@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/src/postgres/providers/rds.ts

@@ -0,0 +1,48 @@
+import { words, COMMON_REFUSED, type ProviderData } from "./types";
+
+/**
+ * Amazon RDS for PostgreSQL. The extension list is the table for major 18 on
+ * the "Extensions supported for RDS for PostgreSQL" page, read 2026-10-03;
+ * the other majors differ at the edges and are not modelled (the list is the
+ * newest GA major's). Package names on that page were mapped to extension
+ * names: pgvector is `vector`, h3-pg is `h3` and `h3_postgis`.
+ */
+export const rds: ProviderData = {
+  provider: "rds",
+  label: "Amazon RDS for PostgreSQL",
+  sources: [
+    {
+      url: "https://docs.aws.amazon.com/AmazonRDS/latest/PostgreSQLReleaseNotes/postgresql-extensions.html",
+      readOn: "2026-10-03",
+      covers: "allowedExtensions (major 18 table)",
+    },
+    {
+      url: "https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.Roles.html",
+      readOn: "2026-10-03",
+      covers: "the master user is a member of rds_superuser, not a superuser",
+    },
+  ],
+  reservedRoles: ["rdsadmin", "rds_superuser", "rds_replication", "rds_password", "rds_iam", "rds_ad", "rdsrepladmin"],
+  reservedSchemas: [],
+  allowedExtensions: words(`
+    address_standardizer address_standardizer_data_us amcheck auto_explain aws_commons aws_lambda aws_s3 bloom
+    btree_gin btree_gist citext cube dblink dict_int dict_xsyn earthdistance fuzzystrmatch h3 h3_postgis hll hstore
+    hstore_plperl hypopg intagg intarray ip4r isn lo log_fdw ltree mysql_fdw oracle_fdw orafce pageinspect pg_bigm
+    pg_buffercache pg_cron pg_freespacemap pg_hint_plan pg_logicalinspect pg_partman pg_prewarm pg_proctab pg_repack
+    pg_similarity pg_stat_monitor pg_stat_statements pg_tle pg_transport pg_trgm pg_visibility pg_walinspect pgaudit
+    pgcrypto pglogical pgrouting pgrowlocks pgstattuple pgtap plperl plpgsql plprofiler pltcl plv8 postgis
+    postgis_raster postgis_tiger_geocoder postgis_topology postgres_fdw prefix rdkit roaringbitmap seg sslinfo
+    tablefunc tcn tds_fdw tsm_system_rows tsm_system_time unaccent uuid-ossp vector wal2json
+  `),
+  extensionListComplete: true,
+  providerExtensions: ["aws_commons", "aws_lambda", "aws_s3", "rds_tools", "log_fdw", "pg_transport"],
+  refusedStatements: [
+    ...COMMON_REFUSED,
+    { id: "create-tablespace-location", pattern: /^CREATE TABLESPACE\b/, reason: "RDS refuses tablespaces on a customer-chosen LOCATION" },
+  ],
+  toCheck: [
+    "reservedRoles beyond rds_superuser were not read from a page: https://docs.aws.amazon.com/AmazonRDS/latest/UserGuide/Appendix.PostgreSQL.CommonDBATasks.Roles.html",
+    "refusedStatements beyond the common three are from the documented master-user model, not a statement list",
+    "per-major differences in the extension list",
+  ],
+};

package/src/postgres/providers/supabase.ts

@@ -0,0 +1,46 @@
+import { words, type ProviderData } from "./types";
+
+/**
+ * Supabase. The extension names are the ones the extensions overview's
+ * sidebar documents (plv8, pgjwt, timescaledb and pgsodium are marked
+ * deprecated there and left out), read 2026-10-03. The overview's full list
+ * is rendered by script and could not be read, so the list is partial:
+ * `extensionListComplete` is false and SQLPG004 does not report a name
+ * outside it. Roles are the "Supabase roles" section of the roles page. The
+ * unsupported operations are the two the roles-and-superuser page names.
+ */
+export const supabase: ProviderData = {
+  provider: "supabase",
+  label: "Supabase",
+  sources: [
+    { url: "https://supabase.com/docs/guides/database/extensions", readOn: "2026-10-03", covers: "allowedExtensions (partial: the documented extension pages)" },
+    { url: "https://supabase.com/docs/guides/database/postgres/roles", readOn: "2026-10-03", covers: "reservedRoles; auth, storage and etl schemas" },
+    {
+      url: "https://raw.githubusercontent.com/supabase/supabase/master/apps/docs/content/guides/database/postgres/roles-superuser.mdx",
+      readOn: "2026-10-03",
+      covers: "superuser-only statements (the source of https://supabase.com/docs/guides/database/postgres/roles-superuser)",
+    },
+  ],
+  reservedRoles: [
+    "postgres", "anon", "authenticator", "authenticated", "service_role", "supabase_auth_admin",
+    "supabase_storage_admin", "supabase_etl_admin", "dashboard_user", "supabase_admin",
+  ],
+  reservedSchemas: ["auth", "storage", "etl"],
+  allowedExtensions: words(`
+    hypopg http index_advisor pgaudit pgroonga pgrouting pg_cron pg_graphql pg_hashids pg_jsonschema pg_net
+    pg_partman pg_plan_filter postgres_fdw vector pg_stat_statements pg_repack postgis pgmq pgtap plpgsql_check
+    uuid-ossp rum
+  `),
+  extensionListComplete: false,
+  providerExtensions: ["pg_graphql", "pg_net", "pgmq", "index_advisor"],
+  refusedStatements: [
+    { id: "copy-program", pattern: /^COPY\b.*\b(FROM|TO) PROGRAM\b/, reason: "COPY ... FROM PROGRAM needs a superuser, which Supabase does not give out" },
+    { id: "superuser-role", pattern: /^(CREATE|ALTER) (ROLE|USER)\b.*\bSUPERUSER\b/, reason: "the SUPERUSER attribute cannot be granted on Supabase" },
+  ],
+  toCheck: [
+    "the full extension list (page body is script-rendered): https://supabase.com/docs/guides/database/extensions",
+    "reservedSchemas beyond auth, storage and etl (extensions, realtime, graphql, graphql_public, vault, net, supabase_functions, pgbouncer were not read from a page): https://supabase.com/docs/guides/database/postgres/roles",
+    "refused statements beyond the two the roles-and-superuser page lists (ALTER SYSTEM was not stated): https://supabase.com/docs/guides/database/postgres/roles-superuser",
+    "providerExtensions are inferred from the extension pages' names, not from a statement of ownership",
+  ],
+};

package/src/postgres/providers/types.ts

@@ -0,0 +1,70 @@
+/**
+ * What the Postgres dialect knows about a managed provider (#3282): the
+ * roles and schemas the provider owns, the extensions it lets a customer
+ * create, and the statements it refuses because they need a superuser.
+ *
+ * The lists are data, one file per provider, each citing the page it was read
+ * from and the date it was read. A provider changes its lists without
+ * announcing it, so a list is a snapshot, not a contract: an extension a
+ * provider added since is reported by SQLPG004 as not allowed until the list
+ * is refreshed, and `toCheck` names what a file did not verify.
+ */
+
+/** The providers the dialect has data for. */
+export const POSTGRES_PROVIDERS = ["rds", "aurora", "cloud-sql", "azure", "neon", "supabase"] as const;
+
+export type PostgresProvider = (typeof POSTGRES_PROVIDERS)[number];
+
+/** A documentation page a provider's data was read from. */
+export interface ProviderSource {
+  url: string;
+  /** ISO date the page was read. */
+  readOn: string;
+  /** What the page was used for. */
+  covers: string;
+}
+
+/** A statement the provider refuses, matched on the statement's text with comments and string contents removed. */
+export interface RefusedStatement {
+  id: string;
+  /** Tested against the upper-cased statement with whitespace collapsed. */
+  pattern: RegExp;
+  reason: string;
+}
+
+export interface ProviderData {
+  provider: PostgresProvider;
+  /** The provider's name as its documentation spells it. */
+  label: string;
+  sources: readonly ProviderSource[];
+  /** Roles the provider creates and owns; a declared role of this name is refused or foreign. */
+  reservedRoles: readonly string[];
+  /** Schemas the provider creates and owns. */
+  reservedSchemas: readonly string[];
+  /** Extensions the provider lets a customer create (`CREATE EXTENSION name`). */
+  allowedExtensions: readonly string[];
+  /**
+   * Whether `allowedExtensions` is the provider's whole list. When false the
+   * list is what a page named and SQLPG004 stays silent about a name outside
+   * it, because the page that has the full list could not be read.
+   */
+  extensionListComplete: boolean;
+  /** Extensions the provider installs and owns; objects they create are the provider's. */
+  providerExtensions: readonly string[];
+  refusedStatements: readonly RefusedStatement[];
+  /** What the data file did not verify against a page, each with the URL to check. */
+  toCheck: readonly string[];
+}
+
+/** The `sql.provider` setting, as a profile or the namespace holds it. */
+export type ProviderSetting = PostgresProvider;
+
+/** Split a whitespace-separated list, so a long extension list stays readable in source. */
+export const words = (s: string): string[] => s.split(/\s+/).filter(Boolean);
+
+/** Statements that need the superuser every managed provider withholds. */
+export const COMMON_REFUSED: readonly RefusedStatement[] = [
+  { id: "alter-system", pattern: /^ALTER SYSTEM\b/, reason: "ALTER SYSTEM writes postgresql.auto.conf, which a managed service owns; use the provider's parameter settings" },
+  { id: "copy-program", pattern: /^COPY\b.*\b(FROM|TO) PROGRAM\b/, reason: "COPY ... PROGRAM runs a command on the host, which the provider does not give out" },
+  { id: "superuser-role", pattern: /^(CREATE|ALTER) (ROLE|USER)\b.*\bSUPERUSER\b/, reason: "the SUPERUSER attribute cannot be granted on a managed service" },
+];

package/src/postgres/testdata/NOTICE

@@ -0,0 +1,31 @@
+postgres-regress-corpus.json holds CREATE SCHEMA, TABLE, INDEX, VIEW,
+MATERIALIZED VIEW, SEQUENCE, TYPE ... AS ENUM and DOMAIN statements and COMMENT
+ON statements taken from PostgreSQL's own regression tests
+(src/test/regress/sql at tag REL_18_6), every 1-in-N of the statements in the
+dialect's declared subset that libpg_query 18 parses (`accepted`), and the
+statements of that subset the tests write as syntax errors (`rejected`). They
+are copied as written.
+
+PostgreSQL Database Management System
+(also known as Postgres, formerly known as Postgres95)
+
+Portions Copyright (c) 1996-2026, PostgreSQL Global Development Group
+
+Portions Copyright (c) 1994, The Regents of the University of California
+
+Permission to use, copy, modify, and distribute this software and its
+documentation for any purpose, without fee, and without a written agreement
+is hereby granted, provided that the above copyright notice and this
+paragraph and the following two paragraphs appear in all copies.
+
+IN NO EVENT SHALL THE UNIVERSITY OF CALIFORNIA BE LIABLE TO ANY PARTY FOR
+DIRECT, INDIRECT, SPECIAL, INCIDENTAL, OR CONSEQUENTIAL DAMAGES, INCLUDING
+LOST PROFITS, ARISING OUT OF THE USE OF THIS SOFTWARE AND ITS
+DOCUMENTATION, EVEN IF THE UNIVERSITY OF CALIFORNIA HAS BEEN ADVISED OF THE
+POSSIBILITY OF SUCH DAMAGE.
+
+THE UNIVERSITY OF CALIFORNIA SPECIFICALLY DISCLAIMS ANY WARRANTIES,
+INCLUDING, BUT NOT LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY
+AND FITNESS FOR A PARTICULAR PURPOSE.  THE SOFTWARE PROVIDED HEREUNDER IS
+ON AN "AS IS" BASIS, AND THE UNIVERSITY OF CALIFORNIA HAS NO OBLIGATIONS TO
+PROVIDE MAINTENANCE, SUPPORT, UPDATES, ENHANCEMENTS, OR MODIFICATIONS.