@alchemy-unifi/network 0.0.1 → 0.1.0

package/dist/index.d.mts

@@ -0,0 +1,929 @@
+import * as Schema from "effect/Schema";
+import * as Sdk from "@alchemy-unifi/network-sdk";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Redacted from "effect/Redacted";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import "effect/Scope";
+import * as Provider from "alchemy/Provider";
+import { Resource } from "alchemy/Resource";
+import * as Deferred from "effect/Deferred";
+import { UserFacingError } from "alchemy/UserFacingError";
+import { State, StateStoreError } from "alchemy/State/State";
+export declare const UNIFI_NETWORK_AUTH_PROVIDER_NAME = "UnifiNetwork";
+/** Values stored in a profile for the `UnifiNetwork` auth provider. */
+export declare const UnifiNetworkAuthConfigSchema: Schema.Union<readonly [Schema.Struct<{
+  readonly method: Schema.Literal<"local">;
+  readonly url: Schema.String;
+  readonly apiKey: Schema.String;
+  readonly certFingerprint: Schema.optional<Schema.String>;
+  readonly insecure: Schema.optional<Schema.Boolean>;
+  readonly site: Schema.optional<Schema.String>;
+}>, Schema.Struct<{
+  readonly method: Schema.Literal<"remote">;
+  readonly consoleId: Schema.String;
+  readonly apiKey: Schema.String;
+  readonly site: Schema.optional<Schema.String>;
+}>]>;
+export type UnifiNetworkAuthConfig = typeof UnifiNetworkAuthConfigSchema.Type;
+export declare const UnifiNetworkAuth: import("effect/Layer").Layer<never, never, import("alchemy").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path>;
+/** A console or self-hosted controller reached directly, e.g. `https://192.168.1.1`. */
+export interface LocalConnection {
+  readonly type: "local";
+  /** Origin of the console, without the Integration API path. */
+  readonly url: string;
+  readonly apiKey: Redacted.Redacted<string>;
+  /**
+   * Accept the server only if a certificate in its chain has this SHA-256
+   * fingerprint (`AB:CD:…`), whether or not Node trusts it.
+   */
+  readonly certFingerprint?: string | undefined;
+  /** Skip TLS verification entirely. */
+  readonly insecure: boolean;
+}
+/** A console reached through the `api.ui.com` cloud connector. */
+export interface RemoteConnection {
+  readonly type: "remote";
+  readonly consoleId: string;
+  readonly apiKey: Redacted.Redacted<string>;
+}
+export type Connection = LocalConnection | RemoteConnection;
+/** Where credentials came from: a named Alchemy profile, or `UNIFI_*` environment variables. */
+export type CredentialsSource = {
+  readonly type: "profile";
+  readonly profile: string;
+} | {
+  readonly type: "env";
+};
+export interface ResolvedCredentials {
+  readonly connection: Connection;
+  /**
+   * Site used by resources that don't set `site`, by internal reference
+   * (e.g. `default`) or name. Unset means the console's only site; it's only
+   * needed on consoles hosting several.
+   */
+  readonly site?: string | undefined;
+  readonly source: CredentialsSource;
+}
+declare const UnifiNetworkCredentials_base: Context.ServiceClass<UnifiNetworkCredentials, "UnifiNetwork::Credentials", Effect.Effect<ResolvedCredentials, never, never>>;
+/**
+ * Lazily-resolved credentials for the active profile (or the environment).
+ * The service value is an Effect so nothing resolves at Layer construction;
+ * handlers run `yield* yield* UnifiNetworkCredentials`.
+ */
+export declare class UnifiNetworkCredentials extends UnifiNetworkCredentials_base {
+  /** Alchemy's tag for credentials services, which lets stack bodies require this one. */
+  readonly kind: "Credentials";
+}
+/**
+ * Resolves {@link UnifiNetworkCredentials} through the `UnifiNetwork` auth
+ * provider: environment variables when they're all set, otherwise the
+ * selected Alchemy profile. Resolution is deferred to first use and cached.
+ */
+export declare const fromAuthProvider: () => Layer.Layer<UnifiNetworkCredentials, never, import("alchemy").AuthProviders | import("alchemy/Auth/Profile").ProfileStore>;
+/** A connection whose base URL has been found and whose API key works. */
+interface Established {
+  readonly baseUrl: string;
+  readonly applicationVersion: string;
+  /** What SDK operations need: credentials for {@link baseUrl} and a client with the connection's TLS settings. */
+  readonly services: Context.Context<Sdk.Credentials | HttpClient.HttpClient>;
+}
+declare const UnifiNetworkConnection_base: Context.ServiceClass<UnifiNetworkConnection, "UnifiNetwork::Connection", Effect.Effect<Established, Sdk.ConfigError, never>>;
+/**
+ * The profile's established connection, created on first use and shared for
+ * the rest of the run. Provider-private: its `HttpClient` and SDK
+ * `Credentials` never enter the stack's context, so they can't replace other
+ * providers' clients.
+ */
+export declare class UnifiNetworkConnection extends UnifiNetworkConnection_base {
+  /** Alchemy's tag for environment services, which lets stack bodies (and so lookups) require this one. */
+  readonly kind: "Environment";
+}
+/** Runs SDK operations against the profile's console, retrying the console's transient stale-network 422. */
+export declare const withConnection: <A, E, R>(effect: Effect.Effect<A, E, R>) => Effect.Effect<A, E | Sdk.ConfigError, Exclude<R, Sdk.Credentials | HttpClient.HttpClient> | UnifiNetworkConnection>;
+declare namespace ReadCache_d_exports {
+  export { Key, UnifiNetworkReadCache, cached, invalidate, invalidating, key, layer };
+}
+declare const UnifiNetworkReadCache_base: Context.ServiceClass<UnifiNetworkReadCache, "UnifiNetwork::ReadCache", {
+  readonly run: object;
+}>;
+/**
+ * Per-run memo of API reads, so a plan touching many resources lists each
+ * collection once instead of once per resource. One instance per
+ * `providers()` build, i.e. per CLI run or test file. The value is only an
+ * identity: entries live on each {@link Key}, keyed by it.
+ */
+export declare class UnifiNetworkReadCache extends UnifiNetworkReadCache_base {
+  /** Alchemy's tag for environment services, which lets stack bodies (and so lookups) require this one. */
+  readonly kind: "Environment";
+}
+declare const layer: Layer.Layer<UnifiNetworkReadCache, never, never>;
+/**
+ * One kind of cached read, e.g. a resource type's list. `scope` arguments
+ * separate its entries, e.g. by site ID.
+ */
+interface Key<A, E> {
+  readonly name: string;
+  readonly entries: WeakMap<object, Map<string, Deferred.Deferred<A, E>>>;
+}
+declare const key: <A, E = never>(name: string) => Key<A, E>;
+/**
+ * `load`'s result, shared by every caller in this run until invalidated.
+ * Concurrent callers wait for one load. Failures aren't cached.
+ */
+declare const cached: <A, E, R>(cacheKey: Key<A, E>, scope: string, load: Effect.Effect<A, E, R>) => Effect.Effect<A, E, R | UnifiNetworkReadCache>;
+/** Drops an entry, so the next read loads afresh. */
+declare const invalidate: <A, E>(cacheKey: Key<A, E>, scope: string) => Effect.Effect<void, never, UnifiNetworkReadCache>;
+/** Runs a write, then invalidates the entry it affects, whether or not the write succeeded. */
+declare const invalidating: <A, E>(cacheKey: Key<A, E>, scope: string) => <B, E2, R>(write: Effect.Effect<B, E2, R>) => Effect.Effect<B, E2, R | UnifiNetworkReadCache>;
+declare const Providers_base: Provider.ProviderCollection<Providers, "UnifiNetwork">;
+export declare class Providers extends Providers_base {}
+/**
+ * Registers every UniFi Network resource provider, the `UnifiNetwork` auth
+ * provider, the lazily-resolved credentials and connection, and the per-run
+ * read cache. Merge
+ * alongside other cloud `providers()` layers in a Stack.
+ *
+ * Its requirements (`AuthProviders`, `ProfileStore`, `FileSystem`, `Path`)
+ * come from Alchemy's runtime; it provides only its own services.
+ *
+ * Unlike most providers this doesn't provide an `HttpClient`: ours carries
+ * the console's TLS settings, and lifecycle operations run in the stack's
+ * merged context, so it would replace other providers' clients. SDK calls
+ * get it through `UnifiNetworkConnection` instead.
+ */
+export declare const providers: () => Layer.Layer<Providers | UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache, never, import("alchemy").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy/Auth/Profile").ProfileStore>;
+/** A UniFi site: a namespace within one console. */
+export interface Site {
+  /** The ID other Integration API calls take. */
+  readonly id: string;
+  /** Stable reference that survives renames: `default`, or a generated one like `x7k2m9q1`. */
+  readonly internalReference: string;
+  readonly name: string;
+}
+declare const SiteNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SiteNotFound";
+} & Readonly<A>;
+export declare class SiteNotFound extends SiteNotFound_base<{
+  readonly site: string;
+  readonly available: ReadonlyArray<Site>;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+declare const SiteRequired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "SiteRequired";
+} & Readonly<A>;
+export declare class SiteRequired extends SiteRequired_base<{
+  readonly available: ReadonlyArray<Site>;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+declare const AmbiguousSite_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "AmbiguousSite";
+} & Readonly<A>;
+export declare class AmbiguousSite extends AmbiguousSite_base<{
+  readonly site: string;
+  readonly matches: ReadonlyArray<Site>;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+declare const CrossSiteReference_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "CrossSiteReference";
+} & Readonly<A>;
+/** A resource referenced another that lives in a different site. */
+export declare class CrossSiteReference extends CrossSiteReference_base<{
+  readonly what: string;
+  readonly referencedSiteId: string;
+  readonly site: Site;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+/** Fails if a reference carries a site ID (resources and lookups do) other than `site`'s. */
+export declare const checkSameSite: (what: string, referencedSiteId: string | undefined, site: Site) => Effect.Effect<void, never, never> | Effect.Effect<never, CrossSiteReference, never>;
+export declare const sitesKey: Key<readonly Site[], Sdk.UnifiNetworkOpError>;
+/** The console's sites, listed once per run. */
+export declare const listSites: Effect.Effect<readonly Site[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/**
+ * The site a resource belongs to: `site` (an ID, internal reference or
+ * name), else the profile's site, else the console's only site. Fails,
+ * listing the console's sites, when it doesn't exist or is ambiguous, so a
+ * plan stops before changing anything.
+ */
+export declare const resolveSite: (site?: string | undefined) => Effect.Effect<Site, AmbiguousSite | SiteNotFound | SiteRequired | Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+export declare const DEFAULT_WARN_AT = 4000000;
+interface UnifiStateOptions {
+  /**
+   * Warn once a stage's stored state passes this many bytes (compressed and
+   * base64-encoded), as a prompt to move to a store without the console's
+   * limits. A console stores up to about 16 MiB directly and 7.5 MiB through
+   * ui.com.
+   *
+   * @default 4_000_000
+   */
+  readonly warnAt?: number;
+}
+/**
+ * State store on the console the profile points at: each stack and stage
+ * is a disabled Gateway → Gateway firewall policy holding the stage's
+ * compressed state, locked with a traffic-matching list while a run uses
+ * it. Nothing connects until the first state operation.
+ *
+ * The state includes secrets in plaintext, as in every Alchemy store: a
+ * UniFi stack's are already on the console, but another provider's
+ * resources in the same stack would put theirs there too.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+ * 	}),
+ * );
+ * ```
+ */
+export declare const state: (options?: UnifiStateOptions) => Layer.Layer<State, never, import("alchemy").AuthProviders | import("effect/FileSystem").FileSystem | import("effect/Path").Path | import("alchemy/Auth/Profile").ProfileStore>;
+/** What resource lifecycle handlers and lookups need. `providers()` provides all of them. */
+type Services = UnifiNetworkCredentials | UnifiNetworkConnection | UnifiNetworkReadCache;
+/**
+ * Comparison of request bodies with what the console reports. Props are
+ * authoritative: a resource's desired body is its props with explicit
+ * defaults for anything unset, sent whole on every update, and the console's
+ * object must equal it field for field.
+ */
+/** `Omit` applied to each member of a union, keeping the discriminant. */
+type DistributiveOmit<T, K extends PropertyKey> = T extends unknown ? Omit<T, K> : never;
+/**
+ * Props are the Integration API's DNS policy body plus `site`. `type` picks
+ * the kind: a record (`"A_RECORD"`, `"AAAA_RECORD"`, `"CNAME_RECORD"`,
+ * `"MX_RECORD"`, `"SRV_RECORD"`, `"TXT_RECORD"`) or `"FORWARD_DOMAIN"`
+ * (send a domain's queries to another DNS server).
+ */
+export type DnsPolicyProps = Sdk.CreateOrUpdateDNSPolicy & {
+  /** Site to create the policy in. @default the profile's site, else the console's only site */
+  site?: string;
+};
+export interface DnsPolicyAttributes {
+  siteId: string;
+  dnsPolicyId: string;
+  type: DnsPolicyProps["type"];
+  domain: string;
+  /** The whole policy as the console reports it, so `alchemy drift` sees any change. */
+  config: DistributiveOmit<Sdk.DNSPolicy, "id" | "metadata">;
+}
+export interface DnsPolicy extends Resource<"UnifiNetwork.DnsPolicy", DnsPolicyProps, DnsPolicyAttributes, never, Providers> {}
+/** A site's DNS policies, listed once per run. */
+export declare const listDnsPolicies: (siteId: string) => Effect.Effect<readonly Sdk.DNSPolicy[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/**
+ * A local DNS record or forwarding rule on the gateway. DNS policies have no
+ * name, so existing ones are adopted with `--adopt` by type and domain (and,
+ * when a domain has several records of that type, by their values).
+ * Changing `type` updates the policy in place.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		yield* UnifiNetwork.DnsPolicy("home-assistant", {
+ * 			type: "A_RECORD",
+ * 			enabled: true,
+ * 			domain: "ha.home.arpa",
+ * 			ipv4Address: "192.168.2.20",
+ * 			ttlSeconds: 300,
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const DnsPolicy: import("alchemy").ResourceClass<DnsPolicy>;
+export declare const DnsPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<DnsPolicy>, never, Services>;
+declare const LookupNotFound_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "LookupNotFound";
+} & Readonly<A>;
+/** A `lookup` found nothing matching its query. */
+export declare class LookupNotFound extends LookupNotFound_base<{
+  readonly resource: string;
+  readonly query: string;
+  readonly site: Site;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+declare const LookupAmbiguous_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "LookupAmbiguous";
+} & Readonly<A>;
+/** A `lookup` matched several objects, e.g. networks sharing a name. */
+export declare class LookupAmbiguous extends LookupAmbiguous_base<{
+  readonly resource: string;
+  readonly query: string;
+  readonly site: Site;
+  readonly count: number;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+export declare const describeQuery: (query: object) => string;
+/** The zones every zone-based firewall has, by their API names. */
+export type BuiltinFirewallZoneName = "Internal" | "External" | "Gateway" | "Vpn" | "Hotspot" | "Dmz";
+/** A built-in zone, resolved by name in whichever site the referencing resource is in. */
+export interface BuiltinFirewallZone {
+  readonly builtinFirewallZone: BuiltinFirewallZoneName;
+}
+/**
+ * A zone: a `FirewallZone` resource, a {@link FirewallZone.lookup} result,
+ * `{ firewallZoneId }`, or a built-in constant such as `FirewallZone.INTERNAL`.
+ */
+export type FirewallZoneReference = {
+  readonly firewallZoneId: string;
+  readonly siteId?: string | undefined;
+} | BuiltinFirewallZone;
+export interface FirewallZoneProps {
+  /** Site to create the zone in. @default the profile's site, else the console's only site */
+  site?: string;
+  name: string;
+}
+export interface FirewallZoneAttributes {
+  siteId: string;
+  firewallZoneId: string;
+  name: string;
+}
+export interface FirewallZone extends Resource<"UnifiNetwork.FirewallZone", FirewallZoneProps, FirewallZoneAttributes, never, Providers> {}
+/** A site's zones, built-in ones included, listed once per run. */
+export declare const listFirewallZones: (siteId: string) => Effect.Effect<readonly Sdk.FirewallZone[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/** The zone ID a reference means in `site`. */
+export declare const resolveFirewallZone: (reference: FirewallZoneReference, site: Site) => Effect.Effect<string, CrossSiteReference | LookupNotFound | Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/**
+ * A custom zone in the zone-based firewall. Networks join zones through
+ * `Network`'s `zone` prop; the zone doesn't list its networks, so the two
+ * resources never fight over membership.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		const cameras = yield* UnifiNetwork.FirewallZone("cameras", { name: "Cameras" });
+ * 		// Networks join zones from the network's side.
+ * 		yield* UnifiNetwork.Network("cctv", {
+ * 			management: "GATEWAY",
+ * 			name: "CCTV",
+ * 			vlanId: 30,
+ * 			enabled: true,
+ * 			cellularBackupEnabled: false,
+ * 			internetAccessEnabled: false,
+ * 			isolationEnabled: true,
+ * 			zone: cameras, // or a built-in zone, e.g. UnifiNetwork.FirewallZone.INTERNAL
+ * 			ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.30.1", prefixLength: 24 },
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const FirewallZone: import("alchemy").ResourceClassWithMethods<FirewallZone, {
+  readonly INTERNAL: BuiltinFirewallZone;
+  readonly EXTERNAL: BuiltinFirewallZone;
+  readonly GATEWAY: BuiltinFirewallZone;
+  readonly VPN: BuiltinFirewallZone;
+  readonly HOTSPOT: BuiltinFirewallZone;
+  readonly DMZ: BuiltinFirewallZone;
+  /**
+   * Any zone in the site, built-in or custom, by name. Dies with a
+   * user-facing `LookupNotFound` if there's none: stack bodies can't fail
+   * with typed errors.
+   */
+  readonly lookup: (query: {
+    readonly name: string;
+    readonly site?: string;
+  }) => Effect.Effect<FirewallZoneAttributes, never, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+}>;
+export declare const FirewallZoneProvider: () => import("effect/Layer").Layer<Provider.Provider<FirewallZone>, never, Services>;
+interface SiteProp {
+  /** Site to create the network in. @default the profile's site, else the console's only site */
+  site?: string;
+}
+/** A device, e.g. the switch routing a switch-managed network. */
+export interface DeviceReference {
+  readonly deviceId: string;
+}
+/** A network routed by the gateway: the usual kind, with DHCP, zones and internet access. */
+export interface GatewayNetworkProps extends Omit<Sdk.IntegrationGatewayManagedNetworkCreateUpdateDto, "zoneId">, SiteProp {
+  /**
+   * The network's firewall zone, e.g. `FirewallZone.INTERNAL` or a
+   * `FirewallZone` resource. Required once the site uses the zone-based
+   * firewall.
+   */
+  zone?: FirewallZoneReference;
+}
+/** A network routed by a layer-3 switch. */
+export interface SwitchNetworkProps extends Omit<Sdk.IntegrationSwitchManagedNetworkCreateUpdateDto, "deviceId">, SiteProp {
+  /** The switch routing the network. */
+  device: DeviceReference;
+}
+/** A VLAN that UniFi carries but doesn't route; something else on it does. */
+export interface UnmanagedNetworkProps extends Sdk.IntegrationUnmanagedNetworkCreateUpdateDto, SiteProp {}
+/** Props are the Integration API's network body, plus `site` and references; `management` picks the kind. */
+export type NetworkProps = GatewayNetworkProps | SwitchNetworkProps | UnmanagedNetworkProps;
+/** A network: a `Network` resource, a {@link Network.lookup} result, or `{ networkId }`. */
+export interface NetworkReference {
+  readonly networkId: string;
+  readonly siteId?: string | undefined;
+  /** Set by resources and lookups. Some objects must reference the default network differently. */
+  readonly default?: boolean | undefined;
+}
+declare const DefaultNetworkReplacement_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "DefaultNetworkReplacement";
+} & Readonly<A>;
+/** A change that would replace the site's default network, which can't be deleted. */
+export declare class DefaultNetworkReplacement extends DefaultNetworkReplacement_base<{
+  readonly networkName: string;
+  readonly reason: string;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+export interface NetworkAttributes {
+  siteId: string;
+  networkId: string;
+  name: string;
+  vlanId: number;
+  management: NetworkProps["management"];
+  /** The network's firewall zone (gateway networks). */
+  zoneId: string | undefined;
+  /** Whether this is the site's default network, which is never deleted. */
+  default: boolean;
+  /** The whole network as the console reports it, so `alchemy drift` sees any change. */
+  config: DistributiveOmit<Sdk.NetworkDetails, "id" | "metadata" | "default">;
+}
+export interface Network extends Resource<"UnifiNetwork.Network", NetworkProps, NetworkAttributes, never, Providers> {}
+/** A site's networks, listed once per run. */
+export declare const listNetworks: (siteId: string) => Effect.Effect<readonly Sdk.NetworkOverview[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/** The network ID a reference means in `site`. */
+export declare const resolveNetwork: (reference: NetworkReference, site: Site) => Effect.Effect<string, CrossSiteReference, never>;
+/**
+ * A network (VLAN). `management` picks the kind: `"GATEWAY"` (routed by the
+ * gateway), `"SWITCH"` (routed by a layer-3 switch) or `"UNMANAGED"`.
+ * Changing it, or the site, replaces the network: the old one is deleted
+ * first, since VLAN IDs must be unique.
+ *
+ * Props are authoritative: every update sends the whole network, with
+ * explicit defaults for unset fields (`mdnsForwardingEnabled: true`, and a
+ * DHCP server's `domainName: ""`), so changes made in the UI are put back.
+ * The `config` attribute mirrors the console's object, so `alchemy drift`
+ * sees them.
+ * Existing networks are adopted by VLAN ID
+ * with `--adopt` (and renamed to match), including the site's default
+ * network (VLAN 1), which is never deleted or replaced.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		yield* UnifiNetwork.Network("guest", {
+ * 			management: "GATEWAY",
+ * 			name: "Guest",
+ * 			vlanId: 12,
+ * 			enabled: true,
+ * 			cellularBackupEnabled: false,
+ * 			internetAccessEnabled: true,
+ * 			isolationEnabled: true,
+ * 			zone: UnifiNetwork.FirewallZone.HOTSPOT,
+ * 			ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.12.1", prefixLength: 24 },
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const Network: import("alchemy").ResourceClassWithMethods<Network, {
+  /**
+   * A network in the site by name or VLAN ID. Dies with a user-facing
+   * `LookupNotFound` or `LookupAmbiguous`: stack bodies can't fail with typed
+   * errors.
+   */
+  readonly lookup: (query: ({
+    readonly name: string;
+  } | {
+    readonly vlanId: number;
+  }) & {
+    readonly site?: string;
+  }) => Effect.Effect<NetworkAttributes, never, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+}>;
+export declare const NetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<Network>, never, Services>;
+/**
+ * Props are the Integration API's list body plus `site`. `type` picks what
+ * it holds: `"IPV4_ADDRESSES"`, `"IPV6_ADDRESSES"` or `"PORTS"` (no MACs).
+ */
+export type TrafficMatchingListProps = Sdk.CreateOrUpdateTrafficMatchingList & {
+  /** Site to create the list in. @default the profile's site, else the console's only site */
+  site?: string;
+};
+/** A list: a `TrafficMatchingList` resource, a {@link TrafficMatchingList.lookup} result, or `{ trafficMatchingListId }`. */
+export interface TrafficMatchingListReference {
+  readonly trafficMatchingListId: string;
+  readonly siteId?: string | undefined;
+}
+export interface TrafficMatchingListAttributes {
+  siteId: string;
+  trafficMatchingListId: string;
+  name: string;
+  type: TrafficMatchingListProps["type"];
+  /** The whole list as the console reports it, so `alchemy drift` sees any change. */
+  config: DistributiveOmit<Sdk.TrafficMatchingList, "id">;
+}
+export interface TrafficMatchingList extends Resource<"UnifiNetwork.TrafficMatchingList", TrafficMatchingListProps, TrafficMatchingListAttributes, never, Providers> {}
+/** A site's traffic-matching lists, listed once per run. */
+export declare const listTrafficMatchingLists: (siteId: string) => Effect.Effect<readonly Sdk.TrafficMatchingList[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+declare const TrafficMatchingListInUse_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "TrafficMatchingListInUse";
+} & Readonly<A>;
+/** A list can't be deleted while something references it. */
+export declare class TrafficMatchingListInUse extends TrafficMatchingListInUse_base<{
+  readonly listName: string;
+  /** Names of the firewall policies referencing it, as far as they could be found. */
+  readonly referencedBy: ReadonlyArray<string>;
+  readonly detail: string;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+/** The list ID a reference means in `site`. */
+export declare const resolveTrafficMatchingList: (reference: TrafficMatchingListReference, site: Site) => Effect.Effect<string, CrossSiteReference, never>;
+/**
+ * A named list of IPv4 addresses, IPv6 addresses or ports, which firewall
+ * policies reference instead of repeating values inline. Names are unique
+ * per site, so existing lists are adopted by name with `--adopt`. Changing
+ * `type` updates the list in place.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		const haHosts = yield* UnifiNetwork.TrafficMatchingList("ha-hosts", {
+ * 			type: "IPV4_ADDRESSES",
+ * 			name: "Home Assistant hosts",
+ * 			items: [{ type: "IP_ADDRESS", value: "192.168.2.20" }],
+ * 		});
+ * 		// Reference it from a policy's filter: { type: "TRAFFIC_MATCHING_LIST", matchOpposite: false, trafficMatchingList: haHosts }
+ * 	}),
+ * );
+ * ```
+ */
+export declare const TrafficMatchingList: import("alchemy").ResourceClassWithMethods<TrafficMatchingList, {
+  /**
+   * A list in the site by name. Dies with a user-facing `LookupNotFound`:
+   * stack bodies can't fail with typed errors.
+   */
+  readonly lookup: (query: {
+    readonly name: string;
+    readonly site?: string;
+  }) => Effect.Effect<TrafficMatchingListAttributes, never, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+}>;
+export declare const TrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<TrafficMatchingList>, never, Services>;
+/** Match the addresses or ports in a traffic-matching list (a `TrafficMatchingList` resource or reference). */
+export interface TrafficMatchingListFilter {
+  readonly type: "TRAFFIC_MATCHING_LIST";
+  /** Match everything except the list's entries. */
+  readonly matchOpposite: boolean;
+  readonly trafficMatchingList: TrafficMatchingListReference;
+}
+/** IP addresses, ranges or subnets to match: inline, or from a list. */
+export type IpAddressFilter = Sdk.IntegrationFirewallPolicySpecificIpAddressFilterDto | TrafficMatchingListFilter;
+/** Ports or port ranges to match: inline, or from a list. */
+export type PortFilter = Sdk.IntegrationFirewallPolicyPortValueFilterDto | TrafficMatchingListFilter;
+/** Networks to match (`Network` resources or references). */
+export interface NetworkFilter {
+  /** Match every network except these. */
+  readonly matchOpposite: boolean;
+  readonly networks: ReadonlyArray<NetworkReference>;
+}
+/** An API traffic filter with its ID fields replaced by references. */
+type WithReferences<F> = { [K in keyof F]: K extends "ipAddressFilter" ? IpAddressFilter : K extends "portFilter" ? PortFilter : K extends "networkFilter" ? NetworkFilter : F[K]; };
+type Distribute<F> = F extends unknown ? WithReferences<F> : never;
+/** What a policy matches at its source, besides the zone. `type` picks the kind. */
+export type FirewallPolicySourceFilter = Distribute<Sdk.FirewallPolicySourceTrafficFilter>;
+/** What a policy matches at its destination, besides the zone. `type` picks the kind. */
+export type FirewallPolicyDestinationFilter = Distribute<Sdk.FirewallPolicyDestinationTrafficFilter>;
+export interface FirewallPolicyEndpoint<Filter> {
+  /** A `FirewallZone` resource or lookup, `{ firewallZoneId }`, or a built-in constant such as `FirewallZone.INTERNAL`. */
+  readonly zone: FirewallZoneReference;
+  /** Narrows the zone's traffic. Unset matches all of it. */
+  readonly trafficFilter?: Filter;
+}
+/**
+ * Props are the Integration API's policy body, with zones, networks and
+ * traffic-matching lists as references, plus `site`.
+ *
+ * Props are authoritative, like every resource's: leaving out
+ * `trafficFilter`, `connectionStateFilter`, `ipsecFilter`, `schedule` or
+ * `description` means none, even if the policy has one in the console.
+ */
+export interface FirewallPolicyProps extends Omit<Sdk.CreateFirewallPolicyRequest, "siteId" | "source" | "destination"> {
+  /** Site to create the policy in. @default the profile's site, else the console's only site */
+  site?: string;
+  source: FirewallPolicyEndpoint<FirewallPolicySourceFilter>;
+  destination: FirewallPolicyEndpoint<FirewallPolicyDestinationFilter>;
+}
+/** A policy: a `FirewallPolicy` resource, a {@link FirewallPolicy.lookup} result, or `{ firewallPolicyId }`. */
+export interface FirewallPolicyReference {
+  readonly firewallPolicyId: string;
+  readonly siteId?: string | undefined;
+}
+export interface FirewallPolicyAttributes {
+  siteId: string;
+  firewallPolicyId: string;
+  name: string;
+  sourceFirewallZoneId: string;
+  destinationFirewallZoneId: string;
+  /**
+   * The whole policy as the console reports it, so `alchemy drift` sees any
+   * change; without its `index`, which moves whenever its ordering changes.
+   */
+  config: Omit<Sdk.FirewallPolicy, "id" | "metadata" | "index">;
+}
+export interface FirewallPolicy extends Resource<"UnifiNetwork.FirewallPolicy", FirewallPolicyProps, FirewallPolicyAttributes, never, Providers> {}
+/**
+ * A site's firewall policies, listed once per run: all of them, including
+ * system-defined ones and ones UniFi derives from UI Objects.
+ */
+export declare const listFirewallPolicies: (siteId: string) => Effect.Effect<readonly Sdk.FirewallPolicy[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/** Policies the user made, as opposed to system-defined ones and ones UniFi derives (from UI Objects, say), which the provider never touches. */
+export declare const isUserDefined: (policy: Sdk.FirewallPolicy) => boolean;
+/**
+ * A zone-based firewall policy: allow, block or reject traffic from one
+ * zone to another, optionally narrowed by traffic filters. Changing its
+ * zones updates it in place and moves it to the new zone pair's ordering
+ * (see `FirewallPolicyOrdering`).
+ *
+ * Existing user-defined policies are adopted with `--adopt` by name and zone
+ * pair (names aren't unique, so several matches adopt nothing). Policies
+ * UniFi derives, e.g. from UI Objects, are invisible: never listed, adopted
+ * or ordered.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		const iot = yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+ * 		yield* UnifiNetwork.FirewallPolicy("block-iot-to-internal", {
+ * 			name: "Block IoT to Internal",
+ * 			enabled: true,
+ * 			action: { type: "BLOCK" },
+ * 			source: { zone: iot },
+ * 			destination: { zone: UnifiNetwork.FirewallZone.INTERNAL },
+ * 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+ * 			loggingEnabled: false,
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const FirewallPolicy: import("alchemy").ResourceClassWithMethods<FirewallPolicy, {
+  /**
+   * A user-defined policy by name, optionally narrowed to a zone pair. Dies
+   * with a user-facing `LookupNotFound` or `LookupAmbiguous`: stack bodies
+   * can't fail with typed errors.
+   */
+  readonly lookup: (query: {
+    readonly name: string;
+    readonly source?: FirewallZoneReference;
+    readonly destination?: FirewallZoneReference;
+    readonly site?: string;
+  }) => Effect.Effect<FirewallPolicyAttributes, never, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+}>;
+export declare const FirewallPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<FirewallPolicy>, never, Services>;
+export interface FirewallPolicyOrderingProps {
+  /** Site of the zones. @default the profile's site, else the console's only site */
+  site?: string;
+  source: FirewallZoneReference;
+  destination: FirewallZoneReference;
+  /** Policies evaluated before the system-defined ones, first match wins. */
+  beforeSystemDefined?: ReadonlyArray<FirewallPolicyReference>;
+  /** Policies evaluated after the system-defined ones. */
+  afterSystemDefined?: ReadonlyArray<FirewallPolicyReference>;
+  /**
+   * Fail instead of keeping policies in the zone pair that aren't listed
+   * (e.g. made in the UI). @default false
+   */
+  exclusive?: boolean;
+}
+export interface FirewallPolicyOrderingAttributes {
+  siteId: string;
+  sourceFirewallZoneId: string;
+  destinationFirewallZoneId: string;
+  beforeSystemDefined: ReadonlyArray<string>;
+  afterSystemDefined: ReadonlyArray<string>;
+  /** The policies the props list, as opposed to unlisted ones kept in the order. */
+  listedFirewallPolicyIds: ReadonlyArray<string>;
+}
+export interface FirewallPolicyOrdering extends Resource<"UnifiNetwork.FirewallPolicyOrdering", FirewallPolicyOrderingProps, FirewallPolicyOrderingAttributes, never, Providers> {}
+declare const InvalidFirewallPolicyOrdering_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+  readonly _tag: "InvalidFirewallPolicyOrdering";
+} & Readonly<A>;
+/** An ordering that can't be applied as given. */
+export declare class InvalidFirewallPolicyOrdering extends InvalidFirewallPolicyOrdering_base<{
+  readonly reason: string;
+}> {
+  readonly [UserFacingError]: true;
+  get message(): string;
+}
+/**
+ * The evaluation order of user-defined policies from one zone to another.
+ * Listing policies makes the ordering depend on them, so it's applied after
+ * they're created or moved, and re-applied when the list changes.
+ *
+ * UniFi rejects an ordering that leaves out any of the pair's policies, so
+ * unlisted ones (e.g. made in the UI) are kept after the listed ones in each
+ * bucket, in their current relative order, with a warning; `exclusive: true`
+ * fails instead. A policy the ordering listed before but no longer does is
+ * kept quietly, even when exclusive: it's usually being deleted in the same
+ * deploy, which runs after the ordering is applied. The state store's
+ * policies (`UnifiNetwork.state()`, Gateway → Gateway) are kept quietly too.
+ * System-defined policies sit between the two buckets and
+ * can't be reordered; policies UniFi derives from UI Objects aren't ordered
+ * at all.
+ *
+ * The zone pair is the identity: an existing ordering is adopted without
+ * `--adopt`, and deleting the resource leaves the order as it is.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		const { INTERNAL } = UnifiNetwork.FirewallZone;
+ * 		const iot = yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+ * 		const policy = { enabled: true, source: { zone: INTERNAL }, destination: { zone: iot }, loggingEnabled: false } as const;
+ * 		const allowHomeAssistant = yield* UnifiNetwork.FirewallPolicy("allow-ha", {
+ * 			...policy,
+ * 			name: "Allow Home Assistant",
+ * 			action: { type: "ALLOW", allowReturnTraffic: true },
+ * 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+ * 		});
+ * 		const blockTheRest = yield* UnifiNetwork.FirewallPolicy("block-rest", {
+ * 			...policy,
+ * 			name: "Block the rest",
+ * 			action: { type: "BLOCK" },
+ * 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+ * 		});
+ * 		yield* UnifiNetwork.FirewallPolicyOrdering("internal-to-iot", {
+ * 			source: INTERNAL,
+ * 			destination: iot,
+ * 			beforeSystemDefined: [allowHomeAssistant, blockTheRest],
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const FirewallPolicyOrdering: import("alchemy").ResourceClass<FirewallPolicyOrdering>;
+export declare const FirewallPolicyOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<FirewallPolicyOrdering>, never, Services>;
+/** The site's native (untagged) network. */
+export interface NativeNetwork {
+  readonly type: "NATIVE";
+}
+interface CommonProps {
+  /** Site to create the broadcast in. @default the profile's site, else the console's only site */
+  site?: string;
+  /**
+   * The network clients join: a network reference, or
+   * `WifiBroadcast.NATIVE_NETWORK` for the site's default network (a
+   * `Network` resource or lookup for the default network works too).
+   */
+  network?: NetworkReference | NativeNetwork;
+}
+/** WPA security on a standard broadcast must set `fastRoamingEnabled` (the console rejects it otherwise). */
+type WithFastRoaming<S> = S extends {
+  fastRoamingEnabled?: boolean;
+} ? S & {
+  fastRoamingEnabled: boolean;
+} : S;
+export type StandardWifiSecurityConfiguration = WithFastRoaming<Sdk.WifiSecurityConfigurationDetailObject>;
+/**
+ * An ordinary SSID. Pass passphrases as `Redacted` (e.g. from
+ * `Config.Redacted`) to keep them out of logs.
+ */
+export interface StandardWifiBroadcastProps extends Omit<Sdk.IntegrationStandardWifiBroadcastCreateUpdateDto, "network" | "securityConfiguration">, CommonProps {
+  securityConfiguration: StandardWifiSecurityConfiguration;
+}
+/** An SSID tuned for IoT devices (2.4 GHz only, longer DTIM). */
+export interface IotWifiBroadcastProps extends Omit<Sdk.IntegrationIotOptimizedWifiBroadcastCreateUpdateDto, "network">, CommonProps {}
+/** Props are the Integration API's Wi-Fi body, plus `site` and references; `type` picks the kind. */
+export type WifiBroadcastProps = StandardWifiBroadcastProps | IotWifiBroadcastProps;
+export interface WifiBroadcastAttributes {
+  siteId: string;
+  wifiBroadcastId: string;
+  name: string;
+  type: WifiBroadcastProps["type"];
+  /** The network clients join, when it isn't the native one. */
+  networkId: string | undefined;
+  /** The whole broadcast as the console reports it (passphrases `Redacted`), so `alchemy drift` sees any change. */
+  config: DistributiveOmit<Sdk.WifiBroadcastDetails, "id" | "metadata">;
+}
+export interface WifiBroadcast extends Resource<"UnifiNetwork.WifiBroadcast", WifiBroadcastProps, WifiBroadcastAttributes, never, Providers> {}
+/** A site's Wi-Fi broadcasts, listed once per run. */
+export declare const listWifiBroadcasts: (siteId: string) => Effect.Effect<readonly Sdk.WifiBroadcastOverview[], Sdk.UnifiNetworkOpError, UnifiNetworkConnection | UnifiNetworkReadCache>;
+/**
+ * A Wi-Fi network (SSID). `type` picks a standard or an IoT-optimised
+ * broadcast; changing it, or the site, replaces the broadcast.
+ *
+ * Props are authoritative: every update sends the whole broadcast, with
+ * explicit defaults for unset fields (a standard broadcast's
+ * `bandSteeringEnabled: false`), so changes made in the UI, passphrases
+ * included, are put back. The `config` attribute mirrors the console's
+ * object, so `alchemy drift` sees them. Existing broadcasts are adopted by name with
+ * `--adopt`.
+ *
+ * @example
+ * ```ts
+ * import * as UnifiNetwork from "@alchemy-unifi/network";
+ * import * as Alchemy from "alchemy";
+ * import * as Config from "effect/Config";
+ * import * as Effect from "effect/Effect";
+ *
+ * export default Alchemy.Stack(
+ * 	"HomeNetwork",
+ * 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+ * 	Effect.gen(function* () {
+ * 		const lan = yield* UnifiNetwork.Network.lookup({ vlanId: 1 });
+ * 		yield* UnifiNetwork.WifiBroadcast("home", {
+ * 			type: "STANDARD",
+ * 			name: "Home",
+ * 			enabled: true,
+ * 			network: lan,
+ * 			securityConfiguration: {
+ * 				type: "WPA2_PERSONAL",
+ * 				passphrase: yield* Config.Redacted("WIFI_PASSPHRASE"),
+ * 				fastRoamingEnabled: false,
+ * 			},
+ * 			broadcastingFrequenciesGHz: [2.4, 5],
+ * 			hideName: false,
+ * 			clientIsolationEnabled: false,
+ * 			multicastToUnicastConversionEnabled: false,
+ * 			uapsdEnabled: false,
+ * 			channel2gLockedTo6: false,
+ * 			dtimPeriod2gLockedTo3: false,
+ * 			advertiseDeviceName: false,
+ * 			arpProxyEnabled: false,
+ * 			bssTransitionEnabled: true,
+ * 		});
+ * 	}),
+ * );
+ * ```
+ */
+export declare const WifiBroadcast: import("alchemy").ResourceClassWithMethods<WifiBroadcast, {
+  readonly NATIVE_NETWORK: NativeNetwork;
+  /**
+   * A broadcast in the site by name. Dies with a user-facing
+   * `LookupNotFound` or `LookupAmbiguous`: stack bodies can't fail with typed
+   * errors.
+   */
+  readonly lookup: (query: {
+    readonly name: string;
+    readonly site?: string;
+  }) => Effect.Effect<WifiBroadcastAttributes, never, UnifiNetworkConnection | UnifiNetworkCredentials | UnifiNetworkReadCache>;
+}>;
+export declare const WifiBroadcastProvider: () => import("effect/Layer").Layer<Provider.Provider<WifiBroadcast>, never, Services>;
+export { type Established, ReadCache_d_exports as ReadCache, type UnifiStateOptions };
+//# sourceMappingURL=index.d.mts.map