@homeflare/alchemy 0.46.0 → 0.46.1

package/src/postgres/fake-schema-sql.ts

@@ -10,6 +10,7 @@
  */
 import * as Effect from 'effect/Effect';
 import { SqlError, SqlSyntaxError, UnknownError } from 'effect/unstable/sql/SqlError';
+import { applyAtomicDrop } from './fake-schema-drop.ts';
 import { parseCommentSchema, parseCreateSchema, parseDropSchema } from './fake-sql-parse.ts';
 import type { PostgresSchemaAttributes } from './schema-attrs.ts';
 
@@ -18,6 +19,11 @@ export interface FakeSchemaState {
   readonly schemas: Map<string, PostgresSchemaAttributes>;
   /** Names of schemas this fake pretends hold at least one relation. */
   readonly relationsIn: Set<string>;
+  /** Per schema name: how many objects in OTHER schemas depend on it (what the atomic drop's
+   * `pg_depend` count answers). Absent means none. */
+  readonly dependentsOutside: Map<string, number>;
+  /** Per schema name: how many sequences it holds (a cascade drop refuses any: `HF004`). */
+  readonly sequencesIn: Map<string, number>;
   /** What `current_database()` answers, and the stamp on every read row. */
   readonly database: string;
   /** What `current_user` answers, and the owner of a `CREATE SCHEMA` without `AUTHORIZATION`. */
@@ -44,6 +50,9 @@ export const applySchemaStatement = <A extends object>(
   text: string,
   params: ReadonlyArray<unknown>,
 ): Effect.Effect<ReadonlyArray<A>, SqlError> | undefined => {
+  // The atomic drop's text contains every marker below; matched first, by its own prefix.
+  if (text.startsWith('DO ')) return applyAtomicDrop(state, text);
+
   if (text.startsWith('SELECT current_database()')) {
     return Effect.succeed([{ database: state.database }] as unknown as ReadonlyArray<A>);
   }
@@ -57,7 +66,7 @@ export const applySchemaStatement = <A extends object>(
     return Effect.succeed([{ empty: !state.relationsIn.has(name) }] as unknown as ReadonlyArray<A>);
   }
 
-  if (text.includes('FROM pg_namespace')) {
+  if (text.includes('FROM pg_catalog.pg_namespace')) {
     const name = params[0] as string;
     const row = state.schemas.get(name);
     return Effect.succeed(

package/src/postgres/fake-sql.ts

@@ -65,6 +65,10 @@ export interface FakeSqlOptions {
   readonly schemas?: ReadonlyArray<PostgresSchemaAttributes>;
   /** Names of schemas the fake answers `schemaIsEmpty` with `false` for. */
   readonly schemasWithRelations?: ReadonlyArray<string>;
+  /** Per schema name, how many objects in OTHER schemas depend on it (a cascade would drop
+   * them): what the atomic drop's `pg_depend` count answers. */
+  readonly dependentsOutside?: Readonly<Record<string, number>>;
+  readonly sequencesIn?: Readonly<Record<string, number>>; // per schema: sequences held (HF004)
   /** Accept the NEXT `CREATE SCHEMA` (no error) but record nothing — the S10 case where the
    * write's own report is a lie and the immediate re-read finds nothing. */
   readonly swallowNextCreateSchema?: boolean;
@@ -93,6 +97,7 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
   >();
   const schemas = seedSchemas(options.schemas, options.database ?? 'postgres');
   const relationsIn = new Set(options.schemasWithRelations ?? []);
+  const dependentsOutside = new Map(Object.entries(options.dependentsOutside ?? {}));
   let raceRemaining = options.raceNextCreate === true ? 1 : 0;
   let failNext = options.failNext;
   let oidCounter = 20000;
@@ -111,6 +116,8 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
   const schemaState: FakeSchemaState = {
     schemas,
     relationsIn,
+    dependentsOutside,
+    sequencesIn: new Map(Object.entries(options.sequencesIn ?? {})),
     database: options.database ?? 'postgres',
     standardConformingStrings: options.standardConformingStrings ?? true,
     sessionRole: options.currentUser ?? 'postgres',
@@ -139,7 +146,7 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
         );
       }
 
-      if (text.startsWith('SELECT 1 AS present FROM pg_roles')) {
+      if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_roles')) {
         const role = params[0] as string;
         return Effect.succeed(
           (roleNames.has(role) || roleRows.has(role)
@@ -151,14 +158,14 @@ export const makeFakeSql = (options: FakeSqlOptions = {}): FakeSql => {
       // ⚠️ startsWith, BEFORE the `FROM pg_database` branch: the full-row select also contains
       //   `FROM pg_database`, but starts with `SELECT d.oid` — only the existence probe starts
       //   with `SELECT 1 AS present`.
-      if (text.startsWith('SELECT 1 AS present FROM pg_database')) {
+      if (text.startsWith('SELECT 1 AS present FROM pg_catalog.pg_database')) {
         const name = params[0] as string;
         return Effect.succeed(
           (databases.has(name) ? [{ present: 1 }] : []) as unknown as ReadonlyArray<A>,
         );
       }
 
-      if (text.includes('FROM pg_database')) {
+      if (text.includes('FROM pg_catalog.pg_database')) {
         const name = params[0] as string;
         const row = databases.get(name);
         return Effect.succeed((row === undefined ? [] : [row]) as unknown as ReadonlyArray<A>);

package/src/postgres/grants-database.test.ts

@@ -48,7 +48,7 @@ const recording = (probe: string, proof: string) => {
   const run: PsqlRunner = ({ stdin, argv }) => {
     stdins.push(stdin);
     argvs.push(argv);
-    const stdout = stdin.includes('FROM pg_database')
+    const stdout = stdin.includes('FROM pg_catalog.pg_database')
       ? probe
       : stdin.includes('current_database()')
         ? proof
@@ -79,7 +79,7 @@ describe('a missing declared database is absent', () => {
     // current_database()/GRANT/REVOKE ever targeted the (absent) declared database.
     expect(result).toBeUndefined();
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(stdins[0]).not.toContain('current_database()');
     expect(argvs[0]?.at(-1)).toBe('postgres');
   });
@@ -106,7 +106,7 @@ describe('a present database is opened and proved', () => {
         .pipe(Effect.provide(provide(run))),
     );
     expect(argvs[0]?.at(-1)).toBe('postgres');
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(argvs.slice(1).every((argv) => argv.at(-1) === 'agents')).toBe(true);
     expect(stdins[1]).toContain('current_database()');
   });
@@ -129,7 +129,7 @@ describe('a present database is opened and proved', () => {
     // declared database and proves current_database() there.
     expect(argvs.length).toBe(2);
     expect(argvs[0]?.at(-1)).toBe('postgres');
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(argvs[1]?.at(-1)).toBe('agents');
     expect(stdins[1]).toContain('current_database()');
   });
@@ -152,7 +152,7 @@ describe('a missing declared database on reconcile is a typed refusal', () => {
     expect(error).toMatchObject({ database: 'agents' });
     // Only the family-connection probe ran; reconcile never opened the declared database.
     expect(stdins.length).toBe(1);
-    expect(stdins[0]).toContain('FROM pg_database');
+    expect(stdins[0]).toContain('FROM pg_catalog.pg_database');
     expect(argvs[0]?.at(-1)).toBe('postgres');
   });
 });

package/src/postgres/grants-existence.ts

@@ -15,9 +15,9 @@ import { PostgresGrantsColumnMissing, PostgresGrantsTableMissing } from './grant
  * (`func.sgml@REL_18_6`). */
 const TABLES_PRESENT_SQL = `SELECT
     c.relname AS table
-  FROM pg_class c
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND c.relname::text IN (SELECT json_array_elements_text($2::json))`;
+  FROM pg_catalog.pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND c.relname::text IN (SELECT pg_catalog.json_array_elements_text($2::json))`;
 
 const findMissingTable = (
   pg: PgExecutor,
@@ -41,13 +41,13 @@ const findMissingTable = (
 const COLUMNS_PRESENT_SQL = `SELECT
     c.relname AS table,
     a.attname AS column
-  FROM pg_attribute a
-  JOIN pg_class c ON c.oid = a.attrelid
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+  FROM pg_catalog.pg_attribute a
+  JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND a.attnum > 0
     AND NOT a.attisdropped
     AND (c.relname, a.attname) IN (
-      SELECT x->>0, x->>1 FROM json_array_elements($2::json) x
+      SELECT x->>0, x->>1 FROM pg_catalog.json_array_elements($2::json) x
     )`;
 
 const findMissingColumn = (

package/src/postgres/grants-ownership.ts

@@ -17,8 +17,8 @@ import type { PgExecutor } from './database-sql.ts';
 /** `pg_namespace.nspowner = <role>` for one schema. No rows when the schema is absent —
  * the caller then reads the fact as `false`. */
 const SCHEMA_OWNER_SQL = `SELECT
-    n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = $2) AS role_owns
-  FROM pg_namespace n
+    n.nspowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2) AS role_owns
+  FROM pg_catalog.pg_namespace n
   WHERE n.nspname = $1`;
 
 export const readSchemaOwnership = (
@@ -34,9 +34,9 @@ export const readSchemaOwnership = (
 /** Every relation in the schema the declared role OWNS, all relkinds (the table class is
  * not relkind-filtered, and neither is this). */
 const OWNED_TABLES_SQL = `SELECT c.relname AS table
-  FROM pg_class c
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = $2)
+  FROM pg_catalog.pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND c.relowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)
   ORDER BY c.relname`;
 
 export const readOwnedTables = (

package/src/postgres/grants-psql-lifecycle.test.ts

@@ -8,6 +8,7 @@ import { describe, expect, test } from 'bun:test';
 import * as Effect from 'effect/Effect';
 import type { PsqlRunner } from './psql-executor.ts';
 import { makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 import { reconcileWithClient } from './grants-ops.ts';
 import { requireDeclaredObjectsExist } from './grants-existence.ts';
 import { resolveProps } from './grants-declare.ts';
@@ -26,7 +27,8 @@ const props: PostgresGrantsProps = {
 const runner = (): { run: PsqlRunner; stdins: string[] } => {
   const stdins: string[] = [];
   let granted = false;
-  const run: PsqlRunner = ({ stdin }) => {
+  const run: PsqlRunner = ({ stdin: raw }) => {
+    const stdin = stripPin(raw);
     stdins.push(stdin);
     if (stdin.startsWith('BEGIN')) granted = true;
     return Promise.resolve({ code: 0, stdout: answer(stdin, granted), stderr: '' });
@@ -40,8 +42,10 @@ const answer = (stdin: string, granted: boolean): string => {
   if (stdin.includes('json_array_elements')) {
     return '[{"table":"a","column":"b.c"},{"table":"a.b","column":"c"}]';
   }
-  if (stdin.includes('SELECT 1 AS present FROM pg_roles')) return '[{"present":1}]';
-  if (stdin.includes('SELECT 1 AS present FROM pg_namespace')) return '[{"present":1}]';
+  if (stdin.includes('SELECT 1 AS present FROM pg_catalog.pg_roles')) return '[{"present":1}]';
+  if (stdin.includes('SELECT 1 AS present FROM pg_catalog.pg_namespace')) {
+    return '[{"present":1}]';
+  }
   if (stdin.includes('aclexplode(n.nspacl)')) {
     return granted ? '[{"public":false,"privilege":"usage","grantable":false}]' : '[]';
   }

package/src/postgres/grants-read-defaults.ts

@@ -15,14 +15,14 @@ import { type AclRow, encodeWord } from './grants-words.ts';
  * role's words, whatever role created the entry. Sorted by forRole so two reads of the
  * same state compare equal. */
 const DEFAULTS_SQL = `SELECT
-    pg_get_userbyid(d.defaclrole) AS for_role,
+    pg_catalog.pg_get_userbyid(d.defaclrole) AS for_role,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_default_acl d
-  CROSS JOIN LATERAL aclexplode(d.defaclacl) AS a
-  WHERE d.defaclnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+  FROM pg_catalog.pg_default_acl d
+  CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) AS a
+  WHERE d.defaclnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND d.defaclobjtype = 'r'
-    AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)
+    AND a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)
   ORDER BY for_role`;
 
 export interface LiveDefault {

package/src/postgres/grants-read.ts

@@ -38,7 +38,7 @@ import { readOwnedTables, readSchemaOwnership } from './grants-ownership.ts';
 import { type LiveDefault, readDefaultAcls } from './grants-read-defaults.ts';
 import { type AclRow, encodeWord, wordsOf } from './grants-words.ts';
 
-const SCHEMA_PRESENT_SQL = 'SELECT 1 AS present FROM pg_namespace WHERE nspname = $1';
+const SCHEMA_PRESENT_SQL = 'SELECT 1 AS present FROM pg_catalog.pg_namespace WHERE nspname = $1';
 
 export const schemaExists = (pg: PgExecutor, schema: string): Effect.Effect<boolean, SqlError> =>
   Effect.map(
@@ -52,10 +52,10 @@ const SCHEMA_ACL_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_namespace n
-  CROSS JOIN LATERAL aclexplode(n.nspacl) AS a
+  FROM pg_catalog.pg_namespace n
+  CROSS JOIN LATERAL pg_catalog.aclexplode(n.nspacl) AS a
   WHERE n.nspname = $1
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))`;
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))`;
 
 export interface LiveSchemaAcl {
   readonly role: ReadonlyArray<string>;
@@ -84,10 +84,10 @@ const TABLES_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_class c
-  CROSS JOIN LATERAL aclexplode(c.relacl) AS a
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+  FROM pg_catalog.pg_class c
+  CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))
   ORDER BY c.relname`;
 
 export interface LiveTable {
@@ -146,17 +146,17 @@ const COLUMNS_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable,
-    pg_get_userbyid(a.grantor) AS grantor,
-    pg_get_userbyid(c.relowner) AS owner,
+    pg_catalog.pg_get_userbyid(a.grantor) AS grantor,
+    pg_catalog.pg_get_userbyid(c.relowner) AS owner,
     current_user AS revoker,
-    pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner
-  FROM pg_attribute v
-  JOIN pg_class c ON c.oid = v.attrelid
-  CROSS JOIN LATERAL aclexplode(v.attacl) AS a
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    pg_catalog.pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner
+  FROM pg_catalog.pg_attribute v
+  JOIN pg_catalog.pg_class c ON c.oid = v.attrelid
+  CROSS JOIN LATERAL pg_catalog.aclexplode(v.attacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND v.attnum > 0
     AND NOT v.attisdropped
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))
   ORDER BY c.relname, v.attname`;
 
 export interface LiveColumn {

package/src/postgres/index.ts

@@ -49,7 +49,9 @@ export {
   diffPostgresSchema,
   isPostgresSchema,
 } from './schema.ts';
+export { PostgresSchemaCascadeSequencesRefused } from './schema-sequence-error.ts';
 export {
+  PostgresSchemaCascadeCrossSchemaRefused,
   PostgresSchemaCreateVanished,
   PostgresSchemaExistsRefused,
   PostgresSchemaIdentityRefused,

package/src/postgres/psql-executor-escaping.test.ts

@@ -6,6 +6,7 @@ import { parseLiteral } from './fake-sql-quote.ts';
 import { buildCommentSchemaSql } from './schema-sql.ts';
 import { buildSetPasswordSql } from './role-sql.ts';
 import { makePsqlExecutor, redactPasswordLiterals } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const payload = "\\'; CREATE SCHEMA injected; --";
 const target = { database: 'postgres', username: 'postgres' };
@@ -22,7 +23,8 @@ for (const on of [true, false]) {
   test(`psql executor comment and bound param stay one literal with standard_conforming_strings=${String(on)}`, async () => {
     const fake = makeFakeSql({ schemas: [row], standardConformingStrings: on });
     const calls: string[] = [];
-    const pg = makePsqlExecutor(async ({ stdin }) => {
+    const pg = makePsqlExecutor(async ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
       calls.push(stdin);
       if (stdin.startsWith('COMMENT')) {
         await Effect.runPromise(fake.unsafe(stdin.slice(0, -1)));

package/src/postgres/psql-executor.test.ts

@@ -7,6 +7,7 @@ import { buildCreateDatabaseSql, isDuplicateDatabaseRace } from './database-sql.
 import { buildSetPasswordSql } from './role-sql.ts';
 import { scramSha256Verifier } from './role-scram.ts';
 import { type PsqlRunner, inlineParams, makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const target = { database: 'postgres', username: 'postgres' };
 const ok = (stdout: string) => Promise.resolve({ code: 0, stdout, stderr: '' });
@@ -24,7 +25,10 @@ describe('psql executor', () => {
       return ok('[{"oid":"16400","name":"x"}]\n');
     };
     const rows = await Effect.runPromise(
-      makePsqlExecutor(run, target).unsafe('SELECT 1 FROM pg_database WHERE datname = $1', ['x']),
+      makePsqlExecutor(run, target).unsafe(
+        'SELECT 1 FROM pg_catalog.pg_database WHERE datname = $1',
+        ['x'],
+      ),
     );
     expect(rows).toEqual([{ oid: 16400, name: 'x' }]);
     expect(calls[0]?.argv.slice(0, 1)).toEqual(['psql']);
@@ -114,10 +118,12 @@ describe('runner transport through withPg', () => {
       tablespace: 'pg_default',
     };
     let created = false;
-    const run: PsqlRunner = ({ stdin }) => {
+    const run: PsqlRunner = ({ stdin: raw }) => {
+      const stdin = stripPin(raw);
       stdins.push(stdin);
-      if (stdin.includes('pg_roles')) return ok('[{"present":1}]');
-      if (stdin.includes('FROM pg_database')) return ok(created ? JSON.stringify([row]) : '[]');
+      if (stdin.includes('pg_catalog.pg_roles')) return ok('[{"present":1}]');
+      if (stdin.includes('FROM pg_catalog.pg_database'))
+        return ok(created ? JSON.stringify([row]) : '[]');
       if (stdin.startsWith('CREATE DATABASE')) created = true;
       return ok('');
     };
@@ -141,7 +147,7 @@ describe('runner transport through withPg', () => {
   test('transaction is one psql script from BEGIN through COMMIT', async () => {
     const calls: string[] = [];
     const run: PsqlRunner = (call) => {
-      calls.push(call.stdin);
+      calls.push(stripPin(call.stdin));
       return ok('');
     };
     await Effect.runPromise(

package/src/postgres/psql-executor.ts

@@ -14,6 +14,7 @@
  * ★ ROWS COME BACK AS JSON: a row-returning statement (`SELECT`, or a `WITH` query) is wrapped
  *   in `json_agg`, so `oid` and `datconnlimit` arrive as JS numbers exactly as the socket client
  *   decodes them (database-sql.ts, no bigint).
+ * ⛔ EVERY SCRIPT IS PREFIXED WITH `SET search_path = pg_catalog, pg_temp;` — see `search-path.ts`.
  * ★ `VERBOSITY=verbose` puts the SQLSTATE in the error line, so `42P04` (duplicate database)
  *   stays recognisable to `isDuplicateDatabaseRace`.
  */
@@ -25,6 +26,7 @@ import {
   UnknownError,
 } from 'effect/unstable/sql/SqlError';
 import { type PgExecutor, quoteStringLiteral } from './database-sql.ts';
+import { PIN_SCRIPT_PREFIX } from './search-path.ts';
 
 export interface PsqlResult {
   readonly code: number;
@@ -122,7 +124,8 @@ const runScript = (
             '-d',
             target.database,
           ],
-          stdin,
+          // ⛔ EVERY psql SESSION STARTS PINNED (`search-path.ts`): one process, one session.
+          stdin: `${PIN_SCRIPT_PREFIX}${stdin}`,
         }),
       catch: (cause) =>
         new SqlError({ reason: new ConnectionError({ cause, operation: 'psql exec' }) }),

package/src/postgres/role-adopt.test.ts

@@ -13,6 +13,7 @@ import * as Effect from 'effect/Effect';
 import { postgresRunnerConnection } from './connection.ts';
 import { parseLiteral } from './fake-sql-quote.ts';
 import { makeFakeSql } from './fake-sql.ts';
+import { stripPin } from './search-path.ts';
 import { type PsqlRunner } from './psql-executor.ts';
 import { postgresRoleHandlers } from './role-provider.ts';
 import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
@@ -42,7 +43,8 @@ const liveRole = (): PostgresRoleAttributes => ({
  */
 const runnerFor =
   (fake: ReturnType<typeof makeFakeSql>): PsqlRunner =>
-  async ({ stdin }) => {
+  async ({ stdin: raw }) => {
+    const stdin = stripPin(raw);
     const wrapped = /^SELECT coalesce\(json_agg\(t\), '\[\]'::json\)::text FROM \((.*)\) t;$/s.exec(
       stdin,
     );

package/src/postgres/role-membership-options.test.ts

@@ -3,6 +3,7 @@ import * as Effect from 'effect/Effect';
 import { makeFakeSql } from './fake-sql.ts';
 import { buildRepairMembershipSql, syncMemberships } from './role-membership-sql.ts';
 import { makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 
 const props = {
   name: 'seat',
@@ -34,7 +35,8 @@ test.each(['2BP01', '42501'])(
     // denial); the real server is the dependency authority.
     const scripts: string[] = [];
     const pg = makePsqlExecutor(
-      ({ stdin }) => {
+      ({ stdin: raw }) => {
+        const stdin = stripPin(raw);
         scripts.push(stdin);
         return Promise.resolve(
           stdin.startsWith('BEGIN')

package/src/postgres/role-membership-repair.test.ts

@@ -84,9 +84,9 @@ test('reads INHERIT and repairs another grantor row for declared NOINHERIT', asy
   expect(before?.memberships).toEqual([
     { parent: 'parent', grantor: 'other', admin: false, set: false, inherit: true },
   ]);
-  expect(fake.statements.find((s) => s.text.includes('FROM pg_auth_members'))?.text).toContain(
-    'm.inherit_option AS inherit',
-  );
+  expect(
+    fake.statements.find((s) => s.text.includes('FROM pg_catalog.pg_auth_members'))?.text,
+  ).toContain('m.inherit_option AS inherit');
   expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: before }))).toEqual({
     action: 'update',
   });

package/src/postgres/role-membership-sql.ts

@@ -40,10 +40,10 @@ const MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
     m.admin_option AS admin,
     m.set_option AS set,
     m.inherit_option AS inherit
-  FROM pg_auth_members m
-  JOIN pg_roles member ON member.oid = m.member
-  JOIN pg_roles parent ON parent.oid = m.roleid
-  LEFT JOIN pg_roles grantor ON grantor.oid = m.grantor
+  FROM pg_catalog.pg_auth_members m
+  JOIN pg_catalog.pg_roles member ON member.oid = m.member
+  JOIN pg_catalog.pg_roles parent ON parent.oid = m.roleid
+  LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid = m.grantor
   WHERE member.rolname = $1
   ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;
 

package/src/postgres/role-password-transports.test.ts

@@ -9,6 +9,7 @@ import type { Connection } from 'effect/unstable/sql/SqlConnection';
 import type { PgExecutor } from './database-sql.ts';
 import { makeFakeSql } from './fake-sql.ts';
 import { type PsqlRunner, makePsqlExecutor } from './psql-executor.ts';
+import { stripPin } from './search-path.ts';
 import { reconcileWithClient } from './role.ts';
 
 const props = {
@@ -84,7 +85,8 @@ test('psql runner receives only a verifier; echoed failure and state hold no pla
     for (const fail of [false, true]) {
       const calls: Parameters<PsqlRunner>[0][] = [];
       let created = exists;
-      const run: PsqlRunner = (call) => {
+      const run: PsqlRunner = (raw) => {
+        const call = { ...raw, stdin: stripPin(raw.stdin) };
         calls.push(call);
         if (call.stdin.includes('PASSWORD') && fail) {
           return Promise.resolve({
@@ -97,7 +99,7 @@ test('psql runner receives only a verifier; echoed failure and state hold no pla
         return Promise.resolve({
           code: 0,
           stderr: '',
-          stdout: call.stdin.includes('FROM pg_roles r')
+          stdout: call.stdin.includes('FROM pg_catalog.pg_roles r')
             ? JSON.stringify(created ? [live] : [])
             : '[]',
         });

package/src/postgres/role-sql.ts

@@ -46,7 +46,7 @@ const SELECT_ROLE_SQL = `SELECT
     r.rolreplication AS replication,
     r.rolbypassrls AS bypassrls,
     to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "validUntil"
-  FROM pg_roles r
+  FROM pg_catalog.pg_roles r
   WHERE r.rolname = $1`;
 
 export const selectRole = (

package/src/postgres/schema-closure-sql.ts

@@ -0,0 +1,108 @@
+/**
+ * The dependency closure `DROP SCHEMA … CASCADE` would walk, and the count of what it would take
+ * that does NOT live in the schema being dropped (`schema-drop-sql.ts` refuses when it is > 0).
+ *
+ * ⛔ THE CLOSURE IS DERIVED FROM THE NAMESPACE OBJECT, NOT FROM A LIST OF CLASSES. Until
+ *   2026-10-06 the scan started from four catalogs (`pg_class`, `pg_type`, `pg_proc`,
+ *   `pg_operator`), so `a.c` (a collation) used by `b.t.x` was invisible and the cascade reached
+ *   into `b.t.x` (Codex read of PR 357). Now the walk starts at `(pg_namespace, v_ns)` and follows
+ *   EVERY `pg_depend` row whose referenced object is already inside — the same edges
+ *   `findDependentObjects` (`dependency.c`) follows — so any object class `pg_depend` can name
+ *   (collation, conversion, opclass, opfamily, text-search, statistics, extension members, …)
+ *   is reached with no catalog enumerated to find it.
+ * ★ EVERY `deptype` FOLLOWS (`pg_depend`, catalogs.sgml); they differ only in attribution:
+ *     n NORMAL    cascade drops the dependent        → followed; foreign if it lives elsewhere
+ *     a AUTO      dropped with any drop              → followed; foreign if it lives elsewhere
+ *                 (an owned sequence in another schema is dropped with its table)
+ *     i INTERNAL  a part of the referenced object    → followed; attributed to its owner (below)
+ *     P / S       partition primary / secondary      → followed; a partition in another
+ *                 schema is dropped with its parent, so it is foreign
+ *     e EXTENSION member of an extension             → followed; the extension's members are
+ *                 dropped with it, wherever they live
+ *     x AUTO-EXT  auto, and dropped with the extension → followed like `a`
+ *     p PIN       system object, `refobjid = 0`      → never a referenced row, never joins
+ * ★ "INSIDE" is a home-schema test per class. TOAST is the case the old scan got wrong: a text
+ *   table's TOAST relation (and its index) lives in `pg_toast` and depends internally on the
+ *   table, so it is attributed to the table that owns it via `reltoastrelid` — otherwise every
+ *   cascade of a schema with a text column was refused. Constraints, triggers, rules, policies
+ *   and defaults have no schema of their own and take their table's.
+ * ⚠️ A CLASS THIS FILE DOES NOT KNOW (a cast, a foreign server, a language, an event trigger)
+ *   resolves to NULL, which is NOT inside: it counts as foreign. Unknown fails CLOSED. The walk
+ *   stops at a foreign object — one is enough to refuse.
+ * ★ A dependent created AFTER this scan is held off by the caller's locks (`schema-drop-sql.ts`).
+ */
+
+const cls = (name: string): string => `'pg_catalog.${name}'::pg_catalog.regclass`;
+
+/** `WHEN <class> THEN <namespace column of the row>` for a catalog that carries its own. */
+const direct = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT x.${column} FROM pg_catalog.${table} x WHERE x.oid = d.objid)`;
+
+/** The same for an object with no schema of its own: the schema of the relation it hangs on. */
+const viaRelation = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT c.relnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_class c ON c.oid = x.${column} WHERE x.oid = d.objid)`;
+
+/** An access-method member belongs to its operator family. */
+const viaFamily = (table: string, column: string): string =>
+  `WHEN ${cls(table)} THEN (SELECT f.opfnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_opfamily f ON f.oid = x.${column} WHERE x.oid = d.objid)`;
+
+/** A relation's home. A TOAST relation, or the index on one, is its owner's. */
+const RELATION_HOME = `WHEN ${cls('pg_class')} THEN COALESCE(
+            (SELECT o.relnamespace FROM pg_catalog.pg_class o
+              WHERE o.reltoastrelid <> 0
+                AND o.reltoastrelid IN (d.objid, (SELECT i.indrelid FROM pg_catalog.pg_index i WHERE i.indexrelid = d.objid))),
+            (SELECT x.relnamespace FROM pg_catalog.pg_class x WHERE x.oid = d.objid))`;
+
+const HOME_OF_DEPENDENT = `CASE d.classid
+          WHEN ${cls('pg_namespace')} THEN d.objid
+          ${RELATION_HOME}
+          ${direct('pg_type', 'typnamespace')}
+          ${direct('pg_proc', 'pronamespace')}
+          ${direct('pg_operator', 'oprnamespace')}
+          ${direct('pg_collation', 'collnamespace')}
+          ${direct('pg_conversion', 'connamespace')}
+          ${direct('pg_opclass', 'opcnamespace')}
+          ${direct('pg_opfamily', 'opfnamespace')}
+          ${direct('pg_ts_config', 'cfgnamespace')}
+          ${direct('pg_ts_dict', 'dictnamespace')}
+          ${direct('pg_ts_parser', 'prsnamespace')}
+          ${direct('pg_ts_template', 'tmplnamespace')}
+          ${direct('pg_statistic_ext', 'stxnamespace')}
+          ${direct('pg_constraint', 'connamespace')}
+          ${direct('pg_default_acl', 'defaclnamespace')}
+          ${direct('pg_extension', 'extnamespace')}
+          ${viaRelation('pg_trigger', 'tgrelid')}
+          ${viaRelation('pg_rewrite', 'ev_class')}
+          ${viaRelation('pg_attrdef', 'adrelid')}
+          ${viaRelation('pg_policy', 'polrelid')}
+          ${viaRelation('pg_publication_rel', 'prrelid')}
+          ${viaFamily('pg_amop', 'amopfamily')}
+          ${viaFamily('pg_amproc', 'amprocfamily')}
+        END`;
+
+/**
+ * `v_count := …`: how many objects the cascade would drop outside `v_ns`, PLUS how many objects
+ * INSIDE it hold an `e` or `i` edge to an object outside the closure.
+ * ⛔ THE SECOND TERM IS THE OWNERSHIP ESCAPE (Codex read of PR 357, 2026-10-06). An inside table
+ *   added to a foreign extension (`ALTER EXTENSION x ADD TABLE a.t`) has an OUTGOING `e` edge; the
+ *   walk only follows edges INTO the closure, so it saw nothing, while `findDependentObjects`
+ *   redirects the deletion of an extension member / internal part to its OWNER and drops that
+ *   owner's other objects too. Any outgoing `e` or `i` edge leaving the closure counts as foreign:
+ *   refuse, never follow-and-classify (the simplest correct answer fails closed).
+ */
+export const OUTSIDE_DEPENDENTS_SQL = `v_count := (
+      WITH RECURSIVE reach (classid, objid, inside) AS (
+        SELECT ${cls('pg_namespace')}::pg_catalog.oid, v_ns, true
+        UNION
+        SELECT d.classid, d.objid, (${HOME_OF_DEPENDENT}) IS NOT DISTINCT FROM v_ns
+        FROM pg_catalog.pg_depend d
+        JOIN reach r ON d.refclassid = r.classid AND d.refobjid = r.objid AND r.inside
+        WHERE d.deptype <> 'p'
+      )
+      SELECT (SELECT pg_catalog.count(*) FROM reach WHERE NOT inside)
+           + (SELECT pg_catalog.count(*) FROM pg_catalog.pg_depend e
+               JOIN reach r ON e.classid = r.classid AND e.objid = r.objid AND r.inside
+               WHERE e.deptype IN ('e', 'i') AND e.refobjid <> 0
+                 AND NOT EXISTS (SELECT 1 FROM reach o
+                                  WHERE o.inside AND o.classid = e.refclassid AND o.objid = e.refobjid))
+    )`;