@homeflare/alchemy 0.43.0 → 0.45.0

package/dist/postgres/role.d.ts

@@ -0,0 +1,57 @@
+/**
+ * `Postgres.Role` — create / adopt / alter / drop of a LOGIN or NOLOGIN role on the same
+ * self-hosted PostgreSQL 18 cluster `Postgres.Database` talks to, over the same transports
+ * (runner `psql` or socket). The seat-wiring lane B12a's shape: one group role per seat
+ * (NOLOGIN, member of `hf_agent`), plus the LOGIN seat users.
+ *
+ * ★ ALTER-CAPABLE, UNLIKE `Postgres.Database`. Every scalar this resource asserts has a safe
+ *   atomic `ALTER ROLE` form (`LOGIN`/`NOLOGIN`, `INHERIT`/`NOINHERIT`, `CONNECTION LIMIT`,
+ *   `VALID UNTIL` — `alter_role.sgml`'s first synopsis variant), so a drifted live row is
+ *   brought back to the declaration, never refused. Memberships move through one-parent
+ *   `GRANT`/`REVOKE` statements (`alter_role.sgml`: "there are no options for adding or
+ *   removing memberships; use GRANT and REVOKE").
+ * ⛔ THE PASSWORD IS A REFERENCE, NEVER A VALUE (S25). It is declared as
+ *   `{ fromEnv: 'PG_SEAT_WIDGET_PASSWORD' }`; the NAME lands in state, the value is resolved
+ *   from the deploying process's environment at reconcile time, held as `Redacted`, and sent only
+ *   as the SCRAM-SHA-256 verifier inside the one `ALTER ROLE … PASSWORD` statement that needs it
+ *   (`role-scram.ts` — the statement text reaching spans, `pg_stat_statements` and a failed
+ *   `ALTER`'s server log never holds the plain value). What state remembers is a
+ *   `scrypt:<salt>:<digest>` seal, so a reconcile sends the password only when the environment
+ *   value differs from the one last written — a plan never re-sends a secret that already
+ *   matches, and never stores one.
+ * ★ MEMBERSHIP IS `pg_auth_members`, compared as a sorted set. `memberOf` omitted leaves live
+ *   memberships alone; `[]` ensures none.
+ * ★ `defaultRemovalPolicy: 'retain'` — a seat group role may own objects and be granted across
+ *   databases; a destroy is still implemented in full (`DROP ROLE IF EXISTS`), opt in with
+ *   `.pipe(RemovalPolicy.destroy())`. A role that still owns objects fails the drop with the
+ *   server's own `2BP01` (`dependent_objects_still_exist`), surfaced as the client's `SqlError`.
+ */
+import { Resource } from 'alchemy';
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import { type Environment } from '../secrets/write-only.ts';
+import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+import { PostgresRoleCreateVanished, PostgresRoleIdentityRefused, type PostgresRoleMembershipUnrepaired, PostgresRoleNameRefused, type PostgresRoleParentMissing, PostgresRolePasswordEnvUnsetError, type PostgresRolePasswordNonAsciiRefused, PostgresRolePrivilegedRefused, PostgresRoleValidUntilRefused } from './role-errors.ts';
+import { type PostgresConnection } from './connection.ts';
+import type { PgExecutor } from './database-sql.ts';
+export interface PostgresRole extends Resource<'Postgres.Role', PostgresRoleProps, PostgresRoleAttributes, never, PostgresConnection> {
+}
+export declare const PostgresRole: import("alchemy").ResourceClass<PostgresRole>;
+/** Mirrors `isPostgresDatabase`: a resource constructor is a callable `Object.assign`ed
+ * function, not a plain object, so `typeof` must accept both. */
+export declare const isPostgresRole: (value: unknown) => value is PostgresRole;
+/**
+ * The core of `reconcile`, against any {@link PgExecutor} — the real client through `withPg`,
+ * or `fake-sql.ts`'s recording fake in tests. `env` defaults to `process.env`; tests pass a
+ * recording one. `previousSeal` is the seal in the engine's state — `''` when the role is
+ * being written for the first time — because `pg_roles` answers no password (S25), so the live
+ * row cannot say whether the environment value still matches the one last written.
+ */
+export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresRoleProps, env?: Environment, previousSeal?: string, storedOid?: number) => Effect.Effect<PostgresRoleAttributes, PostgresRolePasswordEnvUnsetError | PostgresRolePasswordNonAsciiRefused | PostgresRolePrivilegedRefused | PostgresRoleCreateVanished | PostgresRoleMembershipUnrepaired | PostgresRoleParentMissing | PostgresRoleIdentityRefused | SqlError>;
+/** The core of `read`. Answers `undefined` when absent; ownership branding and the state-only
+ * `passwordSeal` merge are the caller's. */
+export declare const readRole: (pg: PgExecutor, name: string) => Effect.Effect<Omit<PostgresRoleAttributes, "passwordSeal"> | undefined, SqlError, never>;
+/** Every plan-time refusal this family makes, in one place so `diff` and `reconcile` check the
+ * same facts. Nothing here touches a client. */
+export declare const refuseAtPlan: (props: PostgresRoleProps) => Effect.Effect<void, PostgresRoleNameRefused | PostgresRoleValidUntilRefused>;
+//# sourceMappingURL=role.d.ts.map

package/dist/postgres/role.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"role.d.ts","sourceRoot":"","sources":["../../src/postgres/role.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,WAAW,EAAE,MAAM,0BAA0B,CAAC;AAC5D,OAAO,KAAK,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,MAAM,iBAAiB,CAAC;AAmBjF,OAAO,EACL,0BAA0B,EAC1B,2BAA2B,EAC3B,KAAK,gCAAgC,EACrC,uBAAuB,EACvB,KAAK,yBAAyB,EAC9B,iCAAiC,EACjC,KAAK,mCAAmC,EACxC,6BAA6B,EAC7B,6BAA6B,EAC9B,MAAM,kBAAkB,CAAC;AAC1B,OAAO,EAAE,KAAK,kBAAkB,EAAE,MAAM,iBAAiB,CAAC;AAC1D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,MAAM,WAAW,YAAa,SAAQ,QAAQ,CAC5C,eAAe,EACf,iBAAiB,EACjB,sBAAsB,EACtB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,YAAY,+CAEvB,CAAC;AAEH;iEACiE;AACjE,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,KAAK,IAAI,YAGD,CAAC;AAEzD;;;;;;GAMG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,iBAAiB,QACnB,WAAW,qCAEJ,MAAM,KACjB,MAAM,CAAC,MAAM,CACd,sBAAsB,EACpB,iCAAiC,GACjC,mCAAmC,GACnC,6BAA6B,GAC7B,0BAA0B,GAC1B,gCAAgC,GAChC,yBAAyB,GACzB,2BAA2B,GAC3B,QAAQ,CA0FR,CAAC;AAEL;4CAC4C;AAC5C,eAAO,MAAM,QAAQ,OAAQ,UAAU,QAAQ,MAAM,6FAAiC,CAAC;AAEvF;gDACgD;AAChD,eAAO,MAAM,YAAY,UAChB,iBAAiB,KACvB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,uBAAuB,GAAG,6BAA6B,CAkB1E,CAAC"}

package/dist/postgres/schema-assert.d.ts

@@ -0,0 +1,50 @@
+/**
+ * Assert a just-read `pg_namespace` row — and the connection that read it — against a
+ * `Postgres.Schema` declaration.
+ *
+ * ⛔ OWNER BEFORE COMMENT. `reconcile` calls `assertOwner` on the create re-read before any
+ *   `COMMENT ON SCHEMA`. Measured before the 2026-10-01 fix: a concurrent creator could win
+ *   `IF NOT EXISTS` (the `CREATE` did nothing). Plain CREATE now refuses that race. The kit role
+ *   is superuser, so commenting first rewrites their schema, and the later drift failure does not roll that write back — the two statements are not one
+ *   transaction.
+ * ⛔ AN OMITTED `owner` IS `current_user`, NOT "DON'T ASSERT". A fresh `CREATE SCHEMA` without
+ *   `AUTHORIZATION` is owned by the role running it. Skipping the comparison when the prop is
+ *   omitted returns that foreign row as reconciled, and a later `RemovalPolicy.destroy()` drops
+ *   the other role's schema.
+ * ⛔ DELETE RE-READS AND PROVES OWNERSHIP (`deleteForeignRefusal`). `DROP SCHEMA` fires by
+ *   name alone; the name is no proof the live schema is the one this resource created — the
+ *   old row can be dropped out of band and the name recreated by another role, and the engine
+ *   hands `delete` no re-read of its own once state exists. The persisted `oid` + `owner`
+ *   (what the last reconcile asserted) are the proof: a live row that does not match them is
+ *   refused, and nothing is dropped.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+import { type PostgresSchemaAttributes, type PostgresSchemaProps } from './schema-attrs.ts';
+import { PostgresSchemaDeleteForeignRefused, PostgresSchemaDrift, PostgresSchemaWrongDatabase } from './schema-errors.ts';
+/** The connected database, proven equal to the declaration or refused — the guard every write
+ * path in this family runs first. */
+export declare const assertDatabase: (props: PostgresSchemaProps, pg: PgExecutor) => Effect.Effect<void, PostgresSchemaWrongDatabase | SqlError>;
+/** The role a fresh `CREATE SCHEMA` without `AUTHORIZATION` would be owned by. */
+export declare const declaredOwner: (props: PostgresSchemaProps, executingRole: string) => string;
+/** Owner, then comment. An omitted owner is `executingRole` (`current_user`), so a race
+ * winner owned by someone else is drift on every return path, not only the create path. */
+export declare const liveDrift: (props: PostgresSchemaProps, live: PostgresSchemaAttributes, executingRole: string) => {
+    readonly prop: string;
+    readonly declared: unknown;
+    readonly live: unknown;
+} | undefined;
+/** Owner only — the check that runs before `COMMENT ON`, so a race winner is never commented. */
+export declare const assertOwner: (props: PostgresSchemaProps, row: PostgresSchemaAttributes, executingRole: string) => Effect.Effect<void, PostgresSchemaDrift>;
+/** Owner and comment. Every return path of `reconcile` passes through this. */
+export declare const assertLive: (props: PostgresSchemaProps, row: PostgresSchemaAttributes, executingRole: string) => Effect.Effect<PostgresSchemaAttributes, PostgresSchemaDrift>;
+/**
+ * The delete-time ownership proof: `undefined` when the live row is provably the one this
+ * resource created (same `oid` and `owner` as the persisted state handed to `delete`), else
+ * the typed refusal — with `lastOid`/`lastOwner` `undefined` when no state was handed over,
+ * the fail-closed shape (the handler type allows `output === undefined` even though the
+ * engine passes state whenever it calls delete).
+ */
+export declare const deleteForeignRefusal: (props: PostgresSchemaProps, live: PostgresSchemaAttributes, output: PostgresSchemaAttributes | undefined) => PostgresSchemaDeleteForeignRefused | undefined;
+//# sourceMappingURL=schema-assert.d.ts.map

package/dist/postgres/schema-assert.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-assert.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-assert.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;GAmBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAC3B,OAAO,EACL,kCAAkC,EAClC,mBAAmB,EACnB,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAG5B;qCACqC;AACrC,eAAO,MAAM,cAAc,UAClB,mBAAmB,MACtB,UAAU,KACb,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,QAAQ,CAW1D,CAAC;AAEJ,kFAAkF;AAClF,eAAO,MAAM,aAAa,UAAW,mBAAmB,iBAAiB,MAAM,KAAG,MACpD,CAAC;AAW/B;2FAC2F;AAC3F,eAAO,MAAM,SAAS,UACb,mBAAmB,QACpB,wBAAwB,iBACf,MAAM,KACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAA;CAAE,GAAG,SAQlF,CAAC;AAeF,iGAAiG;AACjG,eAAO,MAAM,WAAW,UACf,mBAAmB,OACrB,wBAAwB,iBACd,MAAM,KACpB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,mBAAmB,CAGzC,CAAC;AAEF,+EAA+E;AAC/E,eAAO,MAAM,UAAU,UACd,mBAAmB,OACrB,wBAAwB,iBACd,MAAM,KACpB,MAAM,CAAC,MAAM,CAAC,wBAAwB,EAAE,mBAAmB,CAG7D,CAAC;AAEF;;;;;;GAMG;AACH,eAAO,MAAM,oBAAoB,UACxB,mBAAmB,QACpB,wBAAwB,UACtB,wBAAwB,GAAG,SAAS,KAC3C,kCAAkC,GAAG,SAYvC,CAAC"}

package/dist/postgres/schema-attrs.d.ts

@@ -0,0 +1,51 @@
+export interface PostgresSchemaProps {
+    /** Schema name. At most 63 UTF-8 bytes (`NAMEDATALEN`), refused at plan. */
+    readonly name: string;
+    /**
+     * The database the schema lives in. The family connection points at a maintenance database
+     * (`docs/postgres.md#measured-path` — a brand-new database cannot be connected to on a cold
+     * plan), so the schema handlers open THIS database instead and prove it with
+     * `current_database()` (`PostgresSchemaWrongDatabase`) before any write. A change is refused
+     * at plan (`PostgresSchemaDatabaseRefused`) the same way a rename is.
+     */
+    readonly database: string;
+    /** Owning role; becomes `AUTHORIZATION` in `CREATE SCHEMA`. The role must already exist. */
+    readonly owner?: string;
+    /**
+     * Optional `COMMENT ON SCHEMA`. Stored in `pg_description`. A declared `''` IS "no comment":
+     * Postgres stores an empty comment as NULL, so it is normalized to `undefined`
+     * (`normalizedComment`) rather than compared against a live NULL forever.
+     */
+    readonly comment?: string;
+    /**
+     * Whether `DELETE` with `RemovalPolicy.destroy()` may cascade into objects in the schema.
+     * Default `false`: `DROP SCHEMA` refuses when the schema is not empty.
+     */
+    readonly cascade?: boolean;
+}
+export interface PostgresSchemaAttributes {
+    /** Schema name (`pg_namespace.nspname`). */
+    readonly name: string;
+    /** The database the row was read from (`current_database()`), equal to the declared prop on
+     * every honest read — the row itself carries the proof of where the statement ran. */
+    readonly database: string;
+    /** Owner role name (`pg_get_userbyid(nspowner)`). */
+    readonly owner: string;
+    /** Comment from `obj_description`, `null` when none. */
+    readonly comment: string | null;
+    /** `pg_namespace` OID, read as a native `oid` number. */
+    readonly oid: number;
+}
+/**
+ * A declared `''` comment means "no comment": `COMMENT ON SCHEMA … IS ''` deletes the comment in
+ * Postgres (the stored value becomes NULL), so treating `''` as a value would drift against the
+ * live NULL on every later plan — a permanent update loop. Normalizing it to `undefined` keeps
+ * `''` and an absent comment identical everywhere they are compared.
+ */
+export declare const normalizedComment: (comment: string | undefined) => string | undefined;
+/** Refuse names PostgreSQL would silently truncate (see `database-attrs.ts`). */
+export declare const schemaNameByteRefusal: (name: string) => {
+    readonly byteLength: number;
+    readonly limit: number;
+} | undefined;
+//# sourceMappingURL=schema-attrs.d.ts.map

package/dist/postgres/schema-attrs.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-attrs.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-attrs.ts"],"names":[],"mappings":"AAaA,MAAM,WAAW,mBAAmB;IAClC,4EAA4E;IAC5E,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;;;;;;OAMG;IACH,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,4FAA4F;IAC5F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB;;;;OAIG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;IAC1B;;;OAGG;IACH,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAC;CAC5B;AAED,MAAM,WAAW,wBAAwB;IACvC,4CAA4C;IAC5C,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB;0FACsF;IACtF,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,qDAAqD;IACrD,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,wDAAwD;IACxD,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,IAAI,CAAC;IAChC,yDAAyD;IACzD,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;CACtB;AAED;;;;;GAKG;AACH,eAAO,MAAM,iBAAiB,YAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SACnC,CAAC;AAEvC,iFAAiF;AACjF,eAAO,MAAM,qBAAqB,SAC1B,MAAM,KACX;IAAE,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,SAK5D,CAAC"}

package/dist/postgres/schema-delete.d.ts

@@ -0,0 +1,28 @@
+/**
+ * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then
+ * the guarded `DROP SCHEMA`.
+ *
+ * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When
+ *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no
+ *   fresh row — a schema dropped out of band and recreated under the same name by another role
+ *   would be dropped by name, `CASCADE` included, destroying their objects.
+ *   `deleteWithClient` re-reads `pg_namespace` first: absent is idempotent success, and a live
+ *   row that no longer matches the persisted proof fails with
+ *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any
+ *   `DROP` is issued.
+ */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+import { type PostgresSchemaDeleteForeignRefused, PostgresSchemaDropNotEmptyError, type PostgresSchemaWrongDatabase } from './schema-errors.ts';
+/** Prove the connected database, then the guarded drop — the drop core on its own, for the
+ * tests that drive it directly. */
+export declare const dropWithClient: (pg: PgExecutor, props: PostgresSchemaProps) => Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDropNotEmptyError | SqlError>;
+/**
+ * The core of `delete`: re-read first (see the file header), refuse a schema the persisted
+ * proof cannot vouch for, then the guarded drop. `output` is the persisted state the engine
+ * hands over — `undefined` is no proof and refuses too.
+ */
+export declare const deleteWithClient: (pg: PgExecutor, props: PostgresSchemaProps, output: PostgresSchemaAttributes | undefined) => Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDeleteForeignRefused | PostgresSchemaDropNotEmptyError | SqlError>;
+//# sourceMappingURL=schema-delete.d.ts.map

package/dist/postgres/schema-delete.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-delete.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EACL,KAAK,kCAAkC,EACvC,+BAA+B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAuC5B;mCACmC;AACnC,eAAO,MAAM,cAAc,OACrB,UAAU,SACP,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,+BAA+B,GAAG,QAAQ,CAI3F,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,OACvB,UAAU,SACP,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,KAC3C,MAAM,CAAC,MAAM,CACd,IAAI,EACF,2BAA2B,GAC3B,kCAAkC,GAClC,+BAA+B,GAC/B,QAAQ,CASR,CAAC"}

package/dist/postgres/schema-diff.d.ts

@@ -0,0 +1,14 @@
+import type { Input } from 'alchemy/Input';
+import * as Effect from 'effect/Effect';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+import { PostgresSchemaNameRefused } from './schema-errors.ts';
+/** Plan-time only: rename refused, over-long name refused, a database move refused; a `cascade`
+ * flip answers `update` so the new prop reaches state, and every other change answers `update`
+ * too (which `reconcileWithClient` then applies as create, or refuses as drift on a live
+ * schema). */
+export declare const diffPostgresSchema: (news: Input<PostgresSchemaProps>, output: PostgresSchemaAttributes | undefined, olds?: PostgresSchemaProps) => Effect.Effect<{
+    readonly action: 'update';
+} | {
+    readonly action: 'noop';
+} | undefined, import("./schema-errors.ts").PostgresSchemaDatabaseRefused | PostgresSchemaNameRefused | import("./schema-errors.ts").PostgresSchemaRenameRefused, never>;
+//# sourceMappingURL=schema-diff.d.ts.map

package/dist/postgres/schema-diff.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-diff.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-diff.ts"],"names":[],"mappings":"AAeA,OAAO,KAAK,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AAC3C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EAAE,yBAAyB,EAAE,MAAM,oBAAoB,CAAC;AAE/D;;;cAGc;AACd,eAAO,MAAM,kBAAkB,SACvB,KAAK,CAAC,mBAAmB,CAAC,UACxB,wBAAwB,GAAG,SAAS,SACrC,mBAAmB;qBAcI,QAAQ;;qBAA0B,MAAM;wKACpE,CAAC"}

package/dist/postgres/schema-errors.d.ts

@@ -0,0 +1,139 @@
+declare const PostgresSchemaNameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaNameRefused";
+} & Readonly<A>;
+/** A declared name would be silently truncated (same as `PostgresDatabaseNameRefused`). */
+export declare class PostgresSchemaNameRefused extends PostgresSchemaNameRefused_base<{
+    readonly name: string;
+    readonly byteLength: number;
+    readonly limit: number;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaRenameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaRenameRefused";
+} & Readonly<A>;
+/** A logical id's `name` changed. A schema's name is its identity; this family has no
+ * `ALTER SCHEMA … RENAME`. */
+export declare class PostgresSchemaRenameRefused extends PostgresSchemaRenameRefused_base<{
+    readonly from: string;
+    readonly to: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaOwnerMissing_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaOwnerMissing";
+} & Readonly<A>;
+/** `owner` names a role `pg_roles` does not have, checked before the `CREATE SCHEMA`. */
+export declare class PostgresSchemaOwnerMissing extends PostgresSchemaOwnerMissing_base<{
+    readonly schema: string;
+    readonly owner: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaDrift_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaDrift";
+} & Readonly<A>;
+/** A live asserted prop no longer matches the declaration (`owner` or `comment`). */
+export declare class PostgresSchemaDrift extends PostgresSchemaDrift_base<{
+    readonly schema: string;
+    readonly prop: string;
+    readonly declared: unknown;
+    readonly live: unknown;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaCreateVanished_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaCreateVanished";
+} & Readonly<A>;
+/** `CREATE SCHEMA` raised no error, but the immediate re-read (S10) still finds nothing. */
+export declare class PostgresSchemaCreateVanished extends PostgresSchemaCreateVanished_base<{
+    readonly schema: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaDropNotEmptyError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaDropNotEmptyError";
+} & Readonly<A>;
+/**
+ * `delete` with `cascade: false` refuses a schema that still has relations. The same refusal
+ * answers a plain `DROP SCHEMA` the server rejected with SQLSTATE `2BP01`
+ * (`dependent_objects_still_exist`) — an object kind the emptiness check's four catalogs do not
+ * cover (an extension, a collation) — so no "empty" path escapes the typed tag.
+ */
+export declare class PostgresSchemaDropNotEmptyError extends PostgresSchemaDropNotEmptyError_base<{
+    readonly schema: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaWrongDatabase_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaWrongDatabase";
+} & Readonly<A>;
+/** Every statement this resource issues must run against the DECLARED database. The family
+ * connection points at a maintenance database, so the schema handlers open `props.database`
+ * themselves (`withPg`'s database override); this failure means the server answered
+ * `current_database()` with something else — the override was ignored, and no read or write
+ * ran against the schema's real home. */
+export declare class PostgresSchemaWrongDatabase extends PostgresSchemaWrongDatabase_base<{
+    readonly schema: string;
+    readonly declared: string;
+    readonly connected: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaDeleteForeignRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaDeleteForeignRefused";
+} & Readonly<A>;
+/**
+ * `delete` refuses to drop a live schema that is not the one this resource created. The
+ * engine hands `delete` the persisted state (`output`, with the `oid` and `owner` the last
+ * assert proved), and the provider re-reads `pg_namespace` before any `DROP` — a live row that
+ * no longer matches that proof is someone else's schema wearing the same name (the old row was
+ * dropped out of band and the name recreated), and `DROP SCHEMA` would remove their objects.
+ * Nothing is dropped: clear the out-of-band schema by hand, or adopt it.
+ */
+export declare class PostgresSchemaDeleteForeignRefused extends PostgresSchemaDeleteForeignRefused_base<{
+    readonly schema: string;
+    readonly database: string;
+    readonly liveOid: number;
+    readonly liveOwner: string;
+    /** The proof the persisted state carries; both `undefined` when no state was handed over. */
+    readonly lastOid: number | undefined;
+    readonly lastOwner: string | undefined;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaDatabaseRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaDatabaseRefused";
+} & Readonly<A>;
+/** A logical id's `database` changed. A schema lives in one database and this family never
+ * moves one: `DROP SCHEMA` in the old database plus a new declaration is the only path. */
+export declare class PostgresSchemaDatabaseRefused extends PostgresSchemaDatabaseRefused_base<{
+    readonly from: string;
+    readonly to: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaExistsRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaExistsRefused";
+} & Readonly<A>;
+/** No persisted proof: even a same-owner schema needs explicit adoption, including recovery. */
+export declare class PostgresSchemaExistsRefused extends PostgresSchemaExistsRefused_base<{
+    readonly schema: string;
+    readonly database: string;
+}> {
+    get message(): string;
+}
+declare const PostgresSchemaIdentityRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaIdentityRefused";
+} & Readonly<A>;
+/** Reconcile must not replace the oid delete relies on with an out-of-band replacement's oid. */
+export declare class PostgresSchemaIdentityRefused extends PostgresSchemaIdentityRefused_base<{
+    readonly schema: string;
+    readonly storedOid: number;
+    readonly liveOid: number;
+}> {
+    get message(): string;
+}
+export type PostgresSchemaError = PostgresSchemaExistsRefused | PostgresSchemaIdentityRefused | PostgresSchemaNameRefused | PostgresSchemaRenameRefused | PostgresSchemaOwnerMissing | PostgresSchemaDrift | PostgresSchemaCreateVanished | PostgresSchemaDropNotEmptyError | PostgresSchemaDeleteForeignRefused | PostgresSchemaWrongDatabase | PostgresSchemaDatabaseRefused;
+export {};
+//# sourceMappingURL=schema-errors.d.ts.map

package/dist/postgres/schema-errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-errors.ts"],"names":[],"mappings":";;;AAOA,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;8BAC8B;AAC9B,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,yFAAyF;AACzF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;yCAIyC;AACzC,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,wCAEtD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAW7B;CACF;;;;AAED;2FAC2F;AAC3F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,iGAAiG;AACjG,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,mBAAmB,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,4BAA4B,GAC5B,+BAA+B,GAC/B,kCAAkC,GAClC,2BAA2B,GAC3B,6BAA6B,CAAC"}

package/dist/postgres/schema-identity.d.ts

@@ -0,0 +1,8 @@
+/** Apply repeats plan guards: unresolved Outputs can skip both diff and the adoption probe. */
+import * as Effect from 'effect/Effect';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+import { PostgresSchemaDatabaseRefused, PostgresSchemaIdentityRefused, PostgresSchemaRenameRefused } from './schema-errors.ts';
+export declare const assertSchemaTarget: (props: PostgresSchemaProps, output: PostgresSchemaAttributes | undefined) => Effect.Effect<void, PostgresSchemaRenameRefused | PostgresSchemaDatabaseRefused>;
+/** Like Role, refuse recycled names on read as well: drift must not refresh away the proof. */
+export declare const assertSchemaIdentity: (live: PostgresSchemaAttributes, output: PostgresSchemaAttributes) => Effect.Effect<void, PostgresSchemaIdentityRefused>;
+//# sourceMappingURL=schema-identity.d.ts.map

package/dist/postgres/schema-identity.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-identity.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-identity.ts"],"names":[],"mappings":"AAAA,+FAA+F;AAC/F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AACvF,OAAO,EACL,6BAA6B,EAC7B,6BAA6B,EAC7B,2BAA2B,EAC5B,MAAM,oBAAoB,CAAC;AAE5B,eAAO,MAAM,kBAAkB,UACtB,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,KAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,6BAA6B,CAW9E,CAAC;AAEL,+FAA+F;AAC/F,eAAO,MAAM,oBAAoB,SACzB,wBAAwB,UACtB,wBAAwB,KAC/B,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,6BAA6B,CAS7C,CAAC"}

package/dist/postgres/schema-reconcile.d.ts

@@ -0,0 +1,12 @@
+/** Schema reconcile: prove the stored target and identity before asserting a live row. */
+import * as Effect from 'effect/Effect';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import { type PgExecutor } from './database-sql.ts';
+import { type PostgresSchemaAttributes, type PostgresSchemaProps } from './schema-attrs.ts';
+import { PostgresSchemaCreateVanished, type PostgresSchemaDatabaseRefused, type PostgresSchemaDrift, PostgresSchemaExistsRefused, type PostgresSchemaIdentityRefused, PostgresSchemaOwnerMissing, type PostgresSchemaRenameRefused, type PostgresSchemaWrongDatabase } from './schema-errors.ts';
+/**
+ * The core of `reconcile`, against any {@link PgExecutor} — the real pooled client through
+ * `withPg`, or `fake-sql.ts`'s recording fake in tests.
+ */
+export declare const reconcileWithClient: (pg: PgExecutor, props: PostgresSchemaProps, output?: PostgresSchemaAttributes) => Effect.Effect<PostgresSchemaAttributes, PostgresSchemaWrongDatabase | PostgresSchemaOwnerMissing | PostgresSchemaDrift | PostgresSchemaCreateVanished | PostgresSchemaExistsRefused | PostgresSchemaIdentityRefused | PostgresSchemaRenameRefused | PostgresSchemaDatabaseRefused | SqlError>;
+//# sourceMappingURL=schema-reconcile.d.ts.map

package/dist/postgres/schema-reconcile.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-reconcile.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-reconcile.ts"],"names":[],"mappings":"AAAA,0FAA0F;AAC1F,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,EAAE,KAAK,UAAU,EAAc,MAAM,mBAAmB,CAAC;AAChE,OAAO,EACL,KAAK,wBAAwB,EAC7B,KAAK,mBAAmB,EAEzB,MAAM,mBAAmB,CAAC;AAU3B,OAAO,EACL,4BAA4B,EAC5B,KAAK,6BAA6B,EAClC,KAAK,mBAAmB,EACxB,2BAA2B,EAC3B,KAAK,6BAA6B,EAClC,0BAA0B,EAC1B,KAAK,2BAA2B,EAChC,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAE5B;;;GAGG;AACH,eAAO,MAAM,mBAAmB,OAC1B,UAAU,SACP,mBAAmB,WACjB,wBAAwB,KAChC,MAAM,CAAC,MAAM,CACd,wBAAwB,EACtB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,4BAA4B,GAC5B,2BAA2B,GAC3B,6BAA6B,GAC7B,2BAA2B,GAC3B,6BAA6B,GAC7B,QAAQ,CAoDR,CAAC"}

package/dist/postgres/schema-sql.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The statements `Postgres.Schema` issues and the quoting each needs.
+ *
+ * ⛔ `CREATE SCHEMA` TAKES NO BIND PARAMETERS. Measured at `gram.y@REL_18_6`:
+ *   `CreateSchemaStmt: CREATE SCHEMA [IF NOT EXISTS] opt_schema_name AUTHORIZATION
+ *   RoleSpec | create_schema_name opt_schema_element_list`. Neither the name nor the
+ *   authorization role reaches `PARAM` (`$n`), so every free-form value is escaped by hand
+ *   (`quoteIdent`) and the assembled text runs through `.unsafe()`.
+ * ★ The schema name is a single `ColId` token, so `quoteIdent` (single-token quoting) is
+ *   correct — same rule as `Postgres.Database`'s name.
+ */
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import * as Effect from 'effect/Effect';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+import type { PgExecutor } from './database-sql.ts';
+/** `CREATE SCHEMA "name" [AUTHORIZATION "owner"]` — the only create this family issues. */
+export declare const buildCreateSchemaSql: (props: PostgresSchemaProps) => string;
+/** `COMMENT ON SCHEMA "name" IS E'…'` — issued only when a comment is declared. */
+export declare const buildCommentSchemaSql: (name: string, comment: string) => string;
+/** `DROP SCHEMA IF EXISTS "name" [CASCADE]` — idempotent; `CASCADE` only when declared. */
+export declare const buildDropSchemaSql: (name: string, cascade: boolean) => string;
+/** The read: one bound `SELECT` on `pg_namespace`. `undefined` when absent. The row carries
+ * `current_database()` as `database`, so every caller can prove where the statement ran. */
+export declare const selectSchema: (pg: PgExecutor, name: string) => Effect.Effect<PostgresSchemaAttributes | undefined, SqlError>;
+/** Which database this executor actually reaches — checked before any `CREATE` or `DROP SCHEMA`,
+ * so a schema declared for `agents` can never quietly land in the maintenance database the
+ * family connection points at. */
+export declare const currentDatabase: (pg: PgExecutor) => Effect.Effect<string, SqlError>;
+export declare const currentUser: (pg: PgExecutor) => Effect.Effect<string, SqlError>;
+/** `true` when the schema holds none of the four object catalogs above (used before a
+ * non-cascade `DROP SCHEMA`). */
+export declare const schemaIsEmpty: (pg: PgExecutor, name: string) => Effect.Effect<boolean, SqlError>;
+/** SQLSTATE `2BP01` (`dependent_objects_still_exist`): the non-cascade `DROP SCHEMA` refused
+ * because an object kind outside the emptiness check's four catalogs still exists.
+ *
+ * Measured at `@effect/sql-pg@4.0.0-rc.115` `src/internal/sqlError.ts#classifySqlState`: only
+ * class `42` becomes `SqlSyntaxError`. `2BP01` is class `2B`, so it falls through to
+ * `UnknownError` (`sqlError.ts:74`). `PgConnection.ts#classifyFields` still puts the raw code
+ * on `reason.cause.code`. The runner transport copies that rule (`psql-executor.ts#failure`):
+ * `SqlSyntaxError` only when `state.startsWith('42')`, otherwise `UnknownError` with the same
+ * `cause.code`. Reading the code, not the tag, is what makes a real server refusal match. */
+export declare const isDependentObjectsError: (error: SqlError) => boolean;
+/** REL_18_6 pg_namespace.c raises duplicate_schema; both transports retain cause.code. */
+export declare const isDuplicateSchemaError: (error: SqlError) => boolean;
+//# sourceMappingURL=schema-sql.d.ts.map

package/dist/postgres/schema-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,2FAA2F;AAC3F,eAAO,MAAM,oBAAoB,UAAW,mBAAmB,KAAG,MAG9D,CAAC;AAEL,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,SAAU,MAAM,WAAW,MAAM,KAAG,MACK,CAAC;AAE5E,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAAW,OAAO,KAAG,MACK,CAAC;AAW1E;4FAC4F;AAC5F,eAAO,MAAM,YAAY,OACnB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,EAAE,QAAQ,CACgC,CAAC;AAIhG;;kCAEkC;AAClC,eAAO,MAAM,eAAe,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM5E,CAAC;AAUJ,eAAO,MAAM,WAAW,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKxE,CAAC;AAyBJ;iCACiC;AACjC,eAAO,MAAM,aAAa,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAIzF,CAAC;AAEJ;;;;;;;;6FAQ6F;AAC7F,eAAO,MAAM,uBAAuB,UAAW,QAAQ,KAAG,OAKzD,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,UAAW,QAAQ,KAAG,OAKxD,CAAC"}

package/dist/postgres/schema-test-kit.d.ts

@@ -0,0 +1,67 @@
+/**
+ * Shared wiring for the runner-transport `Postgres.Schema` handler tests: the recording
+ * `PsqlRunner` (every stdin and its `psql` argv), the handler-argument builders, and the
+ * one SQL router they all answer through.
+ *
+ * ⚠️ THE ROUTER ORDER IS LOAD-BEARING (`schema-sql.ts`): the emptiness check's `WITH`
+ *   contains `FROM pg_namespace`, and the schema row SELECT contains
+ *   `current_database() AS database` — so `AS empty` must be matched before
+ *   `FROM pg_namespace`, and `FROM pg_namespace` before `current_database()`. The database
+ *   probe (`SELECT 1 AS present FROM pg_database`, `database-sql.ts`) carries no other
+ *   branch's marker and matches its own.
+ */
+import type { PsqlRunner } from './psql-executor.ts';
+import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
+export declare const ok: (stdout: string) => Promise<{
+    code: number;
+    stdout: string;
+    stderr: string;
+}>;
+/** One answer per statement shape a handler issues; `undefined` falls through the router. */
+export interface RouteAnswers {
+    /** `schemaIsEmpty` — the pre-DROP emptiness check (`cascade` unset). */
+    readonly empty?: string;
+    /** `selectSchema` — the schema row re-read, or `[]` for an absent schema. */
+    readonly schema?: string;
+    /** `databaseExists` — `[{\"present\":1}]` when the declared database exists, `[]` when not. */
+    readonly probe?: string;
+    /** `current_database()` — the proof that the override reached the declared database. */
+    readonly proof?: string;
+}
+/** Route one stdin to its answer by the markers above, `undefined` when no branch matches. */
+export declare const route: (stdin: string, answers: RouteAnswers) => string | undefined;
+/** A `router` that answers every stdin (unrouted statements answer the empty string). */
+export declare const router: (answers: RouteAnswers) => (stdin: string) => string;
+/**
+ * A recording `PsqlRunner`: every stdin and the `psql` argv are kept, each stdin answered by
+ * `answers`. The argv recording pins the `-d` database each statement ran against — the last
+ * element of the argv is the `psql -d` value (`psql-executor.ts`).
+ */
+export declare const runnerWith: (answers: (stdin: string) => string) => {
+    run: PsqlRunner;
+    stdins: string[];
+    argvs: Array<readonly string[]>;
+};
+/** The handler inputs the engine passes on `delete`. `output` is the persisted state — the
+ * `oid` + `owner` the last reconcile asserted, which delete must prove the live row still
+ * matches before it drops (`schema-delete.ts`). */
+export declare const deleteArgs: (olds: PostgresSchemaProps, output: PostgresSchemaAttributes) => {
+    id: string;
+    fqn: string;
+    instanceId: string;
+    olds: PostgresSchemaProps;
+    output: PostgresSchemaAttributes;
+    session: never;
+    bindings: never;
+};
+/** The handler inputs the engine passes on `read` (undefined output is the adopt path). */
+export declare const readArgs: (olds: PostgresSchemaProps) => {
+    id: string;
+    fqn: string;
+    instanceId: string;
+    olds: PostgresSchemaProps;
+    output: undefined;
+    session: never;
+    bindings: never;
+};
+//# sourceMappingURL=schema-test-kit.d.ts.map

package/dist/postgres/schema-test-kit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-test-kit.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,eAAO,MAAM,EAAE,WAAY,MAAM;;;;EAAqD,CAAC;AAEvF,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8FAA8F;AAC9F,eAAO,MAAM,KAAK,UAAW,MAAM,WAAW,YAAY,KAAG,MAAM,GAAG,SAMrE,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,MAAM,YAAa,YAAY,aAAa,MAAM,WAAgC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,UAAU,YACZ,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,KACjC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAYtE,CAAC;AAEF;;mDAEmD;AACnD,eAAO,MAAM,UAAU,SAAU,mBAAmB,UAAU,wBAAwB;;;;;;aAM9D,KAAK;cACX,KAAK;CACrB,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,SAAU,mBAAmB;;;;;;aAM1B,KAAK;cACX,KAAK;CACrB,CAAC"}

package/dist/postgres/schema.d.ts

@@ -0,0 +1,54 @@
+/**
+ * `Postgres.Schema` — create-and-assert over one schema in a self-hosted PostgreSQL 18 cluster.
+ *
+ * ★ A SCHEMA CARRIES NO OWNERSHIP MARK, exactly like `Postgres.Database` (H1). `read` answers
+ *   `Unowned` for a match, so every already-live schema needs `adopt(true)` in the stack that
+ *   declares it.
+ * ⛔ NOT ALTER-CAPABLE. `ALTER SCHEMA` only renames or changes owner in Postgres; neither is
+ *   implemented. An owner or comment mismatch against the live row is a typed
+ *   `PostgresSchemaDrift` refusal, never an `ALTER SCHEMA` — same rule `Postgres.Database`
+ *   applies to its own asserted props. An omitted `owner` is compared to `current_user`
+ *   (`schema-assert.ts`): a fresh create without `AUTHORIZATION` would be owned by that role.
+ * ⛔ THE DECLARED `database` IS PROVEN, NEVER ASSUMED. The family connection points at a
+ *   maintenance database (a brand-new database cannot be connected to on a cold plan —
+ *   `docs/postgres.md#measured-path`), so the handlers below open `props.database` themselves
+ *   (`withPg`'s database override) and `reconcile`/`drop` first compare `current_database()`
+ *   against it (`PostgresSchemaWrongDatabase`). Without that proof a seat's schema would be
+ *   created in whatever database the single connection happened to target.
+ * ⛔ `delete` DROPS ONLY WHAT IT CAN PROVE IT CREATED. Before any `DROP`, the handler re-reads
+ *   the live row (`schema-delete.ts`) and matches it against the persisted `oid` + `owner`;
+ *   a mismatch is `PostgresSchemaDeleteForeignRefused`, never a `DROP` (`CASCADE` included) —
+ *   the schema under that name may be another role's, recreated out of band.
+ * ⛔ A MISSING DECLARED DATABASE IS "SCHEMA ABSENT" IN `read` AND `delete`. Both probe
+ *   `pg_database` over the family connection first (`database-sql.ts#databaseExists`), so a
+ *   cold plan against a not-yet-created database plans a create (`read` answers absent)
+ *   instead of failing untyped on connect (`ConnectionError` over psql, `UnknownError` 3D000
+ *   over the socket), and a delete of a dropped database stays idempotent. `reconcile` still
+ *   requires the database to exist — that ordering is the declaration's job (`docs/
+ *   postgres-schema.md`: pass `database: db.name`).
+ * ⛔ `delete` DROPS ONLY WHEN SAFE. `DROP SCHEMA` refuses a non-empty schema unless
+ *   `cascade: true` is declared (`PostgresSchemaDropNotEmptyError`); the `cascade` prop
+ *   defaults to `false` (retain policy by default — see `defaultRemovalPolicy: 'retain'`).
+ */
+import { Resource } from 'alchemy';
+import * as Provider from 'alchemy/Provider';
+import * as Effect from 'effect/Effect';
+import { type PostgresSchemaAttributes, type PostgresSchemaProps } from './schema-attrs.ts';
+import { deleteWithClient, dropWithClient } from './schema-delete.ts';
+import type { PgExecutor } from './database-sql.ts';
+import { type PostgresConnection } from './connection.ts';
+export interface PostgresSchema extends Resource<'Postgres.Schema', PostgresSchemaProps, PostgresSchemaAttributes, never, PostgresConnection> {
+}
+export declare const PostgresSchema: import("alchemy").ResourceClass<PostgresSchema>;
+/** Same dual `typeof` guard as `isPostgresDatabase` (see `database.ts`): a resource constructor
+ * is a callable `Object.assign`ed function, not a plain object. */
+export declare const isPostgresSchema: (value: unknown) => value is PostgresSchema;
+/** The core of `read`: one bound `SELECT`, no ownership branding. */
+export declare const readWithClient: (pg: PgExecutor, name: string) => Effect.Effect<PostgresSchemaAttributes | undefined, import("effect/unstable/sql/SqlError").SqlError, never>;
+export { diffPostgresSchema } from './schema-diff.ts';
+export { reconcileWithClient } from './schema-reconcile.ts';
+export { deleteWithClient, dropWithClient };
+/** The five lifecycle handlers. Exported on its own so a test drives the real implementation. */
+export declare const postgresSchemaHandlers: Provider.ProviderService<PostgresSchema, PostgresConnection, never, never, PostgresConnection, PostgresConnection, never, never, never>;
+export declare const PostgresSchemaProvider: () => import("effect/Layer").Layer<Provider.Provider<PostgresSchema>, never, PostgresConnection>;
+//# sourceMappingURL=schema.d.ts.map

package/dist/postgres/schema.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema.d.ts","sourceRoot":"","sources":["../../src/postgres/schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA+BG;AACH,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAEnC,OAAO,KAAK,QAAQ,MAAM,kBAAkB,CAAC;AAC7C,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,EAAE,KAAK,wBAAwB,EAAE,KAAK,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAO5F,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,MAAM,oBAAoB,CAAC;AACtE,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,KAAK,kBAAkB,EAAU,MAAM,iBAAiB,CAAC;AAGlE,MAAM,WAAW,cAAe,SAAQ,QAAQ,CAC9C,iBAAiB,EACjB,mBAAmB,EACnB,wBAAwB,EACxB,KAAK,EACL,kBAAkB,CACnB;CAAG;AAEJ,eAAO,MAAM,cAAc,iDAEzB,CAAC;AAEH;mEACmE;AACnE,eAAO,MAAM,gBAAgB,UAAW,OAAO,KAAG,KAAK,IAAI,cAGD,CAAC;AAE3D,qEAAqE;AACrE,eAAO,MAAM,cAAc,OAAQ,UAAU,QAAQ,MAAM,gHAA2B,CAAC;AAEvF,OAAO,EAAE,kBAAkB,EAAE,MAAM,kBAAkB,CAAC;AACtD,OAAO,EAAE,mBAAmB,EAAE,MAAM,uBAAuB,CAAC;AAC5D,OAAO,EAAE,gBAAgB,EAAE,cAAc,EAAE,CAAC;AAE5C,iGAAiG;AACjG,eAAO,MAAM,sBAAsB,yIAmDjC,CAAC;AAEH,eAAO,MAAM,sBAAsB,kGACuB,CAAC"}