@takodotid/circuit 0.34.3 → 0.36.0

package/dist/presets/index.js

@@ -1,394 +0,0 @@
-import {
-  contains2
-} from "../chunks/index-v8zgr7wm.js";
-
-// src/presets/index.ts
-var MARTIANS = ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
-var PRIVATE_RANGES = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
-var antiSpoofing = (vlan, sources) => sources.map((src) => ({
-  description: `${vlan}: drop source ${src}`,
-  match: { vlan, src },
-  action: "drop"
-}));
-var AMPLIFIERS = {
-  qotd: 17,
-  chargen: 19,
-  dns: 53,
-  portmap: 111,
-  ntp: 123,
-  netbios: 137,
-  snmp: 161,
-  cldap: 389,
-  slp: 427,
-  rip: 520,
-  "ms-sql": 1434,
-  ssdp: 1900,
-  ard: 3283,
-  "ws-discovery": 3702,
-  mdns: 5353,
-  coap: 5683,
-  ubiquiti: 10001,
-  memcached: 11211,
-  dvr: 37810
-};
-var ASKED = new Set([AMPLIFIERS.dns, AMPLIFIERS.ntp, AMPLIFIERS.snmp]);
-function antiAmplification(destinations, options = {}) {
-  return destinations.flatMap((dst) => [
-    ...(options.keep_fragments ?? []).filter((prefix) => contains2(dst, prefix)).map((prefix) => ({
-      description: `UDP fragments to ${prefix} kept`,
-      match: { protocol: "udp", dst: prefix, src_port: 0 },
-      action: "accept"
-    })),
-    { description: `UDP fragments to ${dst}`, match: { protocol: "udp", dst, src_port: 0 }, action: "drop" },
-    ...Object.entries(AMPLIFIERS).flatMap(([name, port]) => ASKED.has(port) ? [
-      {
-        description: `UDP to ${dst} from ${name}, between two servers`,
-        match: { protocol: "udp", dst, src_port: port, dst_port: port },
-        action: "accept"
-      },
-      {
-        description: `UDP to ${dst} from ${name}, to a port below 1024`,
-        match: { protocol: "udp", dst, src_port: port, dst_port: { min: 0, max: 1023 } },
-        action: "drop"
-      }
-    ] : [{ description: `UDP to ${dst} from ${name}`, match: { protocol: "udp", dst, src_port: port }, action: "drop" }])
-  ]);
-}
-var BAD_TCP_FLAGS = [
-  ["FIN+SYN", ["fin", "syn"], []],
-  ["SYN+RST", ["syn", "rst"], []],
-  ["FIN+RST", ["fin", "rst"], []],
-  ["FIN without ACK", ["fin"], ["ack"]],
-  ["FIN+URG", ["fin", "urg"], []],
-  ["Xmas scan", ["fin", "syn", "psh", "urg"], []]
-];
-var badTcpFlags = () => BAD_TCP_FLAGS.map(([name, set, unset]) => ({
-  description: `Bad flags ${name}`,
-  match: { protocol: "tcp", tcp_flags: { set, unset } },
-  action: "drop"
-}));
-function bgpSanity(lengths = {}) {
-  const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
-  const ipv6 = lengths.ipv6 ?? { min: 16, max: 48 };
-  return [
-    {
-      description: `IPv4 shorter than /${ipv4.min}`,
-      match: { family: "ipv4", prefix_length: { max: ipv4.min - 1 } },
-      action: "reject"
-    },
-    { description: `IPv4 longer than /${ipv4.max}`, match: { family: "ipv4", prefix_length: { min: ipv4.max + 1 } }, action: "reject" },
-    {
-      description: `IPv6 shorter than /${ipv6.min}`,
-      match: { family: "ipv6", prefix_length: { max: ipv6.min - 1 } },
-      action: "reject"
-    },
-    { description: `IPv6 longer than /${ipv6.max}`, match: { family: "ipv6", prefix_length: { min: ipv6.max + 1 } }, action: "reject" },
-    { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" }
-  ];
-}
-function neighborPolicies(device) {
-  const bgp = device.routing?.bgp;
-  return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
-    const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
-    return {
-      name,
-      address: neighbor.address,
-      role: neighbor.role ?? group?.role,
-      import: neighbor.import ?? group?.import,
-      export: neighbor.export ?? group?.export
-    };
-  });
-}
-function offered(device, policy) {
-  const rules = policy ? device.policies?.[policy] ?? [] : [];
-  return rules.filter((rule) => rule.action === "accept" && rule.match?.prefix).map((rule) => rule.match.prefix);
-}
-var exportsEndInReject = (devices) => {
-  const findings = [];
-  for (const device of devices) {
-    for (const neighbor of neighborPolicies(device)) {
-      if (neighbor.role === "customer")
-        continue;
-      const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
-      if (neighbor.export && (last?.action !== "reject" || last.match)) {
-        findings.push({
-          level: "error",
-          device: device.name,
-          message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`
-        });
-      }
-    }
-  }
-  return findings;
-};
-var vlansOf = (port) => [port.access_vlan, ...port.trunk_vlans ?? []].filter((vlan) => vlan !== undefined);
-var trustBoundary = (boundary) => (devices) => {
-  const untrusted = new Set(boundary.untrusted);
-  const routers = new Set(boundary.routers);
-  const extended = (a, b) => (boundary.extended ?? []).some(([x, y]) => x === a && y === b || x === b && y === a);
-  const findings = [];
-  for (const device of devices) {
-    const isRouter = routers.has(device.name);
-    const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ name, port }] : []);
-    const carriers = [
-      ...ports.filter(({ port }) => !port.lag).map(({ name, port }) => ({
-        what: `port ${name}`,
-        carried: vlansOf(port),
-        faces: port.link ? [port.link.device] : []
-      })),
-      ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [
-        {
-          what: `LAG ${name}`,
-          carried: vlansOf(iface),
-          faces: ports.filter(({ port }) => port.lag === name && port.link).map(({ port }) => port.link.device)
-        }
-      ] : [])
-    ];
-    for (const { what, carried, faces } of carriers) {
-      const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
-      const facesRouter = isRouter || faces.some((name) => routers.has(name));
-      const isExtension = faces.length > 0 && faces.every((name) => extended(device.name, name));
-      if (mixes && !facesRouter && !isExtension) {
-        findings.push({
-          level: "error",
-          device: device.name,
-          message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`
-        });
-      }
-    }
-    if (isRouter)
-      continue;
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-      if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
-        findings.push({
-          level: "error",
-          device: device.name,
-          message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`
-        });
-      }
-    }
-  }
-  return findings;
-};
-var tunnelsOutsideOffered = (devices) => {
-  const findings = [];
-  for (const device of devices) {
-    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
-      if (iface.type !== "gre" && iface.type !== "vxlan")
-        continue;
-      const subnets = (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
-      for (const neighbor of neighborPolicies(device)) {
-        if (!subnets.some((subnet) => contains2(subnet, neighbor.address)))
-          continue;
-        for (const prefix of offered(device, neighbor.export)) {
-          if (contains2(prefix, iface.local)) {
-            findings.push({
-              level: "error",
-              device: device.name,
-              message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`
-            });
-          }
-        }
-      }
-    }
-  }
-  return findings;
-};
-var PREPENDS = [
-  ["once", 1],
-  ["twice", 2],
-  ["three_times", 3]
-];
-var article = (word) => /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
-function communityScheme(scheme) {
-  const { asn } = scheme;
-  const community = (fn, parameter) => `${asn}:${fn}:${parameter}`;
-  const ours = { standard: [`${asn}:*`], large: [`${asn}:*:*`] };
-  const information = [scheme.learned_from?.function, scheme.learned_at?.function, scheme.learned_from_as].filter((fn) => fn !== undefined);
-  const tag = (neighborClass, neighborAs, options = {}) => {
-    const { site, trusted = false } = options;
-    if (scheme.learned_at && site === undefined)
-      throw new Error(`communityScheme: tag for AS${neighborAs} needs a site, for learned_at`);
-    return {
-      description: `Learned from AS${neighborAs}`,
-      set: {
-        remove_communities: ours.standard,
-        remove_large_communities: trusted ? information.map((fn) => community(fn, "*")) : ours.large,
-        add_large_communities: [
-          ...scheme.learned_from ? [community(scheme.learned_from.function, scheme.learned_from.classes[neighborClass])] : [],
-          ...scheme.learned_at ? [community(scheme.learned_at.function, site)] : [],
-          ...scheme.learned_from_as !== undefined ? [community(scheme.learned_from_as, neighborAs)] : []
-        ]
-      }
-    };
-  };
-  const blackhole = (prefixSets) => {
-    const fn = scheme.blackhole?.function;
-    if (fn === undefined)
-      throw new Error("communityScheme: blackhole needs a function number in the scheme");
-    return prefixSets.map((prefixSet) => ({
-      description: "Blackhole, asked by the neighbor",
-      match: { large_community: community(fn, 0), prefix_set: prefixSet },
-      set: { blackhole: true },
-      action: "accept"
-    }));
-  };
-  const actions = (neighborAs) => {
-    const passOn = scheme.blackhole?.upstreams?.[neighborAs];
-    return [
-      ...scheme.blackhole !== undefined && !passOn ? [
-        {
-          description: "Blackholed here, never announced",
-          match: { large_community: community(scheme.blackhole.function, 0) },
-          action: "reject"
-        }
-      ] : [],
-      ...scheme.do_not_announce !== undefined ? [
-        {
-          description: "Asked not to be announced anywhere",
-          match: { large_community: community(scheme.do_not_announce, 0) },
-          action: "reject"
-        },
-        {
-          description: `Asked not to be announced to AS${neighborAs}`,
-          match: { large_community: community(scheme.do_not_announce, neighborAs) },
-          action: "reject"
-        }
-      ] : [],
-      ...scheme.blackhole !== undefined && passOn ? [
-        {
-          description: `Blackhole passed on to AS${neighborAs}`,
-          match: { large_community: community(scheme.blackhole.function, 0) },
-          set: {
-            remove_communities: ours.standard,
-            remove_large_communities: ours.large,
-            add_communities: [passOn]
-          },
-          action: "accept"
-        }
-      ] : [],
-      ...PREPENDS.flatMap(([name, times]) => {
-        const fn = scheme.prepend?.[name];
-        if (fn === undefined)
-          return [];
-        return [
-          {
-            description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
-            match: { large_community: community(fn, neighborAs) },
-            set: { prepend: times }
-          }
-        ];
-      }),
-      {
-        description: "Our communities stay inside our network",
-        set: { remove_communities: ours.standard, remove_large_communities: ours.large }
-      }
-    ];
-  };
-  const catalogue = [
-    ...Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
-      community: community(scheme.learned_from.function, value),
-      description: `Learned from ${article(name)}`
-    })),
-    ...scheme.learned_at ? [
-      ...Object.entries(scheme.learned_at.sites ?? {}).map(([site, name]) => ({
-        community: community(scheme.learned_at.function, site),
-        description: `Learned in ${name}`
-      })),
-      { community: community(scheme.learned_at.function, "nnn"), description: "Learned at site $0" }
-    ] : [],
-    ...scheme.learned_from_as !== undefined ? [{ community: community(scheme.learned_from_as, "nnn"), description: "Learned from AS$0" }] : [],
-    ...scheme.do_not_announce !== undefined ? [
-      { community: community(scheme.do_not_announce, 0), description: "Do not announce to anyone" },
-      { community: community(scheme.do_not_announce, "nnn"), description: "Do not announce to AS$0" }
-    ] : [],
-    ...PREPENDS.flatMap(([name]) => {
-      const fn = scheme.prepend?.[name];
-      return fn === undefined ? [] : [{ community: community(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
-    }),
-    ...scheme.blackhole !== undefined ? [
-      {
-        community: community(scheme.blackhole.function, 0),
-        description: Object.keys(scheme.blackhole.upstreams ?? {}).length ? `Blackhole: dropped in AS${asn} and by its upstreams that take it` : `Blackhole: dropped in AS${asn}, not announced further`
-      }
-    ] : []
-  ];
-  return { community, tag, actions, blackhole, catalogue };
-}
-function internetExchange(exchange, members) {
-  const percent = exchange.storm_percent ?? 1;
-  const ports = (device) => {
-    const result = {};
-    for (const member of members) {
-      const port = member.ports[device];
-      if (!port)
-        continue;
-      result[port] = {
-        description: `${member.name}, AS${member.asn}`,
-        access_vlan: exchange.vlan,
-        stp: false,
-        lldp: false,
-        storm_control: { broadcast: { percent }, multicast: { percent }, unknown_unicast: { percent } }
-      };
-    }
-    return result;
-  };
-  const check = (devices) => {
-    const findings = [];
-    const error = (message, device) => findings.push({ level: "error", ...device ? { device } : {}, message });
-    const taken = new Map((exchange.reserved ?? []).map((address) => [address, "reserved"]));
-    const portHolders = new Map;
-    members.forEach((member, index) => {
-      for (const other of members.slice(index + 1)) {
-        if (other.name === member.name)
-          error(`member ${member.name} is declared twice`);
-        if (other.asn === member.asn)
-          error(`members ${member.name} and ${other.name} share AS${member.asn}`);
-      }
-      for (const [address, lan] of [
-        [member.ipv4, exchange.lan.ipv4],
-        [member.ipv6, exchange.lan.ipv6]
-      ]) {
-        if (!address)
-          continue;
-        if (!lan || !contains2(lan, address))
-          error(`${address} of ${member.name} is outside the peering LAN`);
-        const holder = taken.get(address);
-        if (holder)
-          error(`${address} of ${member.name} is already ${holder === "reserved" ? "reserved" : `${holder}'s`}`);
-        taken.set(address, member.name);
-      }
-      for (const [deviceName, portName] of Object.entries(member.ports)) {
-        const holder = portHolders.get(`${deviceName} ${portName}`);
-        if (holder)
-          error(`port ${portName} is given to both ${holder} and ${member.name}`, deviceName);
-        portHolders.set(`${deviceName} ${portName}`, member.name);
-        const device = devices.find((candidate) => candidate.name === deviceName);
-        const port = device?.ports?.[portName];
-        const carried = port ? vlansOf(port) : [];
-        if (carried.length !== 1 || carried[0] !== exchange.vlan) {
-          error(`port ${portName} of ${member.name} does not carry the peering VLAN alone`, deviceName);
-        }
-      }
-    });
-    return findings;
-  };
-  return { ports, check };
-}
-export {
-  AMPLIFIERS,
-  MARTIANS,
-  PRIVATE_RANGES,
-  antiAmplification,
-  antiSpoofing,
-  badTcpFlags,
-  bgpSanity,
-  communityScheme,
-  exportsEndInReject,
-  internetExchange,
-  neighborPolicies,
-  offered,
-  trustBoundary,
-  tunnelsOutsideOffered,
-  vlansOf
-};

package/dist/types/adapters/devices/catalog.d.ts

@@ -1,86 +0,0 @@
-export declare const catalog: {
-    readonly routeros: {
-        readonly "CCR2216-1G-12XS-2XQ": {
-            readonly ports: {
-                readonly "100g": 2;
-                readonly "25g": 12;
-                readonly "1g": 1;
-            };
-            readonly spelling: {
-                readonly "100g": "qsfp28-{n}-1";
-                readonly "25g": "sfp28-{n}";
-                readonly "1g": "ether{n}";
-            };
-        };
-    };
-    readonly vrp: {
-        readonly "CE6855-48S6Q-HI": {
-            readonly ports: {
-                readonly "10g": 48;
-                readonly "40g": 6;
-            };
-            readonly spelling: {
-                readonly "10g": "10GE1/0/{n}";
-                readonly "40g": "40GE1/0/{n}";
-            };
-        };
-    };
-    readonly "raisecom-ros": {
-        readonly "RAX721-C-6C48": {
-            readonly ports: {
-                readonly "100g": 6;
-                readonly "25g": 24;
-                readonly "10g": 24;
-            };
-            readonly spelling: {
-                readonly "100g": "hundredgige 1/1/{n}";
-                readonly "25g": "twenty-fivegige 1/2/{n}";
-                readonly "10g": "tengigabitethernet 1/3/{n}";
-            };
-        };
-    };
-    readonly junos: {
-        readonly "QFX5100-48S-6Q": {
-            readonly ports: {
-                readonly "40g": 6;
-                readonly "10g": 48;
-                readonly "1g": 2;
-            };
-            readonly spelling: {
-                readonly "40g": "et-0/0/{n+47}";
-                readonly "10g": "xe-0/0/{n-1}";
-                readonly "1g": "em{n-1}";
-            };
-        };
-    };
-    readonly fortios: {
-        readonly "FG-3700D": {
-            readonly ports: {
-                readonly "40g": 4;
-                readonly "10g": 28;
-                readonly "1g": 2;
-            };
-            readonly spelling: {
-                readonly "40g": "port{n}";
-                readonly "10g": "port{n+4}";
-                readonly "1g": "mgmt{n}";
-            };
-        };
-    };
-};
-export type Catalog = typeof catalog;
-export type PlatformName = keyof Catalog;
-export type ModelName<Pl extends PlatformName> = keyof Catalog[Pl] & string;
-type Upto<N extends number, A extends unknown[] = [], R = never> = A["length"] extends N ? R : Upto<N, [...A, 0], R | `${[...A, 0]["length"]}`>;
-type PortsOf<Pl extends PlatformName, M extends ModelName<Pl>> = Catalog[Pl][M] extends {
-    ports: infer P;
-} ? P : never;
-/** `10g-1` to `10g-48` on a model with 48 10G ports. */
-export type PortName<Pl extends PlatformName, M extends ModelName<Pl>> = {
-    [S in keyof PortsOf<Pl, M>]: `${S & string}-${Upto<PortsOf<Pl, M>[S] & number>}`;
-}[keyof PortsOf<Pl, M>];
-/** Every port a model has, in order. */
-export declare function portsOf(platform: string, model: string): string[];
-/** The platform's own name for a port. */
-export declare function spell(platform: string, model: string, port: string): string;
-export {};

package/dist/types/adapters/devices/derive.d.ts

@@ -1,7 +0,0 @@
-import type { Device } from "../../schema";
-/** Each LAG's number: its own `id`, or its position among the device's LAGs. */
-export declare function lagIds(device: Device): Map<string, number>;
-/** The IPv4 networks of a port's or an interface's addresses. */
-export declare function ipv4Networks(device: Device, iface: string): string[];
-/** Fields neither switch platform, VRP nor Raisecom ROS, expresses: a service's own sources or port, a user's description or keys, the IP stack's host settings, a point-to-point address, and offload per interface. */
-export declare function switchUnsupported(device: Device): string[];

package/dist/types/adapters/devices/fortios/firewall.d.ts

@@ -1,23 +0,0 @@
-import type { AclRule, Device, Family, FilterMatch, FilterRule, NatRule, Ports, Protocol } from "../../../schema";
-import { Block } from "./tree";
-/** IP protocol numbers, for a protocol the platform names only by number. */
-export declare const PROTOCOL_NUMBER: Record<Protocol, number>;
-/** NAT rules of both directions, which central NAT needs turned on. */
-export declare function natRules(device: Device): NatRule<string, string>[];
-/** Which families a rule applies to: its own, its addresses', or both. */
-export declare function familiesOf(device: Device, match: FilterMatch<string, string> | undefined): Family[];
-/** A port or ports as the platform writes them in a service: `22`, `1000-2000`. */
-export declare function portList(ports: Ports | undefined): string[];
-/** Every protocol, as a service of Circuit's own, for a device in transparent mode. */
-export declare const ALL_IN_TRANSPARENT = "circuit-all";
-/** The service a rule matches, by name, with what it holds. `ALL` when the rule names no protocol and no port; ports without a protocol are TCP's and UDP's. */
-export declare function serviceOf(match: FilterMatch<string, string> | undefined, family: Family): {
-    name: string;
-    block?: Block;
-};
-/** A rule the platform keeps without being told: replies to a session it let through, and packets that belong to one, pass on their own. */
-export declare function isImplied(rule: FilterRule<string, string>): boolean;
-/** Packet filtering, who reaches the device, NAT and stateless ACLs. */
-export declare function firewall(root: Block, device: Device): void;
-/** Whether a port's ACL drops before it accepts: an accept before a drop is an exception the platform's ACLs cannot hold. */
-export declare function acceptsBeforeDrop(rules: readonly AclRule<string>[]): boolean;

package/dist/types/adapters/devices/fortios/index.d.ts

@@ -1,58 +0,0 @@
-import type { Client } from "ssh2";
-import type { Device, Family } from "../../../schema";
-import { type ConsoleDialect } from "../../../transport/console";
-import type { ApplyOptions, DeviceAdapter, Plan, ReadOptions } from "../types";
-/** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
-export type Channel = {
-    write(data: string): unknown;
-    on(event: "data", listener: (chunk: Buffer) => void): unknown;
-    on(event: "close", listener: () => void): unknown;
-    removeListener(event: "data", listener: (chunk: Buffer) => void): unknown;
-    removeListener(event: "close", listener: () => void): unknown;
-};
-/** A CLI over a channel: one line at a time, and what the device printed until its prompt came back. */
-export declare class Cli {
-    private readonly channel;
-    private readonly newline;
-    /** The prompt that ended the last answer, which shows where the session is: `(port1)` inside an entry. */
-    prompt: string;
-    constructor(channel: Channel, newline?: string);
-    /** Wait for the prompt, after logging in. */
-    ready(timeout?: number): Promise<void>;
-    /** Send one line and return what the device printed after it, without the echo or the prompt. */
-    run(line: string, timeout?: number): Promise<string>;
-    /** Answer a question the device asked. */
-    answer(reply: "y" | "n", timeout?: number): Promise<string>;
-    /** What the device prints until its prompt or a question. A session the device ended, or that went silent, fails. */
-    private collect;
-}
-export declare function login(device: Device): Promise<Client>;
-/** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
-export declare const FORTIOS_CONSOLE: ConsoleDialect;
-/** Refuse a device on a release this adapter was not proved on, before anything is read or sent. */
-export declare function checkVersion(cli: Cli, device: Device): Promise<void>;
-/** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
-export declare function scrub(text: string): string;
-/** Every section Circuit manages, as the device holds it, credentials scrubbed. */
-export declare function readConfig(cli: Cli, device: Device): Promise<string>;
-export declare function read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
-/**
- * A line with each secret's value in place, escaped inside its quotes. A certificate's key from a variable is PEM encoded as one line of base64, and is sent as the PEM it holds. A file saved with Windows line endings is sent with plain ones: the CLI takes each carriage return as a line of its own, and refuses the key, `Invalid private key`. A `?`, which the CLI takes as a call for help, is typed literally.
- */
-export declare function withSecrets(line: string): string;
-/** How a change that could cut access is guarded: the device reloads its saved configuration after `seconds` unless `prove` shows access survived. */
-export type Guard = {
-    seconds: number;
-    prove: () => Promise<void>;
-};
-/**
- * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
- */
-export declare function configure(cli: Cli, plan: Plan, guard: Guard): Promise<void>;
-export declare function apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
-/** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
-export declare function fillLines(set: string, family: Family, prefixes: string[]): string[];
-/** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */
-export declare function fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
-export declare function unsupported(device: Device): string[];
-export declare const fortios: DeviceAdapter;

package/dist/types/adapters/devices/fortios/names.d.ts

@@ -1,48 +0,0 @@
-import type { Device, Family } from "../../../schema";
-type Addressed = {
-    addresses?: readonly (string | {
-        address: string;
-        peer?: string;
-    })[];
-    vrf?: string;
-    lag?: string;
-};
-/** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
-export declare function bridgesOf(device: Device): {
-    name: string;
-    members: readonly string[];
-}[];
-/** Whether the device runs in transparent mode: it has a bridge. */
-export declare const isTransparent: (device: Device) => boolean;
-/**
- * The management address of a device in transparent mode: the one IPv4 address on a port or an interface outside every bridge. The device answers on it, the platform's `manageip`, through that interface alone. Undefined when there is none, and the device is reached only through its console.
- */
-export declare function transparentManagement(device: Device): {
-    name: string;
-    address: string;
-} | undefined;
-/** The forward domain of a VLAN interface in a bridge, or undefined. */
-export declare function forwardDomainOf(device: Device, name: string): number | undefined;
-/** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
-export declare function nameOf(device: Device, name: string): string;
-/** A port's or an interface's settings, by its key. */
-export declare function settingsOf(device: Device, name: string): Addressed | undefined;
-/** Every address of a port or an interface. */
-export declare function addressesOf(settings: Addressed | undefined): string[];
-/** An address or prefix with its length, a bare address taken as a host. */
-export declare const withLength: (value: string) => string;
-/** The family of an address or prefix. */
-export declare const familyOfPrefix: (value: string) => Family;
-/** `192.0.2.0 255.255.255.0`, how the platform writes an IPv4 prefix. */
-export declare const subnet: (prefix: string) => string;
-/** The canonical form of a prefix: its network address and length, a bare address taken as a host. */
-export declare const network: (prefix: string) => string;
-/** The number of a VRF on the platform: its place among the device's VRFs, the default table being 0. */
-export declare function vrfNumber(device: Device, vrf: string | undefined): number;
-/** The interface whose own network holds an address, the most specific when several do, in one routing table. */
-export declare function interfaceFor(device: Device, address: string, vrf?: string): string | undefined;
-/** The interface that holds an address as its own. */
-export declare function holderOf(device: Device, address: string): string | undefined;
-/** Every port and interface with an address, by key, where the device's services answer. */
-export declare function addressed(device: Device): string[];
-export {};

package/dist/types/adapters/devices/fortios/plan.d.ts

@@ -1,28 +0,0 @@
-import type { ApplyOptions, Plan } from "../types";
-import { Block } from "./tree";
-/** How the plan treats the entries of one table. */
-type Table = {
-    /** Entries the factory holds. The plan neither reads nor removes them. */
-    factory?: readonly string[];
-    /** The device keeps the entries in an order of their own, which `move` changes. */
-    ordered?: true;
-    /** An entry is known by what it holds, not by its number. */
-    byContent?: true;
-    /** Settings the device gives an entry it creates. They are unset when the render does not hold them. */
-    created?: (entry: Block) => readonly string[];
-    /** Settings an entry keeps for life. A change deletes the entry and creates it again. */
-    fixed?: readonly string[];
-    /** The device refuses an entry that holds the same as another, `Duplicated entry`, even for a moment while entries are renumbered. */
-    distinct?: true;
-};
-/** Tables whose entries need more than a plain comparison, by section. */
-export declare const TABLES: Record<string, Table>;
-/** The configuration as the plan reads it: factory entries and the device's own settings left out. */
-export declare function clean(text: string): string;
-/**
- * What changes, by section, in the order the render lists them. Entries that go are deleted after everything else, in the reverse order, so nothing is deleted while another section still names it.
- *
- * A secret is sent when its entry is new, or with `secrets` set; it cannot be read back to compare.
- */
-export declare function plan(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
-export {};