@homeflare/alchemy 0.39.0 → 0.41.0

package/dist/unifi/traffic-matching-list.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `Unifi.TrafficMatchingList` — one traffic matching list (IPv4/IPv6/port match entries) on a UniFi
+ * Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26: `Traffic Matching Lists`' 5 operations are byte-identical between
+ *   10.4.57 and 10.6.97, full raw operation objects; the 19-schema closure reachable from all 5
+ *   (`$ref` + `discriminator.mapping`) shares zero names with the 14 schemas that DID change
+ *   elsewhere in the document. Corroborated independently by the A3 changeset's own broader
+ *   25-operation/139-schema re-check (`.changeset/unifi-network-a3-typed-discriminator-filters.md`).
+ *   Full breakdown: `docs/unifi-traffic-matching-list.md`.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';
+import * as Effect from 'effect/Effect';
+import { type TrafficMatchingListAttributes, type TrafficMatchingListProps } from './traffic-matching-list-form.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { TrafficMatchingListAttributes, TrafficMatchingListProps, } from './traffic-matching-list-form.ts';
+export { declareTrafficMatchingList } from './traffic-matching-list-form.ts';
+export { driftOf } from './traffic-matching-list-drift.ts';
+export interface UnifiTrafficMatchingList extends Resource<'Unifi.TrafficMatchingList', TrafficMatchingListProps, TrafficMatchingListAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiTrafficMatchingList: import("alchemy").ResourceClass<UnifiTrafficMatchingList>;
+/** `trafficMatchingList('office-subnets', props)` — `adopt(true)` piped on by default (H5); see
+ *  `network.ts`. */
+export declare const trafficMatchingList: (id: string, props: TrafficMatchingListProps) => Effect.Effect<UnifiTrafficMatchingList, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<TrafficMatchingListProps, trafficMatchingLists.TrafficMatchingList, TrafficMatchingListAttributes, trafficMatchingLists.GetTrafficMatchingListError>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: TrafficMatchingListProps;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<TrafficMatchingListAttributes | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<TrafficMatchingListProps>;
+        output: TrafficMatchingListAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: TrafficMatchingListProps;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: TrafficMatchingListProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiTrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiTrafficMatchingList>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=traffic-matching-list.d.ts.map

package/dist/unifi/traffic-matching-list.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,yGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,8IAI1C,CAAC"}

package/dist/unifi/wifi-broadcast-drift.d.ts

@@ -0,0 +1,22 @@
+/**
+ * `Unifi.WifiBroadcast`'s `matches` AND `driftOf` (B6) — built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `dns-policy-drift.ts`'s header explains
+ * (MEDIUM-4): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true BY
+ * CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ★ THREE FIELDS REUSE `wifi-broadcast-form.ts`'s OWN NORMALIZERS ON THE `declared` SIDE TOO, not
+ *   just the `live` side — `firewall-zone-form.ts`'s `networkIds` gives the same reason: comparing
+ *   a freshly-normalized live value against an un-normalized declared value would report spurious
+ *   drift the moment a committed declaration's array happens to be in a different (still valid)
+ *   order than what `declareWifiBroadcast` would itself produce today.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import { type WifiBroadcastAttributes, type WifiBroadcastProps } from './wifi-broadcast-form.ts';
+export declare const matches: (attributes: WifiBroadcastAttributes, props: WifiBroadcastProps) => boolean;
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export declare const driftOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => import("./drift.ts").FieldDrift[];
+//# sourceMappingURL=wifi-broadcast-drift.d.ts.map

package/dist/unifi/wifi-broadcast-drift.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAEtF,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAOxB,MAAM,0BAA0B,CAAC;AAoClC,eAAO,MAAM,OAAO,eAAgB,uBAAuB,SAAS,kBAAkB,KAAG,OAC7C,CAAC;AAE7C;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,cAAc,CAAC,qBAAqB,SAAS,kBAAkB,sCAC/C,CAAC"}

package/dist/unifi/wifi-broadcast-form.d.ts

@@ -0,0 +1,127 @@
+/**
+ * `Unifi.WifiBroadcast`'s wire shape — the declarable subset of `WifiBroadcastOverview`, and how
+ * a live read becomes both plan attributes and a rendered declaration.
+ *
+ * ⛔ T23, THE WHOLE REASON THIS SHAPE DIFFERS FROM EVERY OTHER FAMILY HERE. Every other family's
+ *   `*-form.ts` (`network-form.ts`, `dns-policy-form.ts`, …) types its props against the vendor's
+ *   CREATE/UPDATE request — the fullest declarable shape, even though this stack never calls it.
+ *   `WifiBroadcastProps`/`WifiBroadcastAttributes` do NOT: `securityConfiguration` is typed
+ *   `wifiBroadcasts.WifiSecurityConfigurationOverview` — the PAGE OVERVIEW's own type, `{type,
+ *   presharedKeyNetworkIds}` — never `WifiSecurityConfigurationDetailObject` (the
+ *   `getWifiBroadcastDetails`/create/update shape, which carries `passphrase` and
+ *   `radiusConfiguration`). There is no DECLARED field on `WifiSecurityConfigurationOverview` for
+ *   `attributesOf`/`declareWifiBroadcast` below to name a passphrase into. See `wifi-broadcast.ts`'s
+ *   header for why `fetchLive` can only ever produce a `WifiBroadcastOverview` in the first place
+ *   (no get-by-id call exists for it).
+ *
+ * ⛔ THE TYPE SYSTEM ALONE DOES NOT ENFORCE THIS (red team, IMPORTANT-1, 2026-09-26). `@distilled
+ *   .cloud/core`'s wire decode does not strip a key a schema doesn't declare (this file's next
+ *   header block); the TS types above describe what a CORRECTLY-shaped response looks like, not
+ *   what the decoder actually returns at runtime, so a stray key nested inside `network`,
+ *   `hotspotConfiguration`, `broadcastingDeviceFilter`, or an element of `presharedKeyNetworkIds`
+ *   would ride along through a naive `{...live}`/pass-through copy exactly like the top-level
+ *   `securityConfiguration` object does. `normalizeRef`/`normalizeHotspot`/`normalizeDeviceFilter`
+ *   below rebuild EVERY nested object field-by-field for the same reason
+ *   `normalizeSecurityConfiguration` does — enumeration, not the type annotation, is what actually
+ *   stops it. `wifi-broadcast-secrets.test.ts` plants a sentinel inside each nested shape
+ *   (including one `presharedKeyNetworkIds` element) to prove it, not just the top level.
+ *
+ * ⚠️ EVERY OTHER FIELD REUSES THE SDK'S OWN OVERVIEW TYPES DIRECTLY (`WifiNetworkReference`,
+ *   `BroadcastingDeviceFilter`, `IntegrationWifiHotspotConfigurationOverviewDto`) rather than
+ *   redeclaring them — same reasoning `network-form.ts` gives for reusing `NetworkDHCPGuarding`/
+ *   `NetworkIPv6Configuration` verbatim: one shape to keep in sync with the SDK's own regen.
+ *
+ * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES, UNCONFIRMED AGAINST A LIVE CONSOLE (same caveat
+ *   `network-form.ts`'s header gives for its own three): `broadcastingDeviceFilter.deviceIds`/
+ *   `.deviceTagIds` and `securityConfiguration.presharedKeyNetworkIds` are membership sets by the
+ *   vendor description's own wording ("Defines the custom scope of devices…"), not ordered
+ *   sequences. `normalizeDeviceFilter`/`normalizeSecurityConfiguration`/`normalizeFrequencies`
+ *   neutralize the same "spurious update, refused by a read-only reconcile" failure mode
+ *   `network-form.ts`'s header describes, exactly like `firewall-zone-form.ts`'s `networkIds`.
+ */
+import type * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+/**
+ * Rebuilds a reference field-by-field — never returns the object as received. IMPORTANT-1: this
+ * runs on EVERY reference this file handles (`network`, and each `presharedKeyNetworkIds`
+ * element) precisely because a reference is exactly the shape (`{network: WifiNetworkReference,
+ * passphrase}`) the details call uses to carry a PPSK passphrase (`IntegrationWifiPresharedKeyDto`,
+ * SDK `wifi_broadcasts.ts`); it is the most plausible place for a stray passphrase-shaped key to
+ * appear on the wire if the vendor ever leaked one onto the overview response.
+ */
+export declare const normalizeRef: (ref: wifiBroadcasts.WifiNetworkReference | undefined) => wifiBroadcasts.WifiNetworkReference | undefined;
+/**
+ * Rebuilds the hotspot configuration field-by-field. `IntegrationWifiHotspotConfigurationOverviewDto`
+ * declares only `type` (SDK `wifi_broadcasts.ts:743-753`) — a PASSPOINT/RADIUS secret would live on
+ * a wire key this type doesn't name, exactly the IMPORTANT-1 risk `normalizeRef` guards against.
+ */
+export declare const normalizeHotspot: (value: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined) => wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+/**
+ * ★ EXPORTED: `wifi-broadcast-drift.ts` reuses these exact normalizers so `matches`/`driftOf` can
+ *   never quietly disagree about what counts as a change (MEDIUM-4, `network-drift.ts`'s header).
+ *
+ * ⛔ NO `{...value}` SPREAD (red team, IMPORTANT-1) — `BroadcastingDeviceFilter` declares exactly
+ *   `type`/`deviceIds`/`deviceTagIds` (SDK `wifi_broadcasts.ts:125-129`); enumerating exactly those
+ *   three is what stops a stray wire key here, the same reason `normalizeSecurityConfiguration`
+ *   (below) never spreads its input.
+ */
+export declare const normalizeDeviceFilter: (value: wifiBroadcasts.BroadcastingDeviceFilter | undefined) => wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+export declare const normalizeFrequencies: (value: readonly number[] | undefined) => number[] | undefined;
+/**
+ * ⛔ NO `{...value}` SPREAD, UNLIKE EVERY OTHER NORMALIZER IN THIS DIRECTORY (`network-form.ts`'s
+ *   `normalizeDhcpGuarding`/`normalizeIpv6Configuration` both spread). This is the one field in
+ *   the whole `Unifi.*` tree with a spec-confirmed passphrase risk (T23): nothing in
+ *   `@distilled.cloud/core`'s wire key-mapping strips an object key the schema doesn't declare —
+ *   it only renames declared ones — so a stray extra key on the WIRE `securityConfiguration`
+ *   object (a vendor bug, or a future console version) survives `getWifiBroadcastPage`'s own
+ *   decode untyped, and `{...value}` would carry it straight through into `Attributes`/`Props`/the
+ *   rendered declaration. Enumerating exactly the two fields
+ *   `WifiSecurityConfigurationOverview` declares is what actually stops that — proved by
+ *   `wifi-broadcast-secrets.test.ts`'s sentinel test, which injects exactly this kind of stray key.
+ */
+export declare const normalizeSecurityConfiguration: (value: wifiBroadcasts.WifiSecurityConfigurationOverview) => wifiBroadcasts.WifiSecurityConfigurationOverview;
+/**
+ * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE — `exactOptionalPropertyTypes`; see
+ *   `network-form.ts`'s own header. `attributesOf`/`declareWifiBroadcast` echo a live optional
+ *   field structurally rather than defaulting it, so the target type must admit an explicit
+ *   `undefined`.
+ */
+export interface WifiBroadcastProps {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network?: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter?: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz?: number[] | undefined;
+    hotspotConfiguration?: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    /** ⛔ T23: the PAGE OVERVIEW's security shape ONLY — see this file's header. */
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+}
+export interface WifiBroadcastAttributes {
+    siteId: string;
+    wifiBroadcastId: string;
+    name: string;
+    enabled: boolean;
+    type: string;
+    network: wifiBroadcasts.WifiNetworkReference | undefined;
+    broadcastingDeviceFilter: wifiBroadcasts.BroadcastingDeviceFilter | undefined;
+    broadcastingFrequenciesGHz: number[] | undefined;
+    hotspotConfiguration: wifiBroadcasts.IntegrationWifiHotspotConfigurationOverviewDto | undefined;
+    securityConfiguration: wifiBroadcasts.WifiSecurityConfigurationOverview;
+    /** `metadata.origin` — server-derived, never declared; same split as every other family. */
+    metadataOrigin: string;
+}
+export declare const attributesOf: (live: wifiBroadcasts.WifiBroadcastOverview, props: WifiBroadcastProps) => WifiBroadcastAttributes;
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getWifiBroadcastPage`'s own per-row
+ * response straight in and writes the result into `alchemy.run.ts` as `wifiBroadcast('<id>',
+ * declareWifiBroadcast(live, siteId))` — no field is invented or defaulted here beyond what
+ * `attributesOf` already reports, so `matches(attributesOf(live, props), declareWifiBroadcast(live,
+ * siteId))` is `true` by construction (`wifi-broadcast.test.ts` proves it) for any live object
+ * this SDK can decode. Builds ONLY from fields `WifiBroadcastOverview` has — never a passphrase,
+ * which that type cannot express (see this file's header).
+ */
+export declare const declareWifiBroadcast: (live: wifiBroadcasts.WifiBroadcastOverview, siteId: string) => WifiBroadcastProps;
+//# sourceMappingURL=wifi-broadcast-form.d.ts.map

package/dist/unifi/wifi-broadcast-form.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast-form.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAwCG;AACH,OAAO,KAAK,KAAK,cAAc,MAAM,gDAAgD,CAAC;AAWtF;;;;;;;GAOG;AACH,eAAO,MAAM,YAAY,QAClB,cAAc,CAAC,oBAAoB,GAAG,SAAS,KACnD,cAAc,CAAC,oBAAoB,GAAG,SAGqD,CAAC;AAa/F;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,UACpB,cAAc,CAAC,8CAA8C,GAAG,SAAS,KAC/E,cAAc,CAAC,8CAA8C,GAAG,SACX,CAAC;AAEzD;;;;;;;;GAQG;AACH,eAAO,MAAM,qBAAqB,UACzB,cAAc,CAAC,wBAAwB,GAAG,SAAS,KACzD,cAAc,CAAC,wBAAwB,GAAG,SAStC,CAAC;AAER,eAAO,MAAM,oBAAoB,UAAW,SAAS,MAAM,EAAE,GAAG,SAAS,KAAG,MAAM,EAAE,GAAG,SAC/B,CAAC;AAEzD;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,8BAA8B,UAClC,cAAc,CAAC,iCAAiC,KACtD,cAAc,CAAC,iCAKhB,CAAC;AAEH;;;;;GAKG;AACH,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IAC1D,wBAAwB,CAAC,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC/E,0BAA0B,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAClD,oBAAoB,CAAC,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IACjG,+EAA+E;IAC/E,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;CACzE;AAED,MAAM,WAAW,uBAAuB;IACtC,MAAM,EAAE,MAAM,CAAC;IACf,eAAe,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,cAAc,CAAC,oBAAoB,GAAG,SAAS,CAAC;IACzD,wBAAwB,EAAE,cAAc,CAAC,wBAAwB,GAAG,SAAS,CAAC;IAC9E,0BAA0B,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IACjD,oBAAoB,EAAE,cAAc,CAAC,8CAA8C,GAAG,SAAS,CAAC;IAChG,qBAAqB,EAAE,cAAc,CAAC,iCAAiC,CAAC;IACxE,4FAA4F;IAC5F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,cAAc,CAAC,qBAAqB,SACnC,kBAAkB,KACxB,uBAYD,CAAC;AAEH;;;;;;;;;GASG;AACH,eAAO,MAAM,oBAAoB,SACzB,cAAc,CAAC,qBAAqB,UAClC,MAAM,KACb,kBAWD,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -0,0 +1,73 @@
+/**
+ * `Unifi.WifiBroadcast` — one WiFi network (SSID) broadcast on a UniFi Network site, READ-ONLY
+ * (`policy.ts`).
+ *
+ * ⛔ T23, THE REASON THIS FAMILY NEVER CALLS `getWifiBroadcastDetails`. That single-object GET
+ *   returns `WifiBroadcastDetails`, whose `securityConfiguration`
+ *   (`WifiSecurityConfigurationDetailObject`) carries the WPA passphrase AND every PPSK entry's
+ *   passphrase — the pinned spec has NO `writeOnly` flag on either (verified: 4 `passphrase`
+ *   props, 0 `writeOnly`; A2 already redacts them to `Redacted.Redacted<string>` at the SDK layer,
+ *   `errors-and-secrets.test.ts`). This family goes further and never fetches that shape AT ALL:
+ *   the only call below is `getWifiBroadcastPage`, which answers `WifiBroadcastOverview` instead —
+ *   whose own `securityConfiguration` (`WifiSecurityConfigurationOverview`) is `{type,
+ *   presharedKeyNetworkIds}`. No passphrase field exists in that type, so `WifiBroadcastProps`/
+ *   `Attributes` (`wifi-broadcast-form.ts`) cannot carry one even by a future mistake.
+ *
+ * ⚠️ NO GET-BY-ID CALL EXISTS FOR THE OVERVIEW SHAPE — unlike every other family in this
+ *   directory (`getNetworkDetails`, `getFirewallZone`, `getDnsPolicy`, `getAclRule`),
+ *   `wifi_broadcasts.ts` only has `getWifiBroadcastPage` (list) and `getWifiBroadcastDetails`
+ *   (single, passphrase-bearing — forbidden above). `fetchLive` below walks every page with B0b's
+ *   `pageAll` and finds the one row matching `wifiBroadcastId` — the first real resource-level
+ *   consumer of that pager (previously exercised only by `paginate.test.ts` in isolation).
+ *
+ * ⚠️ THE `NotFound` CATCH BELOW IS FOR THE WHOLE WALK, NOT JUST THE FIRST PAGE CALL (red team,
+ *   MINOR-4, 2026-09-26 — corrected from an earlier claim that it only applied to the first call).
+ *   `pageAll` makes its sequential page calls inside one Effect pipeline, and `catchTag` here wraps
+ *   that entire pipeline; a 404 on ANY page of the walk — not only the first — folds to `undefined`
+ *   and discards whatever rows the walk had already collected. In practice this means "the site
+ *   vanished partway through listing its broadcasts" is indistinguishable from "the site was never
+ *   there" and from "the target id just isn't among the collected rows" — none of these three cases
+ *   has a separate vendor signal, and no other family's `fetchLive` distinguishes its own analogous
+ *   cases either. Read-only reporting treats all three the same conservative way (absent, not an
+ *   error); a write path would need to tell them apart.
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as wifiBroadcasts from '@distilled.cloud/unifi-network/wifi_broadcasts';
+import * as Effect from 'effect/Effect';
+import { type WifiBroadcastAttributes, type WifiBroadcastProps } from './wifi-broadcast-form.ts';
+import { type UnifiPaginationInconsistent } from './paginate.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+export type { WifiBroadcastAttributes, WifiBroadcastProps } from './wifi-broadcast-form.ts';
+export { declareWifiBroadcast } from './wifi-broadcast-form.ts';
+export { driftOf } from './wifi-broadcast-drift.ts';
+export interface UnifiWifiBroadcast extends Resource<'Unifi.WifiBroadcast', WifiBroadcastProps, WifiBroadcastAttributes, never, UnifiRequirements> {
+}
+export declare const UnifiWifiBroadcast: import("alchemy").ResourceClass<UnifiWifiBroadcast>;
+/** `wifiBroadcast('guest', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export declare const wifiBroadcast: (id: string, props: WifiBroadcastProps) => Effect.Effect<UnifiWifiBroadcast, never, import("effect/unstable/http/HttpClient").HttpClient>;
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export declare const spec: UnifiSpec<WifiBroadcastProps, wifiBroadcasts.WifiBroadcastOverview, WifiBroadcastAttributes, wifiBroadcasts.GetWifiBroadcastPageError | UnifiPaginationInconsistent>;
+export declare const handlers: {
+    list: () => Effect.Effect<never[], never, never>;
+    read: (args: {
+        olds: WifiBroadcastProps;
+        output: WifiBroadcastAttributes | undefined;
+    }) => Effect.Effect<WifiBroadcastAttributes | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    diff: (args: {
+        news: import("alchemy").Input<WifiBroadcastProps>;
+        output: WifiBroadcastAttributes | undefined;
+    }) => Effect.Effect<{
+        readonly action: 'update';
+    } | {
+        readonly action: 'noop';
+    } | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    reconcile: (args: {
+        news: WifiBroadcastProps;
+    }) => Effect.Effect<WifiBroadcastAttributes, UnifiPaginationInconsistent | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    delete: (args: {
+        olds: WifiBroadcastProps;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+};
+export declare const UnifiWifiBroadcastProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiWifiBroadcast>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+//# sourceMappingURL=wifi-broadcast.d.ts.map

package/dist/unifi/wifi-broadcast.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,mGAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}

package/docs/distilled-interim.md

@@ -161,3 +161,10 @@ itself holds everywhere else.
   published — `bun install` would fail to resolve it.
 - ⛔ Don't hand-fix a bug inside `packages/distilled-<vendor>/src/`. Fix it
   upstream (the distilled clone), regenerate, copy again.
+- ⛔ Don't invent `src/` by hand so a `@distilled.cloud/<vendor>` name can
+  publish. `src/` is generated, never hand-written — from a real vendor
+  schema (steps 1–2) when one exists, or from the blocked-`SpecRepos`-entry
+  plus hand-authored-model route (step 1's Caddy paragraph above) when it
+  doesn't. A missing schema is not a licence to stub the client; it is not a
+  reason to skip the vendor either. Talos + Argo CD dogfood vendors that skip
+  both routes: [talos-argocd-dogfood.md](./talos-argocd-dogfood.md).

package/docs/launchd.md

@@ -174,6 +174,8 @@ job is declared: [launchd-ports.md](./launchd-ports.md).
 
 `HostRunner` (see `src/launchd/runner.ts`) is `exec(argv)` (never through a shell), `readFile`,
 `stat` (lstat), `writeFileAtomic`, `removeFile`, `lookupUser`, `lookupGroup`, `sleep`, plus
-`privileged` and `effectiveUid()`. `localRunner()` implements it with `node:fs` and
-`node:child_process`; `sudoRunner()` wraps it and elevates the allowlist. Tests use an in-memory
-fake, so nothing in the test suite runs `launchctl` or `sudo`, or writes outside a temp directory.
+`platform` (`'darwin' | 'linux'`, the target host's own OS — declared, never inferred from
+`process.platform`), `privileged` and `effectiveUid()`. `localRunner()` implements it with
+`node:fs` and `node:child_process`; `sudoRunner()` wraps it and elevates the allowlist. Tests use
+an in-memory fake, so nothing in the test suite runs `launchctl` or `sudo`, or writes outside a
+temp directory.

package/docs/provider-standard.md

@@ -30,7 +30,11 @@ already ships is a finding, even when it works.
    with its typed error unions and Credentials layer. A second SDK or a hand-rolled client
    is a finding. On 2026-09-22 npm had distilled packages for Forgejo, GitHub, Kubernetes
    and Docker, among others, and none for Proxmox, OpenBao, Caddy, Talos, NetBox or UniFi
-   (S23).
+   (S23). A missing package is not a licence to hand-write one — build it by
+   the generate+copy (or blocked-`SpecRepos`) route in
+   [distilled-interim.md](./distilled-interim.md); see
+   [talos-argocd-dogfood.md](./talos-argocd-dogfood.md) for this stack's
+   per-vendor calls.
 3. **Does Alchemy ship the helper?** Hashing (`alchemy/Util/sha256`), polling
    (`alchemy/Util/poll`), atomic writes (`alchemy/Util/AtomicFile`), equality
    (`deepEqual` in `alchemy/Diff`), names (`alchemy/PhysicalName`), tags (`alchemy/Tags`),

package/docs/talos-argocd-dogfood.md

@@ -0,0 +1,160 @@
+# Talos + Argo CD dogfood — Distilled and Alchemy path
+
+Status: decision record — fixes the per-vendor Distilled/Alchemy path for the
+Talos + Argo CD dogfood stack; retire when the stack ships and each row is
+proven live.
+Verified: 2026-09-27 (LAND pass: CRD ownership, Talos K-A3, Cilium CNI
+ordering, topology and the interim-package rule checked against merged PRs
+262/295/307/311; see each section below).
+
+Opened 2026-09-24 after
+[PR 242](https://github.com/taslabs-net/homeflare-kit/pull/242) closed without
+merge.
+
+Placeholder stack: Talos Kubernetes on Proxmox VE, **Argo CD owns GitOps**.
+This page is the Distilled / Alchemy path for each vendor — not a stack file,
+and not a licence to invent SDKs.
+
+## Why there are no interim packages
+
+[distilled-interim.md](./distilled-interim.md) is generate+copy from a real
+vendor schema (distilled clone Steps 1–8, then copy `src/` into
+`packages/distilled-<vendor>`). ⛔ **`src/` is copied, never hand-written.**
+A stub invented so a `@distilled.cloud/<vendor>` name can publish is the
+failure #242 shipped: Alchemy would `catchTag` errors from a client nobody
+can regenerate. ⛔ Do not add npm aliases for packages that do not exist.
+
+## Per-vendor decision
+
+| vendor    | decision                                                                                                                                                                                                                                                                                                |
+| --------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
+| Headlamp  | Skip Distilled / Alchemy vendor family — Argo Application / Helm                                                                                                                                                                                                                                        |
+| Traefik   | No Distilled SDK (no official OpenAPI; do not invent)                                                                                                                                                                                                                                                   |
+| Cilium    | No hand-written interim — install vehicle is D-S2 (open); CRDs via upstream Alchemy `Kubernetes.Manifest`                                                                                                                                                                                               |
+| CNPG      | `postgresql.cnpg.io/v1` CRDs — upstream Alchemy `Kubernetes.Manifest` (S1), not `@distilled.cloud/kubernetes` (built-in API groups only)                                                                                                                                                                |
+| Valkey    | operator CRDs — upstream Alchemy `Kubernetes.Manifest` (S1); Sentinel is RESP, not HTTP                                                                                                                                                                                                                 |
+| Argo CD   | `Application`/`AppProject`/`ApplicationSet` — upstream Alchemy `Kubernetes.Manifest` (decision 49); `Repository`/`RepoCreds`/`Cluster` — `Argocd.Repository`/`RepoCreds`/`Cluster` (kit, built over `@distilled.cloud/argocd`, [PR 262](https://github.com/taslabs-net/homeflare-kit/pull/262), merged) |
+| Talos CLI | No Distilled Talos SDK — stays on `talosctl`, reworked under K-A3 ([PR 307](https://github.com/taslabs-net/homeflare-kit/pull/307)/[311](https://github.com/taslabs-net/homeflare-kit/pull/311): `insecure` prop dropped, `Bootstrap.peers` added)                                                      |
+
+Headlamp's `/config` and cluster proxy are not a vendor control plane.
+
+Traefik declarative config is Kubernetes CRDs (`IngressRoute`, `Middleware`, …
+— `traefik.io`, not a built-in group) / Helm values (experimental flags as
+Helm props). CRDs go through upstream Alchemy `Kubernetes.Manifest` (S1), the
+same as every other vendor's CRDs on this page, never
+`@distilled.cloud/kubernetes`. The dashboard `GET /api/…` is read-only
+runtime — optional later, not the dogfood install path.
+
+Cilium's BGP and network-policy objects are genuine CRDs, not a built-in
+Kubernetes API group, so they go through upstream Alchemy's
+`Kubernetes.Manifest` (S1) — never `@distilled.cloud/kubernetes`: its 24
+service files (checked at the kit's pin, `c2a78002`) cover only built-in
+apiserver groups, and its `apiextensions` service defines CRD _schemas_, not
+CRD _instances_. The install vehicle itself — inline manifests in the seeded
+Talos machine config vs. a Helm step between `Kubeconfig` and `ClusterHealth`
+— is **D-S2, still open**
+([first-boot doc](https://github.com/taslabs-net/homeflare-kit/blob/main/docs/plans/2026-09-26-talos-stack-first-boot.md#tim-must-decide),
+"Tim must decide"; inline manifests is the doc's recommendation, not yet
+accepted). Either vehicle must set `cluster.network.cni.name: none` and
+`cluster.proxy.disabled: true` (kube-proxy replacement) in the seeded config,
+because Argo CD cannot install Cilium — Argo CD itself needs pod networking
+first. Official swagger exists (`cilium/cilium` `api/v1/openapi.yaml`) but
+the default transport is the unix socket `/var/run/cilium/cilium.sock`;
+generate+copy a Distilled SDK later only if node-local agent health over
+that socket is needed.
+
+Argo CD's own storage — `Repository`, `RepoCreds` and `Cluster` — is a `Secret`
+labeled with Argo CD's own convention, not a published Kubernetes API type, so
+the kit's `Argocd.Repository`/`RepoCreds`/`Cluster` (built over
+`@distilled.cloud/argocd`, already on npm) are the correct owner
+([PR 262](https://github.com/taslabs-net/homeflare-kit/pull/262), merged). The
+objects Argo CD reconciles — `Application`, `AppProject`, `ApplicationSet` —
+are genuine `argoproj.io/v1alpha1` CRDs, so upstream Alchemy's
+`Kubernetes.Manifest` owns those (decision 49, "upstream wins"), not a house
+wrapper — see [argocd.md](./argocd.md) and
+[argocd-kubernetes.md](./argocd-kubernetes.md). No Distilled Talos API in this
+path.
+
+## Gates
+
+- ⛔ Do not publish an interim Distilled package until generate+copy from a
+  real vendor schema ([distilled-interim.md](./distilled-interim.md) steps 1–2).
+- ⛔ Do not invent a Traefik Distilled SDK without an official schema.
+- `Argocd.Repository`/`RepoCreds`/`Cluster` were built ahead of a live
+  Talos-on-PVE cluster ([PR 262](https://github.com/taslabs-net/homeflare-kit/pull/262),
+  merged 2026-09-24; tested against `fake-argocd.ts`, a fake in-memory Argo CD
+  API — the HTTP client and Distilled protocol underneath it are real, only
+  the Argo CD server is faked; never exercised against a real instance) —
+  Tim's build-ahead-of-need call. Declaring and applying
+  `Application`/`AppProject`/`ApplicationSet` objects in a real stack still
+  waits on that cluster existing.
+- Prefer upstream Alchemy Kubernetes resources when they exist (S1).
+
+## Placeholder variables
+
+Names a consuming stack substitutes. Origins use RFC 2606 `*.example.com`.
+Addresses use RFC 5737 documentation ranges. Secret _values_ never appear —
+only env-var NAMES (S25). Nothing here is applied.
+
+### Topology — 3 control plane, no workers today
+
+`homeflare-proxmox`'s `src/talos-shape.ts` declares exactly 3 control-plane
+VMs (`n2`/`n3`/`n4`, vmids 10000–10002) and no worker pool. The
+`TALOS_WORKER_*` rows are placeholders for if/when a worker pool is added;
+nothing consumes them yet.
+
+| variable                              | placeholder                     |
+| ------------------------------------- | ------------------------------- |
+| `TALOS_CLUSTER_NAME`                  | `dogfood`                       |
+| `TALOS_CP_NODES`                      | `cp-a`, `cp-b`, `cp-c`          |
+| `TALOS_WORKER_NODES` (none today)     | `wk-a`, `wk-b`, `wk-c`          |
+| `TALOS_CP_ADDRESSES`                  | `192.0.2.10/24` … `.12`         |
+| `TALOS_WORKER_ADDRESSES` (none today) | `192.0.2.20/24` … `.22`         |
+| `TALOS_CONTROL_PLANE_ENDPOINT`        | `https://k8s.example.com:6443`  |
+| `TALOS_VERSION`                       | `v1.13.x` (never measured live) |
+| `STORAGE_CLASS`                       | `STORAGE_CLASS`                 |
+| `STORAGE_SIZE`                        | `STORAGE_SIZE`                  |
+
+### Cilium BGP
+
+| variable                  | placeholder       |
+| ------------------------- | ----------------- |
+| `CILIUM_BGP_CLUSTER_ASN`  | `64512` (private) |
+| `CILIUM_BGP_PEER_ASN`     | `64513`           |
+| `CILIUM_BGP_PEER_ADDRESS` | `198.51.100.1`    |
+| `CILIUM_BGP_VIP_CIDR`     | `203.0.113.0/24`  |
+
+### Traefik
+
+| variable                     | placeholder                                     |
+| ---------------------------- | ----------------------------------------------- |
+| `TRAEFIK_ENTRYPOINTS`        | `web`, `websecure`                              |
+| `TRAEFIK_EXPERIMENTAL_FLAGS` | Helm props, e.g. `kubernetesGateway`, `knative` |
+| `TRAEFIK_NAMESPACE`          | `traefik`                                       |
+
+### Installs Argo owns
+
+| variable                    | placeholder                  |
+| --------------------------- | ---------------------------- |
+| `HEADLAMP_INGRESS_HOST`     | `headlamp.example.com`       |
+| `CNPG_CLUSTER_NAME`         | `dogfood-pg`                 |
+| `CNPG_INSTANCES`            | `3`                          |
+| `CNPG_SUPERUSER_SECRET_ENV` | `CNPG_SUPERUSER_PASSWORD`    |
+| `VALKEY_SENTINEL_NAME`      | `dogfood-valkey`             |
+| `VALKEY_PASSWORD_ENV`       | `VALKEY_PASSWORD`            |
+| `ARGOCD_SERVER`             | `https://argocd.example.com` |
+| `ARGOCD_TOKEN_ENV`          | `ARGOCD_TOKEN`               |
+
+## Non-goals
+
+- No Flux. Argo CD is the GitOps controller.
+- No new Distilled Talos SDK from this page — `@homeflare/alchemy/talos`
+  already reworked under K-A3 ([PR 307](https://github.com/taslabs-net/homeflare-kit/pull/307),
+  [PR 311](https://github.com/taslabs-net/homeflare-kit/pull/311)); it stays on
+  `talosctl`.
+- No new Alchemy provider code from this page itself — `Argocd.*` (PR 262)
+  and upstream `Kubernetes.Manifest` already cover this stack's objects.
+  Declaring and applying them against a real cluster still waits on
+  Talos-on-PVE existing (see Gates).
+- No `packages/distilled-traefik`, `packages/distilled-cilium`, or other
+  interim Distilled packages for this stack.

package/docs/unifi-acl-rule.md

@@ -0,0 +1,122 @@
+# UniFi ACL Rules — `Unifi.AclRule` / `Unifi.AclRuleOrdering`
+
+⛔ **READ-ONLY, BY TIM'S RULE (2026-09-24).** Same posture as `docs/unifi.md`'s `Unifi.Network`/
+`Unifi.FirewallZone`: `reconcile`/`delete` both fail with a typed `UnifiWriteRefused`, and the
+`GetOnlyHttpClient` wire guard (`resource.ts`) refuses any non-`GET` request before it reaches the
+transport. Neither family here calls `createAclRule`, `updateAclRule`, `deleteAclRule` or
+`updateAclRuleOrdering` anywhere — `write-op-reference.test.ts` proves it statically.
+
+## Two resources, because rule order is not a rule's own property (T5)
+
+`Unifi.AclRule` is one user-defined ACL rule (`getAclRule`/`getAclRulePage`).
+`Unifi.AclRuleOrdering` is the site's ONE ordered list of rule IDs (`getAclRuleOrdering`,
+`GET /v1/sites/{siteId}/acl-rules/ordering`) — not one-per-rule and not one-per-zone-pair the way a
+future `Unifi.FirewallPolicyOrdering` will be (`network.ts`'s header names that as a separate,
+bigger PR), because ACL rule ordering is site-wide, not keyed by a source/destination zone pair.
+
+⛔ **`orderedAclRuleIds` IS NEVER RUN THROUGH `sortedSet`.** Every other multi-value field in this
+directory that gets normalized (`firewall-zone-form.ts`'s `networkIds`, this family's own
+`enforcingDeviceFilter.deviceIds`/`protocolFilter` below) is a SET with no documented order.
+`orderedAclRuleIds` is the opposite: its position IS the value — `ACLRule.index`'s own field
+comment says "Lower index has higher priority," and the whole point of `updateAclRuleOrdering` is
+to change that priority by reordering the list. `acl-rule-ordering-form.ts`'s `matches`/`driftOf`
+compare it with plain `deepEqual`, which — per `drift.ts`'s own header — sorts object keys but
+never array elements, so leaving this one field un-normalized is what makes the resource actually
+represent order.
+
+## `Unifi.AclRule`'s own fields
+
+- **`sourceFilter`/`destinationFilter` stay opaque `unknown`**, on the SDK's own authority
+  (`access_control_acl_rules.ts`'s comment on both: "Shape varies by variant — widened by
+  scripts/convert.ts"). This is the same converter-flattening trap (T10) `network-form.ts` already
+  documents for `ipv4Configuration`; typing these per-discriminator (A3) is explicitly scoped OUT
+  of this PR. Compared with plain `deepEqual` — honest about not being decoded, not a guess at a
+  narrower shape. ⚠️ **Known gap until A3 (T15, red team, Minor finding 4)**: the vendor's own
+  filter variants (`IntegrationIpAclRuleNetworkEndpointFilterDto`'s `networkIds`,
+  `IntegrationIpAclRuleSubnetEndpointFilterDto`'s `ipAddressesOrSubnets`, both variants'
+  `portFilter`, `IntegrationMacAclRuleMacAddressEndpointFilterDto`'s `macAddresses`) are themselves
+  set-like arrays — `deepEqual` compares them order-sensitively, the same false-`update` risk
+  already fixed for `deviceIds`/`protocolFilter` below, just not fixable here without decoding the
+  filter first.
+- **`enforcingDeviceFilter.deviceIds` and `protocolFilter` are SETS**, normalized with the same
+  `sortedSet` `firewall-zone-form.ts` uses for `networkIds`: neither field's own vendor description
+  ("IDs of the Switch-capable devices used to enforce the ACL rule," "Protocols this ACL rule will
+  be applied to") indicates order, and leaving either un-normalized would let a console-side
+  reorder plan a spurious `update` this read-only family's `reconcile` then refuses forever.
+- **`index` is attributes-only, never declared.** `CreateAclRuleRequest`'s own comment on the
+  field: "This property is deprecated and has no effect. Use the dedicated ACL rule reordering
+  endpoint." Reported so a reader can see a rule's current position, but never compared —
+  `Unifi.AclRuleOrdering` above is where that position is actually declared.
+- **`metadata.origin` is attributes-only**, same split `firewall-zone-form.ts`'s `metadataOrigin`
+  uses — `UserDefinedOrDerivedEntityMetadata` is server-derived, no writable field accepts it.
+
+## T11 gate: per-tag closure diff, 10.4.57 vs 10.6.97 (checked 2026-09-26)
+
+Same method `spec-version-provenance.md` (distilled package) used for Networks/FirewallZones,
+run here for `DNS Policies` (5 ops) and `Access Control (ACL Rules)` (7 ops) — 12 operations total,
+covering both families in this PR plus `Unifi.DnsPolicy` (`docs/unifi-dns-policy.md`).
+
+- **Pin**: `~/.cache/homeflare/schemas/unifi/network_v10.4.57_openapi.json`, re-verified against
+  its own `SHA256SUMS` today (`3773947b…c9df59d`).
+- **Mirror**: `raw.githubusercontent.com/beezly/unifi-apis/main/unifi-network/10.6.97.json`,
+  diffing aid only, never a spec of record (Q5/M9) — `info.version: "10.6.97"`,
+  `sha256: 44fd0e7f81603bb1279889a528a443d8f1a0102436e4a29675d8451adf32bd78`, mirror commit
+  `f979dd64ec0ea6008c2a698c278fe49a10e102c8` (Andrew Beresford, 2026-08-20, "Add UniFi API specs:
+  Network 10.6.97", GitHub-verified signature).
+- **Operation count**: both versions carry exactly the same 12 operations for these two tags — zero
+  added, zero removed, in either direction.
+- **Full raw operation objects** (parameters, request body, responses, unresolved `$ref`s
+  included — not just named schemas, the same reason `unifi.md`'s own check goes past a
+  schema-name diff): byte-identical for all 12, both versions.
+- **14 component schemas differ somewhere in the whole document** (of 379/380 total) — the SAME 14
+  `unifi.md`'s own Networks/FirewallZones check found: 9 switch-stack/LAG schemas (`Switching`
+  tag), 4 generic `filter`-query-syntax schemas (`FilterExpression` and its three siblings,
+  matching the new `Filtering` tag), and one mDNS enum addition (`SHELLY`, `UniFi Devices` tag).
+  Full per-schema breakdown: the distilled package's own `docs/spec-version-provenance.md`.
+- **Reachability, corrected 2026-09-26 (red team, Important finding 1)**: the original pass
+  resolved only plain `$ref`s reachable from the 12 operations' full parameter/body/response trees
+  — 17 schema names. ⛔ **That walk is wrong for any discriminated schema**: both `DNS policy`
+  (`type`: `A_RECORD`…`TXT_RECORD`, `FORWARD_DOMAIN` — 7-way) and `ACL rule` (`type`: `IPV4`, `MAC`
+  — 2-way) are `discriminator`-typed, and a variant reachable only via `discriminator.mapping`
+  carries no `$ref` from its parent at all. Re-walked following `$ref` **and** `mapping` targets:
+  the closure is **46 schema names**, identical set in both versions. The 29 names the `$ref`-only
+  walk missed: all 7 DNS record variant DTOs (`IntegrationDnsARecordDto`,
+  `IntegrationDnsAaaaRecordDto`, `IntegrationDnsCnameRecordDto`, `IntegrationDnsForwardDomainPolicyDto`,
+  `IntegrationDnsMxRecordDto`, `IntegrationDnsSrvRecordDto`, `IntegrationDnsTxtRecordDto`) plus their
+  7 `*CreateUpdateDto` siblings; both ACL rule variant DTOs (`IntegrationIpAclRuleDto`,
+  `IntegrationMacAclRuleDto`) plus their 2 `*CreateUpdateDto` siblings; the IP/MAC endpoint-filter
+  DTOs (`IP ACL rule endpoint`, `MAC ACL rule endpoint`, `IntegrationIpAclRuleNetworkEndpointFilterDto`,
+  `IntegrationIpAclRulePortEndpointFilterDto`, `IntegrationIpAclRuleSubnetEndpointFilterDto`,
+  `IntegrationMacAclRuleMacAddressEndpointFilterDto`); `IntegrationAclRuleDevicesFilterDto`
+  (the device-filter's own `DEVICES` mapping target); and 2 more entity-metadata variants beyond the
+  five the original count already had. Re-diffed all 46 against the mirror with an order-independent
+  structural compare (not a byte/string compare — JSON key order differs between the pin and the
+  mirror file): **zero differ.** **Zero overlap** with the 14 schemas that changed elsewhere in the
+  document.
+
+**Answer unchanged: neither `DnsPolicy` nor `AclRule`/`AclRuleOrdering` would decode differently
+against 10.6.97** — the conclusion survives the correction; only the closure method and the schema
+count were wrong. **This does not generalize past 10.6.97 or to any other tag — re-run this check,
+following BOTH `$ref` and `discriminator.mapping`, before importing or declaring against `Clients`,
+`WiFi Broadcasts`, `Traffic Matching Lists`, `Switching`, or `Firewall` (`FirewallPolicy`); a
+`$ref`-only walk on `WiFi Broadcasts` finds 15 schemas and would miss
+`IntegrationWifiMdnsProxyPredefinedServiceDto`, which DID change (10.6.97 added the `SHELLY` enum
+member) and is reachable only through a `mapping`.**
+
+## The declaration renderers
+
+`declareAclRule(live, siteId)` and `declareAclRuleOrdering(live, siteId)` are pure functions, same
+contract as `declareNetwork`/`declareFirewallZone` (`docs/unifi.md`): given one live read, they
+return the `Props` a declaration needs so its plan is a no-op. Neither performs the read itself.
+
+## Field-level drift
+
+`acl-rule.ts`/`acl-rule-ordering.ts` each export a pure `driftOf(live, props)`
+(`acl-rule-drift.ts`, `acl-rule-ordering-form.ts`), built on the same `drift.ts`'s `makeDriftOf`
+framework as `Unifi.Network`/`Unifi.FirewallZone` — `matches` is exactly
+`fieldDrift(...).length === 0`, never a second hand-written comparison (MEDIUM-4).
+
+## Vendor version
+
+UniFi Network Integration API **10.4.57**, same pin as `docs/unifi.md`, via
+`@distilled.cloud/unifi-network` aliased onto `@homeflare/distilled-unifi-network@0.2.0`.