@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/ownership/rows.d.ts

@@ -30,6 +30,17 @@ export declare const recordedInstance: (fqn: string, instanceId: string) => Effe
  *   let it write over whatever sits at its new identity (adopt.ts adoptsAtApply).
  */
 export declare const isCreate: (fqn: string, instanceId: string) => Effect.Effect<boolean>;
+/**
+ * `attr.id` on every generation OLDER than `instanceId` in this FQN's state chain (and a former
+ * FQN `renamedFrom` names). Walks `old` the way {@link generationOf} does, and skips the current
+ * generation itself.
+ * ⛔ THOSE IDS ARE NOT THIS GENERATION'S. A `replacing` row's reconcile runs with no attributes, so
+ *   a live row found by name can be the previous generation's own deployment. Recording that id on
+ *   the new generation makes both the same id, and `destroy()` then deletes the old generation by
+ *   it (Apply.ts, the retain check near 2168 and the provider delete that follows when the policy
+ *   is not `retain`). A same-instance `old` snapshot (an `updating` row) is not one of these.
+ */
+export declare const olderGenerationIds: (fqn: string, instanceId: string) => Effect.Effect<readonly string[]>;
 /**
  * ⛔ A REFUSED CREATE MUST NOT LEAVE A ROW THAT CLAIMS THE OBJECT IT REFUSED. Apply commits a
  *   `creating` row for this instance before it calls reconcile, and a failed reconcile leaves it

package/dist/ownership/rows.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmBxC,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAaF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QACxB,MAAM,cACC,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CASnC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAEJ;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}
+{"version":3,"file":"rows.d.ts","sourceRoot":"","sources":["../../src/ownership/rows.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAmBxC,wEAAwE;AACxE,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;IACvB,+FAA+F;IAC/F,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B,CAAC;AAaF,8FAA8F;AAC9F,eAAO,MAAM,kBAAkB,QACxB,MAAM,cACC,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,UAAU,GAAG,SAAS,CASnC,CAAC;AAEL;;;;;;;;;GASG;AACH,MAAM,MAAM,QAAQ,GAAG,QAAQ,GAAG,SAAS,GAAG,OAAO,CAAC;AAEtD,eAAO,MAAM,gBAAgB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,QAAQ,CAKrF,CAAC;AAEL;;;;;GAKG;AACH,eAAO,MAAM,QAAQ,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,CAI7E,CAAC;AAQJ;;;;;;;;;GASG;AACH,eAAO,MAAM,kBAAkB,QACxB,MAAM,cACC,MAAM,KACjB,MAAM,CAAC,MAAM,CAAC,SAAS,MAAM,EAAE,CAS9B,CAAC;AAyBL;;;;;;;;;;GAUG;AACH,eAAO,MAAM,mBAAmB,QAAS,MAAM,cAAc,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAUpF,CAAC"}

package/dist/postgres/connection.d.ts

@@ -41,9 +41,12 @@ export interface PostgresRunnerConfig {
     readonly username: string;
     readonly template?: string;
 }
-/** What `withPg`'s callback learns about the transport beyond the client. */
+/** What `withPg`'s callback learns about the transport beyond the client. `database` is the
+ * database the statements run IN: the family connection's, or the override `Postgres.Schema`
+ * and `Postgres.Grants` pass so they open their declared database and then prove it. */
 export interface PgContext {
     readonly template?: string;
+    readonly database: string;
 }
 declare const PostgresConnection_base: Context.ServiceClass<PostgresConnection, "Postgres.Connection", Effect.Effect<PostgresConnectionConfig | PostgresRunnerConfig, never, never>>;
 /** The lazy connection service. Its value is an `Effect` of the config, per S24 — see the file
@@ -55,6 +58,8 @@ export declare class PostgresConnection extends PostgresConnection_base {
 export declare const postgresConnection: (config: PostgresConnectionConfig) => Layer.Layer<PostgresConnection>;
 /** A stack's one-line way to provide a cluster reached through a command runner. */
 export declare const postgresRunnerConnection: (config: PostgresRunnerConfig) => Layer.Layer<PostgresConnection>;
+/** Effect-scoped pool factory, like BaoGate: tests override it without process-wide module mocks. */
+export declare const PostgresPool: Context.Reference<(config: PgClient.PgPoolConfig) => Layer.Layer<PgClient.PgClient | import("effect/unstable/sql/SqlClient").SqlClient, SqlError>>;
 /**
  * Run one operation against a freshly built, freshly closed connection pool.
  *
@@ -62,7 +67,14 @@ export declare const postgresRunnerConnection: (config: PostgresRunnerConfig) =>
  * operation — never once per statement — so a reconcile that runs a `SELECT`, then a `CREATE`,
  * then a re-read shares one pool and closes it once, while a plan-only `read` still opens and
  * closes its own.
+ *
+ * `database` overrides which database of the SAME cluster the pool opens — the declared
+ * database of `Postgres.Schema` and `Postgres.Grants`. The family connection is pointed at a
+ * maintenance database (a brand-new database cannot be connected to on a cold plan), so those
+ * resources pass their declared database here: the runner transport swaps the `psql -d` target,
+ * the socket path swaps the pool's `database`. The swap is proven, not trusted: schema rows
+ * carry `current_database()` (`schema-sql.ts`) and grants calls the same function before writing.
  */
-export declare const withPg: <A, E>(build: (pg: PgClient.PgClient | PgExecutor, context: PgContext) => Effect.Effect<A, E>) => Effect.Effect<A, E | SqlError, PostgresConnection>;
+export declare const withPg: <A, E>(build: (pg: PgExecutor, context: PgContext) => Effect.Effect<A, E>, database?: string) => Effect.Effect<A, E | SqlError, PostgresConnection>;
 export {};
 //# sourceMappingURL=connection.d.ts.map

package/dist/postgres/connection.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/postgres/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,oBAAoB,CAAC;AAEvE;;;uFAGuF;AACvF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;wFAGwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED,6EAA6E;AAC7E,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;;AAED;qBACqB;AACrB,qBAAa,kBAAmB,SAAQ,uBAGd;CAAG;AAE7B;8EAC8E;AAC9E,eAAO,MAAM,kBAAkB,WACrB,wBAAwB,KAC/B,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAA8D,CAAC;AAEhG,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,WAC3B,oBAAoB,KAC3B,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAA8D,CAAC;AAKhG;;;;;;;GAOG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,SAClB,CAAC,EAAE,EAAE,QAAQ,CAAC,QAAQ,GAAG,UAAU,EAAE,OAAO,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,KACrF,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,kBAAkB,CAahD,CAAC"}
+{"version":3,"file":"connection.d.ts","sourceRoot":"","sources":["../../src/postgres/connection.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,QAAQ,MAAM,yBAAyB,CAAC;AACpD,OAAO,KAAK,OAAO,MAAM,gBAAgB,CAAC;AAC1C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,UAAU,EAAoB,MAAM,oBAAoB,CAAC;AAEvE;;;uFAGuF;AACvF,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,GAAG,CAAC,EAAE,OAAO,CAAC;CACxB;AAED;;;wFAGwF;AACxF,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,GAAG,EAAE,UAAU,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B;AAED;;wFAEwF;AACxF,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;;AAED;qBACqB;AACrB,qBAAa,kBAAmB,SAAQ,uBAGd;CAAG;AAE7B;8EAC8E;AAC9E,eAAO,MAAM,kBAAkB,WACrB,wBAAwB,KAC/B,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAA8D,CAAC;AAEhG,oFAAoF;AACpF,eAAO,MAAM,wBAAwB,WAC3B,oBAAoB,KAC3B,KAAK,CAAC,KAAK,CAAC,kBAAkB,CAA8D,CAAC;AAEhG,qGAAqG;AACrG,eAAO,MAAM,YAAY,oJAEvB,CAAC;AAKH;;;;;;;;;;;;;;GAcG;AACH,eAAO,MAAM,MAAM,GAAI,CAAC,EAAE,CAAC,SAClB,CAAC,EAAE,EAAE,UAAU,EAAE,OAAO,EAAE,SAAS,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,CAAC,aACvD,MAAM,KAChB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,QAAQ,EAAE,kBAAkB,CAgChD,CAAC"}

package/dist/postgres/database-sql.d.ts

@@ -19,26 +19,36 @@
  *   `createdb_opt_item`'s string branch is `opt_boolean_or_string → NonReservedWord_or_Sconst →
  *   NonReservedWord | Sconst`. A locale like `en_US.UTF-8` would hit the same dot-splitting
  *   `quoteIdent` avoids if it were identifier-quoted; a plain `Sconst` (`quoteStringLiteral`) has
- *   no such rule. This rests on `standard_conforming_strings = on` (the PG18 default, and
- *   measured live 2026-09-23 — `docs/postgres.md#measured`); the escaper only ever doubles `'`
- *   and never emits a backslash, so it never depends on which way that setting points.
+ *   no such rule. Use E'…' with doubled backslashes and quotes: PostgreSQL 18 lexical
+ *   section 4.1.2.2 makes escape strings independent of standard_conforming_strings.
+ *   Measured 2026-10-01: the former quote-only escaper allowed comment SQL injection when
+ *   that setting was off; an input backslash escaped the first quote of a doubled pair.
  */
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import * as Effect from 'effect/Effect';
 import type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';
 /** What every function in this file needs from a client — real (`PgClient.PgClient`) or fake
- * (`fake-sql.ts`). Deliberately smaller than `SqlClient`: nothing here ever needs the tagged
- * template, transactions or streaming, because every statement is either bound params through
- * `.unsafe(text, params)` or a hand-escaped literal through `.unsafe(text)`. */
+ * (`fake-sql.ts`). Deliberately smaller than `SqlClient`: nothing here needs the tagged template
+ * or streaming. `transaction` is the exception `Postgres.Role`'s create and `Postgres.Grants`'
+ * repair share: role DDL commits per statement unless the statements share a transaction, and
+ * a grants repair's `REVOKE` must not autocommit apart from the `GRANT`s that restore it. */
 export interface PgExecutor {
     readonly unsafe: <A extends object>(sql: string, params?: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<A>, SqlError>;
+    /**
+     * Run `statements` in one transaction. `CREATE ROLE`, `ALTER ROLE` and `GRANT`/`REVOKE` of
+     * membership are transactional (`utility.c@REL_18_6`: those cases do not call
+     * `PreventInTransactionBlock`; `CREATE DATABASE` does). The socket client reserves one
+     * connection (`SqlClient.withTransaction`); the runner sends one `psql` script, because each
+     * `unsafe` call is its own session and would autocommit.
+     */
+    readonly transaction: (statements: readonly string[]) => Effect.Effect<void, SqlError>;
 }
 /** Single-token identifier quoting: wrap in `"`, double any embedded `"`. No dot-splitting —
  * see the file header. Used for the database name and, since a role or tablespace name is a
  * `NonReservedWord` too, for `OWNER` and `TABLESPACE`. */
 export declare const quoteIdent: (value: string) => string;
-/** SQL string-literal quoting: wrap in `'`, double any embedded `'`. Used for every `WITH`
- * value that is locale or encoding text, never for an identifier (see the file header). */
+/** Escape-string quoting is safe with standard_conforming_strings either on or off.
+ * Double backslashes BEFORE quotes, so caller text cannot escape a closing delimiter. */
 export declare const quoteStringLiteral: (value: string) => string;
 /**
  * Build the exact `CREATE DATABASE` text — a pure function, unit-tested on its own with no
@@ -58,6 +68,15 @@ export declare const isDuplicateDatabaseRace: (error: SqlError) => boolean;
  * `PostgresDatabaseOwnerMissing` at reconcile time rather than the server's own
  * `ERROR: role "…" does not exist` surfacing as an unclassified statement failure. */
 export declare const roleExists: (pg: PgExecutor, role: string) => Effect.Effect<boolean, SqlError>;
+/**
+ * Does one database of the cluster exist? `Postgres.Schema` runs this over the FAMILY
+ * connection (no `withPg` database override) before `read` and `delete`, so a declared
+ * database that does not exist yet answers "schema absent" instead of the transports' untyped
+ * connect failures (`ConnectionError` over psql, `UnknownError` 3D000 over the socket). The
+ * probe targets the maintenance database the family connection already points at, which a
+ * cold plan can always reach.
+ */
+export declare const databaseExists: (pg: PgExecutor, name: string) => Effect.Effect<boolean, SqlError>;
 /** The read: one bound `SELECT` on `pg_database`, joined to the two functions that turn its raw
  * owner and encoding columns into names (`docs/postgres.md#mapping`). `undefined` when the row
  * is absent — ownership branding happens one layer up, in `database.ts`, not here. */

package/dist/postgres/database-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"database-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/database-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE7F;;;gFAGgF;AAChF,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,KAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;CAChD;AAED;;0DAE0D;AAC1D,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,MAA0C,CAAC;AAEtF;2FAC2F;AAC3F,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MAA0C,CAAC;AAwB9F;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,UAAW,qBAAqB,aAAa,MAAM,KAAG,MACP,CAAC;AAEnF;;;;;mFAKmF;AACnF,eAAO,MAAM,uBAAuB,UAAW,QAAQ,KAAG,OAMzD,CAAC;AAIF;;sFAEsF;AACtF,eAAO,MAAM,UAAU,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAItF,CAAC;AAwCJ;;sFAEsF;AACtF,eAAO,MAAM,cAAc,OACrB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,CACkC,CAAC;AAEpG;;qFAEqF;AACrF,eAAO,MAAM,UAAU,UACd,qBAAqB,QACtB,0BAA0B,KAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,SAgBlF,CAAC"}
+{"version":3,"file":"database-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/database-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;GAyBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAE7F;;;;6FAI6F;AAC7F,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,MAAM,EAAE,CAAC,CAAC,SAAS,MAAM,EAChC,GAAG,EAAE,MAAM,EACX,MAAM,CAAC,EAAE,aAAa,CAAC,OAAO,CAAC,KAC5B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IAC/C;;;;;;OAMG;IACH,QAAQ,CAAC,WAAW,EAAE,CAAC,UAAU,EAAE,SAAS,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,QAAQ,CAAC,CAAC;CACxF;AAED;;0DAE0D;AAC1D,eAAO,MAAM,UAAU,UAAW,MAAM,KAAG,MAA0C,CAAC;AAEtF;yFACyF;AACzF,eAAO,MAAM,kBAAkB,UAAW,MAAM,KAAG,MACO,CAAC;AAwB3D;;;;;GAKG;AACH,eAAO,MAAM,sBAAsB,UAAW,qBAAqB,aAAa,MAAM,KAAG,MACP,CAAC;AAEnF;;;;;mFAKmF;AACnF,eAAO,MAAM,uBAAuB,UAAW,QAAQ,KAAG,OAMzD,CAAC;AAIF;;sFAEsF;AACtF,eAAO,MAAM,UAAU,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAItF,CAAC;AAIJ;;;;;;;GAOG;AACH,eAAO,MAAM,cAAc,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAI1F,CAAC;AAwCJ;;sFAEsF;AACtF,eAAO,MAAM,cAAc,OACrB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,0BAA0B,GAAG,SAAS,EAAE,QAAQ,CACkC,CAAC;AAEpG;;qFAEqF;AACrF,eAAO,MAAM,UAAU,UACd,qBAAqB,QACtB,0BAA0B,KAC/B;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,SAgBlF,CAAC"}

package/dist/postgres/fake-grants-parse.d.ts

@@ -0,0 +1,37 @@
+/**
+ * The statement parser half of the `Postgres.Grants` test fake: it understands EXACTLY the
+ * ten statement shapes `grants-sql.ts` generates — `quoteIdent`'s quoting, one clause
+ * order — and nothing else, so a quoting or clause-order bug in a builder trips the parser
+ * instead of hiding behind lenient matching. The server-model half (entries, grant/revoke
+ * semantics, the aclexplode-shaped reads) lives in `fake-grants-sql.ts`.
+ *
+ * ⛔ IT PARSES ITS OWN OUTPUT, NOT SQL IN GENERAL (`fake-sql.ts`'s own rule): every value
+ *   the builders `quoteIdent` is read back through the same `"…""…"` unquoting, and every
+ *   statement ends in exactly one of the accepted shapes or the parse refuses.
+ * ⛔ A COLUMN GRANT CARRIES ONE COLUMN LIST PER WORD — `GRANT select ("id"), update ("id")`:
+ *   a single trailing list binds only to the privilege it follows (gram.y@REL_18_6), so
+ *   `GRANT select, update ("id")` is a table-level SELECT on a real server. The parser
+ *   refuses that shape instead of filing it as a column-only grant.
+ */
+export interface AclObject {
+    readonly schema: string;
+    readonly table?: string;
+    readonly column?: string;
+    readonly defaultFor?: string;
+}
+/** One parsed write statement, already reduced to what the model applies. */
+export interface ParsedWrite {
+    readonly kind: 'grant' | 'revoke';
+    /** `REVOKE ALL ON ALL TABLES IN SCHEMA … FROM PUBLIC` — applied per known relation. */
+    readonly allTables?: boolean;
+    readonly object: AclObject;
+    /** `'PUBLIC'` or a role name. */
+    readonly grantee: string;
+    /** Declared privilege words, lowercase, no `*` marks (the option clause carries the flag). */
+    readonly words: ReadonlyArray<string>;
+    readonly option: boolean;
+}
+/** `undefined` when the text is no statement this family generates — the model refuses it
+ * rather than guessing (a parse miss on a GRANT-shaped text means a builder regressed). */
+export declare const parseGrantStatement: (text: string) => ParsedWrite | undefined;
+//# sourceMappingURL=fake-grants-parse.d.ts.map

package/dist/postgres/fake-grants-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-grants-parse.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-grants-parse.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,MAAM,WAAW,SAAS;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;CAC9B;AAED,6EAA6E;AAC7E,MAAM,WAAW,WAAW;IAC1B,QAAQ,CAAC,IAAI,EAAE,OAAO,GAAG,QAAQ,CAAC;IAClC,uFAAuF;IACvF,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,iCAAiC;IACjC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,8FAA8F;IAC9F,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;CAC1B;AAgJD;2FAC2F;AAC3F,eAAO,MAAM,mBAAmB,SAAU,MAAM,KAAG,WAAW,GAAG,SAShE,CAAC"}

package/dist/postgres/fake-grants-read.d.ts

@@ -0,0 +1,61 @@
+/**
+ * The read-answering half of the `Postgres.Grants` test fake: the `aclexplode`-shaped
+ * queries and the existence/ownership checks, answered from the server model's ACL
+ * (`fake-grants-sql.ts`), never from the statement list (S28). The entry and model shape
+ * are defined HERE so the write half (`fake-grants-write.ts`) can import them without a
+ * cycle.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { AclObject } from './fake-grants-parse.ts';
+/** One `aclitem` as the fake stores it: one (object, grantee, grantor) with the words that
+ * grantor granted, `*`-marked when WITH GRANT OPTION. `words` is mutable: grants and
+ * revokes edit it. */
+export interface AclEntry {
+    readonly object: AclObject;
+    readonly grantee: string;
+    readonly grantor: string;
+    words: string[];
+}
+/** One relation in the fake's catalog: every relation a table/column statement may name,
+ * with its columns, its `relkind` (default `'r'`) and its owner (default: the executor
+ * role, which no declared seat role owns). A sequence is a row with `relkind: 'S'`. */
+export interface FakeCatalogTable {
+    readonly schema: string;
+    readonly table: string;
+    readonly columns?: ReadonlyArray<string>;
+    readonly relkind?: string;
+    readonly owner?: string;
+}
+/** What the read half needs from the factory, keyed per schema so two schemas may hold
+ * same-named relations: `relkinds`/`tableOwners` map `"schema\0table"`, `schemaOwners`
+ * maps the schema to its owning role. */
+export interface FakeGrantsModel {
+    readonly schemas: ReadonlySet<string>;
+    readonly roles: ReadonlySet<string>;
+    readonly databases: ReadonlySet<string>;
+    readonly tables: ReadonlyArray<FakeCatalogTable>;
+    readonly acl: AclEntry[];
+    readonly relkinds: ReadonlyMap<string, string>;
+    readonly tableOwners: ReadonlyMap<string, string>;
+    readonly schemaOwners: ReadonlyMap<string, string>;
+    /** `current_user` — the grantor a write records, and the revoker the column read reports. */
+    readonly executor: string;
+    /** Whether `current_user` is a superuser: one arm of `revokesAsOwner` (a superuser revokes
+     * as the object owner, `revoke.sgml`). */
+    readonly executorSuper: boolean;
+    /** The roles `current_user` is a member of (recursively): a member of the owning role revokes
+     * as that role (`revokesAsOwner`). */
+    readonly executorMemberships: ReadonlySet<string>;
+    /** What `SELECT current_database()` answers. */
+    readonly connected: string;
+}
+/** Whether a `REVOKE` from the executor is performed as the object's owner (`select_best_grantor`
+ * acl.c@REL_18_6): a superuser, the owner itself, or a member of the owning role. Gates the
+ * column read's `grantor === owner` arm; the write path removes the owner's grant under it. */
+export declare const revokesAsOwner: (model: FakeGrantsModel, owner: string) => boolean;
+/** Answer the reads the family issues: the two existence checks, the schema/table/column/
+ * default `aclexplode` reads, and the two ownership reads. `undefined` when the text is no
+ * read this fake answers — the caller applies it as a write. */
+export declare const answerRead: <A extends object>(text: string, params: ReadonlyArray<unknown>, model: FakeGrantsModel) => Effect.Effect<ReadonlyArray<A>, SqlError> | undefined;
+//# sourceMappingURL=fake-grants-read.d.ts.map

package/dist/postgres/fake-grants-read.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-grants-read.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-grants-read.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AAExD;;sBAEsB;AACtB,MAAM,WAAW,QAAQ;IACvB,QAAQ,CAAC,MAAM,EAAE,SAAS,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,KAAK,EAAE,MAAM,EAAE,CAAC;CACjB;AAED;;uFAEuF;AACvF,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED;;yCAEyC;AACzC,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACpC,QAAQ,CAAC,SAAS,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IACxC,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IACjD,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;IACzB,QAAQ,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,WAAW,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IAClD,QAAQ,CAAC,YAAY,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnD,6FAA6F;IAC7F,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B;8CAC0C;IAC1C,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC;0CACsC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAClD,gDAAgD;IAChD,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B;AAOD;;+FAE+F;AAC/F,eAAO,MAAM,cAAc,UAAW,eAAe,SAAS,MAAM,KAAG,OACkB,CAAC;AAuB1F;;gEAEgE;AAChE,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,MAAM,QACnC,MAAM,UACJ,aAAa,CAAC,OAAO,CAAC,SACvB,eAAe,KACrB,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SA0J9C,CAAC"}

package/dist/postgres/fake-grants-sql.d.ts

@@ -0,0 +1,46 @@
+import type { PgExecutor } from './database-sql.ts';
+import { type AclEntry, type FakeCatalogTable } from './fake-grants-read.ts';
+export type { AclEntry, FakeCatalogTable };
+export interface RecordedStatement {
+    readonly text: string;
+    readonly params: ReadonlyArray<unknown>;
+}
+export interface FakeGrants extends PgExecutor {
+    readonly statements: ReadonlyArray<RecordedStatement>;
+    /** Each `transaction` call, in order — the statement list that committed together. */
+    readonly transactions: ReadonlyArray<ReadonlyArray<string>>;
+    /** Mutable on purpose: a test seeds a "competing" grant the same way `fake-sql.ts`'s
+     * `databases` map is seeded before the reconcile ever runs. */
+    readonly acl: AclEntry[];
+}
+export interface FakeGrantsOptions {
+    /** Schemas the existence check (`pg_namespace`) answers yes for. */
+    readonly schemas?: ReadonlyArray<string>;
+    /** Roles the existence check (`pg_roles`) answers yes for. */
+    readonly roles?: ReadonlyArray<string>;
+    /** Databases the existence check (`pg_database`) answers yes for. */
+    readonly databases?: ReadonlyArray<string>;
+    /** The catalog: every relation a table/column statement may name, with its columns,
+     * relkind and owner (see `fake-grants-read.ts#FakeCatalogTable`). */
+    readonly tables?: ReadonlyArray<FakeCatalogTable>;
+    /** The role that owns each seeded schema; unset means the executor owns it. */
+    readonly schemaOwner?: string;
+    /** Seed grants, each carrying its own grantor (the third-grantor survival cases). */
+    readonly acl?: ReadonlyArray<Omit<AclEntry, 'words'> & {
+        readonly words: ReadonlyArray<string>;
+    }>;
+    /** The role the statements run AS — the grantor recorded on every write, and
+     * `current_user` on the column read (default `postgres`, the owner the fixtures assume). */
+    readonly executor?: string;
+    /** Whether the executor is a superuser (default `true`: `postgres` is). A superuser, the
+     * owner itself, or a member of the owning role revokes as the owner — `revoke.sgml`'s rule,
+     * modelled by `revokesAsOwner` (fake-grants-read.ts) on both the read and the write. */
+    readonly executorSuper?: boolean;
+    /** The roles the executor is a member of (recursively): a member of a table's owning role
+     * revokes that table's grants as the owner, the same as a superuser. */
+    readonly executorMemberships?: ReadonlyArray<string>;
+    /** What `current_database()` answers (default `agents`, the declaration the fixtures use). */
+    readonly connected?: string;
+}
+export declare const makeFakeGrants: (options?: FakeGrantsOptions) => FakeGrants;
+//# sourceMappingURL=fake-grants-sql.d.ts.map

package/dist/postgres/fake-grants-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-grants-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-grants-sql.ts"],"names":[],"mappings":"AAkBA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,QAAQ,EAAE,KAAK,gBAAgB,EAAc,MAAM,uBAAuB,CAAC;AAKzF,YAAY,EAAE,QAAQ,EAAE,gBAAgB,EAAE,CAAC;AAE3C,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,UAAW,SAAQ,UAAU;IAC5C,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD,sFAAsF;IACtF,QAAQ,CAAC,YAAY,EAAE,aAAa,CAAC,aAAa,CAAC,MAAM,CAAC,CAAC,CAAC;IAC5D;mEAC+D;IAC/D,QAAQ,CAAC,GAAG,EAAE,QAAQ,EAAE,CAAC;CAC1B;AAED,MAAM,WAAW,iBAAiB;IAChC,oEAAoE;IACpE,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACzC,8DAA8D;IAC9D,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,qEAAqE;IACrE,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC3C;yEACqE;IACrE,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,gBAAgB,CAAC,CAAC;IAClD,+EAA+E;IAC/E,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,qFAAqF;IACrF,QAAQ,CAAC,GAAG,CAAC,EAAE,aAAa,CAAC,IAAI,CAAC,QAAQ,EAAE,OAAO,CAAC,GAAG;QAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;KAAE,CAAC,CAAC;IAClG;gGAC4F;IAC5F,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;4FAEwF;IACxF,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC;4EACwE;IACxE,QAAQ,CAAC,mBAAmB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACrD,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,CAAC,EAAE,MAAM,CAAC;CAC7B;AAaD,eAAO,MAAM,cAAc,aAAa,iBAAiB,KAAQ,UA+HhE,CAAC"}

package/dist/postgres/fake-grants-write.d.ts

@@ -0,0 +1,29 @@
+/**
+ * The write-semantics half of the `Postgres.Grants` test fake, extracted from
+ * `fake-grants-sql.ts` (the factory and the statement parser) to keep both files under the
+ * cap: how one `GRANT`/`REVOKE` edits the in-memory ACL with the server's rule that a
+ * superuser, the owner itself, or a member of the owning role performs the command AS the
+ * owner (`select_best_grantor`, acl.c@REL_18_6; `revoke.sgml@REL_18_6`).
+ *
+ * ★ THE EFFECTIVE GRANTOR. `effectiveGrantor` names the role a write is recorded as: the
+ *   owner when the executor acts as owner, otherwise the executor. A relation (table, column)
+ *   is owned by its `relowner`; a schema by its `nspowner`; a default ACL has no owner, so the
+ *   executor's own grants are the only ones its writes touch.
+ * ★ `GRANT` records the words on the effective grantor's entry, upgrading a base word to its
+ *   `*` (WITH GRANT OPTION) form rather than keeping both — one `aclitem` per pair.
+ * ★ `REVOKE ALL` removes the effective grantor's entry only: a third grantor's grant to the
+ *   same grantee SURVIVES silently (the survival `PostgresGrantsRepairRefused` surfaces), and
+ *   a grantee that re-granted onward fails like the server without CASCADE (`2BP01`).
+ */
+import { SqlError } from 'effect/unstable/sql/SqlError';
+import type { AclObject } from './fake-grants-parse.ts';
+import { type FakeGrantsModel } from './fake-grants-read.ts';
+/** The role a `GRANT`/`REVOKE` from the executor on `object` is performed AS (see the header). */
+export declare const effectiveGrantor: (model: FakeGrantsModel, object: AclObject) => string;
+/** Add words to the (object, grantee, effective-grantor) entry, upgrading a base word to its
+ * `*` form rather than keeping both. */
+export declare const grantWords: (model: FakeGrantsModel, object: AclObject, grantee: string, words: ReadonlyArray<string>, option: boolean) => void;
+/** Remove the effective grantor's grants for (object, grantee); a third grantor's entry
+ * survives by the keying, and a grantee that re-granted onward fails without CASCADE. */
+export declare const revoke: (model: FakeGrantsModel, object: AclObject, grantee: string, operation: string) => SqlError | undefined;
+//# sourceMappingURL=fake-grants-write.d.ts.map

package/dist/postgres/fake-grants-write.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-grants-write.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-grants-write.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AACH,OAAO,EAAE,QAAQ,EAAkB,MAAM,8BAA8B,CAAC;AACxE,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,wBAAwB,CAAC;AACxD,OAAO,EAAE,KAAK,eAAe,EAAkB,MAAM,uBAAuB,CAAC;AAQ7E,kGAAkG;AAClG,eAAO,MAAM,gBAAgB,UAAW,eAAe,UAAU,SAAS,KAAG,MAU5E,CAAC;AAEF;wCACwC;AACxC,eAAO,MAAM,UAAU,UACd,eAAe,UACd,SAAS,WACR,MAAM,SACR,aAAa,CAAC,MAAM,CAAC,UACpB,OAAO,KACd,IAeF,CAAC;AAEF;yFACyF;AACzF,eAAO,MAAM,MAAM,UACV,eAAe,UACd,SAAS,WACR,MAAM,aACJ,MAAM,KAChB,QAAQ,GAAG,SAiBb,CAAC"}

package/dist/postgres/fake-role-sql.d.ts

@@ -0,0 +1,41 @@
+/**
+ * The `Postgres.Role` half of `fake-sql.ts`: the in-memory `pg_roles` / `pg_auth_members` catalog
+ * and every statement branch that touches it, split out so each fake file serves one family.
+ *
+ * ⛔ IT PARSES ITS OWN OUTPUT, NOT SQL IN GENERAL (the rule `fake-sql.ts` documents). Every
+ *   parser here understands exactly the text `role-sql.ts` produces — quoted with `quoteIdent` /
+ *   `quoteStringLiteral` — because that is the only `CREATE ROLE`, per-field `ALTER ROLE`,
+ *   `GRANT`, `REVOKE` and `DROP ROLE` this family ever issues. A general SQL parser would hide a
+ *   quoting bug instead of tripping over it.
+ * ★ THE DEDICATED PASSWORD `ALTER ROLE … WITH PASSWORD` IS RECORDED, NEVER PARSED: `pg_roles`
+ *   answers no password value (S25), so the fake stores none either — the seal lives only in the
+ *   attributes a test seeds or a reconcile returns.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PostgresRoleAttributes } from './role-attrs.ts';
+/** The role catalog `fake-sql.ts` constructs and shares with its callers: seeded by a test, then
+ * mutated by the statements this module applies. */
+export interface FakeRoleState {
+    /** Bare role names, backing the `roleExists` check the database family's owner probe uses. */
+    readonly roleNames: Set<string>;
+    readonly roleRows: Map<string, PostgresRoleAttributes>;
+    /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = unresolvable
+     * grantor); `GRANT`/`REVOKE` mutate it. */
+    readonly memberships: Set<string>;
+    /** Options a name-only compare would hide, keyed `member\0parent\0grantor`. */
+    readonly membershipOptions: Map<string, {
+        readonly admin: boolean;
+        readonly set: boolean;
+        readonly inherit?: boolean;
+    }>;
+    /** Hands out the next `oid` a real cluster would assign. */
+    nextOid(): number;
+}
+/**
+ * Every `Postgres.Role` statement and both role reads, applied against the fake catalog. Answers
+ * the effect the statement produces — `undefined` when the text belongs to another family, so
+ * `fake-sql.ts` can fall through to its own branches.
+ */
+export declare const applyRoleStatement: <A extends object>(state: FakeRoleState, text: string, params: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<A>, SqlError> | undefined;
+//# sourceMappingURL=fake-role-sql.d.ts.map

package/dist/postgres/fake-role-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAG9D;oDACoD;AACpD,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;+CAC2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAC7B,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAC/E,CAAC;IACF,4DAA4D;IAC5D,OAAO,IAAI,MAAM,CAAC;CACnB;AAuDD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,SAC1C,aAAa,QACd,MAAM,UACJ,aAAa,CAAC,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SA6I9C,CAAC"}

package/dist/postgres/fake-schema-sql.d.ts

@@ -0,0 +1,42 @@
+/**
+ * The `Postgres.Schema` half of `fake-sql.ts`: the in-memory `pg_namespace` catalog and every
+ * statement branch that touches it, split out so each fake file serves one family.
+ *
+ * ⛔ IT PARSES ITS OWN OUTPUT, NOT SQL IN GENERAL (the rule `fake-sql.ts` documents). Every
+ *   parser understands exactly the text `schema-sql.ts` produces. A general SQL parser would
+ *   hide a quoting bug instead of tripping over it.
+ * ★ Reads answer `current_database()` from this fake's `database` — the same a real server
+ *   answers for the connection it opened — and `schemaIsEmpty` from a seeded relation set.
+ */
+import * as Effect from 'effect/Effect';
+import { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PostgresSchemaAttributes } from './schema-attrs.ts';
+/** The schema catalog `fake-sql.ts` constructs and shares with its callers. */
+export interface FakeSchemaState {
+    readonly schemas: Map<string, PostgresSchemaAttributes>;
+    /** Names of schemas this fake pretends hold at least one relation. */
+    readonly relationsIn: Set<string>;
+    /** What `current_database()` answers, and the stamp on every read row. */
+    readonly database: string;
+    /** What `current_user` answers, and the owner of a `CREATE SCHEMA` without `AUTHORIZATION`. */
+    readonly sessionRole: string;
+    readonly standardConformingStrings: boolean;
+    /** Remaining swallowed `CREATE SCHEMA`s (the S10 lie). */
+    swallowRemaining: number;
+    /** Owner a raced `CREATE SCHEMA` stores instead, consumed once. */
+    raceOwner: string | undefined;
+    nextOid(): number;
+}
+/**
+ * Every `Postgres.Schema` statement and the reads that back it. `undefined` when the text
+ * belongs to another family, so `fake-sql.ts` can fall through.
+ *
+ * ⚠️ THE EMPTY CHECK BEFORE THE NAMESPACE READ: `SCHEMA_EMPTY_SQL` contains `FROM pg_namespace`,
+ *   so a plain `includes('FROM pg_namespace')` test would swallow it.
+ * ⚠️ `current_database()` is `startsWith`, not `includes`: `SELECT_SCHEMA_SQL` also projects
+ *   `current_database() AS database`.
+ */
+export declare const applySchemaStatement: <A extends object>(state: FakeSchemaState, text: string, params: ReadonlyArray<unknown>) => Effect.Effect<ReadonlyArray<A>, SqlError> | undefined;
+/** REL_18_6 pg_namespace.dat: public exists on bootstrap, owned by pg_database_owner. */
+export declare const seedSchemas: (rows: readonly PostgresSchemaAttributes[] | undefined, database: string) => Map<string, PostgresSchemaAttributes>;
+//# sourceMappingURL=fake-schema-sql.d.ts.map

package/dist/postgres/fake-schema-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-schema-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-schema-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,QAAQ,EAAgC,MAAM,8BAA8B,CAAC;AAEtF,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,+EAA+E;AAC/E,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD,sEAAsE;IACtE,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,0EAA0E;IAC1E,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,+FAA+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,yBAAyB,EAAE,OAAO,CAAC;IAC5C,0DAA0D;IAC1D,gBAAgB,EAAE,MAAM,CAAC;IACzB,mEAAmE;IACnE,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;IAC9B,OAAO,IAAI,MAAM,CAAC;CACnB;AAED;;;;;;;;GAQG;AACH,eAAO,MAAM,oBAAoB,GAAI,CAAC,SAAS,MAAM,SAC5C,eAAe,QAChB,MAAM,UACJ,aAAa,CAAC,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SAqE9C,CAAC;AAcF,yFAAyF;AACzF,eAAO,MAAM,WAAW,SAChB,SAAS,wBAAwB,EAAE,GAAG,SAAS,YAC3C,MAAM,KACf,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAanC,CAAC"}

package/dist/postgres/fake-sql-parse.d.ts

@@ -0,0 +1,23 @@
+/**
+ * Parsers for exactly the SQL `fake-sql.ts` records — the text this family's builders emit,
+ * not SQL in general. A general parser would hide a quoting bug instead of tripping over it.
+ */
+import type { PostgresDatabaseAttributes } from './database-attrs.ts';
+import type { PostgresSchemaAttributes } from './schema-attrs.ts';
+/** Pull every field back out of exactly the text `buildCreateDatabaseSql` writes. */
+export declare const parseCreate: (text: string) => PostgresDatabaseAttributes;
+/** Parse exactly the text `buildCreateSchemaSql` writes. The caller stamps `database` and
+ * `oid`. Absent `AUTHORIZATION`, the owner is `executingRole` — Postgres's own default, the
+ * role `current_user` answers. */
+export declare const parseCreateSchema: (text: string, executingRole: string) => Omit<PostgresSchemaAttributes, 'database' | 'oid'>;
+/** Parse exactly the text `buildCommentSchemaSql` writes. */
+export declare const parseCommentSchema: (text: string, standardConformingStrings?: boolean) => {
+    readonly name: string;
+    readonly comment: string;
+};
+/** Parse exactly the text `buildDropSchemaSql` writes. */
+export declare const parseDropSchema: (text: string) => {
+    readonly name: string;
+    readonly cascade: boolean;
+};
+//# sourceMappingURL=fake-sql-parse.d.ts.map

package/dist/postgres/fake-sql-parse.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-sql-parse.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql-parse.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAIlE,qFAAqF;AACrF,eAAO,MAAM,WAAW,SAAU,MAAM,KAAG,0BA4B1C,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,iBAAiB,SACtB,MAAM,iBACG,MAAM,KACpB,IAAI,CAAC,wBAAwB,EAAE,UAAU,GAAG,KAAK,CAanD,CAAC;AAEF,6DAA6D;AAC7D,eAAO,MAAM,kBAAkB,SACvB,MAAM,0CAEX;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CASnD,CAAC;AAEF,0DAA0D;AAC1D,eAAO,MAAM,eAAe,SACpB,MAAM,KACX;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAA;CAMpD,CAAC"}

package/dist/postgres/fake-sql-quote.d.ts

@@ -0,0 +1,12 @@
+/**
+ * The inverse of `quoteIdent` / `quoteStringLiteral` (`database-sql.ts`), for the fakes that
+ * parse their own generated statement text. One place, so the database and role fakes can never
+ * disagree about what a doubled quote means.
+ */
+export declare const unquoteIdent: (raw: string) => string;
+export declare const unquoteLiteral: (raw: string) => string;
+/** Decode one entire literal, rejecting trailing SQL. PG18 §4.1.2.2: only E strings
+ * interpret backslashes when standard_conforming_strings is on. Deliberately tiny:
+ * accepts generated escapes, not the server's octal/hex/unicode grammar. */
+export declare const parseLiteral: (text: string, standardConformingStrings?: boolean) => string;
+//# sourceMappingURL=fake-sql-quote.d.ts.map

package/dist/postgres/fake-sql-quote.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"fake-sql-quote.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql-quote.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AACH,eAAO,MAAM,YAAY,QAAS,MAAM,KAAG,MAAiC,CAAC;AAE7E,eAAO,MAAM,cAAc,QAAS,MAAM,KAAG,MACG,CAAC;AAEjD;;4EAE4E;AAC5E,eAAO,MAAM,YAAY,SAAU,MAAM,0CAAqC,MAsB7E,CAAC"}

package/dist/postgres/fake-sql.d.ts

@@ -1,5 +1,7 @@
 import type { PostgresDatabaseAttributes } from './database-attrs.ts';
 import type { PgExecutor } from './database-sql.ts';
+import type { PostgresRoleAttributes } from './role-attrs.ts';
+import type { PostgresSchemaAttributes } from './schema-attrs.ts';
 export interface RecordedStatement {
     readonly text: string;
     readonly params: ReadonlyArray<unknown>;
@@ -9,14 +11,54 @@ export interface FakeSql extends PgExecutor {
     /** Mutable on purpose: a test seeds a row a "competing" statement would have produced (the
      * `42P04` race case) before the fake ever sees it. */
     readonly databases: Map<string, PostgresDatabaseAttributes>;
+    /** Mutable on purpose: a test seeds a live role (adoption, drift) or clears one (drop). */
+    readonly roleRows: Map<string, PostgresRoleAttributes>;
+    /** `member\0parent\0grantor` triples backing `pg_auth_members` (a plain `pg_auth_members`
+     * read, a grant, a revoke and a DROP ROLE cascade all go through `fake-role-sql.ts`);
+     * `GRANT`/`REVOKE` mutate it. An empty grantor segment is an inconsistent catalog/test row. */
+    readonly memberships: Set<string>;
+    /** Options on a membership the name alone hides, keyed `member\0parent\0grantor`. Absent
+     * means neither ADMIN, SET nor an explicit per-grant INHERIT. */
+    readonly membershipOptions: Map<string, {
+        readonly admin: boolean;
+        readonly set: boolean;
+        readonly inherit?: boolean;
+    }>;
+    /** Mutable on purpose: a test seeds a live schema (adoption, drift) or clears one (drop). */
+    readonly schemas: Map<string, PostgresSchemaAttributes>;
+    /** Mutable on purpose: names of schemas this fake pretends hold at least one relation, so a
+     * `cascade: false` drop refusal has something to refuse. */
+    readonly relationsIn: Set<string>;
 }
 export interface FakeSqlOptions {
+    readonly standardConformingStrings?: boolean;
     readonly roles?: ReadonlyArray<string>;
     readonly databases?: ReadonlyArray<PostgresDatabaseAttributes>;
+    readonly roleRows?: ReadonlyArray<PostgresRoleAttributes>;
     /** Fail the NEXT `CREATE DATABASE` with SQLSTATE `42P04` (duplicate_database), once, the way a
      * concurrent creator racing this reconcile would — classified exactly as
      * `@effect/sql-pg`'s own driver classifies it (`database-sql.ts`'s header). */
     readonly raceNextCreate?: boolean;
+    /** Fail the next statement whose text starts with this prefix, once, without applying it.
+     * A `transaction` that included earlier statements rolls them back. */
+    readonly failNext?: string;
+    readonly schemas?: ReadonlyArray<PostgresSchemaAttributes>;
+    /** Names of schemas the fake answers `schemaIsEmpty` with `false` for. */
+    readonly schemasWithRelations?: ReadonlyArray<string>;
+    /** Accept the NEXT `CREATE SCHEMA` (no error) but record nothing — the S10 case where the
+     * write's own report is a lie and the immediate re-read finds nothing. */
+    readonly swallowNextCreateSchema?: boolean;
+    /** What `current_database()` answers and every schema row is stamped with (a real server
+     * always reports the database its connection opened). Default `postgres`. */
+    readonly database?: string;
+    /** The NEXT `CREATE SCHEMA` races with a row owned by THIS role — a
+     * concurrent creator won between the first `SELECT` and the `IF NOT EXISTS`, which then
+     * does nothing; plain CREATE instead fails with 42P06. Consumed once. */
+    readonly raceNextCreateSchema?: string;
+    /** What `current_user` answers, and the owner a `CREATE SCHEMA` without `AUTHORIZATION`
+     * stores. Default `postgres`. A test that sets this pins the omitted-owner comparison
+     * against the session role, not a hardcoded name. */
+    readonly currentUser?: string;
 }
 export declare const makeFakeSql: (options?: FakeSqlOptions) => FakeSql;
 //# sourceMappingURL=fake-sql.d.ts.map

package/dist/postgres/fake-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql.ts"],"names":[],"mappings":"AAcA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;CAC7D;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC/D;;mFAE+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;CACnC;AAoCD,eAAO,MAAM,WAAW,aAAa,cAAc,KAAQ,OAkD1D,CAAC"}
+{"version":3,"file":"fake-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5D,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;;mGAE+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC;qEACiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAC7B,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAC/E,CAAC;IACF,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC1D;;mFAE+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD;8EAC0E;IAC1E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;iFAC6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;6EAEyE;IACzE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;yDAEqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,WAAW,aAAa,cAAc,KAAQ,OA+J1D,CAAC"}