@takodotid/circuit 0.18.5 → 0.20.0

package/dist/cli/index.js

@@ -1,4 +1,17 @@
 #!/usr/bin/env node
+import {
+  LAYERS,
+  addressesOf,
+  deviceId,
+  freeOfLength,
+  graphOf,
+  holdersOf,
+  keyOf,
+  only,
+  portsOf,
+  spell,
+  studioData
+} from "../chunks/index-jtzfw679.js";
 import {
   contains,
   familyOf,
@@ -10,7 +23,7 @@ import {
   network,
   split,
   wildcard
-} from "../chunks/index-ex1wcst7.js";
+} from "../chunks/index-xm9nma2t.js";
 import {
   __require,
   __toESM
@@ -18,8 +31,8 @@ import {
 
 // src/cli/index.ts
 import { createPrivateKey, createPublicKey } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, join as join2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname2, join as join4, relative as relative2, resolve as resolve3, sep } from "node:path";
 
 // src/core/secrets.ts
 import { spawnSync } from "node:child_process";
@@ -207,44 +220,6 @@ function upload(client, path, content) {
   });
 }
 
-// src/adapters/devices/raisecom-ros/models.ts
-var models = {
-  "RAX721-C-6C48": {
-    ports: { "100g": 6, "25g": 24, "10g": 24 },
-    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
-  }
-};
-
-// src/adapters/devices/routeros/models.ts
-var models2 = {
-  "CCR2216-1G-12XS-2XQ": {
-    ports: { "100g": 2, "25g": 12, "1g": 1 },
-    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" }
-  }
-};
-
-// src/adapters/devices/vrp/models.ts
-var models3 = {
-  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
-};
-
-// src/adapters/devices/catalog.ts
-var catalog = { routeros: models2, vrp: models3, "raisecom-ros": models };
-function portsOf(platform, model) {
-  const spec = catalog[platform]?.[model];
-  if (!spec)
-    throw new Error(`${platform} has no model ${model}`);
-  return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
-}
-function spell(platform, model, port) {
-  const spec = catalog[platform]?.[model];
-  const parts = /^(\d+[gm])-(\d+)$/.exec(port);
-  const template = parts && spec?.spelling[parts[1]];
-  if (!template)
-    throw new Error(`${model} has no port ${port}`);
-  return template.replace("{n}", parts[2]);
-}
-
 // src/adapters/devices/derive.ts
 function lagIds(device) {
   const numbers = new Map;
@@ -262,6 +237,36 @@ function ipv4Networks(device, iface) {
   const addresses = (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
   return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
 }
+var SWITCH_SERVICES = ["ssh", "telnet", "snmp"];
+function switchUnsupported(device) {
+  const found = [];
+  for (const service of SWITCH_SERVICES) {
+    const settings = device.management?.[service];
+    if (settings?.allow)
+      found.push(`management.${service}.allow, every service takes management.allow`);
+    if (settings?.port)
+      found.push(`management.${service}.port`);
+  }
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    if (user.description)
+      found.push(`users.${name}.description`);
+    if (user.ssh_keys?.length)
+      found.push(`users.${name}.ssh_keys`);
+  }
+  if (device.system?.ip)
+    found.push("system.ip");
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (port?.hardware_offload !== undefined)
+      found.push(`ports.${name}.hardware_offload`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.addresses?.some((entry) => typeof entry !== "string"))
+      found.push(`interfaces.${name}.addresses with a peer`);
+    if (iface.hardware_offload !== undefined)
+      found.push(`interfaces.${name}.hardware_offload`);
+  }
+  return found;
+}
 
 // src/adapters/devices/lines.ts
 var indentOf = (raw) => raw.length - raw.trimStart().length;
@@ -307,12 +312,12 @@ function head(line) {
 }
 function compare(desired, current, dialect) {
   const canon = dialect.canon ?? ((line) => line);
-  const keyOf = (entry) => [...entry.path, canon(entry.line)].join("\x00");
+  const keyOf2 = (entry) => [...entry.path, canon(entry.line)].join("\x00");
   const pathKey = (path) => path.join("\x00");
   const wanted = entries(desired, dialect);
   const existing = entries(current, dialect);
-  const wantedKeys = new Set(wanted.map(keyOf));
-  const existingKeys = new Set(existing.map(keyOf));
+  const wantedKeys = new Set(wanted.map(keyOf2));
+  const existingKeys = new Set(existing.map(keyOf2));
   const wantedBlocks = new Set(wanted.map((entry) => pathKey([...entry.path, entry.line])));
   const groups = new Map;
   const groupFor = (path) => {
@@ -322,7 +327,7 @@ function compare(desired, current, dialect) {
     return groups.get(key);
   };
   for (const entry of wanted) {
-    if (existingKeys.has(keyOf(entry)))
+    if (existingKeys.has(keyOf2(entry)))
       continue;
     const ownBlock = pathKey([...entry.path, entry.line]);
     const opensBlock = wanted.some((other) => {
@@ -334,7 +339,7 @@ function compare(desired, current, dialect) {
     groupFor(entry.path).add.push(entry.line);
   }
   for (const entry of [...existing].reverse()) {
-    if (wantedKeys.has(keyOf(entry)))
+    if (wantedKeys.has(keyOf2(entry)))
       continue;
     const insideRemovedBlock = entry.path.some((_, depth) => {
       const enclosing = pathKey(entry.path.slice(0, depth + 1));
@@ -344,7 +349,7 @@ function compare(desired, current, dialect) {
       continue;
     const replaced = wanted.some((other) => {
       const sameBlock = pathKey(other.path) === pathKey(entry.path);
-      const isNew = !existingKeys.has(keyOf(other));
+      const isNew = !existingKeys.has(keyOf2(other));
       return sameBlock && isNew && head(other.line) === head(entry.line);
     });
     if (!replaced)
@@ -715,8 +720,15 @@ function unsupported(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
       continue;
     }
-    if (iface.vrf)
-      found.push(`interfaces.${name}.vrf`);
+    for (const field of ["vrf", "description", "mtu", "ipv6_ra"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}`);
+    }
+    for (const entry of iface.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      if (familyOf(address) === "ipv6")
+        found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
+    }
     for (const group of iface.vrrp ?? []) {
       if (familyOf(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
@@ -739,8 +751,15 @@ function unsupported(device) {
     }
   }
   for (const route of routing?.static ?? []) {
-    if (!route.via || route.vrf)
+    if (!route.via || route.vrf || familyOf(route.prefix) === "ipv6") {
       found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+    }
+    if (route.description || route.distance)
+      found.push(`routing.static ${route.prefix} description and distance`);
+  }
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    if (vlan.description)
+      found.push(`vlans.${name}.description`);
   }
   const UNSUPPORTED_SECTIONS = [
     "firewall",
@@ -767,6 +786,10 @@ function unsupported(device) {
     if (!SNMP_AUTH[user.auth])
       found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
   }
+  if (management.snmp?.contact || management.snmp?.location)
+    found.push("management.snmp.contact and location");
+  if (management.ssh?.weak_crypto)
+    found.push("management.ssh.weak_crypto");
   if (device.lldp && device.lldp !== true)
     found.push("lldp.interfaces, LLDP is per device");
   if (device.stp?.mode && device.stp.mode !== "mstp")
@@ -779,6 +802,7 @@ function unsupported(device) {
   if (system.dns || system.logging || system.release_channel || system.banner || system.ntp?.serve) {
     found.push("system.dns, logging, release_channel, banner and ntp.serve");
   }
+  found.push(...switchUnsupported(device));
   return found;
 }
 var REFUSED = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
@@ -2587,6 +2611,14 @@ function unsupported2(device) {
       found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
     }
   }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "lag")
+      continue;
+    for (const field of ["storm_control", "stp"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}, on a LAG`);
+    }
+  }
   const bgp = device.routing?.bgp;
   for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
@@ -2599,6 +2631,8 @@ function unsupported2(device) {
     found.push("management.console, the console uses the device's users");
   if (management?.privilege_password)
     found.push("management.privilege_password, the platform has no privileged mode");
+  if (management?.snmp?.port)
+    found.push("management.snmp.port");
   if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
     found.push("management.ssh.auth_timeout and auth_retries");
   }
@@ -3224,10 +3258,16 @@ function unsupported3(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
     if (iface.type === "lag" && iface.addresses?.length)
       found.push(`interfaces.${name}.addresses, LAGs are switched`);
+    if (iface.mtu !== undefined)
+      found.push(`interfaces.${name}.mtu`);
     for (const group of iface.vrrp ?? [])
       if (familyOf(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
   }
+  for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+    if (vrf.description)
+      found.push(`vrfs.${name}.description`);
+  }
   const routing = device.routing;
   if (routing?.bgp)
     found.push("routing.bgp");
@@ -3258,6 +3298,9 @@ function unsupported3(device) {
   if (system2.dns || system2.logging || system2.release_channel || system2.banner) {
     found.push("system.dns, logging, release_channel and banner");
   }
+  if (system2.transceiver_monitoring !== undefined)
+    found.push("system.transceiver_monitoring");
+  found.push(...switchUnsupported(device));
   const flow = device.flow_export;
   if (flow && flow.protocol !== "sflow")
     found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
@@ -3437,10 +3480,10 @@ async function sendLibreNms(network2, additions) {
 
 // src/adapters/registries/peeringdb.ts
 var API = "https://www.peeringdb.com/api";
-var addressesOf = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+var addressesOf2 = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
 function peersWithRouteServer(device, iface) {
   const bgp = device.routing?.bgp;
-  const subnets = addressesOf(iface);
+  const subnets = addressesOf2(iface);
   return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
     const role = neighbor.role ?? group?.role;
@@ -3454,7 +3497,7 @@ function wanted(network2) {
       const exchange = iface.exchange;
       if (!exchange?.peeringdb_ixlan)
         continue;
-      const published = addressesOf(iface).map(host).filter(isGlobal);
+      const published = addressesOf2(iface).map(host).filter(isGlobal);
       records.push({
         name: exchange.name,
         ixlan_id: exchange.peeringdb_ixlan,
@@ -3572,6 +3615,243 @@ function snmpExporterAuths(network2) {
 
 // src/core/validate.ts
 import { X509Certificate as X509Certificate2 } from "node:crypto";
+
+// src/core/across.ts
+function checkAcross(devices) {
+  const holders2 = holdersOf(devices);
+  const owners = new Map;
+  for (const holder of holders2) {
+    const key = keyOf(host(holder.address));
+    if (!owners.has(key))
+      owners.set(key, holder);
+  }
+  return [
+    ...checkLinks(devices),
+    ...checkAddresses(holders2),
+    ...checkSessions(devices, owners),
+    ...checkVrrp(holders2),
+    ...checkTunnels(devices, owners)
+  ];
+}
+function carried(device, port) {
+  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
+  return {
+    access: id(port.access_vlan),
+    native: id(port.native_vlan),
+    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
+  };
+}
+function vlanNames(device, settings) {
+  const names = [settings.access_vlan, settings.native_vlan, ...settings.trunk_vlans ?? []].filter((name) => name !== undefined);
+  return new Map(names.flatMap((name) => device.vlans?.[name] ? [[device.vlans[name].id, name]] : []));
+}
+function carrierOf(device, portName, port) {
+  const lag = port.lag ? device.interfaces?.[port.lag] : undefined;
+  if (port.lag && lag?.type === "lag")
+    return { name: port.lag, settings: lag };
+  return { name: portName, settings: port };
+}
+var plainAddresses = (settings, family) => (settings.addresses ?? []).filter((entry) => typeof entry === "string" && isCidr(entry) && familyOf(entry) === family);
+function addressDisagreement(here, there, far, farName) {
+  for (const family of ["ipv4", "ipv6"]) {
+    const ours = plainAddresses(here, family);
+    const theirs = plainAddresses(there, family);
+    if (!ours.length || !theirs.length)
+      continue;
+    const theirPrefixes = new Set(theirs.map(network));
+    if (!ours.some((address) => theirPrefixes.has(network(address)))) {
+      return `has ${ours.join(", ")}, and ${far.name} ${farName} has ${theirs.join(", ")}: not one prefix of one length`;
+    }
+  }
+  const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host(typeof entry === "string" ? entry : entry.address))));
+  for (const entry of here.addresses ?? []) {
+    if (typeof entry === "string" || !keyOf(entry.peer) || farHosts.has(keyOf(entry.peer)))
+      continue;
+    return `${entry.address} names peer ${entry.peer}, which ${far.name} ${farName} does not hold`;
+  }
+  return;
+}
+function checkLinks(devices) {
+  const findings = [];
+  const byName = new Map(devices.map((device) => [device.name, device]));
+  for (const device of devices) {
+    for (const [portName, port] of Object.entries(device.ports ?? {})) {
+      const link = port?.link;
+      if (!port || !link)
+        continue;
+      const report = (message, level = "error") => findings.push({
+        level,
+        device: device.name,
+        message: `port ${portName} link: ${message}`
+      });
+      const far = byName.get(link.device);
+      if (!far) {
+        report(`device ${link.device} is not in the network`);
+        continue;
+      }
+      const farPort = far.ports?.[link.port];
+      if (!farPort) {
+        report(`${link.device} does not declare port ${link.port}`);
+        continue;
+      }
+      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
+      if (!linksBack) {
+        report(`${link.device} ${link.port} does not link back to it`);
+        continue;
+      }
+      const here = JSON.stringify(carried(device, port));
+      const there = JSON.stringify(carried(far, farPort));
+      if (here !== there)
+        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+      if (port.speed && farPort.speed && port.speed !== farPort.speed) {
+        report(`speed ${port.speed}, and ${link.device} ${link.port} is ${farPort.speed}`);
+      }
+      const near = carrierOf(device, portName, port);
+      const away = carrierOf(far, link.port, farPort);
+      const mtu = near.settings.mtu ?? 1500;
+      const farMtu = away.settings.mtu ?? 1500;
+      if (mtu !== farMtu)
+        report(`MTU ${mtu} on ${near.name}, and ${link.device} ${away.name} has ${farMtu}`);
+      const disagreement = addressDisagreement(near.settings, away.settings, far, away.name);
+      if (disagreement)
+        report(`${near.name} ${disagreement}`);
+      const farNames = vlanNames(far, away.settings);
+      for (const [id, name] of vlanNames(device, near.settings)) {
+        const farName = farNames.get(id);
+        if (farName && farName !== name)
+          report(`VLAN ${id} is ${name} here and ${farName} on ${link.device}`, "warning");
+      }
+    }
+  }
+  return findings;
+}
+function checkAddresses(holders2) {
+  const findings = [];
+  const first = new Map;
+  const isLoopback = (holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
+  for (const holder of holders2) {
+    const key = keyOf(host(holder.address));
+    const earlier = first.get(key);
+    if (!earlier) {
+      first.set(key, holder);
+      continue;
+    }
+    if (earlier.device === holder.device)
+      continue;
+    const anycast = isLoopback(earlier) && isLoopback(holder);
+    findings.push({
+      level: anycast ? "warning" : "error",
+      device: holder.device.name,
+      message: `${host(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`
+    });
+  }
+  return findings;
+}
+function checkSessions(devices, owners) {
+  const findings = [];
+  const sessionsOf = (device) => {
+    const bgp = device.routing?.bgp;
+    return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+      const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+      return {
+        name,
+        address: neighbor.address,
+        remoteAs: neighbor.remote_as ?? group?.remote_as,
+        localAddress: neighbor.local_address ?? group?.local_address
+      };
+    });
+  };
+  for (const device of devices) {
+    for (const session of sessionsOf(device)) {
+      const far = owners.get(keyOf(session.address) ?? "")?.device;
+      if (!far || far === device)
+        continue;
+      const report = (message) => findings.push({ level: "error", device: device.name, message: `neighbor ${session.name}: ${message}` });
+      const farBgp = far.routing?.bgp;
+      if (!farBgp) {
+        report(`${session.address} is ${far.name}'s, which runs no BGP`);
+        continue;
+      }
+      if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
+        report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
+      }
+      const back = sessionsOf(far).find((other) => owners.get(keyOf(other.address) ?? "")?.device === device && familyOf(other.address) === familyOf(session.address));
+      if (!back) {
+        report(`${far.name} has no session back to ${device.name}`);
+        continue;
+      }
+      if (session.localAddress && keyOf(session.localAddress) !== keyOf(back.address)) {
+        report(`starts from ${session.localAddress}, and ${far.name}'s session ${back.name} expects ${back.address}`);
+      }
+    }
+  }
+  return findings;
+}
+function checkVrrp(holders2) {
+  const findings = [];
+  const bySegment = new Map;
+  for (const holder of holders2) {
+    const segment = network(holder.address);
+    for (const group of holder.vrrp) {
+      if (!keyOf(group.address) || familyOf(group.address) !== familyOf(holder.address))
+        continue;
+      if (!contains(segment, group.address))
+        continue;
+      bySegment.set(segment, [...bySegment.get(segment) ?? [], { holder, id: group.id, address: group.address }]);
+    }
+  }
+  for (const members of bySegment.values()) {
+    for (const member of members) {
+      const where = `${member.holder.device.name} ${member.holder.name}`;
+      const others = members.filter((other) => other.holder.device !== member.holder.device);
+      const sameId = others.find((other) => other.id === member.id && keyOf(other.address) !== keyOf(member.address));
+      if (sameId) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP ${member.id} on ${member.holder.name} is ${member.address}, and on ${sameId.holder.device.name} ${sameId.holder.name} it is ${sameId.address}`
+        });
+      }
+      const sameAddress = others.find((other) => keyOf(other.address) === keyOf(member.address) && other.id !== member.id);
+      if (sameAddress) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP address ${member.address} is id ${member.id} on ${where}, and id ${sameAddress.id} on ${sameAddress.holder.device.name} ${sameAddress.holder.name}`
+        });
+      }
+    }
+  }
+  return findings;
+}
+function checkTunnels(devices, owners) {
+  const findings = [];
+  const ends = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "gre" || iface.type === "vxlan" ? [{ device, name, iface }] : []));
+  const same = (a, b) => keyOf(a) !== undefined && keyOf(a) === keyOf(b);
+  for (const end of ends) {
+    const far = owners.get(keyOf(end.iface.remote) ?? "")?.device;
+    if (!far || far === end.device)
+      continue;
+    const report = (message) => findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
+    const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
+    const mirror = ends.find((other) => other.device === far && other.iface.type === end.iface.type && same(other.iface.local, end.iface.remote) && same(other.iface.remote, end.iface.local));
+    if (!mirror) {
+      report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);
+      continue;
+    }
+    if (end.iface.type !== "vxlan" || mirror.iface.type !== "vxlan")
+      continue;
+    if (end.iface.vni !== mirror.iface.vni)
+      report(`VNI ${end.iface.vni}, and ${far.name} ${mirror.name} has ${mirror.iface.vni}`);
+    const port = end.iface.port ?? 4789;
+    const farPort = mirror.iface.port ?? 4789;
+    if (port !== farPort)
+      report(`UDP port ${port}, and ${far.name} ${mirror.name} has ${farPort}`);
+  }
+  return findings;
+}
+
+// src/core/validate.ts
 function validate(network2) {
   const findings = [];
   const seen = new Set;
@@ -3590,7 +3870,7 @@ function validate(network2) {
       for (const field of adapter.unsupported(device))
         report(`${device.platform} cannot express ${field}`);
   }
-  findings.push(...checkLinks(network2.devices));
+  findings.push(...checkAcross(network2.devices));
   for (const check of network2.checks ?? [])
     findings.push(...check(network2.devices));
   return findings;
@@ -3635,7 +3915,7 @@ function checkDevice(device, report) {
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
   checkVlans(device, report);
-  checkAddresses(device, report, cidr, ip);
+  checkAddresses2(device, report, cidr, ip);
   checkPorts(device, names, report);
   checkInterfaces(device, names, report, ip);
   checkRouting(device, names, report, cidr, ip);
@@ -3654,7 +3934,7 @@ function checkVlans(device, report) {
     ids.set(vlan.id, name);
   }
 }
-function checkAddresses(device, report, cidr, ip) {
+function checkAddresses2(device, report, cidr, ip) {
   const holderOf = new Map;
   const holders2 = [
     ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
@@ -3867,47 +4147,186 @@ function checkCertificates(device, names, report) {
     }
   }
 }
-function carried(device, port) {
-  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
-  return {
-    access: id(port.access_vlan),
-    native: id(port.native_vlan),
-    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
+
+// src/cli/graph.ts
+function markOf(graph, node) {
+  if (node.kind !== "device")
+    return;
+  const findings = graph.findings.filter((finding) => finding.device && deviceId(finding.device) === node.id);
+  if (findings.some((finding) => finding.level === "error"))
+    return "error";
+  const drift = graph.drift[node.label]?.status;
+  if (findings.length || drift === "differs" || drift === "cannot plan")
+    return "warning";
+  return;
+}
+function mermaid(graph) {
+  const ids = new Map(graph.nodes.map((node, index) => [node.id, `n${index}`]));
+  const text = (...lines2) => `"${lines2.map((line2) => line2.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
+  const shapes = {
+    device: (label) => `[${label}]`,
+    segment: (label) => `([${label}])`,
+    outside: (label) => `{{${label}}}`
+  };
+  const lines = ["graph LR"];
+  for (const node of graph.nodes) {
+    const label = node.kind === "device" ? text(node.label, node.detail[0] ?? "") : text(node.label);
+    lines.push(`    ${ids.get(node.id)}${shapes[node.kind](label)}`);
+  }
+  for (const edge of graph.edges) {
+    const arrow = edge.oneSided ? "-.-" : "---";
+    lines.push(`    ${ids.get(edge.from)} ${arrow}|${text(edge.label)}| ${ids.get(edge.to)}`);
+  }
+  lines.push("    classDef error stroke:#d1242f,stroke-width:3px", "    classDef warning stroke:#bf8700,stroke-width:3px", "    classDef outside stroke-dasharray:4 3");
+  for (const node of graph.nodes) {
+    const mark = markOf(graph, node) ?? (node.kind === "outside" ? "outside" : undefined);
+    if (mark)
+      lines.push(`    class ${ids.get(node.id)} ${mark}`);
+  }
+  return lines.join(`
+`) + `
+`;
+}
+function dot(graph) {
+  const text = (value2) => `"${value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+  const colors = { error: "#d1242f", warning: "#bf8700" };
+  const shapes = {
+    device: "shape=box, style=rounded",
+    segment: "shape=ellipse",
+    outside: "shape=box, style=dashed"
   };
+  const lines = [
+    "graph network {",
+    "    rankdir=LR;",
+    '    node [fontname="Helvetica"];',
+    '    edge [fontname="Helvetica", fontsize=10];'
+  ];
+  for (const node of graph.nodes) {
+    const label = node.kind === "device" ? `${node.label}
+${node.detail[0] ?? ""}` : node.label;
+    const mark = markOf(graph, node);
+    const color = mark ? `, color=${text(colors[mark])}, penwidth=2` : "";
+    lines.push(`    ${text(node.id)} [label=${text(label)}, ${shapes[node.kind]}${color}];`);
+  }
+  for (const edge of graph.edges) {
+    const style = edge.oneSided ? ", style=dashed" : "";
+    lines.push(`    ${text(edge.from)} -- ${text(edge.to)} [label=${text(edge.label)}${style}];`);
+  }
+  lines.push("}");
+  return lines.join(`
+`) + `
+`;
 }
-function checkLinks(devices) {
-  const findings = [];
-  const byName = new Map(devices.map((device) => [device.name, device]));
-  for (const device of devices) {
-    for (const [portName, port] of Object.entries(device.ports ?? {})) {
-      const link = port?.link;
-      if (!port || !link)
-        continue;
-      const report = (message) => findings.push({
-        level: "error",
-        device: device.name,
-        message: `port ${portName} link: ${message}`
+
+// src/cli/rename.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, renameSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join as join3, resolve as resolve2 } from "node:path";
+
+// src/core/files.ts
+import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2, relative } from "node:path";
+var SKIPPED = new Set(["node_modules", ".git", ".circuit", "dist"]);
+function projectSources(root2, directory = root2) {
+  const entries2 = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return entries2.flatMap((entry) => {
+    if (entry.isDirectory())
+      return SKIPPED.has(entry.name) ? [] : projectSources(root2, join2(directory, entry.name));
+    return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root2, join2(directory, entry.name))] : [];
+  });
+}
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function declaresDevice(text, name) {
+  const declares = new RegExp(`\\bname\\s*:\\s*(["'\`])${escape(name)}\\1`);
+  return text.includes("defineDevice") && declares.test(text);
+}
+function deviceFiles(root2, name, sources = projectSources(root2)) {
+  return sources.filter((file) => declaresDevice(readFileSync2(join2(root2, file), "utf8"), name));
+}
+
+// src/cli/rename.ts
+var escape2 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function planRename(root2, from, to, options) {
+  const changes2 = [];
+  const moves = [];
+  const exact = new RegExp(`(["'\`])${escape2(from)}\\1`, "g");
+  const anywhere = new RegExp(`(^|[^A-Za-z0-9_.-])${escape2(from)}(?![A-Za-z0-9_-])`);
+  const sources = projectSources(root2);
+  const declaring = new Set;
+  for (const file of sources) {
+    const text = readFileSync3(join3(root2, file), "utf8");
+    const lines = text.split(`
+`);
+    if (declaresDevice(text, from))
+      declaring.add(file);
+    for (const [index, before] of lines.entries()) {
+      const after = before.replace(exact, (_match, quote3) => `${quote3}${to}${quote3}`);
+      if (after !== before)
+        changes2.push({ file, line: index + 1, before, after });
+    }
+  }
+  if (!declaring.size) {
+    throw new Error(`no file declares name: "${from}"; the name may be built from parts, such as a template string, so rename it by hand`);
+  }
+  for (const snapshot of options.snapshots) {
+    moves.push({ from: snapshot, to: join3(dirname(snapshot), `${to}${extname(snapshot)}`) });
+  }
+  if (options.file) {
+    if (declaring.size > 1)
+      throw new Error(`${[...declaring].join(" and ")} both declare name: "${from}"; rename the file by hand`);
+    const [file] = [...declaring];
+    const target = join3(dirname(file), `${to}${extname(file)}`);
+    if (existsSync2(join3(root2, target)))
+      throw new Error(`${target} already exists`);
+    moves.push({ from: file, to: target });
+    changes2.push(...importChanges(root2, sources, file, target, changes2));
+  }
+  const mentions = sources.flatMap((file) => readFileSync3(join3(root2, file), "utf8").split(`
+`).flatMap((original, index) => {
+    const text = changes2.find((change) => change.file === file && change.line === index + 1)?.after ?? original;
+    return anywhere.test(text) ? [{ file, line: index + 1, text: text.trim() }] : [];
+  }));
+  return { changes: changes2, moves, mentions };
+}
+function importChanges(root2, sources, file, target, earlier) {
+  const result = [];
+  const withoutExtension = (path) => path.replace(/\.(ts|mts|cts|js|mjs|cjs)$/, "");
+  const moved = withoutExtension(resolve2(root2, file));
+  for (const source of sources) {
+    const lines = readFileSync3(join3(root2, source), "utf8").split(`
+`);
+    for (const [index, original] of lines.entries()) {
+      const line2 = index + 1;
+      const changed = earlier.find((change) => change.file === source && change.line === line2);
+      const before = changed?.after ?? original;
+      const after = before.replace(/(\bfrom\s+|\bimport\s*\(\s*)(["'])(\.{1,2}\/[^"']+)\2/g, (match, lead, quote3, specifier) => {
+        if (withoutExtension(resolve2(root2, dirname(source), specifier)) !== moved)
+          return match;
+        const extension = specifier.match(/\.(ts|mts|cts|js|mjs|cjs)$/)?.[0] ?? "";
+        const renamed = `${dirname(specifier)}/${basename(withoutExtension(target))}${extension}`;
+        return `${lead}${quote3}${renamed}${quote3}`;
       });
-      const far = byName.get(link.device);
-      if (!far) {
-        report(`device ${link.device} is not in the network`);
-        continue;
-      }
-      const farPort = far.ports?.[link.port];
-      if (!farPort) {
-        report(`${link.device} does not declare port ${link.port}`);
+      if (after === before)
         continue;
-      }
-      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
-      if (!linksBack)
-        report(`${link.device} ${link.port} does not link back to it`);
-      const here = JSON.stringify(carried(device, port));
-      const there = JSON.stringify(carried(far, farPort));
-      if (here !== there)
-        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+      if (changed)
+        changed.after = after;
+      else
+        result.push({ file: source, line: line2, before: original, after });
     }
   }
-  return findings;
+  return result;
+}
+function applyRename(root2, plan4) {
+  const files = new Set(plan4.changes.map((change) => change.file));
+  for (const file of files) {
+    const lines = readFileSync3(join3(root2, file), "utf8").split(`
+`);
+    for (const change of plan4.changes.filter((each) => each.file === file))
+      lines[change.line - 1] = change.after;
+    writeFileSync(join3(root2, file), lines.join(`
+`));
+  }
+  for (const move of plan4.moves)
+    renameSync(join3(root2, move.from), join3(root2, move.to));
 }
 
 // src/cli/index.ts
@@ -3930,6 +4349,22 @@ var HELP = `usage: circuit <command> [device...] [options]
   prometheus            every device with SNMP, as Prometheus targets for snmp_exporter
                           --auths        snmp_exporter's auths for them instead, with secrets as \${NAME}
   secrets               every secret the config uses, and whether each can be read
+  rename <device> <new-name>
+                        give a device a new name in every file that names it, with --confirm
+                          --file         also rename the file that declares it, to <new-name>.ts
+  addresses [prefix]    every address the config uses, by prefix, and what is still free
+                          --length=N     free prefixes of this length, instead of the fewest that cover the free space
+                          --format=json  as JSON
+  graph [device...]     the network as a graph, from the config alone, without contacting a device
+                          --layer=l1     l1, l2, l3, bgp, ospf or tunnels, several with commas, or all
+                          --format=mermaid  mermaid, dot or json
+  studio                Circuit Studio: the network in the browser, drawn again whenever the config changes
+                          --port=4600    the port it listens on
+                          --no-open      do not open the browser
+                          --host=0.0.0.0 listen on a server's address instead, with --allow-host
+                          --allow-host=studio.example.com
+                                         the names it is reached by, several with commas
+                          --json         print what Studio shows, as JSON, instead
 
   --config <path>       the network's config file, circuit.config.ts in the working directory by default`;
 var DEFAULT_CONFIG = "circuit.config.ts";
@@ -3946,12 +4381,12 @@ if (!command2 || command2 === "help" || command2 === "--help" || command2 === "-
 var configAt = args.indexOf("--config");
 var configArgument = configAt >= 0 ? args[configAt + 1] : args.find((arg) => arg.startsWith("--config="))?.slice("--config=".length);
 var rest = args.filter((arg, index) => index !== configAt && (configAt < 0 || index !== configAt + 1) && !arg.startsWith("--config="));
-var configPath = resolve2(process.cwd(), configArgument ?? DEFAULT_CONFIG);
-if (!existsSync2(configPath)) {
+var configPath = resolve3(process.cwd(), configArgument ?? DEFAULT_CONFIG);
+if (!existsSync3(configPath)) {
   console.error(configArgument ? `no config at ${configPath}` : `no ${DEFAULT_CONFIG} in ${process.cwd()}; name another with --config <path>`);
   process.exit(1);
 }
-var root2 = dirname(configPath);
+var root2 = dirname2(configPath);
 useRoot(root2);
 async function load(path) {
   if (process.versions.bun)
@@ -3983,9 +4418,9 @@ function one() {
   return device ?? fail("name a device");
 }
 var adapterOf = (device) => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-var generated = join2(root2, ".circuit");
-var stateDirectory = join2(generated, "state");
-var statePath = (device) => join2(stateDirectory, device.name + adapterOf(device).extension);
+var generated = join4(root2, ".circuit");
+var stateDirectory = join4(generated, "state");
+var statePath = (device) => join4(stateDirectory, device.name + adapterOf(device).extension);
 var GENERATED_README = `# Written by Circuit
 
 Do not edit anything here: an edit changes nothing on a device, and Circuit overwrites it. Change the config instead.
@@ -3994,8 +4429,8 @@ Do not edit anything here: an edit changes nothing on a device, and Circuit over
 `;
 function writeState(device, text) {
   mkdirSync(stateDirectory, { recursive: true });
-  writeFileSync(join2(generated, "README.md"), GENERATED_README);
-  writeFileSync(statePath(device), text);
+  writeFileSync2(join4(generated, "README.md"), GENERATED_README);
+  writeFileSync2(statePath(device), text);
 }
 function guard(devices) {
   const relevant = new Set(devices.map((device) => device.name));
@@ -4037,12 +4472,12 @@ function diffCommand() {
   let differences = 0;
   for (const device of devices) {
     const path = statePath(device);
-    if (!existsSync2(path)) {
+    if (!existsSync3(path)) {
       console.log(`${device.name}: no snapshot, run snapshot first`);
       continue;
     }
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
     differences += show(device, plan4);
   }
   process.exit(differences ? 1 : 0);
@@ -4054,13 +4489,13 @@ async function snapshotCommand() {
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
   }
-  if (names.length || !existsSync2(stateDirectory))
+  if (names.length || !existsSync3(stateDirectory))
     return;
-  const current = new Set(network2.devices.map((device) => basename(statePath(device))));
-  for (const file of readdirSync(stateDirectory)) {
+  const current = new Set(network2.devices.map((device) => basename2(statePath(device))));
+  for (const file of readdirSync2(stateDirectory)) {
     if (current.has(file))
       continue;
-    rmSync(join2(stateDirectory, file));
+    rmSync(join4(stateDirectory, file));
     console.log(`${file}: removed, no such device in the config`);
   }
 }
@@ -4223,6 +4658,162 @@ function secretsCommand() {
 ${references.length} secret(s), ${missing} missing.`);
   process.exit(missing ? 1 : 0);
 }
+var flagValue = (name) => flags.find((flag) => flag.startsWith(`--${name}=`))?.slice(name.length + 3);
+function driftOf(device) {
+  const path = statePath(device);
+  if (!existsSync3(path))
+    return { status: "no snapshot", lines: [] };
+  try {
+    const adapter = adapterOf(device);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
+    const lines = [
+      ...plan4.steps.flatMap((step) => [step.title, ...step.show.map((line2) => `  ${line2}`)]),
+      ...plan4.problems.map((problem) => `PROBLEM ${problem}`)
+    ];
+    return { status: lines.length ? "differs" : "matches", lines };
+  } catch (error) {
+    return { status: "cannot plan", lines: [error.message] };
+  }
+}
+function annotatedGraph(layers, deviceNames) {
+  const graph = only(graphOf(network2.devices), layers, deviceNames);
+  const shown = new Set(graph.nodes.map((node) => node.label));
+  return {
+    ...graph,
+    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
+    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
+  };
+}
+function graphCommand() {
+  const requested = (flagValue("layer") ?? "l1").split(",");
+  const layers = requested.includes("all") ? [...LAYERS] : requested;
+  const unknown = layers.filter((layer) => !LAYERS.includes(layer));
+  if (unknown.length)
+    fail(`no layer ${unknown.join(", ")}; known: ${LAYERS.join(", ")}, all`);
+  const format = flagValue("format") ?? "mermaid";
+  const devices = selected(true);
+  const annotated = annotatedGraph(layers, names.length ? devices.map((device) => device.name) : []);
+  if (format === "mermaid")
+    process.stdout.write(mermaid(annotated));
+  else if (format === "dot")
+    process.stdout.write(dot(annotated));
+  else if (format === "json")
+    console.log(JSON.stringify(annotated, null, 4));
+  else
+    fail(`no format ${format}; known: mermaid, dot, json`);
+}
+function printSegment(segment, indent) {
+  const next = segment.next ? `, next ${segment.next}` : "";
+  console.log(`${indent}${segment.prefix}, ${segment.free} free${next}`);
+  const width = Math.max(...segment.uses.map((use) => use.address.length)) + 2;
+  for (const use of segment.uses)
+    console.log(`${indent}    ${use.address.padEnd(width)}${use.what}`);
+}
+function addressesCommand() {
+  const [within] = names;
+  if (within && !isCidr(within))
+    fail(`${within} is not a prefix, such as 10.0.0.0/16`);
+  const lengthText = flagValue("length");
+  const length = lengthText === undefined ? undefined : Number(lengthText);
+  if (length !== undefined && !(Number.isInteger(length) && length >= 0 && length <= 128))
+    fail("--length takes a prefix length, such as 24");
+  const report = addressesOf(network2.devices, within);
+  if (flagValue("format") === "json") {
+    console.log(JSON.stringify(report, null, 4));
+    return;
+  }
+  for (const space of report.spaces) {
+    console.log(`${space.prefix}, ${space.owner}`);
+    for (const segment of space.segments)
+      printSegment(segment, "  ");
+    for (const block of space.blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+    if (length === undefined) {
+      console.log(`  free: ${space.free.join(", ") || "none"}`);
+    } else {
+      const { prefixes, total } = freeOfLength(space.free, length, 16);
+      const more = total > BigInt(prefixes.length) ? `, and ${total - BigInt(prefixes.length)} more` : "";
+      console.log(`  free /${length}: ${prefixes.join(", ") || "none"}${more}`);
+    }
+    console.log("");
+  }
+  const { segments, blocks } = report.elsewhere;
+  if (segments.length || blocks.length) {
+    console.log("Outside the space the network originates");
+    for (const segment of segments)
+      printSegment(segment, "  ");
+    for (const block of blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+  }
+  if (!report.spaces.length && !segments.length && !blocks.length)
+    console.log("The config holds no addresses.");
+}
+function renameCommand() {
+  const [from, to] = names;
+  if (!from || !to)
+    fail("usage: circuit rename <device> <new-name> [--file] [--confirm]");
+  const device = network2.devices.find((candidate) => candidate.name === from);
+  if (!device)
+    fail(`no device ${from}; known: ${network2.devices.map((candidate) => candidate.name).join(", ")}`);
+  if (network2.devices.some((candidate) => candidate.name === to))
+    fail(`${to} is already a device`);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(to))
+    fail(`${to} is not a hostname: letters, digits, dots, dashes and underscores`);
+  const snapshot = statePath(device);
+  const snapshots = existsSync3(snapshot) ? [relative2(root2, snapshot)] : [];
+  let plan4;
+  try {
+    plan4 = planRename(root2, from, to, { file: flags.includes("--file"), snapshots });
+  } catch (error) {
+    fail(error.message);
+  }
+  for (const change of plan4.changes) {
+    console.log(`${change.file}:${change.line}`);
+    console.log(`  - ${change.before.trim()}`);
+    console.log(`  + ${change.after.trim()}`);
+  }
+  for (const move of plan4.moves)
+    console.log(`move ${move.from} to ${move.to}`);
+  if (plan4.mentions.length) {
+    console.log(`
+Still naming ${from}, left as they are: change them by hand if they mean the device.`);
+    for (const mention of plan4.mentions)
+      console.log(`  ${mention.file}:${mention.line}  ${mention.text.slice(0, 160)}`);
+  }
+  if (!confirmed) {
+    console.log(`
+Nothing written. Re-run with --confirm.`);
+    return;
+  }
+  applyRename(root2, plan4);
+  console.log(`
+Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its old hostname until then.`);
+}
+async function studioCommand() {
+  if (flags.includes("--json")) {
+    const sources = projectSources(root2);
+    const data = studioData(network2.devices, annotatedGraph(LAYERS, []), {
+      render: (device) => adapterOf(device).render(device),
+      snapshot: (device) => existsSync3(statePath(device)) ? readFileSync4(statePath(device), "utf8") : undefined,
+      files: (device) => ({
+        source: deviceFiles(root2, device.name, sources)[0]?.split(sep).join("/"),
+        snapshot: existsSync3(statePath(device)) ? relative2(root2, statePath(device)).split(sep).join("/") : undefined
+      })
+    });
+    console.log(JSON.stringify(data));
+    return;
+  }
+  const port = Number(flagValue("port") ?? 4600);
+  if (!Number.isInteger(port) || port < 1 || port > 65535)
+    fail("--port takes a number from 1 to 65535");
+  const { isLoopback, studio } = await import("../chunks/server-5shmsmse.js");
+  const host2 = flagValue("host") ?? "127.0.0.1";
+  const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
+  if (!isLoopback(host2) && !allowHosts.length) {
+    fail(`Studio on ${host2} needs --allow-host=<name>, the name people reach it by, such as studio.example.com`);
+  }
+  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open"), host: host2, allowHosts });
+}
 var commands = {
   validate: validateCommand,
   build: buildCommand,
@@ -4235,7 +4826,11 @@ var commands = {
   peeringdb: peeringdbCommand,
   librenms: librenmsCommand,
   prometheus: prometheusCommand,
-  secrets: secretsCommand
+  secrets: secretsCommand,
+  rename: renameCommand,
+  addresses: addressesCommand,
+  graph: graphCommand,
+  studio: studioCommand
 };
 var run = commands[command2];
 if (run)