@takodotid/circuit 0.18.5 → 0.19.0

package/dist/cli/index.js

@@ -8,9 +8,10 @@ import {
   isGlobal,
   netmask,
   network,
+  parse,
   split,
   wildcard
-} from "../chunks/index-ex1wcst7.js";
+} from "../chunks/index-dczpxzzm.js";
 import {
   __require,
   __toESM
@@ -352,7 +353,7 @@ function compare(desired, current, dialect) {
   }
   return [...groups.values()].filter((group) => group.add.length || group.remove.length);
 }
-function vlanListChange(groups, prefix, parse, format, removal) {
+function vlanListChange(groups, prefix, parse2, format, removal) {
   const top = groups.find((group) => group.path.length === 0);
   if (!top)
     return;
@@ -360,8 +361,8 @@ function vlanListChange(groups, prefix, parse, format, removal) {
   const fresh = top.add.find((line) => line.startsWith(prefix));
   if (!old && !fresh)
     return;
-  const before = old ? parse(old) : [];
-  const after = fresh ? parse(fresh) : [];
+  const before = old ? parse2(old) : [];
+  const after = fresh ? parse2(fresh) : [];
   top.remove = top.remove.filter((line) => line !== old);
   top.add = top.add.filter((line) => line !== fresh);
   const added = after.filter((id) => !before.includes(id));
@@ -960,7 +961,7 @@ function parseLine(menu, line) {
   }
   return { menu, verb, selector, flags, attrs };
 }
-function parse(text) {
+function parse2(text) {
   const commands = [];
   const generated = new Set;
   let menu = "";
@@ -1413,8 +1414,8 @@ function planOrdered(menu, wanted, existing) {
   return result;
 }
 function plan2(desired, current, options) {
-  const want = parse(desired);
-  const have = parse(current);
+  const want = parse2(desired);
+  const have = parse2(current);
   const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
   const wantedByMenu = byMenu(want.commands.filter(owned));
   const existingByMenu = byMenu(have.commands.filter(owned));
@@ -3570,6 +3571,417 @@ function snmpExporterAuths(network2) {
 `, notes };
 }
 
+// src/core/graph.ts
+var LAYERS = ["l1", "l2", "l3", "bgp", "ospf", "tunnels"];
+var deviceId = (name) => `device:${name}`;
+function keyOf(address) {
+  if (!address || !isAddress(address))
+    return;
+  return `${familyOf(address)}:${parse(address)}`;
+}
+var isHostRoute = (cidr) => {
+  const { len, family } = split(cidr);
+  return len === (family === "ipv4" ? 32 : 128);
+};
+
+class Builder {
+  nodes = new Map;
+  edges = [];
+  node(id, kind, label, detail = []) {
+    const existing = this.nodes.get(id);
+    if (!existing)
+      this.nodes.set(id, { id, kind, label, detail: [...detail] });
+    else
+      for (const line2 of detail)
+        if (!existing.detail.includes(line2))
+          existing.detail.push(line2);
+    return id;
+  }
+  edge(edge) {
+    this.edges.push(edge);
+    return edge;
+  }
+}
+function routedOf(device) {
+  const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [[name, port]] : []);
+  const interfaces = Object.entries(device.interfaces ?? {});
+  return [...ports, ...interfaces];
+}
+function holdersOf(devices) {
+  return devices.flatMap((device) => routedOf(device).flatMap(([name, settings]) => (settings.addresses ?? []).flatMap((entry) => {
+    const address = typeof entry === "string" ? entry : entry.address;
+    if (!isCidr(address))
+      return [];
+    const peer = typeof entry === "string" ? undefined : entry.peer;
+    return [{ device, name, address, peer, vrrp: settings.vrrp ?? [] }];
+  })));
+}
+function describeDevice(device) {
+  const addresses2 = routedOf(device).filter(([, settings]) => settings.addresses?.length).map(([name, settings]) => {
+    const list = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : `${entry.address} to ${entry.peer}`);
+    const vrf = settings.vrf ? `, VRF ${settings.vrf}` : "";
+    return `${name}: ${list.join(", ")}${vrf}`;
+  });
+  return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses2];
+}
+function carriedBy(device, settings) {
+  const vlan = (name, untagged) => {
+    const id = name ? device.vlans?.[name]?.id : undefined;
+    return name && id !== undefined ? [{ name, id, untagged }] : [];
+  };
+  const trunk = (settings?.trunk_vlans ?? []).filter((name) => name !== settings?.native_vlan);
+  return [...vlan(settings?.access_vlan, true), ...vlan(settings?.native_vlan, true), ...trunk.flatMap((name) => vlan(name, false))].sort((a, b) => a.id - b.id);
+}
+function vlanLabel(vlans) {
+  if (vlans.length === 1)
+    return `${vlans[0].name}${vlans[0].untagged ? ", untagged" : ""}`;
+  if (vlans.length <= 3)
+    return vlans.map((vlan) => vlan.name).join(", ");
+  return `${vlans.length} VLANs`;
+}
+function cables(devices, graph) {
+  const byName = new Map(devices.map((device) => [device.name, device]));
+  const drawn = new Set;
+  const bundles = new Map;
+  for (const device of devices) {
+    for (const [portName, port] of Object.entries(device.ports ?? {})) {
+      const link = port?.link;
+      if (!port || !link)
+        continue;
+      const here = `${device.name} ${portName}`;
+      const there = `${link.device} ${link.port}`;
+      if (drawn.has(`${there}|${here}`))
+        continue;
+      drawn.add(`${here}|${there}`);
+      const far = byName.get(link.device);
+      const farPort = far?.ports?.[link.port];
+      const linksBack = farPort?.link?.device === device.name && farPort.link.port === portName;
+      const to = far ? deviceId(far.name) : graph.node(`missing:${link.device}`, "outside", link.device, ["named by a link, and not in the network"]);
+      const cableLine = `${here} to ${there}`;
+      const lag = port.lag;
+      const farLag = farPort?.lag;
+      const bundleKey = `${device.name} ${lag}|${link.device} ${farLag}`;
+      const bundle = lag && farLag && linksBack ? bundles.get(bundleKey) : undefined;
+      if (bundle) {
+        bundle.members++;
+        bundle.cable.detail.push(cableLine);
+        bundle.cable.label = `${lag} to ${farLag}, ${bundle.members} cables`;
+        continue;
+      }
+      const isBundle = Boolean(lag && farLag && linksBack);
+      const cable = graph.edge({
+        layer: "l1",
+        from: deviceId(device.name),
+        to,
+        label: isBundle ? `${lag} to ${farLag}` : `${portName} to ${link.port}`,
+        detail: [cableLine],
+        ...linksBack ? {} : { oneSided: true }
+      });
+      if (isBundle)
+        bundles.set(bundleKey, { cable, members: 1 });
+      const lagSettings = lag ? device.interfaces?.[lag] : undefined;
+      const carrier = lagSettings?.type === "lag" ? lagSettings : lag ? undefined : port;
+      const vlans = carriedBy(device, carrier);
+      if (!vlans.length)
+        continue;
+      graph.edge({
+        layer: "l2",
+        from: deviceId(device.name),
+        to,
+        label: vlanLabel(vlans),
+        detail: [
+          `${device.name} ${lag ?? portName}`,
+          ...vlans.map((vlan) => `${vlan.name}, VLAN ${vlan.id}${vlan.untagged ? ", untagged" : ""}`)
+        ],
+        vlans,
+        ...linksBack ? {} : { oneSided: true }
+      });
+    }
+  }
+}
+function segments(holders2, owners, graph) {
+  const bySegment = new Map;
+  const pairs = new Set;
+  for (const holder of holders2) {
+    if (holder.peer) {
+      const far = owners.get(keyOf(holder.peer) ?? "");
+      if (!far || far.device === holder.device)
+        continue;
+      const ends = [`${holder.device.name} ${holder.name}`, `${far.device.name} ${far.name}`].sort().join("|");
+      if (pairs.has(ends))
+        continue;
+      pairs.add(ends);
+      graph.edge({
+        layer: "l3",
+        from: deviceId(holder.device.name),
+        to: deviceId(far.device.name),
+        label: `${host(holder.address)} to ${host(far.address)}`,
+        detail: [`${holder.device.name} ${holder.name} ${holder.address}`, `${far.device.name} ${far.name} ${far.address}`]
+      });
+      continue;
+    }
+    if (isHostRoute(holder.address))
+      continue;
+    const segment = network(holder.address);
+    bySegment.set(segment, [...bySegment.get(segment) ?? [], holder]);
+  }
+  for (const [segment, members] of bySegment) {
+    if (new Set(members.map((member) => member.device.name)).size < 2)
+      continue;
+    const memberLines = members.map((member) => `${member.device.name} ${member.name} ${member.address}`);
+    const vrrpLines3 = members.flatMap((member) => member.vrrp.map((group) => `VRRP ${group.id} ${group.address} on ${member.device.name}, priority ${group.priority ?? 100}`));
+    if (members.length === 2) {
+      const [a, b] = members;
+      graph.edge({
+        layer: "l3",
+        from: deviceId(a.device.name),
+        to: deviceId(b.device.name),
+        label: segment,
+        detail: [...memberLines, ...vrrpLines3]
+      });
+      continue;
+    }
+    const id = graph.node(`segment:${segment}`, "segment", segment, [...memberLines, ...vrrpLines3]);
+    for (const member of members) {
+      graph.edge({
+        layer: "l3",
+        from: deviceId(member.device.name),
+        to: id,
+        label: `${member.name} ${host(member.address)}`,
+        detail: [`${member.device.name} ${member.name} ${member.address}`]
+      });
+    }
+  }
+}
+function sessions(devices, owners, graph) {
+  const all = devices.flatMap((device) => {
+    const bgp = device.routing?.bgp;
+    return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+      const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+      return {
+        device,
+        name,
+        address: neighbor.address,
+        ownAs: bgp.asn,
+        remoteAs: neighbor.remote_as ?? group?.remote_as,
+        role: neighbor.role ?? group?.role,
+        description: neighbor.description ?? group?.description,
+        import: neighbor.import ?? group?.import,
+        export: neighbor.export ?? group?.export
+      };
+    });
+  });
+  const describe2 = (session) => {
+    const parts = [
+      session.address,
+      session.remoteAs ? `AS${session.remoteAs}` : "no remote AS",
+      session.role,
+      session.import ? `import ${session.import}` : "imports nothing",
+      session.export ? `export ${session.export}` : "exports nothing"
+    ];
+    return `${session.device.name} ${session.name}: ${parts.filter(Boolean).join(", ")}`;
+  };
+  const ownerOf = (session) => owners.get(keyOf(session.address) ?? "")?.device;
+  const paired = new Set;
+  for (const session of all) {
+    if (paired.has(session))
+      continue;
+    const far = ownerOf(session);
+    if (far && far !== session.device) {
+      const back = all.find((other) => other.device === far && !paired.has(other) && ownerOf(other) === session.device);
+      if (back)
+        paired.add(back);
+      graph.edge({
+        layer: "bgp",
+        from: deviceId(session.device.name),
+        to: deviceId(far.name),
+        label: session.remoteAs === session.ownAs ? "iBGP" : "eBGP",
+        detail: [describe2(session), ...back ? [describe2(back)] : [`${far.name} has no session back`]],
+        ...back ? {} : { oneSided: true }
+      });
+      continue;
+    }
+    const outside = session.remoteAs ? graph.node(`as:${session.remoteAs}`, "outside", `AS${session.remoteAs}`, session.description ? [session.description] : []) : graph.node(`address:${session.address}`, "outside", session.address, ["a BGP neighbor without a remote AS"]);
+    const internal = session.remoteAs === session.ownAs;
+    graph.edge({
+      layer: "bgp",
+      from: deviceId(session.device.name),
+      to: outside,
+      label: [session.name, session.role].filter(Boolean).join(", "),
+      detail: [describe2(session), ...internal ? ["internal, and no device in the network holds the address"] : []],
+      ...internal ? { oneSided: true } : {}
+    });
+  }
+}
+function adjacencies(devices, graph) {
+  const byKey = new Map;
+  for (const device of devices) {
+    for (const [area, { interfaces }] of Object.entries(device.routing?.ospf?.areas ?? {})) {
+      for (const [name, settings] of Object.entries(interfaces)) {
+        if (settings?.passive)
+          continue;
+        const routed = device.ports?.[name] ?? device.interfaces?.[name];
+        const cost = settings?.cost ? `, cost ${settings.cost}` : "";
+        for (const entry of routed?.addresses ?? []) {
+          const address = typeof entry === "string" ? entry : entry.address;
+          if (!isCidr(address) || isHostRoute(address))
+            continue;
+          const key = `${area} ${network(address)}`;
+          const member = { device, name, line: `${device.name} ${name} ${address}${cost}` };
+          byKey.set(key, [...byKey.get(key) ?? [], member]);
+        }
+      }
+    }
+  }
+  for (const [key, members] of byKey) {
+    const [area] = key.split(" ");
+    for (const [index, a] of members.entries()) {
+      for (const b of members.slice(index + 1)) {
+        if (a.device === b.device)
+          continue;
+        graph.edge({
+          layer: "ospf",
+          from: deviceId(a.device.name),
+          to: deviceId(b.device.name),
+          label: `area ${area}`,
+          detail: [a.line, b.line]
+        });
+      }
+    }
+  }
+}
+var endpointHost = (endpoint) => endpoint.replace(/:\d+$/, "").replace(/^\[(.*)\]$/, "$1");
+function tunnels2(devices, owners, graph) {
+  const ends = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "gre" || iface.type === "vxlan" ? [{ device, name, iface }] : []));
+  const same = (a, b) => keyOf(a) !== undefined && keyOf(a) === keyOf(b);
+  const mirrors = (a, b) => a.device !== b.device && a.iface.type === b.iface.type && same(a.iface.local, b.iface.remote) && same(a.iface.remote, b.iface.local) && (a.iface.type !== "vxlan" || b.iface.type === "vxlan" && a.iface.vni === b.iface.vni);
+  const describe2 = (end) => {
+    const vni = end.iface.type === "vxlan" ? `, VNI ${end.iface.vni}` : "";
+    return `${end.device.name} ${end.name}: ${end.iface.local} to ${end.iface.remote}${vni}`;
+  };
+  const paired = new Set;
+  for (const end of ends) {
+    if (paired.has(end))
+      continue;
+    const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
+    const mirror = ends.find((other) => !paired.has(other) && mirrors(end, other));
+    if (mirror) {
+      paired.add(mirror);
+      graph.edge({
+        layer: "tunnels",
+        from: deviceId(end.device.name),
+        to: deviceId(mirror.device.name),
+        label: `${kind} ${end.name} to ${mirror.name}`,
+        detail: [describe2(end), describe2(mirror)]
+      });
+      continue;
+    }
+    const owner = owners.get(keyOf(end.iface.remote) ?? "")?.device;
+    if (owner && owner !== end.device) {
+      graph.edge({
+        layer: "tunnels",
+        from: deviceId(end.device.name),
+        to: deviceId(owner.name),
+        label: `${kind} ${end.name}`,
+        detail: [describe2(end), `${owner.name} declares no tunnel back`],
+        oneSided: true
+      });
+      continue;
+    }
+    const outside = graph.node(`address:${end.iface.remote}`, "outside", end.iface.remote, end.iface.description ? [end.iface.description] : []);
+    graph.edge({
+      layer: "tunnels",
+      from: deviceId(end.device.name),
+      to: outside,
+      label: `${kind} ${end.name}`,
+      detail: [describe2(end)]
+    });
+  }
+  wireguard2(devices, owners, graph);
+}
+function wireguard2(devices, owners, graph) {
+  const interfaces = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "wireguard" ? [{ device, name, iface }] : []));
+  const farEndOf = (device, peer) => interfaces.find(({ device: other, iface }) => {
+    if (other === device)
+      return false;
+    const tunnelAddresses = (iface.addresses ?? []).map((entry) => host(typeof entry === "string" ? entry : entry.address));
+    const sendsFrom = tunnelAddresses.some((address) => isAddress(address) && peer.allowed_addresses.some((allowed) => isCidr(allowed) && contains(allowed, address)));
+    const endpoint = peer.endpoint ? endpointHost(peer.endpoint) : undefined;
+    const isEndpoint = endpoint !== undefined && owners.get(keyOf(endpoint) ?? "")?.device === other;
+    return sendsFrom || isEndpoint;
+  });
+  const drawn = new Set;
+  for (const { device, name, iface } of interfaces) {
+    const clients = [];
+    for (const peer of iface.peers ?? []) {
+      const far = farEndOf(device, peer);
+      if (far) {
+        const ends = [`${device.name} ${name}`, `${far.device.name} ${far.name}`].sort().join("|");
+        if (drawn.has(ends))
+          continue;
+        drawn.add(ends);
+        graph.edge({
+          layer: "tunnels",
+          from: deviceId(device.name),
+          to: deviceId(far.device.name),
+          label: `WireGuard ${name} to ${far.name}`,
+          detail: [`${device.name} ${name} peer ${peer.name}`]
+        });
+        continue;
+      }
+      if (!peer.endpoint) {
+        clients.push(peer);
+        continue;
+      }
+      const endpoint = endpointHost(peer.endpoint);
+      const outside2 = graph.node(`address:${endpoint}`, "outside", peer.name, [`WireGuard endpoint ${peer.endpoint}`]);
+      graph.edge({
+        layer: "tunnels",
+        from: deviceId(device.name),
+        to: outside2,
+        label: `WireGuard ${name}`,
+        detail: [`${device.name} ${name} peer ${peer.name}, allowed ${peer.allowed_addresses.join(", ")}`]
+      });
+    }
+    if (!clients.length)
+      continue;
+    const outside = graph.node(`clients:${device.name}:${name}`, "outside", `${clients.length} ${clients.length === 1 ? "client" : "clients"}`, clients.map((peer) => `${peer.name}: ${peer.allowed_addresses.join(", ")}`));
+    graph.edge({
+      layer: "tunnels",
+      from: deviceId(device.name),
+      to: outside,
+      label: `WireGuard ${name}`,
+      detail: [`peers that dial in to ${device.name} ${name}`]
+    });
+  }
+}
+function graphOf(devices) {
+  const graph = new Builder;
+  for (const device of devices)
+    graph.node(deviceId(device.name), "device", device.name, describeDevice(device));
+  const holders2 = holdersOf(devices);
+  const owners = new Map;
+  for (const holder of holders2) {
+    const key = keyOf(host(holder.address));
+    if (!owners.has(key))
+      owners.set(key, holder);
+  }
+  cables(devices, graph);
+  segments(holders2, owners, graph);
+  sessions(devices, owners, graph);
+  adjacencies(devices, graph);
+  tunnels2(devices, owners, graph);
+  return { nodes: [...graph.nodes.values()], edges: graph.edges };
+}
+function only(graph, layers, deviceNames = []) {
+  const named = new Set(deviceNames.map(deviceId));
+  const touches = (edge) => !named.size || named.has(edge.from) || named.has(edge.to);
+  const edges = graph.edges.filter((edge) => layers.includes(edge.layer) && touches(edge));
+  const ends = new Set(edges.flatMap((edge) => [edge.from, edge.to]));
+  const nodes = graph.nodes.filter((node) => (named.size ? named.has(node.id) : node.kind === "device") || ends.has(node.id));
+  return { nodes, edges };
+}
+
 // src/core/validate.ts
 import { X509Certificate as X509Certificate2 } from "node:crypto";
 function validate(network2) {
@@ -3910,6 +4322,76 @@ function checkLinks(devices) {
   return findings;
 }
 
+// src/cli/graph.ts
+function markOf(graph, node) {
+  if (node.kind !== "device")
+    return;
+  const findings = graph.findings.filter((finding) => finding.device && deviceId(finding.device) === node.id);
+  if (findings.some((finding) => finding.level === "error"))
+    return "error";
+  const drift = graph.drift[node.label]?.status;
+  if (findings.length || drift === "differs" || drift === "cannot plan")
+    return "warning";
+  return;
+}
+function mermaid(graph) {
+  const ids = new Map(graph.nodes.map((node, index) => [node.id, `n${index}`]));
+  const text = (...lines2) => `"${lines2.map((line2) => line2.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
+  const shapes = {
+    device: (label) => `[${label}]`,
+    segment: (label) => `([${label}])`,
+    outside: (label) => `{{${label}}}`
+  };
+  const lines = ["graph LR"];
+  for (const node of graph.nodes) {
+    const label = node.kind === "device" ? text(node.label, node.detail[0] ?? "") : text(node.label);
+    lines.push(`    ${ids.get(node.id)}${shapes[node.kind](label)}`);
+  }
+  for (const edge of graph.edges) {
+    const arrow = edge.oneSided ? "-.-" : "---";
+    lines.push(`    ${ids.get(edge.from)} ${arrow}|${text(edge.label)}| ${ids.get(edge.to)}`);
+  }
+  lines.push("    classDef error stroke:#d1242f,stroke-width:3px", "    classDef warning stroke:#bf8700,stroke-width:3px", "    classDef outside stroke-dasharray:4 3");
+  for (const node of graph.nodes) {
+    const mark = markOf(graph, node) ?? (node.kind === "outside" ? "outside" : undefined);
+    if (mark)
+      lines.push(`    class ${ids.get(node.id)} ${mark}`);
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function dot(graph) {
+  const text = (value2) => `"${value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+  const colors = { error: "#d1242f", warning: "#bf8700" };
+  const shapes = {
+    device: "shape=box, style=rounded",
+    segment: "shape=ellipse",
+    outside: "shape=box, style=dashed"
+  };
+  const lines = [
+    "graph network {",
+    "    rankdir=LR;",
+    '    node [fontname="Helvetica"];',
+    '    edge [fontname="Helvetica", fontsize=10];'
+  ];
+  for (const node of graph.nodes) {
+    const label = node.kind === "device" ? `${node.label}
+${node.detail[0] ?? ""}` : node.label;
+    const mark = markOf(graph, node);
+    const color = mark ? `, color=${text(colors[mark])}, penwidth=2` : "";
+    lines.push(`    ${text(node.id)} [label=${text(label)}, ${shapes[node.kind]}${color}];`);
+  }
+  for (const edge of graph.edges) {
+    const style = edge.oneSided ? ", style=dashed" : "";
+    lines.push(`    ${text(edge.from)} -- ${text(edge.to)} [label=${text(edge.label)}${style}];`);
+  }
+  lines.push("}");
+  return lines.join(`
+`) + `
+`;
+}
+
 // src/cli/index.ts
 var HELP = `usage: circuit <command> [device...] [options]
 
@@ -3930,6 +4412,12 @@ var HELP = `usage: circuit <command> [device...] [options]
   prometheus            every device with SNMP, as Prometheus targets for snmp_exporter
                           --auths        snmp_exporter's auths for them instead, with secrets as \${NAME}
   secrets               every secret the config uses, and whether each can be read
+  graph [device...]     the network as a graph, from the config alone, without contacting a device
+                          --layer=l1     l1, l2, l3, bgp, ospf or tunnels, several with commas, or all
+                          --format=mermaid  mermaid, dot or json
+  studio                the graph in the browser, drawn again whenever the config changes
+                          --port=4600    the port it listens on, on this machine only
+                          --no-open      do not open the browser
 
   --config <path>       the network's config file, circuit.config.ts in the working directory by default`;
 var DEFAULT_CONFIG = "circuit.config.ts";
@@ -4223,6 +4711,54 @@ function secretsCommand() {
 ${references.length} secret(s), ${missing} missing.`);
   process.exit(missing ? 1 : 0);
 }
+var flagValue = (name) => flags.find((flag) => flag.startsWith(`--${name}=`))?.slice(name.length + 3);
+function driftOf(device) {
+  const path = statePath(device);
+  if (!existsSync2(path))
+    return { status: "no snapshot", lines: [] };
+  try {
+    const adapter = adapterOf(device);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    const lines = [
+      ...plan4.steps.flatMap((step) => [step.title, ...step.show.map((line2) => `  ${line2}`)]),
+      ...plan4.problems.map((problem) => `PROBLEM ${problem}`)
+    ];
+    return { status: lines.length ? "differs" : "matches", lines };
+  } catch (error) {
+    return { status: "cannot plan", lines: [error.message] };
+  }
+}
+function graphCommand() {
+  const requested = (flagValue("layer") ?? "l1").split(",");
+  const layers = requested.includes("all") ? [...LAYERS] : requested;
+  const unknown = layers.filter((layer) => !LAYERS.includes(layer));
+  if (unknown.length)
+    fail(`no layer ${unknown.join(", ")}; known: ${LAYERS.join(", ")}, all`);
+  const format = flagValue("format") ?? "mermaid";
+  const devices = selected(true);
+  const graph = only(graphOf(network2.devices), layers, names.length ? devices.map((device) => device.name) : []);
+  const shown = new Set(graph.nodes.map((node) => node.label));
+  const annotated = {
+    ...graph,
+    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
+    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
+  };
+  if (format === "mermaid")
+    process.stdout.write(mermaid(annotated));
+  else if (format === "dot")
+    process.stdout.write(dot(annotated));
+  else if (format === "json")
+    console.log(JSON.stringify(annotated, null, 4));
+  else
+    fail(`no format ${format}; known: mermaid, dot, json`);
+}
+async function studioCommand() {
+  const port = Number(flagValue("port") ?? 4600);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    fail("--port takes a number from 1 to 65535");
+  const { studio } = await import("../chunks/studio-femhydvd.js");
+  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open") });
+}
 var commands = {
   validate: validateCommand,
   build: buildCommand,
@@ -4235,7 +4771,9 @@ var commands = {
   peeringdb: peeringdbCommand,
   librenms: librenmsCommand,
   prometheus: prometheusCommand,
-  secrets: secretsCommand
+  secrets: secretsCommand,
+  graph: graphCommand,
+  studio: studioCommand
 };
 var run = commands[command2];
 if (run)

package/dist/index.js

@@ -6,7 +6,7 @@ import {
   isCidr,
   isGlobal,
   network
-} from "./chunks/index-ex1wcst7.js";
+} from "./chunks/index-dczpxzzm.js";
 import"./chunks/index-fq57hya4.js";
 
 // src/core/define.ts

package/dist/presets/index.js

@@ -1,6 +1,6 @@
 import {
   contains
-} from "../chunks/index-ex1wcst7.js";
+} from "../chunks/index-dczpxzzm.js";
 import"../chunks/index-fq57hya4.js";
 
 // src/presets/index.ts

package/dist/types/core/graph.d.ts

@@ -0,0 +1,44 @@
+import type { Device } from "../schema";
+/** One view of the network. Every edge belongs to one. */
+export type Layer = "l1" | "l2" | "l3" | "bgp" | "ospf" | "tunnels";
+export declare const LAYERS: readonly Layer[];
+/** One of our devices, a segment several of them share, or something outside the network. */
+export type GraphNode = {
+    /** Unique among the nodes, such as `device:edge-01` or `as:64501`. */
+    id: string;
+    kind: "device" | "segment" | "outside";
+    /** A word or two, drawn on the node. */
+    label: string;
+    /** One fact per line, for a closer look. */
+    detail: string[];
+};
+/** A VLAN a cable carries. */
+export type CarriedVlan = {
+    name: string;
+    id: number;
+    /** Carried without a tag: the access VLAN, or a trunk's native VLAN. */
+    untagged: boolean;
+};
+export type GraphEdge = {
+    layer: Layer;
+    /** Node ids. */
+    from: string;
+    to: string;
+    /** A few words, drawn on the edge. */
+    label: string;
+    /** One fact per line, for a closer look. */
+    detail: string[];
+    /** Only one end declares it: the far device does not declare the cable, session or tunnel back. */
+    oneSided?: true;
+    /** On `l2`, the VLANs the cable carries. */
+    vlans?: CarriedVlan[];
+};
+export type Graph = {
+    nodes: GraphNode[];
+    edges: GraphEdge[];
+};
+export declare const deviceId: (name: string) => string;
+/** The network as a graph. It reads the config only, never a device, and works on a config that does not validate. */
+export declare function graphOf(devices: readonly Device[]): Graph;
+/** Only the edges on these layers, and among those only the ones that touch these devices when any are named. Every device named stays. */
+export declare function only(graph: Graph, layers: readonly Layer[], deviceNames?: readonly string[]): Graph;