@homeflare/alchemy 0.57.0 → 0.58.0

package/dist/unifi/firewall-policy-drift.d.ts

@@ -10,9 +10,9 @@
  *   before comparing — never applied to only `live` or only `declared` (the specific gap MEDIUM-4's
  *   own mutant found in `network-drift.ts`; see its header, and `acl-rule-drift.ts`'s own repeat of
  *   this same rule for `protocolFilter`/`enforcingDeviceFilter`).
- * ★ `action`/`destination`/`ipProtocolScope`/`schedule`/`source` compare with the plain default
- *   `equal` (whole-value `deepEqual`) — see `firewall-policy-form.ts`'s header for the accepted
- *   known gap this leaves in their own nested set-like arrays.
+ * ★ `destination`/`ipProtocolScope`/`schedule`/`source` run through `normalizeSetArrays` on BOTH
+ *   sides (set-like nested arrays compare as sets; `firewall-policy-form.ts`'s header), then the
+ *   default `deepEqual`. `action` compares wholesale.
  */
 import type * as firewall from '@distilled.cloud/unifi-network/firewall';
 import { type FirewallPolicyAttributes, type FirewallPolicyProps } from './firewall-policy-form.ts';

package/dist/unifi/firewall-policy-drift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAGzB,MAAM,2BAA2B,CAAC;AAoBnC,eAAO,MAAM,OAAO,eACN,wBAAwB,SAC7B,mBAAmB,KACzB,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,mBAAmB,sCACnC,CAAC"}
+{"version":3,"file":"firewall-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAIzB,MAAM,2BAA2B,CAAC;AAoCnC,eAAO,MAAM,OAAO,eACN,wBAAwB,SAC7B,mBAAmB,KACzB,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,mBAAmB,sCACnC,CAAC"}

package/dist/unifi/firewall-policy-form.d.ts

@@ -15,17 +15,18 @@
  *   `deepEqual` (`stripNullish`) as ONE value, same proportion `acl-rule-form.ts`'s
  *   `enforcingDeviceFilter` gets (one level of structure, not exploded into scalars).
  *
- * ⚠️ KNOWN GAP (T15, same shape as `acl-rule-form.ts`'s own — accepted, not fixed, here either):
- *   several of the vendor's filter variants nested inside `source`/`destination`/`ipProtocolScope`
- *   are themselves SET-LIKE arrays with no documented order —
- *   `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
- *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyIPAddressFilter.items`,
- *   `FirewallPolicyRegionFilter.regions`, `FirewallPolicyVPNServerFilter.vpnServerIds`,
- *   `FirewallSchedule.repeatOnDays` — `deepEqual` compares every one of them order-sensitively, so a
- *   console-side reorder with no membership change would report a spurious drift this read-only
- *   family's `reconcile` then refuses forever. Not fixed here for the same reason ACL's own gap
- *   isn't: normalizing 12 filter variants' own nested arrays is a bigger, separate change, not a
- *   proportional extension of typing per-discriminator (A3) into set-aware comparison too.
+ * ★ SET-LIKE NESTED ARRAYS COMPARE AS SETS (closed 2026-10-19; was T15's accepted gap). The
+ *   vendor's filter variants inside `source`/`destination`/`ipProtocolScope`/`schedule` carry
+ *   arrays with no documented order: `FirewallPolicyIPAddressFilter.items`, the port filter's
+ *   `items`, `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
+ *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyRegionFilter.regions`,
+ *   `FirewallPolicyVPNServerFilter.vpnServerIds`, `FirewallPolicyDomainFilter.domains`,
+ *   `applicationCategoryIds` and `FirewallSchedule.repeatOnDays`. Measured:
+ *   the controller (Network 11.0.83) stored a declared port list [443, 9100] as [9100, 443], so a
+ *   correct create failed its read-back (`UnifiCreateDidNotConverge`, homeflare-network PR 79).
+ *   `normalizeSetArrays` sorts every array under one of those keys (by canonical JSON) on BOTH
+ *   sides before `deepEqual`. Membership still has to match exactly, and duplicates are kept, so a
+ *   real change is never hidden.
  *
  * ⛔ `connectionStateFilter` IS THE ONE TOP-LEVEL PROPS ARRAY, AND IS A SET — "Match on firewall
  *   connection state. If null, matches all connection states" describes membership, not a sequence
@@ -48,6 +49,8 @@ import type * as firewall from '@distilled.cloud/unifi-network/firewall';
  *  see `acl-rule-form.ts`'s own header for why a normalizer applied to only one side is a bug
  *  class (MEDIUM-4). */
 export declare const normalizeConnectionStateFilter: (value: readonly string[] | undefined) => string[] | undefined;
+/** A deep copy with every SET_ARRAY_KEYS array sorted by canonical JSON (duplicates kept). */
+export declare const normalizeSetArrays: <T>(value: T) => T;
 /** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
  *  `network-form.ts`'s own header.
  *
@@ -64,17 +67,17 @@ export interface FirewallPolicyProps {
     /** Connection states this policy matches — compared as a SET, see the header. */
     connectionStateFilter?: string[] | undefined;
     description?: string | undefined;
-    /** Traffic destination — compound, compared wholesale; see the header's known gap. */
+    /** Traffic destination — compound, compared wholesale with set-like arrays normalized; see the header. */
     destination: firewall.FirewallPolicyDestination;
     enabled: boolean;
-    /** IP version + protocol scope — compound, compared wholesale; see the header's known gap. */
+    /** IP version + protocol scope — compound, compared wholesale with set-like arrays normalized; see the header. */
     ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
     ipsecFilter?: string | undefined;
     loggingEnabled: boolean;
     name: string;
-    /** Schedule this policy is active on — compound, compared wholesale; see the header's known gap. */
+    /** Schedule this policy is active on — compound, compared wholesale with set-like arrays normalized; see the header. */
     schedule?: firewall.FirewallSchedule | undefined;
-    /** Traffic source — compound, compared wholesale; see the header's known gap. */
+    /** Traffic source — compound, compared wholesale with set-like arrays normalized; see the header. */
     source: firewall.FirewallPolicySource;
 }
 export interface FirewallPolicyAttributes {

package/dist/unifi/firewall-policy-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;;;;;;;;6FAQ6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}
+{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AA6B1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,CAAC,KAAG,CAehD,CAAC;AAEF;;;;;;;;6FAQ6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,0GAA0G;IAC1G,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,kHAAkH;IAClH,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,wHAAwH;IACxH,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,qGAAqG;IACrG,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}

package/dist/unifi/index.js

@@ -318,6 +318,15 @@ var computePatch = (news, olds, patchKeys) => {
   }
   return { set, unset };
 };
+var acceptInto = (olds, news, accepted) => {
+  const next = { ...olds };
+  for (const field of accepted) {
+    const key = String(field);
+    if (key in news || key in next)
+      next[key] = news[key];
+  }
+  return next;
+};
 var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(function* () {
   const identity = spec.describe(news);
   const live = yield* spec.fetchLive(news);
@@ -334,15 +343,22 @@ var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(functi
   if (previous !== identity) {
     return yield* new UnifiIdentityChanged({ type: spec.type, identity, previous });
   }
+  const disagrees = new Set(update.driftOf(live, news).map((d) => String(d.field)));
   const drifted = update.driftOf(live, olds).map((d) => d.field);
-  if (drifted.length > 0) {
+  const conflicts = drifted.filter((field) => disagrees.has(String(field)));
+  if (conflicts.length > 0) {
     return yield* new UnifiLiveDriftedSinceDeploy({
       type: spec.type,
       identity,
-      fields: drifted
+      fields: conflicts
     });
   }
-  const patch = computePatch(news, olds, update.patchKeys);
+  const accepted = drifted.filter((field) => !disagrees.has(String(field)));
+  const baseline = acceptInto(olds, news, accepted);
+  if (accepted.length > 0) {
+    yield* note(`${spec.type} ${identity}: live edits since the last deploy already match the declaration, accepted: [${accepted.map(String).join(", ")}]`);
+  }
+  const patch = computePatch(news, baseline, update.patchKeys);
   if (Object.keys(patch.set).length === 0 && patch.unset.length === 0) {
     return yield* refuseWrite(spec.type, identity, "update");
   }
@@ -936,6 +952,30 @@ var writeFirewallPolicyCreate = (props) => firewall2.createFirewallPolicy(firewa
 // src/unifi/firewall-policy-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
 var normalizeConnectionStateFilter = (value) => value == null ? undefined : sortedSet4(value);
+var SET_ARRAY_KEYS = new Set([
+  "items",
+  "macAddresses",
+  "networkIds",
+  "applicationIds",
+  "regions",
+  "vpnServerIds",
+  "repeatOnDays",
+  "domains",
+  "applicationCategoryIds"
+]);
+var sortKeys = (value) => Array.isArray(value) ? value.map(sortKeys) : value !== null && typeof value === "object" ? Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])])) : value;
+var canonical = (value) => JSON.stringify(sortKeys(normalizeSetArrays(value)));
+var normalizeSetArrays = (value) => {
+  if (Array.isArray(value))
+    return value.map((v) => normalizeSetArrays(v));
+  if (value === null || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    out[key] = SET_ARRAY_KEYS.has(key) && Array.isArray(inner) ? [...inner].map((v) => normalizeSetArrays(v)).sort((x, y) => canonical(x) < canonical(y) ? -1 : canonical(x) > canonical(y) ? 1 : 0) : normalizeSetArrays(inner);
+  }
+  return out;
+};
 var attributesOf7 = (live, props) => ({
   siteId: props.siteId,
   firewallPolicyId: live.id,
@@ -978,14 +1018,30 @@ var fieldDrift7 = makeDriftOf([
     declared: (p) => normalizeConnectionStateFilter(p.connectionStateFilter)
   },
   { field: "description", live: (a) => a.description, declared: (p) => p.description },
-  { field: "destination", live: (a) => a.destination, declared: (p) => p.destination },
+  {
+    field: "destination",
+    live: (a) => normalizeSetArrays(a.destination),
+    declared: (p) => normalizeSetArrays(p.destination)
+  },
   { field: "enabled", live: (a) => a.enabled, declared: (p) => p.enabled },
-  { field: "ipProtocolScope", live: (a) => a.ipProtocolScope, declared: (p) => p.ipProtocolScope },
+  {
+    field: "ipProtocolScope",
+    live: (a) => normalizeSetArrays(a.ipProtocolScope),
+    declared: (p) => normalizeSetArrays(p.ipProtocolScope)
+  },
   { field: "ipsecFilter", live: (a) => a.ipsecFilter, declared: (p) => p.ipsecFilter },
   { field: "loggingEnabled", live: (a) => a.loggingEnabled, declared: (p) => p.loggingEnabled },
   { field: "name", live: (a) => a.name, declared: (p) => p.name },
-  { field: "schedule", live: (a) => a.schedule, declared: (p) => p.schedule },
-  { field: "source", live: (a) => a.source, declared: (p) => p.source }
+  {
+    field: "schedule",
+    live: (a) => normalizeSetArrays(a.schedule),
+    declared: (p) => normalizeSetArrays(p.schedule)
+  },
+  {
+    field: "source",
+    live: (a) => normalizeSetArrays(a.source),
+    declared: (p) => normalizeSetArrays(p.source)
+  }
 ]);
 var matches7 = (attributes, props) => fieldDrift7(attributes, props).length === 0;
 var driftOf7 = (live, props) => fieldDrift7(attributesOf7(live, props), props);
@@ -1195,5 +1251,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=F58E0BCA65985B3464756E2164756E21
+//# debugId=D14D4404F58A5F1264756E2164756E21
 //# sourceMappingURL=index.js.map