@homeflare/alchemy 0.38.0 → 0.40.0

package/dist/unifi/firewall-policy-form.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `Unifi.FirewallPolicy`'s wire shape — the declarable subset of `FirewallPolicy` (`getFirewallPolicy`'s
+ * own decode target), and how a live read becomes both plan attributes and a rendered declaration.
+ * Rule ORDER is a separate resource (`firewall-policy-ordering.ts`, T5) — this file is one policy's
+ * own fields only.
+ *
+ * ★ `source`/`destination`/`ipProtocolScope`/`action`/`schedule` STAY COMPOUND, COMPARED WHOLESALE —
+ *   post-A3 (`8ee11f1`, "type FirewallPolicy/ACL/TrafficMatchingList filters per discriminator"),
+ *   these decode as real per-discriminator TS unions instead of `unknown`
+ *   (`discriminated-filter-decode.test.ts` proves the wire path keeps every key, including one this
+ *   pinned spec doesn't yet declare), so this file is honest about their real shape rather than
+ *   casting to `unknown` the way `acl-rule-form.ts` still does for its own opaque filters. It does
+ *   NOT follow that up with a leaf-by-leaf declarable schema for all 12 filter variants, though:
+ *   that is new modelling work this PR does not attempt, so each field is compared with plain
+ *   `deepEqual` (`stripNullish`) as ONE value, same proportion `acl-rule-form.ts`'s
+ *   `enforcingDeviceFilter` gets (one level of structure, not exploded into scalars).
+ *
+ * ⚠️ KNOWN GAP (T15, same shape as `acl-rule-form.ts`'s own — accepted, not fixed, here either):
+ *   several of the vendor's filter variants nested inside `source`/`destination`/`ipProtocolScope`
+ *   are themselves SET-LIKE arrays with no documented order —
+ *   `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
+ *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyIPAddressFilter.items`,
+ *   `FirewallPolicyRegionFilter.regions`, `FirewallPolicyVPNServerFilter.vpnServerIds`,
+ *   `FirewallSchedule.repeatOnDays` — `deepEqual` compares every one of them order-sensitively, so a
+ *   console-side reorder with no membership change would report a spurious drift this read-only
+ *   family's `reconcile` then refuses forever. Not fixed here for the same reason ACL's own gap
+ *   isn't: normalizing 12 filter variants' own nested arrays is a bigger, separate change, not a
+ *   proportional extension of typing per-discriminator (A3) into set-aware comparison too.
+ *
+ * ⛔ `connectionStateFilter` IS THE ONE TOP-LEVEL PROPS ARRAY, AND IS A SET — "Match on firewall
+ *   connection state. If null, matches all connection states" describes membership, not a sequence
+ *   (unlike `firewall-policy-ordering-form.ts`'s own `beforeSystemDefined`/`afterSystemDefined`,
+ *   where position IS the value). Normalized with the same `sortedSet` every other family in this
+ *   directory uses for a set-shaped array (`firewall-zone-form.ts`'s `networkIds`,
+ *   `acl-rule-form.ts`'s `protocolFilter`).
+ *
+ * ⛔ `index` IS ATTRIBUTES-ONLY, NEVER DECLARED. `CreateFirewallPolicyRequest` has no `index`
+ *   field at all — the live object's current position among ALL policies on the site is reported,
+ *   but a policy's PRIORITY relative to its own zone pair is `firewall-policy-ordering.ts`'s concern
+ *   (`OrderedFirewallPolicyIDs`), same split `acl-rule-form.ts`'s own `index` documents.
+ *
+ * ⛔ `metadata.origin` IS ATTRIBUTES-ONLY, same split every other family here uses
+ *   (`firewall-zone-form.ts`'s `metadataOrigin`) — `UserOrSystemDefinedOrDerivedEntityMetadata` is
+ *   server-derived, no writable field accepts it.
+ */
+import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+/** ★ EXPORTED so `firewall-policy-drift.ts` normalizes both live and declared sides identically —
+ *  see `acl-rule-form.ts`'s own header for why a normalizer applied to only one side is a bug
+ *  class (MEDIUM-4). */
+export declare const normalizeConnectionStateFilter: (value: readonly string[] | undefined) => string[] | undefined;
+/** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
+ *  `network-form.ts`'s own header. */
+export interface FirewallPolicyProps {
+    siteId: string;
+    firewallPolicyId: string;
+    action: firewall.FirewallPolicyAction;
+    /** Connection states this policy matches — compared as a SET, see the header. */
+    connectionStateFilter?: string[] | undefined;
+    description?: string | undefined;
+    /** Traffic destination — compound, compared wholesale; see the header's known gap. */
+    destination: firewall.FirewallPolicyDestination;
+    enabled: boolean;
+    /** IP version + protocol scope — compound, compared wholesale; see the header's known gap. */
+    ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
+    ipsecFilter?: string | undefined;
+    loggingEnabled: boolean;
+    name: string;
+    /** Schedule this policy is active on — compound, compared wholesale; see the header's known gap. */
+    schedule?: firewall.FirewallSchedule | undefined;
+    /** Traffic source — compound, compared wholesale; see the header's known gap. */
+    source: firewall.FirewallPolicySource;
+}
+export interface FirewallPolicyAttributes {
+    siteId: string;
+    firewallPolicyId: string;
+    action: firewall.FirewallPolicyAction;
+    connectionStateFilter: string[] | undefined;
+    description: string | undefined;
+    destination: firewall.FirewallPolicyDestination;
+    enabled: boolean;
+    /** Current position among ALL policies on the site — server-derived, never declared; see header. */
+    index: number;
+    ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
+    ipsecFilter: string | undefined;
+    loggingEnabled: boolean;
+    name: string;
+    schedule: firewall.FirewallSchedule | undefined;
+    source: firewall.FirewallPolicySource;
+    /** `metadata.origin` — server-derived, never declared; see `firewall-zone-form.ts`'s own. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: firewall.FirewallPolicy, props: FirewallPolicyProps) => FirewallPolicyAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getFirewallPolicy`'s own response
+ * straight in and writes the result as `firewallPolicy('<id>', declareFirewallPolicy(live, siteId))`
+ * — no field is invented or defaulted beyond what `attributesOf` already reports, so
+ * `matches(attributesOf(live, props), declareFirewallPolicy(live, siteId))` is `true` by
+ * construction (`firewall-policy.test.ts` proves it).
+ */
+export declare const declareFirewallPolicy: (live: firewall.FirewallPolicy, siteId: string) => FirewallPolicyProps;
+//# sourceMappingURL=firewall-policy-form.d.ts.map

package/dist/unifi/firewall-policy-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;sCACsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}

package/dist/unifi/firewall-policy-ordering-form.d.ts

@@ -0,0 +1,66 @@
+/**
+ * `Unifi.FirewallPolicyOrdering`'s wire shape — ONE resource per `(sourceFirewallZoneId,
+ * destinationFirewallZoneId)` ZONE PAIR (`getFirewallPolicyOrdering`'s own scope, `GET
+ * /v1/sites/{siteId}/firewall/policies/ordering?sourceFirewallZoneId=…&destinationFirewallZoneId=…`),
+ * not per policy and not site-wide. Compare with `acl-rule-ordering-form.ts`'s own header: ACL rule
+ * order is ONE list for the whole site because ACL rules have no zone concept; firewall policies are
+ * scoped to a zone pair (`firewall-zone.ts`'s own `Unifi.FirewallZone`), so the vendor keys ordering
+ * the same way — a console can have as many `Unifi.FirewallPolicyOrdering` resources as it has
+ * zone pairs with at least one user-defined policy between them.
+ *
+ * ⛔ T5 — `beforeSystemDefined`/`afterSystemDefined` ARE EACH A SEQUENCE, NEVER RUN THROUGH
+ *   `sortedSet`. `OrderedFirewallPolicyIDs`' own shape splits a zone pair's user-defined policies
+ *   into the ones ordered BEFORE the system-defined policies and the ones ordered AFTER them —
+ *   within each half, position is priority, the same "lower index/earlier position wins" reasoning
+ *   `acl-rule-ordering-form.ts` gives for `orderedAclRuleIds`. `drift.ts`'s `defaultEqual`
+ *   (`deepEqual`) already compares arrays element-by-element without sorting them, so leaving both
+ *   fields un-normalized is what makes the comparison order-sensitive, not an oversight.
+ *
+ * ★ TWO SEQUENCES, NOT ONE — the one real difference from `acl-rule-ordering-form.ts`'s single
+ *   `orderedAclRuleIds`. A policy ordered "before system-defined" and one ordered "after" can never
+ *   swap sides through this endpoint (there is no single combined list position that would let one
+ *   policy move from one half to the other) — `matches`/`driftOf` below compare each half
+ *   independently, so a policy moving from `beforeSystemDefined` to `afterSystemDefined` reports as
+ *   drift on BOTH fields, not a single reordering of one array.
+ *
+ * ★ `makeDriftOf`, NO CUSTOM `equal` — same framework every other family's `matches`/`driftOf`
+ *   share (MEDIUM-4). Its default `deepEqual` is already order-sensitive for arrays, so the absence
+ *   of a custom `equal` here is itself the "never sortedSet" rule in force, exactly as
+ *   `acl-rule-ordering-form.ts`'s own header explains for its one field.
+ */
+import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+export interface FirewallPolicyOrderingProps {
+    siteId: string;
+    sourceFirewallZoneId: string;
+    destinationFirewallZoneId: string;
+    /** Policy IDs ordered before the zone pair's system-defined policies, highest priority first —
+     *  never compared as a set (see header). */
+    beforeSystemDefined: string[];
+    /** Policy IDs ordered after the zone pair's system-defined policies, highest priority first —
+     *  never compared as a set (see header). */
+    afterSystemDefined: string[];
+}
+export interface FirewallPolicyOrderingAttributes {
+    siteId: string;
+    sourceFirewallZoneId: string;
+    destinationFirewallZoneId: string;
+    beforeSystemDefined: string[];
+    afterSystemDefined: string[];
+}
+export declare const attributesOf: (live: firewall.IntegrationFirewallPolicyOrderingDto, props: FirewallPolicyOrderingProps) => FirewallPolicyOrderingAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getFirewallPolicyOrdering`'s own
+ * response straight in and writes the result as `firewallPolicyOrdering('<id>',
+ * declareFirewallPolicyOrdering(live, siteId, sourceZoneId, destZoneId))` —
+ * `matches(attributesOf(live, props), declareFirewallPolicyOrdering(live, …))` is `true` by
+ * construction (`firewall-policy-ordering.test.ts` proves it).
+ */
+export declare const declareFirewallPolicyOrdering: (live: firewall.IntegrationFirewallPolicyOrderingDto, siteId: string, sourceFirewallZoneId: string, destinationFirewallZoneId: string) => FirewallPolicyOrderingProps;
+export declare const matches: (attributes: FirewallPolicyOrderingAttributes, props: FirewallPolicyOrderingProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`).
+ */
+export declare const driftOf: (live: firewall.IntegrationFirewallPolicyOrderingDto, props: FirewallPolicyOrderingProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=firewall-policy-ordering-form.d.ts.map

package/dist/unifi/firewall-policy-ordering-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-ordering-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-ordering-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAGzE,MAAM,WAAW,2BAA2B;IAC1C,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC;gDAC4C;IAC5C,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B;gDAC4C;IAC5C,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,MAAM,WAAW,gCAAgC;IAC/C,MAAM,EAAE,MAAM,CAAC;IACf,oBAAoB,EAAE,MAAM,CAAC;IAC7B,yBAAyB,EAAE,MAAM,CAAC;IAClC,mBAAmB,EAAE,MAAM,EAAE,CAAC;IAC9B,kBAAkB,EAAE,MAAM,EAAE,CAAC;CAC9B;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,oCAAoC,SAC5C,2BAA2B,KACjC,gCAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,6BAA6B,SAClC,QAAQ,CAAC,oCAAoC,UAC3C,MAAM,wBACQ,MAAM,6BACD,MAAM,KAChC,2BAMD,CAAC;AAeH,eAAO,MAAM,OAAO,eACN,gCAAgC,SACrC,2BAA2B,KACjC,OAAqD,CAAC;AAEzD;;;GAGG;AACH,eAAO,MAAM,OAAO,SACZ,QAAQ,CAAC,oCAAoC,SAC5C,2BAA2B,sCACa,CAAC"}

package/dist/unifi/firewall-policy-ordering.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `Unifi.FirewallPolicyOrdering` — the ordered `before`/`afterSystemDefined` policy-id lists for
+ * ONE `(sourceFirewallZoneId, destinationFirewallZoneId)` zone pair (`getFirewallPolicyOrdering`,
+ * `GET /v1/sites/{siteId}/firewall/policies/ordering`), READ-ONLY (`policy.ts`). T5/I4's per-family
+ * variant: `docs/unifi.md`'s own header named this "a future `Unifi.FirewallPolicyOrdering`" as a
+ * separate, bigger PR (see `acl-rule-ordering.ts`'s header for the same forward reference, now
+ * resolved) — this is that resource.
+ *
+ * ⚠️ NOT ONE OBJECT PER SITE, UNLIKE `acl-rule-ordering.ts` — the identity is the TRIPLE
+ *   `(siteId, sourceFirewallZoneId, destinationFirewallZoneId)`, both zone ids passed as QUERY
+ *   parameters on the same path every time (`firewall.ts`'s `GetFirewallPolicyOrderingRequest`).
+ *   There is no "list every zone pair with an ordering" endpoint — a caller (a future Lane C import)
+ *   has to already know which pairs exist, typically by walking `firewall.getFirewallPolicies`
+ *   (T9's own 424-live-policy scale — B0b's `pageAll`, see `firewall-policy.test.ts`'s own decode
+ *   proof) and grouping by each policy's `source.zoneId`/`destination.zoneId`. Nothing here performs
+ *   that discovery — this resource is one already-known pair's ordering, same as
+ *   `firewall-policy.ts`/`acl-rule.ts` are one already-known object's own fields.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { type FirewallPolicyOrderingAttributes, type FirewallPolicyOrderingProps } from './firewall-policy-ordering-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { FirewallPolicyOrderingAttributes, FirewallPolicyOrderingProps, } from './firewall-policy-ordering-form.ts';
+export { declareFirewallPolicyOrdering, driftOf } from './firewall-policy-ordering-form.ts';
+export interface UnifiFirewallPolicyOrdering extends Resource<'Unifi.FirewallPolicyOrdering', FirewallPolicyOrderingProps, FirewallPolicyOrderingAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiFirewallPolicyOrdering: import("alchemy").ResourceClass<UnifiFirewallPolicyOrdering>;
+/** `firewallPolicyOrdering('iot-to-external', props)` — `adopt(true)` piped on by default (H5); see
+ *  `network.ts`. */
+export declare const firewallPolicyOrdering: (id: string, props: FirewallPolicyOrderingProps) => Effect.Effect<UnifiFirewallPolicyOrdering, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<FirewallPolicyOrderingProps, firewall.IntegrationFirewallPolicyOrderingDto, FirewallPolicyOrderingAttributes, firewall.GetFirewallPolicyOrderingError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: FirewallPolicyOrderingProps;
+        output: FirewallPolicyOrderingAttributes | undefined;
+    }) => Effect.Effect<FirewallPolicyOrderingAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<FirewallPolicyOrderingProps>;
+        output: FirewallPolicyOrderingAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: FirewallPolicyOrderingProps;
+    }) => Effect.Effect<FirewallPolicyOrderingAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: FirewallPolicyOrderingProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiFirewallPolicyOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicyOrdering>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=firewall-policy-ordering.d.ts.map

package/dist/unifi/firewall-policy-ordering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAGjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAE5F,MAAM,WAAW,2BAA4B,SAAQ,QAAQ,CAC3D,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,2BAA2B,8DAGvC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,sBAAsB,OAAQ,MAAM,SAAS,2BAA2B,4GAC3B,CAAC;AAE3D,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,2BAA2B,EAC3B,QAAQ,CAAC,oCAAoC,EAC7C,gCAAgC,EAChC,QAAQ,CAAC,8BAA8B,CAiBxC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,mCAAmC,iJAI7C,CAAC"}

package/dist/unifi/firewall-policy.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `Unifi.FirewallPolicy` — one firewall policy on a UniFi Network site, READ-ONLY (`policy.ts`).
+ * `Unifi.FirewallPolicyOrdering` (`firewall-policy-ordering.ts`) is the sibling resource for policy
+ * ORDER within a zone pair (T5) — one per `(sourceFirewallZoneId, destinationFirewallZoneId)`, never
+ * this file's concern. `docs/unifi.md`'s own header names this pair as "a bigger, separate PR";
+ * this is that PR — see `docs/unifi-firewall-policy.md` for the full breakdown.
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26: the `Firewall` tag's 13 operations (5 already covered for
+ *   `Unifi.FirewallZone` in `docs/unifi.md`, 8 new here for `FirewallPolicy` — `getFirewallPolicies`,
+ *   `createFirewallPolicy`, `getFirewallPolicyOrdering`, `updateFirewallPolicyOrdering`,
+ *   `deleteFirewallPolicy`, `getFirewallPolicy`, `patchFirewallPolicy`, `updateFirewallPolicy`) are
+ *   byte-identical between 10.4.57 and 10.6.97, full raw operation objects; the 106-schema closure
+ *   reachable from all 13 (`$ref` + `discriminator.mapping`) shares zero names with the 14 schemas
+ *   that DID change elsewhere in the document. Corroborated independently by the A3 changeset's own
+ *   broader 25-operation/139-schema re-check (`.changeset/unifi-network-a3-typed-discriminator-filters.md`).
+ *   Full breakdown: `docs/unifi-firewall-policy.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { type FirewallPolicyAttributes, type FirewallPolicyProps } from './firewall-policy-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { FirewallPolicyAttributes, FirewallPolicyProps } from './firewall-policy-form.ts';
+export { declareFirewallPolicy } from './firewall-policy-form.ts';
+export { driftOf } from './firewall-policy-drift.ts';
+export interface UnifiFirewallPolicy extends Resource<'Unifi.FirewallPolicy', FirewallPolicyProps, FirewallPolicyAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiFirewallPolicy: import("alchemy").ResourceClass<UnifiFirewallPolicy>;
+/** `firewallPolicy('block-iot-wan', props)` — `adopt(true)` piped on by default (H5); see
+ *  `network.ts`. */
+export declare const firewallPolicy: (id: string, props: FirewallPolicyProps) => Effect.Effect<UnifiFirewallPolicy, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<FirewallPolicyProps, firewall.FirewallPolicy, FirewallPolicyAttributes, firewall.GetFirewallPolicyError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: FirewallPolicyProps;
+        output: FirewallPolicyAttributes | undefined;
+    }) => Effect.Effect<FirewallPolicyAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<FirewallPolicyProps>;
+        output: FirewallPolicyAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: FirewallPolicyProps;
+    }) => Effect.Effect<FirewallPolicyAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: FirewallPolicyProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiFirewallPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=firewall-policy.d.ts.map

package/dist/unifi/firewall-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAE9B,CAAC;AAEH;oBACoB;AACpB,eAAO,MAAM,cAAc,OAAQ,MAAM,SAAS,mBAAmB,oGACnB,CAAC;AAEnD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,mBAAmB,EACnB,QAAQ,CAAC,cAAc,EACvB,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}

package/dist/unifi/firewall-zone-form.d.ts

@@ -31,6 +31,12 @@ export interface FirewallZoneAttributes {
 }
 export declare const attributesOf: (live: firewall.FirewallZone, props: FirewallZoneProps) => FirewallZoneAttributes;
 export declare const matches: (attributes: FirewallZoneAttributes, props: FirewallZoneProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: firewall.FirewallZone, props: FirewallZoneProps) => import("./drift.ts").FieldDrift[];
 /**
  * The declaration renderer (task spec: "given one live object, return the props a declaration
  * needs so its plan is noop"). `matches(attributesOf(live, props), declareFirewallZone(live,

package/dist/unifi/firewall-zone-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-zone-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,YAAY,SACpB,iBAAiB,KACvB,sBAMD,CAAC;AAEH,eAAO,MAAM,OAAO,eAAgB,sBAAsB,SAAS,iBAAiB,KAAG,OAEZ,CAAC;AAE5E;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SACxB,QAAQ,CAAC,YAAY,UACnB,MAAM,KACb,iBAKD,CAAC"}
+{"version":3,"file":"firewall-zone-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAGzE,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,+BAA+B;IAC/B,IAAI,EAAE,MAAM,CAAC;IACb,6EAA6E;IAC7E,UAAU,EAAE,MAAM,EAAE,CAAC;CACtB;AAED,MAAM,WAAW,sBAAsB;IACrC,MAAM,EAAE,MAAM,CAAC;IACf,cAAc,EAAE,MAAM,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,EAAE,CAAC;IACrB,yEAAyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB;AAID,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,YAAY,SACpB,iBAAiB,KACvB,sBAMD,CAAC;AAuBH,eAAO,MAAM,OAAO,eAAgB,sBAAsB,SAAS,iBAAiB,KAAG,OAC3C,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,YAAY,SAAS,iBAAiB,sCAC/B,CAAC;AAE/C;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,SACxB,QAAQ,CAAC,YAAY,UACnB,MAAM,KACb,iBAKD,CAAC"}

package/dist/unifi/firewall-zone.d.ts

@@ -17,7 +17,7 @@ import * as Effect from 'effect/Effect';
 import { type FirewallZoneAttributes, type FirewallZoneProps } from './firewall-zone-form.ts';
 import type { UnifiRequirements, UnifiSpec } from './resource.ts';
 export type { FirewallZoneAttributes, FirewallZoneProps } from './firewall-zone-form.ts';
-export { declareFirewallZone } from './firewall-zone-form.ts';
+export { declareFirewallZone, driftOf } from './firewall-zone-form.ts';
 export interface UnifiFirewallZone extends Resource<'Unifi.FirewallZone', FirewallZoneProps, FirewallZoneAttributes, never, UnifiRequirements> {
 }
 export declare const UnifiFirewallZone: import("alchemy").ResourceClass<UnifiFirewallZone>;

package/dist/unifi/firewall-zone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-zone.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAE9D,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,YAAY,OAAQ,MAAM,SAAS,iBAAiB,kGACjB,CAAC;AAEjD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,iBAAiB,EACjB,QAAQ,CAAC,YAAY,EACrB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}
+{"version":3,"file":"firewall-zone.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,YAAY,OAAQ,MAAM,SAAS,iBAAiB,kGACjB,CAAC;AAEjD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,iBAAiB,EACjB,QAAQ,CAAC,YAAY,EACrB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}

package/dist/unifi/index.d.ts

@@ -6,8 +6,16 @@
  *   not depend on — mirrors `../netbox/index.ts`.
  */
 export { UNIFI_READ_ONLY_POLICY, UnifiWriteRefused, type UnifiWriteAction } from './policy.ts';
-export type { UnifiRequirements, UnifiSpec } from './resource.ts';
-export { UnifiNetwork, UnifiNetworkProvider, declareNetwork, network, type NetworkAttributes, type NetworkProps, } from './network.ts';
-export { UnifiFirewallZone, UnifiFirewallZoneProvider, declareFirewallZone, firewallZone, type FirewallZoneAttributes, type FirewallZoneProps, } from './firewall-zone.ts';
+export { GetOnlyHttpClient, UnifiNonGetRequest, type UnifiRequirements, type UnifiSpec, } from './resource.ts';
+export type { FieldDrift } from './drift.ts';
+export { UnifiNetwork, UnifiNetworkProvider, declareNetwork, network, type NetworkAttributes, type NetworkProps, driftOf as networkDriftOf, } from './network.ts';
+export { UnifiFirewallZone, UnifiFirewallZoneProvider, declareFirewallZone, firewallZone, type FirewallZoneAttributes, type FirewallZoneProps, driftOf as firewallZoneDriftOf, } from './firewall-zone.ts';
+export { UnifiDnsPolicy, UnifiDnsPolicyProvider, declareDnsPolicy, dnsPolicy, type DnsPolicyAttributes, type DnsPolicyProps, driftOf as dnsPolicyDriftOf, } from './dns-policy.ts';
+export { UnifiAclRule, UnifiAclRuleProvider, aclRule, declareAclRule, type AclRuleAttributes, type AclRuleProps, driftOf as aclRuleDriftOf, } from './acl-rule.ts';
+export { UnifiAclRuleOrdering, UnifiAclRuleOrderingProvider, aclRuleOrdering, declareAclRuleOrdering, type AclRuleOrderingAttributes, type AclRuleOrderingProps, driftOf as aclRuleOrderingDriftOf, } from './acl-rule-ordering.ts';
+export { UnifiWifiBroadcast, UnifiWifiBroadcastProvider, declareWifiBroadcast, wifiBroadcast, type WifiBroadcastAttributes, type WifiBroadcastProps, driftOf as wifiBroadcastDriftOf, } from './wifi-broadcast.ts';
+export { UnifiFirewallPolicy, UnifiFirewallPolicyProvider, declareFirewallPolicy, firewallPolicy, type FirewallPolicyAttributes, type FirewallPolicyProps, driftOf as firewallPolicyDriftOf, } from './firewall-policy.ts';
+export { UnifiFirewallPolicyOrdering, UnifiFirewallPolicyOrderingProvider, declareFirewallPolicyOrdering, firewallPolicyOrdering, type FirewallPolicyOrderingAttributes, type FirewallPolicyOrderingProps, driftOf as firewallPolicyOrderingDriftOf, } from './firewall-policy-ordering.ts';
+export { UnifiTrafficMatchingList, UnifiTrafficMatchingListProvider, declareTrafficMatchingList, trafficMatchingList, type TrafficMatchingListAttributes, type TrafficMatchingListProps, driftOf as trafficMatchingListDriftOf, } from './traffic-matching-list.ts';
 export { providers } from './providers.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/unifi/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unifi/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/F,YAAY,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAClE,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,KAAK,iBAAiB,EACtB,KAAK,YAAY,GAClB,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,GACvB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unifi/index.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,KAAK,gBAAgB,EAAE,MAAM,aAAa,CAAC;AAC/F,OAAO,EAIL,iBAAiB,EACjB,kBAAkB,EAClB,KAAK,iBAAiB,EACtB,KAAK,SAAS,GACf,MAAM,eAAe,CAAC;AACvB,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIjB,OAAO,IAAI,cAAc,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,OAAO,IAAI,mBAAmB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,SAAS,EACT,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,OAAO,IAAI,gBAAgB,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,OAAO,EACP,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,OAAO,IAAI,cAAc,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,eAAe,EACf,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,OAAO,IAAI,sBAAsB,GAClC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,OAAO,IAAI,oBAAoB,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,EACrB,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,OAAO,IAAI,qBAAqB,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,OAAO,IAAI,6BAA6B,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,OAAO,IAAI,0BAA0B,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}