@homeflare/alchemy 0.55.0 → 0.57.0

package/dist/unifi/network.d.ts

@@ -80,7 +80,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: NetworkProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/policy.d.ts

@@ -1,5 +1,13 @@
 import * as Effect from 'effect/Effect';
 export declare const UNIFI_WRITE_POLICY: string;
+/**
+ * ⛔ THE ONE GATE THAT DECIDES "hf:" (Tim 2026-10-19, `nas-firewall`'s own naming:
+ *   `hf: CT100 to NAS https`). The space after the colon is deliberate and checked: `"hf:foo"`
+ *   (no space) is NOT an hf: name under this policy, so a typo can never silently slip past the
+ *   create gate by omitting it. Exported so `firewall-policy-create.ts`'s `checkScope` and every
+ *   test that proves the boundary use this ONE function, never a second regex hand-copied nearby.
+ */
+export declare const isHfPolicyName: (name: string) => boolean;
 /** @deprecated renamed `UNIFI_WRITE_POLICY`; kept so existing consumer imports do not break. */
 export declare const UNIFI_READ_ONLY_POLICY: string;
 /** What kind of write was asked for and refused — for the message only, never acted on. */
@@ -50,6 +58,20 @@ export declare class UnifiUpdateDidNotConverge extends UnifiUpdateDidNotConverge
 }> {
     get message(): string;
 }
+declare const UnifiCreateDidNotConverge_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiCreateDidNotConverge";
+} & Readonly<A>;
+/** The POST answered, a read-back ran, yet the read-back object still differs from the
+ *  declaration — the hf: create path's own convergence check (`create-reconcile.ts`'s sibling in
+ *  `update-reconcile.ts`), same shape as `UnifiUpdateDidNotConverge` for the same reason: the
+ *  object now exists on the console, unrolled-back, so the operator needs to know and re-import. */
+export declare class UnifiCreateDidNotConverge extends UnifiCreateDidNotConverge_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
 declare const UnifiFieldNotRemovable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "UnifiFieldNotRemovable";
 } & Readonly<A>;

package/dist/unifi/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAIiC,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAOmC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,OAAkC,CAAC;AAEjF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;oGAGoG;AACpG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}

package/dist/unifi/resource.d.ts

@@ -2,7 +2,7 @@ import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/http/HttpClient';
-import { type ReconcileArgs, type UnifiUpdate } from './update-reconcile.ts';
+import { type ReconcileArgs, type UnifiCreate, type UnifiUpdate } from './update-reconcile.ts';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**
@@ -11,7 +11,7 @@ export type UnifiRequirements = HttpClient.HttpClient;
  * union, with `NotFound` already folded away) so the precise per-operation error union flows
  * through instead of being widened by hand here. `E2` is the error union of the optional write.
  */
-export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never> = {
+export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never, E3 = never> = {
     /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */
     readonly type: string;
     /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */
@@ -22,8 +22,11 @@ export type UnifiSpec<Props extends object, Live, Attributes extends object, E,
     readonly describe: (props: Props) => string;
     /** Present only on a family allowed to write (`Unifi.Network`); see `update-reconcile.ts`. */
     readonly update?: UnifiUpdate<Props, Live, E2>;
+    /** Present only on a family allowed to create (`Unifi.FirewallPolicy`, `hf:` rows only); see
+     *  `update-reconcile.ts`'s `createReconcile`. */
+    readonly create?: UnifiCreate<Props, Live, E3>;
 };
-export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     read: (props: Props) => Effect.Effect<Attributes | undefined, E, UnifiNetworkOpContext>;
     readHandler: ({ olds, output }: {
         olds: Props;
@@ -34,8 +37,24 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
     } | {
         readonly action: 'noop';
     } | undefined, E, UnifiNetworkOpContext>;
-    /** Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset. */
-    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+    /**
+     * Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset — the
+     * SAME calling convention a plain cold adoption already uses (H6), so the existence GET must
+     * run FIRST, for every name, exactly as it always has: a row that already exists is adopted
+     * (exact match, zero writes) regardless of its name, and ONLY an absent row ever reaches
+     * `create.checkScope`. "A non-hf: create sends nothing" therefore means no WRITE (no
+     * POST/PUT/DELETE) — the same guarantee every other refusal in this engine gives, and the one
+     * `wire-guard.ts`'s allow list enforces at the wire; the existence GET is not a write.
+     *
+     * ⛔ THE CREATE BRANCH ONLY RUNS WHEN THERE IS NO PRIOR STATE AT ALL (`olds`/`output` both
+     *   absent — a genuine first deploy, never a re-declare of an adopted row) AND the family
+     *   declares `create` AND the live read comes back absent. A row that already exists (someone
+     *   else's object with a colliding identity, or a retried deploy that already created it)
+     *   takes the ordinary `updateReconcile` path instead — exact match reports with zero writes,
+     *   anything else refuses (there is no `olds` to PUT a patch against, so it can never silently
+     *   fall through to an update of an existing row).
+     */
+    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
     destroy: (olds: Props) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
 };
 /**
@@ -44,7 +63,7 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
  * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;
  *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.
  */
-export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
         olds: Props;
@@ -65,7 +84,7 @@ export declare const unifiHandlers: <Props extends object, Live, Attributes exte
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
+    }) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
     delete: (args: {
         olds: Props;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AAG9F,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI;IAC5F,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;kBAE1B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB,4FAA4F;sBAC1E,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAQ1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QAClF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;IAe7C,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5CtB,QAAQ;;yBAElC,MAAM;;IA6CzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAWD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAG/B,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CACnB,KAAK,SAAS,MAAM,EACpB,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,EACD,EAAE,GAAG,KAAK,EACV,EAAE,GAAG,KAAK,IACR;IACF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C;qDACiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;kBAE9B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB;;;;;;;;;;;;;;;;OAgBG;sBACe,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAc1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACtF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;IAejD,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAlEtB,QAAQ;;yBAElC,MAAM;;IAmEzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAqBD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -47,7 +47,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: TrafficMatchingListProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/update-reconcile.d.ts

@@ -1,7 +1,7 @@
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type { FieldDrift } from './drift.ts';
-import { UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
+import { UnifiCreateDidNotConverge, UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
 import type { UnifiSpec } from './resource.ts';
 import type { AllowedWrite } from './wire-guard.ts';
 export type Patch<Props> = {
@@ -27,5 +27,39 @@ export type ReconcileArgs<Props extends object> = {
     readonly output: unknown;
     readonly note: (message: string) => Effect.Effect<void>;
 };
-export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+/**
+ * The write half of a CREATE-capable family: today, only `Unifi.FirewallPolicy`, and only for an
+ * `hf:`-named row (`policy.ts`'s `isHfPolicyName`). Deliberately NOT a merge-with-live update —
+ * there is no live object yet — so there is no `patchKeys`/`checkScope(live, patch, …)` here: a
+ * create sends exactly the fields the declaration owns, nothing echoed from elsewhere, nothing to
+ * accidentally reset.
+ *
+ * ⛔ `checkScope` RUNS BEFORE THE POST (same ordering `update.checkScope` already has): a
+ *   non-`hf:` name is refused here, typed, never reaching the wire at all.
+ * ★ `identify` CLOSES THE LOOP FROM THE POST'S RESPONSE TO A FRESH GET. The vendor assigns the id
+ *   on create; `write`'s response carries it, but a response body is not proof the object is
+ *   actually readable back (`createReconcile` re-fetches with the id `identify` folds in, rather
+ *   than trusting the POST's own echo — same reasoning `network-update.ts`'s header gives for
+ *   never trusting a write's own response over a real read).
+ */
+export type UnifiCreate<Props extends object, Live, E3> = {
+    /** The one POST the wire guard may pass for this family (the site's fixed collection route,
+     *  built from `props` the same way `UnifiUpdate.allowedWrite` reads a row's ids from `props`). */
+    readonly allowedWrite: (props: Props) => AllowedWrite;
+    /** Refuses (typed, before any note or request) a create outside this family's write scope. */
+    readonly checkScope: (props: Props) => Effect.Effect<void, E3>;
+    readonly write: (props: Props) => Effect.Effect<Live, E3, UnifiNetworkOpContext>;
+    /** `props` plus the vendor id the POST's response assigned, for the read-back `fetchLive`. */
+    readonly identify: (props: Props, written: Live) => Props;
+    readonly driftOf: (live: Live, props: Props) => ReadonlyArray<FieldDrift>;
+};
+/**
+ * CREATE for a family whose live read came back absent AND which has no prior Alchemy state
+ * (`resource.ts`'s `unifiOperations.reconcile` is the only caller, and only under that same
+ * condition — see its own header). Refuses (untyped-to-typed, same `refuseWrite` every other
+ * refusal uses) when the family declares no `create` at all; `create.checkScope` then refuses
+ * again, more specifically, for a declared row the create scope itself does not allow.
+ */
+export declare const createReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, news: Props, note: (message: string) => Effect.Effect<void, never, never>) => Effect.Effect<Attributes, E | E3 | UnifiCreateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
 //# sourceMappingURL=update-reconcile.d.ts.map

package/dist/unifi/update-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,gCACjB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC"}
+{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,gCACrB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD;sGACkG;IAClG,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACjF,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;CAC3E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAC7C,KAAK,QACL,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,mIA8B1D,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -69,7 +69,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: WifiBroadcastProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/wire-guard.d.ts

@@ -5,7 +5,7 @@ import * as HttpClient from 'effect/http/HttpClient';
  * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).
  */
 export type AllowedWrite = {
-    readonly method: 'PUT';
+    readonly method: 'PUT' | 'POST';
     readonly tail: string;
 };
 export declare class UnifiRefusedRequest extends Error {

package/dist/unifi/wire-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}
+{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}

package/docs/distilled-interim.md

@@ -122,8 +122,10 @@ Two checks, both real, neither skippable:
 No special-casing: add a changeset (`bun changeset`, minor — new package),
 push, merge. `scripts/publish.ts` packs with `bun pm pack` (resolves
 `workspace:`/`catalog:` the way `npm pack` cannot) and publishes with `npm
-publish --provenance` from CI. `README.md`/`LICENSE`/`scripts/smoke.ts` ship
-in `files`; nothing about the release pipeline needs to know this package is
+publish --provenance` from CI. `README.md`/`LICENSE` ship in `files`;
+`scripts/smoke.ts` is outside `files` so it never packs — `scripts/pack.ts`
+additionally strips the `scripts`/`devDependencies` manifest fields at pack
+time. Nothing about the release pipeline needs to know this package is
 an interim stand-in.
 
 ### 5. Alias it in, then cut over later

package/docs/linux-sudo-review-2026-09-23.md

@@ -0,0 +1,27 @@
+# The 2026-09-23 adversarial review of the linux sudo runner
+
+Extracted from [linux-sudo.md](./linux-sudo.md) to keep that doc under the 200-line
+cap. The findings it records are live rules of the runner, not history.
+
+🔴 **Adversarial review, 2026-09-23, two rounds — everything found is fixed
+and tested.** Round 1: a directory this runner elevates was checked for
+SHAPE only, never mode or owner. `mkdir -m 0777` and `chown <non-root uid>`
+both passed untouched, so a stack could declare `HostDirectory({ path:
+'/etc/systemd/system/x.service.d', mode: 0o777 })`, drop an `ExecStart=`
+override into it, and this runner's own next `daemon-reload` + `restart`
+would run it as root. Fixed: a directory this runner elevates is now always
+root-owned and never setuid/setgid or group/other-writable, unconditionally
+— a directory's OWNER always has write access through the owner bits alone,
+so no mode restriction alone could make a non-root-owned directory safe
+here. The same round tightened the shared `modeProblem` check
+(`../launchd/sudo-guard.ts`, used by both platforms): it exempted a file
+merely because its `uid` was non-root, missing that `{uid: 501, gid: 0,
+mode: 0o2775}` — setgid to root's own group — reaches the same escalation
+through the group instead. Round 2 found the round-1 `modeProblem` fix was
+itself incomplete (an OMITTED `gid`, not just an explicit `0`, defaults to
+root's own group under `install` — see the section above), the masked-unit
+and FragmentPath-scope gaps documented above, `install`'s own numeric-id
+ambiguity (also above), and a swallowed cleanup-`rm` failure (now included
+in the thrown error, with the leftover path named). All covered by tests:
+`sudo-allowlist.test.ts`, `sudo-lifecycle.test.ts`, `sudo-runner.test.ts`,
+`../launchd/sudo-modes.test.ts`.

package/docs/linux-sudo.md

@@ -60,18 +60,19 @@ staging directory is removed either way.
 
 Each is `/usr/bin/sudo -n -- <argv>`, every program by absolute path.
 
-| when                                 | argv                                                                                |
-| ------------------------------------ | ----------------------------------------------------------------------------------- |
-| a file under a prefix — stage→temp   | `/usr/bin/install -m <0644> -T -- <staged> <temp>`                                  |
-| its owner, if not root:root          | `/usr/bin/chown +<uid>[:+<gid>] -- <temp>` — numeric, `+`-forced, bound to `<temp>` |
-| a file under a prefix — temp→dest    | `/usr/bin/mv -f -T -- <temp> <dest>`                                                |
-| a file under a prefix is removed     | `/usr/bin/rm -f -- <path>`                                                          |
-| a directory under a prefix is made   | `/usr/bin/mkdir -m <octal> -- <path>` — never setuid/setgid or group/other-write    |
-| its mode is fixed                    | `/usr/bin/chmod <octal> -- <path>` — same restriction                               |
-| its owner is fixed                   | `/usr/bin/chown <owner> -- <path>` — **root only**: `+0`, `:+0` or `+0:+0`          |
-| it is removed                        | `/usr/bin/rmdir -- <path>`                                                          |
-| after any unit-file write/removal    | `/usr/bin/systemctl daemon-reload`                                                  |
-| a unit is enabled/disabled/started/… | `/usr/bin/systemctl <verb> -- <unit>`                                               |
+| when                                 | argv                                                                                          |
+| ------------------------------------ | --------------------------------------------------------------------------------------------- |
+| a file under a prefix — stage→temp   | `/usr/bin/install -m <0644> -T -- <staged> <temp>`                                            |
+| its owner, if not root:root          | `/usr/bin/chown +<uid>[:+<gid>] -- <temp>` — numeric, `+`-forced, bound to `<temp>`           |
+| a file under a prefix — temp→dest    | `/usr/bin/mv -f -T -- <temp> <dest>`                                                          |
+| a file under a prefix is removed     | `/usr/bin/rm -f -- <path>`                                                                    |
+| a directory under a prefix is made   | `/usr/bin/mkdir -m <octal> -- <path>` — never setuid/setgid or group/other-write              |
+| its mode is fixed                    | `/usr/bin/chmod <octal> -- <path>` — same restriction                                         |
+| its owner is fixed                   | `/usr/bin/chown <owner> -- <path>` — **root only**: `+0`, `:+0` or `+0:+0`                    |
+| it is removed                        | `/usr/bin/rmdir -- <path>`                                                                    |
+| after any unit-file write/removal    | `/usr/bin/systemctl daemon-reload`                                                            |
+| a unit is enabled/disabled/started/… | `/usr/bin/systemctl <verb> -- <unit>`                                                         |
+| a `privilegedReads` file is read     | `/usr/bin/base64 -- <path>` — exact listed path, root-owned regular file, or the read refuses |
 
 `enable`/`disable`/`start`/`stop`/`restart` elevate only when the unit is not
 **masked** (`LoadState`, read alongside `FragmentPath` in the same call —
@@ -103,7 +104,7 @@ know that syntax exists.
 
 ## What stays as the operator
 
-- Every read: `stat`, `readFile`, user/group lookups, `systemctl show`.
+- Every read: `stat`, `readFile`, user/group lookups, `systemctl show` — with one exact exception: a file on the runner's `privilegedReads` list is read with `sudo -n base64` (the plan-diff read a declared root-owned file needs; see the table above). Every other path, and every `checkWrite` host probe (`id -G`, `ls`, `stat`), stays the operator's own.
 - `checkWrite` — the plan-time half of a write, run at every plan so a
   refusal surfaces before any resource is applied, never at the write.
 - Files and directories outside every prefix (a foreign owner there is a
@@ -111,10 +112,11 @@ know that syntax exists.
 - `ls -ldn` and `mktemp -d` — the guard's chain read and the write's own
   staging, both unprivileged (`src/linux/sudo-listing.ts`, `sudo-stage.ts`).
 
-★ **So a plan never calls sudo**, and construction never does either:
-`sshSudoRunner()` runs one combined, read-only `test -x` for the nine
-absolute programs above, so a missing coreutils package or a systemd-free
-container fails with a clear message at construction — never a sudo probe.
+★ **So a plan calls sudo for exactly one thing** — reading a `privilegedReads`
+file — and construction never does: `sshSudoRunner()` runs one combined,
+read-only `test -x` for the nine absolute programs above, so a missing
+coreutils package or a systemd-free container fails with a clear message at
+construction — never a sudo probe.
 
 ## The host guard
 
@@ -144,31 +146,17 @@ prefix-sibling (`/usr/local/bin-x` is not under `/usr/local/bin`), or a
 `chown` by name, a bare digit, or any non-root id; `systemctl mask`/`--user`;
 a masked unit, any verb; `enable`/`start`/`restart` on a unit with no unit
 file; a root-owned file that would be group- or world-writable, setuid or
-setgid; a file the operator could not read back (both `Systemd.Unit` and
-`Remote.File` read every write back to compare digests).
+setgid; a file NOT on the `privilegedReads` list that the operator could not
+read back (both `Systemd.Unit` and `Remote.File` read every write back to
+compare digests); a listed file handed to a non-root uid, whatever its mode
+— the elevated read-back refuses anything but a root-owned regular file, so
+the handoff would land and then fail every read.
 
 🔴 **Adversarial review, 2026-09-23, two rounds — everything found is fixed
-and tested.** Round 1: a directory this runner elevates was checked for
-SHAPE only, never mode or owner. `mkdir -m 0777` and `chown <non-root uid>`
-both passed untouched, so a stack could declare `HostDirectory({ path:
-'/etc/systemd/system/x.service.d', mode: 0o777 })`, drop an `ExecStart=`
-override into it, and this runner's own next `daemon-reload` + `restart`
-would run it as root. Fixed: a directory this runner elevates is now always
-root-owned and never setuid/setgid or group/other-writable, unconditionally
-— a directory's OWNER always has write access through the owner bits alone,
-so no mode restriction alone could make a non-root-owned directory safe
-here. The same round tightened the shared `modeProblem` check
-(`../launchd/sudo-guard.ts`, used by both platforms): it exempted a file
-merely because its `uid` was non-root, missing that `{uid: 501, gid: 0,
-mode: 0o2775}` — setgid to root's own group — reaches the same escalation
-through the group instead. Round 2 found the round-1 `modeProblem` fix was
-itself incomplete (an OMITTED `gid`, not just an explicit `0`, defaults to
-root's own group under `install` — see the section above), the masked-unit
-and FragmentPath-scope gaps documented above, `install`'s own numeric-id
-ambiguity (also above), and a swallowed cleanup-`rm` failure (now included
-in the thrown error, with the leftover path named). All covered by tests:
-`sudo-allowlist.test.ts`, `sudo-lifecycle.test.ts`, `sudo-runner.test.ts`,
-`../launchd/sudo-modes.test.ts`.
+and tested** — the full record (the directory shape-only gap, the shared `modeProblem`
+escapes, the omitted-`gid` default, the masked-unit and `FragmentPath` scope gaps,
+`install`'s numeric-id ambiguity, the swallowed cleanup failure) lives in
+[linux-sudo-review-2026-09-23.md](./linux-sudo-review-2026-09-23.md).
 
 Every refusal throws `SudoRefusedError`: nothing ran as root. A privileged
 command that ran and failed throws a plain `Error` with its exit code.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.55.0",
+  "version": "0.57.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/launchd/sudo-guard-mode.ts

@@ -72,9 +72,15 @@ export const canRead = (
 /**
  * ⛔ REFUSE A FILE THE DEPLOYING USER COULD NOT READ BACK, before writing it. Both providers read
  *   every write back to verify it (host-file-lifecycle.ts, job-lifecycle.ts) and read it again at
- *   every plan, as the deploying user; this runner elevates writes, never reads. A root-only
- *   `0600` would be installed, then fail the read-back with EACCES and stay on disk with no state,
- *   so every later plan would fail too.
+ *   every plan, as the deploying user; a runner that elevates writes but no reads strands a
+ *   root-only `0600` on disk — installed, failing the read-back with EACCES, with no state, so
+ *   every later plan would fail too.
+ * ★ `readAsRoot` IS THE ONE EXCEPTION, and it is not this guard's to grant: the caller passes it
+ *   only when the RUNNER reads this exact path back through a privileged read (the linux
+ *   sshSudoRunner's `privilegedReads` list names the file, so its readFile goes through
+ *   `sudo -n base64`). The read-back then cannot fail with EACCES whatever the mode is, and the
+ *   refusal would be false; every other check — setuid/setgid, group-writable, the path chain —
+ *   still applies to that file exactly as before.
  * ★ An omitted owner is root (under a prefix the runner writes as root). An omitted group is the
  *   parent directory's, which is the group a new file gets on macOS.
  * ⚠️ Unknown groups never refuse: the read-back after the write stays the final judge.
@@ -84,7 +90,9 @@ export const assertReadableBack = async (
   path: string,
   options: WriteOptions,
   groups: readonly number[] | undefined,
+  readAsRoot = false,
 ): Promise<void> => {
+  if (readAsRoot) return;
   const operator = base.effectiveUid();
   const parent = path.slice(0, path.lastIndexOf('/')) || '/';
   const gid = options.gid ?? (await base.stat(parent))?.gid ?? 0;

package/src/linux/fake-sudo-root.ts

@@ -13,6 +13,7 @@
  *   separate "staged bytes" side-channel to model, unlike the Mac fake's local temp files.
  */
 import type { ExecResult, FileStat } from '../launchd/runner.ts';
+import { BASE64 } from './sudo-runner.ts';
 import { CHMOD, CHOWN, INSTALL, MKDIR, MV, RM, RMDIR, SYSTEMCTL_ABS } from './sudo-allowlist.ts';
 import type { fakeLinuxHost } from './fake-linux-host.ts';
 
@@ -113,6 +114,20 @@ const fileRoot = (
     if (path !== undefined) fake.files.delete(path);
     return ok();
   }
+  /**
+   * ★ `sudo -n base64 -- <path>` — the elevated read itself (sudo-runner.ts's readFile), so a
+   *   test can join the two halves: a hidden-mode file just written through the skipped guard
+   *   reads back AS ROOT here, never EACCES. Refuses exactly what the runner's own pre-elevation
+   *   check refuses: a root-owned REGULAR file, nothing else.
+   */
+  if (program === BASE64) {
+    const [, path] = args;
+    const entry = path === undefined ? undefined : fake.files.get(path);
+    if (entry === undefined || entry.kind !== 'file' || entry.uid !== 0) {
+      return fail(1, `base64: '${String(path)}': No such file or directory`);
+    }
+    return ok(`${Buffer.from(entry.bytes).toString('base64')}\n`);
+  }
   return undefined;
 };
 

package/src/linux/fake-sudo.ts

@@ -59,6 +59,14 @@ export type FakeSudoHostOptions = {
   readonly hostFactory?: (options: FakeLinuxOptions) => ReturnType<typeof fakeLinuxHost>;
   /** The runner's own declared prefixes. @default PREFIXES */
   readonly prefixes?: readonly string[];
+  /** The runner's exact-path elevated reads (`sshSudoRunner`'s `privilegedReads`). */
+  readonly privilegedReads?: readonly string[];
+  /**
+   * What `/usr/bin/id -G` answers (sudo-guard-mode.ts's `operatorGroups`). Unset, the fake has
+   * no `id` and `operatorGroups` reads `undefined` — "unknown groups never refuse" — which is
+   * what every pre-existing test relied on; set it to make the read-back refusal decidable.
+   */
+  readonly operatorGroups?: readonly number[];
 };
 
 /**
@@ -69,7 +77,12 @@ export type FakeSudoHostOptions = {
 export const fakeSudoHost = (
   extraDirs: Record<string, number> = {},
   acl: ReadonlySet<string> = new Set(),
-  { hostFactory = fakeLinuxHost, prefixes = PREFIXES }: FakeSudoHostOptions = {},
+  {
+    hostFactory = fakeLinuxHost,
+    prefixes = PREFIXES,
+    privilegedReads,
+    operatorGroups: idGroups,
+  }: FakeSudoHostOptions = {},
 ) => {
   const dirs: Record<string, number> = {};
   for (const prefix of prefixes) dirs[prefix] = 0;
@@ -131,6 +144,11 @@ export const fakeSudoHost = (
         return handleMktemp();
       }
       if (argv[0] === 'rm' || argv[0] === '/usr/bin/rm') return handleRm(argv);
+      // ★ Only modelled when a test asks for it: unset, `id` stays unknown and the read-back
+      //   guard keeps its "unknown groups never refuse" behavior (see the option's docs).
+      if (argv[0] === '/usr/bin/id' && argv[1] === '-G' && idGroups !== undefined) {
+        return ok(`${idGroups.join(' ')}\n`);
+      }
       if (argv[0] === '/usr/bin/systemctl')
         return fake.runner.exec(['systemctl', ...argv.slice(1)]);
       if (argv[0] !== SUDO) return fake.runner.exec(argv);
@@ -146,6 +164,7 @@ export const fakeSudoHost = (
   const runner = makeSshSudoRunner(prefixes, {
     base,
     log: (line) => logs.push(line),
+    ...(privilegedReads === undefined ? {} : { privilegedReads }),
     // ★ The real stager, unmodified: it only ever calls `base.exec`/`base.writeFileAtomic`, both
     //   of which this fake's `mktemp`/`ls`/operator-level paths already answer.
     stage: stageRemote(base),

package/src/linux/sudo-guard.ts

@@ -121,6 +121,15 @@ export const assertGuardedChain = async (
  * The mode/owner and read-back checks for a file write under `prefix`, plus the path chain.
  * ★ Reads only, as the operator — the same checks run at plan time (`checkWrite`) and before the
  *   install/mv pair. `expect` is `'file-or-absent'`: a write may create or replace.
+ * ★ `privilegedReads` is the runner's exact-path elevated-read set (sudo-runner.ts): a file on it
+ *   is read back through `sudo -n base64`, so it cannot be stranded by its own mode — every
+ *   other refusal below applies to it unchanged.
+ * ⛔ A LISTED FILE MAY NEVER BE HANDED TO A NON-ROOT UID, whatever its mode: its read back is
+ *   the elevated one, which refuses anything but a root-owned regular file, so a handoff with
+ *   operator-readable other bits (0644 uid 1001) would sail through the plain read-back check,
+ *   land, and die at EVERY later read — the stranding this guard exists to prevent (glm seat
+ *   round, 2026-10-18). Refused up front instead. An omitted owner is root under a prefix, so
+ *   plain root writes are untouched.
  */
 export const assertInstallable = async (
   base: HostRunner,
@@ -128,6 +137,7 @@ export const assertInstallable = async (
   path: string,
   options: WriteOptions,
   groups: readonly number[] | undefined,
+  privilegedReads?: ReadonlySet<string>,
 ): Promise<void> => {
   const mode = modeProblem(options);
   if (mode !== undefined) {
@@ -137,6 +147,17 @@ export const assertInstallable = async (
         'real owner. Nothing ran as root.',
     );
   }
+  const listed = privilegedReads?.has(path) === true;
+  const uid = options.uid ?? 0;
+  if (listed && uid !== 0) {
+    throw refuse(
+      path,
+      `is on the runner's privilegedReads list, so its read back is the elevated one — which ` +
+        `refuses anything but a root-owned regular file. Handing it to uid ${String(uid)} would ` +
+        'land and then fail every read. Keep it root-owned, or take it off the list. Nothing ' +
+        'ran as root.',
+    );
+  }
   await assertGuardedChain(base, prefix, path, 'file-or-absent');
-  await assertReadableBack(base, path, options, groups);
+  await assertReadableBack(base, path, options, groups, listed && uid === 0);
 };