@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/src/lint/post-synth/postgres-checks.test.ts

@@ -0,0 +1,257 @@
+import { describe, expect, test } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import type { PostSynthCheck } from "@intentius/chant/lint/post-synth";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { sqlSerializer } from "../../serializer";
+import { table as chTable } from "../../clickhouse/entities";
+import { extension, index, schema, table, view } from "../../postgres/entities";
+import { sqlAuditCatalog } from "../audit-catalog";
+import { postSynthChecks } from "./index";
+
+type Entities = Record<string, unknown>;
+
+function run(id: string, entities: Entities, major?: number) {
+  const check = postSynthChecks.find((c: PostSynthCheck) => c.id === id)!;
+  const config = major === undefined ? undefined : { sql: { postgresMajor: major } };
+  const out = sqlSerializer.serialize(new Map(Object.entries(entities)) as never, undefined, { config }) as SerializerResult;
+  return check.check(makePostSynthCtx("sql", out.primary));
+}
+
+const flagged = (id: string, entities: Entities, text: RegExp) => {
+  const diags = run(id, entities);
+  expect(diags.length).toBeGreaterThan(0);
+  expect(diags[0]).toMatchObject({ checkId: id, lexicon: "sql" });
+  expect(diags[0]!.message).toMatch(text);
+  return diags;
+};
+
+const clean = (id: string, entities: Entities) => expect(run(id, entities)).toEqual([]);
+
+describe("registration", () => {
+  const ids = postSynthChecks.map((c) => c.id).filter((id) => /^SQLPG1\d\d$/.test(id));
+  test("at least 15 Postgres post-synth checks, each with an audit entry", () => {
+    expect(ids.length).toBeGreaterThanOrEqual(15);
+    for (const id of ids) expect(sqlAuditCatalog[id], id).toBeDefined();
+  });
+  test("the Postgres audit entries cover security, correctness and best practice", () => {
+    const cats = new Set(ids.map((id) => sqlAuditCatalog[id]!.category));
+    expect(cats).toEqual(new Set(["security", "correctness", "best-practice"]));
+  });
+  test("lineage credits name registered tools", () => {
+    expect(sqlAuditCatalog.SQLPG103!.lineage?.[0]).toMatchObject({ tool: "squawk", rule: "prefer-identity" });
+    expect(sqlAuditCatalog.SQLPG105!.lineage?.[0]).toMatchObject({ tool: "strong_migrations" });
+  });
+  test("a ClickHouse build is not read by the Postgres checks", () => {
+    const ch = chTable`CREATE TABLE ch (a UInt8) ENGINE = MergeTree ORDER BY a`;
+    for (const id of ids) expect(run(id, { ch }), id).toEqual([]);
+  });
+});
+
+describe("SQLPG101: no primary key", () => {
+  test("flags a table with none", () => {
+    flagged("SQLPG101", { t: table`CREATE TABLE t (a int)` }, /no primary key/);
+  });
+  test("a primary key, or a unique over NOT NULL columns, is clean", () => {
+    clean("SQLPG101", {
+      a: table`CREATE TABLE a (id int PRIMARY KEY)`,
+      b: table`CREATE TABLE b (k int NOT NULL, UNIQUE (k))`,
+    });
+  });
+});
+
+describe("SQLPG102: foreign key without an index", () => {
+  test("flags an unindexed referencing column", () => {
+    const u = table`CREATE TABLE u (id bigint PRIMARY KEY)`;
+    const o = table`CREATE TABLE o (id bigint PRIMARY KEY, uid bigint REFERENCES ${u} (${u.columns.id}))`;
+    flagged("SQLPG102", { u, o }, /foreign key on \(uid\)/);
+  });
+  test("an index leading with the column covers it", () => {
+    const u = table`CREATE TABLE u (id bigint PRIMARY KEY)`;
+    const o = table`CREATE TABLE o (id bigint PRIMARY KEY, uid bigint REFERENCES ${u} (${u.columns.id}))`;
+    const i = index`CREATE INDEX o_uid_idx ON ${o} (${o.columns.uid})`;
+    clean("SQLPG102", { u, o, i });
+  });
+});
+
+describe("SQLPG103: serial", () => {
+  test("flags bigserial", () => flagged("SQLPG103", { t: table`CREATE TABLE t (id bigserial PRIMARY KEY)` }, /identity/));
+  test("identity is clean", () => clean("SQLPG103", { t: table`CREATE TABLE t (id bigint GENERATED ALWAYS AS IDENTITY PRIMARY KEY)` }));
+});
+
+describe("SQLPG104: timestamp without time zone", () => {
+  test("flags timestamp(3)", () => flagged("SQLPG104", { t: table`CREATE TABLE t (at timestamp(3))` }, /timestamptz/));
+  test("timestamptz is clean", () => clean("SQLPG104", { t: table`CREATE TABLE t (at timestamptz, b timestamp with time zone)` }));
+});
+
+describe("SQLPG105: json", () => {
+  test("flags json", () => flagged("SQLPG105", { t: table`CREATE TABLE t (j json)` }, /jsonb/));
+  test("jsonb is clean", () => clean("SQLPG105", { t: table`CREATE TABLE t (j jsonb)` }));
+});
+
+describe("SQLPG106: char(n)", () => {
+  test("flags char(3)", () => flagged("SQLPG106", { t: table`CREATE TABLE t (c char(3))` }, /pads/));
+  test("varchar and text are clean", () => clean("SQLPG106", { t: table`CREATE TABLE t (c varchar(3), d text)` }));
+});
+
+describe("SQLPG107: money", () => {
+  test("flags money", () => flagged("SQLPG107", { t: table`CREATE TABLE t (m money)` }, /lc_monetary/));
+  test("numeric is clean", () => clean("SQLPG107", { t: table`CREATE TABLE t (m numeric(12, 2))` }));
+});
+
+describe("SQLPG108: habitual varchar limit", () => {
+  test("flags varchar(255)", () => flagged("SQLPG108", { t: table`CREATE TABLE t (c varchar(255))` }, /varchar\(255\)/));
+  test("a limit that is a rule is clean", () => clean("SQLPG108", { t: table`CREATE TABLE t (c varchar(2), d character varying(37))` }));
+});
+
+describe("SQLPG109: duplicate index", () => {
+  test("flags an index over a primary key's columns", () => {
+    const t = table`CREATE TABLE t (id int PRIMARY KEY, a int)`;
+    const i = index`CREATE INDEX t_id_idx ON ${t} (${t.columns.id})`;
+    flagged("SQLPG109", { t, i }, /primary key/);
+  });
+  test("flags two identical indexes", () => {
+    const t = table`CREATE TABLE t (id int PRIMARY KEY, a int)`;
+    const i = index`CREATE INDEX t_a_1 ON ${t} (${t.columns.a})`;
+    const j = index`CREATE INDEX t_a_2 ON ${t} (${t.columns.a})`;
+    flagged("SQLPG109", { t, i, j }, /duplicates/);
+  });
+  test("a partial index on the same column is not a duplicate", () => {
+    const t = table`CREATE TABLE t (id int PRIMARY KEY, a int)`;
+    const i = index`CREATE INDEX t_a_1 ON ${t} (${t.columns.a})`;
+    const j = index`CREATE INDEX t_a_2 ON ${t} (${t.columns.a}) WHERE a > 0`;
+    clean("SQLPG109", { t, i, j });
+  });
+});
+
+describe("SQLPG110: prefix index", () => {
+  test("flags an index that is a prefix of another", () => {
+    const t = table`CREATE TABLE t (id int PRIMARY KEY, a int, b int)`;
+    const i = index`CREATE INDEX t_a ON ${t} (${t.columns.a})`;
+    const j = index`CREATE INDEX t_ab ON ${t} (${t.columns.a}, ${t.columns.b})`;
+    flagged("SQLPG110", { t, i, j }, /prefix of t_ab/);
+  });
+  test("a different leading column is clean", () => {
+    const t = table`CREATE TABLE t (id int PRIMARY KEY, a int, b int)`;
+    const i = index`CREATE INDEX t_b ON ${t} (${t.columns.b})`;
+    const j = index`CREATE INDEX t_ab ON ${t} (${t.columns.a}, ${t.columns.b})`;
+    clean("SQLPG110", { t, i, j });
+  });
+});
+
+describe("SQLPG111: materialized view without a unique index", () => {
+  test("flags one with none", () => {
+    flagged("SQLPG111", { mv: view`CREATE MATERIALIZED VIEW mv AS SELECT 1 AS a` }, /CONCURRENTLY/);
+  });
+  test("a unique index over columns is clean", () => {
+    const mv = view`CREATE MATERIALIZED VIEW mv AS SELECT 1 AS a`;
+    const i = index`CREATE UNIQUE INDEX mv_a ON ${mv} (${mv.columns.a})`;
+    clean("SQLPG111", { mv, i });
+  });
+});
+
+describe("SQLPG112: sensitive column without a comment", () => {
+  test("flags an email column", () => {
+    flagged("SQLPG112", { t: table`CREATE TABLE t (id int PRIMARY KEY, email text)` }, /t\.email/);
+  });
+  test("a table or column comment is clean", () => {
+    clean("SQLPG112", {
+      a: table`CREATE TABLE a (email text); COMMENT ON TABLE a IS 'Accounts, emails hashed'`,
+      b: table`CREATE TABLE b (email text); COMMENT ON COLUMN b.email IS 'Login address, masked in exports'`,
+      c: table`CREATE TABLE c (name text)`,
+    });
+  });
+});
+
+describe("SQLPG113: public schema", () => {
+  test("flags an unqualified table when a schema is declared", () => {
+    flagged("SQLPG113", { app: schema`CREATE SCHEMA app`, t: table`CREATE TABLE t (id int)` }, /public schema/);
+  });
+  test("qualified, or no schema declared, is clean", () => {
+    const app = schema`CREATE SCHEMA app`;
+    clean("SQLPG113", { app, t: table`CREATE TABLE ${app}.t (id int)` });
+    clean("SQLPG113", { t: table`CREATE TABLE t (id int)` });
+  });
+});
+
+describe("SQLPG114: storage parameters", () => {
+  test("flags an unknown parameter", () => {
+    flagged("SQLPG114", { t: table`CREATE TABLE t (id int) WITH (fillfactr = 70)` }, /not a Postgres 18 storage parameter/);
+  });
+  test("the message names the target major", () => {
+    expect(run("SQLPG114", { t: table`CREATE TABLE t (id int) WITH (fillfactr = 70)` }, 14)[0]!.message).toMatch(/not a Postgres 14 storage parameter/);
+  });
+  test("flags a parameter for another relation kind", () => {
+    const t = table`CREATE TABLE t (id int)`;
+    const i = index`CREATE INDEX t_id ON ${t} (${t.columns.id}) WITH (fillfactor = 70, buffering = on)`;
+    flagged("SQLPG114", { t, i }, /buffering/);
+  });
+  test("known parameters are clean", () => {
+    const t = table`CREATE TABLE t (id int) WITH (fillfactor = 70, autovacuum_enabled = false)`;
+    const i = index`CREATE INDEX t_id ON ${t} (${t.columns.id}) WITH (fillfactor = 80)`;
+    clean("SQLPG114", { t, i });
+  });
+});
+
+describe("SQLPG115: features newer than the target major", () => {
+  test("flags a storage parameter newer than 14, NULLS NOT DISTINCT (15) and a virtual column (18)", () => {
+    const v = view`CREATE MATERIALIZED VIEW v WITH (autovacuum_vacuum_max_threshold = 10) AS SELECT 1 AS a`;
+    const t = table`CREATE TABLE t (a int, b int GENERATED ALWAYS AS (a + 1) VIRTUAL, UNIQUE NULLS NOT DISTINCT (a))`;
+    const msgs = run("SQLPG115", { v, t }, 14).map((d) => d.message).join("\n");
+    expect(msgs).toMatch(/autovacuum_vacuum_max_threshold.*needs Postgres 18/);
+    expect(msgs).toMatch(/virtual generated column b.*Postgres 18/);
+    expect(msgs).toMatch(/NULLS NOT DISTINCT.*Postgres 15/);
+  });
+  test("flags NOT ENFORCED", () => {
+    const t = table`CREATE TABLE t (a int, CONSTRAINT pos CHECK (a > 0) NOT ENFORCED)`;
+    expect(run("SQLPG115", { t }, 14)[0]!.message).toMatch(/NOT ENFORCED.*Postgres 18; Postgres 14 refuses/);
+  });
+  test("a project targeting 18 (or with no target) is not flagged for 18 features", () => {
+    const v = view`CREATE MATERIALIZED VIEW v WITH (autovacuum_vacuum_max_threshold = 10) AS SELECT 1 AS a`;
+    const t = table`CREATE TABLE t (a int, b int GENERATED ALWAYS AS (a + 1) VIRTUAL, UNIQUE NULLS NOT DISTINCT (a), CONSTRAINT pos CHECK (a > 0) NOT ENFORCED)`;
+    expect(run("SQLPG115", { v, t }, 18)).toEqual([]);
+    expect(run("SQLPG115", { v, t })).toEqual([]);
+  });
+  test("at 16 only the 17 and 18 features are flagged, not NULLS NOT DISTINCT (15)", () => {
+    const t = table`CREATE TABLE t (a int, UNIQUE NULLS NOT DISTINCT (a), CONSTRAINT pos CHECK (a > 0) NOT ENFORCED)`;
+    const msgs = run("SQLPG115", { t }, 16).map((d) => d.message).join("\n");
+    expect(msgs).toMatch(/NOT ENFORCED/);
+    expect(msgs).not.toMatch(/NULLS NOT DISTINCT/);
+  });
+  test("features every major has are clean", () => {
+    clean("SQLPG115", { t: table`CREATE TABLE t (a int, b int GENERATED ALWAYS AS (a + 1) STORED) WITH (fillfactor = 70)` });
+  });
+});
+
+describe("SQLPG116: removed extension", () => {
+  test("flags adminpack, gone after 16", () => {
+    flagged("SQLPG116", { e: extension`CREATE EXTENSION adminpack` }, /adminpack.*last in 16/);
+  });
+  test("a shipped extension is clean", () => clean("SQLPG116", { e: extension`CREATE EXTENSION pg_trgm` }));
+  test("an extension dropped after 16 is fine at 14 and 16, flagged at 17 and 18", () => {
+    const e = extension`CREATE EXTENSION adminpack`;
+    expect(run("SQLPG116", { e }, 14)).toEqual([]);
+    expect(run("SQLPG116", { e }, 16)).toEqual([]);
+    expect(run("SQLPG116", { e }, 17)[0]!.message).toMatch(/Postgres 17 does not ship/);
+    expect(run("SQLPG116", { e }, 18)[0]!.message).toMatch(/Postgres 18 does not ship/);
+  });
+});
+
+describe("SQLPG117: view without security_invoker", () => {
+  test("flags a plain view", () => {
+    flagged("SQLPG117", { v: view`CREATE VIEW v AS SELECT 1 AS a` }, /security_invoker/);
+  });
+  test("security_invoker = true is clean", () => {
+    clean("SQLPG117", { v: view`CREATE VIEW v WITH (security_invoker = true) AS SELECT 1 AS a` });
+  });
+});
+
+describe("SQLPG118: INHERITS", () => {
+  test("flags an inheriting table", () => {
+    const p = table`CREATE TABLE p (id int)`;
+    flagged("SQLPG118", { p, c: table`CREATE TABLE c (x int) INHERITS (${p})` }, /INHERITS/);
+  });
+  test("a partition is clean", () => {
+    const p = table`CREATE TABLE p (id int) PARTITION BY RANGE (id)`;
+    clean("SQLPG118", { p, c: table`CREATE TABLE c PARTITION OF ${p} FOR VALUES FROM (1) TO (10)` });
+  });
+});

package/src/lint/post-synth/postgres-helpers.ts

@@ -0,0 +1,126 @@
+/**
+ * Reading the Postgres objects in the sql build output for post-synth checks:
+ * typed views of the serialized objects and the small scanners the checks
+ * share. Expressions are kept as written; the scanners answer narrow questions
+ * ("is this a bare column"), not what an expression evaluates to.
+ */
+
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { POSTGRES_MAJORS, VERSION_RANGES } from "../../generated/postgres";
+import type { VersionRange } from "../../postgres/catalog-types";
+import type { ColumnDef, KeyDef } from "../../postgres/entities";
+import { postgresMajorOf, postgresObjects, type OutputObject } from "./sql-helpers";
+
+export interface PgTable extends OutputObject {
+  sqlName: string;
+  like: string[];
+  schema?: string;
+  comment?: string;
+  columns: Array<ColumnDef & { comment?: string }>;
+  primaryKey?: KeyDef;
+  uniques: KeyDef[];
+  checks: Array<{ name?: string; expr: string; notEnforced?: boolean }>;
+  foreignKeys: Array<{ name?: string; columns: string[]; refTable: string; refColumns: string[] }>;
+  exclusions: unknown[];
+  inherits: unknown[];
+  partitionOf?: unknown;
+  ofType?: unknown;
+  persistence?: string;
+  with?: string;
+}
+
+export interface PgIndex extends OutputObject {
+  sqlName: string;
+  schema?: string;
+  table: string;
+  tableName: string;
+  unique?: boolean;
+  method?: string;
+  elements: Array<{ expr: string; column?: string }>;
+  include?: string;
+  where?: string;
+  with?: string;
+}
+
+export interface PgView extends OutputObject {
+  sqlName: string;
+  schema?: string;
+  query: string;
+  with?: string;
+}
+
+export const isTable = (o: OutputObject): o is PgTable => o.type === "Postgres::Table";
+export const isIndex = (o: OutputObject): o is PgIndex => o.type === "Postgres::Index";
+export const isView = (o: OutputObject): o is PgView => o.type === "Postgres::View";
+export const isMaterializedView = (o: OutputObject): o is PgView => o.type === "Postgres::MaterializedView";
+
+export const tablesOf = (ctx: PostSynthContext): PgTable[] => postgresObjects(ctx).filter(isTable);
+export const indexesOf = (ctx: PostSynthContext): PgIndex[] => postgresObjects(ctx).filter(isIndex);
+
+/** The major the build targets (`postgresMajor` in the output), else the newest pinned. */
+export const targetMajor = (ctx: PostSynthContext): number => postgresMajorOf(ctx, PINNED_MAJOR);
+
+/** The newest and oldest majors the lexicon carries a catalog for. */
+export const PINNED_MAJOR: number = POSTGRES_MAJORS[POSTGRES_MAJORS.length - 1]!;
+export const OLDEST_MAJOR: number = POSTGRES_MAJORS[0]!;
+
+/** The version range the generated catalog records for `name` in `table`, if it is not in every major. */
+export function rangeOf(table: keyof typeof VERSION_RANGES, name: string): VersionRange | undefined {
+  return (VERSION_RANGES[table] as Record<string, VersionRange | undefined>)[name];
+}
+
+/** A column type's leading words, lower-cased, without a length or array suffix: `timestamp(3)[]` is `timestamp`. */
+export function baseType(type: string | undefined): string {
+  return (type ?? "").toLowerCase().replace(/\[.*$/, "").replace(/\(.*?\)/g, "").replace(/\s+/g, " ").trim();
+}
+
+/** The `name = value` pairs of a `(a = 1, b)` storage parameter list, names lower-cased. */
+export function storageParams(text: string | undefined): Map<string, string> {
+  const out = new Map<string, string>();
+  const inner = (text ?? "").trim().replace(/^\(/, "").replace(/\)$/, "");
+  for (const part of inner.split(",")) {
+    const [k, ...v] = part.split("=");
+    const name = k!.trim().toLowerCase();
+    if (name) out.set(name, v.join("=").trim());
+  }
+  return out;
+}
+
+/** The leading bare-column elements of an index, in order; stops at the first expression. */
+export function leadingColumns(index: PgIndex): string[] {
+  const out: string[] = [];
+  for (const e of index.elements) {
+    if (!e.column) break;
+    out.push(e.column);
+  }
+  return out;
+}
+
+/** A check over the build's Postgres objects, so each check file holds its rule. */
+export function checkOf(
+  meta: { id: string; description: string },
+  run: (ctx: PostSynthContext, report: (d: Omit<PostSynthDiagnostic, "checkId" | "lexicon">) => void) => void,
+): PostSynthCheck {
+  return {
+    ...meta,
+    check(ctx) {
+      const out: PostSynthDiagnostic[] = [];
+      run(ctx, (d) => out.push({ checkId: meta.id, lexicon: "sql", ...d }));
+      return out;
+    },
+  };
+}
+
+/** A table that owns its columns: not a partition, not typed (`OF type`), not temporary. */
+export const ownsColumns = (t: PgTable): boolean => t.partitionOf === undefined && t.ofType === undefined && t.persistence !== "temporary";
+
+/** The catalog's relation kind for a storage-parameter list on this object, as `STORAGE_PARAMETERS.targets` spells it. */
+export function storageTarget(o: OutputObject): string | undefined {
+  switch (o.type) {
+    case "Postgres::Table": return "table";
+    case "Postgres::View": return "view";
+    case "Postgres::MaterializedView": return "materialized view";
+    case "Postgres::Index": return `index:${(o.method as string | undefined) ?? "btree"}`;
+    default: return undefined;
+  }
+}

package/src/lint/post-synth/sql-helpers.ts

@@ -0,0 +1,53 @@
+/**
+ * Reading the sql lexicon's build output in a post-synth check: the JSON
+ * document the serializer writes (`dialect`, `applyOrder`, `objects`).
+ */
+
+import type { PostSynthContext } from "@intentius/chant/lint/post-synth";
+
+export interface OutputObject {
+  export: string;
+  type: string;
+  name: string;
+  database?: string;
+  engine?: { name: string; args?: string[] };
+  [key: string]: unknown;
+}
+
+/** Every schema object in the build's sql output, ClickHouse dialect. */
+export function clickhouseObjects(ctx: PostSynthContext): OutputObject[] {
+  const out: OutputObject[] = [];
+  for (const doc of ctx.docs ?? []) {
+    if (doc.error || doc.lexicon !== "sql" || doc.format !== "json") continue;
+    const value = doc.value as { dialect?: unknown; objects?: unknown };
+    if (value?.dialect !== "clickhouse" || !Array.isArray(value.objects)) continue;
+    out.push(...(value.objects as OutputObject[]));
+  }
+  return out;
+}
+
+/** Every schema object in the build's sql output, Postgres dialect. */
+export function postgresObjects(ctx: PostSynthContext): OutputObject[] {
+  const out: OutputObject[] = [];
+  for (const doc of ctx.docs ?? []) {
+    if (doc.error || doc.lexicon !== "sql" || doc.format !== "json") continue;
+    const value = doc.value as { dialect?: unknown; objects?: unknown };
+    if (value?.dialect !== "postgres" || !Array.isArray(value.objects)) continue;
+    out.push(...(value.objects as OutputObject[]));
+  }
+  return out;
+}
+
+/**
+ * The Postgres major the build targets, as the serializer recorded it
+ * (`sql.postgresMajor`, else the newest pinned major). `fallback` answers for
+ * output that carries none.
+ */
+export function postgresMajorOf(ctx: PostSynthContext, fallback: number): number {
+  for (const doc of ctx.docs ?? []) {
+    if (doc.error || doc.lexicon !== "sql" || doc.format !== "json") continue;
+    const value = doc.value as { dialect?: unknown; postgresMajor?: unknown };
+    if (value?.dialect === "postgres" && typeof value.postgresMajor === "number") return value.postgresMajor;
+  }
+  return fallback;
+}

package/src/lint/post-synth/sqlch101.ts

@@ -0,0 +1,35 @@
+import type { PostSynthCheck, PostSynthContext, PostSynthDiagnostic } from "@intentius/chant/lint/post-synth";
+import { DATABASE_ENGINES, TABLE_ENGINES, CLICKHOUSE_VERSION } from "../../generated/clickhouse";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH101: a table, materialized view or database names an engine the pinned
+ * ClickHouse server does not have.
+ *
+ * The engine list is the pinned server's own (`system.table_engines`,
+ * `system.database_engines`), so a misspelling (`MergTree`) or an engine a
+ * release removed fails here, at build, rather than at `CREATE` against a
+ * server.
+ */
+export const sqlch101: PostSynthCheck = {
+  id: "SQLCH101",
+  description: "A ClickHouse object names an engine the pinned server does not have",
+
+  check(ctx: PostSynthContext): PostSynthDiagnostic[] {
+    const out: PostSynthDiagnostic[] = [];
+    for (const obj of clickhouseObjects(ctx)) {
+      const engine = obj.engine?.name;
+      if (!engine) continue;
+      const known = obj.type === "ClickHouse::Database" ? engine in DATABASE_ENGINES : engine in TABLE_ENGINES;
+      if (known) continue;
+      out.push({
+        checkId: "SQLCH101",
+        severity: "error",
+        message: `${obj.export} (${obj.name}) uses engine "${engine}", which ClickHouse ${CLICKHOUSE_VERSION} does not have`,
+        entity: obj.export,
+        lexicon: "sql",
+      });
+    }
+    return out;
+  },
+};

package/src/lint/post-synth/sqlch102.ts

@@ -0,0 +1,23 @@
+import { checkOf, isTable, keyElements } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH102: a PRIMARY KEY that is not a prefix of ORDER BY.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * ("The primary key must be a prefix of the sorting key"); the server refuses
+ * the table at CREATE.
+ */
+export const sqlch102 = checkOf({ id: "SQLCH102", description: "A PRIMARY KEY is not a prefix of ORDER BY" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.primaryKey || !t.orderBy) continue;
+    const pk = keyElements(t.primaryKey).map((e) => e.replace(/\s+/g, ""));
+    const ob = keyElements(t.orderBy).map((e) => e.replace(/\s+/g, ""));
+    if (pk.every((e, i) => ob[i] === e)) continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) has PRIMARY KEY ${t.primaryKey}, which is not a prefix of ORDER BY ${t.orderBy}`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch103.ts

@@ -0,0 +1,45 @@
+import { baseEngineName, checkOf, columnByName, engineArguments, isNullableType, isTable, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const VERSION_TYPES = new Set(["UInt8", "UInt16", "UInt32", "UInt64", "UInt128", "UInt256", "Date", "DateTime", "DateTime64"]);
+
+/** engine -> the argument positions that name a column, and the types the engine accepts there. */
+const SPECIAL: Record<string, Array<{ role: string; index: number; accepts: (family: string) => boolean; wants: string }>> = {
+  ReplacingMergeTree: [
+    { role: "version", index: 0, accepts: (f) => VERSION_TYPES.has(f), wants: "UInt*, Date, DateTime or DateTime64" },
+    { role: "is_deleted", index: 1, accepts: (f) => f === "UInt8", wants: "UInt8" },
+  ],
+  CollapsingMergeTree: [{ role: "sign", index: 0, accepts: (f) => f === "Int8", wants: "Int8" }],
+  VersionedCollapsingMergeTree: [
+    { role: "sign", index: 0, accepts: (f) => f === "Int8", wants: "Int8" },
+    { role: "version", index: 1, accepts: (f) => VERSION_TYPES.has(f), wants: "UInt*, Date, DateTime or DateTime64" },
+  ],
+};
+
+/**
+ * SQLCH103: the version, sign or is_deleted column of a Replacing, Collapsing
+ * or VersionedCollapsing table has a type the engine does not accept.
+ *
+ * Docs: https://clickhouse.com/docs/engines/table-engines/mergetree-family/replacingmergetree
+ * (version: UInt*, Date, DateTime or DateTime64; is_deleted: UInt8) and
+ * .../collapsingmergetree, .../versionedcollapsingmergetree (sign: Int8).
+ */
+export const sqlch103 = checkOf({ id: "SQLCH103", description: "An engine's version, sign or is_deleted column has an unsupported type" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.engine) continue;
+    const roles = SPECIAL[baseEngineName(t.engine)];
+    if (!roles) continue;
+    const args = engineArguments(t.engine);
+    for (const r of roles) {
+      const arg = args[r.index];
+      const col = arg ? columnByName(t, arg.replace(/^`|`$/g, "")) : undefined;
+      if (!col?.type) continue;
+      if (!isNullableType(col.type) && r.accepts(typeFamily(col.type))) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${r.role} column ${col.name} is ${col.type}; ${t.engine.name} takes ${r.wants}`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch104.ts

@@ -0,0 +1,42 @@
+import { baseEngineName, checkOf, engineArguments, isTable, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/** The engine arguments that name columns, by base engine. */
+function columnArguments(engine: string, args: string[]): string[] {
+  switch (engine) {
+    case "ReplacingMergeTree":
+      return args.slice(0, 2);
+    case "CollapsingMergeTree":
+      return args.slice(0, 1);
+    case "VersionedCollapsingMergeTree":
+      return args.slice(0, 2);
+    case "SummingMergeTree":
+    case "CoalescingMergeTree":
+      return args.flatMap((a) => splitTop(a.trim().replace(/^\(([\s\S]*)\)$/, "$1")));
+    default:
+      return [];
+  }
+}
+
+/**
+ * SQLCH104: an engine argument names a column the table does not declare.
+ *
+ * Docs: the engine pages under
+ * https://clickhouse.com/docs/engines/table-engines/mergetree-family/ (the
+ * sign, version, is_deleted and summed columns are columns of the table).
+ */
+export const sqlch104 = checkOf({ id: "SQLCH104", description: "A MergeTree engine argument names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!t.engine || t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    for (const arg of columnArguments(baseEngineName(t.engine), engineArguments(t.engine))) {
+      const name = arg.trim().replace(/^`(.*)`$/, "$1");
+      if (!/^[A-Za-z_]\w*$/.test(name) || declared.has(name)) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${t.engine.name} names column ${name}, which the table does not declare`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch105.ts

@@ -0,0 +1,35 @@
+import { bareName, checkOf, isTable, keyElements } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH105: ORDER BY, PRIMARY KEY, PARTITION BY or SAMPLE BY lists a bare
+ * column name the table does not declare.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * (the keys are expressions over the table's columns). Only a bare name is
+ * judged; an expression is left to the server.
+ */
+export const sqlch105 = checkOf({ id: "SQLCH105", description: "A table key clause names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    const clauses: Array<[string, string | undefined]> = [
+      ["ORDER BY", t.orderBy],
+      ["PRIMARY KEY", t.primaryKey],
+      ["PARTITION BY", t.partitionBy],
+      ["SAMPLE BY", t.sampleBy],
+    ];
+    for (const [clause, expr] of clauses) {
+      if (!expr) continue;
+      for (const element of keyElements(expr)) {
+        const name = bareName(element);
+        if (name === undefined || declared.has(name)) continue;
+        report({
+          severity: "error",
+          message: `${t.export} (${t.name}): ${clause} names column ${name}, which the table does not declare`,
+          entity: t.export,
+        });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlch106.ts

@@ -0,0 +1,27 @@
+import { checkOf, isTable, mentionedNames } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH106: a data skipping index expression mentions a column the table does
+ * not declare.
+ *
+ * Doc: https://clickhouse.com/docs/optimize/skipping-indexes (an index is
+ * defined over an expression of the table's columns). Projections are not
+ * checked: their SELECT is a full query, and reading its column names without a
+ * SQL parser would guess.
+ */
+export const sqlch106 = checkOf({ id: "SQLCH106", description: "A skip index expression names a column the table does not declare" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (t.columns.length === 0) continue;
+    const declared = new Set(t.columns.map((c) => c.name));
+    for (const index of t.indexes ?? []) {
+      const missing = [...new Set(mentionedNames(index.expr))].filter((n) => !declared.has(n));
+      if (missing.length === 0) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): index ${index.name} (${index.expr}) names ${missing.join(", ")}, which the table does not declare`,
+        entity: t.export,
+      });
+    }
+  }
+});