@homeflare/alchemy 0.56.0 → 0.57.0

package/dist/unifi/network.d.ts

@@ -80,7 +80,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: NetworkProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/policy.d.ts

@@ -1,5 +1,13 @@
 import * as Effect from 'effect/Effect';
 export declare const UNIFI_WRITE_POLICY: string;
+/**
+ * ⛔ THE ONE GATE THAT DECIDES "hf:" (Tim 2026-10-19, `nas-firewall`'s own naming:
+ *   `hf: CT100 to NAS https`). The space after the colon is deliberate and checked: `"hf:foo"`
+ *   (no space) is NOT an hf: name under this policy, so a typo can never silently slip past the
+ *   create gate by omitting it. Exported so `firewall-policy-create.ts`'s `checkScope` and every
+ *   test that proves the boundary use this ONE function, never a second regex hand-copied nearby.
+ */
+export declare const isHfPolicyName: (name: string) => boolean;
 /** @deprecated renamed `UNIFI_WRITE_POLICY`; kept so existing consumer imports do not break. */
 export declare const UNIFI_READ_ONLY_POLICY: string;
 /** What kind of write was asked for and refused — for the message only, never acted on. */
@@ -50,6 +58,20 @@ export declare class UnifiUpdateDidNotConverge extends UnifiUpdateDidNotConverge
 }> {
     get message(): string;
 }
+declare const UnifiCreateDidNotConverge_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiCreateDidNotConverge";
+} & Readonly<A>;
+/** The POST answered, a read-back ran, yet the read-back object still differs from the
+ *  declaration — the hf: create path's own convergence check (`create-reconcile.ts`'s sibling in
+ *  `update-reconcile.ts`), same shape as `UnifiUpdateDidNotConverge` for the same reason: the
+ *  object now exists on the console, unrolled-back, so the operator needs to know and re-import. */
+export declare class UnifiCreateDidNotConverge extends UnifiCreateDidNotConverge_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
 declare const UnifiFieldNotRemovable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "UnifiFieldNotRemovable";
 } & Readonly<A>;

package/dist/unifi/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAIiC,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAOmC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,OAAkC,CAAC;AAEjF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;oGAGoG;AACpG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}

package/dist/unifi/resource.d.ts

@@ -2,7 +2,7 @@ import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/http/HttpClient';
-import { type ReconcileArgs, type UnifiUpdate } from './update-reconcile.ts';
+import { type ReconcileArgs, type UnifiCreate, type UnifiUpdate } from './update-reconcile.ts';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**
@@ -11,7 +11,7 @@ export type UnifiRequirements = HttpClient.HttpClient;
  * union, with `NotFound` already folded away) so the precise per-operation error union flows
  * through instead of being widened by hand here. `E2` is the error union of the optional write.
  */
-export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never> = {
+export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never, E3 = never> = {
     /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */
     readonly type: string;
     /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */
@@ -22,8 +22,11 @@ export type UnifiSpec<Props extends object, Live, Attributes extends object, E,
     readonly describe: (props: Props) => string;
     /** Present only on a family allowed to write (`Unifi.Network`); see `update-reconcile.ts`. */
     readonly update?: UnifiUpdate<Props, Live, E2>;
+    /** Present only on a family allowed to create (`Unifi.FirewallPolicy`, `hf:` rows only); see
+     *  `update-reconcile.ts`'s `createReconcile`. */
+    readonly create?: UnifiCreate<Props, Live, E3>;
 };
-export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     read: (props: Props) => Effect.Effect<Attributes | undefined, E, UnifiNetworkOpContext>;
     readHandler: ({ olds, output }: {
         olds: Props;
@@ -34,8 +37,24 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
     } | {
         readonly action: 'noop';
     } | undefined, E, UnifiNetworkOpContext>;
-    /** Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset. */
-    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+    /**
+     * Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset — the
+     * SAME calling convention a plain cold adoption already uses (H6), so the existence GET must
+     * run FIRST, for every name, exactly as it always has: a row that already exists is adopted
+     * (exact match, zero writes) regardless of its name, and ONLY an absent row ever reaches
+     * `create.checkScope`. "A non-hf: create sends nothing" therefore means no WRITE (no
+     * POST/PUT/DELETE) — the same guarantee every other refusal in this engine gives, and the one
+     * `wire-guard.ts`'s allow list enforces at the wire; the existence GET is not a write.
+     *
+     * ⛔ THE CREATE BRANCH ONLY RUNS WHEN THERE IS NO PRIOR STATE AT ALL (`olds`/`output` both
+     *   absent — a genuine first deploy, never a re-declare of an adopted row) AND the family
+     *   declares `create` AND the live read comes back absent. A row that already exists (someone
+     *   else's object with a colliding identity, or a retried deploy that already created it)
+     *   takes the ordinary `updateReconcile` path instead — exact match reports with zero writes,
+     *   anything else refuses (there is no `olds` to PUT a patch against, so it can never silently
+     *   fall through to an update of an existing row).
+     */
+    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
     destroy: (olds: Props) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
 };
 /**
@@ -44,7 +63,7 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
  * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;
  *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.
  */
-export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
         olds: Props;
@@ -65,7 +84,7 @@ export declare const unifiHandlers: <Props extends object, Live, Attributes exte
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
+    }) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
     delete: (args: {
         olds: Props;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AAG9F,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI;IAC5F,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;kBAE1B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB,4FAA4F;sBAC1E,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAQ1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QAClF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;IAe7C,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5CtB,QAAQ;;yBAElC,MAAM;;IA6CzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAWD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAG/B,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CACnB,KAAK,SAAS,MAAM,EACpB,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,EACD,EAAE,GAAG,KAAK,EACV,EAAE,GAAG,KAAK,IACR;IACF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C;qDACiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;kBAE9B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB;;;;;;;;;;;;;;;;OAgBG;sBACe,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAc1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACtF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;IAejD,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAlEtB,QAAQ;;yBAElC,MAAM;;IAmEzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAqBD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -47,7 +47,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: TrafficMatchingListProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/update-reconcile.d.ts

@@ -1,7 +1,7 @@
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type { FieldDrift } from './drift.ts';
-import { UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
+import { UnifiCreateDidNotConverge, UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
 import type { UnifiSpec } from './resource.ts';
 import type { AllowedWrite } from './wire-guard.ts';
 export type Patch<Props> = {
@@ -27,5 +27,39 @@ export type ReconcileArgs<Props extends object> = {
     readonly output: unknown;
     readonly note: (message: string) => Effect.Effect<void>;
 };
-export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+/**
+ * The write half of a CREATE-capable family: today, only `Unifi.FirewallPolicy`, and only for an
+ * `hf:`-named row (`policy.ts`'s `isHfPolicyName`). Deliberately NOT a merge-with-live update —
+ * there is no live object yet — so there is no `patchKeys`/`checkScope(live, patch, …)` here: a
+ * create sends exactly the fields the declaration owns, nothing echoed from elsewhere, nothing to
+ * accidentally reset.
+ *
+ * ⛔ `checkScope` RUNS BEFORE THE POST (same ordering `update.checkScope` already has): a
+ *   non-`hf:` name is refused here, typed, never reaching the wire at all.
+ * ★ `identify` CLOSES THE LOOP FROM THE POST'S RESPONSE TO A FRESH GET. The vendor assigns the id
+ *   on create; `write`'s response carries it, but a response body is not proof the object is
+ *   actually readable back (`createReconcile` re-fetches with the id `identify` folds in, rather
+ *   than trusting the POST's own echo — same reasoning `network-update.ts`'s header gives for
+ *   never trusting a write's own response over a real read).
+ */
+export type UnifiCreate<Props extends object, Live, E3> = {
+    /** The one POST the wire guard may pass for this family (the site's fixed collection route,
+     *  built from `props` the same way `UnifiUpdate.allowedWrite` reads a row's ids from `props`). */
+    readonly allowedWrite: (props: Props) => AllowedWrite;
+    /** Refuses (typed, before any note or request) a create outside this family's write scope. */
+    readonly checkScope: (props: Props) => Effect.Effect<void, E3>;
+    readonly write: (props: Props) => Effect.Effect<Live, E3, UnifiNetworkOpContext>;
+    /** `props` plus the vendor id the POST's response assigned, for the read-back `fetchLive`. */
+    readonly identify: (props: Props, written: Live) => Props;
+    readonly driftOf: (live: Live, props: Props) => ReadonlyArray<FieldDrift>;
+};
+/**
+ * CREATE for a family whose live read came back absent AND which has no prior Alchemy state
+ * (`resource.ts`'s `unifiOperations.reconcile` is the only caller, and only under that same
+ * condition — see its own header). Refuses (untyped-to-typed, same `refuseWrite` every other
+ * refusal uses) when the family declares no `create` at all; `create.checkScope` then refuses
+ * again, more specifically, for a declared row the create scope itself does not allow.
+ */
+export declare const createReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, news: Props, note: (message: string) => Effect.Effect<void, never, never>) => Effect.Effect<Attributes, E | E3 | UnifiCreateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
 //# sourceMappingURL=update-reconcile.d.ts.map

package/dist/unifi/update-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,gCACjB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC"}
+{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,gCACrB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD;sGACkG;IAClG,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACjF,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;CAC3E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAC7C,KAAK,QACL,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,mIA8B1D,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -69,7 +69,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: WifiBroadcastProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/wire-guard.d.ts

@@ -5,7 +5,7 @@ import * as HttpClient from 'effect/http/HttpClient';
  * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).
  */
 export type AllowedWrite = {
-    readonly method: 'PUT';
+    readonly method: 'PUT' | 'POST';
     readonly tail: string;
 };
 export declare class UnifiRefusedRequest extends Error {

package/dist/unifi/wire-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}
+{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}

package/docs/distilled-interim.md

@@ -122,8 +122,10 @@ Two checks, both real, neither skippable:
 No special-casing: add a changeset (`bun changeset`, minor — new package),
 push, merge. `scripts/publish.ts` packs with `bun pm pack` (resolves
 `workspace:`/`catalog:` the way `npm pack` cannot) and publishes with `npm
-publish --provenance` from CI. `README.md`/`LICENSE`/`scripts/smoke.ts` ship
-in `files`; nothing about the release pipeline needs to know this package is
+publish --provenance` from CI. `README.md`/`LICENSE` ship in `files`;
+`scripts/smoke.ts` is outside `files` so it never packs — `scripts/pack.ts`
+additionally strips the `scripts`/`devDependencies` manifest fields at pack
+time. Nothing about the release pipeline needs to know this package is
 an interim stand-in.
 
 ### 5. Alias it in, then cut over later

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.56.0",
+  "version": "0.57.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/unifi/firewall-policy-create.ts

@@ -0,0 +1,94 @@
+/**
+ * `Unifi.FirewallPolicy`'s CREATE — the one write this family may make, and only for a row whose
+ * declared `name` passes `policy.ts`'s `isHfPolicyName` (Tim 2026-10-19 ~16:20Z, "Allow kit to
+ * create hf: rules"). THE ONLY FILE UNDER `src/unifi` ALLOWED TO NAME `createFirewallPolicy`
+ * (`write-op-reference.test.ts`'s `WRITE_OP_ALLOWLIST` pins that, alongside `network-update.ts`'s
+ * own `updateNetwork` entry).
+ *
+ * ⛔ A CREATE SENDS ONLY THE FIELDS THE DECLARATION OWNS — NEVER A SPREAD OF ANYTHING ELSE. Unlike
+ *   `network-update.ts`'s whole-object PUT (which must carry the untouched live object forward so
+ *   an omitted optional block is not read by the controller as "turn it off"), there IS no live
+ *   object yet: `createBody` builds `CreateFirewallPolicyRequest` field by field from `props`,
+ *   omitting every optional key `props` itself leaves `undefined` rather than sending it as
+ *   `null`/`undefined` (UniFi's "missing = off" rule cuts both ways — a key that is actually absent
+ *   from the JSON body is what "this policy does not restrict on this axis" means here, same as a
+ *   declaration that never sets `connectionStateFilter` means "match every connection state").
+ * ⛔ `checkScope` RUNS BEFORE THE REQUEST, TYPED, NEVER A STRING COMPARISON INLINE AT THE CALL
+ *   SITE — one function (`policy.ts`'s `isHfPolicyName`) decides "hf:" everywhere this boundary is
+ *   checked, so a future second caller cannot drift from this one with a slightly different regex.
+ *
+ * 🔴 `checkScope` ALSO REFUSES A `firewallPolicyId` THAT IS ALREADY SET (Opus red team,
+ *   2026-10-19, PRIMARY FINDING). `resource.ts`'s `create` branch runs for EVERY
+ *   `Unifi.FirewallPolicy` declaration with no prior Alchemy state, not only ones meant to
+ *   create — including every `firewallPolicy()` import `.pipe(adopt(true))`, and Tim's own live
+ *   console ALREADY names hand-made rules `hf: <desc>` (this file's sibling `policy.ts` cites
+ *   `hf: Vpn to MGMT (Magic WAN site-to-site)` as the existing convention). Before this check, an
+ *   hf:-named IMPORTED row whose `firewallPolicyId` stopped resolving (state lost, the rule
+ *   hand-deleted and recreated with a new id, a wrong id in a generated declaration) would GET
+ *   404, fall into `createReconcile`, pass the name check, and POST A DUPLICATE — silently, with
+ *   a green plan, where every other family still refuses "declared row absent" outright
+ *   (`update-reconcile.ts`'s original behavior, unchanged for every family but this one). A
+ *   declaration carrying a vendor id is BY DEFINITION an existing row, adopted or updated, never
+ *   a fresh create; `firewallPolicyId !== undefined` is refused here before `isHfPolicyName` is
+ *   even checked, so this holds regardless of what the name says.
+ */
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { isHfPolicyName, refuseWrite } from './policy.ts';
+import type { FirewallPolicyProps } from './firewall-policy-form.ts';
+import type { AllowedWrite } from './wire-guard.ts';
+
+/** The site's fixed firewall-policies COLLECTION route — never a per-row path, since there is no
+ *  row id before this POST creates one. Takes `props` (not just a bare `siteId`) to match
+ *  `UnifiUpdate.allowedWrite`'s own shape, so `resource.ts`'s wiring treats both the same way. */
+export const firewallPolicyCreateAllowedWrite = (props: FirewallPolicyProps): AllowedWrite => ({
+  method: 'POST',
+  tail: `/v1/sites/${props.siteId}/firewall/policies`,
+});
+
+const describeByName = (props: FirewallPolicyProps) =>
+  `sites/${props.siteId}/firewall/policies/by-name/${props.name}`;
+
+/** Refuses, typed, before any request: the one gate `createReconcile` calls before `write`.
+ *  Order matters for the message only (both refuse the same way) — the identity check runs
+ *  first because it is the one that must hold regardless of what the name says (see header). */
+export const checkHfCreateScope = (props: FirewallPolicyProps) => {
+  if (props.firewallPolicyId !== undefined) {
+    return refuseWrite(
+      'Unifi.FirewallPolicy',
+      `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
+      'create',
+    );
+  }
+  return isHfPolicyName(props.name)
+    ? Effect.void
+    : refuseWrite('Unifi.FirewallPolicy', describeByName(props), 'create');
+};
+
+/** Every field `CreateFirewallPolicyRequest` accepts, straight from the declaration, with an
+ *  absent optional field left OUT of the body entirely (never sent as `undefined`/`null`) —
+ *  `JSON.stringify` already drops an `undefined` value, but building the object field-by-field
+ *  rather than spreading `props` keeps this list the single place that enumerates exactly what a
+ *  create may send, so a future prop added to `FirewallPolicyProps` for some OTHER purpose cannot
+ *  silently become a wire field here without this file changing too. */
+export const firewallPolicyCreateBody = (
+  props: FirewallPolicyProps,
+): firewall.CreateFirewallPolicyRequest => ({
+  siteId: props.siteId,
+  action: props.action,
+  ...(props.connectionStateFilter === undefined
+    ? {}
+    : { connectionStateFilter: props.connectionStateFilter }),
+  ...(props.description === undefined ? {} : { description: props.description }),
+  destination: props.destination,
+  enabled: props.enabled,
+  ipProtocolScope: props.ipProtocolScope,
+  ...(props.ipsecFilter === undefined ? {} : { ipsecFilter: props.ipsecFilter }),
+  loggingEnabled: props.loggingEnabled,
+  name: props.name,
+  ...(props.schedule === undefined ? {} : { schedule: props.schedule }),
+  source: props.source,
+});
+
+export const writeFirewallPolicyCreate = (props: FirewallPolicyProps) =>
+  firewall.createFirewallPolicy(firewallPolicyCreateBody(props));

package/src/unifi/firewall-policy-form.ts

@@ -55,10 +55,17 @@ export const normalizeConnectionStateFilter = (
 ): string[] | undefined => (value == null ? undefined : sortedSet(value));
 
 /** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
- *  `network-form.ts`'s own header. */
+ *  `network-form.ts`'s own header.
+ *
+ * ⛔ `firewallPolicyId` IS OPTIONAL SINCE THE 2026-10-19 hf: CREATE LIFT. An adopt-only
+ *   declaration (`declareFirewallPolicy`, every imported row) always carries the vendor id it was
+ *   read from. A fresh `hf:` creatable declaration (`declareHfFirewallPolicy` below) does not have
+ *   one yet — the vendor assigns it on `createFirewallPolicy`'s response — so `spec.fetchLive`
+ *   (`firewall-policy.ts`) locates by `name` instead of `id` whenever this is absent (netbox's
+ *   `locateOne` is the precedent for identity-by-natural-key over identity-by-vendor-id). */
 export interface FirewallPolicyProps {
   siteId: string;
-  firewallPolicyId: string;
+  firewallPolicyId?: string | undefined;
   action: firewall.FirewallPolicyAction;
   /** Connection states this policy matches — compared as a SET, see the header. */
   connectionStateFilter?: string[] | undefined;

package/src/unifi/firewall-policy.test.ts

@@ -23,7 +23,13 @@ import * as Effect from 'effect/Effect';
 import { fakeFailure, fakeUnifi, fakeUnifiLayer } from './fake-unifi.ts';
 import { attributesOf } from './firewall-policy-form.ts';
 import { driftOf, matches } from './firewall-policy-drift.ts';
-import { type FirewallPolicyProps, declareFirewallPolicy, spec } from './firewall-policy.ts';
+import {
+  type FirewallPolicyProps,
+  declareFirewallPolicy,
+  hfFirewallPolicy,
+  spec,
+} from './firewall-policy.ts';
+import { UnifiCreateDidNotConverge, UnifiWriteRefused } from './policy.ts';
 import { pageAll } from './paginate.ts';
 import { unifiOperations } from './resource.ts';
 
@@ -152,6 +158,187 @@ describe('Unifi.FirewallPolicy write paths never reach the vendor API', () => {
   });
 });
 
+/**
+ * The hf: create lift (Tim 2026-10-19 ~16:20Z) -- the one write `Unifi.FirewallPolicy` may now
+ * make, and only for a declared `name` starting `hf: `. Mirrors the write-refusal tests above,
+ * plus the one path that now DOES reach the vendor API.
+ */
+const POLICIES_PATH = '/proxy/network/integration/v1/sites/site-1/firewall/policies';
+const NEW_ID = 'hf-new-1';
+
+const emptyPage = () => Response.json({ count: 0, data: [], limit: 0, offset: 0, totalCount: 0 });
+
+/** No `firewallPolicyId`: the shape `hfFirewallPolicy` declares before anything is created. */
+const HF_PROPS: FirewallPolicyProps = {
+  siteId: 'site-1',
+  action: { type: 'ALLOW', allowReturnTraffic: true },
+  destination: { zoneId: 'zone-storage' },
+  enabled: true,
+  ipProtocolScope: { ipVersion: 'IPV4' },
+  loggingEnabled: true,
+  name: 'hf: CT100 to NAS https',
+  source: { zoneId: 'zone-internal' },
+};
+
+describe('Unifi.FirewallPolicy hf: create', () => {
+  const ops = unifiOperations(spec);
+
+  test('an hf:-named create: one locate GET, one POST of only the declared fields, one read-back GET', async () => {
+    let createdLive: firewall.FirewallPolicy | undefined;
+    const fake = fakeUnifi((method, url) => {
+      if (url.pathname === POLICIES_PATH && method === 'GET') return emptyPage();
+      if (url.pathname === POLICIES_PATH && method === 'POST') {
+        createdLive = {
+          ...HF_PROPS,
+          id: NEW_ID,
+          index: 0,
+          metadata: { origin: 'USER' },
+        } as firewall.FirewallPolicy;
+        return Response.json(createdLive);
+      }
+      if (url.pathname === `${POLICIES_PATH}/${NEW_ID}` && method === 'GET') {
+        return Response.json(createdLive);
+      }
+      return fakeFailure(400, 'unexpected request');
+    });
+
+    const attrs = await Effect.runPromise(
+      ops.reconcile(HF_PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(attrs.firewallPolicyId).toBe(NEW_ID);
+    expect(attrs.name).toBe('hf: CT100 to NAS https');
+    expect(fake.seen.map((s) => `${s.method} ${s.path}`)).toEqual([
+      `GET ${POLICIES_PATH}?offset=0`,
+      `POST ${POLICIES_PATH}`,
+      `GET ${POLICIES_PATH}/${NEW_ID}`,
+    ]);
+    // ⛔ ONLY the declared fields -- no firewallPolicyId (there was none), no stray key.
+    // `siteId` is a path label (`T.Http`'s `uri: "/v1/sites/{siteId}/..."`), not a body field.
+    expect(fake.seen[1]?.body).toEqual({
+      action: { type: 'ALLOW', allowReturnTraffic: true },
+      destination: { zoneId: 'zone-storage' },
+      enabled: true,
+      ipProtocolScope: { ipVersion: 'IPV4' },
+      loggingEnabled: true,
+      name: 'hf: CT100 to NAS https',
+      source: { zoneId: 'zone-internal' },
+    });
+  });
+
+  test('a non-hf: name refuses create, typed, sending the existence GET but no write', async () => {
+    // ★ The existence GET (does a row this name already matches exist?) runs for every name --
+    //   the SAME GET a plain cold adoption needs (H6) -- and answers empty here. Only the WRITE
+    //   is refused: `fake.seen.every(GET)` is this file's own standing idiom for that proof.
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICIES_PATH
+        ? emptyPage()
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const notHf: FirewallPolicyProps = { ...HF_PROPS, name: 'Not hf-named' };
+    const failure = await Effect.runPromise(
+      Effect.flip(ops.reconcile(notHf).pipe(Effect.provide(fakeUnifiLayer(fake.fetch)))),
+    );
+    expect(failure).toBeInstanceOf(UnifiWriteRefused);
+    expect((failure as UnifiWriteRefused).action).toBe('create');
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+    expect(fake.seen.length).toBeGreaterThan(0);
+  });
+
+  test('"hf:foo" with no space after the colon is NOT an hf: name -- refused, no write', async () => {
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === POLICIES_PATH
+        ? emptyPage()
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const noSpace: FirewallPolicyProps = { ...HF_PROPS, name: 'hf:no-space' };
+    const failure = await Effect.runPromise(
+      Effect.flip(ops.reconcile(noSpace).pipe(Effect.provide(fakeUnifiLayer(fake.fetch)))),
+    );
+    expect(failure).toBeInstanceOf(UnifiWriteRefused);
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+  });
+
+  test('a read-back mismatch after the POST fails typed (UnifiCreateDidNotConverge), not silently', async () => {
+    const fake = fakeUnifi((method, url) => {
+      if (url.pathname === POLICIES_PATH && method === 'GET') return emptyPage();
+      if (url.pathname === POLICIES_PATH && method === 'POST') {
+        return Response.json({ ...HF_PROPS, id: NEW_ID, index: 0, metadata: { origin: 'USER' } });
+      }
+      if (url.pathname === `${POLICIES_PATH}/${NEW_ID}` && method === 'GET') {
+        // The read-back disagrees with what was declared (e.g. the console normalized `enabled`).
+        return Response.json({
+          ...HF_PROPS,
+          id: NEW_ID,
+          index: 0,
+          metadata: { origin: 'USER' },
+          enabled: false,
+        });
+      }
+      return fakeFailure(400, 'unexpected request');
+    });
+    const failure = await Effect.runPromise(
+      Effect.flip(ops.reconcile(HF_PROPS).pipe(Effect.provide(fakeUnifiLayer(fake.fetch)))),
+    );
+    expect(failure).toBeInstanceOf(UnifiCreateDidNotConverge);
+    expect((failure as UnifiCreateDidNotConverge).fields).toEqual(['enabled']);
+  });
+
+  test('an hf:-named row with an id that 404s refuses -- never silently creates a duplicate (Opus red team)', async () => {
+    // ★ THE SCENARIO THE RED TEAM FOUND: an hf:-named row that ALREADY has Alchemy state's
+    //   `firewallPolicyId` but whose live object is gone (state lost and rebuilt with no `olds`/
+    //   `output`, a hand-deleted-and-recreated rule, a wrong id in a generated declaration) must
+    //   still refuse "create" -- not fall through and POST a second copy just because the name
+    //   happens to start `hf: ` (Tim's own hand-made console rules already do).
+    const hfWithId: FirewallPolicyProps = { ...HF_PROPS, firewallPolicyId: 'fp-gone' };
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === `${POLICIES_PATH}/fp-gone`
+        ? fakeFailure(404, 'not found')
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const failure = await Effect.runPromise(
+      Effect.flip(ops.reconcile(hfWithId).pipe(Effect.provide(fakeUnifiLayer(fake.fetch)))),
+    );
+    expect(failure).toBeInstanceOf(UnifiWriteRefused);
+    expect((failure as UnifiWriteRefused).action).toBe('create');
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+  });
+
+  test('hfFirewallPolicy throws immediately when props already carries a firewallPolicyId', () => {
+    const withId = { ...HF_PROPS, firewallPolicyId: 'fp-1' };
+    expect(() => hfFirewallPolicy('bad', withId)).toThrow(/already carries a firewallPolicyId/);
+  });
+
+  test('update (drift) of an existing hf: row still refuses -- the lift is create only', async () => {
+    const hfWithId: FirewallPolicyProps = { ...HF_PROPS, firewallPolicyId: 'fp-hf-1' };
+    const fake = fakeUnifi((method, url) =>
+      method === 'GET' && url.pathname === `${POLICIES_PATH}/fp-hf-1`
+        ? Response.json({
+            ...HF_PROPS,
+            id: 'fp-hf-1',
+            index: 0,
+            metadata: { origin: 'USER' },
+            enabled: false,
+          })
+        : fakeFailure(400, 'unexpected request'),
+    );
+    const exit = await Effect.runPromiseExit(
+      ops.reconcile(hfWithId).pipe(Effect.provide(fakeUnifiLayer(fake.fetch))),
+    );
+    expect(exit._tag).toBe('Failure');
+    expect(fake.seen.every((s) => s.method === 'GET')).toBe(true);
+  });
+
+  test('delete of an hf: row still refuses -- no DELETE is ever sent', async () => {
+    const hfWithId: FirewallPolicyProps = { ...HF_PROPS, firewallPolicyId: 'fp-hf-1' };
+    const exit = await Effect.runPromiseExit(ops.destroy(hfWithId));
+    expect(exit._tag).toBe('Failure');
+  });
+
+  test('hfFirewallPolicy throws immediately for a name that is not hf:-prefixed', () => {
+    expect(() => hfFirewallPolicy('bad', { ...HF_PROPS, name: 'Not hf-named' })).toThrow(/hf: /);
+  });
+});
+
 describe("T9/B0b -- pageAll walks this family's own page shape (decode proof)", () => {
   test('every row across several pages of getFirewallPolicies decodes, in order', async () => {
     const rows = Array.from({ length: 7 }, (_, i) =>