@homeflare/alchemy 0.56.0 → 0.57.0

package/dist/unifi/acl-rule-ordering.d.ts

@@ -50,7 +50,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<AclRuleOrderingAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleOrderingAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: AclRuleOrderingProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/acl-rule.d.ts

@@ -45,7 +45,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<AclRuleAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<AclRuleAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | aclRules.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: AclRuleProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/dns-policy.d.ts

@@ -51,7 +51,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<DnsPolicyAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | dnsPolicies.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<DnsPolicyAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | dnsPolicies.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: DnsPolicyProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/firewall-policy-create.d.ts

@@ -0,0 +1,55 @@
+/**
+ * `Unifi.FirewallPolicy`'s CREATE — the one write this family may make, and only for a row whose
+ * declared `name` passes `policy.ts`'s `isHfPolicyName` (Tim 2026-10-19 ~16:20Z, "Allow kit to
+ * create hf: rules"). THE ONLY FILE UNDER `src/unifi` ALLOWED TO NAME `createFirewallPolicy`
+ * (`write-op-reference.test.ts`'s `WRITE_OP_ALLOWLIST` pins that, alongside `network-update.ts`'s
+ * own `updateNetwork` entry).
+ *
+ * ⛔ A CREATE SENDS ONLY THE FIELDS THE DECLARATION OWNS — NEVER A SPREAD OF ANYTHING ELSE. Unlike
+ *   `network-update.ts`'s whole-object PUT (which must carry the untouched live object forward so
+ *   an omitted optional block is not read by the controller as "turn it off"), there IS no live
+ *   object yet: `createBody` builds `CreateFirewallPolicyRequest` field by field from `props`,
+ *   omitting every optional key `props` itself leaves `undefined` rather than sending it as
+ *   `null`/`undefined` (UniFi's "missing = off" rule cuts both ways — a key that is actually absent
+ *   from the JSON body is what "this policy does not restrict on this axis" means here, same as a
+ *   declaration that never sets `connectionStateFilter` means "match every connection state").
+ * ⛔ `checkScope` RUNS BEFORE THE REQUEST, TYPED, NEVER A STRING COMPARISON INLINE AT THE CALL
+ *   SITE — one function (`policy.ts`'s `isHfPolicyName`) decides "hf:" everywhere this boundary is
+ *   checked, so a future second caller cannot drift from this one with a slightly different regex.
+ *
+ * 🔴 `checkScope` ALSO REFUSES A `firewallPolicyId` THAT IS ALREADY SET (Opus red team,
+ *   2026-10-19, PRIMARY FINDING). `resource.ts`'s `create` branch runs for EVERY
+ *   `Unifi.FirewallPolicy` declaration with no prior Alchemy state, not only ones meant to
+ *   create — including every `firewallPolicy()` import `.pipe(adopt(true))`, and Tim's own live
+ *   console ALREADY names hand-made rules `hf: <desc>` (this file's sibling `policy.ts` cites
+ *   `hf: Vpn to MGMT (Magic WAN site-to-site)` as the existing convention). Before this check, an
+ *   hf:-named IMPORTED row whose `firewallPolicyId` stopped resolving (state lost, the rule
+ *   hand-deleted and recreated with a new id, a wrong id in a generated declaration) would GET
+ *   404, fall into `createReconcile`, pass the name check, and POST A DUPLICATE — silently, with
+ *   a green plan, where every other family still refuses "declared row absent" outright
+ *   (`update-reconcile.ts`'s original behavior, unchanged for every family but this one). A
+ *   declaration carrying a vendor id is BY DEFINITION an existing row, adopted or updated, never
+ *   a fresh create; `firewallPolicyId !== undefined` is refused here before `isHfPolicyName` is
+ *   even checked, so this holds regardless of what the name says.
+ */
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import type { FirewallPolicyProps } from './firewall-policy-form.ts';
+import type { AllowedWrite } from './wire-guard.ts';
+/** The site's fixed firewall-policies COLLECTION route — never a per-row path, since there is no
+ *  row id before this POST creates one. Takes `props` (not just a bare `siteId`) to match
+ *  `UnifiUpdate.allowedWrite`'s own shape, so `resource.ts`'s wiring treats both the same way. */
+export declare const firewallPolicyCreateAllowedWrite: (props: FirewallPolicyProps) => AllowedWrite;
+/** Refuses, typed, before any request: the one gate `createReconcile` calls before `write`.
+ *  Order matters for the message only (both refuse the same way) — the identity check runs
+ *  first because it is the one that must hold regardless of what the name says (see header). */
+export declare const checkHfCreateScope: (props: FirewallPolicyProps) => Effect.Effect<void, never, never> | Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
+/** Every field `CreateFirewallPolicyRequest` accepts, straight from the declaration, with an
+ *  absent optional field left OUT of the body entirely (never sent as `undefined`/`null`) —
+ *  `JSON.stringify` already drops an `undefined` value, but building the object field-by-field
+ *  rather than spreading `props` keeps this list the single place that enumerates exactly what a
+ *  create may send, so a future prop added to `FirewallPolicyProps` for some OTHER purpose cannot
+ *  silently become a wire field here without this file changing too. */
+export declare const firewallPolicyCreateBody: (props: FirewallPolicyProps) => firewall.CreateFirewallPolicyRequest;
+export declare const writeFirewallPolicyCreate: (props: FirewallPolicyProps) => Effect.Effect<firewall.FirewallPolicy, firewall.UnifiNetworkOpError, firewall.UnifiNetworkOpContext>;
+//# sourceMappingURL=firewall-policy-create.d.ts.map

package/dist/unifi/firewall-policy-create.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"firewall-policy-create.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-create.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAiCG;AACH,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AACrE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD;;kGAEkG;AAClG,eAAO,MAAM,gCAAgC,UAAW,mBAAmB,KAAG,YAG5E,CAAC;AAKH;;gGAEgG;AAChG,eAAO,MAAM,kBAAkB,UAAW,mBAAmB,6GAW5D,CAAC;AAEF;;;;;wEAKwE;AACxE,eAAO,MAAM,wBAAwB,UAC5B,mBAAmB,KACzB,QAAQ,CAAC,2BAeV,CAAC;AAEH,eAAO,MAAM,yBAAyB,UAAW,mBAAmB,yGACJ,CAAC"}

package/dist/unifi/firewall-policy-form.d.ts

@@ -49,10 +49,17 @@ import type * as firewall from '@distilled.cloud/unifi-network/firewall';
  *  class (MEDIUM-4). */
 export declare const normalizeConnectionStateFilter: (value: readonly string[] | undefined) => string[] | undefined;
 /** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
- *  `network-form.ts`'s own header. */
+ *  `network-form.ts`'s own header.
+ *
+ * ⛔ `firewallPolicyId` IS OPTIONAL SINCE THE 2026-10-19 hf: CREATE LIFT. An adopt-only
+ *   declaration (`declareFirewallPolicy`, every imported row) always carries the vendor id it was
+ *   read from. A fresh `hf:` creatable declaration (`declareHfFirewallPolicy` below) does not have
+ *   one yet — the vendor assigns it on `createFirewallPolicy`'s response — so `spec.fetchLive`
+ *   (`firewall-policy.ts`) locates by `name` instead of `id` whenever this is absent (netbox's
+ *   `locateOne` is the precedent for identity-by-natural-key over identity-by-vendor-id). */
 export interface FirewallPolicyProps {
     siteId: string;
-    firewallPolicyId: string;
+    firewallPolicyId?: string | undefined;
     action: firewall.FirewallPolicyAction;
     /** Connection states this policy matches — compared as a SET, see the header. */
     connectionStateFilter?: string[] | undefined;

package/dist/unifi/firewall-policy-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;sCACsC;AACtC,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}
+{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;;;;;;;;6FAQ6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}

package/dist/unifi/firewall-policy-ordering.d.ts

@@ -53,7 +53,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<FirewallPolicyOrderingAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyOrderingAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallPolicyOrderingProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/firewall-policy.d.ts

@@ -1,9 +1,13 @@
 /**
- * `Unifi.FirewallPolicy` — one firewall policy on a UniFi Network site, READ-ONLY (`policy.ts`).
- * `Unifi.FirewallPolicyOrdering` (`firewall-policy-ordering.ts`) is the sibling resource for policy
- * ORDER within a zone pair (T5) — one per `(sourceFirewallZoneId, destinationFirewallZoneId)`, never
- * this file's concern. `docs/unifi.md`'s own header names this pair as "a bigger, separate PR";
- * this is that PR — see `docs/unifi-firewall-policy.md` for the full breakdown.
+ * `Unifi.FirewallPolicy` — one firewall policy on a UniFi Network site. READ/ADOPT-ONLY for every
+ * row (`policy.ts`), EXCEPT create for a row whose declared `name` starts `hf: `
+ * (`isHfPolicyName`, Tim 2026-10-19 ~16:20Z) — `update` and `delete` stay refused even for an
+ * `hf:` row. `Unifi.FirewallPolicyOrdering` (`firewall-policy-ordering.ts`) is the sibling
+ * resource for policy ORDER within a zone pair (T5) — one per `(sourceFirewallZoneId,
+ * destinationFirewallZoneId)`, still read-only; this lift does not touch it, so a created `hf:`
+ * row lands wherever the controller places a new policy, and placing it ahead of its zone pair's
+ * "Block All Traffic" (if the controller does not already do that) would need an ordering WRITE —
+ * a second, separate lift this PR does not make (see `docs/unifi-firewall-policy.md`).
  *
  * ★ T11 GATE, CHECKED 2026-09-26: the `Firewall` tag's 13 operations (5 already covered for
  *   `Unifi.FirewallZone` in `docs/unifi.md`, 8 new here for `FirewallPolicy` — `getFirewallPolicies`,
@@ -14,30 +18,59 @@
  *   that DID change elsewhere in the document. Corroborated independently by the A3 changeset's own
  *   broader 25-operation/139-schema re-check (`.changeset/unifi-network-a3-typed-discriminator-filters.md`).
  *   Full breakdown: `docs/unifi-firewall-policy.md`.
+ *
+ * ⛔ `fetchLive` LOCATES BY `name` WHEN `firewallPolicyId` IS ABSENT (an `hf:` creatable
+ *   declaration never has the vendor id before its first successful create). A real site's policy
+ *   count is in the hundreds (T9, 424 live policies), so this walks every page with `pageAll`
+ *   rather than trusting any one page to hold the match — same reasoning netbox's `locateOne`
+ *   gives for a server-side filter that cannot be trusted alone, except here there IS no
+ *   server-side name filter at all, so every row is paged. More than one row sharing a name is a
+ *   defect, not a reason to take the first: `policy.ts`'s naming convention is exactly `hf: <desc>`
+ *   because a free-text description makes a collision astronomically unlikely, but if the console
+ *   ever has one, this engine refuses to guess which row is "the" declared one.
  */
 import { Resource } from 'alchemy';
 import * as Provider from 'alchemy/Provider';
 import * as firewall from '@distilled.cloud/unifi-network/firewall';
 import * as Effect from 'effect/Effect';
 import { type FirewallPolicyAttributes, type FirewallPolicyProps } from './firewall-policy-form.ts';
+import { type UnifiPaginationInconsistent } from './paginate.ts';
 import type { UnifiRequirements, UnifiSpec } from './resource.ts';
+import type { UnifiWriteRefused } from './policy.ts';
 export type { FirewallPolicyAttributes, FirewallPolicyProps } from './firewall-policy-form.ts';
 export { declareFirewallPolicy } from './firewall-policy-form.ts';
 export { driftOf } from './firewall-policy-drift.ts';
+/** `checkHfCreateScope`'s typed refusal, union'd with the real create call's own error, same
+ *  shape `network.ts`'s own `UpdateError` gives its write half. */
+type CreateError = UnifiWriteRefused | firewall.CreateFirewallPolicyError;
 export interface UnifiFirewallPolicy extends Resource<'Unifi.FirewallPolicy', FirewallPolicyProps, FirewallPolicyAttributes, never, UnifiRequirements> {
 }
 export declare const UnifiFirewallPolicy: import("alchemy").ResourceClass<UnifiFirewallPolicy>;
-/** `firewallPolicy('block-iot-wan', props)` — `adopt(true)` piped on by default (H5); see
- *  `network.ts`. */
+/** `firewallPolicy('block-iot-wan', props)` — for an IMPORTED, adopt-only row (always carries the
+ *  vendor's `firewallPolicyId`). `adopt(true)` piped on by default (H5); see `network.ts`. */
 export declare const firewallPolicy: (id: string, props: FirewallPolicyProps) => Effect.Effect<UnifiFirewallPolicy, never, import("effect/http/HttpClient").HttpClient>;
+/**
+ * `hfFirewallPolicy('ct100-to-nas-https', props)` — for a NEW, kit-creatable row: `props` has no
+ * `firewallPolicyId` (the vendor assigns one), and `name` MUST start `hf: ` or this throws
+ * immediately, at declaration time, rather than waiting for `createReconcile`'s own typed refusal
+ * at deploy time. That typed refusal (`checkHfCreateScope`) is still the authoritative gate — this
+ * is a second, earlier check for the common case of a typo, not a replacement for it; a caller
+ * that builds `FirewallPolicyProps` by hand and calls `UnifiFirewallPolicy` directly still goes
+ * through `checkHfCreateScope` and is still refused the same way.
+ *
+ * ⛔ NO `adopt(true)` HERE. This is a create path, not an adoption: a cold read finding an
+ *  existing row of this exact name is `Unowned`, same as any other family, and a plan that adopts
+ *  one silently is not what "create" means for this lift.
+ */
+export declare const hfFirewallPolicy: (id: string, props: Omit<FirewallPolicyProps, 'firewallPolicyId'>) => Effect.Effect<UnifiFirewallPolicy, never, import("effect/http/HttpClient").HttpClient>;
 /** ★ EXPORTED for direct testing against a fake `Credentials` layer — see `network.ts`'s own. */
-export declare const spec: UnifiSpec<FirewallPolicyProps, firewall.FirewallPolicy, FirewallPolicyAttributes, firewall.GetFirewallPolicyError>;
+export declare const spec: UnifiSpec<FirewallPolicyProps, firewall.FirewallPolicy, FirewallPolicyAttributes, firewall.GetFirewallPolicyError | firewall.GetFirewallPoliciesError | UnifiPaginationInconsistent, never, CreateError>;
 export declare const handlers: {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
         olds: FirewallPolicyProps;
         output: FirewallPolicyAttributes | undefined;
-    }) => Effect.Effect<FirewallPolicyAttributes | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyAttributes | undefined, UnifiPaginationInconsistent | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     diff: (args: {
         news: import("alchemy").Input<FirewallPolicyProps>;
         output: FirewallPolicyAttributes | undefined;
@@ -45,7 +78,7 @@ export declare const handlers: {
         readonly action: 'update';
     } | {
         readonly action: 'noop';
-    } | undefined, firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    } | undefined, UnifiPaginationInconsistent | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     reconcile: (args: {
         news: FirewallPolicyProps;
         olds: FirewallPolicyProps | undefined;
@@ -53,10 +86,10 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<FirewallPolicyAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallPolicyAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallPolicyProps;
-    }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<never, UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;
 };
 export declare const UnifiFirewallPolicyProvider: () => import("effect/Layer").Layer<Provider.Provider<UnifiFirewallPolicy>, never, import("effect/http/HttpClient").HttpClient>;
 //# sourceMappingURL=firewall-policy.d.ts.map

package/dist/unifi/firewall-policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAGlE,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAE9B,CAAC;AAEH;oBACoB;AACpB,eAAO,MAAM,cAAc,OAAQ,MAAM,SAAS,mBAAmB,2FACnB,CAAC;AAEnD,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,mBAAmB,EACnB,QAAQ,CAAC,cAAc,EACvB,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,CAUhC,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,2BAA2B,gIACyD,CAAC"}
+{"version":3,"file":"firewall-policy.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AACpE,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAOxC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,2BAA2B,CAAC;AAEnC,OAAO,EAAE,KAAK,2BAA2B,EAAW,MAAM,eAAe,CAAC;AAC1E,OAAO,KAAK,EAAE,iBAAiB,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAElE,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,aAAa,CAAC;AAErD,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,2BAA2B,CAAC;AAC/F,OAAO,EAAE,qBAAqB,EAAE,MAAM,2BAA2B,CAAC;AAClE,OAAO,EAAE,OAAO,EAAE,MAAM,4BAA4B,CAAC;AAErD;mEACmE;AACnE,KAAK,WAAW,GAAG,iBAAiB,GAAG,QAAQ,CAAC,yBAAyB,CAAC;AAE1E,MAAM,WAAW,mBAAoB,SAAQ,QAAQ,CACnD,sBAAsB,EACtB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,iBAAiB,CAClB;CAAG;AAEJ,eAAO,MAAM,mBAAmB,sDAE9B,CAAC;AAEH;8FAC8F;AAC9F,eAAO,MAAM,cAAc,OAAQ,MAAM,SAAS,mBAAmB,2FACnB,CAAC;AAEnD;;;;;;;;;;;;GAYG;AACH,eAAO,MAAM,gBAAgB,OACvB,MAAM,SACH,IAAI,CAAC,mBAAmB,EAAE,kBAAkB,CAAC,2FAuBrD,CAAC;AAkBF,iGAAiG;AACjG,eAAO,MAAM,IAAI,EAAE,SAAS,CAC1B,mBAAmB,EACnB,QAAQ,CAAC,cAAc,EACvB,wBAAwB,EACxB,QAAQ,CAAC,sBAAsB,GAAG,QAAQ,CAAC,wBAAwB,GAAG,2BAA2B,EACjG,KAAK,EACL,WAAW,CAsBZ,CAAC;AAEF,eAAO,MAAM,QAAQ;;;;;;;;;;;;;;;;;;;;;;;;;CAAsB,CAAC;AAE5C,eAAO,MAAM,2BAA2B,gIACyD,CAAC"}

package/dist/unifi/firewall-zone.d.ts

@@ -46,7 +46,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<FirewallZoneAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<FirewallZoneAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | firewall.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: FirewallZoneProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/index.d.ts

@@ -16,7 +16,7 @@ export { UnifiDnsPolicy, UnifiDnsPolicyProvider, declareDnsPolicy, dnsPolicy, ty
 export { UnifiAclRule, UnifiAclRuleProvider, aclRule, declareAclRule, type AclRuleAttributes, type AclRuleProps, driftOf as aclRuleDriftOf, } from './acl-rule.ts';
 export { UnifiAclRuleOrdering, UnifiAclRuleOrderingProvider, aclRuleOrdering, declareAclRuleOrdering, type AclRuleOrderingAttributes, type AclRuleOrderingProps, driftOf as aclRuleOrderingDriftOf, } from './acl-rule-ordering.ts';
 export { UnifiWifiBroadcast, UnifiWifiBroadcastProvider, declareWifiBroadcast, wifiBroadcast, type WifiBroadcastAttributes, type WifiBroadcastProps, driftOf as wifiBroadcastDriftOf, } from './wifi-broadcast.ts';
-export { UnifiFirewallPolicy, UnifiFirewallPolicyProvider, declareFirewallPolicy, firewallPolicy, type FirewallPolicyAttributes, type FirewallPolicyProps, driftOf as firewallPolicyDriftOf, } from './firewall-policy.ts';
+export { UnifiFirewallPolicy, UnifiFirewallPolicyProvider, declareFirewallPolicy, firewallPolicy, hfFirewallPolicy, type FirewallPolicyAttributes, type FirewallPolicyProps, driftOf as firewallPolicyDriftOf, } from './firewall-policy.ts';
 export { UnifiFirewallPolicyOrdering, UnifiFirewallPolicyOrderingProvider, declareFirewallPolicyOrdering, firewallPolicyOrdering, type FirewallPolicyOrderingAttributes, type FirewallPolicyOrderingProps, driftOf as firewallPolicyOrderingDriftOf, } from './firewall-policy-ordering.ts';
 export { UnifiTrafficMatchingList, UnifiTrafficMatchingListProvider, declareTrafficMatchingList, trafficMatchingList, type TrafficMatchingListAttributes, type TrafficMatchingListProps, driftOf as trafficMatchingListDriftOf, } from './traffic-matching-list.ts';
 export { providers } from './providers.ts';

package/dist/unifi/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unifi/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,YAAY,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIjB,OAAO,IAAI,cAAc,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,OAAO,IAAI,mBAAmB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,SAAS,EACT,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,OAAO,IAAI,gBAAgB,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,OAAO,EACP,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,OAAO,IAAI,cAAc,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,eAAe,EACf,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,OAAO,IAAI,sBAAsB,GAClC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,OAAO,IAAI,oBAAoB,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,EACrB,cAAc,EACd,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,OAAO,IAAI,qBAAqB,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,OAAO,IAAI,6BAA6B,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,OAAO,IAAI,0BAA0B,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/unifi/index.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,EACL,sBAAsB,EACtB,kBAAkB,EAClB,sBAAsB,EACtB,qBAAqB,EACrB,oBAAoB,EACpB,0BAA0B,EAC1B,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,sBAAsB,EACtB,iBAAiB,EACjB,KAAK,gBAAgB,GACtB,MAAM,aAAa,CAAC;AACrB,OAAO,EAIL,KAAK,YAAY,EACjB,iBAAiB,EACjB,kBAAkB,EAClB,mBAAmB,EACnB,iBAAiB,GAClB,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,KAAK,iBAAiB,EAAE,KAAK,SAAS,EAAE,MAAM,eAAe,CAAC;AACvE,YAAY,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,cAAc,EACd,OAAO,EACP,KAAK,iBAAiB,EACtB,KAAK,YAAY,EAIjB,OAAO,IAAI,cAAc,GAC1B,MAAM,cAAc,CAAC;AACtB,OAAO,EACL,iBAAiB,EACjB,yBAAyB,EACzB,mBAAmB,EACnB,YAAY,EACZ,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EACtB,OAAO,IAAI,mBAAmB,GAC/B,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,gBAAgB,EAChB,SAAS,EACT,KAAK,mBAAmB,EACxB,KAAK,cAAc,EACnB,OAAO,IAAI,gBAAgB,GAC5B,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,YAAY,EACZ,oBAAoB,EACpB,OAAO,EACP,cAAc,EACd,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,OAAO,IAAI,cAAc,GAC1B,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,oBAAoB,EACpB,4BAA4B,EAC5B,eAAe,EACf,sBAAsB,EACtB,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,EACzB,OAAO,IAAI,sBAAsB,GAClC,MAAM,wBAAwB,CAAC;AAChC,OAAO,EACL,kBAAkB,EAClB,0BAA0B,EAC1B,oBAAoB,EACpB,aAAa,EACb,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,OAAO,IAAI,oBAAoB,GAChC,MAAM,qBAAqB,CAAC;AAC7B,OAAO,EACL,mBAAmB,EACnB,2BAA2B,EAC3B,qBAAqB,EACrB,cAAc,EACd,gBAAgB,EAChB,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EACxB,OAAO,IAAI,qBAAqB,GACjC,MAAM,sBAAsB,CAAC;AAC9B,OAAO,EACL,2BAA2B,EAC3B,mCAAmC,EACnC,6BAA6B,EAC7B,sBAAsB,EACtB,KAAK,gCAAgC,EACrC,KAAK,2BAA2B,EAChC,OAAO,IAAI,6BAA6B,GACzC,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,wBAAwB,EACxB,gCAAgC,EAChC,0BAA0B,EAC1B,mBAAmB,EACnB,KAAK,6BAA6B,EAClC,KAAK,wBAAwB,EAC7B,OAAO,IAAI,0BAA0B,GACtC,MAAM,4BAA4B,CAAC;AACpC,OAAO,EAAE,SAAS,EAAE,MAAM,gBAAgB,CAAC"}

package/dist/unifi/index.js

@@ -1,7 +1,8 @@
 // src/unifi/policy.ts
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-var UNIFI_WRITE_POLICY = "UniFi is adopt-only except Unifi.Network update: one whole-object PUT built from the live " + "object plus the declared field changes, only on a row with prior Alchemy state, only through " + "deploy-approve; create/delete and every other family stay refused -- widening is a kit change " + "(Tim 2026-10-10 lifts the 2026-09-24 rule for this one case)";
+var UNIFI_WRITE_POLICY = "UniFi is adopt-only except (1) Unifi.Network update: one whole-object PUT built from the live " + "object plus the declared field changes, only on a row with prior Alchemy state, only through " + 'deploy-approve; and (2) Unifi.FirewallPolicy create, only when the declared name starts "hf: ", ' + "one POST built from only the declared fields, read back and checked to match after; every " + "other create, every update of an hf: row, every delete and every other family stay refused -- " + "widening is a kit change (Tim 2026-10-10 lifts the 2026-09-24 rule for Network update, Tim " + "2026-10-19 lifts it again for hf:-named FirewallPolicy create)";
+var isHfPolicyName = (name) => name.startsWith("hf: ");
 var UNIFI_READ_ONLY_POLICY = UNIFI_WRITE_POLICY;
 
 class UnifiWriteRefused extends Data.TaggedError("UnifiWriteRefused") {
@@ -30,6 +31,12 @@ class UnifiUpdateDidNotConverge extends Data.TaggedError("UnifiUpdateDidNotConve
   }
 }
 
+class UnifiCreateDidNotConverge extends Data.TaggedError("UnifiCreateDidNotConverge") {
+  get message() {
+    return `${this.type} ${this.identity}: the POST created an object, but the read-back differs from ` + `the declaration on ${fieldList(this.fields)}. The object is on the console and is not ` + "rolled back; the next deploy will see this as drift. Recovery is a re-import of the live object.";
+  }
+}
+
 class UnifiFieldNotRemovable extends Data.TaggedError("UnifiFieldNotRemovable") {
   get message() {
     return `${this.type} ${this.identity}: refusing to remove ${fieldList(this.fields)}; a whole-object ` + "PUT turns an omitted block off, and only the removable allowlist may be dropped.";
@@ -351,6 +358,28 @@ var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(functi
     fields: update.driftOf(written, news).map((d) => d.field)
   });
 });
+var createReconcile = (spec, news, note) => Effect5.gen(function* () {
+  const identity = spec.describe(news);
+  const create = spec.create;
+  if (create === undefined)
+    return yield* refuseWrite(spec.type, identity, "create");
+  yield* create.checkScope(news);
+  yield* note(`${spec.type} ${identity}: POST create`);
+  const written = yield* create.write(news);
+  const withId = create.identify(news, written);
+  const confirmed = yield* spec.fetchLive(withId);
+  if (confirmed === undefined) {
+    return yield* Effect5.die(new Error(`${spec.type} ${identity}: the create POST answered, but the read-back found nothing ` + "at the id it assigned. The object may or may not exist on the console; re-import " + "before trying again rather than retrying this create blindly."));
+  }
+  const attrs = spec.attributes(confirmed, withId);
+  if (spec.matches(attrs, withId))
+    return attrs;
+  return yield* new UnifiCreateDidNotConverge({
+    type: spec.type,
+    identity,
+    fields: create.driftOf(confirmed, withId).map((d) => d.field)
+  });
+});
 
 // src/unifi/resource.ts
 var unifiOperations = (spec) => {
@@ -371,12 +400,17 @@ var unifiOperations = (spec) => {
         return { action: "update" };
       return spec.matches(live, news) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: (news, rest = {}) => updateReconcile(spec, {
-      news,
-      olds: rest.olds,
-      output: rest.output,
-      note: rest.note ?? (() => Effect6.void)
-    }),
+    reconcile: (news, rest = {}) => {
+      const note = rest.note ?? (() => Effect6.void);
+      const create = spec.create;
+      if (create !== undefined && rest.olds === undefined && rest.output === undefined) {
+        return Effect6.gen(function* () {
+          const live = yield* spec.fetchLive(news);
+          return live === undefined ? yield* createReconcile(spec, news, note) : yield* updateReconcile(spec, { news, olds: undefined, output: undefined, note });
+        });
+      }
+      return updateReconcile(spec, { news, olds: rest.olds, output: rest.output, note });
+    },
     destroy: (olds) => refuseWrite(spec.type, spec.describe(olds), "delete")
   };
 };
@@ -394,7 +428,10 @@ var unifiHandlers = (spec) => {
       olds: args.olds,
       output: args.output,
       note: (message) => args.session.note(message)
-    }), spec.update ? [spec.update.allowedWrite(args.news)] : []),
+    }), [
+      ...spec.update ? [spec.update.allowedWrite(args.news)] : [],
+      ...spec.create && args.olds === undefined && args.output === undefined ? [spec.create.allowedWrite(args.news)] : []
+    ]),
     delete: (args) => withCredentials(ops.destroy(args.olds))
   };
 };
@@ -863,8 +900,38 @@ var UnifiWifiBroadcastProvider = () => Provider6.effect(UnifiWifiBroadcast, Effe
 import { Resource as Resource7 } from "alchemy";
 import { adopt as adopt7 } from "alchemy/AdoptPolicy";
 import * as Provider7 from "alchemy/Provider";
+import * as firewall3 from "@distilled.cloud/unifi-network/firewall";
+import * as Effect15 from "effect/Effect";
+
+// src/unifi/firewall-policy-create.ts
 import * as firewall2 from "@distilled.cloud/unifi-network/firewall";
 import * as Effect14 from "effect/Effect";
+var firewallPolicyCreateAllowedWrite = (props) => ({
+  method: "POST",
+  tail: `/v1/sites/${props.siteId}/firewall/policies`
+});
+var describeByName = (props) => `sites/${props.siteId}/firewall/policies/by-name/${props.name}`;
+var checkHfCreateScope = (props) => {
+  if (props.firewallPolicyId !== undefined) {
+    return refuseWrite("Unifi.FirewallPolicy", `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`, "create");
+  }
+  return isHfPolicyName(props.name) ? Effect14.void : refuseWrite("Unifi.FirewallPolicy", describeByName(props), "create");
+};
+var firewallPolicyCreateBody = (props) => ({
+  siteId: props.siteId,
+  action: props.action,
+  ...props.connectionStateFilter === undefined ? {} : { connectionStateFilter: props.connectionStateFilter },
+  ...props.description === undefined ? {} : { description: props.description },
+  destination: props.destination,
+  enabled: props.enabled,
+  ipProtocolScope: props.ipProtocolScope,
+  ...props.ipsecFilter === undefined ? {} : { ipsecFilter: props.ipsecFilter },
+  loggingEnabled: props.loggingEnabled,
+  name: props.name,
+  ...props.schedule === undefined ? {} : { schedule: props.schedule },
+  source: props.source
+});
+var writeFirewallPolicyCreate = (props) => firewall2.createFirewallPolicy(firewallPolicyCreateBody(props));
 
 // src/unifi/firewall-policy-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
@@ -928,21 +995,44 @@ var UnifiFirewallPolicy = Resource7("Unifi.FirewallPolicy", {
   defaultRemovalPolicy: "retain"
 });
 var firewallPolicy = (id, props) => UnifiFirewallPolicy(id, props).pipe(adopt7(true));
+var hfFirewallPolicy = (id, props) => {
+  if ("firewallPolicyId" in props && props.firewallPolicyId !== undefined) {
+    throw new Error(`hfFirewallPolicy(${id}): props already carries a firewallPolicyId -- this constructor is ` + "for a row that does not exist yet. A row with a vendor id is adopted or updated, never " + "created; use firewallPolicy() instead.");
+  }
+  if (!props.name.startsWith("hf: ")) {
+    throw new Error(`hfFirewallPolicy(${id}): name "${props.name}" does not start "hf: " -- only hf:-named ` + "policies may be created by this kit (Tim 2026-10-19); rename the declaration.");
+  }
+  return UnifiFirewallPolicy(id, props);
+};
+var locateByName = (siteId, name) => pageAll(firewall3.getFirewallPolicies, { siteId }).pipe(Effect15.map((rows) => {
+  const matching = rows.filter((row) => row.name === name);
+  if (matching.length > 1) {
+    throw new Error(`Unifi.FirewallPolicy: ${String(matching.length)} live policies are named "${name}" on ` + `site ${siteId}. A name this engine locates by must be unique; rename one on the console.`);
+  }
+  return matching[0];
+}));
 var spec7 = {
   type: "Unifi.FirewallPolicy",
-  describe: (props) => `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
-  fetchLive: (props) => firewall2.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect14.catchTag("NotFound", () => Effect14.succeed(undefined))),
+  describe: (props) => props.firewallPolicyId === undefined ? `sites/${props.siteId}/firewall/policies/by-name/${props.name}` : `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
+  fetchLive: (props) => props.firewallPolicyId === undefined ? locateByName(props.siteId, props.name) : firewall3.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect15.catchTag("NotFound", () => Effect15.succeed(undefined))),
   attributes: attributesOf7,
-  matches: matches7
+  matches: matches7,
+  create: {
+    allowedWrite: firewallPolicyCreateAllowedWrite,
+    checkScope: checkHfCreateScope,
+    write: writeFirewallPolicyCreate,
+    identify: (props, written) => ({ ...props, firewallPolicyId: written.id }),
+    driftOf: driftOf7
+  }
 };
 var handlers7 = unifiHandlers(spec7);
-var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect14.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
+var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect15.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
 // src/unifi/firewall-policy-ordering.ts
 import { Resource as Resource8 } from "alchemy";
 import { adopt as adopt8 } from "alchemy/AdoptPolicy";
 import * as Provider8 from "alchemy/Provider";
-import * as firewall3 from "@distilled.cloud/unifi-network/firewall";
-import * as Effect15 from "effect/Effect";
+import * as firewall4 from "@distilled.cloud/unifi-network/firewall";
+import * as Effect16 from "effect/Effect";
 
 // src/unifi/firewall-policy-ordering-form.ts
 var attributesOf8 = (live, props) => ({
@@ -980,22 +1070,22 @@ var firewallPolicyOrdering = (id, props) => UnifiFirewallPolicyOrdering(id, prop
 var spec8 = {
   type: "Unifi.FirewallPolicyOrdering",
   describe: (props) => `sites/${props.siteId}/firewall/policies/ordering` + `?sourceFirewallZoneId=${props.sourceFirewallZoneId}` + `&destinationFirewallZoneId=${props.destinationFirewallZoneId}`,
-  fetchLive: (props) => firewall3.getFirewallPolicyOrdering({
+  fetchLive: (props) => firewall4.getFirewallPolicyOrdering({
     siteId: props.siteId,
     sourceFirewallZoneId: props.sourceFirewallZoneId,
     destinationFirewallZoneId: props.destinationFirewallZoneId
-  }).pipe(Effect15.catchTag("NotFound", () => Effect15.succeed(undefined))),
+  }).pipe(Effect16.catchTag("NotFound", () => Effect16.succeed(undefined))),
   attributes: attributesOf8,
   matches: matches8
 };
 var handlers8 = unifiHandlers(spec8);
-var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect15.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
+var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect16.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
 // src/unifi/traffic-matching-list.ts
 import { Resource as Resource9 } from "alchemy";
 import { adopt as adopt9 } from "alchemy/AdoptPolicy";
 import * as Provider9 from "alchemy/Provider";
 import * as trafficMatchingLists from "@distilled.cloud/unifi-network/traffic_matching_lists";
-import * as Effect16 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/unifi/traffic-matching-list-form.ts
 var attributesOf9 = (live, props) => ({
@@ -1031,12 +1121,12 @@ var spec9 = {
   fetchLive: (props) => trafficMatchingLists.getTrafficMatchingList({
     siteId: props.siteId,
     trafficMatchingListId: props.trafficMatchingListId
-  }).pipe(Effect16.catchTag("NotFound", () => Effect16.succeed(undefined))),
+  }).pipe(Effect17.catchTag("NotFound", () => Effect17.succeed(undefined))),
   attributes: attributesOf9,
   matches: matches9
 };
 var handlers9 = unifiHandlers(spec9);
-var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect16.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
+var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect17.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
 // src/unifi/providers.ts
 import * as Layer from "effect/Layer";
 var providers = () => Layer.mergeAll(UnifiNetworkProvider(), UnifiFirewallZoneProvider(), UnifiDnsPolicyProvider(), UnifiAclRuleProvider(), UnifiAclRuleOrderingProvider(), UnifiWifiBroadcastProvider(), UnifiFirewallPolicyProvider(), UnifiFirewallPolicyOrderingProvider(), UnifiTrafficMatchingListProvider());
@@ -1095,6 +1185,7 @@ export {
   firewallZone,
   driftOf2 as firewallZoneDriftOf,
   guardedHttpClient,
+  hfFirewallPolicy,
   network,
   driftOf as networkDriftOf,
   providers,
@@ -1104,5 +1195,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=04975D29327C722564756E2164756E21
+//# debugId=F58E0BCA65985B3464756E2164756E21
 //# sourceMappingURL=index.js.map