@homeflare/alchemy 0.56.0 → 0.58.0

package/dist/unifi/network-update.fixtures.d.ts

@@ -0,0 +1,53 @@
+import { type NetworkProps } from './network.ts';
+export declare const PATH = "/proxy/network/integration/v1/sites/site-1/networks/net-1";
+export declare const IPV6: {
+    interfaceType: string;
+    prefixLength: number;
+    hostIpAddress: string;
+    clientAddressAssignment: {
+        slaacEnabled: boolean;
+    };
+    routerAdvertisement: {
+        priority: string;
+    };
+};
+export declare const BASE: NetworkProps;
+export declare const WITH_V6: NetworkProps;
+/** Raw live object, with a key the SDK schema has never heard of. */
+export declare const live: (extra?: Record<string, unknown>) => {
+    name: string;
+    enabled: boolean;
+    management: string;
+    vlanId: number;
+    dhcpGuarding?: import("@distilled.cloud/unifi-network/networks").NetworkDHCPGuarding | undefined;
+    cellularBackupEnabled?: boolean | undefined;
+    internetAccessEnabled?: boolean | undefined;
+    ipv4Configuration?: unknown;
+    ipv6Configuration?: import("@distilled.cloud/unifi-network/networks").NetworkIPv6Configuration | undefined;
+    isolationEnabled?: boolean | undefined;
+    mdnsForwardingEnabled?: boolean | undefined;
+    zoneId?: string | undefined;
+    deviceId?: string | undefined;
+    id: string;
+    default: boolean;
+    metadata: {
+        origin: string;
+    };
+    futureTopLevelKey: string;
+    siteId: undefined;
+    networkId: undefined;
+};
+export declare const reconcile: (route: (method: string, url: URL) => Response, news: NetworkProps, olds: NetworkProps | undefined, outputArg?: object | null) => {
+    fake: {
+        fetch: typeof fetch;
+        seen: import("./fake-unifi.ts").Seen[];
+    };
+    notes: string[];
+    exit: Promise<import("effect/Exit").Exit<import("./network-form.ts").NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity>>;
+};
+export declare const answering: (liveBody: object, put?: () => Response) => (method: string, url: URL) => Response;
+export declare const putBody: (seen: ReadonlyArray<{
+    method: string;
+    body?: unknown;
+}>) => Record<string, unknown>[];
+//# sourceMappingURL=network-update.fixtures.d.ts.map

package/dist/unifi/network-update.fixtures.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"network-update.fixtures.d.ts","sourceRoot":"","sources":["../../src/unifi/network-update.fixtures.ts"],"names":[],"mappings":"AAQA,OAAO,EAAE,KAAK,YAAY,EAAQ,MAAM,cAAc,CAAC;AAGvD,eAAO,MAAM,IAAI,8DAA8D,CAAC;AAChF,eAAO,MAAM,IAAI;IACf,aAAa;IACb,YAAY;IACZ,aAAa;IACb,uBAAuB;QAAI,YAAY;;IACvC,mBAAmB;QAAI,QAAQ;;CAChC,CAAC;AAEF,eAAO,MAAM,IAAI,EAAE,YASlB,CAAC;AACF,eAAO,MAAM,OAAO,EAA2C,YAAY,CAAC;AAE5E,qEAAqE;AACrE,eAAO,MAAM,IAAI,WAAW,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC;;;;;;;;;;;;;;;;;QAGrC,MAAM;;;;;CAMlB,CAAC;AAEH,eAAO,MAAM,SAAS,UACb,CAAC,MAAM,EAAE,MAAM,EAAE,GAAG,EAAE,GAAG,KAAK,QAAQ,QACvC,YAAY,QACZ,YAAY,GAAG,SAAS,cACnB,MAAM,GAAG,IAAI;;;;;;;CAazB,CAAC;AAEF,eAAO,MAAM,SAAS,aACT,MAAM,QAAO,MAAM,QAAQ,cAC7B,MAAM,OAAO,GAAG,aAKW,CAAC;AAEvC,eAAO,MAAM,OAAO,SAAU,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,CAAC,EAAE,OAAO,CAAA;CAAE,CAAC,8BACO,CAAC"}

package/dist/unifi/network.d.ts

@@ -80,7 +80,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<NetworkAttributes, import("@distilled.cloud/caddy").BadGateway | import("@distilled.cloud/caddy").BadRequest | import("@distilled.cloud/caddy").ConfigError | import("@distilled.cloud/caddy").Conflict | import("@distilled.cloud/caddy").Forbidden | import("@distilled.cloud/caddy").GatewayTimeout | import("effect/http/HttpClientError").HttpClientError | import("@distilled.cloud/caddy").InternalServerError | import("@distilled.cloud/caddy").NotFound | import("@distilled.cloud/caddy").ServiceUnavailable | import("@distilled.cloud/caddy").TooManyRequests | import("@distilled.cloud/caddy").Unauthorized | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiFieldNotRemovable | import("./policy.ts").UnifiFieldNotSettable | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiImmutableFieldChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiManagementNetworkRefused | import("@distilled.cloud/unifi-network/Errors").UnifiNetworkParseError | import("./policy.ts").UnifiUpdateDidNotConverge | UnifiUpdateWouldBeNoop | import("./policy.ts").UnifiWriteRefused | import("@distilled.cloud/unifi-network/Errors").UnknownUnifiNetworkError | import("@distilled.cloud/caddy").UnprocessableEntity, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: NetworkProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/policy.d.ts

@@ -1,5 +1,13 @@
 import * as Effect from 'effect/Effect';
 export declare const UNIFI_WRITE_POLICY: string;
+/**
+ * ⛔ THE ONE GATE THAT DECIDES "hf:" (Tim 2026-10-19, `nas-firewall`'s own naming:
+ *   `hf: CT100 to NAS https`). The space after the colon is deliberate and checked: `"hf:foo"`
+ *   (no space) is NOT an hf: name under this policy, so a typo can never silently slip past the
+ *   create gate by omitting it. Exported so `firewall-policy-create.ts`'s `checkScope` and every
+ *   test that proves the boundary use this ONE function, never a second regex hand-copied nearby.
+ */
+export declare const isHfPolicyName: (name: string) => boolean;
 /** @deprecated renamed `UNIFI_WRITE_POLICY`; kept so existing consumer imports do not break. */
 export declare const UNIFI_READ_ONLY_POLICY: string;
 /** What kind of write was asked for and refused — for the message only, never acted on. */
@@ -50,6 +58,20 @@ export declare class UnifiUpdateDidNotConverge extends UnifiUpdateDidNotConverge
 }> {
     get message(): string;
 }
+declare const UnifiCreateDidNotConverge_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "UnifiCreateDidNotConverge";
+} & Readonly<A>;
+/** The POST answered, a read-back ran, yet the read-back object still differs from the
+ *  declaration — the hf: create path's own convergence check (`create-reconcile.ts`'s sibling in
+ *  `update-reconcile.ts`), same shape as `UnifiUpdateDidNotConverge` for the same reason: the
+ *  object now exists on the console, unrolled-back, so the operator needs to know and re-import. */
+export declare class UnifiCreateDidNotConverge extends UnifiCreateDidNotConverge_base<{
+    readonly type: string;
+    readonly identity: string;
+    readonly fields: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
 declare const UnifiFieldNotRemovable_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "UnifiFieldNotRemovable";
 } & Readonly<A>;

package/dist/unifi/policy.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAgBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAIiC,CAAC;AAEjE,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}
+{"version":3,"file":"policy.d.ts","sourceRoot":"","sources":["../../src/unifi/policy.ts"],"names":[],"mappings":"AAmBA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,eAAO,MAAM,kBAAkB,QAOmC,CAAC;AAEnE;;;;;;GAMG;AACH,eAAO,MAAM,cAAc,SAAU,MAAM,KAAG,OAAkC,CAAC;AAEjF,gGAAgG;AAChG,eAAO,MAAM,sBAAsB,QAAqB,CAAC;AAEzD,2FAA2F;AAC3F,MAAM,MAAM,gBAAgB,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,CAAC;;;;AAE9D,qBAAa,iBAAkB,SAAQ,uBAAsC;IAC3E,oDAAoD;IACpD,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,wEAAwE;IACxE,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,gBAAgB,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,2FAA2F;AAC3F,eAAO,MAAM,WAAW,SAAU,MAAM,YAAY,MAAM,UAAU,gBAAgB,mDACpB,CAAC;;;;AAMjE,0FAA0F;AAC1F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,6EAA6E;AAC7E,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;oGAGoG;AACpG,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAKD,mGAAmG;AACnG,qBAAa,sBAAuB,SAAQ,4BAA2C;IACrF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,wGAAwG;AACxG,qBAAa,qBAAsB,SAAQ,2BAA0C;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED,iFAAiF;AACjF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,sFAAsF;AACtF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,+FAA+F;AAC/F,qBAAa,oBAAqB,SAAQ,0BAAyC;IACjF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF"}

package/dist/unifi/resource.d.ts

@@ -2,7 +2,7 @@ import type { Input } from 'alchemy/Input';
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type * as HttpClient from 'effect/http/HttpClient';
-import { type ReconcileArgs, type UnifiUpdate } from './update-reconcile.ts';
+import { type ReconcileArgs, type UnifiCreate, type UnifiUpdate } from './update-reconcile.ts';
 /** What every handler needs from the caller's runtime once `CredentialsFromEnv` is baked in. */
 export type UnifiRequirements = HttpClient.HttpClient;
 /**
@@ -11,7 +11,7 @@ export type UnifiRequirements = HttpClient.HttpClient;
  * union, with `NotFound` already folded away) so the precise per-operation error union flows
  * through instead of being widened by hand here. `E2` is the error union of the optional write.
  */
-export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never> = {
+export type UnifiSpec<Props extends object, Live, Attributes extends object, E, E2 = never, E3 = never> = {
     /** The vendor type string, e.g. `Unifi.Network` — for the refusal message only. */
     readonly type: string;
     /** Already folds a genuine not-found to `undefined`; nothing else is folded (see header). */
@@ -22,8 +22,11 @@ export type UnifiSpec<Props extends object, Live, Attributes extends object, E,
     readonly describe: (props: Props) => string;
     /** Present only on a family allowed to write (`Unifi.Network`); see `update-reconcile.ts`. */
     readonly update?: UnifiUpdate<Props, Live, E2>;
+    /** Present only on a family allowed to create (`Unifi.FirewallPolicy`, `hf:` rows only); see
+     *  `update-reconcile.ts`'s `createReconcile`. */
+    readonly create?: UnifiCreate<Props, Live, E3>;
 };
-export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiOperations: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     read: (props: Props) => Effect.Effect<Attributes | undefined, E, UnifiNetworkOpContext>;
     readHandler: ({ olds, output }: {
         olds: Props;
@@ -34,8 +37,24 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
     } | {
         readonly action: 'noop';
     } | undefined, E, UnifiNetworkOpContext>;
-    /** Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset. */
-    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+    /**
+     * Pre-state callers (tests, adopt-only probes) pass just `news`: `olds`/`output` unset — the
+     * SAME calling convention a plain cold adoption already uses (H6), so the existence GET must
+     * run FIRST, for every name, exactly as it always has: a row that already exists is adopted
+     * (exact match, zero writes) regardless of its name, and ONLY an absent row ever reaches
+     * `create.checkScope`. "A non-hf: create sends nothing" therefore means no WRITE (no
+     * POST/PUT/DELETE) — the same guarantee every other refusal in this engine gives, and the one
+     * `wire-guard.ts`'s allow list enforces at the wire; the existence GET is not a write.
+     *
+     * ⛔ THE CREATE BRANCH ONLY RUNS WHEN THERE IS NO PRIOR STATE AT ALL (`olds`/`output` both
+     *   absent — a genuine first deploy, never a re-declare of an adopted row) AND the family
+     *   declares `create` AND the live read comes back absent. A row that already exists (someone
+     *   else's object with a colliding identity, or a retried deploy that already created it)
+     *   takes the ordinary `updateReconcile` path instead — exact match reports with zero writes,
+     *   anything else refuses (there is no `olds` to PUT a patch against, so it can never silently
+     *   fall through to an update of an existing row).
+     */
+    reconcile: (news: Props, rest?: Partial<Omit<ReconcileArgs<Props>, 'news'>>) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
     destroy: (olds: Props) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, never>;
 };
 /**
@@ -44,7 +63,7 @@ export declare const unifiOperations: <Props extends object, Live, Attributes ex
  * ⛔ `list` ANSWERS EMPTY. `GET /v1/sites/{siteId}/networks` answers every network on the site;
  *   adoption stays explicit, the same reasoning `Proxmox.User`'s and NetBox's `list` give.
  */
-export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>) => {
+export declare const unifiHandlers: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>) => {
     list: () => Effect.Effect<never[], never, never>;
     read: (args: {
         olds: Props;
@@ -65,7 +84,7 @@ export declare const unifiHandlers: <Props extends object, Live, Attributes exte
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<Attributes, E | E2 | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
+    }) => Effect.Effect<Attributes, E | E2 | E3 | import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;
     delete: (args: {
         olds: Props;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, HttpClient.HttpClient>;

package/dist/unifi/resource.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AAsCA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,WAAW,EAAmB,MAAM,uBAAuB,CAAC;AAG9F,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,GAAG,KAAK,IAAI;IAC5F,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;kBAE1B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB,4FAA4F;sBAC1E,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAQ1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QAClF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;IAe7C,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBA5CtB,QAAQ;;yBAElC,MAAM;;IA6CzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAWD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}
+{"version":3,"file":"resource.d.ts","sourceRoot":"","sources":["../../src/unifi/resource.ts"],"names":[],"mappings":"AA0CA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAE3C,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAE1D,OAAO,EACL,KAAK,aAAa,EAClB,KAAK,WAAW,EAChB,KAAK,WAAW,EAGjB,MAAM,uBAAuB,CAAC;AAG/B,gGAAgG;AAChG,MAAM,MAAM,iBAAiB,GAAG,UAAU,CAAC,UAAU,CAAC;AAEtD;;;;;GAKG;AACH,MAAM,MAAM,SAAS,CACnB,KAAK,SAAS,MAAM,EACpB,IAAI,EACJ,UAAU,SAAS,MAAM,EACzB,CAAC,EACD,EAAE,GAAG,KAAK,EACV,EAAE,GAAG,KAAK,IACR;IACF,mFAAmF;IACnF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6FAA6F;IAC7F,QAAQ,CAAC,SAAS,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,GAAG,SAAS,EAAE,CAAC,EAAE,qBAAqB,CAAC,CAAC;IAChG,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,UAAU,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,CAAC,UAAU,EAAE,UAAU,EAAE,KAAK,EAAE,KAAK,KAAK,OAAO,CAAC;IACpE,sDAAsD;IACtD,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC;IAC5C,8FAA8F;IAC9F,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/C;qDACiD;IACjD,QAAQ,CAAC,MAAM,CAAC,EAAE,WAAW,CAAC,KAAK,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;CAChD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;kBAE9B,KAAK;oCAQQ;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;iBAUlE,KAAK,CAAC,KAAK,CAAC,UAAU,UAAU,GAAG,SAAS;yBAIZ,QAAQ;;yBAElC,MAAM;;IAIzB;;;;;;;;;;;;;;;;OAgBG;sBACe,KAAK,SAAQ,OAAO,CAAC,IAAI,CAAC,aAAa,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC,CAAC;oBAc1D,KAAK;CAExB,CAAC;AAEF;;;;;GAKG;AACH,eAAO,MAAM,aAAa,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACtF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC;IAejD,IAAI;IACJ,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;IAE5D,IAAI,SAAS;QAAE,IAAI,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;QAAC,MAAM,EAAE,UAAU,GAAG,SAAS,CAAA;KAAE;yBAlEtB,QAAQ;;yBAElC,MAAM;;IAmEzB,SAAS,SAAS;QAChB,IAAI,EAAE,KAAK,CAAC;QACZ,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;QACxB,MAAM,EAAE,UAAU,GAAG,SAAS,CAAC;QAC/B,OAAO,EAAE;YAAE,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,CAAA;SAAE,CAAC;KAC3E;IAqBD,MAAM,SAAS;QAAE,IAAI,EAAE,KAAK,CAAA;KAAE;CAEjC,CAAC"}

package/dist/unifi/traffic-matching-list.d.ts

@@ -47,7 +47,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<TrafficMatchingListAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | trafficMatchingLists.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: TrafficMatchingListProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/update-reconcile.d.ts

@@ -1,7 +1,7 @@
 import type { UnifiNetworkOpContext } from '@distilled.cloud/unifi-network/Protocol';
 import * as Effect from 'effect/Effect';
 import type { FieldDrift } from './drift.ts';
-import { UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
+import { UnifiCreateDidNotConverge, UnifiIdentityChanged, UnifiLiveDriftedSinceDeploy, UnifiUpdateDidNotConverge } from './policy.ts';
 import type { UnifiSpec } from './resource.ts';
 import type { AllowedWrite } from './wire-guard.ts';
 export type Patch<Props> = {
@@ -27,5 +27,39 @@ export type ReconcileArgs<Props extends object> = {
     readonly output: unknown;
     readonly note: (message: string) => Effect.Effect<void>;
 };
-export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2>(spec: UnifiSpec<Props, Live, Attributes, E, E2>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+export declare const updateReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, { news, olds, output, note }: ReconcileArgs<Props>) => Effect.Effect<Attributes, E | E2 | UnifiIdentityChanged | UnifiLiveDriftedSinceDeploy | UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
+/**
+ * The write half of a CREATE-capable family: today, only `Unifi.FirewallPolicy`, and only for an
+ * `hf:`-named row (`policy.ts`'s `isHfPolicyName`). Deliberately NOT a merge-with-live update —
+ * there is no live object yet — so there is no `patchKeys`/`checkScope(live, patch, …)` here: a
+ * create sends exactly the fields the declaration owns, nothing echoed from elsewhere, nothing to
+ * accidentally reset.
+ *
+ * ⛔ `checkScope` RUNS BEFORE THE POST (same ordering `update.checkScope` already has): a
+ *   non-`hf:` name is refused here, typed, never reaching the wire at all.
+ * ★ `identify` CLOSES THE LOOP FROM THE POST'S RESPONSE TO A FRESH GET. The vendor assigns the id
+ *   on create; `write`'s response carries it, but a response body is not proof the object is
+ *   actually readable back (`createReconcile` re-fetches with the id `identify` folds in, rather
+ *   than trusting the POST's own echo — same reasoning `network-update.ts`'s header gives for
+ *   never trusting a write's own response over a real read).
+ */
+export type UnifiCreate<Props extends object, Live, E3> = {
+    /** The one POST the wire guard may pass for this family (the site's fixed collection route,
+     *  built from `props` the same way `UnifiUpdate.allowedWrite` reads a row's ids from `props`). */
+    readonly allowedWrite: (props: Props) => AllowedWrite;
+    /** Refuses (typed, before any note or request) a create outside this family's write scope. */
+    readonly checkScope: (props: Props) => Effect.Effect<void, E3>;
+    readonly write: (props: Props) => Effect.Effect<Live, E3, UnifiNetworkOpContext>;
+    /** `props` plus the vendor id the POST's response assigned, for the read-back `fetchLive`. */
+    readonly identify: (props: Props, written: Live) => Props;
+    readonly driftOf: (live: Live, props: Props) => ReadonlyArray<FieldDrift>;
+};
+/**
+ * CREATE for a family whose live read came back absent AND which has no prior Alchemy state
+ * (`resource.ts`'s `unifiOperations.reconcile` is the only caller, and only under that same
+ * condition — see its own header). Refuses (untyped-to-typed, same `refuseWrite` every other
+ * refusal uses) when the family declares no `create` at all; `create.checkScope` then refuses
+ * again, more specifically, for a declared row the create scope itself does not allow.
+ */
+export declare const createReconcile: <Props extends object, Live, Attributes extends object, E, E2, E3>(spec: UnifiSpec<Props, Live, Attributes, E, E2, E3>, news: Props, note: (message: string) => Effect.Effect<void, never, never>) => Effect.Effect<Attributes, E | E3 | UnifiCreateDidNotConverge | import("./policy.ts").UnifiWriteRefused, UnifiNetworkOpContext>;
 //# sourceMappingURL=update-reconcile.d.ts.map

package/dist/unifi/update-reconcile.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAEF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,QACpF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC,gCACjB,aAAa,CAAC,KAAK,CAAC,wLA2ChD,CAAC"}
+{"version":3,"file":"update-reconcile.d.ts","sourceRoot":"","sources":["../../src/unifi/update-reconcile.ts"],"names":[],"mappings":"AA2BA,OAAO,KAAK,EAAE,qBAAqB,EAAE,MAAM,yCAAyC,CAAC;AACrF,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAC7C,OAAO,EACL,yBAAyB,EACzB,oBAAoB,EACpB,2BAA2B,EAC3B,yBAAyB,EAE1B,MAAM,aAAa,CAAC;AACrB,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,eAAe,CAAC;AAC/C,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAEpD,MAAM,MAAM,KAAK,CAAC,KAAK,IAAI;IAAE,GAAG,EAAE,OAAO,CAAC,KAAK,CAAC,CAAC;IAAC,KAAK,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAA;CAAE,CAAC;AAEtF,mGAAmG;AACnG,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD,2FAA2F;IAC3F,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,KAAK,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;IAC1E,6FAA6F;IAC7F,QAAQ,CAAC,UAAU,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EAAE,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAChG,QAAQ,CAAC,KAAK,EAAE,CACd,IAAI,EAAE,IAAI,EACV,KAAK,EAAE,KAAK,CAAC,KAAK,CAAC,EACnB,KAAK,EAAE,KAAK,KACT,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;CACrD,CAAC;AAEF,gGAAgG;AAChG,eAAO,MAAM,YAAY,GAAI,KAAK,SAAS,MAAM,QACzC,KAAK,QACL,KAAK,aACA,aAAa,CAAC,MAAM,KAAK,CAAC,KACpC,KAAK,CAAC,KAAK,CASb,CAAC;AAiBF,MAAM,MAAM,aAAa,CAAC,KAAK,SAAS,MAAM,IAAI;IAChD,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IACrB,QAAQ,CAAC,IAAI,EAAE,KAAK,GAAG,SAAS,CAAC;IACjC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;CACzD,CAAC;AAEF,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,gCACrB,aAAa,CAAC,KAAK,CAAC,wLA8DhD,CAAC;AAEL;;;;;;;;;;;;;;GAcG;AACH,MAAM,MAAM,WAAW,CAAC,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,EAAE,IAAI;IACxD;sGACkG;IAClG,QAAQ,CAAC,YAAY,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,YAAY,CAAC;IACtD,8FAA8F;IAC9F,QAAQ,CAAC,UAAU,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,CAAC,CAAC;IAC/D,QAAQ,CAAC,KAAK,EAAE,CAAC,KAAK,EAAE,KAAK,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,EAAE,EAAE,qBAAqB,CAAC,CAAC;IACjF,8FAA8F;IAC9F,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,IAAI,KAAK,KAAK,CAAC;IAC1D,QAAQ,CAAC,OAAO,EAAE,CAAC,IAAI,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,KAAK,aAAa,CAAC,UAAU,CAAC,CAAC;CAC3E,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,eAAe,GAAI,KAAK,SAAS,MAAM,EAAE,IAAI,EAAE,UAAU,SAAS,MAAM,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,QACxF,SAAS,CAAC,KAAK,EAAE,IAAI,EAAE,UAAU,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,QAC7C,KAAK,QACL,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,KAAK,EAAE,KAAK,CAAC,mIA8B1D,CAAC"}

package/dist/unifi/wifi-broadcast.d.ts

@@ -69,7 +69,7 @@ export declare const handlers: {
         session: {
             note: (message: string) => Effect.Effect<void, never, never>;
         };
-    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
+    }) => Effect.Effect<WifiBroadcastAttributes, import("./policy.ts").UnifiCreateDidNotConverge | import("./policy.ts").UnifiIdentityChanged | import("./policy.ts").UnifiLiveDriftedSinceDeploy | UnifiPaginationInconsistent | import("./policy.ts").UnifiUpdateDidNotConverge | import("./policy.ts").UnifiWriteRefused | wifiBroadcasts.UnifiNetworkOpError, import("effect/http/HttpClient").HttpClient>;
     delete: (args: {
         olds: WifiBroadcastProps;
     }) => Effect.Effect<never, import("./policy.ts").UnifiWriteRefused, import("effect/http/HttpClient").HttpClient>;

package/dist/unifi/wire-guard.d.ts

@@ -5,7 +5,7 @@ import * as HttpClient from 'effect/http/HttpClient';
  * `baseUrl + tail` and requires an empty query and fragment (`isAllowed`).
  */
 export type AllowedWrite = {
-    readonly method: 'PUT';
+    readonly method: 'PUT' | 'POST';
     readonly tail: string;
 };
 export declare class UnifiRefusedRequest extends Error {

package/dist/unifi/wire-guard.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAkCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAE7E,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}
+{"version":3,"file":"wire-guard.d.ts","sourceRoot":"","sources":["../../src/unifi/wire-guard.ts"],"names":[],"mappings":"AAyCA,OAAO,KAAK,UAAU,MAAM,wBAAwB,CAAC;AAKrD;;;;GAIG;AACH,MAAM,MAAM,YAAY,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,KAAK,GAAG,MAAM,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;AAEtF,qBAAa,mBAAoB,SAAQ,KAAK;IAE1C,QAAQ,CAAC,MAAM,EAAE,MAAM;IACvB,+DAA+D;IAC/D,QAAQ,CAAC,IAAI,EAAE,MAAM;IAHvB,YACW,MAAM,EAAE,MAAM;IACvB,+DAA+D;IACtD,IAAI,EAAE,MAAM,EACrB,MAAM,SAAiC,EASxC;CACF;AAED,iGAAiG;AACjG,eAAO,MAAM,kBAAkB,4BAAsB,CAAC;AACtD,MAAM,MAAM,kBAAkB,GAAG,mBAAmB,CAAC;AA0FrD;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,UAAW,aAAa,CAAC,YAAY,CAAC,YAAY,MAAM,sFASrF,CAAC;AAkBF;;;GAGG;AACH,eAAO,MAAM,iBAAiB,mFAAwB,CAAC"}

package/docs/distilled-interim.md

@@ -122,8 +122,10 @@ Two checks, both real, neither skippable:
 No special-casing: add a changeset (`bun changeset`, minor — new package),
 push, merge. `scripts/publish.ts` packs with `bun pm pack` (resolves
 `workspace:`/`catalog:` the way `npm pack` cannot) and publishes with `npm
-publish --provenance` from CI. `README.md`/`LICENSE`/`scripts/smoke.ts` ship
-in `files`; nothing about the release pipeline needs to know this package is
+publish --provenance` from CI. `README.md`/`LICENSE` ship in `files`;
+`scripts/smoke.ts` is outside `files` so it never packs — `scripts/pack.ts`
+additionally strips the `scripts`/`devDependencies` manifest fields at pack
+time. Nothing about the release pipeline needs to know this package is
 an interim stand-in.
 
 ### 5. Alias it in, then cut over later

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.56.0",
+  "version": "0.58.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/unifi/firewall-policy-create.ts

@@ -0,0 +1,94 @@
+/**
+ * `Unifi.FirewallPolicy`'s CREATE — the one write this family may make, and only for a row whose
+ * declared `name` passes `policy.ts`'s `isHfPolicyName` (Tim 2026-10-19 ~16:20Z, "Allow kit to
+ * create hf: rules"). THE ONLY FILE UNDER `src/unifi` ALLOWED TO NAME `createFirewallPolicy`
+ * (`write-op-reference.test.ts`'s `WRITE_OP_ALLOWLIST` pins that, alongside `network-update.ts`'s
+ * own `updateNetwork` entry).
+ *
+ * ⛔ A CREATE SENDS ONLY THE FIELDS THE DECLARATION OWNS — NEVER A SPREAD OF ANYTHING ELSE. Unlike
+ *   `network-update.ts`'s whole-object PUT (which must carry the untouched live object forward so
+ *   an omitted optional block is not read by the controller as "turn it off"), there IS no live
+ *   object yet: `createBody` builds `CreateFirewallPolicyRequest` field by field from `props`,
+ *   omitting every optional key `props` itself leaves `undefined` rather than sending it as
+ *   `null`/`undefined` (UniFi's "missing = off" rule cuts both ways — a key that is actually absent
+ *   from the JSON body is what "this policy does not restrict on this axis" means here, same as a
+ *   declaration that never sets `connectionStateFilter` means "match every connection state").
+ * ⛔ `checkScope` RUNS BEFORE THE REQUEST, TYPED, NEVER A STRING COMPARISON INLINE AT THE CALL
+ *   SITE — one function (`policy.ts`'s `isHfPolicyName`) decides "hf:" everywhere this boundary is
+ *   checked, so a future second caller cannot drift from this one with a slightly different regex.
+ *
+ * 🔴 `checkScope` ALSO REFUSES A `firewallPolicyId` THAT IS ALREADY SET (Opus red team,
+ *   2026-10-19, PRIMARY FINDING). `resource.ts`'s `create` branch runs for EVERY
+ *   `Unifi.FirewallPolicy` declaration with no prior Alchemy state, not only ones meant to
+ *   create — including every `firewallPolicy()` import `.pipe(adopt(true))`, and Tim's own live
+ *   console ALREADY names hand-made rules `hf: <desc>` (this file's sibling `policy.ts` cites
+ *   `hf: Vpn to MGMT (Magic WAN site-to-site)` as the existing convention). Before this check, an
+ *   hf:-named IMPORTED row whose `firewallPolicyId` stopped resolving (state lost, the rule
+ *   hand-deleted and recreated with a new id, a wrong id in a generated declaration) would GET
+ *   404, fall into `createReconcile`, pass the name check, and POST A DUPLICATE — silently, with
+ *   a green plan, where every other family still refuses "declared row absent" outright
+ *   (`update-reconcile.ts`'s original behavior, unchanged for every family but this one). A
+ *   declaration carrying a vendor id is BY DEFINITION an existing row, adopted or updated, never
+ *   a fresh create; `firewallPolicyId !== undefined` is refused here before `isHfPolicyName` is
+ *   even checked, so this holds regardless of what the name says.
+ */
+import * as firewall from '@distilled.cloud/unifi-network/firewall';
+import * as Effect from 'effect/Effect';
+import { isHfPolicyName, refuseWrite } from './policy.ts';
+import type { FirewallPolicyProps } from './firewall-policy-form.ts';
+import type { AllowedWrite } from './wire-guard.ts';
+
+/** The site's fixed firewall-policies COLLECTION route — never a per-row path, since there is no
+ *  row id before this POST creates one. Takes `props` (not just a bare `siteId`) to match
+ *  `UnifiUpdate.allowedWrite`'s own shape, so `resource.ts`'s wiring treats both the same way. */
+export const firewallPolicyCreateAllowedWrite = (props: FirewallPolicyProps): AllowedWrite => ({
+  method: 'POST',
+  tail: `/v1/sites/${props.siteId}/firewall/policies`,
+});
+
+const describeByName = (props: FirewallPolicyProps) =>
+  `sites/${props.siteId}/firewall/policies/by-name/${props.name}`;
+
+/** Refuses, typed, before any request: the one gate `createReconcile` calls before `write`.
+ *  Order matters for the message only (both refuse the same way) — the identity check runs
+ *  first because it is the one that must hold regardless of what the name says (see header). */
+export const checkHfCreateScope = (props: FirewallPolicyProps) => {
+  if (props.firewallPolicyId !== undefined) {
+    return refuseWrite(
+      'Unifi.FirewallPolicy',
+      `sites/${props.siteId}/firewall/policies/${props.firewallPolicyId}`,
+      'create',
+    );
+  }
+  return isHfPolicyName(props.name)
+    ? Effect.void
+    : refuseWrite('Unifi.FirewallPolicy', describeByName(props), 'create');
+};
+
+/** Every field `CreateFirewallPolicyRequest` accepts, straight from the declaration, with an
+ *  absent optional field left OUT of the body entirely (never sent as `undefined`/`null`) —
+ *  `JSON.stringify` already drops an `undefined` value, but building the object field-by-field
+ *  rather than spreading `props` keeps this list the single place that enumerates exactly what a
+ *  create may send, so a future prop added to `FirewallPolicyProps` for some OTHER purpose cannot
+ *  silently become a wire field here without this file changing too. */
+export const firewallPolicyCreateBody = (
+  props: FirewallPolicyProps,
+): firewall.CreateFirewallPolicyRequest => ({
+  siteId: props.siteId,
+  action: props.action,
+  ...(props.connectionStateFilter === undefined
+    ? {}
+    : { connectionStateFilter: props.connectionStateFilter }),
+  ...(props.description === undefined ? {} : { description: props.description }),
+  destination: props.destination,
+  enabled: props.enabled,
+  ipProtocolScope: props.ipProtocolScope,
+  ...(props.ipsecFilter === undefined ? {} : { ipsecFilter: props.ipsecFilter }),
+  loggingEnabled: props.loggingEnabled,
+  name: props.name,
+  ...(props.schedule === undefined ? {} : { schedule: props.schedule }),
+  source: props.source,
+});
+
+export const writeFirewallPolicyCreate = (props: FirewallPolicyProps) =>
+  firewall.createFirewallPolicy(firewallPolicyCreateBody(props));

package/src/unifi/firewall-policy-drift.test.ts

@@ -149,3 +149,67 @@ describe('I2 -- every declarable field is wired into the drift field list', () =
     },
   );
 });
+
+describe('set-like nested filter arrays compare as sets (homeflare-network PR 79)', () => {
+  const dest = (ports: number[], ips: string[]) =>
+    ({
+      zoneId: 'zone-storage',
+      trafficFilter: {
+        type: 'IP_ADDRESS',
+        ipAddressFilter: {
+          type: 'IP_ADDRESSES',
+          matchOpposite: false,
+          items: ips.map((value) => ({ type: 'IP_ADDRESS', value })),
+        },
+        portFilter: {
+          type: 'PORTS',
+          matchOpposite: false,
+          items: ports.map((value) => ({ type: 'PORT_NUMBER', value })),
+        },
+      },
+    }) as unknown as FirewallPolicyProps['destination'];
+
+  test('the measured case: declared [443, 9100], live [9100, 443] is a noop', () => {
+    const props = { ...PROPS, destination: dest([443, 9100], ['10.20.14.10']) };
+    const live = liveFirewallPolicy({ destination: dest([9100, 443], ['10.20.14.10']) as never });
+    expect(matches(attributesOf(live, props), props)).toBe(true);
+    expect(driftOf(live, props)).toEqual([]);
+  });
+
+  test('IP items in another order are a noop too, on source as well as destination', () => {
+    const props = { ...PROPS, source: dest([], ['10.0.0.1', '10.0.0.2']) as never };
+    const live = liveFirewallPolicy({ source: dest([], ['10.0.0.2', '10.0.0.1']) as never });
+    expect(driftOf(live, props)).toEqual([]);
+  });
+
+  test('a membership change still drifts: a port swapped, added or dropped', () => {
+    const props = { ...PROPS, destination: dest([443, 9100], ['10.20.14.10']) };
+    for (const ports of [[443, 22], [443, 9100, 22], [443]]) {
+      const live = liveFirewallPolicy({ destination: dest(ports, ['10.20.14.10']) as never });
+      expect(
+        driftOf(live, props).map((d) => d.field),
+        String(ports),
+      ).toEqual(['destination']);
+    }
+  });
+
+  test('a duplicate is not collapsed away: [443, 443] differs from [443]', () => {
+    const props = { ...PROPS, destination: dest([443], ['10.20.14.10']) };
+    const live = liveFirewallPolicy({ destination: dest([443, 443], ['10.20.14.10']) as never });
+    expect(driftOf(live, props).map((d) => d.field)).toEqual(['destination']);
+  });
+
+  test('mixed port items sort the same whatever their key order (range vs number)', () => {
+    const range = { start: 8000, stop: 8100, type: 'PORT_NUMBER_RANGE' };
+    const rangeDecoded = { type: 'PORT_NUMBER_RANGE', start: 8000, stop: 8100 };
+    const one = { type: 'PORT_NUMBER', value: 443 };
+    const withItems = (items: unknown[]) =>
+      ({
+        zoneId: 'zone-storage',
+        trafficFilter: { type: 'PORT', portFilter: { type: 'PORTS', matchOpposite: false, items } },
+      }) as unknown as FirewallPolicyProps['destination'];
+    const props = { ...PROPS, destination: withItems([range, one]) };
+    const live = liveFirewallPolicy({ destination: withItems([one, rangeDecoded]) as never });
+    expect(driftOf(live, props)).toEqual([]);
+  });
+});

package/src/unifi/firewall-policy-drift.ts

@@ -10,9 +10,9 @@
  *   before comparing — never applied to only `live` or only `declared` (the specific gap MEDIUM-4's
  *   own mutant found in `network-drift.ts`; see its header, and `acl-rule-drift.ts`'s own repeat of
  *   this same rule for `protocolFilter`/`enforcingDeviceFilter`).
- * ★ `action`/`destination`/`ipProtocolScope`/`schedule`/`source` compare with the plain default
- *   `equal` (whole-value `deepEqual`) — see `firewall-policy-form.ts`'s header for the accepted
- *   known gap this leaves in their own nested set-like arrays.
+ * ★ `destination`/`ipProtocolScope`/`schedule`/`source` run through `normalizeSetArrays` on BOTH
+ *   sides (set-like nested arrays compare as sets; `firewall-policy-form.ts`'s header), then the
+ *   default `deepEqual`. `action` compares wholesale.
  */
 import type * as firewall from '@distilled.cloud/unifi-network/firewall';
 import { makeDriftOf } from './drift.ts';
@@ -21,6 +21,7 @@ import {
   type FirewallPolicyProps,
   attributesOf,
   normalizeConnectionStateFilter,
+  normalizeSetArrays,
 } from './firewall-policy-form.ts';
 
 const fieldDrift = makeDriftOf<FirewallPolicyAttributes, FirewallPolicyProps>([
@@ -31,14 +32,30 @@ const fieldDrift = makeDriftOf<FirewallPolicyAttributes, FirewallPolicyProps>([
     declared: (p) => normalizeConnectionStateFilter(p.connectionStateFilter),
   },
   { field: 'description', live: (a) => a.description, declared: (p) => p.description },
-  { field: 'destination', live: (a) => a.destination, declared: (p) => p.destination },
+  {
+    field: 'destination',
+    live: (a) => normalizeSetArrays(a.destination),
+    declared: (p) => normalizeSetArrays(p.destination),
+  },
   { field: 'enabled', live: (a) => a.enabled, declared: (p) => p.enabled },
-  { field: 'ipProtocolScope', live: (a) => a.ipProtocolScope, declared: (p) => p.ipProtocolScope },
+  {
+    field: 'ipProtocolScope',
+    live: (a) => normalizeSetArrays(a.ipProtocolScope),
+    declared: (p) => normalizeSetArrays(p.ipProtocolScope),
+  },
   { field: 'ipsecFilter', live: (a) => a.ipsecFilter, declared: (p) => p.ipsecFilter },
   { field: 'loggingEnabled', live: (a) => a.loggingEnabled, declared: (p) => p.loggingEnabled },
   { field: 'name', live: (a) => a.name, declared: (p) => p.name },
-  { field: 'schedule', live: (a) => a.schedule, declared: (p) => p.schedule },
-  { field: 'source', live: (a) => a.source, declared: (p) => p.source },
+  {
+    field: 'schedule',
+    live: (a) => normalizeSetArrays(a.schedule),
+    declared: (p) => normalizeSetArrays(p.schedule),
+  },
+  {
+    field: 'source',
+    live: (a) => normalizeSetArrays(a.source),
+    declared: (p) => normalizeSetArrays(p.source),
+  },
 ]);
 
 export const matches = (