@homeflare/alchemy 0.38.0 → 0.40.0

package/dist/unifi/network-drift.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Unifi.Network`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, not two
+ * hand-kept-in-sync comparisons. `matches` used to be a separate boolean expression in
+ * `network-form.ts`; MEDIUM-4 (red team, 2026-09-26) found that a `fieldDrift` entry could be
+ * deleted entirely and every test still passed, because `matches` never consulted `fieldDrift` at
+ * all. `matches(attrs, props) === (driftOf(live, props).length === 0)` is now true BY
+ * CONSTRUCTION — there is exactly one comparison — and every `fieldDrift` entry names ONE field
+ * plus its own live/declared value instead of collapsing straight to a boolean.
+ *
+ * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`). UniFi's JSON
+ *   answers `null` for an unset optional field; a declaration that omits the same prop carries
+ *   `undefined`. Without this, every plan against an object with one unset optional field would
+ *   report `update` forever — the exact "read and write are different shapes" trap
+ *   `netbox/values.ts` and `proxmox/user-wire.ts` both work around, here solved once by
+ *   `makeDriftOf`'s own default instead of a per-field coercion.
+ */
+import type * as networks from '@distilled.cloud/unifi-network/networks';
+import { type NetworkAttributes, type NetworkProps } from './network-form.ts';
+export declare const matches: (attributes: NetworkAttributes, props: NetworkProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: networks.NetworkDetails, props: NetworkProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=network-drift.d.ts.map

package/dist/unifi/network-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/network-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIlB,MAAM,mBAAmB,CAAC;AA8C3B,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,KAAG,OACjC,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,YAAY,sCAC5B,CAAC"}

package/dist/unifi/network-form.d.ts

@@ -1,4 +1,38 @@
+/**
+ * `Unifi.Network`'s wire shape: the declarable subset of `NetworkDetails`, and how a live read
+ * becomes both plan attributes and a rendered declaration.
+ *
+ * ⚠️ PROPS MIRROR `UpdateNetworkRequest`, NOT `NetworkDetails`. `default` and `metadata` are
+ *   server-derived — no writable endpoint in `networks.ts` accepts either — so they are
+ *   attributes-only, reported but never compared or declared. Everything else in `NetworkProps`
+ *   is exactly what `updateNetwork`/`createNetwork` would accept, even though this family never
+ *   calls either: the shape is what a future write path would need, and what today's read-only
+ *   `matches` compares against.
+ *
+ * ⛔ `ipv4Configuration` STAYS `unknown`, ON THE SDK'S OWN AUTHORITY. `networks.ts`'s own comment
+ *   ("Shape varies by variant — widened by scripts/convert.ts; see README") says the OpenAPI
+ *   discriminator this field varies over was flattened at generation time, not decoded per
+ *   variant. Comparing it as an opaque JSON value (below) is honest about that; guessing a
+ *   narrower shape here would silently stop matching the day a new variant's key order differs.
+ *   ⚠️ It may ALSO hide an unordered array the way `dhcpGuarding` and `ipv6Configuration` do
+ *   below — this family just can't know, because the shape is never decoded. If a future variant
+ *   plans spurious `update`s, suspect this field first and widen it into a typed, order-normalized
+ *   shape rather than adding another opaque comparison.
+ *
+ * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES: `dhcpGuarding.trustedDhcpServerIpAddresses`,
+ *   `ipv6Configuration.additionalHostIpSubnets`, and `ipv6Configuration.dnsServerIpAddressesOverride`.
+ *   The vendor document gives no indication any of the three is ordered — same reasoning
+ *   `firewall-zone-form.ts` gives for `networkIds`, and `proxmox/user-wire.ts`'s `groupSet` gives
+ *   for PVE's `groups` — but `matches` compares via alchemy's `deepEqual`, which sorts object KEYS
+ *   but NOT ARRAY ELEMENTS (`node_modules/alchemy/lib/Diff.js`). Left alone, a console that
+ *   returns the same set in a different order between calls plans a spurious `update`, and the
+ *   read-only reconcile then refuses every deploy. `sortedSet` (dedupe + sort) neutralizes that
+ *   before any of the three is attributed, declared, or compared. Every OTHER array field in this
+ *   family (there are none today besides these three) would stay declaration-order as written.
+ */
 import type * as networks from '@distilled.cloud/unifi-network/networks';
+export declare const normalizeDhcpGuarding: (value: networks.NetworkDHCPGuarding | undefined) => networks.NetworkDHCPGuarding | undefined;
+export declare const normalizeIpv6Configuration: (value: networks.NetworkIPv6Configuration | undefined) => networks.NetworkIPv6Configuration | undefined;
 /**
  * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE. `tsconfig.json` sets
  *   `exactOptionalPropertyTypes`, which treats `field?: T` (absent-or-T) and
@@ -47,14 +81,13 @@ export interface NetworkAttributes {
 }
 export declare const attributesOf: (live: networks.NetworkDetails, props: NetworkProps) => NetworkAttributes;
 /**
- * ⚠️ `stripNullish: true` ON EVERY COMPARISON. UniFi's JSON answers `null` for an unset optional
- *   field; a declaration that omits the same prop carries `undefined`. Without this option every
- *   plan against an object with one unset optional field would report `update` forever — the
- *   exact "read and write are different shapes" trap `netbox/values.ts` and `proxmox/user-wire.ts`
- *   both work around, here solved once with the engine's own `deepEqual` instead of a per-field
- *   coercion, because nothing here needs PVE's or NetBox's extra wire-format translation.
+ * MEDIUM-4 (red team, 2026-09-26): `matches` used to be a hand-written boolean expression here,
+ * kept in sync BY HAND with `network-drift.ts`'s separately-maintained field list — two comparisons
+ * that could (and, per a red-team mutant, silently did) drift apart. `matches` now lives in
+ * `network-drift.ts`, defined as `fieldDrift(...).length === 0` — the SAME comparison `driftOf`
+ * runs, not a second one. See that file's own header for the `stripNullish`/normalizer reasoning
+ * this expression used to carry.
  */
-export declare const matches: (attributes: NetworkAttributes, props: NetworkProps) => boolean;
 /**
  * The declaration renderer (task spec: "given one live object, return the props a declaration
  * needs so its plan is noop"). A later import script feeds `getNetworkDetails`'s own response

package/dist/unifi/network-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network-form.d.ts","sourceRoot":"","sources":["../../src/unifi/network-form.ts"],"names":[],"mappings":"AAiCA,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAwCzE;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACxD,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,QAAQ,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAClE,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvD,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,QAAQ,CAAC,wBAAwB,GAAG,SAAS,CAAC;IACjE,gBAAgB,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,YAAY,KAClB,iBAiBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,KAAG,OA6BL,CAAC;AAEzE;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SAAU,QAAQ,CAAC,cAAc,UAAU,MAAM,KAAG,YAgB7E,CAAC"}
+{"version":3,"file":"network-form.d.ts","sourceRoot":"","sources":["../../src/unifi/network-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAgBzE,eAAO,MAAM,qBAAqB,UACzB,QAAQ,CAAC,mBAAmB,GAAG,SAAS,KAC9C,QAAQ,CAAC,mBAAmB,GAAG,SAG6D,CAAC;AAOhG,eAAO,MAAM,0BAA0B,UAC9B,QAAQ,CAAC,wBAAwB,GAAG,SAAS,KACnD,QAAQ,CAAC,wBAAwB,GAAG,SAWhC,CAAC;AAER;;;;;;;GAOG;AACH,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,mFAAmF;IACnF,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,CAAC,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACxD,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,+BAA+B;IAC/B,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,iBAAiB,CAAC,EAAE,QAAQ,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAClE,gBAAgB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IACvC,qBAAqB,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC5C,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC/B;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,+FAA+F;IAC/F,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,MAAM,EAAE,MAAM,CAAC;IACf,YAAY,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACvD,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,iBAAiB,EAAE,OAAO,CAAC;IAC3B,iBAAiB,EAAE,QAAQ,CAAC,wBAAwB,GAAG,SAAS,CAAC;IACjE,gBAAgB,EAAE,OAAO,GAAG,SAAS,CAAC;IACtC,qBAAqB,EAAE,OAAO,GAAG,SAAS,CAAC;IAC3C,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;CAC9B;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,YAAY,KAClB,iBAiBD,CAAC;AAEH;;;;;;;GAOG;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,SAAU,QAAQ,CAAC,cAAc,UAAU,MAAM,KAAG,YAgB7E,CAAC"}

package/dist/unifi/network.d.ts

@@ -26,6 +26,7 @@ import { type NetworkAttributes, type NetworkProps } from './network-form.ts';
 import type { UnifiRequirements, UnifiSpec } from './resource.ts';
 export type { NetworkAttributes, NetworkProps } from './network-form.ts';
 export { declareNetwork } from './network-form.ts';
+export { driftOf } from './network-drift.ts';
 export interface UnifiNetwork extends Resource<'Unifi.Network', NetworkProps, NetworkAttributes, never, UnifiRequirements> {
 }
 export declare const UnifiNetwork: import("alchemy").ResourceClass<UnifiNetwork>;

package/dist/unifi/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAGlB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,6FACZ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,6FACZ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}

package/dist/unifi/paginate.d.ts

@@ -0,0 +1,24 @@
+import * as Effect from 'effect/Effect';
+/** The one response shape every UniFi Network list operation already has (`protocol.ts`). */
+export interface OffsetPage<T> {
+    readonly data: readonly T[];
+    readonly offset: number;
+    readonly totalCount: number;
+}
+/** The one request shape every UniFi Network list operation already accepts, plus its own fields. */
+export type OffsetPageRequest = {
+    readonly offset?: number;
+    readonly limit?: number;
+};
+declare const UnifiPaginationInconsistent_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiPaginationInconsistent";
+} & Readonly<A>;
+export declare class UnifiPaginationInconsistent extends UnifiPaginationInconsistent_base<{
+    readonly reason: 'offset-mismatch' | 'total-count-changed' | 'row-count-mismatch' | 'page-ceiling';
+    readonly detail: string;
+}> {
+    get message(): string;
+}
+export declare const pageAll: <Req extends OffsetPageRequest, T, E, R>(fetchPage: (request: Req) => Effect.Effect<OffsetPage<T>, E, R>, request: Req) => Effect.Effect<T[], E | UnifiPaginationInconsistent, R>;
+export {};
+//# sourceMappingURL=paginate.d.ts.map

package/dist/unifi/paginate.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"paginate.d.ts","sourceRoot":"","sources":["../../src/unifi/paginate.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,6FAA6F;AAC7F,MAAM,WAAW,UAAU,CAAC,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,SAAS,CAAC,EAAE,CAAC;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B;AAED,qGAAqG;AACrG,MAAM,MAAM,iBAAiB,GAAG;IAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAA;CAAE,CAAC;;;;AAQtF,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EACX,iBAAiB,GACjB,qBAAqB,GACrB,oBAAoB,GACpB,cAAc,CAAC;IACnB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;AA0BD,eAAO,MAAM,OAAO,GAAI,GAAG,SAAS,iBAAiB,EAAE,CAAC,EAAE,CAAC,EAAE,CAAC,aACjD,CAAC,OAAO,EAAE,GAAG,KAAK,MAAM,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,WACtD,GAAG,KACX,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,CAAC,GAAG,2BAA2B,EAAE,CAAC,CA4CpD,CAAC"}

package/dist/unifi/providers.d.ts

@@ -9,5 +9,5 @@
  * mirroring `../discord/providers.ts`.
  */
 import * as Layer from 'effect/Layer';
-export declare const providers: () => Layer.Layer<import("alchemy").Provider<import("./firewall-zone.ts").UnifiFirewallZone> | import("alchemy").Provider<import("./network.ts").UnifiNetwork>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const providers: () => Layer.Layer<import("alchemy").Provider<import("./acl-rule.ts").UnifiAclRule> | import("alchemy").Provider<import("./acl-rule-ordering.ts").UnifiAclRuleOrdering> | import("alchemy").Provider<import("./dns-policy.ts").UnifiDnsPolicy> | import("alchemy").Provider<import("./firewall-policy.ts").UnifiFirewallPolicy> | import("alchemy").Provider<import("./firewall-policy-ordering.ts").UnifiFirewallPolicyOrdering> | import("alchemy").Provider<import("./firewall-zone.ts").UnifiFirewallZone> | import("alchemy").Provider<import("./network.ts").UnifiNetwork> | import("alchemy").Provider<import("./traffic-matching-list.ts").UnifiTrafficMatchingList> | import("alchemy").Provider<import("./wifi-broadcast.ts").UnifiWifiBroadcast>, never, import("effect/unstable/http/HttpClient").HttpClient>;
 //# sourceMappingURL=providers.d.ts.map

package/dist/unifi/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/unifi/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAItC,eAAO,MAAM,SAAS,8NAA4E,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/unifi/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAWtC,eAAO,MAAM,SAAS,0xBAWnB,CAAC"}

package/dist/unifi/resource.d.ts

@@ -1,7 +1,7 @@
 import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
-import type * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as HttpClient from 'effect/unstable/http/HttpClient';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**
@@ -34,6 +34,41 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
     reconcile: (news: Props) => Effect.Effect<Attributes, E | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
     destroy: (olds: Props) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
 };
+/**
+ * B0a / T12 DEFENSE IN DEPTH. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at
+ * `reconcile`/`destroy` — every path this engine exposes already returns that refusal instead of
+ * calling an SDK write op. This guard stops the same thing one layer lower, AT THE WIRE: it wraps
+ * whatever `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in
+ * production, `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same
+ * "wrap, don't replace" seam) so a future resource file that, by mistake, called an SDK write
+ * operation directly — bypassing `unifiOperations` entirely — would still never reach the vendor
+ * API. `write-op-reference.test.ts` proves no such call exists today; this is what stops one from
+ * ever taking effect if one is ever added.
+ *
+ * ⚠️ `Effect.die`, NOT A TYPED FAILURE — classified per distilled-doctrine's "classify every
+ *   die/orDie". Every generated SDK operation (`networks.getNetworkDetails`, …) declares its OWN
+ *   closed error union from the pinned OpenAPI spec, and generated files are never hand-edited to
+ *   add a member to it. A typed `Effect.fail` here would be a failure mode absent from every op's
+ *   declared type the moment it occurred — a type-system lie. A defect is the sound way to add a
+ *   NEW "this must be structurally impossible" failure underneath types this package does not
+ *   own, exactly like `openbao`'s `refuse()` helpers' `Effect.die(new Error(...))` for a
+ *   configuration move that should never be reachable.
+ */
+export declare class UnifiNonGetRequest extends Error {
+    readonly method: string;
+    /** PATH ONLY, never the full URL — see `requestPath` below. */
+    readonly path: string;
+    constructor(method: string, 
+    /** PATH ONLY, never the full URL — see `requestPath` below. */
+    path: string);
+}
+/**
+ * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,
+ * for everything downstream, with `guardGetOnly`'s wrapped version (`HttpClient.layerMergedContext`
+ * — see the guard above). Exported so `get-only-guard.test.ts` can prove the mechanism directly,
+ * against a bare `HttpClient` service, without needing `CredentialsFromEnv` or any env var at all.
+ */
+export declare const GetOnlyHttpClient: import("effect/Layer").Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
 /**
  * The four provider handlers for a spec'd read-only UniFi object, wired once.
  *

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAGnE,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;IAChF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAChF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAEtB,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;sBAIP,KAAK;oBAYP,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAC9E,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAMzC,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAtCtB,QAAQ;;yBAElC,MAAM;;IAsCzB,SAAS,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACjC,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;IAChF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAChF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAEtB,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;sBAIP,KAAK;oBAYP,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EAStB;CACF;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,mFAE7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAC9E,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAMzC,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5GtB,QAAQ;;yBAElC,MAAM;;IA4GzB,SAAS,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACjC,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/scan-source.d.ts

@@ -0,0 +1,11 @@
+/**
+ * One left-to-right scan tracking a single state (code / `//` / `/* *\/` / string). Comments are
+ * blanked to spaces (newlines kept, so a caller's own line-number diagnostics still line up);
+ * string and template literal CONTENTS are left untouched, because a banned token hidden inside
+ * one is still an offense a caller needs to see.
+ */
+export declare const stripComments: (src: string) => string;
+/** Every `.ts` file under `dir`, recursively — a future `src/unifi/<subdir>/*.ts` is walked too. */
+export declare const walk: (dir: string) => string[];
+export declare const readSource: (path: string) => string;
+//# sourceMappingURL=scan-source.d.ts.map

package/dist/unifi/scan-source.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"scan-source.d.ts","sourceRoot":"","sources":["../../src/unifi/scan-source.ts"],"names":[],"mappings":"AAqBA;;;;;GAKG;AACH,eAAO,MAAM,aAAa,QAAS,MAAM,KAAG,MA2B3C,CAAC;AAEF,oGAAoG;AACpG,eAAO,MAAM,IAAI,QAAS,MAAM,KAAG,MAAM,EAIrC,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,MAAM,KAAG,MAAoC,CAAC"}

package/dist/unifi/traffic-matching-list-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.TrafficMatchingList`'s `matches` AND `driftOf` (B6) — both built on the ONE field list
+ * below, the same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s header explains
+ * (MEDIUM-4, red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)`
+ * is true BY CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`) — same "UniFi's
+ *   JSON answers `null`, a declaration omits" tolerance every other family here relies on.
+ * ★ `items` compares with the plain default `equal` (whole-value `deepEqual`) — see
+ *   `traffic-matching-list-form.ts`'s header for the accepted known gap this leaves for a
+ *   membership-preserving reorder.
+ */
+import type * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';
+import { type TrafficMatchingListAttributes, type TrafficMatchingListProps } from './traffic-matching-list-form.ts';
+export declare const matches: (attributes: TrafficMatchingListAttributes, props: TrafficMatchingListProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: trafficMatchingLists.TrafficMatchingList, props: TrafficMatchingListProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=traffic-matching-list-drift.d.ts.map

package/dist/unifi/traffic-matching-list-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traffic-matching-list-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAEnG,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAQzC,eAAO,MAAM,OAAO,eACN,6BAA6B,SAClC,wBAAwB,KAC9B,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SACZ,oBAAoB,CAAC,mBAAmB,SACvC,wBAAwB,sCACgB,CAAC"}

package/dist/unifi/traffic-matching-list-form.d.ts

@@ -0,0 +1,56 @@
+/**
+ * `Unifi.TrafficMatchingList`'s wire shape — the declarable subset of `TrafficMatchingList`
+ * (`getTrafficMatchingList`'s own decode target), and how a live read becomes both plan attributes
+ * and a rendered declaration.
+ *
+ * ★ NO `metadata` FIELD AT ALL — the simplest object shape in this directory. Unlike every other
+ *   family here (`FirewallZone`/`DNSPolicy`/`ACLRule`/`FirewallPolicy` all carry a server-derived
+ *   `metadata.origin`), `TrafficMatchingList` is just `{id, name, type, items?}` — nothing here is
+ *   attributes-only the way `metadataOrigin`/`index` are elsewhere.
+ *
+ * ★ `items` IS A REAL TS UNION POST-A3, COMPARED WHOLESALE — `Array<IPv4Matching> |
+ *   Array<IPv6Matching> | Array<PortMatching>`, keyed by the sibling `type` field
+ *   (`traffic_matching_lists.ts`'s own comment: "Shape depends on the sibling discriminator value").
+ *   The runtime schema is still a passthrough `S.Unknown` (A3's own changeset: narrower for a reader
+ *   at the type level only, so decode keeps every key including one this pinned spec doesn't yet
+ *   declare — same proof `discriminated-filter-decode.test.ts` runs for `FirewallPolicy`/`AclRule`).
+ *
+ * ⚠️ KNOWN GAP (T15, same shape `acl-rule-form.ts`/`firewall-policy-form.ts` both carry): a traffic
+ *   matching list's `items` is semantically a SET of match entries (matching is "is this traffic
+ *   covered by ANY entry," not order-dependent, unlike `firewall-policy-ordering-form.ts`'s own
+ *   sequences), but each entry is an OBJECT (`{type, value?, start?, stop?}`), not a bare string --
+ *   there is no cheap canonical sort key the way `sortedSet` gives a `string[]`. `deepEqual` compares
+ *   `items` order-sensitively, so a console-side reorder with no membership change would report a
+ *   spurious drift this read-only family's `reconcile` then refuses forever. Accepted, not fixed,
+ *   same proportion as ACL rule's own nested-filter gap: a generic object-set normalizer is bigger,
+ *   separate modelling work, not a mechanical extension of typing `items` per-discriminator (A3).
+ */
+import type * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';
+export interface TrafficMatchingListProps {
+    siteId: string;
+    trafficMatchingListId: string;
+    name: string;
+    /** Discriminator for `items`' own shape (e.g. an IPv4/IPv6/port list) — the spec enumerates no
+     *  fixed value set for it (also accepts a future vendor value it did not enumerate). */
+    type: string;
+    /** Match entries — a SET semantically, compared wholesale; see the header's known gap. */
+    items?: trafficMatchingLists.TrafficMatchingListItems | undefined;
+}
+export interface TrafficMatchingListAttributes {
+    siteId: string;
+    trafficMatchingListId: string;
+    name: string;
+    type: string;
+    items: trafficMatchingLists.TrafficMatchingListItems | undefined;
+}
+export declare const attributesOf: (live: trafficMatchingLists.TrafficMatchingList, props: TrafficMatchingListProps) => TrafficMatchingListAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getTrafficMatchingList`'s own response
+ * straight in and writes the result as `trafficMatchingList('<id>',
+ * declareTrafficMatchingList(live, siteId))` — no field is invented or defaulted beyond what
+ * `attributesOf` already reports, so `matches(attributesOf(live, props), declareTrafficMatchingList(
+ * live, siteId))` is `true` by construction (`traffic-matching-list.test.ts` proves it).
+ */
+export declare const declareTrafficMatchingList: (live: trafficMatchingLists.TrafficMatchingList, siteId: string) => TrafficMatchingListProps;
+//# sourceMappingURL=traffic-matching-list-form.d.ts.map

package/dist/unifi/traffic-matching-list-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traffic-matching-list-form.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;GA0BG;AACH,OAAO,KAAK,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAEnG,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb;4FACwF;IACxF,IAAI,EAAE,MAAM,CAAC;IACb,0FAA0F;IAC1F,KAAK,CAAC,EAAE,oBAAoB,CAAC,wBAAwB,GAAG,SAAS,CAAC;CACnE;AAED,MAAM,WAAW,6BAA6B;IAC5C,MAAM,EAAE,MAAM,CAAC;IACf,qBAAqB,EAAE,MAAM,CAAC;IAC9B,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,oBAAoB,CAAC,wBAAwB,GAAG,SAAS,CAAC;CAClE;AAED,eAAO,MAAM,YAAY,SACjB,oBAAoB,CAAC,mBAAmB,SACvC,wBAAwB,KAC9B,6BAMD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,0BAA0B,SAC/B,oBAAoB,CAAC,mBAAmB,UACtC,MAAM,KACb,wBAMD,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `Unifi.TrafficMatchingList` — one traffic matching list (IPv4/IPv6/port match entries) on a UniFi
+ * Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26: `Traffic Matching Lists`' 5 operations are byte-identical between
+ *   10.4.57 and 10.6.97, full raw operation objects; the 19-schema closure reachable from all 5
+ *   (`$ref` + `discriminator.mapping`) shares zero names with the 14 schemas that DID change
+ *   elsewhere in the document. Corroborated independently by the A3 changeset's own broader
+ *   25-operation/139-schema re-check (`.changeset/unifi-network-a3-typed-discriminator-filters.md`).
+ *   Full breakdown: `docs/unifi-traffic-matching-list.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';
+import * as Effect from 'effect/Effect';
+import { type TrafficMatchingListAttributes, type TrafficMatchingListProps } from './traffic-matching-list-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { TrafficMatchingListAttributes, TrafficMatchingListProps, } from './traffic-matching-list-form.ts';
+export { declareTrafficMatchingList } from './traffic-matching-list-form.ts';
+export { driftOf } from './traffic-matching-list-drift.ts';
+export interface UnifiTrafficMatchingList extends Resource<'Unifi.TrafficMatchingList', TrafficMatchingListProps, TrafficMatchingListAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiTrafficMatchingList: import("alchemy").ResourceClass<UnifiTrafficMatchingList>;
+/** `trafficMatchingList('office-subnets', props)` — `adopt(true)` piped on by default (H5); see
+ *  `network.ts`. */
+export declare const trafficMatchingList: (id: string, props: TrafficMatchingListProps) => Effect.Effect<UnifiTrafficMatchingList, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<TrafficMatchingListProps, trafficMatchingLists.TrafficMatchingList, TrafficMatchingListAttributes, trafficMatchingLists.GetTrafficMatchingListError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: TrafficMatchingListProps;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<TrafficMatchingListAttributes | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<TrafficMatchingListProps>;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: TrafficMatchingListProps;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: TrafficMatchingListProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiTrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiTrafficMatchingList>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=traffic-matching-list.d.ts.map

package/dist/unifi/traffic-matching-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,yGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,8IAI1C,CAAC"}

package/dist/unifi/wifi-broadcast-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.WifiBroadcast`'s `matches` AND `driftOf` (B6) — built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `dns-policy-drift.ts`'s header explains
+ * (MEDIUM-4): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true BY
+ * CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ★ THREE FIELDS REUSE `wifi-broadcast-form.ts`'s OWN NORMALIZERS ON THE `declared` SIDE TOO, not
+ *   just the `live` side — `firewall-zone-form.ts`'s `networkIds` gives the same reason: comparing
+ *   a freshly-normalized live value against an un-normalized declared value would report spurious
+ *   drift the moment a committed declaration's array happens to be in a different (still valid)
+ *   order than what `declareWifiBroadcast` would itself produce today.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import { type WifiBroadcastAttributes, type WifiBroadcastProps } from './wifi-broadcast-form.ts';
+export declare const matches: (attributes: WifiBroadcastAttributes, props: WifiBroadcastProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=wifi-broadcast-drift.d.ts.map

package/dist/unifi/wifi-broadcast-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAOxB,MAAM,0BAA0B,CAAC;AAoClC,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,KAAG,OAC7C,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,cAAc,CAAC,qBAAqB,SAAS,kBAAkB,sCAC/C,CAAC"}

package/dist/unifi/wifi-broadcast-form.d.ts

@@ -0,0 +1,127 @@
+/**
+ * `Unifi.WifiBroadcast`'s wire shape — the declarable subset of `WifiBroadcastOverview`, and how
+ * a live read becomes both plan attributes and a rendered declaration.
+ *
+ * ⛔ T23, THE WHOLE REASON THIS SHAPE DIFFERS FROM EVERY OTHER FAMILY HERE. Every other family's
+ *   `*-form.ts` (`network-form.ts`, `dns-policy-form.ts`, …) types its props against the vendor's
+ *   CREATE/UPDATE request — the fullest declarable shape, even though this stack never calls it.
+ *   `WifiBroadcastProps`/`WifiBroadcastAttributes` do NOT: `securityConfiguration` is typed
+ *   `wifiBroadcasts.WifiSecurityConfigurationOverview` — the PAGE OVERVIEW's own type, `{type,
+ *   presharedKeyNetworkIds}` — never `WifiSecurityConfigurationDetailObject` (the
+ *   `getWifiBroadcastDetails`/create/update shape, which carries `passphrase` and
+ *   `radiusConfiguration`). There is no DECLARED field on `WifiSecurityConfigurationOverview` for
+ *   `attributesOf`/`declareWifiBroadcast` below to name a passphrase into. See `wifi-broadcast.ts`'s
+ *   header for why `fetchLive` can only ever produce a `WifiBroadcastOverview` in the first place
+ *   (no get-by-id call exists for it).
+ *
+ * ⛔ THE TYPE SYSTEM ALONE DOES NOT ENFORCE THIS (red team, IMPORTANT-1, 2026-09-26). `@distilled
+ *   .cloud/core`'s wire decode does not strip a key a schema doesn't declare (this file's next
+ *   header block); the TS types above describe what a CORRECTLY-shaped response looks like, not
+ *   what the decoder actually returns at runtime, so a stray key nested inside `network`,
+ *   `hotspotConfiguration`, `broadcastingDeviceFilter`, or an element of `presharedKeyNetworkIds`
+ *   would ride along through a naive `{...live}`/pass-through copy exactly like the top-level
+ *   `securityConfiguration` object does. `normalizeRef`/`normalizeHotspot`/`normalizeDeviceFilter`
+ *   below rebuild EVERY nested object field-by-field for the same reason
+ *   `normalizeSecurityConfiguration` does — enumeration, not the type annotation, is what actually
+ *   stops it. `wifi-broadcast-secrets.test.ts` plants a sentinel inside each nested shape
+ *   (including one `presharedKeyNetworkIds` element) to prove it, not just the top level.
+ *
+ * ⚠️ EVERY OTHER FIELD REUSES THE SDK'S OWN OVERVIEW TYPES DIRECTLY (`WifiNetworkReference`,
+ *   `BroadcastingDeviceFilter`, `IntegrationWifiHotspotConfigurationOverviewDto`) rather than
+ *   redeclaring them — same reasoning `network-form.ts` gives for reusing `NetworkDHCPGuarding`/
+ *   `NetworkIPv6Configuration` verbatim: one shape to keep in sync with the SDK's own regen.
+ *
+ * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES, UNCONFIRMED AGAINST A LIVE CONSOLE (same caveat
+ *   `network-form.ts`'s header gives for its own three): `broadcastingDeviceFilter.deviceIds`/
+ *   `.deviceTagIds` and `securityConfiguration.presharedKeyNetworkIds` are membership sets by the
+ *   vendor description's own wording ("Defines the custom scope of devices…"), not ordered
+ *   sequences. `normalizeDeviceFilter`/`normalizeSecurityConfiguration`/`normalizeFrequencies`
+ *   neutralize the same "spurious update, refused by a read-only reconcile" failure mode
+ *   `network-form.ts`'s header describes, exactly like `firewall-zone-form.ts`'s `networkIds`.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+/**
+ * Rebuilds a reference field-by-field — never returns the object as received. IMPORTANT-1: this
+ * runs on EVERY reference this file handles (`network`, and each `presharedKeyNetworkIds`
+ * element) precisely because a reference is exactly the shape (`{network: WifiNetworkReference,
+ * passphrase}`) the details call uses to carry a PPSK passphrase (`IntegrationWifiPresharedKeyDto`,
+ * SDK `wifi_broadcasts.ts`); it is the most plausible place for a stray passphrase-shaped key to
+ * appear on the wire if the vendor ever leaked one onto the overview response.
+ */
+export declare const normalizeRef: (ref: wifiBroadcasts.WifiNetworkReference | undefined) => wifiBroadcasts.WifiNetworkReference | undefined;
+/**
+ * Rebuilds the hotspot configuration field-by-field. `IntegrationWifiHotspotConfigurationOverviewDto`
+ * declares only `type` (SDK `wifi_broadcasts.ts:743-753`) — a PASSPOINT/RADIUS secret would live on
+ * a wire key this type doesn't name, exactly the IMPORTANT-1 risk `normalizeRef` guards against.
+ */
+export declare const normalizeHotspot: (value: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined) => wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+/**
+ * ★ EXPORTED: `wifi-broadcast-drift.ts` reuses these exact normalizers so `matches`/`driftOf` can
+ *   never quietly disagree about what counts as a change (MEDIUM-4, `network-drift.ts`'s header).
+ *
+ * ⛔ NO `{...value}` SPREAD (red team, IMPORTANT-1) — `BroadcastingDeviceFilter` declares exactly
+ *   `type`/`deviceIds`/`deviceTagIds` (SDK `wifi_broadcasts.ts:125-129`); enumerating exactly those
+ *   three is what stops a stray wire key here, the same reason `normalizeSecurityConfiguration`
+ *   (below) never spreads its input.
+ */
+export declare const normalizeDeviceFilter: (value: wifiBroadcasts.BroadcastingDeviceFilter | undefined) => wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+export declare const normalizeFrequencies: (value: readonly number[] | undefined) => number[] | undefined;
+/**
+ * ⛔ NO `{...value}` SPREAD, UNLIKE EVERY OTHER NORMALIZER IN THIS DIRECTORY (`network-form.ts`'s
+ *   `normalizeDhcpGuarding`/`normalizeIpv6Configuration` both spread). This is the one field in
+ *   the whole `Unifi.*` tree with a spec-confirmed passphrase risk (T23): nothing in
+ *   `@distilled.cloud/core`'s wire key-mapping strips an object key the schema doesn't declare —
+ *   it only renames declared ones — so a stray extra key on the WIRE `securityConfiguration`
+ *   object (a vendor bug, or a future console version) survives `getWifiBroadcastPage`'s own
+ *   decode untyped, and `{...value}` would carry it straight through into `Attributes`/`Props`/the
+ *   rendered declaration. Enumerating exactly the two fields
+ *   `WifiSecurityConfigurationOverview` declares is what actually stops that — proved by
+ *   `wifi-broadcast-secrets.test.ts`'s sentinel test, which injects exactly this kind of stray key.
+ */
+export declare const normalizeSecurityConfiguration: (value: wifiBroadcasts.WifiSecurityConfigurationOverview) => wifiBroadcasts.WifiSecurityConfigurationOverview;
+/**
+ * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE — `exactOptionalPropertyTypes`; see
+ *   `network-form.ts`'s own header. `attributesOf`/`declareWifiBroadcast` echo a live optional
+ *   field structurally rather than defaulting it, so the target type must admit an explicit
+ *   `undefined`.
+ */
+export interface WifiBroadcastProps {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network?: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter?: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz?: number[] | undefined;
+    hotspotConfiguration?: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    /** ⛔ T23: the PAGE OVERVIEW's security shape ONLY — see this file's header. */
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+}
+export interface WifiBroadcastAttributes {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz: number[] | undefined;
+    hotspotConfiguration: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+    /** `metadata.origin` — server-derived, never declared; same split as every other family. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => WifiBroadcastAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getWifiBroadcastPage`'s own per-row
+ * response straight in and writes the result into `alchemy.run.ts` as `wifiBroadcast('<id>',
+ * declareWifiBroadcast(live, siteId))` — no field is invented or defaulted here beyond what
+ * `attributesOf` already reports, so `matches(attributesOf(live, props), declareWifiBroadcast(live,
+ * siteId))` is `true` by construction (`wifi-broadcast.test.ts` proves it) for any live object
+ * this SDK can decode. Builds ONLY from fields `WifiBroadcastOverview` has — never a passphrase,
+ * which that type cannot express (see this file's header).
+ */
+export declare const declareWifiBroadcast: (live: wifiBroadcasts.WifiBroadcastOverview, siteId: string) => WifiBroadcastProps;
+//# sourceMappingURL=wifi-broadcast-form.d.ts.map

package/dist/unifi/wifi-broadcast-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-form.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAWtF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,QAClB,cAAc,CAAC,oBAAoB,GAAG,SAAS,KACnD,cAAc,CAAC,oBAAoB,GAAG,SAGqD,CAAC;AAa/F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UACpB,cAAc,CAAC,8CAA8C,GAAG,SAAS,KAC/E,cAAc,CAAC,8CAA8C,GAAG,SACX,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,UACzB,cAAc,CAAC,wBAAwB,GAAG,SAAS,KACzD,cAAc,CAAC,wBAAwB,GAAG,SAStC,CAAC;AAER,eAAO,MAAM,oBAAoB,UAAW,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,EAAE,GAAG,SAC/B,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,UAClC,cAAc,CAAC,iCAAiC,KACtD,cAAc,CAAC,iCAKhB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC1D,wBAAwB,CAAC,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC/E,0BAA0B,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClD,oBAAoB,CAAC,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IACjG,+EAA+E;IAC/E,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;CACzE;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACzD,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC9E,0BAA0B,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD,oBAAoB,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IAChG,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;IACxE,4FAA4F;IAC5F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,cAAc,CAAC,qBAAqB,SACnC,kBAAkB,KACxB,uBAYD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,SACzB,cAAc,CAAC,qBAAqB,UAClC,MAAM,KACb,kBAWD,CAAC"}