@takodotid/circuit 0.19.0 → 0.20.0

package/src/core/addresses.ts

@@ -0,0 +1,316 @@
+// Every address the config uses, by prefix, and what is still free: what `circuit addresses` prints. It reads the config only, so an address a device gave out by itself, such as a DHCP lease, is not known.
+
+import type { Device, Family } from "../schema";
+import {
+    contains,
+    familyOf,
+    formatAddress,
+    host,
+    isAddress,
+    isCidr,
+    network as prefixOf,
+    parse,
+    prefixesBetween,
+    rangeOf,
+    split,
+} from "./addr";
+import { holdersOf } from "./graph";
+
+/** One address or range in a segment, and what holds it. */
+export type Use = {
+    /** An address, or `first-last` for a range. */
+    address: string;
+    what: string;
+};
+
+/** A prefix our devices have addresses in. */
+export type Segment = {
+    prefix: string;
+    uses: Use[];
+    /** How many addresses no one uses, as a number written out, since an IPv6 count does not fit a JavaScript number. */
+    free: string;
+    /** The lowest free address, when there is one. */
+    next?: string;
+};
+
+/** A prefix in use without being a segment: a loopback's address, or a block routed elsewhere. */
+export type Block = {
+    prefix: string;
+    what: string;
+};
+
+/** Space the network owns: a prefix it originates in BGP, or one asked for. Everything in use inside it, and what is free. */
+export type Space = {
+    prefix: string;
+    /** Why it is listed, such as `originated by edge-01`. */
+    owner: string;
+    segments: Segment[];
+    blocks: Block[];
+    /** The fewest prefixes that cover what nothing uses. */
+    free: string[];
+};
+
+export type AddressReport = {
+    spaces: Space[];
+    /** What is in use outside every space. Left out when a prefix is asked for. */
+    elsewhere: { segments: Segment[]; blocks: Block[] };
+};
+
+/** A use as a range of numbers, for counting. */
+type Taken = { first: bigint; last: bigint };
+
+const bits = (family: Family) => (family === "ipv4" ? 32 : 128);
+const isHostRoute = (cidr: string) => split(cidr).len === bits(split(cidr).family);
+const numberOf = (address: string) => parse(address)!;
+
+/** Addresses a segment can give out: IPv4 leaves out the network and broadcast addresses below /31, and IPv6 the subnet-router anycast address. */
+function usable(prefix: string): Taken {
+    const { first, last, family } = rangeOf(prefix);
+    const { len } = split(prefix);
+
+    if (family === "ipv4" && len <= 30) return { first: first + 1n, last: last - 1n };
+    if (family === "ipv6" && len < 127) return { first: first + 1n, last };
+
+    return { first, last };
+}
+
+/** Ranges merged, so overlapping ones count once. */
+function merged(ranges: Taken[]): Taken[] {
+    const sorted = [...ranges].sort((a, b) => (a.first < b.first ? -1 : a.first > b.first ? 1 : 0));
+    const result: Taken[] = [];
+
+    for (const range of sorted) {
+        const previous = result.at(-1);
+        if (previous && range.first <= previous.last + 1n) previous.last = range.last > previous.last ? range.last : previous.last;
+        else result.push({ ...range });
+    }
+
+    return result;
+}
+
+/** What is inside `within` and not in any of the ranges. */
+function gaps(within: Taken, taken: Taken[]): Taken[] {
+    const result: Taken[] = [];
+    let cursor = within.first;
+
+    for (const range of merged(taken)) {
+        if (range.last < within.first || range.first > within.last) continue;
+        if (range.first > cursor) result.push({ first: cursor, last: range.first - 1n });
+        if (range.last + 1n > cursor) cursor = range.last + 1n;
+    }
+
+    if (cursor <= within.last) result.push({ first: cursor, last: within.last });
+    return result;
+}
+
+/** `12` or, for a count too long to read, `about 2^64`, to the nearest power of two. */
+function count(value: bigint): string {
+    if (value <= 1n << 20n) return String(value);
+
+    const power = value.toString(2).length - 1;
+    const nearer = value - (1n << BigInt(power)) >= 1n << BigInt(power - 1) ? power + 1 : power;
+    return `about 2^${nearer}`;
+}
+
+const byAddress = (a: Use, b: Use) => {
+    const first = (use: Use) => numberOf(use.address.split("-")[0]!);
+    return first(a) < first(b) ? -1 : first(a) > first(b) ? 1 : 0;
+};
+
+/** IPv4 before IPv6, then by first address. */
+function comparePrefixes(a: string, b: string): number {
+    const [ra, rb] = [rangeOf(a), rangeOf(b)];
+    if (ra.family !== rb.family) return ra.family === "ipv4" ? -1 : 1;
+    return ra.first < rb.first ? -1 : ra.first > rb.first ? 1 : 0;
+}
+
+const byPrefix = (a: { prefix: string }, b: { prefix: string }) => comparePrefixes(a.prefix, b.prefix);
+
+/** Every address in use, by segment, under the space the network owns. With `within`, only what falls inside that prefix, as the one space. */
+export function addressesOf(devices: readonly Device[], within?: string): AddressReport {
+    const segments = new Map<string, { uses: Use[]; taken: Taken[] }>();
+    const blocks: Block[] = [];
+
+    const segmentOf = (address: string) => [...segments.keys()].find((prefix) => contains(prefix, address));
+
+    // Segments come from the addresses on interfaces; a host route, such as a loopback's, is a block of its own.
+    for (const holder of holdersOf(devices)) {
+        const vrf = holder.device.ports?.[holder.name]?.vrf ?? holder.device.interfaces?.[holder.name]?.vrf;
+        const what = `${holder.device.name} ${holder.name}${vrf ? `, VRF ${vrf}` : ""}`;
+
+        if (isHostRoute(holder.address) || holder.peer) {
+            blocks.push({ prefix: `${host(holder.address)}/${bits(familyOf(holder.address))}`, what });
+            continue;
+        }
+
+        const prefix = prefixOf(holder.address);
+        const segment = segments.get(prefix) ?? { uses: [], taken: [] };
+        const value = numberOf(host(holder.address));
+
+        segment.uses.push({ address: host(holder.address), what });
+        segment.taken.push({ first: value, last: value });
+        segments.set(prefix, segment);
+
+        for (const group of holder.vrrp) {
+            if (!isAddress(group.address) || !contains(prefix, group.address)) continue;
+            if (segment.uses.some((use) => use.address === group.address)) continue;
+
+            const holders = devices.filter((device) =>
+                Object.values({ ...device.ports, ...device.interfaces }).some((settings) =>
+                    settings?.vrrp?.some((other) => other.id === group.id && other.address === group.address)
+                )
+            );
+
+            segment.uses.push({ address: group.address, what: `VRRP ${group.id} on ${holders.map((device) => device.name).join(", ")}` });
+            segment.taken.push({ first: numberOf(group.address), last: numberOf(group.address) });
+        }
+    }
+
+    // A use inside a segment is an address taken; outside every segment, a block of its own. An address one of our interfaces holds is listed once, as that interface.
+    const take = (address: string, what: string, first = address, last = address) => {
+        const prefix = segmentOf(first);
+        if (!prefix) return false;
+
+        const segment = segments.get(prefix)!;
+        if (segment.uses.some((use) => use.address === address)) return true;
+
+        segment.uses.push({ address, what });
+        segment.taken.push({ first: numberOf(first), last: numberOf(last) });
+        return true;
+    };
+
+    for (const device of devices) {
+        for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+            const [start, end] = server.pool;
+            if (isAddress(start) && isAddress(end)) take(`${start}-${end}`, `DHCP pool ${name} on ${device.name}`, start, end);
+
+            for (const reservation of server.reservations ?? []) {
+                if (isAddress(reservation.address))
+                    take(reservation.address, `reserved for ${reservation.description ?? reservation.mac} by ${device.name}`);
+            }
+        }
+
+        for (const route of device.routing?.static ?? []) {
+            if (route.via && isAddress(route.via)) take(route.via, `next hop for ${route.prefix} on ${device.name}`);
+        }
+
+        for (const [name, neighbor] of Object.entries(device.routing?.bgp?.neighbors ?? {})) {
+            if (isAddress(neighbor.address)) take(neighbor.address, `BGP neighbor ${name} of ${device.name}`);
+        }
+
+        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+            if (iface.type !== "wireguard") continue;
+
+            for (const peer of iface.peers ?? []) {
+                for (const allowed of peer.allowed_addresses) {
+                    if (!isCidr(allowed)) continue;
+
+                    const what = `WireGuard peer ${peer.name} on ${device.name} ${name}`;
+                    if (isHostRoute(allowed) && take(host(allowed), what)) continue;
+                    if (!segmentOf(host(allowed))) blocks.push({ prefix: prefixOf(allowed), what });
+                }
+            }
+        }
+    }
+
+    // Space the network owns: what it originates in BGP, or the prefix asked for.
+    const owners = new Map<string, string[]>();
+    for (const device of devices) {
+        for (const prefix of device.routing?.bgp?.networks ?? []) {
+            if (!isCidr(prefix)) continue;
+            owners.set(prefixOf(prefix), [...(owners.get(prefixOf(prefix)) ?? []), device.name]);
+        }
+    }
+
+    // A static route to a prefix no segment is in hands that block to whoever is at the next hop. A route covering segments or owned space, such as an aggregate, is not a use.
+    for (const device of devices) {
+        for (const route of device.routing?.static ?? []) {
+            if (!isCidr(route.prefix) || split(route.prefix).len === 0) continue;
+
+            const overlapsSegment = [...segments.keys()].some((prefix) => contains(route.prefix, prefix) || contains(prefix, route.prefix));
+            const coversOwned = [...owners.keys()].some((owned) => contains(route.prefix, owned));
+            if (overlapsSegment || coversOwned) continue;
+
+            const how = route.blackhole ? "discarded" : route.via ? `routed via ${route.via}` : `routed out ${route.interface}`;
+            blocks.push({ prefix: prefixOf(route.prefix), what: `${how} by ${device.name}` });
+        }
+    }
+
+    const asked = within ? prefixOf(within) : undefined;
+    const spacePrefixes = asked ? [asked] : [...owners.keys()];
+
+    // A segment or block belongs to the smallest space it is inside.
+    const spaceOf = (prefix: string) =>
+        spacePrefixes.filter((space) => contains(space, prefix)).sort((a, b) => split(b).len - split(a).len)[0];
+
+    const toSegment = (prefix: string): Segment => {
+        const { uses, taken } = segments.get(prefix)!;
+        const free = gaps(usable(prefix), taken);
+        const total = free.reduce((sum, range) => sum + range.last - range.first + 1n, 0n);
+        const family = familyOf(prefix);
+
+        return {
+            prefix,
+            uses: uses.sort(byAddress),
+            free: count(total),
+            ...(free[0] ? { next: formatAddress(free[0].first, family) } : {}),
+        };
+    };
+
+    const uniqueBlocks = blocks.filter(
+        (block, index) => blocks.findIndex((other) => other.prefix === block.prefix && other.what === block.what) === index
+    );
+
+    const spaces: Space[] = spacePrefixes.sort(comparePrefixes).map((space) => {
+        const inside = (prefix: string) => spaceOf(prefix) === space;
+        const spaceSegments = [...segments.keys()].filter(inside).sort(comparePrefixes);
+        const spaceBlocks = uniqueBlocks.filter((block) => inside(block.prefix)).sort(byPrefix);
+
+        // Smaller spaces inside this one are in use too.
+        const nested = spacePrefixes.filter((other) => other !== space && contains(space, other));
+        const taken = [...spaceSegments, ...spaceBlocks.map((block) => block.prefix), ...nested].map((prefix) => rangeOf(prefix));
+        const family = familyOf(space);
+
+        return {
+            prefix: space,
+            owner: asked && !owners.has(space) ? "asked for" : `originated by ${(owners.get(space) ?? []).join(", ")}`,
+            segments: spaceSegments.map(toSegment),
+            blocks: spaceBlocks,
+            free: gaps(rangeOf(space), taken).flatMap((range) => prefixesBetween(range.first, range.last, family)),
+        };
+    });
+
+    const outside = (prefix: string) => !spaceOf(prefix);
+
+    return {
+        spaces,
+        elsewhere: asked
+            ? { segments: [], blocks: [] }
+            : {
+                  segments: [...segments.keys()].filter(outside).sort(comparePrefixes).map(toSegment),
+                  blocks: uniqueBlocks.filter((block) => outside(block.prefix)).sort(byPrefix),
+              },
+    };
+}
+
+/** Free prefixes of one length inside the free space, up to `limit`, and how many there are in all. */
+export function freeOfLength(free: readonly string[], length: number, limit: number): { prefixes: string[]; total: bigint } {
+    const prefixes: string[] = [];
+    let total = 0n;
+
+    for (const prefix of free) {
+        const { len, family } = split(prefix);
+        if (len > length || length > bits(family)) continue;
+
+        const { first } = rangeOf(prefix);
+        const step = 1n << BigInt(bits(family) - length);
+        const fits = 1n << BigInt(length - len);
+        total += fits;
+
+        for (let index = 0n; index < fits && prefixes.length < limit; index++) {
+            prefixes.push(`${formatAddress(first + index * step, family)}/${length}`);
+        }
+    }
+
+    return { prefixes, total };
+}

package/src/core/files.ts

@@ -0,0 +1,30 @@
+// A project's own TypeScript files, and which of them declares a device: for renaming a device everywhere, and for a device's history.
+
+import { readdirSync, readFileSync } from "node:fs";
+import { join, relative } from "node:path";
+
+/** Directories that hold no config of the project's own. */
+const SKIPPED = new Set(["node_modules", ".git", ".circuit", "dist"]);
+
+/** Every TypeScript file of the project, relative to its root, in name order. */
+export function projectSources(root: string, directory = root): string[] {
+    const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
+
+    return entries.flatMap((entry) => {
+        if (entry.isDirectory()) return SKIPPED.has(entry.name) ? [] : projectSources(root, join(directory, entry.name));
+        return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root, join(directory, entry.name))] : [];
+    });
+}
+
+const escape = (text: string) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+
+/** Whether a file's text declares the device: it calls defineDevice and gives it the name, written out whole. */
+export function declaresDevice(text: string, name: string): boolean {
+    const declares = new RegExp(`\\bname\\s*:\\s*(["'\`])${escape(name)}\\1`);
+    return text.includes("defineDevice") && declares.test(text);
+}
+
+/** The project files that declare the device, relative to the root. */
+export function deviceFiles(root: string, name: string, sources = projectSources(root)): string[] {
+    return sources.filter((file) => declaresDevice(readFileSync(join(root, file), "utf8"), name));
+}

package/src/core/graph.ts

@@ -1,6 +1,7 @@
 // The network as a graph, read from the config alone: cables, the VLANs they carry, shared segments, BGP sessions, OSPF adjacencies and tunnels. `circuit graph` prints it and `circuit studio` draws it.
 
 import type { Device, Gre, Routed, Switched, Vxlan, WireGuardPeer } from "../schema";
+import type { Finding } from "./define";
 import { contains, familyOf, host, isAddress, isCidr, network as prefixOf, parse, split } from "./addr";
 
 /** One view of the network. Every edge belongs to one. */
@@ -47,8 +48,22 @@ export type Graph = {
     edges: GraphEdge[];
 };
 
+/** How a device compares with its last snapshot, found offline as `diff` finds it. */
+export type Drift = {
+    status: "matches" | "differs" | "no snapshot" | "cannot plan";
+    /** The plan `diff` would show, when it differs. */
+    lines: string[];
+};
+
+/** The graph with what `validate` found and how each device drawn compares with its snapshot. */
+export type Annotated = Graph & {
+    findings: Finding[];
+    /** By device name. */
+    drift: Record<string, Drift>;
+};
+
 /** An address one of the devices holds on a port or interface. */
-type Holder = {
+export type Holder = {
     device: Device;
     /** The port or interface. */
     name: string;
@@ -62,7 +77,7 @@ type Holder = {
 export const deviceId = (name: string) => `device:${name}`;
 
 /** An address as a key, so two spellings of one address compare equal. Undefined when it is not an address. */
-function keyOf(address: string | undefined): string | undefined {
+export function keyOf(address: string | undefined): string | undefined {
     if (!address || !isAddress(address)) return undefined;
     return `${familyOf(address)}:${parse(address)}`;
 }
@@ -93,7 +108,7 @@ class Builder {
 }
 
 /** Ports, then interfaces, that can hold an address. */
-function routedOf(device: Device): [string, Routed<string>][] {
+export function routedOf(device: Device): [string, Routed<string>][] {
     const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => (port ? [[name, port] as [string, Routed<string>]] : []));
     const interfaces = Object.entries(device.interfaces ?? {}) as [string, Routed<string>][];
 
@@ -101,7 +116,7 @@ function routedOf(device: Device): [string, Routed<string>][] {
 }
 
 /** Every valid address the devices hold. An invalid one is left for `validate` to report. */
-function holdersOf(devices: readonly Device[]): Holder[] {
+export function holdersOf(devices: readonly Device[]): Holder[] {
     return devices.flatMap((device) =>
         routedOf(device).flatMap(([name, settings]) =>
             (settings.addresses ?? []).flatMap((entry) => {
@@ -337,8 +352,14 @@ function sessions(devices: readonly Device[], owners: Map<string, Holder>, graph
         const far = ownerOf(session);
 
         if (far && far !== session.device) {
-            // The far device's session back: one that names an address this device holds.
-            const back = all.find((other) => other.device === far && !paired.has(other) && ownerOf(other) === session.device);
+            // The far device's session back: one of the same family that names an address this device holds.
+            const back = all.find(
+                (other) =>
+                    other.device === far &&
+                    !paired.has(other) &&
+                    ownerOf(other) === session.device &&
+                    familyOf(other.address) === familyOf(session.address)
+            );
             if (back) paired.add(back);
 
             graph.edge({

package/src/core/schema-docs.ts

@@ -0,0 +1,166 @@
+// The schema's own comments, read as data: each type, what it is, and each field with its type and description. The schema reference page and Studio both show them.
+
+/** The schema files in reading order, with the title each gets. */
+export const SCHEMA_FILES = [
+    ["device.ts", "Device"],
+    ["interfaces.ts", "Ports and interfaces"],
+    ["routing.ts", "Routing"],
+    ["policy.ts", "Route policies"],
+    ["firewall.ts", "Firewall and ACLs"],
+    ["system.ts", "System and management"],
+    ["common.ts", "Common values"],
+] as const;
+
+export type Field = { path: string; type: string; description: string };
+export type TypeDoc = { name: string; description: string; definition?: string; includes?: string[]; fields: Field[] };
+
+/** The text of a JSDoc comment, without its markers, as one paragraph. */
+function commentText(lines: string[]): string {
+    return lines
+        .map((line) => line.replace(/^\s*\/\*\*\s?|\s*\*\/\s*$|^\s*\*\s?/g, "").trim())
+        .filter(Boolean)
+        .join(" ");
+}
+
+/** What a type parameter stands for, where it is not one of the device's names. */
+const PARAMETER_MEANING: Record<string, string> = { Pl: "platform", M: "model" };
+
+/** A type as a reader needs it: "name" for each of the device's names, and no parameter list on the schema's own types. */
+function withoutGenerics(type: string, generics: Set<string>): string {
+    let result = type;
+    while (/NoInfer<([^<>]*)>/.test(result)) {
+        result = result.replace(/NoInfer<([^<>]*)>/g, (_, inner: string) => (inner.includes("|") ? `(${inner})` : inner));
+    }
+
+    for (const name of generics) {
+        result = result.replace(new RegExp(`\\b${name}<[^<>]*(?:<[^<>]*>[^<>]*)*>`, "g"), name);
+    }
+
+    return result
+        .replace(/\b(Pl|M|N|V|I|P|S|G|A|AS|U|F|C|L|K)\b/g, (parameter) => PARAMETER_MEANING[parameter] ?? "name")
+        .replace(/\bname(?: \| name)+\b/g, "name")
+        .replace(/\(name\)/g, "name");
+}
+
+function parse(source: string, generics: Set<string>): TypeDoc[] {
+    const lines = source.split("\n");
+    const types: TypeDoc[] = [];
+
+    let comment: string[] = [];
+    let inComment = false;
+    let current: TypeDoc | undefined;
+    let depth = 0;
+    const parents: string[] = [];
+    let header: string | undefined;
+
+    /** Reads a whole declaration: a type it aliases, the types whose fields it also has, and whether a body opens. */
+    function finishHeader(): void {
+        const text = header!;
+        header = undefined;
+
+        // The part after `=`, with the generic parameter list before it left out.
+        const body = text.slice(text.indexOf("> =") >= 0 ? text.indexOf("> =") + 3 : text.indexOf("=") + 1).trim();
+
+        if (!body.includes("{")) {
+            current!.definition = body.replace(/;$/, "").replace(/^\|\s*/, "");
+        } else {
+            const before = body.slice(0, body.indexOf("{"));
+            const included = before
+                .split("&")
+                .map((part) => part.trim())
+                .filter((part) => /^\w/.test(part));
+            if (included.length) current!.includes = included;
+        }
+
+        depth = (text.match(/{/g) ?? []).length - (text.match(/}/g) ?? []).length;
+    }
+
+    for (const line of lines) {
+        const trimmed = line.trim();
+
+        if (trimmed.startsWith("/**")) {
+            comment = [trimmed];
+            inComment = !trimmed.endsWith("*/");
+            continue;
+        }
+
+        if (inComment) {
+            comment.push(trimmed);
+            if (trimmed.endsWith("*/")) inComment = false;
+            continue;
+        }
+
+        // A declaration can span lines before its body opens or it ends.
+        if (header !== undefined) {
+            header += ` ${trimmed}`;
+            if (trimmed.endsWith("{") || trimmed.endsWith(";")) finishHeader();
+            continue;
+        }
+
+        // A type the schema does not export is documented too, since exported types take its fields.
+        const declaration = /^(?:export )?type (\w+)(<)?/.exec(trimmed);
+        if (declaration && depth === 0) {
+            if (declaration[2]) generics.add(declaration[1]!);
+
+            current = { name: declaration[1]!, description: commentText(comment), fields: [] };
+            types.push(current);
+            comment = [];
+
+            header = trimmed;
+            if (trimmed.endsWith("{") || trimmed.endsWith(";")) finishHeader();
+            continue;
+        }
+
+        if (!current) continue;
+
+        const field = /^(?:readonly\s+)?("?[\w-]+"?)(\?)?:\s*(.*)$/.exec(trimmed);
+        if (field && depth >= 1) {
+            const [, name, optional, rest] = field;
+            const path = [...parents, name!.replace(/"/g, "")].join(".");
+            const opensObject = rest!.trim().endsWith("{");
+            const type = opensObject ? "object" : rest!.replace(/;$/, "").trim();
+
+            current.fields.push({ path: `${path}${optional ? "?" : ""}`, type, description: commentText(comment) });
+            comment = [];
+
+            if (opensObject) {
+                parents.push(name!.replace(/"/g, ""));
+                depth++;
+            }
+            continue;
+        }
+
+        const opens = (trimmed.match(/{/g) ?? []).length;
+        const closes = (trimmed.match(/}/g) ?? []).length;
+
+        for (let index = 0; index < closes - opens; index++) {
+            if (parents.length >= depth - 1 && parents.length > 0) parents.pop();
+        }
+
+        depth += opens - closes;
+        if (depth <= 0) {
+            depth = 0;
+            parents.length = 0;
+        }
+
+        comment = [];
+    }
+
+    return types;
+}
+
+/** Every type in each schema file, in the order given. Every file is read first, so a type is known to take parameters wherever it is used. */
+export function schemaTypes(sources: readonly string[]): TypeDoc[][] {
+    const generics = new Set<string>();
+    const parsed = sources.map((source) => parse(source, generics));
+
+    for (const types of parsed) {
+        for (const type of types) {
+            if (type.definition) type.definition = withoutGenerics(type.definition, generics);
+            if (type.includes) type.includes = type.includes.map((name) => withoutGenerics(name, generics));
+            for (const field of type.fields) field.type = withoutGenerics(field.type, generics);
+        }
+    }
+
+    return parsed;
+}

package/src/core/validate.ts

@@ -4,6 +4,7 @@ import { X509Certificate } from "node:crypto";
 import { adapters } from "../adapters/devices";
 import { portsOf } from "../adapters/devices/catalog";
 import type { Device } from "../schema";
+import { checkAcross } from "./across";
 import { contains, familyOf, isAddress, isCidr } from "./addr";
 import type { Finding, Network } from "./define";
 
@@ -28,7 +29,7 @@ export function validate(network: Network): Finding[] {
         else for (const field of adapter.unsupported(device)) report(`${device.platform} cannot express ${field}`);
     }
 
-    findings.push(...checkLinks(network.devices));
+    findings.push(...checkAcross(network.devices));
     for (const check of network.checks ?? []) findings.push(...check(network.devices));
     return findings;
 }
@@ -327,54 +328,3 @@ function checkCertificates(device: Device, names: Names, report: Report): void {
         }
     }
 }
-
-/** The VLAN ids a port carries, by how it carries them, so two ends can be compared across devices. */
-function carried(device: Device, port: NonNullable<NonNullable<Device["ports"]>[string]>) {
-    const id = (vlan: string | undefined) => (vlan ? device.vlans?.[vlan]?.id : undefined);
-    return {
-        access: id(port.access_vlan),
-        native: id(port.native_vlan),
-        trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0)),
-    };
-}
-
-/** A link names a device and port that exist, the far end links back, and both ends carry the same VLANs the same way. */
-function checkLinks(devices: readonly Device[]): Finding[] {
-    const findings: Finding[] = [];
-    const byName = new Map(devices.map((device) => [device.name, device]));
-
-    for (const device of devices) {
-        for (const [portName, port] of Object.entries(device.ports ?? {})) {
-            const link = port?.link;
-            if (!port || !link) continue;
-
-            const report = (message: string) =>
-                findings.push({
-                    level: "error",
-                    device: device.name,
-                    message: `port ${portName} link: ${message}`,
-                });
-
-            const far = byName.get(link.device);
-            if (!far) {
-                report(`device ${link.device} is not in the network`);
-                continue;
-            }
-
-            const farPort = far.ports?.[link.port];
-            if (!farPort) {
-                report(`${link.device} does not declare port ${link.port}`);
-                continue;
-            }
-
-            const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
-            if (!linksBack) report(`${link.device} ${link.port} does not link back to it`);
-
-            const here = JSON.stringify(carried(device, port));
-            const there = JSON.stringify(carried(far, farPort));
-            if (here !== there) report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
-        }
-    }
-
-    return findings;
-}