@takodotid/circuit 0.26.2 → 0.28.0

package/dist/types/adapters/devices/fortios/index.d.ts

@@ -1,6 +1,7 @@
 import type { Client } from "ssh2";
 import type { Device, Family } from "../../../schema";
-import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+import { type ConsoleDialect } from "../../../transport/console";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 /** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
 export type Channel = {
     write(data: string): unknown;
@@ -26,13 +27,15 @@ export declare class Cli {
     private collect;
 }
 export declare function login(device: Device): Promise<Client>;
+/** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
+export declare const FORTIOS_CONSOLE: ConsoleDialect;
 /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
 export declare function checkVersion(cli: Cli, device: Device): Promise<void>;
 /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
 export declare function scrub(text: string): string;
 /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
 export declare function readConfig(cli: Cli, device: Device): Promise<string>;
-export declare function read(device: Device): Promise<string>;
+export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
 /**
  * A line with each secret's value in place, escaped inside its quotes. A certificate's key from a variable is PEM encoded as one line of base64, and is sent as the PEM it holds. A file saved with Windows line endings is sent with plain ones: the CLI takes each carriage return as a line of its own, and refuses the key, `Invalid private key`. A `?`, which the CLI takes as a call for help, is typed literally.
  */

package/dist/types/adapters/devices/fortios/plan.d.ts

@@ -12,6 +12,8 @@ type Table = {
     created?: (entry: Block) => readonly string[];
     /** Settings an entry keeps for life. A change deletes the entry and creates it again. */
     fixed?: readonly string[];
+    /** The device refuses an entry that holds the same as another, `Duplicated entry`, even for a moment while entries are renumbered. */
+    distinct?: true;
 };
 /** Tables whose entries need more than a plain comparison, by section. */
 export declare const TABLES: Record<string, Table>;

package/dist/types/adapters/devices/junos/index.d.ts

@@ -1,6 +1,7 @@
 import type { Client, ClientChannel } from "ssh2";
 import type { Device, Family } from "../../../schema";
-import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+import { type ConsoleDialect } from "../../../transport/console";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 /** A statement's words; a quoted value is one word with its quotes. */
 export declare function wordsOf(statement: string): string[];
 /** The device prints a password as a hash, an SNMP key as a reversible cipher, and a community as itself. None leave the read. */
@@ -16,7 +17,9 @@ export declare function clean(output: string): string;
  */
 export declare function plan(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
 export declare function login(device: Device): Promise<Client>;
-export declare function read(device: Device): Promise<string>;
+export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
+/** How the console asks for a login. Root lands in a shell, `%`, every other user in the CLI, `>`; a session left in configuration mode, `#`, leaves it first. Not yet proved on a device. */
+export declare const JUNOS_CONSOLE: ConsoleDialect;
 /** An interactive CLI with paging off. Root lands in a shell and starts the CLI from there. */
 export declare function openCli(channel: ClientChannel): Promise<void>;
 /** How a commit that could cut access is guarded: it rolls back after `minutes` unless `prove` shows access survived. */

package/dist/types/adapters/devices/raisecom-ros/index.d.ts

@@ -1,23 +1,28 @@
 import type { ClientChannel } from "ssh2";
 import type { Device } from "../../../schema";
+import { type ConsoleDialect } from "../../../transport/console";
 import { type Dialect } from "../lines";
-import type { DeviceAdapter, Plan } from "../types";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 export declare const dialect: Dialect;
 /** The access-list that guards every management service. */
 export declare const MANAGEMENT_ACL = 1000;
 /** `99,200-201,999`, the platform's compression of a VLAN list. */
 export declare function vlanList(ids: number[]): string;
 export declare function render(device: Device): string;
+/** A session, and how to prove access in a fresh login: a new SSH session, or logging out and in again on the console. */
 export type Session = {
     channel: ClientChannel;
     close: () => void;
+    fresh: () => Promise<Session>;
 };
-/** An interactive shell, paging off. A session that does not answer as ROS is refused, so nothing meant for it can reach another shell. */
-export declare function open(device: Device): Promise<Session>;
+/** How the console asks for a login. Not yet proved on a device: the RAX721's console was never cabled to a jump host. */
+export declare const RAISECOM_CONSOLE: ConsoleDialect;
+/** An interactive shell, paging off, over SSH or on the console. A session that does not answer as ROS is refused, so nothing meant for it can reach another shell. */
+export declare function open(device: Device, options?: ReadOptions): Promise<Session>;
 /** What the device runs, credentials scrubbed. */
-export declare function read(device: Device): Promise<string>;
+export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
 export declare function unsupported(device: Device): string[];
-export declare function apply(device: Device, _network: readonly Device[], plan: Plan): Promise<void>;
+export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
 /** The VLAN IDs of a `create vlan 10,20-30 active` line. */
 export declare function createdIds(line: string): number[];
 export declare const raisecom: DeviceAdapter;

package/dist/types/adapters/devices/routeros/index.d.ts

@@ -1,17 +1,30 @@
 import type { Client } from "ssh2";
 import type { Device, Family } from "../../../schema";
-import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+import { type ConsoleDialect } from "../../../transport/console";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 /** The major version this adapter renders for. Version 6 has a different BGP and filter language altogether. */
 export declare const SUPPORTED_MAJOR = 7;
 export declare function login(device: Device): Promise<Client>;
+/** How the RouterOS console asks for a login. The flags after the user turn off colours and terminal detection, without which the console redraws every line. */
+export declare const ROUTEROS_CONSOLE: ConsoleDialect;
+/** Where commands run, one at a time, each returning what it printed: an SSH session, or the console. */
+type Session = {
+    run(command: string, timeout?: number): Promise<string>;
+    /** Write a file to the device. Only SSH can. */
+    upload?(path: string, content: string): Promise<void>;
+    /** A fresh login, which proves access survived: this session ends and a new SSH session opens, or the console logs out and in again. */
+    fresh(): Promise<Session>;
+    end(): void;
+};
 /** Refuse a device on a version this adapter does not render for, before anything is read or sent. */
-export declare function checkVersion(client: Client, device: Device): Promise<void>;
+export declare function checkVersion(session: Session, device: Device): Promise<void>;
 /**
  * What the device runs: its export, its users, and its certificates. Secrets are not part of an export.
  */
-export declare function read(device: Device): Promise<string>;
+export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
 export declare function unsupported(device: Device): string[];
 export declare function apply(device: Device, _network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
 /** Replace a list's entries in batches, so each command stays a sane length. */
 export declare function fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
 export declare const routeros: DeviceAdapter;
+export {};

package/dist/types/adapters/devices/types.d.ts

@@ -15,16 +15,22 @@ export type ApplyOptions = {
     secrets: boolean;
     /** Minutes before a platform that can restore itself does so, if the run does not prove access survived. */
     rollback: number;
+    /** Reach the device through its serial console, `connection.console`, instead of SSH to its management address. */
+    console?: boolean;
 };
+/** How a device is read. */
+export type ReadOptions = Pick<ApplyOptions, "console">;
 export type DeviceAdapter = {
     /** File extension of a saved snapshot, for syntax highlighting. */
     extension: string;
     /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
     unsupported(device: Device): string[];
+    /** The platform can be read and applied through a serial console, `--console`. */
+    console?: true;
     /** The whole configuration the device should run. Secrets appear as markers, never values. */
     render(device: Device): string;
     /** What the device runs now, secrets removed, in the form `render` produces where the platform allows. */
-    read(device: Device, network: readonly Device[]): Promise<string>;
+    read(device: Device, network: readonly Device[], options?: ReadOptions): Promise<string>;
     /** What it takes to go from `current` to `desired`. */
     plan(desired: string, current: string, options: ApplyOptions): Plan;
     /** Replace the contents of a prefix set fetched from a registry. Absent on a platform that cannot hold one. */

package/dist/types/adapters/devices/vrp/index.d.ts

@@ -1,7 +1,8 @@
 import type { Client, ClientChannel } from "ssh2";
 import type { Device } from "../../../schema";
+import { type ConsoleDialect } from "../../../transport/console";
 import { type Dialect } from "../lines";
-import type { DeviceAdapter, Plan } from "../types";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 export declare const dialect: Dialect;
 /** The ACL that guards every management service. */
 export declare const MANAGEMENT_ACL = 2000;
@@ -17,8 +18,10 @@ export declare function login(device: Device): Promise<Client>;
  * Every login asks whether to change the password. Answering yes replaces it at once and every stored credential with it, so the answer is always no. Anything sent before the question is answered is taken as the answer.
  */
 export declare function openShell(client: Client): Promise<ClientChannel>;
+/** How the console asks for a login: the same question to change the password, always answered no, and a system view left with `return`. Not yet proved on a device. */
+export declare const VRP_CONSOLE: ConsoleDialect;
 /** What the device runs, credentials scrubbed. */
-export declare function read(device: Device): Promise<string>;
+export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
 export declare function unsupported(device: Device): string[];
-export declare function apply(device: Device, _network: readonly Device[], plan: Plan): Promise<void>;
+export declare function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
 export declare const vrp: DeviceAdapter;

package/dist/types/schema/device.d.ts

@@ -1,4 +1,4 @@
-import type { IP } from "./common";
+import type { IP, Secret } from "./common";
 import type { AclRule, Firewall } from "./firewall";
 import type { Interface, Port, Vlan } from "./interfaces";
 import type { PrefixSet, RoutePolicy } from "./policy";
@@ -12,6 +12,30 @@ export type Connection<U extends string> = {
     user: U;
     /** SSH port. 22 when absent. */
     port?: number;
+    /** The device's serial console, for `--console`: the way in before the device has a management address, or when its management network is down. */
+    console?: Console;
+};
+/** A computer with SSH that holds the serial consoles of devices, such as a laptop beside the rack. It runs Python 3. */
+export type Jump = {
+    /** Its address or name. */
+    host: string;
+    /** The user Circuit logs in as. It must be allowed to open the serial ports. */
+    user: string;
+    /** The user's password. */
+    password: Secret;
+    /** SSH port. 22 when absent. */
+    port?: number;
+    /** The jump host is reached through a Cloudflare Tunnel, so Circuit connects with `cloudflared access ssh`, which must be installed. */
+    cloudflared?: true;
+};
+/** A serial console, on a jump host or on the computer Circuit runs on. */
+export type Console = {
+    /** The jump host the console cable is plugged into. When absent, the cable is plugged into the computer Circuit runs on. */
+    jump?: Jump;
+    /** The serial port: on Linux or macOS a path under `/dev`, where a path under `/dev/serial/by-path/` stays the same when two adapters swap names; on Windows a COM port, such as `COM3`. */
+    port: string;
+    /** Line speed in bits per second, such as 9600 or 115200. */
+    baud: number;
 };
 /** A separate routing table, with the interfaces that route in it. */
 export type Vrf = {

package/dist/types/transport/console.d.ts

@@ -0,0 +1,57 @@
+import { type ClientChannel } from "ssh2";
+import type { Console, Device } from "../schema";
+/** An open console: the stream to the device's CLI, and how to let it go. */
+export type ConsoleSession = {
+    channel: ClientChannel;
+    close: () => void;
+};
+/** Open a device's serial console, through its jump host or on this computer. Fails when another session holds the port. */
+export declare function openConsole(console: Console): Promise<ConsoleSession>;
+/** A device's console and its login, for `--console`. */
+export declare function consoleOf(device: Device): {
+    console: Console;
+    user: string;
+    password: string;
+};
+/** How a platform's console asks for a login and shows its prompt, and what moves it on from anywhere else. */
+export type ConsoleDialect = {
+    /** The login prompt. */
+    login: RegExp;
+    /** The password prompt. */
+    password: RegExp;
+    /** The CLI's prompt once logged in. */
+    prompt: RegExp;
+    /** What logs out from the prompt. */
+    logout: string;
+    /** Other places a console can be left, each with what moves it toward a login prompt: a pager, a config level, a question. Checked before the prompt. */
+    others?: readonly (readonly [RegExp, string])[];
+    /** The name typed at the login prompt, when the platform adds to it. */
+    user?: (user: string) => string;
+};
+/** The channel a console speaks on: an SSH stream from the relay, or anything shaped like one. */
+type Channel = Pick<ClientChannel, "write"> & {
+    on(event: "data", listener: (chunk: Buffer) => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer) => void): unknown;
+};
+/** Write, then wait until what the console printed since ends with one of the patterns. Returns which, and what was printed. */
+export declare function expect(channel: Channel, write: string, patterns: readonly RegExp[], timeout?: number): Promise<{
+    index: number;
+    text: string;
+}>;
+/**
+ * Log in on a console, whatever state the last session left it in: what `others` names is moved on, a session left open is logged out, so every session starts from a fresh login. Returns once the CLI's prompt shows.
+ */
+export declare function consoleLogin(channel: Channel, dialect: ConsoleDialect, user: string, password: string): Promise<void>;
+/** The text after a command's echo. A terminal wraps a long echo where it likes, so the echo is matched character by character, line breaks it added skipped. */
+export declare function afterEcho(text: string, command: string): string;
+/** A CLI on a console that runs one command at a time and returns what it printed, as an SSH exec would: no echo, no prompt. */
+export declare class ConsoleShell {
+    private readonly channel;
+    private readonly dialect;
+    constructor(channel: Channel, dialect: ConsoleDialect);
+    /** Run a command and wait for the prompt. A pager in `others` is answered as it shows. */
+    run(command: string, timeout?: number): Promise<string>;
+    /** Log out, so no session is left open on the console. */
+    logout(): void;
+}
+export {};

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.26.2",
+    "version": "0.28.0",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/adapters/devices/fortios/TRAPS.md

@@ -19,7 +19,7 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - Global `alias` is set again at every start, whatever was saved.
 - `log memory setting` prints its `status` whether on or off, and `unset status` turns memory logging on.
 - Two interfaces that are up cannot have overlapping subnets, `Subnets overlap between ...`, so an address moving from one to another must leave the first before it joins the second.
-- A static route identical to another is refused, `Duplicated entry`. An IPv4 route's destination is not printed when it is the default route; neither is IPv6's.
+- A static route identical to another is refused, `Duplicated entry`, even for a moment: editing route 1 into what route 2 holds fails before route 2 is changed. A plan deletes every route that changes or goes before it creates any. An IPv4 route's destination is not printed when it is the default route; neither is IPv6's.
 - A deny policy is given `logtraffic disable`, and its action is not printed, since deny is the default. `send-deny-packet` exists only while a policy denies: set before `action deny` or unset after `action accept`, it is `command parse error`. So the render writes `action deny` before `send-deny-packet`, and a plan removes the settings that go before it sets the ones that come: `send-deny-packet` is unset while the policy still denies, and set only once it does.
 - `show` prints `unset` in two places: an ICMP service's `unset icmptype`, and a prefix list rule's `unset ge` and `unset le` for a bound it does not have.
 - An SNMPv3 user authenticates with MD5 or SHA1 only, and has no list of sources: only a community has hosts. Circuit decides who reaches every service with local-in policies instead.
@@ -38,3 +38,4 @@ Behaviour that looks like something else. Each one has been hit on a FortiGate 3
 - There is no WireGuard and no RPKI, `command parse error`. A route map has no large community and a BGP neighbor no role: neither is among their settings. SNMPv3 offers no SHA256.
 - `execute backup config flash <comment>` keeps a revision on the device, and `execute restore config flash <id>` restores one.
 - The ports are `port1` to `port4` at 40G and `port5` to `port32` at 10G, then `mgmt1` and `mgmt2`. The factory dedicates both management ports to management and gives them addresses `192.168.1.99` and `192.168.2.99`.
+- On the serial console a line ends at a carriage return. A session left open stays logged in, and one left inside `config` stays there, so the next login must first leave and log out. The console takes 9600 bits per second: reading the sections Circuit manages takes about two minutes.

package/src/adapters/devices/fortios/index.ts

@@ -6,9 +6,10 @@ import type { Client } from "ssh2";
 import { familyOf, host, split } from "../../../core/addr";
 import { MARKER, resolve, valueOfReference } from "../../../core/secrets";
 import type { AclRule, Device, Family, FilterRule } from "../../../schema";
+import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
 import { connect, shell } from "../../../transport/ssh";
 import { portsOf, spell } from "../catalog";
-import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
 import { acceptsBeforeDrop, familiesOf, isImplied, serviceOf } from "./firewall";
 import { holderOf, interfaceFor, network, settingsOf, subnet } from "./names";
 import { clean, plan } from "./plan";
@@ -147,8 +148,47 @@ export async function login(device: Device): Promise<Client> {
     });
 }
 
-/** Log in, open the CLI, and run `work` in it. */
-async function session<T>(device: Device, work: (cli: Cli) => Promise<T>): Promise<T> {
+/** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
+export const FORTIOS_CONSOLE: ConsoleDialect = {
+    login: /login: $/,
+    password: /Password: $/,
+    prompt: /[#$] $/,
+    logout: "exit",
+    others: [
+        [BANNER, "a"],
+        [/--More-- $/, "q"],
+        [/\([^)\n]*\) [#$] $/, "end\n"],
+    ],
+};
+
+/** Log out of a console, so no session is left open on it. */
+async function consoleLogout(cli: Cli): Promise<void> {
+    await leave(cli).catch(() => undefined);
+    await cli.run("exit", 10_000).catch(() => undefined);
+}
+
+/** Log in on the console, open the CLI, and run `work` in it. `work` is also given a way to log in afresh on the same console. */
+async function consoleSession<T>(device: Device, work: (cli: Cli, relogin: () => Promise<void>) => Promise<T>): Promise<T> {
+    const { console, user, password } = consoleOf(device);
+    const opened = await openConsole(console);
+
+    try {
+        await consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+        const cli = new Cli(opened.channel);
+        const relogin = () => consoleLogin(opened.channel, FORTIOS_CONSOLE, user, password);
+
+        const result = await work(cli, relogin);
+        await consoleLogout(cli);
+        return result;
+    } finally {
+        opened.close();
+    }
+}
+
+/** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
+async function session<T>(device: Device, work: (cli: Cli) => Promise<T>, options: ReadOptions = {}): Promise<T> {
+    if (options.console) return consoleSession(device, (cli) => work(cli));
+
     const client = await login(device);
 
     try {
@@ -216,8 +256,8 @@ export async function readConfig(cli: Cli, device: Device): Promise<string> {
     return scrub(clean(text));
 }
 
-export function read(device: Device): Promise<string> {
-    return session(device, (cli) => readConfig(cli, device));
+export function read(device: Device, _network: readonly Device[] = [], options: ReadOptions = {}): Promise<string> {
+    return session(device, (cli) => readConfig(cli, device), options);
 }
 
 /**
@@ -317,15 +357,19 @@ const RELOAD = { attempts: 20, interval: 15_000 } as const;
 /**
  * Once the device is back from a reload, set it to save changes on its own again: the saved configuration still says to revert. Setting it saves what runs, so it is set only once the device says nothing is left to reload; until then the reload is asked for again.
  */
-async function settle(device: Device): Promise<string> {
+async function settle(device: Device, options: ReadOptions): Promise<string> {
     for (let attempt = 0; attempt < RELOAD.attempts; attempt++) {
         await new Promise((done) => setTimeout(done, RELOAD.interval));
 
-        const settled = await session(device, async (cli) => {
-            if (!/no config to be reloaded/.test(await cli.run("execute cfg reload"))) return false;
-            await saving(cli, "automatic");
-            return true;
-        }).catch(() => false);
+        const settled = await session(
+            device,
+            async (cli) => {
+                if (!/no config to be reloaded/.test(await cli.run("execute cfg reload"))) return false;
+                await saving(cli, "automatic");
+                return true;
+            },
+            options
+        ).catch(() => false);
         if (settled) return "the device is back and saves changes on its own again";
     }
 
@@ -333,12 +377,23 @@ async function settle(device: Device): Promise<string> {
 }
 
 export async function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void> {
+    const seconds = options.rollback * 60;
+
     try {
+        // Through the console, a fresh login on the same console proves the change left the device's logins working; over SSH, a fresh SSH session proves the management path too.
+        if (options.console) {
+            await consoleSession(device, async (cli, relogin) => {
+                await checkVersion(cli, device);
+                await configure(cli, plan, { seconds, prove: relogin });
+            });
+            return;
+        }
+
         await session(device, async (cli) => {
             await checkVersion(cli, device);
 
             await configure(cli, plan, {
-                seconds: options.rollback * 60,
+                seconds,
                 prove: async () => {
                     const proof = await login(device);
                     proof.end();
@@ -347,7 +402,7 @@ export async function apply(device: Device, _network: readonly Device[], plan: P
         });
     } catch (error) {
         if (!(error instanceof Reloaded)) throw error;
-        throw new Error(`${error.message}\n    ${await settle(device)}`);
+        throw new Error(`${error.message}\n    ${await settle(device, options)}`);
     }
 }
 
@@ -791,6 +846,7 @@ function serviceGaps(device: Device): string[] {
 
 export const fortios: DeviceAdapter = {
     extension: ".conf",
+    console: true,
     unsupported,
     render,
     read,

package/src/adapters/devices/fortios/plan.ts

@@ -18,6 +18,8 @@ type Table = {
     created?: (entry: Block) => readonly string[];
     /** Settings an entry keeps for life. A change deletes the entry and creates it again. */
     fixed?: readonly string[];
+    /** The device refuses an entry that holds the same as another, `Duplicated entry`, even for a moment while entries are renumbered. */
+    distinct?: true;
 };
 
 /** Objects every FortiGate running 6.2 is shipped with, which policies and profiles of the factory name. */
@@ -168,6 +170,8 @@ export const TABLES: Record<string, Table> = {
     "firewall local-in-policy": ORDERED,
     "firewall local-in-policy6": ORDERED,
     "firewall central-snat-map": ORDERED,
+    "router static": { distinct: true },
+    "router static6": { distinct: true },
 };
 
 /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
@@ -346,7 +350,11 @@ function compare(path: string[], want: Block, have: Block, table: Table | undefi
 
     for (const [header, child] of want.blocks) nested(header, child, have.blocks.get(header) ?? new Block());
 
-    const entries = table?.byContent ? byContent(path, want, have) : byId(path, want, have, table, context);
+    const entries = table?.byContent
+        ? byContent(path, want, have)
+        : table?.distinct
+          ? distinctById(path, want, have, table, context)
+          : byId(path, want, have, table, context);
     send.push(...entries.send);
     show.push(...entries.show);
 
@@ -410,6 +418,37 @@ function byId(path: string[], want: Block, have: Block, table: Table | undefined
     return { send, show, removals, removed };
 }
 
+/** Entries matched by name in a table that refuses two alike: every entry that changes or goes is deleted before any is created, so none is ever briefly the same as another. */
+function distinctById(path: string[], want: Block, have: Block, table: Table, context: Context): Diff {
+    const deletes: string[] = [];
+    const creates: string[] = [];
+    const show: string[] = [];
+
+    for (const [key, entry] of want.entries) {
+        const old = have.entries.get(key);
+        const where = [...path, bare(entry.id)];
+
+        if (old) {
+            if (!compare(where, entry.block, old.block, undefined, false, context).send.length) continue;
+
+            deletes.push(`delete ${old.id}`);
+            show.push(...shown("-", where, old.block));
+        }
+
+        creates.push(...creation(entry, table));
+        show.push(...shown("+", where, entry.block));
+    }
+
+    for (const [key, entry] of have.entries) {
+        if (want.entries.has(key) || isFactory(table, entry)) continue;
+
+        deletes.push(`delete ${entry.id}`);
+        show.push(...shown("-", [...path, bare(entry.id)], entry.block));
+    }
+
+    return { send: [...deletes, ...creates], show, removals: [], removed: [] };
+}
+
 /** The `move` commands that put a table's entries in the render's order. Kept entries hold their place on the device and new ones are added at the end. */
 function moves(want: Block, have: Block): string[] {
     const wanted = [...want.entries.keys()];

package/src/adapters/devices/junos/index.ts

@@ -6,9 +6,10 @@ import type { Client, ClientChannel } from "ssh2";
 import { familyOf, host, isAddress, split } from "../../../core/addr";
 import { resolve, substitute } from "../../../core/secrets";
 import type { Device, Family } from "../../../schema";
+import { type ConsoleDialect, consoleLogin, consoleOf, openConsole } from "../../../transport/console";
 import { connect, exec, readUntil, shell } from "../../../transport/ssh";
 import { lagIds } from "../derive";
-import type { ApplyOptions, DeviceAdapter, Plan, Step } from "../types";
+import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions, Step } from "../types";
 import { GENERATED, settingsOf } from "./bgp";
 import { KEY_STATEMENT, Names, render, stormProfile, vrrpAddress } from "./render";
 
@@ -303,8 +304,8 @@ export async function login(device: Device): Promise<Client> {
 }
 
 /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
-async function checkVersion(client: Client, device: Device): Promise<void> {
-    const version = await exec(client, "show version | match Junos:");
+async function checkVersion(ask: (command: string) => Promise<string>, device: Device): Promise<void> {
+    const version = await ask("show version | match Junos:");
     const release = /Junos: (\d+)\.(\S+)/.exec(version);
 
     if (!release) throw new Error(`${device.name} did not say which Junos it runs: ${version.slice(0, 200)}`);
@@ -313,11 +314,21 @@ async function checkVersion(client: Client, device: Device): Promise<void> {
     }
 }
 
-export async function read(device: Device): Promise<string> {
+export async function read(device: Device, _network: readonly Device[] = [], options: ReadOptions = {}): Promise<string> {
+    if (options.console) {
+        return onConsole(device, async (channel) => {
+            await checkVersion((command) => run(channel, command), device);
+            const output = await run(channel, "show configuration | display set | no-more", 180_000);
+            if (!/^set /m.test(output)) throw new Error(`${device.name} returned no configuration`);
+
+            return clean(output);
+        });
+    }
+
     const client = await login(device);
 
     try {
-        await checkVersion(client, device);
+        await checkVersion((command) => exec(client, command), device);
         const output = await exec(client, "show configuration | display set | no-more", 180_000);
         if (!/^set /m.test(output)) throw new Error(`${device.name} returned no configuration`);
 
@@ -347,6 +358,38 @@ async function edit(channel: ClientChannel, line: string, timeout = 60_000): Pro
     return output.replace(/\r/g, "");
 }
 
+/** How the console asks for a login. Root lands in a shell, `%`, every other user in the CLI, `>`; a session left in configuration mode, `#`, leaves it first. Not yet proved on a device. */
+export const JUNOS_CONSOLE: ConsoleDialect = {
+    login: /login: $/,
+    password: /Password:\s*$/,
+    prompt: /[>%] $/,
+    logout: "exit",
+    others: [[/# $/, "exit configuration-mode\n"]],
+};
+
+/** Log in on the console, open the CLI, and run `work` in it with a way to log in afresh. Logs out after. */
+async function onConsole<T>(device: Device, work: (channel: ClientChannel, relogin: () => Promise<void>) => Promise<T>): Promise<T> {
+    const { console, user, password } = consoleOf(device);
+    const opened = await openConsole(console);
+
+    // The CLI is opened on a prompt asked for after the login, since the login's own prompt is already read.
+    const login = async () => {
+        await consoleLogin(opened.channel, JUNOS_CONSOLE, user, password);
+        const ready = openCli(opened.channel);
+        opened.channel.write("\n");
+        await ready;
+    };
+
+    try {
+        await login();
+        const result = await work(opened.channel, login);
+        opened.channel.write(`${JUNOS_CONSOLE.logout}\n`);
+        return result;
+    } finally {
+        opened.close();
+    }
+}
+
 /** An interactive CLI with paging off. Root lands in a shell and starts the CLI from there. */
 export async function openCli(channel: ClientChannel): Promise<void> {
     const banner = await readUntil(channel, (text) => PROMPT.test(text.replace(/\r/g, "")), 20_000, 500);
@@ -470,10 +513,27 @@ export async function configure(channel: ClientChannel, plan: Plan, guard?: Guar
 }
 
 export async function apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void> {
+    if (options.console) {
+        await onConsole(device, async (channel, relogin) => {
+            await checkVersion((command) => run(channel, command), device);
+
+            // A fresh login on the console ends the session that holds the candidate, so the proof logs in again and takes the candidate back to confirm the commit.
+            await configure(channel, plan, {
+                minutes: options.rollback,
+                prove: async () => {
+                    await run(channel, "exit configuration-mode");
+                    await relogin();
+                    await run(channel, "configure exclusive");
+                },
+            });
+        });
+        return;
+    }
+
     const client = await login(device);
 
     try {
-        await checkVersion(client, device);
+        await checkVersion((command) => exec(client, command), device);
 
         const channel = await shell(client);
         await openCli(channel);
@@ -760,7 +820,7 @@ export async function fill(device: Device, _network: readonly Device[], set: str
     const client = await login(device);
 
     try {
-        await checkVersion(client, device);
+        await checkVersion((command) => exec(client, command), device);
 
         const channel = await shell(client);
         await openCli(channel);
@@ -775,6 +835,7 @@ export async function fill(device: Device, _network: readonly Device[], set: str
 
 export const junos: DeviceAdapter = {
     extension: ".conf",
+    console: true,
     unsupported,
     render,
     read,