@takodotid/circuit 0.41.0 → 0.42.1

package/dist/chunks/index-6wb41q67.js

@@ -0,0 +1,62 @@
+// src/platforms/fortios/models.ts
+var models = {
+  "FG-3700D": {
+    ports: { "40g": 4, "10g": 28, "1g": 2 },
+    spelling: { "40g": "port{n}", "10g": "port{n+4}", "1g": "mgmt{n}" }
+  }
+};
+
+// src/platforms/junos/models.ts
+var models2 = {
+  "QFX5100-48S-6Q": {
+    ports: { "40g": 6, "10g": 48, "1g": 2 },
+    spelling: { "40g": "et-0/0/{n+47}", "10g": "xe-0/0/{n-1}", "1g": "em{n-1}" }
+  }
+};
+
+// src/platforms/raisecom-ros/models.ts
+var models3 = {
+  "RAX721-C-6C48": {
+    ports: { "100g": 6, "25g": 24, "10g": 24 },
+    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
+  }
+};
+
+// src/platforms/routeros/models.ts
+var models4 = {
+  "CCR2216-1G-12XS-2XQ": {
+    ports: { "100g": 2, "25g": 12, "1g": 1 },
+    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" },
+    limits: { lag_members: 8, switch_port_ranges: 5 }
+  }
+};
+
+// src/platforms/vrp/models.ts
+var models5 = {
+  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
+};
+
+// src/platforms/catalog.ts
+class Catalog {
+  static MODELS = { routeros: models4, vrp: models5, "raisecom-ros": models3, junos: models2, fortios: models };
+  static ports(platform, model) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    if (!spec)
+      throw new Error(`${platform} has no model ${model}`);
+    return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
+  }
+  static limits(platform, model) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    return spec?.limits ?? {};
+  }
+  static spell(platform, model, port) {
+    const spec = Catalog.MODELS[platform]?.[model];
+    const parts = /^(\d+[gm])-(\d+)$/.exec(port);
+    const template = parts && spec?.spelling[parts[1]];
+    if (!template)
+      throw new Error(`${model} has no port ${port}`);
+    return template.replace(/\{n([+-]\d+)?\}/, (_, shift) => String(Number(parts[2]) + Number(shift ?? 0)));
+  }
+}
+
+export { Catalog };

package/dist/chunks/{index-k38bby43.js → index-yzw86rc8.js}

@@ -1,68 +1,10 @@
+import {
+  Catalog
+} from "./index-6wb41q67.js";
 import {
   Address2
 } from "./index-n7w3tg5y.js";
 
-// src/platforms/fortios/models.ts
-var models = {
-  "FG-3700D": {
-    ports: { "40g": 4, "10g": 28, "1g": 2 },
-    spelling: { "40g": "port{n}", "10g": "port{n+4}", "1g": "mgmt{n}" }
-  }
-};
-
-// src/platforms/junos/models.ts
-var models2 = {
-  "QFX5100-48S-6Q": {
-    ports: { "40g": 6, "10g": 48, "1g": 2 },
-    spelling: { "40g": "et-0/0/{n+47}", "10g": "xe-0/0/{n-1}", "1g": "em{n-1}" }
-  }
-};
-
-// src/platforms/raisecom-ros/models.ts
-var models3 = {
-  "RAX721-C-6C48": {
-    ports: { "100g": 6, "25g": 24, "10g": 24 },
-    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
-  }
-};
-
-// src/platforms/routeros/models.ts
-var models4 = {
-  "CCR2216-1G-12XS-2XQ": {
-    ports: { "100g": 2, "25g": 12, "1g": 1 },
-    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" },
-    limits: { lag_members: 8, switch_port_ranges: 5 }
-  }
-};
-
-// src/platforms/vrp/models.ts
-var models5 = {
-  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
-};
-
-// src/platforms/catalog.ts
-class Catalog {
-  static MODELS = { routeros: models4, vrp: models5, "raisecom-ros": models3, junos: models2, fortios: models };
-  static ports(platform, model) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    if (!spec)
-      throw new Error(`${platform} has no model ${model}`);
-    return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
-  }
-  static limits(platform, model) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    return spec?.limits ?? {};
-  }
-  static spell(platform, model, port) {
-    const spec = Catalog.MODELS[platform]?.[model];
-    const parts = /^(\d+[gm])-(\d+)$/.exec(port);
-    const template = parts && spec?.spelling[parts[1]];
-    if (!template)
-      throw new Error(`${model} has no port ${port}`);
-    return template.replace(/\{n([+-]\d+)?\}/, (_, shift) => String(Number(parts[2]) + Number(shift ?? 0)));
-  }
-}
-
 // src/core/topology.ts
 class Builder {
   nodes = new Map;
@@ -976,4 +918,4 @@ class StudioModel {
   }
 }
 
-export { Catalog, Topology, AddressSpace, StudioModel };
+export { Topology, AddressSpace, StudioModel };

package/dist/chunks/{server-ggertnce.js → server-cxr9ynxc.js}

@@ -1,6 +1,6 @@
 import {
   StudioModel
-} from "./index-k38bby43.js";
+} from "./index-yzw86rc8.js";
 
 // src/studio/server.ts
 import { execFile as execFile2, spawn } from "node:child_process";

package/dist/cli/index.js

@@ -4,11 +4,13 @@ import {
   Secrets2
 } from "../chunks/index-20kcjxjg.js";
 import {
-  Catalog,
   Topology,
   AddressSpace,
   StudioModel
-} from "../chunks/index-k38bby43.js";
+} from "../chunks/index-yzw86rc8.js";
+import {
+  Catalog
+} from "../chunks/index-6wb41q67.js";
 import {
   Address2
 } from "../chunks/index-n7w3tg5y.js";
@@ -547,9 +549,23 @@ class Derive {
     for (const route of routing?.static ?? []) {
       if (route.bfd && !has("static-route-bfd"))
         found.push(`routing.static ${route.prefix} bfd, BFD on a static route is ${unproved}`);
+      if (route.table && !has("routing-tables"))
+        found.push(`routing.static ${route.prefix} table, a routing table beside the main one is ${unproved}`);
+    }
+    if (!has("routing-tables")) {
+      if (routing?.tables)
+        found.push(`routing.tables, a routing table beside the main one is ${unproved}`);
+      if (routing?.rules)
+        found.push(`routing.rules, routing rules are ${unproved}`);
     }
     const bgp = routing?.bgp;
+    for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
+      if (group.table && !has("routing-tables"))
+        found.push(`routing.bgp.groups.${name}.table, a routing table beside the main one is ${unproved}`);
+    }
     for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+      if (neighbor.table && !has("routing-tables"))
+        found.push(`routing.bgp.neighbors.${name}.table, a routing table beside the main one is ${unproved}`);
       const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
       const bfd = neighbor.bfd ?? group?.bfd;
       const multihop = neighbor.multihop ?? group?.multihop;
@@ -3969,28 +3985,6 @@ class Cabling {
     }
     return findings;
   }
-  static describeLinks(devices) {
-    const byName = new Map(devices.map((device) => [device.name, device]));
-    return devices.map((device) => {
-      const ports = Object.entries(device.ports ?? {});
-      if (!ports.some(([, port]) => port?.link && port.description === undefined))
-        return device;
-      const described = ports.map(([name, port]) => {
-        const far = port?.link ? byName.get(port.link.device) : undefined;
-        if (!port?.link || port.description !== undefined || !far)
-          return [name, port];
-        return [name, { ...port, description: `${far.name} ${Cabling.labelOf(far, port.link.port)}` }];
-      });
-      return { ...device, ports: Object.fromEntries(described) };
-    });
-  }
-  static labelOf(device, port) {
-    try {
-      return Catalog.spell(device.platform, device.model, port);
-    } catch {
-      return port;
-    }
-  }
   static isDevice(system, name) {
     return system === name || system.startsWith(`${name}.`);
   }
@@ -6828,13 +6822,13 @@ class BgpWait {
   static AFTER_APPLY = { seconds: 180, every: 10 };
   static async until(read, enough, limits, waiting = () => {}) {
     const deadline = Date.now() + limits.seconds * 1000;
-    let sessions = await read();
-    while (!enough(sessions) && Date.now() < deadline) {
-      waiting(sessions);
+    let value = await read();
+    while (!enough(value) && Date.now() < deadline) {
+      waiting(value);
       await sleep(Math.min(limits.every * 1000, Math.max(0, deadline - Date.now())));
-      sessions = await read();
+      value = await read();
     }
-    return sessions;
+    return value;
   }
   static upCount(sessions) {
     return sessions.filter((session) => session.established).length;
@@ -6954,6 +6948,7 @@ class RouterOsExport {
   };
   static ORDERED = new Set([
     "/routing filter rule",
+    "/routing rule",
     "/ip firewall filter",
     "/ipv6 firewall filter",
     "/ip firewall nat",
@@ -7135,6 +7130,8 @@ class RouterOsPlan {
     "/interface bridge filter",
     "/interface list",
     "/ip vrf",
+    "/routing table",
+    "/routing rule",
     "/ip address",
     "/ipv6 address",
     "/ip pool",
@@ -7179,6 +7176,7 @@ class RouterOsPlan {
     "/interface bridge vlan"
   ]);
   static CHANGED_IN_PLACE = new Set(["/interface vlan"]);
+  static RESTART_ON = { "/routing bgp connection": ["routing-table"] };
   static OLD_RULES = "frameworkOldRules";
   problems = [];
   constructor(sendSecrets) {
@@ -7349,8 +7347,16 @@ class RouterOsPlan {
       const update = this.changes(entry, current, `${menu} ${entryKey}`);
       if (!Object.keys(update).length)
         continue;
+      const selector = RouterOsPlan.find(menu, RouterOsExport.identity(current));
+      const restartsOn = (RouterOsPlan.RESTART_ON[menu] ?? []).filter((property) => (property in update));
+      if (restartsOn.length) {
+        changeStep.show.push(`~ ${entryKey} ${RouterOsPlan.describe(update)}, restarting the session: it takes a new ${restartsOn.join(" and ")} only when it restarts`);
+        changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], { disabled: "yes", ...update }));
+        changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], { disabled: "no" }));
+        continue;
+      }
       changeStep.show.push(`~ ${entryKey} ${RouterOsPlan.describe(update)}`);
-      changeStep.send.push(RouterOsPlan.line(menu, "set", RouterOsPlan.find(menu, RouterOsExport.identity(current)), [], update));
+      changeStep.send.push(RouterOsPlan.line(menu, "set", selector, [], update));
     }
     const removed = existingEntries.filter((entry) => !kept.has(key(entry)));
     const wholeLists = new Set;
@@ -8297,6 +8303,8 @@ class RouterOsRender {
     return rules;
   }
   routing() {
+    this.routingTables();
+    this.routingRules();
     this.staticRoutes();
     this.rpki();
     if (this.device.routing?.bgp) {
@@ -8307,6 +8315,24 @@ class RouterOsRender {
     this.ospf();
     this.bfd();
   }
+  routingTables() {
+    for (const [name, table] of Object.entries(this.device.routing?.tables ?? {})) {
+      this.add("/routing table", "add fib", { comment: table.description, name });
+    }
+  }
+  routingRules() {
+    for (const rule of this.device.routing?.rules ?? []) {
+      const onlyInTable = rule.table !== "main" && (rule.fallback ?? "none") === "none";
+      this.add("/routing rule", "add", {
+        action: onlyInTable ? "lookup-only-in-table" : "lookup",
+        comment: rule.description,
+        "dst-address": rule.match?.dst,
+        interface: rule.match?.in_interface && this.name(rule.match.in_interface),
+        "src-address": rule.match?.src,
+        table: rule.table
+      });
+    }
+  }
   staticRoutes() {
     for (const route of this.device.routing?.static ?? []) {
       const menu = Address2.family(Address2.host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
@@ -8317,7 +8343,7 @@ class RouterOsRender {
         distance: route.distance,
         "dst-address": route.prefix,
         gateway,
-        "routing-table": route.vrf
+        "routing-table": route.vrf ?? route.table
       });
     }
   }
@@ -8438,6 +8464,7 @@ class RouterOsRender {
         "output.network": originates ? RouterOsRender.NETWORKS[family] : undefined,
         "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
         "remote.as": settings.remote_as,
+        "routing-table": settings.table,
         "tcp-md5-key": settings.password && Secrets2.marker(settings.password),
         "use-bfd": settings.bfd ? "yes" : undefined
       });
@@ -8669,6 +8696,10 @@ class RouterOs extends Platform {
     ':put ("disabled|" . [/routing bgp connection get $c name] . "|" . [/routing bgp connection get $c remote.address])',
     "}"
   ].join(" ");
+  static listAdvertisements(prefixes) {
+    const where = prefixes.map((prefix) => `dst=${prefix}`).join(" or ");
+    return `:foreach a in=[/routing bgp advertisements print as-value where ${where}] do={ :put ("ADV|" . ($a->"peer") . "|" . ($a->"dst")) }`;
+  }
   static clearLimit(address) {
     return `/routing bgp session clear [find remote.address=${address} and limit-exceeded] flag=limit-exceeded`;
   }
@@ -8695,6 +8726,42 @@ class RouterOs extends Platform {
   };
   extension = ".rsc";
   console = RouterOs.CONSOLE;
+  checks(device) {
+    const bgp = device.routing?.bgp;
+    const statics = device.routing?.static ?? [];
+    const findings = [];
+    for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+      const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+      const table = neighbor.table ?? group?.table;
+      if (!table)
+        continue;
+      const families = neighbor.families ?? group?.families ?? [Address2.family(neighbor.address)];
+      const networks = (bgp?.networks ?? []).filter((prefix) => families.includes(Address2.family(Address2.host(prefix))));
+      const inTable = (prefix) => statics.some((route) => route.table === table && Address2.canonical(route.prefix) === Address2.canonical(prefix));
+      const missing = networks.filter((prefix) => !inTable(prefix));
+      if (!missing.length)
+        continue;
+      const where = `routing.bgp.neighbors.${name}`;
+      const route = (prefix) => `{ prefix: "${prefix}", blackhole: true, table: "${table}" }`;
+      const fix = `On RouterOS a session announces from its own table, ${table}`;
+      if (missing.length === networks.length) {
+        findings.push({
+          level: "error",
+          device: device.name,
+          message: `${where} would announce nothing: ${fix}, which has no route for any of networks. Add the routes it announces to ${table} too, such as ${route(missing[0])} in routing.static`
+        });
+        continue;
+      }
+      for (const prefix of missing) {
+        findings.push({
+          level: "warning",
+          device: device.name,
+          message: `${where} does not announce ${prefix}: ${fix}, which has no route for it. If its export should announce it, add ${route(prefix)} to routing.static`
+        });
+      }
+    }
+    return findings;
+  }
   unsupported(device) {
     const found = [];
     for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
@@ -8761,7 +8828,14 @@ class RouterOs extends Platform {
       if (route.bfd)
         found.push(`routing.static ${route.prefix} bfd, a static route's check-gateway takes arp, none or ping on 7.23`);
     }
-    found.push(...Derive.unproved(device, ["bfd-timers", "multihop-bfd", "static-route-bfd", "mac-limit", "ethertype-filter"]));
+    found.push(...Derive.unproved(device, [
+      "bfd-timers",
+      "multihop-bfd",
+      "static-route-bfd",
+      "mac-limit",
+      "ethertype-filter",
+      "routing-tables"
+    ]));
     return found;
   }
   render(device) {
@@ -8925,6 +8999,7 @@ ${certificates}` : "";
     const switchRules = plan.steps.some((step) => step.send.some((command) => command.startsWith(RouterOs.SWITCH_RULES)));
     const limits = options.bgp ?? BgpWait.AFTER_APPLY;
     const establishedBefore = await this.establishedSessions(device, options);
+    const announcedBefore = establishedBefore.length ? await this.announcedNow(device, options) : [];
     return {
       run: async () => {
         if (!switchRules && !establishedBefore.length) {
@@ -8935,7 +9010,8 @@ ${certificates}` : "";
         try {
           const switchProblems = switchRules ? await RouterOs.invalidSwitchRules(session, device) : [];
           const bgpProblems = await this.bgpBack(device, session, establishedBefore, limits);
-          return [...switchProblems, ...bgpProblems];
+          const announceProblems = await this.announcedBack(device, session, announcedBefore, limits);
+          return [...switchProblems, ...bgpProblems, ...announceProblems];
         } finally {
           session.close();
         }
@@ -9003,7 +9079,51 @@ ${certificates}` : "";
       console.log(`  BGP: all ${neighbors.length} established again`);
       return [];
     }
-    return down.map((bgp) => bgp.limit ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} ${bgp.neighbor} --clear-limit` : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`);
+    return down.map((bgp) => bgp.limit ? `BGP session ${bgp.neighbor} was established before the apply and closed on its limit${bgp.limit.max !== undefined ? ` of ${bgp.limit.max} prefixes` : ""}: the neighbor sends more than it may. Find out why, then: circuit bgp ${device.name} --neighbors '^${bgp.neighbor}$' --clear-limit` : `BGP session ${bgp.neighbor} was established before the apply and is not ${limits.seconds} s after it (${bgp.reason ?? (bgp.uptime === "no session" ? "no session" : "not established")}). Look with: circuit bgp ${device.name} --log`);
+  }
+  async announcedNow(device, options) {
+    if (!device.routing?.bgp?.networks?.length)
+      return [];
+    const session = await this.session(device, options);
+    try {
+      return await this.announced(device, session);
+    } finally {
+      session.close();
+    }
+  }
+  async announced(device, session) {
+    const bgp = device.routing?.bgp;
+    const networks = bgp?.networks ?? [];
+    if (!networks.length)
+      return [];
+    const sessions = (await session.run(RouterOs.LIST_BGP_SESSIONS, 60000)).split(/\r?\n/).map((line) => line.trim().split("|")).filter((fields) => fields.length > 1 && fields[0] !== "disabled");
+    const neighbors = Object.entries(bgp?.neighbors ?? {});
+    const neighborOf = (sessionName) => {
+      const remote = sessions.find(([name]) => name === sessionName)?.[1];
+      const byAddress = neighbors.find(([, neighbor]) => neighbor.address === remote);
+      const byName = neighbors.find(([name]) => name === sessionName.replace(/-\d+$/, ""));
+      return (byAddress ?? byName)?.[0];
+    };
+    const output = await session.run(RouterOs.listAdvertisements(networks), 60000);
+    return output.split(/\r?\n/).map((line) => line.trim().split("|")).flatMap(([marker, peer, prefix]) => {
+      const neighbor = marker === "ADV" && peer ? neighborOf(peer) : undefined;
+      return neighbor && prefix ? [`${neighbor} ${prefix}`] : [];
+    }).sort();
+  }
+  async announcedBack(device, session, before, limits) {
+    if (!before.length)
+      return [];
+    const missing = (now) => before.filter((pair) => !now.includes(pair));
+    const after = await BgpWait.until(() => this.announced(device, session), (now) => !missing(now).length, limits, (now) => console.log(`  BGP: ${missing(now).length} announcement(s) not back yet, checking again in ${limits.every} s`));
+    const gone = missing(after);
+    if (!gone.length) {
+      console.log(`  BGP: every session announces what it announced before`);
+      return [];
+    }
+    return gone.map((pair) => {
+      const [neighbor, prefix] = pair.split(" ");
+      return `BGP session ${neighbor} announced ${prefix} before the apply and does not ${limits.seconds} s after it, though it may still be established. A RouterOS session announces from its routing table: that table needs a route for ${prefix}, and a session whose table changed must restart. Look with: circuit show ${device.name} '/routing bgp advertisements print'`;
+    });
   }
   static async invalidSwitchRules(session, device) {
     const answer = (await session.run(RouterOs.COUNT_INVALID_SWITCH_RULES)).trim();
@@ -11220,9 +11340,11 @@ class Validator {
       const adapter = Platforms.find(device.platform);
       if (!adapter)
         report(`no adapter for platform ${device.platform}`);
-      else
+      else {
         for (const field of adapter.unsupported(device))
           report(`${device.platform} cannot express ${field}`);
+        findings.push(...adapter.checks?.(device) ?? []);
+      }
     }
     findings.push(...CrossChecks.run(network.devices));
     for (const check of network.checks ?? [])
@@ -11433,15 +11555,21 @@ class Validator {
         report(`static route ${route.prefix} has bfd without via, the address BFD watches`);
       names.expectInterface(`static route ${route.prefix} interface`, route.interface);
       names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
+      names.expect(`static route ${route.prefix} table`, route.table, route.table !== undefined && route.table in (routing?.tables ?? {}));
+      if (route.vrf && route.table)
+        report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
     }
+    Validator.checkTables(device, names, report, cidr);
     const bgp = routing?.bgp;
     const isPolicy = (policy) => policy !== undefined && (policy in policies);
     for (const prefix of bgp?.networks ?? [])
       cidr("BGP network", prefix);
+    const isTable = (table) => table !== undefined && (table in (routing?.tables ?? {}));
     for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
       for (const policy of [group.import, group.export]) {
         names.expect(`BGP group ${name} policy`, policy, isPolicy(policy));
       }
+      names.expect(`BGP group ${name} table`, group.table, isTable(group.table));
     }
     for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
       ip(`neighbor ${name}`, neighbor.address);
@@ -11452,6 +11580,7 @@ class Validator {
       for (const policy of [neighbor.import, neighbor.export]) {
         names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
       }
+      names.expect(`neighbor ${name} table`, neighbor.table, isTable(neighbor.table));
       const local = neighbor.local_address ?? group?.local_address;
       if (local && Address2.family(local) !== Address2.family(neighbor.address))
         report(`neighbor ${name} local_address and address differ in family`);
@@ -11463,6 +11592,48 @@ class Validator {
         names.expectInterface(`OSPF area ${areaId} interface`, iface);
     }
   }
+  static checkTables(device, names, report, cidr) {
+    const routing = device.routing;
+    const tables = routing?.tables ?? {};
+    const bgp = routing?.bgp;
+    const installed = new Set;
+    for (const route of routing?.static ?? [])
+      if (route.table)
+        installed.add(route.table);
+    for (const neighbor of Object.values(bgp?.neighbors ?? {})) {
+      const table = neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined);
+      if (table)
+        installed.add(table);
+    }
+    for (const name of Object.keys(tables)) {
+      if (name === "main")
+        report("routing.tables has main, the main table every device has; give the table another name");
+      if (name in (device.vrfs ?? {}))
+        report(`routing.tables ${name} has the name of a VRF; give the table another name`);
+      if (name !== "main" && !installed.has(name))
+        report(`routing.tables ${name}: nothing installs routes in it; give a static route or a BGP neighbor table: "${name}", or remove the table`);
+    }
+    const rules = routing?.rules ?? [];
+    rules.forEach((rule, index) => {
+      const where = `routing.rules ${index + 1}${rule.description ? ` (${rule.description})` : ""}`;
+      const match = rule.match ?? {};
+      names.expect(`${where} table`, rule.table, rule.table === "main" || rule.table in tables);
+      names.expectInterface(`${where} in_interface`, match.in_interface);
+      if (match.src)
+        cidr(where, match.src);
+      if (match.dst)
+        cidr(where, match.dst);
+      if (match.src && match.dst && Address2.isCidr(match.src) && Address2.isCidr(match.dst)) {
+        if (Address2.family(Address2.host(match.src)) !== Address2.family(Address2.host(match.dst)))
+          report(`${where}: src and dst differ in family, so no packet matches both`);
+      }
+      if (rule.table === "main" && rule.fallback)
+        report(`${where} looks up main and has fallback; fallback is for another table, so remove it`);
+      const matchesAll = !match.src && !match.dst && !match.in_interface;
+      if (matchesAll && index < rules.length - 1)
+        report(`${where} matches every packet, so the rules after it never run; give it a match, or move it last`);
+    });
+  }
   static checkPolicies(device, names, report, cidr) {
     const policies = device.policies ?? {};
     const sets = device.prefix_sets ?? {};
@@ -11865,14 +12036,10 @@ class Cli {
     return new Cli(configPath, network, options);
   }
   static async load(path) {
-    let network;
-    if (process.versions.bun) {
-      network = (await import(path)).default;
-    } else {
-      const { createJiti } = await import("jiti");
-      network = await createJiti(import.meta.url).import(path, { default: true });
-    }
-    return { ...network, devices: Cabling.describeLinks(network.devices) };
+    if (process.versions.bun)
+      return (await import(path)).default;
+    const { createJiti } = await import("jiti");
+    return createJiti(import.meta.url).import(path, { default: true });
   }
   static fail(message) {
     console.error(message);
@@ -11916,7 +12083,12 @@ class Cli {
     program.command("snapshot").description("read what each device runs into the state directory").argument("[device...]", "every device when none is named").option("--console", "through the device's serial console on its jump host, instead of SSH").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (devices, flags) => (await Cli.open(flags.config, flags)).snapshot(devices));
     program.command("apply").description("read the device, plan against what it runs, and send with --confirm").argument("<device>").option("--confirm", "send the plan; without it, nothing is sent").option("--secrets", "also send every secret, to rotate one").option("--rollback <minutes>", "minutes before a device that can restore itself does", Cli.minutes, 10).option("--console", "through the device's serial console on its jump host, instead of SSH").option("--force", "send even when the pings before --confirm find a path that loses too much or is too slow").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags) => (await Cli.open(flags.config, flags)).apply(device, flags.confirm ?? false, flags.force ?? false));
     program.command("show").description("run commands that only read on a device and print what it answers, secrets hidden").argument("<device>").argument("[command...]", "each command in quotes, such as '/ip route print'").option("--file <path>", "also each line of this file; blank lines and lines starting with # are skipped").option("--timeout <seconds>", "how long each command may take", Cli.seconds, 90).option("--console", "through the device's serial console, instead of SSH").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, commands, flags) => (await Cli.open(flags.config, flags)).show(device, commands, flags.file, flags.timeout));
-    program.command("bgp").description("each BGP neighbor in the config next to its live session: up or down and why, prefixes, uptime").argument("[device]", "may be left out when only one device has BGP neighbors").argument("[name-regex]", "only the neighbors whose name matches").option("--wait [count]", `read again every ${BgpWait.COMMAND.every} seconds until every neighbor shown, or this many, is up`, Cli.count).option("--max <seconds>", "how long --wait waits at most", Cli.seconds, BgpWait.COMMAND.seconds).option("--log [minutes]", "also print the device's BGP log lines from the last minutes, 5 by default", Cli.minutes).option("--clear-limit", "open again the neighbors shown that closed on their prefix limit; any other is left alone").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (first, second, flags) => (await Cli.open(flags.config)).bgp(first, second, flags));
+    program.command("bgp").description("each BGP neighbor in the config next to its live session: up or down and why, prefixes, uptime").argument("[device]", "may be left out when only one device has BGP neighbors").allowExcessArguments().option("--neighbors <regex>", "only the neighbors whose name matches").option("--wait [count]", `read again every ${BgpWait.COMMAND.every} seconds until every neighbor shown, or this many, is up`, Cli.count).option("--max <seconds>", "how long --wait waits at most", Cli.seconds, BgpWait.COMMAND.seconds).option("--log [minutes]", "also print the device's BGP log lines from the last minutes, 5 by default", Cli.minutes).option("--clear-limit", "open again the neighbors shown that closed on their prefix limit; any other is left alone").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags, command) => {
+      const [, filter] = command.args;
+      if (filter !== undefined)
+        Cli.fail(`circuit bgp takes one device; filter the neighbors with --neighbors: circuit bgp ${device} --neighbors '${filter}'`);
+      (await Cli.open(flags.config)).bgp(device, flags);
+    });
     program.command("console").description("open a device's serial console here, logged in; or send it lines and print what it answers").argument("<device>").argument("[line...]", "lines to send, each in quotes; none joins the console to this terminal, Ctrl-] leaves").option("--raw", "do not log in or out: only join the console, or send the lines").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, lines, flags) => (await Cli.open(flags.config)).console(device, lines, flags.raw ?? false));
     program.command("refresh").description("fetch prefix sets that come from a registry onto the device, with --confirm").argument("<device>").option("--confirm", "put them on the device; without it, nothing is sent").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, flags) => (await Cli.open(flags.config)).refresh(device, flags.confirm ?? false));
     program.command("wireguard").description("a client config for one peer, its private key left for the peer to fill").argument("<device>").argument("<interface>").argument("<peer>").option(Cli.CONFIG_FLAGS, Cli.CONFIG_HELP).action(async (device, iface, peer, flags) => (await Cli.open(flags.config)).wireguard(device, iface, peer));
@@ -12138,8 +12310,9 @@ ${output.replace(/\r/g, "").trimEnd()}${stoppedAtLimit}
     if (failed)
       process.exitCode = 1;
   }
-  async bgp(first, second, flags) {
-    const { device, pattern } = this.bgpTarget(first, second);
+  async bgp(deviceName, flags) {
+    const device = this.bgpDevice(deviceName);
+    const pattern = flags.neighbors;
     const adapter = this.adapterOf(device);
     const supported = Platforms.all().filter((platform) => platform.bgpSessions).map((platform) => platform.name).join(", ");
     if (!adapter.bgpSessions)
@@ -12199,17 +12372,15 @@ no neighbor shown is closed on its prefix limit, so nothing was cleared`);
 `);
     Cli.printBgp(await read());
   }
-  bgpTarget(first, second) {
-    if (second !== undefined || first && this.network.devices.some((device) => device.name === first)) {
-      return { device: this.one(first), pattern: second };
-    }
+  bgpDevice(name) {
+    if (name !== undefined)
+      return this.one(name);
     const withBgp = this.network.devices.filter((device) => Object.keys(device.routing?.bgp?.neighbors ?? {}).length);
-    const named = first ? `no device ${first}, and ` : "";
     if (withBgp.length === 1)
-      return { device: withBgp[0], pattern: first };
+      return withBgp[0];
     if (!withBgp.length)
-      Cli.fail(`${named}no device has BGP neighbors`);
-    return Cli.fail(`${named}several devices have BGP neighbors, so name one: ${withBgp.map((device) => device.name).join(", ")}`);
+      Cli.fail("no device has BGP neighbors");
+    return Cli.fail(`several devices have BGP neighbors, so name one: ${withBgp.map((device) => device.name).join(", ")}`);
   }
   static printBgp(sessions) {
     const width = Math.max(...sessions.map((session) => session.neighbor.length));
@@ -12677,7 +12848,7 @@ Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its ol
     const port = Number(flags.port);
     if (!Number.isInteger(port) || port < 1 || port > 65535)
       Cli.fail("--port takes a number from 1 to 65535");
-    const { StudioServer } = await import("../chunks/server-ggertnce.js");
+    const { StudioServer } = await import("../chunks/server-cxr9ynxc.js");
     const host = flags.host;
     const allowHosts = (flags.allowHost ?? "").split(",").filter(Boolean);
     if (!StudioServer.isLoopback(host) && !allowHosts.length) {