS extends string> = {
-    /** Only packets of this family. */
-    family?: Family;
-    /** IP protocol. */
-    protocol?: Protocol;
-    /** Source address or prefix. */
-    src?: Prefix;
-    /** Destination address or prefix. */
-    dst?: Prefix;
-    /** Source is in this address set. */
-    src_set?: AS;
-    /** Destination is in this address set. */
-    dst_set?: AS;
-    /** Source port, or any of several. TCP and UDP only. */
-    src_port?: Ports;
-    /** Destination port, or any of several. TCP and UDP only. */
-    dst_port?: Ports;
-    /** Arrived on this interface. */
-    in_interface?: I;
-    /** Leaves through this interface. */
-    out_interface?: I;
-    /** Connection tracking state, any of these. */
-    state?: readonly ConnectionState[];
-    /** TCP flags that must be set, and flags that must not be. */
-    tcp_flags?: {
-        set?: readonly TcpFlag[];
-        unset?: readonly TcpFlag[];
-    };
-};
-/** One firewall rule. */
-export type FilterRule<I extends string, AS extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets the rule applies to. Every packet when absent. */
-    match?: FilterMatch<I, AS>;
-    /** What happens to a matching packet. `reject` answers the sender, `drop` does not. */
-    action: "accept" | "drop" | "reject";
-    /** Send the rest of an accepted flow through the fast path, skipping the remaining rules. */
-    offload?: true;
-};
-/** Rules evaluated in order, first match wins, then `default`. */
-export type Chain<I extends string, AS extends string> = {
-    /** What happens to a packet no rule matched. Accept when absent. */
-    default?: "accept" | "drop";
-    /** Evaluated in order. */
-    rules?: readonly FilterRule<I, AS>[];
-};
-/** One address translation. */
-export type NatRule<I extends string, AS extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets are translated. Every packet when absent. */
-    match?: FilterMatch<I, AS>;
-} & ({
-    /** Use the address of the outgoing interface. */
-    action: "masquerade";
-} | {
-    /** `snat` rewrites the source, `dnat` the destination. */
-    action: "snat" | "dnat";
-    /** The address to rewrite to. */
-    to: IP;
-    /** The port to rewrite to. Unchanged when absent. */
-    to_port?: number;
-});
-/** Connection-tracking helpers that rewrite application payloads. None run unless listed. */
-export type Helper = "ftp" | "tftp" | "sip" | "h323" | "pptp" | "rtsp" | "irc";
-/** What the device filters and translates. */
-export type Firewall<I extends string, AS extends string> = {
-    /** Named groups of addresses and prefixes, of either family, that rules match on. */
-    address_sets?: Record<AS, readonly (IP | Prefix)[]>;
-    /** Traffic to the device, through it, and from it. */
-    filter?: {
-        input?: Chain<I, NoInfer<AS>>;
-        forward?: Chain<I, NoInfer<AS>>;
-        output?: Chain<I, NoInfer<AS>>;
-    };
-    /** Source translation on the way out, destination translation on the way in. */
-    nat?: {
-        source?: readonly NatRule<I, NoInfer<AS>>[];
-        destination?: readonly NatRule<I, NoInfer<AS>>[];
-    };
-    /** Helpers that run. None when absent. */
-    helpers?: readonly Helper[];
-    /**
-     * Traffic to and from these prefixes passes without connection tracking. A flood toward them cannot fill the connection table, and rules see its packets in the state `untracked`. Everything is tracked when absent.
-     *
-     * Each address NAT uses inside one of these prefixes (a source translation's `to`, a destination translation's `to` or matched `dst`) stays tracked: Circuit writes two accept rules for it, one for traffic to it and one for traffic from it, before the untracked rules. Without them, a reply to that address would skip tracking and never be translated back.
-     */
-    untracked?: readonly Prefix[];
-};
-/** A stateless rule evaluated in hardware where traffic arrives, before routing. */
-export type AclRule<V extends string> = {
-    /** Shown beside the rule on the device. */
-    description?: string;
-    /** Which packets the rule applies to. Every packet when absent. */
-    match?: {
-        /** Only packets of this family. */
-        family?: Family;
-        /** IP protocol. */
-        protocol?: Protocol;
-        /** Source prefix. */
-        src?: Prefix;
-        /** Destination prefix. */
-        dst?: Prefix;
-        /** Source port, or any of several. */
-        src_port?: Ports;
-        /** Destination port, or any of several. */
-        dst_port?: Ports;
-        /** In this VLAN. */
-        vlan?: V;
-    };
-    /** What happens to a matching packet. */
-    action: "accept" | "drop";
-    /** Accepted traffic above this rate is dropped. On RouterOS it did not limit traffic the CPU routes; see its TRAPS.md. */
-    rate?: Rate;
-};

package/dist/types/schema/index.d.ts

@@ -1,8 +0,0 @@
-export type * from "./common.js";
-export type * from "./device.js";
-export type * from "./firewall.js";
-export type * from "./interfaces.js";
-export type * from "./policy.js";
-export type * from "./routing.js";
-export type * from "./system.js";
-export type * from "./time-zones.js";

package/dist/types/schema/interfaces.d.ts

@@ -1,205 +0,0 @@
-import type { InterfaceAddress, IP, MacAddress, Prefix, Secret } from "./common.js";
-/** A VLAN. Its key in `vlans` is its name. */
-export type Vlan = {
-    /** The VLAN's number on the wire, 1 to 4094. */
-    id: number;
-    /** What the VLAN is for. */
-    description?: string;
-};
-/** A storm-control threshold: packets per second, or percent of the link's speed. */
-export type Threshold = {
-    pps: number;
-} | {
-    percent: number;
-};
-/** A kind of frame, by the ethertype in its header: `ipv4` is 0x0800, `ipv6` 0x86DD, `arp` 0x0806. */
-export type Ethertype = "ipv4" | "ipv6" | "arp";
-/** A virtual router address shared with other devices on the same segment, RFC 5798. */
-export type Vrrp = {
-    /** Virtual router number, 1 to 255. The same on every device sharing the address. */
-    id: number;
-    /** The shared address, without a length. */
-    address: IP;
-    /** Higher wins the master election, 1 to 254. 100 when absent. */
-    priority?: number;
-    /** Take mastership back from a lower priority device when this one returns. Off when absent. */
-    preempt?: boolean;
-    /** Seconds between advertisements. 1 when absent. */
-    interval?: number;
-};
-/** Layer 3 settings shared by every interface that can have an address. */
-export type Routed<F extends string> = {
-    /** Addresses with their length. Use `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
-    addresses?: readonly (InterfaceAddress | {
-        address: InterfaceAddress;
-        peer: IP;
-    })[];
-    /** Send IPv6 router advertisements on this interface. Off when absent. */
-    ipv6_ra?: boolean;
-    /** Overrides the device's `hardware_offload` for traffic routed through this interface. Software forwarding is what makes the firewall apply. */
-    hardware_offload?: boolean;
-    /** Virtual router addresses on this interface. */
-    vrrp?: readonly Vrrp[];
-    /** The VRF this interface routes in. The default table when absent. */
-    vrf?: F;
-    /** This interface is the network's presence at an internet exchange. Devices ignore it; `circuit peeringdb` publishes it. */
-    exchange?: Exchange;
-};
-/** Presence at an internet exchange, as a registry lists it. The addresses are the interface's own. */
-export type Exchange = {
-    /** The exchange's name, for output. */
-    name: string;
-    /** Capacity toward the exchange, in Mbit/s. */
-    speed: number;
-    /** The exchange LAN's id at PeeringDB, its `ixlan_id`. */
-    peeringdb_ixlan?: number;
-};
-/** Spanning tree settings for one port. */
-export type PortStp = {
-    /** The port faces a host, never a switch, so it forwards at once. */
-    edge?: boolean;
-    /** Path cost. Lower is preferred. Derived from speed when absent. */
-    cost?: number;
-    /** Port priority, 0 to 240 in steps of 16. Lower is preferred. */
-    priority?: number;
-};
-/** Layer 2 membership. A port or LAG with none of these is routed. */
-export type Switched<V extends string> = {
-    /** The one VLAN this port or LAG is in, untagged. */
-    access_vlan?: V;
-    /** The VLANs this port or LAG carries, tagged. */
-    trunk_vlans?: readonly V[];
-    /** Untagged frames on a trunk are in this VLAN. Only with `trunk_vlans`. */
-    native_vlan?: V;
-    /** Overrides the device's `stp` for this port. `false` stops it sending or acting on BPDUs. */
-    stp?: boolean | PortStp;
-    /** Drop flooded traffic above these thresholds. */
-    storm_control?: {
-        broadcast?: Threshold;
-        multicast?: Threshold;
-        unknown_unicast?: Threshold;
-    };
-    /** The most MAC addresses this port or LAG learns, 1 or more. Frames from any other source address are dropped. An exchange sets 1 on a member port, so each member sends from one router only. No limit when absent. */
-    mac_limit?: number;
-    /** The only kinds of frame this port or LAG takes in; any other kind is dropped. An exchange takes `ipv4`, `ipv6` and `arp` on a member port. Every kind when absent. */
-    ethertypes?: readonly Ethertype[];
-};
-/** The other end of a cable: another device and its port. Both ends must agree on how they are switched. */
-export type Link = {
-    /** Name of the device at the other end. */
-    device: string;
-    /** The port on that device. */
-    port: string;
-    /**
-     * What is between the two ends when the cable is not direct, such as a carrier's local loop or L2 transport: `"Carrier A local loop"`. LLDP then sees the carrier's switches, not the far end, so `validate` does not compare LLDP on this port. Both ends name the same carrier.
-     */
-    through?: string;
-};
-/** A physical port. Ports a device does not declare are shut down. */
-export type Port<V extends string, A extends string, L extends string, F extends string> = Routed<F> & Switched<V> & {
-    /** What is plugged in. */
-    description?: string;
-    /** Largest IP packet, in bytes. 1500 when absent. */
-    mtu?: number;
-    /** Fixed speed, for an optic slower than the cage. Negotiated when absent. */
-    speed?: "100m" | "1g" | "10g" | "25g" | "40g" | "50g" | "100g";
-    /** Overrides the device's `lldp` for this port. */
-    lldp?: boolean;
-    /** Hardware ACL applied to traffic arriving on this port. */
-    acl?: A;
-    /** The LAG this port is in. Every other setting goes on the LAG. */
-    lag?: L;
-    /** Another of our devices at the other end of the cable. */
-    link?: Link;
-};
-/** Settings every interface that is not a physical port shares. */
-type Base<F extends string> = Routed<F> & {
-    /** What the interface is for. */
-    description?: string;
-    /** Largest IP packet, in bytes. */
-    mtu?: number;
-};
-/** A layer 3 interface on a VLAN. */
-export type VlanInterface<V extends string, F extends string> = Base<F> & {
-    type: "vlan";
-    /** The VLAN it is on. */
-    vlan: V;
-    /**
-     * A MAC address of its own, instead of the one it shares with the device's other VLAN interfaces. A gateway in front of a transparent firewall needs one: frames to it come back on another VLAN, where the bridge would otherwise take a shared MAC for its own and keep them.
-     */
-    mac?: MacAddress;
-};
-/** An interface that is always up and is on no link, for addresses that must not depend on one. */
-export type Loopback<F extends string> = Base<F> & {
-    type: "loopback";
-};
-/** A link aggregation. Each member port points to it with `lag`. */
-export type Lag<V extends string, F extends string> = Base<F> & Switched<V> & {
-    type: "lag";
-    /** LACP negotiates membership with the far end; `static` joins the ports without asking. LACP when absent. */
-    mode?: "lacp" | "static";
-    /** Number, on platforms where a LAG has a number instead of a name. Its position among the device's LAGs when absent. */
-    id?: number;
-};
-/** A GRE tunnel. */
-export type Gre<F extends string> = Base<F> & {
-    type: "gre";
-    /** Our tunnel endpoint. */
-    local: IP;
-    /** The far tunnel endpoint. */
-    remote: IP;
-};
-/** A point-to-point VXLAN tunnel. */
-export type Vxlan<F extends string> = Base<F> & {
-    type: "vxlan";
-    /** Segment identifier, the same on both ends. */
-    vni: number;
-    /** Our tunnel endpoint. */
-    local: IP;
-    /** The far tunnel endpoint. */
-    remote: IP;
-    /** UDP port. 4789 when absent. */
-    port?: number;
-    /** Fixed MAC address, so a rebuild keeps the one the far side learned. */
-    mac?: MacAddress;
-};
-/** A host and a UDP port, `host:port`, for example `203.0.113.10:51820` or `vpn.example.net:51820`. */
-export type Endpoint = `${string}:${number}`;
-/** One peer of a WireGuard interface. */
-export type WireGuardPeer = {
-    /** Who or what the peer is. */
-    name: string;
-    /** The peer's public key. Public keys are not secrets. */
-    public_key: string;
-    /** Addresses the peer may send from and that are routed to it. */
-    allowed_addresses: readonly Prefix[];
-    /** `host:port`, for a peer this side dials. The peer dials in when absent. */
-    endpoint?: Endpoint;
-    /** Seconds between keepalives, for a peer behind NAT. None when absent. */
-    keepalive?: number;
-    /** What a generated client config routes into the tunnel. Affects no forwarding here. */
-    client_allowed_addresses?: readonly Prefix[];
-};
-/** A WireGuard interface. */
-export type WireGuard<F extends string> = Base<F> & {
-    type: "wireguard";
-    /** UDP port peers connect to. */
-    listen_port: number;
-    /** The address clients connect to, for generated client configs. */
-    endpoint?: IP;
-    /** This interface's private key. Its public key is derived from it. */
-    private_key: Secret;
-    /** Who may connect. */
-    peers?: readonly WireGuardPeer[];
-};
-/**
- * A layer 2 bridge between VLAN interfaces, each keeping its own VLAN: a frame that comes in on one member leaves another with that member's tag. A firewall filters what crosses it, by the rules of its forward chain between the members, without routing it.
- */
-export type Bridge<F extends string> = Base<F> & {
-    type: "bridge";
-    /** The VLAN interfaces it joins, by name. Each has no address of its own. */
-    members: readonly string[];
-};
-/** Any interface that is not a physical port. */
-export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F> | Bridge<F>;
-export {};