@takodotid/circuit 0.43.0 → 0.43.1

package/dist/cli/index.js

@@ -1611,7 +1611,9 @@ class FortiOsPlan {
     "Fortinet_SSL_ED25519",
     "Fortinet_SSL_ED448"
   ];
-  static ORDERED = { ordered: true };
+  static BY_COMMENTS = { keys: [["comments"]] };
+  static ORDERED = { ordered: true, numbered: FortiOsPlan.BY_COMMENTS };
+  static ROUTES = { numbered: { keys: [["comment"]] }, distinct: true };
   static TABLES = {
     "system interface": {
       factory: ["modem", "ssl.root"],
@@ -1636,8 +1638,11 @@ class FortiOsPlan {
     "firewall local-in-policy": FortiOsPlan.ORDERED,
     "firewall local-in-policy6": FortiOsPlan.ORDERED,
     "firewall central-snat-map": FortiOsPlan.ORDERED,
-    "router static": { distinct: true },
-    "router static6": { distinct: true }
+    "firewall acl": { numbered: FortiOsPlan.BY_COMMENTS },
+    "firewall acl6": { numbered: FortiOsPlan.BY_COMMENTS },
+    "firewall vip": { numbered: { keys: [["comment"], ["extintf", "extip", "protocol", "extport"]], prefix: "dnat-" } },
+    "router static": FortiOsPlan.ROUTES,
+    "router static6": FortiOsPlan.ROUTES
   };
   static IGNORED = new Set(["uuid", "snmp-index"]);
   static IGNORED_IN = {
@@ -1798,7 +1803,7 @@ class FortiOsPlan {
     }
     for (const [header, child] of want.blocks)
       nested(header, child, have.blocks.get(header) ?? new FortiOsBlock);
-    const entries = table?.byContent ? FortiOsPlan.byContent(path, want, have) : table?.distinct ? FortiOsPlan.distinctById(path, want, have, table, context) : FortiOsPlan.byId(path, want, have, table, context);
+    const entries = table?.byContent ? FortiOsPlan.byContent(path, want, have) : table?.numbered ? FortiOsPlan.numbered(path, want, have, table, table.numbered, context) : FortiOsPlan.byId(path, want, have, table, context);
     send.push(...entries.send);
     show.push(...entries.show);
     if (top) {
@@ -1840,55 +1845,100 @@ class FortiOsPlan {
       removals.push(`delete ${entry.id}`);
       removed.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
     }
-    if (table?.ordered) {
-      const moved = FortiOsPlan.moves(want, have);
-      send.push(...moved);
-      show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
-    }
     return { send, show, removals, removed };
   }
-  static distinctById(path, want, have, table, context) {
-    const deletes = [];
-    const creates = [];
+  static numbered(path, want, have, table, numbered, context) {
+    const send = [];
     const show = [];
+    const pattern = new RegExp(`^${numbered.prefix ?? ""}(\\d+)$`);
+    const numberOf = (entry) => Number(pattern.exec(FortiOsTree.bare(entry.id))?.[1] ?? NaN);
+    const held = [...have.entries.values()].filter((entry) => !FortiOsPlan.isFactory(table, entry));
+    const kept = new Map;
+    const unmatched = new Set(held.filter((entry) => Number.isInteger(numberOf(entry))));
+    const keep = (key, old) => {
+      kept.set(key, old);
+      unmatched.delete(old);
+    };
+    const alike = Map.groupBy(unmatched, (old) => FortiOsPlan.signature(old.block, context.section));
+    const same = (entry, old) => !FortiOsPlan.compare([], entry.block, old.block, undefined, false, context).send.length;
     for (const [key, entry] of want.entries) {
-      const old = have.entries.get(key);
-      const where = [...path, FortiOsTree.bare(entry.id)];
-      if (old) {
-        if (!FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context).send.length)
-          continue;
-        deletes.push(`delete ${old.id}`);
-        show.push(...FortiOsPlan.shown("-", where, old.block));
+      const candidates = alike.get(FortiOsPlan.signature(entry.block, context.section)) ?? [];
+      const index = candidates.findIndex((old) => same(entry, old));
+      if (index >= 0)
+        keep(key, candidates.splice(index, 1)[0]);
+    }
+    for (const settings of numbered.keys) {
+      const valueOf = (entry) => {
+        const parts = settings.map((setting) => FortiOsPlan.canonical(setting, entry.block.settings.get(setting) ?? ""));
+        return parts.some(Boolean) ? parts.join(`
+`) : undefined;
+      };
+      const changed = Map.groupBy([...want.entries].filter(([key]) => !kept.has(key)), ([, entry]) => valueOf(entry));
+      const left = Map.groupBy(unmatched, valueOf);
+      for (const [value, entries] of changed) {
+        const old = left.get(value);
+        if (value !== undefined && entries.length === 1 && old?.length === 1)
+          keep(entries[0][0], old[0]);
       }
-      creates.push(...FortiOsPlan.creation(entry, table));
-      show.push(...FortiOsPlan.shown("+", where, entry.block));
     }
-    for (const [key, entry] of have.entries) {
-      if (want.entries.has(key) || FortiOsPlan.isFactory(table, entry))
+    let next = Math.max(0, ...[...have.entries.values()].map(numberOf).filter(Number.isInteger)) + 1;
+    const wanted = [];
+    const replaced = [];
+    for (const [key, entry] of want.entries) {
+      const old = kept.get(key);
+      if (!old) {
+        const name = `${numbered.prefix ?? ""}${next++}`;
+        const id = numbered.prefix ? FortiOsTree.quote(name) : name;
+        wanted.push(id);
+        send.push(...FortiOsPlan.creation(entry, table, id));
+        show.push(...FortiOsPlan.shown("+", [...path, name], entry.block));
         continue;
-      deletes.push(`delete ${entry.id}`);
-      show.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
+      }
+      wanted.push(old.id);
+      const where = [...path, FortiOsTree.bare(old.id)];
+      const diff = FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context);
+      if (!diff.send.length)
+        continue;
+      if (table.distinct) {
+        replaced.push(`delete ${old.id}`);
+        send.push(...FortiOsPlan.creation(entry, table, old.id));
+        show.push(...FortiOsPlan.shown("-", where, old.block), ...FortiOsPlan.shown("+", where, entry.block));
+        continue;
+      }
+      send.push(`edit ${old.id}`, ...diff.send, "next");
+      show.push(...diff.show);
     }
-    return { send: [...deletes, ...creates], show, removals: [], removed: [] };
+    const keptEntries = new Set(kept.values());
+    if (table.ordered) {
+      const order = held.filter((entry) => keptEntries.has(entry)).map((entry) => entry.id);
+      const moved = FortiOsPlan.moves(wanted, order);
+      send.push(...moved);
+      show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
+    }
+    const gone = held.filter((entry) => !keptEntries.has(entry));
+    const removals = gone.map((entry) => `delete ${entry.id}`);
+    const removed = gone.flatMap((entry) => FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
+    if (table.distinct)
+      return { send: [...replaced, ...removals, ...send], show: [...removed, ...show], removals: [], removed: [] };
+    return { send, show, removals, removed };
   }
-  static moves(want, have) {
-    const wanted = [...want.entries.keys()];
-    const order = [...have.entries.keys()].filter((key) => want.entries.has(key));
-    order.push(...wanted.filter((key) => !have.entries.has(key)));
+  static moves(wanted, held) {
+    const order = [...held, ...wanted.filter((id) => !held.includes(id))];
     const send = [];
-    const idOf = (key) => want.entries.get(key).id;
     for (let index = 0;index < wanted.length; index++) {
-      if (order[index] === wanted[index])
+      const id = wanted[index];
+      if (order[index] === id)
         continue;
-      const key = wanted[index];
-      send.push(index === 0 ? `move ${idOf(key)} before ${idOf(order[0])}` : `move ${idOf(key)} after ${idOf(wanted[index - 1])}`);
-      order.splice(order.indexOf(key), 1);
-      order.splice(index, 0, key);
+      send.push(index === 0 ? `move ${id} before ${order[0]}` : `move ${id} after ${wanted[index - 1]}`);
+      order.splice(order.indexOf(id), 1);
+      order.splice(index, 0, id);
     }
     return send;
   }
-  static signature(block) {
-    return [...block.settings].map(([key, value]) => `${key} ${FortiOsPlan.canonical(key, value)}`).sort().join(`
+  static signature(block, section = "") {
+    const defaults = FortiOsPlan.DEFAULTS[section] ?? {};
+    const isDefault = (key, value) => defaults[key] !== undefined && FortiOsPlan.canonical(key, defaults[key]) === FortiOsPlan.canonical(key, value);
+    return [...block.settings].filter(([key, value]) => !isDefault(key, value)).map(([key, value]) => `${key} ${FortiOsPlan.canonical(key, value)}`).sort().join(`
 `);
   }
   static byContent(path, want, have) {

package/dist/types/platforms/fortios/plan.d.ts

@@ -5,7 +5,11 @@ export declare class FortiOsPlan {
     private static readonly FACTORY_SERVICES;
     /** The device's own certificates, which the factory makes for each device. */
     private static readonly FACTORY_CERTIFICATES;
+    /** An entry known by what it holds, or else by its description. */
+    private static readonly BY_COMMENTS;
     private static readonly ORDERED;
+    /** A static route known by what it holds, or else by its description. Many routes share a destination, so that is no key. */
+    private static readonly ROUTES;
     /** Tables whose entries need more than a plain comparison, by section. */
     private static readonly TABLES;
     /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
@@ -61,13 +65,19 @@ export declare class FortiOsPlan {
      * What goes is undone before what comes is set, since a setting can hide another: `send-deny-packet` exists only while a policy denies. A nested list that goes is deleted before the settings, since one can hide the list and keep its entries hidden, such as `secondary-IP`; NTP refuses to delete its last server while it synchronises, so `ntpsync` goes before its list.
      */
     private static compare;
-    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted, and an ordered table put in order. */
+    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted. */
     private static byId;
-    /** Entries matched by name in a table that refuses two alike: every entry that changes or goes is deleted before any is created, so none is ever briefly the same as another. */
-    private static distinctById;
-    /** The `move` commands that put a table's entries in the render's order. Kept entries hold their place on the device and new ones are added at the end. */
+    /**
+     * Entries the render numbers by their place, while on the device each keeps the number it was created with, so they are matched by what they are.
+     *
+     * An entry that holds the same as one on the device is kept. One that changes is found by the first of the table's keys that no other entry left to match shares, such as its description, and edited under its own number. Any other is new and takes a number the device does not use; in a table the device keeps in order, it is created at the end and moved into place. An entry on the device that nothing matched is deleted last, so every entry the render keeps stays on the device through the whole change.
+     *
+     * In a `distinct` table, an entry that changes is deleted and created again under its own number, and every deletion comes before any creation.
+     */
+    private static numbered;
+    /** The `move` commands that put a table's entries in the render's order, by the device's numbers: `wanted` in the render's order, `held` the kept ones in the device's. Kept entries hold their place on the device and new ones are added at the end. */
     private static moves;
-    /** An entry's settings in the form two entries compare in, whatever their numbers. */
+    /** An entry's settings in the form two entries compare in, whatever their numbers. A setting at its section's default is left out, as the device does not print it. */
     private static signature;
     /** Entries matched by what they hold. One the device holds and the render does not is deleted; one the render adds takes a number the device does not use. */
     private static byContent;

package/package.json

@@ -1,6 +1,6 @@
 {
     "name": "@takodotid/circuit",
-    "version": "0.43.0",
+    "version": "0.43.1",
     "description": "Declarative, vendor-neutral network configuration: describe each device in TypeScript, and Circuit makes the device match. Alpha.",
     "keywords": [
         "network",

package/src/platforms/fortios/plan.ts

@@ -12,13 +12,17 @@ type Table = {
     factory?: readonly string[];
     /** The device keeps the entries in an order of their own, which `move` changes. */
     ordered?: true;
+    /**
+     * The render numbers the entries by their place, but on the device each keeps the number it was created with. An entry is known by what it holds, or else by the settings of the first of `keys` that only it holds, such as its description. A new entry takes a number the device does not use, after `prefix` when the render names entries so.
+     */
+    numbered?: { keys: readonly (readonly string[])[]; prefix?: string };
     /** An entry is known by what it holds, not by its number. */
     byContent?: true;
     /** Settings the device gives an entry it creates. They are unset when the render does not hold them. */
     created?: (entry: FortiOsBlock) => readonly string[];
     /** Settings an entry keeps for life. A change deletes the entry and creates it again. */
     fixed?: readonly string[];
-    /** The device refuses an entry that holds the same as another, `Duplicated entry`, even for a moment while entries are renumbered. */
+    /** Every entry that changes or goes is deleted before any is created. The device refuses a static route the same as another, `Duplicated entry`, even for a moment. */
     distinct?: true;
 };
 
@@ -154,7 +158,13 @@ export class FortiOsPlan {
         "Fortinet_SSL_ED448",
     ];
 
-    private static readonly ORDERED: Table = { ordered: true };
+    /** An entry known by what it holds, or else by its description. */
+    private static readonly BY_COMMENTS: Table["numbered"] = { keys: [["comments"]] };
+
+    private static readonly ORDERED: Table = { ordered: true, numbered: FortiOsPlan.BY_COMMENTS };
+
+    /** A static route known by what it holds, or else by its description. Many routes share a destination, so that is no key. */
+    private static readonly ROUTES: Table = { numbered: { keys: [["comment"]] }, distinct: true };
 
     /** Tables whose entries need more than a plain comparison, by section. */
     private static readonly TABLES: Record<string, Table> = {
@@ -180,8 +190,12 @@ export class FortiOsPlan {
         "firewall local-in-policy": FortiOsPlan.ORDERED,
         "firewall local-in-policy6": FortiOsPlan.ORDERED,
         "firewall central-snat-map": FortiOsPlan.ORDERED,
-        "router static": { distinct: true },
-        "router static6": { distinct: true },
+        "firewall acl": { numbered: FortiOsPlan.BY_COMMENTS },
+        "firewall acl6": { numbered: FortiOsPlan.BY_COMMENTS },
+        // A virtual IP that changes is also known by the address it answers on.
+        "firewall vip": { numbered: { keys: [["comment"], ["extintf", "extip", "protocol", "extport"]], prefix: "dnat-" } },
+        "router static": FortiOsPlan.ROUTES,
+        "router static6": FortiOsPlan.ROUTES,
     };
 
     /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
@@ -399,8 +413,8 @@ export class FortiOsPlan {
 
         const entries = table?.byContent
             ? FortiOsPlan.byContent(path, want, have)
-            : table?.distinct
-              ? FortiOsPlan.distinctById(path, want, have, table, context)
+            : table?.numbered
+              ? FortiOsPlan.numbered(path, want, have, table, table.numbered, context)
               : FortiOsPlan.byId(path, want, have, table, context);
         send.push(...entries.send);
         show.push(...entries.show);
@@ -416,7 +430,7 @@ export class FortiOsPlan {
         return { send, show, removals, removed };
     }
 
-    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted, and an ordered table put in order. */
+    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted. */
     private static byId(path: string[], want: FortiOsBlock, have: FortiOsBlock, table: Table | undefined, context: Context): Diff {
         const send: string[] = [];
         const show: string[] = [];
@@ -456,70 +470,144 @@ export class FortiOsPlan {
             removed.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
         }
 
-        if (table?.ordered) {
-            const moved = FortiOsPlan.moves(want, have);
-            send.push(...moved);
-            show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
-        }
-
         return { send, show, removals, removed };
     }
 
-    /** Entries matched by name in a table that refuses two alike: every entry that changes or goes is deleted before any is created, so none is ever briefly the same as another. */
-    private static distinctById(path: string[], want: FortiOsBlock, have: FortiOsBlock, table: Table, context: Context): Diff {
-        const deletes: string[] = [];
-        const creates: string[] = [];
+    /**
+     * Entries the render numbers by their place, while on the device each keeps the number it was created with, so they are matched by what they are.
+     *
+     * An entry that holds the same as one on the device is kept. One that changes is found by the first of the table's keys that no other entry left to match shares, such as its description, and edited under its own number. Any other is new and takes a number the device does not use; in a table the device keeps in order, it is created at the end and moved into place. An entry on the device that nothing matched is deleted last, so every entry the render keeps stays on the device through the whole change.
+     *
+     * In a `distinct` table, an entry that changes is deleted and created again under its own number, and every deletion comes before any creation.
+     */
+    private static numbered(
+        path: string[],
+        want: FortiOsBlock,
+        have: FortiOsBlock,
+        table: Table,
+        numbered: NonNullable<Table["numbered"]>,
+        context: Context
+    ): Diff {
+        const send: string[] = [];
         const show: string[] = [];
 
+        // The number in a name the render gives, such as 7 in `dnat-7`. An entry named otherwise is never kept.
+        const pattern = new RegExp(`^${numbered.prefix ?? ""}(\\d+)$`);
+        const numberOf = (entry: Entry) => Number(pattern.exec(FortiOsTree.bare(entry.id))?.[1] ?? NaN);
+
+        const held = [...have.entries.values()].filter((entry) => !FortiOsPlan.isFactory(table, entry));
+        const kept = new Map<string, Entry>();
+        const unmatched = new Set(held.filter((entry) => Number.isInteger(numberOf(entry))));
+
+        const keep = (key: string, old: Entry) => {
+            kept.set(key, old);
+            unmatched.delete(old);
+        };
+
+        // Only entries with the same signature can hold the same, so an entry is compared with those alone.
+        const alike = Map.groupBy(unmatched, (old) => FortiOsPlan.signature(old.block, context.section));
+        const same = (entry: Entry, old: Entry) => !FortiOsPlan.compare([], entry.block, old.block, undefined, false, context).send.length;
+
         for (const [key, entry] of want.entries) {
-            const old = have.entries.get(key);
-            const where = [...path, FortiOsTree.bare(entry.id)];
+            const candidates = alike.get(FortiOsPlan.signature(entry.block, context.section)) ?? [];
+            const index = candidates.findIndex((old) => same(entry, old));
+            if (index >= 0) keep(key, candidates.splice(index, 1)[0]!);
+        }
+
+        for (const settings of numbered.keys) {
+            const valueOf = (entry: Entry) => {
+                const parts = settings.map((setting) => FortiOsPlan.canonical(setting, entry.block.settings.get(setting) ?? ""));
+                return parts.some(Boolean) ? parts.join("\n") : undefined;
+            };
+
+            const changed = Map.groupBy(
+                [...want.entries].filter(([key]) => !kept.has(key)),
+                ([, entry]) => valueOf(entry)
+            );
+            const left = Map.groupBy(unmatched, valueOf);
+
+            for (const [value, entries] of changed) {
+                const old = left.get(value);
+                if (value !== undefined && entries.length === 1 && old?.length === 1) keep(entries[0]![0], old[0]!);
+            }
+        }
+
+        // A number no entry on the device holds, not even one deleted at the end.
+        let next = Math.max(0, ...[...have.entries.values()].map(numberOf).filter(Number.isInteger)) + 1;
+        const wanted: string[] = [];
+        const replaced: string[] = [];
+
+        for (const [key, entry] of want.entries) {
+            const old = kept.get(key);
+
+            if (!old) {
+                const name = `${numbered.prefix ?? ""}${next++}`;
+                const id = numbered.prefix ? FortiOsTree.quote(name) : name;
+                wanted.push(id);
+                send.push(...FortiOsPlan.creation(entry, table, id));
+                show.push(...FortiOsPlan.shown("+", [...path, name], entry.block));
+                continue;
+            }
+
+            wanted.push(old.id);
 
-            if (old) {
-                if (!FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context).send.length) continue;
+            const where = [...path, FortiOsTree.bare(old.id)];
+            const diff = FortiOsPlan.compare(where, entry.block, old.block, undefined, false, context);
+            if (!diff.send.length) continue;
 
-                deletes.push(`delete ${old.id}`);
-                show.push(...FortiOsPlan.shown("-", where, old.block));
+            if (table.distinct) {
+                replaced.push(`delete ${old.id}`);
+                send.push(...FortiOsPlan.creation(entry, table, old.id));
+                show.push(...FortiOsPlan.shown("-", where, old.block), ...FortiOsPlan.shown("+", where, entry.block));
+                continue;
             }
 
-            creates.push(...FortiOsPlan.creation(entry, table));
-            show.push(...FortiOsPlan.shown("+", where, entry.block));
+            send.push(`edit ${old.id}`, ...diff.send, "next");
+            show.push(...diff.show);
         }
 
-        for (const [key, entry] of have.entries) {
-            if (want.entries.has(key) || FortiOsPlan.isFactory(table, entry)) continue;
+        const keptEntries = new Set(kept.values());
 
-            deletes.push(`delete ${entry.id}`);
-            show.push(...FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
+        if (table.ordered) {
+            const order = held.filter((entry) => keptEntries.has(entry)).map((entry) => entry.id);
+            const moved = FortiOsPlan.moves(wanted, order);
+            send.push(...moved);
+            show.push(...moved.map((line) => `+ ${FortiOsPlan.labelOf(path)}${line}`));
         }
 
-        return { send: [...deletes, ...creates], show, removals: [], removed: [] };
-    }
+        const gone = held.filter((entry) => !keptEntries.has(entry));
+        const removals = gone.map((entry) => `delete ${entry.id}`);
+        const removed = gone.flatMap((entry) => FortiOsPlan.shown("-", [...path, FortiOsTree.bare(entry.id)], entry.block));
 
-    /** The `move` commands that put a table's entries in the render's order. Kept entries hold their place on the device and new ones are added at the end. */
-    private static moves(want: FortiOsBlock, have: FortiOsBlock): string[] {
-        const wanted = [...want.entries.keys()];
-        const order = [...have.entries.keys()].filter((key) => want.entries.has(key));
-        order.push(...wanted.filter((key) => !have.entries.has(key)));
+        if (table.distinct) return { send: [...replaced, ...removals, ...send], show: [...removed, ...show], removals: [], removed: [] };
+        return { send, show, removals, removed };
+    }
 
+    /** The `move` commands that put a table's entries in the render's order, by the device's numbers: `wanted` in the render's order, `held` the kept ones in the device's. Kept entries hold their place on the device and new ones are added at the end. */
+    private static moves(wanted: readonly string[], held: readonly string[]): string[] {
+        const order = [...held, ...wanted.filter((id) => !held.includes(id))];
         const send: string[] = [];
-        const idOf = (key: string) => want.entries.get(key)!.id;
 
         for (let index = 0; index < wanted.length; index++) {
-            if (order[index] === wanted[index]) continue;
+            const id = wanted[index]!;
+            if (order[index] === id) continue;
 
-            const key = wanted[index]!;
-            send.push(index === 0 ? `move ${idOf(key)} before ${idOf(order[0]!)}` : `move ${idOf(key)} after ${idOf(wanted[index - 1]!)}`);
-            order.splice(order.indexOf(key), 1);
-            order.splice(index, 0, key);
+            send.push(index === 0 ? `move ${id} before ${order[0]}` : `move ${id} after ${wanted[index - 1]}`);
+            order.splice(order.indexOf(id), 1);
+            order.splice(index, 0, id);
         }
 
         return send;
     }
 
-    /** An entry's settings in the form two entries compare in, whatever their numbers. */
-    private static signature(block: FortiOsBlock): string {
+    /** An entry's settings in the form two entries compare in, whatever their numbers. A setting at its section's default is left out, as the device does not print it. */
+    private static signature(block: FortiOsBlock, section = ""): string {
+        const defaults = FortiOsPlan.DEFAULTS[section] ?? {};
+        const isDefault = (key: string, value: string) =>
+            defaults[key] !== undefined && FortiOsPlan.canonical(key, defaults[key]) === FortiOsPlan.canonical(key, value);
+
         return [...block.settings]
+            .filter(([key, value]) => !isDefault(key, value))
             .map(([key, value]) => `${key} ${FortiOsPlan.canonical(key, value)}`)
             .sort()
             .join("\n");