@homeflare/alchemy 0.46.0 → 0.47.0

package/dist/postgres/index.js

@@ -1,17 +1,12 @@
 // src/postgres/connection.ts
 import * as PgClient from "@effect/sql-pg/PgClient";
 import * as Context from "effect/Context";
-import * as Effect3 from "effect/Effect";
+import * as Effect4 from "effect/Effect";
 import * as Layer from "effect/Layer";
 
 // src/postgres/psql-executor.ts
-import * as Effect2 from "effect/Effect";
-import {
-  ConnectionError,
-  SqlError,
-  SqlSyntaxError,
-  UnknownError
-} from "effect/unstable/sql/SqlError";
+import * as Effect3 from "effect/Effect";
+import { ConnectionError, SqlError, SqlSyntaxError, UnknownError } from "effect/sql/SqlError";
 
 // src/postgres/database-sql.ts
 import * as Effect from "effect/Effect";
@@ -49,15 +44,15 @@ var isDuplicateDatabaseRace = (error) => {
   const cause = error.reason.cause;
   return typeof cause === "object" && cause !== null && cause.code === "42P04";
 };
-var ROLE_EXISTS_SQL = "SELECT 1 AS present FROM pg_roles WHERE rolname = $1";
+var ROLE_EXISTS_SQL = "SELECT 1 AS present FROM pg_catalog.pg_roles WHERE rolname = $1";
 var roleExists = (pg, role) => Effect.map(pg.unsafe(ROLE_EXISTS_SQL, [role]), (rows) => rows.length > 0);
-var DATABASE_EXISTS_SQL = "SELECT 1 AS present FROM pg_database WHERE datname = $1";
+var DATABASE_EXISTS_SQL = "SELECT 1 AS present FROM pg_catalog.pg_database WHERE datname = $1";
 var databaseExists = (pg, name) => Effect.map(pg.unsafe(DATABASE_EXISTS_SQL, [name]), (rows) => rows.length > 0);
 var SELECT_DATABASE_SQL = `SELECT
     d.oid AS oid,
     d.datname AS name,
-    pg_get_userbyid(d.datdba) AS owner,
-    pg_encoding_to_char(d.encoding) AS encoding,
+    pg_catalog.pg_get_userbyid(d.datdba) AS owner,
+    pg_catalog.pg_encoding_to_char(d.encoding) AS encoding,
     CASE d.datlocprovider
       WHEN 'b' THEN 'builtin' WHEN 'i' THEN 'icu' WHEN 'c' THEN 'libc'
       ELSE 'libc'
@@ -68,8 +63,8 @@ var SELECT_DATABASE_SQL = `SELECT
     d.datconnlimit AS "connectionLimit",
     d.datistemplate AS "isTemplate",
     t.spcname AS tablespace
-  FROM pg_database d
-  JOIN pg_tablespace t ON t.oid = d.dattablespace
+  FROM pg_catalog.pg_database d
+  JOIN pg_catalog.pg_tablespace t ON t.oid = d.dattablespace
   WHERE d.datname = $1`;
 var selectDatabase = (pg, name) => Effect.map(pg.unsafe(SELECT_DATABASE_SQL, [name]), (rows) => rows[0]);
 var firstDrift = (props, live) => {
@@ -90,6 +85,26 @@ var firstDrift = (props, live) => {
   return;
 };
 
+// src/postgres/search-path.ts
+import * as Effect2 from "effect/Effect";
+var PIN_SEARCH_PATH_SQL = "SET search_path = pg_catalog, pg_temp";
+var PIN_SCRIPT_PREFIX = `${PIN_SEARCH_PATH_SQL};
+`;
+var pinnedSocketExecutor = (pg) => Effect2.gen(function* () {
+  const connection = yield* pg.reserve;
+  const run = (sql, params) => Effect2.provideService(pg.unsafe(sql, params), pg.transactionService, [connection, 0]);
+  yield* run(PIN_SEARCH_PATH_SQL);
+  return {
+    unsafe: run,
+    transaction: (statements) => Effect2.gen(function* () {
+      yield* run("BEGIN");
+      for (const sql of statements)
+        yield* run(sql);
+      yield* run("COMMIT");
+    }).pipe(Effect2.onError(() => run("ROLLBACK").pipe(Effect2.ignore)), Effect2.asVoid)
+  };
+});
+
 // src/postgres/psql-executor.ts
 var inlineParams = (sql, params) => params.length === 0 ? sql : sql.replace(/\$(\d+)/g, (_match, index) => {
   const value = params[Number(index) - 1];
@@ -113,8 +128,8 @@ var failure = (operation, result) => {
   const reason = state === undefined ? new ConnectionError(fields) : state.startsWith("42") ? new SqlSyntaxError(fields) : new UnknownError(fields);
   return new SqlError({ reason });
 };
-var runScript = (run, target, stdin, operation) => Effect2.gen(function* () {
-  const result = yield* Effect2.tryPromise({
+var runScript = (run, target, stdin, operation) => Effect3.gen(function* () {
+  const result = yield* Effect3.tryPromise({
     try: () => run({
       argv: [
         "psql",
@@ -131,18 +146,18 @@ var runScript = (run, target, stdin, operation) => Effect2.gen(function* () {
         "-d",
         target.database
       ],
-      stdin
+      stdin: `${PIN_SCRIPT_PREFIX}${stdin}`
     }),
     catch: (cause) => new SqlError({ reason: new ConnectionError({ cause, operation: "psql exec" }) })
   });
   if (result.code !== 0) {
-    return yield* Effect2.fail(failure(operation, result));
+    return yield* Effect3.fail(failure(operation, result));
   }
   return result;
 });
 var makePsqlExecutor = (run, target) => ({
-  unsafe: (sql, params = []) => Effect2.gen(function* () {
-    const inlined = yield* Effect2.try({
+  unsafe: (sql, params = []) => Effect3.gen(function* () {
+    const inlined = yield* Effect3.try({
       try: () => inlineParams(sql, params),
       catch: (cause) => new SqlError({ reason: new UnknownError({ cause, operation: "psql inline params" }) })
     });
@@ -150,13 +165,13 @@ var makePsqlExecutor = (run, target) => ({
     const result = yield* runScript(run, target, rows ? wrapRows(inlined) : `${inlined};`, redactPasswordLiterals(inlined).slice(0, 40));
     if (!rows)
       return [];
-    const parsed = yield* Effect2.try({
+    const parsed = yield* Effect3.try({
       try: () => JSON.parse(result.stdout.trim() || "[]").map(normalizeRow),
       catch: (cause) => new SqlError({ reason: new UnknownError({ cause, operation: "psql parse output" }) })
     });
     return parsed;
   }),
-  transaction: (statements) => Effect2.gen(function* () {
+  transaction: (statements) => Effect3.gen(function* () {
     const script = ["BEGIN", ...statements, "COMMIT"].join(`;
 `);
     yield* runScript(run, target, `${script};`, "BEGIN");
@@ -166,13 +181,13 @@ var makePsqlExecutor = (run, target) => ({
 // src/postgres/connection.ts
 class PostgresConnection extends Context.Service()("Postgres.Connection") {
 }
-var postgresConnection = (config) => Layer.succeed(PostgresConnection, Effect3.succeed(config));
-var postgresRunnerConnection = (config) => Layer.succeed(PostgresConnection, Effect3.succeed(config));
+var postgresConnection = (config) => Layer.succeed(PostgresConnection, Effect4.succeed(config));
+var postgresRunnerConnection = (config) => Layer.succeed(PostgresConnection, Effect4.succeed(config));
 var PostgresPool = Context.Reference("homeflare/postgres/Pool", {
   defaultValue: () => PgClient.layer
 });
 var isRunner = (c) => ("run" in c);
-var withPg = (build, database) => Effect3.gen(function* () {
+var withPg = (build, database) => Effect4.gen(function* () {
   const resolveConfig = yield* PostgresConnection;
   const config = yield* resolveConfig;
   const target = database === undefined ? config : { ...config, database };
@@ -183,13 +198,7 @@ var withPg = (build, database) => Effect3.gen(function* () {
     });
   }
   const pool = yield* PostgresPool;
-  return yield* Effect3.provide(Effect3.flatMap(PgClient.PgClient, (pg) => build({
-    unsafe: (sql, params) => pg.unsafe(sql, params),
-    transaction: (statements) => pg.withTransaction(Effect3.gen(function* () {
-      for (const sql of statements)
-        yield* pg.unsafe(sql).pipe(Effect3.asVoid);
-    }))
-  }, { database: target.database })), pool(target));
+  return yield* Effect4.provide(Effect4.scoped(Effect4.flatMap(PgClient.PgClient, (pg) => Effect4.flatMap(pinnedSocketExecutor(pg), (executor) => build(executor, { database: target.database })))), pool(target));
 });
 // src/postgres/database-attrs.ts
 var POSTGRES_NAME_MAX_BYTES = 63;
@@ -203,7 +212,7 @@ import { Resource } from "alchemy";
 import { Unowned } from "alchemy/AdoptPolicy";
 import { isResolved } from "alchemy/Diff";
 import * as Provider from "alchemy/Provider";
-import * as Effect4 from "effect/Effect";
+import * as Effect5 from "effect/Effect";
 
 // src/postgres/errors.ts
 import * as Data from "effect/Data";
@@ -255,23 +264,23 @@ var liveDrift = (props, live) => {
   }
   return firstDrift(props, live);
 };
-var reconcileWithClient = (pg, props, template) => Effect4.gen(function* () {
+var reconcileWithClient = (pg, props, template) => Effect5.gen(function* () {
   const observed = yield* selectDatabase(pg, props.name);
   if (observed === undefined) {
     const ownerPresent = yield* roleExists(pg, props.owner);
     if (!ownerPresent) {
-      return yield* Effect4.fail(new PostgresDatabaseOwnerMissing({ database: props.name, owner: props.owner }));
+      return yield* Effect5.fail(new PostgresDatabaseOwnerMissing({ database: props.name, owner: props.owner }));
     }
-    yield* pg.unsafe(buildCreateDatabaseSql(props, template)).pipe(Effect4.asVoid, Effect4.catchTag("SqlError", (error) => isDuplicateDatabaseRace(error) ? Effect4.succeed(undefined) : Effect4.fail(error)));
+    yield* pg.unsafe(buildCreateDatabaseSql(props, template)).pipe(Effect5.asVoid, Effect5.catchTag("SqlError", (error) => isDuplicateDatabaseRace(error) ? Effect5.succeed(undefined) : Effect5.fail(error)));
     const created = yield* selectDatabase(pg, props.name);
     if (created === undefined) {
-      return yield* Effect4.fail(new PostgresDatabaseCreateVanished({ database: props.name }));
+      return yield* Effect5.fail(new PostgresDatabaseCreateVanished({ database: props.name }));
     }
     return created;
   }
   const drift = liveDrift(props, observed);
   if (drift !== undefined) {
-    return yield* Effect4.fail(new PostgresDatabaseDrift({
+    return yield* Effect5.fail(new PostgresDatabaseDrift({
       database: props.name,
       prop: drift.prop,
       declared: drift.declared,
@@ -281,36 +290,36 @@ var reconcileWithClient = (pg, props, template) => Effect4.gen(function* () {
   return observed;
 });
 var readWithClient = (pg, name) => selectDatabase(pg, name);
-var diffPostgresDatabase = (news, output) => Effect4.gen(function* () {
+var diffPostgresDatabase = (news, output) => Effect5.gen(function* () {
   if (output === undefined || !isResolved(news))
     return;
   if (news.name !== output.name) {
-    return yield* Effect4.fail(new PostgresDatabaseRenameRefused({ from: output.name, to: news.name }));
+    return yield* Effect5.fail(new PostgresDatabaseRenameRefused({ from: output.name, to: news.name }));
   }
   const nameRefusal = nameByteRefusal(news.name);
   if (nameRefusal !== undefined) {
-    return yield* Effect4.fail(new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }));
+    return yield* Effect5.fail(new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }));
   }
   const changed = news.owner !== output.owner || firstDrift(news, output) !== undefined;
   return changed ? { action: "update" } : { action: "noop" };
 });
 var postgresDatabaseHandlers = PostgresDatabase.Provider.of({
-  list: () => Effect4.succeed([]),
+  list: () => Effect5.succeed([]),
   nuke: { skip: true },
-  read: ({ olds, output }) => Effect4.gen(function* () {
+  read: ({ olds, output }) => Effect5.gen(function* () {
     const name = output?.name ?? olds.name;
     const live = yield* withPg((pg) => readWithClient(pg, name));
     return live === undefined ? undefined : Unowned(live);
   }),
   diff: ({ news, output }) => diffPostgresDatabase(news, output),
-  reconcile: ({ news }) => Effect4.gen(function* () {
+  reconcile: ({ news }) => Effect5.gen(function* () {
     const nameRefusal = nameByteRefusal(news.name);
     if (nameRefusal !== undefined) {
-      return yield* Effect4.fail(new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }));
+      return yield* Effect5.fail(new PostgresDatabaseNameRefused({ name: news.name, ...nameRefusal }));
     }
     return yield* withPg((pg, ctx) => reconcileWithClient(pg, news, ctx.template));
   }),
-  delete: ({ olds }) => Effect4.fail(new PostgresDatabaseDropRefused({ database: olds.name }))
+  delete: ({ olds }) => Effect5.fail(new PostgresDatabaseDropRefused({ database: olds.name }))
 });
 var PostgresDatabaseProvider = () => Provider.succeed(PostgresDatabase, postgresDatabaseHandlers);
 // src/postgres/schema-attrs.ts
@@ -320,34 +329,35 @@ var schemaNameByteRefusal = (name) => {
   return byteLength > POSTGRES_NAME_MAX_BYTES ? { byteLength, limit: POSTGRES_NAME_MAX_BYTES } : undefined;
 };
 // src/postgres/schema-sql.ts
-import * as Effect5 from "effect/Effect";
+import * as Effect6 from "effect/Effect";
 var buildCreateSchemaSql = (props) => `CREATE SCHEMA ${quoteIdent(props.name)}${props.owner === undefined ? "" : ` AUTHORIZATION ${quoteIdent(props.owner)}`}`;
 var buildCommentSchemaSql = (name, comment) => `COMMENT ON SCHEMA ${quoteIdent(name)} IS ${quoteStringLiteral(comment)}`;
 var buildDropSchemaSql = (name, cascade) => `DROP SCHEMA IF EXISTS ${quoteIdent(name)}${cascade ? " CASCADE" : ""}`;
 var SELECT_SCHEMA_SQL = `SELECT
     n.oid AS oid,
     n.nspname AS name,
-    pg_get_userbyid(n.nspowner) AS owner,
-    obj_description(n.oid, 'pg_namespace') AS comment,
+    pg_catalog.pg_get_userbyid(n.nspowner) AS owner,
+    pg_catalog.obj_description(n.oid, 'pg_namespace') AS comment,
     current_database() AS database
-  FROM pg_namespace n
+  FROM pg_catalog.pg_namespace n
   WHERE n.nspname = $1`;
-var selectSchema = (pg, name) => Effect5.map(pg.unsafe(SELECT_SCHEMA_SQL, [name]), (rows) => rows[0]);
+var selectSchema = (pg, name) => Effect6.map(pg.unsafe(SELECT_SCHEMA_SQL, [name]), (rows) => rows[0]);
 var CURRENT_DATABASE_SQL = "SELECT current_database() AS database";
-var currentDatabase = (pg) => Effect5.map(pg.unsafe(CURRENT_DATABASE_SQL), (rows) => rows[0]?.database ?? "");
+var currentDatabase = (pg) => Effect6.map(pg.unsafe(CURRENT_DATABASE_SQL), (rows) => rows[0]?.database ?? "");
 var CURRENT_USER_SQL = "SELECT current_user AS role";
-var currentUser = (pg) => Effect5.map(pg.unsafe(CURRENT_USER_SQL), (rows) => rows[0]?.role ?? "");
-var SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_namespace WHERE nspname = $1)
-  SELECT NOT EXISTS (
-    SELECT 1 FROM pg_class c WHERE c.relnamespace = (SELECT oid FROM ns)
+var currentUser = (pg) => Effect6.map(pg.unsafe(CURRENT_USER_SQL), (rows) => rows[0]?.role ?? "");
+var emptyPredicate = (ns) => `NOT EXISTS (
+    SELECT 1 FROM pg_catalog.pg_class c WHERE c.relnamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_proc p WHERE p.pronamespace = (SELECT oid FROM ns)
+    SELECT 1 FROM pg_catalog.pg_proc p WHERE p.pronamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_type t WHERE t.typnamespace = (SELECT oid FROM ns)
+    SELECT 1 FROM pg_catalog.pg_type t WHERE t.typnamespace = ${ns}
   ) AND NOT EXISTS (
-    SELECT 1 FROM pg_operator o WHERE o.oprnamespace = (SELECT oid FROM ns)
-  ) AS empty`;
-var schemaIsEmpty = (pg, name) => Effect5.map(pg.unsafe(SCHEMA_EMPTY_SQL, [name]), (rows) => rows[0]?.empty ?? true);
+    SELECT 1 FROM pg_catalog.pg_operator o WHERE o.oprnamespace = ${ns}
+  )`;
+var SCHEMA_EMPTY_SQL = `WITH ns AS (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+  SELECT ${emptyPredicate("(SELECT oid FROM ns)")} AS empty`;
+var schemaIsEmpty = (pg, name) => Effect6.map(pg.unsafe(SCHEMA_EMPTY_SQL, [name]), (rows) => rows[0]?.empty ?? true);
 var isDependentObjectsError = (error) => {
   const cause = error.reason.cause;
   return typeof cause === "object" && cause !== null && cause.code === "2BP01";
@@ -360,10 +370,10 @@ var isDuplicateSchemaError = (error) => {
 import { Resource as Resource2 } from "alchemy";
 import { Unowned as Unowned2 } from "alchemy/AdoptPolicy";
 import * as Provider2 from "alchemy/Provider";
-import * as Effect11 from "effect/Effect";
+import * as Effect12 from "effect/Effect";
 
 // src/postgres/schema-identity.ts
-import * as Effect6 from "effect/Effect";
+import * as Effect7 from "effect/Effect";
 
 // src/postgres/schema-errors.ts
 import * as Data2 from "effect/Data";
@@ -404,6 +414,12 @@ class PostgresSchemaDropNotEmptyError extends Data2.TaggedError("PostgresSchemaD
   }
 }
 
+class PostgresSchemaCascadeCrossSchemaRefused extends Data2.TaggedError("PostgresSchemaCascadeCrossSchemaRefused") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": cascade: true refused — ${String(this.dependents)} ` + "dependent object(s) outside this schema would be dropped with it. No DROP was issued. " + "Remove or move those dependents first.";
+  }
+}
+
 class PostgresSchemaWrongDatabase extends Data2.TaggedError("PostgresSchemaWrongDatabase") {
   get message() {
     return `Postgres.Schema "${this.schema}": declared in database "${this.declared}" but the ` + `connection answers current_database() "${this.connected}". The handlers open the declared ` + "database themselves, so this points at broken provider wiring — fix it before touching any " + "schema, or the next create would land in the wrong database.";
@@ -436,15 +452,15 @@ class PostgresSchemaIdentityRefused extends Data2.TaggedError("PostgresSchemaIde
 }
 
 // src/postgres/schema-identity.ts
-var assertSchemaTarget = (props, output) => Effect6.gen(function* () {
+var assertSchemaTarget = (props, output) => Effect7.gen(function* () {
   if (output === undefined)
     return;
   if (props.name !== output.name)
-    return yield* Effect6.fail(new PostgresSchemaRenameRefused({ from: output.name, to: props.name }));
+    return yield* Effect7.fail(new PostgresSchemaRenameRefused({ from: output.name, to: props.name }));
   if (props.database !== output.database)
-    return yield* Effect6.fail(new PostgresSchemaDatabaseRefused({ from: output.database, to: props.database }));
+    return yield* Effect7.fail(new PostgresSchemaDatabaseRefused({ from: output.database, to: props.database }));
 });
-var assertSchemaIdentity = (live, output) => live.oid === output.oid ? Effect6.void : Effect6.fail(new PostgresSchemaIdentityRefused({
+var assertSchemaIdentity = (live, output) => live.oid === output.oid ? Effect7.void : Effect7.fail(new PostgresSchemaIdentityRefused({
   schema: live.name,
   storedOid: output.oid,
   liveOid: live.oid
@@ -452,14 +468,14 @@ var assertSchemaIdentity = (live, output) => live.oid === output.oid ? Effect6.v
 
 // src/postgres/schema-diff.ts
 import { isResolved as isResolved2 } from "alchemy/Diff";
-import * as Effect7 from "effect/Effect";
-var diffPostgresSchema = (news, output, olds) => Effect7.gen(function* () {
+import * as Effect8 from "effect/Effect";
+var diffPostgresSchema = (news, output, olds) => Effect8.gen(function* () {
   if (output === undefined || !isResolved2(news))
     return;
   yield* assertSchemaTarget(news, output);
   const nameRefusal = schemaNameByteRefusal(news.name);
   if (nameRefusal !== undefined) {
-    return yield* Effect7.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
+    return yield* Effect8.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
   }
   const comment = normalizedComment(news.comment);
   const changed = news.owner !== undefined && news.owner !== output.owner || comment !== undefined && comment !== (output.comment ?? undefined) || (news.cascade ?? false) !== (olds?.cascade ?? false);
@@ -467,11 +483,11 @@ var diffPostgresSchema = (news, output, olds) => Effect7.gen(function* () {
 });
 
 // src/postgres/schema-reconcile.ts
-import * as Effect9 from "effect/Effect";
+import * as Effect10 from "effect/Effect";
 
 // src/postgres/schema-assert.ts
-import * as Effect8 from "effect/Effect";
-var assertDatabase = (props, pg) => Effect8.flatMap(currentDatabase(pg), (connected) => connected === props.database ? Effect8.void : Effect8.fail(new PostgresSchemaWrongDatabase({
+import * as Effect9 from "effect/Effect";
+var assertDatabase = (props, pg) => Effect9.flatMap(currentDatabase(pg), (connected) => connected === props.database ? Effect9.void : Effect9.fail(new PostgresSchemaWrongDatabase({
   schema: props.name,
   declared: props.database,
   connected
@@ -491,7 +507,7 @@ var liveDrift2 = (props, live, executingRole) => {
   }
   return;
 };
-var refuse = (props, drift) => Effect8.fail(new PostgresSchemaDrift({
+var refuse = (props, drift) => Effect9.fail(new PostgresSchemaDrift({
   schema: props.name,
   prop: drift.prop,
   declared: drift.declared,
@@ -499,11 +515,11 @@ var refuse = (props, drift) => Effect8.fail(new PostgresSchemaDrift({
 }));
 var assertOwner = (props, row, executingRole) => {
   const drift = ownerDrift(props, row, executingRole);
-  return drift === undefined ? Effect8.void : refuse(props, drift);
+  return drift === undefined ? Effect9.void : refuse(props, drift);
 };
 var assertLive = (props, row, executingRole) => {
   const drift = liveDrift2(props, row, executingRole);
-  return drift === undefined ? Effect8.succeed(row) : refuse(props, drift);
+  return drift === undefined ? Effect9.succeed(row) : refuse(props, drift);
 };
 var deleteForeignRefusal = (props, live, output) => {
   if (output !== undefined && output.oid === live.oid && output.owner === live.owner) {
@@ -520,7 +536,7 @@ var deleteForeignRefusal = (props, live, output) => {
 };
 
 // src/postgres/schema-reconcile.ts
-var reconcileWithClient2 = (pg, props, output) => Effect9.gen(function* () {
+var reconcileWithClient2 = (pg, props, output) => Effect10.gen(function* () {
   yield* assertSchemaTarget(props, output);
   yield* assertDatabase(props, pg);
   const executingRole = props.owner !== undefined ? props.owner : yield* currentUser(pg);
@@ -529,55 +545,215 @@ var reconcileWithClient2 = (pg, props, output) => Effect9.gen(function* () {
     if (props.owner !== undefined) {
       const ownerPresent = yield* roleExists(pg, props.owner);
       if (!ownerPresent) {
-        return yield* Effect9.fail(new PostgresSchemaOwnerMissing({ schema: props.name, owner: props.owner }));
+        return yield* Effect10.fail(new PostgresSchemaOwnerMissing({ schema: props.name, owner: props.owner }));
       }
     }
     const createRefusal = (error) => isDuplicateSchemaError(error) ? new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }) : error;
-    yield* pg.unsafe(buildCreateSchemaSql(props)).pipe(Effect9.asVoid, Effect9.catchTag("SqlError", (error) => Effect9.fail(createRefusal(error))));
+    yield* pg.unsafe(buildCreateSchemaSql(props)).pipe(Effect10.asVoid, Effect10.catchTag("SqlError", (error) => Effect10.fail(createRefusal(error))));
     const created = yield* selectSchema(pg, props.name);
     if (created === undefined) {
-      return yield* Effect9.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
+      return yield* Effect10.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
     }
     yield* assertOwner(props, created, executingRole);
     const comment = normalizedComment(props.comment);
     if (comment !== undefined && comment !== (created.comment ?? undefined)) {
-      yield* pg.unsafe(buildCommentSchemaSql(props.name, comment)).pipe(Effect9.asVoid);
+      yield* pg.unsafe(buildCommentSchemaSql(props.name, comment)).pipe(Effect10.asVoid);
       const commented = yield* selectSchema(pg, props.name);
       if (commented === undefined) {
-        return yield* Effect9.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
+        return yield* Effect10.fail(new PostgresSchemaCreateVanished({ schema: props.name }));
       }
       return yield* assertLive(props, commented, executingRole);
     }
     return yield* assertLive(props, created, executingRole);
   }
   if (output === undefined) {
-    return yield* Effect9.fail(new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }));
+    return yield* Effect10.fail(new PostgresSchemaExistsRefused({ schema: props.name, database: props.database }));
   }
   yield* assertSchemaIdentity(observed, output);
   return yield* assertLive(props, observed, executingRole);
 });
 
 // src/postgres/schema-delete.ts
-import * as Effect10 from "effect/Effect";
-var dropGuarded = (pg, props) => Effect10.gen(function* () {
-  if (props.cascade !== true) {
-    const empty = yield* schemaIsEmpty(pg, props.name);
-    if (!empty) {
-      return yield* Effect10.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
-    }
+import * as Effect11 from "effect/Effect";
+
+// src/postgres/schema-closure-sql.ts
+var cls = (name) => `'pg_catalog.${name}'::pg_catalog.regclass`;
+var direct = (table, column) => `WHEN ${cls(table)} THEN (SELECT x.${column} FROM pg_catalog.${table} x WHERE x.oid = d.objid)`;
+var viaRelation = (table, column) => `WHEN ${cls(table)} THEN (SELECT c.relnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_class c ON c.oid = x.${column} WHERE x.oid = d.objid)`;
+var viaFamily = (table, column) => `WHEN ${cls(table)} THEN (SELECT f.opfnamespace FROM pg_catalog.${table} x JOIN pg_catalog.pg_opfamily f ON f.oid = x.${column} WHERE x.oid = d.objid)`;
+var RELATION_HOME = `WHEN ${cls("pg_class")} THEN COALESCE(
+            (SELECT o.relnamespace FROM pg_catalog.pg_class o
+              WHERE o.reltoastrelid <> 0
+                AND o.reltoastrelid IN (d.objid, (SELECT i.indrelid FROM pg_catalog.pg_index i WHERE i.indexrelid = d.objid))),
+            (SELECT x.relnamespace FROM pg_catalog.pg_class x WHERE x.oid = d.objid))`;
+var HOME_OF_DEPENDENT = `CASE d.classid
+          WHEN ${cls("pg_namespace")} THEN d.objid
+          ${RELATION_HOME}
+          ${direct("pg_type", "typnamespace")}
+          ${direct("pg_proc", "pronamespace")}
+          ${direct("pg_operator", "oprnamespace")}
+          ${direct("pg_collation", "collnamespace")}
+          ${direct("pg_conversion", "connamespace")}
+          ${direct("pg_opclass", "opcnamespace")}
+          ${direct("pg_opfamily", "opfnamespace")}
+          ${direct("pg_ts_config", "cfgnamespace")}
+          ${direct("pg_ts_dict", "dictnamespace")}
+          ${direct("pg_ts_parser", "prsnamespace")}
+          ${direct("pg_ts_template", "tmplnamespace")}
+          ${direct("pg_statistic_ext", "stxnamespace")}
+          ${direct("pg_constraint", "connamespace")}
+          ${direct("pg_default_acl", "defaclnamespace")}
+          ${direct("pg_extension", "extnamespace")}
+          ${viaRelation("pg_trigger", "tgrelid")}
+          ${viaRelation("pg_rewrite", "ev_class")}
+          ${viaRelation("pg_attrdef", "adrelid")}
+          ${viaRelation("pg_policy", "polrelid")}
+          ${viaRelation("pg_publication_rel", "prrelid")}
+          ${viaFamily("pg_amop", "amopfamily")}
+          ${viaFamily("pg_amproc", "amprocfamily")}
+        END`;
+var OUTSIDE_DEPENDENTS_SQL = `v_count := (
+      WITH RECURSIVE reach (classid, objid, inside) AS (
+        SELECT ${cls("pg_namespace")}::pg_catalog.oid, v_ns, true
+        UNION
+        SELECT d.classid, d.objid, (${HOME_OF_DEPENDENT}) IS NOT DISTINCT FROM v_ns
+        FROM pg_catalog.pg_depend d
+        JOIN reach r ON d.refclassid = r.classid AND d.refobjid = r.objid AND r.inside
+        WHERE d.deptype <> 'p'
+      )
+      SELECT (SELECT pg_catalog.count(*) FROM reach WHERE NOT inside)
+           + (SELECT pg_catalog.count(*) FROM pg_catalog.pg_depend e
+               JOIN reach r ON e.classid = r.classid AND e.objid = r.objid AND r.inside
+               WHERE e.deptype IN ('e', 'i') AND e.refobjid <> 0
+                 AND NOT EXISTS (SELECT 1 FROM reach o
+                                  WHERE o.inside AND o.classid = e.refclassid AND o.objid = e.refobjid))
+    )`;
+
+// src/postgres/schema-drop-sql.ts
+var IDENTITY_CHANGED = "HF001";
+var NOT_EMPTY = "HF002";
+var CROSS_SCHEMA_DEPENDENTS = "HF003";
+var CASCADE_SEQUENCES = "HF004";
+var LOCK_TIMEOUT = "10s";
+var buildAtomicDropSql = (drop) => {
+  const body = `DECLARE
+  v_name text := ${quoteStringLiteral(drop.name)};
+  v_oid oid := ${String(Math.trunc(drop.oid))};
+  v_owner text := ${quoteStringLiteral(drop.owner)};
+  v_cascade boolean := ${drop.cascade ? "true" : "false"};
+  v_ns oid;
+  v_count bigint;
+  v_comment text;
+  v_rel text;
+BEGIN
+  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n WHERE n.nspname = v_name;
+  IF v_ns IS NULL THEN RETURN; END IF;
+  PERFORM pg_catalog.set_config('lock_timeout', '${LOCK_TIMEOUT}', true);
+  PERFORM pg_catalog.pg_advisory_xact_lock(v_ns::pg_catalog.int8);
+  v_comment := pg_catalog.obj_description(v_ns, 'pg_namespace');
+  EXECUTE pg_catalog.format('COMMENT ON SCHEMA %I IS %L', v_name, v_comment);
+  SELECT n.oid INTO v_ns FROM pg_catalog.pg_namespace n
+    WHERE n.nspname = v_name AND n.oid = v_oid
+      AND pg_catalog.pg_get_userbyid(n.nspowner) = v_owner;
+  IF v_ns IS NULL THEN
+    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';
+  END IF;
+  IF NOT v_cascade THEN
+    IF NOT (${emptyPredicate("v_ns")}) THEN
+      RAISE EXCEPTION 'schema not empty' USING ERRCODE = '${NOT_EMPTY}';
+    END IF;
+  ELSE
+    SELECT count(*) INTO v_count FROM pg_catalog.pg_class c
+      WHERE c.relnamespace = v_ns AND c.relkind = 'S';
+    IF v_count > 0 THEN
+      RAISE EXCEPTION 'cascade sequences: %', v_count USING ERRCODE = '${CASCADE_SEQUENCES}';
+    END IF;
+    FOR v_rel IN SELECT c.oid::pg_catalog.regclass::pg_catalog.text FROM pg_catalog.pg_class c
+        WHERE c.relnamespace = v_ns AND c.relkind IN ('r', 'p', 'v', 'm', 'f') ORDER BY c.oid LOOP
+      EXECUTE pg_catalog.format('LOCK TABLE %s IN ACCESS EXCLUSIVE MODE', v_rel);
+    END LOOP;
+    ${OUTSIDE_DEPENDENTS_SQL};
+    IF v_count > 0 THEN
+      RAISE EXCEPTION 'cross-schema dependents: %', v_count USING ERRCODE = '${CROSS_SCHEMA_DEPENDENTS}';
+    END IF;
+  END IF;
+  PERFORM 1 FROM pg_catalog.pg_namespace n WHERE n.oid = v_oid AND n.nspname = v_name;
+  IF NOT FOUND THEN
+    RAISE EXCEPTION 'schema identity changed' USING ERRCODE = '${IDENTITY_CHANGED}';
+  END IF;
+  EXECUTE ${quoteStringLiteral(buildDropSchemaSql(drop.name, drop.cascade))};
+END`;
+  return `DO ${quoteStringLiteral(body)}`;
+};
+var sqlStateOf = (error) => {
+  const cause = error.reason.cause;
+  const code = typeof cause === "object" && cause !== null ? cause.code : "";
+  return typeof code === "string" ? code : undefined;
+};
+var dependentsCount = (error) => {
+  const cause = error.reason.cause;
+  const message = typeof cause === "object" && cause !== null ? cause.message : "";
+  const parsed = /dependents:\s*(\d+)/.exec(message ?? "")?.[1];
+  return Math.max(1, Number(parsed ?? 1));
+};
+
+// src/postgres/schema-sequence-error.ts
+import * as Data3 from "effect/Data";
+
+class PostgresSchemaCascadeSequencesRefused extends Data3.TaggedError("PostgresSchemaCascadeSequencesRefused") {
+  get message() {
+    return `Postgres.Schema "${this.schema}": cascade: true refused — the schema holds ` + `${String(this.sequences)} sequence(s) (serial/identity columns own one), which cannot be ` + "locked, so a concurrent dependent could escape the cascade proof. No DROP was issued. " + "Drop the schema contents first, then declare cascade: false.";
   }
-  const dropRefusal = (error) => props.cascade !== true && isDependentObjectsError(error) ? new PostgresSchemaDropNotEmptyError({ schema: props.name }) : error;
-  yield* pg.unsafe(buildDropSchemaSql(props.name, props.cascade === true)).pipe(Effect10.asVoid, Effect10.catchTag("SqlError", (error) => Effect10.fail(dropRefusal(error))));
-});
-var deleteWithClient = (pg, props, output) => Effect10.gen(function* () {
+}
+var sequencesCount = (error) => {
+  const cause = error.reason.cause;
+  const message = typeof cause === "object" && cause !== null ? cause.message : "";
+  return Math.max(1, Number(/sequences:\s*(\d+)/.exec(message ?? "")?.[1] ?? 1));
+};
+
+// src/postgres/schema-delete.ts
+var dropAtomic = (pg, props, live) => {
+  const cascade = props.cascade === true;
+  const classify = (error) => {
+    const state = sqlStateOf(error);
+    if (state === NOT_EMPTY || !cascade && isDependentObjectsError(error)) {
+      return Effect11.fail(new PostgresSchemaDropNotEmptyError({ schema: props.name }));
+    }
+    if (state === CROSS_SCHEMA_DEPENDENTS) {
+      return Effect11.fail(new PostgresSchemaCascadeCrossSchemaRefused({
+        schema: props.name,
+        dependents: dependentsCount(error)
+      }));
+    }
+    if (state === CASCADE_SEQUENCES) {
+      return Effect11.fail(new PostgresSchemaCascadeSequencesRefused({
+        schema: props.name,
+        sequences: sequencesCount(error)
+      }));
+    }
+    if (state === IDENTITY_CHANGED) {
+      return Effect11.flatMap(selectSchema(pg, props.name), (now) => now === undefined ? Effect11.void : Effect11.fail(new PostgresSchemaDeleteForeignRefused({
+        schema: props.name,
+        database: props.database,
+        liveOid: now.oid,
+        liveOwner: now.owner,
+        lastOid: live.oid,
+        lastOwner: live.owner
+      })));
+    }
+    return Effect11.fail(error);
+  };
+  return pg.unsafe(buildAtomicDropSql({ name: props.name, oid: live.oid, owner: live.owner, cascade })).pipe(Effect11.asVoid, Effect11.catchTag("SqlError", classify));
+};
+var deleteWithClient = (pg, props, output) => Effect11.gen(function* () {
   yield* assertDatabase(props, pg);
   const live = yield* selectSchema(pg, props.name);
   if (live === undefined)
     return;
   const refusal = deleteForeignRefusal(props, live, output);
   if (refusal !== undefined)
-    return yield* Effect10.fail(refusal);
-  yield* dropGuarded(pg, props);
+    return yield* Effect11.fail(refusal);
+  yield* dropAtomic(pg, props, live);
 });
 
 // src/postgres/schema.ts
@@ -587,9 +763,9 @@ var PostgresSchema = Resource2("Postgres.Schema", {
 var isPostgresSchema = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Postgres.Schema";
 var readWithClient2 = (pg, name) => selectSchema(pg, name);
 var postgresSchemaHandlers = PostgresSchema.Provider.of({
-  list: () => Effect11.succeed([]),
+  list: () => Effect12.succeed([]),
   nuke: { skip: true },
-  read: ({ olds, output }) => Effect11.gen(function* () {
+  read: ({ olds, output }) => Effect12.gen(function* () {
     const name = output?.name ?? olds.name;
     const database = output?.database ?? olds.database;
     const present = yield* withPg((pg) => databaseExists(pg, database));
@@ -597,7 +773,7 @@ var postgresSchemaHandlers = PostgresSchema.Provider.of({
       return;
     const live = yield* withPg((pg) => readWithClient2(pg, name), database);
     if (live !== undefined && live.database !== database) {
-      return yield* Effect11.fail(new PostgresSchemaWrongDatabase({
+      return yield* Effect12.fail(new PostgresSchemaWrongDatabase({
         schema: name,
         declared: database,
         connected: live.database
@@ -608,15 +784,15 @@ var postgresSchemaHandlers = PostgresSchema.Provider.of({
     return live === undefined ? undefined : Unowned2(live);
   }),
   diff: ({ news, output, olds }) => diffPostgresSchema(news, output, olds),
-  reconcile: ({ news, output }) => Effect11.gen(function* () {
+  reconcile: ({ news, output }) => Effect12.gen(function* () {
     const nameRefusal = schemaNameByteRefusal(news.name);
     if (nameRefusal !== undefined) {
-      return yield* Effect11.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
+      return yield* Effect12.fail(new PostgresSchemaNameRefused({ name: news.name, ...nameRefusal }));
     }
     yield* assertSchemaTarget(news, output);
     return yield* withPg((pg) => reconcileWithClient2(pg, news, output), news.database);
   }),
-  delete: ({ olds, output }) => Effect11.gen(function* () {
+  delete: ({ olds, output }) => Effect12.gen(function* () {
     const present = yield* withPg((pg) => databaseExists(pg, olds.database));
     if (!present)
       return;
@@ -706,7 +882,7 @@ var revokePublicTablesSql = (schema) => `REVOKE ALL ON ALL TABLES IN SCHEMA ${qu
 import { Resource as Resource3 } from "alchemy";
 import { Unowned as Unowned3 } from "alchemy/AdoptPolicy";
 import * as Provider3 from "alchemy/Provider";
-import * as Effect17 from "effect/Effect";
+import * as Effect18 from "effect/Effect";
 
 // src/postgres/grants-declare.ts
 var cleanWords = (words) => [...new Set(words)].sort();
@@ -781,7 +957,7 @@ var removedNames = (output, declared) => {
 };
 
 // src/postgres/grants-ops.ts
-import * as Effect16 from "effect/Effect";
+import * as Effect17 from "effect/Effect";
 import { isResolved as isResolved3 } from "alchemy/Diff";
 
 // src/postgres/grants-refuse.ts
@@ -1038,72 +1214,72 @@ var grantsDiffer = (declared, live) => {
 };
 
 // src/postgres/grants-existence.ts
-import * as Effect12 from "effect/Effect";
+import * as Effect13 from "effect/Effect";
 
 // src/postgres/grants-errors.ts
-import * as Data3 from "effect/Data";
+import * as Data4 from "effect/Data";
 
-class PostgresGrantsPrivilegeRefused extends Data3.TaggedError("PostgresGrantsPrivilegeRefused") {
+class PostgresGrantsPrivilegeRefused extends Data4.TaggedError("PostgresGrantsPrivilegeRefused") {
   get message() {
     return `Postgres.Grants: "${this.prop}" declares "${this.word}", which is not in the vocabulary ` + "PostgreSQL 18 grants on that object class (see grants-attrs.ts for the three sets, traced " + "to acl.h at REL_18_6). Column grants take select/insert/update/references only — TRUNCATE, " + "TRIGGER and MAINTAIN are table-wide.";
   }
 }
 
-class PostgresGrantsNameRefused extends Data3.TaggedError("PostgresGrantsNameRefused") {
+class PostgresGrantsNameRefused extends Data4.TaggedError("PostgresGrantsNameRefused") {
   get message() {
     return `Postgres.Grants: the name "${this.name}" is ${String(this.byteLength)} UTF-8 bytes, over the ` + `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` + "accept the statement and silently truncate the name with only a NOTICE, so this plan refuses " + "it instead of granting on an object no later read will ever find again.";
   }
 }
 
-class PostgresGrantsDuplicateObject extends Data3.TaggedError("PostgresGrantsDuplicateObject") {
+class PostgresGrantsDuplicateObject extends Data4.TaggedError("PostgresGrantsDuplicateObject") {
   get message() {
     return `Postgres.Grants: "${this.prop}" declares "${this.name}" twice. Merge the entries into one — ` + "the declaration must state each object at most once, and each privilege word in exactly one " + "form: plain, or WITH GRANT OPTION (`select` and `select*` cannot both hold, the server keeps " + "one aclitem per grantee per grantor).";
   }
 }
 
-class PostgresGrantsRetargetRefused extends Data3.TaggedError("PostgresGrantsRetargetRefused") {
+class PostgresGrantsRetargetRefused extends Data4.TaggedError("PostgresGrantsRetargetRefused") {
   get message() {
     return `Postgres.Grants: the declared ${this.prop} changed from "${this.from}" to "${this.to}". A ` + "retarget is refused at plan — declare a new logical id for the new target and delete the old " + "one (its retain policy keeps the grants until a destroy revokes them).";
   }
 }
 
-class PostgresGrantsDatabaseMismatch extends Data3.TaggedError("PostgresGrantsDatabaseMismatch") {
+class PostgresGrantsDatabaseMismatch extends Data4.TaggedError("PostgresGrantsDatabaseMismatch") {
   get message() {
     return `Postgres.Grants: the declaration names database "${this.declared}" but ` + `current_database() is "${this.connected}". The handlers open the declared database and ` + "prove it before any GRANT or REVOKE — a mismatch means that open did not land there.";
   }
 }
 
-class PostgresGrantsSchemaMissing extends Data3.TaggedError("PostgresGrantsSchemaMissing") {
+class PostgresGrantsSchemaMissing extends Data4.TaggedError("PostgresGrantsSchemaMissing") {
   get message() {
     return `Postgres.Grants: schema "${this.schema}" is not in pg_namespace. Grants are written into a ` + "schema that already exists — declare a Postgres.Schema (or create it by hand) before the " + "grant set that scopes to it.";
   }
 }
 
-class PostgresGrantsDatabaseMissing extends Data3.TaggedError("PostgresGrantsDatabaseMissing") {
+class PostgresGrantsDatabaseMissing extends Data4.TaggedError("PostgresGrantsDatabaseMissing") {
   get message() {
     return `Postgres.Grants: database "${this.database}" is not in pg_database. Grants are written into ` + "a database that already exists — declare a Postgres.Database (or create it by hand) before " + "the grant set that scopes to it.";
   }
 }
 
-class PostgresGrantsRoleMissing extends Data3.TaggedError("PostgresGrantsRoleMissing") {
+class PostgresGrantsRoleMissing extends Data4.TaggedError("PostgresGrantsRoleMissing") {
   get message() {
     return `Postgres.Grants: role "${this.role}" is not in pg_roles. GRANT and ALTER DEFAULT PRIVILEGES ` + "would fail against it — create the role (a group role per seat, membership owned by a human) " + "before declaring its grants.";
   }
 }
 
-class PostgresGrantsTableMissing extends Data3.TaggedError("PostgresGrantsTableMissing") {
+class PostgresGrantsTableMissing extends Data4.TaggedError("PostgresGrantsTableMissing") {
   get message() {
     return `Postgres.Grants: table "${this.schema}"."${this.table}" does not exist. The declaration ` + "names a relation before it is created; create the table (or fix the name) before granting.";
   }
 }
 
-class PostgresGrantsColumnMissing extends Data3.TaggedError("PostgresGrantsColumnMissing") {
+class PostgresGrantsColumnMissing extends Data4.TaggedError("PostgresGrantsColumnMissing") {
   get message() {
     return `Postgres.Grants: column "${this.column}" of "${this.schema}"."${this.table}" does not ` + "exist. Declare the column (or fix its name) before granting on it.";
   }
 }
 
-class PostgresGrantsRepairRefused extends Data3.TaggedError("PostgresGrantsRepairRefused") {
+class PostgresGrantsRepairRefused extends Data4.TaggedError("PostgresGrantsRepairRefused") {
   get message() {
     return `Postgres.Grants: the repair on schema "${this.schema}" for role "${this.role}" re-read as ` + `still drifted; these statements would run again: ${this.remaining.join(" ; ")}. A grant made ` + "by another role survives this resource’s REVOKE (only its grantor or the object’s " + "owner can revoke it) — revoke it as that grantor or the owner, or declare the privilege so " + "the set matches.";
   }
@@ -1112,39 +1288,39 @@ class PostgresGrantsRepairRefused extends Data3.TaggedError("PostgresGrantsRepai
 // src/postgres/grants-existence.ts
 var TABLES_PRESENT_SQL = `SELECT
     c.relname AS table
-  FROM pg_class c
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND c.relname::text IN (SELECT json_array_elements_text($2::json))`;
-var findMissingTable = (pg, schema, tables) => tables.length === 0 ? Effect12.succeed(undefined) : Effect12.map(pg.unsafe(TABLES_PRESENT_SQL, [schema, JSON.stringify(tables)]), (rows) => {
+  FROM pg_catalog.pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND c.relname::text IN (SELECT pg_catalog.json_array_elements_text($2::json))`;
+var findMissingTable = (pg, schema, tables) => tables.length === 0 ? Effect13.succeed(undefined) : Effect13.map(pg.unsafe(TABLES_PRESENT_SQL, [schema, JSON.stringify(tables)]), (rows) => {
   const present = new Set(rows.map((row) => row.table));
   return tables.find((table) => !present.has(table));
 });
 var COLUMNS_PRESENT_SQL = `SELECT
     c.relname AS table,
     a.attname AS column
-  FROM pg_attribute a
-  JOIN pg_class c ON c.oid = a.attrelid
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+  FROM pg_catalog.pg_attribute a
+  JOIN pg_catalog.pg_class c ON c.oid = a.attrelid
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND a.attnum > 0
     AND NOT a.attisdropped
     AND (c.relname, a.attname) IN (
-      SELECT x->>0, x->>1 FROM json_array_elements($2::json) x
+      SELECT x->>0, x->>1 FROM pg_catalog.json_array_elements($2::json) x
     )`;
-var findMissingColumn = (pg, schema, columns) => columns.length === 0 ? Effect12.succeed(undefined) : Effect12.map(pg.unsafe(COLUMNS_PRESENT_SQL, [
+var findMissingColumn = (pg, schema, columns) => columns.length === 0 ? Effect13.succeed(undefined) : Effect13.map(pg.unsafe(COLUMNS_PRESENT_SQL, [
   schema,
   JSON.stringify(columns.map(({ table, column }) => [table, column]))
 ]), (rows) => {
   const present = new Set(rows.map((row) => `${row.table}\x00${row.column}`));
   return columns.find(({ table, column }) => !present.has(`${table}\x00${column}`));
 });
-var requireDeclaredObjectsExist = (pg, declared) => Effect12.gen(function* () {
+var requireDeclaredObjectsExist = (pg, declared) => Effect13.gen(function* () {
   const missingTable = yield* findMissingTable(pg, declared.schema, declared.tables.map((table) => table.table));
   if (missingTable !== undefined) {
-    return yield* Effect12.fail(new PostgresGrantsTableMissing({ schema: declared.schema, table: missingTable }));
+    return yield* Effect13.fail(new PostgresGrantsTableMissing({ schema: declared.schema, table: missingTable }));
   }
   const missingColumn = yield* findMissingColumn(pg, declared.schema, declared.columns.map((column) => ({ table: column.table, column: column.column })));
   if (missingColumn !== undefined) {
-    return yield* Effect12.fail(new PostgresGrantsColumnMissing({
+    return yield* Effect13.fail(new PostgresGrantsColumnMissing({
       schema: declared.schema,
       table: missingColumn.table,
       column: missingColumn.column
@@ -1153,35 +1329,35 @@ var requireDeclaredObjectsExist = (pg, declared) => Effect12.gen(function* () {
 });
 
 // src/postgres/grants-read.ts
-import * as Effect15 from "effect/Effect";
+import * as Effect16 from "effect/Effect";
 
 // src/postgres/grants-ownership.ts
-import * as Effect13 from "effect/Effect";
+import * as Effect14 from "effect/Effect";
 var SCHEMA_OWNER_SQL = `SELECT
-    n.nspowner = (SELECT oid FROM pg_roles WHERE rolname = $2) AS role_owns
-  FROM pg_namespace n
+    n.nspowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2) AS role_owns
+  FROM pg_catalog.pg_namespace n
   WHERE n.nspname = $1`;
-var readSchemaOwnership = (pg, schema, role) => Effect13.map(pg.unsafe(SCHEMA_OWNER_SQL, [schema, role]), (rows) => rows[0]?.role_owns === true);
+var readSchemaOwnership = (pg, schema, role) => Effect14.map(pg.unsafe(SCHEMA_OWNER_SQL, [schema, role]), (rows) => rows[0]?.role_owns === true);
 var OWNED_TABLES_SQL = `SELECT c.relname AS table
-  FROM pg_class c
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND c.relowner = (SELECT oid FROM pg_roles WHERE rolname = $2)
+  FROM pg_catalog.pg_class c
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND c.relowner = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)
   ORDER BY c.relname`;
-var readOwnedTables = (pg, schema, role) => Effect13.map(pg.unsafe(OWNED_TABLES_SQL, [schema, role]), (rows) => rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)));
+var readOwnedTables = (pg, schema, role) => Effect14.map(pg.unsafe(OWNED_TABLES_SQL, [schema, role]), (rows) => rows.map((row) => row.table).sort((a, b) => a.localeCompare(b)));
 
 // src/postgres/grants-read-defaults.ts
-import * as Effect14 from "effect/Effect";
+import * as Effect15 from "effect/Effect";
 var DEFAULTS_SQL = `SELECT
-    pg_get_userbyid(d.defaclrole) AS for_role,
+    pg_catalog.pg_get_userbyid(d.defaclrole) AS for_role,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_default_acl d
-  CROSS JOIN LATERAL aclexplode(d.defaclacl) AS a
-  WHERE d.defaclnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+  FROM pg_catalog.pg_default_acl d
+  CROSS JOIN LATERAL pg_catalog.aclexplode(d.defaclacl) AS a
+  WHERE d.defaclnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND d.defaclobjtype = 'r'
-    AND a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2)
+    AND a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2)
   ORDER BY for_role`;
-var readDefaultAcls = (pg, schema, role) => Effect14.map(pg.unsafe(DEFAULTS_SQL, [schema, role]), (rows) => {
+var readDefaultAcls = (pg, schema, role) => Effect15.map(pg.unsafe(DEFAULTS_SQL, [schema, role]), (rows) => {
   const byRole = new Map;
   for (const row of rows) {
     const words = byRole.get(row.for_role) ?? [];
@@ -1192,17 +1368,17 @@ var readDefaultAcls = (pg, schema, role) => Effect14.map(pg.unsafe(DEFAULTS_SQL,
 });
 
 // src/postgres/grants-read.ts
-var SCHEMA_PRESENT_SQL = "SELECT 1 AS present FROM pg_namespace WHERE nspname = $1";
-var schemaExists = (pg, schema) => Effect15.map(pg.unsafe(SCHEMA_PRESENT_SQL, [schema]), (rows) => rows.length > 0);
+var SCHEMA_PRESENT_SQL = "SELECT 1 AS present FROM pg_catalog.pg_namespace WHERE nspname = $1";
+var schemaExists = (pg, schema) => Effect16.map(pg.unsafe(SCHEMA_PRESENT_SQL, [schema]), (rows) => rows.length > 0);
 var SCHEMA_ACL_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_namespace n
-  CROSS JOIN LATERAL aclexplode(n.nspacl) AS a
+  FROM pg_catalog.pg_namespace n
+  CROSS JOIN LATERAL pg_catalog.aclexplode(n.nspacl) AS a
   WHERE n.nspname = $1
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))`;
-var readSchemaAcl = (pg, schema, role) => Effect15.map(pg.unsafe(SCHEMA_ACL_SQL, [schema, role]), (rows) => ({
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))`;
+var readSchemaAcl = (pg, schema, role) => Effect16.map(pg.unsafe(SCHEMA_ACL_SQL, [schema, role]), (rows) => ({
   role: wordsOf(rows, false),
   public: wordsOf(rows, true)
 }));
@@ -1212,12 +1388,12 @@ var TABLES_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable
-  FROM pg_class c
-  CROSS JOIN LATERAL aclexplode(c.relacl) AS a
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+  FROM pg_catalog.pg_class c
+  CROSS JOIN LATERAL pg_catalog.aclexplode(c.relacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))
   ORDER BY c.relname`;
-var readTableAcls = (pg, schema, role) => Effect15.map(pg.unsafe(TABLES_SQL, [
+var readTableAcls = (pg, schema, role) => Effect16.map(pg.unsafe(TABLES_SQL, [
   schema,
   role
 ]), (rows) => {
@@ -1240,19 +1416,19 @@ var COLUMNS_SQL = `SELECT
     a.grantee = 0 AS public,
     a.privilege_type AS privilege,
     a.is_grantable AS grantable,
-    pg_get_userbyid(a.grantor) AS grantor,
-    pg_get_userbyid(c.relowner) AS owner,
+    pg_catalog.pg_get_userbyid(a.grantor) AS grantor,
+    pg_catalog.pg_get_userbyid(c.relowner) AS owner,
     current_user AS revoker,
-    pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner
-  FROM pg_attribute v
-  JOIN pg_class c ON c.oid = v.attrelid
-  CROSS JOIN LATERAL aclexplode(v.attacl) AS a
-  WHERE c.relnamespace = (SELECT oid FROM pg_namespace WHERE nspname = $1)
+    pg_catalog.pg_has_role(current_user, c.relowner, 'USAGE') AS revoker_as_owner
+  FROM pg_catalog.pg_attribute v
+  JOIN pg_catalog.pg_class c ON c.oid = v.attrelid
+  CROSS JOIN LATERAL pg_catalog.aclexplode(v.attacl) AS a
+  WHERE c.relnamespace = (SELECT oid FROM pg_catalog.pg_namespace WHERE nspname = $1)
     AND v.attnum > 0
     AND NOT v.attisdropped
-    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_roles WHERE rolname = $2))
+    AND (a.grantee = 0 OR a.grantee = (SELECT oid FROM pg_catalog.pg_roles WHERE rolname = $2))
   ORDER BY c.relname, v.attname`;
-var readColumnAcls = (pg, schema, role) => Effect15.map(pg.unsafe(COLUMNS_SQL, [schema, role]), (rows) => {
+var readColumnAcls = (pg, schema, role) => Effect16.map(pg.unsafe(COLUMNS_SQL, [schema, role]), (rows) => {
   const byColumn = new Map;
   for (const row of rows) {
     const key = `${row.table}\x00${row.column}`;
@@ -1275,7 +1451,7 @@ var readColumnAcls = (pg, schema, role) => Effect15.map(pg.unsafe(COLUMNS_SQL, [
     };
   }).sort((a, b) => a.table.localeCompare(b.table) || a.column.localeCompare(b.column));
 });
-var readGrants = (pg, schema, role) => Effect15.all({
+var readGrants = (pg, schema, role) => Effect16.all({
   schemaExists: schemaExists(pg, schema),
   schema: readSchemaAcl(pg, schema, role),
   tables: readTableAcls(pg, schema, role),
@@ -1286,8 +1462,8 @@ var readGrants = (pg, schema, role) => Effect15.all({
 });
 
 // src/postgres/grants-ops.ts
-var failRefusal = (refusal) => refusal.kind === "privilege" ? Effect16.fail(new PostgresGrantsPrivilegeRefused({ prop: refusal.prop, word: refusal.word })) : Effect16.fail(new PostgresGrantsDuplicateObject({ prop: refusal.prop, name: refusal.name }));
-var proveDatabase = (pg, declared) => Effect16.flatMap(currentDatabase(pg), (connected) => connected === declared ? Effect16.void : Effect16.fail(new PostgresGrantsDatabaseMismatch({ declared, connected })));
+var failRefusal = (refusal) => refusal.kind === "privilege" ? Effect17.fail(new PostgresGrantsPrivilegeRefused({ prop: refusal.prop, word: refusal.word })) : Effect17.fail(new PostgresGrantsDuplicateObject({ prop: refusal.prop, name: refusal.name }));
+var proveDatabase = (pg, declared) => Effect17.flatMap(currentDatabase(pg), (connected) => connected === declared ? Effect17.void : Effect17.fail(new PostgresGrantsDatabaseMismatch({ declared, connected })));
 var refuseNames = (props) => {
   const declared = resolveProps(props);
   const names = grantsNamesRefusal(declared);
@@ -1297,30 +1473,30 @@ var refuseNames = (props) => {
     limit: names.limit
   });
 };
-var reconcileWithClient3 = (pg, props, output) => Effect16.gen(function* () {
+var reconcileWithClient3 = (pg, props, output) => Effect17.gen(function* () {
   const declared = resolveProps(props);
   const declRefusal = declarationRefusal(declared);
   if (declRefusal !== undefined)
     return yield* failRefusal(declRefusal);
   const nameRefusal = refuseNames(props);
   if (nameRefusal !== undefined)
-    return yield* Effect16.fail(nameRefusal);
+    return yield* Effect17.fail(nameRefusal);
   for (const [prop, from, to] of [
     ["role", output?.role, declared.role],
     ["database", output?.database, declared.database],
     ["schema", output?.schema, declared.schema]
   ]) {
     if (from !== undefined && from !== to) {
-      return yield* Effect16.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+      return yield* Effect17.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
     }
   }
   yield* proveDatabase(pg, declared.database);
   if (!(yield* schemaExists(pg, declared.schema))) {
-    return yield* Effect16.fail(new PostgresGrantsSchemaMissing({ schema: declared.schema }));
+    return yield* Effect17.fail(new PostgresGrantsSchemaMissing({ schema: declared.schema }));
   }
   for (const role of [declared.role, ...declared.defaults.map((entry) => entry.forRole)]) {
     if (!(yield* roleExists(pg, role))) {
-      return yield* Effect16.fail(new PostgresGrantsRoleMissing({ role }));
+      return yield* Effect17.fail(new PostgresGrantsRoleMissing({ role }));
     }
   }
   yield* requireDeclaredObjectsExist(pg, declared);
@@ -1332,7 +1508,7 @@ var reconcileWithClient3 = (pg, props, output) => Effect16.gen(function* () {
   const after = yield* readGrants(pg, declared.schema, declared.role);
   const remaining = planReconcile(declared, after, removed);
   if (remaining.length > 0) {
-    return yield* Effect16.fail(new PostgresGrantsRepairRefused({
+    return yield* Effect17.fail(new PostgresGrantsRepairRefused({
       schema: declared.schema,
       role: declared.role,
       remaining
@@ -1340,7 +1516,7 @@ var reconcileWithClient3 = (pg, props, output) => Effect16.gen(function* () {
   }
   return attributesOf(after, declaredNames(declared));
 });
-var readWithClient3 = (pg, names, stored) => Effect16.gen(function* () {
+var readWithClient3 = (pg, names, stored) => Effect17.gen(function* () {
   yield* proveDatabase(pg, names.database);
   if (!(yield* schemaExists(pg, names.schema)))
     return;
@@ -1349,7 +1525,7 @@ var readWithClient3 = (pg, names, stored) => Effect16.gen(function* () {
   const holdsAnything = projected.schemaPrivileges.length > 0 || projected.tables.some((table) => table.privileges.length > 0) || projected.columns.some((column) => column.privileges.length > 0) || projected.defaults.some((entry) => entry.privileges.length > 0);
   return stored || holdsAnything ? projected : undefined;
 });
-var deleteWithClient2 = (pg, props) => Effect16.gen(function* () {
+var deleteWithClient2 = (pg, props) => Effect17.gen(function* () {
   yield* proveDatabase(pg, props.database);
   if (!(yield* roleExists(pg, props.role)))
     return;
@@ -1363,14 +1539,14 @@ var deleteWithClient2 = (pg, props) => Effect16.gen(function* () {
   const after = yield* readGrants(pg, cleared.schema, cleared.role);
   const remaining = planRepair(cleared, after);
   if (remaining.length > 0) {
-    return yield* Effect16.fail(new PostgresGrantsRepairRefused({
+    return yield* Effect17.fail(new PostgresGrantsRepairRefused({
       schema: cleared.schema,
       role: cleared.role,
       remaining
     }));
   }
 });
-var diffPostgresGrants = (news, output) => Effect16.gen(function* () {
+var diffPostgresGrants = (news, output) => Effect17.gen(function* () {
   if (output === undefined || !isResolved3(news))
     return;
   const declared = resolveProps(news);
@@ -1380,12 +1556,12 @@ var diffPostgresGrants = (news, output) => Effect16.gen(function* () {
     ["schema", output.schema, declared.schema]
   ]) {
     if (from !== to) {
-      return yield* Effect16.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
+      return yield* Effect17.fail(new PostgresGrantsRetargetRefused({ prop, from, to }));
     }
   }
   const nameRefusal = refuseNames(news);
   if (nameRefusal !== undefined)
-    return yield* Effect16.fail(nameRefusal);
+    return yield* Effect17.fail(nameRefusal);
   const declRefusal = declarationRefusal(declared);
   if (declRefusal !== undefined)
     return yield* failRefusal(declRefusal);
@@ -1398,9 +1574,9 @@ var PostgresGrants = Resource3("Postgres.Grants", {
 });
 var isPostgresGrants = (value) => (typeof value === "object" || typeof value === "function") && value !== null && value.Type === "Postgres.Grants";
 var postgresGrantsHandlers = PostgresGrants.Provider.of({
-  list: () => Effect17.succeed([]),
+  list: () => Effect18.succeed([]),
   nuke: { skip: true },
-  read: ({ olds, output }) => Effect17.gen(function* () {
+  read: ({ olds, output }) => Effect18.gen(function* () {
     const names = output !== undefined ? namesFromAttrs(output) : declaredNames(resolveProps(olds));
     const present = yield* withPg((pg) => databaseExists(pg, names.database));
     if (!present)
@@ -1409,14 +1585,14 @@ var postgresGrantsHandlers = PostgresGrants.Provider.of({
     return live === undefined ? undefined : Unowned3(live);
   }),
   diff: ({ news, output }) => diffPostgresGrants(news, output),
-  reconcile: ({ news, output }) => Effect17.gen(function* () {
+  reconcile: ({ news, output }) => Effect18.gen(function* () {
     const present = yield* withPg((pg) => databaseExists(pg, news.database));
     if (!present) {
-      return yield* Effect17.fail(new PostgresGrantsDatabaseMissing({ database: news.database }));
+      return yield* Effect18.fail(new PostgresGrantsDatabaseMissing({ database: news.database }));
     }
     return yield* withPg((pg) => reconcileWithClient3(pg, news, output), news.database);
   }),
-  delete: ({ olds }) => Effect17.gen(function* () {
+  delete: ({ olds }) => Effect18.gen(function* () {
     const present = yield* withPg((pg) => databaseExists(pg, olds.database));
     if (!present)
       return;
@@ -1435,70 +1611,70 @@ var validUntilRefusal = (value) => {
 };
 var sameValidUntil = (declared, live) => live !== null && Date.parse(declared) === Date.parse(live);
 // src/postgres/role-sql.ts
-import * as Effect19 from "effect/Effect";
+import * as Effect20 from "effect/Effect";
 
 // src/postgres/role-membership-sql.ts
-import * as Effect18 from "effect/Effect";
+import * as Effect19 from "effect/Effect";
 
 // src/postgres/role-errors.ts
-import * as Data4 from "effect/Data";
+import * as Data5 from "effect/Data";
 
-class PostgresRoleNameRefused extends Data4.TaggedError("PostgresRoleNameRefused") {
+class PostgresRoleNameRefused extends Data5.TaggedError("PostgresRoleNameRefused") {
   get message() {
     return `Postgres.Role "${this.name}": ${String(this.byteLength)} UTF-8 bytes, over the ` + `${String(this.limit)}-byte limit (NAMEDATALEN 64, minus the terminator). PostgreSQL would ` + "accept the CREATE and silently truncate the name with only a NOTICE, so this plan refuses " + "it instead of creating a role no later read will ever find again.";
   }
 }
 
-class PostgresRoleRenameRefused extends Data4.TaggedError("PostgresRoleRenameRefused") {
+class PostgresRoleRenameRefused extends Data5.TaggedError("PostgresRoleRenameRefused") {
   get message() {
     return `Postgres.Role: the declared name changed from "${this.from}" to "${this.to}". A ` + "rename is refused at plan — this provider never replaces a role (that is DROP then " + "CREATE, which loses memberships, grants and ownerships). Declare a new logical id for " + "the new name, and remove the old one once its objects have moved.";
   }
 }
 
-class PostgresRolePasswordEnvUnsetError extends Data4.TaggedError("PostgresRolePasswordEnvUnsetError") {
+class PostgresRolePasswordEnvUnsetError extends Data5.TaggedError("PostgresRolePasswordEnvUnsetError") {
   get message() {
     return `Postgres.Role "${this.role}": password.fromEnv "${this.variable}" is unset or empty ` + "in the deploying process, but this write requires a password this stack has not sealed.";
   }
 }
 
-class PostgresRolePrivilegedRefused extends Data4.TaggedError("PostgresRolePrivilegedRefused") {
+class PostgresRolePrivilegedRefused extends Data5.TaggedError("PostgresRolePrivilegedRefused") {
   get message() {
     return `Postgres.Role "${this.role}": the live role has ${this.flags.join(", ")} set. This ` + "family never declares those attributes (a create lands on the server default, all off), " + "and they are not inherited — a member who SET ROLEs to this role would exercise them. " + "Clear the flag on the cluster before this stack adopts the role.";
   }
 }
 
-class PostgresRoleValidUntilRefused extends Data4.TaggedError("PostgresRoleValidUntilRefused") {
+class PostgresRoleValidUntilRefused extends Data5.TaggedError("PostgresRoleValidUntilRefused") {
   get message() {
     return `Postgres.Role "${this.role}": validUntil "${this.value}" is ${this.reason === "unparseable" ? "not a timestamp this kit can parse" : "missing its UTC designator or numeric offset"}. ` + 'Declare an explicit-zone ISO 8601 value such as "2027-01-01T00:00:00Z" — PostgreSQL would ' + "read a zone-free value in the session time zone while the plan compares UTC, and the two " + "would never agree.";
   }
 }
 
-class PostgresRoleCreateVanished extends Data4.TaggedError("PostgresRoleCreateVanished") {
+class PostgresRoleCreateVanished extends Data5.TaggedError("PostgresRoleCreateVanished") {
   get message() {
     return `Postgres.Role "${this.role}": CREATE ROLE raised no error, but the role is still ` + "absent on the immediate re-read. Re-plan — this is not a state this provider expects to reach.";
   }
 }
 
-class PostgresRoleMembershipUnrepaired extends Data4.TaggedError("PostgresRoleMembershipUnrepaired") {
+class PostgresRoleMembershipUnrepaired extends Data5.TaggedError("PostgresRoleMembershipUnrepaired") {
   get message() {
     const who = this.grantor === null ? "an unresolvable grantor (inconsistent catalog)" : `grantor "${this.grantor}"`;
     return `Postgres.Role "${this.role}": membership of "${this.parent}" ` + `(${this.declared ? "declared, options unsafe" : "not declared"}) could not be repaired ` + `under ${who}. The server refused the repair or the catalog re-read still found the row ` + "outside the declaration. pg_auth_members keys a membership on (parent, member, grantor). " + "Check dependent grants, executor permissions and grantor identity before re-planning.";
   }
 }
 
-class PostgresRoleParentMissing extends Data4.TaggedError("PostgresRoleParentMissing") {
+class PostgresRoleParentMissing extends Data5.TaggedError("PostgresRoleParentMissing") {
   get message() {
     return `Postgres.Role "${this.role}": memberOf parent "${this.parent}" does not exist. ` + "Nothing was written — declare that role first (or drop it from memberOf). A GRANT of a " + "missing role fails only after CREATE ROLE has committed, and the next plan then needs " + "--adopt to finish the orphan.";
   }
 }
 
-class PostgresRoleIdentityRefused extends Data4.TaggedError("PostgresRoleIdentityRefused") {
+class PostgresRoleIdentityRefused extends Data5.TaggedError("PostgresRoleIdentityRefused") {
   get message() {
     return `Postgres.Role "${this.role}": the live oid is ${String(this.liveOid)}, but state recorded ` + `${String(this.storedOid)}. The name was dropped and recreated outside this stack. Nothing ` + "was altered and the live role was not dropped — remove the stale state, or adopt the new " + "role under a new logical id once you mean to own it.";
   }
 }
 
-class PostgresRolePasswordNonAsciiRefused extends Data4.TaggedError("PostgresRolePasswordNonAsciiRefused") {
+class PostgresRolePasswordNonAsciiRefused extends Data5.TaggedError("PostgresRolePasswordNonAsciiRefused") {
   get message() {
     return `Postgres.Role "${this.role}": password must be ASCII; this provider does not implement PostgreSQL SASLprep normalization. Nothing was written.`;
   }
@@ -1510,13 +1686,13 @@ var MEMBERSHIP_SQL = `SELECT parent.rolname AS parent,
     m.admin_option AS admin,
     m.set_option AS set,
     m.inherit_option AS inherit
-  FROM pg_auth_members m
-  JOIN pg_roles member ON member.oid = m.member
-  JOIN pg_roles parent ON parent.oid = m.roleid
-  LEFT JOIN pg_roles grantor ON grantor.oid = m.grantor
+  FROM pg_catalog.pg_auth_members m
+  JOIN pg_catalog.pg_roles member ON member.oid = m.member
+  JOIN pg_catalog.pg_roles parent ON parent.oid = m.roleid
+  LEFT JOIN pg_catalog.pg_roles grantor ON grantor.oid = m.grantor
   WHERE member.rolname = $1
   ORDER BY parent.rolname, grantor.rolname NULLS FIRST`;
-var selectRoleMemberships = (pg, name) => Effect18.map(pg.unsafe(MEMBERSHIP_SQL, [name]), (rows) => rows);
+var selectRoleMemberships = (pg, name) => Effect19.map(pg.unsafe(MEMBERSHIP_SQL, [name]), (rows) => rows);
 var buildGrantMembershipSql = (member, parent) => `GRANT ${quoteIdent(parent)} TO ${quoteIdent(member)} WITH SET FALSE`;
 var buildRepairMembershipSql = (member, parent, grantor, option) => `REVOKE ${option} OPTION FOR ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)} RESTRICT`;
 var buildRevokeGrantorMembershipSql = (member, parent, grantor) => `REVOKE ${quoteIdent(parent)} FROM ${quoteIdent(member)} GRANTED BY ${quoteIdent(grantor)}`;
@@ -1534,16 +1710,16 @@ var membershipDrift = (declared, live, unsafe = new Set) => {
     ]
   };
 };
-var assertParentsExist = (pg, role, parents) => Effect18.gen(function* () {
+var assertParentsExist = (pg, role, parents) => Effect19.gen(function* () {
   if (parents === undefined)
     return;
   for (const parent of [...new Set(parents)].sort()) {
     if (!(yield* roleExists(pg, parent))) {
-      return yield* Effect18.fail(new PostgresRoleParentMissing({ role, parent }));
+      return yield* Effect19.fail(new PostgresRoleParentMissing({ role, parent }));
     }
   }
 });
-var syncMemberships = (pg, props, rows) => Effect18.gen(function* () {
+var syncMemberships = (pg, props, rows) => Effect19.gen(function* () {
   if (props.memberOf === undefined) {
     return [...new Set(rows.map((row) => row.parent))].sort();
   }
@@ -1568,10 +1744,10 @@ var syncMemberships = (pg, props, rows) => Effect18.gen(function* () {
       }
     }
     if (statements.length > 0)
-      yield* pg.transaction(statements).pipe(Effect18.catchTag("SqlError", (error) => {
+      yield* pg.transaction(statements).pipe(Effect19.catchTag("SqlError", (error) => {
         const cause = error.reason.cause;
         const code = typeof cause === "object" && cause !== null ? cause.code : undefined;
-        return Effect18.fail(code === "2BP01" || code === "42501" ? new PostgresRoleMembershipUnrepaired({
+        return Effect19.fail(code === "2BP01" || code === "42501" ? new PostgresRoleMembershipUnrepaired({
           role: props.name,
           parent: row.parent,
           grantor: row.grantor,
@@ -1584,7 +1760,7 @@ var syncMemberships = (pg, props, rows) => Effect18.gen(function* () {
     yield* pg.transaction(grants);
   for (const row of yield* selectRoleMemberships(pg, props.name)) {
     if (!wanted.includes(row.parent) || row.admin || row.set || row.inherit && !props.inherit) {
-      return yield* Effect18.fail(new PostgresRoleMembershipUnrepaired({
+      return yield* Effect19.fail(new PostgresRoleMembershipUnrepaired({
         role: props.name,
         parent: row.parent,
         grantor: row.grantor,
@@ -1608,10 +1784,10 @@ var SELECT_ROLE_SQL = `SELECT
     r.rolreplication AS replication,
     r.rolbypassrls AS bypassrls,
     to_char(r.rolvaliduntil AT TIME ZONE 'UTC', 'YYYY-MM-DD"T"HH24:MI:SS.MS"Z"') AS "validUntil"
-  FROM pg_roles r
+  FROM pg_catalog.pg_roles r
   WHERE r.rolname = $1`;
-var selectRole = (pg, name) => Effect19.map(pg.unsafe(SELECT_ROLE_SQL, [name]), (rows) => rows[0]);
-var readRoleWithClient = (pg, name) => Effect19.gen(function* () {
+var selectRole = (pg, name) => Effect20.map(pg.unsafe(SELECT_ROLE_SQL, [name]), (rows) => rows[0]);
+var readRoleWithClient = (pg, name) => Effect20.gen(function* () {
   const row = yield* selectRole(pg, name);
   if (row === undefined)
     return;
@@ -1692,12 +1868,12 @@ var privilegedFlags = (live) => {
 };
 // src/postgres/role.ts
 import { Resource as Resource4 } from "alchemy";
-import * as Effect21 from "effect/Effect";
+import * as Effect22 from "effect/Effect";
 import * as Redacted2 from "effect/Redacted";
 
 // src/postgres/role-secrets.ts
 import * as Redacted from "effect/Redacted";
-import * as Effect20 from "effect/Effect";
+import * as Effect21 from "effect/Effect";
 
 // src/secrets/write-only.ts
 import { Buffer } from "node:buffer";
@@ -1737,7 +1913,7 @@ var sealMatches = (sealed, values) => {
 };
 
 // src/postgres/role-secrets.ts
-var assertPasswordAscii = (role, resolved) => resolved.value !== undefined && /[\u0080-\uffff]/.test(Redacted.value(resolved.value)) ? Effect20.fail(new PostgresRolePasswordNonAsciiRefused({ role })) : Effect20.void;
+var assertPasswordAscii = (role, resolved) => resolved.value !== undefined && /[\u0080-\uffff]/.test(Redacted.value(resolved.value)) ? Effect21.fail(new PostgresRolePasswordNonAsciiRefused({ role })) : Effect21.void;
 var resolvePassword = (props, env = process.env) => {
   if (props.password === undefined)
     return { variable: undefined, value: undefined };
@@ -1771,20 +1947,20 @@ var PostgresRole = Resource4("Postgres.Role", {
   defaultRemovalPolicy: "retain"
 });
 var isPostgresRole = (value3) => (typeof value3 === "object" || typeof value3 === "function") && value3 !== null && value3.Type === "Postgres.Role";
-var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", storedOid) => Effect21.gen(function* () {
+var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", storedOid) => Effect22.gen(function* () {
   const resolved = resolvePassword(props, env);
   yield* assertPasswordAscii(props.name, resolved);
   const observed = yield* readRoleWithClient(pg, props.name);
   if (observed === undefined) {
     if (resolved.variable !== undefined && resolved.value === undefined) {
-      return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+      return yield* Effect22.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
     }
     yield* assertParentsExist(pg, props.name, props.memberOf);
     const verifier = resolved.value === undefined ? undefined : scramSha256Verifier(Redacted2.value(resolved.value));
     yield* pg.transaction(buildCreateStatements(props, verifier));
     const created = yield* readRoleWithClient(pg, props.name);
     if (created === undefined) {
-      return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
+      return yield* Effect22.fail(new PostgresRoleCreateVanished({ role: props.name }));
     }
     return {
       ...storedAttributes(created),
@@ -1792,7 +1968,7 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
     };
   }
   if (storedOid !== undefined && observed.oid !== storedOid) {
-    return yield* Effect21.fail(new PostgresRoleIdentityRefused({
+    return yield* Effect22.fail(new PostgresRoleIdentityRefused({
       role: props.name,
       storedOid,
       liveOid: observed.oid
@@ -1800,23 +1976,23 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
   }
   const flags = privilegedFlags(observed);
   if (flags.length > 0) {
-    return yield* Effect21.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));
+    return yield* Effect22.fail(new PostgresRolePrivilegedRefused({ role: props.name, flags }));
   }
   if (resolved.variable !== undefined && resolved.value === undefined && previousSeal === "") {
-    return yield* Effect21.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
+    return yield* Effect22.fail(new PostgresRolePasswordEnvUnsetError({ role: props.name, variable: resolved.variable }));
   }
   yield* assertParentsExist(pg, props.name, props.memberOf);
   for (const change of scalarDrift(props, observed)) {
-    yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect21.asVoid);
+    yield* pg.unsafe(buildAlterRoleSql(props.name, change)).pipe(Effect22.asVoid);
   }
   const passwordMatched = resolved.value !== undefined && passwordMatchesSeal(resolved.value, previousSeal);
   if (resolved.value !== undefined && !passwordMatched) {
-    yield* pg.unsafe(buildSetPasswordSql(props.name, scramSha256Verifier(Redacted2.value(resolved.value)))).pipe(Effect21.asVoid);
+    yield* pg.unsafe(buildSetPasswordSql(props.name, scramSha256Verifier(Redacted2.value(resolved.value)))).pipe(Effect22.asVoid);
   }
   yield* syncMemberships(pg, props, observed.memberships ?? []);
   const after = yield* readRoleWithClient(pg, props.name);
   if (after === undefined) {
-    return yield* Effect21.fail(new PostgresRoleCreateVanished({ role: props.name }));
+    return yield* Effect22.fail(new PostgresRoleCreateVanished({ role: props.name }));
   }
   return {
     ...storedAttributes(after),
@@ -1824,15 +2000,15 @@ var reconcileWithClient4 = (pg, props, env = process.env, previousSeal = "", sto
   };
 });
 var readRole = (pg, name) => readRoleWithClient(pg, name);
-var refuseAtPlan = (props) => Effect21.gen(function* () {
+var refuseAtPlan = (props) => Effect22.gen(function* () {
   const nameRefusal = nameByteRefusal(props.name);
   if (nameRefusal !== undefined) {
-    return yield* Effect21.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));
+    return yield* Effect22.fail(new PostgresRoleNameRefused({ name: props.name, ...nameRefusal }));
   }
   if (props.validUntil !== undefined) {
     const untilRefusal = validUntilRefusal(props.validUntil);
     if (untilRefusal !== undefined) {
-      return yield* Effect21.fail(new PostgresRoleValidUntilRefused({
+      return yield* Effect22.fail(new PostgresRoleValidUntilRefused({
         role: props.name,
         value: props.validUntil,
         reason: untilRefusal.reason
@@ -1843,22 +2019,65 @@ var refuseAtPlan = (props) => Effect21.gen(function* () {
 // src/postgres/role-provider.ts
 import * as Provider4 from "alchemy/Provider";
 import { isResolved as isResolved5 } from "alchemy/Diff";
-import * as Effect28 from "effect/Effect";
+import * as Effect29 from "effect/Effect";
 
 // src/ownership/probe.ts
+import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
+import * as Effect26 from "effect/Effect";
+import * as Option4 from "effect/Option";
+
+// src/ownership/resume.ts
 import { Unowned as Unowned4 } from "alchemy/AdoptPolicy";
-import * as Effect24 from "effect/Effect";
+import { Artifacts } from "alchemy/Artifacts";
+import * as Effect23 from "effect/Effect";
+import * as Option from "effect/Option";
+var PROVEN = "homeflare/ownership/resumes";
+var UNFINISHED = "homeflare/ownership/unfinished";
+var note = (key, instanceId) => Effect23.gen(function* () {
+  const bag = yield* Effect23.serviceOption(Artifacts);
+  if (Option.isSome(bag))
+    yield* bag.value.set(key, instanceId);
+});
+var noted = (key, instanceId) => Effect23.gen(function* () {
+  const bag = yield* Effect23.serviceOption(Artifacts);
+  if (Option.isNone(bag))
+    return false;
+  return (yield* bag.value.get(key)) === instanceId;
+});
+var noteUnfinished = (instanceId) => Effect23.as(note(UNFINISHED, instanceId), undefined);
+var noteResume = (instanceId, recovered) => Effect23.gen(function* () {
+  yield* noteUnfinished(instanceId);
+  const unproven = () => Effect23.succeed(undefined);
+  const found = yield* recovered.pipe(Effect23.catch(unproven), Effect23.catchDefect(unproven));
+  if (found === undefined || found === null || Unowned4.is(found))
+    return;
+  yield* note(PROVEN, instanceId);
+});
+var resumes = (instanceId) => noted(PROVEN, instanceId);
+var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
+var provingResumes = (service) => {
+  const { diff, read } = service;
+  if (diff === undefined || read === undefined)
+    return service;
+  const proving = (input) => Effect23.gen(function* () {
+    if (input.output === undefined) {
+      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
+    }
+    return yield* diff(input);
+  });
+  return { ...service, diff: proving };
+};
 
 // src/ownership/rows.ts
 import { Stack as Stack2 } from "alchemy/Stack";
 import { State, isActionState } from "alchemy/State/State";
-import * as Effect23 from "effect/Effect";
-import * as Option2 from "effect/Option";
+import * as Effect25 from "effect/Effect";
+import * as Option3 from "effect/Option";
 
 // src/ownership/whole.ts
 import { Stack } from "alchemy/Stack";
-import * as Effect22 from "effect/Effect";
-import * as Option from "effect/Option";
+import * as Effect24 from "effect/Effect";
+import * as Option2 from "effect/Option";
 var absent = (value3) => value3 === undefined || value3 === null;
 var isPlainObject = (value3) => {
   if (typeof value3 !== "object" || value3 === null || Array.isArray(value3))
@@ -1883,22 +2102,22 @@ var carries = (declared, recorded) => {
   }
   return true;
 };
-var wholeDeclaration = (fqn, props) => Effect22.map(Effect22.serviceOption(Stack), (stack) => {
-  const declared = Option.isSome(stack) ? stack.value.resources[fqn] : undefined;
+var wholeDeclaration = (fqn, props) => Effect24.map(Effect24.serviceOption(Stack), (stack) => {
+  const declared = Option2.isSome(stack) ? stack.value.resources[fqn] : undefined;
   return declared !== undefined && carries(declared.Props, props);
 });
 
 // src/ownership/rows.ts
-var storeOf = Effect23.gen(function* () {
-  const stack = yield* Effect23.serviceOption(Stack2);
-  const state = yield* Effect23.serviceOption(State);
-  if (Option2.isNone(stack) || Option2.isNone(state))
+var storeOf = Effect25.gen(function* () {
+  const stack = yield* Effect25.serviceOption(Stack2);
+  const state = yield* Effect25.serviceOption(State);
+  if (Option3.isNone(stack) || Option3.isNone(state))
     return;
   const store = yield* state.value;
   const where = { stack: stack.value.name, stage: stack.value.stage };
   return { resources: stack.value.resources, store, where };
 });
-var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect23.orElseSucceed(() => {
+var rowAt = (store, where, fqn) => store.get({ ...where, fqn }).pipe(Effect25.orElseSucceed(() => {
   return;
 }));
 var generationOf = (row, instanceId) => {
@@ -1911,7 +2130,7 @@ var generationOf = (row, instanceId) => {
   }
   return;
 };
-var recordedGeneration = (fqn, instanceId) => Effect23.gen(function* () {
+var recordedGeneration = (fqn, instanceId) => Effect25.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1922,20 +2141,20 @@ var recordedGeneration = (fqn, instanceId) => Effect23.gen(function* () {
   }
   return;
 });
-var recordedInstance = (fqn, instanceId) => Effect23.gen(function* () {
+var recordedInstance = (fqn, instanceId) => Effect25.gen(function* () {
   const generation = yield* recordedGeneration(fqn, instanceId);
   if (generation === undefined)
     return "absent";
   return (yield* wholeDeclaration(fqn, generation.props)) ? "whole" : "partial";
 });
-var isCreate = (fqn, instanceId) => Effect23.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
+var isCreate = (fqn, instanceId) => Effect25.map(recordedGeneration(fqn, instanceId), (generation) => generation?.status === "creating");
 var idOf = (attr) => {
   if (typeof attr !== "object" || attr === null)
     return;
   const id = attr.id;
   return typeof id === "string" && id !== "" ? id : undefined;
 };
-var olderGenerationIds = (fqn, instanceId) => Effect23.gen(function* () {
+var olderGenerationIds = (fqn, instanceId) => Effect25.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return [];
@@ -1963,7 +2182,7 @@ var collectOlder = (row, instanceId, ids) => {
     at = generation.old;
   }
 };
-var forgetRefusedCreate = (fqn, instanceId) => Effect23.gen(function* () {
+var forgetRefusedCreate = (fqn, instanceId) => Effect25.gen(function* () {
   const found = yield* storeOf;
   if (found === undefined)
     return;
@@ -1972,97 +2191,75 @@ var forgetRefusedCreate = (fqn, instanceId) => Effect23.gen(function* () {
   if (mine?.status !== "creating" || mine.instanceId !== instanceId || mine.attr !== undefined) {
     return;
   }
-  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect23.ignore);
+  yield* found.store.delete({ ...found.where, fqn }).pipe(Effect25.ignore);
 });
 
 // src/ownership/probe.ts
-var provenOurs = (ask, settled) => Effect24.gen(function* () {
+var inApplyResource = (span) => {
+  let at = span;
+  while (at !== undefined && at._tag === "Span") {
+    if (at.name === "apply.resource")
+      return true;
+    at = Option4.getOrUndefined(at.parent);
+  }
+  return false;
+};
+var isCreatesRead = (span) => {
+  const current = Option4.getOrUndefined(span);
+  return current?.name === "provider.read" && inApplyResource(current);
+};
+var readsAtApply = Effect26.map(Effect26.option(Effect26.currentSpan), isCreatesRead);
+var provenOurs = (ask, settled) => Effect26.gen(function* () {
+  if (yield* readsAtApply)
+    return yield* resumes(ask.instanceId);
   const recorded = yield* recordedInstance(ask.fqn, ask.instanceId);
   if (recorded === "absent")
     return false;
   if (recorded === "partial") {
-    yield* Effect24.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
+    yield* Effect26.logWarning(`${ask.fqn}: the interrupted create's state row lacks part of the declaration (a prop ` + "was still an Output when it was written), so the live object is not proven ours");
     return false;
   }
-  const unproven = (reason) => Effect24.as(Effect24.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
-  return yield* settled.pipe(Effect24.catch(unproven), Effect24.catchDefect(unproven));
+  const unproven = (reason) => Effect26.as(Effect26.logWarning(`${ask.fqn}: the interrupted create's object could not be compared with its props ` + `(${reason instanceof Error ? reason.message : String(reason)}), so it is not treated as ours`), false);
+  return yield* settled.pipe(Effect26.catch(unproven), Effect26.catchDefect(unproven));
 });
-var ownedRead = (ask, found, settled) => Effect24.gen(function* () {
+var ownedRead = (ask, found, settled) => Effect26.gen(function* () {
   if (found === undefined || ask.output !== undefined)
     return found;
-  return (yield* provenOurs(ask, settled)) ? found : Unowned4(found);
-});
-
-// src/ownership/resume.ts
-import { Unowned as Unowned5 } from "alchemy/AdoptPolicy";
-import { Artifacts } from "alchemy/Artifacts";
-import * as Effect25 from "effect/Effect";
-import * as Option3 from "effect/Option";
-var PROVEN = "homeflare/ownership/resumes";
-var UNFINISHED = "homeflare/ownership/unfinished";
-var note = (key, instanceId) => Effect25.gen(function* () {
-  const bag = yield* Effect25.serviceOption(Artifacts);
-  if (Option3.isSome(bag))
-    yield* bag.value.set(key, instanceId);
-});
-var noted = (key, instanceId) => Effect25.gen(function* () {
-  const bag = yield* Effect25.serviceOption(Artifacts);
-  if (Option3.isNone(bag))
-    return false;
-  return (yield* bag.value.get(key)) === instanceId;
-});
-var noteUnfinished = (instanceId) => Effect25.as(note(UNFINISHED, instanceId), undefined);
-var noteResume = (instanceId, recovered) => Effect25.gen(function* () {
-  yield* noteUnfinished(instanceId);
-  const unproven = () => Effect25.succeed(undefined);
-  const found = yield* recovered.pipe(Effect25.catch(unproven), Effect25.catchDefect(unproven));
-  if (found === undefined || found === null || Unowned5.is(found))
-    return;
-  yield* note(PROVEN, instanceId);
+  if (yield* provenOurs(ask, settled))
+    return found;
+  if (yield* readsAtApply)
+    yield* forgetRefusedCreate(ask.fqn, ask.instanceId);
+  return Unowned5(found);
 });
-var resumes = (instanceId) => noted(PROVEN, instanceId);
-var unfinished = (instanceId) => noted(UNFINISHED, instanceId);
-var provingResumes = (service) => {
-  const { diff, read } = service;
-  if (diff === undefined || read === undefined)
-    return service;
-  const proving = (input) => Effect25.gen(function* () {
-    if (input.output === undefined) {
-      yield* noteResume(input.instanceId, read({ ...input, output: undefined }));
-    }
-    return yield* diff(input);
-  });
-  return { ...service, diff: proving };
-};
 
 // src/ownership/adopt.ts
 import { AdoptPolicy } from "alchemy/AdoptPolicy";
 import { AlchemyContext } from "alchemy/AlchemyContext";
 import { Stack as Stack3 } from "alchemy/Stack";
-import * as Effect26 from "effect/Effect";
-import * as Option4 from "effect/Option";
-var adoptEnabled = (fqn) => Effect26.gen(function* () {
-  const stack = yield* Effect26.serviceOption(Stack3);
-  const scoped = Option4.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
-  if (scoped !== undefined)
-    return scoped;
-  const policy = yield* Effect26.serviceOption(AdoptPolicy);
-  if (Option4.isSome(policy))
+import * as Effect27 from "effect/Effect";
+import * as Option5 from "effect/Option";
+var adoptEnabled = (fqn) => Effect27.gen(function* () {
+  const stack = yield* Effect27.serviceOption(Stack3);
+  const scoped2 = Option5.isSome(stack) ? stack.value.resources[fqn]?.Adopt : undefined;
+  if (scoped2 !== undefined)
+    return scoped2;
+  const policy = yield* Effect27.serviceOption(AdoptPolicy);
+  if (Option5.isSome(policy))
     return policy.value;
-  const context = yield* Effect26.serviceOption(AlchemyContext);
-  return Option4.isSome(context) ? context.value.adopt : false;
+  const context = yield* Effect27.serviceOption(AlchemyContext);
+  return Option5.isSome(context) ? context.value.adopt : false;
 });
-var adoptable = (owner) => Effect26.gen(function* () {
+var adoptable = (owner) => Effect27.gen(function* () {
   if (yield* isCreate(owner.fqn, owner.instanceId))
     return true;
   return yield* unfinished(owner.instanceId);
 });
-var adoptsAtApply = (owner) => Effect26.gen(function* () {
+var adoptsAtApply = (owner) => Effect27.gen(function* () {
   if (!(yield* adoptEnabled(owner.fqn)))
     return false;
   return yield* adoptable(owner);
 });
-var refuseTakeover = (owner, what) => Effect26.gen(function* () {
+var refuseTakeover = (owner, what) => Effect27.gen(function* () {
   if (owner.output !== undefined)
     return;
   if (yield* resumes(owner.instanceId))
@@ -2072,23 +2269,23 @@ var refuseTakeover = (owner, what) => Effect26.gen(function* () {
     return;
   yield* forgetRefusedCreate(owner.fqn, owner.instanceId);
   const remedy = may ? "Deploy with --adopt (or wrap the resource in adopt(true)) to take it over, or remove it first." : "It is the new identity of a replace, which --adopt does not cover: remove it first.";
-  return yield* Effect26.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
+  return yield* Effect27.die(new Error(`${what}: already exists, and this stack holds no state for it — the plan could not ask ` + "first (a prop was still an Output, a replace moved onto it, or it appeared after the " + `plan). Nothing was written. ${remedy}`));
 });
 var claimFor = (owner) => (what) => refuseTakeover(owner, what);
 
 // src/postgres/role-diff.ts
 import { isResolved as isResolved4 } from "alchemy/Diff";
-import * as Effect27 from "effect/Effect";
-var diffPostgresRole = (news, output, env = process.env, observation) => Effect27.gen(function* () {
+import * as Effect28 from "effect/Effect";
+var diffPostgresRole = (news, output, env = process.env, observation) => Effect28.gen(function* () {
   if (output === undefined || !isResolved4(news))
     return;
   if (news.name !== output.name) {
-    return yield* Effect27.fail(new PostgresRoleRenameRefused({ from: output.name, to: news.name }));
+    return yield* Effect28.fail(new PostgresRoleRenameRefused({ from: output.name, to: news.name }));
   }
   yield* refuseAtPlan(news);
   const live = observation?.found;
   if (live !== undefined && live.oid !== output.oid) {
-    return yield* Effect27.fail(new PostgresRoleIdentityRefused({
+    return yield* Effect28.fail(new PostgresRoleIdentityRefused({
       role: output.name,
       storedOid: output.oid,
       liveOid: live.oid
@@ -2107,15 +2304,15 @@ var diffPostgresRole = (news, output, env = process.env, observation) => Effect2
 
 // src/postgres/role-provider.ts
 var postgresRoleHandlers = PostgresRole.Provider.of({
-  list: () => Effect28.succeed([]),
+  list: () => Effect29.succeed([]),
   nuke: { skip: true },
-  read: ({ fqn, instanceId, olds, output }) => Effect28.gen(function* () {
+  read: ({ fqn, instanceId, olds, output }) => Effect29.gen(function* () {
     const name = output?.name ?? olds.name;
     const live = yield* withPg((pg) => readRole(pg, name));
     if (live === undefined)
       return;
     if (output !== undefined && live.oid !== output.oid) {
-      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
+      return yield* Effect29.fail(new PostgresRoleIdentityRefused({
         role: name,
         storedOid: output.oid,
         liveOid: live.oid
@@ -2123,9 +2320,9 @@ var postgresRoleHandlers = PostgresRole.Provider.of({
     }
     const passwordSeal = output?.passwordSeal ?? "";
     const found = { ...storedAttributes(live), passwordSeal };
-    return yield* ownedRead({ fqn, instanceId, output }, found, Effect28.succeed(declarationMatches(olds, live)));
+    return yield* ownedRead({ fqn, instanceId, output }, found, Effect29.succeed(declarationMatches(olds, live)));
   }),
-  diff: ({ news, output, instanceId }) => Effect28.gen(function* () {
+  diff: ({ news, output, instanceId }) => Effect29.gen(function* () {
     if (output === undefined)
       return yield* noteUnfinished(instanceId);
     if (!isResolved5(news))
@@ -2133,9 +2330,9 @@ var postgresRoleHandlers = PostgresRole.Provider.of({
     const found = yield* withPg((pg) => readRole(pg, output.name));
     return yield* diffPostgresRole(news, output, process.env, { found });
   }),
-  reconcile: ({ fqn, instanceId, news, output }) => Effect28.gen(function* () {
+  reconcile: ({ fqn, instanceId, news, output }) => Effect29.gen(function* () {
     yield* refuseAtPlan(news);
-    return yield* withPg((pg) => Effect28.gen(function* () {
+    return yield* withPg((pg) => Effect29.gen(function* () {
       const observed = yield* readRole(pg, news.name);
       if (observed !== undefined && output === undefined) {
         yield* refuseTakeover({ fqn, instanceId, output }, "Postgres.Role");
@@ -2143,20 +2340,20 @@ var postgresRoleHandlers = PostgresRole.Provider.of({
       return yield* reconcileWithClient4(pg, news, process.env, output?.passwordSeal, output?.oid);
     }));
   }),
-  delete: ({ output }) => withPg((pg) => Effect28.gen(function* () {
+  delete: ({ output }) => withPg((pg) => Effect29.gen(function* () {
     if (output === undefined)
       return;
     const live = yield* readRole(pg, output.name);
     if (live === undefined)
       return;
     if (live.oid !== output.oid) {
-      return yield* Effect28.fail(new PostgresRoleIdentityRefused({
+      return yield* Effect29.fail(new PostgresRoleIdentityRefused({
         role: output.name,
         storedOid: output.oid,
         liveOid: live.oid
       }));
     }
-    yield* pg.unsafe(buildDropRoleSql(output.name)).pipe(Effect28.asVoid);
+    yield* pg.unsafe(buildDropRoleSql(output.name)).pipe(Effect29.asVoid);
   }))
 });
 var PostgresRoleProvider = () => Provider4.succeed(PostgresRole, postgresRoleHandlers);
@@ -2203,6 +2400,8 @@ export {
   PostgresRoleRenameRefused,
   PostgresRoleValidUntilRefused,
   PostgresSchema,
+  PostgresSchemaCascadeCrossSchemaRefused,
+  PostgresSchemaCascadeSequencesRefused,
   PostgresSchemaCreateVanished,
   PostgresSchemaDatabaseRefused,
   PostgresSchemaDeleteForeignRefused,
@@ -2281,5 +2480,5 @@ export {
   withPg
 };
 
-//# debugId=584CB763916085BE64756E2164756E21
+//# debugId=DBF1833AF422AC3264756E2164756E21
 //# sourceMappingURL=index.js.map