@takodotid/circuit 0.34.2 → 0.35.0

package/dist/types/platforms/junos/render.d.ts

@@ -0,0 +1,154 @@
+import type { Device, Interface, Port, Vrrp } from "../../schema";
+type AnyPort = Port<string, string, string, string>;
+type AnyInterface = Interface<string, string>;
+type LagInterface = Extract<AnyInterface, {
+    type: "lag";
+}>;
+type Switched = AnyPort | LagInterface;
+/** Collects `set` statements, and comments the plan reads. */
+export declare class JunosStatements {
+    private readonly lines;
+    private readonly notes;
+    set(...words: (string | number)[]): void;
+    note(comment: string): void;
+    /** The statements as the device prints them: each once, and none that another one extends, because the platform prints only the longest. */
+    text(): string;
+}
+/** What the platform calls a port, a LAG, a VLAN interface or a loopback. */
+export declare class JunosNames {
+    private readonly device;
+    readonly lags: Map<string, number>;
+    readonly loopbacks: Map<string, number>;
+    readonly tunnels: Map<string, number>;
+    constructor(device: Device);
+    /** A physical port. A 10G cage holding a 1G optic is `ge-`, not `xe-`. */
+    port(port: string): string;
+    /** The physical interface a port or a LAG is: `xe-0/0/1`, `ae1`. */
+    physical(name: string): string;
+    /** The logical interface that holds addresses: `xe-0/0/1.0`, `ae1.0`, `irb.10`, `lo0.0`. */
+    unit(name: string): string;
+    /** The physical ports behind a port or a LAG. */
+    members(name: string): string[];
+}
+/** The whole configuration of one device, built section by section into one set of statements. */
+export declare class JunosRender {
+    private readonly device;
+    /** The class each role logs in with. */
+    private static readonly USER_CLASS;
+    /** The statement each kind of public key is written under, by the key's own prefix. */
+    static readonly KEY_STATEMENT: Record<string, string>;
+    private static readonly SNMP_AUTH;
+    private static readonly SNMP_PRIVACY;
+    /** The SNMPv3 group every user joins, with read access to everything. */
+    private static readonly SNMP_GROUP;
+    /** A severity as the platform names it. It has no debug; `any` takes everything. */
+    private static readonly LEVEL;
+    /** The filters that decide who reaches the device's own services, one per family. A filter name is unique across families. */
+    private static readonly SERVICES_FILTER;
+    /** The policy OSPF announces other routes with. */
+    private static readonly OSPF_EXPORT;
+    /** Strong ciphers, MACs and key exchanges, offered unless `weak_crypto`. */
+    private static readonly SSH_CIPHERS;
+    private static readonly SSH_MACS;
+    private static readonly SSH_KEY_EXCHANGES;
+    /** The transport and port each management service listens on. */
+    private static readonly SERVICE_PORTS;
+    /** Kinds of frame as `ether-type` names them, in the order the render writes them. */
+    private static readonly ETHERTYPES;
+    /** Detection under a second: three missed packets 300 ms apart. The platform has no interval of its own, and 3 is its multiplier. */
+    static readonly BFD_INTERVAL = 300;
+    /** Kinds of flooded traffic, with the statement that leaves each out of a storm-control profile. */
+    private static readonly STORM_KINDS;
+    private readonly out;
+    private readonly names;
+    private constructor();
+    /** The whole configuration the device should run, as `set` statements. */
+    static of(device: Device): string;
+    /** BFD under a statement: `routing.bfd`'s timers, or every 300 ms when it has none. */
+    static bfd(out: JunosStatements, statement: string, device: Device): void;
+    /** Quote a value unless it is a plain word. Quoting more than the platform would is harmless: the comparison ignores quotes. */
+    static quote(value: string): string;
+    /** The address a VRRP group sits on: the one whose network holds the virtual address. */
+    static vrrpAddress(addresses: readonly string[], group: Vrrp): string | undefined;
+    /**
+     * The storm-control profile a port or LAG names. A profile holds one threshold for every kind it limits, so a port's kinds must share one in percent; `unsupported()` refuses any other.
+     */
+    static stormProfile(settings: Switched): {
+        name: string;
+        percent: number;
+        left: string[];
+    } | undefined;
+    /** The size a port's frames may reach for an IP MTU: the Ethernet header, and a VLAN tag when the port switches. */
+    private static frameSize;
+    /** `2g`, a rate as a policer takes it. */
+    private static bandwidth;
+    /** Bytes a policer lets through at once: 10 ms at its rate, and never less than one full frame. */
+    private static burstOf;
+    /** Each port or range as the platform writes it: `53`, `1000-2000`. */
+    private static eachPort;
+    /** The family a hardware ACL rule is limited to, by its family or its addresses. */
+    private static aclFamily;
+    /** The protocol as an IPv6 header names it. */
+    private static nextHeader;
+    /** A rule's term name: its place, then its description so a reader sees it on the device. */
+    private static ruleName;
+    private system;
+    /** Every user but root logs in with a class. Root is the platform's own account and takes only its password and keys. */
+    private users;
+    private services;
+    /** SNMP version 2c with one read community, version 3 with users in one read-only group, or both. */
+    private snmp;
+    private vlans;
+    /** Layer 2 membership of a port or LAG. The native VLAN is a member too, or its untagged frames are dropped. */
+    private switching;
+    /** The filter that lets only these kinds of frame in, named after them: `circuit-ethertypes-ipv4-ipv6-arp`. */
+    private static ethertypeFilter;
+    /** One filter for each set of kinds a port or LAG lets in: those kinds, then nothing else. */
+    private ethertypeFilters;
+    /** Addresses and VRRP groups of a logical interface such as `irb.10`. */
+    private addressing;
+    /** Every port the model has. One the config does not declare is turned off, and so is a 10G cage's name for the optic it does not hold. */
+    private ports;
+    private lags;
+    /** VLAN interfaces, loopbacks and GRE tunnels: a description, a tunnel's ends, addresses and VRRP, and an MTU per family. */
+    private routedInterfaces;
+    /** One profile per threshold the ports and LAGs name. */
+    private stormProfiles;
+    /**
+     * Who reaches the device's own services: each guarded service from its sources only, time answered only to the servers the device keeps time from, and everything else as it was.
+     *
+     * The filter sits on every loopback unit and on each management port with an address, so it applies whichever routing table or port a packet arrives on.
+     */
+    private servicesFilter;
+    /** A VRF is a virtual router: its own table, holding its interfaces. */
+    private vrfs;
+    /** A route with a distance names its next hop as qualified, so two routes to one prefix can each have their own. */
+    private staticRoutes;
+    /** Spanning tree on every switched port and LAG, each with its own settings. RSTP when no mode is given. */
+    private spanningTree;
+    /**
+     * LLDP on every port or on those listed, a port's own setting over the device's. LLDP runs on a LAG's member ports.
+     *
+     * The device sends a port's SNMP index as its port ID unless told to send its name, so a neighbor sees `et-0/0/52` rather than `520`.
+     */
+    private lldp;
+    /** OSPF for IPv4 and OSPFv3 for IPv6, with the same areas and interfaces. */
+    private ospf;
+    /** Each relay is a group of servers and the interface it listens on, in the table that interface routes in. */
+    private dhcpRelay;
+    /** sFlow from the management address, to each collector, on every declared port or those listed. A LAG is observed on its member ports. */
+    private sflow;
+    /**
+     * Hardware ACLs. A switched port takes a filter of the switching family, which matches IPv4 and IPv6 under `ip-version`; a routed port takes one filter per family. Each ends by accepting what no rule matched.
+     */
+    private acls;
+    /** A rule's decision, through a policer when it has a rate. */
+    private aclThen;
+    private switchingFilter;
+    private routedFilter;
+    /** A DHCP server is an address pool with its network, range, options and reservations, served on its interface. */
+    private dhcpServers;
+    /** Router advertisements announce each IPv6 network of the interface. */
+    private routerAdvertisements;
+}
+export {};

package/dist/types/platforms/line-diff.d.ts

@@ -0,0 +1,67 @@
+import type { Plan } from "./platform";
+export type Dialect = {
+    /** A line at the margin that opens a block, for platforms that do not indent a block's lines. */
+    block: RegExp;
+    /** Whether a block's lines are indented under it. When they are, any line followed by deeper lines opens a block. */
+    indented: boolean;
+    /** A line at the margin that closes every open block. */
+    terminator: string;
+    /** Lines that describe the device rather than configure it, or that the platform prints whatever is set. */
+    ignore: (line: string) => boolean;
+    /** The command that removes a line. */
+    undo: (line: string) => string;
+    /** Leaves one level of block. */
+    leave: string;
+    /** Lines sent before the undos of their block, because the platform refuses an undo until they are in place. */
+    first?: RegExp;
+    /** A line in the form both sides compare in, for example a secret the device prints as a cipher. */
+    canon?: (line: string) => string;
+    /** Where a block is sent among the others, lowest first, so that nothing is referenced before it exists. In the order they differ when absent. */
+    order?: (path: string[]) => number;
+};
+/** One line, with the blocks it sits in, outermost first. */
+export type Entry = {
+    path: string[];
+    line: string;
+};
+/** What changes inside one block. */
+export type Group = {
+    path: string[];
+    remove: string[];
+    add: string[];
+};
+/** Commands a platform needs around one group, such as releasing a binding before a change and restoring it after. */
+export type Around = (group: Group) => {
+    before: string[];
+    after: string[];
+};
+export declare class LineDiff {
+    /** What a switch prints in place of a secret: the cipher of a password, a community or an SNMPv3 key, and a Raisecom community in clear. Never an algorithm list such as `ssh server cipher`. */
+    private static readonly STORED_CREDENTIAL;
+    /** How deep a line is indented. */
+    private static indentOf;
+    static entries(text: string, dialect: Dialect): Entry[];
+    /** The part of a line that names what it sets: `rule 5`, a free-text keyword, or the line up to its value. Two lines with one head are one setting with two values. */
+    static head(line: string): string;
+    /**
+     * What differs, by block.
+     *
+     * A device line replaced by a desired line with the same head is not undone; sending the new one is enough. A block the render does not hold goes with its header, and its lines with it.
+     */
+    static compare(desired: string, current: string, dialect: Dialect): Group[];
+    /**
+     * Send every line that holds a secret again, for `apply --secrets`. A device prints a secret as a cipher, so a line whose secret changed compares equal and is otherwise never sent.
+     */
+    static withSecrets(groups: Group[], desired: string, dialect: Dialect): Group[];
+    /**
+     * Replace a changed VLAN list line with only what changed.
+     *
+     * A platform keeps its VLANs as one line, such as `vlan batch 10 20 to 30`. Undoing the old line would delete VLANs still in use, so the plan adds the new IDs and removes the gone ones instead.
+     */
+    static vlanListChange(groups: Group[], prefix: string, parse: (line: string) => number[], format: (ids: number[]) => string[], removal: (ids: number[]) => string[]): void;
+    private static nothingAround;
+    /** The steps for the groups: enter each block of the path, undo, add, then leave each level. */
+    static steps(groups: Group[], dialect: Dialect, around?: Around): Plan["steps"];
+    /** A device prints stored credentials as ciphers. They never leave the read. */
+    static scrub(text: string): string;
+}

package/dist/types/platforms/platform.d.ts

@@ -0,0 +1,120 @@
+import type { Neighbor } from "../core/cabling";
+import type { Device, Family } from "../schema";
+import type { ConsoleDialect } from "../transport/console";
+import type { WaitLimits } from "./bgp-wait";
+import type { PlatformName } from "./catalog";
+/** One part of a plan: what a reviewer reads, and what is sent. */
+export type Step = {
+    title: string;
+    show: string[];
+    send: string[];
+};
+/** The commands that turn what a device runs into what its config says. `problems` blocks an apply: something the adapter cannot converge. */
+export type Plan = {
+    steps: Step[];
+    problems: string[];
+};
+export type ApplyOptions = {
+    /** Also send every secret, so a rotated value reaches the device. Secrets cannot be read back, so they are otherwise only sent when the object holding them is new. */
+    secrets: boolean;
+    /** Minutes before a platform that can restore itself does so, if the run does not prove access survived. */
+    rollback: number;
+    /** Reach the device through its serial console, `connection.console`, instead of SSH to its management address. */
+    console?: boolean;
+};
+/** How a device is read. */
+export type ReadOptions = Pick<ApplyOptions, "console">;
+/** A login on a device for commands that only read, as `circuit show` runs them. */
+export type ReadSession = {
+    /**
+     * Run one command and return what it printed, without its echo or the prompt.
+     *
+     * At `timeout` milliseconds, a command run on its own over SSH is left, and what it printed so far is returned. In a shell or on a console, where it would hold up every command after it, the run fails instead.
+     */
+    run(command: string, timeout?: number): Promise<string>;
+    /** Log out. */
+    close(): void;
+};
+/** How the checks after an apply reach the device, and how long they wait. */
+export type HealthOptions = ReadOptions & {
+    /** How long BGP sessions established before the apply have to be established again. `BgpWait.AFTER_APPLY` when absent. */
+    bgp?: WaitLimits;
+};
+/** The checks after an apply, holding what they compare against, which was read before the plan was sent. */
+export type HealthCheck = {
+    /** Run the checks. Gives one line per problem, each saying what to do; none when the device is healthy. */
+    run(): Promise<string[]>;
+};
+/** A BGP neighbor in the config and its live session, as `circuit bgp` shows it. A neighbor with no session is not established. */
+export type BgpSession = {
+    /** The neighbor's name in the config. */
+    neighbor: string;
+    /** The session's remote address, or `-` when there is no session. */
+    remote: string;
+    /** Whether the session is established. */
+    established: boolean;
+    /** How many prefixes it received, as the device prints it, or `-`. */
+    prefixes: string;
+    /** How long it has been up, as the device prints it, or `no session`. */
+    uptime: string;
+};
+/** One BGP log line: when, as the device printed it, such as `2026-10-24 03:12:44`, and the rest of the line. */
+export type BgpLogLine = {
+    at: string;
+    message: string;
+};
+/** The operating system a platform runs, and the versions it is proved on. */
+export type OsSupport = {
+    /** Its name in full, such as `MikroTik RouterOS`. */
+    name: string;
+    /** The versions the adapter renders for, such as `7`. */
+    versions: string;
+    /** The device and version it was proved on, such as `CCR2216-1G-12XS-2XQ, RouterOS 7.23`. */
+    provedOn: string;
+    /** Whether a read or an apply refuses a device on another version. */
+    checked: boolean;
+};
+/** The switch rules a render makes from a device's hardware ACLs, counted. */
+export type SwitchRules = {
+    /** How many rules there are. */
+    count: number;
+    /** How many distinct port ranges they use, such as `0-1023`. */
+    ranges: number;
+};
+export declare abstract class Platform {
+    /** The name a device's `platform` field takes. */
+    abstract readonly name: PlatformName;
+    abstract readonly os: OsSupport;
+    /** File extension of a saved snapshot, for syntax highlighting. */
+    abstract readonly extension: string;
+    /** How the platform's serial console asks for a login and shows its prompt. Present when the platform can be read and applied through a console, `--console`, and opened with `circuit console`. */
+    readonly console: ConsoleDialect | undefined;
+    /** Fields this platform cannot express. Validation fails on any of them, so nothing is skipped silently. */
+    abstract unsupported(device: Device): string[];
+    /** The switch rules the render makes from the device's hardware ACLs, so `validate` can hold them to the model's limits. Absent on a platform whose rules are not counted. */
+    switchRules?(device: Device): SwitchRules;
+    /** The whole configuration the device should run. Secrets appear as markers, never values. */
+    abstract render(device: Device): string;
+    /** What the device runs now, secrets removed, in the form `render` produces where the platform allows. */
+    abstract read(device: Device, network: readonly Device[], options?: ReadOptions): Promise<string>;
+    /** The LLDP neighbors the device sees, by Circuit's port names, for `snapshot` to save. Absent on a platform whose LLDP command and its output are not proved on a device yet. */
+    neighbors?(device: Device, network: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /** What it takes to go from `current` to `desired`. */
+    abstract plan(desired: string, current: string, options: ApplyOptions): Plan;
+    /** Replace the contents of a prefix set fetched from a registry. Absent on a platform that cannot hold one. */
+    fill?(device: Device, network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+    /** Send a plan, keeping the device reachable or restoring it. */
+    abstract apply(device: Device, network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+    /** Whether a command only reads on this platform, so `circuit show` may send it. Anything not known to only read is refused. */
+    abstract readOnly(command: string): boolean;
+    /** Log in for commands that only read, over SSH or on the console, the way the platform's read logs in. */
+    abstract session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    /** Each BGP neighbor in the config, in its order, with its live session, read over a `session()`. Absent on a platform `circuit bgp` does not support yet. */
+    bgpSessions?(device: Device, session: ReadSession): Promise<BgpSession[]>;
+    /** The device's BGP log lines from the last `minutes`, by the device's own clock, read over a `session()`. */
+    bgpLog?(session: ReadSession, minutes: number): Promise<BgpLogLine[]>;
+    /**
+     * Checks that the device is healthy after an apply, not only that it took the commands. Called before the plan is sent, to read what the checks compare against; the CLI runs them after the apply and the snapshot. Absent on a platform with no checks yet.
+     */
+    health?(device: Device, plan: Plan, options?: HealthOptions): Promise<HealthCheck>;
+}

package/dist/types/platforms/raisecom-ros/index.d.ts

@@ -0,0 +1,71 @@
+import type { ClientChannel } from "ssh2";
+import type { Neighbor } from "../../core/cabling";
+import type { Device } from "../../schema";
+import { type ConsoleDialect } from "../../transport/console";
+import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform";
+/** A session, and how to prove access in a fresh login: a new SSH session, or logging out and in again on the console. */
+export type Session = {
+    channel: ClientChannel;
+    close: () => void;
+    fresh: () => Promise<Session>;
+};
+export declare class RaisecomRos extends Platform {
+    /** How the console asks for a login and shows its prompt. Not yet proved on a device: the RAX721's console was never cabled to a jump host. */
+    static readonly CONSOLE: ConsoleDialect;
+    /** Lines the device prints whatever is configured, or that are part of moving around the CLI. */
+    private static readonly DEVICE_FACTS;
+    /** Lines whose opposite is not `no` and the line. */
+    private static readonly OPPOSITES;
+    /** Lines whose removal takes only their keyword, not their value. */
+    private static readonly UNDO_BY_KEYWORD;
+    private static readonly DIALECT;
+    /** The firmware offers only an `ssh-rsa` host key, so that one is allowed for this platform alone. Key exchange, cipher and MAC still negotiate modern ones. */
+    private static readonly HOST_KEYS;
+    /** How long a dump may go quiet before the prompt, as on a lossy path where a retransmit stalls it for seconds, and how long it may take in all. */
+    private static readonly DUMP_QUIET;
+    private static readonly DUMP_LIMIT;
+    /** What the device prints when it refuses a line. */
+    private static readonly REFUSED;
+    /** Lines that ask for `y` and do nothing without it. */
+    private static readonly CONFIRM;
+    /** A service letting go of an access-list, so the list can change. */
+    private static readonly RELEASE;
+    /** Lines that each add one more of a kind rather than set a value: `snmp-server access-list 1001` beside `1000` binds both. */
+    private static readonly STANDALONE;
+    /** Commands that only read. A `?` sent by a script is run, so a line with one is refused. */
+    private static readonly READS;
+    readonly name = "raisecom-ros";
+    readonly os: OsSupport;
+    readonly extension = ".txt";
+    readonly console: ConsoleDialect;
+    unsupported(device: Device): string[];
+    render(device: Device): string;
+    /** What the device runs, credentials scrubbed. */
+    read(device: Device, _network: readonly Device[], options?: ReadOptions): Promise<string>;
+    /** Read `show running-config` until it ends at the prompt, or until it goes quiet for too long or takes too long in all. */
+    private static dump;
+    /** The LLDP neighbors from `show lldp remote detail`, which spells each port in full. The short form abbreviates ports (`TGE1/3/3`) and pads columns, so a name with a space cannot be told apart there. */
+    neighbors(device: Device, _network: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /**
+     * The neighbors in `show lldp remote detail`: a `<port> has N remotes:` line per port, then a block per remote of `Key: value` lines. A long value wraps onto lines that start with spaces, cut mid-word.
+     *
+     * A remote without a system name is named by its chassis ID. A port the catalog does not have, such as the out-of-band port, is left out.
+     */
+    static lldpRemotes(text: string, device: Device): Neighbor[];
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    apply(device: Device, _network: readonly Device[], plan: Plan, options: ApplyOptions): Promise<void>;
+    readOnly(command: string): boolean;
+    /** One shell for every command, as the platform takes commands only there. */
+    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    private static undo;
+    /** An interactive shell, paging off, over SSH or on the console. A session that does not answer as ROS is refused, so nothing meant for it can reach another shell. */
+    private static open;
+    private static sshShell;
+    private static consoleShell;
+    /** The ports, by their `interface` line, that filter what they take in with an access-list. */
+    private static filteredPorts;
+    /** Services holding an access-list. It cannot change while any of them does. */
+    private static holders;
+    /** The VLAN IDs of a `create vlan 10,20-30 active` line. */
+    private static createdIds;
+}

package/dist/types/platforms/raisecom-ros/render.d.ts

@@ -0,0 +1,41 @@
+import type { Device, SnmpUser } from "../../schema";
+/** The configuration a Raisecom ROS device should run. */
+export declare class RaisecomRosRender {
+    /** The access-list that guards every management service. */
+    static readonly MANAGEMENT_ACL = 1000;
+    /** The access-list that guards SNMP when it has sources of its own. */
+    static readonly SNMP_ACL = 1001;
+    /** A log level as the platform prints it, a number. It takes the names too (`warnings`), but prints the number. */
+    private static readonly LOG_LEVELS;
+    /** The most MAC addresses port security takes on a port, and its default. */
+    static readonly MAC_LIMIT_MAX = 1024;
+    /** A kind of frame as a MAC access-list rule matches it, in the form the device prints. It takes a type as hex without `0x`, and names IPv4 and ARP. */
+    private static readonly ETHERTYPES;
+    /** The log level and UDP port a log host has unless told otherwise. Neither prints. */
+    private static readonly LOG_DEFAULTS;
+    /** The SNMPv3 authentication each `auth` takes on this platform. One missing here cannot be expressed. */
+    static readonly SNMP_AUTH: Partial<Record<SnmpUser["auth"], string>>;
+    /** The OSPF process number. */
+    private static readonly OSPF_PROCESS;
+    /** The SNMPv3 access group every user belongs to, read-only on the whole tree. */
+    private static readonly SNMP_GROUP;
+    /** `99,200-201,999`, the platform's compression of a VLAN list. */
+    static vlanList(ids: number[]): string;
+    /** The whole configuration of a device. */
+    static of(device: Device): string;
+    /** An access-list permitting `sources`, then denying the rest. Its description takes one word. */
+    private static accessList;
+    /** Access or trunk membership, for a port or a LAG. */
+    private static switching;
+    /** A VRRP group. The platform enables a group once it has an address, and preempts unless told not to. */
+    private static vrrp;
+    /** A port the config does not declare is shut down. A LAG member holds its membership and description; the LAG holds the rest. */
+    private static physicalPort;
+    /** The MAC access-list of the port at `index` in the catalog, for its `ethertypes`. MAC access-lists are 3000 and up. */
+    /** The BFD session for each next hop a static route watches, numbered from 1 in the order the routes come, with the VLAN its interface is on. A next hop on no VLAN interface's network has none. */
+    static bfdSessions(device: Device): Map<string, {
+        id: number;
+        vlan: string;
+    }>;
+    static ethertypeAcl(index: number): number;
+}

package/dist/types/platforms/routeros/export.d.ts

@@ -0,0 +1,59 @@
+export type Command = {
+    /** The menu the command belongs to, such as `/ip address`. */
+    menu: string;
+    verb: "add" | "set";
+    /** What a `set` addresses: `[ find default-name=ether1 ]`, `ftp`, `1`, or nothing for a menu of one. */
+    selector: string;
+    /** Words without a value, such as `blackhole`. */
+    flags: string[];
+    /** Properties, unquoted and unescaped. */
+    attrs: Record<string, string>;
+};
+export type Parsed = {
+    commands: Command[];
+    /** Address lists whose entries are filled by `refresh`, not by the render. */
+    generated: Set<string>;
+};
+export declare class RouterOsExport {
+    /**
+     * Values the platform holds when nothing was set, per menu, and under `*` for every menu.
+     *
+     * A property at its default is dropped from both sides of a comparison, and this is the value a property the config does not state is reset to. A property the device holds that is not here cannot be reset, which the plan reports as a problem.
+     */
+    private static readonly DEFAULTS;
+    /** Whether each `/ip service` ships disabled. */
+    private static readonly SERVICE_DISABLED;
+    /** Helpers of `/ip firewall service-port` that ship disabled. The rest ship enabled. */
+    private static readonly HELPER_DISABLED;
+    /** A property the device stops printing once another returns to its default. Resetting that other one clears it, so it is never reset on its own. */
+    static readonly CLEARED_WITH: Record<string, Record<string, string>>;
+    /** Properties whose value cannot be read back from the device. They are compared only by the presence of what holds them. */
+    static readonly SECRET_KEYS: Set<string>;
+    /** Properties that tell two `add` entries of a menu apart. `name` where the menu is not listed. */
+    private static readonly IDENTITY;
+    /** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
+    static readonly ORDERED: Set<string>;
+    /** Undo the line wrapping an export applies: a backslash at the end of a line continues it. */
+    private static unwrap;
+    /** A quoted value without its quotes and escapes. `\_` is an escaped space. */
+    private static unquote;
+    /** Split a command into words, keeping quoted values and bracketed selectors whole. */
+    private static words;
+    /** One `add` or `set` line into a command. */
+    private static parseLine;
+    static parse(text: string): Parsed;
+    /** The default of one property of a command, or undefined when it is not known. */
+    static defaultOf(command: Command, property: string): string | undefined;
+    /** How the renderer writes a secret. */
+    static isSecretMarker(value: string): boolean;
+    /** A filter rule as the platform prints it, with its own spacing, squeezed so that only a real change survives. */
+    private static canonicalRule;
+    /** One property value in the form both sides compare in. */
+    private static normalValue;
+    /** A command's properties without defaults or secrets, in the form both sides compare in. */
+    static normal(command: Command): Record<string, string>;
+    /** What identifies an `add` entry, so that the same entry is found on both sides. */
+    static identity(command: Command): Record<string, string>;
+    /** One command as a string that is equal for equal commands. */
+    static canonical(command: Command): string;
+}

package/dist/types/platforms/routeros/index.d.ts

@@ -0,0 +1,96 @@
+import type { Neighbor } from "../../core/cabling";
+import type { Device, Family } from "../../schema";
+import { type ConsoleDialect } from "../../transport/console";
+import { type ApplyOptions, type BgpLogLine, type BgpSession, type HealthCheck, type HealthOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, type SwitchRules, Platform } from "../platform";
+export declare class RouterOs extends Platform {
+    /** How the RouterOS console asks for a login. The flags after the user turn off colours and terminal detection, without which the console redraws every line. */
+    static readonly CONSOLE: ConsoleDialect;
+    /** Why a MAC limit is refused: neither a bridge port nor a switch port has a learning limit on 7.23.5. */
+    private static readonly NO_MAC_LIMIT;
+    /** The major version this adapter renders for. Version 6 has a different BGP and filter language altogether. */
+    private static readonly SUPPORTED_MAJOR;
+    /** Both dumps stamp the time they were taken. Without the stamp, an unchanged device reads the same twice. */
+    private static readonly EXPORT_TIMESTAMP;
+    /** Lists certificates in the form the renderer writes them, since an export does not include them. One line, because a script sent over exec runs as one. */
+    private static readonly LIST_CERTIFICATES;
+    /** Every BGP session, one line each: name, remote address, established, prefixes received, uptime. One line, because a script sent over exec runs as one. */
+    private static readonly LIST_BGP_SESSIONS;
+    /**
+     * Every LLDP neighbor, one line each: our interfaces, the port first and then the LAG and bridge it is in, the far system name, and the far port as LLDP reports it. `:tostr` keeps the interface list one value; joined to a string as it is, a list repeats the whole line for each of its items. One line, because a script sent over exec runs as one.
+     */
+    private static readonly LIST_NEIGHBORS;
+    /** BGP log lines, without the `connection ...` lines a session that cannot connect repeats. */
+    private static readonly BGP_LOG;
+    /** The device's date and time, in the form its log prints: `2026-10-24 03:12:44`. */
+    private static readonly CLOCK;
+    /** The switch chip's rules. A rule it cannot hold is invalid, and so is every rule after it, with no log line (TRAPS.md). */
+    private static readonly SWITCH_RULES;
+    private static readonly COUNT_INVALID_SWITCH_RULES;
+    private static readonly ROLLBACK_SCHEDULER;
+    /** Commands that only read: print, monitor, ping, traceroute, torch, profile, sniffer quick, an AS-path regex test, export, and `:put`, `:foreach` or `:delay` scripts. */
+    private static readonly READS;
+    /** Words that change something, or print secrets. A command with any of them is refused, whatever else it holds. */
+    private static readonly WRITES;
+    /** Flags after the user over SSH: no colours, no terminal detection, 300 columns, so output is plain and lines are not cut. */
+    private static readonly PLAIN_OUTPUT;
+    readonly name = "routeros";
+    readonly os: OsSupport;
+    readonly extension = ".rsc";
+    readonly console: ConsoleDialect;
+    unsupported(device: Device): string[];
+    render(device: Device): string;
+    switchRules(device: Device): SwitchRules;
+    /**
+     * What the device runs: its export, its users, and its certificates. Secrets are not part of an export.
+     */
+    read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
+    plan(desired: string, current: string, options: ApplyOptions): Plan;
+    apply(device: Device, _network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
+    readOnly(command: string): boolean;
+    /** Over SSH, each command runs on its own. */
+    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
+    /**
+     * A session is named `<connection>-<n>`, but a renamed connection keeps its session's old name until the session restarts. So a neighbor is matched by its address first, then by name.
+     */
+    bgpSessions(device: Device, session: ReadSession): Promise<BgpSession[]>;
+    /** A `time>` filter in `/log print` does not filter, so the lines are kept here by comparing each one's time with the device's clock. */
+    bgpLog(session: ReadSession, minutes: number): Promise<BgpLogLine[]>;
+    /**
+     * Two checks after an apply. When the plan touched switch rules, none may be invalid. BGP sessions established before the apply must be established again, within `BgpWait.AFTER_APPLY`.
+     */
+    health(device: Device, plan: Plan, options?: HealthOptions): Promise<HealthCheck>;
+    /** The LLDP neighbors the device sees, by Circuit's port names. */
+    neighbors(device: Device, network: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
+    /** One line of `LIST_NEIGHBORS` as a neighbor. Our port is the first interface, by Circuit's name when it is a port. */
+    private static neighbor;
+    /**
+     * RouterOS reports the far port's description, where it has one, not its name (TRAPS.md). When it is the description of exactly one port of that device in the network, that port is the far port, by Circuit's name; otherwise the report stays as it is.
+     */
+    private static farPort;
+    /** Replace a list's entries in batches, so each command stays a sane length. */
+    fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+    /** The names of the configured neighbors whose session is established now. None, without logging in, on a device without BGP neighbors. */
+    private establishedSessions;
+    /** Wait until every one of these neighbors is established again, and give a problem for each that is not when time runs out. */
+    private bgpBack;
+    /** A problem when any switch rule is invalid, saying what to do. */
+    private static invalidSwitchRules;
+    /** Log in over SSH. `flags` go after the user, as RouterOS reads them: `+ct300w`. */
+    private static login;
+    private static sshSession;
+    /** Log in on the console. `settle` is the quiet after the prompt a command waits for, as `ConsoleShell` takes it. */
+    private static consoleSession;
+    /** Log in over SSH, or on the console when asked. */
+    private static open;
+    /** Refuse a device on a version this adapter does not render for, before anything is read or sent. */
+    private static checkVersion;
+    /** A time as the clock and the log print it, `2026-10-24 03:12:44`, in milliseconds. Both are read the same way, so the computer's time zone does not matter. Not a number when the text is not such a time. */
+    private static logTime;
+    private static withoutTimestamp;
+    /** Escape a command so it can sit inside a quoted string on the device. */
+    private static escapeForString;
+    /** Compile a command on the device without running it. Returns why it was refused, or undefined. */
+    private static refusal;
+    /** Upload a certificate and its key, import both under one name, and delete the files. */
+    private static installCertificate;
+}

package/dist/types/{adapters/devices → platforms}/routeros/models.d.ts

@@ -10,5 +10,9 @@ export declare const models: {
             readonly "25g": "sfp28-{n}";
             readonly "1g": "ether{n}";
         };
+        readonly limits: {
+            readonly lag_members: 8;
+            readonly switch_port_ranges: 5;
+        };
     };
 };