component/

Package all blank-imports every AAA backend so their init() functions fire and aaa.Default contains the backend factories.

Package cmd registers engine-side RPC handlers for the AAA component's CLI surface.

Design: docs/architecture/api/architecture.md -- gRPC API transport

Package yang embeds and registers the gRPC transport YANG configuration module.

Design: docs/architecture/api/architecture.md -- REST API transport Related: auth.go -- the per-request credential gate and the reload seam that replaces it

Package yang embeds and registers the REST transport YANG configuration module.

Package yang embeds and registers the API YANG configuration module.

Package yang embeds and registers the authorization YANG configuration module.

Package api defines the BFD engine's client-facing service interface for requesting sessions and receiving state changes.

Package auth implements BFD packet authentication signers and verifiers per RFC 5880.

Design: docs/architecture/bfd.md -- BFD CLI handlers

Design: rfc/short/rfc5880.md -- Echo Function (Section 6.4) Related: loop.go -- express-loop goroutine that drains the echo RX channel Related: ../packet/echo.go -- ZEEC envelope codec Related: ../session/timers.go -- EchoInterval / NextEchoTxDeadline / AdvanceEcho

Design: rfc/short/rfc5880.md -- Authentication Section (Section 4.2-4.4) Related: control.go -- 24-byte mandatory section codec

Design: rfc/short/rfc5880.md -- Section 6.7 (authentication integration) Related: session.go -- Machine state and identity Related: fsm.go -- reception procedure that drives Verify

Design: rfc/short/rfc5881.md -- single-hop UDP encapsulation Design: rfc/short/rfc5883.md -- multi-hop UDP encapsulation Related: udp.go -- IPv4 UDP transport wrapped by Dual Related: socket.go -- Transport interface contract

Package yang embeds and registers the BFD YANG configuration and command modules.

Package attrpool provides refcounted, deduplicating attribute pools for BGP path attributes.

Package blackholecfg reads the per-peer `blackhole` container of a BGP config subtree.

Design: docs/architecture/core-design.md — BGP CLI commands Detail: cmd_plugin.go — plugin CLI simulator subcommand

Package yang embeds and registers the BGP tools CLI command YANG module.

Package bgpconfig converts BGP configuration trees into peer definitions and route attributes.

Package configjson provides shared helpers for traversing BGP config JSON delivered to plugins at Stage 2 (configure callback).

Package filter implements BGP route filtering based on attribute matching rules.

Design: docs/architecture/bgp/fanout-dedup.md -- fingerprint the edit set, confirm by equality Overview: filterapi.go -- ModAccumulator, whose state this encodes Related: editset.go -- the rebuild plan the digest predicts the output of

Package filtertext reads one attribute out of the policy filter text format.

Package format provides JSON and text formatting of BGP messages directly from wire bytes.

Package fsm implements the BGP Finite State Machine per RFC 4271 Section 8, managing peer state transitions, timers, and session lifecycle events.

Design: docs/architecture/core-design.md -- GR restart marker for Restarting Speaker detection

Design: docs/architecture/wire/messages.md — BGP message types Related: update_build.go — UPDATE builder infrastructure

Design: docs/architecture/plugin/rib-storage-design.md — Adj-RIB-In raw hex storage RFC: rfc/short/rfc4271.md -- Adj-RIBs-In stores unprocessed routing information Detail: rib_commands.go — command handlers (status, show, replay, validation) Detail: rib_validation.go — RPKI validation gate (pending routes, timeout, state constants)

Package yang embeds and registers the adj-rib-in API YANG module.

Design: (none -- predates documentation) RFC: rfc/short/rfc7311.md

Design: docs/architecture/core-design.md -- BGP plugin model

Package yang embeds and registers the BMP command and configuration YANG modules.

Package announce implements the on-demand BGP route origination command handlers.

Package yang embeds and registers the BGP announce command and API YANG modules.

Package cache implements the BGP cache operation command handlers.

Package yang embeds and registers the YANG schema modules for the cache command.

Package commit implements the BGP commit command that manages named route commit transactions.

Package yang embeds and registers the YANG schema modules for the commit command.

Design: docs/architecture/api/commands.md — BGP monitor command handlers

Package yang embeds and registers the YANG schema modules for the monitor command.

Package peer provides BGP peer lifecycle and introspection command handlers for the plugin server.

Package yang embeds and registers the YANG schema modules for the peer command.

Package policy implements the show policy commands that inspect policy chains and dry-run policy evaluation.

Package yang embeds and registers the YANG schema module for the policy command.

Design: docs/architecture/api/commands.md — BGP raw message command handler

Package yang embeds and registers the YANG schema modules for the raw command.

Design: docs/architecture/api/commands.md — RIB CLI proxy handlers

Package yang embeds and registers the YANG schema modules for the rib command.

Design: docs/architecture/bgp/replay-cursor.md -- stateful cursor for replay batching Overview: update_text.go — handleUpdate dispatch, parsedAttrs, snapshot, parseCommonAttributeText Related: update_text_nlri.go — parseNLRISection (reused unchanged)

Package yang embeds and registers the YANG schema modules for the update command.

Design: docs/architecture/core-design.md -- AS-path filter config parsing Related: match.go -- AS-path regex matching algorithm Related: filter_aspath.go -- SDK entry point and handleFilterUpdate

Package yang embeds and registers the YANG schema module for the aspath filter.

Package yang embeds and registers the YANG schema module for the aspath-length filter.

Package filter_community implements the bgp-filter-community plugin.

Package yang embeds and registers the community-filter plugin's YANG configuration schema module.

Design: docs/architecture/core-design.md -- community match filter config parsing Related: match.go -- community matching algorithm Related: filter_community_match.go -- SDK entry point and handleFilterUpdate

Package yang embeds and registers the YANG schema module for the community-match filter.

Design: docs/architecture/core-design.md -- address-family policy filter Related: config.go -- bgp/policy/family-filter config parsing + tear-down-in-export guard Related: match.go -- family extraction from the raw UPDATE body Related: handler.go -- per-update remove / tear-down decision RFC: rfc/short/rfc4760.md -- multiprotocol families (Section 6) RFC: rfc/short/rfc4271.md -- NOTIFICATION + session close (Section 6)

Package yang embeds and registers the family-filter plugin's YANG configuration schema module.

Package yang embeds and registers the IRR-filter plugin's YANG configuration schema modules.

Design: docs/architecture/core-design.md -- route modify filter config parsing Related: modify.go -- delta building and attribute encoding Related: filter_modify.go -- SDK entry point and handleFilterUpdate

Package yang embeds and registers the modify-filter plugin's YANG configuration schema module.

Design: docs/architecture/core-design.md -- prefix-list filter plugin Detail: match.go -- prefix matching algorithm and update evaluator Detail: config.go -- bgp/policy/prefix-list config parsing

Package yang embeds and registers the prefix-filter plugin's YANG configuration schema module.

Package yang embeds and registers the remove-private-AS filter plugin's YANG configuration schema module.

Design: docs/architecture/core-design.md — graceful restart plugin RFC: rfc/short/rfc4724.md RFC: rfc/short/rfc9494.md Detail: gr_state.go — GR state machine (per-peer timers, stale family tracking) Detail: gr_llgr.go — LLGR capability decode, config extraction, CLI decode (RFC 9494)

Package yang embeds and registers the graceful-restart plugin's YANG configuration schema module.

Design: docs/architecture/bgp/healthcheck-plugin.md -- healthcheck config parsing Overview: healthcheck.go -- plugin lifecycle and probe management

Package yang embeds and registers the healthcheck plugin's YANG configuration schema module.

Design: docs/architecture/core-design.md — hostname capability plugin

Package yang embeds and registers the hostname plugin's YANG configuration schema module.

Design: docs/architecture/core-design.md — link-local next-hop plugin RFC: rfc/short/rfc5549.md

Package yang embeds and registers the link-local-nexthop plugin's YANG configuration schema module.

Design: docs/architecture/wire/nlri-evpn.md — EVPN NLRI plugin RFC: rfc/short/rfc7432.md

Design: docs/architecture/wire/nlri-flowspec.md — FlowSpec NLRI plugin RFC: rfc/short/rfc5575.md Detail: plugin_decode.go — wire-to-JSON decoding and formatting Detail: plugin_encode_text.go — text-to-wire encoding Detail: plugin_protocol.go — stdin/stdout protocol dispatch

Design: docs/architecture/wire/nlri.md — labeled unicast NLRI plugin RFC: rfc/short/rfc8277.md

Design: docs/architecture/wire/nlri-bgpls.md — BGP-LS attribute TLV framework RFC: rfc/short/rfc7752.md — BGP-LS attribute type 29 TLV format Overview: types.go — core types, TLV constants, and helper functions Detail: attr_node.go — node attribute TLV types Detail: attr_link.go — link attribute TLV types Detail: attr_prefix.go — prefix attribute TLV types Detail: attr_srv6.go — SRv6 attribute TLV types Detail: register_attr.go — attribute TLV registration

Design: docs/architecture/wire/nlri.md — MUP NLRI prefix encoding helpers RFC: rfc/short/draft-ietf-bess-mup-safi.md — MUP SAFI encoding

Design: docs/architecture/wire/nlri.md — MVPN NLRI plugin

Design: docs/architecture/wire/nlri.md — route target constraint plugin RFC: rfc/short/rfc4684.md

Design: docs/architecture/wire/nlri.md -- SR-Policy NLRI plugin RFC: rfc/short/rfc9830.md -- SR-Policy NLRI wire format (SAFI 73)

Design: docs/architecture/wire/nlri.md — VPLS NLRI plugin RFC: rfc/short/rfc4761.md

Design: docs/architecture/wire/nlri.md — VPN NLRI plugin RFC: rfc/short/rfc4364.md

Design: docs/architecture/plugin/rib-storage-design.md — best-path selection Overview: rib.go — RIB plugin core types and event handlers Related: rib_attr_format.go — attribute formatting (asPathLength, firstASInPath shared concern) Related: rib_commands.go — extractCandidate, gatherCandidates Related: rib_pipeline_best.go — best-path pipeline for show bgp rib best commands Related: rib_bestchange.go — best-path change tracking and Bus publishing

Package pool holds the per-attribute-type BGP path-attribute pools used for fine-grained RIB deduplication.

Package storage implements the per-peer, per-family RIB storage with per-attribute-type deduplication.

Package yang embeds and registers the BGP RIB YANG schema modules.

Design: docs/architecture/core-design.md — BGP role plugin RFC: rfc/short/rfc9234.md Detail: otc.go — OTC attribute processing (ingress/egress) Detail: config.go — per-peer role config parsing (import/export)

Package yang embeds and registers the BGP role YANG schema module.

Design: docs/architecture/core-design.md — route refresh capability plugin RFC: rfc/short/rfc2918.md — route refresh capability RFC: rfc/short/rfc7313.md — enhanced route refresh

Design: docs/architecture/api/commands.md — BGP route refresh command handlers Overview: ../register.go — bgp-route-refresh SDK plugin registration

Package yang embeds and registers the BGP route-refresh YANG schema modules.

Design: docs/architecture/plugin/rib-storage-design.md -- ASPA record cache Overview: rpki.go -- plugin using this cache for ASPA path verification Related: roa_cache.go -- ROA cache following the same pattern

Package yang embeds and registers the RPKI YANG schema module.

Package rpki_decorator provides the bgp-rpki-decorator plugin.

Package yang embeds and registers the RPKI decorator YANG schema module.

Package yang embeds and registers the BGP route-reflector command YANG schema module.

Package yang embeds and registers the BGP route-server configuration YANG schema module.

Design: docs/architecture/core-design.md — software-version capability plugin

Package yang embeds and registers the BGP software-version capability YANG schema module.

Design: docs/architecture/rib-transition.md — watchdog plugin extraction Detail: server.go — command dispatch and state management Detail: config.go — config tree parser Detail: pool.go — route pool management

Package reactor implements the BGP reactor event loop, managing peer sessions, processing wire events, and dispatching messages to plugins.

Design: docs/architecture/core-design.md — route loop detection ingress filter RFC: rfc/short/rfc4271.md RFC: rfc/short/rfc4456.md

Package yang embeds and registers the BGP loop-detection filter YANG schema module.

Package redistribute bridges BGP RIB best-path changes into the generic redistribution subsystem and injects redistributed routes back as BGP updates.

Package rib implements the BGP Routing Information Base with per-attribute-type deduplication.

Package route parses text-format BGP route definitions into wire-ready attributes and NLRI.

Package server provides BGP-specific event delivery and dispatch for the plugin server.

Package textparse provides a zero-allocation tokenizer and keyword resolution for BGP text commands.

Package transaction manages named BGP commits that queue route announcements and withdrawals until they are ended or rolled back.

Package types defines shared BGP-specific types for routes, next-hops, and reactor interfaces.

Package wireu ("wire UPDATE") implements lazy-parsed BGP UPDATE messages with zero-copy iterators over wire bytes.

Package schema embeds the YANG schemas for BGP configuration and API.

Design: docs/architecture/core-design.md — interactive CLI Related: ../../../../cmd/ze/internal/cmdutil/cmdutil.go — shared command utilities (uses BuildCommandTree)

Design: docs/architecture/core-design.md -- component boundaries (cli/contract)

Design: docs/architecture/config/yang-config-design.md — editor test infrastructure

Design: docs/architecture/api/commands.md -- clear verb (generic verb shell)

Package yang embeds and registers the CLI clear command YANG schema modules.

Design: docs/architecture/api/commands.md — delete verb command handlers

Package yang embeds and registers the CLI delete command YANG schema modules.

Design: docs/architecture/api/commands.md — BGP log level command handlers

Package yang embeds and registers the BGP log command YANG schema modules.

Design: docs/architecture/api/commands.md — BGP command discovery and plugin configuration

Package yang embeds and registers the BGP meta command YANG schema modules.

Design: docs/architecture/api/commands.md — BGP metrics command handlers

Package yang embeds and registers the BGP metrics command YANG schema modules.

Design: docs/architecture/api/commands.md — monitor verb root (unowned)

Package yang embeds and registers the CLI monitor command YANG module.

Design: docs/architecture/api/commands.md — set verb command handlers

Package yang embeds and registers the CLI set command and API YANG modules.

Design: docs/architecture/api/commands.md -- show verb command handlers

Package yang embeds and registers the CLI show command and API YANG modules.

Design: docs/architecture/api/commands.md — BGP event subscription handlers

Package yang embeds and registers the CLI subscribe command and API YANG modules.

Design: docs/architecture/api/commands.md — update verb command handlers

Package yang embeds and registers the CLI update command and API YANG modules.

Design: docs/architecture/cli/command-namespacing.md -- CLI command grammar

Package registry holds the process-wide registries for ze's command-line surface: offline local handlers, top-level root commands, and owner-backed root command handlers.

Package archive saves committed configuration to file and HTTP locations on commit, manual, and scheduled triggers.

Package cmd handles the config archive trigger command that archives the running configuration.

Package yang embeds and registers the config archive API YANG module.

Design: docs/architecture/config/yang-config-design.md — config claim model Related: schema.go -- builds the merged config-schema tree Audit walks Related: allowlist.json -- recorded exceptions, one reason and one owner each

Design: docs/architecture/config/syntax.md — stdin ("-") wiring for config editor commands Overview: main.go — dispatch and exit codes

Design: docs/architecture/config/environment.md — environment variable handling

Package infra holds the always-on daemon-startup contract between the hub and whichever routing engine constructs a reactor.

Package migration rewrites deprecated configuration syntax into its current equivalent.

Package redistribute moves routes between routing protocols with origin-based loop prevention.

Package yang embeds and registers the redistribute configuration YANG module.

Design: docs/architecture/config/yang-config-design.md — schema CLI

Design: docs/architecture/config/syntax.md — sensitive value encoding

Design: docs/architecture/zefs-format.md -- config storage abstraction Detail: blob.go -- blob storage implementation wrapping zefs

Design: docs/architecture/zefs-format.md -- ZeFS blob store CLI

Package system manages system-wide configuration including identity, DNS, console, connection tracking, and self-update.

Package yang embeds and registers the system configuration YANG module.

Package transaction implements the stream-based config transaction protocol.

Package events defines event constants for config transactions.

Design: docs/architecture/config/yang-config-design.md — YANG schema handling

Design: docs/architecture/config/yang-config-design.md -- YANG analysis tool Related: tree.go -- unified analysis tree builder Related: format.go -- output formatting for collisions and trees

Package yang registers debug YANG modules and validates debug flag and scope names against them.

Package cmd handles the show doctor command that runs system and plugin diagnostic checks.

Package yang embeds and registers the doctor command YANG module.

Package firewall provides the ze firewall subcommand for viewing nftables firewall state (tables, chains, rules, counters).

Package cmd provides formatting functions for firewall CLI output.

Design: docs/architecture/firewall/firewall-irr.md -- firewall IRR plugin entry point Related: doctor.go -- the ze doctor check over the same references verifyRefs guards

Package yang embeds and registers the firewall IRR command and schema YANG modules.

Package yang embeds and registers the firewall component's YANG schema modules.

Package yang embeds and registers the gNMI component's YANG schema module.

Package yang embeds and registers the hub component's YANG schema module.

Design: docs/architecture/iface/management.md -- Interface CLI commands

Design: docs/features/interfaces.md — Interface RPC handlers for daemon dispatch Related: manage.go — command registration and server wiring for this package

Package yang embeds and registers the interface component's YANG schema modules.

Package cmd registers the IPsec VPN operational command handlers.

Package crypto implements the IKEv2 cryptographic primitives and proposal negotiation.

Package dataplane abstracts installation of IPsec security associations and policies across xfrm and VPP backends.

Package eap implements the EAP authentication framework and its MSCHAPv2 and TLS methods for IKEv2.

Design: docs/architecture/ike/ipsec-7-ikev2-engine.md -- AUTH payload computation Related: remote_id.go -- remote identity policy and certificate binding Detail: cert_payload.go -- CERT payload assembly, the received-chain bound, Hash and URL RFC: rfc/short/rfc7296.md -- Authentication of the IKE SA (Section 2.15) RFC: rfc/short/rfc7427.md -- Digital Signature AUTH method 14

Package ipsec defines the IPsec data model types and parses their configuration.

Package yang embeds and registers the IPsec configuration YANG schema module.

Package transport implements the IKE UDP transport with NAT detection and keepalive handling.

Design: docs/architecture/wire/buffer-writer.md -- payload chain parsing RFC: rfc/short/rfc7296.md -- encrypted payload contents (Section 3.14)

Package yang embeds and registers the IPsec operational command YANG schema module.

Design: docs/architecture/core-design.md -- l2tp offline CLI

Design: docs/guide/l2tp.md -- L2TP CLI handlers

Package yang embeds and registers the L2TP operational command YANG schema module.

Package events defines the typed EventBus handle for L2TP subscriber route-change events.

Package yang embeds and registers the L2TP local authentication YANG schema module.

Package yang embeds and registers the L2TP RADIUS authentication YANG schema module.

Package yang embeds and registers the L2TP address pool YANG schema module.

Package yang embeds and registers the L2TP shaper configuration YANG module.

Package ppp implements the PPP control plane (LCP, authentication, IPCP, IPv6CP) over chan/unit file descriptors obtained from /dev/ppp.

Package pppoe implements the PPPoE (RFC 2516) access concentrator for subscriber session management over Ethernet.

Design: docs/architecture/l2tp/bng-5-pppoe.md -- PPPoE CLI handlers

Package yang embeds and registers the PPPoE command YANG module.

Package yang embeds and registers the PPPoE API and configuration YANG modules.

Package pppoeclient implements a PPPoE client dialer that performs RFC 2516 discovery and kernel session setup.

Package subscriber provides the shared subscriber session model, registry, and metrics for PPPoE and L2TP access.

Package cmd registers the show subscriber CLI RPC handlers.

Package yang embeds and registers the subscriber command YANG module.

Package events defines the subscriber session event namespace and payloads.

Package yang embeds and registers the L2TP API and configuration YANG modules.

Package yang embeds and registers the looking-glass configuration YANG module.

Package yang embeds and registers the MCP configuration YANG module.

Package cmd owns the entire ping feature surface as a dedicated feature module (see ai/rules/plugins.md "Dedicated feature modules").

Package yang embeds and registers the PKI API and configuration YANG modules.

Package all imports all internal plugins and schema packages, triggering their init() registration.

Design: docs/architecture/cli/plugin-modes.md — plugin CLI framework

Package doctor registers a diagnostic check that verifies configured plugin binaries are present.

Package ipc provides Unix socket pairs and typed RPC for engine-plugin communication.

Package plugin implements the PluginManager for plugin registration, lifecycle, and capabilities.

Package process manages plugin process lifecycle, respawn, and event delivery pipelines.

Package registry provides compile-time plugin registration and query for CLI dispatch, engine startup, and decode routing.

Package server manages plugin process connections, the 5-stage startup protocol, and command dispatch.

Package schema embeds the YANG schema for plugin configuration.

Package yang embeds the radius component's YANG configuration schema and registers it with the config module registry.

Design: docs/architecture/resolve.md -- Shared TTL cache for resolution components

Design: docs/architecture/resolve.md -- Team Cymru ASN resolution CLI

Design: docs/architecture/resolve.md -- resolve command handlers for dispatcher

Design: docs/architecture/resolve.md -- Team Cymru ASN name resolution Related: ../dns/resolver.go -- DNS resolver used for TXT queries

Package dns provides a DNS resolver component for Ze.

Design: (none -- predates documentation)

Design: docs/architecture/resolve.md -- shared IRR prefix resolution + persistence

Design: docs/architecture/resolve.md -- PeeringDB client for prefix update

Package yang embeds and registers the resolver API YANG module.

Package yang embeds and registers the SSH configuration YANG module.

Package yang embeds the storage component's YANG configuration schema and registers it with the config module registry.

Design: docs/architecture/core-design.md -- sysctl offline CLI

Package events defines event constants for the sysctl plugin.

Package yang embeds the sysctl component's YANG configuration schema and registers it with the config module registry.

Package events defines event constants and typed event handles for the system RIB plugin.

Package yang embeds the sysrib component's YANG configuration schema and registers it with the config module registry.

Design: docs/architecture/aaa-tacacs.md -- TACACS+ AAA operational CLI

Package yang embeds the tacacs component's YANG configuration schema and registers it with the config module registry.

Package collector reads Netdata-compatible OS metrics from procfs and sysfs and feeds them into the shared metrics registry.

Package yang embeds the telemetry exporter's YANG configuration schema and registers it with the config module registry.

Package cmd owns the entire traceroute feature surface as a dedicated feature module (see ai/rules/plugins.md "Dedicated feature modules").

Package tc provides the ze traffic control subcommand for viewing tc qdisc, class, and filter state on network interfaces.

Package cmd provides formatting functions for traffic control CLI output.

Package yang embeds the traffic component's YANG configuration schema and registers it with the config module registry.

Package cmd registers the show traffic feature CLI handler that surfaces neutral per-source feature signals.

Package yang embeds the traffic-feature command's YANG schema and registers it with the config module registry.

Package cmd registers the show and monitor traffic stat CLI handlers.

Package yang embeds the traffic-stat command's YANG schema and registers it with the config module registry.

Package yang embeds the vpp component's YANG configuration schema and registers it with the config module registry.

Design: docs/architecture/testing/ci-format.md -- web browser test parser Related: runner.go -- .wb test execution and browser control Related: expect.go -- expectation checking

Package yang embeds the web component's YANG configuration schema and registers it with the config module registry.