@homeflare/alchemy 0.38.0 → 0.39.0

package/src/telemetry/redact.ts

@@ -0,0 +1,147 @@
+/**
+ * URL/header redaction for outgoing spans — applied at the `Tracer.Tracer` boundary so it holds for
+ * EVERY span source (a provider's own `Effect.withSpan`, effect's `HttpClient` client spans, and
+ * alchemy's own plan/apply/resource spans), not just the ones a caller remembers to annotate.
+ *
+ * ★ WHY THE TRACER, NOT AN HTTPCLIENT MIDDLEWARE. effect's `HttpClient.make` (src/unstable/http/
+ *   HttpClient.ts) hard-codes `span.attribute("url.full", …)`, `"url.query"` and
+ *   `http.request.header.<name>` on the span it creates — there is no hook to stop it recording
+ *   them. The one seam every span (HttpClient's included) passes through is `Tracer.span()`
+ *   returning a `Tracer.Span`, so `wrapTracer` intercepts `Span.attribute()` there instead.
+ * ⛔ NEVER RECORD HEADERS. A header NAME can itself be sensitive (`x-api-key`, a session cookie
+ *   name), so every `http.{request,response}.header.*` key is DROPPED, not value-redacted.
+ * ⚠️ QUERY STRINGS ARE STRIPPED WHOLE, not redacted per-parameter: an allowlist of "safe" params
+ *   would silently leak the next secret param a provider adds. `url.query` is dropped outright and
+ *   `url.full`/`url.path` never carry a `?…` past this point.
+ */
+import type * as Tracer from 'effect/Tracer';
+
+/** Host or path segments to blank wherever they appear in a URL attribute — exact-segment match. */
+export interface RedactionPolicy {
+  /**
+   * e.g. a UniFi console id embedded in a path (`/proxy/network/api/site/<id>/...`) or a private
+   * hostname a consumer never wants leaving its own process. Compared against the full hostname and
+   * against each `/`-separated path segment — never a substring match, so `"db"` cannot accidentally
+   * blank `"db1.example.test"`.
+   */
+  readonly denylist?: ReadonlyArray<string>;
+}
+
+export const REDACTED = '<redacted>';
+
+/** Returned by `redactAttribute` to mean "drop this attribute entirely — do not forward it". */
+export const DROP: unique symbol = Symbol.for('homeflare/alchemy/telemetry/drop-attribute');
+
+const HEADER_ATTRIBUTE = /^http\.(?:request|response)\.header\./;
+
+const redactSegments = (value: string, denylist: ReadonlySet<string>): string =>
+  value
+    .split('/')
+    .map((segment) => (denylist.has(segment) ? REDACTED : segment))
+    .join('/');
+
+/**
+ * Applies `policy` to one span attribute. Returns `DROP` when the key must never be recorded at
+ * all (every header); otherwise returns the value to record, with URLs stripped of their query
+ * string and hash and their denylisted host/path segments blanked. A value this function does not
+ * recognize (not a URL-shaped key, or not a string) passes through unchanged — alchemy's own
+ * engine attributes (`resource.fqn`, `plan.action`, …) are never URLs and are never touched.
+ */
+export const redactAttribute = (key: string, value: unknown, policy: RedactionPolicy): unknown => {
+  if (HEADER_ATTRIBUTE.test(key)) return DROP;
+  if (key === 'url.query') return DROP;
+  if (typeof value !== 'string') return value;
+  const denylist = new Set(policy.denylist ?? []);
+  if (denylist.size === 0 && key !== 'url.full' && key !== 'server.address') return value;
+  // ⚠️ MEASURED 2026-09-26 (docs/telemetry-spike.md): effect's own `HttpClient.make` sets
+  //   `server.address` to `url.origin` (`http://host:port`), NOT a bare hostname — a denylist entry
+  //   naming just a hostname would never match the raw value, so this parses it out the same way
+  //   `url.full` does.
+  // ⛔ FIX (redteam PR 302 MINOR item 5, 2026-09-26): the OTel semantic convention's own default for
+  //   `server.address` IS a bare hostname with no scheme (`new URL(value)` throws on that), and other
+  //   instrumentation could emit exactly that even though effect's `HttpClient` doesn't today —
+  //   `redactAttribute('server.address', 'db1.example.test', { denylist: ['db1.example.test'] })`
+  //   returned the value verbatim before this fallback. Compare the raw string directly when it
+  //   isn't a parseable URL, instead of giving up.
+  if (key === 'server.address') {
+    try {
+      const url = new URL(value);
+      return denylist.has(url.hostname) ? REDACTED : value;
+    } catch {
+      return denylist.has(value) ? REDACTED : value;
+    }
+  }
+  if (key === 'url.path') return redactSegments(value, denylist);
+  if (key === 'url.full') {
+    try {
+      const url = new URL(value);
+      const host = denylist.has(url.hostname) ? REDACTED : url.host;
+      return `${url.protocol}//${host}${redactSegments(url.pathname, denylist)}`;
+    } catch {
+      // Not a URL we can parse (a relative path effect couldn't resolve) — leave it verbatim
+      // rather than guess; `url.full` is the one HttpClient always sets from a resolved `URL`, so
+      // this branch is a defensive fallback, not the expected path.
+      return value;
+    }
+  }
+  return value;
+};
+
+const redactAttributes = (
+  attributes: Record<string, unknown>,
+  policy: RedactionPolicy,
+): Record<string, unknown> => {
+  const out: Record<string, unknown> = {};
+  for (const [key, value] of Object.entries(attributes)) {
+    const redacted = redactAttribute(key, value, policy);
+    if (redacted !== DROP) out[key] = redacted;
+  }
+  return out;
+};
+
+/**
+ * Wraps a `Tracer.Tracer` so every span it creates redacts its attributes and event attributes
+ * through `redactAttribute`/`redactAttributes` before they reach the real span (and therefore
+ * before OTLP serialization ever sees them). Everything else — timing, status, links, the span's
+ * own identity — passes straight through to `inner`.
+ */
+export const wrapTracer = (inner: Tracer.Tracer, policy: RedactionPolicy): Tracer.Tracer => ({
+  context: inner.context,
+  span(options): Tracer.Span {
+    const real = inner.span(options);
+    return {
+      _tag: 'Span',
+      spanId: real.spanId,
+      traceId: real.traceId,
+      parent: real.parent,
+      annotations: real.annotations,
+      get name() {
+        return real.name;
+      },
+      get status() {
+        return real.status;
+      },
+      get attributes() {
+        return real.attributes;
+      },
+      get links() {
+        return real.links;
+      },
+      sampled: real.sampled,
+      kind: real.kind,
+      end: (endTime, exit) => {
+        real.end(endTime, exit);
+      },
+      attribute: (key, value) => {
+        const redacted = redactAttribute(key, value, policy);
+        if (redacted !== DROP) real.attribute(key, redacted);
+      },
+      event: (name, startTime, attributes) => {
+        real.event(name, startTime, attributes ? redactAttributes(attributes, policy) : attributes);
+      },
+      addLinks: (links) => {
+        real.addLinks(links);
+      },
+    };
+  },
+});

package/src/unifi/drift.test.ts

@@ -0,0 +1,78 @@
+/**
+ * `makeDriftOf` (B6) against a synthetic field list — no SDK, no HTTP. `network.test.ts` and
+ * `firewall-zone.test.ts` each prove their own family's `driftOf` on top of this; this file proves
+ * the framework itself: an exact match reports nothing, a drifted field reports its own live and
+ * declared values (never swallowing a real difference into a single boolean), several drifted
+ * fields all report, and a custom `equal` overrides the default `deepEqual`.
+ */
+import { describe, expect, test } from 'bun:test';
+import { type DriftField, makeDriftOf } from './drift.ts';
+
+interface Widget {
+  name: string;
+  tags: string[];
+  nested: { count: number } | undefined;
+}
+
+const FIELDS: readonly DriftField<Widget, Widget>[] = [
+  { field: 'name', live: (a) => a.name, declared: (p) => p.name },
+  { field: 'nested', live: (a) => a.nested, declared: (p) => p.nested },
+  {
+    field: 'tags',
+    live: (a) => a.tags,
+    declared: (p) => p.tags,
+    equal: (live, declared) =>
+      [...(live as string[])].sort().join(',') === [...(declared as string[])].sort().join(','),
+  },
+];
+
+const widget = (overrides: Partial<Widget> = {}): Widget => ({
+  name: 'lan',
+  nested: { count: 1 },
+  tags: ['a', 'b'],
+  ...overrides,
+});
+
+describe('makeDriftOf', () => {
+  const driftOf = makeDriftOf(FIELDS);
+
+  test('an exact match reports nothing', () => {
+    const attrs = widget();
+    expect(driftOf(attrs, widget())).toEqual([]);
+  });
+
+  test('a drifted field reports its own live and declared values', () => {
+    const attrs = widget({ name: 'lan' });
+    const props = widget({ name: 'guest' });
+    expect(driftOf(attrs, props)).toEqual([{ field: 'name', live: 'lan', declared: 'guest' }]);
+  });
+
+  test('several drifted fields all report, independently', () => {
+    const attrs = widget({ name: 'lan', nested: { count: 1 } });
+    const props = widget({ name: 'guest', nested: { count: 2 } });
+    expect(driftOf(attrs, props)).toEqual([
+      { field: 'name', live: 'lan', declared: 'guest' },
+      { field: 'nested', live: { count: 1 }, declared: { count: 2 } },
+    ]);
+  });
+
+  test('the default comparison strips nullish, matching every matches() in this directory', () => {
+    const attrs = widget({ nested: undefined });
+    const props = { ...widget(), nested: null as unknown as undefined };
+    expect(driftOf(attrs, props)).toEqual([]);
+  });
+
+  test('a custom `equal` overrides the default -- an unordered set is not drift', () => {
+    const attrs = widget({ tags: ['b', 'a'] });
+    const props = widget({ tags: ['a', 'b'] });
+    expect(driftOf(attrs, props)).toEqual([]);
+  });
+
+  test('a custom `equal` still reports a genuine difference', () => {
+    const attrs = widget({ tags: ['a', 'b'] });
+    const props = widget({ tags: ['a', 'c'] });
+    expect(driftOf(attrs, props)).toEqual([
+      { field: 'tags', live: ['a', 'b'], declared: ['a', 'c'] },
+    ]);
+  });
+});

package/src/unifi/drift.ts

@@ -0,0 +1,56 @@
+/**
+ * B6: the field-level drift framework every family's own `driftOf(live, props)` is built on
+ * (`network-form.ts`, `firewall-zone-form.ts`, and whatever family follows). Consumed by
+ * `homeflare-network`'s pre-import drift check (its own C4, not built here) to show WHICH fields
+ * a live object and a committed declaration disagree on, before that script overwrites the
+ * committed module — never by a `Unifi.*` provider itself, which only ever needs `matches`'s
+ * boolean.
+ *
+ * ★ BUILT ON `matches`, NOT A SEPARATE COMPARISON. Each family's `driftOf` reuses the SAME
+ *   normalizers (`sortedSet`, the `dhcpGuarding`/`ipv6Configuration` null-vs-undefined handling)
+ *   its own `matches` already applies — so this reports NOTHING `matches` would call a noop, and
+ *   everything `matches` would call `update`, broken down by field instead of collapsed to one
+ *   boolean. Two comparisons drifting apart would be its own bug class; there is exactly one.
+ */
+import { deepEqual } from 'alchemy/Diff';
+
+/** One field whose live and declared values differ, as `makeDriftOf` reports it. */
+export interface FieldDrift {
+  readonly field: string;
+  readonly live: unknown;
+  readonly declared: unknown;
+}
+
+/** One field's comparison recipe for `makeDriftOf`. */
+export interface DriftField<Attributes, Props> {
+  readonly field: string;
+  readonly live: (attributes: Attributes) => unknown;
+  readonly declared: (props: Props) => unknown;
+  /**
+   * Defaults to `alchemy/Diff`'s `deepEqual` with `stripNullish: true` — the same tolerance
+   * every `matches` in this directory already gives UniFi's `null`-for-unset optionals (see
+   * `network-form.ts`'s header). Pass one explicitly for a field `matches` compares as a
+   * normalized SET (`firewall-zone-form.ts`'s `networkIds`), where plain `deepEqual` would
+   * report order as drift `matches` never would.
+   */
+  readonly equal?: (live: unknown, declared: unknown) => boolean;
+}
+
+const defaultEqual = (live: unknown, declared: unknown) =>
+  deepEqual(live, declared, { stripNullish: true });
+
+/**
+ * Builds a `(attributes, props) => FieldDrift[]` from a field list — the framework a family's own
+ * `*-form.ts` calls once, then wraps as `driftOf(live, props)` by feeding it `attributesOf(live,
+ * props)` (the task's own API: callers have a live SDK object, not `Attributes`, on hand).
+ */
+export const makeDriftOf =
+  <Attributes, Props>(fields: readonly DriftField<Attributes, Props>[]) =>
+  (attributes: Attributes, props: Props): FieldDrift[] =>
+    fields.flatMap(({ field, live, declared, equal = defaultEqual }) => {
+      const liveValue = live(attributes);
+      const declaredValue = declared(props);
+      return equal(liveValue, declaredValue)
+        ? []
+        : [{ field, live: liveValue, declared: declaredValue }];
+    });

package/src/unifi/errors-and-secrets.test.ts

@@ -0,0 +1,127 @@
+/**
+ * Runtime proof for A12 (T8/T23): the distilled regen's two behavioral changes actually decode
+ * through the real fake-fetch path every other `*.test.ts` in this family uses — not just typecheck.
+ *
+ * ⛔ WITHOUT THESE, A FUTURE REGEN THAT DROPS `sensitivePatterns` OR `errorEnvelope` STAYS GREEN.
+ *   Every other test here fixes response bodies before A2/A1 landed, so none of them would notice
+ *   either regressing back to a plain string / an always-`undefined` envelope.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import * as applicationInfo from '@distilled.cloud/unifi-network/application_info';
+import * as Retry from '@distilled.cloud/unifi-network/Retry';
+import * as Effect from 'effect/Effect';
+import * as Redacted from 'effect/Redacted';
+import { fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
+
+const WIFI_PATH = '/proxy/network/integration/v1/sites/site-1/wifi/broadcasts/wifi-1';
+
+// A fabricated sentinel, not a real WiFi passphrase (kit is PUBLIC — see fake-unifi.ts).
+const SENTINEL = 'sentinel-wpa-passphrase-do-not-log-me';
+
+const liveWifiBroadcast = () => ({
+  channel2gLockedTo6: false,
+  clientIsolationEnabled: false,
+  dtimPeriod2gLockedTo3: false,
+  enabled: true,
+  hideName: false,
+  id: 'wifi-1',
+  metadata: { origin: 'USER' },
+  multicastToUnicastConversionEnabled: false,
+  name: 'Guest',
+  type: 'STANDARD',
+  securityConfiguration: {
+    type: 'WPA_PERSONAL',
+    passphrase: SENTINEL,
+    presharedKeys: [{ network: { type: 'VLAN', networkId: 'net-1' }, passphrase: SENTINEL }],
+  },
+});
+
+describe('A2/T23 — WPA/PPSK passphrase decodes Redacted, not a plain string', () => {
+  test('both the single passphrase and every PPSK entry come back Redacted', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === WIFI_PATH
+        ? Response.json(liveWifiBroadcast())
+        : new Response('unexpected request', { status: 400 }),
+    );
+    const live = await Effect.runPromise(
+      wifiBroadcasts
+        .getWifiBroadcastDetails({ siteId: 'site-1', wifiBroadcastId: 'wifi-1' })
+        .pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    const { passphrase, presharedKeys } = live.securityConfiguration;
+    expect(Redacted.isRedacted(passphrase)).toBe(true);
+    expect(Redacted.value(passphrase as Redacted.Redacted<string>)).toBe(SENTINEL);
+    expect(Redacted.isRedacted(presharedKeys?.[0]?.passphrase)).toBe(true);
+  });
+
+  test('neither JSON.stringify nor String() ever shows the sentinel value', async () => {
+    const fake = fakeUnifi(() => Response.json(liveWifiBroadcast()));
+    const live = await Effect.runPromise(
+      wifiBroadcasts
+        .getWifiBroadcastDetails({ siteId: 'site-1', wifiBroadcastId: 'wifi-1' })
+        .pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(JSON.stringify(live)).not.toContain(SENTINEL);
+    expect(String(live.securityConfiguration.passphrase)).not.toContain(SENTINEL);
+  });
+});
+
+/** The pinned spec's `Error Message` schema (T8) — see `src/protocol.ts`'s module doc. */
+const envelopeBody = (over: Record<string, unknown> = {}) => ({
+  code: 'api.example.not-found',
+  message: 'vendor-provided failure text',
+  requestId: 'req-sentinel-1',
+  requestPath: '/v1/sites/site-1/secret-console-path',
+  statusCode: 404,
+  statusName: 'Not Found',
+  timestamp: '2026-01-01T00:00:00.000Z',
+  ...over,
+});
+
+describe('A1/T8 — the vendor Error Message envelope actually decodes', () => {
+  test('a mapped status (404) carries the vendor message, not a bare "HTTP 404"', async () => {
+    const fake = fakeUnifi(() => Response.json(envelopeBody(), { status: 404 }));
+    const failure = await Effect.runPromise(
+      Effect.flip(applicationInfo.getInfo({}).pipe(Effect.provide(fakeUnifiLayer(fake.fetch)))),
+    );
+    expect(failure._tag).toBe('NotFound');
+    expect((failure as { message?: string }).message).toBe('vendor-provided failure text');
+  });
+
+  test('an unmapped status (418) becomes UnknownUnifiNetworkError with the extra envelope fields', async () => {
+    // ⚠️ `Retry.none`: `UnknownUnifiNetworkError` is tagged a retryable server error by core's
+    //   default policy regardless of the actual (client, 4xx) status — this test asserts the
+    //   FAILURE, not the retry schedule (same reason `network.test.ts`'s 500 test needs it).
+    const fake = fakeUnifi(() =>
+      Response.json(envelopeBody({ statusCode: 418, statusName: "I'm a teapot" }), {
+        status: 418,
+      }),
+    );
+    const failure = await Effect.runPromise(
+      Effect.flip(
+        applicationInfo.getInfo({}).pipe(Retry.none, Effect.provide(fakeUnifiLayer(fake.fetch))),
+      ),
+    );
+    expect(failure._tag).toBe('UnknownUnifiNetworkError');
+    const err = failure as unknown as {
+      code?: string;
+      requestId?: string;
+      statusCode?: number;
+      statusName?: string;
+      timestamp?: string;
+      body: unknown;
+    };
+    expect(err.code).toBe('api.example.not-found');
+    expect(err.requestId).toBe('req-sentinel-1');
+    expect(err.statusCode).toBe(418);
+    expect(err.statusName).toBe("I'm a teapot");
+    expect(err.timestamp).toBe('2026-01-01T00:00:00.000Z');
+    // T3: requestPath is never plucked into its own field or into `message` …
+    expect('requestPath' in err).toBe(false);
+    // … but it IS still inside the raw body for anyone who reads that on purpose (README/errors.ts).
+    expect((err.body as { requestPath?: string }).requestPath).toBe(
+      '/v1/sites/site-1/secret-console-path',
+    );
+  });
+});

package/src/unifi/fake-unifi.ts

@@ -19,7 +19,11 @@ export const FAKE_KEY = 'placeholder-unifi-key';
 
 export type Seen = { readonly method: string; readonly path: string };
 
-/** No documented failure envelope (see `protocol.ts`) — plain text is all a failure needs. */
+/**
+ * Plain-text failure. `protocol.ts`'s `errorEnvelope` also decodes a documented JSON shape
+ * (`components.schemas["Error Message"]`, A1/T8) when a scenario needs that instead — see
+ * `errors-and-secrets.test.ts`'s `envelopeBody` helper for a fixture in that shape.
+ */
 export const fakeFailure = (status: number, detail: string) => new Response(detail, { status });
 
 /**

package/src/unifi/firewall-zone-form.ts

@@ -13,6 +13,7 @@
  *   the same reasoning `proxmox/user-wire.ts`'s `groupSet` gives for PVE's `groups`.
  */
 import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+import { makeDriftOf } from './drift.ts';
 
 export interface FirewallZoneProps {
   siteId: string;
@@ -45,9 +46,37 @@ export const attributesOf = (
   metadataOrigin: live.metadata.origin,
 });
 
+/**
+ * B6: `fieldDrift` (`makeDriftOf`, `drift.ts`) is now the ONLY comparison this family has — MEDIUM-4
+ * (red team, 2026-09-26): a hand-written `matches` kept beside `fieldDrift` is two field lists an
+ * edit to one can silently leave out of sync with the other (a mutant deleting a `fieldDrift` entry
+ * left every test green, because `matches` never consulted it). `matches(attrs, props) ===
+ * (driftOf(live, props).length === 0)` is now true BY CONSTRUCTION, not just by a test that happens
+ * to check both. `networkIds`' custom `equal` is the set comparison the family has always used —
+ * see the header — and its reported `live`/`declared` values in a `driftOf` result are the SORTED
+ * arrays, not the joined strings this `equal` compares internally, so a real diff reads as a set
+ * difference, not two opaque strings.
+ */
+const fieldDrift = makeDriftOf<FirewallZoneAttributes, FirewallZoneProps>([
+  { field: 'name', live: (a) => a.name, declared: (p) => p.name },
+  {
+    field: 'networkIds',
+    live: (a) => a.networkIds,
+    declared: (p) => sortedSet(p.networkIds),
+    equal: (live, declared) => (live as string[]).join(',') === (declared as string[]).join(','),
+  },
+]);
+
 export const matches = (attributes: FirewallZoneAttributes, props: FirewallZoneProps): boolean =>
-  attributes.name === props.name &&
-  attributes.networkIds.join(',') === sortedSet(props.networkIds).join(',');
+  fieldDrift(attributes, props).length === 0;
+
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export const driftOf = (live: firewall.FirewallZone, props: FirewallZoneProps) =>
+  fieldDrift(attributesOf(live, props), props);
 
 /**
  * The declaration renderer (task spec: "given one live object, return the props a declaration

package/src/unifi/firewall-zone.test.ts

@@ -5,7 +5,7 @@ import { describe, expect, test } from 'bun:test';
 import type * as firewall from '@distilled.cloud/unifi-network/firewall';
 import * as Effect from 'effect/Effect';
 import { fakeFailure, fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
-import { attributesOf, matches } from './firewall-zone-form.ts';
+import { attributesOf, driftOf, matches } from './firewall-zone-form.ts';
 import { type FirewallZoneProps, declareFirewallZone, spec } from './firewall-zone.ts';
 import { unifiOperations } from './resource.ts';
 
@@ -59,6 +59,26 @@ describe('declareFirewallZone -- the declaration renderer', () => {
   });
 });
 
+describe('driftOf -- B6 field-level drift, straight from one live read', () => {
+  test('a live object that matches its declaration drifts on nothing, order included', () => {
+    // `networkIds` in a different order is a noop for `matches` (the header's own rule) --
+    // `driftOf` must agree, not report a set that only LOOKS different because of order.
+    expect(driftOf(liveZone(), PROPS)).toEqual([]);
+  });
+
+  test('a real name change reports its own field, live and declared', () => {
+    const live = liveZone({ name: 'Garage' });
+    expect(driftOf(live, PROPS)).toEqual([{ field: 'name', live: 'Garage', declared: 'Cameras' }]);
+  });
+
+  test('a genuine networkIds difference reports SORTED arrays, not joined strings', () => {
+    const live = liveZone({ networkIds: ['net-1'] });
+    expect(driftOf(live, PROPS)).toEqual([
+      { field: 'networkIds', live: ['net-1'], declared: ['net-1', 'net-2'] },
+    ]);
+  });
+});
+
 describe('Unifi.FirewallZone write paths never reach the vendor API', () => {
   test('reconcile on an exact-match adoption (H6) sends only the one read', async () => {
     const fake = fakeUnifi((method, url) =>

package/src/unifi/firewall-zone.ts

@@ -25,7 +25,7 @@ import type { UnifiRequirements, UnifiSpec } from './resource.ts';
 import { unifiHandlers } from './resource.ts';
 
 export type { FirewallZoneAttributes, FirewallZoneProps } from './firewall-zone-form.ts';
-export { declareFirewallZone } from './firewall-zone-form.ts';
+export { declareFirewallZone, driftOf } from './firewall-zone-form.ts';
 
 export interface UnifiFirewallZone extends Resource<
   'Unifi.FirewallZone',