@takodotid/circuit 0.34.2 → 0.35.0

package/dist/types/platforms/fortios/names.d.ts

@@ -0,0 +1,52 @@
+import type { Device, Family } from "../../schema";
+type Addressed = {
+    addresses?: readonly (string | {
+        address: string;
+        peer?: string;
+    })[];
+    vrf?: string;
+    lag?: string;
+};
+export declare class FortiOsNames {
+    /** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
+    static bridgesOf(device: Device): {
+        name: string;
+        members: readonly string[];
+    }[];
+    /** Whether the device runs in transparent mode: it has a bridge. */
+    static isTransparent(device: Device): boolean;
+    /**
+     * The management address of a device in transparent mode: the one IPv4 address on a port or an interface outside every bridge. The device answers on it, the platform's `manageip`, through that interface alone. Undefined when there is none, and the device is reached only through its console.
+     */
+    static transparentManagement(device: Device): {
+        name: string;
+        address: string;
+    } | undefined;
+    /** The forward domain of a VLAN interface in a bridge, or undefined. */
+    static forwardDomainOf(device: Device, name: string): number | undefined;
+    /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
+    static nameOf(device: Device, name: string): string;
+    /** A port's or an interface's settings, by its key. */
+    static settingsOf(device: Device, name: string): Addressed | undefined;
+    /** Every address of a port or an interface. */
+    static addressesOf(settings: Addressed | undefined): string[];
+    /** An address or prefix with its length, a bare address taken as a host. */
+    static withLength(value: string): string;
+    /** The family of an address or prefix. */
+    static familyOfPrefix(value: string): Family;
+    /** `192.0.2.0 255.255.255.0`, how the platform writes an IPv4 prefix. */
+    static subnet(prefix: string): string;
+    /** The canonical form of a prefix: its network address and length, a bare address taken as a host. */
+    static network(prefix: string): string;
+    /** The number of a VRF on the platform: its place among the device's VRFs, the default table being 0. */
+    static vrfNumber(device: Device, vrf: string | undefined): number;
+    /** Every port and interface that routes, by key, with its settings. A LAG member routes through its LAG. */
+    private static routedHolders;
+    /** The interface whose own network holds an address, the most specific when several do, in one routing table. */
+    static interfaceFor(device: Device, address: string, vrf?: string): string | undefined;
+    /** The interface that holds an address as its own. */
+    static holderOf(device: Device, address: string): string | undefined;
+    /** Every port and interface with an address, by key, where the device's services answer. */
+    static addressed(device: Device): string[];
+}
+export {};

package/dist/types/platforms/fortios/plan.d.ts

@@ -0,0 +1,104 @@
+import type { ApplyOptions, Plan } from "../platform";
+export declare class FortiOsPlan {
+    /** Objects every FortiGate running 6.2 is shipped with, which policies and profiles of the factory name. */
+    private static readonly FACTORY_ADDRESSES;
+    private static readonly FACTORY_SERVICES;
+    /** The device's own certificates, which the factory makes for each device. */
+    private static readonly FACTORY_CERTIFICATES;
+    private static readonly ORDERED;
+    /** Tables whose entries need more than a plain comparison, by section. */
+    private static readonly TABLES;
+    /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
+    private static readonly IGNORED;
+    /** Settings of one section the device keeps for itself: how changes are saved, which `apply` sets while it works, and the alias it gives itself at every start. */
+    private static readonly IGNORED_IN;
+    /** In a certificate's entry, the settings that matter: its text and its key. The device prints others it decides for itself. */
+    private static readonly KEPT;
+    /** A policy denies unless told otherwise. */
+    private static readonly DENY;
+    /** Defaults the device does not print, by section. A config may state one, such as SSH on port 22, and the render states some because other settings appear only once they hold: a DHCP server's resolvers show only while it names them itself, and a policy answers a denied sender only while it denies. */
+    private static readonly DEFAULTS;
+    /** Settings whose value is a secret wherever they appear, such as a certificate's key, which the device prints encrypted. */
+    private static readonly SECRET_KEYS;
+    /** Settings holding a certificate's text, compared without its line breaks. */
+    private static readonly CERTIFICATES;
+    /** Settings undone before a nested list is deleted. Any other goes after it. */
+    private static readonly FIRST;
+    /** Settings holding a list in no particular order. */
+    private static readonly LISTS;
+    /** Settings that name an interface: an entry's own, or a list a section holds, such as OSPF's passive interfaces or the interfaces NTP answers on. */
+    private static readonly NAMES_INTERFACE;
+    /** Tables whose entries are named after an interface, so that releasing the interface deletes its entry: `The vxlan device is currently used` otherwise. */
+    private static readonly KEYED_BY_INTERFACE;
+    /** The tables whose entries are interfaces, so that releasing one frees what names it. */
+    private static readonly INTERFACE_TABLES;
+    /**
+     * Lists of interfaces that exist only while a setting is on, by the list. NTP serves only on interfaces it names, so its list cannot be emptied while it serves, `There aren't any interfaces with NTP server enabled`; turning it off hides the list and lets go of them.
+     */
+    private static readonly HELD_BY;
+    /** The interfaces of tunnels, which their own tables create, compared after those tables as a section of their own. */
+    private static readonly TUNNELS;
+    /** A value that is a secret: a marker in the render, a cipher or a redaction in the read. */
+    private static isSecret;
+    /** A value in the form both sides compare in: words without quotes, a secret as one word, a list sorted. */
+    private static canonical;
+    /** Whether an entry changes a setting it keeps for life, so it must be created again. */
+    private static changesFixed;
+    /** Whether the device holds an entry the plan leaves alone. */
+    private static isFactory;
+    /** The configuration as the plan reads it: factory entries and the device's own settings left out. */
+    static clean(text: string): string;
+    private static dropIgnored;
+    /** The words before a line a reviewer reads, naming the entry and block it sits in. */
+    private static labelOf;
+    /** A block's lines as reviewer lines, each with its place. An entry that holds nothing, such as an extra IPv6 address, is its own line. */
+    private static shown;
+    /** The lines that create an entry, with the settings the device adds unset when the render does not hold them. */
+    private static creation;
+    /**
+     * Compare one block. `table` applies to its entries; `top` sends their removal to the end of the plan.
+     *
+     * What goes is undone before what comes is set, since a setting can hide another: `send-deny-packet` exists only while a policy denies. A nested list that goes is deleted before the settings, since one can hide the list and keep its entries hidden, such as `secondary-IP`; NTP refuses to delete its last server while it synchronises, so `ntpsync` goes before its list.
+     */
+    private static compare;
+    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted, and an ordered table put in order. */
+    private static byId;
+    /** Entries matched by name in a table that refuses two alike: every entry that changes or goes is deleted before any is created, so none is ever briefly the same as another. */
+    private static distinctById;
+    /** The `move` commands that put a table's entries in the render's order. Kept entries hold their place on the device and new ones are added at the end. */
+    private static moves;
+    /** An entry's settings in the form two entries compare in, whatever their numbers. */
+    private static signature;
+    /** Entries matched by what they hold. One the device holds and the render does not is deleted; one the render adds takes a number the device does not use. */
+    private static byContent;
+    /** The interface names a block's settings hold. */
+    private static interfacesNamed;
+    /**
+     * What goes before anything else changes.
+     *
+     * A port joins a LAG only while nothing names it, and its speed cannot change while it is in one. So a LAG that keeps some of its ports lets the others go first, a port whose speed changes leaves its LAG and joins again later, a LAG whose ports join another goes first, and an interface whose type or parent changes is deleted and created again. Whatever names such an interface on the device is deleted first, or unset when a list names it, and set again later if the render holds it; an interface or tunnel deleted this way frees what names it in turn.
+     *
+     * A LAG that goes otherwise is deleted with everything else that goes, after what names it; its ports are changed after that.
+     */
+    private static released;
+    /**
+     * The lines, inside one block, that release what names a freed interface: an entry that names one is deleted, and a list a block holds that names one is unset. The device's tree loses them too, so the plan creates or sets them again. An interface the release deletes itself is in `gone`.
+     */
+    private static release;
+    /**
+     * Addresses that leave an interface, taken off before any is set: the device refuses an address in a subnet another interface still holds, `Subnets overlap`. A primary address that changes takes the secondary ones with it, since they hang on it.
+     */
+    private static movedAddresses;
+    /**
+     * What changes, by section, in the order the render lists them. Entries that go are deleted after everything else, in the reverse order, so nothing is deleted while another section still names it.
+     *
+     * A secret is sent when its entry is new, or with `secrets` set; it cannot be read back to compare.
+     */
+    static of(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
+    /** The tree with each tunnel's interface moved from `system interface` to a section of its own, just after the tunnels' tables. The interface it leaves through is its tunnel's, and is left to the tunnel's table. */
+    private static separateTunnels;
+    /** A prefix list `refresh` fills keeps the entries the device holds. */
+    private static keepFilled;
+    /** The ports of a LAG that goes, taken out of the main comparison and changed in a step of their own once the LAG is deleted. */
+    private static deferredPorts;
+}

package/dist/types/platforms/fortios/render.d.ts

@@ -0,0 +1,75 @@
+import type { Device, Helper, Severity } from "../../schema";
+export type Section = (typeof FortiOsRender.SECTIONS)[number];
+export declare class FortiOsRender {
+    /** Where the pre-login banner's text is kept. */
+    static readonly BANNER = "system replacemsg admin \"pre_admin-disclaimer-text\"";
+    /** Every section Circuit manages, in the order a change goes in: what others name comes first. */
+    static readonly SECTIONS: readonly ["vpn certificate local", "vpn certificate ca", "system global", "system replacemsg admin \"pre_admin-disclaimer-text\"", "system settings", "system accprofile", "system admin", "system interface", "system gre-tunnel", "system vxlan", "system dns", "system dns-server", "system ntp", "system snmp sysinfo", "system snmp community", "system snmp user", "log memory setting", "log memory filter", "log disk setting", ...string[], "system sflow", "system netflow", "system dhcp server", "router static", "router static6", "router prefix-list", "router prefix-list6", "router community-list", "router route-map", "router ospf", "router ospf6", "router bgp", "system session-helper", "firewall address", "firewall address6", "firewall addrgrp", "firewall addrgrp6", "firewall service custom", "firewall ippool", "firewall vip", "firewall policy", "firewall policy6", "firewall local-in-policy", "firewall local-in-policy6", "firewall central-snat-map", "firewall acl", "firewall acl6"];
+    /** Sections `show` prints without what matters, which `show full-configuration` prints: a certificate's text. */
+    static readonly FULL: readonly string[];
+    /** The FortiOS zone number of each IANA zone it has one for. A number names a list of places in one zone; `00` is the device's default. */
+    private static readonly ZONES;
+    /** What each role may do: the factory profile for an admin, and a profile Circuit adds for the others. */
+    static readonly PROFILE: {
+        readonly admin: "super_admin";
+        readonly operator: "circuit-operator";
+        readonly "read-only": "circuit-read-only";
+    };
+    /** The permission groups of an access profile. */
+    private static readonly PERMISSION_GROUPS;
+    /** The most public keys a user holds. */
+    static readonly SSH_KEYS = 3;
+    /** The most resolvers the device and a DHCP server hold, per family. */
+    static readonly RESOLVERS: {
+        readonly device: 2;
+        readonly dhcp: 4;
+    };
+    /** The most syslog collectors the device sends to. */
+    static readonly COLLECTORS = 4;
+    /** The most VRFs the device holds besides its default table. */
+    static readonly VRFS = 31;
+    /** A severity as the platform names it. */
+    static readonly LEVEL: Record<Severity, string>;
+    /** The helpers the factory runs, by the name a config gives them: protocol and port of each. */
+    static readonly HELPERS: Partial<Record<Helper, readonly [string, number, number][]>>;
+    /** Speed by the platform's spelling, for each class a port's cage takes. */
+    static readonly SPEEDS: Record<string, Partial<Record<string, string>>>;
+    /** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
+    static readonly TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
+    /** The zone number for an IANA zone. UTC when the config names none. */
+    static zoneOf(timezone?: string): string | undefined;
+    /** The services a port or an interface answers on its addresses: ping always, and every management service the config turns on. */
+    private static allowAccess;
+    /** The whole configuration the device should run, in the form `show` prints. */
+    static of(device: Device): string;
+    /** A certificate with its key is the device's own; one without is only trusted. */
+    private static certificates;
+    private static global;
+    /** Each user, with the profile its role takes. */
+    private static users;
+    /** Ports, then the LAGs they join, VLAN interfaces on them, loopbacks, and the tunnels with their own tables. */
+    private static interfaces;
+    /** The platform sends ICMP redirects unless an interface says otherwise; the config sends them only when asked. */
+    private static redirects;
+    /** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
+    static vlanParent(device: Device, vlan: string): string | undefined;
+    /** Addresses and their routing table, the services answered on them, VRRP, DHCP relay, router advertisements, LLDP and flow sampling of a port or an interface. */
+    private static routed;
+    /** The device's resolvers, and the interfaces it answers DNS queries on when it serves them. */
+    private static dns;
+    /** The servers the device keeps time from, and the interfaces it answers time queries on when it serves them. */
+    private static ntp;
+    /** SNMP version 2c with one community, guarded by its hosts, and version 3 users. */
+    private static snmp;
+    /** Logs kept in memory from a level up, none on disk, and up to four syslog collectors, each with the least severe message it takes. */
+    private static logging;
+    /** One collector, and sampling on each interface it observes. */
+    private static flowExport;
+    private static dhcpServers;
+    /** Each route by its position. A route goes in the routing table of the interface it leaves through. A default route is the platform's default destination and is not printed. */
+    private static staticRoutes;
+    /** BFD runs once a route or a session uses it, or the config sets its timers, which the device shows only while it runs. */
+    private static bfd;
+    /** The helpers the config lists, each on the protocols and ports the factory gives it. None run otherwise. */
+    private static helpers;
+}

package/dist/types/platforms/fortios/routing.d.ts

@@ -0,0 +1,56 @@
+import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema";
+import { FortiOsBlock } from "./tree";
+type AnyRule = PolicyRule<string, string>;
+type AnyNeighbor = Neighbor<string, string>;
+/** The lengths a prefix list's rule takes within its prefix. */
+type Lengths = {
+    ge?: number;
+    le?: number;
+};
+export declare class FortiOsRouting {
+    /** The route map a session takes when its config states none, so it learns or announces nothing. */
+    static readonly REJECT_ALL = "circuit-reject-all";
+    /** The start of the comment on a prefix list `refresh` fills. The plan keeps the entries the device holds in one. */
+    static readonly FILLED = "Filled by circuit refresh";
+    /** The table a prefix list of one family sits in. */
+    static readonly PREFIX_LIST: {
+        readonly ipv4: "router prefix-list";
+        readonly ipv6: "router prefix-list6";
+    };
+    /** The longest prefix of each family. */
+    static readonly BITS: {
+        readonly ipv4: 32;
+        readonly ipv6: 128;
+    };
+    /** A neighbor's settings with its group's beneath them. */
+    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string>;
+    /** The families a session carries: its own, or the family of its address. */
+    static familiesOfNeighbor(device: Device, neighbor: AnyNeighbor): Family[];
+    /** Whether a static route, OSPF or BGP detects a dead neighbor with BFD, which the device then runs. */
+    static usesBfd(device: Device): boolean;
+    static render(root: FortiOsBlock, device: Device): void;
+    /** A prefix as the platform writes it in a prefix list of its family. */
+    private static listPrefix;
+    /** One rule of a prefix list: a prefix, and the lengths it takes within it. The device prints a bound the rule does not hold as `unset`. */
+    static listRule(rule: FortiOsBlock, family: Family, prefix: string, lengths?: Lengths): void;
+    /** The lengths a rule takes within a prefix to match lengths from `min` to `max`, or none when no length fits. A bound equal to the prefix's own length is left out. */
+    static bounds(prefix: string, family: Family, min?: number, max?: number): Lengths | undefined;
+    /** Each prefix set as a prefix list matching its prefixes and any more specific. One a registry fills starts with a rule that denies every prefix, so it matches nothing until `refresh` fills it. */
+    private static prefixLists;
+    /** The networks of an interface's addresses of one family, for an OSPF area to announce. */
+    private static networksOf;
+    /** OSPF for IPv4. An area runs on the networks of its interfaces; an interface named with a cost, a link type or BFD has settings of its own; a passive one forms no adjacency. */
+    private static ospf;
+    /** OSPFv3 for IPv6. Every interface of an area runs it in that area. */
+    private static ospf6;
+    /** BGP: each session with its settings and group's, the route maps its policies become for each family it carries, and the prefixes the device originates. */
+    private static bgp;
+    /** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
+    static familyOfRule(device: Device, rule: AnyRule): Family | undefined;
+    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller. */
+    static flatten(device: Device, policy: string, seen?: string[]): AnyRule[];
+    /** Routing the platform cannot express, or that this adapter does not yet write. */
+    static gaps(device: Device): string[];
+    private static ruleGaps;
+}
+export {};

package/dist/types/platforms/fortios/tree.d.ts

@@ -0,0 +1,37 @@
+/** One `edit` of a table: its name as written, and what it holds. */
+export type Entry = {
+    id: string;
+    block: FortiOsBlock;
+};
+export declare class FortiOsBlock {
+    readonly settings: Map<string, string>;
+    readonly blocks: Map<string, FortiOsBlock>;
+    readonly entries: Map<string, Entry>;
+    /** Set a key. A value of several words is written as given. */
+    set(key: string, value: string | number): this;
+    /** The nested `config` block with this header, created when absent. */
+    block(header: string): FortiOsBlock;
+    /** The table entry with this name, created when absent. A name is quoted unless it is a number, or the table prints it bare, such as an OSPF area or an IPv6 prefix. */
+    entry(id: string | number, plain?: boolean): FortiOsBlock;
+    isEmpty(): boolean;
+}
+export declare class FortiOsTree {
+    /** A setting the device prints as `unset <key>`, a key it holds empty on purpose, such as an ICMP service's type. */
+    static readonly UNSET = "\0unset";
+    /** A string as the CLI takes it, in double quotes. */
+    static quote(text: string): string;
+    /** Each of several strings quoted, as a list setting takes them. */
+    static quoteAll(texts: readonly string[]): string;
+    /** A value's words; a quoted string is one word with its quotes. */
+    static words(value: string): string[];
+    /** A word as the device means it, without quotes or escapes. */
+    static bare(word: string): string;
+    /** The lines that build a block, at an indent, in the form `show` prints and the CLI takes. */
+    static lines(block: FortiOsBlock, indent?: string): string[];
+    /** The whole configuration: each top-level block as `config <section>` to `end`. */
+    static print(root: FortiOsBlock): string;
+    /** Whether a line opens a quoted value it does not close, so the value goes on over the next lines. */
+    private static unclosed;
+    /** The tree of what `show` printed. Lines that are not configuration, such as the version header, are skipped. */
+    static parse(text: string): FortiOsBlock;
+}

package/dist/types/platforms/index.d.ts

@@ -0,0 +1,13 @@
+import type { Platform } from "./platform";
+/** Every platform the framework can render and apply, by name. */
+export declare class Platforms {
+    private static readonly BY_NAME;
+    /** The platform of that name, or undefined when there is none. */
+    static find(name: string): Platform | undefined;
+    /** The platform of that name. Throws when there is none. */
+    static get(name: string): Platform;
+    /** Every platform, in the order the framework lists them. */
+    static all(): Platform[];
+    /** Every platform's name. */
+    static names(): string[];
+}

package/dist/types/platforms/junos/bgp.d.ts

@@ -0,0 +1,44 @@
+import type { Device, Neighbor, NeighborSettings } from "../../schema";
+import { type JunosStatements } from "./render";
+type AnyNeighbor = Neighbor<string, string>;
+/** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
+export declare class JunosBgp {
+    private readonly out;
+    private readonly device;
+    /** The policy a session uses when it states none, so that it learns or announces nothing. */
+    private static readonly REJECT_ALL;
+    /** The policy every export starts with. BGP's own routes and the prefixes the device originates go on to the session's policy; the device's other routes never reach it. */
+    private static readonly ORIGIN;
+    /** The validator group every RPKI server joins. */
+    private static readonly RPKI_GROUP;
+    /** A comment in the render naming a path whose statements `refresh` fills, so the plan keeps what the device holds there. */
+    static readonly GENERATED = "# generated ";
+    private static readonly FAMILY;
+    private static readonly VALIDATION;
+    private constructor();
+    /** Add the device's prefix sets, RPKI servers, BGP sessions and the policies they use. */
+    static render(out: JunosStatements, device: Device): void;
+    /** A neighbor's settings with its group's beneath them. */
+    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string>;
+    /** A name made of a value's words, for a community or a path-length list: `64500:*` becomes `64500-any`. */
+    private static slug;
+    /** A community as the platform writes a member: a large community carries the `large:` prefix. */
+    private static member;
+    /** A term's name: its place, then the rule's description so a reader sees it on the device. */
+    private static termName;
+    private sessions;
+    /** BGP's routes and the originated prefixes go on to the session's policy; anything else is rejected. */
+    private origin;
+    private prefixSets;
+    private rpki;
+    /** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
+    private familyOfRule;
+    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller, as it does on every platform. */
+    private flatten;
+    /** One policy as a policy statement: a term per rule, then a reject when the last rule does not decide on every route. */
+    private policyStatement;
+    private term;
+    /** A named community holding these members, named after them. */
+    private community;
+}
+export {};

package/dist/types/platforms/junos/index.d.ts

@@ -0,0 +1,114 @@
+import type { Neighbor } from "../../core/cabling";
+import type { Device, Family } from "../../schema";
+import { type ConsoleDialect } from "../../transport/console";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+/** How a commit that could cut access is guarded: it rolls back after `minutes` unless `prove` shows access survived. */
+export type Guard = {
+    minutes: number;
+    prove: () => Promise<void>;
+};
+export declare class Junos extends Platform {
+    /** How the console asks for a login. Root lands in a shell, `%`, every other user in the CLI, `>`; a session left in configuration mode, `#`, leaves it first. Not yet proved on a device. */
+    static readonly CONSOLE: ConsoleDialect;
+    /** The release this adapter renders for, and was proved on. */
+    private static readonly SUPPORTED_MAJOR;
+    /** Statements the device keeps for itself: the release it runs and the number it gives each user. */
+    private static readonly DEVICE_FACTS;
+    /** Names the platform keeps for its own system accounts. A user under one fails the commit check. */
+    private static readonly SYSTEM_ACCOUNTS;
+    /** A value the device keeps hashed or encrypted, and the render writes as a marker, as one word both sides share. Each keeps the number of words. */
+    private static readonly SECRETS;
+    /** Lists whose entries are named: a delete cannot stop at the list, `delete interfaces xe-0/0/1 unit`, only at an entry, `unit 0`. A leaf-list such as `vlan members` or `ciphers` can go whole. */
+    private static readonly NAMED_LISTS;
+    /** A prompt at the end of what the device printed: `user@host> `, `user@host# `, or a shell's `% `. */
+    private static readonly PROMPT;
+    /** The prompt in configuration mode, under its `[edit]` line. An echoed statement cannot end with it. */
+    private static readonly EDIT_PROMPT;
+    /** What the device says when it refuses a statement in a load: `terminal:3:(14) syntax error: ...`. A warning, such as a statement not found, is not a refusal. */
+    private static readonly REFUSED;
+    /** Every LLDP neighbor with the far port, which the brief form leaves out. */
+    private static readonly LLDP_NEIGHBORS;
+    /** Commands that only read. */
+    private static readonly READS;
+    /** Features `Derive.unproved` refuses until a platform proves them, proved here on a QFX5100-48S-6Q running Junos 21.4R3. */
+    private static readonly PROVED;
+    readonly name = "junos";
+    readonly os: OsSupport;
+    readonly extension = ".conf";
+    readonly console: ConsoleDialect;
+    unsupported(device: Device): string[];
+    render(device: Device): string;
+    read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
+    /** The LLDP neighbors from `show lldp neighbors detail` as XML. The brief form leaves out the far port, and its table pads columns that a description can fill. */
+    neighbors(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /** Each neighbor in the XML the device printed, on our port by Circuit's name. The far end's system name, or its chassis ID when it sends none. */
+    static neighborsOf(device: Device, xml: string): Neighbor[];
+    private static unescapeXml;
+    /**
+     * What changes, by section.
+     *
+     * A statement the render holds and the device does not is set. One the device holds and the render does not is deleted at the shortest path that holds nothing the render wants, so a removed port goes as a whole and a changed value goes alone. A hidden value ends a path by its name alone; a hidden name in a list, such as a community, stays `<redacted>` and the session names each entry when it sends the plan. A statement the device holds deactivated is activated when the render wants it.
+     *
+     * A policy, a filter or an import or export chain is ordered, so when anything in one changes it is deleted and set again whole, in the render's order. A path the render marks as generated, such as a prefix list `refresh` fills, keeps what the device holds.
+     */
+    plan(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
+    apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+    /** Replace a prefix list `refresh` fetched. It cannot cut access, so it is committed without a rollback. */
+    fill(device: Device, _network: readonly Device[], set: string, _family: Family, prefixes: string[]): Promise<void>;
+    readOnly(command: string): boolean;
+    /** Over SSH, each command runs on its own, as the read does. */
+    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    /** A statement's words; a quoted value is one word with its quotes. */
+    private static wordsOf;
+    /** A word as the platform means it, without quotes or escapes, so a value quoted on one side and not on the other compares equal. */
+    private static bare;
+    /** A statement in the form both sides compare in: its words, secrets as one marker, quotes dropped. */
+    private static keyOf;
+    /** The device prints a password as a hash, an SNMP key as a reversible cipher, and a community as itself. None leave the read. */
+    private static scrub;
+    /** The configuration's statements from what `show configuration | display set` printed. */
+    private static clean;
+    /** Whether a delete may stop after `path[index]`. Below the top level a named list may not; `vlan` names a list except in `vlan members`. */
+    private static canStopAt;
+    /** The section a statement belongs to, for a reviewer: `interfaces xe-0/0/1`, `system login`, `snmp`. */
+    private static sectionOf;
+    /**
+     * The ordered block a statement sits in, and its item there: a policy's or a filter's term, or one policy of an import or export chain. The device keeps their order, and `set` adds at the end.
+     */
+    private static orderedBlockOf;
+    /** Whether a path starts with another. */
+    private static startsWith;
+    private static login;
+    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
+    private static checkVersion;
+    /** Send one line and wait for the prompt to come back. */
+    private static run;
+    /** Send one line in configuration mode and wait for its prompt to come back. */
+    private static edit;
+    /** Log in on the console and open the CLI. Returns the console, a way to log in afresh, and how to let the console go. */
+    private static openConsole;
+    /** Log in on the console, open the CLI, and run `work` in it with a way to log in afresh. Logs out after. */
+    private static onConsole;
+    /** An interactive CLI with paging off. Root lands in a shell and starts the CLI from there. */
+    private static openCli;
+    /**
+     * A delete through a name the read redacted, `delete snmp community <redacted>`, as one delete for each entry the device holds there. The names stay in the session.
+     */
+    private static named;
+    /**
+     * Load the plan into an exclusive candidate and check it. With a guard, commit it to roll back after `minutes`, prove access, then confirm; without one, commit it outright.
+     *
+     * Deletions go before the statements that are set, so a path deleted and set again in one plan ends up set.
+     */
+    private static configure;
+    /** The plan that replaces a prefix list's entries with what a registry returned. */
+    private static fillPlan;
+    /** The IP MTU of every port and LAG that carries a VLAN; 1500 where none is given. */
+    private static carriers;
+    /** BGP settings Junos 21 has no statement for, and policy steps it cannot take. */
+    private static bgpGaps;
+    /** Layer 3 settings the platform cannot express on a port or an interface. */
+    private static routedGaps;
+    /** Storm control in a form a profile holds: one threshold in percent for every kind. */
+    private static switchedGaps;
+}