@takodotid/circuit 0.8.0 → 0.10.0

package/dist/types/adapters/devices/types.d.ts

@@ -0,0 +1,34 @@
+import type { Device, Family } from "../../schema";
+/** One part of a plan: what a reviewer reads, and what is sent. */
+export type Step = {
+    title: string;
+    show: string[];
+    send: string[];
+};
+/** The commands that turn what a device runs into what its config says. `problems` blocks an apply: something the adapter cannot converge. */
+export type Plan = {
+    steps: Step[];
+    problems: string[];
+};
+export type ApplyOptions = {
+    /** Also send every secret, so a rotated value reaches the device. Secrets cannot be read back, so they are otherwise only sent when the object holding them is new. */
+    secrets: boolean;
+    /** Minutes before a platform that can restore itself does so, if the run does not prove access survived. */
+    rollback: number;
+};
+export type DeviceAdapter = {
+    /** File extension of a saved snapshot, for syntax highlighting. */
+    extension: string;
+    /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
+    unsupported(device: Device): string[];
+    /** The whole configuration the device should run. Secrets appear as markers, never values. */
+    render(device: Device): string;
+    /** What the device runs now, secrets removed, in the form `render` produces where the platform allows. */
+    read(device: Device, network: readonly Device[]): Promise<string>;
+    /** What it takes to go from `current` to `desired`. */
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    /** Replace the contents of a prefix set fetched from a registry. Absent on a platform that cannot hold one. */
+    fill?(device: Device, network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+    /** Send a plan, keeping the device reachable or restoring it. */
+    apply(device: Device, network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+};

package/dist/types/adapters/devices/vrp/index.d.ts

@@ -0,0 +1,24 @@
+import type { Client, ClientChannel } from "ssh2";
+import type { Device } from "../../../schema";
+import { type Dialect } from "../lines";
+import type { DeviceAdapter, Plan } from "../types";
+export declare const dialect: Dialect;
+/** The ACL that guards every management service. */
+export declare const MANAGEMENT_ACL = 2000;
+/** `99 999 to 1000 2000`, the platform's compression of a VLAN list. */
+/** The VLAN IDs of a `vlan batch` line: `vlan batch 10 20 to 30`. */
+export declare function batchIds(line: string): number[];
+export declare function vlanBatch(ids: number[]): string;
+export declare function render(device: Device): string;
+export declare function login(device: Device): Promise<Client>;
+/**
+ * An interactive shell at the user prompt, paging off.
+ *
+ * Every login asks whether to change the password. Answering yes replaces it at once and every stored credential with it, so the answer is always no. Anything sent before the question is answered is taken as the answer.
+ */
+export declare function openShell(client: Client): Promise<ClientChannel>;
+/** What the device runs, credentials scrubbed. */
+export declare function read(device: Device): Promise<string>;
+export declare function unsupported(device: Device): string[];
+export declare function apply(device: Device, _network: readonly Device[], plan: Plan): Promise<void>;
+export declare const vrp: DeviceAdapter;

package/dist/types/adapters/devices/vrp/models.d.ts

@@ -0,0 +1,12 @@
+export declare const models: {
+    readonly "CE6855-48S6Q-HI": {
+        readonly ports: {
+            readonly "10g": 48;
+            readonly "40g": 6;
+        };
+        readonly spelling: {
+            readonly "10g": "10GE1/0/{n}";
+            readonly "40g": "40GE1/0/{n}";
+        };
+    };
+};

package/dist/types/adapters/registries/index.d.ts

@@ -0,0 +1,3 @@
+import type { Family } from "../../schema";
+import type { Registry } from "../../schema/policy";
+export declare const registries: Record<Registry, (query: string, family: Family) => Promise<string[]>>;

package/dist/types/adapters/registries/peeringdb.d.ts

@@ -0,0 +1,16 @@
+import type { Network } from "../../core/define";
+/** A change to send. `id` is set when the record exists and is updated in place. */
+export type PeeringDbChange = {
+    summary: string;
+    id?: number;
+    body: Record<string, unknown>;
+};
+export type PeeringDbPlan = {
+    changes: PeeringDbChange[];
+    /** Records PeeringDB holds that the config does not. */
+    unknown: string[];
+};
+/** What would change at PeeringDB. Reads the public API; needs no key. */
+export declare function planPeeringDb(network: Network): Promise<PeeringDbPlan>;
+/** Send the changes, with the network's API key. */
+export declare function sendPeeringDb(network: Network, changes: PeeringDbChange[]): Promise<void>;

package/dist/types/core/addr.d.ts

@@ -0,0 +1,24 @@
+import type { Family } from "../schema";
+export declare const familyOf: (address: string) => Family;
+/** An address as a number, or null when it is not one. */
+export declare function parse(address: string): bigint | null;
+/** `10.0.0.1/24` to its parts. Throws when it is not an address with a length. */
+export declare function split(cidr: string): {
+    addr: string;
+    len: number;
+    family: Family;
+};
+export declare const isAddress: (text: string) => boolean;
+export declare function isCidr(text: string): boolean;
+/** `10.0.0.1/24` to `10.0.0.0/24`. */
+export declare function network(cidr: string): string;
+/** Is the address or prefix `inner` inside `outer`? */
+export declare function contains(outer: string, inner: string): boolean;
+/** `/25` to `255.255.255.128`. */
+export declare const netmask: (length: number) => string;
+/** `/24` to `0.0.0.255`, the inverted mask some ACLs take. */
+export declare const wildcard: (length: number) => string;
+/** The address with its length dropped. */
+export declare const host: (cidr: string) => string;
+/** Whether another network can reach the address. IPv6 is global only inside 2000::/3, less documentation space. */
+export declare function isGlobal(address: string): boolean;

package/dist/types/core/define.d.ts

@@ -0,0 +1,50 @@
+import type { ModelName, PlatformName, PortName } from "../adapters/devices/catalog";
+import type { Device, Secret } from "../schema";
+/** A value resolved by name when a device is applied, from the environment or `.env` beside the config, and through 1Password when that value is an `op://` reference. Never the value itself. */
+export declare const secret: (name: string) => Secret;
+/** A value read from a file when a device is applied, such as a private key in PEM. The path is relative to the config file; keep the file out of git. */
+export declare const secretFile: (path: string) => Secret;
+/**
+ * Declare one device.
+ *
+ * The names it declares (VLANs, interfaces, policies and the rest) are the only names its other fields accept, and the editor suggests them. The port names come from the model.
+ */
+export declare function defineDevice<const Platform extends PlatformName, const Model extends ModelName<Platform>, const Vlans extends string = never, const Interfaces extends string = never, const Policies extends string = never, const PrefixSets extends string = never, const BgpGroups extends string = never, const Acls extends string = never, const AddressSets extends string = never, const Users extends string = never, const Vrfs extends string = never, const Certificates extends string = never>(device: Device<Platform, Model, PortName<Platform, Model>, Vlans, Interfaces, Policies, PrefixSets, BgpGroups, Acls, AddressSets, Users, Vrfs, Certificates>): Device;
+/** Something a check found. */
+export type Finding = {
+    /** An error stops `diff` and `apply`; a warning is reported only. */
+    level: "error" | "warning";
+    /** The device it is about, when it is about one. */
+    device?: string;
+    /** What is wrong, in a sentence. */
+    message: string;
+};
+/** A rule of your own design, run by `validate` beside the framework's. */
+export type Check = (devices: readonly Device[]) => readonly Finding[];
+/**
+ * One BGP community the network defines, in the community description format of the NLNOG Ring looking glass, which bgp.tools also reads.
+ *
+ * `community` takes `nnn` for any number, `x` for one digit and `a-b` for a range, such as `65535:0:nnn`. `description` refers to what each wildcard matched as `$0`, `$1` and so on, such as `do not announce to AS$0`.
+ */
+export type Community = {
+    community: string;
+    description: string;
+};
+/** The whole network. */
+export type Network = {
+    /** Every device the framework manages. */
+    devices: readonly Device[];
+    /** Rules of your own design. */
+    checks?: readonly Check[];
+    /** The AS the network operates, for what is published about it. */
+    asn?: number;
+    /** The BGP communities the network defines, printed by `circuit communities` for a looking glass or bgp.tools. */
+    communities?: readonly Community[];
+    /** Keeps the network's PeeringDB record in step with the config: `circuit peeringdb`. Needs `asn`. */
+    peeringdb?: {
+        /** An API key with write access to the network's record. */
+        api_key: Secret;
+    };
+};
+/** Declare the network, in `circuit.config.ts`. */
+export declare const defineNetwork: (network: Network) => Network;

package/dist/types/core/merge.d.ts

@@ -0,0 +1,4 @@
+type Merged<T extends readonly object[]> = T extends readonly [infer Head, ...infer Tail extends readonly object[]] ? Head & Merged<Tail> : unknown;
+/** Combine records into one. Unlike spreading them, a name two of them hold is an error rather than one silently replacing the other. */
+export declare function merge<const T extends readonly Record<string, unknown>[]>(...records: T): Merged<T>;
+export {};

package/dist/types/core/secrets.d.ts

@@ -0,0 +1,21 @@
+import type { Secret } from "../schema";
+/** Find `.env` and secret files from this directory, the config file's, instead of the working directory. */
+export declare function useRoot(directory: string): void;
+export declare const isSecret: (value: unknown) => value is Secret;
+/** How a reference is written inside a marker: a variable's name, or `file:` and a path. */
+export declare const referenceOf: (secret: Secret) => string;
+/** Where a reference's value comes from, such as `.env` or `1Password, through .env`, without reading it. Undefined when it is set nowhere. */
+export declare function sourceOf(reference: string): string | undefined;
+/** The value behind a reference, as `referenceOf` writes it. */
+declare function valueOf(reference: string): string;
+/** The value of a secret, or of a variable named directly. */
+export declare const resolve: (secret: Secret | string) => string;
+/** How a secret appears in rendered config. Replaced with its value only when sent to a device. */
+export declare const marker: (secret: Secret) => string;
+/** A marker anywhere in a command. Its group is the reference. */
+export declare const MARKER: RegExp;
+/** Replace every marker in a command with its value. */
+export declare const substitute: (text: string) => string;
+/** The value behind one marker's reference, for a platform that takes a secret interactively. */
+export declare const valueOfReference: typeof valueOf;
+export {};

package/dist/types/core/time.d.ts

@@ -0,0 +1,2 @@
+/** Minutes east of UTC an IANA zone is at now, for platforms that take an offset rather than a zone. */
+export declare function offset(zone: string): number;

package/dist/types/core/validate.d.ts

@@ -0,0 +1,2 @@
+import type { Finding, Network } from "./define";
+export declare function validate(network: Network): Finding[];

package/dist/types/index.d.ts

@@ -0,0 +1,6 @@
+export { defineDevice, defineNetwork, secret, secretFile } from "./core/define";
+export { merge } from "./core/merge";
+export type { Check, Community, Finding, Network } from "./core/define";
+export type * from "./schema";
+/** Address helpers, for checks of your own. */
+export { contains, familyOf, host, isAddress, isCidr, isGlobal, network as prefixOf } from "./core/addr";

package/dist/types/presets/index.d.ts

@@ -0,0 +1,99 @@
+import type { Check, Community } from "../core/define";
+import type { AclRule, Device, FilterRule, PolicyRule, Prefix } from "../schema";
+/** IPv4 sources that never arrive from the internet: loopback, link-local and "this network", after RFC 6890. */
+export declare const MARTIANS: readonly ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
+/** IPv4 private space, RFC 1918. */
+export declare const PRIVATE_RANGES: readonly ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+/** Hardware ACL rules dropping traffic arriving on a VLAN from sources that cannot be there: your own space, martians, private ranges. One rule per source. */
+export declare const antiSpoofing: <V extends string>(vlan: V, sources: readonly Prefix[]) => AclRule<V>[];
+/** Firewall rules dropping packets with a TCP flag combination no legitimate packet carries, for a forward chain. */
+export declare const badTcpFlags: () => FilterRule<never, never>[];
+/** The prefix lengths a BGP import accepts. */
+export type SanityLengths = {
+    /** Shortest and longest IPv4 prefix accepted. /8 to /24 when absent. */
+    ipv4?: {
+        min: number;
+        max: number;
+    };
+    /** Shortest and longest IPv6 prefix accepted. /16 to /48 when absent. */
+    ipv6?: {
+        min: number;
+        max: number;
+    };
+};
+/** Route policy rules rejecting what no neighbor should send: prefixes too short or too long for the global table, and RPKI invalid. Place it first in an import, or as a policy other imports call. */
+export declare function bgpSanity(lengths?: SanityLengths): PolicyRule<never, never>[];
+/** Each BGP neighbor's own policies, or its group's. */
+export declare function neighborPolicies(device: Device): {
+    name: string;
+    address: string;
+    import: string | undefined;
+    export: string | undefined;
+}[];
+/** The prefixes an export policy accepts by name. */
+export declare function offered(device: Device, policy: string | undefined): string[];
+/** Every BGP export ends in a reject that matches everything, so nothing leaves by accident. */
+export declare const exportsEndInReject: Check;
+/** The VLANs a port carries, untagged or tagged. */
+export declare const vlansOf: (port: {
+    access_vlan?: string;
+    trunk_vlans?: readonly string[];
+}) => string[];
+/** Where traffic from outside, before anything filters it, may go. Every VLAN not listed as untrusted is trusted, so a VLAN added later is protected without being listed. */
+export type TrustBoundary = {
+    /** VLANs carrying traffic straight from outside: transits, exchanges, an ISP handoff. */
+    untrusted: readonly string[];
+    /** The devices that filter: the only ones that may give an untrusted VLAN an address, and the only ones a port carrying both kinds may face. */
+    routers: readonly string[];
+};
+/** A check: traffic from outside reaches your own VLANs only through a router. A port or LAG carrying an untrusted VLAN beside any other is on a router or faces one, and only a router gives an untrusted VLAN an address. */
+export declare const trustBoundary: (boundary: TrustBoundary) => Check;
+/** A GRE or VXLAN tunnel's local address is outside what the neighbors over it are offered, or their replies route back into the tunnel. */
+export declare const tunnelsOutsideOffered: Check;
+/**
+ * A BGP community scheme of large communities, `asn:function:parameter`, in the style of RFC 8195. Each field names the function number your network uses for it; leave out what your network does not offer.
+ */
+export type CommunityScheme<Class extends string = string> = {
+    /** Your AS. It is the first part of every community. */
+    asn: number;
+    /** Set on import: the kind of neighbor a route came from, `asn:function:class`. */
+    learned_from?: {
+        function: number;
+        classes: Readonly<Record<Class, number>>;
+    };
+    /** Set on import: the site a route was learned at, `asn:function:site`. `sites` names the sites, for the catalogue. */
+    learned_at?: {
+        function: number;
+        sites?: Readonly<Record<number, string>>;
+    };
+    /** Set on import: the AS a route was learned from, `asn:function:asn`. */
+    learned_from_as?: number;
+    /** Set by a customer: do not announce the route to an AS, `asn:function:asn`, or to anyone, `asn:function:0`. */
+    do_not_announce?: number;
+    /** Set by a customer: prepend toward an AS once, twice or three times, `asn:function:asn`. */
+    prepend?: {
+        once?: number;
+        twice?: number;
+        three_times?: number;
+    };
+    /** Set by a customer: drop traffic to the route in your network, before it reaches them, `asn:function:0`. The route is never announced further. */
+    blackhole?: number;
+};
+/**
+ * Policy rules and a catalogue from one community scheme, so the communities your routers set, the ones they act on, and the ones you publish never disagree.
+ *
+ * - `tag(neighborClass, neighborAs, { site, keepActions })`: a rule for an import policy. It removes your communities a neighbor set, then adds where the route was learned. `site` is needed when the scheme has `learned_at`. With `keepActions`, for a customer, its action communities stay.
+ * - `actions(neighborAs)`: rules for an export policy toward one neighbor. They act on a customer's action communities, then remove all of yours. Place them before the rules that accept.
+ * - `blackhole(prefixSet)`: a rule for a customer's import policy, before anything that rejects long prefixes. It takes a route the customer asked to blackhole, but only inside `prefixSet`, its own space, and drops traffic to it here.
+ * - `catalogue`: every community, for `communities` in `defineNetwork`.
+ */
+export declare function communityScheme<const Class extends string>(scheme: CommunityScheme<Class>): {
+    community: (fn: number, parameter: number | string) => string;
+    tag: (neighborClass: Class, neighborAs: number, options?: {
+        site?: number;
+        keepActions?: boolean;
+    }) => PolicyRule<never, never>;
+    actions: (neighborAs: number) => PolicyRule<never, never>[];
+    blackhole: <S extends string>(prefixSet: S) => PolicyRule<never, S>;
+    catalogue: Community[];
+};

package/dist/types/schema/common.d.ts

@@ -0,0 +1,24 @@
+/**
+ * A value kept out of the repository and resolved only when a device is applied.
+ *
+ * `secret("NAME")` reads a variable from the environment or `.env` beside the config; a value written as `op://vault/item/field` is read from 1Password. `secretFile("path")` reads a file, relative to the config file, for a value that spans lines such as a private key in PEM. Keep that file out of git.
+ */
+export type Secret = {
+    /** Name of the value in the environment or in `.env`. */
+    readonly secret: string;
+} | {
+    /** Path of a file holding the value, relative to the config file. */
+    readonly secret_file: string;
+};
+/** An address without a length, IPv4 or IPv6, for example `10.0.0.1`. */
+export type IP = string;
+/** A network with its length, for example `10.0.0.0/24`. */
+export type Prefix = string;
+/** An interface address with its length, for example `10.0.0.1/24`. */
+export type Address = string;
+/** An address family. */
+export type Family = "ipv4" | "ipv6";
+/** Bits per second, for example `2G`, `500M` or `64k`. */
+export type Rate = `${number}${"k" | "M" | "G"}`;
+/** A log severity, most severe first. A threshold includes everything above it. */
+export type Severity = "emergency" | "alert" | "critical" | "error" | "warning" | "notice" | "info" | "debug";

package/dist/types/schema/device.d.ts

@@ -0,0 +1,80 @@
+import type { IP } from "./common";
+import type { AclRule, Firewall } from "./firewall";
+import type { Interface, Port, Vlan } from "./interfaces";
+import type { PrefixSet, RoutePolicy } from "./policy";
+import type { Routing } from "./routing";
+import type { Certificate, DhcpRelay, DhcpServer, FlowExport, Management, System, User } from "./system";
+/** How the framework reaches the device. */
+export type Connection<U extends string> = {
+    /** Management address. */
+    host: IP;
+    /** One of the device's `users`. Its password is the login. */
+    user: U;
+    /** SSH port. 22 when absent. */
+    port?: number;
+};
+/** A separate routing table, with the interfaces that route in it. */
+export type Vrf = {
+    /** What the VRF is for. */
+    description?: string;
+};
+/**
+ * Everything one device runs. What is not written here is removed from the device or returned to its default.
+ *
+ * Type parameters are the names the device declares, so a reference to a name that does not exist fails to compile: N ports, V VLANs, I interfaces, P policies, S prefix sets, G BGP groups, A ACLs, AS address sets, U users, F VRFs, C certificates.
+ */
+export type Device<Pl extends string = string, M extends string = string, N extends string = string, V extends string = string, I extends string = string, P extends string = string, S extends string = string, G extends string = string, A extends string = string, AS extends string = string, U extends string = string, F extends string = string, C extends string = string> = {
+    /** Hostname. */
+    name: string;
+    /** Operating system, which decides the adapter that renders and applies the device. */
+    platform: Pl;
+    /** Hardware model. Decides which port names exist. */
+    model: M;
+    /** How the framework logs in. */
+    connection: Connection<NoInfer<U>>;
+    /** Device-wide settings. */
+    system?: System;
+    /** Logins, keyed by user name. Users not listed are removed. */
+    users?: Record<U, User>;
+    /** Ways in, and who may use them. */
+    management?: Management<NoInfer<I | N>, NoInfer<C>>;
+    /** Certificates, keyed by name. */
+    certificates?: Record<C, Certificate>;
+    /** VLANs, keyed by name. */
+    vlans?: Record<V, Vlan>;
+    /** Physical ports, keyed by `<speed>-<position>`. */
+    ports?: Partial<Record<N, Port<NoInfer<V>, NoInfer<A>, NoInfer<I>, NoInfer<F>>>>;
+    /** Interfaces that are not physical ports, keyed by name. */
+    interfaces?: Record<I, Interface<NoInfer<V>, NoInfer<F>>>;
+    /** Separate routing tables, keyed by name. */
+    vrfs?: Record<F, Vrf>;
+    /** Static routes, BGP, OSPF and route validation. */
+    routing?: Routing<NoInfer<P>, G, NoInfer<I | N>, NoInfer<F>>;
+    /** Route policies, keyed by name. */
+    policies?: Record<P, RoutePolicy<NoInfer<P>, NoInfer<S>>>;
+    /** Prefix sets that policies match on, keyed by name. */
+    prefix_sets?: Record<S, PrefixSet>;
+    /** Packet filtering and address translation. */
+    firewall?: Firewall<NoInfer<I | N>, AS>;
+    /** Hardware ACLs, keyed by name, applied to a port with `acl`. */
+    acls?: Record<A, readonly AclRule<NoInfer<V>>[]>;
+    /** DHCP servers, keyed by name. */
+    dhcp?: Record<string, DhcpServer<NoInfer<I | N>>>;
+    /** DHCP relays, keyed by name. */
+    dhcp_relay?: Record<string, DhcpRelay<NoInfer<I | N>>>;
+    /** Flow records or packet samples sent to collectors. */
+    flow_export?: FlowExport<NoInfer<I | N>>;
+    /** Advertise and learn neighbors with LLDP on every port, or only on the interfaces listed. A port may override it. */
+    lldp?: true | {
+        interfaces: readonly NoInfer<I | N>[];
+    };
+    /** Spanning tree on every switched port. A port may override it. */
+    stp?: {
+        /** Which variant runs. RSTP when absent. */
+        mode?: "stp" | "rstp" | "mstp";
+        /** Bridge priority, 0 to 61440 in steps of 4096. Lower wins the root election. */
+        priority?: number;
+    };
+    /** Forward in hardware where the platform can. An interface may override it. */
+    hardware_offload?: boolean;
+};

package/dist/types/schema/firewall.d.ts

@@ -0,0 +1,118 @@
+import type { Family, IP, Prefix, Rate } from "./common";
+/** An IP protocol. `icmp` means ICMPv6 in an IPv6 rule. */
+export type Protocol = "tcp" | "udp" | "icmp" | "gre" | "esp" | "ah" | "ospf" | "vrrp";
+/** The state connection tracking assigns a packet. */
+export type ConnectionState = "new" | "established" | "related" | "untracked" | "invalid";
+/** A TCP header flag. */
+export type TcpFlag = "fin" | "syn" | "rst" | "psh" | "ack" | "urg";
+/** Conditions on a packet. All must hold. A rule with addresses of one family applies to that family only. */
+export type FilterMatch<I extends string, AS extends string> = {
+    /** Only packets of this family. */
+    family?: Family;
+    /** IP protocol. */
+    protocol?: Protocol;
+    /** Source address or prefix. */
+    src?: Prefix;
+    /** Destination address or prefix. */
+    dst?: Prefix;
+    /** Source is in this address set. */
+    src_set?: AS;
+    /** Destination is in this address set. */
+    dst_set?: AS;
+    /** Source port, or any of several. TCP and UDP only. */
+    src_port?: number | readonly number[];
+    /** Destination port, or any of several. TCP and UDP only. */
+    dst_port?: number | readonly number[];
+    /** Arrived on this interface. */
+    in_interface?: I;
+    /** Leaves through this interface. */
+    out_interface?: I;
+    /** Connection tracking state, any of these. */
+    state?: readonly ConnectionState[];
+    /** TCP flags that must be set, and flags that must not be. */
+    tcp_flags?: {
+        set?: readonly TcpFlag[];
+        unset?: readonly TcpFlag[];
+    };
+};
+/** One firewall rule. */
+export type FilterRule<I extends string, AS extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets the rule applies to. Every packet when absent. */
+    match?: FilterMatch<I, AS>;
+    /** What happens to a matching packet. `reject` answers the sender, `drop` does not. */
+    action: "accept" | "drop" | "reject";
+    /** Hand the rest of an accepted flow to the fast path, past the remaining rules. */
+    offload?: true;
+};
+/** Rules evaluated in order, first match wins, then `default`. */
+export type Chain<I extends string, AS extends string> = {
+    /** What happens to a packet no rule matched. Accept when absent. */
+    default?: "accept" | "drop";
+    /** Evaluated in order. */
+    rules?: readonly FilterRule<I, AS>[];
+};
+/** One address translation. */
+export type NatRule<I extends string, AS extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets are translated. Every packet when absent. */
+    match?: FilterMatch<I, AS>;
+} & ({
+    /** Use the address of the outgoing interface. */
+    action: "masquerade";
+} | {
+    /** `snat` rewrites the source, `dnat` the destination. */
+    action: "snat" | "dnat";
+    /** The address to rewrite to. */
+    to: IP;
+    /** The port to rewrite to. Unchanged when absent. */
+    to_port?: number;
+});
+/** Connection-tracking helpers that rewrite application payloads. None run unless listed. */
+export type Helper = "ftp" | "tftp" | "sip" | "h323" | "pptp" | "rtsp" | "irc";
+/** What the device filters and translates. */
+export type Firewall<I extends string, AS extends string> = {
+    /** Named groups of addresses and prefixes, of either family, that rules match on. */
+    address_sets?: Record<AS, readonly (IP | Prefix)[]>;
+    /** Traffic to the device, through it, and from it. */
+    filter?: {
+        input?: Chain<I, NoInfer<AS>>;
+        forward?: Chain<I, NoInfer<AS>>;
+        output?: Chain<I, NoInfer<AS>>;
+    };
+    /** Source translation on the way out, destination translation on the way in. */
+    nat?: {
+        source?: readonly NatRule<I, NoInfer<AS>>[];
+        destination?: readonly NatRule<I, NoInfer<AS>>[];
+    };
+    /** Helpers that run. None when absent. */
+    helpers?: readonly Helper[];
+};
+/** A stateless rule evaluated in hardware where traffic arrives, before routing. */
+export type AclRule<V extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Which packets the rule applies to. Every packet when absent. */
+    match?: {
+        /** Only packets of this family. */
+        family?: Family;
+        /** IP protocol. */
+        protocol?: Protocol;
+        /** Source prefix. */
+        src?: Prefix;
+        /** Destination prefix. */
+        dst?: Prefix;
+        /** Source port, or any of several. */
+        src_port?: number | readonly number[];
+        /** Destination port, or any of several. */
+        dst_port?: number | readonly number[];
+        /** Carried in this VLAN. */
+        vlan?: V;
+    };
+    /** What happens to a matching packet. */
+    action: "accept" | "drop";
+    /** Accepted traffic above this rate is dropped. */
+    rate?: Rate;
+};

package/dist/types/schema/index.d.ts

@@ -0,0 +1,7 @@
+export type * from "./common";
+export type * from "./device";
+export type * from "./firewall";
+export type * from "./interfaces";
+export type * from "./policy";
+export type * from "./routing";
+export type * from "./system";