@homeflare/alchemy 0.43.0 → 0.45.0

package/src/postgres/grants-lifecycle-guards.test.ts

@@ -0,0 +1,208 @@
+/**
+ * The ownership and refusal guards of `Postgres.Grants`, replayed against the fake server
+ * model: objects the declared role OWNS are never touched (an owner holds every privilege
+ * implicitly and a REVOKE cannot take that away — measured on PG 18.6, where a repair left
+ * the docs' own seat example with an empty ACL on its own schema), the three
+ * database-mismatch refusals fire before any statement, the reconcile-side retarget guard
+ * closes the plan-time bypass, and `delete` is a no-op when the role or schema is missing or
+ * the target holds no grants. The read path's absent-vs-projection faces live in
+ * `grants-read-absent.test.ts`.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeGrants } from './fake-grants-sql.ts';
+import { deleteWithClient, readWithClient, reconcileWithClient } from './grants-ops.ts';
+import type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';
+import { PostgresGrantsDatabaseMismatch, PostgresGrantsRetargetRefused } from './grants-errors.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> => Effect.runPromise(Effect.flip(eff));
+
+const isWrite = (text: string): boolean => /^(GRANT|REVOKE|ALTER)/.test(text);
+
+const baseProps: PostgresGrantsProps = {
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  schemaUsage: true,
+};
+
+/** The seat model: `notes` (with its column) and its catalog are the seat's OWN objects;
+ * `shared` is someone else's. The schema is still owned by the executor. */
+const ownedCatalog = {
+  schemas: ['app'],
+  roles: ['postgres', 'seat_writer'],
+  databases: ['agents'],
+  tables: [
+    { schema: 'app', table: 'notes', owner: 'seat_writer', columns: ['id'] },
+    { schema: 'app', table: 'shared' },
+  ],
+};
+
+const writesOf = (fake: ReturnType<typeof makeFakeGrants>): ReadonlyArray<string> =>
+  fake.statements.map((s) => s.text).filter(isWrite);
+
+const applied = (over: Partial<PostgresGrantsAttributes>): PostgresGrantsAttributes => ({
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  schemaPrivileges: [],
+  tables: [],
+  columns: [],
+  defaults: [],
+  publicSchemaRevoked: false,
+  publicTablesRevoked: false,
+  schemaOwnedByRole: false,
+  ownedTables: [],
+  ...over,
+});
+
+describe('reconcile: objects the role owns are left alone', () => {
+  test('an owned table is skipped by repair, delete and the projection', async () => {
+    const fake = makeFakeGrants(ownedCatalog);
+    const props: PostgresGrantsProps = {
+      ...baseProps,
+      tables: [
+        { table: 'notes', privileges: ['select'] },
+        { table: 'shared', privileges: ['select'] },
+      ],
+      columnGrants: [{ table: 'notes', column: 'id', privileges: ['select'] }],
+    };
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+    // Only the NOT-owned table is repaired; the owned one records an empty word list and
+    // its name in ownedTables (the owner holds everything implicitly, whatever the ACL says).
+    expect(attrs.tables).toEqual([
+      { table: 'notes', privileges: [] },
+      { table: 'shared', privileges: ['select'] },
+    ]);
+    expect(attrs.columns).toEqual([{ table: 'notes', column: 'id', privileges: [] }]);
+    expect(attrs.ownedTables).toEqual(['notes']);
+    expect(attrs.schemaOwnedByRole).toBe(false);
+    expect(writesOf(fake)).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'GRANT usage ON SCHEMA "app" TO "seat_writer"',
+      'REVOKE ALL ON "app"."shared" FROM "seat_writer"',
+      'GRANT select ON "app"."shared" TO "seat_writer"',
+    ]);
+    // delete revokes the schema grant and `shared` only: stripping the owner's ACL would
+    // strip rights that existed before this resource (the round-1 finding's empty relacl).
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    await run(deleteWithClient(fake, props));
+    expect(writesOf(fake).slice(writesBefore)).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'REVOKE ALL ON "app"."shared" FROM "seat_writer"',
+    ]);
+  });
+
+  test('a schema the role owns is skipped entirely by reconcile and delete', async () => {
+    const fake = makeFakeGrants({
+      schemas: ['app'],
+      roles: ['postgres', 'seat_writer'],
+      schemaOwner: 'seat_writer',
+      tables: [{ schema: 'app', table: 'notes', owner: 'seat_writer' }],
+    });
+    const props: PostgresGrantsProps = { ...baseProps, schemaCreate: true };
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+    expect(attrs.schemaOwnedByRole).toBe(true);
+    expect(attrs.schemaPrivileges).toEqual([]);
+    // A revoke on the seat's own schema would leave it without USAGE on the very schema it
+    // owns — the regression the round-1 review measured — so nothing runs at all.
+    expect(writesOf(fake)).toEqual([]);
+    await run(deleteWithClient(fake, props));
+    expect(writesOf(fake)).toEqual([]);
+  });
+});
+
+describe('current_database() must be the declared database', () => {
+  test('reconcile, read and delete each refuse before any write', async () => {
+    const fake = makeFakeGrants({ ...ownedCatalog, connected: 'other_db' });
+    const reconcileError = await fails(
+      reconcileWithClient(
+        fake,
+        { ...baseProps, tables: [{ table: 'shared', privileges: ['select'] }] },
+        undefined,
+      ),
+    );
+    expect(reconcileError).toBeInstanceOf(PostgresGrantsDatabaseMismatch);
+    expect((reconcileError as PostgresGrantsDatabaseMismatch).connected).toBe('other_db');
+    const readError = await fails(
+      readWithClient(
+        fake,
+        {
+          role: 'seat_writer',
+          database: 'agents',
+          schema: 'app',
+          tables: [],
+          columns: [],
+          defaults: [],
+        },
+        false,
+      ),
+    );
+    expect(readError).toBeInstanceOf(PostgresGrantsDatabaseMismatch);
+    const deleteError = await fails(deleteWithClient(fake, baseProps));
+    expect(deleteError).toBeInstanceOf(PostgresGrantsDatabaseMismatch);
+    expect(fake.statements.map((s) => s.text).filter(isWrite)).toEqual([]);
+    expect(fake.statements.some((s) => s.text.startsWith('SELECT current_database()'))).toBe(true);
+  });
+});
+
+describe('reconcile: the retarget guard cannot be bypassed by an unresolved plan', () => {
+  test('an output naming a different role, database or schema is refused before any statement', async () => {
+    const fake = makeFakeGrants(ownedCatalog);
+    const props: PostgresGrantsProps = {
+      ...baseProps,
+      tables: [{ table: 'shared', privileges: ['select'] }],
+    };
+    // `news` unresolved at plan time would let the engine's own comparison answer update;
+    // reconcile, where news IS resolved, re-checks the persisted identity against the
+    // declaration (a same-deploy role rename would otherwise land on the new role while
+    // the old one keeps every privilege).
+    const variants: ReadonlyArray<readonly [string, PostgresGrantsAttributes]> = [
+      ['role', applied({ role: 'seat_old' })],
+      ['database', applied({ database: 'other_db' })],
+      ['schema', applied({ schema: 'other_schema' })],
+    ];
+    for (const [prop, output] of variants) {
+      const error = await fails(reconcileWithClient(fake, props, output));
+      expect(error, prop).toBeInstanceOf(PostgresGrantsRetargetRefused);
+      expect((error as PostgresGrantsRetargetRefused).prop).toBe(prop);
+    }
+    expect(fake.statements).toEqual([]);
+  });
+});
+
+describe('delete: a no-op when the target is gone or holds nothing', () => {
+  test('writes nothing when the grantee role no longer exists', async () => {
+    const fake = makeFakeGrants({ ...ownedCatalog, roles: [] });
+    await run(
+      deleteWithClient(fake, {
+        ...baseProps,
+        tables: [{ table: 'shared', privileges: ['select'] }],
+      }),
+    );
+    expect(fake.statements.filter((s) => isWrite(s.text))).toEqual([]);
+  });
+
+  test('writes nothing when the schema no longer exists', async () => {
+    const fake = makeFakeGrants({ ...ownedCatalog, schemas: [] });
+    await run(
+      deleteWithClient(fake, {
+        ...baseProps,
+        tables: [{ table: 'shared', privileges: ['select'] }],
+      }),
+    );
+    expect(fake.statements.filter((s) => isWrite(s.text))).toEqual([]);
+  });
+
+  test('writes nothing when the target holds no grants (the idempotent re-delete)', async () => {
+    const fake = makeFakeGrants(ownedCatalog);
+    await run(
+      deleteWithClient(fake, {
+        ...baseProps,
+        tables: [{ table: 'shared', privileges: ['select'] }],
+      }),
+    );
+    expect(fake.statements.filter((s) => isWrite(s.text))).toEqual([]);
+  });
+});

package/src/postgres/grants-lifecycle-repair.test.ts

@@ -0,0 +1,208 @@
+/**
+ * The repair-specific lifecycles the round-1 review measured against real PG 18.6, replayed
+ * against the fake server model: (1) a table-level REVOKE ALL also clears the grantee's
+ * column entries on that table, so a table-words change on a table with declared column
+ * grants must re-grant the columns in the SAME pass to converge; (2) removing an entry from
+ * the declaration revokes the privilege instead of silently retaining it; (3) default
+ * privileges grant, read back and converge; (4) a PUBLIC grant on a SEQUENCE survives the
+ * bulk revoke, so it must never block `revokeFromPublic`'s convergence; (5) a multi-word
+ * column grant repeats the synopsis per word — every word lands on the column, nothing on
+ * the relation, and the parser refuses the single-trailing-list shape PG 18.6 reads as a
+ * table-level grant.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeGrants } from './fake-grants-sql.ts';
+import { parseGrantStatement } from './fake-grants-parse.ts';
+import { reconcileWithClient } from './grants-ops.ts';
+import type { PostgresGrantsAttributes, PostgresGrantsProps } from './grants-attrs.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+
+const isWrite = (text: string): boolean => /^(GRANT|REVOKE|ALTER)/.test(text);
+
+const baseProps: PostgresGrantsProps = {
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  schemaUsage: true,
+};
+
+/** Three relations and both auxiliary roles: `widgets` carries the declared column,
+ * `ledger` the later-removed table grant, `app_seq` a sequence for the relkind-scoped
+ * PUBLIC check, and `owner_role` the default-privileges creator. */
+const catalog = {
+  schemas: ['app'],
+  roles: ['postgres', 'seat_writer', 'owner_role'],
+  tables: [
+    { schema: 'app', table: 'widgets', columns: ['id'] },
+    { schema: 'app', table: 'ledger' },
+    { schema: 'app', table: 'app_seq', relkind: 'S' },
+  ],
+};
+
+const writesOf = (fake: ReturnType<typeof makeFakeGrants>): ReadonlyArray<string> =>
+  fake.statements.map((s) => s.text).filter(isWrite);
+
+describe('reconcile: a table revoke clears that grantee\u2019s column entries', () => {
+  test('a table-words change on a table with declared column grants converges in ONE pass', async () => {
+    const fake = makeFakeGrants(catalog);
+    const declared = (privileges: ReadonlyArray<string>): PostgresGrantsProps => ({
+      ...baseProps,
+      tables: [{ table: 'widgets', privileges }],
+      columnGrants: [{ table: 'widgets', column: 'id', privileges: ['select'] }],
+    });
+    const first = await run(reconcileWithClient(fake, declared(['select']), undefined));
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    // The table's words change while its column grant stays declared: the server's REVOKE
+    // ALL also takes the column grant away, so the same pass must re-grant it — planned
+    // against an empty column set — or the convergence re-read answers drift and refuses.
+    const again = await run(reconcileWithClient(fake, declared(['select', 'insert']), first));
+    expect(writesOf(fake).slice(writesBefore)).toEqual([
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+      'GRANT insert, select ON "app"."widgets" TO "seat_writer"',
+      'REVOKE ALL ("id") ON "app"."widgets" FROM "seat_writer"',
+      'GRANT select ("id") ON "app"."widgets" TO "seat_writer"',
+    ]);
+    expect(again.tables).toEqual([{ table: 'widgets', privileges: ['insert', 'select'] }]);
+    expect(again.columns).toEqual([{ table: 'widgets', column: 'id', privileges: ['select'] }]);
+  });
+});
+
+describe('reconcile: removal takes the privilege away', () => {
+  test('removing table, column and default entries revokes exactly what they held', async () => {
+    const fake = makeFakeGrants(catalog);
+    const first = await run(
+      reconcileWithClient(
+        fake,
+        {
+          ...baseProps,
+          tables: [{ table: 'ledger', privileges: ['select'] }],
+          columnGrants: [{ table: 'widgets', column: 'id', privileges: ['select'] }],
+          defaultPrivileges: [{ forRole: 'owner_role', privileges: ['select'] }],
+        },
+        undefined,
+      ),
+    );
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    // The operator deletes every entry: the seat keeps nothing the resource granted, and
+    // the schema grant it still declares stays.
+    const after = await run(reconcileWithClient(fake, { ...baseProps }, first));
+    expect(writesOf(fake).slice(writesBefore)).toEqual([
+      'REVOKE ALL ON "app"."ledger" FROM "seat_writer"',
+      'REVOKE ALL ("id") ON "app"."widgets" FROM "seat_writer"',
+      'ALTER DEFAULT PRIVILEGES FOR ROLE "owner_role" IN SCHEMA "app" REVOKE ALL ON TABLES FROM "seat_writer"',
+    ]);
+    expect(after.tables).toEqual([]);
+    expect(after.columns).toEqual([]);
+    expect(after.defaults).toEqual([]);
+    expect(after.schemaPrivileges).toEqual(['usage']);
+  });
+});
+
+describe('reconcile: default privileges', () => {
+  test('grant, read back, and converge on a re-run with the previous output', async () => {
+    const fake = makeFakeGrants(catalog);
+    const props: PostgresGrantsProps = {
+      ...baseProps,
+      defaultPrivileges: [{ forRole: 'owner_role', privileges: ['select'] }],
+    };
+    const attrs: PostgresGrantsAttributes = await run(reconcileWithClient(fake, props, undefined));
+    expect(attrs.defaults).toEqual([{ forRole: 'owner_role', privileges: ['select'] }]);
+    expect(writesOf(fake)).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'GRANT usage ON SCHEMA "app" TO "seat_writer"',
+      'ALTER DEFAULT PRIVILEGES FOR ROLE "owner_role" IN SCHEMA "app" REVOKE ALL ON TABLES FROM "seat_writer"',
+      'ALTER DEFAULT PRIVILEGES FOR ROLE "owner_role" IN SCHEMA "app" GRANT select ON TABLES TO "seat_writer"',
+    ]);
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    const again = await run(reconcileWithClient(fake, props, attrs));
+    expect(again.defaults).toEqual([{ forRole: 'owner_role', privileges: ['select'] }]);
+    expect(fake.statements.filter((s) => isWrite(s.text)).length).toBe(writesBefore);
+  });
+});
+
+describe('reconcile: PUBLIC on a sequence', () => {
+  test('revokeFromPublic converges with a PUBLIC grant on a sequence in the schema', async () => {
+    const fake = makeFakeGrants({
+      ...catalog,
+      acl: [
+        {
+          object: { schema: 'app', table: 'app_seq' },
+          grantee: 'PUBLIC',
+          grantor: 'postgres',
+          words: ['usage'],
+        },
+      ],
+    });
+    const props: PostgresGrantsProps = { ...baseProps, revokeFromPublic: true };
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+    // REVOKE ALL ON ALL TABLES IN SCHEMA does not reach sequences (measured), so the
+    // sequence's PUBLIC grant is never counted: the reconcile converges without any
+    // PUBLIC statement, and the recorded fact stays relkind-scoped.
+    expect(writesOf(fake)).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'GRANT usage ON SCHEMA "app" TO "seat_writer"',
+    ]);
+    expect(attrs.publicSchemaRevoked).toBe(true);
+    expect(attrs.publicTablesRevoked).toBe(true);
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    await run(reconcileWithClient(fake, props, attrs));
+    expect(fake.statements.filter((s) => isWrite(s.text)).length).toBe(writesBefore);
+  });
+});
+
+describe('reconcile: multi-word column grants land on the column, not the table', () => {
+  test('a two-word column declaration converges and leaves no table-level grant', async () => {
+    const fake = makeFakeGrants(catalog);
+    const props: PostgresGrantsProps = {
+      ...baseProps,
+      columnGrants: [{ table: 'widgets', column: 'id', privileges: ['select', 'update'] }],
+    };
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+    // Each word carries its own column list, so `select` and `update` both land on the
+    // column and nothing lands on the relation — the re-read projection proves it.
+    expect(attrs.columns).toEqual([
+      { table: 'widgets', column: 'id', privileges: ['select', 'update'] },
+    ]);
+    expect(attrs.tables).toEqual([]);
+    // The statement that got the words there is the synopsis repeat, not a word list under
+    // one trailing column list (which PG 18.6 reads as a table-level grant of all but the last).
+    expect(writesOf(fake)).toContain(
+      'GRANT select ("id"), update ("id") ON "app"."widgets" TO "seat_writer"',
+    );
+    // A re-run with the projection back in is a no-op — the shape converges.
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    await run(reconcileWithClient(fake, props, attrs));
+    expect(fake.statements.filter((s) => isWrite(s.text)).length).toBe(writesBefore);
+  });
+});
+
+describe('fake parser: the single-trailing-column-list shape is refused', () => {
+  test('a word list under one column list is not a column grant', () => {
+    // On PG 18.6 this is a table-level SELECT plus a column-level UPDATE; the builders
+    // never emit it, so the parser must not file it as a column-only grant.
+    expect(parseGrantStatement('GRANT select, update ("id") ON "app"."widgets" TO "seat"')).toBe(
+      undefined,
+    );
+  });
+
+  test('the synopsis-repeat shape parses as one column grant with every word', () => {
+    const parsed = parseGrantStatement(
+      'GRANT select ("id"), update ("id") ON "app"."widgets" TO "seat"',
+    );
+    expect(parsed).toEqual({
+      kind: 'grant',
+      object: { schema: 'app', table: 'widgets', column: 'id' },
+      grantee: 'seat',
+      words: ['select', 'update'],
+      option: false,
+    });
+  });
+
+  test('mixed columns in one statement are refused', () => {
+    expect(
+      parseGrantStatement('GRANT select ("id"), update ("name") ON "app"."widgets" TO "seat"'),
+    ).toBe(undefined);
+  });
+});

package/src/postgres/grants-lifecycle.test.ts

@@ -0,0 +1,181 @@
+/**
+ * The base lifecycles of `Postgres.Grants` against `fake-grants-sql.ts`'s server-model
+ * fake: greenfield emits REVOKE-then-GRANT per class, a re-run with the previous `output`
+ * writes nothing, `read` answers the projection recovered from the attributes, a third
+ * grantor's grant survives as `PostgresGrantsRepairRefused`, and the missing role/schema
+ * guards refuse before any statement. The repair-specific lifecycles (a table revoke's
+ * column collateral, removal revocation, default privileges, a PUBLIC sequence) live in
+ * `grants-lifecycle-repair.test.ts`; the ownership and refusal guards in
+ * `grants-lifecycle-guards.test.ts`.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeGrants } from './fake-grants-sql.ts';
+import { deleteWithClient, readWithClient, reconcileWithClient } from './grants-ops.ts';
+import { namesFromAttrs } from './grants-declare.ts';
+import type { PostgresGrantsProps } from './grants-attrs.ts';
+import {
+  PostgresGrantsRepairRefused,
+  PostgresGrantsRoleMissing,
+  PostgresGrantsSchemaMissing,
+} from './grants-errors.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> => Effect.runPromise(Effect.flip(eff));
+
+const isWrite = (text: string): boolean => /^(GRANT|REVOKE|ALTER)/.test(text);
+
+const baseProps: PostgresGrantsProps = {
+  role: 'seat_writer',
+  database: 'agents',
+  schema: 'app',
+  schemaUsage: true,
+};
+
+/** The catalog a reconcile needs: the schema and grantee role exist, and one table with two
+ * columns so column and table grants have a target. */
+const catalog = {
+  schemas: ['app'],
+  roles: ['postgres', 'seat_writer'],
+  tables: [{ schema: 'app', table: 'widgets', columns: ['id', 'name'] }],
+};
+
+describe('reconcile: greenfield', () => {
+  test('issues REVOKE-then-GRANT for each declared class and returns the read-back', async () => {
+    const fake = makeFakeGrants(catalog);
+    const attrs = await run(
+      reconcileWithClient(
+        fake,
+        {
+          ...baseProps,
+          tables: [{ table: 'widgets', privileges: ['select'] }],
+          columnGrants: [{ table: 'widgets', column: 'id', privileges: ['select'] }],
+        },
+        undefined,
+      ),
+    );
+    expect(attrs.role).toBe('seat_writer');
+    expect(attrs.schemaPrivileges).toEqual(['usage']);
+    expect(attrs.tables).toEqual([{ table: 'widgets', privileges: ['select'] }]);
+    expect(attrs.columns).toEqual([{ table: 'widgets', column: 'id', privileges: ['select'] }]);
+    // Reads (the existence checks and the aclexplode projections) are recorded beside the
+    // writes; the assertion is on the writes, which are exactly REVOKE-then-GRANT per class.
+    const writes = fake.statements.map((s) => s.text).filter(isWrite);
+    expect(writes).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'GRANT usage ON SCHEMA "app" TO "seat_writer"',
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+      'GRANT select ON "app"."widgets" TO "seat_writer"',
+      'REVOKE ALL ("id") ON "app"."widgets" FROM "seat_writer"',
+      'GRANT select ("id") ON "app"."widgets" TO "seat_writer"',
+    ]);
+    // One transaction: a live grantee never observes the revoke without the grant.
+    expect(fake.transactions).toEqual([writes]);
+  });
+});
+
+describe('reconcile: convergence', () => {
+  test('a re-run with the previous output writes nothing', async () => {
+    const fake = makeFakeGrants(catalog);
+    const props = { ...baseProps, tables: [{ table: 'widgets', privileges: ['select'] }] };
+    const attrs = await run(reconcileWithClient(fake, props, undefined));
+    const writesBefore = fake.statements.filter((s) => isWrite(s.text)).length;
+    // The engine's real update flow: `output` (the persisted attributes) is passed back in,
+    // and its names are all still declared, so no removed-entries revocation may fire.
+    const again = await run(reconcileWithClient(fake, props, attrs));
+    expect(again.tables).toEqual([{ table: 'widgets', privileges: ['select'] }]);
+    expect(fake.statements.filter((s) => isWrite(s.text)).length).toBe(writesBefore);
+  });
+
+  test('readWithClient answers the projection recovered from the attributes', async () => {
+    const fake = makeFakeGrants(catalog);
+    const attrs = await run(
+      reconcileWithClient(
+        fake,
+        {
+          ...baseProps,
+          tables: [{ table: 'widgets', privileges: ['select'] }],
+          columnGrants: [{ table: 'widgets', column: 'id', privileges: ['select'] }],
+        },
+        undefined,
+      ),
+    );
+    const live = await run(readWithClient(fake, namesFromAttrs(attrs), true));
+    expect(live?.tables).toEqual([{ table: 'widgets', privileges: ['select'] }]);
+    expect(live?.columns).toEqual([{ table: 'widgets', column: 'id', privileges: ['select'] }]);
+  });
+
+  test('a third grantor\u2019s grant survives REVOKE and surfaces as PostgresGrantsRepairRefused', async () => {
+    const fake = makeFakeGrants({
+      ...catalog,
+      acl: [
+        {
+          object: { schema: 'app', table: 'widgets' },
+          grantee: 'seat_writer',
+          grantor: 'someone_else',
+          words: ['delete'],
+        },
+      ],
+    });
+    const error = await fails(
+      reconcileWithClient(
+        fake,
+        { ...baseProps, tables: [{ table: 'widgets', privileges: ['select'] }] },
+        undefined,
+      ),
+    );
+    expect(error).toBeInstanceOf(PostgresGrantsRepairRefused);
+    // The surviving grant is a third grantor's 'delete' the executor cannot revoke, so the
+    // re-read still plans the table's REVOKE-then-GRANT — that statement list is the refusal.
+    expect((error as PostgresGrantsRepairRefused).remaining).toContain(
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+    );
+  });
+});
+
+describe('reconcile: guards', () => {
+  test('refuses before any write when the grantee role is missing', async () => {
+    const fake = makeFakeGrants({ ...catalog, roles: [] });
+    const error = await fails(reconcileWithClient(fake, baseProps, undefined));
+    expect(error).toBeInstanceOf(PostgresGrantsRoleMissing);
+    expect(fake.statements.filter((s) => isWrite(s.text))).toEqual([]);
+  });
+
+  test('refuses when the schema does not exist', async () => {
+    const fake = makeFakeGrants({ ...catalog, schemas: [] });
+    const error = await fails(reconcileWithClient(fake, baseProps, undefined));
+    expect(error).toBeInstanceOf(PostgresGrantsSchemaMissing);
+  });
+});
+
+describe('delete', () => {
+  test('revokes exactly the last declaration\u2019s objects and nothing PUBLIC', async () => {
+    const fake = makeFakeGrants(catalog);
+    await run(
+      reconcileWithClient(
+        fake,
+        {
+          ...baseProps,
+          tables: [{ table: 'widgets', privileges: ['select'] }],
+          revokeFromPublic: true,
+        },
+        undefined,
+      ),
+    );
+    const before = fake.statements.length;
+    await run(
+      deleteWithClient(fake, {
+        ...baseProps,
+        tables: [{ table: 'widgets', privileges: ['select'] }],
+      }),
+    );
+    const writes = fake.statements
+      .slice(before)
+      .map((s) => s.text)
+      .filter(isWrite);
+    expect(writes).toEqual([
+      'REVOKE ALL ON SCHEMA "app" FROM "seat_writer"',
+      'REVOKE ALL ON "app"."widgets" FROM "seat_writer"',
+    ]);
+  });
+});