@homeflare/alchemy 0.39.0 → 0.41.0

package/src/unifi/discriminated-filter-decode.test.ts

@@ -0,0 +1,134 @@
+/**
+ * A3/T26 regression: the SDK's per-discriminator-typed filters (FirewallPolicy's
+ * `protocolFilter`/`macAddressFilter`, an ACL rule's `sourceFilter`/`destinationFilter`) must
+ * decode a wire value UNCHANGED — including a key this pinned spec doesn't yet declare.
+ *
+ * ⛔ WITHOUT THIS TEST, A REGEN THAT SWITCHES `scripts/generate.ts` BACK TO
+ *   `unionStyle: "opaque-cases"` STAYS GREEN. That style emits `S.Unknown.pipe(T.UnionCases(...))`,
+ *   whose decode (`@distilled.cloud/core` `protocol-http.ts`'s `mapKeys`) picks the best-matching
+ *   case by key set and keeps ONLY that case's keys — silently dropping a future vendor field, and
+ *   in a same-key-set tie (an all-null MAC endpoint vs. the IP endpoint below) picking the WRONG
+ *   case's keys outright. `scripts/generate.ts` now uses Argo CD's `union:` callback instead — a
+ *   bare `S.Unknown` with no case annotation — which this repo's own `fake-unifi.ts` proves against
+ *   the real wire path (path assembly + JSON decode), the same way `errors-and-secrets.test.ts`
+ *   proves A1/A2. This family has no `Unifi.FirewallPolicy`/`Unifi.AclRule` provider yet (Lane B),
+ *   so the SDK's own `getAclRule`/`getFirewallPolicy` operations are called directly.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as aclRules from '@distilled.cloud/unifi-network/access_control_acl_rules';
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
+
+const ACL_PATH = '/proxy/network/integration/v1/sites/site-1/acl-rules/acl-1';
+const FW_PATH = '/proxy/network/integration/v1/sites/site-1/firewall/policies/fp-1';
+
+// Fabricated fixture (RFC 5737 address block, RFC 2606-safe ids) — kit is PUBLIC (fake-unifi.ts).
+const aclBody = () => ({
+  type: 'IPV4',
+  id: 'acl-1',
+  name: 'example-rule',
+  enabled: true,
+  action: 'BLOCK',
+  index: 0,
+  metadata: { origin: 'USER' },
+  // A future console version's field this pinned spec has never declared.
+  sourceFilter: {
+    type: 'IP_ADDRESSES_OR_SUBNETS',
+    ipAddressesOrSubnets: ['192.0.2.0/24'],
+    futureVendorField: 'unmodeled-by-this-spec-version',
+  },
+  // Every member null (a same-key-set tie with the IP case under key-set matching).
+  destinationFilter: { type: 'MAC_ADDRESSES', macAddresses: null, prefixLength: null },
+});
+
+describe('A3/T26 — ACL rule filters decode unchanged, including an unmodeled field', () => {
+  test('sourceFilter keeps a key this spec version does not declare', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === ACL_PATH
+        ? Response.json(aclBody())
+        : new Response('unexpected request', { status: 400 }),
+    );
+    const live = await Effect.runPromise(
+      aclRules
+        .getAclRule({ siteId: 'site-1', aclRuleId: 'acl-1' })
+        .pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    const source = live.sourceFilter as unknown as Record<string, unknown>;
+    expect(source.futureVendorField).toBe('unmodeled-by-this-spec-version');
+    expect(source.ipAddressesOrSubnets).toEqual(['192.0.2.0/24']);
+  });
+
+  test('destinationFilter is not silently reassigned to the tied IP case', async () => {
+    const fake = fakeUnifi(() => Response.json(aclBody()));
+    const live = await Effect.runPromise(
+      aclRules
+        .getAclRule({ siteId: 'site-1', aclRuleId: 'acl-1' })
+        .pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    const dest = live.destinationFilter as unknown as Record<string, unknown>;
+    expect(dest.type).toBe('MAC_ADDRESSES');
+    expect('macAddresses' in dest).toBe(true);
+    // The IP case's own keys (`ipAddressesOrSubnets`, `portFilter`, `networkIds`) never appear —
+    // the case-narrowing mapKeys path this SDK no longer uses would rewrite them in on a key-set tie.
+    expect('ipAddressesOrSubnets' in dest).toBe(false);
+  });
+});
+
+const fwBody = () => ({
+  id: 'fp-1',
+  name: 'example-policy',
+  enabled: true,
+  index: 1,
+  action: { type: 'ALLOW' },
+  source: {
+    zoneId: 'zone-src',
+    trafficFilter: {
+      type: 'MAC_ADDRESS',
+      macAddressFilter: {
+        macAddresses: ['02:00:00:00:00:01'],
+        futureVendorField: 'unmodeled-by-this-spec-version',
+      },
+    },
+  },
+  destination: { zoneId: 'zone-dst' },
+  ipProtocolScope: {
+    ipVersion: 'IPV6',
+    protocolFilter: {
+      type: 'NAMED_PROTOCOL',
+      protocol: { name: 'icmpv6', typenameFilter: 'ECHO_REQUEST' },
+      matchOpposite: false,
+      futureVendorField: 'unmodeled-by-this-spec-version',
+    },
+  },
+  metadata: { origin: 'USER' },
+  loggingEnabled: false,
+});
+
+describe('A3/T26 — FirewallPolicy filters decode unchanged, including an unmodeled field', () => {
+  test('macAddressFilter and protocolFilter both keep a key this spec version does not declare', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === FW_PATH
+        ? Response.json(fwBody())
+        : new Response('unexpected request', { status: 400 }),
+    );
+    const live = await Effect.runPromise(
+      firewall
+        .getFirewallPolicy({ siteId: 'site-1', firewallPolicyId: 'fp-1' })
+        .pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    const macFilter = live.source.trafficFilter?.macAddressFilter as unknown as Record<
+      string,
+      unknown
+    >;
+    expect(macFilter.futureVendorField).toBe('unmodeled-by-this-spec-version');
+    expect(macFilter.macAddresses).toEqual(['02:00:00:00:00:01']);
+
+    const protocolFilter = live.ipProtocolScope.protocolFilter as unknown as Record<
+      string,
+      unknown
+    >;
+    expect(protocolFilter.futureVendorField).toBe('unmodeled-by-this-spec-version');
+    expect((protocolFilter.protocol as Record<string, unknown>).name).toBe('icmpv6');
+  });
+});

package/src/unifi/dns-policy-drift.ts

@@ -0,0 +1,48 @@
+/**
+ * `Unifi.DnsPolicy`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, the
+ * same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s own header explains (MEDIUM-4,
+ * red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)` is true
+ * BY CONSTRUCTION, never two hand-kept-in-sync comparisons.
+ *
+ * ★ NO CUSTOM `equal` ANYWHERE. Every field is a scalar and `drift.ts`'s `defaultEqual`
+ *   (`deepEqual` with `stripNullish: true`) already gives UniFi's `null`-for-unset-optional
+ *   reality the same tolerance `network-drift.ts`/`firewall-zone-form.ts` rely on — see
+ *   `dns-policy-form.ts`'s own header for why no field here needs a set/order normalizer.
+ */
+import type * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+import { makeDriftOf } from './drift.ts';
+import { type DnsPolicyAttributes, type DnsPolicyProps, attributesOf } from './dns-policy-form.ts';
+
+const fieldDrift = makeDriftOf<DnsPolicyAttributes, DnsPolicyProps>([
+  { field: 'enabled', live: (a) => a.enabled, declared: (p) => p.enabled },
+  { field: 'type', live: (a) => a.type, declared: (p) => p.type },
+  { field: 'domain', live: (a) => a.domain, declared: (p) => p.domain },
+  { field: 'ipv6Address', live: (a) => a.ipv6Address, declared: (p) => p.ipv6Address },
+  { field: 'ttlSeconds', live: (a) => a.ttlSeconds, declared: (p) => p.ttlSeconds },
+  { field: 'ipv4Address', live: (a) => a.ipv4Address, declared: (p) => p.ipv4Address },
+  { field: 'targetDomain', live: (a) => a.targetDomain, declared: (p) => p.targetDomain },
+  { field: 'ipAddress', live: (a) => a.ipAddress, declared: (p) => p.ipAddress },
+  {
+    field: 'mailServerDomain',
+    live: (a) => a.mailServerDomain,
+    declared: (p) => p.mailServerDomain,
+  },
+  { field: 'priority', live: (a) => a.priority, declared: (p) => p.priority },
+  { field: 'port', live: (a) => a.port, declared: (p) => p.port },
+  { field: 'protocol', live: (a) => a.protocol, declared: (p) => p.protocol },
+  { field: 'serverDomain', live: (a) => a.serverDomain, declared: (p) => p.serverDomain },
+  { field: 'service', live: (a) => a.service, declared: (p) => p.service },
+  { field: 'weight', live: (a) => a.weight, declared: (p) => p.weight },
+  { field: 'text', live: (a) => a.text, declared: (p) => p.text },
+]);
+
+export const matches = (attributes: DnsPolicyAttributes, props: DnsPolicyProps): boolean =>
+  fieldDrift(attributes, props).length === 0;
+
+/**
+ * Per-field live-vs-declared drift straight from one live read — the task's own API
+ * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive
+ * `attributesOf` itself just to call this.
+ */
+export const driftOf = (live: dnsPolicies.DNSPolicy, props: DnsPolicyProps) =>
+  fieldDrift(attributesOf(live, props), props);

package/src/unifi/dns-policy-form.ts

@@ -0,0 +1,142 @@
+/**
+ * `Unifi.DnsPolicy`'s wire shape — the declarable subset of `DNSPolicy`, and how a live read
+ * becomes both plan attributes and a rendered declaration.
+ *
+ * ★ ONE FLAT DTO FOR EVERY DNS RECORD `type` (`A_RECORD`/`AAAA_RECORD`/`CNAME_RECORD`/
+ *   `FORWARD_DOMAIN`/`MX_RECORD`/`SRV_RECORD`/`TXT_RECORD` — the pinned spec's `DNS policy` schema
+ *   DOES discriminate on `type`, via `discriminator.mapping` to 7 variant DTOs; see
+ *   `docs/unifi-dns-policy.md`'s "One flat DTO" section, corrected 2026-09-26). Unlike
+ *   `access_control_acl_rules.ts`'s `sourceFilter`/`destinationFilter` or `firewall.ts`'s policy
+ *   filters, NONE of `dns_policies.ts`'s fields were widened to `unknown` by the converter (T10) —
+ *   `scripts/convert.ts` flattens the 7 variants into one struct instead, because no two variants
+ *   collide on a field name, so every optional field still decodes as a plain scalar and there is
+ *   no discriminated-variant trap here to flag or defer past this PR.
+ *
+ * ⚠️ PROPS MIRROR `UpdateDnsPolicyRequest`, NOT `DNSPolicy` — same split `network-form.ts` and
+ *   `firewall-zone-form.ts` both use. `id` and `metadata` are server-derived (no writable field
+ *   accepts either), so they are attributes-only, reported but never compared or declared.
+ *   Everything else in `DnsPolicyProps` is exactly what `updateDnsPolicy`/`createDnsPolicy` would
+ *   accept, even though this family never calls either.
+ *
+ * ⛔ NO ARRAY FIELD ANYWHERE IN THIS SHAPE. Every field below is a scalar (`string`/`number`/
+ *   `boolean`), so none of `network-form.ts`'s/`firewall-zone-form.ts`'s `sortedSet` normalizing
+ *   is needed — `deepEqual`'s default `stripNullish` handling (`drift.ts`) is the whole story.
+ */
+import type * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+
+/**
+ * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE (`exactOptionalPropertyTypes` —
+ *   see `network-form.ts`'s own header for why `declareDnsPolicy` below needs it: it assigns a
+ *   live optional field straight through, so the target type must admit an explicit `undefined`,
+ *   not just omission).
+ */
+export interface DnsPolicyProps {
+  siteId: string;
+  dnsPolicyId: string;
+  enabled: boolean;
+  /** DNS record type: `A_RECORD`, `AAAA_RECORD`, `CNAME_RECORD`, `FORWARD_DOMAIN`, `MX_RECORD`,
+   *  `SRV_RECORD` or `TXT_RECORD` (the discriminator's own mapping keys, see the header). */
+  type: string;
+  domain?: string | undefined;
+  ipv6Address?: string | undefined;
+  /** Time to live in seconds. */
+  ttlSeconds?: number | undefined;
+  ipv4Address?: string | undefined;
+  targetDomain?: string | undefined;
+  /** IP address of the DNS Server that the DNS query is forwarded to. */
+  ipAddress?: string | undefined;
+  mailServerDomain?: string | undefined;
+  /** Priority. A lower number is preferred. */
+  priority?: number | undefined;
+  port?: number | undefined;
+  /** Protocol used by the service. */
+  protocol?: string | undefined;
+  /** Domain of the server that is running the service. */
+  serverDomain?: string | undefined;
+  /** Service associated with this SRV record. */
+  service?: string | undefined;
+  /** Weight. A relative value applicable for records with the same priority. A lower number is
+   *  preferred. */
+  weight?: number | undefined;
+  /** The text value associated with this TXT DNS record. Text can contain up to four
+   *  255-character strings. Lines containing commas must be enclosed in double quotes ("). */
+  text?: string | undefined;
+}
+
+export interface DnsPolicyAttributes {
+  siteId: string;
+  dnsPolicyId: string;
+  enabled: boolean;
+  type: string;
+  domain: string | undefined;
+  ipv6Address: string | undefined;
+  ttlSeconds: number | undefined;
+  ipv4Address: string | undefined;
+  targetDomain: string | undefined;
+  ipAddress: string | undefined;
+  mailServerDomain: string | undefined;
+  priority: number | undefined;
+  port: number | undefined;
+  protocol: string | undefined;
+  serverDomain: string | undefined;
+  service: string | undefined;
+  weight: number | undefined;
+  text: string | undefined;
+  /** `metadata.origin` (e.g. `USER`) — server-derived, never declared; see
+   *  `firewall-zone-form.ts`'s own `metadataOrigin` for the same split. */
+  metadataOrigin: string;
+}
+
+export const attributesOf = (
+  live: dnsPolicies.DNSPolicy,
+  props: DnsPolicyProps,
+): DnsPolicyAttributes => ({
+  siteId: props.siteId,
+  dnsPolicyId: live.id,
+  enabled: live.enabled,
+  type: live.type,
+  domain: live.domain,
+  ipv6Address: live.ipv6Address,
+  ttlSeconds: live.ttlSeconds,
+  ipv4Address: live.ipv4Address,
+  targetDomain: live.targetDomain,
+  ipAddress: live.ipAddress,
+  mailServerDomain: live.mailServerDomain,
+  priority: live.priority,
+  port: live.port,
+  protocol: live.protocol,
+  serverDomain: live.serverDomain,
+  service: live.service,
+  weight: live.weight,
+  text: live.text,
+  metadataOrigin: live.metadata.origin,
+});
+
+/**
+ * The declaration renderer (task spec: "given one live object, return the props a declaration
+ * needs so its plan is noop"). A later import script feeds `getDnsPolicy`'s own response straight
+ * in and writes the result into `alchemy.run.ts` as `dnsPolicy('<id>', declareDnsPolicy(live,
+ * siteId))` — no field is invented or defaulted here beyond what `attributesOf` already reports,
+ * so `matches(attributesOf(live, props), declareDnsPolicy(live, siteId))` is `true` by
+ * construction (`dns-policy.test.ts` proves it) for any live object this SDK can decode.
+ */
+export const declareDnsPolicy = (live: dnsPolicies.DNSPolicy, siteId: string): DnsPolicyProps => ({
+  siteId,
+  dnsPolicyId: live.id,
+  enabled: live.enabled,
+  type: live.type,
+  domain: live.domain,
+  ipv6Address: live.ipv6Address,
+  ttlSeconds: live.ttlSeconds,
+  ipv4Address: live.ipv4Address,
+  targetDomain: live.targetDomain,
+  ipAddress: live.ipAddress,
+  mailServerDomain: live.mailServerDomain,
+  priority: live.priority,
+  port: live.port,
+  protocol: live.protocol,
+  serverDomain: live.serverDomain,
+  service: live.service,
+  weight: live.weight,
+  text: live.text,
+});

package/src/unifi/dns-policy.test.ts

@@ -0,0 +1,154 @@
+/**
+ * `Unifi.DnsPolicy`'s `spec` against a fake UniFi Network API — mirrors `network.test.ts`/
+ * `firewall-zone.test.ts`. `driftOf`/`matches` coverage lives here too (not split into its own
+ * file, unlike `network-drift.test.ts`): this family's field list is flat scalars only, so there
+ * is no unordered-array normalizer to exercise and the whole file stays well under the house cap.
+ */
+import { describe, expect, test } from 'bun:test';
+import type * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+import * as Retry from '@distilled.cloud/unifi-network/Retry';
+import * as Effect from 'effect/Effect';
+import { fakeFailure, fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
+import { attributesOf } from './dns-policy-form.ts';
+import { driftOf, matches } from './dns-policy-drift.ts';
+import { type DnsPolicyProps, declareDnsPolicy, spec } from './dns-policy.ts';
+import { unifiOperations } from './resource.ts';
+
+const POLICY_PATH = '/proxy/network/integration/v1/sites/site-1/dns/policies/dns-1';
+
+const liveDnsPolicy = (overrides: Partial<dnsPolicies.DNSPolicy> = {}): dnsPolicies.DNSPolicy => ({
+  enabled: true,
+  id: 'dns-1',
+  metadata: { origin: 'USER' },
+  type: 'A_RECORD',
+  domain: 'cameras.example.test',
+  ipv4Address: '192.0.2.10',
+  ttlSeconds: 300,
+  ...overrides,
+});
+
+const PROPS: DnsPolicyProps = {
+  siteId: 'site-1',
+  dnsPolicyId: 'dns-1',
+  enabled: true,
+  type: 'A_RECORD',
+  domain: 'cameras.example.test',
+  ipv4Address: '192.0.2.10',
+  ttlSeconds: 300,
+};
+
+describe('Unifi.DnsPolicy spec.fetchLive', () => {
+  test('a real GET response decodes into the typed live object', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICY_PATH
+        ? Response.json(liveDnsPolicy())
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const live = await Effect.runPromise(
+      spec.fetchLive(PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(live?.id).toBe('dns-1');
+    expect(fake.seen).toEqual([{ method: 'GET', path: POLICY_PATH }]);
+  });
+
+  test('a genuine 404 folds to undefined -- never a false "unreadable" on anything else', async () => {
+    const fake = fakeUnifi(() => fakeFailure(404, 'not found'));
+    const live = await Effect.runPromise(
+      spec.fetchLive(PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(live).toBeUndefined();
+  });
+
+  test('a 500 fails loudly -- only a genuine not-found may mean absent (T14)', async () => {
+    // ⚠️ `Retry.none`: the default policy retries a 500 indefinitely with backoff -- this test
+    //   asserts the FAILURE, not the retry schedule. Regression for red-team Important finding 2:
+    //   a blanket `Effect.orElseSucceed(() => undefined)` fold would pass every test above too.
+    const fake = fakeUnifi(() => fakeFailure(500, 'boom'));
+    const failure = await Effect.runPromise(
+      Effect.flip(
+        spec.fetchLive(PROPS).pipe(Retry.none, Effect.provide(fakeUnifiLayer(fake.fetch))),
+      ),
+    );
+    expect(failure._tag).toBe('InternalServerError');
+  });
+});
+
+describe('declareDnsPolicy -- the declaration renderer', () => {
+  test('its output matches attributesOf(live) by construction, for any live object', () => {
+    // A record shape with a DIFFERENT set of fields present than `liveDnsPolicy`'s default (a
+    // TXT record has no `ipv4Address`/`ttlSeconds`, but DOES require its own `domain` --
+    // `IntegrationDnsTxtRecordDto` lists `domain` as required, unlike the A-record-only fields) --
+    // a fresh literal, not the `A_RECORD` fixture's overrides, so no field is merely omitted from
+    // an override that would otherwise still carry the base fixture's value.
+    const live: dnsPolicies.DNSPolicy = {
+      enabled: true,
+      id: 'dns-2',
+      metadata: { origin: 'USER' },
+      type: 'TXT_RECORD',
+      domain: 'spf.example.test',
+      text: '"v=spf1 -all"',
+    };
+    const declared = declareDnsPolicy(live, 'site-1');
+    const attrs = attributesOf(live, declared);
+    expect(matches(attrs, declared)).toBe(true);
+    expect(driftOf(live, declared)).toEqual([]);
+  });
+});
+
+describe('driftOf -- B6 field-level drift, straight from one live read', () => {
+  test('a drifted field reports its own live and declared values, by name', () => {
+    const live = liveDnsPolicy({ ttlSeconds: 60 });
+    expect(driftOf(live, PROPS)).toEqual([{ field: 'ttlSeconds', live: 60, declared: 300 }]);
+  });
+
+  test('a live `null` for an unset optional field is a noop, not a spurious update', () => {
+    // UniFi's JSON answers `null` for an unset optional (see `dns-policy-drift.ts`'s header);
+    // the double cast lands `null` at runtime past what the SDK's `T | undefined` types allow.
+    const live = { ...liveDnsPolicy(), ipv6Address: null } as unknown as dnsPolicies.DNSPolicy;
+    expect(matches(attributesOf(live, PROPS), PROPS)).toBe(true);
+    expect(driftOf(live, PROPS)).toEqual([]);
+  });
+});
+
+describe('Unifi.DnsPolicy write paths never reach the vendor API', () => {
+  const ops = unifiOperations(spec);
+
+  test('reconcile on an exact-match adoption (H6) makes no request but the one read', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICY_PATH
+        ? Response.json(liveDnsPolicy())
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const exit = await Effect.runPromiseExit(
+      ops.reconcile(PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(exit._tag).toBe('Success');
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+  });
+
+  test('reconcile on drift refuses instead of PUTting a merged body', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICY_PATH
+        ? Response.json(liveDnsPolicy({ ttlSeconds: 999 }))
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const exit = await Effect.runPromiseExit(
+      ops.reconcile(PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(exit._tag).toBe('Failure');
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+  });
+
+  test('delete always refuses -- no DELETE is ever sent', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICY_PATH
+        ? Response.json(liveDnsPolicy())
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const exit = await Effect.runPromiseExit(
+      ops.destroy(PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(exit._tag).toBe('Failure');
+    expect(fake.seen).toEqual([]);
+  });
+});

package/src/unifi/dns-policy.ts

@@ -0,0 +1,67 @@
+/**
+ * `Unifi.DnsPolicy` — one DNS policy on a UniFi Network site, READ-ONLY (`policy.ts`).
+ *
+ * ★ T11 GATE, CHECKED 2026-09-26, CORRECTED SAME DAY (red team, Important finding 1): `DNS
+ *   Policies` is 5 operations, `Access Control (ACL Rules)` (`acl-rule.ts`) is 7 — 12 total.
+ *   Diffed the pinned 10.4.57 spec against a 10.6.97 mirror (`beezly/unifi-apis`, diffing aid
+ *   only, `docs/unifi-acl-rule.md` records the sha256 + mirror commit): all 12 full operation
+ *   objects (parameters, request body, responses, unresolved `$ref`s included) are byte-identical
+ *   across versions. ⚠️ The schema closure is 46, not 17 — a `$ref`-only walk misses every schema
+ *   reachable only via a `discriminator.mapping` (both `DNS policy` and `ACL rule` discriminate on
+ *   `type`); the 46-schema closure, `$ref` + `mapping` together, shares zero names with the 14
+ *   schemas that DID change between the two versions (all in `Switching`, `Filtering`, or one
+ *   `UniFi Devices` enum — none of it DNS- or ACL-shaped). Same reachability method
+ *   `spec-version-provenance.md` (distilled package) used for Networks/FirewallZones, extended to
+ *   follow `mapping` too; full breakdown in `docs/unifi-acl-rule.md`, not repeated per family.
+ */
+import { Resource } from 'alchemy';
+import { adopt } from 'alchemy/AdoptPolicy';
+import * as Provider from 'alchemy/Provider';
+import * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';
+import * as Effect from 'effect/Effect';
+import { type DnsPolicyAttributes, type DnsPolicyProps, attributesOf } from './dns-policy-form.ts';
+import { matches } from './dns-policy-drift.ts';
+import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+import { unifiHandlers } from './resource.ts';
+
+export type { DnsPolicyAttributes, DnsPolicyProps } from './dns-policy-form.ts';
+export { declareDnsPolicy } from './dns-policy-form.ts';
+export { driftOf } from './dns-policy-drift.ts';
+
+export interface UnifiDnsPolicy extends Resource<
+  'Unifi.DnsPolicy',
+  DnsPolicyProps,
+  DnsPolicyAttributes,
+  never,
+  UnifiRequirements
+> {}
+
+export const UnifiDnsPolicy = Resource<UnifiDnsPolicy>('Unifi.DnsPolicy', {
+  defaultRemovalPolicy: 'retain',
+});
+
+/** `dnsPolicy('lan-forwarding', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
+export const dnsPolicy = (id: string, props: DnsPolicyProps) =>
+  UnifiDnsPolicy(id, props).pipe(adopt(true));
+
+/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
+export const spec: UnifiSpec<
+  DnsPolicyProps,
+  dnsPolicies.DNSPolicy,
+  DnsPolicyAttributes,
+  dnsPolicies.GetDnsPolicyError
+> = {
+  type: 'Unifi.DnsPolicy',
+  describe: (props) => `sites/${props.siteId}/dns/policies/${props.dnsPolicyId}`,
+  fetchLive: (props) =>
+    dnsPolicies
+      .getDnsPolicy({ siteId: props.siteId, dnsPolicyId: props.dnsPolicyId })
+      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),
+  attributes: attributesOf,
+  matches,
+};
+
+export const handlers = unifiHandlers(spec);
+
+export const UnifiDnsPolicyProvider = () =>
+  Provider.effect(UnifiDnsPolicy, Effect.succeed(UnifiDnsPolicy.Provider.of(handlers)));