@homeflare/alchemy 0.39.0 → 0.40.0

package/dist/unifi/traffic-matching-list.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `Unifi.TrafficMatchingList` — one traffic matching list (IPv4/IPv6/port match entries) on a UniFi
+ * Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26: `Traffic Matching Lists`' 5 operations are byte-identical between
+ *   10.4.57 and 10.6.97, full raw operation objects; the 19-schema closure reachable from all 5
+ *   (`$ref` + `discriminator.mapping`) shares zero names with the 14 schemas that DID change
+ *   elsewhere in the document. Corroborated independently by the A3 changeset's own broader
+ *   25-operation/139-schema re-check (`.changeset/unifi-network-a3-typed-discriminator-filters.md`).
+ *   Full breakdown: `docs/unifi-traffic-matching-list.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';
+import * as Effect from 'effect/Effect';
+import { type TrafficMatchingListAttributes, type TrafficMatchingListProps } from './traffic-matching-list-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { TrafficMatchingListAttributes, TrafficMatchingListProps, } from './traffic-matching-list-form.ts';
+export { declareTrafficMatchingList } from './traffic-matching-list-form.ts';
+export { driftOf } from './traffic-matching-list-drift.ts';
+export interface UnifiTrafficMatchingList extends Resource<'Unifi.TrafficMatchingList', TrafficMatchingListProps, TrafficMatchingListAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiTrafficMatchingList: import("alchemy").ResourceClass<UnifiTrafficMatchingList>;
+/** `trafficMatchingList('office-subnets', props)` — `adopt(true)` piped on by default (H5); see
+ *  `network.ts`. */
+export declare const trafficMatchingList: (id: string, props: TrafficMatchingListProps) => Effect.Effect<UnifiTrafficMatchingList, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<TrafficMatchingListProps, trafficMatchingLists.TrafficMatchingList, TrafficMatchingListAttributes, trafficMatchingLists.GetTrafficMatchingListError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: TrafficMatchingListProps;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<TrafficMatchingListAttributes | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<TrafficMatchingListProps>;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: TrafficMatchingListProps;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: TrafficMatchingListProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiTrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiTrafficMatchingList>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=traffic-matching-list.d.ts.map

package/dist/unifi/traffic-matching-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,yGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,8IAI1C,CAAC"}

package/dist/unifi/wifi-broadcast-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.WifiBroadcast`'s `matches` AND `driftOf` (B6) — built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `dns-policy-drift.ts`'s header explains
+ * (MEDIUM-4): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true BY
+ * CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ★ THREE FIELDS REUSE `wifi-broadcast-form.ts`'s OWN NORMALIZERS ON THE `declared` SIDE TOO, not
+ *   just the `live` side — `firewall-zone-form.ts`'s `networkIds` gives the same reason: comparing
+ *   a freshly-normalized live value against an un-normalized declared value would report spurious
+ *   drift the moment a committed declaration's array happens to be in a different (still valid)
+ *   order than what `declareWifiBroadcast` would itself produce today.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import { type WifiBroadcastAttributes, type WifiBroadcastProps } from './wifi-broadcast-form.ts';
+export declare const matches: (attributes: WifiBroadcastAttributes, props: WifiBroadcastProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=wifi-broadcast-drift.d.ts.map

package/dist/unifi/wifi-broadcast-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAOxB,MAAM,0BAA0B,CAAC;AAoClC,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,KAAG,OAC7C,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,cAAc,CAAC,qBAAqB,SAAS,kBAAkB,sCAC/C,CAAC"}

package/dist/unifi/wifi-broadcast-form.d.ts

@@ -0,0 +1,127 @@
+/**
+ * `Unifi.WifiBroadcast`'s wire shape — the declarable subset of `WifiBroadcastOverview`, and how
+ * a live read becomes both plan attributes and a rendered declaration.
+ *
+ * ⛔ T23, THE WHOLE REASON THIS SHAPE DIFFERS FROM EVERY OTHER FAMILY HERE. Every other family's
+ *   `*-form.ts` (`network-form.ts`, `dns-policy-form.ts`, …) types its props against the vendor's
+ *   CREATE/UPDATE request — the fullest declarable shape, even though this stack never calls it.
+ *   `WifiBroadcastProps`/`WifiBroadcastAttributes` do NOT: `securityConfiguration` is typed
+ *   `wifiBroadcasts.WifiSecurityConfigurationOverview` — the PAGE OVERVIEW's own type, `{type,
+ *   presharedKeyNetworkIds}` — never `WifiSecurityConfigurationDetailObject` (the
+ *   `getWifiBroadcastDetails`/create/update shape, which carries `passphrase` and
+ *   `radiusConfiguration`). There is no DECLARED field on `WifiSecurityConfigurationOverview` for
+ *   `attributesOf`/`declareWifiBroadcast` below to name a passphrase into. See `wifi-broadcast.ts`'s
+ *   header for why `fetchLive` can only ever produce a `WifiBroadcastOverview` in the first place
+ *   (no get-by-id call exists for it).
+ *
+ * ⛔ THE TYPE SYSTEM ALONE DOES NOT ENFORCE THIS (red team, IMPORTANT-1, 2026-09-26). `@distilled
+ *   .cloud/core`'s wire decode does not strip a key a schema doesn't declare (this file's next
+ *   header block); the TS types above describe what a CORRECTLY-shaped response looks like, not
+ *   what the decoder actually returns at runtime, so a stray key nested inside `network`,
+ *   `hotspotConfiguration`, `broadcastingDeviceFilter`, or an element of `presharedKeyNetworkIds`
+ *   would ride along through a naive `{...live}`/pass-through copy exactly like the top-level
+ *   `securityConfiguration` object does. `normalizeRef`/`normalizeHotspot`/`normalizeDeviceFilter`
+ *   below rebuild EVERY nested object field-by-field for the same reason
+ *   `normalizeSecurityConfiguration` does — enumeration, not the type annotation, is what actually
+ *   stops it. `wifi-broadcast-secrets.test.ts` plants a sentinel inside each nested shape
+ *   (including one `presharedKeyNetworkIds` element) to prove it, not just the top level.
+ *
+ * ⚠️ EVERY OTHER FIELD REUSES THE SDK'S OWN OVERVIEW TYPES DIRECTLY (`WifiNetworkReference`,
+ *   `BroadcastingDeviceFilter`, `IntegrationWifiHotspotConfigurationOverviewDto`) rather than
+ *   redeclaring them — same reasoning `network-form.ts` gives for reusing `NetworkDHCPGuarding`/
+ *   `NetworkIPv6Configuration` verbatim: one shape to keep in sync with the SDK's own regen.
+ *
+ * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES, UNCONFIRMED AGAINST A LIVE CONSOLE (same caveat
+ *   `network-form.ts`'s header gives for its own three): `broadcastingDeviceFilter.deviceIds`/
+ *   `.deviceTagIds` and `securityConfiguration.presharedKeyNetworkIds` are membership sets by the
+ *   vendor description's own wording ("Defines the custom scope of devices…"), not ordered
+ *   sequences. `normalizeDeviceFilter`/`normalizeSecurityConfiguration`/`normalizeFrequencies`
+ *   neutralize the same "spurious update, refused by a read-only reconcile" failure mode
+ *   `network-form.ts`'s header describes, exactly like `firewall-zone-form.ts`'s `networkIds`.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+/**
+ * Rebuilds a reference field-by-field — never returns the object as received. IMPORTANT-1: this
+ * runs on EVERY reference this file handles (`network`, and each `presharedKeyNetworkIds`
+ * element) precisely because a reference is exactly the shape (`{network: WifiNetworkReference,
+ * passphrase}`) the details call uses to carry a PPSK passphrase (`IntegrationWifiPresharedKeyDto`,
+ * SDK `wifi_broadcasts.ts`); it is the most plausible place for a stray passphrase-shaped key to
+ * appear on the wire if the vendor ever leaked one onto the overview response.
+ */
+export declare const normalizeRef: (ref: wifiBroadcasts.WifiNetworkReference | undefined) => wifiBroadcasts.WifiNetworkReference | undefined;
+/**
+ * Rebuilds the hotspot configuration field-by-field. `IntegrationWifiHotspotConfigurationOverviewDto`
+ * declares only `type` (SDK `wifi_broadcasts.ts:743-753`) — a PASSPOINT/RADIUS secret would live on
+ * a wire key this type doesn't name, exactly the IMPORTANT-1 risk `normalizeRef` guards against.
+ */
+export declare const normalizeHotspot: (value: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined) => wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+/**
+ * ★ EXPORTED: `wifi-broadcast-drift.ts` reuses these exact normalizers so `matches`/`driftOf` can
+ *   never quietly disagree about what counts as a change (MEDIUM-4, `network-drift.ts`'s header).
+ *
+ * ⛔ NO `{...value}` SPREAD (red team, IMPORTANT-1) — `BroadcastingDeviceFilter` declares exactly
+ *   `type`/`deviceIds`/`deviceTagIds` (SDK `wifi_broadcasts.ts:125-129`); enumerating exactly those
+ *   three is what stops a stray wire key here, the same reason `normalizeSecurityConfiguration`
+ *   (below) never spreads its input.
+ */
+export declare const normalizeDeviceFilter: (value: wifiBroadcasts.BroadcastingDeviceFilter | undefined) => wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+export declare const normalizeFrequencies: (value: readonly number[] | undefined) => number[] | undefined;
+/**
+ * ⛔ NO `{...value}` SPREAD, UNLIKE EVERY OTHER NORMALIZER IN THIS DIRECTORY (`network-form.ts`'s
+ *   `normalizeDhcpGuarding`/`normalizeIpv6Configuration` both spread). This is the one field in
+ *   the whole `Unifi.*` tree with a spec-confirmed passphrase risk (T23): nothing in
+ *   `@distilled.cloud/core`'s wire key-mapping strips an object key the schema doesn't declare —
+ *   it only renames declared ones — so a stray extra key on the WIRE `securityConfiguration`
+ *   object (a vendor bug, or a future console version) survives `getWifiBroadcastPage`'s own
+ *   decode untyped, and `{...value}` would carry it straight through into `Attributes`/`Props`/the
+ *   rendered declaration. Enumerating exactly the two fields
+ *   `WifiSecurityConfigurationOverview` declares is what actually stops that — proved by
+ *   `wifi-broadcast-secrets.test.ts`'s sentinel test, which injects exactly this kind of stray key.
+ */
+export declare const normalizeSecurityConfiguration: (value: wifiBroadcasts.WifiSecurityConfigurationOverview) => wifiBroadcasts.WifiSecurityConfigurationOverview;
+/**
+ * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE — `exactOptionalPropertyTypes`; see
+ *   `network-form.ts`'s own header. `attributesOf`/`declareWifiBroadcast` echo a live optional
+ *   field structurally rather than defaulting it, so the target type must admit an explicit
+ *   `undefined`.
+ */
+export interface WifiBroadcastProps {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network?: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter?: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz?: number[] | undefined;
+    hotspotConfiguration?: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    /** ⛔ T23: the PAGE OVERVIEW's security shape ONLY — see this file's header. */
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+}
+export interface WifiBroadcastAttributes {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz: number[] | undefined;
+    hotspotConfiguration: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+    /** `metadata.origin` — server-derived, never declared; same split as every other family. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => WifiBroadcastAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getWifiBroadcastPage`'s own per-row
+ * response straight in and writes the result into `alchemy.run.ts` as `wifiBroadcast('<id>',
+ * declareWifiBroadcast(live, siteId))` — no field is invented or defaulted here beyond what
+ * `attributesOf` already reports, so `matches(attributesOf(live, props), declareWifiBroadcast(live,
+ * siteId))` is `true` by construction (`wifi-broadcast.test.ts` proves it) for any live object
+ * this SDK can decode. Builds ONLY from fields `WifiBroadcastOverview` has — never a passphrase,
+ * which that type cannot express (see this file's header).
+ */
+export declare const declareWifiBroadcast: (live: wifiBroadcasts.WifiBroadcastOverview, siteId: string) => WifiBroadcastProps;
+//# sourceMappingURL=wifi-broadcast-form.d.ts.map

package/dist/unifi/wifi-broadcast-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-form.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAWtF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,QAClB,cAAc,CAAC,oBAAoB,GAAG,SAAS,KACnD,cAAc,CAAC,oBAAoB,GAAG,SAGqD,CAAC;AAa/F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UACpB,cAAc,CAAC,8CAA8C,GAAG,SAAS,KAC/E,cAAc,CAAC,8CAA8C,GAAG,SACX,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,UACzB,cAAc,CAAC,wBAAwB,GAAG,SAAS,KACzD,cAAc,CAAC,wBAAwB,GAAG,SAStC,CAAC;AAER,eAAO,MAAM,oBAAoB,UAAW,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,EAAE,GAAG,SAC/B,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,UAClC,cAAc,CAAC,iCAAiC,KACtD,cAAc,CAAC,iCAKhB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC1D,wBAAwB,CAAC,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC/E,0BAA0B,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClD,oBAAoB,CAAC,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IACjG,+EAA+E;IAC/E,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;CACzE;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACzD,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC9E,0BAA0B,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD,oBAAoB,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IAChG,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;IACxE,4FAA4F;IAC5F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,cAAc,CAAC,qBAAqB,SACnC,kBAAkB,KACxB,uBAYD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,SACzB,cAAc,CAAC,qBAAqB,UAClC,MAAM,KACb,kBAWD,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `Unifi.WifiBroadcast` — one WiFi network (SSID) broadcast on a UniFi Network site, READ-ONLY
+ * (`policy.ts`).
+ *
+ * ⛔ T23, THE REASON THIS FAMILY NEVER CALLS `getWifiBroadcastDetails`. That single-object GET
+ *   returns `WifiBroadcastDetails`, whose `securityConfiguration`
+ *   (`WifiSecurityConfigurationDetailObject`) carries the WPA passphrase AND every PPSK entry's
+ *   passphrase — the pinned spec has NO `writeOnly` flag on either (verified: 4 `passphrase`
+ *   props, 0 `writeOnly`; A2 already redacts them to `Redacted.Redacted<string>` at the SDK layer,
+ *   `errors-and-secrets.test.ts`). This family goes further and never fetches that shape AT ALL:
+ *   the only call below is `getWifiBroadcastPage`, which answers `WifiBroadcastOverview` instead —
+ *   whose own `securityConfiguration` (`WifiSecurityConfigurationOverview`) is `{type,
+ *   presharedKeyNetworkIds}`. No passphrase field exists in that type, so `WifiBroadcastProps`/
+ *   `Attributes` (`wifi-broadcast-form.ts`) cannot carry one even by a future mistake.
+ *
+ * ⚠️ NO GET-BY-ID CALL EXISTS FOR THE OVERVIEW SHAPE — unlike every other family in this
+ *   directory (`getNetworkDetails`, `getFirewallZone`, `getDnsPolicy`, `getAclRule`),
+ *   `wifi_broadcasts.ts` only has `getWifiBroadcastPage` (list) and `getWifiBroadcastDetails`
+ *   (single, passphrase-bearing — forbidden above). `fetchLive` below walks every page with B0b's
+ *   `pageAll` and finds the one row matching `wifiBroadcastId` — the first real resource-level
+ *   consumer of that pager (previously exercised only by `paginate.test.ts` in isolation).
+ *
+ * ⚠️ THE `NotFound` CATCH BELOW IS FOR THE WHOLE WALK, NOT JUST THE FIRST PAGE CALL (red team,
+ *   MINOR-4, 2026-09-26 — corrected from an earlier claim that it only applied to the first call).
+ *   `pageAll` makes its sequential page calls inside one Effect pipeline, and `catchTag` here wraps
+ *   that entire pipeline; a 404 on ANY page of the walk — not only the first — folds to `undefined`
+ *   and discards whatever rows the walk had already collected. In practice this means "the site
+ *   vanished partway through listing its broadcasts" is indistinguishable from "the site was never
+ *   there" and from "the target id just isn't among the collected rows" — none of these three cases
+ *   has a separate vendor signal, and no other family's `fetchLive` distinguishes its own analogous
+ *   cases either. Read-only reporting treats all three the same conservative way (absent, not an
+ *   error); a write path would need to tell them apart.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import * as Effect from 'effect/Effect';
+import { type WifiBroadcastAttributes, type WifiBroadcastProps } from './wifi-broadcast-form.ts';
+import { type UnifiPaginationInconsistent } from './paginate.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { WifiBroadcastAttributes, WifiBroadcastProps } from './wifi-broadcast-form.ts';
+export { declareWifiBroadcast } from './wifi-broadcast-form.ts';
+export { driftOf } from './wifi-broadcast-drift.ts';
+export interface UnifiWifiBroadcast extends Resource<'Unifi.WifiBroadcast', WifiBroadcastProps, WifiBroadcastAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiWifiBroadcast: import("alchemy").ResourceClass<UnifiWifiBroadcast>;
+/** `wifiBroadcast('guest', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const wifiBroadcast: (id: string, props: WifiBroadcastProps) => Effect.Effect<UnifiWifiBroadcast, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<WifiBroadcastProps, wifiBroadcasts.WifiBroadcastOverview, WifiBroadcastAttributes, wifiBroadcasts.GetWifiBroadcastPageError | UnifiPaginationInconsistent>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: WifiBroadcastProps;
+        output: WifiBroadcastAttributes | undefined;
+    }) => Effect.Effect<WifiBroadcastAttributes | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<WifiBroadcastProps>;
+        output: WifiBroadcastAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: WifiBroadcastProps;
+    }) => Effect.Effect<WifiBroadcastAttributes, UnifiPaginationInconsistent | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: WifiBroadcastProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiWifiBroadcastProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiWifiBroadcast>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=wifi-broadcast.d.ts.map

package/dist/unifi/wifi-broadcast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,mGAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}

package/docs/unifi-acl-rule.md

@@ -0,0 +1,122 @@
+# UniFi ACL Rules — `Unifi.AclRule` / `Unifi.AclRuleOrdering`
+
+⛔ **READ-ONLY, BY TIM'S RULE (2026-09-24).** Same posture as `docs/unifi.md`'s `Unifi.Network`/
+`Unifi.FirewallZone`: `reconcile`/`delete` both fail with a typed `UnifiWriteRefused`, and the
+`GetOnlyHttpClient` wire guard (`resource.ts`) refuses any non-`GET` request before it reaches the
+transport. Neither family here calls `createAclRule`, `updateAclRule`, `deleteAclRule` or
+`updateAclRuleOrdering` anywhere — `write-op-reference.test.ts` proves it statically.
+
+## Two resources, because rule order is not a rule's own property (T5)
+
+`Unifi.AclRule` is one user-defined ACL rule (`getAclRule`/`getAclRulePage`).
+`Unifi.AclRuleOrdering` is the site's ONE ordered list of rule IDs (`getAclRuleOrdering`,
+`GET /v1/sites/{siteId}/acl-rules/ordering`) — not one-per-rule and not one-per-zone-pair the way a
+future `Unifi.FirewallPolicyOrdering` will be (`network.ts`'s header names that as a separate,
+bigger PR), because ACL rule ordering is site-wide, not keyed by a source/destination zone pair.
+
+⛔ **`orderedAclRuleIds` IS NEVER RUN THROUGH `sortedSet`.** Every other multi-value field in this
+directory that gets normalized (`firewall-zone-form.ts`'s `networkIds`, this family's own
+`enforcingDeviceFilter.deviceIds`/`protocolFilter` below) is a SET with no documented order.
+`orderedAclRuleIds` is the opposite: its position IS the value — `ACLRule.index`'s own field
+comment says "Lower index has higher priority," and the whole point of `updateAclRuleOrdering` is
+to change that priority by reordering the list. `acl-rule-ordering-form.ts`'s `matches`/`driftOf`
+compare it with plain `deepEqual`, which — per `drift.ts`'s own header — sorts object keys but
+never array elements, so leaving this one field un-normalized is what makes the resource actually
+represent order.
+
+## `Unifi.AclRule`'s own fields
+
+- **`sourceFilter`/`destinationFilter` stay opaque `unknown`**, on the SDK's own authority
+  (`access_control_acl_rules.ts`'s comment on both: "Shape varies by variant — widened by
+  scripts/convert.ts"). This is the same converter-flattening trap (T10) `network-form.ts` already
+  documents for `ipv4Configuration`; typing these per-discriminator (A3) is explicitly scoped OUT
+  of this PR. Compared with plain `deepEqual` — honest about not being decoded, not a guess at a
+  narrower shape. ⚠️ **Known gap until A3 (T15, red team, Minor finding 4)**: the vendor's own
+  filter variants (`IntegrationIpAclRuleNetworkEndpointFilterDto`'s `networkIds`,
+  `IntegrationIpAclRuleSubnetEndpointFilterDto`'s `ipAddressesOrSubnets`, both variants'
+  `portFilter`, `IntegrationMacAclRuleMacAddressEndpointFilterDto`'s `macAddresses`) are themselves
+  set-like arrays — `deepEqual` compares them order-sensitively, the same false-`update` risk
+  already fixed for `deviceIds`/`protocolFilter` below, just not fixable here without decoding the
+  filter first.
+- **`enforcingDeviceFilter.deviceIds` and `protocolFilter` are SETS**, normalized with the same
+  `sortedSet` `firewall-zone-form.ts` uses for `networkIds`: neither field's own vendor description
+  ("IDs of the Switch-capable devices used to enforce the ACL rule," "Protocols this ACL rule will
+  be applied to") indicates order, and leaving either un-normalized would let a console-side
+  reorder plan a spurious `update` this read-only family's `reconcile` then refuses forever.
+- **`index` is attributes-only, never declared.** `CreateAclRuleRequest`'s own comment on the
+  field: "This property is deprecated and has no effect. Use the dedicated ACL rule reordering
+  endpoint." Reported so a reader can see a rule's current position, but never compared —
+  `Unifi.AclRuleOrdering` above is where that position is actually declared.
+- **`metadata.origin` is attributes-only**, same split `firewall-zone-form.ts`'s `metadataOrigin`
+  uses — `UserDefinedOrDerivedEntityMetadata` is server-derived, no writable field accepts it.
+
+## T11 gate: per-tag closure diff, 10.4.57 vs 10.6.97 (checked 2026-09-26)
+
+Same method `spec-version-provenance.md` (distilled package) used for Networks/FirewallZones,
+run here for `DNS Policies` (5 ops) and `Access Control (ACL Rules)` (7 ops) — 12 operations total,
+covering both families in this PR plus `Unifi.DnsPolicy` (`docs/unifi-dns-policy.md`).
+
+- **Pin**: `~/.cache/homeflare/schemas/unifi/network_v10.4.57_openapi.json`, re-verified against
+  its own `SHA256SUMS` today (`3773947b…c9df59d`).
+- **Mirror**: `raw.githubusercontent.com/beezly/unifi-apis/main/unifi-network/10.6.97.json`,
+  diffing aid only, never a spec of record (Q5/M9) — `info.version: "10.6.97"`,
+  `sha256: 44fd0e7f81603bb1279889a528a443d8f1a0102436e4a29675d8451adf32bd78`, mirror commit
+  `f979dd64ec0ea6008c2a698c278fe49a10e102c8` (Andrew Beresford, 2026-08-20, "Add UniFi API specs:
+  Network 10.6.97", GitHub-verified signature).
+- **Operation count**: both versions carry exactly the same 12 operations for these two tags — zero
+  added, zero removed, in either direction.
+- **Full raw operation objects** (parameters, request body, responses, unresolved `$ref`s
+  included — not just named schemas, the same reason `unifi.md`'s own check goes past a
+  schema-name diff): byte-identical for all 12, both versions.
+- **14 component schemas differ somewhere in the whole document** (of 379/380 total) — the SAME 14
+  `unifi.md`'s own Networks/FirewallZones check found: 9 switch-stack/LAG schemas (`Switching`
+  tag), 4 generic `filter`-query-syntax schemas (`FilterExpression` and its three siblings,
+  matching the new `Filtering` tag), and one mDNS enum addition (`SHELLY`, `UniFi Devices` tag).
+  Full per-schema breakdown: the distilled package's own `docs/spec-version-provenance.md`.
+- **Reachability, corrected 2026-09-26 (red team, Important finding 1)**: the original pass
+  resolved only plain `$ref`s reachable from the 12 operations' full parameter/body/response trees
+  — 17 schema names. ⛔ **That walk is wrong for any discriminated schema**: both `DNS policy`
+  (`type`: `A_RECORD`…`TXT_RECORD`, `FORWARD_DOMAIN` — 7-way) and `ACL rule` (`type`: `IPV4`, `MAC`
+  — 2-way) are `discriminator`-typed, and a variant reachable only via `discriminator.mapping`
+  carries no `$ref` from its parent at all. Re-walked following `$ref` **and** `mapping` targets:
+  the closure is **46 schema names**, identical set in both versions. The 29 names the `$ref`-only
+  walk missed: all 7 DNS record variant DTOs (`IntegrationDnsARecordDto`,
+  `IntegrationDnsAaaaRecordDto`, `IntegrationDnsCnameRecordDto`, `IntegrationDnsForwardDomainPolicyDto`,
+  `IntegrationDnsMxRecordDto`, `IntegrationDnsSrvRecordDto`, `IntegrationDnsTxtRecordDto`) plus their
+  7 `*CreateUpdateDto` siblings; both ACL rule variant DTOs (`IntegrationIpAclRuleDto`,
+  `IntegrationMacAclRuleDto`) plus their 2 `*CreateUpdateDto` siblings; the IP/MAC endpoint-filter
+  DTOs (`IP ACL rule endpoint`, `MAC ACL rule endpoint`, `IntegrationIpAclRuleNetworkEndpointFilterDto`,
+  `IntegrationIpAclRulePortEndpointFilterDto`, `IntegrationIpAclRuleSubnetEndpointFilterDto`,
+  `IntegrationMacAclRuleMacAddressEndpointFilterDto`); `IntegrationAclRuleDevicesFilterDto`
+  (the device-filter's own `DEVICES` mapping target); and 2 more entity-metadata variants beyond the
+  five the original count already had. Re-diffed all 46 against the mirror with an order-independent
+  structural compare (not a byte/string compare — JSON key order differs between the pin and the
+  mirror file): **zero differ.** **Zero overlap** with the 14 schemas that changed elsewhere in the
+  document.
+
+**Answer unchanged: neither `DnsPolicy` nor `AclRule`/`AclRuleOrdering` would decode differently
+against 10.6.97** — the conclusion survives the correction; only the closure method and the schema
+count were wrong. **This does not generalize past 10.6.97 or to any other tag — re-run this check,
+following BOTH `$ref` and `discriminator.mapping`, before importing or declaring against `Clients`,
+`WiFi Broadcasts`, `Traffic Matching Lists`, `Switching`, or `Firewall` (`FirewallPolicy`); a
+`$ref`-only walk on `WiFi Broadcasts` finds 15 schemas and would miss
+`IntegrationWifiMdnsProxyPredefinedServiceDto`, which DID change (10.6.97 added the `SHELLY` enum
+member) and is reachable only through a `mapping`.**
+
+## The declaration renderers
+
+`declareAclRule(live, siteId)` and `declareAclRuleOrdering(live, siteId)` are pure functions, same
+contract as `declareNetwork`/`declareFirewallZone` (`docs/unifi.md`): given one live read, they
+return the `Props` a declaration needs so its plan is a no-op. Neither performs the read itself.
+
+## Field-level drift
+
+`acl-rule.ts`/`acl-rule-ordering.ts` each export a pure `driftOf(live, props)`
+(`acl-rule-drift.ts`, `acl-rule-ordering-form.ts`), built on the same `drift.ts`'s `makeDriftOf`
+framework as `Unifi.Network`/`Unifi.FirewallZone` — `matches` is exactly
+`fieldDrift(...).length === 0`, never a second hand-written comparison (MEDIUM-4).
+
+## Vendor version
+
+UniFi Network Integration API **10.4.57**, same pin as `docs/unifi.md`, via
+`@distilled.cloud/unifi-network` aliased onto `@homeflare/distilled-unifi-network@0.2.0`.

package/docs/unifi-dns-policy.md

@@ -0,0 +1,75 @@
+# UniFi DNS Policies — `Unifi.DnsPolicy`
+
+⛔ **READ-ONLY, BY TIM'S RULE (2026-09-24).** Same posture as `docs/unifi.md`'s `Unifi.Network`/
+`Unifi.FirewallZone`: `reconcile`/`delete` both fail with a typed `UnifiWriteRefused`, and the
+`GetOnlyHttpClient` wire guard (`resource.ts`) refuses any non-`GET` request before it reaches the
+transport. This family calls no SDK write op anywhere — `write-op-reference.test.ts` proves it
+statically, and `dns-policy.test.ts`'s own write-path tests prove `reconcile`/`destroy` never send
+anything but the one `GET` this spec's `fetchLive` makes.
+
+## One flat DTO for every DNS record type
+
+⚠️ **Corrected 2026-09-26 (red team, Important finding 1): the vendor spec DOES discriminate.**
+The pinned spec's `DNS policy` schema carries a 7-way `discriminator.mapping` on `type`
+(`A_RECORD`, `AAAA_RECORD`, `CNAME_RECORD`, `FORWARD_DOMAIN`, `MX_RECORD`, `SRV_RECORD`,
+`TXT_RECORD`), each mapping to its own variant DTO (`IntegrationDnsARecordDto`, …) that carries the
+record-specific fields (`ipv4Address`, `ttlSeconds`, `text`, …) — the base `DNS policy` schema
+itself has only `domain`/`enabled`/`id`/`metadata`/`type`. None of those variant DTOs are reachable
+from the base schema by a plain `$ref` walk; they exist only behind the `mapping` (T11 gate below).
+
+What IS still true: `scripts/convert.ts` FLATTENS all 7 variants into one struct — every variant
+field becomes optional on the same `DNSPolicy`/`CreateDnsPolicyRequest`/`UpdateDnsPolicyRequest`
+type, rather than widening any of them to `unknown` (T10). No two variants collide on a field name,
+so the flattening loses no information. **That means `dns-policy-form.ts` still has no opaque-JSON
+field to flag or defer, unlike `acl-rule-form.ts`'s `sourceFilter`/`destinationFilter`
+(`docs/unifi-acl-rule.md`)** — that conclusion holds; only the "never discriminates" reason given
+for it originally was wrong.
+
+⛔ **No array field exists anywhere in this shape**, so none of `network-form.ts`'s/
+`firewall-zone-form.ts`'s/`acl-rule-form.ts`'s `sortedSet` set-normalizing applies here —
+`drift.ts`'s default `stripNullish` tolerance for UniFi's `null`-for-unset-optional fields is the
+whole story for `dns-policy-drift.ts`.
+
+## `id`/`metadata` are attributes-only, same split as every other family here
+
+`DnsPolicyProps` mirrors `UpdateDnsPolicyRequest`, not `DNSPolicy`: `id` and `metadata.origin` are
+server-derived (no writable field accepts either), reported in `DnsPolicyAttributes` but never
+compared or declared — the same split `network-form.ts` and `firewall-zone-form.ts` document for
+their own server-derived fields.
+
+## T11 gate: per-tag closure diff, 10.4.57 vs 10.6.97 (checked 2026-09-26, corrected same day)
+
+Run together with `Unifi.AclRule`'s own gate, since both tags were diffed in the same pass —
+**full breakdown, pin/mirror checksums and mirror commit are in
+[`docs/unifi-acl-rule.md`](./unifi-acl-rule.md), not repeated here.** Summary for this family: all
+5 `DNS Policies` operations are byte-identical between 10.4.57 and 10.6.97 (parameters, request
+body, responses, unresolved `$ref`s included). ⚠️ The schema closure is **46 schemas, not 17** — a
+plain `$ref` walk misses everything reachable only through `discriminator.mapping` (see "One flat
+DTO" above), which for this tag is all 7 DNS record variant DTOs plus their 7 create/update
+siblings. Re-run with `$ref` + `mapping` both followed, the full 46-schema closure (both tags
+together) shares zero names with the 14 schemas that changed anywhere in the document between the
+two versions — all 14 are `Switching`-, `Filtering`- or one `UniFi Devices` enum-shaped, none of it
+DNS- or ACL-shaped. **Answer unchanged: `Unifi.DnsPolicy` would not decode differently against a
+10.6.97 console** — the conclusion survives the correction; only the closure method and count were
+wrong. **Method note for the next family (B4+): always follow `discriminator.mapping`, not just
+`$ref` — a `$ref`-only walk silently under-counts any tag with a discriminated schema.**
+
+## The declaration renderer
+
+`declareDnsPolicy(live, siteId)` is a pure function, same contract as `declareNetwork`/
+`declareFirewallZone` (`docs/unifi.md`): given one `getDnsPolicy` response, it returns the `Props`
+a declaration needs so its plan is a no-op. A later import script reads every DNS policy on a site
+and writes one `dnsPolicy('<id>', declareDnsPolicy(live, siteId))` row per result — nothing here
+performs that write.
+
+## Field-level drift
+
+`dns-policy.ts` exports a pure `driftOf(live, props)` (`dns-policy-drift.ts`), built on `drift.ts`'s
+`makeDriftOf` framework — the same one `Unifi.Network`/`Unifi.FirewallZone`/`Unifi.AclRule` use.
+`matches` is exactly `fieldDrift(...).length === 0`, never a second hand-written comparison
+(MEDIUM-4, `network-drift.ts`'s own header).
+
+## Vendor version
+
+UniFi Network Integration API **10.4.57**, same pin as `docs/unifi.md`, via
+`@distilled.cloud/unifi-network` aliased onto `@homeflare/distilled-unifi-network@0.2.0`.

package/docs/unifi-firewall-policy.md

@@ -0,0 +1,109 @@
+# UniFi Firewall Policies — `Unifi.FirewallPolicy` / `Unifi.FirewallPolicyOrdering`
+
+⛔ **READ-ONLY, BY TIM'S RULE (2026-09-24).** Same posture as `docs/unifi.md`'s `Unifi.Network`/
+`Unifi.FirewallZone`: `reconcile`/`delete` both fail with a typed `UnifiWriteRefused`, and the
+`GetOnlyHttpClient` wire guard (`resource.ts`) refuses any non-`GET` request before it reaches the
+transport. Neither family here calls `createFirewallPolicy`, `updateFirewallPolicy`,
+`patchFirewallPolicy`, `deleteFirewallPolicy` or `updateFirewallPolicyOrdering` anywhere —
+`write-op-reference.test.ts` proves it statically.
+
+## Two resources, because policy order is not a policy's own property (T5)
+
+`Unifi.FirewallPolicy` is one policy (`getFirewallPolicy`/`getFirewallPolicies`).
+`Unifi.FirewallPolicyOrdering` is the ordered `before`/`afterSystemDefined` policy-id lists for ONE
+`(sourceFirewallZoneId, destinationFirewallZoneId)` zone pair (`getFirewallPolicyOrdering`,
+`GET /v1/sites/{siteId}/firewall/policies/ordering?sourceFirewallZoneId=…&destinationFirewallZoneId=…`)
+— unlike `Unifi.AclRuleOrdering` (`docs/unifi-acl-rule.md`), which is site-wide, because firewall
+policies are scoped to a zone pair and the vendor keys ordering the same way. There is no "list
+every zone pair" endpoint; a caller has to already know which pairs exist, typically by walking
+`getFirewallPolicies` (T9 — see below) and grouping by each policy's `source.zoneId`/
+`destination.zoneId`. Neither resource performs that discovery.
+
+⛔ **`beforeSystemDefined`/`afterSystemDefined` ARE NEVER RUN THROUGH `sortedSet`.** Both are
+sequences — within each half, position is priority — the same "order IS the value" reasoning
+`docs/unifi-acl-rule.md` gives for `orderedAclRuleIds`. `firewall-policy-ordering-form.ts` compares
+each half independently with plain `deepEqual`, so a policy moving from one half to the other
+reports as drift on BOTH fields rather than one combined reorder.
+
+## `Unifi.FirewallPolicy`'s own fields
+
+- **`action`/`destination`/`ipProtocolScope`/`schedule`/`source` are compound, compared wholesale.**
+  Post-A3 (`8ee11f1`), these decode as real per-discriminator TS unions instead of `unknown`
+  (`discriminated-filter-decode.test.ts` proves the wire path keeps every key, including one this
+  pinned spec doesn't yet declare) — but this PR does not go on to build a leaf-by-leaf declarable
+  schema for all 12 filter variants underneath them. Each is compared as ONE value with plain
+  `deepEqual` (`stripNullish`), the same proportion `acl-rule-form.ts`'s `enforcingDeviceFilter`
+  gets (one level of structure, not exploded into scalars).
+  ⚠️ **Known gap (T15, same shape as `acl-rule-form.ts`'s own)**: several of the vendor's filter
+  variants nested inside these fields are themselves set-like arrays with no documented order
+  (`FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
+  `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyIPAddressFilter.items`,
+  `FirewallPolicyRegionFilter.regions`, `FirewallPolicyVPNServerFilter.vpnServerIds`,
+  `FirewallSchedule.repeatOnDays`) — `deepEqual` compares them order-sensitively, so a console-side
+  reorder with no membership change would report a spurious drift this read-only family's
+  `reconcile` then refuses forever. Accepted, not fixed: normalizing 12 filter variants' own nested
+  arrays is bigger, separate modelling work, not a mechanical extension of A3.
+- **`connectionStateFilter` is the one top-level Props array, and is a SET** — "matches all
+  connection states" if null describes membership, not a sequence (unlike the ordering resource's
+  own lists, where position IS the value). Normalized with the same `sortedSet` every other family
+  here uses for a set-shaped array.
+- **`index` is attributes-only, never declared.** `CreateFirewallPolicyRequest` has no `index`
+  field — the live object's position among ALL policies on the site is reported, but its priority
+  relative to its own zone pair is `Unifi.FirewallPolicyOrdering`'s concern, same split
+  `acl-rule-form.ts`'s own `index` documents.
+- **`metadata.origin` is attributes-only**, same split every family here uses.
+
+## T11 gate: per-tag closure diff, 10.4.57 vs 10.6.97 (checked 2026-09-26)
+
+Same method `docs/unifi-acl-rule.md` used, run here for the `Firewall` tag's 13 operations (5
+already covered for `Unifi.FirewallZone` in `docs/unifi.md`; 8 new here: `getFirewallPolicies`,
+`createFirewallPolicy`, `getFirewallPolicyOrdering`, `updateFirewallPolicyOrdering`,
+`deleteFirewallPolicy`, `getFirewallPolicy`, `patchFirewallPolicy`, `updateFirewallPolicy`).
+
+- **Pin**: `~/.cache/homeflare/schemas/unifi/network_v10.4.57_openapi.json`, re-verified against
+  its own `SHA256SUMS` today (`3773947b…c9df59d`).
+- **Mirror**: `raw.githubusercontent.com/beezly/unifi-apis/main/unifi-network/10.6.97.json`,
+  diffing aid only, never a spec of record — re-fetched today, still `info.version: "10.6.97"`,
+  `sha256: 44fd0e7f81603bb1279889a528a443d8f1a0102436e4a29675d8451adf32bd78`, unchanged since mirror
+  commit `f979dd64ec0ea6008c2a698c278fe49a10e102c8` (Andrew Beresford, 2026-08-20, "Add UniFi API
+  specs: Network 10.6.97", GitHub-verified signature) — the same file `docs/unifi-acl-rule.md` cites.
+- **Operation count**: both versions carry exactly the same 13 operations for `Firewall` — zero
+  added, zero removed, either direction.
+- **Full raw operation objects** (parameters, request body, responses, unresolved `$ref`s included):
+  byte-identical for all 13, both versions.
+- **Reachability** (`$ref` AND `discriminator.mapping`, per `docs/unifi-acl-rule.md`'s corrected
+  method): the closure is **106 schema names**, identical set in both versions. Every one of the 12
+  filter variants' own sub-schemas (`IntegrationFirewallPolicySourceMacAddressFilterDto`, all three
+  IP-protocol-scope Dto families, both action Dtos, etc.) is in it. **Zero overlap** with the 14
+  schemas that changed elsewhere in the document (the same 9 `Switching`, 4 `Filtering`, 1 mDNS
+  schemas `docs/unifi.md`/`docs/unifi-acl-rule.md` already found) — re-diffed all 106 with an
+  order-independent structural compare: **zero differ**.
+- **Corroboration**: the A3 changeset's own broader re-check
+  (`.changeset/unifi-network-a3-typed-discriminator-filters.md`) independently walked all 25
+  FirewallPolicy/ACL rule/TrafficMatchingList operations together — a 139-schema closure, also
+  byte-identical between versions — against a mirror fetch the same day citing commit
+  `2457b337173c83599c583993210218b1b6c0f8e7` (that commit only touches `README.md`; the spec file
+  itself has been untouched, hence unchanged, since `f979dd64` above).
+
+**Answer: neither `FirewallPolicy` nor `FirewallPolicyOrdering` would decode differently against
+10.6.97.** This does not generalize past 10.6.97 or to any other tag — re-run this check, following
+BOTH `$ref` and `discriminator.mapping`, before importing or declaring against `Clients`,
+`Switching`, or any tag not yet covered by an existing `docs/unifi-*.md`.
+
+## The declaration renderers
+
+`declareFirewallPolicy(live, siteId)` and `declareFirewallPolicyOrdering(live, siteId, sourceZoneId,
+destZoneId)` are pure functions, same contract as every other family's own (`docs/unifi.md`): given
+one live read, they return the `Props` a declaration needs so its plan is a no-op.
+
+## Field-level drift
+
+`firewall-policy.ts`/`firewall-policy-ordering.ts` each export a pure `driftOf(live, props)`
+(`firewall-policy-drift.ts`, `firewall-policy-ordering-form.ts`), built on the same `drift.ts`'s
+`makeDriftOf` framework as every other family — `matches` is exactly `fieldDrift(...).length === 0`,
+never a second hand-written comparison (MEDIUM-4).
+
+## Vendor version
+
+UniFi Network Integration API **10.4.57**, same pin as `docs/unifi.md`, via
+`@distilled.cloud/unifi-network` aliased onto `@homeflare/distilled-unifi-network@0.3.0`.