@takodotid/circuit 0.9.0 → 0.11.0

package/dist/index.js

@@ -0,0 +1,48 @@
+import {
+  contains,
+  familyOf,
+  host,
+  isAddress,
+  isCidr,
+  isGlobal,
+  network
+} from "./chunks/index-ex1wcst7.js";
+import"./chunks/index-fq57hya4.js";
+
+// src/core/define.ts
+var secret = (name) => ({ secret: name });
+var secretFile = (path) => {
+  if (!/^[A-Za-z0-9_./-]+$/.test(path))
+    throw new Error(`secret file path ${path} may hold only letters, digits, _ . / and -`);
+  return { secret_file: path };
+};
+function defineDevice(device) {
+  return device;
+}
+var defineNetwork = (network2) => network2;
+// src/core/merge.ts
+function merge(...records) {
+  const result = {};
+  for (const record of records) {
+    for (const [key, value] of Object.entries(record)) {
+      if (key in result)
+        throw new Error(`merge: ${key} is declared twice`);
+      result[key] = value;
+    }
+  }
+  return result;
+}
+export {
+  secretFile,
+  secret,
+  network as prefixOf,
+  merge,
+  isGlobal,
+  isCidr,
+  isAddress,
+  host,
+  familyOf,
+  defineNetwork,
+  defineDevice,
+  contains
+};

package/dist/presets/index.js

@@ -0,0 +1,269 @@
+import {
+  contains
+} from "../chunks/index-ex1wcst7.js";
+import"../chunks/index-fq57hya4.js";
+
+// src/presets/index.ts
+var MARTIANS = ["127.0.0.0/8", "169.254.0.0/16", "0.0.0.0/8"];
+var PRIVATE_RANGES = ["10.0.0.0/8", "172.16.0.0/12", "192.168.0.0/16"];
+var antiSpoofing = (vlan, sources) => sources.map((src) => ({
+  description: `${vlan}: drop source ${src}`,
+  match: { vlan, src },
+  action: "drop"
+}));
+var BAD_TCP_FLAGS = [
+  ["FIN+SYN", ["fin", "syn"], []],
+  ["SYN+RST", ["syn", "rst"], []],
+  ["FIN+RST", ["fin", "rst"], []],
+  ["FIN without ACK", ["fin"], ["ack"]],
+  ["FIN+URG", ["fin", "urg"], []],
+  ["Xmas scan", ["fin", "syn", "psh", "urg"], []]
+];
+var badTcpFlags = () => BAD_TCP_FLAGS.map(([name, set, unset]) => ({
+  description: `Bad flags ${name}`,
+  match: { protocol: "tcp", tcp_flags: { set, unset } },
+  action: "drop"
+}));
+function bgpSanity(lengths = {}) {
+  const ipv4 = lengths.ipv4 ?? { min: 8, max: 24 };
+  const ipv6 = lengths.ipv6 ?? { min: 16, max: 48 };
+  return [
+    {
+      description: `IPv4 shorter than /${ipv4.min}`,
+      match: { family: "ipv4", prefix_length: { max: ipv4.min - 1 } },
+      action: "reject"
+    },
+    { description: `IPv4 longer than /${ipv4.max}`, match: { family: "ipv4", prefix_length: { min: ipv4.max + 1 } }, action: "reject" },
+    {
+      description: `IPv6 shorter than /${ipv6.min}`,
+      match: { family: "ipv6", prefix_length: { max: ipv6.min - 1 } },
+      action: "reject"
+    },
+    { description: `IPv6 longer than /${ipv6.max}`, match: { family: "ipv6", prefix_length: { min: ipv6.max + 1 } }, action: "reject" },
+    { description: "RPKI invalid", match: { rpki: "invalid" }, action: "reject" }
+  ];
+}
+function neighborPolicies(device) {
+  const bgp = device.routing?.bgp;
+  return Object.entries(bgp?.neighbors ?? {}).map(([name, neighbor]) => {
+    const group = neighbor.group ? bgp?.groups?.[neighbor.group] : undefined;
+    return { name, address: neighbor.address, import: neighbor.import ?? group?.import, export: neighbor.export ?? group?.export };
+  });
+}
+function offered(device, policy) {
+  const rules = policy ? device.policies?.[policy] ?? [] : [];
+  return rules.filter((rule) => rule.action === "accept" && rule.match?.prefix).map((rule) => rule.match.prefix);
+}
+var exportsEndInReject = (devices) => {
+  const findings = [];
+  for (const device of devices) {
+    for (const neighbor of neighborPolicies(device)) {
+      const last = neighbor.export ? device.policies?.[neighbor.export]?.at(-1) : undefined;
+      if (neighbor.export && (last?.action !== "reject" || last.match)) {
+        findings.push({
+          level: "error",
+          device: device.name,
+          message: `${neighbor.name}: export ${neighbor.export} does not end in an unconditional reject`
+        });
+      }
+    }
+  }
+  return findings;
+};
+var vlansOf = (port) => [port.access_vlan, ...port.trunk_vlans ?? []].filter((vlan) => vlan !== undefined);
+var trustBoundary = (boundary) => (devices) => {
+  const untrusted = new Set(boundary.untrusted);
+  const routers = new Set(boundary.routers);
+  const findings = [];
+  for (const device of devices) {
+    const isRouter = routers.has(device.name);
+    const ports = Object.entries(device.ports ?? {}).flatMap(([name, port]) => port ? [{ name, port }] : []);
+    const carriers = [
+      ...ports.filter(({ port }) => !port.lag).map(({ name, port }) => ({
+        what: `port ${name}`,
+        carried: vlansOf(port),
+        faces: port.link ? [port.link.device] : []
+      })),
+      ...Object.entries(device.interfaces ?? {}).flatMap(([name, iface]) => iface.type === "lag" ? [
+        {
+          what: `LAG ${name}`,
+          carried: vlansOf(iface),
+          faces: ports.filter(({ port }) => port.lag === name && port.link).map(({ port }) => port.link.device)
+        }
+      ] : [])
+    ];
+    for (const { what, carried, faces } of carriers) {
+      const mixes = carried.some((vlan) => untrusted.has(vlan)) && carried.some((vlan) => !untrusted.has(vlan));
+      const facesRouter = isRouter || faces.some((name) => routers.has(name));
+      if (mixes && !facesRouter) {
+        findings.push({
+          level: "error",
+          device: device.name,
+          message: `${what} carries an untrusted VLAN beside a trusted one and does not face a router`
+        });
+      }
+    }
+    if (isRouter)
+      continue;
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+      if (iface.type === "vlan" && untrusted.has(iface.vlan)) {
+        findings.push({
+          level: "error",
+          device: device.name,
+          message: `interface ${name} puts an address on untrusted VLAN ${iface.vlan}; only a router may`
+        });
+      }
+    }
+  }
+  return findings;
+};
+var tunnelsOutsideOffered = (devices) => {
+  const findings = [];
+  for (const device of devices) {
+    for (const [name, iface] of Object.entries(device.interfaces ?? {})) {
+      if (iface.type !== "gre" && iface.type !== "vxlan")
+        continue;
+      const subnets = (iface.addresses ?? []).map((entry) => typeof entry === "string" ? entry : entry.address);
+      for (const neighbor of neighborPolicies(device)) {
+        if (!subnets.some((subnet) => contains(subnet, neighbor.address)))
+          continue;
+        for (const prefix of offered(device, neighbor.export)) {
+          if (contains(prefix, iface.local)) {
+            findings.push({
+              level: "error",
+              device: device.name,
+              message: `${name} is sourced from ${iface.local}, inside ${prefix}, which ${neighbor.name} is offered`
+            });
+          }
+        }
+      }
+    }
+  }
+  return findings;
+};
+var PREPENDS = [
+  ["once", 1],
+  ["twice", 2],
+  ["three_times", 3]
+];
+var article = (word) => /^[aeiou]/i.test(word) ? `an ${word}` : `a ${word}`;
+function communityScheme(scheme) {
+  const { asn } = scheme;
+  const community = (fn, parameter) => `${asn}:${fn}:${parameter}`;
+  const ours = { standard: [`${asn}:*`], large: [`${asn}:*:*`] };
+  const information = [scheme.learned_from?.function, scheme.learned_at?.function, scheme.learned_from_as].filter((fn) => fn !== undefined);
+  const tag = (neighborClass, neighborAs, options = {}) => {
+    const { site, keepActions = false } = options;
+    if (scheme.learned_at && site === undefined)
+      throw new Error(`communityScheme: tag for AS${neighborAs} needs a site, for learned_at`);
+    return {
+      description: `Learned from AS${neighborAs}`,
+      set: {
+        remove_communities: ours.standard,
+        remove_large_communities: keepActions ? information.map((fn) => community(fn, "*")) : ours.large,
+        add_large_communities: [
+          ...scheme.learned_from ? [community(scheme.learned_from.function, scheme.learned_from.classes[neighborClass])] : [],
+          ...scheme.learned_at ? [community(scheme.learned_at.function, site)] : [],
+          ...scheme.learned_from_as !== undefined ? [community(scheme.learned_from_as, neighborAs)] : []
+        ]
+      }
+    };
+  };
+  const blackhole = (prefixSet) => {
+    if (scheme.blackhole === undefined)
+      throw new Error("communityScheme: blackhole needs a function number in the scheme");
+    return {
+      description: "Blackhole, asked by the customer",
+      match: { large_community: community(scheme.blackhole, 0), prefix_set: prefixSet },
+      set: { blackhole: true },
+      action: "accept"
+    };
+  };
+  const actions = (neighborAs, options = {}) => [
+    ...scheme.blackhole !== undefined && !options.blackhole ? [
+      {
+        description: "Blackholed here, never announced",
+        match: { large_community: community(scheme.blackhole, 0) },
+        action: "reject"
+      }
+    ] : [],
+    ...scheme.do_not_announce !== undefined ? [
+      {
+        description: "Asked not to be announced anywhere",
+        match: { large_community: community(scheme.do_not_announce, 0) },
+        action: "reject"
+      },
+      {
+        description: `Asked not to be announced to AS${neighborAs}`,
+        match: { large_community: community(scheme.do_not_announce, neighborAs) },
+        action: "reject"
+      }
+    ] : [],
+    ...scheme.blackhole !== undefined && options.blackhole ? [
+      {
+        description: `Blackhole passed on to AS${neighborAs}`,
+        match: { large_community: community(scheme.blackhole, 0) },
+        set: {
+          remove_communities: ours.standard,
+          remove_large_communities: ours.large,
+          add_communities: [options.blackhole]
+        },
+        action: "accept"
+      }
+    ] : [],
+    ...PREPENDS.flatMap(([name, times]) => {
+      const fn = scheme.prepend?.[name];
+      if (fn === undefined)
+        return [];
+      return [
+        {
+          description: `Asked to prepend ${name.replace("_", " ")} to AS${neighborAs}`,
+          match: { large_community: community(fn, neighborAs) },
+          set: { prepend: times }
+        }
+      ];
+    }),
+    {
+      description: "Our communities stay inside our network",
+      set: { remove_communities: ours.standard, remove_large_communities: ours.large }
+    }
+  ];
+  const catalogue = [
+    ...Object.entries(scheme.learned_from?.classes ?? {}).map(([name, value]) => ({
+      community: community(scheme.learned_from.function, value),
+      description: `Learned from ${article(name)}`
+    })),
+    ...scheme.learned_at ? [
+      ...Object.entries(scheme.learned_at.sites ?? {}).map(([site, name]) => ({
+        community: community(scheme.learned_at.function, site),
+        description: `Learned in ${name}`
+      })),
+      { community: community(scheme.learned_at.function, "nnn"), description: "Learned at site $0" }
+    ] : [],
+    ...scheme.learned_from_as !== undefined ? [{ community: community(scheme.learned_from_as, "nnn"), description: "Learned from AS$0" }] : [],
+    ...scheme.do_not_announce !== undefined ? [
+      { community: community(scheme.do_not_announce, 0), description: "Do not announce to anyone" },
+      { community: community(scheme.do_not_announce, "nnn"), description: "Do not announce to AS$0" }
+    ] : [],
+    ...PREPENDS.flatMap(([name]) => {
+      const fn = scheme.prepend?.[name];
+      return fn === undefined ? [] : [{ community: community(fn, "nnn"), description: `Prepend ${name.replace("_", " ")} to AS$0` }];
+    }),
+    ...scheme.blackhole !== undefined ? [{ community: community(scheme.blackhole, 0), description: `Blackhole: dropped in AS${asn}, not announced further` }] : []
+  ];
+  return { community, tag, actions, blackhole, catalogue };
+}
+export {
+  vlansOf,
+  tunnelsOutsideOffered,
+  trustBoundary,
+  offered,
+  neighborPolicies,
+  exportsEndInReject,
+  communityScheme,
+  bgpSanity,
+  badTcpFlags,
+  antiSpoofing,
+  PRIVATE_RANGES,
+  MARTIANS
+};

package/dist/types/adapters/devices/catalog.d.ts

@@ -0,0 +1,58 @@
+export declare const catalog: {
+    readonly routeros: {
+        readonly "CCR2216-1G-12XS-2XQ": {
+            readonly ports: {
+                readonly "100g": 2;
+                readonly "25g": 12;
+                readonly "1g": 1;
+            };
+            readonly spelling: {
+                readonly "100g": "qsfp28-{n}-1";
+                readonly "25g": "sfp28-{n}";
+                readonly "1g": "ether{n}";
+            };
+        };
+    };
+    readonly vrp: {
+        readonly "CE6855-48S6Q-HI": {
+            readonly ports: {
+                readonly "10g": 48;
+                readonly "40g": 6;
+            };
+            readonly spelling: {
+                readonly "10g": "10GE1/0/{n}";
+                readonly "40g": "40GE1/0/{n}";
+            };
+        };
+    };
+    readonly "raisecom-ros": {
+        readonly "RAX721-C-6C48": {
+            readonly ports: {
+                readonly "100g": 6;
+                readonly "25g": 24;
+                readonly "10g": 24;
+            };
+            readonly spelling: {
+                readonly "100g": "hundredgige 1/1/{n}";
+                readonly "25g": "twenty-fivegige 1/2/{n}";
+                readonly "10g": "tengigabitethernet 1/3/{n}";
+            };
+        };
+    };
+};
+export type Catalog = typeof catalog;
+export type PlatformName = keyof Catalog;
+export type ModelName<Pl extends PlatformName> = keyof Catalog[Pl] & string;
+type Upto<N extends number, A extends unknown[] = [], R = never> = A["length"] extends N ? R : Upto<N, [...A, 0], R | `${[...A, 0]["length"]}`>;
+type PortsOf<Pl extends PlatformName, M extends ModelName<Pl>> = Catalog[Pl][M] extends {
+    ports: infer P;
+} ? P : never;
+/** `10g-1` to `10g-48` on a model with 48 10G ports. */
+export type PortName<Pl extends PlatformName, M extends ModelName<Pl>> = {
+    [S in keyof PortsOf<Pl, M>]: `${S & string}-${Upto<PortsOf<Pl, M>[S] & number>}`;
+}[keyof PortsOf<Pl, M>];
+/** Every port a model has, in order. */
+export declare function portsOf(platform: string, model: string): string[];
+/** The platform's own name for a port. */
+export declare function spell(platform: string, model: string, port: string): string;
+export {};

package/dist/types/adapters/devices/derive.d.ts

@@ -0,0 +1,5 @@
+import type { Device } from "../../schema";
+/** Each LAG's number: its own `id`, or its position among the device's LAGs. */
+export declare function lagIds(device: Device): Map<string, number>;
+/** The IPv4 networks of a port's or an interface's addresses. */
+export declare function ipv4Networks(device: Device, iface: string): string[];

package/dist/types/adapters/devices/index.d.ts

@@ -0,0 +1,3 @@
+import type { DeviceAdapter } from "./types";
+/** Every platform the framework can render and apply, by name. */
+export declare const adapters: Record<string, DeviceAdapter>;

package/dist/types/adapters/devices/lines.d.ts

@@ -0,0 +1,56 @@
+import type { Plan } from "./types";
+export type Dialect = {
+    /** A line at the margin that opens a block, for platforms that do not indent a block's lines. */
+    block: RegExp;
+    /** Whether a block's lines are indented under it. When they are, any line followed by deeper lines opens a block. */
+    indented: boolean;
+    /** A line at the margin that closes every open block. */
+    terminator: string;
+    /** Lines that describe the device rather than configure it, or that the platform prints whatever is set. */
+    ignore: (line: string) => boolean;
+    /** The command that removes a line. */
+    undo: (line: string) => string;
+    /** Leaves one level of block. */
+    leave: string;
+    /** Lines sent before the undos of their block, because the platform refuses an undo until they are in place. */
+    first?: RegExp;
+    /** A line in the form both sides compare in, for example a secret the device prints as a cipher. */
+    canon?: (line: string) => string;
+    /** Where a block is sent among the others, lowest first, so that nothing is referenced before it exists. In the order they differ when absent. */
+    order?: (path: string[]) => number;
+};
+/** One line, with the blocks it sits in, outermost first. */
+export type Entry = {
+    path: string[];
+    line: string;
+};
+export declare function entries(text: string, dialect: Dialect): Entry[];
+/** The part of a line that names what it sets: `rule 5`, a free-text keyword, or the line up to its value. Two lines with one head are one setting with two values. */
+export declare function head(line: string): string;
+/** What changes inside one block. */
+export type Group = {
+    path: string[];
+    remove: string[];
+    add: string[];
+};
+/**
+ * What differs, by block.
+ *
+ * A device line replaced by a desired line with the same head is not undone; sending the new one is enough. A block the render does not hold goes with its header, and its lines with it.
+ */
+export declare function compare(desired: string, current: string, dialect: Dialect): Group[];
+/**
+ * Replace a changed VLAN list line with only what changed.
+ *
+ * A platform keeps its VLANs as one line, such as `vlan batch 10 20 to 30`. Undoing the old line would delete VLANs still in use, so the plan adds the new IDs and removes the gone ones instead.
+ */
+export declare function vlanListChange(groups: Group[], prefix: string, parse: (line: string) => number[], format: (ids: number[]) => string[], removal: (ids: number[]) => string[]): void;
+/** Commands a platform needs around one group, such as releasing a binding before a change and restoring it after. */
+export type Around = (group: Group) => {
+    before: string[];
+    after: string[];
+};
+/** The steps for the groups: enter each block of the path, undo, add, then leave each level. */
+export declare function steps(groups: Group[], dialect: Dialect, around?: Around): Plan["steps"];
+/** A device prints stored credentials as ciphers. They never leave the read. */
+export declare const scrub: (text: string) => string;

package/dist/types/adapters/devices/raisecom-ros/index.d.ts

@@ -0,0 +1,23 @@
+import type { ClientChannel } from "ssh2";
+import type { Device } from "../../../schema";
+import { type Dialect } from "../lines";
+import type { DeviceAdapter, Plan } from "../types";
+export declare const dialect: Dialect;
+/** The access-list that guards every management service. */
+export declare const MANAGEMENT_ACL = 1000;
+/** `99,200-201,999`, the platform's compression of a VLAN list. */
+export declare function vlanList(ids: number[]): string;
+export declare function render(device: Device): string;
+export type Session = {
+    channel: ClientChannel;
+    close: () => void;
+};
+/** An interactive shell, paging off. A session that does not answer as ROS is refused, so nothing meant for it can reach another shell. */
+export declare function open(device: Device): Promise<Session>;
+/** What the device runs, credentials scrubbed. */
+export declare function read(device: Device): Promise<string>;
+export declare function unsupported(device: Device): string[];
+export declare function apply(device: Device, _network: readonly Device[], plan: Plan): Promise<void>;
+/** The VLAN IDs of a `create vlan 10,20-30 active` line. */
+export declare function createdIds(line: string): number[];
+export declare const raisecom: DeviceAdapter;

package/dist/types/adapters/devices/raisecom-ros/models.d.ts

@@ -0,0 +1,14 @@
+export declare const models: {
+    readonly "RAX721-C-6C48": {
+        readonly ports: {
+            readonly "100g": 6;
+            readonly "25g": 24;
+            readonly "10g": 24;
+        };
+        readonly spelling: {
+            readonly "100g": "hundredgige 1/1/{n}";
+            readonly "25g": "twenty-fivegige 1/2/{n}";
+            readonly "10g": "tengigabitethernet 1/3/{n}";
+        };
+    };
+};

package/dist/types/adapters/devices/routeros/export.d.ts

@@ -0,0 +1,39 @@
+export type Command = {
+    /** The menu the command belongs to, such as `/ip address`. */
+    menu: string;
+    verb: "add" | "set";
+    /** What a `set` addresses: `[ find default-name=ether1 ]`, `ftp`, `1`, or nothing for a menu of one. */
+    selector: string;
+    /** Words without a value, such as `blackhole`. */
+    flags: string[];
+    /** Properties, unquoted and unescaped. */
+    attrs: Record<string, string>;
+};
+export type Parsed = {
+    commands: Command[];
+    /** Address lists whose entries are filled by `refresh`, not by the render. */
+    generated: Set<string>;
+};
+export declare function parse(text: string): Parsed;
+/**
+ * Values the platform holds when nothing was set, per menu, and under `*` for every menu.
+ *
+ * A property at its default is dropped from both sides of a comparison, and this is the value a property the config does not state is reset to. A property the device holds that is not here cannot be reset, which the plan reports as a problem.
+ */
+export declare const DEFAULTS: Record<string, Record<string, string>>;
+/** The default of one property of a command, or undefined when it is not known. */
+export declare function defaultOf(command: Command, property: string): string | undefined;
+/** A property the device stops printing once another returns to its default. Resetting that other one clears it, so it is never reset on its own. */
+export declare const CLEARED_WITH: Record<string, Record<string, string>>;
+/** Properties whose value cannot be read back from the device. They are compared only by the presence of what holds them. */
+export declare const SECRET_KEYS: Set<string>;
+/** How the renderer writes a secret. */
+export declare const isSecretMarker: (value: string) => boolean;
+/** A command's properties without defaults or secrets, in the form both sides compare in. */
+export declare function normal(command: Command): Record<string, string>;
+/** What identifies an `add` entry, so that the same entry is found on both sides. */
+export declare function identity(command: Command): Record<string, string>;
+/** Menus whose entries are an ordered list without names. They are rewritten whole, in the order the render gives. */
+export declare const ORDERED: Set<string>;
+/** One command as a string that is equal for equal commands. */
+export declare function canonical(command: Command): string;

package/dist/types/adapters/devices/routeros/index.d.ts

@@ -0,0 +1,17 @@
+import type { Client } from "ssh2";
+import type { Device, Family } from "../../../schema";
+import type { ApplyOptions, DeviceAdapter, Plan } from "../types";
+/** The major version this adapter renders for. Version 6 has a different BGP and filter language altogether. */
+export declare const SUPPORTED_MAJOR = 7;
+export declare function login(device: Device): Promise<Client>;
+/** Refuse a device on a version this adapter does not render for, before anything is read or sent. */
+export declare function checkVersion(client: Client, device: Device): Promise<void>;
+/**
+ * What the device runs: its export, its users, and its certificates. Secrets are not part of an export.
+ */
+export declare function read(device: Device): Promise<string>;
+export declare function unsupported(device: Device): string[];
+export declare function apply(device: Device, _network: readonly Device[], changes: Plan, options: ApplyOptions): Promise<void>;
+/** Replace a list's entries in batches, so each command stays a sane length. */
+export declare function fill(device: Device, _network: readonly Device[], set: string, family: Family, prefixes: string[]): Promise<void>;
+export declare const routeros: DeviceAdapter;

package/dist/types/adapters/devices/routeros/models.d.ts

@@ -0,0 +1,14 @@
+export declare const models: {
+    readonly "CCR2216-1G-12XS-2XQ": {
+        readonly ports: {
+            readonly "100g": 2;
+            readonly "25g": 12;
+            readonly "1g": 1;
+        };
+        readonly spelling: {
+            readonly "100g": "qsfp28-{n}-1";
+            readonly "25g": "sfp28-{n}";
+            readonly "1g": "ether{n}";
+        };
+    };
+};

package/dist/types/adapters/devices/routeros/plan.d.ts

@@ -0,0 +1,4 @@
+import type { ApplyOptions, Plan } from "../types";
+/** A plan line the apply handles itself: upload a certificate and its key, and import them. */
+export declare const INSTALL_CERTIFICATE = "#install-certificate ";
+export declare function plan(desired: string, current: string, options: Pick<ApplyOptions, "secrets">): Plan;

package/dist/types/adapters/devices/routeros/render.d.ts

@@ -0,0 +1,96 @@
+import type { Device, Family, Interface, Port } from "../../../schema";
+/** A property value as a command takes it. `undefined` and `false` leave the property out. */
+export type Value = string | number | undefined | false;
+/** Collects commands under their menu. */
+export declare class Output {
+    private readonly menus;
+    /** Add a command to a menu. */
+    add(menu: string, command: string): void;
+    /** The whole configuration as text. */
+    text(): string;
+}
+/** Quote a value when it holds anything but plain characters. */
+export declare function quote(value: string): string;
+/**
+ * A command: a verb such as `add` or `set [ find name=x ]`, then `property=value` for every property that has a value.
+ *
+ * Properties are written in the order given.
+ */
+export declare function command(verb: string, properties: Record<string, Value>): string;
+/** `yes` or `no`. */
+export declare const yesNo: (on: boolean | undefined) => string;
+/** `V4` or `V6`, the suffix of a chain rendered for one family. */
+export declare const familySuffix: (family: Family) => string;
+/** One port or a list of ports, as `53,123`. */
+export declare function portList(ports: number | readonly number[] | undefined): string | undefined;
+/** Seconds as the platform writes a duration: `3600` becomes `1h`, `90` becomes `1m30s`. */
+export declare function duration(seconds: number): string;
+/** A rate as the switch chip takes it: `2G` becomes `2.0Gbps`. */
+export declare function bitrate(rate: string): string;
+/** An IPv4 prefix with a dotted mask, as the switch chip takes it: `10.0.0.0/8` becomes `10.0.0.0/255.0.0.0`. */
+export declare function dottedMask(cidr: string): string;
+/** A community pattern with `*` as a regular expression the platform matches on: `64500:*:*` becomes `^64500:[0-9]+:[0-9]+$`. */
+export declare function communityPattern(pattern: string): string;
+/** The bridge every switched port joins. One per device. */
+export declare const BRIDGE = "bridge";
+export type AnyPort = Port<string, string, string, string>;
+export type AnyInterface = Interface<string, string>;
+export declare class Context {
+    readonly device: Device;
+    readonly ports: Record<string, AnyPort>;
+    readonly interfaces: Record<string, AnyInterface>;
+    constructor(device: Device);
+    /** What the platform calls a port or an interface. A port is spelled by the model; an interface keeps its config name. */
+    name(portOrInterface: string): string;
+    /** The number of a VLAN, by its config name. */
+    vlanId(vlan: string): number;
+    /** Ports and LAGs that are layer 2 members of a VLAN, with their settings. A port in a LAG is represented by the LAG. */
+    switched(): [string, AnyPort | Extract<AnyInterface, {
+        type: "lag";
+    }>][];
+    /** VLAN interfaces, with their settings. */
+    vlanInterfaces(): [string, Extract<AnyInterface, {
+        type: "vlan";
+    }>][];
+    /** Every port and interface that holds addresses or other layer 3 settings. Ports are named as the platform spells them. */
+    routed(): {
+        name: string;
+        settings: AnyPort | AnyInterface;
+    }[];
+}
+export declare function renderInterfaces(out: Output, ctx: Context): void;
+type Speed = NonNullable<AnyPort["speed"]>;
+/** The platform's name for a fixed speed on a port, or undefined when it has none. */
+export declare function mediumOf(platformPortName: string, speed: Speed): string | undefined;
+/** The interface holding one VRRP group. */
+export declare const vrrpName: (iface: string, id: number) => string;
+/**
+ * Where LLDP runs, when it is limited to some ports. Undefined when it runs everywhere or nowhere, which the discovery settings say directly.
+ */
+export declare function lldpMembers(ctx: Context): string[] | undefined;
+/** Address lists holding the prefixes BGP originates. A session reads the one of its family. */
+export declare const NETWORKS: Record<Family, string>;
+export declare function renderAddressing(out: Output, ctx: Context): void;
+export declare function renderFirewall(out: Output, ctx: Context): void;
+/** The validator group every RPKI server joins. */
+export declare const RPKI_GROUP = "rpki";
+/** The chain a session without a policy uses, so that it learns or announces nothing. */
+export declare const REJECT_ALL = "REJECT-ALL";
+export declare function renderRouting(out: Output, ctx: Context): void;
+/** Neutral service name to the platform's. `native` is the platform's own desktop client. */
+export declare const SERVICES: {
+    readonly ftp: "ftp";
+    readonly ssh: "ssh";
+    readonly telnet: "telnet";
+    readonly http: "www";
+    readonly https: "www-ssl";
+    readonly api: "api";
+    readonly api_tls: "api-ssl";
+    readonly native: "winbox";
+};
+export declare function renderManagement(out: Output, ctx: Context): void;
+/** SHA-256 of the certificate's DER encoding, lowercase hex, as the platform prints it. */
+export declare function fingerprint(pem: string): string;
+export declare function renderSystem(out: Output, ctx: Context): void;
+export declare function render(device: Device): string;
+export {};