@homeflare/alchemy 0.46.0 → 0.46.1

package/dist/postgres/psql-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"psql-executor.d.ts","sourceRoot":"","sources":["../../src/postgres/psql-executor.ts"],"names":[],"mappings":"AA0BA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AAExE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;yDAEyD;AACzD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,YAAY,QAAS,MAAM,UAAU,aAAa,CAAC,OAAO,CAAC,KAAG,MASnE,CAAC;AAgBT;;8EAE8E;AAC9E,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MAInD,CAAC;AAuDJ,eAAO,MAAM,gBAAgB,QAAS,UAAU,UAAU,UAAU,KAAG,UAkCrE,CAAC"}
+{"version":3,"file":"psql-executor.d.ts","sourceRoot":"","sources":["../../src/postgres/psql-executor.ts"],"names":[],"mappings":"AA2BA,OAAO,EAAE,KAAK,UAAU,EAAsB,MAAM,mBAAmB,CAAC;AAGxE,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB;AAED;;yDAEyD;AACzD,MAAM,MAAM,UAAU,GAAG,CAAC,IAAI,EAAE;IAC9B,QAAQ,CAAC,IAAI,EAAE,SAAS,MAAM,EAAE,CAAC;IACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,KAAK,OAAO,CAAC,UAAU,CAAC,CAAC;AAE1B,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B;AAED,yFAAyF;AACzF,eAAO,MAAM,YAAY,QAAS,MAAM,UAAU,aAAa,CAAC,OAAO,CAAC,KAAG,MASnE,CAAC;AAgBT;;8EAE8E;AAC9E,eAAO,MAAM,sBAAsB,SAAU,MAAM,KAAG,MAInD,CAAC;AAwDJ,eAAO,MAAM,gBAAgB,QAAS,UAAU,UAAU,UAAU,KAAG,UAkCrE,CAAC"}

package/dist/postgres/schema-closure-sql.d.ts

@@ -0,0 +1,45 @@
+/**
+ * The dependency closure `DROP SCHEMA … CASCADE` would walk, and the count of what it would take
+ * that does NOT live in the schema being dropped (`schema-drop-sql.ts` refuses when it is > 0).
+ *
+ * ⛔ THE CLOSURE IS DERIVED FROM THE NAMESPACE OBJECT, NOT FROM A LIST OF CLASSES. Until
+ *   2026-10-06 the scan started from four catalogs (`pg_class`, `pg_type`, `pg_proc`,
+ *   `pg_operator`), so `a.c` (a collation) used by `b.t.x` was invisible and the cascade reached
+ *   into `b.t.x` (Codex read of PR 357). Now the walk starts at `(pg_namespace, v_ns)` and follows
+ *   EVERY `pg_depend` row whose referenced object is already inside — the same edges
+ *   `findDependentObjects` (`dependency.c`) follows — so any object class `pg_depend` can name
+ *   (collation, conversion, opclass, opfamily, text-search, statistics, extension members, …)
+ *   is reached with no catalog enumerated to find it.
+ * ★ EVERY `deptype` FOLLOWS (`pg_depend`, catalogs.sgml); they differ only in attribution:
+ *     n NORMAL    cascade drops the dependent        → followed; foreign if it lives elsewhere
+ *     a AUTO      dropped with any drop              → followed; foreign if it lives elsewhere
+ *                 (an owned sequence in another schema is dropped with its table)
+ *     i INTERNAL  a part of the referenced object    → followed; attributed to its owner (below)
+ *     P / S       partition primary / secondary      → followed; a partition in another
+ *                 schema is dropped with its parent, so it is foreign
+ *     e EXTENSION member of an extension             → followed; the extension's members are
+ *                 dropped with it, wherever they live
+ *     x AUTO-EXT  auto, and dropped with the extension → followed like `a`
+ *     p PIN       system object, `refobjid = 0`      → never a referenced row, never joins
+ * ★ "INSIDE" is a home-schema test per class. TOAST is the case the old scan got wrong: a text
+ *   table's TOAST relation (and its index) lives in `pg_toast` and depends internally on the
+ *   table, so it is attributed to the table that owns it via `reltoastrelid` — otherwise every
+ *   cascade of a schema with a text column was refused. Constraints, triggers, rules, policies
+ *   and defaults have no schema of their own and take their table's.
+ * ⚠️ A CLASS THIS FILE DOES NOT KNOW (a cast, a foreign server, a language, an event trigger)
+ *   resolves to NULL, which is NOT inside: it counts as foreign. Unknown fails CLOSED. The walk
+ *   stops at a foreign object — one is enough to refuse.
+ * ★ A dependent created AFTER this scan is held off by the caller's locks (`schema-drop-sql.ts`).
+ */
+/**
+ * `v_count := …`: how many objects the cascade would drop outside `v_ns`, PLUS how many objects
+ * INSIDE it hold an `e` or `i` edge to an object outside the closure.
+ * ⛔ THE SECOND TERM IS THE OWNERSHIP ESCAPE (Codex read of PR 357, 2026-10-06). An inside table
+ *   added to a foreign extension (`ALTER EXTENSION x ADD TABLE a.t`) has an OUTGOING `e` edge; the
+ *   walk only follows edges INTO the closure, so it saw nothing, while `findDependentObjects`
+ *   redirects the deletion of an extension member / internal part to its OWNER and drops that
+ *   owner's other objects too. Any outgoing `e` or `i` edge leaving the closure counts as foreign:
+ *   refuse, never follow-and-classify (the simplest correct answer fails closed).
+ */
+export declare const OUTSIDE_DEPENDENTS_SQL: string;
+//# sourceMappingURL=schema-closure-sql.d.ts.map

package/dist/postgres/schema-closure-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-closure-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-closure-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAkDH;;;;;;;;;GASG;AACH,eAAO,MAAM,sBAAsB,QAe7B,CAAC"}

package/dist/postgres/schema-delete.d.ts

@@ -1,6 +1,6 @@
 /**
  * `Postgres.Schema`'s drop path: prove the connection, prove the schema is still ours, then
- * the guarded `DROP SCHEMA`.
+ * ONE atomic statement that re-proves it under a lock and drops (`schema-drop-sql.ts`).
  *
  * ⛔ THE ENGINE DOES NOT RE-READ BEFORE A DELETE THAT HAS STATE (alchemy `Apply.ts`). When
  *   persisted attributes exist, `delete` receives the LAST asserted `oid` + `owner` and no
@@ -10,19 +10,28 @@
  *   row that no longer matches the persisted proof fails with
  *   `PostgresSchemaDeleteForeignRefused` (`schema-assert.ts#deleteForeignRefusal`) before any
  *   `DROP` is issued.
+ * ⛔ THE RE-READ ALONE IS A WINDOW. It is a separate autocommit statement (a separate `psql` on
+ *   the runner transport), so the schema can change between the read and the drop. The drop
+ *   therefore carries the proven `oid` + `owner` INTO one `DO` block that locks, re-verifies
+ *   them, checks emptiness or cross-schema dependents, and drops in one transaction. This
+ *   file's read is the typed, readable refusal; the block is the guarantee.
  */
 import * as Effect from 'effect/Effect';
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import type { PgExecutor } from './database-sql.ts';
 import type { PostgresSchemaAttributes, PostgresSchemaProps } from './schema-attrs.ts';
-import { type PostgresSchemaDeleteForeignRefused, PostgresSchemaDropNotEmptyError, type PostgresSchemaWrongDatabase } from './schema-errors.ts';
-/** Prove the connected database, then the guarded drop — the drop core on its own, for the
- * tests that drive it directly. */
-export declare const dropWithClient: (pg: PgExecutor, props: PostgresSchemaProps) => Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDropNotEmptyError | SqlError>;
+import { PostgresSchemaCascadeCrossSchemaRefused, PostgresSchemaDeleteForeignRefused, PostgresSchemaDropNotEmptyError, type PostgresSchemaWrongDatabase } from './schema-errors.ts';
+import { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
+type DropError = PostgresSchemaDropNotEmptyError | PostgresSchemaCascadeCrossSchemaRefused | PostgresSchemaCascadeSequencesRefused | PostgresSchemaDeleteForeignRefused | SqlError;
+/** Prove the connected database, then the guarded drop of whatever row is live now — the drop
+ * core on its own, for the tests that drive it directly. No persisted proof is consulted: the
+ * row read here is the row the atomic drop re-verifies. */
+export declare const dropWithClient: (pg: PgExecutor, props: PostgresSchemaProps) => Effect.Effect<void, PostgresSchemaWrongDatabase | DropError>;
 /**
  * The core of `delete`: re-read first (see the file header), refuse a schema the persisted
- * proof cannot vouch for, then the guarded drop. `output` is the persisted state the engine
- * hands over — `undefined` is no proof and refuses too.
+ * proof cannot vouch for, then the atomic guarded drop. `output` is the persisted state the
+ * engine hands over — `undefined` is no proof and refuses too.
  */
-export declare const deleteWithClient: (pg: PgExecutor, props: PostgresSchemaProps, output: PostgresSchemaAttributes | undefined) => Effect.Effect<void, PostgresSchemaWrongDatabase | PostgresSchemaDeleteForeignRefused | PostgresSchemaDropNotEmptyError | SqlError>;
+export declare const deleteWithClient: (pg: PgExecutor, props: PostgresSchemaProps, output: PostgresSchemaAttributes | undefined) => Effect.Effect<void, PostgresSchemaWrongDatabase | DropError>;
+export {};
 //# sourceMappingURL=schema-delete.d.ts.map

package/dist/postgres/schema-delete.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-delete.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;GAYG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EACL,KAAK,kCAAkC,EACvC,+BAA+B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAuC5B;mCACmC;AACnC,eAAO,MAAM,cAAc,OACrB,UAAU,SACP,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,+BAA+B,GAAG,QAAQ,CAI3F,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,OACvB,UAAU,SACP,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,KAC3C,MAAM,CAAC,MAAM,CACd,IAAI,EACF,2BAA2B,GAC3B,kCAAkC,GAClC,+BAA+B,GAC/B,QAAQ,CASR,CAAC"}
+{"version":3,"file":"schema-delete.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-delete.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,EACL,uCAAuC,EACvC,kCAAkC,EAClC,+BAA+B,EAC/B,KAAK,2BAA2B,EACjC,MAAM,oBAAoB,CAAC;AAU5B,OAAO,EAAE,qCAAqC,EAAkB,MAAM,4BAA4B,CAAC;AAGnG,KAAK,SAAS,GACV,+BAA+B,GAC/B,uCAAuC,GACvC,qCAAqC,GACrC,kCAAkC,GAClC,QAAQ,CAAC;AA4Db;;2DAE2D;AAC3D,eAAO,MAAM,cAAc,OACrB,UAAU,SACP,mBAAmB,KACzB,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,SAAS,CAM1D,CAAC;AAEL;;;;GAIG;AACH,eAAO,MAAM,gBAAgB,OACvB,UAAU,SACP,mBAAmB,UAClB,wBAAwB,GAAG,SAAS,KAC3C,MAAM,CAAC,MAAM,CAAC,IAAI,EAAE,2BAA2B,GAAG,SAAS,CAQ1D,CAAC"}

package/dist/postgres/schema-drop-sql.d.ts

@@ -0,0 +1,66 @@
+/**
+ * The atomic `DROP SCHEMA` `Postgres.Schema` issues: ONE `DO` statement that takes a lock,
+ * re-proves the schema inside the same transaction, refuses what must not be dropped, and only
+ * then drops.
+ *
+ * ⛔ PROOF AND DROP ARE ONE STATEMENT, ONE TRANSACTION. Before 2026-10-02 the re-read, the
+ *   emptiness check and the `DROP` were three autocommit statements — three `psql` processes on
+ *   the runner transport — so an out-of-band drop-and-recreate between them was dropped by name,
+ *   `CASCADE` included (Opus read of PR 334). A `DO` block is atomic on both transports and needs
+ *   no `BEGIN`/`COMMIT` the runner would have to thread through.
+ * ⛔ THE LOCK MUST CONFLICT WITH DDL, NOT ONLY WITH OTHER RUNS OF THIS PROVIDER. An advisory lock
+ *   (`pg_advisory_xact_lock`) is cooperative: an ordinary `DROP SCHEMA` + `CREATE SCHEMA` ignores
+ *   it, and the by-name `DROP` below would then drop the REPLACEMENT, `CASCADE` included (Codex
+ *   read of PR 357, 2026-10-06). So, BEFORE the re-verify and held to the end of the transaction:
+ *   (1) `COMMENT ON SCHEMA <name> IS <its current comment>` — `CommentObject` resolves the schema
+ *   through `get_object_address(…, ShareUpdateExclusiveLock)`, which locks the namespace OBJECT
+ *   (`LockDatabaseObject`), and `DROP SCHEMA` takes `AccessExclusiveLock` on that same object
+ *   (`AcquireDeletionLock`), so a concurrent drop waits for us; (2) on a cascade, `LOCK TABLE …
+ *   IN ACCESS EXCLUSIVE MODE` on every table-like relation in the schema, which holds off a
+ *   concurrent creator of a dependent (a view or foreign key reads the table it references).
+ *   Lock modes: PostgreSQL docs, explicit-locking.html §13.3; `COMMENT`: sql-comment.html.
+ *   `lock_timeout` turns any wait into `55P03`, an unclassified error: the drop is REFUSED, never
+ *   forced. A comment-less schema is rewritten as `IS NULL`, which still takes the lock.
+ * ⛔ RENAME TAKES NO SUCH LOCK (Codex read of PR 357, 2026-10-06): `ALTER SCHEMA … RENAME` updates
+ *   `pg_namespace` without locking the object, so a rename-then-`CREATE SCHEMA` of the same name
+ *   committed while we waited on a table lock would make the by-name `DROP` delete the
+ *   REPLACEMENT. The last statement before the `DROP` re-reads the name of the verified OID and
+ *   refuses `HF001` if it moved; only the statements between that read and the `DROP` remain.
+ * ⛔ SEQUENCES REFUSE THE CASCADE (`HF004`, KNOWN LIMIT; `schema-sequence-error.ts`). `LOCK TABLE`
+ *   cannot lock a sequence, so an uncommitted `CREATE VIEW b.v AS SELECT last_value FROM a.s` is
+ *   invisible to the closure scan, and PostgreSQL's deletion (locks first, THEN scans dependents)
+ *   would cascade into `b.v` once it commits. A schema with serial or identity columns therefore
+ *   cannot be cascade-dropped here: drop its contents first. The check runs before any table lock.
+ * ⚠️ NOT COVERED: a type,
+ *   function or collation created in ANOTHER schema to use ours has no relation to wait on. The
+ *   advisory lock stays: it serialises runs of this provider, which is cheap and correct.
+ * ★ THE VALUES ARE LITERALS INSIDE THE BODY, AND THE BODY IS ONE `E'…'` LITERAL. A `DO` body
+ *   takes no bind parameters, and a dollar-quote tag could be forged by a schema NAME containing
+ *   it; `quoteStringLiteral` doubles backslashes and quotes, so nesting it twice is exact.
+ *   The `DROP` text inside is `buildDropSchemaSql` run through `EXECUTE`, so the quoting rule is
+ *   the same single one.
+ * ★ REFUSALS ARE CUSTOM SQLSTATEs, read from `reason.cause.code` exactly like `2BP01`
+ *   (`schema-sql.ts#isDependentObjectsError`): `HF001` identity changed, `HF002` not empty,
+ *   `HF003` dependents in another schema, `HF004` a cascade over a schema holding a sequence. Class `HF` is not `42`, so both transports wrap it as
+ *   `UnknownError` with the raw code. The `HF003` message carries a COUNT only: another owner's
+ *   object names must not reach this stack's logs.
+ */
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+export declare const IDENTITY_CHANGED = "HF001";
+export declare const NOT_EMPTY = "HF002";
+export declare const CROSS_SCHEMA_DEPENDENTS = "HF003";
+export declare const CASCADE_SEQUENCES = "HF004";
+export interface AtomicDrop {
+    readonly name: string;
+    readonly oid: number;
+    readonly owner: string;
+    readonly cascade: boolean;
+}
+/** The whole atomic drop: lock → re-verify → refuse or drop. Pure text, no client. */
+export declare const buildAtomicDropSql: (drop: AtomicDrop) => string;
+/** The server's SQLSTATE on a failed statement, whichever transport raised it. */
+export declare const sqlStateOf: (error: SqlError) => string | undefined;
+/** The dependents COUNT out of an `HF003` error. An unreadable message still refuses: it
+ * answers 1, never 0 — the refusal is the fail-closed answer. */
+export declare const dependentsCount: (error: SqlError) => number;
+//# sourceMappingURL=schema-drop-sql.d.ts.map

package/dist/postgres/schema-drop-sql.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-drop-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-drop-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA8CG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAK7D,eAAO,MAAM,gBAAgB,UAAU,CAAC;AACxC,eAAO,MAAM,SAAS,UAAU,CAAC;AACjC,eAAO,MAAM,uBAAuB,UAAU,CAAC;AAC/C,eAAO,MAAM,iBAAiB,UAAU,CAAC;AAKzC,MAAM,WAAW,UAAU;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;CAC3B;AAED,sFAAsF;AACtF,eAAO,MAAM,kBAAkB,SAAU,UAAU,KAAG,MAiDrD,CAAC;AAEF,kFAAkF;AAClF,eAAO,MAAM,UAAU,UAAW,QAAQ,KAAG,MAAM,GAAG,SAKrD,CAAC;AAEF;iEACiE;AACjE,eAAO,MAAM,eAAe,UAAW,QAAQ,KAAG,MAKjD,CAAC"}

package/dist/postgres/schema-errors.d.ts

@@ -1,3 +1,4 @@
+import type { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
 declare const PostgresSchemaNameRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "PostgresSchemaNameRefused";
 } & Readonly<A>;
@@ -65,6 +66,23 @@ export declare class PostgresSchemaDropNotEmptyError extends PostgresSchemaDropN
 }> {
     get message(): string;
 }
+declare const PostgresSchemaCascadeCrossSchemaRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaCascadeCrossSchemaRefused";
+} & Readonly<A>;
+/**
+ * `cascade: true` refused: `DROP SCHEMA … CASCADE` would also drop objects that live in OTHER
+ * schemas because they depend on something in this one (a view, a foreign key or a trigger
+ * another stack owns). The refusal carries the COUNT only — never an object name, so the error
+ * cannot disclose another owner's catalog. Nothing was dropped: move or drop those dependents
+ * deliberately, or empty this schema by hand and declare `cascade: false`.
+ */
+export declare class PostgresSchemaCascadeCrossSchemaRefused extends PostgresSchemaCascadeCrossSchemaRefused_base<{
+    readonly schema: string;
+    /** How many dependent objects live outside this schema (at least one when raised). */
+    readonly dependents: number;
+}> {
+    get message(): string;
+}
 declare const PostgresSchemaWrongDatabase_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
     readonly _tag: "PostgresSchemaWrongDatabase";
 } & Readonly<A>;
@@ -134,6 +152,6 @@ export declare class PostgresSchemaIdentityRefused extends PostgresSchemaIdentit
 }> {
     get message(): string;
 }
-export type PostgresSchemaError = PostgresSchemaExistsRefused | PostgresSchemaIdentityRefused | PostgresSchemaNameRefused | PostgresSchemaRenameRefused | PostgresSchemaOwnerMissing | PostgresSchemaDrift | PostgresSchemaCreateVanished | PostgresSchemaDropNotEmptyError | PostgresSchemaDeleteForeignRefused | PostgresSchemaWrongDatabase | PostgresSchemaDatabaseRefused;
+export type PostgresSchemaError = PostgresSchemaExistsRefused | PostgresSchemaIdentityRefused | PostgresSchemaNameRefused | PostgresSchemaRenameRefused | PostgresSchemaOwnerMissing | PostgresSchemaDrift | PostgresSchemaCreateVanished | PostgresSchemaDropNotEmptyError | PostgresSchemaCascadeCrossSchemaRefused | PostgresSchemaCascadeSequencesRefused | PostgresSchemaDeleteForeignRefused | PostgresSchemaWrongDatabase | PostgresSchemaDatabaseRefused;
 export {};
 //# sourceMappingURL=schema-errors.d.ts.map

package/dist/postgres/schema-errors.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-errors.ts"],"names":[],"mappings":";;;AAOA,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;8BAC8B;AAC9B,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,yFAAyF;AACzF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;yCAIyC;AACzC,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,wCAEtD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAW7B;CACF;;;;AAED;2FAC2F;AAC3F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,iGAAiG;AACjG,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,mBAAmB,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,4BAA4B,GAC5B,+BAA+B,GAC/B,kCAAkC,GAClC,2BAA2B,GAC3B,6BAA6B,CAAC"}
+{"version":3,"file":"schema-errors.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-errors.ts"],"names":[],"mappings":"AAMA,OAAO,KAAK,EAAE,qCAAqC,EAAE,MAAM,4BAA4B,CAAC;;;;AAExF,2FAA2F;AAC3F,qBAAa,yBAA0B,SAAQ,+BAA8C;IAC3F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;IAC5B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;8BAC8B;AAC9B,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,yFAAyF;AACzF,qBAAa,0BAA2B,SAAQ,gCAA+C;IAC7F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAE7B;CACF;;;;AAED,qFAAqF;AACrF,qBAAa,mBAAoB,SAAQ,yBAAwC;IAC/E,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;IAC3B,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;CACxB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED,4FAA4F;AAC5F,qBAAa,4BAA6B,SAAQ,kCAAiD;IACjG,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;GAKG;AACH,qBAAa,+BAAgC,SAAQ,qCAEnD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAK7B;CACF;;;;AAED;;;;;;GAMG;AACH,qBAAa,uCAAwC,SAAQ,6CAE3D;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sFAAsF;IACtF,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAC;CAC7B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED;;;;yCAIyC;AACzC,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;;;;AAED;;;;;;;GAOG;AACH,qBAAa,kCAAmC,SAAQ,wCAEtD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;IACzB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,6FAA6F;IAC7F,QAAQ,CAAC,OAAO,EAAE,MAAM,GAAG,SAAS,CAAC;IACrC,QAAQ,CAAC,SAAS,EAAE,MAAM,GAAG,SAAS,CAAC;CACxC,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAW7B;CACF;;;;AAED;2FAC2F;AAC3F,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,EAAE,MAAM,CAAC;CACrB,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,gGAAgG;AAChG,qBAAa,2BAA4B,SAAQ,iCAAgD;IAC/F,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;CAC3B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;;;;AAED,iGAAiG;AACjG,qBAAa,6BAA8B,SAAQ,mCAEjD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;IAC3B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAM7B;CACF;AAED,MAAM,MAAM,mBAAmB,GAC3B,2BAA2B,GAC3B,6BAA6B,GAC7B,yBAAyB,GACzB,2BAA2B,GAC3B,0BAA0B,GAC1B,mBAAmB,GACnB,4BAA4B,GAC5B,+BAA+B,GAC/B,uCAAuC,GACvC,qCAAqC,GACrC,kCAAkC,GAClC,2BAA2B,GAC3B,6BAA6B,CAAC"}

package/dist/postgres/schema-sequence-error.d.ts

@@ -0,0 +1,29 @@
+declare const PostgresSchemaCascadeSequencesRefused_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "PostgresSchemaCascadeSequencesRefused";
+} & Readonly<A>;
+/**
+ * `cascade: true` on a schema that holds a SEQUENCE is refused (`HF004`, `schema-drop-sql.ts`).
+ *
+ * ⛔ A sequence cannot be locked by `LOCK TABLE`, so the drop's closure proof has a hole there: a
+ *   concurrent, uncommitted `CREATE VIEW other.v AS SELECT last_value FROM ours.seq` is invisible
+ *   to the scan, and when it commits while the drop waits on the sequence, PostgreSQL's deletion
+ *   cascades into `other.v` (Codex read of PR 357, 2026-10-06). Serial and identity columns each
+ *   own a sequence, so such a schema cannot be cascade-dropped by this provider.
+ * The message carries a COUNT only. Nothing was dropped: drop the schema's contents deliberately
+ * (the sequences included), then declare `cascade: false`.
+ */
+export declare class PostgresSchemaCascadeSequencesRefused extends PostgresSchemaCascadeSequencesRefused_base<{
+    readonly schema: string;
+    /** How many sequences the schema holds (at least one when raised). */
+    readonly sequences: number;
+}> {
+    get message(): string;
+}
+/** The sequence COUNT out of an `HF004` error; unreadable still refuses (1, never 0). */
+export declare const sequencesCount: (error: {
+    readonly reason: {
+        readonly cause?: unknown;
+    };
+}) => number;
+export {};
+//# sourceMappingURL=schema-sequence-error.d.ts.map

package/dist/postgres/schema-sequence-error.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"schema-sequence-error.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-sequence-error.ts"],"names":[],"mappings":";;;AAEA;;;;;;;;;;GAUG;AACH,qBAAa,qCAAsC,SAAQ,2CAEzD;IACA,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;IACxB,sEAAsE;IACtE,QAAQ,CAAC,SAAS,EAAE,MAAM,CAAC;CAC5B,CAAC;IACA,IAAa,OAAO,IAAI,MAAM,CAO7B;CACF;AAED,yFAAyF;AACzF,eAAO,MAAM,cAAc,UAAW;IACpC,QAAQ,CAAC,MAAM,EAAE;QAAE,QAAQ,CAAC,KAAK,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAC/C,KAAG,MAIH,CAAC"}

package/dist/postgres/schema-sql.d.ts

@@ -27,6 +27,22 @@ export declare const selectSchema: (pg: PgExecutor, name: string) => Effect.Effe
  * family connection points at. */
 export declare const currentDatabase: (pg: PgExecutor) => Effect.Effect<string, SqlError>;
 export declare const currentUser: (pg: PgExecutor) => Effect.Effect<string, SqlError>;
+/**
+ * "Empty" means no object of ANY kind the schema owns. Measured object kinds live in four
+ * catalogs: relations (tables, views, indexes, sequences — `pg_class`), functions and
+ * aggregates (`pg_proc`), types, domains and enums (`pg_type`), operators (`pg_operator`). A
+ * kind without a dedicated catalog (an extension's `extnamespace`, a collation) can still pass
+ * this check — and then the plain `DROP SCHEMA` answers `2BP01`, which `dropWithClient`
+ * classifies as the same typed refusal.
+ *
+ * ⚠️ THE FAKE (`fake-schema-sql.ts`) ROUTES THIS STATEMENT BY `AS empty` + `pg_class` — keep both
+ *   markers in any rewrite, and keep this check matched BEFORE the plain `pg_namespace` branch
+ *   (this SQL contains `FROM pg_catalog.pg_namespace` too, inside its `WITH`).
+ */
+/** The four-catalog emptiness predicate over a namespace oid expression — shared by this read
+ * and by the atomic drop's in-transaction check (`schema-drop-sql.ts`), so the two cannot
+ * disagree about what "empty" means. */
+export declare const emptyPredicate: (ns: string) => string;
 /** `true` when the schema holds none of the four object catalogs above (used before a
  * non-cascade `DROP SCHEMA`). */
 export declare const schemaIsEmpty: (pg: PgExecutor, name: string) => Effect.Effect<boolean, SqlError>;

package/dist/postgres/schema-sql.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,2FAA2F;AAC3F,eAAO,MAAM,oBAAoB,UAAW,mBAAmB,KAAG,MAG9D,CAAC;AAEL,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,SAAU,MAAM,WAAW,MAAM,KAAG,MACK,CAAC;AAE5E,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAAW,OAAO,KAAG,MACK,CAAC;AAW1E;4FAC4F;AAC5F,eAAO,MAAM,YAAY,OACnB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,EAAE,QAAQ,CACgC,CAAC;AAIhG;;kCAEkC;AAClC,eAAO,MAAM,eAAe,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM5E,CAAC;AAUJ,eAAO,MAAM,WAAW,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKxE,CAAC;AAyBJ;iCACiC;AACjC,eAAO,MAAM,aAAa,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAIzF,CAAC;AAEJ;;;;;;;;6FAQ6F;AAC7F,eAAO,MAAM,uBAAuB,UAAW,QAAQ,KAAG,OAKzD,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,UAAW,QAAQ,KAAG,OAKxD,CAAC"}
+{"version":3,"file":"schema-sql.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-sql.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,2FAA2F;AAC3F,eAAO,MAAM,oBAAoB,UAAW,mBAAmB,KAAG,MAG9D,CAAC;AAEL,mFAAmF;AACnF,eAAO,MAAM,qBAAqB,SAAU,MAAM,WAAW,MAAM,KAAG,MACK,CAAC;AAE5E,2FAA2F;AAC3F,eAAO,MAAM,kBAAkB,SAAU,MAAM,WAAW,OAAO,KAAG,MACK,CAAC;AAW1E;4FAC4F;AAC5F,eAAO,MAAM,YAAY,OACnB,UAAU,QACR,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,wBAAwB,GAAG,SAAS,EAAE,QAAQ,CACgC,CAAC;AAIhG;;kCAEkC;AAClC,eAAO,MAAM,eAAe,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAM5E,CAAC;AAUJ,eAAO,MAAM,WAAW,OAAQ,UAAU,KAAG,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,QAAQ,CAKxE,CAAC;AAEJ;;;;;;;;;;;GAWG;AACH;;wCAEwC;AACxC,eAAO,MAAM,cAAc,OAAQ,MAAM,KAAG,MAQxC,CAAC;AAKL;iCACiC;AACjC,eAAO,MAAM,aAAa,OAAQ,UAAU,QAAQ,MAAM,KAAG,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,QAAQ,CAIzF,CAAC;AAEJ;;;;;;;;6FAQ6F;AAC7F,eAAO,MAAM,uBAAuB,UAAW,QAAQ,KAAG,OAKzD,CAAC;AAEF,0FAA0F;AAC1F,eAAO,MAAM,sBAAsB,UAAW,QAAQ,KAAG,OAKxD,CAAC"}

package/dist/postgres/schema-test-kit.d.ts

@@ -37,7 +37,9 @@ export declare const router: (answers: RouteAnswers) => (stdin: string) => strin
  * `answers`. The argv recording pins the `-d` database each statement ran against — the last
  * element of the argv is the `psql -d` value (`psql-executor.ts`).
  */
-export declare const runnerWith: (answers: (stdin: string) => string) => {
+export declare const runnerWith: (answers: (stdin: string) => string, 
+/** The `psql` stderr a statement fails with (exit 3), or `undefined` to answer normally. */
+failOn?: (stdin: string) => string | undefined) => {
     run: PsqlRunner;
     stdins: string[];
     argvs: Array<readonly string[]>;

package/dist/postgres/schema-test-kit.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"schema-test-kit.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AACrD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,eAAO,MAAM,EAAE,WAAY,MAAM;;;;EAAqD,CAAC;AAEvF,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8FAA8F;AAC9F,eAAO,MAAM,KAAK,UAAW,MAAM,WAAW,YAAY,KAAG,MAAM,GAAG,SAMrE,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,MAAM,YAAa,YAAY,aAAa,MAAM,WAAgC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,UAAU,YACZ,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,KACjC;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAYtE,CAAC;AAEF;;mDAEmD;AACnD,eAAO,MAAM,UAAU,SAAU,mBAAmB,UAAU,wBAAwB;;;;;;aAM9D,KAAK;cACX,KAAK;CACrB,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,SAAU,mBAAmB;;;;;;aAM1B,KAAK;cACX,KAAK;CACrB,CAAC"}
+{"version":3,"file":"schema-test-kit.d.ts","sourceRoot":"","sources":["../../src/postgres/schema-test-kit.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,oBAAoB,CAAC;AAErD,OAAO,KAAK,EAAE,wBAAwB,EAAE,mBAAmB,EAAE,MAAM,mBAAmB,CAAC;AAEvF,eAAO,MAAM,EAAE,WAAY,MAAM;;;;EAAqD,CAAC;AAEvF,6FAA6F;AAC7F,MAAM,WAAW,YAAY;IAC3B,wEAAwE;IACxE,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,6EAA6E;IAC7E,QAAQ,CAAC,MAAM,CAAC,EAAE,MAAM,CAAC;IACzB,+FAA+F;IAC/F,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;IACxB,wFAAwF;IACxF,QAAQ,CAAC,KAAK,CAAC,EAAE,MAAM,CAAC;CACzB;AAED,8FAA8F;AAC9F,eAAO,MAAM,KAAK,UAAW,MAAM,WAAW,YAAY,KAAG,MAAM,GAAG,SASrE,CAAC;AAEF,yFAAyF;AACzF,eAAO,MAAM,MAAM,YAAa,YAAY,aAAa,MAAM,WAAgC,CAAC;AAEhG;;;;GAIG;AACH,eAAO,MAAM,UAAU,YACZ,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM;AAClC,4FAA4F;SACpF,CAAC,KAAK,EAAE,MAAM,KAAK,MAAM,GAAG,SAAS,KAC5C;IAAE,GAAG,EAAE,UAAU,CAAC;IAAC,MAAM,EAAE,MAAM,EAAE,CAAC;IAAC,KAAK,EAAE,KAAK,CAAC,SAAS,MAAM,EAAE,CAAC,CAAA;CAoBtE,CAAC;AAEF;;mDAEmD;AACnD,eAAO,MAAM,UAAU,SAAU,mBAAmB,UAAU,wBAAwB;;;;;;aAM9D,KAAK;cACX,KAAK;CACrB,CAAC;AAEH,2FAA2F;AAC3F,eAAO,MAAM,QAAQ,SAAU,mBAAmB;;;;;;aAM1B,KAAK;cACX,KAAK;CACrB,CAAC"}

package/dist/postgres/search-path.d.ts

@@ -0,0 +1,38 @@
+/**
+ * The session setup every `Postgres.*` connection runs first: `search_path = pg_catalog, pg_temp`.
+ *
+ * ⛔ AN UNPINNED SESSION READS ITS OWN CATALOGS THROUGH `search_path`. Postgres searches
+ *   `pg_catalog` first only while the path does not NAME it (ddl.sgml 5.10.3); a role- or
+ *   database-level `ALTER … SET search_path = public, pg_catalog` (or a path naming any schema
+ *   another role may create in) puts a writable schema ahead of it, and a `public.pg_namespace`
+ *   TABLE then answers the delete proof's `oid`/`owner` re-read. Found by the Opus read of PR 334
+ *   (2026-10-02). The pin makes the order ours whatever the role, database or server says; the SQL
+ *   builders ALSO write `pg_catalog.<name>` (`catalog-qualified.test.ts` greps for it), so no
+ *   single layer is the whole defence.
+ * ★ `pg_temp` goes LAST on purpose: unnamed, it is searched FIRST for relations.
+ * ★ TWO TRANSPORTS, TWO MECHANISMS. The runner path prefixes the stdin script: `psql` argv is
+ *   the consumer's to join into a remote command, and a value with a space would split. The
+ *   socket path pins the ONE connection an operation reserves, because the driver's startup
+ *   message carries user, database and application_name only (`PgConnection.ts`, 4.0.0-rc.115)
+ *   and a pool hands each statement a different, unpinned connection.
+ */
+import type { PgClient } from '@effect/sql-pg/PgClient';
+import * as Effect from 'effect/Effect';
+import type * as Scope from 'effect/Scope';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import type { PgExecutor } from './database-sql.ts';
+export declare const PIN_SEARCH_PATH_SQL = "SET search_path = pg_catalog, pg_temp";
+/** The runner path's script prefix. */
+export declare const PIN_SCRIPT_PREFIX = "SET search_path = pg_catalog, pg_temp;\n";
+/** A runner stdin without its pin — for tests that assert the statement that follows it. */
+export declare const stripPin: (stdin: string) => string;
+/**
+ * A `PgExecutor` over ONE reserved, pinned connection, for the life of the surrounding scope.
+ * `unsafe` runs on it (the client routes any statement under `transactionService` to that
+ * connection, so spans and error classification stay the driver's); `transaction` is a plain
+ * `BEGIN` … `COMMIT` on it — `withTransaction` would open a SAVEPOINT, because the service is
+ * already provided. A failure rolls back, and the pin is re-asserted by the next operation's own
+ * reservation, never assumed to survive one.
+ */
+export declare const pinnedSocketExecutor: (pg: PgClient) => Effect.Effect<PgExecutor, SqlError, Scope.Scope>;
+//# sourceMappingURL=search-path.d.ts.map

package/dist/postgres/search-path.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"search-path.d.ts","sourceRoot":"","sources":["../../src/postgres/search-path.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;GAiBG;AACH,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,KAAK,MAAM,MAAM,eAAe,CAAC;AACxC,OAAO,KAAK,KAAK,KAAK,MAAM,cAAc,CAAC;AAC3C,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,8BAA8B,CAAC;AAC7D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAEpD,eAAO,MAAM,mBAAmB,0CAA0C,CAAC;AAE3E,uCAAuC;AACvC,eAAO,MAAM,iBAAiB,6CAA8B,CAAC;AAE7D,4FAA4F;AAC5F,eAAO,MAAM,QAAQ,UAAW,MAAM,KAAG,MAC4C,CAAC;AAEtF;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,OAC3B,QAAQ,KACX,MAAM,CAAC,MAAM,CAAC,UAAU,EAAE,QAAQ,EAAE,KAAK,CAAC,KAAK,CAkB9C,CAAC"}

package/docs/postgres-schema.md

@@ -97,7 +97,28 @@ empty, or when `cascade: true` is declared.
   as the same typed tag. `2BP01` is class `2B`, so both transports wrap it as `UnknownError`
   with the raw code on `reason.cause.code` — the classifier reads that code, not the tag.
 - With `cascade: true` the drop is `DROP SCHEMA IF EXISTS … CASCADE` and removes the schema's
-  objects too. The `IF EXISTS` makes delete idempotent.
+  objects too — and, because Postgres cascades through `pg_depend`, anything in ANOTHER schema
+  that depends on them (a view, a foreign key, a trigger another stack owns). So before a
+  cascade drop the atomic block counts those dependents and refuses with
+  `PostgresSchemaCascadeCrossSchemaRefused`, naming the COUNT only (never another owner's
+  object names). A dependent whose catalog class is not recognised counts as foreign: the check
+  fails closed. The `IF EXISTS` makes delete idempotent.
+- Known limit: `cascade: true` over a schema that holds a sequence (every serial or identity
+  column owns one) is refused with `PostgresSchemaCascadeSequencesRefused` (`HF004`, count only).
+  A sequence cannot be locked, so a concurrent view over it could escape the dependency proof;
+  drop the schema's contents first, then declare `cascade: false`.
+- The proof and the drop are ONE statement. The re-read, the emptiness (or dependents) check and
+  the `DROP` run in a single `DO` block, so on the runner transport it is one `psql`. The block
+  takes `pg_advisory_xact_lock(<schema oid>)`, re-verifies the persisted `oid` + `owner` inside
+  the transaction, and only then drops; a schema replaced after the read is
+  `PostgresSchemaDeleteForeignRefused`. The lock is cooperative (it serialises two runs of this
+  provider, not an arbitrary `CREATE TABLE`); a creator that slips in after the check is still
+  caught by the server's own `2BP01` on a plain drop.
+- Every session pins `search_path = pg_catalog, pg_temp` (`search-path.ts`) and every SQL
+  builder writes `pg_catalog.<name>`, so a role that can create objects in a schema on its
+  path cannot forge `pg_namespace` and fake the delete proof. Runner path: the script is
+  prefixed with the `SET`; socket path: the one reserved connection an operation uses is pinned
+  first (`search-path.test.ts` greps the builders for an unqualified catalog name).
 - A `cascade` change is a real change: it answers `update` (compared against the previous
   declaration's persisted props), so the flipped value reaches state and the eventual drop
   uses it — a schema first declared `cascade: true` stops dropping with CASCADE once the

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homeflare/alchemy",
-  "version": "0.46.0",
+  "version": "0.46.1",
   "description": "Custom Alchemy providers for Cloudflare, Proxmox, OpenBao, Forgejo, Talos, launchd and Caddy, and a verifier that proves adoptions are no-ops.",
   "homepage": "https://github.com/taslabs-net/homeflare-kit/tree/main/packages/alchemy#readme",
   "bugs": "https://github.com/taslabs-net/homeflare-kit/issues",

package/src/postgres/connection.ts

@@ -20,6 +20,7 @@ import * as Layer from 'effect/Layer';
 import type { SqlError } from 'effect/unstable/sql/SqlError';
 import type { PgExecutor } from './database-sql.ts';
 import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
+import { pinnedSocketExecutor } from './search-path.ts';
 
 /** What a stack passes to reach one cluster. `host` may be a socket directory (one beginning
  * with `/` expands to `${host}/.s.PGSQL.${port}` — measured in
@@ -109,21 +110,16 @@ export const withPg = <A, E>(
       });
     }
     const pool = yield* PostgresPool;
+    // ⛔ ONE RESERVED, PINNED CONNECTION FOR THE WHOLE OPERATION (`search-path.ts`): the pin is a
+    // session setting, so a pool checkout per statement would run most statements unpinned — and
+    // would autocommit CREATE before GRANT. `Effect.scoped` releases the reservation; the pool
+    // layer below closes the pool after.
     return yield* Effect.provide(
-      Effect.flatMap(PgClient.PgClient, (pg) =>
-        build(
-          {
-            unsafe: (sql, params) => pg.unsafe(sql, params),
-            // One reserved connection (`SqlClient.withTransaction`). A pool checkout per
-            // statement would autocommit CREATE before GRANT.
-            transaction: (statements) =>
-              pg.withTransaction(
-                Effect.gen(function* () {
-                  for (const sql of statements) yield* pg.unsafe(sql).pipe(Effect.asVoid);
-                }),
-              ),
-          },
-          { database: target.database },
+      Effect.scoped(
+        Effect.flatMap(PgClient.PgClient, (pg) =>
+          Effect.flatMap(pinnedSocketExecutor(pg), (executor) =>
+            build(executor, { database: target.database }),
+          ),
         ),
       ),
       pool(target),

package/src/postgres/database-bigint-serialization.test.ts

@@ -76,10 +76,10 @@ const wireAccuratePg = (seed?: {
   return {
     unsafe: <A extends object>(text: string, params: ReadonlyArray<unknown> = []) =>
       Effect.suspend(() => {
-        if (text.startsWith('SELECT 1 AS present FROM pg_roles')) {
+        if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_roles')) {
           return Effect.succeed([{ present: 1 }] as unknown as ReadonlyArray<A>);
         }
-        if (text.includes('FROM pg_database')) {
+        if (text.includes('FROM pg_catalog.pg_database')) {
           if (created === undefined) return Effect.succeed([] as unknown as ReadonlyArray<A>);
           const row = wireAccurateRow(text, created.oid, created.connectionLimit);
           return Effect.succeed([row] as unknown as ReadonlyArray<A>);

package/src/postgres/database-sql.ts

@@ -103,7 +103,7 @@ export const isDuplicateDatabaseRace = (error: SqlError): boolean => {
   );
 };
 
-const ROLE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_roles WHERE rolname = $1';
+const ROLE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_roles WHERE rolname = $1';
 
 /** `OWNER` is checked against `pg_roles` before any `CREATE`, so a missing role is
  * `PostgresDatabaseOwnerMissing` at reconcile time rather than the server's own
@@ -114,7 +114,7 @@ export const roleExists = (pg: PgExecutor, role: string): Effect.Effect<boolean,
     (rows) => rows.length > 0,
   );
 
-const DATABASE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_database WHERE datname = $1';
+const DATABASE_EXISTS_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_database WHERE datname = $1';
 
 /**
  * Does one database of the cluster exist? `Postgres.Schema` runs this over the FAMILY
@@ -152,8 +152,8 @@ export const databaseExists = (pg: PgExecutor, name: string): Effect.Effect<bool
 const SELECT_DATABASE_SQL = `SELECT
     d.oid AS oid,
     d.datname AS name,
-    pg_get_userbyid(d.datdba) AS owner,
-    pg_encoding_to_char(d.encoding) AS encoding,
+    pg_catalog.pg_get_userbyid(d.datdba) AS owner,
+    pg_catalog.pg_encoding_to_char(d.encoding) AS encoding,
     CASE d.datlocprovider
       WHEN 'b' THEN 'builtin' WHEN 'i' THEN 'icu' WHEN 'c' THEN 'libc'
       ELSE 'libc'
@@ -164,8 +164,8 @@ const SELECT_DATABASE_SQL = `SELECT
     d.datconnlimit AS "connectionLimit",
     d.datistemplate AS "isTemplate",
     t.spcname AS tablespace
-  FROM pg_database d
-  JOIN pg_tablespace t ON t.oid = d.dattablespace
+  FROM pg_catalog.pg_database d
+  JOIN pg_catalog.pg_tablespace t ON t.oid = d.dattablespace
   WHERE d.datname = $1`;
 
 /** The read: one bound `SELECT` on `pg_database`, joined to the two functions that turn its raw

package/src/postgres/fake-grants-read.ts

@@ -96,17 +96,17 @@ export const answerRead = <A extends object>(
 ): Effect.Effect<ReadonlyArray<A>, SqlError> | undefined => {
   const { acl, schemas, roles, databases, tables } = model;
 
-  if (text.startsWith('SELECT 1 AS present FROM pg_roles')) {
+  if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_roles')) {
     return Effect.succeed(
       (roles.has(params[0] as string) ? [{ present: 1 }] : []) as unknown as ReadonlyArray<A>,
     );
   }
-  if (text.startsWith('SELECT 1 AS present FROM pg_namespace')) {
+  if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_namespace')) {
     return Effect.succeed(
       (schemas.has(params[0] as string) ? [{ present: 1 }] : []) as unknown as ReadonlyArray<A>,
     );
   }
-  if (text.startsWith('SELECT 1 AS present FROM pg_database')) {
+  if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_database')) {
     return Effect.succeed(
       (databases.has(params[0] as string) ? [{ present: 1 }] : []) as unknown as ReadonlyArray<A>,
     );

package/src/postgres/fake-role-sql.ts

@@ -97,7 +97,7 @@ export const applyRoleStatement = <A extends object>(
   text: string,
   params: ReadonlyArray<unknown>,
 ): Effect.Effect<ReadonlyArray<A>, SqlError> | undefined => {
-  if (text.includes('FROM pg_auth_members')) {
+  if (text.includes('FROM pg_catalog.pg_auth_members')) {
     const member = params[0] as string;
     const rows = [...state.memberships]
       .filter((key) => key.split('\0')[0] === member)
@@ -119,7 +119,7 @@ export const applyRoleStatement = <A extends object>(
     return Effect.succeed(rows as unknown as ReadonlyArray<A>);
   }
 
-  if (text.includes('FROM pg_roles r')) {
+  if (text.includes('FROM pg_catalog.pg_roles r')) {
     const name = params[0] as string;
     const row = state.roleRows.get(name);
     // pg_roles answers no password value (S25): even a seeded seal is not read back — state

package/src/postgres/fake-schema-drop.ts

@@ -0,0 +1,75 @@
+/**
+ * The fake's reading of the atomic `DO` drop `schema-drop-sql.ts` emits.
+ *
+ * ⛔ IT PARSES ITS OWN OUTPUT (the rule `fake-sql.ts` documents): the four `DECLARE` literals are
+ *   read back out of the generated text and the block's decisions are replayed against the
+ *   in-memory catalog in the same order the SQL makes them — absent → return, identity, empty or
+ *   cross-schema dependents, drop. A changed block shape fails the parse loudly.
+ */
+import * as Effect from 'effect/Effect';
+import { SqlError, UnknownError } from 'effect/unstable/sql/SqlError';
+import { parseLiteral } from './fake-sql-quote.ts';
+import { parseDropSchema } from './fake-sql-parse.ts';
+import type { FakeSchemaState } from './fake-schema-sql.ts';
+import {
+  CASCADE_SEQUENCES,
+  CROSS_SCHEMA_DEPENDENTS,
+  IDENTITY_CHANGED,
+  NOT_EMPTY,
+} from './schema-drop-sql.ts';
+
+const refusal = (code: string, message: string): SqlError =>
+  new SqlError({
+    reason: new UnknownError({
+      cause: Object.assign(new Error(message), { code }),
+      message,
+      operation: 'DO',
+    }),
+  });
+
+/** `E'…'` literal at the end of a generated line, decoded. */
+const literalAfter = (body: string, label: string): string => {
+  const match = new RegExp(`${label} [a-z]+ := (E'(?:[^']|'')*');`).exec(body);
+  if (match === null) throw new Error(`fake-sql: could not parse DO block ${label}: ${body}`);
+  return parseLiteral(match[1] as string);
+};
+
+export const applyAtomicDrop = (
+  state: FakeSchemaState,
+  text: string,
+): Effect.Effect<ReadonlyArray<never>, SqlError> => {
+  const body = parseLiteral(text.slice('DO '.length));
+  const name = literalAfter(body, 'v_name');
+  const owner = literalAfter(body, 'v_owner');
+  const oid = Number(/v_oid oid := (\d+);/.exec(body)?.[1]);
+  const cascade = /v_cascade boolean := (true|false);/.exec(body)?.[1] === 'true';
+  const drop = /EXECUTE (E'(?:[^']|'')*');/.exec(body)?.[1];
+  if (drop === undefined || Number.isNaN(oid)) {
+    throw new Error(`fake-sql: could not parse DO block: ${body}`);
+  }
+  if (parseDropSchema(parseLiteral(drop)).name !== name) {
+    throw new Error('fake-sql: DO block drops a different schema than it proves');
+  }
+  const row = state.schemas.get(name);
+  if (row === undefined) return Effect.succeed([]);
+  if (row.oid !== oid || row.owner !== owner) {
+    return Effect.fail(refusal(IDENTITY_CHANGED, 'schema identity changed'));
+  }
+  if (!cascade) {
+    if (state.relationsIn.has(name)) return Effect.fail(refusal(NOT_EMPTY, 'schema not empty'));
+  } else {
+    const sequences = state.sequencesIn.get(name) ?? 0;
+    if (sequences > 0) {
+      return Effect.fail(refusal(CASCADE_SEQUENCES, `cascade sequences: ${String(sequences)}`));
+    }
+    const outside = state.dependentsOutside.get(name) ?? 0;
+    if (outside > 0) {
+      return Effect.fail(
+        refusal(CROSS_SCHEMA_DEPENDENTS, `cross-schema dependents: ${String(outside)}`),
+      );
+    }
+    state.relationsIn.delete(name);
+  }
+  state.schemas.delete(name);
+  return Effect.succeed([]);
+};