@takodotid/circuit 0.38.0 → 0.40.0

package/dist/helpers/index.js

@@ -1,6 +1,3 @@
-import {
-  Catalog
-} from "../chunks/index-6wb41q67.js";
 import {
   Address2
 } from "../chunks/index-n7w3tg5y.js";
@@ -235,8 +232,8 @@ class Bgp {
 class Cables {
   static link(spec) {
     return {
-      a: { [spec.a.port]: Cables.end(spec, spec.b, spec.b.port) },
-      b: { [spec.b.port]: Cables.end(spec, spec.a, spec.a.port) }
+      a: { [spec.a.port]: Cables.end(spec, spec.b.device, spec.b.port) },
+      b: { [spec.b.port]: Cables.end(spec, spec.a.device, spec.a.port) }
     };
   }
   static lag(spec) {
@@ -248,18 +245,17 @@ class Cables {
         throw new Error(`Cables.lag: ${spec.b.device} ${far} is cabled to both ${other} and ${near} on ${spec.a.device}`);
       taken.set(far, near);
     }
-    const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b, far), lag: spec.a.lag }]));
-    const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a, near), lag: spec.b.lag }]));
+    const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b.device, far), lag: spec.a.lag }]));
+    const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a.device, near), lag: spec.b.lag }]));
     return {
       a,
       b
     };
   }
-  static end(shared, far, port) {
-    const farEnd = { device: far.device, port, label: Catalog.spell(far.platform, far.model, port) };
+  static end(shared, device, port) {
     return {
-      description: shared.describe ? shared.describe(farEnd) : `${farEnd.device} ${farEnd.label}`,
-      link: { device: far.device, port, ...shared.through ? { through: shared.through } : {} }
+      link: { device, port, ...shared.through ? { through: shared.through } : {} },
+      ...shared.describe ? { description: shared.describe({ device, port }) } : {}
     };
   }
 }
@@ -668,21 +664,61 @@ class Filters {
   }
 }
 // src/helpers/upstreams.ts
+var DEFAULTS = {
+  vlan: "{key}",
+  native: "{key}-native",
+  interface: "{key}",
+  import: "{KEY}-IN",
+  export: "{KEY}-OUT",
+  group: "{key}"
+};
+
 class Upstreams {
-  static define(catalog) {
+  static define(catalog, options = {}) {
+    const names = options.names ?? {};
     const all = Object.entries(catalog);
     const nameOf = (key, upstream) => upstream.name ?? key;
-    const policy = (key) => key.toUpperCase();
     const grouped = (upstream) => upstream.role === "rs" || Boolean(upstream.multihop);
+    const named = (field, key, upstream) => {
+      const given = names[field];
+      const pattern = given === undefined || typeof given === "string" ? given ?? DEFAULTS[field] : (upstream.tunnel && "tunnel" in given ? given.tunnel : given[upstream.role]) ?? DEFAULTS[field];
+      return pattern.replaceAll("{key}", key).replaceAll("{KEY}", key.toUpperCase()).replaceAll("{number}", () => {
+        const number = upstream.handoff?.number ?? upstream.tunnel?.number;
+        if (number === undefined)
+          throw new Error(`Upstreams: ${key} needs a number for ${field} name ${pattern}`);
+        return String(number);
+      });
+    };
+    for (const field of Object.keys(DEFAULTS)) {
+      const taken = new Map;
+      for (const [key, upstream] of all) {
+        if (field === "native" && upstream.handoff?.native === undefined)
+          continue;
+        if (field === "import" && !upstream.import)
+          continue;
+        if (field === "group" && !grouped(upstream))
+          continue;
+        if (field === "vlan" && !upstream.handoff || field === "interface" && !upstream.handoff && !upstream.tunnel)
+          continue;
+        const name = named(field, key, upstream);
+        const other = taken.get(name);
+        if (other)
+          throw new Error(`Upstreams: ${other} and ${key} both have the ${field} name ${name}`);
+        taken.set(name, key);
+      }
+    }
+    const vlan = (key, upstream) => named("vlan", key, upstream);
+    const native = (key, upstream) => named("native", key, upstream);
+    const policy = (direction, key, upstream) => named(direction, key, upstream);
     const vlans = (device) => {
       const result = {};
       for (const [key, upstream] of all) {
         const handoff = upstream.handoff;
         if (!handoff || device !== undefined && handoff.port?.device !== device)
           continue;
-        result[key] = { id: handoff.vlan, description: nameOf(key, upstream) };
+        result[vlan(key, upstream)] = { id: handoff.vlan, description: nameOf(key, upstream) };
         if (device !== undefined && handoff.native !== undefined) {
-          result[`${key}-native`] = {
+          result[native(key, upstream)] = {
             id: handoff.native,
             description: `Native toward ${nameOf(key, upstream)}, nothing else in it`
           };
@@ -690,7 +726,7 @@ class Upstreams {
       }
       return result;
     };
-    const vlansOn = (device) => all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key]) => key);
+    const vlansOn = (device) => all.filter(([, upstream]) => upstream.handoff?.port?.device === device).map(([key, upstream]) => vlan(key, upstream));
     const ports = (device) => {
       const result = {};
       for (const [key, upstream] of all) {
@@ -698,8 +734,8 @@ class Upstreams {
         if (!handoff?.port || handoff.port.device !== device)
           continue;
         result[handoff.port.port] = {
-          description: nameOf(key, upstream),
-          ...handoff.native !== undefined ? { trunk_vlans: [key], native_vlan: `${key}-native` } : { access_vlan: key },
+          description: names.port ? names.port(key, upstream) : nameOf(key, upstream),
+          ...handoff.native !== undefined ? { trunk_vlans: [vlan(key, upstream)], native_vlan: native(key, upstream) } : { access_vlan: vlan(key, upstream) },
           lldp: false,
           stp: false,
           ...handoff.port.storm_control ? { storm_control: handoff.port.storm_control } : {}
@@ -711,27 +747,29 @@ class Upstreams {
       const result = {};
       for (const [key, upstream] of all) {
         const description = nameOf(key, upstream);
+        const name = named("interface", key, upstream);
         if (upstream.tunnel) {
           const { local, remote, addresses, mtu } = upstream.tunnel;
-          result[key] = { type: "gre", description, local, remote, addresses, ...mtu ? { mtu } : {} };
+          result[name] = { type: "gre", description, local, remote, addresses, ...mtu ? { mtu } : {} };
         } else if (upstream.handoff) {
           const { addresses, exchange } = upstream.handoff;
-          result[key] = { type: "vlan", vlan: key, description, addresses, ...exchange ? { exchange } : {} };
+          result[name] = { type: "vlan", vlan: vlan(key, upstream), description, addresses, ...exchange ? { exchange } : {} };
         }
       }
       return result;
     };
+    const uplinks = () => all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => named("interface", key, upstream));
     const settings = (key, upstream) => ({
       remote_as: upstream.asn,
       description: nameOf(key, upstream),
       role: upstream.role,
-      ...upstream.import ? { import: `${policy(key)}-IN` } : {},
-      export: `${policy(key)}-OUT`
+      ...upstream.import ? { import: policy("import", key, upstream) } : {},
+      export: policy("export", key, upstream)
     });
     const groups = () => Object.fromEntries(all.filter(([, upstream]) => grouped(upstream)).map(([key, upstream]) => {
       const multihop = upstream.multihop;
       return [
-        key,
+        named("group", key, upstream),
         {
           ...settings(key, upstream),
           ...multihop ? {
@@ -749,7 +787,7 @@ class Upstreams {
         name,
         {
           ...session,
-          ...grouped(upstream) ? { group: key } : settings(key, upstream),
+          ...grouped(upstream) ? { group: named("group", key, upstream) } : settings(key, upstream),
           ...limit ? { max_prefixes: limit } : {}
         }
       ];
@@ -757,7 +795,7 @@ class Upstreams {
     const policies = (options = {}) => {
       const result = {};
       for (const [key, upstream] of all) {
-        result[`${policy(key)}-OUT`] = [
+        result[policy("export", key, upstream)] = [
           ...options.actions?.(key, upstream) ?? [],
           ...upstream.export ?? [],
           ...Bgp.announce(upstream.announce)
@@ -766,7 +804,7 @@ class Upstreams {
         if (!taken)
           continue;
         const tag = options.tag?.(key, upstream);
-        result[`${policy(key)}-IN`] = [
+        result[policy("import", key, upstream)] = [
           ...taken.default ? Bgp.defaultOnly({ ...taken.default, ...options.sources ? { sources: options.sources } : {} }) : [],
           ...taken.learn ? Bgp.learn({
             ...taken.learn.before ? { before: taken.learn.before } : {},
@@ -779,9 +817,12 @@ class Upstreams {
       }
       return result;
     };
-    const untrusted = () => [...all.filter(([, upstream]) => upstream.handoff).map(([key]) => key), ...natives()];
-    const natives = () => all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key]) => `${key}-native`);
-    const privateDrops = () => all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key]) => key);
+    const untrusted = () => [
+      ...all.filter(([, upstream]) => upstream.handoff).map(([key, upstream]) => vlan(key, upstream)),
+      ...natives()
+    ];
+    const natives = () => all.filter(([, upstream]) => upstream.handoff?.native !== undefined).map(([key, upstream]) => native(key, upstream));
+    const privateDrops = () => all.filter(([, upstream]) => upstream.handoff && upstream.drop_private).map(([key, upstream]) => vlan(key, upstream));
     const tunnelRules = () => all.flatMap(([key, upstream]) => upstream.tunnel ? [
       {
         description: `GRE from ${nameOf(key, upstream)}`,
@@ -798,6 +839,7 @@ class Upstreams {
       vlansOn,
       ports,
       interfaces,
+      uplinks,
       groups,
       neighbors,
       policies,

package/dist/types/core/cabling.d.ts

@@ -31,6 +31,12 @@ export declare class Cabling {
      * Only ports where both ends run LLDP, by the config, are compared, and only on devices whose neighbors were read. A link `through` a carrier is not compared. LLDP can be off at the far end, so each is a warning.
      */
     static compare(devices: readonly Device[], neighbors: ReadonlyMap<string, readonly Neighbor[]>): Finding[];
+    /**
+     * Each linked port without a description gets one from its far end: the far device and the far port as printed on it, such as `firewall-1 port6`. The far device's own file has its platform and model, so the label is never written twice. A port whose far device is not in the network keeps none.
+     */
+    static describeLinks(devices: readonly Device[]): Device[];
+    /** A port as printed on the device, or Circuit's name for it when the model has no spelling for it. */
+    private static labelOf;
     /** A system name is the device's name, alone or with a domain after it. */
     private static isDevice;
     private static deviceOf;

package/dist/types/core/validator.d.ts

@@ -2,6 +2,8 @@ import type { Finding, Network } from "./define.js";
 export declare class Validator {
     static run(network: Network): Finding[];
     private static checkDevice;
+    /** A management VDOM: FortiOS only, not `root`, with declared interfaces, and routes that leave through its own. */
+    private static checkVdoms;
     /** What the model's hardware holds, from the catalog. A LAG with too many members is an error; too many switch rules is a warning, since the limit is only roughly known. */
     private static checkLimits;
     private static checkVlans;

package/dist/types/helpers/cables.d.ts

@@ -1,32 +1,24 @@
-import { type ModelName, type PlatformName, type PortName } from "../platforms/catalog.js";
-/** One end of a cable: the device, and its platform and model, which name its ports. */
-export type CableEnd<P extends PlatformName, M extends ModelName<P>> = {
-    device: string;
-    platform: P;
-    model: M;
-};
-/** The far end of a port, for its description: the device, the port by Circuit's name, and by the name printed on the device. */
+/** The far end of a port, for a description of your own: the device and its port by Circuit's name. */
 export type FarEnd = {
     device: string;
     port: string;
-    label: string;
 };
 /** What every cable of one entry shares. */
 type Shared = {
     /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
     through?: string;
-    /** A port's description from its far end. The far device and the far port's label when absent, such as `firewall-1 port6`. */
+    /** A port's description from its far end. When absent, Circuit writes the far device and the far port as printed on it, such as `firewall-1 port6`, from the far device's own file. */
     describe?: (far: FarEnd) => string;
 };
-/** A port a cable builds: what it is, the LAG it is in, and the other end. */
+/** A port a cable builds: the other end, the LAG it is in, and a description when `describe` gives one. */
 type CablePort<L extends string> = {
-    description: string;
     link: {
         device: string;
         port: string;
         through?: string;
     };
     lag?: L;
+    description?: string;
 };
 /** Ports for both ends of the cables between two of our devices, each cable written once. */
 export declare class Cables {
@@ -34,15 +26,17 @@ export declare class Cables {
      * One cable, both ends. Spread each end into its device's `ports`:
      *
      * ```ts
-     * const uplink = Cables.link({ a: { device: "router-1", platform: "routeros", model: "CCR2216-1G-12XS-2XQ", port: "25g-1" }, b: { ... } });
+     * const uplink = Cables.link({ a: { device: "router-1", port: "25g-1" }, b: { device: "switch-1", port: "10g-48" } });
      * // router-1: ports: { ...uplink.a }
      * ```
      */
-    static link<const PA extends PlatformName, const MA extends ModelName<PA>, const NA extends PortName<PA, MA>, const PB extends PlatformName, const MB extends ModelName<PB>, const NB extends PortName<PB, MB>>(spec: Shared & {
-        a: CableEnd<PA, MA> & {
+    static link<const NA extends string, const NB extends string>(spec: Shared & {
+        a: {
+            device: string;
             port: NA;
         };
-        b: CableEnd<PB, MB> & {
+        b: {
+            device: string;
             port: NB;
         };
     }): {
@@ -52,17 +46,19 @@ export declare class Cables {
     /**
      * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
      */
-    static lag<const PA extends PlatformName, const MA extends ModelName<PA>, const LA extends string, const PB extends PlatformName, const MB extends ModelName<PB>, const LB extends string, const C extends Partial<Record<PortName<PA, MA>, PortName<PB, MB>>>>(spec: Shared & {
-        a: CableEnd<PA, MA> & {
+    static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(spec: Shared & {
+        a: {
+            device: string;
             lag: LA;
         };
-        b: CableEnd<PB, MB> & {
+        b: {
+            device: string;
             lag: LB;
         };
         cables: C;
     }): {
         a: Record<keyof C & string, CablePort<LA>>;
-        b: Record<NonNullable<C[keyof C]> & string, CablePort<LB>>;
+        b: Record<C[keyof C], CablePort<LB>>;
     };
     /** A port facing `port` on the far device. */
     private static end;

package/dist/types/helpers/index.d.ts

@@ -1,7 +1,7 @@
 export { Bgp } from "./bgp.js";
 export type { Announced, CommunityScheme, DefaultOnlyOptions, LearnOptions, SanityLengths } from "./bgp.js";
 export { Cables } from "./cables.js";
-export type { CableEnd, FarEnd } from "./cables.js";
+export type { FarEnd } from "./cables.js";
 export { Checks } from "./checks.js";
 export type { TrustBoundary } from "./checks.js";
 export { Exchange } from "./exchange.js";

package/dist/types/helpers/upstreams.d.ts

@@ -13,6 +13,8 @@ export type Upstream = {
         vlan: number;
         /** It sends its VLAN tagged: its port gets a native VLAN of its own with this ID, which nothing else is in. Untagged when absent. */
         native?: number;
+        /** Its number in names with `{number}`, such as `core-ipt01-transita`. Written here, so removing another upstream renumbers nothing. */
+        number?: number;
         /** Our addresses on it. `{ address, peer }` for a point-to-point address whose far end is outside its own prefix. */
         addresses: readonly (InterfaceAddress | {
             address: InterfaceAddress;
@@ -27,12 +29,13 @@ export type Upstream = {
         /** An exchange's LAN, for `circuit peeringdb`. */
         exchange?: ExchangeLan;
     };
-    /** A GRE tunnel to it. */
+    /** A GRE tunnel to it. `number` is its number in names with `{number}`. */
     tunnel?: {
         local: IP;
         remote: IP;
         addresses: readonly InterfaceAddress[];
         mtu?: number;
+        number?: number;
     };
     /** Our BGP sessions with it, by name: its address, and ours when it is not the interface's. */
     sessions: Readonly<Record<string, {
@@ -72,6 +75,36 @@ export type Upstream = {
 };
 /** Upstreams by key. The key names everything built from it. */
 export type UpstreamCatalog = Readonly<Record<string, Upstream>>;
+/** A name made from an upstream: `{key}` is its key, `{KEY}` the key in capitals, `{number}` its `handoff.number` or `tunnel.number`. */
+type Pattern = string;
+/** A pattern for every upstream, or one per role. A role left out takes the default. */
+type ByRole = Pattern | {
+    readonly provider?: Pattern;
+    readonly rs?: Pattern;
+    readonly peer?: Pattern;
+};
+/** How the names built from each upstream are made. Each one left out takes its default. */
+export type UpstreamNames = {
+    /** The VLAN a handoff is on. `{key}` when absent. */
+    vlan?: ByRole;
+    /** The native VLAN of a handoff sent tagged. `{key}-native` when absent. */
+    native?: Pattern;
+    /** The router's interface: per role, and `tunnel` for one reached over a tunnel. `{key}` when absent. */
+    interface?: Pattern | {
+        readonly provider?: Pattern;
+        readonly rs?: Pattern;
+        readonly peer?: Pattern;
+        readonly tunnel?: Pattern;
+    };
+    /** The import policy. `{KEY}-IN` when absent. */
+    import?: Pattern;
+    /** The export policy. `{KEY}-OUT` when absent. */
+    export?: Pattern;
+    /** The BGP group of an exchange's route servers or of multihop sessions. `{key}` when absent. */
+    group?: Pattern;
+    /** The description of a handoff's switch port. Its `name` when absent. No device names it, so it may be any function. */
+    port?: (key: string, upstream: Upstream) => string;
+};
 /** How each upstream's policies are written: shared by every upstream of a catalog. */
 export type UpstreamPolicies<P extends string> = {
     /** A policy holding `Bgp.sanity()` that each import calls. The sanity rules are written in each import when absent. */
@@ -83,6 +116,17 @@ export type UpstreamPolicies<P extends string> = {
     /** The source address for routes of its family, one per family. */
     sources?: readonly IP[];
 };
+/** The names a device can refer to, and their patterns when the project gives none. */
+declare const DEFAULTS: {
+    readonly vlan: "{key}";
+    readonly native: "{key}-native";
+    readonly interface: "{key}";
+    readonly import: "{KEY}-IN";
+    readonly export: "{KEY}-OUT";
+    readonly group: "{key}";
+};
+type Defaults = typeof DEFAULTS;
+type Field = keyof Defaults;
 type Key<C> = keyof C & string;
 /** The upstreams that land on a VLAN of ours. */
 type Landed<C> = {
@@ -118,37 +162,76 @@ type Importing<C> = {
         import: object;
     } ? K : never;
 }[Key<C>];
-/** A native VLAN's name. */
-type Native<K extends string> = `${K}-native`;
-/** Each upstream's policies: `TRANSIT_A-IN` and `TRANSIT_A-OUT`. */
-type PolicyName<C> = `${Uppercase<Importing<C>>}-IN` | `${Uppercase<Key<C>>}-OUT`;
+/** The project's pattern for a name, or the default. */
+type PatternOf<N, F extends Field> = N extends {
+    [X in F]: infer P;
+} ? P : Defaults[F];
+/** The pattern an upstream takes: the only one, its tunnel's, its role's, or the default. */
+type Chosen<P, U, F extends Field> = P extends string ? P : U extends {
+    tunnel: object;
+} ? P extends {
+    tunnel: infer T extends string;
+} ? T : Defaults[F] : U extends {
+    role: infer R extends string;
+} ? P extends {
+    [X in R]: infer T extends string;
+} ? T : Defaults[F] : Defaults[F];
+/** Every `From` in `S` replaced. */
+type Replace<S extends string, From extends string, To extends string> = S extends `${infer A}${From}${infer B}` ? `${A}${To}${Replace<B, From, To>}` : S;
+/** An upstream's `handoff.number` or `tunnel.number`. */
+type NumberOf<U> = U extends {
+    handoff: {
+        number: infer N extends number;
+    };
+} ? N : U extends {
+    tunnel: {
+        number: infer N extends number;
+    };
+} ? N : number;
+/** The name built for upstream `K`: its pattern with the key, the key in capitals and its number filled in. */
+type Named<C, N, F extends Field, K extends Key<C>> = Replace<Replace<Replace<Chosen<PatternOf<N, F>, C[K], F>, "{key}", K>, "{KEY}", Uppercase<K>>, "{number}", `${NumberOf<C[K]>}`>;
+/** Each of these upstreams' names. */
+type Names<C, N, F extends Field, Ks extends Key<C>> = {
+    [K in Ks]: Named<C, N, F, K>;
+}[Ks];
 /** The catalog as written, with any key the shape does not have refused, at every level. */
-type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret ? T : {
+type Exact<S, T> = T extends readonly unknown[] | string | number | boolean | Secret | ((...args: never[]) => unknown) ? T : S extends unknown ? {
     [K in keyof T]: K extends keyof S ? Exact<NonNullable<S[K]>, T[K]> : never;
+} : never;
+/** The names as written, with a name or a role Upstreams does not make refused. */
+type ExactNames<N> = {
+    [F in keyof N]: F extends keyof UpstreamNames ? N[F] extends string | ((...args: never[]) => unknown) ? N[F] : {
+        [R in keyof N[F]]: R extends "provider" | "rs" | "peer" | "tunnel" ? N[F][R] : never;
+    } : never;
 };
 /** A network's upstreams written once, and each device's part built from them. */
 export declare class Upstreams {
     /**
-     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked:
+     * Each upstream written once: its AS, where it lands, its sessions, limits and policy. Everything a device needs is built from it, under names made from each key, so a device that names one is checked. By default:
      *
      * - VLAN `<key>`, and `<key>-native` for one that sends its VLAN tagged. The router's interface is `<key>` too, a VLAN interface or a GRE tunnel.
      * - Policies `<KEY>-IN` and `<KEY>-OUT`; a BGP group `<key>` for an exchange's route servers or multihop sessions.
      *
-     * On the router: `vlans()`, `interfaces()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
+     * `names` gives patterns of your own, such as `{ interface: { provider: "core-ipt0{number}-{key}" } }`; see `UpstreamNames`.
+     *
+     * On the router: `vlans()`, `interfaces()`, `uplinks()`, `groups()`, `neighbors()`, `policies({ ... })`, `tunnelRules()`, `addresses()`. On a switch: `vlans(device)`, `ports(device)`, `vlansOn(device)`. For checks and ACLs: `untrusted()`, `natives()`, `privateDrops()`. Lists follow the catalog's order, where order counts on a device.
      */
-    static define<const C extends UpstreamCatalog>(catalog: C & {
+    static define<const C extends UpstreamCatalog, const N extends UpstreamNames = {}>(catalog: C & {
         [K in keyof C]: Exact<Upstream, C[K]>;
+    }, options?: {
+        names?: N & ExactNames<N>;
     }): {
-        vlans: <const D extends string | undefined = undefined>(device?: D) => D extends string ? { [K in Landed<C>]: Vlan; } & { [K in Tagged<C> as Native<K>]: Vlan; } : { [K in Landed<C>]: Vlan; };
-        vlansOn: (device: string) => Landed<C>[];
-        ports: (device: string) => Record<string, Port<`${Tagged<C>}-native` | Landed<C>, never, never, never>>;
-        interfaces: () => { [K in Landed<C>]: VlanInterface<Landed<C>, never>; } & { [K in Tunneled<C>]: Gre<never>; };
-        groups: () => Record<Grouped<C>, NeighborSettings<PolicyName<C>>>;
-        neighbors: () => Record<string, Neighbor<PolicyName<C>, Grouped<C>>>;
-        policies: <const P extends string = never>(options?: UpstreamPolicies<P>) => Record<PolicyName<C>, PolicyRule<P, never>[]>;
-        untrusted: () => (`${Tagged<C>}-native` | Landed<C>)[];
-        natives: () => `${Tagged<C>}-native`[];
-        privateDrops: () => Landed<C>[];
+        vlans: <const D extends string | undefined = undefined>(device?: D) => D extends string ? { [K in Names<C, N, "vlan", Landed<C>>]: Vlan; } & { [K in Names<C, N, "native", Tagged<C>>]: Vlan; } : { [K in Names<C, N, "vlan", Landed<C>>]: Vlan; };
+        vlansOn: (device: string) => Names<C, N, "vlan", Landed<C>>[];
+        ports: (device: string) => Record<string, Port<Names<C, N, "native", Tagged<C>> | Names<C, N, "vlan", Landed<C>>, never, never, never>>;
+        interfaces: () => { [K in Names<C, N, "interface", Landed<C>>]: VlanInterface<Names<C, N, "vlan", Landed<C>>, never>; } & { [K in Names<C, N, "interface", Tunneled<C>>]: Gre<never>; };
+        uplinks: () => Names<C, N, "interface", Landed<C>>[];
+        groups: () => Record<Names<C, N, "group", Grouped<C>>, NeighborSettings<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>>>;
+        neighbors: () => Record<string, Neighbor<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>, Names<C, N, "group", Grouped<C>>>>;
+        policies: <const P extends string = never>(options?: UpstreamPolicies<P>) => Record<Names<C, N, "export", Key<C>> | Names<C, N, "import", Importing<C>>, PolicyRule<P, never>[]>;
+        untrusted: () => (Names<C, N, "native", Tagged<C>> | Names<C, N, "vlan", Landed<C>>)[];
+        natives: () => Names<C, N, "native", Tagged<C>>[];
+        privateDrops: () => Names<C, N, "vlan", Landed<C>>[];
         tunnelRules: () => FilterRule<never, never>[];
         addresses: () => IP[];
     };

package/dist/types/platforms/derive.d.ts

@@ -1,6 +1,6 @@
 import type { Device } from "../schema/index.js";
 /** A feature a platform renders once proved on one of its devices. */
-export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
+export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter" | "management-vdom";
 export declare class Derive {
     /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
     static lagIds(device: Device): Map<string, number>;

package/dist/types/platforms/fortios/firewall.d.ts

@@ -20,6 +20,8 @@ export declare class FortiOsFirewall {
     };
     /** A rule the platform keeps without being told: replies to a session it let through, and packets that belong to one, pass on their own. */
     static isImplied(rule: FilterRule<string, string>): boolean;
+    /** Who reaches the device's own services, alone: for a management VDOM, which routes no traffic of its own. */
+    static managementOnly(root: FortiOsBlock, device: Device): void;
     /** Packet filtering, who reaches the device, NAT and stateless ACLs. */
     static render(root: FortiOsBlock, device: Device): void;
     /**

package/dist/types/platforms/fortios/index.d.ts

@@ -92,12 +92,18 @@ export declare class FortiOs extends Platform {
     private static consoleSession;
     /** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
     private static withCli;
-    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. Gives what `get system status` printed. */
     private static checkVersion;
+    /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
+    private static inGlobal;
     /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
     private static scrub;
     /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
     private static readConfig;
+    /**
+     * A device in multi-VDOM mode, read where each section lives: the device's own under `config global`, the rest in `root`, and a management VDOM's sections named as the render names them. A VDOM that does not exist yet is not entered, since `edit` would make it.
+     */
+    private static readVdoms;
     /** Leave every `config` and `edit` level, back to the top prompt. */
     private static leave;
     /** Send the lines that set how the device saves changes. */

package/dist/types/platforms/fortios/render.d.ts

@@ -42,6 +42,8 @@ export declare class FortiOsRender {
     private static allowAccess;
     /** The whole configuration the device should run, in the form `show` prints. */
     static of(device: Device): string;
+    /** A management VDOM's routes, and who reaches the device's own services through it, as sections of their own after everything else. */
+    private static managementVdom;
     /** A certificate with its key is the device's own; one without is only trusted. */
     private static certificates;
     private static global;

package/dist/types/platforms/fortios/vdoms.d.ts

@@ -0,0 +1,50 @@
+import type { Device } from "../../schema/index.js";
+import type { Plan } from "../platform.js";
+import { FortiOsBlock } from "./tree.js";
+/** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
+type Scope = {
+    kind: "global";
+} | {
+    kind: "vdom";
+    vdom: string;
+};
+export declare class FortiOsVdoms {
+    /** The VDOM everything is in unless named otherwise. */
+    static readonly ROOT = "root";
+    /**
+     * Sections under `config global` in multi-VDOM mode, from FortiOS 6.2's CLI reference: the device's identity, logins, interfaces, name resolution, time, SNMP, logging targets, flow export and session helpers. Every other section belongs to a VDOM. Not proved on a device yet.
+     */
+    static readonly GLOBAL: Set<string>;
+    /** What a management VDOM holds: its routes, and who reaches the device's own services through it, with the objects those name. */
+    static readonly MANAGEMENT_SECTIONS: readonly ["firewall address", "firewall address6", "firewall addrgrp", "firewall addrgrp6", "firewall service custom", "router static", "router static6", "firewall local-in-policy", "firewall local-in-policy6"];
+    /** The management VDOM's name, when the device has one. */
+    static managementOf(device: Device): string | undefined;
+    /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
+    static vdomOf(device: Device, name: string): string;
+    /** A management VDOM's section as the render and the read write it. */
+    static key(vdom: string, section: string): string;
+    /** A section's scope, and its name as the device writes it. */
+    static scopeOf(key: string): {
+        scope: Scope;
+        section: string;
+    };
+    /** Whether a configuration runs in multi-VDOM mode. */
+    static isMulti(tree: FortiOsBlock): boolean;
+    /** Lines sent in a scope: inside `config global`, or inside one VDOM. */
+    static wrap(scope: Scope, lines: readonly string[]): string[];
+    /** What `show` printed in a management VDOM, each top-level section named as the render names it. */
+    static named(vdom: string, text: string): string;
+    /** The VDOMs `diagnose sys vd list` names, such as `name=mgmt/mgmt index=1`. */
+    static listed(text: string): string[];
+    /**
+     * A plan for a device that may run in multi-VDOM mode. In one VDOM it is `planOne` as it is. In several, each scope is planned on its own and its steps sent in that scope: the global steps first, then each VDOM's, then the global removals, so an interface is gone only once no VDOM names it.
+     *
+     * Turning multi-VDOM mode on or off, and moving an interface into another VDOM, are left to an operator: the first moves everything into `root` and ends every session, and the second can cut the way in. A plan that needs either holds only the problem.
+     */
+    static plan(desired: string, current: string, planOne: (desired: string, current: string) => Plan): Plan;
+    /** Interfaces the config puts in another VDOM than the device has them in. */
+    private static moved;
+    /** What a management VDOM can't hold yet, or a config with one can't have. */
+    static gaps(device: Device): string[];
+}
+export {};

package/dist/types/platforms/routeros/render.d.ts

@@ -164,8 +164,14 @@ export declare class RouterOsRender {
      */
     private addressLists;
     private firewall;
-    /** Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made. */
+    /**
+     * Untracked prefixes skip connection tracking in the raw table, both ways, before a connection is ever made.
+     *
+     * An address NAT uses inside one stays tracked, by an `accept` in each direction before every `notrack`: a reply to it that skipped tracking would never be translated back.
+     */
     private untracked;
+    /** Every address NAT translates to or from: each translation's target, and the address a destination translation matches. Once each, in rule order. */
+    static natAddresses(device: Device): string[];
     /**
      * The families a rule applies to. An address in the rule decides it; otherwise it applies to both.
      *