@homeflare/alchemy 0.47.1 → 0.48.1

package/src/talos/yaml-parse.test.ts

@@ -0,0 +1,41 @@
+/**
+ * `parseYaml` — a syntax error is "not a document"; nothing else is swallowed. And the adapter's
+ * kubeconfig reader no longer reports a parser/runtime fault as an unreadable kubeconfig.
+ */
+import { expect, spyOn, test } from 'bun:test';
+import { kubeconfigTransport } from './kubeconfig-doc.ts';
+import { parseYaml } from './yaml-parse.ts';
+
+test('valid YAML parses and a syntax error is undefined', () => {
+  expect(parseYaml('a: 1\nb: [x, y]\n')).toEqual({ a: 1, b: ['x', 'y'] });
+  expect(parseYaml('a: [unclosed\n')).toBeUndefined();
+});
+
+test('an unresolved tag beside key material emits no warning carrying the source', () => {
+  // ⛔ yaml's default logLevel is 'warn': process.emitWarning with the SOURCE TEXT. Reproduced in
+  //   hunt round 5: the whole client-key-data landed on stderr while parsing still succeeded.
+  // A fresh random needle per run: a fixed high-entropy literal here is exactly what the secret scan refuses.
+  const secret = Buffer.from(crypto.getRandomValues(new Uint8Array(32))).toString('base64');
+  const text = `users:\n  - user:\n      client-key-data: ${secret}\n      other: !nosuchtag value\n`;
+  const emitted: string[] = [];
+  const warn = spyOn(process, 'emitWarning').mockImplementation(((w: unknown) => {
+    emitted.push(String(w instanceof Error ? w.message : w));
+  }) as never);
+  const err = spyOn(process.stderr, 'write').mockImplementation(((c: unknown) => {
+    emitted.push(String(c));
+    return true;
+  }) as never);
+  try {
+    expect(parseYaml(text)).toBeDefined();
+  } finally {
+    warn.mockRestore();
+    err.mockRestore();
+  }
+  expect(emitted.join('\n')).not.toContain(secret);
+  expect(emitted).toEqual([]);
+});
+
+test('kubeconfigTransport returns undefined for a non-document, not for a fault', () => {
+  expect(kubeconfigTransport('a: [unclosed\n', 'admin@c1')).toBeUndefined();
+  expect(kubeconfigTransport('- just\n- a list\n', 'admin@c1')).toBeUndefined();
+});

package/src/talos/yaml-parse.ts

@@ -0,0 +1,28 @@
+/**
+ * The one YAML parser of the Talos family — runtime-neutral, so it runs under Bun AND Node.
+ *
+ * ⛔ NOT `Bun.YAML`. The published `dist/` runs on Node for consumers (AGENTS.md: Bun is the
+ *   toolchain, not the runtime). `Bun.YAML` is a missing global there: the old code swallowed that
+ *   ReferenceError and reported every kubeconfig as unreadable (reproduced on Node 22: the adapter
+ *   returned no transport). ★ `yaml` is the parser alchemy itself depends on (`yaml ^2.9.0`), so no
+ *   new package enters a consumer's tree.
+ * ⚠️ ONLY a YAML syntax error is `undefined` ("this is not a document"). Anything else — a broken
+ *   import, a runtime fault — propagates, so a parser/runtime defect is never dressed up as bad
+ *   vault content.
+ */
+import { YAMLParseError, parse } from 'yaml';
+
+/** Parse one YAML document, or `undefined` when the text is not valid YAML. */
+export const parseYaml = (text: string): unknown => {
+  try {
+    // ⛔ yaml reports unresolved tags etc. via process.emitWarning with the SOURCE TEXT in the
+    //   message (reproduced, hunt round 5: a kubeconfig with an unknown tag beside client-key-data
+    //   put the whole key on stderr). `logLevel: 'error'` silences warnings (yaml options.d.ts:
+    //   LogLevelId; doc.warnings are never emitted) and `prettyErrors: false` keeps source excerpts
+    //   out of any thrown error's message; syntax errors still throw YAMLParseError.
+    return parse(text, { logLevel: 'error', prettyErrors: false });
+  } catch (error) {
+    if (error instanceof YAMLParseError) return undefined;
+    throw error;
+  }
+};

package/src/verify/fake-engine.ts

@@ -143,6 +143,8 @@ export interface FakeEngine {
    * `verify.ts`'s `readWithState`, which already wraps that same call in `Effect.catchCause`.
    */
   readonly drift: (body: Body) => Promise<Record<string, DriftRow>>;
+  /** `alchemy drift --repair` (`Alchemy.Drift.repair`): read, then reconcile what drifted. */
+  readonly repair: (body: Body) => Promise<Record<string, DriftRow>>;
   /**
    * Every state row the store holds, as JSON — what a Postgres store would persist. ★ For tests
    * that must prove a value NEVER reaches state (proxmox/pbs-notification-target-state.test.ts).
@@ -173,6 +175,8 @@ export const engineOver = <ROut, E, RIn>(
     stage: string;
   }) => Effect.Effect<{ resources: Record<string, DriftRow> }, unknown>;
 
+  const repairDrift = Alchemy.Drift.repair as unknown as typeof detectDrift;
+
   const run = <A>(body: Body, next: (compiled: Compiled) => Effect.Effect<A, unknown, unknown>) =>
     Effect.runPromise(
       Effect.gen(function* () {
@@ -208,6 +212,12 @@ export const engineOver = <ROut, E, RIn>(
           Effect.map((detected) => detected.resources),
         ),
       ),
+    repair: (body) =>
+      run(body, (compiled) =>
+        repairDrift({ name: compiled.name, stage: compiled.stage }).pipe(
+          Effect.map((detected) => detected.resources),
+        ),
+      ),
   };
 };
 

package/dist/talos/fake-process.d.ts

@@ -1,56 +0,0 @@
-/**
- * A fake `ChildProcessSpawner` for offline Talos tests — no real `bao` or `talosctl` process ever
- * starts. Shared by credentials.test.ts and talos-machine-config.test.ts (2026-09-26, K-A3);
- * this package had NO process-level test fake before this file — every Talos resource file spawns
- * a real binary in production and none of that was previously exercised offline.
- *
- * ★ A FULL FAKE SERVICE, NOT A REAL SPAWN WITH A FIXTURE EXECUTABLE ON `PATH`. The alternative —
- *   a tiny fake `bao`/`talosctl` script and a mutated `process.env.PATH` — spawns a REAL OS
- *   process and mutates process-global state for the test's duration, which is exactly the kind
- *   of cross-test interference the house rules ask tests to avoid. `ChildProcessSpawner.make`
- *   takes just a `spawn` function and derives everything else, so a fake `spawn` is the whole cost.
- */
-import * as Effect from 'effect/Effect';
-import * as Stream from 'effect/Stream';
-import type { Command } from 'effect/process/ChildProcess';
-import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
-export type FakeResult = {
-    readonly stdout?: string;
-    readonly stderr?: string;
-    readonly exitCode?: number;
-};
-export type FakeCall = {
-    readonly command: string;
-    readonly args: readonly string[];
-    /**
-     * Decoded stdin text, present only when the real caller piped a `Stream` in (K-talos-first-boot,
-     * `credentials-write.ts`'s `writeKvValue`) — the whole reason this fake exists is to prove a
-     * value went in via stdin and never via argv, so a test needs to see it.
-     */
-    readonly stdin?: string;
-};
-export type FakeHandler = (call: FakeCall) => FakeResult;
-/**
- * Build a fake `ChildProcessSpawner.Service` from `handler`, which sees every command's
- * executable + argv (+ decoded stdin, when piped) and returns canned stdout/stderr/exitCode.
- * `credentials.ts` and `talosctl.ts` only ever build `StandardCommand`s (never a piped command),
- * so that is the only shape this fake accepts — a `PipedCommand` is a test-authoring mistake, not
- * something to fake.
- */
-export declare const fakeSpawner: (handler: FakeHandler, calls?: FakeCall[]) => {
-    spawn(command: Command): Effect.Effect<ChildProcessSpawner.ChildProcessHandle, import("effect/PlatformError").PlatformError, import("effect/Scope").Scope>;
-    exitCode(command: Command): Effect.Effect<ChildProcessSpawner.ExitCode, import("effect/PlatformError").PlatformError>;
-    streamString(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
-    streamLines(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Stream.Stream<string, import("effect/PlatformError").PlatformError>;
-    lines(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Effect.Effect<Array<string>, import("effect/PlatformError").PlatformError>;
-    string(command: Command, options?: {
-        readonly includeStderr?: boolean | undefined;
-    }): Effect.Effect<string, import("effect/PlatformError").PlatformError>;
-};
-//# sourceMappingURL=fake-process.d.ts.map

package/dist/talos/fake-process.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"fake-process.d.ts","sourceRoot":"","sources":["../../src/talos/fake-process.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAE1E,MAAM,MAAM,UAAU,GAAG;IACvB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,QAAQ,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC;;;;OAIG;IACH,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CAAC,IAAI,EAAE,QAAQ,KAAK,UAAU,CAAC;AAsCzD;;;;;;GAMG;AACH,eAAO,MAAM,WAAW,YAAa,WAAW,UAAS,QAAQ,EAAE;;;;;;;;;;;;;;;CAehE,CAAC"}

package/dist/talos/machine-config-fixtures.d.ts

@@ -1,60 +0,0 @@
-/**
- * Shared fixtures for talos-machine-config.test.ts and machine-config-poll.test.ts — split out
- * so neither test file needs to duplicate the fake `bao`/`talosctl` dispatcher (2026-09-26, K-A3).
- *
- * ⚠️ FIXTURES ONLY. `CONFIG_TEXT` is a plain marker string, never anything resembling a real
- *   Talos machine config, CA key or bootstrap token. No provider imports this file.
- */
-import * as Effect from 'effect/Effect';
-import * as ChildProcessSpawner from 'effect/process/ChildProcessSpawner';
-import { type FakeCall } from './fake-process.ts';
-import type { MachineConfigProps } from './talos-machine-config.ts';
-export declare const CONFIG_TEXT = "machine:\n  type: worker\n";
-export declare const PIN: string;
-export declare const TARGET: {
-    cluster: string;
-    mount: string;
-};
-export declare const FAST_POLL: {
-    immediate: {
-        intervalMs: number;
-        maxAttempts: number;
-    };
-    rebootish: {
-        intervalMs: number;
-        maxAttempts: number;
-    };
-};
-export declare const props: (overrides?: Partial<MachineConfigProps>) => MachineConfigProps;
-/** Shape REASONED from talosctl's `get machineconfig -o yaml` — see values.ts's own header. */
-export declare const wrapperFor: (specText: string, version?: string) => string;
-/** Routes fake `bao kv get` (config + talosconfig keys) and `talosctl` calls in one place. */
-export declare const dispatcher: (opts: {
-    configText?: string;
-    liveWrapper?: () => {
-        stdout?: string;
-        exitCode?: number;
-    };
-    applyExitCode?: number;
-    /**
-     * Controls the fix-first #1 maintenance-mode probe (`talosctl version --insecure`), reached only
-     * when the authenticated `get machineconfig` above fails. Defaults to `false` so a bare failing
-     * `liveWrapper` (most tests) still exercises the "both reads fail → propagate" path rather than
-     * silently succeeding at the probe.
-     */
-    maintenanceReachable?: boolean;
-}) => (call: FakeCall) => {
-    stdout?: string;
-    exitCode?: number;
-} | {
-    exitCode: number;
-    stderr: string;
-};
-export declare const run: <A, E>(effect: Effect.Effect<A, E, ChildProcessSpawner.ChildProcessSpawner>, handler: (c: FakeCall) => {
-    stdout?: string;
-    stderr?: string;
-    exitCode?: number;
-}, calls?: FakeCall[]) => Promise<A>;
-/** `Data.TaggedError` stamps `_tag`, not `.message` — see talos-errors.ts. */
-export declare const hasTag: (tag: string) => (error: unknown) => boolean;
-//# sourceMappingURL=machine-config-fixtures.d.ts.map

package/dist/talos/machine-config-fixtures.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"machine-config-fixtures.d.ts","sourceRoot":"","sources":["../../src/talos/machine-config-fixtures.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,mBAAmB,MAAM,oCAAoC,CAAC;AAC1E,OAAO,EAAE,KAAK,QAAQ,EAAe,MAAM,mBAAmB,CAAC;AAC/D,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,2BAA2B,CAAC;AAGpE,eAAO,MAAM,WAAW,+BAA+B,CAAC;AACxD,eAAO,MAAM,GAAG,QAA4B,CAAC;AAC7C,eAAO,MAAM,MAAM;IAAK,OAAO;IAAQ,KAAK;CAAc,CAAC;AAC3D,eAAO,MAAM,SAAS;IACpB,SAAS;QAAI,UAAU;QAAK,WAAW;;IACvC,SAAS;QAAI,UAAU;QAAK,WAAW;;CACxC,CAAC;AAEF,eAAO,MAAM,KAAK,eAAe,OAAO,CAAC,kBAAkB,CAAC,KAAQ,kBAMlE,CAAC;AAEH,+FAA+F;AAC/F,eAAO,MAAM,UAAU,aAAc,MAAM,6BAC6D,CAAC;AAEzG,8FAA8F;AAC9F,eAAO,MAAM,UAAU,SAAU;IAC/B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,WAAW,CAAC,EAAE,MAAM;QAAE,MAAM,CAAC,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC;IAC3D,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB;;;;;OAKG;IACH,oBAAoB,CAAC,EAAE,OAAO,CAAC;CAChC,YAEe,QAAQ;aAXS,MAAM;eAAa,MAAM;;;;CAgCzD,CAAC;AAEF,eAAO,MAAM,GAAG,GAAI,CAAC,EAAE,CAAC,UACd,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,mBAAmB,CAAC,mBAAmB,CAAC,WAC3D,CAAC,CAAC,EAAE,QAAQ,KAAK;IAAE,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,EAAE,MAAM,CAAA;CAAE,UAC1E,QAAQ,EAAE,eAQhB,CAAC;AAEJ,8EAA8E;AAC9E,eAAO,MAAM,MAAM,QAAS,MAAM,aAAa,OAAO,YACH,CAAC"}

package/src/postgres/fixtures/pg-REL_18_6-acl.h.txt

@@ -1,147 +0,0 @@
-# path: src/include/utils/acl.h
-# blob: 13bb8128747139d9cae66777e4782359ead0a760
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-30 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the AclItem struct, the grant-option layout, every ACL_*_CHR letter define and the ACL_ALL_RIGHTS_* sets (lines 40-180 of the full file)
-#
-
-/*
- * typedef AclMode is declared in parsenodes.h, also the individual privilege
- * bit meanings are defined there
- */
-
-#define ACL_ID_PUBLIC	0		/* placeholder for id in a PUBLIC acl item */
-
-/*
- * AclItem
- *
- * Note: must be same size on all platforms, because the size is hardcoded
- * in the pg_type.h entry for aclitem.
- */
-typedef struct AclItem
-{
-	Oid			ai_grantee;		/* ID that this item grants privs to */
-	Oid			ai_grantor;		/* grantor of privs */
-	AclMode		ai_privs;		/* privilege bits */
-} AclItem;
-
-/*
- * The upper 32 bits of the ai_privs field of an AclItem are the grant option
- * bits, and the lower 32 bits are the actual privileges.  We use "rights"
- * to mean the combined grant option and privilege bits fields.
- */
-#define ACLITEM_GET_PRIVS(item)    ((item).ai_privs & 0xFFFFFFFF)
-#define ACLITEM_GET_GOPTIONS(item) (((item).ai_privs >> 32) & 0xFFFFFFFF)
-#define ACLITEM_GET_RIGHTS(item)   ((item).ai_privs)
-
-#define ACL_GRANT_OPTION_FOR(privs) (((AclMode) (privs) & 0xFFFFFFFF) << 32)
-#define ACL_OPTION_TO_PRIVS(privs)	(((AclMode) (privs) >> 32) & 0xFFFFFFFF)
-
-#define ACLITEM_SET_PRIVS(item,privs) \
-  ((item).ai_privs = ((item).ai_privs & ~((AclMode) 0xFFFFFFFF)) | \
-					 ((AclMode) (privs) & 0xFFFFFFFF))
-#define ACLITEM_SET_GOPTIONS(item,goptions) \
-  ((item).ai_privs = ((item).ai_privs & ~(((AclMode) 0xFFFFFFFF) << 32)) | \
-					 (((AclMode) (goptions) & 0xFFFFFFFF) << 32))
-#define ACLITEM_SET_RIGHTS(item,rights) \
-  ((item).ai_privs = (AclMode) (rights))
-
-#define ACLITEM_SET_PRIVS_GOPTIONS(item,privs,goptions) \
-  ((item).ai_privs = ((AclMode) (privs) & 0xFFFFFFFF) | \
-					 (((AclMode) (goptions) & 0xFFFFFFFF) << 32))
-
-
-#define ACLITEM_ALL_PRIV_BITS		((AclMode) 0xFFFFFFFF)
-#define ACLITEM_ALL_GOPTION_BITS	((AclMode) 0xFFFFFFFF << 32)
-
-/*
- * Definitions for convenient access to Acl (array of AclItem).
- * These are standard PostgreSQL arrays, but are restricted to have one
- * dimension and no nulls.  We also ignore the lower bound when reading,
- * and set it to one when writing.
- *
- * CAUTION: as of PostgreSQL 7.1, these arrays are toastable (just like all
- * other array types).  Therefore, be careful to detoast them with the
- * macros provided, unless you know for certain that a particular array
- * can't have been toasted.
- */
-
-
-/*
- * Acl			a one-dimensional array of AclItem
- */
-typedef struct ArrayType Acl;
-
-#define ACL_NUM(ACL)			(ARR_DIMS(ACL)[0])
-#define ACL_DAT(ACL)			((AclItem *) ARR_DATA_PTR(ACL))
-#define ACL_N_SIZE(N)			(ARR_OVERHEAD_NONULLS(1) + ((N) * sizeof(AclItem)))
-#define ACL_SIZE(ACL)			ARR_SIZE(ACL)
-
-/*
- * fmgr macros for these types
- */
-#define DatumGetAclItemP(X)		   ((AclItem *) DatumGetPointer(X))
-#define PG_GETARG_ACLITEM_P(n)	   DatumGetAclItemP(PG_GETARG_DATUM(n))
-#define PG_RETURN_ACLITEM_P(x)	   PG_RETURN_POINTER(x)
-
-#define DatumGetAclP(X)			   ((Acl *) PG_DETOAST_DATUM(X))
-#define DatumGetAclPCopy(X)		   ((Acl *) PG_DETOAST_DATUM_COPY(X))
-#define PG_GETARG_ACL_P(n)		   DatumGetAclP(PG_GETARG_DATUM(n))
-#define PG_GETARG_ACL_P_COPY(n)    DatumGetAclPCopy(PG_GETARG_DATUM(n))
-#define PG_RETURN_ACL_P(x)		   PG_RETURN_POINTER(x)
-
-/*
- * ACL modification opcodes for aclupdate
- */
-#define ACL_MODECHG_ADD			1
-#define ACL_MODECHG_DEL			2
-#define ACL_MODECHG_EQL			3
-
-/*
- * External representations of the privilege bits --- aclitemin/aclitemout
- * represent each possible privilege bit with a distinct 1-character code
- */
-#define ACL_INSERT_CHR			'a' /* formerly known as "append" */
-#define ACL_SELECT_CHR			'r' /* formerly known as "read" */
-#define ACL_UPDATE_CHR			'w' /* formerly known as "write" */
-#define ACL_DELETE_CHR			'd'
-#define ACL_TRUNCATE_CHR		'D' /* super-delete, as it were */
-#define ACL_REFERENCES_CHR		'x'
-#define ACL_TRIGGER_CHR			't'
-#define ACL_EXECUTE_CHR			'X'
-#define ACL_USAGE_CHR			'U'
-#define ACL_CREATE_CHR			'C'
-#define ACL_CREATE_TEMP_CHR		'T'
-#define ACL_CONNECT_CHR			'c'
-#define ACL_SET_CHR				's'
-#define ACL_ALTER_SYSTEM_CHR	'A'
-#define ACL_MAINTAIN_CHR		'm'
-
-/* string holding all privilege code chars, in order by bitmask position */
-#define ACL_ALL_RIGHTS_STR	"arwdDxtXUCTcsAm"
-
-/*
- * Bitmasks defining "all rights" for each supported object type
- */
-#define ACL_ALL_RIGHTS_COLUMN		(ACL_INSERT|ACL_SELECT|ACL_UPDATE|ACL_REFERENCES)
-#define ACL_ALL_RIGHTS_RELATION		(ACL_INSERT|ACL_SELECT|ACL_UPDATE|ACL_DELETE|ACL_TRUNCATE|ACL_REFERENCES|ACL_TRIGGER|ACL_MAINTAIN)
-#define ACL_ALL_RIGHTS_SEQUENCE		(ACL_USAGE|ACL_SELECT|ACL_UPDATE)
-#define ACL_ALL_RIGHTS_DATABASE		(ACL_CREATE|ACL_CREATE_TEMP|ACL_CONNECT)
-#define ACL_ALL_RIGHTS_FDW			(ACL_USAGE)
-#define ACL_ALL_RIGHTS_FOREIGN_SERVER (ACL_USAGE)
-#define ACL_ALL_RIGHTS_FUNCTION		(ACL_EXECUTE)
-#define ACL_ALL_RIGHTS_LANGUAGE		(ACL_USAGE)
-#define ACL_ALL_RIGHTS_LARGEOBJECT	(ACL_SELECT|ACL_UPDATE)
-#define ACL_ALL_RIGHTS_PARAMETER_ACL (ACL_SET|ACL_ALTER_SYSTEM)
-#define ACL_ALL_RIGHTS_SCHEMA		(ACL_USAGE|ACL_CREATE)
-#define ACL_ALL_RIGHTS_TABLESPACE	(ACL_CREATE)
-#define ACL_ALL_RIGHTS_TYPE			(ACL_USAGE)
-
-/* operation codes for pg_*_aclmask */
-typedef enum
-{
-	ACLMASK_ALL,				/* normal case: compute all bits */
-	ACLMASK_ANY,				/* return when result is known nonzero */
-} AclMaskHow;
-
-/* result codes for pg_*_aclcheck */

package/src/postgres/fixtures/pg-REL_18_6-aclexplode-func.txt

@@ -1,31 +0,0 @@
-# path: doc/src/sgml/func.sgml
-# blob: b57f161f53c8833c721dede3d48121490dc15f12
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-30 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the aclexplode row of "Access Privilege Inquiry Functions" (lines 25843-25867 of the full file)
-#
-       <entry role="func_table_entry"><para role="func_signature">
-        <indexterm>
-         <primary>aclexplode</primary>
-        </indexterm>
-        <function>aclexplode</function> ( <type>aclitem[]</type> )
-        <returnvalue>setof record</returnvalue>
-        ( <parameter>grantor</parameter> <type>oid</type>,
-        <parameter>grantee</parameter> <type>oid</type>,
-        <parameter>privilege_type</parameter> <type>text</type>,
-        <parameter>is_grantable</parameter> <type>boolean</type> )
-       </para>
-       <para>
-        Returns the <type>aclitem</type> array as a set of rows.
-        If the grantee is the pseudo-role PUBLIC, it is represented by zero in
-        the <parameter>grantee</parameter> column.  Each granted privilege is
-        represented as <literal>SELECT</literal>, <literal>INSERT</literal>,
-        etc (see <xref linkend="privilege-abbrevs-table"/> for a full list).
-        Note that each privilege is broken out as a separate row, so
-        only one keyword appears in the <parameter>privilege_type</parameter>
-        column.
-       </para></entry>
-      </row>
-
-      <row>
-       <entry role="func_table_entry"><para role="func_signature">

package/src/postgres/fixtures/pg-REL_18_6-alter-default-privileges-synopsis.txt

@@ -1,82 +0,0 @@
-# path: doc/src/sgml/ref/alter_default_privileges.sgml
-# blob: 6acd0f1df914c6926e6d6f5bd28b0599d66d629c
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-30 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the <synopsis> block only (lines 23-98 of the full file), cut per house doc-size convention
-#
-<synopsis>
-ALTER DEFAULT PRIVILEGES
-    [ FOR { ROLE | USER } <replaceable>target_role</replaceable> [, ...] ]
-    [ IN SCHEMA <replaceable>schema_name</replaceable> [, ...] ]
-    <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable>
-
-<phrase>where <replaceable class="parameter">abbreviated_grant_or_revoke</replaceable> is one of:</phrase>
-
-GRANT { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON TABLES
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-GRANT { { USAGE | SELECT | UPDATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON SEQUENCES
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-GRANT { EXECUTE | ALL [ PRIVILEGES ] }
-    ON { FUNCTIONS | ROUTINES }
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-GRANT { USAGE | ALL [ PRIVILEGES ] }
-    ON TYPES
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-GRANT { { USAGE | CREATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON SCHEMAS
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-GRANT { { SELECT | UPDATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON LARGE OBJECTS
-    TO { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...] [ WITH GRANT OPTION ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { { SELECT | INSERT | UPDATE | DELETE | TRUNCATE | REFERENCES | TRIGGER | MAINTAIN }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON TABLES
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { { USAGE | SELECT | UPDATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON SEQUENCES
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { EXECUTE | ALL [ PRIVILEGES ] }
-    ON { FUNCTIONS | ROUTINES }
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { USAGE | ALL [ PRIVILEGES ] }
-    ON TYPES
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { { USAGE | CREATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON SCHEMAS
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-
-REVOKE [ GRANT OPTION FOR ]
-    { { SELECT | UPDATE }
-    [, ...] | ALL [ PRIVILEGES ] }
-    ON LARGE OBJECTS
-    FROM { [ GROUP ] <replaceable class="parameter">role_name</replaceable> | PUBLIC } [, ...]
-    [ CASCADE | RESTRICT ]
-</synopsis>

package/src/postgres/fixtures/pg-REL_18_6-alter_role.sgml.txt

@@ -1,44 +0,0 @@
-# path: doc/src/sgml/ref/alter_role.sgml
-# blob: 7b0a04bc4637c7c08246e597a9acf4466b467fa2
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-29 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the <synopsis> block plus the memberships sentence the GRANT/REVOKE design leans on; blob SHA is the full upstream file
-#
-<synopsis>
-ALTER ROLE <replaceable class="parameter">role_specification</replaceable> [ WITH ] <replaceable class="parameter">option</replaceable> [ ... ]
-
-<phrase>where <replaceable class="parameter">option</replaceable> can be:</phrase>
-
-      SUPERUSER | NOSUPERUSER
-    | CREATEDB | NOCREATEDB
-    | CREATEROLE | NOCREATEROLE
-    | INHERIT | NOINHERIT
-    | LOGIN | NOLOGIN
-    | REPLICATION | NOREPLICATION
-    | BYPASSRLS | NOBYPASSRLS
-    | CONNECTION LIMIT <replaceable class="parameter">connlimit</replaceable>
-    | [ ENCRYPTED ] PASSWORD '<replaceable class="parameter">password</replaceable>' | PASSWORD NULL
-    | VALID UNTIL '<replaceable class="parameter">timestamp</replaceable>'
-
-ALTER ROLE <replaceable class="parameter">name</replaceable> RENAME TO <replaceable>new_name</replaceable>
-
-ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | ALL } [ IN DATABASE <replaceable class="parameter">database_name</replaceable> ] SET <replaceable>configuration_parameter</replaceable> { TO | = } { <replaceable>value</replaceable> | DEFAULT }
-ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | ALL } [ IN DATABASE <replaceable class="parameter">database_name</replaceable> ] SET <replaceable>configuration_parameter</replaceable> FROM CURRENT
-ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | ALL } [ IN DATABASE <replaceable class="parameter">database_name</replaceable> ] RESET <replaceable>configuration_parameter</replaceable>
-ALTER ROLE { <replaceable class="parameter">role_specification</replaceable> | ALL } [ IN DATABASE <replaceable class="parameter">database_name</replaceable> ] RESET ALL
-
-<phrase>where <replaceable class="parameter">role_specification</replaceable> can be:</phrase>
-
-    <replaceable class="parameter">role_name</replaceable>
-  | CURRENT_ROLE
-  | CURRENT_USER
-  | SESSION_USER
-</synopsis>
-
-The first variant of this command listed in the synopsis can change
-   many of the role attributes that can be specified in
-   <link linkend="sql-createrole"><command>CREATE ROLE</command></link>.
-   (All the possible attributes are covered,
-   except that there are no options for adding or removing memberships; use
-   <link linkend="sql-grant"><command>GRANT</command></link> and
-   <link linkend="sql-revoke"><command>REVOKE</command></link> for that.)

package/src/postgres/fixtures/pg-REL_18_6-create-database-synopsis.txt

@@ -1,26 +0,0 @@
-# path: doc/src/sgml/ref/create_database.sgml
-# blob: 4da8aeebb50a29e89bd9f68a8deac4b1a3ec7b18
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-23 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the <synopsis> block only (lines 23-42 of the full file), cut per house doc-size convention
-#
-<synopsis>
-CREATE DATABASE <replaceable class="parameter">name</replaceable>
-    [ WITH ] [ OWNER [=] <replaceable class="parameter">user_name</replaceable> ]
-           [ TEMPLATE [=] <replaceable class="parameter">template</replaceable> ]
-           [ ENCODING [=] <replaceable class="parameter">encoding</replaceable> ]
-           [ STRATEGY [=] <replaceable class="parameter">strategy</replaceable> ]
-           [ LOCALE [=] <replaceable class="parameter">locale</replaceable> ]
-           [ LC_COLLATE [=] <replaceable class="parameter">lc_collate</replaceable> ]
-           [ LC_CTYPE [=] <replaceable class="parameter">lc_ctype</replaceable> ]
-           [ BUILTIN_LOCALE [=] <replaceable class="parameter">builtin_locale</replaceable> ]
-           [ ICU_LOCALE [=] <replaceable class="parameter">icu_locale</replaceable> ]
-           [ ICU_RULES [=] <replaceable class="parameter">icu_rules</replaceable> ]
-           [ LOCALE_PROVIDER [=] <replaceable class="parameter">locale_provider</replaceable> ]
-           [ COLLATION_VERSION = <replaceable>collation_version</replaceable> ]
-           [ TABLESPACE [=] <replaceable class="parameter">tablespace_name</replaceable> ]
-           [ ALLOW_CONNECTIONS [=] <replaceable class="parameter">allowconn</replaceable> ]
-           [ CONNECTION LIMIT [=] <replaceable class="parameter">connlimit</replaceable> ]
-           [ IS_TEMPLATE [=] <replaceable class="parameter">istemplate</replaceable> ]
-           [ OID [=] <replaceable class="parameter">oid</replaceable> ]
-</synopsis>

package/src/postgres/fixtures/pg-REL_18_6-create_role.sgml.txt

@@ -1,26 +0,0 @@
-# path: doc/src/sgml/ref/create_role.sgml
-# blob: cee23b1ea6b4dcf2d9d356d07a582e64808c2912
-# tag: REL_18_6 (commit 724edf9bde9d356724ad384a2e196edc3c9f80f7)
-# fetched: 2026-09-29 via gh api repos/postgres/postgres/contents/...?ref=724edf9bde9d356724ad384a2e196edc3c9f80f7
-# excerpt: the <synopsis> block only (the provenance test reads the option list); blob SHA is the full upstream file
-#
-<synopsis>
-CREATE ROLE <replaceable class="parameter">name</replaceable> [ [ WITH ] <replaceable class="parameter">option</replaceable> [ ... ] ]
-
-<phrase>where <replaceable class="parameter">option</replaceable> can be:</phrase>
-
-      SUPERUSER | NOSUPERUSER
-    | CREATEDB | NOCREATEDB
-    | CREATEROLE | NOCREATEROLE
-    | INHERIT | NOINHERIT
-    | LOGIN | NOLOGIN
-    | REPLICATION | NOREPLICATION
-    | BYPASSRLS | NOBYPASSRLS
-    | CONNECTION LIMIT <replaceable class="parameter">connlimit</replaceable>
-    | [ ENCRYPTED ] PASSWORD '<replaceable class="parameter">password</replaceable>' | PASSWORD NULL
-    | VALID UNTIL '<replaceable class="parameter">timestamp</replaceable>'
-    | IN ROLE <replaceable class="parameter">role_name</replaceable> [, ...]
-    | ROLE <replaceable class="parameter">role_name</replaceable> [, ...]
-    | ADMIN <replaceable class="parameter">role_name</replaceable> [, ...]
-    | SYSID <replaceable class="parameter">uid</replaceable>
-</synopsis>