@homeflare/alchemy 0.44.0 → 0.45.0

package/dist/postgres/role-attrs.d.ts

@@ -37,7 +37,8 @@ export interface PostgresRoleProps {
     readonly login: boolean;
     /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */
     readonly connectionLimit: number;
-    /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`. */
+    /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant
+     * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */
     readonly inherit: boolean;
     /**
      * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is
@@ -86,18 +87,20 @@ export interface PostgresRoleAttributes {
      */
     readonly memberOf: readonly string[] | null;
     /**
-     * The membership rows behind `memberOf`, including `admin_option` and `set_option`. Present
+     * The membership rows behind `memberOf`, including `admin_option`, `set_option` and
+     * `inherit_option`. Present
      * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the
      * engine's diff receives stored attributes and would never see them there. The provider's
      * diff reads these rows live. `grantor` is the role that made the grant
-     * (`pg_auth_members.grantor`), null when that role was dropped — a dropped-grantor row cannot
-     * be named in `REVOKE … GRANTED BY`, so reconcile can only fail typed on it.
+     * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary
+     * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.
      */
     readonly memberships?: readonly {
         readonly parent: string;
         readonly grantor: string | null;
         readonly admin: boolean;
         readonly set: boolean;
+        readonly inherit: boolean;
     }[];
     /**
      * A seal of the last password value written, or `''` if none was ever written (`seal()` from

package/dist/postgres/role-attrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/role-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,oEAAoE;AACpE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAe/F,eAAO,MAAM,iBAAiB,UACrB,MAAM,KACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GAAG,SAOrD,CAAC;AAEF;mEACmE;AACnE,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAG,OACX,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;KACvB,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"role-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/role-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,oEAAoE;AACpE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAe/F,eAAO,MAAM,iBAAiB,UACrB,MAAM,KACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GAAG,SAOrD,CAAC;AAEF;mEACmE;AACnE,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAG,OACX,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;iGAC6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/postgres/role-diff.d.ts

@@ -2,7 +2,7 @@ import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
 import type { Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
-import { PostgresRoleIdentityRefused, type PostgresRoleNameRefused, PostgresRoleRenameRefused, type PostgresRoleValidUntilRefused } from './role-errors.ts';
+import { PostgresRoleIdentityRefused, type PostgresRoleNameRefused, type PostgresRolePasswordNonAsciiRefused, PostgresRoleRenameRefused, type PostgresRoleValidUntilRefused } from './role-errors.ts';
 /** A catalog read the provider performed for this diff. `found: undefined` means the name is
  * absent. Omitting the argument means no catalog read (the offline comparison). */
 export interface RoleObservation {
@@ -18,5 +18,5 @@ export declare const diffPostgresRole: (news: Input<PostgresRoleProps>, output:
     readonly action: 'update';
 } | {
     readonly action: 'noop';
-} | undefined, PostgresRoleRenameRefused | PostgresRoleNameRefused | PostgresRoleValidUntilRefused | PostgresRoleIdentityRefused>;
+} | undefined, PostgresRoleRenameRefused | PostgresRoleNameRefused | PostgresRoleValidUntilRefused | PostgresRoleIdentityRefused | PostgresRolePasswordNonAsciiRefused>;
 //# sourceMappingURL=role-diff.d.ts.map

package/dist/postgres/role-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/role-diff.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,kBAAkB,CAAC;AAM1B;mFACmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,KAAK,CAAC,iBAAiB,CAAC,UACtB,sBAAsB,GAAG,SAAS,QACrC,WAAW,gBACF,eAAe,KAC5B,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrE,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,2BAA2B,CAwC3B,CAAC"}
+{"version":3,"file":"role-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/role-diff.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,mCAAmC,EACxC,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,kBAAkB,CAAC;AAM1B;mFACmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,KAAK,CAAC,iBAAiB,CAAC,UACtB,sBAAsB,GAAG,SAAS,QACrC,WAAW,gBACF,eAAe,KAC5B,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrE,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,2BAA2B,GAC3B,mCAAmC,CA0CnC,CAAC"}

package/dist/postgres/role-errors.d.ts

@@ -82,12 +82,9 @@ export declare class PostgresRoleCreateVanished extends PostgresRoleCreateVanish
 declare const PostgresRoleMembershipUnrepaired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "PostgresRoleMembershipUnrepaired";
 } & Readonly<A>;
-/** A `pg_auth_members` row survived reconcile in a shape the declaration does not allow — not
- * wanted, still `ADMIN`, or still `SET` at the upstream default TRUE. A live grantor's row is
- * named in `REVOKE … GRANTED BY`, which either binds or fails loudly; the one shape no
- * statement this family may issue can touch is a row whose grantor role was dropped
- * (`pg_auth_members` keeps it keyed on the dead oid, and no `GRANTED BY` name reaches it), so
- * the message asks the operator to revoke it by hand as a bootstrap superuser and re-plan. */
+/** An option repair was refused, or a catalog row survived outside the declaration. A null grantor is a
+ * defensive corruption/test case: PostgreSQL tracks grantor dependencies, so ordinary
+ * DROP ROLE does not leave a dangling grantor. Refuse instead of claiming convergence. */
 export declare class PostgresRoleMembershipUnrepaired extends PostgresRoleMembershipUnrepaired_base<{
     readonly role: string;
     readonly parent: string;
@@ -121,6 +118,15 @@ export declare class PostgresRoleIdentityRefused extends PostgresRoleIdentityRef
 }> {
     get message(): string;
 }
-export type PostgresRoleError = PostgresRoleNameRefused | PostgresRoleRenameRefused | PostgresRoleValidUntilRefused | PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused;
+declare const PostgresRolePasswordNonAsciiRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRolePasswordNonAsciiRefused";
+} & Readonly<A>;
+/** Never carry the rejected password in this error: errors reach logs and traces. */
+export declare class PostgresRolePasswordNonAsciiRefused extends PostgresRolePasswordNonAsciiRefused_base<{
+    readonly role: string;
+}> {
+    get message(): string;
+}
+export type PostgresRoleError = PostgresRolePasswordNonAsciiRefused | PostgresRoleNameRefused | PostgresRoleRenameRefused | PostgresRoleValidUntilRefused | PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused;
 export {};
 //# sourceMappingURL=role-errors.d.ts.map

package/dist/postgres/role-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/role-errors.ts"],"names":[],"mappings":";;;AAWA;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;iDAIiD;AACjD,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;yDAGyD;AACzD,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;yFAEyF;AACzF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;CAC9C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;uEAEuE;AACvE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;8FAK8F;AAC9F,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAY7B;CACF;;;;AAED;;sCAEsC;AACtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mDAEmD;AACnD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;AAED,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,CAAC"}
+{"version":3,"file":"role-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/role-errors.ts"],"names":[],"mappings":";;;AAYA;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;iDAIiD;AACjD,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;yDAGyD;AACzD,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;yFAEyF;AACzF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;CAC9C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;uEAEuE;AACvE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;0FAE0F;AAC1F,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAY7B;CACF;;;;AAED;;sCAEsC;AACtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mDAEmD;AACnD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mCAAoC,SAAQ,yCAEvD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;IAC1B,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,MAAM,MAAM,iBAAiB,GACzB,mCAAmC,GACnC,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,CAAC"}

package/dist/postgres/role-membership-sql.d.ts

@@ -11,8 +11,8 @@
  *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.
  * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's
  *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing
- *   (`revoke.sgml`). Every revoke here names `GRANTED BY`, so the statement either removes
- *   the row it targets or fails loudly — never a silent no-op.
+ *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still
+ *   produce only a warning; the catalog re-read below catches surviving unsafe rows.
  */
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import * as Effect from 'effect/Effect';
@@ -20,30 +20,40 @@ import type { PgExecutor } from './database-sql.ts';
 import { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './role-errors.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
 /** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made
- * the grant, and the two options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;
  * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null
- * when the granting role was later dropped — such a row can never be named in a `REVOKE …
- * GRANTED BY`, so it can only be repaired by hand as a bootstrap superuser. */
+ * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:
+ * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */
 export interface MembershipRow {
     readonly parent: string;
     readonly grantor: string | null;
     readonly admin: boolean;
     readonly set: boolean;
+    readonly inherit: boolean;
 }
 export declare const selectRoleMemberships: (pg: PgExecutor, name: string) => Effect.Effect<readonly MembershipRow[], SqlError>;
 /** Seat grants say `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE, and `SET ROLE` to the
  * parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB` are exercised (`user-manag.sgml`). */
 export declare const buildGrantMembershipSql: (member: string, parent: string) => string;
-/** Repair an existing membership in place: one atomic full-options `GRANT` per parent.
- * Upstream keeps any `WITH` option the new `GRANT` omits (`grant.sgml`), so a repair must
- * spell both bits — `ADMIN FALSE, SET FALSE` — rather than rely on `SET FALSE` alone. */
-export declare const buildRepairMembershipSql: (member: string, parent: string) => string;
+/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made
+ * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:
+ * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES
+ * https://www.postgresql.org/docs/16/sql-revoke.html
+ * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;
+ * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.
+ * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.
+ * GRANTED BY targets the observed row, including a different grantor's row. */
+export declare const buildRepairMembershipSql: (member: string, parent: string, grantor: string, option: 'ADMIN' | 'SET' | 'INHERIT') => string;
 /** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke
  * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */
 export declare const buildRevokeGrantorMembershipSql: (member: string, parent: string, grantor: string) => string;
-/** Catalog flags this family never declares. A create lands on the server default (all false);
- * an absent field on a seeded test row is that default. */
-export declare const unsafeMemberships: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => ReadonlySet<string>;
+/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.
+ * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */
+export declare const unsafeMemberships: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>, 
+/** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live
+ *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */
+inherit: boolean) => ReadonlySet<string>;
 /** Membership drift: sorted set difference between declared and live. Duplicates in the
  * declaration collapse to one; `undefined` means "not asserted" — nothing to grant or revoke.
  * A parent already granted `WITH ADMIN`, or with `SET` still at the upstream default TRUE, is
@@ -56,20 +66,13 @@ export declare const membershipDrift: (declared: readonly string[] | undefined,
  * missing role is `42704` (`user.c@REL_18_6`), and on a create that error arrives only after
  * `CREATE ROLE` has committed. */
 export declare const assertParentsExist: (pg: PgExecutor, role: string, parents: readonly string[] | undefined) => Effect.Effect<void, PostgresRoleParentMissing | SqlError>;
-/** Make live memberships equal the declaration, never dropping a membership the declaration
- * keeps. A wanted parent that is already granted is repaired with one
- * `GRANT … WITH ADMIN FALSE, SET FALSE` — `AddRoleMems` updates that grantor's row in place
- * (`user.c@REL_18_6` `SearchSysCache3` on role, member, grantor) — and any other grantor's
- * unsafe row is then revoked by name.
- *
- * 1. Rows the declaration does not want are revoked **by their own grantor** (dead-grantor
- *    rows are skipped and left for the backstop to report).
- * 2. Unsafe-but-wanted rows get one full-options repair `GRANT` per parent — atomic, in place,
- *    so the membership never drops even when another grantor's row also exists.
- * 3. A repair leaves other grantors' unsafe rows beside the safe one, so a mid re-read
- *    revokes every remaining unsafe row with a live grantor.
- * 4. Absent-but-wanted parents get a fresh seat grant.
- * 5. Backstop re-read: any row that is not wanted, or still unsafe, fails typed — including a
- *    dead-grantor row, which no statement this family may issue can repair. */
+/** Make live memberships equal the declaration, preserving wanted memberships in place.
+ * The previous full-options GRANT updated only its own grantor's row, then revoked other
+ * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).
+ * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows
+ * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).
+ * Each retained row's options share a transaction, attributing a dependency/permission
+ * refusal to that parent and grantor. No CASCADE and no replacement grantor row.
+ * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */
 export declare const syncMemberships: (pg: PgExecutor, props: PostgresRoleProps, rows: readonly MembershipRow[]) => Effect.Effect<readonly string[], SqlError | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing>;
 //# sourceMappingURL=role-membership-sql.d.ts.map

package/dist/postgres/role-membership-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-membership-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-membership-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;+EAI+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAaD,eAAO,MAAM,qBAAqB,OAC5B,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,QAAQ,CAC2B,CAAC;AAE/E;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,WAAY,MAAM,UAAU,MAAM,KAAG,MACF,CAAC;AAExE;;yFAEyF;AACzF,eAAO,MAAM,wBAAwB,WAAY,MAAM,UAAU,MAAM,KAAG,MACU,CAAC;AAErF;4EAC4E;AAC5E,eAAO,MAAM,+BAA+B,WAClC,MAAM,UACN,MAAM,WACL,MAAM,KACd,MAC0F,CAAC;AAE9F;2DAC2D;AAC3D,eAAO,MAAM,iBAAiB,SACtB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,WAAW,CAAC,MAAM,CAC6E,CAAC;AAEnG;;;6FAG6F;AAC7F,eAAO,MAAM,eAAe,aAChB,SAAS,MAAM,EAAE,GAAG,SAAS,QACjC,SAAS,MAAM,EAAE,WACf,WAAW,CAAC,MAAM,CAAC,KAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAW3E,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,WACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,QAAQ,CAQvD,CAAC;AAEL;;;;;;;;;;;;;;+EAc+E;AAC/E,eAAO,MAAM,eAAe,OACtB,UAAU,SACP,iBAAiB,QAClB,SAAS,aAAa,EAAE,KAC7B,MAAM,CAAC,MAAM,CACd,SAAS,MAAM,EAAE,EACjB,QAAQ,GAAG,gCAAgC,GAAG,yBAAyB,CA2DrE,CAAC"}
+{"version":3,"file":"role-membership-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-membership-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;;yFAKyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAcD,eAAO,MAAM,qBAAqB,OAC5B,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,QAAQ,CAC2B,CAAC;AAE/E;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,WAAY,MAAM,UAAU,MAAM,KAAG,MACF,CAAC;AAExE;;;;;;;+EAO+E;AAC/E,eAAO,MAAM,wBAAwB,WAC3B,MAAM,UACN,MAAM,WACL,MAAM,UACP,OAAO,GAAG,KAAK,GAAG,SAAS,KAClC,MACwH,CAAC;AAE5H;4EAC4E;AAC5E,eAAO,MAAM,+BAA+B,WAClC,MAAM,UACN,MAAM,WACL,MAAM,KACd,MAC0F,CAAC;AAE9F;kFACkF;AAClF,eAAO,MAAM,iBAAiB,SACtB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC;AAClD;kFACkF;SACzE,OAAO,KACf,WAAW,CAAC,MAAM,CAKlB,CAAC;AAEJ;;;6FAG6F;AAC7F,eAAO,MAAM,eAAe,aAChB,SAAS,MAAM,EAAE,GAAG,SAAS,QACjC,SAAS,MAAM,EAAE,WACf,WAAW,CAAC,MAAM,CAAC,KAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAW3E,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,WACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,QAAQ,CAQvD,CAAC;AAEL;;;;;;;6FAO6F;AAC7F,eAAO,MAAM,eAAe,OACtB,UAAU,SACP,iBAAiB,QAClB,SAAS,aAAa,EAAE,KAC7B,MAAM,CAAC,MAAM,CACd,SAAS,MAAM,EAAE,EACjB,QAAQ,GAAG,gCAAgC,GAAG,yBAAyB,CAuErE,CAAC"}

package/dist/postgres/role-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-provider.d.ts","sourceRoot":"","sources":["../../src/postgres/role-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzC,eAAO,MAAM,oBAAoB,4PAkF/B,CAAC;AAEH,eAAO,MAAM,oBAAoB,0HAA6D,CAAC"}
+{"version":3,"file":"role-provider.d.ts","sourceRoot":"","sources":["../../src/postgres/role-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzC,eAAO,MAAM,oBAAoB,4PAmF/B,CAAC;AAEH,eAAO,MAAM,oBAAoB,0HAA6D,CAAC"}

package/dist/postgres/role-scram.d.ts

@@ -1,6 +1,8 @@
 /**
  * `SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>` for one password. The salt is fresh per
  * call (same as `psql \password`); tests pass one to make the output deterministic.
+ * Callers first run `assertPasswordAscii`: raw non-ASCII may differ from PostgreSQL's
+ * SASLprep bytes (https://www.postgresql.org/docs/16/sasl-authentication.html).
  */
 export declare const scramSha256Verifier: (password: string, salt?: Buffer) => string;
 //# sourceMappingURL=role-scram.d.ts.map

package/dist/postgres/role-scram.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-scram.d.ts","sourceRoot":"","sources":["../../src/postgres/role-scram.ts"],"names":[],"mappings":"AA2BA;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAAc,MAAM,SAAS,MAAM,KAAG,MAMrE,CAAC"}
+{"version":3,"file":"role-scram.d.ts","sourceRoot":"","sources":["../../src/postgres/role-scram.ts"],"names":[],"mappings":"AA2BA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,aAAc,MAAM,SAAS,MAAM,KAAG,MAMrE,CAAC"}

package/dist/postgres/role-secrets.d.ts

@@ -11,6 +11,8 @@
  *   written — a plan never re-sends a secret that already matches, and never stores one.
  */
 import * as Redacted from 'effect/Redacted';
+import * as Effect from 'effect/Effect';
+import { PostgresRolePasswordNonAsciiRefused } from './role-errors.ts';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleProps } from './role-attrs.ts';
 /** What the environment holds for the declared password. `value` is `undefined` when no
@@ -20,6 +22,12 @@ export interface ResolvedPassword {
     readonly variable: string | undefined;
     readonly value: Redacted.Redacted<string> | undefined;
 }
+/** ⛔ PostgreSQL applies SASLprep before SCRAM, with a raw-byte fallback for prohibited input:
+ * https://www.postgresql.org/docs/16/sasl-authentication.html#SASL-SCRAM-SHA-256
+ * Non-ASCII can normalize to different bytes (e.g. soft hyphen disappears). Refuse before
+ * any write, even with a matching old seal, until we have a vendor-compatible normalizer.
+ * ASCII is unchanged, including prohibited ASCII controls via PostgreSQL's fallback. */
+export declare const assertPasswordAscii: (role: string, resolved: ResolvedPassword) => Effect.Effect<void, PostgresRolePasswordNonAsciiRefused>;
 export declare const resolvePassword: (props: PostgresRoleProps, env?: Environment) => ResolvedPassword;
 /** `seal({ password })` of the resolved value — the one thing state remembers about it. */
 export declare const sealPassword: (value: Redacted.Redacted<string>) => string;

package/dist/postgres/role-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-secrets.d.ts","sourceRoot":"","sources":["../../src/postgres/role-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;2FAE2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED,eAAO,MAAM,eAAe,UACnB,iBAAiB,QACnB,WAAW,KACf,gBAQF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAG,MACrB,CAAC;AAE5C;;iFAEiF;AACjF,eAAO,MAAM,mBAAmB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,KAAG,OAC7B,CAAC"}
+{"version":3,"file":"role-secrets.d.ts","sourceRoot":"","sources":["../../src/postgres/role-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;2FAE2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED;;;;wFAIwF;AACxF,eAAO,MAAM,mBAAmB,SACxB,MAAM,YACF,gBAAgB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAGzC,CAAC;AAElB,eAAO,MAAM,eAAe,UACnB,iBAAiB,QACnB,WAAW,KACf,gBAQF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAG,MACrB,CAAC;AAE5C;;iFAEiF;AACjF,eAAO,MAAM,mBAAmB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,KAAG,OAC7B,CAAC"}

package/dist/postgres/role-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,UAAU,OACjB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAI7F,CAAC;AAEJ;oGACoG;AACpG,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAW/E,CAAC;AAiBL,eAAO,MAAM,kBAAkB,UAAW,iBAAiB,KAAG,MACM,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,SACtB,MAAM,UAER;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KACxC,MAYF,CAAC;AAEF;;;;0BAI0B;AAC1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,YAAY,MAAM,KAAG,MACW,CAAC;AAEjF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAAmD,CAAC;AAEpG;sFACsF;AACtF,eAAO,MAAM,qBAAqB,UACzB,iBAAiB,YACd,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAMjB,CAAC;AAEF;2FAC2F;AAC3F,eAAO,MAAM,WAAW,UACf,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,aAAa,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAcvD,CAAC;AAEF;;wDAEwD;AACxD,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,OAcF,CAAC;AAEF;;;+CAG+C;AAC/C,eAAO,MAAM,gBAAgB,SACrB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAG7C,CAAC;AAEF;2DAC2D;AAC3D,eAAO,MAAM,eAAe,SACpB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,SAAS,MAAM,EAQjB,CAAC"}
+{"version":3,"file":"role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,UAAU,OACjB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAI7F,CAAC;AAEJ;oGACoG;AACpG,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAW/E,CAAC;AAiBL,eAAO,MAAM,kBAAkB,UAAW,iBAAiB,KAAG,MACM,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,SACtB,MAAM,UAER;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KACxC,MAYF,CAAC;AAEF;;;;0BAI0B;AAC1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,YAAY,MAAM,KAAG,MACW,CAAC;AAEjF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAAmD,CAAC;AAEpG;sFACsF;AACtF,eAAO,MAAM,qBAAqB,UACzB,iBAAiB,YACd,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAMjB,CAAC;AAEF;2FAC2F;AAC3F,eAAO,MAAM,WAAW,UACf,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,aAAa,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAcvD,CAAC;AAEF;;wDAEwD;AACxD,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,OAgBF,CAAC;AAEF;;;+CAG+C;AAC/C,eAAO,MAAM,gBAAgB,SACrB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAG7C,CAAC;AAEF;2DAC2D;AAC3D,eAAO,MAAM,eAAe,SACpB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,SAAS,MAAM,EAQjB,CAAC"}

package/dist/postgres/role.d.ts

@@ -31,7 +31,7 @@ import * as Effect from 'effect/Effect';
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
-import { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, type PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, type PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, PostgresRolePrivilegedRefused, PostgresRoleValidUntilRefused } from './role-errors.ts';
+import { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, type PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, type PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, type PostgresRolePasswordNonAsciiRefused, PostgresRolePrivilegedRefused, PostgresRoleValidUntilRefused } from './role-errors.ts';
 import { type PostgresConnection } from './connection.ts';
 import type { PgExecutor } from './database-sql.ts';
 export interface PostgresRole extends Resource<'Postgres.Role', PostgresRoleProps, PostgresRoleAttributes, never, PostgresConnection> {
@@ -47,7 +47,7 @@ export declare const isPostgresRole: (value: unknown) => value is PostgresRole;
  * being written for the first time — because `pg_roles` answers no password (S25), so the live
  * row cannot say whether the environment value still matches the one last written.
  */
-export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresRoleProps, env?: Environment, previousSeal?: string, storedOid?: number) => Effect.Effect<PostgresRoleAttributes, PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused | SqlError>;
+export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresRoleProps, env?: Environment, previousSeal?: string, storedOid?: number) => Effect.Effect<PostgresRoleAttributes, PostgresRolePasswordEnvUnsetError | PostgresRolePasswordNonAsciiRefused | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused | SqlError>;
 /** The core of `read`. Answers `undefined` when absent; ownership branding and the state-only
  * `passwordSeal` merge are the caller's. */
 export declare const readRole: (pg: PgExecutor, name: string) => Effect.Effect<Omit<PostgresRoleAttributes, "passwordSeal"> | undefined, SqlError, never>;

package/dist/postgres/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/postgres/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAcjF,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,iCAAiC,EACjC,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;iEACiE;AACjE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,YAGD,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,iBAAiB,QACnB,WAAW,qCAEJ,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,sBAAsB,EACpB,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,GAC3B,QAAQ,CAyFR,CAAC;AAEL;4CAC4C;AAC5C,eAAO,MAAM,QAAQ,OAAQ,UAAU,QAAQ,MAAM,6FAAiC,CAAC;AAEvF;gDACgD;AAChD,eAAO,MAAM,YAAY,UAChB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,6BAA6B,CAkB1E,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/postgres/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmBjF,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;iEACiE;AACjE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,YAGD,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,iBAAiB,QACnB,WAAW,qCAEJ,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,sBAAsB,EACpB,iCAAiC,GACjC,mCAAmC,GACnC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,GAC3B,QAAQ,CA0FR,CAAC;AAEL;4CAC4C;AAC5C,eAAO,MAAM,QAAQ,OAAQ,UAAU,QAAQ,MAAM,6FAAiC,CAAC;AAEvF;gDACgD;AAChD,eAAO,MAAM,YAAY,UAChB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,6BAA6B,CAkB1E,CAAC"}

package/docs/postgres-role.md

@@ -26,16 +26,26 @@ run yourself. The `Postgres.Database` resource in this kit already binds `@effec
   never re-sends a secret that already matches, and never stores one. A create that declares a
   password but whose variable is unset refuses before any write
   (`PostgresRolePasswordEnvUnsetError`), including the retry of a create whose password statement
-  never sealed.
+  never sealed. Non-ASCII passwords fail typed before writes (`PostgresRolePasswordNonAsciiRefused`):
+  PostgreSQL applies SASLprep, and this provider does not implement that normalization.
 - **Membership is `pg_auth_members`, compared as a sorted set.** `memberOf` omitted leaves live
   memberships alone; `[]` ensures none. Moves run through one-parent `GRANT`/`REVOKE`
   (`alter_role.sgml`: "there are no options for adding or removing memberships; use GRANT and
   REVOKE"). A plain `REVOKE` only removes the session grantor's row (`plan_single_revoke` matches
   `grantor`); each unwanted row is `REVOKE … GRANTED BY` its own grantor. A wanted row that is
-  `WITH ADMIN` or still `SET TRUE` is repaired in place with one
-  `GRANT … WITH ADMIN FALSE, SET FALSE` (`AddRoleMems` updates that grantor's tuple). Another
-  grantor's unsafe row is revoked by name afterwards. A row whose grantor role is gone cannot be
-  named and fails `PostgresRoleMembershipUnrepaired`. A missing parent fails
+  `WITH ADMIN`, still `SET TRUE`, or `INHERIT TRUE` when `inherit:false` is declared is repaired
+  with `REVOKE ADMIN/SET/INHERIT OPTION FOR … GRANTED BY … RESTRICT`. Unwanted-row revokes commit
+  first, then each retained row's options share a repair transaction. SQLSTATE 2BP01/42501 becomes
+  `PostgresRoleMembershipUnrepaired` naming that parent and grantor, preserving refused options
+  and dependent rows without rolling back unwanted-row revokes. No CASCADE is issued.
+  Option repair was measured once by hand on a throwaway PostgreSQL 17.11 (2026-10-02);
+  automated tests stub the 2BP01/42501 responses. Semantics: PostgreSQL
+  [16 GRANT](https://www.postgresql.org/docs/16/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/16/sql-revoke.html),
+  [17 GRANT](https://www.postgresql.org/docs/17/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/17/sql-revoke.html),
+  [18 GRANT](https://www.postgresql.org/docs/18/sql-grant.html) / [REVOKE](https://www.postgresql.org/docs/18/sql-revoke.html).
+  `buildRepairMembershipSql` now requires the grantor and option (`ADMIN`, `SET` or `INHERIT`).
+  A null grantor is a defensive inconsistent-catalog case, not an ordinary DROP ROLE outcome,
+  and fails `PostgresRoleMembershipUnrepaired`. A missing parent fails
   `PostgresRoleParentMissing` before any statement.
 - **`defaultRemovalPolicy: 'retain'`.** A seat group role may own objects and be granted across
   databases. A destroy is still implemented in full (`DROP ROLE IF EXISTS`, idempotent), opted in
@@ -47,7 +57,9 @@ run yourself. The `Postgres.Database` resource in this kit already binds `@effec
   says `WITH SET FALSE`. Create runs `CREATE`, the password `ALTER` and the seat `GRANT`s in one
   transaction, so a later statement failure does not leave a LOGIN role behind. `diff` reads
   `pg_auth_members` live — stored attributes omit the option rows, and the engine passes stored
-  attributes — so `ADMIN` or `SET TRUE` plans as `update`. A live oid that is not the stored oid
+  attributes — so unsafe `ADMIN`, `SET` or `INHERIT` plans as `update`. Privileged catalog flags also plan
+  `update`, reaching the typed reconcile refusal. `read` omits membership option rows just as
+  reconcile does, so an unchanged role does not report structural drift. A live oid that is not the stored oid
   is `PostgresRoleIdentityRefused` on read, diff, reconcile and delete: the name was recreated
   out of band and is not dropped or altered.
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.44.0",
+  "version": "0.45.0",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/ceph/ceph-argv.test.ts

@@ -208,7 +208,7 @@ describe('K-A4 finding 4: configValueProblem never accepts a flag-shaped value',
     ['a short flag', '-n'],
     ['a file-overwrite flag glued to its argument', '-o/etc/ceph/ceph.conf'],
     ['a long flag with =', '--admin-daemon=/var/run/ceph/ceph-mon.a.asok'],
-    ['another long flag', '--conf=/tmp/x'],
+    ['another long flag', '--conf=/tmp/x'], // tmp-allow: refused argv, not a directory this test creates
     ['the empty string', ''],
     ['a bare dash', '-'],
   ])('refuses %s (%j)', (_name, value) => {

package/src/launchd/sudo-allowlist.test.ts

@@ -15,7 +15,7 @@ import {
 } from './sudo-allowlist.ts';
 
 const DAEMONS = '/Library/LaunchDaemons';
-const context = { prefixes: [DAEMONS, '/opt/example'], staged: '/tmp/hf-sudo-x/staged' };
+const context = { prefixes: [DAEMONS, '/opt/example'], staged: '/tmp/hf-sudo-x/staged' }; // tmp-allow: in-memory staging path, not a directory this test creates
 const allowed = (argv: string[]) => privilegedProblem(argv, context);
 const PLIST = `${DAEMONS}/com.example.a.plist`;
 
@@ -66,7 +66,7 @@ describe('launchctl shapes', () => {
     ['bootstrap of two plists', [LAUNCHCTL, 'bootstrap', 'system', PLIST, PLIST]],
     [
       'bootstrap outside every prefix',
-      [LAUNCHCTL, 'bootstrap', 'system', '/tmp/com.example.a.plist'],
+      [LAUNCHCTL, 'bootstrap', 'system', '/tmp/com.example.a.plist'], // tmp-allow: refused argv, not a directory this test creates
     ],
     ['bootstrap of a non-plist', [LAUNCHCTL, 'bootstrap', 'system', `${DAEMONS}/com.example.a`]],
     // ★ Only where launchd loads daemons at boot: anywhere else is a job that vanishes on restart.

package/src/linux/sudo-allowlist.test.ts

@@ -22,7 +22,7 @@ import {
 } from './sudo-allowlist.ts';
 
 const PREFIXES = ['/etc/systemd/system', '/usr/local/bin'];
-const STAGED = '/tmp/hf-sudo-1/staged';
+const STAGED = '/tmp/hf-sudo-1/staged'; // tmp-allow: in-memory staging path, not a directory this test creates
 const TEMP = '/etc/systemd/system/.thing.service.hf-abcdef012345.tmp';
 const context: AllowContext = { prefixes: PREFIXES, staged: STAGED, temp: TEMP };
 const allowed = (argv: string[]) => privilegedProblem(argv, context);
@@ -51,7 +51,7 @@ describe('install shapes', () => {
       'a target that is not the derived temp',
       [INSTALL, '-m', '0644', '-T', '--', STAGED, '/etc/systemd/system/x.service'],
     ],
-    ['a temp outside every prefix', [INSTALL, '-m', '0644', '-T', '--', STAGED, '/tmp/x.tmp']],
+    ['a temp outside every prefix', [INSTALL, '-m', '0644', '-T', '--', STAGED, '/tmp/x.tmp']], // tmp-allow: refused argv, not a directory this test creates
     ['no -T', [INSTALL, '-m', '0644', '--', STAGED, TEMP]],
     ['a three-digit mode', [INSTALL, '-m', '644', '-T', '--', STAGED, TEMP]],
     ['-S (the Mac flag)', [INSTALL, '-S', '-m', '0644', '-T', '--', STAGED, TEMP]],
@@ -103,7 +103,7 @@ describe('mv and rm shapes', () => {
     ['mv without -T', [MV, '-f', '--', TEMP, '/etc/systemd/system/thing.service']],
     ['rm -r', [RM, '-rf', '--', TEMP]],
     ['rm without --', [RM, '-f', TEMP]],
-    ['rm outside every prefix', [RM, '-f', '--', '/tmp/x']],
+    ['rm outside every prefix', [RM, '-f', '--', '/tmp/x']], // tmp-allow: refused argv, not a directory this test creates
     ['sudo in argv', ['/usr/bin/sudo', '-n', RM, '-f', '--', TEMP]],
   ])('refuses %s', (_name, argv) => {
     expect(allowed(argv)).toBeString();

package/src/linux/sudo-runner.test.ts

@@ -52,7 +52,7 @@ describe('writeFileAtomic under a prefix', () => {
     for (const line of logs) expect(line.startsWith('homeflare/linux sudo -n ')).toBe(true);
     // No temp file left behind, and the staging directory is gone too.
     expect([...fake.files.keys()].some((path) => path.includes('.hf-'))).toBe(false);
-    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false);
+    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false); // tmp-allow: in-memory fake path from fake-sudo, not a directory this test creates
   });
 
   test('a failed mv removes the temp it just installed, then still throws', async () => {
@@ -68,7 +68,7 @@ describe('writeFileAtomic under a prefix', () => {
     expect(calls[2]?.at(-1)).toBe(calls[0]?.at(-1));
     expect(fake.files.has(DEST)).toBe(false);
     expect([...fake.files.keys()].some((path) => path.includes('.hf-'))).toBe(false);
-    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false);
+    expect([...fake.dirs.keys()].some((path) => path.startsWith('/tmp/hf-sudo-'))).toBe(false); // tmp-allow: in-memory fake path from fake-sudo, not a directory this test creates
   });
 
   // 🔴 Adversarial review, round 2: a failed CLEANUP rm after a failed mv used to be swallowed

package/src/postgres/fake-role-sql.ts

@@ -22,11 +22,14 @@ export interface FakeRoleState {
   /** Bare role names, backing the `roleExists` check the database family's owner probe uses. */
   readonly roleNames: Set<string>;
   readonly roleRows: Map<string, PostgresRoleAttributes>;
-  /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = dropped
+  /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = unresolvable
    * grantor); `GRANT`/`REVOKE` mutate it. */
   readonly memberships: Set<string>;
   /** Options a name-only compare would hide, keyed `member\0parent\0grantor`. */
-  readonly membershipOptions: Map<string, { readonly admin: boolean; readonly set: boolean }>;
+  readonly membershipOptions: Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >;
   /** Hands out the next `oid` a real cluster would assign. */
   nextOid(): number;
 }
@@ -106,6 +109,7 @@ export const applyRoleStatement = <A extends object>(
           grantor: parts[2] === undefined || parts[2] === '' ? null : (parts[2] as string),
           admin: options?.admin === true,
           set: options?.set === true,
+          inherit: options?.inherit === true,
         };
       })
       .sort(
@@ -165,17 +169,33 @@ export const applyRoleStatement = <A extends object>(
     // `grant.sgml` (REL_18_6): altering an existing membership retains every option the new
     // GRANT omits, so only the full-options form clears ADMIN; `WITH SET FALSE` alone keeps a
     // current ADMIN. A bare `GRANT` (never issued by this family) leaves options untouched.
-    const options = state.membershipOptions.get(key) ?? { admin: false, set: false };
+    const options = state.membershipOptions.get(key) ?? {
+      admin: false,
+      set: false,
+      inherit: state.roleRows.get(member)?.inherit ?? true,
+    };
     if (text.endsWith('WITH ADMIN FALSE, SET FALSE')) {
-      state.membershipOptions.delete(key);
+      state.membershipOptions.set(key, { ...options, admin: false, set: false });
     } else if (text.endsWith('WITH SET FALSE')) {
-      if (options.admin) state.membershipOptions.set(key, { admin: true, set: false });
-      else state.membershipOptions.delete(key);
+      state.membershipOptions.set(key, { ...options, set: false });
     }
     return Effect.succeed([] as unknown as ReadonlyArray<A>);
   }
 
   if (text.startsWith('REVOKE')) {
+    const option =
+      /^REVOKE (ADMIN|SET|INHERIT) OPTION FOR "((?:[^"]|"")*)" FROM "((?:[^"]|"")*)" GRANTED BY "((?:[^"]|"")*)" RESTRICT$/.exec(
+        text,
+      );
+    if (option !== null) {
+      const key = `${unquoteIdent(option[3] as string)}\0${unquoteIdent(option[2] as string)}\0${unquoteIdent(option[4] as string)}`;
+      const options = state.membershipOptions.get(key) ?? { admin: false, set: false };
+      const next = { ...options, [(option[1] as string).toLowerCase()]: false };
+      if (next.admin || next.set || next.inherit !== undefined)
+        state.membershipOptions.set(key, next);
+      else state.membershipOptions.delete(key);
+      return Effect.succeed([] as unknown as ReadonlyArray<A>);
+    }
     const granted =
       /^REVOKE "((?:[^"]|"")*)" FROM "((?:[^"]|"")*)" GRANTED BY "((?:[^"]|"")*)"$/.exec(text);
     if (granted !== null) {

package/src/postgres/fake-sql.ts

@@ -35,12 +35,14 @@ export interface FakeSql extends PgExecutor {
   readonly roleRows: Map<string, PostgresRoleAttributes>;
   /** `member\0parent\0grantor` triples backing `pg_auth_members` (a plain `pg_auth_members`
    * read, a grant, a revoke and a DROP ROLE cascade all go through `fake-role-sql.ts`);
-   * `GRANT`/`REVOKE` mutate it. An empty grantor segment is a grantor role that no longer
-   * exists. */
+   * `GRANT`/`REVOKE` mutate it. An empty grantor segment is an inconsistent catalog/test row. */
   readonly memberships: Set<string>;
   /** Options on a membership the name alone hides, keyed `member\0parent\0grantor`. Absent
-   * means neither ADMIN nor SET. */
-  readonly membershipOptions: Map<string, { readonly admin: boolean; readonly set: boolean }>;
+   * means neither ADMIN, SET nor an explicit per-grant INHERIT. */
+  readonly membershipOptions: Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >;
   /** Mutable on purpose: a test seeds a live schema (adoption, drift) or clears one (drop). */
   readonly schemas: Map<string, PostgresSchemaAttributes>;
   /** Mutable on purpose: names of schemas this fake pretends hold at least one relation, so a
@@ -85,7 +87,10 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
   const roleRows = new Map(options.roleRows?.map((r) => [r.name, r] as const) ?? []);
   const databases = new Map(options.databases?.map((d) => [d.name, d] as const) ?? []);
   const memberships = new Set<string>();
-  const membershipOptions = new Map<string, { readonly admin: boolean; readonly set: boolean }>();
+  const membershipOptions = new Map<
+    string,
+    { readonly admin: boolean; readonly set: boolean; readonly inherit?: boolean }
+  >();
   const schemas = seedSchemas(options.schemas, options.database ?? 'postgres');
   const relationsIn = new Set(options.schemasWithRelations ?? []);
   let raceRemaining = options.raceNextCreate === true ? 1 : 0;

package/src/postgres/index.ts

@@ -147,6 +147,7 @@ export {
   PostgresRoleNameRefused,
   PostgresRoleParentMissing,
   PostgresRolePasswordEnvUnsetError,
+  PostgresRolePasswordNonAsciiRefused,
   PostgresRolePrivilegedRefused,
   PostgresRoleRenameRefused,
   PostgresRoleValidUntilRefused,

package/src/postgres/role-attrs.ts

@@ -62,7 +62,8 @@ export interface PostgresRoleProps {
   readonly login: boolean;
   /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */
   readonly connectionLimit: number;
-  /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`. */
+  /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant
+   * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */
   readonly inherit: boolean;
   /**
    * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is
@@ -112,18 +113,20 @@ export interface PostgresRoleAttributes {
    */
   readonly memberOf: readonly string[] | null;
   /**
-   * The membership rows behind `memberOf`, including `admin_option` and `set_option`. Present
+   * The membership rows behind `memberOf`, including `admin_option`, `set_option` and
+   * `inherit_option`. Present
    * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the
    * engine's diff receives stored attributes and would never see them there. The provider's
    * diff reads these rows live. `grantor` is the role that made the grant
-   * (`pg_auth_members.grantor`), null when that role was dropped — a dropped-grantor row cannot
-   * be named in `REVOKE … GRANTED BY`, so reconcile can only fail typed on it.
+   * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary
+   * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.
    */
   readonly memberships?: readonly {
     readonly parent: string;
     readonly grantor: string | null;
     readonly admin: boolean;
     readonly set: boolean;
+    readonly inherit: boolean;
   }[];
   /**
    * A seal of the last password value written, or `''` if none was ever written (`seal()` from