@homeflare/alchemy 0.23.0 → 0.25.0

package/src/postgres/database-bigint-serialization.test.ts

@@ -0,0 +1,140 @@
+/**
+ * Regression for the critical finding: `SELECT_DATABASE_SQL` casting `oid`/`datconnlimit` to
+ * `::int8` makes `@effect/sql-pg`'s binary-protocol codec decode them as JS `bigint`, and
+ * alchemy's `encodeState` has no `bigint` branch — so `JSON.stringify`ing the persisted state
+ * throws on every successful `reconcile`, and a matching declared `connectionLimit` reads as
+ * permanent drift (`bigint !== number`).
+ *
+ * ⛔ THIS DOES NOT HIT A LIVE SOCKET. It stays faithful to the real defect by driving the exact
+ *   query TEXT `selectDatabase` sends (`fake-sql.ts`'s recorder does not decode types at all, so
+ *   it cannot see this bug) through `@effect/sql-pg/PgTypes`'s own public `encode`/`decode`
+ *   (the same codec table the real driver looks up by OID — measured `PgTypes.ts@4.0.0-rc.115`)
+ *   and through alchemy's own `encodeState` (`alchemy/State/StateEncoding`, what `LocalState.js`
+ *   calls before every `JSON.stringify`). If a column is cast to `::int8` in the production SQL,
+ *   this fake decodes it exactly as the real wire would: a genuine `bigint`, round-tripped
+ *   through the vendor's own codec, not a hand-simulated one.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import * as Result from 'effect/Result';
+import * as PgTypes from '@effect/sql-pg/PgTypes';
+import type { SqlError } from 'effect/unstable/sql/SqlError';
+import { encodeState } from 'alchemy/State/StateEncoding';
+import { reconcileWithClient } from './database.ts';
+import { PostgresDatabaseDrift } from './errors.ts';
+import type { PostgresDatabaseProps } from './database-attrs.ts';
+import type { PgExecutor } from './database-sql.ts';
+
+/** Round-trip `value` through the real `@effect/sql-pg` codec for `oid` — encode, then decode
+ * the resulting wire bytes back — so the JS type this returns is whatever the real driver would
+ * hand back for that OID, not an assumption about it. */
+const wireRoundtrip = (value: number, oid: number): number | bigint => {
+  const encoded = PgTypes.encode(oid === PgTypes.OID.int8 ? BigInt(value) : value, oid);
+  if (!Result.isSuccess(encoded)) throw new Error(`fixture: encode failed for OID ${String(oid)}`);
+  const decoded = PgTypes.decode(encoded.success, oid, 1);
+  if (!Result.isSuccess(decoded)) throw new Error(`fixture: decode failed for OID ${String(oid)}`);
+  return decoded.success as number | bigint;
+};
+
+const baseRow = {
+  name: 'widgets',
+  owner: 'tim',
+  encoding: 'UTF8',
+  localeProvider: 'libc',
+  collate: 'C',
+  ctype: 'C',
+  allowConnections: true,
+  isTemplate: false,
+  tablespace: 'pg_default',
+};
+
+/** A `pg_database` row decoded exactly as the production `SELECT_DATABASE_SQL` TEXT dictates:
+ * `oid`/`connectionLimit` come back as `bigint` only when that text casts them to `::int8` —
+ * the same condition that flips the real driver's codec lookup. */
+const wireAccurateRow = (text: string, oid: number, connectionLimit: number) => ({
+  ...baseRow,
+  oid: wireRoundtrip(oid, text.includes('d.oid::int8 AS oid') ? PgTypes.OID.int8 : PgTypes.OID.oid),
+  connectionLimit: wireRoundtrip(
+    connectionLimit,
+    text.includes('d.datconnlimit::int8 AS "connectionLimit"')
+      ? PgTypes.OID.int8
+      : PgTypes.OID.int4,
+  ),
+});
+
+/** A `PgExecutor` that answers `SELECT_DATABASE_SQL` with a wire-accurate row (see above) and
+ * every other statement the way `fake-sql.ts`'s own fake does. `seed`, when given, is the row
+ * already "on the cluster" — so `reconcileWithClient` takes the already-present/drift-check
+ * branch instead of create. With no seed, a `CREATE DATABASE` statement makes one up (oid
+ * 30000, the default `connectionLimit` of -1) so the mandatory post-create re-read has a row to
+ * decode — mirroring `fake-sql.ts`'s own greenfield bookkeeping. */
+const wireAccuratePg = (seed?: {
+  readonly oid: number;
+  readonly connectionLimit: number;
+}): PgExecutor => {
+  let created: { readonly oid: number; readonly connectionLimit: number } | undefined = seed;
+  return {
+    unsafe: <A extends object>(text: string, params: ReadonlyArray<unknown> = []) =>
+      Effect.suspend(() => {
+        if (text.startsWith('SELECT 1 AS present FROM pg_roles')) {
+          return Effect.succeed([{ present: 1 }] as unknown as ReadonlyArray<A>);
+        }
+        if (text.includes('FROM pg_database')) {
+          if (created === undefined) return Effect.succeed([] as unknown as ReadonlyArray<A>);
+          const row = wireAccurateRow(text, created.oid, created.connectionLimit);
+          return Effect.succeed([row] as unknown as ReadonlyArray<A>);
+        }
+        if (text.startsWith('CREATE DATABASE')) {
+          created = { oid: 30000, connectionLimit: -1 };
+          return Effect.succeed([] as unknown as ReadonlyArray<A>);
+        }
+        throw new Error(`wireAccuratePg: unrecognised statement: ${text}`);
+      }) as Effect.Effect<ReadonlyArray<A>, SqlError>,
+  };
+};
+
+const baseProps: PostgresDatabaseProps = { name: 'widgets', owner: 'tim' };
+
+describe('measured: @effect/sql-pg int8 vs native-width codecs (PgTypes.ts@4.0.0-rc.115)', () => {
+  test('OID.int8 decodes to a JS bigint', () => {
+    expect(typeof wireRoundtrip(20000, PgTypes.OID.int8)).toBe('bigint');
+  });
+
+  test('OID.oid and OID.int4 — the columns’ real pg_database.h widths — decode to a JS number', () => {
+    expect(typeof wireRoundtrip(20000, PgTypes.OID.oid)).toBe('number');
+    expect(typeof wireRoundtrip(-1, PgTypes.OID.int4)).toBe('number');
+  });
+});
+
+describe('reconcileWithClient: state must survive alchemy’s real encodeState + JSON.stringify', () => {
+  test('greenfield create-and-reread never returns a value the state encoder cannot serialize', async () => {
+    const pg = wireAccuratePg();
+    const attrs = await Effect.runPromise(reconcileWithClient(pg, baseProps));
+
+    expect(typeof attrs.oid).toBe('number');
+    expect(typeof attrs.connectionLimit).toBe('number');
+
+    let json: string | undefined;
+    expect(() => {
+      json = JSON.stringify(encodeState(attrs), null, 2);
+    }).not.toThrow();
+    expect(JSON.parse(json as string)).toMatchObject({ oid: attrs.oid, connectionLimit: -1 });
+  });
+
+  test('a declared connectionLimit that matches the live value is a no-op, not a false-positive drift', async () => {
+    const pg = wireAccuratePg({ oid: 30000, connectionLimit: 5 });
+    const attrs = await Effect.runPromise(
+      reconcileWithClient(pg, { ...baseProps, connectionLimit: 5 }),
+    );
+    expect(attrs.connectionLimit).toBe(5);
+  });
+
+  test('PostgresDatabaseDrift.message never throws building itself, even when a mismatch is real', async () => {
+    const pg = wireAccuratePg({ oid: 30000, connectionLimit: 5 });
+    const error = await Effect.runPromise(
+      Effect.flip(reconcileWithClient(pg, { ...baseProps, connectionLimit: 10 })),
+    );
+    expect(error).toBeInstanceOf(PostgresDatabaseDrift);
+    expect(() => (error as PostgresDatabaseDrift).message).not.toThrow();
+  });
+});

package/src/postgres/database-lifecycle.test.ts

@@ -0,0 +1,113 @@
+/**
+ * `reconcile` and `read` against `fake-sql.ts`'s recording fake — greenfield, no-drift, drift,
+ * a `42P04` race, a missing owner role, and exact quoting for hostile names. Every case reverts
+ * cleanly by reverting `database.ts`/`database-sql.ts` locally: these tests fail on `origin/main`
+ * because the files do not exist there.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeSql } from './fake-sql.ts';
+import { readWithClient, reconcileWithClient } from './database.ts';
+import { PostgresDatabaseDrift, PostgresDatabaseOwnerMissing } from './errors.ts';
+import type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> => Effect.runPromise(Effect.flip(eff));
+
+const baseProps: PostgresDatabaseProps = { name: 'widgets', owner: 'tim' };
+
+const liveRow = (over: Partial<PostgresDatabaseAttributes> = {}): PostgresDatabaseAttributes => ({
+  name: 'widgets',
+  oid: 30000,
+  owner: 'tim',
+  encoding: 'UTF8',
+  localeProvider: 'libc',
+  collate: 'C',
+  ctype: 'C',
+  allowConnections: true,
+  connectionLimit: -1,
+  isTemplate: false,
+  tablespace: 'pg_default',
+  ...over,
+});
+
+describe('reconcile: greenfield', () => {
+  test('issues exactly one CREATE, quoted, with an OWNER clause, and nothing before the role check', async () => {
+    const fake = makeFakeSql({ roles: ['tim'] });
+    const attrs = await run(reconcileWithClient(fake, baseProps));
+    expect(attrs.name).toBe('widgets');
+    expect(attrs.owner).toBe('tim');
+    const creates = fake.statements.filter((s) => s.text.startsWith('CREATE DATABASE'));
+    expect(creates.length).toBe(1);
+    expect(creates[0]?.text).toBe('CREATE DATABASE "widgets" WITH OWNER "tim"');
+  });
+
+  test('refuses before any CREATE when the owner role does not exist', async () => {
+    const fake = makeFakeSql({ roles: [] });
+    const error = await fails(reconcileWithClient(fake, baseProps));
+    expect(error).toBeInstanceOf(PostgresDatabaseOwnerMissing);
+    expect(fake.statements.some((s) => s.text.startsWith('CREATE DATABASE'))).toBe(false);
+  });
+
+  test('a 42P04 race (something else created it first) converges instead of failing', async () => {
+    const fake = makeFakeSql({ roles: ['tim'], raceNextCreate: true });
+    // Seed the row a "competing" create would have produced, so the post-race re-read finds it.
+    fake.databases.set('widgets', liveRow());
+    const attrs = await run(reconcileWithClient(fake, baseProps));
+    expect(attrs.name).toBe('widgets');
+  });
+
+  test('hostile names are quoted exactly: embedded quote and a hyphen', async () => {
+    const fake = makeFakeSql({ roles: ['tim'] });
+    await run(reconcileWithClient(fake, { name: 'a"b-c', owner: 'tim' }));
+    const create = fake.statements.find((s) => s.text.startsWith('CREATE DATABASE'));
+    expect(create?.text).toBe('CREATE DATABASE "a""b-c" WITH OWNER "tim"');
+  });
+});
+
+describe('reconcile: already present', () => {
+  test('no drift records zero write statements', async () => {
+    const fake = makeFakeSql({ roles: ['tim'], databases: [liveRow()] });
+    const attrs = await run(reconcileWithClient(fake, baseProps));
+    expect(attrs).toEqual(liveRow());
+    expect(
+      fake.statements.every((s) => !s.text.startsWith('CREATE') && !s.text.startsWith('ALTER')),
+    ).toBe(true);
+  });
+
+  test('an owner mismatch fails with the typed drift tag and issues no ALTER', async () => {
+    const fake = makeFakeSql({
+      roles: ['tim', 'someone-else'],
+      databases: [liveRow({ owner: 'someone-else' })],
+    });
+    const error = await fails(reconcileWithClient(fake, baseProps));
+    expect(error).toBeInstanceOf(PostgresDatabaseDrift);
+    expect((error as PostgresDatabaseDrift).prop).toBe('owner');
+    expect(fake.statements.some((s) => s.text.startsWith('ALTER'))).toBe(false);
+  });
+
+  test('an asserted-prop mismatch fails with the typed drift tag naming that prop', async () => {
+    const fake = makeFakeSql({ roles: ['tim'], databases: [liveRow({ isTemplate: true })] });
+    const error = await fails(reconcileWithClient(fake, { ...baseProps, isTemplate: false }));
+    expect(error).toBeInstanceOf(PostgresDatabaseDrift);
+    expect((error as PostgresDatabaseDrift).prop).toBe('isTemplate');
+  });
+
+  test('no recorded statement ever runs inside BEGIN', async () => {
+    const fake = makeFakeSql({ roles: ['tim'], databases: [liveRow()] });
+    await run(reconcileWithClient(fake, baseProps));
+    expect(fake.statements.some((s) => /\bBEGIN\b/.test(s.text))).toBe(false);
+  });
+});
+
+describe('read', () => {
+  test('answers undefined when the database is absent', async () => {
+    const fake = makeFakeSql();
+    expect(await run(readWithClient(fake, 'widgets'))).toBeUndefined();
+  });
+
+  test("answers the live row when present (ownership branding is the caller's job)", async () => {
+    const fake = makeFakeSql({ databases: [liveRow()] });
+    expect(await run(readWithClient(fake, 'widgets'))).toEqual(liveRow());
+  });
+});

package/src/postgres/database-provenance.test.ts

@@ -0,0 +1,118 @@
+/**
+ * Provenance: every `PostgresDatabaseProps` field traces to a real `CREATE DATABASE` synopsis
+ * option AND a real `pg_database` column, and every synopsis option this family does NOT expose
+ * as a prop is named with a reason. Both fixtures are parsed, not eyeballed — deleting a fixture
+ * line, or adding a prop with no mapping, fails this file (S38, the house's provenance rule).
+ */
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import { join } from 'node:path';
+
+const FIXTURES = join(import.meta.dir, 'fixtures');
+const synopsis = readFileSync(join(FIXTURES, 'pg-REL_18_6-create-database-synopsis.txt'), 'utf8');
+const struct = readFileSync(join(FIXTURES, 'pg-REL_18_6-pg_database.h.txt'), 'utf8');
+
+const SYNOPSIS_BLOB = '4da8aeebb50a29e89bd9f68a8deac4b1a3ec7b18';
+const STRUCT_BLOB = '54f0d38c9c9e1cd4d419b05b296b8f84875e9768';
+
+const synopsisOptions = (): readonly string[] => {
+  const re = /\[\s*([A-Z][A-Z_ ]*?)\s*(?:\[=\]|=)\s*<replaceable/g;
+  const found: string[] = [];
+  for (const m of synopsis.matchAll(re)) found.push(m[1] as string);
+  return found;
+};
+
+const structColumns = (): readonly string[] => {
+  const re = /^\t[A-Za-z_][A-Za-z0-9_]*\s+(\w+)(?:\[\d+\])?\b/;
+  const found: string[] = [];
+  for (const line of struct.split('\n')) {
+    const m = re.exec(line);
+    if (m !== null) found.push(m[1] as string);
+  }
+  return found;
+};
+
+/** Every asserted prop except `name`, which is the mandatory `CREATE DATABASE <name>` token, not
+ * a bracketed `WITH` option — checked separately below. */
+const PROP_MAPPING: Readonly<Record<string, { readonly option: string; readonly column: string }>> =
+  {
+    owner: { option: 'OWNER', column: 'datdba' },
+    encoding: { option: 'ENCODING', column: 'encoding' },
+    localeProvider: { option: 'LOCALE_PROVIDER', column: 'datlocprovider' },
+    lcCollate: { option: 'LC_COLLATE', column: 'datcollate' },
+    lcCtype: { option: 'LC_CTYPE', column: 'datctype' },
+    allowConnections: { option: 'ALLOW_CONNECTIONS', column: 'datallowconn' },
+    connectionLimit: { option: 'CONNECTION LIMIT', column: 'datconnlimit' },
+    isTemplate: { option: 'IS_TEMPLATE', column: 'datistemplate' },
+    tablespace: { option: 'TABLESPACE', column: 'dattablespace' },
+  };
+
+/** Every synopsis option this family does NOT declare as a prop, and why. */
+const EXCLUDED: Readonly<Record<string, string>> = {
+  TEMPLATE: 'consumed only at create time to copy from; pg_database has no column recording it',
+  STRATEGY: 'consumed only at create time (WAL_LOG vs FILE_COPY copy method); not stored',
+  LOCALE:
+    'a shorthand that sets LC_COLLATE/LC_CTYPE (or BUILTIN_LOCALE); this family declares lcCollate/lcCtype directly instead',
+  BUILTIN_LOCALE:
+    "only meaningful when localeProvider='builtin'; folds into datcollate/datctype like LOCALE, no column of its own",
+  ICU_LOCALE:
+    "only meaningful when localeProvider='icu' (datlocale column exists); deferred — measured 2026-09-23, all 24 live databases are locale provider 'c' (libc)",
+  ICU_RULES:
+    'stored in daticurules, but this family has no ICU-provider consumer yet (see ICU_LOCALE)',
+  COLLATION_VERSION:
+    'intended for pg_upgrade only; normally omitted so PostgreSQL computes it from the OS',
+  OID: 'primarily for pg_upgrade\'s internal use (docs: "only pg_upgrade can specify a value less than 16384"); not something a stack should assert',
+};
+
+describe('postgres provenance', () => {
+  test('fixture headers name the measured blob shas', () => {
+    expect(synopsis).toContain(SYNOPSIS_BLOB);
+    expect(synopsis).toContain('doc/src/sgml/ref/create_database.sgml');
+    expect(struct).toContain(STRUCT_BLOB);
+    expect(struct).toContain('src/include/catalog/pg_database.h');
+  });
+
+  test('the name token is documented and backed by datname', () => {
+    expect(synopsis).toContain('CREATE DATABASE <replaceable class="parameter">name</replaceable>');
+    expect(structColumns()).toContain('datname');
+  });
+
+  test('every declared prop maps to a real synopsis option', () => {
+    const options = synopsisOptions();
+    for (const [prop, { option }] of Object.entries(PROP_MAPPING)) {
+      expect(options, `prop "${prop}" claims synopsis option "${option}"`).toContain(option);
+    }
+  });
+
+  test('every declared prop maps to a real pg_database column', () => {
+    const columns = structColumns();
+    for (const [prop, { column }] of Object.entries(PROP_MAPPING)) {
+      expect(columns, `prop "${prop}" claims column "${column}"`).toContain(column);
+    }
+  });
+
+  test('every synopsis option is either a declared prop or a documented exclusion', () => {
+    const declaredOptions = new Set(Object.values(PROP_MAPPING).map((m) => m.option));
+    for (const option of synopsisOptions()) {
+      const accounted = declaredOptions.has(option) || option in EXCLUDED;
+      expect(accounted, `synopsis option "${option}" is neither a prop nor in EXCLUDED`).toBe(true);
+    }
+  });
+
+  test('no excluded option is silently also a declared prop', () => {
+    const declaredOptions = new Set(Object.values(PROP_MAPPING).map((m) => m.option));
+    for (const option of Object.keys(EXCLUDED)) {
+      expect(declaredOptions.has(option), `"${option}" is both excluded and declared`).toBe(false);
+    }
+  });
+
+  test('every excluded option actually exists in the synopsis (no stale entries)', () => {
+    const options = new Set(synopsisOptions());
+    for (const option of Object.keys(EXCLUDED)) {
+      expect(
+        options.has(option),
+        `EXCLUDED names "${option}", which the synopsis no longer has`,
+      ).toBe(true);
+    }
+  });
+});

package/src/postgres/database-refusals.test.ts

@@ -0,0 +1,135 @@
+/**
+ * Every plan-time refusal, checked without a client: name-byte precision, identifier and string
+ * quoting, the rename refusal, a full sweep proving `diff` never answers `replace`, and `delete`.
+ */
+import { describe, expect, test } from 'bun:test';
+import { readFileSync } from 'node:fs';
+import * as Effect from 'effect/Effect';
+import { POSTGRES_NAME_MAX_BYTES, nameByteRefusal, utf8ByteLength } from './database-attrs.ts';
+import { buildCreateDatabaseSql, quoteIdent, quoteStringLiteral } from './database-sql.ts';
+import { diffPostgresDatabase, postgresDatabaseHandlers } from './database.ts';
+import { PostgresDatabaseDropRefused, PostgresDatabaseRenameRefused } from './errors.ts';
+import type { PostgresDatabaseAttributes, PostgresDatabaseProps } from './database-attrs.ts';
+
+describe('name byte length', () => {
+  test('a 63-byte ASCII name is accepted', () => {
+    const name = 'a'.repeat(63);
+    expect(utf8ByteLength(name)).toBe(63);
+    expect(nameByteRefusal(name)).toBeUndefined();
+  });
+
+  test('a 64-byte ASCII name is refused', () => {
+    const name = 'a'.repeat(64);
+    const refusal = nameByteRefusal(name);
+    expect(refusal).toEqual({ byteLength: 64, limit: POSTGRES_NAME_MAX_BYTES });
+  });
+
+  test('a 63-byte multibyte name (21 three-byte characters) is accepted, though .length is 21', () => {
+    // U+4E2D ("中") is 3 UTF-8 bytes. 21 * 3 = 63 bytes exactly — the last size that survives.
+    const name = '中'.repeat(21);
+    expect(name.length).toBe(21);
+    expect(utf8ByteLength(name)).toBe(63);
+    expect(nameByteRefusal(name)).toBeUndefined();
+  });
+
+  test('one more multibyte character (64 bytes) is refused', () => {
+    const name = `${'中'.repeat(21)}a`;
+    expect(utf8ByteLength(name)).toBe(64);
+    expect(nameByteRefusal(name)).toEqual({ byteLength: 64, limit: POSTGRES_NAME_MAX_BYTES });
+  });
+});
+
+describe('quoting', () => {
+  test('quoteIdent doubles an embedded double quote and leaves a hyphen alone', () => {
+    expect(quoteIdent('a"b-c')).toBe('"a""b-c"');
+  });
+
+  test('quoteIdent does not split a dot the way a qualified-name escaper would', () => {
+    // The hazard this file exists to avoid — see database-sql.ts's header.
+    expect(quoteIdent('my.app')).toBe('"my.app"');
+  });
+
+  test('quoteStringLiteral doubles an embedded single quote', () => {
+    expect(quoteStringLiteral("en_US.UTF-8'; DROP")).toBe("'en_US.UTF-8''; DROP'");
+  });
+
+  test('buildCreateDatabaseSql never string-concatenates an unescaped value', () => {
+    const sql = buildCreateDatabaseSql({ name: 'db"1', owner: 'ro"le', encoding: "UT'F8" });
+    expect(sql).toBe('CREATE DATABASE "db""1" WITH OWNER "ro""le" ENCODING \'UT\'\'F8\'');
+  });
+});
+
+const sampleOutput: PostgresDatabaseAttributes = {
+  name: 'widgets',
+  oid: 1,
+  owner: 'tim',
+  encoding: 'UTF8',
+  localeProvider: 'libc',
+  collate: 'C',
+  ctype: 'C',
+  allowConnections: true,
+  connectionLimit: -1,
+  isTemplate: false,
+  tablespace: 'pg_default',
+};
+const base: PostgresDatabaseProps = { name: 'widgets', owner: 'tim' };
+
+describe('diff', () => {
+  const output = sampleOutput;
+
+  test('a rename is refused at plan, before reconcile ever runs', async () => {
+    const error = await Effect.runPromise(
+      Effect.flip(diffPostgresDatabase({ ...base, name: 'gadgets' }, output)),
+    );
+    expect(error).toBeInstanceOf(PostgresDatabaseRenameRefused);
+  });
+
+  test('an unchanged declaration answers noop', async () => {
+    const result = await Effect.runPromise(diffPostgresDatabase(base, output));
+    expect(result).toEqual({ action: 'noop' });
+  });
+
+  test('a change in any single prop answers update, and NEVER replace — swept across every prop', async () => {
+    const variants: ReadonlyArray<Partial<PostgresDatabaseProps>> = [
+      { owner: 'someone-else' },
+      { encoding: 'LATIN1' },
+      { localeProvider: 'icu' },
+      { lcCollate: 'en_US.UTF-8' },
+      { lcCtype: 'en_US.UTF-8' },
+      { allowConnections: false },
+      { connectionLimit: 5 },
+      { isTemplate: true },
+      { tablespace: 'fast_ssd' },
+    ];
+    for (const variant of variants) {
+      const result = await Effect.runPromise(diffPostgresDatabase({ ...base, ...variant }, output));
+      expect(result?.action, `variant ${JSON.stringify(variant)}`).toBe('update');
+      expect(result).not.toEqual({ action: 'replace' });
+    }
+  });
+});
+
+describe('delete', () => {
+  test('the real handler refuses with PostgresDatabaseDropRefused naming the database', async () => {
+    const error = await Effect.runPromise(
+      Effect.flip(
+        postgresDatabaseHandlers.delete({
+          id: 'x',
+          fqn: 'x',
+          instanceId: 'x',
+          olds: base,
+          output: sampleOutput,
+          session: undefined as never,
+          bindings: [] as never,
+        }),
+      ),
+    );
+    expect(error).toBeInstanceOf(PostgresDatabaseDropRefused);
+    expect((error as PostgresDatabaseDropRefused).database).toBe('widgets');
+  });
+
+  test('defaultRemovalPolicy is retain (declared alongside PostgresDatabase, checked in source)', () => {
+    const source = readFileSync(new URL('./database.ts', import.meta.url), 'utf8');
+    expect(source).toContain("defaultRemovalPolicy: 'retain'");
+  });
+});