plume 0.2.0 → 0.3.0

data/lib/plume/analysis/resolver.rb

@@ -19,18 +19,18 @@ module Plume
 				def self.table(name, table, node) = new(name:, kind: :table, schema: table.schema, table:, columns: table.columns, node:)
 
 				def matches?(qualifier, schema_qualifier)
-					return false unless name&.casecmp?(qualifier)
+					return false unless name&.casecmp(qualifier)&.zero?
 					return true unless schema_qualifier
 
-					schema&.casecmp?(schema_qualifier) || (schema.nil? && schema_qualifier.casecmp?("main"))
+					schema&.casecmp(schema_qualifier)&.zero? || (schema.nil? && schema_qualifier.casecmp("main")&.zero?)
 				end
 
 				def column(name)
 					return unless columns
 					return table.column(name) if table
 
-					needle = name.downcase
-					columns.find { |c| c&.downcase == needle }
+					needle = name.downcase(:ascii)
+					columns.find { |c| c&.downcase(:ascii) == needle }
 				end
 			end
 
@@ -53,10 +53,19 @@ module Plume
 				"json_tree" => JSON_TABLE_COLUMNS,
 				"jsonb_each" => JSON_TABLE_COLUMNS,
 				"jsonb_tree" => JSON_TABLE_COLUMNS,
-				"generate_series" => %w[value start stop step],
+				"generate_series" => %w[value start stop step].freeze,
 			}.freeze
 
-			STATEMENTS = [SelectStatement, InsertStatement, UpdateStatement, DeleteStatement].freeze
+			STATEMENTS = [SelectStatement, InsertStatement, UpdateStatement, DeleteStatement, CreateTriggerStatement].freeze # analyzed for reads and writes
+
+			# What SQLite calls for these operators and keywords, as its authorizer names them
+			OPERATOR_FUNCTIONS = {
+				LIKE: "like", NOT_LIKE: "like", GLOB: "glob", NOT_GLOB: "glob", REGEXP: "regexp", NOT_REGEXP: "regexp",
+				MATCH: "match", NOT_MATCH: "match", EXTRACT: "->", RETRIEVE: "->>",
+			}.freeze
+
+			# SQLite's own limit, which also keeps resolving names across a join from going quadratic
+			MAX_JOIN_TABLES = 64
 
 			def initialize(catalog: nil)
 				@catalog = catalog
@@ -70,9 +79,12 @@ module Plume
 				when InsertStatement then insert(statement)
 				when UpdateStatement then update(statement)
 				when DeleteStatement then delete(statement)
+				when CreateTriggerStatement then trigger(statement)
+				when ExplainStatement then return analyze(statement.statement)
+				else schema_statement(statement)
 				end
 
-				Access.new(reads: @reads, writes: @writes)
+				Access.new(reads: @reads, writes: @writes, actions: @actions.freeze)
 			end
 
 			# Names of the columns a select produces, nil for the ones we cannot name
@@ -85,7 +97,8 @@ module Plume
 
 			def start(statement)
 				@reads = Reads.new(statement)
-				@writes = Writes.new(statement, @reads.unresolved)
+				@writes = Writes.new(statement, @reads.unresolved, @reads.ctes, @reads.aliases)
+				@actions = []
 				# By identity: a view holds its parsed select, and hashing that hashes the whole tree
 				@expanding_views = Set.new.compare_by_identity
 			end
@@ -93,15 +106,16 @@ module Plume
 			def with_scope(with_clause, parent)
 				scope = Scope.new(sources: [], parent:, ctes: {})
 				with_clause&.ctes&.each do |cte|
-					scope.ctes[cte.name.downcase] = Cte.new(node: cte, scope:, analyzed: Set.new)
+					scope.ctes[cte.name.downcase(:ascii)] = Cte.new(node: cte, scope:, analyzed: Set.new)
+					@reads.ctes << cte.name if @expanding_views.empty?
 				end
 				scope
 			end
 
 			# -- INSERT, UPDATE, DELETE
 
-			def insert(statement)
-				outer = with_scope(statement.with_clause, nil)
+			def insert(statement, parent: nil)
+				outer = with_scope(statement.with_clause, parent)
 				# The rows being inserted cannot see the target table, upserts and RETURNING can
 				select(statement.select, parent: outer, usage: :projected) if statement.select
 
@@ -113,7 +127,8 @@ module Plume
 				elsif statement.columns
 					statement.columns.each { |column| write(target, column.column, :insert, column) }
 				elsif target&.columns
-					target.columns.each { |column| write(target, column, :insert, statement.table) }
+					# A VALUES row without a column list has no slot for generated columns
+					(target.columns - (target.table&.generated_columns || [])).each { |column| write(target, column, :insert, statement.table) }
 				else
 					write(target, "*", :insert, statement.table)
 				end
@@ -131,11 +146,15 @@ module Plume
 				returning(statement.returning, scope, target)
 			end
 
-			def update(statement)
-				outer = with_scope(statement.with_clause, nil)
+			def update(statement, parent: nil)
+				outer = with_scope(statement.with_clause, parent)
 				scope = Scope.new(sources: [], parent: outer, ctes: {}, aliases: {})
 				target = add_target(statement.table, scope)
-				add_source(statement.source, scope, :projected) if statement.source
+				if statement.source
+					# Pairing the target's rows with FROM's reads the target, named columns or not
+					record(target.schema, target.table&.name || statement.table.table, nil, :referenced, statement.table) if target&.kind == :table
+					add_from(statement.source, scope, :projected)
+				end
 
 				assign(statement.assignments, target, scope)
 				expression(statement.condition, scope, :referenced)
@@ -143,8 +162,8 @@ module Plume
 				tail(statement, scope)
 			end
 
-			def delete(statement)
-				outer = with_scope(statement.with_clause, nil)
+			def delete(statement, parent: nil)
+				outer = with_scope(statement.with_clause, parent)
 				scope = Scope.new(sources: [], parent: outer, ctes: {}, aliases: {})
 				target = add_target(statement.table, scope)
 
@@ -154,6 +173,184 @@ module Plume
 				tail(statement, scope)
 			end
 
+			# -- schema changes and the rest
+
+			def schema_statement(statement)
+				case statement
+				when CreateTableStatement
+					schema = new_schema(statement.table, statement.temporary)
+					act(:create_table, temp: schema, name: statement.table.name, node: statement)
+					Catalog.autoindexes(statement).each { |index| act(:create_index, temp: schema, name: index, detail: statement.table.name, node: statement) }
+					select(statement.select_statement, parent: nil, usage: :projected) if statement.select_statement
+				when CreateViewStatement
+					# SQLite checks a view's body when the view is used, not when it is made
+					act(:create_view, temp: new_schema(statement.view, statement.temporary), name: statement.view.name, node: statement)
+				when CreateIndexStatement then create_index(statement)
+				when CreateVirtualTableStatement
+					act(:create_vtable, name: statement.table.name, detail: statement.module_name, schema: new_schema(statement.table, false), node: statement)
+				when DropStatement then drop(statement)
+				when AlterTableStatement
+					table = @catalog&.table(statement.table.table, schema: statement.table.schema)
+					detail = statement.column if statement.action == :DROP_COLUMN
+					act(:alter_table, name: table&.name || statement.table.table, detail:, schema: table&.schema || statement.table.schema || "main", node: statement)
+				when PragmaStatement
+					act(:pragma, name: statement.name, detail: pragma_value(statement), schema: statement.schema, node: statement)
+				when BeginStatement then act(:transaction, name: "BEGIN", node: statement)
+				when CommitStatement then act(:transaction, name: "COMMIT", node: statement)
+				when RollbackStatement
+					if statement.savepoint
+						act(:savepoint, name: "ROLLBACK", detail: statement.savepoint, node: statement)
+					else
+						act(:transaction, name: "ROLLBACK", node: statement)
+					end
+				when SavepointStatement then act(:savepoint, name: "BEGIN", detail: statement.name, node: statement)
+				when ReleaseStatement then act(:savepoint, name: "RELEASE", detail: statement.name, node: statement)
+				when AttachStatement then act(:attach, name: plain_value(statement.file), node: statement)
+				when DetachStatement then act(:detach, name: plain_value(statement.schema), node: statement)
+				when ReindexStatement then reindex(statement)
+				when AnalyzeStatement then analyze_tables(statement)
+				end
+			end
+
+			def create_index(statement)
+				schema = statement.index.schema
+				table_node = TableName.new(schema:, table: statement.table)
+				act(:create_index, temp: new_schema(statement.index, false, on: table_node), name: statement.index.name, detail: statement.table, node: statement)
+				scope = Scope.new(sources: [], parent: nil, ctes: {}, aliases: {})
+				add_table_source(table_node, scope, :referenced)
+				# The table's rows are read to fill the index, which only an authorizer sees as columns
+				@reads.references.pop if @reads.references.last&.column.nil?
+				statement.columns&.each { |term| expression(term.expression, scope, :referenced) }
+				expression(statement.condition, scope, :referenced)
+				act(:reindex, name: statement.index.name, schema: @actions.last.schema, node: statement)
+			end
+
+			def drop(statement)
+				target = statement.target
+				case statement.type
+				when :TABLE
+					table = @catalog&.table(target.table, schema: target.schema)
+					if table&.module_name
+						act(:drop_vtable, name: table.name, detail: table.module_name, schema: table.schema, node: statement)
+					else
+						act(:drop_table, temp: table&.schema || target.schema || "main", name: table&.name || target.table, node: statement)
+					end
+					@writes.references << Reference.new(schema: table&.schema || target.schema, table: table&.name || target.table, column: nil, usage: :delete, node: statement)
+					drop_triggers(table, statement)
+				when :VIEW
+					view = @catalog&.view(target.table, schema: target.schema)
+					act(:drop_view, temp: view&.schema || target.schema || "main", name: view&.name || target.table, node: statement)
+					drop_triggers(view, statement)
+				when :INDEX
+					index = @catalog&.index(target.table, schema: target.schema)
+					act(:drop_index, temp: index&.schema || target.schema || "main", name: index&.name || target.table, detail: index&.table, node: statement)
+				when :TRIGGER
+					trigger = @catalog&.trigger(target.table, schema: target.schema)
+					act(:drop_trigger, temp: trigger&.schema || target.schema || "main", name: trigger&.name || target.table, detail: trigger&.table, node: statement)
+				end
+			end
+
+			# Dropping a table or view drops its triggers, newest first
+			def drop_triggers(object, statement)
+				return unless object
+
+				triggers = @catalog.triggers.select { |t| Catalog.same_name?(t.schema, object.schema) && Catalog.same_name?(t.table, object.name) }
+				triggers.reverse_each { |t| act(:drop_trigger, temp: t.schema, name: t.name, detail: t.table, node: statement) }
+			end
+
+			# `temp:` takes the schema and makes the action its _temp_ variant when that schema is temp
+			def act(action, node:, name: nil, detail: nil, schema: nil, temp: nil)
+				if temp
+					schema = temp
+					action = action.name.sub(/\A(create|drop)_/) { "#{$1}_temp_" }.to_sym if Catalog.same_name?(temp, "temp")
+				end
+				@actions << Action.new(action:, name:, detail:, schema:, node:)
+			end
+
+			# Where a new object goes: the schema it names, temp for TEMP, or the schema of the table it is on
+			def new_schema(name, temporary, on: nil)
+				return name.schema if name.schema
+				return "temp" if temporary
+				return @catalog&.table(on.table)&.schema || "main" if on
+
+				"main"
+			end
+
+			# REINDEX names an index, a table whose indexes to rebuild, or a collation - and SQLite's
+			# authorizer is asked about each index rebuilt. Without a catalog only a name is known
+			def reindex(statement)
+				target = statement.target
+				return target && act(:reindex, name: target.table, schema: target.schema || "main", node: statement) unless @catalog
+
+				indexes =
+					if target.nil? then @catalog.indexes
+					elsif (index = @catalog.index(target.table, schema: target.schema)) then [index]
+					elsif (table = @catalog.table(target.table, schema: target.schema))
+						@catalog.indexes.select { |i| i.schema == table.schema && Catalog.same_name?(i.table, table.name) }
+					else
+						[]
+					end
+				indexes.each { |i| act(:reindex, name: i.name, schema: i.schema, node: statement) }
+			end
+
+			# ANALYZE names a table, an index, a schema, or nothing for every schema but temp
+			def analyze_tables(statement)
+				target = statement.target
+				return target && act(:analyze, name: target.table, schema: target.schema || "main", node: statement) unless @catalog
+
+				tables =
+					if target.nil? then @catalog.tables.reject { |t| Catalog.same_name?(t.schema, "temp") }
+					elsif (table = @catalog.table(target.table, schema: target.schema)) then [table]
+					elsif (index = @catalog.index(target.table, schema: target.schema)) then [@catalog.table(index.table, schema: index.schema)].compact
+					elsif target.schema.nil? then @catalog.tables.select { |t| Catalog.same_name?(t.schema, target.table) }
+					else
+						[]
+					end
+				tables.each { |t| act(:analyze, name: t.name, schema: t.schema, node: statement) unless t.module_name }
+			end
+
+			# SQLite hands the authorizer a PRAGMA's value as text, unquoted and without a plus sign
+			def pragma_value(statement)
+				src = statement.value_tk_src or return
+				(src.match?(/\A['"]/) ? statement.value_tk_val.to_s : src.delete_prefix("+"))
+			end
+
+			# ATTACH and DETACH name a file or schema with any expression; a plain string or name is told
+			def plain_value(node)
+				case node
+				when LiteralExpression then node.value.to_s
+				when ColumnName then node.column
+				end
+			end
+
+			# What a trigger's WHEN and body read and write each time it fires. NEW and OLD stand for
+			# the row of the table it is on, and reading them reads that table, as SQLite's authorizer has it
+			def trigger(statement)
+				on_schema = @catalog&.table(statement.table.table, schema: statement.table.schema)&.schema
+				act(:create_trigger, temp: statement.trigger.schema || (statement.temporary ? "temp" : on_schema || "main"), name: statement.trigger.name, detail: statement.table.table, node: statement)
+				scope = Scope.new(sources: [], parent: nil, ctes: {}, aliases: {})
+				if (on = trigger_table(statement.table))
+					rows = [("new" unless statement.event == :DELETE), ("old" unless statement.event == :INSERT)].compact
+					rows.each { |name| scope.sources << on.dup.tap { |row| row.name, row.qualified_only = name, true } }
+				end
+
+				expression(statement.condition, scope, :referenced)
+				statement.statements.each do |body|
+					case body
+					when SelectStatement then select(body, parent: scope, usage: :projected)
+					when InsertStatement then insert(body, parent: scope)
+					when UpdateStatement then update(body, parent: scope)
+					when DeleteStatement then delete(body, parent: scope)
+					end
+				end
+			end
+
+			# The table or view a trigger is on, which it neither reads nor writes by being on it
+			def trigger_table(node)
+				scope = Scope.new(sources: [], parent: nil, ctes: {}, aliases: {})
+				add_target(node, scope)
+			end
+
 			# Assigned values end up in the table, so whatever they read counts as projected
 			def assign(assignments, target, scope)
 				assignments&.each do |assignment|
@@ -185,6 +382,7 @@ module Plume
 			# writing to it is not a read, so it joins the scope without recording one
 			def add_target(node, scope)
 				name = node.alias || node.table
+				alias_of(node.alias, node.schema, node.table)
 				source =
 					if @catalog.nil?
 						Source.new(name:, kind: :table, schema: node.schema, node:)
@@ -208,6 +406,8 @@ module Plume
 				if target.table
 					if column && column != "*"
 						canonical = target.column(column)
+						# SQLite's authorizer names a write to the rowid "ROWID" however it was spelled, alias or not
+						canonical ||= "ROWID" if Catalog::ROWID_NAMES.include?(column.downcase(:ascii)) && target.table.rowid?
 						return unresolved(column, "no such column in #{target.table.name}", node) unless canonical
 
 						column = canonical
@@ -249,10 +449,10 @@ module Plume
 					return [Array.new(width) { |i| "column#{i + 1}" }, scope]
 				end
 
-				add_source(core.source, scope, usage) if core.source
+				add_from(core.source, scope, usage) if core.source
 
 				core.columns.each do |column|
-					scope.aliases[column.alias.downcase] = column.result if ResultColumn === column && column.alias
+					scope.aliases[column.alias.downcase(:ascii)] = column.result if ResultColumn === column && column.alias
 				end
 
 				names = []
@@ -288,6 +488,14 @@ module Plume
 
 			# -- FROM
 
+			def add_from(source, scope, usage)
+				add_source(source, scope, usage)
+				tables = scope.sources.sum { |s| join_tables(s) }
+				raise Error, "at most #{MAX_JOIN_TABLES} tables in a join" if tables > MAX_JOIN_TABLES
+			end
+
+			def join_tables(source) = (source.kind == :group) ? source.inner_sources.sum { |s| join_tables(s) } : 1
+
 			def add_source(source, scope, usage)
 				case source
 				when JoinClause
@@ -299,6 +507,7 @@ module Plume
 					end
 				when TableName then add_table_source(source, scope, usage)
 				when TableFunction
+					alias_of(source.alias, source.schema, source.function)
 					source.arguments&.each { |a| expression(a, scope, :referenced) }
 					# Any virtual table can be called like this, `fts('query')` reads the fts table
 					if @catalog && (table = @catalog.table(source.function, schema: source.schema))
@@ -307,10 +516,10 @@ module Plume
 						return
 					end
 
-					@reads.functions << source.function.downcase
+					@reads.functions << source.function.downcase(:ascii)
 					scope.sources << Source.new(
 						name: source.alias || source.function, kind: :function,
-						columns: FUNCTION_COLUMNS[source.function.downcase], node: source,
+						columns: FUNCTION_COLUMNS[source.function.downcase(:ascii)], node: source,
 					)
 				when SubquerySource
 					# A FROM subquery sees the enclosing queries, but not its siblings in this FROM
@@ -329,6 +538,7 @@ module Plume
 
 			def add_table_source(source, scope, usage)
 				name = source.alias || source.table
+				alias_of(source.alias, source.schema, source.table)
 
 				if source.schema.nil? && (cte = find_cte(source.table, scope))
 					columns = analyze_cte(cte, usage)
@@ -357,7 +567,7 @@ module Plume
 			end
 
 			def find_cte(name, scope)
-				needle = name.downcase
+				needle = name.downcase(:ascii)
 				scope.each_up do |s|
 					return s.ctes[needle] if s.ctes&.key?(needle)
 				end
@@ -401,7 +611,7 @@ module Plume
 					left = left_sources.find { |s| s.column(column) } || left_sources.find { |s| s.columns.nil? }
 					read_through(left, column, :referenced, join) if left
 					read_through(right, column, :referenced, join)
-					(right.merged ||= Set.new) << column.downcase
+					(right.merged ||= Set.new) << column.downcase(:ascii)
 				end
 			end
 
@@ -435,12 +645,12 @@ module Plume
 						record(source.schema, source.node.table, "*", usage, node)
 						nil
 					else
-						columns = source.columns.reject { |c| skip_merged && source.merged&.include?(c.downcase) }
+						columns = source.columns.reject { |c| skip_merged && source.merged&.include?(c.downcase(:ascii)) }
 						columns.each { |c| record(source.table.schema, source.table.name, c, usage, node) }
 						columns
 					end
 				else
-					source.columns&.reject { |c| skip_merged && c && source.merged&.include?(c.downcase) }
+					source.columns&.reject { |c| skip_merged && c && source.merged&.include?(c.downcase(:ascii)) }
 				end
 			end
 
@@ -448,11 +658,20 @@ module Plume
 
 			def expression(node, scope, usage, aliases: :none)
 				case node
-				when nil, Variable, LiteralExpression then nil
+				when nil, Variable then nil
+				when LiteralExpression
+					@reads.calls << node.value.name.downcase if node.value in :CURRENT_DATE | :CURRENT_TIME | :CURRENT_TIMESTAMP
 				when ColumnName then column(node, scope, usage, aliases)
+				when FunctionReference
+					@reads.calls << node.function.downcase(:ascii)
+					node.children.each { |child| expression(child, scope, usage, aliases:) }
 				when SelectStatement then select(node, parent: scope, usage:)
 				when TableName then whole_table(node, scope)
-				when Node then node.children.each { |child| expression(child, scope, usage, aliases:) }
+				when Node
+					if node.respond_to?(:operator) && (function = OPERATOR_FUNCTIONS[node.operator])
+						@reads.calls << function
+					end
+					node.children.each { |child| expression(child, scope, usage, aliases:) }
 				end
 			end
 
@@ -475,11 +694,11 @@ module Plume
 					return unresolved(qualified_name(node), "no such table: #{node.table}", node)
 				end
 
-				return if aliases == :first && scope.aliases&.key?(name.downcase)
+				return if aliases == :first && scope.aliases&.key?(name.downcase(:ascii))
 
 				scope.each_up do |s|
 					return if resolve_in(s, name, usage, node)
-					return if s.equal?(scope) && aliases == :fallback && s.aliases&.key?(name.downcase)
+					return if s.equal?(scope) && aliases == :fallback && s.aliases&.key?(name.downcase(:ascii))
 					return if rowid(s, name, usage, node)
 				end
 
@@ -498,7 +717,7 @@ module Plume
 					read_through(known.first, name, usage, node)
 				elsif known.size > 1 && unknown.empty?
 					# A USING/NATURAL column belongs to both sides and is not ambiguous
-					merged = known.select { |s| s.merged&.include?(name.downcase) }
+					merged = known.select { |s| s.merged&.include?(name.downcase(:ascii)) }
 					if merged.any?
 						read_through((known - merged).first || known.first, name, usage, node)
 					else
@@ -527,7 +746,7 @@ module Plume
 			end
 
 			def rowid(scope, name, usage, node)
-				return false unless Catalog::ROWID_NAMES.include?(name.downcase)
+				return false unless Catalog::ROWID_NAMES.include?(name.downcase(:ascii))
 
 				candidates = scope.sources.select { |s| s.kind == :table && (s.table.nil? || s.table.rowid?) }
 				return false unless candidates.size == 1
@@ -541,7 +760,7 @@ module Plume
 				when :table
 					if source.table
 						column = source.table.column(name)
-						column ||= source.table.rowid_alias || "rowid" if Catalog::ROWID_NAMES.include?(name.downcase) && source.table.rowid?
+						column ||= source.table.rowid_alias || "rowid" if Catalog::ROWID_NAMES.include?(name.downcase(:ascii)) && source.table.rowid?
 						return unresolved(name, "no such column in #{source.table.name}", node) unless column
 
 						record(source.table.schema, source.table.name, column, usage, node)
@@ -559,6 +778,10 @@ module Plume
 				true
 			end
 
+			def alias_of(name, schema, table)
+				@reads.aliases[name] = Analysis.table_key(schema, table) if name && @expanding_views.empty?
+			end
+
 			def record(schema, table, column, usage, node)
 				@reads.references << Reference.new(schema:, table:, column:, usage:, node:)
 			end

data/lib/plume/analysis.rb

@@ -2,7 +2,8 @@
 
 module Plume
 	# Static analysis on top of the AST. The first question it answers is "which tables and
-	# columns would this statement read?", see `Plume.reads`.
+	# columns would this statement read?", see `Plume.reads`; the second is what it would
+	# write, see `Plume.writes`.
 	module Analysis
 		autoload :Resolver, "plume/analysis/resolver"
 
@@ -42,16 +43,21 @@ module Plume
 		# Tables in the main schema are keyed by their bare name, any other schema
 		# (temp, attached databases) is spelled out as "schema.table"
 		def self.table_key(schema, table)
-			(schema.nil? || schema.casecmp?("main")) ? table : "#{schema}.#{table}"
+			(schema.nil? || schema.casecmp("main")&.zero?) ? table : "#{schema}.#{table}"
 		end
 
 		class References
-			attr_reader :statement, :references, :unresolved
+			# `ctes` are the names the statement's WITH clauses define, `aliases` maps each table alias
+			# to the table, view, CTE or function it stands for - all spelled as written, and none from
+			# inside the views read. Reads and Writes of one statement share them
+			attr_reader :statement, :references, :unresolved, :ctes, :aliases
 
-			def initialize(statement, unresolved = [])
+			def initialize(statement, unresolved = [], ctes = Set.new, aliases = {})
 				@statement = statement
 				@references = []
 				@unresolved = unresolved
+				@ctes = ctes
+				@aliases = aliases
 			end
 
 			# Every base table touched, including ones touched only as a whole
@@ -74,12 +80,16 @@ module Plume
 		end
 
 		class Reads < References
-			attr_reader :views, :functions
+			# `functions` are the table-valued ones in FROM, `calls` every other function called -
+			# including those LIKE, GLOB, REGEXP, MATCH, `->`, `->>` and CURRENT_* call - as SQLite's
+			# authorizer reports them
+			attr_reader :views, :functions, :calls
 
 			def initialize(...)
 				super
 				@views = Set.new
 				@functions = Set.new
+				@calls = Set.new
 			end
 
 			def projected = columns(:projected)
@@ -93,7 +103,47 @@ module Plume
 			def deleted = tables(:delete)
 		end
 
-		Access = Data.define(:reads, :writes) do
+		# What a run of statements reads, writes and does, as `Plume.summary` gives it. `accesses` has one
+		# entry per statement, the rest is merged across them
+		class Summary
+			attr_reader :statements, :accesses
+
+			def initialize(statements, accesses)
+				@statements = statements
+				@accesses = accesses
+			end
+
+			# Each statement's node class, like "SelectStatement" or "CreateTableStatement"
+			def statement_types = @statements.map { |s| s.class.name.delete_prefix("Plume::") }
+
+			# Every base table read or written, or only those touched in one way: `:projected`,
+			# `:referenced`, `:insert`, `:update` or `:delete`
+			def tables(usage = nil) = each_side.reduce(Set.new) { |all, refs| all | refs.tables(usage) }
+
+			def reads = @accesses.map(&:reads)
+			def writes = @accesses.map(&:writes)
+			def actions = @accesses.flat_map(&:actions)
+			def views = union(reads, :views)
+			def functions = union(reads, :functions)
+			def calls = union(reads, :calls)
+			def ctes = union(reads, :ctes)
+			def aliases = reads.reduce({}) { |all, r| all.merge(r.aliases) }
+			def unresolved = reads.flat_map(&:unresolved)
+			def resolved? = unresolved.empty?
+
+			private
+
+			def each_side = reads + writes
+			def union(list, name) = list.reduce(Set.new) { |all, r| all | r.public_send(name) }
+		end
+
+		# Something a statement does besides reading and writing rows, named as SQLite's authorizer
+		# names it: `action` is its action code as a symbol (`:create_table`, `:drop_temp_index`,
+		# `:alter_table`, `:pragma`, `:transaction`…), and `name`, `detail` and `schema` are the
+		# arguments the authorizer gets with it - for `:create_index`, the index, its table and the schema
+		Action = Data.define(:action, :name, :detail, :schema, :node)
+
+		Access = Data.define(:reads, :writes, :actions) do
 			def unresolved = reads.unresolved
 			def resolved? = reads.resolved?
 		end
@@ -111,25 +161,51 @@ module Plume
 		# `Plume::Analysis::Error`; with `strict: false` it is listed in `Reads#unresolved` instead.
 		def self.reads(sql, catalog: nil, strict: true) = access(sql, catalog:, strict:).reads
 
-		# Like `reads`, but also reports what an INSERT, UPDATE or DELETE writes
+		# Which tables and columns an INSERT, UPDATE or DELETE would write, with the same arguments
+		# and strictness as `reads`. A SELECT writes nothing. The triggers a statement fires are not looked into, so rows
+		# they write elsewhere - or the rows a REPLACE deletes - are not reported.
+		def self.writes(sql, catalog: nil, strict: true) = access(sql, catalog:, strict:).writes
+
+		# Like `reads`, but also reports what an INSERT, UPDATE or DELETE writes, and in `actions` what
+		# any other statement does - creating, dropping and altering things, pragmas, transactions. A
+		# CREATE TRIGGER is analyzed for what its WHEN and body do each time it fires, a CREATE TABLE … AS
+		# reads what its SELECT reads, a CREATE INDEX reads what it indexes, DROP TABLE deletes the rows
 		def self.access(sql, catalog: nil, strict: true)
-			statements =
-				case sql
-				when Node then [sql]
-				when Array then sql
-				else Parser.new(sql).parse
-				end
+			statements = statements(sql)
 			raise Error, "expected exactly one statement, got #{statements.size}" unless statements.size == 1
 
 			statement = statements.first
-			unless Resolver::STATEMENTS.any? { |klass| klass === statement }
-				raise Error, "only SELECT, INSERT, UPDATE and DELETE can be analyzed, got #{statement.class.name}"
+			access = begin
+				Resolver.new(catalog:).analyze(statement)
+			rescue *STACK_EXHAUSTED
+				# As with parsing, how deep the resolver can go depends on the stack the caller has left
+				raise Error, "statement nested too deeply"
 			end
-
-			access = Resolver.new(catalog:).analyze(statement)
 			raise Error.new(unresolved: access.unresolved) if strict && !access.resolved?
 
 			access
 		end
+
+		# Reads and writes for any number of statements, a migration or a whole log line - with the
+		# same arguments as `access`. Each statement sees the schema as the statements before it left
+		# it: a copy of the catalog is changed as they create, alter and drop things, and the catalog
+		# passed in stays as it was
+		def self.summary(sql, catalog: nil, strict: true)
+			statements = statements(sql)
+			catalog = catalog&.dup
+			accesses = statements.map do |statement|
+				access(statement, catalog:, strict:).tap { catalog&.apply(statement) }
+			end
+			Summary.new(statements, accesses)
+		end
+
+		def self.statements(sql)
+			case sql
+			when Node then [sql]
+			when Array then sql
+			else Parser.new(sql).parse
+			end
+		end
+		private_class_method :statements
 	end
 end