@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/src/lint/post-synth/sqlch107.ts

@@ -0,0 +1,35 @@
+import { bareName, checkOf, isTable, splitTop, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const DATE_TYPES = new Set(["Date", "Date32", "DateTime", "DateTime64"]);
+const TTL_ACTION = /\s+(DELETE|TO\s+DISK|TO\s+VOLUME|RECOMPRESS|GROUP\s+BY|WHERE)\b[\s\S]*$/i;
+
+/**
+ * SQLCH107: a TTL expression is a bare column, or a column plus an INTERVAL,
+ * and that column is not a Date or DateTime.
+ *
+ * Doc: https://clickhouse.com/docs/guides/developer/ttl ("The TTL expression
+ * must evaluate to Date or DateTime"). Only the two plain forms are judged;
+ * a function call is left to the server.
+ */
+export const sqlch107 = checkOf({ id: "SQLCH107", description: "A TTL expression is built on a column that is not a Date or DateTime" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    const ttls: Array<{ where: string; expr: string }> = [];
+    if (t.ttl) for (const clause of splitTop(t.ttl)) ttls.push({ where: "table TTL", expr: clause.replace(TTL_ACTION, "") });
+    for (const c of t.columns) if (c.ttl) ttls.push({ where: `column ${c.name} TTL`, expr: c.ttl.replace(TTL_ACTION, "") });
+    for (const { where, expr } of ttls) {
+      const plain = /^\s*(`[^`]+`|[A-Za-z_]\w*)\s*(?:[+-]\s*INTERVAL\b[\s\S]*)?$/i.exec(expr);
+      if (!plain) continue;
+      const name = bareName(plain[1]!);
+      const col = name === undefined ? undefined : t.columns.find((c) => c.name === name);
+      if (!col?.type) continue;
+      const family = typeFamily(col.type);
+      if (DATE_TYPES.has(family)) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.name}): ${where} is built on ${col.name}, which is ${col.type}; a TTL expression must be a Date or DateTime`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch108.ts

@@ -0,0 +1,27 @@
+import { checkOf, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH108: CREATE OR REPLACE TABLE in a database whose engine is not Atomic
+ * (or Replicated, which is Atomic underneath).
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/table
+ * ("The REPLACE query is supported only for Atomic and Replicated databases"),
+ * and https://clickhouse.com/docs/engines/database-engines/atomic for
+ * EXCHANGE TABLES. Judged against a database the same build declares.
+ */
+export const sqlch108 = checkOf({ id: "SQLCH108", description: "CREATE OR REPLACE TABLE in a database that is not Atomic" }, (ctx, report) => {
+  const objects = clickhouseObjects(ctx);
+  const databases = new Map(objects.filter((o) => o.type === "ClickHouse::Database").map((d) => [d.name, d]));
+  for (const t of objects.filter(isTable)) {
+    if (!t.orReplace || !t.database) continue;
+    const db = databases.get(t.database);
+    const engine = db?.engine?.name;
+    if (!db || !engine || engine === "Atomic" || engine === "Replicated") continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) is CREATE OR REPLACE in database ${t.database}, whose engine is ${engine}; REPLACE needs Atomic or Replicated`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch109.ts

@@ -0,0 +1,21 @@
+import { checkOf, isMaterializedView } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH109: a materialized view selects `*`.
+ *
+ * Doc: https://clickhouse.com/docs/materialized-view/incremental-materialized-view
+ * (the view's columns come from the SELECT, and a materialized view is a
+ * trigger on inserts). A star ties the target's columns to whatever the source
+ * has today, so adding a source column changes what the view writes.
+ */
+export const sqlch109 = checkOf({ id: "SQLCH109", description: "A materialized view selects *" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isMaterializedView)) {
+    if (!(v.lineage ?? []).some((e) => e.expr === "*" || /\.\*$/.test(e.expr))) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) selects *; list the columns so a new source column does not change what the view writes`,
+      entity: v.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch110.ts

@@ -0,0 +1,29 @@
+import { checkOf, isMaterializedView, isTable, resolveObject, type TableObject } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH110: a materialized view writes an output column its TO target table
+ * does not declare.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/view
+ * (a materialized view with TO inserts the SELECT's result into the target;
+ * columns are matched by name, so a column the target lacks is not stored).
+ * Judged only against a target the same build declares, and only when the
+ * SELECT lists its columns.
+ */
+export const sqlch110 = checkOf({ id: "SQLCH110", description: "A materialized view writes a column its TO target does not declare" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isMaterializedView)) {
+    if (!v.to || (v.lineage ?? []).some((e) => e.expr === "*" || /\.\*$/.test(e.expr))) continue;
+    const target = resolveObject(ctx, v.to);
+    if (!target || !isTable(target) || (target as TableObject).columns.length === 0) continue;
+    const declared = new Set((target as TableObject).columns.map((c) => c.name));
+    const outputs = v.columns.length > 0 ? v.columns.map((c) => c.name) : v.lineage.map((e) => e.output);
+    const dropped = outputs.filter((n) => !declared.has(n));
+    if (dropped.length === 0) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) selects ${dropped.join(", ")}, which ${target.name} does not declare; ClickHouse matches by name, so the value is not stored`,
+      entity: v.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch111.ts

@@ -0,0 +1,40 @@
+import { checkOf, isTable, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const MAX_VALUES = 100;
+
+/** The literals a CHECK constrains `column` to, for `col IN (...)` and `col = 'a' OR col = 'b'`. */
+function allowedValues(expr: string): { column: string; count: number } | undefined {
+  const inList = /^\(?\s*(`[^`]+`|[A-Za-z_]\w*)\s+IN\s*\(([\s\S]*)\)\s*\)?$/i.exec(expr.trim());
+  if (inList) return { column: inList[1]!.replace(/`/g, ""), count: splitTop(inList[2]!).length };
+  const ors = expr.split(/\s+OR\s+/i);
+  const eq = ors.map((p) => /^\(?\s*(`[^`]+`|[A-Za-z_]\w*)\s*=\s*'(?:[^'\\]|\\.)*'\s*\)?$/.exec(p.trim()));
+  if (ors.length > 1 && eq.every((m) => m && m[1] === eq[0]![1])) return { column: eq[0]![1]!.replace(/`/g, ""), count: ors.length };
+  return undefined;
+}
+
+/**
+ * SQLCH111: a String column a CHECK constrains to a small set of values is not
+ * LowCardinality.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/data-types/lowcardinality
+ * (LowCardinality dictionary-encodes a column and speeds up SELECT for fewer
+ * than about 10,000 distinct values) and
+ * https://clickhouse.com/docs/best-practices/select-data-types.
+ */
+export const sqlch111 = checkOf({ id: "SQLCH111", description: "A String column limited to a few values is not LowCardinality" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.constraints ?? []) {
+      if (c.kind !== "CHECK") continue;
+      const found = allowedValues(c.expr);
+      if (!found || found.count > MAX_VALUES) continue;
+      const col = t.columns.find((x) => x.name === found.column);
+      if (!col?.type || !/^String$/i.test(col.type.trim())) continue;
+      report({
+        severity: "warning",
+        message: `${t.export} (${t.name}): column ${col.name} is String but constraint ${c.name} limits it to ${found.count} values; use LowCardinality(String)`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch112.ts

@@ -0,0 +1,30 @@
+import { checkOf, isTable, typeFamily } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const FINE_FUNCTIONS =
+  /\b(toStartOfSecond|toStartOfMinute|toStartOfFiveMinutes?|toStartOfTenMinutes|toStartOfFifteenMinutes|toStartOfHour|toRelativeSecondNum|toRelativeMinuteNum|toRelativeHourNum|toUnixTimestamp|toYYYYMMDDhhmmss|toStartOfInterval)\s*\(/;
+
+/**
+ * SQLCH112: a PARTITION BY finer than a day.
+ *
+ * Doc: https://clickhouse.com/docs/best-practices/choosing-a-partitioning-key
+ * and the MergeTree page's note that partitioning is not meant to speed up
+ * queries and that "you should not partition by too granular": every
+ * partition is a separate set of parts, and the server stops inserts when a
+ * table has too many (parts_to_throw_insert). Flags a bare DateTime column and
+ * the sub-day truncation functions.
+ */
+export const sqlch112 = checkOf({ id: "SQLCH112", description: "A PARTITION BY expression is finer than a day" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    const expr = t.partitionBy?.trim();
+    if (!expr) continue;
+    const col = t.columns.find((c) => c.name === expr.replace(/^\(|\)$/g, "").trim());
+    const bareDateTime = col?.type && ["DateTime", "DateTime64"].includes(typeFamily(col.type));
+    if (!bareDateTime && !FINE_FUNCTIONS.test(expr)) continue;
+    report({
+      severity: "warning",
+      message: `${t.export} (${t.name}) partitions by ${expr}, which makes a partition per second, minute or hour; partition by month or day`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch113.ts

@@ -0,0 +1,20 @@
+import { checkOf, isMergeTree, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH113: a MergeTree table with neither ORDER BY nor PRIMARY KEY.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * ("ORDER BY: required unless PRIMARY KEY is specified"; write
+ * `ORDER BY tuple()` to have none). The server refuses the CREATE.
+ */
+export const sqlch113 = checkOf({ id: "SQLCH113", description: "A MergeTree table declares no sort key" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (!isMergeTree(t.engine) || t.orderBy || t.primaryKey) continue;
+    report({
+      severity: "error",
+      message: `${t.export} (${t.name}) uses ${t.engine!.name} with no ORDER BY or PRIMARY KEY; add one, or ORDER BY tuple() for none`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch114.ts

@@ -0,0 +1,26 @@
+import { CODECS } from "../../generated/clickhouse";
+import { checkOf, codecNames, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH114: a column CODEC names a codec the pinned server does not have.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/table#column-compression-codecs.
+ * The list is the pinned server's own (`system.codecs`).
+ */
+export const sqlch114 = checkOf({ id: "SQLCH114", description: "A column codec is not one the pinned server has" }, (ctx, report) => {
+  const known = new Set(Object.keys(CODECS).map((n) => n.toLowerCase()));
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.columns) {
+      if (!c.codec) continue;
+      for (const name of codecNames(c.codec)) {
+        if (known.has(name.toLowerCase())) continue;
+        report({
+          severity: "error",
+          message: `${t.export} (${t.name}): column ${c.name} uses codec ${name}, which the pinned server does not have`,
+          entity: t.export,
+        });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlch115.ts

@@ -0,0 +1,31 @@
+import { CODECS } from "../../generated/clickhouse";
+import { checkOf, codecNames, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const SENSITIVE = /(^|_)(password|passwd|pwd|secret|api_?key|access_?key|private_?key|token|ssn|social_?security|credit_?card|card_?number|iban)(_|$)/i;
+
+/**
+ * SQLCH115: a column named like a secret or personal data has no COMMENT, no
+ * TTL and no encryption codec.
+ *
+ * Docs: https://clickhouse.com/docs/sql-reference/statements/create/table
+ * (column COMMENT, column TTL, and the AES_128_GCM_SIV / AES_256_GCM_SIV
+ * encryption codecs). The marker is the author saying the column was
+ * considered: a COMMENT stating what it holds, a TTL that bounds how long it
+ * is kept, or a codec that encrypts it. The table's own TTL counts for the
+ * whole row.
+ */
+export const sqlch115 = checkOf({ id: "SQLCH115", description: "A secret- or PII-named column carries no comment, TTL or encryption" }, (ctx, report) => {
+  const encryption = new Set(Object.entries(CODECS).filter(([, s]) => s.encryption).map(([n]) => n.toLowerCase()));
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.columns) {
+      if (!SENSITIVE.test(c.name) || c.comment || c.ttl || t.ttl) continue;
+      if (c.codec && codecNames(c.codec).some((n) => encryption.has(n.toLowerCase()))) continue;
+      report({
+        severity: "warning",
+        message: `${t.export} (${t.name}): column ${c.name} looks like a secret or personal data; add a COMMENT, a TTL or an encryption codec`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch116.ts

@@ -0,0 +1,22 @@
+import { checkOf, isAnyView } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH116: a view declared SQL SECURITY DEFINER without a DEFINER.
+ *
+ * Doc: https://clickhouse.com/docs/sql-reference/statements/create/view#sql-security
+ * (the DEFINER clause names the user whose privileges the view's SELECT runs
+ * with). Without it the view's access is decided by whoever happened to run
+ * the CREATE, so the same declaration grants different access per environment.
+ */
+export const sqlch116 = checkOf({ id: "SQLCH116", description: "A view is SQL SECURITY DEFINER with no DEFINER" }, (ctx, report) => {
+  for (const v of clickhouseObjects(ctx).filter(isAnyView)) {
+    const security = v.security ?? "";
+    if (!/SQL\s+SECURITY\s+DEFINER/i.test(security) || /\bDEFINER\s*=/i.test(security)) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.name}) is SQL SECURITY DEFINER with no DEFINER = <user>; name the user whose privileges it runs with`,
+      entity: v.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch117.ts

@@ -0,0 +1,25 @@
+import { MERGE_TREE_SETTINGS } from "../../generated/clickhouse";
+import { checkOf, isMergeTree } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH117: a MergeTree SETTINGS entry the pinned server marks obsolete.
+ *
+ * Doc: https://clickhouse.com/docs/operations/settings/merge-tree-settings.
+ * `system.merge_tree_settings` flags it with tier Obsolete; the server accepts
+ * it and ignores it, so the table does not behave as the setting suggests.
+ */
+export const sqlch117 = checkOf({ id: "SQLCH117", description: "A MergeTree setting is obsolete at the pinned server" }, (ctx, report) => {
+  const specs = MERGE_TREE_SETTINGS as Record<string, { obsolete: boolean } | undefined>;
+  for (const o of clickhouseObjects(ctx)) {
+    if (!isMergeTree(o.engine) && o.type !== "ClickHouse::MaterializedView") continue;
+    for (const name of Object.keys((o.settings as Record<string, string> | undefined) ?? {})) {
+      if (!specs[name]?.obsolete) continue;
+      report({
+        severity: "warning",
+        message: `${o.export} (${o.name}) sets ${name}, which is obsolete and does nothing at ClickHouse 26.8; remove it`,
+        entity: o.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch118.ts

@@ -0,0 +1,26 @@
+import { MERGE_TREE_SETTINGS } from "../../generated/clickhouse";
+import { checkOf, isMergeTree } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH118: a MergeTree SETTINGS entry the pinned server does not have.
+ *
+ * Doc: https://clickhouse.com/docs/operations/settings/merge-tree-settings.
+ * The list is the pinned server's `system.merge_tree_settings`; an unknown
+ * name (usually a typo, or a setting a later release added) fails the CREATE
+ * with "Unknown setting".
+ */
+export const sqlch118 = checkOf({ id: "SQLCH118", description: "A MergeTree setting is not one the pinned server has" }, (ctx, report) => {
+  const known = MERGE_TREE_SETTINGS as Record<string, unknown>;
+  for (const o of clickhouseObjects(ctx)) {
+    if (o.type !== "ClickHouse::Table" || !isMergeTree(o.engine)) continue;
+    for (const name of Object.keys((o.settings as Record<string, string> | undefined) ?? {})) {
+      if (name in known) continue;
+      report({
+        severity: "error",
+        message: `${o.export} (${o.name}) sets ${name}, which ClickHouse 26.8 does not have as a MergeTree setting`,
+        entity: o.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlch119.ts

@@ -0,0 +1,31 @@
+import { DATABASE_ENGINES, TABLE_ENGINES } from "../../generated/clickhouse";
+import { checkOf } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH119: an engine the pinned catalog describes as deprecated or experimental.
+ *
+ * Docs: https://clickhouse.com/docs/engines/database-engines/ordinary (the
+ * legacy, deprecated default replaced by Atomic) and the engine pages the
+ * snapshot's summaries come from (`This engine is experimental`,
+ * ExperimentalBadge). The words are read from the committed catalog snapshot,
+ * so a pin move changes the verdict.
+ */
+export const sqlch119 = checkOf({ id: "SQLCH119", description: "An object uses a deprecated or experimental engine" }, (ctx, report) => {
+  const tables = TABLE_ENGINES as Record<string, { summary: string } | undefined>;
+  const databases = DATABASE_ENGINES as Record<string, { summary: string } | undefined>;
+  for (const o of clickhouseObjects(ctx)) {
+    const name = o.engine?.name;
+    if (!name) continue;
+    const isDatabase = o.type === "ClickHouse::Database";
+    const summary = (isDatabase ? databases : tables)[name]?.summary ?? "";
+    const deprecated = /\bdeprecated\b/i.test(summary);
+    const experimental = isDatabase ? /ExperimentalBadge/.test(summary) : /\b(is|are) (an )?experimental\b/i.test(summary);
+    if (!deprecated && !experimental) continue;
+    report({
+      severity: "warning",
+      message: `${o.export} (${o.name}) uses the ${deprecated ? "deprecated" : "experimental"} engine ${name}`,
+      entity: o.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlch120.ts

@@ -0,0 +1,21 @@
+import { checkOf, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+/**
+ * SQLCH120: a MergeTree engine written with the legacy positional arguments.
+ *
+ * Doc: https://clickhouse.com/docs/engines/table-engines/mergetree-family/mergetree
+ * ("Deprecated Method for Creating a Table": `MergeTree(date-column
+ * [, sampling_expression], (primary, key), index_granularity)`). Current
+ * syntax is a bare `MergeTree` with ORDER BY, PARTITION BY and SETTINGS.
+ */
+export const sqlch120 = checkOf({ id: "SQLCH120", description: "A MergeTree engine uses the deprecated positional arguments" }, (ctx, report) => {
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    if (t.engine?.name !== "MergeTree" || (t.engine.args ?? []).length === 0) continue;
+    report({
+      severity: "warning",
+      message: `${t.export} (${t.name}) is MergeTree(${t.engine.args!.join(", ")}), the deprecated positional form; use ORDER BY, PARTITION BY and SETTINGS`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg101.ts

@@ -0,0 +1,24 @@
+import { checkOf, ownsColumns, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG101: a table with no primary key.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-constraints.html#DDL-CONSTRAINTS-PRIMARY-KEYS
+ * ("a primary key indicates that a column or group of columns can be used as a
+ * unique identifier for rows"). Without one, logical replication needs a
+ * REPLICA IDENTITY and rows cannot be addressed by identity. A partition, a
+ * typed table and a LIKE copy are skipped, and a UNIQUE constraint over NOT
+ * NULL columns counts as an identity.
+ */
+export const sqlpg101 = checkOf({ id: "SQLPG101", description: "A table declares no primary key" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    if (!ownsColumns(t) || t.primaryKey || t.like.length > 0) continue;
+    const notNull = new Set(t.columns.filter((c) => c.notNull).map((c) => c.name));
+    if (t.uniques.some((u) => u.columns.length > 0 && u.columns.every((c) => notNull.has(c)))) continue;
+    report({
+      severity: "warning",
+      message: `${t.export} (${t.sqlName}) has no primary key; add one, or a UNIQUE constraint over NOT NULL columns`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg102.ts

@@ -0,0 +1,30 @@
+import { checkOf, indexesOf, leadingColumns, ownsColumns, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG102: a foreign key whose referencing columns no index leads with.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-constraints.html#DDL-CONSTRAINTS-FK
+ * ("it is often a good idea to index the referencing columns too ... a delete
+ * of a referenced row requires a scan of the referencing table"). The primary
+ * key, a UNIQUE constraint or an index covers the key when its leading columns
+ * are the foreign key's columns, in any order.
+ */
+export const sqlpg102 = checkOf({ id: "SQLPG102", description: "A foreign key's referencing columns have no index" }, (ctx, report) => {
+  const indexes = indexesOf(ctx);
+  const sameSet = (a: string[], b: string[]) => a.length === b.length && a.every((c) => b.includes(c));
+  for (const t of tablesOf(ctx)) {
+    if (!ownsColumns(t)) continue;
+    const covers: string[][] = [];
+    if (t.primaryKey) covers.push(t.primaryKey.columns);
+    for (const u of t.uniques) covers.push(u.columns);
+    for (const i of indexes) if (i.tableName === t.sqlName && (i.method ?? "btree") === "btree") covers.push(leadingColumns(i));
+    for (const fk of t.foreignKeys) {
+      if (covers.some((c) => c.length >= fk.columns.length && sameSet(c.slice(0, fk.columns.length), fk.columns))) continue;
+      report({
+        severity: "warning",
+        message: `${t.export} (${t.sqlName}) has a foreign key on (${fk.columns.join(", ")}) to ${fk.refTable} with no index leading with those columns; deletes and updates of the referenced row scan the table`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg103.ts

@@ -0,0 +1,23 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG103: a serial column where an identity column is preferred.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-numeric.html#DATATYPE-SERIAL
+ * (serial is a notational convenience that creates a sequence the column does
+ * not own as a constraint); https://www.postgresql.org/docs/18/sql-createtable.html
+ * documents GENERATED ... AS IDENTITY, the standard form. Prior art: squawk
+ * prefer-identity.
+ */
+export const sqlpg103 = checkOf({ id: "SQLPG103", description: "A serial column where an identity column is preferred" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      if (!/^(small|big)?serial[248]?$/.test(baseType(c.type))) continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is ${c.type}; declare it as an identity column (GENERATED ALWAYS AS IDENTITY)`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg104.ts

@@ -0,0 +1,23 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG104: a timestamp column without time zone.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-datetime.html (timestamp
+ * without time zone ignores any zone in the input, so the value means
+ * different instants to clients in different zones); the Postgres wiki's
+ * "Don't Do This" says the same. Prior art: squawk prefer-timestamptz.
+ */
+export const sqlpg104 = checkOf({ id: "SQLPG104", description: "A timestamp column without time zone" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      const type = baseType(c.type);
+      if (type !== "timestamp" && type !== "timestamp without time zone") continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is ${c.type}; use timestamptz, which stores an instant`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg105.ts

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG105: a json column where jsonb fits.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-json.html ("the jsonb data
+ * type is faster to process ... and supports indexing"; json has no equality
+ * operator, so SELECT DISTINCT, GROUP BY and UNION fail on it). Prior art:
+ * strong_migrations "Adding a json column".
+ */
+export const sqlpg105 = checkOf({ id: "SQLPG105", description: "A json column where jsonb fits" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      if (baseType(c.type) !== "json") continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is json; use jsonb unless the exact text, key order or duplicate keys must be kept`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg106.ts

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG106: a char(n) column.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-character.html ("there is
+ * no performance advantage to character(n) ... it takes more storage because
+ * of the blank padding"). Prior art: squawk ban-char-field.
+ */
+export const sqlpg106 = checkOf({ id: "SQLPG106", description: "A char(n) column" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      const type = baseType(c.type);
+      if (type !== "char" && type !== "character" && type !== "bpchar") continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is ${c.type}, which pads with blanks; use text, or varchar(n) for a length rule`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg107.ts

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG107: a money column.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-money.html ("the output of
+ * this type depends on lc_monetary ... restoring a dump into a database with
+ * a different lc_monetary setting may not work"; it holds a fixed number of
+ * decimals and no currency). Use numeric(p, s).
+ */
+export const sqlpg107 = checkOf({ id: "SQLPG107", description: "A money column" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      if (baseType(c.type) !== "money") continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is money, whose rounding and output depend on lc_monetary; use numeric(p, s) and a currency column`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg108.ts

@@ -0,0 +1,27 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG108: a varchar(n) column whose limit no CHECK or domain explains.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-character.html ("there is
+ * no performance difference among these three types"; a length limit only
+ * buys the check, and raising it later takes a table rewrite on old majors).
+ * Reported only for a limit that is a round number such as 255, the habit of
+ * other databases. Prior art: squawk prefer-text-field.
+ */
+export const sqlpg108 = checkOf({ id: "SQLPG108", description: "A varchar(n) column with a habitual length limit" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      const type = (c.type ?? "").toLowerCase();
+      const m = /^(?:varchar|character varying)\s*\(\s*(\d+)\s*\)$/.exec(type.trim());
+      if (!m || baseType(type) !== "varchar" && baseType(type) !== "character varying") continue;
+      const n = Number(m[1]);
+      if (![50, 100, 128, 200, 250, 255, 256, 500, 512, 1000, 1024].includes(n)) continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} is varchar(${n}); text performs the same, and a CHECK states a real length rule`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg109.ts

@@ -0,0 +1,37 @@
+import { checkOf, indexesOf, tablesOf, type PgIndex } from "./postgres-helpers";
+
+const plain = (i: PgIndex) => (i.method ?? "btree") === "btree" && i.elements.every((e) => e.column);
+const keyOf = (i: PgIndex) => `${i.elements.map((e) => e.column).join(",")}|${i.where ?? ""}|${i.include ?? ""}`;
+
+/**
+ * SQLPG109: an index that duplicates a constraint's index, or another index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/indexes-unique.html ("PostgreSQL
+ * automatically creates a unique index when a unique constraint or a primary
+ * key is defined for a table"), so a second index on the same columns costs
+ * every write and serves no query. Two indexes with the same method, columns,
+ * INCLUDE and predicate are the same index.
+ */
+export const sqlpg109 = checkOf({ id: "SQLPG109", description: "An index duplicates a constraint or another index" }, (ctx, report) => {
+  const indexes = indexesOf(ctx).filter(plain);
+  for (const t of tablesOf(ctx)) {
+    const constraints: Array<{ label: string; cols: string }> = [];
+    if (t.primaryKey) constraints.push({ label: "its primary key", cols: t.primaryKey.columns.join(",") });
+    for (const u of t.uniques) constraints.push({ label: `its unique constraint${u.name ? ` ${u.name}` : ""}`, cols: u.columns.join(",") });
+    const mine = indexes.filter((i) => i.tableName === t.sqlName);
+    const seen = new Map<string, PgIndex>();
+    for (const i of mine) {
+      const key = keyOf(i);
+      const cols = i.elements.map((e) => e.column).join(",");
+      const dup = constraints.find((c) => c.cols === cols && !i.where && !i.include);
+      if (dup) {
+        report({ severity: "warning", message: `${i.export} (${i.sqlName}) indexes (${cols}) on ${t.sqlName}, which ${dup.label} already indexes`, entity: i.export });
+        continue;
+      }
+      const first = seen.get(key);
+      if (first) {
+        report({ severity: "warning", message: `${i.export} (${i.sqlName}) duplicates ${first.export} (${first.sqlName}): same columns on ${t.sqlName}`, entity: i.export });
+      } else seen.set(key, i);
+    }
+  }
+});