@takodotid/circuit 0.43.1 → 1.0.0-rc.2

package/dist/types/platforms/fortios/index.d.ts

@@ -1,140 +0,0 @@
-import type { Neighbor } from "../../core/cabling.js";
-import type { Device, Family } from "../../schema/index.js";
-import { type ConsoleDialect } from "../../transport/console.js";
-import { type ApplyOptions, type OsSupport, type Plan, type ReadOptions, type ReadSession, Platform } from "../platform.js";
-/** What a session reads and writes: an SSH shell, or anything else that streams the CLI. */
-export type Channel = {
-    write(data: string): unknown;
-    on(event: "data", listener: (chunk: Buffer) => void): unknown;
-    on(event: "close", listener: () => void): unknown;
-    removeListener(event: "data", listener: (chunk: Buffer) => void): unknown;
-    removeListener(event: "close", listener: () => void): unknown;
-};
-/** How a change that could cut access is guarded: the device reloads its saved configuration after `seconds` unless `prove` shows access survived. */
-export type Guard = {
-    seconds: number;
-    prove: () => Promise<void>;
-};
-/** A CLI over a channel: one line at a time, and what the device printed until its prompt came back. */
-export declare class FortiOsCli {
-    private readonly channel;
-    private readonly newline;
-    /** The prompt at the end of what the device printed, `host # ` or `host (context) # `, or a question it waits on. */
-    private static readonly PROMPT;
-    static readonly QUESTION: RegExp;
-    /** The pre-login banner, which waits for the reader to accept it. */
-    static readonly BANNER: RegExp;
-    /** The device ended the session and asks for a login again. */
-    private static readonly LOGGED_OUT;
-    /** The pager the device stops at, and how it erases itself once answered. */
-    private static readonly PAGER;
-    /** The prompt that ended the last answer, which shows where the session is: `(port1)` inside an entry. */
-    prompt: string;
-    constructor(channel: Channel, newline?: string);
-    /** Wait for the prompt, after logging in. */
-    ready(timeout?: number): Promise<void>;
-    /** Send one line and return what the device printed after it, without the echo or the prompt. */
-    run(line: string, timeout?: number): Promise<string>;
-    /** Answer a question the device asked. */
-    answer(reply: "y" | "n", timeout?: number): Promise<string>;
-    /** What the device prints until its prompt or a question. A session the device ended, or that went silent, fails. */
-    private collect;
-}
-export declare class FortiOs extends Platform {
-    /** How the FortiOS console asks for a login, and what moves it on from where the last session left it. */
-    static readonly CONSOLE: ConsoleDialect;
-    /** The release this adapter renders for, and was proved on. */
-    private static readonly SUPPORTED;
-    /** The longest name the platform takes for an interface, and for an address or service. */
-    private static readonly NAME_LENGTH;
-    /** Names the platform keeps for interfaces of its own. */
-    private static readonly RESERVED_INTERFACES;
-    /** What the device prints when it refuses a line. */
-    private static readonly REFUSED;
-    /** How long a device may take to come back from a reload of its configuration, and how often to try it. */
-    private static readonly RELOAD;
-    /** Commands that only read: `show`, `get`, a set of `diagnose` and `execute` commands. `diagnose sys session filter` sets only this session's filter; `diagnose sys session clear`, which ends sessions, is not here. `diagnose lldprx` shows what LLDP received. */
-    private static readonly READS;
-    /** A session filter, which holds only in the shell that set it. */
-    private static readonly SESSION_FILTER;
-    readonly name = "fortios";
-    readonly os: OsSupport;
-    readonly extension = ".conf";
-    readonly console: ConsoleDialect;
-    unsupported(device: Device): string[];
-    render(device: Device): string;
-    read(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<string>;
-    /** The LLDP neighbors the device received, read with `diagnose lldprx neighbor details`. A port hears LLDP only while it, or the aggregate it is in, has `lldp-reception` on. */
-    neighbors(device: Device, _network?: readonly Device[], options?: ReadOptions): Promise<Neighbor[]>;
-    /**
-     * The neighbors in what `diagnose lldprx neighbor details` prints, one `lldprx.neighbor.<n>.<field>: <value>` line per field: `port.txt` is our port, `port.id.data` the far port and `system.name.data` the far device. Our port is given Circuit's name. A neighbor that sent no system name or port is left out.
-     */
-    static neighborsOf(text: string, device: Device): Neighbor[];
-    plan(desired: string, current: string, options: ApplyOptions): Plan;
-    apply(device: Device, network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
-    /** Replace a prefix list `refresh` fetched. It cannot cut access, so it is sent without a guard, and saved as it goes. `purge` asks to confirm, and is answered yes. */
-    fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
-    readOnly(command: string): boolean;
-    /** Over SSH, each command runs on its own until a session filter is set. The filter holds only in the shell that set it, so it and every command after it run in one shell. */
-    session(device: Device, options?: ReadOptions): Promise<ReadSession>;
-    /** The lines that replace a prefix list's entries with what a registry returned: every entry is purged, then each prefix added, matching it and anything more specific. */
-    static fillLines(set: string, family: Family, prefixes: string[]): string[];
-    /**
-     * A line with each secret's value in place, escaped inside its quotes. A certificate's key from a variable is PEM encoded as one line of base64, and is sent as the PEM it holds. A file saved with Windows line endings is sent with plain ones: the CLI takes each carriage return as a line of its own, and refuses the key, `Invalid private key`. A `?`, which the CLI takes as a call for help, is typed literally.
-     */
-    static withSecrets(line: string): string;
-    private static login;
-    /** Log out of a console, so no session is left open on it. */
-    private static consoleLogout;
-    /** Log in on the console and open the CLI. Returns the CLI, a way to log in afresh on the same console, and how to let the console go. */
-    private static openConsole;
-    /** Log in on the console, open the CLI, and run `work` in it. `work` is also given a way to log in afresh on the same console. */
-    private static consoleSession;
-    /** Log in, open the CLI, and run `work` in it: through the console when asked, else over SSH. */
-    private static withCli;
-    /** Refuse a device on a release this adapter was not proved on, before anything is read or sent. Gives what `get system status` printed. */
-    private static checkVersion;
-    /** Run `work` among the device's own settings: inside `config global` on a device with VDOMs, as it is on one without. */
-    private static inGlobal;
-    /** Secrets the device prints: a password or an SNMPv3 key as a cipher, a certificate's key encrypted, and the SNMP community in clear. None leave the read. */
-    private static scrub;
-    /** Every section Circuit manages, as the device holds it, credentials scrubbed. */
-    private static readConfig;
-    /**
-     * A device in multi-VDOM mode, read where each section lives: the device's own under `config global`, the rest in `root`, and a management VDOM's sections named as the render names them. A VDOM that does not exist yet is not entered, since `edit` would make it.
-     */
-    private static readVdoms;
-    /** Leave every `config` and `edit` level, back to the top prompt. */
-    private static leave;
-    /** Send the lines that set how the device saves changes. */
-    private static saving;
-    /**
-     * Send a plan line by line, each applied as it arrives. The device is first set to revert what is not saved, so a refused line or a fresh login that fails reloads its saved configuration. Once access is proved the change is saved, and changes save themselves again.
-     */
-    private static configure;
-    /**
-     * Once the device is back from a reload, set it to save changes on its own again: the saved configuration still says to revert. Setting it saves what runs, so it is set only once the device says nothing is left to reload; until then the reload is asked for again.
-     */
-    private static settle;
-    private static applyOnce;
-    /**
-     * What transparent mode, which a bridge needs, leaves out: every address but one IPv4 management address outside the bridges, routing beyond static routes for it, NAT and DHCP. Without a management address the device is reached through its console and answers no service.
-     */
-    private static transparentGaps;
-    private static systemGaps;
-    private static managementGaps;
-    /** Every name the platform knows a port by. */
-    private static portNames;
-    private static interfaceGaps;
-    /** A port or LAG carries tagged only VLANs that have an interface here, and is the only one carrying each. */
-    private static trunkGaps;
-    /** Layer 3 settings the platform cannot express on a port or an interface. Only a tunnel takes an address with a peer. */
-    private static routedGaps;
-    /** An ACL as the platform's, which only drop: every drop comes before any accept, and no rule limits a rate or matches a VLAN. */
-    private static aclGaps;
-    private static staticGaps;
-    private static firewallGaps;
-    /** A filter rule the platform cannot express. */
-    private static ruleGaps;
-    private static serviceGaps;
-}

package/dist/types/platforms/fortios/models.d.ts

@@ -1,14 +0,0 @@
-export declare const models: {
-    readonly "FG-3700D": {
-        readonly ports: {
-            readonly "40g": 4;
-            readonly "10g": 28;
-            readonly "1g": 2;
-        };
-        readonly spelling: {
-            readonly "40g": "port{n}";
-            readonly "10g": "port{n+4}";
-            readonly "1g": "mgmt{n}";
-        };
-    };
-};

package/dist/types/platforms/fortios/names.d.ts

@@ -1,52 +0,0 @@
-import type { Device, Family } from "../../schema/index.js";
-type Addressed = {
-    addresses?: readonly (string | {
-        address: string;
-        peer?: string;
-    })[];
-    vrf?: string;
-    lag?: string;
-};
-export declare class FortiOsNames {
-    /** The bridges a device has, in the config's order. A device with any runs in transparent mode, each bridge a forward domain numbered by its place. */
-    static bridgesOf(device: Device): {
-        name: string;
-        members: readonly string[];
-    }[];
-    /** Whether the device runs in transparent mode: it has a bridge. */
-    static isTransparent(device: Device): boolean;
-    /**
-     * The management address of a device in transparent mode: the one IPv4 address on a port or an interface outside every bridge. The device answers on it, the platform's `manageip`, through that interface alone. Undefined when there is none, and the device is reached only through its console.
-     */
-    static transparentManagement(device: Device): {
-        name: string;
-        address: string;
-    } | undefined;
-    /** The forward domain of a VLAN interface in a bridge, or undefined. */
-    static forwardDomainOf(device: Device, name: string): number | undefined;
-    /** The name the platform gives a port or an interface: a port by its spelling, any other interface by its key. */
-    static nameOf(device: Device, name: string): string;
-    /** A port's or an interface's settings, by its key. */
-    static settingsOf(device: Device, name: string): Addressed | undefined;
-    /** Every address of a port or an interface. */
-    static addressesOf(settings: Addressed | undefined): string[];
-    /** An address or prefix with its length, a bare address taken as a host. */
-    static withLength(value: string): string;
-    /** The family of an address or prefix. */
-    static familyOfPrefix(value: string): Family;
-    /** `192.0.2.0 255.255.255.0`, how the platform writes an IPv4 prefix. */
-    static subnet(prefix: string): string;
-    /** The canonical form of a prefix: its network address and length, a bare address taken as a host. */
-    static network(prefix: string): string;
-    /** The number of a VRF on the platform: its place among the device's VRFs, the default table being 0. */
-    static vrfNumber(device: Device, vrf: string | undefined): number;
-    /** Every port and interface that routes, by key, with its settings. A LAG member routes through its LAG. */
-    private static routedHolders;
-    /** The interface whose own network holds an address, the most specific when several do, in one routing table. */
-    static interfaceFor(device: Device, address: string, vrf?: string): string | undefined;
-    /** The interface that holds an address as its own. */
-    static holderOf(device: Device, address: string): string | undefined;
-    /** Every port and interface with an address, by key, where the device's services answer. */
-    static addressed(device: Device): string[];
-}
-export {};

package/dist/types/platforms/fortios/plan.d.ts

@@ -1,114 +0,0 @@
-import type { ApplyOptions, Plan } from "../platform.js";
-export declare class FortiOsPlan {
-    /** Objects every FortiGate running 6.2 is shipped with, which policies and profiles of the factory name. */
-    private static readonly FACTORY_ADDRESSES;
-    private static readonly FACTORY_SERVICES;
-    /** The device's own certificates, which the factory makes for each device. */
-    private static readonly FACTORY_CERTIFICATES;
-    /** An entry known by what it holds, or else by its description. */
-    private static readonly BY_COMMENTS;
-    private static readonly ORDERED;
-    /** A static route known by what it holds, or else by its description. Many routes share a destination, so that is no key. */
-    private static readonly ROUTES;
-    /** Tables whose entries need more than a plain comparison, by section. */
-    private static readonly TABLES;
-    /** Settings the device keeps for itself: an object's UUID and an interface's SNMP index. */
-    private static readonly IGNORED;
-    /** Settings of one section the device keeps for itself: how changes are saved, which `apply` sets while it works, and the alias it gives itself at every start. */
-    private static readonly IGNORED_IN;
-    /** In a certificate's entry, the settings that matter: its text and its key. The device prints others it decides for itself. */
-    private static readonly KEPT;
-    /** A policy denies unless told otherwise. */
-    private static readonly DENY;
-    /** Defaults the device does not print, by section. A config may state one, such as SSH on port 22, and the render states some because other settings appear only once they hold: a DHCP server's resolvers show only while it names them itself, and a policy answers a denied sender only while it denies. */
-    private static readonly DEFAULTS;
-    /** Settings whose value is a secret wherever they appear, such as a certificate's key, which the device prints encrypted. */
-    private static readonly SECRET_KEYS;
-    /** Settings holding a certificate's text, compared without its line breaks. */
-    private static readonly CERTIFICATES;
-    /** Settings undone before a nested list is deleted. Any other goes after it. */
-    private static readonly FIRST;
-    /** Settings holding a list in no particular order. */
-    private static readonly LISTS;
-    /** Settings that name an interface: an entry's own, or a list a section holds, such as OSPF's passive interfaces or the interfaces NTP answers on. */
-    private static readonly NAMES_INTERFACE;
-    /** Tables whose entries are named after an interface, so that releasing the interface deletes its entry: `The vxlan device is currently used` otherwise. */
-    private static readonly KEYED_BY_INTERFACE;
-    /** The tables whose entries are interfaces, so that releasing one frees what names it. */
-    private static readonly INTERFACE_TABLES;
-    /**
-     * Lists of interfaces that exist only while a setting is on, by the list. NTP serves only on interfaces it names, so its list cannot be emptied while it serves, `There aren't any interfaces with NTP server enabled`; turning it off hides the list and lets go of them.
-     */
-    private static readonly HELD_BY;
-    /** The interfaces of tunnels, which their own tables create, compared after those tables as a section of their own. */
-    private static readonly TUNNELS;
-    /** A value that is a secret: a marker in the render, a cipher or a redaction in the read. */
-    private static isSecret;
-    /** A value in the form both sides compare in: words without quotes, a secret as one word, a list sorted. */
-    private static canonical;
-    /** Whether an entry changes a setting it keeps for life, so it must be created again. */
-    private static changesFixed;
-    /** Whether the device holds an entry the plan leaves alone. */
-    private static isFactory;
-    /** The configuration as the plan reads it: factory entries and the device's own settings left out. */
-    static clean(text: string): string;
-    private static dropIgnored;
-    /** The words before a line a reviewer reads, naming the entry and block it sits in. */
-    private static labelOf;
-    /** A block's lines as reviewer lines, each with its place. An entry that holds nothing, such as an extra IPv6 address, is its own line. */
-    private static shown;
-    /** The lines that create an entry, with the settings the device adds unset when the render does not hold them. */
-    private static creation;
-    /**
-     * Compare one block. `table` applies to its entries; `top` sends their removal to the end of the plan.
-     *
-     * What goes is undone before what comes is set, since a setting can hide another: `send-deny-packet` exists only while a policy denies. A nested list that goes is deleted before the settings, since one can hide the list and keep its entries hidden, such as `secondary-IP`; NTP refuses to delete its last server while it synchronises, so `ntpsync` goes before its list.
-     */
-    private static compare;
-    /** Entries matched by name: new ones created, changed ones edited, gone ones deleted. */
-    private static byId;
-    /**
-     * Entries the render numbers by their place, while on the device each keeps the number it was created with, so they are matched by what they are.
-     *
-     * An entry that holds the same as one on the device is kept. One that changes is found by the first of the table's keys that no other entry left to match shares, such as its description, and edited under its own number. Any other is new and takes a number the device does not use; in a table the device keeps in order, it is created at the end and moved into place. An entry on the device that nothing matched is deleted last, so every entry the render keeps stays on the device through the whole change.
-     *
-     * In a `distinct` table, an entry that changes is deleted and created again under its own number, and every deletion comes before any creation.
-     */
-    private static numbered;
-    /** The `move` commands that put a table's entries in the render's order, by the device's numbers: `wanted` in the render's order, `held` the kept ones in the device's. Kept entries hold their place on the device and new ones are added at the end. */
-    private static moves;
-    /** An entry's settings in the form two entries compare in, whatever their numbers. A setting at its section's default is left out, as the device does not print it. */
-    private static signature;
-    /** Entries matched by what they hold. One the device holds and the render does not is deleted; one the render adds takes a number the device does not use. */
-    private static byContent;
-    /** The interface names a block's settings hold. */
-    private static interfacesNamed;
-    /**
-     * What goes before anything else changes.
-     *
-     * A port joins a LAG only while nothing names it, and its speed cannot change while it is in one. So a LAG that keeps some of its ports lets the others go first, a port whose speed changes leaves its LAG and joins again later, a LAG whose ports join another goes first, and an interface whose type or parent changes is deleted and created again. Whatever names such an interface on the device is deleted first, or unset when a list names it, and set again later if the render holds it; an interface or tunnel deleted this way frees what names it in turn.
-     *
-     * A LAG that goes otherwise is deleted with everything else that goes, after what names it; its ports are changed after that.
-     */
-    private static released;
-    /**
-     * The lines, inside one block, that release what names a freed interface: an entry that names one is deleted, and a list a block holds that names one is unset. The device's tree loses them too, so the plan creates or sets them again. An interface the release deletes itself is in `gone`.
-     */
-    private static release;
-    /**
-     * Addresses that leave an interface, taken off before any is set: the device refuses an address in a subnet another interface still holds, `Subnets overlap`. A primary address that changes takes the secondary ones with it, since they hang on it.
-     */
-    private static movedAddresses;
-    /**
-     * What changes, by section, in the order the render lists them. Entries that go are deleted after everything else, in the reverse order, so nothing is deleted while another section still names it.
-     *
-     * A secret is sent when its entry is new, or with `secrets` set; it cannot be read back to compare.
-     */
-    static of(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;
-    /** The tree with each tunnel's interface moved from `system interface` to a section of its own, just after the tunnels' tables. The interface it leaves through is its tunnel's, and is left to the tunnel's table. */
-    private static separateTunnels;
-    /** A prefix list `refresh` fills keeps the entries the device holds. */
-    private static keepFilled;
-    /** The ports of a LAG that goes, taken out of the main comparison and changed in a step of their own once the LAG is deleted. */
-    private static deferredPorts;
-}

package/dist/types/platforms/fortios/render.d.ts

@@ -1,77 +0,0 @@
-import type { Device, Helper, Severity } from "../../schema/index.js";
-export type Section = (typeof FortiOsRender.SECTIONS)[number];
-export declare class FortiOsRender {
-    /** Where the pre-login banner's text is kept. */
-    static readonly BANNER = "system replacemsg admin \"pre_admin-disclaimer-text\"";
-    /** Every section Circuit manages, in the order a change goes in: what others name comes first. */
-    static readonly SECTIONS: readonly ["vpn certificate local", "vpn certificate ca", "system global", "system replacemsg admin \"pre_admin-disclaimer-text\"", "system settings", "system accprofile", "system admin", "system interface", "system gre-tunnel", "system vxlan", "system dns", "system dns-server", "system ntp", "system snmp sysinfo", "system snmp community", "system snmp user", "log memory setting", "log memory filter", "log disk setting", ...string[], "system sflow", "system netflow", "system dhcp server", "router static", "router static6", "router prefix-list", "router prefix-list6", "router community-list", "router route-map", "router ospf", "router ospf6", "router bgp", "system session-helper", "firewall address", "firewall address6", "firewall addrgrp", "firewall addrgrp6", "firewall service custom", "firewall ippool", "firewall vip", "firewall policy", "firewall policy6", "firewall local-in-policy", "firewall local-in-policy6", "firewall central-snat-map", "firewall acl", "firewall acl6"];
-    /** Sections `show` prints without what matters, which `show full-configuration` prints: a certificate's text. */
-    static readonly FULL: readonly string[];
-    /** The FortiOS zone number of each IANA zone it has one for. A number names a list of places in one zone; `00` is the device's default. */
-    private static readonly ZONES;
-    /** What each role may do: the factory profile for an admin, and a profile Circuit adds for the others. */
-    static readonly PROFILE: {
-        readonly admin: "super_admin";
-        readonly operator: "circuit-operator";
-        readonly "read-only": "circuit-read-only";
-    };
-    /** The permission groups of an access profile. */
-    private static readonly PERMISSION_GROUPS;
-    /** The most public keys a user holds. */
-    static readonly SSH_KEYS = 3;
-    /** The most resolvers the device and a DHCP server hold, per family. */
-    static readonly RESOLVERS: {
-        readonly device: 2;
-        readonly dhcp: 4;
-    };
-    /** The most syslog collectors the device sends to. */
-    static readonly COLLECTORS = 4;
-    /** The most VRFs the device holds besides its default table. */
-    static readonly VRFS = 31;
-    /** A severity as the platform names it. */
-    static readonly LEVEL: Record<Severity, string>;
-    /** The helpers the factory runs, by the name a config gives them: protocol and port of each. */
-    static readonly HELPERS: Partial<Record<Helper, readonly [string, number, number][]>>;
-    /** Speed by the platform's spelling, for each class a port's cage takes. */
-    static readonly SPEEDS: Record<string, Partial<Record<string, string>>>;
-    /** The management address of a device in transparent mode, which is reached only through its console: link-local, on no network it can reach. */
-    static readonly TRANSPARENT_MANAGEIP = "169.254.0.1/255.255.255.255";
-    /** The zone number for an IANA zone. UTC when the config names none. */
-    static zoneOf(timezone?: string): string | undefined;
-    /** The services a port or an interface answers on its addresses: ping always, and every management service the config turns on. */
-    private static allowAccess;
-    /** The whole configuration the device should run, in the form `show` prints. */
-    static of(device: Device): string;
-    /** A management VDOM's routes, and who reaches the device's own services through it, as sections of their own after everything else. */
-    private static managementVdom;
-    /** A certificate with its key is the device's own; one without is only trusted. */
-    private static certificates;
-    private static global;
-    /** Each user, with the profile its role takes. */
-    private static users;
-    /** Ports, then the LAGs they join, VLAN interfaces on them, loopbacks, and the tunnels with their own tables. */
-    private static interfaces;
-    /** The platform sends ICMP redirects unless an interface says otherwise; the config sends them only when asked. */
-    private static redirects;
-    /** The one port or LAG that carries a VLAN tagged, which its VLAN interface sits on. `unsupported()` refuses any other case. */
-    static vlanParent(device: Device, vlan: string): string | undefined;
-    /** Addresses and their routing table, the services answered on them, VRRP, DHCP relay, router advertisements, LLDP and flow sampling of a port or an interface. */
-    private static routed;
-    /** The device's resolvers, and the interfaces it answers DNS queries on when it serves them. */
-    private static dns;
-    /** The servers the device keeps time from, and the interfaces it answers time queries on when it serves them. */
-    private static ntp;
-    /** SNMP version 2c with one community, guarded by its hosts, and version 3 users. */
-    private static snmp;
-    /** Logs kept in memory from a level up, none on disk, and up to four syslog collectors, each with the least severe message it takes. */
-    private static logging;
-    /** One collector, and sampling on each interface it observes. */
-    private static flowExport;
-    private static dhcpServers;
-    /** Each route by its position. A route goes in the routing table of the interface it leaves through. A default route is the platform's default destination and is not printed. */
-    private static staticRoutes;
-    /** BFD runs once a route or a session uses it, or the config sets its timers, which the device shows only while it runs. */
-    private static bfd;
-    /** The helpers the config lists, each on the protocols and ports the factory gives it. None run otherwise. */
-    private static helpers;
-}

package/dist/types/platforms/fortios/routing.d.ts

@@ -1,56 +0,0 @@
-import type { Device, Family, Neighbor, NeighborSettings, PolicyRule } from "../../schema/index.js";
-import { FortiOsBlock } from "./tree.js";
-type AnyRule = PolicyRule<string, string>;
-type AnyNeighbor = Neighbor<string, string, string>;
-/** The lengths a prefix list's rule takes within its prefix. */
-type Lengths = {
-    ge?: number;
-    le?: number;
-};
-export declare class FortiOsRouting {
-    /** The route map a session takes when its config states none, so it learns or announces nothing. */
-    static readonly REJECT_ALL = "circuit-reject-all";
-    /** The start of the comment on a prefix list `refresh` fills. The plan keeps the entries the device holds in one. */
-    static readonly FILLED = "Filled by circuit refresh";
-    /** The table a prefix list of one family sits in. */
-    static readonly PREFIX_LIST: {
-        readonly ipv4: "router prefix-list";
-        readonly ipv6: "router prefix-list6";
-    };
-    /** The longest prefix of each family. */
-    static readonly BITS: {
-        readonly ipv4: 32;
-        readonly ipv6: 128;
-    };
-    /** A neighbor's settings with its group's beneath them. */
-    static neighborSettings(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string>;
-    /** The families a session carries: its own, or the family of its address. */
-    static familiesOfNeighbor(device: Device, neighbor: AnyNeighbor): Family[];
-    /** Whether a static route, OSPF or BGP detects a dead neighbor with BFD, which the device then runs. */
-    static usesBfd(device: Device): boolean;
-    static render(root: FortiOsBlock, device: Device): void;
-    /** A prefix as the platform writes it in a prefix list of its family. */
-    private static listPrefix;
-    /** One rule of a prefix list: a prefix, and the lengths it takes within it. The device prints a bound the rule does not hold as `unset`. */
-    static listRule(rule: FortiOsBlock, family: Family, prefix: string, lengths?: Lengths): void;
-    /** The lengths a rule takes within a prefix to match lengths from `min` to `max`, or none when no length fits. A bound equal to the prefix's own length is left out. */
-    static bounds(prefix: string, family: Family, min?: number, max?: number): Lengths | undefined;
-    /** Each prefix set as a prefix list matching its prefixes and any more specific. One a registry fills starts with a rule that denies every prefix, so it matches nothing until `refresh` fills it. */
-    private static prefixLists;
-    /** The networks of an interface's addresses of one family, for an OSPF area to announce. */
-    private static networksOf;
-    /** OSPF for IPv4. An area runs on the networks of its interfaces; an interface named with a cost, a link type or BFD has settings of its own; a passive one forms no adjacency. */
-    private static ospf;
-    /** OSPFv3 for IPv6. Every interface of an area runs it in that area. */
-    private static ospf6;
-    /** BGP: each session with its settings and group's, the route maps its policies become for each family it carries, and the prefixes the device originates. */
-    private static bgp;
-    /** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
-    static familyOfRule(device: Device, rule: AnyRule): Family | undefined;
-    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller. */
-    static flatten(device: Device, policy: string, seen?: string[]): AnyRule[];
-    /** Routing the platform cannot express, or that this adapter does not yet write. */
-    static gaps(device: Device): string[];
-    private static ruleGaps;
-}
-export {};

package/dist/types/platforms/fortios/tree.d.ts

@@ -1,37 +0,0 @@
-/** One `edit` of a table: its name as written, and what it holds. */
-export type Entry = {
-    id: string;
-    block: FortiOsBlock;
-};
-export declare class FortiOsBlock {
-    readonly settings: Map<string, string>;
-    readonly blocks: Map<string, FortiOsBlock>;
-    readonly entries: Map<string, Entry>;
-    /** Set a key. A value of several words is written as given. */
-    set(key: string, value: string | number): this;
-    /** The nested `config` block with this header, created when absent. */
-    block(header: string): FortiOsBlock;
-    /** The table entry with this name, created when absent. A name is quoted unless it is a number, or the table prints it bare, such as an OSPF area or an IPv6 prefix. */
-    entry(id: string | number, plain?: boolean): FortiOsBlock;
-    isEmpty(): boolean;
-}
-export declare class FortiOsTree {
-    /** A setting the device prints as `unset <key>`, a key it holds empty on purpose, such as an ICMP service's type. */
-    static readonly UNSET = "\0unset";
-    /** A string as the CLI takes it, in double quotes. */
-    static quote(text: string): string;
-    /** Each of several strings quoted, as a list setting takes them. */
-    static quoteAll(texts: readonly string[]): string;
-    /** A value's words; a quoted string is one word with its quotes. */
-    static words(value: string): string[];
-    /** A word as the device means it, without quotes or escapes. */
-    static bare(word: string): string;
-    /** The lines that build a block, at an indent, in the form `show` prints and the CLI takes. */
-    static lines(block: FortiOsBlock, indent?: string): string[];
-    /** The whole configuration: each top-level block as `config <section>` to `end`. */
-    static print(root: FortiOsBlock): string;
-    /** Whether a line opens a quoted value it does not close, so the value goes on over the next lines. */
-    private static unclosed;
-    /** The tree of what `show` printed. Lines that are not configuration, such as the version header, are skipped. */
-    static parse(text: string): FortiOsBlock;
-}

package/dist/types/platforms/fortios/vdoms.d.ts

@@ -1,50 +0,0 @@
-import type { Device } from "../../schema/index.js";
-import type { Plan } from "../platform.js";
-import { FortiOsBlock } from "./tree.js";
-/** Where a section lives in multi-VDOM mode: the device's own, or one VDOM's. */
-type Scope = {
-    kind: "global";
-} | {
-    kind: "vdom";
-    vdom: string;
-};
-export declare class FortiOsVdoms {
-    /** The VDOM everything is in unless named otherwise. */
-    static readonly ROOT = "root";
-    /**
-     * Sections under `config global` in multi-VDOM mode, from FortiOS 6.2's CLI reference: the device's identity, logins, interfaces, name resolution, time, SNMP, logging targets, flow export and session helpers. Every other section belongs to a VDOM. Not proved on a device yet.
-     */
-    static readonly GLOBAL: Set<string>;
-    /** What a management VDOM holds: its routes, and who reaches the device's own services through it, with the objects those name. */
-    static readonly MANAGEMENT_SECTIONS: readonly ["firewall address", "firewall address6", "firewall addrgrp", "firewall addrgrp6", "firewall service custom", "router static", "router static6", "firewall local-in-policy", "firewall local-in-policy6"];
-    /** The management VDOM's name, when the device has one. */
-    static managementOf(device: Device): string | undefined;
-    /** The VDOM a port or interface is in, by Circuit's name. A port in a LAG is where its LAG is. */
-    static vdomOf(device: Device, name: string): string;
-    /** A management VDOM's section as the render and the read write it. */
-    static key(vdom: string, section: string): string;
-    /** A section's scope, and its name as the device writes it. */
-    static scopeOf(key: string): {
-        scope: Scope;
-        section: string;
-    };
-    /** Whether a configuration runs in multi-VDOM mode. */
-    static isMulti(tree: FortiOsBlock): boolean;
-    /** Lines sent in a scope: inside `config global`, or inside one VDOM. */
-    static wrap(scope: Scope, lines: readonly string[]): string[];
-    /** What `show` printed in a management VDOM, each top-level section named as the render names it. */
-    static named(vdom: string, text: string): string;
-    /** The VDOMs `diagnose sys vd list` names, such as `name=mgmt/mgmt index=1`. */
-    static listed(text: string): string[];
-    /**
-     * A plan for a device that may run in multi-VDOM mode. In one VDOM it is `planOne` as it is. In several, each scope is planned on its own and its steps sent in that scope: the global steps first, then each VDOM's, then the global removals, so an interface is gone only once no VDOM names it.
-     *
-     * Turning multi-VDOM mode on or off, and moving an interface into another VDOM, are left to an operator: the first moves everything into `root` and ends every session, and the second can cut the way in. A plan that needs either holds only the problem.
-     */
-    static plan(desired: string, current: string, planOne: (desired: string, current: string) => Plan): Plan;
-    /** Interfaces the config puts in another VDOM than the device has them in. */
-    private static moved;
-    /** What a management VDOM can't hold yet, or a config with one can't have. */
-    static gaps(device: Device): string[];
-}
-export {};

package/dist/types/platforms/index.d.ts

@@ -1,13 +0,0 @@
-import type { Platform } from "./platform.js";
-/** Every platform the framework can render and apply, by name. */
-export declare class Platforms {
-    private static readonly BY_NAME;
-    /** The platform of that name, or undefined when there is none. */
-    static find(name: string): Platform | undefined;
-    /** The platform of that name. Throws when there is none. */
-    static get(name: string): Platform;
-    /** Every platform, in the order the framework lists them. */
-    static all(): Platform[];
-    /** Every platform's name. */
-    static names(): string[];
-}

package/dist/types/platforms/junos/bgp.d.ts

@@ -1,44 +0,0 @@
-import type { Device, Neighbor, NeighborSettings } from "../../schema/index.js";
-import { type JunosStatements } from "./render.js";
-type AnyNeighbor = Neighbor<string, string, string>;
-/** BGP sessions, the policies they use, prefix sets and RPKI servers, added to one device's statements. */
-export declare class JunosBgp {
-    private readonly out;
-    private readonly device;
-    /** The policy a session uses when it states none, so that it learns or announces nothing. */
-    private static readonly REJECT_ALL;
-    /** The policy every export starts with. BGP's own routes and the prefixes the device originates go on to the session's policy; the device's other routes never reach it. */
-    private static readonly ORIGIN;
-    /** The validator group every RPKI server joins. */
-    private static readonly RPKI_GROUP;
-    /** A comment in the render naming a path whose statements `refresh` fills, so the plan keeps what the device holds there. */
-    static readonly GENERATED = "# generated ";
-    private static readonly FAMILY;
-    private static readonly VALIDATION;
-    private constructor();
-    /** Add the device's prefix sets, RPKI servers, BGP sessions and the policies they use. */
-    static render(out: JunosStatements, device: Device): void;
-    /** A neighbor's settings with its group's beneath them. */
-    static settingsOf(device: Device, neighbor: AnyNeighbor): NeighborSettings<string, string>;
-    /** A name made of a value's words, for a community or a path-length list: `64500:*` becomes `64500-any`. */
-    private static slug;
-    /** A community as the platform writes a member: a large community carries the `large:` prefix. */
-    private static member;
-    /** A term's name: its place, then the rule's description so a reader sees it on the device. */
-    private static termName;
-    private sessions;
-    /** BGP's routes and the originated prefixes go on to the session's policy; anything else is rejected. */
-    private origin;
-    private prefixSets;
-    private rpki;
-    /** The family a rule is limited to, by its match: a family, a prefix, or a prefix set of one family. */
-    private familyOfRule;
-    /** A policy's rules with each call replaced by the rules it calls, in order. A called policy that decides nothing hands back to the caller, as it does on every platform. */
-    private flatten;
-    /** One policy as a policy statement: a term per rule, then a reject when the last rule does not decide on every route. */
-    private policyStatement;
-    private term;
-    /** A named community holding these members, named after them. */
-    private community;
-}
-export {};