confgraph 0.3.7__tar.gz → 0.3.8__tar.gz

{confgraph-0.3.7 → confgraph-0.3.8}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: confgraph
-Version: 0.3.7
+Version: 0.3.8
 Summary: Local-first network config dependency mapper — parse, visualize, and lint vendor configs
 Project-URL: Homepage, https://github.com/verigraphs/confgraph
 Project-URL: Repository, https://github.com/verigraphs/confgraph

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/models/interface.py

@@ -2,8 +2,9 @@
 
 from enum import Enum
 from ipaddress import IPv4Address, IPv4Interface, IPv6Interface
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from confgraph.models.base import BaseConfigObject
+from confgraph.utils.ospf import canonical_area_id
 
 
 class InterfaceType(str, Enum):
@@ -355,7 +356,11 @@ class InterfaceConfig(BaseConfigObject):
     )
     ospf_area: str | None = Field(
         default=None,
-        description="OSPF area ID",
+        description=(
+            "OSPF area ID, CANONICALIZED to the decimal spelling (CCR-0227) "
+            "so a '0.0.0.0' interface and a '0' interface are in the same "
+            "area here, as they are on hardware."
+        ),
     )
     ospf_cost: int | None = Field(
         default=None,
@@ -377,9 +382,22 @@ class InterfaceConfig(BaseConfigObject):
         default=None,
         description="OSPF network type ('point-to-point', 'broadcast', etc.)",
     )
-    ospf_passive: bool = Field(
-        default=False,
-        description="OSPF passive interface",
+    ospf_passive: bool | None = Field(
+        default=None,
+        description=(
+            "OSPF passive interface. TRI-STATE (CCR-0222, the CCR-0165 "
+            "``activate`` precedent): True = this interface is passive "
+            "(an interface-level ``ip ospf passive-interface``, or the "
+            "process-level passive config back-filled by the M3 walk); "
+            "False = EXPLICITLY non-passive (``no ip ospf passive-interface`` "
+            "— the per-interface override of a process-level "
+            "``passive-interface default``); None = NOT STATED on the "
+            "interface, so the consumer falls back to the process-level "
+            "passive config. A bool default of False could not express the "
+            "override at all: the M3 back-fill clobbered it, a field-level "
+            "merge could never overlay it (the CCR-0211 disease), and no "
+            "Change-IR SET op was emitted for it."
+        ),
     )
     ospf_authentication: str | None = Field(
         default=None,
@@ -646,6 +664,11 @@ class InterfaceConfig(BaseConfigObject):
             or self.dynamic_address
         )
 
+    # CCR-0227: area-ID storage point 4 of 4.
+    _canonical_area = field_validator("ospf_area", mode="before")(
+        canonical_area_id
+    )
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/models/ospf.py

@@ -2,8 +2,9 @@
 
 from enum import Enum
 from ipaddress import IPv4Address, IPv4Network
-from pydantic import BaseModel, Field
+from pydantic import BaseModel, Field, field_validator
 from confgraph.models.base import BaseConfigObject
+from confgraph.utils.ospf import canonical_area_id
 
 
 class OSPFAreaType(str, Enum):
@@ -159,12 +160,24 @@ class OSPFInterfaceConfig(BaseModel):
         default=None, description="BFD detection multiplier"
     )
 
+    # CCR-0227: area-ID storage point 1 of 4.
+    _canonical_area = field_validator("area_id", mode="before")(
+        canonical_area_id
+    )
+
 
 class OSPFArea(BaseModel):
     """OSPF area configuration."""
 
     area_id: str = Field(
-        ..., description="Area ID (e.g., '0', '0.0.0.1', '10')"
+        ...,
+        description=(
+            "Area ID, CANONICALIZED to the decimal spelling (CCR-0227): the "
+            "NX-OS/JunOS '0.0.0.0' and the IOS/IOS-XR '0' are the same area on "
+            "hardware and are the same key here. Dotted quads convert to their "
+            "32-bit decimal ('0.0.0.51' -> '51'); anything else is stored as "
+            "written."
+        ),
     )
     area_type: OSPFAreaType = Field(
         default=OSPFAreaType.NORMAL, description="Area type"
@@ -220,6 +233,11 @@ class OSPFArea(BaseModel):
         description="Prefix-list name filtering Type-3 LSAs sent out of this area (outbound from area)",
     )
 
+    # CCR-0227: area-ID storage point 2 of 4.
+    _canonical_area = field_validator("area_id", mode="before")(
+        canonical_area_id
+    )
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True
@@ -326,7 +344,11 @@ class OSPFConfig(BaseConfigObject):
     )
     network_statements: list[tuple[IPv4Network, str]] = Field(
         default_factory=list,
-        description="Network statements (network, wildcard, area) - IOS style",
+        description=(
+            "Network statements (network, area) - IOS style. The area half is "
+            "canonicalized exactly like every other area-ID storage point "
+            "(CCR-0227)."
+        ),
     )
     shutdown: bool = Field(
         default=False, description="OSPF process shutdown"
@@ -341,6 +363,14 @@ class OSPFConfig(BaseConfigObject):
         default=False, description="BFD enabled on all OSPF interfaces"
     )
 
+    # CCR-0227: area-ID storage point 3 of 4 — the area half of each
+    # statement. ``mode="after"`` so the tuples are already built; the
+    # network half is untouched.
+    @field_validator("network_statements", mode="after")
+    @classmethod
+    def _canonical_statement_areas(cls, value):
+        return [(net, canonical_area_id(area)) for net, area in value]
+
     class Config:
         """Pydantic model configuration."""
         use_enum_values = True

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/parsers/__init__.py

@@ -108,7 +108,44 @@ from confgraph.parsers.panos_parser import PANOSParser
 # Persisted baseline snapshots are invalidated by the pbv move itself (it is a
 # digest-key component), which subsumes the Tier-A digest shift these fields
 # cause.
-PARSER_BEHAVIOR_VERSION: int = 10
+# 11 (CCR-0222): ``InterfaceConfig.ospf_passive`` becomes tri-state
+# (``bool | None``, default None) and the shared interface walk extracts BOTH
+# polarities of the per-interface ``[no] ip ospf passive-interface`` override
+# (NX-OS/EOS inherit it).  Observable parse output moves three ways: every
+# interface that says nothing now reads None rather than False; an interface
+# exempted from a process-level ``passive-interface default`` reads an explicit
+# False and gains a native SET op for it (False != the new default); and the
+# ``no`` line it was emitting as an UnrecognizedBlock disappears, claimed by
+# that op's line provenance (CCR-0203 ledger).  No ParsedConfig JSON-schema
+# change beyond the field's own type, so pbv is what invalidates the platform
+# parse cache and entrp's digest keys.
+# 12 (CCR-0227): OSPF area IDs are CANONICALIZED at parse to the decimal
+# spelling, by one shared ``canonical_area_id`` applied via model validators on
+# all four storage points (OSPFArea.area_id, OSPFInterfaceConfig.area_id,
+# InterfaceConfig.ospf_area, the area half of OSPFConfig.network_statements).
+# `0.0.0.0` and `0` are the same area on hardware; stored raw they were two
+# keys, so every mixed-vendor estate (NX-OS/JunOS dotted, IOS/IOS-XR decimal)
+# modelled one real area as two — no adjacency across the spellings and wrong
+# ABR/inter-area computation. Observable parse output moves for every config
+# that spells an area as a dotted quad, with NO ParsedConfig JSON-schema
+# change — the sharp case this constant exists for. Decimal is canonical
+# precisely so the existing tombstone/golden keys (`ospf:1:area:0:...`) do not
+# move.
+# 13 (CCR-0227 completion): the two OPS-ONLY area-scoped removals —
+# ``no network A W area <aid>`` (and the EOS ``no network A/M area <aid>``
+# twin) and ``no area <aid> range A M`` — build their LIST_REMOVE key
+# directly in the parser rather than through the tombstone registry, and were
+# left spelling the area as the proposal wrote it while 12 made storage
+# canonical. A dotted withdrawal therefore addressed an area that no longer
+# existed under that spelling and removed NOTHING, silently — including the
+# dotted-baseline/dotted-proposal pair that worked before 12. The removal key
+# and the refresh-suppression map on both sides of each walk are now
+# canonical. Observable parse output moves (those op paths) with no schema
+# change. Bumped rather than riding 12 — unreleased though 12 is, the rule in
+# this module's header is per-commit and not optional for a qualifying
+# change, and deciding otherwise would mean re-deriving "was the predecessor
+# released?" at every review.
+PARSER_BEHAVIOR_VERSION: int = 13
 
 __all__ = [
     "BaseParser",

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/parsers/base.py

@@ -956,16 +956,23 @@ class BaseParser(ABC):
         # (explicitly named in passive_interfaces or non_passive_interfaces,
         # or whose ospf_process_id matches). Never infer passive for L2 ports
         # or interfaces not in any OSPF process — correctness over coverage.
+        #
+        # CCR-0222: every stamp here is guarded on ``ospf_passive is None``.
+        # The field is tri-state, and a non-None value means the INTERFACE
+        # block itself spoke (`[no] ip ospf passive-interface`) — which on
+        # hardware overrides anything the process says. Without the guard
+        # this walk clobbers the explicit False and the override vanishes
+        # again, one layer down.
         if pc.ospf_instances and pc.interfaces:
             intf_by_name = {i.name: i for i in pc.interfaces}
             for ospf in pc.ospf_instances:
                 for name in ospf.passive_interfaces:
                     intf = intf_by_name.get(name)
-                    if intf:
+                    if intf and intf.ospf_passive is None:
                         intf.ospf_passive = True
                 for name in ospf.non_passive_interfaces:
                     intf = intf_by_name.get(name)
-                    if intf:
+                    if intf and intf.ospf_passive is None:
                         intf.ospf_passive = False
                 # For default-passive, only mark interfaces that belong to
                 # this process (ospf_process_id matches or listed in an area)
@@ -975,6 +982,8 @@ class BaseParser(ABC):
                         area_intfs.update(area.interfaces)
                     non_passive_set = set(ospf.non_passive_interfaces)
                     for intf in pc.interfaces:
+                        if intf.ospf_passive is not None:
+                            continue  # the interface block already decided
                         if intf.name in non_passive_set:
                             continue  # already handled above
                         if intf.name in area_intfs or intf.ospf_process_id == ospf.process_id:
@@ -1036,6 +1045,27 @@ class BaseParser(ABC):
         ("bfd_multiplier",     "bfd_multiplier"),
     )
 
+    @staticmethod
+    def _is_model_default(obj, field_name: str, value) -> bool:
+        """True when *value* is still *field_name*'s model-declared default.
+
+        The single "has this field been set?" test for the back-fill walks
+        (CCR-0222). Identity first so the singletons (``None``, ``False``)
+        match exactly; equality only within the same type, so an explicitly
+        parsed ``0`` is never read as a default ``False``.
+        """
+        field_info = type(obj).model_fields.get(field_name)
+        if field_info is None:
+            return value is None
+        default = (
+            field_info.default_factory()
+            if field_info.default_factory is not None
+            else field_info.default
+        )
+        if value is default:
+            return True
+        return type(value) is type(default) and value == default
+
     def _backfill_ospf_interface_settings(self, pc: ParsedConfig) -> None:
         """Carry ``area > interface`` OSPF settings out to ``InterfaceConfig``.
 
@@ -1077,14 +1107,25 @@ class BaseParser(ABC):
                             continue
                         # Never clobber a value the interface block itself set.
                         #
-                        # Compared with `is`, not `in (None, False)`: in Python
-                        # `0 == False`, so a membership test would read an
-                        # explicitly parsed ZERO as "unset" and overwrite it.
-                        # `ip ospf priority 0` is a real, meaningful value — it
-                        # says "never become DR" — and silently promoting it to a
-                        # back-filled 33 would invert the operator's intent.
+                        # "Unset" means "still holds the field's MODEL-DECLARED
+                        # default", read off the model rather than hard-coded as
+                        # None-or-False (CCR-0222): `ospf_passive` is tri-state
+                        # with default None, so a False there is an EXPLICIT
+                        # `no ip ospf passive-interface` and must survive, while
+                        # a False in a default-False field (`ospf_mtu_ignore`)
+                        # is still unset. Behaviour-identical for every other
+                        # row — no default-None field in the table can hold
+                        # False, and no default-False field can hold None.
+                        #
+                        # Compared with `is` before `==`, not `in (None, False)`:
+                        # in Python `0 == False`, so a plain equality test would
+                        # read an explicitly parsed ZERO as "unset" and overwrite
+                        # it. `ip ospf priority 0` is a real, meaningful value —
+                        # it says "never become DR" — and silently promoting it
+                        # to a back-filled 33 would invert the operator's intent.
+                        # The type check keeps `0` distinct from `False`.
                         current = getattr(intf, dst_field, None)
-                        if current is not None and current is not False:
+                        if not self._is_model_default(intf, dst_field, current):
                             continue
                         setattr(intf, dst_field, value)
 

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/parsers/eos_parser.py

@@ -14,6 +14,7 @@ from confgraph.parsers.base import (
 from confgraph.models.base import OSType, UnrecognizedBlock
 from confgraph.models.line import LineType
 from confgraph.models.ospf import OSPFConfig
+from confgraph.utils.ospf import canonical_area_id
 from confgraph.models.bgp import BGPConfig, BGPNeighborAF
 from confgraph.models.prefix_list import PrefixListConfig, PrefixListEntry
 from confgraph.models.static_route import StaticRoute
@@ -306,7 +307,10 @@ class EOSParser(IOSParser):
                     ospf_area_children[0].text,
                 )
                 if am:
-                    intf_cfg.ospf_area = am.group(1)
+                    # CCR-0227: assignment to an already-built model skips
+                    # pydantic validation — canonicalize as the field
+                    # validator would.
+                    intf_cfg.ospf_area = canonical_area_id(am.group(1))
 
             # VARP: "ip virtual-router address <ip>". A device emits ONE LINE
             # PER ADDRESS, so accumulate rather than overwrite
@@ -397,7 +401,10 @@ class EOSParser(IOSParser):
                 m = re.match(r"^\s+network\s+(\S+)\s+area\s+(\S+)\s*$", nc.text)
                 if not m:
                     continue
-                prefix_str, area_id = m.group(1), m.group(2)
+                # CCR-0227: this appends into a LIVE model's list, which runs
+                # no field validator — canonicalize here as the validator on
+                # OSPFConfig.network_statements would.
+                prefix_str, area_id = m.group(1), canonical_area_id(m.group(2))
                 try:
                     net = IPv4Network(prefix_str, strict=False)
                 except ValueError:

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/parsers/ios_parser.py

@@ -10,6 +10,7 @@ from confgraph.utils.interface import normalize_interface_name
 # confgraph imports, so this cannot cycle (the other change_ir names in this file
 # stay lazily imported at their call sites, unchanged).
 from confgraph.change_ir import _native_deletion_path
+from confgraph.utils.ospf import canonical_area_id
 from confgraph.models.base import OSType
 from confgraph.models.vrf import VRFConfig
 from confgraph.models.interface import (
@@ -1266,7 +1267,7 @@ class IOSParser(BaseParser):
             ospf_hello_interval = None
             ospf_dead_interval = None
             ospf_network_type = None
-            ospf_passive = False
+            ospf_passive = None
             ospf_authentication = None
             ospf_authentication_key = None
             ospf_message_digest_keys = {}
@@ -1380,6 +1381,28 @@ class IOSParser(BaseParser):
             if intf_obj.find_child_objects(r"^\s+ip\s+ospf\s+mtu-ignore"):
                 ospf_mtu_ignore = True
 
+            # ip ospf passive-interface / no ip ospf passive-interface
+            #
+            # CCR-0222: BOTH polarities are value-bearing state, so the
+            # negation parses to an explicit False — it is the per-interface
+            # override of a process-level `passive-interface default`, the
+            # NX-OS hardening pattern, and on hardware the interface-level
+            # word is final.  Hence the tri-state field: None means the
+            # interface said nothing and the process-level config decides.
+            # `$`-anchored both ways (disjoint from any operand-bearing
+            # spelling) with last-line-wins, exactly like every sibling
+            # `ip ospf *` scalar above.  This is the SHARED walk — NX-OS and
+            # EOS inherit it through super().parse_interfaces(); the
+            # process-level `passive-interface` spelling is parsed by the
+            # OSPF-process walks and is untouched by this.
+            ospf_passive_children = intf_obj.find_child_objects(
+                r"^\s+(?:no\s+)?ip\s+ospf\s+passive-interface\s*$"
+            )
+            if ospf_passive_children:
+                ospf_passive = not re.match(
+                    r"^\s*no\s+", ospf_passive_children[-1].text
+                )
+
             # Tunnel attributes
             tunnel_source = None
             tunnel_destination = None
@@ -1893,6 +1916,11 @@ class IOSParser(BaseParser):
         "ospf_dead_interval": r"^\s+ip\s+ospf\s+dead-interval\s+",
         "ospf_network_type": r"^\s+ip\s+ospf\s+network\s+",
         "ospf_mtu_ignore": r"^\s+ip\s+ospf\s+mtu-ignore\s*$",
+        # CCR-0222: both polarities — the SET op for an explicit False must
+        # carry the `no ip ospf passive-interface` line, which is also what
+        # claims that negation for the CCR-0203 ledger (consumed, not
+        # disclosed).
+        "ospf_passive": r"^\s+(?:no\s+)?ip\s+ospf\s+passive-interface\s*$",
         "cdp_enabled": r"^\s+(?:no\s+)?cdp\s+enable\s*$",
         "lldp_transmit": r"^\s+(?:no\s+)?lldp\s+transmit\s*$",
         "lldp_receive": r"^\s+(?:no\s+)?lldp\s+receive\s*$",
@@ -4952,6 +4980,18 @@ class IOSParser(BaseParser):
         """
         from confgraph.change_ir import ChangeOp, Verb
 
+        # CCR-0227: areas are STORED canonical, so both sides of this walk must
+        # speak the canonical spelling — the removal key, which the merger
+        # compares against stored ``network_statements``, and the caller's
+        # positive map, whose keys come from its own walk (IOS builds them raw
+        # from the regex, EOS canonical). Normalizing both HERE, where
+        # everything the two spellings must never disagree on already lives,
+        # keeps suppression and removal from splitting on the spelling.
+        positive_net_last_line = {
+            (net, canonical_area_id(area)): line
+            for (net, area), line in positive_net_last_line.items()
+        }
+
         for nnc in ospf_obj.find_child_objects(r"^\s+no\s+network\s+"):
             nnm = re.match(child_pattern, nnc.text)
             if not nnm:
@@ -4960,7 +5000,7 @@ class IOSParser(BaseParser):
             if extracted is None:
                 continue
             rem_net, rem_area = extracted
-            rem_key = (str(rem_net), rem_area)
+            rem_key = (str(rem_net), canonical_area_id(rem_area))
             if positive_net_last_line.get(rem_key, -1) > nnc.linenum:
                 # CCR-0203: suppressed-by-refresh is CONSUMED (understood and
                 # deliberately dropped), not blind — claim it or the fallback
@@ -5186,16 +5226,28 @@ class IOSParser(BaseParser):
             # (area_id, prefix) reappears as a positive range line LATER in
             # the block (refresh → re-add wins → device truth and legacy
             # parity).
+            #
+            # ONE key builder for both walks (CCR-0227): the area half is
+            # canonicalized, because the merger looks the area up by its
+            # STORED id, and the suppression map and the removal must agree
+            # on the spelling or a refresh stops suppressing its own removal.
+            # Returns None on an unparseable mask — dropped on BOTH walks, as
+            # before.
+            def _range_key(m) -> "tuple[str, str] | None":
+                try:
+                    prefix = IPv4Network(f"{m.group(2)}/{m.group(3)}")
+                except ValueError:
+                    return None
+                return canonical_area_id(m.group(1)), str(prefix)
+
             positive_range_last_line: dict[tuple[str, str], int] = {}
             for rc in ospf_obj.find_child_objects(r"^\s+area\s+\S+\s+range\s+"):
                 rm = re.match(r"^\s+area\s+(\S+)\s+range\s+(\S+)\s+(\S+)", rc.text)
                 if not rm:
                     continue
-                try:
-                    rng_pfx = IPv4Network(f"{rm.group(2)}/{rm.group(3)}")
-                except ValueError:
+                rkey = _range_key(rm)
+                if rkey is None:
                     continue
-                rkey = (rm.group(1), str(rng_pfx))
                 positive_range_last_line[rkey] = max(
                     positive_range_last_line.get(rkey, -1), rc.linenum
                 )
@@ -5205,11 +5257,9 @@ class IOSParser(BaseParser):
                 )
                 if not nrm:
                     continue
-                try:
-                    rng_pfx = IPv4Network(f"{nrm.group(2)}/{nrm.group(3)}")
-                except ValueError:
+                rkey = _range_key(nrm)
+                if rkey is None:
                     continue
-                rkey = (nrm.group(1), str(rng_pfx))
                 if positive_range_last_line.get(rkey, -1) > nrc.linenum:
                     self._claim_negation(nrc)  # CCR-0203: suppressed == consumed
                     continue  # re-added later in the block — removal suppressed
@@ -5383,6 +5433,19 @@ class IOSParser(BaseParser):
             def _queue_ospf_negation(verb, path_tail, child):
                 # CCR-0110 Phase E4/E5: queue the native op only; op-primary
                 # parsers no longer persist the deprecated no_commands string.
+                #
+                # CCR-0227: the area segment of an area-scoped path comes from
+                # the proposal TEXT, while the positive member ops key off the
+                # stored (canonical) ``area.area_id`` — so canonicalize it
+                # here, at the one point every OSPF negation op is built. A
+                # `no area 0.0.0.1 stub` must address the same area a
+                # `no area 1 stub` does, because the device does.
+                if len(path_tail) > 1 and path_tail[0] == "area":
+                    path_tail = (
+                        "area",
+                        canonical_area_id(path_tail[1]),
+                        *path_tail[2:],
+                    )
                 self._pending_native_ospf_ops.append(
                     ChangeOp(
                         verb=verb,

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/parsers/nxos_parser.py

@@ -13,6 +13,7 @@ from confgraph.models.bgp import (
     BGPBestpathOptions,
 )
 from confgraph.models.ospf import OSPFConfig
+from confgraph.utils.ospf import canonical_area_id
 from confgraph.models.qos import ControlPlaneConfig
 from confgraph.models.interface import InterfaceFlowMonitor, StormControlLevel, VRRPGroup
 from confgraph.models.netflow import (
@@ -488,7 +489,11 @@ class NXOSParser(IOSParser):
                 )
                 if m:
                     intf_cfg.ospf_process_id = int(m.group(1))
-                    intf_cfg.ospf_area = m.group(2)
+                    # CCR-0227: assignment to an already-built model skips
+                    # pydantic validation, so this post-patch calls the
+                    # canonicalizer the field validator would have — NX-OS is
+                    # the dotted-quad vendor that makes it matter.
+                    intf_cfg.ospf_area = canonical_area_id(m.group(2))
 
             # NX-OS storm-control: "storm-control {broadcast|multicast|unicast}
             # level <threshold>". The threshold is a bandwidth percentage by

{confgraph-0.3.7 → confgraph-0.3.8}/confgraph/tombstones.py

@@ -86,6 +86,19 @@ def _derive_secondary_cidr(ctx: dict) -> "dict[str, Any] | None":
         return None
 
 
+def _derive_area_id(ctx: dict) -> "dict[str, Any] | None":
+    """Canonical OSPF area-ID key for an area-scoped tombstone (CCR-0227).
+
+    Areas are stored canonical (``0.0.0.1`` -> ``1``), and the POSITIVE
+    member ops read the stored value, so a deletion key built from the raw
+    proposal text would address an area that no longer exists under that
+    spelling. One normalizer, the same one the models use.
+    """
+    from confgraph.utils.ospf import canonical_area_id
+
+    return {"area_id": canonical_area_id(ctx["area_id"])}
+
+
 def _derive_line_type(ctx: dict) -> "dict[str, Any] | None":
     """Canonical ``LineType`` value for a line-block tombstone key.
 
@@ -162,6 +175,7 @@ NESTED_DELETION_RULES: list[NestedDeletionRule] = [
         child_pattern=r"^no\s+area\s+(\S+)\s+stub",
         child_groups=["area_id"],
         template="ospf:{pid}:area:{area_id}:stub_reset",
+        derive=_derive_area_id,
     ),
     # OSPF area type reset — 'no area N nssa' / 'no area N nssa no-summary'
     # Proposal: ``no area 2 nssa`` inside ``router ospf 1``
@@ -173,6 +187,7 @@ NESTED_DELETION_RULES: list[NestedDeletionRule] = [
         child_pattern=r"^no\s+area\s+(\S+)\s+nssa",
         child_groups=["area_id"],
         template="ospf:{pid}:area:{area_id}:nssa_reset",
+        derive=_derive_area_id,
     ),
     # VRF route-target removals (CCR confgraph_vrf_rt_removal_tombstones.md).
     # The WI-4 merge made route_target_* lists ADDITIVE (device-faithful), so

confgraph-0.3.8/confgraph/utils/ospf.py

@@ -0,0 +1,43 @@
+"""OSPF value normalization shared by the models and every consumer.
+
+CCR-0227: an OSPF area ID is a 32-bit number that vendors print two ways.
+NX-OS and JunOS spell the backbone ``0.0.0.0``; IOS and IOS-XR spell it ``0``.
+On hardware they are the same area and the adjacency forms. Stored as raw
+strings they are two different keys, so the model partitions one real area in
+two across a mixed-vendor estate: the adjacency gate refuses the neighbor,
+and every area-KEYED structure (ABR detection, inter-area filtering) computes
+against half the area.
+
+Canonical form is the DECIMAL spelling — chosen over dotted-quad because it
+leaves existing tombstone and golden keys (``ospf:1:area:0:stub_reset``)
+byte-identical.
+"""
+
+import re
+
+# Exactly four dotted octets. [0-9] not \d — \d is Unicode-aware, and a
+# Devanagari digit is not an area ID.
+_DOTTED_QUAD = re.compile(r"^([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})\.([0-9]{1,3})$")
+
+
+def canonical_area_id(value):
+    """Return *value*'s canonical OSPF area ID — the single normalizer.
+
+    ``"0.0.0.0"`` -> ``"0"``; any dotted quad -> the decimal spelling of its
+    32-bit value (``"0.0.0.51"`` -> ``"51"``). Everything else — decimal
+    strings, None, non-strings — passes through UNCHANGED: this normalizes a
+    spelling, it never rejects or invents one. Deliberately not a parser of
+    out-of-range quads either (``"0.0.0.999"`` is not an area ID in any
+    spelling, so it passes through for the caller to see as written).
+    """
+    if not isinstance(value, str):
+        return value
+    match = _DOTTED_QUAD.match(value.strip())
+    if match is None:
+        return value
+    octets = [int(group) for group in match.groups()]
+    if any(octet > 255 for octet in octets):
+        return value
+    return str(
+        (octets[0] << 24) | (octets[1] << 16) | (octets[2] << 8) | octets[3]
+    )

confgraph-0.3.8/dist-0.3.8/.gitignore

@@ -0,0 +1 @@
+*

{confgraph-0.3.7 → confgraph-0.3.8}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "confgraph"
-version = "0.3.7"
+version = "0.3.8"
 description = "Local-first network config dependency mapper — parse, visualize, and lint vendor configs"
 readme = "README.md"
 requires-python = ">=3.11"

{confgraph-0.3.7 → confgraph-0.3.8}/uv.lock

@@ -67,7 +67,7 @@ wheels = [
 
 [[package]]
 name = "confgraph"
-version = "0.3.6"
+version = "0.3.8"
 source = { editable = "." }
 dependencies = [
     { name = "ciscoconfparse2" },