@intentius/chant-lexicon-sql 0.0.0-stage → 0.112.1

package/src/lint/post-synth/sqlpg110.ts

@@ -0,0 +1,33 @@
+import { checkOf, indexesOf, leadingColumns, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG110: a btree index whose columns are a leading prefix of another index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/indexes-multicolumn.html ("a
+ * multicolumn B-tree index can be used with query conditions that involve any
+ * subset of the index's columns, but the index is most efficient when there
+ * are constraints on the leading (leftmost) columns"). A plain index on (a)
+ * is served by one on (a, b) or by the primary key (a, b). A unique index
+ * enforces a rule and is kept.
+ */
+export const sqlpg110 = checkOf({ id: "SQLPG110", description: "A btree index is a prefix of another index" }, (ctx, report) => {
+  const indexes = indexesOf(ctx).filter((i) => (i.method ?? "btree") === "btree");
+  for (const t of tablesOf(ctx)) {
+    const wider: Array<{ label: string; cols: string[] }> = [];
+    if (t.primaryKey) wider.push({ label: "the primary key", cols: t.primaryKey.columns });
+    for (const u of t.uniques) wider.push({ label: "a unique constraint", cols: u.columns });
+    const mine = indexes.filter((i) => i.tableName === t.sqlName);
+    for (const i of mine) if (!i.where) wider.push({ label: i.sqlName, cols: leadingColumns(i) });
+    for (const i of mine) {
+      if (i.unique || i.where || i.include || !i.elements.every((e) => e.column)) continue;
+      const cols = i.elements.map((e) => e.column!);
+      const cover = wider.find((w) => w.label !== i.sqlName && w.cols.length > cols.length && cols.every((c, n) => w.cols[n] === c));
+      if (!cover) continue;
+      report({
+        severity: "warning",
+        message: `${i.export} (${i.sqlName}) on (${cols.join(", ")}) is a prefix of ${cover.label} (${cover.cols.join(", ")}); drop it`,
+        entity: i.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg111.ts

@@ -0,0 +1,23 @@
+import { checkOf, indexesOf, isMaterializedView } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+/**
+ * SQLPG111: a materialized view with no unique index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-refreshmaterializedview.html
+ * ("CONCURRENTLY ... is only allowed if there is at least one UNIQUE index on
+ * the materialized view which uses only column names and includes all rows").
+ * Without one, every refresh takes an ACCESS EXCLUSIVE lock and blocks readers.
+ */
+export const sqlpg111 = checkOf({ id: "SQLPG111", description: "A materialized view has no unique index, so it cannot refresh concurrently" }, (ctx, report) => {
+  const indexes = indexesOf(ctx);
+  for (const v of postgresObjects(ctx).filter(isMaterializedView)) {
+    const ok = indexes.some((i) => i.tableName === v.sqlName && i.unique && !i.where && i.elements.every((e) => e.column));
+    if (ok) continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.sqlName}) has no unique index over plain columns; REFRESH MATERIALIZED VIEW CONCURRENTLY is refused and a plain refresh blocks readers`,
+      entity: v.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg112.ts

@@ -0,0 +1,25 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+
+const SENSITIVE = /(^|_)(password|passwd|pwd|secret|token|api_?key|ssn|social_security|tax_id|credit_card|card_number|cvv|iban|passport|date_of_birth|dob|email|phone|address)(_|$)/i;
+
+/**
+ * SQLPG112: a secret- or PII-named column in a table with no comment.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-comment.html. A COMMENT on the
+ * table or the column is where the retention, encryption or masking rule is
+ * written down, and where pg_dump, anonymizers and catalog scanners read it.
+ * A column or a table comment satisfies the check.
+ */
+export const sqlpg112 = checkOf({ id: "SQLPG112", description: "A secret- or PII-named column with no comment on it or its table" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    if (t.comment) continue;
+    for (const c of t.columns) {
+      if (c.comment || !SENSITIVE.test(c.name)) continue;
+      report({
+        severity: "warning",
+        message: `${t.export}.${c.name} looks like a secret or personal data and neither it nor ${t.sqlName} has a COMMENT; say what it holds and how it is protected`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg113.ts

@@ -0,0 +1,28 @@
+import { checkOf } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+const PLACED = new Set(["Postgres::Table", "Postgres::View", "Postgres::MaterializedView", "Postgres::Sequence", "Postgres::Enum", "Postgres::Domain"]);
+
+/**
+ * SQLPG113: an object in the public schema while the project declares schemas.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-schemas.html#DDL-SCHEMAS-PUBLIC
+ * and https://www.postgresql.org/docs/18/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
+ * (the usage patterns recommend that applications not share `public`). An
+ * unqualified name is created in the first schema of search_path, usually
+ * public. Silent for a project that declares no schema.
+ */
+export const sqlpg113 = checkOf({ id: "SQLPG113", description: "An object is in the public schema though the project declares schemas" }, (ctx, report) => {
+  const objects = postgresObjects(ctx);
+  if (!objects.some((o) => o.type === "Postgres::Schema")) return;
+  for (const o of objects) {
+    if (!PLACED.has(o.type)) continue;
+    const schema = (o.schema as string | undefined) ?? "public";
+    if (schema !== "public") continue;
+    report({
+      severity: "warning",
+      message: `${o.export} (${o.sqlName}) is in the public schema; qualify it with one of the declared schemas`,
+      entity: o.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg114.ts

@@ -0,0 +1,37 @@
+import { STORAGE_PARAMETERS } from "../../generated/postgres";
+import { checkOf, rangeOf, storageParams, storageTarget, targetMajor } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+/**
+ * SQLPG114: a storage parameter the object's kind does not accept at the
+ * target major (`postgresMajor` in the output).
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createtable.html#SQL-CREATETABLE-STORAGE-PARAMETERS
+ * (and the CREATE INDEX, CREATE VIEW and CREATE MATERIALIZED VIEW pages). The
+ * server refuses an unrecognized parameter at CREATE. The accepted names and
+ * the relation kinds they apply to come from the generated catalog, whose
+ * since/until data says which majors have each one: a parameter removed
+ * before the target major is reported as removed.
+ */
+export const sqlpg114 = checkOf({ id: "SQLPG114", description: "A storage parameter the object's kind or the target major does not accept" }, (ctx, report) => {
+  const major = targetMajor(ctx);
+  const specs = STORAGE_PARAMETERS as Record<string, { targets: readonly string[] } | undefined>;
+  for (const o of postgresObjects(ctx)) {
+    const target = storageTarget(o);
+    if (!target) continue;
+    for (const raw of storageParams(o.with as string | undefined).keys()) {
+      if (raw.startsWith("toast.")) continue;
+      const spec = specs[raw];
+      if (!spec) {
+        report({ severity: "error", message: `${o.export} (${o.sqlName}) sets ${raw}, which is not a Postgres ${major} storage parameter`, entity: o.export });
+        continue;
+      }
+      const range = rangeOf("storageParameters", `${target}.${raw}`);
+      if (!spec.targets.includes(target)) {
+        report({ severity: "error", message: `${o.export} (${o.sqlName}) sets ${raw}, which applies to ${spec.targets.join(", ")} and not to a ${target}`, entity: o.export });
+      } else if (range?.until !== undefined && range.until < major) {
+        report({ severity: "error", message: `${o.export} (${o.sqlName}) sets ${raw}, which Postgres removed after ${range.until}`, entity: o.export });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlpg115.ts

@@ -0,0 +1,38 @@
+import { checkOf, rangeOf, storageParams, storageTarget, tablesOf, targetMajor } from "./postgres-helpers";
+import { indexesOf } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+/**
+ * SQLPG115: a feature newer than the target major.
+ *
+ * Doc: https://www.postgresql.org/docs/18/release-18.html (NOT ENFORCED
+ * constraints and virtual generated columns arrive in 18),
+ * https://www.postgresql.org/docs/15/release-15.html (NULLS NOT DISTINCT). Storage parameters read the generated catalog's
+ * `since` data. The target is `sql.postgresMajor`
+ * (recorded as `postgresMajor` in the output), else the newest pinned major;
+ * a feature is reported as a warning only when it is newer than the target,
+ * naming the first major that has it.
+ */
+export const sqlpg115 = checkOf({ id: "SQLPG115", description: "A feature newer than the target major" }, (ctx, report) => {
+  const major = targetMajor(ctx);
+  const note = (entity: string, what: string, since: number) =>
+    report({ severity: "warning", message: `${entity} uses ${what}, which needs Postgres ${since}; Postgres ${major} refuses it`, entity });
+  for (const o of postgresObjects(ctx)) {
+    const target = storageTarget(o);
+    if (!target) continue;
+    for (const name of storageParams(o.with as string | undefined).keys()) {
+      // SQLPG117 asks every view for security_invoker (15), so it is not also a portability finding.
+      if (name === "security_invoker") continue;
+      const since = rangeOf("storageParameters", `${target}.${name}`)?.since;
+      if (since !== undefined && since > major) note(o.export, `the storage parameter ${name}`, since);
+    }
+  }
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.checks) if (c.notEnforced !== undefined && major < 18) note(t.export, `a NOT ENFORCED / ENFORCED constraint${c.name ? ` ${c.name}` : ""}`, 18);
+    for (const fk of t.foreignKeys as Array<{ notEnforced?: boolean; name?: string }>) if (fk.notEnforced !== undefined && major < 18) note(t.export, `a NOT ENFORCED / ENFORCED foreign key${fk.name ? ` ${fk.name}` : ""}`, 18);
+    for (const c of t.columns) if (c.generated?.kind === "virtual" && major < 18) note(t.export, `the virtual generated column ${c.name}`, 18);
+    const nulls = [...t.uniques, ...(t.primaryKey ? [t.primaryKey] : [])].some((k) => k.nullsNotDistinct);
+    if (nulls && major < 15) note(t.export, "NULLS NOT DISTINCT", 15);
+  }
+  for (const i of indexesOf(ctx)) if ((i as { nullsNotDistinct?: boolean }).nullsNotDistinct && major < 15) note(i.export, "NULLS NOT DISTINCT", 15);
+});

package/src/lint/post-synth/sqlpg116.ts

@@ -0,0 +1,25 @@
+import { checkOf, rangeOf, targetMajor } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+/**
+ * SQLPG116: an extension the target major no longer ships.
+ *
+ * Doc: https://www.postgresql.org/docs/18/contrib.html and the release notes
+ * of the major that dropped it (adminpack and old_snapshot are gone after 16,
+ * https://www.postgresql.org/docs/17/release-17.html). The target is `postgresMajor` in the output. The extension names
+ * and their since/until majors come from the generated catalog, read from
+ * pg_available_extensions of each major's server image.
+ */
+export const sqlpg116 = checkOf({ id: "SQLPG116", description: "An extension the target major no longer ships" }, (ctx, report) => {
+  const major = targetMajor(ctx);
+  for (const o of postgresObjects(ctx)) {
+    if (o.type !== "Postgres::Extension") continue;
+    const until = rangeOf("extensions", o.name)?.until;
+    if (until === undefined || until >= major) continue;
+    report({
+      severity: "error",
+      message: `${o.export} installs the ${o.name} extension, which Postgres ${major} does not ship (last in ${until})`,
+      entity: o.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg117.ts

@@ -0,0 +1,24 @@
+import { checkOf, isView, storageParams } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+/**
+ * SQLPG117: a view that runs with its owner's privileges.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createview.html ("by default,
+ * access to the underlying base relations referenced in the view is determined
+ * by the permissions of the view owner"; with security_invoker = true it is the
+ * caller's, and the base tables' row-level security applies to the caller).
+ * A view over tables with RLS otherwise hands the owner's view of the rows to
+ * every role that can select from it.
+ */
+export const sqlpg117 = checkOf({ id: "SQLPG117", description: "A view without security_invoker runs with its owner's privileges" }, (ctx, report) => {
+  for (const v of postgresObjects(ctx).filter(isView)) {
+    const flag = storageParams(v.with).get("security_invoker");
+    if (flag === "true" || flag === "on" || flag === "1" || flag === "'true'" || flag === "'on'") continue;
+    report({
+      severity: "warning",
+      message: `${v.export} (${v.sqlName}) does not set security_invoker = true, so it reads its tables as its owner and skips the caller's row-level security`,
+      entity: v.export,
+    });
+  }
+});

package/src/lint/post-synth/sqlpg118.ts

@@ -0,0 +1,22 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+
+/**
+ * SQLPG118: a table that uses INHERITS.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-partitioning.html#DDL-PARTITIONING-DECLARATIVE-BEST-PRACTICES
+ * and https://www.postgresql.org/docs/18/ddl-inherit.html#DDL-INHERIT-CAVEATS
+ * (indexes, unique constraints and foreign keys are not inherited, so a
+ * constraint on the parent does not cover the children). Declarative
+ * partitioning (PARTITION BY ... / PARTITION OF) replaced inheritance for
+ * splitting a table; INHERITS is kept for its other uses.
+ */
+export const sqlpg118 = checkOf({ id: "SQLPG118", description: "A table uses INHERITS where declarative partitioning replaced it" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    if (t.inherits.length === 0) continue;
+    report({
+      severity: "warning",
+      message: `${t.export} (${t.sqlName}) uses INHERITS; its parent's unique and foreign keys do not cover it, so use PARTITION OF for a split table`,
+      entity: t.export,
+    });
+  }
+});

package/src/lint/rules/index.ts

@@ -0,0 +1,13 @@
+import type { LintRule } from "@intentius/chant/lint/rule";
+import { sqlch001 } from "./sqlch001";
+import { sqlch002 } from "./sqlch002";
+import { sqlch003 } from "./sqlch003";
+import { sqlpg001 } from "./sqlpg001";
+import { sqlpg002 } from "./sqlpg002";
+import { sqlpg003 } from "./sqlpg003";
+import { sqlpg004 } from "./sqlpg004";
+
+export { sqlch001, sqlch002, sqlch003, sqlpg001, sqlpg002, sqlpg003, sqlpg004 };
+
+/** The lexicon's source-level lint rules, returned by `lintRules()`. */
+export const rules: LintRule[] = [sqlch001, sqlch002, sqlch003, sqlpg001, sqlpg002, sqlpg003, sqlpg004];

package/src/lint/rules/postgres-templates.ts

@@ -0,0 +1,36 @@
+/**
+ * Finding the Postgres tags in a source file, for the source-level rules. A
+ * tag is Postgres's because of the module it is imported from: the
+ * `/postgres` subpath, or the package root for the tags whose names
+ * ClickHouse does not export (the root's `table` and `view` are
+ * ClickHouse's).
+ */
+
+import type * as ts from "typescript";
+import { tokenize, type Token } from "../../postgres/tokens";
+import type { PostgresTag } from "../../postgres/entities";
+import { findSqlTemplates, type FoundTemplate, type TemplateSource } from "../../core/find-templates";
+
+export { templatePosition, tokenPosition } from "../../core/find-templates";
+
+export const POSTGRES_TEMPLATE_SOURCES: readonly TemplateSource<PostgresTag>[] = [
+  {
+    dialect: "postgres",
+    modules: ["@intentius/chant-lexicon-sql/postgres"],
+    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension"],
+  },
+  {
+    dialect: "postgres",
+    modules: ["@intentius/chant-lexicon-sql"],
+    tags: ["schema", "index", "sequence", "type", "domain", "extension"],
+  },
+];
+
+export type PostgresFoundTemplate = FoundTemplate<PostgresTag>;
+
+/** Every Postgres template in the file. */
+export function findPostgresTemplates(source: ts.SourceFile): PostgresFoundTemplate[] {
+  return findSqlTemplates(source, POSTGRES_TEMPLATE_SOURCES);
+}
+
+export const postgresTokensOf = (found: PostgresFoundTemplate): Token[] => tokenize(found.parts);

package/src/lint/rules/rules.test.ts

@@ -0,0 +1,228 @@
+import * as ts from "typescript";
+import { describe, expect, test } from "vitest";
+import type { LintContext } from "@intentius/chant/lint/rule";
+import { sqlch001 } from "./sqlch001";
+import { sqlch002 } from "./sqlch002";
+import { sqlch003 } from "./sqlch003";
+import { sqlpg001 } from "./sqlpg001";
+import { sqlpg002 } from "./sqlpg002";
+import { sqlpg003 } from "./sqlpg003";
+import { sqlpg004, providerFromConfig } from "./sqlpg004";
+
+const ctx = (code: string): LintContext => ({
+  sourceFile: ts.createSourceFile("schema.ts", code, ts.ScriptTarget.Latest, true),
+  entities: [],
+  filePath: "schema.ts",
+});
+
+const IMPORT = 'import { table, view } from "@intentius/chant-lexicon-sql/clickhouse";\n';
+
+describe("SQLCH001: DDL that does not parse", () => {
+  test("is reported at the token, as a line and column of the .ts file", () => {
+    const code = `${IMPORT}export const t = table\`
+  CREATE TABLE t (
+    a Strin g
+  ) ENGINE = Log\`;`;
+    const [d, ...rest] = sqlch001.check(ctx(code));
+    expect(rest).toEqual([]);
+    expect(d).toMatchObject({ ruleId: "SQLCH001", severity: "error", line: 4, column: 13 });
+  });
+
+  test("a tag holding another statement is reported", () => {
+    const code = `${IMPORT}export const v = table\`CREATE VIEW v AS SELECT 1\`;`;
+    expect(sqlch001.check(ctx(code))[0]?.message).toMatch(/use the view tag/);
+  });
+
+  test("valid DDL with interpolations is clean", () => {
+    const code = `${IMPORT}import { events } from "./events";
+const name = "v";
+export const v = view\`CREATE VIEW \${name} AS SELECT \${events.columns.kind} FROM \${events}\`;`;
+    expect(sqlch001.check(ctx(code))).toEqual([]);
+  });
+
+  test("a tag of the same name from another module is not ours", () => {
+    const code = `import { table } from "./mine";\nexport const t = table\`not sql\`;`;
+    expect(sqlch001.check(ctx(code))).toEqual([]);
+  });
+
+  test("an aliased import is followed", () => {
+    const code = `import { table as chTable } from "@intentius/chant-lexicon-sql/clickhouse";\nexport const t = chTable\`CREATE TABLE\`;`;
+    expect(sqlch001.check(ctx(code))).toHaveLength(1);
+  });
+});
+
+describe("SQLCH002: a Nullable column in a key", () => {
+  test("is reported at the column in ORDER BY", () => {
+    const code = `${IMPORT}export const t = table\`
+  CREATE TABLE t (id UInt64, region Nullable(String))
+  ENGINE = MergeTree
+  ORDER BY (region, id)\`;`;
+    const diags = sqlch002.check(ctx(code));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]).toMatchObject({ ruleId: "SQLCH002", line: 5, column: 13 });
+    expect(diags[0]!.message).toMatch(/"region" is Nullable/);
+  });
+
+  test("sees LowCardinality(Nullable(...)), the NULL modifier and PRIMARY KEY", () => {
+    const code = `${IMPORT}export const t = table\`
+  CREATE TABLE t (a LowCardinality(Nullable(String)), b UInt8 NULL, c UInt8)
+  ENGINE = MergeTree ORDER BY (a, b, c) PRIMARY KEY a\`;`;
+    expect(sqlch002.check(ctx(code)).map((d) => d.message.match(/"(\w+)"/)![1])).toEqual(["a", "b", "a"]);
+  });
+
+  test("a function of a nullable column, or a non-key use, is not reported", () => {
+    const code = `${IMPORT}export const t = table\`
+  CREATE TABLE t (a Nullable(String), id UInt64)
+  ENGINE = MergeTree ORDER BY (id, ifNull(a, ''))\`;`;
+    expect(sqlch002.check(ctx(code))).toEqual([]);
+  });
+
+  test("allow_nullable_key = 1 turns it off", () => {
+    const code = `${IMPORT}export const t = table\`
+  CREATE TABLE t (a Nullable(String)) ENGINE = MergeTree ORDER BY a SETTINGS allow_nullable_key = 1\`;`;
+    expect(sqlch002.check(ctx(code))).toEqual([]);
+  });
+});
+
+describe("SQLCH003: a column interpolated without .columns", () => {
+  test("is reported for an entity declared in the file", () => {
+    const code = `${IMPORT}export const events = table\`CREATE TABLE events (kind String) ENGINE = Log\`;
+export const v = view\`CREATE VIEW v AS SELECT \${events.kind} FROM \${events}\`;`;
+    const diags = sqlch003.check(ctx(code));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]!.message).toMatch(/events\.columns\.kind/);
+  });
+
+  test("is reported for an entity imported from another project file", () => {
+    const code = `${IMPORT}import { events } from "./events";
+export const v = view\`CREATE VIEW v AS SELECT \${events.props} FROM \${events}\`;`;
+    expect(sqlch003.check(ctx(code))).toHaveLength(1);
+  });
+
+  test("a composite's parameter object and .columns are not reported", () => {
+    const code = `${IMPORT}import { events } from "./events";
+const make = (props: { kind: string }) => view\`CREATE VIEW \${props.kind} AS SELECT \${events.columns.kind} FROM \${events}\`;`;
+    expect(sqlch003.check(ctx(code))).toEqual([]);
+  });
+});
+
+const PG = 'import { index, sequence, table, view } from "@intentius/chant-lexicon-sql/postgres";\n';
+
+describe("SQLPG001: Postgres DDL that does not parse", () => {
+  test("is reported at the token, as a line and column of the .ts file", () => {
+    const code = `${PG}export const t = table\`
+  CREATE TABLE t (
+    a text DEFAULT 'x' CHEK (a <> '')
+  )\`;`;
+    const [d, ...rest] = sqlpg001.check(ctx(code));
+    expect(rest).toEqual([]);
+    expect(d).toMatchObject({ ruleId: "SQLPG001", severity: "error", line: 4, column: 24 });
+    expect(d!.message).toMatch(/CHEK/);
+  });
+
+  test("a tag holding another statement, a second CREATE and an unnamed index are reported", () => {
+    expect(sqlpg001.check(ctx(`${PG}export const i = table\`CREATE INDEX i ON t (a)\`;`))[0]?.message).toMatch(/use the index tag/);
+    expect(sqlpg001.check(ctx(`${PG}export const t = table\`CREATE TABLE a (x int); CREATE TABLE b (x int)\`;`))[0]?.message).toMatch(/second statement/);
+    const unnamed = sqlpg001.check(ctx(`${PG}export const i = index\`CREATE INDEX ON t (a)\`;`));
+    expect(unnamed[0]).toMatchObject({ line: 2, column: 37 });
+    expect(unnamed[0]!.message).toMatch(/an index needs a name/);
+  });
+
+  test("valid DDL with interpolations is clean, and ClickHouse's tags are not read as Postgres", () => {
+    const code = `${PG}import { users } from "./users";
+export const t = table\`CREATE TABLE \${"orders"} (id bigint PRIMARY KEY, user_id bigint REFERENCES \${users} (\${users.columns.id}))\`;`;
+    expect(sqlpg001.check(ctx(code))).toEqual([]);
+    const ch = 'import { table } from "@intentius/chant-lexicon-sql/clickhouse";\nexport const t = table`CREATE TABLE t (a String) ENGINE = Log`;';
+    expect(sqlpg001.check(ctx(ch))).toEqual([]);
+  });
+
+  test("the package root's Postgres-only tags are Postgres's", () => {
+    const code = 'import { sequence } from "@intentius/chant-lexicon-sql";\nexport const s = sequence`CREATE SEQUENCE s START WITH`;';
+    expect(sqlpg001.check(ctx(code))).toHaveLength(1);
+  });
+});
+
+describe("SQLPG002: a column interpolated without .columns", () => {
+  test("is reported for an entity declared in the file", () => {
+    const code = `${PG}export const users = table\`CREATE TABLE users (kind text)\`;
+export const v = view\`CREATE VIEW v AS SELECT \${users.kind} FROM \${users}\`;`;
+    const diags = sqlpg002.check(ctx(code));
+    expect(diags).toHaveLength(1);
+    expect(diags[0]!.message).toMatch(/users\.columns\.kind/);
+  });
+});
+
+describe("SQLPG003: an object named in a regclass string", () => {
+  test("nextval('...') and '...'::regclass are reported at the string", () => {
+    const code = `${PG}export const t = table\`CREATE TABLE t (
+    a bigint DEFAULT nextval('app.seq'),
+    b regclass DEFAULT 'app.t'::regclass
+  )\`;`;
+    const diags = sqlpg003.check(ctx(code));
+    expect(diags.map((d) => [d.line, d.column])).toEqual([[3, 30], [4, 24]]);
+    expect(diags[0]!.message).toMatch(/nextval\(\$\{\.\.\.\}\)/);
+    expect(diags[0]!.severity).toBe("warning");
+  });
+
+  test("an interpolated sequence is clean", () => {
+    const code = `${PG}import { seq } from "./seq";
+export const t = table\`CREATE TABLE t (a bigint DEFAULT nextval(\${seq}))\`;`;
+    expect(sqlpg003.check(ctx(code))).toEqual([]);
+  });
+});
+
+describe("SQLPG004: an extension the configured provider does not allow", () => {
+  const withConfig = (code: string, sql: unknown): LintContext => ({ ...ctx(code), projectConfig: { sql } as never });
+  const PGX = 'import { extension, schema } from "@intentius/chant-lexicon-sql/postgres";\n';
+  const ext = (stmt: string) => `${PGX}export const e = extension\`${stmt}\`;`;
+
+  test("is reported at the extension's name when the provider's list lacks it", () => {
+    const [d, ...rest] = sqlpg004.check(withConfig(ext("CREATE EXTENSION pg_squeeze"), { provider: "rds" }));
+    expect(rest).toEqual([]);
+    expect(d).toMatchObject({ ruleId: "SQLPG004", severity: "error", line: 2, column: 45 });
+    expect(d!.message).toMatch(/Amazon RDS for PostgreSQL does not allow the extension "pg_squeeze"/);
+  });
+
+  test("an allowed extension, IF NOT EXISTS and a quoted name are read", () => {
+    expect(sqlpg004.check(withConfig(ext("CREATE EXTENSION IF NOT EXISTS pgcrypto"), { provider: "neon" }))).toEqual([]);
+    expect(sqlpg004.check(withConfig(ext('CREATE EXTENSION "uuid-ossp"'), { provider: "neon" }))).toEqual([]);
+    const d = sqlpg004.check(withConfig(ext("CREATE EXTENSION IF NOT EXISTS plv8"), { provider: "neon" }));
+    expect(d).toHaveLength(1);
+    expect(d[0]!.column).toBe(59);
+  });
+
+  test("each provider reports one name it lacks", () => {
+    const lacks: Record<string, string> = {
+      rds: "timescaledb",
+      aurora: "timescaledb",
+      "cloud-sql": "timescaledb",
+      azure: "pg_stat_monitor",
+      neon: "pg_squeeze",
+    };
+    for (const [provider, name] of Object.entries(lacks)) {
+      expect(sqlpg004.check(withConfig(ext(`CREATE EXTENSION ${name}`), { provider })), provider).toHaveLength(1);
+    }
+  });
+
+  test("a partial list (supabase) does not report a name outside it", () => {
+    expect(sqlpg004.check(withConfig(ext("CREATE EXTENSION pg_trgm"), { provider: "supabase" }))).toEqual([]);
+  });
+
+  test("with no provider, or profiles that disagree, it is silent", () => {
+    expect(sqlpg004.check(ctx(ext("CREATE EXTENSION pg_squeeze")))).toEqual([]);
+    expect(sqlpg004.check(withConfig(ext("CREATE EXTENSION pg_squeeze"), { dialect: "postgres" }))).toEqual([]);
+    const split = { profiles: { a: { url: "x", provider: "rds" }, b: { url: "y", provider: "neon" } } };
+    expect(sqlpg004.check(withConfig(ext("CREATE EXTENSION pg_squeeze"), split))).toEqual([]);
+  });
+
+  test("profiles that all name one provider set it", () => {
+    expect(providerFromConfig({ sql: { profiles: { a: { url: "x", provider: "rds" }, b: { url: "y", provider: "rds" } } } })).toBe("rds");
+    expect(providerFromConfig({ sql: { provider: "azure", profiles: { a: { url: "x", provider: "rds" } } } })).toBe("azure");
+  });
+
+  test("the ClickHouse tags and other statements are not read", () => {
+    const ch = 'import { table } from "@intentius/chant-lexicon-sql/clickhouse";\nexport const t = table`CREATE TABLE t (a String) ENGINE = Log`;';
+    expect(sqlpg004.check(withConfig(ch, { provider: "rds" }))).toEqual([]);
+    expect(sqlpg004.check(withConfig(`${PGX}export const s = schema\`CREATE SCHEMA app\`;`, { provider: "rds" }))).toEqual([]);
+  });
+});

package/src/lint/rules/sqlch001.ts

@@ -0,0 +1,53 @@
+import type { LintContext, LintDiagnostic, LintRule } from "@intentius/chant/lint/rule";
+import { parseCreate } from "../../clickhouse/parser";
+import { SqlSyntaxError } from "../../clickhouse/tokens";
+import { findTemplates, templatePosition, tokensOf } from "./templates";
+
+const STATEMENT: Record<string, string> = { database: "CREATE DATABASE", table: "CREATE TABLE", view: "CREATE VIEW" };
+
+/**
+ * SQLCH001: the DDL in a `database`, `table` or `view` template does not parse, or holds another statement than its tag.
+ *
+ * The same parse runs when the build calls the tag, and fails the build there.
+ * This rule reports it in the editor and in `chant lint`, at the token, before
+ * anything is built. Interpolations are references here, since lint cannot
+ * know their values, so an error inside text a string interpolation supplies
+ * is left to the build.
+ */
+export const sqlch001: LintRule = {
+  id: "SQLCH001",
+  severity: "error",
+  category: "correctness",
+  description: "ClickHouse DDL in a database, table or view template does not parse",
+
+  check(context: LintContext): LintDiagnostic[] {
+    const source = context.sourceFile;
+    const out: LintDiagnostic[] = [];
+    for (const found of findTemplates(source)) {
+      let tokens;
+      try {
+        tokens = tokensOf(found);
+        const node = parseCreate(tokens);
+        if (node.statement !== found.tag) {
+          out.push({
+            ruleId: "SQLCH001",
+            severity: "error",
+            message: `${found.tag}\`...\` holds a ${STATEMENT[node.statement]}; use the ${node.statement} tag`,
+            file: context.filePath,
+            ...templatePosition(source, found, 0, 0),
+          });
+        }
+      } catch (err) {
+        if (!(err instanceof SqlSyntaxError)) throw err;
+        out.push({
+          ruleId: "SQLCH001",
+          severity: "error",
+          message: `ClickHouse DDL does not parse: ${err.message}`,
+          file: context.filePath,
+          ...templatePosition(source, found, err.part, err.offset),
+        });
+      }
+    }
+    return out;
+  },
+};