@takodotid/circuit 0.25.0 → 0.26.1

package/dist/cli/index.js

@@ -11,7 +11,7 @@ import {
   addressesOf,
   freeOfLength,
   studioData
-} from "../chunks/index-wm9ypkjq.js";
+} from "../chunks/index-22sbskdx.js";
 import {
   familyOf2,
   split,
@@ -202,6 +202,2732 @@ function upload(client, path, content) {
   });
 }
 
+// src/adapters/devices/fortios/names.ts
+function nameOf(device, name) {
+  if (device.interfaces && name in device.interfaces)
+    return name;
+  return spell(device.platform, device.model, name);
+}
+function settingsOf(device, name) {
+  return device.interfaces?.[name] ?? device.ports?.[name];
+}
+function addressesOf2(settings) {
+  return (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+}
+var withLength = (value) => value.includes("/") ? value : `${value}/${familyOf2(value) === "ipv4" ? 32 : 128}`;
+var familyOfPrefix = (value) => familyOf2(split(withLength(value)).addr);
+var subnet = (prefix) => `${host2(prefix)} ${netmask(split(prefix).len)}`;
+var network2 = (prefix) => network(withLength(prefix));
+function vrfNumber(device, vrf) {
+  return vrf ? Object.keys(device.vrfs ?? {}).indexOf(vrf) + 1 : 0;
+}
+function routedHolders(device) {
+  const holders = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})];
+  return holders.filter((holder) => holder[1] !== undefined && !holder[1].lag);
+}
+function interfaceFor(device, address, vrf) {
+  let best;
+  for (const [name, settings] of routedHolders(device)) {
+    if ((settings.vrf ?? undefined) !== vrf)
+      continue;
+    for (const own of addressesOf2(settings)) {
+      const length = split(own).len;
+      const holds = familyOf2(host2(own)) === familyOf2(address) && contains2(network2(own), address);
+      if (holds && length > (best?.length ?? -1))
+        best = { name, length };
+    }
+  }
+  return best?.name;
+}
+function holderOf(device, address) {
+  return routedHolders(device).find(([, settings]) => addressesOf2(settings).some((own) => host2(own) === address))?.[0];
+}
+function addressed(device) {
+  return routedHolders(device).filter(([, settings]) => addressesOf2(settings).length > 0).map(([name]) => name);
+}
+
+// src/adapters/devices/fortios/tree.ts
+var UNSET = "\x00unset";
+
+class Block {
+  settings = new Map;
+  blocks = new Map;
+  entries = new Map;
+  set(key, value) {
+    this.settings.set(key, String(value));
+    return this;
+  }
+  block(header) {
+    if (!this.blocks.has(header))
+      this.blocks.set(header, new Block);
+    return this.blocks.get(header);
+  }
+  entry(id, plain = false) {
+    const written = typeof id === "number" || plain ? String(id) : quote(id);
+    const key = bare(written);
+    if (!this.entries.has(key))
+      this.entries.set(key, { id: written, block: new Block });
+    return this.entries.get(key).block;
+  }
+  isEmpty() {
+    return !this.settings.size && !this.blocks.size && !this.entries.size;
+  }
+}
+function quote(text) {
+  return `"${text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"")}"`;
+}
+var quoteAll = (texts) => texts.map(quote).join(" ");
+function wordsOf(value) {
+  return value.match(/"(?:[^"\\]|\\.)*"|'[^']*'|\S+/g) ?? [];
+}
+function bare(word) {
+  if (word.startsWith('"'))
+    return word.slice(1, -1).replace(/\\(.)/g, "$1");
+  if (word.startsWith("'"))
+    return word.slice(1, -1);
+  return word;
+}
+function linesOf(block, indent = "") {
+  const lines = [];
+  for (const [key, value] of block.settings)
+    lines.push(value === UNSET ? `${indent}unset ${key}` : `${indent}set ${key} ${value}`);
+  for (const [header, child] of block.blocks)
+    lines.push(`${indent}config ${header}`, ...linesOf(child, indent + "    "), `${indent}end`);
+  for (const { id, block: entry } of block.entries.values()) {
+    lines.push(`${indent}edit ${id}`, ...linesOf(entry, indent + "    "), `${indent}next`);
+  }
+  return lines;
+}
+function print(root) {
+  const lines = [];
+  for (const [section, block] of root.blocks)
+    lines.push(`config ${section}`, ...linesOf(block, "    "), "end");
+  return lines.join(`
+`) + `
+`;
+}
+var unclosed = (line) => (line.replace(/\\./g, "").match(/"/g)?.length ?? 0) % 2 === 1;
+function parse(text) {
+  const root = new Block;
+  const stack = [{ block: root, isEntry: false }];
+  const lines = text.replace(/\r/g, "").split(`
+`);
+  for (let index = 0;index < lines.length; index++) {
+    let line = lines[index].trim();
+    if (!line || line.startsWith("#"))
+      continue;
+    while (unclosed(line) && index + 1 < lines.length)
+      line += `
+` + lines[++index];
+    const current = stack.at(-1).block;
+    const [verb] = line.split(/\s+/, 1);
+    const rest = line.slice(verb.length).trim();
+    if (verb === "config") {
+      const child = current.block(rest);
+      stack.push({ block: child, isEntry: false });
+    } else if (verb === "edit") {
+      const key = bare(rest);
+      if (!current.entries.has(key))
+        current.entries.set(key, { id: rest, block: new Block });
+      stack.push({ block: current.entries.get(key).block, isEntry: true });
+    } else if (verb === "next") {
+      if (stack.at(-1).isEntry)
+        stack.pop();
+    } else if (verb === "end") {
+      if (stack.at(-1).isEntry)
+        stack.pop();
+      if (stack.length > 1)
+        stack.pop();
+    } else if (verb === "set") {
+      const [key] = rest.split(/\s+/, 1);
+      current.settings.set(key, rest.slice(key.length).trim());
+    } else if (verb === "unset") {
+      current.settings.set(rest, UNSET);
+    }
+  }
+  return root;
+}
+
+// src/adapters/devices/fortios/firewall.ts
+var PROTOCOL_NUMBER = { tcp: 6, udp: 17, icmp: 1, gre: 47, esp: 50, ah: 51, ospf: 89, vrrp: 112 };
+var SERVICES = {
+  ssh: { protocol: "tcp", port: 22 },
+  https: { protocol: "tcp", port: 443 },
+  http: { protocol: "tcp", port: 80 },
+  telnet: { protocol: "tcp", port: 23 },
+  snmp: { protocol: "udp", port: 161 },
+  native: { protocol: "tcp", port: 541 }
+};
+function natRules(device) {
+  const nat = device.firewall?.nat;
+  return [...nat?.source ?? [], ...nat?.destination ?? []];
+}
+function familiesOf(device, match) {
+  if (match?.family)
+    return [match.family];
+  const prefixes = [match?.src, match?.dst].filter((prefix) => prefix !== undefined);
+  if (prefixes.length)
+    return [...new Set(prefixes.map(familyOfPrefix))];
+  let families = ["ipv4", "ipv6"];
+  for (const set of [match?.src_set, match?.dst_set]) {
+    if (!set)
+      continue;
+    const present = new Set((device.firewall?.address_sets?.[set] ?? []).map(familyOfPrefix));
+    families = families.filter((family) => present.has(family));
+  }
+  return families;
+}
+function portList(ports) {
+  if (ports === undefined)
+    return [];
+  const list = Array.isArray(ports) ? ports : [ports];
+  return list.map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
+}
+function serviceOf(match, family) {
+  const protocol = match?.protocol;
+  const destinations = portList(match?.dst_port);
+  const sources = portList(match?.src_port);
+  if (!protocol && !destinations.length && !sources.length)
+    return { name: "ALL" };
+  if (!protocol || protocol === "tcp" || protocol === "udp") {
+    const ranges = (destinations.length ? destinations : ["1-65535"]).flatMap((destination) => sources.length ? sources.map((source) => `${destination}:${source}`) : [destination]);
+    const protocols = protocol ? [protocol] : ["tcp", "udp"];
+    const name = `${protocols.join("+")}/${destinations.join(",") || "any"}${sources.length ? ` from ${sources.join(",")}` : ""}`;
+    const block = new Block;
+    for (const each of protocols)
+      block.set(`${each}-portrange`, ranges.join(" "));
+    return { name, block };
+  }
+  if (protocol === "icmp") {
+    const kind = family === "ipv4" ? "ICMP" : "ICMP6";
+    return { name: kind.toLowerCase(), block: new Block().set("protocol", kind).set("icmptype", UNSET) };
+  }
+  const number = PROTOCOL_NUMBER[protocol];
+  return { name: `protocol/${number}`, block: new Block().set("protocol", "IP").set("protocol-number", number) };
+}
+function isImplied(rule) {
+  const state = rule.match?.state;
+  return rule.action === "accept" && state !== undefined && state.length > 0 && state.every((one) => one === "established" || one === "related");
+}
+
+class Objects {
+  root;
+  device;
+  constructor(root, device) {
+    this.root = root;
+    this.device = device;
+  }
+  address(prefix, set, family) {
+    if (set)
+      return this.group(set, this.device.firewall?.address_sets?.[set] ?? [], family);
+    if (!prefix)
+      return "all";
+    return this.prefix(prefix, family);
+  }
+  prefix(prefix, family) {
+    const name = network2(prefix);
+    if (family === "ipv4")
+      this.root.block("firewall address").entry(name).set("subnet", subnet(name));
+    else
+      this.root.block("firewall address6").entry(name).set("ip6", name);
+    return name;
+  }
+  group(name, members, family) {
+    const names = members.filter((member) => familyOfPrefix(member) === family).map((member) => this.prefix(member, family));
+    const table = family === "ipv4" ? "firewall addrgrp" : "firewall addrgrp6";
+    this.root.block(table).entry(name).set("member", quoteAll([...new Set(names)]));
+    return name;
+  }
+  pool(address) {
+    this.root.block("firewall ippool").entry(address).set("startip", address).set("endip", address);
+  }
+  service(match, family) {
+    const { name, block } = serviceOf(match, family);
+    if (!block)
+      return name;
+    const entry = this.root.block("firewall service custom").entry(name);
+    for (const [key, value] of block.settings)
+      entry.set(key, value);
+    return name;
+  }
+}
+function firewall(root, device) {
+  const fw = device.firewall;
+  const objects = new Objects(root, device);
+  const forward = fw?.filter?.forward;
+  const policies = { ipv4: 0, ipv6: 0 };
+  for (const rule of forward?.rules ?? []) {
+    if (isImplied(rule))
+      continue;
+    for (const family of familiesOf(device, rule.match)) {
+      const table = root.block(family === "ipv4" ? "firewall policy" : "firewall policy6");
+      policy(table.entry(++policies[family]), objects, device, rule, family);
+    }
+  }
+  if (forward?.default !== "drop") {
+    for (const family of ["ipv4", "ipv6"]) {
+      const table = root.block(family === "ipv4" ? "firewall policy" : "firewall policy6");
+      policy(table.entry(++policies[family]), objects, device, { action: "accept" }, family);
+    }
+  }
+  const localIns = { ipv4: 0, ipv6: 0 };
+  const localInEntry = (family) => root.block(family === "ipv4" ? "firewall local-in-policy" : "firewall local-in-policy6").entry(++localIns[family]);
+  management(localInEntry, objects, device);
+  const input = fw?.filter?.input;
+  for (const rule of input?.rules ?? []) {
+    if (isImplied(rule))
+      continue;
+    for (const family of familiesOf(device, rule.match))
+      localIn(localInEntry(family), objects, device, rule, family);
+  }
+  if (input?.default === "drop") {
+    for (const family of ["ipv4", "ipv6"])
+      localIn(localInEntry(family), objects, device, { action: "drop" }, family);
+  }
+  (fw?.nat?.source ?? []).forEach((rule, index) => sourceNat(root.block("firewall central-snat-map").entry(index + 1), objects, device, rule));
+  (fw?.nat?.destination ?? []).forEach((rule, index) => destinationNat(root.block("firewall vip").entry(`dnat-${index + 1}`), device, rule));
+  acls(root, objects, device);
+}
+function management(entry, objects, device) {
+  const config = device.management ?? {};
+  const guards = new Map;
+  for (const [service, listener] of Object.entries(SERVICES)) {
+    const settings = config[service];
+    const sources = settings?.allow ?? config.allow;
+    if (!settings || !sources?.length)
+      continue;
+    const name = settings.allow ? `circuit-${service}` : "circuit-management";
+    const guard = guards.get(name) ?? { sources, services: [] };
+    guard.services.push(objects.service({ protocol: listener.protocol, dst_port: settings.port ?? listener.port }, "ipv4"));
+    guards.set(name, guard);
+  }
+  for (const [name, guard] of guards) {
+    for (const family of ["ipv4", "ipv6"]) {
+      const services = quoteAll(guard.services);
+      if (guard.sources.some((source) => familyOfPrefix(source) === family)) {
+        const accept = entry(family);
+        accept.set("intf", quote("any"));
+        accept.set("srcaddr", quote(objects.group(name, guard.sources, family)));
+        accept.set("dstaddr", quote("all"));
+        accept.set("action", "accept");
+        accept.set("service", services);
+        accept.set("schedule", quote("always"));
+        accept.set("comments", quote("Management from allowed sources"));
+      }
+      const deny = entry(family);
+      deny.set("intf", quote("any"));
+      deny.set("srcaddr", quote("all"));
+      deny.set("dstaddr", quote("all"));
+      deny.set("action", "deny");
+      deny.set("service", services);
+      deny.set("schedule", quote("always"));
+      deny.set("comments", quote("Management from anywhere else"));
+    }
+  }
+}
+function policy(entry, objects, device, rule, family) {
+  const match = rule.match;
+  entry.set("srcintf", quote(match?.in_interface ? nameOf(device, match.in_interface) : "any"));
+  entry.set("dstintf", quote(match?.out_interface ? nameOf(device, match.out_interface) : "any"));
+  entry.set("srcaddr", quote(objects.address(match?.src, match?.src_set, family)));
+  entry.set("dstaddr", quote(objects.address(match?.dst, match?.dst_set, family)));
+  entry.set("action", rule.action === "accept" ? "accept" : "deny");
+  entry.set("schedule", quote("always"));
+  entry.set("service", quote(objects.service(match, family)));
+  if (rule.action !== "accept")
+    entry.set("logtraffic", "disable");
+  if (rule.action === "accept" && !device.hardware_offload && !rule.offload)
+    entry.set("auto-asic-offload", "disable");
+  if (rule.description)
+    entry.set("comments", quote(rule.description));
+  if (rule.action === "reject")
+    entry.set("send-deny-packet", "enable");
+}
+function localIn(entry, objects, device, rule, family) {
+  const match = rule.match;
+  entry.set("intf", quote(match?.in_interface ? nameOf(device, match.in_interface) : "any"));
+  entry.set("srcaddr", quote(objects.address(match?.src, match?.src_set, family)));
+  entry.set("dstaddr", quote(objects.address(match?.dst, match?.dst_set, family)));
+  entry.set("action", rule.action === "accept" ? "accept" : "deny");
+  entry.set("service", quote(objects.service(match, family)));
+  entry.set("schedule", quote("always"));
+  if (rule.description)
+    entry.set("comments", quote(rule.description));
+}
+function sourceNat(entry, objects, device, rule) {
+  const match = rule.match;
+  entry.set("orig-addr", quote(objects.address(match?.src, match?.src_set, "ipv4")));
+  entry.set("srcintf", quote(match?.in_interface ? nameOf(device, match.in_interface) : "any"));
+  entry.set("dst-addr", quote(objects.address(match?.dst, match?.dst_set, "ipv4")));
+  entry.set("dstintf", quote(match?.out_interface ? nameOf(device, match.out_interface) : "any"));
+  if (match?.protocol)
+    entry.set("protocol", PROTOCOL_NUMBER[match.protocol]);
+  const ports = portList(match?.src_port);
+  if (rule.action === "snat") {
+    objects.pool(rule.to);
+    entry.set("nat-ippool", quote(rule.to));
+    if (ports.length)
+      entry.set("orig-port", ports[0]).set("nat-port", rule.to_port ?? ports[0]);
+  } else if (ports.length) {
+    entry.set("orig-port", ports[0]);
+  }
+  if (rule.description)
+    entry.set("comments", quote(rule.description));
+}
+function destinationNat(entry, device, rule) {
+  if (rule.action !== "dnat")
+    return;
+  const match = rule.match;
+  if (rule.description)
+    entry.set("comment", quote(rule.description));
+  if (match?.dst)
+    entry.set("extip", host2(withLength(match.dst)));
+  entry.set("extintf", quote(match?.in_interface ? nameOf(device, match.in_interface) : "any"));
+  const sources = match?.src ? [match.src] : match?.src_set ? device.firewall?.address_sets?.[match.src_set] ?? [] : [];
+  if (sources.length)
+    entry.set("src-filter", quoteAll(sources.map(network2)));
+  const ports = portList(match?.dst_port);
+  if (ports.length)
+    entry.set("portforward", "enable");
+  entry.set("mappedip", quote(rule.to));
+  if (ports.length) {
+    if (match?.protocol === "udp")
+      entry.set("protocol", "udp");
+    entry.set("extport", ports[0]);
+    entry.set("mappedport", rule.to_port ?? ports[0]);
+  }
+}
+function acls(root, objects, device) {
+  const counters = { ipv4: 0, ipv6: 0 };
+  for (const [port, settings] of Object.entries(device.ports ?? {})) {
+    if (!settings?.acl)
+      continue;
+    for (const rule of device.acls?.[settings.acl] ?? []) {
+      if (rule.action !== "drop")
+        continue;
+      const match = rule.match;
+      for (const family of familiesOf(device, match)) {
+        const entry = root.block(family === "ipv4" ? "firewall acl" : "firewall acl6").entry(++counters[family]);
+        if (rule.description)
+          entry.set("comments", quote(rule.description));
+        entry.set("interface", quote(nameOf(device, port)));
+        entry.set("srcaddr", quote(objects.address(match?.src, undefined, family)));
+        entry.set("dstaddr", quote(objects.address(match?.dst, undefined, family)));
+        entry.set("service", quote(objects.service(match, family)));
+      }
+    }
+  }
+}
+function acceptsBeforeDrop(rules) {
+  const lastDrop = rules.map((rule) => rule.action).lastIndexOf("drop");
+  return rules.slice(0, Math.max(0, lastDrop)).some((rule) => rule.action === "accept");
+}
+
+// src/adapters/devices/fortios/routing.ts
+var REJECT_ALL = "circuit-reject-all";
+var FILLED = "Filled by circuit refresh";
+var PREFIX_LIST = { ipv4: "router prefix-list", ipv6: "router prefix-list6" };
+var BITS = { ipv4: 32, ipv6: 128 };
+function neighborSettings(device, neighbor) {
+  const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+  return { ...group, ...neighbor };
+}
+function familiesOfNeighbor(device, neighbor) {
+  return [...neighborSettings(device, neighbor).families ?? [familyOf2(neighbor.address)]];
+}
+function usesBfd(device) {
+  const areas = Object.values(device.routing?.ospf?.areas ?? {});
+  const ospf = areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
+  const bgp = Object.values(device.routing?.bgp?.neighbors ?? {}).some((neighbor) => neighborSettings(device, neighbor).bfd);
+  return ospf || bgp;
+}
+function routing(root, device) {
+  prefixLists(root, device);
+  ospf(root, device);
+  ospf6(root, device);
+  bgp(root, device);
+}
+var listPrefix = (prefix, family) => family === "ipv4" ? subnet(network2(prefix)) : network2(prefix);
+function listRule(rule, family, prefix, lengths = {}) {
+  rule.set(family === "ipv4" ? "prefix" : "prefix6", listPrefix(prefix, family));
+  rule.set("ge", lengths.ge ?? UNSET);
+  rule.set("le", lengths.le ?? UNSET);
+}
+function bounds(prefix, family, min = 0, max = BITS[family]) {
+  const own = split(network2(prefix)).len;
+  const low = Math.max(min, own);
+  if (max < low)
+    return;
+  if (low === own && max === own)
+    return {};
+  return { ...low > own ? { ge: low } : {}, le: max };
+}
+function prefixLists(root, device) {
+  for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+    if ("source" in set) {
+      const { registry, query, family } = set.source;
+      const entry = root.block(PREFIX_LIST[family]).entry(name).set("comments", quote(`${FILLED} from ${registry} ${query}`));
+      const rule = entry.block("rule").entry(1);
+      listRule(rule, family, family === "ipv4" ? "0.0.0.0/0" : "::/0", { le: BITS[family] });
+      rule.set("action", "deny");
+      continue;
+    }
+    const family = set.prefixes[0] ? familyOfPrefix(set.prefixes[0]) : "ipv4";
+    const entry = root.block(PREFIX_LIST[family]).entry(name);
+    set.prefixes.forEach((prefix, index) => listRule(entry.block("rule").entry(index + 1), family, prefix, bounds(prefix, family)));
+  }
+}
+function networksOf(device, name, family) {
+  return addressesOf2(settingsOf(device, name)).filter((address) => familyOfPrefix(address) === family).map(network2);
+}
+function ospf(root, device) {
+  const ospf = device.routing?.ospf;
+  if (!ospf || !(ospf.families ?? ["ipv4"]).includes("ipv4"))
+    return;
+  const block = root.block("router ospf");
+  if (device.routing?.router_id)
+    block.set("router-id", device.routing.router_id);
+  const passive = [];
+  let networks = 0;
+  for (const [areaId, area] of Object.entries(ospf.areas)) {
+    block.block("area").entry(areaId, true);
+    for (const [name, settings] of Object.entries(area.interfaces)) {
+      const iface = nameOf(device, name);
+      if (settings?.passive)
+        passive.push(iface);
+      if (settings?.cost !== undefined || settings?.network === "point-to-point" || settings?.bfd) {
+        const entry = block.block("ospf-interface").entry(iface);
+        entry.set("interface", quote(iface));
+        if (settings.cost !== undefined)
+          entry.set("cost", settings.cost);
+        if (settings.network === "point-to-point")
+          entry.set("network-type", "point-to-point");
+        if (settings.bfd)
+          entry.set("bfd", "enable");
+      }
+      for (const prefix of networksOf(device, name, "ipv4")) {
+        const entry = block.block("network").entry(++networks);
+        entry.set("prefix", subnet(prefix));
+        if (areaId !== "0.0.0.0")
+          entry.set("area", areaId);
+      }
+    }
+  }
+  if (passive.length)
+    block.set("passive-interface", quoteAll(passive));
+  for (const source of ospf.redistribute ?? [])
+    block.block(`redistribute "${source}"`).set("status", "enable");
+}
+function ospf6(root, device) {
+  const ospf = device.routing?.ospf;
+  if (!ospf?.families?.includes("ipv6"))
+    return;
+  const block = root.block("router ospf6");
+  if (device.routing?.router_id)
+    block.set("router-id", device.routing.router_id);
+  const passive = [];
+  for (const [areaId, area] of Object.entries(ospf.areas)) {
+    block.block("area").entry(areaId, true);
+    for (const [name, settings] of Object.entries(area.interfaces)) {
+      const iface = nameOf(device, name);
+      if (settings?.passive)
+        passive.push(iface);
+      const entry = block.block("ospf6-interface").entry(iface);
+      entry.set("interface", quote(iface));
+      if (areaId !== "0.0.0.0")
+        entry.set("area-id", areaId);
+      if (settings?.cost !== undefined)
+        entry.set("cost", settings.cost);
+      if (settings?.network === "point-to-point")
+        entry.set("network-type", "point-to-point");
+      if (settings?.bfd)
+        entry.set("bfd", "enable");
+    }
+  }
+  if (passive.length)
+    block.set("passive-interface", quoteAll(passive));
+  for (const source of ospf.redistribute ?? [])
+    block.block(`redistribute "${source}"`).set("status", "enable");
+}
+function bgp(root, device) {
+  const bgp = device.routing?.bgp;
+  if (!bgp)
+    return;
+  const block = root.block("router bgp");
+  block.set("as", bgp.asn);
+  if (device.routing?.router_id)
+    block.set("router-id", device.routing.router_id);
+  const maps = new RouteMaps(root, device);
+  for (const neighbor of Object.values(bgp.neighbors ?? {})) {
+    const settings = neighborSettings(device, neighbor);
+    const families = familiesOfNeighbor(device, neighbor);
+    const entry = block.block("neighbor").entry(neighbor.address);
+    if (!families.includes("ipv4"))
+      entry.set("activate", "disable");
+    if (!families.includes("ipv6"))
+      entry.set("activate6", "disable");
+    if (settings.bfd)
+      entry.set("bfd", "enable");
+    if (settings.multihop)
+      entry.set("ebgp-enforce-multihop", "enable");
+    if (settings.passive)
+      entry.set("passive", "enable");
+    if (settings.description)
+      entry.set("description", quote(settings.description));
+    if (settings.remote_as !== undefined)
+      entry.set("remote-as", settings.remote_as);
+    for (const family of families) {
+      const suffix = family === "ipv4" ? "" : "6";
+      if (settings.max_prefixes !== undefined)
+        entry.set(`maximum-prefix${suffix}`, settings.max_prefixes);
+      entry.set(`route-map-in${suffix}`, quote(maps.of(settings.import, family)));
+      entry.set(`route-map-out${suffix}`, quote(maps.of(settings.export, family)));
+    }
+    if (settings.keepalive !== undefined)
+      entry.set("keep-alive-timer", settings.keepalive);
+    if (settings.hold_time !== undefined)
+      entry.set("holdtime-timer", settings.hold_time);
+    const source = settings.local_address ? holderOf(device, settings.local_address) : undefined;
+    if (source)
+      entry.set("update-source", quote(nameOf(device, source)));
+    if (settings.password)
+      entry.set("password", quote(marker(settings.password)));
+  }
+  const networks = { ipv4: 0, ipv6: 0 };
+  for (const prefix of bgp.networks ?? []) {
+    const family = familyOfPrefix(prefix);
+    const entry = block.block(family === "ipv4" ? "network" : "network6").entry(++networks[family]);
+    entry.set(family === "ipv4" ? "prefix" : "prefix6", listPrefix(prefix, family));
+  }
+}
+function familyOfRule(device, rule) {
+  const match = rule.match;
+  if (match?.family)
+    return match.family;
+  if (match?.prefix)
+    return familyOfPrefix(match.prefix);
+  const set = match?.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+  if (set && "source" in set)
+    return set.source.family;
+  if (set?.prefixes[0])
+    return familyOfPrefix(set.prefixes[0]);
+  return;
+}
+function flatten(device, policy, seen = [policy]) {
+  const flat = [];
+  for (const rule of device.policies?.[policy] ?? []) {
+    if (rule.call && !seen.includes(rule.call))
+      flat.push(...flatten(device, rule.call, [...seen, rule.call]));
+    if (rule.match || rule.set || rule.action)
+      flat.push(rule);
+  }
+  return flat;
+}
+var slug = (value) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
+var patternOf = (pattern) => `^${pattern.replace(/\*/g, "[0-9]+")}$`;
+
+class RouteMaps {
+  root;
+  device;
+  built = new Set;
+  constructor(root, device) {
+    this.root = root;
+    this.device = device;
+  }
+  of(policy, family) {
+    if (!policy) {
+      if (!this.built.has(REJECT_ALL)) {
+        this.built.add(REJECT_ALL);
+        this.root.block("router route-map").entry(REJECT_ALL).block("rule").entry(1).set("action", "deny");
+      }
+      return REJECT_ALL;
+    }
+    const name = family === "ipv4" ? policy : `${policy}-v6`;
+    if (this.built.has(name))
+      return name;
+    this.built.add(name);
+    const map = this.root.block("router route-map").entry(name);
+    let number = 0;
+    for (const rule of flatten(this.device, policy)) {
+      const only = familyOfRule(this.device, rule);
+      if (only && only !== family)
+        continue;
+      this.rule(map.block("rule").entry(++number), rule, family, `${name}-${number}`);
+    }
+    return name;
+  }
+  rule(entry, rule, family, label) {
+    const match = rule.match ?? {};
+    const set = rule.set ?? {};
+    const address = family === "ipv4" ? "match-ip-address" : "match-ip6-address";
+    if (match.prefix) {
+      this.list(label, family, [[match.prefix, {}]]);
+      entry.set(address, quote(label));
+    } else if (match.prefix_set && match.prefix_length) {
+      const name = `${match.prefix_set}-${match.prefix_length.min ?? 0}-${match.prefix_length.max ?? BITS[family]}`;
+      const prefixes = this.prefixesOf(match.prefix_set);
+      this.list(name, family, prefixes.map((prefix) => [prefix, bounds(prefix, family, match.prefix_length?.min, match.prefix_length?.max)]));
+      entry.set(address, quote(name));
+    } else if (match.prefix_set) {
+      entry.set(address, quote(match.prefix_set));
+    } else if (match.prefix_length) {
+      const { min = 0, max = BITS[family] } = match.prefix_length;
+      const name = `circuit-length-${min}-${max}`;
+      const everything = family === "ipv4" ? "0.0.0.0/0" : "::/0";
+      this.list(name, family, [[everything, bounds(everything, family, min, max)]]);
+      entry.set(address, quote(name));
+    }
+    if (match.community)
+      entry.set("match-community", quote(this.communities(`circuit-match-${slug(match.community)}`, [match.community], false)));
+    if (set.local_pref !== undefined)
+      entry.set("set-local-preference", set.local_pref);
+    if (set.med !== undefined)
+      entry.set("set-metric", set.med);
+    if (set.prepend !== undefined)
+      entry.set("set-aspath", quote(Array(set.prepend).fill(this.device.routing.bgp.asn).join(" ")));
+    if (set.communities) {
+      entry.set("set-community", quoteAll([...set.communities, ...set.add_communities ?? []]));
+    } else {
+      if (set.add_communities)
+        entry.set("set-community", quoteAll(set.add_communities)).set("set-community-additive", "enable");
+      if (set.remove_communities) {
+        const name = `circuit-remove-${slug(set.remove_communities.join(" "))}`;
+        entry.set("set-community-delete", quote(this.communities(name, set.remove_communities, true)));
+      }
+    }
+    if (set.next_hop && familyOf2(set.next_hop) === family)
+      entry.set(family === "ipv4" ? "set-ip-nexthop" : "set-ip6-nexthop", set.next_hop);
+    if (rule.action === "reject")
+      entry.set("action", "deny");
+  }
+  prefixesOf(set) {
+    const prefixes = this.device.prefix_sets?.[set];
+    return prefixes && "prefixes" in prefixes ? [...prefixes.prefixes] : [];
+  }
+  list(name, family, rules) {
+    const rulesBlock = this.root.block(PREFIX_LIST[family]).entry(name).block("rule");
+    let number = 0;
+    for (const [prefix, lengths] of rules)
+      if (lengths)
+        listRule(rulesBlock.entry(++number), family, prefix, lengths);
+  }
+  communities(name, values, patterns) {
+    const list = this.root.block("router community-list").entry(name);
+    if (patterns)
+      list.set("type", "expanded");
+    values.forEach((value, index) => {
+      const rule = list.block("rule").entry(index + 1).set("action", "permit");
+      if (patterns)
+        rule.set("regexp", quote(patternOf(value)));
+      else
+        rule.set("match", quote(value));
+    });
+    return name;
+  }
+}
+function routingGaps(device) {
+  const found = [];
+  const routing = device.routing;
+  if (routing?.rpki)
+    found.push("routing.rpki, the platform has no route origin validation");
+  if (routing?.router_id && !routing.ospf && !routing.bgp)
+    found.push("routing.router_id without OSPF or BGP, which each hold it");
+  const ospf = routing?.ospf;
+  if (ospf?.families?.includes("ipv6") && !routing?.router_id)
+    found.push("routing.ospf for IPv6 without routing.router_id");
+  for (const area of Object.values(ospf?.areas ?? {})) {
+    for (const name of Object.keys(area.interfaces)) {
+      if (settingsOf(device, name)?.vrf)
+        found.push(`routing.ospf on ${name}, which routes in a VRF: OSPF runs in the default table`);
+      const ipv4 = addressesOf2(settingsOf(device, name)).some((address) => familyOf2(host2(address)) === "ipv4");
+      if ((ospf?.families ?? ["ipv4"]).includes("ipv4") && !ipv4)
+        found.push(`routing.ospf on ${name}, which has no IPv4 address for OSPF to run on`);
+    }
+  }
+  for (const [name, neighbor] of Object.entries(routing?.bgp?.neighbors ?? {})) {
+    const where = `routing.bgp.neighbors.${name}`;
+    const settings = neighborSettings(device, neighbor);
+    if (settings.role)
+      found.push(`${where}.role, the platform has no BGP roles`);
+    if (settings.local_address && !holderOf(device, settings.local_address)) {
+      found.push(`${where}.local_address, no interface holds ${settings.local_address}`);
+    }
+    if (familyOf2(neighbor.address) === "ipv6" && familiesOfNeighbor(device, neighbor).includes("ipv4")) {
+      found.push(`${where}.families ipv4 over an IPv6 session`);
+    }
+  }
+  for (const [name, rules] of Object.entries(device.policies ?? {})) {
+    rules.forEach((rule, index) => found.push(...ruleGaps(device, `policies.${name}[${index}]`, rule)));
+  }
+  return found;
+}
+function ruleGaps(device, where, rule) {
+  const found = [];
+  const match = rule.match ?? {};
+  const set = rule.set ?? {};
+  if ((rule.match || rule.set) && !rule.action)
+    found.push(`${where}, a rule without action: the platform stops at the first rule that matches`);
+  for (const field of ["as_path_length", "rpki", "large_community"]) {
+    if (match[field] !== undefined)
+      found.push(`${where}.match.${field}`);
+  }
+  for (const field of [
+    "large_communities",
+    "add_large_communities",
+    "remove_large_communities",
+    "preferred_source",
+    "blackhole"
+  ]) {
+    if (set[field] !== undefined)
+      found.push(`${where}.set.${field}`);
+  }
+  if (match.prefix && match.prefix_length)
+    found.push(`${where}.match.prefix with prefix_length`);
+  if (match.prefix && match.prefix_set)
+    found.push(`${where}.match.prefix with prefix_set`);
+  const prefixSet = match.prefix_set ? device.prefix_sets?.[match.prefix_set] : undefined;
+  if (prefixSet && "source" in prefixSet && match.prefix_length) {
+    found.push(`${where}.match.prefix_length with a prefix set a registry fills`);
+  }
+  return found;
+}
+
+// src/adapters/devices/fortios/plan.ts
+var FACTORY_ADDRESSES = [
+  "none",
+  "login.microsoftonline.com",
+  "login.microsoft.com",
+  "login.windows.net",
+  "gmail.com",
+  "wildcard.google.com",
+  "wildcard.dropbox.com",
+  "all",
+  "FIREWALL_AUTH_PORTAL_ADDRESS",
+  "FABRIC_DEVICE",
+  "SSLVPN_TUNNEL_ADDR1"
+];
+var FACTORY_SERVICES = [
+  "ALL",
+  "ALL_TCP",
+  "ALL_UDP",
+  "ALL_ICMP",
+  "ALL_ICMP6",
+  "GRE",
+  "AH",
+  "ESP",
+  "AOL",
+  "BGP",
+  "DHCP",
+  "DNS",
+  "FINGER",
+  "FTP",
+  "FTP_GET",
+  "FTP_PUT",
+  "GOPHER",
+  "H323",
+  "HTTP",
+  "HTTPS",
+  "IKE",
+  "IMAP",
+  "IMAPS",
+  "Internet-Locator-Service",
+  "IRC",
+  "L2TP",
+  "LDAP",
+  "NetMeeting",
+  "NFS",
+  "NNTP",
+  "NTP",
+  "OSPF",
+  "PC-Anywhere",
+  "PING",
+  "TIMESTAMP",
+  "INFO_REQUEST",
+  "INFO_ADDRESS",
+  "ONC-RPC",
+  "DCE-RPC",
+  "POP3",
+  "POP3S",
+  "PPTP",
+  "QUAKE",
+  "RAUDIO",
+  "REXEC",
+  "RIP",
+  "RLOGIN",
+  "RSH",
+  "SCCP",
+  "SIP",
+  "SIP-MSNmessenger",
+  "SAMBA",
+  "SMTP",
+  "SMTPS",
+  "SNMP",
+  "SSH",
+  "SYSLOG",
+  "TALK",
+  "TELNET",
+  "TFTP",
+  "MGCP",
+  "UUCP",
+  "VDOLIVE",
+  "WAIS",
+  "WINFRAME",
+  "X-WINDOWS",
+  "PING6",
+  "MS-SQL",
+  "MYSQL",
+  "RDP",
+  "VNC",
+  "DHCP6",
+  "SQUID",
+  "SOCKS",
+  "WINS",
+  "RADIUS",
+  "RADIUS-OLD",
+  "CVSPSERVER",
+  "AFS3",
+  "TRACEROUTE",
+  "RTSP",
+  "MMS",
+  "KERBEROS",
+  "LDAP_UDP",
+  "SMB",
+  "NONE",
+  "webproxy"
+];
+var FACTORY_CERTIFICATES = [
+  "Fortinet_CA_SSL",
+  "Fortinet_CA_Untrusted",
+  "Fortinet_SSL",
+  "Fortinet_SSL_RSA1024",
+  "Fortinet_SSL_RSA2048",
+  "Fortinet_SSL_RSA4096",
+  "Fortinet_SSL_DSA1024",
+  "Fortinet_SSL_DSA2048",
+  "Fortinet_SSL_ECDSA256",
+  "Fortinet_SSL_ECDSA384",
+  "Fortinet_SSL_ECDSA521",
+  "Fortinet_SSL_ED25519",
+  "Fortinet_SSL_ED448"
+];
+var ORDERED = { ordered: true };
+var TABLES = {
+  "system interface": {
+    factory: ["modem", "ssl.root"],
+    created: (entry) => {
+      if (entry.settings.get("type") === "aggregate")
+        return ["device-identification", "lldp-transmission"];
+      if (entry.settings.has("interface") && !entry.settings.has("type"))
+        return ["device-identification", "role"];
+      return [];
+    },
+    fixed: ["type", "interface"]
+  },
+  "system accprofile": { factory: ["prof_admin"] },
+  "vpn certificate local": { factory: FACTORY_CERTIFICATES },
+  "system session-helper": { byContent: true },
+  "firewall address": { factory: FACTORY_ADDRESSES },
+  "firewall address6": { factory: ["SSLVPN_TUNNEL_IPv6_ADDR1", "all", "none"] },
+  "firewall addrgrp": { factory: ["G Suite", "Microsoft Office 365"] },
+  "firewall service custom": { factory: FACTORY_SERVICES },
+  "firewall policy": ORDERED,
+  "firewall policy6": ORDERED,
+  "firewall local-in-policy": ORDERED,
+  "firewall local-in-policy6": ORDERED,
+  "firewall central-snat-map": ORDERED
+};
+var IGNORED = new Set(["uuid", "snmp-index"]);
+var IGNORED_IN = { "system global": ["cfg-save", "cfg-revert-timeout", "alias"] };
+var KEPT = { "vpn certificate local": ["certificate", "private-key"], "vpn certificate ca": ["ca"] };
+var DENY = { action: "deny" };
+var DEFAULTS = {
+  "system global": {
+    "admin-ssh-port": "22",
+    "admin-sport": "443",
+    "admin-port": "80",
+    "admin-telnet-port": "23",
+    "admin-ssh-grace-time": "120"
+  },
+  "system interface": { mtu: "1500" },
+  "system snmp community": { "query-v2c-port": "161" },
+  "system snmp user": { "query-port": "161" },
+  "system dhcp server": { "dns-service": "specify" },
+  "firewall policy": DENY,
+  "firewall policy6": DENY,
+  "firewall local-in-policy": DENY,
+  "firewall local-in-policy6": DENY
+};
+var SECRET_KEYS = new Set(["private-key"]);
+var CERTIFICATES = new Set(["certificate", "ca"]);
+var FIRST = new Set(["ntpsync"]);
+var LISTS = new Set([
+  "allowaccess",
+  "ip6-allowaccess",
+  "member",
+  "srcintf",
+  "dstintf",
+  "srcaddr",
+  "dstaddr",
+  "service",
+  "src-filter",
+  "dhcp-relay-ip"
+]);
+var isSecret2 = (value) => /<secret:|<redacted>/.test(value) || value.startsWith("ENC ");
+function canonical(key, value) {
+  if (value === UNSET)
+    return UNSET;
+  if (isSecret2(value) || SECRET_KEYS.has(key))
+    return "<secret>";
+  if (CERTIFICATES.has(key))
+    return bare(value).replace(/\s+/g, "");
+  const words = wordsOf(value).map(bare);
+  return (LISTS.has(key) ? words.sort() : words).join(" ");
+}
+function changesFixed(table, before, after) {
+  const value = (block, key) => canonical(key, block.settings.get(key) ?? "");
+  return (table?.fixed ?? []).some((key) => value(before, key) !== value(after, key));
+}
+function isFactory(table, entry) {
+  return table?.factory?.includes(bare(entry.id)) ?? false;
+}
+function clean(text) {
+  const root = parse(text);
+  for (const [section, block] of root.blocks) {
+    const table = TABLES[section];
+    for (const [key, entry] of block.entries)
+      if (isFactory(table, entry))
+        block.entries.delete(key);
+    for (const key of IGNORED_IN[section] ?? [])
+      block.settings.delete(key);
+    dropIgnored(block);
+    const kept = KEPT[section];
+    if (!kept)
+      continue;
+    for (const { block: entry } of block.entries.values()) {
+      for (const key of entry.settings.keys())
+        if (!kept.includes(key))
+          entry.settings.delete(key);
+      entry.blocks.clear();
+    }
+  }
+  return print(root);
+}
+function dropIgnored(block) {
+  for (const key of block.settings.keys())
+    if (IGNORED.has(key))
+      block.settings.delete(key);
+  for (const child of block.blocks.values())
+    dropIgnored(child);
+  for (const { block: entry } of block.entries.values())
+    dropIgnored(entry);
+}
+var labelOf = (path) => path.length ? `${path.join(" ")}: ` : "";
+function shown(sign, path, block) {
+  const label = labelOf(path);
+  const lines = linesOf(block).map((line) => `${sign} ${label}${line.trim()}`);
+  return lines.length ? lines : [`${sign} ${path.join(" ")}`];
+}
+function creation(entry, table, id = entry.id) {
+  const unset = (table?.created?.(entry.block) ?? []).filter((key) => !entry.block.settings.has(key)).map((key) => `unset ${key}`);
+  return [`edit ${id}`, ...linesOf(entry.block).map((line) => line.trim()), ...unset, "next"];
+}
+function compare(path, want, have, table, top, context) {
+  const send = [];
+  const show = [];
+  const removals = [];
+  const removed = [];
+  const label = labelOf(path);
+  const nested = (header, wanted, held) => {
+    const diff = compare([...path, header], wanted, held, undefined, false, context);
+    if (!diff.send.length)
+      return;
+    send.push(`config ${header}`, ...diff.send, "end");
+    show.push(...diff.show);
+  };
+  const unset = (key, old) => {
+    send.push(`unset ${key}`);
+    show.push(`- ${label}set ${key} ${old}`);
+  };
+  const gone = [...have.settings].filter(([key]) => !want.settings.has(key) && !IGNORED.has(key));
+  for (const [key, old] of gone)
+    if (FIRST.has(key))
+      unset(key, old);
+  for (const [header, child] of [...have.blocks].reverse())
+    if (!want.blocks.has(header))
+      nested(header, new Block, child);
+  for (const [key, old] of gone.reverse())
+    if (!FIRST.has(key))
+      unset(key, old);
+  for (const [key, value] of want.settings) {
+    const old = have.settings.get(key);
+    const current = old ?? DEFAULTS[context.section]?.[key];
+    const same = current !== undefined && canonical(key, current) === canonical(key, value);
+    if (same && !(context.secrets && value.includes("<secret:")))
+      continue;
+    send.push(value === UNSET ? `unset ${key}` : `set ${key} ${value}`);
+    if (old !== undefined)
+      show.push(`- ${label}set ${key} ${old}`);
+    show.push(`+ ${label}set ${key} ${value}`);
+  }
+  for (const [header, child] of want.blocks)
+    nested(header, child, have.blocks.get(header) ?? new Block);
+  const entries = table?.byContent ? byContent(path, want, have) : byId(path, want, have, table, context);
+  send.push(...entries.send);
+  show.push(...entries.show);
+  if (top) {
+    removals.push(...entries.removals);
+    removed.push(...entries.removed);
+  } else {
+    send.push(...entries.removals);
+    show.push(...entries.removed);
+  }
+  return { send, show, removals, removed };
+}
+function byId(path, want, have, table, context) {
+  const send = [];
+  const show = [];
+  const removals = [];
+  const removed = [];
+  for (const [key, entry] of want.entries) {
+    const old = have.entries.get(key);
+    const where = [...path, bare(entry.id)];
+    const replaced = old && changesFixed(table, old.block, entry.block);
+    if (!old || replaced) {
+      if (old) {
+        send.push(`delete ${old.id}`);
+        show.push(...shown("-", where, old.block));
+      }
+      send.push(...creation(entry, table));
+      show.push(...shown("+", where, entry.block));
+      continue;
+    }
+    const diff = compare(where, entry.block, old.block, undefined, false, context);
+    if (!diff.send.length)
+      continue;
+    send.push(`edit ${entry.id}`, ...diff.send, "next");
+    show.push(...diff.show);
+  }
+  const gone = [...have.entries].filter(([key, entry]) => !want.entries.has(key) && !isFactory(table, entry));
+  gone.sort(([, a], [, b]) => Number(b.block.settings.has("interface")) - Number(a.block.settings.has("interface")));
+  for (const [, entry] of gone) {
+    removals.push(`delete ${entry.id}`);
+    removed.push(...shown("-", [...path, bare(entry.id)], entry.block));
+  }
+  if (table?.ordered) {
+    const moved = moves(want, have);
+    send.push(...moved);
+    show.push(...moved.map((line) => `+ ${labelOf(path)}${line}`));
+  }
+  return { send, show, removals, removed };
+}
+function moves(want, have) {
+  const wanted = [...want.entries.keys()];
+  const order = [...have.entries.keys()].filter((key) => want.entries.has(key));
+  order.push(...wanted.filter((key) => !have.entries.has(key)));
+  const send = [];
+  const idOf = (key) => want.entries.get(key).id;
+  for (let index = 0;index < wanted.length; index++) {
+    if (order[index] === wanted[index])
+      continue;
+    const key = wanted[index];
+    send.push(index === 0 ? `move ${idOf(key)} before ${idOf(order[0])}` : `move ${idOf(key)} after ${idOf(wanted[index - 1])}`);
+    order.splice(order.indexOf(key), 1);
+    order.splice(index, 0, key);
+  }
+  return send;
+}
+function signature(block) {
+  return [...block.settings].map(([key, value]) => `${key} ${canonical(key, value)}`).sort().join(`
+`);
+}
+function byContent(path, want, have) {
+  const send = [];
+  const show = [];
+  const removals = [];
+  const removed = [];
+  const unmatched = [...have.entries.values()];
+  const added = [];
+  for (const entry of want.entries.values()) {
+    const index = unmatched.findIndex((old) => signature(old.block) === signature(entry.block));
+    if (index >= 0)
+      unmatched.splice(index, 1);
+    else
+      added.push(entry);
+  }
+  let next = Math.max(0, ...[...have.entries.keys()].map(Number).filter(Number.isInteger)) + 1;
+  for (const entry of added) {
+    const id = String(next++);
+    send.push(...creation(entry, undefined, id));
+    show.push(...shown("+", [...path, id], entry.block));
+  }
+  for (const entry of unmatched) {
+    removals.push(`delete ${entry.id}`);
+    removed.push(...shown("-", [...path, bare(entry.id)], entry.block));
+  }
+  return { send, show, removals, removed };
+}
+var NAMES_INTERFACE = new Set(["device", "interface", "srcintf", "dstintf", "intf", "extintf", "update-source", "passive-interface"]);
+function interfacesNamed(block) {
+  return [...block.settings].filter(([key]) => NAMES_INTERFACE.has(key)).flatMap(([, value]) => wordsOf(value).map(bare));
+}
+var KEYED_BY_INTERFACE = new Set(["system dns-server"]);
+var INTERFACE_TABLES = new Set(["system interface", "system gre-tunnel", "system vxlan"]);
+function released(want, have) {
+  const interfaces = have.blocks.get("system interface") ?? new Block;
+  const wanted = want.blocks.get("system interface") ?? new Block;
+  const members = (block) => wordsOf(block?.settings.get("member") ?? "").map(bare);
+  const freed = new Set;
+  const gone = new Set;
+  const trims = [];
+  const deferred = new Set;
+  const changesSpeed = (port) => {
+    const speed = (block) => canonical("speed", block?.settings.get("speed") ?? "");
+    return speed(interfaces.entries.get(port)?.block) !== speed(wanted.entries.get(port)?.block);
+  };
+  for (const [key, entry] of wanted.entries) {
+    const before = interfaces.entries.get(key)?.block;
+    for (const member of members(entry.block))
+      if (!members(before).includes(member))
+        freed.add(member);
+    if (before && changesFixed(TABLES["system interface"], before, entry.block))
+      freed.add(key);
+  }
+  for (const [key, entry] of interfaces.entries) {
+    if (entry.block.settings.get("type") !== "aggregate")
+      continue;
+    const kept = members(entry.block).filter((member) => members(wanted.entries.get(key)?.block).includes(member) && !changesSpeed(member));
+    if (kept.length === members(entry.block).length)
+      continue;
+    if (kept.length && wanted.entries.has(key)) {
+      trims.push({ id: entry.id, members: kept });
+      continue;
+    }
+    if (!wanted.entries.has(key) && !members(entry.block).some((member) => freed.has(member))) {
+      for (const member of members(entry.block))
+        deferred.add(member);
+      continue;
+    }
+    freed.add(key);
+    gone.add(key);
+  }
+  let grew = true;
+  while (grew) {
+    grew = false;
+    for (const [section, block] of have.blocks) {
+      if (!INTERFACE_TABLES.has(section))
+        continue;
+      for (const [key, entry] of block.entries) {
+        if (freed.has(key) || !interfacesNamed(entry.block).some((name) => freed.has(name)))
+          continue;
+        freed.add(key);
+        grew = true;
+      }
+    }
+  }
+  return { freed, gone, trims, deferred };
+}
+var HELD_BY = { interface: "server-mode" };
+function release(block, path, freed, gone, isEntry) {
+  const send = [];
+  const show = [];
+  const label = labelOf(path);
+  if (!isEntry) {
+    for (const [key, value] of [...block.settings]) {
+      if (!NAMES_INTERFACE.has(key) || !wordsOf(value).some((word) => freed.has(bare(word))))
+        continue;
+      const holder = HELD_BY[key];
+      if (holder && block.settings.has(holder)) {
+        send.push(`unset ${holder}`);
+        show.push(`- ${label}set ${holder} ${block.settings.get(holder)}`, `- ${label}set ${key} ${value}`);
+        block.settings.delete(holder);
+        block.settings.delete(key);
+        continue;
+      }
+      send.push(`unset ${key}`);
+      show.push(`- ${label}set ${key} ${value}`);
+      block.settings.delete(key);
+    }
+  }
+  for (const [header, child] of block.blocks) {
+    const inner = release(child, [...path, header], freed, gone, false);
+    if (inner.send.length)
+      send.push(`config ${header}`, ...inner.send, "end");
+    show.push(...inner.show);
+  }
+  const entries = [...block.entries].sort(([, a], [, b]) => Number(b.block.settings.has("interface")) - Number(a.block.settings.has("interface")));
+  for (const [key, entry] of entries) {
+    const where = [...path, bare(entry.id)];
+    const named = interfacesNamed(entry.block).some((name) => freed.has(name));
+    if (named || gone.has(key)) {
+      send.push(`delete ${entry.id}`);
+      show.push(...shown("-", where, entry.block));
+      block.entries.delete(key);
+      continue;
+    }
+    const inner = release(entry.block, where, freed, gone, true);
+    if (inner.send.length)
+      send.push(`edit ${entry.id}`, ...inner.send, "next");
+    show.push(...inner.show);
+  }
+  return { send, show };
+}
+function movedAddresses(want, have) {
+  const wanted = want.blocks.get("system interface");
+  const held = have.blocks.get("system interface");
+  if (!wanted || !held)
+    return;
+  const send = [];
+  const show = [];
+  const same = (key, a, b) => canonical(key, a ?? "") === canonical(key, b ?? "");
+  for (const [key, entry] of held.entries) {
+    const after = wanted.entries.get(key)?.block;
+    const before = entry.block;
+    const lines = [];
+    const label = labelOf([bare(entry.id)]);
+    const primaryMoves = before.settings.has("ip") && !same("ip", before.settings.get("ip"), after?.settings.get("ip"));
+    const secondaries = before.blocks.get("secondaryip");
+    const keptSecondaries = after?.blocks.get("secondaryip");
+    const goneSecondaries = [...secondaries?.entries ?? []].filter(([id, secondary]) => primaryMoves || !same("ip", secondary.block.settings.get("ip"), keptSecondaries?.entries.get(id)?.block.settings.get("ip")));
+    if (goneSecondaries.length) {
+      lines.push("config secondaryip", ...goneSecondaries.map(([, secondary]) => `delete ${secondary.id}`), "end");
+      for (const [id, secondary] of goneSecondaries) {
+        show.push(`- ${label}secondaryip ${bare(secondary.id)}: set ip ${secondary.block.settings.get("ip")}`);
+        secondaries.entries.delete(id);
+      }
+    }
+    if (primaryMoves) {
+      lines.push("unset ip");
+      show.push(`- ${label}set ip ${before.settings.get("ip")}`);
+      before.settings.delete("ip");
+    }
+    const ipv6 = before.blocks.get("ipv6");
+    const keptIpv6 = after?.blocks.get("ipv6");
+    const extra = ipv6?.blocks.get("ip6-extra-addr");
+    const goneExtra = [...extra?.entries ?? []].filter(([id]) => !keptIpv6?.blocks.get("ip6-extra-addr")?.entries.has(id));
+    const v6Lines = [];
+    if (goneExtra.length) {
+      v6Lines.push("config ip6-extra-addr", ...goneExtra.map(([, address]) => `delete ${address.id}`), "end");
+      for (const [id, address] of goneExtra) {
+        show.push(`- ${label}ipv6 ip6-extra-addr ${bare(address.id)}`);
+        extra.entries.delete(id);
+      }
+    }
+    if (ipv6?.settings.has("ip6-address") && !same("ip6-address", ipv6.settings.get("ip6-address"), keptIpv6?.settings.get("ip6-address"))) {
+      v6Lines.push("unset ip6-address");
+      show.push(`- ${label}ipv6: set ip6-address ${ipv6.settings.get("ip6-address")}`);
+      ipv6.settings.delete("ip6-address");
+    }
+    if (v6Lines.length)
+      lines.push("config ipv6", ...v6Lines, "end");
+    if (lines.length)
+      send.push(`edit ${entry.id}`, ...lines, "next");
+  }
+  return send.length ? { title: "system interface, addresses that move", show, send: ["config system interface", ...send, "end"] } : undefined;
+}
+function plan(desired, current, options) {
+  const want = separateTunnels(parse(desired));
+  const have = separateTunnels(parse(clean(current)));
+  keepFilled(want, have);
+  const first = [];
+  const steps = [];
+  const removals = [];
+  const { freed, gone, trims, deferred } = released(want, have);
+  const late = deferredPorts(want, have, deferred, options.secrets);
+  if (freed.size) {
+    for (const section of [...have.blocks.keys()].reverse()) {
+      const block = have.blocks.get(section);
+      if (section === TUNNELS) {
+        for (const key of [...block.entries.keys()])
+          if (freed.has(key))
+            block.entries.delete(key);
+        continue;
+      }
+      const { send, show } = release(block, [], freed, KEYED_BY_INTERFACE.has(section) ? freed : section === "system interface" ? gone : new Set, false);
+      if (send.length)
+        first.push({ title: `${section}, released`, show, send: [`config ${section}`, ...send, "end"] });
+    }
+  }
+  if (trims.length) {
+    const interfaces = have.blocks.get("system interface");
+    const send = trims.flatMap(({ id, members }) => [`edit ${id}`, `set member ${quoteAll(members)}`, "next"]);
+    const show = trims.map(({ id, members }) => `+ ${bare(id)}: set member ${quoteAll(members)}`);
+    first.push({ title: "system interface, ports leaving a LAG", show, send: ["config system interface", ...send, "end"] });
+    for (const { id, members } of trims)
+      interfaces.entries.get(bare(id)).block.settings.set("member", quoteAll(members));
+  }
+  const moved = movedAddresses(want, have);
+  if (moved)
+    first.push(moved);
+  for (const [section, block] of want.blocks) {
+    const header = section === TUNNELS ? "system interface" : section;
+    const context = { section: header, secrets: options.secrets };
+    const table = section === TUNNELS ? undefined : TABLES[header];
+    const diff = compare([], block, have.blocks.get(section) ?? new Block, table, true, context);
+    if (diff.send.length)
+      steps.push({ title: section, show: diff.show, send: [`config ${header}`, ...diff.send, "end"] });
+    if (diff.removals.length && section !== TUNNELS) {
+      removals.unshift({ title: `${section}, removed`, show: diff.removed, send: [`config ${header}`, ...diff.removals, "end"] });
+    }
+  }
+  return { steps: [...first, ...steps, ...removals, ...late], problems: [] };
+}
+var TUNNELS = "system interface, tunnels";
+function separateTunnels(root) {
+  const interfaces = root.blocks.get("system interface");
+  if (!interfaces)
+    return root;
+  const tunnels = new Block;
+  for (const [key, entry] of interfaces.entries) {
+    const type = entry.block.settings.get("type");
+    if (type !== "tunnel" && type !== "vxlan")
+      continue;
+    entry.block.settings.delete("interface");
+    tunnels.entries.set(key, entry);
+    interfaces.entries.delete(key);
+  }
+  const sections = [...root.blocks];
+  root.blocks.clear();
+  for (const [section, block] of sections) {
+    root.blocks.set(section, block);
+    if (section === "system vxlan")
+      root.blocks.set(TUNNELS, tunnels);
+  }
+  if (!root.blocks.has(TUNNELS))
+    root.blocks.set(TUNNELS, tunnels);
+  return root;
+}
+function keepFilled(want, have) {
+  for (const table of Object.values(PREFIX_LIST)) {
+    for (const [key, entry] of want.blocks.get(table)?.entries ?? []) {
+      if (!bare(entry.block.settings.get("comments") ?? "").startsWith(FILLED))
+        continue;
+      const held = have.blocks.get(table)?.entries.get(key)?.block.blocks.get("rule");
+      if (held)
+        entry.block.blocks.set("rule", held);
+    }
+  }
+}
+function deferredPorts(want, have, ports, secrets) {
+  const wanted = want.blocks.get("system interface");
+  const held = have.blocks.get("system interface");
+  if (!ports.size || !wanted || !held)
+    return [];
+  const later = { want: new Block, have: new Block };
+  for (const port of ports) {
+    const after = wanted.entries.get(port);
+    const before = held.entries.get(port);
+    if (!after || !before)
+      continue;
+    later.want.entries.set(port, after);
+    later.have.entries.set(port, before);
+    wanted.entries.delete(port);
+    held.entries.delete(port);
+  }
+  const diff = compare([], later.want, later.have, TABLES["system interface"], true, { section: "system interface", secrets });
+  if (!diff.send.length)
+    return [];
+  return [
+    { title: "system interface, ports of a LAG that went", show: diff.show, send: ["config system interface", ...diff.send, "end"] }
+  ];
+}
+
+// src/adapters/devices/fortios/render.ts
+var BANNER = 'system replacemsg admin "pre_admin-disclaimer-text"';
+var SECTIONS = [
+  "vpn certificate local",
+  "vpn certificate ca",
+  "system global",
+  BANNER,
+  "system settings",
+  "system accprofile",
+  "system admin",
+  "system interface",
+  "system gre-tunnel",
+  "system vxlan",
+  "system dns",
+  "system dns-server",
+  "system ntp",
+  "system snmp sysinfo",
+  "system snmp community",
+  "system snmp user",
+  "log memory setting",
+  "log memory filter",
+  "log disk setting",
+  ...["", "2", "3", "4"].flatMap((number) => [`log syslogd${number} setting`, `log syslogd${number} filter`]),
+  "system sflow",
+  "system netflow",
+  "system dhcp server",
+  "router static",
+  "router static6",
+  "router prefix-list",
+  "router prefix-list6",
+  "router community-list",
+  "router route-map",
+  "router ospf",
+  "router ospf6",
+  "router bgp",
+  "system session-helper",
+  "firewall address",
+  "firewall address6",
+  "firewall addrgrp",
+  "firewall addrgrp6",
+  "firewall service custom",
+  "firewall ippool",
+  "firewall vip",
+  "firewall policy",
+  "firewall policy6",
+  "firewall local-in-policy",
+  "firewall local-in-policy6",
+  "firewall central-snat-map",
+  "firewall acl",
+  "firewall acl6"
+];
+var FULL = ["vpn certificate local", "vpn certificate ca"];
+var ZONES = {
+  "00": ["Pacific/Kwajalein"],
+  "01": ["Pacific/Midway", "Pacific/Pago_Pago"],
+  "02": ["Pacific/Honolulu"],
+  "03": ["America/Anchorage"],
+  "04": ["America/Los_Angeles", "America/Vancouver", "America/Tijuana"],
+  "05": ["America/Phoenix"],
+  "06": ["America/Denver", "America/Edmonton"],
+  "07": ["America/Guatemala", "America/Costa_Rica", "America/El_Salvador", "America/Tegucigalpa", "America/Managua"],
+  "08": ["America/Chicago", "America/Winnipeg"],
+  "09": ["America/Mexico_City"],
+  "10": ["America/Regina"],
+  "11": ["America/Bogota", "America/Lima", "America/Guayaquil"],
+  "12": ["America/New_York", "America/Toronto"],
+  "13": ["America/Indiana/Indianapolis"],
+  "14": ["America/Halifax"],
+  "15": ["America/La_Paz"],
+  "16": ["America/Santiago"],
+  "17": ["America/St_Johns"],
+  "18": ["America/Sao_Paulo"],
+  "19": ["America/Argentina/Buenos_Aires"],
+  "20": ["America/Nuuk", "America/Godthab"],
+  "21": ["Atlantic/South_Georgia"],
+  "22": ["Atlantic/Azores"],
+  "23": ["Atlantic/Cape_Verde"],
+  "24": ["Africa/Monrovia"],
+  "25": ["Europe/London", "Europe/Dublin", "Europe/Lisbon", "Atlantic/Canary"],
+  "26": ["Europe/Amsterdam", "Europe/Berlin", "Europe/Zurich", "Europe/Rome", "Europe/Stockholm", "Europe/Vienna"],
+  "27": ["Europe/Belgrade", "Europe/Bratislava", "Europe/Budapest", "Europe/Ljubljana", "Europe/Prague"],
+  "28": ["Europe/Brussels", "Europe/Copenhagen", "Europe/Madrid", "Europe/Paris"],
+  "29": ["Europe/Sarajevo", "Europe/Skopje", "Europe/Warsaw", "Europe/Zagreb"],
+  "30": ["Africa/Lagos"],
+  "31": ["Europe/Athens", "Europe/Sofia", "Europe/Vilnius"],
+  "32": ["Europe/Bucharest"],
+  "33": ["Africa/Cairo"],
+  "34": ["Africa/Harare", "Africa/Johannesburg"],
+  "35": ["Europe/Helsinki", "Europe/Riga", "Europe/Tallinn"],
+  "36": ["Asia/Jerusalem"],
+  "37": ["Asia/Baghdad"],
+  "38": ["Asia/Kuwait", "Asia/Riyadh"],
+  "39": ["Europe/Volgograd"],
+  "40": ["Africa/Nairobi"],
+  "41": ["Asia/Tehran"],
+  "42": ["Asia/Dubai", "Asia/Muscat"],
+  "43": ["Asia/Baku"],
+  "44": ["Asia/Kabul"],
+  "45": ["Asia/Yekaterinburg"],
+  "46": ["Asia/Karachi", "Asia/Tashkent"],
+  "47": ["Asia/Kolkata", "Asia/Calcutta"],
+  "48": ["Asia/Kathmandu"],
+  "49": ["Asia/Almaty", "Asia/Novosibirsk"],
+  "50": ["Asia/Dhaka"],
+  "51": ["Asia/Colombo"],
+  "52": ["Asia/Yangon", "Asia/Rangoon"],
+  "53": ["Asia/Jakarta", "Asia/Bangkok", "Asia/Ho_Chi_Minh"],
+  "54": ["Asia/Krasnoyarsk"],
+  "55": ["Asia/Shanghai", "Asia/Chongqing", "Asia/Hong_Kong", "Asia/Urumqi", "Asia/Irkutsk"],
+  "56": ["Asia/Ulaanbaatar"],
+  "57": ["Asia/Kuala_Lumpur", "Asia/Singapore"],
+  "58": ["Australia/Perth"],
+  "59": ["Asia/Taipei"],
+  "60": ["Asia/Tokyo", "Asia/Seoul"],
+  "61": ["Asia/Yakutsk"],
+  "62": ["Australia/Adelaide"],
+  "63": ["Australia/Darwin"],
+  "64": ["Australia/Brisbane"],
+  "65": ["Australia/Sydney", "Australia/Melbourne", "Australia/Canberra"],
+  "66": ["Pacific/Guam", "Pacific/Port_Moresby"],
+  "67": ["Australia/Hobart"],
+  "68": ["Asia/Vladivostok"],
+  "69": ["Asia/Magadan"],
+  "70": ["Pacific/Guadalcanal", "Pacific/Noumea"],
+  "71": ["Pacific/Auckland"],
+  "72": ["Pacific/Fiji", "Asia/Kamchatka", "Pacific/Majuro"],
+  "73": ["Pacific/Tongatapu"],
+  "74": ["America/Caracas"],
+  "75": ["America/Montevideo"],
+  "76": ["Pacific/Kiritimati"],
+  "77": ["America/Guyana"],
+  "78": ["Africa/Windhoek"],
+  "79": ["Africa/Casablanca"],
+  "80": ["UTC", "Etc/UTC", "Etc/GMT", "GMT"],
+  "81": ["America/Mazatlan", "America/Chihuahua"],
+  "82": ["Pacific/Chatham"],
+  "83": ["Europe/Moscow"],
+  "84": ["Europe/Minsk"],
+  "85": ["Europe/Istanbul"],
+  "86": ["Pacific/Apia"],
+  "87": ["America/Asuncion"]
+};
+function zoneOf(timezone = "UTC") {
+  return Object.entries(ZONES).find(([, places]) => places.includes(timezone))?.[0];
+}
+var PROFILE = { admin: "super_admin", operator: "circuit-operator", "read-only": "circuit-read-only" };
+var PERMISSION_GROUPS = [
+  "secfabgrp",
+  "ftviewgrp",
+  "authgrp",
+  "sysgrp",
+  "netgrp",
+  "loggrp",
+  "fwgrp",
+  "vpngrp",
+  "utmgrp",
+  "wanoptgrp",
+  "wifi"
+];
+var SSH_KEYS = 3;
+var RESOLVERS = { device: 2, dhcp: 4 };
+var COLLECTORS = 4;
+var VRFS = 31;
+var LEVEL = {
+  emergency: "emergency",
+  alert: "alert",
+  critical: "critical",
+  error: "error",
+  warning: "warning",
+  notice: "notification",
+  info: "information",
+  debug: "debug"
+};
+var HELPERS = {
+  ftp: [["ftp", 6, 21]],
+  tftp: [["tftp", 17, 69]],
+  sip: [["sip", 17, 5060]],
+  h323: [
+    ["h323", 6, 1720],
+    ["ras", 17, 1719]
+  ],
+  pptp: [["pptp", 6, 1723]],
+  rtsp: [
+    ["rtsp", 6, 554],
+    ["rtsp", 6, 7070],
+    ["rtsp", 6, 8554]
+  ]
+};
+var SPEEDS = {
+  "40g": { "40g": "40000full" },
+  "10g": { "10g": "10000full", "1g": "1000full" },
+  "1g": { "1g": "1000full", "100m": "100full" }
+};
+function allowAccess(device) {
+  const management = device.management ?? {};
+  const services = ["ping"];
+  if (management.https)
+    services.push("https");
+  if (management.ssh)
+    services.push("ssh");
+  if (management.snmp)
+    services.push("snmp");
+  if (management.http)
+    services.push("http");
+  if (management.telnet)
+    services.push("telnet");
+  if (management.native)
+    services.push("fgfm");
+  return services.join(" ");
+}
+function render(device) {
+  const root = new Block;
+  for (const section of SECTIONS)
+    root.block(section);
+  const section = (name) => root.block(name);
+  certificates(section("vpn certificate local"), section("vpn certificate ca"), device);
+  global(section("system global"), device);
+  if (device.system?.banner)
+    section(BANNER).set("buffer", quote(device.system.banner));
+  if (natRules(device).length)
+    section("system settings").set("central-nat", "enable");
+  section("system settings").set("default-voip-alg-mode", "kernel-helper-based");
+  if (usesBfd(device))
+    section("system settings").set("bfd", "enable");
+  users(section("system accprofile"), section("system admin"), device);
+  interfaces(root, device);
+  dns(section("system dns"), section("system dns-server"), device);
+  ntp(section("system ntp"), device);
+  snmp(root, device);
+  logging(root, device);
+  flowExport(root, device);
+  dhcpServers(section("system dhcp server"), device);
+  staticRoutes(section("router static"), section("router static6"), device);
+  routing(root, device);
+  helpers(section("system session-helper"), device);
+  firewall(root, device);
+  return print(root);
+}
+function certificates(local, trusted, device) {
+  for (const [name, certificate] of Object.entries(device.certificates ?? {})) {
+    const text = quote(certificate.certificate.trim());
+    if (certificate.private_key)
+      local.entry(name).set("private-key", quote(marker(certificate.private_key))).set("certificate", text);
+    else
+      trusted.entry(name).set("ca", text);
+  }
+}
+function global(block, device) {
+  const management = device.management ?? {};
+  block.set("hostname", quote(device.name));
+  const zone = zoneOf(device.system?.timezone);
+  if (zone && zone !== "00")
+    block.set("timezone", zone);
+  if (management.ssh?.port)
+    block.set("admin-ssh-port", management.ssh.port);
+  if (management.ssh?.auth_timeout)
+    block.set("admin-ssh-grace-time", management.ssh.auth_timeout);
+  if (management.ssh?.weak_crypto)
+    block.set("strong-crypto", "disable");
+  if (management.https?.port)
+    block.set("admin-sport", management.https.port);
+  if (management.https?.certificate)
+    block.set("admin-server-cert", quote(management.https.certificate));
+  if (management.http?.port)
+    block.set("admin-port", management.http.port);
+  if (management.telnet?.port)
+    block.set("admin-telnet-port", management.telnet.port);
+  if (management.http)
+    block.set("admin-https-redirect", "disable");
+  if (device.system?.banner)
+    block.set("pre-login-banner", "enable");
+  if (device.lldp === true)
+    block.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+}
+function users(profiles, admins, device) {
+  const roles = new Set(Object.values(device.users ?? {}).map((user) => user.role));
+  for (const role of ["operator", "read-only"]) {
+    if (!roles.has(role))
+      continue;
+    const profile = profiles.entry(PROFILE[role]);
+    for (const group of PERMISSION_GROUPS)
+      profile.set(group, role === "operator" && group !== "sysgrp" ? "read-write" : "read");
+  }
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    const admin = admins.entry(name);
+    admin.set("accprofile", quote(PROFILE[user.role]));
+    if (user.description)
+      admin.set("comments", quote(user.description));
+    admin.set("vdom", quote("root"));
+    (user.ssh_keys ?? []).forEach((key, index) => admin.set(`ssh-public-key${index + 1}`, quote(key)));
+    admin.set("password", quote(marker(user.password)));
+  }
+}
+function interfaces(root, device) {
+  const block = root.block("system interface");
+  const access = allowAccess(device);
+  for (const port of portsOf(device.platform, device.model)) {
+    const settings = device.ports?.[port];
+    const entry = block.entry(spell(device.platform, device.model, port));
+    entry.set("vdom", quote("root"));
+    entry.set("type", "physical");
+    if (!settings) {
+      redirects(entry, device);
+      entry.set("status", "down");
+      continue;
+    }
+    if (settings.description)
+      entry.set("description", quote(settings.description));
+    const speed = settings.speed && SPEEDS[port.split("-")[0]]?.[settings.speed];
+    if (speed)
+      entry.set("speed", speed);
+    if (settings.lag)
+      continue;
+    redirects(entry, device);
+    if (settings.mtu)
+      entry.set("mtu-override", "enable").set("mtu", settings.mtu);
+    routed(entry, device, port, settings, access);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "lag")
+      continue;
+    const members = Object.entries(device.ports ?? {}).filter(([, port]) => port?.lag === name).map(([port]) => spell(device.platform, device.model, port));
+    const entry = block.entry(name);
+    entry.set("vdom", quote("root"));
+    entry.set("type", "aggregate");
+    if (members.length)
+      entry.set("member", quoteAll(members));
+    if (iface.mode === "static")
+      entry.set("lacp-mode", "static");
+    if (iface.description)
+      entry.set("description", quote(iface.description));
+    if (iface.mtu)
+      entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+    redirects(entry, device);
+    routed(entry, device, name, iface, access);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "vlan")
+      continue;
+    const parent = vlanParent(device, iface.vlan);
+    const entry = block.entry(name);
+    entry.set("vdom", quote("root"));
+    if (parent)
+      entry.set("interface", quote(nameOf(device, parent)));
+    entry.set("vlanid", device.vlans?.[iface.vlan]?.id ?? 0);
+    if (iface.description)
+      entry.set("description", quote(iface.description));
+    if (iface.mtu)
+      entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+    redirects(entry, device);
+    routed(entry, device, name, iface, access);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "loopback")
+      continue;
+    const entry = block.entry(name);
+    entry.set("vdom", quote("root"));
+    entry.set("type", "loopback");
+    if (iface.description)
+      entry.set("description", quote(iface.description));
+    redirects(entry, device);
+    routed(entry, device, name, iface, access);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "gre" && iface.type !== "vxlan")
+      continue;
+    const outgoing = holderOf(device, iface.local);
+    const via = outgoing ? quote(nameOf(device, outgoing)) : '""';
+    const ipv6 = familyOf2(iface.remote) === "ipv6";
+    if (iface.type === "gre") {
+      const tunnel = root.block("system gre-tunnel").entry(name).set("interface", via);
+      if (ipv6)
+        tunnel.set("ip-version", 6).set("remote-gw6", iface.remote).set("local-gw6", iface.local);
+      else
+        tunnel.set("remote-gw", iface.remote).set("local-gw", iface.local);
+    } else {
+      const tunnel = root.block("system vxlan").entry(name).set("interface", via).set("vni", iface.vni);
+      if (ipv6)
+        tunnel.set("ip-version", "ipv6-unicast").set("remote-ip6", quote(iface.remote));
+      else
+        tunnel.set("remote-ip", quote(iface.remote));
+      if (iface.port !== undefined && iface.port !== 4789)
+        tunnel.set("dstport", iface.port);
+    }
+    const entry = block.entry(name);
+    entry.set("vdom", quote("root"));
+    entry.set("type", iface.type === "gre" ? "tunnel" : "vxlan");
+    entry.set("interface", via);
+    if (iface.type === "vxlan" && iface.mac)
+      entry.set("macaddr", iface.mac.toLowerCase());
+    if (iface.description)
+      entry.set("description", quote(iface.description));
+    if (iface.mtu)
+      entry.set("mtu-override", "enable").set("mtu", iface.mtu);
+    redirects(entry, device);
+    routed(entry, device, name, iface, access);
+  }
+}
+function redirects(entry, device) {
+  if (!device.system?.ip?.icmp_redirects)
+    entry.set("icmp-send-redirect", "disable");
+}
+function vlanParent(device, vlan) {
+  const carriers = [
+    ...Object.entries(device.ports ?? {}).filter(([, port]) => !port?.lag && port?.trunk_vlans?.includes(vlan)),
+    ...Object.entries(device.interfaces ?? {}).filter(([, iface]) => iface.type === "lag" && iface.trunk_vlans?.includes(vlan))
+  ];
+  return carriers.length === 1 ? carriers[0][0] : undefined;
+}
+function routed(entry, device, name, settings, access) {
+  const addresses = addressesOf2(settings);
+  const ipv4 = addresses.filter((address) => familyOf2(host2(address)) === "ipv4");
+  const ipv6 = addresses.filter((address) => familyOf2(host2(address)) === "ipv6");
+  const vrf = vrfNumber(device, settings.vrf);
+  if (vrf)
+    entry.set("vrf", vrf);
+  const peer = settings.addresses?.find((item) => typeof item !== "string");
+  if (peer) {
+    entry.set("ip", `${host2(peer.address)} 255.255.255.255`);
+    entry.set("remote-ip", `${peer.peer} ${netmask(split(peer.address).len)}`);
+    entry.set("allowaccess", access);
+  } else if (ipv4.length) {
+    entry.set("ip", subnet(ipv4[0]));
+    entry.set("allowaccess", access);
+  }
+  if (!peer && ipv4.length > 1) {
+    entry.set("secondary-IP", "enable");
+    const secondaries = entry.block("secondaryip");
+    ipv4.slice(1).forEach((address, index) => secondaries.entry(index + 1).set("ip", subnet(address)).set("allowaccess", access));
+  }
+  const relays = Object.values(device.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
+  const relayed = relays.flatMap((relay) => relay.servers);
+  const relayed4 = relayed.filter((server) => familyOf2(server) === "ipv4");
+  const relayed6 = relayed.filter((server) => familyOf2(server) === "ipv6");
+  if (ipv6.length || relayed6.length) {
+    const block = entry.block("ipv6");
+    if (ipv6.length) {
+      block.set("ip6-address", ipv6[0]);
+      block.set("ip6-allowaccess", access);
+    }
+    if (settings.ipv6_ra) {
+      block.set("ip6-send-adv", "enable");
+      const prefixes = block.block("ip6-prefix-list");
+      for (const address of ipv6)
+        prefixes.entry(network2(address), true);
+    }
+    if (relayed6.length)
+      block.set("dhcp6-relay-service", "enable").set("dhcp6-relay-ip", relayed6.join(" "));
+    if (ipv6.length > 1) {
+      const extra = block.block("ip6-extra-addr");
+      for (const address of ipv6.slice(1))
+        extra.entry(address, true);
+    }
+  }
+  if (settings.vrrp?.length) {
+    const groups = entry.block("vrrp");
+    for (const group of settings.vrrp) {
+      const vrrp = groups.entry(group.id).set("vrip", group.address);
+      if (group.priority !== undefined && group.priority !== 100)
+        vrrp.set("priority", group.priority);
+      if (group.interval !== undefined && group.interval !== 1)
+        vrrp.set("adv-interval", group.interval);
+      if (!group.preempt)
+        vrrp.set("preempt", "disable");
+    }
+  }
+  if (relayed4.length) {
+    entry.set("dhcp-relay-service", "enable");
+    entry.set("dhcp-relay-ip", quoteAll(relayed4));
+  }
+  const listed = typeof device.lldp === "object" && device.lldp.interfaces.includes(name);
+  if (settings.lldp === false)
+    entry.set("lldp-transmission", "disable").set("lldp-reception", "disable");
+  else if (listed || settings.lldp === true && device.lldp !== true)
+    entry.set("lldp-transmission", "enable").set("lldp-reception", "enable");
+  const flow = device.flow_export;
+  const tunnel = ["gre", "vxlan"].includes(device.interfaces?.[name]?.type ?? "");
+  const sampled = flow && !tunnel && (!flow.interfaces || flow.interfaces.includes(name));
+  if (sampled && flow.protocol === "sflow") {
+    entry.set("sflow-sampler", "enable");
+    if (flow.sampling !== undefined && flow.sampling !== 2000)
+      entry.set("sample-rate", flow.sampling);
+  }
+  if (sampled && flow.protocol === "netflow-v9")
+    entry.set("netflow-sampler", "both");
+}
+function dns(block, servers, device) {
+  const resolvers = device.system?.dns?.servers ?? [];
+  const ipv4 = resolvers.filter((server) => familyOf2(server) === "ipv4");
+  const ipv6 = resolvers.filter((server) => familyOf2(server) === "ipv6");
+  if (ipv4[0])
+    block.set("primary", ipv4[0]);
+  if (ipv4[1])
+    block.set("secondary", ipv4[1]);
+  if (ipv6[0])
+    block.set("ip6-primary", ipv6[0]);
+  if (ipv6[1])
+    block.set("ip6-secondary", ipv6[1]);
+  if (device.system?.dns?.serve)
+    for (const name of addressed(device))
+      servers.entry(nameOf(device, name));
+}
+function ntp(block, device) {
+  const ntp = device.system?.ntp;
+  const servers = ntp?.servers ?? [];
+  if (servers.length) {
+    block.set("ntpsync", "enable");
+    block.set("type", "custom");
+    const list = block.block("ntpserver");
+    servers.forEach((server, index) => list.entry(index + 1).set("server", quote(server)));
+  }
+  if (ntp?.serve) {
+    block.set("server-mode", "enable");
+    block.set("interface", quoteAll(addressed(device).map((name) => nameOf(device, name))));
+  }
+}
+function snmp(root, device) {
+  const snmp = device.management?.snmp;
+  if (!snmp)
+    return;
+  const sysinfo = root.block("system snmp sysinfo");
+  sysinfo.set("status", "enable");
+  if (snmp.contact)
+    sysinfo.set("contact-info", quote(snmp.contact));
+  if (snmp.location)
+    sysinfo.set("location", quote(snmp.location));
+  if (snmp.community) {
+    const community = root.block("system snmp community").entry(1);
+    community.set("name", quote(marker(snmp.community)));
+    const allow = snmp.allow ?? device.management?.allow ?? [];
+    const ipv4 = allow.filter((prefix) => familyOf2(host2(prefix)) === "ipv4");
+    const ipv6 = allow.filter((prefix) => familyOf2(host2(prefix)) === "ipv6");
+    ipv4.forEach((prefix, index) => community.block("hosts").entry(index + 1).set("ip", subnet(network2(prefix))));
+    ipv6.forEach((prefix, index) => community.block("hosts6").entry(index + 1).set("ipv6", network2(prefix)));
+    community.set("query-v1-status", "disable");
+    if (snmp.port)
+      community.set("query-v2c-port", snmp.port);
+    community.set("trap-v1-status", "disable");
+    community.set("trap-v2c-status", "disable");
+  }
+  for (const [name, user] of Object.entries(snmp.users ?? {})) {
+    const entry = root.block("system snmp user").entry(name);
+    entry.set("security-level", "auth-priv");
+    if (snmp.port)
+      entry.set("query-port", snmp.port);
+    entry.set("auth-pwd", quote(marker(user.auth_password)));
+    if (user.privacy === "des")
+      entry.set("priv-proto", "des");
+    entry.set("priv-pwd", quote(marker(user.privacy_password)));
+  }
+}
+function logging(root, device) {
+  const logging = device.system?.logging;
+  root.block("log memory setting").set("status", logging?.local ? "enable" : "disable");
+  if (logging?.local && logging.local.level !== "info")
+    root.block("log memory filter").set("severity", LEVEL[logging.local.level]);
+  root.block("log disk setting").set("status", "disable");
+  (logging?.remote ?? []).slice(0, COLLECTORS).forEach((collector, index) => {
+    const number = index === 0 ? "" : String(index + 1);
+    const setting = root.block(`log syslogd${number} setting`);
+    setting.set("status", "enable");
+    setting.set("server", quote(collector.address));
+    if (collector.port && collector.port !== 514)
+      setting.set("port", collector.port);
+    if (collector.level !== "info")
+      root.block(`log syslogd${number} filter`).set("severity", LEVEL[collector.level]);
+  });
+}
+function flowExport(root, device) {
+  const flow = device.flow_export;
+  const collector = flow?.collectors[0];
+  if (!flow || !collector)
+    return;
+  if (flow.protocol === "sflow") {
+    const block = root.block("system sflow").set("collector-ip", collector.address);
+    if (collector.port && collector.port !== 6343)
+      block.set("collector-port", collector.port);
+  }
+  if (flow.protocol === "netflow-v9") {
+    const block = root.block("system netflow").set("collector-ip", collector.address);
+    if (collector.port && collector.port !== 2055)
+      block.set("collector-port", collector.port);
+  }
+}
+function dhcpServers(block, device) {
+  Object.values(device.dhcp ?? {}).forEach((server, index) => {
+    const entry = block.entry(index + 1);
+    if (server.lease_time !== undefined && server.lease_time !== 604800)
+      entry.set("lease-time", server.lease_time);
+    entry.set("default-gateway", server.gateway);
+    entry.set("netmask", netmask(split(server.network).len));
+    entry.set("interface", quote(nameOf(device, server.interface)));
+    entry.set("dns-service", "specify");
+    entry.block("ip-range").entry(1).set("start-ip", server.pool[0]).set("end-ip", server.pool[1]);
+    (server.reservations ?? []).forEach((reservation, number) => {
+      const reserved = entry.block("reserved-address").entry(number + 1);
+      reserved.set("ip", reservation.address).set("mac", reservation.mac.toLowerCase());
+      if (reservation.description)
+        reserved.set("description", quote(reservation.description));
+    });
+    (server.dns ?? []).forEach((resolver, number) => entry.set(`dns-server${number + 1}`, resolver));
+  });
+}
+function staticRoutes(ipv4, ipv6, device) {
+  const counters = { ipv4: 0, ipv6: 0 };
+  for (const route of device.routing?.static ?? []) {
+    const family = familyOf2(split(route.prefix).addr);
+    const entry = (family === "ipv4" ? ipv4 : ipv6).entry(++counters[family]);
+    const prefix = network2(route.prefix);
+    if (family === "ipv6" && prefix !== "::/0")
+      entry.set("dst", prefix);
+    if (family === "ipv4" && prefix !== "0.0.0.0/0")
+      entry.set("dst", subnet(prefix));
+    if (route.via)
+      entry.set("gateway", route.via);
+    const outgoing = route.interface ?? (route.via ? interfaceFor(device, route.via, route.vrf) : undefined);
+    if (outgoing && !route.blackhole)
+      entry.set("device", quote(nameOf(device, outgoing)));
+    if (route.distance !== undefined && route.distance !== 10)
+      entry.set("distance", route.distance);
+    if (route.description)
+      entry.set("comment", quote(route.description));
+    if (route.blackhole)
+      entry.set("blackhole", "enable");
+  }
+}
+function helpers(block, device) {
+  let number = 0;
+  for (const helper of device.firewall?.helpers ?? []) {
+    for (const [name, protocol, port] of HELPERS[helper] ?? [])
+      block.entry(++number).set("name", name).set("protocol", protocol).set("port", port);
+  }
+}
+
+// src/adapters/devices/fortios/index.ts
+var SUPPORTED = "6.2";
+var NAME_LENGTH = { interface: 15, object: 79 };
+var RESERVED_INTERFACES = new Set(["any", "modem", "ssl.root"]);
+var PROMPT = /(?:^|\n)[^\n]*[#$] $/;
+var QUESTION = /\(y\/n\)\s*$/;
+var BANNER2 = /\(Press 'a' to accept\):\s*$/;
+var LOGGED_OUT = /(?:^|\n)[^\n]*login: $/;
+var PAGER = /--More-- \r? *\r/g;
+var REFUSED = /Command fail\. Return code|Unknown action|parse error|discard the setting|MUST be set|Can not config|isn't supported|(?:^|\n)Invalid /;
+
+class Cli {
+  channel;
+  newline;
+  prompt = "";
+  constructor(channel, newline = `
+`) {
+    this.channel = channel;
+    this.newline = newline;
+  }
+  async ready(timeout = 30000) {
+    await this.collect(timeout);
+  }
+  async run(line, timeout = 60000) {
+    this.channel.write(line + this.newline);
+    const output = await this.collect(timeout);
+    const lines = output.split(`
+`);
+    return lines.slice(1, -1).join(`
+`);
+  }
+  answer(reply, timeout = 60000) {
+    this.channel.write(reply);
+    return this.collect(timeout);
+  }
+  collect(timeout) {
+    return new Promise((done, fail) => {
+      let raw = "";
+      let settle;
+      const text = () => raw.replace(PAGER, "").replace(/\r/g, "");
+      const stop = () => {
+        clearTimeout(limit);
+        clearTimeout(settle);
+        this.channel.removeListener("data", onData);
+        this.channel.removeListener("close", onClose);
+      };
+      const finish = () => {
+        stop();
+        const output = text();
+        this.prompt = output.split(`
+`).at(-1) ?? "";
+        done(output);
+      };
+      const onData = (chunk) => {
+        raw += chunk.toString("utf8");
+        if (raw.endsWith("--More-- "))
+          this.channel.write(" ");
+        if (BANNER2.test(raw))
+          this.channel.write("a");
+        clearTimeout(settle);
+        if (LOGGED_OUT.test(text())) {
+          stop();
+          fail(new Error("the device ended the session"));
+        } else if (PROMPT.test(text()) || QUESTION.test(text())) {
+          settle = setTimeout(finish, 300);
+        }
+      };
+      const onClose = () => {
+        stop();
+        fail(new Error("the device ended the session"));
+      };
+      const limit = setTimeout(() => {
+        stop();
+        fail(new Error(`no prompt within ${timeout / 1000} seconds: ${text().slice(-200)}`));
+      }, timeout);
+      this.channel.on("data", onData);
+      this.channel.on("close", onClose);
+    });
+  }
+}
+async function login(device) {
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return connect({
+    host: device.connection.host,
+    port: device.connection.port,
+    user: device.connection.user,
+    password: resolve(user.password)
+  });
+}
+async function session(device, work) {
+  const client = await login(device);
+  try {
+    const channel = await shell(client, 4000);
+    const cli = new Cli(channel);
+    await cli.ready();
+    const result = await work(cli);
+    channel.end();
+    return result;
+  } finally {
+    client.end();
+  }
+}
+async function checkVersion(cli, device) {
+  const status = await cli.run("get system status");
+  const version = /^Version: \S+ v(\d+)\.(\d+)\.(\d+)/m.exec(status);
+  if (!version)
+    throw new Error(`${device.name} did not say which FortiOS it runs: ${status.slice(0, 200)}`);
+  if (`${version[1]}.${version[2]}` !== SUPPORTED) {
+    throw new Error(`${device.name} runs FortiOS ${version[1]}.${version[2]}.${version[3]}; this adapter renders for FortiOS ${SUPPORTED}`);
+  }
+}
+function scrub(text) {
+  const root = parse(text);
+  for (const { block } of root.blocks.get("system snmp community")?.entries.values() ?? []) {
+    if (block.settings.has("name"))
+      block.settings.set("name", '"<redacted>"');
+  }
+  const hide = (block) => {
+    for (const [key, value] of block.settings) {
+      if (value.startsWith("ENC "))
+        block.settings.set(key, "ENC <redacted>");
+      if (key === "private-key")
+        block.settings.set(key, '"<redacted>"');
+    }
+    for (const child of block.blocks.values())
+      hide(child);
+    for (const entry of block.entries.values())
+      hide(entry.block);
+  };
+  hide(root);
+  return print(root);
+}
+async function readConfig(cli, device) {
+  await checkVersion(cli, device);
+  const parts = [];
+  for (const section of SECTIONS) {
+    const show = FULL.includes(section) ? "show full-configuration" : "show";
+    parts.push(await cli.run(`${show} ${section}`, 120000));
+  }
+  const text = parts.join(`
+`);
+  if (!/^config system global$/m.test(text))
+    throw new Error(`${device.name} returned no configuration`);
+  return scrub(clean(text));
+}
+function read(device) {
+  return session(device, (cli) => readConfig(cli, device));
+}
+function withSecrets(line) {
+  const key = line.startsWith("set private-key ");
+  const filled = line.replace(MARKER, (_, reference) => {
+    const value = valueOfReference(reference);
+    const text = key && !value.includes("-----BEGIN") ? Buffer.from(value, "base64").toString("utf8").trim() : value;
+    return text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"");
+  });
+  return filled.replace(/\r\n?/g, `
+`).replace(/\?/g, "\x16?");
+}
+async function leave(cli) {
+  for (let level = 0;level < 10 && /\(.*\) [#$] $/.test(cli.prompt); level++)
+    await cli.run("end");
+}
+async function saving(cli, mode, seconds) {
+  const lines = ["config system global", `set cfg-save ${mode}`, ...seconds ? [`set cfg-revert-timeout ${seconds}`] : [], "end"];
+  for (const line of lines) {
+    const answer = await cli.run(line);
+    if (REFUSED.test(answer))
+      throw new Error(`the device refused ${line}: ${answer.trim().slice(0, 300)}`);
+  }
+}
+async function configure(cli, plan, guard) {
+  const minutes = guard.seconds / 60;
+  await saving(cli, "revert", guard.seconds);
+  const restore = async (reason) => {
+    await leave(cli).catch(() => {
+      return;
+    });
+    await cli.run("execute cfg reload").catch(() => {
+      return;
+    });
+    return new Reloaded(`${reason}
+    the device reloads its saved configuration, which undoes what was sent, at the latest in ${minutes} minutes`);
+  };
+  for (const step of plan.steps) {
+    for (const line of step.send) {
+      const answer = await cli.run(withSecrets(line)).catch((error) => error);
+      if (answer instanceof Error)
+        throw await restore(`${step.title}: ${line}
+    ${answer.message}`);
+      if (/System will reload/.test(answer)) {
+        throw new Reloaded(`${step.title}: ${line}
+    the rollback time ran out while the plan was sent, and the device is reloading its saved configuration`);
+      }
+      if (REFUSED.test(answer))
+        throw await restore(`${step.title}: ${line}
+    device said: ${answer.trim().slice(0, 300)}`);
+      if (QUESTION.test(cli.prompt)) {
+        await cli.answer("n").catch(() => {
+          return;
+        });
+        throw await restore(`${step.title}: ${line}
+    device asked: ${cli.prompt.trim()}`);
+      }
+    }
+  }
+  console.log(`  sent; the device reloads its saved configuration in ${minutes} minutes unless access is proved`);
+  try {
+    await guard.prove();
+  } catch (error) {
+    throw await restore(`a fresh login failed: ${error.message}`);
+  }
+  const saved = await cli.run("execute cfg save", 120000);
+  if (!/config saved|no config to be saved/.test(saved)) {
+    throw new Error(`access was proved but the save failed; the device reverts in ${minutes} minutes:
+    ${saved.trim().slice(0, 300)}`);
+  }
+  await saving(cli, "automatic");
+  console.log("  logged in again, saved");
+}
+
+class Reloaded extends Error {
+}
+var RELOAD = { attempts: 20, interval: 15000 };
+async function settle(device) {
+  for (let attempt = 0;attempt < RELOAD.attempts; attempt++) {
+    await new Promise((done) => setTimeout(done, RELOAD.interval));
+    const settled = await session(device, async (cli) => {
+      if (!/no config to be reloaded/.test(await cli.run("execute cfg reload")))
+        return false;
+      await saving(cli, "automatic");
+      return true;
+    }).catch(() => false);
+    if (settled)
+      return "the device is back and saves changes on its own again";
+  }
+  return "the device did not come back in time and still reverts every change; set `cfg-save automatic` under `config system global`";
+}
+async function apply(device, _network, plan, options) {
+  try {
+    await session(device, async (cli) => {
+      await checkVersion(cli, device);
+      await configure(cli, plan, {
+        seconds: options.rollback * 60,
+        prove: async () => {
+          const proof = await login(device);
+          proof.end();
+        }
+      });
+    });
+  } catch (error) {
+    if (!(error instanceof Reloaded))
+      throw error;
+    throw new Error(`${error.message}
+    ${await settle(device)}`);
+  }
+}
+function fillLines(set, family, prefixes) {
+  const list = new Block;
+  prefixes.forEach((prefix, index) => {
+    const rule = list.entry(index + 1);
+    rule.set(family === "ipv4" ? "prefix" : "prefix6", family === "ipv4" ? subnet(network2(prefix)) : network2(prefix));
+    if (split(network2(prefix)).len < BITS[family])
+      rule.set("le", BITS[family]);
+  });
+  return [
+    `config ${PREFIX_LIST[family]}`,
+    `edit ${quote(set)}`,
+    "config rule",
+    "purge",
+    ...linesOf(list).map((line) => line.trim()),
+    "end",
+    "next",
+    "end"
+  ];
+}
+async function fill(device, _network, set, family, prefixes) {
+  await session(device, async (cli) => {
+    await checkVersion(cli, device);
+    for (const line of fillLines(set, family, prefixes)) {
+      let answer = await cli.run(line);
+      if (QUESTION.test(cli.prompt) && line === "purge")
+        answer = await cli.answer("y");
+      if (REFUSED.test(answer))
+        throw new Error(`${set}: ${line}
+    device said: ${answer.trim().slice(0, 300)}`);
+    }
+    console.log(`  ${set}: ${prefixes.length} prefixes on the device`);
+  });
+}
+function unsupported(device) {
+  const found = [];
+  found.push(...systemGaps(device));
+  found.push(...managementGaps(device));
+  found.push(...interfaceGaps(device));
+  found.push(...staticGaps(device));
+  found.push(...routingGaps(device));
+  found.push(...firewallGaps(device));
+  found.push(...serviceGaps(device));
+  if (device.stp)
+    found.push("stp, ports are routed");
+  if (Object.keys(device.vrfs ?? {}).length > VRFS)
+    found.push(`vrfs, at most ${VRFS}`);
+  for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
+    if (vrf.description)
+      found.push(`vrfs.${name}.description, the platform numbers a VRF and keeps no description`);
+  }
+  return found;
+}
+function systemGaps(device) {
+  const found = [];
+  const system = device.system ?? {};
+  if (system.timezone && !zoneOf(system.timezone))
+    found.push(`system.timezone ${system.timezone}, the platform has no zone for it`);
+  if (system.release_channel)
+    found.push("system.release_channel, the platform's firmware has no release channel to follow");
+  if (system.transceiver_monitoring !== undefined)
+    found.push("system.transceiver_monitoring, the platform reads optics without being told");
+  if (system.ip?.syn_cookies)
+    found.push("system.ip.syn_cookies, the platform has a SYN proxy per DoS policy, not SYN cookies");
+  const local = system.logging?.local;
+  if (local?.files !== undefined || local?.lines_per_file !== undefined) {
+    found.push("system.logging.local.files and lines_per_file, logs kept in memory do not rotate into files");
+  }
+  if ((system.logging?.remote?.length ?? 0) > COLLECTORS)
+    found.push(`system.logging.remote, at most ${COLLECTORS} collectors`);
+  const servers = system.dns?.servers ?? [];
+  for (const family of ["ipv4", "ipv6"]) {
+    if (servers.filter((server) => familyOf2(server) === family).length > RESOLVERS.device) {
+      found.push(`system.dns.servers, at most ${RESOLVERS.device} of each family`);
+    }
+  }
+  return found;
+}
+function managementGaps(device) {
+  const found = [];
+  const management = device.management ?? {};
+  if (management.api || management.api_tls)
+    found.push("management.api and api_tls, the API is served by management.https");
+  if (management.ftp)
+    found.push("management.ftp, the platform has no FTP service");
+  if (management.console)
+    found.push("management.console, the console logs in with the device's users");
+  if (management.privilege_password)
+    found.push("management.privilege_password, the platform has no privileged mode");
+  if (management.native?.interfaces?.length)
+    found.push("management.native.interfaces, FortiManager access runs over IP only");
+  if (management.native?.port)
+    found.push("management.native.port, FortiManager access listens on 541");
+  if (management.ssh?.auth_retries)
+    found.push("management.ssh.auth_retries, the platform counts failed logins per source, not per connection");
+  for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
+    if (user.auth === "sha256")
+      found.push(`management.snmp.users.${name}.auth sha256, the platform authenticates with SHA1 or MD5`);
+  }
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    if ((user.ssh_keys?.length ?? 0) > SSH_KEYS)
+      found.push(`users.${name}.ssh_keys, at most ${SSH_KEYS}`);
+  }
+  return found;
+}
+function portNames(device) {
+  return new Set(portsOf(device.platform, device.model).map((port) => spell(device.platform, device.model, port)));
+}
+function interfaceGaps(device) {
+  const found = [];
+  const vlanInterfaces = new Set(Object.values(device.interfaces ?? {}).flatMap((iface) => iface.type === "vlan" ? [iface.vlan] : []));
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    if (vlan.description)
+      found.push(`vlans.${name}.description, a VLAN interface holds its own`);
+  }
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    const where = `ports.${name}`;
+    const speedClass = name.split("-")[0];
+    if (port.speed && !SPEEDS[speedClass]?.[port.speed])
+      found.push(`${where}.speed ${port.speed}, not in a ${speedClass} cage`);
+    for (const field of ["access_vlan", "native_vlan", "stp", "storm_control"]) {
+      if (port[field] !== undefined)
+        found.push(`${where}.${field}, ports are routed`);
+    }
+    if (port.hardware_offload !== undefined)
+      found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
+    if (port.lag) {
+      for (const field of ["addresses", "mtu", "vrrp", "vrf", "lldp", "trunk_vlans", "ipv6_ra", "acl"]) {
+        if (port[field] !== undefined)
+          found.push(`${where}.${field}, a LAG member takes its settings from the LAG`);
+      }
+    }
+    const acl = port.acl ? device.acls?.[port.acl] : undefined;
+    if (acl)
+      found.push(...aclGaps(`acls.${port.acl}`, acl));
+    found.push(...trunkGaps(where, name, port.trunk_vlans, vlanInterfaces, device));
+    found.push(...routedGaps(where, port, false));
+  }
+  const ports = portNames(device);
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    const where = `interfaces.${name}`;
+    if (iface.type === "wireguard") {
+      found.push(`${where}, a wireguard: the platform has no WireGuard`);
+      continue;
+    }
+    if (name.length > NAME_LENGTH.interface)
+      found.push(`${where}, a name longer than ${NAME_LENGTH.interface} characters`);
+    if (ports.has(name) || RESERVED_INTERFACES.has(name))
+      found.push(`${where}, a name the platform gives a port of its own`);
+    if (iface.hardware_offload !== undefined)
+      found.push(`${where}.hardware_offload, offload is decided per policy, which can match many interfaces`);
+    if (iface.type === "lag") {
+      if (iface.id !== undefined)
+        found.push(`${where}.id, the platform names a LAG by its key`);
+      for (const field of ["access_vlan", "native_vlan", "stp", "storm_control"]) {
+        if (iface[field] !== undefined)
+          found.push(`${where}.${field}, LAGs are routed`);
+      }
+      found.push(...trunkGaps(where, name, iface.trunk_vlans, vlanInterfaces, device));
+    }
+    if (iface.type === "vlan" && !vlanParent(device, iface.vlan)) {
+      found.push(`${where}, VLAN ${iface.vlan} must be carried tagged by exactly one port or LAG`);
+    }
+    if (iface.type === "loopback") {
+      if (iface.mtu !== undefined)
+        found.push(`${where}.mtu, a loopback has no MTU of its own`);
+      if (iface.vrrp?.length)
+        found.push(`${where}.vrrp, a loopback runs no VRRP`);
+    }
+    if (iface.type === "gre" || iface.type === "vxlan") {
+      if (!holderOf(device, iface.local))
+        found.push(`${where}.local, no interface holds ${iface.local}`);
+      if (familyOf2(iface.local) !== familyOf2(iface.remote))
+        found.push(`${where}, endpoints of two families`);
+      if (iface.vrrp?.length)
+        found.push(`${where}.vrrp, on a tunnel`);
+      if (iface.ipv6_ra)
+        found.push(`${where}.ipv6_ra, on a tunnel`);
+    }
+    if (iface.type === "gre") {
+      for (const entry of iface.addresses ?? []) {
+        if (typeof entry !== "string" && familyOf2(host2(entry.address)) === "ipv6")
+          found.push(`${where}.addresses, a peer on an IPv6 address`);
+      }
+      const ipv4 = (iface.addresses ?? []).filter((entry) => familyOf2(host2(typeof entry === "string" ? entry : entry.address)) === "ipv4");
+      if (ipv4.some((entry) => typeof entry === "string"))
+        found.push(`${where}.addresses, an IPv4 address on a tunnel takes its peer`);
+      if (ipv4.length > 1)
+        found.push(`${where}.addresses, one IPv4 address`);
+    }
+    found.push(...routedGaps(where, iface, iface.type === "gre"));
+  }
+  if (device.lldp && typeof device.lldp === "object") {
+    for (const name of device.lldp.interfaces) {
+      const settings = device.interfaces?.[name];
+      if (settings && settings.type !== "lag" && settings.type !== "vlan")
+        found.push(`lldp.interfaces ${name}, a ${settings.type}`);
+    }
+  }
+  return found;
+}
+function trunkGaps(where, name, vlans, withInterface, device) {
+  const found = [];
+  for (const vlan of vlans ?? []) {
+    if (!withInterface.has(vlan)) {
+      found.push(`${where}.trunk_vlans ${vlan}, a VLAN with no interface here: the platform routes and does not switch`);
+    } else if (vlanParent(device, vlan) !== name) {
+      found.push(`${where}.trunk_vlans ${vlan}, which another port or LAG also carries`);
+    }
+  }
+  return found;
+}
+function routedGaps(where, settings, tunnel) {
+  const found = [];
+  if (!tunnel && settings.addresses?.some((entry) => typeof entry !== "string"))
+    found.push(`${where}.addresses with a peer, which only a tunnel takes`);
+  for (const group of settings.vrrp ?? []) {
+    if (familyOf2(group.address) === "ipv6")
+      found.push(`${where}.vrrp ${group.id}, IPv6: the platform runs VRRP for IPv4`);
+  }
+  return found;
+}
+function aclGaps(where, rules) {
+  const found = [];
+  if (acceptsBeforeDrop(rules))
+    found.push(`${where}, an accept before a drop: the platform's ACLs only drop`);
+  rules.forEach((rule, index) => {
+    if (rule.rate)
+      found.push(`${where}[${index}].rate`);
+    if (rule.match?.vlan)
+      found.push(`${where}[${index}].match.vlan, a port's ACL sees no VLAN`);
+  });
+  return found;
+}
+function staticGaps(device) {
+  const found = [];
+  const seen = new Set;
+  for (const route of device.routing?.static ?? []) {
+    const where = `routing.static ${route.prefix}`;
+    if (route.vrf && route.blackhole)
+      found.push(`${where}, a blackhole in a VRF: a route takes the VRF of the interface it leaves through`);
+    if (route.vrf && route.interface && settingsOf(device, route.interface)?.vrf !== route.vrf) {
+      found.push(`${where}.interface, which is not in VRF ${route.vrf}`);
+    }
+    if (route.via && !route.interface && !route.blackhole && !interfaceFor(device, route.via, route.vrf)) {
+      found.push(`${where} via ${route.via}, no interface's own network in its table holds the next hop`);
+    }
+    const key = [
+      split(route.prefix).addr,
+      split(route.prefix).len,
+      route.via,
+      route.interface,
+      route.blackhole,
+      route.distance,
+      route.vrf
+    ].join(" ");
+    if (seen.has(key))
+      found.push(`${where}, the same route twice`);
+    seen.add(key);
+  }
+  return found;
+}
+function firewallGaps(device) {
+  const found = [];
+  const fw = device.firewall;
+  if (!fw)
+    return found;
+  if (fw.filter?.output)
+    found.push("firewall.filter.output, the platform filters no traffic it sends itself");
+  if (fw.untracked)
+    found.push("firewall.untracked, every session is tracked");
+  for (const helper of fw.helpers ?? []) {
+    if (!HELPERS[helper])
+      found.push(`firewall.helpers ${helper}, the platform has no helper for it`);
+  }
+  for (const chain of ["forward", "input"]) {
+    (fw.filter?.[chain]?.rules ?? []).forEach((rule, index) => found.push(...ruleGaps2(`firewall.filter.${chain}[${index}]`, rule, chain, device)));
+  }
+  (fw.nat?.source ?? []).forEach((rule, index) => {
+    const where = `firewall.nat.source[${index}]`;
+    const match = rule.match;
+    if (familiesOf(device, match).includes("ipv6") && (match?.family === "ipv6" || match?.src || match?.dst)) {
+      found.push(`${where}, IPv6: central NAT translates IPv4`);
+    }
+    if (rule.action === "dnat")
+      found.push(`${where}.action dnat, in source NAT`);
+    if (rule.action === "snat" && familyOf2(rule.to) === "ipv6")
+      found.push(`${where}.to, IPv6: central NAT translates IPv4`);
+    if (match?.dst_port !== undefined)
+      found.push(`${where}.match.dst_port, central NAT matches the source port only`);
+    if (Array.isArray(match?.src_port))
+      found.push(`${where}.match.src_port, one port or range`);
+    if (rule.action === "snat" && rule.to_port !== undefined && match?.src_port === undefined)
+      found.push(`${where}.to_port, without match.src_port`);
+    if (match?.src && match.src_set || match?.dst && match.dst_set)
+      found.push(`${where}.match, a prefix and a set on one side`);
+    if (match?.state || match?.tcp_flags)
+      found.push(`${where}.match.state and tcp_flags`);
+  });
+  (fw.nat?.destination ?? []).forEach((rule, index) => {
+    const where = `firewall.nat.destination[${index}]`;
+    const match = rule.match;
+    if (rule.action !== "dnat") {
+      found.push(`${where}.action ${rule.action}, in destination NAT`);
+      return;
+    }
+    if (!match?.dst || split(match.dst.includes("/") ? match.dst : `${match.dst}/32`).len !== 32) {
+      found.push(`${where}.match.dst, one IPv4 address the virtual IP answers on`);
+    }
+    const sources = match?.src ? [match.src] : match?.src_set ? fw.address_sets?.[match.src_set] ?? [] : [];
+    if (familyOf2(rule.to) === "ipv6" || sources.some((source) => familyOf2(host2(source)) === "ipv6"))
+      found.push(`${where}, IPv6`);
+    if (match?.dst_port !== undefined && Array.isArray(match.dst_port))
+      found.push(`${where}.match.dst_port, one port or range`);
+    if (match?.dst_port !== undefined && match.protocol !== "tcp" && match.protocol !== "udp") {
+      found.push(`${where}.match.protocol, tcp or udp with a port`);
+    }
+    if (match?.dst_port === undefined && (match?.protocol || rule.to_port)) {
+      found.push(`${where}.match.dst_port, a protocol or port is forwarded by its port`);
+    }
+    if (match?.src && match.src_set)
+      found.push(`${where}.match, a prefix and a set on one side`);
+    for (const field of ["dst_set", "src_port", "out_interface", "state", "tcp_flags", "family"]) {
+      if (match?.[field] !== undefined)
+        found.push(`${where}.match.${field}`);
+    }
+  });
+  for (const name of Object.keys(fw.address_sets ?? {})) {
+    if (name.length > NAME_LENGTH.object)
+      found.push(`firewall.address_sets.${name}, a name longer than ${NAME_LENGTH.object} characters`);
+    if (name.startsWith("circuit-"))
+      found.push(`firewall.address_sets.${name}, a name Circuit keeps for the sources of management`);
+  }
+  return found;
+}
+function ruleGaps2(where, rule, chain, device) {
+  const found = [];
+  const match = rule.match;
+  const state = match?.state ?? [];
+  if (state.some((one) => one === "invalid" || one === "untracked"))
+    found.push(`${where}.match.state ${state.join(", ")}`);
+  else if (state.length && rule.action !== "accept")
+    found.push(`${where}.match.state, on a rule that does not accept`);
+  if (match?.tcp_flags)
+    found.push(`${where}.match.tcp_flags, the platform matches no TCP flags`);
+  if (match?.src && match.src_set || match?.dst && match.dst_set)
+    found.push(`${where}.match, a prefix and a set on one side`);
+  if (isImplied(rule))
+    return found;
+  const families = familiesOf(device, match);
+  if (!families.length)
+    found.push(`${where}, its addresses share no family`);
+  if (match?.src && match.dst && familyOf2(host2(match.src)) !== familyOf2(host2(match.dst))) {
+    found.push(`${where}, a source and destination of two families`);
+  }
+  for (const family of families) {
+    if (serviceOf(match, family).name.length > NAME_LENGTH.object)
+      found.push(`${where}.match ports, too many for one service`);
+  }
+  if (chain === "input") {
+    if (match?.out_interface)
+      found.push(`${where}.match.out_interface, on traffic to the device`);
+    if (rule.action === "reject")
+      found.push(`${where}.action reject, the platform drops traffic to itself silently`);
+    if (rule.offload)
+      found.push(`${where}.offload, on traffic to the device`);
+  }
+  return found;
+}
+function serviceGaps(device) {
+  const found = [];
+  for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+    if (familyOf2(host2(server.network)) === "ipv6")
+      found.push(`dhcp.${name}.network, IPv6: DHCPv6 hands out no gateway`);
+    if ((server.dns?.length ?? 0) > RESOLVERS.dhcp)
+      found.push(`dhcp.${name}.dns, at most ${RESOLVERS.dhcp}`);
+  }
+  const flow = device.flow_export;
+  if (flow?.protocol === "ipfix")
+    found.push("flow_export.protocol ipfix, the platform exports sFlow and NetFlow 9");
+  if (flow && flow.collectors.length > 1)
+    found.push("flow_export.collectors, one collector");
+  for (const name of flow?.interfaces ?? []) {
+    const type = device.interfaces?.[name]?.type;
+    if (type === "gre" || type === "vxlan")
+      found.push(`flow_export.interfaces ${name}, a tunnel: the platform samples the interface it leaves through`);
+  }
+  if (flow?.protocol === "netflow-v9" && flow.sampling !== undefined)
+    found.push("flow_export.sampling, NetFlow here exports every flow");
+  if (flow?.protocol === "sflow" && (flow.sampling === undefined || flow.sampling < 10 || flow.sampling > 99999)) {
+    found.push("flow_export.sampling, required and from 10 to 99999: the platform samples");
+  }
+  return found;
+}
+var fortios = {
+  extension: ".conf",
+  unsupported,
+  render,
+  read,
+  plan,
+  apply,
+  fill
+};
+
 // src/adapters/devices/derive.ts
 function lagIds(device) {
   const numbers = new Map;
@@ -262,7 +2988,7 @@ var KEY_STATEMENT = {
 var SNMP_AUTH = { sha1: "authentication-sha", sha256: "authentication-sha256" };
 var SNMP_PRIVACY = { aes128: "privacy-aes128", des: "privacy-des" };
 var SNMP_GROUP = "circuit";
-var LEVEL = {
+var LEVEL2 = {
   emergency: "emergency",
   alert: "alert",
   critical: "critical",
@@ -287,7 +3013,7 @@ var SERVICE_PORTS = {
   native: ["tcp", 830]
 };
 var BFD_INTERVAL = 300;
-function quote(value) {
+function quote2(value) {
   if (/^[\w.:/@-]+$/.test(value))
     return value;
   const escaped = value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\n/g, "\\n");
@@ -383,13 +3109,13 @@ function stormProfile(settings) {
   const left = STORM_KINDS.filter(([kind]) => !storm[kind]).map(([, statement]) => statement);
   return { name: `${kinds.join("-")}-${first.percent}-percent`, percent: first.percent, left };
 }
-function render(device) {
+function render2(device) {
   const out = new Statements;
   const names = new Names(device);
   system(out, device);
-  users(out, device);
+  users2(out, device);
   services(out, device);
-  snmp(out, device);
+  snmp2(out, device);
   vlans(out, device, names);
   ports(out, device, names);
   lags(out, device, names);
@@ -397,25 +3123,25 @@ function render(device) {
   stormProfiles(out, device);
   servicesFilter(out, device, names);
   vrfs(out, device, names);
-  staticRoutes(out, device, names);
+  staticRoutes2(out, device, names);
   spanningTree(out, device, names);
   lldp(out, device, names);
-  ospf(out, device, names);
+  ospf2(out, device, names);
   dhcpRelay(out, device, names);
-  dhcpServers(out, device, names);
+  dhcpServers2(out, device, names);
   routerAdvertisements(out, device, names);
-  acls(out, device, names);
+  acls2(out, device, names);
   renderBgp(out, device);
   sflow(out, device, names);
   return out.text();
 }
 function system(out, device) {
-  out.set("system host-name", quote(device.name));
+  out.set("system host-name", quote2(device.name));
   const system = device.system ?? {};
   if (system.timezone)
     out.set("system time-zone", system.timezone);
   if (system.banner)
-    out.set("system login message", quote(system.banner));
+    out.set("system login message", quote2(system.banner));
   for (const server of system.dns?.servers ?? [])
     out.set("system name-server", server);
   for (const server of system.ntp?.servers ?? [])
@@ -426,27 +3152,27 @@ function system(out, device) {
   }
   const local = system.logging?.local;
   if (local) {
-    out.set("system syslog file messages any", LEVEL[local.level]);
+    out.set("system syslog file messages any", LEVEL2[local.level]);
     if (local.files !== undefined)
       out.set("system syslog file messages archive files", local.files);
   }
   for (const remote of system.logging?.remote ?? []) {
-    out.set("system syslog host", remote.address, "any", LEVEL[remote.level]);
+    out.set("system syslog host", remote.address, "any", LEVEL2[remote.level]);
     if (remote.port !== undefined && remote.port !== 514)
       out.set("system syslog host", remote.address, "port", remote.port);
   }
 }
-function users(out, device) {
+function users2(out, device) {
   for (const [name, user] of Object.entries(device.users ?? {})) {
     const login = name === "root" ? "system root-authentication" : `system login user ${name} authentication`;
     if (name !== "root") {
       out.set(`system login user ${name} class`, USER_CLASS[user.role]);
       if (user.description)
-        out.set(`system login user ${name} full-name`, quote(user.description));
+        out.set(`system login user ${name} full-name`, quote2(user.description));
     }
     out.set(login, "plain-text-password-value", marker(user.password));
     for (const key of user.ssh_keys ?? [])
-      out.set(login, KEY_STATEMENT[key.split(" ")[0]], quote(key));
+      out.set(login, KEY_STATEMENT[key.split(" ")[0]], quote2(key));
   }
 }
 function services(out, device) {
@@ -483,14 +3209,14 @@ function services(out, device) {
       out.set(statement, "port", settings.port);
   }
 }
-function snmp(out, device) {
+function snmp2(out, device) {
   const snmp = device.management?.snmp;
   if (!snmp)
     return;
   if (snmp.contact)
-    out.set("snmp contact", quote(snmp.contact));
+    out.set("snmp contact", quote2(snmp.contact));
   if (snmp.location)
-    out.set("snmp location", quote(snmp.location));
+    out.set("snmp location", quote2(snmp.location));
   if (snmp.community)
     out.set("snmp community", marker(snmp.community), "authorization read-only");
   if (!snmp.users)
@@ -508,7 +3234,7 @@ function vlans(out, device, names) {
   for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
     out.set(`vlans ${name} vlan-id`, vlan.id);
     if (vlan.description)
-      out.set(`vlans ${name} description`, quote(vlan.description));
+      out.set(`vlans ${name} description`, quote2(vlan.description));
   }
   for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
     if (iface.type === "vlan")
@@ -566,7 +3292,7 @@ function ports(out, device, names) {
       continue;
     }
     if (settings.description)
-      out.set(`interfaces ${name} description`, quote(settings.description));
+      out.set(`interfaces ${name} description`, quote2(settings.description));
     if (settings.lag) {
       out.set(`interfaces ${name} ether-options 802.3ad`, `ae${names.lags.get(settings.lag)}`);
       continue;
@@ -586,7 +3312,7 @@ function lags(out, device, names) {
     const physical = names.physical(name);
     highest = Math.max(highest, names.lags.get(name));
     if (lag.description)
-      out.set(`interfaces ${physical} description`, quote(lag.description));
+      out.set(`interfaces ${physical} description`, quote2(lag.description));
     if (lag.mode !== "static")
       out.set(`interfaces ${physical} aggregated-ether-options lacp active`);
     if (lag.mtu !== undefined)
@@ -605,7 +3331,7 @@ function routedInterfaces(out, device, names) {
     const [physical, number] = unit.split(".");
     const prefix = `interfaces ${physical} unit ${number}`;
     if (iface.description)
-      out.set(`${prefix} description`, quote(iface.description));
+      out.set(`${prefix} description`, quote2(iface.description));
     if (iface.type === "gre") {
       out.set(`${prefix} tunnel source`, iface.local);
       out.set(`${prefix} tunnel destination`, iface.remote);
@@ -700,7 +3426,7 @@ function vrfs(out, device, names) {
   for (const [name, vrf] of Object.entries(device.vrfs ?? {})) {
     out.set(`routing-instances ${name} instance-type virtual-router`);
     if (vrf.description)
-      out.set(`routing-instances ${name} description`, quote(vrf.description));
+      out.set(`routing-instances ${name} description`, quote2(vrf.description));
   }
   const routed = [...Object.entries(device.ports ?? {}), ...Object.entries(device.interfaces ?? {})];
   for (const [name, settings] of routed) {
@@ -708,7 +3434,7 @@ function vrfs(out, device, names) {
       out.set(`routing-instances ${settings.vrf} interface`, names.unit(name));
   }
 }
-function staticRoutes(out, device, names) {
+function staticRoutes2(out, device, names) {
   if (device.routing?.router_id)
     out.set("routing-options router-id", device.routing.router_id);
   for (const route of device.routing?.static ?? []) {
@@ -777,7 +3503,7 @@ function lldp(out, device, names) {
       out.set("protocols lldp interface", names.port(port));
   }
 }
-function ospf(out, device, names) {
+function ospf2(out, device, names) {
   const ospf = device.routing?.ospf;
   if (!ospf)
     return;
@@ -852,8 +3578,8 @@ function aclFamily(rule) {
   return address ? familyOf2(host2(address)) : undefined;
 }
 var nextHeader = (protocol) => protocol === "icmp" ? "icmp6" : protocol;
-var ruleName = (label, description) => quote(description ? `${label} ${description}` : label);
-function acls(out, device, names) {
+var ruleName = (label, description) => quote2(description ? `${label} ${description}` : label);
+function acls2(out, device, names) {
   const switched = new Set;
   const routed = new Set;
   for (const [port, settings] of Object.entries(device.ports ?? {})) {
@@ -945,7 +3671,7 @@ function routedFilter(out, device, acl, family) {
   });
   out.set(filter, "term circuit-default then accept");
 }
-function dhcpServers(out, device, names) {
+function dhcpServers2(out, device, names) {
   for (const [name, server] of Object.entries(device.dhcp ?? {})) {
     out.set(`system services dhcp-local-server group ${name} interface`, names.unit(server.interface));
     const pool = `access address-assignment pool ${name} family inet`;
@@ -978,17 +3704,17 @@ function routerAdvertisements(out, device, names) {
 }
 
 // src/adapters/devices/junos/bgp.ts
-var REJECT_ALL = "circuit-reject-all";
+var REJECT_ALL2 = "circuit-reject-all";
 var ORIGIN = "circuit-bgp-origin";
 var RPKI_GROUP = "circuit";
 var GENERATED = "# generated ";
 var FAMILY = { ipv4: "inet", ipv6: "inet6" };
 var VALIDATION = { valid: "valid", invalid: "invalid", "not-found": "unknown" };
-function settingsOf(device, neighbor) {
+function settingsOf2(device, neighbor) {
   const group = neighbor.group ? device.routing?.bgp?.groups?.[neighbor.group] : undefined;
   return { ...group, ...neighbor };
 }
-var slug = (value) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
+var slug2 = (value) => value.replace(/\*/g, "any").replace(/[^A-Za-z0-9]+/g, "-");
 var member = (community, large) => large ? `large:${community}` : community;
 function renderBgp(out, device) {
   prefixSets(out, device);
@@ -1001,12 +3727,12 @@ function renderBgp(out, device) {
   let rejectAll = false;
   let exports = false;
   for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
-    const settings = settingsOf(device, neighbor);
+    const settings = settingsOf2(device, neighbor);
     const group = `protocols bgp group ${name}`;
     out.set(group, "type", settings.remote_as === bgp.asn ? "internal" : "external");
     out.set(group, "peer-as", settings.remote_as);
     if (settings.description)
-      out.set(group, "description", quote(settings.description));
+      out.set(group, "description", quote2(settings.description));
     if (settings.local_address)
       out.set(group, "local-address", settings.local_address);
     if (settings.multihop)
@@ -1019,13 +3745,13 @@ function renderBgp(out, device) {
       out.set(group, "authentication-key", marker(settings.password));
     if (settings.bfd)
       out.set(group, "bfd-liveness-detection minimum-interval", BFD_INTERVAL);
-    out.set(group, "import", settings.import ?? REJECT_ALL);
+    out.set(group, "import", settings.import ?? REJECT_ALL2);
     if (settings.export) {
       exports = true;
       out.set(group, "export", ORIGIN);
       out.set(group, "export", settings.export);
     } else
-      out.set(group, "export", REJECT_ALL);
+      out.set(group, "export", REJECT_ALL2);
     for (const policy of [settings.import, settings.export]) {
       if (policy)
         used.add(policy);
@@ -1043,7 +3769,7 @@ function renderBgp(out, device) {
     out.set(group, "neighbor", neighbor.address);
   }
   if (rejectAll)
-    out.set(`policy-options policy-statement ${REJECT_ALL} then reject`);
+    out.set(`policy-options policy-statement ${REJECT_ALL2} then reject`);
   if (exports)
     origin(out, device);
   for (const policy of [...used].sort())
@@ -1077,7 +3803,7 @@ function rpki(out, device) {
     out.set(`routing-options validation group ${RPKI_GROUP} session`, server.address, "port", server.port);
   }
 }
-function familyOfRule(device, rule) {
+function familyOfRule2(device, rule) {
   const match = rule.match;
   if (match?.family)
     return match.family;
@@ -1090,24 +3816,24 @@ function familyOfRule(device, rule) {
     return familyOf2(host2(set.prefixes[0]));
   return;
 }
-function flatten(device, policy, label, seen) {
+function flatten2(device, policy, label, seen) {
   const rules = device.policies?.[policy] ?? [];
   const flat = [];
   rules.forEach((rule, index) => {
     const here = label ? `${label}.${index + 1}` : `${index + 1}`;
     if (rule.call && !seen.includes(rule.call))
-      flat.push(...flatten(device, rule.call, here, [...seen, rule.call]));
+      flat.push(...flatten2(device, rule.call, here, [...seen, rule.call]));
     if (rule.match || rule.set || rule.action)
       flat.push({ label: here, rule });
   });
   return flat;
 }
-var termName = (label, rule) => quote(rule.description ? `${label} ${rule.description}` : label);
+var termName = (label, rule) => quote2(rule.description ? `${label} ${rule.description}` : label);
 function policyStatement(out, device, policy) {
   const statement = `policy-options policy-statement ${policy}`;
-  const flat = flatten(device, policy, "", [policy]);
+  const flat = flatten2(device, policy, "", [policy]);
   for (const { label, rule } of flat) {
-    const family = familyOfRule(device, rule);
+    const family = familyOfRule2(device, rule);
     const split = !family && (rule.set?.next_hop || rule.match?.prefix_length) ? ["ipv4", "ipv6"] : [family];
     for (const part of split) {
       const name = split.length > 1 ? termName(`${label}-${part === "ipv4" ? "v4" : "v6"}`, rule) : termName(label, rule);
@@ -1141,7 +3867,7 @@ function term(out, device, term, rule, family, splitFamily) {
   if (match.as_path_length) {
     const { min = 0, max } = match.as_path_length;
     const name = `circuit-path-length-${min}-${max ?? "any"}`;
-    out.set(`policy-options as-path ${name}`, quote(`.{${min},${max ?? ""}}`));
+    out.set(`policy-options as-path ${name}`, quote2(`.{${min},${max ?? ""}}`));
     from.push(["as-path", name]);
   }
   if (match.rpki)
@@ -1158,7 +3884,7 @@ function term(out, device, term, rule, family, splitFamily) {
     then.push(["metric", set.med]);
   if (set.prepend !== undefined) {
     const asn = device.routing.bgp.asn;
-    then.push(["as-path-prepend", quote(Array(set.prepend).fill(asn).join(" "))]);
+    then.push(["as-path-prepend", quote2(Array(set.prepend).fill(asn).join(" "))]);
   }
   const removed = [
     ...(set.communities ? ["*:*"] : set.remove_communities ?? []).map((pattern) => member(pattern, false)),
@@ -1190,9 +3916,9 @@ function term(out, device, term, rule, family, splitFamily) {
     out.set(term);
 }
 function community(out, purpose, members) {
-  const name = `circuit-${purpose}-${slug(members.join(" "))}`;
+  const name = `circuit-${purpose}-${slug2(members.join(" "))}`;
   for (const value of members)
-    out.set(`policy-options community ${name} members`, quote(value));
+    out.set(`policy-options community ${name} members`, quote2(value));
   return name;
 }
 
@@ -1200,10 +3926,10 @@ function community(out, purpose, members) {
 var SUPPORTED_MAJOR = 21;
 var DEVICE_FACTS = [/^set version /, /^set system login user \S+ uid \d+$/];
 var SYSTEM_ACCOUNTS = new Set(["bind", "daemon", "kmem", "nobody", "operator", "sshd", "tty", "uucp"]);
-function wordsOf(statement) {
+function wordsOf2(statement) {
   return statement.match(/"(?:[^"\\]|\\.)*"|\S+/g) ?? [];
 }
-var bare = (word) => word.startsWith('"') ? word.slice(1, -1).replace(/\\(.)/g, "$1") : word;
+var bare2 = (word) => word.startsWith('"') ? word.slice(1, -1).replace(/\\(.)/g, "$1") : word;
 var SECRETS = [
   [/ (?:encrypted-password|plain-text-password-value) (?:"[^"]*"|\S+)/, " password <secret>"],
   [/ (?:authentication-key|authentication-password) (?:"[^"]*"|\S+)/, " authentication-key <secret>"],
@@ -1214,15 +3940,15 @@ function keyOf2(statement) {
   let canonical = statement;
   for (const [pattern, replacement] of SECRETS)
     canonical = canonical.replace(pattern, replacement);
-  return wordsOf(canonical).slice(1).map(bare);
+  return wordsOf2(canonical).slice(1).map(bare2);
 }
-function scrub(text) {
+function scrub2(text) {
   return text.replace(/ ## SECRET-DATA$/gm, "").replace(/((?:encrypted-password|authentication-key|privacy-key) )(?:"[^"]*"|\S+)/g, "$1<redacted>").replace(/^(set snmp community )(?:"[^"]*"|\S+)/gm, "$1<redacted>").replace(/"\$\d\$[^"]*"/g, "<redacted>");
 }
-function clean(output) {
+function clean2(output) {
   const statements = output.replace(/\r/g, "").split(`
 `).map((line) => line.trimEnd()).filter((line) => /^(set|deactivate) /.test(line)).filter((line) => !DEVICE_FACTS.some((fact) => fact.test(line)));
-  return scrub(statements.join(`
+  return scrub2(statements.join(`
 `) + `
 `);
 }
@@ -1286,13 +4012,13 @@ function orderedBlockOf(path) {
   return;
 }
 var startsWith = (path, prefix) => prefix.every((word, index) => path[index] === word);
-function plan(desired, current, options) {
+function plan2(desired, current, options) {
   const lines = (text, verb) => text.split(`
 `).filter((line) => line.startsWith(`${verb} `));
   const wanted = lines(desired, "set");
   const deactivated = lines(current, "deactivate");
   const generated = desired.split(`
-`).filter((line) => line.startsWith(GENERATED)).map((line) => wordsOf(line.slice(GENERATED.length)).map(bare));
+`).filter((line) => line.startsWith(GENERATED)).map((line) => wordsOf2(line.slice(GENERATED.length)).map(bare2));
   const printed = lines(current, "set").filter((line) => !DEVICE_FACTS.some((fact) => fact.test(line)));
   const isGenerated = (line) => generated.some((path) => keyOf2(line).length > path.length && startsWith(keyOf2(line), path));
   const existing = printed.filter((line) => !isGenerated(line));
@@ -1329,7 +4055,7 @@ function plan(desired, current, options) {
     rewritten.push(block);
     const section = sectionFor(block);
     if (existingHere.length)
-      section.remove.push(`delete ${wordsOf(existingHere[0]).slice(1, 1 + block.length).join(" ")}`);
+      section.remove.push(`delete ${wordsOf2(existingHere[0]).slice(1, 1 + block.length).join(" ")}`);
     section.show.push(...existingHere.map((line) => `- ${line}`), ...wantedHere.map((line) => `+ ${line}`));
     section.add.push(...wantedHere);
   }
@@ -1351,22 +4077,22 @@ function plan(desired, current, options) {
     const hidden = path.indexOf("<secret>");
     if (hidden >= 0 && hidden < length && !NAMED_LISTS.has(path[hidden - 1]))
       length = hidden;
-    removed.push(wordsOf(line).slice(1, 1 + length));
+    removed.push(wordsOf2(line).slice(1, 1 + length));
   }
-  const isInside = (path, other) => other.length < path.length && other.every((word, index) => bare(path[index]) === bare(word));
+  const isInside = (path, other) => other.length < path.length && other.every((word, index) => bare2(path[index]) === bare2(word));
   const removals = removed.filter((path, index) => !removed.some((other) => isInside(path, other)) && removed.findIndex((other) => join(other) === join(path)) === index);
-  const isRemoved = (line) => removals.some((path) => startsWith(keyOf2(line), path.map(bare)));
+  const isRemoved = (line) => removals.some((path) => startsWith(keyOf2(line), path.map(bare2)));
   for (const path of removals) {
-    const section = sectionFor(path.map(bare));
+    const section = sectionFor(path.map(bare2));
     section.remove.push(`delete ${path.join(" ")}`);
-    const under = existing.filter((line) => startsWith(keyOf2(line), path.map(bare)));
+    const under = existing.filter((line) => startsWith(keyOf2(line), path.map(bare2)));
     section.show.push(...under.map((line) => `- ${line}`));
   }
   for (const line of deactivated) {
-    const path = wordsOf(line).slice(1);
-    if (!wantedUnder(path.map(bare)).length)
+    const path = wordsOf2(line).slice(1);
+    if (!wantedUnder(path.map(bare2)).length)
       continue;
-    const section = sectionFor(path.map(bare));
+    const section = sectionFor(path.map(bare2));
     section.activate.push(`activate ${path.join(" ")}`);
     section.show.push(`+ activate ${path.join(" ")}`);
   }
@@ -1389,7 +4115,7 @@ function plan(desired, current, options) {
   const steps = [...sections].filter(([, section]) => section.show.length).map(([title, section]) => ({ title, show: section.show, send: [...section.activate, ...section.remove, ...section.add] }));
   return { steps, problems: [] };
 }
-async function login(device) {
+async function login2(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -1400,7 +4126,7 @@ async function login(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion(client, device) {
+async function checkVersion2(client, device) {
   const version = await exec(client, "show version | match Junos:");
   const release = /Junos: (\d+)\.(\S+)/.exec(version);
   if (!release)
@@ -1409,23 +4135,23 @@ async function checkVersion(client, device) {
     throw new Error(`${device.name} runs Junos ${release[1]}.${release[2]}; this adapter renders for Junos ${SUPPORTED_MAJOR}`);
   }
 }
-async function read(device) {
-  const client = await login(device);
+async function read2(device) {
+  const client = await login2(device);
   try {
-    await checkVersion(client, device);
+    await checkVersion2(client, device);
     const output = await exec(client, "show configuration | display set | no-more", 180000);
     if (!/^set /m.test(output))
       throw new Error(`${device.name} returned no configuration`);
-    return clean(output);
+    return clean2(output);
   } finally {
     client.end();
   }
 }
-var PROMPT = /[>#%] $/;
+var PROMPT2 = /[>#%] $/;
 async function run(channel, line, timeout = 60000) {
   channel.write(`${line}
 `);
-  const output = await readUntil(channel, (text) => PROMPT.test(text.replace(/\r/g, "")), timeout, 300);
+  const output = await readUntil(channel, (text) => PROMPT2.test(text.replace(/\r/g, "")), timeout, 300);
   return output.replace(/\r/g, "");
 }
 var EDIT_PROMPT = /\[edit[^\]\n]*\]\n[^\n]*# $/;
@@ -1436,7 +4162,7 @@ async function edit(channel, line, timeout = 60000) {
   return output.replace(/\r/g, "");
 }
 async function openCli(channel) {
-  const banner = await readUntil(channel, (text) => PROMPT.test(text.replace(/\r/g, "")), 20000, 500);
+  const banner = await readUntil(channel, (text) => PROMPT2.test(text.replace(/\r/g, "")), 20000, 500);
   if (/% $/.test(banner.replace(/\r/g, "")))
     await run(channel, "cli");
   await run(channel, "set cli screen-length 0");
@@ -1444,18 +4170,18 @@ async function openCli(channel) {
   await run(channel, "set cli complete-on-space off");
 }
 async function named(channel, line) {
-  const words = wordsOf(line).slice(1);
+  const words = wordsOf2(line).slice(1);
   const at = words.indexOf("<redacted>");
   if (at < 0)
     return [line];
   const shown = await edit(channel, `show ${words.slice(0, at - 1).join(" ")} | display set`);
   const inList = (statement) => statement[0] === "set" && words.slice(0, at).every((word, index) => statement[index + 1] === word);
   const names = new Set(shown.split(`
-`).map(wordsOf).filter(inList).map((statement) => statement[at + 1]));
+`).map(wordsOf2).filter(inList).map((statement) => statement[at + 1]));
   return [...names].map((name) => `delete ${[...words.slice(0, at), name, ...words.slice(at + 1)].join(" ")}`);
 }
-var REFUSED = /^terminal:\d+:\(\d+\) (?!warning)|^error: /m;
-async function configure(channel, plan, guard) {
+var REFUSED2 = /^terminal:\d+:\(\d+\) (?!warning)|^error: /m;
+async function configure2(channel, plan, guard) {
   const sent = plan.steps.flatMap((step) => step.send);
   const entered = await run(channel, "configure exclusive");
   if (!/Entering configuration mode/.test(entered) || /^error: /m.test(entered)) {
@@ -1486,7 +4212,7 @@ async function configure(channel, plan, guard) {
 `);
   const loaded = await edit(channel, "\x04", 300000);
   const refused = loaded.split(`
-`).filter((line) => REFUSED.test(line));
+`).filter((line) => REFUSED2.test(line));
   if (refused.length)
     throw await discard(`the device refused the plan, nothing was applied:
     ${refused.join(`
@@ -1537,16 +4263,16 @@ async function configure(channel, plan, guard) {
   await run(channel, "exit configuration-mode");
   console.log("  logged in again, commit confirmed");
 }
-async function apply(device, _network, plan, options) {
-  const client = await login(device);
+async function apply2(device, _network, plan, options) {
+  const client = await login2(device);
   try {
-    await checkVersion(client, device);
+    await checkVersion2(client, device);
     const channel = await shell(client);
     await openCli(channel);
-    await configure(channel, plan, {
+    await configure2(channel, plan, {
       minutes: options.rollback,
       prove: async () => {
-        const proof = await login(device);
+        const proof = await login2(device);
         proof.end();
       }
     });
@@ -1555,7 +4281,7 @@ async function apply(device, _network, plan, options) {
     client.end();
   }
 }
-function unsupported(device) {
+function unsupported2(device) {
   const found = [];
   const names = new Names(device);
   const users = device.users ?? {};
@@ -1636,7 +4362,7 @@ function unsupported(device) {
     const acl = port.acl ? device.acls?.[port.acl] : undefined;
     if (acl?.some((rule) => rule.match?.vlan))
       found.push(`acls.${port.acl} matching a VLAN, on port ${name}`);
-    found.push(...routedGaps(`ports.${name}`, port));
+    found.push(...routedGaps2(`ports.${name}`, port));
     found.push(...switchedGaps(`ports.${name}`, port, device));
   }
   const loopbackTables = new Set;
@@ -1658,7 +4384,7 @@ function unsupported(device) {
       if (iface.mtu > smallest)
         found.push(`interfaces.${name}.mtu ${iface.mtu}, above the ${smallest} its VLAN's ports carry`);
     }
-    found.push(...routedGaps(`interfaces.${name}`, iface));
+    found.push(...routedGaps2(`interfaces.${name}`, iface));
     if (iface.type === "lag")
       found.push(...switchedGaps(`interfaces.${name}`, iface, device));
     if (iface.type === "loopback") {
@@ -1741,7 +4467,7 @@ function bgpGaps(device) {
   const found = [];
   const bgp = device.routing?.bgp;
   for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
-    const settings = settingsOf(device, neighbor);
+    const settings = settingsOf2(device, neighbor);
     if (settings.role)
       found.push(`routing.bgp.neighbors.${name}.role, Junos 21 has no BGP roles`);
     if (familyOf2(neighbor.address) === "ipv6" && settings.families?.includes("ipv4")) {
@@ -1765,7 +4491,7 @@ function bgpGaps(device) {
   }
   return found;
 }
-function routedGaps(where, settings) {
+function routedGaps2(where, settings) {
   const found = [];
   const addresses = (settings.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
   if (settings.addresses?.some((entry) => typeof entry !== "string"))
@@ -1795,13 +4521,13 @@ function fillPlan(set, prefixes) {
   const send = [`delete ${list}`, `set ${list}`, ...prefixes.map((prefix) => `set ${list} ${prefix}`)];
   return { steps: [{ title: list, show: [], send }], problems: [] };
 }
-async function fill(device, _network, set, _family, prefixes) {
-  const client = await login(device);
+async function fill2(device, _network, set, _family, prefixes) {
+  const client = await login2(device);
   try {
-    await checkVersion(client, device);
+    await checkVersion2(client, device);
     const channel = await shell(client);
     await openCli(channel);
-    await configure(channel, fillPlan(set, prefixes));
+    await configure2(channel, fillPlan(set, prefixes));
     channel.end();
     console.log(`  ${set}: ${prefixes.length} prefixes on the device`);
   } finally {
@@ -1810,12 +4536,12 @@ async function fill(device, _network, set, _family, prefixes) {
 }
 var junos = {
   extension: ".conf",
-  unsupported,
-  render,
-  read,
-  plan,
-  apply,
-  fill
+  unsupported: unsupported2,
+  render: render2,
+  read: read2,
+  plan: plan2,
+  apply: apply2,
+  fill: fill2
 };
 
 // src/core/time.ts
@@ -1874,7 +4600,7 @@ function head(line) {
   const words = line.split(" ");
   return words.slice(0, Math.max(1, words.length - 1)).join(" ");
 }
-function compare(desired, current, dialect) {
+function compare2(desired, current, dialect) {
   const canon = dialect.canon ?? ((line) => line);
   const keyOf = (entry) => [...entry.path, canon(entry.line)].join("\x00");
   const pathKey = (path) => path.join("\x00");
@@ -1959,7 +4685,7 @@ function steps(groups, dialect, around = nothingAround) {
   });
 }
 var STORED_CREDENTIAL = /(password (?:irreversible-)?cipher|community read cipher|^snmp-server community)( +)\S+/gm;
-var scrub2 = (text) => text.replace(STORED_CREDENTIAL, "$1$2<redacted>");
+var scrub3 = (text) => text.replace(STORED_CREDENTIAL, "$1$2<redacted>");
 
 // src/adapters/devices/raisecom-ros/index.ts
 var DEVICE_FACTS2 = [
@@ -2046,7 +4772,7 @@ function vlanList(ids) {
   }
   return ranges.join(",");
 }
-function render2(device) {
+function render3(device) {
   const lines = [];
   const vlans = device.vlans ?? {};
   const vlanId = (name) => vlans[name].id;
@@ -2236,7 +4962,7 @@ async function open(device) {
   await send(channel, "terminal page-break disable", 15000, 1000);
   return { channel, close };
 }
-async function read2(device) {
+async function read3(device) {
   const { channel, close } = await open(device);
   try {
     const dump = await send(channel, "show running-config", 150000, 6000);
@@ -2248,13 +4974,13 @@ async function read2(device) {
     const body = lines.slice(start).filter((line) => line.startsWith("!") || !/[#>]\s*$/.test(line.trim()));
     const text = body.join(`
 `).replace(/^!(System (up )?time|Boot times):.*\n/gm, "").trim();
-    return scrub2(text + `
+    return scrub3(text + `
 `).replace(/(authkey \S+|privkey\s+\S+) \S+/g, "$1 <redacted>");
   } finally {
     close();
   }
 }
-function unsupported2(device) {
+function unsupported3(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -2369,10 +5095,10 @@ function unsupported2(device) {
   found.push(...switchUnsupported(device));
   return found;
 }
-var REFUSED2 = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
+var REFUSED3 = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
 var CONFIRM = /^(portswitch|switchport trunk allowed vlan|switchport mode)/;
 var RELEASE = /^no (\S+ access-list \d+)$/;
-async function apply2(device, _network, plan) {
+async function apply3(device, _network, plan) {
   const { channel, close } = await open(device);
   const released = [];
   try {
@@ -2383,7 +5109,7 @@ async function apply2(device, _network, plan) {
         const asks = /[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line) && !/set successfully/i.test(answer);
         if (asks)
           answer += await send(channel, "y", 1e4, 1000);
-        if (REFUSED2.test(answer))
+        if (REFUSED3.test(answer))
           throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
         const release = RELEASE.exec(line);
@@ -2431,8 +5157,8 @@ function createdIds(line) {
   }
   return ids;
 }
-function plan2(desired, current) {
-  const groups = compare(desired, current, dialect);
+function plan3(desired, current) {
+  const groups = compare2(desired, current, dialect);
   const existing = entries(current, dialect);
   for (const group of groups) {
     if (!group.path[0]?.startsWith("access-list "))
@@ -2481,7 +5207,7 @@ function plan2(desired, current) {
   }
   return { steps: planned, problems: [] };
 }
-var raisecom = { extension: ".txt", unsupported: unsupported2, render: render2, read: read2, plan: plan2, apply: apply2 };
+var raisecom = { extension: ".txt", unsupported: unsupported3, render: render3, read: read3, plan: plan3, apply: apply3 };
 
 // src/adapters/devices/routeros/export.ts
 var unwrap = (text) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
@@ -2548,7 +5274,7 @@ function parseLine(menu, line) {
   }
   return { menu, verb, selector, flags, attrs };
 }
-function parse(text) {
+function parse2(text) {
   const commands = [];
   const generated = new Set;
   let menu = "";
@@ -2567,7 +5293,7 @@ function parse(text) {
   }
   return { commands, generated };
 }
-var DEFAULTS = {
+var DEFAULTS2 = {
   "*": { disabled: "no", comment: "", instance: "default", "routing-table": "main", vrf: "main" },
   "/interface bridge": { "protocol-mode": "rstp", priority: "0x8000", "vlan-filtering": "no", pvid: "1" },
   "/interface bridge port": { pvid: "1", "frame-types": "admit-all", edge: "auto", "path-cost": "10", priority: "0x80" },
@@ -2637,12 +5363,12 @@ function defaultOf(command, property) {
     return SERVICE_DISABLED[command.selector];
   if (command.menu === "/ip firewall service-port" && property === "disabled")
     return HELPER_DISABLED[command.selector] ?? "no";
-  return DEFAULTS[command.menu]?.[property] ?? DEFAULTS["*"][property];
+  return DEFAULTS2[command.menu]?.[property] ?? DEFAULTS2["*"][property];
 }
 var CLEARED_WITH = {
   "/interface ethernet": { speed: "auto-negotiation" }
 };
-var SECRET_KEYS = new Set(["private-key", "password", "tcp-md5-key", "authentication-password", "encryption-password"]);
+var SECRET_KEYS2 = new Set(["private-key", "password", "tcp-md5-key", "authentication-password", "encryption-password"]);
 var isSecretMarker = (value) => value.startsWith("<secret:");
 var canonicalRule = (rule) => rule.replace(/\s*([=&|;{}(),<>!]+)\s*/g, "$1").replace(/\s+/g, " ").trim();
 function normalValue(command, property, value) {
@@ -2663,7 +5389,7 @@ function normalValue(command, property, value) {
 function normal(command) {
   const result = {};
   for (const [property, raw] of Object.entries(command.attrs)) {
-    if (SECRET_KEYS.has(property) || isSecretMarker(raw))
+    if (SECRET_KEYS2.has(property) || isSecretMarker(raw))
       continue;
     const value = normalValue(command, property, raw);
     if (value === defaultOf(command, property))
@@ -2708,7 +5434,7 @@ function identity(command) {
   }
   return result;
 }
-var ORDERED = new Set([
+var ORDERED2 = new Set([
   "/routing filter rule",
   "/ip firewall filter",
   "/ipv6 firewall filter",
@@ -2721,7 +5447,7 @@ var ORDERED = new Set([
   "/interface bridge filter",
   "/interface ethernet switch rule"
 ]);
-function canonical(command) {
+function canonical2(command) {
   const properties = Object.entries(normal(command)).sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => `${name}=${value}`);
   const flags = [...command.flags].sort();
   return [command.verb, command.selector, ...flags, ...properties].filter(Boolean).join(" ");
@@ -2798,9 +5524,9 @@ var DYNAMIC = new Set([
   "/ip dhcp-server lease",
   "/interface bridge vlan"
 ]);
-var quote2 = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
-var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote2(raw);
-var findValue = (raw) => /^[\w.:-]+$/.test(raw) ? raw : quote2(raw);
+var quote3 = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
+var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote3(raw);
+var findValue = (raw) => /^[\w.:-]+$/.test(raw) ? raw : quote3(raw);
 function find(menu, id) {
   const conditions = Object.entries(id).map(([property, raw]) => `${property}=${findValue(raw)}`);
   if (DYNAMIC.has(menu))
@@ -2844,7 +5570,7 @@ function changes(wanted, existing, sendSecrets, problems, label) {
   }
   if (sendSecrets) {
     for (const [property, raw] of Object.entries(wanted.attrs)) {
-      if (SECRET_KEYS.has(property) || isSecretMarker(raw))
+      if (SECRET_KEYS2.has(property) || isSecretMarker(raw))
         result[property] = raw;
     }
   }
@@ -2886,13 +5612,13 @@ function planEntries(menu, wanted, existing, sendSecrets, problems) {
     kept.add(entryKey);
     const current = existingByKey.get(entryKey);
     if (!current) {
-      changeStep.show.push(`+ ${canonical(entry)}`);
+      changeStep.show.push(`+ ${canonical2(entry)}`);
       changeStep.send.push(line(menu, "add", "", entry.flags, entry.attrs));
       continue;
     }
     const flagsDiffer = [...entry.flags].sort().join() !== [...current.flags].sort().join();
     if (flagsDiffer) {
-      changeStep.show.push(`~ replace ${canonical(entry)}`);
+      changeStep.show.push(`~ replace ${canonical2(entry)}`);
       removeStep.send.push(`${menu} remove ${find(menu, identity(current))}`);
       changeStep.send.push(line(menu, "add", "", entry.flags, entry.attrs));
       continue;
@@ -2915,12 +5641,12 @@ function planEntries(menu, wanted, existing, sendSecrets, problems) {
   for (const list of wholeLists) {
     const count = removed.filter((entry) => entry.attrs.list === list).length;
     removeStep.show.push(`- list ${list}, ${count} entr${count === 1 ? "y" : "ies"}`);
-    removeStep.send.push(`${menu} remove [ find list=${quote2(list)} and !dynamic ]`);
+    removeStep.send.push(`${menu} remove [ find list=${quote3(list)} and !dynamic ]`);
   }
   for (const entry of removed) {
     if (wholeLists.has(entry.attrs.list ?? ""))
       continue;
-    removeStep.show.push(`- ${canonical(entry)}`);
+    removeStep.show.push(`- ${canonical2(entry)}`);
     removeStep.send.push(`${menu} remove ${find(menu, identity(entry))}`);
   }
   if (changeStep.send.length)
@@ -2940,26 +5666,26 @@ function planCertificates(wanted, existing) {
   for (const entry of wanted) {
     const name = entry.attrs.name;
     const current = existingByName.get(name);
-    if (current && canonical(current) === canonical(entry))
+    if (current && canonical2(current) === canonical2(entry))
       continue;
     const sameCertificate = existing.find((item) => !wantedNames.has(item.attrs.name) && !renamed.has(item.attrs.name) && item.attrs.fingerprint === entry.attrs.fingerprint && item.attrs["private-key"] === entry.attrs["private-key"]);
     if (!current && sameCertificate) {
       const oldName = sameCertificate.attrs.name;
       renamed.add(oldName);
       install.show.push(`~ rename ${oldName} to ${name}`);
-      install.send.push(`${menu} set [ find name=${quote2(oldName)} ] name=${quote2(name)}`);
+      install.send.push(`${menu} set [ find name=${quote3(oldName)} ] name=${quote3(name)}`);
       continue;
     }
     install.show.push(`${current ? "~" : "+"} install ${name}`);
     if (current)
-      install.send.push(`${menu} remove [ find name=${quote2(name)} ]`);
+      install.send.push(`${menu} remove [ find name=${quote3(name)} ]`);
     install.send.push(INSTALL_CERTIFICATE + name);
   }
   for (const entry of existing) {
     if (wantedNames.has(entry.attrs.name) || renamed.has(entry.attrs.name))
       continue;
     remove.show.push(`- ${entry.attrs.name}`);
-    remove.send.push(`${menu} remove [ find name=${quote2(entry.attrs.name)} ]`);
+    remove.send.push(`${menu} remove [ find name=${quote3(entry.attrs.name)} ]`);
   }
   if (install.send.length)
     result.first.push(install);
@@ -2970,8 +5696,8 @@ function planCertificates(wanted, existing) {
 var OLD_RULES = "frameworkOldRules";
 function planOrdered(menu, wanted, existing) {
   const result = { first: [], last: [] };
-  const same = wanted.map((item) => canonical(item)).join(`
-`) === existing.map((item) => canonical(item)).join(`
+  const same = wanted.map((item) => canonical2(item)).join(`
+`) === existing.map((item) => canonical2(item)).join(`
 `);
   if (same)
     return result;
@@ -2981,7 +5707,7 @@ function planOrdered(menu, wanted, existing) {
   const droppedChains = [...new Set(existing.map((item) => item.attrs.chain ?? ""))].filter((chain) => !keptChains.has(chain));
   let removeOld = `${menu} remove $${OLD_RULES}`;
   if (hasChains) {
-    const keep = [...keptChains].map((chain) => quote2(chain)).join(";");
+    const keep = [...keptChains].map((chain) => quote3(chain)).join(";");
     const inKeptChain = `[:typeof [:find $keep [${menu} get $id chain]]] != "nil"`;
     removeOld = `:local keep {${keep}}; :foreach id in=$${OLD_RULES} do={ :if (${inKeptChain}) do={ ${menu} remove $id } }`;
   }
@@ -2990,19 +5716,19 @@ function planOrdered(menu, wanted, existing) {
     ...wanted.map((item) => line(menu, "add", "", item.flags, item.attrs)),
     `:global ${OLD_RULES}; ${removeOld}; /system script environment remove [find name="${OLD_RULES}"]`
   ];
-  const show = [...existing.map((item) => `- ${canonical(item)}`), ...wanted.map((item) => `+ ${canonical(item)}`)];
+  const show = [...existing.map((item) => `- ${canonical2(item)}`), ...wanted.map((item) => `+ ${canonical2(item)}`)];
   result.first.push({ title: `${menu}, in the order of the config`, show, send });
   if (hasChains) {
     for (const chain of droppedChains) {
-      const selector = `[ find chain=${quote2(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
+      const selector = `[ find chain=${quote3(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
       result.last.push({ title: `${menu} chain ${chain}`, show: [`- chain ${chain}`], send: [`${menu} remove ${selector}`] });
     }
   }
   return result;
 }
-function plan3(desired, current, options) {
-  const want = parse(desired);
-  const have = parse(current);
+function plan4(desired, current, options) {
+  const want = parse2(desired);
+  const have = parse2(current);
   const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
   const wantedByMenu = byMenu(want.commands.filter(owned));
   const existingByMenu = byMenu(have.commands.filter(owned));
@@ -3016,7 +5742,7 @@ function plan3(desired, current, options) {
     let menuPlan;
     if (menu === "/certificate")
       menuPlan = planCertificates(wanted, existing);
-    else if (ORDERED.has(menu))
+    else if (ORDERED2.has(menu))
       menuPlan = planOrdered(menu, wanted, existing);
     else {
       menuPlan = planEntries(menu, wanted, existing, options.secrets, problems);
@@ -3047,7 +5773,7 @@ class Output {
 `;
   }
 }
-function quote3(value) {
+function quote4(value) {
   const plain = /^[\w.:/@-]+$/.test(value);
   if (plain)
     return value;
@@ -3059,7 +5785,7 @@ function command(verb, properties) {
   for (const [name, value] of Object.entries(properties)) {
     if (value === undefined || value === false)
       continue;
-    const written = typeof value === "number" ? String(value) : quote3(value);
+    const written = typeof value === "number" ? String(value) : quote4(value);
     words.push(`${name}=${written}`);
   }
   return words.join(" ");
@@ -3067,7 +5793,7 @@ function command(verb, properties) {
 var yesNo = (on) => on ? "yes" : "no";
 var familySuffix = (family) => family === "ipv4" ? "V4" : "V6";
 var eachPort2 = (ports) => [ports].flat().map((port) => typeof port === "number" ? String(port) : `${port.min}-${port.max}`);
-function portList(ports) {
+function portList2(ports) {
   if (ports === undefined)
     return;
   return eachPort2(ports).join(",");
@@ -3443,7 +6169,7 @@ var NETWORKS = { ipv4: "bgp-networks-v4", ipv6: "bgp-networks-v6" };
 function renderAddressing(out, ctx) {
   addresses(out, ctx);
   dhcp(out, ctx);
-  dns(out, ctx);
+  dns2(out, ctx);
   addressLists(out, ctx);
 }
 function addresses(out, ctx) {
@@ -3501,7 +6227,7 @@ function dhcp(out, ctx) {
     out.add("/ip dhcp-relay", command("add", { "dhcp-server": relay.servers.join(","), interface: ctx.name(relay.interface), name }));
   }
 }
-function dns(out, ctx) {
+function dns2(out, ctx) {
   const dns = ctx.device.system?.dns;
   out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns?.serve), servers: dns?.servers.join(",") ?? "" }));
 }
@@ -3531,7 +6257,7 @@ function addressLists(out, ctx) {
     }
   }
 }
-var HELPERS = ["ftp", "tftp", "irc", "h323", "sip", "pptp", "rtsp"];
+var HELPERS2 = ["ftp", "tftp", "irc", "h323", "sip", "pptp", "rtsp"];
 var CHAINS = ["input", "forward", "output"];
 function renderFirewall(out, ctx) {
   for (const family of ["ipv4", "ipv6"]) {
@@ -3539,7 +6265,7 @@ function renderFirewall(out, ctx) {
     filter(out, ctx, family);
     nat(out, ctx, family);
   }
-  helpers(out, ctx);
+  helpers2(out, ctx);
   switchAcls(out, ctx);
 }
 function untracked(out, ctx, family) {
@@ -3575,13 +6301,13 @@ function matchProperties(ctx, match, family) {
     "connection-state": match?.state?.join(","),
     "dst-address": match?.dst,
     "dst-address-list": match?.dst_set,
-    "dst-port": portList(match?.dst_port),
+    "dst-port": portList2(match?.dst_port),
     "in-interface": match?.in_interface && ctx.name(match.in_interface),
     "out-interface": match?.out_interface && ctx.name(match.out_interface),
     protocol,
     "src-address": match?.src,
     "src-address-list": match?.src_set,
-    "src-port": portList(match?.src_port),
+    "src-port": portList2(match?.src_port),
     "tcp-flags": flags
   };
 }
@@ -3623,9 +6349,9 @@ function nat(out, ctx, family) {
     }
   }
 }
-function helpers(out, ctx) {
+function helpers2(out, ctx) {
   const enabled = ctx.device.firewall?.helpers ?? [];
-  for (const helper of HELPERS) {
+  for (const helper of HELPERS2) {
     out.add("/ip firewall service-port", command(`set ${helper}`, { disabled: yesNo(!enabled.includes(helper)) }));
   }
 }
@@ -3660,7 +6386,7 @@ function switchAcls(out, ctx) {
   }
 }
 var RPKI_GROUP2 = "rpki";
-var REJECT_ALL2 = "REJECT-ALL";
+var REJECT_ALL3 = "REJECT-ALL";
 var ROLES = {
   provider: "ebgp-customer",
   customer: "ebgp-provider",
@@ -3669,17 +6395,17 @@ var ROLES = {
   "rs-client": "ebgp-rs"
 };
 function renderRouting(out, ctx) {
-  staticRoutes2(out, ctx);
+  staticRoutes3(out, ctx);
   rpki2(out, ctx);
   if (ctx.device.routing?.bgp) {
     bgpInstance(out, ctx);
     policies(out, ctx);
     bgpConnections(out, ctx);
   }
-  ospf2(out, ctx);
+  ospf3(out, ctx);
   bfd(out, ctx);
 }
-function staticRoutes2(out, ctx) {
+function staticRoutes3(out, ctx) {
   for (const route of ctx.device.routing?.static ?? []) {
     const menu = familyOf2(host2(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
     const verb = route.blackhole ? "add blackhole" : "add";
@@ -3707,12 +6433,12 @@ function bgpInstance(out, ctx) {
   const bgp = ctx.device.routing.bgp;
   out.add("/routing bgp instance", command("add", { as: bgp.asn, name: "default", "router-id": ctx.device.routing?.router_id }));
 }
-function settingsOf2(ctx, neighbor) {
+function settingsOf3(ctx, neighbor) {
   const group = neighbor.group ? ctx.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
   return { ...group, ...neighbor };
 }
-function familiesOf(ctx, neighbor) {
-  return settingsOf2(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
+function familiesOf2(ctx, neighbor) {
+  return settingsOf3(ctx, neighbor).families ?? [familyOf2(neighbor.address)];
 }
 var chainName = (policy, family) => `${policy}-${familySuffix(family)}`;
 function appliesTo(ctx, rule, family) {
@@ -3817,8 +6543,8 @@ function policies(out, ctx) {
   };
   let rejectAllNeeded = false;
   for (const neighbor of Object.values(bgp.neighbors ?? {})) {
-    const settings = settingsOf2(ctx, neighbor);
-    for (const family of familiesOf(ctx, neighbor)) {
+    const settings = settingsOf3(ctx, neighbor);
+    for (const family of familiesOf2(ctx, neighbor)) {
       for (const policy of [settings.import, settings.export]) {
         if (policy)
           want(policy, family);
@@ -3848,7 +6574,7 @@ function policies(out, ctx) {
   if (rejectAllNeeded) {
     for (const family of ["ipv4", "ipv6"])
       out.add("/routing filter rule", command("add", {
-        chain: chainName(REJECT_ALL2, family),
+        chain: chainName(REJECT_ALL3, family),
         rule: "reject"
       }));
   }
@@ -3856,8 +6582,8 @@ function policies(out, ctx) {
 function bgpConnections(out, ctx) {
   const bgp = ctx.device.routing.bgp;
   for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
-    const settings = settingsOf2(ctx, neighbor);
-    const [family] = familiesOf(ctx, neighbor);
+    const settings = settingsOf3(ctx, neighbor);
+    const [family] = familiesOf2(ctx, neighbor);
     const addressFamily = familyOf2(neighbor.address);
     const internal = settings.remote_as === bgp.asn;
     const originates = bgp.networks?.some((prefix) => familyOf2(host2(prefix)) === family);
@@ -3867,7 +6593,7 @@ function bgpConnections(out, ctx) {
       as: bgp.asn,
       connect: settings.passive ? "no" : undefined,
       "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
-      "input.filter": chainName(settings.import ?? REJECT_ALL2, family),
+      "input.filter": chainName(settings.import ?? REJECT_ALL3, family),
       instance: "default",
       [`input.limit-process-routes-${family}`]: settings.max_prefixes,
       "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
@@ -3876,7 +6602,7 @@ function bgpConnections(out, ctx) {
       "local.role": role,
       multihop: settings.multihop ? "yes" : undefined,
       name,
-      "output.filter-chain": chainName(settings.export ?? REJECT_ALL2, family),
+      "output.filter-chain": chainName(settings.export ?? REJECT_ALL3, family),
       "output.network": originates ? NETWORKS[family] : undefined,
       "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
       "remote.as": settings.remote_as,
@@ -3885,7 +6611,7 @@ function bgpConnections(out, ctx) {
     }));
   }
 }
-function ospf2(out, ctx) {
+function ospf3(out, ctx) {
   const ospf = ctx.device.routing?.ospf;
   if (!ospf)
     return;
@@ -3916,12 +6642,12 @@ function ospf2(out, ctx) {
 }
 function bfd(out, ctx) {
   const routing = ctx.device.routing;
-  const bgpWants = Object.values(routing?.bgp?.neighbors ?? {}).some((neighbor) => settingsOf2(ctx, neighbor).bfd);
+  const bgpWants = Object.values(routing?.bgp?.neighbors ?? {}).some((neighbor) => settingsOf3(ctx, neighbor).bfd);
   const ospfWants = Object.values(routing?.ospf?.areas ?? {}).some((area) => Object.values(area.interfaces).some((iface) => iface?.bfd));
   if (bgpWants || ospfWants)
     out.add("/routing bfd configuration", command("add", { interfaces: "all" }));
 }
-var SERVICES = {
+var SERVICES2 = {
   ftp: "ftp",
   ssh: "ssh",
   telnet: "telnet",
@@ -3937,13 +6663,13 @@ var SNMP_PRIVACY2 = { aes128: "AES", des: "DES" };
 function renderManagement(out, ctx) {
   services2(out, ctx);
   layerTwo(out, ctx);
-  snmp2(out, ctx);
-  users2(out, ctx);
-  certificates(out, ctx);
+  snmp3(out, ctx);
+  users3(out, ctx);
+  certificates2(out, ctx);
 }
 function services2(out, ctx) {
   const management = ctx.device.management ?? {};
-  for (const [neutral, platform] of Object.entries(SERVICES)) {
+  for (const [neutral, platform] of Object.entries(SERVICES2)) {
     const service = management[neutral];
     if (!service) {
       out.add("/ip service", command(`set ${platform}`, { disabled: "yes" }));
@@ -3973,7 +6699,7 @@ function layerTwo(out, ctx) {
     discovery = "all";
   out.add("/ip neighbor discovery-settings", command("set", { "discover-interface-list": discovery, protocol: "lldp" }));
 }
-function snmp2(out, ctx) {
+function snmp3(out, ctx) {
   const management = ctx.device.management ?? {};
   const snmp = management.snmp;
   if (!snmp) {
@@ -3999,7 +6725,7 @@ function snmp2(out, ctx) {
     }));
   }
 }
-function users2(out, ctx) {
+function users3(out, ctx) {
   for (const [name, user] of Object.entries(ctx.device.users ?? {})) {
     out.add("/user", command("add", {
       comment: user.description,
@@ -4011,7 +6737,7 @@ function users2(out, ctx) {
       out.add("/user ssh-keys", command("add", { key, user: name }));
   }
 }
-function certificates(out, ctx) {
+function certificates2(out, ctx) {
   for (const [name, certificate] of Object.entries(ctx.device.certificates ?? {})) {
     out.add("/certificate", command("add", {
       fingerprint: fingerprint(certificate.certificate),
@@ -4048,12 +6774,12 @@ function renderSystem(out, ctx) {
   out.add("/system ntp server", command("set", { enabled: yesNo(system.ntp?.serve) }));
   for (const server of system.ntp?.servers ?? [])
     out.add("/system ntp client servers", command("add", { address: server }));
-  logging(out, ctx);
+  logging2(out, ctx);
   out.add("/system package update", command("set", { channel: system.release_channel ?? "stable" }));
   out.add("/system routerboard settings", command("set", { "enter-setup-on": "delete-key" }));
-  flowExport(out, ctx);
+  flowExport2(out, ctx);
 }
-function logging(out, ctx) {
+function logging2(out, ctx) {
   const logging = ctx.device.system?.logging;
   const local = logging?.local;
   out.add("/system logging action", command("set 1", {
@@ -4074,7 +6800,7 @@ function logging(out, ctx) {
       out.add("/system logging", command("add", { action, topics: topic }));
   });
 }
-function flowExport(out, ctx) {
+function flowExport2(out, ctx) {
   const flow = ctx.device.flow_export;
   if (!flow) {
     out.add("/ip traffic-flow", command("set", { enabled: "no" }));
@@ -4094,7 +6820,7 @@ function flowExport(out, ctx) {
     out.add("/ip traffic-flow target", command("add", { "dst-address": collector.address, port: collector.port ?? 2055, version }));
   }
 }
-function render3(device) {
+function render4(device) {
   const out = new Output;
   const ctx = new Context(device);
   renderInterfaces(out, ctx);
@@ -4108,7 +6834,7 @@ function render3(device) {
 
 // src/adapters/devices/routeros/index.ts
 var SUPPORTED_MAJOR2 = 7;
-async function login2(device) {
+async function login3(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -4119,7 +6845,7 @@ async function login2(device) {
     password: resolve(user.password)
   });
 }
-async function checkVersion2(client, device) {
+async function checkVersion3(client, device) {
   const version = (await exec(client, ":put [/system resource get version]")).trim();
   const major = Number(version.split(".")[0]);
   if (major !== SUPPORTED_MAJOR2) {
@@ -4135,10 +6861,10 @@ var LIST_CERTIFICATES = [
   ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
   "}"
 ].join(" ");
-async function read3(device) {
-  const client = await login2(device);
+async function read4(device) {
+  const client = await login3(device);
   try {
-    await checkVersion2(client, device);
+    await checkVersion3(client, device);
     const config = await exec(client, "/export", 300000);
     const users = await exec(client, "/user export");
     const certificates = (await exec(client, LIST_CERTIFICATES)).trim();
@@ -4159,7 +6885,7 @@ ${certificates}` : "";
     client.end();
   }
 }
-function unsupported3(device) {
+function unsupported4(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -4233,9 +6959,9 @@ async function installCertificate(client, device, name) {
   }
   await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
 }
-async function apply3(device, _network, changes, options) {
-  const client = await login2(device);
-  await checkVersion2(client, device);
+async function apply4(device, _network, changes, options) {
+  const client = await login3(device);
+  await checkVersion3(client, device);
   const commands = changes.steps.flatMap((step) => step.send.map((command) => ({ title: step.title, command })));
   for (const { title, command } of commands) {
     if (command.startsWith(INSTALL_CERTIFICATE))
@@ -4281,7 +7007,7 @@ async function apply3(device, _network, changes, options) {
     throw new Error("apply failed and the backup is being restored");
   }
   client.end();
-  const proof = await login2(device).catch(() => {
+  const proof = await login3(device).catch(() => {
     return;
   });
   if (!proof)
@@ -4291,10 +7017,10 @@ async function apply3(device, _network, changes, options) {
   proof.end();
   console.log("  logged in again, rollback disarmed");
 }
-async function fill2(device, _network, set, family, prefixes) {
+async function fill3(device, _network, set, family, prefixes) {
   const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
   const batchSize = 60;
-  const client = await login2(device);
+  const client = await login3(device);
   try {
     await exec(client, `${menu} remove [find list="${set}" and !dynamic]`);
     for (let start = 0;start < prefixes.length; start += batchSize) {
@@ -4311,12 +7037,12 @@ async function fill2(device, _network, set, family, prefixes) {
 }
 var routeros = {
   extension: ".rsc",
-  unsupported: unsupported3,
-  render: render3,
-  read: read3,
-  plan: plan3,
-  apply: apply3,
-  fill: fill2
+  unsupported: unsupported4,
+  render: render4,
+  read: read4,
+  plan: plan4,
+  apply: apply4,
+  fill: fill3
 };
 
 // src/adapters/devices/vrp/index.ts
@@ -4435,7 +7161,7 @@ class Config {
 `;
   }
 }
-function render4(device) {
+function render5(device) {
   const config = new Config;
   const vlans = device.vlans ?? {};
   const vlanId = (name) => vlans[name].id;
@@ -4452,7 +7178,7 @@ function render4(device) {
   system2(config, device);
   vlanBlocks(config, device);
   managementAcl(config, device);
-  users3(config, device);
+  users4(config, device);
   vrfs3(config, device);
   for (const [name, lag] of Object.entries(interfaces)) {
     if (lag.type === "lag")
@@ -4466,16 +7192,16 @@ function render4(device) {
     const settings = device.ports?.[port];
     config.block(`interface ${nameOf(port)}`, physicalPort2(device, port, settings, vlanId, lagNumbers));
   }
-  staticRoutes3(config, device, nameOf);
-  ospf3(config, device, nameOf);
+  staticRoutes4(config, device, nameOf);
+  ospf4(config, device, nameOf);
   if (wantsBfd(device))
     config.block("bfd", []);
   if (device.dhcp_relay && Object.keys(device.dhcp_relay).length) {
     config.line("dhcp enable");
     config.separator();
   }
-  flowExport2(config, device);
-  snmp3(config, device);
+  flowExport3(config, device);
+  snmp4(config, device);
   ssh(config, device);
   userInterfaces(config, device);
   return config.text();
@@ -4535,7 +7261,7 @@ function managementAcl(config, device) {
   const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host2(cidr)} ${wildcard(split(cidr).len)}`);
   config.block(`acl number ${MANAGEMENT_ACL2}`, ["description Management access", ...rules, `rule ${(allow.length + 1) * 5} deny`]);
 }
-function users3(config, device) {
+function users4(config, device) {
   const lines = [];
   for (const [name, user] of Object.entries(device.users ?? {})) {
     lines.push(`local-user ${name} password irreversible-cipher ${marker(user.password)}`);
@@ -4660,7 +7386,7 @@ function physicalPort2(device, port, settings, vlanId, lagNumbers) {
   }
   return lines;
 }
-function staticRoutes3(config, device, nameOf) {
+function staticRoutes4(config, device, nameOf) {
   for (const route of device.routing?.static ?? []) {
     const { addr, len } = split(route.prefix);
     const nextHop = route.blackhole ? "NULL0" : route.via ?? nameOf(route.interface);
@@ -4674,7 +7400,7 @@ function staticRoutes3(config, device, nameOf) {
   }
   config.separator();
 }
-function ospf3(config, device, nameOf) {
+function ospf4(config, device, nameOf) {
   const ospf = device.routing?.ospf;
   if (!ospf)
     return;
@@ -4698,7 +7424,7 @@ function wantsBfd(device) {
   const areas = Object.values(device.routing?.ospf?.areas ?? {});
   return areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
 }
-function flowExport2(config, device) {
+function flowExport3(config, device) {
   const flow = device.flow_export;
   if (flow?.protocol !== "sflow")
     return;
@@ -4709,7 +7435,7 @@ function flowExport2(config, device) {
   });
   config.separator();
 }
-function snmp3(config, device) {
+function snmp4(config, device) {
   const snmp = device.management?.snmp;
   if (!snmp)
     return;
@@ -4763,7 +7489,7 @@ function userInterfaces(config, device) {
   config.block("user-interface vty 0 4", ["authentication-mode aaa", `protocol inbound ${device.management?.telnet ? "all" : "ssh"}`]);
 }
 var HOST_KEYS2 = ["ssh-rsa"];
-async function login3(device) {
+async function login4(device) {
   const user = device.users?.[device.connection.user];
   if (!user)
     throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
@@ -4783,8 +7509,8 @@ async function openShell(client) {
   await send(channel, "screen-length 0 temporary", 1e4, 1500);
   return channel;
 }
-async function read4(device) {
-  const client = await login3(device);
+async function read5(device) {
+  const client = await login4(device);
   try {
     const channel = await openShell(client);
     const dump = await send(channel, "display current-configuration", 120000, 3000);
@@ -4795,14 +7521,14 @@ async function read4(device) {
     if (start < 0)
       throw new Error(`${device.name} returned no configuration`);
     const body = lines.slice(start).filter((line) => !/^<.*>$/.test(line.trim()) && !line.startsWith("!Last configuration"));
-    return scrub2(body.join(`
+    return scrub3(body.join(`
 `).trim() + `
 `);
   } finally {
     client.end();
   }
 }
-function unsupported4(device) {
+function unsupported5(device) {
   const found = [];
   for (const [name, port] of Object.entries(device.ports ?? {})) {
     if (!port)
@@ -4881,7 +7607,7 @@ function unsupported4(device) {
   }
   return found;
 }
-var REFUSED3 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
+var REFUSED4 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
 var INTERACTIVE = /^(snmp-agent usm-user v3 \S+ (?:authentication|privacy)-mode \S+) cipher <secret:([A-Za-z0-9_./:-]+)>$/;
 async function sendLine(channel, line) {
   const interactive = INTERACTIVE.exec(line.trim());
@@ -4898,21 +7624,21 @@ async function sendLine(channel, line) {
     answer += await send(channel, "Y", 20000, 800);
   return answer;
 }
-async function apply4(device, _network, plan) {
-  const client = await login3(device);
+async function apply5(device, _network, plan) {
+  const client = await login4(device);
   const channel = await openShell(client);
   try {
     await send(channel, "system-view", 1e4, 1500);
     for (const step of plan.steps) {
       for (const line of step.send) {
         const answer = await sendLine(channel, line);
-        if (REFUSED3.test(answer))
+        if (REFUSED4.test(answer))
           throw new Error(`${step.title}: ${line}
     device said: ${answer.trim().slice(0, 300)}`);
       }
     }
     const committed = await send(channel, "commit", 60000, 3000);
-    if (REFUSED3.test(committed))
+    if (REFUSED4.test(committed))
       throw new Error(`commit refused: ${committed.trim().slice(0, 300)}`);
     await send(channel, "quit", 1e4);
   } catch (error) {
@@ -4923,7 +7649,7 @@ async function apply4(device, _network, plan) {
     client.end();
     throw error;
   }
-  const proof = await login3(device).catch(() => {
+  const proof = await login4(device).catch(() => {
     return;
   });
   if (!proof) {
@@ -4939,8 +7665,8 @@ async function apply4(device, _network, plan) {
   client.end();
   console.log("  committed, login proved, saved");
 }
-function plan4(desired, current) {
-  const groups = compare(desired, current, dialect2);
+function plan5(desired, current) {
+  const groups = compare2(desired, current, dialect2);
   vlanListChange(groups, "vlan batch ", batchIds, (ids) => [`vlan batch ${vlanBatch(ids)}`], (ids) => [`vlan batch ${vlanBatch(ids)}`]);
   const top = groups.find((group) => group.path.length === 0);
   const removedBatch = top?.remove.find((line) => line.startsWith("vlan batch ")) ?? "";
@@ -4961,15 +7687,15 @@ function plan4(desired, current) {
 }
 var vrp = {
   extension: ".cfg",
-  unsupported: unsupported4,
-  render: render4,
-  read: read4,
-  plan: plan4,
-  apply: apply4
+  unsupported: unsupported5,
+  render: render5,
+  read: read5,
+  plan: plan5,
+  apply: apply5
 };
 
 // src/adapters/devices/index.ts
-var adapters = { routeros, vrp, "raisecom-ros": raisecom, junos };
+var adapters = { routeros, vrp, "raisecom-ros": raisecom, junos, fortios };
 
 // src/adapters/registries/index.ts
 async function ripeStat(query, family) {
@@ -4990,7 +7716,7 @@ var registries = { "ripe-stat": ripeStat };
 // src/adapters/registries/librenms.ts
 var AUTH = { sha1: "SHA", sha256: "SHA-256" };
 var PRIVACY = { aes128: "AES", des: "DES" };
-function settingsOf3(network) {
+function settingsOf4(network) {
   if (!network.librenms)
     throw new Error("the network has no librenms settings");
   return {
@@ -5017,7 +7743,7 @@ function credentials(device) {
   return;
 }
 async function planLibreNms(network) {
-  const { base, headers } = settingsOf3(network);
+  const { base, headers } = settingsOf4(network);
   const response = await fetch(`${base}/devices?type=all`, { headers, signal: AbortSignal.timeout(30000) });
   if (!response.ok)
     throw new Error(`LibreNMS answered ${response.status} to the device list`);
@@ -5031,7 +7757,7 @@ async function planLibreNms(network) {
   };
 }
 async function sendLibreNms(network, additions) {
-  const { base, headers } = settingsOf3(network);
+  const { base, headers } = settingsOf4(network);
   for (const device of additions) {
     const body = { hostname: device.connection.host, display_template: device.name, ...credentials(device) };
     const response = await fetch(`${base}/devices`, {
@@ -5050,10 +7776,10 @@ async function sendLibreNms(network, additions) {
 
 // src/adapters/registries/peeringdb.ts
 var API = "https://www.peeringdb.com/api";
-var addressesOf2 = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+var addressesOf3 = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
 function peersWithRouteServer(device, iface) {
   const bgp = device.routing?.bgp;
-  const subnets = addressesOf2(iface);
+  const subnets = addressesOf3(iface);
   return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
     const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
     const role = neighbor.role ?? group?.role;
@@ -5067,7 +7793,7 @@ function wanted(network) {
       const exchange = iface.exchange;
       if (!exchange?.peeringdb_ixlan)
         continue;
-      const published = addressesOf2(iface).map(host2).filter(isGlobal2);
+      const published = addressesOf3(iface).map(host2).filter(isGlobal2);
       records.push({
         name: exchange.name,
         ixlan_id: exchange.peeringdb_ixlan,
@@ -5983,7 +8709,7 @@ async function load(path) {
   const { createJiti } = await import("jiti");
   return createJiti(import.meta.url).import(path, { default: true });
 }
-var network2 = await load(configPath);
+var network3 = await load(configPath);
 var flags = rest.filter((arg) => arg.startsWith("--"));
 var names = rest.filter((arg) => !arg.startsWith("--"));
 var confirmed = flags.includes("--confirm");
@@ -5997,9 +8723,9 @@ function fail(message) {
 }
 function selected(allByDefault) {
   if (!names.length && allByDefault)
-    return [...network2.devices];
-  const known = network2.devices.map((device) => device.name).join(", ");
-  const byName = (name) => network2.devices.find((device) => device.name === name);
+    return [...network3.devices];
+  const known = network3.devices.map((device) => device.name).join(", ");
+  const byName = (name) => network3.devices.find((device) => device.name === name);
   return names.map((name) => byName(name) ?? fail(`no device ${name}; known: ${known}`));
 }
 function one() {
@@ -6023,7 +8749,7 @@ function writeState(device, text) {
 }
 function guard(devices) {
   const relevant = new Set(devices.map((device) => device.name));
-  const findings = validate(network2).filter((finding) => !finding.device || relevant.has(finding.device));
+  const findings = validate(network3).filter((finding) => !finding.device || relevant.has(finding.device));
   for (const finding of findings) {
     const where = finding.device ? `${finding.device}: ` : "";
     const level = finding.level === "error" ? "error" : "warn ";
@@ -6048,8 +8774,8 @@ function show(device, plan) {
   return commands + plan.problems.length;
 }
 function validateCommand() {
-  guard([...network2.devices]);
-  console.log(`${network2.devices.length} device(s), no errors.`);
+  guard([...network3.devices]);
+  console.log(`${network3.devices.length} device(s), no errors.`);
 }
 function buildCommand() {
   const device = one();
@@ -6073,14 +8799,14 @@ function diffCommand() {
 }
 async function snapshotCommand() {
   for (const device of selected(true)) {
-    const text = await adapterOf(device).read(device, network2.devices);
+    const text = await adapterOf(device).read(device, network3.devices);
     writeState(device, text);
     console.log(`${device.name}: ${text.split(`
 `).length} lines`);
   }
   if (names.length || !existsSync3(stateDirectory))
     return;
-  const current = new Set(network2.devices.map((device) => basename2(statePath(device))));
+  const current = new Set(network3.devices.map((device) => basename2(statePath(device))));
   for (const file of readdirSync2(stateDirectory)) {
     if (current.has(file))
       continue;
@@ -6092,7 +8818,7 @@ async function applyCommand() {
   const device = one();
   guard([device]);
   const adapter = adapterOf(device);
-  const live = await adapter.read(device, network2.devices);
+  const live = await adapter.read(device, network3.devices);
   writeState(device, live);
   const plan = adapter.plan(adapter.render(device), live, options);
   if (!show(device, plan))
@@ -6105,8 +8831,8 @@ Not sent: resolve the problems first.`);
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await adapter.apply(device, network2.devices, plan, options);
-  writeState(device, await adapter.read(device, network2.devices));
+  await adapter.apply(device, network3.devices, plan, options);
+  writeState(device, await adapter.read(device, network3.devices));
   console.log("snapshot updated");
 }
 async function refreshCommand() {
@@ -6122,7 +8848,7 @@ async function refreshCommand() {
     }
     console.log(`${name}: ${prefixes.length} prefixes from ${registry} ${query}`);
     if (confirmed)
-      await fill(device, network2.devices, name, family, prefixes);
+      await fill(device, network3.devices, name, family, prefixes);
   }
   if (!confirmed)
     console.log(`
@@ -6137,7 +8863,7 @@ function publicKeyOf(privateKey) {
 }
 function wireguardCommand() {
   const [deviceName, interfaceName, peerName] = names;
-  const device = network2.devices.find((candidate) => candidate.name === deviceName) ?? fail(HELP);
+  const device = network3.devices.find((candidate) => candidate.name === deviceName) ?? fail(HELP);
   const iface = device.interfaces?.[interfaceName ?? ""];
   if (iface?.type !== "wireguard")
     fail(`${deviceName} has no WireGuard interface ${interfaceName}`);
@@ -6162,7 +8888,7 @@ function wireguardCommand() {
 `));
 }
 function communitiesCommand() {
-  const communities = network2.communities ?? fail("the network declares no communities");
+  const communities = network3.communities ?? fail("the network declares no communities");
   for (const { community, description } of communities) {
     if (community.includes(","))
       fail(`community ${community} holds a comma`);
@@ -6170,7 +8896,7 @@ function communitiesCommand() {
   }
 }
 async function peeringdbCommand() {
-  const plan = await planPeeringDb(network2);
+  const plan = await planPeeringDb(network3);
   for (const name of plan.unknown) {
     console.log(`  PeeringDB lists ${name}, which the config does not. Remove it by hand if the network left.`);
   }
@@ -6185,10 +8911,10 @@ async function peeringdbCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendPeeringDb(network2, plan.changes);
+  await sendPeeringDb(network3, plan.changes);
 }
 async function librenmsCommand() {
-  const plan = await planLibreNms(network2);
+  const plan = await planLibreNms(network3);
   for (const hostname of plan.unknown)
     console.log(`  LibreNMS monitors ${hostname}, which the config does not. Remove it by hand if it is gone.`);
   for (const device of plan.withoutSnmp)
@@ -6204,17 +8930,17 @@ async function librenmsCommand() {
 Nothing sent. Re-run with --confirm.`);
     return;
   }
-  await sendLibreNms(network2, plan.additions);
+  await sendLibreNms(network3, plan.additions);
 }
 function prometheusCommand() {
   if (flags.includes("--auths")) {
-    const { yaml, notes } = snmpExporterAuths(network2);
+    const { yaml, notes } = snmpExporterAuths(network3);
     for (const note of notes)
       console.error(note);
     process.stdout.write(yaml);
     return;
   }
-  const { targets, withoutSnmp } = prometheusTargets(network2);
+  const { targets, withoutSnmp } = prometheusTargets(network3);
   for (const device of withoutSnmp)
     console.error(`${device.name} has no SNMP in its config; left out`);
   console.log(JSON.stringify(targets, null, 4));
@@ -6231,7 +8957,7 @@ function secretsIn(value, found = new Set) {
   return found;
 }
 function secretsCommand() {
-  const references = [...secretsIn([network2.devices, network2.peeringdb, network2.librenms])].sort();
+  const references = [...secretsIn([network3.devices, network3.peeringdb, network3.librenms])].sort();
   let missing = 0;
   for (const reference of references) {
     const name = reference.replace(/^file:/, "");
@@ -6265,12 +8991,12 @@ function driftOf(device) {
   }
 }
 function annotatedGraph(layers, deviceNames) {
-  const graph = only(graphOf(network2.devices), layers, deviceNames);
+  const graph = only(graphOf(network3.devices), layers, deviceNames);
   const shown = new Set(graph.nodes.map((node) => node.label));
   return {
     ...graph,
-    findings: validate(network2).filter((finding) => !finding.device || shown.has(finding.device)),
-    drift: Object.fromEntries(network2.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
+    findings: validate(network3).filter((finding) => !finding.device || shown.has(finding.device)),
+    drift: Object.fromEntries(network3.devices.filter((device) => shown.has(device.name)).map((device) => [device.name, driftOf(device)]))
   };
 }
 function graphCommand() {
@@ -6306,7 +9032,7 @@ function addressesCommand() {
   const length = lengthText === undefined ? undefined : Number(lengthText);
   if (length !== undefined && !(Number.isInteger(length) && length >= 0 && length <= 128))
     fail("--length takes a prefix length, such as 24");
-  const report = addressesOf(network2.devices, within);
+  const report = addressesOf(network3.devices, within);
   if (flagValue("format") === "json") {
     console.log(JSON.stringify(report, null, 4));
     return;
@@ -6341,10 +9067,10 @@ function renameCommand() {
   const [from, to] = names;
   if (!from || !to)
     fail("usage: circuit rename <device> <new-name> [--file] [--confirm]");
-  const device = network2.devices.find((candidate) => candidate.name === from);
+  const device = network3.devices.find((candidate) => candidate.name === from);
   if (!device)
-    fail(`no device ${from}; known: ${network2.devices.map((candidate) => candidate.name).join(", ")}`);
-  if (network2.devices.some((candidate) => candidate.name === to))
+    fail(`no device ${from}; known: ${network3.devices.map((candidate) => candidate.name).join(", ")}`);
+  if (network3.devices.some((candidate) => candidate.name === to))
     fail(`${to} is already a device`);
   if (!/^[A-Za-z0-9][A-Za-z0-9._-]*$/.test(to))
     fail(`${to} is not a hostname: letters, digits, dots, dashes and underscores`);
@@ -6381,7 +9107,7 @@ Renamed. Run circuit validate, then circuit apply ${to}: the device keeps its ol
 async function studioCommand() {
   if (flags.includes("--json")) {
     const sources = projectSources(root2);
-    const data = studioData(network2.devices, annotatedGraph(LAYERS, []), {
+    const data = studioData(network3.devices, annotatedGraph(LAYERS, []), {
       render: (device) => adapterOf(device).render(device),
       snapshot: (device) => existsSync3(statePath(device)) ? readFileSync4(statePath(device), "utf8") : undefined,
       files: (device) => ({
@@ -6395,7 +9121,7 @@ async function studioCommand() {
   const port = Number(flagValue("port") ?? 4600);
   if (!Number.isInteger(port) || port < 1 || port > 65535)
     fail("--port takes a number from 1 to 65535");
-  const { isLoopback, studio } = await import("../chunks/server-n2q4tzy4.js");
+  const { isLoopback, studio } = await import("../chunks/server-1ftkqkx5.js");
   const host = flagValue("host") ?? "127.0.0.1";
   const allowHosts = (flagValue("allow-host") ?? "").split(",").filter(Boolean);
   if (!isLoopback(host) && !allowHosts.length) {