@homeflare/alchemy 0.44.0 → 0.46.0

package/dist/postgres/role-attrs.d.ts

@@ -37,7 +37,8 @@ export interface PostgresRoleProps {
     readonly login: boolean;
     /** `CONNECTION LIMIT n`, `-1` for unlimited — maps to `pg_roles.rolconnlimit`. */
     readonly connectionLimit: number;
-    /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`. */
+    /** `INHERIT` or `NOINHERIT` — maps to `pg_roles.rolinherit`; false also clears per-grant
+     * INHERIT on declared memberships (PG 16+ uses the role flag only to default new grants). */
     readonly inherit: boolean;
     /**
      * `VALID UNTIL 'timestamp'` — maps to `pg_roles.rolvaliduntil`. ISO 8601 without a timezone is
@@ -86,18 +87,20 @@ export interface PostgresRoleAttributes {
      */
     readonly memberOf: readonly string[] | null;
     /**
-     * The membership rows behind `memberOf`, including `admin_option` and `set_option`. Present
+     * The membership rows behind `memberOf`, including `admin_option`, `set_option` and
+     * `inherit_option`. Present
      * on a catalog read; stripped before attributes are stored (`storedAttributes`), because the
      * engine's diff receives stored attributes and would never see them there. The provider's
      * diff reads these rows live. `grantor` is the role that made the grant
-     * (`pg_auth_members.grantor`), null when that role was dropped — a dropped-grantor row cannot
-     * be named in `REVOKE … GRANTED BY`, so reconcile can only fail typed on it.
+     * (`pg_auth_members.grantor`). Null is a defensive inconsistent-catalog case, not an ordinary
+     * DROP ROLE outcome; such a row cannot be named in `REVOKE … GRANTED BY`.
      */
     readonly memberships?: readonly {
         readonly parent: string;
         readonly grantor: string | null;
         readonly admin: boolean;
         readonly set: boolean;
+        readonly inherit: boolean;
     }[];
     /**
      * A seal of the last password value written, or `''` if none was ever written (`seal()` from

package/dist/postgres/role-attrs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/role-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,oEAAoE;AACpE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAe/F,eAAO,MAAM,iBAAiB,UACrB,MAAM,KACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GAAG,SAOrD,CAAC;AAEF;mEACmE;AACnE,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAG,OACX,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,gEAAgE;IAChE,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C;;;;;;;OAOG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;KACvB,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}
+{"version":3,"file":"role-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/role-attrs.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AACH,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,0BAA0B,CAAC;AAExD,oEAAoE;AACpE,OAAO,EAAE,uBAAuB,EAAE,eAAe,EAAE,cAAc,EAAE,MAAM,qBAAqB,CAAC;AAe/F,eAAO,MAAM,iBAAiB,UACrB,MAAM,KACZ;IAAE,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAA;CAAE,GAAG,SAOrD,CAAC;AAEF;mEACmE;AACnE,eAAO,MAAM,cAAc,aAAc,MAAM,QAAQ,MAAM,GAAG,IAAI,KAAG,OACX,CAAC;AAE7D;;;;;;;GAOG;AACH,MAAM,WAAW,iBAAiB;IAChC,gGAAgG;IAChG,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,6DAA6D;IAC7D,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,kFAAkF;IAClF,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC;iGAC6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B;;;;;OAKG;IACH,QAAQ,CAAC,UAAU,CAAC,EAAE,MAAM,CAAC;IAC7B;;;;OAIG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACtC;;;;;OAKG;IACH,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;CAC7B;AAED,+FAA+F;AAC/F,MAAM,WAAW,sBAAsB;IACrC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,eAAe,EAAE,MAAM,CAAC;IACjC,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,yFAAyF;IACzF,QAAQ,CAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IACnC;;;;;OAKG;IACH,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAC;IAC9B,QAAQ,CAAC,QAAQ,CAAC,EAAE,OAAO,CAAC;IAC5B,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,SAAS,CAAC,EAAE,OAAO,CAAC;IAC7B;;;OAGG;IACH,QAAQ,CAAC,QAAQ,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;IAC5C;;;;;;;;OAQG;IACH,QAAQ,CAAC,WAAW,CAAC,EAAE,SAAS;QAC9B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;QACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;QAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;QACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;QACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;KAC3B,EAAE,CAAC;IACJ;;;;OAIG;IACH,QAAQ,CAAC,YAAY,EAAE,MAAM,CAAC;CAC/B"}

package/dist/postgres/role-diff.d.ts

@@ -2,7 +2,7 @@ import type { Input } from 'alchemy/Input';
 import * as Effect from 'effect/Effect';
 import type { Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
-import { PostgresRoleIdentityRefused, type PostgresRoleNameRefused, PostgresRoleRenameRefused, type PostgresRoleValidUntilRefused } from './role-errors.ts';
+import { PostgresRoleIdentityRefused, type PostgresRoleNameRefused, type PostgresRolePasswordNonAsciiRefused, PostgresRoleRenameRefused, type PostgresRoleValidUntilRefused } from './role-errors.ts';
 /** A catalog read the provider performed for this diff. `found: undefined` means the name is
  * absent. Omitting the argument means no catalog read (the offline comparison). */
 export interface RoleObservation {
@@ -18,5 +18,5 @@ export declare const diffPostgresRole: (news: Input<PostgresRoleProps>, output:
     readonly action: 'update';
 } | {
     readonly action: 'noop';
-} | undefined, PostgresRoleRenameRefused | PostgresRoleNameRefused | PostgresRoleValidUntilRefused | PostgresRoleIdentityRefused>;
+} | undefined, PostgresRoleRenameRefused | PostgresRoleNameRefused | PostgresRoleValidUntilRefused | PostgresRoleIdentityRefused | PostgresRolePasswordNonAsciiRefused>;
 //# sourceMappingURL=role-diff.d.ts.map

package/dist/postgres/role-diff.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/role-diff.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,kBAAkB,CAAC;AAM1B;mFACmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,KAAK,CAAC,iBAAiB,CAAC,UACtB,sBAAsB,GAAG,SAAS,QACrC,WAAW,gBACF,eAAe,KAC5B,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrE,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,2BAA2B,CAwC3B,CAAC"}
+{"version":3,"file":"role-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/role-diff.ts"],"names":[],"mappings":"AAWA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AACjF,OAAO,EACL,2BAA2B,EAC3B,KAAK,uBAAuB,EAC5B,KAAK,mCAAmC,EACxC,yBAAyB,EACzB,KAAK,6BAA6B,EACnC,MAAM,kBAAkB,CAAC;AAM1B;mFACmF;AACnF,MAAM,WAAW,eAAe;IAC9B,QAAQ,CAAC,KAAK,EAAE,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,CAAC;CAC1E;AAED;;;;;GAKG;AACH,eAAO,MAAM,gBAAgB,SACrB,KAAK,CAAC,iBAAiB,CAAC,UACtB,sBAAsB,GAAG,SAAS,QACrC,WAAW,gBACF,eAAe,KAC5B,MAAM,CAAC,MAAM,CACd;IAAE,QAAQ,CAAC,MAAM,EAAE,QAAQ,CAAA;CAAE,GAAG;IAAE,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EACrE,yBAAyB,GACzB,uBAAuB,GACvB,6BAA6B,GAC7B,2BAA2B,GAC3B,mCAAmC,CA0CnC,CAAC"}

package/dist/postgres/role-errors.d.ts

@@ -82,12 +82,9 @@ export declare class PostgresRoleCreateVanished extends PostgresRoleCreateVanish
 declare const PostgresRoleMembershipUnrepaired_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "PostgresRoleMembershipUnrepaired";
 } & Readonly<A>;
-/** A `pg_auth_members` row survived reconcile in a shape the declaration does not allow — not
- * wanted, still `ADMIN`, or still `SET` at the upstream default TRUE. A live grantor's row is
- * named in `REVOKE … GRANTED BY`, which either binds or fails loudly; the one shape no
- * statement this family may issue can touch is a row whose grantor role was dropped
- * (`pg_auth_members` keeps it keyed on the dead oid, and no `GRANTED BY` name reaches it), so
- * the message asks the operator to revoke it by hand as a bootstrap superuser and re-plan. */
+/** An option repair was refused, or a catalog row survived outside the declaration. A null grantor is a
+ * defensive corruption/test case: PostgreSQL tracks grantor dependencies, so ordinary
+ * DROP ROLE does not leave a dangling grantor. Refuse instead of claiming convergence. */
 export declare class PostgresRoleMembershipUnrepaired extends PostgresRoleMembershipUnrepaired_base<{
     readonly role: string;
     readonly parent: string;
@@ -121,6 +118,15 @@ export declare class PostgresRoleIdentityRefused extends PostgresRoleIdentityRef
 }> {
     get message(): string;
 }
-export type PostgresRoleError = PostgresRoleNameRefused | PostgresRoleRenameRefused | PostgresRoleValidUntilRefused | PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused;
+declare const PostgresRolePasswordNonAsciiRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresRolePasswordNonAsciiRefused";
+} & Readonly<A>;
+/** Never carry the rejected password in this error: errors reach logs and traces. */
+export declare class PostgresRolePasswordNonAsciiRefused extends PostgresRolePasswordNonAsciiRefused_base<{
+    readonly role: string;
+}> {
+    get message(): string;
+}
+export type PostgresRoleError = PostgresRolePasswordNonAsciiRefused | PostgresRoleNameRefused | PostgresRoleRenameRefused | PostgresRoleValidUntilRefused | PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused;
 export {};
 //# sourceMappingURL=role-errors.d.ts.map

package/dist/postgres/role-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/role-errors.ts"],"names":[],"mappings":";;;AAWA;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;iDAIiD;AACjD,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;yDAGyD;AACzD,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;yFAEyF;AACzF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;CAC9C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;uEAEuE;AACvE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;8FAK8F;AAC9F,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAY7B;CACF;;;;AAED;;sCAEsC;AACtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mDAEmD;AACnD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;AAED,MAAM,MAAM,iBAAiB,GACzB,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,CAAC"}
+{"version":3,"file":"role-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/role-errors.ts"],"names":[],"mappings":";;;AAYA;;;;;;;GAOG;AACH,qBAAa,uBAAwB,SAAQ,6BAA4C;IACvF,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;iDAIiD;AACjD,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;yDAGyD;AACzD,qBAAa,iCAAkC,SAAQ,uCAErD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;yFAEyF;AACzF,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,SAAS,MAAM,EAAE,CAAC;CACnC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;yEAEyE;AACzE,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,MAAM,EAAE,aAAa,GAAG,WAAW,CAAC;CAC9C,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;uEAEuE;AACvE,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;CACvB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;0FAE0F;AAC1F,qBAAa,gCAAiC,SAAQ,sCAEpD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAY7B;CACF;;;;AAED;;sCAEsC;AACtC,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;mDAEmD;AACnD,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mCAAoC,SAAQ,yCAEvD;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAAC;IAC1B,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;AAED,MAAM,MAAM,iBAAiB,GACzB,mCAAmC,GACnC,uBAAuB,GACvB,yBAAyB,GACzB,6BAA6B,GAC7B,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,CAAC"}

package/dist/postgres/role-membership-sql.d.ts

@@ -11,8 +11,8 @@
  *   are exercised (`user-manag.sgml`). A safe seat membership is `ADMIN FALSE, SET FALSE`.
  * ⛔ REVOKE BY GRANTOR. A plain `REVOKE parent FROM member` only touches rows the session's
  *   own grantor made; Postgres 18 warns and leaves another grantor's rows standing
- *   (`revoke.sgml`). Every revoke here names `GRANTED BY`, so the statement either removes
- *   the row it targets or fails loudly — never a silent no-op.
+ *   (`revoke.sgml`). Every revoke here names `GRANTED BY`. A mismatched grantor can still
+ *   produce only a warning; the catalog re-read below catches surviving unsafe rows.
  */
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import * as Effect from 'effect/Effect';
@@ -20,30 +20,40 @@ import type { PgExecutor } from './database-sql.ts';
 import { PostgresRoleMembershipUnrepaired, PostgresRoleParentMissing } from './role-errors.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
 /** One `pg_auth_members` row as this family reads it: the parent name, the grantor who made
- * the grant, and the two options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * the grant, and the three options a name-only compare would hide. `admin` true is `WITH ADMIN`;
+ * `inherit` true inherits the parent's privileges even when the member is NOINHERIT;
  * `set` true (the `GRANT` default) lets the member `SET ROLE` to the parent. `grantor` is null
- * when the granting role was later dropped — such a row can never be named in a `REVOKE …
- * GRANTED BY`, so it can only be repaired by hand as a bootstrap superuser. */
+ * only in an inconsistent catalog or a synthetic test row, not after an ordinary DROP ROLE:
+ * PostgreSQL tracks grantor dependencies. Keep the null guard as a defensive refusal. */
 export interface MembershipRow {
     readonly parent: string;
     readonly grantor: string | null;
     readonly admin: boolean;
     readonly set: boolean;
+    readonly inherit: boolean;
 }
 export declare const selectRoleMemberships: (pg: PgExecutor, name: string) => Effect.Effect<readonly MembershipRow[], SqlError>;
 /** Seat grants say `SET FALSE`. Upstream `GRANT` defaults `SET` to TRUE, and `SET ROLE` to the
  * parent is how `SUPERUSER` / `CREATEROLE` / `CREATEDB` are exercised (`user-manag.sgml`). */
 export declare const buildGrantMembershipSql: (member: string, parent: string) => string;
-/** Repair an existing membership in place: one atomic full-options `GRANT` per parent.
- * Upstream keeps any `WITH` option the new `GRANT` omits (`grant.sgml`), so a repair must
- * spell both bits — `ADMIN FALSE, SET FALSE` — rather than rely on `SET FALSE` alone. */
-export declare const buildRepairMembershipSql: (member: string, parent: string) => string;
+/** ⛔ Do not repair with GRANT … ADMIN FALSE: measured in PR 336, that left grants made
+ * by the member standing after stripping its ADMIN. PG 16+ tracks dependent role grants:
+ * https://www.postgresql.org/docs/16/sql-grant.html#SQL-GRANT-DESCRIPTION-ROLES
+ * https://www.postgresql.org/docs/16/sql-revoke.html
+ * Measured 2026-10-02 on PG 17.11: REVOKE ADMIN OPTION … RESTRICT refuses dependents;
+ * without dependents, ADMIN/SET revocation keeps membership and its INHERIT bit intact.
+ * INHERIT revocation explicitly clears that bit for a declared NOINHERIT role.
+ * GRANTED BY targets the observed row, including a different grantor's row. */
+export declare const buildRepairMembershipSql: (member: string, parent: string, grantor: string, option: 'ADMIN' | 'SET' | 'INHERIT') => string;
 /** Remove one grantor's row for one parent. Naming the grantor is what makes the revoke
  * bind: a plain `REVOKE` skips rows other grantors made (`revoke.sgml`). */
 export declare const buildRevokeGrantorMembershipSql: (member: string, parent: string, grantor: string) => string;
-/** Catalog flags this family never declares. A create lands on the server default (all false);
- * an absent field on a seeded test row is that default. */
-export declare const unsafeMemberships: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>) => ReadonlySet<string>;
+/** ADMIN/SET are always unsafe; per-grant INHERIT is unsafe for declared NOINHERIT.
+ * PG 16–18 GRANT docs: the role attribute only defaults NEW membership grants. */
+export declare const unsafeMemberships: (live: Omit<PostgresRoleAttributes, 'passwordSeal'>, 
+/** The DECLARED inherit flag (never the live one): a declared NOINHERIT role must see live
+ *  per-grant INHERIT rows as unsafe even when the live role flag says INHERIT. */
+inherit: boolean) => ReadonlySet<string>;
 /** Membership drift: sorted set difference between declared and live. Duplicates in the
  * declaration collapse to one; `undefined` means "not asserted" — nothing to grant or revoke.
  * A parent already granted `WITH ADMIN`, or with `SET` still at the upstream default TRUE, is
@@ -56,20 +66,13 @@ export declare const membershipDrift: (declared: readonly string[] | undefined,
  * missing role is `42704` (`user.c@REL_18_6`), and on a create that error arrives only after
  * `CREATE ROLE` has committed. */
 export declare const assertParentsExist: (pg: PgExecutor, role: string, parents: readonly string[] | undefined) => Effect.Effect<void, PostgresRoleParentMissing | SqlError>;
-/** Make live memberships equal the declaration, never dropping a membership the declaration
- * keeps. A wanted parent that is already granted is repaired with one
- * `GRANT … WITH ADMIN FALSE, SET FALSE` — `AddRoleMems` updates that grantor's row in place
- * (`user.c@REL_18_6` `SearchSysCache3` on role, member, grantor) — and any other grantor's
- * unsafe row is then revoked by name.
- *
- * 1. Rows the declaration does not want are revoked **by their own grantor** (dead-grantor
- *    rows are skipped and left for the backstop to report).
- * 2. Unsafe-but-wanted rows get one full-options repair `GRANT` per parent — atomic, in place,
- *    so the membership never drops even when another grantor's row also exists.
- * 3. A repair leaves other grantors' unsafe rows beside the safe one, so a mid re-read
- *    revokes every remaining unsafe row with a live grantor.
- * 4. Absent-but-wanted parents get a fresh seat grant.
- * 5. Backstop re-read: any row that is not wanted, or still unsafe, fails typed — including a
- *    dead-grantor row, which no statement this family may issue can repair. */
+/** Make live memberships equal the declaration, preserving wanted memberships in place.
+ * The previous full-options GRANT updated only its own grantor's row, then revoked other
+ * unsafe rows; it could silently strip ADMIN despite dependent grants (PR 336 round 2).
+ * Now each unsafe option is revoked by its observed grantor with RESTRICT. Unwanted rows
+ * commit first, so a blocked ADMIN repair cannot restore unwanted access (PR 349 review).
+ * Each retained row's options share a transaction, attributing a dependency/permission
+ * refusal to that parent and grantor. No CASCADE and no replacement grantor row.
+ * Unnameable grantors are defensive catalog-corruption cases, left to the typed backstop. */
 export declare const syncMemberships: (pg: PgExecutor, props: PostgresRoleProps, rows: readonly MembershipRow[]) => Effect.Effect<readonly string[], SqlError | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing>;
 //# sourceMappingURL=role-membership-sql.d.ts.map

package/dist/postgres/role-membership-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-membership-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-membership-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;+EAI+E;AAC/E,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;CACvB;AAaD,eAAO,MAAM,qBAAqB,OAC5B,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,QAAQ,CAC2B,CAAC;AAE/E;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,WAAY,MAAM,UAAU,MAAM,KAAG,MACF,CAAC;AAExE;;yFAEyF;AACzF,eAAO,MAAM,wBAAwB,WAAY,MAAM,UAAU,MAAM,KAAG,MACU,CAAC;AAErF;4EAC4E;AAC5E,eAAO,MAAM,+BAA+B,WAClC,MAAM,UACN,MAAM,WACL,MAAM,KACd,MAC0F,CAAC;AAE9F;2DAC2D;AAC3D,eAAO,MAAM,iBAAiB,SACtB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,WAAW,CAAC,MAAM,CAC6E,CAAC;AAEnG;;;6FAG6F;AAC7F,eAAO,MAAM,eAAe,aAChB,SAAS,MAAM,EAAE,GAAG,SAAS,QACjC,SAAS,MAAM,EAAE,WACf,WAAW,CAAC,MAAM,CAAC,KAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAW3E,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,WACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,QAAQ,CAQvD,CAAC;AAEL;;;;;;;;;;;;;;+EAc+E;AAC/E,eAAO,MAAM,eAAe,OACtB,UAAU,SACP,iBAAiB,QAClB,SAAS,aAAa,EAAE,KAC7B,MAAM,CAAC,MAAM,CACd,SAAS,MAAM,EAAE,EACjB,QAAQ,GAAG,gCAAgC,GAAG,yBAAyB,CA2DrE,CAAC"}
+{"version":3,"file":"role-membership-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-membership-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;GAeG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,gCAAgC,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAC/F,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEjF;;;;;yFAKyF;AACzF,MAAM,WAAW,aAAa;IAC5B,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,GAAG,EAAE,OAAO,CAAC;IACtB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAcD,eAAO,MAAM,qBAAqB,OAC5B,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,SAAS,aAAa,EAAE,EAAE,QAAQ,CAC2B,CAAC;AAE/E;8FAC8F;AAC9F,eAAO,MAAM,uBAAuB,WAAY,MAAM,UAAU,MAAM,KAAG,MACF,CAAC;AAExE;;;;;;;+EAO+E;AAC/E,eAAO,MAAM,wBAAwB,WAC3B,MAAM,UACN,MAAM,WACL,MAAM,UACP,OAAO,GAAG,KAAK,GAAG,SAAS,KAClC,MACwH,CAAC;AAE5H;4EAC4E;AAC5E,eAAO,MAAM,+BAA+B,WAClC,MAAM,UACN,MAAM,WACL,MAAM,KACd,MAC0F,CAAC;AAE9F;kFACkF;AAClF,eAAO,MAAM,iBAAiB,SACtB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC;AAClD;kFACkF;SACzE,OAAO,KACf,WAAW,CAAC,MAAM,CAKlB,CAAC;AAEJ;;;6FAG6F;AAC7F,eAAO,MAAM,eAAe,aAChB,SAAS,MAAM,EAAE,GAAG,SAAS,QACjC,SAAS,MAAM,EAAE,WACf,WAAW,CAAC,MAAM,CAAC,KAC1B;IAAE,QAAQ,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAA;CAW3E,CAAC;AAEF;;kCAEkC;AAClC,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,WACH,SAAS,MAAM,EAAE,GAAG,SAAS,KACrC,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,yBAAyB,GAAG,QAAQ,CAQvD,CAAC;AAEL;;;;;;;6FAO6F;AAC7F,eAAO,MAAM,eAAe,OACtB,UAAU,SACP,iBAAiB,QAClB,SAAS,aAAa,EAAE,KAC7B,MAAM,CAAC,MAAM,CACd,SAAS,MAAM,EAAE,EACjB,QAAQ,GAAG,gCAAgC,GAAG,yBAAyB,CAuErE,CAAC"}

package/dist/postgres/role-provider.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-provider.d.ts","sourceRoot":"","sources":["../../src/postgres/role-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzC,eAAO,MAAM,oBAAoB,4PAkF/B,CAAC;AAEH,eAAO,MAAM,oBAAoB,0HAA6D,CAAC"}
+{"version":3,"file":"role-provider.d.ts","sourceRoot":"","sources":["../../src/postgres/role-provider.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AACH,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAM7C,OAAO,EAAE,YAAY,EAAE,MAAM,WAAW,CAAC;AAOzC,eAAO,MAAM,oBAAoB,4PAmF/B,CAAC;AAEH,eAAO,MAAM,oBAAoB,0HAA6D,CAAC"}

package/dist/postgres/role-scram.d.ts

@@ -1,6 +1,8 @@
 /**
  * `SCRAM-SHA-256$4096:<salt>$<StoredKey>:<ServerKey>` for one password. The salt is fresh per
  * call (same as `psql \password`); tests pass one to make the output deterministic.
+ * Callers first run `assertPasswordAscii`: raw non-ASCII may differ from PostgreSQL's
+ * SASLprep bytes (https://www.postgresql.org/docs/16/sasl-authentication.html).
  */
 export declare const scramSha256Verifier: (password: string, salt?: Buffer) => string;
 //# sourceMappingURL=role-scram.d.ts.map

package/dist/postgres/role-scram.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-scram.d.ts","sourceRoot":"","sources":["../../src/postgres/role-scram.ts"],"names":[],"mappings":"AA2BA;;;GAGG;AACH,eAAO,MAAM,mBAAmB,aAAc,MAAM,SAAS,MAAM,KAAG,MAMrE,CAAC"}
+{"version":3,"file":"role-scram.d.ts","sourceRoot":"","sources":["../../src/postgres/role-scram.ts"],"names":[],"mappings":"AA2BA;;;;;GAKG;AACH,eAAO,MAAM,mBAAmB,aAAc,MAAM,SAAS,MAAM,KAAG,MAMrE,CAAC"}

package/dist/postgres/role-secrets.d.ts

@@ -11,6 +11,8 @@
  *   written — a plan never re-sends a secret that already matches, and never stores one.
  */
 import * as Redacted from 'effect/Redacted';
+import * as Effect from 'effect/Effect';
+import { PostgresRolePasswordNonAsciiRefused } from './role-errors.ts';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleProps } from './role-attrs.ts';
 /** What the environment holds for the declared password. `value` is `undefined` when no
@@ -20,6 +22,12 @@ export interface ResolvedPassword {
     readonly variable: string | undefined;
     readonly value: Redacted.Redacted<string> | undefined;
 }
+/** ⛔ PostgreSQL applies SASLprep before SCRAM, with a raw-byte fallback for prohibited input:
+ * https://www.postgresql.org/docs/16/sasl-authentication.html#SASL-SCRAM-SHA-256
+ * Non-ASCII can normalize to different bytes (e.g. soft hyphen disappears). Refuse before
+ * any write, even with a matching old seal, until we have a vendor-compatible normalizer.
+ * ASCII is unchanged, including prohibited ASCII controls via PostgreSQL's fallback. */
+export declare const assertPasswordAscii: (role: string, resolved: ResolvedPassword) => Effect.Effect<void, PostgresRolePasswordNonAsciiRefused>;
 export declare const resolvePassword: (props: PostgresRoleProps, env?: Environment) => ResolvedPassword;
 /** `seal({ password })` of the resolved value — the one thing state remembers about it. */
 export declare const sealPassword: (value: Redacted.Redacted<string>) => string;

package/dist/postgres/role-secrets.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-secrets.d.ts","sourceRoot":"","sources":["../../src/postgres/role-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;2FAE2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED,eAAO,MAAM,eAAe,UACnB,iBAAiB,QACnB,WAAW,KACf,gBAQF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAG,MACrB,CAAC;AAE5C;;iFAEiF;AACjF,eAAO,MAAM,mBAAmB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,KAAG,OAC7B,CAAC"}
+{"version":3,"file":"role-secrets.d.ts","sourceRoot":"","sources":["../../src/postgres/role-secrets.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,QAAQ,MAAM,iBAAiB,CAAC;AAC5C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,mCAAmC,EAAE,MAAM,kBAAkB,CAAC;AACvE,OAAO,EAAE,KAAK,WAAW,EAAiC,MAAM,0BAA0B,CAAC;AAC3F,OAAO,KAAK,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAEzD;;2FAE2F;AAC3F,MAAM,WAAW,gBAAgB;IAC/B,QAAQ,CAAC,QAAQ,EAAE,MAAM,GAAG,SAAS,CAAC;IACtC,QAAQ,CAAC,KAAK,EAAE,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,GAAG,SAAS,CAAC;CACvD;AAED;;;;wFAIwF;AACxF,eAAO,MAAM,mBAAmB,SACxB,MAAM,YACF,gBAAgB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mCAAmC,CAGzC,CAAC;AAElB,eAAO,MAAM,eAAe,UACnB,iBAAiB,QACnB,WAAW,KACf,gBAQF,CAAC;AAEF,2FAA2F;AAC3F,eAAO,MAAM,YAAY,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,KAAG,MACrB,CAAC;AAE5C;;iFAEiF;AACjF,eAAO,MAAM,mBAAmB,UAAW,QAAQ,CAAC,QAAQ,CAAC,MAAM,CAAC,UAAU,MAAM,KAAG,OAC7B,CAAC"}

package/dist/postgres/role-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,UAAU,OACjB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAI7F,CAAC;AAEJ;oGACoG;AACpG,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAW/E,CAAC;AAiBL,eAAO,MAAM,kBAAkB,UAAW,iBAAiB,KAAG,MACM,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,SACtB,MAAM,UAER;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KACxC,MAYF,CAAC;AAEF;;;;0BAI0B;AAC1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,YAAY,MAAM,KAAG,MACW,CAAC;AAEjF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAAmD,CAAC;AAEpG;sFACsF;AACtF,eAAO,MAAM,qBAAqB,UACzB,iBAAiB,YACd,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAMjB,CAAC;AAEF;2FAC2F;AAC3F,eAAO,MAAM,WAAW,UACf,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,aAAa,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAcvD,CAAC;AAEF;;wDAEwD;AACxD,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,OAcF,CAAC;AAEF;;;+CAG+C;AAC/C,eAAO,MAAM,gBAAgB,SACrB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAG7C,CAAC;AAEF;2DAC2D;AAC3D,eAAO,MAAM,eAAe,SACpB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,SAAS,MAAM,EAQjB,CAAC"}
+{"version":3,"file":"role-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/role-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAGpD,OAAO,EACL,KAAK,sBAAsB,EAC3B,KAAK,iBAAiB,EAEvB,MAAM,iBAAiB,CAAC;AAuBzB,eAAO,MAAM,UAAU,OACjB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAI7F,CAAC;AAEJ;oGACoG;AACpG,eAAO,MAAM,kBAAkB,OACzB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,GAAG,SAAS,EAAE,QAAQ,CAW/E,CAAC;AAiBL,eAAO,MAAM,kBAAkB,UAAW,iBAAiB,KAAG,MACM,CAAC;AAErE,4FAA4F;AAC5F,eAAO,MAAM,iBAAiB,SACtB,MAAM,UAER;IAAE,IAAI,EAAE,OAAO,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACjC;IAAE,IAAI,EAAE,SAAS,CAAC;IAAC,KAAK,EAAE,OAAO,CAAA;CAAE,GACnC;IACE,IAAI,EAAE,iBAAiB,CAAC;IACxB,KAAK,EAAE,MAAM,CAAC;CACf,GACD;IAAE,IAAI,EAAE,YAAY,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,KACxC,MAYF,CAAC;AAEF;;;;0BAI0B;AAC1B,eAAO,MAAM,mBAAmB,SAAU,MAAM,YAAY,MAAM,KAAG,MACW,CAAC;AAEjF,eAAO,MAAM,gBAAgB,SAAU,MAAM,KAAG,MAAmD,CAAC;AAEpG;sFACsF;AACtF,eAAO,MAAM,qBAAqB,UACzB,iBAAiB,YACd,MAAM,GAAG,SAAS,KAC3B,SAAS,MAAM,EAMjB,CAAC;AAEF;2FAC2F;AAC3F,eAAO,MAAM,WAAW,UACf,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,aAAa,CAAC,UAAU,CAAC,OAAO,iBAAiB,CAAC,CAAC,CAAC,CAAC,CAcvD,CAAC;AAEF;;wDAEwD;AACxD,eAAO,MAAM,kBAAkB,UACtB,iBAAiB,QAClB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,OAgBF,CAAC;AAEF;;;+CAG+C;AAC/C,eAAO,MAAM,gBAAgB,SACrB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAG7C,CAAC;AAEF;2DAC2D;AAC3D,eAAO,MAAM,eAAe,SACpB,IAAI,CAAC,sBAAsB,EAAE,cAAc,CAAC,KACjD,SAAS,MAAM,EAQjB,CAAC"}

package/dist/postgres/role.d.ts

@@ -31,7 +31,7 @@ import * as Effect from 'effect/Effect';
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import { type Environment } from '../secrets/write-only.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
-import { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, type PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, type PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, PostgresRolePrivilegedRefused, PostgresRoleValidUntilRefused } from './role-errors.ts';
+import { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, type PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, type PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, type PostgresRolePasswordNonAsciiRefused, PostgresRolePrivilegedRefused, PostgresRoleValidUntilRefused } from './role-errors.ts';
 import { type PostgresConnection } from './connection.ts';
 import type { PgExecutor } from './database-sql.ts';
 export interface PostgresRole extends Resource<'Postgres.Role', PostgresRoleProps, PostgresRoleAttributes, never, PostgresConnection> {
@@ -47,7 +47,7 @@ export declare const isPostgresRole: (value: unknown) => value is PostgresRole;
  * being written for the first time — because `pg_roles` answers no password (S25), so the live
  * row cannot say whether the environment value still matches the one last written.
  */
-export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresRoleProps, env?: Environment, previousSeal?: string, storedOid?: number) => Effect.Effect<PostgresRoleAttributes, PostgresRolePasswordEnvUnsetError | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused | SqlError>;
+export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresRoleProps, env?: Environment, previousSeal?: string, storedOid?: number) => Effect.Effect<PostgresRoleAttributes, PostgresRolePasswordEnvUnsetError | PostgresRolePasswordNonAsciiRefused | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused | SqlError>;
 /** The core of `read`. Answers `undefined` when absent; ownership branding and the state-only
  * `passwordSeal` merge are the caller's. */
 export declare const readRole: (pg: PgExecutor, name: string) => Effect.Effect<Omit<PostgresRoleAttributes, "passwordSeal"> | undefined, SqlError, never>;

package/dist/postgres/role.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/postgres/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAcjF,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,iCAAiC,EACjC,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;iEACiE;AACjE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,YAGD,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,iBAAiB,QACnB,WAAW,qCAEJ,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,sBAAsB,EACpB,iCAAiC,GACjC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,GAC3B,QAAQ,CAyFR,CAAC;AAEL;4CAC4C;AAC5C,eAAO,MAAM,QAAQ,OAAQ,UAAU,QAAQ,MAAM,6FAAiC,CAAC;AAEvF;gDACgD;AAChD,eAAO,MAAM,YAAY,UAChB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,6BAA6B,CAkB1E,CAAC"}
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/postgres/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmBjF,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;iEACiE;AACjE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,YAGD,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,iBAAiB,QACnB,WAAW,qCAEJ,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,sBAAsB,EACpB,iCAAiC,GACjC,mCAAmC,GACnC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,GAC3B,QAAQ,CA0FR,CAAC;AAEL;4CAC4C;AAC5C,eAAO,MAAM,QAAQ,OAAQ,UAAU,QAAQ,MAAM,6FAAiC,CAAC;AAEvF;gDACgD;AAChD,eAAO,MAAM,YAAY,UAChB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,6BAA6B,CAkB1E,CAAC"}

package/dist/proxmox/generated/constraints/index.d.ts

@@ -15,5 +15,5 @@ export declare const PROXMOX_CONSTRAINTS: Readonly<Record<string, EndpointConstr
  * ★ A DIGEST OF THE DATA, NOT OF THE FILE TEXT, so reformatting is not a stale generation while
  *   changing a 128 to a 129 by hand is. `tests/schema-manifest.test.ts` recomputes it.
  */
-export declare const PROXMOX_CONSTRAINTS_DIGEST = "8b6745a471839974";
+export declare const PROXMOX_CONSTRAINTS_DIGEST = "cbf63b7bac0500ef";
 //# sourceMappingURL=index.d.ts.map

package/dist/proxmox/generated/constraints/pve-access.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-backup.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-firewall.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-ha.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-metrics.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-notifications.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-replication.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-cluster-sdn.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-ceph.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-disks.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-lxc.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-network.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-qemu.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-nodes-qemu.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"pve-nodes-qemu.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-nodes-qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAsGpF,CAAC"}
+{"version":3,"file":"pve-nodes-qemu.d.ts","sourceRoot":"","sources":["../../../../src/proxmox/generated/constraints/pve-nodes-qemu.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,sBAAsB,CAAC;AAEhE,eAAO,MAAM,0BAA0B,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CA2GpF,CAAC"}

package/dist/proxmox/generated/constraints/pve-nodes-storage.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-pools.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/generated/constraints/pve-storage.d.ts

@@ -6,7 +6,7 @@
  *   sha256 9def8f13611184ee, read on a PVE cluster node from
  *   /usr/share/pve-docs/api-viewer/apidoc.js
  *
- * 59 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
+ * 60 of this product's 258 POST/PUT endpoints are tabled across all areas: the ones
  * this package writes to, named in its own source. Every other vendor write endpoint is UNTABLED
  * and therefore unchecked at plan time.
  *

package/dist/proxmox/index.d.ts

@@ -85,6 +85,7 @@ export { PROVISION_DEFAULTS, PROVISION_PRIVILEGES, type CoreProvisionNames, type
 export { provisionBootstrap } from './provision-bootstrap.ts';
 export { type DeclareProvisionOptions, declareProvisionBaseline } from './provision-declare.ts';
 export { ProxmoxVm, ProxmoxVmProvider, type VmAttributes, type VmProps } from './qemu.ts';
+export { QemuDiskResizeRefused } from './qemu-size.ts';
 export { ProxmoxStorageDownload, ProxmoxStorageDownloadProvider, type StorageDownloadAttributes, type StorageDownloadProps, } from './storage-download.ts';
 export { ProxmoxReplicationJobProvider } from './replication-job.ts';
 export { ProxmoxRole, ProxmoxRoleProvider } from './role.ts';

package/dist/proxmox/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/proxmox/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsDG;AACH,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC1D,OAAO,EAAE,KAAK,uBAAuB,EAAE,qBAAqB,EAAE,MAAM,wBAAwB,CAAC;AAC7F,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AACzD,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,cAAc,EAAE,cAAc,EAAE,MAAM,uBAAuB,CAAC;AACvE,OAAO,EACL,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,eAAe,EACpB,UAAU,GACX,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,4BAA4B,EAAE,MAAM,qBAAqB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,YAAY,CAAC;AAChE,OAAO,EAAE,iBAAiB,EAAE,yBAAyB,EAAE,MAAM,kBAAkB,CAAC;AAChF,OAAO,EAAE,aAAa,EAAE,qBAAqB,EAAE,MAAM,cAAc,CAAC;AACpE,OAAO,EAAE,KAAK,aAAa,EAAE,KAAK,QAAQ,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC7F,OAAO,EAAE,mBAAmB,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACtF,OAAO,EAAE,2BAA2B,EAAE,MAAM,oBAAoB,CAAC;AACjE,OAAO,EAAE,0BAA0B,EAAE,MAAM,mBAAmB,CAAC;AAC/D,OAAO,EACL,0BAA0B,EAC1B,kCAAkC,GACnC,MAAM,2BAA2B,CAAC;AACnC,OAAO,EACL,yBAAyB,EACzB,iCAAiC,GAClC,MAAM,0BAA0B,CAAC;AAClC,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,oBAAoB,CAAC;AACxE,OAAO,EACL,sBAAsB,EACtB,8BAA8B,GAC/B,MAAM,+BAA+B,CAAC;AACvC,OAAO,EACL,qBAAqB,EACrB,6BAA6B,EAC7B,KAAK,0BAA0B,GAChC,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,EAAE,UAAU,EAAE,kBAAkB,EAAE,MAAM,mBAAmB,CAAC;AACnE,OAAO,EAAE,YAAY,EAAE,oBAAoB,EAAE,MAAM,qBAAqB,CAAC;AACzE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EACL,kBAAkB,EAClB,oBAAoB,EACpB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,sBAAsB,EAC3B,iBAAiB,GAClB,MAAM,yBAAyB,CAAC;AACjC,OAAO,EAAE,kBAAkB,EAAE,MAAM,0BAA0B,CAAC;AAC9D,OAAO,EAAE,KAAK,uBAAuB,EAAE,wBAAwB,EAAE,MAAM,wBAAwB,CAAC;AAChG,OAAO,EAAE,SAAS,EAAE,iBAAiB,EAAE,KAAK,YAAY,EAAE,KAAK,OAAO,EAAE,MAAM,WAAW,CAAC;AAC1F,OAAO,EAAE,qBAAqB,EAAE,MAAM,gBAAgB,CAAC;AACvD,OAAO,EACL,sBAAsB,EACtB,8BAA8B,EAC9B,KAAK,yBAAyB,EAC9B,KAAK,oBAAoB,GAC1B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,6BAA6B,EAAE,MAAM,sBAAsB,CAAC;AACrE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,eAAe,EAAE,uBAAuB,EAAE,MAAM,gBAAgB,CAAC;AAC1E,OAAO,EAAE,gBAAgB,EAAE,wBAAwB,EAAE,MAAM,iBAAiB,CAAC;AAC7E,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC;AACvE,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,cAAc,CAAC;AACtE,OAAO,EAAE,WAAW,EAAE,mBAAmB,EAAE,MAAM,WAAW,CAAC;AAC7D,OAAO,EAAE,KAAK,OAAO,EAAE,MAAM,0BAA0B,CAAC;AACxD,OAAO,EAAE,cAAc,EAAE,sBAAsB,EAAE,MAAM,eAAe,CAAC"}