@homeflare/alchemy 0.56.0 → 0.58.0

package/dist/unifi/index.js

@@ -1,7 +1,8 @@
 // src/unifi/policy.ts
 import * as Data from "effect/Data";
 import * as Effect from "effect/Effect";
-var UNIFI_WRITE_POLICY = "UniFi is adopt-only except Unifi.Network update: one whole-object PUT built from the live " + "object plus the declared field changes, only on a row with prior Alchemy state, only through " + "deploy-approve; create/delete and every other family stay refused -- widening is a kit change " + "(Tim 2026-10-10 lifts the 2026-09-24 rule for this one case)";
+var UNIFI_WRITE_POLICY = "UniFi is adopt-only except (1) Unifi.Network update: one whole-object PUT built from the live " + "object plus the declared field changes, only on a row with prior Alchemy state, only through " + 'deploy-approve; and (2) Unifi.FirewallPolicy create, only when the declared name starts "hf: ", ' + "one POST built from only the declared fields, read back and checked to match after; every " + "other create, every update of an hf: row, every delete and every other family stay refused -- " + "widening is a kit change (Tim 2026-10-10 lifts the 2026-09-24 rule for Network update, Tim " + "2026-10-19 lifts it again for hf:-named FirewallPolicy create)";
+var isHfPolicyName = (name) => name.startsWith("hf: ");
 var UNIFI_READ_ONLY_POLICY = UNIFI_WRITE_POLICY;
 
 class UnifiWriteRefused extends Data.TaggedError("UnifiWriteRefused") {
@@ -30,6 +31,12 @@ class UnifiUpdateDidNotConverge extends Data.TaggedError("UnifiUpdateDidNotConve
   }
 }
 
+class UnifiCreateDidNotConverge extends Data.TaggedError("UnifiCreateDidNotConverge") {
+  get message() {
+    return `${this.type} ${this.identity}: the POST created an object, but the read-back differs from ` + `the declaration on ${fieldList(this.fields)}. The object is on the console and is not ` + "rolled back; the next deploy will see this as drift. Recovery is a re-import of the live object.";
+  }
+}
+
 class UnifiFieldNotRemovable extends Data.TaggedError("UnifiFieldNotRemovable") {
   get message() {
     return `${this.type} ${this.identity}: refusing to remove ${fieldList(this.fields)}; a whole-object ` + "PUT turns an omitted block off, and only the removable allowlist may be dropped.";
@@ -311,6 +318,15 @@ var computePatch = (news, olds, patchKeys) => {
   }
   return { set, unset };
 };
+var acceptInto = (olds, news, accepted) => {
+  const next = { ...olds };
+  for (const field of accepted) {
+    const key = String(field);
+    if (key in news || key in next)
+      next[key] = news[key];
+  }
+  return next;
+};
 var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(function* () {
   const identity = spec.describe(news);
   const live = yield* spec.fetchLive(news);
@@ -327,15 +343,22 @@ var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(functi
   if (previous !== identity) {
     return yield* new UnifiIdentityChanged({ type: spec.type, identity, previous });
   }
+  const disagrees = new Set(update.driftOf(live, news).map((d) => String(d.field)));
   const drifted = update.driftOf(live, olds).map((d) => d.field);
-  if (drifted.length > 0) {
+  const conflicts = drifted.filter((field) => disagrees.has(String(field)));
+  if (conflicts.length > 0) {
     return yield* new UnifiLiveDriftedSinceDeploy({
       type: spec.type,
       identity,
-      fields: drifted
+      fields: conflicts
     });
   }
-  const patch = computePatch(news, olds, update.patchKeys);
+  const accepted = drifted.filter((field) => !disagrees.has(String(field)));
+  const baseline = acceptInto(olds, news, accepted);
+  if (accepted.length > 0) {
+    yield* note(`${spec.type} ${identity}: live edits since the last deploy already match the declaration, accepted: [${accepted.map(String).join(", ")}]`);
+  }
+  const patch = computePatch(news, baseline, update.patchKeys);
   if (Object.keys(patch.set).length === 0 && patch.unset.length === 0) {
     return yield* refuseWrite(spec.type, identity, "update");
   }
@@ -351,6 +374,28 @@ var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(functi
     fields: update.driftOf(written, news).map((d) => d.field)
   });
 });
+var createReconcile = (spec, news, note) => Effect5.gen(function* () {
+  const identity = spec.describe(news);
+  const create = spec.create;
+  if (create === undefined)
+    return yield* refuseWrite(spec.type, identity, "create");
+  yield* create.checkScope(news);
+  yield* note(`${spec.type} ${identity}: POST create`);
+  const written = yield* create.write(news);
+  const withId = create.identify(news, written);
+  const confirmed = yield* spec.fetchLive(withId);
+  if (confirmed === undefined) {
+    return yield* Effect5.die(new Error(`${spec.type} ${identity}: the create POST answered, but the read-back found nothing ` + "at the id it assigned. The object may or may not exist on the console; re-import " + "before trying again rather than retrying this create blindly."));
+  }
+  const attrs = spec.attributes(confirmed, withId);
+  if (spec.matches(attrs, withId))
+    return attrs;
+  return yield* new UnifiCreateDidNotConverge({
+    type: spec.type,
+    identity,
+    fields: create.driftOf(confirmed, withId).map((d) => d.field)
+  });
+});
 
 // src/unifi/resource.ts
 var unifiOperations = (spec) => {
@@ -371,12 +416,17 @@ var unifiOperations = (spec) => {
         return { action: "update" };
       return spec.matches(live, news) ? { action: "noop" } : { action: "update" };
     }),
-    reconcile: (news, rest = {}) => updateReconcile(spec, {
-      news,
-      olds: rest.olds,
-      output: rest.output,
-      note: rest.note ?? (() => Effect6.void)
-    }),
+    reconcile: (news, rest = {}) => {
+      const note = rest.note ?? (() => Effect6.void);
+      const create = spec.create;
+      if (create !== undefined && rest.olds === undefined && rest.output === undefined) {
+        return Effect6.gen(function* () {
+          const live = yield* spec.fetchLive(news);
+          return live === undefined ? yield* createReconcile(spec, news, note) : yield* updateReconcile(spec, { news, olds: undefined, output: undefined, note });
+        });
+      }
+      return updateReconcile(spec, { news, olds: rest.olds, output: rest.output, note });
+    },
     destroy: (olds) => refuseWrite(spec.type, spec.describe(olds), "delete")
   };
 };
@@ -394,7 +444,10 @@ var unifiHandlers = (spec) => {
       olds: args.olds,
       output: args.output,
       note: (message) => args.session.note(message)
-    }), spec.update ? [spec.update.allowedWrite(args.news)] : []),
+    }), [
+      ...spec.update ? [spec.update.allowedWrite(args.news)] : [],
+      ...spec.create && args.olds === undefined && args.output === undefined ? [spec.create.allowedWrite(args.news)] : []
+    ]),
     delete: (args) => withCredentials(ops.destroy(args.olds))
   };
 };
@@ -863,12 +916,66 @@ var UnifiWifiBroadcastProvider = () => Provider6.effect(UnifiWifiBroadcast, Effe
 import { Resource as Resource7 } from "alchemy";
 import { adopt as adopt7 } from "alchemy/AdoptPolicy";
 import * as Provider7 from "alchemy/Provider";
+import * as firewall3 from "@distilled.cloud/unifi-network/firewall";
+import * as Effect15 from "effect/Effect";
+
+// src/unifi/firewall-policy-create.ts
 import * as firewall2 from "@distilled.cloud/unifi-network/firewall";
 import * as Effect14 from "effect/Effect";
+var firewallPolicyCreateAllowedWrite = (props) => ({
+  method: "POST",
+  tail: `/v1/sites/${props.siteId}/firewall/policies`
+});
+var describeByName = (props) => `sites/${props.siteId}/firewall/policies/by-name/${props.name}`;
+var checkHfCreateScope = (props) => {
+  if (props.firewallPolicyId !== undefined) {
+    return refuseWrite("Unifi.FirewallPolicy", `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`, "create");
+  }
+  return isHfPolicyName(props.name) ? Effect14.void : refuseWrite("Unifi.FirewallPolicy", describeByName(props), "create");
+};
+var firewallPolicyCreateBody = (props) => ({
+  siteId: props.siteId,
+  action: props.action,
+  ...props.connectionStateFilter === undefined ? {} : { connectionStateFilter: props.connectionStateFilter },
+  ...props.description === undefined ? {} : { description: props.description },
+  destination: props.destination,
+  enabled: props.enabled,
+  ipProtocolScope: props.ipProtocolScope,
+  ...props.ipsecFilter === undefined ? {} : { ipsecFilter: props.ipsecFilter },
+  loggingEnabled: props.loggingEnabled,
+  name: props.name,
+  ...props.schedule === undefined ? {} : { schedule: props.schedule },
+  source: props.source
+});
+var writeFirewallPolicyCreate = (props) => firewall2.createFirewallPolicy(firewallPolicyCreateBody(props));
 
 // src/unifi/firewall-policy-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
 var normalizeConnectionStateFilter = (value) => value == null ? undefined : sortedSet4(value);
+var SET_ARRAY_KEYS = new Set([
+  "items",
+  "macAddresses",
+  "networkIds",
+  "applicationIds",
+  "regions",
+  "vpnServerIds",
+  "repeatOnDays",
+  "domains",
+  "applicationCategoryIds"
+]);
+var sortKeys = (value) => Array.isArray(value) ? value.map(sortKeys) : value !== null && typeof value === "object" ? Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])])) : value;
+var canonical = (value) => JSON.stringify(sortKeys(normalizeSetArrays(value)));
+var normalizeSetArrays = (value) => {
+  if (Array.isArray(value))
+    return value.map((v) => normalizeSetArrays(v));
+  if (value === null || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    out[key] = SET_ARRAY_KEYS.has(key) && Array.isArray(inner) ? [...inner].map((v) => normalizeSetArrays(v)).sort((x, y) => canonical(x) < canonical(y) ? -1 : canonical(x) > canonical(y) ? 1 : 0) : normalizeSetArrays(inner);
+  }
+  return out;
+};
 var attributesOf7 = (live, props) => ({
   siteId: props.siteId,
   firewallPolicyId: live.id,
@@ -911,14 +1018,30 @@ var fieldDrift7 = makeDriftOf([
     declared: (p) => normalizeConnectionStateFilter(p.connectionStateFilter)
   },
   { field: "description", live: (a) => a.description, declared: (p) => p.description },
-  { field: "destination", live: (a) => a.destination, declared: (p) => p.destination },
+  {
+    field: "destination",
+    live: (a) => normalizeSetArrays(a.destination),
+    declared: (p) => normalizeSetArrays(p.destination)
+  },
   { field: "enabled", live: (a) => a.enabled, declared: (p) => p.enabled },
-  { field: "ipProtocolScope", live: (a) => a.ipProtocolScope, declared: (p) => p.ipProtocolScope },
+  {
+    field: "ipProtocolScope",
+    live: (a) => normalizeSetArrays(a.ipProtocolScope),
+    declared: (p) => normalizeSetArrays(p.ipProtocolScope)
+  },
   { field: "ipsecFilter", live: (a) => a.ipsecFilter, declared: (p) => p.ipsecFilter },
   { field: "loggingEnabled", live: (a) => a.loggingEnabled, declared: (p) => p.loggingEnabled },
   { field: "name", live: (a) => a.name, declared: (p) => p.name },
-  { field: "schedule", live: (a) => a.schedule, declared: (p) => p.schedule },
-  { field: "source", live: (a) => a.source, declared: (p) => p.source }
+  {
+    field: "schedule",
+    live: (a) => normalizeSetArrays(a.schedule),
+    declared: (p) => normalizeSetArrays(p.schedule)
+  },
+  {
+    field: "source",
+    live: (a) => normalizeSetArrays(a.source),
+    declared: (p) => normalizeSetArrays(p.source)
+  }
 ]);
 var matches7 = (attributes, props) => fieldDrift7(attributes, props).length === 0;
 var driftOf7 = (live, props) => fieldDrift7(attributesOf7(live, props), props);
@@ -928,21 +1051,44 @@ var UnifiFirewallPolicy = Resource7("Unifi.FirewallPolicy", {
   defaultRemovalPolicy: "retain"
 });
 var firewallPolicy = (id, props) => UnifiFirewallPolicy(id, props).pipe(adopt7(true));
+var hfFirewallPolicy = (id, props) => {
+  if ("firewallPolicyId" in props && props.firewallPolicyId !== undefined) {
+    throw new Error(`hfFirewallPolicy(${id}): props already carries a firewallPolicyId -- this constructor is ` + "for a row that does not exist yet. A row with a vendor id is adopted or updated, never " + "created; use firewallPolicy() instead.");
+  }
+  if (!props.name.startsWith("hf: ")) {
+    throw new Error(`hfFirewallPolicy(${id}): name "${props.name}" does not start "hf: " -- only hf:-named ` + "policies may be created by this kit (Tim 2026-10-19); rename the declaration.");
+  }
+  return UnifiFirewallPolicy(id, props);
+};
+var locateByName = (siteId, name) => pageAll(firewall3.getFirewallPolicies, { siteId }).pipe(Effect15.map((rows) => {
+  const matching = rows.filter((row) => row.name === name);
+  if (matching.length > 1) {
+    throw new Error(`Unifi.FirewallPolicy: ${String(matching.length)} live policies are named "${name}" on ` + `site ${siteId}. A name this engine locates by must be unique; rename one on the console.`);
+  }
+  return matching[0];
+}));
 var spec7 = {
   type: "Unifi.FirewallPolicy",
-  describe: (props) => `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
-  fetchLive: (props) => firewall2.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect14.catchTag("NotFound", () => Effect14.succeed(undefined))),
+  describe: (props) => props.firewallPolicyId === undefined ? `sites/${props.siteId}/firewall/policies/by-name/${props.name}` : `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
+  fetchLive: (props) => props.firewallPolicyId === undefined ? locateByName(props.siteId, props.name) : firewall3.getFirewallPolicy({ siteId: props.siteId, firewallPolicyId: props.firewallPolicyId }).pipe(Effect15.catchTag("NotFound", () => Effect15.succeed(undefined))),
   attributes: attributesOf7,
-  matches: matches7
+  matches: matches7,
+  create: {
+    allowedWrite: firewallPolicyCreateAllowedWrite,
+    checkScope: checkHfCreateScope,
+    write: writeFirewallPolicyCreate,
+    identify: (props, written) => ({ ...props, firewallPolicyId: written.id }),
+    driftOf: driftOf7
+  }
 };
 var handlers7 = unifiHandlers(spec7);
-var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect14.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
+var UnifiFirewallPolicyProvider = () => Provider7.effect(UnifiFirewallPolicy, Effect15.succeed(UnifiFirewallPolicy.Provider.of(handlers7)));
 // src/unifi/firewall-policy-ordering.ts
 import { Resource as Resource8 } from "alchemy";
 import { adopt as adopt8 } from "alchemy/AdoptPolicy";
 import * as Provider8 from "alchemy/Provider";
-import * as firewall3 from "@distilled.cloud/unifi-network/firewall";
-import * as Effect15 from "effect/Effect";
+import * as firewall4 from "@distilled.cloud/unifi-network/firewall";
+import * as Effect16 from "effect/Effect";
 
 // src/unifi/firewall-policy-ordering-form.ts
 var attributesOf8 = (live, props) => ({
@@ -980,22 +1126,22 @@ var firewallPolicyOrdering = (id, props) => UnifiFirewallPolicyOrdering(id, prop
 var spec8 = {
   type: "Unifi.FirewallPolicyOrdering",
   describe: (props) => `sites/${props.siteId}/firewall/policies/ordering` + `?sourceFirewallZoneId=${props.sourceFirewallZoneId}` + `&destinationFirewallZoneId=${props.destinationFirewallZoneId}`,
-  fetchLive: (props) => firewall3.getFirewallPolicyOrdering({
+  fetchLive: (props) => firewall4.getFirewallPolicyOrdering({
     siteId: props.siteId,
     sourceFirewallZoneId: props.sourceFirewallZoneId,
     destinationFirewallZoneId: props.destinationFirewallZoneId
-  }).pipe(Effect15.catchTag("NotFound", () => Effect15.succeed(undefined))),
+  }).pipe(Effect16.catchTag("NotFound", () => Effect16.succeed(undefined))),
   attributes: attributesOf8,
   matches: matches8
 };
 var handlers8 = unifiHandlers(spec8);
-var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect15.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
+var UnifiFirewallPolicyOrderingProvider = () => Provider8.effect(UnifiFirewallPolicyOrdering, Effect16.succeed(UnifiFirewallPolicyOrdering.Provider.of(handlers8)));
 // src/unifi/traffic-matching-list.ts
 import { Resource as Resource9 } from "alchemy";
 import { adopt as adopt9 } from "alchemy/AdoptPolicy";
 import * as Provider9 from "alchemy/Provider";
 import * as trafficMatchingLists from "@distilled.cloud/unifi-network/traffic_matching_lists";
-import * as Effect16 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 
 // src/unifi/traffic-matching-list-form.ts
 var attributesOf9 = (live, props) => ({
@@ -1031,12 +1177,12 @@ var spec9 = {
   fetchLive: (props) => trafficMatchingLists.getTrafficMatchingList({
     siteId: props.siteId,
     trafficMatchingListId: props.trafficMatchingListId
-  }).pipe(Effect16.catchTag("NotFound", () => Effect16.succeed(undefined))),
+  }).pipe(Effect17.catchTag("NotFound", () => Effect17.succeed(undefined))),
   attributes: attributesOf9,
   matches: matches9
 };
 var handlers9 = unifiHandlers(spec9);
-var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect16.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
+var UnifiTrafficMatchingListProvider = () => Provider9.effect(UnifiTrafficMatchingList, Effect17.succeed(UnifiTrafficMatchingList.Provider.of(handlers9)));
 // src/unifi/providers.ts
 import * as Layer from "effect/Layer";
 var providers = () => Layer.mergeAll(UnifiNetworkProvider(), UnifiFirewallZoneProvider(), UnifiDnsPolicyProvider(), UnifiAclRuleProvider(), UnifiAclRuleOrderingProvider(), UnifiWifiBroadcastProvider(), UnifiFirewallPolicyProvider(), UnifiFirewallPolicyOrderingProvider(), UnifiTrafficMatchingListProvider());
@@ -1095,6 +1241,7 @@ export {
   firewallZone,
   driftOf2 as firewallZoneDriftOf,
   guardedHttpClient,
+  hfFirewallPolicy,
   network,
   driftOf as networkDriftOf,
   providers,
@@ -1104,5 +1251,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=04975D29327C722564756E2164756E21
+//# debugId=D14D4404F58A5F1264756E2164756E21
 //# sourceMappingURL=index.js.map