@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/platforms/platform.ts

@@ -1,6 +1,6 @@
 import type { Neighbor } from "../core/cabling";
-import type { Finding } from "../core/define";
-import type { Device, Family } from "../schema";
+import type { Finding } from "./finding";
+import type { Device, Family } from "../model";
 import type { ConsoleDialect } from "../transport/console";
 import type { WaitLimits } from "./bgp-wait";
 import type { PlatformName } from "./catalog";
@@ -23,7 +23,7 @@ export type ApplyOptions = {
 /** How a device is read. */
 export type ReadOptions = Pick<ApplyOptions, "console">;
 
-/** A login on a device for commands that only read, as `circuit show` runs them. */
+/** A login on a device for commands that only read, as `circuit exec` runs them. */
 export type ReadSession = {
     /**
      * Run one command and return what it printed, without its echo or the prompt.
@@ -95,12 +95,14 @@ export abstract class Platform {
     /** The name a device's `platform` field takes. */
     abstract readonly name: PlatformName;
     abstract readonly os: OsSupport;
-    /** File extension of a saved snapshot, for syntax highlighting. */
+    /** File extension of the device's config, for syntax highlighting. */
     abstract readonly extension: string;
-    /** How the platform's serial console asks for a login and shows its prompt. Present when the platform can be read and applied through a console, `--console`, and opened with `circuit console`. */
+    /** How the platform's serial console asks for a login and shows its prompt. Present when the platform can be read and applied through a console, `--console`, and opened with `circuit access-console`. */
     readonly console: ConsoleDialect | undefined = undefined;
     /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
     abstract unsupported(device: Device): string[];
+    /** Fields this platform renders but has not proved on a device yet. Validation refuses them, unless `--experimental` asks for them, which makes each a warning. Absent on a platform with none. */
+    experimental?(device: Device): string[];
     /** What the platform does with a config that it may not do elsewhere, each as `validate` reports it: an error stops `diff` and `apply`, a warning is reported only. Absent on a platform with none. */
     checks?(device: Device): Finding[];
     /** The switch rules the render makes from the device's hardware ACLs, so `validate` can hold them to the model's limits. Absent on a platform whose rules are not counted. */
@@ -109,7 +111,7 @@ export abstract class Platform {
     abstract render(device: Device): string;
     /** What the device runs now, secrets removed, in the form `render` produces where the platform allows. */
     abstract read(device: Device, network: readonly Device[], options?: ReadOptions): Promise<string>;
-    /** The LLDP neighbors the device sees, by Circuit's port names, for `snapshot` to save. Absent on a platform whose LLDP command and its output are not proved on a device yet. */
+    /** The LLDP neighbors the device sees, by Circuit's port names, for `diff` and `apply` to compare with each port's `link`. Absent on a platform whose LLDP command and its output are not proved on a device yet. */
     neighbors?(device: Device, network: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
     /** What it takes to go from `current` to `desired`. */
     abstract plan(desired: string, current: string, options: ApplyOptions): Plan;
@@ -117,7 +119,7 @@ export abstract class Platform {
     fill?(device: Device, network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
     /** Send a plan, keeping the device reachable or restoring it. */
     abstract apply(device: Device, network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
-    /** Whether a command only reads on this platform, so `circuit show` may send it. Anything not known to only read is refused. */
+    /** Whether a command only reads on this platform, so `circuit exec` may send it. Anything not known to only read is refused. */
     abstract readOnly(command: string): boolean;
     /** Log in for commands that only read, over SSH or on the console, the way the platform's read logs in. */
     abstract session(device: Device, options?: ReadOptions): Promise<ReadSession>;
@@ -128,7 +130,7 @@ export abstract class Platform {
     /** Open again these sessions, each closed on its prefix limit, read by `bgpSessions`. Only a session still closed on its limit is touched. */
     bgpClearLimit?(session: ReadSession, sessions: readonly BgpSession[]): Promise<void>;
     /**
-     * Checks that the device is healthy after an apply, not only that it took the commands. Called before the plan is sent, to read what the checks compare against; the CLI runs them after the apply and the snapshot. Absent on a platform with no checks yet.
+     * Checks that the device is healthy after an apply, not only that it took the commands. Called before the plan is sent, to read what the checks compare against; the CLI runs them after the apply. Absent on a platform with no checks yet.
      */
     health?(device: Device, plan: Plan, options?: HealthOptions): Promise<HealthCheck>;
 }

package/src/platforms/raisecom-ros/TRAPS.md

@@ -35,6 +35,6 @@ Behaviour that looks like something else. Each one has been hit on a RAX721 runn
 - A MAC access-list a port filters with cannot change: `ACL 3000 is in use, and it can not be modified or destroyed`. Each port has its own list, 3001 and up by its place in the catalog, and the plan unbinds the port, changes the list and binds it again.
 - `no portswitch` asks for `y` like `portswitch`; a port the plan switched stays switched when it goes back to unused, which the read cannot see.
 - OSPF BFD is `ip ospf bfd` on the VLAN interface, printed as sent and undone with `no ip ospf bfd`.
-- A static route is watched by a BFD session: `bfd N bind peer-ip <next hop> interface vlan <V>` opens the session's view, where `session enable` starts it. It prints under `!command in bfd_template_mode`, with `session enable` indented, and goes with `no bfd N`. The route takes it as `ip route <prefix> <mask> <next hop> track bfd N` and prints `track bfd-session N`; `no ip route <prefix> <mask> <next hop>` removes the route whatever it tracks. A route takes a session number that does not exist yet. Only one session binds to a peer: a second one's `session enable` answers `Error input`, so the old session goes before the new one is made. Proved on tako-mmr-01, 2026-10-24.
+- A static route is watched by a BFD session: `bfd N bind peer-ip <next hop> interface vlan <V>` opens the session's view, where `session enable` starts it. It prints under `!command in bfd_template_mode`, with `session enable` indented, and goes with `no bfd N`. The route takes it as `ip route <prefix> <mask> <next hop> track bfd N` and prints `track bfd-session N`; `no ip route <prefix> <mask> <next hop>` removes the route whatever it tracks. A route takes a session number that does not exist yet. Only one session binds to a peer: a second one's `session enable` answers `Error input`, so the old session goes before the new one is made. Proved on switch-01, 2026-10-24.
 - BFD timers are global, `bfd detect-multiplier N`, `bfd send-interval N` and `bfd receive-interval N`, but `send-interval` took 10 and refused 300 and 99999, so its unit and range are not known and Circuit refuses `routing.bfd` here.
 - The caret under `Error input` marks how far the CLI took a line, so sending a whole line with a made-up ending shows whether a keyword exists, without the `?` or Tab that run the line.

package/src/platforms/raisecom-ros/index.ts

@@ -6,7 +6,7 @@ import type { ClientChannel } from "ssh2";
 import { Address } from "../../core/address";
 import type { Neighbor } from "../../core/cabling";
 import { Secrets } from "../../core/secrets";
-import type { Device } from "../../schema";
+import type { Device } from "../../model";
 import { ConsoleShell, SerialConsole, type ConsoleDialect } from "../../transport/console";
 import { Ssh } from "../../transport/ssh";
 import { Catalog } from "../catalog";
@@ -139,60 +139,67 @@ export class RaisecomRos extends Platform {
 
         if (device.management?.interfaces) found.push("management.interfaces, which only FortiOS builds for now");
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "bridge") found.push(`interfaces.${name}, a bridge, which only FortiOS builds for now`);
-            if (iface.type === "vlan" && iface.mac) found.push(`interfaces.${name}.mac, which only RouterOS sets for now`);
+        const interfaces = Derive.interfaces(device);
+
+        for (const { name, kind, settings } of interfaces) {
+            if (kind === "bridge") found.push(`interfaces.bridge.${name}, which only FortiOS builds for now`);
+            if (kind === "vlan_interface" && "mac" in settings && settings.mac)
+                found.push(`interfaces.vlan_interface.${name}.mac, which only RouterOS sets for now`);
         }
 
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
+        for (const [name, port] of Derive.ports(device)) {
+            const where = `interfaces.ethernet.${name}`;
 
-            for (const field of ["speed", "acl", "mtu", "addresses", "vrrp", "vrf"] as const) {
-                if (port[field] !== undefined) found.push(`ports.${name}.${field}`);
+            for (const field of ["speed", "ingress_acl", "mtu", "addresses", "vrrp", "vrf", "ipv6_ra", "hardware_offload"] as const) {
+                if (port[field] !== undefined) found.push(`${where}.${field}`);
             }
 
-            if (port.lldp === true) found.push(`ports.${name}.lldp true, LLDP is turned on per device`);
-            if (port.lag && (port.mac_limit !== undefined || port.ethertypes))
-                found.push(`ports.${name}.mac_limit and ethertypes on a LAG member, proved on a port alone`);
+            if (port.lldp === true) found.push(`${where}.lldp true, LLDP is turned on per device`);
+            if (port.in_lag && (port.mac_limit !== undefined || port.ethertypes))
+                found.push(`${where}.mac_limit and ethertypes on a LAG member, proved on a port alone`);
             if (port.mac_limit !== undefined && (port.mac_limit < 1 || port.mac_limit > RaisecomRosRender.MAC_LIMIT_MAX))
-                found.push(`ports.${name}.mac_limit ${port.mac_limit}, port security takes 1 to ${RaisecomRosRender.MAC_LIMIT_MAX}`);
-            if (typeof port.stp === "object" || port.stp === true) found.push(`ports.${name}.stp other than false`);
+                found.push(`${where}.mac_limit ${port.mac_limit}, port security takes 1 to ${RaisecomRosRender.MAC_LIMIT_MAX}`);
+            if (typeof port.stp === "object" || port.stp === true) found.push(`${where}.stp other than false`);
             const storm = port.storm_control;
             if (storm && (storm.multicast || storm.unknown_unicast || (storm.broadcast && "percent" in storm.broadcast))) {
-                found.push(`ports.${name}.storm_control other than broadcast in pps`);
+                found.push(`${where}.storm_control other than broadcast in pps`);
             }
         }
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type === "lag") {
-                for (const field of ["addresses", "vrrp", "vrf", "mtu", "storm_control", "stp"] as const) {
-                    if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}, a LAG here only switches`);
-                }
-                for (const field of ["mac_limit", "ethertypes"] as const) {
-                    if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}, proved on a port alone`);
-                }
-                continue;
-            }
+        for (const [name, lag] of Object.entries(device.interfaces?.lag ?? {})) {
+            if (!lag) continue;
 
-            if (iface.type !== "vlan") {
-                found.push(`interfaces.${name}, a ${iface.type}`);
-                continue;
+            for (const field of ["addresses", "vrrp", "vrf", "mtu", "storm_control", "stp", "ipv6_ra", "hardware_offload"] as const) {
+                if (lag[field] !== undefined) found.push(`interfaces.lag.${name}.${field}, a LAG here only switches`);
+            }
+            for (const field of ["mac_limit", "ethertypes"] as const) {
+                if (lag[field] !== undefined) found.push(`interfaces.lag.${name}.${field}, proved on a port alone`);
             }
+        }
+
+        for (const [name, iface] of Object.entries(device.interfaces?.vlan_interface ?? {})) {
+            if (!iface) continue;
+            const where = `interfaces.vlan_interface.${name}`;
 
-            for (const field of ["vrf", "description", "mtu", "ipv6_ra"] as const) {
-                if (iface[field] !== undefined) found.push(`interfaces.${name}.${field}`);
+            for (const field of ["vrf", "description", "mtu", "ipv6_ra", "hardware_offload"] as const) {
+                if (iface[field] !== undefined) found.push(`${where}.${field}`);
             }
 
             for (const entry of iface.addresses ?? []) {
                 const address = typeof entry === "string" ? entry : entry.address;
-                if (Address.family(address) === "ipv6") found.push(`interfaces.${name}.addresses ${address}, only IPv4 here`);
+                if (Address.family(address) === "ipv6") found.push(`${where}.addresses ${address}, only IPv4 here`);
             }
 
             for (const group of iface.vrrp ?? []) {
-                if (Address.family(group.address) === "ipv6") found.push(`interfaces.${name}.vrrp for IPv6`);
+                if (Address.family(group.address) === "ipv6") found.push(`${where}.vrrp for IPv6`);
             }
         }
 
+        // Only LAGs and VLAN interfaces are built here.
+        for (const { name, kind } of interfaces) {
+            if (kind !== "lag" && kind !== "vlan_interface") found.push(`interfaces.${kind}.${name}`);
+        }
+
         const routing = device.routing;
 
         for (const field of ["bgp", "rpki"] as const) {
@@ -200,73 +207,85 @@ export class RaisecomRos extends Platform {
         }
 
         const ospf = routing?.ospf;
-        if (ospf?.families?.includes("ipv6")) found.push("routing.ospf for IPv6");
+        if (routing?.router_id && !ospf) found.push("routing.router_id without routing.ospf, only OSPF uses it here");
+        if (ospf?.address_families?.includes("ipv6")) found.push("routing.ospf.address_families ipv6, OSPF runs for IPv4 here");
 
         for (const [areaId, area] of Object.entries(ospf?.areas ?? {})) {
-            for (const name of Object.keys(area.interfaces)) {
-                if (device.interfaces?.[name]?.type !== "vlan")
-                    found.push(`routing.ospf.areas.${areaId}.${name}, OSPF runs on VLAN interfaces here`);
+            for (const [name, settings] of Object.entries(area.interfaces)) {
+                if (settings && !device.interfaces?.vlan_interface?.[name])
+                    found.push(`routing.ospf.areas.${areaId}.interfaces.${name}, OSPF runs on VLAN interfaces here`);
             }
         }
 
-        for (const route of routing?.static ?? []) {
-            if (!route.via || route.vrf || Address.family(route.prefix) === "ipv6") {
-                found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+        for (const route of routing?.static_routes ?? []) {
+            const where = `routing.static_routes ${route.prefix}`;
+
+            if (!route.next_hop || route.vrf || Address.family(route.prefix) === "ipv6") {
+                found.push(`${where}, only an IPv4 next_hop in the default table`);
             }
 
-            if (route.description || route.distance) found.push(`routing.static ${route.prefix} description and distance`);
+            if (route.description || route.distance) found.push(`${where} description and distance`);
 
-            if (route.bfd && route.via && !RaisecomRosRender.bfdSessions(device).has(route.via)) {
-                found.push(`routing.static ${route.prefix} bfd, the next hop must be on a VLAN interface's network`);
+            if (route.bfd && route.next_hop && !RaisecomRosRender.bfdSessions(device).has(route.next_hop)) {
+                found.push(`${where} bfd, the next hop must be on a VLAN interface's network`);
             }
         }
 
-        for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
-            if (vlan.description) found.push(`vlans.${name}.description`);
+        for (const [name, vlan] of Object.entries(device.switching?.vlans ?? {})) {
+            if (vlan?.description) found.push(`switching.vlans.${name}.description`);
         }
 
-        const UNSUPPORTED_SECTIONS = [
-            "firewall",
-            "dhcp",
-            "dhcp_relay",
-            "acls",
-            "policies",
-            "prefix_sets",
-            "hardware_offload",
-            "certificates",
-            "vrfs",
-            "flow_export",
-        ] as const;
-
-        for (const field of UNSUPPORTED_SECTIONS) {
-            if (device[field] !== undefined) found.push(field);
+        // Address sets alone build nothing: `management.allow` may name one, and the project has put its addresses there.
+        const { address_sets: _addressSets, ...firewall } = device.firewall ?? {};
+
+        const UNSUPPORTED_GROUPS: [string, unknown][] = [
+            ["firewall", Object.keys(firewall).length ? firewall : undefined],
+            ["services.dhcp_server", device.services?.dhcp_server],
+            ["services.dhcp_relay", device.services?.dhcp_relay],
+            ["switching.acls", device.switching?.acls],
+            ["routing.policies", routing?.policies],
+            ["routing.prefix_sets", routing?.prefix_sets],
+            ["system.hardware_offload", device.system?.hardware_offload],
+            ["system.certificates", device.system?.certificates],
+            ["routing.vrfs", routing?.vrfs],
+            ["monitoring.flow_export", device.monitoring?.flow_export],
+        ];
+
+        for (const [path, value] of UNSUPPORTED_GROUPS) {
+            if (value !== undefined) found.push(path);
         }
 
         const management = device.management ?? {};
 
-        for (const field of ["http", "https", "api", "api_tls", "ftp", "native", "console"] as const) {
+        for (const field of ["http", "https", "api", "api_tls", "ftp", "native_protocol", "console"] as const) {
             if (management[field]) found.push(`management.${field}`);
         }
 
-        for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
+        const snmp = device.monitoring?.snmp;
+
+        for (const [name, user] of Object.entries(snmp?.users ?? {})) {
             if (!RaisecomRosRender.SNMP_AUTH[user.auth])
-                found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
+                found.push(`monitoring.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
         }
 
-        if (management.snmp?.contact || management.snmp?.location) found.push("management.snmp.contact and location");
+        if (snmp?.contact || snmp?.location) found.push("monitoring.snmp.contact and location");
         if (management.ssh?.weak_crypto) found.push("management.ssh.weak_crypto");
 
-        if (device.lldp && device.lldp !== true) found.push("lldp.interfaces, LLDP is per device");
-        if (device.stp?.mode && device.stp.mode !== "mstp") found.push("stp.mode other than mstp");
+        const switching = device.switching;
+        if (switching?.lldp && switching.lldp !== true) found.push("switching.lldp.interfaces, LLDP is per device");
+        if (switching?.stp?.mode && switching.stp.mode !== "mstp") found.push("switching.stp.mode other than mstp");
 
-        for (const [name, user] of Object.entries(device.users ?? {})) {
-            if (user.role !== "admin") found.push(`users.${name}.role other than admin`);
+        for (const [name, user] of Object.entries(device.system?.users ?? {})) {
+            if (user && user.role !== "admin") found.push(`system.users.${name}.role other than admin`);
         }
 
         const system = device.system ?? {};
+        const services = device.services ?? {};
 
-        if (system.dns || system.logging?.local || system.release_channel || system.banner || system.ntp?.serve) {
-            found.push("system.dns, logging.local, release_channel, banner and ntp.serve");
+        if (system.dns || system.logging?.local || system.release_channel || system.banner || services.dns_server || services.ntp_server) {
+            found.push(
+                "system.dns, system.logging.local, system.release_channel, system.banner, services.dns_server and services.ntp_server"
+            );
         }
 
         // SNMP takes its own access-list; SSH and telnet share the management one.
@@ -682,7 +701,7 @@ export class RaisecomRos extends Platform {
         const opened = await SerialConsole.open(console);
 
         try {
-            await SerialConsole.login(opened.channel, RaisecomRos.CONSOLE, user, password, console.passwordOnly);
+            await SerialConsole.login(opened.channel, RaisecomRos.CONSOLE, user, password, console.password_only);
         } catch (error) {
             opened.close();
             throw error;
@@ -695,7 +714,7 @@ export class RaisecomRos extends Platform {
                 opened.close();
             },
             fresh: async () => {
-                await SerialConsole.login(opened.channel, RaisecomRos.CONSOLE, user, password, console.passwordOnly);
+                await SerialConsole.login(opened.channel, RaisecomRos.CONSOLE, user, password, console.password_only);
                 await Ssh.send(opened.channel, "terminal page-break disable", 15_000, 1000);
                 return session;
             },

package/src/platforms/raisecom-ros/render.ts

@@ -1,12 +1,10 @@
 import { Address } from "../../core/address";
 import { Secrets } from "../../core/secrets";
 import { Utils } from "../../core/utils";
-import type { Device, Ethertype, Port, Prefix, Severity, SnmpUser, Switched, Vrrp } from "../../schema";
+import type { Device, Ethertype, Port, Prefix, Severity, SnmpUser, Switched, Vrrp } from "../../model";
 import { Catalog } from "../catalog";
 import { Derive } from "../derive";
 
-type AnyPort = Port<string, string, string, string>;
-
 /** The configuration a Raisecom ROS device should run. */
 export class RaisecomRosRender {
     /** The access-list that guards every management service. */
@@ -63,18 +61,18 @@ export class RaisecomRosRender {
     /** The whole configuration of a device. */
     static of(device: Device): string {
         const lines: string[] = [];
-        const vlans = device.vlans ?? {};
+        const vlans = device.switching?.vlans ?? {};
         const vlanId = (name: string) => vlans[name]!.id;
         const management = device.management ?? {};
-        const allow = management.allow ?? [];
+        const allow = RaisecomRosRender.managementAllow(device);
 
-        const ids = Object.values(vlans).map((vlan) => vlan.id);
+        const ids = Object.values(vlans).flatMap((vlan) => (vlan ? [vlan.id] : []));
         if (ids.length) lines.push(`create vlan ${RaisecomRosRender.vlanList(ids)} active`, "!");
 
         const lagNumbers = Derive.lagIds(device);
 
-        for (const [name, lag] of Object.entries(device.interfaces ?? {})) {
-            if (lag.type !== "lag") continue;
+        for (const [name, lag] of Object.entries(device.interfaces?.lag ?? {})) {
+            if (!lag) continue;
 
             lines.push(`interface port-channel ${lagNumbers.get(name)}`);
             if (lag.description) lines.push(`description ${lag.description}`);
@@ -83,14 +81,15 @@ export class RaisecomRosRender {
         }
 
         if (allow.length) lines.push(...RaisecomRosRender.accessList(RaisecomRosRender.MANAGEMENT_ACL, "management", allow));
-        const snmpSources = management.snmp?.allow;
+        const snmp = device.monitoring?.snmp;
+        const snmpSources = snmp?.allow;
         if (snmpSources) lines.push(...RaisecomRosRender.accessList(RaisecomRosRender.SNMP_ACL, "snmp", snmpSources));
 
         const ports = Catalog.ports(device.platform, device.model);
 
         // Each port that takes only some kinds of frame has a MAC access-list of its own, so changing one releases only that port.
         ports.forEach((port, index) => {
-            const ethertypes = device.ports?.[port as keyof typeof device.ports]?.ethertypes;
+            const ethertypes = device.interfaces?.ethernet?.[port]?.ethertypes;
             if (!ethertypes) return;
 
             lines.push(`access-list ${RaisecomRosRender.ethertypeAcl(index)}`);
@@ -100,8 +99,8 @@ export class RaisecomRosRender {
             lines.push("  rule 100 deny any any", "!");
         });
 
-        for (const [name, user] of Object.entries(device.users ?? {}))
-            lines.push(`user name ${name} password ${Secrets.marker(user.password)}`);
+        for (const [name, user] of Object.entries(device.system?.users ?? {}))
+            if (user) lines.push(`user name ${name} password ${Secrets.marker(user.password)}`);
         if (management.privilege_password) lines.push(`enable password ${Secrets.marker(management.privilege_password)}`);
         lines.push(`hostname ${device.name}`);
 
@@ -115,7 +114,7 @@ export class RaisecomRosRender {
         lines.push("!");
 
         ports.forEach((port, index) => {
-            const settings = device.ports?.[port as keyof typeof device.ports];
+            const settings = device.interfaces?.ethernet?.[port];
             lines.push(
                 `interface ${Catalog.spell(device.platform, device.model, port)}`,
                 ...RaisecomRosRender.physicalPort(settings, vlanId, lagNumbers),
@@ -126,8 +125,8 @@ export class RaisecomRosRender {
 
         const ospf = device.routing?.ospf;
 
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (iface.type !== "vlan") continue;
+        for (const [name, iface] of Object.entries(device.interfaces?.vlan_interface ?? {})) {
+            if (!iface) continue;
 
             lines.push(`interface vlan ${vlanId(iface.vlan)}`);
 
@@ -153,7 +152,9 @@ export class RaisecomRosRender {
             lines.push(`router ospf ${RaisecomRosRender.OSPF_PROCESS}${routerId ? ` router-id ${routerId}` : ""}`);
 
             for (const [areaId, area] of Object.entries(ospf.areas)) {
-                for (const iface of Object.keys(area.interfaces)) {
+                for (const [iface, settings] of Object.entries(area.interfaces)) {
+                    if (!settings) continue;
+
                     for (const prefix of Derive.ipv4Networks(device, iface)) {
                         lines.push(`network ${Address.host(prefix)} ${Address.wildcard(Address.split(prefix).len)} area ${areaId}`);
                     }
@@ -165,18 +166,18 @@ export class RaisecomRosRender {
         }
 
         // Storm control acts only once detection is on.
-        if (Object.values(device.ports ?? {}).some((port) => port?.storm_control)) lines.push("storm-control detection enable");
-        if (device.system?.transceiver_monitoring) lines.push("transceiver ddm enable");
+        if (Derive.ports(device).some(([, port]) => port.storm_control)) lines.push("storm-control detection enable");
+        if (device.monitoring?.transceivers) lines.push("transceiver ddm enable");
         // LLDP and spanning tree are off by default and turned on by the config.
-        if (device.lldp) lines.push("lldp enable");
-        if (device.stp) {
+        const switching = device.switching;
+        if (switching?.lldp) lines.push("lldp enable");
+        if (switching?.stp) {
             lines.push("spanning-tree enable");
-            if (device.stp.priority !== undefined) lines.push(`spanning-tree priority ${device.stp.priority}`);
+            if (switching.stp.priority !== undefined) lines.push(`spanning-tree priority ${switching.stp.priority}`);
         }
 
         // The factory communities survive a reset, and one of them can write, so they are always removed.
         lines.push("no snmp-server community public", "no snmp-server community private");
-        const snmp = management.snmp;
         if (snmp?.community) lines.push(`snmp-server community ${Secrets.marker(snmp.community)} ro`);
 
         const snmpUsers = Object.entries(snmp?.users ?? {});
@@ -201,12 +202,12 @@ export class RaisecomRosRender {
             lines.push(`bfd ${session.id} bind peer-ip ${via} interface vlan ${vlanId(session.vlan)}`, "session enable", "!");
         }
 
-        for (const route of device.routing?.static ?? []) {
+        for (const route of device.routing?.static_routes ?? []) {
             const { addr, len } = Address.split(route.prefix);
-            if (Address.family(addr) !== "ipv4" || !route.via) continue;
+            if (Address.family(addr) !== "ipv4" || !route.next_hop) continue;
 
-            const session = route.bfd ? sessions.get(route.via) : undefined;
-            lines.push(`ip route ${addr} ${Address.netmask(len)} ${route.via}${session ? ` track bfd ${session.id}` : ""}`);
+            const session = route.bfd ? sessions.get(route.next_hop) : undefined;
+            lines.push(`ip route ${addr} ${Address.netmask(len)} ${route.next_hop}${session ? ` track bfd ${session.id}` : ""}`);
         }
 
         if (management.telnet) {
@@ -222,7 +223,7 @@ export class RaisecomRosRender {
         const ntp = device.system?.ntp;
         if (ntp?.servers.length) lines.push("ntp enable", ...ntp.servers.map((server) => `ntp server ${server}`));
 
-        for (const host of device.system?.logging?.remote ?? []) {
+        for (const host of device.monitoring?.syslog ?? []) {
             const level = RaisecomRosRender.LOG_LEVELS[host.level];
             const port = host.port ?? RaisecomRosRender.LOG_DEFAULTS.port;
             let line = `logging host ${host.address}`;
@@ -234,6 +235,14 @@ export class RaisecomRosRender {
         return lines.join("\n") + "\n";
     }
 
+    /** The sources every management service takes. The project has already turned an address set's name here into the set's addresses. */
+    private static managementAllow(device: Device): readonly Prefix[] {
+        const allow = device.management?.allow ?? [];
+        if (typeof allow === "string")
+            throw new Error(`${device.name}: management.allow is still the address set ${allow}, not its addresses`);
+        return allow;
+    }
+
     /** An access-list permitting `sources`, then denying the rest. Its description takes one word. */
     private static accessList(number: number, description: string, sources: readonly Prefix[]): string[] {
         const rules = sources.map(
@@ -245,7 +254,7 @@ export class RaisecomRosRender {
     }
 
     /** Access or trunk membership, for a port or a LAG. */
-    private static switching(settings: Switched<string>, vlanId: (name: string) => number): string[] {
+    private static switching(settings: Switched, vlanId: (name: string) => number): string[] {
         const lines: string[] = [];
         if (settings.access_vlan) lines.push(`switchport access vlan ${vlanId(settings.access_vlan)}`);
 
@@ -271,16 +280,12 @@ export class RaisecomRosRender {
     }
 
     /** A port the config does not declare is shut down. A LAG member holds its membership and description; the LAG holds the rest. */
-    private static physicalPort(
-        settings: AnyPort | undefined,
-        vlanId: (name: string) => number,
-        lagNumbers: Map<string, number>
-    ): string[] {
+    private static physicalPort(settings: Port | undefined, vlanId: (name: string) => number, lagNumbers: Map<string, number>): string[] {
         if (!settings) return ["shutdown"];
 
         const lines: string[] = [];
         if (settings.description) lines.push(`description ${settings.description}`);
-        if (settings.lag) return [...lines, `port-channel ${lagNumbers.get(settings.lag)}`];
+        if (settings.in_lag) return [...lines, `port-channel ${lagNumbers.get(settings.in_lag)}`];
 
         lines.push(...RaisecomRosRender.switching(settings, vlanId));
 
@@ -299,29 +304,28 @@ export class RaisecomRosRender {
         return lines;
     }
 
-    /** The MAC access-list of the port at `index` in the catalog, for its `ethertypes`. MAC access-lists are 3000 and up. */
     /** The BFD session for each next hop a static route watches, numbered from 1 in the order the routes come, with the VLAN its interface is on. A next hop on no VLAN interface's network has none. */
     static bfdSessions(device: Device): Map<string, { id: number; vlan: string }> {
         const sessions = new Map<string, { id: number; vlan: string }>();
 
-        for (const route of device.routing?.static ?? []) {
-            if (!route.bfd || !route.via || sessions.has(route.via)) continue;
+        for (const route of device.routing?.static_routes ?? []) {
+            const nextHop = route.next_hop;
+            if (!route.bfd || !nextHop || sessions.has(nextHop)) continue;
 
-            const holder = Object.values(device.interfaces ?? {}).find(
-                (iface) =>
-                    iface.type === "vlan" &&
-                    (iface.addresses ?? []).some((entry) => {
-                        const address = typeof entry === "string" ? entry : entry.address;
-                        return Address.family(address) === "ipv4" && Address.contains(Address.prefixOf(address), route.via!);
-                    })
+            const holder = Object.values(device.interfaces?.vlan_interface ?? {}).find((iface) =>
+                (iface?.addresses ?? []).some((entry) => {
+                    const address = typeof entry === "string" ? entry : entry.address;
+                    return Address.family(address) === "ipv4" && Address.contains(Address.prefixOf(address), nextHop);
+                })
             );
 
-            if (holder?.type === "vlan") sessions.set(route.via, { id: sessions.size + 1, vlan: holder.vlan });
+            if (holder) sessions.set(nextHop, { id: sessions.size + 1, vlan: holder.vlan });
         }
 
         return sessions;
     }
 
+    /** The MAC access-list of the port at `index` in the catalog, for its `ethertypes`. MAC access-lists are 3000 and up. */
     static ethertypeAcl(index: number): number {
         return 3001 + index;
     }

package/src/platforms/routeros/TRAPS.md

@@ -3,7 +3,7 @@
 Behaviour that looks like something else. Each one has been hit on a real device.
 
 - Every command takes effect as it arrives; there is no candidate configuration. `apply` saves a backup, arms a scheduler that restores it, and restores at once if a command is refused.
-- A `/32` address gives no connected route, so a session over it never opens. Give the far end: `{ address, peer }` renders `network=<peer>`.
+- A `/32` address gives no connected route, so a session over it never opens. Give the far end: `{ address, peer_address }` renders `network=<peer_address>`.
 - `[find address=X/Y]` unquoted matches nothing, silently. Every selector the plan builds is quoted.
 - `~` in `find` has no anchors. Match exactly.
 - A property of the same group is printed as a bare suffix, `output.filter-chain=X .network=Y`, which only reads back inside that command. The parser expands it before building a `set`.
@@ -64,8 +64,8 @@ Behaviour that looks like something else. Each one has been hit on a real device
 - No MAC learning limit on 7.23.5: `/interface bridge port` has `learn` but no limit, and `/interface ethernet switch port` has none (CCR2216). `mac_limit` stays refused.
 - A switch rule matches a kind of frame with `mac-protocol` (`ip`, `ipv6`, `arp` among 23 kinds), but cannot match "not" one. An ethertype filter is a rule that lets each kind through and a last one with an empty `new-dst-ports` for the rest, after the port's ACL rules, which match only `ip` or `ipv6`. Four such rules on a free port took the router to 70 switch rules, none invalid (CCR2216, 7.23.5).
 - A routing table holds no routes the router forwards by unless it has `fib`: `/routing table add fib name=...`. The export prints the flag between the properties, `add comment=... fib name=...`.
-- A BGP connection's `routing-table` is where the session installs what it learns and also where it announces from: an `output.network` prefix is announced only while that table has a route for it, and a route in main alone is not enough. On a CCR2216 on 7.23.5, a fresh session with `routing-table=<table>` installed its routes there, active, with the next hop resolved through main, and announced nothing until the table had the prefix too; then it did. Circuit's validate refuses a session in a table that holds none of `networks`, and warns for each it lacks. Routing filters cannot move a route to a table: `set routing-table` and `set table` are `invalid argument`.
-- A running session takes a new `routing-table` only when it restarts, but its announcements stop at once: set from main to a table, it withdrew everything within seconds, kept its learned routes in main, and announced nothing even once the table had the prefix; set back to main, it still announced nothing until it restarted. `/routing bgp session resend afi=ipv6` did not help either, on the router where this was found (#157). Disabling and enabling the connection restarted it in the new table. The plan does exactly that, written on the plan's line, and after an apply Circuit checks that every session still announces what it announced of `networks` before (CCR2216, 7.23.5).
+- A BGP connection's `routing-table` is where the session installs what it learns and also where it announces from: an `output.network` prefix is announced only while that table has a route for it, and a route in main alone is not enough. On a CCR2216 on 7.23.5, a fresh session with `routing-table=<table>` installed its routes there, active, with the next hop resolved through main, and announced nothing until the table had the prefix too; then it did. Circuit's validate refuses a session in a table that holds none of `originated_prefixes`, and warns for each it lacks. Routing filters cannot move a route to a table: `set routing-table` and `set table` are `invalid argument`.
+- A running session takes a new `routing-table` only when it restarts, but its announcements stop at once: set from main to a table, it withdrew everything within seconds, kept its learned routes in main, and announced nothing even once the table had the prefix; set back to main, it still announced nothing until it restarted. `/routing bgp session resend afi=ipv6` did not help either, on the router where this was found (#157). Disabling and enabling the connection restarted it in the new table. The plan does exactly that, written on the plan's line, and after an apply Circuit checks that every session still announces what it announced of `originated_prefixes` before (CCR2216, 7.23.5).
 - A passive connection without `local.address` listens only on its default local address, `local.default-address`, which may be a public one: a peer connecting to another address of the router gets a TCP reset (CCR2216, 7.23.5).
 - `/routing rule` is an ordered list without names, like a filter chain, and the plan rewrites it whole in the config's order. `lookup-only-in-table` drops a packet its table has no route for (a ping printed `no route`); `lookup` routes it by main instead (the ping left). An interface to match is `interface=`. A `drop` or `unreachable` rule is printed with `!realm`, which Circuit does not write (CCR2216, 7.23.5).
 - An eBGP connection to an address on no connected network, without `multihop=yes`, takes the TCP connection, logs `connection <local> from <remote>`, and closes it with no OPEN and nothing else in the log, even with `bgp,debug` logging on (CCR2216, 7.23.5).