@takodotid/circuit 0.9.0 → 0.11.0

package/dist/cli/index.js

@@ -0,0 +1,4079 @@
+#!/usr/bin/env node
+import {
+  contains,
+  familyOf,
+  host,
+  isAddress,
+  isCidr,
+  isGlobal,
+  netmask,
+  network,
+  split,
+  wildcard
+} from "../chunks/index-ex1wcst7.js";
+import {
+  __require,
+  __toESM
+} from "../chunks/index-fq57hya4.js";
+
+// src/cli/index.ts
+import { createPrivateKey, createPublicKey } from "node:crypto";
+import { existsSync as existsSync2, mkdirSync, readdirSync, readFileSync as readFileSync2, rmSync, writeFileSync } from "node:fs";
+import { basename, dirname, join as join2, resolve as resolve2 } from "node:path";
+
+// src/core/secrets.ts
+import { spawnSync } from "node:child_process";
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+var root = process.cwd();
+var envFile;
+var fromOnePassword = new Map;
+function useRoot(directory) {
+  root = directory;
+  envFile = undefined;
+}
+function dotenv() {
+  if (envFile)
+    return envFile;
+  envFile = {};
+  const path = join(root, ".env");
+  if (!existsSync(path))
+    return envFile;
+  for (const line of readFileSync(path, "utf8").split(`
+`)) {
+    const trimmed = line.trim();
+    if (!trimmed || trimmed.startsWith("#"))
+      continue;
+    const separator = trimmed.indexOf("=");
+    if (separator <= 0)
+      continue;
+    const value = trimmed.slice(separator + 1).trim();
+    const unquoted = /^(["']).*\1$/.test(value) ? value.slice(1, -1) : value;
+    envFile[trimmed.slice(0, separator).trim()] = unquoted;
+  }
+  return envFile;
+}
+function readOnePassword(name, reference) {
+  const cached = fromOnePassword.get(reference);
+  if (cached !== undefined)
+    return cached;
+  const result = spawnSync("op", ["read", "--no-newline", reference], { encoding: "utf8" });
+  if (result.error)
+    throw new Error(`secret ${name} is a 1Password reference, and the 1Password CLI, op, is not installed`);
+  if (result.status !== 0) {
+    const reason = result.stderr.trim() || `op exited with ${result.status}`;
+    throw new Error(`secret ${name}: 1Password could not read ${reference}: ${reason}`);
+  }
+  const value = result.stdout;
+  fromOnePassword.set(reference, value);
+  return value;
+}
+var isSecret = (value) => typeof value === "object" && value !== null && (("secret" in value) || ("secret_file" in value));
+var referenceOf = (secret) => ("secret" in secret) ? secret.secret : `file:${secret.secret_file}`;
+function sourceOf(reference) {
+  if (reference.startsWith("file:"))
+    return existsSync(join(root, reference.slice("file:".length))) ? "a file" : undefined;
+  const value = process.env[reference] || dotenv()[reference];
+  if (!value)
+    return;
+  const where = process.env[reference] && process.env[reference] !== dotenv()[reference] ? "the environment" : ".env";
+  return value.startsWith("op://") ? `1Password, through ${where}` : where;
+}
+function valueOf(reference) {
+  if (reference.startsWith("file:")) {
+    const path = reference.slice("file:".length);
+    const fullPath = join(root, path);
+    if (!existsSync(fullPath))
+      throw new Error(`secret file ${path} does not exist`);
+    const value2 = readFileSync(fullPath, "utf8").trimEnd();
+    if (!value2)
+      throw new Error(`secret file ${path} is empty`);
+    return value2;
+  }
+  const value = process.env[reference] || dotenv()[reference];
+  if (!value)
+    throw new Error(`secret ${reference} is not set in the environment or in .env`);
+  return value.startsWith("op://") ? readOnePassword(reference, value) : value;
+}
+var resolve = (secret) => valueOf(typeof secret === "string" ? secret : referenceOf(secret));
+var marker = (secret) => `<secret:${referenceOf(secret)}>`;
+var MARKER = /<secret:([A-Za-z0-9_./:-]+)>/g;
+var substitute = (text) => text.replace(MARKER, (_, reference) => valueOf(reference));
+var valueOfReference = valueOf;
+
+// src/core/time.ts
+function offset(zone) {
+  const name = new Intl.DateTimeFormat("en-US", {
+    timeZone: zone,
+    timeZoneName: "longOffset"
+  }).formatToParts(new Date).find((entry) => entry.type === "timeZoneName").value;
+  const found = /GMT([+-])(\d{2}):(\d{2})/.exec(name);
+  if (!found)
+    return 0;
+  const [, sign, hours, minutes] = found;
+  const sizeInMinutes = Number(hours) * 60 + Number(minutes);
+  return sign === "-" ? -sizeInMinutes : sizeInMinutes;
+}
+
+// src/transport/ssh.ts
+import { Client } from "ssh2";
+function connect(login) {
+  return new Promise((resolve2, reject) => {
+    const client = new Client;
+    client.on("ready", () => resolve2(client)).on("error", reject).connect({
+      host: login.host,
+      port: login.port ?? 22,
+      username: login.user,
+      password: login.password,
+      readyTimeout: 30000,
+      ...login.hostKeys ? { algorithms: { serverHostKey: login.hostKeys } } : {}
+    });
+  });
+}
+function exec(client, command, timeout = 120000) {
+  return new Promise((resolve2, reject) => {
+    client.exec(command, (error, stream) => {
+      if (error)
+        return reject(error);
+      let output = "";
+      const append = (chunk) => output += chunk.toString("utf8");
+      const timer = setTimeout(() => resolve2(output.trim()), timeout);
+      stream.on("data", append);
+      stream.stderr.on("data", append);
+      stream.on("close", () => {
+        clearTimeout(timer);
+        resolve2(output.trim());
+      });
+    });
+  });
+}
+function shell(client, columns = 200, rows = 1000) {
+  return new Promise((resolve2, reject) => {
+    client.shell({ cols: columns, rows }, (error, channel) => error ? reject(error) : resolve2(channel));
+  });
+}
+function readUntil(channel, done, timeout, settle = 400) {
+  return new Promise((resolve2) => {
+    let output = "";
+    let finished = false;
+    const finish = () => {
+      if (finished)
+        return;
+      finished = true;
+      channel.removeListener("data", onData);
+      resolve2(output);
+    };
+    const onData = (chunk) => {
+      output += chunk.toString("utf8");
+      if (done(output))
+        setTimeout(finish, settle);
+    };
+    channel.on("data", onData);
+    setTimeout(finish, timeout);
+  });
+}
+function send(channel, line, timeout = 20000, settle = 1500) {
+  channel.write(line + `
+`);
+  return new Promise((resolve2) => {
+    let output = "";
+    let timer;
+    const finish = () => {
+      channel.removeListener("data", onData);
+      resolve2(output);
+    };
+    const onData = (chunk) => {
+      output += chunk.toString("utf8");
+      clearTimeout(timer);
+      timer = setTimeout(finish, settle);
+    };
+    channel.on("data", onData);
+    timer = setTimeout(finish, timeout);
+  });
+}
+function upload(client, path, content) {
+  return new Promise((resolve2, reject) => {
+    client.sftp((error, sftp) => {
+      if (error)
+        return reject(error);
+      sftp.writeFile(path, content, (writeError) => {
+        sftp.end();
+        if (writeError)
+          reject(writeError);
+        else
+          resolve2();
+      });
+    });
+  });
+}
+
+// src/adapters/devices/raisecom-ros/models.ts
+var models = {
+  "RAX721-C-6C48": {
+    ports: { "100g": 6, "25g": 24, "10g": 24 },
+    spelling: { "100g": "hundredgige 1/1/{n}", "25g": "twenty-fivegige 1/2/{n}", "10g": "tengigabitethernet 1/3/{n}" }
+  }
+};
+
+// src/adapters/devices/routeros/models.ts
+var models2 = {
+  "CCR2216-1G-12XS-2XQ": {
+    ports: { "100g": 2, "25g": 12, "1g": 1 },
+    spelling: { "100g": "qsfp28-{n}-1", "25g": "sfp28-{n}", "1g": "ether{n}" }
+  }
+};
+
+// src/adapters/devices/vrp/models.ts
+var models3 = {
+  "CE6855-48S6Q-HI": { ports: { "10g": 48, "40g": 6 }, spelling: { "10g": "10GE1/0/{n}", "40g": "40GE1/0/{n}" } }
+};
+
+// src/adapters/devices/catalog.ts
+var catalog = { routeros: models2, vrp: models3, "raisecom-ros": models };
+function portsOf(platform, model) {
+  const spec = catalog[platform]?.[model];
+  if (!spec)
+    throw new Error(`${platform} has no model ${model}`);
+  return Object.entries(spec.ports).flatMap(([speed, count]) => Array.from({ length: count }, (_, i) => `${speed}-${i + 1}`));
+}
+function spell(platform, model, port) {
+  const spec = catalog[platform]?.[model];
+  const parts = /^(\d+[gm])-(\d+)$/.exec(port);
+  const template = parts && spec?.spelling[parts[1]];
+  if (!template)
+    throw new Error(`${model} has no port ${port}`);
+  return template.replace("{n}", parts[2]);
+}
+
+// src/adapters/devices/derive.ts
+function lagIds(device) {
+  const numbers = new Map;
+  let position = 0;
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "lag")
+      continue;
+    position++;
+    numbers.set(name, iface.id ?? position);
+  }
+  return numbers;
+}
+function ipv4Networks(device, iface) {
+  const settings = device.interfaces?.[iface] ?? device.ports?.[iface];
+  const addresses = (settings?.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+  return addresses.filter((address) => familyOf(address) === "ipv4").map((address) => network(address));
+}
+
+// src/adapters/devices/lines.ts
+var indentOf = (raw) => raw.length - raw.trimStart().length;
+function entries(text, dialect) {
+  const lines = text.replace(/\r/g, "").split(`
+`).filter((raw) => raw.trim() !== "");
+  const result = [];
+  const open = [];
+  for (let i = 0;i < lines.length; i++) {
+    const raw = lines[i];
+    const indent = indentOf(raw);
+    const line = raw.trim().replace(/\s+/g, " ");
+    if (line === dialect.terminator) {
+      if (indent === 0)
+        open.length = 0;
+      continue;
+    }
+    if (dialect.ignore(line))
+      continue;
+    if (dialect.indented) {
+      while (open.length && open.at(-1).indent >= indent)
+        open.pop();
+    } else if (indent === 0 && dialect.block.test(line)) {
+      open.length = 0;
+    }
+    result.push({ path: open.map((block) => block.header), line });
+    const isContent = (candidate) => candidate.trim() !== dialect.terminator && !dialect.ignore(candidate.trim());
+    const nextLine = lines.slice(i + 1).find(isContent);
+    const opensBlock = dialect.indented ? nextLine !== undefined && indentOf(nextLine) > indent : indent === 0 && dialect.block.test(line);
+    if (opensBlock)
+      open.push({ indent, header: line });
+  }
+  return result;
+}
+function head(line) {
+  const rule = /^rule \d+/.exec(line);
+  if (rule)
+    return rule[0];
+  if (/^(description|name) /.test(line))
+    return line.split(" ")[0];
+  const words = line.split(" ");
+  return words.slice(0, Math.max(1, words.length - 1)).join(" ");
+}
+function compare(desired, current, dialect) {
+  const canon = dialect.canon ?? ((line) => line);
+  const keyOf = (entry) => [...entry.path, canon(entry.line)].join("\x00");
+  const pathKey = (path) => path.join("\x00");
+  const wanted = entries(desired, dialect);
+  const existing = entries(current, dialect);
+  const wantedKeys = new Set(wanted.map(keyOf));
+  const existingKeys = new Set(existing.map(keyOf));
+  const wantedBlocks = new Set(wanted.map((entry) => pathKey([...entry.path, entry.line])));
+  const groups = new Map;
+  const groupFor = (path) => {
+    const key = pathKey(path);
+    if (!groups.has(key))
+      groups.set(key, { path, remove: [], add: [] });
+    return groups.get(key);
+  };
+  for (const entry of wanted) {
+    if (existingKeys.has(keyOf(entry)))
+      continue;
+    const ownBlock = pathKey([...entry.path, entry.line]);
+    const opensBlock = wanted.some((other) => {
+      const deeper = other.path.length > entry.path.length;
+      return deeper && pathKey(other.path.slice(0, entry.path.length + 1)) === ownBlock;
+    });
+    if (opensBlock)
+      continue;
+    groupFor(entry.path).add.push(entry.line);
+  }
+  for (const entry of [...existing].reverse()) {
+    if (wantedKeys.has(keyOf(entry)))
+      continue;
+    const insideRemovedBlock = entry.path.some((_, depth) => {
+      const enclosing = pathKey(entry.path.slice(0, depth + 1));
+      return !wantedBlocks.has(enclosing);
+    });
+    if (insideRemovedBlock)
+      continue;
+    const replaced = wanted.some((other) => {
+      const sameBlock = pathKey(other.path) === pathKey(entry.path);
+      const isNew = !existingKeys.has(keyOf(other));
+      return sameBlock && isNew && head(other.line) === head(entry.line);
+    });
+    if (!replaced)
+      groupFor(entry.path).remove.push(entry.line);
+  }
+  return [...groups.values()].filter((group) => group.add.length || group.remove.length);
+}
+function vlanListChange(groups, prefix, parse, format, removal) {
+  const top = groups.find((group) => group.path.length === 0);
+  if (!top)
+    return;
+  const old = top.remove.find((line) => line.startsWith(prefix));
+  const fresh = top.add.find((line) => line.startsWith(prefix));
+  if (!old && !fresh)
+    return;
+  const before = old ? parse(old) : [];
+  const after = fresh ? parse(fresh) : [];
+  top.remove = top.remove.filter((line) => line !== old);
+  top.add = top.add.filter((line) => line !== fresh);
+  const added = after.filter((id) => !before.includes(id));
+  const removed = before.filter((id) => !after.includes(id));
+  if (added.length)
+    top.add.unshift(...format(added));
+  if (removed.length)
+    top.remove.push(...removal(removed));
+}
+var nothingAround = () => ({ before: [], after: [] });
+function steps(groups, dialect, around = nothingAround) {
+  const rank = dialect.order ?? (() => 0);
+  const ordered = [...groups].sort((a, b) => rank(a.path) - rank(b.path));
+  return ordered.map((group) => {
+    const { before, after } = around(group);
+    const early = group.add.filter((line) => dialect.first?.test(line));
+    const late = group.add.filter((line) => !early.includes(line));
+    const added = late.flatMap((line) => dialect.block.test(line) ? [line, dialect.leave] : [line]);
+    const inner = [...early, ...group.remove.map(dialect.undo), ...added];
+    const leave = group.path.map(() => dialect.leave);
+    return {
+      title: group.path.join(" > ") || "(top level)",
+      show: [...group.remove.map((line) => `- ${line}`), ...group.add.map((line) => `+ ${line}`)],
+      send: [...before, ...group.path, ...inner, ...leave, ...after]
+    };
+  });
+}
+var STORED_CREDENTIAL = /(password (?:irreversible-)?cipher|community read cipher|^snmp-server community)( +)\S+/gm;
+var scrub = (text) => text.replace(STORED_CREDENTIAL, "$1$2<redacted>");
+
+// src/adapters/devices/raisecom-ros/index.ts
+var DEVICE_FACTS = [
+  "Being processed",
+  "System current configuration",
+  "recv-mode",
+  "mpls te periodic-flooding",
+  "spanning-tree region-configuration",
+  "interface NULL",
+  "ip rarp",
+  "quit",
+  "config",
+  "exit",
+  "portswitch"
+];
+var OPPOSITES = [
+  [/^mode manual$/, "mode lacp"],
+  [/^ip ospf passive-interface enable$/, "ip ospf passive-interface disable"],
+  [/^lldp disable$/, "lldp enable"],
+  [/^spanning-tree disable$/, "spanning-tree enable"],
+  [/^switchport mode trunk$/, "switchport mode access"],
+  [/^telnet-server disable$/, "telnet-server enable"],
+  [/^shutdown$/, "no shutdown"]
+];
+var UNDO_BY_KEYWORD = /^(description|switchport access vlan|switchport trunk native vlan|switchport trunk allowed vlan|storm-control broadcast|storm-control mode|ip address|port-channel|ip ospf cost|ip ospf network)\b/;
+function undo(line) {
+  for (const [pattern, opposite] of OPPOSITES)
+    if (pattern.test(line))
+      return opposite;
+  if (/^rule \d+/.test(line))
+    return `no ${line.split(" ").slice(0, 2).join(" ")}`;
+  const vrrp = /^(no )?vrrp (\d+) (ip \S+|priority|timers advertise-interval|preempt)/.exec(line);
+  if (vrrp)
+    return vrrp[1] ? `vrrp ${vrrp[2]} preempt` : `no vrrp ${vrrp[2]} ${vrrp[3]}`;
+  const ospfProcess = /^router ospf (\d+)/.exec(line);
+  if (ospfProcess)
+    return `no router ospf ${ospfProcess[1]}`;
+  const snmpUser = /^snmp-server user (\S+)/.exec(line);
+  if (snmpUser)
+    return `no snmp-server user ${snmpUser[1]}`;
+  const snmpGroup = /^snmp-server group \S+ user (\S+) usm$/.exec(line);
+  if (snmpGroup)
+    return `no snmp-server group user ${snmpGroup[1]} usm`;
+  const snmpAccess = /^snmp-server access (\S+) .* usm (\S+)$/.exec(line);
+  if (snmpAccess)
+    return `no snmp-server access ${snmpAccess[1]} usm ${snmpAccess[2]}`;
+  const keyword = UNDO_BY_KEYWORD.exec(line);
+  if (keyword)
+    return `no ${keyword[1]}`;
+  return `no ${line}`;
+}
+var dialect = {
+  block: /^(interface |access-list |router ospf )/,
+  indented: false,
+  terminator: "!",
+  ignore: (line) => line.startsWith("!") || DEVICE_FACTS.some((fact) => line.startsWith(fact)),
+  undo,
+  leave: "exit",
+  canon: (line) => line.replace(/password (cipher )?(\S+)/, "password <secret>").replace(/community <secret:\w+>/, "community <redacted>").replace(/^snmp-server user (\S+) (?:authentication|authkey) (\S+) \S+ (?:privacy|privkey)\s+(\S+) \S+$/, "snmp-server user $1 $2 $3 <secret>").replace(/^(snmp-server access \S+ read \S+) notify internet (usm \S+)$/, "$1 $2"),
+  order: (path) => {
+    const header = path[0] ?? "";
+    if (header.startsWith("interface port-channel"))
+      return 1;
+    if (header.startsWith("interface "))
+      return 2;
+    if (header.startsWith("router ospf"))
+      return 3;
+    return 0;
+  }
+};
+var OSPF_PROCESS = 1;
+var SNMP_GROUP = "circuit";
+var SNMP_AUTH = { sha1: "sha" };
+var MANAGEMENT_ACL = 1000;
+function vlanList(ids) {
+  const sorted = [...new Set(ids)].sort((a, b) => a - b);
+  const ranges = [];
+  for (let i = 0;i < sorted.length; i++) {
+    let end = i;
+    while (sorted[end + 1] === sorted[end] + 1)
+      end++;
+    ranges.push(i === end ? `${sorted[i]}` : `${sorted[i]}-${sorted[end]}`);
+    i = end;
+  }
+  return ranges.join(",");
+}
+function render(device) {
+  const lines = [];
+  const vlans = device.vlans ?? {};
+  const vlanId = (name) => vlans[name].id;
+  const management = device.management ?? {};
+  const allow = management.allow ?? [];
+  const ids = Object.values(vlans).map((vlan) => vlan.id);
+  if (ids.length)
+    lines.push(`create vlan ${vlanList(ids)} active`, "!");
+  const lagNumbers = lagIds(device);
+  for (const [name, lag] of Object.entries(device.interfaces ?? {})) {
+    if (lag.type !== "lag")
+      continue;
+    lines.push(`interface port-channel ${lagNumbers.get(name)}`);
+    if (lag.description)
+      lines.push(`description ${lag.description}`);
+    if (lag.mode === "static")
+      lines.push("mode manual");
+    lines.push(...switching(lag, vlanId), "!");
+  }
+  if (allow.length) {
+    lines.push(`access-list ${MANAGEMENT_ACL}`, "  description management");
+    allow.forEach((cidr, index) => lines.push(`  rule ${(index + 1) * 10} permit ${host(cidr)} ${netmask(split(cidr).len)}`));
+    lines.push("  rule 100 deny any", "!");
+  }
+  for (const [name, user] of Object.entries(device.users ?? {}))
+    lines.push(`user name ${name} password ${marker(user.password)}`);
+  if (management.privilege_password)
+    lines.push(`enable password ${marker(management.privilege_password)}`);
+  const timezone = device.system?.timezone;
+  if (timezone) {
+    const minutes = offset(timezone);
+    const absolute = Math.abs(minutes);
+    lines.push(`clock timezone ${minutes < 0 ? "-" : "+"} ${Math.floor(absolute / 60)} ${absolute % 60} 0`);
+  }
+  lines.push("!");
+  for (const port of portsOf(device.platform, device.model)) {
+    const settings = device.ports?.[port];
+    lines.push(`interface ${spell(device.platform, device.model, port)}`, ...physicalPort(settings, vlanId, lagNumbers), "!");
+  }
+  const ospf = device.routing?.ospf;
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "vlan")
+      continue;
+    lines.push(`interface vlan ${vlanId(iface.vlan)}`);
+    for (const entry of iface.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      if (familyOf(address) === "ipv4")
+        lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+    }
+    const ospfSettings = Object.values(ospf?.areas ?? {}).find((area) => area.interfaces[name])?.interfaces[name];
+    if (ospfSettings?.network === "point-to-point")
+      lines.push("ip ospf network ptp");
+    if (ospfSettings?.cost !== undefined)
+      lines.push(`ip ospf cost ${ospfSettings.cost}`);
+    if (ospfSettings?.passive)
+      lines.push("ip ospf passive-interface enable");
+    for (const group of iface.vrrp ?? [])
+      lines.push(...vrrpLines(group));
+    lines.push("!");
+  }
+  if (ospf) {
+    const routerId = device.routing?.router_id;
+    lines.push(`router ospf ${OSPF_PROCESS}${routerId ? ` router-id ${routerId}` : ""}`);
+    for (const [areaId, area] of Object.entries(ospf.areas)) {
+      for (const iface of Object.keys(area.interfaces)) {
+        for (const prefix of ipv4Networks(device, iface)) {
+          lines.push(`network ${host(prefix)} ${wildcard(split(prefix).len)} area ${areaId}`);
+        }
+      }
+    }
+    for (const source of ospf.redistribute ?? [])
+      lines.push(`redistribute ${source}`);
+    lines.push("!");
+  }
+  if (Object.values(device.ports ?? {}).some((port) => port?.storm_control))
+    lines.push("storm-control detection enable");
+  if (device.system?.transceiver_monitoring)
+    lines.push("transceiver ddm enable");
+  if (device.lldp)
+    lines.push("lldp enable");
+  if (device.stp) {
+    lines.push("spanning-tree enable");
+    if (device.stp.priority !== undefined)
+      lines.push(`spanning-tree priority ${device.stp.priority}`);
+  }
+  lines.push("no snmp-server community public", "no snmp-server community private");
+  const snmp = management.snmp;
+  if (snmp?.community)
+    lines.push(`snmp-server community ${marker(snmp.community)} ro`);
+  const snmpUsers = Object.entries(snmp?.users ?? {});
+  if (snmpUsers.length)
+    lines.push(`snmp-server access ${SNMP_GROUP} read internet usm authpriv`);
+  for (const [name, user] of snmpUsers) {
+    const authentication = `authentication ${SNMP_AUTH[user.auth]} ${marker(user.auth_password)}`;
+    const privacy = `privacy ${user.privacy} ${marker(user.privacy_password)}`;
+    lines.push(`snmp-server user ${name} ${authentication} ${privacy}`, `snmp-server group ${SNMP_GROUP} user ${name} usm`);
+  }
+  if ((snmp?.community || snmpUsers.length) && allow.length)
+    lines.push(`snmp-server access-list ${MANAGEMENT_ACL}`);
+  for (const route of device.routing?.static ?? []) {
+    const { addr, len } = split(route.prefix);
+    if (familyOf(addr) === "ipv4" && route.via)
+      lines.push(`ip route ${addr} ${netmask(len)} ${route.via}`);
+  }
+  if (management.telnet) {
+    lines.push("telnet-server enable");
+    if (allow.length)
+      lines.push(`telnet-server access-list ${MANAGEMENT_ACL}`);
+  } else
+    lines.push("telnet-server disable");
+  const ssh = management.ssh;
+  if (ssh?.auth_timeout)
+    lines.push(`ssh2 server authentication-timeout ${ssh.auth_timeout}`);
+  if (ssh?.auth_retries)
+    lines.push(`ssh2 server authentication-retries ${ssh.auth_retries}`);
+  if (ssh && allow.length)
+    lines.push(`ssh2 access-list ${MANAGEMENT_ACL}`);
+  const ntp = device.system?.ntp;
+  if (ntp?.servers.length)
+    lines.push("ntp enable", ...ntp.servers.map((server) => `ntp server ${server}`));
+  return lines.join(`
+`) + `
+`;
+}
+function switching(settings, vlanId) {
+  const lines = [];
+  if (settings.access_vlan)
+    lines.push(`switchport access vlan ${vlanId(settings.access_vlan)}`);
+  if (settings.trunk_vlans) {
+    if (settings.native_vlan)
+      lines.push(`switchport trunk native vlan ${vlanId(settings.native_vlan)}`);
+    lines.push(`switchport trunk allowed vlan ${vlanList(settings.trunk_vlans.map(vlanId))}`, "switchport mode trunk");
+  }
+  return lines;
+}
+function vrrpLines(group) {
+  const lines = [`vrrp ${group.id} ip ${group.address}`];
+  if (group.interval !== undefined && group.interval !== 1)
+    lines.push(`vrrp ${group.id} timers advertise-interval ${group.interval}`);
+  if (group.priority !== undefined && group.priority !== 100)
+    lines.push(`vrrp ${group.id} priority ${group.priority}`);
+  if (!group.preempt)
+    lines.push(`no vrrp ${group.id} preempt`);
+  return lines;
+}
+function physicalPort(settings, vlanId, lagNumbers) {
+  if (!settings)
+    return ["shutdown"];
+  const lines = [];
+  if (settings.description)
+    lines.push(`description ${settings.description}`);
+  if (settings.lag)
+    return [...lines, `port-channel ${lagNumbers.get(settings.lag)}`];
+  lines.push(...switching(settings, vlanId));
+  if (settings.lldp === false)
+    lines.push("lldp disable");
+  if (settings.stp === false)
+    lines.push("spanning-tree disable");
+  const broadcast = settings.storm_control?.broadcast;
+  if (broadcast && "pps" in broadcast)
+    lines.push("storm-control mode pps", `storm-control broadcast pps ${broadcast.pps}`);
+  return lines;
+}
+var HOST_KEYS = ["ssh-rsa"];
+async function open(device) {
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  const client = await connect({
+    host: device.connection.host,
+    port: device.connection.port,
+    user: device.connection.user,
+    password: resolve(user.password),
+    hostKeys: HOST_KEYS
+  });
+  const channel = await shell(client);
+  const close = () => {
+    channel.end();
+    client.end();
+  };
+  const banner = await readUntil(channel, (text) => /[#>]\s*$/.test(text.trimEnd()), 30000);
+  const version = await send(channel, "show version", 15000, 1500);
+  if (!/[#>]\s*$/.test(banner.trimEnd()) || !version.includes("ROS")) {
+    close();
+    throw new Error(`${device.name} did not answer as ROS`);
+  }
+  await send(channel, "terminal page-break disable", 15000, 1000);
+  return { channel, close };
+}
+async function read(device) {
+  const { channel, close } = await open(device);
+  try {
+    const dump = await send(channel, "show running-config", 150000, 6000);
+    const lines = dump.replace(/\r/g, "").split(`
+`);
+    const start = lines.findIndex((line) => line.trim().startsWith("!ROS version"));
+    if (start < 0)
+      throw new Error(`${device.name} returned no configuration`);
+    const body = lines.slice(start).filter((line) => line.startsWith("!") || !/[#>]\s*$/.test(line.trim()));
+    const text = body.join(`
+`).replace(/^!(System (up )?time|Boot times):.*\n/gm, "").trim();
+    return scrub(text + `
+`).replace(/(authkey \S+|privkey\s+\S+) \S+/g, "$1 <redacted>");
+  } finally {
+    close();
+  }
+}
+function unsupported(device) {
+  const found = [];
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    for (const field of ["speed", "acl", "mtu", "addresses", "vrrp", "vrf"]) {
+      if (port[field] !== undefined)
+        found.push(`ports.${name}.${field}`);
+    }
+    if (port.lldp === true)
+      found.push(`ports.${name}.lldp true, LLDP is turned on per device`);
+    if (typeof port.stp === "object" || port.stp === true)
+      found.push(`ports.${name}.stp other than false`);
+    const storm = port.storm_control;
+    if (storm && (storm.multicast || storm.unknown_unicast || storm.broadcast && ("percent" in storm.broadcast))) {
+      found.push(`ports.${name}.storm_control other than broadcast in pps`);
+    }
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type === "lag") {
+      for (const field of ["addresses", "vrrp", "vrf", "mtu", "storm_control", "stp"]) {
+        if (iface[field] !== undefined)
+          found.push(`interfaces.${name}.${field}, a LAG here only switches`);
+      }
+      continue;
+    }
+    if (iface.type !== "vlan") {
+      found.push(`interfaces.${name}, a ${iface.type}`);
+      continue;
+    }
+    if (iface.vrf)
+      found.push(`interfaces.${name}.vrf`);
+    for (const group of iface.vrrp ?? []) {
+      if (familyOf(group.address) === "ipv6")
+        found.push(`interfaces.${name}.vrrp for IPv6`);
+    }
+  }
+  const routing = device.routing;
+  for (const field of ["bgp", "rpki"]) {
+    if (routing?.[field])
+      found.push(`routing.${field}`);
+  }
+  const ospf = routing?.ospf;
+  if (ospf?.families?.includes("ipv6"))
+    found.push("routing.ospf for IPv6");
+  for (const [areaId, area] of Object.entries(ospf?.areas ?? {})) {
+    for (const [name, settings] of Object.entries(area.interfaces)) {
+      if (device.interfaces?.[name]?.type !== "vlan")
+        found.push(`routing.ospf.areas.${areaId}.${name}, OSPF runs on VLAN interfaces here`);
+      if (settings?.bfd)
+        found.push(`routing.ospf.areas.${areaId}.${name}.bfd`);
+    }
+  }
+  for (const route of routing?.static ?? []) {
+    if (!route.via || route.vrf)
+      found.push(`routing.static ${route.prefix}, only an IPv4 next hop in the default table`);
+  }
+  const UNSUPPORTED_SECTIONS = [
+    "firewall",
+    "dhcp",
+    "dhcp_relay",
+    "acls",
+    "policies",
+    "prefix_sets",
+    "hardware_offload",
+    "certificates",
+    "vrfs",
+    "flow_export"
+  ];
+  for (const field of UNSUPPORTED_SECTIONS) {
+    if (device[field] !== undefined)
+      found.push(field);
+  }
+  const management = device.management ?? {};
+  for (const field of ["http", "https", "api", "api_tls", "ftp", "native", "console"]) {
+    if (management[field])
+      found.push(`management.${field}`);
+  }
+  for (const [name, user] of Object.entries(management.snmp?.users ?? {})) {
+    if (!SNMP_AUTH[user.auth])
+      found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
+  }
+  if (device.lldp && device.lldp !== true)
+    found.push("lldp.interfaces, LLDP is per device");
+  if (device.stp?.mode && device.stp.mode !== "mstp")
+    found.push("stp.mode other than mstp");
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    if (user.role !== "admin")
+      found.push(`users.${name}.role other than admin`);
+  }
+  const system = device.system ?? {};
+  if (system.dns || system.logging || system.release_channel || system.banner || system.ntp?.serve) {
+    found.push("system.dns, logging, release_channel, banner and ntp.serve");
+  }
+  return found;
+}
+var REFUSED = /^(%|Error|Incomplete|Unrecognized)|can not|cannot |is in use|Wrong parameter|invalid|unsuccessful/im;
+var CONFIRM = /^(portswitch|switchport trunk allowed vlan|switchport mode)/;
+var RELEASE = /^no (\S+ access-list \d+)$/;
+async function apply(device, _network, plan) {
+  const { channel, close } = await open(device);
+  const released = [];
+  try {
+    await send(channel, "config", 1e4);
+    for (const step of plan.steps) {
+      for (const line of step.send) {
+        let answer = await send(channel, substitute(line), 20000, 2000);
+        if (/[[(]y\/n[\])]|input 'y'/i.test(answer) || CONFIRM.test(line))
+          answer += await send(channel, "y", 1e4, 1000);
+        if (REFUSED.test(answer))
+          throw new Error(`${step.title}: ${line}
+    device said: ${answer.trim().slice(0, 300)}`);
+        const release = RELEASE.exec(line);
+        if (release)
+          released.push(release[1]);
+        else if (released.includes(line))
+          released.splice(released.indexOf(line), 1);
+      }
+    }
+    await send(channel, "exit", 1e4);
+  } catch (error) {
+    await send(channel, "end", 1e4).catch(() => {
+      return;
+    });
+    await send(channel, "config", 1e4).catch(() => {
+      return;
+    });
+    for (const binding of released)
+      await send(channel, binding, 1e4).catch(() => {
+        return;
+      });
+    if (released.length)
+      console.log(`  bound again: ${released.join(", ")}`);
+    throw error;
+  } finally {
+    close();
+  }
+  const proof = await open(device).catch(() => {
+    return;
+  });
+  if (!proof)
+    throw new Error("applied, but a fresh login failed. Not written: a reboot restores the previous configuration. Recover from the console.");
+  await send(proof.channel, "write", 60000, 3000);
+  proof.close();
+  console.log("  applied, login proved, written");
+}
+var holders = (config) => [...config.matchAll(new RegExp(`^([a-z0-9-]+) access-list ${MANAGEMENT_ACL}$`, "gm"))].map((match) => match[1]);
+function createdIds(line) {
+  const list = line.replace(/^create vlan /, "").replace(/ active$/, "");
+  const ids = [];
+  for (const part of list.split(",")) {
+    const [first, last] = part.split("-").map(Number);
+    for (let id = first;id <= (last ?? first); id++)
+      ids.push(id);
+  }
+  return ids;
+}
+function plan(desired, current) {
+  const groups = compare(desired, current, dialect);
+  const existing = entries(current, dialect);
+  for (const group of groups) {
+    if (!group.path[0]?.startsWith("access-list "))
+      continue;
+    for (const line of group.add) {
+      const number = /^rule (\d+) /.exec(line)?.[1];
+      if (!number)
+        continue;
+      const old = existing.find((entry) => entry.path.join(`
+`) === group.path.join(`
+`) && entry.line.startsWith(`rule ${number} `) && entry.line !== line);
+      if (old && !group.remove.includes(old.line))
+        group.remove.push(old.line);
+    }
+  }
+  vlanListChange(groups, "create vlan ", createdIds, (ids) => [`create vlan ${vlanList(ids)} active`], (ids) => ids.map((id) => `vlan ${id}`));
+  for (const group of groups) {
+    const isPort = group.path[0]?.startsWith("interface ") ?? false;
+    const switches = group.add.some((line) => line.startsWith("switchport") || line.startsWith("port-channel"));
+    if (isPort && switches)
+      group.add.unshift("portswitch");
+  }
+  const lagRemovals = [];
+  for (const group of groups) {
+    if (group.path.length)
+      continue;
+    lagRemovals.push(...group.remove.filter((line) => line.startsWith("interface port-channel")));
+    group.remove = group.remove.filter((line) => !line.startsWith("interface port-channel"));
+  }
+  const releaseAndBind = (group) => {
+    if (group.path[0] !== `access-list ${MANAGEMENT_ACL}`)
+      return { before: [], after: [] };
+    return {
+      before: holders(current).map((service) => `no ${service} access-list ${MANAGEMENT_ACL}`),
+      after: holders(desired).map((service) => `${service} access-list ${MANAGEMENT_ACL}`)
+    };
+  };
+  const planned = steps(groups.filter((group) => group.add.length || group.remove.length), dialect, releaseAndBind);
+  if (lagRemovals.length) {
+    const removeLags = {
+      title: "LAGs no longer used",
+      show: lagRemovals.map((line) => `- ${line}`),
+      send: lagRemovals.map(undo)
+    };
+    planned.push(removeLags);
+  }
+  return { steps: planned, problems: [] };
+}
+var raisecom = { extension: ".txt", unsupported, render, read, plan, apply };
+
+// src/adapters/devices/routeros/export.ts
+var unwrap = (text) => text.replace(/\r/g, "").replace(/\\\n\s*/g, "");
+function unquote(value) {
+  if (!value.startsWith('"'))
+    return value;
+  return value.slice(1, -1).replace(/\\(.)/g, (_, escaped) => escaped === "_" ? " " : escaped);
+}
+function words(line) {
+  const result = [];
+  let current = "";
+  let inQuotes = false;
+  let bracketDepth = 0;
+  for (let i = 0;i < line.length; i++) {
+    const char = line[i];
+    if (inQuotes) {
+      current += char;
+      if (char === "\\")
+        current += line[++i] ?? "";
+      else if (char === '"')
+        inQuotes = false;
+      continue;
+    }
+    if (char === '"')
+      inQuotes = true;
+    if (char === "[")
+      bracketDepth++;
+    if (char === "]")
+      bracketDepth--;
+    if (char === " " && bracketDepth === 0) {
+      if (current)
+        result.push(current);
+      current = "";
+      continue;
+    }
+    current += char;
+  }
+  if (current)
+    result.push(current);
+  return result;
+}
+function parseLine(menu, line) {
+  const [verb, ...rest] = words(line);
+  let selector = "";
+  const first = rest[0];
+  if (verb === "set" && first && (first.startsWith("[") || !first.includes("="))) {
+    selector = rest.shift().replace(/\s+/g, " ");
+  }
+  const flags = [];
+  const attrs = {};
+  let group = "";
+  for (const word of rest) {
+    const equals = word.indexOf("=");
+    if (equals < 0) {
+      flags.push(word);
+      continue;
+    }
+    let name = word.slice(0, equals);
+    if (name.startsWith("."))
+      name = group + name;
+    else if (name.includes("."))
+      group = name.split(".")[0];
+    attrs[name] = unquote(word.slice(equals + 1));
+  }
+  return { menu, verb, selector, flags, attrs };
+}
+function parse(text) {
+  const commands = [];
+  const generated = new Set;
+  let menu = "";
+  for (const raw of unwrap(text).split(`
+`)) {
+    const line = raw.trim();
+    if (line.startsWith("/")) {
+      menu = line;
+      continue;
+    }
+    const marker2 = /^# generated (\S+)$/.exec(line);
+    if (marker2)
+      generated.add(marker2[1]);
+    if (menu && /^(add|set)( |$)/.test(line))
+      commands.push(parseLine(menu, line));
+  }
+  return { commands, generated };
+}
+var DEFAULTS = {
+  "*": { disabled: "no", comment: "", instance: "default", "routing-table": "main", vrf: "main" },
+  "/interface bridge": { "protocol-mode": "rstp", priority: "0x8000", "vlan-filtering": "no", pvid: "1" },
+  "/interface bridge port": { pvid: "1", "frame-types": "admit-all", edge: "auto", "path-cost": "10", priority: "0x80" },
+  "/interface bonding": { mode: "balance-rr", "transmit-hash-policy": "layer-2", mtu: "1500" },
+  "/interface ethernet": { mtu: "1500", "auto-negotiation": "yes" },
+  "/interface ethernet switch port": {
+    "storm-rate": "100",
+    "limit-broadcasts": "yes",
+    "limit-unknown-multicasts": "no",
+    "limit-unknown-unicasts": "no"
+  },
+  "/interface vlan": { "l3-hw-offloading": "yes", mtu: "1500" },
+  "/interface vrrp": { priority: "100", "preemption-mode": "yes", interval: "1s", version: "3", "v3-protocol": "ipv4" },
+  "/interface vxlan": { port: "4789" },
+  "/interface wireguard peers": {
+    "client-allowed-address": "",
+    "endpoint-address": "",
+    "endpoint-port": "0",
+    "persistent-keepalive": "0s"
+  },
+  "/ipv6 address": { advertise: "yes" },
+  "/ip dhcp-server": { "lease-time": "30m" },
+  "/ip dns": { servers: "", "allow-remote-requests": "no" },
+  "/ip service": { address: "", certificate: "none" },
+  "/ip ssh": { "strong-crypto": "no" },
+  "/ip traffic-flow": { enabled: "no", interfaces: "all", "packet-sampling": "no" },
+  "/tool mac-server": { "allowed-interface-list": "all" },
+  "/tool mac-server mac-winbox": { "allowed-interface-list": "all" },
+  "/tool mac-server ping": { enabled: "yes" },
+  "/tool bandwidth-server": { enabled: "yes" },
+  "/ip neighbor discovery-settings": { "discover-interface-list": "!dynamic", protocol: "cdp,lldp,mndp" },
+  "/snmp": { enabled: "no", contact: "", location: "" },
+  "/snmp community": {
+    addresses: "::/0",
+    name: "public",
+    security: "none",
+    "authentication-protocol": "MD5",
+    "encryption-protocol": "DES",
+    "read-access": "yes",
+    "write-access": "no"
+  },
+  "/ip settings": { "send-redirects": "yes", "tcp-syncookies": "no" },
+  "/system clock": { "time-zone-autodetect": "yes", "time-zone-name": "manual" },
+  "/system note": { note: "", "show-at-login": "yes" },
+  "/system ntp client": { enabled: "no" },
+  "/system ntp server": { enabled: "no" },
+  "/system logging action": { "disk-file-count": "2", "disk-lines-per-file": "1000" },
+  "/system package update": { channel: "stable" },
+  "/system routerboard settings": { "enter-setup-on": "any-key" },
+  "/interface ethernet switch": { "l3-hw-offloading": "no" },
+  "/interface ethernet switch l3hw-settings": { autorestart: "no", "ipv6-hw": "no" }
+};
+var SERVICE_DISABLED = {
+  ftp: "no",
+  ssh: "no",
+  telnet: "no",
+  www: "no",
+  "www-ssl": "yes",
+  "reverse-proxy": "no",
+  winbox: "no",
+  api: "no",
+  "api-ssl": "no"
+};
+var HELPER_DISABLED = { irc: "yes", rtsp: "yes" };
+function defaultOf(command, property) {
+  if (command.menu === "/ip service" && property === "disabled")
+    return SERVICE_DISABLED[command.selector];
+  if (command.menu === "/ip firewall service-port" && property === "disabled")
+    return HELPER_DISABLED[command.selector] ?? "no";
+  return DEFAULTS[command.menu]?.[property] ?? DEFAULTS["*"][property];
+}
+var CLEARED_WITH = {
+  "/interface ethernet": { speed: "auto-negotiation" }
+};
+var SECRET_KEYS = new Set(["private-key", "password", "tcp-md5-key", "authentication-password", "encryption-password"]);
+var isSecretMarker = (value) => value.startsWith("<secret:");
+var canonicalRule = (rule) => rule.replace(/\s*([=&|;{}(),<>!]+)\s*/g, "$1").replace(/\s+/g, " ").trim();
+function normalValue(command, property, value) {
+  if (property === "rule")
+    return canonicalRule(value);
+  if (property === "tagged" || property === "untagged" || property === "slaves")
+    return value.split(",").sort().join(",");
+  const onInterface = property === "address" && (command.menu === "/ip address" || command.menu === "/ipv6 address");
+  const isAddress2 = /(^|-)address$/.test(property) && !property.endsWith("mac-address");
+  if (onInterface && !value.includes("/"))
+    return `${value}/${value.includes(":") ? 64 : 32}`;
+  if (!onInterface && isAddress2 && /^[\d.]+\/32$/.test(value))
+    return value.slice(0, -3);
+  if (!onInterface && isAddress2 && value.includes(":") && !value.includes("/") && !value.includes(","))
+    return `${value}/128`;
+  return value;
+}
+function normal(command) {
+  const result = {};
+  for (const [property, raw] of Object.entries(command.attrs)) {
+    if (SECRET_KEYS.has(property) || isSecretMarker(raw))
+      continue;
+    const value = normalValue(command, property, raw);
+    if (value === defaultOf(command, property))
+      continue;
+    result[property] = value;
+  }
+  if (command.menu === "/ip address" && result.network && result.address && network(result.address).split("/")[0] === result.network)
+    delete result.network;
+  return result;
+}
+var IDENTITY = {
+  "/interface wireguard peers": ["public-key"],
+  "/interface list member": ["list", "interface"],
+  "/ip firewall address-list": ["list", "address"],
+  "/ipv6 firewall address-list": ["list", "address"],
+  "/interface bridge port": ["interface"],
+  "/interface bridge vlan": ["vlan-ids"],
+  "/interface vxlan vteps": ["interface", "remote-ip"],
+  "/routing bgp connection": ["remote.address"],
+  "/routing rpki": ["address"],
+  "/routing ospf interface-template": ["area", "interfaces"],
+  "/routing bfd configuration": ["interfaces"],
+  "/ip route": ["dst-address", "routing-table"],
+  "/ipv6 route": ["dst-address", "routing-table"],
+  "/ip address": ["address"],
+  "/ipv6 address": ["address"],
+  "/ip dhcp-server network": ["address"],
+  "/ip dhcp-server lease": ["address"],
+  "/ip traffic-flow target": ["dst-address", "port"],
+  "/system ntp client servers": ["address"],
+  "/system logging": ["action", "topics"],
+  "/user ssh-keys": ["user", "key"]
+};
+function identity(command) {
+  if (command.menu === "/interface bridge" && command.attrs["vlan-filtering"] === "yes")
+    return { "vlan-filtering": "yes" };
+  const normalized = normal(command);
+  const properties = IDENTITY[command.menu] ?? ["name"];
+  const result = {};
+  for (const property of properties) {
+    const value = normalized[property] ?? command.attrs[property] ?? defaultOf(command, property) ?? "";
+    result[property] = value;
+  }
+  return result;
+}
+var ORDERED = new Set([
+  "/routing filter rule",
+  "/ip firewall filter",
+  "/ipv6 firewall filter",
+  "/ip firewall nat",
+  "/ipv6 firewall nat",
+  "/ip firewall mangle",
+  "/ipv6 firewall mangle",
+  "/ip firewall raw",
+  "/ipv6 firewall raw",
+  "/interface bridge filter",
+  "/interface ethernet switch rule"
+]);
+function canonical(command) {
+  const properties = Object.entries(normal(command)).sort(([a], [b]) => a.localeCompare(b)).map(([name, value]) => `${name}=${value}`);
+  const flags = [...command.flags].sort();
+  return [command.verb, command.selector, ...flags, ...properties].filter(Boolean).join(" ");
+}
+
+// src/adapters/devices/routeros/plan.ts
+var INSTALL_CERTIFICATE = "#install-certificate ";
+var ORDER = [
+  "/certificate",
+  "/interface bridge",
+  "/interface ethernet",
+  "/interface bonding",
+  "/interface vlan",
+  "/interface gre",
+  "/interface vxlan",
+  "/interface wireguard",
+  "/interface vrrp",
+  "/interface bridge port",
+  "/interface bridge vlan",
+  "/interface bridge filter",
+  "/interface list",
+  "/ip vrf",
+  "/ip address",
+  "/ipv6 address",
+  "/ip pool",
+  "/ip dhcp-server",
+  "/ip firewall address-list",
+  "/ipv6 firewall address-list",
+  "/ip firewall",
+  "/ipv6 firewall",
+  "/routing rpki",
+  "/routing filter rule",
+  "/routing bgp instance",
+  "/routing bgp connection",
+  "/routing ospf instance",
+  "/routing ospf area",
+  "/routing ospf interface-template",
+  "/ip",
+  "/ipv6",
+  "/routing",
+  "/interface ethernet switch",
+  "/snmp",
+  "/tool",
+  "/user",
+  "/system"
+];
+function rank(menu) {
+  let best = ORDER.length;
+  let bestLength = 0;
+  ORDER.forEach((prefix, index) => {
+    const matches = menu === prefix || menu.startsWith(prefix + " ");
+    if (matches && prefix.length > bestLength) {
+      best = index;
+      bestLength = prefix.length;
+    }
+  });
+  return best;
+}
+var DYNAMIC = new Set([
+  "/ip route",
+  "/ipv6 route",
+  "/ip address",
+  "/ipv6 address",
+  "/ip firewall address-list",
+  "/ipv6 firewall address-list",
+  "/ip firewall filter",
+  "/ipv6 firewall filter",
+  "/ip firewall nat",
+  "/ip dhcp-server lease"
+]);
+var quote = (value) => `"${value.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$")}"`;
+var value = (raw) => /^[\w.:/@,!-]+$/.test(raw) ? raw : quote(raw);
+var findValue = (raw) => /^[\w.:-]+$/.test(raw) ? raw : quote(raw);
+function find(menu, id) {
+  const conditions = Object.entries(id).map(([property, raw]) => `${property}=${findValue(raw)}`);
+  if (DYNAMIC.has(menu))
+    conditions.push("!dynamic");
+  return `[ find ${conditions.join(" and ")} ]`;
+}
+function line(menu, verb, selector, flags, attrs) {
+  const properties = Object.entries(attrs).map(([property, raw]) => `${property}=${value(raw)}`);
+  return [menu, verb, selector, ...flags, ...properties].filter(Boolean).join(" ");
+}
+var describe = (attrs) => Object.entries(attrs).map(([property, raw]) => `${property}=${raw}`).join(" ");
+function byMenu(commands) {
+  const groups = new Map;
+  for (const command of commands) {
+    const group = groups.get(command.menu) ?? [];
+    group.push(command);
+    groups.set(command.menu, group);
+  }
+  return groups;
+}
+function changes(wanted, existing, sendSecrets, problems, label) {
+  const want = normal(wanted);
+  const have = existing ? normal(existing) : {};
+  const result = {};
+  for (const [property, desired] of Object.entries(want)) {
+    if (have[property] !== desired)
+      result[property] = desired;
+  }
+  for (const property of Object.keys(have)) {
+    if (property in want)
+      continue;
+    const clearedWith = CLEARED_WITH[wanted.menu]?.[property];
+    if (clearedWith && !(clearedWith in want))
+      continue;
+    const fallback = defaultOf(wanted, property);
+    if (fallback === undefined) {
+      problems.push(`${label}: ${property}=${have[property]} is set on the device and its default is unknown; add it to DEFAULTS`);
+    } else {
+      result[property] = fallback;
+    }
+  }
+  if (sendSecrets) {
+    for (const [property, raw] of Object.entries(wanted.attrs)) {
+      if (SECRET_KEYS.has(property) || isSecretMarker(raw))
+        result[property] = raw;
+    }
+  }
+  return result;
+}
+function planSettings(menu, wanted, existing, sendSecrets, problems) {
+  const step = { title: menu, show: [], send: [] };
+  const wantedBySelector = new Map(wanted.filter((item) => item.verb === "set").map((item) => [item.selector, item]));
+  const existingBySelector = new Map(existing.filter((item) => item.verb === "set").map((item) => [item.selector, item]));
+  for (const selector of new Set([...wantedBySelector.keys(), ...existingBySelector.keys()])) {
+    const want = wantedBySelector.get(selector);
+    const have = existingBySelector.get(selector);
+    const target = want ?? { ...have, attrs: {} };
+    const update = changes(target, have, sendSecrets, problems, `${menu} ${selector}`);
+    if (!Object.keys(update).length)
+      continue;
+    step.show.push(`~ set ${selector} ${describe(update)}`.replace(/\s+/g, " "));
+    step.send.push(line(menu, "set", selector, [], update));
+  }
+  return step.send.length ? step : undefined;
+}
+function planEntries(menu, wanted, existing, sendSecrets, problems) {
+  const result = { first: [], last: [] };
+  const changeStep = { title: menu, show: [], send: [] };
+  const removeStep = { title: menu, show: [], send: [] };
+  const key = (c) => JSON.stringify(identity(c));
+  const wantedEntries = wanted.filter((item) => item.verb === "add");
+  const existingEntries = existing.filter((item) => item.verb === "add");
+  const existingByKey = new Map;
+  for (const entry of existingEntries) {
+    const entryKey = key(entry);
+    if (existingByKey.has(entryKey))
+      problems.push(`${menu}: two entries share ${entryKey}, so neither can be addressed alone`);
+    existingByKey.set(entryKey, entry);
+  }
+  const kept = new Set;
+  for (const entry of wantedEntries) {
+    const entryKey = key(entry);
+    kept.add(entryKey);
+    const current = existingByKey.get(entryKey);
+    if (!current) {
+      changeStep.show.push(`+ ${canonical(entry)}`);
+      changeStep.send.push(line(menu, "add", "", entry.flags, entry.attrs));
+      continue;
+    }
+    const flagsDiffer = [...entry.flags].sort().join() !== [...current.flags].sort().join();
+    if (flagsDiffer) {
+      changeStep.show.push(`~ replace ${canonical(entry)}`);
+      removeStep.send.push(`${menu} remove ${find(menu, identity(current))}`);
+      changeStep.send.push(line(menu, "add", "", entry.flags, entry.attrs));
+      continue;
+    }
+    const update = changes(entry, current, sendSecrets, problems, `${menu} ${entryKey}`);
+    if (!Object.keys(update).length)
+      continue;
+    changeStep.show.push(`~ ${entryKey} ${describe(update)}`);
+    changeStep.send.push(line(menu, "set", find(menu, identity(current)), [], update));
+  }
+  const removed = existingEntries.filter((entry) => !kept.has(key(entry)));
+  const wholeLists = new Set;
+  if (menu.endsWith("address-list")) {
+    for (const entry of removed) {
+      const list = entry.attrs.list;
+      if (!wantedEntries.some((candidate) => candidate.attrs.list === list))
+        wholeLists.add(list);
+    }
+  }
+  for (const list of wholeLists) {
+    const count = removed.filter((entry) => entry.attrs.list === list).length;
+    removeStep.show.push(`- list ${list}, ${count} entr${count === 1 ? "y" : "ies"}`);
+    removeStep.send.push(`${menu} remove [ find list=${quote(list)} and !dynamic ]`);
+  }
+  for (const entry of removed) {
+    if (wholeLists.has(entry.attrs.list ?? ""))
+      continue;
+    removeStep.show.push(`- ${canonical(entry)}`);
+    removeStep.send.push(`${menu} remove ${find(menu, identity(entry))}`);
+  }
+  if (changeStep.send.length)
+    result.first.push(changeStep);
+  if (removeStep.send.length)
+    result.last.push(removeStep);
+  return result;
+}
+function planCertificates(wanted, existing) {
+  const menu = "/certificate";
+  const result = { first: [], last: [] };
+  const install = { title: menu, show: [], send: [] };
+  const remove = { title: menu, show: [], send: [] };
+  const existingByName = new Map(existing.map((item) => [item.attrs.name, item]));
+  const wantedNames = new Set(wanted.map((item) => item.attrs.name));
+  const renamed = new Set;
+  for (const entry of wanted) {
+    const name = entry.attrs.name;
+    const current = existingByName.get(name);
+    if (current && canonical(current) === canonical(entry))
+      continue;
+    const sameCertificate = existing.find((item) => !wantedNames.has(item.attrs.name) && !renamed.has(item.attrs.name) && item.attrs.fingerprint === entry.attrs.fingerprint && item.attrs["private-key"] === entry.attrs["private-key"]);
+    if (!current && sameCertificate) {
+      const oldName = sameCertificate.attrs.name;
+      renamed.add(oldName);
+      install.show.push(`~ rename ${oldName} to ${name}`);
+      install.send.push(`${menu} set [ find name=${quote(oldName)} ] name=${quote(name)}`);
+      continue;
+    }
+    install.show.push(`${current ? "~" : "+"} install ${name}`);
+    if (current)
+      install.send.push(`${menu} remove [ find name=${quote(name)} ]`);
+    install.send.push(INSTALL_CERTIFICATE + name);
+  }
+  for (const entry of existing) {
+    if (wantedNames.has(entry.attrs.name) || renamed.has(entry.attrs.name))
+      continue;
+    remove.show.push(`- ${entry.attrs.name}`);
+    remove.send.push(`${menu} remove [ find name=${quote(entry.attrs.name)} ]`);
+  }
+  if (install.send.length)
+    result.first.push(install);
+  if (remove.send.length)
+    result.last.push(remove);
+  return result;
+}
+var OLD_RULES = "frameworkOldRules";
+function planOrdered(menu, wanted, existing) {
+  const result = { first: [], last: [] };
+  const same = wanted.map((item) => canonical(item)).join(`
+`) === existing.map((item) => canonical(item)).join(`
+`);
+  if (same)
+    return result;
+  const where = DYNAMIC.has(menu) ? " where !dynamic" : "";
+  const hasChains = [...wanted, ...existing].some((item) => item.attrs.chain !== undefined);
+  const keptChains = new Set(wanted.map((item) => item.attrs.chain ?? ""));
+  const droppedChains = [...new Set(existing.map((item) => item.attrs.chain ?? ""))].filter((chain) => !keptChains.has(chain));
+  let removeOld = `${menu} remove $${OLD_RULES}`;
+  if (hasChains) {
+    const keep = [...keptChains].map((chain) => quote(chain)).join(";");
+    const inKeptChain = `[:typeof [:find $keep [${menu} get $id chain]]] != "nil"`;
+    removeOld = `:local keep {${keep}}; :foreach id in=$${OLD_RULES} do={ :if (${inKeptChain}) do={ ${menu} remove $id } }`;
+  }
+  const send2 = [
+    `:global ${OLD_RULES} [${menu} find${where}]`,
+    ...wanted.map((item) => line(menu, "add", "", item.flags, item.attrs)),
+    `:global ${OLD_RULES}; ${removeOld}; /system script environment remove [find name="${OLD_RULES}"]`
+  ];
+  const show = [...existing.map((item) => `- ${canonical(item)}`), ...wanted.map((item) => `+ ${canonical(item)}`)];
+  result.first.push({ title: `${menu}, in the order of the config`, show, send: send2 });
+  if (hasChains) {
+    for (const chain of droppedChains) {
+      const selector = `[ find chain=${quote(chain)}${DYNAMIC.has(menu) ? " and !dynamic" : ""} ]`;
+      result.last.push({ title: `${menu} chain ${chain}`, show: [`- chain ${chain}`], send: [`${menu} remove ${selector}`] });
+    }
+  }
+  return result;
+}
+function plan2(desired, current, options) {
+  const want = parse(desired);
+  const have = parse(current);
+  const owned = (command) => !(command.menu.endsWith("address-list") && want.generated.has(command.attrs.list ?? ""));
+  const wantedByMenu = byMenu(want.commands.filter(owned));
+  const existingByMenu = byMenu(have.commands.filter(owned));
+  const menus = [...new Set([...wantedByMenu.keys(), ...existingByMenu.keys()])].sort((a, b) => rank(a) - rank(b) || a.localeCompare(b));
+  const first = [];
+  const last = [];
+  const problems = [];
+  for (const menu of menus) {
+    const wanted = wantedByMenu.get(menu) ?? [];
+    const existing = existingByMenu.get(menu) ?? [];
+    let menuPlan;
+    if (menu === "/certificate")
+      menuPlan = planCertificates(wanted, existing);
+    else if (ORDERED.has(menu))
+      menuPlan = planOrdered(menu, wanted, existing);
+    else {
+      menuPlan = planEntries(menu, wanted, existing, options.secrets, problems);
+      const settings = planSettings(menu, wanted, existing, options.secrets, problems);
+      if (settings)
+        menuPlan.first.unshift(settings);
+    }
+    first.push(...menuPlan.first);
+    last.unshift(...menuPlan.last);
+  }
+  return { steps: [...first, ...last], problems };
+}
+
+// src/adapters/devices/routeros/render.ts
+import { X509Certificate } from "node:crypto";
+class Output {
+  menus = new Map;
+  add(menu, command) {
+    const commands = this.menus.get(menu) ?? [];
+    commands.push(command);
+    this.menus.set(menu, commands);
+  }
+  text() {
+    const blocks = [...this.menus].map(([menu, commands]) => [menu, ...commands].join(`
+`));
+    return blocks.join(`
+`) + `
+`;
+  }
+}
+function quote2(value2) {
+  const plain = /^[\w.:/@-]+$/.test(value2);
+  if (plain)
+    return value2;
+  const escaped = value2.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
+  return `"${escaped}"`;
+}
+function command(verb, properties) {
+  const words2 = [verb];
+  for (const [name, value2] of Object.entries(properties)) {
+    if (value2 === undefined || value2 === false)
+      continue;
+    const written = typeof value2 === "number" ? String(value2) : quote2(value2);
+    words2.push(`${name}=${written}`);
+  }
+  return words2.join(" ");
+}
+var yesNo = (on) => on ? "yes" : "no";
+var familySuffix = (family) => family === "ipv4" ? "V4" : "V6";
+function portList(ports) {
+  if (ports === undefined)
+    return;
+  return [ports].flat().join(",");
+}
+function duration(seconds) {
+  const units = [
+    ["w", 604800],
+    ["d", 86400],
+    ["h", 3600],
+    ["m", 60],
+    ["s", 1]
+  ];
+  let remaining = seconds;
+  let text = "";
+  for (const [unit, size] of units) {
+    const count = Math.floor(remaining / size);
+    if (count > 0)
+      text += `${count}${unit}`;
+    remaining %= size;
+  }
+  return text || "0s";
+}
+function bitrate(rate) {
+  const match = /^([\d.]+)([kMG])$/.exec(rate);
+  if (!match)
+    return rate;
+  const [, amount, unit] = match;
+  const suffix = unit === "k" ? "kbps" : `${unit}bps`;
+  return `${Number(amount).toFixed(1)}${suffix}`;
+}
+function dottedMask(cidr) {
+  const { addr, len } = split(cidr);
+  const mask = len === 0 ? 0 : 4294967295 << 32 - len >>> 0;
+  const octets = [24, 16, 8, 0].map((shift) => mask >>> shift & 255);
+  return `${addr}/${octets.join(".")}`;
+}
+function communityPattern(pattern) {
+  const fields = pattern.split(":").map((field) => field === "*" ? "[0-9]+" : field);
+  return `^${fields.join(":")}$`;
+}
+var BRIDGE = "bridge";
+
+class Context {
+  device;
+  ports;
+  interfaces;
+  constructor(device) {
+    this.device = device;
+    this.ports = Object.fromEntries(Object.entries(device.ports ?? {}).filter((entry) => entry[1] !== undefined));
+    this.interfaces = device.interfaces ?? {};
+  }
+  name(portOrInterface) {
+    if (portOrInterface in this.interfaces)
+      return portOrInterface;
+    return spell(this.device.platform, this.device.model, portOrInterface);
+  }
+  vlanId(vlan) {
+    const declared = this.device.vlans?.[vlan];
+    if (!declared)
+      throw new Error(`${this.device.name}: VLAN ${vlan} is not declared`);
+    return declared.id;
+  }
+  switched() {
+    const ports = Object.entries(this.ports).filter(([, port]) => !port.lag && (port.access_vlan || port.trunk_vlans));
+    const lags = Object.entries(this.interfaces).filter((entry) => {
+      const lag = entry[1];
+      return lag.type === "lag" && Boolean(lag.access_vlan || lag.trunk_vlans);
+    });
+    return [...ports, ...lags];
+  }
+  vlanInterfaces() {
+    return Object.entries(this.interfaces).filter((entry) => entry[1].type === "vlan");
+  }
+  routed() {
+    const ports = Object.entries(this.ports).map(([port, settings]) => ({ name: this.name(port), settings }));
+    const interfaces = Object.entries(this.interfaces).map(([name, settings]) => ({ name, settings }));
+    return [...ports, ...interfaces];
+  }
+}
+var BPDU_DESTINATION = "01:80:C2:00:00:00/FF:FF:FF:FF:FF:FF";
+function renderInterfaces(out, ctx) {
+  hardwareOffload(out, ctx);
+  bridge(out, ctx);
+  ethernet(out, ctx);
+  switchPorts(out, ctx);
+  lags(out, ctx);
+  vlanInterfaces(out, ctx);
+  tunnels(out, ctx);
+  wireguard(out, ctx);
+  vrrp(out, ctx);
+  bridgePorts(out, ctx);
+  bridgeVlans(out, ctx);
+  bridgeFilters(out, ctx);
+  interfaceLists(out, ctx);
+  vrfs(out, ctx);
+}
+function hardwareOffload(out, ctx) {
+  const on = yesNo(ctx.device.hardware_offload);
+  out.add("/interface ethernet switch", command("set switch1", { "l3-hw-offloading": on }));
+  out.add("/interface ethernet switch l3hw-settings", command("set", { autorestart: on, "ipv6-hw": on }));
+}
+function bridge(out, ctx) {
+  const { device } = ctx;
+  const needsBridge = ctx.switched().length > 0 || ctx.vlanInterfaces().length > 0;
+  if (needsBridge) {
+    const stp = device.stp;
+    const protocolMode = stp ? stp.mode ?? "rstp" : "none";
+    const priority = stp?.priority === undefined ? undefined : `0x${stp.priority.toString(16)}`;
+    out.add("/interface bridge", command("add", { name: BRIDGE, "protocol-mode": protocolMode, priority, "vlan-filtering": "yes" }));
+  }
+  for (const [name, iface] of Object.entries(ctx.interfaces)) {
+    if (iface.type !== "loopback")
+      continue;
+    out.add("/interface bridge", command("add", { comment: iface.description, name }));
+  }
+}
+var MEDIUM = {
+  optical: {
+    "1g": "1G-baseX",
+    "10g": "10G-baseSR-LR",
+    "25g": "25G-baseSR-LR",
+    "40g": "40G-baseSR4-LR4",
+    "50g": "50G-baseSR2-LR2",
+    "100g": "100G-baseSR4-LR4"
+  },
+  copper: {
+    "100m": "100M-baseT-full",
+    "1g": "1G-baseT-full"
+  }
+};
+function mediumOf(platformPortName, speed) {
+  const medium = platformPortName.startsWith("ether") ? "copper" : "optical";
+  return MEDIUM[medium][speed];
+}
+function ethernet(out, ctx) {
+  const { device } = ctx;
+  for (const port of portsOf(device.platform, device.model)) {
+    const selector = `set [ find default-name=${spell(device.platform, device.model, port)} ]`;
+    const settings = ctx.ports[port];
+    if (!settings) {
+      out.add("/interface ethernet", command(selector, { disabled: "yes" }));
+      continue;
+    }
+    const fixedSpeed = settings.speed && mediumOf(spell(device.platform, device.model, port), settings.speed);
+    out.add("/interface ethernet", command(selector, {
+      "auto-negotiation": fixedSpeed ? "no" : undefined,
+      comment: settings.description,
+      mtu: settings.mtu,
+      speed: fixedSpeed
+    }));
+  }
+}
+function switchPorts(out, ctx) {
+  for (const [port, settings] of Object.entries(ctx.ports)) {
+    const storm = settings.storm_control;
+    if (!storm)
+      continue;
+    const thresholds = [storm.broadcast, storm.multicast, storm.unknown_unicast].filter((threshold) => threshold !== undefined);
+    const percent = thresholds.find((threshold) => ("percent" in threshold));
+    if (!percent || !("percent" in percent))
+      continue;
+    out.add("/interface ethernet switch port", command(`set ${ctx.name(port)}`, {
+      "limit-broadcasts": yesNo(storm.broadcast !== undefined),
+      "limit-unknown-multicasts": yesNo(storm.multicast !== undefined),
+      "limit-unknown-unicasts": yesNo(storm.unknown_unicast !== undefined),
+      "storm-rate": percent.percent
+    }));
+  }
+}
+function lags(out, ctx) {
+  for (const [name, lag] of Object.entries(ctx.interfaces)) {
+    if (lag.type !== "lag")
+      continue;
+    const members = Object.entries(ctx.ports).filter(([, port]) => port.lag === name).map(([port]) => ctx.name(port));
+    const mode = lag.mode === "static" ? "balance-xor" : "802.3ad";
+    out.add("/interface bonding", command("add", {
+      comment: lag.description,
+      mode,
+      mtu: lag.mtu,
+      name,
+      slaves: members.join(","),
+      "transmit-hash-policy": "layer-2-and-3"
+    }));
+  }
+}
+function vlanInterfaces(out, ctx) {
+  for (const [name, iface] of ctx.vlanInterfaces()) {
+    const softwareOnly = ctx.device.hardware_offload && iface.hardware_offload === false;
+    out.add("/interface vlan", command("add", {
+      comment: iface.description,
+      interface: BRIDGE,
+      "l3-hw-offloading": softwareOnly ? "no" : undefined,
+      mtu: iface.mtu,
+      name,
+      "vlan-id": ctx.vlanId(iface.vlan)
+    }));
+  }
+}
+function tunnels(out, ctx) {
+  for (const [name, iface] of Object.entries(ctx.interfaces)) {
+    if (iface.type === "gre") {
+      out.add("/interface gre", command("add", {
+        comment: iface.description,
+        "local-address": iface.local,
+        mtu: iface.mtu,
+        name,
+        "remote-address": iface.remote
+      }));
+    }
+    if (iface.type === "vxlan") {
+      const port = iface.port && iface.port !== 4789 ? iface.port : undefined;
+      out.add("/interface vxlan", command("add", {
+        comment: iface.description,
+        "local-address": iface.local,
+        "mac-address": iface.mac,
+        mtu: iface.mtu,
+        name,
+        port,
+        vni: iface.vni
+      }));
+      out.add("/interface vxlan vteps", command("add", { interface: name, "remote-ip": iface.remote }));
+    }
+  }
+}
+function wireguard(out, ctx) {
+  for (const [name, iface] of Object.entries(ctx.interfaces)) {
+    if (iface.type !== "wireguard")
+      continue;
+    out.add("/interface wireguard", command("add", {
+      comment: iface.description,
+      "listen-port": iface.listen_port,
+      mtu: iface.mtu,
+      name,
+      "private-key": marker(iface.private_key)
+    }));
+    for (const peer of iface.peers ?? []) {
+      const endpoint = peer.endpoint ? splitEndpoint(peer.endpoint) : undefined;
+      out.add("/interface wireguard peers", command("add", {
+        "allowed-address": peer.allowed_addresses.join(","),
+        "client-allowed-address": peer.client_allowed_addresses?.join(","),
+        "endpoint-address": endpoint?.host,
+        "endpoint-port": endpoint?.port,
+        interface: name,
+        name: `${name}-${peer.name}`,
+        "persistent-keepalive": peer.keepalive ? duration(peer.keepalive) : undefined,
+        "public-key": peer.public_key
+      }));
+    }
+  }
+}
+function splitEndpoint(endpoint) {
+  const colon = endpoint.lastIndexOf(":");
+  return { host: endpoint.slice(0, colon), port: endpoint.slice(colon + 1) };
+}
+function vrrp(out, ctx) {
+  for (const { name, settings } of ctx.routed()) {
+    for (const group of settings.vrrp ?? []) {
+      const ipv6 = familyOf(group.address) === "ipv6";
+      out.add("/interface vrrp", command("add", {
+        interface: name,
+        interval: group.interval ? duration(group.interval) : undefined,
+        name: vrrpName(name, group.id),
+        "preemption-mode": yesNo(group.preempt),
+        priority: group.priority,
+        "v3-protocol": ipv6 ? "ipv6" : undefined,
+        version: ipv6 ? 3 : undefined,
+        vrid: group.id
+      }));
+    }
+  }
+}
+var vrrpName = (iface, id) => `${iface}-vrrp${id}`;
+function bridgePorts(out, ctx) {
+  for (const [port, settings] of ctx.switched()) {
+    const isTrunk = Boolean(settings.trunk_vlans);
+    const untagged = isTrunk ? settings.native_vlan : settings.access_vlan;
+    const pvid = untagged ? ctx.vlanId(untagged) : undefined;
+    let frameTypes;
+    if (!isTrunk)
+      frameTypes = "admit-only-untagged-and-priority-tagged";
+    else if (pvid === undefined)
+      frameTypes = "admit-only-vlan-tagged";
+    const stp = typeof settings.stp === "object" ? settings.stp : undefined;
+    out.add("/interface bridge port", command("add", {
+      bridge: BRIDGE,
+      edge: stp?.edge ? "yes" : undefined,
+      "frame-types": frameTypes,
+      interface: ctx.name(port),
+      "path-cost": stp?.cost,
+      priority: stp?.priority === undefined ? undefined : `0x${stp.priority.toString(16)}`,
+      pvid
+    }));
+  }
+}
+function bridgeVlans(out, ctx) {
+  for (const [vlanName, vlan] of Object.entries(ctx.device.vlans ?? {})) {
+    const routedHere = ctx.vlanInterfaces().some(([, iface]) => iface.vlan === vlanName);
+    const trunks = ctx.switched().filter(([, settings]) => settings.trunk_vlans?.includes(vlanName)).map(([port]) => ctx.name(port));
+    const tagged = [...routedHere ? [BRIDGE] : [], ...trunks];
+    if (!tagged.length)
+      continue;
+    out.add("/interface bridge vlan", command("add", {
+      bridge: BRIDGE,
+      comment: vlan.description,
+      tagged: tagged.join(","),
+      "vlan-ids": vlan.id
+    }));
+  }
+}
+function bridgeFilters(out, ctx) {
+  for (const [port, settings] of ctx.switched()) {
+    if (settings.stp !== false)
+      continue;
+    const name = ctx.name(port);
+    const comment = `${name} out of spanning tree`;
+    out.add("/interface bridge filter", command("add", {
+      action: "drop",
+      chain: "input",
+      comment,
+      "dst-mac-address": BPDU_DESTINATION,
+      "in-interface": name
+    }));
+    out.add("/interface bridge filter", command("add", {
+      action: "drop",
+      chain: "output",
+      comment,
+      "dst-mac-address": BPDU_DESTINATION,
+      "out-interface": name
+    }));
+  }
+}
+function interfaceLists(out, ctx) {
+  const lists = new Map;
+  const lldp = lldpMembers(ctx);
+  if (lldp)
+    lists.set("lldp", lldp);
+  const native = ctx.device.management?.native?.interfaces;
+  if (native)
+    lists.set("native", native.map((member) => ctx.name(member)));
+  for (const list of lists.keys())
+    out.add("/interface list", command("add", { name: list }));
+  for (const [list, members] of lists)
+    for (const member of members)
+      out.add("/interface list member", command("add", {
+        interface: member,
+        list
+      }));
+}
+function lldpMembers(ctx) {
+  const lldp = ctx.device.lldp;
+  if (!lldp)
+    return;
+  const overridden = Object.entries(ctx.ports).filter(([, port]) => port.lldp !== undefined);
+  if (lldp === true && !overridden.length)
+    return;
+  const base = lldp === true ? Object.keys(ctx.ports) : [...lldp.interfaces];
+  const members = new Set(base.map((member) => ctx.name(member)));
+  for (const [port, settings] of overridden) {
+    if (settings.lldp)
+      members.add(ctx.name(port));
+    else
+      members.delete(ctx.name(port));
+  }
+  return [...members];
+}
+function vrfs(out, ctx) {
+  for (const [vrf, settings] of Object.entries(ctx.device.vrfs ?? {})) {
+    const members = ctx.routed().filter(({ settings: iface }) => iface.vrf === vrf).map(({ name }) => name);
+    out.add("/ip vrf", command("add", { comment: settings.description, interfaces: members.join(","), name: vrf }));
+  }
+}
+var NETWORKS = { ipv4: "bgp-networks-v4", ipv6: "bgp-networks-v6" };
+function renderAddressing(out, ctx) {
+  addresses(out, ctx);
+  dhcp(out, ctx);
+  dns(out, ctx);
+  addressLists(out, ctx);
+}
+function addresses(out, ctx) {
+  for (const { name, settings } of ctx.routed()) {
+    for (const entry of settings.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      const peer = typeof entry === "string" ? undefined : entry.peer;
+      if (familyOf(address) === "ipv4") {
+        out.add("/ip address", command("add", { address, comment: settings.description, interface: name, network: peer }));
+      } else {
+        out.add("/ipv6 address", command("add", { address, advertise: yesNo(settings.ipv6_ra), comment: settings.description, interface: name }));
+      }
+    }
+    for (const group of settings.vrrp ?? []) {
+      const vrrpInterface = vrrpName(name, group.id);
+      const comment = `VRRP ${group.id} on ${name}`;
+      if (familyOf(group.address) === "ipv4") {
+        out.add("/ip address", command("add", { address: `${group.address}/32`, comment, interface: vrrpInterface }));
+      } else {
+        out.add("/ipv6 address", command("add", {
+          address: `${group.address}/128`,
+          advertise: "no",
+          comment,
+          interface: vrrpInterface
+        }));
+      }
+    }
+  }
+}
+function dhcp(out, ctx) {
+  for (const [name, server] of Object.entries(ctx.device.dhcp ?? {})) {
+    const [first, last] = server.pool;
+    out.add("/ip pool", command("add", { name, ranges: `${first}-${last}` }));
+    out.add("/ip dhcp-server", command("add", {
+      "address-pool": name,
+      interface: ctx.name(server.interface),
+      "lease-time": server.lease_time ? duration(server.lease_time) : undefined,
+      name
+    }));
+    out.add("/ip dhcp-server network", command("add", {
+      address: server.network,
+      "dns-server": server.dns?.join(","),
+      gateway: server.gateway
+    }));
+    for (const reservation of server.reservations ?? []) {
+      out.add("/ip dhcp-server lease", command("add", {
+        address: reservation.address,
+        comment: reservation.description,
+        "mac-address": reservation.mac,
+        server: name
+      }));
+    }
+  }
+  for (const [name, relay] of Object.entries(ctx.device.dhcp_relay ?? {})) {
+    out.add("/ip dhcp-relay", command("add", { "dhcp-server": relay.servers.join(","), interface: ctx.name(relay.interface), name }));
+  }
+}
+function dns(out, ctx) {
+  const dns2 = ctx.device.system?.dns;
+  out.add("/ip dns", command("set", { "allow-remote-requests": yesNo(dns2?.serve), servers: dns2?.servers.join(",") ?? "" }));
+}
+function addressLists(out, ctx) {
+  const { device } = ctx;
+  const entries2 = [];
+  for (const [list, members] of Object.entries(device.firewall?.address_sets ?? {})) {
+    for (const address of members)
+      entries2.push({ list, address });
+  }
+  for (const [list, set] of Object.entries(device.prefix_sets ?? {})) {
+    if ("prefixes" in set)
+      for (const address of set.prefixes)
+        entries2.push({ list, address });
+    else
+      out.add("/ip firewall address-list", `# generated ${list}`);
+  }
+  for (const prefix of device.routing?.bgp?.networks ?? []) {
+    entries2.push({ list: NETWORKS[familyOf(host(prefix))], address: prefix });
+  }
+  for (const family of ["ipv4", "ipv6"]) {
+    const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
+    for (const { list, address } of entries2) {
+      if (familyOf(host(address)) !== family)
+        continue;
+      out.add(menu, command("add", { address, list }));
+    }
+  }
+}
+var HELPERS = ["ftp", "tftp", "irc", "h323", "sip", "pptp", "rtsp"];
+var CHAINS = ["input", "forward", "output"];
+function renderFirewall(out, ctx) {
+  for (const family of ["ipv4", "ipv6"]) {
+    filter(out, ctx, family);
+    nat(out, ctx, family);
+  }
+  helpers(out, ctx);
+  switchAcls(out, ctx);
+}
+function families(ctx, match) {
+  const sets = ctx.device.firewall?.address_sets ?? {};
+  const address = match?.src ?? match?.dst;
+  let candidates = ["ipv4", "ipv6"];
+  if (match?.family)
+    candidates = [match.family];
+  else if (address)
+    candidates = [familyOf(address)];
+  const setHas = (set, family) => !set || (sets[set] ?? []).some((member) => familyOf(member) === family);
+  return candidates.filter((family) => setHas(match?.src_set, family) && setHas(match?.dst_set, family));
+}
+function matchProperties(ctx, match, family) {
+  const protocol = match?.protocol === "icmp" && family === "ipv6" ? "icmpv6" : match?.protocol;
+  const setFlags = match?.tcp_flags?.set ?? [];
+  const unsetFlags = (match?.tcp_flags?.unset ?? []).map((flag) => `!${flag}`);
+  const flags = match?.tcp_flags ? [...setFlags, ...unsetFlags].join(",") : undefined;
+  return {
+    "connection-state": match?.state?.join(","),
+    "dst-address": match?.dst,
+    "dst-address-list": match?.dst_set,
+    "dst-port": portList(match?.dst_port),
+    "in-interface": match?.in_interface && ctx.name(match.in_interface),
+    "out-interface": match?.out_interface && ctx.name(match.out_interface),
+    protocol,
+    "src-address": match?.src,
+    "src-address-list": match?.src_set,
+    "src-port": portList(match?.src_port),
+    "tcp-flags": flags
+  };
+}
+function filter(out, ctx, family) {
+  const menu = family === "ipv4" ? "/ip firewall filter" : "/ipv6 firewall filter";
+  for (const chain of CHAINS) {
+    const settings = ctx.device.firewall?.filter?.[chain];
+    if (!settings)
+      continue;
+    for (const rule of settings.rules ?? []) {
+      if (!families(ctx, rule.match).includes(family))
+        continue;
+      const match = matchProperties(ctx, rule.match, family);
+      if (rule.offload && family === "ipv4") {
+        out.add(menu, command("add", { action: "fasttrack-connection", chain, comment: rule.description, ...match }));
+      }
+      out.add(menu, command("add", { action: rule.action, chain, comment: rule.description, ...match }));
+    }
+    if (settings.default === "drop")
+      out.add(menu, command("add", { action: "drop", chain, comment: "Default" }));
+  }
+}
+function nat(out, ctx, family) {
+  const menu = family === "ipv4" ? "/ip firewall nat" : "/ipv6 firewall nat";
+  const chains = [
+    ["srcnat", ctx.device.firewall?.nat?.source],
+    ["dstnat", ctx.device.firewall?.nat?.destination]
+  ];
+  for (const [chain, rules] of chains) {
+    for (const rule of rules ?? []) {
+      if (!families(ctx, rule.match).includes(family))
+        continue;
+      if (rule.action !== "masquerade" && familyOf(rule.to) !== family)
+        continue;
+      const action = rule.action === "masquerade" ? {
+        action: "masquerade"
+      } : { action: rule.action === "snat" ? "src-nat" : "dst-nat", "to-addresses": rule.to, "to-ports": rule.to_port };
+      out.add(menu, command("add", { ...action, chain, comment: rule.description, ...matchProperties(ctx, rule.match, family) }));
+    }
+  }
+}
+function helpers(out, ctx) {
+  const enabled = ctx.device.firewall?.helpers ?? [];
+  for (const helper of HELPERS) {
+    out.add("/ip firewall service-port", command(`set ${helper}`, { disabled: yesNo(!enabled.includes(helper)) }));
+  }
+}
+function switchAcls(out, ctx) {
+  for (const [port, settings] of Object.entries(ctx.ports)) {
+    if (!settings.acl)
+      continue;
+    for (const rule of ctx.device.acls?.[settings.acl] ?? []) {
+      const match = rule.match ?? {};
+      const ipv6 = match.family === "ipv6" || [match.src, match.dst].some((address2) => address2 && familyOf(address2) === "ipv6");
+      const address = (prefix) => prefix && !ipv6 ? dottedMask(prefix) : prefix;
+      out.add("/interface ethernet switch rule", command("add", {
+        comment: rule.description,
+        [ipv6 ? "dst-address6" : "dst-address"]: address(match.dst),
+        "dst-port": portList(match.dst_port),
+        "mac-protocol": ipv6 ? "ipv6" : "ip",
+        "new-dst-ports": rule.action === "drop" ? "" : undefined,
+        ports: ctx.name(port),
+        protocol: match.protocol,
+        rate: rule.rate && bitrate(rule.rate),
+        [ipv6 ? "src-address6" : "src-address"]: address(match.src),
+        "src-port": portList(match.src_port),
+        switch: "switch1",
+        "vlan-id": match.vlan && ctx.vlanId(match.vlan)
+      }));
+    }
+  }
+}
+var RPKI_GROUP = "rpki";
+var REJECT_ALL = "REJECT-ALL";
+var ROLES = {
+  provider: "ebgp-customer",
+  customer: "ebgp-provider",
+  peer: "ebgp-peer",
+  rs: "ebgp-rs-client",
+  "rs-client": "ebgp-rs"
+};
+function renderRouting(out, ctx) {
+  staticRoutes(out, ctx);
+  rpki(out, ctx);
+  if (ctx.device.routing?.bgp) {
+    bgpInstance(out, ctx);
+    policies(out, ctx);
+    bgpConnections(out, ctx);
+  }
+  ospf(out, ctx);
+  bfd(out, ctx);
+}
+function staticRoutes(out, ctx) {
+  for (const route of ctx.device.routing?.static ?? []) {
+    const menu = familyOf(host(route.prefix)) === "ipv4" ? "/ip route" : "/ipv6 route";
+    const verb = route.blackhole ? "add blackhole" : "add";
+    const gateway = route.via ?? (route.interface ? ctx.name(route.interface) : undefined);
+    out.add(menu, command(verb, {
+      comment: route.description,
+      distance: route.distance,
+      "dst-address": route.prefix,
+      gateway,
+      "routing-table": route.vrf
+    }));
+  }
+}
+function rpki(out, ctx) {
+  for (const server of ctx.device.routing?.rpki ?? []) {
+    out.add("/routing rpki", command("add", {
+      address: server.address,
+      comment: server.description,
+      group: RPKI_GROUP,
+      port: server.port
+    }));
+  }
+}
+function bgpInstance(out, ctx) {
+  const bgp = ctx.device.routing.bgp;
+  out.add("/routing bgp instance", command("add", { as: bgp.asn, name: "default", "router-id": ctx.device.routing?.router_id }));
+}
+function settingsOf(ctx, neighbor) {
+  const group = neighbor.group ? ctx.device.routing?.bgp?.groups?.[neighbor.group] : undefined;
+  return { ...group, ...neighbor };
+}
+function familiesOf(ctx, neighbor) {
+  return settingsOf(ctx, neighbor).families ?? [familyOf(neighbor.address)];
+}
+var chainName = (policy, family) => `${policy}-${familySuffix(family)}`;
+function appliesTo(ctx, rule, family) {
+  const match = rule.match;
+  if (match?.family && match.family !== family)
+    return false;
+  if (match?.prefix && familyOf(host(match.prefix)) !== family)
+    return false;
+  if (match?.prefix_set) {
+    const set = ctx.device.prefix_sets?.[match.prefix_set];
+    if (!set)
+      return false;
+    const firstPrefix = "source" in set ? undefined : set.prefixes[0];
+    const setFamily = "source" in set ? set.source.family : firstPrefix && familyOf(host(firstPrefix));
+    if (setFamily !== family)
+      return false;
+  }
+  return true;
+}
+function conditions(rule) {
+  const match = rule.match ?? {};
+  const tests = [];
+  if (match.prefix)
+    tests.push(`dst==${match.prefix}`);
+  if (match.prefix_set)
+    tests.push(`dst in ${match.prefix_set}`);
+  if (match.prefix_length?.min !== undefined)
+    tests.push(`dst-len>${match.prefix_length.min - 1}`);
+  if (match.prefix_length?.max !== undefined)
+    tests.push(`dst-len<${match.prefix_length.max + 1}`);
+  if (match.as_path_length?.min !== undefined)
+    tests.push(`bgp-path-len>${match.as_path_length.min - 1}`);
+  if (match.as_path_length?.max !== undefined)
+    tests.push(`bgp-path-len<${match.as_path_length.max + 1}`);
+  if (match.rpki)
+    tests.push(`rpki ${match.rpki}`);
+  if (match.community)
+    tests.push(`bgp-communities includes ${match.community}`);
+  if (match.large_community)
+    tests.push(`bgp-large-communities includes ${match.large_community}`);
+  return tests;
+}
+function actions(rule, family) {
+  const set = rule.set ?? {};
+  const steps2 = [];
+  if (set.local_pref !== undefined)
+    steps2.push(`set bgp-local-pref ${set.local_pref}`);
+  if (set.med !== undefined)
+    steps2.push(`set bgp-med ${set.med}`);
+  if (set.prepend !== undefined)
+    steps2.push(`set bgp-path-prepend ${set.prepend}`);
+  for (const pattern of set.remove_communities ?? [])
+    steps2.push(`delete bgp-communities regexp "${communityPattern(pattern)}"`);
+  if (set.communities)
+    steps2.push(`set bgp-communities ${set.communities.join(",")}`);
+  if (set.add_communities)
+    steps2.push(`append bgp-communities ${set.add_communities.join(",")}`);
+  for (const pattern of set.remove_large_communities ?? []) {
+    steps2.push(`delete bgp-large-communities regexp "${communityPattern(pattern)}"`);
+  }
+  if (set.large_communities)
+    steps2.push(`set bgp-large-communities ${set.large_communities.join(",")}`);
+  if (set.add_large_communities)
+    steps2.push(`append bgp-large-communities ${set.add_large_communities.join(",")}`);
+  if (set.next_hop && familyOf(set.next_hop) === family)
+    steps2.push(`set gw ${set.next_hop}`);
+  if (set.preferred_source && familyOf(set.preferred_source) === family)
+    steps2.push(`set pref-src ${set.preferred_source}`);
+  if (set.blackhole)
+    steps2.push("set blackhole yes");
+  if (rule.action)
+    steps2.push(rule.action);
+  return steps2;
+}
+function ruleText(rule, family) {
+  const parts = [];
+  if (rule.call)
+    parts.push(`jump ${chainName(rule.call, family)}`);
+  if (rule.match?.rpki)
+    parts.push(`rpki-verify ${RPKI_GROUP}`);
+  const tests = conditions(rule);
+  const steps2 = actions(rule, family);
+  if (tests.length)
+    parts.push(`if (${tests.join(" && ")})${steps2.length ? ` { ${steps2.join("; ")} }` : ""}`);
+  else
+    parts.push(...steps2);
+  return parts.join("; ");
+}
+function policies(out, ctx) {
+  const bgp = ctx.device.routing.bgp;
+  const policies2 = ctx.device.policies ?? {};
+  const wanted = new Map;
+  const want = (policy, family) => {
+    const families2 = wanted.get(policy) ?? new Set;
+    if (families2.has(family))
+      return;
+    families2.add(family);
+    wanted.set(policy, families2);
+    for (const rule of policies2[policy] ?? [])
+      if (rule.call && appliesTo(ctx, rule, family))
+        want(rule.call, family);
+  };
+  let rejectAllNeeded = false;
+  for (const neighbor of Object.values(bgp.neighbors ?? {})) {
+    const settings = settingsOf(ctx, neighbor);
+    for (const family of familiesOf(ctx, neighbor)) {
+      for (const policy of [settings.import, settings.export]) {
+        if (policy)
+          want(policy, family);
+        else
+          rejectAllNeeded = true;
+      }
+    }
+  }
+  const called = new Set(Object.values(policies2).flatMap((rules) => rules.flatMap((rule) => rule.call ? [rule.call] : [])));
+  for (const policy of [...wanted.keys()].sort()) {
+    for (const family of ["ipv4", "ipv6"]) {
+      if (!wanted.get(policy).has(family))
+        continue;
+      const chain = chainName(policy, family);
+      const rules = (policies2[policy] ?? []).filter((rule) => appliesTo(ctx, rule, family));
+      for (const rule of rules) {
+        const text = ruleText(rule, family);
+        if (text)
+          out.add("/routing filter rule", command("add", { chain, comment: rule.description, rule: text }));
+      }
+      const last = rules.at(-1);
+      const decides = last !== undefined && !last.match && !last.call && last.action !== undefined;
+      if (!called.has(policy) && !decides)
+        out.add("/routing filter rule", command("add", { chain, rule: "reject" }));
+    }
+  }
+  if (rejectAllNeeded) {
+    for (const family of ["ipv4", "ipv6"])
+      out.add("/routing filter rule", command("add", {
+        chain: chainName(REJECT_ALL, family),
+        rule: "reject"
+      }));
+  }
+}
+function bgpConnections(out, ctx) {
+  const bgp = ctx.device.routing.bgp;
+  for (const [name, neighbor] of Object.entries(bgp.neighbors ?? {})) {
+    const settings = settingsOf(ctx, neighbor);
+    const [family] = familiesOf(ctx, neighbor);
+    const addressFamily = familyOf(neighbor.address);
+    const internal = settings.remote_as === bgp.asn;
+    const originates = bgp.networks?.some((prefix) => familyOf(host(prefix)) === family);
+    const role = settings.role ? ROLES[settings.role] : internal ? "ibgp" : "ebgp";
+    out.add("/routing bgp connection", command("add", {
+      afi: addressFamily === family ? undefined : family === "ipv6" ? "ipv6" : "ip",
+      as: bgp.asn,
+      connect: settings.passive ? "no" : undefined,
+      "hold-time": settings.hold_time ? duration(settings.hold_time) : undefined,
+      "input.filter": chainName(settings.import ?? REJECT_ALL, family),
+      [`input.limit-process-routes-${family}`]: settings.max_prefixes,
+      "keepalive-time": settings.keepalive ? duration(settings.keepalive) : undefined,
+      listen: settings.passive ? "yes" : undefined,
+      "local.address": settings.local_address,
+      "local.role": role,
+      multihop: settings.multihop ? "yes" : undefined,
+      name,
+      "output.filter-chain": chainName(settings.export ?? REJECT_ALL, family),
+      "output.network": originates ? NETWORKS[family] : undefined,
+      "remote.address": `${neighbor.address}/${addressFamily === "ipv4" ? 32 : 128}`,
+      "remote.as": settings.remote_as,
+      "tcp-md5-key": settings.password && marker(settings.password),
+      "use-bfd": settings.bfd ? "yes" : undefined
+    }));
+  }
+}
+function ospf(out, ctx) {
+  const ospf2 = ctx.device.routing?.ospf;
+  if (!ospf2)
+    return;
+  for (const family of ospf2.families ?? ["ipv4"]) {
+    const version = family === "ipv4" ? 2 : 3;
+    const instance = `ospf-v${version}`;
+    out.add("/routing ospf instance", command("add", {
+      name: instance,
+      redistribute: ospf2.redistribute?.join(","),
+      "router-id": ctx.device.routing?.router_id,
+      version
+    }));
+    for (const [areaId, area] of Object.entries(ospf2.areas)) {
+      const areaName = `${instance}-${areaId}`;
+      out.add("/routing ospf area", command("add", { "area-id": areaId, instance, name: areaName }));
+      for (const [iface, settings] of Object.entries(area.interfaces)) {
+        const verb = settings?.passive ? "add passive" : "add";
+        out.add("/routing ospf interface-template", command(verb, {
+          area: areaName,
+          cost: settings?.cost,
+          interfaces: ctx.name(iface),
+          type: settings?.network === "point-to-point" ? "ptp" : undefined,
+          "use-bfd": settings?.bfd ? "yes" : undefined
+        }));
+      }
+    }
+  }
+}
+function bfd(out, ctx) {
+  const routing = ctx.device.routing;
+  const bgpWants = Object.values(routing?.bgp?.neighbors ?? {}).some((neighbor) => settingsOf(ctx, neighbor).bfd);
+  const ospfWants = Object.values(routing?.ospf?.areas ?? {}).some((area) => Object.values(area.interfaces).some((iface) => iface?.bfd));
+  if (bgpWants || ospfWants)
+    out.add("/routing bfd configuration", command("add", { interfaces: "all" }));
+}
+var SERVICES = {
+  ftp: "ftp",
+  ssh: "ssh",
+  telnet: "telnet",
+  http: "www",
+  https: "www-ssl",
+  api: "api",
+  api_tls: "api-ssl",
+  native: "winbox"
+};
+var USER_GROUPS = { admin: "full", operator: "write", "read-only": "read" };
+var SNMP_AUTH2 = { sha1: "SHA1", sha256: "SHA1" };
+var SNMP_PRIVACY = { aes128: "AES", des: "DES" };
+function renderManagement(out, ctx) {
+  services(out, ctx);
+  layerTwo(out, ctx);
+  snmp(out, ctx);
+  users(out, ctx);
+  certificates(out, ctx);
+}
+function services(out, ctx) {
+  const management = ctx.device.management ?? {};
+  for (const [neutral, platform] of Object.entries(SERVICES)) {
+    const service = management[neutral];
+    if (!service) {
+      out.add("/ip service", command(`set ${platform}`, { disabled: "yes" }));
+      continue;
+    }
+    const allow = service.allow ?? management.allow ?? [];
+    out.add("/ip service", command(`set ${platform}`, {
+      address: allow.join(","),
+      certificate: service.certificate,
+      disabled: "no",
+      port: service.port
+    }));
+  }
+  out.add("/ip service", command("set reverse-proxy", { disabled: "yes" }));
+  out.add("/ip ssh", command("set", { "strong-crypto": yesNo(!management.ssh?.weak_crypto) }));
+}
+function layerTwo(out, ctx) {
+  const nativeList = ctx.device.management?.native?.interfaces ? "native" : "none";
+  out.add("/tool mac-server", command("set", { "allowed-interface-list": nativeList }));
+  out.add("/tool mac-server mac-winbox", command("set", { "allowed-interface-list": nativeList }));
+  out.add("/tool mac-server ping", command("set", { enabled: "no" }));
+  out.add("/tool bandwidth-server", command("set", { enabled: "no" }));
+  let discovery = "none";
+  if (lldpMembers(ctx))
+    discovery = "lldp";
+  else if (ctx.device.lldp)
+    discovery = "all";
+  out.add("/ip neighbor discovery-settings", command("set", { "discover-interface-list": discovery, protocol: "lldp" }));
+}
+function snmp(out, ctx) {
+  const management = ctx.device.management ?? {};
+  const snmp2 = management.snmp;
+  if (!snmp2) {
+    out.add("/snmp", command("set", { enabled: "no" }));
+    out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", name: "public" }));
+    return;
+  }
+  const allow = (snmp2.allow ?? management.allow ?? []).join(",");
+  out.add("/snmp", command("set", { contact: snmp2.contact ?? "", enabled: "yes", location: snmp2.location ?? "" }));
+  if (snmp2.community)
+    out.add("/snmp community", command("set [ find default=yes ]", { addresses: allow, name: marker(snmp2.community) }));
+  else
+    out.add("/snmp community", command("set [ find default=yes ]", { addresses: "::/0", disabled: "yes", name: "public" }));
+  for (const [name, user] of Object.entries(snmp2.users ?? {})) {
+    out.add("/snmp community", command("add", {
+      addresses: allow,
+      "authentication-password": marker(user.auth_password),
+      "authentication-protocol": SNMP_AUTH2[user.auth],
+      "encryption-password": marker(user.privacy_password),
+      "encryption-protocol": SNMP_PRIVACY[user.privacy],
+      name,
+      security: "private"
+    }));
+  }
+}
+function users(out, ctx) {
+  for (const [name, user] of Object.entries(ctx.device.users ?? {})) {
+    out.add("/user", command("add", {
+      comment: user.description,
+      group: USER_GROUPS[user.role],
+      name,
+      password: marker(user.password)
+    }));
+    for (const key of user.ssh_keys ?? [])
+      out.add("/user ssh-keys", command("add", { key, user: name }));
+  }
+}
+function certificates(out, ctx) {
+  for (const [name, certificate] of Object.entries(ctx.device.certificates ?? {})) {
+    out.add("/certificate", command("add", {
+      fingerprint: fingerprint(certificate.certificate),
+      name,
+      "private-key": yesNo(Boolean(certificate.private_key))
+    }));
+  }
+}
+function fingerprint(pem) {
+  return new X509Certificate(pem).fingerprint256.replace(/:/g, "").toLowerCase();
+}
+var TOPICS = [
+  ["critical", "critical"],
+  ["error", "error"],
+  ["warning", "warning"],
+  ["info", "info"],
+  ["debug", "debug"]
+];
+var SEVERITY_ORDER = ["emergency", "alert", "critical", "error", "warning", "notice", "info", "debug"];
+function topicsFrom(level) {
+  const threshold = Math.max(SEVERITY_ORDER.indexOf(level), SEVERITY_ORDER.indexOf("critical"));
+  return TOPICS.filter(([severity]) => SEVERITY_ORDER.indexOf(severity) <= threshold).map(([, topic]) => topic);
+}
+function renderSystem(out, ctx) {
+  const system = ctx.device.system ?? {};
+  out.add("/ip settings", command("set", {
+    "send-redirects": yesNo(system.ip?.icmp_redirects),
+    "tcp-syncookies": yesNo(system.ip?.syn_cookies)
+  }));
+  out.add("/system identity", command("set", { name: ctx.device.name }));
+  out.add("/system clock", command("set", { "time-zone-autodetect": "no", "time-zone-name": system.timezone ?? "UTC" }));
+  out.add("/system note", command("set", { note: system.banner ?? "", "show-at-login": "yes" }));
+  out.add("/system ntp client", command("set", { enabled: yesNo(Boolean(system.ntp?.servers.length)) }));
+  out.add("/system ntp server", command("set", { enabled: yesNo(system.ntp?.serve) }));
+  for (const server of system.ntp?.servers ?? [])
+    out.add("/system ntp client servers", command("add", { address: server }));
+  logging(out, ctx);
+  out.add("/system package update", command("set", { channel: system.release_channel ?? "stable" }));
+  out.add("/system routerboard settings", command("set", { "enter-setup-on": "delete-key" }));
+  flowExport(out, ctx);
+}
+function logging(out, ctx) {
+  const logging2 = ctx.device.system?.logging;
+  const local = logging2?.local;
+  out.add("/system logging action", command("set 1", {
+    "disk-file-count": local?.files ?? 2,
+    "disk-lines-per-file": local?.lines_per_file ?? 1000
+  }));
+  for (const topic of local ? topicsFrom(local.level) : [])
+    out.add("/system logging", command("add", { action: "disk", topics: topic }));
+  (logging2?.remote ?? []).forEach((collector, index) => {
+    const action = `remote${index + 1}`;
+    out.add("/system logging action", command("add", {
+      name: action,
+      remote: collector.address,
+      "remote-port": collector.port,
+      target: "remote"
+    }));
+    for (const topic of topicsFrom(collector.level))
+      out.add("/system logging", command("add", { action, topics: topic }));
+  });
+}
+function flowExport(out, ctx) {
+  const flow = ctx.device.flow_export;
+  if (!flow) {
+    out.add("/ip traffic-flow", command("set", { enabled: "no" }));
+    return;
+  }
+  const sampled = flow.sampling !== undefined && flow.sampling > 1;
+  const interfaces = flow.interfaces?.map((iface) => ctx.name(iface)).join(",") ?? "all";
+  out.add("/ip traffic-flow", command("set", {
+    enabled: "yes",
+    interfaces,
+    "packet-sampling": yesNo(sampled),
+    "sampling-interval": sampled ? flow.sampling : undefined,
+    "sampling-space": sampled ? 1 : undefined
+  }));
+  const version = flow.protocol === "ipfix" ? "ipfix" : "9";
+  for (const collector of flow.collectors) {
+    out.add("/ip traffic-flow target", command("add", { "dst-address": collector.address, port: collector.port ?? 2055, version }));
+  }
+}
+function render2(device) {
+  const out = new Output;
+  const ctx = new Context(device);
+  renderInterfaces(out, ctx);
+  renderAddressing(out, ctx);
+  renderFirewall(out, ctx);
+  renderRouting(out, ctx);
+  renderManagement(out, ctx);
+  renderSystem(out, ctx);
+  return out.text();
+}
+
+// src/adapters/devices/routeros/index.ts
+var SUPPORTED_MAJOR = 7;
+async function login(device) {
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return connect({
+    host: device.connection.host,
+    port: device.connection.port,
+    user: device.connection.user,
+    password: resolve(user.password)
+  });
+}
+async function checkVersion(client, device) {
+  const version = (await exec(client, ":put [/system resource get version]")).trim();
+  const major = Number(version.split(".")[0]);
+  if (major !== SUPPORTED_MAJOR) {
+    throw new Error(`${device.name} runs RouterOS ${version}; this adapter renders for version ${SUPPORTED_MAJOR}`);
+  }
+}
+var EXPORT_TIMESTAMP = /^# \d{4}-\d{2}-\d{2} \d{2}:\d{2}:\d{2} by RouterOS/m;
+var withoutTimestamp = (text) => text.replace(/\r/g, "").replace(EXPORT_TIMESTAMP, "# by RouterOS");
+var LIST_CERTIFICATES = [
+  ":foreach c in=[/certificate find] do={",
+  ':local key "no";',
+  ':if ([/certificate get $c private-key]) do={ :set key "yes" };',
+  ':put ("add fingerprint=" . [/certificate get $c fingerprint] . " name=" . [/certificate get $c name] . " private-key=" . $key)',
+  "}"
+].join(" ");
+async function read2(device) {
+  const client = await login(device);
+  try {
+    await checkVersion(client, device);
+    const config = await exec(client, "/export", 300000);
+    const users2 = await exec(client, "/user export");
+    const certificates2 = (await exec(client, LIST_CERTIFICATES)).trim();
+    const listed = certificates2.split(`
+`).every((line2) => line2.trim().startsWith("add fingerprint="));
+    if (certificates2 && !listed) {
+      throw new Error(`${device.name}: certificates could not be listed: ${certificates2.slice(0, 120)}`);
+    }
+    const userMenu = users2.slice(users2.indexOf(`
+/`)).trim();
+    const certificateMenu = certificates2 ? `/certificate
+${certificates2}` : "";
+    const text = [config.trim(), userMenu, certificateMenu].filter(Boolean).join(`
+`);
+    return withoutTimestamp(text) + `
+`;
+  } finally {
+    client.end();
+  }
+}
+function unsupported2(device) {
+  const found = [];
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    if (port.speed && !mediumOf(spell(device.platform, device.model, name), port.speed)) {
+      found.push(`ports.${name}.speed ${port.speed}, the port has no fixed speed by that name`);
+    }
+    const thresholds = Object.values(port.storm_control ?? {});
+    const percents = new Set(thresholds.map((threshold) => ("percent" in threshold) ? threshold.percent : undefined));
+    if (thresholds.some((threshold) => ("pps" in threshold))) {
+      found.push(`ports.${name}.storm_control in pps, the platform takes percent`);
+    } else if (percents.size > 1) {
+      found.push(`ports.${name}.storm_control with a different percent per kind, the platform takes one`);
+    }
+  }
+  const bgp = device.routing?.bgp;
+  for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+    const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+    const families2 = neighbor.families ?? group?.families ?? [familyOf(neighbor.address)];
+    if (families2.length > 1)
+      found.push(`routing.bgp.neighbors.${name}.families, one family per session`);
+  }
+  const management = device.management;
+  if (management?.console)
+    found.push("management.console, the console uses the device's users");
+  if (management?.privilege_password)
+    found.push("management.privilege_password, the platform has no privileged mode");
+  if (management?.ssh?.auth_timeout || management?.ssh?.auth_retries) {
+    found.push("management.ssh.auth_timeout and auth_retries");
+  }
+  for (const [name, user] of Object.entries(management?.snmp?.users ?? {})) {
+    if (user.auth !== "sha1") {
+      found.push(`management.snmp.users.${name}.auth ${user.auth}, the platform authenticates with SHA1 or MD5`);
+    }
+  }
+  if (device.system?.transceiver_monitoring === false)
+    found.push("system.transceiver_monitoring false, it is always on");
+  if (device.flow_export?.protocol === "sflow")
+    found.push("flow_export.protocol sflow, the platform exports NetFlow and IPFIX");
+  return found;
+}
+var ROLLBACK_SCHEDULER = "apply-rollback";
+var escapeForString = (text) => text.replace(/\\/g, "\\\\").replace(/"/g, "\\\"").replace(/\$/g, "\\$");
+async function refusal(client, command2) {
+  const compiled = (await exec(client, `:put [:parse "${escapeForString(command2)}"]`)).trim();
+  const refused = !compiled.startsWith("(") || /syntax error|bad parameter|no such|expected/.test(compiled);
+  return refused ? compiled.slice(0, 200) : undefined;
+}
+async function installCertificate(client, device, name) {
+  const certificate = device.certificates?.[name];
+  if (!certificate)
+    throw new Error(`certificate ${name} is not declared`);
+  await upload(client, `${name}.crt`, certificate.certificate);
+  await exec(client, `/certificate import file-name=${name}.crt name=${name} passphrase=""`);
+  if (certificate.private_key) {
+    const value2 = resolve(certificate.private_key);
+    const privateKey = value2.includes("-----BEGIN") ? `${value2}
+` : Buffer.from(value2, "base64").toString("utf8");
+    await upload(client, `${name}.key`, privateKey);
+    await exec(client, `/certificate import file-name=${name}.key name=${name} passphrase=""`);
+  }
+  await exec(client, `/file remove [find name="${name}.crt" or name="${name}.key"]`);
+}
+async function apply2(device, _network, changes2, options) {
+  const client = await login(device);
+  await checkVersion(client, device);
+  const commands = changes2.steps.flatMap((step) => step.send.map((command2) => ({ title: step.title, command: command2 })));
+  for (const { title, command: command2 } of commands) {
+    if (command2.startsWith(INSTALL_CERTIFICATE))
+      continue;
+    const reason = await refusal(client, substitute(command2));
+    if (reason) {
+      client.end();
+      throw new Error(`${title}: the device will not parse ${command2.slice(0, 200)}
+    ${reason}`);
+    }
+  }
+  const stamp = new Date().toISOString().replace(/[-:T]/g, "").slice(0, 12);
+  const backup = `pre-apply-${stamp}`;
+  const armRollback = [
+    `/system scheduler add name="${ROLLBACK_SCHEDULER}"`,
+    `interval=${options.rollback}m`,
+    `on-event="/system backup load name=${backup} password=\\"\\""`,
+    "policy=read,write,policy,test,reboot,ftp"
+  ].join(" ");
+  try {
+    console.log(`  saving ${backup}, arming a ${options.rollback} minute rollback`);
+    await exec(client, `/system backup save name=${backup} dont-encrypt=yes`, 120000);
+    await exec(client, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+    await exec(client, armRollback);
+    for (const { title, command: command2 } of commands) {
+      if (command2.startsWith(INSTALL_CERTIFICATE)) {
+        const certificateName = command2.slice(INSTALL_CERTIFICATE.length).trim();
+        await installCertificate(client, device, certificateName);
+        continue;
+      }
+      const answer = (await exec(client, substitute(command2), 120000)).trim();
+      if (answer)
+        throw new Error(`${title}: ${command2.slice(0, 160)}
+    device said: ${answer.slice(0, 300)}`);
+    }
+  } catch (error) {
+    console.log(`  FAILED: ${error.message}`);
+    console.log(`  restoring ${backup} now; the rollback stays armed in case this does not get through`);
+    await exec(client, `/system backup load name=${backup} password=""`, 30000).catch(() => {
+      return;
+    });
+    client.end();
+    throw new Error("apply failed and the backup is being restored");
+  }
+  client.end();
+  const proof = await login(device).catch(() => {
+    return;
+  });
+  if (!proof)
+    throw new Error(`could not log in again; the device restores ${backup} within ${options.rollback} minutes`);
+  await exec(proof, `/system scheduler remove [find name="${ROLLBACK_SCHEDULER}"]`);
+  await exec(proof, `/file remove [find name="${backup}.backup"]`);
+  proof.end();
+  console.log("  logged in again, rollback disarmed");
+}
+async function fill(device, _network, set, family, prefixes) {
+  const menu = family === "ipv4" ? "/ip firewall address-list" : "/ipv6 firewall address-list";
+  const batchSize = 60;
+  const client = await login(device);
+  try {
+    await exec(client, `${menu} remove [find list="${set}" and !dynamic]`);
+    for (let start = 0;start < prefixes.length; start += batchSize) {
+      const batch = prefixes.slice(start, start + batchSize).map((prefix) => `${menu} add list="${set}" address=${prefix}`);
+      const answer = (await exec(client, batch.join("; "), 90000)).trim();
+      if (answer)
+        throw new Error(`${set}: ${answer.slice(0, 200)}`);
+    }
+    const count = (await exec(client, `:put [:len [${menu} find list="${set}"]]`)).trim();
+    console.log(`  ${set}: ${count} entries on the device`);
+  } finally {
+    client.end();
+  }
+}
+var routeros = {
+  extension: ".rsc",
+  unsupported: unsupported2,
+  render: render2,
+  read: read2,
+  plan: plan2,
+  apply: apply2,
+  fill
+};
+
+// src/adapters/devices/vrp/index.ts
+var DEVICE_FACTS2 = [
+  "!",
+  "device ",
+  "system resource",
+  "drop-profile",
+  "dcb ",
+  "diffserv domain",
+  "vlan reserved",
+  "interface MEth",
+  "interface NULL",
+  "stack",
+  "vm-manager",
+  "return",
+  "authentication-scheme default",
+  "authorization-scheme default",
+  "accounting-scheme default",
+  "domain default",
+  "Info:"
+];
+var UNDO_BY_KEYWORD2 = /^(description|name|port default vlan|port link-type|port trunk pvid vlan|set authentication password|eth-trunk|ip binding vpn-instance)\b/;
+function undo2(line2) {
+  if (line2.startsWith("undo "))
+    return line2.slice("undo ".length);
+  if (/^rule \d+/.test(line2))
+    return `undo ${line2.split(" ").slice(0, 2).join(" ")}`;
+  const keyword = UNDO_BY_KEYWORD2.exec(line2);
+  if (keyword)
+    return `undo ${keyword[1]}`;
+  if (line2.startsWith("storm control "))
+    return `undo ${line2.replace(/ (min-rate|max-rate).*$/, "")}`;
+  return `undo ${line2}`;
+}
+function canon(line2) {
+  return line2.replace(/(irreversible-cipher|cipher) \S+/g, "cipher <secret>").replace(/<secret:\w+>/g, "<secret>");
+}
+function order(path) {
+  const header = path[0] ?? "";
+  if (!header)
+    return 1;
+  if (/^(ip vpn-instance|vlan |acl number|aaa|bfd)/.test(header))
+    return 0;
+  if (header.startsWith("interface Eth-Trunk"))
+    return 2;
+  if (header.startsWith("interface Vlanif"))
+    return 4;
+  if (header.startsWith("interface "))
+    return 3;
+  if (header.startsWith("ospf "))
+    return 5;
+  return 6;
+}
+var dialect2 = {
+  block: /^(interface |vlan \d+$|acl number |aaa$|user-interface |ospf |ip vpn-instance |bfd$)/,
+  indented: true,
+  terminator: "#",
+  ignore: (line2) => DEVICE_FACTS2.some((fact) => line2.startsWith(fact)),
+  undo: undo2,
+  leave: "quit",
+  first: /^authentication-mode /,
+  canon,
+  order
+};
+var MANAGEMENT_ACL2 = 2000;
+var OSPF_PROCESS2 = 1;
+var FIRST_COLLECTOR = 1;
+var SNMP_GROUP2 = "circuit";
+var USER_LEVEL = { admin: 3, operator: 2, "read-only": 1 };
+var SNMP_AUTH3 = { sha1: "sha", sha256: "sha2-256" };
+var SNMP_PRIVACY2 = { aes128: "aes128", des: "des56" };
+function batchIds(line2) {
+  const words2 = line2.replace(/^vlan batch /, "").split(" ");
+  const ids = [];
+  for (let index = 0;index < words2.length; index++) {
+    const first = Number(words2[index]);
+    if (words2[index + 1] === "to") {
+      const last = Number(words2[index + 2]);
+      for (let id = first;id <= last; id++)
+        ids.push(id);
+      index += 2;
+    } else {
+      ids.push(first);
+    }
+  }
+  return ids;
+}
+function vlanBatch(ids) {
+  const sorted = [...new Set(ids)].sort((a, b) => a - b);
+  const ranges = [];
+  for (let i = 0;i < sorted.length; i++) {
+    let end = i;
+    while (sorted[end + 1] === sorted[end] + 1)
+      end++;
+    ranges.push(i === end ? `${sorted[i]}` : `${sorted[i]} to ${sorted[end]}`);
+    i = end;
+  }
+  return ranges.join(" ");
+}
+
+class Config {
+  lines = [];
+  line(text) {
+    this.lines.push(text);
+  }
+  block(header, body) {
+    this.lines.push(header, ...body.map((text) => ` ${text}`), "#");
+  }
+  separator() {
+    this.lines.push("#");
+  }
+  text() {
+    return this.lines.join(`
+`) + `
+`;
+  }
+}
+function render3(device) {
+  const config = new Config;
+  const vlans = device.vlans ?? {};
+  const vlanId = (name) => vlans[name].id;
+  const interfaces = device.interfaces ?? {};
+  const lagNumbers = lagIds(device);
+  const nameOf = (portOrInterface) => {
+    const iface = interfaces[portOrInterface];
+    if (iface?.type === "lag")
+      return `Eth-Trunk${lagNumbers.get(portOrInterface)}`;
+    if (iface?.type === "vlan")
+      return `Vlanif${vlanId(iface.vlan)}`;
+    return spell(device.platform, device.model, portOrInterface);
+  };
+  system(config, device);
+  vlanBlocks(config, device);
+  managementAcl(config, device);
+  users2(config, device);
+  vrfs2(config, device);
+  for (const [name, lag] of Object.entries(interfaces)) {
+    if (lag.type === "lag")
+      config.block(`interface ${nameOf(name)}`, [...lagMode(lag), ...switching2(lag, vlanId)]);
+  }
+  for (const [name, iface] of Object.entries(interfaces)) {
+    if (iface.type === "vlan")
+      config.block(`interface ${nameOf(name)}`, vlanInterface(device, name, iface));
+  }
+  for (const port of portsOf(device.platform, device.model)) {
+    const settings = device.ports?.[port];
+    config.block(`interface ${nameOf(port)}`, physicalPort2(device, port, settings, vlanId, lagNumbers));
+  }
+  staticRoutes2(config, device, nameOf);
+  ospf2(config, device, nameOf);
+  if (wantsBfd(device))
+    config.block("bfd", []);
+  if (device.dhcp_relay && Object.keys(device.dhcp_relay).length) {
+    config.line("dhcp enable");
+    config.separator();
+  }
+  flowExport2(config, device);
+  snmp2(config, device);
+  ssh(config, device);
+  userInterfaces(config, device);
+  return config.text();
+}
+function system(config, device) {
+  config.line(`sysname ${device.name}`);
+  config.separator();
+  const timezone = device.system?.timezone;
+  if (timezone) {
+    const minutes = offset(timezone);
+    const absolute = Math.abs(minutes);
+    const hours = String(Math.floor(absolute / 60)).padStart(2, "0");
+    const remainder = String(absolute % 60).padStart(2, "0");
+    config.line(`clock timezone ${timezone.split("/").at(-1)} ${minutes < 0 ? "minus" : "add"} ${hours}:${remainder}:00`);
+    config.separator();
+  }
+  const stp = device.stp;
+  if (!stp)
+    config.line("stp disable");
+  else {
+    if (stp.mode && stp.mode !== "mstp")
+      config.line(`stp mode ${stp.mode}`);
+    if (stp.priority !== undefined)
+      config.line(`stp priority ${stp.priority}`);
+  }
+  if (device.lldp)
+    config.line("lldp enable");
+  config.separator();
+  const ntp = device.system?.ntp;
+  if (!ntp?.serve) {
+    config.line("ntp server disable");
+    config.line("ntp ipv6 server disable");
+  }
+  for (const server of ntp?.servers ?? [])
+    config.line(`ntp unicast-server ${server}`);
+  config.separator();
+  const ids = Object.values(device.vlans ?? {}).map((vlan) => vlan.id);
+  if (ids.length) {
+    config.line(`vlan batch ${vlanBatch(ids)}`);
+    config.separator();
+  }
+  if (!device.management?.telnet) {
+    config.line("telnet server disable");
+    config.line("telnet ipv6 server disable");
+    config.separator();
+  }
+}
+function vlanBlocks(config, device) {
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    config.block(`vlan ${vlan.id}`, [`name ${name}`, ...vlan.description ? [`description ${vlan.description}`] : []]);
+  }
+}
+function managementAcl(config, device) {
+  const allow = device.management?.allow ?? [];
+  if (!allow.length)
+    return;
+  const rules = allow.map((cidr, index) => `rule ${(index + 1) * 5} permit source ${host(cidr)} ${wildcard(split(cidr).len)}`);
+  config.block(`acl number ${MANAGEMENT_ACL2}`, ["description Management access", ...rules, `rule ${(allow.length + 1) * 5} deny`]);
+}
+function users2(config, device) {
+  const lines = [];
+  for (const [name, user] of Object.entries(device.users ?? {})) {
+    lines.push(`local-user ${name} password irreversible-cipher ${marker(user.password)}`);
+    lines.push(`local-user ${name} service-type ssh`);
+    lines.push(`local-user ${name} level ${USER_LEVEL[user.role]}`);
+  }
+  config.block("aaa", lines);
+}
+function vrfs2(config, device) {
+  for (const name of Object.keys(device.vrfs ?? {}))
+    config.block(`ip vpn-instance ${name}`, ["ipv4-family"]);
+}
+function lagMode(lag) {
+  const lines = [lag.mode === "static" ? "mode manual load-balance" : "mode lacp-static"];
+  if (lag.description)
+    lines.unshift(`description ${lag.description}`);
+  return lines;
+}
+function switching2(settings, vlanId) {
+  const lines = [];
+  if (settings.access_vlan)
+    lines.push(`port default vlan ${vlanId(settings.access_vlan)}`);
+  if (settings.trunk_vlans) {
+    lines.push("port link-type trunk");
+    if (settings.native_vlan)
+      lines.push(`port trunk pvid vlan ${vlanId(settings.native_vlan)}`);
+    const allowed = [...settings.trunk_vlans, ...settings.native_vlan ? [settings.native_vlan] : []].map(vlanId);
+    lines.push("undo port trunk allow-pass vlan 1");
+    lines.push(`port trunk allow-pass vlan ${vlanBatch(allowed)}`);
+  }
+  if (settings.stp === false)
+    lines.push("stp disable");
+  else if (typeof settings.stp === "object") {
+    if (settings.stp.edge)
+      lines.push("stp edged-port enable");
+    if (settings.stp.cost !== undefined)
+      lines.push(`stp cost ${settings.stp.cost}`);
+    if (settings.stp.priority !== undefined)
+      lines.push(`stp port priority ${settings.stp.priority}`);
+  }
+  const storm = settings.storm_control;
+  if (storm) {
+    const kinds = [
+      ["broadcast", storm.broadcast],
+      ["multicast", storm.multicast],
+      ["unknown-unicast", storm.unknown_unicast]
+    ];
+    for (const [kind, threshold] of kinds) {
+      if (!threshold || !("percent" in threshold))
+        continue;
+      const percent = threshold.percent;
+      lines.push(`storm control ${kind} min-rate percent ${percent} max-rate percent ${percent}`);
+    }
+    lines.push("storm control action suppress", "storm control enable trap", "storm control enable log");
+  }
+  return lines;
+}
+function vrrpLines2(group) {
+  const lines = [`vrrp vrid ${group.id} virtual-ip ${group.address}`];
+  if (group.priority !== undefined)
+    lines.push(`vrrp vrid ${group.id} priority ${group.priority}`);
+  if (!group.preempt)
+    lines.push(`vrrp vrid ${group.id} preempt disable`);
+  if (group.interval !== undefined && group.interval !== 1)
+    lines.push(`vrrp vrid ${group.id} timer advertise ${group.interval}`);
+  return lines;
+}
+function vlanInterface(device, name, iface) {
+  const lines = [];
+  if (iface.description)
+    lines.push(`description ${iface.description}`);
+  if (iface.vrf)
+    lines.push(`ip binding vpn-instance ${iface.vrf}`);
+  for (const entry of iface.addresses ?? []) {
+    const address = typeof entry === "string" ? entry : entry.address;
+    if (familyOf(address) === "ipv4")
+      lines.push(`ip address ${host(address)} ${netmask(split(address).len)}`);
+    else
+      lines.push(`ipv6 address ${address}`);
+  }
+  for (const group of iface.vrrp ?? [])
+    lines.push(...vrrpLines2(group));
+  const relays = Object.values(device.dhcp_relay ?? {}).filter((relay) => relay.interface === name);
+  if (relays.length) {
+    lines.push("dhcp select relay");
+    for (const server of relays.flatMap((relay) => relay.servers))
+      lines.push(`dhcp relay binding server ip ${server}`);
+  }
+  for (const area of Object.values(device.routing?.ospf?.areas ?? {})) {
+    const settings = area.interfaces[name];
+    if (!settings)
+      continue;
+    if (settings.cost !== undefined)
+      lines.push(`ospf cost ${settings.cost}`);
+    if (settings.network === "point-to-point")
+      lines.push("ospf network-type p2p");
+    if (settings.bfd)
+      lines.push("ospf bfd enable");
+  }
+  return lines;
+}
+function physicalPort2(device, port, settings, vlanId, lagNumbers) {
+  if (!settings)
+    return ["shutdown"];
+  if (settings.lag) {
+    const membership = `eth-trunk ${lagNumbers.get(settings.lag)}`;
+    return settings.description ? [membership, `description ${settings.description}`] : [membership];
+  }
+  const lines = [];
+  if (settings.description)
+    lines.push(`description ${settings.description}`);
+  lines.push(...switching2(settings, vlanId));
+  if (settings.lldp === false)
+    lines.push("lldp disable");
+  const flow = device.flow_export;
+  const observed = flow?.protocol === "sflow" && (!flow.interfaces || flow.interfaces.includes(port));
+  if (observed) {
+    for (let index = 0;index < flow.collectors.length; index++)
+      lines.push(`sflow sampling collector ${FIRST_COLLECTOR + index}`);
+    lines.push(`sflow sampling rate ${flow.sampling}`);
+    lines.push("sflow sampling inbound");
+  }
+  return lines;
+}
+function staticRoutes2(config, device, nameOf) {
+  for (const route of device.routing?.static ?? []) {
+    const { addr, len } = split(route.prefix);
+    const nextHop = route.blackhole ? "NULL0" : route.via ?? nameOf(route.interface);
+    const vrf = route.vrf ? ` vpn-instance ${route.vrf}` : "";
+    const preference = route.distance ? ` preference ${route.distance}` : "";
+    const description = route.description ? ` description ${route.description}` : "";
+    if (familyOf(addr) === "ipv4")
+      config.line(`ip route-static${vrf} ${addr} ${netmask(len)} ${nextHop}${preference}${description}`);
+    else
+      config.line(`ipv6 route-static${vrf} ${addr} ${len} ${nextHop}${preference}`);
+  }
+  config.separator();
+}
+function ospf2(config, device, nameOf) {
+  const ospf3 = device.routing?.ospf;
+  if (!ospf3)
+    return;
+  const routerId = device.routing?.router_id;
+  const lines = [];
+  for (const source of ospf3.redistribute ?? [])
+    lines.push(`import-route ${source === "connected" ? "direct" : "static"}`);
+  const areaLines = [];
+  for (const [areaId, area] of Object.entries(ospf3.areas)) {
+    areaLines.push(`area ${areaId}`);
+    for (const [iface, settings] of Object.entries(area.interfaces)) {
+      if (settings?.passive)
+        lines.push(`silent-interface ${nameOf(iface)}`);
+      for (const prefix of ipv4Networks(device, iface))
+        areaLines.push(` network ${host(prefix)} ${wildcard(split(prefix).len)}`);
+    }
+  }
+  config.block(`ospf ${OSPF_PROCESS2}${routerId ? ` router-id ${routerId}` : ""}`, [...lines, ...areaLines]);
+}
+function wantsBfd(device) {
+  const areas = Object.values(device.routing?.ospf?.areas ?? {});
+  return areas.some((area) => Object.values(area.interfaces).some((settings) => settings?.bfd));
+}
+function flowExport2(config, device) {
+  const flow = device.flow_export;
+  if (flow?.protocol !== "sflow")
+    return;
+  config.line(`sflow agent ip ${device.connection.host}`);
+  flow.collectors.forEach((collector, index) => {
+    const number = FIRST_COLLECTOR + index;
+    config.line(`sflow collector ${number} ip ${collector.address} udp-port ${collector.port ?? 6343}`);
+  });
+  config.separator();
+}
+function snmp2(config, device) {
+  const snmp3 = device.management?.snmp;
+  if (!snmp3)
+    return;
+  const versions = [snmp3.community ? "v2c" : "", snmp3.users ? "v3" : ""].filter(Boolean).join(" ");
+  const guarded = (device.management?.allow?.length ?? 0) > 0;
+  config.line("snmp-agent");
+  config.line(`snmp-agent sys-info version ${versions}`);
+  if (snmp3.contact)
+    config.line(`snmp-agent sys-info contact ${snmp3.contact}`);
+  if (snmp3.location)
+    config.line(`snmp-agent sys-info location ${snmp3.location}`);
+  if (snmp3.community)
+    config.line(`snmp-agent community read cipher ${marker(snmp3.community)}${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
+  if (snmp3.users) {
+    config.line("snmp-agent mib-view included all iso");
+    config.line(`snmp-agent group v3 ${SNMP_GROUP2} privacy read-view all${guarded ? ` acl ${MANAGEMENT_ACL2}` : ""}`);
+    for (const [name, user] of Object.entries(snmp3.users)) {
+      config.line(`snmp-agent usm-user v3 ${name} group ${SNMP_GROUP2}`);
+      config.line(`snmp-agent usm-user v3 ${name} authentication-mode ${SNMP_AUTH3[user.auth]} cipher ${marker(user.auth_password)}`);
+      config.line(`snmp-agent usm-user v3 ${name} privacy-mode ${SNMP_PRIVACY2[user.privacy]} cipher ${marker(user.privacy_password)}`);
+    }
+  }
+  config.separator();
+}
+function ssh(config, device) {
+  const ssh2 = device.management?.ssh;
+  if (!ssh2)
+    return;
+  const guarded = (device.management?.allow?.length ?? 0) > 0;
+  config.line("stelnet server enable");
+  for (const user of Object.keys(device.users ?? {})) {
+    config.line(`ssh user ${user}`);
+    config.line(`ssh user ${user} authentication-type password`);
+    config.line(`ssh user ${user} service-type stelnet`);
+  }
+  if (guarded)
+    config.line(`ssh server acl ${MANAGEMENT_ACL2}`);
+  config.line("ssh authorization-type default aaa");
+  config.separator();
+  if (!ssh2.weak_crypto) {
+    config.line("ssh server cipher aes256_ctr aes128_ctr");
+    config.line("ssh server hmac sha2_256_96 sha2_256");
+    config.line("ssh server key-exchange dh_group_exchange_sha256 ecdh_sha2_nistp256 ecdh_sha2_nistp384 ecdh_sha2_nistp521");
+    config.separator();
+  }
+}
+function userInterfaces(config, device) {
+  const console2 = device.management?.console;
+  const consoleLogin = console2 ? ["authentication-mode password", `set authentication password cipher ${marker(console2.password)}`] : ["authentication-mode aaa"];
+  config.block("user-interface con 0", consoleLogin);
+  config.block("user-interface vty 0 4", ["authentication-mode aaa", `protocol inbound ${device.management?.telnet ? "all" : "ssh"}`]);
+}
+var HOST_KEYS2 = ["ssh-rsa"];
+async function login2(device) {
+  const user = device.users?.[device.connection.user];
+  if (!user)
+    throw new Error(`${device.name}: connection user ${device.connection.user} is not one of its users`);
+  return connect({
+    host: device.connection.host,
+    port: device.connection.port,
+    user: device.connection.user,
+    password: resolve(user.password),
+    hostKeys: HOST_KEYS2
+  });
+}
+async function openShell(client) {
+  const channel = await shell(client);
+  const banner = await readUntil(channel, (text) => /Change now\? ?\[Y\/N\]/i.test(text) || /<[^>]+>\s*$/.test(text), 15000, 1500);
+  if (/Change now\?/i.test(banner))
+    await send(channel, "N", 1e4, 1500);
+  await send(channel, "screen-length 0 temporary", 1e4, 1500);
+  return channel;
+}
+async function read3(device) {
+  const client = await login2(device);
+  try {
+    const channel = await openShell(client);
+    const dump = await send(channel, "display current-configuration", 120000, 3000);
+    channel.end();
+    const lines = dump.replace(/\r/g, "").split(`
+`);
+    const start = lines.findIndex((line2) => line2.startsWith("!Software Version"));
+    if (start < 0)
+      throw new Error(`${device.name} returned no configuration`);
+    const body = lines.slice(start).filter((line2) => !/^<.*>$/.test(line2.trim()) && !line2.startsWith("!Last configuration"));
+    return scrub(body.join(`
+`).trim() + `
+`);
+  } finally {
+    client.end();
+  }
+}
+function unsupported3(device) {
+  const found = [];
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    for (const field of ["speed", "acl", "mtu", "addresses", "vrrp", "vrf"]) {
+      if (port[field] !== undefined)
+        found.push(`ports.${name}.${field}, ports are switched; use a VLAN interface`);
+    }
+    if (port.lldp === true && !device.lldp)
+      found.push(`ports.${name}.lldp true while LLDP is off on the device`);
+    const storm = Object.values(port.storm_control ?? {});
+    if (storm.some((threshold) => ("pps" in threshold)))
+      found.push(`ports.${name}.storm_control in pps, the platform takes percent`);
+  }
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (iface.type !== "vlan" && iface.type !== "lag")
+      found.push(`interfaces.${name}, a ${iface.type}`);
+    if (iface.type === "lag" && iface.addresses?.length)
+      found.push(`interfaces.${name}.addresses, LAGs are switched`);
+    for (const group of iface.vrrp ?? [])
+      if (familyOf(group.address) === "ipv6")
+        found.push(`interfaces.${name}.vrrp for IPv6`);
+  }
+  const routing = device.routing;
+  if (routing?.bgp)
+    found.push("routing.bgp");
+  if (routing?.rpki)
+    found.push("routing.rpki");
+  if (routing?.ospf?.families?.includes("ipv6"))
+    found.push("routing.ospf for IPv6");
+  for (const field of ["firewall", "dhcp", "acls", "policies", "prefix_sets", "hardware_offload", "certificates"]) {
+    if (device[field] !== undefined)
+      found.push(field);
+  }
+  for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
+    if (device.interfaces?.[relay.interface]?.type !== "vlan")
+      found.push(`dhcp_relay.${name}.interface, relays run on VLAN interfaces`);
+  }
+  if (device.users && "admin" in device.users)
+    found.push("users.admin, the platform reserves the name");
+  const management = device.management ?? {};
+  for (const field of ["http", "https", "api", "api_tls", "ftp", "native", "privilege_password"]) {
+    if (management[field])
+      found.push(`management.${field}`);
+  }
+  if (management.ssh?.auth_timeout || management.ssh?.auth_retries)
+    found.push("management.ssh.auth_timeout and auth_retries");
+  if (device.lldp && device.lldp !== true)
+    found.push("lldp.interfaces, use lldp on the ports instead");
+  const system2 = device.system ?? {};
+  if (system2.dns || system2.logging || system2.release_channel || system2.banner) {
+    found.push("system.dns, logging, release_channel and banner");
+  }
+  const flow = device.flow_export;
+  if (flow && flow.protocol !== "sflow")
+    found.push(`flow_export.protocol ${flow.protocol}, the platform exports sFlow`);
+  const sampling = flow?.protocol === "sflow" ? flow.sampling : undefined;
+  const samplingInRange = sampling !== undefined && Number.isInteger(sampling) && sampling >= 4096 && sampling <= 4294967295;
+  if (flow?.protocol === "sflow" && !samplingInRange) {
+    found.push("flow_export.sampling, required and between 4096 and 4294967295: the platform samples, one packet in 4096 at most");
+  }
+  return found;
+}
+var REFUSED2 = /^\s*Error|Unrecognized command|Incomplete command|Wrong parameter|Too many parameters/m;
+var INTERACTIVE = /^(snmp-agent usm-user v3 \S+ (?:authentication|privacy)-mode \S+) cipher <secret:([A-Za-z0-9_./:-]+)>$/;
+async function sendLine(channel, line2) {
+  const interactive = INTERACTIVE.exec(line2.trim());
+  if (interactive) {
+    const [, command2, reference] = interactive;
+    const password = valueOfReference(reference);
+    let answer2 = await send(channel, command2, 15000, 900);
+    answer2 += await send(channel, password, 15000, 900);
+    answer2 += await send(channel, password, 15000, 900);
+    return answer2;
+  }
+  let answer = await send(channel, substitute(line2), 20000, 800);
+  if (/\[Y\/N\]/i.test(answer))
+    answer += await send(channel, "Y", 20000, 800);
+  return answer;
+}
+async function apply3(device, _network, plan3) {
+  const client = await login2(device);
+  const channel = await openShell(client);
+  try {
+    await send(channel, "system-view", 1e4, 1500);
+    for (const step of plan3.steps) {
+      for (const line2 of step.send) {
+        const answer = await sendLine(channel, line2);
+        if (REFUSED2.test(answer))
+          throw new Error(`${step.title}: ${line2}
+    device said: ${answer.trim().slice(0, 300)}`);
+      }
+    }
+    const committed = await send(channel, "commit", 60000, 3000);
+    if (REFUSED2.test(committed))
+      throw new Error(`commit refused: ${committed.trim().slice(0, 300)}`);
+    await send(channel, "quit", 1e4);
+  } catch (error) {
+    await send(channel, "clear configuration candidate", 1e4).catch(() => {
+      return;
+    });
+    channel.end();
+    client.end();
+    throw error;
+  }
+  const proof = await login2(device).catch(() => {
+    return;
+  });
+  if (!proof) {
+    channel.end();
+    client.end();
+    throw new Error("committed, but a fresh login failed. Not saved: a reboot restores the previous configuration. Recover over the open session or the console.");
+  }
+  proof.end();
+  const saving = await send(channel, "save", 20000, 2000);
+  if (/\[Y\/N\]/i.test(saving))
+    await send(channel, "Y", 60000, 5000);
+  channel.end();
+  client.end();
+  console.log("  committed, login proved, saved");
+}
+function plan3(desired, current) {
+  const groups = compare(desired, current, dialect2);
+  vlanListChange(groups, "vlan batch ", batchIds, (ids) => [`vlan batch ${vlanBatch(ids)}`], (ids) => [`vlan batch ${vlanBatch(ids)}`]);
+  const top = groups.find((group) => group.path.length === 0);
+  const removedBatch = top?.remove.find((line2) => line2.startsWith("vlan batch ")) ?? "";
+  const removedIds = removedBatch ? batchIds(removedBatch) : [];
+  const firstRemovals = [
+    ...removedIds.map((id) => `interface Vlanif${id}`).filter((line2) => top?.remove.includes(line2)),
+    ...removedIds.map((id) => `vlan ${id}`).filter((line2) => top?.remove.includes(line2)),
+    ...removedBatch ? [removedBatch] : []
+  ];
+  if (top)
+    top.remove = top.remove.filter((line2) => !firstRemovals.includes(line2));
+  const planned = steps(groups.filter((group) => group.add.length || group.remove.length), dialect2);
+  if (firstRemovals.length) {
+    const sent = firstRemovals.filter((line2) => !/^vlan \d+$/.test(line2)).map(undo2);
+    planned.unshift({ title: "VLANs no longer used", show: firstRemovals.map((line2) => `- ${line2}`), send: sent });
+  }
+  return { steps: planned, problems: [] };
+}
+var vrp = {
+  extension: ".cfg",
+  unsupported: unsupported3,
+  render: render3,
+  read: read3,
+  plan: plan3,
+  apply: apply3
+};
+
+// src/adapters/devices/index.ts
+var adapters = { routeros, vrp, "raisecom-ros": raisecom };
+
+// src/adapters/registries/index.ts
+async function ripeStat(query, family) {
+  if (!/^AS\d+$/i.test(query))
+    throw new Error(`ripe-stat takes an AS number, got '${query}'`);
+  const res = await fetch(`https://stat.ripe.net/data/announced-prefixes/data.json?resource=${query.toUpperCase()}`, {
+    signal: AbortSignal.timeout(90000)
+  });
+  if (!res.ok)
+    throw new Error(`ripe-stat answered ${res.status}`);
+  const data = await res.json();
+  return [
+    ...new Set(data.data.prefixes.map((entry) => entry.prefix).filter((entry) => entry.includes(":") === (family === "ipv6")))
+  ].sort();
+}
+var registries = { "ripe-stat": ripeStat };
+
+// src/adapters/registries/peeringdb.ts
+var API = "https://www.peeringdb.com/api";
+var addressesOf = (iface) => (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+function peersWithRouteServer(device, iface) {
+  const bgp = device.routing?.bgp;
+  const subnets = addressesOf(iface);
+  return Object.values(bgp?.neighbors ?? {}).some((neighbor) => {
+    const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+    const role = neighbor.role ?? group?.role;
+    return role === "rs" && subnets.some((subnet) => contains(subnet, neighbor.address));
+  });
+}
+function wanted(network2) {
+  const records = [];
+  for (const device of network2.devices) {
+    for (const iface of Object.values(device.interfaces ?? {})) {
+      const exchange = iface.exchange;
+      if (!exchange?.peeringdb_ixlan)
+        continue;
+      const published = addressesOf(iface).map(host).filter(isGlobal);
+      records.push({
+        name: exchange.name,
+        ixlan_id: exchange.peeringdb_ixlan,
+        speed: exchange.speed,
+        ipaddr4: published.find((address) => familyOf(address) === "ipv4") ?? null,
+        ipaddr6: published.find((address) => familyOf(address) === "ipv6") ?? null,
+        is_rs_peer: peersWithRouteServer(device, iface)
+      });
+    }
+  }
+  return records;
+}
+async function planPeeringDb(network2) {
+  if (!network2.asn)
+    throw new Error("the network declares no asn");
+  const response = await fetch(`${API}/netixlan?asn=${network2.asn}`, {
+    headers: { Accept: "application/json" },
+    signal: AbortSignal.timeout(30000)
+  });
+  if (!response.ok)
+    throw new Error(`PeeringDB answered ${response.status}`);
+  const existing = (await response.json()).data;
+  const desired = wanted(network2);
+  const netId = existing[0]?.net_id;
+  const changes2 = [];
+  for (const record of desired) {
+    const current = existing.find((candidate) => candidate.ixlan_id === record.ixlan_id);
+    const body = {
+      net_id: netId,
+      ixlan_id: record.ixlan_id,
+      asn: network2.asn,
+      speed: record.speed,
+      ipaddr4: record.ipaddr4,
+      ipaddr6: record.ipaddr6,
+      is_rs_peer: record.is_rs_peer,
+      operational: current?.operational ?? true
+    };
+    if (!current) {
+      changes2.push({ summary: `+ ${record.name}: ${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s`, body });
+      continue;
+    }
+    const differs = current.ipaddr4 !== record.ipaddr4 || current.ipaddr6 !== record.ipaddr6 || current.speed !== record.speed || current.is_rs_peer !== record.is_rs_peer;
+    if (differs) {
+      const before = `${current.ipaddr4}, ${current.ipaddr6}, ${current.speed} Mbit/s, route server ${current.is_rs_peer}`;
+      const after = `${record.ipaddr4}, ${record.ipaddr6}, ${record.speed} Mbit/s, route server ${record.is_rs_peer}`;
+      changes2.push({ summary: `~ ${record.name}: ${before} to ${after}`, id: current.id, body });
+    }
+  }
+  const unknown = existing.filter((record) => !desired.some((candidate) => candidate.ixlan_id === record.ixlan_id)).map((record) => record.name);
+  if (changes2.some((change) => !change.id) && !netId) {
+    throw new Error("PeeringDB holds no presence for this network yet, so its record id is unknown; add the first one by hand");
+  }
+  return { changes: changes2, unknown };
+}
+async function sendPeeringDb(network2, changes2) {
+  if (!network2.peeringdb)
+    throw new Error("the network declares no peeringdb api_key");
+  const apiKey = resolve(network2.peeringdb.api_key);
+  for (const change of changes2) {
+    const response = await fetch(`${API}/netixlan${change.id ? `/${change.id}` : ""}`, {
+      method: change.id ? "PUT" : "POST",
+      headers: { Authorization: `Api-Key ${apiKey}`, "Content-Type": "application/json" },
+      body: JSON.stringify(change.body),
+      signal: AbortSignal.timeout(30000)
+    });
+    if (!response.ok) {
+      const reason = (await response.text()).slice(0, 300);
+      throw new Error(`${change.summary}: PeeringDB answered ${response.status} ${reason}`);
+    }
+    console.log(`  sent ${change.summary}`);
+  }
+}
+
+// src/core/validate.ts
+import { X509Certificate as X509Certificate2 } from "node:crypto";
+function validate(network2) {
+  const findings = [];
+  const seen = new Set;
+  for (const device of network2.devices) {
+    if (seen.has(device.name))
+      findings.push({ level: "error", device: device.name, message: "declared twice" });
+    seen.add(device.name);
+  }
+  for (const device of network2.devices) {
+    const report = (message) => findings.push({ level: "error", device: device.name, message });
+    checkDevice(device, report);
+    const adapter = adapters[device.platform];
+    if (!adapter)
+      report(`no adapter for platform ${device.platform}`);
+    else
+      for (const field of adapter.unsupported(device))
+        report(`${device.platform} cannot express ${field}`);
+  }
+  findings.push(...checkLinks(network2.devices));
+  for (const check of network2.checks ?? [])
+    findings.push(...check(network2.devices));
+  return findings;
+}
+
+class Names {
+  device;
+  report;
+  ports;
+  constructor(device, report) {
+    this.device = device;
+    this.report = report;
+    let ports = [];
+    try {
+      ports = portsOf(device.platform, device.model);
+    } catch (error) {
+      report(error.message);
+    }
+    this.ports = ports;
+  }
+  isInterface(name) {
+    return name in (this.device.interfaces ?? {}) || this.ports.includes(name);
+  }
+  expect(what, name, declared) {
+    if (name !== undefined && !declared)
+      this.report(`${what} '${name}' is not declared`);
+  }
+  expectInterface(what, name) {
+    this.expect(what, name, name !== undefined && this.isInterface(name));
+  }
+}
+function checkDevice(device, report) {
+  const names = new Names(device, report);
+  const cidr = (where, value2) => {
+    if (!isCidr(value2))
+      report(`${where}: '${value2}' is not an address with a length`);
+  };
+  const ip = (where, value2) => {
+    if (!isAddress(value2))
+      report(`${where}: '${value2}' is not an address`);
+  };
+  if (!device.users?.[device.connection.user])
+    report(`connection user '${device.connection.user}' is not one of its users`);
+  checkVlans(device, report);
+  checkAddresses(device, report, cidr, ip);
+  checkPorts(device, names, report);
+  checkInterfaces(device, names, report, ip);
+  checkRouting(device, names, report, cidr, ip);
+  checkPolicies(device, names, report, cidr);
+  checkFirewall(device, names, cidr);
+  checkServices(device, names, report, cidr);
+  checkCertificates(device, names, report);
+}
+function checkVlans(device, report) {
+  const ids = new Map;
+  for (const [name, vlan] of Object.entries(device.vlans ?? {})) {
+    if (!Number.isInteger(vlan.id) || vlan.id < 1 || vlan.id > 4094)
+      report(`VLAN ${name} id ${vlan.id} is outside 1-4094`);
+    if (ids.has(vlan.id))
+      report(`VLANs ${ids.get(vlan.id)} and ${name} share id ${vlan.id}`);
+    ids.set(vlan.id, name);
+  }
+}
+function checkAddresses(device, report, cidr, ip) {
+  const holderOf = new Map;
+  const holders2 = [
+    ...Object.entries(device.ports ?? {}).map(([name, settings]) => ({ where: `port ${name}`, settings })),
+    ...Object.entries(device.interfaces ?? {}).map(([name, settings]) => ({ where: `interface ${name}`, settings }))
+  ];
+  for (const { where, settings } of holders2) {
+    for (const entry of settings?.addresses ?? []) {
+      const address = typeof entry === "string" ? entry : entry.address;
+      cidr(where, address);
+      if (typeof entry !== "string")
+        ip(where, entry.peer);
+      const bare = address.split("/")[0];
+      if (holderOf.has(bare))
+        report(`${bare} is on both ${holderOf.get(bare)} and ${where}`);
+      holderOf.set(bare, where);
+    }
+    for (const group of settings?.vrrp ?? []) {
+      ip(`${where} VRRP ${group.id}`, group.address);
+      if (group.id < 1 || group.id > 255)
+        report(`${where} VRRP id ${group.id} is outside 1-255`);
+    }
+  }
+}
+function checkPorts(device, names, report) {
+  const vlans = device.vlans ?? {};
+  for (const [name, port] of Object.entries(device.ports ?? {})) {
+    if (!port)
+      continue;
+    const switched = Boolean(port.access_vlan || port.trunk_vlans);
+    if (!names.ports.includes(name))
+      report(`port ${name} does not exist on ${device.model}`);
+    if (port.access_vlan && port.trunk_vlans)
+      report(`port ${name} is both access and trunk`);
+    if (port.native_vlan && !port.trunk_vlans)
+      report(`port ${name} has a native VLAN but is not a trunk`);
+    if (switched && port.addresses?.length)
+      report(`port ${name} is switched and routed at once`);
+    if (port.lag && (switched || port.addresses)) {
+      report(`port ${name} is in a LAG and states its own switching or addresses; the LAG holds them`);
+    }
+    for (const vlan of [port.access_vlan, port.native_vlan, ...port.trunk_vlans ?? []]) {
+      names.expect(`port ${name} VLAN`, vlan, vlan === undefined || vlan in vlans);
+    }
+    names.expect(`port ${name} ACL`, port.acl, port.acl !== undefined && port.acl in (device.acls ?? {}));
+    names.expect(`port ${name} LAG`, port.lag, port.lag !== undefined && device.interfaces?.[port.lag]?.type === "lag");
+    names.expect(`port ${name} VRF`, port.vrf, port.vrf !== undefined && port.vrf in (device.vrfs ?? {}));
+  }
+}
+function checkInterfaces(device, names, report, ip) {
+  const vlans = device.vlans ?? {};
+  for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+    if (names.ports.includes(name))
+      report(`interface ${name} has the name of a port`);
+    names.expect(`interface ${name} VRF`, iface.vrf, iface.vrf !== undefined && iface.vrf in (device.vrfs ?? {}));
+    if (iface.type === "vlan")
+      names.expect(`interface ${name} VLAN`, iface.vlan, iface.vlan in vlans);
+    if (iface.type === "gre" || iface.type === "vxlan") {
+      ip(`interface ${name}`, iface.local);
+      ip(`interface ${name}`, iface.remote);
+    }
+    if (iface.type === "lag") {
+      const members = Object.values(device.ports ?? {}).filter((port) => port?.lag === name);
+      if (!members.length)
+        report(`LAG ${name} has no member ports`);
+    }
+    if (iface.type === "wireguard") {
+      for (const peer of iface.peers ?? []) {
+        for (const address of peer.allowed_addresses) {
+          if (!isCidr(address))
+            report(`interface ${name} peer ${peer.name}: '${address}' is not an address with a length`);
+        }
+      }
+    }
+  }
+}
+function checkRouting(device, names, report, cidr, ip) {
+  const routing = device.routing;
+  const policies2 = device.policies ?? {};
+  for (const route of routing?.static ?? []) {
+    cidr("static route", route.prefix);
+    if (!route.via && !route.interface && !route.blackhole)
+      report(`static route ${route.prefix} has no next hop`);
+    if (route.via)
+      ip(`static route ${route.prefix}`, route.via);
+    names.expectInterface(`static route ${route.prefix} interface`, route.interface);
+    names.expect(`static route ${route.prefix} VRF`, route.vrf, route.vrf !== undefined && route.vrf in (device.vrfs ?? {}));
+  }
+  const bgp = routing?.bgp;
+  const isPolicy = (policy) => policy !== undefined && (policy in policies2);
+  for (const prefix of bgp?.networks ?? [])
+    cidr("BGP network", prefix);
+  for (const [name, group] of Object.entries(bgp?.groups ?? {})) {
+    for (const policy of [group.import, group.export]) {
+      names.expect(`BGP group ${name} policy`, policy, isPolicy(policy));
+    }
+  }
+  for (const [name, neighbor] of Object.entries(bgp?.neighbors ?? {})) {
+    ip(`neighbor ${name}`, neighbor.address);
+    const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+    names.expect(`neighbor ${name} group`, neighbor.group, group !== undefined);
+    if (!(neighbor.remote_as ?? group?.remote_as))
+      report(`neighbor ${name} has no remote_as`);
+    for (const policy of [neighbor.import, neighbor.export]) {
+      names.expect(`neighbor ${name} policy`, policy, isPolicy(policy));
+    }
+    const local = neighbor.local_address ?? group?.local_address;
+    if (local && familyOf(local) !== familyOf(neighbor.address))
+      report(`neighbor ${name} local_address and address differ in family`);
+  }
+  for (const [areaId, area] of Object.entries(routing?.ospf?.areas ?? {})) {
+    if (!/^\d+\.\d+\.\d+\.\d+$/.test(areaId))
+      report(`OSPF area '${areaId}' is not written as a dotted area ID`);
+    for (const iface of Object.keys(area.interfaces))
+      names.expectInterface(`OSPF area ${areaId} interface`, iface);
+  }
+}
+function checkPolicies(device, names, report, cidr) {
+  const policies2 = device.policies ?? {};
+  const sets = device.prefix_sets ?? {};
+  for (const [name, rules] of Object.entries(policies2)) {
+    for (const rule of rules) {
+      names.expect(`policy ${name} call`, rule.call, rule.call !== undefined && rule.call in policies2);
+      const set = rule.match?.prefix_set;
+      names.expect(`policy ${name} prefix set`, set, set !== undefined && set in sets);
+      if (rule.match?.prefix)
+        cidr(`policy ${name}`, rule.match.prefix);
+    }
+  }
+  const visit = (policy, path) => {
+    if (path.includes(policy))
+      return report(`policy ${[...path, policy].join(" -> ")} calls itself`);
+    for (const rule of policies2[policy] ?? [])
+      if (rule.call)
+        visit(rule.call, [...path, policy]);
+  };
+  for (const policy of Object.keys(policies2))
+    visit(policy, []);
+}
+function checkFirewall(device, names, cidr) {
+  const firewall = device.firewall;
+  const sets = firewall?.address_sets ?? {};
+  for (const [name, members] of Object.entries(sets)) {
+    for (const member of members) {
+      if (!isAddress(member))
+        cidr(`address set ${name}`, member);
+    }
+  }
+  const filterChains = [firewall?.filter?.input, firewall?.filter?.forward, firewall?.filter?.output];
+  const filterRules = filterChains.flatMap((chain) => chain?.rules ?? []);
+  const natRules = [...firewall?.nat?.source ?? [], ...firewall?.nat?.destination ?? []];
+  for (const rule of [...filterRules, ...natRules]) {
+    const match = rule.match;
+    if (!match)
+      continue;
+    for (const set of [match.src_set, match.dst_set]) {
+      names.expect("address set", set, set !== undefined && set in sets);
+    }
+    for (const iface of [match.in_interface, match.out_interface])
+      names.expectInterface("interface", iface);
+    for (const address of [match.src, match.dst]) {
+      if (address)
+        cidr("firewall rule", address);
+    }
+  }
+}
+function checkServices(device, names, report, cidr) {
+  for (const [name, server] of Object.entries(device.dhcp ?? {})) {
+    names.expectInterface(`DHCP ${name} interface`, server.interface);
+    cidr(`DHCP ${name}`, server.network);
+    if (!isCidr(server.network))
+      continue;
+    const reserved = (server.reservations ?? []).map((reservation) => reservation.address);
+    const addresses2 = [server.gateway, ...server.pool, ...reserved];
+    for (const address of addresses2) {
+      if (!contains(server.network, address))
+        report(`DHCP ${name}: ${address} is outside ${server.network}`);
+    }
+  }
+  for (const [name, relay] of Object.entries(device.dhcp_relay ?? {})) {
+    names.expectInterface(`DHCP relay ${name} interface`, relay.interface);
+  }
+  for (const iface of device.flow_export?.interfaces ?? [])
+    names.expectInterface("flow export interface", iface);
+  const lldp = device.lldp;
+  if (lldp && lldp !== true)
+    for (const iface of lldp.interfaces)
+      names.expectInterface("LLDP interface", iface);
+  const management = device.management;
+  for (const iface of management?.native?.interfaces ?? [])
+    names.expectInterface("native management interface", iface);
+  for (const prefix of management?.allow ?? [])
+    cidr("management allow", prefix);
+  if (management?.snmp && !management.snmp.community && !management.snmp.users)
+    report("SNMP is on with neither a community nor a user");
+}
+function checkCertificates(device, names, report) {
+  const certificates2 = device.certificates ?? {};
+  for (const [name, certificate] of Object.entries(certificates2)) {
+    try {
+      new X509Certificate2(certificate.certificate);
+    } catch {
+      report(`certificate ${name} is not a PEM certificate`);
+    }
+  }
+  for (const service of ["https", "api_tls"]) {
+    const name = device.management?.[service]?.certificate;
+    names.expect(`${service} certificate`, name, name !== undefined && name in certificates2);
+    if (name && certificates2[name] && !certificates2[name].private_key) {
+      report(`${service} certificate ${name} has no private key to serve with`);
+    }
+  }
+}
+function carried(device, port) {
+  const id = (vlan) => vlan ? device.vlans?.[vlan]?.id : undefined;
+  return {
+    access: id(port.access_vlan),
+    native: id(port.native_vlan),
+    trunk: (port.trunk_vlans ?? []).map(id).sort((a, b) => (a ?? 0) - (b ?? 0))
+  };
+}
+function checkLinks(devices) {
+  const findings = [];
+  const byName = new Map(devices.map((device) => [device.name, device]));
+  for (const device of devices) {
+    for (const [portName, port] of Object.entries(device.ports ?? {})) {
+      const link = port?.link;
+      if (!port || !link)
+        continue;
+      const report = (message) => findings.push({
+        level: "error",
+        device: device.name,
+        message: `port ${portName} link: ${message}`
+      });
+      const far = byName.get(link.device);
+      if (!far) {
+        report(`device ${link.device} is not in the network`);
+        continue;
+      }
+      const farPort = far.ports?.[link.port];
+      if (!farPort) {
+        report(`${link.device} does not declare port ${link.port}`);
+        continue;
+      }
+      const linksBack = farPort.link?.device === device.name && farPort.link.port === portName;
+      if (!linksBack)
+        report(`${link.device} ${link.port} does not link back to it`);
+      const here = JSON.stringify(carried(device, port));
+      const there = JSON.stringify(carried(far, farPort));
+      if (here !== there)
+        report(`carries ${here}, and ${link.device} ${link.port} carries ${there}`);
+    }
+  }
+  return findings;
+}
+
+// src/cli/index.ts
+var HELP = `usage: circuit <command> [device...] [options]
+
+  new [directory]       start a project from a pattern, asking what it needs
+  validate              check the config, then every rule in checks
+  build <device>        print the configuration the device should run, without contacting it
+  diff [device...]      what apply would send, planned against the last snapshot, offline
+  snapshot [device...]  read what each device runs into the state directory
+  apply <device>        read the device, plan against what it runs, and send with --confirm
+                          --secrets      also send every secret, to rotate one
+                          --rollback=N   minutes before a device that can restore itself does, default 10
+  refresh <device>      fetch prefix sets that come from a registry onto the device, with --confirm
+  wireguard <device> <interface> <peer>
+                        a client config for one peer, its private key left for the peer to fill
+  communities           the network's BGP communities, one per line, for a looking glass or bgp.tools
+  peeringdb             bring PeeringDB's exchange records in line with the config, with --confirm
+  secrets               every secret the config uses, and whether each can be read
+
+  --config <path>       the network's config file, circuit.config.ts in the working directory by default`;
+var DEFAULT_CONFIG = "circuit.config.ts";
+var [command2, ...args] = process.argv.slice(2);
+if (command2 === "new") {
+  const { create } = await import("../chunks/new-7n8qvtjd.js");
+  await create(args);
+  process.exit(0);
+}
+if (!command2 || command2 === "help" || command2 === "--help" || command2 === "-h") {
+  console.log(HELP);
+  process.exit(0);
+}
+var configAt = args.indexOf("--config");
+var configArgument = configAt >= 0 ? args[configAt + 1] : args.find((arg) => arg.startsWith("--config="))?.slice("--config=".length);
+var rest = args.filter((arg, index) => index !== configAt && (configAt < 0 || index !== configAt + 1) && !arg.startsWith("--config="));
+var configPath = resolve2(process.cwd(), configArgument ?? DEFAULT_CONFIG);
+if (!existsSync2(configPath)) {
+  console.error(configArgument ? `no config at ${configPath}` : `no ${DEFAULT_CONFIG} in ${process.cwd()}; name another with --config <path>`);
+  process.exit(1);
+}
+var root2 = dirname(configPath);
+useRoot(root2);
+async function load(path) {
+  if (process.versions.bun)
+    return (await import(path)).default;
+  const { createJiti } = await import("jiti");
+  return createJiti(import.meta.url).import(path, { default: true });
+}
+var network2 = await load(configPath);
+var flags = rest.filter((arg) => arg.startsWith("--"));
+var names = rest.filter((arg) => !arg.startsWith("--"));
+var confirmed = flags.includes("--confirm");
+var options = {
+  secrets: flags.includes("--secrets"),
+  rollback: Number(flags.find((flag) => flag.startsWith("--rollback="))?.split("=")[1] ?? 10)
+};
+function fail(message) {
+  console.error(message);
+  process.exit(1);
+}
+function selected(allByDefault) {
+  if (!names.length && allByDefault)
+    return [...network2.devices];
+  const known = network2.devices.map((device) => device.name).join(", ");
+  const byName = (name) => network2.devices.find((device) => device.name === name);
+  return names.map((name) => byName(name) ?? fail(`no device ${name}; known: ${known}`));
+}
+function one() {
+  const [device] = selected(false);
+  return device ?? fail("name a device");
+}
+var adapterOf = (device) => adapters[device.platform] ?? fail(`no adapter for ${device.platform}`);
+var generated = join2(root2, ".circuit");
+var stateDirectory = join2(generated, "state");
+var statePath = (device) => join2(stateDirectory, device.name + adapterOf(device).extension);
+var GENERATED_README = `# Written by Circuit
+
+Do not edit anything here: an edit changes nothing on a device, and Circuit overwrites it. Change the config instead.
+
+\`state/\` holds what each device ran when Circuit last read it, with secrets removed. \`circuit snapshot\` and \`circuit apply\` write it, and \`circuit diff\` plans against it. Commit it, so the history of this directory is the history of the network.
+`;
+function writeState(device, text) {
+  mkdirSync(stateDirectory, { recursive: true });
+  writeFileSync(join2(generated, "README.md"), GENERATED_README);
+  writeFileSync(statePath(device), text);
+}
+function guard(devices) {
+  const relevant = new Set(devices.map((device) => device.name));
+  const findings = validate(network2).filter((finding) => !finding.device || relevant.has(finding.device));
+  for (const finding of findings) {
+    const where = finding.device ? `${finding.device}: ` : "";
+    const level = finding.level === "error" ? "error" : "warn ";
+    console.log(`  ${level}  ${where}${finding.message}`);
+  }
+  const errors = findings.filter((finding) => finding.level === "error").length;
+  if (errors)
+    fail(`
+${errors} error(s).`);
+}
+function show(device, plan4) {
+  const commands = plan4.steps.reduce((count, step) => count + step.send.length, 0);
+  const summary = commands ? `${commands} command(s) in ${plan4.steps.length} step(s)` : "matches";
+  console.log(`${device.name}: ${summary}`);
+  for (const step of plan4.steps) {
+    console.log(`  ${step.title}`);
+    for (const line2 of step.show)
+      console.log(`    ${line2.slice(0, 220)}`);
+  }
+  for (const problem of plan4.problems)
+    console.log(`  PROBLEM ${problem}`);
+  return commands + plan4.problems.length;
+}
+function validateCommand() {
+  guard([...network2.devices]);
+  console.log(`${network2.devices.length} device(s), no errors.`);
+}
+function buildCommand() {
+  const device = one();
+  process.stdout.write(adapterOf(device).render(device));
+}
+function diffCommand() {
+  const devices = selected(true);
+  guard(devices);
+  let differences = 0;
+  for (const device of devices) {
+    const path = statePath(device);
+    if (!existsSync2(path)) {
+      console.log(`${device.name}: no snapshot, run snapshot first`);
+      continue;
+    }
+    const adapter = adapterOf(device);
+    const plan4 = adapter.plan(adapter.render(device), readFileSync2(path, "utf8"), options);
+    differences += show(device, plan4);
+  }
+  process.exit(differences ? 1 : 0);
+}
+async function snapshotCommand() {
+  for (const device of selected(true)) {
+    const text = await adapterOf(device).read(device, network2.devices);
+    writeState(device, text);
+    console.log(`${device.name}: ${text.split(`
+`).length} lines`);
+  }
+  if (names.length || !existsSync2(stateDirectory))
+    return;
+  const current = new Set(network2.devices.map((device) => basename(statePath(device))));
+  for (const file of readdirSync(stateDirectory)) {
+    if (current.has(file))
+      continue;
+    rmSync(join2(stateDirectory, file));
+    console.log(`${file}: removed, no such device in the config`);
+  }
+}
+async function applyCommand() {
+  const device = one();
+  guard([device]);
+  const adapter = adapterOf(device);
+  const live = await adapter.read(device, network2.devices);
+  writeState(device, live);
+  const plan4 = adapter.plan(adapter.render(device), live, options);
+  if (!show(device, plan4))
+    return;
+  if (plan4.problems.length)
+    fail(`
+Not sent: resolve the problems first.`);
+  if (!confirmed) {
+    console.log(`
+Nothing sent. Re-run with --confirm.`);
+    return;
+  }
+  await adapter.apply(device, network2.devices, plan4, options);
+  writeState(device, await adapter.read(device, network2.devices));
+  console.log("snapshot updated");
+}
+async function refreshCommand() {
+  const device = one();
+  const fill2 = adapterOf(device).fill ?? fail(`${device.platform} cannot hold a fetched prefix set`);
+  for (const [name, set] of Object.entries(device.prefix_sets ?? {})) {
+    if (!("source" in set))
+      continue;
+    const { registry, query, family } = set.source;
+    const prefixes = await registries[registry](query, family);
+    if (prefixes.length < 1 || prefixes.length > 1e5) {
+      fail(`${name}: ${prefixes.length} prefixes from ${registry}, refusing`);
+    }
+    console.log(`${name}: ${prefixes.length} prefixes from ${registry} ${query}`);
+    if (confirmed)
+      await fill2(device, network2.devices, name, family, prefixes);
+  }
+  if (!confirmed)
+    console.log(`
+Nothing sent. Re-run with --confirm.`);
+}
+function publicKeyOf(privateKey) {
+  const pkcs8Prefix = Buffer.from("302e020100300506032b656e04220420", "hex");
+  const der = Buffer.concat([pkcs8Prefix, Buffer.from(privateKey, "base64")]);
+  const key = createPrivateKey({ key: der, format: "der", type: "pkcs8" });
+  const publicDer = createPublicKey(key).export({ format: "der", type: "spki" });
+  return publicDer.subarray(-32).toString("base64");
+}
+function wireguardCommand() {
+  const [deviceName, interfaceName, peerName] = names;
+  const device = network2.devices.find((candidate) => candidate.name === deviceName) ?? fail(HELP);
+  const iface = device.interfaces?.[interfaceName ?? ""];
+  if (iface?.type !== "wireguard")
+    fail(`${deviceName} has no WireGuard interface ${interfaceName}`);
+  const peers = iface.peers ?? [];
+  const peerNames = peers.map((candidate) => candidate.name).join(", ");
+  const peer = peers.find((candidate) => candidate.name === peerName) ?? fail(`no peer ${peerName} on ${interfaceName}: ${peerNames}`);
+  const tunnelNetworks = (iface.addresses ?? []).map((entry) => network(typeof entry === "string" ? entry : entry.address));
+  const lines = [
+    "[Interface]",
+    `# ${peerName}'s own private key. It never leaves their machine.`,
+    "PrivateKey = <FILL IN>",
+    `Address = ${peer.allowed_addresses.join(", ")}`,
+    "",
+    "[Peer]",
+    `PublicKey = ${publicKeyOf(resolve(iface.private_key))}`,
+    `Endpoint = ${iface.endpoint ?? "<FILL IN>"}:${iface.listen_port}`,
+    `AllowedIPs = ${(peer.client_allowed_addresses ?? tunnelNetworks).join(", ")}`,
+    "PersistentKeepalive = 25",
+    ""
+  ];
+  process.stdout.write(lines.join(`
+`));
+}
+function communitiesCommand() {
+  const communities = network2.communities ?? fail("the network declares no communities");
+  for (const { community, description } of communities) {
+    if (community.includes(","))
+      fail(`community ${community} holds a comma`);
+    console.log(`${community},${description}`);
+  }
+}
+async function peeringdbCommand() {
+  const plan4 = await planPeeringDb(network2);
+  for (const name of plan4.unknown) {
+    console.log(`  PeeringDB lists ${name}, which the config does not. Remove it by hand if the network left.`);
+  }
+  for (const change of plan4.changes)
+    console.log(`  ${change.summary}`);
+  if (!plan4.changes.length) {
+    console.log("PeeringDB matches the config.");
+    return;
+  }
+  if (!confirmed) {
+    console.log(`
+Nothing sent. Re-run with --confirm.`);
+    return;
+  }
+  await sendPeeringDb(network2, plan4.changes);
+}
+function secretsIn(value2, found = new Set) {
+  if (isSecret(value2))
+    found.add(referenceOf(value2));
+  else if (Array.isArray(value2))
+    for (const item of value2)
+      secretsIn(item, found);
+  else if (typeof value2 === "object" && value2 !== null)
+    for (const item of Object.values(value2))
+      secretsIn(item, found);
+  return found;
+}
+function secretsCommand() {
+  const references = [...secretsIn([network2.devices, network2.peeringdb])].sort();
+  let missing = 0;
+  for (const reference of references) {
+    const name = reference.replace(/^file:/, "");
+    try {
+      resolve(reference);
+      console.log(`  ok       ${name}, from ${sourceOf(reference)}`);
+    } catch (error) {
+      missing++;
+      console.log(`  missing  ${name}: ${error.message}`);
+    }
+  }
+  console.log(`
+${references.length} secret(s), ${missing} missing.`);
+  process.exit(missing ? 1 : 0);
+}
+var commands = {
+  validate: validateCommand,
+  build: buildCommand,
+  diff: diffCommand,
+  snapshot: snapshotCommand,
+  apply: applyCommand,
+  refresh: refreshCommand,
+  wireguard: wireguardCommand,
+  communities: communitiesCommand,
+  peeringdb: peeringdbCommand,
+  secrets: secretsCommand
+};
+var run = commands[command2];
+if (run)
+  await run();
+else
+  fail(`no command ${command2}
+
+${HELP}`);