@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/postgres/installed-classifier.d.ts

@@ -0,0 +1,13 @@
+/**
+ * The installed `@effect/sql-pg` classifier, for tests that must pin real driver behavior
+ * instead of a hand-built error shape.
+ *
+ * ⛔ TEST-ONLY, PINNED TO THE INSTALLED DRIVER. `@effect/sql-pg` nulls the `./internal/*`
+ * export, so the public specifier cannot name `src/internal/sqlError.ts`; the file URL is
+ * resolved from the installed package's `package.json` — the same module
+ * `PgConnection.ts#classifyFields` calls. If the driver moves the file, the import fails
+ * loudly in the tests that use it rather than silently asserting a fabricated shape.
+ */
+import { SqlError } from 'effect/unstable/sql/SqlError';
+export declare const classifyInstalled: (code: string, message?: string) => Promise<SqlError>;
+//# sourceMappingURL=installed-classifier.d.ts.map

package/dist/postgres/installed-classifier.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"installed-classifier.d.ts","sourceRoot":"","sources":["../../src/postgres/installed-classifier.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAExD,eAAO,MAAM,iBAAiB,SACtB,MAAM,uBAEX,OAAO,CAAC,QAAQ,CAoBlB,CAAC"}

package/dist/postgres/providers.d.ts

@@ -1,16 +1,24 @@
 /**
- * `Postgres.Database`'s provider, pre-wired to one cluster:
+ * `Postgres.*` providers, pre-wired for one cluster:
  *
- *     const providers = postgresProviders({ host: '/opt/homeflare/postgres/sockets', database: 'postgres', username: 'tim' });
+ *     const providers = postgresProviders({ host: '/var/run/postgresql', database: 'postgres', username: 'tim' });
  *
- * ★ THE CLUSTER IS A PARAMETER, NOT A DEFAULT (S15, and `docs/postgres.md#path`). This kit is
- *   PUBLIC; the mini's socket directory, its user and its port are the CONSUMING stack's values,
- *   never baked in here. A stack with more than one cluster calls this more than once and merges
+ * ★ THE CLUSTER IS THE PARAMETER, NOT A DEFAULT (S15, `docs/postgres.md#path`). This kit is
+ *   PUBLIC; mini's socket directory, user and port are the CONSUMING stack's values,
+ *   never baked in here. A stack with more than one cluster calls this once per cluster and merges
  *   the results under whatever logical grouping it wants.
  */
 import * as Layer from 'effect/Layer';
 import { type PostgresConnectionConfig, type PostgresRunnerConfig } from './connection.ts';
-export declare const postgresProviders: (config: PostgresConnectionConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./database.ts").PostgresDatabase>, never, never>;
-/** The same provider over a command runner (`psql-executor.ts`) — for a loopback-only cluster. */
-export declare const postgresRunnerProviders: (config: PostgresRunnerConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./database.ts").PostgresDatabase>, never, never>;
+export declare const postgresProviders: (config: PostgresConnectionConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./database.ts").PostgresDatabase> | import("alchemy").Provider<import("./grants.ts").PostgresGrants> | import("alchemy").Provider<import("./schema.ts").PostgresSchema>, never, never>;
+/** The same providers over a command runner (`psql-executor.ts`) — for loopback-only clusters. */
+export declare const postgresRunnerProviders: (config: PostgresRunnerConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./database.ts").PostgresDatabase> | import("alchemy").Provider<import("./grants.ts").PostgresGrants> | import("alchemy").Provider<import("./schema.ts").PostgresSchema>, never, never>;
+/**
+ * `Postgres.Role`'s provider, over the same socket transport and the same cluster parameter.
+ *
+ *     const providers = postgresRoleProviders({ host: '/opt/homeflare/postgres/sockets', database: 'postgres', username: 'tim' });
+ */
+export declare const postgresRoleProviders: (config: PostgresConnectionConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./role.ts").PostgresRole>, never, never>;
+/** `Postgres.Role` over a command runner (`psql-executor.ts`) — for loopback-only clusters. */
+export declare const postgresRoleRunnerProviders: (config: PostgresRunnerConfig) => Layer.Layer<import("./connection.ts").PostgresConnection | import("alchemy").Provider<import("./role.ts").PostgresRole>, never, never>;
 //# sourceMappingURL=providers.d.ts.map

package/dist/postgres/providers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/postgres/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAG1B,MAAM,iBAAiB,CAAC;AAOzB,eAAO,MAAM,iBAAiB,WAAY,wBAAwB,mJACe,CAAC;AAElF,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,WAAY,oBAAoB,mJACmB,CAAC"}
+{"version":3,"file":"providers.d.ts","sourceRoot":"","sources":["../../src/postgres/providers.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AACH,OAAO,KAAK,KAAK,MAAM,cAAc,CAAC;AACtC,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,oBAAoB,EAG1B,MAAM,iBAAiB,CAAC;AAWzB,eAAO,MAAM,iBAAiB,WAAY,wBAAwB,yRAK/D,CAAC;AAEJ,kGAAkG;AAClG,eAAO,MAAM,uBAAuB,WAAY,oBAAoB,yRAKjE,CAAC;AAEJ;;;;GAIG;AACH,eAAO,MAAM,qBAAqB,WAAY,wBAAwB,2IACO,CAAC;AAE9E,+FAA+F;AAC/F,eAAO,MAAM,2BAA2B,WAAY,oBAAoB,2IACW,CAAC"}

package/dist/postgres/psql-executor.d.ts

@@ -17,5 +17,9 @@ export interface PsqlTarget {
 }
 /** Replace `$1…$n` with string literals; refuses a non-string param or a missing one. */
 export declare const inlineParams: (sql: string, params: ReadonlyArray<unknown>) => string;
+/** A password literal must not survive into an error Alchemy logs. `ALTER ROLE … PASSWORD`
+ * inlines the value (Postgres has no bind form), and the runner turns the first 40 characters
+ * of that statement into `operation` and the full `stderr` into `message`. */
+export declare const redactPasswordLiterals: (text: string) => string;
 export declare const makePsqlExecutor: (run: PsqlRunner, target: PsqlTarget) => PgExecutor;
 //# sourceMappingURL=psql-executor.d.ts.map

package/dist/postgres/psql-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"psql-executor.d.ts","sourceRoot":"","sources":["../../src/postgres/psql-executor.ts"],"names":[],"mappings":"AAyBA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;yDAEyD;AACzD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,YAAY,QAAS,MAAM,UAAU,aAAa,CAAC,OAAO,CAAC,KAAG,MASnE,CAAC;AAgCT,eAAO,MAAM,gBAAgB,QAAS,UAAU,UAAU,UAAU,KAAG,UAyCrE,CAAC"}
+{"version":3,"file":"psql-executor.d.ts","sourceRoot":"","sources":["../../src/postgres/psql-executor.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;yDAEyD;AACzD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,YAAY,QAAS,MAAM,UAAU,aAAa,CAAC,OAAO,CAAC,KAAG,MASnE,CAAC;AAgBT;;8EAE8E;AAC9E,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MAInD,CAAC;AAuDJ,eAAO,MAAM,gBAAgB,QAAS,UAAU,UAAU,UAAU,KAAG,UAkCrE,CAAC"}

package/dist/postgres/role-attrs.d.ts

@@ -0,0 +1,112 @@
+/**
+ * `Postgres.Role` props and attributes, and the plan-time checks that run before any statement.
+ *
+ * ⛔ EVERY ASSERTED PROP TRACES TO A REAL `CREATE ROLE` / `ALTER ROLE` OPTION AND A REAL CATALOG
+ *   COLUMN. `role-provenance.test.ts` parses the committed fixtures (`create_role.sgml`,
+ *   `alter_role.sgml`, `pg_authid.h`, `pg_auth_members.h`) and fails if that mapping breaks.
+ * ⛔ NO PASSWORD VALUE AS A PROP (S25). `password` is declared as
+ *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`, never a string. The name lives in state; the value
+ *   is resolved from the deploying process's environment at reconcile time, wrapped in
+ *   `Redacted`, and quoted into the one statement that needs it.
+ * ★ UNLIKE `Postgres.Database`, THIS FAMILY IS ALTER-CAPABLE: `LOGIN`/`NOLOGIN`,
+ *   `INHERIT`/`NOINHERIT`, `CONNECTION LIMIT` and `VALID UNTIL` all have a safe atomic
+ *   `ALTER ROLE` form (`alter_role.sgml`'s first synopsis variant), so a drifted live row is
+ *   brought back to the declaration instead of refused.
+ */
+import type { FromEnv } from '../secrets/write-only.ts';
+/** Re-exported for tests that operate on identifier byte length. */
+export { POSTGRES_NAME_MAX_BYTES, nameByteRefusal, utf8ByteLength } from './database-attrs.ts';
+export declare const validUntilRefusal: (value: string) => {
+    readonly reason: 'unparseable' | 'zone-free';
+} | undefined;
+/** Whether a declared `validUntil` and the live serialised value name the same instant. Both
+ * sides are plan-checked parseable, so `NaN` cannot reach here. */
+export declare const sameValidUntil: (declared: string, live: string | null) => boolean;
+/**
+ * Declared properties of one role.
+ *
+ * `login` and `inherit` are required: the resource configures a LOGIN or NOLOGIN role with
+ * INHERIT explicit, per the seat-wiring spec's group-role-per-seat shape (`NOLOGIN`, member of
+ * `hf_agent`, owning its own schema). An undeclared boolean would silently adopt whatever the
+ * live row already says — the opposite of idempotent.
+ */
+export interface PostgresRoleProps {
+    /** At most 63 UTF-8 bytes — refused at plan/reconcile if larger (`PostgresRoleNameRefused`). */
+    readonly name: string;
+    /** `LOGIN` or `NOLOGIN` — maps to `pg_roles.rolcanlogin`. */
+    readonly login: boolean;
+    /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */
+    readonly connectionLimit: number;
+    /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant
+     * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */
+    readonly inherit: boolean;
+    /**
+     * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is
+     * accepted by PostgreSQL's `timestamptz` input (it is interpreted in the client's time zone);
+     * an ISO 8601 string carrying `Z` is unambiguous, so the docs recommend declaring it. Omitted
+     * means "leave the live value alone" — the resource never clears an expiry it did not declare.
+     */
+    readonly validUntil?: string;
+    /**
+     * The roles this role is a member of (`GRANT parent TO this`). Backed by `pg_auth_members`.
+     * Compared when declared; omitted leaves live memberships untouched. Empty array means
+     * "ensure none".
+     */
+    readonly memberOf?: readonly string[];
+    /**
+     * `PASSWORD '...'` by the NAME of the environment variable holding it. Omitted means "leave
+     * the live password alone" (and `NOLOGIN` group roles need none). Required once, before the
+     * first create that declares it, and on every later write while the variable is set — a value
+     * the environment stopped providing is never guessed.
+     */
+    readonly password?: FromEnv;
+}
+/** Live attributes, read back after every reconcile. `passwordValue` is NEVER stored (S25). */
+export interface PostgresRoleAttributes {
+    readonly name: string;
+    readonly oid: number;
+    readonly login: boolean;
+    readonly connectionLimit: number;
+    readonly inherit: boolean;
+    /** ISO 8601 (`...Z`), server-side serialised; `null` when the live row has no expiry. */
+    readonly validUntil: string | null;
+    /**
+     * Catalog flags this family never declares. A create lands on the server default (all false).
+     * An adopt or alter that finds any of them true is refused — they are not inherited, so a
+     * member who `SET ROLE`s to this role would exercise them. Absent on a seeded test row means
+     * false, the default a `CREATE ROLE` without the option lands on.
+     */
+    readonly superuser?: boolean;
+    readonly createrole?: boolean;
+    readonly createdb?: boolean;
+    readonly replication?: boolean;
+    readonly bypassrls?: boolean;
+    /**
+     * Parent role names, sorted. Empty array when the role is a member of nothing. Null means
+     * "memberships were not declared on this resource", so the field is not asserted.
+     */
+    readonly memberOf: readonly string[] | null;
+    /**
+     * The membership rows behind `memberOf`, including `admin_option`, `set_option` and
+     * `inherit_option`. Present
+     * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the
+     * engine's diff receives stored attributes and would never see them there. The provider's
+     * diff reads these rows live. `grantor` is the role that made the grant
+     * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary
+     * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.
+     */
+    readonly memberships?: readonly {
+        readonly parent: string;
+        readonly grantor: string | null;
+        readonly admin: boolean;
+        readonly set: boolean;
+        readonly inherit: boolean;
+    }[];
+    /**
+     * A seal of the last password value written, or `''` if none was ever written (`seal()` from
+     * `secrets/write-only.ts`). Lets a later reconcile notice a rotated environment variable
+     * without the state store holding anything a reader could replay.
+     */
+    readonly passwordSeal: string;
+}
+//# sourceMappingURL=role-attrs.d.ts.map

package/dist/postgres/role-attrs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/role-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,oEAAoE;AACpE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAe/F,eAAO,MAAM,iBAAiB,UACrB,MAAM,KACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GAAG,SAOrD,CAAC;AAEF;mEACmE;AACnE,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAG,OACX,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;iGAC6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/postgres/role-diff.d.ts

@@ -0,0 +1,22 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { Environment } from '../secrets/write-only.ts';
+import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+import { PostgresRoleIdentityRefused, type PostgresRoleNameRefused, type PostgresRolePasswordNonAsciiRefused, PostgresRoleRenameRefused, type PostgresRoleValidUntilRefused } from './role-errors.ts';
+/** A catalog read the provider performed for this diff. `found: undefined` means the name is
+ * absent. Omitting the argument means no catalog read (the offline comparison). */
+export interface RoleObservation {
+    readonly found: Omit<PostgresRoleAttributes, 'passwordSeal'> | undefined;
+}
+/**
+ * `news` against stored `output`, plus a live row when the provider has one. A rename is a
+ * plan-time refusal; so are an over-long name and an unusable `validUntil`. An oid that is not
+ * the stored one is refused — the name was recreated out of band. Every other change answers
+ * `update`. `delete` is a real drop here, so `diff` never answers `replace`.
+ */
+export declare const diffPostgresRole: (news: Input<PostgresRoleProps>, output: PostgresRoleAttributes | undefined, env?: Environment, observation?: RoleObservation) => Effect.Effect<{
+    readonly action: 'update';
+} | {
+    readonly action: 'noop';
+} | undefined, PostgresRoleRenameRefused | PostgresRoleNameRefused | PostgresRoleValidUntilRefused | PostgresRoleIdentityRefused | PostgresRolePasswordNonAsciiRefused>;
+//# sourceMappingURL=role-diff.d.ts.map

package/dist/postgres/role-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/role-diff.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,mCAAmC,EACxC,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,kBAAkB,CAAC;AAM1B;mFACmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,KAAK,CAAC,iBAAiB,CAAC,UACtB,sBAAsB,GAAG,SAAS,QACrC,WAAW,gBACF,eAAe,KAC5B,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrE,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,2BAA2B,GAC3B,mCAAmC,CA0CnC,CAAC"}

package/dist/postgres/role-errors.d.ts

@@ -0,0 +1,132 @@
+declare const PostgresRoleNameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleNameRefused";
+} & Readonly<A>;
+/**
+ * A role name would be silently truncated by the server (`NAMEDATALEN` 64, so 63 UTF-8 bytes is
+ * the last one that survives whole) — refused at plan, before any statement runs.
+ *
+ * ⚠️ Same hazard as `PostgresDatabaseNameRefused`: `truncate_identifier` clips at 63 bytes and
+ * emits only a NOTICE. A create would succeed against the truncated name; the next plan would
+ * look for the original name and find nothing, looping forever.
+ */
+export declare class PostgresRoleNameRefused extends PostgresRoleNameRefused_base<{
+    readonly name: string;
+    readonly byteLength: number;
+    readonly limit: number;
+}> {
+    get message(): string;
+}
+declare const PostgresRoleRenameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleRenameRefused";
+} & Readonly<A>;
+/** A logical id's `name` changed. A role's name is its identity; this resource never replaces via
+ * `DROP` then `CREATE` — role memberships, grants and owned objects would be lost, and the
+ * seat-wiring shape depends on the group-role name staying stable. `ALTER ROLE … RENAME TO`
+ * exists in PostgreSQL; this family does not drive it, so a rename is refused at plan and the
+ * new name is declared as its own logical id. */
+export declare class PostgresRoleRenameRefused extends PostgresRoleRenameRefused_base<{
+    readonly from: string;
+    readonly to: string;
+}> {
+    get message(): string;
+}
+declare const PostgresRolePasswordEnvUnsetError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRolePasswordEnvUnsetError";
+} & Readonly<A>;
+/** The password prop names an environment variable that is unset or empty at reconcile time, on a
+ * write that must send one (a create that declares it, or any reconcile while the variable is
+ * set). Never a guess: a group role left with a stale or empty password is exactly the
+ * unauthenticated path the refusal exists to prevent. */
+export declare class PostgresRolePasswordEnvUnsetError extends PostgresRolePasswordEnvUnsetError_base<{
+    readonly role: string;
+    readonly variable: string;
+}> {
+    get message(): string;
+}
+declare const PostgresRolePrivilegedRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRolePrivilegedRefused";
+} & Readonly<A>;
+/** A live role carries a catalog flag this family never declares (`rolsuper`, `rolcreaterole`,
+ * `rolcreatedb`, `rolreplication`, `rolbypassrls`). Those are not inherited: a member who
+ * `SET ROLE`s to the parent exercises them. Refused before any write, adopt included. */
+export declare class PostgresRolePrivilegedRefused extends PostgresRolePrivilegedRefused_base<{
+    readonly role: string;
+    readonly flags: readonly string[];
+}> {
+    get message(): string;
+}
+declare const PostgresRoleValidUntilRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleValidUntilRefused";
+} & Readonly<A>;
+/** The declared `validUntil` is not a timestamp this family can compare: ECMAScript cannot parse
+ * it at all, or it names no time zone. Refused at plan, before any statement — see
+ * `role-attrs.ts#validUntilRefusal` for the churn loop this prevents. */
+export declare class PostgresRoleValidUntilRefused extends PostgresRoleValidUntilRefused_base<{
+    readonly role: string;
+    readonly value: string;
+    readonly reason: 'unparseable' | 'zone-free';
+}> {
+    get message(): string;
+}
+declare const PostgresRoleCreateVanished_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleCreateVanished";
+} & Readonly<A>;
+/** `CREATE ROLE` raised no error, but the immediate re-read still finds nothing (S10/S20).
+ * Measured to have no real trigger in a correctly speaking client; still a typed failure the
+ * caller can see and retry, never a defect that crashes the engine. */
+export declare class PostgresRoleCreateVanished extends PostgresRoleCreateVanished_base<{
+    readonly role: string;
+}> {
+    get message(): string;
+}
+declare const PostgresRoleMembershipUnrepaired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleMembershipUnrepaired";
+} & Readonly<A>;
+/** An option repair was refused, or a catalog row survived outside the declaration. A null grantor is a
+ * defensive corruption/test case: PostgreSQL tracks grantor dependencies, so ordinary
+ * DROP ROLE does not leave a dangling grantor. Refuse instead of claiming convergence. */
+export declare class PostgresRoleMembershipUnrepaired extends PostgresRoleMembershipUnrepaired_base<{
+    readonly role: string;
+    readonly parent: string;
+    readonly grantor: string | null;
+    readonly declared: boolean;
+}> {
+    get message(): string;
+}
+declare const PostgresRoleParentMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleParentMissing";
+} & Readonly<A>;
+/** A declared `memberOf` parent is not in `pg_roles`. Checked before any statement of a create,
+ * so a missing parent never leaves a committed LOGIN role behind a `42704` (`undefined_object`,
+ * `user.c@REL_18_6`) from `GRANT`. */
+export declare class PostgresRoleParentMissing extends PostgresRoleParentMissing_base<{
+    readonly role: string;
+    readonly parent: string;
+}> {
+    get message(): string;
+}
+declare const PostgresRoleIdentityRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRoleIdentityRefused";
+} & Readonly<A>;
+/** The live role's oid is not the one this stack stored. A drop and recreate out of band reuses
+ * the name and would otherwise plan as ours: noop while the seal still matches, and a destroy
+ * would `DROP` a role this stack never created. */
+export declare class PostgresRoleIdentityRefused extends PostgresRoleIdentityRefused_base<{
+    readonly role: string;
+    readonly storedOid: number;
+    readonly liveOid: number;
+}> {
+    get message(): string;
+}
+declare const PostgresRolePasswordNonAsciiRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRolePasswordNonAsciiRefused";
+} & Readonly<A>;
+/** Never carry the rejected password in this error: errors reach logs and traces. */
+export declare class PostgresRolePasswordNonAsciiRefused extends PostgresRolePasswordNonAsciiRefused_base<{
+    readonly role: string;
+}> {
+    get message(): string;
+}
+export type PostgresRoleError = PostgresRolePasswordNonAsciiRefused | PostgresRoleNameRefused | PostgresRoleRenameRefused | PostgresRoleValidUntilRefused | PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused;
+export {};
+//# sourceMappingURL=role-errors.d.ts.map

package/dist/postgres/role-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/role-errors.ts"],"names":[],"mappings":";;;AAYA;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;iDAIiD;AACjD,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;yDAGyD;AACzD,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;yFAEyF;AACzF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;CAC9C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;uEAEuE;AACvE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;0FAE0F;AAC1F,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAY7B;CACF;;;;AAED;;sCAEsC;AACtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mDAEmD;AACnD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mCAAoC,SAAQ,yCAEvD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;IAC1B,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,MAAM,MAAM,iBAAiB,GACzB,mCAAmC,GACnC,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,CAAC"}

package/dist/postgres/role-membership-sql.d.ts

@@ -0,0 +1,78 @@
+/**
+ * Membership statements and the catalog read behind them, split out of `role-sql.ts`
+ * (file cap). One file so `diff`, reconcile and the fake agree on the exact texts.
+ *
+ * ★ ONE PARENT PER STATEMENT. `pg_auth_members` keys a membership on three columns —
+ *   (parent, member, grantor) — so more than one row can exist for one parent name:
+ *   another grantor's `ADMIN`-option grant rides beside the safe one. A multi-role
+ *   `GRANT`/`REVOKE` list would make a partially-failed write harder to attribute.
+ * ★ SEAT GRANTS SAY `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE (`grant.sgml` at
+ *   REL_18_6), and `SET ROLE` to the parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB`
+ *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.
+ * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's
+ *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing
+ *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still
+ *   produce only a warning; the catalog re-read below catches surviving unsafe rows.
+ */
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import * as Effect from 'effect/Effect';
+import type { PgExecutor } from './database-sql.ts';
+import { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './role-errors.ts';
+import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+/** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made
+ * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;
+ * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null
+ * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:
+ * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */
+export interface MembershipRow {
+    readonly parent: string;
+    readonly grantor: string | null;
+    readonly admin: boolean;
+    readonly set: boolean;
+    readonly inherit: boolean;
+}
+export declare const selectRoleMemberships: (pg: PgExecutor, name: string) => Effect.Effect<readonly MembershipRow[], SqlError>;
+/** Seat grants say `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE, and `SET ROLE` to the
+ * parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB` are exercised (`user-manag.sgml`). */
+export declare const buildGrantMembershipSql: (member: string, parent: string) => string;
+/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made
+ * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:
+ * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES
+ * https://www.postgresql.org/docs/16/sql-revoke.html
+ * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;
+ * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.
+ * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.
+ * GRANTED BY targets the observed row, including a different grantor's row. */
+export declare const buildRepairMembershipSql: (member: string, parent: string, grantor: string, option: 'ADMIN' | 'SET' | 'INHERIT') => string;
+/** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke
+ * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */
+export declare const buildRevokeGrantorMembershipSql: (member: string, parent: string, grantor: string) => string;
+/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.
+ * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */
+export declare const unsafeMemberships: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>, 
+/** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live
+ *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */
+inherit: boolean) => ReadonlySet<string>;
+/** Membership drift: sorted set difference between declared and live. Duplicates in the
+ * declaration collapse to one; `undefined` means "not asserted" — nothing to grant or revoke.
+ * A parent already granted `WITH ADMIN`, or with `SET` still at the upstream default TRUE, is
+ * a grant again: the name matches, but the options do not, so reconcile repairs in place. */
+export declare const membershipDrift: (declared: readonly string[] | undefined, live: readonly string[], unsafe?: ReadonlySet<string>) => {
+    readonly grants: readonly string[];
+    readonly revokes: readonly string[];
+};
+/** Refuse before any membership write when a declared parent is not in `pg_roles`. `GRANT` of a
+ * missing role is `42704` (`user.c@REL_18_6`), and on a create that error arrives only after
+ * `CREATE ROLE` has committed. */
+export declare const assertParentsExist: (pg: PgExecutor, role: string, parents: readonly string[] | undefined) => Effect.Effect<void, PostgresRoleParentMissing | SqlError>;
+/** Make live memberships equal the declaration, preserving wanted memberships in place.
+ * The previous full-options GRANT updated only its own grantor's row, then revoked other
+ * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).
+ * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows
+ * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).
+ * Each retained row's options share a transaction, attributing a dependency/permission
+ * refusal to that parent and grantor. No CASCADE and no replacement grantor row.
+ * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */
+export declare const syncMemberships: (pg: PgExecutor, props: PostgresRoleProps, rows: readonly MembershipRow[]) => Effect.Effect<readonly string[], SqlError | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing>;
+//# sourceMappingURL=role-membership-sql.d.ts.map

package/dist/postgres/role-membership-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-membership-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-membership-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;;yFAKyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAcD,eAAO,MAAM,qBAAqB,OAC5B,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,QAAQ,CAC2B,CAAC;AAE/E;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,WAAY,MAAM,UAAU,MAAM,KAAG,MACF,CAAC;AAExE;;;;;;;+EAO+E;AAC/E,eAAO,MAAM,wBAAwB,WAC3B,MAAM,UACN,MAAM,WACL,MAAM,UACP,OAAO,GAAG,KAAK,GAAG,SAAS,KAClC,MACwH,CAAC;AAE5H;4EAC4E;AAC5E,eAAO,MAAM,+BAA+B,WAClC,MAAM,UACN,MAAM,WACL,MAAM,KACd,MAC0F,CAAC;AAE9F;kFACkF;AAClF,eAAO,MAAM,iBAAiB,SACtB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC;AAClD;kFACkF;SACzE,OAAO,KACf,WAAW,CAAC,MAAM,CAKlB,CAAC;AAEJ;;;6FAG6F;AAC7F,eAAO,MAAM,eAAe,aAChB,SAAS,MAAM,EAAE,GAAG,SAAS,QACjC,SAAS,MAAM,EAAE,WACf,WAAW,CAAC,MAAM,CAAC,KAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAW3E,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,WACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,QAAQ,CAQvD,CAAC;AAEL;;;;;;;6FAO6F;AAC7F,eAAO,MAAM,eAAe,OACtB,UAAU,SACP,iBAAiB,QAClB,SAAS,aAAa,EAAE,KAC7B,MAAM,CAAC,MAAM,CACd,SAAS,MAAM,EAAE,EACjB,QAAQ,GAAG,gCAAgC,GAAG,yBAAyB,CAuErE,CAAC"}

package/dist/postgres/role-provider.d.ts

@@ -0,0 +1,11 @@
+/**
+ * `Postgres.Role`'s five lifecycle handlers, wired to `withPg` for anything that touches a
+ * client, and the one Layer a consuming stack provides. Split from `role.ts` so the file stays
+ * under the house cap: `role.ts` holds reconcile, `role-diff.ts` the plan diff; this file holds
+ * only the engine wiring.
+ */
+import * as Provider from 'alchemy/Provider';
+import { PostgresRole } from './role.ts';
+export declare const postgresRoleHandlers: Provider.ProviderService<PostgresRole, import("./connection.ts").PostgresConnection, import("./connection.ts").PostgresConnection, never, import("./connection.ts").PostgresConnection, import("./connection.ts").PostgresConnection, never, never, never>;
+export declare const PostgresRoleProvider: () => import("effect/Layer").Layer<Provider.Provider<PostgresRole>, never, import("./connection.ts").PostgresConnection>;
+//# sourceMappingURL=role-provider.d.ts.map

package/dist/postgres/role-provider.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-provider.d.ts","sourceRoot":"","sources":["../../src/postgres/role-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzC,eAAO,MAAM,oBAAoB,4PAmF/B,CAAC;AAEH,eAAO,MAAM,oBAAoB,0HAA6D,CAAC"}

package/dist/postgres/role-scram.d.ts

@@ -0,0 +1,8 @@
+/**
+ * `SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>` for one password. The salt is fresh per
+ * call (same as `psql \password`); tests pass one to make the output deterministic.
+ * Callers first run `assertPasswordAscii`: raw non-ASCII may differ from PostgreSQL's
+ * SASLprep bytes (https://www.postgresql.org/docs/16/sasl-authentication.html).
+ */
+export declare const scramSha256Verifier: (password: string, salt?: Buffer) => string;
+//# sourceMappingURL=role-scram.d.ts.map

package/dist/postgres/role-scram.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-scram.d.ts","sourceRoot":"","sources":["../../src/postgres/role-scram.ts"],"names":[],"mappings":"AA2BA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,aAAc,MAAM,SAAS,MAAM,KAAG,MAMrE,CAAC"}

package/dist/postgres/role-secrets.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The `Postgres.Role` password: resolution from the environment and the seal arithmetic that
+ * lets state answer "did this value already go out?" without storing it (S25).
+ *
+ * ⛔ THE PASSWORD IS A REFERENCE, NEVER A VALUE. It is declared as
+ *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`; the NAME lands in state, the value is resolved
+ *   from the deploying process's environment at reconcile/diff time, held as `Redacted`, and
+ *   quoted into the one `ALTER ROLE … PASSWORD` statement that needs it.
+ * ★ What state remembers is a `scrypt:<salt>:<digest>` seal ({@link sealPassword}), so a
+ *   reconcile sends the password only when the environment value differs from the one last
+ *   written — a plan never re-sends a secret that already matches, and never stores one.
+ */
+import * as Redacted from 'effect/Redacted';
+import * as Effect from 'effect/Effect';
+import { PostgresRolePasswordNonAsciiRefused } from './role-errors.ts';
+import { type Environment } from '../secrets/write-only.ts';
+import type { PostgresRoleProps } from './role-attrs.ts';
+/** What the environment holds for the declared password. `value` is `undefined` when no
+ * password is declared, or when the variable is unset or empty (a renderer that failed writes
+ * `NAME=`; `resolveAll` treats empty as missing). ⛔ Reads the environment at CALL time. */
+export interface ResolvedPassword {
+    readonly variable: string | undefined;
+    readonly value: Redacted.Redacted<string> | undefined;
+}
+/** ⛔ PostgreSQL applies SASLprep before SCRAM, with a raw-byte fallback for prohibited input:
+ * https://www.postgresql.org/docs/16/sasl-authentication.html#SASL-SCRAM-SHA-256
+ * Non-ASCII can normalize to different bytes (e.g. soft hyphen disappears). Refuse before
+ * any write, even with a matching old seal, until we have a vendor-compatible normalizer.
+ * ASCII is unchanged, including prohibited ASCII controls via PostgreSQL's fallback. */
+export declare const assertPasswordAscii: (role: string, resolved: ResolvedPassword) => Effect.Effect<void, PostgresRolePasswordNonAsciiRefused>;
+export declare const resolvePassword: (props: PostgresRoleProps, env?: Environment) => ResolvedPassword;
+/** `seal({ password })` of the resolved value — the one thing state remembers about it. */
+export declare const sealPassword: (value: Redacted.Redacted<string>) => string;
+/** Whether the seal was made from the resolved value. Malformed/empty seals answer false, so an
+ * adopted role (seal `''`) or one written outside this stack gets the password written on the
+ * first reconcile that holds the variable — the declaration is authoritative. */
+export declare const passwordMatchesSeal: (value: Redacted.Redacted<string>, sealed: string) => boolean;
+//# sourceMappingURL=role-secrets.d.ts.map

package/dist/postgres/role-secrets.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-secrets.d.ts","sourceRoot":"","sources":["../../src/postgres/role-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;2FAE2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED;;;;wFAIwF;AACxF,eAAO,MAAM,mBAAmB,SACxB,MAAM,YACF,gBAAgB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAGzC,CAAC;AAElB,eAAO,MAAM,eAAe,UACnB,iBAAiB,QACnB,WAAW,KACf,gBAQF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAG,MACrB,CAAC;AAE5C;;iFAEiF;AACjF,eAAO,MAAM,mBAAmB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,KAAG,OAC7B,CAAC"}

package/dist/postgres/role-sql.d.ts

@@ -0,0 +1,68 @@
+/**
+ * The statements `Postgres.Role` ever issues, and the one read that backs them.
+ *
+ * ⛔ `CREATE ROLE` / `ALTER ROLE` TAKE NO BIND PARAMETERS FOR ANY OF THEIR VALUES. Measured at
+ *   `gram.y@REL_18_6`: every option value in `CreateOptRoleStmt` is a `RoleSpec`, a signed
+ *   `Iconst` or an `Sconst`, and none of those productions reaches `PARAM` (`$n`). Only the
+ *   catalog reads below bind a role name (`$1`).
+ * ⛔ THE PASSWORD NEVER CROSSES THE WIRE AS A PLAIN LITERAL. Postgres has no bind form for it in
+ *   `CREATE`/`ALTER ROLE`, so the statement carries the SCRAM-SHA-256 verifier `role-scram.ts`
+ *   computes client-side (what `psql \password` sends; stored as-is, never reversible): the
+ *   statement text that reaches the span attribute `db.query.text`, `pg_stat_statements` and a
+ *   failed `ALTER`'s server log holds no secret. It is quoted with `quoteStringLiteral` like every
+ *   other string value and NEVER written to state — only its seal is (`role-attrs.ts`,
+ *   `passwordSeal`).
+ * ★ MEMBERSHIP IS TWO ONE-PARENT STATEMENTS (`GRANT` / `REVOKE`), never a multi-role list, so a
+ *   partially-failed membership write is observable in the state that remains. Those statements
+ *   and the `pg_auth_members` read live in `role-membership-sql.ts` — this file stays the role
+ *   row (`pg_roles`), its scalar statements and the compare between them.
+ */
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import * as Effect from 'effect/Effect';
+import type { PgExecutor } from './database-sql.ts';
+import { type PostgresRoleAttributes, type PostgresRoleProps } from './role-attrs.ts';
+export declare const selectRole: (pg: PgExecutor, name: string) => Effect.Effect<Omit<PostgresRoleAttributes, 'memberOf' | 'passwordSeal'> | undefined, SqlError>;
+/** One combined read used by reconcile, so a no-op reconcile issues exactly one round trip.
+ * `passwordSeal` is state-only — `pg_roles` answers no password (S25) — so the caller merges it. */
+export declare const readRoleWithClient: (pg: PgExecutor, name: string) => Effect.Effect<Omit<PostgresRoleAttributes, 'passwordSeal'> | undefined, SqlError>;
+export declare const buildCreateRoleSql: (props: PostgresRoleProps) => string;
+/** One `ALTER ROLE` per drifted scalar. Membership and password are separate statements. */
+export declare const buildAlterRoleSql: (name: string, change: {
+    prop: 'login';
+    value: boolean;
+} | {
+    prop: 'inherit';
+    value: boolean;
+} | {
+    prop: 'connectionLimit';
+    value: number;
+} | {
+    prop: 'validUntil';
+    value: string;
+}) => string;
+/** One dedicated `ALTER ROLE … PASSWORD`. It carries the SCRAM-SHA-256 verifier
+ * `role-scram.ts` computes, never the plain password: Postgres takes no bind parameter for a role
+ * password, but a string already in SCRAM verifier format is stored as-is (`create_role.sgml`),
+ * so the statement text that reaches the span, `pg_stat_statements` and a failed `ALTER`'s server
+ * log holds no secret. */
+export declare const buildSetPasswordSql: (name: string, verifier: string) => string;
+export declare const buildDropRoleSql: (name: string) => string;
+/** `CREATE`, the optional password `ALTER`, and one seat `GRANT` per declared parent, in the
+ * order a single transaction runs them. Grants are sorted so the script is stable. */
+export declare const buildCreateStatements: (props: PostgresRoleProps, verifier: string | undefined) => readonly string[];
+/** Compare every declared scalar prop against the live row; answer the list of statements
+ * reconcile needs to run, empty when nothing drifted. `name` is compared by the caller. */
+export declare const scalarDrift: (props: PostgresRoleProps, live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => ReadonlyArray<Parameters<typeof buildAlterRoleSql>[1]>;
+/** Whether a live role is the one an interrupted create would have left: every declared scalar,
+ * the declared parent set, and no privilege flag or unsafe membership option. The password is
+ * not in `pg_roles`, so it is not part of the proof. */
+export declare const declarationMatches: (props: PostgresRoleProps, live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => boolean;
+/** Drop the observe-only membership options before attributes reach state. Alchemy's plan diff
+ * receives the stored attributes (`Plan.ts` passes `oldState.attr`), so an `admin`/`set` row
+ * kept here would still not be what `diff` sees — the provider reads `pg_auth_members` live.
+ * What state stores is the parent-name set. */
+export declare const storedAttributes: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => Omit<PostgresRoleAttributes, 'passwordSeal'>;
+/** Catalog flags this family never declares. A create lands on the server default (all false);
+ * an absent field on a seeded test row is that default. */
+export declare const privilegedFlags: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => readonly string[];
+//# sourceMappingURL=role-sql.d.ts.map

package/dist/postgres/role-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,UAAU,OACjB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAI7F,CAAC;AAEJ;oGACoG;AACpG,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAW/E,CAAC;AAiBL,eAAO,MAAM,kBAAkB,UAAW,iBAAiB,KAAG,MACM,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,SACtB,MAAM,UAER;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KACxC,MAYF,CAAC;AAEF;;;;0BAI0B;AAC1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,YAAY,MAAM,KAAG,MACW,CAAC;AAEjF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAAmD,CAAC;AAEpG;sFACsF;AACtF,eAAO,MAAM,qBAAqB,UACzB,iBAAiB,YACd,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAMjB,CAAC;AAEF;2FAC2F;AAC3F,eAAO,MAAM,WAAW,UACf,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,aAAa,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAcvD,CAAC;AAEF;;wDAEwD;AACxD,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,OAgBF,CAAC;AAEF;;;+CAG+C;AAC/C,eAAO,MAAM,gBAAgB,SACrB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAG7C,CAAC;AAEF;2DAC2D;AAC3D,eAAO,MAAM,eAAe,SACpB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,SAAS,MAAM,EAQjB,CAAC"}