@isothrum/editor 0.0.0-stage → 0.1.0

package/src/lib/tool/model.test.ts

@@ -0,0 +1,128 @@
+import { describe, expect, test } from "vitest";
+import {
+  APPLIANCES,
+  LAN_H,
+  LAN_W,
+  MACHINE_H,
+  MACHINE_W,
+  ROUTER_H,
+  ROUTER_W,
+  SWITCH_H,
+  SWITCH_W,
+  applianceInterface,
+  centerOf,
+  cleanName,
+  freeName,
+  idleByDefault,
+  imageName,
+  isAppliance,
+  isRealRouter,
+  nodeName,
+  sizeOf,
+  uid,
+  unselected,
+} from "./model";
+import { autoRouter, lan, machine, note, realRouter, switchNode } from "@/test/lab";
+
+describe("applianceInterface", () => {
+  test("numbers IOL interfaces four to a slot", () => {
+    expect([1, 3, 4, 5].map((k) => applianceInterface("cisco-iol", k))).toEqual(["Ethernet0/1", "Ethernet0/3", "Ethernet1/0", "Ethernet1/1"]);
+    expect(applianceInterface("cisco-iol-l2", 4)).toBe("Ethernet1/0");
+  });
+
+  test("numbers IOSv interfaces on slot 0", () => {
+    expect(applianceInterface("cisco-vios", 2)).toBe("GigabitEthernet0/2");
+    expect(applianceInterface("cisco-vios-l2", 1)).toBe("GigabitEthernet0/1");
+  });
+
+  test("numbers IOS XE interfaces from 2 (GigabitEthernet1 is management)", () => {
+    expect(applianceInterface("cisco-csr1000v", 1)).toBe("GigabitEthernet2");
+    expect(applianceInterface("cisco-c8000v", 3)).toBe("GigabitEthernet4");
+  });
+
+  test("numbers Dynamips interfaces two to a slot, the first on slot 0", () => {
+    expect([1, 2, 3, 4].map((k) => applianceInterface("cisco-dynamips", k))).toEqual(["FastEthernet0/0", "FastEthernet1/0", "FastEthernet1/1", "FastEthernet2/0"]);
+  });
+
+  test("gives every Cisco OS an image except Dynamips, which Isoloom builds", () => {
+    expect(APPLIANCES.filter((a) => !a.image).map((a) => a.id)).toEqual(["cisco-dynamips"]);
+  });
+});
+
+describe("images", () => {
+  test("names an image by its last path segment, without tag, in lowercase", () => {
+    expect(imageName(" Docker.io/Library/Nginx:1.27 ")).toBe("nginx");
+  });
+
+  test("keeps stock Linux images running idle, not service images", () => {
+    expect(["alpine", "x/ubuntu:22", " Debian:12", "nicolaka/netshoot"].map(idleByDefault)).toEqual([true, true, true, true]);
+    expect(["nginx", "postgres:16", ""].map(idleByDefault)).toEqual([false, false, false]);
+  });
+});
+
+describe("kinds of node", () => {
+  test("a router you configure is a real router; the automatic one is not", () => {
+    expect(isRealRouter(realRouter("frr"))).toBe(true);
+    expect(isRealRouter(autoRouter("r"))).toBe(false);
+  });
+
+  test("routers and firewalls are appliances; servers are not", () => {
+    expect(isAppliance(autoRouter("r"))).toBe(true);
+    expect(isAppliance(machine("fw", { icon: "shield" }))).toBe(true);
+    expect(isAppliance(machine("web", { icon: "server" }))).toBe(false);
+  });
+
+  test("names a note 'note' and anything else by its name", () => {
+    expect(nodeName(note("n1"))).toBe("note");
+    expect(nodeName(lan("l1", { name: "office" }))).toBe("office");
+  });
+});
+
+describe("sizeOf", () => {
+  test("sizes a LAN by its own width and height, or the default area", () => {
+    expect(sizeOf(lan("l", {}, { w: 500, h: 200 }))).toEqual({ w: 500, h: 200 });
+    expect(sizeOf({ ...lan("l"), width: undefined, height: undefined })).toEqual({ w: LAN_W, h: LAN_H });
+  });
+
+  test("sizes switches, real routers and machines by their faceplate or box", () => {
+    expect(sizeOf(switchNode("sw"))).toEqual({ w: SWITCH_W, h: SWITCH_H });
+    expect(sizeOf(realRouter("frr"))).toEqual({ w: ROUTER_W, h: ROUTER_H });
+    expect(sizeOf(autoRouter("r"))).toEqual({ w: MACHINE_W, h: MACHINE_H });
+  });
+
+  test("sizes a note by its own size, 200 by 90 when it has none", () => {
+    expect(sizeOf({ ...note("n"), width: undefined, height: undefined })).toEqual({ w: 200, h: 90 });
+  });
+});
+
+describe("centerOf", () => {
+  test("uses the node's width, then its measured size, then the fallback", () => {
+    expect(centerOf(lan("l", {}, { x: 10, y: 20, w: 100, h: 50 }))).toEqual({ x: 60, y: 45 });
+    expect(centerOf({ ...machine("m"), measured: { width: 40, height: 20 } })).toEqual({ x: 20, y: 10 });
+    expect(centerOf(machine("m"), { w: 10, h: 10 })).toEqual({ x: 5, y: 5 });
+  });
+});
+
+describe("names", () => {
+  test("cleans a name into an Isoloom key: lowercase letters, digits and dashes", () => {
+    expect(cleanName("Web 1")).toBe("web1");
+    expect(cleanName("ÉA_b-c")).toBe("ab-c");
+  });
+
+  test("gives the first number no machine or LAN uses", () => {
+    const nodes = [machine("a", { name: "web1" }), lan("b", { name: "web2" }), machine("c", { name: "web4" })];
+    expect(freeName("web", nodes)).toBe("web3");
+    expect(freeName("db", nodes)).toBe("db1");
+  });
+
+  test("makes ids with their prefix, different each time", () => {
+    const [a, b] = [uid("m"), uid("m")];
+    expect(a).toMatch(/^m-[a-z0-9]+$/);
+    expect(a).not.toBe(b);
+  });
+});
+
+test("unselected clears the selection of every node", () => {
+  const nodes = [{ ...machine("a"), selected: true }, lan("b")];
+  expect(unselected(nodes).map((n) => n.selected)).toEqual([false, false]);
+});

package/src/lib/tool/model.ts

@@ -0,0 +1,238 @@
+import type { Edge, Node, XYPosition } from "@xyflow/react";
+
+/**
+ * The lab as drawn on the canvas: machines, LANs, switches and notes are nodes, cables are edges
+ * between two ports. `toTopology` translates it into the topology JSON the engine reads
+ * (`isothrum_compiler::Topology`), which it compiles to Isoloom's isoloom.yml.
+ */
+
+export type IconId = "container" | "server" | "router" | "shield" | "monitor" | "laptop";
+
+/** The Cisco OSes a container node can be (Isoloom's `app.appliance`). */
+export type Appliance = "cisco-iol" | "cisco-iol-l2" | "cisco-vios" | "cisco-vios-l2" | "cisco-csr1000v" | "cisco-c8000v" | "cisco-dynamips";
+
+/** Each Cisco OS: its usual vrnetlab image (none for Dynamips: Isoloom builds the emulator). */
+export const APPLIANCES: { id: Appliance; label: string; image: string; switch?: boolean; kvm?: boolean }[] = [
+  { id: "cisco-iol", label: "IOL (IOS on Linux)", image: "vrnetlab/cisco_iol:17.12.01" },
+  { id: "cisco-iol-l2", label: "IOL-L2 (switch)", image: "vrnetlab/cisco_iol:L2-17.12.01", switch: true },
+  { id: "cisco-vios", label: "IOSv", image: "vrnetlab/cisco_vios:15.9.3M6", kvm: true },
+  { id: "cisco-vios-l2", label: "IOSvL2 (switch)", image: "vrnetlab/cisco_viosl2:15.2", switch: true, kvm: true },
+  { id: "cisco-csr1000v", label: "CSR1000v (IOS XE)", image: "vrnetlab/cisco_csr1000v:17.03.08", kvm: true },
+  { id: "cisco-c8000v", label: "Catalyst 8000v (IOS XE)", image: "vrnetlab/cisco_c8000v:17.15.01a", kvm: true },
+  { id: "cisco-dynamips", label: "Dynamips 7200 (classic IOS)", image: "" },
+];
+
+/** The OS's name for the `k`th data interface (from 1), as Isoloom numbers them. */
+export function applianceInterface(kind: Appliance, k: number): string {
+  switch (kind) {
+    case "cisco-iol":
+    case "cisco-iol-l2":
+      return `Ethernet${String(Math.floor(k / 4))}/${String(k % 4)}`;
+    case "cisco-vios":
+    case "cisco-vios-l2":
+      return `GigabitEthernet0/${String(k)}`;
+    case "cisco-csr1000v":
+    case "cisco-c8000v":
+      return `GigabitEthernet${String(k + 1)}`;
+    case "cisco-dynamips":
+      return k === 1 ? "FastEthernet0/0" : `FastEthernet${String(Math.floor(k / 2))}/${String(k % 2)}`;
+  }
+}
+
+export type MachineData = {
+  name: string;
+  /** "router": an automatic router, not a machine (its networks reach each other). */
+  kind: "container" | "vm" | "router";
+  icon: IconId;
+  /** Container image (`kind: container`): Isoloom's `app.image`. */
+  image: string;
+  /** The OS, as Isoloom writes it (`debian@12`, see `OS_CHOICES`) (`kind: vm`): Isoloom's `os`. */
+  os: string;
+  /** Provisioning steps, one per line (`kind: vm`): Isoloom's `app.steps`. */
+  provision: string;
+  /** Service ports, comma-separated, each a port and what it speaks when it isn't TCP (`80, 53/udp`): see `readPorts`. */
+  ports: string;
+  /** The machine the user lands on. */
+  access: boolean;
+  /**
+   * A container with no service of its own (a stock Linux image), kept running idle as a
+   * machine to work from. Unset: guessed from the image (see `idleByDefault`).
+   */
+  idle?: boolean;
+  /** A network OS in its container, wired as its image expects (Cisco IOL, built with vrnetlab). */
+  appliance?: Appliance;
+  /** The appliance's own configuration (IOS commands), added to the one Isoloom generates. */
+  config?: string;
+  /** Addresses fixed by hand: LAN name -> last octet. Others take the next free one. */
+  pins?: Record<string, number>;
+};
+
+/** Stock Linux images: a shell that exits at once, so they need to be kept running idle. */
+const STOCK_IMAGES = ["alpine", "ubuntu", "debian", "kali-rolling", "fedora", "rockylinux", "almalinux", "centos", "busybox", "archlinux", "netshoot"];
+
+/** An image's name: its last path segment, without the tag, in lowercase. */
+export function imageName(image: string): string {
+  return image.trim().split(":")[0].split("/").pop()?.toLowerCase() ?? "";
+}
+
+export function idleByDefault(image: string): boolean {
+  return STOCK_IMAGES.includes(imageName(image));
+}
+
+/** How a cable or a LAN behaves, as a slow or lossy link: one-way delay and its jitter (ms),
+ * loss (%), bandwidth (Mbit/s). Isoloom applies it with `tc netem` (its `tc`). */
+export type LinkConditions = {
+  delay?: number;
+  jitter?: number;
+  loss?: number;
+  rate?: number;
+};
+
+/** The two ends of a cable: `aPort` on the source machine, `bPort` on the target. */
+export type CableData = {
+  aPort: string;
+  bPort: string;
+  /** How the cable behaves (between two machines; a cable to a LAN takes the LAN's). */
+  tc?: LinkConditions;
+  /** Drawing only, worked out from what the cable is plugged into (never saved). */
+  color?: string;
+};
+
+/** A LAN (or VLAN) drawn as an area: machines inside it are on it. */
+export type LanData = {
+  name: string;
+  cidr: string;
+  internet: boolean;
+  /** How the LAN behaves (not on a switch's VLAN yet). */
+  tc?: LinkConditions;
+  /** Only its label is drawn: the LAN, its machines and their addresses are unchanged. */
+  hidden?: boolean;
+};
+
+/** A VLAN on a switch: `vlan<id>`, with its block. VLANs are lab-wide: `vlan10` is the same
+ * network on every switch, and a LAN area named `vlan10` is that VLAN too. */
+type Vlan = {
+  id: number;
+  cidr: string;
+};
+
+/** A switch port: a VLAN (access), "trunk" (every VLAN of the switch), or nothing. */
+export type PortMode = number | "trunk" | null;
+
+/**
+ * A switch: access ports, each in a VLAN (or none), and one trunk port that carries every VLAN
+ * of the switch. Not a machine: it is the network fabric, so it never appears in isoloom.yml;
+ * its VLANs do, as networks, and a machine cabled to a port joins the port's VLAN.
+ */
+type SwitchData = {
+  name: string;
+  vlans: Vlan[];
+  ports: PortMode[];
+};
+
+/** A note on the canvas: text, a box or an ellipse. Drawing only: never in isoloom.yml. */
+export type NoteShape = "text" | "rect" | "ellipse";
+export const NOTE_COLORS = ["yellow", "red", "blue", "green", "violet"] as const;
+type NoteData = {
+  text: string;
+  shape: NoteShape;
+  color: (typeof NOTE_COLORS)[number];
+};
+
+export type MachineNode = Node<MachineData, "machine">;
+export type LanNode = Node<LanData, "lan">;
+export type SwitchNode = Node<SwitchData, "switch">;
+export type NoteNode = Node<NoteData, "note">;
+export type LabNode = MachineNode | LanNode | SwitchNode | NoteNode;
+export type CableEdge = Edge<CableData, "cable">;
+
+export const isMachine = (n: LabNode): n is MachineNode => n.type === "machine";
+/**
+ * A router you configure (FRR as a container, or a VM): drawn as a faceplate with interfaces,
+ * like a switch. The automatic router (kind "router") has no interfaces to show.
+ */
+export const isRealRouter = (n: LabNode): n is MachineNode => isMachine(n) && n.data.icon === "router" && n.data.kind !== "router";
+export const ROUTER_PORTS = 4;
+export const ROUTER_W = 168;
+export const ROUTER_H = 74;
+export const routerPort = (i: number) => `eth${String(i)}`;
+
+/** Routers and firewalls: one connection point, and they snap onto a LAN's edge. */
+export const isAppliance = (n: LabNode): n is MachineNode => isMachine(n) && (n.data.icon === "router" || n.data.icon === "shield");
+export const isLan = (n: LabNode): n is LanNode => n.type === "lan";
+export const isSwitch = (n: LabNode): n is SwitchNode => n.type === "switch";
+export const isNote = (n: LabNode): n is NoteNode => n.type === "note";
+/** A node's name as lists show it (a note has none). */
+export const nodeName = (n: LabNode): string => (isNote(n) ? "note" : n.data.name);
+
+export const SWITCH_PORTS = 8;
+/** A switch's faceplate on the canvas (see `SwitchNodeView`). */
+export const SWITCH_W = 306;
+export const SWITCH_H = 74;
+export const TRUNK = "trunk";
+
+/** A machine's box on the canvas (see `MachineNodeView`). */
+export const MACHINE_W = 120;
+export const MACHINE_H = 116;
+export const LAN_W = 420;
+export const LAN_H = 300;
+
+/** How big a node is drawn: what snapping and "is it inside the LAN" go by. */
+export function sizeOf(n: LabNode): { w: number; h: number } {
+  if (n.type === "lan") return { w: n.width ?? LAN_W, h: n.height ?? LAN_H };
+  if (n.type === "switch") return { w: SWITCH_W, h: SWITCH_H };
+  if (n.type === "note") return { w: n.width ?? 200, h: n.height ?? 90 };
+  if (n.data.icon === "router" && n.data.kind !== "router") return { w: ROUTER_W, h: ROUTER_H };
+  return { w: MACHINE_W, h: MACHINE_H };
+}
+
+/** A node's center on the canvas, by its drawn size (measured by React Flow, or `fallback`). */
+export function centerOf(n: LabNode, fallback: { w: number; h: number } = { w: MACHINE_W, h: MACHINE_H }): XYPosition {
+  return {
+    x: n.position.x + (n.width ?? n.measured?.width ?? fallback.w) / 2,
+    y: n.position.y + (n.height ?? n.measured?.height ?? fallback.h) / 2,
+  };
+}
+
+/**
+ * How a LAN behaves on the canvas, as an Excalidraw frame: it is moved and selected by its label
+ * only, so a click or a drag inside it reaches the canvas (placing a device, drawing a selection
+ * box). Not saved: applied to every LAN when it is created or loaded.
+ */
+export const LAN_BEHAVIOR = { dragHandle: ".lan-handle", className: "pointer-events-none" } as const;
+
+/** Which side of a LAN an appliance sits on, when it is snapped onto one. */
+export type Side = "top" | "bottom" | "left" | "right";
+
+/** The canvas's look (see `DesignContext`): hand-drawn, or crisp for a report. */
+export type Design = "sketch" | "business";
+export const DESIGNS: Design[] = ["sketch", "business"];
+
+export type Draft = {
+  name: string;
+  nodes: LabNode[];
+  edges: CableEdge[];
+  design?: Design;
+};
+
+/** Machine names are Isoloom keys: lowercase letters, digits and dashes. */
+export function cleanName(name: string): string {
+  return name.toLowerCase().replace(/[^a-z0-9-]/g, "");
+}
+
+export function uid(prefix: string): string {
+  return `${prefix}-${Date.now().toString(36)}${Math.random().toString(36).slice(2, 7)}`;
+}
+
+/** The first `<prefix><n>` no machine or LAN uses yet. */
+export function freeName(prefix: string, nodes: LabNode[]): string {
+  const taken = new Set(nodes.map(nodeName));
+  for (let i = 1; ; i++) {
+    if (!taken.has(`${prefix}${String(i)}`)) return `${prefix}${String(i)}`;
+  }
+}
+
+/** Every node unselected: what placing or pasting something does to the rest. */
+export function unselected<T extends LabNode | CableEdge>(items: T[]): T[] {
+  return items.map((n) => ({ ...n, selected: false }));
+}

package/src/lib/tool/os.test.ts

@@ -0,0 +1,45 @@
+import fc from "fast-check";
+import { describe, expect, test } from "vitest";
+import { DEFAULT_OS, OS_CHOICES, currentMachine, currentOs } from "./os";
+import { machine } from "@/test/lab";
+
+describe("currentOs", () => {
+  test("writes a stored lab's OS as Isoloom names it now", () => {
+    expect(["debian-12", "ubuntu-24.04", "almalinux-9", "kali", "windows-11", "windows-server-2008r2", "centos-7"].map(currentOs)).toEqual([
+      "debian@12",
+      "ubuntu@24.04",
+      "alma@9",
+      "kali@rolling",
+      "windows@11",
+      "windows-server@2008r2",
+      "centos@7",
+    ]);
+  });
+
+  test("keeps an OS already written today's way, and what it can't read", () => {
+    for (const os of [...OS_CHOICES, "", "plan9", "debian"]) expect(currentOs(os)).toBe(os);
+  });
+
+  test("never changes an OS twice", () => {
+    fc.assert(
+      fc.property(fc.string(), (os) => {
+        expect(currentOs(currentOs(os))).toBe(currentOs(os));
+      }),
+    );
+  });
+});
+
+describe("currentMachine", () => {
+  test("renames a stored machine's OS and its Cisco OS, and nothing else", () => {
+    const m = machine("sw", { os: "debian-12", appliance: "cisco-viosl2" as never, ports: "22" }).data;
+    expect(currentMachine(m)).toEqual({ ...m, os: "debian@12", appliance: "cisco-vios-l2" });
+  });
+
+  test("leaves a machine without a Cisco OS without one", () => {
+    expect("appliance" in currentMachine(machine("web").data)).toBe(false);
+  });
+});
+
+test("a new VM is Debian 12, one of the OSes offered", () => {
+  expect(OS_CHOICES).toContain(DEFAULT_OS);
+});

package/src/lib/tool/os.ts

@@ -0,0 +1,57 @@
+import type { Appliance } from "./model";
+
+/**
+ * The OSes a machine can be, as Isoloom writes them (`<family>@<version>`): exactly Isoloom's list,
+ * which its engine gives (`choices_json`, checked by the tests). A machine of one of them is its
+ * OS, set up by its provisioning steps; each target decides whether it runs as a VM or as a
+ * container built from the OS's image.
+ */
+export const OS_CHOICES = [
+  "debian@11",
+  "debian@12",
+  "debian@13",
+  "ubuntu@14.04",
+  "ubuntu@16.04",
+  "ubuntu@18.04",
+  "ubuntu@20.04",
+  "ubuntu@22.04",
+  "ubuntu@24.04",
+  "rocky@9",
+  "alma@9",
+  "alpine@3.19",
+  "kali@rolling",
+  "fedora@42",
+  "centos@7",
+  "windows@10",
+  "windows@11",
+  "windows-server@2008r2",
+  "windows-server@2012r2",
+  "windows-server@2016",
+  "windows-server@2019",
+  "windows-server@2022",
+  "windows-server@2025",
+];
+
+/** The OS a new VM gets. */
+export const DEFAULT_OS = "debian@12";
+
+/**
+ * An OS as a lab stored before Isoloom's new format named it (its image-table name: `debian-12`,
+ * `almalinux-9`, `kali`, `windows-server-2022`), in today's spelling; any other value as it is.
+ */
+export function currentOs(os: string): string {
+  if (os === "kali") return "kali@rolling";
+  const m = /^([a-z-]+?)-(\d[\da-z.]*)$/.exec(os);
+  if (!m || os.includes("@")) return os;
+  const family = m[1] === "almalinux" ? "alma" : m[1];
+  return `${family}@${m[2]}`;
+}
+
+/** The Cisco OSes stored under the id the editor gave them before Isoloom's (`cisco-viosl2`). */
+const OLD_APPLIANCES: ReadonlyMap<string, Appliance> = new Map([["cisco-viosl2", "cisco-vios-l2"]]);
+
+/** A machine as a stored lab or device holds it, in today's spelling: its OS and its Cisco OS. */
+export function currentMachine<M extends { os: string; appliance?: Appliance }>(m: M): M {
+  const appliance = m.appliance === undefined ? undefined : (OLD_APPLIANCES.get(m.appliance) ?? m.appliance);
+  return { ...m, os: currentOs(m.os), ...(appliance === undefined ? {} : { appliance }) };
+}

package/src/lib/tool/parity.test.ts

@@ -0,0 +1,145 @@
+import fc from "fast-check";
+import { describe, expect, test } from "vitest";
+import { shippedEngine, verdict } from "@/test/engine";
+import { conditionsOf, tcOf, type Tc } from "./conditions";
+import { APPLIANCES } from "./model";
+import { OS_CHOICES } from "./os";
+import { PORT_PROTOCOLS, readPorts } from "./ports";
+
+/**
+ * The editor's model accepts exactly what Isoloom accepts: each list it offers is Isoloom's, and
+ * each value it reads or writes is one Isoloom reads the same way, checked against the engine the
+ * site ships (Isoloom itself, in WebAssembly).
+ */
+
+interface Choices {
+  os: string[];
+  appliances: string[];
+  protocols: string[];
+}
+
+const choices = async () => JSON.parse((await shippedEngine()).choices_json()) as Choices;
+
+/** A lab of one container on LAN `lan`, with `tc` on the LAN and `services` on the machine. */
+const lab = (tc?: Tc, services: unknown[] = []) => ({
+  name: "parity",
+  networks: { lan: { cidr: "10.10.1.0/24", ...(tc ? { tc } : {}) } },
+  nodes: { a: { kind: { container: { image: "alpine:3.20" } }, services, networks: { lan: null } } },
+});
+
+/** Whether Isoloom finds a problem with `field` of the LAN's `tc`. */
+async function refuses(tc: Tc, field: keyof Tc): Promise<boolean> {
+  const v = await verdict(lab(tc));
+  return v.problems.some((p) => p.includes(`networks.lan.tc.${field} `));
+}
+
+describe("the lists the editor offers are Isoloom's", () => {
+  test("every OS, and only those", async () => {
+    expect([...OS_CHOICES].sort()).toEqual([...(await choices()).os].sort());
+  });
+
+  test("every network appliance, and only those", async () => {
+    expect(APPLIANCES.map((a) => a.id).sort()).toEqual([...(await choices()).appliances].sort());
+  });
+
+  test("every port protocol, and only those", async () => {
+    expect([...PORT_PROTOCOLS]).toEqual((await choices()).protocols);
+  });
+});
+
+/** A number in one of the spellings Rust reads (or doesn't: an empty one, a lone point). */
+const number = (odd: string[]) =>
+  fc
+    .tuple(fc.constantFrom("", "+", "-"), fc.oneof(fc.nat(100_000).map(String), fc.double({ min: 0, max: 1e6, noNaN: true }).map(String), fc.constantFrom(".5", "5.", "1e3", "2E-2", ...odd)))
+    .map(([sign, n]) => `${sign}${n}`);
+
+/** A `tc` value: a number, then letters that may or may not be a unit. */
+const measured = fc
+  .tuple(number(["", ".", "x1"]), fc.constantFrom("", "ms", "s", "us", "MS", "bit", "kbit", "mbit", "gbit", "bps", "kbps", "mbps", "gbps", "Mbit", "kb", "e", "m s"))
+  .map(([n, unit]) => `${n}${unit}`);
+
+/** A value Isoloom takes: a number and one of `units`. */
+const taken = (units: string[]) => fc.tuple(number([]), fc.constantFrom(...units)).map(([n, unit]) => `${n}${unit}`);
+
+/** Whether two readings hold the same numbers, but for what floating point loses. */
+function same(a: Record<string, number | undefined> | undefined, b: Record<string, number | undefined> | undefined): boolean {
+  const keys = new Set([...Object.keys(a ?? {}), ...Object.keys(b ?? {})]);
+  return [...keys].every((k) => {
+    const [x, y] = [a?.[k], b?.[k]];
+    return x !== undefined && y !== undefined && Math.abs(x - y) <= 1e-9 * Math.max(1, Math.abs(x));
+  });
+}
+
+describe("a link condition is read exactly as Isoloom reads it", () => {
+  test("a delay or a rate: Isoloom refuses it if and only if the editor reports it", async () => {
+    await fc.assert(
+      fc.asyncProperty(measured, fc.constantFrom("delay", "rate"), async (value, field) => {
+        const reported = conditionsOf({ [field]: value }).problems.length > 0;
+        expect(reported, `${field}: ${value}`).toBe(await refuses({ [field]: value }, field));
+      }),
+      { numRuns: 120 },
+    );
+  });
+
+  test("a rate without its unit is reported, as Isoloom does", async () => {
+    expect(conditionsOf({ rate: "10" }).problems).toEqual([{ field: "rate", value: "10" }]);
+    expect(await refuses({ rate: "10" }, "rate")).toBe(true);
+  });
+
+  test("what the editor writes back, Isoloom reads as the same conditions", async () => {
+    await fc.assert(
+      fc.asyncProperty(taken(["us", "ms", "s"]), taken(["bit", "kbit", "mbit", "gbit", "bps", "kbps", "mbps", "gbps"]), async (delay, rate) => {
+        const read = conditionsOf({ delay, rate });
+        expect(read.problems).toEqual([]);
+        const written = tcOf(read.conditions);
+        expect(same(conditionsOf(written).conditions, read.conditions), JSON.stringify({ delay, rate, written })).toBe(true);
+        expect((await verdict(lab(written))).problems).toEqual([]);
+      }),
+      { numRuns: 40 },
+    );
+  });
+
+  test("a loss above 100% or a jitter without a delay is written for Isoloom to report, never changed", async () => {
+    expect(tcOf({ loss: 150, jitter: 5 })).toEqual({ loss: 150, jitter: "5ms" });
+    const problems = (await verdict(lab(tcOf({ loss: 150, jitter: 5 })))).problems.join("\n");
+    expect(problems).toContain("networks.lan.tc.loss");
+    expect(problems).toContain("networks.lan.tc.jitter");
+  });
+});
+
+describe("a machine's ports are read exactly as Isoloom takes them", () => {
+  const entry = fc.oneof(
+    fc.tuple(fc.integer({ min: -5, max: 70_000 }), fc.constantFrom("", "/tcp", "/udp", "/http", "/https", "/tls", "/TCP", "/sctp", "/")).map(([p, proto]) => `${String(p)}${proto}`),
+    fc.constantFrom("http", "80.5", "", "0x50"),
+  );
+
+  test("an entry the editor keeps is a port Isoloom takes; the others are reported", async () => {
+    await fc.assert(
+      fc.asyncProperty(fc.array(entry, { maxLength: 4 }), async (entries) => {
+        const { services, bad } = readPorts(entries.join(", "));
+        expect(services.length + bad.length).toBe(entries.filter((e) => e.trim()).length);
+        const v = await verdict(lab(undefined, services));
+        expect(v.error).toBeNull();
+        expect(v.problems.filter((p) => p.includes("machines.a.ports"))).toEqual([]);
+      }),
+      { numRuns: 40 },
+    );
+  });
+
+  test("a port out of range or a protocol Isoloom doesn't have is refused by the engine too", async () => {
+    for (const service of [{ port: 0 }, { port: 70_000 }, { port: 80, protocol: "sctp" }]) {
+      expect((await verdict(lab(undefined, [service]))).ok).toBe(false);
+    }
+  });
+});
+
+describe("an OS is one Isoloom knows", () => {
+  test("every OS the editor offers compiles, and the earlier spelling doesn't", async () => {
+    for (const os of OS_CHOICES) {
+      const v = await verdict({ name: "os", networks: { lan: { cidr: "10.10.1.0/24" } }, nodes: { m: { kind: { vm: { os } }, networks: { lan: null } } } });
+      expect(v.ok, `${os}: ${v.error ?? ""}`).toBe(true);
+    }
+    const old = await verdict({ name: "os", nodes: { m: { kind: { vm: { os: "debian-12" } } } } });
+    expect(old.error).toContain("unknown OS `debian-12`");
+  });
+});

package/src/lib/tool/pins.test.ts

@@ -0,0 +1,24 @@
+import { describe, expect, test } from "vitest";
+import { pinned } from "./pins";
+
+describe("pinned", () => {
+  test("pins the last number typed alone", () => {
+    expect(pinned(undefined, "office", "10.10.1.10", "20")).toEqual({ office: 20 });
+  });
+
+  test("pins the last number of a whole address typed in the same block", () => {
+    expect(pinned({ servers: 7 }, "office", "10.10.1.10", "10.10.1.42")).toEqual({ servers: 7, office: 42 });
+  });
+
+  test("clearing the field unpins that LAN only", () => {
+    expect(pinned({ servers: 7, office: 20 }, "office", "10.10.1.20", "  ")).toEqual({ servers: 7 });
+  });
+
+  test("refuses what can't be a host's last number", () => {
+    for (const typed of ["0", "255", "-3", "abc"]) expect(pinned(undefined, "office", "10.10.1.10", typed)).toBeNull();
+  });
+});
+
+test("pinned takes the last number of an address in another block", () => {
+  expect(pinned(undefined, "office", "10.10.1.10", "192.168.0.9")).toEqual({ office: 9 });
+});

package/src/lib/tool/pins.ts

@@ -0,0 +1,11 @@
+/**
+ * Fixing a machine's address on a LAN by hand: same block, a new last number (typed alone, or
+ * as a whole address); clearing it goes back to the next free one. Null: not a valid address.
+ */
+export function pinned(pins: Record<string, number> | undefined, net: string, ip: string, typed: string): Record<string, number> | null {
+  const text = typed.trim();
+  if (text === "") return Object.fromEntries(Object.entries(pins ?? {}).filter(([n]) => n !== net));
+  const base = ip.slice(0, ip.lastIndexOf(".") + 1);
+  const last = Number(text.startsWith(base) ? text.slice(base.length) : text.split(".").pop());
+  return Number.isInteger(last) && last > 0 && last < 255 ? { ...pins, [net]: last } : null;
+}