@takodotid/circuit 0.41.0 → 0.42.0

package/dist/chunks/index-6wb41q67.js

@@ -0,0 +1,62 @@
+// src/platforms/fortios/models.ts
+var models = {
+  "FG-3700D": {
+    ports: { "40g": 4, "10g": 28, "1g": 2 },
+    spelling: { "40g": "port{n}", "10g": "port{n+4}", "1g": "mgmt{n}" }
+  }
+};
+
+// src/platforms/junos/models.ts
+var models2 = {
+  "QFX5100-48S-6Q": {
+    ports: { "40g": 6, "10g": 48, "1g": 2 },
+    spelling: { "40g": "et-0/0/{n+47}", "10g": "xe-0/0/{n-1}", "1g": "em{n-1}" }
+  }
+};
+
+// src/platforms/raisecom-ros/models.ts
+var models3 = {
+  "RAX721-C-6C48": {
+    ports: { "100g": 6, "25g": 24, "10g": 24 },
+    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
+  }
+};
+
+// src/platforms/routeros/models.ts
+var models4 = {
+  "CCR2216-1G-12XS-2XQ": {
+    ports: { "100g": 2, "25g": 12, "1g": 1 },
+    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" },
+    limits: { lag_members: 8, switch_port_ranges: 5 }
+  }
+};
+
+// src/platforms/vrp/models.ts
+var models5 = {
+  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
+};
+
+// src/platforms/catalog.ts
+class Catalog {
+  static MODELS = { routeros: models4, vrp: models5, "raisecom-ros": models3, junos: models2, fortios: models };
+  static ports(platform, model) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    if (!spec)
+      throw new Error(`${platform} has no model ${model}`);
+    return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
+  }
+  static limits(platform, model) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    return spec?.limits ?? {};
+  }
+  static spell(platform, model, port) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    const parts = /^(\d+[gm])-(\d+)$/.exec(port);
+    const template = parts && spec?.spelling[parts[1]];
+    if (!template)
+      throw new Error(`${model} has no port ${port}`);
+    return template.replace(/\{n([+-]\d+)?\}/, (_, shift) => String(Number(parts[2]) + Number(shift ?? 0)));
+  }
+}
+
+export { Catalog };

package/dist/chunks/{index-k38bby43.js → index-yzw86rc8.js}

@@ -1,68 +1,10 @@
+import {
+  Catalog
+} from "./index-6wb41q67.js";
 import {
   Address2
 } from "./index-n7w3tg5y.js";
 
-// src/platforms/fortios/models.ts
-var models = {
-  "FG-3700D": {
-    ports: { "40g": 4, "10g": 28, "1g": 2 },
-    spelling: { "40g": "port{n}", "10g": "port{n+4}", "1g": "mgmt{n}" }
-  }
-};
-
-// src/platforms/junos/models.ts
-var models2 = {
-  "QFX5100-48S-6Q": {
-    ports: { "40g": 6, "10g": 48, "1g": 2 },
-    spelling: { "40g": "et-0/0/{n+47}", "10g": "xe-0/0/{n-1}", "1g": "em{n-1}" }
-  }
-};
-
-// src/platforms/raisecom-ros/models.ts
-var models3 = {
-  "RAX721-C-6C48": {
-    ports: { "100g": 6, "25g": 24, "10g": 24 },
-    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
-  }
-};
-
-// src/platforms/routeros/models.ts
-var models4 = {
-  "CCR2216-1G-12XS-2XQ": {
-    ports: { "100g": 2, "25g": 12, "1g": 1 },
-    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" },
-    limits: { lag_members: 8, switch_port_ranges: 5 }
-  }
-};
-
-// src/platforms/vrp/models.ts
-var models5 = {
-  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
-};
-
-// src/platforms/catalog.ts
-class Catalog {
-  static MODELS = { routeros: models4, vrp: models5, "raisecom-ros": models3, junos: models2, fortios: models };
-  static ports(platform, model) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    if (!spec)
-      throw new Error(`${platform} has no model ${model}`);
-    return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
-  }
-  static limits(platform, model) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    return spec?.limits ?? {};
-  }
-  static spell(platform, model, port) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    const parts = /^(\d+[gm])-(\d+)$/.exec(port);
-    const template = parts && spec?.spelling[parts[1]];
-    if (!template)
-      throw new Error(`${model} has no port ${port}`);
-    return template.replace(/\{n([+-]\d+)?\}/, (_, shift) => String(Number(parts[2]) + Number(shift ?? 0)));
-  }
-}
-
 // src/core/topology.ts
 class Builder {
   nodes = new Map;
@@ -976,4 +918,4 @@ class StudioModel {
   }
 }
 
-export { Catalog, Topology, AddressSpace, StudioModel };
+export { Topology, AddressSpace, StudioModel };

package/dist/chunks/{server-ggertnce.js → server-cxr9ynxc.js}

@@ -1,6 +1,6 @@
 import {
   StudioModel
-} from "./index-k38bby43.js";
+} from "./index-yzw86rc8.js";
 
 // src/studio/server.ts
 import { execFile as execFile2, spawn } from "node:child_process";

package/dist/cli/index.js

@@ -4,11 +4,13 @@ import {
   Secrets2
 } from "../chunks/index-20kcjxjg.js";
 import {
-  Catalog,
   Topology,
   AddressSpace,
   StudioModel
-} from "../chunks/index-k38bby43.js";
+} from "../chunks/index-yzw86rc8.js";
+import {
+  Catalog
+} from "../chunks/index-6wb41q67.js";
 import {
   Address2
 } from "../chunks/index-n7w3tg5y.js";
@@ -547,9 +549,23 @@ class Derive {
     for (const route of routing?.static ?? []) {
       if (route.bfd && !has("static-route-bfd"))
         found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+      if (route.table && !has("routing-tables"))
+        found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
+    }
+    if (!has("routing-tables")) {
+      if (routing?.tables)
+        found.push(`routing.tables, a routing table beside the main one is ${unproved}`);
+      if (routing?.rules)
+        found.push(`routing.rules, routing rules are ${unproved}`);
     }
     const bgp = routing?.bgp;
+    for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
+      if (group.table && !has("routing-tables"))
+        found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
+    }
     for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+      if (neighbor.table && !has("routing-tables"))
+        found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
       const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
       const bfd = neighbor.bfd ?? group?.bfd;
       const multihop = neighbor.multihop ?? group?.multihop;
@@ -3969,28 +3985,6 @@ class Cabling {
     }
     return findings;
   }
-  static describeLinks(devices) {
-    const byName = new Map(devices.map((device) => [device.name, device]));
-    return devices.map((device) => {
-      const ports = Object.entries(device.ports ?? {});
-      if (!ports.some(([, port]) => port?.link && port.description === undefined))
-        return device;
-      const described = ports.map(([name, port]) => {
-        const far = port?.link ? byName.get(port.link.device) : undefined;
-        if (!port?.link || port.description !== undefined || !far)
-          return [name, port];
-        return [name, { ...port, description: `${far.name} ${Cabling.labelOf(far, port.link.port)}` }];
-      });
-      return { ...device, ports: Object.fromEntries(described) };
-    });
-  }
-  static labelOf(device, port) {
-    try {
-      return Catalog.spell(device.platform, device.model, port);
-    } catch {
-      return port;
-    }
-  }
   static isDevice(system, name) {
     return system === name || system.startsWith(`${name}.`);
   }
@@ -6954,6 +6948,7 @@ class RouterOsExport {
   };
   static ORDERED = new Set([
     "/routing filter rule",
+    "/routing rule",
     "/ip firewall filter",
     "/ipv6 firewall filter",
     "/ip firewall nat",
@@ -7135,6 +7130,8 @@ class RouterOsPlan {
     "/interface bridge filter",
     "/interface list",
     "/ip vrf",
+    "/routing table",
+    "/routing rule",
     "/ip address",
     "/ipv6 address",
     "/ip pool",
@@ -8297,6 +8294,8 @@ class RouterOsRender {
     return rules;
   }
   routing() {
+    this.routingTables();
+    this.routingRules();
     this.staticRoutes();
     this.rpki();
     if (this.device.routing?.bgp) {
@@ -8307,6 +8306,24 @@ class RouterOsRender {
     this.ospf();
     this.bfd();
   }
+  routingTables() {
+    for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+      this.add("/routing table", "add fib", { comment: table.description, name });
+    }
+  }
+  routingRules() {
+    for (const rule of this.device.routing?.rules ?? []) {
+      const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+      this.add("/routing rule", "add", {
+        action: onlyInTable ? "lookup-only-in-table" : "lookup",
+        comment: rule.description,
+        "dst-address": rule.match?.dst,
+        interface: rule.match?.in_interface && this.name(rule.match.in_interface),
+        "src-address": rule.match?.src,
+        table: rule.table
+      });
+    }
+  }
   staticRoutes() {
     for (const route of this.device.routing?.static ?? []) {
       const menu = Address2.family(Address2.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
@@ -8317,7 +8334,7 @@ class RouterOsRender {
         distance: route.distance,
         "dst-address": route.prefix,
         gateway,
-        "routing-table": route.vrf
+        "routing-table": route.vrf ?? route.table
       });
     }
   }
@@ -8438,6 +8455,7 @@ class RouterOsRender {
         "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
         "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
         "remote.as": settings.remote_as,
+        "routing-table": settings.table,
         "tcp-md5-key": settings.password && Secrets2.marker(settings.password),
         "use-bfd": settings.bfd ? "yes" : undefined
       });
@@ -8761,7 +8779,14 @@ class RouterOs extends Platform {
       if (route.bfd)
         found.push(`routing.static ${route.prefix} bfd, a static route's check-gateway takes arp, none or ping on 7.23`);
     }
-    found.push(...Derive.unproved(device, ["bfd-timers", "multihop-bfd", "static-route-bfd", "mac-limit", "ethertype-filter"]));
+    found.push(...Derive.unproved(device, [
+      "bfd-timers",
+      "multihop-bfd",
+      "static-route-bfd",
+      "mac-limit",
+      "ethertype-filter",
+      "routing-tables"
+    ]));
     return found;
   }
   render(device) {
@@ -9003,7 +9028,7 @@ ${certificates}` : "";
       console.log(`  BGP: all ${neighbors.length} established again`);
       return [];
     }
-    return down.map((bgp) => bgp.limit ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit` : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`);
+    return down.map((bgp) => bgp.limit ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} --neighbors '^${bgp.neighbor}$' --clear-limit` : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`);
   }
   static async invalidSwitchRules(session, device) {
     const answer = (await session.run(RouterOs.COUNT_INVALID_SWITCH_RULES)).trim();
@@ -11433,15 +11458,21 @@ class Validator {
         report(`static route ${route.prefix} has bfd without via, the address BFD watches`);
       names.expectInterface(`static route ${route.prefix} interface`, route.interface);
       names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
+      names.expect(`static route ${route.prefix} table`, route.table, route.table !== undefined && route.table in (routing?.tables ?? {}));
+      if (route.vrf && route.table)
+        report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
     }
+    Validator.checkTables(device, names, report, cidr);
     const bgp = routing?.bgp;
     const isPolicy = (policy) => policy !== undefined && (policy in policies);
     for (const prefix of bgp?.networks ?? [])
       cidr("BGP network", prefix);
+    const isTable = (table) => table !== undefined && (table in (routing?.tables ?? {}));
     for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
       for (const policy of [group.import, group.export]) {
         names.expect(`BGP group ${name} policy`, policy, isPolicy(policy));
       }
+      names.expect(`BGP group ${name} table`, group.table, isTable(group.table));
     }
     for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
       ip(`neighbor ${name}`, neighbor.address);
@@ -11452,6 +11483,7 @@ class Validator {
       for (const policy of [neighbor.import, neighbor.export]) {
         names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
       }
+      names.expect(`neighbor ${name} table`, neighbor.table, isTable(neighbor.table));
       const local = neighbor.local_address ?? group?.local_address;
       if (local && Address2.family(local) !== Address2.family(neighbor.address))
         report(`neighbor ${name} local_address and address differ in family`);
@@ -11463,6 +11495,48 @@ class Validator {
         names.expectInterface(`OSPF area ${areaId} interface`, iface);
     }
   }
+  static checkTables(device, names, report, cidr) {
+    const routing = device.routing;
+    const tables = routing?.tables ?? {};
+    const bgp = routing?.bgp;
+    const installed = new Set;
+    for (const route of routing?.static ?? [])
+      if (route.table)
+        installed.add(route.table);
+    for (const neighbor of Object.values(bgp?.neighbors ?? {})) {
+      const table = neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined);
+      if (table)
+        installed.add(table);
+    }
+    for (const name of Object.keys(tables)) {
+      if (name === "main")
+        report("routing.tables has main, the main table every device has; give the table another name");
+      if (name in (device.vrfs ?? {}))
+        report(`routing.tables ${name} has the name of a VRF; give the table another name`);
+      if (name !== "main" && !installed.has(name))
+        report(`routing.tables ${name}: nothing installs routes in it; give a static route or a BGP neighbor table: "${name}", or remove the table`);
+    }
+    const rules = routing?.rules ?? [];
+    rules.forEach((rule, index) => {
+      const where = `routing.rules ${index + 1}${rule.description ? ` (${rule.description})` : ""}`;
+      const match = rule.match ?? {};
+      names.expect(`${where} table`, rule.table, rule.table === "main" || rule.table in tables);
+      names.expectInterface(`${where} in_interface`, match.in_interface);
+      if (match.src)
+        cidr(where, match.src);
+      if (match.dst)
+        cidr(where, match.dst);
+      if (match.src && match.dst && Address2.isCidr(match.src) && Address2.isCidr(match.dst)) {
+        if (Address2.family(Address2.host(match.src)) !== Address2.family(Address2.host(match.dst)))
+          report(`${where}: src and dst differ in family, so no packet matches both`);
+      }
+      if (rule.table === "main" && rule.fallback)
+        report(`${where} looks up main and has fallback; fallback is for another table, so remove it`);
+      const matchesAll = !match.src && !match.dst && !match.in_interface;
+      if (matchesAll && index < rules.length - 1)
+        report(`${where} matches every packet, so the rules after it never run; give it a match, or move it last`);
+    });
+  }
   static checkPolicies(device, names, report, cidr) {
     const policies = device.policies ?? {};
     const sets = device.prefix_sets ?? {};
@@ -11865,14 +11939,10 @@ class Cli {
     return new Cli(configPath, network, options);
   }
   static async load(path) {
-    let network;
-    if (process.versions.bun) {
-      network = (await import(path)).default;
-    } else {
-      const { createJiti } = await import("jiti");
-      network = await createJiti(import.meta.url).import(path, { default: true });
-    }
-    return { ...network, devices: Cabling.describeLinks(network.devices) };
+    if (process.versions.bun)
+      return (await import(path)).default;
+    const { createJiti } = await import("jiti");
+    return createJiti(import.meta.url).import(path, { default: true });
   }
   static fail(message) {
     console.error(message);
@@ -11916,7 +11986,12 @@ class Cli {
     program.command("snapshot").description("read what each device runs into the state directory").argument("[device...]", "every device when none is named").option("--console", "through the device's serial console on its jump host, instead of SSH").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (devices, flags) => (await Cli.open(flags.config, flags)).snapshot(devices));
     program.command("apply").description("read the device, plan against what it runs, and send with --confirm").argument("<device>").option("--confirm", "send the plan; without it, nothing is sent").option("--secrets", "also send every secret, to rotate one").option("--rollback <minutes>", "minutes before a device that can restore itself does", Cli.minutes, 10).option("--console", "through the device's serial console on its jump host, instead of SSH").option("--force", "send even when the pings before --confirm find a path that loses too much or is too slow").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags) => (await Cli.open(flags.config, flags)).apply(device, flags.confirm ?? false, flags.force ?? false));
     program.command("show").description("run commands that only read on a device and print what it answers, secrets hidden").argument("<device>").argument("[command...]", "each command in quotes, such as '/ip route print'").option("--file <path>", "also each line of this file; blank lines and lines starting with # are skipped").option("--timeout <seconds>", "how long each command may take", Cli.seconds, 90).option("--console", "through the device's serial console, instead of SSH").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, commands, flags) => (await Cli.open(flags.config, flags)).show(device, commands, flags.file, flags.timeout));
-    program.command("bgp").description("each BGP neighbor in the config next to its live session: up or down and why, prefixes, uptime").argument("[device]", "may be left out when only one device has BGP neighbors").argument("[name-regex]", "only the neighbors whose name matches").option("--wait [count]", `read again every ${BgpWait.COMMAND.every} seconds until every neighbor shown, or this many, is up`, Cli.count).option("--max <seconds>", "how long --wait waits at most", Cli.seconds, BgpWait.COMMAND.seconds).option("--log [minutes]", "also print the device's BGP log lines from the last minutes, 5 by default", Cli.minutes).option("--clear-limit", "open again the neighbors shown that closed on their prefix limit; any other is left alone").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (first, second, flags) => (await Cli.open(flags.config)).bgp(first, second, flags));
+    program.command("bgp").description("each BGP neighbor in the config next to its live session: up or down and why, prefixes, uptime").argument("[device]", "may be left out when only one device has BGP neighbors").allowExcessArguments().option("--neighbors <regex>", "only the neighbors whose name matches").option("--wait [count]", `read again every ${BgpWait.COMMAND.every} seconds until every neighbor shown, or this many, is up`, Cli.count).option("--max <seconds>", "how long --wait waits at most", Cli.seconds, BgpWait.COMMAND.seconds).option("--log [minutes]", "also print the device's BGP log lines from the last minutes, 5 by default", Cli.minutes).option("--clear-limit", "open again the neighbors shown that closed on their prefix limit; any other is left alone").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags, command) => {
+      const [, filter] = command.args;
+      if (filter !== undefined)
+        Cli.fail(`circuit bgp takes one device; filter the neighbors with --neighbors: circuit bgp ${device} --neighbors '${filter}'`);
+      (await Cli.open(flags.config)).bgp(device, flags);
+    });
     program.command("console").description("open a device's serial console here, logged in; or send it lines and print what it answers").argument("<device>").argument("[line...]", "lines to send, each in quotes; none joins the console to this terminal, Ctrl-] leaves").option("--raw", "do not log in or out: only join the console, or send the lines").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, lines, flags) => (await Cli.open(flags.config)).console(device, lines, flags.raw ?? false));
     program.command("refresh").description("fetch prefix sets that come from a registry onto the device, with --confirm").argument("<device>").option("--confirm", "put them on the device; without it, nothing is sent").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags) => (await Cli.open(flags.config)).refresh(device, flags.confirm ?? false));
     program.command("wireguard").description("a client config for one peer, its private key left for the peer to fill").argument("<device>").argument("<interface>").argument("<peer>").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, iface, peer, flags) => (await Cli.open(flags.config)).wireguard(device, iface, peer));
@@ -12138,8 +12213,9 @@ ${output.replace(/\r/g, "").trimEnd()}${stoppedAtLimit}
     if (failed)
       process.exitCode = 1;
   }
-  async bgp(first, second, flags) {
-    const { device, pattern } = this.bgpTarget(first, second);
+  async bgp(deviceName, flags) {
+    const device = this.bgpDevice(deviceName);
+    const pattern = flags.neighbors;
     const adapter = this.adapterOf(device);
     const supported = Platforms.all().filter((platform) => platform.bgpSessions).map((platform) => platform.name).join(", ");
     if (!adapter.bgpSessions)
@@ -12199,17 +12275,15 @@ no neighbor shown is closed on its prefix limit, so nothing was cleared`);
 `);
     Cli.printBgp(await read());
   }
-  bgpTarget(first, second) {
-    if (second !== undefined || first && this.network.devices.some((device) => device.name === first)) {
-      return { device: this.one(first), pattern: second };
-    }
+  bgpDevice(name) {
+    if (name !== undefined)
+      return this.one(name);
     const withBgp = this.network.devices.filter((device) => Object.keys(device.routing?.bgp?.neighbors ?? {}).length);
-    const named = first ? `no device ${first}, and ` : "";
     if (withBgp.length === 1)
-      return { device: withBgp[0], pattern: first };
+      return withBgp[0];
     if (!withBgp.length)
-      Cli.fail(`${named}no device has BGP neighbors`);
-    return Cli.fail(`${named}several devices have BGP neighbors, so name one: ${withBgp.map((device) => device.name).join(", ")}`);
+      Cli.fail("no device has BGP neighbors");
+    return Cli.fail(`several devices have BGP neighbors, so name one: ${withBgp.map((device) => device.name).join(", ")}`);
   }
   static printBgp(sessions) {
     const width = Math.max(...sessions.map((session) => session.neighbor.length));
@@ -12677,7 +12751,7 @@ Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its ol
     const port = Number(flags.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       Cli.fail("--port takes a number from 1 to 65535");
-    const { StudioServer } = await import("../chunks/server-ggertnce.js");
+    const { StudioServer } = await import("../chunks/server-cxr9ynxc.js");
     const host = flags.host;
     const allowHosts = (flags.allowHost ?? "").split(",").filter(Boolean);
     if (!StudioServer.isLoopback(host) && !allowHosts.length) {

package/dist/helpers/index.js

@@ -1,3 +1,6 @@
+import {
+  Catalog
+} from "../chunks/index-6wb41q67.js";
 import {
   Address2
 } from "../chunks/index-n7w3tg5y.js";
@@ -238,8 +241,8 @@ class Bgp {
 class Cables {
   static link(spec) {
     return {
-      a: { [spec.a.port]: Cables.end(spec, spec.b.device, spec.b.port) },
-      b: { [spec.b.port]: Cables.end(spec, spec.a.device, spec.a.port) }
+      a: { [spec.a.port]: Cables.end(spec, spec.b, spec.b.port) },
+      b: { [spec.b.port]: Cables.end(spec, spec.a, spec.a.port) }
     };
   }
   static lag(spec) {
@@ -251,17 +254,18 @@ class Cables {
         throw new Error(`Cables.lag: ${spec.b.device} ${far} is cabled to both ${other} and ${near} on ${spec.a.device}`);
       taken.set(far, near);
     }
-    const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b.device, far), lag: spec.a.lag }]));
-    const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a.device, near), lag: spec.b.lag }]));
+    const a = Object.fromEntries(pairs.map(([near, far]) => [near, { ...Cables.end(spec, spec.b, far), lag: spec.a.lag }]));
+    const b = Object.fromEntries(pairs.map(([near, far]) => [far, { ...Cables.end(spec, spec.a, near), lag: spec.b.lag }]));
     return {
       a,
       b
     };
   }
-  static end(shared, device, port) {
+  static end(shared, far, port) {
+    const label = far.platform && far.model ? Catalog.spell(far.platform, far.model, port) : undefined;
     return {
-      link: { device, port, ...shared.through ? { through: shared.through } : {} },
-      ...shared.describe ? { description: shared.describe({ device, port }) } : {}
+      link: { device: far.device, port, ...shared.through ? { through: shared.through } : {} },
+      ...shared.describe ? { description: shared.describe({ device: far.device, port, ...label ? { label } : {} }) } : {}
     };
   }
 }
@@ -560,8 +564,8 @@ class Exchange {
         result[port] = {
           description: `${member.name}, AS${member.asn}`,
           access_vlan: exchange.vlan,
-          stp: false,
-          lldp: false,
+          stp: exchange.stp ?? false,
+          lldp: exchange.lldp ?? false,
           storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } },
           ...exchange.mac_limit !== undefined ? { mac_limit: exchange.mac_limit } : {},
           ...exchange.ethertypes ? { ethertypes: exchange.ethertypes } : {}
@@ -767,6 +771,7 @@ class Upstreams {
         role: upstream.role,
         ...upstream.import ? { import: upstream.import.name } : {},
         export: upstream.export.name,
+        ...upstream.table ? { table: upstream.table } : {},
         ...multihop ? {
           local_address: multihop.local_address,
           multihop: true,

package/dist/types/core/cabling.d.ts

@@ -31,12 +31,6 @@ export declare class Cabling {
      * Only ports where both ends run LLDP, by the config, are compared, and only on devices whose neighbors were read. A link `through` a carrier is not compared. LLDP can be off at the far end, so each is a warning.
      */
     static compare(devices: readonly Device[], neighbors: ReadonlyMap<string, readonly Neighbor[]>): Finding[];
-    /**
-     * Each linked port without a description gets one from its far end: the far device and the far port as printed on it, such as `firewall-1 port6`. The far device's own file has its platform and model, so the label is never written twice. A port whose far device is not in the network keeps none.
-     */
-    static describeLinks(devices: readonly Device[]): Device[];
-    /** A port as printed on the device, or Circuit's name for it when the model has no spelling for it. */
-    private static labelOf;
     /** A system name is the device's name, alone or with a domain after it. */
     private static isDevice;
     private static deviceOf;

package/dist/types/core/define.d.ts

@@ -9,7 +9,7 @@ export declare const secretFile: (path: string) => Secret;
  *
  * The names it declares (VLANs, interfaces, policies and the rest) are the only names its other fields accept, and the editor suggests them. The port names come from the model.
  */
-export declare function defineDevice<const Platform extends PlatformName, const Model extends ModelName<Platform>, const Vlans extends string = never, const Interfaces extends string = never, const Policies extends string = never, const PrefixSets extends string = never, const BgpGroups extends string = never, const Acls extends string = never, const AddressSets extends string = never, const Users extends string = never, const Vrfs extends string = never, const Certificates extends string = never>(device: Device<Platform, Model, PortName<Platform, Model>, Vlans, Interfaces, Policies, PrefixSets, BgpGroups, Acls, AddressSets, Users, Vrfs, Certificates>): Device;
+export declare function defineDevice<const Platform extends PlatformName, const Model extends ModelName<Platform>, const Vlans extends string = never, const Interfaces extends string = never, const Policies extends string = never, const PrefixSets extends string = never, const BgpGroups extends string = never, const Acls extends string = never, const AddressSets extends string = never, const Users extends string = never, const Vrfs extends string = never, const Certificates extends string = never, const Tables extends string = never>(device: Device<Platform, Model, PortName<Platform, Model>, Vlans, Interfaces, Policies, PrefixSets, BgpGroups, Acls, AddressSets, Users, Vrfs, Certificates, Tables>): Device;
 /** Something a check found. */
 export type Finding = {
     /** An error stops `diff` and `apply`; a warning is reported only. */

package/dist/types/core/validator.d.ts

@@ -14,6 +14,8 @@ export declare class Validator {
     private static checkFrames;
     private static checkInterfaces;
     private static checkRouting;
+    /** Routing tables have names of their own and something installing routes in them, and rules name a table and can each be reached. */
+    private static checkTables;
     private static checkPolicies;
     private static checkFirewall;
     private static checkServices;

package/dist/types/helpers/cables.d.ts

@@ -1,13 +1,20 @@
-/** The far end of a port, for a description of your own: the device and its port by Circuit's name. */
+/** The far end of a port, for a description of your own: the device, its port by Circuit's name, and the port as printed on the device when that end names its platform and model. */
 export type FarEnd = {
     device: string;
     port: string;
+    label?: string;
+};
+/** One end of a cable entry: the device, and its platform and model if a description should name its ports as printed on it. */
+type End = {
+    device: string;
+    platform?: string;
+    model?: string;
 };
 /** What every cable of one entry shares. */
 type Shared = {
     /** What is between the two ends, such as a carrier's local loop. Both ends get it on their `link`. */
     through?: string;
-    /** A port's description from its far end. When absent, Circuit writes the far device and the far port as printed on it, such as `firewall-1 port6`, from the far device's own file. */
+    /** A port's description from its far end, such as `(far) => \`${far.device} ${far.label}\``. No description when absent. */
     describe?: (far: FarEnd) => string;
 };
 /** A port a cable builds: the other end, the LAG it is in, and a description when `describe` gives one. */
@@ -31,12 +38,10 @@ export declare class Cables {
      * ```
      */
     static link<const NA extends string, const NB extends string>(spec: Shared & {
-        a: {
-            device: string;
+        a: End & {
             port: NA;
         };
-        b: {
-            device: string;
+        b: End & {
             port: NB;
         };
     }): {
@@ -47,12 +52,10 @@ export declare class Cables {
      * The cables of a LAG, both ends, from one list read from end A: `{ "25g-1": "10g-2" }` is a cable from A's 25g-1 to B's 10g-2. Each port is a member of its end's LAG. Spread each end into its device's `ports`; the LAG itself stays on each device.
      */
     static lag<const LA extends string, const LB extends string, const C extends Readonly<Record<string, string>>>(spec: Shared & {
-        a: {
-            device: string;
+        a: End & {
             lag: LA;
         };
-        b: {
-            device: string;
+        b: End & {
             lag: LB;
         };
         cables: C;
@@ -60,7 +63,7 @@ export declare class Cables {
         a: Record<keyof C & string, CablePort<LA>>;
         b: Record<C[keyof C], CablePort<LB>>;
     };
-    /** A port facing `port` on the far device. */
+    /** A port facing `port` on the far end. */
     private static end;
 }
 export {};

package/dist/types/helpers/exchange.d.ts

@@ -29,13 +29,19 @@ export type InternetExchange<V extends string> = {
     mac_limit?: number;
     /** The only kinds of frame a member port takes in, usually `ipv4`, `ipv6` and `arp`. Every kind when absent. No platform renders it yet, so `validate` refuses it. */
     ethertypes?: readonly Ethertype[];
+    /** LLDP on member ports. Off when absent: a member's router has no business learning the fabric. */
+    lldp?: boolean;
+    /** Spanning tree on member ports. Off when absent: a member's port faces a router, which must not join the fabric's spanning tree. */
+    stp?: boolean;
 };
 /** An internet exchange's fabric: its member ports, a check of its members, and its route servers' config. */
 export declare class Exchange {
     /**
      * Member ports and a check for an internet exchange's fabric.
      *
-     * - `ports(device)`: every member's port on one switch. A member port is in the peering VLAN and nothing else, takes no part in spanning tree or LLDP, and lets only a trickle of broadcast, multicast and unknown unicast through. With `mac_limit` and `ethertypes`, it also learns that many MAC addresses at most and takes in only those kinds of frame.
+     * - `ports(device)`: every member's port on one switch, each written as
+     *   `{ description: "<name>, AS<asn>", access_vlan: vlan, stp: false, lldp: false, storm_control: { broadcast, multicast, unknown_unicast: { percent: storm_percent } } }`,
+     *   plus `mac_limit` and `ethertypes` when the exchange sets them. `stp` and `lldp` are the exchange's own when it sets them, and storm control is 1 % when `storm_percent` is absent.
      * - `check`: members never share a name, an AS, an address or a port; every address is inside the peering LAN and not reserved; every member port carries the peering VLAN alone.
      * - `bird(server)`: one route server's BIRD 2 config, with a session to every member. Write it to a file for the server; Circuit never logs in to a route server.
      * - `openbgpd(server)`: the same route server's config for OpenBGPD, its `bgpd.conf`, with the same sessions and the same rules.