@takodotid/circuit 0.19.0 → 0.21.0

package/dist/cli/index.js

@@ -1,26 +1,34 @@
 #!/usr/bin/env node
 import {
-  contains,
-  familyOf,
-  host,
-  isAddress,
-  isCidr,
-  isGlobal,
-  netmask,
-  network,
-  parse,
-  split,
-  wildcard
-} from "../chunks/index-dczpxzzm.js";
+  portsOf,
+  spell,
+  LAYERS,
+  deviceId,
+  keyOf,
+  holdersOf,
+  graphOf,
+  only,
+  addressesOf,
+  freeOfLength,
+  studioData
+} from "../chunks/index-n4zpd25n.js";
 import {
-  __require,
-  __toESM
-} from "../chunks/index-fq57hya4.js";
+  familyOf2,
+  split,
+  isAddress2,
+  isCidr2,
+  network,
+  contains2,
+  netmask,
+  wildcard,
+  host2,
+  isGlobal2
+} from "../chunks/index-v8zgr7wm.js";
 
 // src/cli/index.ts
 import { createPrivateKey, createPublicKey } from "node:crypto";
-import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
-import { basename, dirname, join as join2, resolve as resolve2 } from "node:path";
+import { existsSync as existsSync3, mkdirSync, readdirSync as readdirSync2, readFileSync as readFileSync4, rmSync, writeFileSync as writeFileSync2 } from "node:fs";
+import { basename as basename2, dirname as dirname2, join as join4, relative as relative2, resolve as resolve3, sep } from "node:path";
 
 // src/core/secrets.ts
 import { spawnSync } from "node:child_process";
@@ -86,10 +94,10 @@ function valueOf(reference) {
     const fullPath = join(root, path);
     if (!existsSync(fullPath))
       throw new Error(`secret file ${path} does not exist`);
-    const value2 = readFileSync(fullPath, "utf8").trimEnd();
-    if (!value2)
+    const value = readFileSync(fullPath, "utf8").trimEnd();
+    if (!value)
       throw new Error(`secret file ${path} is empty`);
-    return value2;
+    return value;
   }
   const value = process.env[reference] || dotenv()[reference];
   if (!value)
@@ -119,9 +127,9 @@ function offset(zone) {
 // src/transport/ssh.ts
 import { Client } from "ssh2";
 function connect(login) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const client = new Client;
-    client.on("ready", () => resolve2(client)).on("error", reject).connect({
+    client.on("ready", () => resolve(client)).on("error", reject).connect({
       host: login.host,
       port: login.port ?? 22,
       username: login.user,
@@ -132,29 +140,29 @@ function connect(login) {
   });
 }
 function exec(client, command, timeout = 120000) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     client.exec(command, (error, stream) => {
       if (error)
         return reject(error);
       let output = "";
       const append = (chunk) => output += chunk.toString("utf8");
-      const timer = setTimeout(() => resolve2(output.trim()), timeout);
+      const timer = setTimeout(() => resolve(output.trim()), timeout);
       stream.on("data", append);
       stream.stderr.on("data", append);
       stream.on("close", () => {
         clearTimeout(timer);
-        resolve2(output.trim());
+        resolve(output.trim());
       });
     });
   });
 }
 function shell(client, columns = 200, rows = 1000) {
-  return new Promise((resolve2, reject) => {
-    client.shell({ cols: columns, rows }, (error, channel) => error ? reject(error) : resolve2(channel));
+  return new Promise((resolve, reject) => {
+    client.shell({ cols: columns, rows }, (error, channel) => error ? reject(error) : resolve(channel));
   });
 }
 function readUntil(channel, done, timeout, settle = 400) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     let output = "";
     let finished = false;
     const finish = () => {
@@ -162,7 +170,7 @@ function readUntil(channel, done, timeout, settle = 400) {
         return;
       finished = true;
       channel.removeListener("data", onData);
-      resolve2(output);
+      resolve(output);
     };
     const onData = (chunk) => {
       output += chunk.toString("utf8");
@@ -176,12 +184,12 @@ function readUntil(channel, done, timeout, settle = 400) {
 function send(channel, line, timeout = 20000, settle = 1500) {
   channel.write(line + `
 `);
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     let output = "";
     let timer;
     const finish = () => {
       channel.removeListener("data", onData);
-      resolve2(output);
+      resolve(output);
     };
     const onData = (chunk) => {
       output += chunk.toString("utf8");
@@ -193,7 +201,7 @@ function send(channel, line, timeout = 20000, settle = 1500) {
   });
 }
 function upload(client, path, content) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     client.sftp((error, sftp) => {
       if (error)
         return reject(error);
@@ -202,50 +210,12 @@ function upload(client, path, content) {
         if (writeError)
           reject(writeError);
         else
-          resolve2();
+          resolve();
       });
     });
   });
 }
 
-// src/adapters/devices/raisecom-ros/models.ts
-var models = {
-  "RAX721-C-6C48": {
-    ports: { "100g": 6, "25g": 24, "10g": 24 },
-    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
-  }
-};
-
-// src/adapters/devices/routeros/models.ts
-var models2 = {
-  "CCR2216-1G-12XS-2XQ": {
-    ports: { "100g": 2, "25g": 12, "1g": 1 },
-    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" }
-  }
-};
-
-// src/adapters/devices/vrp/models.ts
-var models3 = {
-  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
-};
-
-// src/adapters/devices/catalog.ts
-var catalog = { routeros: models2, vrp: models3, "raisecom-ros": models };
-function portsOf(platform, model) {
-  const spec = catalog[platform]?.[model];
-  if (!spec)
-    throw new Error(`${platform} has no model ${model}`);
-  return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
-}
-function spell(platform, model, port) {
-  const spec = catalog[platform]?.[model];
-  const parts = /^(\d+[gm])-(\d+)$/.exec(port);
-  const template = parts && spec?.spelling[parts[1]];
-  if (!template)
-    throw new Error(`${model} has no port ${port}`);
-  return template.replace("{n}", parts[2]);
-}
-
 // src/adapters/devices/derive.ts
 function lagIds(device) {
   const numbers = new Map;
@@ -261,7 +231,37 @@ function lagIds(device) {
 function ipv4Networks(device, iface) {
   const settings = device.interfaces?.[iface] ?? device.ports?.[iface];
   const addresses = (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
-  return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
+  return addresses.filter((address) => familyOf2(address) === "ipv4").map((address) => network(address));
+}
+var SWITCH_SERVICES = ["ssh", "telnet", "snmp"];
+function switchUnsupported(device) {
+  const found = [];
+  for (const service of SWITCH_SERVICES) {
+    const settings = device.management?.[service];
+    if (settings?.allow)
+      found.push(`management.${service}.allow, every service takes management.allow`);
+    if (settings?.port)
+      found.push(`management.${service}.port`);
+  }
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    if (user.description)
+      found.push(`users.${name}.description`);
+    if (user.ssh_keys?.length)
+      found.push(`users.${name}.ssh_keys`);
+  }
+  if (device.system?.ip)
+    found.push("system.ip");
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (port?.hardware_offload !== undefined)
+      found.push(`ports.${name}.hardware_offload`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.addresses?.some((entry) => typeof entry !== "string"))
+      found.push(`interfaces.${name}.addresses with a peer`);
+    if (iface.hardware_offload !== undefined)
+      found.push(`interfaces.${name}.hardware_offload`);
+  }
+  return found;
 }
 
 // src/adapters/devices/lines.ts
@@ -353,7 +353,7 @@ function compare(desired, current, dialect) {
   }
   return [...groups.values()].filter((group) => group.add.length || group.remove.length);
 }
-function vlanListChange(groups, prefix, parse2, format, removal) {
+function vlanListChange(groups, prefix, parse, format, removal) {
   const top = groups.find((group) => group.path.length === 0);
   if (!top)
     return;
@@ -361,8 +361,8 @@ function vlanListChange(groups, prefix, parse2, format, removal) {
   const fresh = top.add.find((line) => line.startsWith(prefix));
   if (!old && !fresh)
     return;
-  const before = old ? parse2(old) : [];
-  const after = fresh ? parse2(fresh) : [];
+  const before = old ? parse(old) : [];
+  const after = fresh ? parse(fresh) : [];
   top.remove = top.remove.filter((line) => line !== old);
   top.add = top.add.filter((line) => line !== fresh);
   const added = after.filter((id) => !before.includes(id));
@@ -500,7 +500,7 @@ function render(device) {
   }
   if (allow.length) {
     lines.push(`access-list ${MANAGEMENT_ACL}`, "  description management");
-    allow.forEach((cidr, index) => lines.push(`  rule ${(index + 1) * 10} permit ${host(cidr)} ${netmask(split(cidr).len)}`));
+    allow.forEach((cidr, index) => lines.push(`  rule ${(index + 1) * 10} permit ${host2(cidr)} ${netmask(split(cidr).len)}`));
     lines.push("  rule 100 deny any", "!");
   }
   for (const [name, user] of Object.entries(device.users ?? {}))
@@ -525,8 +525,8 @@ function render(device) {
     lines.push(`interface vlan ${vlanId(iface.vlan)}`);
     for (const entry of iface.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
-      if (familyOf(address) === "ipv4")
-        lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+      if (familyOf2(address) === "ipv4")
+        lines.push(`ip address ${host2(address)} ${netmask(split(address).len)}`);
     }
     const ospfSettings = Object.values(ospf?.areas ?? {}).find((area) => area.interfaces[name])?.interfaces[name];
     if (ospfSettings?.network === "point-to-point")
@@ -545,7 +545,7 @@ function render(device) {
     for (const [areaId, area] of Object.entries(ospf.areas)) {
       for (const iface of Object.keys(area.interfaces)) {
         for (const prefix of ipv4Networks(device, iface)) {
-          lines.push(`network ${host(prefix)} ${wildcard(split(prefix).len)} area ${areaId}`);
+          lines.push(`network ${host2(prefix)} ${wildcard(split(prefix).len)} area ${areaId}`);
         }
       }
     }
@@ -580,7 +580,7 @@ function render(device) {
     lines.push(`snmp-server access-list ${MANAGEMENT_ACL}`);
   for (const route of device.routing?.static ?? []) {
     const { addr, len } = split(route.prefix);
-    if (familyOf(addr) === "ipv4" && route.via)
+    if (familyOf2(addr) === "ipv4" && route.via)
       lines.push(`ip route ${addr} ${netmask(len)} ${route.via}`);
   }
   if (management.telnet) {
@@ -716,10 +716,17 @@ function unsupported(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
       continue;
     }
-    if (iface.vrf)
-      found.push(`interfaces.${name}.vrf`);
+    for (const field of ["vrf", "description", "mtu", "ipv6_ra"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}`);
+    }
+    for (const entry of iface.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      if (familyOf2(address) === "ipv6")
+        found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
+    }
     for (const group of iface.vrrp ?? []) {
-      if (familyOf(group.address) === "ipv6")
+      if (familyOf2(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
     }
   }
@@ -740,8 +747,15 @@ function unsupported(device) {
     }
   }
   for (const route of routing?.static ?? []) {
-    if (!route.via || route.vrf)
+    if (!route.via || route.vrf || familyOf2(route.prefix) === "ipv6") {
       found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+    }
+    if (route.description || route.distance)
+      found.push(`routing.static ${route.prefix} description and distance`);
+  }
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    if (vlan.description)
+      found.push(`vlans.${name}.description`);
   }
   const UNSUPPORTED_SECTIONS = [
     "firewall",
@@ -768,6 +782,10 @@ function unsupported(device) {
     if (!SNMP_AUTH[user.auth])
       found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
   }
+  if (management.snmp?.contact || management.snmp?.location)
+    found.push("management.snmp.contact and location");
+  if (management.ssh?.weak_crypto)
+    found.push("management.ssh.weak_crypto");
   if (device.lldp && device.lldp !== true)
     found.push("lldp.interfaces, LLDP is per device");
   if (device.stp?.mode && device.stp.mode !== "mstp")
@@ -780,6 +798,7 @@ function unsupported(device) {
   if (system.dns || system.logging || system.release_channel || system.banner || system.ntp?.serve) {
     found.push("system.dns, logging, release_channel, banner and ntp.serve");
   }
+  found.push(...switchUnsupported(device));
   return found;
 }
 var REFUSED = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
@@ -961,7 +980,7 @@ function parseLine(menu, line) {
   }
   return { menu, verb, selector, flags, attrs };
 }
-function parse2(text) {
+function parse(text) {
   const commands = [];
   const generated = new Set;
   let menu = "";
@@ -972,9 +991,9 @@ function parse2(text) {
       menu = line;
       continue;
     }
-    const marker2 = /^# generated (\S+)$/.exec(line);
-    if (marker2)
-      generated.add(marker2[1]);
+    const marker = /^# generated (\S+)$/.exec(line);
+    if (marker)
+      generated.add(marker[1]);
     if (menu && /^(add|set)( |$)/.test(line))
       commands.push(parseLine(menu, line));
   }
@@ -1064,12 +1083,12 @@ function normalValue(command, property, value) {
   if (property === "tagged" || property === "untagged" || property === "slaves")
     return value.split(",").sort().join(",");
   const onInterface = property === "address" && (command.menu === "/ip address" || command.menu === "/ipv6 address");
-  const isAddress2 = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
+  const isAddress = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
   if (onInterface && !value.includes("/"))
     return `${value}/${value.includes(":") ? 64 : 32}`;
-  if (!onInterface && isAddress2 && /^[\d.]+\/32$/.test(value))
+  if (!onInterface && isAddress && /^[\d.]+\/32$/.test(value))
     return value.slice(0, -3);
-  if (!onInterface && isAddress2 && value.includes(":") && !value.includes("/") && !value.includes(","))
+  if (!onInterface && isAddress && value.includes(":") && !value.includes("/") && !value.includes(","))
     return `${value}/128`;
   return value;
 }
@@ -1398,13 +1417,13 @@ function planOrdered(menu, wanted, existing) {
     const inKeptChain = `[:typeof [:find $keep [${menu} get $id chain]]] != "nil"`;
     removeOld = `:local keep {${keep}}; :foreach id in=$${OLD_RULES} do={ :if (${inKeptChain}) do={ ${menu} remove $id } }`;
   }
-  const send2 = [
+  const send = [
     `:global ${OLD_RULES} [${menu} find${where}]`,
     ...wanted.map((item) => line(menu, "add", "", item.flags, item.attrs)),
     `:global ${OLD_RULES}; ${removeOld}; /system script environment remove [find name="${OLD_RULES}"]`
   ];
   const show = [...existing.map((item) => `- ${canonical(item)}`), ...wanted.map((item) => `+ ${canonical(item)}`)];
-  result.first.push({ title: `${menu}, in the order of the config`, show, send: send2 });
+  result.first.push({ title: `${menu}, in the order of the config`, show, send });
   if (hasChains) {
     for (const chain of droppedChains) {
       const selector = `[ find chain=${quote(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
@@ -1414,8 +1433,8 @@ function planOrdered(menu, wanted, existing) {
   return result;
 }
 function plan2(desired, current, options) {
-  const want = parse2(desired);
-  const have = parse2(current);
+  const want = parse(desired);
+  const have = parse(current);
   const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
   const wantedByMenu = byMenu(want.commands.filter(owned));
   const existingByMenu = byMenu(have.commands.filter(owned));
@@ -1460,22 +1479,22 @@ class Output {
 `;
   }
 }
-function quote2(value2) {
-  const plain = /^[\w.:/@-]+$/.test(value2);
+function quote2(value) {
+  const plain = /^[\w.:/@-]+$/.test(value);
   if (plain)
-    return value2;
-  const escaped = value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
+    return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
   return `"${escaped}"`;
 }
 function command(verb, properties) {
-  const words2 = [verb];
-  for (const [name, value2] of Object.entries(properties)) {
-    if (value2 === undefined || value2 === false)
+  const words = [verb];
+  for (const [name, value] of Object.entries(properties)) {
+    if (value === undefined || value === false)
       continue;
-    const written = typeof value2 === "number" ? String(value2) : quote2(value2);
-    words2.push(`${name}=${written}`);
+    const written = typeof value === "number" ? String(value) : quote2(value);
+    words.push(`${name}=${written}`);
   }
-  return words2.join(" ");
+  return words.join(" ");
 }
 var yesNo = (on) => on ? "yes" : "no";
 var familySuffix = (family) => family === "ipv4" ? "V4" : "V6";
@@ -1738,7 +1757,7 @@ function splitEndpoint(endpoint) {
 function vrrp(out, ctx) {
   for (const { name, settings } of ctx.routed()) {
     for (const group of settings.vrrp ?? []) {
-      const ipv6 = familyOf(group.address) === "ipv6";
+      const ipv6 = familyOf2(group.address) === "ipv6";
       out.add("/interface vrrp", command("add", {
         interface: name,
         interval: group.interval ? duration(group.interval) : undefined,
@@ -1864,7 +1883,7 @@ function addresses(out, ctx) {
     for (const entry of settings.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
       const peer = typeof entry === "string" ? undefined : entry.peer;
-      if (familyOf(address) === "ipv4") {
+      if (familyOf2(address) === "ipv4") {
         out.add("/ip address", command("add", { address, comment: settings.description, interface: name, network: peer }));
       } else {
         out.add("/ipv6 address", command("add", { address, advertise: yesNo(settings.ipv6_ra), comment: settings.description, interface: name }));
@@ -1873,7 +1892,7 @@ function addresses(out, ctx) {
     for (const group of settings.vrrp ?? []) {
       const vrrpInterface = vrrpName(name, group.id);
       const comment = `VRRP ${group.id} on ${name}`;
-      if (familyOf(group.address) === "ipv4") {
+      if (familyOf2(group.address) === "ipv4") {
         out.add("/ip address", command("add", { address: `${group.address}/32`, comment, interface: vrrpInterface }));
       } else {
         out.add("/ipv6 address", command("add", {
@@ -1915,30 +1934,30 @@ function dhcp(out, ctx) {
   }
 }
 function dns(out, ctx) {
-  const dns2 = ctx.device.system?.dns;
-  out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns2?.serve), servers: dns2?.servers.join(",") ?? "" }));
+  const dns = ctx.device.system?.dns;
+  out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns?.serve), servers: dns?.servers.join(",") ?? "" }));
 }
 function addressLists(out, ctx) {
   const { device } = ctx;
-  const entries2 = [];
+  const entries = [];
   for (const [list, members] of Object.entries(device.firewall?.address_sets ?? {})) {
     for (const address of members)
-      entries2.push({ list, address });
+      entries.push({ list, address });
   }
   for (const [list, set] of Object.entries(device.prefix_sets ?? {})) {
     if ("prefixes" in set)
       for (const address of set.prefixes)
-        entries2.push({ list, address });
+        entries.push({ list, address });
     else
       out.add("/ip firewall address-list", `# generated ${list}`);
   }
   for (const prefix of device.routing?.bgp?.networks ?? []) {
-    entries2.push({ list: NETWORKS[familyOf(host(prefix))], address: prefix });
+    entries.push({ list: NETWORKS[familyOf2(host2(prefix))], address: prefix });
   }
   for (const family of ["ipv4", "ipv6"]) {
     const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
-    for (const { list, address } of entries2) {
-      if (familyOf(host(address)) !== family)
+    for (const { list, address } of entries) {
+      if (familyOf2(host2(address)) !== family)
         continue;
       out.add(menu, command("add", { address, list }));
     }
@@ -1958,7 +1977,7 @@ function renderFirewall(out, ctx) {
 function untracked(out, ctx, family) {
   const menu = family === "ipv4" ? "/ip firewall raw" : "/ipv6 firewall raw";
   for (const prefix of ctx.device.firewall?.untracked ?? []) {
-    if (familyOf(prefix) !== family)
+    if (familyOf2(prefix) !== family)
       continue;
     for (const [direction, property] of [
       ["to", "dst-address"],
@@ -1975,8 +1994,8 @@ function families(ctx, match) {
   if (match?.family)
     candidates = [match.family];
   else if (address)
-    candidates = [familyOf(address)];
-  const setHas = (set, family) => !set || (sets[set] ?? []).some((member) => familyOf(member) === family);
+    candidates = [familyOf2(address)];
+  const setHas = (set, family) => !set || (sets[set] ?? []).some((member) => familyOf2(member) === family);
   return candidates.filter((family) => setHas(match?.src_set, family) && setHas(match?.dst_set, family));
 }
 function matchProperties(ctx, match, family) {
@@ -2027,7 +2046,7 @@ function nat(out, ctx, family) {
     for (const rule of rules ?? []) {
       if (!families(ctx, rule.match).includes(family))
         continue;
-      if (rule.action !== "masquerade" && familyOf(rule.to) !== family)
+      if (rule.action !== "masquerade" && familyOf2(rule.to) !== family)
         continue;
       const action = rule.action === "masquerade" ? {
         action: "masquerade"
@@ -2049,7 +2068,7 @@ function switchAcls(out, ctx) {
       continue;
     for (const rule of ctx.device.acls?.[settings.acl] ?? []) {
       const match = rule.match ?? {};
-      const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address2) => address2 && familyOf(address2) === "ipv6");
+      const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address) => address && familyOf2(address) === "ipv6");
       const address = (prefix) => prefix && !ipv6 ? dottedMask(prefix) : prefix;
       for (const srcPort of each(match.src_port)) {
         for (const dstPort of each(match.dst_port)) {
@@ -2094,7 +2113,7 @@ function renderRouting(out, ctx) {
 }
 function staticRoutes(out, ctx) {
   for (const route of ctx.device.routing?.static ?? []) {
-    const menu = familyOf(host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
+    const menu = familyOf2(host2(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
     const verb = route.blackhole ? "add blackhole" : "add";
     const gateway = route.via ?? (route.interface ? ctx.name(route.interface) : undefined);
     out.add(menu, command(verb, {
@@ -2125,21 +2144,21 @@ function settingsOf(ctx, neighbor) {
   return { ...group, ...neighbor };
 }
 function familiesOf(ctx, neighbor) {
-  return settingsOf(ctx, neighbor).families ?? [familyOf(neighbor.address)];
+  return settingsOf(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
 }
 var chainName = (policy, family) => `${policy}-${familySuffix(family)}`;
 function appliesTo(ctx, rule, family) {
   const match = rule.match;
   if (match?.family && match.family !== family)
     return false;
-  if (match?.prefix && familyOf(host(match.prefix)) !== family)
+  if (match?.prefix && familyOf2(host2(match.prefix)) !== family)
     return false;
   if (match?.prefix_set) {
     const set = ctx.device.prefix_sets?.[match.prefix_set];
     if (!set)
       return false;
     const firstPrefix = "source" in set ? undefined : set.prefixes[0];
-    const setFamily = "source" in set ? set.source.family : firstPrefix && familyOf(host(firstPrefix));
+    const setFamily = "source" in set ? set.source.family : firstPrefix && familyOf2(host2(firstPrefix));
     if (setFamily !== family)
       return false;
   }
@@ -2170,35 +2189,35 @@ function conditions(rule) {
 }
 function actions(rule, family) {
   const set = rule.set ?? {};
-  const steps2 = [];
+  const steps = [];
   if (set.local_pref !== undefined)
-    steps2.push(`set bgp-local-pref ${set.local_pref}`);
+    steps.push(`set bgp-local-pref ${set.local_pref}`);
   if (set.med !== undefined)
-    steps2.push(`set bgp-med ${set.med}`);
+    steps.push(`set bgp-med ${set.med}`);
   if (set.prepend !== undefined)
-    steps2.push(`set bgp-path-prepend ${set.prepend}`);
+    steps.push(`set bgp-path-prepend ${set.prepend}`);
   for (const pattern of set.remove_communities ?? [])
-    steps2.push(`delete bgp-communities regexp "${communityPattern(pattern)}"`);
+    steps.push(`delete bgp-communities regexp "${communityPattern(pattern)}"`);
   if (set.communities)
-    steps2.push(`set bgp-communities ${set.communities.join(",")}`);
+    steps.push(`set bgp-communities ${set.communities.join(",")}`);
   if (set.add_communities)
-    steps2.push(`append bgp-communities ${set.add_communities.join(",")}`);
+    steps.push(`append bgp-communities ${set.add_communities.join(",")}`);
   for (const pattern of set.remove_large_communities ?? []) {
-    steps2.push(`delete bgp-large-communities regexp "${communityPattern(pattern)}"`);
+    steps.push(`delete bgp-large-communities regexp "${communityPattern(pattern)}"`);
   }
   if (set.large_communities)
-    steps2.push(`set bgp-large-communities ${set.large_communities.join(",")}`);
+    steps.push(`set bgp-large-communities ${set.large_communities.join(",")}`);
   if (set.add_large_communities)
-    steps2.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
-  if (set.next_hop && familyOf(set.next_hop) === family)
-    steps2.push(`set gw ${set.next_hop}`);
-  if (set.preferred_source && familyOf(set.preferred_source) === family)
-    steps2.push(`set pref-src ${set.preferred_source}`);
+    steps.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
+  if (set.next_hop && familyOf2(set.next_hop) === family)
+    steps.push(`set gw ${set.next_hop}`);
+  if (set.preferred_source && familyOf2(set.preferred_source) === family)
+    steps.push(`set pref-src ${set.preferred_source}`);
   if (set.blackhole)
-    steps2.push("set blackhole yes");
+    steps.push("set blackhole yes");
   if (rule.action)
-    steps2.push(rule.action);
-  return steps2;
+    steps.push(rule.action);
+  return steps;
 }
 function ruleText(rule, family) {
   const parts = [];
@@ -2207,24 +2226,24 @@ function ruleText(rule, family) {
   if (rule.match?.rpki)
     parts.push(`rpki-verify ${RPKI_GROUP}`);
   const tests = conditions(rule);
-  const steps2 = actions(rule, family);
+  const steps = actions(rule, family);
   if (tests.length)
-    parts.push(`if (${tests.join(" && ")})${steps2.length ? ` { ${steps2.join("; ")} }` : ""}`);
+    parts.push(`if (${tests.join(" && ")})${steps.length ? ` { ${steps.join("; ")} }` : ""}`);
   else
-    parts.push(...steps2);
+    parts.push(...steps);
   return parts.join("; ");
 }
 function policies(out, ctx) {
   const bgp = ctx.device.routing.bgp;
-  const policies2 = ctx.device.policies ?? {};
+  const policies = ctx.device.policies ?? {};
   const wanted = new Map;
   const want = (policy, family) => {
-    const families2 = wanted.get(policy) ?? new Set;
-    if (families2.has(family))
+    const families = wanted.get(policy) ?? new Set;
+    if (families.has(family))
       return;
-    families2.add(family);
-    wanted.set(policy, families2);
-    for (const rule of policies2[policy] ?? [])
+    families.add(family);
+    wanted.set(policy, families);
+    for (const rule of policies[policy] ?? [])
       if (rule.call && appliesTo(ctx, rule, family))
         want(rule.call, family);
   };
@@ -2240,13 +2259,13 @@ function policies(out, ctx) {
       }
     }
   }
-  const called = new Set(Object.values(policies2).flatMap((rules) => rules.flatMap((rule) => rule.call ? [rule.call] : [])));
+  const called = new Set(Object.values(policies).flatMap((rules) => rules.flatMap((rule) => rule.call ? [rule.call] : [])));
   for (const policy of [...wanted.keys()].sort()) {
     for (const family of ["ipv4", "ipv6"]) {
       if (!wanted.get(policy).has(family))
         continue;
       const chain = chainName(policy, family);
-      const rules = (policies2[policy] ?? []).filter((rule) => appliesTo(ctx, rule, family));
+      const rules = (policies[policy] ?? []).filter((rule) => appliesTo(ctx, rule, family));
       for (const rule of rules) {
         const text = ruleText(rule, family);
         if (text)
@@ -2271,9 +2290,9 @@ function bgpConnections(out, ctx) {
   for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
     const settings = settingsOf(ctx, neighbor);
     const [family] = familiesOf(ctx, neighbor);
-    const addressFamily = familyOf(neighbor.address);
+    const addressFamily = familyOf2(neighbor.address);
     const internal = settings.remote_as === bgp.asn;
-    const originates = bgp.networks?.some((prefix) => familyOf(host(prefix)) === family);
+    const originates = bgp.networks?.some((prefix) => familyOf2(host2(prefix)) === family);
     const role = settings.role ? ROLES[settings.role] : internal ? "ibgp" : "ebgp";
     out.add("/routing bgp connection", command("add", {
       afi: addressFamily === family ? undefined : family === "ipv6" ? "ipv6" : "ip",
@@ -2299,19 +2318,19 @@ function bgpConnections(out, ctx) {
   }
 }
 function ospf(out, ctx) {
-  const ospf2 = ctx.device.routing?.ospf;
-  if (!ospf2)
+  const ospf = ctx.device.routing?.ospf;
+  if (!ospf)
     return;
-  for (const family of ospf2.families ?? ["ipv4"]) {
+  for (const family of ospf.families ?? ["ipv4"]) {
     const version = family === "ipv4" ? 2 : 3;
     const instance = `ospf-v${version}`;
     out.add("/routing ospf instance", command("add", {
       name: instance,
-      redistribute: ospf2.redistribute?.join(","),
+      redistribute: ospf.redistribute?.join(","),
       "router-id": ctx.device.routing?.router_id,
       version
     }));
-    for (const [areaId, area] of Object.entries(ospf2.areas)) {
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
       const areaName = `${instance}-${areaId}`;
       out.add("/routing ospf area", command("add", { "area-id": areaId, instance, name: areaName }));
       for (const [iface, settings] of Object.entries(area.interfaces)) {
@@ -2388,19 +2407,19 @@ function layerTwo(out, ctx) {
 }
 function snmp(out, ctx) {
   const management = ctx.device.management ?? {};
-  const snmp2 = management.snmp;
-  if (!snmp2) {
+  const snmp = management.snmp;
+  if (!snmp) {
     out.add("/snmp", command("set", { enabled: "no" }));
     out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", name: "public" }));
     return;
   }
-  const allow = (snmp2.allow ?? management.allow ?? []).join(",");
-  out.add("/snmp", command("set", { contact: snmp2.contact ?? "", enabled: "yes", location: snmp2.location ?? "" }));
-  if (snmp2.community)
-    out.add("/snmp community", command("set [ find default=yes ]", { addresses: allow, name: marker(snmp2.community) }));
+  const allow = (snmp.allow ?? management.allow ?? []).join(",");
+  out.add("/snmp", command("set", { contact: snmp.contact ?? "", enabled: "yes", location: snmp.location ?? "" }));
+  if (snmp.community)
+    out.add("/snmp community", command("set [ find default=yes ]", { addresses: allow, name: marker(snmp.community) }));
   else
     out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", disabled: "yes", name: "public" }));
-  for (const [name, user] of Object.entries(snmp2.users ?? {})) {
+  for (const [name, user] of Object.entries(snmp.users ?? {})) {
     out.add("/snmp community", command("add", {
       addresses: allow,
       "authentication-password": marker(user.auth_password),
@@ -2467,15 +2486,15 @@ function renderSystem(out, ctx) {
   flowExport(out, ctx);
 }
 function logging(out, ctx) {
-  const logging2 = ctx.device.system?.logging;
-  const local = logging2?.local;
+  const logging = ctx.device.system?.logging;
+  const local = logging?.local;
   out.add("/system logging action", command("set 1", {
     "disk-file-count": local?.files ?? 2,
     "disk-lines-per-file": local?.lines_per_file ?? 1000
   }));
   for (const topic of local ? topicsFrom(local.level) : [])
     out.add("/system logging", command("add", { action: "disk", topics: topic }));
-  (logging2?.remote ?? []).forEach((collector, index) => {
+  (logging?.remote ?? []).forEach((collector, index) => {
     const action = `remote${index + 1}`;
     out.add("/system logging action", command("add", {
       name: action,
@@ -2553,17 +2572,17 @@ async function read2(device) {
   try {
     await checkVersion(client, device);
     const config = await exec(client, "/export", 300000);
-    const users2 = await exec(client, "/user export");
-    const certificates2 = (await exec(client, LIST_CERTIFICATES)).trim();
-    const listed = certificates2.split(`
-`).every((line2) => line2.trim().startsWith("add fingerprint="));
-    if (certificates2 && !listed) {
-      throw new Error(`${device.name}: certificates could not be listed: ${certificates2.slice(0, 120)}`);
+    const users = await exec(client, "/user export");
+    const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
+    const listed = certificates.split(`
+`).every((line) => line.trim().startsWith("add fingerprint="));
+    if (certificates && !listed) {
+      throw new Error(`${device.name}: certificates could not be listed: ${certificates.slice(0, 120)}`);
     }
-    const userMenu = users2.slice(users2.indexOf(`
+    const userMenu = users.slice(users.indexOf(`
 /`)).trim();
-    const certificateMenu = certificates2 ? `/certificate
-${certificates2}` : "";
+    const certificateMenu = certificates ? `/certificate
+${certificates}` : "";
     const text = [config.trim(), userMenu, certificateMenu].filter(Boolean).join(`
 `);
     return withoutTimestamp(text) + `
@@ -2588,11 +2607,19 @@ function unsupported2(device) {
       found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
     }
   }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "lag")
+      continue;
+    for (const field of ["storm_control", "stp"]) {
+      if (iface[field] !== undefined)
+        found.push(`interfaces.${name}.${field}, on a LAG`);
+    }
+  }
   const bgp = device.routing?.bgp;
   for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-    const families2 = neighbor.families ?? group?.families ?? [familyOf(neighbor.address)];
-    if (families2.length > 1)
+    const families = neighbor.families ?? group?.families ?? [familyOf2(neighbor.address)];
+    if (families.length > 1)
       found.push(`routing.bgp.neighbors.${name}.families, one family per session`);
   }
   const management = device.management;
@@ -2600,6 +2627,8 @@ function unsupported2(device) {
     found.push("management.console, the console uses the device's users");
   if (management?.privilege_password)
     found.push("management.privilege_password, the platform has no privileged mode");
+  if (management?.snmp?.port)
+    found.push("management.snmp.port");
   if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
     found.push("management.ssh.auth_timeout and auth_retries");
   }
@@ -2616,8 +2645,8 @@ function unsupported2(device) {
 }
 var ROLLBACK_SCHEDULER = "apply-rollback";
 var escapeForString = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
-async function refusal(client, command2) {
-  const compiled = (await exec(client, `:put [:parse "${escapeForString(command2)}"]`)).trim();
+async function refusal(client, command) {
+  const compiled = (await exec(client, `:put [:parse "${escapeForString(command)}"]`)).trim();
   const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
   return refused ? compiled.slice(0, 200) : undefined;
 }
@@ -2628,25 +2657,25 @@ async function installCertificate(client, device, name) {
   await upload(client, `${name}.crt`, certificate.certificate);
   await exec(client, `/certificate import file-name=${name}.crt name=${name} passphrase=""`);
   if (certificate.private_key) {
-    const value2 = resolve(certificate.private_key);
-    const privateKey = value2.includes("-----BEGIN") ? `${value2}
-` : Buffer.from(value2, "base64").toString("utf8");
+    const value = resolve(certificate.private_key);
+    const privateKey = value.includes("-----BEGIN") ? `${value}
+` : Buffer.from(value, "base64").toString("utf8");
     await upload(client, `${name}.key`, privateKey);
     await exec(client, `/certificate import file-name=${name}.key name=${name} passphrase=""`);
   }
   await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
-async function apply2(device, _network, changes2, options) {
+async function apply2(device, _network, changes, options) {
   const client = await login(device);
   await checkVersion(client, device);
-  const commands = changes2.steps.flatMap((step) => step.send.map((command2) => ({ title: step.title, command: command2 })));
-  for (const { title, command: command2 } of commands) {
-    if (command2.startsWith(INSTALL_CERTIFICATE))
+  const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
+  for (const { title, command } of commands) {
+    if (command.startsWith(INSTALL_CERTIFICATE))
       continue;
-    const reason = await refusal(client, substitute(command2));
+    const reason = await refusal(client, substitute(command));
     if (reason) {
       client.end();
-      throw new Error(`${title}: the device will not parse ${command2.slice(0, 200)}
+      throw new Error(`${title}: the device will not parse ${command.slice(0, 200)}
     ${reason}`);
     }
   }
@@ -2663,15 +2692,15 @@ async function apply2(device, _network, changes2, options) {
     await exec(client, `/system backup save name=${backup} dont-encrypt=yes`, 120000);
     await exec(client, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
     await exec(client, armRollback);
-    for (const { title, command: command2 } of commands) {
-      if (command2.startsWith(INSTALL_CERTIFICATE)) {
-        const certificateName = command2.slice(INSTALL_CERTIFICATE.length).trim();
+    for (const { title, command } of commands) {
+      if (command.startsWith(INSTALL_CERTIFICATE)) {
+        const certificateName = command.slice(INSTALL_CERTIFICATE.length).trim();
         await installCertificate(client, device, certificateName);
         continue;
       }
-      const answer = (await exec(client, substitute(command2), 120000)).trim();
+      const answer = (await exec(client, substitute(command), 120000)).trim();
       if (answer)
-        throw new Error(`${title}: ${command2.slice(0, 160)}
+        throw new Error(`${title}: ${command.slice(0, 160)}
     device said: ${answer.slice(0, 300)}`);
     }
   } catch (error) {
@@ -2743,20 +2772,20 @@ var DEVICE_FACTS2 = [
   "Info:"
 ];
 var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance)\b/;
-function undo2(line2) {
-  if (line2.startsWith("undo "))
-    return line2.slice("undo ".length);
-  if (/^rule \d+/.test(line2))
-    return `undo ${line2.split(" ").slice(0, 2).join(" ")}`;
-  const keyword = UNDO_BY_KEYWORD2.exec(line2);
+function undo2(line) {
+  if (line.startsWith("undo "))
+    return line.slice("undo ".length);
+  if (/^rule \d+/.test(line))
+    return `undo ${line.split(" ").slice(0, 2).join(" ")}`;
+  const keyword = UNDO_BY_KEYWORD2.exec(line);
   if (keyword)
     return `undo ${keyword[1]}`;
-  if (line2.startsWith("storm control "))
-    return `undo ${line2.replace(/ (min-rate|max-rate).*$/, "")}`;
-  return `undo ${line2}`;
+  if (line.startsWith("storm control "))
+    return `undo ${line.replace(/ (min-rate|max-rate).*$/, "")}`;
+  return `undo ${line}`;
 }
-function canon(line2) {
-  return line2.replace(/(irreversible-cipher|cipher) \S+/g, "cipher <secret>").replace(/<secret:\w+>/g, "<secret>");
+function canon(line) {
+  return line.replace(/(irreversible-cipher|cipher) \S+/g, "cipher <secret>").replace(/<secret:\w+>/g, "<secret>");
 }
 function order(path) {
   const header = path[0] ?? "";
@@ -2778,7 +2807,7 @@ var dialect2 = {
   block: /^(interface |vlan \d+$|acl number |aaa$|user-interface |ospf |ip vpn-instance |bfd$)/,
   indented: true,
   terminator: "#",
-  ignore: (line2) => DEVICE_FACTS2.some((fact) => line2.startsWith(fact)),
+  ignore: (line) => DEVICE_FACTS2.some((fact) => line.startsWith(fact)),
   undo: undo2,
   leave: "quit",
   first: /^authentication-mode /,
@@ -2792,13 +2821,13 @@ var SNMP_GROUP2 = "circuit";
 var USER_LEVEL = { admin: 3, operator: 2, "read-only": 1 };
 var SNMP_AUTH3 = { sha1: "sha", sha256: "sha2-256" };
 var SNMP_PRIVACY2 = { aes128: "aes128", des: "des56" };
-function batchIds(line2) {
-  const words2 = line2.replace(/^vlan batch /, "").split(" ");
+function batchIds(line) {
+  const words = line.replace(/^vlan batch /, "").split(" ");
   const ids = [];
-  for (let index = 0;index < words2.length; index++) {
-    const first = Number(words2[index]);
-    if (words2[index + 1] === "to") {
-      const last = Number(words2[index + 2]);
+  for (let index = 0;index < words.length; index++) {
+    const first = Number(words[index]);
+    if (words[index + 1] === "to") {
+      const last = Number(words[index + 2]);
       for (let id = first;id <= last; id++)
         ids.push(id);
       index += 2;
@@ -2935,7 +2964,7 @@ function managementAcl(config, device) {
   const allow = device.management?.allow ?? [];
   if (!allow.length)
     return;
-  const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host(cidr)} ${wildcard(split(cidr).len)}`);
+  const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host2(cidr)} ${wildcard(split(cidr).len)}`);
   config.block(`acl number ${MANAGEMENT_ACL2}`, ["description Management access", ...rules, `rule ${(allow.length + 1) * 5} deny`]);
 }
 function users2(config, device) {
@@ -3014,8 +3043,8 @@ function vlanInterface(device, name, iface) {
     lines.push(`ip binding vpn-instance ${iface.vrf}`);
   for (const entry of iface.addresses ?? []) {
     const address = typeof entry === "string" ? entry : entry.address;
-    if (familyOf(address) === "ipv4")
-      lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+    if (familyOf2(address) === "ipv4")
+      lines.push(`ip address ${host2(address)} ${netmask(split(address).len)}`);
     else
       lines.push(`ipv6 address ${address}`);
   }
@@ -3070,7 +3099,7 @@ function staticRoutes2(config, device, nameOf) {
     const vrf = route.vrf ? ` vpn-instance ${route.vrf}` : "";
     const preference = route.distance ? ` preference ${route.distance}` : "";
     const description = route.description ? ` description ${route.description}` : "";
-    if (familyOf(addr) === "ipv4")
+    if (familyOf2(addr) === "ipv4")
       config.line(`ip route-static${vrf} ${addr} ${netmask(len)} ${nextHop}${preference}${description}`);
     else
       config.line(`ipv6 route-static${vrf} ${addr} ${len} ${nextHop}${preference}`);
@@ -3078,21 +3107,21 @@ function staticRoutes2(config, device, nameOf) {
   config.separator();
 }
 function ospf2(config, device, nameOf) {
-  const ospf3 = device.routing?.ospf;
-  if (!ospf3)
+  const ospf = device.routing?.ospf;
+  if (!ospf)
     return;
   const routerId = device.routing?.router_id;
   const lines = [];
-  for (const source of ospf3.redistribute ?? [])
+  for (const source of ospf.redistribute ?? [])
     lines.push(`import-route ${source === "connected" ? "direct" : "static"}`);
   const areaLines = [];
-  for (const [areaId, area] of Object.entries(ospf3.areas)) {
+  for (const [areaId, area] of Object.entries(ospf.areas)) {
     areaLines.push(`area ${areaId}`);
     for (const [iface, settings] of Object.entries(area.interfaces)) {
       if (settings?.passive)
         lines.push(`silent-interface ${nameOf(iface)}`);
       for (const prefix of ipv4Networks(device, iface))
-        areaLines.push(` network ${host(prefix)} ${wildcard(split(prefix).len)}`);
+        areaLines.push(` network ${host2(prefix)} ${wildcard(split(prefix).len)}`);
     }
   }
   config.block(`ospf ${OSPF_PROCESS2}${routerId ? ` router-id ${routerId}` : ""}`, [...lines, ...areaLines]);
@@ -3113,23 +3142,23 @@ function flowExport2(config, device) {
   config.separator();
 }
 function snmp2(config, device) {
-  const snmp3 = device.management?.snmp;
-  if (!snmp3)
+  const snmp = device.management?.snmp;
+  if (!snmp)
     return;
-  const versions = [snmp3.community ? "v2c" : "", snmp3.users ? "v3" : ""].filter(Boolean).join(" ");
+  const versions = [snmp.community ? "v2c" : "", snmp.users ? "v3" : ""].filter(Boolean).join(" ");
   const guarded = (device.management?.allow?.length ?? 0) > 0;
   config.line("snmp-agent");
   config.line(`snmp-agent sys-info version ${versions}`);
-  if (snmp3.contact)
-    config.line(`snmp-agent sys-info contact ${snmp3.contact}`);
-  if (snmp3.location)
-    config.line(`snmp-agent sys-info location ${snmp3.location}`);
-  if (snmp3.community)
-    config.line(`snmp-agent community read cipher ${marker(snmp3.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
-  if (snmp3.users) {
+  if (snmp.contact)
+    config.line(`snmp-agent sys-info contact ${snmp.contact}`);
+  if (snmp.location)
+    config.line(`snmp-agent sys-info location ${snmp.location}`);
+  if (snmp.community)
+    config.line(`snmp-agent community read cipher ${marker(snmp.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
+  if (snmp.users) {
     config.line("snmp-agent mib-view included all iso");
     config.line(`snmp-agent group v3 ${SNMP_GROUP2} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
-    for (const [name, user] of Object.entries(snmp3.users)) {
+    for (const [name, user] of Object.entries(snmp.users)) {
       config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP2}`);
       config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH3[user.auth]} cipher ${marker(user.auth_password)}`);
       config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY2[user.privacy]} cipher ${marker(user.privacy_password)}`);
@@ -3138,8 +3167,8 @@ function snmp2(config, device) {
   config.separator();
 }
 function ssh(config, device) {
-  const ssh2 = device.management?.ssh;
-  if (!ssh2)
+  const ssh = device.management?.ssh;
+  if (!ssh)
     return;
   const guarded = (device.management?.allow?.length ?? 0) > 0;
   config.line("stelnet server enable");
@@ -3152,7 +3181,7 @@ function ssh(config, device) {
     config.line(`ssh server acl ${MANAGEMENT_ACL2}`);
   config.line("ssh authorization-type default aaa");
   config.separator();
-  if (!ssh2.weak_crypto) {
+  if (!ssh.weak_crypto) {
     config.line("ssh server cipher aes256_ctr aes128_ctr");
     config.line("ssh server hmac sha2_256_96 sha2_256");
     config.line("ssh server key-exchange dh_group_exchange_sha256 ecdh_sha2_nistp256 ecdh_sha2_nistp384 ecdh_sha2_nistp521");
@@ -3194,10 +3223,10 @@ async function read3(device) {
     channel.end();
     const lines = dump.replace(/\r/g, "").split(`
 `);
-    const start = lines.findIndex((line2) => line2.startsWith("!Software Version"));
+    const start = lines.findIndex((line) => line.startsWith("!Software Version"));
     if (start < 0)
       throw new Error(`${device.name} returned no configuration`);
-    const body = lines.slice(start).filter((line2) => !/^<.*>$/.test(line2.trim()) && !line2.startsWith("!Last configuration"));
+    const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
     return scrub(body.join(`
 `).trim() + `
 `);
@@ -3225,10 +3254,16 @@ function unsupported3(device) {
       found.push(`interfaces.${name}, a ${iface.type}`);
     if (iface.type === "lag" && iface.addresses?.length)
       found.push(`interfaces.${name}.addresses, LAGs are switched`);
+    if (iface.mtu !== undefined)
+      found.push(`interfaces.${name}.mtu`);
     for (const group of iface.vrrp ?? [])
-      if (familyOf(group.address) === "ipv6")
+      if (familyOf2(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
   }
+  for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+    if (vrf.description)
+      found.push(`vrfs.${name}.description`);
+  }
   const routing = device.routing;
   if (routing?.bgp)
     found.push("routing.bgp");
@@ -3255,10 +3290,13 @@ function unsupported3(device) {
     found.push("management.ssh.auth_timeout and auth_retries");
   if (device.lldp && device.lldp !== true)
     found.push("lldp.interfaces, use lldp on the ports instead");
-  const system2 = device.system ?? {};
-  if (system2.dns || system2.logging || system2.release_channel || system2.banner) {
+  const system = device.system ?? {};
+  if (system.dns || system.logging || system.release_channel || system.banner) {
     found.push("system.dns, logging, release_channel and banner");
   }
+  if (system.transceiver_monitoring !== undefined)
+    found.push("system.transceiver_monitoring");
+  found.push(...switchUnsupported(device));
   const flow = device.flow_export;
   if (flow && flow.protocol !== "sflow")
     found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
@@ -3271,31 +3309,31 @@ function unsupported3(device) {
 }
 var REFUSED2 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
 var INTERACTIVE = /^(snmp-agent usm-user v3 \S+ (?:authentication|privacy)-mode \S+) cipher <secret:([A-Za-z0-9_./:-]+)>$/;
-async function sendLine(channel, line2) {
-  const interactive = INTERACTIVE.exec(line2.trim());
+async function sendLine(channel, line) {
+  const interactive = INTERACTIVE.exec(line.trim());
   if (interactive) {
-    const [, command2, reference] = interactive;
+    const [, command, reference] = interactive;
     const password = valueOfReference(reference);
-    let answer2 = await send(channel, command2, 15000, 900);
-    answer2 += await send(channel, password, 15000, 900);
-    answer2 += await send(channel, password, 15000, 900);
-    return answer2;
+    let answer = await send(channel, command, 15000, 900);
+    answer += await send(channel, password, 15000, 900);
+    answer += await send(channel, password, 15000, 900);
+    return answer;
   }
-  let answer = await send(channel, substitute(line2), 20000, 800);
+  let answer = await send(channel, substitute(line), 20000, 800);
   if (/\[Y\/N\]/i.test(answer))
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply3(device, _network, plan3) {
+async function apply3(device, _network, plan) {
   const client = await login2(device);
   const channel = await openShell(client);
   try {
     await send(channel, "system-view", 1e4, 1500);
-    for (const step of plan3.steps) {
-      for (const line2 of step.send) {
-        const answer = await sendLine(channel, line2);
+    for (const step of plan.steps) {
+      for (const line of step.send) {
+        const answer = await sendLine(channel, line);
         if (REFUSED2.test(answer))
-          throw new Error(`${step.title}: ${line2}
+          throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
       }
     }
@@ -3331,19 +3369,19 @@ function plan3(desired, current) {
   const groups = compare(desired, current, dialect2);
   vlanListChange(groups, "vlan batch ", batchIds, (ids) => [`vlan batch ${vlanBatch(ids)}`], (ids) => [`vlan batch ${vlanBatch(ids)}`]);
   const top = groups.find((group) => group.path.length === 0);
-  const removedBatch = top?.remove.find((line2) => line2.startsWith("vlan batch ")) ?? "";
+  const removedBatch = top?.remove.find((line) => line.startsWith("vlan batch ")) ?? "";
   const removedIds = removedBatch ? batchIds(removedBatch) : [];
   const firstRemovals = [
-    ...removedIds.map((id) => `interface Vlanif${id}`).filter((line2) => top?.remove.includes(line2)),
-    ...removedIds.map((id) => `vlan ${id}`).filter((line2) => top?.remove.includes(line2)),
+    ...removedIds.map((id) => `interface Vlanif${id}`).filter((line) => top?.remove.includes(line)),
+    ...removedIds.map((id) => `vlan ${id}`).filter((line) => top?.remove.includes(line)),
     ...removedBatch ? [removedBatch] : []
   ];
   if (top)
-    top.remove = top.remove.filter((line2) => !firstRemovals.includes(line2));
+    top.remove = top.remove.filter((line) => !firstRemovals.includes(line));
   const planned = steps(groups.filter((group) => group.add.length || group.remove.length), dialect2);
   if (firstRemovals.length) {
-    const sent = firstRemovals.filter((line2) => !/^vlan \d+$/.test(line2)).map(undo2);
-    planned.unshift({ title: "VLANs no longer used", show: firstRemovals.map((line2) => `- ${line2}`), send: sent });
+    const sent = firstRemovals.filter((line) => !/^vlan \d+$/.test(line)).map(undo2);
+    planned.unshift({ title: "VLANs no longer used", show: firstRemovals.map((line) => `- ${line}`), send: sent });
   }
   return { steps: planned, problems: [] };
 }
@@ -3378,17 +3416,17 @@ var registries = { "ripe-stat": ripeStat };
 // src/adapters/registries/librenms.ts
 var AUTH = { sha1: "SHA", sha256: "SHA-256" };
 var PRIVACY = { aes128: "AES", des: "DES" };
-function settingsOf2(network2) {
-  if (!network2.librenms)
+function settingsOf2(network) {
+  if (!network.librenms)
     throw new Error("the network has no librenms settings");
   return {
-    base: `${network2.librenms.url.replace(/\/+$/, "")}/api/v0`,
-    headers: { "X-Auth-Token": resolve(network2.librenms.api_token), "Content-Type": "application/json" }
+    base: `${network.librenms.url.replace(/\/+$/, "")}/api/v0`,
+    headers: { "X-Auth-Token": resolve(network.librenms.api_token), "Content-Type": "application/json" }
   };
 }
 function credentials(device) {
-  const snmp3 = device.management?.snmp;
-  const [name, user] = Object.entries(snmp3?.users ?? {})[0] ?? [];
+  const snmp = device.management?.snmp;
+  const [name, user] = Object.entries(snmp?.users ?? {})[0] ?? [];
   if (name && user) {
     return {
       snmpver: "v3",
@@ -3400,26 +3438,26 @@ function credentials(device) {
       cryptoalgo: PRIVACY[user.privacy]
     };
   }
-  if (snmp3?.community)
-    return { snmpver: "v2c", community: resolve(snmp3.community) };
+  if (snmp?.community)
+    return { snmpver: "v2c", community: resolve(snmp.community) };
   return;
 }
-async function planLibreNms(network2) {
-  const { base, headers } = settingsOf2(network2);
+async function planLibreNms(network) {
+  const { base, headers } = settingsOf2(network);
   const response = await fetch(`${base}/devices?type=all`, { headers, signal: AbortSignal.timeout(30000) });
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
   const monitored = new Set((await response.json()).devices.map((device) => device.hostname));
-  const ours = new Set(network2.devices.map((device) => device.connection.host));
-  const missing = network2.devices.filter((device) => !monitored.has(device.connection.host));
+  const ours = new Set(network.devices.map((device) => device.connection.host));
+  const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
   return {
     additions: missing.filter((device) => device.management?.snmp),
     withoutSnmp: missing.filter((device) => !device.management?.snmp),
     unknown: [...monitored].filter((hostname) => !ours.has(hostname)).sort()
   };
 }
-async function sendLibreNms(network2, additions) {
-  const { base, headers } = settingsOf2(network2);
+async function sendLibreNms(network, additions) {
+  const { base, headers } = settingsOf2(network);
   for (const device of additions) {
     const body = { hostname: device.connection.host, display_template: device.name, ...credentials(device) };
     const response = await fetch(`${base}/devices`, {
@@ -3438,55 +3476,55 @@ async function sendLibreNms(network2, additions) {
 
 // src/adapters/registries/peeringdb.ts
 var API = "https://www.peeringdb.com/api";
-var addressesOf = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+var addressesOf2 = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
 function peersWithRouteServer(device, iface) {
   const bgp = device.routing?.bgp;
-  const subnets = addressesOf(iface);
+  const subnets = addressesOf2(iface);
   return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
     const role = neighbor.role ?? group?.role;
-    return role === "rs" && subnets.some((subnet) => contains(subnet, neighbor.address));
+    return role === "rs" && subnets.some((subnet) => contains2(subnet, neighbor.address));
   });
 }
-function wanted(network2) {
+function wanted(network) {
   const records = [];
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     for (const iface of Object.values(device.interfaces ?? {})) {
       const exchange = iface.exchange;
       if (!exchange?.peeringdb_ixlan)
         continue;
-      const published = addressesOf(iface).map(host).filter(isGlobal);
+      const published = addressesOf2(iface).map(host2).filter(isGlobal2);
       records.push({
         name: exchange.name,
         ixlan_id: exchange.peeringdb_ixlan,
         speed: exchange.speed,
-        ipaddr4: published.find((address) => familyOf(address) === "ipv4") ?? null,
-        ipaddr6: published.find((address) => familyOf(address) === "ipv6") ?? null,
+        ipaddr4: published.find((address) => familyOf2(address) === "ipv4") ?? null,
+        ipaddr6: published.find((address) => familyOf2(address) === "ipv6") ?? null,
         is_rs_peer: peersWithRouteServer(device, iface)
       });
     }
   }
   return records;
 }
-async function planPeeringDb(network2) {
-  if (!network2.asn)
+async function planPeeringDb(network) {
+  if (!network.asn)
     throw new Error("the network declares no asn");
-  const response = await fetch(`${API}/netixlan?asn=${network2.asn}`, {
+  const response = await fetch(`${API}/netixlan?asn=${network.asn}`, {
     headers: { Accept: "application/json" },
     signal: AbortSignal.timeout(30000)
   });
   if (!response.ok)
     throw new Error(`PeeringDB answered ${response.status}`);
   const existing = (await response.json()).data;
-  const desired = wanted(network2);
+  const desired = wanted(network);
   const netId = existing[0]?.net_id;
-  const changes2 = [];
+  const changes = [];
   for (const record of desired) {
     const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
     const body = {
       net_id: netId,
       ixlan_id: record.ixlan_id,
-      asn: network2.asn,
+      asn: network.asn,
       speed: record.speed,
       ipaddr4: record.ipaddr4,
       ipaddr6: record.ipaddr6,
@@ -3494,27 +3532,27 @@ async function planPeeringDb(network2) {
       operational: current?.operational ?? true
     };
     if (!current) {
-      changes2.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
+      changes.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
       continue;
     }
     const differs = current.ipaddr4 !== record.ipaddr4 || current.ipaddr6 !== record.ipaddr6 || current.speed !== record.speed || current.is_rs_peer !== record.is_rs_peer;
     if (differs) {
       const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
       const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
-      changes2.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
+      changes.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
     }
   }
   const unknown = existing.filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id)).map((record) => record.name);
-  if (changes2.some((change) => !change.id) && !netId) {
+  if (changes.some((change) => !change.id) && !netId) {
     throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
   }
-  return { changes: changes2, unknown };
+  return { changes, unknown };
 }
-async function sendPeeringDb(network2, changes2) {
-  if (!network2.peeringdb)
+async function sendPeeringDb(network, changes) {
+  if (!network.peeringdb)
     throw new Error("the network declares no peeringdb api_key");
-  const apiKey = resolve(network2.peeringdb.api_key);
-  for (const change of changes2) {
+  const apiKey = resolve(network.peeringdb.api_key);
+  for (const change of changes) {
     const response = await fetch(`${API}/netixlan${change.id ? `/${change.id}` : ""}`, {
       method: change.id ? "PUT" : "POST",
       headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
@@ -3532,13 +3570,13 @@ async function sendPeeringDb(network2, changes2) {
 // src/adapters/registries/prometheus.ts
 var AUTH2 = { sha1: "SHA", sha256: "SHA256" };
 var PRIVACY2 = { aes128: "AES", des: "DES" };
-function prometheusTargets(network2) {
+function prometheusTargets(network) {
   return {
-    targets: network2.devices.filter((device) => device.management?.snmp).map((device) => ({
+    targets: network.devices.filter((device) => device.management?.snmp).map((device) => ({
       targets: [device.connection.host],
       labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name }
     })),
-    withoutSnmp: network2.devices.filter((device) => !device.management?.snmp)
+    withoutSnmp: network.devices.filter((device) => !device.management?.snmp)
   };
 }
 function fromEnvironment(secret, notes, where) {
@@ -3547,17 +3585,17 @@ function fromEnvironment(secret, notes, where) {
   notes.push(`${where} is read from a file; write its value in place of FILL_IN`);
   return "FILL_IN";
 }
-function snmpExporterAuths(network2) {
+function snmpExporterAuths(network) {
   const notes = [];
   const lines = [
     "# Written by `circuit prometheus --auths`. Load it beside snmp.yml, with --config.expand-environment-variables.",
     "auths:"
   ];
-  for (const device of network2.devices) {
-    const snmp3 = device.management?.snmp;
-    if (!snmp3)
+  for (const device of network.devices) {
+    const snmp = device.management?.snmp;
+    if (!snmp)
       continue;
-    const [name, user] = Object.entries(snmp3.users ?? {})[0] ?? [];
+    const [name, user] = Object.entries(snmp.users ?? {})[0] ?? [];
     lines.push(`  ${device.name}:`);
     if (name && user) {
       lines.push("    version: 3", `    username: ${name}`, "    security_level: authPriv", `    password: ${fromEnvironment(user.auth_password, notes, `${device.name}'s SNMP password`)}`, `    auth_protocol: ${AUTH2[user.auth]}`, `    priv_protocol: ${PRIVACY2[user.privacy]}`, `    priv_password: ${fromEnvironment(user.privacy_password, notes, `${device.name}'s SNMP privacy password`)}`);
@@ -3571,428 +3609,254 @@ function snmpExporterAuths(network2) {
 `, notes };
 }
 
-// src/core/graph.ts
-var LAYERS = ["l1", "l2", "l3", "bgp", "ospf", "tunnels"];
-var deviceId = (name) => `device:${name}`;
-function keyOf(address) {
-  if (!address || !isAddress(address))
-    return;
-  return `${familyOf(address)}:${parse(address)}`;
-}
-var isHostRoute = (cidr) => {
-  const { len, family } = split(cidr);
-  return len === (family === "ipv4" ? 32 : 128);
-};
+// src/core/validate.ts
+import { X509Certificate as X509Certificate2 } from "node:crypto";
 
-class Builder {
-  nodes = new Map;
-  edges = [];
-  node(id, kind, label, detail = []) {
-    const existing = this.nodes.get(id);
-    if (!existing)
-      this.nodes.set(id, { id, kind, label, detail: [...detail] });
-    else
-      for (const line2 of detail)
-        if (!existing.detail.includes(line2))
-          existing.detail.push(line2);
-    return id;
-  }
-  edge(edge) {
-    this.edges.push(edge);
-    return edge;
+// src/core/across.ts
+function checkAcross(devices) {
+  const holders = holdersOf(devices);
+  const owners = new Map;
+  for (const holder of holders) {
+    const key = keyOf(host2(holder.address));
+    if (!owners.has(key))
+      owners.set(key, holder);
   }
+  return [
+    ...checkLinks(devices),
+    ...checkAddresses(holders),
+    ...checkSessions(devices, owners),
+    ...checkVrrp(holders),
+    ...checkTunnels(devices, owners)
+  ];
 }
-function routedOf(device) {
-  const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [[name, port]] : []);
-  const interfaces = Object.entries(device.interfaces ?? {});
-  return [...ports, ...interfaces];
+function carried(device, port) {
+  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
+  return {
+    access: id(port.access_vlan),
+    native: id(port.native_vlan),
+    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
+  };
 }
-function holdersOf(devices) {
-  return devices.flatMap((device) => routedOf(device).flatMap(([name, settings]) => (settings.addresses ?? []).flatMap((entry) => {
-    const address = typeof entry === "string" ? entry : entry.address;
-    if (!isCidr(address))
-      return [];
-    const peer = typeof entry === "string" ? undefined : entry.peer;
-    return [{ device, name, address, peer, vrrp: settings.vrrp ?? [] }];
-  })));
-}
-function describeDevice(device) {
-  const addresses2 = routedOf(device).filter(([, settings]) => settings.addresses?.length).map(([name, settings]) => {
-    const list = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : `${entry.address} to ${entry.peer}`);
-    const vrf = settings.vrf ? `, VRF ${settings.vrf}` : "";
-    return `${name}: ${list.join(", ")}${vrf}`;
-  });
-  return [`${device.platform} ${device.model}`, `reached at ${device.connection.host}`, ...addresses2];
+function vlanNames(device, settings) {
+  const names = [settings.access_vlan, settings.native_vlan, ...settings.trunk_vlans ?? []].filter((name) => name !== undefined);
+  return new Map(names.flatMap((name) => device.vlans?.[name] ? [[device.vlans[name].id, name]] : []));
 }
-function carriedBy(device, settings) {
-  const vlan = (name, untagged) => {
-    const id = name ? device.vlans?.[name]?.id : undefined;
-    return name && id !== undefined ? [{ name, id, untagged }] : [];
-  };
-  const trunk = (settings?.trunk_vlans ?? []).filter((name) => name !== settings?.native_vlan);
-  return [...vlan(settings?.access_vlan, true), ...vlan(settings?.native_vlan, true), ...trunk.flatMap((name) => vlan(name, false))].sort((a, b) => a.id - b.id);
+function carrierOf(device, portName, port) {
+  const lag = port.lag ? device.interfaces?.[port.lag] : undefined;
+  if (port.lag && lag?.type === "lag")
+    return { name: port.lag, settings: lag };
+  return { name: portName, settings: port };
 }
-function vlanLabel(vlans) {
-  if (vlans.length === 1)
-    return `${vlans[0].name}${vlans[0].untagged ? ", untagged" : ""}`;
-  if (vlans.length <= 3)
-    return vlans.map((vlan) => vlan.name).join(", ");
-  return `${vlans.length} VLANs`;
+var plainAddresses = (settings, family) => (settings.addresses ?? []).filter((entry) => typeof entry === "string" && isCidr2(entry) && familyOf2(entry) === family);
+function addressDisagreement(here, there, far, farName) {
+  for (const family of ["ipv4", "ipv6"]) {
+    const ours = plainAddresses(here, family);
+    const theirs = plainAddresses(there, family);
+    if (!ours.length || !theirs.length)
+      continue;
+    const theirPrefixes = new Set(theirs.map(network));
+    if (!ours.some((address) => theirPrefixes.has(network(address)))) {
+      return `has ${ours.join(", ")}, and ${far.name} ${farName} has ${theirs.join(", ")}: not one prefix of one length`;
+    }
+  }
+  const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host2(typeof entry === "string" ? entry : entry.address))));
+  for (const entry of here.addresses ?? []) {
+    if (typeof entry === "string" || !keyOf(entry.peer) || farHosts.has(keyOf(entry.peer)))
+      continue;
+    return `${entry.address} names peer ${entry.peer}, which ${far.name} ${farName} does not hold`;
+  }
+  return;
 }
-function cables(devices, graph) {
+function checkLinks(devices) {
+  const findings = [];
   const byName = new Map(devices.map((device) => [device.name, device]));
-  const drawn = new Set;
-  const bundles = new Map;
   for (const device of devices) {
     for (const [portName, port] of Object.entries(device.ports ?? {})) {
       const link = port?.link;
       if (!port || !link)
         continue;
-      const here = `${device.name} ${portName}`;
-      const there = `${link.device} ${link.port}`;
-      if (drawn.has(`${there}|${here}`))
-        continue;
-      drawn.add(`${here}|${there}`);
+      const report = (message, level = "error") => findings.push({
+        level,
+        device: device.name,
+        message: `port ${portName} link: ${message}`
+      });
       const far = byName.get(link.device);
-      const farPort = far?.ports?.[link.port];
-      const linksBack = farPort?.link?.device === device.name && farPort.link.port === portName;
-      const to = far ? deviceId(far.name) : graph.node(`missing:${link.device}`, "outside", link.device, ["named by a link, and not in the network"]);
-      const cableLine = `${here} to ${there}`;
-      const lag = port.lag;
-      const farLag = farPort?.lag;
-      const bundleKey = `${device.name} ${lag}|${link.device} ${farLag}`;
-      const bundle = lag && farLag && linksBack ? bundles.get(bundleKey) : undefined;
-      if (bundle) {
-        bundle.members++;
-        bundle.cable.detail.push(cableLine);
-        bundle.cable.label = `${lag} to ${farLag}, ${bundle.members} cables`;
+      if (!far) {
+        report(`device ${link.device} is not in the network`);
         continue;
       }
-      const isBundle = Boolean(lag && farLag && linksBack);
-      const cable = graph.edge({
-        layer: "l1",
-        from: deviceId(device.name),
-        to,
-        label: isBundle ? `${lag} to ${farLag}` : `${portName} to ${link.port}`,
-        detail: [cableLine],
-        ...linksBack ? {} : { oneSided: true }
-      });
-      if (isBundle)
-        bundles.set(bundleKey, { cable, members: 1 });
-      const lagSettings = lag ? device.interfaces?.[lag] : undefined;
-      const carrier = lagSettings?.type === "lag" ? lagSettings : lag ? undefined : port;
-      const vlans = carriedBy(device, carrier);
-      if (!vlans.length)
+      const farPort = far.ports?.[link.port];
+      if (!farPort) {
+        report(`${link.device} does not declare port ${link.port}`);
         continue;
-      graph.edge({
-        layer: "l2",
-        from: deviceId(device.name),
-        to,
-        label: vlanLabel(vlans),
-        detail: [
-          `${device.name} ${lag ?? portName}`,
-          ...vlans.map((vlan) => `${vlan.name}, VLAN ${vlan.id}${vlan.untagged ? ", untagged" : ""}`)
-        ],
-        vlans,
-        ...linksBack ? {} : { oneSided: true }
-      });
+      }
+      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
+      if (!linksBack) {
+        report(`${link.device} ${link.port} does not link back to it`);
+        continue;
+      }
+      const here = JSON.stringify(carried(device, port));
+      const there = JSON.stringify(carried(far, farPort));
+      if (here !== there)
+        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+      if (port.speed && farPort.speed && port.speed !== farPort.speed) {
+        report(`speed ${port.speed}, and ${link.device} ${link.port} is ${farPort.speed}`);
+      }
+      const near = carrierOf(device, portName, port);
+      const away = carrierOf(far, link.port, farPort);
+      const mtu = near.settings.mtu ?? 1500;
+      const farMtu = away.settings.mtu ?? 1500;
+      if (mtu !== farMtu)
+        report(`MTU ${mtu} on ${near.name}, and ${link.device} ${away.name} has ${farMtu}`);
+      const disagreement = addressDisagreement(near.settings, away.settings, far, away.name);
+      if (disagreement)
+        report(`${near.name} ${disagreement}`);
+      const farNames = vlanNames(far, away.settings);
+      for (const [id, name] of vlanNames(device, near.settings)) {
+        const farName = farNames.get(id);
+        if (farName && farName !== name)
+          report(`VLAN ${id} is ${name} here and ${farName} on ${link.device}`, "warning");
+      }
     }
   }
+  return findings;
 }
-function segments(holders2, owners, graph) {
-  const bySegment = new Map;
-  const pairs = new Set;
-  for (const holder of holders2) {
-    if (holder.peer) {
-      const far = owners.get(keyOf(holder.peer) ?? "");
-      if (!far || far.device === holder.device)
-        continue;
-      const ends = [`${holder.device.name} ${holder.name}`, `${far.device.name} ${far.name}`].sort().join("|");
-      if (pairs.has(ends))
-        continue;
-      pairs.add(ends);
-      graph.edge({
-        layer: "l3",
-        from: deviceId(holder.device.name),
-        to: deviceId(far.device.name),
-        label: `${host(holder.address)} to ${host(far.address)}`,
-        detail: [`${holder.device.name} ${holder.name} ${holder.address}`, `${far.device.name} ${far.name} ${far.address}`]
-      });
+function checkAddresses(holders) {
+  const findings = [];
+  const first = new Map;
+  const isLoopback = (holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
+  for (const holder of holders) {
+    const key = keyOf(host2(holder.address));
+    const earlier = first.get(key);
+    if (!earlier) {
+      first.set(key, holder);
       continue;
     }
-    if (isHostRoute(holder.address))
+    if (earlier.device === holder.device)
       continue;
-    const segment = network(holder.address);
-    bySegment.set(segment, [...bySegment.get(segment) ?? [], holder]);
-  }
-  for (const [segment, members] of bySegment) {
-    if (new Set(members.map((member) => member.device.name)).size < 2)
-      continue;
-    const memberLines = members.map((member) => `${member.device.name} ${member.name} ${member.address}`);
-    const vrrpLines3 = members.flatMap((member) => member.vrrp.map((group) => `VRRP ${group.id} ${group.address} on ${member.device.name}, priority ${group.priority ?? 100}`));
-    if (members.length === 2) {
-      const [a, b] = members;
-      graph.edge({
-        layer: "l3",
-        from: deviceId(a.device.name),
-        to: deviceId(b.device.name),
-        label: segment,
-        detail: [...memberLines, ...vrrpLines3]
-      });
-      continue;
-    }
-    const id = graph.node(`segment:${segment}`, "segment", segment, [...memberLines, ...vrrpLines3]);
-    for (const member of members) {
-      graph.edge({
-        layer: "l3",
-        from: deviceId(member.device.name),
-        to: id,
-        label: `${member.name} ${host(member.address)}`,
-        detail: [`${member.device.name} ${member.name} ${member.address}`]
-      });
-    }
+    const anycast = isLoopback(earlier) && isLoopback(holder);
+    findings.push({
+      level: anycast ? "warning" : "error",
+      device: holder.device.name,
+      message: `${host2(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`
+    });
   }
+  return findings;
 }
-function sessions(devices, owners, graph) {
-  const all = devices.flatMap((device) => {
+function checkSessions(devices, owners) {
+  const findings = [];
+  const sessionsOf = (device) => {
     const bgp = device.routing?.bgp;
     return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
       const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
       return {
-        device,
         name,
         address: neighbor.address,
-        ownAs: bgp.asn,
         remoteAs: neighbor.remote_as ?? group?.remote_as,
-        role: neighbor.role ?? group?.role,
-        description: neighbor.description ?? group?.description,
-        import: neighbor.import ?? group?.import,
-        export: neighbor.export ?? group?.export
+        localAddress: neighbor.local_address ?? group?.local_address
       };
     });
-  });
-  const describe2 = (session) => {
-    const parts = [
-      session.address,
-      session.remoteAs ? `AS${session.remoteAs}` : "no remote AS",
-      session.role,
-      session.import ? `import ${session.import}` : "imports nothing",
-      session.export ? `export ${session.export}` : "exports nothing"
-    ];
-    return `${session.device.name} ${session.name}: ${parts.filter(Boolean).join(", ")}`;
   };
-  const ownerOf = (session) => owners.get(keyOf(session.address) ?? "")?.device;
-  const paired = new Set;
-  for (const session of all) {
-    if (paired.has(session))
-      continue;
-    const far = ownerOf(session);
-    if (far && far !== session.device) {
-      const back = all.find((other) => other.device === far && !paired.has(other) && ownerOf(other) === session.device);
-      if (back)
-        paired.add(back);
-      graph.edge({
-        layer: "bgp",
-        from: deviceId(session.device.name),
-        to: deviceId(far.name),
-        label: session.remoteAs === session.ownAs ? "iBGP" : "eBGP",
-        detail: [describe2(session), ...back ? [describe2(back)] : [`${far.name} has no session back`]],
-        ...back ? {} : { oneSided: true }
-      });
-      continue;
+  for (const device of devices) {
+    for (const session of sessionsOf(device)) {
+      const far = owners.get(keyOf(session.address) ?? "")?.device;
+      if (!far || far === device)
+        continue;
+      const report = (message) => findings.push({ level: "error", device: device.name, message: `neighbor ${session.name}: ${message}` });
+      const farBgp = far.routing?.bgp;
+      if (!farBgp) {
+        report(`${session.address} is ${far.name}'s, which runs no BGP`);
+        continue;
+      }
+      if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
+        report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
+      }
+      const back = sessionsOf(far).find((other) => owners.get(keyOf(other.address) ?? "")?.device === device && familyOf2(other.address) === familyOf2(session.address));
+      if (!back) {
+        report(`${far.name} has no session back to ${device.name}`);
+        continue;
+      }
+      if (session.localAddress && keyOf(session.localAddress) !== keyOf(back.address)) {
+        report(`starts from ${session.localAddress}, and ${far.name}'s session ${back.name} expects ${back.address}`);
+      }
     }
-    const outside = session.remoteAs ? graph.node(`as:${session.remoteAs}`, "outside", `AS${session.remoteAs}`, session.description ? [session.description] : []) : graph.node(`address:${session.address}`, "outside", session.address, ["a BGP neighbor without a remote AS"]);
-    const internal = session.remoteAs === session.ownAs;
-    graph.edge({
-      layer: "bgp",
-      from: deviceId(session.device.name),
-      to: outside,
-      label: [session.name, session.role].filter(Boolean).join(", "),
-      detail: [describe2(session), ...internal ? ["internal, and no device in the network holds the address"] : []],
-      ...internal ? { oneSided: true } : {}
-    });
   }
+  return findings;
 }
-function adjacencies(devices, graph) {
-  const byKey = new Map;
-  for (const device of devices) {
-    for (const [area, { interfaces }] of Object.entries(device.routing?.ospf?.areas ?? {})) {
-      for (const [name, settings] of Object.entries(interfaces)) {
-        if (settings?.passive)
-          continue;
-        const routed = device.ports?.[name] ?? device.interfaces?.[name];
-        const cost = settings?.cost ? `, cost ${settings.cost}` : "";
-        for (const entry of routed?.addresses ?? []) {
-          const address = typeof entry === "string" ? entry : entry.address;
-          if (!isCidr(address) || isHostRoute(address))
-            continue;
-          const key = `${area} ${network(address)}`;
-          const member = { device, name, line: `${device.name} ${name} ${address}${cost}` };
-          byKey.set(key, [...byKey.get(key) ?? [], member]);
-        }
-      }
+function checkVrrp(holders) {
+  const findings = [];
+  const bySegment = new Map;
+  for (const holder of holders) {
+    const segment = network(holder.address);
+    for (const group of holder.vrrp) {
+      if (!keyOf(group.address) || familyOf2(group.address) !== familyOf2(holder.address))
+        continue;
+      if (!contains2(segment, group.address))
+        continue;
+      bySegment.set(segment, [...bySegment.get(segment) ?? [], { holder, id: group.id, address: group.address }]);
     }
   }
-  for (const [key, members] of byKey) {
-    const [area] = key.split(" ");
-    for (const [index, a] of members.entries()) {
-      for (const b of members.slice(index + 1)) {
-        if (a.device === b.device)
-          continue;
-        graph.edge({
-          layer: "ospf",
-          from: deviceId(a.device.name),
-          to: deviceId(b.device.name),
-          label: `area ${area}`,
-          detail: [a.line, b.line]
+  for (const members of bySegment.values()) {
+    for (const member of members) {
+      const where = `${member.holder.device.name} ${member.holder.name}`;
+      const others = members.filter((other) => other.holder.device !== member.holder.device);
+      const sameId = others.find((other) => other.id === member.id && keyOf(other.address) !== keyOf(member.address));
+      if (sameId) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP ${member.id} on ${member.holder.name} is ${member.address}, and on ${sameId.holder.device.name} ${sameId.holder.name} it is ${sameId.address}`
+        });
+      }
+      const sameAddress = others.find((other) => keyOf(other.address) === keyOf(member.address) && other.id !== member.id);
+      if (sameAddress) {
+        findings.push({
+          level: "error",
+          device: member.holder.device.name,
+          message: `VRRP address ${member.address} is id ${member.id} on ${where}, and id ${sameAddress.id} on ${sameAddress.holder.device.name} ${sameAddress.holder.name}`
         });
       }
     }
   }
+  return findings;
 }
-var endpointHost = (endpoint) => endpoint.replace(/:\d+$/, "").replace(/^\[(.*)\]$/, "$1");
-function tunnels2(devices, owners, graph) {
+function checkTunnels(devices, owners) {
+  const findings = [];
   const ends = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "gre" || iface.type === "vxlan" ? [{ device, name, iface }] : []));
   const same = (a, b) => keyOf(a) !== undefined && keyOf(a) === keyOf(b);
-  const mirrors = (a, b) => a.device !== b.device && a.iface.type === b.iface.type && same(a.iface.local, b.iface.remote) && same(a.iface.remote, b.iface.local) && (a.iface.type !== "vxlan" || b.iface.type === "vxlan" && a.iface.vni === b.iface.vni);
-  const describe2 = (end) => {
-    const vni = end.iface.type === "vxlan" ? `, VNI ${end.iface.vni}` : "";
-    return `${end.device.name} ${end.name}: ${end.iface.local} to ${end.iface.remote}${vni}`;
-  };
-  const paired = new Set;
   for (const end of ends) {
-    if (paired.has(end))
+    const far = owners.get(keyOf(end.iface.remote) ?? "")?.device;
+    if (!far || far === end.device)
       continue;
+    const report = (message) => findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
     const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
-    const mirror = ends.find((other) => !paired.has(other) && mirrors(end, other));
-    if (mirror) {
-      paired.add(mirror);
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(end.device.name),
-        to: deviceId(mirror.device.name),
-        label: `${kind} ${end.name} to ${mirror.name}`,
-        detail: [describe2(end), describe2(mirror)]
-      });
-      continue;
-    }
-    const owner = owners.get(keyOf(end.iface.remote) ?? "")?.device;
-    if (owner && owner !== end.device) {
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(end.device.name),
-        to: deviceId(owner.name),
-        label: `${kind} ${end.name}`,
-        detail: [describe2(end), `${owner.name} declares no tunnel back`],
-        oneSided: true
-      });
+    const mirror = ends.find((other) => other.device === far && other.iface.type === end.iface.type && same(other.iface.local, end.iface.remote) && same(other.iface.remote, end.iface.local));
+    if (!mirror) {
+      report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);
       continue;
     }
-    const outside = graph.node(`address:${end.iface.remote}`, "outside", end.iface.remote, end.iface.description ? [end.iface.description] : []);
-    graph.edge({
-      layer: "tunnels",
-      from: deviceId(end.device.name),
-      to: outside,
-      label: `${kind} ${end.name}`,
-      detail: [describe2(end)]
-    });
-  }
-  wireguard2(devices, owners, graph);
-}
-function wireguard2(devices, owners, graph) {
-  const interfaces = devices.flatMap((device) => Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "wireguard" ? [{ device, name, iface }] : []));
-  const farEndOf = (device, peer) => interfaces.find(({ device: other, iface }) => {
-    if (other === device)
-      return false;
-    const tunnelAddresses = (iface.addresses ?? []).map((entry) => host(typeof entry === "string" ? entry : entry.address));
-    const sendsFrom = tunnelAddresses.some((address) => isAddress(address) && peer.allowed_addresses.some((allowed) => isCidr(allowed) && contains(allowed, address)));
-    const endpoint = peer.endpoint ? endpointHost(peer.endpoint) : undefined;
-    const isEndpoint = endpoint !== undefined && owners.get(keyOf(endpoint) ?? "")?.device === other;
-    return sendsFrom || isEndpoint;
-  });
-  const drawn = new Set;
-  for (const { device, name, iface } of interfaces) {
-    const clients = [];
-    for (const peer of iface.peers ?? []) {
-      const far = farEndOf(device, peer);
-      if (far) {
-        const ends = [`${device.name} ${name}`, `${far.device.name} ${far.name}`].sort().join("|");
-        if (drawn.has(ends))
-          continue;
-        drawn.add(ends);
-        graph.edge({
-          layer: "tunnels",
-          from: deviceId(device.name),
-          to: deviceId(far.device.name),
-          label: `WireGuard ${name} to ${far.name}`,
-          detail: [`${device.name} ${name} peer ${peer.name}`]
-        });
-        continue;
-      }
-      if (!peer.endpoint) {
-        clients.push(peer);
-        continue;
-      }
-      const endpoint = endpointHost(peer.endpoint);
-      const outside2 = graph.node(`address:${endpoint}`, "outside", peer.name, [`WireGuard endpoint ${peer.endpoint}`]);
-      graph.edge({
-        layer: "tunnels",
-        from: deviceId(device.name),
-        to: outside2,
-        label: `WireGuard ${name}`,
-        detail: [`${device.name} ${name} peer ${peer.name}, allowed ${peer.allowed_addresses.join(", ")}`]
-      });
-    }
-    if (!clients.length)
+    if (end.iface.type !== "vxlan" || mirror.iface.type !== "vxlan")
       continue;
-    const outside = graph.node(`clients:${device.name}:${name}`, "outside", `${clients.length} ${clients.length === 1 ? "client" : "clients"}`, clients.map((peer) => `${peer.name}: ${peer.allowed_addresses.join(", ")}`));
-    graph.edge({
-      layer: "tunnels",
-      from: deviceId(device.name),
-      to: outside,
-      label: `WireGuard ${name}`,
-      detail: [`peers that dial in to ${device.name} ${name}`]
-    });
-  }
-}
-function graphOf(devices) {
-  const graph = new Builder;
-  for (const device of devices)
-    graph.node(deviceId(device.name), "device", device.name, describeDevice(device));
-  const holders2 = holdersOf(devices);
-  const owners = new Map;
-  for (const holder of holders2) {
-    const key = keyOf(host(holder.address));
-    if (!owners.has(key))
-      owners.set(key, holder);
+    if (end.iface.vni !== mirror.iface.vni)
+      report(`VNI ${end.iface.vni}, and ${far.name} ${mirror.name} has ${mirror.iface.vni}`);
+    const port = end.iface.port ?? 4789;
+    const farPort = mirror.iface.port ?? 4789;
+    if (port !== farPort)
+      report(`UDP port ${port}, and ${far.name} ${mirror.name} has ${farPort}`);
   }
-  cables(devices, graph);
-  segments(holders2, owners, graph);
-  sessions(devices, owners, graph);
-  adjacencies(devices, graph);
-  tunnels2(devices, owners, graph);
-  return { nodes: [...graph.nodes.values()], edges: graph.edges };
-}
-function only(graph, layers, deviceNames = []) {
-  const named = new Set(deviceNames.map(deviceId));
-  const touches = (edge) => !named.size || named.has(edge.from) || named.has(edge.to);
-  const edges = graph.edges.filter((edge) => layers.includes(edge.layer) && touches(edge));
-  const ends = new Set(edges.flatMap((edge) => [edge.from, edge.to]));
-  const nodes = graph.nodes.filter((node) => (named.size ? named.has(node.id) : node.kind === "device") || ends.has(node.id));
-  return { nodes, edges };
+  return findings;
 }
 
 // src/core/validate.ts
-import { X509Certificate as X509Certificate2 } from "node:crypto";
-function validate(network2) {
+function validate(network) {
   const findings = [];
   const seen = new Set;
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     if (seen.has(device.name))
       findings.push({ level: "error", device: device.name, message: "declared twice" });
     seen.add(device.name);
   }
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     const report = (message) => findings.push({ level: "error", device: device.name, message });
     checkDevice(device, report);
     const adapter = adapters[device.platform];
@@ -4002,9 +3866,9 @@ function validate(network2) {
       for (const field of adapter.unsupported(device))
         report(`${device.platform} cannot express ${field}`);
   }
-  findings.push(...checkLinks(network2.devices));
-  for (const check of network2.checks ?? [])
-    findings.push(...check(network2.devices));
+  findings.push(...checkAcross(network.devices));
+  for (const check of network.checks ?? [])
+    findings.push(...check(network.devices));
   return findings;
 }
 
@@ -4036,18 +3900,18 @@ class Names {
 }
 function checkDevice(device, report) {
   const names = new Names(device, report);
-  const cidr = (where, value2) => {
-    if (!isCidr(value2))
-      report(`${where}: '${value2}' is not an address with a length`);
+  const cidr = (where, value) => {
+    if (!isCidr2(value))
+      report(`${where}: '${value}' is not an address with a length`);
   };
-  const ip = (where, value2) => {
-    if (!isAddress(value2))
-      report(`${where}: '${value2}' is not an address`);
+  const ip = (where, value) => {
+    if (!isAddress2(value))
+      report(`${where}: '${value}' is not an address`);
   };
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
   checkVlans(device, report);
-  checkAddresses(device, report, cidr, ip);
+  checkAddresses2(device, report, cidr, ip);
   checkPorts(device, names, report);
   checkInterfaces(device, names, report, ip);
   checkRouting(device, names, report, cidr, ip);
@@ -4066,13 +3930,13 @@ function checkVlans(device, report) {
     ids.set(vlan.id, name);
   }
 }
-function checkAddresses(device, report, cidr, ip) {
+function checkAddresses2(device, report, cidr, ip) {
   const holderOf = new Map;
-  const holders2 = [
+  const holders = [
     ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
     ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({ where: `interface ${name}`, settings }))
   ];
-  for (const { where, settings } of holders2) {
+  for (const { where, settings } of holders) {
     for (const entry of settings?.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
       cidr(where, address);
@@ -4135,7 +3999,7 @@ function checkInterfaces(device, names, report, ip) {
     if (iface.type === "wireguard") {
       for (const peer of iface.peers ?? []) {
         for (const address of peer.allowed_addresses) {
-          if (!isCidr(address))
+          if (!isCidr2(address))
             report(`interface ${name} peer ${peer.name}: '${address}' is not an address with a length`);
         }
       }
@@ -4144,7 +4008,7 @@ function checkInterfaces(device, names, report, ip) {
 }
 function checkRouting(device, names, report, cidr, ip) {
   const routing = device.routing;
-  const policies2 = device.policies ?? {};
+  const policies = device.policies ?? {};
   for (const route of routing?.static ?? []) {
     cidr("static route", route.prefix);
     if (!route.via && !route.interface && !route.blackhole)
@@ -4155,7 +4019,7 @@ function checkRouting(device, names, report, cidr, ip) {
     names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
   }
   const bgp = routing?.bgp;
-  const isPolicy = (policy) => policy !== undefined && (policy in policies2);
+  const isPolicy = (policy) => policy !== undefined && (policy in policies);
   for (const prefix of bgp?.networks ?? [])
     cidr("BGP network", prefix);
   for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
@@ -4173,7 +4037,7 @@ function checkRouting(device, names, report, cidr, ip) {
       names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
     }
     const local = neighbor.local_address ?? group?.local_address;
-    if (local && familyOf(local) !== familyOf(neighbor.address))
+    if (local && familyOf2(local) !== familyOf2(neighbor.address))
       report(`neighbor ${name} local_address and address differ in family`);
   }
   for (const [areaId, area] of Object.entries(routing?.ospf?.areas ?? {})) {
@@ -4184,11 +4048,11 @@ function checkRouting(device, names, report, cidr, ip) {
   }
 }
 function checkPolicies(device, names, report, cidr) {
-  const policies2 = device.policies ?? {};
+  const policies = device.policies ?? {};
   const sets = device.prefix_sets ?? {};
-  for (const [name, rules] of Object.entries(policies2)) {
+  for (const [name, rules] of Object.entries(policies)) {
     for (const rule of rules) {
-      names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies2);
+      names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies);
       const set = rule.match?.prefix_set;
       names.expect(`policy ${name} prefix set`, set, set !== undefined && set in sets);
       if (rule.match?.prefix)
@@ -4198,11 +4062,11 @@ function checkPolicies(device, names, report, cidr) {
   const visit = (policy, path) => {
     if (path.includes(policy))
       return report(`policy ${[...path, policy].join(" -> ")} calls itself`);
-    for (const rule of policies2[policy] ?? [])
+    for (const rule of policies[policy] ?? [])
       if (rule.call)
         visit(rule.call, [...path, policy]);
   };
-  for (const policy of Object.keys(policies2))
+  for (const policy of Object.keys(policies))
     visit(policy, []);
 }
 function checkFirewall(device, names, cidr) {
@@ -4210,7 +4074,7 @@ function checkFirewall(device, names, cidr) {
   const sets = firewall?.address_sets ?? {};
   for (const [name, members] of Object.entries(sets)) {
     for (const member of members) {
-      if (!isAddress(member))
+      if (!isAddress2(member))
         cidr(`address set ${name}`, member);
     }
   }
@@ -4236,12 +4100,12 @@ function checkServices(device, names, report, cidr) {
   for (const [name, server] of Object.entries(device.dhcp ?? {})) {
     names.expectInterface(`DHCP ${name} interface`, server.interface);
     cidr(`DHCP ${name}`, server.network);
-    if (!isCidr(server.network))
+    if (!isCidr2(server.network))
       continue;
     const reserved = (server.reservations ?? []).map((reservation) => reservation.address);
-    const addresses2 = [server.gateway, ...server.pool, ...reserved];
-    for (const address of addresses2) {
-      if (!contains(server.network, address))
+    const addresses = [server.gateway, ...server.pool, ...reserved];
+    for (const address of addresses) {
+      if (!contains2(server.network, address))
         report(`DHCP ${name}: ${address} is outside ${server.network}`);
     }
   }
@@ -4263,8 +4127,8 @@ function checkServices(device, names, report, cidr) {
     report("SNMP is on with neither a community nor a user");
 }
 function checkCertificates(device, names, report) {
-  const certificates2 = device.certificates ?? {};
-  for (const [name, certificate] of Object.entries(certificates2)) {
+  const certificates = device.certificates ?? {};
+  for (const [name, certificate] of Object.entries(certificates)) {
     try {
       new X509Certificate2(certificate.certificate);
     } catch {
@@ -4273,54 +4137,12 @@ function checkCertificates(device, names, report) {
   }
   for (const service of ["https", "api_tls"]) {
     const name = device.management?.[service]?.certificate;
-    names.expect(`${service} certificate`, name, name !== undefined && name in certificates2);
-    if (name && certificates2[name] && !certificates2[name].private_key) {
+    names.expect(`${service} certificate`, name, name !== undefined && name in certificates);
+    if (name && certificates[name] && !certificates[name].private_key) {
       report(`${service} certificate ${name} has no private key to serve with`);
     }
   }
 }
-function carried(device, port) {
-  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
-  return {
-    access: id(port.access_vlan),
-    native: id(port.native_vlan),
-    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
-  };
-}
-function checkLinks(devices) {
-  const findings = [];
-  const byName = new Map(devices.map((device) => [device.name, device]));
-  for (const device of devices) {
-    for (const [portName, port] of Object.entries(device.ports ?? {})) {
-      const link = port?.link;
-      if (!port || !link)
-        continue;
-      const report = (message) => findings.push({
-        level: "error",
-        device: device.name,
-        message: `port ${portName} link: ${message}`
-      });
-      const far = byName.get(link.device);
-      if (!far) {
-        report(`device ${link.device} is not in the network`);
-        continue;
-      }
-      const farPort = far.ports?.[link.port];
-      if (!farPort) {
-        report(`${link.device} does not declare port ${link.port}`);
-        continue;
-      }
-      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
-      if (!linksBack)
-        report(`${link.device} ${link.port} does not link back to it`);
-      const here = JSON.stringify(carried(device, port));
-      const there = JSON.stringify(carried(far, farPort));
-      if (here !== there)
-        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
-    }
-  }
-  return findings;
-}
 
 // src/cli/graph.ts
 function markOf(graph, node) {
@@ -4336,7 +4158,7 @@ function markOf(graph, node) {
 }
 function mermaid(graph) {
   const ids = new Map(graph.nodes.map((node, index) => [node.id, `n${index}`]));
-  const text = (...lines2) => `"${lines2.map((line2) => line2.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
+  const text = (...lines) => `"${lines.map((line) => line.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
   const shapes = {
     device: (label) => `[${label}]`,
     segment: (label) => `([${label}])`,
@@ -4362,7 +4184,7 @@ function mermaid(graph) {
 `;
 }
 function dot(graph) {
-  const text = (value2) => `"${value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+  const text = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
   const colors = { error: "#d1242f", warning: "#bf8700" };
   const shapes = {
     device: "shape=box, style=rounded",
@@ -4392,6 +4214,116 @@ ${node.detail[0] ?? ""}` : node.label;
 `;
 }
 
+// src/cli/rename.ts
+import { existsSync as existsSync2, readFileSync as readFileSync3, renameSync, writeFileSync } from "node:fs";
+import { basename, dirname, extname, join as join3, resolve as resolve2 } from "node:path";
+
+// src/core/files.ts
+import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
+import { join as join2, relative } from "node:path";
+var SKIPPED = new Set(["node_modules", ".git", ".circuit", "dist"]);
+function projectSources(root, directory = root) {
+  const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return entries.flatMap((entry) => {
+    if (entry.isDirectory())
+      return SKIPPED.has(entry.name) ? [] : projectSources(root, join2(directory, entry.name));
+    return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root, join2(directory, entry.name))] : [];
+  });
+}
+var FIRST_NAME = /^[\s\S]*?\bname\s*:\s*(["'`])(.*?)\1/;
+function declaresDevice(text, name) {
+  return [...text.matchAll(/\bdefineDevice\s*\(/g)].some((call) => FIRST_NAME.exec(text.slice(call.index + call[0].length))?.[2] === name);
+}
+function deviceFiles(root, name, sources = projectSources(root)) {
+  return sources.filter((file) => declaresDevice(readFileSync2(join2(root, file), "utf8"), name));
+}
+
+// src/cli/rename.ts
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function planRename(root, from, to, options) {
+  const changes = [];
+  const moves = [];
+  const exact = new RegExp(`(["'\`])${escape(from)}\\1`, "g");
+  const anywhere = new RegExp(`(^|[^A-Za-z0-9_.-])${escape(from)}(?![A-Za-z0-9_-])`);
+  const sources = projectSources(root);
+  const declaring = new Set;
+  for (const file of sources) {
+    const text = readFileSync3(join3(root, file), "utf8");
+    const lines = text.split(`
+`);
+    if (declaresDevice(text, from))
+      declaring.add(file);
+    for (const [index, before] of lines.entries()) {
+      const after = before.replace(exact, (_match, quote) => `${quote}${to}${quote}`);
+      if (after !== before)
+        changes.push({ file, line: index + 1, before, after });
+    }
+  }
+  if (!declaring.size) {
+    throw new Error(`no file declares name: "${from}"; the name may be built from parts, such as a template string, so rename it by hand`);
+  }
+  for (const snapshot of options.snapshots) {
+    moves.push({ from: snapshot, to: join3(dirname(snapshot), `${to}${extname(snapshot)}`) });
+  }
+  if (options.file) {
+    if (declaring.size > 1)
+      throw new Error(`${[...declaring].join(" and ")} both declare name: "${from}"; rename the file by hand`);
+    const [file] = [...declaring];
+    const target = join3(dirname(file), `${to}${extname(file)}`);
+    if (existsSync2(join3(root, target)))
+      throw new Error(`${target} already exists`);
+    moves.push({ from: file, to: target });
+    changes.push(...importChanges(root, sources, file, target, changes));
+  }
+  const mentions = sources.flatMap((file) => readFileSync3(join3(root, file), "utf8").split(`
+`).flatMap((original, index) => {
+    const text = changes.find((change) => change.file === file && change.line === index + 1)?.after ?? original;
+    return anywhere.test(text) ? [{ file, line: index + 1, text: text.trim() }] : [];
+  }));
+  return { changes, moves, mentions };
+}
+function importChanges(root, sources, file, target, earlier) {
+  const result = [];
+  const withoutExtension = (path) => path.replace(/\.(ts|mts|cts|js|mjs|cjs)$/, "");
+  const moved = withoutExtension(resolve2(root, file));
+  for (const source of sources) {
+    const lines = readFileSync3(join3(root, source), "utf8").split(`
+`);
+    for (const [index, original] of lines.entries()) {
+      const line = index + 1;
+      const changed = earlier.find((change) => change.file === source && change.line === line);
+      const before = changed?.after ?? original;
+      const after = before.replace(/(\bfrom\s+|\bimport\s*\(\s*)(["'])(\.{1,2}\/[^"']+)\2/g, (match, lead, quote, specifier) => {
+        if (withoutExtension(resolve2(root, dirname(source), specifier)) !== moved)
+          return match;
+        const extension = specifier.match(/\.(ts|mts|cts|js|mjs|cjs)$/)?.[0] ?? "";
+        const renamed = `${dirname(specifier)}/${basename(withoutExtension(target))}${extension}`;
+        return `${lead}${quote}${renamed}${quote}`;
+      });
+      if (after === before)
+        continue;
+      if (changed)
+        changed.after = after;
+      else
+        result.push({ file: source, line, before: original, after });
+    }
+  }
+  return result;
+}
+function applyRename(root, plan) {
+  const files = new Set(plan.changes.map((change) => change.file));
+  for (const file of files) {
+    const lines = readFileSync3(join3(root, file), "utf8").split(`
+`);
+    for (const change of plan.changes.filter((each) => each.file === file))
+      lines[change.line - 1] = change.after;
+    writeFileSync(join3(root, file), lines.join(`
+`));
+  }
+  for (const move of plan.moves)
+    renameSync(join3(root, move.from), join3(root, move.to));
+}
+
 // src/cli/index.ts
 var HELP = `usage: circuit <command> [device...] [options]
 
@@ -4412,18 +4344,28 @@ var HELP = `usage: circuit <command> [device...] [options]
   prometheus            every device with SNMP, as Prometheus targets for snmp_exporter
                           --auths        snmp_exporter's auths for them instead, with secrets as \${NAME}
   secrets               every secret the config uses, and whether each can be read
+  rename <device> <new-name>
+                        give a device a new name in every file that names it, with --confirm
+                          --file         also rename the file that declares it, to <new-name>.ts
+  addresses [prefix]    every address the config uses, by prefix, and what is still free
+                          --length=N     free prefixes of this length, instead of the fewest that cover the free space
+                          --format=json  as JSON
   graph [device...]     the network as a graph, from the config alone, without contacting a device
                           --layer=l1     l1, l2, l3, bgp, ospf or tunnels, several with commas, or all
                           --format=mermaid  mermaid, dot or json
-  studio                the graph in the browser, drawn again whenever the config changes
-                          --port=4600    the port it listens on, on this machine only
+  studio                Circuit Studio: the network in the browser, drawn again whenever the config changes
+                          --port=4600    the port it listens on
                           --no-open      do not open the browser
+                          --host=0.0.0.0 listen on a server's address instead, with --allow-host
+                          --allow-host=studio.example.com
+                                         the names it is reached by, several with commas
+                          --json         print what Studio shows, as JSON, instead
 
   --config <path>       the network's config file, circuit.config.ts in the working directory by default`;
 var DEFAULT_CONFIG = "circuit.config.ts";
 var [command2, ...args] = process.argv.slice(2);
 if (command2 === "new") {
-  const { create } = await import("../chunks/new-7n8qvtjd.js");
+  const { create } = await import("../chunks/new-ny89s7y7.js");
   await create(args);
   process.exit(0);
 }
@@ -4434,12 +4376,12 @@ if (!command2 || command2 === "help" || command2 === "--help" || command2 === "-
 var configAt = args.indexOf("--config");
 var configArgument = configAt >= 0 ? args[configAt + 1] : args.find((arg) => arg.startsWith("--config="))?.slice("--config=".length);
 var rest = args.filter((arg, index) => index !== configAt && (configAt < 0 || index !== configAt + 1) && !arg.startsWith("--config="));
-var configPath = resolve2(process.cwd(), configArgument ?? DEFAULT_CONFIG);
-if (!existsSync2(configPath)) {
+var configPath = resolve3(process.cwd(), configArgument ?? DEFAULT_CONFIG);
+if (!existsSync3(configPath)) {
   console.error(configArgument ? `no config at ${configPath}` : `no ${DEFAULT_CONFIG} in ${process.cwd()}; name another with --config <path>`);
   process.exit(1);
 }
-var root2 = dirname(configPath);
+var root2 = dirname2(configPath);
 useRoot(root2);
 async function load(path) {
   if (process.versions.bun)
@@ -4471,9 +4413,9 @@ function one() {
   return device ?? fail("name a device");
 }
 var adapterOf = (device) => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
-var generated = join2(root2, ".circuit");
-var stateDirectory = join2(generated, "state");
-var statePath = (device) => join2(stateDirectory, device.name + adapterOf(device).extension);
+var generated = join4(root2, ".circuit");
+var stateDirectory = join4(generated, "state");
+var statePath = (device) => join4(stateDirectory, device.name + adapterOf(device).extension);
 var GENERATED_README = `# Written by Circuit
 
 Do not edit anything here: an edit changes nothing on a device, and Circuit overwrites it. Change the config instead.
@@ -4482,8 +4424,8 @@ Do not edit anything here: an edit changes nothing on a device, and Circuit over
 `;
 function writeState(device, text) {
   mkdirSync(stateDirectory, { recursive: true });
-  writeFileSync(join2(generated, "README.md"), GENERATED_README);
-  writeFileSync(statePath(device), text);
+  writeFileSync2(join4(generated, "README.md"), GENERATED_README);
+  writeFileSync2(statePath(device), text);
 }
 function guard(devices) {
   const relevant = new Set(devices.map((device) => device.name));
@@ -4498,18 +4440,18 @@ function guard(devices) {
     fail(`
 ${errors} error(s).`);
 }
-function show(device, plan4) {
-  const commands = plan4.steps.reduce((count, step) => count + step.send.length, 0);
-  const summary = commands ? `${commands} command(s) in ${plan4.steps.length} step(s)` : "matches";
+function show(device, plan) {
+  const commands = plan.steps.reduce((count, step) => count + step.send.length, 0);
+  const summary = commands ? `${commands} command(s) in ${plan.steps.length} step(s)` : "matches";
   console.log(`${device.name}: ${summary}`);
-  for (const step of plan4.steps) {
+  for (const step of plan.steps) {
     console.log(`  ${step.title}`);
-    for (const line2 of step.show)
-      console.log(`    ${line2.slice(0, 220)}`);
+    for (const line of step.show)
+      console.log(`    ${line.slice(0, 220)}`);
   }
-  for (const problem of plan4.problems)
+  for (const problem of plan.problems)
     console.log(`  PROBLEM ${problem}`);
-  return commands + plan4.problems.length;
+  return commands + plan.problems.length;
 }
 function validateCommand() {
   guard([...network2.devices]);
@@ -4525,13 +4467,13 @@ function diffCommand() {
   let differences = 0;
   for (const device of devices) {
     const path = statePath(device);
-    if (!existsSync2(path)) {
+    if (!existsSync3(path)) {
       console.log(`${device.name}: no snapshot, run snapshot first`);
       continue;
     }
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
-    differences += show(device, plan4);
+    const plan = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
+    differences += show(device, plan);
   }
   process.exit(differences ? 1 : 0);
 }
@@ -4542,13 +4484,13 @@ async function snapshotCommand() {
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
   }
-  if (names.length || !existsSync2(stateDirectory))
+  if (names.length || !existsSync3(stateDirectory))
     return;
-  const current = new Set(network2.devices.map((device) => basename(statePath(device))));
-  for (const file of readdirSync(stateDirectory)) {
+  const current = new Set(network2.devices.map((device) => basename2(statePath(device))));
+  for (const file of readdirSync2(stateDirectory)) {
     if (current.has(file))
       continue;
-    rmSync(join2(stateDirectory, file));
+    rmSync(join4(stateDirectory, file));
     console.log(`${file}: removed, no such device in the config`);
   }
 }
@@ -4558,10 +4500,10 @@ async function applyCommand() {
   const adapter = adapterOf(device);
   const live = await adapter.read(device, network2.devices);
   writeState(device, live);
-  const plan4 = adapter.plan(adapter.render(device), live, options);
-  if (!show(device, plan4))
+  const plan = adapter.plan(adapter.render(device), live, options);
+  if (!show(device, plan))
     return;
-  if (plan4.problems.length)
+  if (plan.problems.length)
     fail(`
 Not sent: resolve the problems first.`);
   if (!confirmed) {
@@ -4569,13 +4511,13 @@ Not sent: resolve the problems first.`);
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await adapter.apply(device, network2.devices, plan4, options);
+  await adapter.apply(device, network2.devices, plan, options);
   writeState(device, await adapter.read(device, network2.devices));
   console.log("snapshot updated");
 }
 async function refreshCommand() {
   const device = one();
-  const fill2 = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
+  const fill = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
   for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
     if (!("source" in set))
       continue;
@@ -4586,7 +4528,7 @@ async function refreshCommand() {
     }
     console.log(`${name}: ${prefixes.length} prefixes from ${registry} ${query}`);
     if (confirmed)
-      await fill2(device, network2.devices, name, family, prefixes);
+      await fill(device, network2.devices, name, family, prefixes);
   }
   if (!confirmed)
     console.log(`
@@ -4634,13 +4576,13 @@ function communitiesCommand() {
   }
 }
 async function peeringdbCommand() {
-  const plan4 = await planPeeringDb(network2);
-  for (const name of plan4.unknown) {
+  const plan = await planPeeringDb(network2);
+  for (const name of plan.unknown) {
     console.log(`  PeeringDB lists ${name}, which the config does not. Remove it by hand if the network left.`);
   }
-  for (const change of plan4.changes)
+  for (const change of plan.changes)
     console.log(`  ${change.summary}`);
-  if (!plan4.changes.length) {
+  if (!plan.changes.length) {
     console.log("PeeringDB matches the config.");
     return;
   }
@@ -4649,17 +4591,17 @@ async function peeringdbCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendPeeringDb(network2, plan4.changes);
+  await sendPeeringDb(network2, plan.changes);
 }
 async function librenmsCommand() {
-  const plan4 = await planLibreNms(network2);
-  for (const hostname of plan4.unknown)
+  const plan = await planLibreNms(network2);
+  for (const hostname of plan.unknown)
     console.log(`  LibreNMS monitors ${hostname}, which the config does not. Remove it by hand if it is gone.`);
-  for (const device of plan4.withoutSnmp)
+  for (const device of plan.withoutSnmp)
     console.log(`  ${device.name} has no SNMP in its config, so LibreNMS cannot poll it. Add management.snmp first.`);
-  for (const device of plan4.additions)
+  for (const device of plan.additions)
     console.log(`  add ${device.name}, ${device.connection.host}`);
-  if (!plan4.additions.length) {
+  if (!plan.additions.length) {
     console.log("LibreNMS monitors every device it can.");
     return;
   }
@@ -4668,7 +4610,7 @@ async function librenmsCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendLibreNms(network2, plan4.additions);
+  await sendLibreNms(network2, plan.additions);
 }
 function prometheusCommand() {
   if (flags.includes("--auths")) {
@@ -4683,14 +4625,14 @@ function prometheusCommand() {
     console.error(`${device.name} has no SNMP in its config; left out`);
   console.log(JSON.stringify(targets, null, 4));
 }
-function secretsIn(value2, found = new Set) {
-  if (isSecret(value2))
-    found.add(referenceOf(value2));
-  else if (Array.isArray(value2))
-    for (const item of value2)
+function secretsIn(value, found = new Set) {
+  if (isSecret(value))
+    found.add(referenceOf(value));
+  else if (Array.isArray(value))
+    for (const item of value)
       secretsIn(item, found);
-  else if (typeof value2 === "object" && value2 !== null)
-    for (const item of Object.values(value2))
+  else if (typeof value === "object" && value !== null)
+    for (const item of Object.values(value))
       secretsIn(item, found);
   return found;
 }
@@ -4714,20 +4656,29 @@ ${references.length} secret(s), ${missing} missing.`);
 var flagValue = (name) => flags.find((flag) => flag.startsWith(`--${name}=`))?.slice(name.length + 3);
 function driftOf(device) {
   const path = statePath(device);
-  if (!existsSync2(path))
+  if (!existsSync3(path))
     return { status: "no snapshot", lines: [] };
   try {
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    const plan = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
     const lines = [
-      ...plan4.steps.flatMap((step) => [step.title, ...step.show.map((line2) => `  ${line2}`)]),
-      ...plan4.problems.map((problem) => `PROBLEM ${problem}`)
+      ...plan.steps.flatMap((step) => [step.title, ...step.show.map((line) => `  ${line}`)]),
+      ...plan.problems.map((problem) => `PROBLEM ${problem}`)
     ];
     return { status: lines.length ? "differs" : "matches", lines };
   } catch (error) {
     return { status: "cannot plan", lines: [error.message] };
   }
 }
+function annotatedGraph(layers, deviceNames) {
+  const graph = only(graphOf(network2.devices), layers, deviceNames);
+  const shown = new Set(graph.nodes.map((node) => node.label));
+  return {
+    ...graph,
+    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
+    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
+  };
+}
 function graphCommand() {
   const requested = (flagValue("layer") ?? "l1").split(",");
   const layers = requested.includes("all") ? [...LAYERS] : requested;
@@ -4736,13 +4687,7 @@ function graphCommand() {
     fail(`no layer ${unknown.join(", ")}; known: ${LAYERS.join(", ")}, all`);
   const format = flagValue("format") ?? "mermaid";
   const devices = selected(true);
-  const graph = only(graphOf(network2.devices), layers, names.length ? devices.map((device) => device.name) : []);
-  const shown = new Set(graph.nodes.map((node) => node.label));
-  const annotated = {
-    ...graph,
-    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
-    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
-  };
+  const annotated = annotatedGraph(layers, names.length ? devices.map((device) => device.name) : []);
   if (format === "mermaid")
     process.stdout.write(mermaid(annotated));
   else if (format === "dot")
@@ -4752,12 +4697,117 @@ function graphCommand() {
   else
     fail(`no format ${format}; known: mermaid, dot, json`);
 }
+function printSegment(segment, indent) {
+  const next = segment.next ? `, next ${segment.next}` : "";
+  console.log(`${indent}${segment.prefix}, ${segment.free} free${next}`);
+  const width = Math.max(...segment.uses.map((use) => use.address.length)) + 2;
+  for (const use of segment.uses)
+    console.log(`${indent}    ${use.address.padEnd(width)}${use.what}`);
+}
+function addressesCommand() {
+  const [within] = names;
+  if (within && !isCidr2(within))
+    fail(`${within} is not a prefix, such as 10.0.0.0/16`);
+  const lengthText = flagValue("length");
+  const length = lengthText === undefined ? undefined : Number(lengthText);
+  if (length !== undefined && !(Number.isInteger(length) && length >= 0 && length <= 128))
+    fail("--length takes a prefix length, such as 24");
+  const report = addressesOf(network2.devices, within);
+  if (flagValue("format") === "json") {
+    console.log(JSON.stringify(report, null, 4));
+    return;
+  }
+  for (const space of report.spaces) {
+    console.log(`${space.prefix}, ${space.owner}`);
+    for (const segment of space.segments)
+      printSegment(segment, "  ");
+    for (const block of space.blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+    if (length === undefined) {
+      console.log(`  free: ${space.free.join(", ") || "none"}`);
+    } else {
+      const { prefixes, total } = freeOfLength(space.free, length, 16);
+      const more = total > BigInt(prefixes.length) ? `, and ${total - BigInt(prefixes.length)} more` : "";
+      console.log(`  free /${length}: ${prefixes.join(", ") || "none"}${more}`);
+    }
+    console.log("");
+  }
+  const { segments, blocks } = report.elsewhere;
+  if (segments.length || blocks.length) {
+    console.log("Outside the space the network originates");
+    for (const segment of segments)
+      printSegment(segment, "  ");
+    for (const block of blocks)
+      console.log(`  ${block.prefix}  ${block.what}`);
+  }
+  if (!report.spaces.length && !segments.length && !blocks.length)
+    console.log("The config holds no addresses.");
+}
+function renameCommand() {
+  const [from, to] = names;
+  if (!from || !to)
+    fail("usage: circuit rename <device> <new-name> [--file] [--confirm]");
+  const device = network2.devices.find((candidate) => candidate.name === from);
+  if (!device)
+    fail(`no device ${from}; known: ${network2.devices.map((candidate) => candidate.name).join(", ")}`);
+  if (network2.devices.some((candidate) => candidate.name === to))
+    fail(`${to} is already a device`);
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(to))
+    fail(`${to} is not a hostname: letters, digits, dots, dashes and underscores`);
+  const snapshot = statePath(device);
+  const snapshots = existsSync3(snapshot) ? [relative2(root2, snapshot)] : [];
+  let plan;
+  try {
+    plan = planRename(root2, from, to, { file: flags.includes("--file"), snapshots });
+  } catch (error) {
+    fail(error.message);
+  }
+  for (const change of plan.changes) {
+    console.log(`${change.file}:${change.line}`);
+    console.log(`  - ${change.before.trim()}`);
+    console.log(`  + ${change.after.trim()}`);
+  }
+  for (const move of plan.moves)
+    console.log(`move ${move.from} to ${move.to}`);
+  if (plan.mentions.length) {
+    console.log(`
+Still naming ${from}, left as they are: change them by hand if they mean the device.`);
+    for (const mention of plan.mentions)
+      console.log(`  ${mention.file}:${mention.line}  ${mention.text.slice(0, 160)}`);
+  }
+  if (!confirmed) {
+    console.log(`
+Nothing written. Re-run with --confirm.`);
+    return;
+  }
+  applyRename(root2, plan);
+  console.log(`
+Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its old hostname until then.`);
+}
 async function studioCommand() {
+  if (flags.includes("--json")) {
+    const sources = projectSources(root2);
+    const data = studioData(network2.devices, annotatedGraph(LAYERS, []), {
+      render: (device) => adapterOf(device).render(device),
+      snapshot: (device) => existsSync3(statePath(device)) ? readFileSync4(statePath(device), "utf8") : undefined,
+      files: (device) => ({
+        source: deviceFiles(root2, device.name, sources)[0]?.split(sep).join("/"),
+        snapshot: existsSync3(statePath(device)) ? relative2(root2, statePath(device)).split(sep).join("/") : undefined
+      })
+    });
+    console.log(JSON.stringify(data));
+    return;
+  }
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { studio } = await import("../chunks/studio-femhydvd.js");
-  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open") });
+  const { isLoopback, studio } = await import("../chunks/server-zapfzhv4.js");
+  const host = flagValue("host") ?? "127.0.0.1";
+  const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
+  if (!isLoopback(host) && !allowHosts.length) {
+    fail(`Studio on ${host} needs --allow-host=<name>, the name people reach it by, such as studio.example.com`);
+  }
+  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open"), host, allowHosts });
 }
 var commands = {
   validate: validateCommand,
@@ -4772,6 +4822,8 @@ var commands = {
   librenms: librenmsCommand,
   prometheus: prometheusCommand,
   secrets: secretsCommand,
+  rename: renameCommand,
+  addresses: addressesCommand,
   graph: graphCommand,
   studio: studioCommand
 };