@homeflare/alchemy 0.50.0 → 0.51.0

package/dist/unifi/index.js.map

@@ -1,13 +1,17 @@
 {
   "version": 3,
-  "sources": ["../src/unifi/policy.ts", "../src/unifi/resource.ts", "../src/unifi/network.ts", "../src/unifi/network-form.ts", "../src/unifi/drift.ts", "../src/unifi/network-drift.ts", "../src/unifi/firewall-zone.ts", "../src/unifi/firewall-zone-form.ts", "../src/unifi/dns-policy.ts", "../src/unifi/dns-policy-form.ts", "../src/unifi/dns-policy-drift.ts", "../src/unifi/acl-rule.ts", "../src/unifi/acl-rule-form.ts", "../src/unifi/acl-rule-drift.ts", "../src/unifi/acl-rule-ordering.ts", "../src/unifi/acl-rule-ordering-form.ts", "../src/unifi/wifi-broadcast.ts", "../src/unifi/wifi-broadcast-form.ts", "../src/unifi/wifi-broadcast-drift.ts", "../src/unifi/paginate.ts", "../src/unifi/firewall-policy.ts", "../src/unifi/firewall-policy-form.ts", "../src/unifi/firewall-policy-drift.ts", "../src/unifi/firewall-policy-ordering.ts", "../src/unifi/firewall-policy-ordering-form.ts", "../src/unifi/traffic-matching-list.ts", "../src/unifi/traffic-matching-list-form.ts", "../src/unifi/traffic-matching-list-drift.ts", "../src/unifi/providers.ts"],
+  "sources": ["../src/unifi/policy.ts", "../src/unifi/wire-guard.ts", "../src/unifi/network.ts", "../src/unifi/network-form.ts", "../src/unifi/drift.ts", "../src/unifi/network-drift.ts", "../src/unifi/network-scope.ts", "../src/unifi/network-update.ts", "../src/unifi/resource.ts", "../src/unifi/update-reconcile.ts", "../src/unifi/firewall-zone.ts", "../src/unifi/firewall-zone-form.ts", "../src/unifi/dns-policy.ts", "../src/unifi/dns-policy-form.ts", "../src/unifi/dns-policy-drift.ts", "../src/unifi/acl-rule.ts", "../src/unifi/acl-rule-form.ts", "../src/unifi/acl-rule-drift.ts", "../src/unifi/acl-rule-ordering.ts", "../src/unifi/acl-rule-ordering-form.ts", "../src/unifi/wifi-broadcast.ts", "../src/unifi/wifi-broadcast-form.ts", "../src/unifi/wifi-broadcast-drift.ts", "../src/unifi/paginate.ts", "../src/unifi/firewall-policy.ts", "../src/unifi/firewall-policy-form.ts", "../src/unifi/firewall-policy-drift.ts", "../src/unifi/firewall-policy-ordering.ts", "../src/unifi/firewall-policy-ordering-form.ts", "../src/unifi/traffic-matching-list.ts", "../src/unifi/traffic-matching-list-form.ts", "../src/unifi/traffic-matching-list-drift.ts", "../src/unifi/providers.ts"],
   "sourcesContent": [
-    "/**\n * The one refusal every `Unifi.*` write handler returns — never an SDK write call.\n *\n * ⛔ TIM'S RULE, 2026-09-24: UniFi (and OPNsense) are READ-ONLY FOR NOW. This family has no\n *   `create`, no `update` body and no delete call anywhere in its source — `reconcile` and\n *   `delete` both fail with this typed error instead, and `resource.test.ts` proves the point\n *   with a fake `HttpClient` that fails the test on any request that is not a `GET`. Lifting the\n *   policy is a kit change (a new PR that adds a write path, reviewed as one), not a flag a stack\n *   can pass.\n *\n * ★ A TYPED TAG, NOT A THROWN STRING (S21). `Effect.catchTag('UnifiWriteRefused', …)` lets a\n *   caller (a future import script, a test) branch on the refusal without parsing a message.\n */\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\n\nexport const UNIFI_READ_ONLY_POLICY =\n  \"read-only by Tim's rule, 2026-09-24; lifting it is a kit change\";\n\n/** What kind of write was asked for and refused — for the message only, never acted on. */\nexport type UnifiWriteAction = 'create' | 'update' | 'delete';\n\nexport class UnifiWriteRefused extends Data.TaggedError('UnifiWriteRefused')<{\n  /** The vendor type string, e.g. `Unifi.Network`. */\n  readonly type: string;\n  /** `spec.describe(props)` — the object the write would have touched. */\n  readonly identity: string;\n  readonly action: UnifiWriteAction;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: refusing to ${this.action} -- ${UNIFI_READ_ONLY_POLICY}.`;\n  }\n}\n\n/** The only thing `reconcile`/`delete` ever return for a write this family cannot make. */\nexport const refuseWrite = (type: string, identity: string, action: UnifiWriteAction) =>\n  Effect.fail(new UnifiWriteRefused({ type, identity, action }));\n",
-    "/**\n * One shape for every UniFi Network read-only object — `Unifi.Network`, `Unifi.FirewallZone`,\n * and whatever import adds next.\n *\n * ★ MIRRORS `../discord/resource.ts` (S7-S10, H1, H5), NOT `../netbox/resource.ts`. Both are\n *   \"marker-less API\" families (S8): UniFi Network objects carry no tag or metadata field this\n *   stack could stamp as ownership, so a cold read of a match is `Unowned(attrs)` exactly like\n *   `Cloudflare/Snippets/Snippet.ts@v2.0.0-beta.79#read`, the reference implementation S8 and H1\n *   both cite. `adopt(true)`, piped on by each resource's convenience constructor (H5), turns\n *   that into a silent one-time bind instead of an `OwnedBySomeoneElse` refusal.\n *\n * ⛔ THE DIFFERENCE FROM EVERY OTHER FAMILY HERE: THERE IS NO `create`, `update` OR `destroy` IN\n *   THIS SPEC AT ALL. Tim's rule, 2026-09-24 (`policy.ts`): UniFi and OPNsense are read-only. So\n *   `reconcile` below can only ever refuse or report an exact match — it has no write path to\n *   fall into by accident, and no resource file wired through this engine can reach one either.\n *\n * ⚠️ RECONCILE STILL HAS TO SUCCEED ON AN EXACT-MATCH ADOPTION, NOT JUST REFUSE UNCONDITIONALLY.\n *   Measured against `Plan.ts@v2.0.0-beta.79` (`forceUpdateAfterAdoption`, H6): beta.79 forces\n *   ONE reconcile call after every cold adoption, whether or not the diff said noop — so a\n *   resource whose `reconcile` always failed would break the ordinary \"adopt an unchanged\n *   object\" deploy, not just a real write. The fix, exactly like `discordOperations.reconcile`:\n *   read the live object again, and refuse ONLY when it is missing (would need a create) or\n *   drifted (would need a write to converge). An exact match returns the live attributes and\n *   calls nothing — S10's \"zero write calls when there is no drift\" holds even under the forced\n *   post-adoption call.\n *\n * ⚠️ `NotFound` IS FOLDED TO \"ABSENT\" INSIDE EACH RESOURCE FILE'S OWN `fetchLive`, NOT HERE —\n *   same split netbox's `resource.ts` uses and for the same reason: `Effect.catchTag`'s\n *   tag-literal inference needs a concrete error union to resolve `\"NotFound\"` against, and a\n *   spec's `E` is only concrete at each resource file's own call site. Every OTHER failure (a\n *   real 5xx, a network error, `Forbidden`) is NOT folded anywhere — it fails the plan loudly,\n *   per the task's own rule: only a genuine not-found may mean absent.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { CredentialsFromEnv } from '@distilled.cloud/unifi-network/Credentials';\nimport type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';\nimport * as Effect from 'effect/Effect';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport { UNIFI_READ_ONLY_POLICY, refuseWrite } from './policy.ts';\n\n/** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */\nexport type UnifiRequirements = HttpClient.HttpClient;\n\n/**\n * One UniFi Network object's read. `Live` is whatever the SDK decodes (a `NetworkDetails`, a\n * `FirewallZone`, …); `E` is left to each resource file to declare (its own `fetchLive`'s error\n * union, with `NotFound` already folded away) so the precise per-operation error union flows\n * through instead of being widened by hand here.\n */\nexport type UnifiSpec<Props extends object, Live, Attributes extends object, E> = {\n  /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */\n  readonly type: string;\n  /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */\n  readonly fetchLive: (props: Props) => Effect.Effect<Live | undefined, E, UnifiNetworkOpContext>;\n  readonly attributes: (live: Live, props: Props) => Attributes;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /** For the refusal message and read-back failures. */\n  readonly describe: (props: Props) => string;\n};\n\nexport const unifiOperations = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const read = (props: Props) =>\n    spec\n      .fetchLive(props)\n      .pipe(Effect.map((live) => (live === undefined ? undefined : spec.attributes(live, props))));\n\n  return {\n    read,\n\n    readHandler: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n      Effect.gen(function* () {\n        const attrs = yield* read(olds);\n        if (attrs === undefined) return undefined;\n        // Warm read (persisted `output` says a prior apply already adopted this exact object):\n        // plain attributes. Cold read (fresh store, or state lost): no ownership marker on this\n        // vendor exists to tell \"ours\" from \"someone else's\" apart, so Unowned until adopt(true).\n        return output !== undefined ? attrs : Unowned(attrs);\n      }),\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        return spec.matches(live, news)\n          ? ({ action: 'noop' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    reconcile: (news: Props) =>\n      Effect.gen(function* () {\n        const live = yield* read(news);\n        if (live === undefined) return yield* refuseWrite(spec.type, spec.describe(news), 'create');\n        if (!spec.matches(live, news)) {\n          return yield* refuseWrite(spec.type, spec.describe(news), 'update');\n        }\n        // Exact match: the object already is what is declared. Zero write calls (S10), correct\n        // whether this is a routine deploy or beta.79's forced post-adoption reconcile (H6).\n        return live;\n      }),\n\n    destroy: (olds: Props) => refuseWrite(spec.type, spec.describe(olds), 'delete'),\n  };\n};\n\n/**\n * B0a / T12 DEFENSE IN DEPTH. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at\n * `reconcile`/`destroy` — every path this engine exposes already returns that refusal instead of\n * calling an SDK write op. This guard stops the same thing one layer lower, AT THE WIRE: it wraps\n * whatever `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in\n * production, `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same\n * \"wrap, don't replace\" seam) so a future resource file that, by mistake, called an SDK write\n * operation directly — bypassing `unifiOperations` entirely — would still never reach the vendor\n * API. `write-op-reference.test.ts` proves no such call exists today; this is what stops one from\n * ever taking effect if one is ever added.\n *\n * ⚠️ `Effect.die`, NOT A TYPED FAILURE — classified per distilled-doctrine's \"classify every\n *   die/orDie\". Every generated SDK operation (`networks.getNetworkDetails`, …) declares its OWN\n *   closed error union from the pinned OpenAPI spec, and generated files are never hand-edited to\n *   add a member to it. A typed `Effect.fail` here would be a failure mode absent from every op's\n *   declared type the moment it occurred — a type-system lie. A defect is the sound way to add a\n *   NEW \"this must be structurally impossible\" failure underneath types this package does not\n *   own, exactly like `openbao`'s `refuse()` helpers' `Effect.die(new Error(...))` for a\n *   configuration move that should never be reachable.\n */\nexport class UnifiNonGetRequest extends Error {\n  constructor(\n    readonly method: string,\n    /** PATH ONLY, never the full URL — see `requestPath` below. */\n    readonly path: string,\n  ) {\n    super(\n      `UniFi HttpClient guard: refused ${method} ${path} -- ${UNIFI_READ_ONLY_POLICY}. This is a ` +\n        'defect, not a recoverable condition: something under src/unifi tried to send a non-GET ' +\n        \"request, which policy.ts's per-operation refusal should already have made impossible. \" +\n        'Fix the kit code that produced this request.',\n    );\n    this.name = 'UnifiNonGetRequest';\n  }\n}\n\n/**\n * ⛔ PATH ONLY, NEVER THE HOST. A cloud connector's base URL embeds the account's Console ID\n *   (`docs/unifi.md`'s Credentials section, T3) — a defect message is still a message that can\n *   reach a log, a CI failure body or a pasted error report, so it gets the same treatment as\n *   `redactUrls` gives the import layer's own error text. Falls back to a fixed placeholder rather\n *   than the raw string on a parse failure, so a malformed URL can never leak through unredacted.\n */\nconst requestPath = (url: string): string => {\n  try {\n    return new URL(url).pathname;\n  } catch {\n    return '<unparseable request url>';\n  }\n};\n\nconst guardGetOnly = (client: HttpClient.HttpClient): HttpClient.HttpClient =>\n  client.pipe(\n    HttpClient.mapRequestEffect((request) =>\n      request.method === 'GET'\n        ? Effect.succeed(request)\n        : Effect.die(new UnifiNonGetRequest(request.method, requestPath(request.url))),\n    ),\n  );\n\n/**\n * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,\n * for everything downstream, with `guardGetOnly`'s wrapped version (`HttpClient.layerMergedContext`\n * — see the guard above). Exported so `get-only-guard.test.ts` can prove the mechanism directly,\n * against a bare `HttpClient` service, without needing `CredentialsFromEnv` or any env var at all.\n */\nexport const GetOnlyHttpClient = HttpClient.layerMergedContext(\n  Effect.map(HttpClient.HttpClient, guardGetOnly),\n);\n\n/**\n * The four provider handlers for a spec'd read-only UniFi object, wired once.\n *\n * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;\n *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.\n */\nexport const unifiHandlers = <Props extends object, Live, Attributes extends object, E>(\n  spec: UnifiSpec<Props, Live, Attributes, E>,\n) => {\n  const ops = unifiOperations(spec);\n  const withCredentials = <A, Err>(effect: Effect.Effect<A, Err, UnifiNetworkOpContext>) =>\n    effect.pipe(Effect.provide(GetOnlyHttpClient), Effect.provide(CredentialsFromEnv));\n  return {\n    list: () => Effect.succeed([]),\n    read: (args: { olds: Props; output: Attributes | undefined }) =>\n      withCredentials(ops.readHandler(args)),\n    diff: (args: { news: Input<Props>; output: Attributes | undefined }) =>\n      withCredentials(ops.diff(args.news, args.output)),\n    reconcile: (args: { news: Props }) => withCredentials(ops.reconcile(args.news)),\n    delete: (args: { olds: Props }) => withCredentials(ops.destroy(args.olds)),\n  };\n};\n",
-    "/**\n * `Unifi.Network` — one network on a UniFi Network site, READ-ONLY (`policy.ts`).\n *\n * ★ WHY NETWORK IS IN THE FIRST IMPORT SET. `getNetworkDetails`/`getNetworksOverviewPage`\n *   (`../../distilled-unifi-network/src/services/networks.ts`) is a list+get pair over\n *   genuine configuration — VLAN, DHCP guarding, IPv4/IPv6 addressing, isolation — not runtime\n *   state like a connected client, a device statistic or a hotspot voucher. It is also the SDK\n *   package's own README recommendation for a first read/adopt-only resource, alongside `Site`\n *   (skipped here — no `getSite`, only the list operation, so it fails this task's own \"both a\n *   list and a get\" bar) and `FirewallZone`/`FirewallPolicy` (`firewall-zone.ts` ships\n *   `FirewallZone`; `FirewallPolicy`'s several discriminated filter variants and its\n *   list-replacing ordering endpoint are a bigger, separate PR).\n *\n * ⛔ THE WHOLE-OBJECT-PUT TRAP (`docs/unifi-api-notes.md`) NEVER FIRES HERE, BY CONSTRUCTION.\n *   `updateNetwork` is a `PUT` that disables `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration`\n *   outright when the caller omits them — the exact failure mode a read-only family cannot cause,\n *   because `resource.ts`'s `reconcile` never calls `updateNetwork` at all. Recorded here for\n *   whoever adds the write path this docs note anticipates: read-merge-write the WHOLE object,\n *   never a props-only body.\n */\nimport { Resource } from 'alchemy';\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as networks from '@distilled.cloud/unifi-network/networks';\nimport * as Effect from 'effect/Effect';\nimport { type NetworkAttributes, type NetworkProps, attributesOf } from './network-form.ts';\nimport { matches } from './network-drift.ts';\nimport type { UnifiRequirements, UnifiSpec } from './resource.ts';\nimport { unifiHandlers } from './resource.ts';\n\nexport type { NetworkAttributes, NetworkProps } from './network-form.ts';\nexport { declareNetwork } from './network-form.ts';\n// MEDIUM-4: `matches` moved here from `network-form.ts` — see network-drift.ts's own header. Not\n// re-exported from this barrel file either, same as before the move: `spec.matches` below is the\n// only consumer a provider needs.\nexport { driftOf } from './network-drift.ts';\n\nexport interface UnifiNetwork extends Resource<\n  'Unifi.Network',\n  NetworkProps,\n  NetworkAttributes,\n  never,\n  UnifiRequirements\n> {}\n\nexport const UnifiNetwork = Resource<UnifiNetwork>('Unifi.Network', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * `network('lan', props)` — `adopt(true)` piped on by default (H5). This family never writes, so\n * the only thing a first deploy against an existing network could ever do is bind to it or refuse\n * `OwnedBySomeoneElse`; piping `adopt(true)` here picks the former without a stack having to\n * remember `--adopt`, mirroring `discord/application-command.ts`'s `applicationCommand`.\n */\nexport const network = (id: string, props: NetworkProps) =>\n  UnifiNetwork(id, props).pipe(adopt(true));\n\n/**\n * ★ EXPORTED for direct testing against a fake `Credentials` layer (`fake-unifi.ts`), the same\n *   seam `netbox/prefix.ts`'s `spec` and `discord/application-command.ts`'s `spec` use — `handlers`\n *   bakes in `CredentialsFromEnv`, which resolves environment variables a test cannot repoint.\n */\nexport const spec: UnifiSpec<\n  NetworkProps,\n  networks.NetworkDetails,\n  NetworkAttributes,\n  networks.GetNetworkDetailsError\n> = {\n  type: 'Unifi.Network',\n  describe: (props) => `sites/${props.siteId}/networks/${props.networkId}`,\n  fetchLive: (props) =>\n    networks\n      .getNetworkDetails({ siteId: props.siteId, networkId: props.networkId })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  attributes: attributesOf,\n  matches,\n};\n\nexport const handlers = unifiHandlers(spec);\n\nexport const UnifiNetworkProvider = () =>\n  Provider.effect(UnifiNetwork, Effect.succeed(UnifiNetwork.Provider.of(handlers)));\n",
+    "/**\n * The one refusal every refused `Unifi.*` write returns. The family makes exactly one SDK write\n * call — `networks.updateNetwork`, through `network-update.ts` — and that is the only write that\n * never sees this error.\n *\n * ⛔ TIM'S RULE, 2026-09-24: UniFi (and OPNsense) are READ-ONLY. LIFTED FOR EXACTLY ONE CASE on\n *   2026-10-10 (Tim): `Unifi.Network` update, through `update-reconcile.ts` + `network-update.ts`.\n *   Every other write — create, delete, any other family's update — still fails with this typed\n *   error, and `resource.test.ts`/`wire-guard.test.ts` prove it with a fake `HttpClient` that\n *   records every request. Widening the policy again is a kit change (a new PR, reviewed as one),\n *   not a flag a stack can pass.\n *\n * ★ A TYPED TAG, NOT A THROWN STRING (S21). `Effect.catchTag('UnifiWriteRefused', …)` lets a\n *   caller (a future import script, a test) branch on the refusal without parsing a message.\n */\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\n\nexport const UNIFI_WRITE_POLICY =\n  'UniFi is adopt-only except Unifi.Network update: one whole-object PUT built from the live ' +\n  'object plus the declared field changes, only on a row with prior Alchemy state, only through ' +\n  'deploy-approve; create/delete and every other family stay refused -- widening is a kit change ' +\n  '(Tim 2026-10-10 lifts the 2026-09-24 rule for this one case)';\n\n/** @deprecated renamed `UNIFI_WRITE_POLICY`; kept so existing consumer imports do not break. */\nexport const UNIFI_READ_ONLY_POLICY = UNIFI_WRITE_POLICY;\n\n/** What kind of write was asked for and refused — for the message only, never acted on. */\nexport type UnifiWriteAction = 'create' | 'update' | 'delete';\n\nexport class UnifiWriteRefused extends Data.TaggedError('UnifiWriteRefused')<{\n  /** The vendor type string, e.g. `Unifi.Network`. */\n  readonly type: string;\n  /** `spec.describe(props)` — the object the write would have touched. */\n  readonly identity: string;\n  readonly action: UnifiWriteAction;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: refusing to ${this.action} -- ${UNIFI_WRITE_POLICY}.`;\n  }\n}\n\n/** The only thing `reconcile`/`delete` ever return for a write this family cannot make. */\nexport const refuseWrite = (type: string, identity: string, action: UnifiWriteAction) =>\n  Effect.fail(new UnifiWriteRefused({ type, identity, action }));\n\n// ⛔ THE THREE ERRORS BELOW CARRY FIELD NAMES ONLY, NEVER VALUES: a network row holds addressing\n//   detail, and an error message reaches logs, CI bodies and pasted reports.\nconst fieldList = (fields: ReadonlyArray<string>) => `[${fields.join(', ')}]`;\n\n/** Live no longer equals what the last deploy wrote: a hand edit is never overwritten. */\nexport class UnifiLiveDriftedSinceDeploy extends Data.TaggedError('UnifiLiveDriftedSinceDeploy')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly fields: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return (\n      `${this.type} ${this.identity}: live differs from the last deployed state on ` +\n      `${fieldList(this.fields)}; refusing to PUT over it. Two causes look identical from here: a ` +\n      'hand edit on the console, or an earlier PUT that landed but did not converge ' +\n      '(UnifiUpdateDidNotConverge). Re-import the live object first.'\n    );\n  }\n}\n\n/** The merged body equals live: a PUT would change nothing (keeps a re-PUT loop impossible). */\nexport class UnifiUpdateWouldBeNoop extends Data.TaggedError('UnifiUpdateWouldBeNoop')<{\n  readonly type: string;\n  readonly identity: string;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: the merged update body equals live; refusing a no-op PUT.`;\n  }\n}\n\n/** The PUT answered, yet the response still differs from the declaration. */\nexport class UnifiUpdateDidNotConverge extends Data.TaggedError('UnifiUpdateDidNotConverge')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly fields: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return (\n      `${this.type} ${this.identity}: the PUT LANDED, but live now differs from the declaration on ` +\n      `${fieldList(this.fields)}. The change is on the console and is not rolled back; the next ` +\n      'deploy will see this as drift. Recovery is a re-import of the live object.'\n    );\n  }\n}\n\n// ⛔ THE FIVE ERRORS BELOW BOUND THE WRITE SCOPE (`network-scope.ts`, `update-reconcile.ts`): the\n//   one intended consumer is a single VLAN's `ipv6Configuration`. Field names only, as above.\n\n/** A patch would remove a key outside the removable allowlist (an omitted block is turned off). */\nexport class UnifiFieldNotRemovable extends Data.TaggedError('UnifiFieldNotRemovable')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly fields: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return (\n      `${this.type} ${this.identity}: refusing to remove ${fieldList(this.fields)}; a whole-object ` +\n      'PUT turns an omitted block off, and only the removable allowlist may be dropped.'\n    );\n  }\n}\n\n/** A patch would SET a key outside the settable allowlist (only `ipv6Configuration` may be written). */\nexport class UnifiFieldNotSettable extends Data.TaggedError('UnifiFieldNotSettable')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly fields: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return (\n      `${this.type} ${this.identity}: refusing to set ${fieldList(this.fields)}; this write path ` +\n      'only sets the settable allowlist (ipv6Configuration).'\n    );\n  }\n}\n\n/** The live object is the site's default (management) network: never written. */\nexport class UnifiManagementNetworkRefused extends Data.TaggedError(\n  'UnifiManagementNetworkRefused',\n)<{\n  readonly type: string;\n  readonly identity: string;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: live is the default (management) network; refusing any write to it.`;\n  }\n}\n\n/** A patch changes a field that decides where the network lives or what serves it. */\nexport class UnifiImmutableFieldChanged extends Data.TaggedError('UnifiImmutableFieldChanged')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly fields: ReadonlyArray<string>;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: refusing to change ${fieldList(this.fields)}; those fields are never written.`;\n  }\n}\n\n/** `olds` and `news` name different objects: the prior state is no baseline for this write. */\nexport class UnifiIdentityChanged extends Data.TaggedError('UnifiIdentityChanged')<{\n  readonly type: string;\n  readonly identity: string;\n  readonly previous: string;\n}> {\n  override get message(): string {\n    return `${this.type} ${this.identity}: the last deploy named ${this.previous}; refusing to PUT against another object.`;\n  }\n}\n",
+    "/**\n * B0a / T12 DEFENSE IN DEPTH, AT THE WIRE. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at\n * `reconcile`/`destroy`; this guard stops the same thing one layer lower. It wraps whatever\n * `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in production,\n * `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same \"wrap, don't\n * replace\" seam), so an SDK write operation called by mistake, bypassing `unifiOperations`, still\n * never reaches the vendor API. `write-op-reference.test.ts` proves no such call exists outside\n * `network-update.ts`; this is what stops one from ever taking effect.\n *\n * ★ A GET ALWAYS PASSES THE REQUEST GUARD; ANY OTHER METHOD PASSES ONLY WHEN `(method, pathname)`\n *   MATCHES AN ENTRY OF THE `allow` LIST. `unifiHandlers` builds that list PER ROW\n *   (`spec.update.allowedWrite(news)`): the one PUT that can pass is to this row's own\n *   `/v1/sites/<siteId>/networks/<networkId>` under the CONFIGURED base URL (local and\n *   cloud-connector base paths differ, so the base is passed in and compared exactly, `isAllowed`).\n *   A PUT to another network id, the list route, or another family dies here.\n *\n * ⚠️ `Effect.die`, NOT A TYPED FAILURE — every generated SDK operation declares its OWN closed\n *   error union from the pinned OpenAPI spec and generated files are never hand-edited, so a typed\n *   `Effect.fail` here would be a failure absent from every op's declared type. A defect is the\n *   sound way to add a \"structurally impossible\" failure underneath types this package does not\n *   own, like `openbao`'s `refuse()` helpers.\n *\n * ⛔ REDIRECTS (LOW-7), REFUSED FOR EVERY METHOD — GETs included, 2026-10-10. The layer sets fetch\n *   `redirect: 'manual'` on EVERY guarded request and the guard dies on any 3xx answer. Default\n *   fetch follows a redirect and re-sends the request to a `Location` this guard never saw — a PUT\n *   with its body on 307/308, a GET still carrying the API-key header — so following is never\n *   safe. Scoping `manual` to a non-empty allow list (the pre-2026-10-10 shape) also made the two\n *   postures DIVERGE by accident: reconcile's own GETs ran manual, so a 3xx surfaced raw and failed\n *   the SDK decode, while read/diff under `GetOnlyHttpClient` followed the redirect silently. One\n *   rule for both postures now: a redirect is refused everywhere, fail closed.\n */\nimport * as Effect from 'effect/Effect';\nimport * as Option from 'effect/Option';\nimport * as FetchHttpClient from 'effect/http/FetchHttpClient';\nimport * as HttpClient from 'effect/http/HttpClient';\nimport * as HttpClientRequest from 'effect/http/HttpClientRequest';\nimport type * as HttpClientResponse from 'effect/http/HttpClientResponse';\nimport { UNIFI_WRITE_POLICY } from './policy.ts';\n\n/**\n * One non-GET request the guard may let through. `tail` is the exact route below the configured\n * base URL (`/v1/sites/<site>/networks/<id>`): the guard compares the request's origin and path to\n * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).\n */\nexport type AllowedWrite = { readonly method: 'PUT'; readonly tail: string };\n\nexport class UnifiRefusedRequest extends Error {\n  constructor(\n    readonly method: string,\n    /** PATH ONLY, never the full URL — see `requestPath` below. */\n    readonly path: string,\n    detail = \"not on this row's allow list\",\n  ) {\n    super(\n      `UniFi HttpClient guard: refused ${method} ${path} (${detail}) -- ${UNIFI_WRITE_POLICY}. ` +\n        'This is a defect, not a recoverable condition: something under src/unifi sent a request ' +\n        \"policy.ts's per-operation refusal should already have made impossible. Fix the kit \" +\n        'code that produced this request.',\n    );\n    this.name = 'UnifiRefusedRequest';\n  }\n}\n\n/** @deprecated renamed `UnifiRefusedRequest`; kept so existing consumer imports do not break. */\nexport const UnifiNonGetRequest = UnifiRefusedRequest;\nexport type UnifiNonGetRequest = UnifiRefusedRequest;\n\n/**\n * ⛔ PATH ONLY, NEVER THE HOST. A cloud connector's base URL embeds the account's Console ID\n *   (`docs/unifi.md`'s Credentials section, T3) — a defect message can still reach a log or a CI\n *   failure body. Falls back to a fixed placeholder on a parse failure so a malformed URL can\n *   never leak through unredacted.\n */\nconst requestPath = (url: string): string => {\n  try {\n    // ⛔ The cloud connector path is `/v1/connector/consoles/<consoleId>/...`: the id is dropped too.\n    return new URL(url).pathname.replace(/(\\/consoles\\/)[^/]*/g, '$1<redacted>');\n  } catch {\n    return '<unparseable request url>';\n  }\n};\n\n/**\n * ⛔ ANCHORED TO THE CONFIGURED BASE URL, NOT A SUFFIX. The request must share the base's origin,\n *   its path must be exactly `<base path><tail>` (so `//v1/...`, another base path or a nested\n *   `/v1/sites/X/v1/sites/s/...` all miss), and it must carry no query or fragment (`?force=true`).\n *   Without a base URL nothing is allowed: fail closed.\n */\nconst isAllowed = (\n  allow: ReadonlyArray<AllowedWrite>,\n  baseUrl: string | undefined,\n  method: string,\n  request: HttpClientRequest.HttpClientRequest,\n) => {\n  if (baseUrl === undefined) return false;\n  try {\n    const base = new URL(baseUrl);\n    // ⛔ `toUrl`, NOT `request.url`: `setUrlParam` keeps its parameters OUTSIDE `request.url`, so\n    //   the bare string looked query-free while the wire request carried `?force=true` (round 2, F5).\n    const resolved = HttpClientRequest.toUrl(request);\n    if (Option.isNone(resolved)) return false;\n    const target = resolved.value;\n    if (target.origin !== base.origin || target.search !== '' || target.hash !== '') return false;\n    const basePath = base.pathname.replace(/\\/+$/, '');\n    return allow.some(\n      (entry) => entry.method === method && target.pathname === `${basePath}${entry.tail}`,\n    );\n  } catch {\n    return false;\n  }\n};\n\n/** True when the response says it came from a different URL than the request named. */\nconst followedElsewhere = (res: HttpClientResponse.HttpClientResponse): boolean => {\n  const sent = HttpClientRequest.toUrl(res.request);\n  return res.url !== '' && Option.isSome(sent) && res.url !== sent.value.href.split('#')[0];\n};\n\nconst guard = (\n  client: HttpClient.HttpClient,\n  allow: ReadonlyArray<AllowedWrite>,\n  baseUrl: string | undefined,\n) =>\n  client.pipe(\n    HttpClient.mapRequestEffect((request) =>\n      request.method === 'GET' || isAllowed(allow, baseUrl, request.method, request)\n        ? Effect.succeed(request)\n        : Effect.die(new UnifiRefusedRequest(request.method, requestPath(request.url))),\n    ),\n    HttpClient.transformResponse((response) =>\n      Effect.flatMap(response, (res) =>\n        // ⛔ ANY METHOD: a GET's 3xx is refused exactly like a PUT's — see REDIRECTS in the header.\n        res.status >= 300 && res.status < 400\n          ? Effect.die(\n              new UnifiRefusedRequest(\n                res.request.method,\n                requestPath(res.request.url),\n                `answered a ${res.status} redirect`,\n              ),\n            )\n          : // ⛔ BACKSTOP (round 2, F3): if a consumer's own transform replaced `manual` and fetch\n            //   followed a redirect, the response URL is no longer the request's. Die on that.\n            followedElsewhere(res)\n            ? Effect.die(\n                new UnifiRefusedRequest(\n                  res.request.method,\n                  requestPath(res.request.url),\n                  'the response URL differs from the request URL (a redirect was followed)',\n                ),\n              )\n            : Effect.succeed(res),\n      ),\n    ),\n  );\n\n/**\n * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,\n * for everything downstream, with the guarded version. Exported so `wire-guard.test.ts` can prove\n * the mechanism against a bare `HttpClient`, without `CredentialsFromEnv` or any env var.\n */\nexport const guardedHttpClient = (allow: ReadonlyArray<AllowedWrite>, baseUrl?: string) => {\n  return HttpClient.layerMergedContext(\n    Effect.map(HttpClient.HttpClient, (client) =>\n      // ⛔ MANUAL REDIRECT ON BOTH POSTURES, not just an allow list: the response guard refuses a\n      //   3xx for GETs too, and under the default 'follow' a GET redirect is silently followed —\n      //   the guard would never see it, and read/diff would diverge from reconcile again.\n      HttpClient.transform(guard(client, allow, baseUrl), manualRedirect),\n    ),\n  );\n};\n\n/**\n * ⛔ `redirect: 'manual'` IS SET PER REQUEST, ON THE CALLING FIBER'S `RequestInit`. A layer-provided\n *   `RequestInit` is silently REPLACED by an outer one (Effect 4.0.1 `layerMergedContext` merges the\n *   caller's context over the layer's), which would turn redirects back on. Same read-merge-provide\n *   pattern as `openbao/bao-http.ts`'s `overSocket`; outer fetch options are kept.\n */\nconst manualRedirect = <E, R>(\n  effect: Effect.Effect<HttpClientResponse.HttpClientResponse, E, R>,\n): Effect.Effect<HttpClientResponse.HttpClientResponse, E, R> =>\n  Effect.flatMap(Effect.serviceOption(FetchHttpClient.RequestInit), (existing) =>\n    Effect.provideService(effect, FetchHttpClient.RequestInit, {\n      ...Option.getOrElse(existing, () => ({})),\n      redirect: 'manual',\n    }),\n  );\n\n/**\n * No write may pass; the posture of `read`/`diff`/`delete` and of every non-updatable family. A 3xx\n * answer to a GET is refused here exactly as under the allow-list posture — see REDIRECTS above.\n */\nexport const GetOnlyHttpClient = guardedHttpClient([]);\n",
+    "/**\n * `Unifi.Network` — one network on a UniFi Network site, READ-ONLY (`policy.ts`).\n *\n * ★ WHY NETWORK IS IN THE FIRST IMPORT SET. `getNetworkDetails`/`getNetworksOverviewPage`\n *   (`../../distilled-unifi-network/src/services/networks.ts`) is a list+get pair over\n *   genuine configuration — VLAN, DHCP guarding, IPv4/IPv6 addressing, isolation — not runtime\n *   state like a connected client, a device statistic or a hotspot voucher. It is also the SDK\n *   package's own README recommendation for a first read/adopt-only resource, alongside `Site`\n *   (skipped here — no `getSite`, only the list operation, so it fails this task's own \"both a\n *   list and a get\" bar) and `FirewallZone`/`FirewallPolicy` (`firewall-zone.ts` ships\n *   `FirewallZone`; `FirewallPolicy`'s several discriminated filter variants and its\n *   list-replacing ordering endpoint are a bigger, separate PR).\n *\n * ⛔ THE WHOLE-OBJECT-PUT TRAP (packages/distilled-unifi-network/README.md) FIRES HERE, THROUGH `network-update.ts`;\n *   see its header. `updateNetwork` is a `PUT` that disables `dhcpGuarding`/`ipv4Configuration`/\n *   `ipv6Configuration` outright when the caller omits them, so the body is the raw live object\n *   plus only the fields the declaration changed since the last deploy — never props alone.\n *   This is the ONE family with a write path (Tim 2026-10-10, `policy.ts`); create/delete refuse.\n */\nimport { Resource } from 'alchemy';\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as networks from '@distilled.cloud/unifi-network/networks';\nimport * as Effect from 'effect/Effect';\nimport { type NetworkAttributes, type NetworkProps, attributesOf } from './network-form.ts';\nimport { driftOf, matches } from './network-drift.ts';\nimport { type ScopeError, checkNetworkWriteScope } from './network-scope.ts';\nimport { writeNetwork } from './network-update.ts';\nimport type { UnifiUpdateWouldBeNoop } from './policy.ts';\nimport type { UnifiRequirements, UnifiSpec } from './resource.ts';\nimport { unifiHandlers } from './resource.ts';\nimport type { AllowedWrite } from './wire-guard.ts';\n\ntype UpdateError = networks.UpdateNetworkError | UnifiUpdateWouldBeNoop | ScopeError;\n\nexport type { NetworkAttributes, NetworkProps } from './network-form.ts';\nexport { declareNetwork } from './network-form.ts';\n// MEDIUM-4: `matches` moved here from `network-form.ts` — see network-drift.ts's own header. Not\n// re-exported from this barrel file either, same as before the move: `spec.matches` below is the\n// only consumer a provider needs.\nexport { driftOf } from './network-drift.ts';\n\nexport interface UnifiNetwork extends Resource<\n  'Unifi.Network',\n  NetworkProps,\n  NetworkAttributes,\n  never,\n  UnifiRequirements\n> {}\n\nexport const UnifiNetwork = Resource<UnifiNetwork>('Unifi.Network', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/**\n * `network('lan', props)` — `adopt(true)` piped on by default (H5). A cold first deploy against an\n * existing network can still only bind to it or refuse `OwnedBySomeoneElse` — the update path\n * needs prior Alchemy state (`update-reconcile.ts`), so it cannot fire on adoption. Piping\n * `adopt(true)` here picks the bind without a stack having to remember `--adopt`, mirroring\n * `discord/application-command.ts`'s `applicationCommand`.\n */\nexport const network = (id: string, props: NetworkProps) =>\n  UnifiNetwork(id, props).pipe(adopt(true));\n\n/**\n * ★ EXPORTED for direct testing against a fake `Credentials` layer (`fake-unifi.ts`), the same\n *   seam `netbox/prefix.ts`'s `spec` and `discord/application-command.ts`'s `spec` use — `handlers`\n *   bakes in `CredentialsFromEnv`, which resolves environment variables a test cannot repoint.\n */\n/**\n * Every declarable key: `NetworkProps` minus the two identity ids. A test pins this against a\n * fully-populated `NetworkProps` literal so a new prop cannot be silently unpatchable.\n */\nexport const NETWORK_PATCH_KEYS: ReadonlyArray<keyof NetworkProps> = [\n  'name',\n  'enabled',\n  'management',\n  'vlanId',\n  'dhcpGuarding',\n  'cellularBackupEnabled',\n  'internetAccessEnabled',\n  'ipv4Configuration',\n  'ipv6Configuration',\n  'isolationEnabled',\n  'mdnsForwardingEnabled',\n  'zoneId',\n  'deviceId',\n];\n\n/**\n * The only PUT that may pass for this row: its own `/v1/sites/<siteId>/networks/<networkId>` under\n * the configured base URL. ⛔ Built from the row's NEW props (the ids the write is about to use) and\n * compared by exact string against the request path, so no id can act as a pattern.\n */\nexport const networkAllowedWrite = (props: NetworkProps): AllowedWrite => ({\n  method: 'PUT',\n  tail: `/v1/sites/${props.siteId}/networks/${props.networkId}`,\n});\n\nexport const spec: UnifiSpec<\n  NetworkProps,\n  networks.NetworkDetails,\n  NetworkAttributes,\n  networks.GetNetworkDetailsError,\n  UpdateError\n> = {\n  type: 'Unifi.Network',\n  describe: (props) => `sites/${props.siteId}/networks/${props.networkId}`,\n  fetchLive: (props) =>\n    networks\n      .getNetworkDetails({ siteId: props.siteId, networkId: props.networkId })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  attributes: attributesOf,\n  matches,\n  update: {\n    allowedWrite: networkAllowedWrite,\n    patchKeys: NETWORK_PATCH_KEYS,\n    driftOf,\n    checkScope: checkNetworkWriteScope,\n    write: writeNetwork,\n  },\n};\n\nexport const handlers = unifiHandlers(spec);\n\nexport const UnifiNetworkProvider = () =>\n  Provider.effect(UnifiNetwork, Effect.succeed(UnifiNetwork.Provider.of(handlers)));\n",
     "/**\n * `Unifi.Network`'s wire shape: the declarable subset of `NetworkDetails`, and how a live read\n * becomes both plan attributes and a rendered declaration.\n *\n * ⚠️ PROPS MIRROR `UpdateNetworkRequest`, NOT `NetworkDetails`. `default` and `metadata` are\n *   server-derived — no writable endpoint in `networks.ts` accepts either — so they are\n *   attributes-only, reported but never compared or declared. Everything else in `NetworkProps`\n *   is exactly what `updateNetwork`/`createNetwork` would accept, even though this family never\n *   calls either: the shape is what a future write path would need, and what today's read-only\n *   `matches` compares against.\n *\n * ⛔ `ipv4Configuration` STAYS `unknown`, ON THE SDK'S OWN AUTHORITY. `networks.ts`'s own comment\n *   (\"Shape varies by variant — widened by scripts/convert.ts; see README\") says the OpenAPI\n *   discriminator this field varies over was flattened at generation time, not decoded per\n *   variant. Comparing it as an opaque JSON value (below) is honest about that; guessing a\n *   narrower shape here would silently stop matching the day a new variant's key order differs.\n *   ⚠️ It may ALSO hide an unordered array the way `dhcpGuarding` and `ipv6Configuration` do\n *   below — this family just can't know, because the shape is never decoded. If a future variant\n *   plans spurious `update`s, suspect this field first and widen it into a typed, order-normalized\n *   shape rather than adding another opaque comparison.\n *\n * ⛔ THREE FIELDS ARE SETS, NOT SEQUENCES: `dhcpGuarding.trustedDhcpServerIpAddresses`,\n *   `ipv6Configuration.additionalHostIpSubnets`, and `ipv6Configuration.dnsServerIpAddressesOverride`.\n *   The vendor document gives no indication any of the three is ordered — same reasoning\n *   `firewall-zone-form.ts` gives for `networkIds`, and `proxmox/user-wire.ts`'s `groupSet` gives\n *   for PVE's `groups` — but `matches` compares via alchemy's `deepEqual`, which sorts object KEYS\n *   but NOT ARRAY ELEMENTS (`node_modules/alchemy/lib/Diff.js`). Left alone, a console that\n *   returns the same set in a different order between calls plans a spurious `update`, and the\n *   read-only reconcile then refuses every deploy. `sortedSet` (dedupe + sort) neutralizes that\n *   before any of the three is attributed, declared, or compared. Every OTHER array field in this\n *   family (there are none today besides these three) would stay declaration-order as written.\n */\nimport type * as networks from '@distilled.cloud/unifi-network/networks';\n\nconst sortedSet = (values: readonly string[]): string[] => [...new Set(values)].sort();\n\n// ⚠️ `value == null` (NOT `=== undefined`) ON PURPOSE, IN BOTH NORMALIZERS BELOW. The SDK types\n//   `dhcpGuarding`/`ipv6Configuration` `T | undefined`, but `matches`'s own header says UniFi's\n//   JSON answers `null` for an unset optional field — a reality `deepEqual`'s `stripNullish`\n//   already treats as equivalent to `undefined` (`value == null` in alchemy's `Diff.js`), which\n//   this family's props/attributes types don't model at the TS level. Destructuring a `null` with\n//   `=== undefined`'s false branch (`{ ...value, field: value.field }`) would throw\n//   `TypeError: Cannot read properties of null` the first time a console omits either field —\n//   `== null` catches both and returns the value through untouched, matching what the rest of\n//   this file already does for every other optional field.\n// ★ EXPORTED (not just used below): `network-drift.ts`'s `driftOf` reuses these exact two\n//   normalizers so it can never quietly disagree with `matches` about what counts as a change —\n//   see that file's own header.\nexport const normalizeDhcpGuarding = (\n  value: networks.NetworkDHCPGuarding | undefined,\n): networks.NetworkDHCPGuarding | undefined =>\n  value == null\n    ? value\n    : { ...value, trustedDhcpServerIpAddresses: sortedSet(value.trustedDhcpServerIpAddresses) };\n\n// ⚠️ `exactOptionalPropertyTypes` (see the props header) means these two subfields must be\n//   OMITTED, not set to an explicit `undefined`, when the live/declared value has no override —\n//   `NetworkIPv6Configuration` types them `field?: T`, not `field?: T | undefined`. Conditional\n//   spread (rather than `field: value.field === undefined ? undefined : sortedSet(...)`) is what\n//   keeps an absent key absent.\nexport const normalizeIpv6Configuration = (\n  value: networks.NetworkIPv6Configuration | undefined,\n): networks.NetworkIPv6Configuration | undefined =>\n  value == null\n    ? value\n    : {\n        ...value,\n        ...(value.additionalHostIpSubnets !== undefined\n          ? { additionalHostIpSubnets: sortedSet(value.additionalHostIpSubnets) }\n          : {}),\n        ...(value.dnsServerIpAddressesOverride !== undefined\n          ? { dnsServerIpAddressesOverride: sortedSet(value.dnsServerIpAddressesOverride) }\n          : {}),\n      };\n\n/**\n * ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` ON PURPOSE. `tsconfig.json` sets\n *   `exactOptionalPropertyTypes`, which treats `field?: T` (absent-or-T) and\n *   `field?: T | undefined` (absent-or-explicitly-undefined) as different types. `declareNetwork`\n *   below assigns `live.dhcpGuarding` (typed `T | undefined`) straight through — the whole point\n *   of a renderer that echoes a live optional field structurally rather than defaulting it — so\n *   the target has to admit an explicit `undefined`, not just omission.\n */\nexport interface NetworkProps {\n  siteId: string;\n  networkId: string;\n  name: string;\n  enabled: boolean;\n  management: string;\n  /** VLAN ID. Must be 1 for the default network and >= 2 for additional networks. */\n  vlanId: number;\n  dhcpGuarding?: networks.NetworkDHCPGuarding | undefined;\n  cellularBackupEnabled?: boolean | undefined;\n  internetAccessEnabled?: boolean | undefined;\n  /** Opaque — see the header. */\n  ipv4Configuration?: unknown;\n  ipv6Configuration?: networks.NetworkIPv6Configuration | undefined;\n  isolationEnabled?: boolean | undefined;\n  mdnsForwardingEnabled?: boolean | undefined;\n  zoneId?: string | undefined;\n  deviceId?: string | undefined;\n}\n\nexport interface NetworkAttributes {\n  siteId: string;\n  networkId: string;\n  /** Whether this is the site's undeletable default network — server-derived, never declared. */\n  default: boolean;\n  name: string;\n  enabled: boolean;\n  management: string;\n  vlanId: number;\n  dhcpGuarding: networks.NetworkDHCPGuarding | undefined;\n  cellularBackupEnabled: boolean | undefined;\n  internetAccessEnabled: boolean | undefined;\n  ipv4Configuration: unknown;\n  ipv6Configuration: networks.NetworkIPv6Configuration | undefined;\n  isolationEnabled: boolean | undefined;\n  mdnsForwardingEnabled: boolean | undefined;\n  zoneId: string | undefined;\n  deviceId: string | undefined;\n}\n\nexport const attributesOf = (\n  live: networks.NetworkDetails,\n  props: NetworkProps,\n): NetworkAttributes => ({\n  siteId: props.siteId,\n  networkId: live.id,\n  default: live.default,\n  name: live.name,\n  enabled: live.enabled,\n  management: live.management,\n  vlanId: live.vlanId,\n  dhcpGuarding: normalizeDhcpGuarding(live.dhcpGuarding),\n  cellularBackupEnabled: live.cellularBackupEnabled,\n  internetAccessEnabled: live.internetAccessEnabled,\n  ipv4Configuration: live.ipv4Configuration,\n  ipv6Configuration: normalizeIpv6Configuration(live.ipv6Configuration),\n  isolationEnabled: live.isolationEnabled,\n  mdnsForwardingEnabled: live.mdnsForwardingEnabled,\n  zoneId: live.zoneId,\n  deviceId: live.deviceId,\n});\n\n/**\n * MEDIUM-4 (red team, 2026-09-26): `matches` used to be a hand-written boolean expression here,\n * kept in sync BY HAND with `network-drift.ts`'s separately-maintained field list — two comparisons\n * that could (and, per a red-team mutant, silently did) drift apart. `matches` now lives in\n * `network-drift.ts`, defined as `fieldDrift(...).length === 0` — the SAME comparison `driftOf`\n * runs, not a second one. See that file's own header for the `stripNullish`/normalizer reasoning\n * this expression used to carry.\n */\n\n/**\n * The declaration renderer (task spec: \"given one live object, return the props a declaration\n * needs so its plan is noop\"). A later import script feeds `getNetworkDetails`'s own response\n * straight in and writes the result into `alchemy.run.ts` as `network('<id>', declareNetwork(live,\n * siteId))` — no field is invented or defaulted here beyond what `attributesOf` already reports,\n * so `matches(attributesOf(live, props), declareNetwork(live, siteId))` is `true` by construction\n * (`network.test.ts` proves it) for any live object this SDK can decode.\n */\nexport const declareNetwork = (live: networks.NetworkDetails, siteId: string): NetworkProps => ({\n  siteId,\n  networkId: live.id,\n  name: live.name,\n  enabled: live.enabled,\n  management: live.management,\n  vlanId: live.vlanId,\n  dhcpGuarding: normalizeDhcpGuarding(live.dhcpGuarding),\n  cellularBackupEnabled: live.cellularBackupEnabled,\n  internetAccessEnabled: live.internetAccessEnabled,\n  ipv4Configuration: live.ipv4Configuration,\n  ipv6Configuration: normalizeIpv6Configuration(live.ipv6Configuration),\n  isolationEnabled: live.isolationEnabled,\n  mdnsForwardingEnabled: live.mdnsForwardingEnabled,\n  zoneId: live.zoneId,\n  deviceId: live.deviceId,\n});\n",
     "/**\n * B6: the field-level drift framework every family's own `driftOf(live, props)` is built on\n * (`network-form.ts`, `firewall-zone-form.ts`, and whatever family follows). Consumed by\n * `homeflare-network`'s pre-import drift check (its own C4, not built here) to show WHICH fields\n * a live object and a committed declaration disagree on, before that script overwrites the\n * committed module — never by a `Unifi.*` provider itself, which only ever needs `matches`'s\n * boolean.\n *\n * ★ BUILT ON `matches`, NOT A SEPARATE COMPARISON. Each family's `driftOf` reuses the SAME\n *   normalizers (`sortedSet`, the `dhcpGuarding`/`ipv6Configuration` null-vs-undefined handling)\n *   its own `matches` already applies — so this reports NOTHING `matches` would call a noop, and\n *   everything `matches` would call `update`, broken down by field instead of collapsed to one\n *   boolean. Two comparisons drifting apart would be its own bug class; there is exactly one.\n */\nimport { deepEqual } from 'alchemy/Diff';\n\n/** One field whose live and declared values differ, as `makeDriftOf` reports it. */\nexport interface FieldDrift {\n  readonly field: string;\n  readonly live: unknown;\n  readonly declared: unknown;\n}\n\n/** One field's comparison recipe for `makeDriftOf`. */\nexport interface DriftField<Attributes, Props> {\n  readonly field: string;\n  readonly live: (attributes: Attributes) => unknown;\n  readonly declared: (props: Props) => unknown;\n  /**\n   * Defaults to `alchemy/Diff`'s `deepEqual` with `stripNullish: true` — the same tolerance\n   * every `matches` in this directory already gives UniFi's `null`-for-unset optionals (see\n   * `network-form.ts`'s header). Pass one explicitly for a field `matches` compares as a\n   * normalized SET (`firewall-zone-form.ts`'s `networkIds`), where plain `deepEqual` would\n   * report order as drift `matches` never would.\n   */\n  readonly equal?: (live: unknown, declared: unknown) => boolean;\n}\n\nconst defaultEqual = (live: unknown, declared: unknown) =>\n  deepEqual(live, declared, { stripNullish: true });\n\n/**\n * Builds a `(attributes, props) => FieldDrift[]` from a field list — the framework a family's own\n * `*-form.ts` calls once, then wraps as `driftOf(live, props)` by feeding it `attributesOf(live,\n * props)` (the task's own API: callers have a live SDK object, not `Attributes`, on hand).\n */\nexport const makeDriftOf =\n  <Attributes, Props>(fields: readonly DriftField<Attributes, Props>[]) =>\n  (attributes: Attributes, props: Props): FieldDrift[] =>\n    fields.flatMap(({ field, live, declared, equal = defaultEqual }) => {\n      const liveValue = live(attributes);\n      const declaredValue = declared(props);\n      return equal(liveValue, declaredValue)\n        ? []\n        : [{ field, live: liveValue, declared: declaredValue }];\n    });\n",
     "/**\n * `Unifi.Network`'s `matches` AND `driftOf` (B6) — both built on the ONE field list below, not two\n * hand-kept-in-sync comparisons. `matches` used to be a separate boolean expression in\n * `network-form.ts`; MEDIUM-4 (red team, 2026-09-26) found that a `fieldDrift` entry could be\n * deleted entirely and every test still passed, because `matches` never consulted `fieldDrift` at\n * all. `matches(attrs, props) === (driftOf(live, props).length === 0)` is now true BY\n * CONSTRUCTION — there is exactly one comparison — and every `fieldDrift` entry names ONE field\n * plus its own live/declared value instead of collapsing straight to a boolean.\n *\n * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`). UniFi's JSON\n *   answers `null` for an unset optional field; a declaration that omits the same prop carries\n *   `undefined`. Without this, every plan against an object with one unset optional field would\n *   report `update` forever — the exact \"read and write are different shapes\" trap\n *   `netbox/values.ts` and `proxmox/user-wire.ts` both work around, here solved once by\n *   `makeDriftOf`'s own default instead of a per-field coercion.\n */\nimport type * as networks from '@distilled.cloud/unifi-network/networks';\nimport { makeDriftOf } from './drift.ts';\nimport {\n  type NetworkAttributes,\n  type NetworkProps,\n  attributesOf,\n  normalizeDhcpGuarding,\n  normalizeIpv6Configuration,\n} from './network-form.ts';\n\nconst fieldDrift = makeDriftOf<NetworkAttributes, NetworkProps>([\n  { field: 'name', live: (a) => a.name, declared: (p) => p.name },\n  { field: 'enabled', live: (a) => a.enabled, declared: (p) => p.enabled },\n  { field: 'management', live: (a) => a.management, declared: (p) => p.management },\n  { field: 'vlanId', live: (a) => a.vlanId, declared: (p) => p.vlanId },\n  {\n    field: 'dhcpGuarding',\n    live: (a) => normalizeDhcpGuarding(a.dhcpGuarding),\n    declared: (p) => normalizeDhcpGuarding(p.dhcpGuarding),\n  },\n  {\n    field: 'cellularBackupEnabled',\n    live: (a) => a.cellularBackupEnabled,\n    declared: (p) => p.cellularBackupEnabled,\n  },\n  {\n    field: 'internetAccessEnabled',\n    live: (a) => a.internetAccessEnabled,\n    declared: (p) => p.internetAccessEnabled,\n  },\n  {\n    field: 'ipv4Configuration',\n    live: (a) => a.ipv4Configuration,\n    declared: (p) => p.ipv4Configuration,\n  },\n  {\n    field: 'ipv6Configuration',\n    live: (a) => normalizeIpv6Configuration(a.ipv6Configuration),\n    declared: (p) => normalizeIpv6Configuration(p.ipv6Configuration),\n  },\n  {\n    field: 'isolationEnabled',\n    live: (a) => a.isolationEnabled,\n    declared: (p) => p.isolationEnabled,\n  },\n  {\n    field: 'mdnsForwardingEnabled',\n    live: (a) => a.mdnsForwardingEnabled,\n    declared: (p) => p.mdnsForwardingEnabled,\n  },\n  { field: 'zoneId', live: (a) => a.zoneId, declared: (p) => p.zoneId },\n  { field: 'deviceId', live: (a) => a.deviceId, declared: (p) => p.deviceId },\n]);\n\nexport const matches = (attributes: NetworkAttributes, props: NetworkProps): boolean =>\n  fieldDrift(attributes, props).length === 0;\n\n/**\n * Per-field live-vs-declared drift straight from one live read — the task's own API\n * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive\n * `attributesOf` itself just to call this.\n */\nexport const driftOf = (live: networks.NetworkDetails, props: NetworkProps) =>\n  fieldDrift(attributesOf(live, props), props);\n",
+    "/**\n * The write SCOPE of `Unifi.Network`: the one intended consumer is a single VLAN's\n * `ipv6Configuration`, so everything else a whole-object PUT could reach is refused BEFORE any\n * request, with a typed error that carries field names only.\n *\n * ⛔ SETTABLE ALLOWLIST. A key in `patch.set` is written into the PUT body, so only\n *   `ipv6Configuration` may be set: `enabled`, `internetAccessEnabled`, `ipv4Configuration`,\n *   `dhcpGuarding` and every other declared key are refused with `UnifiFieldNotSettable` (a touched\n *   immutable key gets `UnifiImmutableFieldChanged` first). Widening it is a kit change.\n * ⛔ REMOVABLE ALLOWLIST. A key in `patch.unset` is deleted from the PUT body, and the controller\n *   reads an omitted `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration` as \"off\". Dropping a\n *   declaration key therefore must not silently turn a live block off: only `ipv6Configuration`\n *   (the block this write path exists for, and the revert target) may be removed. A required key\n *   (`name`, `vlanId`, …) removed from a declaration would fail the SDK schema or send a body the\n *   controller rejects, so it is refused here with the same error.\n * ⛔ `default: true` IS THE MANAGEMENT LAN. Writing it can cut the admin off the console.\n * ⛔ `zoneId`/`vlanId`/`management`/`deviceId` decide where the network lives and what serves it;\n *   a patch (set OR unset) touching one is refused. Non-USER `metadata.origin` is deliberately NOT\n *   handled yet: no rule exists for it.\n */\nimport type * as networks from '@distilled.cloud/unifi-network/networks';\nimport * as Effect from 'effect/Effect';\nimport type { NetworkProps } from './network-form.ts';\nimport {\n  UnifiFieldNotRemovable,\n  UnifiFieldNotSettable,\n  UnifiImmutableFieldChanged,\n  UnifiManagementNetworkRefused,\n} from './policy.ts';\nimport type { Patch } from './update-reconcile.ts';\n\nexport const SETTABLE_KEYS: ReadonlyArray<keyof NetworkProps> = ['ipv6Configuration'];\nexport const REMOVABLE_KEYS: ReadonlyArray<keyof NetworkProps> = ['ipv6Configuration'];\nexport const IMMUTABLE_KEYS: ReadonlyArray<keyof NetworkProps> = [\n  'zoneId',\n  'vlanId',\n  'management',\n  'deviceId',\n];\n\nexport type ScopeError =\n  | UnifiFieldNotRemovable\n  | UnifiFieldNotSettable\n  | UnifiImmutableFieldChanged\n  | UnifiManagementNetworkRefused;\n\nconst isIn = (list: ReadonlyArray<string>) => (key: string) => list.includes(key);\n\nexport const checkNetworkWriteScope = (\n  live: networks.NetworkDetails,\n  patch: Patch<NetworkProps>,\n  props: NetworkProps,\n): Effect.Effect<void, ScopeError> => {\n  const type = 'Unifi.Network';\n  const identity = `sites/${props.siteId}/networks/${props.networkId}`;\n  if (live.default === true) {\n    return Effect.fail(new UnifiManagementNetworkRefused({ type, identity }));\n  }\n  const touched = [...Object.keys(patch.set), ...patch.unset.map(String)];\n  const immutable = touched.filter(isIn(IMMUTABLE_KEYS as ReadonlyArray<string>));\n  if (immutable.length > 0) {\n    return Effect.fail(new UnifiImmutableFieldChanged({ type, identity, fields: immutable }));\n  }\n  const removable = isIn(REMOVABLE_KEYS as ReadonlyArray<string>);\n  const notRemovable = patch.unset.map(String).filter((k) => !removable(k));\n  if (notRemovable.length > 0) {\n    return Effect.fail(new UnifiFieldNotRemovable({ type, identity, fields: notRemovable }));\n  }\n  const settable = isIn(SETTABLE_KEYS as ReadonlyArray<string>);\n  const notSettable = Object.keys(patch.set).filter((k) => !settable(k));\n  if (notSettable.length > 0) {\n    return Effect.fail(new UnifiFieldNotSettable({ type, identity, fields: notSettable }));\n  }\n  return Effect.void;\n};\n",
+    "/**\n * `Unifi.Network`'s one write: `updateNetwork`. THE ONLY FILE UNDER `src/unifi` ALLOWED TO NAME IT\n * (`write-op-reference.test.ts`'s `WRITE_OP_ALLOWLIST` pins that, and still refuses\n * `createNetwork`/`deleteNetwork` here).\n *\n * ⛔ THE WHOLE-OBJECT-PUT TRAP (packages/distilled-unifi-network/README.md). `PUT .../networks/{id}` disables\n *   `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration` outright when the body omits them. So\n *   the body is never `props`: it is the RAW live object (as `fetchLive` decoded it) minus the\n *   server fields (`SERVER_FIELDS`: `id`/`default`/`metadata`), plus ONLY the patch (HIGH-2). A\n *   hand edit on a field\n *   the declaration never touched rides through byte-for-byte; `update-reconcile.ts` has already\n *   refused any hand edit on a declared field.\n *\n * ★ WHY RAW LIVE, NOT THE ATTRIBUTES VIEW (LOW-6). `attributesOf` normalizes (sorted sets) and\n *   drops keys this kit does not model. Unknown keys must survive the round trip or the PUT would\n *   silently delete a setting the console added after the SDK was generated (F2). Measured by\n *   reading `@distilled.cloud/core` `protocol-http.ts`: `validateResponse` returns the ORIGINAL\n *   decoded value and `mapKeys` passes unknown keys through at every level, so top-level and\n *   nested unknown keys both survive; `network-update.test.ts` is the alarm if that ever changes.\n *\n * ★ WHY `unset` EXISTS (HIGH-1). Reverting a declaration (dropping `ipv6Configuration`) must plan\n *   and execute a real update back to the pre-image. A key in `patch.unset` is DELETED from the\n *   body, which is exactly \"absent = off\" for the optional blocks above.\n *\n * ⛔ NO-OP GUARD. If the merged body equals live (ignoring the ids), the PUT would change nothing;\n *   `UnifiUpdateWouldBeNoop` refuses so a normalizer gap can never become a re-PUT loop.\n *\n * ⛔ NO RETRY ON THE PUT (red team round 1, reversing the earlier Q7 decision). The SDK's default\n *   policy would replay a write whose first attempt may already have landed (a dropped response\n *   during a reprovision); a replay then runs against a controller state this reconcile never\n *   read. One attempt, and a failure surfaces for the operator. Reads keep the default policy.\n *\n * ⛔ SCOPE FIRST (`network-scope.ts`): the management LAN, immutable fields and non-removable keys\n *   are refused before the body is even built, so none of them can reach the wire.\n */\nimport * as networks from '@distilled.cloud/unifi-network/networks';\nimport * as Retry from '@distilled.cloud/unifi-network/Retry';\nimport { deepEqual } from 'alchemy/Diff';\nimport * as Effect from 'effect/Effect';\nimport { type NetworkProps } from './network-form.ts';\nimport { checkNetworkWriteScope } from './network-scope.ts';\nimport { UnifiUpdateWouldBeNoop } from './policy.ts';\nimport type { Patch } from './update-reconcile.ts';\n\nexport const SERVER_FIELDS = ['id', 'default', 'metadata'] as const;\n\n/**\n * The live object minus `SERVER_FIELDS` — ONE list drives the strip. The destructure this\n * replaced hard-coded the same three names a second time, so a key added to the export was\n * silently NOT stripped (and a removed one still was): two lists that could drift apart. Own\n * enumerable string keys only, exactly what object-rest destructure copies; a decoded JSON body\n * has no symbol keys.\n */\nconst withoutServerFields = (live: networks.NetworkDetails): Record<string, unknown> => {\n  const server = new Set<string>(SERVER_FIELDS);\n  const rest: Record<string, unknown> = {};\n  for (const [key, value] of Object.entries(live)) {\n    if (!server.has(key)) rest[key] = value;\n  }\n  return rest;\n};\n\nexport const mergeForUpdate = (\n  live: networks.NetworkDetails,\n  patch: Patch<NetworkProps>,\n  props: NetworkProps,\n): Effect.Effect<networks.UpdateNetworkRequest, UnifiUpdateWouldBeNoop> => {\n  // Raw copy minus the server fields: unknown top-level keys stay in `rest` (F2).\n  const rest = withoutServerFields(live);\n  const body: Record<string, unknown> = { ...rest, ...patch.set };\n  for (const key of patch.unset) delete body[key];\n  if (deepEqual(body, rest, { stripNullish: true })) {\n    return Effect.fail(\n      new UnifiUpdateWouldBeNoop({\n        type: 'Unifi.Network',\n        identity: `sites/${props.siteId}/networks/${props.networkId}`,\n      }),\n    );\n  }\n  return Effect.succeed({\n    ...body,\n    siteId: props.siteId,\n    networkId: live.id,\n  } as networks.UpdateNetworkRequest);\n};\n\nexport const writeNetwork = (\n  live: networks.NetworkDetails,\n  patch: Patch<NetworkProps>,\n  props: NetworkProps,\n) =>\n  checkNetworkWriteScope(live, patch, props).pipe(\n    Effect.andThen(mergeForUpdate(live, patch, props)),\n    Effect.flatMap((body) => networks.updateNetwork(body).pipe(Retry.none)),\n  );\n",
+    "/**\n * One shape for every UniFi Network object — `Unifi.Network`, `Unifi.FirewallZone`, and whatever\n * import adds next. ADOPT-ONLY, except the one `update` a spec may opt into (`Unifi.Network`).\n *\n * ★ MIRRORS `../discord/resource.ts` (S7-S10, H1, H5), NOT `../netbox/resource.ts`. Both are\n *   \"marker-less API\" families (S8): UniFi Network objects carry no tag or metadata field this\n *   stack could stamp as ownership, so a cold read of a match is `Unowned(attrs)` exactly like\n *   `Cloudflare/Snippets/Snippet.ts@v2.0.0-beta.81#read`, the reference implementation S8 and H1\n *   both cite. `adopt(true)`, piped on by each resource's convenience constructor (H5), turns\n *   that into a silent one-time bind instead of an `OwnedBySomeoneElse` refusal.\n *\n * ⛔ THE POSTURE (`policy.ts`, Tim 2026-09-24, lifted for ONE case 2026-10-10): there is no\n *   `create` and no `destroy` in this spec at all, and `update` exists only when a spec carries an\n *   `update` block (`update-reconcile.ts`). `reconcile` is `updateReconcile`: refuse a create,\n *   report an exact match with zero writes, and otherwise either refuse or run the three-way PUT.\n *   A spec without `update` (every family but Network) can only ever refuse or report a match.\n *\n * ⚠️ RECONCILE STILL HAS TO SUCCEED ON AN EXACT-MATCH ADOPTION, NOT JUST REFUSE UNCONDITIONALLY.\n *   Measured against `Plan.ts@v2.0.0-beta.81` (`forceUpdateAfterAdoption`, H6): beta.81 forces\n *   ONE reconcile call after every cold adoption, whether or not the diff said noop — so a\n *   resource whose `reconcile` always failed would break the ordinary \"adopt an unchanged\n *   object\" deploy, not just a real write. The fix, exactly like `discordOperations.reconcile`:\n *   read the live object again and return it on a match. S10's \"zero write calls when there is\n *   no drift\" holds even under the forced post-adoption call.\n *\n * ⚠️ `NotFound` IS FOLDED TO \"ABSENT\" INSIDE EACH RESOURCE FILE'S OWN `fetchLive`, NOT HERE —\n *   same split netbox's `resource.ts` uses and for the same reason: `Effect.catchTag`'s\n *   tag-literal inference needs a concrete error union to resolve `\"NotFound\"` against, and a\n *   spec's `E` is only concrete at each resource file's own call site. Every OTHER failure (a\n *   real 5xx, a network error, `Forbidden`) is NOT folded anywhere — it fails the plan loudly,\n *   per the task's own rule: only a genuine not-found may mean absent.\n *\n * ★ The wire guard (`wire-guard.ts`) and the three-way reconcile (`update-reconcile.ts`) live in\n *   their own files; `read`/`diff`/`delete` run under `GetOnlyHttpClient`, only `reconcile` gets\n *   the per-row allow entry of a spec that declares `update`.\n */\nimport { Unowned } from 'alchemy/AdoptPolicy';\nimport { isResolved } from 'alchemy/Diff';\nimport type { Input } from 'alchemy/Input';\nimport { Credentials, CredentialsFromEnv } from '@distilled.cloud/unifi-network/Credentials';\nimport type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';\nimport * as Effect from 'effect/Effect';\nimport type * as HttpClient from 'effect/http/HttpClient';\nimport { refuseWrite } from './policy.ts';\nimport { type ReconcileArgs, type UnifiUpdate, updateReconcile } from './update-reconcile.ts';\nimport { type AllowedWrite, guardedHttpClient } from './wire-guard.ts';\n\n/** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */\nexport type UnifiRequirements = HttpClient.HttpClient;\n\n/**\n * One UniFi Network object's read. `Live` is whatever the SDK decodes (a `NetworkDetails`, a\n * `FirewallZone`, …); `E` is left to each resource file to declare (its own `fetchLive`'s error\n * union, with `NotFound` already folded away) so the precise per-operation error union flows\n * through instead of being widened by hand here. `E2` is the error union of the optional write.\n */\nexport type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never> = {\n  /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */\n  readonly type: string;\n  /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */\n  readonly fetchLive: (props: Props) => Effect.Effect<Live | undefined, E, UnifiNetworkOpContext>;\n  readonly attributes: (live: Live, props: Props) => Attributes;\n  readonly matches: (attributes: Attributes, props: Props) => boolean;\n  /** For the refusal message and read-back failures. */\n  readonly describe: (props: Props) => string;\n  /** Present only on a family allowed to write (`Unifi.Network`); see `update-reconcile.ts`. */\n  readonly update?: UnifiUpdate<Props, Live, E2>;\n};\n\nexport const unifiOperations = <Props extends object, Live, Attributes extends object, E, E2>(\n  spec: UnifiSpec<Props, Live, Attributes, E, E2>,\n) => {\n  const read = (props: Props) =>\n    spec\n      .fetchLive(props)\n      .pipe(Effect.map((live) => (live === undefined ? undefined : spec.attributes(live, props))));\n\n  return {\n    read,\n\n    readHandler: ({ olds, output }: { olds: Props; output: Attributes | undefined }) =>\n      Effect.gen(function* () {\n        const attrs = yield* read(olds);\n        if (attrs === undefined) return undefined;\n        // Warm read (persisted `output` says a prior apply already adopted this exact object):\n        // plain attributes. Cold read (fresh store, or state lost): no ownership marker on this\n        // vendor exists to tell \"ours\" from \"someone else's\" apart, so Unowned until adopt(true).\n        return output !== undefined ? attrs : Unowned(attrs);\n      }),\n\n    diff: (news: Input<Props>, output: Attributes | undefined) =>\n      Effect.gen(function* () {\n        if (output === undefined || !isResolved(news)) return undefined;\n        const live = yield* read(news);\n        if (live === undefined) return { action: 'update' } as const;\n        return spec.matches(live, news)\n          ? ({ action: 'noop' } as const)\n          : ({ action: 'update' } as const);\n      }),\n\n    /** Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset. */\n    reconcile: (news: Props, rest: Partial<Omit<ReconcileArgs<Props>, 'news'>> = {}) =>\n      updateReconcile(spec, {\n        news,\n        olds: rest.olds,\n        output: rest.output,\n        note: rest.note ?? (() => Effect.void),\n      }),\n\n    destroy: (olds: Props) => refuseWrite(spec.type, spec.describe(olds), 'delete'),\n  };\n};\n\n/**\n * The four provider handlers for a spec'd UniFi object, wired once.\n *\n * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;\n *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.\n */\nexport const unifiHandlers = <Props extends object, Live, Attributes extends object, E, E2>(\n  spec: UnifiSpec<Props, Live, Attributes, E, E2>,\n) => {\n  const ops = unifiOperations(spec);\n  const withCredentials = <A, Err>(\n    effect: Effect.Effect<A, Err, UnifiNetworkOpContext>,\n    allow: ReadonlyArray<AllowedWrite> = [],\n  ) =>\n    Effect.gen(function* () {\n      // ⛔ The guard anchors the allowed PUT to the CONFIGURED base URL (`wire-guard.ts`), so it is\n      //   read from the same credentials the SDK uses.\n      const { apiBaseUrl } = yield* yield* Credentials;\n      return yield* effect.pipe(Effect.provide(guardedHttpClient(allow, apiBaseUrl)));\n    }).pipe(Effect.provide(CredentialsFromEnv)) as Effect.Effect<A, Err, HttpClient.HttpClient>;\n\n  return {\n    list: () => Effect.succeed([]),\n    read: (args: { olds: Props; output: Attributes | undefined }) =>\n      withCredentials(ops.readHandler(args)),\n    diff: (args: { news: Input<Props>; output: Attributes | undefined }) =>\n      withCredentials(ops.diff(args.news, args.output)),\n    // ⛔ ONLY `reconcile` gets the per-row allow entry, and only when the spec declares `update`.\n    reconcile: (args: {\n      news: Props;\n      olds: Props | undefined;\n      output: Attributes | undefined;\n      session: { note: (message: string) => Effect.Effect<void, never, never> };\n    }) =>\n      withCredentials(\n        ops.reconcile(args.news, {\n          olds: args.olds,\n          output: args.output,\n          note: (message) => args.session.note(message),\n        }),\n        // ⛔ From `news` (the ids the write will use), never `olds`; reconcile also refuses when\n        //   `olds` names another object (`update-reconcile.ts`).\n        spec.update ? [spec.update.allowedWrite(args.news)] : [],\n      ),\n    delete: (args: { olds: Props }) => withCredentials(ops.destroy(args.olds)),\n  };\n};\n",
+    "/**\n * The three-way `reconcile` every updatable `Unifi.*` family shares (today: `Unifi.Network`).\n *\n * ⛔ THREE INPUTS, NOT TWO. `news` is the declaration now, `olds` is the declaration the LAST\n *   DEPLOY wrote (Alchemy state), `live` is the raw object read right now. The PUT body is built\n *   from `live` plus ONLY the fields where `news` differs from `olds` (`computePatch`) — never\n *   from `news` alone. So (HIGH-2) a hand edit on a field the declaration never touched is carried\n *   through unchanged instead of reverted, and a hand edit on ANY declared field is refused\n *   outright (step 4) rather than overwritten.\n *\n * ★ `unset` IS WHAT MAKES A REVERT REAL (HIGH-1). Deleting an override from a declaration makes\n *   `news[k]` absent while `olds[k]` is set; a patch that only carried `set` would see \"nothing\n *   changed\" and the revert would never write. A key present in `olds` and null/absent in `news`\n *   lands in `unset`, and the family's `write` removes it from the body.\n *\n * ⛔ FIRST DEPLOY IS ADOPT-ONLY BY CONSTRUCTION (F1, LOW-8). Without BOTH `olds` and `output` there\n *   is no last-deployed baseline to patch against, so the write refuses. That also covers beta.81's\n *   forced post-adoption reconcile (H6): on a match (step 2) it returns live with zero writes.\n *   `olds` must also name the SAME object as `news` (`UnifiIdentityChanged`).\n *\n * ⛔ SCOPE (`update.checkScope`) runs before the note and any request: the family decides what a\n *   patch may touch (`network-scope.ts`). An omitted optional block is turned OFF by a whole-object\n *   PUT, so removing a key is allowed only for an explicit allowlist.\n *\n * ⚠️ NOTES AND ERRORS CARRY FIELD NAMES ONLY, NEVER VALUES.\n */\nimport { deepEqual } from 'alchemy/Diff';\nimport type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';\nimport * as Effect from 'effect/Effect';\nimport type { FieldDrift } from './drift.ts';\nimport {\n  UnifiIdentityChanged,\n  UnifiLiveDriftedSinceDeploy,\n  UnifiUpdateDidNotConverge,\n  refuseWrite,\n} from './policy.ts';\nimport type { UnifiSpec } from './resource.ts';\nimport type { AllowedWrite } from './wire-guard.ts';\n\nexport type Patch<Props> = { set: Partial<Props>; unset: ReadonlyArray<keyof Props> };\n\n/** The write half of a spec: everything needed to PUT one object, and nothing to create/delete. */\nexport type UnifiUpdate<Props extends object, Live, E2> = {\n  /** The one PUT the wire guard may pass for this row (path pinned to the row's own ids). */\n  readonly allowedWrite: (props: Props) => AllowedWrite;\n  /** Declarable keys; never the identity keys. */\n  readonly patchKeys: ReadonlyArray<keyof Props>;\n  readonly driftOf: (live: Live, props: Props) => ReadonlyArray<FieldDrift>;\n  /** Refuses (typed, before any note or request) a patch outside this family's write scope. */\n  readonly checkScope: (live: Live, patch: Patch<Props>, props: Props) => Effect.Effect<void, E2>;\n  readonly write: (\n    live: Live,\n    patch: Patch<Props>,\n    props: Props,\n  ) => Effect.Effect<Live, E2, UnifiNetworkOpContext>;\n};\n\n/** Keys whose `news` value differs from `olds`: set when still declared, unset when dropped. */\nexport const computePatch = <Props extends object>(\n  news: Props,\n  olds: Props,\n  patchKeys: ReadonlyArray<keyof Props>,\n): Patch<Props> => {\n  const set: Partial<Props> = {};\n  const unset: Array<keyof Props> = [];\n  for (const key of patchKeys) {\n    if (deepEqual(news[key], olds[key], { stripNullish: true })) continue;\n    if (news[key] == null) unset.push(key);\n    else set[key] = news[key];\n  }\n  return { set, unset };\n};\n\nexport type ReconcileArgs<Props extends object> = {\n  readonly news: Props;\n  readonly olds: Props | undefined;\n  readonly output: unknown;\n  readonly note: (message: string) => Effect.Effect<void>;\n};\n\nexport const updateReconcile = <Props extends object, Live, Attributes extends object, E, E2>(\n  spec: UnifiSpec<Props, Live, Attributes, E, E2>,\n  { news, olds, output, note }: ReconcileArgs<Props>,\n) =>\n  Effect.gen(function* () {\n    const identity = spec.describe(news);\n    const live = yield* spec.fetchLive(news);\n    if (live === undefined) return yield* refuseWrite(spec.type, identity, 'create');\n    const attrs = spec.attributes(live, news);\n    // Exact match: zero writes, correct for a routine deploy and the forced post-adoption call.\n    if (spec.matches(attrs, news)) return attrs;\n    const update = spec.update;\n    if (update === undefined || olds === undefined || output === undefined) {\n      return yield* refuseWrite(spec.type, identity, 'update');\n    }\n    // ⛔ `olds` is the baseline for THIS object only; another site or network id is no baseline.\n    const previous = spec.describe(olds);\n    if (previous !== identity) {\n      return yield* new UnifiIdentityChanged({ type: spec.type, identity, previous });\n    }\n    const drifted = update.driftOf(live, olds).map((d) => d.field);\n    if (drifted.length > 0) {\n      return yield* new UnifiLiveDriftedSinceDeploy({\n        type: spec.type,\n        identity,\n        fields: drifted,\n      });\n    }\n    const patch = computePatch(news, olds, update.patchKeys);\n    if (Object.keys(patch.set).length === 0 && patch.unset.length === 0) {\n      return yield* refuseWrite(spec.type, identity, 'update');\n    }\n    yield* update.checkScope(live, patch, news);\n    yield* note(\n      `${spec.type} ${identity}: PUT changes [${Object.keys(patch.set).join(', ')}] ` +\n        `removes [${patch.unset.map(String).join(', ')}]`,\n    );\n    const written = yield* update.write(live, patch, news);\n    const writtenAttrs = spec.attributes(written, news);\n    if (spec.matches(writtenAttrs, news)) return writtenAttrs;\n    return yield* new UnifiUpdateDidNotConverge({\n      type: spec.type,\n      identity,\n      fields: update.driftOf(written, news).map((d) => d.field),\n    });\n  });\n",
     "/**\n * `Unifi.FirewallZone` — one firewall zone on a UniFi Network site, READ-ONLY (`policy.ts`).\n *\n * ★ WHY FIREWALL ZONE IS IN THE FIRST IMPORT SET AND `Unifi.FirewallPolicy` IS NOT.\n *   `getFirewallZone`/`getFirewallZones` (`firewall.ts`) is a list+get pair over genuine,\n *   simply-shaped configuration: `{id, metadata, name, networkIds}`, four fields, no nested\n *   discriminated filter. `FirewallPolicy` (same file) is also list+get and also configuration,\n *   but its `source`/`destination`/`ipProtocolScope` fields carry several of `docs/unifi-api-notes.md`'s\n *   \"converter-flattened discriminator variants\" each, and `firewall/policies/ordering` replaces\n *   the whole ordered list — modelling those correctly is a bigger, separate PR (`network.ts`'s\n *   header note names it explicitly) rather than something to rush alongside this one.\n */\nimport { Resource } from 'alchemy';\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as firewall from '@distilled.cloud/unifi-network/firewall';\nimport * as Effect from 'effect/Effect';\nimport {\n  type FirewallZoneAttributes,\n  type FirewallZoneProps,\n  attributesOf,\n  matches,\n} from './firewall-zone-form.ts';\nimport type { UnifiRequirements, UnifiSpec } from './resource.ts';\nimport { unifiHandlers } from './resource.ts';\n\nexport type { FirewallZoneAttributes, FirewallZoneProps } from './firewall-zone-form.ts';\nexport { declareFirewallZone, driftOf } from './firewall-zone-form.ts';\n\nexport interface UnifiFirewallZone extends Resource<\n  'Unifi.FirewallZone',\n  FirewallZoneProps,\n  FirewallZoneAttributes,\n  never,\n  UnifiRequirements\n> {}\n\nexport const UnifiFirewallZone = Resource<UnifiFirewallZone>('Unifi.FirewallZone', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** `firewallZone('lan', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */\nexport const firewallZone = (id: string, props: FirewallZoneProps) =>\n  UnifiFirewallZone(id, props).pipe(adopt(true));\n\n/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */\nexport const spec: UnifiSpec<\n  FirewallZoneProps,\n  firewall.FirewallZone,\n  FirewallZoneAttributes,\n  firewall.GetFirewallZoneError\n> = {\n  type: 'Unifi.FirewallZone',\n  describe: (props) => `sites/${props.siteId}/firewall/zones/${props.firewallZoneId}`,\n  fetchLive: (props) =>\n    firewall\n      .getFirewallZone({ siteId: props.siteId, firewallZoneId: props.firewallZoneId })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  attributes: attributesOf,\n  matches,\n};\n\nexport const handlers = unifiHandlers(spec);\n\nexport const UnifiFirewallZoneProvider = () =>\n  Provider.effect(UnifiFirewallZone, Effect.succeed(UnifiFirewallZone.Provider.of(handlers)));\n",
     "/**\n * `Unifi.FirewallZone`'s wire shape — the declarable subset of `FirewallZone`, and how a live\n * read becomes both plan attributes and a rendered declaration.\n *\n * ⚠️ ONLY `name` AND `networkIds` ARE DECLARABLE. `CreateFirewallZoneRequest`\n *   (`firewall.ts`) accepts exactly those two beyond `siteId`; `metadata` (origin/source) and\n *   `id` are server-derived, so — same split as `network-form.ts`'s `default`/`metadata` —\n *   they are attributes-only, reported but never compared or declared.\n *\n * ⛔ `networkIds` ORDER IS NOT PART OF IDENTITY. The vendor document gives no indication the\n *   list is ordered (it is a set of attached networks, not a sequence like the ordering\n *   endpoints' rule lists), so `matches` compares it as a set — sorted before comparing —\n *   the same reasoning `proxmox/user-wire.ts`'s `groupSet` gives for PVE's `groups`.\n */\nimport type * as firewall from '@distilled.cloud/unifi-network/firewall';\nimport { makeDriftOf } from './drift.ts';\n\nexport interface FirewallZoneProps {\n  siteId: string;\n  firewallZoneId: string;\n  /** Name of a firewall zone. */\n  name: string;\n  /** Network IDs attached to this zone — compared as a set, see the header. */\n  networkIds: string[];\n}\n\nexport interface FirewallZoneAttributes {\n  siteId: string;\n  firewallZoneId: string;\n  name: string;\n  networkIds: string[];\n  /** `origin`/`source` (e.g. `SDWAN`) — server-derived, never declared. */\n  metadataOrigin: string;\n}\n\nconst sortedSet = (values: readonly string[]): string[] => [...new Set(values)].sort();\n\nexport const attributesOf = (\n  live: firewall.FirewallZone,\n  props: FirewallZoneProps,\n): FirewallZoneAttributes => ({\n  siteId: props.siteId,\n  firewallZoneId: live.id,\n  name: live.name,\n  networkIds: sortedSet(live.networkIds),\n  metadataOrigin: live.metadata.origin,\n});\n\n/**\n * B6: `fieldDrift` (`makeDriftOf`, `drift.ts`) is now the ONLY comparison this family has — MEDIUM-4\n * (red team, 2026-09-26): a hand-written `matches` kept beside `fieldDrift` is two field lists an\n * edit to one can silently leave out of sync with the other (a mutant deleting a `fieldDrift` entry\n * left every test green, because `matches` never consulted it). `matches(attrs, props) ===\n * (driftOf(live, props).length === 0)` is now true BY CONSTRUCTION, not just by a test that happens\n * to check both. `networkIds`' custom `equal` is the set comparison the family has always used —\n * see the header — and its reported `live`/`declared` values in a `driftOf` result are the SORTED\n * arrays, not the joined strings this `equal` compares internally, so a real diff reads as a set\n * difference, not two opaque strings.\n */\nconst fieldDrift = makeDriftOf<FirewallZoneAttributes, FirewallZoneProps>([\n  { field: 'name', live: (a) => a.name, declared: (p) => p.name },\n  {\n    field: 'networkIds',\n    live: (a) => a.networkIds,\n    declared: (p) => sortedSet(p.networkIds),\n    equal: (live, declared) => (live as string[]).join(',') === (declared as string[]).join(','),\n  },\n]);\n\nexport const matches = (attributes: FirewallZoneAttributes, props: FirewallZoneProps): boolean =>\n  fieldDrift(attributes, props).length === 0;\n\n/**\n * Per-field live-vs-declared drift straight from one live read — the task's own API\n * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive\n * `attributesOf` itself just to call this.\n */\nexport const driftOf = (live: firewall.FirewallZone, props: FirewallZoneProps) =>\n  fieldDrift(attributesOf(live, props), props);\n\n/**\n * The declaration renderer (task spec: \"given one live object, return the props a declaration\n * needs so its plan is noop\"). `matches(attributesOf(live, props), declareFirewallZone(live,\n * siteId))` is `true` by construction (`firewall-zone.test.ts` proves it).\n */\nexport const declareFirewallZone = (\n  live: firewall.FirewallZone,\n  siteId: string,\n): FirewallZoneProps => ({\n  siteId,\n  firewallZoneId: live.id,\n  name: live.name,\n  networkIds: sortedSet(live.networkIds),\n});\n",
     "/**\n * `Unifi.DnsPolicy` — one DNS policy on a UniFi Network site, READ-ONLY (`policy.ts`).\n *\n * ★ T11 GATE, CHECKED 2026-09-26, CORRECTED SAME DAY (red team, Important finding 1): `DNS\n *   Policies` is 5 operations, `Access Control (ACL Rules)` (`acl-rule.ts`) is 7 — 12 total.\n *   Diffed the pinned 10.4.57 spec against a 10.6.97 mirror (`beezly/unifi-apis`, diffing aid\n *   only, `docs/unifi-acl-rule.md` records the sha256 + mirror commit): all 12 full operation\n *   objects (parameters, request body, responses, unresolved `$ref`s included) are byte-identical\n *   across versions. ⚠️ The schema closure is 46, not 17 — a `$ref`-only walk misses every schema\n *   reachable only via a `discriminator.mapping` (both `DNS policy` and `ACL rule` discriminate on\n *   `type`); the 46-schema closure, `$ref` + `mapping` together, shares zero names with the 14\n *   schemas that DID change between the two versions (all in `Switching`, `Filtering`, or one\n *   `UniFi Devices` enum — none of it DNS- or ACL-shaped). Same reachability method\n *   `spec-version-provenance.md` (distilled package) used for Networks/FirewallZones, extended to\n *   follow `mapping` too; full breakdown in `docs/unifi-acl-rule.md`, not repeated per family.\n */\nimport { Resource } from 'alchemy';\nimport { adopt } from 'alchemy/AdoptPolicy';\nimport * as Provider from 'alchemy/Provider';\nimport * as dnsPolicies from '@distilled.cloud/unifi-network/dns_policies';\nimport * as Effect from 'effect/Effect';\nimport { type DnsPolicyAttributes, type DnsPolicyProps, attributesOf } from './dns-policy-form.ts';\nimport { matches } from './dns-policy-drift.ts';\nimport type { UnifiRequirements, UnifiSpec } from './resource.ts';\nimport { unifiHandlers } from './resource.ts';\n\nexport type { DnsPolicyAttributes, DnsPolicyProps } from './dns-policy-form.ts';\nexport { declareDnsPolicy } from './dns-policy-form.ts';\nexport { driftOf } from './dns-policy-drift.ts';\n\nexport interface UnifiDnsPolicy extends Resource<\n  'Unifi.DnsPolicy',\n  DnsPolicyProps,\n  DnsPolicyAttributes,\n  never,\n  UnifiRequirements\n> {}\n\nexport const UnifiDnsPolicy = Resource<UnifiDnsPolicy>('Unifi.DnsPolicy', {\n  defaultRemovalPolicy: 'retain',\n});\n\n/** `dnsPolicy('lan-forwarding', props)` — `adopt(true)` piped on by default (H5); see `network.ts`. */\nexport const dnsPolicy = (id: string, props: DnsPolicyProps) =>\n  UnifiDnsPolicy(id, props).pipe(adopt(true));\n\n/** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */\nexport const spec: UnifiSpec<\n  DnsPolicyProps,\n  dnsPolicies.DNSPolicy,\n  DnsPolicyAttributes,\n  dnsPolicies.GetDnsPolicyError\n> = {\n  type: 'Unifi.DnsPolicy',\n  describe: (props) => `sites/${props.siteId}/dns/policies/${props.dnsPolicyId}`,\n  fetchLive: (props) =>\n    dnsPolicies\n      .getDnsPolicy({ siteId: props.siteId, dnsPolicyId: props.dnsPolicyId })\n      .pipe(Effect.catchTag('NotFound', () => Effect.succeed(undefined))),\n  attributes: attributesOf,\n  matches,\n};\n\nexport const handlers = unifiHandlers(spec);\n\nexport const UnifiDnsPolicyProvider = () =>\n  Provider.effect(UnifiDnsPolicy, Effect.succeed(UnifiDnsPolicy.Provider.of(handlers)));\n",
@@ -32,7 +36,7 @@
     "/**\n * `Unifi.TrafficMatchingList`'s `matches` AND `driftOf` (B6) — both built on the ONE field list\n * below, the same `fieldDrift`-is-the-only-comparison shape `network-drift.ts`'s header explains\n * (MEDIUM-4, red team, 2026-09-26): `matches(attrs, props) === (driftOf(live, props).length === 0)`\n * is true BY CONSTRUCTION, never two hand-kept-in-sync comparisons.\n *\n * ⚠️ `stripNullish: true` ON EVERY FIELD BY DEFAULT (`drift.ts`'s `defaultEqual`) — same \"UniFi's\n *   JSON answers `null`, a declaration omits\" tolerance every other family here relies on.\n * ★ `items` compares with the plain default `equal` (whole-value `deepEqual`) — see\n *   `traffic-matching-list-form.ts`'s header for the accepted known gap this leaves for a\n *   membership-preserving reorder.\n */\nimport type * as trafficMatchingLists from '@distilled.cloud/unifi-network/traffic_matching_lists';\nimport { makeDriftOf } from './drift.ts';\nimport {\n  type TrafficMatchingListAttributes,\n  type TrafficMatchingListProps,\n  attributesOf,\n} from './traffic-matching-list-form.ts';\n\nconst fieldDrift = makeDriftOf<TrafficMatchingListAttributes, TrafficMatchingListProps>([\n  { field: 'name', live: (a) => a.name, declared: (p) => p.name },\n  { field: 'type', live: (a) => a.type, declared: (p) => p.type },\n  { field: 'items', live: (a) => a.items, declared: (p) => p.items },\n]);\n\nexport const matches = (\n  attributes: TrafficMatchingListAttributes,\n  props: TrafficMatchingListProps,\n): boolean => fieldDrift(attributes, props).length === 0;\n\n/**\n * Per-field live-vs-declared drift straight from one live read — the task's own API\n * (`driftOf(live, props)`), so `homeflare-network`'s pre-import drift check never has to derive\n * `attributesOf` itself just to call this.\n */\nexport const driftOf = (\n  live: trafficMatchingLists.TrafficMatchingList,\n  props: TrafficMatchingListProps,\n) => fieldDrift(attributesOf(live, props), props);\n",
     "/**\n * Every `Unifi.*` provider as one layer for a stack.\n *\n *     Layer.mergeAll(unifiProviders(), …the stack's other providers)\n *       .pipe(Layer.provide(FetchHttpClient.layer))\n *\n * S16: a subpath's `providers()` plays the role upstream's own `Providers.ts` does — one minimal\n * insertion per family. `FetchHttpClient.layer` is the stack's own responsibility to provide,\n * mirroring `../discord/providers.ts`.\n */\nimport * as Layer from 'effect/Layer';\nimport { UnifiAclRuleProvider } from './acl-rule.ts';\nimport { UnifiAclRuleOrderingProvider } from './acl-rule-ordering.ts';\nimport { UnifiDnsPolicyProvider } from './dns-policy.ts';\nimport { UnifiFirewallPolicyProvider } from './firewall-policy.ts';\nimport { UnifiFirewallPolicyOrderingProvider } from './firewall-policy-ordering.ts';\nimport { UnifiFirewallZoneProvider } from './firewall-zone.ts';\nimport { UnifiNetworkProvider } from './network.ts';\nimport { UnifiTrafficMatchingListProvider } from './traffic-matching-list.ts';\nimport { UnifiWifiBroadcastProvider } from './wifi-broadcast.ts';\n\nexport const providers = () =>\n  Layer.mergeAll(\n    UnifiNetworkProvider(),\n    UnifiFirewallZoneProvider(),\n    UnifiDnsPolicyProvider(),\n    UnifiAclRuleProvider(),\n    UnifiAclRuleOrderingProvider(),\n    UnifiWifiBroadcastProvider(),\n    UnifiFirewallPolicyProvider(),\n    UnifiFirewallPolicyOrderingProvider(),\n    UnifiTrafficMatchingListProvider(),\n  );\n"
   ],
-  "mappings": ";AAaA;AACA;AAEO,IAAM,yBACX;AAAA;AAKK,MAAM,0BAA+B,iBAAY,mBAAmB,EAMxE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK,yBAAyB,KAAK,aAAa;AAAA;AAE3E;AAGO,IAAM,cAAc,CAAC,MAAc,UAAkB,WACnD,YAAK,IAAI,kBAAkB,EAAE,MAAM,UAAU,OAAO,CAAC,CAAC;;ACH/D;AACA;AAEA;AAEA;AACA;AAuBO,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,OAAO,CAAC,UACZ,KACG,UAAU,KAAK,EACf,KAAY,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CAAC;AAAA,EAE/F,OAAO;AAAA,IACL;AAAA,IAEA,aAAa,GAAG,MAAM,aACb,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU;AAAA,QAAW;AAAA,MAIzB,OAAO,WAAW,YAAY,QAAQ,QAAQ,KAAK;AAAA,KACpD;AAAA,IAEH,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,OAAO,KAAK,QAAQ,MAAM,IAAI,IACzB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAEH,WAAW,CAAC,SACH,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,OAAO,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MAC1F,IAAI,CAAC,KAAK,QAAQ,MAAM,IAAI,GAAG;AAAA,QAC7B,OAAO,OAAO,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,MACpE;AAAA,MAGA,OAAO;AAAA,KACR;AAAA,IAEH,SAAS,CAAC,SAAgB,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,EAChF;AAAA;AAAA;AAuBK,MAAM,2BAA2B,MAAM;AAAA,EAEjC;AAAA,EAEA;AAAA,EAHX,WAAW,CACA,QAEA,MACT;AAAA,IACA,MACE,mCAAmC,UAAU,WAAW,uCACtD,4FACA,2FACA,8CACJ;AAAA,IATS;AAAA,IAEA;AAAA,IAQT,KAAK,OAAO;AAAA;AAEhB;AASA,IAAM,cAAc,CAAC,QAAwB;AAAA,EAC3C,IAAI;AAAA,IACF,OAAO,IAAI,IAAI,GAAG,EAAE;AAAA,IACpB,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAIX,IAAM,eAAe,CAAC,WACpB,OAAO,KACM,4BAAiB,CAAC,YAC3B,QAAQ,WAAW,QACR,gBAAQ,OAAO,IACf,YAAI,IAAI,mBAAmB,QAAQ,QAAQ,YAAY,QAAQ,GAAG,CAAC,CAAC,CACjF,CACF;AAQK,IAAM,oBAA+B,8BACnC,YAAe,uBAAY,YAAY,CAChD;AAQO,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,MAAM,MAAM,gBAAgB,IAAI;AAAA,EAChC,MAAM,kBAAkB,CAAS,WAC/B,OAAO,KAAY,gBAAQ,iBAAiB,GAAU,gBAAQ,kBAAkB,CAAC;AAAA,EACnF,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,CAAC,SACL,gBAAgB,IAAI,YAAY,IAAI,CAAC;AAAA,IACvC,MAAM,CAAC,SACL,gBAAgB,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM,CAAC;AAAA,IAClD,WAAW,CAAC,SAA0B,gBAAgB,IAAI,UAAU,KAAK,IAAI,CAAC;AAAA,IAC9E,QAAQ,CAAC,SAA0B,gBAAgB,IAAI,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC3E;AAAA;;ACnLF;AACA;AACA;AACA;AACA;;;ACUA,IAAM,YAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAc9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA,KAAK,OAAO,8BAA8B,UAAU,MAAM,4BAA4B,EAAE;AAOvF,IAAM,6BAA6B,CACxC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,4BAA4B,YAClC,EAAE,yBAAyB,UAAU,MAAM,uBAAuB,EAAE,IACpE,CAAC;AAAA,KACD,MAAM,iCAAiC,YACvC,EAAE,8BAA8B,UAAU,MAAM,4BAA4B,EAAE,IAC9E,CAAC;AACP;AAkDC,IAAM,eAAe,CAC1B,MACA,WACuB;AAAA,EACvB,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;AAmBO,IAAM,iBAAiB,CAAC,MAA+B,YAAkC;AAAA,EAC9F;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;;;ACpKA;AAwBA,IAAM,eAAe,CAAC,MAAe,aACnC,UAAU,MAAM,UAAU,EAAE,cAAc,KAAK,CAAC;AAO3C,IAAM,cACX,CAAoB,WACpB,CAAC,YAAwB,UACvB,OAAO,QAAQ,GAAG,OAAO,MAAM,UAAU,QAAQ,mBAAmB;AAAA,EAClE,MAAM,YAAY,KAAK,UAAU;AAAA,EACjC,MAAM,gBAAgB,SAAS,KAAK;AAAA,EACpC,OAAO,MAAM,WAAW,aAAa,IACjC,CAAC,IACD,CAAC,EAAE,OAAO,MAAM,WAAW,UAAU,cAAc,CAAC;AAAA,CACzD;;;AC7BL,IAAM,aAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,IACjD,UAAU,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,EACvD;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,IAC3D,UAAU,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,EACjE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAC5E,CAAC;AAEM,IAAM,UAAU,CAAC,YAA+B,UACrD,WAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,UAAU,CAAC,MAA+B,UACrD,WAAW,aAAa,MAAM,KAAK,GAAG,KAAK;;;AHlCtC,IAAM,eAAe,SAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAQM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,MAAM,IAAI,CAAC;AAOnC,IAAM,OAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,mBAAmB,MAAM;AAAA,EAC7D,WAAW,CAAC,UAEP,2BAAkB,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EACtE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,WAAW,cAAc,IAAI;AAEnC,IAAM,uBAAuB,MACzB,gBAAO,cAAqB,gBAAQ,aAAa,SAAS,GAAG,QAAQ,CAAC,CAAC;;AItElF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACmBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAE9E,IAAM,gBAAe,CAC1B,MACA,WAC4B;AAAA,EAC5B,QAAQ,MAAM;AAAA,EACd,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AAAA,EACrC,gBAAgB,KAAK,SAAS;AAChC;AAaA,IAAM,cAAa,YAAuD;AAAA,EACxE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,WAAU,EAAE,UAAU;AAAA,IACvC,OAAO,CAAC,MAAM,aAAc,KAAkB,KAAK,GAAG,MAAO,SAAsB,KAAK,GAAG;AAAA,EAC7F;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAoC,UAC1D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;AAOtC,IAAM,sBAAsB,CACjC,MACA,YACuB;AAAA,EACvB;AAAA,EACA,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AACvC;;;ADxDO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAGM,IAAM,eAAe,CAAC,IAAY,UACvC,kBAAkB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGxC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,yBAAyB,MAAM;AAAA,EACnE,WAAW,CAAC,UAEP,yBAAgB,EAAE,QAAQ,MAAM,QAAQ,gBAAgB,MAAM,eAAe,CAAC,EAC9E,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEjD5F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACqEO,IAAM,gBAAe,CAC1B,MACA,WACyB;AAAA,EACzB,QAAQ,MAAM;AAAA,EACd,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AAAA,EACX,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,mBAAmB,CAAC,MAA6B,YAAoC;AAAA,EAChG;AAAA,EACA,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AACb;;;AC9HA,IAAM,cAAa,YAAiD;AAAA,EAClE,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE,WAAW,UAAU,CAAC,MAAM,EAAE,UAAU;AAAA,EAC7E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAChE,CAAC;AAEM,IAAM,WAAU,CAAC,YAAiC,UACvD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFTtC,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAGM,IAAM,YAAY,CAAC,IAAY,UACpC,eAAe,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGrC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,uBAAuB,MAAM;AAAA,EACjE,WAAW,CAAC,UAEP,yBAAa,EAAE,QAAQ,MAAM,QAAQ,aAAa,MAAM,YAAY,CAAC,EACrE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGxDtF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACwBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAI9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,cAAc,YAAY,EAAE,WAAW,WAAU,MAAM,SAAS,EAAE,IAAI,CAAC;AACnF;AAEC,IAAM,0BAA0B,CACrC,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA2ChE,IAAM,gBAAe,CAAC,MAAwB,WAA4C;AAAA,EAC/F,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,OAAO,KAAK;AAAA,EACZ,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AAAA,EACtB,gBAAgB,KAAK,SAAS;AAChC;AASO,IAAM,iBAAiB,CAAC,MAAwB,YAAkC;AAAA,EACvF;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AACxB;;;AChHA,IAAM,cAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,IAC1D,UAAU,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,EAChE;AAAA,EACA,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,IACrD,UAAU,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,EAC3D;AAAA,EACA,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AACjG,CAAC;AAEM,IAAM,WAAU,CAAC,YAA+B,UACrD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAAwB,UAC9C,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFxBtC,IAAM,eAAe,UAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAGM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGnC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,oBAAoB,MAAM;AAAA,EAC9D,WAAW,CAAC,UAEP,oBAAW,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EAC/D,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,uBAAuB,MACzB,iBAAO,cAAqB,gBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG5ClF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACeO,IAAM,gBAAe,CAC1B,MACA,WAC+B;AAAA,EAC/B,QAAQ,MAAM;AAAA,EACd,mBAAmB,KAAK;AAC1B;AASO,IAAM,yBAAyB,CACpC,MACA,YAC0B;AAAA,EAC1B;AAAA,EACA,mBAAmB,KAAK;AAC1B;AAEA,IAAM,cAAa,YAA6D;AAAA,EAC9E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAQhD,IAAM,WAAU,CAAC,MAAgC,UACtD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADrCtC,IAAM,uBAAuB,UAA+B,yBAAyB;AAAA,EAC1F,sBAAsB;AACxB,CAAC;AAGM,IAAM,kBAAkB,CAAC,IAAY,UAC1C,qBAAqB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG3C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM;AAAA,EACpC,WAAW,CAAC,UAEP,6BAAmB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAC3C,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,+BAA+B,MACjC,iBAAO,sBAA6B,gBAAQ,qBAAqB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEpClG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACMA,IAAM,gBAAgB,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAEzF,IAAM,oBAAoB,CAAC,WACzB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AAG3C,IAAM,SAAS,CAAC,QACd,GAAG,IAAI,QAAQ,IAAI,aAAa;AAU3B,IAAM,eAAe,CAC1B,QAEA,QAAQ,YACJ,YACA,EAAE,MAAM,IAAI,SAAU,IAAI,cAAc,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAE7F,IAAM,aAAa,CACjB,WAC0C;AAAA,EAC1C,MAAM,QAAQ,IAAI,IAChB,OAAO,IACL,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,aAAa,GAAG,CAAwC,CACjF,CACF;AAAA,EACA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;AAQvE,IAAM,mBAAmB,CAC9B,UAEA,UAAU,YAAY,YAAY,EAAE,MAAM,MAAM,KAAK;AAWhD,IAAM,yBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,EACE,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,KACjF,MAAM,iBAAiB,YACvB,EAAE,cAAc,cAAc,MAAM,YAAY,EAAE,IAClD,CAAC;AACP;AAEC,IAAM,uBAAuB,CAAC,UACnC,UAAU,YAAY,QAAQ,kBAAkB,KAAK;AAchD,IAAM,iCAAiC,CAC5C,WACsD;AAAA,EACtD,MAAM,MAAM;AAAA,KACR,MAAM,2BAA2B,YACjC,EAAE,wBAAwB,WAAW,MAAM,sBAAsB,EAAE,IACnE,CAAC;AACP;AAqCO,IAAM,gBAAe,CAC1B,MACA,WAC6B;AAAA,EAC7B,QAAQ,MAAM;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,gBAAgB,KAAK,SAAS;AAChC;AAYO,IAAM,uBAAuB,CAClC,MACA,YACwB;AAAA,EACxB;AAAA,EACA,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAClF;;;ACzLA,IAAM,cAAa,YAAyD;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IAIE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,aAAa,EAAE,OAAO;AAAA,EACzC;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,uBAAsB,EAAE,wBAAwB;AAAA,EACnE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,qBAAqB,EAAE,0BAA0B;AAAA,EACpE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,iBAAiB,EAAE,oBAAoB;AAAA,EAC1D;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAqC,UAC3D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA4C,UAClE,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AClC7C;AACA;AAgBA,IAAM,YAAY;AAAA;AAEX,MAAM,oCAAyC,kBAAY,6BAA6B,EAO5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,gBAAgB,KAAK,aAAa,KAAK,wDACvC;AAAA;AAGN;AAuBA,IAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI;AAEjE,IAAM,UAAU,CACrB,WACA,YAEO,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAY,CAAC;AAAA,EACnB,MAAM,cAAc,QAAQ,UAAU;AAAA,EACtC,IAAI,SAAS;AAAA,EACb,IAAI;AAAA,EACJ,SAAS,YAAY,IAAK,aAAa;AAAA,IACrC,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,iBAAiB,6BAA6B;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,IAKA,MAAM,OAAO,OAAO,UAAU,KAAK,SAAS,OAAO,CAAQ;AAAA,IAC3D,IAAI,KAAK,WAAW,QAAQ;AAAA,MAC1B,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,oBAAoB,uBAAuB,iBAAiB,KAAK,MAAM;AAAA,MACjF,CAAC;AAAA,IACH;AAAA,IACA,IAAI,eAAe,aAAa,KAAK,eAAe,YAAY;AAAA,MAC9D,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,2BAA2B,iBAAiB,UAAU,QAAQ,iBAAiB,KAAK,UAAU;AAAA,MACxG,CAAC;AAAA,IACH;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK,GAAG,KAAK,IAAI;AAAA,IACtB,IAAI,KAAK,KAAK,WAAW;AAAA,MAAG;AAAA,IAC5B,UAAU,KAAK,KAAK;AAAA,IACpB,IAAI,UAAU;AAAA,MAAY;AAAA,EAC5B;AAAA,EACA,MAAM,WAAW,aAAa;AAAA,EAC9B,IAAI,KAAK,WAAW,UAAU;AAAA,IAC5B,OAAO,OAAO,IAAI,4BAA4B;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ,aAAa,KAAK,8BAA8B,iBAAiB,UAAU,oBAAoB,kBAAkB,iBAAiB,QAAQ;AAAA,IACpJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA,CACR;;;AHhFI,IAAM,qBAAqB,UAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AAGM,IAAM,gBAAgB,CAAC,IAAY,UACxC,mBAAmB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGzC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,0BAA0B,MAAM;AAAA,EACpE,WAAW,CAAC,UACV,QAAuB,qCAAsB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAAE,KAC9D,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,GACpD,YAAI,CAAC,SAAS,MAAM,KAAK,CAAC,QAAQ,IAAI,OAAO,MAAM,eAAe,CAAC,CAC5E;AAAA,EACF,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,gBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AIxE9F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC0BA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAK9E,IAAM,iCAAiC,CAC5C,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA6ChE,IAAM,gBAAe,CAC1B,MACA,WAC8B;AAAA,EAC9B,QAAQ,MAAM;AAAA,EACd,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,OAAO,KAAK;AAAA,EACZ,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AAAA,EACb,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,wBAAwB,CACnC,MACA,YACyB;AAAA,EACzB;AAAA,EACA,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AACf;;;ACxHA,IAAM,cAAa,YAA2D;AAAA,EAC5E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,IACnE,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AAAA,EACA,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AAAA,EAC/F,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,kBAAkB,MAAM,CAAC,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe;AAAA,EAC5F,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AACtE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CAAC,MAA+B,UACrD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFXtC,IAAM,sBAAsB,UAA8B,wBAAwB;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAIM,IAAM,iBAAiB,CAAC,IAAY,UACzC,oBAAoB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG1C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,4BAA4B,MAAM;AAAA,EACtE,WAAW,CAAC,UAEP,4BAAkB,EAAE,QAAQ,MAAM,QAAQ,kBAAkB,MAAM,iBAAiB,CAAC,EACpF,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,8BAA8B,MAChC,iBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGtDhG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC+BO,IAAM,gBAAe,CAC1B,MACA,WACsC;AAAA,EACtC,QAAQ,MAAM;AAAA,EACd,sBAAsB,MAAM;AAAA,EAC5B,2BAA2B,MAAM;AAAA,EACjC,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAUO,IAAM,gCAAgC,CAC3C,MACA,QACA,sBACA,+BACiC;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAEA,IAAM,cAAa,YAA2E;AAAA,EAC5F;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAMhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADhEzC,IAAM,8BAA8B,UACzC,gCACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,yBAAyB,CAAC,IAAY,UACjD,4BAA4B,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGlD,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,sCACf,yBAAyB,MAAM,yBAC/B,8BAA8B,MAAM;AAAA,EACtC,WAAW,CAAC,UAEP,oCAA0B;AAAA,IACzB,QAAQ,MAAM;AAAA,IACd,sBAAsB,MAAM;AAAA,IAC5B,2BAA2B,MAAM;AAAA,EACnC,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,sCAAsC,MACxC,iBACP,6BACO,iBAAQ,4BAA4B,SAAS,GAAG,SAAQ,CAAC,CAClE;;AE3EF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACiCO,IAAM,gBAAe,CAC1B,MACA,WACmC;AAAA,EACnC,QAAQ,MAAM;AAAA,EACd,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;AAUO,IAAM,6BAA6B,CACxC,MACA,YAC8B;AAAA,EAC9B;AAAA,EACA,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;;;ACxDA,IAAM,cAAa,YAAqE;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM;AACnE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFCzC,IAAM,2BAA2B,UACtC,6BACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,sBAAsB,CAAC,IAAY,UAC9C,yBAAyB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG/C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,iCAAiC,MAAM;AAAA,EACxD,WAAW,CAAC,UAEP,4CAAuB;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,uBAAuB,MAAM;AAAA,EAC/B,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,mCAAmC,MACrC,iBACP,0BACO,iBAAQ,yBAAyB,SAAS,GAAG,SAAQ,CAAC,CAC/D;;AGnEF;AAWO,IAAM,YAAY,MACjB,eACJ,qBAAqB,GACrB,0BAA0B,GAC1B,uBAAuB,GACvB,qBAAqB,GACrB,6BAA6B,GAC7B,2BAA2B,GAC3B,4BAA4B,GAC5B,oCAAoC,GACpC,iCAAiC,CACnC;",
-  "debugId": "5A3AB5CE8957273E64756E2164756E21",
+  "mappings": ";AAeA;AACA;AAEO,IAAM,qBACX,+FACA,kGACA,mGACA;AAGK,IAAM,yBAAyB;AAAA;AAK/B,MAAM,0BAA+B,iBAAY,mBAAmB,EAMxE;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK,yBAAyB,KAAK,aAAa;AAAA;AAE3E;AAGO,IAAM,cAAc,CAAC,MAAc,UAAkB,WACnD,YAAK,IAAI,kBAAkB,EAAE,MAAM,UAAU,OAAO,CAAC,CAAC;AAI/D,IAAM,YAAY,CAAC,WAAkC,IAAI,OAAO,KAAK,IAAI;AAAA;AAGlE,MAAM,oCAAyC,iBAAY,6BAA6B,EAI5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,QAAQ,KAAK,4DACrB,GAAG,UAAU,KAAK,MAAM,wEACxB,kFACA;AAAA;AAGN;AAAA;AAGO,MAAM,+BAAoC,iBAAY,wBAAwB,EAGlF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK;AAAA;AAEhC;AAAA;AAGO,MAAM,kCAAuC,iBAAY,2BAA2B,EAIxF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,QAAQ,KAAK,4EACrB,GAAG,UAAU,KAAK,MAAM,sEACxB;AAAA;AAGN;AAAA;AAMO,MAAM,+BAAoC,iBAAY,wBAAwB,EAIlF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,QAAQ,KAAK,gCAAgC,UAAU,KAAK,MAAM,uBAC1E;AAAA;AAGN;AAAA;AAGO,MAAM,8BAAmC,iBAAY,uBAAuB,EAIhF;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,GAAG,KAAK,QAAQ,KAAK,6BAA6B,UAAU,KAAK,MAAM,wBACvE;AAAA;AAGN;AAAA;AAGO,MAAM,sCAA2C,iBACtD,+BACF,EAGG;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK;AAAA;AAEhC;AAAA;AAGO,MAAM,mCAAwC,iBAAY,4BAA4B,EAI1F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK,gCAAgC,UAAU,KAAK,MAAM;AAAA;AAErF;AAAA;AAGO,MAAM,6BAAkC,iBAAY,sBAAsB,EAI9E;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OAAO,GAAG,KAAK,QAAQ,KAAK,mCAAmC,KAAK;AAAA;AAExE;;AC3HA;AACA;AACA;AACA;AACA;AAWO,MAAM,4BAA4B,MAAM;AAAA,EAElC;AAAA,EAEA;AAAA,EAHX,WAAW,CACA,QAEA,MACT,SAAS,gCACT;AAAA,IACA,MACE,mCAAmC,UAAU,SAAS,cAAc,yBAClE,6FACA,wFACA,kCACJ;AAAA,IAVS;AAAA,IAEA;AAAA,IAST,KAAK,OAAO;AAAA;AAEhB;AAGO,IAAM,qBAAqB;AASlC,IAAM,cAAc,CAAC,QAAwB;AAAA,EAC3C,IAAI;AAAA,IAEF,OAAO,IAAI,IAAI,GAAG,EAAE,SAAS,QAAQ,wBAAwB,cAAc;AAAA,IAC3E,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAUX,IAAM,YAAY,CAChB,OACA,SACA,QACA,YACG;AAAA,EACH,IAAI,YAAY;AAAA,IAAW,OAAO;AAAA,EAClC,IAAI;AAAA,IACF,MAAM,OAAO,IAAI,IAAI,OAAO;AAAA,IAG5B,MAAM,WAA6B,wBAAM,OAAO;AAAA,IAChD,IAAW,cAAO,QAAQ;AAAA,MAAG,OAAO;AAAA,IACpC,MAAM,SAAS,SAAS;AAAA,IACxB,IAAI,OAAO,WAAW,KAAK,UAAU,OAAO,WAAW,MAAM,OAAO,SAAS;AAAA,MAAI,OAAO;AAAA,IACxF,MAAM,WAAW,KAAK,SAAS,QAAQ,QAAQ,EAAE;AAAA,IACjD,OAAO,MAAM,KACX,CAAC,UAAU,MAAM,WAAW,UAAU,OAAO,aAAa,GAAG,WAAW,MAAM,MAChF;AAAA,IACA,MAAM;AAAA,IACN,OAAO;AAAA;AAAA;AAKX,IAAM,oBAAoB,CAAC,QAAwD;AAAA,EACjF,MAAM,OAAyB,wBAAM,IAAI,OAAO;AAAA,EAChD,OAAO,IAAI,QAAQ,MAAa,cAAO,IAAI,KAAK,IAAI,QAAQ,KAAK,MAAM,KAAK,MAAM,GAAG,EAAE;AAAA;AAGzF,IAAM,QAAQ,CACZ,QACA,OACA,YAEA,OAAO,KACM,4BAAiB,CAAC,YAC3B,QAAQ,WAAW,SAAS,UAAU,OAAO,SAAS,QAAQ,QAAQ,OAAO,IAClE,gBAAQ,OAAO,IACf,YAAI,IAAI,oBAAoB,QAAQ,QAAQ,YAAY,QAAQ,GAAG,CAAC,CAAC,CAClF,GACW,6BAAkB,CAAC,aACrB,gBAAQ,UAAU,CAAC,QAExB,IAAI,UAAU,OAAO,IAAI,SAAS,MACvB,YACL,IAAI,oBACF,IAAI,QAAQ,QACZ,YAAY,IAAI,QAAQ,GAAG,GAC3B,cAAc,IAAI,iBACpB,CACF,IAGA,kBAAkB,GAAG,IACZ,YACL,IAAI,oBACF,IAAI,QAAQ,QACZ,YAAY,IAAI,QAAQ,GAAG,GAC3B,yEACF,CACF,IACO,gBAAQ,GAAG,CAC1B,CACF,CACF;AAOK,IAAM,oBAAoB,CAAC,OAAoC,YAAqB;AAAA,EACzF,OAAkB,8BACT,YAAe,uBAAY,CAAC,WAItB,qBAAU,MAAM,QAAQ,OAAO,OAAO,GAAG,cAAc,CACpE,CACF;AAAA;AASF,IAAM,iBAAiB,CACrB,WAEO,gBAAe,sBAA8B,2BAAW,GAAG,CAAC,aAC1D,uBAAe,QAAwB,6BAAa;AAAA,KAC/C,iBAAU,UAAU,OAAO,CAAC,EAAE;AAAA,EACxC,UAAU;AACZ,CAAC,CACH;AAMK,IAAM,oBAAoB,kBAAkB,CAAC,CAAC;;AC5KrD;AACA;AACA;AACA;AACA;;;ACWA,IAAM,YAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAc9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA,KAAK,OAAO,8BAA8B,UAAU,MAAM,4BAA4B,EAAE;AAOvF,IAAM,6BAA6B,CACxC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,4BAA4B,YAClC,EAAE,yBAAyB,UAAU,MAAM,uBAAuB,EAAE,IACpE,CAAC;AAAA,KACD,MAAM,iCAAiC,YACvC,EAAE,8BAA8B,UAAU,MAAM,4BAA4B,EAAE,IAC9E,CAAC;AACP;AAkDC,IAAM,eAAe,CAC1B,MACA,WACuB;AAAA,EACvB,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;AAmBO,IAAM,iBAAiB,CAAC,MAA+B,YAAkC;AAAA,EAC9F;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,YAAY,KAAK;AAAA,EACjB,QAAQ,KAAK;AAAA,EACb,cAAc,sBAAsB,KAAK,YAAY;AAAA,EACrD,uBAAuB,KAAK;AAAA,EAC5B,uBAAuB,KAAK;AAAA,EAC5B,mBAAmB,KAAK;AAAA,EACxB,mBAAmB,2BAA2B,KAAK,iBAAiB;AAAA,EACpE,kBAAkB,KAAK;AAAA,EACvB,uBAAuB,KAAK;AAAA,EAC5B,QAAQ,KAAK;AAAA,EACb,UAAU,KAAK;AACjB;;;ACpKA;AAwBA,IAAM,eAAe,CAAC,MAAe,aACnC,UAAU,MAAM,UAAU,EAAE,cAAc,KAAK,CAAC;AAO3C,IAAM,cACX,CAAoB,WACpB,CAAC,YAAwB,UACvB,OAAO,QAAQ,GAAG,OAAO,MAAM,UAAU,QAAQ,mBAAmB;AAAA,EAClE,MAAM,YAAY,KAAK,UAAU;AAAA,EACjC,MAAM,gBAAgB,SAAS,KAAK;AAAA,EACpC,OAAO,MAAM,WAAW,aAAa,IACjC,CAAC,IACD,CAAC,EAAE,OAAO,MAAM,WAAW,UAAU,cAAc,CAAC;AAAA,CACzD;;;AC7BL,IAAM,aAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,IACjD,UAAU,CAAC,MAAM,sBAAsB,EAAE,YAAY;AAAA,EACvD;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,IAC3D,UAAU,CAAC,MAAM,2BAA2B,EAAE,iBAAiB;AAAA,EACjE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAC5E,CAAC;AAEM,IAAM,UAAU,CAAC,YAA+B,UACrD,WAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,UAAU,CAAC,MAA+B,UACrD,WAAW,aAAa,MAAM,KAAK,GAAG,KAAK;;;AC1D7C;AAUO,IAAM,gBAAmD,CAAC,mBAAmB;AAC7E,IAAM,iBAAoD,CAAC,mBAAmB;AAC9E,IAAM,iBAAoD;AAAA,EAC/D;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAQA,IAAM,OAAO,CAAC,SAAgC,CAAC,QAAgB,KAAK,SAAS,GAAG;AAEzE,IAAM,yBAAyB,CACpC,MACA,OACA,UACoC;AAAA,EACpC,MAAM,OAAO;AAAA,EACb,MAAM,WAAW,SAAS,MAAM,mBAAmB,MAAM;AAAA,EACzD,IAAI,KAAK,YAAY,MAAM;AAAA,IACzB,OAAc,aAAK,IAAI,8BAA8B,EAAE,MAAM,SAAS,CAAC,CAAC;AAAA,EAC1E;AAAA,EACA,MAAM,UAAU,CAAC,GAAG,OAAO,KAAK,MAAM,GAAG,GAAG,GAAG,MAAM,MAAM,IAAI,MAAM,CAAC;AAAA,EACtE,MAAM,YAAY,QAAQ,OAAO,KAAK,cAAuC,CAAC;AAAA,EAC9E,IAAI,UAAU,SAAS,GAAG;AAAA,IACxB,OAAc,aAAK,IAAI,2BAA2B,EAAE,MAAM,UAAU,QAAQ,UAAU,CAAC,CAAC;AAAA,EAC1F;AAAA,EACA,MAAM,YAAY,KAAK,cAAuC;AAAA,EAC9D,MAAM,eAAe,MAAM,MAAM,IAAI,MAAM,EAAE,OAAO,CAAC,MAAM,CAAC,UAAU,CAAC,CAAC;AAAA,EACxE,IAAI,aAAa,SAAS,GAAG;AAAA,IAC3B,OAAc,aAAK,IAAI,uBAAuB,EAAE,MAAM,UAAU,QAAQ,aAAa,CAAC,CAAC;AAAA,EACzF;AAAA,EACA,MAAM,WAAW,KAAK,aAAsC;AAAA,EAC5D,MAAM,cAAc,OAAO,KAAK,MAAM,GAAG,EAAE,OAAO,CAAC,MAAM,CAAC,SAAS,CAAC,CAAC;AAAA,EACrE,IAAI,YAAY,SAAS,GAAG;AAAA,IAC1B,OAAc,aAAK,IAAI,sBAAsB,EAAE,MAAM,UAAU,QAAQ,YAAY,CAAC,CAAC;AAAA,EACvF;AAAA,EACA,OAAc;AAAA;;;ACtChB;AACA;AACA,sBAAS;AACT;AAMO,IAAM,gBAAgB,CAAC,MAAM,WAAW,UAAU;AASzD,IAAM,sBAAsB,CAAC,SAA2D;AAAA,EACtF,MAAM,SAAS,IAAI,IAAY,aAAa;AAAA,EAC5C,MAAM,OAAgC,CAAC;AAAA,EACvC,YAAY,KAAK,UAAU,OAAO,QAAQ,IAAI,GAAG;AAAA,IAC/C,IAAI,CAAC,OAAO,IAAI,GAAG;AAAA,MAAG,KAAK,OAAO;AAAA,EACpC;AAAA,EACA,OAAO;AAAA;AAGF,IAAM,iBAAiB,CAC5B,MACA,OACA,UACyE;AAAA,EAEzE,MAAM,OAAO,oBAAoB,IAAI;AAAA,EACrC,MAAM,OAAgC,KAAK,SAAS,MAAM,IAAI;AAAA,EAC9D,WAAW,OAAO,MAAM;AAAA,IAAO,OAAO,KAAK;AAAA,EAC3C,IAAI,WAAU,MAAM,MAAM,EAAE,cAAc,KAAK,CAAC,GAAG;AAAA,IACjD,OAAc,aACZ,IAAI,uBAAuB;AAAA,MACzB,MAAM;AAAA,MACN,UAAU,SAAS,MAAM,mBAAmB,MAAM;AAAA,IACpD,CAAC,CACH;AAAA,EACF;AAAA,EACA,OAAc,gBAAQ;AAAA,OACjB;AAAA,IACH,QAAQ,MAAM;AAAA,IACd,WAAW,KAAK;AAAA,EAClB,CAAkC;AAAA;AAG7B,IAAM,eAAe,CAC1B,MACA,OACA,UAEA,uBAAuB,MAAM,OAAO,KAAK,EAAE,KAClC,gBAAQ,eAAe,MAAM,OAAO,KAAK,CAAC,GAC1C,gBAAQ,CAAC,SAAkB,uBAAc,IAAI,EAAE,KAAW,UAAI,CAAC,CACxE;;;AC1DF;AACA;AAEA;AAEA;;;ACfA,sBAAS;AAET;AA8BO,IAAM,eAAe,CAC1B,MACA,MACA,cACiB;AAAA,EACjB,MAAM,MAAsB,CAAC;AAAA,EAC7B,MAAM,QAA4B,CAAC;AAAA,EACnC,WAAW,OAAO,WAAW;AAAA,IAC3B,IAAI,WAAU,KAAK,MAAM,KAAK,MAAM,EAAE,cAAc,KAAK,CAAC;AAAA,MAAG;AAAA,IAC7D,IAAI,KAAK,QAAQ;AAAA,MAAM,MAAM,KAAK,GAAG;AAAA,IAChC;AAAA,UAAI,OAAO,KAAK;AAAA,EACvB;AAAA,EACA,OAAO,EAAE,KAAK,MAAM;AAAA;AAUf,IAAM,kBAAkB,CAC7B,QACE,MAAM,MAAM,QAAQ,WAEf,YAAI,UAAU,GAAG;AAAA,EACtB,MAAM,WAAW,KAAK,SAAS,IAAI;AAAA,EACnC,MAAM,OAAO,OAAO,KAAK,UAAU,IAAI;AAAA,EACvC,IAAI,SAAS;AAAA,IAAW,OAAO,OAAO,YAAY,KAAK,MAAM,UAAU,QAAQ;AAAA,EAC/E,MAAM,QAAQ,KAAK,WAAW,MAAM,IAAI;AAAA,EAExC,IAAI,KAAK,QAAQ,OAAO,IAAI;AAAA,IAAG,OAAO;AAAA,EACtC,MAAM,SAAS,KAAK;AAAA,EACpB,IAAI,WAAW,aAAa,SAAS,aAAa,WAAW,WAAW;AAAA,IACtE,OAAO,OAAO,YAAY,KAAK,MAAM,UAAU,QAAQ;AAAA,EACzD;AAAA,EAEA,MAAM,WAAW,KAAK,SAAS,IAAI;AAAA,EACnC,IAAI,aAAa,UAAU;AAAA,IACzB,OAAO,OAAO,IAAI,qBAAqB,EAAE,MAAM,KAAK,MAAM,UAAU,SAAS,CAAC;AAAA,EAChF;AAAA,EACA,MAAM,UAAU,OAAO,QAAQ,MAAM,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,EAC7D,IAAI,QAAQ,SAAS,GAAG;AAAA,IACtB,OAAO,OAAO,IAAI,4BAA4B;AAAA,MAC5C,MAAM,KAAK;AAAA,MACX;AAAA,MACA,QAAQ;AAAA,IACV,CAAC;AAAA,EACH;AAAA,EACA,MAAM,QAAQ,aAAa,MAAM,MAAM,OAAO,SAAS;AAAA,EACvD,IAAI,OAAO,KAAK,MAAM,GAAG,EAAE,WAAW,KAAK,MAAM,MAAM,WAAW,GAAG;AAAA,IACnE,OAAO,OAAO,YAAY,KAAK,MAAM,UAAU,QAAQ;AAAA,EACzD;AAAA,EACA,OAAO,OAAO,WAAW,MAAM,OAAO,IAAI;AAAA,EAC1C,OAAO,KACL,GAAG,KAAK,QAAQ,0BAA0B,OAAO,KAAK,MAAM,GAAG,EAAE,KAAK,IAAI,QACxE,YAAY,MAAM,MAAM,IAAI,MAAM,EAAE,KAAK,IAAI,IACjD;AAAA,EACA,MAAM,UAAU,OAAO,OAAO,MAAM,MAAM,OAAO,IAAI;AAAA,EACrD,MAAM,eAAe,KAAK,WAAW,SAAS,IAAI;AAAA,EAClD,IAAI,KAAK,QAAQ,cAAc,IAAI;AAAA,IAAG,OAAO;AAAA,EAC7C,OAAO,OAAO,IAAI,0BAA0B;AAAA,IAC1C,MAAM,KAAK;AAAA,IACX;AAAA,IACA,QAAQ,OAAO,QAAQ,SAAS,IAAI,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK;AAAA,EAC1D,CAAC;AAAA,CACF;;;ADxDI,IAAM,kBAAkB,CAC7B,SACG;AAAA,EACH,MAAM,OAAO,CAAC,UACZ,KACG,UAAU,KAAK,EACf,KAAY,YAAI,CAAC,SAAU,SAAS,YAAY,YAAY,KAAK,WAAW,MAAM,KAAK,CAAE,CAAC;AAAA,EAE/F,OAAO;AAAA,IACL;AAAA,IAEA,aAAa,GAAG,MAAM,aACb,YAAI,UAAU,GAAG;AAAA,MACtB,MAAM,QAAQ,OAAO,KAAK,IAAI;AAAA,MAC9B,IAAI,UAAU;AAAA,QAAW;AAAA,MAIzB,OAAO,WAAW,YAAY,QAAQ,QAAQ,KAAK;AAAA,KACpD;AAAA,IAEH,MAAM,CAAC,MAAoB,WAClB,YAAI,UAAU,GAAG;AAAA,MACtB,IAAI,WAAW,aAAa,CAAC,WAAW,IAAI;AAAA,QAAG;AAAA,MAC/C,MAAM,OAAO,OAAO,KAAK,IAAI;AAAA,MAC7B,IAAI,SAAS;AAAA,QAAW,OAAO,EAAE,QAAQ,SAAS;AAAA,MAClD,OAAO,KAAK,QAAQ,MAAM,IAAI,IACzB,EAAE,QAAQ,OAAO,IACjB,EAAE,QAAQ,SAAS;AAAA,KACzB;AAAA,IAGH,WAAW,CAAC,MAAa,OAAoD,CAAC,MAC5E,gBAAgB,MAAM;AAAA,MACpB;AAAA,MACA,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,MAAM,KAAK,SAAS,MAAa;AAAA,IACnC,CAAC;AAAA,IAEH,SAAS,CAAC,SAAgB,YAAY,KAAK,MAAM,KAAK,SAAS,IAAI,GAAG,QAAQ;AAAA,EAChF;AAAA;AASK,IAAM,gBAAgB,CAC3B,SACG;AAAA,EACH,MAAM,MAAM,gBAAgB,IAAI;AAAA,EAChC,MAAM,kBAAkB,CACtB,QACA,QAAqC,CAAC,MAE/B,YAAI,UAAU,GAAG;AAAA,IAGtB,QAAQ,eAAe,OAAO,OAAO;AAAA,IACrC,OAAO,OAAO,OAAO,KAAY,gBAAQ,kBAAkB,OAAO,UAAU,CAAC,CAAC;AAAA,GAC/E,EAAE,KAAY,gBAAQ,kBAAkB,CAAC;AAAA,EAE5C,OAAO;AAAA,IACL,MAAM,MAAa,gBAAQ,CAAC,CAAC;AAAA,IAC7B,MAAM,CAAC,SACL,gBAAgB,IAAI,YAAY,IAAI,CAAC;AAAA,IACvC,MAAM,CAAC,SACL,gBAAgB,IAAI,KAAK,KAAK,MAAM,KAAK,MAAM,CAAC;AAAA,IAElD,WAAW,CAAC,SAMV,gBACE,IAAI,UAAU,KAAK,MAAM;AAAA,MACvB,MAAM,KAAK;AAAA,MACX,QAAQ,KAAK;AAAA,MACb,MAAM,CAAC,YAAY,KAAK,QAAQ,KAAK,OAAO;AAAA,IAC9C,CAAC,GAGD,KAAK,SAAS,CAAC,KAAK,OAAO,aAAa,KAAK,IAAI,CAAC,IAAI,CAAC,CACzD;AAAA,IACF,QAAQ,CAAC,SAA0B,gBAAgB,IAAI,QAAQ,KAAK,IAAI,CAAC;AAAA,EAC3E;AAAA;;;AN5GK,IAAM,eAAe,SAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AASM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,MAAM,IAAI,CAAC;AAWnC,IAAM,qBAAwD;AAAA,EACnE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAOO,IAAM,sBAAsB,CAAC,WAAuC;AAAA,EACzE,QAAQ;AAAA,EACR,MAAM,aAAa,MAAM,mBAAmB,MAAM;AACpD;AAEO,IAAM,OAMT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,mBAAmB,MAAM;AAAA,EAC7D,WAAW,CAAC,UAEP,4BAAkB,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EACtE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AAAA,EACA,QAAQ;AAAA,IACN,cAAc;AAAA,IACd,WAAW;AAAA,IACX;AAAA,IACA,YAAY;AAAA,IACZ,OAAO;AAAA,EACT;AACF;AAEO,IAAM,WAAW,cAAc,IAAI;AAEnC,IAAM,uBAAuB,MACzB,gBAAO,cAAqB,gBAAQ,aAAa,SAAS,GAAG,QAAQ,CAAC,CAAC;;AQlHlF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACmBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAE9E,IAAM,gBAAe,CAC1B,MACA,WAC4B;AAAA,EAC5B,QAAQ,MAAM;AAAA,EACd,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AAAA,EACrC,gBAAgB,KAAK,SAAS;AAChC;AAaA,IAAM,cAAa,YAAuD;AAAA,EACxE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,WAAU,EAAE,UAAU;AAAA,IACvC,OAAO,CAAC,MAAM,aAAc,KAAkB,KAAK,GAAG,MAAO,SAAsB,KAAK,GAAG;AAAA,EAC7F;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAoC,UAC1D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;AAOtC,IAAM,sBAAsB,CACjC,MACA,YACuB;AAAA,EACvB;AAAA,EACA,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,YAAY,WAAU,KAAK,UAAU;AACvC;;;ADxDO,IAAM,oBAAoB,UAA4B,sBAAsB;AAAA,EACjF,sBAAsB;AACxB,CAAC;AAGM,IAAM,eAAe,CAAC,IAAY,UACvC,kBAAkB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGxC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,yBAAyB,MAAM;AAAA,EACnE,WAAW,CAAC,UAEP,yBAAgB,EAAE,QAAQ,MAAM,QAAQ,gBAAgB,MAAM,eAAe,CAAC,EAC9E,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,4BAA4B,MAC9B,iBAAO,mBAA0B,gBAAQ,kBAAkB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEjD5F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACqEO,IAAM,gBAAe,CAC1B,MACA,WACyB;AAAA,EACzB,QAAQ,MAAM;AAAA,EACd,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AAAA,EACX,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,mBAAmB,CAAC,MAA6B,YAAoC;AAAA,EAChG;AAAA,EACA,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,YAAY,KAAK;AAAA,EACjB,aAAa,KAAK;AAAA,EAClB,cAAc,KAAK;AAAA,EACnB,WAAW,KAAK;AAAA,EAChB,kBAAkB,KAAK;AAAA,EACvB,UAAU,KAAK;AAAA,EACf,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,cAAc,KAAK;AAAA,EACnB,SAAS,KAAK;AAAA,EACd,QAAQ,KAAK;AAAA,EACb,MAAM,KAAK;AACb;;;AC9HA,IAAM,cAAa,YAAiD;AAAA,EAClE,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,cAAc,MAAM,CAAC,MAAM,EAAE,YAAY,UAAU,CAAC,MAAM,EAAE,WAAW;AAAA,EAChF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,aAAa,MAAM,CAAC,MAAM,EAAE,WAAW,UAAU,CAAC,MAAM,EAAE,UAAU;AAAA,EAC7E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAChE,CAAC;AAEM,IAAM,WAAU,CAAC,YAAiC,UACvD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA6B,UACnD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFTtC,IAAM,iBAAiB,UAAyB,mBAAmB;AAAA,EACxE,sBAAsB;AACxB,CAAC;AAGM,IAAM,YAAY,CAAC,IAAY,UACpC,eAAe,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGrC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,uBAAuB,MAAM;AAAA,EACjE,WAAW,CAAC,UAEP,yBAAa,EAAE,QAAQ,MAAM,QAAQ,aAAa,MAAM,YAAY,CAAC,EACrE,KAAY,iBAAS,YAAY,MAAa,gBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,yBAAyB,MAC3B,iBAAO,gBAAuB,gBAAQ,eAAe,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGxDtF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACwBA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAI9E,IAAM,wBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,KACK;AAAA,KACC,MAAM,cAAc,YAAY,EAAE,WAAW,WAAU,MAAM,SAAS,EAAE,IAAI,CAAC;AACnF;AAEC,IAAM,0BAA0B,CACrC,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA2ChE,IAAM,gBAAe,CAAC,MAAwB,WAA4C;AAAA,EAC/F,QAAQ,MAAM;AAAA,EACd,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,OAAO,KAAK;AAAA,EACZ,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AAAA,EACtB,gBAAgB,KAAK,SAAS;AAChC;AASO,IAAM,iBAAiB,CAAC,MAAwB,YAAkC;AAAA,EACvF;AAAA,EACA,WAAW,KAAK;AAAA,EAChB,QAAQ,KAAK;AAAA,EACb,aAAa,KAAK;AAAA,EAClB,mBAAmB,KAAK;AAAA,EACxB,SAAS,KAAK;AAAA,EACd,uBAAuB,sBAAsB,KAAK,qBAAqB;AAAA,EACvE,MAAM,KAAK;AAAA,EACX,cAAc,KAAK;AAAA,EACnB,MAAM,KAAK;AAAA,EACX,gBAAgB,wBAAwB,KAAK,cAAc;AAAA,EAC3D,iBAAiB,KAAK;AACxB;;;AChHA,IAAM,cAAa,YAA6C;AAAA,EAC9D,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,IAC1D,UAAU,CAAC,MAAM,sBAAsB,EAAE,qBAAqB;AAAA,EAChE;AAAA,EACA,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,gBAAgB,MAAM,CAAC,MAAM,EAAE,cAAc,UAAU,CAAC,MAAM,EAAE,aAAa;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,IACrD,UAAU,CAAC,MAAM,wBAAwB,EAAE,cAAc;AAAA,EAC3D;AAAA,EACA,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AACjG,CAAC;AAEM,IAAM,WAAU,CAAC,YAA+B,UACrD,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAAwB,UAC9C,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFxBtC,IAAM,eAAe,UAAuB,iBAAiB;AAAA,EAClE,sBAAsB;AACxB,CAAC;AAGM,IAAM,UAAU,CAAC,IAAY,UAClC,aAAa,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGnC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,oBAAoB,MAAM;AAAA,EAC9D,WAAW,CAAC,UAEP,oBAAW,EAAE,QAAQ,MAAM,QAAQ,WAAW,MAAM,UAAU,CAAC,EAC/D,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,uBAAuB,MACzB,iBAAO,cAAqB,iBAAQ,aAAa,SAAS,GAAG,SAAQ,CAAC,CAAC;;AG5ClF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACeO,IAAM,gBAAe,CAC1B,MACA,WAC+B;AAAA,EAC/B,QAAQ,MAAM;AAAA,EACd,mBAAmB,KAAK;AAC1B;AASO,IAAM,yBAAyB,CACpC,MACA,YAC0B;AAAA,EAC1B;AAAA,EACA,mBAAmB,KAAK;AAC1B;AAEA,IAAM,cAAa,YAA6D;AAAA,EAC9E;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAQhD,IAAM,WAAU,CAAC,MAAgC,UACtD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADrCtC,IAAM,uBAAuB,UAA+B,yBAAyB;AAAA,EAC1F,sBAAsB;AACxB,CAAC;AAGM,IAAM,kBAAkB,CAAC,IAAY,UAC1C,qBAAqB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG3C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM;AAAA,EACpC,WAAW,CAAC,UAEP,6BAAmB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAC3C,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,+BAA+B,MACjC,iBAAO,sBAA6B,iBAAQ,qBAAqB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AEpClG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACMA,IAAM,gBAAgB,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAEzF,IAAM,oBAAoB,CAAC,WACzB,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,IAAI,CAAC;AAG3C,IAAM,SAAS,CAAC,QACd,GAAG,IAAI,QAAQ,IAAI,aAAa;AAU3B,IAAM,eAAe,CAC1B,QAEA,QAAQ,YACJ,YACA,EAAE,MAAM,IAAI,SAAU,IAAI,cAAc,YAAY,EAAE,WAAW,IAAI,UAAU,IAAI,CAAC,EAAG;AAE7F,IAAM,aAAa,CACjB,WAC0C;AAAA,EAC1C,MAAM,QAAQ,IAAI,IAChB,OAAO,IACL,CAAC,QAAQ,CAAC,OAAO,GAAG,GAAG,aAAa,GAAG,CAAwC,CACjF,CACF;AAAA,EACA,OAAO,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,OAAO,CAAC,EAAE,cAAc,OAAO,CAAC,CAAC,CAAC;AAAA;AAQvE,IAAM,mBAAmB,CAC9B,UAEA,UAAU,YAAY,YAAY,EAAE,MAAM,MAAM,KAAK;AAWhD,IAAM,yBAAwB,CACnC,UAEA,SAAS,OACL,QACA;AAAA,EACE,MAAM,MAAM;AAAA,KACR,MAAM,cAAc,YAAY,EAAE,WAAW,cAAc,MAAM,SAAS,EAAE,IAAI,CAAC;AAAA,KACjF,MAAM,iBAAiB,YACvB,EAAE,cAAc,cAAc,MAAM,YAAY,EAAE,IAClD,CAAC;AACP;AAEC,IAAM,uBAAuB,CAAC,UACnC,UAAU,YAAY,QAAQ,kBAAkB,KAAK;AAchD,IAAM,iCAAiC,CAC5C,WACsD;AAAA,EACtD,MAAM,MAAM;AAAA,KACR,MAAM,2BAA2B,YACjC,EAAE,wBAAwB,WAAW,MAAM,sBAAsB,EAAE,IACnE,CAAC;AACP;AAqCO,IAAM,gBAAe,CAC1B,MACA,WAC6B;AAAA,EAC7B,QAAQ,MAAM;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,gBAAgB,KAAK,SAAS;AAChC;AAYO,IAAM,uBAAuB,CAClC,MACA,YACwB;AAAA,EACxB;AAAA,EACA,iBAAiB,KAAK;AAAA,EACtB,MAAM,KAAK;AAAA,EACX,SAAS,KAAK;AAAA,EACd,MAAM,KAAK;AAAA,EACX,SAAS,aAAa,KAAK,OAAO;AAAA,EAClC,0BAA0B,uBAAsB,KAAK,wBAAwB;AAAA,EAC7E,4BAA4B,qBAAqB,KAAK,0BAA0B;AAAA,EAChF,sBAAsB,iBAAiB,KAAK,oBAAoB;AAAA,EAChE,uBAAuB,+BAA+B,KAAK,qBAAqB;AAClF;;;ACzLA,IAAM,cAAa,YAAyD;AAAA,EAC1E,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D;AAAA,IAIE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,aAAa,EAAE,OAAO;AAAA,EACzC;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,uBAAsB,EAAE,wBAAwB;AAAA,EACnE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,qBAAqB,EAAE,0BAA0B;AAAA,EACpE;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,iBAAiB,EAAE,oBAAoB;AAAA,EAC1D;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AACF,CAAC;AAEM,IAAM,WAAU,CAAC,YAAqC,UAC3D,YAAW,YAAY,KAAK,EAAE,WAAW;AAOpC,IAAM,WAAU,CAAC,MAA4C,UAClE,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AClC7C;AACA;AAgBA,IAAM,YAAY;AAAA;AAEX,MAAM,oCAAyC,kBAAY,6BAA6B,EAO5F;AAAA,MACY,OAAO,GAAW;AAAA,IAC7B,OACE,gBAAgB,KAAK,aAAa,KAAK,wDACvC;AAAA;AAGN;AAuBA,IAAM,mBAAmB,CAAC,UACxB,OAAO,UAAU,YAAY,OAAO,SAAS,KAAK,IAAI,OAAO,KAAK,IAAI;AAEjE,IAAM,UAAU,CACrB,WACA,YAEO,aAAI,UAAU,GAAG;AAAA,EACtB,MAAM,OAAY,CAAC;AAAA,EACnB,MAAM,cAAc,QAAQ,UAAU;AAAA,EACtC,IAAI,SAAS;AAAA,EACb,IAAI;AAAA,EACJ,SAAS,YAAY,IAAK,aAAa;AAAA,IACrC,IAAI,YAAY,WAAW;AAAA,MACzB,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,iBAAiB,6BAA6B;AAAA,MACxD,CAAC;AAAA,IACH;AAAA,IAKA,MAAM,OAAO,OAAO,UAAU,KAAK,SAAS,OAAO,CAAQ;AAAA,IAC3D,IAAI,KAAK,WAAW,QAAQ;AAAA,MAC1B,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,oBAAoB,uBAAuB,iBAAiB,KAAK,MAAM;AAAA,MACjF,CAAC;AAAA,IACH;AAAA,IACA,IAAI,eAAe,aAAa,KAAK,eAAe,YAAY;AAAA,MAC9D,OAAO,OAAO,IAAI,4BAA4B;AAAA,QAC5C,QAAQ;AAAA,QACR,QAAQ,2BAA2B,iBAAiB,UAAU,QAAQ,iBAAiB,KAAK,UAAU;AAAA,MACxG,CAAC;AAAA,IACH;AAAA,IACA,aAAa,KAAK;AAAA,IAClB,KAAK,KAAK,GAAG,KAAK,IAAI;AAAA,IACtB,IAAI,KAAK,KAAK,WAAW;AAAA,MAAG;AAAA,IAC5B,UAAU,KAAK,KAAK;AAAA,IACpB,IAAI,UAAU;AAAA,MAAY;AAAA,EAC5B;AAAA,EACA,MAAM,WAAW,aAAa;AAAA,EAC9B,IAAI,KAAK,WAAW,UAAU;AAAA,IAC5B,OAAO,OAAO,IAAI,4BAA4B;AAAA,MAC5C,QAAQ;AAAA,MACR,QAAQ,aAAa,KAAK,8BAA8B,iBAAiB,UAAU,oBAAoB,kBAAkB,iBAAiB,QAAQ;AAAA,IACpJ,CAAC;AAAA,EACH;AAAA,EACA,OAAO;AAAA,CACR;;;AHhFI,IAAM,qBAAqB,UAA6B,uBAAuB;AAAA,EACpF,sBAAsB;AACxB,CAAC;AAGM,IAAM,gBAAgB,CAAC,IAAY,UACxC,mBAAmB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGzC,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,0BAA0B,MAAM;AAAA,EACpE,WAAW,CAAC,UACV,QAAuB,qCAAsB,EAAE,QAAQ,MAAM,OAAO,CAAC,EAAE,KAC9D,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,GACpD,aAAI,CAAC,SAAS,MAAM,KAAK,CAAC,QAAQ,IAAI,OAAO,MAAM,eAAe,CAAC,CAC5E;AAAA,EACF,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,6BAA6B,MAC/B,iBAAO,oBAA2B,iBAAQ,mBAAmB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AIxE9F,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC0BA,IAAM,aAAY,CAAC,WAAwC,CAAC,GAAG,IAAI,IAAI,MAAM,CAAC,EAAE,KAAK;AAK9E,IAAM,iCAAiC,CAC5C,UAC0B,SAAS,OAAO,YAAY,WAAU,KAAK;AA6ChE,IAAM,gBAAe,CAC1B,MACA,WAC8B;AAAA,EAC9B,QAAQ,MAAM;AAAA,EACd,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,OAAO,KAAK;AAAA,EACZ,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AAAA,EACb,gBAAgB,KAAK,SAAS;AAChC;AAUO,IAAM,wBAAwB,CACnC,MACA,YACyB;AAAA,EACzB;AAAA,EACA,kBAAkB,KAAK;AAAA,EACvB,QAAQ,KAAK;AAAA,EACb,uBAAuB,+BAA+B,KAAK,qBAAqB;AAAA,EAChF,aAAa,KAAK;AAAA,EAClB,aAAa,KAAK;AAAA,EAClB,SAAS,KAAK;AAAA,EACd,iBAAiB,KAAK;AAAA,EACtB,aAAa,KAAK;AAAA,EAClB,gBAAgB,KAAK;AAAA,EACrB,MAAM,KAAK;AAAA,EACX,UAAU,KAAK;AAAA,EACf,QAAQ,KAAK;AACf;;;ACxHA,IAAM,cAAa,YAA2D;AAAA,EAC5E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AAAA,EACpE;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,IACnE,UAAU,CAAC,MAAM,+BAA+B,EAAE,qBAAqB;AAAA,EACzE;AAAA,EACA,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,WAAW,MAAM,CAAC,MAAM,EAAE,SAAS,UAAU,CAAC,MAAM,EAAE,QAAQ;AAAA,EACvE,EAAE,OAAO,mBAAmB,MAAM,CAAC,MAAM,EAAE,iBAAiB,UAAU,CAAC,MAAM,EAAE,gBAAgB;AAAA,EAC/F,EAAE,OAAO,eAAe,MAAM,CAAC,MAAM,EAAE,aAAa,UAAU,CAAC,MAAM,EAAE,YAAY;AAAA,EACnF,EAAE,OAAO,kBAAkB,MAAM,CAAC,MAAM,EAAE,gBAAgB,UAAU,CAAC,MAAM,EAAE,eAAe;AAAA,EAC5F,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,YAAY,MAAM,CAAC,MAAM,EAAE,UAAU,UAAU,CAAC,MAAM,EAAE,SAAS;AAAA,EAC1E,EAAE,OAAO,UAAU,MAAM,CAAC,MAAM,EAAE,QAAQ,UAAU,CAAC,MAAM,EAAE,OAAO;AACtE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CAAC,MAA+B,UACrD,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFXtC,IAAM,sBAAsB,UAA8B,wBAAwB;AAAA,EACvF,sBAAsB;AACxB,CAAC;AAIM,IAAM,iBAAiB,CAAC,IAAY,UACzC,oBAAoB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG1C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UAAU,SAAS,MAAM,4BAA4B,MAAM;AAAA,EACtE,WAAW,CAAC,UAEP,4BAAkB,EAAE,QAAQ,MAAM,QAAQ,kBAAkB,MAAM,iBAAiB,CAAC,EACpF,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,8BAA8B,MAChC,iBAAO,qBAA4B,iBAAQ,oBAAoB,SAAS,GAAG,SAAQ,CAAC,CAAC;;AGtDhG,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;AC+BO,IAAM,gBAAe,CAC1B,MACA,WACsC;AAAA,EACtC,QAAQ,MAAM;AAAA,EACd,sBAAsB,MAAM;AAAA,EAC5B,2BAA2B,MAAM;AAAA,EACjC,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAUO,IAAM,gCAAgC,CAC3C,MACA,QACA,sBACA,+BACiC;AAAA,EACjC;AAAA,EACA;AAAA,EACA;AAAA,EACA,qBAAqB,KAAK,yBAAyB;AAAA,EACnD,oBAAoB,KAAK,yBAAyB;AACpD;AAEA,IAAM,cAAa,YAA2E;AAAA,EAC5F;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AAAA,EACA;AAAA,IACE,OAAO;AAAA,IACP,MAAM,CAAC,MAAM,EAAE;AAAA,IACf,UAAU,CAAC,MAAM,EAAE;AAAA,EACrB;AACF,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAMhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;ADhEzC,IAAM,8BAA8B,UACzC,gCACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,yBAAyB,CAAC,IAAY,UACjD,4BAA4B,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAGlD,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,sCACf,yBAAyB,MAAM,yBAC/B,8BAA8B,MAAM;AAAA,EACtC,WAAW,CAAC,UAEP,oCAA0B;AAAA,IACzB,QAAQ,MAAM;AAAA,IACd,sBAAsB,MAAM;AAAA,IAC5B,2BAA2B,MAAM;AAAA,EACnC,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,sCAAsC,MACxC,iBACP,6BACO,iBAAQ,4BAA4B,SAAS,GAAG,SAAQ,CAAC,CAClE;;AE3EF,qBAAS;AACT,kBAAS;AACT;AACA;AACA;;;ACiCO,IAAM,gBAAe,CAC1B,MACA,WACmC;AAAA,EACnC,QAAQ,MAAM;AAAA,EACd,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;AAUO,IAAM,6BAA6B,CACxC,MACA,YAC8B;AAAA,EAC9B;AAAA,EACA,uBAAuB,KAAK;AAAA,EAC5B,MAAM,KAAK;AAAA,EACX,MAAM,KAAK;AAAA,EACX,OAAO,KAAK;AACd;;;ACxDA,IAAM,cAAa,YAAqE;AAAA,EACtF,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,QAAQ,MAAM,CAAC,MAAM,EAAE,MAAM,UAAU,CAAC,MAAM,EAAE,KAAK;AAAA,EAC9D,EAAE,OAAO,SAAS,MAAM,CAAC,MAAM,EAAE,OAAO,UAAU,CAAC,MAAM,EAAE,MAAM;AACnE,CAAC;AAEM,IAAM,WAAU,CACrB,YACA,UACY,YAAW,YAAY,KAAK,EAAE,WAAW;AAOhD,IAAM,WAAU,CACrB,MACA,UACG,YAAW,cAAa,MAAM,KAAK,GAAG,KAAK;;;AFCzC,IAAM,2BAA2B,UACtC,6BACA,EAAE,sBAAsB,SAAS,CACnC;AAIO,IAAM,sBAAsB,CAAC,IAAY,UAC9C,yBAAyB,IAAI,KAAK,EAAE,KAAK,OAAM,IAAI,CAAC;AAG/C,IAAM,QAKT;AAAA,EACF,MAAM;AAAA,EACN,UAAU,CAAC,UACT,SAAS,MAAM,iCAAiC,MAAM;AAAA,EACxD,WAAW,CAAC,UAEP,4CAAuB;AAAA,IACtB,QAAQ,MAAM;AAAA,IACd,uBAAuB,MAAM;AAAA,EAC/B,CAAC,EACA,KAAY,kBAAS,YAAY,MAAa,iBAAQ,SAAS,CAAC,CAAC;AAAA,EACtE,YAAY;AAAA,EACZ;AACF;AAEO,IAAM,YAAW,cAAc,KAAI;AAEnC,IAAM,mCAAmC,MACrC,iBACP,0BACO,iBAAQ,yBAAyB,SAAS,GAAG,SAAQ,CAAC,CAC/D;;AGnEF;AAWO,IAAM,YAAY,MACjB,eACJ,qBAAqB,GACrB,0BAA0B,GAC1B,uBAAuB,GACvB,qBAAqB,GACrB,6BAA6B,GAC7B,2BAA2B,GAC3B,4BAA4B,GAC5B,oCAAoC,GACpC,iCAAiC,CACnC;",
+  "debugId": "04975D29327C722564756E2164756E21",
   "names": []
 }

package/dist/unifi/network-scope.d.ts

@@ -0,0 +1,31 @@
+/**
+ * The write SCOPE of `Unifi.Network`: the one intended consumer is a single VLAN's
+ * `ipv6Configuration`, so everything else a whole-object PUT could reach is refused BEFORE any
+ * request, with a typed error that carries field names only.
+ *
+ * ⛔ SETTABLE ALLOWLIST. A key in `patch.set` is written into the PUT body, so only
+ *   `ipv6Configuration` may be set: `enabled`, `internetAccessEnabled`, `ipv4Configuration`,
+ *   `dhcpGuarding` and every other declared key are refused with `UnifiFieldNotSettable` (a touched
+ *   immutable key gets `UnifiImmutableFieldChanged` first). Widening it is a kit change.
+ * ⛔ REMOVABLE ALLOWLIST. A key in `patch.unset` is deleted from the PUT body, and the controller
+ *   reads an omitted `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration` as "off". Dropping a
+ *   declaration key therefore must not silently turn a live block off: only `ipv6Configuration`
+ *   (the block this write path exists for, and the revert target) may be removed. A required key
+ *   (`name`, `vlanId`, …) removed from a declaration would fail the SDK schema or send a body the
+ *   controller rejects, so it is refused here with the same error.
+ * ⛔ `default: true` IS THE MANAGEMENT LAN. Writing it can cut the admin off the console.
+ * ⛔ `zoneId`/`vlanId`/`management`/`deviceId` decide where the network lives and what serves it;
+ *   a patch (set OR unset) touching one is refused. Non-USER `metadata.origin` is deliberately NOT
+ *   handled yet: no rule exists for it.
+ */
+import type * as networks from '@distilled.cloud/unifi-network/networks';
+import * as Effect from 'effect/Effect';
+import type { NetworkProps } from './network-form.ts';
+import { UnifiFieldNotRemovable, UnifiFieldNotSettable, UnifiImmutableFieldChanged, UnifiManagementNetworkRefused } from './policy.ts';
+import type { Patch } from './update-reconcile.ts';
+export declare const SETTABLE_KEYS: ReadonlyArray<keyof NetworkProps>;
+export declare const REMOVABLE_KEYS: ReadonlyArray<keyof NetworkProps>;
+export declare const IMMUTABLE_KEYS: ReadonlyArray<keyof NetworkProps>;
+export type ScopeError = UnifiFieldNotRemovable | UnifiFieldNotSettable | UnifiImmutableFieldChanged | UnifiManagementNetworkRefused;
+export declare const checkNetworkWriteScope: (live: networks.NetworkDetails, patch: Patch<NetworkProps>, props: NetworkProps) => Effect.Effect<void, ScopeError>;
+//# sourceMappingURL=network-scope.d.ts.map

package/dist/unifi/network-scope.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-scope.d.ts","sourceRoot":"","sources":["../../src/unifi/network-scope.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACzE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACtD,OAAO,EACL,sBAAsB,EACtB,qBAAqB,EACrB,0BAA0B,EAC1B,6BAA6B,EAC9B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,eAAO,MAAM,aAAa,EAAE,aAAa,CAAC,MAAM,YAAY,CAAyB,CAAC;AACtF,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,YAAY,CAAyB,CAAC;AACvF,eAAO,MAAM,cAAc,EAAE,aAAa,CAAC,MAAM,YAAY,CAK5D,CAAC;AAEF,MAAM,MAAM,UAAU,GAClB,sBAAsB,GACtB,qBAAqB,GACrB,0BAA0B,GAC1B,6BAA6B,CAAC;AAIlC,eAAO,MAAM,sBAAsB,SAC3B,QAAQ,CAAC,cAAc,SACtB,KAAK,CAAC,YAAY,CAAC,SACnB,YAAY,KAClB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,CAsBhC,CAAC"}

package/dist/unifi/network-update.d.ts

@@ -0,0 +1,44 @@
+/**
+ * `Unifi.Network`'s one write: `updateNetwork`. THE ONLY FILE UNDER `src/unifi` ALLOWED TO NAME IT
+ * (`write-op-reference.test.ts`'s `WRITE_OP_ALLOWLIST` pins that, and still refuses
+ * `createNetwork`/`deleteNetwork` here).
+ *
+ * ⛔ THE WHOLE-OBJECT-PUT TRAP (packages/distilled-unifi-network/README.md). `PUT .../networks/{id}` disables
+ *   `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration` outright when the body omits them. So
+ *   the body is never `props`: it is the RAW live object (as `fetchLive` decoded it) minus the
+ *   server fields (`SERVER_FIELDS`: `id`/`default`/`metadata`), plus ONLY the patch (HIGH-2). A
+ *   hand edit on a field
+ *   the declaration never touched rides through byte-for-byte; `update-reconcile.ts` has already
+ *   refused any hand edit on a declared field.
+ *
+ * ★ WHY RAW LIVE, NOT THE ATTRIBUTES VIEW (LOW-6). `attributesOf` normalizes (sorted sets) and
+ *   drops keys this kit does not model. Unknown keys must survive the round trip or the PUT would
+ *   silently delete a setting the console added after the SDK was generated (F2). Measured by
+ *   reading `@distilled.cloud/core` `protocol-http.ts`: `validateResponse` returns the ORIGINAL
+ *   decoded value and `mapKeys` passes unknown keys through at every level, so top-level and
+ *   nested unknown keys both survive; `network-update.test.ts` is the alarm if that ever changes.
+ *
+ * ★ WHY `unset` EXISTS (HIGH-1). Reverting a declaration (dropping `ipv6Configuration`) must plan
+ *   and execute a real update back to the pre-image. A key in `patch.unset` is DELETED from the
+ *   body, which is exactly "absent = off" for the optional blocks above.
+ *
+ * ⛔ NO-OP GUARD. If the merged body equals live (ignoring the ids), the PUT would change nothing;
+ *   `UnifiUpdateWouldBeNoop` refuses so a normalizer gap can never become a re-PUT loop.
+ *
+ * ⛔ NO RETRY ON THE PUT (red team round 1, reversing the earlier Q7 decision). The SDK's default
+ *   policy would replay a write whose first attempt may already have landed (a dropped response
+ *   during a reprovision); a replay then runs against a controller state this reconcile never
+ *   read. One attempt, and a failure surfaces for the operator. Reads keep the default policy.
+ *
+ * ⛔ SCOPE FIRST (`network-scope.ts`): the management LAN, immutable fields and non-removable keys
+ *   are refused before the body is even built, so none of them can reach the wire.
+ */
+import * as networks from '@distilled.cloud/unifi-network/networks';
+import * as Effect from 'effect/Effect';
+import { type NetworkProps } from './network-form.ts';
+import { UnifiUpdateWouldBeNoop } from './policy.ts';
+import type { Patch } from './update-reconcile.ts';
+export declare const SERVER_FIELDS: readonly ['id', 'default', 'metadata'];
+export declare const mergeForUpdate: (live: networks.NetworkDetails, patch: Patch<NetworkProps>, props: NetworkProps) => Effect.Effect<networks.UpdateNetworkRequest, UnifiUpdateWouldBeNoop>;
+export declare const writeNetwork: (live: networks.NetworkDetails, patch: Patch<NetworkProps>, props: NetworkProps) => Effect.Effect<networks.NetworkDetails, UnifiUpdateWouldBeNoop | import("./network-scope.ts").ScopeError | networks.UnifiNetworkOpError, networks.UnifiNetworkOpContext>;
+//# sourceMappingURL=network-update.d.ts.map

package/dist/unifi/network-update.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-update.d.ts","sourceRoot":"","sources":["../../src/unifi/network-update.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAkCG;AACH,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAGpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,YAAY,EAAE,MAAM,mBAAmB,CAAC;AAEtD,OAAO,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AACrD,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,uBAAuB,CAAC;AAEnD,eAAO,MAAM,aAAa,YAAI,IAAI,EAAE,SAAS,EAAE,UAAU,CAAU,CAAC;AAkBpE,eAAO,MAAM,cAAc,SACnB,QAAQ,CAAC,cAAc,SACtB,KAAK,CAAC,YAAY,CAAC,SACnB,YAAY,KAClB,MAAM,CAAC,MAAM,CAAC,QAAQ,CAAC,oBAAoB,EAAE,sBAAsB,CAkBrE,CAAC;AAEF,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,KAAK,CAAC,YAAY,CAAC,SACnB,YAAY,4KAKlB,CAAC"}

package/dist/unifi/network.d.ts

@@ -11,19 +11,22 @@
  *   `FirewallZone`; `FirewallPolicy`'s several discriminated filter variants and its
  *   list-replacing ordering endpoint are a bigger, separate PR).
  *
- * ⛔ THE WHOLE-OBJECT-PUT TRAP (`docs/unifi-api-notes.md`) NEVER FIRES HERE, BY CONSTRUCTION.
- *   `updateNetwork` is a `PUT` that disables `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration`
- *   outright when the caller omits them — the exact failure mode a read-only family cannot cause,
- *   because `resource.ts`'s `reconcile` never calls `updateNetwork` at all. Recorded here for
- *   whoever adds the write path this docs note anticipates: read-merge-write the WHOLE object,
- *   never a props-only body.
+ * ⛔ THE WHOLE-OBJECT-PUT TRAP (packages/distilled-unifi-network/README.md) FIRES HERE, THROUGH `network-update.ts`;
+ *   see its header. `updateNetwork` is a `PUT` that disables `dhcpGuarding`/`ipv4Configuration`/
+ *   `ipv6Configuration` outright when the caller omits them, so the body is the raw live object
+ *   plus only the fields the declaration changed since the last deploy — never props alone.
+ *   This is the ONE family with a write path (Tim 2026-10-10, `policy.ts`); create/delete refuse.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as networks from '@distilled.cloud/unifi-network/networks';
 import * as Effect from 'effect/Effect';
 import { type NetworkAttributes, type NetworkProps } from './network-form.ts';
+import { type ScopeError } from './network-scope.ts';
+import type { UnifiUpdateWouldBeNoop } from './policy.ts';
 import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+import type { AllowedWrite } from './wire-guard.ts';
+type UpdateError = networks.UpdateNetworkError | UnifiUpdateWouldBeNoop | ScopeError;
 export type { NetworkAttributes, NetworkProps } from './network-form.ts';
 export { declareNetwork } from './network-form.ts';
 export { driftOf } from './network-drift.ts';
@@ -31,10 +34,11 @@ export interface UnifiNetwork extends Resource<'Unifi.Network', NetworkProps, Ne
 }
 export declare const UnifiNetwork: import("alchemy").ResourceClass<UnifiNetwork>;
 /**
- * `network('lan', props)` — `adopt(true)` piped on by default (H5). This family never writes, so
- * the only thing a first deploy against an existing network could ever do is bind to it or refuse
- * `OwnedBySomeoneElse`; piping `adopt(true)` here picks the former without a stack having to
- * remember `--adopt`, mirroring `discord/application-command.ts`'s `applicationCommand`.
+ * `network('lan', props)` — `adopt(true)` piped on by default (H5). A cold first deploy against an
+ * existing network can still only bind to it or refuse `OwnedBySomeoneElse` — the update path
+ * needs prior Alchemy state (`update-reconcile.ts`), so it cannot fire on adoption. Piping
+ * `adopt(true)` here picks the bind without a stack having to remember `--adopt`, mirroring
+ * `discord/application-command.ts`'s `applicationCommand`.
  */
 export declare const network: (id: string, props: NetworkProps) => Effect.Effect<UnifiNetwork, never, import("effect/http/HttpClient").HttpClient>;
 /**
@@ -42,7 +46,18 @@ export declare const network: (id: string, props: NetworkProps) => Effect.Effect
  *   seam `netbox/prefix.ts`'s `spec` and `discord/application-command.ts`'s `spec` use — `handlers`
  *   bakes in `CredentialsFromEnv`, which resolves environment variables a test cannot repoint.
  */
-export declare const spec: UnifiSpec<NetworkProps, networks.NetworkDetails, NetworkAttributes, networks.GetNetworkDetailsError>;
+/**
+ * Every declarable key: `NetworkProps` minus the two identity ids. A test pins this against a
+ * fully-populated `NetworkProps` literal so a new prop cannot be silently unpatchable.
+ */
+export declare const NETWORK_PATCH_KEYS: ReadonlyArray<keyof NetworkProps>;
+/**
+ * The only PUT that may pass for this row: its own `/v1/sites/<siteId>/networks/<networkId>` under
+ * the configured base URL. ⛔ Built from the row's NEW props (the ids the write is about to use) and
+ * compared by exact string against the request path, so no id can act as a pattern.
+ */
+export declare const networkAllowedWrite: (props: NetworkProps) => AllowedWrite;
+export declare const spec: UnifiSpec<NetworkProps, networks.NetworkDetails, NetworkAttributes, networks.GetNetworkDetailsError, UpdateError>;
 export declare const handlers: {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
@@ -59,7 +74,12 @@ export declare const handlers: {
     } | undefined, networks.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: NetworkProps;
-    }) => Effect.Effect<NetworkAttributes, import("./policy.ts").UnifiWriteRefused | networks.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+        olds: NetworkProps | undefined;
+        output: NetworkAttributes | undefined;
+        session: {
+            note: (message: string) => Effect.Effect<void, never, never>;
+        };
+    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: NetworkProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/network.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5F,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;GAKG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,oFACZ,CAAC;AAE5C;;;;GAIG;AACH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,yHACkD,CAAC"}
+{"version":3,"file":"network.d.ts","sourceRoot":"","sources":["../../src/unifi/network.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,YAAY,EAAgB,MAAM,mBAAmB,CAAC;AAE5F,OAAO,EAAE,KAAK,UAAU,EAA0B,MAAM,oBAAoB,CAAC;AAE7E,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,aAAa,CAAC;AAC1D,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,KAAK,WAAW,GAAG,QAAQ,CAAC,kBAAkB,GAAG,sBAAsB,GAAG,UAAU,CAAC;AAErF,YAAY,EAAE,iBAAiB,EAAE,YAAY,EAAE,MAAM,mBAAmB,CAAC;AACzE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAInD,OAAO,EAAE,OAAO,EAAE,MAAM,oBAAoB,CAAC;AAE7C,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,YAAY,EACZ,iBAAiB,EACjB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;;;;;;GAMG;AACH,eAAO,MAAM,OAAO,OAAQ,MAAM,SAAS,YAAY,oFACZ,CAAC;AAE5C;;;;GAIG;AACH;;;GAGG;AACH,eAAO,MAAM,kBAAkB,EAAE,aAAa,CAAC,MAAM,YAAY,CAchE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,UAAW,YAAY,KAAG,YAGxD,CAAC;AAEH,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,YAAY,EACZ,QAAQ,CAAC,cAAc,EACvB,iBAAiB,EACjB,QAAQ,CAAC,sBAAsB,EAC/B,WAAW,CAiBZ,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,oBAAoB,yHACkD,CAAC"}