@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/postgres/index.js

@@ -16,7 +16,7 @@ import {
 // src/postgres/database-sql.ts
 import * as Effect from "effect/Effect";
 var quoteIdent = (value) => `"${value.replace(/"/g, '""')}"`;
-var quoteStringLiteral = (value) => `'${value.replace(/'/g, "''")}'`;
+var quoteStringLiteral = (value) => `E'${value.replace(/\\/g, "\\\\").replace(/'/g, "''")}'`;
 var withOptions = (props, template) => {
   const parts = [`OWNER ${quoteIdent(props.owner)}`];
   if (template !== undefined)
@@ -51,6 +51,8 @@ var isDuplicateDatabaseRace = (error) => {
 };
 var ROLE_EXISTS_SQL = "SELECT 1 AS present FROM pg_roles WHERE rolname = $1";
 var roleExists = (pg, role) => Effect.map(pg.unsafe(ROLE_EXISTS_SQL, [role]), (rows) => rows.length > 0);
+var DATABASE_EXISTS_SQL = "SELECT 1 AS present FROM pg_database WHERE datname = $1";
+var databaseExists = (pg, name) => Effect.map(pg.unsafe(DATABASE_EXISTS_SQL, [name]), (rows) => rows.length > 0);
 var SELECT_DATABASE_SQL = `SELECT
     d.oid AS oid,
     d.datname AS name,
@@ -97,48 +99,55 @@ var inlineParams = (sql, params) => params.length === 0 ? sql : sql.replace(/\$(
   return quoteStringLiteral(value);
 });
 var normalizeRow = (row) => typeof row === "object" && row !== null && typeof row.oid === "string" ? { ...row, oid: Number(row.oid) } : row;
-var isSelect = (sql) => /^\s*SELECT\b/i.test(sql);
+var returnsRows = (sql) => /^\s*(SELECT|WITH)\b/i.test(sql);
 var wrapRows = (sql) => `SELECT coalesce(json_agg(t), '[]'::json)::text FROM (${sql}) t;`;
+var redactPasswordLiterals = (text) => text.replace(/PASSWORD\s+(?:E'(?:[^'\\]|\\[\s\S]|'')*'|'(?:[^']|'')*')/gi, "PASSWORD '[redacted]'");
 var failure = (operation, result) => {
   const state = /ERROR:\s+([0-9A-Z]{5}):/.exec(result.stderr)?.[1];
+  const stderr = redactPasswordLiterals(result.stderr.trim());
   const fields = {
-    cause: Object.assign(new Error(result.stderr.trim()), state === undefined ? {} : { code: state }),
-    message: result.stderr.trim(),
-    operation
+    cause: Object.assign(new Error(stderr), state === undefined ? {} : { code: state }),
+    message: stderr,
+    operation: redactPasswordLiterals(operation)
   };
   const reason = state === undefined ? new ConnectionError(fields) : state.startsWith("42") ? new SqlSyntaxError(fields) : new UnknownError(fields);
   return new SqlError({ reason });
 };
+var runScript = (run, target, stdin, operation) => Effect2.gen(function* () {
+  const result = yield* Effect2.tryPromise({
+    try: () => run({
+      argv: [
+        "psql",
+        "-X",
+        "-q",
+        "-A",
+        "-t",
+        "-v",
+        "ON_ERROR_STOP=1",
+        "-v",
+        "VERBOSITY=verbose",
+        "-U",
+        target.username,
+        "-d",
+        target.database
+      ],
+      stdin
+    }),
+    catch: (cause) => new SqlError({ reason: new ConnectionError({ cause, operation: "psql exec" }) })
+  });
+  if (result.code !== 0) {
+    return yield* Effect2.fail(failure(operation, result));
+  }
+  return result;
+});
 var makePsqlExecutor = (run, target) => ({
   unsafe: (sql, params = []) => Effect2.gen(function* () {
     const inlined = yield* Effect2.try({
       try: () => inlineParams(sql, params),
       catch: (cause) => new SqlError({ reason: new UnknownError({ cause, operation: "psql inline params" }) })
     });
-    const rows = isSelect(inlined);
-    const result = yield* Effect2.tryPromise({
-      try: () => run({
-        argv: [
-          "psql",
-          "-X",
-          "-q",
-          "-A",
-          "-t",
-          "-v",
-          "ON_ERROR_STOP=1",
-          "-v",
-          "VERBOSITY=verbose",
-          "-U",
-          target.username,
-          "-d",
-          target.database
-        ],
-        stdin: rows ? wrapRows(inlined) : `${inlined};`
-      }),
-      catch: (cause) => new SqlError({ reason: new ConnectionError({ cause, operation: "psql exec" }) })
-    });
-    if (result.code !== 0)
-      return yield* Effect2.fail(failure(inlined.slice(0, 40), result));
+    const rows = returnsRows(inlined);
+    const result = yield* runScript(run, target, rows ? wrapRows(inlined) : `${inlined};`, redactPasswordLiterals(inlined).slice(0, 40));
     if (!rows)
       return [];
     const parsed = yield* Effect2.try({
@@ -146,6 +155,11 @@ var makePsqlExecutor = (run, target) => ({
       catch: (cause) => new SqlError({ reason: new UnknownError({ cause, operation: "psql parse output" }) })
     });
     return parsed;
+  }),
+  transaction: (statements) => Effect2.gen(function* () {
+    const script = ["BEGIN", ...statements, "COMMIT"].join(`;
+`);
+    yield* runScript(run, target, `${script};`, "BEGIN");
   })
 });
 
@@ -154,16 +168,28 @@ class PostgresConnection extends Context.Service()("Postgres.Connection") {
 }
 var postgresConnection = (config) => Layer.succeed(PostgresConnection, Effect3.succeed(config));
 var postgresRunnerConnection = (config) => Layer.succeed(PostgresConnection, Effect3.succeed(config));
+var PostgresPool = Context.Reference("homeflare/postgres/Pool", {
+  defaultValue: () => PgClient.layer
+});
 var isRunner = (c) => ("run" in c);
-var withPg = (build) => Effect3.gen(function* () {
+var withPg = (build, database) => Effect3.gen(function* () {
   const resolveConfig = yield* PostgresConnection;
   const config = yield* resolveConfig;
-  if (isRunner(config)) {
-    return yield* build(makePsqlExecutor(config.run, config), {
-      template: config.template ?? "template0"
+  const target = database === undefined ? config : { ...config, database };
+  if (isRunner(target)) {
+    return yield* build(makePsqlExecutor(target.run, target), {
+      template: target.template ?? "template0",
+      database: target.database
     });
   }
-  return yield* Effect3.provide(Effect3.flatMap(PgClient.PgClient, (pg) => build(pg, {})), PgClient.layer(config));
+  const pool = yield* PostgresPool;
+  return yield* Effect3.provide(Effect3.flatMap(PgClient.PgClient, (pg) => build({
+    unsafe: (sql, params) => pg.unsafe(sql, params),
+    transaction: (statements) => pg.withTransaction(Effect3.gen(function* () {
+      for (const sql of statements)
+        yield* pg.unsafe(sql).pipe(Effect3.asVoid);
+    }))
+  }, { database: target.database })), pool(target));
 });
 // src/postgres/database-attrs.ts
 var POSTGRES_NAME_MAX_BYTES = 63;
@@ -287,11 +313,1861 @@ var postgresDatabaseHandlers = PostgresDatabase.Provider.of({
   delete: ({ olds }) => Effect4.fail(new PostgresDatabaseDropRefused({ database: olds.name }))
 });
 var PostgresDatabaseProvider = () => Provider.succeed(PostgresDatabase, postgresDatabaseHandlers);
+// src/postgres/schema-attrs.ts
+var normalizedComment = (comment) => comment === "" ? undefined : comment;
+var schemaNameByteRefusal = (name) => {
+  const byteLength = utf8ByteLength(name);
+  return byteLength > POSTGRES_NAME_MAX_BYTES ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES } : undefined;
+};
+// src/postgres/schema-sql.ts
+import * as Effect5 from "effect/Effect";
+var buildCreateSchemaSql = (props) => `CREATE SCHEMA ${quoteIdent(props.name)}${props.owner === undefined ? "" : ` AUTHORIZATION ${quoteIdent(props.owner)}`}`;
+var buildCommentSchemaSql = (name, comment) => `COMMENT ON SCHEMA ${quoteIdent(name)} IS ${quoteStringLiteral(comment)}`;
+var buildDropSchemaSql = (name, cascade) => `DROP SCHEMA IF EXISTS ${quoteIdent(name)}${cascade ? " CASCADE" : ""}`;
+var SELECT_SCHEMA_SQL = `SELECT
+    n.oid AS oid,
+    n.nspname AS name,
+    pg_get_userbyid(n.nspowner) AS owner,
+    obj_description(n.oid, 'pg_namespace') AS comment,
+    current_database() AS database
+  FROM pg_namespace n
+  WHERE n.nspname = $1`;
+var selectSchema = (pg, name) => Effect5.map(pg.unsafe(SELECT_SCHEMA_SQL, [name]), (rows) => rows[0]);
+var CURRENT_DATABASE_SQL = "SELECT current_database() AS database";
+var currentDatabase = (pg) => Effect5.map(pg.unsafe(CURRENT_DATABASE_SQL), (rows) => rows[0]?.database ?? "");
+var CURRENT_USER_SQL = "SELECT current_user AS role";
+var currentUser = (pg) => Effect5.map(pg.unsafe(CURRENT_USER_SQL), (rows) => rows[0]?.role ?? "");
+var SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_namespace WHERE nspname = $1)
+  SELECT NOT EXISTS (
+    SELECT 1 FROM pg_class c WHERE c.relnamespace = (SELECT oid FROM ns)
+  ) AND NOT EXISTS (
+    SELECT 1 FROM pg_proc p WHERE p.pronamespace = (SELECT oid FROM ns)
+  ) AND NOT EXISTS (
+    SELECT 1 FROM pg_type t WHERE t.typnamespace = (SELECT oid FROM ns)
+  ) AND NOT EXISTS (
+    SELECT 1 FROM pg_operator o WHERE o.oprnamespace = (SELECT oid FROM ns)
+  ) AS empty`;
+var schemaIsEmpty = (pg, name) => Effect5.map(pg.unsafe(SCHEMA_EMPTY_SQL, [name]), (rows) => rows[0]?.empty ?? true);
+var isDependentObjectsError = (error) => {
+  const cause = error.reason.cause;
+  return typeof cause === "object" && cause !== null && cause.code === "2BP01";
+};
+var isDuplicateSchemaError = (error) => {
+  const cause = error.reason.cause;
+  return typeof cause === "object" && cause !== null && cause.code === "42P06";
+};
+// src/postgres/schema.ts
+import { Resource as Resource2 } from "alchemy";
+import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
+import * as Provider2 from "alchemy/Provider";
+import * as Effect11 from "effect/Effect";
+
+// src/postgres/schema-identity.ts
+import * as Effect6 from "effect/Effect";
+
+// src/postgres/schema-errors.ts
+import * as Data2 from "effect/Data";
+
+class PostgresSchemaNameRefused extends Data2.TaggedError("PostgresSchemaNameRefused") {
+  get message() {
+    return `Postgres.Schema "${this.name}": ${String(this.byteLength)} UTF-8 bytes, over the ` + `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` + "accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses " + "it instead of creating a schema no later read will ever find again.";
+  }
+}
+
+class PostgresSchemaRenameRefused extends Data2.TaggedError("PostgresSchemaRenameRefused") {
+  get message() {
+    return `Postgres.Schema: the declared name changed from "${this.from}" to "${this.to}". A ` + "rename is refused during plan or apply — this provider never runs ALTER SCHEMA … RENAME. Declare a new " + "logical id for the new name and remove the old one once its contents have moved.";
+  }
+}
+
+class PostgresSchemaOwnerMissing extends Data2.TaggedError("PostgresSchemaOwnerMissing") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": AUTHORIZATION "${this.owner}" is not a role in pg_roles.`;
+  }
+}
+
+class PostgresSchemaDrift extends Data2.TaggedError("PostgresSchemaDrift") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": ${this.prop} is declared as ` + `${JSON.stringify(this.declared)} but the live schema has ${JSON.stringify(this.live)}. ` + "This provider never issues ALTER SCHEMA — update the declaration to match the live value, " + "or change it by hand and re-plan.";
+  }
+}
+
+class PostgresSchemaCreateVanished extends Data2.TaggedError("PostgresSchemaCreateVanished") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": CREATE SCHEMA raised no error, but the schema is still ` + "absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.";
+  }
+}
+
+class PostgresSchemaDropNotEmptyError extends Data2.TaggedError("PostgresSchemaDropNotEmptyError") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": DROP SCHEMA refused because the schema is not empty and ` + "cascade is false. Declare cascade: true to drop its contents, or empty it by hand first.";
+  }
+}
+
+class PostgresSchemaWrongDatabase extends Data2.TaggedError("PostgresSchemaWrongDatabase") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": declared in database "${this.declared}" but the ` + `connection answers current_database() "${this.connected}". The handlers open the declared ` + "database themselves, so this points at broken provider wiring — fix it before touching any " + "schema, or the next create would land in the wrong database.";
+  }
+}
+
+class PostgresSchemaDeleteForeignRefused extends Data2.TaggedError("PostgresSchemaDeleteForeignRefused") {
+  get message() {
+    const proof = this.lastOid === undefined || this.lastOwner === undefined ? "delete carried no persisted oid/owner to prove ownership" : `the persisted proof is oid ${String(this.lastOid)}, owner "${this.lastOwner}"`;
+    return `Postgres.Schema "${this.schema}": the live schema in database "${this.database}" (oid ` + `${String(this.liveOid)}, owner "${this.liveOwner}") is not the one this resource created — ` + `${proof}. No DROP was issued: a schema with this name was created out of band. Drop it by ` + "hand, or adopt it on a resource whose declared props match it.";
+  }
+}
+
+class PostgresSchemaDatabaseRefused extends Data2.TaggedError("PostgresSchemaDatabaseRefused") {
+  get message() {
+    return `Postgres.Schema: the declared database changed from "${this.from}" to "${this.to}". A ` + "schema is never moved across databases — declare a new logical id in the new database and " + "remove the old one once its contents have moved.";
+  }
+}
+
+class PostgresSchemaExistsRefused extends Data2.TaggedError("PostgresSchemaExistsRefused") {
+  get message() {
+    return `Postgres.Schema "${this.schema}" in "${this.database}" already exists. Re-plan with ` + "--adopt (adopt(true)) to adopt it explicitly; crash recovery also requires adoption. " + "No existing schema was changed.";
+  }
+}
+
+class PostgresSchemaIdentityRefused extends Data2.TaggedError("PostgresSchemaIdentityRefused") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": live oid ${String(this.liveOid)} differs from stored oid ` + `${String(this.storedOid)}. The schema was dropped and recreated outside this stack. ` + "Remove stale state and explicitly adopt the replacement before managing it.";
+  }
+}
+
+// src/postgres/schema-identity.ts
+var assertSchemaTarget = (props, output) => Effect6.gen(function* () {
+  if (output === undefined)
+    return;
+  if (props.name !== output.name)
+    return yield* Effect6.fail(new PostgresSchemaRenameRefused({ from: output.name, to: props.name }));
+  if (props.database !== output.database)
+    return yield* Effect6.fail(new PostgresSchemaDatabaseRefused({ from: output.database, to: props.database }));
+});
+var assertSchemaIdentity = (live, output) => live.oid === output.oid ? Effect6.void : Effect6.fail(new PostgresSchemaIdentityRefused({
+  schema: live.name,
+  storedOid: output.oid,
+  liveOid: live.oid
+}));
+
+// src/postgres/schema-diff.ts
+import { isResolved as isResolved2 } from "alchemy/Diff";
+import * as Effect7 from "effect/Effect";
+var diffPostgresSchema = (news, output, olds) => Effect7.gen(function* () {
+  if (output === undefined || !isResolved2(news))
+    return;
+  yield* assertSchemaTarget(news, output);
+  const nameRefusal = schemaNameByteRefusal(news.name);
+  if (nameRefusal !== undefined) {
+    return yield* Effect7.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
+  }
+  const comment = normalizedComment(news.comment);
+  const changed = news.owner !== undefined && news.owner !== output.owner || comment !== undefined && comment !== (output.comment ?? undefined) || (news.cascade ?? false) !== (olds?.cascade ?? false);
+  return changed ? { action: "update" } : { action: "noop" };
+});
+
+// src/postgres/schema-reconcile.ts
+import * as Effect9 from "effect/Effect";
+
+// src/postgres/schema-assert.ts
+import * as Effect8 from "effect/Effect";
+var assertDatabase = (props, pg) => Effect8.flatMap(currentDatabase(pg), (connected) => connected === props.database ? Effect8.void : Effect8.fail(new PostgresSchemaWrongDatabase({
+  schema: props.name,
+  declared: props.database,
+  connected
+})));
+var declaredOwner = (props, executingRole) => props.owner ?? executingRole;
+var ownerDrift = (props, live, executingRole) => {
+  const declared = declaredOwner(props, executingRole);
+  return declared === live.owner ? undefined : { prop: "owner", declared, live: live.owner };
+};
+var liveDrift2 = (props, live, executingRole) => {
+  const owner = ownerDrift(props, live, executingRole);
+  if (owner !== undefined)
+    return owner;
+  const comment = normalizedComment(props.comment);
+  if (comment !== undefined && comment !== (live.comment ?? undefined)) {
+    return { prop: "comment", declared: comment, live: live.comment };
+  }
+  return;
+};
+var refuse = (props, drift) => Effect8.fail(new PostgresSchemaDrift({
+  schema: props.name,
+  prop: drift.prop,
+  declared: drift.declared,
+  live: drift.live
+}));
+var assertOwner = (props, row, executingRole) => {
+  const drift = ownerDrift(props, row, executingRole);
+  return drift === undefined ? Effect8.void : refuse(props, drift);
+};
+var assertLive = (props, row, executingRole) => {
+  const drift = liveDrift2(props, row, executingRole);
+  return drift === undefined ? Effect8.succeed(row) : refuse(props, drift);
+};
+var deleteForeignRefusal = (props, live, output) => {
+  if (output !== undefined && output.oid === live.oid && output.owner === live.owner) {
+    return;
+  }
+  return new PostgresSchemaDeleteForeignRefused({
+    schema: props.name,
+    database: props.database,
+    liveOid: live.oid,
+    liveOwner: live.owner,
+    lastOid: output?.oid,
+    lastOwner: output?.owner
+  });
+};
+
+// src/postgres/schema-reconcile.ts
+var reconcileWithClient2 = (pg, props, output) => Effect9.gen(function* () {
+  yield* assertSchemaTarget(props, output);
+  yield* assertDatabase(props, pg);
+  const executingRole = props.owner !== undefined ? props.owner : yield* currentUser(pg);
+  const observed = yield* selectSchema(pg, props.name);
+  if (observed === undefined) {
+    if (props.owner !== undefined) {
+      const ownerPresent = yield* roleExists(pg, props.owner);
+      if (!ownerPresent) {
+        return yield* Effect9.fail(new PostgresSchemaOwnerMissing({ schema: props.name, owner: props.owner }));
+      }
+    }
+    const createRefusal = (error) => isDuplicateSchemaError(error) ? new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }) : error;
+    yield* pg.unsafe(buildCreateSchemaSql(props)).pipe(Effect9.asVoid, Effect9.catchTag("SqlError", (error) => Effect9.fail(createRefusal(error))));
+    const created = yield* selectSchema(pg, props.name);
+    if (created === undefined) {
+      return yield* Effect9.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
+    }
+    yield* assertOwner(props, created, executingRole);
+    const comment = normalizedComment(props.comment);
+    if (comment !== undefined && comment !== (created.comment ?? undefined)) {
+      yield* pg.unsafe(buildCommentSchemaSql(props.name, comment)).pipe(Effect9.asVoid);
+      const commented = yield* selectSchema(pg, props.name);
+      if (commented === undefined) {
+        return yield* Effect9.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
+      }
+      return yield* assertLive(props, commented, executingRole);
+    }
+    return yield* assertLive(props, created, executingRole);
+  }
+  if (output === undefined) {
+    return yield* Effect9.fail(new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }));
+  }
+  yield* assertSchemaIdentity(observed, output);
+  return yield* assertLive(props, observed, executingRole);
+});
+
+// src/postgres/schema-delete.ts
+import * as Effect10 from "effect/Effect";
+var dropGuarded = (pg, props) => Effect10.gen(function* () {
+  if (props.cascade !== true) {
+    const empty = yield* schemaIsEmpty(pg, props.name);
+    if (!empty) {
+      return yield* Effect10.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
+    }
+  }
+  const dropRefusal = (error) => props.cascade !== true && isDependentObjectsError(error) ? new PostgresSchemaDropNotEmptyError({ schema: props.name }) : error;
+  yield* pg.unsafe(buildDropSchemaSql(props.name, props.cascade === true)).pipe(Effect10.asVoid, Effect10.catchTag("SqlError", (error) => Effect10.fail(dropRefusal(error))));
+});
+var deleteWithClient = (pg, props, output) => Effect10.gen(function* () {
+  yield* assertDatabase(props, pg);
+  const live = yield* selectSchema(pg, props.name);
+  if (live === undefined)
+    return;
+  const refusal = deleteForeignRefusal(props, live, output);
+  if (refusal !== undefined)
+    return yield* Effect10.fail(refusal);
+  yield* dropGuarded(pg, props);
+});
+
+// src/postgres/schema.ts
+var PostgresSchema = Resource2("Postgres.Schema", {
+  defaultRemovalPolicy: "retain"
+});
+var isPostgresSchema = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Postgres.Schema";
+var readWithClient2 = (pg, name) => selectSchema(pg, name);
+var postgresSchemaHandlers = PostgresSchema.Provider.of({
+  list: () => Effect11.succeed([]),
+  nuke: { skip: true },
+  read: ({ olds, output }) => Effect11.gen(function* () {
+    const name = output?.name ?? olds.name;
+    const database = output?.database ?? olds.database;
+    const present = yield* withPg((pg) => databaseExists(pg, database));
+    if (!present)
+      return;
+    const live = yield* withPg((pg) => readWithClient2(pg, name), database);
+    if (live !== undefined && live.database !== database) {
+      return yield* Effect11.fail(new PostgresSchemaWrongDatabase({
+        schema: name,
+        declared: database,
+        connected: live.database
+      }));
+    }
+    if (live !== undefined && output !== undefined)
+      yield* assertSchemaIdentity(live, output);
+    return live === undefined ? undefined : Unowned2(live);
+  }),
+  diff: ({ news, output, olds }) => diffPostgresSchema(news, output, olds),
+  reconcile: ({ news, output }) => Effect11.gen(function* () {
+    const nameRefusal = schemaNameByteRefusal(news.name);
+    if (nameRefusal !== undefined) {
+      return yield* Effect11.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
+    }
+    yield* assertSchemaTarget(news, output);
+    return yield* withPg((pg) => reconcileWithClient2(pg, news, output), news.database);
+  }),
+  delete: ({ olds, output }) => Effect11.gen(function* () {
+    const present = yield* withPg((pg) => databaseExists(pg, olds.database));
+    if (!present)
+      return;
+    return yield* withPg((pg) => deleteWithClient(pg, olds, output), olds.database);
+  })
+});
+var PostgresSchemaProvider = () => Provider2.succeed(PostgresSchema, postgresSchemaHandlers);
+// src/postgres/grants-attrs.ts
+var SCHEMA_PRIVILEGES = ["usage", "create"];
+var TABLE_PRIVILEGES = [
+  "select",
+  "insert",
+  "update",
+  "delete",
+  "truncate",
+  "references",
+  "trigger",
+  "maintain"
+];
+var COLUMN_PRIVILEGES = ["select", "insert", "update", "references"];
+var ALL_GRANT_WORDS = [...SCHEMA_PRIVILEGES, ...TABLE_PRIVILEGES];
+var LETTER_FOR_PRIVILEGE = {
+  insert: "a",
+  select: "r",
+  update: "w",
+  delete: "d",
+  truncate: "D",
+  references: "x",
+  trigger: "t",
+  maintain: "m",
+  usage: "U",
+  create: "C"
+};
+var letterForPrivilege = (word) => {
+  const letter = LETTER_FOR_PRIVILEGE[word];
+  if (letter === undefined)
+    throw new Error(`grants-attrs: no ACL letter for "${word}"`);
+  return letter;
+};
+var grantsNameByteRefusal = (name) => {
+  const byteLength = utf8ByteLength(name);
+  return byteLength > POSTGRES_NAME_MAX_BYTES ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES } : undefined;
+};
+// src/postgres/grants-sql.ts
+var splitParts = (words) => {
+  const parts = [];
+  let optionCount = 0;
+  for (const word of words) {
+    const base = word.endsWith("*") ? word.slice(0, -1) : word;
+    if (!ALL_GRANT_WORDS.includes(base)) {
+      throw new Error(`grants-sql: "${base}" is not a privilege this family can grant — see the three ` + "vocabularies in grants-attrs.ts (traced to acl.h at REL_18_6)");
+    }
+    if (word.endsWith("*"))
+      optionCount += 1;
+    parts.push(base);
+  }
+  if (optionCount > 0 && optionCount < words.length) {
+    throw new Error(`grants-sql: a mixed grant-option list cannot be one GRANT statement: ${words.join(", ")}` + " — split it with splitGrantWords first (one option clause grants the option to every word)");
+  }
+  return { parts, anyOption: optionCount > 0 };
+};
+var optionClause = (anyOption) => anyOption ? " WITH GRANT OPTION" : "";
+var grantTableSql = (schema, table, role, words) => {
+  const { parts, anyOption } = splitParts(words);
+  return `GRANT ${parts.join(", ")} ON ${quoteIdent(schema)}.${quoteIdent(table)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;
+};
+var grantColumnSql = (schema, table, column, role, words) => {
+  const { parts, anyOption } = splitParts(words);
+  const columnList = `(${quoteIdent(column)})`;
+  return `GRANT ${parts.map((word) => `${word} ${columnList}`).join(", ")} ON ${quoteIdent(schema)}.${quoteIdent(table)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;
+};
+var grantSchemaSql = (schema, role, words) => {
+  const { parts, anyOption } = splitParts(words);
+  return `GRANT ${parts.join(", ")} ON SCHEMA ${quoteIdent(schema)} TO ${quoteIdent(role)}${optionClause(anyOption)}`;
+};
+var grantDefaultSql = (schema, forRole, role, words) => {
+  const { parts, anyOption } = splitParts(words);
+  return `ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(forRole)} IN SCHEMA ${quoteIdent(schema)} GRANT ${parts.join(", ")} ON TABLES TO ${quoteIdent(role)}${optionClause(anyOption)}`;
+};
+var revokeTableSql = (schema, table, role) => `REVOKE ALL ON ${quoteIdent(schema)}.${quoteIdent(table)} FROM ${quoteIdent(role)}`;
+var revokeColumnSql = (schema, table, column, role) => `REVOKE ALL (${quoteIdent(column)}) ON ${quoteIdent(schema)}.${quoteIdent(table)} FROM ${quoteIdent(role)}`;
+var revokeSchemaSql = (schema, role) => `REVOKE ALL ON SCHEMA ${quoteIdent(schema)} FROM ${quoteIdent(role)}`;
+var revokeDefaultSql = (schema, forRole, role) => `ALTER DEFAULT PRIVILEGES FOR ROLE ${quoteIdent(forRole)} IN SCHEMA ${quoteIdent(schema)} REVOKE ALL ON TABLES FROM ${quoteIdent(role)}`;
+var revokePublicSchemaSql = (schema) => `REVOKE ALL ON SCHEMA ${quoteIdent(schema)} FROM PUBLIC`;
+var revokePublicTablesSql = (schema) => `REVOKE ALL ON ALL TABLES IN SCHEMA ${quoteIdent(schema)} FROM PUBLIC`;
+// src/postgres/grants.ts
+import { Resource as Resource3 } from "alchemy";
+import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
+import * as Provider3 from "alchemy/Provider";
+import * as Effect17 from "effect/Effect";
+
+// src/postgres/grants-declare.ts
+var cleanWords = (words) => [...new Set(words)].sort();
+var baseWord = (word) => word.endsWith("*") ? word.slice(0, -1) : word;
+var resolveProps = (props) => ({
+  role: props.role,
+  database: props.database,
+  schema: props.schema,
+  schemaPrivileges: cleanWords([
+    ...props.schemaUsage === false ? [] : ["usage"],
+    ...props.schemaCreate === true ? ["create"] : []
+  ]),
+  tables: [...props.tables ?? []].map((table) => ({ table: table.table, privileges: cleanWords(table.privileges) })).sort((a, b) => a.table.localeCompare(b.table)),
+  columns: [...props.columnGrants ?? []].map((column) => ({
+    table: column.table,
+    column: column.column,
+    privileges: cleanWords(column.privileges)
+  })).sort((a, b) => a.table.localeCompare(b.table) || a.column.localeCompare(b.column)),
+  defaults: [...props.defaultPrivileges ?? []].map((entry) => ({ forRole: entry.forRole, privileges: cleanWords(entry.privileges) })).sort((a, b) => a.forRole.localeCompare(b.forRole)),
+  publicSchemaRevoked: props.revokeFromPublic === true,
+  publicTablesRevoked: props.revokeFromPublic === true
+});
+var splitGrantWords = (words) => ({
+  plain: words.filter((word) => !word.endsWith("*")),
+  grantable: words.filter((word) => word.endsWith("*"))
+});
+var declaredNames = (declared) => ({
+  role: declared.role,
+  database: declared.database,
+  schema: declared.schema,
+  tables: declared.tables.map((table) => table.table),
+  columns: declared.columns.map(({ table, column }) => ({ table, column })),
+  defaults: declared.defaults.map((entry) => entry.forRole)
+});
+var namesFromAttrs = (attrs) => ({
+  role: attrs.role,
+  database: attrs.database,
+  schema: attrs.schema,
+  tables: attrs.tables.map((table) => table.table),
+  columns: attrs.columns.map(({ table, column }) => ({ table, column })),
+  defaults: attrs.defaults.map((entry) => entry.forRole)
+});
+var clearedDeclaration = (declared) => ({
+  ...declared,
+  schemaPrivileges: [],
+  tables: declared.tables.map((table) => ({ table: table.table, privileges: [] })),
+  columns: declared.columns.map((column) => ({
+    table: column.table,
+    column: column.column,
+    privileges: []
+  })),
+  defaults: declared.defaults.map((entry) => ({ forRole: entry.forRole, privileges: [] })),
+  publicSchemaRevoked: false,
+  publicTablesRevoked: false
+});
+var removedNames = (output, declared) => {
+  if (output === undefined)
+    return;
+  const keepTables = new Set(declared.tables.map((table) => table.table));
+  const keepColumns = new Set(declared.columns.map((column) => `${column.table}\x00${column.column}`));
+  const keepDefaults = new Set(declared.defaults.map((entry) => entry.forRole));
+  const tables = output.tables.filter((table) => !keepTables.has(table.table)).map((table) => ({ table: table.table, privileges: [] }));
+  const columns = output.columns.filter((column) => !keepColumns.has(`${column.table}\x00${column.column}`)).map((column) => ({
+    table: column.table,
+    column: column.column,
+    privileges: []
+  }));
+  const defaults = output.defaults.filter((entry) => !keepDefaults.has(entry.forRole)).map((entry) => ({ forRole: entry.forRole, privileges: [] }));
+  if (tables.length === 0 && columns.length === 0 && defaults.length === 0)
+    return;
+  return { schema: declared.schema, role: declared.role, tables, columns, defaults };
+};
+
+// src/postgres/grants-ops.ts
+import * as Effect16 from "effect/Effect";
+import { isResolved as isResolved3 } from "alchemy/Diff";
+
+// src/postgres/grants-refuse.ts
+var wordRefusal = (words, vocabulary) => {
+  for (const word of words) {
+    if (word === "*")
+      return word;
+    const bare = baseWord(word);
+    if (!vocabulary.includes(bare))
+      return bare;
+  }
+  return;
+};
+var listRefusal = (words, vocabulary, prop) => {
+  const word = wordRefusal(words, vocabulary);
+  if (word !== undefined)
+    return { kind: "privilege", prop, word };
+  const seen = new Set;
+  for (const entry of words) {
+    const base = baseWord(entry);
+    if (seen.has(base))
+      return { kind: "duplicate", prop, name: base };
+    seen.add(base);
+  }
+  return;
+};
+var declarationRefusal = (declared) => {
+  const schema = listRefusal(declared.schemaPrivileges, SCHEMA_PRIVILEGES, "schemaPrivileges");
+  if (schema !== undefined)
+    return schema;
+  for (const table2 of declared.tables) {
+    const refusal = listRefusal(table2.privileges, TABLE_PRIVILEGES, `tables.${table2.table}`);
+    if (refusal !== undefined)
+      return refusal;
+  }
+  for (const column2 of declared.columns) {
+    const refusal = listRefusal(column2.privileges, COLUMN_PRIVILEGES, `columnGrants.${column2.table}.${column2.column}`);
+    if (refusal !== undefined)
+      return refusal;
+  }
+  for (const entry of declared.defaults) {
+    const refusal = listRefusal(entry.privileges, TABLE_PRIVILEGES, `defaultPrivileges.${entry.forRole}`);
+    if (refusal !== undefined)
+      return refusal;
+  }
+  const duplicate = (names) => {
+    const seen = new Set;
+    for (const name of names) {
+      if (seen.has(name))
+        return name;
+      seen.add(name);
+    }
+    return;
+  };
+  const table = duplicate(declared.tables.map((entry) => entry.table));
+  if (table !== undefined)
+    return { kind: "duplicate", prop: "tables", name: table };
+  const column = duplicate(declared.columns.map((entry) => `${entry.table}\x00${entry.column}`));
+  if (column !== undefined)
+    return { kind: "duplicate", prop: "columnGrants", name: column.replace("\x00", ".") };
+  const forRole = duplicate(declared.defaults.map((entry) => entry.forRole));
+  if (forRole !== undefined)
+    return { kind: "duplicate", prop: "defaultPrivileges", name: forRole };
+  return;
+};
+var grantsNamesRefusal = (declared) => {
+  const names = [
+    declared.role,
+    declared.database,
+    declared.schema,
+    ...declared.tables.map((table) => table.table),
+    ...declared.columns.flatMap((column) => [column.table, column.column]),
+    ...declared.defaults.map((entry) => entry.forRole)
+  ];
+  for (const name of names) {
+    const refusal = grantsNameByteRefusal(name);
+    if (refusal !== undefined)
+      return { name, ...refusal };
+  }
+  return;
+};
+
+// src/postgres/grants-plan-restore.ts
+var tableWords = (live, table) => live.tables.find((entry) => entry.table === table)?.role ?? [];
+var columnWords = (live, table, column) => live.columns.find((entry) => entry.table === table && entry.column === column)?.role ?? [];
+var removalRevokes = (removed, live) => {
+  const ownedTables = new Set(live.ownedTables);
+  return {
+    tables: removed.tables.filter((table) => !ownedTables.has(table.table) && tableWords(live, table.table).length > 0).map((table) => table.table),
+    columns: removed.columns.filter((column) => !ownedTables.has(column.table) && columnWords(live, column.table, column.column).length > 0).map(({ table, column }) => ({ table, column }))
+  };
+};
+
+// src/postgres/grants-words.ts
+var encodeWord = (row) => `${row.privilege.toLowerCase()}${row.grantable ? "*" : ""}`;
+var wordsOf = (rows, wantPublic) => [...new Set(rows.filter((row) => row.public === wantPublic).map(encodeWord))].sort();
+var PUBLIC_REVOCABLE_RELKINDS = ["r", "v", "m", "f", "p"];
+var relkindIsPublicRevocable = (relkind) => PUBLIC_REVOCABLE_RELKINDS.includes(relkind);
+
+// src/postgres/grants-plan.ts
+var wordsDiffer = (declared, live) => declared.length !== live.length || declared.some((word, index) => word !== live[index]);
+var grantStatements = (words, grant) => {
+  const { plain, grantable } = splitGrantWords(words);
+  return [
+    ...plain.length > 0 ? [grant(plain)] : [],
+    ...grantable.length > 0 ? [grant(grantable)] : []
+  ];
+};
+var liveTableWords = (live, table) => live.tables.find((entry) => entry.table === table)?.role ?? [];
+var liveColumnWords = (live, table, column) => live.columns.find((entry) => entry.table === table && entry.column === column)?.role ?? [];
+var liveDefaultWords = (live, forRole) => live.defaults.find((entry) => entry.forRole === forRole)?.role ?? [];
+var columnKey = (table, column) => `${table}\x00${column}`;
+var restoredColumnGrants = (declared, live, table, skip) => {
+  const statements = [];
+  for (const column of live.columns) {
+    if (column.table !== table || skip.has(columnKey(column.table, column.column)))
+      continue;
+    if (column.restorable.length === 0)
+      continue;
+    statements.push(...grantStatements(column.restorable, (words) => grantColumnSql(declared.schema, column.table, column.column, declared.role, words)));
+  }
+  return statements;
+};
+var planRepair = (declared, live, prior = {}) => {
+  const statements = [];
+  const ownedTables = new Set(live.ownedTables);
+  if (!live.schemaOwnedByRole && wordsDiffer(declared.schemaPrivileges, live.schema.role)) {
+    statements.push(revokeSchemaSql(declared.schema, declared.role));
+    statements.push(...grantStatements(declared.schemaPrivileges, (words) => grantSchemaSql(declared.schema, declared.role, words)));
+  }
+  const revokedTables = new Set(prior.revokedTables ?? []);
+  const skipColumns = new Set([
+    ...declared.columns.map((column) => columnKey(column.table, column.column)),
+    ...(prior.revokedColumns ?? []).map((column) => columnKey(column.table, column.column))
+  ]);
+  const declaredTableNames = new Set(declared.tables.map((table) => table.table));
+  for (const table of declared.tables) {
+    if (ownedTables.has(table.table))
+      continue;
+    if (wordsDiffer(table.privileges, liveTableWords(live, table.table))) {
+      revokedTables.add(table.table);
+      statements.push(revokeTableSql(declared.schema, table.table, declared.role));
+      statements.push(...grantStatements(table.privileges, (words) => grantTableSql(declared.schema, table.table, declared.role, words)));
+      statements.push(...restoredColumnGrants(declared, live, table.table, skipColumns));
+    }
+  }
+  for (const table of prior.revokedTables ?? []) {
+    if (declaredTableNames.has(table) || ownedTables.has(table))
+      continue;
+    statements.push(...restoredColumnGrants(declared, live, table, skipColumns));
+  }
+  for (const column of declared.columns) {
+    if (ownedTables.has(column.table))
+      continue;
+    const liveWords = revokedTables.has(column.table) ? [] : liveColumnWords(live, column.table, column.column);
+    if (wordsDiffer(column.privileges, liveWords)) {
+      statements.push(revokeColumnSql(declared.schema, column.table, column.column, declared.role));
+      statements.push(...grantStatements(column.privileges, (words) => grantColumnSql(declared.schema, column.table, column.column, declared.role, words)));
+    }
+  }
+  for (const entry of declared.defaults) {
+    if (wordsDiffer(entry.privileges, liveDefaultWords(live, entry.forRole))) {
+      statements.push(revokeDefaultSql(declared.schema, entry.forRole, declared.role));
+      statements.push(...grantStatements(entry.privileges, (words) => grantDefaultSql(declared.schema, entry.forRole, declared.role, words)));
+    }
+  }
+  if (declared.publicSchemaRevoked && live.schema.public.length > 0) {
+    statements.push(revokePublicSchemaSql(declared.schema));
+  }
+  if (declared.publicTablesRevoked && (live.tables.some((table) => relkindIsPublicRevocable(table.relkind) && table.public.length > 0) || live.columns.some((column) => column.public.length > 0))) {
+    statements.push(revokePublicTablesSql(declared.schema));
+  }
+  return statements;
+};
+var planRevocations = (removed, live) => {
+  const statements = [];
+  const revoked = removalRevokes(removed, live);
+  for (const table of revoked.tables) {
+    statements.push(revokeTableSql(removed.schema, table, removed.role));
+  }
+  for (const column of revoked.columns) {
+    statements.push(revokeColumnSql(removed.schema, column.table, column.column, removed.role));
+  }
+  for (const entry of removed.defaults) {
+    if (liveDefaultWords(live, entry.forRole).length > 0) {
+      statements.push(revokeDefaultSql(removed.schema, entry.forRole, removed.role));
+    }
+  }
+  return statements;
+};
+var planReconcile = (declared, live, removed) => {
+  const revoked = removed === undefined ? undefined : removalRevokes(removed, live);
+  return [
+    ...removed !== undefined ? planRevocations(removed, live) : [],
+    ...planRepair(declared, live, {
+      revokedTables: revoked?.tables ?? [],
+      revokedColumns: removed?.columns ?? []
+    })
+  ];
+};
+
+// src/postgres/grants-diff.ts
+var attributesOf = (live, names) => ({
+  role: names.role,
+  database: names.database,
+  schema: names.schema,
+  schemaPrivileges: live.schema.role,
+  tables: names.tables.map((table) => ({
+    table,
+    privileges: liveTableWords(live, table)
+  })),
+  columns: names.columns.map(({ table, column }) => ({
+    table,
+    column,
+    privileges: liveColumnWords(live, table, column)
+  })),
+  defaults: names.defaults.map((forRole) => ({
+    forRole,
+    privileges: liveDefaultWords(live, forRole)
+  })),
+  publicSchemaRevoked: live.schema.public.length === 0,
+  publicTablesRevoked: live.tables.every((table) => !relkindIsPublicRevocable(table.relkind) || table.public.length === 0) && live.columns.every((column) => column.public.length === 0),
+  schemaOwnedByRole: live.schemaOwnedByRole,
+  ownedTables: names.tables.filter((table) => live.ownedTables.includes(table))
+});
+var grantsDiffer = (declared, live) => {
+  if (declared.role !== live.role || declared.database !== live.database || declared.schema !== live.schema) {
+    return true;
+  }
+  if (declared.publicSchemaRevoked && !live.publicSchemaRevoked)
+    return true;
+  if (declared.publicTablesRevoked && !live.publicTablesRevoked)
+    return true;
+  if (!live.schemaOwnedByRole && wordsDiffer(declared.schemaPrivileges, live.schemaPrivileges)) {
+    return true;
+  }
+  if (declared.tables.length !== live.tables.length)
+    return true;
+  const ownedTables = new Set(live.ownedTables);
+  if (declared.tables.some((table, index) => table.table !== (live.tables[index]?.table ?? null) || !ownedTables.has(table.table) && wordsDiffer(table.privileges, live.tables[index]?.privileges ?? []))) {
+    return true;
+  }
+  if (declared.columns.length !== live.columns.length)
+    return true;
+  if (declared.columns.some((column, index) => column.table !== (live.columns[index]?.table ?? null) || column.column !== (live.columns[index]?.column ?? null) || !ownedTables.has(column.table) && wordsDiffer(column.privileges, live.columns[index]?.privileges ?? []))) {
+    return true;
+  }
+  if (declared.defaults.length !== live.defaults.length)
+    return true;
+  if (declared.defaults.some((entry, index) => entry.forRole !== (live.defaults[index]?.forRole ?? null) || wordsDiffer(entry.privileges, live.defaults[index]?.privileges ?? []))) {
+    return true;
+  }
+  return false;
+};
+
+// src/postgres/grants-existence.ts
+import * as Effect12 from "effect/Effect";
+
+// src/postgres/grants-errors.ts
+import * as Data3 from "effect/Data";
+
+class PostgresGrantsPrivilegeRefused extends Data3.TaggedError("PostgresGrantsPrivilegeRefused") {
+  get message() {
+    return `Postgres.Grants: "${this.prop}" declares "${this.word}", which is not in the vocabulary ` + "PostgreSQL 18 grants on that object class (see grants-attrs.ts for the three sets, traced " + "to acl.h at REL_18_6). Column grants take select/insert/update/references only — TRUNCATE, " + "TRIGGER and MAINTAIN are table-wide.";
+  }
+}
+
+class PostgresGrantsNameRefused extends Data3.TaggedError("PostgresGrantsNameRefused") {
+  get message() {
+    return `Postgres.Grants: the name "${this.name}" is ${String(this.byteLength)} UTF-8 bytes, over the ` + `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` + "accept the statement and silently truncate the name with only a NOTICE, so this plan refuses " + "it instead of granting on an object no later read will ever find again.";
+  }
+}
+
+class PostgresGrantsDuplicateObject extends Data3.TaggedError("PostgresGrantsDuplicateObject") {
+  get message() {
+    return `Postgres.Grants: "${this.prop}" declares "${this.name}" twice. Merge the entries into one — ` + "the declaration must state each object at most once, and each privilege word in exactly one " + "form: plain, or WITH GRANT OPTION (`select` and `select*` cannot both hold, the server keeps " + "one aclitem per grantee per grantor).";
+  }
+}
+
+class PostgresGrantsRetargetRefused extends Data3.TaggedError("PostgresGrantsRetargetRefused") {
+  get message() {
+    return `Postgres.Grants: the declared ${this.prop} changed from "${this.from}" to "${this.to}". A ` + "retarget is refused at plan — declare a new logical id for the new target and delete the old " + "one (its retain policy keeps the grants until a destroy revokes them).";
+  }
+}
+
+class PostgresGrantsDatabaseMismatch extends Data3.TaggedError("PostgresGrantsDatabaseMismatch") {
+  get message() {
+    return `Postgres.Grants: the declaration names database "${this.declared}" but ` + `current_database() is "${this.connected}". The handlers open the declared database and ` + "prove it before any GRANT or REVOKE — a mismatch means that open did not land there.";
+  }
+}
+
+class PostgresGrantsSchemaMissing extends Data3.TaggedError("PostgresGrantsSchemaMissing") {
+  get message() {
+    return `Postgres.Grants: schema "${this.schema}" is not in pg_namespace. Grants are written into a ` + "schema that already exists — declare a Postgres.Schema (or create it by hand) before the " + "grant set that scopes to it.";
+  }
+}
+
+class PostgresGrantsDatabaseMissing extends Data3.TaggedError("PostgresGrantsDatabaseMissing") {
+  get message() {
+    return `Postgres.Grants: database "${this.database}" is not in pg_database. Grants are written into ` + "a database that already exists — declare a Postgres.Database (or create it by hand) before " + "the grant set that scopes to it.";
+  }
+}
+
+class PostgresGrantsRoleMissing extends Data3.TaggedError("PostgresGrantsRoleMissing") {
+  get message() {
+    return `Postgres.Grants: role "${this.role}" is not in pg_roles. GRANT and ALTER DEFAULT PRIVILEGES ` + "would fail against it — create the role (a group role per seat, membership owned by a human) " + "before declaring its grants.";
+  }
+}
+
+class PostgresGrantsTableMissing extends Data3.TaggedError("PostgresGrantsTableMissing") {
+  get message() {
+    return `Postgres.Grants: table "${this.schema}"."${this.table}" does not exist. The declaration ` + "names a relation before it is created; create the table (or fix the name) before granting.";
+  }
+}
+
+class PostgresGrantsColumnMissing extends Data3.TaggedError("PostgresGrantsColumnMissing") {
+  get message() {
+    return `Postgres.Grants: column "${this.column}" of "${this.schema}"."${this.table}" does not ` + "exist. Declare the column (or fix its name) before granting on it.";
+  }
+}
+
+class PostgresGrantsRepairRefused extends Data3.TaggedError("PostgresGrantsRepairRefused") {
+  get message() {
+    return `Postgres.Grants: the repair on schema "${this.schema}" for role "${this.role}" re-read as ` + `still drifted; these statements would run again: ${this.remaining.join(" ; ")}. A grant made ` + "by another role survives this resource’s REVOKE (only its grantor or the object’s " + "owner can revoke it) — revoke it as that grantor or the owner, or declare the privilege so " + "the set matches.";
+  }
+}
+
+// src/postgres/grants-existence.ts
+var TABLES_PRESENT_SQL = `SELECT
+    c.relname AS table
+  FROM pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND c.relname::text IN (SELECT json_array_elements_text($2::json))`;
+var findMissingTable = (pg, schema, tables) => tables.length === 0 ? Effect12.succeed(undefined) : Effect12.map(pg.unsafe(TABLES_PRESENT_SQL, [schema, JSON.stringify(tables)]), (rows) => {
+  const present = new Set(rows.map((row) => row.table));
+  return tables.find((table) => !present.has(table));
+});
+var COLUMNS_PRESENT_SQL = `SELECT
+    c.relname AS table,
+    a.attname AS column
+  FROM pg_attribute a
+  JOIN pg_class c ON c.oid = a.attrelid
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND a.attnum > 0
+    AND NOT a.attisdropped
+    AND (c.relname, a.attname) IN (
+      SELECT x->>0, x->>1 FROM json_array_elements($2::json) x
+    )`;
+var findMissingColumn = (pg, schema, columns) => columns.length === 0 ? Effect12.succeed(undefined) : Effect12.map(pg.unsafe(COLUMNS_PRESENT_SQL, [
+  schema,
+  JSON.stringify(columns.map(({ table, column }) => [table, column]))
+]), (rows) => {
+  const present = new Set(rows.map((row) => `${row.table}\x00${row.column}`));
+  return columns.find(({ table, column }) => !present.has(`${table}\x00${column}`));
+});
+var requireDeclaredObjectsExist = (pg, declared) => Effect12.gen(function* () {
+  const missingTable = yield* findMissingTable(pg, declared.schema, declared.tables.map((table) => table.table));
+  if (missingTable !== undefined) {
+    return yield* Effect12.fail(new PostgresGrantsTableMissing({ schema: declared.schema, table: missingTable }));
+  }
+  const missingColumn = yield* findMissingColumn(pg, declared.schema, declared.columns.map((column) => ({ table: column.table, column: column.column })));
+  if (missingColumn !== undefined) {
+    return yield* Effect12.fail(new PostgresGrantsColumnMissing({
+      schema: declared.schema,
+      table: missingColumn.table,
+      column: missingColumn.column
+    }));
+  }
+});
+
+// src/postgres/grants-read.ts
+import * as Effect15 from "effect/Effect";
+
+// src/postgres/grants-ownership.ts
+import * as Effect13 from "effect/Effect";
+var SCHEMA_OWNER_SQL = `SELECT
+    n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = $2) AS role_owns
+  FROM pg_namespace n
+  WHERE n.nspname = $1`;
+var readSchemaOwnership = (pg, schema, role) => Effect13.map(pg.unsafe(SCHEMA_OWNER_SQL, [schema, role]), (rows) => rows[0]?.role_owns === true);
+var OWNED_TABLES_SQL = `SELECT c.relname AS table
+  FROM pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = $2)
+  ORDER BY c.relname`;
+var readOwnedTables = (pg, schema, role) => Effect13.map(pg.unsafe(OWNED_TABLES_SQL, [schema, role]), (rows) => rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)));
+
+// src/postgres/grants-read-defaults.ts
+import * as Effect14 from "effect/Effect";
+var DEFAULTS_SQL = `SELECT
+    pg_get_userbyid(d.defaclrole) AS for_role,
+    a.privilege_type AS privilege,
+    a.is_grantable AS grantable
+  FROM pg_default_acl d
+  CROSS JOIN LATERAL aclexplode(d.defaclacl) AS a
+  WHERE d.defaclnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND d.defaclobjtype = 'r'
+    AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)
+  ORDER BY for_role`;
+var readDefaultAcls = (pg, schema, role) => Effect14.map(pg.unsafe(DEFAULTS_SQL, [schema, role]), (rows) => {
+  const byRole = new Map;
+  for (const row of rows) {
+    const words = byRole.get(row.for_role) ?? [];
+    words.push(encodeWord(row));
+    byRole.set(row.for_role, words);
+  }
+  return [...byRole.entries()].map(([forRole, words]) => ({ forRole, role: [...new Set(words)].sort() })).sort((a, b) => a.forRole.localeCompare(b.forRole));
+});
+
+// src/postgres/grants-read.ts
+var SCHEMA_PRESENT_SQL = "SELECT 1 AS present FROM pg_namespace WHERE nspname = $1";
+var schemaExists = (pg, schema) => Effect15.map(pg.unsafe(SCHEMA_PRESENT_SQL, [schema]), (rows) => rows.length > 0);
+var SCHEMA_ACL_SQL = `SELECT
+    a.grantee = 0 AS public,
+    a.privilege_type AS privilege,
+    a.is_grantable AS grantable
+  FROM pg_namespace n
+  CROSS JOIN LATERAL aclexplode(n.nspacl) AS a
+  WHERE n.nspname = $1
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))`;
+var readSchemaAcl = (pg, schema, role) => Effect15.map(pg.unsafe(SCHEMA_ACL_SQL, [schema, role]), (rows) => ({
+  role: wordsOf(rows, false),
+  public: wordsOf(rows, true)
+}));
+var TABLES_SQL = `SELECT
+    c.relname AS table,
+    c.relkind::text AS relkind,
+    a.grantee = 0 AS public,
+    a.privilege_type AS privilege,
+    a.is_grantable AS grantable
+  FROM pg_class c
+  CROSS JOIN LATERAL aclexplode(c.relacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+  ORDER BY c.relname`;
+var readTableAcls = (pg, schema, role) => Effect15.map(pg.unsafe(TABLES_SQL, [
+  schema,
+  role
+]), (rows) => {
+  const byTable = new Map;
+  for (const row of rows) {
+    const entry = byTable.get(row.table) ?? { relkind: row.relkind, role: [], public: [] };
+    entry[row.public ? "public" : "role"].push(encodeWord(row));
+    byTable.set(row.table, entry);
+  }
+  return [...byTable.entries()].map(([table, entry]) => ({
+    table,
+    relkind: entry.relkind,
+    role: [...new Set(entry.role)].sort(),
+    public: [...new Set(entry.public)].sort()
+  })).sort((a, b) => a.table.localeCompare(b.table));
+});
+var COLUMNS_SQL = `SELECT
+    c.relname AS table,
+    v.attname AS column,
+    a.grantee = 0 AS public,
+    a.privilege_type AS privilege,
+    a.is_grantable AS grantable,
+    pg_get_userbyid(a.grantor) AS grantor,
+    pg_get_userbyid(c.relowner) AS owner,
+    current_user AS revoker,
+    pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner
+  FROM pg_attribute v
+  JOIN pg_class c ON c.oid = v.attrelid
+  CROSS JOIN LATERAL aclexplode(v.attacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    AND v.attnum > 0
+    AND NOT v.attisdropped
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+  ORDER BY c.relname, v.attname`;
+var readColumnAcls = (pg, schema, role) => Effect15.map(pg.unsafe(COLUMNS_SQL, [schema, role]), (rows) => {
+  const byColumn = new Map;
+  for (const row of rows) {
+    const key = `${row.table}\x00${row.column}`;
+    const entry = byColumn.get(key) ?? { role: [], public: [], restorable: [] };
+    const word = encodeWord(row);
+    entry[row.public ? "public" : "role"].push(word);
+    if (!row.public && (row.grantor === row.revoker || row.grantor === row.owner && row.revoker_as_owner)) {
+      entry.restorable.push(word);
+    }
+    byColumn.set(key, entry);
+  }
+  return [...byColumn.entries()].map(([key, entry]) => {
+    const [table, column] = key.split("\x00");
+    return {
+      table,
+      column,
+      role: [...new Set(entry.role)].sort(),
+      public: [...new Set(entry.public)].sort(),
+      restorable: [...new Set(entry.restorable)].sort()
+    };
+  }).sort((a, b) => a.table.localeCompare(b.table) || a.column.localeCompare(b.column));
+});
+var readGrants = (pg, schema, role) => Effect15.all({
+  schemaExists: schemaExists(pg, schema),
+  schema: readSchemaAcl(pg, schema, role),
+  tables: readTableAcls(pg, schema, role),
+  columns: readColumnAcls(pg, schema, role),
+  defaults: readDefaultAcls(pg, schema, role),
+  schemaOwnedByRole: readSchemaOwnership(pg, schema, role),
+  ownedTables: readOwnedTables(pg, schema, role)
+});
+
+// src/postgres/grants-ops.ts
+var failRefusal = (refusal) => refusal.kind === "privilege" ? Effect16.fail(new PostgresGrantsPrivilegeRefused({ prop: refusal.prop, word: refusal.word })) : Effect16.fail(new PostgresGrantsDuplicateObject({ prop: refusal.prop, name: refusal.name }));
+var proveDatabase = (pg, declared) => Effect16.flatMap(currentDatabase(pg), (connected) => connected === declared ? Effect16.void : Effect16.fail(new PostgresGrantsDatabaseMismatch({ declared, connected })));
+var refuseNames = (props) => {
+  const declared = resolveProps(props);
+  const names = grantsNamesRefusal(declared);
+  return names === undefined ? undefined : new PostgresGrantsNameRefused({
+    name: names.name,
+    byteLength: names.byteLength,
+    limit: names.limit
+  });
+};
+var reconcileWithClient3 = (pg, props, output) => Effect16.gen(function* () {
+  const declared = resolveProps(props);
+  const declRefusal = declarationRefusal(declared);
+  if (declRefusal !== undefined)
+    return yield* failRefusal(declRefusal);
+  const nameRefusal = refuseNames(props);
+  if (nameRefusal !== undefined)
+    return yield* Effect16.fail(nameRefusal);
+  for (const [prop, from, to] of [
+    ["role", output?.role, declared.role],
+    ["database", output?.database, declared.database],
+    ["schema", output?.schema, declared.schema]
+  ]) {
+    if (from !== undefined && from !== to) {
+      return yield* Effect16.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+    }
+  }
+  yield* proveDatabase(pg, declared.database);
+  if (!(yield* schemaExists(pg, declared.schema))) {
+    return yield* Effect16.fail(new PostgresGrantsSchemaMissing({ schema: declared.schema }));
+  }
+  for (const role of [declared.role, ...declared.defaults.map((entry) => entry.forRole)]) {
+    if (!(yield* roleExists(pg, role))) {
+      return yield* Effect16.fail(new PostgresGrantsRoleMissing({ role }));
+    }
+  }
+  yield* requireDeclaredObjectsExist(pg, declared);
+  const removed = removedNames(output, declared);
+  const current = yield* readGrants(pg, declared.schema, declared.role);
+  const planned = planReconcile(declared, current, removed);
+  if (planned.length > 0)
+    yield* pg.transaction(planned);
+  const after = yield* readGrants(pg, declared.schema, declared.role);
+  const remaining = planReconcile(declared, after, removed);
+  if (remaining.length > 0) {
+    return yield* Effect16.fail(new PostgresGrantsRepairRefused({
+      schema: declared.schema,
+      role: declared.role,
+      remaining
+    }));
+  }
+  return attributesOf(after, declaredNames(declared));
+});
+var readWithClient3 = (pg, names, stored) => Effect16.gen(function* () {
+  yield* proveDatabase(pg, names.database);
+  if (!(yield* schemaExists(pg, names.schema)))
+    return;
+  const live = yield* readGrants(pg, names.schema, names.role);
+  const projected = attributesOf(live, names);
+  const holdsAnything = projected.schemaPrivileges.length > 0 || projected.tables.some((table) => table.privileges.length > 0) || projected.columns.some((column) => column.privileges.length > 0) || projected.defaults.some((entry) => entry.privileges.length > 0);
+  return stored || holdsAnything ? projected : undefined;
+});
+var deleteWithClient2 = (pg, props) => Effect16.gen(function* () {
+  yield* proveDatabase(pg, props.database);
+  if (!(yield* roleExists(pg, props.role)))
+    return;
+  if (!(yield* schemaExists(pg, props.schema)))
+    return;
+  const cleared = clearedDeclaration(resolveProps(props));
+  const live = yield* readGrants(pg, cleared.schema, cleared.role);
+  const planned = planRepair(cleared, live);
+  if (planned.length > 0)
+    yield* pg.transaction(planned);
+  const after = yield* readGrants(pg, cleared.schema, cleared.role);
+  const remaining = planRepair(cleared, after);
+  if (remaining.length > 0) {
+    return yield* Effect16.fail(new PostgresGrantsRepairRefused({
+      schema: cleared.schema,
+      role: cleared.role,
+      remaining
+    }));
+  }
+});
+var diffPostgresGrants = (news, output) => Effect16.gen(function* () {
+  if (output === undefined || !isResolved3(news))
+    return;
+  const declared = resolveProps(news);
+  for (const [prop, from, to] of [
+    ["role", output.role, declared.role],
+    ["database", output.database, declared.database],
+    ["schema", output.schema, declared.schema]
+  ]) {
+    if (from !== to) {
+      return yield* Effect16.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+    }
+  }
+  const nameRefusal = refuseNames(news);
+  if (nameRefusal !== undefined)
+    return yield* Effect16.fail(nameRefusal);
+  const declRefusal = declarationRefusal(declared);
+  if (declRefusal !== undefined)
+    return yield* failRefusal(declRefusal);
+  return grantsDiffer(declared, output) ? { action: "update" } : { action: "noop" };
+});
+
+// src/postgres/grants.ts
+var PostgresGrants = Resource3("Postgres.Grants", {
+  defaultRemovalPolicy: "retain"
+});
+var isPostgresGrants = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Postgres.Grants";
+var postgresGrantsHandlers = PostgresGrants.Provider.of({
+  list: () => Effect17.succeed([]),
+  nuke: { skip: true },
+  read: ({ olds, output }) => Effect17.gen(function* () {
+    const names = output !== undefined ? namesFromAttrs(output) : declaredNames(resolveProps(olds));
+    const present = yield* withPg((pg) => databaseExists(pg, names.database));
+    if (!present)
+      return;
+    const live = yield* withPg((pg) => readWithClient3(pg, names, output !== undefined), names.database);
+    return live === undefined ? undefined : Unowned3(live);
+  }),
+  diff: ({ news, output }) => diffPostgresGrants(news, output),
+  reconcile: ({ news, output }) => Effect17.gen(function* () {
+    const present = yield* withPg((pg) => databaseExists(pg, news.database));
+    if (!present) {
+      return yield* Effect17.fail(new PostgresGrantsDatabaseMissing({ database: news.database }));
+    }
+    return yield* withPg((pg) => reconcileWithClient3(pg, news, output), news.database);
+  }),
+  delete: ({ olds }) => Effect17.gen(function* () {
+    const present = yield* withPg((pg) => databaseExists(pg, olds.database));
+    if (!present)
+      return;
+    return yield* withPg((pg) => deleteWithClient2(pg, olds), olds.database);
+  })
+});
+var PostgresGrantsProvider = () => Provider3.succeed(PostgresGrants, postgresGrantsHandlers);
+// src/postgres/role-attrs.ts
+var VALID_UNTIL_OFFSET = /(?:Z|[+-]\d{2}:\d{2})$/;
+var validUntilRefusal = (value) => {
+  if (Number.isNaN(Date.parse(value)))
+    return { reason: "unparseable" };
+  if (VALID_UNTIL_OFFSET.test(value))
+    return;
+  return { reason: "zone-free" };
+};
+var sameValidUntil = (declared, live) => live !== null && Date.parse(declared) === Date.parse(live);
+// src/postgres/role-sql.ts
+import * as Effect19 from "effect/Effect";
+
+// src/postgres/role-membership-sql.ts
+import * as Effect18 from "effect/Effect";
+
+// src/postgres/role-errors.ts
+import * as Data4 from "effect/Data";
+
+class PostgresRoleNameRefused extends Data4.TaggedError("PostgresRoleNameRefused") {
+  get message() {
+    return `Postgres.Role "${this.name}": ${String(this.byteLength)} UTF-8 bytes, over the ` + `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` + "accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses " + "it instead of creating a role no later read will ever find again.";
+  }
+}
+
+class PostgresRoleRenameRefused extends Data4.TaggedError("PostgresRoleRenameRefused") {
+  get message() {
+    return `Postgres.Role: the declared name changed from "${this.from}" to "${this.to}". A ` + "rename is refused at plan — this provider never replaces a role (that is DROP then " + "CREATE, which loses memberships, grants and ownerships). Declare a new logical id for " + "the new name, and remove the old one once its objects have moved.";
+  }
+}
+
+class PostgresRolePasswordEnvUnsetError extends Data4.TaggedError("PostgresRolePasswordEnvUnsetError") {
+  get message() {
+    return `Postgres.Role "${this.role}": password.fromEnv "${this.variable}" is unset or empty ` + "in the deploying process, but this write requires a password this stack has not sealed.";
+  }
+}
+
+class PostgresRolePrivilegedRefused extends Data4.TaggedError("PostgresRolePrivilegedRefused") {
+  get message() {
+    return `Postgres.Role "${this.role}": the live role has ${this.flags.join(", ")} set. This ` + "family never declares those attributes (a create lands on the server default, all off), " + "and they are not inherited — a member who SET ROLEs to this role would exercise them. " + "Clear the flag on the cluster before this stack adopts the role.";
+  }
+}
+
+class PostgresRoleValidUntilRefused extends Data4.TaggedError("PostgresRoleValidUntilRefused") {
+  get message() {
+    return `Postgres.Role "${this.role}": validUntil "${this.value}" is ${this.reason === "unparseable" ? "not a timestamp this kit can parse" : "missing its UTC designator or numeric offset"}. ` + 'Declare an explicit-zone ISO 8601 value such as "2027-01-01T00:00:00Z" — PostgreSQL would ' + "read a zone-free value in the session time zone while the plan compares UTC, and the two " + "would never agree.";
+  }
+}
+
+class PostgresRoleCreateVanished extends Data4.TaggedError("PostgresRoleCreateVanished") {
+  get message() {
+    return `Postgres.Role "${this.role}": CREATE ROLE raised no error, but the role is still ` + "absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.";
+  }
+}
+
+class PostgresRoleMembershipUnrepaired extends Data4.TaggedError("PostgresRoleMembershipUnrepaired") {
+  get message() {
+    const who = this.grantor === null ? "an unresolvable grantor (inconsistent catalog)" : `grantor "${this.grantor}"`;
+    return `Postgres.Role "${this.role}": membership of "${this.parent}" ` + `(${this.declared ? "declared, options unsafe" : "not declared"}) could not be repaired ` + `under ${who}. The server refused the repair or the catalog re-read still found the row ` + "outside the declaration. pg_auth_members keys a membership on (parent, member, grantor). " + "Check dependent grants, executor permissions and grantor identity before re-planning.";
+  }
+}
+
+class PostgresRoleParentMissing extends Data4.TaggedError("PostgresRoleParentMissing") {
+  get message() {
+    return `Postgres.Role "${this.role}": memberOf parent "${this.parent}" does not exist. ` + "Nothing was written — declare that role first (or drop it from memberOf). A GRANT of a " + "missing role fails only after CREATE ROLE has committed, and the next plan then needs " + "--adopt to finish the orphan.";
+  }
+}
+
+class PostgresRoleIdentityRefused extends Data4.TaggedError("PostgresRoleIdentityRefused") {
+  get message() {
+    return `Postgres.Role "${this.role}": the live oid is ${String(this.liveOid)}, but state recorded ` + `${String(this.storedOid)}. The name was dropped and recreated outside this stack. Nothing ` + "was altered and the live role was not dropped — remove the stale state, or adopt the new " + "role under a new logical id once you mean to own it.";
+  }
+}
+
+class PostgresRolePasswordNonAsciiRefused extends Data4.TaggedError("PostgresRolePasswordNonAsciiRefused") {
+  get message() {
+    return `Postgres.Role "${this.role}": password must be ASCII; this provider does not implement PostgreSQL SASLprep normalization. Nothing was written.`;
+  }
+}
+
+// src/postgres/role-membership-sql.ts
+var MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
+    grantor.rolname AS grantor,
+    m.admin_option AS admin,
+    m.set_option AS set,
+    m.inherit_option AS inherit
+  FROM pg_auth_members m
+  JOIN pg_roles member ON member.oid = m.member
+  JOIN pg_roles parent ON parent.oid = m.roleid
+  LEFT JOIN pg_roles grantor ON grantor.oid = m.grantor
+  WHERE member.rolname = $1
+  ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;
+var selectRoleMemberships = (pg, name) => Effect18.map(pg.unsafe(MEMBERSHIP_SQL, [name]), (rows) => rows);
+var buildGrantMembershipSql = (member, parent) => `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;
+var buildRepairMembershipSql = (member, parent, grantor, option) => `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;
+var buildRevokeGrantorMembershipSql = (member, parent, grantor) => `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;
+var unsafeMemberships = (live, inherit) => new Set((live.memberships ?? []).filter((row) => row.admin || row.set || row.inherit && !inherit).map((row) => row.parent));
+var membershipDrift = (declared, live, unsafe = new Set) => {
+  if (declared === undefined)
+    return { grants: [], revokes: [] };
+  const wanted = [...new Set(declared)].sort();
+  const current = [...new Set(live)].sort();
+  return {
+    grants: wanted.filter((parent) => !current.includes(parent) || unsafe.has(parent)),
+    revokes: [
+      ...current.filter((parent) => !wanted.includes(parent)),
+      ...wanted.filter((parent) => current.includes(parent) && unsafe.has(parent))
+    ]
+  };
+};
+var assertParentsExist = (pg, role, parents) => Effect18.gen(function* () {
+  if (parents === undefined)
+    return;
+  for (const parent of [...new Set(parents)].sort()) {
+    if (!(yield* roleExists(pg, parent))) {
+      return yield* Effect18.fail(new PostgresRoleParentMissing({ role, parent }));
+    }
+  }
+});
+var syncMemberships = (pg, props, rows) => Effect18.gen(function* () {
+  if (props.memberOf === undefined) {
+    return [...new Set(rows.map((row) => row.parent))].sort();
+  }
+  yield* assertParentsExist(pg, props.name, props.memberOf);
+  const wanted = [...new Set(props.memberOf)].sort();
+  const revokes = [];
+  for (const row of rows) {
+    if (!wanted.includes(row.parent) && row.grantor !== null) {
+      revokes.push(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor));
+    }
+  }
+  if (revokes.length > 0)
+    yield* pg.transaction(revokes);
+  for (const row of rows) {
+    if (row.grantor === null || !wanted.includes(row.parent))
+      continue;
+    const statements = [];
+    for (const option of ["ADMIN", "SET", "INHERIT"]) {
+      const unsafe = option === "ADMIN" ? row.admin : option === "SET" ? row.set : row.inherit && !props.inherit;
+      if (unsafe) {
+        statements.push(buildRepairMembershipSql(props.name, row.parent, row.grantor, option));
+      }
+    }
+    if (statements.length > 0)
+      yield* pg.transaction(statements).pipe(Effect18.catchTag("SqlError", (error) => {
+        const cause = error.reason.cause;
+        const code = typeof cause === "object" && cause !== null ? cause.code : undefined;
+        return Effect18.fail(code === "2BP01" || code === "42501" ? new PostgresRoleMembershipUnrepaired({
+          role: props.name,
+          parent: row.parent,
+          grantor: row.grantor,
+          declared: true
+        }) : error);
+      }));
+  }
+  const grants = wanted.filter((p) => !rows.some((row) => row.parent === p)).map((parent) => buildGrantMembershipSql(props.name, parent));
+  if (grants.length > 0)
+    yield* pg.transaction(grants);
+  for (const row of yield* selectRoleMemberships(pg, props.name)) {
+    if (!wanted.includes(row.parent) || row.admin || row.set || row.inherit && !props.inherit) {
+      return yield* Effect18.fail(new PostgresRoleMembershipUnrepaired({
+        role: props.name,
+        parent: row.parent,
+        grantor: row.grantor,
+        declared: wanted.includes(row.parent)
+      }));
+    }
+  }
+  return wanted;
+});
+
+// src/postgres/role-sql.ts
+var SELECT_ROLE_SQL = `SELECT
+    r.oid AS oid,
+    r.rolname AS name,
+    r.rolcanlogin AS login,
+    r.rolconnlimit AS "connectionLimit",
+    r.rolinherit AS inherit,
+    r.rolsuper AS superuser,
+    r.rolcreaterole AS createrole,
+    r.rolcreatedb AS createdb,
+    r.rolreplication AS replication,
+    r.rolbypassrls AS bypassrls,
+    to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "validUntil"
+  FROM pg_roles r
+  WHERE r.rolname = $1`;
+var selectRole = (pg, name) => Effect19.map(pg.unsafe(SELECT_ROLE_SQL, [name]), (rows) => rows[0]);
+var readRoleWithClient = (pg, name) => Effect19.gen(function* () {
+  const row = yield* selectRole(pg, name);
+  if (row === undefined)
+    return;
+  const memberships = yield* selectRoleMemberships(pg, name);
+  return {
+    ...row,
+    memberOf: [...new Set(memberships.map((membership) => membership.parent))].sort(),
+    memberships
+  };
+});
+var withOptions2 = (props) => {
+  const parts = [];
+  parts.push(props.login ? "LOGIN" : "NOLOGIN");
+  parts.push(props.inherit ? "INHERIT" : "NOINHERIT");
+  parts.push(`CONNECTION LIMIT ${String(Math.trunc(props.connectionLimit))}`);
+  if (props.validUntil !== undefined) {
+    parts.push(`VALID UNTIL ${quoteStringLiteral(props.validUntil)}`);
+  }
+  return parts.join(" ");
+};
+var buildCreateRoleSql = (props) => `CREATE ROLE ${quoteIdent(props.name)} WITH ${withOptions2(props)}`;
+var buildAlterRoleSql = (name, change) => {
+  const who = quoteIdent(name);
+  switch (change.prop) {
+    case "login":
+      return `ALTER ROLE ${who} WITH ${change.value ? "LOGIN" : "NOLOGIN"}`;
+    case "inherit":
+      return `ALTER ROLE ${who} WITH ${change.value ? "INHERIT" : "NOINHERIT"}`;
+    case "connectionLimit":
+      return `ALTER ROLE ${who} WITH CONNECTION LIMIT ${String(Math.trunc(change.value))}`;
+    case "validUntil":
+      return `ALTER ROLE ${who} WITH VALID UNTIL ${quoteStringLiteral(change.value)}`;
+  }
+};
+var buildSetPasswordSql = (name, verifier) => `ALTER ROLE ${quoteIdent(name)} WITH PASSWORD ${quoteStringLiteral(verifier)}`;
+var buildDropRoleSql = (name) => `DROP ROLE IF EXISTS ${quoteIdent(name)}`;
+var buildCreateStatements = (props, verifier) => [
+  buildCreateRoleSql(props),
+  ...verifier === undefined ? [] : [buildSetPasswordSql(props.name, verifier)],
+  ...[...new Set(props.memberOf ?? [])].sort().map((parent) => buildGrantMembershipSql(props.name, parent))
+];
+var scalarDrift = (props, live) => {
+  const changes = [];
+  if (props.login !== live.login)
+    changes.push({ prop: "login", value: props.login });
+  if (props.inherit !== live.inherit)
+    changes.push({ prop: "inherit", value: props.inherit });
+  if (props.connectionLimit !== live.connectionLimit) {
+    changes.push({ prop: "connectionLimit", value: props.connectionLimit });
+  }
+  if (props.validUntil !== undefined && !sameValidUntil(props.validUntil, live.validUntil)) {
+    changes.push({ prop: "validUntil", value: props.validUntil });
+  }
+  return changes;
+};
+var declarationMatches = (props, live) => {
+  const wanted = props.memberOf === undefined ? undefined : [...new Set(props.memberOf)].sort().join("\x00");
+  const found = [...live.memberOf ?? []].sort().join("\x00");
+  return props.name === live.name && props.login === live.login && props.inherit === live.inherit && props.connectionLimit === live.connectionLimit && (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) && (wanted === undefined || wanted === found) && privilegedFlags(live).length === 0 && (live.memberships ?? []).every((row) => !row.admin && !row.set && (!row.inherit || props.inherit));
+};
+var storedAttributes = (live) => {
+  const { memberships: _observeOnly, ...stored } = live;
+  return stored;
+};
+var privilegedFlags = (live) => {
+  const flags = [];
+  if (live.superuser === true)
+    flags.push("SUPERUSER");
+  if (live.createrole === true)
+    flags.push("CREATEROLE");
+  if (live.createdb === true)
+    flags.push("CREATEDB");
+  if (live.replication === true)
+    flags.push("REPLICATION");
+  if (live.bypassrls === true)
+    flags.push("BYPASSRLS");
+  return flags;
+};
+// src/postgres/role.ts
+import { Resource as Resource4 } from "alchemy";
+import * as Effect21 from "effect/Effect";
+import * as Redacted2 from "effect/Redacted";
+
+// src/postgres/role-secrets.ts
+import * as Redacted from "effect/Redacted";
+import * as Effect20 from "effect/Effect";
+
+// src/secrets/write-only.ts
+import { Buffer } from "node:buffer";
+import { randomBytes, scryptSync, timingSafeEqual } from "node:crypto";
+var resolveAll = (refs, env = process.env) => {
+  const values = {};
+  const missing = [];
+  for (const [key, ref] of Object.entries(refs)) {
+    const value = env[ref.fromEnv];
+    if (value === undefined || value === "")
+      missing.push(ref.fromEnv);
+    else
+      values[key] = value;
+  }
+  return { missing: [...new Set(missing)].sort(), values };
+};
+var COST = { N: 16384, maxmem: 64 * 1024 * 1024, p: 1, r: 8 };
+var PREFIX = "scrypt";
+var canonical = (values) => JSON.stringify(Object.keys(values).sort().map((key) => [key, values[key]]));
+var digest = (salt, values) => scryptSync(canonical(values), salt, 32, COST);
+var seal = (values, salt) => {
+  if (Object.keys(values).length === 0)
+    return "";
+  const bytes = salt === undefined ? randomBytes(16) : Buffer.from(salt, "utf8");
+  return `${PREFIX}:${bytes.toString("base64url")}:${digest(bytes, values).toString("base64url")}`;
+};
+var sealMatches = (sealed, values) => {
+  if (sealed === "")
+    return Object.keys(values).length === 0;
+  const [prefix, salt, stored, extra] = sealed.split(":");
+  if (prefix !== PREFIX || salt === undefined || stored === undefined || extra !== undefined) {
+    return false;
+  }
+  const expected = Buffer.from(stored, "base64url");
+  const actual = digest(Buffer.from(salt, "base64url"), values);
+  return expected.length === actual.length && timingSafeEqual(expected, actual);
+};
+
+// src/postgres/role-secrets.ts
+var assertPasswordAscii = (role, resolved) => resolved.value !== undefined && /[\u0080-\uffff]/.test(Redacted.value(resolved.value)) ? Effect20.fail(new PostgresRolePasswordNonAsciiRefused({ role })) : Effect20.void;
+var resolvePassword = (props, env = process.env) => {
+  if (props.password === undefined)
+    return { variable: undefined, value: undefined };
+  const { values } = resolveAll({ password: props.password }, env);
+  const raw = values["password"];
+  return {
+    variable: props.password.fromEnv,
+    value: raw === undefined ? undefined : Redacted.make(raw)
+  };
+};
+var sealPassword = (value2) => seal({ password: Redacted.value(value2) });
+var passwordMatchesSeal = (value2, sealed) => sealMatches(sealed, { password: Redacted.value(value2) });
+
+// src/postgres/role-scram.ts
+import { createHash, createHmac, pbkdf2Sync, randomBytes as randomBytes2 } from "node:crypto";
+var ITERATIONS = 4096;
+var SALT_BYTES = 16;
+var KEY_BYTES = 32;
+var hmac = (key, label) => createHmac("sha256", key).update(label, "utf8").digest();
+var b64 = (value2) => value2.toString("base64");
+var scramSha256Verifier = (password, salt) => {
+  const bytes = salt ?? randomBytes2(SALT_BYTES);
+  const saltedPassword = pbkdf2Sync(password, bytes, ITERATIONS, KEY_BYTES, "sha256");
+  const storedKey = createHash("sha256").update(hmac(saltedPassword, "Client Key")).digest();
+  const serverKey = hmac(saltedPassword, "Server Key");
+  return `SCRAM-SHA-256$${ITERATIONS}:${b64(bytes)}$${b64(storedKey)}:${b64(serverKey)}`;
+};
+
+// src/postgres/role.ts
+var PostgresRole = Resource4("Postgres.Role", {
+  defaultRemovalPolicy: "retain"
+});
+var isPostgresRole = (value3) => (typeof value3 === "object" || typeof value3 === "function") && value3 !== null && value3.Type === "Postgres.Role";
+var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", storedOid) => Effect21.gen(function* () {
+  const resolved = resolvePassword(props, env);
+  yield* assertPasswordAscii(props.name, resolved);
+  const observed = yield* readRoleWithClient(pg, props.name);
+  if (observed === undefined) {
+    if (resolved.variable !== undefined && resolved.value === undefined) {
+      return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+    }
+    yield* assertParentsExist(pg, props.name, props.memberOf);
+    const verifier = resolved.value === undefined ? undefined : scramSha256Verifier(Redacted2.value(resolved.value));
+    yield* pg.transaction(buildCreateStatements(props, verifier));
+    const created = yield* readRoleWithClient(pg, props.name);
+    if (created === undefined) {
+      return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
+    }
+    return {
+      ...storedAttributes(created),
+      passwordSeal: resolved.value === undefined ? "" : sealPassword(resolved.value)
+    };
+  }
+  if (storedOid !== undefined && observed.oid !== storedOid) {
+    return yield* Effect21.fail(new PostgresRoleIdentityRefused({
+      role: props.name,
+      storedOid,
+      liveOid: observed.oid
+    }));
+  }
+  const flags = privilegedFlags(observed);
+  if (flags.length > 0) {
+    return yield* Effect21.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));
+  }
+  if (resolved.variable !== undefined && resolved.value === undefined && previousSeal === "") {
+    return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+  }
+  yield* assertParentsExist(pg, props.name, props.memberOf);
+  for (const change of scalarDrift(props, observed)) {
+    yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect21.asVoid);
+  }
+  const passwordMatched = resolved.value !== undefined && passwordMatchesSeal(resolved.value, previousSeal);
+  if (resolved.value !== undefined && !passwordMatched) {
+    yield* pg.unsafe(buildSetPasswordSql(props.name, scramSha256Verifier(Redacted2.value(resolved.value)))).pipe(Effect21.asVoid);
+  }
+  yield* syncMemberships(pg, props, observed.memberships ?? []);
+  const after = yield* readRoleWithClient(pg, props.name);
+  if (after === undefined) {
+    return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
+  }
+  return {
+    ...storedAttributes(after),
+    passwordSeal: resolved.value === undefined || passwordMatched ? previousSeal : sealPassword(resolved.value)
+  };
+});
+var readRole = (pg, name) => readRoleWithClient(pg, name);
+var refuseAtPlan = (props) => Effect21.gen(function* () {
+  const nameRefusal = nameByteRefusal(props.name);
+  if (nameRefusal !== undefined) {
+    return yield* Effect21.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));
+  }
+  if (props.validUntil !== undefined) {
+    const untilRefusal = validUntilRefusal(props.validUntil);
+    if (untilRefusal !== undefined) {
+      return yield* Effect21.fail(new PostgresRoleValidUntilRefused({
+        role: props.name,
+        value: props.validUntil,
+        reason: untilRefusal.reason
+      }));
+    }
+  }
+});
+// src/postgres/role-provider.ts
+import * as Provider4 from "alchemy/Provider";
+import { isResolved as isResolved5 } from "alchemy/Diff";
+import * as Effect28 from "effect/Effect";
+
+// src/ownership/probe.ts
+import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
+import * as Effect24 from "effect/Effect";
+
+// src/ownership/rows.ts
+import { Stack as Stack2 } from "alchemy/Stack";
+import { State, isActionState } from "alchemy/State/State";
+import * as Effect23 from "effect/Effect";
+import * as Option2 from "effect/Option";
+
+// src/ownership/whole.ts
+import { Stack } from "alchemy/Stack";
+import * as Effect22 from "effect/Effect";
+import * as Option from "effect/Option";
+var absent = (value3) => value3 === undefined || value3 === null;
+var isPlainObject = (value3) => {
+  if (typeof value3 !== "object" || value3 === null || Array.isArray(value3))
+    return false;
+  const proto = Object.getPrototypeOf(value3);
+  return proto === Object.prototype || proto === null;
+};
+var carries = (declared, recorded) => {
+  if (absent(declared))
+    return true;
+  if (absent(recorded))
+    return false;
+  if (Array.isArray(declared)) {
+    if (!Array.isArray(recorded))
+      return false;
+    return declared.every((each, index) => carries(each, recorded[index]));
+  }
+  if (isPlainObject(declared)) {
+    if (!isPlainObject(recorded))
+      return false;
+    return Object.entries(declared).every(([key, each]) => carries(each, recorded[key]));
+  }
+  return true;
+};
+var wholeDeclaration = (fqn, props) => Effect22.map(Effect22.serviceOption(Stack), (stack) => {
+  const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;
+  return declared !== undefined && carries(declared.Props, props);
+});
+
+// src/ownership/rows.ts
+var storeOf = Effect23.gen(function* () {
+  const stack = yield* Effect23.serviceOption(Stack2);
+  const state = yield* Effect23.serviceOption(State);
+  if (Option2.isNone(stack) || Option2.isNone(state))
+    return;
+  const store = yield* state.value;
+  const where = { stack: stack.value.name, stage: stack.value.stage };
+  return { resources: stack.value.resources, store, where };
+});
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect23.orElseSucceed(() => {
+  return;
+}));
+var generationOf = (row, instanceId) => {
+  let at = row;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (generation.instanceId === instanceId)
+      return generation;
+    at = generation.old;
+  }
+  return;
+};
+var recordedGeneration = (fqn, instanceId) => Effect23.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    const generation = generationOf(yield* rowAt(found.store, found.where, at), instanceId);
+    if (generation !== undefined)
+      return generation;
+  }
+  return;
+});
+var recordedInstance = (fqn, instanceId) => Effect23.gen(function* () {
+  const generation = yield* recordedGeneration(fqn, instanceId);
+  if (generation === undefined)
+    return "absent";
+  return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
+});
+var isCreate = (fqn, instanceId) => Effect23.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var idOf = (attr) => {
+  if (typeof attr !== "object" || attr === null)
+    return;
+  const id = attr.id;
+  return typeof id === "string" && id !== "" ? id : undefined;
+};
+var olderGenerationIds = (fqn, instanceId) => Effect23.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return [];
+  const ids = [];
+  for (const at of [fqn, ...found.resources[fqn]?.FormerFqns ?? []]) {
+    collectOlder(yield* rowAt(found.store, found.where, at), instanceId, ids);
+  }
+  return ids;
+});
+var collectOlder = (row, instanceId, ids) => {
+  let at = row;
+  let seen = false;
+  while (typeof at === "object" && at !== null && !isActionState(at)) {
+    const generation = at;
+    if (!seen) {
+      seen = generation.instanceId === instanceId;
+      at = generation.old;
+      continue;
+    }
+    if (generation.instanceId !== instanceId) {
+      const id = idOf(generation.attr);
+      if (id !== undefined)
+        ids.push(id);
+    }
+    at = generation.old;
+  }
+};
+var forgetRefusedCreate = (fqn, instanceId) => Effect23.gen(function* () {
+  const found = yield* storeOf;
+  if (found === undefined)
+    return;
+  const row = yield* rowAt(found.store, found.where, fqn);
+  const mine = row;
+  if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
+    return;
+  }
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect23.ignore);
+});
+
+// src/ownership/probe.ts
+var provenOurs = (ask, settled) => Effect24.gen(function* () {
+  const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
+  if (recorded === "absent")
+    return false;
+  if (recorded === "partial") {
+    yield* Effect24.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    return false;
+  }
+  const unproven = (reason) => Effect24.as(Effect24.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
+});
+var ownedRead = (ask, found, settled) => Effect24.gen(function* () {
+  if (found === undefined || ask.output !== undefined)
+    return found;
+  return (yield* provenOurs(ask, settled)) ? found : Unowned4(found);
+});
+
+// src/ownership/resume.ts
+import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect25 from "effect/Effect";
+import * as Option3 from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
+  if (Option3.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
+  if (Option3.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect25.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect25.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect25.succeed(undefined);
+  const found = yield* recovered.pipe(Effect25.catch(unproven), Effect25.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned5.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect25.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
+
+// src/ownership/adopt.ts
+import { AdoptPolicy } from "alchemy/AdoptPolicy";
+import { AlchemyContext } from "alchemy/AlchemyContext";
+import { Stack as Stack3 } from "alchemy/Stack";
+import * as Effect26 from "effect/Effect";
+import * as Option4 from "effect/Option";
+var adoptEnabled = (fqn) => Effect26.gen(function* () {
+  const stack = yield* Effect26.serviceOption(Stack3);
+  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped !== undefined)
+    return scoped;
+  const policy = yield* Effect26.serviceOption(AdoptPolicy);
+  if (Option4.isSome(policy))
+    return policy.value;
+  const context = yield* Effect26.serviceOption(AlchemyContext);
+  return Option4.isSome(context) ? context.value.adopt : false;
+});
+var adoptable = (owner) => Effect26.gen(function* () {
+  if (yield* isCreate(owner.fqn, owner.instanceId))
+    return true;
+  return yield* unfinished(owner.instanceId);
+});
+var adoptsAtApply = (owner) => Effect26.gen(function* () {
+  if (!(yield* adoptEnabled(owner.fqn)))
+    return false;
+  return yield* adoptable(owner);
+});
+var refuseTakeover = (owner, what) => Effect26.gen(function* () {
+  if (owner.output !== undefined)
+    return;
+  if (yield* resumes(owner.instanceId))
+    return;
+  const may = yield* adoptable(owner);
+  if (may && (yield* adoptEnabled(owner.fqn)))
+    return;
+  yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
+  const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
+  return yield* Effect26.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+});
+var claimFor = (owner) => (what) => refuseTakeover(owner, what);
+
+// src/postgres/role-diff.ts
+import { isResolved as isResolved4 } from "alchemy/Diff";
+import * as Effect27 from "effect/Effect";
+var diffPostgresRole = (news, output, env = process.env, observation) => Effect27.gen(function* () {
+  if (output === undefined || !isResolved4(news))
+    return;
+  if (news.name !== output.name) {
+    return yield* Effect27.fail(new PostgresRoleRenameRefused({ from: output.name, to: news.name }));
+  }
+  yield* refuseAtPlan(news);
+  const live = observation?.found;
+  if (live !== undefined && live.oid !== output.oid) {
+    return yield* Effect27.fail(new PostgresRoleIdentityRefused({
+      role: output.name,
+      storedOid: output.oid,
+      liveOid: live.oid
+    }));
+  }
+  const compared = live ?? output;
+  const scalars = scalarDrift(news, compared);
+  const membership = membershipDrift(news.memberOf, compared.memberOf ?? [], live === undefined ? new Set : unsafeMemberships(live, news.inherit));
+  const resolved = resolvePassword(news, env);
+  yield* assertPasswordAscii(news.name, resolved);
+  const passwordStale = resolved.value !== undefined && !passwordMatchesSeal(resolved.value, output.passwordSeal);
+  const absent2 = observation !== undefined && live === undefined;
+  const changed = absent2 || privilegedFlags(compared).length > 0 || scalars.length > 0 || membership.grants.length > 0 || membership.revokes.length > 0 || passwordStale;
+  return changed ? { action: "update" } : { action: "noop" };
+});
+
+// src/postgres/role-provider.ts
+var postgresRoleHandlers = PostgresRole.Provider.of({
+  list: () => Effect28.succeed([]),
+  nuke: { skip: true },
+  read: ({ fqn, instanceId, olds, output }) => Effect28.gen(function* () {
+    const name = output?.name ?? olds.name;
+    const live = yield* withPg((pg) => readRole(pg, name));
+    if (live === undefined)
+      return;
+    if (output !== undefined && live.oid !== output.oid) {
+      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
+        role: name,
+        storedOid: output.oid,
+        liveOid: live.oid
+      }));
+    }
+    const passwordSeal = output?.passwordSeal ?? "";
+    const found = { ...storedAttributes(live), passwordSeal };
+    return yield* ownedRead({ fqn, instanceId, output }, found, Effect28.succeed(declarationMatches(olds, live)));
+  }),
+  diff: ({ news, output, instanceId }) => Effect28.gen(function* () {
+    if (output === undefined)
+      return yield* noteUnfinished(instanceId);
+    if (!isResolved5(news))
+      return;
+    const found = yield* withPg((pg) => readRole(pg, output.name));
+    return yield* diffPostgresRole(news, output, process.env, { found });
+  }),
+  reconcile: ({ fqn, instanceId, news, output }) => Effect28.gen(function* () {
+    yield* refuseAtPlan(news);
+    return yield* withPg((pg) => Effect28.gen(function* () {
+      const observed = yield* readRole(pg, news.name);
+      if (observed !== undefined && output === undefined) {
+        yield* refuseTakeover({ fqn, instanceId, output }, "Postgres.Role");
+      }
+      return yield* reconcileWithClient4(pg, news, process.env, output?.passwordSeal, output?.oid);
+    }));
+  }),
+  delete: ({ output }) => withPg((pg) => Effect28.gen(function* () {
+    if (output === undefined)
+      return;
+    const live = yield* readRole(pg, output.name);
+    if (live === undefined)
+      return;
+    if (live.oid !== output.oid) {
+      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
+        role: output.name,
+        storedOid: output.oid,
+        liveOid: live.oid
+      }));
+    }
+    yield* pg.unsafe(buildDropRoleSql(output.name)).pipe(Effect28.asVoid);
+  }))
+});
+var PostgresRoleProvider = () => Provider4.succeed(PostgresRole, postgresRoleHandlers);
 // src/postgres/providers.ts
 import * as Layer2 from "effect/Layer";
-var postgresProviders = (config) => PostgresDatabaseProvider().pipe(Layer2.provideMerge(postgresConnection(config)));
-var postgresRunnerProviders = (config) => PostgresDatabaseProvider().pipe(Layer2.provideMerge(postgresRunnerConnection(config)));
+var postgresProviders = (config) => Layer2.mergeAll(PostgresDatabaseProvider().pipe(Layer2.provideMerge(postgresConnection(config))), PostgresSchemaProvider().pipe(Layer2.provideMerge(postgresConnection(config))), PostgresGrantsProvider().pipe(Layer2.provideMerge(postgresConnection(config))));
+var postgresRunnerProviders = (config) => Layer2.mergeAll(PostgresDatabaseProvider().pipe(Layer2.provideMerge(postgresRunnerConnection(config))), PostgresSchemaProvider().pipe(Layer2.provideMerge(postgresRunnerConnection(config))), PostgresGrantsProvider().pipe(Layer2.provideMerge(postgresRunnerConnection(config))));
+var postgresRoleProviders = (config) => PostgresRoleProvider().pipe(Layer2.provideMerge(postgresConnection(config)));
+var postgresRoleRunnerProviders = (config) => PostgresRoleProvider().pipe(Layer2.provideMerge(postgresRunnerConnection(config)));
 export {
+  COLUMN_PRIVILEGES,
   POSTGRES_NAME_MAX_BYTES,
   PostgresConnection,
   PostgresDatabase,
@@ -301,24 +2177,109 @@ export {
   PostgresDatabaseOwnerMissing,
   PostgresDatabaseProvider,
   PostgresDatabaseRenameRefused,
+  PostgresGrants,
+  PostgresGrantsColumnMissing,
+  PostgresGrantsDatabaseMismatch,
+  PostgresGrantsDatabaseMissing,
+  PostgresGrantsDuplicateObject,
+  PostgresGrantsNameRefused,
+  PostgresGrantsPrivilegeRefused,
+  PostgresGrantsProvider,
+  PostgresGrantsRepairRefused,
+  PostgresGrantsRetargetRefused,
+  PostgresGrantsRoleMissing,
+  PostgresGrantsSchemaMissing,
+  PostgresGrantsTableMissing,
+  PostgresRole,
+  PostgresRoleCreateVanished,
+  PostgresRoleIdentityRefused,
+  PostgresRoleMembershipUnrepaired,
+  PostgresRoleNameRefused,
+  PostgresRoleParentMissing,
+  PostgresRolePasswordEnvUnsetError,
+  PostgresRolePasswordNonAsciiRefused,
+  PostgresRolePrivilegedRefused,
+  PostgresRoleProvider,
+  PostgresRoleRenameRefused,
+  PostgresRoleValidUntilRefused,
+  PostgresSchema,
+  PostgresSchemaCreateVanished,
+  PostgresSchemaDatabaseRefused,
+  PostgresSchemaDeleteForeignRefused,
+  PostgresSchemaDrift,
+  PostgresSchemaDropNotEmptyError,
+  PostgresSchemaExistsRefused,
+  PostgresSchemaIdentityRefused,
+  PostgresSchemaNameRefused,
+  PostgresSchemaOwnerMissing,
+  PostgresSchemaProvider,
+  PostgresSchemaRenameRefused,
+  PostgresSchemaWrongDatabase,
+  SCHEMA_PRIVILEGES,
+  TABLE_PRIVILEGES,
+  buildAlterRoleSql,
+  buildCommentSchemaSql,
   buildCreateDatabaseSql,
+  buildCreateRoleSql,
+  buildCreateSchemaSql,
+  buildDropRoleSql,
+  buildDropSchemaSql,
+  buildGrantMembershipSql,
+  buildRepairMembershipSql,
+  buildRevokeGrantorMembershipSql,
+  buildSetPasswordSql,
+  currentDatabase,
+  currentUser,
+  databaseExists,
+  diffPostgresSchema,
   firstDrift,
+  grantColumnSql,
+  grantDefaultSql,
+  grantSchemaSql,
+  grantTableSql,
+  grantsNameByteRefusal,
   inlineParams,
+  isDependentObjectsError,
   isDuplicateDatabaseRace,
   isPostgresDatabase,
+  isPostgresGrants,
+  isPostgresRole,
+  isPostgresSchema,
+  letterForPrivilege,
   makePsqlExecutor,
+  membershipDrift,
   nameByteRefusal,
+  normalizedComment,
   postgresConnection,
   postgresProviders,
+  postgresRoleProviders,
+  postgresRoleRunnerProviders,
   postgresRunnerConnection,
   postgresRunnerProviders,
   quoteIdent,
   quoteStringLiteral,
+  resolvePassword,
+  revokeColumnSql,
+  revokeDefaultSql,
+  revokePublicSchemaSql,
+  revokePublicTablesSql,
+  revokeSchemaSql,
+  revokeTableSql,
   roleExists,
+  sameValidUntil,
+  scalarDrift,
+  schemaIsEmpty,
+  schemaNameByteRefusal,
   selectDatabase,
+  selectRole,
+  selectRoleMemberships,
+  selectSchema,
+  syncMemberships,
+  unsafeMemberships,
   utf8ByteLength,
+  validUntilRefusal,
   withPg
 };
 
-//# debugId=0FE6812621B3699B64756E2164756E21
+//# debugId=584CB763916085BE64756E2164756E21
 //# sourceMappingURL=index.js.map