@alchemy-unifi/network 0.0.1 → 0.1.0

package/dist/index.mjs

@@ -0,0 +1,2372 @@
+import { t as __exportAll } from "./rolldown-runtime-D8jQpDG7.mjs";
+import * as Schema from "effect/Schema";
+import * as Sdk from "@alchemy-unifi/network-sdk";
+import { ConfigError } from "@alchemy-unifi/network-sdk";
+import { AuthError, AuthProviderLayer } from "alchemy/Auth/AuthProvider";
+import { displayRedacted } from "alchemy/Auth/Credentials";
+import { getEnv, getEnvRedactedRequired, mapPromptCancellation } from "alchemy/Auth/Env";
+import { storedSecret, storedValueText, validateFieldValues } from "alchemy/Auth/StoredAuthProvider";
+import * as Interaction from "alchemy/Interaction";
+import * as Effect from "effect/Effect";
+import * as HttpClient from "effect/http/HttpClient";
+import * as Redacted from "effect/Redacted";
+import * as Context from "effect/Context";
+import * as Layer from "effect/Layer";
+import * as Predicate from "effect/Predicate";
+import * as Schedule from "effect/Schedule";
+import * as RateLimiter from "effect/persistence/RateLimiter";
+import * as Scope from "effect/Scope";
+import { deferUntilFirstUse, orDieCredentialsUnavailable, resolveProviderConfig } from "alchemy/Auth/Resolve";
+import * as NodeHttpClient from "@effect/platform-node/NodeHttpClient";
+import { buildConnector } from "@effect/platform-node/Undici";
+import * as Data from "effect/Data";
+import * as net from "node:net";
+import * as tls from "node:tls";
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+import * as HttpClientResponse from "effect/http/HttpClientResponse";
+import * as Provider from "alchemy/Provider";
+import { Unowned } from "alchemy/AdoptPolicy";
+import { Resource } from "alchemy/Resource";
+import * as Stream from "effect/Stream";
+import { deepEqual, isResolved } from "alchemy/Diff";
+import * as Deferred from "effect/Deferred";
+import * as Exit from "effect/Exit";
+import { UserFacingError } from "alchemy/UserFacingError";
+import { STATE_STORE_VERSION } from "alchemy/State/HttpStateApi";
+import { State, StateStoreError } from "alchemy/State/State";
+import { encodeState, reviveState } from "alchemy/State/StateEncoding";
+import { recordStateStoreInit } from "alchemy/Telemetry/Metrics";
+import * as Clock from "effect/Clock";
+import * as LogLevel from "effect/LogLevel";
+import * as References from "effect/References";
+import * as Semaphore from "effect/Semaphore";
+import * as zlib from "node:zlib";
+// src/AuthConfig.ts
+const UNIFI_NETWORK_AUTH_PROVIDER_NAME = "UnifiNetwork";
+/** Values stored in a profile for the `UnifiNetwork` auth provider. */
+const UnifiNetworkAuthConfigSchema = Schema.Union([Schema.Struct({
+	method: Schema.Literal("local"),
+	url: Schema.String,
+	apiKey: Schema.String,
+	certFingerprint: Schema.optional(Schema.String),
+	insecure: Schema.optional(Schema.Boolean),
+	site: Schema.optional(Schema.String)
+}), Schema.Struct({
+	method: Schema.Literal("remote"),
+	consoleId: Schema.String,
+	apiKey: Schema.String,
+	site: Schema.optional(Schema.String)
+})]);
+// src/Credentials.ts
+/**
+* Lazily-resolved credentials for the active profile (or the environment).
+* The service value is an Effect so nothing resolves at Layer construction;
+* handlers run `yield* yield* UnifiNetworkCredentials`.
+*/
+var UnifiNetworkCredentials = class extends Context.Service()("UnifiNetwork::Credentials") {};
+/**
+* Resolves {@link UnifiNetworkCredentials} through the `UnifiNetwork` auth
+* provider: environment variables when they're all set, otherwise the
+* selected Alchemy profile. Resolution is deferred to first use and cached.
+*/
+const fromAuthProvider = () => Layer.effect(UnifiNetworkCredentials, Effect.gen(function* () {
+	return yield* (yield* resolveProviderConfig(UNIFI_NETWORK_AUTH_PROVIDER_NAME).pipe(Effect.flatMap(({ profileName, resolve }) => resolve.pipe(Effect.mapError((e) => ConfigError.make({ message: `Failed to resolve UniFi Network credentials from ${profileName === void 0 ? "the environment" : `profile '${profileName}'`}: ${e.message}` })))), deferUntilFirstUse)).pipe(orDieCredentialsUnavailable(UNIFI_NETWORK_AUTH_PROVIDER_NAME), Effect.cached);
+}));
+// src/HttpClient.ts
+/** Normalises a SHA-256 fingerprint to Node's `AB:CD:…` form, or returns `undefined` if it isn't one. */
+const normaliseFingerprint = (value) => {
+	const hex = value.replace(/[\s:]/g, "").toUpperCase();
+	return /^[0-9A-F]{64}$/.test(hex) ? (hex.match(/../g) ?? []).join(":") : void 0;
+};
+/** SHA-256 fingerprints of a peer's certificate chain, leaf first. */
+const chainFingerprints = (socket) => {
+	const fingerprints = [];
+	let cert = socket.getPeerCertificate(true);
+	while (cert?.fingerprint256 !== void 0 && !fingerprints.includes(cert.fingerprint256)) {
+		fingerprints.push(cert.fingerprint256);
+		cert = cert.issuerCertificate;
+	}
+	return fingerprints;
+};
+const PINNING_ERROR_CODE = "ERR_UNIFI_CERT_PINNING";
+/**
+* Whether an error (or one of its causes) is a certificate verification or
+* pinning failure. These are deterministic, so they aren't worth retrying.
+*/
+const isCertificateError = (error) => {
+	for (let e = error, depth = 0; typeof e === "object" && e !== null && depth < 5; depth++) {
+		const code = "code" in e ? String(e.code) : "";
+		if (code === PINNING_ERROR_CODE || /CERT|SELF_SIGNED|UNABLE_TO_VERIFY|UNABLE_TO_GET_ISSUER/.test(code)) return true;
+		e = "cause" in e ? e.cause : "reason" in e ? e.reason : void 0;
+	}
+	return false;
+};
+/**
+* Pinning can't use `checkServerIdentity`: Node skips it when the chain
+* doesn't verify, which is always the case for a console's self-signed
+* certificate. So verification is off, and the connector checks the
+* presented chain itself once the handshake completes. Session resumption
+* is off too, because a resumed session presents no certificate to check.
+*/
+const pinnedConnector = (fingerprint) => {
+	const connect = buildConnector({
+		rejectUnauthorized: false,
+		maxCachedSessions: 0
+	});
+	return (options, callback) => connect(options, (error, socket) => {
+		if (error !== null) return callback(error, null);
+		if (socket instanceof tls.TLSSocket && !chainFingerprints(socket).includes(fingerprint)) {
+			socket.destroy();
+			return callback(Object.assign(/* @__PURE__ */ new Error(`The certificate presented by ${options.hostname} doesn't match the pinned fingerprint ${fingerprint}.`), { code: PINNING_ERROR_CODE }), null);
+		}
+		callback(null, socket);
+	});
+};
+/** An undici-backed `HttpClient` applying {@link TlsOptions}. The dispatcher closes with the scope. */
+const make = (options = {}) => NodeHttpClient.makeDispatcherOptions(options.certFingerprint !== void 0 ? { connect: pinnedConnector(options.certFingerprint) } : options.insecure ? { connect: { rejectUnauthorized: false } } : void 0).pipe(Effect.flatMap((dispatcher) => NodeHttpClient.makeUndici.pipe(Effect.provideService(NodeHttpClient.Dispatcher, dispatcher))));
+var CertificateInspectionError = class extends Data.TaggedError("CertificateInspectionError") {};
+/**
+* Connects to an `https:` URL without verifying it and reports the
+* certificate it presents, so `configure` can offer to pin it.
+*/
+const inspectCertificate = (url) => Effect.callback((resume) => {
+	const { hostname, port } = new URL(url);
+	const host = hostname.replace(/^\[|\]$/g, "");
+	const socket = tls.connect({
+		host,
+		port: Number(port || 443),
+		rejectUnauthorized: false,
+		...net.isIP(host) === 0 ? { servername: host } : {}
+	});
+	socket.setTimeout(1e4, () => socket.destroy(/* @__PURE__ */ new Error(`Timed out connecting to ${url}.`)));
+	socket.once("secureConnect", () => {
+		const cert = socket.getPeerCertificate();
+		resume(Effect.succeed({
+			trusted: socket.authorized,
+			fingerprint: cert.fingerprint256,
+			subject: String(cert.subject?.CN ?? cert.subjectaltname ?? "unknown"),
+			validTo: cert.valid_to
+		}));
+		socket.end();
+	});
+	socket.once("error", (cause) => resume(Effect.fail(new CertificateInspectionError({
+		message: cause.message,
+		cause
+	}))));
+	return Effect.sync(() => socket.destroy());
+});
+// src/Connection.ts
+const SITE_MANAGER_URL = "https://api.ui.com";
+/** Integration API base URL through the cloud connector. */
+const connectorBaseUrl = (consoleId) => `${SITE_MANAGER_URL}/v1/connector/consoles/${encodeURIComponent(consoleId)}/proxy/network/integration`;
+/** Integration API base URLs to try for a connection: a UniFi OS console's, then a standalone controller's. */
+const candidateBaseUrls = (connection) => connection.type === "remote" ? [connectorBaseUrl(connection.consoleId)] : [`${connection.url}/proxy/network/integration`, `${connection.url}/integration`];
+/** The SDK's default retry policy, minus certificate failures, which retrying won't fix. */
+const probeRetry = (lastError) => {
+	const defaults = Sdk.Retry.makeDefault(lastError);
+	return {
+		...defaults,
+		while: (error) => (defaults.while?.(error) ?? false) && !isCertificateError(error)
+	};
+};
+/** The connector allows 100 requests/minute per console; stay under it. */
+const REMOTE_REQUESTS_PER_MINUTE = 90;
+/** Joins an error's message with its causes' (e.g. a transport error and the TLS failure behind it). */
+const describeError = (error) => {
+	const messages = [];
+	for (let e = error, depth = 0; e !== void 0 && e !== null && depth < 5; depth++) {
+		const message = typeof e === "object" && "message" in e ? String(e.message) : String(e);
+		if (message !== "" && !messages.some((m) => m.includes(message))) messages.push(message);
+		e = typeof e === "object" && "cause" in e ? e.cause : void 0;
+	}
+	return messages.join(": ") || "unknown error";
+};
+const describeTarget = (connection) => connection.type === "remote" ? `console ${connection.consoleId} via ${SITE_MANAGER_URL}` : connection.url;
+const rateLimited = (client, key) => Effect.gen(function* () {
+	const limiter = yield* RateLimiter.make.pipe(Effect.provide(RateLimiter.layerStoreMemory));
+	const wait = RateLimiter.sleep(limiter, {
+		algorithm: "token-bucket",
+		window: "1 minute",
+		limit: REMOTE_REQUESTS_PER_MINUTE,
+		key
+	}).pipe(Effect.orDie);
+	return HttpClient.transform(client, (response) => Effect.andThen(wait, response));
+});
+/**
+* Builds a client for the connection and finds the Integration API: local
+* connections try the console path, then the standalone controller path.
+* Fails with a `ConfigError` describing what went wrong. `options.client`
+* replaces the TLS-configured client (for tests).
+*/
+const connect = (connection, options = {}) => Effect.gen(function* () {
+	const base = options.client ?? (yield* make(connection.type === "local" ? connection : {}));
+	const client = connection.type === "remote" ? yield* rateLimited(base, `connector:${connection.consoleId}`) : base;
+	const servicesFor = (baseUrl) => Context.make(Sdk.Credentials, Effect.succeed({
+		baseUrl,
+		apiKey: connection.apiKey
+	})).pipe(Context.add(HttpClient.HttpClient, client));
+	const candidates = candidateBaseUrls(connection);
+	for (const baseUrl of candidates) {
+		const services = servicesFor(baseUrl);
+		const info = yield* Sdk.getInfo({}).pipe(Effect.provide(services), Sdk.Retry.policy(probeRetry), Effect.map(({ applicationVersion }) => ({
+			baseUrl,
+			applicationVersion,
+			services
+		})), Effect.catchTag("NotFound", () => Effect.undefined), Effect.mapError((error) => Sdk.ConfigError.make({ message: error._tag === "Unauthorized" || error._tag === "Forbidden" ? `${describeTarget(connection)} rejected the API key (${error._tag}).` : `Could not connect to ${describeTarget(connection)}: ${describeError(error)}` })));
+		if (info !== void 0) return info;
+	}
+	return yield* Sdk.ConfigError.make({ message: connection.type === "remote" ? `The cloud connector found no UniFi Network application on console ${connection.consoleId}.` : `No UniFi Network Integration API at ${connection.url} (tried ${candidates.join(", ")}). Use the console's root URL, e.g. https://192.168.1.1.` });
+});
+const majorMinor = (version) => version.split(".").slice(0, 2).join(".");
+/** Patch releases routinely ship without a published spec, so only major.minor drift is worth a warning. */
+const checkVersion = (applicationVersion) => majorMinor(applicationVersion) === majorMinor(Sdk.SPEC_VERSION) ? Effect.void : Effect.logWarning(`UniFi Network ${applicationVersion} is newer or older than the API spec this provider was built from (${Sdk.SPEC_VERSION}). Resources may not behave as documented.`);
+/**
+* The profile's established connection, created on first use and shared for
+* the rest of the run. Provider-private: its `HttpClient` and SDK
+* `Credentials` never enter the stack's context, so they can't replace other
+* providers' clients.
+*/
+var UnifiNetworkConnection = class extends Context.Service()("UnifiNetwork::Connection") {};
+const layer$1 = Layer.effect(UnifiNetworkConnection, Effect.gen(function* () {
+	const credentials = yield* UnifiNetworkCredentials;
+	const scope = yield* Effect.scope;
+	return yield* Effect.cached(credentials.pipe(Effect.flatMap(({ connection }) => connect(connection)), Effect.tap(({ applicationVersion }) => checkVersion(applicationVersion)), Scope.provide(scope)));
+}));
+/**
+* The 422 "Configured network does not exist" the console answers requests
+* with, on any endpoint, for a moment while networks are created or deleted
+* anywhere on it (seen on the test controller under parallel tests, for
+* network, zone and policy requests alike). It's never a real error, so it's
+* retried; other 422s are.
+*/
+const isStaleNetworkState = (error) => Predicate.hasProperty(error, "_tag") && error._tag === "UnprocessableEntity" && Predicate.hasProperty(error, "message") && typeof error.message === "string" && error.message.includes("Configured network does not exist");
+/** Runs SDK operations against the profile's console, retrying the console's transient stale-network 422. */
+const withConnection = (effect) => Effect.gen(function* () {
+	const { services } = yield* yield* UnifiNetworkConnection;
+	return yield* Effect.provide(effect, services).pipe(Effect.retry({
+		while: isStaleNetworkState,
+		schedule: Schedule.spaced("500 millis").pipe(Schedule.upTo({ times: 10 }))
+	}));
+});
+// src/SiteManager.ts
+/**
+* Just enough of the Site Manager API (`GET /v1/hosts`) for `configure` to
+* list the consoles a key can reach. A full SDK belongs in its own package.
+*/
+const Host = Schema.Struct({
+	id: Schema.String,
+	type: Schema.optional(Schema.NullOr(Schema.String)),
+	reportedState: Schema.optional(Schema.NullOr(Schema.Struct({
+		name: Schema.optional(Schema.NullOr(Schema.String)),
+		hostname: Schema.optional(Schema.NullOr(Schema.String))
+	})))
+});
+const HostsPage = Schema.Struct({
+	data: Schema.Array(Host),
+	nextToken: Schema.optional(Schema.NullOr(Schema.String))
+});
+const listConsoles = (apiKey) => Effect.gen(function* () {
+	const client = (yield* HttpClient.HttpClient).pipe(HttpClient.filterStatusOk);
+	const consoles = [];
+	let nextToken;
+	do {
+		const page = yield* client.execute(HttpClientRequest.get(`${SITE_MANAGER_URL}/v1/hosts`).pipe(HttpClientRequest.setHeaders({
+			"X-API-KEY": Redacted.value(apiKey),
+			Accept: "application/json"
+		}), HttpClientRequest.setUrlParams(nextToken === void 0 ? {} : { nextToken }))).pipe(Effect.flatMap(HttpClientResponse.schemaBodyJson(HostsPage)));
+		for (const host of page.data) consoles.push({
+			id: host.id,
+			name: host.reportedState?.name ?? host.reportedState?.hostname ?? host.id,
+			type: host.type ?? void 0
+		});
+		nextToken = page.nextToken ?? void 0;
+	} while (nextToken !== void 0);
+	return consoles;
+});
+// src/AuthProvider.ts
+const NAME = UNIFI_NETWORK_AUTH_PROVIDER_NAME;
+const authError = (message, cause) => AuthError.make({
+	message: `${NAME}: ${message}`,
+	...cause === void 0 ? {} : { cause }
+});
+/** Normalises a console URL (no trailing slash), or returns `undefined` if it isn't `http(s):`. */
+const parseConsoleUrl = (value) => {
+	try {
+		const url = new URL(value.trim());
+		if (url.protocol !== "http:" && url.protocol !== "https:") return void 0;
+		return `${url.origin}${url.pathname.replace(/\/+$/, "")}`;
+	} catch {
+		return;
+	}
+};
+const parseBoolean = (value) => /^(true|1|yes)$/i.test(value) ? true : /^(false|0|no|)$/i.test(value) ? false : void 0;
+const validateUrl = (value) => parseConsoleUrl(value) === void 0 ? "Expected an http(s) URL such as https://192.168.1.1" : void 0;
+const validateFingerprint = (value) => normaliseFingerprint(value) === void 0 ? "Expected a SHA-256 fingerprint: 64 hex digits, optionally colon-separated" : void 0;
+const validateBoolean = (value) => parseBoolean(value) === void 0 ? "Expected true or false" : void 0;
+const required = (value) => value.length === 0 ? "Required" : void 0;
+/** Validates stored, entered or environment values. `source` names them in errors. */
+const resolve = (input, source) => Effect.gen(function* () {
+	const site = input.site || void 0;
+	if (input.method === "remote") {
+		if (!input.consoleId) return yield* authError(`no console ID (${source}).`);
+		return {
+			connection: {
+				type: "remote",
+				consoleId: input.consoleId,
+				apiKey: input.apiKey
+			},
+			site
+		};
+	}
+	const url = parseConsoleUrl(input.url ?? "");
+	if (url === void 0) return yield* authError(`'${input.url ?? ""}' is not an http(s) URL (${source}).`);
+	const certFingerprint = input.certFingerprint === void 0 ? void 0 : normaliseFingerprint(input.certFingerprint);
+	if (input.certFingerprint !== void 0 && certFingerprint === void 0) return yield* authError(`'${input.certFingerprint}' is not a SHA-256 fingerprint (${source}).`);
+	if (certFingerprint !== void 0 && input.insecure) return yield* authError(`set a certificate fingerprint or insecure, not both (${source}).`);
+	if (certFingerprint !== void 0 && url.startsWith("http:")) return yield* authError(`a certificate fingerprint needs an https: URL (${source}).`);
+	return {
+		connection: {
+			type: "local",
+			url,
+			apiKey: input.apiKey,
+			certFingerprint,
+			insecure: input.insecure ?? false
+		},
+		site
+	};
+});
+const fromConfig = (profileName, config) => resolve({
+	...config,
+	apiKey: Redacted.make(config.apiKey)
+}, `profile '${profileName}'`).pipe(Effect.map((settings) => ({
+	...settings,
+	source: {
+		type: "profile",
+		profile: profileName
+	}
+})));
+const toConfig = ({ connection, site }) => connection.type === "remote" ? {
+	method: "remote",
+	consoleId: connection.consoleId,
+	apiKey: Redacted.value(connection.apiKey),
+	...site === void 0 ? {} : { site }
+} : {
+	method: "local",
+	url: connection.url,
+	apiKey: Redacted.value(connection.apiKey),
+	...connection.certFingerprint === void 0 ? {} : { certFingerprint: connection.certFingerprint },
+	...connection.insecure ? { insecure: true } : {},
+	...site === void 0 ? {} : { site }
+};
+const siteField = {
+	name: "site",
+	label: "Default site",
+	description: "Only for consoles hosting several sites: internal reference (e.g. default) or name of the site resources use when they don't set one.",
+	optional: true
+};
+const configureMethods = [{
+	method: "local",
+	fields: [
+		{
+			name: "url",
+			label: "Console URL",
+			placeholder: "https://192.168.1.1",
+			validate: validateUrl
+		},
+		{
+			name: "apiKey",
+			label: "API key",
+			secret: true
+		},
+		{
+			name: "certFingerprint",
+			label: "Certificate SHA-256 fingerprint",
+			description: "Pin the console's certificate (or a CA in its chain) instead of verifying it.",
+			optional: true,
+			validate: validateFingerprint
+		},
+		{
+			name: "insecure",
+			label: "Skip TLS verification",
+			optional: true,
+			validate: validateBoolean
+		},
+		siteField
+	]
+}, {
+	method: "remote",
+	fields: [
+		{
+			name: "consoleId",
+			label: "Console ID",
+			description: "The console's host ID in Site Manager."
+		},
+		{
+			name: "apiKey",
+			label: "Site Manager API key",
+			secret: true
+		},
+		siteField
+	]
+}];
+const environment = [
+	{
+		name: "UNIFI_URL",
+		required: true,
+		alternatives: ["UNIFI_CONSOLE_ID"],
+		description: "URL of the console or controller, e.g. https://192.168.1.1. To go through the ui.com cloud connector instead, set UNIFI_CONSOLE_ID to the console's host ID."
+	},
+	{
+		name: "UNIFI_API_KEY",
+		required: true,
+		secret: true,
+		description: "A Network API key (local) or a Site Manager API key (remote)."
+	},
+	{
+		name: "UNIFI_CERT_FINGERPRINT",
+		required: false,
+		description: "Local only: SHA-256 fingerprint of the console's certificate (or a CA in its chain) to pin."
+	},
+	{
+		name: "UNIFI_INSECURE",
+		required: false,
+		description: "Local only: true to skip TLS verification."
+	},
+	{
+		name: "UNIFI_SITE",
+		required: false,
+		description: "Default site, for consoles hosting several. Unset means the console's only site."
+	}
+];
+const readEnvironment = Effect.gen(function* () {
+	const apiKey = yield* getEnvRedactedRequired("UNIFI_API_KEY");
+	const url = yield* getEnv("UNIFI_URL");
+	const consoleId = yield* getEnv("UNIFI_CONSOLE_ID");
+	const site = yield* getEnv("UNIFI_SITE");
+	if (url && consoleId) return yield* authError("set UNIFI_URL or UNIFI_CONSOLE_ID, not both.");
+	if (consoleId) return yield* resolve({
+		method: "remote",
+		consoleId,
+		apiKey,
+		site
+	}, "UNIFI_* environment variables");
+	if (!url) return yield* authError("set UNIFI_URL (local) or UNIFI_CONSOLE_ID (remote) along with UNIFI_API_KEY.");
+	const insecureValue = (yield* getEnv("UNIFI_INSECURE")) ?? "";
+	const insecure = parseBoolean(insecureValue);
+	if (insecure === void 0) return yield* authError(`UNIFI_INSECURE must be true or false, not '${insecureValue}'.`);
+	const certFingerprint = (yield* getEnv("UNIFI_CERT_FINGERPRINT")) || void 0;
+	return yield* resolve({
+		method: "local",
+		url,
+		apiKey,
+		certFingerprint,
+		insecure,
+		site
+	}, "UNIFI_* environment variables");
+}).pipe(Effect.map((settings) => ({
+	...settings,
+	source: { type: "env" }
+})));
+/** Runs `f` against a freshly established connection, mapping connection failures to `AuthError`. */
+const withEstablished = (connection, f) => Effect.scoped(Effect.flatMap(connect(connection), f)).pipe(Effect.mapError((error) => error instanceof AuthError ? error : authError(describeError(error), error)));
+const configureWith = (_profileName, input) => Effect.gen(function* () {
+	const method = configureMethods.find((m) => m.method === input.method);
+	if (method === void 0) return yield* authError(`unknown method '${input.method}'. Valid methods: local, remote.`);
+	const values = yield* validateFieldValues(NAME, method.fields, input.values);
+	const insecure = storedValueText(values["insecure"]);
+	const resolved = yield* resolve({
+		method: method.method === "remote" ? "remote" : "local",
+		url: storedValueText(values["url"]),
+		consoleId: storedValueText(values["consoleId"]),
+		apiKey: storedSecret(values["apiKey"]) ?? Redacted.make(""),
+		certFingerprint: storedValueText(values["certFingerprint"]),
+		insecure: insecure === void 0 ? void 0 : parseBoolean(insecure),
+		site: storedValueText(values["site"])
+	}, "--set values");
+	return toConfig(resolved);
+});
+const details = (profileName, config) => Effect.gen(function* () {
+	const { connection, site } = yield* fromConfig(profileName, config);
+	const lines = connection.type === "remote" ? [{
+		key: "method",
+		value: "remote (ui.com cloud connector)"
+	}, {
+		key: "consoleId",
+		value: connection.consoleId
+	}] : [
+		{
+			key: "method",
+			value: "local"
+		},
+		{
+			key: "url",
+			value: connection.url
+		},
+		{
+			key: "tls",
+			value: connection.url.startsWith("http:") ? "none (http)" : connection.certFingerprint !== void 0 ? `pinned ${connection.certFingerprint}` : connection.insecure ? "not verified" : "verified"
+		}
+	];
+	lines.push({
+		key: "apiKey",
+		value: displayRedacted(connection.apiKey)
+	});
+	if (site !== void 0) lines.push({
+		key: "site",
+		value: site
+	});
+	const network = yield* withEstablished(connection, (established) => Effect.succeed(`UniFi Network ${established.applicationVersion}`)).pipe(Effect.catch((error) => Effect.succeed(`unreachable (${error.message})`)));
+	lines.push({
+		key: "network",
+		value: network
+	});
+	return { lines };
+});
+const UnifiNetworkAuth = AuthProviderLayer()(NAME, Effect.gen(function* () {
+	const interaction = Interaction.accessors;
+	/**
+	* Lists the console's sites and, if there are several, lets the user
+	* pick the default (remembering `current`). A single site isn't stored.
+	*/
+	const pickSite = (connection, current) => Effect.gen(function* () {
+		const { applicationVersion, sites } = yield* withEstablished(connection, (established) => Sdk.getSiteOverviewPage({ limit: 200 }).pipe(Effect.provide(established.services), Effect.map((page) => ({
+			applicationVersion: established.applicationVersion,
+			sites: page.data
+		}))));
+		yield* interaction.output.info(`Connected to UniFi Network ${applicationVersion}.`);
+		const [only] = sites;
+		if (only === void 0) return yield* authError("the console has no sites.");
+		if (sites.length === 1) {
+			yield* interaction.output.info(`The console has one site, ${only.name}; resources will use it.`);
+			return;
+		}
+		return yield* interaction.prompt.select({
+			message: "Default site",
+			searchable: true,
+			...current !== void 0 && sites.some((s) => s.internalReference === current) ? { initialValue: current } : {},
+			options: sites.map((s) => ({
+				value: s.internalReference,
+				label: s.name,
+				description: s.internalReference
+			}))
+		}).pipe(mapPromptCancellation);
+	});
+	const promptApiKey = (message, description) => interaction.prompt.password({
+		message,
+		description,
+		validate: required
+	}).pipe(mapPromptCancellation, Effect.map(Redacted.make));
+	const configureLocal = (current) => Effect.gen(function* () {
+		const url = yield* interaction.prompt.text({
+			message: "Console URL",
+			description: "The console's or self-hosted controller's address on your network.",
+			placeholder: "https://192.168.1.1",
+			...current?.method === "local" ? { defaultValue: current.url } : {},
+			validate: validateUrl
+		}).pipe(mapPromptCancellation, Effect.map((value) => parseConsoleUrl(value) ?? value));
+		const apiKey = yield* promptApiKey("API key", "Create one in UniFi Network under Settings → Integrations.");
+		let tls = {};
+		if (url.startsWith("https:")) {
+			const cert = yield* inspectCertificate(url).pipe(Effect.mapError((error) => authError(`could not connect to ${url}: ${describeError(error)}`, error)));
+			if (cert.trusted) yield* interaction.output.info("The console's certificate is publicly trusted; it will be verified normally.");
+			else tls = (yield* interaction.prompt.select({
+				message: `${url} presents an untrusted certificate (${cert.subject}, valid until ${cert.validTo})`,
+				options: [{
+					value: "pin",
+					label: "Pin this certificate",
+					description: `SHA-256 ${cert.fingerprint}. Check it matches the console's before choosing this.`
+				}, {
+					value: "insecure",
+					label: "Skip verification",
+					description: "Accept any certificate. Anyone on the network path could intercept the API key."
+				}]
+			}).pipe(mapPromptCancellation)) === "pin" ? { certFingerprint: cert.fingerprint } : { insecure: true };
+		}
+		const resolved = yield* resolve({
+			method: "local",
+			url,
+			apiKey,
+			...tls
+		}, "entered values");
+		const site = yield* pickSite(resolved.connection, current?.site);
+		return toConfig({
+			...resolved,
+			site
+		});
+	});
+	const configureRemote = (current) => Effect.gen(function* () {
+		const apiKey = yield* promptApiKey("Site Manager API key", "Create one at unifi.ui.com under API.");
+		const consoles = yield* Effect.scoped(make().pipe(Effect.flatMap((client) => listConsoles(apiKey).pipe(Effect.provideService(HttpClient.HttpClient, client))))).pipe(Effect.mapError((error) => authError(`could not list consoles: ${describeError(error)}`, error)));
+		const [only] = consoles;
+		if (only === void 0) return yield* authError("this API key can't see any consoles.");
+		const consoleId = consoles.length === 1 ? only.id : yield* interaction.prompt.select({
+			message: "Console",
+			searchable: true,
+			...current?.method === "remote" && consoles.some((c) => c.id === current.consoleId) ? { initialValue: current.consoleId } : {},
+			options: consoles.map((c) => ({
+				value: c.id,
+				label: c.name,
+				description: c.type === void 0 ? c.id : `${c.type} · ${c.id}`
+			}))
+		}).pipe(mapPromptCancellation);
+		if (consoles.length === 1) yield* interaction.output.info(`Using console ${only.name}.`);
+		const resolved = yield* resolve({
+			method: "remote",
+			consoleId,
+			apiKey
+		}, "entered values");
+		const site = yield* pickSite(resolved.connection, current?.site);
+		return toConfig({
+			...resolved,
+			site
+		});
+	});
+	const configure = (_profileName, current) => Effect.gen(function* () {
+		const config = yield* (yield* interaction.prompt.select({
+			message: "How should Alchemy reach the console?",
+			initialValue: current?.method ?? "local",
+			options: [{
+				value: "local",
+				label: "Directly",
+				description: "the console's or controller's URL on your network"
+			}, {
+				value: "remote",
+				label: "Through ui.com",
+				description: "the api.ui.com cloud connector, from anywhere"
+			}]
+		}).pipe(mapPromptCancellation)) === "local" ? configureLocal(current) : configureRemote(current);
+		yield* interaction.output.success(`${NAME}: credentials saved.`);
+		return config;
+	});
+	return {
+		configSchema: UnifiNetworkAuthConfigSchema,
+		configure,
+		configureWith,
+		configureMethods,
+		login: (_profileName, config) => Effect.succeed(config),
+		logout: () => Effect.void,
+		details,
+		read: fromConfig,
+		readEnvironment,
+		environment
+	};
+}));
+// src/internal/Fields.ts
+/** `value` with every `Redacted` unwrapped, recursively, so passphrases compare by contents. */
+const unwrap = (value) => {
+	if (Redacted.isRedacted(value)) return Redacted.value(value);
+	if (Array.isArray(value)) return value.map(unwrap);
+	if (typeof value === "object" && value !== null) return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, unwrap(nested)]));
+	return value;
+};
+/**
+* Whether the console's object is exactly the desired body: same fields,
+* same values, recursively (key order and `Redacted` wrappers aside; unset
+* fields must be absent on both sides). Leave read-only fields out of
+* `observed` first.
+*/
+const isCurrent = (desired, observed) => deepEqual(unwrap(desired), unwrap(observed));
+/**
+* `value` with every array sorted, recursively, for fields whose arrays are
+* sets: the console keeps them in an order of its own (e.g. a firewall
+* policy's port list), so order mustn't count as a difference.
+*/
+const sortArrays = (value) => {
+	if (Array.isArray(value)) return value.map(sortArrays).toSorted((a, b) => JSON.stringify(a).localeCompare(JSON.stringify(b)));
+	if (typeof value === "object" && value !== null && !Redacted.isRedacted(value)) return Object.fromEntries(Object.entries(value).map(([key, nested]) => [key, sortArrays(nested)]));
+	return value;
+};
+/** `record` without `keys`, e.g. read-only fields the console rejects in request bodies. */
+const omitKeys = (record, keys) => Object.fromEntries(Object.entries(record).filter(([key]) => !keys.includes(key)));
+// src/internal/Plan.ts
+/** A prop whose value depends on another resource's output, so isn't known while planning. */
+const UNKNOWN = Symbol("UnifiNetwork.unknown");
+/**
+* A top-level prop of `diff`'s `news` (props that may still hold outputs of
+* resources not yet deployed): its value, `undefined` when unset, or
+* {@link UNKNOWN}.
+*/
+const planned = (news, key) => {
+	if (typeof news !== "object" || news === null) return UNKNOWN;
+	const value = Predicate.hasProperty(news, key) ? news[key] : void 0;
+	return isResolved(value) ? value : UNKNOWN;
+};
+/** {@link planned} for string props such as `site`. */
+const plannedString = (news, key) => {
+	const value = planned(news, key);
+	return value === UNKNOWN || value === void 0 || typeof value === "string" ? value : UNKNOWN;
+};
+// src/internal/Services.ts
+/**
+* The provider's services, captured when the provider is built, as a
+* function that runs a handler with them. Handlers then don't depend on
+* what the stack's merged context happens to hold when they run.
+*/
+const captureServices = Effect.map(Effect.context(), (services) => (effect) => Effect.provide(effect, services));
+// src/ReadCache.ts
+var ReadCache_exports = /* @__PURE__ */ __exportAll({
+	UnifiNetworkReadCache: () => UnifiNetworkReadCache,
+	cached: () => cached,
+	invalidate: () => invalidate,
+	invalidating: () => invalidating,
+	key: () => key,
+	layer: () => layer
+});
+/**
+* Per-run memo of API reads, so a plan touching many resources lists each
+* collection once instead of once per resource. One instance per
+* `providers()` build, i.e. per CLI run or test file. The value is only an
+* identity: entries live on each {@link Key}, keyed by it.
+*/
+var UnifiNetworkReadCache = class extends Context.Service()("UnifiNetwork::ReadCache") {};
+const layer = Layer.sync(UnifiNetworkReadCache, () => ({ run: {} }));
+const key = (name) => ({
+	name,
+	entries: /* @__PURE__ */ new WeakMap()
+});
+const entriesFor = (cacheKey, run) => {
+	const existing = cacheKey.entries.get(run);
+	if (existing !== void 0) return existing;
+	const entries = /* @__PURE__ */ new Map();
+	cacheKey.entries.set(run, entries);
+	return entries;
+};
+/**
+* `load`'s result, shared by every caller in this run until invalidated.
+* Concurrent callers wait for one load. Failures aren't cached.
+*/
+const cached = (cacheKey, scope, load) => Effect.gen(function* () {
+	const { run } = yield* UnifiNetworkReadCache;
+	const entries = entriesFor(cacheKey, run);
+	const existing = entries.get(scope);
+	if (existing !== void 0) return yield* Deferred.await(existing);
+	const deferred = Deferred.makeUnsafe();
+	entries.set(scope, deferred);
+	return yield* load.pipe(Effect.onExit((exit) => {
+		if (Exit.isFailure(exit) && entries.get(scope) === deferred) entries.delete(scope);
+		return Deferred.done(deferred, exit);
+	}));
+});
+/** Drops an entry, so the next read loads afresh. */
+const invalidate = (cacheKey, scope) => Effect.gen(function* () {
+	const { run } = yield* UnifiNetworkReadCache;
+	cacheKey.entries.get(run)?.delete(scope);
+});
+/** Runs a write, then invalidates the entry it affects, whether or not the write succeeded. */
+const invalidating = (cacheKey, scope) => (write) => Effect.ensuring(write, invalidate(cacheKey, scope));
+// src/Site.ts
+const describeSites = (sites) => sites.map((site) => `${site.internalReference} (${site.name})`).join(", ") || "none";
+var SiteNotFound = class extends Data.TaggedError("SiteNotFound") {
+	[UserFacingError] = true;
+	get message() {
+		return `The console has no site "${this.site}". Its sites: ${describeSites(this.available)}. Point the profile's site, or the resource's site prop, at one of them.`;
+	}
+};
+var SiteRequired = class extends Data.TaggedError("SiteRequired") {
+	[UserFacingError] = true;
+	get message() {
+		return `The console hosts several sites (${describeSites(this.available)}), so resources need one: set site in the profile (alchemy profile edit --reconfigure UnifiNetwork), or the resource's site prop.`;
+	}
+};
+var AmbiguousSite = class extends Data.TaggedError("AmbiguousSite") {
+	[UserFacingError] = true;
+	get message() {
+		return `Several sites are named "${this.site}" (${describeSites(this.matches)}). Use the internal reference instead.`;
+	}
+};
+/** A resource referenced another that lives in a different site. */
+var CrossSiteReference = class extends Data.TaggedError("CrossSiteReference") {
+	[UserFacingError] = true;
+	get message() {
+		return `The referenced ${this.what} is in another site (${this.referencedSiteId}), not ${this.site.internalReference} (${this.site.name}). UniFi objects can only reference objects in their own site.`;
+	}
+};
+/** Fails if a reference carries a site ID (resources and lookups do) other than `site`'s. */
+const checkSameSite = (what, referencedSiteId, site) => referencedSiteId === void 0 || referencedSiteId === site.id ? Effect.void : Effect.fail(new CrossSiteReference({
+	what,
+	referencedSiteId,
+	site
+}));
+const loadSites = withConnection(Sdk.getSiteOverviewPage.items({}).pipe(Stream.map(({ id, internalReference, name }) => ({
+	id,
+	internalReference,
+	name
+})), Stream.runCollect));
+const sitesKey = key("sites");
+/** The console's sites, listed once per run. */
+const listSites = cached(sitesKey, "", loadSites);
+/**
+* The site a resource belongs to: `site` (an ID, internal reference or
+* name), else the profile's site, else the console's only site. Fails,
+* listing the console's sites, when it doesn't exist or is ambiguous, so a
+* plan stops before changing anything.
+*/
+const resolveSite = Effect.fn("UnifiNetwork.resolveSite")(function* (site) {
+	const requested = site ?? (yield* yield* UnifiNetworkCredentials).site;
+	const sites = yield* listSites;
+	if (requested === void 0) {
+		const [only] = sites;
+		if (only !== void 0 && sites.length === 1) return only;
+		return yield* new SiteRequired({ available: sites });
+	}
+	const byReference = sites.find((s) => s.id === requested || s.internalReference === requested);
+	if (byReference !== void 0) return byReference;
+	const byName = sites.filter((s) => s.name === requested);
+	const [match] = byName;
+	if (match !== void 0 && byName.length === 1) return match;
+	if (byName.length > 1) return yield* new AmbiguousSite({
+		site: requested,
+		matches: byName
+	});
+	return yield* new SiteNotFound({
+		site: requested,
+		available: sites
+	});
+});
+// src/DnsPolicy.ts
+const loadPolicies$1 = (siteId) => withConnection(Stream.runCollect(Sdk.getDnsPolicyPage.items({ siteId })));
+const policiesKey$1 = key("dnsPolicies");
+/** A site's DNS policies, listed once per run. */
+const listDnsPolicies = (siteId) => cached(policiesKey$1, siteId, loadPolicies$1(siteId));
+const toAttributes$6 = (siteId, policy) => {
+	const { id, metadata: _metadata, ...config } = policy;
+	return {
+		siteId,
+		dnsPolicyId: id,
+		type: policy.type,
+		domain: policy.domain,
+		config
+	};
+};
+/** Fields the console reports but rejects in request bodies. */
+const READ_ONLY$4 = ["id", "metadata"];
+/** A policy by ID, from the run's cached list, which returns whole policies (one request for every policy in a plan). */
+const getPolicy$1 = (siteId, dnsPolicyId) => listDnsPolicies(siteId).pipe(Effect.map((policies) => policies.find((p) => p.id === dnsPolicyId)));
+/**
+* The existing policy `body` describes: the only one with its type and
+* domain, or, when a domain has several records of that type (e.g. two A
+* records), the only one of those whose other fields match too.
+*/
+const findExisting = (policies, body) => {
+	const sameName = policies.filter((p) => p.type === body.type && p.domain === body.domain);
+	const candidates = sameName.length > 1 ? sameName.filter((p) => isCurrent(body, omitKeys(p, READ_ONLY$4))) : sameName;
+	const [policy] = candidates;
+	return candidates.length === 1 ? policy : void 0;
+};
+/**
+* A local DNS record or forwarding rule on the gateway. DNS policies have no
+* name, so existing ones are adopted with `--adopt` by type and domain (and,
+* when a domain has several records of that type, by their values).
+* Changing `type` updates the policy in place.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		yield* UnifiNetwork.DnsPolicy("home-assistant", {
+* 			type: "A_RECORD",
+* 			enabled: true,
+* 			domain: "ha.home.arpa",
+* 			ipv4Address: "192.168.2.20",
+* 			ttlSeconds: 300,
+* 		});
+* 	}),
+* );
+* ```
+*/
+const DnsPolicy = Resource("UnifiNetwork.DnsPolicy");
+const DnsPolicyProvider = () => Provider.effect(DnsPolicy, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return DnsPolicy.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			return (yield* listDnsPolicies(site.id)).map((policy) => toAttributes$6(site.id, policy));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const policy = yield* getPolicy$1(output.siteId, output.dnsPolicyId);
+				return policy === void 0 ? void 0 : toAttributes$6(output.siteId, policy);
+			}
+			const site = yield* resolveSite(olds.site);
+			const { site: _site, ...body } = olds;
+			const policy = findExisting(yield* listDnsPolicies(site.id), body);
+			return policy === void 0 ? void 0 : Unowned(toAttributes$6(site.id, policy));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			const siteProp = plannedString(news, "site");
+			if (output === void 0 || siteProp === UNKNOWN) return void 0;
+			if ((yield* resolveSite(siteProp)).id !== output.siteId) return { action: "replace" };
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const { site: _site, ...body } = news;
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getPolicy$1(site.id, output.dnsPolicyId) : void 0;
+			const write = invalidating(policiesKey$1, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createDnsPolicy({
+					siteId: site.id,
+					body
+				})).pipe(write);
+				return toAttributes$6(site.id, created);
+			}
+			if (isCurrent(body, omitKeys(observed, READ_ONLY$4))) return toAttributes$6(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateDnsPolicy({
+				siteId: site.id,
+				dnsPolicyId: observed.id,
+				body
+			})).pipe(write);
+			return toAttributes$6(site.id, updated);
+		})),
+		delete: ({ output }) => run(withConnection(Sdk.deleteDnsPolicy({
+			siteId: output.siteId,
+			dnsPolicyId: output.dnsPolicyId
+		})).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void), invalidating(policiesKey$1, output.siteId)))
+	});
+}));
+// src/internal/Networks.ts
+/** A site's networks, uncached. */
+const loadNetworks = (siteId) => withConnection(Stream.runCollect(Sdk.getNetworksOverviewPage.items({ siteId })));
+// src/Lookup.ts
+/** A `lookup` found nothing matching its query. */
+var LookupNotFound = class extends Data.TaggedError("LookupNotFound") {
+	[UserFacingError] = true;
+	get message() {
+		return `No ${this.resource} matches ${this.query} in site ${this.site.internalReference} (${this.site.name}).`;
+	}
+};
+/** A `lookup` matched several objects, e.g. networks sharing a name. */
+var LookupAmbiguous = class extends Data.TaggedError("LookupAmbiguous") {
+	[UserFacingError] = true;
+	get message() {
+		return `${this.count} ${this.resource}s match ${this.query} in site ${this.site.internalReference} (${this.site.name}). Use a more specific query.`;
+	}
+};
+const describeQuery = (query) => Object.entries(query).filter(([key, value]) => key !== "site" && value !== void 0).map(([key, value]) => `${key} ${JSON.stringify(value)}`).join(" and ");
+// src/FirewallZone.ts
+const loadZones = (siteId) => withConnection(Stream.runCollect(Sdk.getFirewallZones.items({ siteId })));
+const zonesKey = key("firewallZones");
+/** A site's zones, built-in ones included, listed once per run. */
+const listFirewallZones = (siteId) => cached(zonesKey, siteId, loadZones(siteId));
+const toAttributes$5 = (siteId, zone) => ({
+	siteId,
+	firewallZoneId: zone.id,
+	name: zone.name
+});
+const isBuiltin = (zone) => zone.metadata.origin === "SYSTEM_DEFINED";
+/** The zone ID a reference means in `site`. */
+const resolveFirewallZone = Effect.fn("UnifiNetwork.resolveFirewallZone")(function* (reference, site) {
+	if ("firewallZoneId" in reference) {
+		yield* checkSameSite("firewall zone", reference.siteId, site);
+		return reference.firewallZoneId;
+	}
+	const zone = (yield* listFirewallZones(site.id)).find((z) => isBuiltin(z) && z.name === reference.builtinFirewallZone);
+	if (zone === void 0) return yield* new LookupNotFound({
+		resource: "built-in firewall zone",
+		query: `name "${reference.builtinFirewallZone}" (has the site been migrated to zone-based firewall?)`,
+		site
+	});
+	return zone.id;
+});
+const builtin = (name) => ({ builtinFirewallZone: name });
+/**
+* A custom zone in the zone-based firewall. Networks join zones through
+* `Network`'s `zone` prop; the zone doesn't list its networks, so the two
+* resources never fight over membership.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		const cameras = yield* UnifiNetwork.FirewallZone("cameras", { name: "Cameras" });
+* 		// Networks join zones from the network's side.
+* 		yield* UnifiNetwork.Network("cctv", {
+* 			management: "GATEWAY",
+* 			name: "CCTV",
+* 			vlanId: 30,
+* 			enabled: true,
+* 			cellularBackupEnabled: false,
+* 			internetAccessEnabled: false,
+* 			isolationEnabled: true,
+* 			zone: cameras, // or a built-in zone, e.g. UnifiNetwork.FirewallZone.INTERNAL
+* 			ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.30.1", prefixLength: 24 },
+* 		});
+* 	}),
+* );
+* ```
+*/
+const FirewallZone = Resource("UnifiNetwork.FirewallZone")({
+	INTERNAL: builtin("Internal"),
+	EXTERNAL: builtin("External"),
+	GATEWAY: builtin("Gateway"),
+	VPN: builtin("Vpn"),
+	HOTSPOT: builtin("Hotspot"),
+	DMZ: builtin("Dmz"),
+	/**
+	* Any zone in the site, built-in or custom, by name. Dies with a
+	* user-facing `LookupNotFound` if there's none: stack bodies can't fail
+	* with typed errors.
+	*/
+	lookup: Effect.fn("UnifiNetwork.FirewallZone.lookup")(function* (query) {
+		const site = yield* resolveSite(query.site);
+		const zone = (yield* listFirewallZones(site.id)).find((z) => z.name === query.name);
+		if (zone === void 0) return yield* new LookupNotFound({
+			resource: "firewall zone",
+			query: describeQuery(query),
+			site
+		});
+		return toAttributes$5(site.id, zone);
+	}, Effect.orDie)
+});
+const getZone = (siteId, firewallZoneId) => withConnection(Sdk.getFirewallZone({
+	siteId,
+	firewallZoneId
+})).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+/**
+* The networks in a zone, from the networks' own `zoneId`s. Updates replace
+* a zone's member list, and the zone's `networkIds` lags a network joining
+* it by a fraction of a second, so sending those back could detach a
+* network that just joined.
+*/
+const currentMembers = (siteId, firewallZoneId) => loadNetworks(siteId).pipe(Effect.map((networks) => networks.filter((n) => "zoneId" in n && n.zoneId === firewallZoneId).map((n) => n.id)));
+const FirewallZoneProvider = () => Provider.effect(FirewallZone, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return FirewallZone.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			return (yield* listFirewallZones(site.id)).filter((zone) => !isBuiltin(zone)).map((zone) => toAttributes$5(site.id, zone));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const zone = yield* getZone(output.siteId, output.firewallZoneId);
+				return zone === void 0 ? void 0 : toAttributes$5(output.siteId, zone);
+			}
+			const site = yield* resolveSite(olds.site);
+			const zone = (yield* listFirewallZones(site.id)).find((z) => !isBuiltin(z) && z.name === olds.name);
+			return zone === void 0 ? void 0 : Unowned(toAttributes$5(site.id, zone));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			const siteProp = plannedString(news, "site");
+			if (output === void 0 || siteProp === UNKNOWN) return void 0;
+			if ((yield* resolveSite(siteProp)).id !== output.siteId) return { action: "replace" };
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getZone(site.id, output.firewallZoneId) : void 0;
+			const write = invalidating(zonesKey, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createFirewallZone({
+					siteId: site.id,
+					name: news.name,
+					networkIds: []
+				})).pipe(write);
+				return toAttributes$5(site.id, created);
+			}
+			if (observed.name === news.name) return toAttributes$5(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateFirewallZone({
+				siteId: site.id,
+				firewallZoneId: observed.id,
+				name: news.name,
+				networkIds: yield* currentMembers(site.id, observed.id)
+			})).pipe(write);
+			return toAttributes$5(site.id, updated);
+		})),
+		delete: ({ output }) => run(withConnection(Sdk.deleteFirewallZone({
+			siteId: output.siteId,
+			firewallZoneId: output.firewallZoneId
+		})).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void), invalidating(zonesKey, output.siteId)))
+	});
+}));
+// src/Network.ts
+/** A change that would replace the site's default network, which can't be deleted. */
+var DefaultNetworkReplacement = class extends Data.TaggedError("DefaultNetworkReplacement") {
+	[UserFacingError] = true;
+	get message() {
+		return `${this.networkName} is the site's default network, which can't be replaced (${this.reason}). It must stay gateway-managed in its site.`;
+	}
+};
+const networksKey = key("networks");
+/** A site's networks, listed once per run. */
+const listNetworks = (siteId) => cached(networksKey, siteId, loadNetworks(siteId));
+const toAttributes$4 = (siteId, network) => {
+	const { id, metadata: _metadata, default: isDefault, ...config } = network;
+	return {
+		siteId,
+		networkId: id,
+		name: network.name,
+		vlanId: network.vlanId,
+		management: network.management,
+		zoneId: "zoneId" in network ? network.zoneId : void 0,
+		default: isDefault,
+		config
+	};
+};
+/** Fields the console reports but rejects in request bodies. */
+const READ_ONLY$3 = [
+	"id",
+	"metadata",
+	"default"
+];
+/**
+* `body` with explicit values for the two unset fields that can't simply be
+* left out (both verified):
+* - `mdnsForwardingEnabled`: a `PUT` without it keeps the console's value
+*   instead of resetting it, so the default (`true`, what the console sets on
+*   create) is always sent;
+* - a DHCP server's `domainName`: the console reports `""` when it's unset,
+*   so without the default the body would never match and every deploy
+*   would update it (and drift would report it) forever.
+*/
+const withDefaults$1 = (body) => {
+	if (body.management !== "GATEWAY") return body;
+	const dhcp = body.ipv4Configuration.dhcpConfiguration;
+	return {
+		...body,
+		mdnsForwardingEnabled: body.mdnsForwardingEnabled ?? true,
+		ipv4Configuration: {
+			...body.ipv4Configuration,
+			...dhcp?.mode === "SERVER" ? { dhcpConfiguration: {
+				...dhcp,
+				domainName: dhcp.domainName ?? ""
+			} } : {}
+		}
+	};
+};
+/** The request body for `props`, with references resolved to IDs. */
+const toBody$2 = Effect.fn(function* (props, site) {
+	switch (props.management) {
+		case "GATEWAY": {
+			const { site: _site, zone, ...rest } = props;
+			if (zone === void 0) return rest;
+			const zoneId = yield* resolveFirewallZone(zone, site);
+			return {
+				...rest,
+				zoneId
+			};
+		}
+		case "SWITCH": {
+			const { site: _site, device, ...rest } = props;
+			return {
+				...rest,
+				deviceId: device.deviceId
+			};
+		}
+		case "UNMANAGED": {
+			const { site: _site, ...rest } = props;
+			return rest;
+		}
+	}
+});
+/** The network ID a reference means in `site`. */
+const resolveNetwork = (reference, site) => checkSameSite("network", reference.siteId, site).pipe(Effect.as(reference.networkId));
+const getNetwork = (siteId, networkId) => withConnection(Sdk.getNetworkDetails({
+	siteId,
+	networkId
+})).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+/** The attributes of a network known to exist (e.g. from a list). */
+const attributesOf$1 = (siteId, networkId) => withConnection(Sdk.getNetworkDetails({
+	siteId,
+	networkId
+})).pipe(Effect.map((network) => toAttributes$4(siteId, network)));
+const isUserDefined$1 = (network) => network.metadata.origin === "USER_DEFINED";
+/**
+* A network (VLAN). `management` picks the kind: `"GATEWAY"` (routed by the
+* gateway), `"SWITCH"` (routed by a layer-3 switch) or `"UNMANAGED"`.
+* Changing it, or the site, replaces the network: the old one is deleted
+* first, since VLAN IDs must be unique.
+*
+* Props are authoritative: every update sends the whole network, with
+* explicit defaults for unset fields (`mdnsForwardingEnabled: true`, and a
+* DHCP server's `domainName: ""`), so changes made in the UI are put back.
+* The `config` attribute mirrors the console's object, so `alchemy drift`
+* sees them.
+* Existing networks are adopted by VLAN ID
+* with `--adopt` (and renamed to match), including the site's default
+* network (VLAN 1), which is never deleted or replaced.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		yield* UnifiNetwork.Network("guest", {
+* 			management: "GATEWAY",
+* 			name: "Guest",
+* 			vlanId: 12,
+* 			enabled: true,
+* 			cellularBackupEnabled: false,
+* 			internetAccessEnabled: true,
+* 			isolationEnabled: true,
+* 			zone: UnifiNetwork.FirewallZone.HOTSPOT,
+* 			ipv4Configuration: { autoScaleEnabled: false, hostIpAddress: "192.168.12.1", prefixLength: 24 },
+* 		});
+* 	}),
+* );
+* ```
+*/
+const Network = Resource("UnifiNetwork.Network")({ 
+/**
+* A network in the site by name or VLAN ID. Dies with a user-facing
+* `LookupNotFound` or `LookupAmbiguous`: stack bodies can't fail with typed
+* errors.
+*/
+lookup: Effect.fn("UnifiNetwork.Network.lookup")(function* (query) {
+	const site = yield* resolveSite(query.site);
+	const networks = (yield* listNetworks(site.id)).filter((n) => "vlanId" in query ? n.vlanId === query.vlanId : n.name === query.name);
+	const [network] = networks;
+	if (network === void 0) return yield* new LookupNotFound({
+		resource: "network",
+		query: describeQuery(query),
+		site
+	});
+	if (networks.length > 1) return yield* new LookupAmbiguous({
+		resource: "network",
+		query: describeQuery(query),
+		site,
+		count: networks.length
+	});
+	return yield* attributesOf$1(site.id, network.id);
+}, Effect.orDie) });
+const NetworkProvider = () => Provider.effect(Network, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return Network.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			const networks = yield* listNetworks(site.id);
+			return yield* Effect.forEach(networks.filter(isUserDefined$1), (network) => attributesOf$1(site.id, network.id));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const network = yield* getNetwork(output.siteId, output.networkId);
+				return network === void 0 ? void 0 : toAttributes$4(output.siteId, network);
+			}
+			const site = yield* resolveSite(olds.site);
+			const network = (yield* listNetworks(site.id)).find((n) => n.vlanId === olds.vlanId);
+			return network === void 0 ? void 0 : Unowned(yield* attributesOf$1(site.id, network.id));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			if (output === void 0) return void 0;
+			const replace = (reason) => output.default ? Effect.fail(new DefaultNetworkReplacement({
+				networkName: output.name,
+				reason
+			})) : Effect.succeed({
+				action: "replace",
+				deleteFirst: true
+			});
+			const management = planned(news, "management");
+			if (management !== UNKNOWN && management !== output.management) return yield* replace(`its management would change to ${String(management)}`);
+			const siteProp = plannedString(news, "site");
+			if (siteProp === UNKNOWN) return void 0;
+			const site = yield* resolveSite(siteProp);
+			if (site.id !== output.siteId) return yield* replace(`it would move to site ${site.internalReference}`);
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const body = withDefaults$1(yield* toBody$2(news, site));
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getNetwork(site.id, output.networkId) : void 0;
+			const write = invalidating(networksKey, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createNetwork({
+					siteId: site.id,
+					body
+				})).pipe(write);
+				return toAttributes$4(site.id, created);
+			}
+			if (isCurrent(body, omitKeys(observed, READ_ONLY$3))) return toAttributes$4(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateNetwork({
+				siteId: site.id,
+				networkId: observed.id,
+				body
+			})).pipe(write);
+			return toAttributes$4(site.id, updated);
+		})),
+		delete: ({ output }) => output.default ? Effect.logInfo(`Leaving ${output.name}, the site's default network, in place.`) : run(withConnection(Sdk.deleteNetwork({
+			siteId: output.siteId,
+			networkId: output.networkId
+		})).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void), invalidating(networksKey, output.siteId)))
+	});
+}));
+// src/TrafficMatchingList.ts
+const loadLists = (siteId) => withConnection(Stream.runCollect(Sdk.getTrafficMatchingLists.items({ siteId })));
+const listsKey = key("trafficMatchingLists");
+/** A site's traffic-matching lists, listed once per run. */
+const listTrafficMatchingLists = (siteId) => cached(listsKey, siteId, loadLists(siteId));
+const toAttributes$3 = (siteId, list) => {
+	const { id, ...config } = list;
+	return {
+		siteId,
+		trafficMatchingListId: id,
+		name: list.name,
+		type: list.type,
+		config
+	};
+};
+/** Fields the console reports but rejects in request bodies. */
+const READ_ONLY$2 = ["id"];
+/** A list can't be deleted while something references it. */
+var TrafficMatchingListInUse = class extends Data.TaggedError("TrafficMatchingListInUse") {
+	[UserFacingError] = true;
+	get message() {
+		const by = this.referencedBy.length > 0 ? `firewall policies ${this.referencedBy.map((name) => `"${name}"`).join(", ")}` : `something the provider couldn't identify (${this.detail})`;
+		return `Can't delete traffic-matching list "${this.listName}": it's still referenced by ${by}. Those references aren't managed by this stack (e.g. made in the UI); remove them, then deploy again.`;
+	}
+};
+/** User-defined firewall policies that mention `trafficMatchingListId` in a filter. */
+const policiesReferencing = (siteId, trafficMatchingListId) => withConnection(Stream.runCollect(Sdk.getFirewallPolicies.items({ siteId }))).pipe(Effect.map((policies) => policies.filter((p) => p.metadata.origin === "USER_DEFINED" && JSON.stringify([p.source, p.destination]).includes(trafficMatchingListId)).map((p) => p.name)), Effect.orElseSucceed(() => []));
+/** The list ID a reference means in `site`. */
+const resolveTrafficMatchingList = (reference, site) => checkSameSite("traffic-matching list", reference.siteId, site).pipe(Effect.as(reference.trafficMatchingListId));
+/** A list by ID, from the run's cached lists, which come whole (one request for every list in a plan). */
+const getList = (siteId, trafficMatchingListId) => listTrafficMatchingLists(siteId).pipe(Effect.map((lists) => lists.find((l) => l.id === trafficMatchingListId)));
+/**
+* A named list of IPv4 addresses, IPv6 addresses or ports, which firewall
+* policies reference instead of repeating values inline. Names are unique
+* per site, so existing lists are adopted by name with `--adopt`. Changing
+* `type` updates the list in place.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		const haHosts = yield* UnifiNetwork.TrafficMatchingList("ha-hosts", {
+* 			type: "IPV4_ADDRESSES",
+* 			name: "Home Assistant hosts",
+* 			items: [{ type: "IP_ADDRESS", value: "192.168.2.20" }],
+* 		});
+* 		// Reference it from a policy's filter: { type: "TRAFFIC_MATCHING_LIST", matchOpposite: false, trafficMatchingList: haHosts }
+* 	}),
+* );
+* ```
+*/
+const TrafficMatchingList = Resource("UnifiNetwork.TrafficMatchingList")({ 
+/**
+* A list in the site by name. Dies with a user-facing `LookupNotFound`:
+* stack bodies can't fail with typed errors.
+*/
+lookup: Effect.fn("UnifiNetwork.TrafficMatchingList.lookup")(function* (query) {
+	const site = yield* resolveSite(query.site);
+	const list = (yield* listTrafficMatchingLists(site.id)).find((l) => l.name === query.name);
+	if (list === void 0) return yield* new LookupNotFound({
+		resource: "traffic-matching list",
+		query: describeQuery(query),
+		site
+	});
+	return toAttributes$3(site.id, list);
+}, Effect.orDie) });
+const TrafficMatchingListProvider = () => Provider.effect(TrafficMatchingList, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return TrafficMatchingList.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			return (yield* listTrafficMatchingLists(site.id)).map((list) => toAttributes$3(site.id, list));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const list = yield* getList(output.siteId, output.trafficMatchingListId);
+				return list === void 0 ? void 0 : toAttributes$3(output.siteId, list);
+			}
+			const site = yield* resolveSite(olds.site);
+			const list = (yield* listTrafficMatchingLists(site.id)).find((l) => l.name === olds.name);
+			return list === void 0 ? void 0 : Unowned(toAttributes$3(site.id, list));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			const siteProp = plannedString(news, "site");
+			if (output === void 0 || siteProp === UNKNOWN) return void 0;
+			if ((yield* resolveSite(siteProp)).id !== output.siteId) return { action: "replace" };
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const { site: _site, ...body } = news;
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getList(site.id, output.trafficMatchingListId) : void 0;
+			const write = invalidating(listsKey, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createTrafficMatchingList({
+					siteId: site.id,
+					body
+				})).pipe(write);
+				return toAttributes$3(site.id, created);
+			}
+			if (isCurrent(body, omitKeys(observed, READ_ONLY$2))) return toAttributes$3(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateTrafficMatchingList({
+				siteId: site.id,
+				trafficMatchingListId: observed.id,
+				body
+			})).pipe(write);
+			return toAttributes$3(site.id, updated);
+		})),
+		delete: ({ output }) => run(withConnection(Sdk.deleteTrafficMatchingList({
+			siteId: output.siteId,
+			trafficMatchingListId: output.trafficMatchingListId
+		})).pipe(Effect.asVoid, Effect.catchTags({
+			NotFound: () => Effect.void,
+			UnprocessableEntity: (error) => policiesReferencing(output.siteId, output.trafficMatchingListId).pipe(Effect.flatMap((referencedBy) => Effect.fail(new TrafficMatchingListInUse({
+				listName: output.name,
+				referencedBy,
+				detail: error.message
+			}))))
+		}), invalidating(listsKey, output.siteId)))
+	});
+}));
+// src/FirewallPolicy.ts
+const loadPolicies = (siteId) => withConnection(Stream.runCollect(Sdk.getFirewallPolicies.items({ siteId })));
+const policiesKey = key("firewallPolicies");
+/**
+* A site's firewall policies, listed once per run: all of them, including
+* system-defined ones and ones UniFi derives from UI Objects.
+*/
+const listFirewallPolicies = (siteId) => cached(policiesKey, siteId, loadPolicies(siteId));
+/** Policies the user made, as opposed to system-defined ones and ones UniFi derives (from UI Objects, say), which the provider never touches. */
+const isUserDefined = (policy) => policy.metadata.origin === "USER_DEFINED";
+const toAttributes$2 = (siteId, policy) => {
+	const { id, metadata: _metadata, index: _index, ...config } = policy;
+	return {
+		siteId,
+		firewallPolicyId: id,
+		name: policy.name,
+		sourceFirewallZoneId: policy.source.zoneId,
+		destinationFirewallZoneId: policy.destination.zoneId,
+		config
+	};
+};
+/** Fields the console reports but rejects in request bodies, or that change without the policy being edited. */
+const READ_ONLY$1 = [
+	"id",
+	"metadata",
+	"index"
+];
+const resolvePortFilter = Effect.fn(function* (filter, site) {
+	if (filter.type === "PORTS") return filter;
+	const trafficMatchingListId = yield* resolveTrafficMatchingList(filter.trafficMatchingList, site);
+	return {
+		type: "TRAFFIC_MATCHING_LIST",
+		matchOpposite: filter.matchOpposite,
+		trafficMatchingListId
+	};
+});
+const resolveIpAddressFilter = Effect.fn(function* (filter, site) {
+	if (filter.type === "IP_ADDRESSES") return filter;
+	const trafficMatchingListId = yield* resolveTrafficMatchingList(filter.trafficMatchingList, site);
+	return {
+		type: "TRAFFIC_MATCHING_LIST",
+		matchOpposite: filter.matchOpposite,
+		trafficMatchingListId
+	};
+});
+const resolveNetworkFilter = (filter, site) => Effect.forEach(filter.networks, (network) => resolveNetwork(network, site)).pipe(Effect.map((networkIds) => ({
+	matchOpposite: filter.matchOpposite,
+	networkIds
+})));
+/** `filter` with its optional `portFilter` resolved (left out when unset). */
+const withPortFilter = Effect.fn(function* (filter, site) {
+	const { portFilter, ...rest } = filter;
+	if (portFilter === void 0) return rest;
+	return {
+		...rest,
+		portFilter: yield* resolvePortFilter(portFilter, site)
+	};
+});
+const resolveSourceFilter = Effect.fn(function* (filter, site) {
+	switch (filter.type) {
+		case "IP_ADDRESS": {
+			const { ipAddressFilter, ...rest } = yield* withPortFilter(filter, site);
+			return {
+				...rest,
+				ipAddressFilter: yield* resolveIpAddressFilter(ipAddressFilter, site)
+			};
+		}
+		case "NETWORK": {
+			const { networkFilter, ...rest } = yield* withPortFilter(filter, site);
+			return {
+				...rest,
+				networkFilter: yield* resolveNetworkFilter(networkFilter, site)
+			};
+		}
+		case "PORT": return {
+			...filter,
+			portFilter: yield* resolvePortFilter(filter.portFilter, site)
+		};
+		case "IPV6_IID": return yield* withPortFilter(filter, site);
+		case "MAC_ADDRESS": return yield* withPortFilter(filter, site);
+		case "REGION": return yield* withPortFilter(filter, site);
+		case "SITE_TO_SITE_VPN_TUNNEL": return yield* withPortFilter(filter, site);
+		case "VPN_SERVER": return yield* withPortFilter(filter, site);
+	}
+});
+const resolveDestinationFilter = Effect.fn(function* (filter, site) {
+	switch (filter.type) {
+		case "IP_ADDRESS": {
+			const { ipAddressFilter, ...rest } = yield* withPortFilter(filter, site);
+			return {
+				...rest,
+				ipAddressFilter: yield* resolveIpAddressFilter(ipAddressFilter, site)
+			};
+		}
+		case "NETWORK": {
+			const { networkFilter, ...rest } = yield* withPortFilter(filter, site);
+			return {
+				...rest,
+				networkFilter: yield* resolveNetworkFilter(networkFilter, site)
+			};
+		}
+		case "PORT": return {
+			...filter,
+			portFilter: yield* resolvePortFilter(filter.portFilter, site)
+		};
+		case "APPLICATION": return yield* withPortFilter(filter, site);
+		case "APPLICATION_CATEGORY": return yield* withPortFilter(filter, site);
+		case "DOMAIN": return yield* withPortFilter(filter, site);
+		case "IPV6_IID": return yield* withPortFilter(filter, site);
+		case "REGION": return yield* withPortFilter(filter, site);
+		case "SITE_TO_SITE_VPN_TUNNEL": return yield* withPortFilter(filter, site);
+		case "VPN_SERVER": return yield* withPortFilter(filter, site);
+	}
+});
+/** The request body for `props` (without `siteId`), with references resolved to IDs. */
+const toBody$1 = Effect.fn(function* (props, site) {
+	const { site: _site, source, destination, ...rest } = props;
+	const sourceFilter = source.trafficFilter;
+	const destinationFilter = destination.trafficFilter;
+	return {
+		...rest,
+		source: {
+			zoneId: yield* resolveFirewallZone(source.zone, site),
+			...sourceFilter === void 0 ? {} : { trafficFilter: yield* resolveSourceFilter(sourceFilter, site) }
+		},
+		destination: {
+			zoneId: yield* resolveFirewallZone(destination.zone, site),
+			...destinationFilter === void 0 ? {} : { trafficFilter: yield* resolveDestinationFilter(destinationFilter, site) }
+		}
+	};
+});
+/**
+* A policy by ID, from the run's cached list: the list returns whole
+* policies, so a plan reading every policy costs one request, not one each
+* (this matters through the ui.com connector's rate limit).
+*/
+const getPolicy = (siteId, firewallPolicyId) => listFirewallPolicies(siteId).pipe(Effect.map((policies) => policies.find((p) => p.id === firewallPolicyId)));
+/** User-defined policies named `name` from `source` to `destination`. Names aren't unique, even within a zone pair. */
+const findByName = Effect.fn(function* (site, name, source, destination) {
+	const sourceId = source === void 0 ? void 0 : yield* resolveFirewallZone(source, site);
+	const destinationId = destination === void 0 ? void 0 : yield* resolveFirewallZone(destination, site);
+	return (yield* listFirewallPolicies(site.id)).filter((p) => isUserDefined(p) && p.name === name && (sourceId === void 0 || p.source.zoneId === sourceId) && (destinationId === void 0 || p.destination.zoneId === destinationId));
+});
+/**
+* A zone-based firewall policy: allow, block or reject traffic from one
+* zone to another, optionally narrowed by traffic filters. Changing its
+* zones updates it in place and moves it to the new zone pair's ordering
+* (see `FirewallPolicyOrdering`).
+*
+* Existing user-defined policies are adopted with `--adopt` by name and zone
+* pair (names aren't unique, so several matches adopt nothing). Policies
+* UniFi derives, e.g. from UI Objects, are invisible: never listed, adopted
+* or ordered.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		const iot = yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+* 		yield* UnifiNetwork.FirewallPolicy("block-iot-to-internal", {
+* 			name: "Block IoT to Internal",
+* 			enabled: true,
+* 			action: { type: "BLOCK" },
+* 			source: { zone: iot },
+* 			destination: { zone: UnifiNetwork.FirewallZone.INTERNAL },
+* 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+* 			loggingEnabled: false,
+* 		});
+* 	}),
+* );
+* ```
+*/
+const FirewallPolicy = Resource("UnifiNetwork.FirewallPolicy")({ 
+/**
+* A user-defined policy by name, optionally narrowed to a zone pair. Dies
+* with a user-facing `LookupNotFound` or `LookupAmbiguous`: stack bodies
+* can't fail with typed errors.
+*/
+lookup: Effect.fn("UnifiNetwork.FirewallPolicy.lookup")(function* (query) {
+	const site = yield* resolveSite(query.site);
+	const policies = yield* findByName(site, query.name, query.source, query.destination);
+	const [policy] = policies;
+	const described = describeQuery({ name: query.name });
+	if (policy === void 0) return yield* new LookupNotFound({
+		resource: "firewall policy",
+		query: described,
+		site
+	});
+	if (policies.length > 1) return yield* new LookupAmbiguous({
+		resource: "firewall policy",
+		query: described,
+		site,
+		count: policies.length
+	});
+	return toAttributes$2(site.id, policy);
+}, Effect.orDie) });
+const FirewallPolicyProvider = () => Provider.effect(FirewallPolicy, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return FirewallPolicy.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			return (yield* listFirewallPolicies(site.id)).filter(isUserDefined).map((policy) => toAttributes$2(site.id, policy));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const policy = yield* getPolicy(output.siteId, output.firewallPolicyId);
+				return policy === void 0 || !isUserDefined(policy) ? void 0 : toAttributes$2(output.siteId, policy);
+			}
+			const site = yield* resolveSite(olds.site);
+			const matching = yield* findByName(site, olds.name, olds.source.zone, olds.destination.zone);
+			const [policy] = matching;
+			return policy === void 0 || matching.length > 1 ? void 0 : Unowned(toAttributes$2(site.id, policy));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			const siteProp = plannedString(news, "site");
+			if (output === void 0 || siteProp === UNKNOWN) return void 0;
+			if ((yield* resolveSite(siteProp)).id !== output.siteId) return { action: "replace" };
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const body = yield* toBody$1(news, site);
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getPolicy(site.id, output.firewallPolicyId) : void 0;
+			const write = invalidating(policiesKey, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createFirewallPolicy({
+					siteId: site.id,
+					...body
+				})).pipe(write);
+				return toAttributes$2(site.id, created);
+			}
+			if (isCurrent(sortArrays(body), sortArrays(omitKeys(observed, READ_ONLY$1)))) return toAttributes$2(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateFirewallPolicy({
+				...body,
+				siteId: site.id,
+				firewallPolicyId: observed.id
+			})).pipe(write);
+			return toAttributes$2(site.id, updated);
+		})),
+		delete: ({ output }) => run(withConnection(Sdk.deleteFirewallPolicy({
+			siteId: output.siteId,
+			firewallPolicyId: output.firewallPolicyId
+		})).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void), invalidating(policiesKey, output.siteId)))
+	});
+}));
+// src/State.ts
+/**
+* State store on the console itself (see `docs/development/state-store.md`). Each stack and
+* stage is one disabled Gateway → Gateway firewall policy whose description
+* holds the stage's state, and a traffic-matching list (whose names, unlike
+* policies', are unique) is its lock.
+*/
+/** Name prefix of the policies holding state. Other code leaves these alone. */
+const STATE_POLICY_PREFIX = "alchemy-state/";
+/** Name prefix of the traffic-matching lists that lock a stage. */
+const STATE_LOCK_PREFIX = "alchemy-lock/";
+/** Prefix of a state policy's description, ahead of the base64 of the Brotli-compressed JSON. */
+const FORMAT = "alchemy-state:v1:";
+const DEFAULT_WARN_AT = 4e6;
+/** How long a lock stays valid without a renewal. */
+const LOCK_TTL_MS = 12e4;
+const RENEW_EVERY_MS = 3e4;
+/** How long a passing check that the lock still exists is trusted. */
+const LOCK_CHECK_TTL_MS = 5e3;
+const policyName = (stack, stage) => `${STATE_POLICY_PREFIX}${stack}/${stage}`;
+const lockName = (stack, stage) => `${STATE_LOCK_PREFIX}${stack}/${stage}`;
+const parsePolicyName = (name) => {
+	const [stack, stage, ...rest] = name.slice(14).split("/");
+	return stack === void 0 || stage === void 0 || rest.length > 0 ? void 0 : {
+		stack,
+		stage
+	};
+};
+const encodeSnapshot = (snapshot) => FORMAT + zlib.brotliCompressSync(JSON.stringify(snapshot), { params: { [zlib.constants.BROTLI_PARAM_QUALITY]: 9 } }).toString("base64");
+const isLockRecord = (value) => Predicate.hasProperty(value, "listId") && typeof value.listId === "string" && Predicate.hasProperty(value, "expiresAt") && typeof value.expiresAt === "number";
+const decodeSnapshot = (policy) => Effect.try({
+	try: () => {
+		if (!policy.description.startsWith(FORMAT)) throw new Error("its description isn't in a known format");
+		const parsed = JSON.parse(zlib.brotliDecompressSync(Buffer.from(policy.description.slice(17), "base64")).toString());
+		if (!Predicate.isObject(parsed) || !Predicate.isObject(parsed["resources"])) throw new Error("it has no resources");
+		return {
+			lock: isLockRecord(parsed["lock"]) ? parsed["lock"] : void 0,
+			resources: { ...parsed["resources"] },
+			output: parsed["output"]
+		};
+	},
+	catch: (cause) => new StateStoreError({
+		message: `UniFi state policy '${policy.name}' can't be read: ${cause instanceof Error ? cause.message : String(cause)}`,
+		...cause instanceof Error ? { cause } : {}
+	})
+});
+/** A copy of a stored value, revived (e.g. `Redacted` values rebuilt). */
+const revive = (encoded) => encoded === void 0 ? void 0 : JSON.parse(JSON.stringify(encoded), reviveState);
+const isRecord = (value) => Predicate.isObject(value);
+const isReplaced = (value) => isRecord(value) && "status" in value && value.status === "replaced";
+const heldError = (stack, stage, detail) => new StateStoreError({ message: `Another run holds the UniFi state lock on '${stack}/${stage}': ${detail}` });
+/**
+* A {@link StateService} over `backend`. The first operation on a stage
+* locks it and loads its state, and the lock is released when `Scope`
+* closes.
+*/
+const makeUnifiState = (backend, options = {}) => Effect.gen(function* () {
+	const scope = yield* Effect.scope;
+	const warnAt = options.warnAt ?? 4e6;
+	let warned = false;
+	const findPolicy = Effect.fn(function* (stack, stage) {
+		const name = policyName(stack, stage);
+		const found = (yield* backend.listPolicies).filter((p) => p.name === name);
+		if (found.length > 1) return yield* new StateStoreError({ message: `Several firewall policies are named '${name}'. Only one may hold this stage's state: delete the others (keep the one with the newest state).` });
+		return found[0];
+	});
+	const takeLock = Effect.fn(function* (stack, stage) {
+		const name = lockName(stack, stage);
+		for (let attempt = 0; attempt < 2; attempt++) {
+			const created = yield* backend.createLock(name);
+			if (created !== void 0) return created;
+			const holder = yield* backend.findLock(name);
+			if (holder === void 0) continue;
+			const policy = yield* findPolicy(stack, stage);
+			const record = policy === void 0 ? void 0 : (yield* decodeSnapshot(policy)).lock;
+			if (record === void 0 || record.listId !== holder) return yield* heldError(stack, stage, `the traffic-matching list '${name}' exists, but no run has recorded holding it. A run may be starting, or one crashed before recording it. If nothing is using this stage, delete the list in the UniFi UI.`);
+			const now = yield* Clock.currentTimeMillis;
+			if (record.expiresAt > now) return yield* heldError(stack, stage, `it expires at ${new Date(record.expiresAt).toISOString()} unless renewed.`);
+			yield* backend.deleteLock(holder);
+		}
+		return yield* heldError(stack, stage, `the traffic-matching list '${name}' keeps reappearing.`);
+	});
+	const checkLock = (s) => Effect.gen(function* () {
+		const lostError = new StateStoreError({ message: `The UniFi state lock on '${s.stack}/${s.stage}' was lost mid-run (its traffic-matching list was deleted); refusing to continue unlocked.` });
+		if (s.lost) return yield* lostError;
+		const now = yield* Clock.currentTimeMillis;
+		if (s.lockCheckedAt !== void 0 && now - s.lockCheckedAt < LOCK_CHECK_TTL_MS) return;
+		if (!(yield* backend.lockExists(s.listId))) {
+			s.lost = true;
+			return yield* lostError;
+		}
+		s.lockCheckedAt = now;
+	});
+	/**
+	* Writes the stage unless `upTo` is already on the console. Without
+	* `upTo` (a renewal) it writes only an existing policy.
+	*/
+	const flush = (s, upTo) => Semaphore.withPermits(s.writer, 1)(Effect.gen(function* () {
+		if (s.closed) return yield* new StateStoreError({ message: `The UniFi state store for '${s.stack}/${s.stage}' is closed.` });
+		if (upTo === void 0 ? s.policyId === void 0 : s.written >= upTo) return;
+		yield* checkLock(s);
+		const version = s.version;
+		const expiresAt = (yield* Clock.currentTimeMillis) + LOCK_TTL_MS;
+		const description = encodeSnapshot({
+			lock: {
+				listId: s.listId,
+				expiresAt
+			},
+			resources: s.resources,
+			output: s.output
+		});
+		if (description.length > warnAt && !warned) {
+			warned = true;
+			yield* Effect.logWarning(`UniFi state for '${s.stack}/${s.stage}' is ${description.length} bytes, over the ${warnAt}-byte warning size. The console stores up to about 16 MiB directly and 7.5 MiB through ui.com: consider moving this stack to another state store.`);
+		}
+		const name = policyName(s.stack, s.stage);
+		if (s.policyId === void 0) s.policyId = yield* backend.createPolicy(name, description);
+		else yield* backend.updatePolicy(s.policyId, name, description);
+		s.written = version;
+	}));
+	const openStage = Effect.fn(function* (stack, stage) {
+		const listId = yield* takeLock(stack, stage);
+		const s = {
+			stack,
+			stage,
+			listId,
+			policyId: void 0,
+			resources: {},
+			output: void 0,
+			version: 0,
+			written: 0,
+			lockCheckedAt: yield* Clock.currentTimeMillis,
+			lost: false,
+			closed: false,
+			writer: Semaphore.makeUnsafe(1)
+		};
+		yield* Scope.addFinalizer(scope, Semaphore.withPermits(s.writer, 1)(Effect.suspend(() => {
+			s.closed = true;
+			return backend.deleteLock(listId);
+		}).pipe(Effect.ignore)));
+		const policy = yield* findPolicy(stack, stage);
+		if (policy !== void 0) {
+			const snapshot = yield* decodeSnapshot(policy);
+			s.policyId = policy.id;
+			s.resources = { ...snapshot.resources };
+			s.output = snapshot.output;
+			yield* flush(s);
+		}
+		yield* flush(s).pipe(Effect.ignore, Effect.delay(RENEW_EVERY_MS), Effect.forever, Effect.interruptible, Effect.forkIn(scope));
+		return s;
+	});
+	const stages = /* @__PURE__ */ new Map();
+	const opening = Semaphore.makeUnsafe(1);
+	const stageFor = (request) => Semaphore.withPermits(opening, 1)(Effect.gen(function* () {
+		const key = `${request.stack}/${request.stage}`;
+		const existing = stages.get(key);
+		if (existing !== void 0) return existing;
+		const opened = yield* openStage(request.stack, request.stage);
+		stages.set(key, opened);
+		return opened;
+	}));
+	const change = (request, apply) => stageFor(request).pipe(Effect.flatMap((s) => {
+		apply(s);
+		s.version++;
+		return flush(s, s.version);
+	}));
+	const deleteStage = (stack, stage) => stageFor({
+		stack,
+		stage
+	}).pipe(Effect.flatMap((s) => Semaphore.withPermits(s.writer, 1)(Effect.gen(function* () {
+		yield* checkLock(s);
+		if (s.policyId !== void 0) yield* backend.deletePolicy(s.policyId);
+		s.policyId = void 0;
+		s.resources = {};
+		s.output = void 0;
+		s.written = s.version;
+	}))));
+	const stored = Effect.map(backend.listPolicies, (policies) => policies.flatMap((p) => {
+		const parsed = parsePolicyName(p.name);
+		return parsed === void 0 ? [] : [parsed];
+	}));
+	const listStages = (stack) => Effect.map(stored, (all) => [...new Set(all.filter((s) => s.stack === stack).map((s) => s.stage))].toSorted());
+	return {
+		id: "unifi-network",
+		getVersion: () => Effect.succeed(STATE_STORE_VERSION),
+		listStacks: () => Effect.map(stored, (all) => [...new Set(all.map((s) => s.stack))].toSorted()),
+		listStages,
+		get: (request) => Effect.map(stageFor(request), (s) => {
+			const record = revive(s.resources[request.fqn]);
+			return isRecord(record) ? record : void 0;
+		}),
+		getReplacedResources: (request) => Effect.map(stageFor(request), (s) => Object.values(s.resources).map(revive).filter(isReplaced)),
+		list: (request) => Effect.map(stageFor(request), (s) => Object.keys(s.resources).toSorted()),
+		set: (request) => change(request, (s) => {
+			s.resources[request.fqn] = encodeState(request.value);
+		}).pipe(Effect.as(request.value)),
+		delete: (request) => change(request, (s) => {
+			delete s.resources[request.fqn];
+		}),
+		deleteStack: ({ stack, stage }) => stage === void 0 ? Effect.flatMap(listStages(stack), (found) => Effect.forEach(found, (each) => deleteStage(stack, each), { discard: true })) : deleteStage(stack, stage),
+		getOutput: (request) => Effect.map(stageFor(request), (s) => revive(s.output)),
+		setOutput: (request) => change(request, (s) => {
+			s.output = encodeState(request.value);
+		}).pipe(Effect.as(request.value))
+	};
+});
+const toStateStoreError = (what) => (cause) => new StateStoreError({
+	message: `UniFi state store: ${what} failed: ${describeError(cause)}`,
+	...cause instanceof Error ? { cause } : {}
+});
+const isAlreadyExists = (error) => Predicate.hasProperty(error, "_tag") && error._tag === "UnprocessableEntity" && Predicate.hasProperty(error, "message") && typeof error.message === "string" && error.message.includes("already exist");
+const policyBody = (zoneId, name, description) => ({
+	enabled: false,
+	name,
+	description,
+	action: { type: "BLOCK" },
+	source: { zoneId },
+	destination: { zoneId },
+	ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+	loggingEnabled: false
+});
+const describeWrite = (description) => `writing ${description.length} bytes of state (a console stores up to about 16 MiB directly, 7.5 MiB through ui.com)`;
+/**
+* Runs with Debug and Trace records off: request bodies are the state,
+* which holds secrets (e.g. Wi-Fi passphrases). Floors already above Info
+* are left alone.
+*/
+const withoutDebugLogs = Effect.updateService(References.MinimumLogLevel, (level) => LogLevel.isLessThan(level, "Info") ? "Info" : level);
+/** The {@link StateBackend} of the profile's console and site. */
+const consoleBackend = Effect.gen(function* () {
+	const { id: siteId } = yield* resolveSite();
+	const context = yield* Effect.context();
+	const run = (what, effect) => withConnection(effect).pipe(Effect.mapError(toStateStoreError(what)), Effect.provideContext(context), withoutDebugLogs);
+	const gatewayZoneId = yield* Effect.cached(run("finding the Gateway zone", Stream.runCollect(Sdk.getFirewallZones.items({ siteId }))).pipe(Effect.flatMap((zones) => {
+		const zone = zones.find((z) => z.metadata.origin === "SYSTEM_DEFINED" && z.name === "Gateway");
+		return zone === void 0 ? Effect.fail(new StateStoreError({ message: "UniFi state store: the site has no Gateway zone." })) : Effect.succeed(zone.id);
+	})));
+	return {
+		listPolicies: run("listing state policies", Stream.runCollect(Sdk.getFirewallPolicies.items({ siteId })).pipe(Effect.map((policies) => policies.flatMap((p) => p.metadata.origin === "USER_DEFINED" && p.name.startsWith("alchemy-state/") ? [{
+			id: p.id,
+			name: p.name,
+			description: p.description ?? ""
+		}] : [])))),
+		createPolicy: (name, description) => Effect.flatMap(gatewayZoneId, (zoneId) => run(describeWrite(description), Sdk.createFirewallPolicy({
+			siteId,
+			...policyBody(zoneId, name, description)
+		}))).pipe(Effect.map((created) => created.id)),
+		updatePolicy: (id, name, description) => Effect.flatMap(gatewayZoneId, (zoneId) => run(describeWrite(description), Sdk.updateFirewallPolicy({
+			siteId,
+			firewallPolicyId: id,
+			...policyBody(zoneId, name, description)
+		}))).pipe(Effect.asVoid),
+		deletePolicy: (id) => run("deleting a state policy", Sdk.deleteFirewallPolicy({
+			siteId,
+			firewallPolicyId: id
+		}).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void))),
+		createLock: (name) => run("taking the lock", Sdk.createTrafficMatchingList({
+			siteId,
+			body: {
+				type: "PORTS",
+				name,
+				items: [{
+					type: "PORT_NUMBER",
+					value: 1
+				}]
+			}
+		}).pipe(Effect.map((created) => created.id), Effect.catchIf(isAlreadyExists, () => Effect.undefined))),
+		findLock: (name) => run("finding the lock", Stream.runCollect(Sdk.getTrafficMatchingLists.items({ siteId })).pipe(Effect.map((lists) => lists.find((l) => l.name === name)?.id))),
+		lockExists: (id) => run("checking the lock", Sdk.getTrafficMatchingList({
+			siteId,
+			trafficMatchingListId: id
+		}).pipe(Effect.as(true), Effect.catchTag("NotFound", () => Effect.succeed(false)))),
+		deleteLock: (id) => run("releasing the lock", Sdk.deleteTrafficMatchingList({
+			siteId,
+			trafficMatchingListId: id
+		}).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void)))
+	};
+}).pipe(Effect.mapError((error) => error instanceof StateStoreError ? error : toStateStoreError("finding the site")(error)));
+/**
+* State store on the console the profile points at: each stack and stage
+* is a disabled Gateway → Gateway firewall policy holding the stage's
+* compressed state, locked with a traffic-matching list while a run uses
+* it. Nothing connects until the first state operation.
+*
+* The state includes secrets in plaintext, as in every Alchemy store: a
+* UniFi stack's are already on the console, but another provider's
+* resources in the same stack would put theirs there too.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+* 	}),
+* );
+* ```
+*/
+const state = (options = {}) => Layer.effect(State, Effect.gen(function* () {
+	const scope = yield* Effect.scope;
+	const context = yield* Effect.context();
+	const make = Effect.flatMap(consoleBackend, (backend) => makeUnifiState(backend, options)).pipe(Scope.provide(scope), recordStateStoreInit, Effect.orDie, Effect.provideContext(context));
+	return yield* Effect.cached(make);
+})).pipe(Layer.provide(Layer.merge(layer$1, layer).pipe(Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(UnifiNetworkAuth))), Layer.orDie);
+// src/FirewallPolicyOrdering.ts
+/** An ordering that can't be applied as given. */
+var InvalidFirewallPolicyOrdering = class extends Data.TaggedError("InvalidFirewallPolicyOrdering") {
+	[UserFacingError] = true;
+	get message() {
+		return `Can't apply the firewall policy ordering: ${this.reason}`;
+	}
+};
+const sameOrder = (a, b) => a.beforeSystemDefined.join() === b.beforeSystemDefined.join() && a.afterSystemDefined.join() === b.afterSystemDefined.join();
+const resolvePair = Effect.fn(function* (props) {
+	const site = yield* resolveSite(props.site);
+	return {
+		site,
+		siteId: site.id,
+		sourceFirewallZoneId: yield* resolveFirewallZone(props.source, site),
+		destinationFirewallZoneId: yield* resolveFirewallZone(props.destination, site)
+	};
+});
+const getOrder = ({ siteId, sourceFirewallZoneId, destinationFirewallZoneId }) => withConnection(Sdk.getFirewallPolicyOrdering({
+	siteId,
+	sourceFirewallZoneId,
+	destinationFirewallZoneId
+})).pipe(Effect.map((ordering) => ordering.orderedFirewallPolicyIds));
+const toAttributes$1 = (pair, order, listedFirewallPolicyIds) => ({
+	siteId: pair.siteId,
+	sourceFirewallZoneId: pair.sourceFirewallZoneId,
+	destinationFirewallZoneId: pair.destinationFirewallZoneId,
+	beforeSystemDefined: order.beforeSystemDefined,
+	afterSystemDefined: order.afterSystemDefined,
+	listedFirewallPolicyIds
+});
+const resolvePolicies = (references, site) => Effect.forEach(references ?? [], (reference) => checkSameSite("firewall policy", reference.siteId, site).pipe(Effect.as(reference.firewallPolicyId)));
+/** Why a listed policy isn't in the zone pair's ordering. */
+const explainMissing = Effect.fn(function* (site, firewallPolicyId, pair) {
+	const policy = (yield* listFirewallPolicies(site.id)).find((p) => p.id === firewallPolicyId);
+	if (policy === void 0) return `policy ${firewallPolicyId} doesn't exist`;
+	if (!isUserDefined(policy)) return `"${policy.name}" isn't user-defined, so it can't be ordered`;
+	if (policy.source.zoneId !== pair.sourceFirewallZoneId || policy.destination.zoneId !== pair.destinationFirewallZoneId) return `"${policy.name}" belongs to another zone pair`;
+	return `"${policy.name}" isn't in the zone pair's ordering`;
+});
+/**
+* The state store's policies (`UnifiNetwork.state()`) among `ids`. The store
+* may have created one since the run's policy list was read, so policies
+* missing from it are fetched.
+*/
+const statePolicies = Effect.fn(function* (site, ids) {
+	const policies = yield* listFirewallPolicies(site.id);
+	const names = yield* Effect.forEach(ids, (id) => {
+		const listed = policies.find((p) => p.id === id);
+		return listed !== void 0 ? Effect.succeed(listed.name) : withConnection(Sdk.getFirewallPolicy({
+			siteId: site.id,
+			firewallPolicyId: id
+		})).pipe(Effect.map((policy) => policy.name), Effect.catchTag("NotFound", () => Effect.undefined));
+	});
+	return ids.filter((_, i) => names[i]?.startsWith(STATE_POLICY_PREFIX) === true);
+});
+const describePolicies = Effect.fn(function* (site, ids) {
+	const policies = yield* listFirewallPolicies(site.id);
+	return ids.map((id) => `"${policies.find((p) => p.id === id)?.name ?? id}"`).join(", ");
+});
+/**
+* The evaluation order of user-defined policies from one zone to another.
+* Listing policies makes the ordering depend on them, so it's applied after
+* they're created or moved, and re-applied when the list changes.
+*
+* UniFi rejects an ordering that leaves out any of the pair's policies, so
+* unlisted ones (e.g. made in the UI) are kept after the listed ones in each
+* bucket, in their current relative order, with a warning; `exclusive: true`
+* fails instead. A policy the ordering listed before but no longer does is
+* kept quietly, even when exclusive: it's usually being deleted in the same
+* deploy, which runs after the ordering is applied. The state store's
+* policies (`UnifiNetwork.state()`, Gateway → Gateway) are kept quietly too.
+* System-defined policies sit between the two buckets and
+* can't be reordered; policies UniFi derives from UI Objects aren't ordered
+* at all.
+*
+* The zone pair is the identity: an existing ordering is adopted without
+* `--adopt`, and deleting the resource leaves the order as it is.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		const { INTERNAL } = UnifiNetwork.FirewallZone;
+* 		const iot = yield* UnifiNetwork.FirewallZone("iot-zone", { name: "IoT" });
+* 		const policy = { enabled: true, source: { zone: INTERNAL }, destination: { zone: iot }, loggingEnabled: false } as const;
+* 		const allowHomeAssistant = yield* UnifiNetwork.FirewallPolicy("allow-ha", {
+* 			...policy,
+* 			name: "Allow Home Assistant",
+* 			action: { type: "ALLOW", allowReturnTraffic: true },
+* 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+* 		});
+* 		const blockTheRest = yield* UnifiNetwork.FirewallPolicy("block-rest", {
+* 			...policy,
+* 			name: "Block the rest",
+* 			action: { type: "BLOCK" },
+* 			ipProtocolScope: { ipVersion: "IPV4_AND_IPV6" },
+* 		});
+* 		yield* UnifiNetwork.FirewallPolicyOrdering("internal-to-iot", {
+* 			source: INTERNAL,
+* 			destination: iot,
+* 			beforeSystemDefined: [allowHomeAssistant, blockTheRest],
+* 		});
+* 	}),
+* );
+* ```
+*/
+const FirewallPolicyOrdering = Resource("UnifiNetwork.FirewallPolicyOrdering");
+const FirewallPolicyOrderingProvider = () => Provider.effect(FirewallPolicyOrdering, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return FirewallPolicyOrdering.Provider.of({
+		list: () => Effect.succeed([]),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) return toAttributes$1(output, yield* getOrder(output), output.listedFirewallPolicyIds);
+			const pair = yield* resolvePair(olds);
+			return toAttributes$1(pair, yield* getOrder(pair), []);
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const pair = yield* resolvePair(news);
+			const { site } = pair;
+			const before = yield* resolvePolicies(news.beforeSystemDefined, site);
+			const after = yield* resolvePolicies(news.afterSystemDefined, site);
+			const listed = [...before, ...after];
+			const duplicate = listed.find((id, i) => listed.indexOf(id) !== i);
+			if (duplicate !== void 0) return yield* new InvalidFirewallPolicyOrdering({ reason: `${yield* describePolicies(site, [duplicate])} is listed twice.` });
+			const current = yield* getOrder(pair);
+			const inPair = /* @__PURE__ */ new Set([...current.beforeSystemDefined, ...current.afterSystemDefined]);
+			const missing = listed.find((id) => !inPair.has(id));
+			if (missing !== void 0) return yield* new InvalidFirewallPolicyOrdering({ reason: `${yield* explainMissing(site, missing, pair)}.` });
+			const unlisted = (ids) => ids.filter((id) => !listed.includes(id));
+			const formerlyListed = output?.listedFirewallPolicyIds ?? [];
+			const unlistedNow = [...unlisted(current.beforeSystemDefined), ...unlisted(current.afterSystemDefined)].filter((id) => !formerlyListed.includes(id));
+			const stateIds = yield* statePolicies(site, unlistedNow);
+			const unmanaged = unlistedNow.filter((id) => !stateIds.includes(id));
+			if (unmanaged.length > 0) {
+				const names = yield* describePolicies(site, unmanaged);
+				if (news.exclusive === true) return yield* new InvalidFirewallPolicyOrdering({ reason: `the zone pair has policies the ordering doesn't list: ${names}. List them, delete them, or drop \`exclusive\`.` });
+				yield* Effect.logWarning(`Firewall policy ordering: keeping unlisted policies after the listed ones: ${names}.`);
+			}
+			const desired = {
+				beforeSystemDefined: [...before, ...unlisted(current.beforeSystemDefined)],
+				afterSystemDefined: [...after, ...unlisted(current.afterSystemDefined)]
+			};
+			if (sameOrder(desired, current)) return toAttributes$1(pair, current, listed);
+			const updated = yield* withConnection(Sdk.updateFirewallPolicyOrdering({
+				siteId: pair.siteId,
+				sourceFirewallZoneId: pair.sourceFirewallZoneId,
+				destinationFirewallZoneId: pair.destinationFirewallZoneId,
+				orderedFirewallPolicyIds: desired
+			}));
+			return toAttributes$1(pair, updated.orderedFirewallPolicyIds, listed);
+		})),
+		delete: () => Effect.void
+	});
+}));
+// src/WifiBroadcast.ts
+const loadBroadcasts = (siteId) => withConnection(Stream.runCollect(Sdk.getWifiBroadcastPage.items({ siteId })));
+const broadcastsKey = key("wifiBroadcasts");
+/** A site's Wi-Fi broadcasts, listed once per run. */
+const listWifiBroadcasts = (siteId) => cached(broadcastsKey, siteId, loadBroadcasts(siteId));
+const toAttributes = (siteId, broadcast) => {
+	const { id, metadata: _metadata, ...config } = broadcast;
+	return {
+		siteId,
+		wifiBroadcastId: id,
+		name: broadcast.name,
+		type: broadcast.type,
+		networkId: broadcast.network?.type === "SPECIFIC" ? broadcast.network.networkId : void 0,
+		config
+	};
+};
+const byFrequency = (bands) => bands.toSorted((a, b) => a - b);
+/**
+* `body` with its bands sorted (their order means nothing; see
+* {@link comparable}), and an explicit value for the one unset field that
+* can't simply be left out (verified): a standard broadcast's
+* `bandSteeringEnabled`, which the console reports as `false` when unset,
+* so without the default the body would never match and every deploy would
+* update it (and drift would report it) forever.
+*/
+const withDefaults = (body) => body.type === "STANDARD" ? {
+	...body,
+	bandSteeringEnabled: body.bandSteeringEnabled ?? false,
+	broadcastingFrequenciesGHz: byFrequency(body.broadcastingFrequenciesGHz)
+} : body;
+/** Fields the console reports but rejects in request bodies. */
+const READ_ONLY = ["id", "metadata"];
+const toBody = Effect.fn(function* (props, site) {
+	const { site: _site, network, ...rest } = props;
+	if (network === void 0) return rest;
+	if ("type" in network || network.default === true) return {
+		...rest,
+		network: { type: "NATIVE" }
+	};
+	const networkId = yield* resolveNetwork(network, site);
+	return {
+		...rest,
+		network: {
+			type: "SPECIFIC",
+			networkId
+		}
+	};
+});
+/**
+* The console's broadcast in body form, with its bands sorted: consoles keep
+* them in an order of their own (not the one sent; the test controller
+* sorts them), so order mustn't count as a difference.
+*/
+const comparable = (observed) => {
+	const body = omitKeys(observed, READ_ONLY);
+	return observed.type === "STANDARD" ? {
+		...body,
+		broadcastingFrequenciesGHz: byFrequency(observed.broadcastingFrequenciesGHz)
+	} : body;
+};
+const getBroadcast = (siteId, wifiBroadcastId) => withConnection(Sdk.getWifiBroadcastDetails({
+	siteId,
+	wifiBroadcastId
+})).pipe(Effect.catchTag("NotFound", () => Effect.undefined));
+/** The attributes of a broadcast known to exist (e.g. from a list). */
+const attributesOf = (siteId, wifiBroadcastId) => withConnection(Sdk.getWifiBroadcastDetails({
+	siteId,
+	wifiBroadcastId
+})).pipe(Effect.map((broadcast) => toAttributes(siteId, broadcast)));
+/**
+* A Wi-Fi network (SSID). `type` picks a standard or an IoT-optimised
+* broadcast; changing it, or the site, replaces the broadcast.
+*
+* Props are authoritative: every update sends the whole broadcast, with
+* explicit defaults for unset fields (a standard broadcast's
+* `bandSteeringEnabled: false`), so changes made in the UI, passphrases
+* included, are put back. The `config` attribute mirrors the console's
+* object, so `alchemy drift` sees them. Existing broadcasts are adopted by name with
+* `--adopt`.
+*
+* @example
+* ```ts
+* import * as UnifiNetwork from "@alchemy-unifi/network";
+* import * as Alchemy from "alchemy";
+* import * as Config from "effect/Config";
+* import * as Effect from "effect/Effect";
+*
+* export default Alchemy.Stack(
+* 	"HomeNetwork",
+* 	{ providers: UnifiNetwork.providers(), state: UnifiNetwork.state() },
+* 	Effect.gen(function* () {
+* 		const lan = yield* UnifiNetwork.Network.lookup({ vlanId: 1 });
+* 		yield* UnifiNetwork.WifiBroadcast("home", {
+* 			type: "STANDARD",
+* 			name: "Home",
+* 			enabled: true,
+* 			network: lan,
+* 			securityConfiguration: {
+* 				type: "WPA2_PERSONAL",
+* 				passphrase: yield* Config.Redacted("WIFI_PASSPHRASE"),
+* 				fastRoamingEnabled: false,
+* 			},
+* 			broadcastingFrequenciesGHz: [2.4, 5],
+* 			hideName: false,
+* 			clientIsolationEnabled: false,
+* 			multicastToUnicastConversionEnabled: false,
+* 			uapsdEnabled: false,
+* 			channel2gLockedTo6: false,
+* 			dtimPeriod2gLockedTo3: false,
+* 			advertiseDeviceName: false,
+* 			arpProxyEnabled: false,
+* 			bssTransitionEnabled: true,
+* 		});
+* 	}),
+* );
+* ```
+*/
+const WifiBroadcast = Resource("UnifiNetwork.WifiBroadcast")({
+	NATIVE_NETWORK: { type: "NATIVE" },
+	/**
+	* A broadcast in the site by name. Dies with a user-facing
+	* `LookupNotFound` or `LookupAmbiguous`: stack bodies can't fail with typed
+	* errors.
+	*/
+	lookup: Effect.fn("UnifiNetwork.WifiBroadcast.lookup")(function* (query) {
+		const site = yield* resolveSite(query.site);
+		const broadcasts = (yield* listWifiBroadcasts(site.id)).filter((b) => b.name === query.name);
+		const [broadcast] = broadcasts;
+		if (broadcast === void 0) return yield* new LookupNotFound({
+			resource: "Wi-Fi broadcast",
+			query: describeQuery(query),
+			site
+		});
+		if (broadcasts.length > 1) return yield* new LookupAmbiguous({
+			resource: "Wi-Fi broadcast",
+			query: describeQuery(query),
+			site,
+			count: broadcasts.length
+		});
+		return yield* attributesOf(site.id, broadcast.id);
+	}, Effect.orDie)
+});
+const WifiBroadcastProvider = () => Provider.effect(WifiBroadcast, Effect.gen(function* () {
+	const run = yield* captureServices;
+	return WifiBroadcast.Provider.of({
+		list: () => run(Effect.gen(function* () {
+			const site = yield* resolveSite();
+			const broadcasts = yield* listWifiBroadcasts(site.id);
+			return yield* Effect.forEach(broadcasts.filter((b) => b.metadata.origin === "USER_DEFINED"), (b) => attributesOf(site.id, b.id));
+		})),
+		read: ({ olds, output }) => run(Effect.gen(function* () {
+			if (output !== void 0) {
+				const broadcast = yield* getBroadcast(output.siteId, output.wifiBroadcastId);
+				return broadcast === void 0 ? void 0 : toAttributes(output.siteId, broadcast);
+			}
+			const site = yield* resolveSite(olds.site);
+			const matching = (yield* listWifiBroadcasts(site.id)).filter((b) => b.name === olds.name);
+			const [broadcast] = matching;
+			return broadcast === void 0 || matching.length > 1 ? void 0 : Unowned(yield* attributesOf(site.id, broadcast.id));
+		})),
+		diff: ({ news, output }) => run(Effect.gen(function* () {
+			if (output === void 0) return void 0;
+			const type = planned(news, "type");
+			if (type !== UNKNOWN && type !== output.type) return { action: "replace" };
+			const siteProp = plannedString(news, "site");
+			if (siteProp === UNKNOWN) return void 0;
+			if ((yield* resolveSite(siteProp)).id !== output.siteId) return { action: "replace" };
+		})),
+		reconcile: ({ news, output }) => run(Effect.gen(function* () {
+			const site = yield* resolveSite(news.site);
+			const body = withDefaults(yield* toBody(news, site));
+			const observed = output !== void 0 && output.siteId === site.id ? yield* getBroadcast(site.id, output.wifiBroadcastId) : void 0;
+			const write = invalidating(broadcastsKey, site.id);
+			if (observed === void 0) {
+				const created = yield* withConnection(Sdk.createWifiBroadcast({
+					siteId: site.id,
+					body
+				})).pipe(write);
+				return toAttributes(site.id, created);
+			}
+			if (isCurrent(body, comparable(observed))) return toAttributes(site.id, observed);
+			const updated = yield* withConnection(Sdk.updateWifiBroadcast({
+				siteId: site.id,
+				wifiBroadcastId: observed.id,
+				body
+			})).pipe(write);
+			return toAttributes(site.id, updated);
+		})),
+		delete: ({ output }) => run(withConnection(Sdk.deleteWifiBroadcast({
+			siteId: output.siteId,
+			wifiBroadcastId: output.wifiBroadcastId
+		})).pipe(Effect.asVoid, Effect.catchTag("NotFound", () => Effect.void), invalidating(broadcastsKey, output.siteId)))
+	});
+}));
+// src/Providers.ts
+var Providers = class extends Provider.ProviderCollection()("UnifiNetwork") {};
+/**
+* Registers every UniFi Network resource provider, the `UnifiNetwork` auth
+* provider, the lazily-resolved credentials and connection, and the per-run
+* read cache. Merge
+* alongside other cloud `providers()` layers in a Stack.
+*
+* Its requirements (`AuthProviders`, `ProfileStore`, `FileSystem`, `Path`)
+* come from Alchemy's runtime; it provides only its own services.
+*
+* Unlike most providers this doesn't provide an `HttpClient`: ours carries
+* the console's TLS settings, and lifecycle operations run in the stack's
+* merged context, so it would replace other providers' clients. SDK calls
+* get it through `UnifiNetworkConnection` instead.
+*/
+const providers = () => Layer.effect(Providers, Provider.collection([
+	FirewallZone,
+	Network,
+	WifiBroadcast,
+	TrafficMatchingList,
+	FirewallPolicy,
+	FirewallPolicyOrdering,
+	DnsPolicy
+])).pipe(Layer.provide(Layer.mergeAll(FirewallZoneProvider(), NetworkProvider(), WifiBroadcastProvider(), TrafficMatchingListProvider(), FirewallPolicyProvider(), FirewallPolicyOrderingProvider(), DnsPolicyProvider())), Layer.provideMerge(Layer.merge(layer$1, layer)), Layer.provideMerge(fromAuthProvider()), Layer.provideMerge(UnifiNetworkAuth), Layer.orDie);
+export { AmbiguousSite, CrossSiteReference, DEFAULT_WARN_AT, DefaultNetworkReplacement, DnsPolicy, DnsPolicyProvider, FirewallPolicy, FirewallPolicyOrdering, FirewallPolicyOrderingProvider, FirewallPolicyProvider, FirewallZone, FirewallZoneProvider, InvalidFirewallPolicyOrdering, LookupAmbiguous, LookupNotFound, Network, NetworkProvider, Providers, ReadCache_exports as ReadCache, SiteNotFound, SiteRequired, TrafficMatchingList, TrafficMatchingListInUse, TrafficMatchingListProvider, UNIFI_NETWORK_AUTH_PROVIDER_NAME, UnifiNetworkAuth, UnifiNetworkAuthConfigSchema, UnifiNetworkConnection, UnifiNetworkCredentials, UnifiNetworkReadCache, WifiBroadcast, WifiBroadcastProvider, checkSameSite, describeQuery, fromAuthProvider, isUserDefined, listDnsPolicies, listFirewallPolicies, listFirewallZones, listNetworks, listSites, listTrafficMatchingLists, listWifiBroadcasts, providers, resolveFirewallZone, resolveNetwork, resolveSite, resolveTrafficMatchingList, sitesKey, state, withConnection };
+
+//# sourceMappingURL=index.mjs.map