@takodotid/circuit 0.24.0 → 0.25.0

package/dist/cli/index.js

@@ -11,7 +11,7 @@ import {
   addressesOf,
   freeOfLength,
   studioData
-} from "../chunks/index-n4zpd25n.js";
+} from "../chunks/index-wm9ypkjq.js";
 import {
   familyOf2,
   split,
@@ -110,20 +110,6 @@ var MARKER = /<secret:([A-Za-z0-9_./:-]+)>/g;
 var substitute = (text) => text.replace(MARKER, (_, reference) => valueOf(reference));
 var valueOfReference = valueOf;
 
-// src/core/time.ts
-function offset(zone) {
-  const name = new Intl.DateTimeFormat("en-US", {
-    timeZone: zone,
-    timeZoneName: "longOffset"
-  }).formatToParts(new Date).find((entry) => entry.type === "timeZoneName").value;
-  const found = /GMT([+-])(\d{2}):(\d{2})/.exec(name);
-  if (!found)
-    return 0;
-  const [, sign, hours, minutes] = found;
-  const sizeInMinutes = Number(hours) * 60 + Number(minutes);
-  return sign === "-" ? -sizeInMinutes : sizeInMinutes;
-}
-
 // src/transport/ssh.ts
 import { Client } from "ssh2";
 function connect(login) {
@@ -264,6 +250,1588 @@ function switchUnsupported(device) {
   return found;
 }
 
+// src/adapters/devices/junos/render.ts
+var USER_CLASS = { admin: "super-user", operator: "operator", "read-only": "read-only" };
+var KEY_STATEMENT = {
+  "ssh-ed25519": "ssh-ed25519",
+  "ssh-rsa": "ssh-rsa",
+  "ecdsa-sha2-nistp256": "ssh-ecdsa",
+  "ecdsa-sha2-nistp384": "ssh-ecdsa",
+  "ecdsa-sha2-nistp521": "ssh-ecdsa"
+};
+var SNMP_AUTH = { sha1: "authentication-sha", sha256: "authentication-sha256" };
+var SNMP_PRIVACY = { aes128: "privacy-aes128", des: "privacy-des" };
+var SNMP_GROUP = "circuit";
+var LEVEL = {
+  emergency: "emergency",
+  alert: "alert",
+  critical: "critical",
+  error: "error",
+  warning: "warning",
+  notice: "notice",
+  info: "info",
+  debug: "any"
+};
+var SERVICES_FILTER = { inet: "circuit-services", inet6: "circuit-services-v6" };
+var OSPF_EXPORT = "circuit-ospf-redistribute";
+var SSH_CIPHERS = ["aes256-gcm@openssh.com", "aes128-gcm@openssh.com", "aes256-ctr", "aes192-ctr", "aes128-ctr"];
+var SSH_MACS = ["hmac-sha2-512", "hmac-sha2-256"];
+var SSH_KEY_EXCHANGES = ["curve25519-sha256", "ecdh-sha2-nistp521", "ecdh-sha2-nistp384", "ecdh-sha2-nistp256", "group-exchange-sha2"];
+var SERVICE_PORTS = {
+  ssh: ["tcp", 22],
+  telnet: ["tcp", 23],
+  ftp: ["tcp", 21],
+  snmp: ["udp", 161],
+  http: ["tcp", 80],
+  api: ["tcp", 3000],
+  native: ["tcp", 830]
+};
+var BFD_INTERVAL = 300;
+function quote(value) {
+  if (/^[\w.:/@-]+$/.test(value))
+    return value;
+  const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
+  return `"${escaped}"`;
+}
+
+class Statements {
+  lines = [];
+  notes = [];
+  set(...words) {
+    this.lines.push(`set ${words.join(" ")}`);
+  }
+  note(comment) {
+    this.notes.push(comment);
+  }
+  text() {
+    const unique = [...new Set(this.lines)];
+    const extended = new Set;
+    for (const line of unique) {
+      const words = line.split(" ");
+      for (let length = 2;length < words.length; length++)
+        extended.add(words.slice(0, length).join(" "));
+    }
+    return [...unique.filter((line) => !extended.has(line)), ...this.notes].join(`
+`) + `
+`;
+  }
+}
+
+class Names {
+  device;
+  lags;
+  loopbacks = new Map;
+  tunnels = new Map;
+  constructor(device) {
+    this.device = device;
+    this.lags = lagIds(device);
+    const loopbacks = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "loopback");
+    let unit = 0;
+    for (const [name, iface] of loopbacks)
+      if (!iface.vrf)
+        this.loopbacks.set(name, 0);
+    for (const [name, iface] of loopbacks)
+      if (iface.vrf)
+        this.loopbacks.set(name, ++unit);
+    const tunnels = Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "gre");
+    tunnels.forEach(([name], index) => this.tunnels.set(name, index));
+  }
+  port(port) {
+    const name = spell(this.device.platform, this.device.model, port);
+    const settings = this.device.ports?.[port];
+    return settings?.speed === "1g" ? name.replace(/^xe-/, "ge-") : name;
+  }
+  physical(name) {
+    if (this.device.interfaces?.[name]?.type === "lag")
+      return `ae${this.lags.get(name)}`;
+    return this.port(name);
+  }
+  unit(name) {
+    const iface = this.device.interfaces?.[name];
+    if (iface?.type === "vlan")
+      return `irb.${this.device.vlans[iface.vlan].id}`;
+    if (iface?.type === "loopback")
+      return `lo0.${this.loopbacks.get(name)}`;
+    if (iface?.type === "gre")
+      return `gr-0/0/0.${this.tunnels.get(name)}`;
+    return `${this.physical(name)}.0`;
+  }
+  members(name) {
+    if (this.device.interfaces?.[name]?.type !== "lag")
+      return [this.port(name)];
+    const ports = Object.entries(this.device.ports ?? {}).filter(([, settings]) => settings?.lag === name);
+    return ports.map(([port]) => this.port(port));
+  }
+}
+function vrrpAddress(addresses, group) {
+  return addresses.find((address) => familyOf2(address) === "ipv4" && contains2(address, group.address));
+}
+var STORM_KINDS = [
+  ["broadcast", "no-broadcast"],
+  ["multicast", "no-multicast"],
+  ["unknown_unicast", "no-unknown-unicast"]
+];
+function stormProfile(settings) {
+  const storm = settings.storm_control;
+  if (!storm)
+    return;
+  const limited = STORM_KINDS.filter(([kind]) => storm[kind]);
+  const first = limited[0] && storm[limited[0][0]];
+  if (!first || !("percent" in first))
+    return;
+  const kinds = limited.map(([kind]) => kind.replace("_", "-"));
+  const left = STORM_KINDS.filter(([kind]) => !storm[kind]).map(([, statement]) => statement);
+  return { name: `${kinds.join("-")}-${first.percent}-percent`, percent: first.percent, left };
+}
+function render(device) {
+  const out = new Statements;
+  const names = new Names(device);
+  system(out, device);
+  users(out, device);
+  services(out, device);
+  snmp(out, device);
+  vlans(out, device, names);
+  ports(out, device, names);
+  lags(out, device, names);
+  routedInterfaces(out, device, names);
+  stormProfiles(out, device);
+  servicesFilter(out, device, names);
+  vrfs(out, device, names);
+  staticRoutes(out, device, names);
+  spanningTree(out, device, names);
+  lldp(out, device, names);
+  ospf(out, device, names);
+  dhcpRelay(out, device, names);
+  dhcpServers(out, device, names);
+  routerAdvertisements(out, device, names);
+  acls(out, device, names);
+  renderBgp(out, device);
+  sflow(out, device, names);
+  return out.text();
+}
+function system(out, device) {
+  out.set("system host-name", quote(device.name));
+  const system = device.system ?? {};
+  if (system.timezone)
+    out.set("system time-zone", system.timezone);
+  if (system.banner)
+    out.set("system login message", quote(system.banner));
+  for (const server of system.dns?.servers ?? [])
+    out.set("system name-server", server);
+  for (const server of system.ntp?.servers ?? [])
+    out.set("system ntp server", server);
+  if (!system.ip?.icmp_redirects) {
+    out.set("system no-redirects");
+    out.set("system no-redirects-ipv6");
+  }
+  const local = system.logging?.local;
+  if (local) {
+    out.set("system syslog file messages any", LEVEL[local.level]);
+    if (local.files !== undefined)
+      out.set("system syslog file messages archive files", local.files);
+  }
+  for (const remote of system.logging?.remote ?? []) {
+    out.set("system syslog host", remote.address, "any", LEVEL[remote.level]);
+    if (remote.port !== undefined && remote.port !== 514)
+      out.set("system syslog host", remote.address, "port", remote.port);
+  }
+}
+function users(out, device) {
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    const login = name === "root" ? "system root-authentication" : `system login user ${name} authentication`;
+    if (name !== "root") {
+      out.set(`system login user ${name} class`, USER_CLASS[user.role]);
+      if (user.description)
+        out.set(`system login user ${name} full-name`, quote(user.description));
+    }
+    out.set(login, "plain-text-password-value", marker(user.password));
+    for (const key of user.ssh_keys ?? [])
+      out.set(login, KEY_STATEMENT[key.split(" ")[0]], quote(key));
+  }
+}
+function services(out, device) {
+  const management = device.management ?? {};
+  const ssh = management.ssh;
+  if (ssh) {
+    out.set("system services ssh");
+    if (ssh.port !== undefined && ssh.port !== 22)
+      out.set("system services ssh port", ssh.port);
+    if (!ssh.weak_crypto) {
+      for (const cipher of SSH_CIPHERS)
+        out.set("system services ssh ciphers", cipher);
+      for (const mac of SSH_MACS)
+        out.set("system services ssh macs", mac);
+      for (const exchange of SSH_KEY_EXCHANGES)
+        out.set("system services ssh key-exchange", exchange);
+    }
+  }
+  if (management.telnet)
+    out.set("system services telnet");
+  if (management.ftp)
+    out.set("system services ftp");
+  const others = [
+    ["http", "system services web-management http"],
+    ["api", "system services rest http"],
+    ["native", "system services netconf ssh"]
+  ];
+  for (const [service, statement] of others) {
+    const settings = management[service];
+    if (!settings)
+      continue;
+    out.set(statement);
+    if (settings.port !== undefined && settings.port !== SERVICE_PORTS[service][1])
+      out.set(statement, "port", settings.port);
+  }
+}
+function snmp(out, device) {
+  const snmp = device.management?.snmp;
+  if (!snmp)
+    return;
+  if (snmp.contact)
+    out.set("snmp contact", quote(snmp.contact));
+  if (snmp.location)
+    out.set("snmp location", quote(snmp.location));
+  if (snmp.community)
+    out.set("snmp community", marker(snmp.community), "authorization read-only");
+  if (!snmp.users)
+    return;
+  for (const [name, user] of Object.entries(snmp.users)) {
+    const usm = `snmp v3 usm local-engine user ${name}`;
+    out.set(usm, SNMP_AUTH[user.auth], "authentication-password", marker(user.auth_password));
+    out.set(usm, SNMP_PRIVACY[user.privacy], "privacy-password", marker(user.privacy_password));
+    out.set("snmp v3 vacm security-to-group security-model usm security-name", name, "group", SNMP_GROUP);
+  }
+  out.set("snmp view all oid .1 include");
+  out.set(`snmp v3 vacm access group ${SNMP_GROUP} default-context-prefix security-model usm security-level privacy read-view all`);
+}
+function vlans(out, device, names) {
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    out.set(`vlans ${name} vlan-id`, vlan.id);
+    if (vlan.description)
+      out.set(`vlans ${name} description`, quote(vlan.description));
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "vlan")
+      out.set(`vlans ${iface.vlan} l3-interface`, names.unit(name));
+  }
+}
+function switching(out, device, physical, settings) {
+  const family = `interfaces ${physical} unit 0 family ethernet-switching`;
+  if (settings.access_vlan) {
+    out.set(family, "interface-mode access");
+    out.set(family, "vlan members", settings.access_vlan);
+  }
+  if (settings.trunk_vlans) {
+    out.set(family, "interface-mode trunk");
+    const members = new Set([...settings.trunk_vlans, ...settings.native_vlan ? [settings.native_vlan] : []]);
+    for (const vlan of members)
+      out.set(family, "vlan members", vlan);
+    if (settings.native_vlan)
+      out.set(`interfaces ${physical} native-vlan-id`, device.vlans[settings.native_vlan].id);
+  }
+  const storm = stormProfile(settings);
+  if (storm)
+    out.set(family, "storm-control", storm.name);
+}
+function addressing(out, unit, settings) {
+  const [physical, number] = unit.split(".");
+  const prefix = `interfaces ${physical} unit ${number}`;
+  const addresses = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+  for (const address of addresses)
+    out.set(`${prefix} family ${familyOf2(address) === "ipv4" ? "inet" : "inet6"} address`, address);
+  for (const group of settings.vrrp ?? []) {
+    const address = vrrpAddress(addresses, group);
+    if (!address)
+      continue;
+    const statement = `${prefix} family inet address ${address} vrrp-group ${group.id}`;
+    out.set(statement, "virtual-address", group.address);
+    if (group.priority !== undefined)
+      out.set(statement, "priority", group.priority);
+    if (!group.preempt)
+      out.set(statement, "no-preempt");
+    if (group.interval !== undefined && group.interval !== 1)
+      out.set(statement, "advertise-interval", group.interval);
+  }
+}
+function ports(out, device, names) {
+  for (const port of portsOf(device.platform, device.model)) {
+    const settings = device.ports?.[port];
+    const name = names.port(port);
+    if (name.startsWith("xe-"))
+      out.set(`interfaces ${name.replace("xe-", "ge-")} disable`);
+    if (name.startsWith("ge-"))
+      out.set(`interfaces ${name.replace("ge-", "xe-")} disable`);
+    if (!settings) {
+      out.set(`interfaces ${name} disable`);
+      continue;
+    }
+    if (settings.description)
+      out.set(`interfaces ${name} description`, quote(settings.description));
+    if (settings.lag) {
+      out.set(`interfaces ${name} ether-options 802.3ad`, `ae${names.lags.get(settings.lag)}`);
+      continue;
+    }
+    const switched = !!(settings.access_vlan || settings.trunk_vlans);
+    if (settings.mtu !== undefined)
+      out.set(`interfaces ${name} mtu`, frameSize(settings.mtu, switched));
+    switching(out, device, name, settings);
+    addressing(out, `${name}.0`, settings);
+  }
+}
+function lags(out, device, names) {
+  let highest = -1;
+  for (const [name, lag] of Object.entries(device.interfaces ?? {})) {
+    if (lag.type !== "lag")
+      continue;
+    const physical = names.physical(name);
+    highest = Math.max(highest, names.lags.get(name));
+    if (lag.description)
+      out.set(`interfaces ${physical} description`, quote(lag.description));
+    if (lag.mode !== "static")
+      out.set(`interfaces ${physical} aggregated-ether-options lacp active`);
+    if (lag.mtu !== undefined)
+      out.set(`interfaces ${physical} mtu`, frameSize(lag.mtu, !!(lag.access_vlan || lag.trunk_vlans)));
+    switching(out, device, physical, lag);
+    addressing(out, `${physical}.0`, lag);
+  }
+  if (highest >= 0)
+    out.set("chassis aggregated-devices ethernet device-count", highest + 1);
+}
+function routedInterfaces(out, device, names) {
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "vlan" && iface.type !== "loopback" && iface.type !== "gre")
+      continue;
+    const unit = names.unit(name);
+    const [physical, number] = unit.split(".");
+    const prefix = `interfaces ${physical} unit ${number}`;
+    if (iface.description)
+      out.set(`${prefix} description`, quote(iface.description));
+    if (iface.type === "gre") {
+      out.set(`${prefix} tunnel source`, iface.local);
+      out.set(`${prefix} tunnel destination`, iface.remote);
+    }
+    addressing(out, unit, iface);
+    if (iface.mtu === undefined)
+      continue;
+    const addresses = (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+    const families = new Set(addresses.map((address) => familyOf2(address) === "ipv4" ? "inet" : "inet6"));
+    for (const family of families)
+      out.set(`${prefix} family ${family} mtu`, iface.mtu);
+  }
+}
+function stormProfiles(out, device) {
+  const switched = [
+    ...Object.values(device.ports ?? {}).filter((settings) => !!settings && !settings.lag),
+    ...Object.values(device.interfaces ?? {}).filter((iface) => iface.type === "lag")
+  ];
+  for (const settings of switched) {
+    const storm = stormProfile(settings);
+    if (!storm)
+      continue;
+    const profile = `forwarding-options storm-control-profiles ${storm.name} all`;
+    out.set(profile, "bandwidth-percentage", storm.percent);
+    for (const statement of storm.left)
+      out.set(profile, statement);
+  }
+}
+function servicesFilter(out, device, names) {
+  const management = device.management ?? {};
+  const guarded = [];
+  for (const service of Object.keys(SERVICE_PORTS)) {
+    const settings = management[service];
+    const sources = settings?.allow ?? management.allow;
+    if (settings && sources?.length)
+      guarded.push({ service, sources });
+  }
+  const ntp = device.system?.ntp;
+  const keepsTimeQuietly = !!ntp?.servers.length && !ntp.serve;
+  if (!guarded.length && !keepsTimeQuietly)
+    return;
+  const families = [
+    ["inet", "ipv4", "protocol"],
+    ["inet6", "ipv6", "next-header"]
+  ];
+  for (const [family, addressFamily, protocolWord] of families) {
+    const filter = `firewall family ${family} filter ${SERVICES_FILTER[family]}`;
+    const ofFamily = (prefix) => familyOf2(host2(prefix)) === addressFamily;
+    for (const { service, sources } of guarded) {
+      const [protocol, standardPort] = SERVICE_PORTS[service];
+      const port = management[service]?.port ?? standardPort;
+      const term = `${filter} term ${service}`;
+      for (const source of sources.filter(ofFamily))
+        out.set(term, "from source-address", source);
+      out.set(term, "from", protocolWord, protocol);
+      out.set(term, "from destination-port", port);
+      out.set(term, "then accept");
+      const others = `${filter} term ${service}-others`;
+      out.set(others, "from", protocolWord, protocol);
+      out.set(others, "from destination-port", port);
+      out.set(others, "then discard");
+    }
+    if (keepsTimeQuietly) {
+      const servers = ntp.servers.filter(ofFamily);
+      if (servers.length) {
+        const length = addressFamily === "ipv4" ? 32 : 128;
+        for (const server of servers)
+          out.set(`${filter} term ntp from source-address`, `${server}/${length}`);
+        out.set(`${filter} term ntp from`, protocolWord, "udp");
+        out.set(`${filter} term ntp from destination-port 123`);
+        out.set(`${filter} term ntp then accept`);
+      }
+      out.set(`${filter} term ntp-others from`, protocolWord, "udp");
+      out.set(`${filter} term ntp-others from destination-port 123`);
+      out.set(`${filter} term ntp-others then discard`);
+    }
+    out.set(`${filter} term everything-else then accept`);
+  }
+  const anchors = new Set(["lo0.0", ...[...names.loopbacks.values()].map((unit) => `lo0.${unit}`)]);
+  for (const [port, settings] of Object.entries(device.ports ?? {})) {
+    const name = names.port(port);
+    if (settings?.addresses?.length && name.startsWith("em"))
+      anchors.add(`${name}.0`);
+  }
+  for (const anchor of anchors) {
+    const [physical, unit] = anchor.split(".");
+    out.set(`interfaces ${physical} unit ${unit} family inet filter input ${SERVICES_FILTER.inet}`);
+    out.set(`interfaces ${physical} unit ${unit} family inet6 filter input ${SERVICES_FILTER.inet6}`);
+  }
+}
+function vrfs(out, device, names) {
+  for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+    out.set(`routing-instances ${name} instance-type virtual-router`);
+    if (vrf.description)
+      out.set(`routing-instances ${name} description`, quote(vrf.description));
+  }
+  const routed = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})];
+  for (const [name, settings] of routed) {
+    if (settings?.vrf)
+      out.set(`routing-instances ${settings.vrf} interface`, names.unit(name));
+  }
+}
+function staticRoutes(out, device, names) {
+  if (device.routing?.router_id)
+    out.set("routing-options router-id", device.routing.router_id);
+  for (const route of device.routing?.static ?? []) {
+    const ipv6 = familyOf2(split(route.prefix).addr) === "ipv6";
+    const table = ipv6 ? ` rib ${route.vrf ? `${route.vrf}.` : ""}inet6.0` : "";
+    const options = route.vrf ? `routing-instances ${route.vrf} routing-options${table}` : `routing-options${table}`;
+    const statement = `${options} static route ${route.prefix}`;
+    if (route.blackhole) {
+      out.set(statement, "discard");
+      if (route.distance !== undefined)
+        out.set(statement, "preference", route.distance);
+      continue;
+    }
+    const nextHop = route.via ?? names.unit(route.interface);
+    if (route.distance === undefined)
+      out.set(statement, "next-hop", nextHop);
+    else
+      out.set(statement, "qualified-next-hop", nextHop, "preference", route.distance);
+  }
+}
+function spanningTree(out, device, names) {
+  const stp = device.stp;
+  if (!stp)
+    return;
+  const protocol = `protocols ${stp.mode === "mstp" ? "mstp" : "rstp"}`;
+  if (stp.mode === "stp")
+    out.set(protocol, "force-version stp");
+  if (stp.priority !== undefined)
+    out.set(protocol, "bridge-priority", stp.priority === 0 ? "0" : `${stp.priority / 1024}k`);
+  const switched = [];
+  for (const [port, settings] of Object.entries(device.ports ?? {})) {
+    if (settings && !settings.lag && (settings.access_vlan || settings.trunk_vlans))
+      switched.push([names.port(port), settings]);
+  }
+  for (const [name, lag] of Object.entries(device.interfaces ?? {})) {
+    if (lag.type === "lag" && (lag.access_vlan || lag.trunk_vlans))
+      switched.push([names.physical(name), lag]);
+  }
+  for (const [name, settings] of switched) {
+    const statement = `${protocol} interface ${name}`;
+    out.set(statement);
+    if (settings.stp === false)
+      out.set(statement, "disable");
+    else if (typeof settings.stp === "object") {
+      if (settings.stp.edge)
+        out.set(statement, "edge");
+      if (settings.stp.cost !== undefined)
+        out.set(statement, "cost", settings.stp.cost);
+      if (settings.stp.priority !== undefined)
+        out.set(statement, "priority", settings.stp.priority);
+    }
+  }
+}
+function lldp(out, device, names) {
+  const lldp = device.lldp;
+  if (lldp === true)
+    out.set("protocols lldp interface all");
+  else if (lldp)
+    for (const name of lldp.interfaces)
+      for (const port of names.members(name))
+        out.set("protocols lldp interface", port);
+  for (const [port, settings] of Object.entries(device.ports ?? {})) {
+    if (settings?.lldp === false)
+      out.set("protocols lldp interface", names.port(port), "disable");
+    else if (settings?.lldp === true)
+      out.set("protocols lldp interface", names.port(port));
+  }
+}
+function ospf(out, device, names) {
+  const ospf = device.routing?.ospf;
+  if (!ospf)
+    return;
+  const protocols = (ospf.families ?? ["ipv4"]).map((family) => family === "ipv4" ? "ospf" : "ospf3");
+  for (const protocol of protocols) {
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
+      for (const [iface, settings] of Object.entries(area.interfaces)) {
+        const statement = `protocols ${protocol} area ${areaId} interface ${names.unit(iface)}`;
+        out.set(statement);
+        if (settings?.cost !== undefined)
+          out.set(statement, "metric", settings.cost);
+        if (settings?.passive)
+          out.set(statement, "passive");
+        if (settings?.network === "point-to-point")
+          out.set(statement, "interface-type p2p");
+        if (settings?.bfd)
+          out.set(statement, "bfd-liveness-detection minimum-interval", BFD_INTERVAL);
+      }
+    }
+    if (ospf.redistribute?.length)
+      out.set(`protocols ${protocol} export`, OSPF_EXPORT);
+  }
+  for (const source of ospf.redistribute ?? []) {
+    const term = `policy-options policy-statement ${OSPF_EXPORT} term ${source}`;
+    out.set(term, "from protocol", source === "connected" ? "direct" : "static");
+    out.set(term, "then accept");
+  }
+}
+function dhcpRelay(out, device, names) {
+  for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
+    const vrf = device.interfaces?.[relay.interface]?.vrf ?? device.ports?.[relay.interface]?.vrf;
+    const relays = vrf ? `routing-instances ${vrf} forwarding-options dhcp-relay` : "forwarding-options dhcp-relay";
+    for (const server of relay.servers)
+      out.set(`${relays} server-group ${name}`, server);
+    out.set(`${relays} group ${name} active-server-group`, name);
+    out.set(`${relays} group ${name} interface`, names.unit(relay.interface));
+  }
+}
+function sflow(out, device, names) {
+  const flow = device.flow_export;
+  if (flow?.protocol !== "sflow")
+    return;
+  out.set("protocols sflow agent-id", device.connection.host);
+  if (flow.sampling !== undefined)
+    out.set("protocols sflow sample-rate ingress", flow.sampling);
+  for (const collector of flow.collectors) {
+    out.set("protocols sflow collector", collector.address);
+    if (collector.port !== undefined && collector.port !== 6343) {
+      out.set("protocols sflow collector", collector.address, "udp-port", collector.port);
+    }
+  }
+  const declared = Object.entries(device.ports ?? {}).filter(([, settings]) => settings && !settings.lag);
+  const observed = flow.interfaces ?? declared.map(([port]) => port);
+  for (const name of observed) {
+    for (const port of names.members(name))
+      if (!port.startsWith("em"))
+        out.set("protocols sflow interfaces", `${port}.0`);
+  }
+}
+var frameSize = (mtu, switched) => mtu + (switched ? 18 : 14);
+var bandwidth = (rate) => rate.toLowerCase();
+function burstOf(rate) {
+  const scale = { k: 1000, m: 1e6, g: 1e9 }[rate.slice(-1).toLowerCase()];
+  return Math.max(1500, Math.round(Number(rate.slice(0, -1)) * scale / 800));
+}
+var eachPort = (ports) => [ports].flat().map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
+function aclFamily(rule) {
+  const match = rule.match;
+  if (match?.family)
+    return match.family;
+  const address = match?.src ?? match?.dst;
+  return address ? familyOf2(host2(address)) : undefined;
+}
+var nextHeader = (protocol) => protocol === "icmp" ? "icmp6" : protocol;
+var ruleName = (label, description) => quote(description ? `${label} ${description}` : label);
+function acls(out, device, names) {
+  const switched = new Set;
+  const routed = new Set;
+  for (const [port, settings] of Object.entries(device.ports ?? {})) {
+    if (!settings?.acl)
+      continue;
+    const physical = names.port(port);
+    if (settings.access_vlan || settings.trunk_vlans) {
+      switched.add(settings.acl);
+      out.set(`interfaces ${physical} unit 0 family ethernet-switching filter input`, settings.acl);
+    } else {
+      routed.add(settings.acl);
+      out.set(`interfaces ${physical} unit 0 family inet filter input`, `${settings.acl}-v4`);
+      out.set(`interfaces ${physical} unit 0 family inet6 filter input`, `${settings.acl}-v6`);
+    }
+  }
+  for (const acl of switched)
+    switchingFilter(out, device, acl);
+  for (const acl of routed) {
+    routedFilter(out, device, acl, "ipv4");
+    routedFilter(out, device, acl, "ipv6");
+  }
+}
+function aclThen(out, term, policer, rule) {
+  if (rule.action === "drop") {
+    out.set(term, "then discard");
+    return;
+  }
+  if (rule.rate) {
+    out.set(`firewall policer ${policer} if-exceeding bandwidth-limit`, bandwidth(rule.rate));
+    out.set(`firewall policer ${policer} if-exceeding burst-size-limit`, burstOf(rule.rate));
+    out.set(`firewall policer ${policer} then discard`);
+    out.set(term, "then policer", policer);
+  }
+  out.set(term, "then accept");
+}
+function switchingFilter(out, device, acl) {
+  const filter = `firewall family ethernet-switching filter ${acl}`;
+  (device.acls?.[acl] ?? []).forEach((rule, index) => {
+    const match = rule.match ?? {};
+    const addressed = match.src || match.dst || match.protocol || match.src_port !== undefined || match.dst_port !== undefined;
+    const family = aclFamily(rule);
+    const families = addressed || family ? family ? [family] : ["ipv4", "ipv6"] : [undefined];
+    for (const each of families) {
+      const label = families.length > 1 ? `${index + 1}-${each === "ipv4" ? "v4" : "v6"}` : `${index + 1}`;
+      const term = `${filter} term ${ruleName(label, rule.description)}`;
+      if (each) {
+        const version = `from ip-version ${each}`;
+        const v4 = each === "ipv4";
+        if (match.src)
+          out.set(term, version, v4 ? "ip-source-address" : "ip6-source-address", match.src);
+        if (match.dst)
+          out.set(term, version, v4 ? "ip-destination-address" : "ip6-destination-address", match.dst);
+        if (match.protocol)
+          out.set(term, version, v4 ? "ip-protocol" : "next-header", v4 ? match.protocol : nextHeader(match.protocol));
+        for (const port of match.src_port !== undefined ? eachPort(match.src_port) : [])
+          out.set(term, version, "source-port", port);
+        for (const port of match.dst_port !== undefined ? eachPort(match.dst_port) : [])
+          out.set(term, version, "destination-port", port);
+        if (!addressed)
+          out.set(term, version);
+      }
+      aclThen(out, term, `${acl}-${label}`, rule);
+    }
+  });
+  out.set(filter, "term circuit-default then accept");
+}
+function routedFilter(out, device, acl, family) {
+  const name = `${acl}-${family === "ipv4" ? "v4" : "v6"}`;
+  const filter = `firewall family ${family === "ipv4" ? "inet" : "inet6"} filter ${name}`;
+  (device.acls?.[acl] ?? []).forEach((rule, index) => {
+    const ruleFamily = aclFamily(rule);
+    if (ruleFamily && ruleFamily !== family)
+      return;
+    const match = rule.match ?? {};
+    const label = `${index + 1}`;
+    const term = `${filter} term ${ruleName(label, rule.description)}`;
+    const protocolWord = family === "ipv4" ? "protocol" : "next-header";
+    if (match.src)
+      out.set(term, "from source-address", match.src);
+    if (match.dst)
+      out.set(term, "from destination-address", match.dst);
+    if (match.protocol)
+      out.set(term, "from", protocolWord, family === "ipv4" ? match.protocol : nextHeader(match.protocol));
+    for (const port of match.src_port !== undefined ? eachPort(match.src_port) : [])
+      out.set(term, "from source-port", port);
+    for (const port of match.dst_port !== undefined ? eachPort(match.dst_port) : [])
+      out.set(term, "from destination-port", port);
+    aclThen(out, term, `${name}-${label}`, rule);
+  });
+  out.set(filter, "term circuit-default then accept");
+}
+function dhcpServers(out, device, names) {
+  for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+    out.set(`system services dhcp-local-server group ${name} interface`, names.unit(server.interface));
+    const pool = `access address-assignment pool ${name} family inet`;
+    const [low, high] = server.pool;
+    out.set(pool, "network", server.network);
+    out.set(pool, `range ${name} low`, low);
+    out.set(pool, `range ${name} high`, high);
+    out.set(pool, "dhcp-attributes router", server.gateway);
+    for (const resolver of server.dns ?? [])
+      out.set(pool, "dhcp-attributes name-server", resolver);
+    if (server.lease_time !== undefined)
+      out.set(pool, "dhcp-attributes maximum-lease-time", server.lease_time);
+    for (const reservation of server.reservations ?? []) {
+      const host = `${pool} host ${reservation.address.replace(/\./g, "-")}`;
+      out.set(host, "hardware-address", reservation.mac.toLowerCase());
+      out.set(host, "ip-address", reservation.address);
+    }
+  }
+}
+function routerAdvertisements(out, device, names) {
+  const routed = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})];
+  for (const [name, settings] of routed) {
+    if (!settings?.ipv6_ra)
+      continue;
+    const addresses = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+    for (const address of addresses.filter((address) => familyOf2(address) === "ipv6")) {
+      out.set(`protocols router-advertisement interface ${names.unit(name)} prefix`, network(address));
+    }
+  }
+}
+
+// src/adapters/devices/junos/bgp.ts
+var REJECT_ALL = "circuit-reject-all";
+var ORIGIN = "circuit-bgp-origin";
+var RPKI_GROUP = "circuit";
+var GENERATED = "# generated ";
+var FAMILY = { ipv4: "inet", ipv6: "inet6" };
+var VALIDATION = { valid: "valid", invalid: "invalid", "not-found": "unknown" };
+function settingsOf(device, neighbor) {
+  const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+  return { ...group, ...neighbor };
+}
+var slug = (value) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
+var member = (community, large) => large ? `large:${community}` : community;
+function renderBgp(out, device) {
+  prefixSets(out, device);
+  rpki(out, device);
+  const bgp = device.routing?.bgp;
+  if (!bgp)
+    return;
+  out.set("routing-options autonomous-system", bgp.asn);
+  const used = new Set;
+  let rejectAll = false;
+  let exports = false;
+  for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
+    const settings = settingsOf(device, neighbor);
+    const group = `protocols bgp group ${name}`;
+    out.set(group, "type", settings.remote_as === bgp.asn ? "internal" : "external");
+    out.set(group, "peer-as", settings.remote_as);
+    if (settings.description)
+      out.set(group, "description", quote(settings.description));
+    if (settings.local_address)
+      out.set(group, "local-address", settings.local_address);
+    if (settings.multihop)
+      out.set(group, "multihop");
+    if (settings.passive)
+      out.set(group, "passive");
+    if (settings.hold_time !== undefined)
+      out.set(group, "hold-time", settings.hold_time);
+    if (settings.password)
+      out.set(group, "authentication-key", marker(settings.password));
+    if (settings.bfd)
+      out.set(group, "bfd-liveness-detection minimum-interval", BFD_INTERVAL);
+    out.set(group, "import", settings.import ?? REJECT_ALL);
+    if (settings.export) {
+      exports = true;
+      out.set(group, "export", ORIGIN);
+      out.set(group, "export", settings.export);
+    } else
+      out.set(group, "export", REJECT_ALL);
+    for (const policy of [settings.import, settings.export]) {
+      if (policy)
+        used.add(policy);
+      else
+        rejectAll = true;
+    }
+    for (const family of settings.families ?? [familyOf2(neighbor.address)]) {
+      const nlri = `${group} family ${FAMILY[family]} unicast`;
+      out.set(nlri);
+      if (settings.max_prefixes !== undefined) {
+        out.set(nlri, "prefix-limit maximum", settings.max_prefixes);
+        out.set(nlri, "prefix-limit teardown idle-timeout forever");
+      }
+    }
+    out.set(group, "neighbor", neighbor.address);
+  }
+  if (rejectAll)
+    out.set(`policy-options policy-statement ${REJECT_ALL} then reject`);
+  if (exports)
+    origin(out, device);
+  for (const policy of [...used].sort())
+    policyStatement(out, device, policy);
+}
+function origin(out, device) {
+  const statement = `policy-options policy-statement ${ORIGIN}`;
+  out.set(statement, "term bgp from protocol bgp");
+  out.set(statement, "term bgp then next policy");
+  const networks = device.routing?.bgp?.networks ?? [];
+  for (const prefix of networks)
+    out.set(statement, "term networks from route-filter", prefix, "exact");
+  if (networks.length)
+    out.set(statement, "term networks then next policy");
+  out.set(statement, "term others then reject");
+}
+function prefixSets(out, device) {
+  for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+    const list = `policy-options prefix-list ${name}`;
+    if ("prefixes" in set && set.prefixes.length)
+      for (const prefix of set.prefixes)
+        out.set(list, prefix);
+    else
+      out.set(list);
+    if ("source" in set)
+      out.note(`${GENERATED}${list}`);
+  }
+}
+function rpki(out, device) {
+  for (const server of device.routing?.rpki ?? []) {
+    out.set(`routing-options validation group ${RPKI_GROUP} session`, server.address, "port", server.port);
+  }
+}
+function familyOfRule(device, rule) {
+  const match = rule.match;
+  if (match?.family)
+    return match.family;
+  if (match?.prefix)
+    return familyOf2(host2(match.prefix));
+  const set = match?.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+  if (set && "source" in set)
+    return set.source.family;
+  if (set?.prefixes[0])
+    return familyOf2(host2(set.prefixes[0]));
+  return;
+}
+function flatten(device, policy, label, seen) {
+  const rules = device.policies?.[policy] ?? [];
+  const flat = [];
+  rules.forEach((rule, index) => {
+    const here = label ? `${label}.${index + 1}` : `${index + 1}`;
+    if (rule.call && !seen.includes(rule.call))
+      flat.push(...flatten(device, rule.call, here, [...seen, rule.call]));
+    if (rule.match || rule.set || rule.action)
+      flat.push({ label: here, rule });
+  });
+  return flat;
+}
+var termName = (label, rule) => quote(rule.description ? `${label} ${rule.description}` : label);
+function policyStatement(out, device, policy) {
+  const statement = `policy-options policy-statement ${policy}`;
+  const flat = flatten(device, policy, "", [policy]);
+  for (const { label, rule } of flat) {
+    const family = familyOfRule(device, rule);
+    const split = !family && (rule.set?.next_hop || rule.match?.prefix_length) ? ["ipv4", "ipv6"] : [family];
+    for (const part of split) {
+      const name = split.length > 1 ? termName(`${label}-${part === "ipv4" ? "v4" : "v6"}`, rule) : termName(label, rule);
+      term(out, device, `${statement} term ${name}`, rule, part, split.length > 1);
+    }
+  }
+  const last = flat.at(-1)?.rule;
+  const decides = last !== undefined && !last.match && last.action !== undefined;
+  if (!decides)
+    out.set(statement, "term circuit-default then reject");
+}
+function term(out, device, term, rule, family, splitFamily) {
+  const match = rule.match ?? {};
+  const set = rule.set ?? {};
+  const from = [];
+  const then = [];
+  if (match.family || splitFamily)
+    from.push(["family", FAMILY[match.family ?? family]]);
+  if (match.prefix)
+    from.push(["route-filter", match.prefix, "exact"]);
+  if (match.prefix_set)
+    from.push(["prefix-list-filter", match.prefix_set, "orlonger"]);
+  if (match.prefix_length) {
+    const families = family ? [family] : ["ipv4", "ipv6"];
+    for (const each of families) {
+      const longest = each === "ipv4" ? 32 : 128;
+      const range = `/${match.prefix_length.min ?? 0}-/${match.prefix_length.max ?? longest}`;
+      from.push(["route-filter", each === "ipv4" ? "0.0.0.0/0" : "::/0", "prefix-length-range", range]);
+    }
+  }
+  if (match.as_path_length) {
+    const { min = 0, max } = match.as_path_length;
+    const name = `circuit-path-length-${min}-${max ?? "any"}`;
+    out.set(`policy-options as-path ${name}`, quote(`.{${min},${max ?? ""}}`));
+    from.push(["as-path", name]);
+  }
+  if (match.rpki)
+    from.push(["validation-database", VALIDATION[match.rpki]]);
+  const wanted = [
+    ...match.community ? [member(match.community, false)] : [],
+    ...match.large_community ? [member(match.large_community, true)] : []
+  ];
+  if (wanted.length)
+    from.push(["community", community(out, "match", wanted)]);
+  if (set.local_pref !== undefined)
+    then.push(["local-preference", set.local_pref]);
+  if (set.med !== undefined)
+    then.push(["metric", set.med]);
+  if (set.prepend !== undefined) {
+    const asn = device.routing.bgp.asn;
+    then.push(["as-path-prepend", quote(Array(set.prepend).fill(asn).join(" "))]);
+  }
+  const removed = [
+    ...(set.communities ? ["*:*"] : set.remove_communities ?? []).map((pattern) => member(pattern, false)),
+    ...(set.large_communities ? ["*:*:*"] : set.remove_large_communities ?? []).map((pattern) => member(pattern, true))
+  ];
+  const added = [
+    ...(set.communities ?? set.add_communities ?? []).map((value) => member(value, false)),
+    ...(set.large_communities ?? set.add_large_communities ?? []).map((value) => member(value, true))
+  ];
+  if (set.communities && set.add_communities)
+    added.push(...set.add_communities.map((value) => member(value, false)));
+  if (set.large_communities && set.add_large_communities)
+    added.push(...set.add_large_communities.map((value) => member(value, true)));
+  for (const pattern of removed)
+    then.push(["community delete", community(out, "remove", [pattern])]);
+  if (added.length)
+    then.push(["community add", community(out, "add", added)]);
+  if (set.next_hop && (!family || familyOf2(set.next_hop) === family))
+    then.push(["next-hop", set.next_hop]);
+  if (set.blackhole)
+    then.push(["next-hop discard"]);
+  if (rule.action)
+    then.push([rule.action]);
+  for (const words of from)
+    out.set(term, "from", ...words);
+  for (const words of then)
+    out.set(term, "then", ...words);
+  if (!from.length && !then.length)
+    out.set(term);
+}
+function community(out, purpose, members) {
+  const name = `circuit-${purpose}-${slug(members.join(" "))}`;
+  for (const value of members)
+    out.set(`policy-options community ${name} members`, quote(value));
+  return name;
+}
+
+// src/adapters/devices/junos/index.ts
+var SUPPORTED_MAJOR = 21;
+var DEVICE_FACTS = [/^set version /, /^set system login user \S+ uid \d+$/];
+var SYSTEM_ACCOUNTS = new Set(["bind", "daemon", "kmem", "nobody", "operator", "sshd", "tty", "uucp"]);
+function wordsOf(statement) {
+  return statement.match(/"(?:[^"\\]|\\.)*"|\S+/g) ?? [];
+}
+var bare = (word) => word.startsWith('"') ? word.slice(1, -1).replace(/\\(.)/g, "$1") : word;
+var SECRETS = [
+  [/ (?:encrypted-password|plain-text-password-value) (?:"[^"]*"|\S+)/, " password <secret>"],
+  [/ (?:authentication-key|authentication-password) (?:"[^"]*"|\S+)/, " authentication-key <secret>"],
+  [/ (?:privacy-key|privacy-password) (?:"[^"]*"|\S+)/, " privacy-key <secret>"],
+  [/^set snmp community (?:"[^"]*"|\S+)/, "set snmp community <secret>"]
+];
+function keyOf2(statement) {
+  let canonical = statement;
+  for (const [pattern, replacement] of SECRETS)
+    canonical = canonical.replace(pattern, replacement);
+  return wordsOf(canonical).slice(1).map(bare);
+}
+function scrub(text) {
+  return text.replace(/ ## SECRET-DATA$/gm, "").replace(/((?:encrypted-password|authentication-key|privacy-key) )(?:"[^"]*"|\S+)/g, "$1<redacted>").replace(/^(set snmp community )(?:"[^"]*"|\S+)/gm, "$1<redacted>").replace(/"\$\d\$[^"]*"/g, "<redacted>");
+}
+function clean(output) {
+  const statements = output.replace(/\r/g, "").split(`
+`).map((line) => line.trimEnd()).filter((line) => /^(set|deactivate) /.test(line)).filter((line) => !DEVICE_FACTS.some((fact) => fact.test(line)));
+  return scrub(statements.join(`
+`) + `
+`);
+}
+var NAMED_LISTS = new Set([
+  "address",
+  "area",
+  "as-path",
+  "class",
+  "collector",
+  "community",
+  "family",
+  "file",
+  "filter",
+  "group",
+  "host",
+  "interface",
+  "interfaces",
+  "neighbor",
+  "oid",
+  "policer",
+  "policy-statement",
+  "pool",
+  "prefix",
+  "prefix-list",
+  "qualified-next-hop",
+  "range",
+  "rib",
+  "route",
+  "security-level",
+  "security-model",
+  "security-name",
+  "server",
+  "server-group",
+  "session",
+  "storm-control-profiles",
+  "term",
+  "trap-group",
+  "unit",
+  "user",
+  "view",
+  "vlan",
+  "vrrp-group"
+]);
+function canStopAt(path, index) {
+  if (index === 0 || !NAMED_LISTS.has(path[index]))
+    return true;
+  return path[index] === "vlan" && path[index + 1] === "members";
+}
+var sectionOf = (path) => path.slice(0, 2).join(" ");
+function orderedBlockOf(path) {
+  if (path[0] === "policy-options" && path[1] === "policy-statement" && path[3] === "term") {
+    return { block: path.slice(0, 3), item: path[4] };
+  }
+  if (path[0] === "firewall" && path[1] === "family" && path[3] === "filter" && path[5] === "term") {
+    return { block: path.slice(0, 5), item: path[6] };
+  }
+  const chain = path.length - 2;
+  if (path[0] === "protocols" && (path[chain] === "import" || path[chain] === "export")) {
+    return { block: path.slice(0, chain + 1), item: path[chain + 1] };
+  }
+  return;
+}
+var startsWith = (path, prefix) => prefix.every((word, index) => path[index] === word);
+function plan(desired, current, options) {
+  const lines = (text, verb) => text.split(`
+`).filter((line) => line.startsWith(`${verb} `));
+  const wanted = lines(desired, "set");
+  const deactivated = lines(current, "deactivate");
+  const generated = desired.split(`
+`).filter((line) => line.startsWith(GENERATED)).map((line) => wordsOf(line.slice(GENERATED.length)).map(bare));
+  const printed = lines(current, "set").filter((line) => !DEVICE_FACTS.some((fact) => fact.test(line)));
+  const isGenerated = (line) => generated.some((path) => keyOf2(line).length > path.length && startsWith(keyOf2(line), path));
+  const existing = printed.filter((line) => !isGenerated(line));
+  const join = (path) => path.join("\x00");
+  const wantedPaths = wanted.map(keyOf2);
+  const wantedKeys = new Set(wantedPaths.map(join));
+  const existingKeys = new Set(existing.map((line) => join(keyOf2(line))));
+  const wantedUnder = (path) => wantedPaths.filter((other) => startsWith(other, path));
+  const sections = new Map;
+  const sectionFor = (path) => {
+    const name = sectionOf(path);
+    if (!sections.has(name))
+      sections.set(name, { show: [], activate: [], remove: [], add: [] });
+    return sections.get(name);
+  };
+  for (const path of wantedPaths)
+    sectionFor(path);
+  const rewritten = [];
+  const blocks = new Map;
+  for (const path of wantedPaths) {
+    const ordered = orderedBlockOf(path);
+    if (ordered)
+      blocks.set(join(ordered.block), ordered.block);
+  }
+  for (const block of blocks.values()) {
+    const inBlock = (line) => startsWith(keyOf2(line), block);
+    const order = (all) => [...new Set(all.filter(inBlock).map((line) => orderedBlockOf(keyOf2(line)).item))];
+    const keys = (all) => all.filter(inBlock).map((line) => join(keyOf2(line))).sort().join(`
+`);
+    const wantedHere = wanted.filter(inBlock);
+    const existingHere = existing.filter(inBlock);
+    if (join(order(wanted)) === join(order(existing)) && keys(wanted) === keys(existing))
+      continue;
+    rewritten.push(block);
+    const section = sectionFor(block);
+    if (existingHere.length)
+      section.remove.push(`delete ${wordsOf(existingHere[0]).slice(1, 1 + block.length).join(" ")}`);
+    section.show.push(...existingHere.map((line) => `- ${line}`), ...wantedHere.map((line) => `+ ${line}`));
+    section.add.push(...wantedHere);
+  }
+  const isRewritten = (line) => rewritten.some((block) => startsWith(keyOf2(line), block));
+  const removed = [];
+  for (const line of existing) {
+    if (isRewritten(line))
+      continue;
+    const path = keyOf2(line);
+    if (wantedKeys.has(join(path)))
+      continue;
+    if (wantedUnder(path).length)
+      continue;
+    let length = 1;
+    while (wantedUnder(path.slice(0, length)).length)
+      length++;
+    while (length < path.length && !canStopAt(path, length - 1))
+      length++;
+    const hidden = path.indexOf("<secret>");
+    if (hidden >= 0 && hidden < length && !NAMED_LISTS.has(path[hidden - 1]))
+      length = hidden;
+    removed.push(wordsOf(line).slice(1, 1 + length));
+  }
+  const isInside = (path, other) => other.length < path.length && other.every((word, index) => bare(path[index]) === bare(word));
+  const removals = removed.filter((path, index) => !removed.some((other) => isInside(path, other)) && removed.findIndex((other) => join(other) === join(path)) === index);
+  const isRemoved = (line) => removals.some((path) => startsWith(keyOf2(line), path.map(bare)));
+  for (const path of removals) {
+    const section = sectionFor(path.map(bare));
+    section.remove.push(`delete ${path.join(" ")}`);
+    const under = existing.filter((line) => startsWith(keyOf2(line), path.map(bare)));
+    section.show.push(...under.map((line) => `- ${line}`));
+  }
+  for (const line of deactivated) {
+    const path = wordsOf(line).slice(1);
+    if (!wantedUnder(path.map(bare)).length)
+      continue;
+    const section = sectionFor(path.map(bare));
+    section.activate.push(`activate ${path.join(" ")}`);
+    section.show.push(`+ activate ${path.join(" ")}`);
+  }
+  const extended = (path) => printed.some((line) => !isRemoved(line) && startsWith(keyOf2(line), path));
+  for (const line of wanted) {
+    if (isRewritten(line))
+      continue;
+    const path = keyOf2(line);
+    const isNew = !existingKeys.has(join(path)) && !extended(path);
+    const rotated = options.secrets && line.includes("<secret:");
+    if (!isNew && !rotated)
+      continue;
+    const section = sectionFor(path);
+    section.add.push(line);
+    section.show.push(`+ ${line}`);
+    const clear = "delete snmp community <redacted>";
+    if (rotated && line.startsWith("set snmp community ") && !section.remove.includes(clear))
+      section.remove.push(clear);
+  }
+  const steps = [...sections].filter(([, section]) => section.show.length).map(([title, section]) => ({ title, show: section.show, send: [...section.activate, ...section.remove, ...section.add] }));
+  return { steps, problems: [] };
+}
+async function login(device) {
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return connect({
+    host: device.connection.host,
+    port: device.connection.port,
+    user: device.connection.user,
+    password: resolve(user.password)
+  });
+}
+async function checkVersion(client, device) {
+  const version = await exec(client, "show version | match Junos:");
+  const release = /Junos: (\d+)\.(\S+)/.exec(version);
+  if (!release)
+    throw new Error(`${device.name} did not say which Junos it runs: ${version.slice(0, 200)}`);
+  if (Number(release[1]) !== SUPPORTED_MAJOR) {
+    throw new Error(`${device.name} runs Junos ${release[1]}.${release[2]}; this adapter renders for Junos ${SUPPORTED_MAJOR}`);
+  }
+}
+async function read(device) {
+  const client = await login(device);
+  try {
+    await checkVersion(client, device);
+    const output = await exec(client, "show configuration | display set | no-more", 180000);
+    if (!/^set /m.test(output))
+      throw new Error(`${device.name} returned no configuration`);
+    return clean(output);
+  } finally {
+    client.end();
+  }
+}
+var PROMPT = /[>#%] $/;
+async function run(channel, line, timeout = 60000) {
+  channel.write(`${line}
+`);
+  const output = await readUntil(channel, (text) => PROMPT.test(text.replace(/\r/g, "")), timeout, 300);
+  return output.replace(/\r/g, "");
+}
+var EDIT_PROMPT = /\[edit[^\]\n]*\]\n[^\n]*# $/;
+async function edit(channel, line, timeout = 60000) {
+  channel.write(`${line}
+`);
+  const output = await readUntil(channel, (text) => EDIT_PROMPT.test(text.replace(/\r/g, "")), timeout, 300);
+  return output.replace(/\r/g, "");
+}
+async function openCli(channel) {
+  const banner = await readUntil(channel, (text) => PROMPT.test(text.replace(/\r/g, "")), 20000, 500);
+  if (/% $/.test(banner.replace(/\r/g, "")))
+    await run(channel, "cli");
+  await run(channel, "set cli screen-length 0");
+  await run(channel, "set cli screen-width 0");
+  await run(channel, "set cli complete-on-space off");
+}
+async function named(channel, line) {
+  const words = wordsOf(line).slice(1);
+  const at = words.indexOf("<redacted>");
+  if (at < 0)
+    return [line];
+  const shown = await edit(channel, `show ${words.slice(0, at - 1).join(" ")} | display set`);
+  const inList = (statement) => statement[0] === "set" && words.slice(0, at).every((word, index) => statement[index + 1] === word);
+  const names = new Set(shown.split(`
+`).map(wordsOf).filter(inList).map((statement) => statement[at + 1]));
+  return [...names].map((name) => `delete ${[...words.slice(0, at), name, ...words.slice(at + 1)].join(" ")}`);
+}
+var REFUSED = /^terminal:\d+:\(\d+\) (?!warning)|^error: /m;
+async function configure(channel, plan, guard) {
+  const sent = plan.steps.flatMap((step) => step.send);
+  const entered = await run(channel, "configure exclusive");
+  if (!/Entering configuration mode/.test(entered) || /^error: /m.test(entered)) {
+    throw new Error(`the candidate could not be locked: ${entered.trim().slice(0, 300)}`);
+  }
+  const deletions = [];
+  for (const line of sent.filter((line) => line.startsWith("delete ")))
+    deletions.push(...await named(channel, line));
+  const ordered = [
+    ...sent.filter((line) => line.startsWith("activate ")),
+    ...deletions,
+    ...sent.filter((line) => line.startsWith("set "))
+  ];
+  const discard = async (reason) => {
+    await edit(channel, "rollback 0").catch(() => {
+      return;
+    });
+    await run(channel, "exit configuration-mode").catch(() => {
+      return;
+    });
+    return new Error(reason);
+  };
+  channel.write(`load set terminal
+`);
+  await readUntil(channel, (text) => text.includes("[Type ^D at a new line to end input]"), 20000, 300);
+  for (const line of ordered)
+    channel.write(`${substitute(line)}
+`);
+  const loaded = await edit(channel, "\x04", 300000);
+  const refused = loaded.split(`
+`).filter((line) => REFUSED.test(line));
+  if (refused.length)
+    throw await discard(`the device refused the plan, nothing was applied:
+    ${refused.join(`
+    `)}`);
+  const checked = await edit(channel, "commit check", 600000);
+  if (!/configuration check succeeds/.test(checked)) {
+    throw await discard(`commit check failed, nothing was applied:
+    ${checked.trim().split(`
+`).slice(1, 20).join(`
+    `)}`);
+  }
+  if (!guard) {
+    const committed = await edit(channel, "commit comment circuit", 600000);
+    if (!/commit complete/.test(committed))
+      throw await discard(`commit failed, nothing was applied:
+    ${committed.trim().slice(0, 300)}`);
+    await run(channel, "exit configuration-mode");
+    return;
+  }
+  const { minutes, prove } = guard;
+  const committed = await edit(channel, `commit confirmed ${minutes} comment circuit`, 600000);
+  if (!/commit complete/.test(committed)) {
+    throw await discard(`commit failed, nothing was applied:
+    ${committed.trim().split(`
+`).slice(1, 20).join(`
+    `)}`);
+  }
+  console.log(`  committed; it rolls back in ${minutes} minutes unless access is proved`);
+  try {
+    await prove();
+  } catch (error) {
+    await edit(channel, "rollback 1", 60000).catch(() => {
+      return;
+    });
+    await edit(channel, "commit comment circuit-restore", 600000).catch(() => {
+      return;
+    });
+    await run(channel, "exit configuration-mode").catch(() => {
+      return;
+    });
+    throw new Error(`a fresh login failed (${error.message}); the previous configuration is restored, at the latest in ${minutes} minutes`);
+  }
+  const confirmed = await edit(channel, "commit comment circuit-confirmed", 600000);
+  if (!/commit complete/.test(confirmed)) {
+    throw new Error(`access was proved but the confirmation failed; the device rolls back in ${minutes} minutes:
+    ${confirmed.trim().slice(0, 300)}`);
+  }
+  await run(channel, "exit configuration-mode");
+  console.log("  logged in again, commit confirmed");
+}
+async function apply(device, _network, plan, options) {
+  const client = await login(device);
+  try {
+    await checkVersion(client, device);
+    const channel = await shell(client);
+    await openCli(channel);
+    await configure(channel, plan, {
+      minutes: options.rollback,
+      prove: async () => {
+        const proof = await login(device);
+        proof.end();
+      }
+    });
+    channel.end();
+  } finally {
+    client.end();
+  }
+}
+function unsupported(device) {
+  const found = [];
+  const names = new Names(device);
+  const users = device.users ?? {};
+  const root = users.root;
+  if (!root)
+    found.push("users without root, the platform needs a root password");
+  if (root && root.role !== "admin")
+    found.push("users.root.role, root is always admin");
+  if (root?.description)
+    found.push("users.root.description");
+  if (device.connection.user === "root")
+    found.push("connection.user root, which logs in to a shell rather than the CLI");
+  for (const [name, user] of Object.entries(users)) {
+    if (SYSTEM_ACCOUNTS.has(name))
+      found.push(`users.${name}, a name the platform keeps for a system account`);
+    for (const key of user.ssh_keys ?? []) {
+      const kind = key.split(" ")[0];
+      if (!KEY_STATEMENT[kind])
+        found.push(`users.${name}.ssh_keys, a key of type ${kind}`);
+    }
+  }
+  const management = device.management ?? {};
+  for (const field of ["https", "api_tls", "privilege_password"]) {
+    if (management[field])
+      found.push(`management.${field}`);
+  }
+  if (management.console)
+    found.push("management.console, the console uses the device's users");
+  if (management.native?.interfaces?.length)
+    found.push("management.native.interfaces, NETCONF runs over IP only");
+  if (management.ssh?.auth_timeout || management.ssh?.auth_retries)
+    found.push("management.ssh.auth_timeout and auth_retries");
+  for (const service of ["telnet", "ftp", "snmp"]) {
+    if (management[service]?.port)
+      found.push(`management.${service}.port`);
+  }
+  const system = device.system ?? {};
+  if (system.release_channel)
+    found.push("system.release_channel");
+  if (system.transceiver_monitoring !== undefined)
+    found.push("system.transceiver_monitoring, it is always on");
+  if (system.dns?.serve)
+    found.push("system.dns.serve");
+  if (system.ip?.syn_cookies)
+    found.push("system.ip.syn_cookies");
+  if (system.logging?.local?.lines_per_file !== undefined)
+    found.push("system.logging.local.lines_per_file, files rotate by size");
+  if (system.ntp && !system.ntp.serve && system.ntp.servers.some((server) => !isAddress2(server))) {
+    found.push("system.ntp.servers by name while not serving, the filter keeping others out needs addresses");
+  }
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    const physical = names.port(name);
+    if (physical.startsWith("em")) {
+      for (const field of [
+        "access_vlan",
+        "trunk_vlans",
+        "native_vlan",
+        "lag",
+        "stp",
+        "storm_control",
+        "speed",
+        "vrrp",
+        "vrf",
+        "mtu",
+        "acl",
+        "ipv6_ra"
+      ]) {
+        if (port[field] !== undefined)
+          found.push(`ports.${name}.${field}, a management port only routes`);
+      }
+    }
+    if (port.speed && !(port.speed === "1g" && physical.startsWith("ge-")))
+      found.push(`ports.${name}.speed ${port.speed}, only a 1G optic in a 10G cage`);
+    if (port.hardware_offload !== undefined)
+      found.push(`ports.${name}.hardware_offload`);
+    const acl = port.acl ? device.acls?.[port.acl] : undefined;
+    if (acl?.some((rule) => rule.match?.vlan))
+      found.push(`acls.${port.acl} matching a VLAN, on port ${name}`);
+    found.push(...routedGaps(`ports.${name}`, port));
+    found.push(...switchedGaps(`ports.${name}`, port, device));
+  }
+  const loopbackTables = new Set;
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "vxlan" || iface.type === "wireguard") {
+      found.push(`interfaces.${name}, a ${iface.type}`);
+      continue;
+    }
+    if (iface.hardware_offload !== undefined)
+      found.push(`interfaces.${name}.hardware_offload`);
+    if (iface.type === "loopback" && iface.ipv6_ra)
+      found.push(`interfaces.${name}.ipv6_ra, on a loopback`);
+    if (iface.type === "loopback" && iface.mtu !== undefined)
+      found.push(`interfaces.${name}.mtu, on a loopback`);
+    if (iface.type === "gre" && iface.vrrp?.length)
+      found.push(`interfaces.${name}.vrrp, on a tunnel`);
+    if (iface.type === "vlan" && iface.mtu !== undefined) {
+      const smallest = Math.min(...carriers(device, iface.vlan));
+      if (iface.mtu > smallest)
+        found.push(`interfaces.${name}.mtu ${iface.mtu}, above the ${smallest} its VLAN's ports carry`);
+    }
+    found.push(...routedGaps(`interfaces.${name}`, iface));
+    if (iface.type === "lag")
+      found.push(...switchedGaps(`interfaces.${name}`, iface, device));
+    if (iface.type === "loopback") {
+      const table = iface.vrf ?? "";
+      if (loopbackTables.has(table))
+        found.push(`interfaces.${name}, a second loopback in one routing table`);
+      loopbackTables.add(table);
+      if (iface.vrrp?.length)
+        found.push(`interfaces.${name}.vrrp, on a loopback`);
+    }
+  }
+  const ids = [...lagIds(device).values()];
+  if (ids.length !== new Set(ids).size)
+    found.push("interfaces, two LAGs with one number");
+  if (device.stp?.priority !== undefined && device.stp.priority % 4096 !== 0)
+    found.push("stp.priority, in steps of 4096");
+  const routing = device.routing;
+  found.push(...bgpGaps(device));
+  const tables = new Map;
+  for (const route of routing?.static ?? []) {
+    if (route.description)
+      found.push(`routing.static ${route.prefix} description`);
+    const table = `${route.vrf ?? ""} ${split(route.prefix).addr}/${split(route.prefix).len}`;
+    tables.set(table, (tables.get(table) ?? 0) + 1);
+  }
+  for (const route of routing?.static ?? []) {
+    const table = `${route.vrf ?? ""} ${split(route.prefix).addr}/${split(route.prefix).len}`;
+    if (route.blackhole && tables.get(table) > 1)
+      found.push(`routing.static ${route.prefix}, a blackhole beside another route to the same prefix`);
+  }
+  for (const area of Object.values(routing?.ospf?.areas ?? {})) {
+    for (const iface of Object.keys(area.interfaces)) {
+      const settings = device.interfaces?.[iface] ?? device.ports?.[iface];
+      if (settings?.vrf)
+        found.push(`routing.ospf on ${iface}, which routes in a VRF`);
+    }
+  }
+  for (const field of ["firewall", "hardware_offload", "certificates"]) {
+    if (device[field] !== undefined)
+      found.push(field);
+  }
+  const relayed = new Set(Object.values(device.dhcp_relay ?? {}).map((relay) => relay.interface));
+  for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+    if (relayed.has(server.interface))
+      found.push(`dhcp.${name}.interface, which a DHCP relay also uses`);
+    const settings = device.interfaces?.[server.interface] ?? device.ports?.[server.interface];
+    if (settings?.vrf)
+      found.push(`dhcp.${name}.interface, which routes in a VRF`);
+    if (familyOf2(host2(server.network)) === "ipv6")
+      found.push(`dhcp.${name}.network, IPv6`);
+  }
+  for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
+    if (relay.servers.some((server) => familyOf2(server) === "ipv6"))
+      found.push(`dhcp_relay.${name}.servers, IPv6`);
+  }
+  const flow = device.flow_export;
+  if (flow && flow.protocol !== "sflow")
+    found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
+  if (flow?.protocol === "sflow" && flow.sampling === undefined)
+    found.push("flow_export.sampling, the platform samples");
+  for (const name of flow?.interfaces ?? []) {
+    if (names.members(name).some((port) => port.startsWith("em")))
+      found.push(`flow_export.interfaces ${name}, a management port`);
+  }
+  return found;
+}
+function carriers(device, vlan) {
+  const sizes = [1500];
+  const carrying = [...Object.values(device.ports ?? {}), ...Object.values(device.interfaces ?? {})];
+  for (const settings of carrying) {
+    if (!settings || !(("access_vlan" in settings) || ("trunk_vlans" in settings)))
+      continue;
+    const members = [settings.access_vlan, settings.native_vlan, ...settings.trunk_vlans ?? []];
+    if (members.includes(vlan))
+      sizes.push(settings.mtu ?? 1500);
+  }
+  return sizes.length > 1 ? sizes.slice(1) : sizes;
+}
+function bgpGaps(device) {
+  const found = [];
+  const bgp = device.routing?.bgp;
+  for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+    const settings = settingsOf(device, neighbor);
+    if (settings.role)
+      found.push(`routing.bgp.neighbors.${name}.role, Junos 21 has no BGP roles`);
+    if (familyOf2(neighbor.address) === "ipv6" && settings.families?.includes("ipv4")) {
+      found.push(`routing.bgp.neighbors.${name}.families ipv4 over an IPv6 session`);
+    }
+    if (settings.keepalive !== undefined)
+      found.push(`routing.bgp.neighbors.${name}.keepalive, the platform keeps it at a third of hold_time`);
+  }
+  for (const server of device.routing?.rpki ?? []) {
+    if (server.description)
+      found.push(`routing.rpki ${server.address} description`);
+  }
+  for (const [name, rules] of Object.entries(device.policies ?? {})) {
+    rules.forEach((rule, index) => {
+      const where = `policies.${name}[${index}]`;
+      if (rule.set?.preferred_source)
+        found.push(`${where}.set.preferred_source`);
+      if (rule.match?.prefix && rule.match.prefix_length)
+        found.push(`${where}.match.prefix with prefix_length`);
+    });
+  }
+  return found;
+}
+function routedGaps(where, settings) {
+  const found = [];
+  const addresses = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+  if (settings.addresses?.some((entry) => typeof entry !== "string"))
+    found.push(`${where}.addresses with a peer`);
+  for (const group of settings.vrrp ?? []) {
+    if (familyOf2(group.address) === "ipv6")
+      found.push(`${where}.vrrp ${group.id}, IPv6`);
+    else if (!vrrpAddress(addresses, group))
+      found.push(`${where}.vrrp ${group.id}, no address of the interface holds ${group.address}`);
+  }
+  return found;
+}
+function switchedGaps(where, settings, device) {
+  const found = [];
+  const storm = Object.values(settings.storm_control ?? {});
+  if (storm.some((threshold) => ("pps" in threshold)))
+    found.push(`${where}.storm_control in pps, the platform takes percent`);
+  else if (new Set(storm.map((threshold) => ("percent" in threshold) ? threshold.percent : 0)).size > 1) {
+    found.push(`${where}.storm_control, one threshold for every kind`);
+  }
+  if (typeof settings.stp === "object" && !device.stp)
+    found.push(`${where}.stp while spanning tree is off on the device`);
+  return found;
+}
+function fillPlan(set, prefixes) {
+  const list = `policy-options prefix-list ${set}`;
+  const send = [`delete ${list}`, `set ${list}`, ...prefixes.map((prefix) => `set ${list} ${prefix}`)];
+  return { steps: [{ title: list, show: [], send }], problems: [] };
+}
+async function fill(device, _network, set, _family, prefixes) {
+  const client = await login(device);
+  try {
+    await checkVersion(client, device);
+    const channel = await shell(client);
+    await openCli(channel);
+    await configure(channel, fillPlan(set, prefixes));
+    channel.end();
+    console.log(`  ${set}: ${prefixes.length} prefixes on the device`);
+  } finally {
+    client.end();
+  }
+}
+var junos = {
+  extension: ".conf",
+  unsupported,
+  render,
+  read,
+  plan,
+  apply,
+  fill
+};
+
+// src/core/time.ts
+function offset(zone) {
+  const name = new Intl.DateTimeFormat("en-US", {
+    timeZone: zone,
+    timeZoneName: "longOffset"
+  }).formatToParts(new Date).find((entry) => entry.type === "timeZoneName").value;
+  const found = /GMT([+-])(\d{2}):(\d{2})/.exec(name);
+  if (!found)
+    return 0;
+  const [, sign, hours, minutes] = found;
+  const sizeInMinutes = Number(hours) * 60 + Number(minutes);
+  return sign === "-" ? -sizeInMinutes : sizeInMinutes;
+}
+
 // src/adapters/devices/lines.ts
 var indentOf = (raw) => raw.length - raw.trimStart().length;
 function entries(text, dialect) {
@@ -391,10 +1959,10 @@ function steps(groups, dialect, around = nothingAround) {
   });
 }
 var STORED_CREDENTIAL = /(password (?:irreversible-)?cipher|community read cipher|^snmp-server community)( +)\S+/gm;
-var scrub = (text) => text.replace(STORED_CREDENTIAL, "$1$2<redacted>");
+var scrub2 = (text) => text.replace(STORED_CREDENTIAL, "$1$2<redacted>");
 
 // src/adapters/devices/raisecom-ros/index.ts
-var DEVICE_FACTS = [
+var DEVICE_FACTS2 = [
   "Being processed",
   "System current configuration",
   "recv-mode",
@@ -447,7 +2015,7 @@ var dialect = {
   block: /^(interface |access-list |router ospf )/,
   indented: false,
   terminator: "!",
-  ignore: (line) => line.startsWith("!") || DEVICE_FACTS.some((fact) => line.startsWith(fact)),
+  ignore: (line) => line.startsWith("!") || DEVICE_FACTS2.some((fact) => line.startsWith(fact)),
   undo,
   leave: "exit",
   canon: (line) => line.replace(/password (cipher )?(\S+)/, "password <secret>").replace(/community <secret:\w+>/, "community <redacted>").replace(/^snmp-server user (\S+) (?:authentication|authkey) (\S+) \S+ (?:privacy|privkey)\s+(\S+) \S+$/, "snmp-server user $1 $2 $3 <secret>").replace(/^(snmp-server access \S+ read \S+) notify internet (usm \S+)$/, "$1 $2"),
@@ -463,8 +2031,8 @@ var dialect = {
   }
 };
 var OSPF_PROCESS = 1;
-var SNMP_GROUP = "circuit";
-var SNMP_AUTH = { sha1: "sha" };
+var SNMP_GROUP2 = "circuit";
+var SNMP_AUTH2 = { sha1: "sha" };
 var MANAGEMENT_ACL = 1000;
 function vlanList(ids) {
   const sorted = [...new Set(ids)].sort((a, b) => a - b);
@@ -478,7 +2046,7 @@ function vlanList(ids) {
   }
   return ranges.join(",");
 }
-function render(device) {
+function render2(device) {
   const lines = [];
   const vlans = device.vlans ?? {};
   const vlanId = (name) => vlans[name].id;
@@ -496,7 +2064,7 @@ function render(device) {
       lines.push(`description ${lag.description}`);
     if (lag.mode === "static")
       lines.push("mode manual");
-    lines.push(...switching(lag, vlanId), "!");
+    lines.push(...switching2(lag, vlanId), "!");
   }
   if (allow.length) {
     lines.push(`access-list ${MANAGEMENT_ACL}`, "  description management");
@@ -570,11 +2138,11 @@ function render(device) {
     lines.push(`snmp-server community ${marker(snmp.community)} ro`);
   const snmpUsers = Object.entries(snmp?.users ?? {});
   if (snmpUsers.length)
-    lines.push(`snmp-server access ${SNMP_GROUP} read internet usm authpriv`);
+    lines.push(`snmp-server access ${SNMP_GROUP2} read internet usm authpriv`);
   for (const [name, user] of snmpUsers) {
-    const authentication = `authentication ${SNMP_AUTH[user.auth]} ${marker(user.auth_password)}`;
+    const authentication = `authentication ${SNMP_AUTH2[user.auth]} ${marker(user.auth_password)}`;
     const privacy = `privacy ${user.privacy} ${marker(user.privacy_password)}`;
-    lines.push(`snmp-server user ${name} ${authentication} ${privacy}`, `snmp-server group ${SNMP_GROUP} user ${name} usm`);
+    lines.push(`snmp-server user ${name} ${authentication} ${privacy}`, `snmp-server group ${SNMP_GROUP2} user ${name} usm`);
   }
   if ((snmp?.community || snmpUsers.length) && allow.length)
     lines.push(`snmp-server access-list ${MANAGEMENT_ACL}`);
@@ -603,7 +2171,7 @@ function render(device) {
 `) + `
 `;
 }
-function switching(settings, vlanId) {
+function switching2(settings, vlanId) {
   const lines = [];
   if (settings.access_vlan)
     lines.push(`switchport access vlan ${vlanId(settings.access_vlan)}`);
@@ -632,7 +2200,7 @@ function physicalPort(settings, vlanId, lagNumbers) {
     lines.push(`description ${settings.description}`);
   if (settings.lag)
     return [...lines, `port-channel ${lagNumbers.get(settings.lag)}`];
-  lines.push(...switching(settings, vlanId));
+  lines.push(...switching2(settings, vlanId));
   if (settings.lldp === false)
     lines.push("lldp disable");
   if (settings.stp === false)
@@ -668,7 +2236,7 @@ async function open(device) {
   await send(channel, "terminal page-break disable", 15000, 1000);
   return { channel, close };
 }
-async function read(device) {
+async function read2(device) {
   const { channel, close } = await open(device);
   try {
     const dump = await send(channel, "show running-config", 150000, 6000);
@@ -680,13 +2248,13 @@ async function read(device) {
     const body = lines.slice(start).filter((line) => line.startsWith("!") || !/[#>]\s*$/.test(line.trim()));
     const text = body.join(`
 `).replace(/^!(System (up )?time|Boot times):.*\n/gm, "").trim();
-    return scrub(text + `
+    return scrub2(text + `
 `).replace(/(authkey \S+|privkey\s+\S+) \S+/g, "$1 <redacted>");
   } finally {
     close();
   }
 }
-function unsupported(device) {
+function unsupported2(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -779,7 +2347,7 @@ function unsupported(device) {
       found.push(`management.${field}`);
   }
   for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
-    if (!SNMP_AUTH[user.auth])
+    if (!SNMP_AUTH2[user.auth])
       found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
   }
   if (management.snmp?.contact || management.snmp?.location)
@@ -801,10 +2369,10 @@ function unsupported(device) {
   found.push(...switchUnsupported(device));
   return found;
 }
-var REFUSED = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
+var REFUSED2 = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
 var CONFIRM = /^(portswitch|switchport trunk allowed vlan|switchport mode)/;
 var RELEASE = /^no (\S+ access-list \d+)$/;
-async function apply(device, _network, plan) {
+async function apply2(device, _network, plan) {
   const { channel, close } = await open(device);
   const released = [];
   try {
@@ -815,7 +2383,7 @@ async function apply(device, _network, plan) {
         const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line) && !/set successfully/i.test(answer);
         if (asks)
           answer += await send(channel, "y", 1e4, 1000);
-        if (REFUSED.test(answer))
+        if (REFUSED2.test(answer))
           throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
         const release = RELEASE.exec(line);
@@ -863,7 +2431,7 @@ function createdIds(line) {
   }
   return ids;
 }
-function plan(desired, current) {
+function plan2(desired, current) {
   const groups = compare(desired, current, dialect);
   const existing = entries(current, dialect);
   for (const group of groups) {
@@ -913,7 +2481,7 @@ function plan(desired, current) {
   }
   return { steps: planned, problems: [] };
 }
-var raisecom = { extension: ".txt", unsupported, render, read, plan, apply };
+var raisecom = { extension: ".txt", unsupported: unsupported2, render: render2, read: read2, plan: plan2, apply: apply2 };
 
 // src/adapters/devices/routeros/export.ts
 var unwrap = (text) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
@@ -1230,9 +2798,9 @@ var DYNAMIC = new Set([
   "/ip dhcp-server lease",
   "/interface bridge vlan"
 ]);
-var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
-var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote(raw);
-var findValue = (raw) => /^[\w.:-]+$/.test(raw) ? raw : quote(raw);
+var quote2 = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
+var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote2(raw);
+var findValue = (raw) => /^[\w.:-]+$/.test(raw) ? raw : quote2(raw);
 function find(menu, id) {
   const conditions = Object.entries(id).map(([property, raw]) => `${property}=${findValue(raw)}`);
   if (DYNAMIC.has(menu))
@@ -1347,7 +2915,7 @@ function planEntries(menu, wanted, existing, sendSecrets, problems) {
   for (const list of wholeLists) {
     const count = removed.filter((entry) => entry.attrs.list === list).length;
     removeStep.show.push(`- list ${list}, ${count} entr${count === 1 ? "y" : "ies"}`);
-    removeStep.send.push(`${menu} remove [ find list=${quote(list)} and !dynamic ]`);
+    removeStep.send.push(`${menu} remove [ find list=${quote2(list)} and !dynamic ]`);
   }
   for (const entry of removed) {
     if (wholeLists.has(entry.attrs.list ?? ""))
@@ -1379,19 +2947,19 @@ function planCertificates(wanted, existing) {
       const oldName = sameCertificate.attrs.name;
       renamed.add(oldName);
       install.show.push(`~ rename ${oldName} to ${name}`);
-      install.send.push(`${menu} set [ find name=${quote(oldName)} ] name=${quote(name)}`);
+      install.send.push(`${menu} set [ find name=${quote2(oldName)} ] name=${quote2(name)}`);
       continue;
     }
     install.show.push(`${current ? "~" : "+"} install ${name}`);
     if (current)
-      install.send.push(`${menu} remove [ find name=${quote(name)} ]`);
+      install.send.push(`${menu} remove [ find name=${quote2(name)} ]`);
     install.send.push(INSTALL_CERTIFICATE + name);
   }
   for (const entry of existing) {
     if (wantedNames.has(entry.attrs.name) || renamed.has(entry.attrs.name))
       continue;
     remove.show.push(`- ${entry.attrs.name}`);
-    remove.send.push(`${menu} remove [ find name=${quote(entry.attrs.name)} ]`);
+    remove.send.push(`${menu} remove [ find name=${quote2(entry.attrs.name)} ]`);
   }
   if (install.send.length)
     result.first.push(install);
@@ -1413,7 +2981,7 @@ function planOrdered(menu, wanted, existing) {
   const droppedChains = [...new Set(existing.map((item) => item.attrs.chain ?? ""))].filter((chain) => !keptChains.has(chain));
   let removeOld = `${menu} remove $${OLD_RULES}`;
   if (hasChains) {
-    const keep = [...keptChains].map((chain) => quote(chain)).join(";");
+    const keep = [...keptChains].map((chain) => quote2(chain)).join(";");
     const inKeptChain = `[:typeof [:find $keep [${menu} get $id chain]]] != "nil"`;
     removeOld = `:local keep {${keep}}; :foreach id in=$${OLD_RULES} do={ :if (${inKeptChain}) do={ ${menu} remove $id } }`;
   }
@@ -1426,13 +2994,13 @@ function planOrdered(menu, wanted, existing) {
   result.first.push({ title: `${menu}, in the order of the config`, show, send });
   if (hasChains) {
     for (const chain of droppedChains) {
-      const selector = `[ find chain=${quote(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
+      const selector = `[ find chain=${quote2(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
       result.last.push({ title: `${menu} chain ${chain}`, show: [`- chain ${chain}`], send: [`${menu} remove ${selector}`] });
     }
   }
   return result;
 }
-function plan2(desired, current, options) {
+function plan3(desired, current, options) {
   const want = parse(desired);
   const have = parse(current);
   const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
@@ -1479,7 +3047,7 @@ class Output {
 `;
   }
 }
-function quote2(value) {
+function quote3(value) {
   const plain = /^[\w.:/@-]+$/.test(value);
   if (plain)
     return value;
@@ -1491,18 +3059,18 @@ function command(verb, properties) {
   for (const [name, value] of Object.entries(properties)) {
     if (value === undefined || value === false)
       continue;
-    const written = typeof value === "number" ? String(value) : quote2(value);
+    const written = typeof value === "number" ? String(value) : quote3(value);
     words.push(`${name}=${written}`);
   }
   return words.join(" ");
 }
 var yesNo = (on) => on ? "yes" : "no";
 var familySuffix = (family) => family === "ipv4" ? "V4" : "V6";
-var eachPort = (ports) => [ports].flat().map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
+var eachPort2 = (ports) => [ports].flat().map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
 function portList(ports) {
   if (ports === undefined)
     return;
-  return eachPort(ports).join(",");
+  return eachPort2(ports).join(",");
 }
 function duration(seconds) {
   const units = [
@@ -1585,7 +3153,7 @@ function renderInterfaces(out, ctx) {
   bridge(out, ctx);
   ethernet(out, ctx);
   switchPorts(out, ctx);
-  lags(out, ctx);
+  lags2(out, ctx);
   vlanInterfaces(out, ctx);
   tunnels(out, ctx);
   wireguard(out, ctx);
@@ -1594,7 +3162,7 @@ function renderInterfaces(out, ctx) {
   bridgeVlans(out, ctx);
   bridgeFilters(out, ctx);
   interfaceLists(out, ctx);
-  vrfs(out, ctx);
+  vrfs2(out, ctx);
 }
 function hardwareOffload(out, ctx) {
   const on = yesNo(ctx.device.hardware_offload);
@@ -1669,7 +3237,7 @@ function switchPorts(out, ctx) {
     }));
   }
 }
-function lags(out, ctx) {
+function lags2(out, ctx) {
   for (const [name, lag] of Object.entries(ctx.interfaces)) {
     if (lag.type !== "lag")
       continue;
@@ -1865,7 +3433,7 @@ function lldpMembers(ctx) {
   }
   return [...members];
 }
-function vrfs(out, ctx) {
+function vrfs2(out, ctx) {
   for (const [vrf, settings] of Object.entries(ctx.device.vrfs ?? {})) {
     const members = ctx.routed().filter(({ settings: iface }) => iface.vrf === vrf).map(({ name }) => name);
     out.add("/ip vrf", command("add", { comment: settings.description, interfaces: members.join(","), name: vrf }));
@@ -2062,7 +3630,7 @@ function helpers(out, ctx) {
   }
 }
 function switchAcls(out, ctx) {
-  const each = (ports) => ports === undefined ? [undefined] : eachPort(ports);
+  const each = (ports) => ports === undefined ? [undefined] : eachPort2(ports);
   for (const [port, settings] of Object.entries(ctx.ports)) {
     if (!settings.acl)
       continue;
@@ -2091,8 +3659,8 @@ function switchAcls(out, ctx) {
     }
   }
 }
-var RPKI_GROUP = "rpki";
-var REJECT_ALL = "REJECT-ALL";
+var RPKI_GROUP2 = "rpki";
+var REJECT_ALL2 = "REJECT-ALL";
 var ROLES = {
   provider: "ebgp-customer",
   customer: "ebgp-provider",
@@ -2101,17 +3669,17 @@ var ROLES = {
   "rs-client": "ebgp-rs"
 };
 function renderRouting(out, ctx) {
-  staticRoutes(out, ctx);
-  rpki(out, ctx);
+  staticRoutes2(out, ctx);
+  rpki2(out, ctx);
   if (ctx.device.routing?.bgp) {
     bgpInstance(out, ctx);
     policies(out, ctx);
     bgpConnections(out, ctx);
   }
-  ospf(out, ctx);
+  ospf2(out, ctx);
   bfd(out, ctx);
 }
-function staticRoutes(out, ctx) {
+function staticRoutes2(out, ctx) {
   for (const route of ctx.device.routing?.static ?? []) {
     const menu = familyOf2(host2(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
     const verb = route.blackhole ? "add blackhole" : "add";
@@ -2125,12 +3693,12 @@ function staticRoutes(out, ctx) {
     }));
   }
 }
-function rpki(out, ctx) {
+function rpki2(out, ctx) {
   for (const server of ctx.device.routing?.rpki ?? []) {
     out.add("/routing rpki", command("add", {
       address: server.address,
       comment: server.description,
-      group: RPKI_GROUP,
+      group: RPKI_GROUP2,
       port: server.port
     }));
   }
@@ -2139,12 +3707,12 @@ function bgpInstance(out, ctx) {
   const bgp = ctx.device.routing.bgp;
   out.add("/routing bgp instance", command("add", { as: bgp.asn, name: "default", "router-id": ctx.device.routing?.router_id }));
 }
-function settingsOf(ctx, neighbor) {
+function settingsOf2(ctx, neighbor) {
   const group = neighbor.group ? ctx.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
   return { ...group, ...neighbor };
 }
 function familiesOf(ctx, neighbor) {
-  return settingsOf(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
+  return settingsOf2(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
 }
 var chainName = (policy, family) => `${policy}-${familySuffix(family)}`;
 function appliesTo(ctx, rule, family) {
@@ -2224,7 +3792,7 @@ function ruleText(rule, family) {
   if (rule.call)
     parts.push(`jump ${chainName(rule.call, family)}`);
   if (rule.match?.rpki)
-    parts.push(`rpki-verify ${RPKI_GROUP}`);
+    parts.push(`rpki-verify ${RPKI_GROUP2}`);
   const tests = conditions(rule);
   const steps = actions(rule, family);
   if (tests.length)
@@ -2249,7 +3817,7 @@ function policies(out, ctx) {
   };
   let rejectAllNeeded = false;
   for (const neighbor of Object.values(bgp.neighbors ?? {})) {
-    const settings = settingsOf(ctx, neighbor);
+    const settings = settingsOf2(ctx, neighbor);
     for (const family of familiesOf(ctx, neighbor)) {
       for (const policy of [settings.import, settings.export]) {
         if (policy)
@@ -2280,7 +3848,7 @@ function policies(out, ctx) {
   if (rejectAllNeeded) {
     for (const family of ["ipv4", "ipv6"])
       out.add("/routing filter rule", command("add", {
-        chain: chainName(REJECT_ALL, family),
+        chain: chainName(REJECT_ALL2, family),
         rule: "reject"
       }));
   }
@@ -2288,7 +3856,7 @@ function policies(out, ctx) {
 function bgpConnections(out, ctx) {
   const bgp = ctx.device.routing.bgp;
   for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
-    const settings = settingsOf(ctx, neighbor);
+    const settings = settingsOf2(ctx, neighbor);
     const [family] = familiesOf(ctx, neighbor);
     const addressFamily = familyOf2(neighbor.address);
     const internal = settings.remote_as === bgp.asn;
@@ -2299,7 +3867,7 @@ function bgpConnections(out, ctx) {
       as: bgp.asn,
       connect: settings.passive ? "no" : undefined,
       "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
-      "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+      "input.filter": chainName(settings.import ?? REJECT_ALL2, family),
       instance: "default",
       [`input.limit-process-routes-${family}`]: settings.max_prefixes,
       "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
@@ -2308,7 +3876,7 @@ function bgpConnections(out, ctx) {
       "local.role": role,
       multihop: settings.multihop ? "yes" : undefined,
       name,
-      "output.filter-chain": chainName(settings.export ?? REJECT_ALL, family),
+      "output.filter-chain": chainName(settings.export ?? REJECT_ALL2, family),
       "output.network": originates ? NETWORKS[family] : undefined,
       "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
       "remote.as": settings.remote_as,
@@ -2317,7 +3885,7 @@ function bgpConnections(out, ctx) {
     }));
   }
 }
-function ospf(out, ctx) {
+function ospf2(out, ctx) {
   const ospf = ctx.device.routing?.ospf;
   if (!ospf)
     return;
@@ -2348,7 +3916,7 @@ function ospf(out, ctx) {
 }
 function bfd(out, ctx) {
   const routing = ctx.device.routing;
-  const bgpWants = Object.values(routing?.bgp?.neighbors ?? {}).some((neighbor) => settingsOf(ctx, neighbor).bfd);
+  const bgpWants = Object.values(routing?.bgp?.neighbors ?? {}).some((neighbor) => settingsOf2(ctx, neighbor).bfd);
   const ospfWants = Object.values(routing?.ospf?.areas ?? {}).some((area) => Object.values(area.interfaces).some((iface) => iface?.bfd));
   if (bgpWants || ospfWants)
     out.add("/routing bfd configuration", command("add", { interfaces: "all" }));
@@ -2364,16 +3932,16 @@ var SERVICES = {
   native: "winbox"
 };
 var USER_GROUPS = { admin: "full", operator: "write", "read-only": "read" };
-var SNMP_AUTH2 = { sha1: "SHA1", sha256: "SHA1" };
-var SNMP_PRIVACY = { aes128: "AES", des: "DES" };
+var SNMP_AUTH3 = { sha1: "SHA1", sha256: "SHA1" };
+var SNMP_PRIVACY2 = { aes128: "AES", des: "DES" };
 function renderManagement(out, ctx) {
-  services(out, ctx);
+  services2(out, ctx);
   layerTwo(out, ctx);
-  snmp(out, ctx);
-  users(out, ctx);
+  snmp2(out, ctx);
+  users2(out, ctx);
   certificates(out, ctx);
 }
-function services(out, ctx) {
+function services2(out, ctx) {
   const management = ctx.device.management ?? {};
   for (const [neutral, platform] of Object.entries(SERVICES)) {
     const service = management[neutral];
@@ -2405,7 +3973,7 @@ function layerTwo(out, ctx) {
     discovery = "all";
   out.add("/ip neighbor discovery-settings", command("set", { "discover-interface-list": discovery, protocol: "lldp" }));
 }
-function snmp(out, ctx) {
+function snmp2(out, ctx) {
   const management = ctx.device.management ?? {};
   const snmp = management.snmp;
   if (!snmp) {
@@ -2423,15 +3991,15 @@ function snmp(out, ctx) {
     out.add("/snmp community", command("add", {
       addresses: allow,
       "authentication-password": marker(user.auth_password),
-      "authentication-protocol": SNMP_AUTH2[user.auth],
+      "authentication-protocol": SNMP_AUTH3[user.auth],
       "encryption-password": marker(user.privacy_password),
-      "encryption-protocol": SNMP_PRIVACY[user.privacy],
+      "encryption-protocol": SNMP_PRIVACY2[user.privacy],
       name,
       security: "private"
     }));
   }
 }
-function users(out, ctx) {
+function users2(out, ctx) {
   for (const [name, user] of Object.entries(ctx.device.users ?? {})) {
     out.add("/user", command("add", {
       comment: user.description,
@@ -2526,7 +4094,7 @@ function flowExport(out, ctx) {
     out.add("/ip traffic-flow target", command("add", { "dst-address": collector.address, port: collector.port ?? 2055, version }));
   }
 }
-function render2(device) {
+function render3(device) {
   const out = new Output;
   const ctx = new Context(device);
   renderInterfaces(out, ctx);
@@ -2539,8 +4107,8 @@ function render2(device) {
 }
 
 // src/adapters/devices/routeros/index.ts
-var SUPPORTED_MAJOR = 7;
-async function login(device) {
+var SUPPORTED_MAJOR2 = 7;
+async function login2(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -2551,11 +4119,11 @@ async function login(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion(client, device) {
+async function checkVersion2(client, device) {
   const version = (await exec(client, ":put [/system resource get version]")).trim();
   const major = Number(version.split(".")[0]);
-  if (major !== SUPPORTED_MAJOR) {
-    throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR}`);
+  if (major !== SUPPORTED_MAJOR2) {
+    throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR2}`);
   }
 }
 var EXPORT_TIMESTAMP = /^# \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} by RouterOS/m;
@@ -2567,10 +4135,10 @@ var LIST_CERTIFICATES = [
   ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
   "}"
 ].join(" ");
-async function read2(device) {
-  const client = await login(device);
+async function read3(device) {
+  const client = await login2(device);
   try {
-    await checkVersion(client, device);
+    await checkVersion2(client, device);
     const config = await exec(client, "/export", 300000);
     const users = await exec(client, "/user export");
     const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
@@ -2591,7 +4159,7 @@ ${certificates}` : "";
     client.end();
   }
 }
-function unsupported2(device) {
+function unsupported3(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -2665,9 +4233,9 @@ async function installCertificate(client, device, name) {
   }
   await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
-async function apply2(device, _network, changes, options) {
-  const client = await login(device);
-  await checkVersion(client, device);
+async function apply3(device, _network, changes, options) {
+  const client = await login2(device);
+  await checkVersion2(client, device);
   const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
   for (const { title, command } of commands) {
     if (command.startsWith(INSTALL_CERTIFICATE))
@@ -2713,7 +4281,7 @@ async function apply2(device, _network, changes, options) {
     throw new Error("apply failed and the backup is being restored");
   }
   client.end();
-  const proof = await login(device).catch(() => {
+  const proof = await login2(device).catch(() => {
     return;
   });
   if (!proof)
@@ -2723,10 +4291,10 @@ async function apply2(device, _network, changes, options) {
   proof.end();
   console.log("  logged in again, rollback disarmed");
 }
-async function fill(device, _network, set, family, prefixes) {
+async function fill2(device, _network, set, family, prefixes) {
   const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
   const batchSize = 60;
-  const client = await login(device);
+  const client = await login2(device);
   try {
     await exec(client, `${menu} remove [find list="${set}" and !dynamic]`);
     for (let start = 0;start < prefixes.length; start += batchSize) {
@@ -2743,16 +4311,16 @@ async function fill(device, _network, set, family, prefixes) {
 }
 var routeros = {
   extension: ".rsc",
-  unsupported: unsupported2,
-  render: render2,
-  read: read2,
-  plan: plan2,
-  apply: apply2,
-  fill
+  unsupported: unsupported3,
+  render: render3,
+  read: read3,
+  plan: plan3,
+  apply: apply3,
+  fill: fill2
 };
 
 // src/adapters/devices/vrp/index.ts
-var DEVICE_FACTS2 = [
+var DEVICE_FACTS3 = [
   "!",
   "device ",
   "system resource",
@@ -2807,7 +4375,7 @@ var dialect2 = {
   block: /^(interface |vlan \d+$|acl number |aaa$|user-interface |ospf |ip vpn-instance |bfd$)/,
   indented: true,
   terminator: "#",
-  ignore: (line) => DEVICE_FACTS2.some((fact) => line.startsWith(fact)),
+  ignore: (line) => DEVICE_FACTS3.some((fact) => line.startsWith(fact)),
   undo: undo2,
   leave: "quit",
   first: /^authentication-mode /,
@@ -2817,10 +4385,10 @@ var dialect2 = {
 var MANAGEMENT_ACL2 = 2000;
 var OSPF_PROCESS2 = 1;
 var FIRST_COLLECTOR = 1;
-var SNMP_GROUP2 = "circuit";
+var SNMP_GROUP3 = "circuit";
 var USER_LEVEL = { admin: 3, operator: 2, "read-only": 1 };
-var SNMP_AUTH3 = { sha1: "sha", sha256: "sha2-256" };
-var SNMP_PRIVACY2 = { aes128: "aes128", des: "des56" };
+var SNMP_AUTH4 = { sha1: "sha", sha256: "sha2-256" };
+var SNMP_PRIVACY3 = { aes128: "aes128", des: "des56" };
 function batchIds(line) {
   const words = line.replace(/^vlan batch /, "").split(" ");
   const ids = [];
@@ -2867,7 +4435,7 @@ class Config {
 `;
   }
 }
-function render3(device) {
+function render4(device) {
   const config = new Config;
   const vlans = device.vlans ?? {};
   const vlanId = (name) => vlans[name].id;
@@ -2881,14 +4449,14 @@ function render3(device) {
       return `Vlanif${vlanId(iface.vlan)}`;
     return spell(device.platform, device.model, portOrInterface);
   };
-  system(config, device);
+  system2(config, device);
   vlanBlocks(config, device);
   managementAcl(config, device);
-  users2(config, device);
-  vrfs2(config, device);
+  users3(config, device);
+  vrfs3(config, device);
   for (const [name, lag] of Object.entries(interfaces)) {
     if (lag.type === "lag")
-      config.block(`interface ${nameOf(name)}`, [...lagMode(lag), ...switching2(lag, vlanId)]);
+      config.block(`interface ${nameOf(name)}`, [...lagMode(lag), ...switching3(lag, vlanId)]);
   }
   for (const [name, iface] of Object.entries(interfaces)) {
     if (iface.type === "vlan")
@@ -2898,8 +4466,8 @@ function render3(device) {
     const settings = device.ports?.[port];
     config.block(`interface ${nameOf(port)}`, physicalPort2(device, port, settings, vlanId, lagNumbers));
   }
-  staticRoutes2(config, device, nameOf);
-  ospf2(config, device, nameOf);
+  staticRoutes3(config, device, nameOf);
+  ospf3(config, device, nameOf);
   if (wantsBfd(device))
     config.block("bfd", []);
   if (device.dhcp_relay && Object.keys(device.dhcp_relay).length) {
@@ -2907,12 +4475,12 @@ function render3(device) {
     config.separator();
   }
   flowExport2(config, device);
-  snmp2(config, device);
+  snmp3(config, device);
   ssh(config, device);
   userInterfaces(config, device);
   return config.text();
 }
-function system(config, device) {
+function system2(config, device) {
   config.line(`sysname ${device.name}`);
   config.separator();
   const timezone = device.system?.timezone;
@@ -2967,7 +4535,7 @@ function managementAcl(config, device) {
   const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host2(cidr)} ${wildcard(split(cidr).len)}`);
   config.block(`acl number ${MANAGEMENT_ACL2}`, ["description Management access", ...rules, `rule ${(allow.length + 1) * 5} deny`]);
 }
-function users2(config, device) {
+function users3(config, device) {
   const lines = [];
   for (const [name, user] of Object.entries(device.users ?? {})) {
     lines.push(`local-user ${name} password irreversible-cipher ${marker(user.password)}`);
@@ -2976,7 +4544,7 @@ function users2(config, device) {
   }
   config.block("aaa", lines);
 }
-function vrfs2(config, device) {
+function vrfs3(config, device) {
   for (const name of Object.keys(device.vrfs ?? {}))
     config.block(`ip vpn-instance ${name}`, ["ipv4-family"]);
 }
@@ -2986,7 +4554,7 @@ function lagMode(lag) {
     lines.unshift(`description ${lag.description}`);
   return lines;
 }
-function switching2(settings, vlanId) {
+function switching3(settings, vlanId) {
   const lines = [];
   if (settings.access_vlan)
     lines.push(`port default vlan ${vlanId(settings.access_vlan)}`);
@@ -3079,7 +4647,7 @@ function physicalPort2(device, port, settings, vlanId, lagNumbers) {
   const lines = [];
   if (settings.description)
     lines.push(`description ${settings.description}`);
-  lines.push(...switching2(settings, vlanId));
+  lines.push(...switching3(settings, vlanId));
   if (settings.lldp === false)
     lines.push("lldp disable");
   const flow = device.flow_export;
@@ -3092,7 +4660,7 @@ function physicalPort2(device, port, settings, vlanId, lagNumbers) {
   }
   return lines;
 }
-function staticRoutes2(config, device, nameOf) {
+function staticRoutes3(config, device, nameOf) {
   for (const route of device.routing?.static ?? []) {
     const { addr, len } = split(route.prefix);
     const nextHop = route.blackhole ? "NULL0" : route.via ?? nameOf(route.interface);
@@ -3106,7 +4674,7 @@ function staticRoutes2(config, device, nameOf) {
   }
   config.separator();
 }
-function ospf2(config, device, nameOf) {
+function ospf3(config, device, nameOf) {
   const ospf = device.routing?.ospf;
   if (!ospf)
     return;
@@ -3141,7 +4709,7 @@ function flowExport2(config, device) {
   });
   config.separator();
 }
-function snmp2(config, device) {
+function snmp3(config, device) {
   const snmp = device.management?.snmp;
   if (!snmp)
     return;
@@ -3157,11 +4725,11 @@ function snmp2(config, device) {
     config.line(`snmp-agent community read cipher ${marker(snmp.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
   if (snmp.users) {
     config.line("snmp-agent mib-view included all iso");
-    config.line(`snmp-agent group v3 ${SNMP_GROUP2} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
+    config.line(`snmp-agent group v3 ${SNMP_GROUP3} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
     for (const [name, user] of Object.entries(snmp.users)) {
-      config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP2}`);
-      config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH3[user.auth]} cipher ${marker(user.auth_password)}`);
-      config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY2[user.privacy]} cipher ${marker(user.privacy_password)}`);
+      config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP3}`);
+      config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH4[user.auth]} cipher ${marker(user.auth_password)}`);
+      config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY3[user.privacy]} cipher ${marker(user.privacy_password)}`);
     }
   }
   config.separator();
@@ -3195,7 +4763,7 @@ function userInterfaces(config, device) {
   config.block("user-interface vty 0 4", ["authentication-mode aaa", `protocol inbound ${device.management?.telnet ? "all" : "ssh"}`]);
 }
 var HOST_KEYS2 = ["ssh-rsa"];
-async function login2(device) {
+async function login3(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -3215,8 +4783,8 @@ async function openShell(client) {
   await send(channel, "screen-length 0 temporary", 1e4, 1500);
   return channel;
 }
-async function read3(device) {
-  const client = await login2(device);
+async function read4(device) {
+  const client = await login3(device);
   try {
     const channel = await openShell(client);
     const dump = await send(channel, "display current-configuration", 120000, 3000);
@@ -3227,14 +4795,14 @@ async function read3(device) {
     if (start < 0)
       throw new Error(`${device.name} returned no configuration`);
     const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
-    return scrub(body.join(`
+    return scrub2(body.join(`
 `).trim() + `
 `);
   } finally {
     client.end();
   }
 }
-function unsupported3(device) {
+function unsupported4(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -3313,7 +4881,7 @@ function unsupported3(device) {
   }
   return found;
 }
-var REFUSED2 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
+var REFUSED3 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
 var INTERACTIVE = /^(snmp-agent usm-user v3 \S+ (?:authentication|privacy)-mode \S+) cipher <secret:([A-Za-z0-9_./:-]+)>$/;
 async function sendLine(channel, line) {
   const interactive = INTERACTIVE.exec(line.trim());
@@ -3330,21 +4898,21 @@ async function sendLine(channel, line) {
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply3(device, _network, plan) {
-  const client = await login2(device);
+async function apply4(device, _network, plan) {
+  const client = await login3(device);
   const channel = await openShell(client);
   try {
     await send(channel, "system-view", 1e4, 1500);
     for (const step of plan.steps) {
       for (const line of step.send) {
         const answer = await sendLine(channel, line);
-        if (REFUSED2.test(answer))
+        if (REFUSED3.test(answer))
           throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
       }
     }
     const committed = await send(channel, "commit", 60000, 3000);
-    if (REFUSED2.test(committed))
+    if (REFUSED3.test(committed))
       throw new Error(`commit refused: ${committed.trim().slice(0, 300)}`);
     await send(channel, "quit", 1e4);
   } catch (error) {
@@ -3355,7 +4923,7 @@ async function apply3(device, _network, plan) {
     client.end();
     throw error;
   }
-  const proof = await login2(device).catch(() => {
+  const proof = await login3(device).catch(() => {
     return;
   });
   if (!proof) {
@@ -3371,7 +4939,7 @@ async function apply3(device, _network, plan) {
   client.end();
   console.log("  committed, login proved, saved");
 }
-function plan3(desired, current) {
+function plan4(desired, current) {
   const groups = compare(desired, current, dialect2);
   vlanListChange(groups, "vlan batch ", batchIds, (ids) => [`vlan batch ${vlanBatch(ids)}`], (ids) => [`vlan batch ${vlanBatch(ids)}`]);
   const top = groups.find((group) => group.path.length === 0);
@@ -3393,15 +4961,15 @@ function plan3(desired, current) {
 }
 var vrp = {
   extension: ".cfg",
-  unsupported: unsupported3,
-  render: render3,
-  read: read3,
-  plan: plan3,
-  apply: apply3
+  unsupported: unsupported4,
+  render: render4,
+  read: read4,
+  plan: plan4,
+  apply: apply4
 };
 
 // src/adapters/devices/index.ts
-var adapters = { routeros, vrp, "raisecom-ros": raisecom };
+var adapters = { routeros, vrp, "raisecom-ros": raisecom, junos };
 
 // src/adapters/registries/index.ts
 async function ripeStat(query, family) {
@@ -3422,7 +4990,7 @@ var registries = { "ripe-stat": ripeStat };
 // src/adapters/registries/librenms.ts
 var AUTH = { sha1: "SHA", sha256: "SHA-256" };
 var PRIVACY = { aes128: "AES", des: "DES" };
-function settingsOf2(network) {
+function settingsOf3(network) {
   if (!network.librenms)
     throw new Error("the network has no librenms settings");
   return {
@@ -3449,7 +5017,7 @@ function credentials(device) {
   return;
 }
 async function planLibreNms(network) {
-  const { base, headers } = settingsOf2(network);
+  const { base, headers } = settingsOf3(network);
   const response = await fetch(`${base}/devices?type=all`, { headers, signal: AbortSignal.timeout(30000) });
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
@@ -3463,7 +5031,7 @@ async function planLibreNms(network) {
   };
 }
 async function sendLibreNms(network, additions) {
-  const { base, headers } = settingsOf2(network);
+  const { base, headers } = settingsOf3(network);
   for (const device of additions) {
     const body = { hostname: device.connection.host, display_template: device.name, ...credentials(device) };
     const response = await fetch(`${base}/devices`, {
@@ -3749,7 +5317,7 @@ function checkAddresses(holders) {
   const first = new Map;
   const isLoopback = (holder) => holder.device.interfaces?.[holder.name]?.type === "loopback";
   for (const holder of holders) {
-    const key = keyOf(host2(holder.address));
+    const key = `${holder.vrf ?? ""} ${keyOf(host2(holder.address))}`;
     const earlier = first.get(key);
     if (!earlier) {
       first.set(key, holder);
@@ -3853,7 +5421,9 @@ function checkTunnels(devices, owners) {
       continue;
     const report = (message) => findings.push({ level: "error", device: end.device.name, message: `interface ${end.name}: ${message}` });
     const kind = end.iface.type === "gre" ? "GRE" : "VXLAN";
-    const mirror = ends.find((other) => other.device === far && other.iface.type === end.iface.type && same(other.iface.local, end.iface.remote) && same(other.iface.remote, end.iface.local));
+    const back = ends.filter((other) => other.device === far && other.iface.type === end.iface.type && same(other.iface.local, end.iface.remote) && same(other.iface.remote, end.iface.local));
+    const vniOf = (iface) => iface.type === "vxlan" ? iface.vni : undefined;
+    const mirror = back.find((other) => vniOf(other.iface) === vniOf(end.iface)) ?? back[0];
     if (!mirror) {
       report(`${end.iface.remote} is ${far.name}'s, which has no ${kind} tunnel from there back to ${end.iface.local}`);
       continue;
@@ -3895,7 +5465,7 @@ function validate(network) {
   return findings;
 }
 
-class Names {
+class Names2 {
   device;
   report;
   ports;
@@ -3922,7 +5492,7 @@ class Names {
   }
 }
 function checkDevice(device, report) {
-  const names = new Names(device, report);
+  const names = new Names2(device, report);
   const cidr = (where, value) => {
     if (!isCidr2(value))
       report(`${where}: '${value}' is not an address with a length`);
@@ -3966,9 +5536,10 @@ function checkAddresses2(device, report, cidr, ip) {
       if (typeof entry !== "string")
         ip(where, entry.peer);
       const bare = address.split("/")[0];
-      if (holderOf.has(bare))
-        report(`${bare} is on both ${holderOf.get(bare)} and ${where}`);
-      holderOf.set(bare, where);
+      const key = `${settings?.vrf ?? ""} ${bare}`;
+      if (holderOf.has(key))
+        report(`${bare} is on both ${holderOf.get(key)} and ${where}`);
+      holderOf.set(key, where);
     }
     for (const group of settings?.vrrp ?? []) {
       ip(`${where} VRRP ${group.id}`, group.address);
@@ -4824,7 +6395,7 @@ async function studioCommand() {
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { isLoopback, studio } = await import("../chunks/server-ckdy25w2.js");
+  const { isLoopback, studio } = await import("../chunks/server-n2q4tzy4.js");
   const host = flagValue("host") ?? "127.0.0.1";
   const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
   if (!isLoopback(host) && !allowHosts.length) {
@@ -4850,9 +6421,9 @@ var commands = {
   graph: graphCommand,
   studio: studioCommand
 };
-var run = commands[command2];
-if (run)
-  await run();
+var run2 = commands[command2];
+if (run2)
+  await run2();
 else
   fail(`no command ${command2}