@takodotid/circuit 0.20.0 → 0.22.0

package/dist/cli/index.js

@@ -1,33 +1,29 @@
 #!/usr/bin/env node
 import {
+  portsOf,
+  spell,
   LAYERS,
-  addressesOf,
   deviceId,
-  freeOfLength,
-  graphOf,
-  holdersOf,
   keyOf,
+  holdersOf,
+  graphOf,
   only,
-  portsOf,
-  spell,
+  addressesOf,
+  freeOfLength,
   studioData
-} from "../chunks/index-jtzfw679.js";
+} from "../chunks/index-n4zpd25n.js";
 import {
-  contains,
-  familyOf,
-  host,
-  isAddress,
-  isCidr,
-  isGlobal,
-  netmask,
-  network,
+  familyOf2,
   split,
-  wildcard
-} from "../chunks/index-xm9nma2t.js";
-import {
-  __require,
-  __toESM
-} from "../chunks/index-fq57hya4.js";
+  isAddress2,
+  isCidr2,
+  network,
+  contains2,
+  netmask,
+  wildcard,
+  host2,
+  isGlobal2
+} from "../chunks/index-v8zgr7wm.js";
 
 // src/cli/index.ts
 import { createPrivateKey, createPublicKey } from "node:crypto";
@@ -98,10 +94,10 @@ function valueOf(reference) {
     const fullPath = join(root, path);
     if (!existsSync(fullPath))
       throw new Error(`secret file ${path} does not exist`);
-    const value2 = readFileSync(fullPath, "utf8").trimEnd();
-    if (!value2)
+    const value = readFileSync(fullPath, "utf8").trimEnd();
+    if (!value)
       throw new Error(`secret file ${path} is empty`);
-    return value2;
+    return value;
   }
   const value = process.env[reference] || dotenv()[reference];
   if (!value)
@@ -131,9 +127,9 @@ function offset(zone) {
 // src/transport/ssh.ts
 import { Client } from "ssh2";
 function connect(login) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     const client = new Client;
-    client.on("ready", () => resolve2(client)).on("error", reject).connect({
+    client.on("ready", () => resolve(client)).on("error", reject).connect({
       host: login.host,
       port: login.port ?? 22,
       username: login.user,
@@ -144,29 +140,29 @@ function connect(login) {
   });
 }
 function exec(client, command, timeout = 120000) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     client.exec(command, (error, stream) => {
       if (error)
         return reject(error);
       let output = "";
       const append = (chunk) => output += chunk.toString("utf8");
-      const timer = setTimeout(() => resolve2(output.trim()), timeout);
+      const timer = setTimeout(() => resolve(output.trim()), timeout);
       stream.on("data", append);
       stream.stderr.on("data", append);
       stream.on("close", () => {
         clearTimeout(timer);
-        resolve2(output.trim());
+        resolve(output.trim());
       });
     });
   });
 }
 function shell(client, columns = 200, rows = 1000) {
-  return new Promise((resolve2, reject) => {
-    client.shell({ cols: columns, rows }, (error, channel) => error ? reject(error) : resolve2(channel));
+  return new Promise((resolve, reject) => {
+    client.shell({ cols: columns, rows }, (error, channel) => error ? reject(error) : resolve(channel));
   });
 }
 function readUntil(channel, done, timeout, settle = 400) {
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     let output = "";
     let finished = false;
     const finish = () => {
@@ -174,7 +170,7 @@ function readUntil(channel, done, timeout, settle = 400) {
         return;
       finished = true;
       channel.removeListener("data", onData);
-      resolve2(output);
+      resolve(output);
     };
     const onData = (chunk) => {
       output += chunk.toString("utf8");
@@ -188,12 +184,12 @@ function readUntil(channel, done, timeout, settle = 400) {
 function send(channel, line, timeout = 20000, settle = 1500) {
   channel.write(line + `
 `);
-  return new Promise((resolve2) => {
+  return new Promise((resolve) => {
     let output = "";
     let timer;
     const finish = () => {
       channel.removeListener("data", onData);
-      resolve2(output);
+      resolve(output);
     };
     const onData = (chunk) => {
       output += chunk.toString("utf8");
@@ -205,7 +201,7 @@ function send(channel, line, timeout = 20000, settle = 1500) {
   });
 }
 function upload(client, path, content) {
-  return new Promise((resolve2, reject) => {
+  return new Promise((resolve, reject) => {
     client.sftp((error, sftp) => {
       if (error)
         return reject(error);
@@ -214,7 +210,7 @@ function upload(client, path, content) {
         if (writeError)
           reject(writeError);
         else
-          resolve2();
+          resolve();
       });
     });
   });
@@ -235,7 +231,7 @@ function lagIds(device) {
 function ipv4Networks(device, iface) {
   const settings = device.interfaces?.[iface] ?? device.ports?.[iface];
   const addresses = (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
-  return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
+  return addresses.filter((address) => familyOf2(address) === "ipv4").map((address) => network(address));
 }
 var SWITCH_SERVICES = ["ssh", "telnet", "snmp"];
 function switchUnsupported(device) {
@@ -312,12 +308,12 @@ function head(line) {
 }
 function compare(desired, current, dialect) {
   const canon = dialect.canon ?? ((line) => line);
-  const keyOf2 = (entry) => [...entry.path, canon(entry.line)].join("\x00");
+  const keyOf = (entry) => [...entry.path, canon(entry.line)].join("\x00");
   const pathKey = (path) => path.join("\x00");
   const wanted = entries(desired, dialect);
   const existing = entries(current, dialect);
-  const wantedKeys = new Set(wanted.map(keyOf2));
-  const existingKeys = new Set(existing.map(keyOf2));
+  const wantedKeys = new Set(wanted.map(keyOf));
+  const existingKeys = new Set(existing.map(keyOf));
   const wantedBlocks = new Set(wanted.map((entry) => pathKey([...entry.path, entry.line])));
   const groups = new Map;
   const groupFor = (path) => {
@@ -327,7 +323,7 @@ function compare(desired, current, dialect) {
     return groups.get(key);
   };
   for (const entry of wanted) {
-    if (existingKeys.has(keyOf2(entry)))
+    if (existingKeys.has(keyOf(entry)))
       continue;
     const ownBlock = pathKey([...entry.path, entry.line]);
     const opensBlock = wanted.some((other) => {
@@ -339,7 +335,7 @@ function compare(desired, current, dialect) {
     groupFor(entry.path).add.push(entry.line);
   }
   for (const entry of [...existing].reverse()) {
-    if (wantedKeys.has(keyOf2(entry)))
+    if (wantedKeys.has(keyOf(entry)))
       continue;
     const insideRemovedBlock = entry.path.some((_, depth) => {
       const enclosing = pathKey(entry.path.slice(0, depth + 1));
@@ -349,7 +345,7 @@ function compare(desired, current, dialect) {
       continue;
     const replaced = wanted.some((other) => {
       const sameBlock = pathKey(other.path) === pathKey(entry.path);
-      const isNew = !existingKeys.has(keyOf2(other));
+      const isNew = !existingKeys.has(keyOf(other));
       return sameBlock && isNew && head(other.line) === head(entry.line);
     });
     if (!replaced)
@@ -504,7 +500,7 @@ function render(device) {
   }
   if (allow.length) {
     lines.push(`access-list ${MANAGEMENT_ACL}`, "  description management");
-    allow.forEach((cidr, index) => lines.push(`  rule ${(index + 1) * 10} permit ${host(cidr)} ${netmask(split(cidr).len)}`));
+    allow.forEach((cidr, index) => lines.push(`  rule ${(index + 1) * 10} permit ${host2(cidr)} ${netmask(split(cidr).len)}`));
     lines.push("  rule 100 deny any", "!");
   }
   for (const [name, user] of Object.entries(device.users ?? {}))
@@ -529,8 +525,8 @@ function render(device) {
     lines.push(`interface vlan ${vlanId(iface.vlan)}`);
     for (const entry of iface.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
-      if (familyOf(address) === "ipv4")
-        lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+      if (familyOf2(address) === "ipv4")
+        lines.push(`ip address ${host2(address)} ${netmask(split(address).len)}`);
     }
     const ospfSettings = Object.values(ospf?.areas ?? {}).find((area) => area.interfaces[name])?.interfaces[name];
     if (ospfSettings?.network === "point-to-point")
@@ -549,7 +545,7 @@ function render(device) {
     for (const [areaId, area] of Object.entries(ospf.areas)) {
       for (const iface of Object.keys(area.interfaces)) {
         for (const prefix of ipv4Networks(device, iface)) {
-          lines.push(`network ${host(prefix)} ${wildcard(split(prefix).len)} area ${areaId}`);
+          lines.push(`network ${host2(prefix)} ${wildcard(split(prefix).len)} area ${areaId}`);
         }
       }
     }
@@ -584,7 +580,7 @@ function render(device) {
     lines.push(`snmp-server access-list ${MANAGEMENT_ACL}`);
   for (const route of device.routing?.static ?? []) {
     const { addr, len } = split(route.prefix);
-    if (familyOf(addr) === "ipv4" && route.via)
+    if (familyOf2(addr) === "ipv4" && route.via)
       lines.push(`ip route ${addr} ${netmask(len)} ${route.via}`);
   }
   if (management.telnet) {
@@ -726,11 +722,11 @@ function unsupported(device) {
     }
     for (const entry of iface.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
-      if (familyOf(address) === "ipv6")
+      if (familyOf2(address) === "ipv6")
         found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
     }
     for (const group of iface.vrrp ?? []) {
-      if (familyOf(group.address) === "ipv6")
+      if (familyOf2(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
     }
   }
@@ -751,7 +747,7 @@ function unsupported(device) {
     }
   }
   for (const route of routing?.static ?? []) {
-    if (!route.via || route.vrf || familyOf(route.prefix) === "ipv6") {
+    if (!route.via || route.vrf || familyOf2(route.prefix) === "ipv6") {
       found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
     }
     if (route.description || route.distance)
@@ -995,9 +991,9 @@ function parse(text) {
       menu = line;
       continue;
     }
-    const marker2 = /^# generated (\S+)$/.exec(line);
-    if (marker2)
-      generated.add(marker2[1]);
+    const marker = /^# generated (\S+)$/.exec(line);
+    if (marker)
+      generated.add(marker[1]);
     if (menu && /^(add|set)( |$)/.test(line))
       commands.push(parseLine(menu, line));
   }
@@ -1087,12 +1083,12 @@ function normalValue(command, property, value) {
   if (property === "tagged" || property === "untagged" || property === "slaves")
     return value.split(",").sort().join(",");
   const onInterface = property === "address" && (command.menu === "/ip address" || command.menu === "/ipv6 address");
-  const isAddress2 = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
+  const isAddress = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
   if (onInterface && !value.includes("/"))
     return `${value}/${value.includes(":") ? 64 : 32}`;
-  if (!onInterface && isAddress2 && /^[\d.]+\/32$/.test(value))
+  if (!onInterface && isAddress && /^[\d.]+\/32$/.test(value))
     return value.slice(0, -3);
-  if (!onInterface && isAddress2 && value.includes(":") && !value.includes("/") && !value.includes(","))
+  if (!onInterface && isAddress && value.includes(":") && !value.includes("/") && !value.includes(","))
     return `${value}/128`;
   return value;
 }
@@ -1421,13 +1417,13 @@ function planOrdered(menu, wanted, existing) {
     const inKeptChain = `[:typeof [:find $keep [${menu} get $id chain]]] != "nil"`;
     removeOld = `:local keep {${keep}}; :foreach id in=$${OLD_RULES} do={ :if (${inKeptChain}) do={ ${menu} remove $id } }`;
   }
-  const send2 = [
+  const send = [
     `:global ${OLD_RULES} [${menu} find${where}]`,
     ...wanted.map((item) => line(menu, "add", "", item.flags, item.attrs)),
     `:global ${OLD_RULES}; ${removeOld}; /system script environment remove [find name="${OLD_RULES}"]`
   ];
   const show = [...existing.map((item) => `- ${canonical(item)}`), ...wanted.map((item) => `+ ${canonical(item)}`)];
-  result.first.push({ title: `${menu}, in the order of the config`, show, send: send2 });
+  result.first.push({ title: `${menu}, in the order of the config`, show, send });
   if (hasChains) {
     for (const chain of droppedChains) {
       const selector = `[ find chain=${quote(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
@@ -1483,22 +1479,22 @@ class Output {
 `;
   }
 }
-function quote2(value2) {
-  const plain = /^[\w.:/@-]+$/.test(value2);
+function quote2(value) {
+  const plain = /^[\w.:/@-]+$/.test(value);
   if (plain)
-    return value2;
-  const escaped = value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
+    return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
   return `"${escaped}"`;
 }
 function command(verb, properties) {
-  const words2 = [verb];
-  for (const [name, value2] of Object.entries(properties)) {
-    if (value2 === undefined || value2 === false)
+  const words = [verb];
+  for (const [name, value] of Object.entries(properties)) {
+    if (value === undefined || value === false)
       continue;
-    const written = typeof value2 === "number" ? String(value2) : quote2(value2);
-    words2.push(`${name}=${written}`);
+    const written = typeof value === "number" ? String(value) : quote2(value);
+    words.push(`${name}=${written}`);
   }
-  return words2.join(" ");
+  return words.join(" ");
 }
 var yesNo = (on) => on ? "yes" : "no";
 var familySuffix = (family) => family === "ipv4" ? "V4" : "V6";
@@ -1761,7 +1757,7 @@ function splitEndpoint(endpoint) {
 function vrrp(out, ctx) {
   for (const { name, settings } of ctx.routed()) {
     for (const group of settings.vrrp ?? []) {
-      const ipv6 = familyOf(group.address) === "ipv6";
+      const ipv6 = familyOf2(group.address) === "ipv6";
       out.add("/interface vrrp", command("add", {
         interface: name,
         interval: group.interval ? duration(group.interval) : undefined,
@@ -1887,7 +1883,7 @@ function addresses(out, ctx) {
     for (const entry of settings.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
       const peer = typeof entry === "string" ? undefined : entry.peer;
-      if (familyOf(address) === "ipv4") {
+      if (familyOf2(address) === "ipv4") {
         out.add("/ip address", command("add", { address, comment: settings.description, interface: name, network: peer }));
       } else {
         out.add("/ipv6 address", command("add", { address, advertise: yesNo(settings.ipv6_ra), comment: settings.description, interface: name }));
@@ -1896,7 +1892,7 @@ function addresses(out, ctx) {
     for (const group of settings.vrrp ?? []) {
       const vrrpInterface = vrrpName(name, group.id);
       const comment = `VRRP ${group.id} on ${name}`;
-      if (familyOf(group.address) === "ipv4") {
+      if (familyOf2(group.address) === "ipv4") {
         out.add("/ip address", command("add", { address: `${group.address}/32`, comment, interface: vrrpInterface }));
       } else {
         out.add("/ipv6 address", command("add", {
@@ -1938,30 +1934,30 @@ function dhcp(out, ctx) {
   }
 }
 function dns(out, ctx) {
-  const dns2 = ctx.device.system?.dns;
-  out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns2?.serve), servers: dns2?.servers.join(",") ?? "" }));
+  const dns = ctx.device.system?.dns;
+  out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns?.serve), servers: dns?.servers.join(",") ?? "" }));
 }
 function addressLists(out, ctx) {
   const { device } = ctx;
-  const entries2 = [];
+  const entries = [];
   for (const [list, members] of Object.entries(device.firewall?.address_sets ?? {})) {
     for (const address of members)
-      entries2.push({ list, address });
+      entries.push({ list, address });
   }
   for (const [list, set] of Object.entries(device.prefix_sets ?? {})) {
     if ("prefixes" in set)
       for (const address of set.prefixes)
-        entries2.push({ list, address });
+        entries.push({ list, address });
     else
       out.add("/ip firewall address-list", `# generated ${list}`);
   }
   for (const prefix of device.routing?.bgp?.networks ?? []) {
-    entries2.push({ list: NETWORKS[familyOf(host(prefix))], address: prefix });
+    entries.push({ list: NETWORKS[familyOf2(host2(prefix))], address: prefix });
   }
   for (const family of ["ipv4", "ipv6"]) {
     const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
-    for (const { list, address } of entries2) {
-      if (familyOf(host(address)) !== family)
+    for (const { list, address } of entries) {
+      if (familyOf2(host2(address)) !== family)
         continue;
       out.add(menu, command("add", { address, list }));
     }
@@ -1981,7 +1977,7 @@ function renderFirewall(out, ctx) {
 function untracked(out, ctx, family) {
   const menu = family === "ipv4" ? "/ip firewall raw" : "/ipv6 firewall raw";
   for (const prefix of ctx.device.firewall?.untracked ?? []) {
-    if (familyOf(prefix) !== family)
+    if (familyOf2(prefix) !== family)
       continue;
     for (const [direction, property] of [
       ["to", "dst-address"],
@@ -1998,8 +1994,8 @@ function families(ctx, match) {
   if (match?.family)
     candidates = [match.family];
   else if (address)
-    candidates = [familyOf(address)];
-  const setHas = (set, family) => !set || (sets[set] ?? []).some((member) => familyOf(member) === family);
+    candidates = [familyOf2(address)];
+  const setHas = (set, family) => !set || (sets[set] ?? []).some((member) => familyOf2(member) === family);
   return candidates.filter((family) => setHas(match?.src_set, family) && setHas(match?.dst_set, family));
 }
 function matchProperties(ctx, match, family) {
@@ -2050,7 +2046,7 @@ function nat(out, ctx, family) {
     for (const rule of rules ?? []) {
       if (!families(ctx, rule.match).includes(family))
         continue;
-      if (rule.action !== "masquerade" && familyOf(rule.to) !== family)
+      if (rule.action !== "masquerade" && familyOf2(rule.to) !== family)
         continue;
       const action = rule.action === "masquerade" ? {
         action: "masquerade"
@@ -2072,7 +2068,7 @@ function switchAcls(out, ctx) {
       continue;
     for (const rule of ctx.device.acls?.[settings.acl] ?? []) {
       const match = rule.match ?? {};
-      const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address2) => address2 && familyOf(address2) === "ipv6");
+      const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address) => address && familyOf2(address) === "ipv6");
       const address = (prefix) => prefix && !ipv6 ? dottedMask(prefix) : prefix;
       for (const srcPort of each(match.src_port)) {
         for (const dstPort of each(match.dst_port)) {
@@ -2117,7 +2113,7 @@ function renderRouting(out, ctx) {
 }
 function staticRoutes(out, ctx) {
   for (const route of ctx.device.routing?.static ?? []) {
-    const menu = familyOf(host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
+    const menu = familyOf2(host2(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
     const verb = route.blackhole ? "add blackhole" : "add";
     const gateway = route.via ?? (route.interface ? ctx.name(route.interface) : undefined);
     out.add(menu, command(verb, {
@@ -2148,21 +2144,21 @@ function settingsOf(ctx, neighbor) {
   return { ...group, ...neighbor };
 }
 function familiesOf(ctx, neighbor) {
-  return settingsOf(ctx, neighbor).families ?? [familyOf(neighbor.address)];
+  return settingsOf(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
 }
 var chainName = (policy, family) => `${policy}-${familySuffix(family)}`;
 function appliesTo(ctx, rule, family) {
   const match = rule.match;
   if (match?.family && match.family !== family)
     return false;
-  if (match?.prefix && familyOf(host(match.prefix)) !== family)
+  if (match?.prefix && familyOf2(host2(match.prefix)) !== family)
     return false;
   if (match?.prefix_set) {
     const set = ctx.device.prefix_sets?.[match.prefix_set];
     if (!set)
       return false;
     const firstPrefix = "source" in set ? undefined : set.prefixes[0];
-    const setFamily = "source" in set ? set.source.family : firstPrefix && familyOf(host(firstPrefix));
+    const setFamily = "source" in set ? set.source.family : firstPrefix && familyOf2(host2(firstPrefix));
     if (setFamily !== family)
       return false;
   }
@@ -2193,35 +2189,35 @@ function conditions(rule) {
 }
 function actions(rule, family) {
   const set = rule.set ?? {};
-  const steps2 = [];
+  const steps = [];
   if (set.local_pref !== undefined)
-    steps2.push(`set bgp-local-pref ${set.local_pref}`);
+    steps.push(`set bgp-local-pref ${set.local_pref}`);
   if (set.med !== undefined)
-    steps2.push(`set bgp-med ${set.med}`);
+    steps.push(`set bgp-med ${set.med}`);
   if (set.prepend !== undefined)
-    steps2.push(`set bgp-path-prepend ${set.prepend}`);
+    steps.push(`set bgp-path-prepend ${set.prepend}`);
   for (const pattern of set.remove_communities ?? [])
-    steps2.push(`delete bgp-communities regexp "${communityPattern(pattern)}"`);
+    steps.push(`delete bgp-communities regexp "${communityPattern(pattern)}"`);
   if (set.communities)
-    steps2.push(`set bgp-communities ${set.communities.join(",")}`);
+    steps.push(`set bgp-communities ${set.communities.join(",")}`);
   if (set.add_communities)
-    steps2.push(`append bgp-communities ${set.add_communities.join(",")}`);
+    steps.push(`append bgp-communities ${set.add_communities.join(",")}`);
   for (const pattern of set.remove_large_communities ?? []) {
-    steps2.push(`delete bgp-large-communities regexp "${communityPattern(pattern)}"`);
+    steps.push(`delete bgp-large-communities regexp "${communityPattern(pattern)}"`);
   }
   if (set.large_communities)
-    steps2.push(`set bgp-large-communities ${set.large_communities.join(",")}`);
+    steps.push(`set bgp-large-communities ${set.large_communities.join(",")}`);
   if (set.add_large_communities)
-    steps2.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
-  if (set.next_hop && familyOf(set.next_hop) === family)
-    steps2.push(`set gw ${set.next_hop}`);
-  if (set.preferred_source && familyOf(set.preferred_source) === family)
-    steps2.push(`set pref-src ${set.preferred_source}`);
+    steps.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
+  if (set.next_hop && familyOf2(set.next_hop) === family)
+    steps.push(`set gw ${set.next_hop}`);
+  if (set.preferred_source && familyOf2(set.preferred_source) === family)
+    steps.push(`set pref-src ${set.preferred_source}`);
   if (set.blackhole)
-    steps2.push("set blackhole yes");
+    steps.push("set blackhole yes");
   if (rule.action)
-    steps2.push(rule.action);
-  return steps2;
+    steps.push(rule.action);
+  return steps;
 }
 function ruleText(rule, family) {
   const parts = [];
@@ -2230,24 +2226,24 @@ function ruleText(rule, family) {
   if (rule.match?.rpki)
     parts.push(`rpki-verify ${RPKI_GROUP}`);
   const tests = conditions(rule);
-  const steps2 = actions(rule, family);
+  const steps = actions(rule, family);
   if (tests.length)
-    parts.push(`if (${tests.join(" && ")})${steps2.length ? ` { ${steps2.join("; ")} }` : ""}`);
+    parts.push(`if (${tests.join(" && ")})${steps.length ? ` { ${steps.join("; ")} }` : ""}`);
   else
-    parts.push(...steps2);
+    parts.push(...steps);
   return parts.join("; ");
 }
 function policies(out, ctx) {
   const bgp = ctx.device.routing.bgp;
-  const policies2 = ctx.device.policies ?? {};
+  const policies = ctx.device.policies ?? {};
   const wanted = new Map;
   const want = (policy, family) => {
-    const families2 = wanted.get(policy) ?? new Set;
-    if (families2.has(family))
+    const families = wanted.get(policy) ?? new Set;
+    if (families.has(family))
       return;
-    families2.add(family);
-    wanted.set(policy, families2);
-    for (const rule of policies2[policy] ?? [])
+    families.add(family);
+    wanted.set(policy, families);
+    for (const rule of policies[policy] ?? [])
       if (rule.call && appliesTo(ctx, rule, family))
         want(rule.call, family);
   };
@@ -2263,13 +2259,13 @@ function policies(out, ctx) {
       }
     }
   }
-  const called = new Set(Object.values(policies2).flatMap((rules) => rules.flatMap((rule) => rule.call ? [rule.call] : [])));
+  const called = new Set(Object.values(policies).flatMap((rules) => rules.flatMap((rule) => rule.call ? [rule.call] : [])));
   for (const policy of [...wanted.keys()].sort()) {
     for (const family of ["ipv4", "ipv6"]) {
       if (!wanted.get(policy).has(family))
         continue;
       const chain = chainName(policy, family);
-      const rules = (policies2[policy] ?? []).filter((rule) => appliesTo(ctx, rule, family));
+      const rules = (policies[policy] ?? []).filter((rule) => appliesTo(ctx, rule, family));
       for (const rule of rules) {
         const text = ruleText(rule, family);
         if (text)
@@ -2294,9 +2290,9 @@ function bgpConnections(out, ctx) {
   for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
     const settings = settingsOf(ctx, neighbor);
     const [family] = familiesOf(ctx, neighbor);
-    const addressFamily = familyOf(neighbor.address);
+    const addressFamily = familyOf2(neighbor.address);
     const internal = settings.remote_as === bgp.asn;
-    const originates = bgp.networks?.some((prefix) => familyOf(host(prefix)) === family);
+    const originates = bgp.networks?.some((prefix) => familyOf2(host2(prefix)) === family);
     const role = settings.role ? ROLES[settings.role] : internal ? "ibgp" : "ebgp";
     out.add("/routing bgp connection", command("add", {
       afi: addressFamily === family ? undefined : family === "ipv6" ? "ipv6" : "ip",
@@ -2322,19 +2318,19 @@ function bgpConnections(out, ctx) {
   }
 }
 function ospf(out, ctx) {
-  const ospf2 = ctx.device.routing?.ospf;
-  if (!ospf2)
+  const ospf = ctx.device.routing?.ospf;
+  if (!ospf)
     return;
-  for (const family of ospf2.families ?? ["ipv4"]) {
+  for (const family of ospf.families ?? ["ipv4"]) {
     const version = family === "ipv4" ? 2 : 3;
     const instance = `ospf-v${version}`;
     out.add("/routing ospf instance", command("add", {
       name: instance,
-      redistribute: ospf2.redistribute?.join(","),
+      redistribute: ospf.redistribute?.join(","),
       "router-id": ctx.device.routing?.router_id,
       version
     }));
-    for (const [areaId, area] of Object.entries(ospf2.areas)) {
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
       const areaName = `${instance}-${areaId}`;
       out.add("/routing ospf area", command("add", { "area-id": areaId, instance, name: areaName }));
       for (const [iface, settings] of Object.entries(area.interfaces)) {
@@ -2411,19 +2407,19 @@ function layerTwo(out, ctx) {
 }
 function snmp(out, ctx) {
   const management = ctx.device.management ?? {};
-  const snmp2 = management.snmp;
-  if (!snmp2) {
+  const snmp = management.snmp;
+  if (!snmp) {
     out.add("/snmp", command("set", { enabled: "no" }));
     out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", name: "public" }));
     return;
   }
-  const allow = (snmp2.allow ?? management.allow ?? []).join(",");
-  out.add("/snmp", command("set", { contact: snmp2.contact ?? "", enabled: "yes", location: snmp2.location ?? "" }));
-  if (snmp2.community)
-    out.add("/snmp community", command("set [ find default=yes ]", { addresses: allow, name: marker(snmp2.community) }));
+  const allow = (snmp.allow ?? management.allow ?? []).join(",");
+  out.add("/snmp", command("set", { contact: snmp.contact ?? "", enabled: "yes", location: snmp.location ?? "" }));
+  if (snmp.community)
+    out.add("/snmp community", command("set [ find default=yes ]", { addresses: allow, name: marker(snmp.community) }));
   else
     out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", disabled: "yes", name: "public" }));
-  for (const [name, user] of Object.entries(snmp2.users ?? {})) {
+  for (const [name, user] of Object.entries(snmp.users ?? {})) {
     out.add("/snmp community", command("add", {
       addresses: allow,
       "authentication-password": marker(user.auth_password),
@@ -2490,15 +2486,15 @@ function renderSystem(out, ctx) {
   flowExport(out, ctx);
 }
 function logging(out, ctx) {
-  const logging2 = ctx.device.system?.logging;
-  const local = logging2?.local;
+  const logging = ctx.device.system?.logging;
+  const local = logging?.local;
   out.add("/system logging action", command("set 1", {
     "disk-file-count": local?.files ?? 2,
     "disk-lines-per-file": local?.lines_per_file ?? 1000
   }));
   for (const topic of local ? topicsFrom(local.level) : [])
     out.add("/system logging", command("add", { action: "disk", topics: topic }));
-  (logging2?.remote ?? []).forEach((collector, index) => {
+  (logging?.remote ?? []).forEach((collector, index) => {
     const action = `remote${index + 1}`;
     out.add("/system logging action", command("add", {
       name: action,
@@ -2576,17 +2572,17 @@ async function read2(device) {
   try {
     await checkVersion(client, device);
     const config = await exec(client, "/export", 300000);
-    const users2 = await exec(client, "/user export");
-    const certificates2 = (await exec(client, LIST_CERTIFICATES)).trim();
-    const listed = certificates2.split(`
-`).every((line2) => line2.trim().startsWith("add fingerprint="));
-    if (certificates2 && !listed) {
-      throw new Error(`${device.name}: certificates could not be listed: ${certificates2.slice(0, 120)}`);
+    const users = await exec(client, "/user export");
+    const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
+    const listed = certificates.split(`
+`).every((line) => line.trim().startsWith("add fingerprint="));
+    if (certificates && !listed) {
+      throw new Error(`${device.name}: certificates could not be listed: ${certificates.slice(0, 120)}`);
     }
-    const userMenu = users2.slice(users2.indexOf(`
+    const userMenu = users.slice(users.indexOf(`
 /`)).trim();
-    const certificateMenu = certificates2 ? `/certificate
-${certificates2}` : "";
+    const certificateMenu = certificates ? `/certificate
+${certificates}` : "";
     const text = [config.trim(), userMenu, certificateMenu].filter(Boolean).join(`
 `);
     return withoutTimestamp(text) + `
@@ -2622,8 +2618,8 @@ function unsupported2(device) {
   const bgp = device.routing?.bgp;
   for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-    const families2 = neighbor.families ?? group?.families ?? [familyOf(neighbor.address)];
-    if (families2.length > 1)
+    const families = neighbor.families ?? group?.families ?? [familyOf2(neighbor.address)];
+    if (families.length > 1)
       found.push(`routing.bgp.neighbors.${name}.families, one family per session`);
   }
   const management = device.management;
@@ -2649,8 +2645,8 @@ function unsupported2(device) {
 }
 var ROLLBACK_SCHEDULER = "apply-rollback";
 var escapeForString = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
-async function refusal(client, command2) {
-  const compiled = (await exec(client, `:put [:parse "${escapeForString(command2)}"]`)).trim();
+async function refusal(client, command) {
+  const compiled = (await exec(client, `:put [:parse "${escapeForString(command)}"]`)).trim();
   const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
   return refused ? compiled.slice(0, 200) : undefined;
 }
@@ -2661,25 +2657,25 @@ async function installCertificate(client, device, name) {
   await upload(client, `${name}.crt`, certificate.certificate);
   await exec(client, `/certificate import file-name=${name}.crt name=${name} passphrase=""`);
   if (certificate.private_key) {
-    const value2 = resolve(certificate.private_key);
-    const privateKey = value2.includes("-----BEGIN") ? `${value2}
-` : Buffer.from(value2, "base64").toString("utf8");
+    const value = resolve(certificate.private_key);
+    const privateKey = value.includes("-----BEGIN") ? `${value}
+` : Buffer.from(value, "base64").toString("utf8");
     await upload(client, `${name}.key`, privateKey);
     await exec(client, `/certificate import file-name=${name}.key name=${name} passphrase=""`);
   }
   await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
-async function apply2(device, _network, changes2, options) {
+async function apply2(device, _network, changes, options) {
   const client = await login(device);
   await checkVersion(client, device);
-  const commands = changes2.steps.flatMap((step) => step.send.map((command2) => ({ title: step.title, command: command2 })));
-  for (const { title, command: command2 } of commands) {
-    if (command2.startsWith(INSTALL_CERTIFICATE))
+  const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
+  for (const { title, command } of commands) {
+    if (command.startsWith(INSTALL_CERTIFICATE))
       continue;
-    const reason = await refusal(client, substitute(command2));
+    const reason = await refusal(client, substitute(command));
     if (reason) {
       client.end();
-      throw new Error(`${title}: the device will not parse ${command2.slice(0, 200)}
+      throw new Error(`${title}: the device will not parse ${command.slice(0, 200)}
     ${reason}`);
     }
   }
@@ -2696,15 +2692,15 @@ async function apply2(device, _network, changes2, options) {
     await exec(client, `/system backup save name=${backup} dont-encrypt=yes`, 120000);
     await exec(client, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
     await exec(client, armRollback);
-    for (const { title, command: command2 } of commands) {
-      if (command2.startsWith(INSTALL_CERTIFICATE)) {
-        const certificateName = command2.slice(INSTALL_CERTIFICATE.length).trim();
+    for (const { title, command } of commands) {
+      if (command.startsWith(INSTALL_CERTIFICATE)) {
+        const certificateName = command.slice(INSTALL_CERTIFICATE.length).trim();
         await installCertificate(client, device, certificateName);
         continue;
       }
-      const answer = (await exec(client, substitute(command2), 120000)).trim();
+      const answer = (await exec(client, substitute(command), 120000)).trim();
       if (answer)
-        throw new Error(`${title}: ${command2.slice(0, 160)}
+        throw new Error(`${title}: ${command.slice(0, 160)}
     device said: ${answer.slice(0, 300)}`);
     }
   } catch (error) {
@@ -2776,20 +2772,20 @@ var DEVICE_FACTS2 = [
   "Info:"
 ];
 var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance)\b/;
-function undo2(line2) {
-  if (line2.startsWith("undo "))
-    return line2.slice("undo ".length);
-  if (/^rule \d+/.test(line2))
-    return `undo ${line2.split(" ").slice(0, 2).join(" ")}`;
-  const keyword = UNDO_BY_KEYWORD2.exec(line2);
+function undo2(line) {
+  if (line.startsWith("undo "))
+    return line.slice("undo ".length);
+  if (/^rule \d+/.test(line))
+    return `undo ${line.split(" ").slice(0, 2).join(" ")}`;
+  const keyword = UNDO_BY_KEYWORD2.exec(line);
   if (keyword)
     return `undo ${keyword[1]}`;
-  if (line2.startsWith("storm control "))
-    return `undo ${line2.replace(/ (min-rate|max-rate).*$/, "")}`;
-  return `undo ${line2}`;
+  if (line.startsWith("storm control "))
+    return `undo ${line.replace(/ (min-rate|max-rate).*$/, "")}`;
+  return `undo ${line}`;
 }
-function canon(line2) {
-  return line2.replace(/(irreversible-cipher|cipher) \S+/g, "cipher <secret>").replace(/<secret:\w+>/g, "<secret>");
+function canon(line) {
+  return line.replace(/(irreversible-cipher|cipher) \S+/g, "cipher <secret>").replace(/<secret:\w+>/g, "<secret>");
 }
 function order(path) {
   const header = path[0] ?? "";
@@ -2811,7 +2807,7 @@ var dialect2 = {
   block: /^(interface |vlan \d+$|acl number |aaa$|user-interface |ospf |ip vpn-instance |bfd$)/,
   indented: true,
   terminator: "#",
-  ignore: (line2) => DEVICE_FACTS2.some((fact) => line2.startsWith(fact)),
+  ignore: (line) => DEVICE_FACTS2.some((fact) => line.startsWith(fact)),
   undo: undo2,
   leave: "quit",
   first: /^authentication-mode /,
@@ -2825,13 +2821,13 @@ var SNMP_GROUP2 = "circuit";
 var USER_LEVEL = { admin: 3, operator: 2, "read-only": 1 };
 var SNMP_AUTH3 = { sha1: "sha", sha256: "sha2-256" };
 var SNMP_PRIVACY2 = { aes128: "aes128", des: "des56" };
-function batchIds(line2) {
-  const words2 = line2.replace(/^vlan batch /, "").split(" ");
+function batchIds(line) {
+  const words = line.replace(/^vlan batch /, "").split(" ");
   const ids = [];
-  for (let index = 0;index < words2.length; index++) {
-    const first = Number(words2[index]);
-    if (words2[index + 1] === "to") {
-      const last = Number(words2[index + 2]);
+  for (let index = 0;index < words.length; index++) {
+    const first = Number(words[index]);
+    if (words[index + 1] === "to") {
+      const last = Number(words[index + 2]);
       for (let id = first;id <= last; id++)
         ids.push(id);
       index += 2;
@@ -2968,7 +2964,7 @@ function managementAcl(config, device) {
   const allow = device.management?.allow ?? [];
   if (!allow.length)
     return;
-  const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host(cidr)} ${wildcard(split(cidr).len)}`);
+  const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host2(cidr)} ${wildcard(split(cidr).len)}`);
   config.block(`acl number ${MANAGEMENT_ACL2}`, ["description Management access", ...rules, `rule ${(allow.length + 1) * 5} deny`]);
 }
 function users2(config, device) {
@@ -3047,8 +3043,8 @@ function vlanInterface(device, name, iface) {
     lines.push(`ip binding vpn-instance ${iface.vrf}`);
   for (const entry of iface.addresses ?? []) {
     const address = typeof entry === "string" ? entry : entry.address;
-    if (familyOf(address) === "ipv4")
-      lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+    if (familyOf2(address) === "ipv4")
+      lines.push(`ip address ${host2(address)} ${netmask(split(address).len)}`);
     else
       lines.push(`ipv6 address ${address}`);
   }
@@ -3103,7 +3099,7 @@ function staticRoutes2(config, device, nameOf) {
     const vrf = route.vrf ? ` vpn-instance ${route.vrf}` : "";
     const preference = route.distance ? ` preference ${route.distance}` : "";
     const description = route.description ? ` description ${route.description}` : "";
-    if (familyOf(addr) === "ipv4")
+    if (familyOf2(addr) === "ipv4")
       config.line(`ip route-static${vrf} ${addr} ${netmask(len)} ${nextHop}${preference}${description}`);
     else
       config.line(`ipv6 route-static${vrf} ${addr} ${len} ${nextHop}${preference}`);
@@ -3111,21 +3107,21 @@ function staticRoutes2(config, device, nameOf) {
   config.separator();
 }
 function ospf2(config, device, nameOf) {
-  const ospf3 = device.routing?.ospf;
-  if (!ospf3)
+  const ospf = device.routing?.ospf;
+  if (!ospf)
     return;
   const routerId = device.routing?.router_id;
   const lines = [];
-  for (const source of ospf3.redistribute ?? [])
+  for (const source of ospf.redistribute ?? [])
     lines.push(`import-route ${source === "connected" ? "direct" : "static"}`);
   const areaLines = [];
-  for (const [areaId, area] of Object.entries(ospf3.areas)) {
+  for (const [areaId, area] of Object.entries(ospf.areas)) {
     areaLines.push(`area ${areaId}`);
     for (const [iface, settings] of Object.entries(area.interfaces)) {
       if (settings?.passive)
         lines.push(`silent-interface ${nameOf(iface)}`);
       for (const prefix of ipv4Networks(device, iface))
-        areaLines.push(` network ${host(prefix)} ${wildcard(split(prefix).len)}`);
+        areaLines.push(` network ${host2(prefix)} ${wildcard(split(prefix).len)}`);
     }
   }
   config.block(`ospf ${OSPF_PROCESS2}${routerId ? ` router-id ${routerId}` : ""}`, [...lines, ...areaLines]);
@@ -3146,23 +3142,23 @@ function flowExport2(config, device) {
   config.separator();
 }
 function snmp2(config, device) {
-  const snmp3 = device.management?.snmp;
-  if (!snmp3)
+  const snmp = device.management?.snmp;
+  if (!snmp)
     return;
-  const versions = [snmp3.community ? "v2c" : "", snmp3.users ? "v3" : ""].filter(Boolean).join(" ");
+  const versions = [snmp.community ? "v2c" : "", snmp.users ? "v3" : ""].filter(Boolean).join(" ");
   const guarded = (device.management?.allow?.length ?? 0) > 0;
   config.line("snmp-agent");
   config.line(`snmp-agent sys-info version ${versions}`);
-  if (snmp3.contact)
-    config.line(`snmp-agent sys-info contact ${snmp3.contact}`);
-  if (snmp3.location)
-    config.line(`snmp-agent sys-info location ${snmp3.location}`);
-  if (snmp3.community)
-    config.line(`snmp-agent community read cipher ${marker(snmp3.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
-  if (snmp3.users) {
+  if (snmp.contact)
+    config.line(`snmp-agent sys-info contact ${snmp.contact}`);
+  if (snmp.location)
+    config.line(`snmp-agent sys-info location ${snmp.location}`);
+  if (snmp.community)
+    config.line(`snmp-agent community read cipher ${marker(snmp.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
+  if (snmp.users) {
     config.line("snmp-agent mib-view included all iso");
     config.line(`snmp-agent group v3 ${SNMP_GROUP2} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
-    for (const [name, user] of Object.entries(snmp3.users)) {
+    for (const [name, user] of Object.entries(snmp.users)) {
       config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP2}`);
       config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH3[user.auth]} cipher ${marker(user.auth_password)}`);
       config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY2[user.privacy]} cipher ${marker(user.privacy_password)}`);
@@ -3171,8 +3167,8 @@ function snmp2(config, device) {
   config.separator();
 }
 function ssh(config, device) {
-  const ssh2 = device.management?.ssh;
-  if (!ssh2)
+  const ssh = device.management?.ssh;
+  if (!ssh)
     return;
   const guarded = (device.management?.allow?.length ?? 0) > 0;
   config.line("stelnet server enable");
@@ -3185,7 +3181,7 @@ function ssh(config, device) {
     config.line(`ssh server acl ${MANAGEMENT_ACL2}`);
   config.line("ssh authorization-type default aaa");
   config.separator();
-  if (!ssh2.weak_crypto) {
+  if (!ssh.weak_crypto) {
     config.line("ssh server cipher aes256_ctr aes128_ctr");
     config.line("ssh server hmac sha2_256_96 sha2_256");
     config.line("ssh server key-exchange dh_group_exchange_sha256 ecdh_sha2_nistp256 ecdh_sha2_nistp384 ecdh_sha2_nistp521");
@@ -3227,10 +3223,10 @@ async function read3(device) {
     channel.end();
     const lines = dump.replace(/\r/g, "").split(`
 `);
-    const start = lines.findIndex((line2) => line2.startsWith("!Software Version"));
+    const start = lines.findIndex((line) => line.startsWith("!Software Version"));
     if (start < 0)
       throw new Error(`${device.name} returned no configuration`);
-    const body = lines.slice(start).filter((line2) => !/^<.*>$/.test(line2.trim()) && !line2.startsWith("!Last configuration"));
+    const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
     return scrub(body.join(`
 `).trim() + `
 `);
@@ -3261,7 +3257,7 @@ function unsupported3(device) {
     if (iface.mtu !== undefined)
       found.push(`interfaces.${name}.mtu`);
     for (const group of iface.vrrp ?? [])
-      if (familyOf(group.address) === "ipv6")
+      if (familyOf2(group.address) === "ipv6")
         found.push(`interfaces.${name}.vrrp for IPv6`);
   }
   for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
@@ -3294,11 +3290,11 @@ function unsupported3(device) {
     found.push("management.ssh.auth_timeout and auth_retries");
   if (device.lldp && device.lldp !== true)
     found.push("lldp.interfaces, use lldp on the ports instead");
-  const system2 = device.system ?? {};
-  if (system2.dns || system2.logging || system2.release_channel || system2.banner) {
+  const system = device.system ?? {};
+  if (system.dns || system.logging || system.release_channel || system.banner) {
     found.push("system.dns, logging, release_channel and banner");
   }
-  if (system2.transceiver_monitoring !== undefined)
+  if (system.transceiver_monitoring !== undefined)
     found.push("system.transceiver_monitoring");
   found.push(...switchUnsupported(device));
   const flow = device.flow_export;
@@ -3313,31 +3309,31 @@ function unsupported3(device) {
 }
 var REFUSED2 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
 var INTERACTIVE = /^(snmp-agent usm-user v3 \S+ (?:authentication|privacy)-mode \S+) cipher <secret:([A-Za-z0-9_./:-]+)>$/;
-async function sendLine(channel, line2) {
-  const interactive = INTERACTIVE.exec(line2.trim());
+async function sendLine(channel, line) {
+  const interactive = INTERACTIVE.exec(line.trim());
   if (interactive) {
-    const [, command2, reference] = interactive;
+    const [, command, reference] = interactive;
     const password = valueOfReference(reference);
-    let answer2 = await send(channel, command2, 15000, 900);
-    answer2 += await send(channel, password, 15000, 900);
-    answer2 += await send(channel, password, 15000, 900);
-    return answer2;
+    let answer = await send(channel, command, 15000, 900);
+    answer += await send(channel, password, 15000, 900);
+    answer += await send(channel, password, 15000, 900);
+    return answer;
   }
-  let answer = await send(channel, substitute(line2), 20000, 800);
+  let answer = await send(channel, substitute(line), 20000, 800);
   if (/\[Y\/N\]/i.test(answer))
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply3(device, _network, plan3) {
+async function apply3(device, _network, plan) {
   const client = await login2(device);
   const channel = await openShell(client);
   try {
     await send(channel, "system-view", 1e4, 1500);
-    for (const step of plan3.steps) {
-      for (const line2 of step.send) {
-        const answer = await sendLine(channel, line2);
+    for (const step of plan.steps) {
+      for (const line of step.send) {
+        const answer = await sendLine(channel, line);
         if (REFUSED2.test(answer))
-          throw new Error(`${step.title}: ${line2}
+          throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
       }
     }
@@ -3373,19 +3369,19 @@ function plan3(desired, current) {
   const groups = compare(desired, current, dialect2);
   vlanListChange(groups, "vlan batch ", batchIds, (ids) => [`vlan batch ${vlanBatch(ids)}`], (ids) => [`vlan batch ${vlanBatch(ids)}`]);
   const top = groups.find((group) => group.path.length === 0);
-  const removedBatch = top?.remove.find((line2) => line2.startsWith("vlan batch ")) ?? "";
+  const removedBatch = top?.remove.find((line) => line.startsWith("vlan batch ")) ?? "";
   const removedIds = removedBatch ? batchIds(removedBatch) : [];
   const firstRemovals = [
-    ...removedIds.map((id) => `interface Vlanif${id}`).filter((line2) => top?.remove.includes(line2)),
-    ...removedIds.map((id) => `vlan ${id}`).filter((line2) => top?.remove.includes(line2)),
+    ...removedIds.map((id) => `interface Vlanif${id}`).filter((line) => top?.remove.includes(line)),
+    ...removedIds.map((id) => `vlan ${id}`).filter((line) => top?.remove.includes(line)),
     ...removedBatch ? [removedBatch] : []
   ];
   if (top)
-    top.remove = top.remove.filter((line2) => !firstRemovals.includes(line2));
+    top.remove = top.remove.filter((line) => !firstRemovals.includes(line));
   const planned = steps(groups.filter((group) => group.add.length || group.remove.length), dialect2);
   if (firstRemovals.length) {
-    const sent = firstRemovals.filter((line2) => !/^vlan \d+$/.test(line2)).map(undo2);
-    planned.unshift({ title: "VLANs no longer used", show: firstRemovals.map((line2) => `- ${line2}`), send: sent });
+    const sent = firstRemovals.filter((line) => !/^vlan \d+$/.test(line)).map(undo2);
+    planned.unshift({ title: "VLANs no longer used", show: firstRemovals.map((line) => `- ${line}`), send: sent });
   }
   return { steps: planned, problems: [] };
 }
@@ -3420,17 +3416,17 @@ var registries = { "ripe-stat": ripeStat };
 // src/adapters/registries/librenms.ts
 var AUTH = { sha1: "SHA", sha256: "SHA-256" };
 var PRIVACY = { aes128: "AES", des: "DES" };
-function settingsOf2(network2) {
-  if (!network2.librenms)
+function settingsOf2(network) {
+  if (!network.librenms)
     throw new Error("the network has no librenms settings");
   return {
-    base: `${network2.librenms.url.replace(/\/+$/, "")}/api/v0`,
-    headers: { "X-Auth-Token": resolve(network2.librenms.api_token), "Content-Type": "application/json" }
+    base: `${network.librenms.url.replace(/\/+$/, "")}/api/v0`,
+    headers: { "X-Auth-Token": resolve(network.librenms.api_token), "Content-Type": "application/json" }
   };
 }
 function credentials(device) {
-  const snmp3 = device.management?.snmp;
-  const [name, user] = Object.entries(snmp3?.users ?? {})[0] ?? [];
+  const snmp = device.management?.snmp;
+  const [name, user] = Object.entries(snmp?.users ?? {})[0] ?? [];
   if (name && user) {
     return {
       snmpver: "v3",
@@ -3442,26 +3438,26 @@ function credentials(device) {
       cryptoalgo: PRIVACY[user.privacy]
     };
   }
-  if (snmp3?.community)
-    return { snmpver: "v2c", community: resolve(snmp3.community) };
+  if (snmp?.community)
+    return { snmpver: "v2c", community: resolve(snmp.community) };
   return;
 }
-async function planLibreNms(network2) {
-  const { base, headers } = settingsOf2(network2);
+async function planLibreNms(network) {
+  const { base, headers } = settingsOf2(network);
   const response = await fetch(`${base}/devices?type=all`, { headers, signal: AbortSignal.timeout(30000) });
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
   const monitored = new Set((await response.json()).devices.map((device) => device.hostname));
-  const ours = new Set(network2.devices.map((device) => device.connection.host));
-  const missing = network2.devices.filter((device) => !monitored.has(device.connection.host));
+  const ours = new Set(network.devices.map((device) => device.connection.host));
+  const missing = network.devices.filter((device) => !monitored.has(device.connection.host));
   return {
     additions: missing.filter((device) => device.management?.snmp),
     withoutSnmp: missing.filter((device) => !device.management?.snmp),
     unknown: [...monitored].filter((hostname) => !ours.has(hostname)).sort()
   };
 }
-async function sendLibreNms(network2, additions) {
-  const { base, headers } = settingsOf2(network2);
+async function sendLibreNms(network, additions) {
+  const { base, headers } = settingsOf2(network);
   for (const device of additions) {
     const body = { hostname: device.connection.host, display_template: device.name, ...credentials(device) };
     const response = await fetch(`${base}/devices`, {
@@ -3487,48 +3483,48 @@ function peersWithRouteServer(device, iface) {
   return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
     const role = neighbor.role ?? group?.role;
-    return role === "rs" && subnets.some((subnet) => contains(subnet, neighbor.address));
+    return role === "rs" && subnets.some((subnet) => contains2(subnet, neighbor.address));
   });
 }
-function wanted(network2) {
+function wanted(network) {
   const records = [];
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     for (const iface of Object.values(device.interfaces ?? {})) {
       const exchange = iface.exchange;
       if (!exchange?.peeringdb_ixlan)
         continue;
-      const published = addressesOf2(iface).map(host).filter(isGlobal);
+      const published = addressesOf2(iface).map(host2).filter(isGlobal2);
       records.push({
         name: exchange.name,
         ixlan_id: exchange.peeringdb_ixlan,
         speed: exchange.speed,
-        ipaddr4: published.find((address) => familyOf(address) === "ipv4") ?? null,
-        ipaddr6: published.find((address) => familyOf(address) === "ipv6") ?? null,
+        ipaddr4: published.find((address) => familyOf2(address) === "ipv4") ?? null,
+        ipaddr6: published.find((address) => familyOf2(address) === "ipv6") ?? null,
         is_rs_peer: peersWithRouteServer(device, iface)
       });
     }
   }
   return records;
 }
-async function planPeeringDb(network2) {
-  if (!network2.asn)
+async function planPeeringDb(network) {
+  if (!network.asn)
     throw new Error("the network declares no asn");
-  const response = await fetch(`${API}/netixlan?asn=${network2.asn}`, {
+  const response = await fetch(`${API}/netixlan?asn=${network.asn}`, {
     headers: { Accept: "application/json" },
     signal: AbortSignal.timeout(30000)
   });
   if (!response.ok)
     throw new Error(`PeeringDB answered ${response.status}`);
   const existing = (await response.json()).data;
-  const desired = wanted(network2);
+  const desired = wanted(network);
   const netId = existing[0]?.net_id;
-  const changes2 = [];
+  const changes = [];
   for (const record of desired) {
     const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
     const body = {
       net_id: netId,
       ixlan_id: record.ixlan_id,
-      asn: network2.asn,
+      asn: network.asn,
       speed: record.speed,
       ipaddr4: record.ipaddr4,
       ipaddr6: record.ipaddr6,
@@ -3536,27 +3532,27 @@ async function planPeeringDb(network2) {
       operational: current?.operational ?? true
     };
     if (!current) {
-      changes2.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
+      changes.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
       continue;
     }
     const differs = current.ipaddr4 !== record.ipaddr4 || current.ipaddr6 !== record.ipaddr6 || current.speed !== record.speed || current.is_rs_peer !== record.is_rs_peer;
     if (differs) {
       const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
       const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
-      changes2.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
+      changes.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
     }
   }
   const unknown = existing.filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id)).map((record) => record.name);
-  if (changes2.some((change) => !change.id) && !netId) {
+  if (changes.some((change) => !change.id) && !netId) {
     throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
   }
-  return { changes: changes2, unknown };
+  return { changes, unknown };
 }
-async function sendPeeringDb(network2, changes2) {
-  if (!network2.peeringdb)
+async function sendPeeringDb(network, changes) {
+  if (!network.peeringdb)
     throw new Error("the network declares no peeringdb api_key");
-  const apiKey = resolve(network2.peeringdb.api_key);
-  for (const change of changes2) {
+  const apiKey = resolve(network.peeringdb.api_key);
+  for (const change of changes) {
     const response = await fetch(`${API}/netixlan${change.id ? `/${change.id}` : ""}`, {
       method: change.id ? "PUT" : "POST",
       headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
@@ -3574,13 +3570,13 @@ async function sendPeeringDb(network2, changes2) {
 // src/adapters/registries/prometheus.ts
 var AUTH2 = { sha1: "SHA", sha256: "SHA256" };
 var PRIVACY2 = { aes128: "AES", des: "DES" };
-function prometheusTargets(network2) {
+function prometheusTargets(network) {
   return {
-    targets: network2.devices.filter((device) => device.management?.snmp).map((device) => ({
+    targets: network.devices.filter((device) => device.management?.snmp).map((device) => ({
       targets: [device.connection.host],
       labels: { device: device.name, platform: device.platform, model: device.model, __param_auth: device.name }
     })),
-    withoutSnmp: network2.devices.filter((device) => !device.management?.snmp)
+    withoutSnmp: network.devices.filter((device) => !device.management?.snmp)
   };
 }
 function fromEnvironment(secret, notes, where) {
@@ -3589,17 +3585,17 @@ function fromEnvironment(secret, notes, where) {
   notes.push(`${where} is read from a file; write its value in place of FILL_IN`);
   return "FILL_IN";
 }
-function snmpExporterAuths(network2) {
+function snmpExporterAuths(network) {
   const notes = [];
   const lines = [
     "# Written by `circuit prometheus --auths`. Load it beside snmp.yml, with --config.expand-environment-variables.",
     "auths:"
   ];
-  for (const device of network2.devices) {
-    const snmp3 = device.management?.snmp;
-    if (!snmp3)
+  for (const device of network.devices) {
+    const snmp = device.management?.snmp;
+    if (!snmp)
       continue;
-    const [name, user] = Object.entries(snmp3.users ?? {})[0] ?? [];
+    const [name, user] = Object.entries(snmp.users ?? {})[0] ?? [];
     lines.push(`  ${device.name}:`);
     if (name && user) {
       lines.push("    version: 3", `    username: ${name}`, "    security_level: authPriv", `    password: ${fromEnvironment(user.auth_password, notes, `${device.name}'s SNMP password`)}`, `    auth_protocol: ${AUTH2[user.auth]}`, `    priv_protocol: ${PRIVACY2[user.privacy]}`, `    priv_password: ${fromEnvironment(user.privacy_password, notes, `${device.name}'s SNMP privacy password`)}`);
@@ -3618,18 +3614,18 @@ import { X509Certificate as X509Certificate2 } from "node:crypto";
 
 // src/core/across.ts
 function checkAcross(devices) {
-  const holders2 = holdersOf(devices);
+  const holders = holdersOf(devices);
   const owners = new Map;
-  for (const holder of holders2) {
-    const key = keyOf(host(holder.address));
+  for (const holder of holders) {
+    const key = keyOf(host2(holder.address));
     if (!owners.has(key))
       owners.set(key, holder);
   }
   return [
     ...checkLinks(devices),
-    ...checkAddresses(holders2),
+    ...checkAddresses(holders),
     ...checkSessions(devices, owners),
-    ...checkVrrp(holders2),
+    ...checkVrrp(holders),
     ...checkTunnels(devices, owners)
   ];
 }
@@ -3651,7 +3647,7 @@ function carrierOf(device, portName, port) {
     return { name: port.lag, settings: lag };
   return { name: portName, settings: port };
 }
-var plainAddresses = (settings, family) => (settings.addresses ?? []).filter((entry) => typeof entry === "string" && isCidr(entry) && familyOf(entry) === family);
+var plainAddresses = (settings, family) => (settings.addresses ?? []).filter((entry) => typeof entry === "string" && isCidr2(entry) && familyOf2(entry) === family);
 function addressDisagreement(here, there, far, farName) {
   for (const family of ["ipv4", "ipv6"]) {
     const ours = plainAddresses(here, family);
@@ -3663,7 +3659,7 @@ function addressDisagreement(here, there, far, farName) {
       return `has ${ours.join(", ")}, and ${far.name} ${farName} has ${theirs.join(", ")}: not one prefix of one length`;
     }
   }
-  const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host(typeof entry === "string" ? entry : entry.address))));
+  const farHosts = new Set((there.addresses ?? []).map((entry) => keyOf(host2(typeof entry === "string" ? entry : entry.address))));
   for (const entry of here.addresses ?? []) {
     if (typeof entry === "string" || !keyOf(entry.peer) || farHosts.has(keyOf(entry.peer)))
       continue;
@@ -3725,12 +3721,12 @@ function checkLinks(devices) {
   }
   return findings;
 }
-function checkAddresses(holders2) {
+function checkAddresses(holders) {
   const findings = [];
   const first = new Map;
   const isLoopback = (holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
-  for (const holder of holders2) {
-    const key = keyOf(host(holder.address));
+  for (const holder of holders) {
+    const key = keyOf(host2(holder.address));
     const earlier = first.get(key);
     if (!earlier) {
       first.set(key, holder);
@@ -3742,7 +3738,7 @@ function checkAddresses(holders2) {
     findings.push({
       level: anycast ? "warning" : "error",
       device: holder.device.name,
-      message: `${host(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`
+      message: `${host2(holder.address)} on ${holder.name} is also on ${earlier.device.name} ${earlier.name}${anycast ? ", which is right only for anycast" : ""}`
     });
   }
   return findings;
@@ -3775,7 +3771,7 @@ function checkSessions(devices, owners) {
       if (session.remoteAs !== undefined && session.remoteAs !== farBgp.asn) {
         report(`expects AS${session.remoteAs}, and ${far.name} is AS${farBgp.asn}`);
       }
-      const back = sessionsOf(far).find((other) => owners.get(keyOf(other.address) ?? "")?.device === device && familyOf(other.address) === familyOf(session.address));
+      const back = sessionsOf(far).find((other) => owners.get(keyOf(other.address) ?? "")?.device === device && familyOf2(other.address) === familyOf2(session.address));
       if (!back) {
         report(`${far.name} has no session back to ${device.name}`);
         continue;
@@ -3787,15 +3783,15 @@ function checkSessions(devices, owners) {
   }
   return findings;
 }
-function checkVrrp(holders2) {
+function checkVrrp(holders) {
   const findings = [];
   const bySegment = new Map;
-  for (const holder of holders2) {
+  for (const holder of holders) {
     const segment = network(holder.address);
     for (const group of holder.vrrp) {
-      if (!keyOf(group.address) || familyOf(group.address) !== familyOf(holder.address))
+      if (!keyOf(group.address) || familyOf2(group.address) !== familyOf2(holder.address))
         continue;
-      if (!contains(segment, group.address))
+      if (!contains2(segment, group.address))
         continue;
       bySegment.set(segment, [...bySegment.get(segment) ?? [], { holder, id: group.id, address: group.address }]);
     }
@@ -3852,15 +3848,15 @@ function checkTunnels(devices, owners) {
 }
 
 // src/core/validate.ts
-function validate(network2) {
+function validate(network) {
   const findings = [];
   const seen = new Set;
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     if (seen.has(device.name))
       findings.push({ level: "error", device: device.name, message: "declared twice" });
     seen.add(device.name);
   }
-  for (const device of network2.devices) {
+  for (const device of network.devices) {
     const report = (message) => findings.push({ level: "error", device: device.name, message });
     checkDevice(device, report);
     const adapter = adapters[device.platform];
@@ -3870,9 +3866,9 @@ function validate(network2) {
       for (const field of adapter.unsupported(device))
         report(`${device.platform} cannot express ${field}`);
   }
-  findings.push(...checkAcross(network2.devices));
-  for (const check of network2.checks ?? [])
-    findings.push(...check(network2.devices));
+  findings.push(...checkAcross(network.devices));
+  for (const check of network.checks ?? [])
+    findings.push(...check(network.devices));
   return findings;
 }
 
@@ -3904,13 +3900,13 @@ class Names {
 }
 function checkDevice(device, report) {
   const names = new Names(device, report);
-  const cidr = (where, value2) => {
-    if (!isCidr(value2))
-      report(`${where}: '${value2}' is not an address with a length`);
+  const cidr = (where, value) => {
+    if (!isCidr2(value))
+      report(`${where}: '${value}' is not an address with a length`);
   };
-  const ip = (where, value2) => {
-    if (!isAddress(value2))
-      report(`${where}: '${value2}' is not an address`);
+  const ip = (where, value) => {
+    if (!isAddress2(value))
+      report(`${where}: '${value}' is not an address`);
   };
   if (!device.users?.[device.connection.user])
     report(`connection user '${device.connection.user}' is not one of its users`);
@@ -3936,11 +3932,11 @@ function checkVlans(device, report) {
 }
 function checkAddresses2(device, report, cidr, ip) {
   const holderOf = new Map;
-  const holders2 = [
+  const holders = [
     ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
     ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({ where: `interface ${name}`, settings }))
   ];
-  for (const { where, settings } of holders2) {
+  for (const { where, settings } of holders) {
     for (const entry of settings?.addresses ?? []) {
       const address = typeof entry === "string" ? entry : entry.address;
       cidr(where, address);
@@ -4003,7 +3999,7 @@ function checkInterfaces(device, names, report, ip) {
     if (iface.type === "wireguard") {
       for (const peer of iface.peers ?? []) {
         for (const address of peer.allowed_addresses) {
-          if (!isCidr(address))
+          if (!isCidr2(address))
             report(`interface ${name} peer ${peer.name}: '${address}' is not an address with a length`);
         }
       }
@@ -4012,7 +4008,7 @@ function checkInterfaces(device, names, report, ip) {
 }
 function checkRouting(device, names, report, cidr, ip) {
   const routing = device.routing;
-  const policies2 = device.policies ?? {};
+  const policies = device.policies ?? {};
   for (const route of routing?.static ?? []) {
     cidr("static route", route.prefix);
     if (!route.via && !route.interface && !route.blackhole)
@@ -4023,7 +4019,7 @@ function checkRouting(device, names, report, cidr, ip) {
     names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
   }
   const bgp = routing?.bgp;
-  const isPolicy = (policy) => policy !== undefined && (policy in policies2);
+  const isPolicy = (policy) => policy !== undefined && (policy in policies);
   for (const prefix of bgp?.networks ?? [])
     cidr("BGP network", prefix);
   for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
@@ -4041,7 +4037,7 @@ function checkRouting(device, names, report, cidr, ip) {
       names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
     }
     const local = neighbor.local_address ?? group?.local_address;
-    if (local && familyOf(local) !== familyOf(neighbor.address))
+    if (local && familyOf2(local) !== familyOf2(neighbor.address))
       report(`neighbor ${name} local_address and address differ in family`);
   }
   for (const [areaId, area] of Object.entries(routing?.ospf?.areas ?? {})) {
@@ -4052,11 +4048,11 @@ function checkRouting(device, names, report, cidr, ip) {
   }
 }
 function checkPolicies(device, names, report, cidr) {
-  const policies2 = device.policies ?? {};
+  const policies = device.policies ?? {};
   const sets = device.prefix_sets ?? {};
-  for (const [name, rules] of Object.entries(policies2)) {
+  for (const [name, rules] of Object.entries(policies)) {
     for (const rule of rules) {
-      names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies2);
+      names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies);
       const set = rule.match?.prefix_set;
       names.expect(`policy ${name} prefix set`, set, set !== undefined && set in sets);
       if (rule.match?.prefix)
@@ -4066,11 +4062,11 @@ function checkPolicies(device, names, report, cidr) {
   const visit = (policy, path) => {
     if (path.includes(policy))
       return report(`policy ${[...path, policy].join(" -> ")} calls itself`);
-    for (const rule of policies2[policy] ?? [])
+    for (const rule of policies[policy] ?? [])
       if (rule.call)
         visit(rule.call, [...path, policy]);
   };
-  for (const policy of Object.keys(policies2))
+  for (const policy of Object.keys(policies))
     visit(policy, []);
 }
 function checkFirewall(device, names, cidr) {
@@ -4078,7 +4074,7 @@ function checkFirewall(device, names, cidr) {
   const sets = firewall?.address_sets ?? {};
   for (const [name, members] of Object.entries(sets)) {
     for (const member of members) {
-      if (!isAddress(member))
+      if (!isAddress2(member))
         cidr(`address set ${name}`, member);
     }
   }
@@ -4104,12 +4100,12 @@ function checkServices(device, names, report, cidr) {
   for (const [name, server] of Object.entries(device.dhcp ?? {})) {
     names.expectInterface(`DHCP ${name} interface`, server.interface);
     cidr(`DHCP ${name}`, server.network);
-    if (!isCidr(server.network))
+    if (!isCidr2(server.network))
       continue;
     const reserved = (server.reservations ?? []).map((reservation) => reservation.address);
-    const addresses2 = [server.gateway, ...server.pool, ...reserved];
-    for (const address of addresses2) {
-      if (!contains(server.network, address))
+    const addresses = [server.gateway, ...server.pool, ...reserved];
+    for (const address of addresses) {
+      if (!contains2(server.network, address))
         report(`DHCP ${name}: ${address} is outside ${server.network}`);
     }
   }
@@ -4131,8 +4127,8 @@ function checkServices(device, names, report, cidr) {
     report("SNMP is on with neither a community nor a user");
 }
 function checkCertificates(device, names, report) {
-  const certificates2 = device.certificates ?? {};
-  for (const [name, certificate] of Object.entries(certificates2)) {
+  const certificates = device.certificates ?? {};
+  for (const [name, certificate] of Object.entries(certificates)) {
     try {
       new X509Certificate2(certificate.certificate);
     } catch {
@@ -4141,8 +4137,8 @@ function checkCertificates(device, names, report) {
   }
   for (const service of ["https", "api_tls"]) {
     const name = device.management?.[service]?.certificate;
-    names.expect(`${service} certificate`, name, name !== undefined && name in certificates2);
-    if (name && certificates2[name] && !certificates2[name].private_key) {
+    names.expect(`${service} certificate`, name, name !== undefined && name in certificates);
+    if (name && certificates[name] && !certificates[name].private_key) {
       report(`${service} certificate ${name} has no private key to serve with`);
     }
   }
@@ -4162,7 +4158,7 @@ function markOf(graph, node) {
 }
 function mermaid(graph) {
   const ids = new Map(graph.nodes.map((node, index) => [node.id, `n${index}`]));
-  const text = (...lines2) => `"${lines2.map((line2) => line2.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
+  const text = (...lines) => `"${lines.map((line) => line.replace(/"/g, "#quot;").replace(/</g, "#lt;").replace(/>/g, "#gt;")).join("<br/>")}"`;
   const shapes = {
     device: (label) => `[${label}]`,
     segment: (label) => `([${label}])`,
@@ -4188,7 +4184,7 @@ function mermaid(graph) {
 `;
 }
 function dot(graph) {
-  const text = (value2) => `"${value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+  const text = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
   const colors = { error: "#d1242f", warning: "#bf8700" };
   const shapes = {
     device: "shape=box, style=rounded",
@@ -4226,42 +4222,41 @@ import { basename, dirname, extname, join as join3, resolve as resolve2 } from "
 import { readdirSync, readFileSync as readFileSync2 } from "node:fs";
 import { join as join2, relative } from "node:path";
 var SKIPPED = new Set(["node_modules", ".git", ".circuit", "dist"]);
-function projectSources(root2, directory = root2) {
-  const entries2 = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
-  return entries2.flatMap((entry) => {
+function projectSources(root, directory = root) {
+  const entries = readdirSync(directory, { withFileTypes: true }).sort((a, b) => a.name < b.name ? -1 : a.name > b.name ? 1 : 0);
+  return entries.flatMap((entry) => {
     if (entry.isDirectory())
-      return SKIPPED.has(entry.name) ? [] : projectSources(root2, join2(directory, entry.name));
-    return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root2, join2(directory, entry.name))] : [];
+      return SKIPPED.has(entry.name) ? [] : projectSources(root, join2(directory, entry.name));
+    return /\.(ts|mts|cts)$/.test(entry.name) ? [relative(root, join2(directory, entry.name))] : [];
   });
 }
-var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+var FIRST_NAME = /^[\s\S]*?\bname\s*:\s*(["'`])(.*?)\1/;
 function declaresDevice(text, name) {
-  const declares = new RegExp(`\\bname\\s*:\\s*(["'\`])${escape(name)}\\1`);
-  return text.includes("defineDevice") && declares.test(text);
+  return [...text.matchAll(/\bdefineDevice\s*\(/g)].some((call) => FIRST_NAME.exec(text.slice(call.index + call[0].length))?.[2] === name);
 }
-function deviceFiles(root2, name, sources = projectSources(root2)) {
-  return sources.filter((file) => declaresDevice(readFileSync2(join2(root2, file), "utf8"), name));
+function deviceFiles(root, name, sources = projectSources(root)) {
+  return sources.filter((file) => declaresDevice(readFileSync2(join2(root, file), "utf8"), name));
 }
 
 // src/cli/rename.ts
-var escape2 = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
-function planRename(root2, from, to, options) {
-  const changes2 = [];
+var escape = (text) => text.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
+function planRename(root, from, to, options) {
+  const changes = [];
   const moves = [];
-  const exact = new RegExp(`(["'\`])${escape2(from)}\\1`, "g");
-  const anywhere = new RegExp(`(^|[^A-Za-z0-9_.-])${escape2(from)}(?![A-Za-z0-9_-])`);
-  const sources = projectSources(root2);
+  const exact = new RegExp(`(["'\`])${escape(from)}\\1`, "g");
+  const anywhere = new RegExp(`(^|[^A-Za-z0-9_.-])${escape(from)}(?![A-Za-z0-9_-])`);
+  const sources = projectSources(root);
   const declaring = new Set;
   for (const file of sources) {
-    const text = readFileSync3(join3(root2, file), "utf8");
+    const text = readFileSync3(join3(root, file), "utf8");
     const lines = text.split(`
 `);
     if (declaresDevice(text, from))
       declaring.add(file);
     for (const [index, before] of lines.entries()) {
-      const after = before.replace(exact, (_match, quote3) => `${quote3}${to}${quote3}`);
+      const after = before.replace(exact, (_match, quote) => `${quote}${to}${quote}`);
       if (after !== before)
-        changes2.push({ file, line: index + 1, before, after });
+        changes.push({ file, line: index + 1, before, after });
     }
   }
   if (!declaring.size) {
@@ -4275,58 +4270,58 @@ function planRename(root2, from, to, options) {
       throw new Error(`${[...declaring].join(" and ")} both declare name: "${from}"; rename the file by hand`);
     const [file] = [...declaring];
     const target = join3(dirname(file), `${to}${extname(file)}`);
-    if (existsSync2(join3(root2, target)))
+    if (existsSync2(join3(root, target)))
       throw new Error(`${target} already exists`);
     moves.push({ from: file, to: target });
-    changes2.push(...importChanges(root2, sources, file, target, changes2));
+    changes.push(...importChanges(root, sources, file, target, changes));
   }
-  const mentions = sources.flatMap((file) => readFileSync3(join3(root2, file), "utf8").split(`
+  const mentions = sources.flatMap((file) => readFileSync3(join3(root, file), "utf8").split(`
 `).flatMap((original, index) => {
-    const text = changes2.find((change) => change.file === file && change.line === index + 1)?.after ?? original;
+    const text = changes.find((change) => change.file === file && change.line === index + 1)?.after ?? original;
     return anywhere.test(text) ? [{ file, line: index + 1, text: text.trim() }] : [];
   }));
-  return { changes: changes2, moves, mentions };
+  return { changes, moves, mentions };
 }
-function importChanges(root2, sources, file, target, earlier) {
+function importChanges(root, sources, file, target, earlier) {
   const result = [];
   const withoutExtension = (path) => path.replace(/\.(ts|mts|cts|js|mjs|cjs)$/, "");
-  const moved = withoutExtension(resolve2(root2, file));
+  const moved = withoutExtension(resolve2(root, file));
   for (const source of sources) {
-    const lines = readFileSync3(join3(root2, source), "utf8").split(`
+    const lines = readFileSync3(join3(root, source), "utf8").split(`
 `);
     for (const [index, original] of lines.entries()) {
-      const line2 = index + 1;
-      const changed = earlier.find((change) => change.file === source && change.line === line2);
+      const line = index + 1;
+      const changed = earlier.find((change) => change.file === source && change.line === line);
       const before = changed?.after ?? original;
-      const after = before.replace(/(\bfrom\s+|\bimport\s*\(\s*)(["'])(\.{1,2}\/[^"']+)\2/g, (match, lead, quote3, specifier) => {
-        if (withoutExtension(resolve2(root2, dirname(source), specifier)) !== moved)
+      const after = before.replace(/(\bfrom\s+|\bimport\s*\(\s*)(["'])(\.{1,2}\/[^"']+)\2/g, (match, lead, quote, specifier) => {
+        if (withoutExtension(resolve2(root, dirname(source), specifier)) !== moved)
           return match;
         const extension = specifier.match(/\.(ts|mts|cts|js|mjs|cjs)$/)?.[0] ?? "";
         const renamed = `${dirname(specifier)}/${basename(withoutExtension(target))}${extension}`;
-        return `${lead}${quote3}${renamed}${quote3}`;
+        return `${lead}${quote}${renamed}${quote}`;
       });
       if (after === before)
         continue;
       if (changed)
         changed.after = after;
       else
-        result.push({ file: source, line: line2, before: original, after });
+        result.push({ file: source, line, before: original, after });
     }
   }
   return result;
 }
-function applyRename(root2, plan4) {
-  const files = new Set(plan4.changes.map((change) => change.file));
+function applyRename(root, plan) {
+  const files = new Set(plan.changes.map((change) => change.file));
   for (const file of files) {
-    const lines = readFileSync3(join3(root2, file), "utf8").split(`
+    const lines = readFileSync3(join3(root, file), "utf8").split(`
 `);
-    for (const change of plan4.changes.filter((each) => each.file === file))
+    for (const change of plan.changes.filter((each) => each.file === file))
       lines[change.line - 1] = change.after;
-    writeFileSync(join3(root2, file), lines.join(`
+    writeFileSync(join3(root, file), lines.join(`
 `));
   }
-  for (const move of plan4.moves)
-    renameSync(join3(root2, move.from), join3(root2, move.to));
+  for (const move of plan.moves)
+    renameSync(join3(root, move.from), join3(root, move.to));
 }
 
 // src/cli/index.ts
@@ -4370,7 +4365,7 @@ var HELP = `usage: circuit <command> [device...] [options]
 var DEFAULT_CONFIG = "circuit.config.ts";
 var [command2, ...args] = process.argv.slice(2);
 if (command2 === "new") {
-  const { create } = await import("../chunks/new-7n8qvtjd.js");
+  const { create } = await import("../chunks/new-ny89s7y7.js");
   await create(args);
   process.exit(0);
 }
@@ -4445,18 +4440,18 @@ function guard(devices) {
     fail(`
 ${errors} error(s).`);
 }
-function show(device, plan4) {
-  const commands = plan4.steps.reduce((count, step) => count + step.send.length, 0);
-  const summary = commands ? `${commands} command(s) in ${plan4.steps.length} step(s)` : "matches";
+function show(device, plan) {
+  const commands = plan.steps.reduce((count, step) => count + step.send.length, 0);
+  const summary = commands ? `${commands} command(s) in ${plan.steps.length} step(s)` : "matches";
   console.log(`${device.name}: ${summary}`);
-  for (const step of plan4.steps) {
+  for (const step of plan.steps) {
     console.log(`  ${step.title}`);
-    for (const line2 of step.show)
-      console.log(`    ${line2.slice(0, 220)}`);
+    for (const line of step.show)
+      console.log(`    ${line.slice(0, 220)}`);
   }
-  for (const problem of plan4.problems)
+  for (const problem of plan.problems)
     console.log(`  PROBLEM ${problem}`);
-  return commands + plan4.problems.length;
+  return commands + plan.problems.length;
 }
 function validateCommand() {
   guard([...network2.devices]);
@@ -4477,8 +4472,8 @@ function diffCommand() {
       continue;
     }
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
-    differences += show(device, plan4);
+    const plan = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
+    differences += show(device, plan);
   }
   process.exit(differences ? 1 : 0);
 }
@@ -4505,10 +4500,10 @@ async function applyCommand() {
   const adapter = adapterOf(device);
   const live = await adapter.read(device, network2.devices);
   writeState(device, live);
-  const plan4 = adapter.plan(adapter.render(device), live, options);
-  if (!show(device, plan4))
+  const plan = adapter.plan(adapter.render(device), live, options);
+  if (!show(device, plan))
     return;
-  if (plan4.problems.length)
+  if (plan.problems.length)
     fail(`
 Not sent: resolve the problems first.`);
   if (!confirmed) {
@@ -4516,13 +4511,13 @@ Not sent: resolve the problems first.`);
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await adapter.apply(device, network2.devices, plan4, options);
+  await adapter.apply(device, network2.devices, plan, options);
   writeState(device, await adapter.read(device, network2.devices));
   console.log("snapshot updated");
 }
 async function refreshCommand() {
   const device = one();
-  const fill2 = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
+  const fill = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
   for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
     if (!("source" in set))
       continue;
@@ -4533,7 +4528,7 @@ async function refreshCommand() {
     }
     console.log(`${name}: ${prefixes.length} prefixes from ${registry} ${query}`);
     if (confirmed)
-      await fill2(device, network2.devices, name, family, prefixes);
+      await fill(device, network2.devices, name, family, prefixes);
   }
   if (!confirmed)
     console.log(`
@@ -4581,13 +4576,13 @@ function communitiesCommand() {
   }
 }
 async function peeringdbCommand() {
-  const plan4 = await planPeeringDb(network2);
-  for (const name of plan4.unknown) {
+  const plan = await planPeeringDb(network2);
+  for (const name of plan.unknown) {
     console.log(`  PeeringDB lists ${name}, which the config does not. Remove it by hand if the network left.`);
   }
-  for (const change of plan4.changes)
+  for (const change of plan.changes)
     console.log(`  ${change.summary}`);
-  if (!plan4.changes.length) {
+  if (!plan.changes.length) {
     console.log("PeeringDB matches the config.");
     return;
   }
@@ -4596,17 +4591,17 @@ async function peeringdbCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendPeeringDb(network2, plan4.changes);
+  await sendPeeringDb(network2, plan.changes);
 }
 async function librenmsCommand() {
-  const plan4 = await planLibreNms(network2);
-  for (const hostname of plan4.unknown)
+  const plan = await planLibreNms(network2);
+  for (const hostname of plan.unknown)
     console.log(`  LibreNMS monitors ${hostname}, which the config does not. Remove it by hand if it is gone.`);
-  for (const device of plan4.withoutSnmp)
+  for (const device of plan.withoutSnmp)
     console.log(`  ${device.name} has no SNMP in its config, so LibreNMS cannot poll it. Add management.snmp first.`);
-  for (const device of plan4.additions)
+  for (const device of plan.additions)
     console.log(`  add ${device.name}, ${device.connection.host}`);
-  if (!plan4.additions.length) {
+  if (!plan.additions.length) {
     console.log("LibreNMS monitors every device it can.");
     return;
   }
@@ -4615,7 +4610,7 @@ async function librenmsCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendLibreNms(network2, plan4.additions);
+  await sendLibreNms(network2, plan.additions);
 }
 function prometheusCommand() {
   if (flags.includes("--auths")) {
@@ -4630,14 +4625,14 @@ function prometheusCommand() {
     console.error(`${device.name} has no SNMP in its config; left out`);
   console.log(JSON.stringify(targets, null, 4));
 }
-function secretsIn(value2, found = new Set) {
-  if (isSecret(value2))
-    found.add(referenceOf(value2));
-  else if (Array.isArray(value2))
-    for (const item of value2)
+function secretsIn(value, found = new Set) {
+  if (isSecret(value))
+    found.add(referenceOf(value));
+  else if (Array.isArray(value))
+    for (const item of value)
       secretsIn(item, found);
-  else if (typeof value2 === "object" && value2 !== null)
-    for (const item of Object.values(value2))
+  else if (typeof value === "object" && value !== null)
+    for (const item of Object.values(value))
       secretsIn(item, found);
   return found;
 }
@@ -4665,10 +4660,10 @@ function driftOf(device) {
     return { status: "no snapshot", lines: [] };
   try {
     const adapter = adapterOf(device);
-    const plan4 = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
+    const plan = adapter.plan(adapter.render(device), readFileSync4(path, "utf8"), options);
     const lines = [
-      ...plan4.steps.flatMap((step) => [step.title, ...step.show.map((line2) => `  ${line2}`)]),
-      ...plan4.problems.map((problem) => `PROBLEM ${problem}`)
+      ...plan.steps.flatMap((step) => [step.title, ...step.show.map((line) => `  ${line}`)]),
+      ...plan.problems.map((problem) => `PROBLEM ${problem}`)
     ];
     return { status: lines.length ? "differs" : "matches", lines };
   } catch (error) {
@@ -4711,7 +4706,7 @@ function printSegment(segment, indent) {
 }
 function addressesCommand() {
   const [within] = names;
-  if (within && !isCidr(within))
+  if (within && !isCidr2(within))
     fail(`${within} is not a prefix, such as 10.0.0.0/16`);
   const lengthText = flagValue("length");
   const length = lengthText === undefined ? undefined : Number(lengthText);
@@ -4761,23 +4756,23 @@ function renameCommand() {
     fail(`${to} is not a hostname: letters, digits, dots, dashes and underscores`);
   const snapshot = statePath(device);
   const snapshots = existsSync3(snapshot) ? [relative2(root2, snapshot)] : [];
-  let plan4;
+  let plan;
   try {
-    plan4 = planRename(root2, from, to, { file: flags.includes("--file"), snapshots });
+    plan = planRename(root2, from, to, { file: flags.includes("--file"), snapshots });
   } catch (error) {
     fail(error.message);
   }
-  for (const change of plan4.changes) {
+  for (const change of plan.changes) {
     console.log(`${change.file}:${change.line}`);
     console.log(`  - ${change.before.trim()}`);
     console.log(`  + ${change.after.trim()}`);
   }
-  for (const move of plan4.moves)
+  for (const move of plan.moves)
     console.log(`move ${move.from} to ${move.to}`);
-  if (plan4.mentions.length) {
+  if (plan.mentions.length) {
     console.log(`
 Still naming ${from}, left as they are: change them by hand if they mean the device.`);
-    for (const mention of plan4.mentions)
+    for (const mention of plan.mentions)
       console.log(`  ${mention.file}:${mention.line}  ${mention.text.slice(0, 160)}`);
   }
   if (!confirmed) {
@@ -4785,7 +4780,7 @@ Still naming ${from}, left as they are: change them by hand if they mean the dev
 Nothing written. Re-run with --confirm.`);
     return;
   }
-  applyRename(root2, plan4);
+  applyRename(root2, plan);
   console.log(`
 Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its old hostname until then.`);
 }
@@ -4806,13 +4801,13 @@ async function studioCommand() {
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { isLoopback, studio } = await import("../chunks/server-5shmsmse.js");
-  const host2 = flagValue("host") ?? "127.0.0.1";
+  const { isLoopback, studio } = await import("../chunks/server-ckdy25w2.js");
+  const host = flagValue("host") ?? "127.0.0.1";
   const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
-  if (!isLoopback(host2) && !allowHosts.length) {
-    fail(`Studio on ${host2} needs --allow-host=<name>, the name people reach it by, such as studio.example.com`);
+  if (!isLoopback(host) && !allowHosts.length) {
+    fail(`Studio on ${host} needs --allow-host=<name>, the name people reach it by, such as studio.example.com`);
   }
-  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open"), host: host2, allowHosts });
+  await studio({ configPath, root: root2, port, open: !flags.includes("--no-open"), host, allowHosts });
 }
 var commands = {
   validate: validateCommand,