@homeflare/alchemy 0.57.0 → 0.59.0

package/dist/scope/index.js

@@ -0,0 +1,71 @@
+// src/scope/duplicate-id.ts
+import { toFqn } from "alchemy/FQN";
+import { CurrentNamespace } from "alchemy/Namespace";
+import { Stack } from "alchemy/Stack";
+import * as Data from "effect/Data";
+import * as Effect from "effect/Effect";
+
+class DuplicateResourceIdError extends Data.TaggedError("DuplicateResourceIdError") {
+}
+var scopeLabel = (namespace) => {
+  if (!namespace)
+    return "(root)";
+  const path = [];
+  let node = namespace;
+  while (node) {
+    path.unshift(node.Id);
+    node = node.Parent;
+  }
+  return path.join("/");
+};
+var registries = new WeakMap;
+var registryFor = (stack) => {
+  const existing = registries.get(stack);
+  if (existing)
+    return existing;
+  const created = new Map;
+  registries.set(stack, created);
+  return created;
+};
+var claimResourceId = (type, id) => Effect.gen(function* () {
+  const stack = yield* Stack;
+  const namespace = yield* CurrentNamespace;
+  const fqn = toFqn(namespace, id);
+  const registry = registryFor(stack);
+  const firstType = registry.get(fqn);
+  if (firstType === undefined) {
+    registry.set(fqn, type);
+    return;
+  }
+  if (firstType !== type) {
+    return yield* Effect.die(new DuplicateResourceIdError({
+      message: `REFUSING: duplicate resource id "${fqn}" in scope ${scopeLabel(namespace)}: ` + `first declared by ${firstType}, again by ${type}`,
+      fqn,
+      scope: scopeLabel(namespace),
+      firstType,
+      secondType: type
+    }));
+  }
+});
+// src/scope/guard.ts
+import * as Effect2 from "effect/Effect";
+var guardDuplicateIds = (resourceClass) => new Proxy(resourceClass, {
+  apply(target, thisArg, args) {
+    const id = args[0];
+    if (typeof id !== "string") {
+      return Reflect.apply(target, thisArg, args);
+    }
+    return Effect2.gen(function* () {
+      yield* claimResourceId(resourceClass.Type, id);
+      return yield* Reflect.apply(target, thisArg, args);
+    });
+  }
+});
+export {
+  DuplicateResourceIdError,
+  claimResourceId,
+  guardDuplicateIds
+};
+
+//# debugId=1AB58BD65E38742164756E2164756E21
+//# sourceMappingURL=index.js.map

package/dist/scope/index.js.map

@@ -0,0 +1,11 @@
+{
+  "version": 3,
+  "sources": ["../src/scope/duplicate-id.ts", "../src/scope/guard.ts"],
+  "sourcesContent": [
+    "/**\n * Refuse a second resource claiming a logical id already taken in the same stack scope.\n *\n * ★ WHY THIS EXISTS (measured, homeflare-mini PR 329, Tim 2026-10-19). `NixJobRetirement('caddy',\n *   …)` and `Caddy.Config` (`CADDY_ID = 'caddy'`) both declared logical id `caddy` in one stack.\n *   Alchemy's own `Resource()` constructor treats a second `yield*` at an already-claimed FQN as\n *   an idempotent re-reference — correct for \"the same resource, read from two call sites\" — and\n *   returns the FIRST-registered resource without ever comparing `Type` (`Resource.ts`, the\n *   `if (existing) { … return existing; }` branch; a sibling TODO there already flags a related\n *   gap — \"check if props are different and die\"). The SECOND resource's props are never written\n *   anywhere: `stack.resources[fqn]` never changes, so nothing downstream — not `Plan.make`, not a\n *   later inspection of the compiled stack — can tell two different registrations ever happened.\n *   Measured directly (dup-experiment.ts, this PR): registering `Test.ResourceB('shared-id', …)`\n *   after `Test.ResourceA('shared-id', …)` compiles a stack whose ONLY entry at that fqn reports\n *   `Type: 'Test.ResourceA'` — the second declaration leaves no trace to check after the fact.\n * ★ WHY THE CHECK CANNOT BE BOLTED ON AFTER THE FACT. Because the losing registration leaves no\n *   trace (above), a guard built from `CompiledStack.resources` — inspected after the stack's body\n *   has run, e.g. before `Plan.make` — sees only one entry per fqn and cannot know a second,\n *   different-typed claim ever happened. The only point where both the existing claim AND the new\n *   claimant's `Type` are both in hand is at the moment of registration, which is why this module\n *   is a REGISTRY populated and checked as each resource is `yield*`ed (see `guard.ts`), not a\n *   post-hoc scan.\n * ⛔ UPSTREAM IS THE RIGHT HOME FOR THE REAL FIX. The comparison belongs in `Resource.ts` itself,\n *   right where its own TODO already sits — every resource (ours and every vendor built-in) goes\n *   through that one function, and this kit cannot wrap a type it does not author (e.g.\n *   `Cloudflare.Worker`). This module is the house-side stopgap decision 49 allows (\"a house rule\n *   only fills a gap upstream is silent on\"): it protects any TWO resources that both go through\n *   `guardDuplicateIds` (guard.ts), which is everywhere this kit's own providers adopt it. The\n *   upstream issue text proposing the real fix is in this PR's body.\n */\nimport { toFqn } from 'alchemy/FQN';\nimport { CurrentNamespace, type NamespaceNode } from 'alchemy/Namespace';\nimport { Stack } from 'alchemy/Stack';\nimport * as Data from 'effect/Data';\nimport * as Effect from 'effect/Effect';\n\n/**\n * Two resources of different types both claimed `fqn` in `scope`. Carries both type names so the\n * message — and any catcher — can tell the attacker from the defender without re-deriving them.\n */\nexport class DuplicateResourceIdError extends Data.TaggedError('DuplicateResourceIdError')<{\n  message: string;\n  fqn: string;\n  scope: string;\n  firstType: string;\n  secondType: string;\n}> {}\n\nconst scopeLabel = (namespace: NamespaceNode | undefined): string => {\n  if (!namespace) return '(root)';\n  const path: string[] = [];\n  let node: NamespaceNode | undefined = namespace;\n  while (node) {\n    path.unshift(node.Id);\n    node = node.Parent;\n  }\n  return path.join('/');\n};\n\n/**\n * One registry per compiled stack, keyed by the `Stack` service object `yield* Stack` returns\n * (a fresh `StackSpec` per `Alchemy.Stack(...)`/`make()` call — see `Stack.ts`'s `Layer.effect`).\n * A `WeakMap` so two unrelated stacks (sequential test runs, two stacks in one process) never see\n * each other's claims, and so the registry is collected with the stack instead of growing forever\n * in a long-running process (an `alchemy dev` watch loop, this package's own test suite).\n */\nconst registries = new WeakMap<object, Map<string, string>>();\n\nconst registryFor = (stack: object): Map<string, string> => {\n  const existing = registries.get(stack);\n  if (existing) return existing;\n  const created = new Map<string, string>();\n  registries.set(stack, created);\n  return created;\n};\n\n/**\n * Claim `id` for `type` in the current namespace scope. Fine the first time, and fine again for\n * the SAME type (the legitimate \"yield the same resource from two call sites\" pattern Alchemy's\n * own idempotent registration supports). Dies with {@link DuplicateResourceIdError} the moment a\n * DIFFERENT type claims an id already taken — before that second resource's provider ever runs.\n *\n * ⚠️ `Effect.die`, NOT a typed failure. This runs at registration, not inside a lifecycle\n * operation (`read`/`diff`/`reconcile`/`delete`) — the provider-standard's S20 ban on\n * `Effect.orDie` in LIFECYCLE operations does not apply here, and `ConflictingProviderModeError`\n * right next door in upstream's own `Resource.ts` dies the same way for the same reason: there is\n * no recovery a caller could usefully attempt mid-registration.\n */\nexport const claimResourceId = (type: string, id: string): Effect.Effect<void, never, Stack> =>\n  Effect.gen(function* () {\n    const stack = yield* Stack;\n    const namespace = yield* CurrentNamespace;\n    const fqn = toFqn(namespace, id);\n    const registry = registryFor(stack);\n    const firstType = registry.get(fqn);\n    if (firstType === undefined) {\n      registry.set(fqn, type);\n      return;\n    }\n    if (firstType !== type) {\n      return yield* Effect.die(\n        new DuplicateResourceIdError({\n          message:\n            `REFUSING: duplicate resource id \"${fqn}\" in scope ${scopeLabel(namespace)}: ` +\n            `first declared by ${firstType}, again by ${type}`,\n          fqn,\n          scope: scopeLabel(namespace),\n          firstType,\n          secondType: type,\n        }),\n      );\n    }\n  });\n",
+    "/**\n * `guardDuplicateIds` — wrap a Resource class so every `(\"id\", props)` call it makes first\n * claims that id through `duplicate-id.ts`'s per-stack registry, naming both resource types if\n * a second, different-typed resource already claimed it. See duplicate-id.ts's header for why\n * the check has to live HERE (at the moment of registration) rather than after the stack body\n * has finished running.\n *\n * Usage, in a resource's own file, right where it's exported today:\n *\n * ```ts\n * export const CaddyConfig = guardDuplicateIds(Resource<CaddyConfig>('Caddy.Config', { … }));\n * ```\n *\n * ★ A `Proxy` around the REAL class, not a reimplementation. `Resource()`'s return value is a\n *   callable object wearing an `Effectable.Prototype` (`Effect.isEffect(MyResource) === true`,\n *   for the bare-tag platform-resource pattern) plus `.ref`, `.Type`, `.Provider`, `.Self`,\n *   `.Aliases` — reconstructing that shape risks silently dropping one of them. A `Proxy` whose\n *   `get` trap is the default (`Reflect.get`) forwards every property read untouched; only the\n *   `apply` trap — the `MyResource(\"id\", props)` call form — is new behaviour.\n * ⚠️ THE \"REGISTER METHODS\" OVERLOAD IS DELIBERATELY LEFT ALONE. `ResourceClass` is also callable\n *   with a single object argument to attach methods (`Resource()`'s own `typeof args[0] ===\n *   'object' ? Object.assign(...) : constructor(...)` branch) — that call mutates and returns the\n *   SAME class, carries no logical id, and has nothing to claim. Only a string first argument\n *   (the `(id, props)` form) goes through `claimResourceId`.\n */\nimport type { ResourceClass, ResourceLike } from 'alchemy/Resource';\nimport * as Effect from 'effect/Effect';\nimport { claimResourceId } from './duplicate-id.ts';\n\nexport const guardDuplicateIds = <R extends ResourceLike>(\n  resourceClass: ResourceClass<R>,\n): ResourceClass<R> =>\n  new Proxy(resourceClass, {\n    apply(target, thisArg, args: unknown[]) {\n      const id = args[0];\n      if (typeof id !== 'string') {\n        // The \"attach methods\" overload — not a registration, nothing to claim.\n        return Reflect.apply(target as (...a: unknown[]) => unknown, thisArg, args);\n      }\n      return Effect.gen(function* () {\n        yield* claimResourceId(resourceClass.Type, id);\n        return yield* Reflect.apply(\n          target as (...a: unknown[]) => unknown,\n          thisArg,\n          args,\n        ) as Effect.Effect<R>;\n      });\n    },\n  }) as ResourceClass<R>;\n"
+  ],
+  "mappings": ";AA8BA;AACA;AACA;AACA;AACA;AAAA;AAMO,MAAM,iCAAsC,iBAAY,0BAA0B,EAMtF;AAAC;AAEJ,IAAM,aAAa,CAAC,cAAiD;AAAA,EACnE,IAAI,CAAC;AAAA,IAAW,OAAO;AAAA,EACvB,MAAM,OAAiB,CAAC;AAAA,EACxB,IAAI,OAAkC;AAAA,EACtC,OAAO,MAAM;AAAA,IACX,KAAK,QAAQ,KAAK,EAAE;AAAA,IACpB,OAAO,KAAK;AAAA,EACd;AAAA,EACA,OAAO,KAAK,KAAK,GAAG;AAAA;AAUtB,IAAM,aAAa,IAAI;AAEvB,IAAM,cAAc,CAAC,UAAuC;AAAA,EAC1D,MAAM,WAAW,WAAW,IAAI,KAAK;AAAA,EACrC,IAAI;AAAA,IAAU,OAAO;AAAA,EACrB,MAAM,UAAU,IAAI;AAAA,EACpB,WAAW,IAAI,OAAO,OAAO;AAAA,EAC7B,OAAO;AAAA;AAeF,IAAM,kBAAkB,CAAC,MAAc,OACrC,WAAI,UAAU,GAAG;AAAA,EACtB,MAAM,QAAQ,OAAO;AAAA,EACrB,MAAM,YAAY,OAAO;AAAA,EACzB,MAAM,MAAM,MAAM,WAAW,EAAE;AAAA,EAC/B,MAAM,WAAW,YAAY,KAAK;AAAA,EAClC,MAAM,YAAY,SAAS,IAAI,GAAG;AAAA,EAClC,IAAI,cAAc,WAAW;AAAA,IAC3B,SAAS,IAAI,KAAK,IAAI;AAAA,IACtB;AAAA,EACF;AAAA,EACA,IAAI,cAAc,MAAM;AAAA,IACtB,OAAO,OAAc,WACnB,IAAI,yBAAyB;AAAA,MAC3B,SACE,oCAAoC,iBAAiB,WAAW,SAAS,QACzE,qBAAqB,uBAAuB;AAAA,MAC9C;AAAA,MACA,OAAO,WAAW,SAAS;AAAA,MAC3B;AAAA,MACA,YAAY;AAAA,IACd,CAAC,CACH;AAAA,EACF;AAAA,CACD;;ACtFH;AAGO,IAAM,oBAAoB,CAC/B,kBAEA,IAAI,MAAM,eAAe;AAAA,EACvB,KAAK,CAAC,QAAQ,SAAS,MAAiB;AAAA,IACtC,MAAM,KAAK,KAAK;AAAA,IAChB,IAAI,OAAO,OAAO,UAAU;AAAA,MAE1B,OAAO,QAAQ,MAAM,QAAwC,SAAS,IAAI;AAAA,IAC5E;AAAA,IACA,OAAc,YAAI,UAAU,GAAG;AAAA,MAC7B,OAAO,gBAAgB,cAAc,MAAM,EAAE;AAAA,MAC7C,OAAO,OAAO,QAAQ,MACpB,QACA,SACA,IACF;AAAA,KACD;AAAA;AAEL,CAAC;",
+  "debugId": "1AB58BD65E38742164756E2164756E21",
+  "names": []
+}

package/dist/unifi/firewall-policy-drift.d.ts

@@ -10,9 +10,9 @@
  *   before comparing — never applied to only `live` or only `declared` (the specific gap MEDIUM-4's
  *   own mutant found in `network-drift.ts`; see its header, and `acl-rule-drift.ts`'s own repeat of
  *   this same rule for `protocolFilter`/`enforcingDeviceFilter`).
- * ★ `action`/`destination`/`ipProtocolScope`/`schedule`/`source` compare with the plain default
- *   `equal` (whole-value `deepEqual`) — see `firewall-policy-form.ts`'s header for the accepted
- *   known gap this leaves in their own nested set-like arrays.
+ * ★ `destination`/`ipProtocolScope`/`schedule`/`source` run through `normalizeSetArrays` on BOTH
+ *   sides (set-like nested arrays compare as sets; `firewall-policy-form.ts`'s header), then the
+ *   default `deepEqual`. `action` compares wholesale.
  */
 import type * as firewall from '@distilled.cloud/unifi-network/firewall';
 import { type FirewallPolicyAttributes, type FirewallPolicyProps } from './firewall-policy-form.ts';

package/dist/unifi/firewall-policy-drift.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAGzB,MAAM,2BAA2B,CAAC;AAoBnC,eAAO,MAAM,OAAO,eACN,wBAAwB,SAC7B,mBAAmB,KACzB,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,mBAAmB,sCACnC,CAAC"}
+{"version":3,"file":"firewall-policy-drift.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-drift.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAEzE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAIzB,MAAM,2BAA2B,CAAC;AAoCnC,eAAO,MAAM,OAAO,eACN,wBAAwB,SAC7B,mBAAmB,KACzB,OAAqD,CAAC;AAEzD;;;;GAIG;AACH,eAAO,MAAM,OAAO,SAAU,QAAQ,CAAC,cAAc,SAAS,mBAAmB,sCACnC,CAAC"}

package/dist/unifi/firewall-policy-form.d.ts

@@ -15,17 +15,18 @@
  *   `deepEqual` (`stripNullish`) as ONE value, same proportion `acl-rule-form.ts`'s
  *   `enforcingDeviceFilter` gets (one level of structure, not exploded into scalars).
  *
- * ⚠️ KNOWN GAP (T15, same shape as `acl-rule-form.ts`'s own — accepted, not fixed, here either):
- *   several of the vendor's filter variants nested inside `source`/`destination`/`ipProtocolScope`
- *   are themselves SET-LIKE arrays with no documented order —
- *   `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
- *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyIPAddressFilter.items`,
- *   `FirewallPolicyRegionFilter.regions`, `FirewallPolicyVPNServerFilter.vpnServerIds`,
- *   `FirewallSchedule.repeatOnDays` — `deepEqual` compares every one of them order-sensitively, so a
- *   console-side reorder with no membership change would report a spurious drift this read-only
- *   family's `reconcile` then refuses forever. Not fixed here for the same reason ACL's own gap
- *   isn't: normalizing 12 filter variants' own nested arrays is a bigger, separate change, not a
- *   proportional extension of typing per-discriminator (A3) into set-aware comparison too.
+ * ★ SET-LIKE NESTED ARRAYS COMPARE AS SETS (closed 2026-10-19; was T15's accepted gap). The
+ *   vendor's filter variants inside `source`/`destination`/`ipProtocolScope`/`schedule` carry
+ *   arrays with no documented order: `FirewallPolicyIPAddressFilter.items`, the port filter's
+ *   `items`, `FirewallPolicyMACAddressFilter.macAddresses`, `FirewallPolicyNetworkFilter.networkIds`,
+ *   `FirewallPolicyApplicationFilter.applicationIds`, `FirewallPolicyRegionFilter.regions`,
+ *   `FirewallPolicyVPNServerFilter.vpnServerIds`, `FirewallPolicyDomainFilter.domains`,
+ *   `applicationCategoryIds` and `FirewallSchedule.repeatOnDays`. Measured:
+ *   the controller (Network 11.0.83) stored a declared port list [443, 9100] as [9100, 443], so a
+ *   correct create failed its read-back (`UnifiCreateDidNotConverge`, homeflare-network PR 79).
+ *   `normalizeSetArrays` sorts every array under one of those keys (by canonical JSON) on BOTH
+ *   sides before `deepEqual`. Membership still has to match exactly, and duplicates are kept, so a
+ *   real change is never hidden.
  *
  * ⛔ `connectionStateFilter` IS THE ONE TOP-LEVEL PROPS ARRAY, AND IS A SET — "Match on firewall
  *   connection state. If null, matches all connection states" describes membership, not a sequence
@@ -48,6 +49,8 @@ import type * as firewall from '@distilled.cloud/unifi-network/firewall';
  *  see `acl-rule-form.ts`'s own header for why a normalizer applied to only one side is a bug
  *  class (MEDIUM-4). */
 export declare const normalizeConnectionStateFilter: (value: readonly string[] | undefined) => string[] | undefined;
+/** A deep copy with every SET_ARRAY_KEYS array sorted by canonical JSON (duplicates kept). */
+export declare const normalizeSetArrays: <T>(value: T) => T;
 /** ⚠️ EVERY OPTIONAL FIELD SPELLS OUT `| undefined` — `exactOptionalPropertyTypes`; see
  *  `network-form.ts`'s own header.
  *
@@ -64,17 +67,17 @@ export interface FirewallPolicyProps {
     /** Connection states this policy matches — compared as a SET, see the header. */
     connectionStateFilter?: string[] | undefined;
     description?: string | undefined;
-    /** Traffic destination — compound, compared wholesale; see the header's known gap. */
+    /** Traffic destination — compound, compared wholesale with set-like arrays normalized; see the header. */
     destination: firewall.FirewallPolicyDestination;
     enabled: boolean;
-    /** IP version + protocol scope — compound, compared wholesale; see the header's known gap. */
+    /** IP version + protocol scope — compound, compared wholesale with set-like arrays normalized; see the header. */
     ipProtocolScope: firewall.FirewallPolicyIPProtocolScope;
     ipsecFilter?: string | undefined;
     loggingEnabled: boolean;
     name: string;
-    /** Schedule this policy is active on — compound, compared wholesale; see the header's known gap. */
+    /** Schedule this policy is active on — compound, compared wholesale with set-like arrays normalized; see the header. */
     schedule?: firewall.FirewallSchedule | undefined;
-    /** Traffic source — compound, compared wholesale; see the header's known gap. */
+    /** Traffic source — compound, compared wholesale with set-like arrays normalized; see the header. */
     source: firewall.FirewallPolicySource;
 }
 export interface FirewallPolicyAttributes {

package/dist/unifi/firewall-policy-form.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AAE1E;;;;;;;;6FAQ6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,sFAAsF;IACtF,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,8FAA8F;IAC9F,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,oGAAoG;IACpG,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,iFAAiF;IACjF,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}
+{"version":3,"file":"firewall-policy-form.d.ts","sourceRoot":"","sources":["../../src/unifi/firewall-policy-form.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6CG;AACH,OAAO,KAAK,KAAK,QAAQ,MAAM,yCAAyC,CAAC;AAIzE;;wBAEwB;AACxB,eAAO,MAAM,8BAA8B,UAClC,SAAS,MAAM,EAAE,GAAG,SAAS,KACnC,MAAM,EAAE,GAAG,SAA2D,CAAC;AA6B1E,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,CAAC,KAAG,CAehD,CAAC;AAEF;;;;;;;;6FAQ6F;AAC7F,MAAM,WAAW,mBAAmB;IAClC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,iFAAiF;IACjF,qBAAqB,CAAC,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC7C,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,0GAA0G;IAC1G,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,kHAAkH;IAClH,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IACjC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,wHAAwH;IACxH,QAAQ,CAAC,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IACjD,qGAAqG;IACrG,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;CACvC;AAED,MAAM,WAAW,wBAAwB;IACvC,MAAM,EAAE,MAAM,CAAC;IACf,gBAAgB,EAAE,MAAM,CAAC;IACzB,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,qBAAqB,EAAE,MAAM,EAAE,GAAG,SAAS,CAAC;IAC5C,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,WAAW,EAAE,QAAQ,CAAC,yBAAyB,CAAC;IAChD,OAAO,EAAE,OAAO,CAAC;IACjB,oGAAoG;IACpG,KAAK,EAAE,MAAM,CAAC;IACd,eAAe,EAAE,QAAQ,CAAC,6BAA6B,CAAC;IACxD,WAAW,EAAE,MAAM,GAAG,SAAS,CAAC;IAChC,cAAc,EAAE,OAAO,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,QAAQ,CAAC,gBAAgB,GAAG,SAAS,CAAC;IAChD,MAAM,EAAE,QAAQ,CAAC,oBAAoB,CAAC;IACtC,6FAA6F;IAC7F,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,eAAO,MAAM,YAAY,SACjB,QAAQ,CAAC,cAAc,SACtB,mBAAmB,KACzB,wBAgBD,CAAC;AAEH;;;;;;;GAOG;AACH,eAAO,MAAM,qBAAqB,SAC1B,QAAQ,CAAC,cAAc,UACrB,MAAM,KACb,mBAcD,CAAC"}

package/dist/unifi/index.js

@@ -318,6 +318,15 @@ var computePatch = (news, olds, patchKeys) => {
   }
   return { set, unset };
 };
+var acceptInto = (olds, news, accepted) => {
+  const next = { ...olds };
+  for (const field of accepted) {
+    const key = String(field);
+    if (key in news || key in next)
+      next[key] = news[key];
+  }
+  return next;
+};
 var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(function* () {
   const identity = spec.describe(news);
   const live = yield* spec.fetchLive(news);
@@ -334,15 +343,22 @@ var updateReconcile = (spec, { news, olds, output, note }) => Effect5.gen(functi
   if (previous !== identity) {
     return yield* new UnifiIdentityChanged({ type: spec.type, identity, previous });
   }
+  const disagrees = new Set(update.driftOf(live, news).map((d) => String(d.field)));
   const drifted = update.driftOf(live, olds).map((d) => d.field);
-  if (drifted.length > 0) {
+  const conflicts = drifted.filter((field) => disagrees.has(String(field)));
+  if (conflicts.length > 0) {
     return yield* new UnifiLiveDriftedSinceDeploy({
       type: spec.type,
       identity,
-      fields: drifted
+      fields: conflicts
     });
   }
-  const patch = computePatch(news, olds, update.patchKeys);
+  const accepted = drifted.filter((field) => !disagrees.has(String(field)));
+  const baseline = acceptInto(olds, news, accepted);
+  if (accepted.length > 0) {
+    yield* note(`${spec.type} ${identity}: live edits since the last deploy already match the declaration, accepted: [${accepted.map(String).join(", ")}]`);
+  }
+  const patch = computePatch(news, baseline, update.patchKeys);
   if (Object.keys(patch.set).length === 0 && patch.unset.length === 0) {
     return yield* refuseWrite(spec.type, identity, "update");
   }
@@ -936,6 +952,30 @@ var writeFirewallPolicyCreate = (props) => firewall2.createFirewallPolicy(firewa
 // src/unifi/firewall-policy-form.ts
 var sortedSet4 = (values) => [...new Set(values)].sort();
 var normalizeConnectionStateFilter = (value) => value == null ? undefined : sortedSet4(value);
+var SET_ARRAY_KEYS = new Set([
+  "items",
+  "macAddresses",
+  "networkIds",
+  "applicationIds",
+  "regions",
+  "vpnServerIds",
+  "repeatOnDays",
+  "domains",
+  "applicationCategoryIds"
+]);
+var sortKeys = (value) => Array.isArray(value) ? value.map(sortKeys) : value !== null && typeof value === "object" ? Object.fromEntries(Object.keys(value).sort().map((k) => [k, sortKeys(value[k])])) : value;
+var canonical = (value) => JSON.stringify(sortKeys(normalizeSetArrays(value)));
+var normalizeSetArrays = (value) => {
+  if (Array.isArray(value))
+    return value.map((v) => normalizeSetArrays(v));
+  if (value === null || typeof value !== "object")
+    return value;
+  const out = {};
+  for (const [key, inner] of Object.entries(value)) {
+    out[key] = SET_ARRAY_KEYS.has(key) && Array.isArray(inner) ? [...inner].map((v) => normalizeSetArrays(v)).sort((x, y) => canonical(x) < canonical(y) ? -1 : canonical(x) > canonical(y) ? 1 : 0) : normalizeSetArrays(inner);
+  }
+  return out;
+};
 var attributesOf7 = (live, props) => ({
   siteId: props.siteId,
   firewallPolicyId: live.id,
@@ -978,14 +1018,30 @@ var fieldDrift7 = makeDriftOf([
     declared: (p) => normalizeConnectionStateFilter(p.connectionStateFilter)
   },
   { field: "description", live: (a) => a.description, declared: (p) => p.description },
-  { field: "destination", live: (a) => a.destination, declared: (p) => p.destination },
+  {
+    field: "destination",
+    live: (a) => normalizeSetArrays(a.destination),
+    declared: (p) => normalizeSetArrays(p.destination)
+  },
   { field: "enabled", live: (a) => a.enabled, declared: (p) => p.enabled },
-  { field: "ipProtocolScope", live: (a) => a.ipProtocolScope, declared: (p) => p.ipProtocolScope },
+  {
+    field: "ipProtocolScope",
+    live: (a) => normalizeSetArrays(a.ipProtocolScope),
+    declared: (p) => normalizeSetArrays(p.ipProtocolScope)
+  },
   { field: "ipsecFilter", live: (a) => a.ipsecFilter, declared: (p) => p.ipsecFilter },
   { field: "loggingEnabled", live: (a) => a.loggingEnabled, declared: (p) => p.loggingEnabled },
   { field: "name", live: (a) => a.name, declared: (p) => p.name },
-  { field: "schedule", live: (a) => a.schedule, declared: (p) => p.schedule },
-  { field: "source", live: (a) => a.source, declared: (p) => p.source }
+  {
+    field: "schedule",
+    live: (a) => normalizeSetArrays(a.schedule),
+    declared: (p) => normalizeSetArrays(p.schedule)
+  },
+  {
+    field: "source",
+    live: (a) => normalizeSetArrays(a.source),
+    declared: (p) => normalizeSetArrays(p.source)
+  }
 ]);
 var matches7 = (attributes, props) => fieldDrift7(attributes, props).length === 0;
 var driftOf7 = (live, props) => fieldDrift7(attributesOf7(live, props), props);
@@ -1195,5 +1251,5 @@ export {
   driftOf6 as wifiBroadcastDriftOf
 };
 
-//# debugId=F58E0BCA65985B3464756E2164756E21
+//# debugId=D14D4404F58A5F1264756E2164756E21
 //# sourceMappingURL=index.js.map