@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/dist/rules/sqlch003.ts

@@ -0,0 +1,68 @@
+import * as ts from "typescript";
+import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
+import { findTemplates } from "./templates";
+
+/** The entity's own members: an interpolation of one of them is never a column. */
+const OWN_MEMBERS = new Set(["kind", "lexicon", "entityType", "props", "sqlName", "dependsOn"]);
+
+/**
+ * Identifiers that hold a ClickHouse entity, as far as one file can tell:
+ * bound to a sql tag here, or imported from another file of the project.
+ */
+function entityBindings(source: ts.SourceFile, tagged: Set<ts.Node>): Set<string> {
+  const out = new Set<string>();
+  for (const stmt of source.statements) {
+    if (ts.isImportDeclaration(stmt) && ts.isStringLiteral(stmt.moduleSpecifier) && stmt.moduleSpecifier.text.startsWith(".")) {
+      const named = stmt.importClause?.namedBindings;
+      if (named && ts.isNamedImports(named)) for (const el of named.elements) out.add(el.name.text);
+    }
+    if (ts.isVariableStatement(stmt)) {
+      for (const d of stmt.declarationList.declarations) {
+        if (ts.isIdentifier(d.name) && d.initializer && tagged.has(d.initializer)) out.add(d.name.text);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * SQLCH003: a column written as `${events.kind}` instead of `${events.columns.kind}`.
+ *
+ * Columns are reached through `.columns`. `kind`, `lexicon`, `entityType`,
+ * `props`, `sqlName` and `dependsOn` are the entity's own fields, so
+ * `${events.kind}` is the string `"resource"`, which the tag splices in as SQL
+ * text: the statement builds and means something else. This rule flags it for
+ * an entity the file declares or imports from another project file.
+ */
+export const sqlch003: LintRule = {
+  id: "SQLCH003",
+  severity: "error",
+  category: "correctness",
+  description: "A column interpolated without .columns reads the entity's own field instead",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const source = context.sourceFile;
+    const found = findTemplates(source);
+    if (found.length === 0) return [];
+    const entities = entityBindings(source, new Set(found.map((f) => f.node)));
+    const out: LintDiagnostic[] = [];
+    for (const f of found) {
+      for (const expr of f.expressions) {
+        if (!ts.isPropertyAccessExpression(expr) || !ts.isIdentifier(expr.expression)) continue;
+        const owner = expr.expression.text;
+        const member = expr.name.text;
+        if (!entities.has(owner) || !OWN_MEMBERS.has(member)) continue;
+        const { line, character } = source.getLineAndCharacterOfPosition(expr.getStart(source));
+        out.push({
+          ruleId: "SQLCH003",
+          severity: "error",
+          message: `\${${owner}.${member}} is the entity's own "${member}" field, not a column; write \${${owner}.columns.${member}}`,
+          file: context.filePath,
+          line: line + 1,
+          column: character + 1,
+        });
+      }
+    }
+    return out;
+  },
+};

package/dist/rules/sqlch101.ts

@@ -0,0 +1,35 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { DATABASE_ENGINES, TABLE_ENGINES, CLICKHOUSE_VERSION } from "../../generated/clickhouse";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH101: a table, materialized view or database names an engine the pinned
+ * ClickHouse server does not have.
+ *
+ * The engine list is the pinned server's own (`system.table_engines`,
+ * `system.database_engines`), so a misspelling (`MergTree`) or an engine a
+ * release removed fails here, at build, rather than at `CREATE` against a
+ * server.
+ */
+export const sqlch101: PostSynthCheck = {
+  id: "SQLCH101",
+  description: "A ClickHouse object names an engine the pinned server does not have",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const obj of clickhouseObjects(ctx)) {
+      const engine = obj.engine?.name;
+      if (!engine) continue;
+      const known = obj.type === "ClickHouse::Database" ? engine in DATABASE_ENGINES : engine in TABLE_ENGINES;
+      if (known) continue;
+      out.push({
+        checkId: "SQLCH101",
+        severity: "error",
+        message: `${obj.export} (${obj.name}) uses engine "${engine}", which ClickHouse ${CLICKHOUSE_VERSION} does not have`,
+        entity: obj.export,
+        lexicon: "sql",
+      });
+    }
+    return out;
+  },
+};

package/dist/rules/sqlch102.ts

@@ -0,0 +1,23 @@
+import { checkOf, isTable, keyElements } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH102: a PRIMARY KEY that is not a prefix of ORDER BY.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * ("The primary key must be a prefix of the sorting key"); the server refuses
+ * the table at CREATE.
+ */
+export const sqlch102 = checkOf({ id: "SQLCH102", description: "A PRIMARY KEY is not a prefix of ORDER BY" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.primaryKey || !t.orderBy) continue;
+    const pk = keyElements(t.primaryKey).map((e) => e.replace(/\s+/g, ""));
+    const ob = keyElements(t.orderBy).map((e) => e.replace(/\s+/g, ""));
+    if (pk.every((e, i) => ob[i] === e)) continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) has PRIMARY KEY ${t.primaryKey}, which is not a prefix of ORDER BY ${t.orderBy}`,
+      entity: t.export,
+    });
+  }
+});

package/dist/rules/sqlch103.ts

@@ -0,0 +1,45 @@
+import { baseEngineName, checkOf, columnByName, engineArguments, isNullableType, isTable, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const VERSION_TYPES = new Set(["UInt8", "UInt16", "UInt32", "UInt64", "UInt128", "UInt256", "Date", "DateTime", "DateTime64"]);
+
+/** engine -> the argument positions that name a column, and the types the engine accepts there. */
+const SPECIAL: Record<string, Array<{ role: string; index: number; accepts: (family: string) => boolean; wants: string }>> = {
+  ReplacingMergeTree: [
+    { role: "version", index: 0, accepts: (f) => VERSION_TYPES.has(f), wants: "UInt*, Date, DateTime or DateTime64" },
+    { role: "is_deleted", index: 1, accepts: (f) => f === "UInt8", wants: "UInt8" },
+  ],
+  CollapsingMergeTree: [{ role: "sign", index: 0, accepts: (f) => f === "Int8", wants: "Int8" }],
+  VersionedCollapsingMergeTree: [
+    { role: "sign", index: 0, accepts: (f) => f === "Int8", wants: "Int8" },
+    { role: "version", index: 1, accepts: (f) => VERSION_TYPES.has(f), wants: "UInt*, Date, DateTime or DateTime64" },
+  ],
+};
+
+/**
+ * SQLCH103: the version, sign or is_deleted column of a Replacing, Collapsing
+ * or VersionedCollapsing table has a type the engine does not accept.
+ *
+ * Docs: https://clickhouse.com/docs/engines/table-engines/mergetree-family/replacingmergetree
+ * (version: UInt*, Date, DateTime or DateTime64; is_deleted: UInt8) and
+ * .../collapsingmergetree, .../versionedcollapsingmergetree (sign: Int8).
+ */
+export const sqlch103 = checkOf({ id: "SQLCH103", description: "An engine's version, sign or is_deleted column has an unsupported type" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.engine) continue;
+    const roles = SPECIAL[baseEngineName(t.engine)];
+    if (!roles) continue;
+    const args = engineArguments(t.engine);
+    for (const r of roles) {
+      const arg = args[r.index];
+      const col = arg ? columnByName(t, arg.replace(/^`|`$/g, "")) : undefined;
+      if (!col?.type) continue;
+      if (!isNullableType(col.type) && r.accepts(typeFamily(col.type))) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${r.role} column ${col.name} is ${col.type}; ${t.engine.name} takes ${r.wants}`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch104.ts

@@ -0,0 +1,42 @@
+import { baseEngineName, checkOf, engineArguments, isTable, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/** The engine arguments that name columns, by base engine. */
+function columnArguments(engine: string, args: string[]): string[] {
+  switch (engine) {
+    case "ReplacingMergeTree":
+      return args.slice(0, 2);
+    case "CollapsingMergeTree":
+      return args.slice(0, 1);
+    case "VersionedCollapsingMergeTree":
+      return args.slice(0, 2);
+    case "SummingMergeTree":
+    case "CoalescingMergeTree":
+      return args.flatMap((a) => splitTop(a.trim().replace(/^\(([\s\S]*)\)$/, "$1")));
+    default:
+      return [];
+  }
+}
+
+/**
+ * SQLCH104: an engine argument names a column the table does not declare.
+ *
+ * Docs: the engine pages under
+ * https://clickhouse.com/docs/engines/table-engines/mergetree-family/ (the
+ * sign, version, is_deleted and summed columns are columns of the table).
+ */
+export const sqlch104 = checkOf({ id: "SQLCH104", description: "A MergeTree engine argument names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.engine || t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    for (const arg of columnArguments(baseEngineName(t.engine), engineArguments(t.engine))) {
+      const name = arg.trim().replace(/^`(.*)`$/, "$1");
+      if (!/^[A-Za-z_]\w*$/.test(name) || declared.has(name)) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${t.engine.name} names column ${name}, which the table does not declare`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch105.ts

@@ -0,0 +1,35 @@
+import { bareName, checkOf, isTable, keyElements } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH105: ORDER BY, PRIMARY KEY, PARTITION BY or SAMPLE BY lists a bare
+ * column name the table does not declare.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * (the keys are expressions over the table's columns). Only a bare name is
+ * judged; an expression is left to the server.
+ */
+export const sqlch105 = checkOf({ id: "SQLCH105", description: "A table key clause names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    const clauses: Array<[string, string | undefined]> = [
+      ["ORDER BY", t.orderBy],
+      ["PRIMARY KEY", t.primaryKey],
+      ["PARTITION BY", t.partitionBy],
+      ["SAMPLE BY", t.sampleBy],
+    ];
+    for (const [clause, expr] of clauses) {
+      if (!expr) continue;
+      for (const element of keyElements(expr)) {
+        const name = bareName(element);
+        if (name === undefined || declared.has(name)) continue;
+        report({
+          severity: "error",
+          message: `${t.export} (${t.name}): ${clause} names column ${name}, which the table does not declare`,
+          entity: t.export,
+        });
+      }
+    }
+  }
+});

package/dist/rules/sqlch106.ts

@@ -0,0 +1,27 @@
+import { checkOf, isTable, mentionedNames } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH106: a data skipping index expression mentions a column the table does
+ * not declare.
+ *
+ * Doc: https://clickhouse.com/docs/optimize/skipping-indexes (an index is
+ * defined over an expression of the table's columns). Projections are not
+ * checked: their SELECT is a full query, and reading its column names without a
+ * SQL parser would guess.
+ */
+export const sqlch106 = checkOf({ id: "SQLCH106", description: "A skip index expression names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    for (const index of t.indexes ?? []) {
+      const missing = [...new Set(mentionedNames(index.expr))].filter((n) => !declared.has(n));
+      if (missing.length === 0) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): index ${index.name} (${index.expr}) names ${missing.join(", ")}, which the table does not declare`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch107.ts

@@ -0,0 +1,35 @@
+import { bareName, checkOf, isTable, splitTop, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const DATE_TYPES = new Set(["Date", "Date32", "DateTime", "DateTime64"]);
+const TTL_ACTION = /\s+(DELETE|TO\s+DISK|TO\s+VOLUME|RECOMPRESS|GROUP\s+BY|WHERE)\b[\s\S]*$/i;
+
+/**
+ * SQLCH107: a TTL expression is a bare column, or a column plus an INTERVAL,
+ * and that column is not a Date or DateTime.
+ *
+ * Doc: https://clickhouse.com/docs/guides/developer/ttl ("The TTL expression
+ * must evaluate to Date or DateTime"). Only the two plain forms are judged;
+ * a function call is left to the server.
+ */
+export const sqlch107 = checkOf({ id: "SQLCH107", description: "A TTL expression is built on a column that is not a Date or DateTime" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    const ttls: Array<{ where: string; expr: string }> = [];
+    if (t.ttl) for (const clause of splitTop(t.ttl)) ttls.push({ where: "table TTL", expr: clause.replace(TTL_ACTION, "") });
+    for (const c of t.columns) if (c.ttl) ttls.push({ where: `column ${c.name} TTL`, expr: c.ttl.replace(TTL_ACTION, "") });
+    for (const { where, expr } of ttls) {
+      const plain = /^\s*(`[^`]+`|[A-Za-z_]\w*)\s*(?:[+-]\s*INTERVAL\b[\s\S]*)?$/i.exec(expr);
+      if (!plain) continue;
+      const name = bareName(plain[1]!);
+      const col = name === undefined ? undefined : t.columns.find((c) => c.name === name);
+      if (!col?.type) continue;
+      const family = typeFamily(col.type);
+      if (DATE_TYPES.has(family)) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${where} is built on ${col.name}, which is ${col.type}; a TTL expression must be a Date or DateTime`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch108.ts

@@ -0,0 +1,27 @@
+import { checkOf, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH108: CREATE OR REPLACE TABLE in a database whose engine is not Atomic
+ * (or Replicated, which is Atomic underneath).
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/table
+ * ("The REPLACE query is supported only for Atomic and Replicated databases"),
+ * and https://clickhouse.com/docs/engines/database-engines/atomic for
+ * EXCHANGE TABLES. Judged against a database the same build declares.
+ */
+export const sqlch108 = checkOf({ id: "SQLCH108", description: "CREATE OR REPLACE TABLE in a database that is not Atomic" }, (ctx, report) => {
+  const objects = clickhouseObjects(ctx);
+  const databases = new Map(objects.filter((o) => o.type === "ClickHouse::Database").map((d) => [d.name, d]));
+  for (const t of objects.filter(isTable)) {
+    if (!t.orReplace || !t.database) continue;
+    const db = databases.get(t.database);
+    const engine = db?.engine?.name;
+    if (!db || !engine || engine === "Atomic" || engine === "Replicated") continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) is CREATE OR REPLACE in database ${t.database}, whose engine is ${engine}; REPLACE needs Atomic or Replicated`,
+      entity: t.export,
+    });
+  }
+});

package/dist/rules/sqlch109.ts

@@ -0,0 +1,21 @@
+import { checkOf, isMaterializedView } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH109: a materialized view selects `*`.
+ *
+ * Doc: https://clickhouse.com/docs/materialized-view/incremental-materialized-view
+ * (the view's columns come from the SELECT, and a materialized view is a
+ * trigger on inserts). A star ties the target's columns to whatever the source
+ * has today, so adding a source column changes what the view writes.
+ */
+export const sqlch109 = checkOf({ id: "SQLCH109", description: "A materialized view selects *" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isMaterializedView)) {
+    if (!(v.lineage ?? []).some((e) => e.expr === "*" || /\.\*$/.test(e.expr))) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) selects *; list the columns so a new source column does not change what the view writes`,
+      entity: v.export,
+    });
+  }
+});

package/dist/rules/sqlch110.ts

@@ -0,0 +1,29 @@
+import { checkOf, isMaterializedView, isTable, resolveObject, type TableObject } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH110: a materialized view writes an output column its TO target table
+ * does not declare.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/view
+ * (a materialized view with TO inserts the SELECT's result into the target;
+ * columns are matched by name, so a column the target lacks is not stored).
+ * Judged only against a target the same build declares, and only when the
+ * SELECT lists its columns.
+ */
+export const sqlch110 = checkOf({ id: "SQLCH110", description: "A materialized view writes a column its TO target does not declare" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isMaterializedView)) {
+    if (!v.to || (v.lineage ?? []).some((e) => e.expr === "*" || /\.\*$/.test(e.expr))) continue;
+    const target = resolveObject(ctx, v.to);
+    if (!target || !isTable(target) || (target as TableObject).columns.length === 0) continue;
+    const declared = new Set((target as TableObject).columns.map((c) => c.name));
+    const outputs = v.columns.length > 0 ? v.columns.map((c) => c.name) : v.lineage.map((e) => e.output);
+    const dropped = outputs.filter((n) => !declared.has(n));
+    if (dropped.length === 0) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) selects ${dropped.join(", ")}, which ${target.name} does not declare; ClickHouse matches by name, so the value is not stored`,
+      entity: v.export,
+    });
+  }
+});

package/dist/rules/sqlch111.ts

@@ -0,0 +1,40 @@
+import { checkOf, isTable, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const MAX_VALUES = 100;
+
+/** The literals a CHECK constrains `column` to, for `col IN (...)` and `col = 'a' OR col = 'b'`. */
+function allowedValues(expr: string): { column: string; count: number } | undefined {
+  const inList = /^\(?\s*(`[^`]+`|[A-Za-z_]\w*)\s+IN\s*\(([\s\S]*)\)\s*\)?$/i.exec(expr.trim());
+  if (inList) return { column: inList[1]!.replace(/`/g, ""), count: splitTop(inList[2]!).length };
+  const ors = expr.split(/\s+OR\s+/i);
+  const eq = ors.map((p) => /^\(?\s*(`[^`]+`|[A-Za-z_]\w*)\s*=\s*'(?:[^'\\]|\\.)*'\s*\)?$/.exec(p.trim()));
+  if (ors.length > 1 && eq.every((m) => m && m[1] === eq[0]![1])) return { column: eq[0]![1]!.replace(/`/g, ""), count: ors.length };
+  return undefined;
+}
+
+/**
+ * SQLCH111: a String column a CHECK constrains to a small set of values is not
+ * LowCardinality.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/data-types/lowcardinality
+ * (LowCardinality dictionary-encodes a column and speeds up SELECT for fewer
+ * than about 10,000 distinct values) and
+ * https://clickhouse.com/docs/best-practices/select-data-types.
+ */
+export const sqlch111 = checkOf({ id: "SQLCH111", description: "A String column limited to a few values is not LowCardinality" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.constraints ?? []) {
+      if (c.kind !== "CHECK") continue;
+      const found = allowedValues(c.expr);
+      if (!found || found.count > MAX_VALUES) continue;
+      const col = t.columns.find((x) => x.name === found.column);
+      if (!col?.type || !/^String$/i.test(col.type.trim())) continue;
+      report({
+        severity: "warning",
+        message: `${t.export} (${t.name}): column ${col.name} is String but constraint ${c.name} limits it to ${found.count} values; use LowCardinality(String)`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch112.ts

@@ -0,0 +1,30 @@
+import { checkOf, isTable, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const FINE_FUNCTIONS =
+  /\b(toStartOfSecond|toStartOfMinute|toStartOfFiveMinutes?|toStartOfTenMinutes|toStartOfFifteenMinutes|toStartOfHour|toRelativeSecondNum|toRelativeMinuteNum|toRelativeHourNum|toUnixTimestamp|toYYYYMMDDhhmmss|toStartOfInterval)\s*\(/;
+
+/**
+ * SQLCH112: a PARTITION BY finer than a day.
+ *
+ * Doc: https://clickhouse.com/docs/best-practices/choosing-a-partitioning-key
+ * and the MergeTree page's note that partitioning is not meant to speed up
+ * queries and that "you should not partition by too granular": every
+ * partition is a separate set of parts, and the server stops inserts when a
+ * table has too many (parts_to_throw_insert). Flags a bare DateTime column and
+ * the sub-day truncation functions.
+ */
+export const sqlch112 = checkOf({ id: "SQLCH112", description: "A PARTITION BY expression is finer than a day" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    const expr = t.partitionBy?.trim();
+    if (!expr) continue;
+    const col = t.columns.find((c) => c.name === expr.replace(/^\(|\)$/g, "").trim());
+    const bareDateTime = col?.type && ["DateTime", "DateTime64"].includes(typeFamily(col.type));
+    if (!bareDateTime && !FINE_FUNCTIONS.test(expr)) continue;
+    report({
+      severity: "warning",
+      message: `${t.export} (${t.name}) partitions by ${expr}, which makes a partition per second, minute or hour; partition by month or day`,
+      entity: t.export,
+    });
+  }
+});

package/dist/rules/sqlch113.ts

@@ -0,0 +1,20 @@
+import { checkOf, isMergeTree, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH113: a MergeTree table with neither ORDER BY nor PRIMARY KEY.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * ("ORDER BY: required unless PRIMARY KEY is specified"; write
+ * `ORDER BY tuple()` to have none). The server refuses the CREATE.
+ */
+export const sqlch113 = checkOf({ id: "SQLCH113", description: "A MergeTree table declares no sort key" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!isMergeTree(t.engine) || t.orderBy || t.primaryKey) continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) uses ${t.engine!.name} with no ORDER BY or PRIMARY KEY; add one, or ORDER BY tuple() for none`,
+      entity: t.export,
+    });
+  }
+});

package/dist/rules/sqlch114.ts

@@ -0,0 +1,26 @@
+import { CODECS } from "../../generated/clickhouse";
+import { checkOf, codecNames, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH114: a column CODEC names a codec the pinned server does not have.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/table#column-compression-codecs.
+ * The list is the pinned server's own (`system.codecs`).
+ */
+export const sqlch114 = checkOf({ id: "SQLCH114", description: "A column codec is not one the pinned server has" }, (ctx, report) => {
+  const known = new Set(Object.keys(CODECS).map((n) => n.toLowerCase()));
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.columns) {
+      if (!c.codec) continue;
+      for (const name of codecNames(c.codec)) {
+        if (known.has(name.toLowerCase())) continue;
+        report({
+          severity: "error",
+          message: `${t.export} (${t.name}): column ${c.name} uses codec ${name}, which the pinned server does not have`,
+          entity: t.export,
+        });
+      }
+    }
+  }
+});

package/dist/rules/sqlch115.ts

@@ -0,0 +1,31 @@
+import { CODECS } from "../../generated/clickhouse";
+import { checkOf, codecNames, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const SENSITIVE = /(^|_)(password|passwd|pwd|secret|api_?key|access_?key|private_?key|token|ssn|social_?security|credit_?card|card_?number|iban)(_|$)/i;
+
+/**
+ * SQLCH115: a column named like a secret or personal data has no COMMENT, no
+ * TTL and no encryption codec.
+ *
+ * Docs: https://clickhouse.com/docs/sql-reference/statements/create/table
+ * (column COMMENT, column TTL, and the AES_128_GCM_SIV / AES_256_GCM_SIV
+ * encryption codecs). The marker is the author saying the column was
+ * considered: a COMMENT stating what it holds, a TTL that bounds how long it
+ * is kept, or a codec that encrypts it. The table's own TTL counts for the
+ * whole row.
+ */
+export const sqlch115 = checkOf({ id: "SQLCH115", description: "A secret- or PII-named column carries no comment, TTL or encryption" }, (ctx, report) => {
+  const encryption = new Set(Object.entries(CODECS).filter(([, s]) => s.encryption).map(([n]) => n.toLowerCase()));
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.columns) {
+      if (!SENSITIVE.test(c.name) || c.comment || c.ttl || t.ttl) continue;
+      if (c.codec && codecNames(c.codec).some((n) => encryption.has(n.toLowerCase()))) continue;
+      report({
+        severity: "warning",
+        message: `${t.export} (${t.name}): column ${c.name} looks like a secret or personal data; add a COMMENT, a TTL or an encryption codec`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch116.ts

@@ -0,0 +1,22 @@
+import { checkOf, isAnyView } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH116: a view declared SQL SECURITY DEFINER without a DEFINER.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/view#sql-security
+ * (the DEFINER clause names the user whose privileges the view's SELECT runs
+ * with). Without it the view's access is decided by whoever happened to run
+ * the CREATE, so the same declaration grants different access per environment.
+ */
+export const sqlch116 = checkOf({ id: "SQLCH116", description: "A view is SQL SECURITY DEFINER with no DEFINER" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isAnyView)) {
+    const security = v.security ?? "";
+    if (!/SQL\s+SECURITY\s+DEFINER/i.test(security) || /\bDEFINER\s*=/i.test(security)) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) is SQL SECURITY DEFINER with no DEFINER = <user>; name the user whose privileges it runs with`,
+      entity: v.export,
+    });
+  }
+});

package/dist/rules/sqlch117.ts

@@ -0,0 +1,25 @@
+import { MERGE_TREE_SETTINGS } from "../../generated/clickhouse";
+import { checkOf, isMergeTree } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH117: a MergeTree SETTINGS entry the pinned server marks obsolete.
+ *
+ * Doc: https://clickhouse.com/docs/operations/settings/merge-tree-settings.
+ * `system.merge_tree_settings` flags it with tier Obsolete; the server accepts
+ * it and ignores it, so the table does not behave as the setting suggests.
+ */
+export const sqlch117 = checkOf({ id: "SQLCH117", description: "A MergeTree setting is obsolete at the pinned server" }, (ctx, report) => {
+  const specs = MERGE_TREE_SETTINGS as Record<string, { obsolete: boolean } | undefined>;
+  for (const o of clickhouseObjects(ctx)) {
+    if (!isMergeTree(o.engine) && o.type !== "ClickHouse::MaterializedView") continue;
+    for (const name of Object.keys((o.settings as Record<string, string> | undefined) ?? {})) {
+      if (!specs[name]?.obsolete) continue;
+      report({
+        severity: "warning",
+        message: `${o.export} (${o.name}) sets ${name}, which is obsolete and does nothing at ClickHouse 26.8; remove it`,
+        entity: o.export,
+      });
+    }
+  }
+});

package/dist/rules/sqlch118.ts

@@ -0,0 +1,26 @@
+import { MERGE_TREE_SETTINGS } from "../../generated/clickhouse";
+import { checkOf, isMergeTree } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH118: a MergeTree SETTINGS entry the pinned server does not have.
+ *
+ * Doc: https://clickhouse.com/docs/operations/settings/merge-tree-settings.
+ * The list is the pinned server's `system.merge_tree_settings`; an unknown
+ * name (usually a typo, or a setting a later release added) fails the CREATE
+ * with "Unknown setting".
+ */
+export const sqlch118 = checkOf({ id: "SQLCH118", description: "A MergeTree setting is not one the pinned server has" }, (ctx, report) => {
+  const known = MERGE_TREE_SETTINGS as Record<string, unknown>;
+  for (const o of clickhouseObjects(ctx)) {
+    if (o.type !== "ClickHouse::Table" || !isMergeTree(o.engine)) continue;
+    for (const name of Object.keys((o.settings as Record<string, string> | undefined) ?? {})) {
+      if (name in known) continue;
+      report({
+        severity: "error",
+        message: `${o.export} (${o.name}) sets ${name}, which ClickHouse 26.8 does not have as a MergeTree setting`,
+        entity: o.export,
+      });
+    }
+  }
+});