@homeflare/alchemy 0.50.0 → 0.51.0

package/dist/unifi/policy.d.ts

@@ -1,5 +1,7 @@
 import * as Effect from 'effect/Effect';
-export declare const UNIFI_READ_ONLY_POLICY = "read-only by Tim's rule, 2026-09-24; lifting it is a kit change";
+export declare const UNIFI_WRITE_POLICY: string;
+/** @deprecated renamed `UNIFI_WRITE_POLICY`; kept so existing consumer imports do not break. */
+export declare const UNIFI_READ_ONLY_POLICY: string;
 /** What kind of write was asked for and refused — for the message only, never acted on. */
 export type UnifiWriteAction = 'create' | 'update' | 'delete';
 declare const UnifiWriteRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
@@ -16,5 +18,91 @@ export declare class UnifiWriteRefused extends UnifiWriteRefused_base<{
 }
 /** The only thing `reconcile`/`delete` ever return for a write this family cannot make. */
 export declare const refuseWrite: (type: string, identity: string, action: UnifiWriteAction) => Effect.Effect<never, UnifiWriteRefused, never>;
+declare const UnifiLiveDriftedSinceDeploy_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiLiveDriftedSinceDeploy";
+} & Readonly<A>;
+/** Live no longer equals what the last deploy wrote: a hand edit is never overwritten. */
+export declare class UnifiLiveDriftedSinceDeploy extends UnifiLiveDriftedSinceDeploy_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const UnifiUpdateWouldBeNoop_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiUpdateWouldBeNoop";
+} & Readonly<A>;
+/** The merged body equals live: a PUT would change nothing (keeps a re-PUT loop impossible). */
+export declare class UnifiUpdateWouldBeNoop extends UnifiUpdateWouldBeNoop_base<{
+    readonly type: string;
+    readonly identity: string;
+}> {
+    get message(): string;
+}
+declare const UnifiUpdateDidNotConverge_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiUpdateDidNotConverge";
+} & Readonly<A>;
+/** The PUT answered, yet the response still differs from the declaration. */
+export declare class UnifiUpdateDidNotConverge extends UnifiUpdateDidNotConverge_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const UnifiFieldNotRemovable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiFieldNotRemovable";
+} & Readonly<A>;
+/** A patch would remove a key outside the removable allowlist (an omitted block is turned off). */
+export declare class UnifiFieldNotRemovable extends UnifiFieldNotRemovable_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const UnifiFieldNotSettable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiFieldNotSettable";
+} & Readonly<A>;
+/** A patch would SET a key outside the settable allowlist (only `ipv6Configuration` may be written). */
+export declare class UnifiFieldNotSettable extends UnifiFieldNotSettable_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const UnifiManagementNetworkRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiManagementNetworkRefused";
+} & Readonly<A>;
+/** The live object is the site's default (management) network: never written. */
+export declare class UnifiManagementNetworkRefused extends UnifiManagementNetworkRefused_base<{
+    readonly type: string;
+    readonly identity: string;
+}> {
+    get message(): string;
+}
+declare const UnifiImmutableFieldChanged_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiImmutableFieldChanged";
+} & Readonly<A>;
+/** A patch changes a field that decides where the network lives or what serves it. */
+export declare class UnifiImmutableFieldChanged extends UnifiImmutableFieldChanged_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+declare const UnifiIdentityChanged_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiIdentityChanged";
+} & Readonly<A>;
+/** `olds` and `news` name different objects: the prior state is no baseline for this write. */
+export declare class UnifiIdentityChanged extends UnifiIdentityChanged_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly previous: string;
+}> {
+    get message(): string;
+}
 export {};
 //# sourceMappingURL=policy.d.ts.map

package/dist/unifi/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,sBAAsB,oEACgC,CAAC;AAEpE,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAIiC,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}

package/dist/unifi/resource.d.ts

@@ -1,16 +1,17 @@
 import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
-import * as HttpClient from 'effect/http/HttpClient';
+import type * as HttpClient from 'effect/http/HttpClient';
+import { type ReconcileArgs, type UnifiUpdate } from './update-reconcile.ts';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**
  * One UniFi Network object's read. `Live` is whatever the SDK decodes (a `NetworkDetails`, a
  * `FirewallZone`, …); `E` is left to each resource file to declare (its own `fetchLive`'s error
  * union, with `NotFound` already folded away) so the precise per-operation error union flows
- * through instead of being widened by hand here.
+ * through instead of being widened by hand here. `E2` is the error union of the optional write.
  */
-export type UnifiSpec<Props extends object, Live, Attributes extends object, E> = {
+export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never> = {
     /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */
     readonly type: string;
     /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */
@@ -19,8 +20,10 @@ export type UnifiSpec<Props extends object, Live, Attributes extends object, E>
     readonly matches: (attributes: Attributes, props: Props) => boolean;
     /** For the refusal message and read-back failures. */
     readonly describe: (props: Props) => string;
+    /** Present only on a family allowed to write (`Unifi.Network`); see `update-reconcile.ts`. */
+    readonly update?: UnifiUpdate<Props, Live, E2>;
 };
-export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E>(spec: UnifiSpec<Props, Live, Attributes, E>) => {
+export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
     read: (props: Props) => Effect.Effect<Attributes | undefined, E, UnifiNetworkOpContext>;
     readHandler: ({ olds, output }: {
         olds: Props;
@@ -31,51 +34,17 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
     } | {
         readonly action: 'noop';
     } | undefined, E, UnifiNetworkOpContext>;
-    reconcile: (news: Props) => Effect.Effect<Attributes, E | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+    /** Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset. */
+    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
     destroy: (olds: Props) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
 };
 /**
- * B0a / T12 DEFENSE IN DEPTH. `policy.ts`'s `UnifiWriteRefused` stops write INTENT at
- * `reconcile`/`destroy` — every path this engine exposes already returns that refusal instead of
- * calling an SDK write op. This guard stops the same thing one layer lower, AT THE WIRE: it wraps
- * whatever `HttpClient` the caller already provides (the stack's `FetchHttpClient.layer` in
- * production, `fakeUnifiLayer` in tests — `openbao/bao-http.ts`'s header names this same
- * "wrap, don't replace" seam) so a future resource file that, by mistake, called an SDK write
- * operation directly — bypassing `unifiOperations` entirely — would still never reach the vendor
- * API. `write-op-reference.test.ts` proves no such call exists today; this is what stops one from
- * ever taking effect if one is ever added.
- *
- * ⚠️ `Effect.die`, NOT A TYPED FAILURE — classified per distilled-doctrine's "classify every
- *   die/orDie". Every generated SDK operation (`networks.getNetworkDetails`, …) declares its OWN
- *   closed error union from the pinned OpenAPI spec, and generated files are never hand-edited to
- *   add a member to it. A typed `Effect.fail` here would be a failure mode absent from every op's
- *   declared type the moment it occurred — a type-system lie. A defect is the sound way to add a
- *   NEW "this must be structurally impossible" failure underneath types this package does not
- *   own, exactly like `openbao`'s `refuse()` helpers' `Effect.die(new Error(...))` for a
- *   configuration move that should never be reachable.
- */
-export declare class UnifiNonGetRequest extends Error {
-    readonly method: string;
-    /** PATH ONLY, never the full URL — see `requestPath` below. */
-    readonly path: string;
-    constructor(method: string, 
-    /** PATH ONLY, never the full URL — see `requestPath` below. */
-    path: string);
-}
-/**
- * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,
- * for everything downstream, with `guardGetOnly`'s wrapped version (`HttpClient.layerMergedContext`
- * — see the guard above). Exported so `get-only-guard.test.ts` can prove the mechanism directly,
- * against a bare `HttpClient` service, without needing `CredentialsFromEnv` or any env var at all.
- */
-export declare const GetOnlyHttpClient: import("effect/Layer").Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
-/**
- * The four provider handlers for a spec'd read-only UniFi object, wired once.
+ * The four provider handlers for a spec'd UniFi object, wired once.
  *
  * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;
  *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.
  */
-export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E>(spec: UnifiSpec<Props, Live, Attributes, E>) => {
+export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
         olds: Props;
@@ -91,7 +60,12 @@ export declare const unifiHandlers: <Props extends object, Live, Attributes exte
     } | undefined, E, HttpClient.HttpClient>;
     reconcile: (args: {
         news: Props;
-    }) => Effect.Effect<Attributes, E | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
+        olds: Props | undefined;
+        output: Attributes | undefined;
+        session: {
+            note: (message: string) => Effect.Effect<void, never, never>;
+        };
+    }) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
     delete: (args: {
         olds: Props;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAmCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAGrD,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,IAAI;IAChF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;CAC7C,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAChF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;kBAEtB,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;sBAIP,KAAK;oBAYP,KAAK;CAExB,CAAC;AAEF;;;;;;;;;;;;;;;;;;;GAmBG;AACH,qBAAa,kBAAmB,SAAQ,KAAK;IAEzC,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EAStB;CACF;AA0BD;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,mFAE7B,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,QAC9E,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,CAAC;IAMzC,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5GtB,QAAQ;;yBAElC,MAAM;;IA4GzB,SAAS,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;IACjC,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AAG9F,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI;IAC5F,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;kBAE1B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB,4FAA4F;sBAC1E,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAQ1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QAClF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;IAe7C,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5CtB,QAAQ;;yBAElC,MAAM;;IA6CzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAWD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -42,7 +42,12 @@ export declare const handlers: {
     } | undefined, trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: TrafficMatchingListProps;
-    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+        olds: TrafficMatchingListProps | undefined;
+        output: TrafficMatchingListAttributes | undefined;
+        session: {
+            note: (message: string) => Effect.Effect<void, never, never>;
+        };
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: TrafficMatchingListProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/traffic-matching-list.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,gGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,qIAI1C,CAAC"}
+{"version":3,"file":"traffic-matching-list.d.ts","sourceRoot":"","sources":["../../src/unifi/traffic-matching-list.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,oBAAoB,MAAM,uDAAuD,CAAC;AAC9F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAE9B,MAAM,iCAAiC,CAAC;AAEzC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EACV,6BAA6B,EAC7B,wBAAwB,GACzB,MAAM,iCAAiC,CAAC;AACzC,OAAO,EAAE,0BAA0B,EAAE,MAAM,iCAAiC,CAAC;AAC7E,OAAO,EAAE,OAAO,EAAE,MAAM,kCAAkC,CAAC;AAE3D,MAAM,WAAW,wBAAyB,SAAQ,QAAQ,CACxD,2BAA2B,EAC3B,wBAAwB,EACxB,6BAA6B,EAC7B,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,wBAAwB,2DAGpC,CAAC;AAEF;oBACoB;AACpB,eAAO,MAAM,mBAAmB,OAAQ,MAAM,SAAS,wBAAwB,gGACxB,CAAC;AAExD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,wBAAwB,EACxB,oBAAoB,CAAC,mBAAmB,EACxC,6BAA6B,EAC7B,oBAAoB,CAAC,2BAA2B,CAcjD,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,gCAAgC,qIAI1C,CAAC"}

package/dist/unifi/update-reconcile.d.ts

@@ -0,0 +1,31 @@
+import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
+import * as Effect from 'effect/Effect';
+import type { FieldDrift } from './drift.ts';
+import { UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
+import type { UnifiSpec } from './resource.ts';
+import type { AllowedWrite } from './wire-guard.ts';
+export type Patch<Props> = {
+    set: Partial<Props>;
+    unset: ReadonlyArray<keyof Props>;
+};
+/** The write half of a spec: everything needed to PUT one object, and nothing to create/delete. */
+export type UnifiUpdate<Props extends object, Live, E2> = {
+    /** The one PUT the wire guard may pass for this row (path pinned to the row's own ids). */
+    readonly allowedWrite: (props: Props) => AllowedWrite;
+    /** Declarable keys; never the identity keys. */
+    readonly patchKeys: ReadonlyArray<keyof Props>;
+    readonly driftOf: (live: Live, props: Props) => ReadonlyArray<FieldDrift>;
+    /** Refuses (typed, before any note or request) a patch outside this family's write scope. */
+    readonly checkScope: (live: Live, patch: Patch<Props>, props: Props) => Effect.Effect<void, E2>;
+    readonly write: (live: Live, patch: Patch<Props>, props: Props) => Effect.Effect<Live, E2, UnifiNetworkOpContext>;
+};
+/** Keys whose `news` value differs from `olds`: set when still declared, unset when dropped. */
+export declare const computePatch: <Props extends object>(news: Props, olds: Props, patchKeys: ReadonlyArray<keyof Props>) => Patch<Props>;
+export type ReconcileArgs<Props extends object> = {
+    readonly news: Props;
+    readonly olds: Props | undefined;
+    readonly output: unknown;
+    readonly note: (message: string) => Effect.Effect<void>;
+};
+export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+//# sourceMappingURL=update-reconcile.d.ts.map

package/dist/unifi/update-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,gCACjB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -64,7 +64,12 @@ export declare const handlers: {
     } | undefined, UnifiPaginationInconsistent | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: WifiBroadcastProps;
-    }) => Effect.Effect<WifiBroadcastAttributes, UnifiPaginationInconsistent | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+        olds: WifiBroadcastProps | undefined;
+        output: WifiBroadcastAttributes | undefined;
+        session: {
+            note: (message: string) => Effect.Effect<void, never, never>;
+        };
+    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: WifiBroadcastProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/wifi-broadcast.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,0FAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,+HACwD,CAAC"}
+{"version":3,"file":"wifi-broadcast.d.ts","sourceRoot":"","sources":["../../src/unifi/wifi-broadcast.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,cAAc,MAAM,gDAAgD,CAAC;AACjF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EAExB,MAAM,0BAA0B,CAAC;AAElC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,uBAAuB,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC5F,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,OAAO,EAAE,MAAM,2BAA2B,CAAC;AAEpD,MAAM,WAAW,kBAAmB,SAAQ,QAAQ,CAClD,qBAAqB,EACrB,kBAAkB,EAClB,uBAAuB,EACvB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,kBAAkB,qDAE7B,CAAC;AAEH,kGAAkG;AAClG,eAAO,MAAM,aAAa,OAAQ,MAAM,SAAS,kBAAkB,0FAClB,CAAC;AAElD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,kBAAkB,EAClB,cAAc,CAAC,qBAAqB,EACpC,uBAAuB,EACvB,cAAc,CAAC,yBAAyB,GAAG,2BAA2B,CAWvE,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,0BAA0B,+HACwD,CAAC"}

package/dist/unifi/wire-guard.d.ts

@@ -0,0 +1,33 @@
+import * as HttpClient from 'effect/http/HttpClient';
+/**
+ * One non-GET request the guard may let through. `tail` is the exact route below the configured
+ * base URL (`/v1/sites/<site>/networks/<id>`): the guard compares the request's origin and path to
+ * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).
+ */
+export type AllowedWrite = {
+    readonly method: 'PUT';
+    readonly tail: string;
+};
+export declare class UnifiRefusedRequest extends Error {
+    readonly method: string;
+    /** PATH ONLY, never the full URL — see `requestPath` below. */
+    readonly path: string;
+    constructor(method: string, 
+    /** PATH ONLY, never the full URL — see `requestPath` below. */
+    path: string, detail?: string);
+}
+/** @deprecated renamed `UnifiRefusedRequest`; kept so existing consumer imports do not break. */
+export declare const UnifiNonGetRequest: typeof UnifiRefusedRequest;
+export type UnifiNonGetRequest = UnifiRefusedRequest;
+/**
+ * A `Layer` that reads whatever `HttpClient` is already in the calling context and replaces it,
+ * for everything downstream, with the guarded version. Exported so `wire-guard.test.ts` can prove
+ * the mechanism against a bare `HttpClient`, without `CredentialsFromEnv` or any env var.
+ */
+export declare const guardedHttpClient: (allow: ReadonlyArray<AllowedWrite>, baseUrl?: string) => import("effect/Layer").Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
+/**
+ * No write may pass; the posture of `read`/`diff`/`delete` and of every non-updatable family. A 3xx
+ * answer to a GET is refused here exactly as under the allow-list posture — see REDIRECTS above.
+ */
+export declare const GetOnlyHttpClient: import("effect/Layer").Layer<HttpClient.HttpClient, never, HttpClient.HttpClient>;
+//# sourceMappingURL=wire-guard.d.ts.map

package/dist/unifi/wire-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}

package/docs/unifi-network-write.md

@@ -0,0 +1,90 @@
+# `Unifi.Network` write scope — what the one PUT may and may not do
+
+`docs/unifi.md` describes the three-way update. This page records the limits placed on it after
+the red team rounds 1 and 2 of PR 377. The only intended consumer is ONE VLAN's
+`ipv6Configuration`: a patch may SET only `ipv6Configuration` and REMOVE only `ipv6Configuration`;
+everything else a whole-object `PUT` could reach is refused with a typed error that carries field
+names only, never values.
+
+| refusal                         | when                                                                        |
+| ------------------------------- | --------------------------------------------------------------------------- |
+| `UnifiFieldNotSettable`         | a patch sets any key but `ipv6Configuration` (`enabled`, `dhcpGuarding`, …) |
+| `UnifiFieldNotRemovable`        | a patch drops any key but `ipv6Configuration`                               |
+| `UnifiManagementNetworkRefused` | the live object has `default: true` (the management LAN)                    |
+| `UnifiImmutableFieldChanged`    | a patch sets or drops `zoneId`, `vlanId`, `management`, `deviceId`          |
+| `UnifiIdentityChanged`          | `olds` names another `siteId`/`networkId` than `news`                       |
+| `UnifiUpdateWouldBeNoop`        | the merged body equals live                                                 |
+
+Every one of them fires after the live GET and before any PUT.
+
+⛔ **Why a removable allowlist.** A key in `patch.unset` is deleted from the PUT body, and the
+controller reads an omitted `dhcpGuarding`/`ipv4Configuration`/`ipv6Configuration` as "off". So
+leaving a field out of a declaration would turn it off on the console. Only `ipv6Configuration`
+(the block this path exists for, and the revert target) may be removed. `network-scope.ts` holds
+the lists (`SETTABLE_KEYS`, `REMOVABLE_KEYS`, `IMMUTABLE_KEYS`); widening them is a kit change.
+
+⚠️ **No version check: a hand edit between the read and the write is overwritten.** The PUT is the
+live GET plus the patch, sent whole; the API offers no ETag or revision, so a change made on the
+console between that GET and the PUT is replaced by the GET's copy. The window is one reconcile.
+
+Non-USER `metadata.origin` is deliberately not handled: there is no rule for it yet.
+
+## The wire guard (`wire-guard.ts`)
+
+⛔ **The allowed PUT is anchored to the configured base URL**, not matched by suffix. The request
+must share the base's origin, its path must be exactly `<base path>/v1/sites/<site>/networks/<id>`,
+and it must carry no query string or fragment. `?force=true`, a nested
+`/v1/sites/OTHER/v1/sites/s/networks/n`, a different base path and `//v1/...` all die before the
+transport. `unifiHandlers` reads the base URL from the same `Credentials` the SDK uses; with none
+the guard allows nothing.
+
+⛔ **`redirect: 'manual'` is set per request, on the calling fiber's `RequestInit`, for EVERY
+guarded request — GETs included — and any 3xx answer dies with `UnifiRefusedRequest`, whatever the
+method.** Effect 4.0.1 `layerMergedContext` lets an outer `FetchHttpClient.RequestInit` REPLACE one
+the layer provides, so a layer-provided `redirect: 'manual'` is silently lost under any consumer
+that sets its own `RequestInit`. The guard reads the fiber's value and merges `redirect: 'manual'`
+over it, the `openbao/bao-http.ts` `overSocket` pattern. `wire-guard-anchor.test.ts` proves it
+against a real `Bun.serve` answering 301/302/303/307/308.
+
+A GET's redirect is refused for the same reason a PUT's is, under both postures: fetch would
+follow it and re-send the request — still carrying the API-key header — to a URL the guard never
+vetted. Before the 2026-10-10 fix only reconcile's GETs ran `manual` (a 3xx surfaced raw and failed
+the SDK decode) while `read`/`diff` followed it silently; one rule everywhere now, fail closed.
+
+⛔ **Where a TLS `RequestInit` must live: on the CALLING FIBER**, provided around the program with
+`Effect.provideService(FetchHttpClient.RequestInit, { tls: … })`, not inside the fetch layer's
+build context (`FetchHttpClient.layer.pipe(Layer.provide(…))`). The guard re-provides `RequestInit` per
+request, merged over the fiber's value, so an option set only inside the layer is overridden on every
+guarded request, GETs included, and a consumer wired that way silently loses its TLS option (it
+fails closed: the handshake is refused, nothing is sent insecurely).
+
+⛔ **Backstop: the response URL must equal the request URL.** If a consumer's own transform provides
+`RequestInit` WITHOUT merging, `manual` is lost and fetch follows a redirect. The guard dies when
+`res.url` differs from `HttpClientRequest.toUrl(res.request)`. The allowed-path check likewise reads
+`toUrl`, so a `setUrlParam` query is seen and refused. Tests: `wire-guard-round2.test.ts`.
+
+⛔ **Refusal messages redact the cloud connector Console ID**: the path segment after `/consoles/`
+becomes `<redacted>`.
+
+## The static check (`write-op-reference.test.ts`)
+
+It harvests the SDK's real write-op export names straight from its own service modules (every
+name starting `create`/`update`/`delete`/`patch`/`execute`/`remove`/`adopt`) and fails any file
+that mentions the SDK's package specifier and contains one of those names as a token anywhere — an
+identifier, a bracket key, a destructured binding, a re-export or a dynamic-import property access
+all read the same way, so one scan catches every syntax form without parsing which one it is. Its
+`WRITE_OP_ALLOWLIST` is exactly `network-update.ts` → `updateNetwork`; any other file naming that
+op, or that file naming `createNetwork`/`deleteNetwork`, is an offense.
+
+## The PUT is attempted once
+
+`updateNetwork` runs under `Retry.none`. The SDK's default policy would replay a write whose first
+attempt may already have landed; a replay then runs against a controller state this reconcile never
+read. A failure surfaces for the operator instead. Reads keep the default policy.
+
+## After a PUT that landed
+
+`UnifiUpdateDidNotConverge` means the PUT LANDED and live now differs from the declaration. It is
+not rolled back. The next deploy sees drift and answers `UnifiLiveDriftedSinceDeploy`, whose
+message names both causes (a hand edit, or an earlier non-converging PUT). Recovery in both cases
+is a re-import of the live object.

package/docs/unifi.md

@@ -1,10 +1,9 @@
 # UniFi Network — `@homeflare/alchemy/unifi`
 
-⛔ **READ-ONLY, BY TIM'S RULE (2026-09-24).** `Unifi.Network` and `Unifi.FirewallZone` read and
-adopt; neither has a create, an update body or a working delete. `reconcile`/`delete` both fail
-with a typed `UnifiWriteRefused` naming the policy rather than calling any SDK write operation.
-Lifting the rule is a kit change — a PR that adds a write path, reviewed as one — not a flag a
-stack can pass. See `packages/alchemy/src/unifi/policy.ts`.
+⛔ **ADOPT-ONLY, EXCEPT ONE WRITE (Tim 2026-09-24, lifted for one case 2026-10-10).** Every UniFi
+family reads and adopts; `Unifi.Network` alone may UPDATE (a three-way whole-object PUT, below).
+Create and delete, and every other family's update, fail with a typed `UnifiWriteRefused`. Widening
+the rule is a kit change, not a flag a stack can pass. See `packages/alchemy/src/unifi/policy.ts`.
 
 This page covers `Unifi.Network`/`Unifi.FirewallZone` only. Every other read-only family has its
 own doc, per family (`docs/unifi.md` would breach the 200-line cap otherwise): [`Unifi.DnsPolicy`](./unifi-dns-policy.md), [`Unifi.AclRule`/`Unifi.AclRuleOrdering`](./unifi-acl-rule.md),
@@ -59,7 +58,7 @@ credential, untouched by this family. Only reads were probed, by hand, outside t
 test suite — nothing in this PR's code exercises the vendor API live, and a write path would still
 need its own verification.
 
-## Adopt is the default posture, and it never writes
+## Adopt is the default posture, and the one write is a three-way Network update
 
 `adopt(true)` is piped onto every resource by its convenience constructor (`network(...)`,
 `firewallZone(...)`) — H5. A cold read of a live match answers `Unowned(attrs)` (H1, the
@@ -68,36 +67,36 @@ objects carry no tag or metadata field this stack could stamp), and `adopt(true)
 a silent bind instead of an `OwnedBySomeoneElse` refusal — the deploy never needs `--adopt`.
 
 ⚠️ **A forced post-adoption reconcile still runs once (H6), and it still makes no write.**
-Beta.79 forces one `reconcile` call after every cold adoption whether or not `diff` said noop.
+Beta.81 forces one `reconcile` call after every cold adoption whether or not `diff` said noop.
 `resource.ts`'s `reconcile` handles this the same way `discord/resource.ts` does: it reads the
-live object again and only refuses when it is missing (would need a create) or drifted (would
-need a write); an exact match returns the live attributes and calls nothing.
+live object again; an exact match returns the live attributes and calls nothing, a missing object
+refuses `create`, and drift refuses `update` unless the row has prior state (`olds` AND `output`)
+and a `Unifi.Network` spec: then `update-reconcile.ts` refuses if live differs from `olds` (a hand
+edit), else PUTs live-plus-the-`news≠olds`-patch (`network-update.ts`; a dropped key is removed).
+
+The limits on that PUT (removable allowlist, management LAN, immutable fields, anchored path,
+no retry) are in [`unifi-network-write.md`](./unifi-network-write.md).
 
 ## `list` answers `[]`
 
 `GET /v1/sites/{siteId}/networks` answers every network on the site. Adoption stays explicit —
 the same reasoning `Proxmox.User`'s and NetBox's own `list` give.
 
-## Defense in depth: GET-only at the wire (2026-09-26)
-
-`policy.ts`'s `UnifiWriteRefused` stops write INTENT at `reconcile`/`delete` — this family calls
-no SDK write op anywhere today. `GetOnlyHttpClient` (`resource.ts`, barrel-exported so
-`homeflare-network`'s own import-layer guard can reuse it instead of re-implementing the same
-wrap), installed in `unifiHandlers`'s `withCredentials`, stops the same thing one layer lower, AT
-THE WIRE: it wraps whatever `HttpClient` the caller provides so ANY non-`GET` method dies with
-`UnifiNonGetRequest` (its message carries the request PATH only, never the host — a cloud
-connector's base URL embeds the account's Console ID) before the request reaches the transport —
-a backstop for a future resource file that, by mistake, called an SDK write operation directly.
-`write-op-reference.test.ts` is the matching static check: it harvests the SDK's real write-op
-export names straight from its own service modules (every name starting
-`create`/`update`/`delete`/`patch`/`execute`/`remove`/`adopt`) and fails any file that mentions
-the SDK's package specifier and contains one of those names as a token anywhere — an identifier, a
-bracket key, a destructured binding, a re-export or a dynamic-import property access all read the
-same way, so one scan catches every syntax form without parsing which one it is.
-`get-only-guard.test.ts` proves the wire guard's mechanism directly against a fake `HttpClient`,
-AND that `unifiHandlers` actually installs it (a handler-level probe, not just the mechanism in
-isolation — `network.test.ts`/`firewall-zone.test.ts` call the lower-level `unifiOperations(spec)`
-directly and never exercise `withCredentials` at all).
+## Defense in depth: GET-only at the wire, one per-row exception (2026-09-26, 2026-10-10)
+
+`policy.ts`'s `UnifiWriteRefused` stops write INTENT at `reconcile`/`delete`. `wire-guard.ts`'s
+`guardedHttpClient(allow)` (`GetOnlyHttpClient` = empty list; barrel-exported so `homeflare-network`'s
+import-layer guard can reuse it), installed in `unifiHandlers`, stops it one layer lower, AT THE
+WIRE: any non-`GET` dies with `UnifiRefusedRequest` (alias `UnifiNonGetRequest`; PATH only, never
+the host — a cloud base URL embeds the Console ID) unless `(method, path)` matches the row's own
+allow entry, `PUT /v1/sites/<siteId>/networks/<networkId>`, supplied only to `reconcile` and only
+by a spec with `update`. The guard also sets fetch `redirect: 'manual'` on every request, GETs
+included, and dies on any 3xx answer (fetch would re-send the request — a PUT with its body, a GET
+with the API key — to a URL the guard never saw).
+`wire-guard.test.ts` proves the guard directly against a fake `HttpClient`, AND that
+`unifiHandlers` installs it (the family tests call `unifiOperations(spec)` and never exercise
+`withCredentials`). The static check `write-op-reference.test.ts` is described in
+[`unifi-network-write.md`](./unifi-network-write.md).
 
 ## Pagination helper
 
@@ -144,8 +143,7 @@ UniFi Network Integration API **10.4.57** (OpenAPI 3.1.0, 44 paths), via
 (`docs/distilled-interim.md`). Traps in the underlying API that this read-only family cannot
 trigger but a future write path must respect — whole-object `PUT`, ordering endpoints that
 replace the whole list, `removeDevice` unadopting and factory-resetting hardware — are recorded
-in the distilled package's own `README.md` and in the estate's `docs/unifi-api-notes.md`
-(outside this repo).
+in the distilled package's own `README.md` (`packages/distilled-unifi-network`).
 
 ## Spec-version check against the live-measured console (2026-09-24)
 
@@ -192,8 +190,10 @@ attributed, declared or compared. Both declaration renderers and both `matches`
 `value == null` / `deepEqual(..., { stripNullish: true })` consistently, per `network-form.ts`'s
 own header. No departure found — nothing in this family needed changing.
 
-⚠️ **Correction (2026-09-26):** the line above is no longer true as written. `resource.ts` now
-has exactly one `Effect.die` — `GetOnlyHttpClient`'s guard (see "Defense in depth" above) —
-classified in its own comment per distilled-doctrine's "classify every die/orDie": it raises a
-NEW defect for a failure mode outside every generated SDK operation's declared error union, never
-converts an existing typed failure the way `orDie` would. Still no `Effect.orDie` anywhere.
+⚠️ **Correction (2026-09-26, recounted 2026-10-10):** the line above is no longer true as written.
+The family has exactly TWO `Effect.die` call sites, both in `wire-guard.ts`'s guard (see "Defense
+in depth" above): the request-side refusal of a non-GET off the row's allow list, and the
+response-side refusal of a 3xx answer. Each raises a NEW defect for a failure mode outside every
+generated SDK operation's declared error union, per distilled-doctrine's "classify every
+die/orDie" — neither converts an existing typed failure the way `orDie` would. Still no
+`Effect.orDie` anywhere.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.50.0",
+  "version": "0.51.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/unifi/fake-unifi.ts

@@ -17,7 +17,14 @@ import * as FetchHttpClient from 'effect/http/FetchHttpClient';
 export const FAKE_BASE = 'https://unifi.example.com/proxy/network/integration';
 export const FAKE_KEY = 'placeholder-unifi-key';
 
-export type Seen = { readonly method: string; readonly path: string };
+export type Seen = {
+  readonly method: string;
+  readonly path: string;
+  /** Parsed JSON request body, when one was sent. */
+  readonly body?: unknown;
+  /** The `redirect` mode fetch was handed (`FetchHttpClient.RequestInit`), when set. */
+  readonly redirect?: NonNullable<RequestInit['redirect']>;
+};
 
 /**
  * Plain-text failure. `protocol.ts`'s `errorEnvelope` also decodes a documented JSON shape
@@ -42,7 +49,13 @@ export const fakeUnifi = (route: (method: string, url: URL) => Response) => {
     const request =
       input instanceof Request ? new Request(input, init) : new Request(String(input), init);
     const url = new URL(request.url);
-    seen.push({ method: request.method, path: `${url.pathname}${url.search}` });
+    const text = request.method === 'GET' ? '' : await request.clone().text();
+    seen.push({
+      method: request.method,
+      path: `${url.pathname}${url.search}`,
+      ...(text === '' ? {} : { body: JSON.parse(text) as unknown }),
+      ...(init?.redirect === undefined ? {} : { redirect: init.redirect }),
+    });
     return route(request.method, url);
   }) as typeof globalThis.fetch;
   return { fetch, seen };