@homeflare/alchemy 0.46.1 → 0.47.0

package/dist/telemetry/index.js.map

@@ -2,11 +2,11 @@
   "version": 3,
   "sources": ["../src/telemetry/layer.ts", "../src/telemetry/redact-serialization.ts", "../src/telemetry/redact.ts"],
   "sourcesContent": [
-    "/**\n * A Layer factory for OTLP tracing/logging/metrics, built for a stack's own `providers` Layer\n * rather than the CLI-wide install alchemy's own `Telemetry/Layer.ts` does (`src/Telemetry/\n * Layer.ts:13-15`, hard-coded to `otel.alchemy.run` with no override). Nothing here calls that\n * endpoint or knows it exists.\n *\n * ⛔ NO DEFAULTS THAT POINT ANYWHERE. `endpoints` is `{}` by default and `telemetryLayer` resolves\n *   to `Layer.empty` when every entry is `undefined` — see layer.test.ts's own \"nothing sent\n *   when unconfigured\". A consumer wires actual hosts from ITS OWN site config; see docs/telemetry.md.\n * ★ SEALED TRANSPORT — the caddy lesson (kit PR 293, admin.ts's own ⛔): merging a layer that still\n *   requires `HttpClient.HttpClient` into a stack's `providers` would let this module's own\n *   `FetchHttpClient` shadow a sibling fetch-based provider's client once both are merged into the\n *   same `Layer.mergeAll`. `Layer.provide` (not `Layer.provideMerge`) twice below feeds\n *   `FetchHttpClient`/`OtlpSerialization` to the OTLP layers and returns ONLY their own output —\n *   `HttpClient.HttpClient` never appears in what `telemetryLayer` hands back. See\n *   http-client-sealing.test.ts.\n * ★ PER-SIGNAL URLS, NOT ONE BASE URL. effect's own `Otlp.layer`/`layerJson` take a single\n *   `baseUrl` and post to `<baseUrl>/v1/{traces,metrics,logs}` — fine when one collector serves all\n *   three, wrong for Victoria's split binaries (VictoriaTraces/Logs/Metrics on three different\n *   ports/paths — docs/telemetry.md has the exact paths). `OtlpTracer`/`OtlpLogger`/`OtlpMetrics`\n *   each take their own `url` and post to it verbatim (OtlpExporter.ts `make`: `HttpClientRequest.\n *   post(options.url, …)`, no suffix appended) — exactly the shape three independent endpoints need.\n * ⛔ PROTOBUF, NOT JSON (redteam PR 302 CRITICAL item 1, 2026-09-26, measured against the pinned\n *   binaries in homeflare-mini's `src/obs`): VictoriaLogs 1.52.0 and VictoriaMetrics 1.151.0 both\n *   answer OTLP/HTTP JSON with `400 \"json encoding isn't supported for opentelemetry format\"` —\n *   effect's exporter treats a 400 as non-transient, drops the batch silently and disables itself for\n *   60s at debug-only log level, so a JSON-encoded consumer sees traces (VictoriaTraces alone\n *   tolerates JSON) but never logs or metrics, with no visible error. `redactedSerialization` below\n *   provides `OtlpSerialization.layerProtobuf`, which all three ingested in the same measurement.\n */\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Logger from 'effect/Logger';\nimport * as LogLevel from 'effect/LogLevel';\nimport * as Tracer from 'effect/Tracer';\nimport * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';\nimport { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from 'effect/unstable/observability';\nimport { redactedSerialization } from './redact-serialization.ts';\nimport { type RedactionPolicy, wrapTracer } from './redact.ts';\n\n/** Full OTLP/HTTP endpoint per signal — e.g. `http://victoria.example.test:10428/insert/opentelemetry/v1/traces`. Any entry left `undefined` sends nothing for that signal. */\nexport interface TelemetryEndpoints {\n  readonly traces?: string;\n  readonly logs?: string;\n  readonly metrics?: string;\n}\n\nexport interface TelemetryOptions {\n  readonly endpoints: TelemetryEndpoints;\n  /** OTLP `service.name` — required, since an unnamed service in a shared Victoria instance is unusable. */\n  readonly serviceName: string;\n  readonly serviceVersion?: string;\n  /** Extra OTLP resource attributes (e.g. `{ \"deployment.environment\": \"prod\" }`). */\n  readonly resourceAttributes?: Record<string, unknown>;\n  readonly redaction?: RedactionPolicy;\n  /**\n   * How often a signal flushes its buffer.\n   * @default '1 second' — short on purpose: alchemy invocations are CLI runs, often shorter than a\n   * typical OTLP batch interval, so the export must fire well before the process could exit. The\n   * scope's own shutdown flush (`Exporter.layerFlusher`) is the backstop for whatever this interval\n   * misses; docs/telemetry-spike.md measured both paths.\n   */\n  readonly exportInterval?: Duration.Input;\n  /**\n   * Floor below which a log record never reaches the OTLP logger.\n   * @default 'Info' — redteam PR 302 IMPORTANT item 4: the `alchemy` CLI sets the GLOBAL minimum\n   * log level to Debug (`GlobalLog.ts`), and `OtlpLogger` has no floor of its own, so without one\n   * every Debug-level record (a provider's own connection-string/config dump, annotation noise)\n   * would ship — once `redactedSerialization` fixed item 1's silent-JSON-failure, they would\n   * actually start arriving. This floor applies ONLY to what THIS layer exports; a consumer's\n   * console/file loggers keep whatever level the CLI's own global setting gives them, since\n   * `logsMinimumLevel` filters after `Logger.layer`'s `mergeWithExisting: true` has already added\n   * this logger alongside them, not by lowering that global setting.\n   */\n  readonly logsMinimumLevel?: LogLevel.LogLevel;\n}\n\n// ⚠️ `exactOptionalPropertyTypes` — omit a key entirely rather than set it `undefined`, or the\n//   OTLP layers' own `{ readonly attributes?: X }` (no `| undefined` in their own signatures)\n//   rejects the object.\nconst resourceOf = (options: TelemetryOptions) => ({\n  serviceName: options.serviceName,\n  ...(options.serviceVersion !== undefined ? { serviceVersion: options.serviceVersion } : {}),\n  ...(options.resourceAttributes !== undefined ? { attributes: options.resourceAttributes } : {}),\n});\n\n/**\n * `OtlpTracer.layer`'s own composition (OtlpTracer.ts: `flow(make, Layer.effect(Tracer.Tracer),\n * Layer.provideMerge(Exporter.layerFlusher))`), with `wrapTracer` inserted between `make` and\n * `Layer.effect` so every span this tracer creates is redacted before anything else can see it.\n */\nconst tracerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) =>\n  Layer.effect(\n    Tracer.Tracer,\n    Effect.map(OtlpTracer.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n      wrapTracer(inner, options.redaction ?? {}),\n    ),\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n\n/**\n * `OtlpLogger.layer`'s own composition (`Logger.layer([make(options)], { mergeWithExisting: true })\n * .pipe(Layer.provideMerge(Exporter.layerFlusher))`), with a level floor inserted between `make` and\n * `Logger.layer` — see `TelemetryOptions.logsMinimumLevel`'s own doc for why.\n */\nconst loggerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) => {\n  const floor = options.logsMinimumLevel ?? 'Info';\n  return Logger.layer(\n    [\n      Effect.map(OtlpLogger.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n        Logger.make((record) =>\n          LogLevel.isGreaterThanOrEqualTo(record.logLevel, floor) ? inner.log(record) : undefined,\n        ),\n      ),\n    ],\n    { mergeWithExisting: true },\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n};\n\n/**\n * The Layer a consumer stack merges into its own `providers` — see docs/telemetry.md for how a\n * site file wires real hosts in, and docs/telemetry-spike.md for what a stack's `providers` Layer does and does\n * not carry a span for.\n *\n * ⚠️ FIXED THREE-ARG `Layer.mergeAll`, NOT AN ARRAY `.reduce`. Every signal slot is filled — with\n *   the real per-signal layer when its endpoint is set, `Layer.empty` when it is not — instead of\n *   building a variable-length array and folding it with `Layer.merge`. `Layer<in ROut, …>`\n *   declares its success channel CONTRAVARIANT, and once a fold's accumulator needs an explicit\n *   annotation to type-check under this repo's `exactOptionalPropertyTypes`, TS's overload\n *   resolution for `Layer.provide`/`Layer.merge` starts inferring `unknown` for that channel and\n *   then fails `unknown` against `never` (measured 2026-09-26, TS2769). `Layer.mergeAll`'s own\n *   fixed-arity overload — the exact shape alchemy's own `Telemetry/Layer.ts` uses for its three\n *   signals — infers cleanly with no annotation at all.\n */\nexport const telemetryLayer = (options: TelemetryOptions): Layer.Layer<never> => {\n  const { traces, logs, metrics } = options.endpoints;\n  if (traces === undefined && logs === undefined && metrics === undefined) return Layer.empty;\n  // Default declared here, not in the options' type, so every call site above stays a concrete\n  // `Duration.Input` — `exactOptionalPropertyTypes` rejects passing `undefined` through to the\n  // OTLP layers' own `exportInterval?: Duration.Input` (no `| undefined` in their signatures).\n  const exportInterval: Duration.Input = options.exportInterval ?? '1 second';\n  const tracer = traces === undefined ? Layer.empty : tracerLayer(traces, options, exportInterval);\n  const logger = logs === undefined ? Layer.empty : loggerLayer(logs, options, exportInterval);\n  const meter =\n    metrics === undefined\n      ? Layer.empty\n      : OtlpMetrics.layer({ exportInterval, resource: resourceOf(options), url: metrics });\n  return Layer.mergeAll(tracer, logger, meter).pipe(\n    Layer.provide(redactedSerialization(options.redaction ?? {})),\n    Layer.provide(FetchHttpClient.layer),\n  );\n};\n",
-    "/**\n * Free-text OTLP redaction applied at `OtlpSerialization` — the ONE place every span/log field\n * reaches the wire, right before HTTP body encoding. `redact.ts`'s `wrapTracer` only sees what a\n * caller passes to `Span.attribute()`/`Span.event()`; two real fields never go through either hook:\n *\n * - `status.message` and the `exception.*` event attributes `OtlpTracer`'s own `makeOtlpSpan` builds\n *   from `Cause.prettyErrors(exit.cause)` — computed at export time, inside effect's tracer, AFTER\n *   `wrapTracer.end()` has already handed the exit straight to `real.end()`.\n * - a log line inside a span, turned into a span event by effect's default `tracerLogger` — the log\n *   message becomes the event NAME (not an attribute `wrapTracer.event()` redacts), and its\n *   `effect.cause` attribute is free text `redactAttribute`'s key-based rules never recognize.\n *\n * Redteam finding (PR 302, 2026-09-26): a provider GET that 404'd exported `exception.message =\n * \"... 404 GET http://host/secret-site-abc123/probe?token=SECRET123\"` unredacted — the query, the\n * denylisted path segment and the denylisted host all went out. A `logWarning` inside a span leaked\n * the same way through the event name.\n *\n * ⚠️ SUBSTRING MATCH, NOT SEGMENT MATCH. `redactAttribute` compares a denylist entry against a whole\n *   `/`-bounded URL segment on purpose (`redact.ts`'s own ⚠️: `\"db\"` must not blank `\"db1.example.\n *   test\"`). Free text has no segment boundaries — a log message or a formatted `Cause` embeds a\n *   token in prose — so `scrubText` matches a denylist entry as a literal substring ANYWHERE in the\n *   string. This is strictly broader than the structured rules, so it also closes the `server.\n *   address` bare-hostname and legacy `http.url` gaps (redteam MINOR item 5) as a side effect: a\n *   denylisted hostname is a substring match wherever it appears, URL-shaped or not. The tradeoff a\n *   caller accepts by naming a short, common word in `denylist` is over-redaction, never a leak.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport { OtlpSerialization } from 'effect/unstable/observability';\nimport type { OtlpLogger, OtlpResource, OtlpTracer } from 'effect/unstable/observability';\nimport { REDACTED, type RedactionPolicy } from './redact.ts';\n\nconst URL_PATTERN = /https?:\\/\\/[^\\s\"'<>)]+/g;\n\n/** Strips an embedded URL's query/hash and blanks its denylisted host/path segments — `redact.ts`'s\n * `url.full` case, reused here because a URL can appear inside prose, not just as its own attribute. */\nconst scrubUrl = (raw: string, denylist: ReadonlySet<string>): string => {\n  try {\n    const url = new URL(raw);\n    const host = denylist.has(url.hostname) ? REDACTED : url.host;\n    const path = url.pathname\n      .split('/')\n      .map((segment) => (denylist.has(segment) ? REDACTED : segment))\n      .join('/');\n    return `${url.protocol}//${host}${path}`;\n  } catch {\n    return raw; // Matched the URL_PATTERN regex but `URL` still rejects it — leave verbatim.\n  }\n};\n\n/** Redacts one piece of free text: every embedded URL loses its query string and denylisted\n * segments, then every denylist entry is blanked as a substring anywhere else in the text. */\nexport const scrubText = (text: string, policy: RedactionPolicy): string => {\n  const denylist = policy.denylist ?? [];\n  const denylistSet = new Set(denylist);\n  let out = text.replace(URL_PATTERN, (match) => scrubUrl(match, denylistSet));\n  for (const token of denylist) {\n    if (token.length === 0) continue; // an empty entry would blank every character boundary\n    out = out.split(token).join(REDACTED);\n  }\n  return out;\n};\n\n/** Walks one OTLP `AnyValue`'s string leaves (`stringValue`, and recursively through `arrayValue`/\n * `kvlistValue`) — the union effect's OTLP encoders use for every attribute and log body value. */\nconst scrubValue = (\n  value: OtlpResource.AnyValue,\n  policy: RedactionPolicy,\n): OtlpResource.AnyValue => {\n  if (typeof value.stringValue === 'string')\n    return { ...value, stringValue: scrubText(value.stringValue, policy) };\n  if (value.arrayValue !== undefined) {\n    return {\n      ...value,\n      arrayValue: { values: value.arrayValue.values.map((v) => scrubValue(v, policy)) },\n    };\n  }\n  if (value.kvlistValue !== undefined) {\n    return {\n      ...value,\n      kvlistValue: {\n        values: value.kvlistValue.values.map((kv) => ({\n          key: kv.key,\n          value: scrubValue(kv.value, policy),\n        })),\n      },\n    };\n  }\n  return value; // boolValue / intValue / doubleValue / bytesValue — never free text.\n};\n\nconst scrubKeyValues = (\n  attributes: ReadonlyArray<OtlpResource.KeyValue>,\n  policy: RedactionPolicy,\n): Array<OtlpResource.KeyValue> =>\n  attributes.map((kv) => ({ key: kv.key, value: scrubValue(kv.value, policy) }));\n\n/** `TraceData` after every span's name, attributes, events (including the `exception.*` ones\n * `makeOtlpSpan` builds from the exit), status message and link attributes have been scrubbed. */\nexport const redactTraceData = (\n  data: OtlpTracer.TraceData,\n  policy: RedactionPolicy,\n): OtlpTracer.TraceData => ({\n  resourceSpans: data.resourceSpans.map((resourceSpan) => ({\n    ...resourceSpan,\n    scopeSpans: resourceSpan.scopeSpans.map((scopeSpan) => ({\n      ...scopeSpan,\n      spans: scopeSpan.spans.map((span) => ({\n        ...span,\n        attributes: scrubKeyValues(span.attributes, policy),\n        events: span.events.map((event) => ({\n          ...event,\n          attributes: scrubKeyValues(event.attributes, policy),\n          name: scrubText(event.name, policy),\n        })),\n        links: span.links.map((link) => ({\n          ...link,\n          attributes: scrubKeyValues(link.attributes, policy),\n        })),\n        name: scrubText(span.name, policy),\n        status:\n          span.status.message === undefined\n            ? span.status\n            : { ...span.status, message: scrubText(span.status.message, policy) },\n      })),\n    })),\n  })),\n});\n\ntype LogRecord = NonNullable<\n  OtlpLogger.LogsData['resourceLogs'][number]['scopeLogs'][number]['logRecords']\n>[number];\n\n// ⚠️ `exactOptionalPropertyTypes` — `body` is `AnyValue?` with no `| undefined` in its own\n//   signature (matches `layer.ts`'s own `resourceOf` note), so an absent one is OMITTED, not set to\n//   `undefined`, or this object-literal return fails to type-check against `ILogRecord`.\nconst scrubLogRecord = (record: LogRecord, policy: RedactionPolicy): LogRecord => ({\n  ...record,\n  attributes: scrubKeyValues(record.attributes, policy),\n  ...(record.body !== undefined ? { body: scrubValue(record.body, policy) } : {}),\n});\n\n/** `LogsData` after every log record's attributes and body have been scrubbed — the fix for redteam\n * item 4's \"logs ship unredacted\": `log.error` (`Cause.pretty`) and the message body are free text. */\nexport const redactLogsData = (\n  data: OtlpLogger.LogsData,\n  policy: RedactionPolicy,\n): OtlpLogger.LogsData => ({\n  resourceLogs: data.resourceLogs.map((resourceLog) => ({\n    ...resourceLog,\n    scopeLogs: resourceLog.scopeLogs.map((scopeLog) => ({\n      ...scopeLog,\n      // Same `exactOptionalPropertyTypes` reasoning as `scrubLogRecord` — omit `logRecords`\n      // entirely rather than assign it `undefined` when the source had none.\n      ...(scopeLog.logRecords !== undefined\n        ? { logRecords: scopeLog.logRecords.map((record) => scrubLogRecord(record, policy)) }\n        : {}),\n    })),\n  })),\n});\n\n/**\n * Wraps the real `OtlpSerialization` so `telemetryLayer` gets this free-text pass on every signal\n * with no separate wiring at each call site — `layer.ts` provides this in place of a bare\n * `OtlpSerialization.layerProtobuf`. Metrics pass through untouched: they carry numeric data points\n * keyed by `Metric.Metric.AttributeSet`, not provider-supplied free text.\n */\nexport const redactedSerialization = (\n  policy: RedactionPolicy,\n): Layer.Layer<OtlpSerialization.OtlpSerialization> =>\n  Layer.effect(\n    OtlpSerialization.OtlpSerialization,\n    Effect.map(OtlpSerialization.OtlpSerialization, (inner) => ({\n      logs: (data: OtlpLogger.LogsData) => inner.logs(redactLogsData(data, policy)),\n      metrics: inner.metrics,\n      traces: (data: OtlpTracer.TraceData) => inner.traces(redactTraceData(data, policy)),\n    })),\n  ).pipe(Layer.provide(OtlpSerialization.layerProtobuf));\n",
+    "/**\n * A Layer factory for OTLP tracing/logging/metrics, built for a stack's own `providers` Layer\n * rather than the CLI-wide install alchemy's own `Telemetry/Layer.ts` does (`src/Telemetry/\n * Layer.ts:13-15`, hard-coded to `otel.alchemy.run` with no override). Nothing here calls that\n * endpoint or knows it exists.\n *\n * ⛔ NO DEFAULTS THAT POINT ANYWHERE. `endpoints` is `{}` by default and `telemetryLayer` resolves\n *   to `Layer.empty` when every entry is `undefined` — see layer.test.ts's own \"nothing sent\n *   when unconfigured\". A consumer wires actual hosts from ITS OWN site config; see docs/telemetry.md.\n * ★ SEALED TRANSPORT — the caddy lesson (kit PR 293, admin.ts's own ⛔): merging a layer that still\n *   requires `HttpClient.HttpClient` into a stack's `providers` would let this module's own\n *   `FetchHttpClient` shadow a sibling fetch-based provider's client once both are merged into the\n *   same `Layer.mergeAll`. `Layer.provide` (not `Layer.provideMerge`) twice below feeds\n *   `FetchHttpClient`/`OtlpSerialization` to the OTLP layers and returns ONLY their own output —\n *   `HttpClient.HttpClient` never appears in what `telemetryLayer` hands back. See\n *   http-client-sealing.test.ts.\n * ★ PER-SIGNAL URLS, NOT ONE BASE URL. effect's own `Otlp.layer`/`layerJson` take a single\n *   `baseUrl` and post to `<baseUrl>/v1/{traces,metrics,logs}` — fine when one collector serves all\n *   three, wrong for Victoria's split binaries (VictoriaTraces/Logs/Metrics on three different\n *   ports/paths — docs/telemetry.md has the exact paths). `OtlpTracer`/`OtlpLogger`/`OtlpMetrics`\n *   each take their own `url` and post to it verbatim (OtlpExporter.ts `make`: `HttpClientRequest.\n *   post(options.url, …)`, no suffix appended) — exactly the shape three independent endpoints need.\n * ⛔ PROTOBUF, NOT JSON (redteam PR 302 CRITICAL item 1, 2026-09-26, measured against the pinned\n *   binaries in homeflare-mini's `src/obs`): VictoriaLogs 1.52.0 and VictoriaMetrics 1.151.0 both\n *   answer OTLP/HTTP JSON with `400 \"json encoding isn't supported for opentelemetry format\"` —\n *   effect's exporter treats a 400 as non-transient, drops the batch silently and disables itself for\n *   60s at debug-only log level, so a JSON-encoded consumer sees traces (VictoriaTraces alone\n *   tolerates JSON) but never logs or metrics, with no visible error. `redactedSerialization` below\n *   provides `OtlpSerialization.layerProtobuf`, which all three ingested in the same measurement.\n */\nimport type * as Duration from 'effect/Duration';\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport * as Logger from 'effect/Logger';\nimport * as LogLevel from 'effect/LogLevel';\nimport * as Tracer from 'effect/Tracer';\nimport * as FetchHttpClient from 'effect/http/FetchHttpClient';\nimport { OtlpExporter, OtlpLogger, OtlpMetrics, OtlpTracer } from 'effect/observability';\nimport { redactedSerialization } from './redact-serialization.ts';\nimport { type RedactionPolicy, wrapTracer } from './redact.ts';\n\n/** Full OTLP/HTTP endpoint per signal — e.g. `http://victoria.example.test:10428/insert/opentelemetry/v1/traces`. Any entry left `undefined` sends nothing for that signal. */\nexport interface TelemetryEndpoints {\n  readonly traces?: string;\n  readonly logs?: string;\n  readonly metrics?: string;\n}\n\nexport interface TelemetryOptions {\n  readonly endpoints: TelemetryEndpoints;\n  /** OTLP `service.name` — required, since an unnamed service in a shared Victoria instance is unusable. */\n  readonly serviceName: string;\n  readonly serviceVersion?: string;\n  /** Extra OTLP resource attributes (e.g. `{ \"deployment.environment\": \"prod\" }`). */\n  readonly resourceAttributes?: Record<string, unknown>;\n  readonly redaction?: RedactionPolicy;\n  /**\n   * How often a signal flushes its buffer.\n   * @default '1 second' — short on purpose: alchemy invocations are CLI runs, often shorter than a\n   * typical OTLP batch interval, so the export must fire well before the process could exit. The\n   * scope's own shutdown flush (`Exporter.layerFlusher`) is the backstop for whatever this interval\n   * misses; docs/telemetry-spike.md measured both paths.\n   */\n  readonly exportInterval?: Duration.Input;\n  /**\n   * Floor below which a log record never reaches the OTLP logger.\n   * @default 'Info' — redteam PR 302 IMPORTANT item 4: the `alchemy` CLI sets the GLOBAL minimum\n   * log level to Debug (`GlobalLog.ts`), and `OtlpLogger` has no floor of its own, so without one\n   * every Debug-level record (a provider's own connection-string/config dump, annotation noise)\n   * would ship — once `redactedSerialization` fixed item 1's silent-JSON-failure, they would\n   * actually start arriving. This floor applies ONLY to what THIS layer exports; a consumer's\n   * console/file loggers keep whatever level the CLI's own global setting gives them, since\n   * `logsMinimumLevel` filters after `Logger.layer`'s `mergeWithExisting: true` has already added\n   * this logger alongside them, not by lowering that global setting.\n   */\n  readonly logsMinimumLevel?: LogLevel.LogLevel;\n}\n\n// ⚠️ `exactOptionalPropertyTypes` — omit a key entirely rather than set it `undefined`, or the\n//   OTLP layers' own `{ readonly attributes?: X }` (no `| undefined` in their own signatures)\n//   rejects the object.\nconst resourceOf = (options: TelemetryOptions) => ({\n  serviceName: options.serviceName,\n  ...(options.serviceVersion !== undefined ? { serviceVersion: options.serviceVersion } : {}),\n  ...(options.resourceAttributes !== undefined ? { attributes: options.resourceAttributes } : {}),\n});\n\n/**\n * `OtlpTracer.layer`'s own composition (OtlpTracer.ts: `flow(make, Layer.effect(Tracer.Tracer),\n * Layer.provideMerge(Exporter.layerFlusher))`), with `wrapTracer` inserted between `make` and\n * `Layer.effect` so every span this tracer creates is redacted before anything else can see it.\n */\nconst tracerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) =>\n  Layer.effect(\n    Tracer.Tracer,\n    Effect.map(OtlpTracer.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n      wrapTracer(inner, options.redaction ?? {}),\n    ),\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n\n/**\n * `OtlpLogger.layer`'s own composition (`Logger.layer([make(options)], { mergeWithExisting: true })\n * .pipe(Layer.provideMerge(Exporter.layerFlusher))`), with a level floor inserted between `make` and\n * `Logger.layer` — see `TelemetryOptions.logsMinimumLevel`'s own doc for why.\n */\nconst loggerLayer = (url: string, options: TelemetryOptions, exportInterval: Duration.Input) => {\n  const floor = options.logsMinimumLevel ?? 'Info';\n  return Logger.layer(\n    [\n      Effect.map(OtlpLogger.make({ exportInterval, resource: resourceOf(options), url }), (inner) =>\n        Logger.make((record) =>\n          LogLevel.isGreaterThanOrEqualTo(record.logLevel, floor) ? inner.log(record) : undefined,\n        ),\n      ),\n    ],\n    { mergeWithExisting: true },\n  ).pipe(Layer.provideMerge(OtlpExporter.layerFlusher));\n};\n\n/**\n * The Layer a consumer stack merges into its own `providers` — see docs/telemetry.md for how a\n * site file wires real hosts in, and docs/telemetry-spike.md for what a stack's `providers` Layer does and does\n * not carry a span for.\n *\n * ⚠️ FIXED THREE-ARG `Layer.mergeAll`, NOT AN ARRAY `.reduce`. Every signal slot is filled — with\n *   the real per-signal layer when its endpoint is set, `Layer.empty` when it is not — instead of\n *   building a variable-length array and folding it with `Layer.merge`. `Layer<in ROut, …>`\n *   declares its success channel CONTRAVARIANT, and once a fold's accumulator needs an explicit\n *   annotation to type-check under this repo's `exactOptionalPropertyTypes`, TS's overload\n *   resolution for `Layer.provide`/`Layer.merge` starts inferring `unknown` for that channel and\n *   then fails `unknown` against `never` (measured 2026-09-26, TS2769). `Layer.mergeAll`'s own\n *   fixed-arity overload — the exact shape alchemy's own `Telemetry/Layer.ts` uses for its three\n *   signals — infers cleanly with no annotation at all.\n */\nexport const telemetryLayer = (options: TelemetryOptions): Layer.Layer<never> => {\n  const { traces, logs, metrics } = options.endpoints;\n  if (traces === undefined && logs === undefined && metrics === undefined) return Layer.empty;\n  // Default declared here, not in the options' type, so every call site above stays a concrete\n  // `Duration.Input` — `exactOptionalPropertyTypes` rejects passing `undefined` through to the\n  // OTLP layers' own `exportInterval?: Duration.Input` (no `| undefined` in their signatures).\n  const exportInterval: Duration.Input = options.exportInterval ?? '1 second';\n  const tracer = traces === undefined ? Layer.empty : tracerLayer(traces, options, exportInterval);\n  const logger = logs === undefined ? Layer.empty : loggerLayer(logs, options, exportInterval);\n  const meter =\n    metrics === undefined\n      ? Layer.empty\n      : OtlpMetrics.layer({ exportInterval, resource: resourceOf(options), url: metrics });\n  return Layer.mergeAll(tracer, logger, meter).pipe(\n    Layer.provide(redactedSerialization(options.redaction ?? {})),\n    Layer.provide(FetchHttpClient.layer),\n  );\n};\n",
+    "/**\n * Free-text OTLP redaction applied at `OtlpSerialization` — the ONE place every span/log field\n * reaches the wire, right before HTTP body encoding. `redact.ts`'s `wrapTracer` only sees what a\n * caller passes to `Span.attribute()`/`Span.event()`; two real fields never go through either hook:\n *\n * - `status.message` and the `exception.*` event attributes `OtlpTracer`'s own `makeOtlpSpan` builds\n *   from `Cause.prettyErrors(exit.cause)` — computed at export time, inside effect's tracer, AFTER\n *   `wrapTracer.end()` has already handed the exit straight to `real.end()`.\n * - a log line inside a span, turned into a span event by effect's default `tracerLogger` — the log\n *   message becomes the event NAME (not an attribute `wrapTracer.event()` redacts), and its\n *   `effect.cause` attribute is free text `redactAttribute`'s key-based rules never recognize.\n *\n * Redteam finding (PR 302, 2026-09-26): a provider GET that 404'd exported `exception.message =\n * \"... 404 GET http://host/secret-site-abc123/probe?token=SECRET123\"` unredacted — the query, the\n * denylisted path segment and the denylisted host all went out. A `logWarning` inside a span leaked\n * the same way through the event name.\n *\n * ⚠️ SUBSTRING MATCH, NOT SEGMENT MATCH. `redactAttribute` compares a denylist entry against a whole\n *   `/`-bounded URL segment on purpose (`redact.ts`'s own ⚠️: `\"db\"` must not blank `\"db1.example.\n *   test\"`). Free text has no segment boundaries — a log message or a formatted `Cause` embeds a\n *   token in prose — so `scrubText` matches a denylist entry as a literal substring ANYWHERE in the\n *   string. This is strictly broader than the structured rules, so it also closes the `server.\n *   address` bare-hostname and legacy `http.url` gaps (redteam MINOR item 5) as a side effect: a\n *   denylisted hostname is a substring match wherever it appears, URL-shaped or not. The tradeoff a\n *   caller accepts by naming a short, common word in `denylist` is over-redaction, never a leak.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Layer from 'effect/Layer';\nimport { OtlpSerialization } from 'effect/observability';\nimport type { OtlpLogger, OtlpResource, OtlpTracer } from 'effect/observability';\nimport { REDACTED, type RedactionPolicy } from './redact.ts';\n\nconst URL_PATTERN = /https?:\\/\\/[^\\s\"'<>)]+/g;\n\n/** Strips an embedded URL's query/hash and blanks its denylisted host/path segments — `redact.ts`'s\n * `url.full` case, reused here because a URL can appear inside prose, not just as its own attribute. */\nconst scrubUrl = (raw: string, denylist: ReadonlySet<string>): string => {\n  try {\n    const url = new URL(raw);\n    const host = denylist.has(url.hostname) ? REDACTED : url.host;\n    const path = url.pathname\n      .split('/')\n      .map((segment) => (denylist.has(segment) ? REDACTED : segment))\n      .join('/');\n    return `${url.protocol}//${host}${path}`;\n  } catch {\n    return raw; // Matched the URL_PATTERN regex but `URL` still rejects it — leave verbatim.\n  }\n};\n\n/** Redacts one piece of free text: every embedded URL loses its query string and denylisted\n * segments, then every denylist entry is blanked as a substring anywhere else in the text. */\nexport const scrubText = (text: string, policy: RedactionPolicy): string => {\n  const denylist = policy.denylist ?? [];\n  const denylistSet = new Set(denylist);\n  let out = text.replace(URL_PATTERN, (match) => scrubUrl(match, denylistSet));\n  for (const token of denylist) {\n    if (token.length === 0) continue; // an empty entry would blank every character boundary\n    out = out.split(token).join(REDACTED);\n  }\n  return out;\n};\n\n/** Walks one OTLP `AnyValue`'s string leaves (`stringValue`, and recursively through `arrayValue`/\n * `kvlistValue`) — the union effect's OTLP encoders use for every attribute and log body value. */\nconst scrubValue = (\n  value: OtlpResource.AnyValue,\n  policy: RedactionPolicy,\n): OtlpResource.AnyValue => {\n  if (typeof value.stringValue === 'string')\n    return { ...value, stringValue: scrubText(value.stringValue, policy) };\n  if (value.arrayValue !== undefined) {\n    return {\n      ...value,\n      arrayValue: { values: value.arrayValue.values.map((v) => scrubValue(v, policy)) },\n    };\n  }\n  if (value.kvlistValue !== undefined) {\n    return {\n      ...value,\n      kvlistValue: {\n        values: value.kvlistValue.values.map((kv) => ({\n          key: kv.key,\n          value: scrubValue(kv.value, policy),\n        })),\n      },\n    };\n  }\n  return value; // boolValue / intValue / doubleValue / bytesValue — never free text.\n};\n\nconst scrubKeyValues = (\n  attributes: ReadonlyArray<OtlpResource.KeyValue>,\n  policy: RedactionPolicy,\n): Array<OtlpResource.KeyValue> =>\n  attributes.map((kv) => ({ key: kv.key, value: scrubValue(kv.value, policy) }));\n\n/** `TraceData` after every span's name, attributes, events (including the `exception.*` ones\n * `makeOtlpSpan` builds from the exit), status message and link attributes have been scrubbed. */\nexport const redactTraceData = (\n  data: OtlpTracer.TraceData,\n  policy: RedactionPolicy,\n): OtlpTracer.TraceData => ({\n  resourceSpans: data.resourceSpans.map((resourceSpan) => ({\n    ...resourceSpan,\n    scopeSpans: resourceSpan.scopeSpans.map((scopeSpan) => ({\n      ...scopeSpan,\n      spans: scopeSpan.spans.map((span) => ({\n        ...span,\n        attributes: scrubKeyValues(span.attributes, policy),\n        events: span.events.map((event) => ({\n          ...event,\n          attributes: scrubKeyValues(event.attributes, policy),\n          name: scrubText(event.name, policy),\n        })),\n        links: span.links.map((link) => ({\n          ...link,\n          attributes: scrubKeyValues(link.attributes, policy),\n        })),\n        name: scrubText(span.name, policy),\n        status:\n          span.status.message === undefined\n            ? span.status\n            : { ...span.status, message: scrubText(span.status.message, policy) },\n      })),\n    })),\n  })),\n});\n\ntype LogRecord = NonNullable<\n  OtlpLogger.LogsData['resourceLogs'][number]['scopeLogs'][number]['logRecords']\n>[number];\n\n// ⚠️ `exactOptionalPropertyTypes` — `body` is `AnyValue?` with no `| undefined` in its own\n//   signature (matches `layer.ts`'s own `resourceOf` note), so an absent one is OMITTED, not set to\n//   `undefined`, or this object-literal return fails to type-check against `ILogRecord`.\nconst scrubLogRecord = (record: LogRecord, policy: RedactionPolicy): LogRecord => ({\n  ...record,\n  attributes: scrubKeyValues(record.attributes, policy),\n  ...(record.body !== undefined ? { body: scrubValue(record.body, policy) } : {}),\n});\n\n/** `LogsData` after every log record's attributes and body have been scrubbed — the fix for redteam\n * item 4's \"logs ship unredacted\": `log.error` (`Cause.pretty`) and the message body are free text. */\nexport const redactLogsData = (\n  data: OtlpLogger.LogsData,\n  policy: RedactionPolicy,\n): OtlpLogger.LogsData => ({\n  resourceLogs: data.resourceLogs.map((resourceLog) => ({\n    ...resourceLog,\n    scopeLogs: resourceLog.scopeLogs.map((scopeLog) => ({\n      ...scopeLog,\n      // Same `exactOptionalPropertyTypes` reasoning as `scrubLogRecord` — omit `logRecords`\n      // entirely rather than assign it `undefined` when the source had none.\n      ...(scopeLog.logRecords !== undefined\n        ? { logRecords: scopeLog.logRecords.map((record) => scrubLogRecord(record, policy)) }\n        : {}),\n    })),\n  })),\n});\n\n/**\n * Wraps the real `OtlpSerialization` so `telemetryLayer` gets this free-text pass on every signal\n * with no separate wiring at each call site — `layer.ts` provides this in place of a bare\n * `OtlpSerialization.layerProtobuf`. Metrics pass through untouched: they carry numeric data points\n * keyed by `Metric.Metric.AttributeSet`, not provider-supplied free text.\n */\nexport const redactedSerialization = (\n  policy: RedactionPolicy,\n): Layer.Layer<OtlpSerialization.OtlpSerialization> =>\n  Layer.effect(\n    OtlpSerialization.OtlpSerialization,\n    Effect.map(OtlpSerialization.OtlpSerialization, (inner) => ({\n      logs: (data: OtlpLogger.LogsData) => inner.logs(redactLogsData(data, policy)),\n      metrics: inner.metrics,\n      traces: (data: OtlpTracer.TraceData) => inner.traces(redactTraceData(data, policy)),\n    })),\n  ).pipe(Layer.provide(OtlpSerialization.layerProtobuf));\n",
     "/**\n * URL/header redaction for outgoing spans — applied at the `Tracer.Tracer` boundary so it holds for\n * EVERY span source (a provider's own `Effect.withSpan`, effect's `HttpClient` client spans, and\n * alchemy's own plan/apply/resource spans), not just the ones a caller remembers to annotate.\n *\n * ★ WHY THE TRACER, NOT AN HTTPCLIENT MIDDLEWARE. effect's `HttpClient.make` (src/unstable/http/\n *   HttpClient.ts) hard-codes `span.attribute(\"url.full\", …)`, `\"url.query\"` and\n *   `http.request.header.<name>` on the span it creates — there is no hook to stop it recording\n *   them. The one seam every span (HttpClient's included) passes through is `Tracer.span()`\n *   returning a `Tracer.Span`, so `wrapTracer` intercepts `Span.attribute()` there instead.\n * ⛔ NEVER RECORD HEADERS. A header NAME can itself be sensitive (`x-api-key`, a session cookie\n *   name), so every `http.{request,response}.header.*` key is DROPPED, not value-redacted.\n * ⚠️ QUERY STRINGS ARE STRIPPED WHOLE, not redacted per-parameter: an allowlist of \"safe\" params\n *   would silently leak the next secret param a provider adds. `url.query` is dropped outright and\n *   `url.full`/`url.path` never carry a `?…` past this point.\n */\nimport type * as Tracer from 'effect/Tracer';\n\n/** Host or path segments to blank wherever they appear in a URL attribute — exact-segment match. */\nexport interface RedactionPolicy {\n  /**\n   * e.g. a UniFi console id embedded in a path (`/proxy/network/api/site/<id>/...`) or a private\n   * hostname a consumer never wants leaving its own process. Compared against the full hostname and\n   * against each `/`-separated path segment — never a substring match, so `\"db\"` cannot accidentally\n   * blank `\"db1.example.test\"`.\n   */\n  readonly denylist?: ReadonlyArray<string>;\n}\n\nexport const REDACTED = '<redacted>';\n\n/** Returned by `redactAttribute` to mean \"drop this attribute entirely — do not forward it\". */\nexport const DROP: unique symbol = Symbol.for('homeflare/alchemy/telemetry/drop-attribute');\n\nconst HEADER_ATTRIBUTE = /^http\\.(?:request|response)\\.header\\./;\n\nconst redactSegments = (value: string, denylist: ReadonlySet<string>): string =>\n  value\n    .split('/')\n    .map((segment) => (denylist.has(segment) ? REDACTED : segment))\n    .join('/');\n\n/**\n * Applies `policy` to one span attribute. Returns `DROP` when the key must never be recorded at\n * all (every header); otherwise returns the value to record, with URLs stripped of their query\n * string and hash and their denylisted host/path segments blanked. A value this function does not\n * recognize (not a URL-shaped key, or not a string) passes through unchanged — alchemy's own\n * engine attributes (`resource.fqn`, `plan.action`, …) are never URLs and are never touched.\n */\nexport const redactAttribute = (key: string, value: unknown, policy: RedactionPolicy): unknown => {\n  if (HEADER_ATTRIBUTE.test(key)) return DROP;\n  if (key === 'url.query') return DROP;\n  if (typeof value !== 'string') return value;\n  const denylist = new Set(policy.denylist ?? []);\n  if (denylist.size === 0 && key !== 'url.full' && key !== 'server.address') return value;\n  // ⚠️ MEASURED 2026-09-26 (docs/telemetry-spike.md): effect's own `HttpClient.make` sets\n  //   `server.address` to `url.origin` (`http://host:port`), NOT a bare hostname — a denylist entry\n  //   naming just a hostname would never match the raw value, so this parses it out the same way\n  //   `url.full` does.\n  // ⛔ FIX (redteam PR 302 MINOR item 5, 2026-09-26): the OTel semantic convention's own default for\n  //   `server.address` IS a bare hostname with no scheme (`new URL(value)` throws on that), and other\n  //   instrumentation could emit exactly that even though effect's `HttpClient` doesn't today —\n  //   `redactAttribute('server.address', 'db1.example.test', { denylist: ['db1.example.test'] })`\n  //   returned the value verbatim before this fallback. Compare the raw string directly when it\n  //   isn't a parseable URL, instead of giving up.\n  if (key === 'server.address') {\n    try {\n      const url = new URL(value);\n      return denylist.has(url.hostname) ? REDACTED : value;\n    } catch {\n      return denylist.has(value) ? REDACTED : value;\n    }\n  }\n  if (key === 'url.path') return redactSegments(value, denylist);\n  if (key === 'url.full') {\n    try {\n      const url = new URL(value);\n      const host = denylist.has(url.hostname) ? REDACTED : url.host;\n      return `${url.protocol}//${host}${redactSegments(url.pathname, denylist)}`;\n    } catch {\n      // Not a URL we can parse (a relative path effect couldn't resolve) — leave it verbatim\n      // rather than guess; `url.full` is the one HttpClient always sets from a resolved `URL`, so\n      // this branch is a defensive fallback, not the expected path.\n      return value;\n    }\n  }\n  return value;\n};\n\nconst redactAttributes = (\n  attributes: Record<string, unknown>,\n  policy: RedactionPolicy,\n): Record<string, unknown> => {\n  const out: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(attributes)) {\n    const redacted = redactAttribute(key, value, policy);\n    if (redacted !== DROP) out[key] = redacted;\n  }\n  return out;\n};\n\n/**\n * Wraps a `Tracer.Tracer` so every span it creates redacts its attributes and event attributes\n * through `redactAttribute`/`redactAttributes` before they reach the real span (and therefore\n * before OTLP serialization ever sees them). Everything else — timing, status, links, the span's\n * own identity — passes straight through to `inner`.\n */\nexport const wrapTracer = (inner: Tracer.Tracer, policy: RedactionPolicy): Tracer.Tracer => ({\n  context: inner.context,\n  span(options): Tracer.Span {\n    const real = inner.span(options);\n    return {\n      _tag: 'Span',\n      spanId: real.spanId,\n      traceId: real.traceId,\n      parent: real.parent,\n      annotations: real.annotations,\n      get name() {\n        return real.name;\n      },\n      get status() {\n        return real.status;\n      },\n      get attributes() {\n        return real.attributes;\n      },\n      get links() {\n        return real.links;\n      },\n      sampled: real.sampled,\n      kind: real.kind,\n      end: (endTime, exit) => {\n        real.end(endTime, exit);\n      },\n      attribute: (key, value) => {\n        const redacted = redactAttribute(key, value, policy);\n        if (redacted !== DROP) real.attribute(key, redacted);\n      },\n      event: (name, startTime, attributes) => {\n        real.event(name, startTime, attributes ? redactAttributes(attributes, policy) : attributes);\n      },\n      addLinks: (links) => {\n        real.addLinks(links);\n      },\n    };\n  },\n});\n"
   ],
   "mappings": ";AA+BA;AACA;AACA;AACA;AACA;AACA;AACA;;;ACXA;AACA;AACA;;;ACCO,IAAM,WAAW;AAGjB,IAAM,OAAsB,OAAO,IAAI,4CAA4C;AAE1F,IAAM,mBAAmB;AAEzB,IAAM,iBAAiB,CAAC,OAAe,aACrC,MACG,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,SAAS,IAAI,OAAO,IAAI,WAAW,OAAQ,EAC7D,KAAK,GAAG;AASN,IAAM,kBAAkB,CAAC,KAAa,OAAgB,WAAqC;AAAA,EAChG,IAAI,iBAAiB,KAAK,GAAG;AAAA,IAAG,OAAO;AAAA,EACvC,IAAI,QAAQ;AAAA,IAAa,OAAO;AAAA,EAChC,IAAI,OAAO,UAAU;AAAA,IAAU,OAAO;AAAA,EACtC,MAAM,WAAW,IAAI,IAAI,OAAO,YAAY,CAAC,CAAC;AAAA,EAC9C,IAAI,SAAS,SAAS,KAAK,QAAQ,cAAc,QAAQ;AAAA,IAAkB,OAAO;AAAA,EAWlF,IAAI,QAAQ,kBAAkB;AAAA,IAC5B,IAAI;AAAA,MACF,MAAM,MAAM,IAAI,IAAI,KAAK;AAAA,MACzB,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW;AAAA,MAC/C,MAAM;AAAA,MACN,OAAO,SAAS,IAAI,KAAK,IAAI,WAAW;AAAA;AAAA,EAE5C;AAAA,EACA,IAAI,QAAQ;AAAA,IAAY,OAAO,eAAe,OAAO,QAAQ;AAAA,EAC7D,IAAI,QAAQ,YAAY;AAAA,IACtB,IAAI;AAAA,MACF,MAAM,MAAM,IAAI,IAAI,KAAK;AAAA,MACzB,MAAM,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW,IAAI;AAAA,MACzD,OAAO,GAAG,IAAI,aAAa,OAAO,eAAe,IAAI,UAAU,QAAQ;AAAA,MACvE,MAAM;AAAA,MAIN,OAAO;AAAA;AAAA,EAEX;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,mBAAmB,CACvB,YACA,WAC4B;AAAA,EAC5B,MAAM,MAA+B,CAAC;AAAA,EACtC,YAAY,KAAK,UAAU,OAAO,QAAQ,UAAU,GAAG;AAAA,IACrD,MAAM,WAAW,gBAAgB,KAAK,OAAO,MAAM;AAAA,IACnD,IAAI,aAAa;AAAA,MAAM,IAAI,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AASF,IAAM,aAAa,CAAC,OAAsB,YAA4C;AAAA,EAC3F,SAAS,MAAM;AAAA,EACf,IAAI,CAAC,SAAsB;AAAA,IACzB,MAAM,OAAO,MAAM,KAAK,OAAO;AAAA,IAC/B,OAAO;AAAA,MACL,MAAM;AAAA,MACN,QAAQ,KAAK;AAAA,MACb,SAAS,KAAK;AAAA,MACd,QAAQ,KAAK;AAAA,MACb,aAAa,KAAK;AAAA,UACd,IAAI,GAAG;AAAA,QACT,OAAO,KAAK;AAAA;AAAA,UAEV,MAAM,GAAG;AAAA,QACX,OAAO,KAAK;AAAA;AAAA,UAEV,UAAU,GAAG;AAAA,QACf,OAAO,KAAK;AAAA;AAAA,UAEV,KAAK,GAAG;AAAA,QACV,OAAO,KAAK;AAAA;AAAA,MAEd,SAAS,KAAK;AAAA,MACd,MAAM,KAAK;AAAA,MACX,KAAK,CAAC,SAAS,SAAS;AAAA,QACtB,KAAK,IAAI,SAAS,IAAI;AAAA;AAAA,MAExB,WAAW,CAAC,KAAK,UAAU;AAAA,QACzB,MAAM,WAAW,gBAAgB,KAAK,OAAO,MAAM;AAAA,QACnD,IAAI,aAAa;AAAA,UAAM,KAAK,UAAU,KAAK,QAAQ;AAAA;AAAA,MAErD,OAAO,CAAC,MAAM,WAAW,eAAe;AAAA,QACtC,KAAK,MAAM,MAAM,WAAW,aAAa,iBAAiB,YAAY,MAAM,IAAI,UAAU;AAAA;AAAA,MAE5F,UAAU,CAAC,UAAU;AAAA,QACnB,KAAK,SAAS,KAAK;AAAA;AAAA,IAEvB;AAAA;AAEJ;;;ADlHA,IAAM,cAAc;AAIpB,IAAM,WAAW,CAAC,KAAa,aAA0C;AAAA,EACvE,IAAI;AAAA,IACF,MAAM,MAAM,IAAI,IAAI,GAAG;AAAA,IACvB,MAAM,OAAO,SAAS,IAAI,IAAI,QAAQ,IAAI,WAAW,IAAI;AAAA,IACzD,MAAM,OAAO,IAAI,SACd,MAAM,GAAG,EACT,IAAI,CAAC,YAAa,SAAS,IAAI,OAAO,IAAI,WAAW,OAAQ,EAC7D,KAAK,GAAG;AAAA,IACX,OAAO,GAAG,IAAI,aAAa,OAAO;AAAA,IAClC,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAMJ,IAAM,YAAY,CAAC,MAAc,WAAoC;AAAA,EAC1E,MAAM,WAAW,OAAO,YAAY,CAAC;AAAA,EACrC,MAAM,cAAc,IAAI,IAAI,QAAQ;AAAA,EACpC,IAAI,MAAM,KAAK,QAAQ,aAAa,CAAC,UAAU,SAAS,OAAO,WAAW,CAAC;AAAA,EAC3E,WAAW,SAAS,UAAU;AAAA,IAC5B,IAAI,MAAM,WAAW;AAAA,MAAG;AAAA,IACxB,MAAM,IAAI,MAAM,KAAK,EAAE,KAAK,QAAQ;AAAA,EACtC;AAAA,EACA,OAAO;AAAA;AAKT,IAAM,aAAa,CACjB,OACA,WAC0B;AAAA,EAC1B,IAAI,OAAO,MAAM,gBAAgB;AAAA,IAC/B,OAAO,KAAK,OAAO,aAAa,UAAU,MAAM,aAAa,MAAM,EAAE;AAAA,EACvE,IAAI,MAAM,eAAe,WAAW;AAAA,IAClC,OAAO;AAAA,SACF;AAAA,MACH,YAAY,EAAE,QAAQ,MAAM,WAAW,OAAO,IAAI,CAAC,MAAM,WAAW,GAAG,MAAM,CAAC,EAAE;AAAA,IAClF;AAAA,EACF;AAAA,EACA,IAAI,MAAM,gBAAgB,WAAW;AAAA,IACnC,OAAO;AAAA,SACF;AAAA,MACH,aAAa;AAAA,QACX,QAAQ,MAAM,YAAY,OAAO,IAAI,CAAC,QAAQ;AAAA,UAC5C,KAAK,GAAG;AAAA,UACR,OAAO,WAAW,GAAG,OAAO,MAAM;AAAA,QACpC,EAAE;AAAA,MACJ;AAAA,IACF;AAAA,EACF;AAAA,EACA,OAAO;AAAA;AAGT,IAAM,iBAAiB,CACrB,YACA,WAEA,WAAW,IAAI,CAAC,QAAQ,EAAE,KAAK,GAAG,KAAK,OAAO,WAAW,GAAG,OAAO,MAAM,EAAE,EAAE;AAIxE,IAAM,kBAAkB,CAC7B,MACA,YAC0B;AAAA,EAC1B,eAAe,KAAK,cAAc,IAAI,CAAC,kBAAkB;AAAA,OACpD;AAAA,IACH,YAAY,aAAa,WAAW,IAAI,CAAC,eAAe;AAAA,SACnD;AAAA,MACH,OAAO,UAAU,MAAM,IAAI,CAAC,UAAU;AAAA,WACjC;AAAA,QACH,YAAY,eAAe,KAAK,YAAY,MAAM;AAAA,QAClD,QAAQ,KAAK,OAAO,IAAI,CAAC,WAAW;AAAA,aAC/B;AAAA,UACH,YAAY,eAAe,MAAM,YAAY,MAAM;AAAA,UACnD,MAAM,UAAU,MAAM,MAAM,MAAM;AAAA,QACpC,EAAE;AAAA,QACF,OAAO,KAAK,MAAM,IAAI,CAAC,UAAU;AAAA,aAC5B;AAAA,UACH,YAAY,eAAe,KAAK,YAAY,MAAM;AAAA,QACpD,EAAE;AAAA,QACF,MAAM,UAAU,KAAK,MAAM,MAAM;AAAA,QACjC,QACE,KAAK,OAAO,YAAY,YACpB,KAAK,SACL,KAAK,KAAK,QAAQ,SAAS,UAAU,KAAK,OAAO,SAAS,MAAM,EAAE;AAAA,MAC1E,EAAE;AAAA,IACJ,EAAE;AAAA,EACJ,EAAE;AACJ;AASA,IAAM,iBAAiB,CAAC,QAAmB,YAAwC;AAAA,KAC9E;AAAA,EACH,YAAY,eAAe,OAAO,YAAY,MAAM;AAAA,KAChD,OAAO,SAAS,YAAY,EAAE,MAAM,WAAW,OAAO,MAAM,MAAM,EAAE,IAAI,CAAC;AAC/E;AAIO,IAAM,iBAAiB,CAC5B,MACA,YACyB;AAAA,EACzB,cAAc,KAAK,aAAa,IAAI,CAAC,iBAAiB;AAAA,OACjD;AAAA,IACH,WAAW,YAAY,UAAU,IAAI,CAAC,cAAc;AAAA,SAC/C;AAAA,SAGC,SAAS,eAAe,YACxB,EAAE,YAAY,SAAS,WAAW,IAAI,CAAC,WAAW,eAAe,QAAQ,MAAM,CAAC,EAAE,IAClF,CAAC;AAAA,IACP,EAAE;AAAA,EACJ,EAAE;AACJ;AAQO,IAAM,wBAAwB,CACnC,WAEM,aACJ,kBAAkB,mBACX,WAAI,kBAAkB,mBAAmB,CAAC,WAAW;AAAA,EAC1D,MAAM,CAAC,SAA8B,MAAM,KAAK,eAAe,MAAM,MAAM,CAAC;AAAA,EAC5E,SAAS,MAAM;AAAA,EACf,QAAQ,CAAC,SAA+B,MAAM,OAAO,gBAAgB,MAAM,MAAM,CAAC;AACpF,EAAE,CACJ,EAAE,KAAW,cAAQ,kBAAkB,aAAa,CAAC;;;ADhGvD,IAAM,aAAa,CAAC,aAA+B;AAAA,EACjD,aAAa,QAAQ;AAAA,KACjB,QAAQ,mBAAmB,YAAY,EAAE,gBAAgB,QAAQ,eAAe,IAAI,CAAC;AAAA,KACrF,QAAQ,uBAAuB,YAAY,EAAE,YAAY,QAAQ,mBAAmB,IAAI,CAAC;AAC/F;AAOA,IAAM,cAAc,CAAC,KAAa,SAA2B,mBACrD,cACG,eACA,YAAI,WAAW,KAAK,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UACnF,WAAW,OAAO,QAAQ,aAAa,CAAC,CAAC,CAC3C,CACF,EAAE,KAAW,oBAAa,aAAa,YAAY,CAAC;AAOtD,IAAM,cAAc,CAAC,KAAa,SAA2B,mBAAmC;AAAA,EAC9F,MAAM,QAAQ,QAAQ,oBAAoB;AAAA,EAC1C,OAAc,aACZ;AAAA,IACS,YAAI,WAAW,KAAK,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,UAC5E,YAAK,CAAC,WACF,gCAAuB,OAAO,UAAU,KAAK,IAAI,MAAM,IAAI,MAAM,IAAI,SAChF,CACF;AAAA,EACF,GACA,EAAE,mBAAmB,KAAK,CAC5B,EAAE,KAAW,oBAAa,aAAa,YAAY,CAAC;AAAA;AAkB/C,IAAM,iBAAiB,CAAC,YAAkD;AAAA,EAC/E,QAAQ,QAAQ,MAAM,YAAY,QAAQ;AAAA,EAC1C,IAAI,WAAW,aAAa,SAAS,aAAa,YAAY;AAAA,IAAW,OAAa;AAAA,EAItF,MAAM,iBAAiC,QAAQ,kBAAkB;AAAA,EACjE,MAAM,SAAS,WAAW,YAAkB,eAAQ,YAAY,QAAQ,SAAS,cAAc;AAAA,EAC/F,MAAM,SAAS,SAAS,YAAkB,eAAQ,YAAY,MAAM,SAAS,cAAc;AAAA,EAC3F,MAAM,QACJ,YAAY,YACF,eACN,YAAY,MAAM,EAAE,gBAAgB,UAAU,WAAW,OAAO,GAAG,KAAK,QAAQ,CAAC;AAAA,EACvF,OAAa,gBAAS,QAAQ,QAAQ,KAAK,EAAE,KACrC,eAAQ,sBAAsB,QAAQ,aAAa,CAAC,CAAC,CAAC,GACtD,eAAwB,qBAAK,CACrC;AAAA;",
-  "debugId": "D5C073A7ECCA33DE64756E2164756E21",
+  "debugId": "C3F43808EA1FDEEB64756E2164756E21",
   "names": []
 }

package/dist/telemetry/redact-serialization.d.ts

@@ -1,6 +1,6 @@
 import * as Layer from 'effect/Layer';
-import { OtlpSerialization } from 'effect/unstable/observability';
-import type { OtlpLogger, OtlpTracer } from 'effect/unstable/observability';
+import { OtlpSerialization } from 'effect/observability';
+import type { OtlpLogger, OtlpTracer } from 'effect/observability';
 import { type RedactionPolicy } from './redact.ts';
 /** Redacts one piece of free text: every embedded URL loses its query string and denylisted
  * segments, then every denylist entry is blanked as a substring anywhere else in the text. */

package/dist/telemetry/redact-serialization.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"redact-serialization.d.ts","sourceRoot":"","sources":["../../src/telemetry/redact-serialization.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,+BAA+B,CAAC;AAClE,OAAO,KAAK,EAAE,UAAU,EAAgB,UAAU,EAAE,MAAM,+BAA+B,CAAC;AAC1F,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB7D;8FAC8F;AAC9F,eAAO,MAAM,SAAS,SAAU,MAAM,UAAU,eAAe,KAAG,MASjE,CAAC;AAoCF;kGACkG;AAClG,eAAO,MAAM,eAAe,SACpB,UAAU,CAAC,SAAS,UAClB,eAAe,KACtB,UAAU,CAAC,SAyBZ,CAAC;AAeH;uGACuG;AACvG,eAAO,MAAM,cAAc,SACnB,UAAU,CAAC,QAAQ,UACjB,eAAe,KACtB,UAAU,CAAC,QAYZ,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WACxB,eAAe,KACtB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAQM,CAAC"}
+{"version":3,"file":"redact-serialization.d.ts","sourceRoot":"","sources":["../../src/telemetry/redact-serialization.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EAAE,iBAAiB,EAAE,MAAM,sBAAsB,CAAC;AACzD,OAAO,KAAK,EAAE,UAAU,EAAgB,UAAU,EAAE,MAAM,sBAAsB,CAAC;AACjF,OAAO,EAAY,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAoB7D;8FAC8F;AAC9F,eAAO,MAAM,SAAS,SAAU,MAAM,UAAU,eAAe,KAAG,MASjE,CAAC;AAoCF;kGACkG;AAClG,eAAO,MAAM,eAAe,SACpB,UAAU,CAAC,SAAS,UAClB,eAAe,KACtB,UAAU,CAAC,SAyBZ,CAAC;AAeH;uGACuG;AACvG,eAAO,MAAM,cAAc,SACnB,UAAU,CAAC,QAAQ,UACjB,eAAe,KACtB,UAAU,CAAC,QAYZ,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,WACxB,eAAe,KACtB,KAAK,CAAC,KAAK,CAAC,iBAAiB,CAAC,iBAAiB,CAQM,CAAC"}

package/dist/unifi/acl-rule-ordering.d.ts

@@ -26,7 +26,7 @@ export interface UnifiAclRuleOrdering extends Resource<'Unifi.AclRuleOrdering',
 }
 export declare const UnifiAclRuleOrdering: import("alchemy").ResourceClass<UnifiAclRuleOrdering>;
 /** `aclRuleOrdering('site-1', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
-export declare const aclRuleOrdering: (id: string, props: AclRuleOrderingProps) => Effect.Effect<UnifiAclRuleOrdering, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const aclRuleOrdering: (id: string, props: AclRuleOrderingProps) => Effect.Effect<UnifiAclRuleOrdering, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<AclRuleOrderingProps, aclRules.ACLRuleOrdering, AclRuleOrderingAttributes, aclRules.GetAclRuleOrderingError>;
 export declare const handlers: {
@@ -34,7 +34,7 @@ export declare const handlers: {
     read: (args: {
         olds: AclRuleOrderingProps;
         output: AclRuleOrderingAttributes | undefined;
-    }) => Effect.Effect<AclRuleOrderingAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleOrderingAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<AclRuleOrderingProps>;
         output: AclRuleOrderingAttributes | undefined;
@@ -42,13 +42,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: AclRuleOrderingProps;
-    }) => Effect.Effect<AclRuleOrderingAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleOrderingAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: AclRuleOrderingProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiAclRuleOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRuleOrdering>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiAclRuleOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRuleOrdering>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=acl-rule-ordering.d.ts.map

package/dist/unifi/acl-rule-ordering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl-rule-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAG1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAE/B,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,eAAe,OAAQ,MAAM,SAAS,oBAAoB,qGACpB,CAAC;AAEpD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,oBAAoB,EACpB,QAAQ,CAAC,eAAe,EACxB,yBAAyB,EACzB,QAAQ,CAAC,uBAAuB,CAUjC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,4BAA4B,0IAC0D,CAAC"}
+{"version":3,"file":"acl-rule-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EAG1B,MAAM,6BAA6B,CAAC;AACrC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,yBAAyB,EAAE,oBAAoB,EAAE,MAAM,6BAA6B,CAAC;AACnG,OAAO,EAAE,sBAAsB,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAE9E,MAAM,WAAW,oBAAqB,SAAQ,QAAQ,CACpD,uBAAuB,EACvB,oBAAoB,EACpB,yBAAyB,EACzB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,oBAAoB,uDAE/B,CAAC;AAEH,qGAAqG;AACrG,eAAO,MAAM,eAAe,OAAQ,MAAM,SAAS,oBAAoB,4FACpB,CAAC;AAEpD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,oBAAoB,EACpB,QAAQ,CAAC,eAAe,EACxB,yBAAyB,EACzB,QAAQ,CAAC,uBAAuB,CAUjC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,4BAA4B,iIAC0D,CAAC"}

package/dist/unifi/acl-rule.d.ts

@@ -21,7 +21,7 @@ export interface UnifiAclRule extends Resource<'Unifi.AclRule', AclRuleProps, Ac
 }
 export declare const UnifiAclRule: import("alchemy").ResourceClass<UnifiAclRule>;
 /** `aclRule('block-iot-wan', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
-export declare const aclRule: (id: string, props: AclRuleProps) => Effect.Effect<UnifiAclRule, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const aclRule: (id: string, props: AclRuleProps) => Effect.Effect<UnifiAclRule, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<AclRuleProps, aclRules.ACLRule, AclRuleAttributes, aclRules.GetAclRuleError>;
 export declare const handlers: {
@@ -29,7 +29,7 @@ export declare const handlers: {
     read: (args: {
         olds: AclRuleProps;
         output: AclRuleAttributes | undefined;
-    }) => Effect.Effect<AclRuleAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleAttributes | undefined, aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<AclRuleProps>;
         output: AclRuleAttributes | undefined;
@@ -37,13 +37,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: AclRuleProps;
-    }) => Effect.Effect<AclRuleAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleAttributes, import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: AclRuleProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiAclRuleProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRule>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiAclRuleProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiAclRule>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=acl-rule.d.ts.map

package/dist/unifi/acl-rule.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"acl-rule.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,oBAAoB,CAAC;AAE7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,6FACZ,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,iBAAiB,EACjB,QAAQ,CAAC,eAAe,CAUzB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"acl-rule.d.ts","sourceRoot":"","sources":["../../src/unifi/acl-rule.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yDAAyD,CAAC;AACpF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,oBAAoB,CAAC;AAE7F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACpD,OAAO,EAAE,OAAO,EAAE,MAAM,qBAAqB,CAAC;AAE9C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH,oGAAoG;AACpG,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,oFACZ,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,OAAO,EAChB,iBAAiB,EACjB,QAAQ,CAAC,eAAe,CAUzB,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,yHACkD,CAAC"}

package/dist/unifi/dns-policy.d.ts

@@ -27,7 +27,7 @@ export interface UnifiDnsPolicy extends Resource<'Unifi.DnsPolicy', DnsPolicyPro
 }
 export declare const UnifiDnsPolicy: import("alchemy").ResourceClass<UnifiDnsPolicy>;
 /** `dnsPolicy('lan-forwarding', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
-export declare const dnsPolicy: (id: string, props: DnsPolicyProps) => Effect.Effect<UnifiDnsPolicy, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const dnsPolicy: (id: string, props: DnsPolicyProps) => Effect.Effect<UnifiDnsPolicy, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<DnsPolicyProps, dnsPolicies.DNSPolicy, DnsPolicyAttributes, dnsPolicies.GetDnsPolicyError>;
 export declare const handlers: {
@@ -35,7 +35,7 @@ export declare const handlers: {
     read: (args: {
         olds: DnsPolicyProps;
         output: DnsPolicyAttributes | undefined;
-    }) => Effect.Effect<DnsPolicyAttributes | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<DnsPolicyAttributes | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<DnsPolicyProps>;
         output: DnsPolicyAttributes | undefined;
@@ -43,13 +43,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, dnsPolicies.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: DnsPolicyProps;
-    }) => Effect.Effect<DnsPolicyAttributes, import("./policy.ts").UnifiWriteRefused | dnsPolicies.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<DnsPolicyAttributes, import("./policy.ts").UnifiWriteRefused | dnsPolicies.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: DnsPolicyProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiDnsPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiDnsPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiDnsPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiDnsPolicy>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=dns-policy.d.ts.map

package/dist/unifi/dns-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"dns-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/dns-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,WAAW,MAAM,6CAA6C,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAEnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,uGAAuG;AACvG,eAAO,MAAM,SAAS,OAAQ,MAAM,SAAS,cAAc,+FACd,CAAC;AAE9C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,cAAc,EACd,WAAW,CAAC,SAAS,EACrB,mBAAmB,EACnB,WAAW,CAAC,iBAAiB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,sBAAsB,oIACoD,CAAC"}
+{"version":3,"file":"dns-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/dns-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,WAAW,MAAM,6CAA6C,CAAC;AAC3E,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,mBAAmB,EAAE,KAAK,cAAc,EAAgB,MAAM,sBAAsB,CAAC;AAEnG,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,mBAAmB,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AAChF,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,MAAM,uBAAuB,CAAC;AAEhD,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,cAAc,EACd,mBAAmB,EACnB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH,uGAAuG;AACvG,eAAO,MAAM,SAAS,OAAQ,MAAM,SAAS,cAAc,sFACd,CAAC;AAE9C,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,cAAc,EACd,WAAW,CAAC,SAAS,EACrB,mBAAmB,EACnB,WAAW,CAAC,iBAAiB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,sBAAsB,2HACoD,CAAC"}

package/dist/unifi/fake-unifi.d.ts

@@ -48,5 +48,5 @@ export declare const fakeUnifi: (route: (method: string, url: URL) => Response)
  *   (the same seam `netbox/fake-netbox.ts` documents). Tests call `spec.fetchLive`/`spec.attributes`
  *   directly instead, with this explicit layer.
  */
-export declare const fakeUnifiLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/unstable/http/HttpClient").HttpClient, never, never>;
+export declare const fakeUnifiLayer: (fetchFn: typeof globalThis.fetch, creds?: Layer.Layer<Credentials>) => Layer.Layer<Credentials | import("effect/http/HttpClient").HttpClient, never, never>;
 //# sourceMappingURL=fake-unifi.d.ts.map

package/dist/unifi/fake-unifi.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-unifi.d.ts","sourceRoot":"","sources":["../../src/unifi/fake-unifi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,SAAS,wDAAwD,CAAC;AAC/E,eAAO,MAAM,QAAQ,0BAA0B,CAAC;AAEhD,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,UAAU,MAAM,aAAqC,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;;;CAUtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAChB,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,kGAC+D,CAAC"}
+{"version":3,"file":"fake-unifi.d.ts","sourceRoot":"","sources":["../../src/unifi/fake-unifi.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,KAAK,WAAW,EAAe,MAAM,4CAA4C,CAAC;AAC3F,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAGtC,eAAO,MAAM,SAAS,wDAAwD,CAAC;AAC/E,eAAO,MAAM,QAAQ,0BAA0B,CAAC;AAEhD,MAAM,MAAM,IAAI,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtE;;;;GAIG;AACH,eAAO,MAAM,WAAW,WAAY,MAAM,UAAU,MAAM,aAAqC,CAAC;AAEhG;;;;;;;;;GASG;AACH,eAAO,MAAM,SAAS,UAAW,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ;;;CAUtE,CAAC;AAEF;;;;;;;;;GASG;AACH,eAAO,MAAM,cAAc,YAChB,OAAO,UAAU,CAAC,KAAK,UACzB,KAAK,CAAC,KAAK,CAAC,WAAW,CAAC,yFAC+D,CAAC"}

package/dist/unifi/firewall-policy-ordering.d.ts

@@ -29,7 +29,7 @@ export interface UnifiFirewallPolicyOrdering extends Resource<'Unifi.FirewallPol
 export declare const UnifiFirewallPolicyOrdering: import("alchemy").ResourceClass<UnifiFirewallPolicyOrdering>;
 /** `firewallPolicyOrdering('iot-to-external', props)` — `adopt(true)` piped on by default (H5); see
  *  `network.ts`. */
-export declare const firewallPolicyOrdering: (id: string, props: FirewallPolicyOrderingProps) => Effect.Effect<UnifiFirewallPolicyOrdering, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const firewallPolicyOrdering: (id: string, props: FirewallPolicyOrderingProps) => Effect.Effect<UnifiFirewallPolicyOrdering, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<FirewallPolicyOrderingProps, firewall.IntegrationFirewallPolicyOrderingDto, FirewallPolicyOrderingAttributes, firewall.GetFirewallPolicyOrderingError>;
 export declare const handlers: {
@@ -37,7 +37,7 @@ export declare const handlers: {
     read: (args: {
         olds: FirewallPolicyOrderingProps;
         output: FirewallPolicyOrderingAttributes | undefined;
-    }) => Effect.Effect<FirewallPolicyOrderingAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyOrderingAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<FirewallPolicyOrderingProps>;
         output: FirewallPolicyOrderingAttributes | undefined;
@@ -45,13 +45,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: FirewallPolicyOrderingProps;
-    }) => Effect.Effect<FirewallPolicyOrderingAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyOrderingAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallPolicyOrderingProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiFirewallPolicyOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicyOrdering>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiFirewallPolicyOrderingProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicyOrdering>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=firewall-policy-ordering.d.ts.map

package/dist/unifi/firewall-policy-ordering.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAGjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAE5F,MAAM,WAAW,2BAA4B,SAAQ,QAAQ,CAC3D,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,2BAA2B,8DAGvC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,sBAAsB,OAAQ,MAAM,SAAS,2BAA2B,4GAC3B,CAAC;AAE3D,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,2BAA2B,EAC3B,QAAQ,CAAC,oCAAoC,EAC7C,gCAAgC,EAChC,QAAQ,CAAC,8BAA8B,CAiBxC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,mCAAmC,iJAI7C,CAAC"}
+{"version":3,"file":"firewall-policy-ordering.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-ordering.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAGjC,MAAM,oCAAoC,CAAC;AAC5C,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,gCAAgC,EAChC,2BAA2B,GAC5B,MAAM,oCAAoC,CAAC;AAC5C,OAAO,EAAE,6BAA6B,EAAE,OAAO,EAAE,MAAM,oCAAoC,CAAC;AAE5F,MAAM,WAAW,2BAA4B,SAAQ,QAAQ,CAC3D,8BAA8B,EAC9B,2BAA2B,EAC3B,gCAAgC,EAChC,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,2BAA2B,8DAGvC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,sBAAsB,OAAQ,MAAM,SAAS,2BAA2B,mGAC3B,CAAC;AAE3D,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,2BAA2B,EAC3B,QAAQ,CAAC,oCAAoC,EAC7C,gCAAgC,EAChC,QAAQ,CAAC,8BAA8B,CAiBxC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,mCAAmC,wIAI7C,CAAC"}

package/dist/unifi/firewall-policy.d.ts

@@ -29,7 +29,7 @@ export interface UnifiFirewallPolicy extends Resource<'Unifi.FirewallPolicy', Fi
 export declare const UnifiFirewallPolicy: import("alchemy").ResourceClass<UnifiFirewallPolicy>;
 /** `firewallPolicy('block-iot-wan', props)` — `adopt(true)` piped on by default (H5); see
  *  `network.ts`. */
-export declare const firewallPolicy: (id: string, props: FirewallPolicyProps) => Effect.Effect<UnifiFirewallPolicy, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const firewallPolicy: (id: string, props: FirewallPolicyProps) => Effect.Effect<UnifiFirewallPolicy, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<FirewallPolicyProps, firewall.FirewallPolicy, FirewallPolicyAttributes, firewall.GetFirewallPolicyError>;
 export declare const handlers: {
@@ -37,7 +37,7 @@ export declare const handlers: {
     read: (args: {
         olds: FirewallPolicyProps;
         output: FirewallPolicyAttributes | undefined;
-    }) => Effect.Effect<FirewallPolicyAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<FirewallPolicyProps>;
         output: FirewallPolicyAttributes | undefined;
@@ -45,13 +45,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: FirewallPolicyProps;
-    }) => Effect.Effect<FirewallPolicyAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallPolicyProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiFirewallPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicy>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiFirewallPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicy>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=firewall-policy.d.ts.map

package/dist/unifi/firewall-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAE9B,CAAC;AAEH;oBACoB;AACpB,eAAO,MAAM,cAAc,OAAQ,MAAM,SAAS,mBAAmB,oGACnB,CAAC;AAEnD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,mBAAmB,EACnB,QAAQ,CAAC,cAAc,EACvB,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,2BAA2B,yIACyD,CAAC"}
+{"version":3,"file":"firewall-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAE9B,CAAC;AAEH;oBACoB;AACpB,eAAO,MAAM,cAAc,OAAQ,MAAM,SAAS,mBAAmB,2FACnB,CAAC;AAEnD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,mBAAmB,EACnB,QAAQ,CAAC,cAAc,EACvB,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,2BAA2B,gIACyD,CAAC"}

package/dist/unifi/firewall-zone.d.ts

@@ -22,7 +22,7 @@ export interface UnifiFirewallZone extends Resource<'Unifi.FirewallZone', Firewa
 }
 export declare const UnifiFirewallZone: import("alchemy").ResourceClass<UnifiFirewallZone>;
 /** `firewallZone('lan', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
-export declare const firewallZone: (id: string, props: FirewallZoneProps) => Effect.Effect<UnifiFirewallZone, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const firewallZone: (id: string, props: FirewallZoneProps) => Effect.Effect<UnifiFirewallZone, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<FirewallZoneProps, firewall.FirewallZone, FirewallZoneAttributes, firewall.GetFirewallZoneError>;
 export declare const handlers: {
@@ -30,7 +30,7 @@ export declare const handlers: {
     read: (args: {
         olds: FirewallZoneProps;
         output: FirewallZoneAttributes | undefined;
-    }) => Effect.Effect<FirewallZoneAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallZoneAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<FirewallZoneProps>;
         output: FirewallZoneAttributes | undefined;
@@ -38,13 +38,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: FirewallZoneProps;
-    }) => Effect.Effect<FirewallZoneAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallZoneAttributes, import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallZoneProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiFirewallZoneProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallZone>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiFirewallZoneProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallZone>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=firewall-zone.d.ts.map

package/dist/unifi/firewall-zone.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-zone.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,YAAY,OAAQ,MAAM,SAAS,iBAAiB,kGACjB,CAAC;AAEjD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,iBAAiB,EACjB,QAAQ,CAAC,YAAY,EACrB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,yBAAyB,uIACuD,CAAC"}
+{"version":3,"file":"firewall-zone.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-zone.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAGvB,MAAM,yBAAyB,CAAC;AACjC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,yBAAyB,CAAC;AACzF,OAAO,EAAE,mBAAmB,EAAE,OAAO,EAAE,MAAM,yBAAyB,CAAC;AAEvE,MAAM,WAAW,iBAAkB,SAAQ,QAAQ,CACjD,oBAAoB,EACpB,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,iBAAiB,oDAE5B,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,YAAY,OAAQ,MAAM,SAAS,iBAAiB,yFACjB,CAAC;AAEjD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,iBAAiB,EACjB,QAAQ,CAAC,YAAY,EACrB,sBAAsB,EACtB,QAAQ,CAAC,oBAAoB,CAU9B,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,yBAAyB,8HACuD,CAAC"}

package/dist/unifi/index.js

@@ -14,7 +14,7 @@ import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import { CredentialsFromEnv } from "@distilled.cloud/unifi-network/Credentials";
 import * as Effect2 from "effect/Effect";
-import * as HttpClient from "effect/unstable/http/HttpClient";
+import * as HttpClient from "effect/http/HttpClient";
 var unifiOperations = (spec) => {
   const read = (props) => spec.fetchLive(props).pipe(Effect2.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
   return {
@@ -851,5 +851,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=8F60CB2F43A8D0E164756E2164756E21
+//# debugId=5A3AB5CE8957273E64756E2164756E21
 //# sourceMappingURL=index.js.map