@intentius/chant-lexicon-sql 0.116.0 → 0.118.0

package/src/clickhouse/parser.ts

@@ -1,7 +1,8 @@
 /**
  * A hand-written recursive-descent parser for the ClickHouse statements the
- * dialect declares: `CREATE DATABASE`, `CREATE TABLE`, `CREATE VIEW` and
- * `CREATE MATERIALIZED VIEW` (chant #3196).
+ * dialect declares: `CREATE DATABASE`, `CREATE TABLE`, `CREATE VIEW`,
+ * `CREATE MATERIALIZED VIEW` (chant #3196), `CREATE DICTIONARY` and
+ * `CREATE FUNCTION` (#3682).
  *
  * Statement structure is parsed; expressions are not. An expression (a
  * default, a codec, a sort key, a TTL, a view's SELECT) is kept as a span of
@@ -114,7 +115,57 @@ export interface ViewNode extends StorageNode {
   comment?: Span;
 }
 
-export type CreateNode = DatabaseNode | TableNode | ViewNode;
+/** One attribute of a dictionary: `name Type [DEFAULT expr] [EXPRESSION expr] [HIERARCHICAL] [INJECTIVE] [IS_OBJECT_ID]`. */
+export interface DictionaryAttributeNode {
+  name: string;
+  nameSpan: Span;
+  type: Span;
+  default?: Span;
+  expression?: Span;
+  /** `HIERARCHICAL`, `BIDIRECTIONAL`, `INJECTIVE`, `IS_OBJECT_ID`, upper case, as written. */
+  flags: string[];
+}
+
+export interface DictionaryNode {
+  statement: "dictionary";
+  orReplace: boolean;
+  ifNotExists: boolean;
+  name: Span;
+  onCluster?: Span;
+  attributes: DictionaryAttributeNode[];
+  /** The key columns, as written after `PRIMARY KEY`. */
+  primaryKey?: Span;
+  /** What is inside `SOURCE(...)`: `CLICKHOUSE(TABLE 'rates')`. */
+  source?: Span;
+  /** What is inside `LAYOUT(...)`: `HASHED()`. */
+  layout?: Span;
+  /** What is inside `LIFETIME(...)`: `300`, `MIN 0 MAX 300`. */
+  lifetime?: Span;
+  /** What is inside `RANGE(...)`: `MIN start MAX end`. */
+  range?: Span;
+  /** What is inside `SETTINGS(...)`. */
+  settings?: Span;
+  comment?: Span;
+}
+
+/** A SQL user-defined function: `CREATE FUNCTION name AS (x, y) -> expr`. It lives outside any database. */
+export interface FunctionNode {
+  statement: "function";
+  orReplace: boolean;
+  ifNotExists: boolean;
+  name: Span;
+  onCluster?: Span;
+  /** The parameter names, each as written. */
+  params: Array<{ name: string; span: Span }>;
+  /** The whole lambda after `AS`: `(x, y) -> expr`. */
+  lambda: Span;
+  /** The expression after `->`. */
+  body: Span;
+  /** Never set: a function has no comment. Here so every node can be asked. */
+  comment?: undefined;
+}
+
+export type CreateNode = DatabaseNode | TableNode | ViewNode | DictionaryNode | FunctionNode;
 
 /** A token that can stand where a name goes. */
 const isNameToken = (t: Token | undefined): boolean =>
@@ -350,9 +401,11 @@ class Parser extends SqlCursor {
     }
     if (this.accept("DATABASE")) return this.database();
     if (this.accept("TABLE")) return this.table(orReplace);
+    if (this.accept("DICTIONARY")) return this.dictionary(orReplace);
+    if (this.accept("FUNCTION")) return this.function(orReplace);
     const materialized = this.accept("MATERIALIZED");
     if (this.accept("VIEW")) return this.view(orReplace, materialized);
-    return this.fail(materialized ? "expected VIEW" : "expected DATABASE, TABLE, VIEW or MATERIALIZED VIEW");
+    return this.fail(materialized ? "expected VIEW" : "expected DATABASE, TABLE, VIEW, MATERIALIZED VIEW, DICTIONARY or FUNCTION");
   }
 
   private ifNotExists(): boolean {
@@ -415,6 +468,85 @@ class Parser extends SqlCursor {
     return node;
   }
 
+  private dictionaryAttribute(): DictionaryAttributeNode {
+    const { text, span } = this.name("an attribute name");
+    const STOP = ["DEFAULT", "EXPRESSION", "HIERARCHICAL", "BIDIRECTIONAL", "INJECTIVE", "IS_OBJECT_ID"];
+    const attr: DictionaryAttributeNode = { name: text, nameSpan: span, type: this.typeSpan(), flags: [] };
+    for (;;) {
+      if (this.accept("DEFAULT")) attr.default = this.expr(STOP);
+      else if (this.accept("EXPRESSION")) attr.expression = this.expr(STOP);
+      else if (kw(this.peek(), "HIERARCHICAL", "BIDIRECTIONAL", "INJECTIVE", "IS_OBJECT_ID")) attr.flags.push(this.next().text.toUpperCase());
+      else return attr;
+    }
+  }
+
+  private dictionary(orReplace: boolean): DictionaryNode {
+    const ifNotExists = this.ifNotExists();
+    const name = this.qualifiedName();
+    this.uuid();
+    const node: DictionaryNode = { statement: "dictionary", orReplace, ifNotExists, name, onCluster: this.onCluster(), attributes: [] };
+    this.expectPunct("(");
+    for (;;) {
+      node.attributes.push(this.dictionaryAttribute());
+      if (this.acceptPunct(",")) {
+        if (this.acceptPunct(")")) break;
+        continue;
+      }
+      this.expectPunct(")");
+      break;
+    }
+    const CLAUSES = ["PRIMARY", "SOURCE", "LAYOUT", "LIFETIME", "RANGE", "SETTINGS", "COMMENT"];
+    for (;;) {
+      if (kw(this.peek(), "PRIMARY") && kw(this.peek(1), "KEY")) {
+        this.p += 2;
+        node.primaryKey = this.expr(CLAUSES, false);
+      } else if (this.accept("SOURCE")) node.source = this.parenthesized();
+      else if (this.accept("LAYOUT")) node.layout = this.parenthesized();
+      else if (this.accept("LIFETIME")) node.lifetime = this.parenthesized();
+      else if (this.accept("RANGE")) node.range = this.parenthesized();
+      else if (this.accept("SETTINGS")) node.settings = this.parenthesized();
+      else if (this.accept("COMMENT")) node.comment = this.expr();
+      else break;
+    }
+    if (!node.primaryKey) this.fail("expected PRIMARY KEY: a dictionary needs its key columns");
+    if (!node.source) this.fail("expected SOURCE(...): a dictionary needs a source");
+    if (!node.layout) this.fail("expected LAYOUT(...): a dictionary needs a layout");
+    this.finish("dictionary definition");
+    return node;
+  }
+
+  private function(orReplace: boolean): FunctionNode {
+    const ifNotExists = this.ifNotExists();
+    const name = this.qualifiedName();
+    if (name.to - name.from > 1 && this.tokens.slice(name.from, name.to).some((t) => t.kind === "punct" && t.text === ".")) {
+      this.fail("a function belongs to no database: name it without one");
+    }
+    const onCluster = this.onCluster();
+    this.expect("AS");
+    const from = this.idx();
+    const params: FunctionNode["params"] = [];
+    const param = () => {
+      const p = this.name("a parameter name");
+      params.push({ name: p.text, span: p.span });
+    };
+    if (this.acceptPunct("(")) {
+      if (!this.acceptPunct(")")) {
+        for (;;) {
+          param();
+          if (this.acceptPunct(",")) continue;
+          this.expectPunct(")");
+          break;
+        }
+      }
+    } else param();
+    const arrow = this.next();
+    if (arrow?.kind !== "op" || arrow.text !== "->") this.fail("expected -> and the function's expression", arrow);
+    const body = this.expr([], false);
+    const lambda = this.span(from, body.refs);
+    this.finish("function definition");
+    return { statement: "function", orReplace, ifNotExists, name, onCluster, params, lambda, body };
+  }
+
   private view(orReplace: boolean, materialized: boolean): ViewNode {
     const ifNotExists = this.ifNotExists();
     const name = this.qualifiedName();

package/src/clickhouse/plan/commands.ts

@@ -11,7 +11,9 @@
  * request's base and head, and needs no server. `plan` compares a build with
  * the server `sql.profiles.<env>` binds and asks that server's formatter about
  * expressions the rules leave different. Both exit 2 when a change needs a
- * rebuild, which a plan refuses to make in place, and 0 otherwise; for each
+ * rebuild, which a plan refuses to make in place, and `plan` also when the
+ * declared databases hold an object whose definition it cannot read (#3653),
+ * which it names; 0 otherwise. For each
  * refused table they name the `ClickHouseRebuildOp` to run instead
  * (`rebuildOps` in `--json`, `./rebuild-handoff.ts`).
  *
@@ -28,10 +30,12 @@
  */
 
 import type { CommandGroup, CommandGroupContext } from "@intentius/chant/cli/command-group";
-import { diffSchemas, type SchemaDiff } from "./diff";
+import { diffSchemas, type SchemaDiff, type UnreadableEntry } from "./diff";
 import { renderDiff } from "./report";
 import { keyedByQualifiedName, schemaFromBuildFile, schemaFromServer } from "./schema";
 import { dropFormattingOnly } from "./server-format";
+import { scopeOf } from "./normalize";
+import { declaredAccess } from "../live/catalog";
 import { bindClickHouse } from "../live/bind";
 import { rebuildOpSuggestions } from "./rebuild-handoff";
 import { readFileSync } from "node:fs";
@@ -86,7 +90,7 @@ async function runDiffStatements(before: string, after: string, json: boolean, t
 
 function emit(diff: SchemaDiff, json: boolean, title: string): number {
   console.log(json ? JSON.stringify(diff, null, 2) : renderDiff(diff, { title }));
-  return diff.rebuilds.length > 0 ? 2 : 0;
+  return diff.rebuilds.length > 0 || (diff.unreadable?.length ?? 0) > 0 ? 2 : 0;
 }
 
 export async function runDiff(ctx: CommandGroupContext): Promise<number> {
@@ -117,8 +121,9 @@ export async function runDiff(ctx: CommandGroupContext): Promise<number> {
 export async function planAgainstServer(environment: string, buildFile: string, options: Parameters<typeof bindClickHouse>[0] = {}): Promise<SchemaDiff> {
   const target = await bindClickHouse({ ...options, environment });
   const declared = keyedByQualifiedName(schemaFromBuildFile(buildFile, target.defaultDatabase, target.topology));
-  const databases = new Set(declared.map((o) => o.canonical.database ?? o.canonical.name));
-  const live = await schemaFromServer(target, databases);
+  const databases = new Set(declared.map((o) => scopeOf(o.canonical)));
+  const unreadable: UnreadableEntry[] = [];
+  const live = await schemaFromServer(target, databases, unreadable, declaredAccess(declared.map((o) => o.canonical)));
   const diff = diffSchemas(live, declared);
   const changes = await dropFormattingOnly(target.endpoint, diff.changes);
   const rebuildOps = rebuildOpSuggestions(
@@ -126,9 +131,15 @@ export async function planAgainstServer(environment: string, buildFile: string,
     new Map(declared.map((o) => [o.key, o.canonical])),
     environment,
   );
-  const label = new Map(declared.map((o) => [o.key, `${o.exportName} (${o.key})`]));
+  const label = new Map(declared.map((o) => [o.key, o.exportName === o.key ? o.key : `${o.exportName} (${o.key})`]));
   const relabel = changes.map((c) => ({ ...c, object: label.get(c.object) ?? c.object }));
-  return { changes: relabel, rebuilds: relabel.filter((c) => c.class === "rebuild"), hints: diff.hints, ...(rebuildOps.length > 0 ? { rebuildOps } : {}) };
+  return {
+    changes: relabel,
+    rebuilds: relabel.filter((c) => c.class === "rebuild"),
+    hints: diff.hints,
+    ...(rebuildOps.length > 0 ? { rebuildOps } : {}),
+    ...(unreadable.length > 0 ? { unreadable } : {}),
+  };
 }
 
 export async function runPlan(ctx: CommandGroupContext): Promise<number> {

package/src/clickhouse/plan/deep.ts

@@ -22,12 +22,12 @@
 import { deepObservation, type DeepObservationResult, type DeepResourceObservation, type DeepNormalizationHooks } from "@intentius/chant/deep-observation";
 import type { UnobservedEntity } from "@intentius/chant/lexicon";
 import { bindClickHouse, classifyClickHouseFailure, type BindOptions, type ClickHouseTarget } from "../live/bind";
-import { readLiveSchema, SYSTEM_DATABASES, type LiveObject } from "../live/catalog";
+import { accessOf, readLiveAccess, readLiveSchema, SYSTEM_DATABASES, type LiveObject } from "../live/catalog";
 import { clickhouseQuery } from "../http";
 import { sqlString } from "../apply/statements";
 import { stripMarkerFromStatement } from "../ownership";
-import { database, table, view, CLICKHOUSE_ENTITY_TYPES, type ColumnDef } from "../entities";
-import { canonicalObject, type CanonicalColumn, type CanonicalObject } from "./normalize";
+import { database, dictionary, func, policy, role, table, user, view, CLICKHOUSE_ENTITY_TYPES, type ColumnDef } from "../entities";
+import { canonicalObject, objectKey, type CanonicalColumn, type CanonicalObject } from "./normalize";
 import { renderFor } from "../topology";
 
 type Props = Record<string, unknown>;
@@ -40,7 +40,22 @@ export const sqlDeepNormalizationHooks: DeepNormalizationHooks = {
 };
 
 function liveProps(o: LiveObject): Props {
-  const tag = o.type === CLICKHOUSE_ENTITY_TYPES.database ? database : o.type === CLICKHOUSE_ENTITY_TYPES.table ? table : view;
+  const tag =
+    o.type === CLICKHOUSE_ENTITY_TYPES.database
+      ? database
+      : o.type === CLICKHOUSE_ENTITY_TYPES.table
+        ? table
+        : o.type === CLICKHOUSE_ENTITY_TYPES.dictionary
+          ? dictionary
+          : o.type === CLICKHOUSE_ENTITY_TYPES.function
+            ? func
+            : o.type === CLICKHOUSE_ENTITY_TYPES.user
+              ? user
+              : o.type === CLICKHOUSE_ENTITY_TYPES.role
+                ? role
+                : o.type === CLICKHOUSE_ENTITY_TYPES.rowPolicy
+                  ? policy
+                  : view;
   const strings = Object.assign([o.statement], { raw: [o.statement] }) as unknown as TemplateStringsArray;
   return { ...(tag(strings).props as unknown as Props) };
 }
@@ -62,8 +77,20 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
   adopt("name", d.name === l.name);
   adopt("database", d.database === l.database);
   adopt("engine", same("engine"));
-  for (const k of ["orderBy", "primaryKey", "partitionBy", "sampleBy", "ttl", "comment", "select", "refresh"] as const) adopt(k, same(k));
+  for (const k of ["orderBy", "primaryKey", "partitionBy", "sampleBy", "ttl", "comment", "select", "refresh", "dataSource", "layout", "lifetime", "range"] as const) adopt(k, same(k));
   adopt("settings", same("settings"));
+  // A user's, role's or row policy's fields, compared as `../access.ts` reads them.
+  if (d.kind === "user" || d.kind === "role" || d.kind === "rowPolicy") {
+    for (const k of ["identified", "host", "validUntil", "defaultRole", "defaultDatabase", "grantees", "settings", "as", "for", "using", "to"]) {
+      adopt(k, d.access?.[k] === l.access?.[k]);
+    }
+    adopt("table", d.table === l.table);
+    // A user's authentication is the environment's unless the declaration says it.
+    if (d.kind === "user" && declared.identified === undefined) delete out.identified;
+  }
+  // A function's parameters and expression are one lambda: the same lambda is the declaration's words.
+  adopt("params", d.kind === "function" && same("lambda"));
+  adopt("body", d.kind === "function" && same("lambda"));
   adopt("indexes", same("indexes"));
   adopt("projections", same("projections"));
   adopt("constraints", same("constraints"));
@@ -72,7 +99,7 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
   if (d.kind === "view" || d.kind === "materializedView") {
     // The server infers a view's columns; a declaration that lists none is not drift.
     if (declaredColumns.length === 0) out.columns = [];
-  } else if (d.kind === "table") {
+  } else if (d.kind === "table" || d.kind === "dictionary") {
     const liveColumns = (live.columns as ColumnDef[] | undefined) ?? [];
     out.columns = liveColumns.map((c, i) => {
       const lc = l.columns[i];
@@ -84,6 +111,22 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
   return out;
 }
 
+/** The entity types that belong to no database. */
+const GLOBAL_TYPES: ReadonlySet<string> = new Set([CLICKHOUSE_ENTITY_TYPES.database, CLICKHOUSE_ENTITY_TYPES.function, CLICKHOUSE_ENTITY_TYPES.user, CLICKHOUSE_ENTITY_TYPES.role]);
+
+/** Whether the server's formatter prints two expressions the same. A formatter that cannot parse them says no. */
+async function sameExpression(target: ClickHouseTarget, a: string, b: string): Promise<boolean> {
+  try {
+    const [row] = await clickhouseQuery<{ a: string; b: string }>(
+      target.endpoint,
+      `SELECT formatQuerySingleLine(${sqlString(`SELECT ${a}`)}) AS a, formatQuerySingleLine(${sqlString(`SELECT ${b}`)}) AS b`,
+    );
+    return row !== undefined && row.a === row.b;
+  } catch {
+    return false;
+  }
+}
+
 /** Every server's copy of each table and view on a cluster (#3664), as `<database>.<name>` → host → statement. */
 interface ClusterCopies {
   /** The host the profile names, whose copy the rest are compared with. */
@@ -164,7 +207,7 @@ export async function observeResourcesDeep(
   let live: LiveObject[];
   try {
     target = await bindClickHouse(options);
-    live = await readLiveSchema(target);
+    live = [...(await readLiveSchema(target)), ...(await readLiveAccess(target, accessOf(options.entities, target.defaultDatabase)))];
   } catch (err) {
     const why = classifyClickHouseFailure(err);
     for (const name of options.entityNames) {
@@ -172,7 +215,7 @@ export async function observeResourcesDeep(
     }
     return deepObservation({}, unobserved);
   }
-  const byKey = new Map(live.map((o) => [`${o.database ?? ""}.${o.name}`, o]));
+  const byKey = new Map(live.map((o) => [objectKey(o), o]));
   let copies: ClusterCopies | undefined;
   try {
     copies = await clusterCopies(target);
@@ -190,10 +233,20 @@ export async function observeResourcesDeep(
       unobserved[name] = { type: entity?.entityType ?? "", reason: "unsupported-kind" };
       continue;
     }
+    if (entity.entityType === CLICKHOUSE_ENTITY_TYPES.grant) {
+      unobserved[name] = {
+        type: entity.entityType,
+        reason: "unsupported-kind",
+        detail: "a grant is compared as part of its grantees' grants, which chant sql plan reports (SQLCH273, SQLCH274)",
+      };
+      continue;
+    }
     const props = entity.props;
-    const isDb = entity.entityType === CLICKHOUSE_ENTITY_TYPES.database;
+    const isDb = GLOBAL_TYPES.has(entity.entityType);
     const db = isDb ? undefined : typeof props.database === "string" ? props.database : target.defaultDatabase;
-    const o = byKey.get(`${db ?? ""}.${String(props.name)}`);
+    const o = byKey.get(
+      objectKey({ type: entity.entityType, ...(db !== undefined ? { database: db } : {}), name: String(props.name), ...(typeof props.table === "string" ? { table: props.table } : {}) }),
+    );
     if (!o) continue;
     try {
       const d = canonicalObject(renderFor(String(props.ddl), target.topology), target.defaultDatabase);
@@ -210,7 +263,14 @@ export async function observeResourcesDeep(
         };
         continue;
       }
-      const l = canonicalObject(o.statement, target.defaultDatabase);
+      let l = canonicalObject(o.statement, target.defaultDatabase);
+      // The server prints a function's expression its own way (`k*x + b` as `((k * x) + b)`): its formatter says whether the two are one.
+      if (d.kind === "function" && d.lambda !== l.lambda && (await sameExpression(target, d.lambda ?? "", l.lambda ?? ""))) l = { ...l, lambda: d.lambda! };
+      // A row policy's condition, the same way.
+      const using = d.access?.using;
+      if (d.kind === "rowPolicy" && using !== undefined && using !== l.access?.using && (await sameExpression(target, using, l.access?.using ?? ""))) {
+        l = { ...l, access: { ...l.access, using } };
+      }
       resources[name] = {
         type: o.type,
         physicalId,

package/src/clickhouse/plan/diff.ts

@@ -17,7 +17,7 @@
  */
 
 import { CLASSIFIER_RULES, type ChangeClass, type ClassifierRuleId } from "./rules";
-import type { CanonicalObject } from "./normalize";
+import type { CanonicalColumn, CanonicalObject } from "./normalize";
 import type { RebuildOpSuggestion } from "./rebuild-handoff";
 import { MERGE_TREE_SETTINGS } from "../../generated/clickhouse";
 import { classifiedChange, type ChangeSet, type ClassifiedChange } from "../../core/classifier";
@@ -32,6 +32,19 @@ export interface SchemaDiff extends ChangeSet<Change> {
   rebuilds: Change[];
   /** For each table refused as a rebuild, the rebuild migration Op to run instead (`./rebuild-handoff.ts`). */
   rebuildOps?: RebuildOpSuggestion[];
+  /**
+   * Objects on the server, in the declared databases, whose definition chant
+   * cannot read (#3653): a plan names each one and fails rather than leave
+   * it out.
+   */
+  unreadable?: UnreadableEntry[];
+}
+
+/** An object a plan could not read: `database.name`, its type and why. */
+export interface UnreadableEntry {
+  object: string;
+  type: string;
+  reason: string;
 }
 
 const qualified = (o: CanonicalObject) => (o.database ? `${o.database}.${o.name}` : o.name);
@@ -133,6 +146,38 @@ function diffObject(key: string, before: CanonicalObject, after: CanonicalObject
     return;
   }
 
+  if (before.kind === "user" || before.kind === "role" || before.kind === "rowPolicy") {
+    const rule = before.kind === "user" ? "SQLCH271" : before.kind === "role" ? "SQLCH270" : "SQLCH272";
+    const b = before.access ?? {};
+    const a = after.access ?? {};
+    const order = ["identified", "host", "validUntil", "defaultRole", "defaultDatabase", "grantees", "settings", "as", "for", "using", "to"];
+    const fields = [...new Set([...Object.keys(b), ...Object.keys(a)])].sort((x, y) => order.indexOf(x) - order.indexOf(y));
+    for (const field of fields) {
+      // A user's authentication is compared only when the declaration says it.
+      if (before.kind === "user" && field === "identified" && a.identified === undefined) continue;
+      if (b[field] !== a[field]) out.push(change(key, field, rule, b[field], a[field]));
+    }
+    return;
+  }
+
+  if (before.kind === "grants") {
+    const b = before.access ?? {};
+    const a = after.access ?? {};
+    for (const atom of Object.keys(b)) if (!(atom in a)) out.push(change(key, `grants.${atom}`, "SQLCH274", atom, undefined));
+    for (const atom of Object.keys(a)) if (!(atom in b)) out.push(change(key, `grants.${atom}`, "SQLCH273", undefined, atom));
+    return;
+  }
+
+  if (before.kind === "function") {
+    if (before.lambda !== after.lambda) out.push(change(key, "lambda", "SQLCH260", before.lambda, after.lambda));
+    return;
+  }
+
+  if (before.kind === "dictionary") {
+    diffDictionary(key, before, after, out);
+    return;
+  }
+
   if (before.kind === "view") {
     if (before.select !== after.select) out.push(change(key, "select", "SQLCH240", before.select, after.select));
     return;
@@ -180,6 +225,23 @@ function diffObject(key: string, before: CanonicalObject, after: CanonicalObject
   diffMap(key, "constraints", before.constraints, after.constraints, "SQLCH215", out);
 }
 
+/** A dictionary: every change but its comment replaces it (SQLCH245). */
+function diffDictionary(key: string, before: CanonicalObject, after: CanonicalObject, out: Change[]): void {
+  const attribute = (c: CanonicalColumn) =>
+    [c.type, c.defaultExpr !== undefined ? `DEFAULT ${c.defaultExpr}` : "", c.expression !== undefined ? `EXPRESSION ${c.expression}` : "", c.flags ?? ""].filter(Boolean).join(" ");
+  const b = new Map(before.columns.map((c) => [c.name, attribute(c)]));
+  const a = new Map(after.columns.map((c) => [c.name, attribute(c)]));
+  for (const name of new Set([...b.keys(), ...a.keys()])) {
+    if (b.get(name) !== a.get(name)) out.push(change(key, `columns.${name}`, "SQLCH245", b.get(name), a.get(name)));
+  }
+  const order = (o: CanonicalObject) => o.columns.map((c) => c.name).join(", ");
+  if (order(before) !== order(after) && [...a.keys()].every((n) => b.has(n)) && a.size === b.size) out.push(change(key, "columns.order", "SQLCH245", order(before), order(after)));
+  for (const f of ["primaryKey", "dataSource", "layout", "lifetime", "range"] as const) {
+    if (before[f] !== after[f]) out.push(change(key, f, "SQLCH245", before[f], after[f]));
+  }
+  for (const name of changedEntries(before.settings, after.settings)) out.push(change(key, `settings.${name}`, "SQLCH245", before.settings[name], after.settings[name]));
+}
+
 /**
  * Diff two schemas. `before` and `after` are matched by key; an `after`
  * object whose key is new but whose `previously` names a `before` object
@@ -190,7 +252,8 @@ export function diffSchemas(before: readonly SchemaObject[], after: readonly Sch
   const hints: string[] = [];
   const matches = matchByIdentity(before, after, {
     qualified,
-    previously: (o) => o.previously,
+    // A function, a user, a role, a row policy and a grantee's grants are not renamed: one under a new name is a create.
+    previously: (o) => (o.kind === "function" || o.kind === "user" || o.kind === "role" || o.kind === "rowPolicy" || o.kind === "grants" ? undefined : o.previously),
     previousNames: (o, prev) => [prev, `${o.database}.${prev}`],
   });
   for (const m of matches) {