@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/src/core/schema-docs.ts

@@ -1,174 +0,0 @@
-// The schema's own comments, read as data: each type, what it is, and each field with its type and description. The schema reference page and Studio both show them.
-
-export type Field = { path: string; type: string; description: string };
-export type TypeDoc = { name: string; description: string; definition?: string; includes?: string[]; fields: Field[] };
-
-export class SchemaDocs {
-    /** The schema files in reading order, with the title each gets. */
-    static readonly FILES = [
-        ["device.ts", "Device"],
-        ["interfaces.ts", "Ports and interfaces"],
-        ["routing.ts", "Routing"],
-        ["policy.ts", "Route policies"],
-        ["firewall.ts", "Firewall and ACLs"],
-        ["system.ts", "System and management"],
-        ["common.ts", "Common values"],
-    ] as const;
-
-    /** The text of a JSDoc comment, without its markers, as one paragraph. */
-    private static commentText(lines: string[]): string {
-        return lines
-            .map((line) => line.replace(/^\s*\/\*\*\s?|\s*\*\/\s*$|^\s*\*\s?/g, "").trim())
-            .filter(Boolean)
-            .join(" ");
-    }
-
-    /** What a type parameter stands for, where it is not one of the device's names. */
-    private static readonly PARAMETER_MEANING: Record<string, string> = { Pl: "platform", M: "model" };
-
-    /** A type as a reader needs it: "name" for each of the device's names, and no parameter list on the schema's own types. */
-    private static withoutGenerics(type: string, generics: Set<string>): string {
-        let result = type;
-        while (/NoInfer<([^<>]*)>/.test(result)) {
-            result = result.replace(/NoInfer<([^<>]*)>/g, (_, inner: string) => (inner.includes("|") ? `(${inner})` : inner));
-        }
-
-        for (const name of generics) {
-            result = result.replace(new RegExp(`\\b${name}<[^<>]*(?:<[^<>]*>[^<>]*)*>`, "g"), name);
-        }
-
-        return (
-            result
-                // A quoted value, such as the "M" of a rate, is left as it is.
-                .replace(/"[^"]*"|\b(Pl|M|N|V|I|P|S|G|A|AS|U|F|C|L|K)\b/g, (found, parameter?: string) =>
-                    parameter ? (SchemaDocs.PARAMETER_MEANING[parameter] ?? "name") : found
-                )
-                .replace(/\bname(?: \| name)+\b/g, "name")
-                .replace(/\(name\)/g, "name")
-        );
-    }
-
-    private static parse(source: string, generics: Set<string>): TypeDoc[] {
-        const lines = source.split("\n");
-        const types: TypeDoc[] = [];
-
-        let comment: string[] = [];
-        let inComment = false;
-        let current: TypeDoc | undefined;
-        let depth = 0;
-        const parents: string[] = [];
-        let header: string | undefined;
-
-        /** Reads a whole declaration: a type it aliases, the types whose fields it also has, and whether a body opens. */
-        function finishHeader(): void {
-            const text = header!;
-            header = undefined;
-
-            // The part after `=`, with the generic parameter list before it left out.
-            const body = text.slice(text.indexOf("> =") >= 0 ? text.indexOf("> =") + 3 : text.indexOf("=") + 1).trim();
-
-            // A template literal type, such as `${number}:${number}`, holds braces but opens no body.
-            if (!body.includes("{") || body.startsWith("`")) {
-                current!.definition = body.replace(/;$/, "").replace(/^\|\s*/, "");
-            } else {
-                const before = body.slice(0, body.indexOf("{"));
-                const included = before
-                    .split("&")
-                    .map((part) => part.trim())
-                    .filter((part) => /^\w/.test(part));
-                if (included.length) current!.includes = included;
-            }
-
-            depth = (text.match(/{/g) ?? []).length - (text.match(/}/g) ?? []).length;
-        }
-
-        for (const line of lines) {
-            const trimmed = line.trim();
-
-            if (trimmed.startsWith("/**")) {
-                comment = [trimmed];
-                inComment = !trimmed.endsWith("*/");
-                continue;
-            }
-
-            if (inComment) {
-                comment.push(trimmed);
-                if (trimmed.endsWith("*/")) inComment = false;
-                continue;
-            }
-
-            // A declaration can span lines before its body opens or it ends.
-            if (header !== undefined) {
-                header += ` ${trimmed}`;
-                if (trimmed.endsWith("{") || trimmed.endsWith(";")) finishHeader();
-                continue;
-            }
-
-            // A type the schema does not export is documented too, since exported types take its fields.
-            const declaration = /^(?:export )?type (\w+)(<)?/.exec(trimmed);
-            if (declaration && depth === 0) {
-                if (declaration[2]) generics.add(declaration[1]!);
-
-                current = { name: declaration[1]!, description: SchemaDocs.commentText(comment), fields: [] };
-                types.push(current);
-                comment = [];
-
-                header = trimmed;
-                if (trimmed.endsWith("{") || trimmed.endsWith(";")) finishHeader();
-                continue;
-            }
-
-            if (!current) continue;
-
-            const field = /^(?:readonly\s+)?("?[\w-]+"?)(\?)?:\s*(.*)$/.exec(trimmed);
-            if (field && depth >= 1) {
-                const [, name, optional, rest] = field;
-                const path = [...parents, name!.replace(/"/g, "")].join(".");
-                const opensObject = rest!.trim().endsWith("{");
-                const type = opensObject ? "object" : rest!.replace(/;$/, "").trim();
-
-                current.fields.push({ path: `${path}${optional ? "?" : ""}`, type, description: SchemaDocs.commentText(comment) });
-                comment = [];
-
-                if (opensObject) {
-                    parents.push(name!.replace(/"/g, ""));
-                    depth++;
-                }
-                continue;
-            }
-
-            const opens = (trimmed.match(/{/g) ?? []).length;
-            const closes = (trimmed.match(/}/g) ?? []).length;
-
-            for (let index = 0; index < closes - opens; index++) {
-                if (parents.length >= depth - 1 && parents.length > 0) parents.pop();
-            }
-
-            depth += opens - closes;
-            if (depth <= 0) {
-                depth = 0;
-                parents.length = 0;
-            }
-
-            comment = [];
-        }
-
-        return types;
-    }
-
-    /** Every type in each schema file, in the order given. Every file is read first, so a type is known to take parameters wherever it is used. */
-    static read(sources: readonly string[]): TypeDoc[][] {
-        const generics = new Set<string>();
-        const parsed = sources.map((source) => SchemaDocs.parse(source, generics));
-
-        for (const types of parsed) {
-            for (const type of types) {
-                if (type.definition) type.definition = SchemaDocs.withoutGenerics(type.definition, generics);
-                if (type.includes) type.includes = type.includes.map((name) => SchemaDocs.withoutGenerics(name, generics));
-                for (const field of type.fields) field.type = SchemaDocs.withoutGenerics(field.type, generics);
-            }
-        }
-
-        return parsed;
-    }
-}

package/src/core/validator.ts

@@ -1,508 +0,0 @@
-// Rules every network has to satisfy, whatever its design. Types catch most of this at compile time; these run again at load, because config is data and may not come from TypeScript.
-
-import { X509Certificate } from "node:crypto";
-import { Utils } from "./utils";
-import { Platforms } from "../platforms";
-import { Catalog } from "../platforms/catalog";
-import type { Device, Switched } from "../schema";
-import { Address } from "./address";
-import { CrossChecks } from "./cross-checks";
-import type { Finding, Network } from "./define";
-
-type Report = (message: string) => void;
-
-/** Names a device declares, and helpers to report a reference to one it does not. */
-class Names {
-    readonly ports: string[];
-
-    constructor(
-        readonly device: Device,
-        private readonly report: Report
-    ) {
-        let ports: string[] = [];
-
-        try {
-            ports = Catalog.ports(device.platform, device.model);
-        } catch (error) {
-            report((error as Error).message);
-        }
-
-        this.ports = ports;
-    }
-
-    isInterface(name: string): boolean {
-        return name in (this.device.interfaces ?? {}) || this.ports.includes(name);
-    }
-
-    /** Report `name` when it is set and not declared. */
-    expect(what: string, name: string | undefined, declared: boolean): void {
-        if (name !== undefined && !declared) this.report(`${what} '${name}' is not declared`);
-    }
-
-    expectInterface(what: string, name: string | undefined): void {
-        this.expect(what, name, name !== undefined && this.isInterface(name));
-    }
-}
-
-type Checker = (where: string, value: string) => void;
-
-export class Validator {
-    static run(network: Network): Finding[] {
-        const findings: Finding[] = [];
-
-        const seen = new Set<string>();
-
-        for (const device of network.devices) {
-            if (seen.has(device.name)) findings.push({ level: "error", device: device.name, message: "declared twice" });
-            seen.add(device.name);
-        }
-
-        for (const device of network.devices) {
-            const report: Report = (message) => findings.push({ level: "error", device: device.name, message });
-            Validator.checkDevice(device, report);
-            findings.push(...Validator.checkLimits(device));
-
-            const adapter = Platforms.find(device.platform);
-            if (!adapter) report(`no adapter for platform ${device.platform}`);
-            else {
-                for (const field of adapter.unsupported(device)) report(`${device.platform} cannot express ${field}`);
-                findings.push(...(adapter.checks?.(device) ?? []));
-            }
-        }
-
-        findings.push(...CrossChecks.run(network.devices));
-        for (const check of network.checks ?? []) findings.push(...check(network.devices));
-        return findings;
-    }
-
-    private static checkDevice(device: Device, report: Report): void {
-        const names = new Names(device, report);
-        const cidr: Checker = (where, value) => {
-            if (!Address.isCidr(value)) report(`${where}: '${value}' is not an address with a length`);
-        };
-        const ip: Checker = (where, value) => {
-            if (!Address.isValid(value)) report(`${where}: '${value}' is not an address`);
-        };
-
-        if (!device.users?.[device.connection.user]) report(`connection user '${device.connection.user}' is not one of its users`);
-        if (!device.connection.host && !device.connection.console)
-            report("connection has neither a host nor a console to reach the device through");
-
-        Validator.checkVlans(device, report);
-        Validator.checkAddresses(device, report, cidr, ip);
-        Validator.checkPorts(device, names, report);
-        Validator.checkInterfaces(device, names, report, ip);
-        Validator.checkRouting(device, names, report, cidr, ip);
-        Validator.checkPolicies(device, names, report, cidr);
-        Validator.checkFirewall(device, names, cidr);
-        Validator.checkServices(device, names, report, cidr);
-        Validator.checkCertificates(device, names, report);
-        Validator.checkVdoms(device, names, report, cidr, ip);
-    }
-
-    /** A management VDOM: FortiOS only, not `root`, with declared interfaces, and routes that leave through its own. */
-    private static checkVdoms(device: Device, names: Names, report: Report, cidr: Checker, ip: Checker): void {
-        const management = device.vdoms?.management;
-        if (!management) return;
-
-        if (device.platform !== "fortios") report("vdoms are a FortiOS setting");
-        if (management.name === "root") report("vdoms.management.name is root, the VDOM everything else is in; give it a name of its own");
-
-        for (const name of management.interfaces) {
-            names.expectInterface("vdoms.management interface", name);
-            const port = device.ports?.[name as keyof typeof device.ports];
-            if (port?.lag) report(`vdoms.management interface ${name} is in LAG ${port.lag}; list the LAG`);
-        }
-
-        for (const route of management.static ?? []) {
-            const where = `vdoms.management static route ${route.prefix}`;
-            cidr(where, route.prefix);
-            if (route.via) ip(where, route.via);
-            if (!route.via && !route.interface && !route.blackhole) report(`${where} has no next hop`);
-            if (route.interface && !management.interfaces.includes(route.interface))
-                report(`${where} leaves through ${route.interface}, which is not in the VDOM`);
-        }
-    }
-
-    /** What the model's hardware holds, from the catalog. A LAG with too many members is an error; too many switch rules is a warning, since the limit is only roughly known. */
-    private static checkLimits(device: Device): Finding[] {
-        const limits = Catalog.limits(device.platform, device.model);
-        const findings: Finding[] = [];
-        const report = (level: Finding["level"], message: string) => findings.push({ level, device: device.name, message });
-
-        if (limits.lag_members !== undefined) {
-            for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-                if (iface.type !== "lag") continue;
-
-                const members = Object.values(device.ports ?? {}).filter((port) => port?.lag === name).length;
-                if (members > limits.lag_members) {
-                    report("error", `LAG ${name} has ${members} members; ${device.model} holds at most ${limits.lag_members}`);
-                }
-            }
-        }
-
-        if (limits.switch_rules === undefined && limits.switch_port_ranges === undefined) return findings;
-
-        const rules = Platforms.find(device.platform)?.switchRules?.(device);
-        if (!rules) return findings;
-
-        const after = "A rule it cannot hold is invalid, and so is every rule after it";
-
-        if (limits.switch_rules !== undefined && rules.count > limits.switch_rules) {
-            report("warning", `ACLs make ${rules.count} switch rules; a ${device.model} held about ${limits.switch_rules}. ${after}`);
-        }
-
-        if (limits.switch_port_ranges !== undefined && rules.ranges > limits.switch_port_ranges) {
-            report(
-                "warning",
-                `ACLs use ${rules.ranges} distinct port ranges; a ${device.model} held ${limits.switch_port_ranges}. ${after}`
-            );
-        }
-
-        return findings;
-    }
-
-    private static checkVlans(device: Device, report: Report): void {
-        const ids = new Map<number, string>();
-
-        for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
-            if (!Number.isInteger(vlan.id) || vlan.id < 1 || vlan.id > 4094) report(`VLAN ${name} id ${vlan.id} is outside 1-4094`);
-            if (ids.has(vlan.id)) report(`VLANs ${ids.get(vlan.id)} and ${name} share id ${vlan.id}`);
-            ids.set(vlan.id, name);
-        }
-    }
-
-    /** Every address is valid, and no address sits on two interfaces of one routing table. Two VRFs may hold the same address. */
-    private static checkAddresses(device: Device, report: Report, cidr: Checker, ip: Checker): void {
-        const holderOf = new Map<string, string>();
-        const holders = [
-            ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
-            ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({ where: `interface ${name}`, settings })),
-        ];
-
-        for (const { where, settings } of holders) {
-            for (const entry of settings?.addresses ?? []) {
-                const address = typeof entry === "string" ? entry : entry.address;
-                cidr(where, address);
-                if (typeof entry !== "string") ip(where, entry.peer);
-
-                const bare = address.split("/")[0]!;
-                const key = `${settings?.vrf ?? ""} ${bare}`;
-                if (holderOf.has(key)) report(`${bare} is on both ${holderOf.get(key)} and ${where}`);
-                holderOf.set(key, where);
-            }
-
-            for (const group of settings?.vrrp ?? []) {
-                ip(`${where} VRRP ${group.id}`, group.address);
-                if (group.id < 1 || group.id > 255) report(`${where} VRRP id ${group.id} is outside 1-255`);
-            }
-        }
-    }
-
-    private static checkPorts(device: Device, names: Names, report: Report): void {
-        const vlans = device.vlans ?? {};
-
-        for (const [name, port] of Object.entries(device.ports ?? {})) {
-            if (!port) continue;
-
-            const switched = Boolean(port.access_vlan || port.trunk_vlans);
-
-            if (!names.ports.includes(name)) report(`port ${name} does not exist on ${device.model}`);
-            if (port.access_vlan && port.trunk_vlans) report(`port ${name} is both access and trunk`);
-            if (port.native_vlan && !port.trunk_vlans) report(`port ${name} has a native VLAN but is not a trunk`);
-            if (switched && port.addresses?.length) report(`port ${name} is switched and routed at once`);
-
-            if (port.lag && (switched || port.addresses)) {
-                report(`port ${name} is in a LAG and states its own switching or addresses; the LAG holds them`);
-            }
-
-            for (const vlan of [port.access_vlan, port.native_vlan, ...(port.trunk_vlans ?? [])]) {
-                names.expect(`port ${name} VLAN`, vlan, vlan === undefined || vlan in vlans);
-            }
-
-            names.expect(`port ${name} ACL`, port.acl, port.acl !== undefined && port.acl in (device.acls ?? {}));
-            names.expect(`port ${name} LAG`, port.lag, port.lag !== undefined && device.interfaces?.[port.lag]?.type === "lag");
-            names.expect(`port ${name} VRF`, port.vrf, port.vrf !== undefined && port.vrf in (device.vrfs ?? {}));
-            Validator.checkFrames(`port ${name}`, port, report);
-        }
-    }
-
-    /** A MAC limit is a whole number above 0, and an ethertype filter lets at least one kind in, each once. */
-    private static checkFrames(where: string, settings: Switched<string>, report: Report): void {
-        const limit = settings.mac_limit;
-        if (limit !== undefined && !(Number.isInteger(limit) && limit >= 1))
-            report(`${where} mac_limit ${limit} is not a whole number above 0`);
-
-        const kinds = settings.ethertypes;
-        if (kinds && !kinds.length) report(`${where} ethertypes is empty, so it would drop every frame`);
-        if (kinds && new Set(kinds).size !== kinds.length) report(`${where} ethertypes names a kind twice`);
-    }
-
-    private static checkInterfaces(device: Device, names: Names, report: Report, ip: Checker): void {
-        const vlans = device.vlans ?? {};
-
-        for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-            if (names.ports.includes(name)) report(`interface ${name} has the name of a port`);
-            names.expect(`interface ${name} VRF`, iface.vrf, iface.vrf !== undefined && iface.vrf in (device.vrfs ?? {}));
-
-            if (iface.type === "vlan") names.expect(`interface ${name} VLAN`, iface.vlan, iface.vlan in vlans);
-            if (iface.type === "gre" || iface.type === "vxlan") {
-                ip(`interface ${name}`, iface.local);
-                ip(`interface ${name}`, iface.remote);
-            }
-
-            if (iface.type === "lag") {
-                Validator.checkFrames(`LAG ${name}`, iface, report);
-
-                const members = Object.values(device.ports ?? {}).filter((port) => port?.lag === name);
-                if (!members.length) report(`LAG ${name} has no member ports`);
-            }
-
-            if (iface.type === "bridge") {
-                if (iface.members.length < 2) report(`bridge ${name} joins fewer than two interfaces`);
-
-                for (const member of iface.members) {
-                    const joined = device.interfaces?.[member];
-                    if (joined?.type !== "vlan") report(`bridge ${name}: member ${member} is not a VLAN interface`);
-                    else if (joined.addresses?.length) report(`bridge ${name}: member ${member} has an address of its own`);
-
-                    const others = Object.entries(device.interfaces ?? {}).filter(
-                        ([other, settings]) => other !== name && settings.type === "bridge" && settings.members.includes(member)
-                    );
-                    if (others.length) report(`bridge ${name}: member ${member} is also in bridge ${others[0]![0]}`);
-                }
-            }
-
-            if (iface.type === "wireguard") {
-                for (const peer of iface.peers ?? []) {
-                    for (const address of peer.allowed_addresses) {
-                        if (!Address.isCidr(address))
-                            report(`interface ${name} peer ${peer.name}: '${address}' is not an address with a length`);
-                    }
-                }
-            }
-        }
-    }
-
-    private static checkRouting(device: Device, names: Names, report: Report, cidr: Checker, ip: Checker): void {
-        const routing = device.routing;
-        const policies = device.policies ?? {};
-
-        for (const route of routing?.static ?? []) {
-            cidr("static route", route.prefix);
-            if (!route.via && !route.interface && !route.blackhole) report(`static route ${route.prefix} has no next hop`);
-            if (route.via) ip(`static route ${route.prefix}`, route.via);
-            if (route.bfd && !route.via) report(`static route ${route.prefix} has bfd without via, the address BFD watches`);
-            names.expectInterface(`static route ${route.prefix} interface`, route.interface);
-            names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
-            names.expect(
-                `static route ${route.prefix} table`,
-                route.table,
-                route.table !== undefined && (route.table === "main" || route.table in (routing?.tables ?? {}))
-            );
-            if (route.vrf && Utils.otherTable(route.table))
-                report(`static route ${route.prefix} has both vrf and table; a route is in one of them`);
-        }
-
-        Validator.checkTables(device, names, report, cidr);
-
-        const bgp = routing?.bgp;
-        const isPolicy = (policy: string | undefined) => policy !== undefined && policy in policies;
-
-        for (const prefix of bgp?.networks ?? []) cidr("BGP network", prefix);
-
-        const isTable = (table: string | undefined) => table !== undefined && (table === "main" || table in (routing?.tables ?? {}));
-
-        for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
-            for (const policy of [group.import, group.export]) {
-                names.expect(`BGP group ${name} policy`, policy, isPolicy(policy));
-            }
-
-            names.expect(`BGP group ${name} table`, group.table, isTable(group.table));
-        }
-
-        for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-            ip(`neighbor ${name}`, neighbor.address);
-
-            const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-            names.expect(`neighbor ${name} group`, neighbor.group, group !== undefined);
-
-            if (!(neighbor.remote_as ?? group?.remote_as)) report(`neighbor ${name} has no remote_as`);
-
-            for (const policy of [neighbor.import, neighbor.export]) {
-                names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
-            }
-
-            names.expect(`neighbor ${name} table`, neighbor.table, isTable(neighbor.table));
-
-            const local = neighbor.local_address ?? group?.local_address;
-            if (local && Address.family(local) !== Address.family(neighbor.address))
-                report(`neighbor ${name} local_address and address differ in family`);
-        }
-
-        for (const [areaId, area] of Object.entries(routing?.ospf?.areas ?? {})) {
-            if (!/^\d+\.\d+\.\d+\.\d+$/.test(areaId)) report(`OSPF area '${areaId}' is not written as a dotted area ID`);
-            for (const iface of Object.keys(area.interfaces)) names.expectInterface(`OSPF area ${areaId} interface`, iface);
-        }
-    }
-
-    /** Routing tables have names of their own and something installing routes in them, and rules name a table and can each be reached. */
-    private static checkTables(device: Device, names: Names, report: Report, cidr: Checker): void {
-        const routing = device.routing;
-        const tables = routing?.tables ?? {};
-        const bgp = routing?.bgp;
-
-        const installed = new Set<string>();
-        for (const route of routing?.static ?? []) {
-            const table = Utils.otherTable(route.table);
-            if (table) installed.add(table);
-        }
-        for (const neighbor of Object.values(bgp?.neighbors ?? {})) {
-            const table = Utils.otherTable(neighbor.table ?? (neighbor.group ? bgp?.groups?.[neighbor.group]?.table : undefined));
-            if (table) installed.add(table);
-        }
-
-        for (const name of Object.keys(tables)) {
-            if (name === "main") report("routing.tables has main, the main table every device has; give the table another name");
-            if (name in (device.vrfs ?? {})) report(`routing.tables ${name} has the name of a VRF; give the table another name`);
-            if (name !== "main" && !installed.has(name))
-                report(
-                    `routing.tables ${name}: nothing installs routes in it; give a static route or a BGP neighbor table: "${name}", or remove the table`
-                );
-        }
-
-        const rules = routing?.rules ?? [];
-        rules.forEach((rule, index) => {
-            const where = `routing.rules ${index + 1}${rule.description ? ` (${rule.description})` : ""}`;
-            const match = rule.match ?? {};
-
-            names.expect(`${where} table`, rule.table, rule.table === "main" || rule.table in tables);
-            names.expectInterface(`${where} in_interface`, match.in_interface);
-            if (match.src) cidr(where, match.src);
-            if (match.dst) cidr(where, match.dst);
-
-            if (match.src && match.dst && Address.isCidr(match.src) && Address.isCidr(match.dst)) {
-                if (Address.family(Address.host(match.src)) !== Address.family(Address.host(match.dst)))
-                    report(`${where}: src and dst differ in family, so no packet matches both`);
-            }
-
-            if (rule.table === "main" && rule.fallback)
-                report(`${where} looks up main and has fallback; fallback is for another table, so remove it`);
-
-            const matchesAll = !match.src && !match.dst && !match.in_interface;
-            if (matchesAll && index < rules.length - 1)
-                report(`${where} matches every packet, so the rules after it never run; give it a match, or move it last`);
-        });
-    }
-
-    private static checkPolicies(device: Device, names: Names, report: Report, cidr: Checker): void {
-        const policies = device.policies ?? {};
-        const sets = device.prefix_sets ?? {};
-
-        for (const [name, rules] of Object.entries(policies)) {
-            rules.forEach((rule, index) => {
-                // A device runs a call for every route, so a match beside it would read as a condition it isn't.
-                const beside = (["match", "set", "action"] as const).filter((key) => rule.call !== undefined && rule[key] !== undefined);
-                if (beside.length) {
-                    report(
-                        `policy ${name} rule ${index + 1} has call and ${beside.join(", ")}: a call is a rule of its own, run for every route. Put ${beside.join(", ")} in the next rule, or the match inside ${rule.call}`
-                    );
-                }
-
-                names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies);
-                const set = rule.match?.prefix_set;
-                names.expect(`policy ${name} prefix set`, set, set !== undefined && set in sets);
-                if (rule.match?.prefix) cidr(`policy ${name}`, rule.match.prefix);
-            });
-        }
-
-        // A policy that calls itself, directly or not, never finishes.
-        const visit = (policy: string, path: string[]): void => {
-            if (path.includes(policy)) return report(`policy ${[...path, policy].join(" -> ")} calls itself`);
-
-            for (const rule of policies[policy] ?? []) if (rule.call) visit(rule.call, [...path, policy]);
-        };
-        for (const policy of Object.keys(policies)) visit(policy, []);
-    }
-
-    private static checkFirewall(device: Device, names: Names, cidr: Checker): void {
-        const firewall = device.firewall;
-        const sets = firewall?.address_sets ?? {};
-
-        for (const [name, members] of Object.entries(sets)) {
-            for (const member of members) {
-                if (!Address.isValid(member)) cidr(`address set ${name}`, member);
-            }
-        }
-
-        const filterChains = [firewall?.filter?.input, firewall?.filter?.forward, firewall?.filter?.output];
-        const filterRules = filterChains.flatMap((chain) => chain?.rules ?? []);
-        const natRules = [...(firewall?.nat?.source ?? []), ...(firewall?.nat?.destination ?? [])];
-
-        for (const rule of [...filterRules, ...natRules]) {
-            const match = rule.match;
-            if (!match) continue;
-
-            for (const set of [match.src_set, match.dst_set]) {
-                names.expect("address set", set, set !== undefined && set in sets);
-            }
-
-            for (const iface of [match.in_interface, match.out_interface]) names.expectInterface("interface", iface);
-
-            for (const address of [match.src, match.dst]) {
-                if (address) cidr("firewall rule", address);
-            }
-        }
-    }
-
-    private static checkServices(device: Device, names: Names, report: Report, cidr: Checker): void {
-        for (const [name, server] of Object.entries(device.dhcp ?? {})) {
-            names.expectInterface(`DHCP ${name} interface`, server.interface);
-            cidr(`DHCP ${name}`, server.network);
-            if (!Address.isCidr(server.network)) continue;
-
-            const reserved = (server.reservations ?? []).map((reservation) => reservation.address);
-            const addresses = [server.gateway, ...server.pool, ...reserved];
-
-            for (const address of addresses) {
-                if (!Address.contains(server.network, address)) report(`DHCP ${name}: ${address} is outside ${server.network}`);
-            }
-        }
-
-        for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
-            names.expectInterface(`DHCP relay ${name} interface`, relay.interface);
-        }
-
-        for (const iface of device.flow_export?.interfaces ?? []) names.expectInterface("flow export interface", iface);
-
-        const lldp = device.lldp;
-        if (lldp && lldp !== true) for (const iface of lldp.interfaces) names.expectInterface("LLDP interface", iface);
-
-        const management = device.management;
-        for (const iface of management?.native?.interfaces ?? []) names.expectInterface("native management interface", iface);
-        for (const prefix of management?.allow ?? []) cidr("management allow", prefix);
-        if (management?.snmp && !management.snmp.community && !management.snmp.users)
-            report("SNMP is on with neither a community nor a user");
-    }
-
-    private static checkCertificates(device: Device, names: Names, report: Report): void {
-        const certificates = device.certificates ?? {};
-
-        for (const [name, certificate] of Object.entries(certificates)) {
-            try {
-                new X509Certificate(certificate.certificate);
-            } catch {
-                report(`certificate ${name} is not a PEM certificate`);
-            }
-        }
-
-        for (const service of ["https", "api_tls"] as const) {
-            const name = device.management?.[service]?.certificate;
-            names.expect(`${service} certificate`, name, name !== undefined && name in certificates);
-
-            if (name && certificates[name] && !certificates[name].private_key) {
-                report(`${service} certificate ${name} has no private key to serve with`);
-            }
-        }
-    }
-}