@homeflare/alchemy 0.46.1 → 0.47.1

package/dist/unifi/index.js.map

@@ -3,7 +3,7 @@
   "sources": ["../src/unifi/policy.ts", "../src/unifi/resource.ts", "../src/unifi/network.ts", "../src/unifi/network-form.ts", "../src/unifi/drift.ts", "../src/unifi/network-drift.ts", "../src/unifi/firewall-zone.ts", "../src/unifi/firewall-zone-form.ts", "../src/unifi/dns-policy.ts", "../src/unifi/dns-policy-form.ts", "../src/unifi/dns-policy-drift.ts", "../src/unifi/acl-rule.ts", "../src/unifi/acl-rule-form.ts", "../src/unifi/acl-rule-drift.ts", "../src/unifi/acl-rule-ordering.ts", "../src/unifi/acl-rule-ordering-form.ts", "../src/unifi/wifi-broadcast.ts", "../src/unifi/wifi-broadcast-form.ts", "../src/unifi/wifi-broadcast-drift.ts", "../src/unifi/paginate.ts", "../src/unifi/firewall-policy.ts", "../src/unifi/firewall-policy-form.ts", "../src/unifi/firewall-policy-drift.ts", "../src/unifi/firewall-policy-ordering.ts", "../src/unifi/firewall-policy-ordering-form.ts", "../src/unifi/traffic-matching-list.ts", "../src/unifi/traffic-matching-list-form.ts", "../src/unifi/traffic-matching-list-drift.ts", "../src/unifi/providers.ts"],
   "sourcesContent": [
     "/**\n * The one refusal every `Unifi.*` write handler returns — never an SDK write call.\n *\n * ⛔ TIM'S RULE, 2026-09-24: UniFi (and OPNsense) are READ-ONLY FOR NOW. This family has no\n *   `create`, no `update` body and no delete call anywhere in its source — `reconcile` and\n *   `delete` both fail with this typed error instead, and `resource.test.ts` proves the point\n *   with a fake `HttpClient` that fails the test on any request that is not a `GET`. Lifting the\n *   policy is a kit change (a new PR that adds a write path, reviewed as one), not a flag a stack\n *   can pass.\n *\n * ★ A TYPED TAG, NOT A THROWN STRING (S21). `Effect.catchTag('UnifiWriteRefused', …)` lets a\n *   caller (a future import script, a test) branch on the refusal without parsing a message.\n */\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\n\nexport const UNIFI_READ_ONLY_POLICY =\n  \"read-only by Tim's rule, 2026-09-24; lifting it is a kit change\";\n\n/** What kind of write was asked for and refused — for the message only, never acted on. */\nexport type UnifiWriteAction = 'create' | 'update' | 'delete';\n\nexport class UnifiWriteRefused extends Data.TaggedError('UnifiWriteRefused')<{\n  /** The vendor type string, e.g. `Unifi.Network`. */\n  readonly type: string;\n  /** `spec.describe(props)` — the object the write would have touched. */\n  readonly identity: string;\n  readonly action: UnifiWriteAction;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: refusing to ${this.action} -- ${UNIFI_READ_ONLY_POLICY}.`;\n  }\n}\n\n/** The only thing `reconcile`/`delete` ever return for a write this family cannot make. */\nexport const refuseWrite = (type: string, identity: string, action: UnifiWriteAction) =>\n  Effect.fail(new UnifiWriteRefused({ type, identity, action }));\n",
-    "/**\n * One shape for every UniFi Network read-only object — `Unifi.Network`, `Unifi.FirewallZone`,\n * and whatever import adds next.\n *\n * ★ MIRRORS `../discord/resource.ts` (S7-S10, H1, H5), NOT `../netbox/resource.ts`. Both are\n *   \"marker-less API\" families (S8): UniFi Network objects carry no tag or metadata field this\n *   stack could stamp as ownership, so a cold read of a match is `Unowned(attrs)` exactly like\n *   `Cloudflare/Snippets/Snippet.ts@v2.0.0-beta.79#read`, the reference implementation S8 and H1\n *   both cite. `adopt(true)`, piped on by each resource's convenience constructor (H5), turns\n *   that into a silent one-time bind instead of an `OwnedBySomeoneElse` refusal.\n *\n * ⛔ THE DIFFERENCE FROM EVERY OTHER FAMILY HERE: THERE IS NO `create`, `update` OR `destroy` IN\n *   THIS SPEC AT ALL. Tim's rule, 2026-09-24 (`policy.ts`): UniFi and OPNsense are read-only. So\n *   `reconcile` below can only ever refuse or report an exact match — it has no write path to\n *   fall into by accident, and no resource file wired through this engine can reach one either.\n *\n * ⚠️ RECONCILE STILL HAS TO SUCCEED ON AN EXACT-MATCH ADOPTION, NOT JUST REFUSE UNCONDITIONALLY.\n *   Measured against `Plan.ts@v2.0.0-beta.79` (`forceUpdateAfterAdoption`, H6): beta.79 forces\n *   ONE reconcile call after every cold adoption, whether or not the diff said noop — so a\n *   resource whose `reconcile` always failed would break the ordinary \"adopt an unchanged\n *   object\" deploy, not just a real write. The fix, exactly like `discordOperations.reconcile`:\n *   read the live object again, and refuse ONLY when it is missing (would need a create) or\n *   drifted (would need a write to converge). An exact match returns the live attributes and\n *   calls nothing — S10's \"zero write calls when there is no drift\" holds even under the forced\n *   post-adoption call.\n *\n * ⚠️ `NotFound` IS FOLDED TO \"ABSENT\" INSIDE EACH RESOURCE FILE'S OWN `fetchLive`, NOT HERE —\n *   same split netbox's `resource.ts` uses and for the same reason: `Effect.catchTag`'s\n *   tag-literal inference needs a concrete error union to resolve `\"NotFound\"` against, and a\n *   spec's `E` is only concrete at each resource file's own call site. Every OTHER failure (a\n *   real 5xx, a network error, `Forbidden`) is NOT folded anywhere — it fails the plan loudly,\n *   per the task's own rule: only a genuine not-found may mean absent.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { CredentialsFromEnv } from '@distilled.cloud/unifi-network/Credentials';\nimport type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/unstable/http/HttpClient';\nimport { UNIFI_READ_ONLY_POLICY, refuseWrite } from './policy.ts';\n\n/** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */\nexport type UnifiRequirements = HttpClient.HttpClient;\n\n/**\n * One UniFi Network object's read. `Live` is whatever the SDK decodes (a `NetworkDetails`, a\n * `FirewallZone`, …); `E` is left to each resource file to declare (its own `fetchLive`'s error\n * union, with `NotFound` already folded away) so the precise per-operation error union flows\n * through instead of being widened by hand here.\n */\nexport type UnifiSpec<Props extends object, Live, Attributes extends object, E> = {\n  /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */\n  readonly type: string;\n  /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */\n  readonly fetchLive: (props: Props) => Effect.Effect<Live | undefined, E, UnifiNetworkOpContext>;\n  readonly attributes: (live: Live, props: Props) => Attributes;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /** For the refusal message and read-back failures. */\n  readonly describe: (props: Props) => string;\n};\n\nexport const unifiOperations = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const read = (props: Props) =>\n    spec\n      .fetchLive(props)\n      .pipe(Effect.map((live) => (live === undefined ? undefined : spec.attributes(live, props))));\n\n  return {\n    read,\n\n    readHandler: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n      Effect.gen(function* () {\n        const attrs = yield* read(olds);\n        if (attrs === undefined) return undefined;\n        // Warm read (persisted `output` says a prior apply already adopted this exact object):\n        // plain attributes. Cold read (fresh store, or state lost): no ownership marker on this\n        // vendor exists to tell \"ours\" from \"someone else's\" apart, so Unowned until adopt(true).\n        return output !== undefined ? attrs : Unowned(attrs);\n      }),\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        return spec.matches(live, news)\n          ? ({ action: 'noop' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        if (live === undefined) return yield* refuseWrite(spec.type, spec.describe(news), 'create');\n        if (!spec.matches(live, news)) {\n          return yield* refuseWrite(spec.type, spec.describe(news), 'update');\n        }\n        // Exact match: the object already is what is declared. Zero write calls (S10), correct\n        // whether this is a routine deploy or beta.79's forced post-adoption reconcile (H6).\n        return live;\n      }),\n\n    destroy: (olds: Props) => refuseWrite(spec.type, spec.describe(olds), 'delete'),\n  };\n};\n\n/**\n * B0a / T12 DEFENSE IN DEPTH. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at\n * `reconcile`/`destroy` — every path this engine exposes already returns that refusal instead of\n * calling an SDK write op. This guard stops the same thing one layer lower, AT THE WIRE: it wraps\n * whatever `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in\n * production, `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same\n * \"wrap, don't replace\" seam) so a future resource file that, by mistake, called an SDK write\n * operation directly — bypassing `unifiOperations` entirely — would still never reach the vendor\n * API. `write-op-reference.test.ts` proves no such call exists today; this is what stops one from\n * ever taking effect if one is ever added.\n *\n * ⚠️ `Effect.die`, NOT A TYPED FAILURE — classified per distilled-doctrine's \"classify every\n *   die/orDie\". Every generated SDK operation (`networks.getNetworkDetails`, …) declares its OWN\n *   closed error union from the pinned OpenAPI spec, and generated files are never hand-edited to\n *   add a member to it. A typed `Effect.fail` here would be a failure mode absent from every op's\n *   declared type the moment it occurred — a type-system lie. A defect is the sound way to add a\n *   NEW \"this must be structurally impossible\" failure underneath types this package does not\n *   own, exactly like `openbao`'s `refuse()` helpers' `Effect.die(new Error(...))` for a\n *   configuration move that should never be reachable.\n */\nexport class UnifiNonGetRequest extends Error {\n  constructor(\n    readonly method: string,\n    /** PATH ONLY, never the full URL — see `requestPath` below. */\n    readonly path: string,\n  ) {\n    super(\n      `UniFi HttpClient guard: refused ${method} ${path} -- ${UNIFI_READ_ONLY_POLICY}. This is a ` +\n        'defect, not a recoverable condition: something under src/unifi tried to send a non-GET ' +\n        \"request, which policy.ts's per-operation refusal should already have made impossible. \" +\n        'Fix the kit code that produced this request.',\n    );\n    this.name = 'UnifiNonGetRequest';\n  }\n}\n\n/**\n * ⛔ PATH ONLY, NEVER THE HOST. A cloud connector's base URL embeds the account's Console ID\n *   (`docs/unifi.md`'s Credentials section, T3) — a defect message is still a message that can\n *   reach a log, a CI failure body or a pasted error report, so it gets the same treatment as\n *   `redactUrls` gives the import layer's own error text. Falls back to a fixed placeholder rather\n *   than the raw string on a parse failure, so a malformed URL can never leak through unredacted.\n */\nconst requestPath = (url: string): string => {\n  try {\n    return new URL(url).pathname;\n  } catch {\n    return '<unparseable request url>';\n  }\n};\n\nconst guardGetOnly = (client: HttpClient.HttpClient): HttpClient.HttpClient =>\n  client.pipe(\n    HttpClient.mapRequestEffect((request) =>\n      request.method === 'GET'\n        ? Effect.succeed(request)\n        : Effect.die(new UnifiNonGetRequest(request.method, requestPath(request.url))),\n    ),\n  );\n\n/**\n * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,\n * for everything downstream, with `guardGetOnly`'s wrapped version (`HttpClient.layerMergedContext`\n * — see the guard above). Exported so `get-only-guard.test.ts` can prove the mechanism directly,\n * against a bare `HttpClient` service, without needing `CredentialsFromEnv` or any env var at all.\n */\nexport const GetOnlyHttpClient = HttpClient.layerMergedContext(\n  Effect.map(HttpClient.HttpClient, guardGetOnly),\n);\n\n/**\n * The four provider handlers for a spec'd read-only UniFi object, wired once.\n *\n * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;\n *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.\n */\nexport const unifiHandlers = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const ops = unifiOperations(spec);\n  const withCredentials = <A, Err>(effect: Effect.Effect<A, Err, UnifiNetworkOpContext>) =>\n    effect.pipe(Effect.provide(GetOnlyHttpClient), Effect.provide(CredentialsFromEnv));\n  return {\n    list: () => Effect.succeed([]),\n    read: (args: { olds: Props; output: Attributes | undefined }) =>\n      withCredentials(ops.readHandler(args)),\n    diff: (args: { news: Input<Props>; output: Attributes | undefined }) =>\n      withCredentials(ops.diff(args.news, args.output)),\n    reconcile: (args: { news: Props }) => withCredentials(ops.reconcile(args.news)),\n    delete: (args: { olds: Props }) => withCredentials(ops.destroy(args.olds)),\n  };\n};\n",
+    "/**\n * One shape for every UniFi Network read-only object — `Unifi.Network`, `Unifi.FirewallZone`,\n * and whatever import adds next.\n *\n * ★ MIRRORS `../discord/resource.ts` (S7-S10, H1, H5), NOT `../netbox/resource.ts`. Both are\n *   \"marker-less API\" families (S8): UniFi Network objects carry no tag or metadata field this\n *   stack could stamp as ownership, so a cold read of a match is `Unowned(attrs)` exactly like\n *   `Cloudflare/Snippets/Snippet.ts@v2.0.0-beta.79#read`, the reference implementation S8 and H1\n *   both cite. `adopt(true)`, piped on by each resource's convenience constructor (H5), turns\n *   that into a silent one-time bind instead of an `OwnedBySomeoneElse` refusal.\n *\n * ⛔ THE DIFFERENCE FROM EVERY OTHER FAMILY HERE: THERE IS NO `create`, `update` OR `destroy` IN\n *   THIS SPEC AT ALL. Tim's rule, 2026-09-24 (`policy.ts`): UniFi and OPNsense are read-only. So\n *   `reconcile` below can only ever refuse or report an exact match — it has no write path to\n *   fall into by accident, and no resource file wired through this engine can reach one either.\n *\n * ⚠️ RECONCILE STILL HAS TO SUCCEED ON AN EXACT-MATCH ADOPTION, NOT JUST REFUSE UNCONDITIONALLY.\n *   Measured against `Plan.ts@v2.0.0-beta.79` (`forceUpdateAfterAdoption`, H6): beta.79 forces\n *   ONE reconcile call after every cold adoption, whether or not the diff said noop — so a\n *   resource whose `reconcile` always failed would break the ordinary \"adopt an unchanged\n *   object\" deploy, not just a real write. The fix, exactly like `discordOperations.reconcile`:\n *   read the live object again, and refuse ONLY when it is missing (would need a create) or\n *   drifted (would need a write to converge). An exact match returns the live attributes and\n *   calls nothing — S10's \"zero write calls when there is no drift\" holds even under the forced\n *   post-adoption call.\n *\n * ⚠️ `NotFound` IS FOLDED TO \"ABSENT\" INSIDE EACH RESOURCE FILE'S OWN `fetchLive`, NOT HERE —\n *   same split netbox's `resource.ts` uses and for the same reason: `Effect.catchTag`'s\n *   tag-literal inference needs a concrete error union to resolve `\"NotFound\"` against, and a\n *   spec's `E` is only concrete at each resource file's own call site. Every OTHER failure (a\n *   real 5xx, a network error, `Forbidden`) is NOT folded anywhere — it fails the plan loudly,\n *   per the task's own rule: only a genuine not-found may mean absent.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { CredentialsFromEnv } from '@distilled.cloud/unifi-network/Credentials';\nimport type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport { UNIFI_READ_ONLY_POLICY, refuseWrite } from './policy.ts';\n\n/** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */\nexport type UnifiRequirements = HttpClient.HttpClient;\n\n/**\n * One UniFi Network object's read. `Live` is whatever the SDK decodes (a `NetworkDetails`, a\n * `FirewallZone`, …); `E` is left to each resource file to declare (its own `fetchLive`'s error\n * union, with `NotFound` already folded away) so the precise per-operation error union flows\n * through instead of being widened by hand here.\n */\nexport type UnifiSpec<Props extends object, Live, Attributes extends object, E> = {\n  /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */\n  readonly type: string;\n  /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */\n  readonly fetchLive: (props: Props) => Effect.Effect<Live | undefined, E, UnifiNetworkOpContext>;\n  readonly attributes: (live: Live, props: Props) => Attributes;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /** For the refusal message and read-back failures. */\n  readonly describe: (props: Props) => string;\n};\n\nexport const unifiOperations = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const read = (props: Props) =>\n    spec\n      .fetchLive(props)\n      .pipe(Effect.map((live) => (live === undefined ? undefined : spec.attributes(live, props))));\n\n  return {\n    read,\n\n    readHandler: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n      Effect.gen(function* () {\n        const attrs = yield* read(olds);\n        if (attrs === undefined) return undefined;\n        // Warm read (persisted `output` says a prior apply already adopted this exact object):\n        // plain attributes. Cold read (fresh store, or state lost): no ownership marker on this\n        // vendor exists to tell \"ours\" from \"someone else's\" apart, so Unowned until adopt(true).\n        return output !== undefined ? attrs : Unowned(attrs);\n      }),\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        return spec.matches(live, news)\n          ? ({ action: 'noop' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        if (live === undefined) return yield* refuseWrite(spec.type, spec.describe(news), 'create');\n        if (!spec.matches(live, news)) {\n          return yield* refuseWrite(spec.type, spec.describe(news), 'update');\n        }\n        // Exact match: the object already is what is declared. Zero write calls (S10), correct\n        // whether this is a routine deploy or beta.79's forced post-adoption reconcile (H6).\n        return live;\n      }),\n\n    destroy: (olds: Props) => refuseWrite(spec.type, spec.describe(olds), 'delete'),\n  };\n};\n\n/**\n * B0a / T12 DEFENSE IN DEPTH. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at\n * `reconcile`/`destroy` — every path this engine exposes already returns that refusal instead of\n * calling an SDK write op. This guard stops the same thing one layer lower, AT THE WIRE: it wraps\n * whatever `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in\n * production, `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same\n * \"wrap, don't replace\" seam) so a future resource file that, by mistake, called an SDK write\n * operation directly — bypassing `unifiOperations` entirely — would still never reach the vendor\n * API. `write-op-reference.test.ts` proves no such call exists today; this is what stops one from\n * ever taking effect if one is ever added.\n *\n * ⚠️ `Effect.die`, NOT A TYPED FAILURE — classified per distilled-doctrine's \"classify every\n *   die/orDie\". Every generated SDK operation (`networks.getNetworkDetails`, …) declares its OWN\n *   closed error union from the pinned OpenAPI spec, and generated files are never hand-edited to\n *   add a member to it. A typed `Effect.fail` here would be a failure mode absent from every op's\n *   declared type the moment it occurred — a type-system lie. A defect is the sound way to add a\n *   NEW \"this must be structurally impossible\" failure underneath types this package does not\n *   own, exactly like `openbao`'s `refuse()` helpers' `Effect.die(new Error(...))` for a\n *   configuration move that should never be reachable.\n */\nexport class UnifiNonGetRequest extends Error {\n  constructor(\n    readonly method: string,\n    /** PATH ONLY, never the full URL — see `requestPath` below. */\n    readonly path: string,\n  ) {\n    super(\n      `UniFi HttpClient guard: refused ${method} ${path} -- ${UNIFI_READ_ONLY_POLICY}. This is a ` +\n        'defect, not a recoverable condition: something under src/unifi tried to send a non-GET ' +\n        \"request, which policy.ts's per-operation refusal should already have made impossible. \" +\n        'Fix the kit code that produced this request.',\n    );\n    this.name = 'UnifiNonGetRequest';\n  }\n}\n\n/**\n * ⛔ PATH ONLY, NEVER THE HOST. A cloud connector's base URL embeds the account's Console ID\n *   (`docs/unifi.md`'s Credentials section, T3) — a defect message is still a message that can\n *   reach a log, a CI failure body or a pasted error report, so it gets the same treatment as\n *   `redactUrls` gives the import layer's own error text. Falls back to a fixed placeholder rather\n *   than the raw string on a parse failure, so a malformed URL can never leak through unredacted.\n */\nconst requestPath = (url: string): string => {\n  try {\n    return new URL(url).pathname;\n  } catch {\n    return '<unparseable request url>';\n  }\n};\n\nconst guardGetOnly = (client: HttpClient.HttpClient): HttpClient.HttpClient =>\n  client.pipe(\n    HttpClient.mapRequestEffect((request) =>\n      request.method === 'GET'\n        ? Effect.succeed(request)\n        : Effect.die(new UnifiNonGetRequest(request.method, requestPath(request.url))),\n    ),\n  );\n\n/**\n * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,\n * for everything downstream, with `guardGetOnly`'s wrapped version (`HttpClient.layerMergedContext`\n * — see the guard above). Exported so `get-only-guard.test.ts` can prove the mechanism directly,\n * against a bare `HttpClient` service, without needing `CredentialsFromEnv` or any env var at all.\n */\nexport const GetOnlyHttpClient = HttpClient.layerMergedContext(\n  Effect.map(HttpClient.HttpClient, guardGetOnly),\n);\n\n/**\n * The four provider handlers for a spec'd read-only UniFi object, wired once.\n *\n * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;\n *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.\n */\nexport const unifiHandlers = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const ops = unifiOperations(spec);\n  const withCredentials = <A, Err>(effect: Effect.Effect<A, Err, UnifiNetworkOpContext>) =>\n    effect.pipe(Effect.provide(GetOnlyHttpClient), Effect.provide(CredentialsFromEnv));\n  return {\n    list: () => Effect.succeed([]),\n    read: (args: { olds: Props; output: Attributes | undefined }) =>\n      withCredentials(ops.readHandler(args)),\n    diff: (args: { news: Input<Props>; output: Attributes | undefined }) =>\n      withCredentials(ops.diff(args.news, args.output)),\n    reconcile: (args: { news: Props }) => withCredentials(ops.reconcile(args.news)),\n    delete: (args: { olds: Props }) => withCredentials(ops.destroy(args.olds)),\n  };\n};\n",
     "/**\n * `Unifi.Network` — one network on a UniFi Network site, READ-ONLY (`policy.ts`).\n *\n * ★ WHY NETWORK IS IN THE FIRST IMPORT SET. `getNetworkDetails`/`getNetworksOverviewPage`\n *   (`../../distilled-unifi-network/src/services/networks.ts`) is a list+get pair over\n *   genuine configuration — VLAN, DHCP guarding, IPv4/IPv6 addressing, isolation — not runtime\n *   state like a connected client, a device statistic or a hotspot voucher. It is also the SDK\n *   package's own README recommendation for a first read/adopt-only resource, alongside `Site`\n *   (skipped here — no `getSite`, only the list operation, so it fails this task's own \"both a\n *   list and a get\" bar) and `FirewallZone`/`FirewallPolicy` (`firewall-zone.ts` ships\n *   `FirewallZone`; `FirewallPolicy`'s several discriminated filter variants and its\n *   list-replacing ordering endpoint are a bigger, separate PR).\n *\n * ⛔ THE WHOLE-OBJECT-PUT TRAP (`docs/unifi-api-notes.md`) NEVER FIRES HERE, BY CONSTRUCTION.\n *   `updateNetwork` is a `PUT` that disables `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration`\n *   outright when the caller omits them — the exact failure mode a read-only family cannot cause,\n *   because `resource.ts`'s `reconcile` never calls `updateNetwork` at all. Recorded here for\n *   whoever adds the write path this docs note anticipates: read-merge-write the WHOLE object,\n *   never a props-only body.\n */\nimport { Resource } from 'alchemy';\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as networks from '@distilled.cloud/unifi-network/networks';\nimport * as Effect from 'effect/Effect';\nimport { type NetworkAttributes, type NetworkProps, attributesOf } from './network-form.ts';\nimport { matches } from './network-drift.ts';\nimport type { UnifiRequirements, UnifiSpec } from './resource.ts';\nimport { unifiHandlers } from './resource.ts';\n\nexport type { NetworkAttributes, NetworkProps } from './network-form.ts';\nexport { declareNetwork } from './network-form.ts';\n// MEDIUM-4: `matches` moved here from `network-form.ts` — see network-drift.ts's own header. Not\n// re-exported from this barrel file either, same as before the move: `spec.matches` below is the\n// only consumer a provider needs.\nexport { driftOf } from './network-drift.ts';\n\nexport interface UnifiNetwork extends Resource<\n  'Unifi.Network',\n  NetworkProps,\n  NetworkAttributes,\n  never,\n  UnifiRequirements\n> {}\n\nexport const UnifiNetwork = Resource<UnifiNetwork>('Unifi.Network', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * `network('lan', props)` — `adopt(true)` piped on by default (H5). This family never writes, so\n * the only thing a first deploy against an existing network could ever do is bind to it or refuse\n * `OwnedBySomeoneElse`; piping `adopt(true)` here picks the former without a stack having to\n * remember `--adopt`, mirroring `discord/application-command.ts`'s `applicationCommand`.\n */\nexport const network = (id: string, props: NetworkProps) =>\n  UnifiNetwork(id, props).pipe(adopt(true));\n\n/**\n * ★ EXPORTED for direct testing against a fake `Credentials` layer (`fake-unifi.ts`), the same\n *   seam `netbox/prefix.ts`'s `spec` and `discord/application-command.ts`'s `spec` use — `handlers`\n *   bakes in `CredentialsFromEnv`, which resolves environment variables a test cannot repoint.\n */\nexport const spec: UnifiSpec<\n  NetworkProps,\n  networks.NetworkDetails,\n  NetworkAttributes,\n  networks.GetNetworkDetailsError\n> = {\n  type: 'Unifi.Network',\n  describe: (props) => `sites/${props.siteId}/networks/${props.networkId}`,\n  fetchLive: (props) =>\n    networks\n      .getNetworkDetails({ siteId: props.siteId, networkId: props.networkId })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  attributes: attributesOf,\n  matches,\n};\n\nexport const handlers = unifiHandlers(spec);\n\nexport const UnifiNetworkProvider = () =>\n  Provider.effect(UnifiNetwork, Effect.succeed(UnifiNetwork.Provider.of(handlers)));\n",
     "/**\n * `Unifi.Network`'s wire shape: the declarable subset of `NetworkDetails`, and how a live read\n * becomes both plan attributes and a rendered declaration.\n *\n * ⚠️ PROPS MIRROR `UpdateNetworkRequest`, NOT `NetworkDetails`. `default` and `metadata` are\n *   server-derived — no writable endpoint in `networks.ts` accepts either — so they are\n *   attributes-only, reported but never compared or declared. Everything else in `NetworkProps`\n *   is exactly what `updateNetwork`/`createNetwork` would accept, even though this family never\n *   calls either: the shape is what a future write path would need, and what today's read-only\n *   `matches` compares against.\n *\n * ⛔ `ipv4Configuration` STAYS `unknown`, ON THE SDK'S OWN AUTHORITY. `networks.ts`'s own comment\n *   (\"Shape varies by variant — widened by scripts/convert.ts; see README\") says the OpenAPI\n *   discriminator this field varies over was flattened at generation time, not decoded per\n *   variant. Comparing it as an opaque JSON value (below) is honest about that; guessing a\n *   narrower shape here would silently stop matching the day a new variant's key order differs.\n *   ⚠️ It may ALSO hide an unordered array the way `dhcpGuarding` and `ipv6Configuration` do\n *   below — this family just can't know, because the shape is never decoded. If a future variant\n *   plans spurious `update`s, suspect this field first and widen it into a typed, order-normalized\n *   shape rather than adding another opaque comparison.\n *\n * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES: `dhcpGuarding.trustedDhcpServerIpAddresses`,\n *   `ipv6Configuration.additionalHostIpSubnets`, and `ipv6Configuration.dnsServerIpAddressesOverride`.\n *   The vendor document gives no indication any of the three is ordered — same reasoning\n *   `firewall-zone-form.ts` gives for `networkIds`, and `proxmox/user-wire.ts`'s `groupSet` gives\n *   for PVE's `groups` — but `matches` compares via alchemy's `deepEqual`, which sorts object KEYS\n *   but NOT ARRAY ELEMENTS (`node_modules/alchemy/lib/Diff.js`). Left alone, a console that\n *   returns the same set in a different order between calls plans a spurious `update`, and the\n *   read-only reconcile then refuses every deploy. `sortedSet` (dedupe + sort) neutralizes that\n *   before any of the three is attributed, declared, or compared. Every OTHER array field in this\n *   family (there are none today besides these three) would stay declaration-order as written.\n */\nimport type * as networks from '@distilled.cloud/unifi-network/networks';\n\nconst sortedSet = (values: readonly string[]): string[] => [...new Set(values)].sort();\n\n// ⚠️ `value == null` (NOT `=== undefined`) ON PURPOSE, IN BOTH NORMALIZERS BELOW. The SDK types\n//   `dhcpGuarding`/`ipv6Configuration` `T | undefined`, but `matches`'s own header says UniFi's\n//   JSON answers `null` for an unset optional field — a reality `deepEqual`'s `stripNullish`\n//   already treats as equivalent to `undefined` (`value == null` in alchemy's `Diff.js`), which\n//   this family's props/attributes types don't model at the TS level. Destructuring a `null` with\n//   `=== undefined`'s false branch (`{ ...value, field: value.field }`) would throw\n//   `TypeError: Cannot read properties of null` the first time a console omits either field —\n//   `== null` catches both and returns the value through untouched, matching what the rest of\n//   this file already does for every other optional field.\n// ★ EXPORTED (not just used below): `network-drift.ts`'s `driftOf` reuses these exact two\n//   normalizers so it can never quietly disagree with `matches` about what counts as a change —\n//   see that file's own header.\nexport const normalizeDhcpGuarding = (\n  value: networks.NetworkDHCPGuarding | undefined,\n): networks.NetworkDHCPGuarding | undefined =>\n  value == null\n    ? value\n    : { ...value, trustedDhcpServerIpAddresses: sortedSet(value.trustedDhcpServerIpAddresses) };\n\n// ⚠️ `exactOptionalPropertyTypes` (see the props header) means these two subfields must be\n//   OMITTED, not set to an explicit `undefined`, when the live/declared value has no override —\n//   `NetworkIPv6Configuration` types them `field?: T`, not `field?: T | undefined`. Conditional\n//   spread (rather than `field: value.field === undefined ? undefined : sortedSet(...)`) is what\n//   keeps an absent key absent.\nexport const normalizeIpv6Configuration = (\n  value: networks.NetworkIPv6Configuration | undefined,\n): networks.NetworkIPv6Configuration | undefined =>\n  value == null\n    ? value\n    : {\n        ...value,\n        ...(value.additionalHostIpSubnets !== undefined\n          ? { additionalHostIpSubnets: sortedSet(value.additionalHostIpSubnets) }\n          : {}),\n        ...(value.dnsServerIpAddressesOverride !== undefined\n          ? { dnsServerIpAddressesOverride: sortedSet(value.dnsServerIpAddressesOverride) }\n          : {}),\n      };\n\n/**\n * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE. `tsconfig.json` sets\n *   `exactOptionalPropertyTypes`, which treats `field?: T` (absent-or-T) and\n *   `field?: T | undefined` (absent-or-explicitly-undefined) as different types. `declareNetwork`\n *   below assigns `live.dhcpGuarding` (typed `T | undefined`) straight through — the whole point\n *   of a renderer that echoes a live optional field structurally rather than defaulting it — so\n *   the target has to admit an explicit `undefined`, not just omission.\n */\nexport interface NetworkProps {\n  siteId: string;\n  networkId: string;\n  name: string;\n  enabled: boolean;\n  management: string;\n  /** VLAN ID. Must be 1 for the default network and >= 2 for additional networks. */\n  vlanId: number;\n  dhcpGuarding?: networks.NetworkDHCPGuarding | undefined;\n  cellularBackupEnabled?: boolean | undefined;\n  internetAccessEnabled?: boolean | undefined;\n  /** Opaque — see the header. */\n  ipv4Configuration?: unknown;\n  ipv6Configuration?: networks.NetworkIPv6Configuration | undefined;\n  isolationEnabled?: boolean | undefined;\n  mdnsForwardingEnabled?: boolean | undefined;\n  zoneId?: string | undefined;\n  deviceId?: string | undefined;\n}\n\nexport interface NetworkAttributes {\n  siteId: string;\n  networkId: string;\n  /** Whether this is the site's undeletable default network — server-derived, never declared. */\n  default: boolean;\n  name: string;\n  enabled: boolean;\n  management: string;\n  vlanId: number;\n  dhcpGuarding: networks.NetworkDHCPGuarding | undefined;\n  cellularBackupEnabled: boolean | undefined;\n  internetAccessEnabled: boolean | undefined;\n  ipv4Configuration: unknown;\n  ipv6Configuration: networks.NetworkIPv6Configuration | undefined;\n  isolationEnabled: boolean | undefined;\n  mdnsForwardingEnabled: boolean | undefined;\n  zoneId: string | undefined;\n  deviceId: string | undefined;\n}\n\nexport const attributesOf = (\n  live: networks.NetworkDetails,\n  props: NetworkProps,\n): NetworkAttributes => ({\n  siteId: props.siteId,\n  networkId: live.id,\n  default: live.default,\n  name: live.name,\n  enabled: live.enabled,\n  management: live.management,\n  vlanId: live.vlanId,\n  dhcpGuarding: normalizeDhcpGuarding(live.dhcpGuarding),\n  cellularBackupEnabled: live.cellularBackupEnabled,\n  internetAccessEnabled: live.internetAccessEnabled,\n  ipv4Configuration: live.ipv4Configuration,\n  ipv6Configuration: normalizeIpv6Configuration(live.ipv6Configuration),\n  isolationEnabled: live.isolationEnabled,\n  mdnsForwardingEnabled: live.mdnsForwardingEnabled,\n  zoneId: live.zoneId,\n  deviceId: live.deviceId,\n});\n\n/**\n * MEDIUM-4 (red team, 2026-09-26): `matches` used to be a hand-written boolean expression here,\n * kept in sync BY HAND with `network-drift.ts`'s separately-maintained field list — two comparisons\n * that could (and, per a red-team mutant, silently did) drift apart. `matches` now lives in\n * `network-drift.ts`, defined as `fieldDrift(...).length === 0` — the SAME comparison `driftOf`\n * runs, not a second one. See that file's own header for the `stripNullish`/normalizer reasoning\n * this expression used to carry.\n */\n\n/**\n * The declaration renderer (task spec: \"given one live object, return the props a declaration\n * needs so its plan is noop\"). A later import script feeds `getNetworkDetails`'s own response\n * straight in and writes the result into `alchemy.run.ts` as `network('<id>', declareNetwork(live,\n * siteId))` — no field is invented or defaulted here beyond what `attributesOf` already reports,\n * so `matches(attributesOf(live, props), declareNetwork(live, siteId))` is `true` by construction\n * (`network.test.ts` proves it) for any live object this SDK can decode.\n */\nexport const declareNetwork = (live: networks.NetworkDetails, siteId: string): NetworkProps => ({\n  siteId,\n  networkId: live.id,\n  name: live.name,\n  enabled: live.enabled,\n  management: live.management,\n  vlanId: live.vlanId,\n  dhcpGuarding: normalizeDhcpGuarding(live.dhcpGuarding),\n  cellularBackupEnabled: live.cellularBackupEnabled,\n  internetAccessEnabled: live.internetAccessEnabled,\n  ipv4Configuration: live.ipv4Configuration,\n  ipv6Configuration: normalizeIpv6Configuration(live.ipv6Configuration),\n  isolationEnabled: live.isolationEnabled,\n  mdnsForwardingEnabled: live.mdnsForwardingEnabled,\n  zoneId: live.zoneId,\n  deviceId: live.deviceId,\n});\n",
     "/**\n * B6: the field-level drift framework every family's own `driftOf(live, props)` is built on\n * (`network-form.ts`, `firewall-zone-form.ts`, and whatever family follows). Consumed by\n * `homeflare-network`'s pre-import drift check (its own C4, not built here) to show WHICH fields\n * a live object and a committed declaration disagree on, before that script overwrites the\n * committed module — never by a `Unifi.*` provider itself, which only ever needs `matches`'s\n * boolean.\n *\n * ★ BUILT ON `matches`, NOT A SEPARATE COMPARISON. Each family's `driftOf` reuses the SAME\n *   normalizers (`sortedSet`, the `dhcpGuarding`/`ipv6Configuration` null-vs-undefined handling)\n *   its own `matches` already applies — so this reports NOTHING `matches` would call a noop, and\n *   everything `matches` would call `update`, broken down by field instead of collapsed to one\n *   boolean. Two comparisons drifting apart would be its own bug class; there is exactly one.\n */\nimport { deepEqual } from 'alchemy/Diff';\n\n/** One field whose live and declared values differ, as `makeDriftOf` reports it. */\nexport interface FieldDrift {\n  readonly field: string;\n  readonly live: unknown;\n  readonly declared: unknown;\n}\n\n/** One field's comparison recipe for `makeDriftOf`. */\nexport interface DriftField<Attributes, Props> {\n  readonly field: string;\n  readonly live: (attributes: Attributes) => unknown;\n  readonly declared: (props: Props) => unknown;\n  /**\n   * Defaults to `alchemy/Diff`'s `deepEqual` with `stripNullish: true` — the same tolerance\n   * every `matches` in this directory already gives UniFi's `null`-for-unset optionals (see\n   * `network-form.ts`'s header). Pass one explicitly for a field `matches` compares as a\n   * normalized SET (`firewall-zone-form.ts`'s `networkIds`), where plain `deepEqual` would\n   * report order as drift `matches` never would.\n   */\n  readonly equal?: (live: unknown, declared: unknown) => boolean;\n}\n\nconst defaultEqual = (live: unknown, declared: unknown) =>\n  deepEqual(live, declared, { stripNullish: true });\n\n/**\n * Builds a `(attributes, props) => FieldDrift[]` from a field list — the framework a family's own\n * `*-form.ts` calls once, then wraps as `driftOf(live, props)` by feeding it `attributesOf(live,\n * props)` (the task's own API: callers have a live SDK object, not `Attributes`, on hand).\n */\nexport const makeDriftOf =\n  <Attributes, Props>(fields: readonly DriftField<Attributes, Props>[]) =>\n  (attributes: Attributes, props: Props): FieldDrift[] =>\n    fields.flatMap(({ field, live, declared, equal = defaultEqual }) => {\n      const liveValue = live(attributes);\n      const declaredValue = declared(props);\n      return equal(liveValue, declaredValue)\n        ? []\n        : [{ field, live: liveValue, declared: declaredValue }];\n    });\n",
@@ -33,6 +33,6 @@
     "/**\n * Every `Unifi.*` provider as one layer for a stack.\n *\n *     Layer.mergeAll(unifiProviders(), …the stack's other providers)\n *       .pipe(Layer.provide(FetchHttpClient.layer))\n *\n * S16: a subpath's `providers()` plays the role upstream's own `Providers.ts` does — one minimal\n * insertion per family. `FetchHttpClient.layer` is the stack's own responsibility to provide,\n * mirroring `../discord/providers.ts`.\n */\nimport * as Layer from 'effect/Layer';\nimport { UnifiAclRuleProvider } from './acl-rule.ts';\nimport { UnifiAclRuleOrderingProvider } from './acl-rule-ordering.ts';\nimport { UnifiDnsPolicyProvider } from './dns-policy.ts';\nimport { UnifiFirewallPolicyProvider } from './firewall-policy.ts';\nimport { UnifiFirewallPolicyOrderingProvider } from './firewall-policy-ordering.ts';\nimport { UnifiFirewallZoneProvider } from './firewall-zone.ts';\nimport { UnifiNetworkProvider } from './network.ts';\nimport { UnifiTrafficMatchingListProvider } from './traffic-matching-list.ts';\nimport { UnifiWifiBroadcastProvider } from './wifi-broadcast.ts';\n\nexport const providers = () =>\n  Layer.mergeAll(\n    UnifiNetworkProvider(),\n    UnifiFirewallZoneProvider(),\n    UnifiDnsPolicyProvider(),\n    UnifiAclRuleProvider(),\n    UnifiAclRuleOrderingProvider(),\n    UnifiWifiBroadcastProvider(),\n    UnifiFirewallPolicyProvider(),\n    UnifiFirewallPolicyOrderingProvider(),\n    UnifiTrafficMatchingListProvider(),\n  );\n"
   ],
   "mappings": ";AAaA;AACA;AAEO,IAAM,yBACX;AAAA;AAKK,MAAM,0BAA+B,iBAAY,mBAAmB,EAMxE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK,yBAAyB,KAAK,aAAa;AAAA;AAE3E;AAGO,IAAM,cAAc,CAAC,MAAc,UAAkB,WACnD,YAAK,IAAI,kBAAkB,EAAE,MAAM,UAAU,OAAO,CAAC,CAAC;;ACH/D;AACA;AAEA;AAEA;AACA;AAuBO,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,OAAO,CAAC,UACZ,KACG,UAAU,KAAK,EACf,KAAY,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CAAC;AAAA,EAE/F,OAAO;AAAA,IACL;AAAA,IAEA,aAAa,GAAG,MAAM,aACb,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU;AAAA,QAAW;AAAA,MAIzB,OAAO,WAAW,YAAY,QAAQ,QAAQ,KAAK;AAAA,KACpD;AAAA,IAEH,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,OAAO,KAAK,QAAQ,MAAM,IAAI,IACzB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,OAAO,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MAC1F,IAAI,CAAC,KAAK,QAAQ,MAAM,IAAI,GAAG;AAAA,QAC7B,OAAO,OAAO,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MACpE;AAAA,MAGA,OAAO;AAAA,KACR;AAAA,IAEH,SAAS,CAAC,SAAgB,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,EAChF;AAAA;AAAA;AAuBK,MAAM,2BAA2B,MAAM;AAAA,EAEjC;AAAA,EAEA;AAAA,EAHX,WAAW,CACA,QAEA,MACT;AAAA,IACA,MACE,mCAAmC,UAAU,WAAW,uCACtD,4FACA,2FACA,8CACJ;AAAA,IATS;AAAA,IAEA;AAAA,IAQT,KAAK,OAAO;AAAA;AAEhB;AASA,IAAM,cAAc,CAAC,QAAwB;AAAA,EAC3C,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,GAAG,EAAE;AAAA,IACpB,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,IAAM,eAAe,CAAC,WACpB,OAAO,KACM,4BAAiB,CAAC,YAC3B,QAAQ,WAAW,QACR,gBAAQ,OAAO,IACf,YAAI,IAAI,mBAAmB,QAAQ,QAAQ,YAAY,QAAQ,GAAG,CAAC,CAAC,CACjF,CACF;AAQK,IAAM,oBAA+B,8BACnC,YAAe,uBAAY,YAAY,CAChD;AAQO,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,MAAM,MAAM,gBAAgB,IAAI;AAAA,EAChC,MAAM,kBAAkB,CAAS,WAC/B,OAAO,KAAY,gBAAQ,iBAAiB,GAAU,gBAAQ,kBAAkB,CAAC;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,CAAC,SACL,gBAAgB,IAAI,YAAY,IAAI,CAAC;AAAA,IACvC,MAAM,CAAC,SACL,gBAAgB,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM,CAAC;AAAA,IAClD,WAAW,CAAC,SAA0B,gBAAgB,IAAI,UAAU,KAAK,IAAI,CAAC;AAAA,IAC9E,QAAQ,CAAC,SAA0B,gBAAgB,IAAI,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC3E;AAAA;;ACnLF;AACA;AACA;AACA;AACA;;;ACUA,IAAM,YAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAc9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA,KAAK,OAAO,8BAA8B,UAAU,MAAM,4BAA4B,EAAE;AAOvF,IAAM,6BAA6B,CACxC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,4BAA4B,YAClC,EAAE,yBAAyB,UAAU,MAAM,uBAAuB,EAAE,IACpE,CAAC;AAAA,KACD,MAAM,iCAAiC,YACvC,EAAE,8BAA8B,UAAU,MAAM,4BAA4B,EAAE,IAC9E,CAAC;AACP;AAkDC,IAAM,eAAe,CAC1B,MACA,WACuB;AAAA,EACvB,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;AAmBO,IAAM,iBAAiB,CAAC,MAA+B,YAAkC;AAAA,EAC9F;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;;;ACpKA;AAwBA,IAAM,eAAe,CAAC,MAAe,aACnC,UAAU,MAAM,UAAU,EAAE,cAAc,KAAK,CAAC;AAO3C,IAAM,cACX,CAAoB,WACpB,CAAC,YAAwB,UACvB,OAAO,QAAQ,GAAG,OAAO,MAAM,UAAU,QAAQ,mBAAmB;AAAA,EAClE,MAAM,YAAY,KAAK,UAAU;AAAA,EACjC,MAAM,gBAAgB,SAAS,KAAK;AAAA,EACpC,OAAO,MAAM,WAAW,aAAa,IACjC,CAAC,IACD,CAAC,EAAE,OAAO,MAAM,WAAW,UAAU,cAAc,CAAC;AAAA,CACzD;;;AC7BL,IAAM,aAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,IACjD,UAAU,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,EACvD;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,IAC3D,UAAU,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,EACjE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAC5E,CAAC;AAEM,IAAM,UAAU,CAAC,YAA+B,UACrD,WAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,UAAU,CAAC,MAA+B,UACrD,WAAW,aAAa,MAAM,KAAK,GAAG,KAAK;;;AHlCtC,IAAM,eAAe,SAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAQM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,MAAM,IAAI,CAAC;AAOnC,IAAM,OAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,mBAAmB,MAAM;AAAA,EAC7D,WAAW,CAAC,UAEP,2BAAkB,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EACtE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,WAAW,cAAc,IAAI;AAEnC,IAAM,uBAAuB,MACzB,gBAAO,cAAqB,gBAAQ,aAAa,SAAS,GAAG,QAAQ,CAAC,CAAC;;AItElF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACmBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAE9E,IAAM,gBAAe,CAC1B,MACA,WAC4B;AAAA,EAC5B,QAAQ,MAAM;AAAA,EACd,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AAAA,EACrC,gBAAgB,KAAK,SAAS;AAChC;AAaA,IAAM,cAAa,YAAuD;AAAA,EACxE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,WAAU,EAAE,UAAU;AAAA,IACvC,OAAO,CAAC,MAAM,aAAc,KAAkB,KAAK,GAAG,MAAO,SAAsB,KAAK,GAAG;AAAA,EAC7F;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAoC,UAC1D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;AAOtC,IAAM,sBAAsB,CACjC,MACA,YACuB;AAAA,EACvB;AAAA,EACA,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AACvC;;;ADxDO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAGM,IAAM,eAAe,CAAC,IAAY,UACvC,kBAAkB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGxC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,yBAAyB,MAAM;AAAA,EACnE,WAAW,CAAC,UAEP,yBAAgB,EAAE,QAAQ,MAAM,QAAQ,gBAAgB,MAAM,eAAe,CAAC,EAC9E,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEjD5F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACqEO,IAAM,gBAAe,CAC1B,MACA,WACyB;AAAA,EACzB,QAAQ,MAAM;AAAA,EACd,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AAAA,EACX,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,mBAAmB,CAAC,MAA6B,YAAoC;AAAA,EAChG;AAAA,EACA,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AACb;;;AC9HA,IAAM,cAAa,YAAiD;AAAA,EAClE,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE,WAAW,UAAU,CAAC,MAAM,EAAE,UAAU;AAAA,EAC7E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAChE,CAAC;AAEM,IAAM,WAAU,CAAC,YAAiC,UACvD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFTtC,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAGM,IAAM,YAAY,CAAC,IAAY,UACpC,eAAe,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGrC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,uBAAuB,MAAM;AAAA,EACjE,WAAW,CAAC,UAEP,yBAAa,EAAE,QAAQ,MAAM,QAAQ,aAAa,MAAM,YAAY,CAAC,EACrE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGxDtF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACwBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAI9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,cAAc,YAAY,EAAE,WAAW,WAAU,MAAM,SAAS,EAAE,IAAI,CAAC;AACnF;AAEC,IAAM,0BAA0B,CACrC,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA2ChE,IAAM,gBAAe,CAAC,MAAwB,WAA4C;AAAA,EAC/F,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,OAAO,KAAK;AAAA,EACZ,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AAAA,EACtB,gBAAgB,KAAK,SAAS;AAChC;AASO,IAAM,iBAAiB,CAAC,MAAwB,YAAkC;AAAA,EACvF;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AACxB;;;AChHA,IAAM,cAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,IAC1D,UAAU,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,EAChE;AAAA,EACA,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,IACrD,UAAU,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,EAC3D;AAAA,EACA,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AACjG,CAAC;AAEM,IAAM,WAAU,CAAC,YAA+B,UACrD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAAwB,UAC9C,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFxBtC,IAAM,eAAe,UAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAGM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGnC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,oBAAoB,MAAM;AAAA,EAC9D,WAAW,CAAC,UAEP,oBAAW,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EAC/D,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,uBAAuB,MACzB,iBAAO,cAAqB,gBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG5ClF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACeO,IAAM,gBAAe,CAC1B,MACA,WAC+B;AAAA,EAC/B,QAAQ,MAAM;AAAA,EACd,mBAAmB,KAAK;AAC1B;AASO,IAAM,yBAAyB,CACpC,MACA,YAC0B;AAAA,EAC1B;AAAA,EACA,mBAAmB,KAAK;AAC1B;AAEA,IAAM,cAAa,YAA6D;AAAA,EAC9E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAQhD,IAAM,WAAU,CAAC,MAAgC,UACtD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADrCtC,IAAM,uBAAuB,UAA+B,yBAAyB;AAAA,EAC1F,sBAAsB;AACxB,CAAC;AAGM,IAAM,kBAAkB,CAAC,IAAY,UAC1C,qBAAqB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG3C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM;AAAA,EACpC,WAAW,CAAC,UAEP,6BAAmB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAC3C,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,+BAA+B,MACjC,iBAAO,sBAA6B,gBAAQ,qBAAqB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEpClG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACMA,IAAM,gBAAgB,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAEzF,IAAM,oBAAoB,CAAC,WACzB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AAG3C,IAAM,SAAS,CAAC,QACd,GAAG,IAAI,QAAQ,IAAI,aAAa;AAU3B,IAAM,eAAe,CAC1B,QAEA,QAAQ,YACJ,YACA,EAAE,MAAM,IAAI,SAAU,IAAI,cAAc,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAE7F,IAAM,aAAa,CACjB,WAC0C;AAAA,EAC1C,MAAM,QAAQ,IAAI,IAChB,OAAO,IACL,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,aAAa,GAAG,CAAwC,CACjF,CACF;AAAA,EACA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;AAQvE,IAAM,mBAAmB,CAC9B,UAEA,UAAU,YAAY,YAAY,EAAE,MAAM,MAAM,KAAK;AAWhD,IAAM,yBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,EACE,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,KACjF,MAAM,iBAAiB,YACvB,EAAE,cAAc,cAAc,MAAM,YAAY,EAAE,IAClD,CAAC;AACP;AAEC,IAAM,uBAAuB,CAAC,UACnC,UAAU,YAAY,QAAQ,kBAAkB,KAAK;AAchD,IAAM,iCAAiC,CAC5C,WACsD;AAAA,EACtD,MAAM,MAAM;AAAA,KACR,MAAM,2BAA2B,YACjC,EAAE,wBAAwB,WAAW,MAAM,sBAAsB,EAAE,IACnE,CAAC;AACP;AAqCO,IAAM,gBAAe,CAC1B,MACA,WAC6B;AAAA,EAC7B,QAAQ,MAAM;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,gBAAgB,KAAK,SAAS;AAChC;AAYO,IAAM,uBAAuB,CAClC,MACA,YACwB;AAAA,EACxB;AAAA,EACA,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAClF;;;ACzLA,IAAM,cAAa,YAAyD;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IAIE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,aAAa,EAAE,OAAO;AAAA,EACzC;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,uBAAsB,EAAE,wBAAwB;AAAA,EACnE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,qBAAqB,EAAE,0BAA0B;AAAA,EACpE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,iBAAiB,EAAE,oBAAoB;AAAA,EAC1D;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAqC,UAC3D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA4C,UAClE,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AClC7C;AACA;AAgBA,IAAM,YAAY;AAAA;AAEX,MAAM,oCAAyC,kBAAY,6BAA6B,EAO5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,gBAAgB,KAAK,aAAa,KAAK,wDACvC;AAAA;AAGN;AAuBA,IAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI;AAEjE,IAAM,UAAU,CACrB,WACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAY,CAAC;AAAA,EACnB,MAAM,cAAc,QAAQ,UAAU;AAAA,EACtC,IAAI,SAAS;AAAA,EACb,IAAI;AAAA,EACJ,SAAS,YAAY,IAAK,aAAa;AAAA,IACrC,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,iBAAiB,6BAA6B;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,IAKA,MAAM,OAAO,OAAO,UAAU,KAAK,SAAS,OAAO,CAAQ;AAAA,IAC3D,IAAI,KAAK,WAAW,QAAQ;AAAA,MAC1B,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,oBAAoB,uBAAuB,iBAAiB,KAAK,MAAM;AAAA,MACjF,CAAC;AAAA,IACH;AAAA,IACA,IAAI,eAAe,aAAa,KAAK,eAAe,YAAY;AAAA,MAC9D,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,2BAA2B,iBAAiB,UAAU,QAAQ,iBAAiB,KAAK,UAAU;AAAA,MACxG,CAAC;AAAA,IACH;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK,GAAG,KAAK,IAAI;AAAA,IACtB,IAAI,KAAK,KAAK,WAAW;AAAA,MAAG;AAAA,IAC5B,UAAU,KAAK,KAAK;AAAA,IACpB,IAAI,UAAU;AAAA,MAAY;AAAA,EAC5B;AAAA,EACA,MAAM,WAAW,aAAa;AAAA,EAC9B,IAAI,KAAK,WAAW,UAAU;AAAA,IAC5B,OAAO,OAAO,IAAI,4BAA4B;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ,aAAa,KAAK,8BAA8B,iBAAiB,UAAU,oBAAoB,kBAAkB,iBAAiB,QAAQ;AAAA,IACpJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA,CACR;;;AHhFI,IAAM,qBAAqB,UAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AAGM,IAAM,gBAAgB,CAAC,IAAY,UACxC,mBAAmB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGzC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,0BAA0B,MAAM;AAAA,EACpE,WAAW,CAAC,UACV,QAAuB,qCAAsB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAAE,KAC9D,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,GACpD,YAAI,CAAC,SAAS,MAAM,KAAK,CAAC,QAAQ,IAAI,OAAO,MAAM,eAAe,CAAC,CAC5E;AAAA,EACF,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AIxE9F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC0BA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAK9E,IAAM,iCAAiC,CAC5C,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA6ChE,IAAM,gBAAe,CAC1B,MACA,WAC8B;AAAA,EAC9B,QAAQ,MAAM;AAAA,EACd,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,OAAO,KAAK;AAAA,EACZ,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AAAA,EACb,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,wBAAwB,CACnC,MACA,YACyB;AAAA,EACzB;AAAA,EACA,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AACf;;;ACxHA,IAAM,cAAa,YAA2D;AAAA,EAC5E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,IACnE,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AAAA,EACA,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AAAA,EAC/F,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,kBAAkB,MAAM,CAAC,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe;AAAA,EAC5F,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AACtE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CAAC,MAA+B,UACrD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFXtC,IAAM,sBAAsB,UAA8B,wBAAwB;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAIM,IAAM,iBAAiB,CAAC,IAAY,UACzC,oBAAoB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG1C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,4BAA4B,MAAM;AAAA,EACtE,WAAW,CAAC,UAEP,4BAAkB,EAAE,QAAQ,MAAM,QAAQ,kBAAkB,MAAM,iBAAiB,CAAC,EACpF,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,8BAA8B,MAChC,iBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGtDhG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC+BO,IAAM,gBAAe,CAC1B,MACA,WACsC;AAAA,EACtC,QAAQ,MAAM;AAAA,EACd,sBAAsB,MAAM;AAAA,EAC5B,2BAA2B,MAAM;AAAA,EACjC,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAUO,IAAM,gCAAgC,CAC3C,MACA,QACA,sBACA,+BACiC;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAEA,IAAM,cAAa,YAA2E;AAAA,EAC5F;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAMhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADhEzC,IAAM,8BAA8B,UACzC,gCACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,yBAAyB,CAAC,IAAY,UACjD,4BAA4B,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGlD,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,sCACf,yBAAyB,MAAM,yBAC/B,8BAA8B,MAAM;AAAA,EACtC,WAAW,CAAC,UAEP,oCAA0B;AAAA,IACzB,QAAQ,MAAM;AAAA,IACd,sBAAsB,MAAM;AAAA,IAC5B,2BAA2B,MAAM;AAAA,EACnC,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,sCAAsC,MACxC,iBACP,6BACO,iBAAQ,4BAA4B,SAAS,GAAG,SAAQ,CAAC,CAClE;;AE3EF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACiCO,IAAM,gBAAe,CAC1B,MACA,WACmC;AAAA,EACnC,QAAQ,MAAM;AAAA,EACd,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;AAUO,IAAM,6BAA6B,CACxC,MACA,YAC8B;AAAA,EAC9B;AAAA,EACA,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;;;ACxDA,IAAM,cAAa,YAAqE;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM;AACnE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFCzC,IAAM,2BAA2B,UACtC,6BACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,sBAAsB,CAAC,IAAY,UAC9C,yBAAyB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG/C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,iCAAiC,MAAM;AAAA,EACxD,WAAW,CAAC,UAEP,4CAAuB;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,uBAAuB,MAAM;AAAA,EAC/B,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,mCAAmC,MACrC,iBACP,0BACO,iBAAQ,yBAAyB,SAAS,GAAG,SAAQ,CAAC,CAC/D;;AGnEF;AAWO,IAAM,YAAY,MACjB,eACJ,qBAAqB,GACrB,0BAA0B,GAC1B,uBAAuB,GACvB,qBAAqB,GACrB,6BAA6B,GAC7B,2BAA2B,GAC3B,4BAA4B,GAC5B,oCAAoC,GACpC,iCAAiC,CACnC;",
-  "debugId": "8F60CB2F43A8D0E164756E2164756E21",
+  "debugId": "5A3AB5CE8957273E64756E2164756E21",
   "names": []
 }

package/dist/unifi/network.d.ts

@@ -36,7 +36,7 @@ export declare const UnifiNetwork: import("alchemy").ResourceClass<UnifiNetwork>
  * `OwnedBySomeoneElse`; piping `adopt(true)` here picks the former without a stack having to
  * remember `--adopt`, mirroring `discord/application-command.ts`'s `applicationCommand`.
  */
-export declare const network: (id: string, props: NetworkProps) => Effect.Effect<UnifiNetwork, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const network: (id: string, props: NetworkProps) => Effect.Effect<UnifiNetwork, never, import("effect/http/HttpClient").HttpClient>;
 /**
  * ★ EXPORTED for direct testing against a fake `Credentials` layer (`fake-unifi.ts`), the same
  *   seam `netbox/prefix.ts`'s `spec` and `discord/application-command.ts`'s `spec` use — `handlers`
@@ -48,7 +48,7 @@ export declare const handlers: {
     read: (args: {
         olds: NetworkProps;
         output: NetworkAttributes | undefined;
-    }) => Effect.Effect<NetworkAttributes | undefined, networks.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<NetworkAttributes | undefined, networks.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<NetworkProps>;
         output: NetworkAttributes | undefined;
@@ -56,13 +56,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, networks.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, networks.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: NetworkProps;
-    }) => Effect.Effect<NetworkAttributes, import("./policy.ts").UnifiWriteRefused | networks.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<NetworkAttributes, import("./policy.ts").UnifiWriteRefused | networks.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: NetworkProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiNetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiNetwork>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiNetworkProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiNetwork>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=network.d.ts.map

package/dist/unifi/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,6FACZ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,kIACkD,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,oFACZ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,yHACkD,CAAC"}

package/dist/unifi/providers.d.ts

@@ -9,5 +9,5 @@
  * mirroring `../discord/providers.ts`.
  */
 import * as Layer from 'effect/Layer';
-export declare const providers: () => Layer.Layer<import("alchemy").Provider<import("./acl-rule.ts").UnifiAclRule> | import("alchemy").Provider<import("./acl-rule-ordering.ts").UnifiAclRuleOrdering> | import("alchemy").Provider<import("./dns-policy.ts").UnifiDnsPolicy> | import("alchemy").Provider<import("./firewall-policy.ts").UnifiFirewallPolicy> | import("alchemy").Provider<import("./firewall-policy-ordering.ts").UnifiFirewallPolicyOrdering> | import("alchemy").Provider<import("./firewall-zone.ts").UnifiFirewallZone> | import("alchemy").Provider<import("./network.ts").UnifiNetwork> | import("alchemy").Provider<import("./traffic-matching-list.ts").UnifiTrafficMatchingList> | import("alchemy").Provider<import("./wifi-broadcast.ts").UnifiWifiBroadcast>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const providers: () => Layer.Layer<import("alchemy").Provider<import("./acl-rule.ts").UnifiAclRule> | import("alchemy").Provider<import("./acl-rule-ordering.ts").UnifiAclRuleOrdering> | import("alchemy").Provider<import("./dns-policy.ts").UnifiDnsPolicy> | import("alchemy").Provider<import("./firewall-policy.ts").UnifiFirewallPolicy> | import("alchemy").Provider<import("./firewall-policy-ordering.ts").UnifiFirewallPolicyOrdering> | import("alchemy").Provider<import("./firewall-zone.ts").UnifiFirewallZone> | import("alchemy").Provider<import("./network.ts").UnifiNetwork> | import("alchemy").Provider<import("./traffic-matching-list.ts").UnifiTrafficMatchingList> | import("alchemy").Provider<import("./wifi-broadcast.ts").UnifiWifiBroadcast>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=providers.d.ts.map

package/dist/unifi/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/unifi/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAWtC,eAAO,MAAM,SAAS,0xBAWnB,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/unifi/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AAWtC,eAAO,MAAM,SAAS,ixBAWnB,CAAC"}

package/dist/unifi/resource.d.ts

@@ -1,7 +1,7 @@
 import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/unstable/http/HttpClient';
+import * as HttpClient from 'effect/http/HttpClient';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,iCAAiC,CAAC;AAG9D,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;IAChF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAChF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAEtB,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;sBAIP,KAAK;oBAYP,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EAStB;CACF;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,mFAE7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAC9E,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAMzC,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5GtB,QAAQ;;yBAElC,MAAM;;IA4GzB,SAAS,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACjC,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAGrD,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;IAChF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAChF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAEtB,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;sBAIP,KAAK;oBAYP,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EAStB;CACF;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,mFAE7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAC9E,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAMzC,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5GtB,QAAQ;;yBAElC,MAAM;;IA4GzB,SAAS,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACjC,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -23,7 +23,7 @@ export interface UnifiTrafficMatchingList extends Resource<'Unifi.TrafficMatchin
 export declare const UnifiTrafficMatchingList: import("alchemy").ResourceClass<UnifiTrafficMatchingList>;
 /** `trafficMatchingList('office-subnets', props)` — `adopt(true)` piped on by default (H5); see
  *  `network.ts`. */
-export declare const trafficMatchingList: (id: string, props: TrafficMatchingListProps) => Effect.Effect<UnifiTrafficMatchingList, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const trafficMatchingList: (id: string, props: TrafficMatchingListProps) => Effect.Effect<UnifiTrafficMatchingList, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<TrafficMatchingListProps, trafficMatchingLists.TrafficMatchingList, TrafficMatchingListAttributes, trafficMatchingLists.GetTrafficMatchingListError>;
 export declare const handlers: {
@@ -31,7 +31,7 @@ export declare const handlers: {
     read: (args: {
         olds: TrafficMatchingListProps;
         output: TrafficMatchingListAttributes | undefined;
-    }) => Effect.Effect<TrafficMatchingListAttributes | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<TrafficMatchingListAttributes | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<TrafficMatchingListProps>;
         output: TrafficMatchingListAttributes | undefined;
@@ -39,13 +39,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: TrafficMatchingListProps;
-    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: TrafficMatchingListProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiTrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiTrafficMatchingList>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiTrafficMatchingListProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiTrafficMatchingList>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=traffic-matching-list.d.ts.map

package/dist/unifi/traffic-matching-list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,yGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,8IAI1C,CAAC"}
+{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,gGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,qIAI1C,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -45,7 +45,7 @@ export interface UnifiWifiBroadcast extends Resource<'Unifi.WifiBroadcast', Wifi
 }
 export declare const UnifiWifiBroadcast: import("alchemy").ResourceClass<UnifiWifiBroadcast>;
 /** `wifiBroadcast('guest', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */
-export declare const wifiBroadcast: (id: string, props: WifiBroadcastProps) => Effect.Effect<UnifiWifiBroadcast, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const wifiBroadcast: (id: string, props: WifiBroadcastProps) => Effect.Effect<UnifiWifiBroadcast, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
 export declare const spec: UnifiSpec<WifiBroadcastProps, wifiBroadcasts.WifiBroadcastOverview, WifiBroadcastAttributes, wifiBroadcasts.GetWifiBroadcastPageError | UnifiPaginationInconsistent>;
 export declare const handlers: {
@@ -53,7 +53,7 @@ export declare const handlers: {
     read: (args: {
         olds: WifiBroadcastProps;
         output: WifiBroadcastAttributes | undefined;
-    }) => Effect.Effect<WifiBroadcastAttributes | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<WifiBroadcastAttributes | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<WifiBroadcastProps>;
         output: WifiBroadcastAttributes | undefined;
@@ -61,13 +61,13 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    } | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: WifiBroadcastProps;
-    }) => Effect.Effect<WifiBroadcastAttributes, UnifiPaginationInconsistent | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<WifiBroadcastAttributes, UnifiPaginationInconsistent | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: WifiBroadcastProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/unstable/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
-export declare const UnifiWifiBroadcastProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiWifiBroadcast>, never, import("effect/unstable/http/HttpClient").HttpClient>;
+export declare const UnifiWifiBroadcastProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiWifiBroadcast>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=wifi-broadcast.d.ts.map

package/dist/unifi/wifi-broadcast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,mGAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,wIACwD,CAAC"}
+{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,0FAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,+HACwD,CAAC"}

package/dist/verify/cli.js.map

@@ -3,7 +3,7 @@
   "sources": ["../src/verify/cli.ts", "../src/verify/args.ts", "../src/verify/report.ts", "../src/verify/verify.ts", "../src/verify/plan-scope.ts", "../src/verify/recheck.ts", "../src/verify/rows.ts", "../src/verify/spy.ts"],
   "sourcesContent": [
     "#!/usr/bin/env node\n/**\n * `hf-adopt-verify` — the bin. Parse, verify, print, exit 0 / 1 / 2.\n *\n * ★ `runMain` IS ALCHEMY'S (alchemy/Util/PlatformServices), so this runs under bun or node the way\n *   `alchemy` itself does, and exits once the report is out rather than lingering on keep-alive\n *   sockets. Run it where the stack's `alchemy` runs: `bunx --bun hf-adopt-verify …` next to\n *   `bun ./node_modules/alchemy/bin/cli.js plan …`, because the entrypoint it imports is\n *   TypeScript.\n * ⛔ EXIT 2 IS \"COULD NOT TELL\", NEVER A PASS. A plan that fails — a provider that dies, an\n *   `adopt(false)` row that is not ours, a state store it cannot read — prints the cause and exits\n *   2, so a gate reading `!= 0` stops either way.\n */\nimport { runMain } from 'alchemy/Util/PlatformServices';\nimport * as Cause from 'effect/Cause';\nimport * as Console from 'effect/Console';\nimport * as Effect from 'effect/Effect';\nimport { USAGE, parseVerifyArgs } from './args.ts';\nimport { exitCodeOf, formatReport } from './report.ts';\nimport { verifyStack } from './verify.ts';\n\nconst setExit = (code: number) =>\n  Effect.sync(() => {\n    process.exitCode = code;\n  });\n\nconst program = Effect.gen(function* () {\n  const parsed = parseVerifyArgs(process.argv.slice(2), process.env);\n  if (parsed.kind === 'help') return yield* Console.log(USAGE);\n  if (parsed.kind === 'error') {\n    yield* Console.error(`hf-adopt-verify: ${parsed.message}\\n\\n${USAGE}`);\n    return yield* setExit(2);\n  }\n  const report = yield* verifyStack(parsed.target, parsed.options);\n  yield* Console.log(\n    parsed.json\n      ? JSON.stringify(report, null, 2)\n      : formatReport(report, parsed.options.all === true),\n  );\n  yield* setExit(exitCodeOf(report));\n}).pipe(\n  Effect.catchCause((cause) =>\n    Console.error(`hf-adopt-verify: the plan could not be verified\\n${Cause.pretty(cause)}`).pipe(\n      Effect.andThen(setExit(2)),\n    ),\n  ),\n);\n\nrunMain(program);\n",
-    "/**\n * `hf-adopt-verify`'s flags — the ones `alchemy plan` takes, so a stack script can swap one\n * command for the other.\n *\n * ★ `node:util` parseArgs, NOT effect's CLI module. Alchemy builds its CLI on\n *   `effect/unstable/cli`, but that needs a CliConfig and a Terminal layer to parse six flags; the\n *   standard library parses them with no service at all, which keeps this pure and testable.\n * ⛔ `--stage` HAS NO GUESSED DEFAULT. Alchemy falls back to `live_$USER`; a gate that silently\n *   verified the wrong stage would pass for the wrong reason. It comes from the flag or from\n *   `$ALCHEMY_STAGE`, or the run stops.\n */\nimport { parseArgs } from 'node:util';\nimport type { VerifyOptions, VerifyTarget } from './verify.ts';\n\nexport const USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n`;\n\nexport type Parsed =\n  | { readonly kind: 'help' }\n  | { readonly kind: 'error'; readonly message: string }\n  | {\n      readonly kind: 'run';\n      readonly target: VerifyTarget;\n      readonly options: VerifyOptions;\n      readonly json: boolean;\n    };\n\nconst parse = (argv: readonly string[]) =>\n  parseArgs({\n    args: [...argv],\n    allowPositionals: false,\n    options: {\n      all: { type: 'boolean', default: false },\n      config: { type: 'string', short: 'c', default: 'alchemy.run.ts' },\n      'env-file': { type: 'string' },\n      help: { type: 'boolean', short: 'h', default: false },\n      json: { type: 'boolean', default: false },\n      profile: { type: 'string' },\n      stage: { type: 'string' },\n    },\n    strict: true,\n  });\n\n/** Parse argv (without the runtime and script) against the environment. Never throws. */\nexport const parseVerifyArgs = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n): Parsed => {\n  let parsed: ReturnType<typeof parse>;\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    return { kind: 'error', message: error instanceof Error ? error.message : String(error) };\n  }\n  const { values } = parsed;\n  if (values.help) return { kind: 'help' };\n  const stage = values.stage ?? env['ALCHEMY_STAGE'];\n  if (stage === undefined || stage === '') {\n    return { kind: 'error', message: 'pass --stage (or set ALCHEMY_STAGE): no stage is guessed' };\n  }\n  const target: VerifyTarget = {\n    entrypoint: values.config,\n    stage,\n    ...(values.profile === undefined ? {} : { profile: values.profile }),\n    ...(values['env-file'] === undefined ? {} : { envFile: values['env-file'] }),\n  };\n  return { json: values.json, kind: 'run', options: { all: values.all }, target };\n};\n",
+    "/**\n * `hf-adopt-verify`'s flags — the ones `alchemy plan` takes, so a stack script can swap one\n * command for the other.\n *\n * ★ `node:util` parseArgs, NOT effect's CLI module. Alchemy builds its CLI on\n *   `effect/cli`, but that needs a CliConfig and a Terminal layer to parse six flags; the\n *   standard library parses them with no service at all, which keeps this pure and testable.\n * ⛔ `--stage` HAS NO GUESSED DEFAULT. Alchemy falls back to `live_$USER`; a gate that silently\n *   verified the wrong stage would pass for the wrong reason. It comes from the flag or from\n *   `$ALCHEMY_STAGE`, or the run stops.\n */\nimport { parseArgs } from 'node:util';\nimport type { VerifyOptions, VerifyTarget } from './verify.ts';\n\nexport const USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n`;\n\nexport type Parsed =\n  | { readonly kind: 'help' }\n  | { readonly kind: 'error'; readonly message: string }\n  | {\n      readonly kind: 'run';\n      readonly target: VerifyTarget;\n      readonly options: VerifyOptions;\n      readonly json: boolean;\n    };\n\nconst parse = (argv: readonly string[]) =>\n  parseArgs({\n    args: [...argv],\n    allowPositionals: false,\n    options: {\n      all: { type: 'boolean', default: false },\n      config: { type: 'string', short: 'c', default: 'alchemy.run.ts' },\n      'env-file': { type: 'string' },\n      help: { type: 'boolean', short: 'h', default: false },\n      json: { type: 'boolean', default: false },\n      profile: { type: 'string' },\n      stage: { type: 'string' },\n    },\n    strict: true,\n  });\n\n/** Parse argv (without the runtime and script) against the environment. Never throws. */\nexport const parseVerifyArgs = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n): Parsed => {\n  let parsed: ReturnType<typeof parse>;\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    return { kind: 'error', message: error instanceof Error ? error.message : String(error) };\n  }\n  const { values } = parsed;\n  if (values.help) return { kind: 'help' };\n  const stage = values.stage ?? env['ALCHEMY_STAGE'];\n  if (stage === undefined || stage === '') {\n    return { kind: 'error', message: 'pass --stage (or set ALCHEMY_STAGE): no stage is guessed' };\n  }\n  const target: VerifyTarget = {\n    entrypoint: values.config,\n    stage,\n    ...(values.profile === undefined ? {} : { profile: values.profile }),\n    ...(values['env-file'] === undefined ? {} : { envFile: values['env-file'] }),\n  };\n  return { json: values.json, kind: 'run', options: { all: values.all }, target };\n};\n",
     "/**\n * The verifier's answer, for a terminal and for a gate.\n *\n * ⛔ NAMES, NEVER VALUES. A row lists which declared fields differ from the live object, not what\n *   either side holds: the tool runs over any stack, and a prop or an attribute can be a secret.\n *   `alchemy plan --detailed` shows declared values; the family's own read shows live ones.\n */\nimport type { AdoptRow } from './rows.ts';\nimport type { AdoptReport } from './verify.ts';\n\n/** 0 when every reported row is a no-op, 1 when any is not. (2 is the CLI's: it could not tell.) */\nexport const exitCodeOf = (report: AdoptReport): 0 | 1 =>\n  report.rows.every((row) => row.ok) ? 0 : 1;\n\nconst pad = (text: string, width: number) => text.padEnd(width);\n\nconst line = (row: AdoptRow, widths: { planned: number; type: number }) => {\n  const head = [\n    row.ok ? 'ok  ' : 'FAIL',\n    pad(row.planned, widths.planned),\n    pad(row.diff, 8),\n    pad(row.read, 9),\n    pad(row.type, widths.type),\n    row.fqn,\n  ].join('  ');\n  const changed = row.changed.length > 0 ? `  changed: ${row.changed.join(', ')}` : '';\n  return row.why === '' ? `${head}${changed}` : `${head}${changed}\\n      ${row.why}`;\n};\n\n/** Plain text, one row per line, with the reason under any row that is not a no-op. */\nexport const formatReport = (report: AdoptReport, all: boolean): string => {\n  const scope = all ? 'every row' : 'rows without state';\n  const title = `hf-adopt-verify ${report.stack}/${report.stage}: ${String(report.rows.length)} ${scope} (of ${String(report.declared)} declared)`;\n  if (report.rows.length === 0) {\n    return `${title}\\nnothing to verify — every declared row already has state. --all checks those too.\\n`;\n  }\n  const widths = {\n    planned: Math.max(7, ...report.rows.map((row) => row.planned.length)),\n    type: Math.max(4, ...report.rows.map((row) => row.type.length)),\n  };\n  const header = ['    ', pad('planned', widths.planned), pad('diff', 8), pad('read', 9)]\n    .concat([pad('type', widths.type), 'fqn'])\n    .join('  ');\n  const failed = report.rows.filter((row) => !row.ok).length;\n  const verdict =\n    failed === 0\n      ? 'every row is a no-op: the deploy writes nothing to them'\n      : `${String(failed)} row(s) are NOT a no-op: the deploy would write, create or delete`;\n  return [title, '', header, ...report.rows.map((row) => line(row, widths)), '', verdict, ''].join(\n    '\\n',\n  );\n};\n",
     "/**\n * Prove a deploy's adoptions are no-ops — with Alchemy's own planner, before anything is written.\n *\n * ★ THE ENGINE PLANS, THIS ONLY WATCHES. `verifySession` runs `Plan.make` — the same call\n *   `alchemy plan` makes (Alchemist routes/stack.ts) — over the session's context with every\n *   provider swapped for a watched copy (spy.ts). Output resolution, the state lookup, rename\n *   migrations, the adoption probe and `adopt(…)` all stay the engine's; nothing here re-derives\n *   them. What it adds is the provider's own `diff` answer, which Plan.ts overwrites for every\n *   adopted row (`forceUpdateAfterAdoption`), and the state-row check that says which rows ARE\n *   adoptions.\n *\n * ⛔ READ-ONLY BY CONSTRUCTION. The planner calls `read` and `diff`; spy.ts replaces `reconcile`,\n *   `delete` and `precreate` with refusals; nothing here calls `apply`. `--all` adds one `read` per\n *   row with state, and recheck.ts one more `diff` for an adopted `noop` whose read differs from\n *   the declaration — both still reads by Alchemy's provider contract.\n * ⚠️ READS ARE NOT FREE FOR EVERY FAMILY. A kit PVE/PBS read mints a lease through OpenBao, which\n *   creates a short-lived API token on the cluster, exactly as `alchemy plan` does.\n */\nimport * as Alchemist from 'alchemy/Alchemist';\nimport * as Plan from 'alchemy/Plan';\nimport type { ProviderService } from 'alchemy/Provider';\nimport type { CompiledStack } from 'alchemy/Stack';\nimport { State, isActionState } from 'alchemy/State';\nimport type * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\nimport { inPlanScope } from './plan-scope.ts';\nimport { recheck } from './recheck.ts';\nimport { type AdoptRow, type PlanView, rowsOf } from './rows.ts';\nimport { type Observations, spyContext } from './spy.ts';\n\nexport interface VerifyOptions {\n  /** Report every declared row and every pending deletion, not only rows without state. */\n  readonly all?: boolean;\n}\n\nexport interface AdoptReport {\n  readonly stack: string;\n  readonly stage: string;\n  /** Resources the stack declares. */\n  readonly declared: number;\n  readonly rows: readonly AdoptRow[];\n}\n\n/** An imported stack and the context it plans under — what `Alchemist.open` returns. */\nexport interface VerifySession {\n  readonly stack: CompiledStack<unknown, unknown>;\n  readonly context: Context.Context<unknown>;\n}\n\n/** The plan-node fields `--all` needs to read a row that has state, and the recheck to replay a diff. */\ntype StatefulNode = {\n  readonly action: string;\n  readonly provider?: ProviderService;\n  readonly resource: { readonly LogicalId: string };\n  readonly state?: {\n    readonly instanceId: string;\n    readonly props: object;\n    readonly attr: object | undefined;\n  };\n};\n\n/** ⚠️ In the scope Plan.ts gives its own reads (plan-scope.ts). */\nconst readWithState = (fqn: string, node: StatefulNode) =>\n  Effect.gen(function* () {\n    const read = node.provider?.read;\n    if (read === undefined || node.state === undefined) return;\n    yield* read({\n      fqn,\n      id: node.resource.LogicalId,\n      instanceId: node.state.instanceId,\n      olds: node.state.props,\n      output: node.state.attr,\n    }).pipe(inPlanScope(fqn, node.state.instanceId));\n  });\n\n/**\n * Which planned rows plan FROM a resource row the stage's state store holds for them.\n *\n * ⚠️ THE ROW MUST BE THE ONE THE NODE PLANS FROM, NOT MERELY A ROW AT THE SAME FQN. Alchemy lets a\n *   rename hand its old id to a new resource in the same deploy (Rename.ts: `Bucket(\"Assets\")\n *   .pipe(renamedFrom(\"Bucket\"))` beside a fresh `Bucket(\"Bucket\")`). The store still holds the\n *   renamer's row at `Bucket`, so a check by FQN alone called the reuser stateful and the default\n *   report hid its `create`. Matching the node's `state.instanceId` also sees the renamer, whose\n *   row still sits at its FORMER FQN, as a row without state.\n */\nconst withState = (\n  stack: CompiledStack<unknown, unknown>,\n  nodes: Readonly<Record<string, StatefulNode>>,\n) =>\n  Effect.gen(function* () {\n    const store = yield* yield* State;\n    const found = yield* Effect.all(\n      Object.entries(nodes).map(([fqn, node]) =>\n        store\n          .get({ fqn, stack: stack.name, stage: stack.stage })\n          .pipe(\n            Effect.map((row) =>\n              row === undefined ||\n              isActionState(row) ||\n              (row as { readonly instanceId?: unknown }).instanceId !== node.state?.instanceId\n                ? []\n                : [fqn],\n            ),\n          ),\n      ),\n      { concurrency: 8 },\n    );\n    return new Set(found.flat());\n  });\n\n/**\n * Plan `session.stack` with watched providers and report each row without state (or, with\n * `all`, every row). Never writes.\n */\nexport const verifySession = (\n  session: VerifySession,\n  options: VerifyOptions = {},\n): Effect.Effect<AdoptReport, unknown> => {\n  const seen: Observations = new Map();\n  const all = options.all === true;\n  // ⚠️ THE CAST IS AT THE ENGINE'S TYPED BOUNDARY. `Plan.make` declares only `State` and hides the\n  //   rest behind a ts-expect-error; the session context carries all of it, as in routes/stack.ts.\n  const plan = Plan.make(session.stack) as unknown as Effect.Effect<\n    PlanView & { readonly resources: Readonly<Record<string, StatefulNode>> },\n    unknown\n  >;\n  return Effect.gen(function* () {\n    const planned = yield* plan;\n    const stateRows = yield* withState(session.stack, planned.resources);\n    // ★ Before the rows are judged: an adopted `noop` beside a differing read is asked again.\n    yield* Effect.all(\n      Object.entries(planned.resources).map(([fqn, node]) => recheck(fqn, node, seen)),\n      { concurrency: 8 },\n    );\n    if (all) {\n      const stateful = Object.entries(planned.resources).filter(([fqn]) => stateRows.has(fqn));\n      yield* Effect.all(\n        stateful.map(([fqn, node]) =>\n          readWithState(fqn, node).pipe(\n            Effect.catchCause(() =>\n              Effect.sync(() => {\n                const entry = seen.get(fqn) ?? {};\n                entry.read = { answer: 'failed', attributes: undefined };\n                seen.set(fqn, entry);\n              }),\n            ),\n          ),\n        ),\n        { concurrency: 8 },\n      );\n    }\n    return {\n      declared: Object.keys(planned.resources).length,\n      rows: rowsOf(planned, stateRows, seen, all),\n      stack: session.stack.name,\n      stage: session.stack.stage,\n    } satisfies AdoptReport;\n  }).pipe(Effect.provide(spyContext(session.context, seen)), Effect.scoped);\n};\n\n/** Where the stack lives — the fields `alchemy plan` takes as flags. */\nexport interface VerifyTarget {\n  /** The stack entrypoint, e.g. `alchemy.run.ts`. */\n  readonly entrypoint: string;\n  readonly stage: string;\n  readonly profile?: string;\n  readonly envFile?: string;\n}\n\n/**\n * Import the stack the way the Alchemy CLI does and verify it.\n *\n * ★ `adopt: true`, ALWAYS, AND IT CANNOT WRITE. Planning is side-effect free (Plan.ts keeps the\n *   adopted state in memory, alchemy#793), so the flag only lets an `Unowned` row reach its\n *   `diff` instead of failing the plan — the report marks it, because the real deploy then needs\n *   `--adopt`. A resource declared `.pipe(adopt(false))` still fails the plan, as it would deploy.\n */\nexport const verifyStack = (\n  target: VerifyTarget,\n  options: VerifyOptions = {},\n): Effect.Effect<AdoptReport, unknown> =>\n  Effect.gen(function* () {\n    const session = yield* Alchemist.open(target, { adopt: true });\n    return yield* verifySession(session, options);\n  }).pipe(Effect.scoped, Effect.provide(Alchemist.layer()));\n",
     "/**\n * The scope Plan.ts gives every provider call it makes, for the calls the verifier makes itself\n * after the plan: `--all`'s reads (verify.ts) and the recheck's diffs (recheck.ts).\n *\n * ⚠️ RE-CREATED, BECAUSE Plan.ts DOES NOT EXPORT IT (`providePlanScope`, alchemy beta.79): a scoped\n *   `Artifacts` bag over the run's `ArtifactStore` (a fresh one when none is provided) and the row's\n *   `InstanceId`. A kit family that consults either — the ownership helpers do — sees what it\n *   would see under `alchemy plan`. Moved here from verify.ts once a second caller needed it.\n */\nimport {\n  ArtifactStore,\n  Artifacts,\n  createArtifactStore,\n  makeScopedArtifacts,\n} from 'alchemy/Artifacts';\nimport { InstanceId } from 'alchemy/InstanceId';\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\n\nexport const inPlanScope =\n  (fqn: string, instanceId: string) =>\n  <A, E, R>(\n    effect: Effect.Effect<A, E, R>,\n  ): Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>> =>\n    Effect.gen(function* () {\n      const store = Option.getOrElse(\n        yield* Effect.serviceOption(ArtifactStore),\n        createArtifactStore,\n      );\n      return yield* effect.pipe(\n        Effect.provideService(Artifacts, makeScopedArtifacts(store, fqn)),\n        Effect.provideService(InstanceId, instanceId),\n      );\n    }) as Effect.Effect<A, E, Exclude<R, Artifacts | InstanceId>>;\n",

package/dist/verify/index.js.map

@@ -2,7 +2,7 @@
   "version": 3,
   "sources": ["../src/verify/args.ts", "../src/verify/report.ts", "../src/verify/rows.ts", "../src/verify/spy.ts", "../src/verify/verify.ts", "../src/verify/plan-scope.ts", "../src/verify/recheck.ts"],
   "sourcesContent": [
-    "/**\n * `hf-adopt-verify`'s flags — the ones `alchemy plan` takes, so a stack script can swap one\n * command for the other.\n *\n * ★ `node:util` parseArgs, NOT effect's CLI module. Alchemy builds its CLI on\n *   `effect/unstable/cli`, but that needs a CliConfig and a Terminal layer to parse six flags; the\n *   standard library parses them with no service at all, which keeps this pure and testable.\n * ⛔ `--stage` HAS NO GUESSED DEFAULT. Alchemy falls back to `live_$USER`; a gate that silently\n *   verified the wrong stage would pass for the wrong reason. It comes from the flag or from\n *   `$ALCHEMY_STAGE`, or the run stops.\n */\nimport { parseArgs } from 'node:util';\nimport type { VerifyOptions, VerifyTarget } from './verify.ts';\n\nexport const USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n`;\n\nexport type Parsed =\n  | { readonly kind: 'help' }\n  | { readonly kind: 'error'; readonly message: string }\n  | {\n      readonly kind: 'run';\n      readonly target: VerifyTarget;\n      readonly options: VerifyOptions;\n      readonly json: boolean;\n    };\n\nconst parse = (argv: readonly string[]) =>\n  parseArgs({\n    args: [...argv],\n    allowPositionals: false,\n    options: {\n      all: { type: 'boolean', default: false },\n      config: { type: 'string', short: 'c', default: 'alchemy.run.ts' },\n      'env-file': { type: 'string' },\n      help: { type: 'boolean', short: 'h', default: false },\n      json: { type: 'boolean', default: false },\n      profile: { type: 'string' },\n      stage: { type: 'string' },\n    },\n    strict: true,\n  });\n\n/** Parse argv (without the runtime and script) against the environment. Never throws. */\nexport const parseVerifyArgs = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n): Parsed => {\n  let parsed: ReturnType<typeof parse>;\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    return { kind: 'error', message: error instanceof Error ? error.message : String(error) };\n  }\n  const { values } = parsed;\n  if (values.help) return { kind: 'help' };\n  const stage = values.stage ?? env['ALCHEMY_STAGE'];\n  if (stage === undefined || stage === '') {\n    return { kind: 'error', message: 'pass --stage (or set ALCHEMY_STAGE): no stage is guessed' };\n  }\n  const target: VerifyTarget = {\n    entrypoint: values.config,\n    stage,\n    ...(values.profile === undefined ? {} : { profile: values.profile }),\n    ...(values['env-file'] === undefined ? {} : { envFile: values['env-file'] }),\n  };\n  return { json: values.json, kind: 'run', options: { all: values.all }, target };\n};\n",
+    "/**\n * `hf-adopt-verify`'s flags — the ones `alchemy plan` takes, so a stack script can swap one\n * command for the other.\n *\n * ★ `node:util` parseArgs, NOT effect's CLI module. Alchemy builds its CLI on\n *   `effect/cli`, but that needs a CliConfig and a Terminal layer to parse six flags; the\n *   standard library parses them with no service at all, which keeps this pure and testable.\n * ⛔ `--stage` HAS NO GUESSED DEFAULT. Alchemy falls back to `live_$USER`; a gate that silently\n *   verified the wrong stage would pass for the wrong reason. It comes from the flag or from\n *   `$ALCHEMY_STAGE`, or the run stops.\n */\nimport { parseArgs } from 'node:util';\nimport type { VerifyOptions, VerifyTarget } from './verify.ts';\n\nexport const USAGE = `Usage: hf-adopt-verify --stage <stage> [--config alchemy.run.ts] [options]\n\nPlans the stack with Alchemy's own planner, never writes, and reports each row\nwithout a state row: what the engine planned, the provider's read and its own\ndiff (before Alchemy forces adopted rows to update), and the declared fields\nthat differ from the live object. Exits 0 when every row is a no-op, 1 when\nany is not, 2 when it could not tell.\n\n  -c, --config <file>   stack entrypoint (default alchemy.run.ts)\n      --stage <stage>   stage to verify (default $ALCHEMY_STAGE; required)\n      --profile <name>  Alchemy auth profile\n      --env-file <file> .env file layered under the environment\n      --all             report every declared row and pending deletion\n      --json            print the report as JSON\n  -h, --help            this text\n`;\n\nexport type Parsed =\n  | { readonly kind: 'help' }\n  | { readonly kind: 'error'; readonly message: string }\n  | {\n      readonly kind: 'run';\n      readonly target: VerifyTarget;\n      readonly options: VerifyOptions;\n      readonly json: boolean;\n    };\n\nconst parse = (argv: readonly string[]) =>\n  parseArgs({\n    args: [...argv],\n    allowPositionals: false,\n    options: {\n      all: { type: 'boolean', default: false },\n      config: { type: 'string', short: 'c', default: 'alchemy.run.ts' },\n      'env-file': { type: 'string' },\n      help: { type: 'boolean', short: 'h', default: false },\n      json: { type: 'boolean', default: false },\n      profile: { type: 'string' },\n      stage: { type: 'string' },\n    },\n    strict: true,\n  });\n\n/** Parse argv (without the runtime and script) against the environment. Never throws. */\nexport const parseVerifyArgs = (\n  argv: readonly string[],\n  env: Readonly<Record<string, string | undefined>>,\n): Parsed => {\n  let parsed: ReturnType<typeof parse>;\n  try {\n    parsed = parse(argv);\n  } catch (error) {\n    return { kind: 'error', message: error instanceof Error ? error.message : String(error) };\n  }\n  const { values } = parsed;\n  if (values.help) return { kind: 'help' };\n  const stage = values.stage ?? env['ALCHEMY_STAGE'];\n  if (stage === undefined || stage === '') {\n    return { kind: 'error', message: 'pass --stage (or set ALCHEMY_STAGE): no stage is guessed' };\n  }\n  const target: VerifyTarget = {\n    entrypoint: values.config,\n    stage,\n    ...(values.profile === undefined ? {} : { profile: values.profile }),\n    ...(values['env-file'] === undefined ? {} : { envFile: values['env-file'] }),\n  };\n  return { json: values.json, kind: 'run', options: { all: values.all }, target };\n};\n",
     "/**\n * The verifier's answer, for a terminal and for a gate.\n *\n * ⛔ NAMES, NEVER VALUES. A row lists which declared fields differ from the live object, not what\n *   either side holds: the tool runs over any stack, and a prop or an attribute can be a secret.\n *   `alchemy plan --detailed` shows declared values; the family's own read shows live ones.\n */\nimport type { AdoptRow } from './rows.ts';\nimport type { AdoptReport } from './verify.ts';\n\n/** 0 when every reported row is a no-op, 1 when any is not. (2 is the CLI's: it could not tell.) */\nexport const exitCodeOf = (report: AdoptReport): 0 | 1 =>\n  report.rows.every((row) => row.ok) ? 0 : 1;\n\nconst pad = (text: string, width: number) => text.padEnd(width);\n\nconst line = (row: AdoptRow, widths: { planned: number; type: number }) => {\n  const head = [\n    row.ok ? 'ok  ' : 'FAIL',\n    pad(row.planned, widths.planned),\n    pad(row.diff, 8),\n    pad(row.read, 9),\n    pad(row.type, widths.type),\n    row.fqn,\n  ].join('  ');\n  const changed = row.changed.length > 0 ? `  changed: ${row.changed.join(', ')}` : '';\n  return row.why === '' ? `${head}${changed}` : `${head}${changed}\\n      ${row.why}`;\n};\n\n/** Plain text, one row per line, with the reason under any row that is not a no-op. */\nexport const formatReport = (report: AdoptReport, all: boolean): string => {\n  const scope = all ? 'every row' : 'rows without state';\n  const title = `hf-adopt-verify ${report.stack}/${report.stage}: ${String(report.rows.length)} ${scope} (of ${String(report.declared)} declared)`;\n  if (report.rows.length === 0) {\n    return `${title}\\nnothing to verify — every declared row already has state. --all checks those too.\\n`;\n  }\n  const widths = {\n    planned: Math.max(7, ...report.rows.map((row) => row.planned.length)),\n    type: Math.max(4, ...report.rows.map((row) => row.type.length)),\n  };\n  const header = ['    ', pad('planned', widths.planned), pad('diff', 8), pad('read', 9)]\n    .concat([pad('type', widths.type), 'fqn'])\n    .join('  ');\n  const failed = report.rows.filter((row) => !row.ok).length;\n  const verdict =\n    failed === 0\n      ? 'every row is a no-op: the deploy writes nothing to them'\n      : `${String(failed)} row(s) are NOT a no-op: the deploy would write, create or delete`;\n  return [title, '', header, ...report.rows.map((row) => line(row, widths)), '', verdict, ''].join(\n    '\\n',\n  );\n};\n",
     "/**\n * One report row per planned resource: what the engine planned, what the provider said, and\n * whether that adds up to \"this deploy leaves the object alone\".\n *\n * ★ PURE, SO THE VERDICT IS TESTABLE WITHOUT AN ENGINE. verify.ts gathers the three inputs — the\n *   plan, which FQNs have a state row, and what the watched providers answered (spy.ts) — and\n *   this file only decides.\n */\nimport { deepEqual, isResolved } from 'alchemy/Diff';\nimport type { DiffAnswer, Observations, ReadAnswer, RecheckAnswer } from './spy.ts';\n\nexport interface AdoptRow {\n  readonly fqn: string;\n  readonly type: string;\n  /**\n   * Whether the row plans from a row the state store holds for it (verify.ts `withState`). An\n   * adoption is a row without one.\n   */\n  readonly stateRow: boolean;\n  /** The engine's action — what `alchemy plan` prints (`adopted`, `create`, `noop`, …). */\n  readonly planned: string;\n  /** What the provider's `read` answered, or `not-read` when nothing asked it. */\n  readonly read: ReadAnswer;\n  /** What the provider's own `diff` answered BEFORE Plan.ts forced it (spy.ts). */\n  readonly diff: DiffAnswer;\n  /**\n   * Declared fields whose live value differs, by NAME only — values can be secrets. Compared on\n   * same-named keys of the declaration and the read's attributes, so a family whose attributes\n   * rename a field cannot show it here. The diff answer is the verdict; a name here beside an\n   * adopted `noop` only makes recheck.ts ask that diff again.\n   */\n  readonly changed: readonly string[];\n  /**\n   * What the provider's `diff` answered when asked again with the live values of `changed` as its\n   * recorded props (recheck.ts). Absent when it was not asked: only an adopted `noop` with\n   * something in `changed` is.\n   */\n  readonly recheck?: RecheckAnswer;\n  /** Bindings the engine will create, update or delete — reconcile applies them even on `noop`. */\n  readonly bindings: number;\n  readonly ok: boolean;\n  /** Why the row is not a no-op, or a note on one that is; empty when there is nothing to say. */\n  readonly why: string;\n}\n\n/** The slice of an Alchemy plan node this file reads. */\nexport interface NodeView {\n  readonly action: string;\n  readonly resource: { readonly Type: string };\n  readonly bindings?: readonly { readonly action: string }[];\n}\n\n/** A stack task (an Alchemy action): `run`, `noop` or `delete`. It has no provider to ask. */\nexport interface TaskView {\n  readonly action: string;\n  readonly def: { readonly Type: string };\n}\n\n/** The slice of an Alchemy `Plan` this file reads. */\nexport interface PlanView {\n  readonly resources: Readonly<Record<string, NodeView>>;\n  readonly deletions: Readonly<Record<string, NodeView | undefined>>;\n  readonly actions?: Readonly<Record<string, TaskView | undefined>>;\n}\n\n/** Same-named, declared, resolved fields where the live value differs. */\nexport const changedFields = (declared: unknown, live: unknown): string[] => {\n  if (typeof declared !== 'object' || declared === null) return [];\n  if (typeof live !== 'object' || live === null) return [];\n  const actual = live as Record<string, unknown>;\n  return Object.entries(declared as Record<string, unknown>)\n    .filter(([key, value]) => value !== undefined && key in actual && isResolved(value))\n    .filter(([key, value]) => !deepEqual(value, actual[key]))\n    .map(([key]) => key)\n    .sort();\n};\n\nconst STILL_LIVE = new Set(['adopted', 'noop']);\n\n/**\n * ⛔ `adopted` NEEDS THE PROVIDER'S OWN `noop`. With no diff (`none`) the engine compared the\n *   declaration with the declaration — an adopted row's state carries `props: news` (Plan.ts) — so\n *   its noop proves nothing. A row with state is different: there the engine compared against the\n *   props it last deployed, which is the same check `alchemy plan` makes.\n */\nconst isNoop = (planned: string, diff: DiffAnswer, stateRow: boolean) =>\n  STILL_LIVE.has(planned) &&\n  (diff === 'noop' || (diff === 'none' && stateRow && planned === 'noop'));\n\n/**\n * ⛔ AND A `noop` MUST SURVIVE BEING ASKED WITH THE LIVE VALUES. A diff that compares recorded props\n *   answers an adopted row `noop` whatever the cloud holds; recheck.ts asks it again, and only a\n *   second `noop` (or no need to ask) proves anything.\n */\nconst proven = (recheck: RecheckAnswer | undefined) => recheck === undefined || recheck === 'noop';\n\n/** Notes on a row that passes: nothing to say is the common case. */\nconst notes = (row: Omit<AdoptRow, 'ok' | 'why'>): string =>\n  [\n    row.read === 'unowned' ? 'unowned: the deploy needs --adopt or adopt(true)' : '',\n    row.recheck === 'noop'\n      ? `${row.changed.join(', ')} differ, but the diff says noop even given the live values: ` +\n        'the family does not manage them, and the deploy leaves them alone'\n      : '',\n  ]\n    .filter((note) => note !== '')\n    .join('; ');\n\nconst reason = (row: Omit<AdoptRow, 'ok' | 'why'>, ok: boolean): string => {\n  if (ok) return notes(row);\n  if (isNoop(row.planned, row.diff, row.stateRow)) {\n    const live = `the live ${row.changed.join(', ')}`;\n    if (row.recheck === 'failed') {\n      return `asked again with ${live} as recorded props, the provider's diff failed: not proven`;\n    }\n    if (!proven(row.recheck)) {\n      return (\n        `the provider's diff compares recorded props, not the live object: given ${live} it ` +\n        `says ${String(row.recheck)}, and the deploy's forced reconcile writes`\n      );\n    }\n    return `${String(row.bindings)} binding(s) change: the deploy reconciles them though the diff is noop`;\n  }\n  if (row.planned === 'delete') return 'no longer declared: the deploy deletes it';\n  if (row.planned === 'orphaned') return 'no longer declared: the deploy drops its state (retain)';\n  if (row.read === 'failed') return \"the verifier's own read of it failed\";\n  if (row.planned === 'create') {\n    if (row.stateRow) return 'an interrupted create: the deploy finishes creating it';\n    return row.read === 'absent'\n      ? 'the read found nothing, so the deploy CREATES it (a lane that cannot see it reads the same)'\n      : 'never probed (a prop is an Output of another resource, or the provider has no read): ' +\n          'the deploy CREATES it';\n  }\n  if (row.diff === 'update') return \"the provider's diff says update: the deploy writes\";\n  if (row.diff === 'replace') return \"the provider's diff says replace: a new one, then a delete\";\n  if (row.diff === 'none') {\n    return 'the provider has no diff, so the engine compared the declaration with itself';\n  }\n  return `the engine plans ${row.planned} although the diff says ${row.diff} (a renamed row, changed bindings or --force)`;\n};\n\nexport const rowFor = (\n  fqn: string,\n  node: NodeView,\n  stateRow: boolean,\n  seen: Observations,\n): AdoptRow => {\n  const observed = seen.get(fqn);\n  const recheck = observed?.recheck;\n  const base = {\n    bindings: (node.bindings ?? []).filter((binding) => binding.action !== 'noop').length,\n    changed: changedFields(observed?.diff?.news, observed?.read?.attributes),\n    diff: observed?.diff?.answer ?? 'not-run',\n    fqn,\n    planned: node.action,\n    read: observed?.read?.answer ?? 'not-read',\n    ...(recheck === undefined ? {} : { recheck }),\n    stateRow,\n    type: node.resource.Type,\n  } satisfies Omit<AdoptRow, 'ok' | 'why'>;\n  /**\n   * ⚠️ A NOOP DIFF DOES NOT COVER BINDINGS. Plan.ts diffs them separately and hands every\n   *   non-noop binding to `reconcile`, which an adopted row reaches anyway — a Worker adopted with\n   *   a new binding writes although its own diff said nothing changed.\n   */\n  const ok = isNoop(base.planned, base.diff, stateRow) && proven(recheck) && base.bindings === 0;\n  return { ...base, ok, why: reason(base, ok) };\n};\n\n/**\n * ⚠️ A TASK THAT RUNS IS A WRITE THE PROVIDERS NEVER SEE, so it is reported in both modes; a task\n *   that would not run appears only with `all`.\n */\nconst taskRow = (fqn: string, task: TaskView): AdoptRow => ({\n  bindings: 0,\n  changed: [],\n  diff: 'not-run',\n  fqn,\n  ok: task.action === 'noop',\n  planned: task.action,\n  read: 'not-read',\n  stateRow: task.action !== 'run',\n  type: task.def.Type,\n  why: task.action === 'noop' ? '' : `a stack task: the deploy will ${task.action} it`,\n});\n\n/**\n * The rows to report. Without `all`, only rows WITHOUT a state row — the adoptions and creates a\n * deploy would perform — which is the question this tool exists for, plus any task that runs. With\n * `all`, every declared row, every pending deletion and every task.\n */\nexport const rowsOf = (\n  plan: PlanView,\n  stateRows: ReadonlySet<string>,\n  seen: Observations,\n  all: boolean,\n): AdoptRow[] => {\n  const declared = Object.entries(plan.resources)\n    .filter(([fqn]) => all || !stateRows.has(fqn))\n    .map(([fqn, node]) => rowFor(fqn, node, stateRows.has(fqn), seen));\n  const removed = all\n    ? Object.entries(plan.deletions).flatMap(([fqn, node]) =>\n        node === undefined ? [] : [rowFor(fqn, node, true, seen)],\n      )\n    : [];\n  const tasks = Object.entries(plan.actions ?? {}).flatMap(([fqn, task]) =>\n    task === undefined || (!all && task.action === 'noop') ? [] : [taskRow(fqn, task)],\n  );\n  return [...declared, ...removed, ...tasks].sort((a, b) => a.fqn.localeCompare(b.fqn));\n};\n",
     "/**\n * The providers a stack registered, wrapped so the plan can be watched and can never write.\n *\n * ★ WHY A WRAPPER AND NOT A LOG LINE. alchemy beta.79 Plan.ts loses the provider's answer on the one\n *   path that matters: after the cold-start adoption probe it sets `forceUpdateAfterAdoption` and\n *   maps a `noop` diff to `update`, and the node says `adopted` either way. Nothing is logged, and\n *   `alchemy plan` has no JSON output — `describePlan` carries only the forced action. The engine\n *   resolves every provider from the Effect context by resource type (Provider.ts\n *   `tryFindProviderRegistrationByType`), so the one honest place to hear the raw answer is the\n *   provider service itself. This hands Alchemy's own `Plan.make` a context whose providers record\n *   what `read` and `diff` answered, per FQN, and otherwise behave exactly as registered.\n *\n * ⛔ EVERY WRITE PATH DIES. `reconcile`, `delete` and `precreate` are replaced, not wrapped: the\n *   planner never calls them, and a verifier that could reach one by accident is worse than none.\n *   `read`, `diff`, `list`, `tail` and `logs` pass through — each is a read by Alchemy's contract.\n *\n * ⚠️ A MISSING `diff` IS WRAPPED AS ONE ANSWERING `undefined`, which is exactly what the planner\n *   does without one (`provider?.diff?.(…)` then its own props compare), so behaviour is unchanged\n *   and the report can say `none` instead of guessing. A missing `read` stays missing: adding one\n *   would make the planner probe where it otherwise would not.\n */\nimport { Unowned, stripUnowned } from 'alchemy/AdoptPolicy';\nimport {\n  type ProviderCollectionService,\n  type ProviderService,\n  isProviderCollectionService,\n  isProviderService,\n} from 'alchemy/Provider';\nimport * as Context from 'effect/Context';\nimport * as Effect from 'effect/Effect';\n\nexport type ReadAnswer = 'found' | 'unowned' | 'absent' | 'failed' | 'not-read';\nexport type DiffAnswer = 'noop' | 'update' | 'replace' | 'none' | 'not-run';\n/** What the diff answered when asked again with the live values as its recorded props (recheck.ts). */\nexport type RecheckAnswer = DiffAnswer | 'failed';\n\n/** Exactly what the planner handed a provider's `diff`. */\nexport type DiffInput = Parameters<NonNullable<ProviderService['diff']>>[0];\n\n/** What one FQN's provider answered during the plan — the LAST answer of each kind. */\nexport interface Seen {\n  read?: { readonly answer: ReadAnswer; readonly attributes: unknown };\n  /**\n   * ★ `input` IS THE WHOLE CALL, NOT ONLY `news`, so recheck.ts can ask the same question again\n   *   with one field changed. In memory only; the report carries field names, never values. An\n   *   observation built by hand without it (rows.ts's tests) is simply never rechecked.\n   */\n  diff?: { readonly answer: DiffAnswer; readonly news: unknown; readonly input?: DiffInput };\n  recheck?: RecheckAnswer;\n}\n\n/** Keyed by FQN. Filled while the plan runs; read once it is done. */\nexport type Observations = Map<string, Seen>;\n\nconst seenFor = (seen: Observations, fqn: string): Seen => {\n  const existing = seen.get(fqn);\n  if (existing !== undefined) return existing;\n  const fresh: Seen = {};\n  seen.set(fqn, fresh);\n  return fresh;\n};\n\n/** The refusal every write path answers with. Exported so a test can match it. */\nexport const WRITE_REFUSED = 'hf-adopt-verify never writes';\n\nconst refuse = (type: string, operation: string) => () =>\n  Effect.die(\n    new Error(\n      `${WRITE_REFUSED}: ${type}.${operation} was called during a verification. Alchemy's planner ` +\n        'does not call it, so something other than Plan.make is driving these providers.',\n    ),\n  );\n\nconst readAnswer = (attributes: unknown): ReadAnswer =>\n  attributes === undefined ? 'absent' : Unowned.is(attributes) ? 'unowned' : 'found';\n\nexport const diffAnswer = (diff: unknown): DiffAnswer => {\n  const action = (diff as { action?: unknown } | undefined)?.action;\n  return action === 'noop' || action === 'update' || action === 'replace' ? action : 'none';\n};\n\n/**\n * One provider service, watched. ⚠️ The spread keeps `version`, `aliases`, `mode`, `stables`,\n * `list` and the rest exactly as registered — the planner reads several of them.\n */\nexport const spyService = (type: string, service: ProviderService, seen: Observations) => {\n  const read = service.read;\n  const diff = service.diff;\n  const modes = service.modes;\n  const watched: ProviderService = {\n    ...service,\n    diff: (input) =>\n      (diff === undefined ? Effect.succeed(undefined) : diff(input)).pipe(\n        Effect.tap((answer) =>\n          Effect.sync(() => {\n            seenFor(seen, input.fqn).diff = { answer: diffAnswer(answer), input, news: input.news };\n          }),\n        ),\n      ),\n    reconcile: refuse(type, 'reconcile'),\n    delete: refuse(type, 'delete'),\n  };\n  if (read !== undefined) {\n    watched.read = (input) =>\n      read(input).pipe(\n        Effect.tap((answer) =>\n          Effect.sync(() => {\n            const attributes = answer === undefined ? undefined : stripUnowned(answer);\n            seenFor(seen, input.fqn).read = { answer: readAnswer(answer), attributes };\n          }),\n        ),\n      );\n  }\n  if (service.precreate !== undefined) watched.precreate = refuse(type, 'precreate');\n  // ⚠️ A `ProviderLayer.dual` registration resolves a per-mode variant at plan time\n  //   (Provider.ts `providerForMode`); wrapping only the registration would miss it.\n  if (modes !== undefined) {\n    watched.modes = {\n      live: Effect.map(modes.live, (variant) => spyService(type, variant, seen)),\n      local: Effect.map(modes.local, (variant) => spyService(type, variant, seen)),\n    };\n  }\n  return watched;\n};\n\nconst spyCollection = (\n  collection: ProviderCollectionService,\n  seen: Observations,\n): ProviderCollectionService => {\n  const providers = Object.fromEntries(\n    Object.entries(collection.providers).map(([type, service]) => [\n      type,\n      spyService(type, service, seen),\n    ]),\n  );\n  return { ...collection, get: (type: string) => providers[type] as never, providers };\n};\n\n/**\n * The same context with every provider service — direct or inside a `Provider.collection` —\n * replaced by its watched copy. Everything else (the state store, the stack, credentials) is the\n * very object the session built.\n */\nexport const spyContext = <R>(\n  context: Context.Context<R>,\n  seen: Observations,\n): Context.Context<R> => {\n  const services = new Map<string, unknown>();\n  for (const [key, value] of context.mapUnsafe) {\n    services.set(\n      key,\n      isProviderService(value)\n        ? spyService(key, value, seen)\n        : isProviderCollectionService(value)\n          ? spyCollection(value, seen)\n          : value,\n    );\n  }\n  return Context.makeUnsafe<R>(services);\n};\n",

package/docs/distilled-interim.md

@@ -111,7 +111,7 @@ Two checks, both real, neither skippable:
 2. **`scripts/smoke.ts`** — packs the tarball, installs it into a scratch
    dir under its OWN published name (never the alias — the alias is the
    _consumer's_ concern), and builds a real request for one operation
-   against a fake `HttpClient` (`effect/unstable/http/HttpClient.make`,
+   against a fake `HttpClient` (`effect/http/HttpClient.make`,
    capturing the request instead of sending it). Assert on method, URL and
    headers, and decode a canned response. This is what caught the `/api/api/`
    bug — a clean typecheck did not, because the bug was in a runtime string,

package/docs/mesh-node.md

@@ -134,7 +134,7 @@ import { fetchMeshNodeToken } from '@homeflare/alchemy/cloudflare';
 import * as Effect from 'effect/Effect';
 import * as Layer from 'effect/Layer';
 import * as Redacted from 'effect/Redacted';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 import { open } from 'node:fs/promises';
 
 const token = await Effect.runPromise(

package/docs/paperless.md

@@ -115,7 +115,7 @@ request interface (`PaperlessTagRequest['matching_algorithm']`), never retyped b
 
 ```ts
 import { paperlessProviders, Tag } from '@homeflare/alchemy/paperless';
-import * as FetchHttpClient from 'effect/unstable/http/FetchHttpClient';
+import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 
 // PAPERLESS_URL and PAPERLESS_TOKEN in the deploy's environment.
 export default async () => {

package/docs/peers.md

@@ -1,16 +1,43 @@
-# Peers — and why each pin exists
-
-The install line for `@homeflare/alchemy`, and why every peer on it and every entry in the
-`overrides` block is required. The block itself, which every consumer copies, is in the
-[README](../README.md#peers--and-one-override-you-need).
+# Peers — and one override you need
 
 ```sh
-bun add @homeflare/alchemy alchemy@2.0.0-beta.79 effect@4.0.0-rc.115 \
-        @effect/platform-node@4.0.0-rc.115 mime@4.1.0 \
-        @distilled.cloud/cloudflare@1.0.0-rc.12 @distilled.cloud/forgejo@1.0.0-rc.12 \
-        @effect/sql-pg@4.0.0-rc.115
+bun add @homeflare/alchemy alchemy@2.0.0-beta.81 effect@4.0.1 \
+        @effect/platform-node@4.0.1 mime@4.1.0 \
+        @distilled.cloud/cloudflare@1.0.0-rc.13 @distilled.cloud/forgejo@1.0.0-rc.13 \
+        @distilled.cloud/discord@1.0.0-rc.13 @distilled.cloud/google-workspace@1.0.0-rc.13 \
+        @distilled.cloud/argocd@1.0.0-rc.13 \
+        @effect/sql-pg@4.0.1
 ```
 
+⛔ **Every one of those is required, and you also need an `overrides` block** — see
+below. The install succeeds without them and the import throws.
+
+★ **The machine-readable source of truth** lives in this package's `package.json` under the
+`homeflare.consumer` field. It carries the exact pins, the overrides below, and the import
+moves for `effect/unstable/*` as an ordered **array of `{"from", "to"}` pairs** — not an
+object keyed by the old path. Order is load-bearing: the most specific path comes first
+(`httpapi` before its parent `http`), because consumers apply the moves in published order.
+The install line, the overrides block in this doc, and the smoke test install are all
+asserted against that field; change the field first, then copy its `overrides` block here.
+
+⛔ **Add this to your `package.json`, or the install works and the import throws:**
+
+```json
+{
+  "overrides": {
+    "effect": "4.0.1",
+    "@effect/platform-node": "4.0.1",
+    "@effect/platform-node-shared": "4.0.1",
+    "@effect/platform-bun": "4.0.1",
+    "rolldown": "1.2.8",
+    "redis": "6.3.0"
+  }
+}
+```
+
+Why each peer is required and each pin exists — the measurements, and the error a missing one
+produces — is below.
+
 🔴 **Why, measured 2026-09-16 on 0.1.0 and re-checked 2026-09-17 against Alchemy 78.**
 Effect's `rc` line is not semver-compatible with itself. Alchemy 78's peer is
 `effect >= 4.0.0-rc.115`; an unlocked `@effect/platform-node-shared` still floats to the
@@ -53,7 +80,7 @@ one `MeshNode` already called. Nothing else in this package imported it, so the
 ⚠️ **`@distilled.cloud/forgejo` (added 2026-09-23, moving `/forgejo` off a hand-rolled
 `HttpClient` client) is required for the same reason `@distilled.cloud/cloudflare` is: it is
 a plain dependency of this package, not something a hoisting installer can hide from a strict
-one.** Pinned to `1.0.0-rc.12` — the distilled release's own lockstep version, not alchemy's,
+one.** Pinned to `1.0.0-rc.13` — the distilled release's own lockstep version, not alchemy's,
 since alchemy does not bundle a Forgejo SDK the way it bundles Cloudflare's.
 
 ⚠️ **`@effect/sql-pg` (added for `/postgres`, 2026-09-23) is required too, for the same
@@ -66,7 +93,7 @@ every other one.
 ⚠️ **`@distilled.cloud/grafana` (added 2026-09-24, kit PR 222, ahead of `/grafana`) is
 required for the same reason `@distilled.cloud/forgejo` is: a plain dependency of this
 package, not something a hoisting installer can hide from a strict one.** Pinned to
-`1.0.0-rc.12`, the same distilled release line as every other pin on this page. Unlike
+`1.0.0-rc.13`, the same distilled release line as every other pin on this page. Unlike
 Forgejo, this family is credential-parameterized per instance (`grafanaCredentials`/
 `grafanaProviders` take a `GrafanaTarget`, not a fixed env-var pair) — see
 [grafana.md](./grafana.md) for why one instance was never going to be enough for this
@@ -91,6 +118,6 @@ add here, nothing for `peers.test.ts` to check.
 ⚠️ **`@distilled.cloud/argocd` (added 2026-09-24, `/argocd`, built ahead of a Talos-on-PVE
 cluster that does not exist yet) is required for the same reason `@distilled.cloud/forgejo` and
 `/discord` are: a plain dependency of this package, not something a hoisting installer can hide
-from a strict one.** Pinned to `1.0.0-rc.12` — measured (`npm view @distilled.cloud/argocd`,
-2026-09-24) as genuinely published at that version, matching every other pin on this page; no
+from a strict one.** Pinned to `1.0.0-rc.13` (rc.12 measured with `npm view @distilled.cloud/argocd`,
+2026-09-24, as genuinely published; rc.13 is the bump's pin) — a version published, matching every other pin on this page; no
 interim alias was needed (see [distilled-interim.md](./distilled-interim.md) for when one is).