@homeflare/alchemy 0.43.0 → 0.45.0

package/src/postgres/role-identity.test.ts

@@ -0,0 +1,197 @@
+/**
+ * Oid identity, live membership options, and the unfinished-create resume. The engine passes
+ * stored attributes to `diff` and calls `read` with `output: undefined` on a `creating` row;
+ * these tests drive `postgresRoleHandlers` the way that engine does, over the runner transport.
+ */
+import { describe, expect, test } from 'bun:test';
+import { Unowned } from 'alchemy/AdoptPolicy';
+import { Artifacts, makeScopedArtifacts } from 'alchemy/Artifacts';
+import { InMemoryService } from 'alchemy/State/InMemoryState';
+import { State } from 'alchemy/State/State';
+import { Stack } from 'alchemy/Stack';
+import * as Effect from 'effect/Effect';
+import { unfinished } from '../ownership/resume.ts';
+import { postgresRunnerConnection } from './connection.ts';
+import { parseLiteral } from './fake-sql-quote.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import { type PsqlRunner } from './psql-executor.ts';
+import { PostgresRoleIdentityRefused } from './role-errors.ts';
+import { postgresRoleHandlers } from './role-provider.ts';
+import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+
+const baseProps: PostgresRoleProps = {
+  name: 'seat-observability',
+  login: false,
+  connectionLimit: 10,
+  inherit: true,
+};
+
+const stored = (): PostgresRoleAttributes => ({
+  name: 'seat-observability',
+  oid: 20000,
+  login: false,
+  connectionLimit: 10,
+  inherit: true,
+  validUntil: null,
+  memberOf: ['hf_agent'],
+  passwordSeal: '',
+});
+
+/** Same envelope the adopt test uses: `withPg` wraps a SELECT in `json_agg` and inlines `$1`. */
+const runnerFor =
+  (fake: ReturnType<typeof makeFakeSql>): PsqlRunner =>
+  async ({ stdin }) => {
+    const wrapped = /^SELECT coalesce\(json_agg\(t\), '\[\]'::json\)::text FROM \((.*)\) t;$/s.exec(
+      stdin,
+    );
+    const body = (wrapped?.[1] ?? stdin).replace(/;\s*$/, '');
+    // Membership reads have ORDER BY after the bound name; preserve that suffix.
+    const bound = /^([\s\S]*) = (E'(?:\\.|''|[^'\\])*')([\s\S]*)$/.exec(body);
+    const sql = bound === null ? body : `${bound[1]} = $1${bound[3]}`;
+    const params = bound === null ? [] : [parseLiteral(bound[2] as string)];
+    const rows = await Effect.runPromise(fake.unsafe(sql, params));
+    return { code: 0, stdout: JSON.stringify(rows), stderr: '' };
+  };
+
+const layerFor = (fake: ReturnType<typeof makeFakeSql>) =>
+  postgresRunnerConnection({
+    run: runnerFor(fake),
+    database: 'postgres',
+    username: 'postgres',
+  });
+
+const handlers = postgresRoleHandlers;
+if (handlers.read === undefined || handlers.diff === undefined || handlers.delete === undefined) {
+  throw new Error('Postgres.Role read, diff and delete are part of the provider');
+}
+const readRoleHandler = handlers.read;
+const diffRoleHandler = handlers.diff;
+const deleteRoleHandler = handlers.delete;
+
+const ids = {
+  id: 'seat-observability',
+  fqn: 'Postgres.Role/seat-observability',
+  instanceId: 'i',
+};
+
+describe('oid and live membership options', () => {
+  test('read returns the reconcile shape, without observe-only memberships', async () => {
+    const fake = makeFakeSql({ roleRows: [stored()], roles: ['hf_agent'] });
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    const output = stored();
+    const found = await Effect.runPromise(
+      readRoleHandler({ ...ids, olds: baseProps, output }).pipe(Effect.provide(layerFor(fake))),
+    );
+    expect(found).toEqual(output);
+    expect(found).not.toHaveProperty('memberships');
+  });
+
+  test('a recycled oid is refused on read, diff and delete, and delete issues no DROP', async () => {
+    const fake = makeFakeSql({ roleRows: [{ ...stored(), oid: 7 }] });
+    const output = stored();
+    const provided = <A, E, R>(effect: Effect.Effect<A, E, R>) =>
+      effect.pipe(Effect.provide(layerFor(fake)));
+    const readError = await Effect.runPromise(
+      Effect.flip(provided(readRoleHandler({ ...ids, olds: baseProps, output }))),
+    );
+    expect(readError).toBeInstanceOf(PostgresRoleIdentityRefused);
+    const diffError = await Effect.runPromise(
+      Effect.flip(
+        provided(
+          diffRoleHandler({
+            ...ids,
+            olds: baseProps,
+            news: { ...baseProps, memberOf: ['hf_agent'] },
+            output,
+            oldBindings: [],
+            newBindings: [],
+          }),
+        ),
+      ),
+    );
+    expect(diffError).toBeInstanceOf(PostgresRoleIdentityRefused);
+    await Effect.runPromise(
+      Effect.flip(
+        provided(
+          deleteRoleHandler({
+            ...ids,
+            olds: baseProps,
+            output,
+            session: {} as never,
+            bindings: [],
+          }),
+        ),
+      ),
+    );
+    expect(fake.statements.some((s) => s.text.startsWith('DROP'))).toBe(false);
+  });
+
+  test('diff reads live ADMIN even though stored output has no membership rows', async () => {
+    const fake = makeFakeSql({ roleRows: [stored()] });
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    fake.membershipOptions.set('seat-observability\0hf_agent\0postgres', {
+      admin: true,
+      set: false,
+    });
+    const plan = await Effect.runPromise(
+      diffRoleHandler({
+        ...ids,
+        olds: baseProps,
+        news: { ...baseProps, memberOf: ['hf_agent'] },
+        output: stored(),
+        oldBindings: [],
+        newBindings: [],
+      }).pipe(Effect.provide(layerFor(fake))),
+    );
+    expect(plan).toEqual({ action: 'update' });
+  });
+
+  test('a creating row with no attributes is noted unfinished', async () => {
+    const bag = makeScopedArtifacts(new Map(), ids.fqn);
+    const plan = await Effect.runPromise(
+      diffRoleHandler({
+        ...ids,
+        instanceId: 'creating-1',
+        olds: baseProps,
+        news: baseProps,
+        output: undefined,
+        oldBindings: [],
+        newBindings: [],
+      }).pipe(Effect.provideService(Artifacts, bag), Effect.provide(layerFor(makeFakeSql()))),
+    );
+    expect(plan).toBeUndefined();
+    expect(
+      await Effect.runPromise(unfinished('creating-1').pipe(Effect.provideService(Artifacts, bag))),
+    ).toBe(true);
+  });
+
+  test('a creating row whose live role matches the declaration is ours', async () => {
+    const fake = makeFakeSql({ roleRows: [{ ...stored(), memberOf: [] }] });
+    const row = {
+      fqn: ids.fqn,
+      instanceId: 'creating-1',
+      status: 'creating',
+      props: baseProps,
+    };
+    const found = await Effect.runPromise(
+      readRoleHandler({
+        ...ids,
+        instanceId: 'creating-1',
+        olds: baseProps,
+        output: undefined,
+      }).pipe(
+        Effect.provide(layerFor(fake)),
+        Effect.provideService(State, InMemoryService({ s: { test: { [ids.fqn]: row as never } } })),
+        Effect.provideService(Stack, {
+          actions: {},
+          bindings: {},
+          name: 's',
+          resources: { [ids.fqn]: { Props: baseProps } },
+          stage: 'test',
+        } as never),
+      ),
+    );
+    expect(Unowned.is(found)).toBe(false);
+    expect(found?.oid).toBe(20000);
+  });
+});

package/src/postgres/role-lifecycle.test.ts

@@ -0,0 +1,228 @@
+/**
+ * `reconcile`, `read` and the drop statement against `fake-sql.ts`'s recording fake — greenfield
+ * create with exact statement text, membership `GRANT`/`REVOKE`, per-field scalar drift, a create
+ * whose re-read finds nothing, and zero statements when nothing drifted. The password lifecycle
+ * is `role-password.test.ts`; the plan-time refusals are `role-refusals.test.ts`. Every case
+ * reverts cleanly by reverting `role.ts`/`role-sql.ts`/`role-membership-sql.ts`/`fake-sql.ts`
+ * locally: these fail on `origin/main`, which has none of them.
+ */
+import { describe, expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import type { PgExecutor } from './database-sql.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import { PostgresRoleCreateVanished } from './role-errors.ts';
+import type { PostgresRoleAttributes, PostgresRoleProps } from './role-attrs.ts';
+import { readRole, reconcileWithClient } from './role.ts';
+
+const run = <A, E>(eff: Effect.Effect<A, E>): Promise<A> => Effect.runPromise(eff);
+const fails = <A, E>(eff: Effect.Effect<A, E>): Promise<E> => Effect.runPromise(Effect.flip(eff));
+
+const baseProps: PostgresRoleProps = {
+  name: 'seat-observability',
+  login: false,
+  connectionLimit: 10,
+  inherit: true,
+};
+
+const liveRole = (over: Partial<PostgresRoleAttributes> = {}): PostgresRoleAttributes => ({
+  name: 'seat-observability',
+  oid: 20000,
+  login: false,
+  connectionLimit: 10,
+  inherit: true,
+  validUntil: null,
+  memberOf: [],
+  passwordSeal: '',
+  ...over,
+});
+
+const startingWith = (fake: ReturnType<typeof makeFakeSql>, prefix: string) =>
+  fake.statements.filter((s) => s.text.startsWith(prefix));
+
+const writeStatements = (fake: ReturnType<typeof makeFakeSql>) =>
+  fake.statements.filter(
+    (s) =>
+      s.text.startsWith('CREATE') ||
+      s.text.startsWith('ALTER') ||
+      s.text.startsWith('GRANT') ||
+      s.text.startsWith('REVOKE') ||
+      s.text.startsWith('DROP'),
+  );
+
+describe('reconcile: greenfield', () => {
+  test('issues exactly one CREATE with the seat shape, and nothing else', async () => {
+    const fake = makeFakeSql();
+    const attrs = await run(reconcileWithClient(fake, baseProps));
+    expect(attrs.name).toBe('seat-observability');
+    expect(startingWith(fake, 'CREATE ROLE')).toEqual([
+      {
+        text: 'CREATE ROLE "seat-observability" WITH NOLOGIN INHERIT CONNECTION LIMIT 10',
+        params: [],
+      },
+    ]);
+    expect(writeStatements(fake).length).toBe(1);
+  });
+
+  test('a LOGIN role with an expiry carries VALID UNTIL last, quoted', async () => {
+    const fake = makeFakeSql();
+    const props = {
+      name: 'seat-alice',
+      login: true,
+      connectionLimit: 10,
+      inherit: true,
+      validUntil: '2027-01-01T00:00:00Z',
+    };
+    const attrs = await run(reconcileWithClient(fake, props));
+    expect(attrs.validUntil).toBe('2027-01-01T00:00:00Z');
+    expect(startingWith(fake, 'CREATE ROLE')[0]?.text).toBe(
+      'CREATE ROLE "seat-alice" WITH LOGIN INHERIT CONNECTION LIMIT 10 VALID UNTIL E\'2027-01-01T00:00:00Z\'',
+    );
+  });
+
+  test('declared memberships become one-parent GRANTs after the CREATE, and the answer comes from the re-read, sorted', async () => {
+    const fake = makeFakeSql({ roles: ['hf_agent', 'seat-b'] });
+    const attrs = await run(
+      reconcileWithClient(fake, { ...baseProps, memberOf: ['seat-b', 'hf_agent'] }),
+    );
+    expect(startingWith(fake, 'GRANT')).toEqual([
+      { text: 'GRANT "hf_agent" TO "seat-observability" WITH SET FALSE', params: [] },
+      { text: 'GRANT "seat-b" TO "seat-observability" WITH SET FALSE', params: [] },
+    ]);
+    expect(attrs.memberOf).toEqual(['hf_agent', 'seat-b']);
+  });
+
+  test('a hostile role name survives the round trip through the fake\u2019s own catalog', async () => {
+    const fake = makeFakeSql();
+    const attrs = await run(reconcileWithClient(fake, { ...baseProps, name: 'a"b-c' }));
+    expect(attrs.name).toBe('a"b-c');
+    expect(startingWith(fake, 'CREATE ROLE')[0]?.text).toBe(
+      'CREATE ROLE "a""b-c" WITH NOLOGIN INHERIT CONNECTION LIMIT 10',
+    );
+  });
+
+  test('a create whose re-read finds nothing fails with the typed tag, not a guess (S10/S20)', async () => {
+    const unsafe = <A extends object>(_sql?: string) => Effect.succeed([] as ReadonlyArray<A>);
+    const blankPg: PgExecutor = {
+      unsafe,
+      transaction: (statements) =>
+        Effect.gen(function* () {
+          for (const sql of statements) yield* unsafe(sql).pipe(Effect.asVoid);
+        }),
+    };
+    const error = await fails(reconcileWithClient(blankPg, baseProps));
+    expect(error).toBeInstanceOf(PostgresRoleCreateVanished);
+  });
+});
+
+describe('reconcile: already present', () => {
+  test('no drift issues zero write statements and returns the live row', async () => {
+    const fake = makeFakeSql({ roleRows: [liveRole()] });
+    const attrs = await run(reconcileWithClient(fake, baseProps));
+    expect(attrs).toEqual(liveRole());
+    expect(writeStatements(fake).length).toBe(0);
+  });
+
+  test('scalar drift issues exactly one ALTER per drifted field, in the compared order', async () => {
+    const fake = makeFakeSql({
+      roleRows: [
+        liveRole({
+          login: true,
+          inherit: false,
+          connectionLimit: 1,
+          validUntil: '2026-01-01T00:00:00.000Z',
+        }),
+      ],
+    });
+    const props = {
+      ...baseProps,
+      login: false,
+      inherit: true,
+      connectionLimit: 10,
+      validUntil: '2027-01-01T00:00:00Z',
+    };
+    const attrs = await run(reconcileWithClient(fake, props));
+    expect(startingWith(fake, 'ALTER ROLE').map((s) => s.text)).toEqual([
+      'ALTER ROLE "seat-observability" WITH NOLOGIN',
+      'ALTER ROLE "seat-observability" WITH INHERIT',
+      'ALTER ROLE "seat-observability" WITH CONNECTION LIMIT 10',
+      'ALTER ROLE "seat-observability" WITH VALID UNTIL E\'2027-01-01T00:00:00Z\'',
+    ]);
+    expect(attrs.connectionLimit).toBe(10);
+  });
+
+  test('a validUntil the server serialised with milliseconds is the same instant, so no ALTER', async () => {
+    const fake = makeFakeSql({
+      roleRows: [liveRole({ validUntil: '2027-01-01T00:00:00.000Z' })],
+    });
+    await run(reconcileWithClient(fake, { ...baseProps, validUntil: '2027-01-01T00:00:00Z' }));
+    expect(fake.statements.some((s) => s.text.startsWith('ALTER'))).toBe(false);
+  });
+
+  test('a membership the declaration adds is granted; a live one it drops is revoked by its grantor', async () => {
+    const fake = makeFakeSql({ roleRows: [liveRole()], roles: ['seat-owners'] });
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    const attrs = await run(reconcileWithClient(fake, { ...baseProps, memberOf: ['seat-owners'] }));
+    expect(startingWith(fake, 'GRANT').map((s) => s.text)).toEqual([
+      'GRANT "seat-owners" TO "seat-observability" WITH SET FALSE',
+    ]);
+    expect(startingWith(fake, 'REVOKE').map((s) => s.text)).toEqual([
+      'REVOKE "hf_agent" FROM "seat-observability" GRANTED BY "postgres"',
+    ]);
+    expect(attrs.memberOf).toEqual(['seat-owners']);
+  });
+
+  test('memberOf [] revokes everything; memberOf undefined touches nothing', async () => {
+    const revoking = makeFakeSql({ roleRows: [liveRole()] });
+    revoking.memberships.add('seat-observability\0hf_agent\0postgres');
+    const afterRevoke = await run(reconcileWithClient(revoking, { ...baseProps, memberOf: [] }));
+    expect(afterRevoke.memberOf).toEqual([]);
+
+    const untouched = makeFakeSql({ roleRows: [liveRole()] });
+    untouched.memberships.add('seat-observability\0hf_agent\0postgres');
+    const afterNoop = await run(reconcileWithClient(untouched, baseProps));
+    expect(afterNoop.memberOf).toEqual(['hf_agent']);
+    expect(
+      untouched.statements.some((s) => s.text.startsWith('GRANT') || s.text.startsWith('REVOKE')),
+    ).toBe(false);
+  });
+});
+
+describe('read', () => {
+  test('answers undefined when the role is absent', async () => {
+    const fake = makeFakeSql();
+    expect(await run(readRole(fake, 'seat-observability'))).toBeUndefined();
+  });
+
+  test('answers the live row with memberships merged in, sorted \u2014 no seal; branding and the seal merge are the caller\u2019s job', async () => {
+    const fake = makeFakeSql({ roleRows: [liveRole()] });
+    fake.memberships.add('seat-observability\0seat-b\0postgres');
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    expect(await run(readRole(fake, 'seat-observability'))).toEqual({
+      name: 'seat-observability',
+      oid: 20000,
+      login: false,
+      connectionLimit: 10,
+      inherit: true,
+      validUntil: null,
+      memberOf: ['hf_agent', 'seat-b'],
+      memberships: [
+        { parent: 'hf_agent', grantor: 'postgres', inherit: false, admin: false, set: false },
+        { parent: 'seat-b', grantor: 'postgres', inherit: false, admin: false, set: false },
+      ],
+    });
+  });
+});
+
+describe('delete statement', () => {
+  test('is the idempotent quoted DROP, and the fake applies it to the row and touching memberships', async () => {
+    const fake = makeFakeSql({ roleRows: [liveRole()] });
+    fake.memberships.add('seat-observability\0hf_agent\0postgres');
+    fake.memberships.add('other-role\0seat-observability\0postgres');
+    await run(fake.unsafe('DROP ROLE IF EXISTS "seat-observability"').pipe(Effect.asVoid));
+    expect(fake.roleRows.has('seat-observability')).toBe(false);
+    expect(fake.memberships.has('seat-observability\0hf_agent\0postgres')).toBe(false);
+    expect(fake.memberships.has('other-role\0seat-observability\0postgres')).toBe(false);
+    // Idempotent: the same statement against the now-absent role is not an error.
+    await run(fake.unsafe('DROP ROLE IF EXISTS "seat-observability"').pipe(Effect.asVoid));
+  });
+});

package/src/postgres/role-membership-options.test.ts

@@ -0,0 +1,73 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import { makeFakeSql } from './fake-sql.ts';
+import { buildRepairMembershipSql, syncMemberships } from './role-membership-sql.ts';
+import { makePsqlExecutor } from './psql-executor.ts';
+
+const props = {
+  name: 'seat',
+  login: false,
+  inherit: true,
+  connectionLimit: -1,
+  memberOf: ['parent'],
+};
+const rows = [{ parent: 'parent', grantor: 'postgres', inherit: true, admin: true, set: true }];
+
+test('a failed option revoke rolls back earlier membership changes', async () => {
+  const fake = makeFakeSql({ roles: ['parent'], failNext: 'REVOKE SET OPTION' });
+  const key = 'seat\0parent\0postgres';
+  fake.memberships.add(key);
+  fake.membershipOptions.set(key, { admin: true, set: true });
+  const error = await Effect.runPromise(
+    syncMemberships(fake, props, rows).pipe(Effect.catchTag('SqlError', Effect.succeed)),
+  );
+  expect(error).toHaveProperty('_tag', 'SqlError');
+  expect(fake.memberships.has(key)).toBe(true);
+  expect(fake.membershipOptions.get(key)).toEqual({ admin: true, set: true });
+});
+
+test.each(['2BP01', '42501'])(
+  'repair refusal %s names parent and grantor over psql',
+  async (code) => {
+    // Measured on PG 17.11, 2026-10-02: RESTRICT refuses while member has granted parent
+    // onward; both membership rows remain. This test STUBS that response (and permission
+    // denial); the real server is the dependency authority.
+    const scripts: string[] = [];
+    const pg = makePsqlExecutor(
+      ({ stdin }) => {
+        scripts.push(stdin);
+        return Promise.resolve(
+          stdin.startsWith('BEGIN')
+            ? {
+                code: 3,
+                stdout: '',
+                stderr: `ERROR:  ${code}: repair refused`,
+              }
+            : { code: 0, stdout: '[{"present":1}]', stderr: '' },
+        );
+      },
+      { username: 'postgres', database: 'postgres' },
+    );
+    const error = await Effect.runPromise(
+      syncMemberships(pg, props, rows).pipe(
+        Effect.catchTag('PostgresRoleMembershipUnrepaired', Effect.succeed),
+      ),
+    );
+    expect(error).toMatchObject({
+      _tag: 'PostgresRoleMembershipUnrepaired',
+      parent: 'parent',
+      grantor: 'postgres',
+    });
+    expect(String(error)).toContain('parent');
+    expect(String(error)).toContain('postgres');
+    expect(scripts.at(-1)).toBe(
+      'BEGIN;\nREVOKE ADMIN OPTION FOR "parent" FROM "seat" GRANTED BY "postgres" RESTRICT;\nREVOKE SET OPTION FOR "parent" FROM "seat" GRANTED BY "postgres" RESTRICT;\nCOMMIT;',
+    );
+  },
+);
+
+test('option revocation quotes all three identities', () => {
+  expect(buildRepairMembershipSql('m"', 'p"', 'g"', 'ADMIN')).toBe(
+    'REVOKE ADMIN OPTION FOR "p""" FROM "m""" GRANTED BY "g""" RESTRICT',
+  );
+});

package/src/postgres/role-membership-repair.test.ts

@@ -0,0 +1,153 @@
+import { expect, test } from 'bun:test';
+import * as Effect from 'effect/Effect';
+import type { PgExecutor } from './database-sql.ts';
+import { makeFakeSql } from './fake-sql.ts';
+import { classifyInstalled } from './installed-classifier.ts';
+import { diffPostgresRole } from './role-diff.ts';
+import { selectRoleMemberships, syncMemberships } from './role-membership-sql.ts';
+import { declarationMatches } from './role-sql.ts';
+import { readRole, reconcileWithClient } from './role.ts';
+
+const props = {
+  name: 'seat',
+  login: false,
+  inherit: false,
+  connectionLimit: -1,
+  memberOf: ['parent'],
+};
+const live = { ...props, oid: 42, validUntil: null, passwordSeal: '' };
+const unsafeRow = { parent: 'parent', grantor: 'other', admin: true, set: true, inherit: false };
+
+test.each(['2BP01', '42501'])(
+  'unwanted revokes stay committed after repair refusal %s',
+  async (code) => {
+    const fake = makeFakeSql({ roles: ['parent'], roleRows: [live] });
+    const unwanted = 'seat\0unwanted\0postgres';
+    const kept = 'seat\0parent\0other';
+    fake.memberships.add(unwanted);
+    fake.memberships.add(kept);
+    fake.membershipOptions.set(kept, unsafeRow);
+    const refusal = await classifyInstalled(code);
+    const batches: string[][] = [];
+    const pg: PgExecutor = {
+      unsafe: fake.unsafe,
+      transaction: (sqls) => {
+        batches.push([...sqls]);
+        return sqls.some((sql) => sql.startsWith('REVOKE ADMIN OPTION'))
+          ? Effect.fail(refusal)
+          : fake.transaction(sqls);
+      },
+    };
+    const error = await Effect.runPromise(
+      reconcileWithClient(pg, props, {}).pipe(
+        Effect.catchTag('PostgresRoleMembershipUnrepaired', Effect.succeed),
+      ),
+    );
+    expect(error).toMatchObject({
+      _tag: 'PostgresRoleMembershipUnrepaired',
+      role: 'seat',
+      parent: 'parent',
+      grantor: 'other',
+      declared: true,
+    });
+    expect(String(error)).toContain('"parent"');
+    expect(String(error)).toContain('"other"');
+    expect(batches).toEqual([
+      ['REVOKE "unwanted" FROM "seat" GRANTED BY "postgres"'],
+      [
+        'REVOKE ADMIN OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+        'REVOKE SET OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+      ],
+    ]);
+    expect(fake.memberships.has(unwanted)).toBe(false);
+    expect(fake.memberships.has(kept)).toBe(true);
+    expect(fake.membershipOptions.get(kept)).toEqual(unsafeRow);
+  },
+);
+
+test('unrelated socket errors propagate unchanged', async () => {
+  const fake = makeFakeSql({ roles: ['parent'] });
+  const refusal = await classifyInstalled('42601');
+  const pg: PgExecutor = { unsafe: fake.unsafe, transaction: () => Effect.fail(refusal) };
+  expect(await Effect.runPromise(Effect.flip(syncMemberships(pg, props, [unsafeRow])))).toBe(
+    refusal,
+  );
+});
+
+test('reads INHERIT and repairs another grantor row for declared NOINHERIT', async () => {
+  const fake = makeFakeSql({ roles: ['parent'], roleRows: [live] });
+  const key = 'seat\0parent\0other';
+  fake.memberships.add(key);
+  fake.membershipOptions.set(key, { admin: false, set: false, inherit: true });
+  const before = await Effect.runPromise(readRole(fake, 'seat'));
+  if (before === undefined) throw new Error('seeded role missing');
+  expect(before?.memberships).toEqual([
+    { parent: 'parent', grantor: 'other', admin: false, set: false, inherit: true },
+  ]);
+  expect(fake.statements.find((s) => s.text.includes('FROM pg_auth_members'))?.text).toContain(
+    'm.inherit_option AS inherit',
+  );
+  expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: before }))).toEqual({
+    action: 'update',
+  });
+  expect(declarationMatches(props, before)).toBe(false);
+  await Effect.runPromise(reconcileWithClient(fake, props, {}));
+  expect(fake.statements.filter((s) => s.text.startsWith('REVOKE')).map((s) => s.text)).toEqual([
+    'REVOKE INHERIT OPTION FOR "parent" FROM "seat" GRANTED BY "other" RESTRICT',
+  ]);
+  expect(fake.memberships.has(key)).toBe(true);
+  const after = await Effect.runPromise(readRole(fake, 'seat'));
+  if (after === undefined) throw new Error('reconciled role missing');
+  expect(after?.memberships?.[0]?.inherit).toBe(false);
+  expect(await Effect.runPromise(diffPostgresRole(props, live, {}, { found: after }))).toEqual({
+    action: 'noop',
+  });
+  expect(declarationMatches(props, after)).toBe(true);
+});
+
+test('a warning-only INHERIT no-op fails the catalog backstop', async () => {
+  const fake = makeFakeSql({ roles: ['parent'] });
+  fake.memberships.add('seat\0parent\0other');
+  fake.membershipOptions.set('seat\0parent\0other', { admin: false, set: false, inherit: true });
+  const rows = await Effect.runPromise(selectRoleMemberships(fake, 'seat'));
+  const pg: PgExecutor = { unsafe: fake.unsafe, transaction: () => Effect.void };
+  const error = await Effect.runPromise(Effect.flip(syncMemberships(pg, props, rows)));
+  expect(error).toMatchObject({
+    _tag: 'PostgresRoleMembershipUnrepaired',
+    parent: 'parent',
+    grantor: 'other',
+  });
+  // INHERIT TRUE is safe when declared, and omitted memberOf still means not asserted.
+  await Effect.runPromise(syncMemberships(pg, { ...props, inherit: true }, rows));
+  const { memberOf: _unasserted, ...unasserted } = props;
+  await Effect.runPromise(syncMemberships(pg, unasserted, rows));
+});
+
+test('ADMIN or SET on the live read answers update; stored membership rows do not', async () => {
+  const declared = { ...props, inherit: true };
+  const stored = { ...live, inherit: true };
+  const row = (admin: boolean, set: boolean) => ({
+    found: {
+      ...stored,
+      memberships: [{ parent: 'parent', grantor: 'postgres', inherit: true, admin, set }],
+    },
+  });
+  expect(await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(true, true)))).toEqual({
+    action: 'update',
+  });
+  expect(await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(false, true)))).toEqual(
+    {
+      action: 'update',
+    },
+  );
+  expect(
+    await Effect.runPromise(diffPostgresRole(declared, stored, {}, row(false, false))),
+  ).toEqual({
+    action: 'noop',
+  });
+  const stuffed = {
+    ...stored,
+    memberships: [{ parent: 'parent', grantor: 'postgres', inherit: true, admin: true, set: true }],
+  };
+  expect(await Effect.runPromise(diffPostgresRole(declared, stuffed))).toEqual({ action: 'noop' });
+});