@everystack/server 0.4.28 → 0.4.30

package/CHANGELOG.md

@@ -4,6 +4,30 @@ All notable changes to `@everystack/server` are documented here.
 
 Format based on [Keep a Changelog](https://keepachangelog.com/).
 
+## [0.4.30] - 2026-09-04
+
+### Fixed
+
+- ADOPT resolves its master from ADMIN_DATABASE_URL on a BYO/external RDS
+
+## [0.4.29] - 2026-09-04
+
+### Added
+
+- ENACT core for brownfield ownership — PG16 guard + owner-grant router
+- wire ENACT into runProvision + master-connection dep (B2, B3, BV)
+- ADOPT semantic audit + confirm gate (B4a, B4c core)
+- ADOPT reassignment planner + pre-flight (B4 core)
+- wire ADOPT into runProvision — master-only, confirm-gated, one transaction (B4, B4c)
+- wire the master connection into the db:provision ops action (B6, server half)
+
+### Fixed
+
+- BLOCKER A — reorder ownership convergence AFTER the secret write
+- BLOCKER B — master SELF-GRANTS SET on the declared owner (RDS split now works)
+- BLOCKER C — the confirm gate reads LIVE facts, not declared
+- round-2 BLOCKER-1 — run ownership convergence on the credentials no-op path too
+
 ## [0.4.28] - 2026-09-02
 
 ### Added
@@ -21,6 +45,18 @@ Format based on [Keep a Changelog](https://keepachangelog.com/).
 
 - delete the orphaned recompile-descent helpers, rewire the illusion of coverage (F1)
 
+## [0.4.27] - 2026-08-22
+
+### Added
+
+- auto-generated changelogs from conventional commits
+
+### Fixed
+
+- db:provision is additive-only — never reset an existing role's password
+- address closing-gate review — pin ordering, guard half-done recovery
+- address Fable red-team — rotated-stage guard, safe polarity
+
 ## [0.4.26] - 2026-08-15
 
 ### Fixed

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@everystack/server",
-  "version": "0.4.28",
+  "version": "0.4.30",
   "description": "Server runtime primitives for Lambda — event adapters, routing, SSR, image processing",
   "license": "AGPL-3.0-only",
   "author": "Scalable Technology, Inc. <licensing@scalable.technology>",
@@ -187,8 +187,8 @@
     "sst": "4.13.1",
     "ts-jest": "29.4.9",
     "typescript": "5.9.3",
-    "@everystack/cli": "0.4.70",
-    "@everystack/auth": "0.4.4"
+    "@everystack/auth": "0.4.4",
+    "@everystack/cli": "0.4.71"
   },
   "scripts": {
     "test": "jest",

package/src/db.ts

@@ -150,6 +150,26 @@ export function getOperatorDatabaseUrl(): { url: string; source: 'admin' | 'mast
   return null;
 }
 
+/**
+ * The connection ADOPT (ownership reassignment) runs on: the linked SST Postgres master when one is
+ * present, else the `ADMIN_DATABASE_URL` operator secret.
+ *
+ * A brownfield / external-RDS app — the exact `db:pull --abilities live` audience — has NO linked
+ * `sst.aws.Postgres` component. It wires the database as secrets, and its `ADMIN_DATABASE_URL` is a
+ * privileged operator (commonly BYPASSRLS and a member of `postgres`, i.e. master-capable) that the
+ * ops Lambda already carries. Resolving ADOPT's master ONLY through the component dead-ended those
+ * apps on the missing component. This falls back to the admin secret so ADOPT has a connection to
+ * try. Whether that connection can ACTUALLY reassign is NOT decided here — ADOPT's live
+ * `master_can_act` probe decides it: a least-privilege admin resolves but the probe then refuses
+ * precisely (naming the grant to run), while a master-capable admin proceeds.
+ *
+ * `master` (linked component) is preferred because its presence guarantees master capability; the
+ * admin fallback is probe-gated. Never the least-privilege `DATABASE_URL`.
+ */
+export function getAdoptMasterUrl(): string | null {
+  return getMasterDatabaseUrl() ?? getAdminDatabaseUrl();
+}
+
 export function getJwtSecret(): Uint8Array {
   // PascalCase Secret (SST_RESOURCE_JwtSecret → { value })
   const pascal = sstLink('JwtSecret')?.value as string | undefined;

package/src/owner-adoption.ts

@@ -0,0 +1,307 @@
+/**
+ * owner-adoption — the ADOPT half of brownfield ownership convergence (Gap 2).
+ *
+ * A brownfield database's functions/views were created by the old tool AS the RDS master
+ * (`postgres`), not as the operator or the declared owner. The least-privilege operator cannot
+ * `CREATE OR REPLACE` an object it does not own, so db:reconcile refuses "must be owner". ADOPT
+ * reassigns each object the Models DECLARE to its declared owner — but this must run on the MASTER
+ * connection (PostgreSQL 16 `ALTER ... OWNER TO` needs the runner to be a member of the CURRENT
+ * owner, and giving the operator INHERIT membership in `postgres` would make it the master — the
+ * one thing the whole least-privilege design forbids).
+ *
+ * ADOPT IS A RUNTIME BEHAVIOR CHANGE, NOT COSMETIC HARDENING. A SECURITY DEFINER function owned by
+ * `postgres` executes with the master's rights; reassigning its owner flips the runs-as identity
+ * AT CALL TIME (not at ALTER time — the ALTER is always green). A view's underlying-table checks
+ * run as its owner. So ADOPT is gated (`--confirm` + a printed manifest) for exactly the objects
+ * whose semantics change, and the pre-adopt SEMANTIC AUDIT below flags where a capability is lost.
+ *
+ * THE AUDIT IS HEURISTIC BY NECESSITY, and says so. PostgreSQL does not track which tables an
+ * opaque function body (a SQL/plpgsql source string) references, so "check every referenced table"
+ * is not precisely realizable. What IS precise is the ATTRIBUTE DELTA — a superuser/BYPASSRLS
+ * current owner handing to an owner that is neither is a real, certain capability loss. The body
+ * regex and the schema-wide privilege gap are WARNINGS, not guarantees. The audit never claims an
+ * object is safe; it names what it can prove and warns where it cannot.
+ *
+ * This module is pure. runProvision wires the live catalog reads (role attributes, the privilege
+ * gap) and applies the reassignment in one transaction on the master.
+ */
+
+/** One object to (possibly) reassign. `body` is the function source, absent for views/matviews. */
+export interface Adoptee {
+  /** Reassign target: `api.foo(integer)` for a function, `api.v_report` for a view/matview. */
+  identity: string;
+  schema: string;
+  name: string;
+  kind: 'function' | 'view' | 'materialized view';
+  /** SECURITY DEFINER — functions only; always false for a view/matview. */
+  secdef: boolean;
+  /** The live owner (e.g. `postgres`). */
+  currentOwner: string;
+  /** The owner the Models declare. */
+  declaredOwner: string;
+  body?: string;
+}
+
+/** The cluster attributes of a role that decide what its owned objects can do. */
+export interface RoleAttrs {
+  superuser: boolean;
+  bypassRls: boolean;
+}
+
+export interface AdoptionFinding {
+  /**
+   * capability-drop — PRECISE: a superuser current owner hands to a non-superuser; superuser-only
+   *   body operations will fail at call time.
+   * rls-filtering — PRECISE: the runs-as identity loses RLS bypass; cross-owner reads may silently
+   *   return filtered rows.
+   * superuser-op — WARNING: the body matches a superuser-only operation (regex, may false-positive).
+   * privilege-gap — WARNING: the declared owner lacks privileges on some app tables; an adopted
+   *   object that touches one fails at call time (which tables it touches is not knowable here).
+   */
+  severity: 'capability-drop' | 'rls-filtering' | 'superuser-op' | 'privilege-gap';
+  identity: string;
+  detail: string;
+}
+
+/**
+ * Body operations that need superuser and will fail as a non-superuser owner. A WARNING signal —
+ * a regex over the source, so it can match text in a comment or string. Never a guarantee; it
+ * points a human at a body to read, which is the audit Fable calls the real work.
+ */
+const SUPERUSER_OP_RE =
+  /\b(pg_terminate_backend|pg_read_file|pg_read_binary_file|pg_ls_dir|pg_stat_file|lo_import|lo_export|COPY\s+.*\s+FROM\s+PROGRAM|CREATE\s+ROLE|CREATE\s+USER|ALTER\s+SYSTEM)\b/i;
+
+/** Only objects whose owner actually changes are adopted; the rest are already correct. */
+export function needsReassignment(a: Adoptee): boolean {
+  return a.currentOwner !== a.declaredOwner;
+}
+
+/**
+ * The pre-adopt semantic audit. `attrs` carries the cluster attributes of every current and
+ * declared owner named. `tableGaps[owner]` lists app tables that owner cannot access at all — the
+ * informational "where a SECDEF body could fail" set, or undefined when not probed.
+ *
+ * Findings are ordered precise-first so a manifest leads with what is certain.
+ */
+export function auditAdoption(
+  adoptees: Adoptee[],
+  attrs: Record<string, RoleAttrs>,
+  tableGaps: Record<string, string[]> = {},
+): AdoptionFinding[] {
+  const findings: AdoptionFinding[] = [];
+  for (const a of adoptees) {
+    if (!needsReassignment(a)) continue;
+    // A view/matview runs its underlying-table checks as its owner; a SECDEF function runs its
+    // whole body as its owner. An INVOKER function runs as its caller, so its owner change carries
+    // no runtime semantics — it is reassigned, but not audited for capability loss.
+    const runsAsOwner = a.kind !== 'function' || a.secdef;
+    if (!runsAsOwner) continue;
+
+    const cur = attrs[a.currentOwner];
+    const decl = attrs[a.declaredOwner];
+
+    if (cur?.superuser && !decl?.superuser) {
+      findings.push({ severity: 'capability-drop', identity: a.identity,
+        detail: `runs-as flips from superuser '${a.currentOwner}' to '${a.declaredOwner}' — any superuser-only operation in the body fails at CALL time (the ALTER is green regardless).` });
+    }
+    if ((cur?.superuser || cur?.bypassRls) && !decl?.bypassRls) {
+      findings.push({ severity: 'rls-filtering', identity: a.identity,
+        detail: `loses RLS bypass ('${a.currentOwner}' had it, '${a.declaredOwner}' does not) — reads across owners may now return FILTERED rows silently, not an error.` });
+    }
+    if (a.body && SUPERUSER_OP_RE.test(a.body)) {
+      const m = a.body.match(SUPERUSER_OP_RE);
+      findings.push({ severity: 'superuser-op', identity: a.identity,
+        detail: `body references '${m?.[0]}', which needs superuser — review whether '${a.declaredOwner}' can run it (heuristic: this is a text match, verify by reading the body).` });
+    }
+    const gaps = tableGaps[a.declaredOwner];
+    if (gaps?.length) {
+      findings.push({ severity: 'privilege-gap', identity: a.identity,
+        detail: `'${a.declaredOwner}' lacks privileges on ${gaps.length} app table(s) (e.g. ${gaps.slice(0, 3).join(', ')}) — if this object touches one it fails at call time (which tables it touches is not knowable from the catalog).` });
+    }
+  }
+  return findings;
+}
+
+/** One object that will actually reassign, with the LIVE facts the confirm gate keys on. */
+export interface Reassignment {
+  kind: Adoptee['kind'];
+  /** SECURITY DEFINER as the model DECLARES it. */
+  declaredSecdef: boolean;
+  /** SECURITY DEFINER as the object is RIGHT NOW (probed). A live-SECDEF/declared-INVOKER function
+   *  still runs as its owner until db:reconcile replaces the body — so the gate must see this. */
+  liveSecdef: boolean;
+  declaredOwner: string;
+}
+
+/**
+ * Whether ADOPT requires `--confirm`, keyed on LIVE facts (Fable BLOCKER C — the declared attribute
+ * is not enough). Confirm when a reassignment changes the runs-as identity or hands ownership to a
+ * powerful role:
+ *   - a view or matview (its underlying-table checks run as the owner), OR
+ *   - a function that is SECURITY DEFINER either as declared OR as it lives right now, OR
+ *   - any object whose declared owner is LIVE superuser / BYPASSRLS (handing ownership escalates).
+ * A plain invoker function to an ordinary owner needs no confirm. Empty → false.
+ */
+export function requiresConfirm(reassignments: Reassignment[], attrs: Record<string, RoleAttrs> = {}): boolean {
+  return reassignments.some((r) => {
+    if (r.kind !== 'function') return true;
+    if (r.declaredSecdef || r.liveSecdef) return true;
+    const target = attrs[r.declaredOwner];
+    return !!(target?.superuser || target?.bypassRls);
+  });
+}
+
+/**
+ * Live catalog facts about one candidate object, read on the MASTER before any ALTER — the
+ * pre-flight that turns a mid-batch Postgres error into a precise refusal.
+ */
+export interface AdopteeProbe {
+  identity: string;
+  /** The object is present in the catalog. Absent → nothing to adopt (reconcile will create it). */
+  exists: boolean;
+  /** prokind/relkind matches the declared kind. `ALTER VIEW` on a matview ERRORS — refuse first. */
+  kindMatches: boolean;
+  /** The LIVE SECURITY DEFINER flag (pg_proc.prosecdef; false for views/matviews). The gate keys on
+   *  this AND the declared flag — a live-SECDEF function declared INVOKER still flips runs-as now. */
+  liveSecdef: boolean;
+  /** The object's real current owner (trusted over the declared guess). */
+  liveOwner: string;
+  /** An extension owns this object (pg_depend deptype='e'). Its OID binds to the extension — never reassign. */
+  isExtensionMember: boolean;
+  /** The declared owner role exists (ADOPT never invents one). */
+  declaredOwnerExists: boolean;
+  /**
+   * PG16 `ALTER … OWNER TO` needs the runner (the master) to hold the privileges of the CURRENT
+   * owner (to give the object away) AND be able to SET ROLE to the DECLARED owner (to receive it).
+   * These are the two conjuncts, read separately so a refusal names the RIGHT one — and because they
+   * fail for different, differently-fixable reasons on a non-superuser RDS master.
+   */
+  masterPrivsOfCurrent: boolean;
+  masterCanSetDeclared: boolean;
+  /**
+   * The master holds ADMIN OPTION on the declared owner (or is a superuser) — so when it cannot yet
+   * SET ROLE to it, ADOPT can self-grant `GRANT <declaredOwner> TO CURRENT_USER WITH SET TRUE` inside
+   * its own transaction rather than refuse. ENACT grants the declared owner to the OPERATOR, never
+   * the master, so on a genuine RDS split this self-grant is what makes the master able to adopt.
+   */
+  masterAdminOfDeclared: boolean;
+}
+
+const OWNER_IDENT = /^[a-z_][a-z0-9_]*$/;
+const KEYWORD: Record<Adoptee['kind'], string> = {
+  function: 'FUNCTION', view: 'VIEW', 'materialized view': 'MATERIALIZED VIEW',
+};
+const RELKIND: Record<Adoptee['kind'], string> = { function: 'f', view: 'v', 'materialized view': 'm' };
+
+/** A SQL single-quoted literal, doubling embedded quotes. */
+function lit(value: string): string {
+  return `'${value.replace(/'/g, "''")}'`;
+}
+
+/**
+ * The live pre-flight probe, read on the MASTER. One row per adoptee via UNION ALL. Uses
+ * `to_regprocedure`/`to_regclass`, which return NULL (never an error) for an absent object, so the
+ * probe reports `exists=false` rather than throwing mid-batch.
+ *
+ * The two PG16 `ALTER … OWNER TO` conjuncts are read SEPARATELY (privs of the current owner; SET on
+ * the declared owner), plus whether the master holds ADMIN on the declared owner so ADOPT can
+ * self-grant the missing SET. A REAL superuser satisfies all three. On RDS nobody is a real
+ * superuser, so memberships decide it — read from the catalog, never assumed (Fable). The owner's
+ * CREATE on the schema is ENACT's precondition (ENACT runs before ADOPT), not re-checked here.
+ */
+export function adopteeProbeSql(adoptees: Adoptee[]): string {
+  const selects = adoptees.map((a) => {
+    const isFn = a.kind === 'function';
+    // `o` is the catalog row; `reg` resolves the OID without erroring on absence.
+    const regExpr = isFn ? `to_regprocedure(${lit(a.identity)})` : `to_regclass(${lit(a.identity)})`;
+    const catalog = isFn ? 'pg_proc' : 'pg_class';
+    const ownerCol = isFn ? 'o.proowner' : 'o.relowner';
+    const kindCol = isFn ? `(o.prokind = 'f')` : `(o.relkind = '${RELKIND[a.kind]}')`;
+    const superExpr = `(SELECT b.rolsuper FROM pg_roles b WHERE b.rolname = CURRENT_USER)`;
+    const decl = lit(a.declaredOwner);
+    return `
+SELECT
+  ${lit(a.identity)} AS identity,
+  (o.oid IS NOT NULL) AS exists,
+  COALESCE(${kindCol}, false) AS kind_matches,
+  COALESCE(${isFn ? 'o.prosecdef' : 'false'}, false) AS live_secdef,
+  COALESCE(pg_get_userbyid(${ownerCol}), '') AS live_owner,
+  COALESCE((SELECT true FROM pg_depend d WHERE d.objid = o.oid AND d.deptype = 'e' LIMIT 1), false) AS is_extension_member,
+  EXISTS (SELECT 1 FROM pg_roles WHERE rolname = ${decl}) AS declared_owner_exists,
+  COALESCE(${superExpr} OR pg_has_role(CURRENT_USER, ${ownerCol}, 'USAGE'), false) AS master_privs_of_current,
+  COALESCE(${superExpr} OR pg_has_role(CURRENT_USER, ${decl}, 'SET'), false) AS master_can_set_declared,
+  COALESCE(${superExpr} OR (SELECT m.admin_option FROM pg_auth_members m JOIN pg_roles r2 ON r2.oid = m.roleid
+     WHERE r2.rolname = ${decl} AND m.member = (SELECT oid FROM pg_roles WHERE rolname = CURRENT_USER)), false) AS master_admin_of_declared
+FROM (SELECT ${regExpr} AS oid) reg
+LEFT JOIN ${catalog} o ON o.oid = reg.oid`.trim();
+  });
+  return selects.join('\nUNION ALL\n');
+}
+
+export interface AdoptionPlan {
+  /** `ALTER ... OWNER TO ...` statements, applied on the master in ONE transaction. */
+  statements: string[];
+  /** The adoptees each statement moves, in order — for the manifest and the schema_log record. */
+  reassigned: Adoptee[];
+  /** Precise pre-flight refusals — nothing is applied if this is non-empty (all or nothing). */
+  refusals: string[];
+}
+
+/**
+ * Turn declared objects + their live probes into the reassignment plan. Only objects that EXIST
+ * and are mis-owned are moved; a declared object that is absent is left for reconcile to create
+ * owned correctly. Every object is checked — exists, kind, not-extension, declared owner present,
+ * master can act — BEFORE any statement, so the caller applies the whole set or refuses the whole
+ * set. A refusal names the exact obstacle; it is never a raw error from the middle of an ALTER.
+ */
+export function planAdoptionReassignment(adoptees: Adoptee[], probes: AdopteeProbe[]): AdoptionPlan {
+  const byId = new Map(probes.map((p) => [p.identity, p]));
+  const alters: string[] = [];
+  const selfGrants = new Set<string>(); // one per declared owner the master must self-grant SET on
+  const plan: AdoptionPlan = { statements: [], reassigned: [], refusals: [] };
+
+  for (const a of adoptees) {
+    const p = byId.get(a.identity);
+    if (!p || !p.exists) continue; // not in the DB — reconcile creates it owned correctly, nothing to adopt
+    if (p.liveOwner === a.declaredOwner) continue; // already correct
+    if (p.isExtensionMember) {
+      plan.refusals.push(`${a.identity}: owned by an extension — never reassigned (its OID binds to the extension).`);
+      continue;
+    }
+    if (!p.kindMatches) {
+      plan.refusals.push(`${a.identity}: declared as ${a.kind} but the live object is a different kind — refusing before ALTER ${KEYWORD[a.kind]} errors on it.`);
+      continue;
+    }
+    if (!p.declaredOwnerExists) {
+      plan.refusals.push(`${a.identity}: declared owner '${a.declaredOwner}' does not exist — ADOPT never invents a role. CREATE ROLE ${a.declaredOwner} NOLOGIN; then re-run.`);
+      continue;
+    }
+    if (!OWNER_IDENT.test(a.declaredOwner)) {
+      plan.refusals.push(`${a.identity}: invalid declared owner name ${JSON.stringify(a.declaredOwner)}.`);
+      continue;
+    }
+    // PG16 ALTER … OWNER TO needs BOTH conjuncts. Name the failing one precisely (the two fail for
+    // different reasons and have different fixes), and try to self-heal the SET conjunct.
+    if (!p.masterPrivsOfCurrent) {
+      plan.refusals.push(`${a.identity}: the master lacks the privileges of the current owner '${p.liveOwner}' — it cannot give the object away. As a role that can:  GRANT ${p.liveOwner} TO <master>;  then re-run.`);
+      continue;
+    }
+    if (!p.masterCanSetDeclared) {
+      // ENACT grants the declared owner to the OPERATOR, not the master — so on the real RDS split
+      // the master arrives here without SET on the declared owner. If it holds ADMIN on that owner
+      // it self-grants SET inside the transaction; otherwise it is a precise refusal naming THIS
+      // conjunct (not the current-owner one), with the fix.
+      if (p.masterAdminOfDeclared) {
+        selfGrants.add(`GRANT ${a.declaredOwner} TO CURRENT_USER WITH SET TRUE, INHERIT FALSE`);
+      } else {
+        plan.refusals.push(`${a.identity}: the master cannot SET ROLE to the declared owner '${a.declaredOwner}' and lacks ADMIN OPTION on it to grant itself. As a role with admin on '${a.declaredOwner}':  GRANT ${a.declaredOwner} TO <master> WITH SET TRUE;  then re-run.`);
+        continue;
+      }
+    }
+    alters.push(`ALTER ${KEYWORD[a.kind]} ${a.identity} OWNER TO ${a.declaredOwner}`);
+    plan.reassigned.push({ ...a, currentOwner: p.liveOwner });
+  }
+  // Self-grants first (they make the SET conjunct true), then the reassignments — one transaction.
+  plan.statements = [...selfGrants, ...alters];
+  return plan;
+}

package/src/owner-enactment.ts

@@ -0,0 +1,231 @@
+/**
+ * owner-enactment — the ENACT half of brownfield ownership convergence (Gap 1).
+ *
+ * The reconciler (db:reconcile) runs its DDL as the least-privilege operator (`migrator`),
+ * creating each function/view AS its declared owner under `SET ROLE`. That needs two grants the
+ * operator does not hold on a fresh or brownfield database, and which db:reconcile can only
+ * REFUSE with (ownerPreflightRefusal prints the fix SQL, nothing applies it):
+ *
+ *   1. `GRANT <owner> TO <operator> WITH INHERIT FALSE, SET TRUE` — so the operator may assume
+ *      the owner. INHERIT FALSE is deliberate: the operator becomes the owner only under an
+ *      explicit SET ROLE, never inheriting the owner's privileges ambiently.
+ *   2. `GRANT CREATE ON SCHEMA <schema> TO <owner>` — so the CREATE, which runs AS the owner,
+ *      can place the object.
+ *
+ * These are privileged, idempotent SETUP — the same category as the role chain — so they belong
+ * in db:provision, not in the least-privilege reconcile lane (which structurally cannot run them).
+ * This module is the PURE core: a probe (read) and a router that turns probe rows into the exact
+ * statements, each routed to the connection that can run it — the operator's own connection where
+ * it holds the grant right, the master where it does not, and a REFUSAL carrying runnable SQL
+ * where neither can. Nothing here opens a connection; runProvision wires the two live probes.
+ *
+ * IDEMPOTENCE is by construction, not by DO-guards: a statement is emitted ONLY when its guard is
+ * unmet (the operator cannot yet SET ROLE the owner; the owner cannot yet CREATE in the schema).
+ * A re-run, where both are satisfied, emits nothing.
+ *
+ * Owner ROLES are never invented — an absent owner is refused with `CREATE ROLE ... NOLOGIN`, the
+ * same rule the reconcile preflight holds: a security principal minted by a tool arrives with no
+ * memberships, no grants, and no review.
+ */
+
+/** PostgreSQL 16 — the first version with `GRANT ... WITH INHERIT FALSE, SET TRUE` and role `SET` membership. */
+export const MIN_SERVER_VERSION_NUM = 160000;
+
+/**
+ * The version refusal, or null when the server is new enough.
+ *
+ * Below 16 the `WITH INHERIT FALSE, SET TRUE` grammar and `pg_has_role(..., 'SET')` do not exist;
+ * the nearest equivalent is a global `NOINHERIT` on the operator, which changes EVERY other
+ * inherited grant it holds — a design fork, not a syntax swap. Provision refuses rather than
+ * silently taking a different, wider action. `server_version_num` is Postgres's own integer form
+ * (e.g. 160004 for 16.4).
+ */
+export function pgVersionRefusal(serverVersionNum: number): string | null {
+  if (serverVersionNum >= MIN_SERVER_VERSION_NUM) return null;
+  const major = Math.floor(serverVersionNum / 10000);
+  return (
+    `owner enactment needs PostgreSQL >= 16 (this server reports ${major}). ` +
+    `The 'WITH INHERIT FALSE, SET TRUE' membership grant and role-level SET privilege are 16+; ` +
+    `below 16 the equivalent is a global NOINHERIT on the operator, which changes every other ` +
+    `inherited grant it holds — a different action provision will not take silently.`
+  );
+}
+
+/** One declared owner and the schema(s) its objects live in — the enactment input. */
+export interface DeclaredOwner {
+  owner: string;
+  schema: string;
+}
+
+/**
+ * The connection-independent facts about one (owner, schema), read once on either connection.
+ * "Can the operator already assume the owner?" and "can the owner already create in the schema?"
+ * are properties of the catalog, not of who is asking.
+ */
+export interface OwnerFactRow {
+  owner: string;
+  schema: string;
+  /** The owner role exists in the cluster. Absent → refuse, never invent. */
+  roleExists: boolean;
+  /** The schema exists. A CREATE grant on an absent schema cannot be written yet. */
+  schemaExists: boolean;
+  /** The operator can already `SET ROLE <owner>` — no membership grant needed. */
+  canSetRole: boolean;
+  /** The owner already holds `CREATE` on the schema — no create grant needed. */
+  ownerCanCreate: boolean;
+}
+
+/**
+ * What ONE connection can grant, per (owner, schema) — read on that connection with CURRENT_USER.
+ * Whether this connection can `GRANT <owner> TO <operator>` (it holds ADMIN OPTION on the owner,
+ * or is a superuser) and whether it can `GRANT CREATE ON SCHEMA <schema> TO <owner>` (it owns the
+ * schema or holds CREATE WITH GRANT OPTION, or is a superuser).
+ */
+export interface GranterCapabilityRow {
+  owner: string;
+  schema: string;
+  canGrantMembership: boolean;
+  canGrantCreate: boolean;
+}
+
+/** The routed enactment: statements the operator runs, statements the master must run, and refusals. */
+export interface EnactmentPlan {
+  /** Runnable on the operator's own connection. */
+  asOperator: string[];
+  /** Must run on the master connection (the operator lacks the grant right). */
+  asMaster: string[];
+  /** Neither connection can enact this — each line is a human-readable refusal carrying the fix SQL. */
+  refusals: string[];
+}
+
+const IDENT = /^[a-z_][a-z0-9_]*$/;
+function assertIdent(name: string, what: string): void {
+  if (!IDENT.test(name)) throw new Error(`Invalid ${what}: ${JSON.stringify(name)} — must match ${IDENT}`);
+}
+
+/**
+ * The connection-independent probe: for each (owner, schema), does the owner exist, does the
+ * schema exist, can `operator` already SET ROLE the owner, and does the owner already hold CREATE.
+ * `has_schema_privilege` throws on an absent schema, so the schema is LEFT JOINed and the privilege
+ * is evaluated only when the schema is really there. Run once, on either connection.
+ */
+export function ownerFactsSql(owners: DeclaredOwner[], operator: string): string {
+  assertIdent(operator, 'operator');
+  const pairs = owners.map((o) => {
+    assertIdent(o.owner, 'owner');
+    assertIdent(o.schema, 'schema');
+    return `('${o.owner}', '${o.schema}')`;
+  });
+  return `
+WITH declared(owner_name, schema_name) AS (VALUES ${pairs.join(', ')})
+SELECT
+  d.owner_name AS owner,
+  d.schema_name AS schema,
+  (r.oid IS NOT NULL) AS role_exists,
+  (n.oid IS NOT NULL) AS schema_exists,
+  CASE WHEN r.oid IS NULL THEN false ELSE pg_has_role('${operator}', r.oid, 'SET') END AS can_set_role,
+  CASE WHEN r.oid IS NULL OR n.oid IS NULL THEN false
+       ELSE has_schema_privilege(r.oid, n.oid, 'CREATE') END AS owner_can_create
+FROM declared d
+LEFT JOIN pg_roles r ON r.rolname = d.owner_name
+LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
+ORDER BY d.owner_name, d.schema_name
+`.trim();
+}
+
+/**
+ * The connection-DEPENDENT probe: run on a connection to learn what CURRENT_USER can grant.
+ * Can it `GRANT <owner> TO <operator>` — it holds ADMIN OPTION on the owner (pg_auth_members), or
+ * is a superuser (RDS: a member of rds_superuser). Can it `GRANT CREATE ON SCHEMA <schema>` — it
+ * owns the schema, holds CREATE WITH GRANT OPTION, or is a superuser. Run on the operator's
+ * connection and, when present, on the master's; the router merges the two.
+ */
+export function granterCapabilitySql(owners: DeclaredOwner[]): string {
+  const pairs = owners.map((o) => {
+    assertIdent(o.owner, 'owner');
+    assertIdent(o.schema, 'schema');
+    return `('${o.owner}', '${o.schema}')`;
+  });
+  return `
+WITH declared(owner_name, schema_name) AS (VALUES ${pairs.join(', ')}),
+me AS (
+  SELECT b.oid, (b.rolsuper OR EXISTS (
+    SELECT 1 FROM pg_auth_members m JOIN pg_roles g ON g.oid = m.roleid
+    WHERE m.member = b.oid AND g.rolname = 'rds_superuser'
+  )) AS is_super
+  FROM pg_roles b WHERE b.rolname = CURRENT_USER
+)
+SELECT
+  d.owner_name AS owner,
+  d.schema_name AS schema,
+  (me.is_super OR EXISTS (
+    SELECT 1 FROM pg_auth_members m
+    WHERE m.roleid = r.oid AND m.member = me.oid AND m.admin_option
+  )) AS can_grant_membership,
+  (me.is_super OR n.nspowner = me.oid
+     OR has_schema_privilege(me.oid, n.oid, 'CREATE WITH GRANT OPTION')) AS can_grant_create
+FROM declared d
+CROSS JOIN me
+LEFT JOIN pg_roles r ON r.rolname = d.owner_name
+LEFT JOIN pg_namespace n ON n.nspname = d.schema_name
+ORDER BY d.owner_name, d.schema_name
+`.trim();
+}
+
+const keyOf = (owner: string, schema: string) => `${owner}${schema}`;
+
+/**
+ * Route the two grants each (owner, schema) may need onto the connection that can run them.
+ *
+ * `operator` is the least-privilege role (`migrator`). `masterCaps` is null when no master
+ * connection is available — then anything the operator cannot do is a refusal, never an
+ * unverified attempt on a connection that may not exist. Fable's rule: precise pre-flight
+ * refusal beats a mid-batch failure, and the master's capability is PROBED, never assumed.
+ */
+export function planOwnerEnactment(
+  operator: string,
+  facts: OwnerFactRow[],
+  operatorCaps: GranterCapabilityRow[],
+  masterCaps: GranterCapabilityRow[] | null,
+): EnactmentPlan {
+  const opCap = new Map(operatorCaps.map((c) => [keyOf(c.owner, c.schema), c]));
+  const mCap = masterCaps ? new Map(masterCaps.map((c) => [keyOf(c.owner, c.schema), c])) : null;
+  const plan: EnactmentPlan = { asOperator: [], asMaster: [], refusals: [] };
+
+  for (const f of facts) {
+    if (!f.roleExists) {
+      plan.refusals.push(
+        `owner role '${f.owner}' does not exist — provision never invents a security principal. ` +
+        `Create it, then re-run:  CREATE ROLE ${f.owner} NOLOGIN;`,
+      );
+      continue;
+    }
+    const op = opCap.get(keyOf(f.owner, f.schema));
+    const master = mCap?.get(keyOf(f.owner, f.schema)) ?? null;
+
+    // 1. Membership: the operator must be able to SET ROLE the owner.
+    if (!f.canSetRole) {
+      const stmt = `GRANT ${f.owner} TO ${operator} WITH INHERIT FALSE, SET TRUE`;
+      if (op?.canGrantMembership) plan.asOperator.push(stmt);
+      else if (master?.canGrantMembership) plan.asMaster.push(stmt);
+      else plan.refusals.push(
+        `cannot GRANT ${f.owner} TO ${operator}: neither the operator nor the master holds ADMIN OPTION on '${f.owner}'. ` +
+        `Run as a role that does:  ${stmt};`,
+      );
+    }
+
+    // 2. Create: the owner must be able to CREATE in the schema the object lives in.
+    if (f.schemaExists && !f.ownerCanCreate) {
+      const stmt = `GRANT CREATE ON SCHEMA ${f.schema} TO ${f.owner}`;
+      if (op?.canGrantCreate) plan.asOperator.push(stmt);
+      else if (master?.canGrantCreate) plan.asMaster.push(stmt);
+      else plan.refusals.push(
+        `cannot GRANT CREATE ON SCHEMA ${f.schema} TO ${f.owner}: neither connection owns the schema or holds CREATE WITH GRANT OPTION. ` +
+        `Run as the schema owner:  ${stmt};`,
+      );
+    }
+    // An absent schema is not enacted here — it is created by the reconcile builder, whose own
+    // preflight then names the owner's missing CREATE. Enactment acts only on what exists.
+  }
+  return plan;
+}

package/src/plugin.ts

@@ -842,6 +842,9 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
         if (db?.host) connection = { host: db.host, port: db.port, database: db.database };
       }
 
+      // Credentials ONLY. Ownership convergence is a SEPARATE action (db:converge-ownership) the CLI
+      // runs AFTER it has written the credential to the secret store — so a long/killable ownership
+      // step can never sit between the password swap and the secret write (the lockout, see provision.ts).
       return await runProvision(
         (payload || {}) as Parameters<typeof runProvision>[0],
         {
@@ -872,6 +875,49 @@ export function dbPlugin(options: DbPluginOptions): Plugin {
       );
     };
 
+    // --- db:converge-ownership — ENACT + ADOPT, AFTER the CLI has written the secret ---
+    // The second half of the provisioning flow, split out so it runs strictly after the credential
+    // is safely in the secret store: credentials (db:provision) → secret write (CLI) → this. A hard
+    // kill here strands nothing — the worst case is an un-converged owner db:reconcile refuses on.
+    actions['db:converge-ownership'] = async (payload, _ctx) => {
+      const { sql } = await import('drizzle-orm');
+      const { convergeOwnership } = await import('./provision');
+      const { getAdoptMasterUrl } = await import('./db');
+
+      const queryRows = async (statement: string): Promise<any[]> => {
+        const res: any = await opsDb.execute(sql.raw(statement));
+        if (Array.isArray(res)) return res;
+        if (Array.isArray(res?.rows)) return res.rows;
+        return [];
+      };
+
+      // The MASTER connection ADOPT reassigns through: the linked SST Postgres master, else the
+      // ADMIN_DATABASE_URL operator secret (a brownfield/external-RDS app has no component but wires
+      // a master-capable admin — see getAdoptMasterUrl). ENACT also routes hard grants here. Null
+      // only when NEITHER exists; then ADOPT refuses. Whether the resolved connection can actually
+      // reassign is decided by ADOPT's live probe, not by which source won. Closed in the finally.
+      const masterUrl = getAdoptMasterUrl();
+      let masterClient: any = null;
+      let master: { execute: (s: string) => Promise<unknown>; query: (s: string) => Promise<any[]> } | null = null;
+      if (masterUrl) {
+        const { default: postgres } = await import('postgres');
+        masterClient = postgres(masterUrl, { max: 1, connect_timeout: 10, ssl: 'prefer', onnotice: () => {} });
+        master = {
+          execute: async (s: string) => { await masterClient.unsafe(s); },
+          query: async (s: string) => Array.from(await masterClient.unsafe(s)) as any[],
+        };
+      }
+
+      try {
+        return await convergeOwnership(
+          (payload || {}) as Parameters<typeof convergeOwnership>[0],
+          { execute: async (statement) => opsDb.execute(sql.raw(statement)), query: queryRows, master },
+        );
+      } finally {
+        if (masterClient) await masterClient.end({ timeout: 5 });
+      }
+    };
+
 
     // --- db:rotate — A/B role detection, provisioning, retirement, draining ---
     // Runs inside the VPC on the operator connection. The CLI orchestrates the

package/src/provision.ts

@@ -21,6 +21,25 @@
  */
 
 import { generateRoleChainSQL, generateAdminRoleSQL, generateSearchPathSQL, generateRotationPairSQL } from './role-chain';
+import {
+  pgVersionRefusal,
+  ownerFactsSql,
+  granterCapabilitySql,
+  planOwnerEnactment,
+  type DeclaredOwner,
+  type OwnerFactRow,
+  type GranterCapabilityRow,
+} from './owner-enactment';
+import {
+  adopteeProbeSql,
+  planAdoptionReassignment,
+  auditAdoption,
+  requiresConfirm,
+  type Adoptee,
+  type AdopteeProbe,
+  type RoleAttrs,
+  type AdoptionFinding,
+} from './owner-adoption';
 
 export interface ProvisionPayload {
   /** Password for the least-privilege API login. Alphanumeric only. */
@@ -30,6 +49,27 @@ export interface ProvisionPayload {
   loginRole?: string;
   adminRole?: string;
   appRoles?: string[];
+  /**
+   * Declared owners to ENACT (brownfield ownership convergence, Gap 1). Each (owner, schema) the
+   * Models declare for a function/view/matview. Provision grants the operator membership so it can
+   * `SET ROLE` the owner, and the owner CREATE on the schema — the two grants db:reconcile needs
+   * but (as the least-privilege operator) can only refuse with. Absent/empty = no enactment
+   * (byte-identical to pre-feature behavior). Derived from the Models barrel by the CLI.
+   */
+  declaredOwners?: DeclaredOwner[];
+  /**
+   * Declared objects to ADOPT (brownfield ownership convergence, Gap 2). Each function/view/matview
+   * the Models declare, with its declared owner. Provision reassigns (on the MASTER, in one
+   * transaction) any that exist and are mis-owned. Reassigning a SECDEF function/view/matview
+   * changes its runs-as identity at CALL time, so those require `confirm`. Absent/empty = no adoption.
+   */
+  declaredObjects?: Adoptee[];
+  /**
+   * Explicit confirmation for a runtime-changing ADOPT. Without it, provision REFUSES (and reports
+   * the manifest) when any object it would reassign is a SECDEF function, a view, or a matview. The
+   * CLI sets this from `--confirm`.
+   */
+  confirm?: boolean;
   /**
    * The declared schema set (ordered, deduped, ending in 'public' — declaredSearchPath). When
    * present, provision sets it as the ROLE default (ALTER ROLE … SET search_path) on both login
@@ -41,6 +81,15 @@ export interface ProvisionPayload {
   rotationPairs?: boolean;
 }
 
+/**
+ * A privileged connection that can both write and READ rows — used for the enactment probes.
+ * The operator's own connection has this shape; the master (linked RDS) has it when present.
+ */
+export interface ProvisionConnection {
+  execute: (sql: string) => Promise<unknown>;
+  query: (sql: string) => Promise<any[]>;
+}
+
 export interface ProvisionDeps {
   /** Run one SQL string on the (privileged) provisioning connection. */
   execute: (sql: string) => Promise<unknown>;
@@ -48,6 +97,19 @@ export interface ProvisionDeps {
   connection?: { host: string; port?: number | string; database: string } | null;
   /** Real login attempt as the admin role — resolves on success, throws on failure. */
   connectProbe?: (url: string) => Promise<void>;
+  /**
+   * Read rows on the operator's own (privileged) connection — for the enactment probes and the
+   * server-version guard. Absent → enactment is skipped even when declaredOwners is present (an
+   * older caller that cannot read; the reconcile preflight still refuses with the fix SQL).
+   */
+  query?: (sql: string) => Promise<any[]>;
+  /**
+   * The MASTER connection (the linked RDS master), when one is available. ENACT routes to it the
+   * grants the operator cannot make; ADOPT (Gap 2) requires it outright. Absent on a BYO-database
+   * app (no linked component) → enactment that needs the master is REFUSED with the fix SQL,
+   * never attempted on a connection that does not exist.
+   */
+  master?: ProvisionConnection | null;
   /**
    * Does this role ALREADY exist with LOGIN? When it does, provision is ADDITIVE-ONLY:
    * it preserves the live password instead of resetting it. A plain `db:provision` used to
@@ -70,6 +132,27 @@ export interface ProvisionResult {
   /** true = login proven; null = no way to probe (unverified); absent = no admin requested. */
   adminVerified?: boolean | null;
   rotationPairsCreated?: boolean;
+  /**
+   * The result of ENACT (declared-owner convergence, Gap 1). Absent when no owners were declared.
+   * `enacted` counts grants actually run; `refusals` are grants neither the operator nor the master
+   * could make, each carrying the fix SQL. Refusals do NOT abort credential provisioning (that is
+   * the critical, atomic path) — they are reported LOUDLY for the CLI to surface and exit non-zero.
+   * The database is not left worse: an un-enacted owner is exactly the state db:reconcile refuses on.
+   */
+  ownerEnactment?: { enacted: number; refusals: string[] };
+  /**
+   * The result of ADOPT (declared-object reassignment, Gap 2). Absent when no objects were declared.
+   * `reassigned` counts objects moved; `manifest` describes each (identity, kind, secdef, owner
+   * change) for the CLI to print; `findings` are the pre-adopt semantic audit; `refusals` block the
+   * whole phase (a pre-flight obstacle, a missing master, or a required --confirm that was absent).
+   * Like ENACT, refusals never abort credential provisioning and never throw.
+   */
+  ownerAdoption?: {
+    reassigned: number;
+    manifest: Array<{ identity: string; kind: string; secdef: boolean; from: string; to: string }>;
+    findings: AdoptionFinding[];
+    refusals: string[];
+  };
   error?: string;
 }
 
@@ -207,5 +290,195 @@ export async function runProvision(
     result.passwordSet = true;
   }
 
+  // Ownership convergence (ENACT + ADOPT) is DELIBERATELY NOT here. It is the one part of the
+  // provisioning flow that can wait on a lock (ADOPT's transaction) or outlive the Lambda clock,
+  // and it sits AFTER the credential swap — so running it inside runProvision would put a
+  // long/killable step between the autocommitted `ALTER ROLE … PASSWORD` and the caller's
+  // secret-store write. A hard kill there (900s Lambda timeout, SIGKILL) strands the fresh operator
+  // password live in the database but never saved: the exact lockout the ordering above exists to
+  // prevent, and one no try/catch can catch. So the caller runs `convergeOwnership` as a SEPARATE
+  // step, AFTER it has written the secret — credentials → secret → ENACT → ADOPT.
   return result;
 }
+
+/**
+ * Converge declared ownership — ENACT (Gap 1) then ADOPT (Gap 2) — as a step SEPARATE from and
+ * AFTER credential provisioning + the secret-store write (see runProvision's closing note). By the
+ * time this runs the operator credential is already saved, so a throw or a hard kill here can strand
+ * nothing: the worst case is an un-converged owner, exactly the state db:reconcile already refuses on.
+ *
+ * Both phases are non-fatal: a thrown execute is folded into `refusals`, never propagated. Returns
+ * the same `ownerEnactment` / `ownerAdoption` shapes runProvision's result used to carry. Skipped
+ * (empty result) when nothing is declared or the caller cannot read (no `query` dep — an older CLI).
+ */
+export async function convergeOwnership(
+  payload: Pick<ProvisionPayload, 'declaredOwners' | 'declaredObjects' | 'confirm' | 'adminRole'>,
+  deps: ProvisionDeps,
+): Promise<Pick<ProvisionResult, 'ownerEnactment' | 'ownerAdoption'>> {
+  const out: Pick<ProvisionResult, 'ownerEnactment' | 'ownerAdoption'> = {};
+  if (!deps.query) return out;
+  const operator = payload.adminRole ?? 'migrator';
+
+  if (payload.declaredOwners?.length) {
+    try {
+      out.ownerEnactment = await enactOwners(payload.declaredOwners, operator, deps);
+    } catch (err: any) {
+      out.ownerEnactment = { enacted: 0, refusals: [`owner enactment failed (credentials are already saved; nothing is stranded): ${err?.message ?? String(err)}`] };
+    }
+  }
+
+  if (payload.declaredObjects?.length) {
+    try {
+      out.ownerAdoption = await adoptOwners(payload.declaredObjects, deps, !!payload.confirm);
+    } catch (err: any) {
+      out.ownerAdoption = { reassigned: 0, manifest: [], findings: [], refusals: [`owner adoption failed (the transaction rolled back; credentials are untouched): ${err?.message ?? String(err)}`] };
+    }
+  }
+  return out;
+}
+
+const truthy = (v: unknown): boolean => v === true || v === 't' || v === 'true';
+
+function toFacts(rows: any[]): OwnerFactRow[] {
+  return rows.map((r) => ({
+    owner: String(r.owner),
+    schema: String(r.schema),
+    roleExists: truthy(r.role_exists),
+    schemaExists: truthy(r.schema_exists),
+    canSetRole: truthy(r.can_set_role),
+    ownerCanCreate: truthy(r.owner_can_create),
+  }));
+}
+
+function toCaps(rows: any[]): GranterCapabilityRow[] {
+  return rows.map((r) => ({
+    owner: String(r.owner),
+    schema: String(r.schema),
+    canGrantMembership: truthy(r.can_grant_membership),
+    canGrantCreate: truthy(r.can_grant_create),
+  }));
+}
+
+/**
+ * Probe (operator + master), route, and apply the declared-owner grants. The PG16 guard runs
+ * first: below 16 the grammar does not exist and provision refuses rather than take a wider action.
+ * Master-routed statements need a live master; without one they were already turned into refusals
+ * by the router (masterCaps=null), so nothing here attempts a connection that is not there.
+ */
+async function enactOwners(
+  owners: DeclaredOwner[],
+  operator: string,
+  deps: ProvisionDeps,
+): Promise<{ enacted: number; refusals: string[] }> {
+  const query = deps.query!;
+  const [vRow] = await query(`SELECT current_setting('server_version_num')::int AS v`);
+  const vRefusal = pgVersionRefusal(Number(vRow?.v ?? 0));
+  if (vRefusal) return { enacted: 0, refusals: [vRefusal] };
+
+  const facts = toFacts(await query(ownerFactsSql(owners, operator)));
+  const operatorCaps = toCaps(await query(granterCapabilitySql(owners)));
+  const masterCaps = deps.master ? toCaps(await deps.master.query(granterCapabilitySql(owners))) : null;
+
+  const plan = planOwnerEnactment(operator, facts, operatorCaps, masterCaps);
+  for (const stmt of plan.asOperator) await deps.execute(`${stmt};`);
+  for (const stmt of plan.asMaster) await deps.master!.execute(`${stmt};`);
+  return { enacted: plan.asOperator.length + plan.asMaster.length, refusals: plan.refusals };
+}
+
+function toProbes(rows: any[]): AdopteeProbe[] {
+  return rows.map((r) => ({
+    identity: String(r.identity),
+    exists: truthy(r.exists),
+    kindMatches: truthy(r.kind_matches),
+    liveSecdef: truthy(r.live_secdef),
+    liveOwner: String(r.live_owner ?? ''),
+    isExtensionMember: truthy(r.is_extension_member),
+    declaredOwnerExists: truthy(r.declared_owner_exists),
+    masterPrivsOfCurrent: truthy(r.master_privs_of_current),
+    masterCanSetDeclared: truthy(r.master_can_set_declared),
+    masterAdminOfDeclared: truthy(r.master_admin_of_declared),
+  }));
+}
+
+const EMPTY_ADOPTION = { reassigned: 0, manifest: [], findings: [], refusals: [] as string[] };
+
+/**
+ * Reassign declared objects to their declared owners — the ADOPT phase (Gap 2), master-only and
+ * confirm-gated. The reassignment is one transaction with a per-statement lock_timeout, so a stall
+ * behind a long reader fails fast and a mid-batch error rolls the whole phase back — never a
+ * half-adopted schema (the residue db:reconcile would then choke on).
+ */
+async function adoptOwners(
+  adoptees: Adoptee[],
+  deps: ProvisionDeps,
+  confirm: boolean,
+): Promise<NonNullable<ProvisionResult['ownerAdoption']>> {
+  const query = deps.query!;
+  const [vRow] = await query(`SELECT current_setting('server_version_num')::int AS v`);
+  const vRefusal = pgVersionRefusal(Number(vRow?.v ?? 0));
+  if (vRefusal) return { ...EMPTY_ADOPTION, refusals: [vRefusal] };
+
+  // ADOPT reassigns on a master-capable connection (the linked SST Postgres master, else the
+  // ADMIN_DATABASE_URL operator secret — see getAdoptMasterUrl). A connection is present unless the
+  // app configures NEITHER. Its actual capability is probed below; this refusal is only the
+  // no-connection-at-all case.
+  if (!deps.master) {
+    return { ...EMPTY_ADOPTION, refusals: [
+      'ADOPT has no master-capable connection to reassign through. Provide an ADMIN_DATABASE_URL ' +
+      'secret for the stage (a privileged operator that owns/administers the objects), or link an ' +
+      'sst.aws.Postgres component. The least-privilege DATABASE_URL cannot reassign a postgres-owned object.',
+    ] };
+  }
+
+  const probes = toProbes(await deps.master.query(adopteeProbeSql(adoptees)));
+  const plan = planAdoptionReassignment(adoptees, probes);
+  if (plan.refusals.length) return { ...EMPTY_ADOPTION, refusals: plan.refusals };
+  if (!plan.statements.length) return { ...EMPTY_ADOPTION };
+
+  // The semantic audit and the confirm gate — computed from what will ACTUALLY reassign, using LIVE
+  // facts (the declared owner's live attributes; the object's live SECDEF flag), never the declared
+  // guess (Fable BLOCKER C). `probeById` recovers each reassignee's live SECDEF.
+  const probeById = new Map(probes.map((p) => [p.identity, p]));
+  const owners = new Set<string>();
+  for (const a of plan.reassigned) { owners.add(a.currentOwner); owners.add(a.declaredOwner); }
+  const attrs = await roleAttrs(deps.master, [...owners]);
+  // Audit with the EFFECTIVE runs-as: SECDEF if declared OR live (a live-SECDEF/declared-INVOKER fn
+  // still runs as its owner until reconcile replaces the body).
+  const findings = auditAdoption(
+    plan.reassigned.map((a) => ({ ...a, secdef: a.secdef || !!probeById.get(a.identity)?.liveSecdef })),
+    attrs,
+  );
+  const manifest = plan.reassigned.map((a) => ({
+    identity: a.identity, kind: a.kind, secdef: a.secdef || !!probeById.get(a.identity)?.liveSecdef, from: a.currentOwner, to: a.declaredOwner,
+  }));
+
+  const reassignments = plan.reassigned.map((a) => ({
+    kind: a.kind, declaredSecdef: a.secdef, liveSecdef: !!probeById.get(a.identity)?.liveSecdef, declaredOwner: a.declaredOwner,
+  }));
+  if (requiresConfirm(reassignments, attrs) && !confirm) {
+    const n = reassignments.filter((r) => requiresConfirm([r], attrs)).length;
+    return { reassigned: 0, manifest, findings, refusals: [
+      `ADOPT needs --confirm: ${n} object(s) change their runs-as identity at call time or hand ` +
+      `ownership to a powerful role (SECDEF functions / views / matviews / superuser-or-BYPASSRLS owners). ` +
+      `Review the manifest, then re-run with --confirm.`,
+    ] };
+  }
+
+  // One transaction: per-statement lock_timeout, all-or-nothing. `statements` may include SET
+  // self-grants ahead of the ALTERs, so the count of reassignments is plan.reassigned, not statements.
+  const body = plan.statements.map((s) => `${s};`).join('\n');
+  await deps.master.execute(`BEGIN;\nSET LOCAL lock_timeout = '5000ms';\n${body}\nCOMMIT;`);
+  return { reassigned: plan.reassigned.length, manifest, findings, refusals: [] };
+}
+
+/** Read superuser / bypassrls for a set of roles, on the master. */
+async function roleAttrs(master: ProvisionConnection, roles: string[]): Promise<Record<string, RoleAttrs>> {
+  if (!roles.length) return {};
+  const list = roles.map((r) => `'${r.replace(/'/g, "''")}'`).join(', ');
+  const rows = await master.query(
+    `SELECT rolname, rolsuper, rolbypassrls FROM pg_roles WHERE rolname IN (${list})`,
+  );
+  const out: Record<string, RoleAttrs> = {};
+  for (const r of rows) out[String(r.rolname)] = { superuser: truthy(r.rolsuper), bypassRls: truthy(r.rolbypassrls) };
+  return out;
+}