@takodotid/circuit 0.8.0 → 0.10.0

package/dist/types/schema/interfaces.d.ts

@@ -0,0 +1,181 @@
+import type { Address, IP, Prefix, Secret } from "./common";
+/** A VLAN. The key it is declared under is its name. */
+export type Vlan = {
+    /** The number carried on the wire, 1 to 4094. */
+    id: number;
+    /** What the VLAN is for. */
+    description?: string;
+};
+/** A storm-control threshold: packets per second, or percent of the link's speed. */
+export type Threshold = {
+    pps: number;
+} | {
+    percent: number;
+};
+/** A virtual router address shared with other devices on the same segment, RFC 5798. */
+export type Vrrp = {
+    /** Virtual router number, 1 to 255. The same on every device sharing the address. */
+    id: number;
+    /** The shared address, without a length. */
+    address: IP;
+    /** Higher wins the master election, 1 to 254. 100 when absent. */
+    priority?: number;
+    /** Take mastership back from a lower priority device when this one returns. Off when absent. */
+    preempt?: boolean;
+    /** Seconds between advertisements. 1 when absent. */
+    interval?: number;
+};
+/** Layer 3 settings shared by every interface that can hold an address. */
+export type Routed<F extends string> = {
+    /** Addresses with their length. Use `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
+    addresses?: readonly (Address | {
+        address: Address;
+        peer: IP;
+    })[];
+    /** Send IPv6 router advertisements on this interface. Off when absent. */
+    ipv6_ra?: boolean;
+    /** Overrides the device's `hardware_offload` for traffic routed through this interface. Software forwarding is what makes the firewall apply. */
+    hardware_offload?: boolean;
+    /** Virtual router addresses held on this interface. */
+    vrrp?: readonly Vrrp[];
+    /** The VRF this interface routes in. The default table when absent. */
+    vrf?: F;
+    /** This interface is the network's presence at an internet exchange. Devices ignore it; `circuit peeringdb` publishes it. */
+    exchange?: Exchange;
+};
+/** Presence at an internet exchange, as a registry lists it. The addresses are the interface's own. */
+export type Exchange = {
+    /** The exchange's name, for output. */
+    name: string;
+    /** Capacity toward the exchange, in Mbit/s. */
+    speed: number;
+    /** The exchange LAN's id at PeeringDB, its `ixlan_id`. */
+    peeringdb_ixlan?: number;
+};
+/** Spanning tree settings for one port. */
+export type PortStp = {
+    /** The port faces a host, never a switch, so it forwards at once. */
+    edge?: boolean;
+    /** Path cost. Lower is preferred. Derived from speed when absent. */
+    cost?: number;
+    /** Port priority, 0 to 240 in steps of 16. Lower is preferred. */
+    priority?: number;
+};
+/** Layer 2 membership. A port or LAG with none of these is routed. */
+export type Switched<V extends string> = {
+    /** Untagged member of one VLAN. */
+    access_vlan?: V;
+    /** Tagged member of these VLANs. */
+    trunk_vlans?: readonly V[];
+    /** Untagged frames on a trunk belong to this VLAN. Only with `trunk_vlans`. */
+    native_vlan?: V;
+    /** Overrides the device's `stp` for this port. `false` stops it sending or acting on BPDUs. */
+    stp?: boolean | PortStp;
+    /** Drop flooded traffic above these thresholds. */
+    storm_control?: {
+        broadcast?: Threshold;
+        multicast?: Threshold;
+        unknown_unicast?: Threshold;
+    };
+};
+/** The other end of a cable: another device and its port. Both ends must agree on how they are switched. */
+export type Link = {
+    /** Name of the device at the other end. */
+    device: string;
+    /** The port on that device. */
+    port: string;
+};
+/** A physical port. Ports a device does not declare are shut down. */
+export type Port<V extends string, A extends string, L extends string, F extends string> = Routed<F> & Switched<V> & {
+    /** What is plugged in. */
+    description?: string;
+    /** Largest IP packet, in bytes. 1500 when absent. */
+    mtu?: number;
+    /** Fixed speed, for an optic slower than the cage. Negotiated when absent. */
+    speed?: "100m" | "1g" | "10g" | "25g" | "40g" | "50g" | "100g";
+    /** Overrides the device's `lldp` for this port. */
+    lldp?: boolean;
+    /** Hardware ACL applied to traffic arriving on this port. */
+    acl?: A;
+    /** Member of this LAG. The LAG holds every other setting. */
+    lag?: L;
+    /** Another of our devices at the other end of the cable. */
+    link?: Link;
+};
+/** Settings every interface that is not a physical port shares. */
+type Base<F extends string> = Routed<F> & {
+    /** What the interface is for. */
+    description?: string;
+    /** Largest IP packet, in bytes. */
+    mtu?: number;
+};
+/** A layer 3 interface on a VLAN. */
+export type VlanInterface<V extends string, F extends string> = Base<F> & {
+    type: "vlan";
+    /** The VLAN it sits on. */
+    vlan: V;
+};
+/** An interface that is always up and belongs to no link, for addresses that must not depend on one. */
+export type Loopback<F extends string> = Base<F> & {
+    type: "loopback";
+};
+/** A link aggregation. Member ports name it with `lag`. */
+export type Lag<V extends string, F extends string> = Base<F> & Switched<V> & {
+    type: "lag";
+    /** LACP negotiates membership with the far end; static bundles without asking. LACP when absent. */
+    mode?: "lacp" | "static";
+    /** Number on platforms that name a LAG by number. Its position among the device's LAGs when absent. */
+    id?: number;
+};
+/** A GRE tunnel. */
+export type Gre<F extends string> = Base<F> & {
+    type: "gre";
+    /** Our tunnel endpoint. */
+    local: IP;
+    /** The far tunnel endpoint. */
+    remote: IP;
+};
+/** A point-to-point VXLAN tunnel. */
+export type Vxlan<F extends string> = Base<F> & {
+    type: "vxlan";
+    /** Segment identifier, the same on both ends. */
+    vni: number;
+    /** Our tunnel endpoint. */
+    local: IP;
+    /** The far tunnel endpoint. */
+    remote: IP;
+    /** UDP port. 4789 when absent. */
+    port?: number;
+    /** Fixed MAC address, so a rebuild keeps the one the far side learned. */
+    mac?: string;
+};
+/** One peer of a WireGuard interface. */
+export type WireGuardPeer = {
+    /** Who or what the peer is. */
+    name: string;
+    /** The peer's public key. Public keys are not secrets. */
+    public_key: string;
+    /** Addresses the peer may send from and that are routed to it. */
+    allowed_addresses: readonly Prefix[];
+    /** `host:port`, for a peer this side dials. The peer dials in when absent. */
+    endpoint?: string;
+    /** Seconds between keepalives, for a peer behind NAT. None when absent. */
+    keepalive?: number;
+    /** What a generated client config routes into the tunnel. Affects no forwarding here. */
+    client_allowed_addresses?: readonly Prefix[];
+};
+/** A WireGuard interface. */
+export type WireGuard<F extends string> = Base<F> & {
+    type: "wireguard";
+    /** UDP port peers connect to. */
+    listen_port: number;
+    /** The address clients connect to, for generated client configs. */
+    endpoint?: IP;
+    /** This interface's private key. Its public key is derived from it. */
+    private_key: Secret;
+    /** Who may connect. */
+    peers?: readonly WireGuardPeer[];
+};
+/** Any interface that is not a physical port. */
+export type Interface<V extends string, F extends string> = VlanInterface<V, F> | Loopback<F> | Lag<V, F> | Gre<F> | Vxlan<F> | WireGuard<F>;
+export {};

package/dist/types/schema/policy.d.ts

@@ -0,0 +1,88 @@
+import type { Family, IP, Prefix } from "./common";
+/** Registries a prefix set can be fetched from. */
+export type Registry = "ripe-stat";
+/** Prefixes listed here, or fetched from a registry by `refresh` and never typed by hand. */
+export type PrefixSet = {
+    /** The prefixes, of one family. */
+    prefixes: readonly Prefix[];
+} | {
+    source: {
+        /** Where the prefixes come from. */
+        registry: Registry;
+        /** What to ask for, for example `AS7713`. */
+        query: string;
+        /** Which family to keep. */
+        family: Family;
+    };
+};
+/** Conditions on a route. All must hold. An empty match holds for every route. */
+export type Match<S extends string> = {
+    /** Only routes of this family. */
+    family?: Family;
+    /** Exactly this prefix. */
+    prefix?: Prefix;
+    /** Any prefix in this set. */
+    prefix_set?: S;
+    /** Prefix length within this range, inclusive. */
+    prefix_length?: {
+        min?: number;
+        max?: number;
+    };
+    /** AS path length within this range, inclusive. Every AS counts, prepends included. */
+    as_path_length?: {
+        min?: number;
+        max?: number;
+    };
+    /** The route's origin validation state. */
+    rpki?: "valid" | "invalid" | "not-found";
+    /** Carries this standard community, `asn:value`. */
+    community?: string;
+    /** Carries this large community, `asn:function:parameter`. */
+    large_community?: string;
+};
+/** Changes to a route. In community lists to remove, `*` stands for any value of a field, as in `64500:*:*`. */
+export type Sets = {
+    /** Preference among routes to the same prefix within our AS. Higher wins. */
+    local_pref?: number;
+    /** Multi-exit discriminator offered to the neighbor. Lower wins. */
+    med?: number;
+    /** Prepend our own AS this many times, to make the path look longer. */
+    prepend?: number;
+    /** Replace the route's standard communities with these. */
+    communities?: readonly string[];
+    /** Add these standard communities. */
+    add_communities?: readonly string[];
+    /** Remove standard communities matching these. */
+    remove_communities?: readonly string[];
+    /** Replace the route's large communities with these. */
+    large_communities?: readonly string[];
+    /** Add these large communities. */
+    add_large_communities?: readonly string[];
+    /** Remove large communities matching these. */
+    remove_large_communities?: readonly string[];
+    /** Next hop for the route. */
+    next_hop?: IP;
+    /** Source address for traffic the device itself sends to the route. Applies to routes of the same family as the address. */
+    preferred_source?: IP;
+    /** Drop traffic to the route on this device, instead of forwarding it. */
+    blackhole?: true;
+};
+/**
+ * One step of a route policy. Evaluated in this order: `call`, then `match`, then `set`, then `action`.
+ *
+ * A rule without `action` changes the route and moves on to the next rule.
+ */
+export type PolicyRule<P extends string, S extends string> = {
+    /** Shown beside the rule on the device. */
+    description?: string;
+    /** Evaluate another policy first. A route it accepts or rejects stops there. */
+    call?: P;
+    /** Which routes the rule applies to. Every route when absent. */
+    match?: Match<S>;
+    /** What to change on a matching route. */
+    set?: Sets;
+    /** Accept or reject a matching route, ending the policy for it. */
+    action?: "accept" | "reject";
+};
+/** Rules evaluated in order, first decision wins. A route no rule accepts is rejected. */
+export type RoutePolicy<P extends string, S extends string> = readonly PolicyRule<P, S>[];

package/dist/types/schema/routing.d.ts

@@ -0,0 +1,115 @@
+import type { Family, IP, Prefix, Secret } from "./common";
+/** A route the device carries without learning it. */
+export type StaticRoute<I extends string, F extends string> = {
+    /** Destination. */
+    prefix: Prefix;
+    /** Next-hop address. */
+    via?: IP;
+    /** Next-hop interface, for a link without a next-hop address. */
+    interface?: I;
+    /** Discard matching traffic. The usual way to originate an aggregate. */
+    blackhole?: true;
+    /** Preference against other routes to the same prefix. Lower wins. 1 when absent. */
+    distance?: number;
+    /** The VRF the route belongs to. The default table when absent. */
+    vrf?: F;
+    /** Why the route exists. */
+    description?: string;
+};
+/**
+ * What a BGP neighbor is to us, with the roles RFC 9234 defines: `provider`, a transit we buy from; `customer`, one we sell transit to; `peer`, one we exchange our own routes with; `rs`, an exchange's route server; `rs-client`, a network using our route server.
+ */
+export type BgpRole = "provider" | "customer" | "peer" | "rs" | "rs-client";
+/** Settings a BGP neighbor can state itself or take from its group. */
+export type NeighborSettings<P extends string> = {
+    /** The neighbor's AS. Our own AS makes the session internal. */
+    remote_as?: number;
+    /** Who the neighbor is. */
+    description?: string;
+    /** Source address for the session. The outgoing interface's address when absent. */
+    local_address?: IP;
+    /** Policy for routes learned. Nothing is accepted when absent. */
+    import?: P;
+    /** Policy for routes announced. Nothing is announced when absent. */
+    export?: P;
+    /** What the neighbor is to us, such as `provider` for a transit. Both sides then reject a route leak, after RFC 9234. */
+    role?: BgpRole;
+    /** The neighbor is more than one hop away. */
+    multihop?: boolean;
+    /** TCP MD5 password shared with the neighbor. */
+    password?: Secret;
+    /** Close the session when the neighbor announces more prefixes than this. It stays closed until cleared by hand, on RouterOS with `/routing bgp session clear <session> flag=limit-exceeded`. */
+    max_prefixes?: number;
+    /** Seconds without a message before the session is declared down. */
+    hold_time?: number;
+    /** Seconds between keepalive messages. */
+    keepalive?: number;
+    /** Families exchanged. The family of the neighbor's address when absent. */
+    families?: readonly Family[];
+    /** Wait for the neighbor to connect instead of connecting to it. */
+    passive?: boolean;
+    /** Detect a dead link in under a second with BFD. */
+    bfd?: boolean;
+};
+/** One BGP session. Settings it does not state come from its group. */
+export type Neighbor<P extends string, G extends string> = NeighborSettings<P> & {
+    /** The neighbor's address. */
+    address: IP;
+    /** Group whose settings this neighbor takes where it states none. */
+    group?: NoInfer<G>;
+};
+/** BGP on this device. */
+export type Bgp<P extends string, G extends string> = {
+    /** Our AS number. */
+    asn: number;
+    /** Prefixes this device originates. Each needs a route, for example a static blackhole. Export policy still decides who receives them. */
+    networks?: readonly Prefix[];
+    /** Settings shared by several neighbors, keyed by group name. */
+    groups?: Record<G, NeighborSettings<P>>;
+    /** Sessions keyed by name. */
+    neighbors?: Record<string, Neighbor<P, G>>;
+};
+/** A route origin validation server, RFC 8210. */
+export type RpkiServer = {
+    /** Where the validator listens. */
+    address: IP;
+    /** Its RTR port, often 323 or 8282. */
+    port: number;
+    /** Who runs it, or why it is here. */
+    description?: string;
+};
+/** OSPF on one interface. */
+export type OspfInterface = {
+    /** Cost of sending through this interface. Lower is preferred. Derived from speed when absent. */
+    cost?: number;
+    /** Advertise the interface's network but form no adjacency on it. */
+    passive?: boolean;
+    /** How the link is treated. Broadcast when absent. */
+    network?: "broadcast" | "point-to-point";
+    /** Detect a dead neighbor in under a second with BFD. */
+    bfd?: boolean;
+};
+/** OSPF, version 2 for IPv4 and version 3 for IPv6. */
+export type Ospf<I extends string> = {
+    /** Which versions run. IPv4 when absent. */
+    families?: readonly Family[];
+    /** Areas keyed by area ID, for example `0.0.0.0`, each with the interfaces in it. */
+    areas: Record<string, {
+        interfaces: Partial<Record<I, OspfInterface>>;
+    }>;
+    /** Routes from other sources announced into OSPF. */
+    redistribute?: readonly ("connected" | "static")[];
+};
+/** Routing on this device. */
+export type Routing<P extends string, G extends string, I extends string, F extends string> = {
+    /** Identifies this router to its neighbors. */
+    router_id?: IP;
+    /** Routes the device carries without learning them. */
+    static?: readonly StaticRoute<I, F>[];
+    /** BGP sessions and what they exchange. */
+    bgp?: Bgp<P, G>;
+    /** OSPF areas and interfaces. */
+    ospf?: Ospf<I>;
+    /** Validators answering route origin validation. */
+    rpki?: readonly RpkiServer[];
+};

package/dist/types/schema/system.d.ts

@@ -0,0 +1,186 @@
+import type { IP, Prefix, Secret, Severity } from "./common";
+/** Device-wide settings. */
+export type System = {
+    /** IANA zone, for example `Asia/Jakarta`. UTC when absent. */
+    timezone?: string;
+    /** Shown at login. */
+    banner?: string;
+    /** Resolvers the device uses. */
+    dns?: {
+        /** Resolvers, in order of preference. */
+        servers: readonly IP[];
+        /** Answer queries from others. Off when absent. */
+        serve?: boolean;
+    };
+    /** Time the device keeps. */
+    ntp?: {
+        /** Time sources, by address or name. */
+        servers: readonly string[];
+        /** Answer time queries from others. Off when absent. */
+        serve?: boolean;
+    };
+    /** Where log messages go. */
+    logging?: {
+        /** Kept on the device's own storage, from `level` up. */
+        local?: {
+            /** The least severe message kept. */
+            level: Severity;
+            /** How many rotated files to keep. */
+            files?: number;
+            /** Lines in each file before it rotates. */
+            lines_per_file?: number;
+        };
+        /** Sent to syslog collectors, each from its own `level` up. */
+        remote?: readonly {
+            address: IP;
+            /** UDP port. 514 when absent. */
+            port?: number;
+            /** The least severe message sent. */
+            level: Severity;
+        }[];
+    };
+    /** Software release track the device updates from. */
+    release_channel?: string;
+    /** Read optic temperature, power and voltage. */
+    transceiver_monitoring?: boolean;
+    /** Host behaviour of the IP stack. */
+    ip?: {
+        /** Send ICMP redirects. Off when absent. */
+        icmp_redirects?: boolean;
+        /** Answer a TCP SYN flood with SYN cookies. Off when absent. */
+        syn_cookies?: boolean;
+    };
+};
+/** A login on the device. */
+export type User = {
+    /** What the user may do. */
+    role: "admin" | "operator" | "read-only";
+    /** The login password. */
+    password: Secret;
+    /** Who the account is for. */
+    description?: string;
+    /** Public keys accepted instead of the password over SSH. */
+    ssh_keys?: readonly string[];
+};
+/** A way into the device. Absent means turned off. */
+export type Service = {
+    /** Sources allowed. `management.allow` when absent. */
+    allow?: readonly Prefix[];
+    /** TCP or UDP port. The protocol's own when absent. */
+    port?: number;
+};
+/** One SNMPv3 user. */
+export type SnmpUser = {
+    /** How messages are authenticated. */
+    auth: "sha1" | "sha256";
+    /** The authentication passphrase. */
+    auth_password: Secret;
+    /** How messages are encrypted. */
+    privacy: "aes128" | "des";
+    /** The encryption passphrase. */
+    privacy_password: Secret;
+};
+/** How the device is reached and managed. */
+export type Management<I extends string, C extends string> = {
+    /** Sources allowed to every service that does not state its own. */
+    allow?: readonly Prefix[];
+    /** Secure shell. */
+    ssh?: Service & {
+        /** Also offer legacy ciphers, MACs and key exchanges. Off when absent. */
+        weak_crypto?: boolean;
+        /** Seconds a login may take. */
+        auth_timeout?: number;
+        /** Failed attempts allowed per connection. */
+        auth_retries?: number;
+    };
+    /** Unencrypted remote login. */
+    telnet?: Service;
+    /** Web interface, unencrypted. */
+    http?: Service;
+    /** Web interface over TLS. */
+    https?: Service & {
+        /** One of the device's `certificates`. */
+        certificate?: C;
+    };
+    /** The platform's own API, unencrypted. */
+    api?: Service;
+    /** The platform's own API over TLS. */
+    api_tls?: Service & {
+        /** One of the device's `certificates`. */
+        certificate?: C;
+    };
+    /** File transfer, unencrypted. */
+    ftp?: Service;
+    /** The platform's own management protocol. `interfaces` also allows it at layer 2 on those interfaces. */
+    native?: Service & {
+        interfaces?: readonly I[];
+    };
+    /** Polling by SNMP. */
+    snmp?: Service & {
+        /** Read-only community for version 2c. Version 2c is off when absent. */
+        community?: Secret;
+        /** Version 3 users, keyed by name. */
+        users?: Record<string, SnmpUser>;
+        /** Who to contact about the device. */
+        contact?: string;
+        /** Where the device is. */
+        location?: string;
+    };
+    /** Console login uses this password. The device's users when absent. */
+    console?: {
+        password: Secret;
+    };
+    /** Password for privileged mode, on platforms that have one. */
+    privilege_password?: Secret;
+};
+/** A DHCP server for one network. */
+export type DhcpServer<I extends string> = {
+    /** Where it answers. */
+    interface: I;
+    /** The network it serves. */
+    network: Prefix;
+    /** Default gateway handed out. */
+    gateway: IP;
+    /** Resolvers handed out. */
+    dns?: readonly IP[];
+    /** First and last address handed out. */
+    pool: readonly [IP, IP];
+    /** Seconds a lease lasts. */
+    lease_time?: number;
+    /** Addresses fixed to a MAC. */
+    reservations?: readonly {
+        address: IP;
+        mac: string;
+        /** Whose address it is. */
+        description?: string;
+    }[];
+};
+/** Forward DHCP requests heard on an interface to servers elsewhere. */
+export type DhcpRelay<I extends string> = {
+    /** Where requests are heard. */
+    interface: I;
+    /** Where they are forwarded. */
+    servers: readonly IP[];
+};
+/** A certificate the device presents or trusts. */
+export type Certificate = {
+    /** The certificate, PEM. Public, so it lives in the repository. */
+    certificate: string;
+    /** Its private key: a PEM file through `secretFile`, or PEM base64-encoded as one line through `secret`. A certificate only trusted, such as a CA, has none. */
+    private_key?: Secret;
+};
+/** Export flow records or packet samples to collectors. */
+export type FlowExport<I extends string> = {
+    /** The record format. */
+    protocol: "sflow" | "netflow-v9" | "ipfix";
+    /** Where records are sent. */
+    collectors: readonly {
+        address: IP;
+        /** UDP port. 6343 for sFlow and 2055 otherwise when absent. */
+        port?: number;
+    }[];
+    /** Sample one packet in this many. Every packet when absent, on a platform that can export every packet. */
+    sampling?: number;
+    /** Where traffic is observed. Every interface when absent. */
+    interfaces?: readonly I[];
+};

package/dist/types/transport/ssh.d.ts

@@ -0,0 +1,22 @@
+import { Client, type ClientChannel } from "ssh2";
+export type Login = {
+    host: string;
+    port?: number;
+    user: string;
+    password: string;
+    /** Host key algorithms to accept, for a device that negotiates one it then signs wrongly. */
+    hostKeys?: string[];
+};
+/** Open a session. */
+export declare function connect(login: Login): Promise<Client>;
+/** Run one command and return what it printed, stderr included. */
+export declare function exec(client: Client, command: string, timeout?: number): Promise<string>;
+/** An interactive shell, for platforms that take configuration only there. */
+export declare function shell(client: Client, columns?: number, rows?: number): Promise<ClientChannel>;
+/** Collect output until `done` holds, then wait `settle` for stragglers, or give up at `timeout`. */
+export declare function readUntil(channel: ClientChannel, done: (output: string) => boolean, timeout: number, settle?: number): Promise<string>;
+/** Send one line into an interactive shell and collect output until it goes quiet for `settle`. */
+export declare function send(channel: ClientChannel, line: string, timeout?: number, settle?: number): Promise<string>;
+export declare const sleep: (milliseconds: number) => Promise<unknown>;
+/** Write a file to the device over SFTP. */
+export declare function upload(client: Client, path: string, content: string | Buffer): Promise<void>;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.8.0",
+    "version": "0.10.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",
@@ -39,19 +39,29 @@
     ],
     "type": "module",
     "exports": {
-        ".": "./src/index.ts",
-        "./presets": "./src/presets/index.ts"
+        ".": {
+            "types": "./dist/types/index.d.ts",
+            "bun": "./src/index.ts",
+            "default": "./dist/index.js"
+        },
+        "./presets": {
+            "types": "./dist/types/presets/index.d.ts",
+            "bun": "./src/presets/index.ts",
+            "default": "./dist/presets/index.js"
+        }
     },
     "bin": {
-        "circuit": "src/cli/index.ts"
+        "circuit": "dist/cli/index.js"
     },
     "files": [
         "src",
+        "dist",
         "templates",
         "LICENSE",
         "README.md"
     ],
     "engines": {
+        "node": ">=20.12",
         "bun": ">=1.3.5"
     },
     "publishConfig": {
@@ -60,22 +70,26 @@
     "scripts": {
         "typecheck": "bunx tsc --noEmit",
         "test": "bun test",
+        "build": "bun scripts/build.ts",
         "format": "bunx prettier --write .",
         "format:check": "bunx prettier --check .",
         "docs:dev": "bun scripts/schema-reference.ts && vitepress dev docs",
         "docs:build": "bun scripts/schema-reference.ts && vitepress build docs",
         "docs:preview": "vitepress preview docs",
         "release": "bun scripts/release.ts",
-        "prepare": "husky || true"
+        "prepare": "husky || true",
+        "prepack": "bun run build"
     },
     "dependencies": {
         "@types/ssh2": "^1.15.6",
+        "jiti": "^2.7.0",
         "ssh2": "^1.17.0"
     },
     "devDependencies": {
         "@commitlint/cli": "^19.5.0",
         "@commitlint/config-conventional": "^19.5.0",
         "@types/bun": "^1.4.2",
+        "@types/node": "^24",
         "husky": "^9.1.6",
         "prettier": "^3.9.9",
         "typescript": "^7.0.2",

package/src/adapters/devices/routeros/TRAPS.md

@@ -31,3 +31,5 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - `:find` on an array returns a number or `nil`. Globals persist between exec commands of one login.
 - A fixed port speed is named by medium, `speed=10G-baseSR-LR` for an optic or `speed=1G-baseT-full` for copper, and only holds with `auto-negotiation=no`. With auto-negotiation back on, the export no longer prints the speed, so the plan resets only auto-negotiation. `speed=""` is refused as ambiguous and `unset speed` does not exist.
 - `bgp-path-len` counts every AS in the path, prepends included, and takes the same strict comparisons as `dst-len`.
+- `:parse` checks the command, not the text inside `rule=`. A routing filter rule is only checked when it is added.
+- `/routing/filter/filter-wizard` adds the rule it builds; it is not a dry run. `set blackhole yes` was proved this way on 7.23, in an unused chain removed right after.

package/src/adapters/devices/routeros/render.ts

@@ -1006,6 +1006,7 @@ function actions(rule: AnyRule, family: Family): string[] {
     // An address only means something to routes of its own family.
     if (set.next_hop && familyOf(set.next_hop) === family) steps.push(`set gw ${set.next_hop}`);
     if (set.preferred_source && familyOf(set.preferred_source) === family) steps.push(`set pref-src ${set.preferred_source}`);
+    if (set.blackhole) steps.push("set blackhole yes");
     if (rule.action) steps.push(rule.action);
     return steps;
 }