@homeflare/alchemy 0.50.0 → 0.51.0

package/dist/unifi/index.js

@@ -1,87 +1,124 @@
 // src/unifi/policy.ts
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-var UNIFI_READ_ONLY_POLICY = "read-only by Tim's rule, 2026-09-24; lifting it is a kit change";
+var UNIFI_WRITE_POLICY = "UniFi is adopt-only except Unifi.Network update: one whole-object PUT built from the live " + "object plus the declared field changes, only on a row with prior Alchemy state, only through " + "deploy-approve; create/delete and every other family stay refused -- widening is a kit change " + "(Tim 2026-10-10 lifts the 2026-09-24 rule for this one case)";
+var UNIFI_READ_ONLY_POLICY = UNIFI_WRITE_POLICY;
 
 class UnifiWriteRefused extends Data.TaggedError("UnifiWriteRefused") {
   get message() {
-    return `${this.type} ${this.identity}: refusing to ${this.action} -- ${UNIFI_READ_ONLY_POLICY}.`;
+    return `${this.type} ${this.identity}: refusing to ${this.action} -- ${UNIFI_WRITE_POLICY}.`;
   }
 }
 var refuseWrite = (type, identity, action) => Effect.fail(new UnifiWriteRefused({ type, identity, action }));
-// src/unifi/resource.ts
-import { Unowned } from "alchemy/AdoptPolicy";
-import { isResolved } from "alchemy/Diff";
-import { CredentialsFromEnv } from "@distilled.cloud/unifi-network/Credentials";
+var fieldList = (fields) => `[${fields.join(", ")}]`;
+
+class UnifiLiveDriftedSinceDeploy extends Data.TaggedError("UnifiLiveDriftedSinceDeploy") {
+  get message() {
+    return `${this.type} ${this.identity}: live differs from the last deployed state on ` + `${fieldList(this.fields)}; refusing to PUT over it. Two causes look identical from here: a ` + "hand edit on the console, or an earlier PUT that landed but did not converge " + "(UnifiUpdateDidNotConverge). Re-import the live object first.";
+  }
+}
+
+class UnifiUpdateWouldBeNoop extends Data.TaggedError("UnifiUpdateWouldBeNoop") {
+  get message() {
+    return `${this.type} ${this.identity}: the merged update body equals live; refusing a no-op PUT.`;
+  }
+}
+
+class UnifiUpdateDidNotConverge extends Data.TaggedError("UnifiUpdateDidNotConverge") {
+  get message() {
+    return `${this.type} ${this.identity}: the PUT LANDED, but live now differs from the declaration on ` + `${fieldList(this.fields)}. The change is on the console and is not rolled back; the next ` + "deploy will see this as drift. Recovery is a re-import of the live object.";
+  }
+}
+
+class UnifiFieldNotRemovable extends Data.TaggedError("UnifiFieldNotRemovable") {
+  get message() {
+    return `${this.type} ${this.identity}: refusing to remove ${fieldList(this.fields)}; a whole-object ` + "PUT turns an omitted block off, and only the removable allowlist may be dropped.";
+  }
+}
+
+class UnifiFieldNotSettable extends Data.TaggedError("UnifiFieldNotSettable") {
+  get message() {
+    return `${this.type} ${this.identity}: refusing to set ${fieldList(this.fields)}; this write path ` + "only sets the settable allowlist (ipv6Configuration).";
+  }
+}
+
+class UnifiManagementNetworkRefused extends Data.TaggedError("UnifiManagementNetworkRefused") {
+  get message() {
+    return `${this.type} ${this.identity}: live is the default (management) network; refusing any write to it.`;
+  }
+}
+
+class UnifiImmutableFieldChanged extends Data.TaggedError("UnifiImmutableFieldChanged") {
+  get message() {
+    return `${this.type} ${this.identity}: refusing to change ${fieldList(this.fields)}; those fields are never written.`;
+  }
+}
+
+class UnifiIdentityChanged extends Data.TaggedError("UnifiIdentityChanged") {
+  get message() {
+    return `${this.type} ${this.identity}: the last deploy named ${this.previous}; refusing to PUT against another object.`;
+  }
+}
+// src/unifi/wire-guard.ts
 import * as Effect2 from "effect/Effect";
+import * as Option from "effect/Option";
+import * as FetchHttpClient from "effect/http/FetchHttpClient";
 import * as HttpClient from "effect/http/HttpClient";
-var unifiOperations = (spec) => {
-  const read = (props) => spec.fetchLive(props).pipe(Effect2.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
-  return {
-    read,
-    readHandler: ({ olds, output }) => Effect2.gen(function* () {
-      const attrs = yield* read(olds);
-      if (attrs === undefined)
-        return;
-      return output !== undefined ? attrs : Unowned(attrs);
-    }),
-    diff: (news, output) => Effect2.gen(function* () {
-      if (output === undefined || !isResolved(news))
-        return;
-      const live = yield* read(news);
-      if (live === undefined)
-        return { action: "update" };
-      return spec.matches(live, news) ? { action: "noop" } : { action: "update" };
-    }),
-    reconcile: (news) => Effect2.gen(function* () {
-      const live = yield* read(news);
-      if (live === undefined)
-        return yield* refuseWrite(spec.type, spec.describe(news), "create");
-      if (!spec.matches(live, news)) {
-        return yield* refuseWrite(spec.type, spec.describe(news), "update");
-      }
-      return live;
-    }),
-    destroy: (olds) => refuseWrite(spec.type, spec.describe(olds), "delete")
-  };
-};
-
-class UnifiNonGetRequest extends Error {
+import * as HttpClientRequest from "effect/http/HttpClientRequest";
+class UnifiRefusedRequest extends Error {
   method;
   path;
-  constructor(method, path) {
-    super(`UniFi HttpClient guard: refused ${method} ${path} -- ${UNIFI_READ_ONLY_POLICY}. This is a ` + "defect, not a recoverable condition: something under src/unifi tried to send a non-GET " + "request, which policy.ts's per-operation refusal should already have made impossible. " + "Fix the kit code that produced this request.");
+  constructor(method, path, detail = "not on this row's allow list") {
+    super(`UniFi HttpClient guard: refused ${method} ${path} (${detail}) -- ${UNIFI_WRITE_POLICY}. ` + "This is a defect, not a recoverable condition: something under src/unifi sent a request " + "policy.ts's per-operation refusal should already have made impossible. Fix the kit " + "code that produced this request.");
     this.method = method;
     this.path = path;
-    this.name = "UnifiNonGetRequest";
+    this.name = "UnifiRefusedRequest";
   }
 }
+var UnifiNonGetRequest = UnifiRefusedRequest;
 var requestPath = (url) => {
   try {
-    return new URL(url).pathname;
+    return new URL(url).pathname.replace(/(\/consoles\/)[^/]*/g, "$1<redacted>");
   } catch {
     return "<unparseable request url>";
   }
 };
-var guardGetOnly = (client) => client.pipe(HttpClient.mapRequestEffect((request) => request.method === "GET" ? Effect2.succeed(request) : Effect2.die(new UnifiNonGetRequest(request.method, requestPath(request.url)))));
-var GetOnlyHttpClient = HttpClient.layerMergedContext(Effect2.map(HttpClient.HttpClient, guardGetOnly));
-var unifiHandlers = (spec) => {
-  const ops = unifiOperations(spec);
-  const withCredentials = (effect) => effect.pipe(Effect2.provide(GetOnlyHttpClient), Effect2.provide(CredentialsFromEnv));
-  return {
-    list: () => Effect2.succeed([]),
-    read: (args) => withCredentials(ops.readHandler(args)),
-    diff: (args) => withCredentials(ops.diff(args.news, args.output)),
-    reconcile: (args) => withCredentials(ops.reconcile(args.news)),
-    delete: (args) => withCredentials(ops.destroy(args.olds))
-  };
+var isAllowed = (allow, baseUrl, method, request) => {
+  if (baseUrl === undefined)
+    return false;
+  try {
+    const base = new URL(baseUrl);
+    const resolved = HttpClientRequest.toUrl(request);
+    if (Option.isNone(resolved))
+      return false;
+    const target = resolved.value;
+    if (target.origin !== base.origin || target.search !== "" || target.hash !== "")
+      return false;
+    const basePath = base.pathname.replace(/\/+$/, "");
+    return allow.some((entry) => entry.method === method && target.pathname === `${basePath}${entry.tail}`);
+  } catch {
+    return false;
+  }
+};
+var followedElsewhere = (res) => {
+  const sent = HttpClientRequest.toUrl(res.request);
+  return res.url !== "" && Option.isSome(sent) && res.url !== sent.value.href.split("#")[0];
 };
+var guard = (client, allow, baseUrl) => client.pipe(HttpClient.mapRequestEffect((request) => request.method === "GET" || isAllowed(allow, baseUrl, request.method, request) ? Effect2.succeed(request) : Effect2.die(new UnifiRefusedRequest(request.method, requestPath(request.url)))), HttpClient.transformResponse((response) => Effect2.flatMap(response, (res) => res.status >= 300 && res.status < 400 ? Effect2.die(new UnifiRefusedRequest(res.request.method, requestPath(res.request.url), `answered a ${res.status} redirect`)) : followedElsewhere(res) ? Effect2.die(new UnifiRefusedRequest(res.request.method, requestPath(res.request.url), "the response URL differs from the request URL (a redirect was followed)")) : Effect2.succeed(res))));
+var guardedHttpClient = (allow, baseUrl) => {
+  return HttpClient.layerMergedContext(Effect2.map(HttpClient.HttpClient, (client) => HttpClient.transform(guard(client, allow, baseUrl), manualRedirect)));
+};
+var manualRedirect = (effect) => Effect2.flatMap(Effect2.serviceOption(FetchHttpClient.RequestInit), (existing) => Effect2.provideService(effect, FetchHttpClient.RequestInit, {
+  ...Option.getOrElse(existing, () => ({})),
+  redirect: "manual"
+}));
+var GetOnlyHttpClient = guardedHttpClient([]);
 // src/unifi/network.ts
 import { Resource } from "alchemy";
 import { adopt } from "alchemy/AdoptPolicy";
 import * as Provider from "alchemy/Provider";
-import * as networks from "@distilled.cloud/unifi-network/networks";
-import * as Effect3 from "effect/Effect";
+import * as networks2 from "@distilled.cloud/unifi-network/networks";
+import * as Effect7 from "effect/Effect";
 
 // src/unifi/network-form.ts
 var sortedSet = (values) => [...new Set(values)].sort();
@@ -183,26 +220,231 @@ var fieldDrift = makeDriftOf([
 var matches = (attributes, props) => fieldDrift(attributes, props).length === 0;
 var driftOf = (live, props) => fieldDrift(attributesOf(live, props), props);
 
+// src/unifi/network-scope.ts
+import * as Effect3 from "effect/Effect";
+var SETTABLE_KEYS = ["ipv6Configuration"];
+var REMOVABLE_KEYS = ["ipv6Configuration"];
+var IMMUTABLE_KEYS = [
+  "zoneId",
+  "vlanId",
+  "management",
+  "deviceId"
+];
+var isIn = (list) => (key) => list.includes(key);
+var checkNetworkWriteScope = (live, patch, props) => {
+  const type = "Unifi.Network";
+  const identity = `sites/${props.siteId}/networks/${props.networkId}`;
+  if (live.default === true) {
+    return Effect3.fail(new UnifiManagementNetworkRefused({ type, identity }));
+  }
+  const touched = [...Object.keys(patch.set), ...patch.unset.map(String)];
+  const immutable = touched.filter(isIn(IMMUTABLE_KEYS));
+  if (immutable.length > 0) {
+    return Effect3.fail(new UnifiImmutableFieldChanged({ type, identity, fields: immutable }));
+  }
+  const removable = isIn(REMOVABLE_KEYS);
+  const notRemovable = patch.unset.map(String).filter((k) => !removable(k));
+  if (notRemovable.length > 0) {
+    return Effect3.fail(new UnifiFieldNotRemovable({ type, identity, fields: notRemovable }));
+  }
+  const settable = isIn(SETTABLE_KEYS);
+  const notSettable = Object.keys(patch.set).filter((k) => !settable(k));
+  if (notSettable.length > 0) {
+    return Effect3.fail(new UnifiFieldNotSettable({ type, identity, fields: notSettable }));
+  }
+  return Effect3.void;
+};
+
+// src/unifi/network-update.ts
+import * as networks from "@distilled.cloud/unifi-network/networks";
+import * as Retry from "@distilled.cloud/unifi-network/Retry";
+import { deepEqual as deepEqual2 } from "alchemy/Diff";
+import * as Effect4 from "effect/Effect";
+var SERVER_FIELDS = ["id", "default", "metadata"];
+var withoutServerFields = (live) => {
+  const server = new Set(SERVER_FIELDS);
+  const rest = {};
+  for (const [key, value] of Object.entries(live)) {
+    if (!server.has(key))
+      rest[key] = value;
+  }
+  return rest;
+};
+var mergeForUpdate = (live, patch, props) => {
+  const rest = withoutServerFields(live);
+  const body = { ...rest, ...patch.set };
+  for (const key of patch.unset)
+    delete body[key];
+  if (deepEqual2(body, rest, { stripNullish: true })) {
+    return Effect4.fail(new UnifiUpdateWouldBeNoop({
+      type: "Unifi.Network",
+      identity: `sites/${props.siteId}/networks/${props.networkId}`
+    }));
+  }
+  return Effect4.succeed({
+    ...body,
+    siteId: props.siteId,
+    networkId: live.id
+  });
+};
+var writeNetwork = (live, patch, props) => checkNetworkWriteScope(live, patch, props).pipe(Effect4.andThen(mergeForUpdate(live, patch, props)), Effect4.flatMap((body) => networks.updateNetwork(body).pipe(Retry.none)));
+
+// src/unifi/resource.ts
+import { Unowned } from "alchemy/AdoptPolicy";
+import { isResolved } from "alchemy/Diff";
+import { Credentials, CredentialsFromEnv } from "@distilled.cloud/unifi-network/Credentials";
+import * as Effect6 from "effect/Effect";
+
+// src/unifi/update-reconcile.ts
+import { deepEqual as deepEqual3 } from "alchemy/Diff";
+import * as Effect5 from "effect/Effect";
+var computePatch = (news, olds, patchKeys) => {
+  const set = {};
+  const unset = [];
+  for (const key of patchKeys) {
+    if (deepEqual3(news[key], olds[key], { stripNullish: true }))
+      continue;
+    if (news[key] == null)
+      unset.push(key);
+    else
+      set[key] = news[key];
+  }
+  return { set, unset };
+};
+var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(function* () {
+  const identity = spec.describe(news);
+  const live = yield* spec.fetchLive(news);
+  if (live === undefined)
+    return yield* refuseWrite(spec.type, identity, "create");
+  const attrs = spec.attributes(live, news);
+  if (spec.matches(attrs, news))
+    return attrs;
+  const update = spec.update;
+  if (update === undefined || olds === undefined || output === undefined) {
+    return yield* refuseWrite(spec.type, identity, "update");
+  }
+  const previous = spec.describe(olds);
+  if (previous !== identity) {
+    return yield* new UnifiIdentityChanged({ type: spec.type, identity, previous });
+  }
+  const drifted = update.driftOf(live, olds).map((d) => d.field);
+  if (drifted.length > 0) {
+    return yield* new UnifiLiveDriftedSinceDeploy({
+      type: spec.type,
+      identity,
+      fields: drifted
+    });
+  }
+  const patch = computePatch(news, olds, update.patchKeys);
+  if (Object.keys(patch.set).length === 0 && patch.unset.length === 0) {
+    return yield* refuseWrite(spec.type, identity, "update");
+  }
+  yield* update.checkScope(live, patch, news);
+  yield* note(`${spec.type} ${identity}: PUT changes [${Object.keys(patch.set).join(", ")}] ` + `removes [${patch.unset.map(String).join(", ")}]`);
+  const written = yield* update.write(live, patch, news);
+  const writtenAttrs = spec.attributes(written, news);
+  if (spec.matches(writtenAttrs, news))
+    return writtenAttrs;
+  return yield* new UnifiUpdateDidNotConverge({
+    type: spec.type,
+    identity,
+    fields: update.driftOf(written, news).map((d) => d.field)
+  });
+});
+
+// src/unifi/resource.ts
+var unifiOperations = (spec) => {
+  const read = (props) => spec.fetchLive(props).pipe(Effect6.map((live) => live === undefined ? undefined : spec.attributes(live, props)));
+  return {
+    read,
+    readHandler: ({ olds, output }) => Effect6.gen(function* () {
+      const attrs = yield* read(olds);
+      if (attrs === undefined)
+        return;
+      return output !== undefined ? attrs : Unowned(attrs);
+    }),
+    diff: (news, output) => Effect6.gen(function* () {
+      if (output === undefined || !isResolved(news))
+        return;
+      const live = yield* read(news);
+      if (live === undefined)
+        return { action: "update" };
+      return spec.matches(live, news) ? { action: "noop" } : { action: "update" };
+    }),
+    reconcile: (news, rest = {}) => updateReconcile(spec, {
+      news,
+      olds: rest.olds,
+      output: rest.output,
+      note: rest.note ?? (() => Effect6.void)
+    }),
+    destroy: (olds) => refuseWrite(spec.type, spec.describe(olds), "delete")
+  };
+};
+var unifiHandlers = (spec) => {
+  const ops = unifiOperations(spec);
+  const withCredentials = (effect, allow = []) => Effect6.gen(function* () {
+    const { apiBaseUrl } = yield* yield* Credentials;
+    return yield* effect.pipe(Effect6.provide(guardedHttpClient(allow, apiBaseUrl)));
+  }).pipe(Effect6.provide(CredentialsFromEnv));
+  return {
+    list: () => Effect6.succeed([]),
+    read: (args) => withCredentials(ops.readHandler(args)),
+    diff: (args) => withCredentials(ops.diff(args.news, args.output)),
+    reconcile: (args) => withCredentials(ops.reconcile(args.news, {
+      olds: args.olds,
+      output: args.output,
+      note: (message) => args.session.note(message)
+    }), spec.update ? [spec.update.allowedWrite(args.news)] : []),
+    delete: (args) => withCredentials(ops.destroy(args.olds))
+  };
+};
+
 // src/unifi/network.ts
 var UnifiNetwork = Resource("Unifi.Network", {
   defaultRemovalPolicy: "retain"
 });
 var network = (id, props) => UnifiNetwork(id, props).pipe(adopt(true));
+var NETWORK_PATCH_KEYS = [
+  "name",
+  "enabled",
+  "management",
+  "vlanId",
+  "dhcpGuarding",
+  "cellularBackupEnabled",
+  "internetAccessEnabled",
+  "ipv4Configuration",
+  "ipv6Configuration",
+  "isolationEnabled",
+  "mdnsForwardingEnabled",
+  "zoneId",
+  "deviceId"
+];
+var networkAllowedWrite = (props) => ({
+  method: "PUT",
+  tail: `/v1/sites/${props.siteId}/networks/${props.networkId}`
+});
 var spec = {
   type: "Unifi.Network",
   describe: (props) => `sites/${props.siteId}/networks/${props.networkId}`,
-  fetchLive: (props) => networks.getNetworkDetails({ siteId: props.siteId, networkId: props.networkId }).pipe(Effect3.catchTag("NotFound", () => Effect3.succeed(undefined))),
+  fetchLive: (props) => networks2.getNetworkDetails({ siteId: props.siteId, networkId: props.networkId }).pipe(Effect7.catchTag("NotFound", () => Effect7.succeed(undefined))),
   attributes: attributesOf,
-  matches
+  matches,
+  update: {
+    allowedWrite: networkAllowedWrite,
+    patchKeys: NETWORK_PATCH_KEYS,
+    driftOf,
+    checkScope: checkNetworkWriteScope,
+    write: writeNetwork
+  }
 };
 var handlers = unifiHandlers(spec);
-var UnifiNetworkProvider = () => Provider.effect(UnifiNetwork, Effect3.succeed(UnifiNetwork.Provider.of(handlers)));
+var UnifiNetworkProvider = () => Provider.effect(UnifiNetwork, Effect7.succeed(UnifiNetwork.Provider.of(handlers)));
 // src/unifi/firewall-zone.ts
 import { Resource as Resource2 } from "alchemy";
 import { adopt as adopt2 } from "alchemy/AdoptPolicy";
 import * as Provider2 from "alchemy/Provider";
 import * as firewall from "@distilled.cloud/unifi-network/firewall";
-import * as Effect4 from "effect/Effect";
+import * as Effect8 from "effect/Effect";
 
 // src/unifi/firewall-zone-form.ts
 var sortedSet2 = (values) => [...new Set(values)].sort();
@@ -239,18 +481,18 @@ var firewallZone = (id, props) => UnifiFirewallZone(id, props).pipe(adopt2(true)
 var spec2 = {
   type: "Unifi.FirewallZone",
   describe: (props) => `sites/${props.siteId}/firewall/zones/${props.firewallZoneId}`,
-  fetchLive: (props) => firewall.getFirewallZone({ siteId: props.siteId, firewallZoneId: props.firewallZoneId }).pipe(Effect4.catchTag("NotFound", () => Effect4.succeed(undefined))),
+  fetchLive: (props) => firewall.getFirewallZone({ siteId: props.siteId, firewallZoneId: props.firewallZoneId }).pipe(Effect8.catchTag("NotFound", () => Effect8.succeed(undefined))),
   attributes: attributesOf2,
   matches: matches2
 };
 var handlers2 = unifiHandlers(spec2);
-var UnifiFirewallZoneProvider = () => Provider2.effect(UnifiFirewallZone, Effect4.succeed(UnifiFirewallZone.Provider.of(handlers2)));
+var UnifiFirewallZoneProvider = () => Provider2.effect(UnifiFirewallZone, Effect8.succeed(UnifiFirewallZone.Provider.of(handlers2)));
 // src/unifi/dns-policy.ts
 import { Resource as Resource3 } from "alchemy";
 import { adopt as adopt3 } from "alchemy/AdoptPolicy";
 import * as Provider3 from "alchemy/Provider";
 import * as dnsPolicies from "@distilled.cloud/unifi-network/dns_policies";
-import * as Effect5 from "effect/Effect";
+import * as Effect9 from "effect/Effect";
 
 // src/unifi/dns-policy-form.ts
 var attributesOf3 = (live, props) => ({
@@ -329,18 +571,18 @@ var dnsPolicy = (id, props) => UnifiDnsPolicy(id, props).pipe(adopt3(true));
 var spec3 = {
   type: "Unifi.DnsPolicy",
   describe: (props) => `sites/${props.siteId}/dns/policies/${props.dnsPolicyId}`,
-  fetchLive: (props) => dnsPolicies.getDnsPolicy({ siteId: props.siteId, dnsPolicyId: props.dnsPolicyId }).pipe(Effect5.catchTag("NotFound", () => Effect5.succeed(undefined))),
+  fetchLive: (props) => dnsPolicies.getDnsPolicy({ siteId: props.siteId, dnsPolicyId: props.dnsPolicyId }).pipe(Effect9.catchTag("NotFound", () => Effect9.succeed(undefined))),
   attributes: attributesOf3,
   matches: matches3
 };
 var handlers3 = unifiHandlers(spec3);
-var UnifiDnsPolicyProvider = () => Provider3.effect(UnifiDnsPolicy, Effect5.succeed(UnifiDnsPolicy.Provider.of(handlers3)));
+var UnifiDnsPolicyProvider = () => Provider3.effect(UnifiDnsPolicy, Effect9.succeed(UnifiDnsPolicy.Provider.of(handlers3)));
 // src/unifi/acl-rule.ts
 import { Resource as Resource4 } from "alchemy";
 import { adopt as adopt4 } from "alchemy/AdoptPolicy";
 import * as Provider4 from "alchemy/Provider";
 import * as aclRules from "@distilled.cloud/unifi-network/access_control_acl_rules";
-import * as Effect6 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/unifi/acl-rule-form.ts
 var sortedSet3 = (values) => [...new Set(values)].sort();
@@ -416,18 +658,18 @@ var aclRule = (id, props) => UnifiAclRule(id, props).pipe(adopt4(true));
 var spec4 = {
   type: "Unifi.AclRule",
   describe: (props) => `sites/${props.siteId}/acl-rules/${props.aclRuleId}`,
-  fetchLive: (props) => aclRules.getAclRule({ siteId: props.siteId, aclRuleId: props.aclRuleId }).pipe(Effect6.catchTag("NotFound", () => Effect6.succeed(undefined))),
+  fetchLive: (props) => aclRules.getAclRule({ siteId: props.siteId, aclRuleId: props.aclRuleId }).pipe(Effect10.catchTag("NotFound", () => Effect10.succeed(undefined))),
   attributes: attributesOf4,
   matches: matches4
 };
 var handlers4 = unifiHandlers(spec4);
-var UnifiAclRuleProvider = () => Provider4.effect(UnifiAclRule, Effect6.succeed(UnifiAclRule.Provider.of(handlers4)));
+var UnifiAclRuleProvider = () => Provider4.effect(UnifiAclRule, Effect10.succeed(UnifiAclRule.Provider.of(handlers4)));
 // src/unifi/acl-rule-ordering.ts
 import { Resource as Resource5 } from "alchemy";
 import { adopt as adopt5 } from "alchemy/AdoptPolicy";
 import * as Provider5 from "alchemy/Provider";
 import * as aclRules2 from "@distilled.cloud/unifi-network/access_control_acl_rules";
-import * as Effect7 from "effect/Effect";
+import * as Effect11 from "effect/Effect";
 
 // src/unifi/acl-rule-ordering-form.ts
 var attributesOf5 = (live, props) => ({
@@ -456,18 +698,18 @@ var aclRuleOrdering = (id, props) => UnifiAclRuleOrdering(id, props).pipe(adopt5
 var spec5 = {
   type: "Unifi.AclRuleOrdering",
   describe: (props) => `sites/${props.siteId}/acl-rules/ordering`,
-  fetchLive: (props) => aclRules2.getAclRuleOrdering({ siteId: props.siteId }).pipe(Effect7.catchTag("NotFound", () => Effect7.succeed(undefined))),
+  fetchLive: (props) => aclRules2.getAclRuleOrdering({ siteId: props.siteId }).pipe(Effect11.catchTag("NotFound", () => Effect11.succeed(undefined))),
   attributes: attributesOf5,
   matches: matches5
 };
 var handlers5 = unifiHandlers(spec5);
-var UnifiAclRuleOrderingProvider = () => Provider5.effect(UnifiAclRuleOrdering, Effect7.succeed(UnifiAclRuleOrdering.Provider.of(handlers5)));
+var UnifiAclRuleOrderingProvider = () => Provider5.effect(UnifiAclRuleOrdering, Effect11.succeed(UnifiAclRuleOrdering.Provider.of(handlers5)));
 // src/unifi/wifi-broadcast.ts
 import { Resource as Resource6 } from "alchemy";
 import { adopt as adopt6 } from "alchemy/AdoptPolicy";
 import * as Provider6 from "alchemy/Provider";
 import * as wifiBroadcasts from "@distilled.cloud/unifi-network/wifi_broadcasts";
-import * as Effect9 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/unifi/wifi-broadcast-form.ts
 var sortedStrings = (values) => [...new Set(values)].sort();
@@ -551,7 +793,7 @@ var driftOf6 = (live, props) => fieldDrift6(attributesOf6(live, props), props);
 
 // src/unifi/paginate.ts
 import * as Data2 from "effect/Data";
-import * as Effect8 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 var MAX_PAGES = 1000;
 
 class UnifiPaginationInconsistent extends Data2.TaggedError("UnifiPaginationInconsistent") {
@@ -560,7 +802,7 @@ class UnifiPaginationInconsistent extends Data2.TaggedError("UnifiPaginationInco
   }
 }
 var numOrPlaceholder = (value) => typeof value === "number" && Number.isFinite(value) ? String(value) : "<non-numeric>";
-var pageAll = (fetchPage, request) => Effect8.gen(function* () {
+var pageAll = (fetchPage, request) => Effect12.gen(function* () {
   const rows = [];
   const startOffset = request.offset ?? 0;
   let offset = startOffset;
@@ -611,18 +853,18 @@ var wifiBroadcast = (id, props) => UnifiWifiBroadcast(id, props).pipe(adopt6(tru
 var spec6 = {
   type: "Unifi.WifiBroadcast",
   describe: (props) => `sites/${props.siteId}/wifi/broadcasts/${props.wifiBroadcastId}`,
-  fetchLive: (props) => pageAll(wifiBroadcasts.getWifiBroadcastPage, { siteId: props.siteId }).pipe(Effect9.catchTag("NotFound", () => Effect9.succeed(undefined)), Effect9.map((rows) => rows?.find((row) => row.id === props.wifiBroadcastId))),
+  fetchLive: (props) => pageAll(wifiBroadcasts.getWifiBroadcastPage, { siteId: props.siteId }).pipe(Effect13.catchTag("NotFound", () => Effect13.succeed(undefined)), Effect13.map((rows) => rows?.find((row) => row.id === props.wifiBroadcastId))),
   attributes: attributesOf6,
   matches: matches6
 };
 var handlers6 = unifiHandlers(spec6);
-var UnifiWifiBroadcastProvider = () => Provider6.effect(UnifiWifiBroadcast, Effect9.succeed(UnifiWifiBroadcast.Provider.of(handlers6)));
+var UnifiWifiBroadcastProvider = () => Provider6.effect(UnifiWifiBroadcast, Effect13.succeed(UnifiWifiBroadcast.Provider.of(handlers6)));
 // src/unifi/firewall-policy.ts
 import { Resource as Resource7 } from "alchemy";
 import { adopt as adopt7 } from "alchemy/AdoptPolicy";
 import * as Provider7 from "alchemy/Provider";
 import * as firewall2 from "@distilled.cloud/unifi-network/firewall";
-import * as Effect10 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 
 // src/unifi/firewall-policy-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -689,18 +931,18 @@ var firewallPolicy = (id, props) => UnifiFirewallPolicy(id, props).pipe(adopt7(t
 var spec7 = {
   type: "Unifi.FirewallPolicy",
   describe: (props) => `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
-  fetchLive: (props) => firewall2.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect10.catchTag("NotFound", () => Effect10.succeed(undefined))),
+  fetchLive: (props) => firewall2.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect14.catchTag("NotFound", () => Effect14.succeed(undefined))),
   attributes: attributesOf7,
   matches: matches7
 };
 var handlers7 = unifiHandlers(spec7);
-var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect10.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
+var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect14.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
 // src/unifi/firewall-policy-ordering.ts
 import { Resource as Resource8 } from "alchemy";
 import { adopt as adopt8 } from "alchemy/AdoptPolicy";
 import * as Provider8 from "alchemy/Provider";
 import * as firewall3 from "@distilled.cloud/unifi-network/firewall";
-import * as Effect11 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 
 // src/unifi/firewall-policy-ordering-form.ts
 var attributesOf8 = (live, props) => ({
@@ -742,18 +984,18 @@ var spec8 = {
     siteId: props.siteId,
     sourceFirewallZoneId: props.sourceFirewallZoneId,
     destinationFirewallZoneId: props.destinationFirewallZoneId
-  }).pipe(Effect11.catchTag("NotFound", () => Effect11.succeed(undefined))),
+  }).pipe(Effect15.catchTag("NotFound", () => Effect15.succeed(undefined))),
   attributes: attributesOf8,
   matches: matches8
 };
 var handlers8 = unifiHandlers(spec8);
-var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect11.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
+var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect15.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
 // src/unifi/traffic-matching-list.ts
 import { Resource as Resource9 } from "alchemy";
 import { adopt as adopt9 } from "alchemy/AdoptPolicy";
 import * as Provider9 from "alchemy/Provider";
 import * as trafficMatchingLists from "@distilled.cloud/unifi-network/traffic_matching_lists";
-import * as Effect12 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 
 // src/unifi/traffic-matching-list-form.ts
 var attributesOf9 = (live, props) => ({
@@ -789,35 +1031,45 @@ var spec9 = {
   fetchLive: (props) => trafficMatchingLists.getTrafficMatchingList({
     siteId: props.siteId,
     trafficMatchingListId: props.trafficMatchingListId
-  }).pipe(Effect12.catchTag("NotFound", () => Effect12.succeed(undefined))),
+  }).pipe(Effect16.catchTag("NotFound", () => Effect16.succeed(undefined))),
   attributes: attributesOf9,
   matches: matches9
 };
 var handlers9 = unifiHandlers(spec9);
-var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect12.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
+var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect16.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
 // src/unifi/providers.ts
 import * as Layer from "effect/Layer";
 var providers = () => Layer.mergeAll(UnifiNetworkProvider(), UnifiFirewallZoneProvider(), UnifiDnsPolicyProvider(), UnifiAclRuleProvider(), UnifiAclRuleOrderingProvider(), UnifiWifiBroadcastProvider(), UnifiFirewallPolicyProvider(), UnifiFirewallPolicyOrderingProvider(), UnifiTrafficMatchingListProvider());
 export {
   GetOnlyHttpClient,
   UNIFI_READ_ONLY_POLICY,
+  UNIFI_WRITE_POLICY,
   UnifiAclRule,
   UnifiAclRuleOrdering,
   UnifiAclRuleOrderingProvider,
   UnifiAclRuleProvider,
   UnifiDnsPolicy,
   UnifiDnsPolicyProvider,
+  UnifiFieldNotRemovable,
+  UnifiFieldNotSettable,
   UnifiFirewallPolicy,
   UnifiFirewallPolicyOrdering,
   UnifiFirewallPolicyOrderingProvider,
   UnifiFirewallPolicyProvider,
   UnifiFirewallZone,
   UnifiFirewallZoneProvider,
+  UnifiIdentityChanged,
+  UnifiImmutableFieldChanged,
+  UnifiLiveDriftedSinceDeploy,
+  UnifiManagementNetworkRefused,
   UnifiNetwork,
   UnifiNetworkProvider,
   UnifiNonGetRequest,
+  UnifiRefusedRequest,
   UnifiTrafficMatchingList,
   UnifiTrafficMatchingListProvider,
+  UnifiUpdateDidNotConverge,
+  UnifiUpdateWouldBeNoop,
   UnifiWifiBroadcast,
   UnifiWifiBroadcastProvider,
   UnifiWriteRefused,
@@ -842,6 +1094,7 @@ export {
   driftOf8 as firewallPolicyOrderingDriftOf,
   firewallZone,
   driftOf2 as firewallZoneDriftOf,
+  guardedHttpClient,
   network,
   driftOf as networkDriftOf,
   providers,
@@ -851,5 +1104,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=5A3AB5CE8957273E64756E2164756E21
+//# debugId=04975D29327C722564756E2164756E21
 //# sourceMappingURL=index.js.map