@homeflare/alchemy 0.44.0 → 0.46.0

package/dist/postgres/fake-role-sql.d.ts

@@ -20,13 +20,14 @@ export interface FakeRoleState {
     /** Bare role names, backing the `roleExists` check the database family's owner probe uses. */
     readonly roleNames: Set<string>;
     readonly roleRows: Map<string, PostgresRoleAttributes>;
-    /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = dropped
+    /** `member\0parent\0grantor` triples backing `pg_auth_members` (`''` grantor = unresolvable
      * grantor); `GRANT`/`REVOKE` mutate it. */
     readonly memberships: Set<string>;
     /** Options a name-only compare would hide, keyed `member\0parent\0grantor`. */
     readonly membershipOptions: Map<string, {
         readonly admin: boolean;
         readonly set: boolean;
+        readonly inherit?: boolean;
     }>;
     /** Hands out the next `oid` a real cluster would assign. */
     nextOid(): number;

package/dist/postgres/fake-role-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAG9D;oDACoD;AACpD,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;+CAC2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F,4DAA4D;IAC5D,OAAO,IAAI,MAAM,CAAC;CACnB;AAuDD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,SAC1C,aAAa,QACd,MAAM,UACJ,aAAa,CAAC,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SA4H9C,CAAC"}
+{"version":3,"file":"fake-role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAG9D;oDACoD;AACpD,MAAM,WAAW,aAAa;IAC5B,8FAA8F;IAC9F,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;+CAC2C;IAC3C,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC,+EAA+E;IAC/E,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAC7B,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAC/E,CAAC;IACF,4DAA4D;IAC5D,OAAO,IAAI,MAAM,CAAC;CACnB;AAuDD;;;;GAIG;AACH,eAAO,MAAM,kBAAkB,GAAI,CAAC,SAAS,MAAM,SAC1C,aAAa,QACd,MAAM,UACJ,aAAa,CAAC,OAAO,CAAC,KAC7B,MAAM,CAAC,MAAM,CAAC,aAAa,CAAC,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,SA6I9C,CAAC"}

package/dist/postgres/fake-sql.d.ts

@@ -15,14 +15,14 @@ export interface FakeSql extends PgExecutor {
     readonly roleRows: Map<string, PostgresRoleAttributes>;
     /** `member\0parent\0grantor` triples backing `pg_auth_members` (a plain `pg_auth_members`
      * read, a grant, a revoke and a DROP ROLE cascade all go through `fake-role-sql.ts`);
-     * `GRANT`/`REVOKE` mutate it. An empty grantor segment is a grantor role that no longer
-     * exists. */
+     * `GRANT`/`REVOKE` mutate it. An empty grantor segment is an inconsistent catalog/test row. */
     readonly memberships: Set<string>;
     /** Options on a membership the name alone hides, keyed `member\0parent\0grantor`. Absent
-     * means neither ADMIN nor SET. */
+     * means neither ADMIN, SET nor an explicit per-grant INHERIT. */
     readonly membershipOptions: Map<string, {
         readonly admin: boolean;
         readonly set: boolean;
+        readonly inherit?: boolean;
     }>;
     /** Mutable on purpose: a test seeds a live schema (adoption, drift) or clears one (drop). */
     readonly schemas: Map<string, PostgresSchemaAttributes>;

package/dist/postgres/fake-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"fake-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5D,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;;;iBAGa;IACb,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC;sCACkC;IAClC,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAA;KAAE,CAAC,CAAC;IAC5F,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC1D;;mFAE+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD;8EAC0E;IAC1E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;iFAC6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;6EAEyE;IACzE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;yDAEqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,WAAW,aAAa,cAAc,KAAQ,OA4J1D,CAAC"}
+{"version":3,"file":"fake-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/fake-sql.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,0BAA0B,EAAE,MAAM,qBAAqB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAIpD,OAAO,KAAK,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AAC9D,OAAO,KAAK,EAAE,wBAAwB,EAAE,MAAM,mBAAmB,CAAC;AAElE,MAAM,WAAW,iBAAiB;IAChC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,aAAa,CAAC,OAAO,CAAC,CAAC;CACzC;AAED,MAAM,WAAW,OAAQ,SAAQ,UAAU;IACzC,QAAQ,CAAC,UAAU,EAAE,aAAa,CAAC,iBAAiB,CAAC,CAAC;IACtD;0DACsD;IACtD,QAAQ,CAAC,SAAS,EAAE,GAAG,CAAC,MAAM,EAAE,0BAA0B,CAAC,CAAC;IAC5D,2FAA2F;IAC3F,QAAQ,CAAC,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;IACvD;;mGAE+F;IAC/F,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;IAClC;qEACiE;IACjE,QAAQ,CAAC,iBAAiB,EAAE,GAAG,CAC7B,MAAM,EACN;QAAE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAC/E,CAAC;IACF,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,GAAG,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IACxD;gEAC4D;IAC5D,QAAQ,CAAC,WAAW,EAAE,GAAG,CAAC,MAAM,CAAC,CAAC;CACnC;AAED,MAAM,WAAW,cAAc;IAC7B,QAAQ,CAAC,yBAAyB,CAAC,EAAE,OAAO,CAAC;IAC7C,QAAQ,CAAC,KAAK,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACvC,QAAQ,CAAC,SAAS,CAAC,EAAE,aAAa,CAAC,0BAA0B,CAAC,CAAC;IAC/D,QAAQ,CAAC,QAAQ,CAAC,EAAE,aAAa,CAAC,sBAAsB,CAAC,CAAC;IAC1D;;mFAE+E;IAC/E,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC;2EACuE;IACvE,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,aAAa,CAAC,wBAAwB,CAAC,CAAC;IAC3D,0EAA0E;IAC1E,QAAQ,CAAC,oBAAoB,CAAC,EAAE,aAAa,CAAC,MAAM,CAAC,CAAC;IACtD;8EAC0E;IAC1E,QAAQ,CAAC,uBAAuB,CAAC,EAAE,OAAO,CAAC;IAC3C;iFAC6E;IAC7E,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAC3B;;6EAEyE;IACzE,QAAQ,CAAC,oBAAoB,CAAC,EAAE,MAAM,CAAC;IACvC;;yDAEqD;IACrD,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;CAC/B;AAED,eAAO,MAAM,WAAW,aAAa,cAAc,KAAQ,OA+J1D,CAAC"}

package/dist/postgres/index.d.ts

@@ -38,6 +38,6 @@ export { PostgresRoleProvider } from './role-provider.ts';
 export { resolvePassword } from './role-secrets.ts';
 export type { ResolvedPassword } from './role-secrets.ts';
 export type { FromEnv } from '../secrets/write-only.ts';
-export { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, PostgresRolePrivilegedRefused, PostgresRoleRenameRefused, PostgresRoleValidUntilRefused, type PostgresRoleError, } from './role-errors.ts';
+export { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, PostgresRolePasswordNonAsciiRefused, PostgresRolePrivilegedRefused, PostgresRoleRenameRefused, PostgresRoleValidUntilRefused, type PostgresRoleError, } from './role-errors.ts';
 export { postgresProviders, postgresRoleProviders, postgresRoleRunnerProviders, postgresRunnerProviders, } from './providers.ts';
 //# sourceMappingURL=index.d.ts.map

package/dist/postgres/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/postgres/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,YAAY,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,MAAM,GACP,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/F,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,aAAa,EACb,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,6BAA6B,EAC7B,kCAAkC,EAClC,mBAAmB,EACnB,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/postgres/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,YAAY,EAAE,wBAAwB,EAAE,oBAAoB,EAAE,MAAM,iBAAiB,CAAC;AACtF,OAAO,EACL,kBAAkB,EAClB,kBAAkB,EAClB,wBAAwB,EACxB,MAAM,GACP,MAAM,iBAAiB,CAAC;AACzB,YAAY,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,YAAY,EAAE,gBAAgB,EAAE,MAAM,oBAAoB,CAAC;AACpE,YAAY,EAAE,0BAA0B,EAAE,qBAAqB,EAAE,MAAM,qBAAqB,CAAC;AAC7F,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAC/F,OAAO,EACL,sBAAsB,EACtB,cAAc,EACd,UAAU,EACV,uBAAuB,EACvB,UAAU,EACV,kBAAkB,EAClB,UAAU,EACV,cAAc,GACf,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,kBAAkB,EAAE,MAAM,eAAe,CAAC;AAC/F,YAAY,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EAAE,iBAAiB,EAAE,qBAAqB,EAAE,MAAM,mBAAmB,CAAC;AAC7E,OAAO,EACL,qBAAqB,EACrB,oBAAoB,EACpB,kBAAkB,EAClB,eAAe,EACf,WAAW,EACX,uBAAuB,EACvB,aAAa,EACb,YAAY,GACb,MAAM,iBAAiB,CAAC;AACzB,OAAO,EACL,cAAc,EACd,sBAAsB,EACtB,kBAAkB,EAClB,gBAAgB,GACjB,MAAM,aAAa,CAAC;AACrB,OAAO,EACL,4BAA4B,EAC5B,2BAA2B,EAC3B,6BAA6B,EAC7B,6BAA6B,EAC7B,kCAAkC,EAClC,mBAAmB,EACnB,+BAA+B,EAC/B,yBAAyB,EACzB,0BAA0B,EAC1B,2BAA2B,EAC3B,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,OAAO,EACL,qBAAqB,EACrB,2BAA2B,EAC3B,2BAA2B,EAC3B,4BAA4B,EAC5B,6BAA6B,EAC7B,KAAK,qBAAqB,GAC3B,MAAM,aAAa,CAAC;AACrB,YAAY,EACV,wBAAwB,EACxB,8BAA8B,EAC9B,+BAA+B,EAC/B,6BAA6B,EAC7B,oBAAoB,EACpB,qBAAqB,EACrB,mBAAmB,EACnB,mBAAmB,GACpB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,iBAAiB,EACjB,iBAAiB,EACjB,gBAAgB,EAChB,qBAAqB,EACrB,kBAAkB,GACnB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,cAAc,EACd,eAAe,EACf,cAAc,EACd,aAAa,EACb,eAAe,EACf,gBAAgB,EAChB,qBAAqB,EACrB,qBAAqB,EACrB,eAAe,EACf,cAAc,GACf,MAAM,iBAAiB,CAAC;AACzB,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,gBAAgB,EAAE,MAAM,aAAa,CAAC;AACvF,OAAO,EACL,8BAA8B,EAC9B,6BAA6B,EAC7B,6BAA6B,EAC7B,yBAAyB,EACzB,8BAA8B,EAC9B,2BAA2B,EAC3B,6BAA6B,EAC7B,yBAAyB,EACzB,2BAA2B,EAC3B,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,mBAAmB,GACzB,MAAM,oBAAoB,CAAC;AAC5B,YAAY,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EAAE,cAAc,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACpE,OAAO,EACL,iBAAiB,EACjB,kBAAkB,EAClB,gBAAgB,EAChB,mBAAmB,EACnB,WAAW,EACX,UAAU,GACX,MAAM,eAAe,CAAC;AACvB,OAAO,EACL,uBAAuB,EACvB,wBAAwB,EACxB,+BAA+B,EAC/B,eAAe,EACf,qBAAqB,EACrB,eAAe,EACf,iBAAiB,GAClB,MAAM,0BAA0B,CAAC;AAClC,YAAY,EAAE,aAAa,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,YAAY,EAAE,cAAc,EAAE,MAAM,WAAW,CAAC;AACzD,OAAO,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AAC1D,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,YAAY,EAAE,gBAAgB,EAAE,MAAM,mBAAmB,CAAC;AAC1D,YAAY,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,gCAAgC,EAChC,uBAAuB,EACvB,yBAAyB,EACzB,iCAAiC,EACjC,mCAAmC,EACnC,6BAA6B,EAC7B,yBAAyB,EACzB,6BAA6B,EAC7B,KAAK,iBAAiB,GACvB,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,2BAA2B,EAC3B,uBAAuB,GACxB,MAAM,gBAAgB,CAAC"}

package/dist/postgres/index.js

@@ -1481,8 +1481,8 @@ class PostgresRoleCreateVanished extends Data4.TaggedError("PostgresRoleCreateVa
 
 class PostgresRoleMembershipUnrepaired extends Data4.TaggedError("PostgresRoleMembershipUnrepaired") {
   get message() {
-    const who = this.grantor === null ? "a grantor role that no longer exists" : `grantor "${this.grantor}"`;
-    return `Postgres.Role "${this.role}": membership of "${this.parent}" ` + `(${this.declared ? "declared, options unsafe" : "not declared"}) could not be repaired ` + `after its statements — the row still stands under ${who}. pg_auth_members keys a ` + "membership on (parent, member, grantor), and a grantor that no longer exists cannot be " + "named in REVOKE … GRANTED BY. Revoke the row by hand as a bootstrap superuser " + "(`REVOKE role FROM member GRANTED BY <grantor>`; a grantor oid with no role name needs " + "catalog surgery) and re-plan.";
+    const who = this.grantor === null ? "an unresolvable grantor (inconsistent catalog)" : `grantor "${this.grantor}"`;
+    return `Postgres.Role "${this.role}": membership of "${this.parent}" ` + `(${this.declared ? "declared, options unsafe" : "not declared"}) could not be repaired ` + `under ${who}. The server refused the repair or the catalog re-read still found the row ` + "outside the declaration. pg_auth_members keys a membership on (parent, member, grantor). " + "Check dependent grants, executor permissions and grantor identity before re-planning.";
   }
 }
 
@@ -1498,11 +1498,18 @@ class PostgresRoleIdentityRefused extends Data4.TaggedError("PostgresRoleIdentit
   }
 }
 
+class PostgresRolePasswordNonAsciiRefused extends Data4.TaggedError("PostgresRolePasswordNonAsciiRefused") {
+  get message() {
+    return `Postgres.Role "${this.role}": password must be ASCII; this provider does not implement PostgreSQL SASLprep normalization. Nothing was written.`;
+  }
+}
+
 // src/postgres/role-membership-sql.ts
 var MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
     grantor.rolname AS grantor,
     m.admin_option AS admin,
-    m.set_option AS set
+    m.set_option AS set,
+    m.inherit_option AS inherit
   FROM pg_auth_members m
   JOIN pg_roles member ON member.oid = m.member
   JOIN pg_roles parent ON parent.oid = m.roleid
@@ -1511,9 +1518,9 @@ var MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
   ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;
 var selectRoleMemberships = (pg, name) => Effect18.map(pg.unsafe(MEMBERSHIP_SQL, [name]), (rows) => rows);
 var buildGrantMembershipSql = (member, parent) => `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;
-var buildRepairMembershipSql = (member, parent) => `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH ADMIN FALSE, SET FALSE`;
+var buildRepairMembershipSql = (member, parent, grantor, option) => `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;
 var buildRevokeGrantorMembershipSql = (member, parent, grantor) => `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;
-var unsafeMemberships = (live) => new Set((live.memberships ?? []).filter((row) => row.admin || row.set).map((row) => row.parent));
+var unsafeMemberships = (live, inherit) => new Set((live.memberships ?? []).filter((row) => row.admin || row.set || row.inherit && !inherit).map((row) => row.parent));
 var membershipDrift = (declared, live, unsafe = new Set) => {
   if (declared === undefined)
     return { grants: [], revokes: [] };
@@ -1542,30 +1549,41 @@ var syncMemberships = (pg, props, rows) => Effect18.gen(function* () {
   }
   yield* assertParentsExist(pg, props.name, props.memberOf);
   const wanted = [...new Set(props.memberOf)].sort();
+  const revokes = [];
   for (const row of rows) {
-    if (wanted.includes(row.parent) || row.grantor === null)
-      continue;
-    yield* pg.unsafe(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor)).pipe(Effect18.asVoid);
+    if (!wanted.includes(row.parent) && row.grantor !== null) {
+      revokes.push(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor));
+    }
   }
-  const repaired = [
-    ...new Set(rows.filter((row) => wanted.includes(row.parent) && (row.admin || row.set) && row.grantor !== null).map((row) => row.parent))
-  ];
-  for (const parent of repaired) {
-    yield* pg.unsafe(buildRepairMembershipSql(props.name, parent)).pipe(Effect18.asVoid);
-  }
-  if (repaired.length > 0) {
-    const midRead = yield* selectRoleMemberships(pg, props.name);
-    for (const row of midRead) {
-      if (wanted.includes(row.parent) && (row.admin || row.set) && row.grantor !== null) {
-        yield* pg.unsafe(buildRevokeGrantorMembershipSql(props.name, row.parent, row.grantor)).pipe(Effect18.asVoid);
+  if (revokes.length > 0)
+    yield* pg.transaction(revokes);
+  for (const row of rows) {
+    if (row.grantor === null || !wanted.includes(row.parent))
+      continue;
+    const statements = [];
+    for (const option of ["ADMIN", "SET", "INHERIT"]) {
+      const unsafe = option === "ADMIN" ? row.admin : option === "SET" ? row.set : row.inherit && !props.inherit;
+      if (unsafe) {
+        statements.push(buildRepairMembershipSql(props.name, row.parent, row.grantor, option));
       }
     }
+    if (statements.length > 0)
+      yield* pg.transaction(statements).pipe(Effect18.catchTag("SqlError", (error) => {
+        const cause = error.reason.cause;
+        const code = typeof cause === "object" && cause !== null ? cause.code : undefined;
+        return Effect18.fail(code === "2BP01" || code === "42501" ? new PostgresRoleMembershipUnrepaired({
+          role: props.name,
+          parent: row.parent,
+          grantor: row.grantor,
+          declared: true
+        }) : error);
+      }));
   }
-  for (const parent of wanted.filter((p) => !rows.some((row) => row.parent === p))) {
-    yield* pg.unsafe(buildGrantMembershipSql(props.name, parent)).pipe(Effect18.asVoid);
-  }
+  const grants = wanted.filter((p) => !rows.some((row) => row.parent === p)).map((parent) => buildGrantMembershipSql(props.name, parent));
+  if (grants.length > 0)
+    yield* pg.transaction(grants);
   for (const row of yield* selectRoleMemberships(pg, props.name)) {
-    if (!wanted.includes(row.parent) || row.admin || row.set) {
+    if (!wanted.includes(row.parent) || row.admin || row.set || row.inherit && !props.inherit) {
       return yield* Effect18.fail(new PostgresRoleMembershipUnrepaired({
         role: props.name,
         parent: row.parent,
@@ -1652,7 +1670,7 @@ var scalarDrift = (props, live) => {
 var declarationMatches = (props, live) => {
   const wanted = props.memberOf === undefined ? undefined : [...new Set(props.memberOf)].sort().join("\x00");
   const found = [...live.memberOf ?? []].sort().join("\x00");
-  return props.name === live.name && props.login === live.login && props.inherit === live.inherit && props.connectionLimit === live.connectionLimit && (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) && (wanted === undefined || wanted === found) && privilegedFlags(live).length === 0 && (live.memberships ?? []).every((row) => !row.admin && !row.set);
+  return props.name === live.name && props.login === live.login && props.inherit === live.inherit && props.connectionLimit === live.connectionLimit && (props.validUntil === undefined || sameValidUntil(props.validUntil, live.validUntil)) && (wanted === undefined || wanted === found) && privilegedFlags(live).length === 0 && (live.memberships ?? []).every((row) => !row.admin && !row.set && (!row.inherit || props.inherit));
 };
 var storedAttributes = (live) => {
   const { memberships: _observeOnly, ...stored } = live;
@@ -1674,11 +1692,12 @@ var privilegedFlags = (live) => {
 };
 // src/postgres/role.ts
 import { Resource as Resource4 } from "alchemy";
-import * as Effect20 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 import * as Redacted2 from "effect/Redacted";
 
 // src/postgres/role-secrets.ts
 import * as Redacted from "effect/Redacted";
+import * as Effect20 from "effect/Effect";
 
 // src/secrets/write-only.ts
 import { Buffer } from "node:buffer";
@@ -1718,6 +1737,7 @@ var sealMatches = (sealed, values) => {
 };
 
 // src/postgres/role-secrets.ts
+var assertPasswordAscii = (role, resolved) => resolved.value !== undefined && /[\u0080-\uffff]/.test(Redacted.value(resolved.value)) ? Effect20.fail(new PostgresRolePasswordNonAsciiRefused({ role })) : Effect20.void;
 var resolvePassword = (props, env = process.env) => {
   if (props.password === undefined)
     return { variable: undefined, value: undefined };
@@ -1751,19 +1771,20 @@ var PostgresRole = Resource4("Postgres.Role", {
   defaultRemovalPolicy: "retain"
 });
 var isPostgresRole = (value3) => (typeof value3 === "object" || typeof value3 === "function") && value3 !== null && value3.Type === "Postgres.Role";
-var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", storedOid) => Effect20.gen(function* () {
+var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", storedOid) => Effect21.gen(function* () {
   const resolved = resolvePassword(props, env);
+  yield* assertPasswordAscii(props.name, resolved);
   const observed = yield* readRoleWithClient(pg, props.name);
   if (observed === undefined) {
     if (resolved.variable !== undefined && resolved.value === undefined) {
-      return yield* Effect20.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+      return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
     }
     yield* assertParentsExist(pg, props.name, props.memberOf);
     const verifier = resolved.value === undefined ? undefined : scramSha256Verifier(Redacted2.value(resolved.value));
     yield* pg.transaction(buildCreateStatements(props, verifier));
     const created = yield* readRoleWithClient(pg, props.name);
     if (created === undefined) {
-      return yield* Effect20.fail(new PostgresRoleCreateVanished({ role: props.name }));
+      return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
     }
     return {
       ...storedAttributes(created),
@@ -1771,7 +1792,7 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
     };
   }
   if (storedOid !== undefined && observed.oid !== storedOid) {
-    return yield* Effect20.fail(new PostgresRoleIdentityRefused({
+    return yield* Effect21.fail(new PostgresRoleIdentityRefused({
       role: props.name,
       storedOid,
       liveOid: observed.oid
@@ -1779,23 +1800,23 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
   }
   const flags = privilegedFlags(observed);
   if (flags.length > 0) {
-    return yield* Effect20.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));
+    return yield* Effect21.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));
   }
   if (resolved.variable !== undefined && resolved.value === undefined && previousSeal === "") {
-    return yield* Effect20.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+    return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
   }
   yield* assertParentsExist(pg, props.name, props.memberOf);
   for (const change of scalarDrift(props, observed)) {
-    yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect20.asVoid);
+    yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect21.asVoid);
   }
   const passwordMatched = resolved.value !== undefined && passwordMatchesSeal(resolved.value, previousSeal);
   if (resolved.value !== undefined && !passwordMatched) {
-    yield* pg.unsafe(buildSetPasswordSql(props.name, scramSha256Verifier(Redacted2.value(resolved.value)))).pipe(Effect20.asVoid);
+    yield* pg.unsafe(buildSetPasswordSql(props.name, scramSha256Verifier(Redacted2.value(resolved.value)))).pipe(Effect21.asVoid);
   }
   yield* syncMemberships(pg, props, observed.memberships ?? []);
   const after = yield* readRoleWithClient(pg, props.name);
   if (after === undefined) {
-    return yield* Effect20.fail(new PostgresRoleCreateVanished({ role: props.name }));
+    return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
   }
   return {
     ...storedAttributes(after),
@@ -1803,15 +1824,15 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
   };
 });
 var readRole = (pg, name) => readRoleWithClient(pg, name);
-var refuseAtPlan = (props) => Effect20.gen(function* () {
+var refuseAtPlan = (props) => Effect21.gen(function* () {
   const nameRefusal = nameByteRefusal(props.name);
   if (nameRefusal !== undefined) {
-    return yield* Effect20.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));
+    return yield* Effect21.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));
   }
   if (props.validUntil !== undefined) {
     const untilRefusal = validUntilRefusal(props.validUntil);
     if (untilRefusal !== undefined) {
-      return yield* Effect20.fail(new PostgresRoleValidUntilRefused({
+      return yield* Effect21.fail(new PostgresRoleValidUntilRefused({
         role: props.name,
         value: props.validUntil,
         reason: untilRefusal.reason
@@ -1822,21 +1843,21 @@ var refuseAtPlan = (props) => Effect20.gen(function* () {
 // src/postgres/role-provider.ts
 import * as Provider4 from "alchemy/Provider";
 import { isResolved as isResolved5 } from "alchemy/Diff";
-import * as Effect27 from "effect/Effect";
+import * as Effect28 from "effect/Effect";
 
 // src/ownership/probe.ts
 import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
-import * as Effect23 from "effect/Effect";
+import * as Effect24 from "effect/Effect";
 
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect22 from "effect/Effect";
+import * as Effect23 from "effect/Effect";
 import * as Option2 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect21 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 import * as Option from "effect/Option";
 var absent = (value3) => value3 === undefined || value3 === null;
 var isPlainObject = (value3) => {
@@ -1862,22 +1883,22 @@ var carries = (declared, recorded) => {
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect21.map(Effect21.serviceOption(Stack), (stack) => {
+var wholeDeclaration = (fqn, props) => Effect22.map(Effect22.serviceOption(Stack), (stack) => {
   const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect22.gen(function* () {
-  const stack = yield* Effect22.serviceOption(Stack2);
-  const state = yield* Effect22.serviceOption(State);
+var storeOf = Effect23.gen(function* () {
+  const stack = yield* Effect23.serviceOption(Stack2);
+  const state = yield* Effect23.serviceOption(State);
   if (Option2.isNone(stack) || Option2.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect22.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect23.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -1890,7 +1911,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect22.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect23.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1901,20 +1922,20 @@ var recordedGeneration = (fqn, instanceId) => Effect22.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect22.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect23.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect22.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var isCreate = (fqn, instanceId) => Effect23.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
 var idOf = (attr) => {
   if (typeof attr !== "object" || attr === null)
     return;
   const id = attr.id;
   return typeof id === "string" && id !== "" ? id : undefined;
 };
-var olderGenerationIds = (fqn, instanceId) => Effect22.gen(function* () {
+var olderGenerationIds = (fqn, instanceId) => Effect23.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return [];
@@ -1942,7 +1963,7 @@ var collectOlder = (row, instanceId, ids) => {
     at = generation.old;
   }
 };
-var forgetRefusedCreate = (fqn, instanceId) => Effect22.gen(function* () {
+var forgetRefusedCreate = (fqn, instanceId) => Effect23.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1951,22 +1972,22 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect22.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect22.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect23.ignore);
 });
 
 // src/ownership/probe.ts
-var provenOurs = (ask, settled) => Effect23.gen(function* () {
+var provenOurs = (ask, settled) => Effect24.gen(function* () {
   const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
   if (recorded === "absent")
     return false;
   if (recorded === "partial") {
-    yield* Effect23.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    yield* Effect24.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
     return false;
   }
-  const unproven = (reason) => Effect23.as(Effect23.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
-  return yield* settled.pipe(Effect23.catch(unproven), Effect23.catchDefect(unproven));
+  const unproven = (reason) => Effect24.as(Effect24.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
 });
-var ownedRead = (ask, found, settled) => Effect23.gen(function* () {
+var ownedRead = (ask, found, settled) => Effect24.gen(function* () {
   if (found === undefined || ask.output !== undefined)
     return found;
   return (yield* provenOurs(ask, settled)) ? found : Unowned4(found);
@@ -1975,26 +1996,26 @@ var ownedRead = (ask, found, settled) => Effect23.gen(function* () {
 // src/ownership/resume.ts
 import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
 import { Artifacts } from "alchemy/Artifacts";
-import * as Effect24 from "effect/Effect";
+import * as Effect25 from "effect/Effect";
 import * as Option3 from "effect/Option";
 var PROVEN = "homeflare/ownership/resumes";
 var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect24.gen(function* () {
-  const bag = yield* Effect24.serviceOption(Artifacts);
+var note = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
   if (Option3.isSome(bag))
     yield* bag.value.set(key, instanceId);
 });
-var noted = (key, instanceId) => Effect24.gen(function* () {
-  const bag = yield* Effect24.serviceOption(Artifacts);
+var noted = (key, instanceId) => Effect25.gen(function* () {
+  const bag = yield* Effect25.serviceOption(Artifacts);
   if (Option3.isNone(bag))
     return false;
   return (yield* bag.value.get(key)) === instanceId;
 });
-var noteUnfinished = (instanceId) => Effect24.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect24.gen(function* () {
+var noteUnfinished = (instanceId) => Effect25.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect25.gen(function* () {
   yield* noteUnfinished(instanceId);
-  const unproven = () => Effect24.succeed(undefined);
-  const found = yield* recovered.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
+  const unproven = () => Effect25.succeed(undefined);
+  const found = yield* recovered.pipe(Effect25.catch(unproven), Effect25.catchDefect(unproven));
   if (found === undefined || found === null || Unowned5.is(found))
     return;
   yield* note(PROVEN, instanceId);
@@ -2005,7 +2026,7 @@ var provingResumes = (service) => {
   const { diff, read } = service;
   if (diff === undefined || read === undefined)
     return service;
-  const proving = (input) => Effect24.gen(function* () {
+  const proving = (input) => Effect25.gen(function* () {
     if (input.output === undefined) {
       yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
     }
@@ -2018,30 +2039,30 @@ var provingResumes = (service) => {
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect25 from "effect/Effect";
+import * as Effect26 from "effect/Effect";
 import * as Option4 from "effect/Option";
-var adoptEnabled = (fqn) => Effect25.gen(function* () {
-  const stack = yield* Effect25.serviceOption(Stack3);
+var adoptEnabled = (fqn) => Effect26.gen(function* () {
+  const stack = yield* Effect26.serviceOption(Stack3);
   const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
   if (scoped !== undefined)
     return scoped;
-  const policy = yield* Effect25.serviceOption(AdoptPolicy);
+  const policy = yield* Effect26.serviceOption(AdoptPolicy);
   if (Option4.isSome(policy))
     return policy.value;
-  const context = yield* Effect25.serviceOption(AlchemyContext);
+  const context = yield* Effect26.serviceOption(AlchemyContext);
   return Option4.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect25.gen(function* () {
+var adoptable = (owner) => Effect26.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect25.gen(function* () {
+var adoptsAtApply = (owner) => Effect26.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect25.gen(function* () {
+var refuseTakeover = (owner, what) => Effect26.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -2051,23 +2072,23 @@ var refuseTakeover = (owner, what) => Effect25.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect25.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect26.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/postgres/role-diff.ts
 import { isResolved as isResolved4 } from "alchemy/Diff";
-import * as Effect26 from "effect/Effect";
-var diffPostgresRole = (news, output, env = process.env, observation) => Effect26.gen(function* () {
+import * as Effect27 from "effect/Effect";
+var diffPostgresRole = (news, output, env = process.env, observation) => Effect27.gen(function* () {
   if (output === undefined || !isResolved4(news))
     return;
   if (news.name !== output.name) {
-    return yield* Effect26.fail(new PostgresRoleRenameRefused({ from: output.name, to: news.name }));
+    return yield* Effect27.fail(new PostgresRoleRenameRefused({ from: output.name, to: news.name }));
   }
   yield* refuseAtPlan(news);
   const live = observation?.found;
   if (live !== undefined && live.oid !== output.oid) {
-    return yield* Effect26.fail(new PostgresRoleIdentityRefused({
+    return yield* Effect27.fail(new PostgresRoleIdentityRefused({
       role: output.name,
       storedOid: output.oid,
       liveOid: live.oid
@@ -2075,35 +2096,36 @@ var diffPostgresRole = (news, output, env = process.env, observation) => Effect2
   }
   const compared = live ?? output;
   const scalars = scalarDrift(news, compared);
-  const membership = membershipDrift(news.memberOf, compared.memberOf ?? [], live === undefined ? new Set : unsafeMemberships(live));
+  const membership = membershipDrift(news.memberOf, compared.memberOf ?? [], live === undefined ? new Set : unsafeMemberships(live, news.inherit));
   const resolved = resolvePassword(news, env);
+  yield* assertPasswordAscii(news.name, resolved);
   const passwordStale = resolved.value !== undefined && !passwordMatchesSeal(resolved.value, output.passwordSeal);
   const absent2 = observation !== undefined && live === undefined;
-  const changed = absent2 || scalars.length > 0 || membership.grants.length > 0 || membership.revokes.length > 0 || passwordStale;
+  const changed = absent2 || privilegedFlags(compared).length > 0 || scalars.length > 0 || membership.grants.length > 0 || membership.revokes.length > 0 || passwordStale;
   return changed ? { action: "update" } : { action: "noop" };
 });
 
 // src/postgres/role-provider.ts
 var postgresRoleHandlers = PostgresRole.Provider.of({
-  list: () => Effect27.succeed([]),
+  list: () => Effect28.succeed([]),
   nuke: { skip: true },
-  read: ({ fqn, instanceId, olds, output }) => Effect27.gen(function* () {
+  read: ({ fqn, instanceId, olds, output }) => Effect28.gen(function* () {
     const name = output?.name ?? olds.name;
     const live = yield* withPg((pg) => readRole(pg, name));
     if (live === undefined)
       return;
     if (output !== undefined && live.oid !== output.oid) {
-      return yield* Effect27.fail(new PostgresRoleIdentityRefused({
+      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
         role: name,
         storedOid: output.oid,
         liveOid: live.oid
       }));
     }
     const passwordSeal = output?.passwordSeal ?? "";
-    const found = { ...live, passwordSeal };
-    return yield* ownedRead({ fqn, instanceId, output }, found, Effect27.succeed(declarationMatches(olds, live)));
+    const found = { ...storedAttributes(live), passwordSeal };
+    return yield* ownedRead({ fqn, instanceId, output }, found, Effect28.succeed(declarationMatches(olds, live)));
   }),
-  diff: ({ news, output, instanceId }) => Effect27.gen(function* () {
+  diff: ({ news, output, instanceId }) => Effect28.gen(function* () {
     if (output === undefined)
       return yield* noteUnfinished(instanceId);
     if (!isResolved5(news))
@@ -2111,9 +2133,9 @@ var postgresRoleHandlers = PostgresRole.Provider.of({
     const found = yield* withPg((pg) => readRole(pg, output.name));
     return yield* diffPostgresRole(news, output, process.env, { found });
   }),
-  reconcile: ({ fqn, instanceId, news, output }) => Effect27.gen(function* () {
+  reconcile: ({ fqn, instanceId, news, output }) => Effect28.gen(function* () {
     yield* refuseAtPlan(news);
-    return yield* withPg((pg) => Effect27.gen(function* () {
+    return yield* withPg((pg) => Effect28.gen(function* () {
       const observed = yield* readRole(pg, news.name);
       if (observed !== undefined && output === undefined) {
         yield* refuseTakeover({ fqn, instanceId, output }, "Postgres.Role");
@@ -2121,20 +2143,20 @@ var postgresRoleHandlers = PostgresRole.Provider.of({
       return yield* reconcileWithClient4(pg, news, process.env, output?.passwordSeal, output?.oid);
     }));
   }),
-  delete: ({ output }) => withPg((pg) => Effect27.gen(function* () {
+  delete: ({ output }) => withPg((pg) => Effect28.gen(function* () {
     if (output === undefined)
       return;
     const live = yield* readRole(pg, output.name);
     if (live === undefined)
       return;
     if (live.oid !== output.oid) {
-      return yield* Effect27.fail(new PostgresRoleIdentityRefused({
+      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
         role: output.name,
         storedOid: output.oid,
         liveOid: live.oid
       }));
     }
-    yield* pg.unsafe(buildDropRoleSql(output.name)).pipe(Effect27.asVoid);
+    yield* pg.unsafe(buildDropRoleSql(output.name)).pipe(Effect28.asVoid);
   }))
 });
 var PostgresRoleProvider = () => Provider4.succeed(PostgresRole, postgresRoleHandlers);
@@ -2175,6 +2197,7 @@ export {
   PostgresRoleNameRefused,
   PostgresRoleParentMissing,
   PostgresRolePasswordEnvUnsetError,
+  PostgresRolePasswordNonAsciiRefused,
   PostgresRolePrivilegedRefused,
   PostgresRoleProvider,
   PostgresRoleRenameRefused,
@@ -2258,5 +2281,5 @@ export {
   withPg
 };
 
-//# debugId=C4337C797D2364A164756E2164756E21
+//# debugId=584CB763916085BE64756E2164756E21
 //# sourceMappingURL=index.js.map