.. หัวข้อ: ACL Shadow & Conflict Detector
.. slug: acl-conflict-detector
.. วันที่: 27-02-2026 00:00:00 UTC
.. แท็ก: ระบบเครือข่าย, ACL, ไฟร์วอลล์, ความปลอดภัย, เครื่องมือ
.. หมวดหมู่:
.. ลิงค์:
.. คำอธิบาย: ACL Shadow & Conflict Detector - ระบุกฎรายการเข้าถึงที่มีเงา ซ้ำซ้อน และขัดแย้งกันทั่วทั้ง Cisco, Juniper, Aruba และ SONiC
.. ประเภท: ข้อความ
<style>
  /* === Base design system (from celsius-to-fahrenheit.html) === */
  .calc-container { max-width:1000px; margin:20px auto; padding:20px; }
  .calc-header { margin-bottom:30px; padding:25px; background:linear-gradient(135deg,#667eea 0%,#764ba2 100%); border-radius:12px; box-shadow:0 4px 6px rgba(0,0,0,0.1); color:white; }
  .calc-header h2 { margin-top:0; color:white; font-size:28px; margin-bottom:10px; }
  .calc-header p { margin:10px 0; opacity:.95; font-size:15px; }
  .input-group { display:grid; grid-template-columns:1fr 1fr; gap:15px; margin-top:20px; }
  .input-field { display:flex; flex-direction:column; }
  .input-field label { margin-bottom:8px; font-weight:bold; color:white; font-size:14px; }
  .input-field input,
  .input-field select,
  .input-field textarea { padding:14px; font-size:14px; border:2px solid rgba(255,255,255,0.3); border-radius:6px; background:rgba(255,255,255,0.95); transition:all 0.3s ease; }
  .input-field input:focus,
  .input-field select:focus,
  .input-field textarea:focus { outline:none; border-color:#4CAF50; box-shadow:0 0 0 3px rgba(76,175,80,0.1); }
  .button-group { margin-top:20px; display:flex; gap:10px; flex-wrap:wrap; }
  .submit-btn { padding:14px 35px; font-size:16px; background:#4CAF50; color:white; border:none; border-radius:6px; cursor:pointer; font-weight:bold; transition:all 0.3s ease; box-shadow:0 2px 4px rgba(0,0,0,0.2); }
  .submit-btn:hover { background:#45a049; transform:translateY(-1px); box-shadow:0 4px 8px rgba(0,0,0,0.3); }
  .submit-btn:active { background:#3d8b40; transform:translateY(0); }
  .result-section { background:white; border:1px solid #e0e0e0; border-radius:8px; margin-bottom:15px; overflow:hidden; box-shadow:0 2px 4px rgba(0,0,0,0.05); transition:all 0.3s ease; }
  .result-section:hover { box-shadow:0 4px 8px rgba(0,0,0,0.1); }
  .section-header { background:linear-gradient(135deg,#4CAF50 0%,#45a049 100%); color:white; padding:15px 20px; font-size:18px; font-weight:bold; }
  .section-content { padding:20px; background:#fafafa; }
  .data-row { display:flex; margin:12px 0; padding:10px; background:white; border-radius:4px; border-left:3px solid #4CAF50; }
  .data-label { font-weight:bold; color:#555; min-width:200px; flex-shrink:0; }
  .data-value { color:#333; font-family:'Courier New',monospace; word-break:break-word; }
  .data-value.highlight { color:#4CAF50; font-weight:bold; font-size:18px; }
  .help-text { margin-top:15px; font-size:14px; color:rgba(255,255,255,0.9); background:rgba(0,0,0,0.1); padding:10px 15px; border-radius:4px; }
  .help-text strong { color:white; }

  /* === ACL tool specific styles === */
  #annotated-acl {
    font-family: 'Courier New', monospace;
    font-size: 12px;
    line-height: 1.8;
    background: #fafafa;
    border: 1px solid #e0e0e0;
    border-radius: 4px;
    padding: 10px;
    max-height: 500px;
    overflow-y: auto;
  }

  .header-badge {
    float: right;
    font-size: 12px;
    font-weight: normal;
    opacity: 0.9;
    margin-left: 10px;
    background: rgba(255,255,255,0.2);
    padding: 2px 10px;
    border-radius: 10px;
  }

  @media (max-width: 768px) {
    .input-group { grid-template-columns: 1fr; }
    .data-row { flex-direction: column; }
    .data-label { margin-bottom: 5px; min-width: auto; }
    #annotated-acl { max-height: 350px; font-size: 11px; }
    .finding-rule-grid { grid-template-columns: 1fr !important; }
  }
  @media (max-width: 480px) {
    .calc-header h2 { font-size: 20px; }
    .submit-btn { padding: 12px 20px; font-size: 14px; }
  }
</style>
<div class="calc-container">
<div class="calc-header">
<h2>ACL เงาและตัวตรวจจับความขัดแย้ง</h2>
<p>วางกฎรายการเข้าถึงเพื่อตรวจจับกฎที่ซ่อนอยู่ (ไม่เริ่มทำงาน) กฎซ้ำซ้อน และข้อขัดแย้งที่ทับซ้อนกันทั่วทั้ง Cisco, Juniper, Aruba และ SONiC</p>
<div class="input-group">
<div class="input-field">
<label for="vendor-select">ผู้จำหน่าย/รูปแบบ</label>
<select id="vendor-select">
<option value="auto">ตรวจจับอัตโนมัติ</option>
<option value="cisco-ios">ซิสโก้ IOS / IOS-XE</option>
<option value="cisco-nxos">ซิสโก้ NX-OS</option>
<option value="juniper">Juniper JunOS (ชุดหรือหยิก)</option>
<option value="aruba-aos-cx">อารูบา AOS-CX</option>
<option value="sonic">Broadcom SONiC [จำกัด]</option>
</select>
</div>
<div class="input-field">
<label for="direction-select">ทิศทาง (ข้อมูลเท่านั้น)</label>
<select id="direction-select">
<option value="inbound">ขาเข้า</option>
<option value="outbound">ขาออก</option>
<option value="">ไม่ระบุ</option>
</select>
</div>
</div>
<div class="input-field" style="margin-top:15px;">
<label for="cli-textarea">วางกฎตัวกรอง ACL / ไฟร์วอลล์</label>
<textarea id="cli-textarea" placeholder="Paste 'show ip access-lists NAME' or 'show firewall filter NAME' output here..." rows="12" style="font-family:'Courier New',monospace;font-size:13px;resize:vertical;width:100%;box-sizing:border-box;"></textarea>
</div>
<div class="button-group">
<button class="submit-btn" onclick="analyzeACLMain()" type="button">วิเคราะห์</button>
<button class="submit-btn" onclick="loadExample()" style="background:#607d8b;" type="button">โหลดตัวอย่าง</button>
<button class="submit-btn" onclick="clearAll()" style="background:#607d8b;" type="button">ชัดเจน</button>
</div>
<div class="help-text">
<strong>ซิสโก้ IOS:</strong>แสดงรายการเข้าถึง IP NAME  |<strong>ซิสโก้ NX-OS:</strong>แสดงรายการเข้าถึง IP NAME  |<strong>จูนิเปอร์:</strong>แสดงตัวกรองไฟร์วอลล์ NAME (กำหนดรูปแบบหรือวงเล็บปีกกา)  |<strong>อารูบา:</strong>แสดงรายการเข้าถึง NAME ip</div>
</div>
<div id="results-area" style="display:none;">
ส่วนที่ 1: สรุป
<div class="result-section">
<div class="section-header">สรุปการวิเคราะห์</div>
<div class="section-content" id="summary-content"></div>
</div>
ส่วนที่ 2: ACL ที่มีคำอธิบายประกอบ
<div class="result-section">
<div class="section-header">ACL ที่มีคำอธิบายประกอบ<span class="header-badge">
<span style="display:inline-block;width:10px;height:10px;background:#e74c3c;border-radius:2px;margin-right:4px;vertical-align:middle;"></span>ไม่เคยยิง<span style="display:inline-block;width:10px;height:10px;background:#f39c12;border-radius:2px;margin:0 4px;vertical-align:middle;"></span>ซ้ำซ้อน<span style="display:inline-block;width:10px;height:10px;background:#3498db;border-radius:2px;margin:0 4px;vertical-align:middle;"></span>เงาอีก</span>
</div>
<div class="section-content" style="padding:15px;">
<div id="annotated-acl"></div>
</div>
</div>
ส่วนที่ 3: ผลการวิจัย
<div class="result-section">
<div class="section-header">รายละเอียดการค้นพบ<span class="header-badge" id="findings-badge"></span></div>
<div class="section-content">
<div id="findings-detail"></div>
</div>
</div>
</div>ผลลัพธ์สุดท้าย-พื้นที่
</div>ปิดท้ายภาชนะตะกรัน
<script>
'use strict';

/* ============================================================
   IP UTILITY FUNCTIONS
   ============================================================ */

function ipToLong(ip) {
  if (!ip) return 0;
  const parts = ip.split('.');
  return ((parseInt(parts[0], 10) << 24) | (parseInt(parts[1], 10) << 16) |
          (parseInt(parts[2], 10) << 8)  |  parseInt(parts[3], 10)) >>> 0;
}

function parseCIDR(cidr) {
  if (!cidr || cidr.toLowerCase() === 'any' || cidr === '0.0.0.0/0') {
    return { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  }
  if (cidr.toLowerCase() === 'any-ipv6') {
    return { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  }
  const parts = cidr.includes('/') ? cidr.split('/') : [cidr, '32'];
  const pLen = parseInt(parts[1]) || 32;
  const mask = pLen === 0 ? 0 : ((0xFFFFFFFF << (32 - pLen)) >>> 0);
  const start = (ipToLong(parts[0]) & mask) >>> 0;
  const end   = (start | (~mask >>> 0)) >>> 0;
  return { type: pLen === 32 ? 'host' : 'network', start, end, display: cidr };
}

function parseWildcard(ip, wildcard) {
  if (!ip) return { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  if (wildcard === '255.255.255.255') return { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  const ipL = ipToLong(ip);
  const wl  = ipToLong(wildcard);
  if (wl === 0) return { type: 'host', start: ipL, end: ipL, display: ip + ' (host)' };
  const start = (ipL & ~wl) >>> 0;
  const end   = (ipL |  wl) >>> 0;
  const prefix = wildcardBitsToPrefix(wl);
  return { type: 'network', start, end, display: ip + '/' + prefix };
}

function wildcardBitsToPrefix(wildcardLong) {
  const inv = (~wildcardLong) >>> 0;
  let prefix = 0;
  for (let bit = 31; bit >= 0; bit--) {
    if ((inv >> bit) & 1) prefix++;
    else break;
  }
  return prefix;
}

const NAMED_PORTS = {
  'ftp-data': 20, ftp: 21, ssh: 22, telnet: 23, smtp: 25, dns: 53, tftp: 69,
  http: 80, www: 80, pop3: 110, ntp: 123, snmp: 161, https: 443, bgp: 179,
  ldap: 389, smb: 445, syslog: 514, rdp: 3389, mysql: 3306, mssql: 1433
};

function resolvePort(s) {
  if (!s) return 0;
  const n = NAMED_PORTS[s.toLowerCase()];
  return n !== undefined ? n : (parseInt(s) || 0);
}

/* ============================================================
   PORT FIELD PARSER
   ============================================================ */

function parsePortField(tokens, i) {
  const op = (tokens[i] || '').toLowerCase();
  if (!['eq', 'neq', 'lt', 'gt', 'range'].includes(op)) return null;
  if (op === 'range') {
    const min = resolvePort(tokens[i + 1]);
    const max = resolvePort(tokens[i + 2]);
    return { port: { op, min, max, display: (tokens[i + 1] || '') + '-' + (tokens[i + 2] || '') }, next: i + 3 };
  }
  const p = resolvePort(tokens[i + 1]);
  const portMap = {
    eq:  { min: p,     max: p,       display: 'eq ' + (tokens[i + 1] || '') },
    neq: { min: p,     max: p,       display: 'neq ' + (tokens[i + 1] || '') },
    lt:  { min: 0,     max: p - 1,   display: 'lt ' + (tokens[i + 1] || '') },
    gt:  { min: p + 1, max: 65535,   display: 'gt ' + (tokens[i + 1] || '') },
  };
  return { port: { op, ...portMap[op] }, next: i + 2 };
}

/* ============================================================
   IP FIELD PARSER
   ============================================================ */

function parseIPField(tokens, i) {
  const ANY = { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  if (!tokens[i]) return { net: ANY, next: i };

  const tok = tokens[i].toLowerCase();

  if (tok === 'any' || tok === 'any4') return { net: ANY, next: i + 1 };

  if (tok === 'host') {
    const hostIp = tokens[i + 1] || '';
    return { net: parseCIDR(hostIp + '/32'), next: i + 2 };
  }

  // CIDR notation: "10.0.0.0/24"
  if (tokens[i].includes('/')) {
    return { net: parseCIDR(tokens[i]), next: i + 1 };
  }

  // Cisco IOS wildcard: "10.0.0.0 0.0.0.255"
  const PORT_OPS = ['eq', 'neq', 'lt', 'gt', 'range'];
  const ACTIONS  = ['permit', 'deny'];
  const next = tokens[i + 1] || '';
  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(next) &&
      !PORT_OPS.includes(next.toLowerCase()) &&
      !ACTIONS.includes(next.toLowerCase())) {
    return { net: parseWildcard(tokens[i], next), next: i + 2 };
  }

  // Plain host IP
  if (/^\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}$/.test(tokens[i])) {
    return { net: parseCIDR(tokens[i] + '/32'), next: i + 1 };
  }

  return { net: ANY, next: i };
}

/* ============================================================
   CORE RULE NORMALIZER
   ============================================================ */

function normalizeRule(seq, action, rest, rawLine) {
  const rule = {
    seq,
    action,
    proto: 'ip',
    src: null,
    srcPort: null,
    dst: null,
    dstPort: null,
    established: false,
    flags: [],
    raw: rawLine,
  };

  const tokens = rest.trim().split(/\s+/).filter(Boolean);
  let i = 0;

  // Protocol
  const PROTOS = ['ip', 'tcp', 'udp', 'icmp', 'icmp6', 'ospf', 'eigrp', 'gre', 'esp', 'ah', 'pim', 'igmp', 'sctp'];
  if (PROTOS.includes((tokens[i] || '').toLowerCase()) || /^\d+$/.test(tokens[i] || '')) {
    rule.proto = tokens[i].toLowerCase();
    i++;
  }

  // Source
  const srcR = parseIPField(tokens, i);
  rule.src = srcR.net;
  i = srcR.next;

  // Source port (tcp/udp/sctp only)
  if (['tcp', 'udp', 'sctp'].includes(rule.proto)) {
    const spR = parsePortField(tokens, i);
    if (spR) { rule.srcPort = spR.port; i = spR.next; }
  }

  // Destination
  const dstR = parseIPField(tokens, i);
  rule.dst = dstR.net;
  i = dstR.next;

  // Destination port
  if (['tcp', 'udp', 'sctp'].includes(rule.proto)) {
    const dpR = parsePortField(tokens, i);
    if (dpR) { rule.dstPort = dpR.port; i = dpR.next; }
  }

  // Flags
  while (i < tokens.length) {
    const f = tokens[i].toLowerCase();
    if (f === 'established') rule.established = true;
    rule.flags.push(f);
    i++;
  }

  rule.src = rule.src || { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };
  rule.dst = rule.dst || { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' };

  return rule;
}

/* ============================================================
   CISCO IOS ACL PARSER
   ============================================================ */

function parseCiscoIOSACL(raw) {
  const rules = [];
  let autoSeq = 10;
  let aclName = 'ACL';
  let isStandard = false;

  const namedM = raw.match(/ip access-list\s+(extended|standard)\s+(\S+)/i);
  if (namedM) {
    isStandard = namedM[1].toLowerCase() === 'standard';
    aclName = namedM[2];
  }
  const numberedM = raw.match(/access-list\s+(\d+)/i);
  if (numberedM && !namedM) {
    aclName = numberedM[1];
    isStandard = parseInt(numberedM[1]) <= 99;
  }

  for (const rawLine of raw.split('\n')) {
    const line = rawLine.trim();
    if (!line || line.startsWith('!') || line.startsWith('remark') || line.startsWith('ip access-list')) continue;

    // Strip "access-list NNN " prefix for numbered ACLs
    let workLine = line.replace(/^access-list\s+\d+\s+/, '');

    // Optional sequence number at start of named ACL entry
    let seqNum = autoSeq;
    const seqM = workLine.match(/^(\d+)\s+(permit|deny)/i);
    if (seqM) {
      seqNum = parseInt(seqM[1]);
      workLine = workLine.slice(seqM[1].length).trim();
    }

    const actionM = workLine.match(/^(permit|deny)\s+(.*)/i);
    if (!actionM) continue;

    const action = actionM[1].toLowerCase();
    const rest = actionM[2].trim();

    if (isStandard) {
      const tokens = rest.split(/\s+/);
      const srcR = parseIPField(tokens, 0);
      rules.push({
        seq: seqNum,
        action,
        proto: 'ip',
        src: srcR.net,
        srcPort: null,
        dst: { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' },
        dstPort: null,
        established: false,
        flags: [],
        raw: line,
      });
    } else {
      rules.push(normalizeRule(seqNum, action, rest, line));
    }

    autoSeq = seqNum + 10;
  }

  return { name: aclName, vendor: 'cisco-ios', rules };
}

/* ============================================================
   CISCO NX-OS ACL PARSER
   ============================================================ */

function parseCiscoNXOSACL(raw) {
  // NX-OS uses CIDR; parseCiscoIOSACL handles CIDR via includes('/') branch
  const result = parseCiscoIOSACL(raw);
  result.vendor = 'cisco-nxos';
  return result;
}

/* ============================================================
   JUNIPER PORT HELPER
   ============================================================ */

function parseJuniperPort(portStr) {
  if (!portStr) return null;
  if (portStr.includes('-')) {
    const [a, b] = portStr.split('-');
    return { op: 'range', min: resolvePort(a), max: resolvePort(b), display: portStr };
  }
  const p = resolvePort(portStr);
  return { op: 'eq', min: p, max: p, display: portStr };
}

/* ============================================================
   JUNIPER SET FORMAT PARSER
   ============================================================ */

function parseJuniperSetFormat(raw) {
  const filterM = raw.match(/set firewall family inet filter (\S+)/i);
  const filterName = filterM ? filterM[1] : 'FILTER';

  const terms = {};
  const termOrder = [];

  const setRe = /^set firewall family inet filter \S+ term (\S+) (from|then) (.+)$/igm;
  let m;
  while ((m = setRe.exec(raw)) !== null) {
    const termName = m[1];
    const clause   = m[2];
    const value    = m[3];

    if (!terms[termName]) {
      terms[termName] = { from: {}, then: {} };
      termOrder.push(termName);
    }

    if (clause.toLowerCase() === 'from') {
      const srcAddrM = value.match(/source-address\s+(\S+)/i);
      const dstAddrM = value.match(/destination-address\s+(\S+)/i);
      const protoM   = value.match(/protocol\s+(\S+)/i);
      const dstPortM = value.match(/destination-port\s+(\S+)/i);
      const srcPortM = value.match(/source-port\s+(\S+)/i);
      if (srcAddrM) terms[termName].from.srcAddr = srcAddrM[1];
      if (dstAddrM) terms[termName].from.dstAddr = dstAddrM[1];
      if (protoM)   terms[termName].from.proto   = protoM[1].toLowerCase();
      if (dstPortM) terms[termName].from.dstPort = dstPortM[1];
      if (srcPortM) terms[termName].from.srcPort = srcPortM[1];
    } else {
      const actM = value.match(/^(accept|reject|discard|next\s+term)/i);
      if (actM) {
        const actWord = actM[1].toLowerCase();
        terms[termName].then.action =
          actWord === 'accept' ? 'permit' :
          actWord.startsWith('next') ? 'next' : 'deny';
      }
    }
  }

  let seq = 10;
  const rules = termOrder
    .filter(t => terms[t].then.action && terms[t].then.action !== 'next')
    .map(termName => {
      const term = terms[termName];
      const rule = {
        seq,
        termName,
        action: term.then.action || 'deny',
        proto: term.from.proto || 'ip',
        src: term.from.srcAddr
          ? parseCIDR(term.from.srcAddr)
          : { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' },
        dst: term.from.dstAddr
          ? parseCIDR(term.from.dstAddr)
          : { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' },
        srcPort: term.from.srcPort ? parseJuniperPort(term.from.srcPort) : null,
        dstPort: term.from.dstPort ? parseJuniperPort(term.from.dstPort) : null,
        established: false,
        flags: [],
        raw: 'term ' + termName + ': ' +
             (term.from.proto || 'ip') + ' ' +
             (term.from.srcAddr || 'any') + ' -> ' +
             (term.from.dstAddr || 'any') +
             (term.from.dstPort ? ':' + term.from.dstPort : '') +
             ' ' + (term.then.action || 'deny'),
      };
      seq += 10;
      return rule;
    });

  return { name: filterName, vendor: 'juniper', rules };
}

/* ============================================================
   JUNIPER CURLY FORMAT PARSER
   ============================================================ */

function parseJuniperCurlyFormat(raw) {
  const filterM = raw.match(/filter\s+(\S+)\s*\{/i);
  const filterName = filterM ? filterM[1] : 'FILTER';

  const rules = [];
  let seq = 10;

  const termRe = /term\s+(\S+)\s*\{([\s\S]*?)^\s*\}/gm;
  let termMatch;
  while ((termMatch = termRe.exec(raw)) !== null) {
    const termName = termMatch[1];
    const termBody = termMatch[2];

    const fromM = termBody.match(/from\s*\{([\s\S]*?)\}/);
    const thenM = termBody.match(/then\s*\{([\s\S]*?)\}/);

    const fromBody = fromM ? fromM[1] : '';
    const thenBody = thenM ? thenM[1] : '';

    const actionM = thenBody.match(/(accept|reject|discard)/i);
    if (!actionM) continue;
    const action = actionM[1].toLowerCase() === 'accept' ? 'permit' : 'deny';

    const srcAddrM = fromBody.match(/source-address\s*\{[\s\S]*?([\d.\/]+)/i);
    const dstAddrM = fromBody.match(/destination-address\s*\{[\s\S]*?([\d.\/]+)/i);
    const protoM   = fromBody.match(/protocol\s+(\S+);/i);
    const dstPortM = fromBody.match(/destination-port\s+(\S+);/i);
    const srcPortM = fromBody.match(/source-port\s+(\S+);/i);

    rules.push({
      seq,
      termName,
      action,
      proto: protoM ? protoM[1].toLowerCase() : 'ip',
      src: srcAddrM
        ? parseCIDR(srcAddrM[1])
        : { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' },
      dst: dstAddrM
        ? parseCIDR(dstAddrM[1])
        : { type: 'any', start: 0, end: 0xFFFFFFFF, display: 'any' },
      srcPort: srcPortM ? parseJuniperPort(srcPortM[1]) : null,
      dstPort: dstPortM ? parseJuniperPort(dstPortM[1]) : null,
      established: false,
      flags: [],
      raw: 'term ' + termName + ': ' + action,
    });
    seq += 10;
  }

  return { name: filterName, vendor: 'juniper', rules };
}

function parseJuniperACL(raw) {
  if (/^set firewall/m.test(raw)) return parseJuniperSetFormat(raw);
  if (/term\s+\S+\s*\{/m.test(raw)) return parseJuniperCurlyFormat(raw);
  return parseJuniperSetFormat(raw);
}

/* ============================================================
   ARUBA AOS-CX PARSER
   ============================================================ */

function parseArubaACL(raw) {
  const result = parseCiscoIOSACL(raw);
  result.vendor = 'aruba-aos-cx';
  return result;
}

/* ============================================================
   SONIC PARSER (LIMITED)
   ============================================================ */

function parseSonicACL(raw) {
  const result = parseCiscoIOSACL(raw);
  result.vendor = 'sonic';
  result.restraintNote = 'SONiC ACL format has limited verification. Results may be incomplete. Verify against a live device.';
  return result;
}

/* ============================================================
   VENDOR AUTO-DETECT & DISPATCH
   ============================================================ */

function detectACLVendor(raw) {
  if (/^set firewall family inet/m.test(raw)) return 'juniper';
  if (/^filter\s+\S+\s*\{/m.test(raw) || /^\s*term\s+\S+\s*\{/m.test(raw)) return 'juniper';
  if (/ip access-list\s+(extended|standard)/i.test(raw) || /^access-list\s+\d+/m.test(raw)) return 'cisco-ios';
  if (/^\s*\d+\s+(permit|deny)\s+\S+.*\/\d+/m.test(raw)) return 'cisco-nxos';
  return 'cisco-ios';
}

function parseACL(vendor, raw) {
  const detected = vendor === 'auto' ? detectACLVendor(raw) : vendor;
  let acl;
  switch (detected) {
    case 'juniper':      acl = parseJuniperACL(raw);    break;
    case 'cisco-nxos':   acl = parseCiscoNXOSACL(raw);  break;
    case 'aruba-aos-cx': acl = parseArubaACL(raw);      break;
    case 'sonic':        acl = parseSonicACL(raw);      break;
    default:             acl = parseCiscoIOSACL(raw);   break;
  }
  acl.detectedVendor = detected;
  return acl;
}

/* ============================================================
   SHADOW DETECTION ALGORITHM
   ============================================================ */

function protoContains(protoA, protoB) {
  if (protoA === 'ip') return true;
  if (protoB === 'ip') return false;
  return protoA === protoB;
}

function networkContains(netA, netB) {
  if (!netA || netA.type === 'any') return true;
  if (!netB || netB.type === 'any') return false;
  return netA.start <= netB.start && netA.end >= netB.end;
}

function portContains(portA, portB) {
  if (!portA) return true;
  if (!portB) return false;
  if (portA.op === 'neq' || portB.op === 'neq') return false;
  return portA.min <= portB.min && portA.max >= portB.max;
}

function buildShadowExplanation(ruleA, ruleB) {
  const reasons = [];
  if (ruleA.proto === 'ip') {
    reasons.push('Protocol: Rule ' + ruleA.seq + ' matches ALL protocols (ip), covers rule ' + ruleB.seq + '\'s ' + ruleB.proto);
  } else {
    reasons.push('Protocol: both are ' + ruleA.proto);
  }
  if (!ruleA.src || ruleA.src.type === 'any') {
    reasons.push('Source: Rule ' + ruleA.seq + ' matches any source');
  } else {
    reasons.push('Source: ' + ruleA.src.display + ' contains ' + (ruleB.src ? ruleB.src.display : 'any'));
  }
  if (!ruleA.dst || ruleA.dst.type === 'any') {
    reasons.push('Destination: Rule ' + ruleA.seq + ' matches any destination');
  } else {
    reasons.push('Destination: ' + ruleA.dst.display + ' contains ' + (ruleB.dst ? ruleB.dst.display : 'any'));
  }
  if (!ruleA.dstPort) {
    reasons.push('Destination port: Rule ' + ruleA.seq + ' matches any port');
  } else if (ruleA.dstPort && ruleB.dstPort) {
    reasons.push('Destination port: [' + ruleA.dstPort.min + '-' + ruleA.dstPort.max + '] contains [' + ruleB.dstPort.min + '-' + ruleB.dstPort.max + ']');
  }
  return reasons;
}

function checkShadow(ruleA, ruleB) {
  if (!protoContains(ruleA.proto, ruleB.proto)) return { shadows: false };
  if (!networkContains(ruleA.src, ruleB.src))   return { shadows: false };
  if (!networkContains(ruleA.dst, ruleB.dst))   return { shadows: false };
  if (!portContains(ruleA.srcPort, ruleB.srcPort)) return { shadows: false };
  if (!portContains(ruleA.dstPort, ruleB.dstPort)) return { shadows: false };

  const isSameAction = ruleA.action === ruleB.action;
  return {
    shadows: true,
    type: isSameAction ? 'redundant' : 'contradictory',
    severity: isSameAction ? 'warning' : 'error',
    explanation: buildShadowExplanation(ruleA, ruleB),
    fix: isSameAction
      ? 'Rule ' + ruleB.seq + ' is redundant. Remove it to clean up the ACL.'
      : 'Rule ' + ruleB.seq + ' (' + ruleB.action + ') can never fire because rule ' + ruleA.seq +
        ' (' + ruleA.action + ') matches all its traffic first. Move rule ' + ruleB.seq +
        ' BEFORE rule ' + ruleA.seq + ', or make rule ' + ruleA.seq + ' more specific.',
  };
}

/* ============================================================
   OVERLAP DETECTION
   ============================================================ */

function networkOverlap(netA, netB) {
  if (!netA || netA.type === 'any') return true;
  if (!netB || netB.type === 'any') return true;
  return netA.start <= netB.end && netB.start <= netA.end;
}

function portOverlap(portA, portB) {
  if (!portA || !portB) return true;
  if (portA.op === 'neq' || portB.op === 'neq') return true;
  return portA.min <= portB.max && portB.min <= portA.max;
}

function rulesOverlap(rA, rB) {
  if (rA.proto !== 'ip' && rB.proto !== 'ip' && rA.proto !== rB.proto) return false;
  if (!networkOverlap(rA.src, rB.src)) return false;
  if (!networkOverlap(rA.dst, rB.dst)) return false;
  if (!portOverlap(rA.dstPort, rB.dstPort)) return false;
  return true;
}

/* ============================================================
   FULL ACL ANALYSIS
   ============================================================ */

function analyzeACL(acl) {
  const findings = [];
  const shadowedSeqs = new Set();
  const rules = acl.rules;

  // O(n^2) shadow check
  for (let j = 1; j < rules.length; j++) {
    if (shadowedSeqs.has(rules[j].seq)) continue;
    for (let i = 0; i < j; i++) {
      const check = checkShadow(rules[i], rules[j]);
      if (check.shadows) {
        shadowedSeqs.add(rules[j].seq);
        findings.push({
          type: check.type,
          severity: check.severity,
          shadowingRule: rules[i],
          shadowedRule:  rules[j],
          explanation: check.explanation,
          fix: check.fix,
        });
        break; // report only the first (earliest) shadowing rule
      }
    }
  }

  // Overlap conflicts: partial overlaps with different actions, neither is a full shadow
  for (let i = 0; i < rules.length; i++) {
    for (let j = i + 1; j < rules.length; j++) {
      if (shadowedSeqs.has(rules[i].seq) || shadowedSeqs.has(rules[j].seq)) continue;
      if (!rulesOverlap(rules[i], rules[j])) continue;
      if (checkShadow(rules[i], rules[j]).shadows) continue;
      if (checkShadow(rules[j], rules[i]).shadows) continue;
      if (rules[i].action === rules[j].action) continue;
      findings.push({
        type: 'overlap',
        severity: 'info',
        rule1: rules[i],
        rule2: rules[j],
        explanation: [
          'Rules ' + rules[i].seq + ' and ' + rules[j].seq +
          ' match overlapping traffic with different actions (' +
          rules[i].action + ' vs ' + rules[j].action + ').',
          'Rule ' + rules[i].seq + ' appears first and wins for the overlapping portion.',
        ],
        fix: 'Review whether rule ' + rules[i].seq + ' or ' + rules[j].seq +
             ' should take precedence for the overlapping traffic. If intentional, this is fine.',
      });
    }
  }

  // Check for implicit deny not documented
  const lastRule = rules[rules.length - 1];
  const hasExplicitDenyAny = lastRule &&
    lastRule.action === 'deny' &&
    lastRule.src && lastRule.src.type === 'any' &&
    lastRule.dst && lastRule.dst.type === 'any' &&
    lastRule.proto === 'ip';
  if (!hasExplicitDenyAny && rules.length > 0) {
    findings.push({
      type: 'implicit-deny',
      severity: 'info',
      explanation: ['No explicit "deny ip any any" at the end of the ACL.'],
      fix: 'An implicit deny-all exists but adding an explicit deny at the end enables logging of denied traffic: "deny ip any any log"',
    });
  }

  return { findings, shadowedSeqs };
}

/* ============================================================
   HTML ESCAPE UTILITY
   ============================================================ */

function escHtml(s) {
  if (s === null || s === undefined) return '';
  return String(s)
    .replace(/&/g, '&amp;')
    .replace(/</g, '&lt;')
    .replace(/>/g, '&gt;')
    .replace(/"/g, '&quot;');
}

/* ============================================================
   RENDER: SUMMARY
   ============================================================ */

function renderSummary(acl, findings, shadowedSeqs) {
  const contradictory = findings.filter(f => f.type === 'contradictory').length;
  const redundant     = findings.filter(f => f.type === 'redundant').length;
  const overlaps      = findings.filter(f => f.type === 'overlap').length;

  document.getElementById('summary-content').innerHTML =
    '<div class="data-row" style="border-left-color:#e74c3c;">' +
      '<div class="data-label">\u2717 Contradictory Shadows</div>' +
      '<div class="data-value" style="color:#e74c3c;font-weight:bold;font-size:18px;">' + contradictory + '</div>' +
    '</div>' +
    '<div class="data-row" style="border-left-color:#f39c12;">' +
      '<div class="data-label">\u26a0 Redundant Shadows</div>' +
      '<div class="data-value" style="color:#f39c12;font-weight:bold;font-size:18px;">' + redundant + '</div>' +
    '</div>' +
    '<div class="data-row" style="border-left-color:#3498db;">' +
      '<div class="data-label">\u2139 Overlap Conflicts</div>' +
      '<div class="data-value" style="color:#3498db;font-weight:bold;font-size:18px;">' + overlaps + '</div>' +
    '</div>' +
    '<div class="data-row" style="border-left-color:#2ecc71;">' +
      '<div class="data-label">\u2713 Rules Analyzed</div>' +
      '<div class="data-value" style="color:#2ecc71;font-weight:bold;font-size:18px;">' + acl.rules.length + '</div>' +
    '</div>' +
    (acl.detectedVendor
      ? '<div class="data-row"><div class="data-label">Detected Vendor</div><div class="data-value highlight">' + escHtml(acl.detectedVendor) + '</div></div>'
      : '') +
    (acl.restraintNote
      ? '<div style="background:#fff3cd;border:1px solid #f39c12;border-radius:4px;padding:10px;margin-top:10px;font-size:13px;color:#856404;">\u26a0 ' + escHtml(acl.restraintNote) + '</div>'
      : '');
}

/* ============================================================
   RENDER: ANNOTATED ACL
   ============================================================ */

function renderAnnotatedACL(acl, findings, shadowedSeqs) {
  const container = document.getElementById('annotated-acl');

  // Build annotation map: seq -> { asShadowed, asShadowing[] }
  const ruleAnnotations = {};
  findings.forEach(f => {
    if (f.shadowedRule) {
      const s = f.shadowedRule.seq;
      if (!ruleAnnotations[s]) ruleAnnotations[s] = { asShadowed: null, asShadowing: [] };
      ruleAnnotations[s].asShadowed = f;
    }
    if (f.shadowingRule) {
      const s = f.shadowingRule.seq;
      if (!ruleAnnotations[s]) ruleAnnotations[s] = { asShadowed: null, asShadowing: [] };
      ruleAnnotations[s].asShadowing.push(f);
    }
  });

  const ACTION_COLORS = { permit: '#2e7d32', deny: '#c62828' };

  if (acl.rules.length === 0) {
    container.innerHTML = '<div style="text-align:center;padding:20px;color:#888;">No rules were parsed. Check the vendor selection and input format.</div>';
    return;
  }

  container.innerHTML = acl.rules.map(function(rule) {
    const ann = ruleAnnotations[rule.seq] || { asShadowed: null, asShadowing: [] };
    const isShadowedContradictory = ann.asShadowed && ann.asShadowed.type === 'contradictory';
    const isShadowedRedundant     = ann.asShadowed && ann.asShadowed.type === 'redundant';
    const isShadowing             = ann.asShadowing.length > 0;

    let rowBg     = '#fff';
    let rowBorder = 'border-left: 3px solid transparent;';
    let rowTitle  = '';

    if (isShadowedContradictory) {
      rowBg     = '#ffebee';
      rowBorder = 'border-left: 4px solid #e74c3c;';
      rowTitle  = 'title="NEVER FIRES - shadowed by rule ' + ann.asShadowed.shadowingRule.seq + '"';
    } else if (isShadowedRedundant) {
      rowBg     = '#fffde7';
      rowBorder = 'border-left: 4px solid #f39c12;';
      rowTitle  = 'title="REDUNDANT - shadowed by rule ' + ann.asShadowed.shadowingRule.seq + '"';
    } else if (isShadowing) {
      rowBorder = 'border-left: 4px solid #3498db;';
    }

    const actionColor = ACTION_COLORS[rule.action] || '#607d8b';
    const actionBadge =
      '<span style="display:inline-block;min-width:52px;text-align:center;padding:2px 8px;' +
      'border-radius:3px;font-size:11px;font-weight:bold;color:white;background:' + actionColor + ';">' +
      rule.action.toUpperCase() + '</span>';

    let annotations = '';
    if (isShadowedContradictory) {
      annotations =
        '<span style="float:right;background:#e74c3c;color:white;font-size:11px;padding:2px 8px;' +
        'border-radius:3px;font-weight:bold;">\u2717 NEVER FIRES \u2014 shadowed by #' +
        ann.asShadowed.shadowingRule.seq + '</span>';
    } else if (isShadowedRedundant) {
      annotations =
        '<span style="float:right;background:#f39c12;color:white;font-size:11px;padding:2px 8px;' +
        'border-radius:3px;font-weight:bold;">\u26a0 REDUNDANT \u2014 shadowed by #' +
        ann.asShadowed.shadowingRule.seq + '</span>';
    } else if (isShadowing) {
      const targets = ann.asShadowing.map(function(f) { return f.shadowedRule ? f.shadowedRule.seq : null; }).filter(Boolean);
      annotations =
        '<span style="float:right;background:#3498db;color:white;font-size:11px;padding:2px 8px;' +
        'border-radius:3px;">\u2193 shadows #' + targets.join(', #') + '</span>';
    }

    const seqLabel = rule.termName
      ? '<span style="color:#888;font-size:11px;min-width:70px;display:inline-block;">' + escHtml(rule.termName) + '</span>'
      : '<span style="color:#888;font-size:11px;min-width:40px;display:inline-block;text-align:right;">' + rule.seq + '</span>';

    return '<div style="padding:8px 12px;margin:2px 0;border-radius:4px;background:' + rowBg + ';' + rowBorder +
           'font-family:\'Courier New\',monospace;font-size:12px;line-height:1.6;" ' + rowTitle + '>' +
           seqLabel + '&nbsp;&nbsp;' + actionBadge + '&nbsp;&nbsp;' +
           '<span style="color:#333;">' + escHtml(rule.raw) + '</span>' +
           annotations +
           '</div>';
  }).join('');
}

/* ============================================================
   RENDER: FINDINGS DETAIL
   ============================================================ */

function renderFindings(findings) {
  const container = document.getElementById('findings-detail');
  const badge = document.getElementById('findings-badge');

  const errCount  = findings.filter(f => f.severity === 'error').length;
  const warnCount = findings.filter(f => f.severity === 'warning').length;
  const infoCount = findings.filter(f => f.severity === 'info').length;

  if (badge) {
    badge.textContent = [
      errCount  > 0 ? errCount  + ' error'   + (errCount  > 1 ? 's' : '') : '',
      warnCount > 0 ? warnCount + ' warning' + (warnCount > 1 ? 's' : '') : '',
      infoCount > 0 ? infoCount + ' info' : '',
    ].filter(Boolean).join(', ') || 'Clean';
  }

  if (findings.length === 0) {
    container.innerHTML = '<div style="color:#2ecc71;font-weight:bold;padding:15px 0;font-size:15px;">\u2713 No findings \u2014 ACL looks clean!</div>';
    return;
  }

  const SEVERITY_CONFIG = {
    error:   { icon: '\u2717', color: '#e74c3c', bg: '#ffebee', label: 'CONTRADICTORY SHADOW' },
    warning: { icon: '\u26a0', color: '#f39c12', bg: '#fffde7', label: 'REDUNDANT SHADOW' },
    info:    { icon: '\u2139', color: '#3498db', bg: '#e3f2fd', label: 'INFO' },
  };

  const TYPE_LABELS = {
    'contradictory':  'CONTRADICTORY SHADOW \u2014 Rule Never Fires',
    'redundant':      'REDUNDANT SHADOW \u2014 Dead Weight',
    'overlap':        'OVERLAP CONFLICT',
    'implicit-deny':  'NO EXPLICIT DENY',
  };

  container.innerHTML = findings.map(function(f, idx) {
    const cfg = SEVERITY_CONFIG[f.severity] || SEVERITY_CONFIG.info;
    const typeLabel = TYPE_LABELS[f.type] || f.type.toUpperCase();

    let ruleBoxes = '';
    if (f.shadowingRule && f.shadowedRule) {
      ruleBoxes =
        '<div style="margin:8px 0;display:grid;grid-template-columns:1fr 1fr;gap:8px;" class="finding-rule-grid">' +
          '<div style="background:#f5f5f5;border:1px solid #ddd;border-radius:4px;padding:8px;">' +
            '<div style="font-size:10px;font-weight:bold;color:#555;margin-bottom:4px;">SHADOWING RULE #' + f.shadowingRule.seq + '</div>' +
            '<code style="font-size:11px;color:#333;">' + escHtml(f.shadowingRule.raw) + '</code>' +
          '</div>' +
          '<div style="background:' + cfg.bg + ';border:1px solid ' + cfg.color + ';border-radius:4px;padding:8px;">' +
            '<div style="font-size:10px;font-weight:bold;color:' + cfg.color + ';margin-bottom:4px;">SHADOWED RULE #' + f.shadowedRule.seq + '</div>' +
            '<code style="font-size:11px;color:#333;">' + escHtml(f.shadowedRule.raw) + '</code>' +
          '</div>' +
        '</div>';
    } else if (f.rule1 && f.rule2) {
      ruleBoxes =
        '<div style="margin:8px 0;display:grid;grid-template-columns:1fr 1fr;gap:8px;" class="finding-rule-grid">' +
          '<div style="background:#f5f5f5;border:1px solid #ddd;border-radius:4px;padding:8px;">' +
            '<div style="font-size:10px;font-weight:bold;color:#555;margin-bottom:4px;">RULE #' + f.rule1.seq + '</div>' +
            '<code style="font-size:11px;">' + escHtml(f.rule1.raw) + '</code>' +
          '</div>' +
          '<div style="background:#f5f5f5;border:1px solid #ddd;border-radius:4px;padding:8px;">' +
            '<div style="font-size:10px;font-weight:bold;color:#555;margin-bottom:4px;">RULE #' + f.rule2.seq + '</div>' +
            '<code style="font-size:11px;">' + escHtml(f.rule2.raw) + '</code>' +
          '</div>' +
        '</div>';
    }

    const explanationLines = Array.isArray(f.explanation) ? f.explanation : [f.explanation || ''];

    return '<div style="background:white;border:1px solid #e0e0e0;border-radius:8px;margin:10px 0;overflow:hidden;box-shadow:0 1px 3px rgba(0,0,0,0.07);">' +
      '<div style="background:' + cfg.bg + ';border-bottom:2px solid ' + cfg.color + ';padding:10px 15px;display:flex;align-items:center;gap:10px;">' +
        '<span style="color:' + cfg.color + ';font-size:20px;font-weight:bold;flex-shrink:0;">' + cfg.icon + '</span>' +
        '<div>' +
          '<span style="background:' + cfg.color + ';color:white;font-size:11px;font-weight:bold;padding:2px 8px;border-radius:3px;">' + escHtml(typeLabel) + '</span>' +
          '<span style="font-size:12px;color:#555;margin-left:8px;">Finding #' + (idx + 1) + '</span>' +
        '</div>' +
      '</div>' +
      '<div style="padding:12px 15px;">' +
        ruleBoxes +
        '<div style="margin:8px 0;">' +
          explanationLines.map(function(e) {
            return '<div style="font-size:13px;color:#444;padding:2px 0;">\u2022 ' + escHtml(e) + '</div>';
          }).join('') +
        '</div>' +
        (f.fix
          ? '<div style="background:#e8f5e9;border:1px solid #a5d6a7;border-radius:4px;padding:8px 12px;margin-top:8px;font-size:12px;color:#2e7d32;"><strong>Fix:</strong> ' + escHtml(f.fix) + '</div>'
          : '') +
      '</div>' +
    '</div>';
  }).join('');
}

/* ============================================================
   EXAMPLE DATA
   ============================================================ */

const EXAMPLES = {
  'cisco-ios':
`ip access-list extended WAN_INBOUND
 10 permit tcp 10.0.0.0 0.0.0.255 any eq 80
 20 permit tcp 10.0.0.0 0.0.0.255 any eq 443
 30 deny   ip  10.0.0.1 0.0.0.0 any
 40 permit tcp 10.0.0.0 0.0.0.255 any eq 443
 50 permit ip  192.168.0.0 0.0.255.255 any
 60 deny   ip  192.168.1.100 0.0.0.0 any
 70 deny   ip  any any log`,

  'cisco-nxos':
`ip access-list WAN_INBOUND
  10 permit tcp 10.0.0.0/24 any eq 80
  20 permit tcp 10.0.0.0/24 any eq 443
  30 deny ip 10.0.0.1/32 any
  40 permit tcp 10.0.0.0/24 any eq 443
  50 permit ip 192.168.0.0/16 any
  60 deny ip 192.168.1.100/32 any
  70 deny ip any any log`,

  'juniper':
`set firewall family inet filter WAN_INBOUND term ALLOW_HTTP from source-address 10.0.0.0/24
set firewall family inet filter WAN_INBOUND term ALLOW_HTTP from protocol tcp
set firewall family inet filter WAN_INBOUND term ALLOW_HTTP from destination-port 80
set firewall family inet filter WAN_INBOUND term ALLOW_HTTP then accept
set firewall family inet filter WAN_INBOUND term ALLOW_HTTPS from source-address 10.0.0.0/24
set firewall family inet filter WAN_INBOUND term ALLOW_HTTPS from protocol tcp
set firewall family inet filter WAN_INBOUND term ALLOW_HTTPS from destination-port 443
set firewall family inet filter WAN_INBOUND term ALLOW_HTTPS then accept
set firewall family inet filter WAN_INBOUND term BLOCK_HOST from source-address 10.0.0.1/32
set firewall family inet filter WAN_INBOUND term BLOCK_HOST then reject
set firewall family inet filter WAN_INBOUND term ALLOW_CORP from source-address 192.168.0.0/16
set firewall family inet filter WAN_INBOUND term ALLOW_CORP then accept
set firewall family inet filter WAN_INBOUND term BLOCK_SPECIFIC from source-address 192.168.1.100/32
set firewall family inet filter WAN_INBOUND term BLOCK_SPECIFIC then reject
set firewall family inet filter WAN_INBOUND term DEFAULT then reject`,

  'aruba-aos-cx':
`ip access-list WAN_INBOUND
    10 permit tcp 10.0.0.0/24 any eq 80
    20 permit tcp 10.0.0.0/24 any eq 443
    30 deny ip 10.0.0.1/32 any
    40 permit tcp 10.0.0.0/24 any eq 443
    50 permit ip 192.168.0.0/16 any
    60 deny ip 192.168.1.100/32 any
    70 deny ip any any log`,

  'sonic':
`ip access-list WAN_INBOUND
  10 permit tcp 10.0.0.0/24 any eq 80
  20 permit tcp 10.0.0.0/24 any eq 443
  30 deny ip 10.0.0.1/32 any
  40 permit tcp 10.0.0.0/24 any eq 443
  50 permit ip 192.168.0.0/16 any
  60 deny ip 192.168.1.100/32 any
  70 deny ip any any log`,
};

/* ============================================================
   MAIN CONTROLLER FUNCTIONS
   ============================================================ */

let currentACL = null;
let currentFindings = [];
let currentShadowedSeqs = new Set();

function analyzeACLMain() {
  const vendor = document.getElementById('vendor-select').value;
  const raw    = document.getElementById('cli-textarea').value.trim();

  if (!raw) {
    alert('Please paste ACL rules first.');
    return;
  }

  try {
    currentACL = parseACL(vendor, raw);
  } catch (e) {
    alert('Parse error: ' + e.message);
    return;
  }

  if (currentACL.rules.length === 0) {
    document.getElementById('results-area').style.display = 'block';
    document.getElementById('summary-content').innerHTML =
      '<div style="color:#e74c3c;padding:10px;">No rules could be parsed. Verify the vendor selection matches your CLI output format.</div>';
    document.getElementById('annotated-acl').innerHTML = '';
    document.getElementById('findings-detail').innerHTML = '';
    return;
  }

  const result = analyzeACL(currentACL);
  currentFindings    = result.findings;
  currentShadowedSeqs = result.shadowedSeqs;

  document.getElementById('results-area').style.display = 'block';
  document.getElementById('results-area').scrollIntoView({ behavior: 'smooth', block: 'start' });

  renderSummary(currentACL, currentFindings, currentShadowedSeqs);
  renderAnnotatedACL(currentACL, currentFindings, currentShadowedSeqs);
  renderFindings(currentFindings);
}

function loadExample() {
  const vendor = document.getElementById('vendor-select').value;
  const key = (vendor === 'auto') ? 'cisco-ios' : (vendor in EXAMPLES ? vendor : 'cisco-ios');
  document.getElementById('cli-textarea').value = EXAMPLES[key];
}

function clearAll() {
  document.getElementById('cli-textarea').value = '';
  document.getElementById('results-area').style.display = 'none';
  currentACL = null;
  currentFindings = [];
  currentShadowedSeqs = new Set();
}

/* ============================================================
   KEYBOARD SHORTCUT & VENDOR CHANGE HANDLER
   ============================================================ */

document.addEventListener('keydown', function(e) {
  if ((e.ctrlKey || e.metaKey) && e.key === 'Enter') analyzeACLMain();
});

document.getElementById('vendor-select').addEventListener('change', function() {
  const currentVal = document.getElementById('cli-textarea').value.trim();
  const isExample = Object.values(EXAMPLES).some(function(ex) { return currentVal === ex.trim(); });
  if (isExample) loadExample();
});
</script>