@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/postgres/grants-attrs.d.ts

@@ -0,0 +1,115 @@
+/** Every schema privilege `GRANT … ON SCHEMA` accepts at REL_18_6 (`ACL_ALL_RIGHTS_SCHEMA`).
+ * `CREATE` lets the role create objects IN the schema; `USAGE` lets it use objects already
+ * there. `schemaUsage` defaults true (a role declared into a schema it cannot even resolve
+ * is almost always a mistake), `schemaCreate` defaults false (create is a real power). */
+export declare const SCHEMA_PRIVILEGES: readonly ['usage', 'create'];
+export type SchemaPrivilege = (typeof SCHEMA_PRIVILEGES)[number];
+/** Every table privilege `GRANT … ON TABLE` accepts at REL_18_6
+ * (`ACL_ALL_RIGHTS_RELATION`). Views are relations with these same letters. */
+export declare const TABLE_PRIVILEGES: readonly ['select', 'insert', 'update', 'delete', 'truncate', 'references', 'trigger', 'maintain'];
+export type TablePrivilege = (typeof TABLE_PRIVILEGES)[number];
+/** Every column privilege the column synopsis accepts at REL_18_6
+ * (`ACL_ALL_RIGHTS_COLUMN`) — the intersection of the table set with what a single column
+ * can carry, measured from `grant.sgml`'s own column form, asserted in
+ * `grants-provenance.test.ts`. */
+export declare const COLUMN_PRIVILEGES: readonly ['select', 'insert', 'update', 'references'];
+export type ColumnPrivilege = (typeof COLUMN_PRIVILEGES)[number];
+/** Every word across the three vocabularies — the superset the statement builders
+ * (`grants-sql.ts`) validate each privilege against before it ever reaches a `GRANT`
+ * clause, so a word that no class declares can never be concatenated into SQL. */
+export declare const ALL_GRANT_WORDS: ReadonlyArray<string>;
+export declare const letterForPrivilege: (word: string) => string;
+/** One declared table grant. `privileges` holds words; a trailing `*` on a word means
+ * WITH GRANT OPTION for that privilege. Default privileges (for future tables) are a
+ * separate prop — this one never touches `pg_default_acl`. */
+export interface PostgresGrantsTable {
+    readonly table: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+/** One declared column grant, from the synopsis' own column form:
+ * `GRANT … ON TABLE t ( c )` (`grant.sgml@REL_18_6`). */
+export interface PostgresGrantsColumn {
+    readonly table: string;
+    readonly column: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+/** One declared default-privileges entry. PostgreSQL records one
+ * `pg_default_acl` row per (defaclrole, defaclnamespace, defaclobjtype); `forRole` is the
+ * role whose FUTURE objects get the privilege (`FOR ROLE <target_role>` in
+ * `ALTER DEFAULT PRIVILEGES`) and is REQUIRED — the resource never infers the connecting
+ * role, so every entry reads back as exactly the role it names. The privileges apply to
+ * future TABLES (DEFACLOBJ_RELATION `'r'`, the only objtype this family writes). */
+export interface PostgresGrantsDefault {
+    readonly forRole: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+/** The declared grant set: one role, in one schema of one database.
+ *
+ * `role` is a group role a human owns the membership of — roles come from elsewhere (the
+ * operator, or a role resource in this family once one lands); this resource only writes
+ * ACL rows. `database` names the cluster-side database the statements run IN — never
+ * `ALTER DATABASE` privileges, which this family does not issue — and `reconcile` refuses
+ * a declaration whose `database` differs from the one the connection actually opened. `revokeFromPublic` strips PUBLIC's default USAGE on schema `public`
+ * and any default SELECT that might exist (PG15 stopped granting PUBLIC CREATE on `public`,
+ * `ddl.sgml@REL_15_1`; PostgreSQL never grants PUBLIC SELECT on tables by default).
+ */
+export interface PostgresGrantsProps {
+    readonly role: string;
+    readonly database: string;
+    readonly schema: string;
+    /** `GRANT USAGE ON SCHEMA` (`pg_namespace.nspacl`). @default true */
+    readonly schemaUsage?: boolean;
+    /** `GRANT CREATE ON SCHEMA` (`pg_namespace.nspacl`). @default false */
+    readonly schemaCreate?: boolean;
+    readonly tables?: ReadonlyArray<PostgresGrantsTable>;
+    readonly columnGrants?: ReadonlyArray<PostgresGrantsColumn>;
+    readonly defaultPrivileges?: ReadonlyArray<PostgresGrantsDefault>;
+    /** `REVOKE ALL ON SCHEMA/ALL TABLES IN SCHEMA FROM PUBLIC` (ddl.sgml: an empty grantee
+     * stands for PUBLIC). @default false */
+    readonly revokeFromPublic?: boolean;
+}
+/** Live attributes, read back from the catalogs after reconcile. Arrays are sorted
+ * (schema tables, then columns) so a persisted state file compares stably, and every word
+ * set is restricted to the objects THIS declaration names (see `attributesOf` in
+ * `grants-plan.ts`). `publicSchemaRevoked`/`publicTablesRevoked` record the one-directional
+ * PUBLIC fact the catalogs answer: PUBLIC holds nothing on the schema itself / on any
+ * relation or column in it. `schemaOwnedByRole`/`ownedTables` record the ownership facts
+ * the catalogs answer: the declared role OWNS the schema / those relations, so it holds
+ * every privilege on them implicitly — the projection records an empty word list for an
+ * owned object (the ACL rows say nothing) and the repair leaves owned objects' ACL rows
+ * alone, because a `REVOKE` cannot take an owner's implicit rights away. */
+export interface PostgresGrantsAttributes {
+    readonly role: string;
+    readonly database: string;
+    readonly schema: string;
+    readonly schemaPrivileges: ReadonlyArray<string>;
+    readonly tables: ReadonlyArray<PostgresGrantsAttributesTable>;
+    readonly columns: ReadonlyArray<PostgresGrantsAttributesColumn>;
+    readonly defaults: ReadonlyArray<PostgresGrantsAttributesDefault>;
+    readonly publicSchemaRevoked: boolean;
+    readonly publicTablesRevoked: boolean;
+    readonly schemaOwnedByRole: boolean;
+    readonly ownedTables: ReadonlyArray<string>;
+}
+export interface PostgresGrantsAttributesTable {
+    readonly table: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+export interface PostgresGrantsAttributesColumn {
+    readonly table: string;
+    readonly column: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+export interface PostgresGrantsAttributesDefault {
+    readonly forRole: string;
+    readonly privileges: ReadonlyArray<string>;
+}
+/** Refuse a name the server would truncate (`NAMEDATALEN`, the same limit
+ * `Postgres.Database` enforces — roles, schemas, tables and columns are all `NameData`).
+ * Named `grantsNameByteRefusal` so the barrel can export it beside database-attrs' own
+ * `nameByteRefusal` without a collision. */
+export declare const grantsNameByteRefusal: (name: string) => {
+    readonly byteLength: number;
+    readonly limit: number;
+} | undefined;
+//# sourceMappingURL=grants-attrs.d.ts.map

package/dist/postgres/grants-attrs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-attrs.ts"],"names":[],"mappings":"AAwBA;;;0FAG0F;AAC1F,eAAO,MAAM,iBAAiB,YAAI,OAAO,EAAE,QAAQ,CAAU,CAAC;AAC9D,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;+EAC+E;AAC/E,eAAO,MAAM,gBAAgB,YAC3B,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,QAAQ,EACR,UAAU,EACV,YAAY,EACZ,SAAS,EACT,UAAU,CACF,CAAC;AACX,MAAM,MAAM,cAAc,GAAG,CAAC,OAAO,gBAAgB,CAAC,CAAC,MAAM,CAAC,CAAC;AAE/D;;;kCAGkC;AAClC,eAAO,MAAM,iBAAiB,YAAI,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,YAAY,CAAU,CAAC;AACvF,MAAM,MAAM,eAAe,GAAG,CAAC,OAAO,iBAAiB,CAAC,CAAC,MAAM,CAAC,CAAC;AAEjE;;kFAEkF;AAClF,eAAO,MAAM,eAAe,EAAE,aAAa,CAAC,MAAM,CAA+C,CAAC;AAmBlG,eAAO,MAAM,kBAAkB,SAAU,MAAM,KAAG,MAIjD,CAAC;AAEF;;8DAE8D;AAC9D,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED;yDACyD;AACzD,MAAM,WAAW,oBAAoB;IACnC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED;;;;;oFAKoF;AACpF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED;;;;;;;;;GASG;AACH,MAAM,WAAW,mBAAmB;IAClC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,qEAAqE;IACrE,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,uEAAuE;IACvE,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,MAAM,CAAC,EAAE,aAAa,CAAC,mBAAmB,CAAC,CAAC;IACrD,QAAQ,CAAC,YAAY,CAAC,EAAE,aAAa,CAAC,oBAAoB,CAAC,CAAC;IAC5D,QAAQ,CAAC,iBAAiB,CAAC,EAAE,aAAa,CAAC,qBAAqB,CAAC,CAAC;IAClE;4CACwC;IACxC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CACrC;AAED;;;;;;;;;4EAS4E;AAC5E,MAAM,WAAW,wBAAwB;IACvC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,6BAA6B,CAAC,CAAC;IAC9D,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC,8BAA8B,CAAC,CAAC;IAChE,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,+BAA+B,CAAC,CAAC;IAClE,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,iBAAiB,EAAE,OAAO,CAAC;IACpC,QAAQ,CAAC,WAAW,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC7C;AAED,MAAM,WAAW,6BAA6B;IAC5C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,8BAA8B;IAC7C,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED,MAAM,WAAW,+BAA+B;IAC9C,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC5C;AAED;;;4CAG4C;AAC5C,eAAO,MAAM,qBAAqB,SAC1B,MAAM,KACX;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAK5D,CAAC"}

package/dist/postgres/grants-declare.d.ts

@@ -0,0 +1,88 @@
+/**
+ * `Postgres.Grants`' declared shape, normalized: every default applied, every list sorted,
+ * the names recovered from the persisted attributes, the cleared twin `delete` replays and
+ * the entries an update removed. Pure — no client, no `Effect` — so `reconcile`, the
+ * engine's `diff` and the tests share one implementation. Word validation and the refusals
+ * live in `grants-refuse.ts`; the comparison against live catalogs and the read-back
+ * projection in `grants-plan.ts` and `grants-diff.ts`.
+ *
+ * ★ WHAT THE RESOURCE OWNS, PRECISELY. For every object the declaration NAMES — the schema,
+ *   each table, each column, each (`forRole`) default — the role's full privilege set is
+ *   declared; an object the declaration does not name is NEVER touched. PUBLIC's privileges
+ *   are touched only when `revokeFromPublic` says so, and only by clearing: this family
+ *   never issues a `GRANT … TO PUBLIC`.
+ */
+import type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';
+/** The resolved declaration: every default applied, every word validated, every list
+ * sorted. Both the live bundle (`grants-read.ts`) and the persisted attributes are already
+ * in these shapes. */
+export interface DeclaredGrants {
+    readonly role: string;
+    readonly database: string;
+    readonly schema: string;
+    readonly schemaPrivileges: ReadonlyArray<string>;
+    readonly tables: ReadonlyArray<{
+        readonly table: string;
+        readonly privileges: ReadonlyArray<string>;
+    }>;
+    readonly columns: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+        readonly privileges: ReadonlyArray<string>;
+    }>;
+    readonly defaults: ReadonlyArray<{
+        readonly forRole: string;
+        readonly privileges: ReadonlyArray<string>;
+    }>;
+    readonly publicSchemaRevoked: boolean;
+    readonly publicTablesRevoked: boolean;
+}
+export declare const baseWord: (word: string) => string;
+/** The one place defaults resolve to values: `schemaUsage` true, `schemaCreate` false, the
+ * PUBLIC revokes false. Every caller — plan, reconcile, diff — normalizes through here so
+ * the three never disagree on what an omitted prop means. */
+export declare const resolveProps: (props: PostgresGrantsProps) => DeclaredGrants;
+/** Split one validated word list by its grant-option mark: a mixed list cannot be a single
+ * `GRANT` (one `WITH GRANT OPTION` clause would grant the option to every listed
+ * privilege, `grants-sql.ts`'s header), so the repair issues one statement per group. */
+export declare const splitGrantWords: (words: ReadonlyArray<string>) => {
+    readonly plain: ReadonlyArray<string>;
+    readonly grantable: ReadonlyArray<string>;
+};
+/** The names the live read is PROJECTED onto — attributes record what the catalogs say,
+ * restricted to the objects one declaration names (an object the declaration never named
+ * must not appear in them: the engine's diff would read it as drift the repair is forbidden
+ * to touch). */
+export interface DeclaredNames {
+    readonly role: string;
+    readonly database: string;
+    readonly schema: string;
+    readonly tables: ReadonlyArray<string>;
+    readonly columns: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+    }>;
+    readonly defaults: ReadonlyArray<string>;
+}
+export declare const declaredNames: (declared: DeclaredGrants) => DeclaredNames;
+/** Recover the last declaration's names from the persisted attributes, for `read`'s
+ * projection when a state file exists (`attributesOf` uses only the names; the recorded
+ * words are the catalogs' to decide). */
+export declare const namesFromAttrs: (attrs: PostgresGrantsAttributes) => DeclaredNames;
+/** The `delete` twin of a declaration: the same names, every privilege list emptied, the
+ * PUBLIC flags off. `planRepair` turns it into exactly the revoke set delete may issue —
+ * one revoke per named object where live still shows the role words, nothing for PUBLIC.
+ * A table revoke still restores the column collateral it clears (`grants-plan.ts`), so a
+ * delete takes away what the declaration managed and leaves a DBA's or another resource's
+ * undeclared column grant untouched. */
+export declare const clearedDeclaration: (declared: DeclaredGrants) => DeclaredGrants;
+/** The entries an update REMOVED from the last applied declaration: the names in
+ * `output` (the persisted attributes) that the new declaration no longer names, every
+ * word list emptied — the input `grants-plan.ts#planRevocations` turns into the revoke set
+ * the reconcile runs before the new declaration's repair, so removing an entry takes the
+ * privilege away instead of silently retaining it. `undefined` when `output` is undefined
+ * (first apply) or nothing was removed. The `database`-mismatch and retarget guards run
+ * first, so the removed set can only ever hold tables, columns and defaults — the schema
+ * class never gains or loses an entry. */
+export declare const removedNames: (output: PostgresGrantsAttributes | undefined, declared: DeclaredGrants) => Pick<DeclaredGrants, 'schema' | 'role' | 'tables' | 'columns' | 'defaults'> | undefined;
+//# sourceMappingURL=grants-declare.d.ts.map

package/dist/postgres/grants-declare.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-declare.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-declare.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF;;sBAEsB;AACtB,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,gBAAgB,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACjD,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC;QAC7B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAC;IACH,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAC9B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAC;IACH,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC;QAC/B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;QACzB,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;KAC5C,CAAC,CAAC;IACH,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;CACvC;AAKD,eAAO,MAAM,QAAQ,SAAU,MAAM,KAAG,MAAyD,CAAC;AAElG;;6DAE6D;AAC7D,eAAO,MAAM,YAAY,UAAW,mBAAmB,KAAG,cAuBxD,CAAC;AAEH;;yFAEyF;AACzF,eAAO,MAAM,eAAe,UACnB,aAAa,CAAC,MAAM,CAAC,KAC3B;IAAE,QAAQ,CAAC,KAAK,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAAC,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAA;CAGnF,CAAC;AAEH;;;gBAGgB;AAChB,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;IACrF,QAAQ,CAAC,QAAQ,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC1C;AAED,eAAO,MAAM,aAAa,aAAc,cAAc,KAAG,aAOvD,CAAC;AAEH;;yCAEyC;AACzC,eAAO,MAAM,cAAc,UAAW,wBAAwB,KAAG,aAO/D,CAAC;AAEH;;;;;wCAKwC;AACxC,eAAO,MAAM,kBAAkB,aAAc,cAAc,KAAG,cAY5D,CAAC;AAEH;;;;;;;0CAO0C;AAC1C,eAAO,MAAM,YAAY,WACf,wBAAwB,GAAG,SAAS,YAClC,cAAc,KACvB,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,GAAG,SAsBhF,CAAC"}

package/dist/postgres/grants-diff.d.ts

@@ -0,0 +1,25 @@
+/**
+ * The offline half of `Postgres.Grants`' diff engine: the read-back projection
+ * (`attributesOf`) and the plan-time comparison (`grantsDiffer`). Pure — no client, no
+ * `Effect` — so `reconcile`'s read-back and the engine's `diff` project and compare one
+ * way. The repair and revocation statement lists live in `grants-plan.ts`.
+ */
+import type { PostgresGrantsAttributes } from './grants-attrs.ts';
+import type { DeclaredGrants, DeclaredNames } from './grants-declare.ts';
+import type { LiveGrants } from './grants-read.ts';
+/** The read-back projection: live catalog words, restricted to the names this declaration
+ * (or, for `read`, the last one) claims — plus the one-directional PUBLIC fact and the
+ * ownership facts. The PUBLIC-tables fact is scoped to the relkinds the bulk revoke
+ * statement actually reaches; an owned object records an empty word list (the ACL rows say
+ * nothing; ownership carries the privileges). */
+export declare const attributesOf: (live: LiveGrants, names: DeclaredNames) => PostgresGrantsAttributes;
+/** The engine's plan-time comparison: the new declaration against the recorded (or freshly
+ * read) attributes. PUBLIC is one-directional — a declaration that does not revoke
+ * PUBLIC leaves whatever it holds alone, so live PUBLIC privileges with
+ * `revokeFromPublic: false` are never drift. Everything else is full equality, grant-option
+ * marks included; a changed NAME SET (a table added to or removed from the declaration)
+ * answers `true` so one reconcile re-records the projection in the new shape. Owned objects
+ * are skipped exactly as the repair skips them: their word list is meaningless (the owner
+ * holds everything implicitly), so only a name-set change on one can answer `true`. */
+export declare const grantsDiffer: (declared: DeclaredGrants, live: PostgresGrantsAttributes) => boolean;
+//# sourceMappingURL=grants-diff.d.ts.map

package/dist/postgres/grants-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-diff.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAClE,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AAEzE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAGnD;;;;iDAIiD;AACjD,eAAO,MAAM,YAAY,SAAU,UAAU,SAAS,aAAa,KAAG,wBAyBpE,CAAC;AAEH;;;;;;;uFAOuF;AACvF,eAAO,MAAM,YAAY,aAAc,cAAc,QAAQ,wBAAwB,KAAG,OAgDvF,CAAC"}

package/dist/postgres/grants-errors.d.ts

@@ -0,0 +1,137 @@
+declare const PostgresGrantsPrivilegeRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsPrivilegeRefused";
+} & Readonly<A>;
+/** A declared privilege word is outside the vocabulary its prop draws from — e.g. `TRUNCATE`
+ * on a column grant (table-wide only at REL_18_6) or `EXECUTE` anywhere (this family never
+ * leaves the table/schema/column words). */
+export declare class PostgresGrantsPrivilegeRefused extends PostgresGrantsPrivilegeRefused_base<{
+    readonly prop: string;
+    readonly word: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsNameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsNameRefused";
+} & Readonly<A>;
+/** A declared name would be silently truncated (same rule as `PostgresDatabaseNameRefused`):
+ * roles, schemas, tables and columns are all `NameData`. */
+export declare class PostgresGrantsNameRefused extends PostgresGrantsNameRefused_base<{
+    readonly name: string;
+    readonly byteLength: number;
+    readonly limit: number;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsDuplicateObject_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsDuplicateObject";
+} & Readonly<A>;
+/** Two declaration entries name the same object (one table twice, one column pair twice,
+ * one `forRole` twice) — silently merging them would hide which entry the operator meant.
+ * The same refusal fires when one word list declares a base word both plain and
+ * `*`-marked: the server keeps ONE aclitem per grantee per grantor, so those two states
+ * can never both hold and the set would never converge. */
+export declare class PostgresGrantsDuplicateObject extends PostgresGrantsDuplicateObject_base<{
+    readonly prop: string;
+    readonly name: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsRetargetRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsRetargetRefused";
+} & Readonly<A>;
+/** A logical id's `role`, `database` or `schema` changed. Those three name WHAT the grant set
+ * is about; changing one is a different grant set, not an edit of this one. */
+export declare class PostgresGrantsRetargetRefused extends PostgresGrantsRetargetRefused_base<{
+    readonly prop: string;
+    readonly from: string;
+    readonly to: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsDatabaseMismatch_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsDatabaseMismatch";
+} & Readonly<A>;
+/** `current_database()` is not the database the declaration names. The handlers open the
+ * declared database (`withPg`'s override — the family connection stays on the maintenance
+ * database); this fires when that open did not land there. Granting in the wrong database
+ * would succeed silently and read back as drift forever. */
+export declare class PostgresGrantsDatabaseMismatch extends PostgresGrantsDatabaseMismatch_base<{
+    readonly declared: string;
+    readonly connected: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsSchemaMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsSchemaMissing";
+} & Readonly<A>;
+/** `reconcile` refuses to repair into a schema the catalogs do not have: grants belong to an
+ * existing container (`Postgres.Schema` creates one; this family never creates anything). */
+export declare class PostgresGrantsSchemaMissing extends PostgresGrantsSchemaMissing_base<{
+    readonly schema: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsDatabaseMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsDatabaseMissing";
+} & Readonly<A>;
+/** `reconcile` refuses to apply into a database `pg_database` does not have. `read` and `delete`
+ * treat a missing database as absence (first create / no-op), but a reconcile names a container
+ * it must write into — probing first turns what would be an untyped connect failure
+ * (`ConnectionError` over psql, `UnknownError` 3D000 over the socket) into a typed refusal. */
+export declare class PostgresGrantsDatabaseMissing extends PostgresGrantsDatabaseMissing_base<{
+    readonly database: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsRoleMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsRoleMissing";
+} & Readonly<A>;
+/** The grantee role, or a default-privileges `forRole` creator, is not in `pg_roles` —
+ * checked before any statement runs, the way `Postgres.Schema` checks its `AUTHORIZATION`
+ * owner. */
+export declare class PostgresGrantsRoleMissing extends PostgresGrantsRoleMissing_base<{
+    readonly role: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsTableMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsTableMissing";
+} & Readonly<A>;
+/** A declared table is not a relation in the schema. The resource refuses before any
+ * statement, because a GRANT/REVOKE on a missing relation would surface as a raw 42P01
+ * after earlier statements had already landed — and the state row would stay `creating`. */
+export declare class PostgresGrantsTableMissing extends PostgresGrantsTableMissing_base<{
+    readonly schema: string;
+    readonly table: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsColumnMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsColumnMissing";
+} & Readonly<A>;
+/** A declared column is not an attribute of its table. The resource refuses before any
+ * statement, matching the table-missing guard. */
+export declare class PostgresGrantsColumnMissing extends PostgresGrantsColumnMissing_base<{
+    readonly schema: string;
+    readonly table: string;
+    readonly column: string;
+}> {
+    get message(): string;
+}
+declare const PostgresGrantsRepairRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresGrantsRepairRefused";
+} & Readonly<A>;
+/** The repair ran clean, but the immediate re-read (S10) still plans statements: a grant this
+ * family cannot revoke survived (its grantor still holds the grant option, or the executing
+ * role is neither the owner nor that grantor). Re-planning forever would hide it as silent
+ * drift, so it fails loud with the surviving statements. */
+export declare class PostgresGrantsRepairRefused extends PostgresGrantsRepairRefused_base<{
+    readonly schema: string;
+    readonly role: string;
+    readonly remaining: ReadonlyArray<string>;
+}> {
+    get message(): string;
+}
+export type PostgresGrantsError = PostgresGrantsPrivilegeRefused | PostgresGrantsNameRefused | PostgresGrantsDuplicateObject | PostgresGrantsRetargetRefused | PostgresGrantsDatabaseMismatch | PostgresGrantsDatabaseMissing | PostgresGrantsSchemaMissing | PostgresGrantsRoleMissing | PostgresGrantsTableMissing | PostgresGrantsColumnMissing | PostgresGrantsRepairRefused;
+export {};
+//# sourceMappingURL=grants-errors.d.ts.map

package/dist/postgres/grants-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-errors.ts"],"names":[],"mappings":";;;AAYA;;4CAE4C;AAC5C,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;4DAC4D;AAC5D,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;2DAI2D;AAC3D,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;+EAC+E;AAC/E,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;4DAG4D;AAC5D,qBAAa,8BAA+B,SAAQ,oCAElD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;6FAC6F;AAC7F,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;+FAG+F;AAC/F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;YAEY;AACZ,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;4FAE4F;AAC5F,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;kDACkD;AAClD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;4DAG4D;AAC5D,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;CAC3C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAQ7B;CACF;AAED,MAAM,MAAM,mBAAmB,GAC3B,8BAA8B,GAC9B,yBAAyB,GACzB,6BAA6B,GAC7B,6BAA6B,GAC7B,8BAA8B,GAC9B,6BAA6B,GAC7B,2BAA2B,GAC3B,yBAAyB,GACzB,0BAA0B,GAC1B,2BAA2B,GAC3B,2BAA2B,CAAC"}

package/dist/postgres/grants-existence.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Pre-statement existence guards for `Postgres.Grants`: every declared table and column
+ * must exist in the schema before any GRANT/REVOKE runs. A missing object would fail
+ * as a raw 42P01/42703 after earlier statements had already landed, leaving the state
+ * row `creating` and the resume failing OwnedBySomeoneElse.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+import type { DeclaredGrants } from './grants-declare.ts';
+import { PostgresGrantsColumnMissing, PostgresGrantsTableMissing } from './grants-errors.ts';
+/** Fail typed before any statement if a declared table or column does not exist. */
+export declare const requireDeclaredObjectsExist: (pg: PgExecutor, declared: DeclaredGrants) => Effect.Effect<void, PostgresGrantsTableMissing | PostgresGrantsColumnMissing | SqlError>;
+//# sourceMappingURL=grants-existence.d.ts.map

package/dist/postgres/grants-existence.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-existence.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-existence.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,EAAE,2BAA2B,EAAE,0BAA0B,EAAE,MAAM,oBAAoB,CAAC;AA4D7F,oFAAoF;AACpF,eAAO,MAAM,2BAA2B,OAClC,UAAU,YACJ,cAAc,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,0BAA0B,GAAG,2BAA2B,GAAG,QAAQ,CA0BtF,CAAC"}

package/dist/postgres/grants-ops.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The lifecycle cores of `Postgres.Grants`, against any `PgExecutor` — the real pooled
+ * client through `withPg`, or the recording fake in tests: `reconcile`, `read`, `delete`
+ * and the plan-time `diff`. The resource declaration and its doctrine header live in
+ * `grants.ts`.
+ *
+ * ★ VALIDATE BEFORE ANY STATEMENT. The declaration refusals and the name-length check are
+ *   pure and run first, then the container guards (schema in `pg_namespace`, the grantee
+ *   role and every default-privileges creator in `pg_roles`), then — and only then — the
+ *   repair's statements.
+ * ★ `reconcile` CONVERGES BY PROOF, NOT TRUST (S10): read → plan → execute → re-read →
+ *   re-plan; an EMPTY second plan is the success condition and a non-empty one fails loud
+ *   with the surviving statements (`PostgresGrantsRepairRefused`).
+ * ★ `output` (the last applied attributes) drives the two update-path repairs: the
+ *   RETARGET guard (the plan-time one can be bypassed when `news` was unresolved at diff
+ *   time — a role created in the same deploy) and the REMOVED-entries revoke set, run
+ *   before the new declaration's plan and re-read after, because the server's `REVOKE ALL`
+ *   on a table also clears that grantee's column entries on it.
+ * ★ `read` answers `undefined` for a target that holds NOTHING anywhere and has no stored
+ *   output: that is a first create, never an adoption of an empty schema (H1: only grants
+ *   mark the target as live). On the update path — the resource already has applied state
+ *   — an all-empty projection is a real answer (the grantee owns everything outright, so
+ *   `aclexplode` has no rows) and is returned as the projection, not as absent. No role
+ *   check — the aclexplode reads are missing-role-safe by construction (`grants-read.ts`).
+ * ★ `delete` NEVER RE-GRANTS THE DECLARATION, NEVER CASCADES. The `retain` policy is the
+ *   default; the revokes are idempotent; the delete then re-reads and re-plans like
+ *   `reconcile` does (S10), so a third grantor's grant that a revoke cannot clear fails loud
+ *   with the surviving statements (`PostgresGrantsRepairRefused`) instead of surviving
+ *   silently (`REVOKE … CASCADE` is never issued). The one re-grant a delete still makes is
+ *   the collateral a table `REVOKE ALL` clears on columns the declaration never named (a
+ *   DBA's or another Grants resource's column grant): `planRepair` restores those as it does
+ *   on the reconcile path (`grants.ts:17-18`, `grants-plan.ts:12-14`), so a delete takes
+ *   away what the declaration managed and leaves everything else exactly as it was.
+ * ★ THE REPAIR'S WRITES ARE ONE TRANSACTION. `unsafe` is still one command — the socket
+ *   path's prepared statement cannot carry several, and each psql `unsafe` is its own
+ *   process — but `pg.transaction` is `BEGIN`…`COMMIT` on both transports (one reserved
+ *   connection on the socket, one psql script on the runner; `psql-executor.ts`). GRANT
+ *   and REVOKE do not call `PreventInTransactionBlock` (`database-sql.ts` cites the same
+ *   rule for role membership). Removal revokes and the repair are planned together
+ *   against one read (`planReconcile`: removed tables count as revoked) and committed
+ *   together, so a live grantee never observes the gap between a `REVOKE ALL` and the
+ *   grants that restore it. The convergence re-read runs after that commit.
+ */
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';
+import type { PgExecutor } from './database-sql.ts';
+import type { namesFromAttrs } from './grants-declare.ts';
+import { PostgresGrantsDatabaseMismatch, PostgresGrantsDuplicateObject, type PostgresGrantsError, PostgresGrantsNameRefused, PostgresGrantsPrivilegeRefused, PostgresGrantsRepairRefused, PostgresGrantsRetargetRefused } from './grants-errors.ts';
+export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresGrantsProps, output: PostgresGrantsAttributes | undefined) => Effect.Effect<PostgresGrantsAttributes, PostgresGrantsError | SqlError>;
+export declare const readWithClient: (pg: PgExecutor, names: ReturnType<typeof namesFromAttrs>, stored: boolean) => Effect.Effect<PostgresGrantsAttributes | undefined, PostgresGrantsDatabaseMismatch | SqlError>;
+export declare const deleteWithClient: (pg: PgExecutor, props: PostgresGrantsProps) => Effect.Effect<void, PostgresGrantsDatabaseMismatch | PostgresGrantsRepairRefused | SqlError>;
+/** Plan-time only, entirely offline: a retarget of `role`/`database`/`schema` is a refusal
+ * (those three name WHAT the grant set is about); everything else validates the same way
+ * `reconcileWithClient` does, then answers `update` on any drift or `noop` on equality.
+ * Unresolved news answers `undefined` (the engine falls back to its own comparison) — the
+ * retarget is then re-checked inside `reconcile`, where news is resolved, so the bypass a
+ * same-deploy role would otherwise get is closed. */
+export declare const diffPostgresGrants: (news: Input<PostgresGrantsProps>, output: PostgresGrantsAttributes | undefined) => Effect.Effect<{
+    readonly action: 'update';
+} | {
+    readonly action: 'noop';
+} | undefined, PostgresGrantsDuplicateObject | PostgresGrantsNameRefused | PostgresGrantsPrivilegeRefused | PostgresGrantsRetargetRefused, never>;
+//# sourceMappingURL=grants-ops.d.ts.map

package/dist/postgres/grants-ops.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-ops.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-ops.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA0CG;AACH,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAW1D,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,KAAK,mBAAmB,EACxB,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAG9B,MAAM,oBAAoB,CAAC;AA+B5B,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,KAC3C,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,mBAAmB,GAAG,QAAQ,CA+CrE,CAAC;AAEL,eAAO,MAAM,cAAc,OACrB,UAAU,SACP,UAAU,CAAC,OAAO,cAAc,CAAC,UAChC,OAAO,KACd,MAAM,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,EAAE,8BAA8B,GAAG,QAAQ,CAY5F,CAAC;AAEL,eAAO,MAAM,gBAAgB,OACvB,UAAU,SACP,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,8BAA8B,GAAG,2BAA2B,GAAG,QAAQ,CAoB1F,CAAC;AAEL;;;;;qDAKqD;AACrD,eAAO,MAAM,kBAAkB,SACvB,KAAK,CAAC,mBAAmB,CAAC,UACxB,wBAAwB,GAAG,SAAS;qBAmB3B,QAAQ;;qBACR,MAAM;iJACrB,CAAC"}

package/dist/postgres/grants-ownership.d.ts

@@ -0,0 +1,18 @@
+/**
+ * The ownership reads of `Postgres.Grants`: `pg_namespace.nspowner` and `pg_class.relowner`
+ * for the declared role, in one schema. The repair and the delete need these to LEAVE
+ * objects the grantee owns alone (H2, `grants-plan.ts`): an owner holds every privilege
+ * implicitly and a `REVOKE` cannot take that away, so neither writes nor clears ACL rows
+ * on an owned object — measured on PG 18.6, where the docs' own seat example had its
+ * owner rights churned by the table-level `REVOKE ALL`.
+ *
+ * ★ A fresh schema or table the role owns carries NO ACL rows at all, so the ownership
+ *   facts cannot ride the `aclexplode` reads (`grants-read.ts`) — they are separate
+ *   queries, still inside the read's one bounded burst.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+export declare const readSchemaOwnership: (pg: PgExecutor, schema: string, role: string) => Effect.Effect<boolean, SqlError>;
+export declare const readOwnedTables: (pg: PgExecutor, schema: string, role: string) => Effect.Effect<ReadonlyArray<string>, SqlError>;
+//# sourceMappingURL=grants-ownership.d.ts.map

package/dist/postgres/grants-ownership.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-ownership.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-ownership.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AASpD,eAAO,MAAM,mBAAmB,OAC1B,UAAU,UACN,MAAM,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAI/B,CAAC;AAUJ,eAAO,MAAM,eAAe,OACtB,UAAU,UACN,MAAM,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,MAAM,CAAC,EAAE,QAAQ,CAG7C,CAAC"}

package/dist/postgres/grants-plan-restore.d.ts

@@ -0,0 +1,22 @@
+/**
+ * Which removed entries a reconcile's `REVOKE ALL` will actually emit.
+ *
+ * Pure — the statement text stays in `grants-plan.ts`. `planRepair` counts the tables
+ * returned here as already revoked, so it re-grants the column entries that revoke
+ * clears and plans any still-declared columns of those tables against an empty set,
+ * all from the pre-revoke read (the writes then share one transaction).
+ */
+import type { DeclaredGrants } from './grants-declare.ts';
+import type { LiveGrants } from './grants-read.ts';
+export interface RemovalRevokes {
+    readonly tables: ReadonlyArray<string>;
+    readonly columns: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+    }>;
+}
+/** Tables and columns an update removed that still show the role's words and that the
+ * role does not own. An empty catalog entry emits no revoke — and must not be counted
+ * as revoked, or the repair would re-grant columns the revoke never cleared. */
+export declare const removalRevokes: (removed: Pick<DeclaredGrants, 'tables' | 'columns'>, live: LiveGrants) => RemovalRevokes;
+//# sourceMappingURL=grants-plan-restore.d.ts.map

package/dist/postgres/grants-plan-restore.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-plan-restore.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-plan-restore.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAEnD,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,OAAO,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACtF;AAQD;;gFAEgF;AAChF,eAAO,MAAM,cAAc,YAChB,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,SAAS,CAAC,QAC7C,UAAU,KACf,cAcF,CAAC"}

package/dist/postgres/grants-plan.d.ts

@@ -0,0 +1,65 @@
+/**
+ * The repair plan: the statement list a reconcile executes, as one pure function of the
+ * declared grant set and the live catalogs — no client, no `Effect` — so `reconcile`, the
+ * engine's `diff` and the tests share one implementation (the family's S10 rule holds at
+ * the callers: `reconcile` re-reads live after the statements run, and re-plans: an EMPTY
+ * plan is the no-op proof). The read-back projection and the plan-time comparison live in
+ * `grants-diff.ts`.
+ *
+ * ★ REPAIR SHAPE PER CLASS: on drift, `REVOKE ALL` (clears extras and grant options) then
+ *   `GRANT` the declared words (only when any are declared), split by the grant-option
+ *   flag. A class that declares nothing and holds nothing live is a no-op; a class that
+ *   declares nothing but holds live grants gets only the revoke — that is how `delete`
+ *   (a cleared declaration, `grants-declare.ts`) revokes exactly what the old declaration
+ *   named. The one thing it restores is the collateral a table `REVOKE ALL` clears on
+ *   columns the declaration never named (see `restoredColumnGrants` below): a delete takes
+ *   away what it managed and leaves a DBA's or another resource's column grant untouched.
+ * ★ OBJECTS THE DECLARED ROLE OWNS ARE LEFT ALONE (H2): an owner holds every privilege
+ *   implicitly and a `REVOKE` cannot take that away, so both plans skip owned objects —
+ *   repairing them would only add ACL rows the state can never converge on, and revoking
+ *   them would strip rights that existed before the resource (measured on PG 18.6: the
+ *   docs' own seat example had its owner rights churned). The projection
+ *   (`grants-diff.ts`) records the ownership facts so the plan-time diff skips the same
+ *   objects.
+ * ★ A TABLE'S `REVOKE ALL` ALSO CLEARS THAT GRANTEE'S COLUMN ENTRIES ON IT (measured on
+ *   PG 18.6, and cited by the resource's own convergence check): every declared column of
+ *   a table whose revoke this plan emits is therefore planned against an empty column
+ *   set, so the declared words are re-granted after the table revoke in the SAME pass —
+ *   without this, the re-read would answer drift and the repair would refuse.
+ */
+import type { DeclaredGrants } from './grants-declare.ts';
+import type { LiveGrants } from './grants-read.ts';
+/** Both sides are sorted by construction (declared by `cleanWords`, live by the reads), so
+ * set equality is positional — grant-option marks included: `select` and `select*` are
+ * DIFFERENT states and the repair must converge on the declared one. */
+export declare const wordsDiffer: (declared: ReadonlyArray<string>, live: ReadonlyArray<string>) => boolean;
+export declare const liveTableWords: (live: LiveGrants, table: string) => ReadonlyArray<string>;
+export declare const liveColumnWords: (live: LiveGrants, table: string, column: string) => ReadonlyArray<string>;
+export declare const liveDefaultWords: (live: LiveGrants, forRole: string) => ReadonlyArray<string>;
+/** Every statement the repair runs, in order. Classes whose live set already equals the
+ * declared one contribute NOTHING — an already-correct declaration emits zero statements,
+ * which is the re-run-is-a-no-op rule; the same function re-planned against the post-repair
+ * read-back is the convergence proof (`PostgresGrantsRepairRefused` when it is not empty). */
+export declare const planRepair: (declared: DeclaredGrants, live: LiveGrants, prior?: {
+    /** Tables whose `REVOKE ALL` this same plan already emits (an update removed them). */
+    readonly revokedTables?: ReadonlyArray<string>;
+    /** Columns that removal is revoking on purpose — do not restore them. */
+    readonly revokedColumns?: ReadonlyArray<{
+        readonly table: string;
+        readonly column: string;
+    }>;
+}) => ReadonlyArray<string>;
+/** Revoke-only statements for the entries an update REMOVED from the declaration: one
+ * `REVOKE ALL` per removed object where the catalogs still show the role's words, so
+ * taking an entry away takes the privilege away (a removal is a drift this resource
+ * repairs, never a silent retention). Never the schema class (a role/database/schema
+ * retarget is refused, so the schema can never gain or lose an entry), never PUBLIC,
+ * never a grant, never an object the role OWNS (an owner's implicit rights are not this
+ * resource's to revoke), and nothing for an object that no longer exists — it shows no
+ * words. */
+export declare const planRevocations: (removed: Pick<DeclaredGrants, 'schema' | 'role' | 'tables' | 'columns' | 'defaults'>, live: LiveGrants) => ReadonlyArray<string>;
+/** Removal revokes and the new declaration's repair, planned against one read. Removed
+ * tables count as revoked inside `planRepair`, so the column re-grants that follow a
+ * table `REVOKE ALL` are in this list — the caller runs it as one transaction. */
+export declare const planReconcile: (declared: DeclaredGrants, live: LiveGrants, removed: Pick<DeclaredGrants, 'schema' | 'role' | 'tables' | 'columns' | 'defaults'> | undefined) => ReadonlyArray<string>;
+//# sourceMappingURL=grants-plan.d.ts.map

package/dist/postgres/grants-plan.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"grants-plan.d.ts","sourceRoot":"","sources":["../../src/postgres/grants-plan.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA4BG;AACH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAE1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,kBAAkB,CAAC;AAgBnD;;wEAEwE;AACxE,eAAO,MAAM,WAAW,aACZ,aAAa,CAAC,MAAM,CAAC,QACzB,aAAa,CAAC,MAAM,CAAC,KAC1B,OACsF,CAAC;AAa1F,eAAO,MAAM,cAAc,SAAU,UAAU,SAAS,MAAM,KAAG,aAAa,CAAC,MAAM,CACrB,CAAC;AAEjE,eAAO,MAAM,eAAe,SACpB,UAAU,SACT,MAAM,UACL,MAAM,KACb,aAAa,CAAC,MAAM,CACqE,CAAC;AAE7F,eAAO,MAAM,gBAAgB,SAAU,UAAU,WAAW,MAAM,KAAG,aAAa,CAAC,MAAM,CACnB,CAAC;AA2BvE;;;8FAG8F;AAC9F,eAAO,MAAM,UAAU,aACX,cAAc,QAClB,UAAU,UACT;IACL,uFAAuF;IACvF,QAAQ,CAAC,aAAa,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IAC/C,yEAAyE;IACzE,QAAQ,CAAC,cAAc,CAAC,EAAE,aAAa,CAAC;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAC9F,KACA,aAAa,CAAC,MAAM,CAgFtB,CAAC;AAEF;;;;;;;YAOY;AACZ,eAAO,MAAM,eAAe,YACjB,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,QAC9E,UAAU,KACf,aAAa,CAAC,MAAM,CAetB,CAAC;AAEF;;kFAEkF;AAClF,eAAO,MAAM,aAAa,aACd,cAAc,QAClB,UAAU,WACP,IAAI,CAAC,cAAc,EAAE,QAAQ,GAAG,MAAM,GAAG,QAAQ,GAAG,SAAS,GAAG,UAAU,CAAC,GAAG,SAAS,KAC/F,aAAa,CAAC,MAAM,CAStB,CAAC"}