@takodotid/circuit 0.34.2 → 0.35.0

package/dist/types/helpers/route-server.d.ts

@@ -0,0 +1,52 @@
+import type { Family, IPv4, IPv6, Prefix } from "../schema";
+import type { ExchangeMember } from "./exchange";
+/** A route server on an exchange's peering LAN: a server running BIRD 2 or OpenBGPD that passes every member's routes to every other member. */
+export type RouteServer = {
+    /** Its name, such as `rs1`, written at the top of its config. */
+    name: string;
+    /** Its own AS. Members peer with it, but it never adds itself to a path, so members see each other's paths as they were sent. */
+    asn: number;
+    /** Its BGP router ID, an IPv4 address of the server. Its address on the peering LAN is the usual pick. */
+    router_id: IPv4;
+    /** Its IPv4 address on the peering LAN. Every member with an IPv4 address gets an IPv4 session from it. */
+    ipv4?: IPv4;
+    /** Its IPv6 address on the peering LAN. Every member with an IPv6 address gets an IPv6 session from it. */
+    ipv6?: IPv6;
+};
+/** A route server's config, written from an exchange's member list. Circuit writes the file; it never logs in to the server. */
+export declare class RouteServerConfig {
+    /** The shortest and longest prefix a member may send, by family. */
+    static readonly LENGTHS: Readonly<Record<Family, {
+        shortest: number;
+        longest: number;
+    }>>;
+    /** The rules a route must pass, the same in every config. */
+    private static readonly RULES;
+    /**
+     * The BIRD 2 config of one route server: one session per member and family, each passing on only the routes the member may send.
+     *
+     * Throws when the server has no address on the peering LAN, has one outside it, or two members would get sessions of one name.
+     */
+    static bird(server: RouteServer, lan: {
+        ipv4?: Prefix;
+        ipv6?: Prefix;
+    }, members: readonly ExchangeMember[]): string;
+    /**
+     * The OpenBGPD config (`bgpd.conf`) of one route server: one session per member and family, in one group per family, and filter rules that pass on only the routes each member may send.
+     *
+     * Throws when the server has no address on the peering LAN, or has one outside it.
+     */
+    static openbgpd(server: RouteServer, lan: {
+        ipv4?: Prefix;
+        ipv6?: Prefix;
+    }, members: readonly ExchangeMember[]): string;
+    /** The families the server has an address in, each checked to be inside the peering LAN. */
+    private static families;
+    /** A BIRD symbol: letters, digits and underscores, starting with a letter. */
+    private static protocolName;
+    /** A member's name and AS, safe inside double quotes. */
+    private static description;
+    private static birdSession;
+    /** One family's sessions: a group holding every member with an address in that family. */
+    private static openbgpdGroup;
+}

package/dist/types/index.d.ts

@@ -1,6 +1,8 @@
 export { defineDevice, defineNetwork, secret, secretFile } from "./core/define";
-export { merge } from "./core/merge";
-export type { Check, Community, Finding, Network } from "./core/define";
+export { Utils } from "./core/utils";
+export type { Check, Community, Finding, NetBoxDevice, Network } from "./core/define";
 export type * from "./schema";
 /** Address helpers, for checks of your own. */
-export { contains, familyOf, host, isAddress, isCidr, isGlobal, network as prefixOf } from "./core/addr";
+export { Address } from "./core/address";
+/** Secrets, for tools of your own: a secret's value, text with every secret hidden, and how Circuit logs in to a device. */
+export { Secrets } from "./core/secrets";

package/dist/types/integrations/librenms.d.ts

@@ -0,0 +1,60 @@
+import type { Network } from "../core/define";
+import type { Device } from "../schema";
+/** A device LibreNMS monitors whose settings differ from its config. */
+export type LibreNmsChange = {
+    device: Device;
+    /** LibreNMS's id for it. */
+    id: number;
+    /** What differs, in words: `name`, `SNMP credentials` or `location`. Never a secret's value. */
+    what: string[];
+    /** What is sent: LibreNMS's field names and their values. */
+    fields: Record<string, string>;
+};
+/** A device group for one site, to make or whose devices change. */
+export type LibreNmsGroup = {
+    /** The site's name, which is the group's. */
+    name: string;
+    /** LibreNMS has no group of this name yet. */
+    create: boolean;
+    /** Devices at the site that are not in the group. */
+    add: Device[];
+    /** Devices in the group that the config puts at another site. */
+    remove: Device[];
+};
+/** What `librenms` would do. */
+export type LibreNmsPlan = {
+    /** Devices to add. */
+    additions: Device[];
+    /** Devices to change. */
+    changes: LibreNmsChange[];
+    /** Site groups to make or change. Empty when the network has no `site`. */
+    groups: LibreNmsGroup[];
+    /** Devices that cannot be added: their config turns SNMP off. */
+    withoutSnmp: Device[];
+    /** Hostnames LibreNMS holds that no device in the config has. */
+    unknown: string[];
+    /** Site groups LibreNMS holds as dynamic groups, which Circuit cannot fill, so leaves alone. */
+    dynamicGroups: string[];
+    /** LibreNMS's id for each device it monitors, by hostname. */
+    ids: ReadonlyMap<string, number>;
+};
+export declare class LibreNms {
+    /** LibreNMS's names for the algorithms. */
+    private static readonly AUTH;
+    private static readonly PRIVACY;
+    /** Compare the config with what LibreNMS monitors. A device is known to LibreNMS by its management address. */
+    static plan(network: Network): Promise<LibreNmsPlan>;
+    /** How many changes a plan holds. */
+    static count(plan: LibreNmsPlan): number;
+    /** Add each device, change each that differs, then make and fill the site groups. */
+    static send(network: Network, plan: LibreNmsPlan): Promise<void>;
+    /** What differs between a device's config and LibreNMS's record of it: its name, SNMP credentials and location. */
+    private static changeOf;
+    /** A static group for each site, with the devices at it. Only groups named after a site are read or changed. */
+    private static groupsOf;
+    private static settingsOf;
+    /** One request. LibreNMS answers a list with nothing in it with 404, so `emptyOn404` reads that as an empty answer. */
+    private static call;
+    /** How LibreNMS polls a device: its first SNMP version 3 user, or else its version 2c community. */
+    private static credentials;
+}

package/dist/types/integrations/netbox.d.ts

@@ -0,0 +1,89 @@
+import type { Network } from "../core/define";
+/** Each kind of object Circuit writes, in the order they are made: each refers only to kinds before it, or waits for the next pass. */
+export type NetBoxKind = "tag" | "site" | "manufacturer" | "platform" | "device-type" | "role" | "vrf" | "vlan" | "device" | "interface" | "prefix" | "ip-range" | "ip" | "cable";
+/** One object to make, change or delete. */
+export type NetBoxChange = {
+    kind: NetBoxKind;
+    /** Where NetBox keeps it, such as `dcim/devices`. */
+    path: string;
+    /** How Circuit knows it, built from its own fields, such as `edge-01/sfp28-1` for an interface. */
+    key: string;
+    /** What is sent. References to other objects are filled in with their ids when sent. */
+    fields: Record<string, unknown>;
+    /** NetBox's id, for an object that exists. */
+    id?: number;
+    /** For a change, each field that differs, as `field: before to after`. */
+    diff: string[];
+};
+/** What `circuit netbox` would do. */
+export type NetBoxPlan = {
+    creates: NetBoxChange[];
+    updates: NetBoxChange[];
+    deletes: NetBoxChange[];
+    /** Objects NetBox holds without the tag that Circuit would otherwise make or change. Circuit refers to them and leaves them as they are. */
+    leftAlone: string[];
+};
+export declare class NetBox {
+    private readonly network;
+    /** The tag on everything Circuit makes. */
+    static readonly TAG = "circuit";
+    /** How many rounds `send` takes at most: a field that refers to an object made in the same round, such as a device's primary address, is set in the next. */
+    private static readonly PASSES;
+    /** Where each kind is kept, and how an object NetBox answers with is known by its key. */
+    private static readonly KINDS;
+    private static readonly ORDER;
+    /** Fields sent when an object is made and never compared after: its tags, which people may add to, and a cable's ends, which its key already holds. */
+    private static readonly CREATE_ONLY;
+    /** Fields that hold an address, compared in one spelling. */
+    private static readonly ADDRESS_FIELDS;
+    /** Who makes the hardware each platform runs on: the config names the platform, not the vendor. */
+    private static readonly VENDORS;
+    /** NetBox's type for a port, by the speed class in Circuit's port name. */
+    private static readonly PORT_TYPES;
+    /** NetBox's type for every interface that is not a port. */
+    private static readonly INTERFACE_TYPES;
+    /** A port's fixed speed in kbit/s, as NetBox counts it. */
+    private static readonly SPEEDS;
+    private readonly base;
+    private readonly headers;
+    /** Every object the config asks for, by kind and key. */
+    private readonly wanted;
+    /** NetBox's id for each object it holds, by kind and key. */
+    private readonly ids;
+    constructor(network: Network);
+    /** Compare the config with what NetBox holds. Reads NetBox only. */
+    plan(): Promise<NetBoxPlan>;
+    /** Send the plan, then plan again and send what is left, until NetBox matches or `PASSES` rounds are done. Returns what is left. */
+    send(plan: NetBoxPlan): Promise<NetBoxPlan>;
+    /** How many changes a plan holds. */
+    static count(plan: NetBoxPlan): number;
+    private apply;
+    /** Declare an object. The first declaration of a key wins; a later one only fills fields still empty. */
+    private want;
+    /** A device, its place, VLANs, VRFs, ports, interfaces, addresses and cables. */
+    private wantDevice;
+    /** A prefix for each subnet an interface is on, and a container for each prefix the network originates in BGP. */
+    private wantPrefixes;
+    /** Addresses Circuit knows that sit on no interface of ours, as `circuit addresses` lists them: peers, next hops, reservations, VRRP, and DHCP pools as ranges. */
+    private wantUnassigned;
+    /** A value with every reference replaced by its id, or by `<kind key>` while the object does not exist. */
+    private resolve;
+    /** The fields NetBox can take now. A reference to an object not made yet waits for the next round. */
+    private sendable;
+    private call;
+    /** Every object of a kind, page by page. */
+    private list;
+    /** NetBox's answer in the shape Circuit sends: a nested object as its id, a choice as its value, a cable end as its type and id, an address in one spelling. */
+    private static normalize;
+    private static isTagged;
+    /** A port's name on the device, such as `sfp28-1` for `25g-1`, as NetBox shows it. An interface keeps its name from the config. */
+    private static interfaceName;
+    private static prefixKey;
+    /** ` on <device>/<interface>` for an address on an interface, or nothing. */
+    private static assignedTo;
+    /** One end of a cable, as `<device>/<interface>`, or by its type and id when it is not an interface. */
+    private static endOf;
+    private static idKey;
+    /** A name as NetBox's slugs write it: `Core switch` to `core-switch`. */
+    private static slug;
+}

package/dist/types/integrations/peeringdb.d.ts

@@ -0,0 +1,24 @@
+import type { Network } from "../core/define";
+/** A change to send. `id` is set when the record exists and is updated in place. */
+export type PeeringDbChange = {
+    summary: string;
+    id?: number;
+    body: Record<string, unknown>;
+};
+export type PeeringDbPlan = {
+    changes: PeeringDbChange[];
+    /** Records PeeringDB holds that the config does not. */
+    unknown: string[];
+};
+export declare class PeeringDb {
+    private static readonly API;
+    /** What would change at PeeringDB. Reads the public API; needs no key. */
+    static plan(network: Network): Promise<PeeringDbPlan>;
+    /** Send the changes, with the network's API key. */
+    static send(network: Network, changes: PeeringDbChange[]): Promise<void>;
+    private static addressesOf;
+    /** Whether the device peers with a route server on this interface's subnets. */
+    private static peersWithRouteServer;
+    /** Every exchange presence the config declares with a PeeringDB exchange LAN. */
+    private static wanted;
+}

package/dist/types/integrations/prometheus.d.ts

@@ -0,0 +1,24 @@
+import type { Network } from "../core/define";
+import type { Device } from "../schema";
+export type PrometheusTarget = {
+    targets: string[];
+    labels: Record<string, string>;
+};
+export declare class Prometheus {
+    /** snmp_exporter's names for the algorithms. */
+    private static readonly AUTH;
+    private static readonly PRIVACY;
+    private static readonly AUTHS_HEADER;
+    /** The targets, and the devices left out because their config turns SNMP off. */
+    static targets(network: Network): {
+        targets: PrometheusTarget[];
+        withoutSnmp: Device[];
+    };
+    /** The `auths` section, as YAML, and what the operator must still fill in by hand. */
+    static snmpExporterAuths(network: Network): {
+        yaml: string;
+        notes: string[];
+    };
+    /** A password as snmp_exporter reads it from its environment, or a note when the secret is a file, which it cannot read. */
+    private static fromEnvironment;
+}

package/dist/types/integrations/registries.d.ts

@@ -0,0 +1,8 @@
+import type { Family } from "../schema";
+import type { Registry } from "../schema/policy";
+export declare class Registries {
+    /** The prefixes of one family a registry gives for a query. */
+    static prefixes(name: Registry, query: string, family: Family): Promise<string[]>;
+    /** Prefixes an origin AS announces, from RIPEstat. */
+    private static ripeStat;
+}

package/dist/types/platforms/bgp-wait.d.ts

@@ -0,0 +1,18 @@
+import type { BgpSession } from "./platform";
+/** How long to wait, and how often to read again, both in seconds. */
+export type WaitLimits = {
+    seconds: number;
+    every: number;
+};
+export declare class BgpWait {
+    /** `circuit bgp --wait` reads the sessions again every 15 seconds, for at most 600 seconds unless `--max` says otherwise. */
+    static readonly COMMAND: WaitLimits;
+    /**
+     * After an apply, the sessions established before have 180 seconds to be established again, read every 10 seconds. A session reset by a change opens again when one side retries; three minutes leaves room for a slow peer without holding the apply up for long. A session that never went down is seen at the first read, so a healthy apply does not wait.
+     */
+    static readonly AFTER_APPLY: WaitLimits;
+    /** Read the sessions until `enough` holds or time runs out, and give the last read. `waiting` is told of each read that fell short, before the pause. */
+    static until(read: () => Promise<BgpSession[]>, enough: (sessions: BgpSession[]) => boolean, limits: WaitLimits, waiting?: (sessions: BgpSession[]) => void): Promise<BgpSession[]>;
+    /** How many of these sessions are established. */
+    static upCount(sessions: readonly BgpSession[]): number;
+}

package/dist/types/platforms/catalog.d.ts

@@ -0,0 +1,109 @@
+/** What a model's hardware holds, where a real device held less than its datasheet lists. `validate` checks a config against it. */
+export type ModelLimits = {
+    /** The most member ports one LAG may have. More is an error. */
+    lag_members?: number;
+    /** About how many switch rules the switch chip held. More is a warning: a rule the chip cannot hold is invalid, and so is every rule after it, without a log line. */
+    switch_rules?: number;
+    /** How many distinct port ranges the switch rules held. More is a warning, for the same reason. */
+    switch_port_ranges?: number;
+};
+/** One hardware model: its ports per speed class, how the platform spells a port, and what its hardware holds. */
+export type ModelSpec = {
+    ports: Readonly<Record<string, number>>;
+    spelling: Readonly<Record<string, string>>;
+    limits?: ModelLimits;
+};
+export declare class Catalog {
+    static readonly MODELS: {
+        readonly routeros: {
+            readonly "CCR2216-1G-12XS-2XQ": {
+                readonly ports: {
+                    readonly "100g": 2;
+                    readonly "25g": 12;
+                    readonly "1g": 1;
+                };
+                readonly spelling: {
+                    readonly "100g": "qsfp28-{n}-1";
+                    readonly "25g": "sfp28-{n}";
+                    readonly "1g": "ether{n}";
+                };
+                readonly limits: {
+                    readonly lag_members: 8;
+                    readonly switch_port_ranges: 5;
+                };
+            };
+        };
+        readonly vrp: {
+            readonly "CE6855-48S6Q-HI": {
+                readonly ports: {
+                    readonly "10g": 48;
+                    readonly "40g": 6;
+                };
+                readonly spelling: {
+                    readonly "10g": "10GE1/0/{n}";
+                    readonly "40g": "40GE1/0/{n}";
+                };
+            };
+        };
+        readonly "raisecom-ros": {
+            readonly "RAX721-C-6C48": {
+                readonly ports: {
+                    readonly "100g": 6;
+                    readonly "25g": 24;
+                    readonly "10g": 24;
+                };
+                readonly spelling: {
+                    readonly "100g": "hundredgige 1/1/{n}";
+                    readonly "25g": "twenty-fivegige 1/2/{n}";
+                    readonly "10g": "tengigabitethernet 1/3/{n}";
+                };
+            };
+        };
+        readonly junos: {
+            readonly "QFX5100-48S-6Q": {
+                readonly ports: {
+                    readonly "40g": 6;
+                    readonly "10g": 48;
+                    readonly "1g": 2;
+                };
+                readonly spelling: {
+                    readonly "40g": "et-0/0/{n+47}";
+                    readonly "10g": "xe-0/0/{n-1}";
+                    readonly "1g": "em{n-1}";
+                };
+            };
+        };
+        readonly fortios: {
+            readonly "FG-3700D": {
+                readonly ports: {
+                    readonly "40g": 4;
+                    readonly "10g": 28;
+                    readonly "1g": 2;
+                };
+                readonly spelling: {
+                    readonly "40g": "port{n}";
+                    readonly "10g": "port{n+4}";
+                    readonly "1g": "mgmt{n}";
+                };
+            };
+        };
+    };
+    /** Every port a model has, in order. */
+    static ports(platform: string, model: string): string[];
+    /** What the model's hardware holds. Empty for a model with no known limits, or a model the catalog does not have. */
+    static limits(platform: string, model: string): ModelLimits;
+    /** The platform's own name for a port. */
+    static spell(platform: string, model: string, port: string): string;
+}
+export type Models = typeof Catalog.MODELS;
+export type PlatformName = keyof Models;
+export type ModelName<Pl extends PlatformName> = keyof Models[Pl] & string;
+type Upto<N extends number, A extends unknown[] = [], R = never> = A["length"] extends N ? R : Upto<N, [...A, 0], R | `${[...A, 0]["length"]}`>;
+type PortsOf<Pl extends PlatformName, M extends ModelName<Pl>> = Models[Pl][M] extends {
+    ports: infer P;
+} ? P : never;
+/** `10g-1` to `10g-48` on a model with 48 10G ports. */
+export type PortName<Pl extends PlatformName, M extends ModelName<Pl>> = {
+    [S in keyof PortsOf<Pl, M>]: `${S & string}-${Upto<PortsOf<Pl, M>[S] & number>}`;
+}[keyof PortsOf<Pl, M>];
+export {};

package/dist/types/platforms/derive.d.ts

@@ -0,0 +1,17 @@
+import type { Device } from "../schema";
+/** A feature a platform renders once proved on one of its devices. */
+export type ProvedFeature = "bfd-timers" | "static-route-bfd" | "multihop-bfd" | "alarm-severity" | "mac-limit" | "ethertype-filter";
+export declare class Derive {
+    /** Each LAG's number: its own `id`, or its position among the device's LAGs. */
+    static lagIds(device: Device): Map<string, number>;
+    /** The IPv4 networks of a port's or an interface's addresses. */
+    static ipv4Networks(device: Device, iface: string): string[];
+    /** Fields a platform renders only once they are proved on one of its devices. */
+    private static readonly UNPROVED_PORT_FIELDS;
+    /** Fields a platform refuses until it has proved them on a device. A platform names the ones it has proved, and the rest are refused. */
+    static unproved(device: Device, proved?: readonly ProvedFeature[]): string[];
+    /** Services the switch platforms run. Each takes its sources from `management.allow`, on the protocol's own port. */
+    private static readonly SWITCH_SERVICES;
+    /** Fields neither switch platform, VRP nor Raisecom ROS, expresses: a service's own sources or port, a user's description or keys, the IP stack's host settings, a point-to-point address, and offload per interface. `ownSources` names the services a platform gives their own sources. */
+    static switchUnsupported(device: Device, ownSources?: readonly ("ssh" | "telnet" | "snmp")[]): string[];
+}

package/dist/types/platforms/fortios/firewall.d.ts

@@ -0,0 +1,45 @@
+import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../schema";
+import { FortiOsBlock } from "./tree";
+export declare class FortiOsFirewall {
+    /** IP protocol numbers, for a protocol the platform names only by number. */
+    static readonly PROTOCOL_NUMBER: Record<Protocol, number>;
+    /** The device's own services, by the config's name, with the protocol and port each listens on unless the config moves it. */
+    private static readonly SERVICES;
+    /** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
+    static readonly ALL_IN_TRANSPARENT = "circuit-all";
+    /** NAT rules of both directions, which central NAT needs turned on. */
+    static natRules(device: Device): NatRule<string, string>[];
+    /** Which families a rule applies to: its own, its addresses', or both. */
+    static familiesOf(device: Device, match: FilterMatch<string, string> | undefined): Family[];
+    /** A port or ports as the platform writes them in a service: `22`, `1000-2000`. */
+    static portList(ports: Ports | undefined): string[];
+    /** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
+    static serviceOf(match: FilterMatch<string, string> | undefined, family: Family): {
+        name: string;
+        block?: FortiOsBlock;
+    };
+    /** A rule the platform keeps without being told: replies to a session it let through, and packets that belong to one, pass on their own. */
+    static isImplied(rule: FilterRule<string, string>): boolean;
+    /** Packet filtering, who reaches the device, NAT and stateless ACLs. */
+    static render(root: FortiOsBlock, device: Device): void;
+    /**
+     * Who reaches the device's own services: each service with sources to allow accepts them and refuses everyone else, ahead of the input chain. Services sharing their sources share the policies, named after `management.allow` or the service.
+     */
+    private static management;
+    /** The interface a rule names on one side, or `any`, quoted. */
+    private static interfaceOf;
+    /** A policy for traffic through the device. A rejection answers the sender; the platform's deny is silent otherwise. */
+    private static policy;
+    /** A local-in policy, for traffic to the device itself. */
+    private static localIn;
+    /** Source NAT: to the outgoing interface's address, or to a pool of one address. */
+    private static sourceNat;
+    /** Destination NAT, as a virtual IP: the address it answers on, and the port it forwards when the rule names one. */
+    private static destinationNat;
+    /**
+     * A port's ACL as the platform's stateless ACLs, which only drop: each rule that drops becomes one, of each family it applies to. What no rule drops passes, so the rules that accept after the last drop are already there; `unsupported()` refuses one before a drop.
+     */
+    private static acls;
+    /** Whether a port's ACL drops before it accepts: an accept before a drop is an exception the platform's ACLs cannot hold. */
+    static acceptsBeforeDrop(rules: readonly AclRule<string>[]): boolean;
+}

package/dist/types/platforms/fortios/index.d.ts

@@ -0,0 +1,134 @@
+import type { Neighbor } from "../../core/cabling";
+import type { Device, Family } from "../../schema";
+import { type ConsoleDialect } from "../../transport/console";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+/** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
+export type Channel = {
+    write(data: string): unknown;
+    on(event: "data", listener: (chunk: Buffer) => void): unknown;
+    on(event: "close", listener: () => void): unknown;
+    removeListener(event: "data", listener: (chunk: Buffer) => void): unknown;
+    removeListener(event: "close", listener: () => void): unknown;
+};
+/** How a change that could cut access is guarded: the device reloads its saved configuration after `seconds` unless `prove` shows access survived. */
+export type Guard = {
+    seconds: number;
+    prove: () => Promise<void>;
+};
+/** A CLI over a channel: one line at a time, and what the device printed until its prompt came back. */
+export declare class FortiOsCli {
+    private readonly channel;
+    private readonly newline;
+    /** The prompt at the end of what the device printed, `host # ` or `host (context) # `, or a question it waits on. */
+    private static readonly PROMPT;
+    static readonly QUESTION: RegExp;
+    /** The pre-login banner, which waits for the reader to accept it. */
+    static readonly BANNER: RegExp;
+    /** The device ended the session and asks for a login again. */
+    private static readonly LOGGED_OUT;
+    /** The pager the device stops at, and how it erases itself once answered. */
+    private static readonly PAGER;
+    /** The prompt that ended the last answer, which shows where the session is: `(port1)` inside an entry. */
+    prompt: string;
+    constructor(channel: Channel, newline?: string);
+    /** Wait for the prompt, after logging in. */
+    ready(timeout?: number): Promise<void>;
+    /** Send one line and return what the device printed after it, without the echo or the prompt. */
+    run(line: string, timeout?: number): Promise<string>;
+    /** Answer a question the device asked. */
+    answer(reply: "y" | "n", timeout?: number): Promise<string>;
+    /** What the device prints until its prompt or a question. A session the device ended, or that went silent, fails. */
+    private collect;
+}
+export declare class FortiOs extends Platform {
+    /** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
+    static readonly CONSOLE: ConsoleDialect;
+    /** The release this adapter renders for, and was proved on. */
+    private static readonly SUPPORTED;
+    /** The longest name the platform takes for an interface, and for an address or service. */
+    private static readonly NAME_LENGTH;
+    /** Names the platform keeps for interfaces of its own. */
+    private static readonly RESERVED_INTERFACES;
+    /** What the device prints when it refuses a line. */
+    private static readonly REFUSED;
+    /** How long a device may take to come back from a reload of its configuration, and how often to try it. */
+    private static readonly RELOAD;
+    /** Commands that only read: `show`, `get`, a set of `diagnose` and `execute` commands. `diagnose sys session filter` sets only this session's filter; `diagnose sys session clear`, which ends sessions, is not here. `diagnose lldprx` shows what LLDP received. */
+    private static readonly READS;
+    /** A session filter, which holds only in the shell that set it. */
+    private static readonly SESSION_FILTER;
+    readonly name = "fortios";
+    readonly os: OsSupport;
+    readonly extension = ".conf";
+    readonly console: ConsoleDialect;
+    unsupported(device: Device): string[];
+    render(device: Device): string;
+    read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
+    /** The LLDP neighbors the device received, read with `diagnose lldprx neighbor details`. A port hears LLDP only while it, or the aggregate it is in, has `lldp-reception` on. */
+    neighbors(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /**
+     * The neighbors in what `diagnose lldprx neighbor details` prints, one `lldprx.neighbor.<n>.<field>: <value>` line per field: `port.txt` is our port, `port.id.data` the far port and `system.name.data` the far device. Our port is given Circuit's name. A neighbor that sent no system name or port is left out.
+     */
+    static neighborsOf(text: string, device: Device): Neighbor[];
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
+    /** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */
+    fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+    readOnly(command: string): boolean;
+    /** Over SSH, each command runs on its own until a session filter is set. The filter holds only in the shell that set it, so it and every command after it run in one shell. */
+    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    /** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
+    static fillLines(set: string, family: Family, prefixes: string[]): string[];
+    /**
+     * A line with each secret's value in place, escaped inside its quotes. A certificate's key from a variable is PEM encoded as one line of base64, and is sent as the PEM it holds. A file saved with Windows line endings is sent with plain ones: the CLI takes each carriage return as a line of its own, and refuses the key, `Invalid private key`. A `?`, which the CLI takes as a call for help, is typed literally.
+     */
+    static withSecrets(line: string): string;
+    private static login;
+    /** Log out of a console, so no session is left open on it. */
+    private static consoleLogout;
+    /** Log in on the console and open the CLI. Returns the CLI, a way to log in afresh on the same console, and how to let the console go. */
+    private static openConsole;
+    /** Log in on the console, open the CLI, and run `work` in it. `work` is also given a way to log in afresh on the same console. */
+    private static consoleSession;
+    /** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
+    private static withCli;
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
+    private static checkVersion;
+    /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
+    private static scrub;
+    /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
+    private static readConfig;
+    /** Leave every `config` and `edit` level, back to the top prompt. */
+    private static leave;
+    /** Send the lines that set how the device saves changes. */
+    private static saving;
+    /**
+     * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
+     */
+    private static configure;
+    /**
+     * Once the device is back from a reload, set it to save changes on its own again: the saved configuration still says to revert. Setting it saves what runs, so it is set only once the device says nothing is left to reload; until then the reload is asked for again.
+     */
+    private static settle;
+    private static applyOnce;
+    /**
+     * What transparent mode, which a bridge needs, leaves out: every address but one IPv4 management address outside the bridges, routing beyond static routes for it, NAT and DHCP. Without a management address the device is reached through its console and answers no service.
+     */
+    private static transparentGaps;
+    private static systemGaps;
+    private static managementGaps;
+    /** Every name the platform knows a port by. */
+    private static portNames;
+    private static interfaceGaps;
+    /** A port or LAG carries tagged only VLANs that have an interface here, and is the only one carrying each. */
+    private static trunkGaps;
+    /** Layer 3 settings the platform cannot express on a port or an interface. Only a tunnel takes an address with a peer. */
+    private static routedGaps;
+    /** An ACL as the platform's, which only drop: every drop comes before any accept, and no rule limits a rate or matches a VLAN. */
+    private static aclGaps;
+    private static staticGaps;
+    private static firewallGaps;
+    /** A filter rule the platform cannot express. */
+    private static ruleGaps;
+    private static serviceGaps;
+}