@homeflare/alchemy 0.39.0 → 0.41.0

package/dist/unifi/acl-rule-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.AclRule`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s header explains (MEDIUM-4,
+ * red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true
+ * BY CONSTRUCTION.
+ *
+ * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`) — same "UniFi's
+ *   JSON answers `null`, a declaration omits" tolerance `network-drift.ts` documents.
+ * ⛔ `enforcingDeviceFilter`/`protocolFilter` RUN THROUGH `acl-rule-form.ts`'s normalizers on BOTH
+ *   sides before comparing — never applied to only `live` or only `declared` (that specific gap is
+ *   what MEDIUM-4's own mutant found in `network-drift.ts`; see its header).
+ */
+import type * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+import { type AclRuleAttributes, type AclRuleProps } from './acl-rule-form.ts';
+export declare const matches: (attributes: AclRuleAttributes, props: AclRuleProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: aclRules.ACLRule, props: AclRuleProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=acl-rule-drift.d.ts.map

package/dist/unifi/acl-rule-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AAEzF,OAAO,EACL,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIlB,MAAM,oBAAoB,CAAC;AA2B5B,eAAO,MAAM,OAAO,eAAgB,iBAAiB,SAAS,YAAY,KAAG,OACjC,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,OAAO,SAAS,YAAY,sCACrB,CAAC"}

package/dist/unifi/acl-rule-form.d.ts

@@ -0,0 +1,90 @@
+/**
+ * `Unifi.AclRule`'s wire shape — the declarable subset of `ACLRule` (`getAclRule`'s own decode
+ *   target — `ACLRuleObject` is the structurally-identical page-list item type, unused here), and
+ *   how a live read
+ * becomes both plan attributes and a rendered declaration. Rule ORDER is a separate resource
+ * (`acl-rule-ordering.ts`, T5) — this file is one rule's own fields only.
+ *
+ * ⚠️ `sourceFilter`/`destinationFilter` STAY `unknown`, ON THE SDK'S OWN AUTHORITY.
+ *   `access_control_acl_rules.ts`'s own comment on both ("Shape varies by variant — widened by
+ *   scripts/convert.ts; see README") says the OpenAPI discriminator these vary over was flattened
+ *   at generation time (T10), same as `network-form.ts`'s `ipv4Configuration`. A3 (typing these
+ *   per-discriminator) is scoped OUT of this PR — see the plan's family inventory — so both stay
+ *   opaque JSON, compared with plain `deepEqual`, honest about not being decoded.
+ *
+ * ⚠️ KNOWN GAP UNTIL A3 (T15, red team, Minor finding 4): the vendor's own variant DTOs for these
+ *   filters carry SET-LIKE arrays too (`networkIds`, `ipAddressesOrSubnets`, `portFilter`,
+ *   `macAddresses` — `docs/unifi-acl-rule.md`'s own field notes). Because the filter stays opaque,
+ *   `deepEqual` compares those nested arrays order-sensitively, the same false-`update` risk this
+ *   file already removes for `deviceIds`/`protocolFilter` by normalizing them — but here there is
+ *   no decoded field to normalize. Accepted as a known gap, not fixed, until A3 types the filter
+ *   per-discriminator and can apply `sortedSet` to its own array fields.
+ *
+ * ⛔ `index` IS ATTRIBUTES-ONLY, NEVER DECLARED. `CreateAclRuleRequest`'s own field comment:
+ *   "ACL rule index. This property is deprecated and has no effect. Use the dedicated ACL rule
+ *   reordering endpoint." The live object's current position is `acl-rule-ordering.ts`'s concern
+ *   (`ACLRuleOrdering.orderedAclRuleIds`), not this resource's declared identity — reporting it
+ *   here without comparing it avoids a field that can never converge under this family's own
+ *   `matches` (nothing here could ever change it) from silently pretending to be declarable.
+ *
+ * ⛔ `enforcingDeviceFilter.deviceIds` AND `protocolFilter` ARE SETS, NOT SEQUENCES — same
+ *   reasoning `firewall-zone-form.ts` gives for `networkIds`: "IDs of the Switch-capable devices
+ *   used to enforce the ACL rule" and "Protocols this ACL rule will be applied to" both describe
+ *   membership, with no indication either list is ordered like `acl-rule-ordering.ts`'s rule-id
+ *   sequence. Left alone, a console that returns either in a different order between calls would
+ *   plan a spurious `update` that this read-only family's `reconcile` then refuses forever.
+ */
+import type * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+/** ★ EXPORTED so `acl-rule-drift.ts` normalizes both live and declared sides identically — see
+ *  `network-form.ts`'s own header for why a normalizer applied to only one side is a bug class. */
+export declare const normalizeDeviceFilter: (value: aclRules.ACLRuleDeviceFilter | undefined) => aclRules.ACLRuleDeviceFilter | undefined;
+export declare const normalizeProtocolFilter: (value: readonly string[] | undefined) => string[] | undefined;
+/** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
+ *  `network-form.ts`'s own header. */
+export interface AclRuleProps {
+    siteId: string;
+    aclRuleId: string;
+    /** `ALLOW` or `BLOCK` (also accepts a future vendor value the spec did not enumerate). */
+    action: string;
+    description?: string | undefined;
+    /** Traffic destination filter — opaque, see the header. */
+    destinationFilter?: unknown;
+    enabled: boolean;
+    /** Devices enforcing this rule — compared as a SET, see the header. */
+    enforcingDeviceFilter?: aclRules.ACLRuleDeviceFilter | undefined;
+    name: string;
+    /** Traffic source filter — opaque, see the header. */
+    sourceFilter?: unknown;
+    type: string;
+    /** Protocols this rule applies to — compared as a SET, see the header. */
+    protocolFilter?: string[] | undefined;
+    networkIdFilter?: string | undefined;
+}
+export interface AclRuleAttributes {
+    siteId: string;
+    aclRuleId: string;
+    action: string;
+    description: string | undefined;
+    destinationFilter: unknown;
+    enabled: boolean;
+    enforcingDeviceFilter: aclRules.ACLRuleDeviceFilter | undefined;
+    /** ACL rule index (current priority position) — server-derived, never declared; see header. */
+    index: number;
+    name: string;
+    sourceFilter: unknown;
+    type: string;
+    protocolFilter: string[] | undefined;
+    networkIdFilter: string | undefined;
+    /** `metadata.origin` — server-derived, never declared; see `firewall-zone-form.ts`'s own. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: aclRules.ACLRule, props: AclRuleProps) => AclRuleAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getAclRule`'s own response straight in
+ * and writes the result as `aclRule('<id>', declareAclRule(live, siteId))` — no field is invented
+ * or defaulted beyond what `attributesOf` already reports, so `matches(attributesOf(live, props),
+ * declareAclRule(live, siteId))` is `true` by construction (`acl-rule.test.ts` proves it).
+ */
+export declare const declareAclRule: (live: aclRules.ACLRule, siteId: string) => AclRuleProps;
+//# sourceMappingURL=acl-rule-form.d.ts.map

package/dist/unifi/acl-rule-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule-form.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAmCG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AAIzF;mGACmG;AACnG,eAAO,MAAM,qBAAqB,UACzB,QAAQ,CAAC,mBAAmB,GAAG,SAAS,KAC9C,QAAQ,CAAC,mBAAmB,GAAG,SAM3B,CAAC;AAER,eAAO,MAAM,uBAAuB,UAC3B,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;sCACsC;AACtC,MAAM,WAAW,YAAY;IAC3B,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,0FAA0F;IAC1F,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,2DAA2D;IAC3D,iBAAiB,CAAC,EAAE,OAAO,CAAC;IAC5B,OAAO,EAAE,OAAO,CAAC;IACjB,uEAAuE;IACvE,qBAAqB,CAAC,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IACjE,IAAI,EAAE,MAAM,CAAC;IACb,sDAAsD;IACtD,YAAY,CAAC,EAAE,OAAO,CAAC;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,0EAA0E;IAC1E,cAAc,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACtC,eAAe,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CACtC;AAED,MAAM,WAAW,iBAAiB;IAChC,MAAM,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,iBAAiB,EAAE,OAAO,CAAC;IAC3B,OAAO,EAAE,OAAO,CAAC;IACjB,qBAAqB,EAAE,QAAQ,CAAC,mBAAmB,GAAG,SAAS,CAAC;IAChE,+FAA+F;IAC/F,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,YAAY,EAAE,OAAO,CAAC;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,cAAc,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACrC,eAAe,EAAE,MAAM,GAAG,SAAS,CAAC;IACpC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SAAU,QAAQ,CAAC,OAAO,SAAS,YAAY,KAAG,iBAezE,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,QAAQ,CAAC,OAAO,UAAU,MAAM,KAAG,YAatE,CAAC"}

package/dist/unifi/acl-rule-ordering-form.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `Unifi.AclRuleOrdering`'s wire shape — ONE resource per site (`getAclRuleOrdering`'s own scope,
+ * `GET /v1/sites/{siteId}/acl-rules/ordering`), not per rule. Compare with `firewall-zone-form.ts`'s
+ * `networkIds`, which is a genuine SET: this file's `orderedAclRuleIds` is the opposite case.
+ *
+ * ⛔ T5 — `orderedAclRuleIds` IS A SEQUENCE, NEVER RUN THROUGH `sortedSet`. The endpoint's own name
+ *   (`updateAclRuleOrdering`) and its field's own vendor comment on `ACLRule.index` ("Lower index
+ *   has higher priority") both say this list's POSITION is the entire value it carries — rule
+ *   priority. `firewall-zone-form.ts`'s `sortedSet`/`network-form.ts`'s three set normalizers all
+ *   exist to stop the OPPOSITE mistake (treating a set as if order mattered); applying the same
+ *   fix here would silently discard the one thing this resource represents. `drift.ts`'s
+ *   `defaultEqual` (`deepEqual`) already compares arrays element-by-element without sorting them
+ *   (its header: "sorts object KEYS but NOT ARRAY ELEMENTS") — so leaving this field un-normalized
+ *   is what makes the comparison order-sensitive, not an oversight to "fix" later.
+ *
+ * ★ `makeDriftOf` (`drift.ts`), NO CUSTOM `equal` — same framework every other family's
+ *   `matches`/`driftOf` share (MEDIUM-4). Its default `deepEqual` is ALREADY order-sensitive for
+ *   arrays (see the paragraph above), so the absence of a custom `equal` here, unlike
+ *   `firewall-zone-form.ts`'s `networkIds` entry, is itself the "never sortedSet" rule in force —
+ *   not an oversight.
+ */
+import type * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+export interface AclRuleOrderingProps {
+    siteId: string;
+    /** Rule IDs in priority order, highest priority first — never compared as a set (see header). */
+    orderedAclRuleIds: string[];
+}
+export interface AclRuleOrderingAttributes {
+    siteId: string;
+    orderedAclRuleIds: string[];
+}
+export declare const attributesOf: (live: aclRules.ACLRuleOrdering, props: AclRuleOrderingProps) => AclRuleOrderingAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getAclRuleOrdering`'s own response
+ * straight in and writes the result as `aclRuleOrdering('site-1', declareAclRuleOrdering(live,
+ * siteId))` — `matches(attributesOf(live, props), declareAclRuleOrdering(live, siteId))` is `true`
+ * by construction (`acl-rule-ordering.test.ts` proves it).
+ */
+export declare const declareAclRuleOrdering: (live: aclRules.ACLRuleOrdering, siteId: string) => AclRuleOrderingProps;
+export declare const matches: (attributes: AclRuleOrderingAttributes, props: AclRuleOrderingProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`). Only one field exists, so this either reports nothing or the whole
+ * ordered pair, never a per-position breakdown -- a future consumer wanting "which rule moved"
+ * would need to diff the two arrays itself.
+ */
+export declare const driftOf: (live: aclRules.ACLRuleOrdering, props: AclRuleOrderingProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=acl-rule-ordering-form.d.ts.map

package/dist/unifi/acl-rule-ordering-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule-ordering-form.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-ordering-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AAGzF,MAAM,WAAW,oBAAoB;IACnC,MAAM,EAAE,MAAM,CAAC;IACf,iGAAiG;IACjG,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,MAAM,WAAW,yBAAyB;IACxC,MAAM,EAAE,MAAM,CAAC;IACf,iBAAiB,EAAE,MAAM,EAAE,CAAC;CAC7B;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,eAAe,SACvB,oBAAoB,KAC1B,yBAGD,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,sBAAsB,SAC3B,QAAQ,CAAC,eAAe,UACtB,MAAM,KACb,oBAGD,CAAC;AAUH,eAAO,MAAM,OAAO,eACN,yBAAyB,SAC9B,oBAAoB,KAC1B,OAAqD,CAAC;AAEzD;;;;;GAKG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,eAAe,SAAS,oBAAoB,sCACrC,CAAC"}

package/dist/unifi/acl-rule-ordering.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `Unifi.AclRuleOrdering` — the ONE ordered list of user-defined ACL rule IDs for a site
+ * (`getAclRuleOrdering`/`updateAclRuleOrdering`, `GET`/`PUT /v1/sites/{siteId}/acl-rules/ordering`),
+ * READ-ONLY (`policy.ts`). T5's per-family variant of the ordering trap `docs/unifi-api-notes.md`
+ * warns about for `Unifi.FirewallPolicyOrdering` (`firewall-policy-ordering.ts`, keyed per zone
+ * pair rather than site-wide — see its own header for why): the endpoint replaces the WHOLE list
+ * on a write, so a partial or resorted body would drop or reorder every OTHER rule too.
+ * This family never writes at all, but its `matches`/`driftOf` (`acl-rule-ordering-form.ts`) are
+ * still order-preserving, never `sortedSet`, so a future write path inherits a correct comparison
+ * rather than one that has to be fixed alongside the first `update`.
+ *
+ * ★ ONE OBJECT PER SITE, NOT PER RULE — unlike `acl-rule.ts`, there is no per-object id in the
+ *   wire response at all (`ACLRuleOrdering` is just `{ orderedAclRuleIds }`); the resource's own
+ *   `id` (the stack-chosen string passed to `aclRuleOrdering(id, props)`) is a label the DECLARER
+ *   picks, same as `firewallZone`/`network`, not something read back from the vendor.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+import * as Effect from 'effect/Effect';
+import { type AclRuleOrderingAttributes, type AclRuleOrderingProps } from './acl-rule-ordering-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { AclRuleOrderingAttributes, AclRuleOrderingProps } from './acl-rule-ordering-form.ts';
+export { declareAclRuleOrdering, driftOf } from './acl-rule-ordering-form.ts';
+export interface UnifiAclRuleOrdering extends Resource<'Unifi.AclRuleOrdering', AclRuleOrderingProps, AclRuleOrderingAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiAclRuleOrdering: import("alchemy").ResourceClass<UnifiAclRuleOrdering>;
+/** `aclRuleOrdering('site-1', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const aclRuleOrdering: (id: string, props: AclRuleOrderingProps) => Effect.Effect<UnifiAclRuleOrdering, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<AclRuleOrderingProps, aclRules.ACLRuleOrdering, AclRuleOrderingAttributes, aclRules.GetAclRuleOrderingError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: AclRuleOrderingProps;
+        output: AclRuleOrderingAttributes | undefined;
+    }) => Effect.Effect<AclRuleOrderingAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<AclRuleOrderingProps>;
+        output: AclRuleOrderingAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: AclRuleOrderingProps;
+    }) => Effect.Effect<AclRuleOrderingAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: AclRuleOrderingProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiAclRuleOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRuleOrdering>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=acl-rule-ordering.d.ts.map

package/dist/unifi/acl-rule-ordering.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAG1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAE/B,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,eAAe,OAAQ,MAAM,SAAS,oBAAoB,qGACpB,CAAC;AAEpD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,oBAAoB,EACpB,QAAQ,CAAC,eAAe,EACxB,yBAAyB,EACzB,QAAQ,CAAC,uBAAuB,CAUjC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,4BAA4B,0IAC0D,CAAC"}

package/dist/unifi/acl-rule.d.ts

@@ -0,0 +1,49 @@
+/**
+ * `Unifi.AclRule` — one user-defined ACL rule on a UniFi Network site, READ-ONLY (`policy.ts`).
+ * `Unifi.AclRuleOrdering` (`acl-rule-ordering.ts`) is the sibling resource for rule ORDER (T5) —
+ * one per site, never this file's concern.
+ *
+ * ★ T11 GATE — see `dns-policy.ts`'s own header for the full closure-diff record: `Access Control
+ *   (ACL Rules)` (7 ops, including `getAclRuleOrdering`/`updateAclRuleOrdering`) is
+ *   byte-identical between 10.4.57 and 10.6.97, and unreachable from any of the 14 schemas that DID
+ *   change. Full breakdown: `docs/unifi-acl-rule.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+import * as Effect from 'effect/Effect';
+import { type AclRuleAttributes, type AclRuleProps } from './acl-rule-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { AclRuleAttributes, AclRuleProps } from './acl-rule-form.ts';
+export { declareAclRule } from './acl-rule-form.ts';
+export { driftOf } from './acl-rule-drift.ts';
+export interface UnifiAclRule extends Resource<'Unifi.AclRule', AclRuleProps, AclRuleAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiAclRule: import("alchemy").ResourceClass<UnifiAclRule>;
+/** `aclRule('block-iot-wan', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const aclRule: (id: string, props: AclRuleProps) => Effect.Effect<UnifiAclRule, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<AclRuleProps, aclRules.ACLRule, AclRuleAttributes, aclRules.GetAclRuleError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: AclRuleProps;
+        output: AclRuleAttributes | undefined;
+    }) => Effect.Effect<AclRuleAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<AclRuleProps>;
+        output: AclRuleAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: AclRuleProps;
+    }) => Effect.Effect<AclRuleAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: AclRuleProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiAclRuleProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRule>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=acl-rule.d.ts.map

package/dist/unifi/acl-rule.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"acl-rule.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,oBAAoB,CAAC;AAE7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,6FACZ,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,iBAAiB,EACjB,QAAQ,CAAC,eAAe,CAUzB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}

package/dist/unifi/dns-policy-drift.d.ts

@@ -0,0 +1,21 @@
+/**
+ * `Unifi.DnsPolicy`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s own header explains (MEDIUM-4,
+ * red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true
+ * BY CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ★ NO CUSTOM `equal` ANYWHERE. Every field is a scalar and `drift.ts`'s `defaultEqual`
+ *   (`deepEqual` with `stripNullish: true`) already gives UniFi's `null`-for-unset-optional
+ *   reality the same tolerance `network-drift.ts`/`firewall-zone-form.ts` rely on — see
+ *   `dns-policy-form.ts`'s own header for why no field here needs a set/order normalizer.
+ */
+import type * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+import { type DnsPolicyAttributes, type DnsPolicyProps } from './dns-policy-form.ts';
+export declare const matches: (attributes: DnsPolicyAttributes, props: DnsPolicyProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: dnsPolicies.DNSPolicy, props: DnsPolicyProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=dns-policy-drift.d.ts.map

package/dist/unifi/dns-policy-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/dns-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,KAAK,WAAW,MAAM,6CAA6C,CAAC;AAEhF,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAyBnG,eAAO,MAAM,OAAO,eAAgB,mBAAmB,SAAS,cAAc,KAAG,OACrC,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,WAAW,CAAC,SAAS,SAAS,cAAc,sCAC5B,CAAC"}

package/dist/unifi/dns-policy-form.d.ts

@@ -0,0 +1,97 @@
+/**
+ * `Unifi.DnsPolicy`'s wire shape — the declarable subset of `DNSPolicy`, and how a live read
+ * becomes both plan attributes and a rendered declaration.
+ *
+ * ★ ONE FLAT DTO FOR EVERY DNS RECORD `type` (`A_RECORD`/`AAAA_RECORD`/`CNAME_RECORD`/
+ *   `FORWARD_DOMAIN`/`MX_RECORD`/`SRV_RECORD`/`TXT_RECORD` — the pinned spec's `DNS policy` schema
+ *   DOES discriminate on `type`, via `discriminator.mapping` to 7 variant DTOs; see
+ *   `docs/unifi-dns-policy.md`'s "One flat DTO" section, corrected 2026-09-26). Unlike
+ *   `access_control_acl_rules.ts`'s `sourceFilter`/`destinationFilter` or `firewall.ts`'s policy
+ *   filters, NONE of `dns_policies.ts`'s fields were widened to `unknown` by the converter (T10) —
+ *   `scripts/convert.ts` flattens the 7 variants into one struct instead, because no two variants
+ *   collide on a field name, so every optional field still decodes as a plain scalar and there is
+ *   no discriminated-variant trap here to flag or defer past this PR.
+ *
+ * ⚠️ PROPS MIRROR `UpdateDnsPolicyRequest`, NOT `DNSPolicy` — same split `network-form.ts` and
+ *   `firewall-zone-form.ts` both use. `id` and `metadata` are server-derived (no writable field
+ *   accepts either), so they are attributes-only, reported but never compared or declared.
+ *   Everything else in `DnsPolicyProps` is exactly what `updateDnsPolicy`/`createDnsPolicy` would
+ *   accept, even though this family never calls either.
+ *
+ * ⛔ NO ARRAY FIELD ANYWHERE IN THIS SHAPE. Every field below is a scalar (`string`/`number`/
+ *   `boolean`), so none of `network-form.ts`'s/`firewall-zone-form.ts`'s `sortedSet` normalizing
+ *   is needed — `deepEqual`'s default `stripNullish` handling (`drift.ts`) is the whole story.
+ */
+import type * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+/**
+ * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE (`exactOptionalPropertyTypes` —
+ *   see `network-form.ts`'s own header for why `declareDnsPolicy` below needs it: it assigns a
+ *   live optional field straight through, so the target type must admit an explicit `undefined`,
+ *   not just omission).
+ */
+export interface DnsPolicyProps {
+    siteId: string;
+    dnsPolicyId: string;
+    enabled: boolean;
+    /** DNS record type: `A_RECORD`, `AAAA_RECORD`, `CNAME_RECORD`, `FORWARD_DOMAIN`, `MX_RECORD`,
+     *  `SRV_RECORD` or `TXT_RECORD` (the discriminator's own mapping keys, see the header). */
+    type: string;
+    domain?: string | undefined;
+    ipv6Address?: string | undefined;
+    /** Time to live in seconds. */
+    ttlSeconds?: number | undefined;
+    ipv4Address?: string | undefined;
+    targetDomain?: string | undefined;
+    /** IP address of the DNS Server that the DNS query is forwarded to. */
+    ipAddress?: string | undefined;
+    mailServerDomain?: string | undefined;
+    /** Priority. A lower number is preferred. */
+    priority?: number | undefined;
+    port?: number | undefined;
+    /** Protocol used by the service. */
+    protocol?: string | undefined;
+    /** Domain of the server that is running the service. */
+    serverDomain?: string | undefined;
+    /** Service associated with this SRV record. */
+    service?: string | undefined;
+    /** Weight. A relative value applicable for records with the same priority. A lower number is
+     *  preferred. */
+    weight?: number | undefined;
+    /** The text value associated with this TXT DNS record. Text can contain up to four
+     *  255-character strings. Lines containing commas must be enclosed in double quotes ("). */
+    text?: string | undefined;
+}
+export interface DnsPolicyAttributes {
+    siteId: string;
+    dnsPolicyId: string;
+    enabled: boolean;
+    type: string;
+    domain: string | undefined;
+    ipv6Address: string | undefined;
+    ttlSeconds: number | undefined;
+    ipv4Address: string | undefined;
+    targetDomain: string | undefined;
+    ipAddress: string | undefined;
+    mailServerDomain: string | undefined;
+    priority: number | undefined;
+    port: number | undefined;
+    protocol: string | undefined;
+    serverDomain: string | undefined;
+    service: string | undefined;
+    weight: number | undefined;
+    text: string | undefined;
+    /** `metadata.origin` (e.g. `USER`) — server-derived, never declared; see
+     *  `firewall-zone-form.ts`'s own `metadataOrigin` for the same split. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: dnsPolicies.DNSPolicy, props: DnsPolicyProps) => DnsPolicyAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getDnsPolicy`'s own response straight
+ * in and writes the result into `alchemy.run.ts` as `dnsPolicy('<id>', declareDnsPolicy(live,
+ * siteId))` — no field is invented or defaulted here beyond what `attributesOf` already reports,
+ * so `matches(attributesOf(live, props), declareDnsPolicy(live, siteId))` is `true` by
+ * construction (`dns-policy.test.ts` proves it) for any live object this SDK can decode.
+ */
+export declare const declareDnsPolicy: (live: dnsPolicies.DNSPolicy, siteId: string) => DnsPolicyProps;
+//# sourceMappingURL=dns-policy-form.d.ts.map

package/dist/unifi/dns-policy-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/dns-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;GAuBG;AACH,OAAO,KAAK,KAAK,WAAW,MAAM,6CAA6C,CAAC;AAEhF;;;;;GAKG;AACH,MAAM,WAAW,cAAc;IAC7B,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB;+FAC2F;IAC3F,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,+BAA+B;IAC/B,UAAU,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,uEAAuE;IACvE,SAAS,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,6CAA6C;IAC7C,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,oCAAoC;IACpC,QAAQ,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,wDAAwD;IACxD,YAAY,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAClC,+CAA+C;IAC/C,OAAO,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B;qBACiB;IACjB,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;gGAC4F;IAC5F,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;CAC3B;AAED,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,UAAU,EAAE,MAAM,GAAG,SAAS,CAAC;IAC/B,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,gBAAgB,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IAC7B,YAAY,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,MAAM,EAAE,MAAM,GAAG,SAAS,CAAC;IAC3B,IAAI,EAAE,MAAM,GAAG,SAAS,CAAC;IACzB;6EACyE;IACzE,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,WAAW,CAAC,SAAS,SACpB,cAAc,KACpB,mBAoBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,gBAAgB,SAAU,WAAW,CAAC,SAAS,UAAU,MAAM,KAAG,cAmB7E,CAAC"}

package/dist/unifi/dns-policy.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `Unifi.DnsPolicy` — one DNS policy on a UniFi Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26, CORRECTED SAME DAY (red team, Important finding 1): `DNS
+ *   Policies` is 5 operations, `Access Control (ACL Rules)` (`acl-rule.ts`) is 7 — 12 total.
+ *   Diffed the pinned 10.4.57 spec against a 10.6.97 mirror (`beezly/unifi-apis`, diffing aid
+ *   only, `docs/unifi-acl-rule.md` records the sha256 + mirror commit): all 12 full operation
+ *   objects (parameters, request body, responses, unresolved `$ref`s included) are byte-identical
+ *   across versions. ⚠️ The schema closure is 46, not 17 — a `$ref`-only walk misses every schema
+ *   reachable only via a `discriminator.mapping` (both `DNS policy` and `ACL rule` discriminate on
+ *   `type`); the 46-schema closure, `$ref` + `mapping` together, shares zero names with the 14
+ *   schemas that DID change between the two versions (all in `Switching`, `Filtering`, or one
+ *   `UniFi Devices` enum — none of it DNS- or ACL-shaped). Same reachability method
+ *   `spec-version-provenance.md` (distilled package) used for Networks/FirewallZones, extended to
+ *   follow `mapping` too; full breakdown in `docs/unifi-acl-rule.md`, not repeated per family.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+import * as Effect from 'effect/Effect';
+import { type DnsPolicyAttributes, type DnsPolicyProps } from './dns-policy-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { DnsPolicyAttributes, DnsPolicyProps } from './dns-policy-form.ts';
+export { declareDnsPolicy } from './dns-policy-form.ts';
+export { driftOf } from './dns-policy-drift.ts';
+export interface UnifiDnsPolicy extends Resource<'Unifi.DnsPolicy', DnsPolicyProps, DnsPolicyAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiDnsPolicy: import("alchemy").ResourceClass<UnifiDnsPolicy>;
+/** `dnsPolicy('lan-forwarding', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const dnsPolicy: (id: string, props: DnsPolicyProps) => Effect.Effect<UnifiDnsPolicy, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<DnsPolicyProps, dnsPolicies.DNSPolicy, DnsPolicyAttributes, dnsPolicies.GetDnsPolicyError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: DnsPolicyProps;
+        output: DnsPolicyAttributes | undefined;
+    }) => Effect.Effect<DnsPolicyAttributes | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<DnsPolicyProps>;
+        output: DnsPolicyAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: DnsPolicyProps;
+    }) => Effect.Effect<DnsPolicyAttributes, import("./policy.ts").UnifiWriteRefused | dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: DnsPolicyProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiDnsPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiDnsPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=dns-policy.d.ts.map

package/dist/unifi/dns-policy.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"dns-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/dns-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,WAAW,MAAM,6CAA6C,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAEnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,uGAAuG;AACvG,eAAO,MAAM,SAAS,OAAQ,MAAM,SAAS,cAAc,+FACd,CAAC;AAE9C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,cAAc,EACd,WAAW,CAAC,SAAS,EACrB,mBAAmB,EACnB,WAAW,CAAC,iBAAiB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}

package/dist/unifi/firewall-policy-drift.d.ts

@@ -0,0 +1,26 @@
+/**
+ * `Unifi.FirewallPolicy`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below,
+ * the same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s header explains (MEDIUM-4,
+ * red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true
+ * BY CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`) — same "UniFi's
+ *   JSON answers `null`, a declaration omits" tolerance every other family here relies on.
+ * ⛔ `connectionStateFilter` RUNS THROUGH `firewall-policy-form.ts`'s normalizer on BOTH sides
+ *   before comparing — never applied to only `live` or only `declared` (the specific gap MEDIUM-4's
+ *   own mutant found in `network-drift.ts`; see its header, and `acl-rule-drift.ts`'s own repeat of
+ *   this same rule for `protocolFilter`/`enforcingDeviceFilter`).
+ * ★ `action`/`destination`/`ipProtocolScope`/`schedule`/`source` compare with the plain default
+ *   `equal` (whole-value `deepEqual`) — see `firewall-policy-form.ts`'s header for the accepted
+ *   known gap this leaves in their own nested set-like arrays.
+ */
+import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+import { type FirewallPolicyAttributes, type FirewallPolicyProps } from './firewall-policy-form.ts';
+export declare const matches: (attributes: FirewallPolicyAttributes, props: FirewallPolicyProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: firewall.FirewallPolicy, props: FirewallPolicyProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=firewall-policy-drift.d.ts.map

package/dist/unifi/firewall-policy-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAGzB,MAAM,2BAA2B,CAAC;AAoBnC,eAAO,MAAM,OAAO,eACN,wBAAwB,SAC7B,mBAAmB,KACzB,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,mBAAmB,sCACnC,CAAC"}

package/dist/unifi/firewall-policy-form.d.ts

@@ -0,0 +1,102 @@
+/**
+ * `Unifi.FirewallPolicy`'s wire shape — the declarable subset of `FirewallPolicy` (`getFirewallPolicy`'s
+ * own decode target), and how a live read becomes both plan attributes and a rendered declaration.
+ * Rule ORDER is a separate resource (`firewall-policy-ordering.ts`, T5) — this file is one policy's
+ * own fields only.
+ *
+ * ★ `source`/`destination`/`ipProtocolScope`/`action`/`schedule` STAY COMPOUND, COMPARED WHOLESALE —
+ *   post-A3 (`8ee11f1`, "type FirewallPolicy/ACL/TrafficMatchingList filters per discriminator"),
+ *   these decode as real per-discriminator TS unions instead of `unknown`
+ *   (`discriminated-filter-decode.test.ts` proves the wire path keeps every key, including one this
+ *   pinned spec doesn't yet declare), so this file is honest about their real shape rather than
+ *   casting to `unknown` the way `acl-rule-form.ts` still does for its own opaque filters. It does
+ *   NOT follow that up with a leaf-by-leaf declarable schema for all 12 filter variants, though:
+ *   that is new modelling work this PR does not attempt, so each field is compared with plain
+ *   `deepEqual` (`stripNullish`) as ONE value, same proportion `acl-rule-form.ts`'s
+ *   `enforcingDeviceFilter` gets (one level of structure, not exploded into scalars).
+ *
+ * ⚠️ KNOWN GAP (T15, same shape as `acl-rule-form.ts`'s own — accepted, not fixed, here either):
+ *   several of the vendor's filter variants nested inside `source`/`destination`/`ipProtocolScope`
+ *   are themselves SET-LIKE arrays with no documented order —
+ *   `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
+ *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyIPAddressFilter.items`,
+ *   `FirewallPolicyRegionFilter.regions`, `FirewallPolicyVPNServerFilter.vpnServerIds`,
+ *   `FirewallSchedule.repeatOnDays` — `deepEqual` compares every one of them order-sensitively, so a
+ *   console-side reorder with no membership change would report a spurious drift this read-only
+ *   family's `reconcile` then refuses forever. Not fixed here for the same reason ACL's own gap
+ *   isn't: normalizing 12 filter variants' own nested arrays is a bigger, separate change, not a
+ *   proportional extension of typing per-discriminator (A3) into set-aware comparison too.
+ *
+ * ⛔ `connectionStateFilter` IS THE ONE TOP-LEVEL PROPS ARRAY, AND IS A SET — "Match on firewall
+ *   connection state. If null, matches all connection states" describes membership, not a sequence
+ *   (unlike `firewall-policy-ordering-form.ts`'s own `beforeSystemDefined`/`afterSystemDefined`,
+ *   where position IS the value). Normalized with the same `sortedSet` every other family in this
+ *   directory uses for a set-shaped array (`firewall-zone-form.ts`'s `networkIds`,
+ *   `acl-rule-form.ts`'s `protocolFilter`).
+ *
+ * ⛔ `index` IS ATTRIBUTES-ONLY, NEVER DECLARED. `CreateFirewallPolicyRequest` has no `index`
+ *   field at all — the live object's current position among ALL policies on the site is reported,
+ *   but a policy's PRIORITY relative to its own zone pair is `firewall-policy-ordering.ts`'s concern
+ *   (`OrderedFirewallPolicyIDs`), same split `acl-rule-form.ts`'s own `index` documents.
+ *
+ * ⛔ `metadata.origin` IS ATTRIBUTES-ONLY, same split every other family here uses
+ *   (`firewall-zone-form.ts`'s `metadataOrigin`) — `UserOrSystemDefinedOrDerivedEntityMetadata` is
+ *   server-derived, no writable field accepts it.
+ */
+import type * as firewall from '@distilled.cloud/unifi-network/firewall';
+/** ★ EXPORTED so `firewall-policy-drift.ts` normalizes both live and declared sides identically —
+ *  see `acl-rule-form.ts`'s own header for why a normalizer applied to only one side is a bug
+ *  class (MEDIUM-4). */
+export declare const normalizeConnectionStateFilter: (value: readonly string[] | undefined) => string[] | undefined;
+/** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
+ *  `network-form.ts`'s own header. */
+export interface FirewallPolicyProps {
+    siteId: string;
+    firewallPolicyId: string;
+    action: firewall.FirewallPolicyAction;
+    /** Connection states this policy matches — compared as a SET, see the header. */
+    connectionStateFilter?: string[] | undefined;
+    description?: string | undefined;
+    /** Traffic destination — compound, compared wholesale; see the header's known gap. */
+    destination: firewall.FirewallPolicyDestination;
+    enabled: boolean;
+    /** IP version + protocol scope — compound, compared wholesale; see the header's known gap. */
+    ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
+    ipsecFilter?: string | undefined;
+    loggingEnabled: boolean;
+    name: string;
+    /** Schedule this policy is active on — compound, compared wholesale; see the header's known gap. */
+    schedule?: firewall.FirewallSchedule | undefined;
+    /** Traffic source — compound, compared wholesale; see the header's known gap. */
+    source: firewall.FirewallPolicySource;
+}
+export interface FirewallPolicyAttributes {
+    siteId: string;
+    firewallPolicyId: string;
+    action: firewall.FirewallPolicyAction;
+    connectionStateFilter: string[] | undefined;
+    description: string | undefined;
+    destination: firewall.FirewallPolicyDestination;
+    enabled: boolean;
+    /** Current position among ALL policies on the site — server-derived, never declared; see header. */
+    index: number;
+    ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
+    ipsecFilter: string | undefined;
+    loggingEnabled: boolean;
+    name: string;
+    schedule: firewall.FirewallSchedule | undefined;
+    source: firewall.FirewallPolicySource;
+    /** `metadata.origin` — server-derived, never declared; see `firewall-zone-form.ts`'s own. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: firewall.FirewallPolicy, props: FirewallPolicyProps) => FirewallPolicyAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getFirewallPolicy`'s own response
+ * straight in and writes the result as `firewallPolicy('<id>', declareFirewallPolicy(live, siteId))`
+ * — no field is invented or defaulted beyond what `attributesOf` already reports, so
+ * `matches(attributesOf(live, props), declareFirewallPolicy(live, siteId))` is `true` by
+ * construction (`firewall-policy.test.ts` proves it).
+ */
+export declare const declareFirewallPolicy: (live: firewall.FirewallPolicy, siteId: string) => FirewallPolicyProps;
+//# sourceMappingURL=firewall-policy-form.d.ts.map

package/dist/unifi/firewall-policy-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;sCACsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}