@intentius/chant-lexicon-sql 0.121.1 → 0.123.0

package/src/lint/post-synth/sqlch125.ts

@@ -0,0 +1,56 @@
+import { CODECS, CLICKHOUSE_VERSION } from "../../generated/clickhouse";
+import { checkOf, isTable, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+type Param = { name: string; kind: string; optional?: boolean; range?: readonly [number, number]; values?: readonly string[] };
+
+const NUMBER = /^-?\d+(\.\d+)?$/;
+
+/**
+ * SQLCH125: a codec's parameters do not fit it: more than the codec takes
+ * (`LZ4(1)`), a number outside its range (`ZSTD(99)`, `LZ4HC(13)`), or a
+ * value outside its set (`Delta(3)`; the byte width is 1, 2, 4 or 8).
+ *
+ * The parameters are the `CODEC_OVERLAY`'s; a codec marked `"unknown"` there
+ * (the experimental ones with undocumented parameters) is not checked. An
+ * unknown codec name is SQLCH114's.
+ */
+export const sqlch125 = checkOf({ id: "SQLCH125", description: "A codec parameter is outside what the codec takes" }, (ctx, report) => {
+  const codecs = CODECS as Record<string, { parameters: readonly Param[] | "unknown" } | undefined>;
+  for (const t of clickhouseObjects(ctx).filter(isTable)) {
+    for (const c of t.columns) {
+      if (!c.codec) continue;
+      for (const part of splitTop(c.codec)) {
+        const m = /^([A-Za-z_]\w*)\s*(?:\(([\s\S]*)\))?$/.exec(part.trim());
+        if (!m) continue;
+        const name = m[1]!;
+        const spec = codecs[name] ?? Object.entries(codecs).find(([k]) => k.toLowerCase() === name.toLowerCase())?.[1];
+        if (!spec || spec.parameters === "unknown" || m[2] === undefined) continue;
+        const args = splitTop(m[2]);
+        const where = `${t.export} (${t.name}): column ${c.name} CODEC(${c.codec})`;
+        const expected = spec.parameters;
+        if (args.length > expected.length) {
+          const takes = expected.length === 0 ? "takes no parameters" : `takes at most ${expected.length} (${expected.map((p) => p.name).join(", ")})`;
+          report({ severity: "error", message: `${where}: ${name} ${takes}, and is given ${args.length}`, entity: t.export });
+          continue;
+        }
+        args.forEach((arg, i) => {
+          const p = expected[i]!;
+          const text = arg.trim();
+          if (p.values && !p.values.some((v) => v.toLowerCase() === text.toLowerCase())) {
+            report({ severity: "error", message: `${where}: ${name} ${p.name} ${text} is not one of ${p.values.join(", ")}`, entity: t.export });
+          } else if (p.range && NUMBER.test(text)) {
+            const n = Number(text);
+            if (n < p.range[0] || n > p.range[1]) {
+              report({
+                severity: "error",
+                message: `${where}: ${name} ${p.name} ${text} is outside ${p.range[0]} to ${p.range[1]}, the range ClickHouse ${CLICKHOUSE_VERSION} takes`,
+                entity: t.export,
+              });
+            }
+          }
+        });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlch126.ts

@@ -0,0 +1,57 @@
+import { bareName, checkOf, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects, type OutputObject } from "./sql-helpers";
+
+/** The columns a grant can name on an object: each declared column, and `n.a` for a `Nested` column's fields. */
+function grantableColumns(o: OutputObject): Set<string> | undefined {
+  const columns = (o.columns ?? []) as Array<{ name: string; type?: string }>;
+  if (columns.length === 0) return undefined;
+  const out = new Set<string>();
+  for (const c of columns) {
+    out.add(c.name);
+    const nested = /^Nested\s*\(([\s\S]*)\)$/.exec(c.type?.trim() ?? "");
+    if (nested) {
+      for (const field of splitTop(nested[1]!)) {
+        const name = /^(`(?:[^`]|``)*`|[A-Za-z_]\w*)/.exec(field.trim())?.[1];
+        if (name) out.add(`${c.name}.${bareName(name) ?? name}`);
+      }
+    }
+  }
+  return out;
+}
+
+/**
+ * SQLCH126: a `GRANT` column list names a column the `${}` table does not
+ * declare: `GRANT SELECT(kindd) ON ${events}`. The server refuses the grant
+ * ("There is no column ...").
+ *
+ * Only a target the grant interpolates is checked, against the columns it
+ * declares; a target written as a plain name, or a view that infers its
+ * columns from its SELECT, is left to the server. ClickHouse has no declared
+ * `REVOKE`, so a grant is the only column list.
+ */
+export const sqlch126 = checkOf({ id: "SQLCH126", description: "A GRANT column list names a column the table does not declare" }, (ctx, report) => {
+  const objects = clickhouseObjects(ctx);
+  const byExport = new Map(objects.map((o) => [o.export, o]));
+  for (const g of objects) {
+    if (g.type !== "ClickHouse::Grant" || typeof g.on !== "string") continue;
+    const target = ((g.dependsOn ?? []) as string[])
+      .map((e) => byExport.get(e))
+      .find((o) => o !== undefined && (o.sqlName === g.on || (o.database ? `${o.database}.${o.name}` : o.name) === g.on));
+    if (!target) continue;
+    const columns = grantableColumns(target);
+    if (!columns) continue;
+    for (const privilege of (g.privileges ?? []) as string[]) {
+      const m = /^([A-Za-z_][A-Za-z_ ]*?)\s*\(([\s\S]*)\)\s*$/.exec(privilege.trim());
+      if (!m) continue;
+      for (const element of splitTop(m[2]!)) {
+        const name = bareName(element);
+        if (name === undefined || columns.has(name)) continue;
+        report({
+          severity: "error",
+          message: `${g.export}: GRANT ${m[1]!.toUpperCase()}(${name}) ON ${g.on} names column ${name}, which ${target.export} (${target.name}) does not declare`,
+          entity: g.export,
+        });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlch127.ts

@@ -0,0 +1,128 @@
+import { AGGREGATE_COMBINATORS, CLICKHOUSE_VERSION, FUNCTIONS, TABLE_FUNCTIONS } from "../../generated/clickhouse";
+import type { FunctionSpec } from "../../clickhouse/catalog-types";
+import { isTrivia, tokenizeText, type Token } from "../../clickhouse/tokens";
+import { checkOf, isTable } from "./clickhouse-helpers";
+import { clickhouseObjects } from "./sql-helpers";
+
+const BY_NAME = FUNCTIONS as Readonly<Record<string, FunctionSpec | undefined>>;
+const FOLDED = new Map<string, FunctionSpec>();
+for (const [name, spec] of Object.entries(BY_NAME)) if (spec?.caseInsensitive) FOLDED.set(name.toLowerCase(), spec);
+
+/**
+ * Words followed by `(` that are not function calls: SQL keywords that take
+ * parentheses, and the names ClickHouse's parser reads with a syntax of their
+ * own (`EXTRACT(DAY FROM d)`, `TRIM(BOTH ' ' FROM s)`, `DATE_ADD(...)`), in
+ * any case.
+ */
+const NOT_CALLS = new Set(
+  (
+    "and or not in is as on by to like ilike between case when then else end any all some global exists array interval " +
+    "extract substring position trim ltrim rtrim " +
+    "dateadd date_add timestamp_add timestampadd datesub date_sub timestamp_sub timestampsub datediff date_diff timestampdiff timestamp_diff " +
+    "grouping over filter where set delete group with select from values distinct using asc desc nulls"
+  ).split(" "),
+);
+
+/** `ZSTD(3)` after `CODEC` in a TTL `RECOMPRESS` is a codec, not a call. */
+const SKIPS_GROUP = new Set(["codec"]);
+
+const lookup = (name: string): FunctionSpec | undefined => BY_NAME[name] ?? FOLDED.get(name.toLowerCase());
+
+const TABLE_FUNCTION_NAMES = new Set(TABLE_FUNCTIONS);
+
+/**
+ * A catalog function, or an aggregate function with combinator suffixes
+ * (`countIf`, `sumState`, `uniqMerge`). A table function (`numbers`) counts
+ * too: it is a name the server has, and where it does not belong is the
+ * server's to say.
+ */
+export function isKnownFunction(name: string): boolean {
+  if (lookup(name) || TABLE_FUNCTION_NAMES.has(name)) return true;
+  // Strip combinators from the end, longest first, and look for an aggregate underneath.
+  const suffixes = [...AGGREGATE_COMBINATORS].sort((a, b) => b.length - a.length);
+  const seen = new Set<string>();
+  const queue = [name];
+  while (queue.length > 0) {
+    const base = queue.pop()!;
+    for (const s of suffixes) {
+      if (base.length <= s.length || !base.endsWith(s)) continue;
+      const rest = base.slice(0, -s.length);
+      if (seen.has(rest)) continue;
+      seen.add(rest);
+      const spec = lookup(rest);
+      const aggregate = spec && (spec.aggregate || (spec.aliasOf !== undefined && lookup(spec.aliasOf)?.aggregate));
+      if (aggregate) return true;
+      queue.push(rest);
+    }
+  }
+  return false;
+}
+
+/** The names an expression calls: an identifier directly followed by `(`, outside strings and quoted names. */
+export function calledNames(expr: string): string[] {
+  let tokens: Token[];
+  try {
+    tokens = tokenizeText(expr, 0).filter((t) => !isTrivia(t));
+  } catch {
+    return [];
+  }
+  const out: string[] = [];
+  for (let i = 0; i < tokens.length; i++) {
+    const t = tokens[i]!;
+    const next = tokens[i + 1];
+    if (t.kind !== "ident" || next?.kind !== "punct" || next.text !== "(") continue;
+    const prev = tokens[i - 1];
+    if (prev?.kind === "punct" && prev.text === ".") continue;
+    const lower = t.text.toLowerCase();
+    if (SKIPS_GROUP.has(lower)) {
+      let depth = 0;
+      for (i = i + 1; i < tokens.length; i++) {
+        const x = tokens[i]!;
+        if (x.kind === "punct" && x.text === "(") depth++;
+        else if (x.kind === "punct" && x.text === ")" && --depth === 0) break;
+      }
+      continue;
+    }
+    if (NOT_CALLS.has(lower)) continue;
+    out.push(t.text);
+  }
+  return out;
+}
+
+/**
+ * SQLCH127: an expression the table declares calls a function the pinned
+ * server does not have: `DEFAULT noww()`, `PARTITION BY toYYYYMMM(at)`.
+ *
+ * Read in each column's `DEFAULT`, `MATERIALIZED`, `ALIAS`, `EPHEMERAL` and
+ * TTL expression, in `ORDER BY`, `PRIMARY KEY`, `PARTITION BY`, `SAMPLE BY`
+ * and the table TTL, and in each skip index expression. A name counts when it
+ * is in `system.functions` (case as the catalog says, aliases included), is an
+ * aggregate function with combinator suffixes, or is a function the project
+ * declares with `func`.
+ */
+export const sqlch127 = checkOf({ id: "SQLCH127", description: "An expression calls a function the pinned server does not have" }, (ctx, report) => {
+  const objects = clickhouseObjects(ctx);
+  const declared = new Set(objects.filter((o) => o.type === "ClickHouse::Function").map((o) => o.name));
+  for (const t of objects.filter(isTable)) {
+    const places: Array<[string, string | undefined]> = [];
+    for (const c of t.columns) {
+      if (c.default?.expr) places.push([`column ${c.name} ${c.default.kind}`, c.default.expr]);
+      if (c.ttl) places.push([`column ${c.name} TTL`, c.ttl]);
+    }
+    places.push(["ORDER BY", t.orderBy], ["PRIMARY KEY", t.primaryKey], ["PARTITION BY", t.partitionBy], ["SAMPLE BY", t.sampleBy], ["TTL", t.ttl]);
+    for (const ix of t.indexes ?? []) places.push([`index ${ix.name}`, ix.expr]);
+    for (const [where, expr] of places) {
+      if (!expr) continue;
+      const reported = new Set<string>();
+      for (const name of calledNames(expr)) {
+        if (reported.has(name) || declared.has(name) || isKnownFunction(name)) continue;
+        reported.add(name);
+        report({
+          severity: "error",
+          message: `${t.export} (${t.name}): ${where} calls ${name}(), which ClickHouse ${CLICKHOUSE_VERSION} does not have and the project does not declare with func`,
+          entity: t.export,
+        });
+      }
+    }
+  }
+});

package/src/lint/post-synth/sqlpg119.ts

@@ -0,0 +1,37 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+import { parseType, projectOf, resolveType, typeLabel } from "./postgres-names";
+
+/**
+ * SQLPG119: a column, array element, domain base or sequence `AS` type the
+ * target major does not have.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype.html. The server refuses
+ * `type "numerik" does not exist` at CREATE. A built-in type counts in every
+ * spelling Postgres accepts: the catalog's `pg_type` name and `format_type()`
+ * name (`int4`, `integer`), and the grammar's own spellings (`int`, `decimal`,
+ * `double precision`, `time with time zone`), an overlay beside the catalog.
+ * So does a type the project declares (`type`, `domain`, a table's row type),
+ * by `${}` or by name. A type qualified with a schema the project does not
+ * declare is a plain-text reference and left to the server. An unknown name is
+ * a warning when the project declares an extension, since extension types are
+ * not in the core catalog; the overlay of common extension types answers for
+ * the ones it knows.
+ */
+export const sqlpg119 = checkOf({ id: "SQLPG119", description: "A column, domain or sequence type the target major does not have" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  const check = (entity: string, sqlName: string, what: string, text: string | undefined, serial: boolean) => {
+    const t = parseType(text);
+    if (!t) return;
+    const r = resolveType(p, t, { serial });
+    if (r.kind !== "missing") return;
+    const kind = t.array ? "array element type" : "type";
+    report({ severity: r.miss.severity, message: `${entity} (${sqlName}) ${what} ${kind} ${typeLabel(t)}, which Postgres ${p.major} does not have${r.miss.note}`, entity });
+  };
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) check(t.export, t.sqlName, `column ${c.name} has`, c.type, true);
+  }
+  for (const o of p.objects) {
+    if (o.type === "Postgres::Domain") check(o.export, o.sqlName as string, "is a domain over", o.dataType as string | undefined, false);
+    if (o.type === "Postgres::Sequence") check(o.export, o.sqlName as string, "is a sequence of", o.dataType as string | undefined, false);
+  }
+});

package/src/lint/post-synth/sqlpg120.ts

@@ -0,0 +1,70 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+import { parametersOf, parseType, projectOf, resolveType, typeLabel, type ParsedType, type PgProject } from "./postgres-names";
+
+/**
+ * SQLPG120: a type modifier that does not fit the type.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-numeric.html,
+ * https://www.postgresql.org/docs/18/datatype-character.html,
+ * https://www.postgresql.org/docs/18/datatype-datetime.html,
+ * https://www.postgresql.org/docs/18/datatype-bit.html. The server refuses a
+ * modifier on a type that takes none (`bigint(8)`), `numeric` precision
+ * outside 1 to 1000 or scale outside -1000 to 1000 (0 to the precision before
+ * 15), `varchar(n)` or `char(n)` outside 1 to 10485760, `timestamp`, `time`
+ * or `interval` precision outside 0 to 6, `bit(n)` below 1, and `float(p)`
+ * outside 1 to 53. The parameters and ranges are the lexicon's type overlay.
+ * Only built-in types are checked: a declared or extension type's modifiers
+ * are its own (`geometry(Point, 4326)`).
+ */
+export const sqlpg120 = checkOf({ id: "SQLPG120", description: "A type modifier that does not fit the type" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  const check = (entity: string, sqlName: string, what: string, text: string | undefined, serial: boolean) => {
+    const t = parseType(text);
+    if (!t) return;
+    const problem = modifierProblem(p, t, serial);
+    if (problem) report({ severity: "error", message: `${entity} (${sqlName}) ${what} ${text!.trim()}: ${problem}`, entity });
+  };
+  for (const t of tablesOf(ctx)) for (const c of t.columns) check(t.export, t.sqlName, `column ${c.name} has type`, c.type, true);
+  for (const o of p.objects) {
+    if (o.type === "Postgres::Domain") check(o.export, o.sqlName as string, "is a domain over", o.dataType as string | undefined, false);
+    if (o.type === "Postgres::Sequence") check(o.export, o.sqlName as string, "is a sequence of", o.dataType as string | undefined, false);
+  }
+});
+
+const int = (s: string): number | undefined => (/^[+-]?\d+$/.test(s.trim()) ? Number(s.trim()) : undefined);
+
+function modifierProblem(p: PgProject, t: ParsedType, serial: boolean): string | undefined {
+  if (t.schema !== undefined || t.quoted) return undefined;
+  const mods = t.modifiers;
+  if (t.name === "float" && mods) {
+    const n = mods.length === 1 ? int(mods[0]!) : undefined;
+    if (mods.length !== 1) return "float takes one precision";
+    if (n !== undefined && (n < 1 || n > 53)) return `float precision ${n} is outside 1 to 53`;
+    return undefined;
+  }
+  const r = resolveType(p, t, { serial });
+  if (r.kind !== "builtin") return undefined;
+  const params = parametersOf(r.canonical);
+  if (t.fields !== undefined) {
+    const fields = params.find((a) => a.kind === "keyword")?.values ?? [];
+    if (!fields.includes(t.fields)) return `${t.fields} is not an interval field (${fields.join(", ")})`;
+  }
+  if (!mods) return undefined;
+  const numbers = params.filter((a) => a.kind === "number");
+  if (numbers.length === 0) return `${typeLabel(t)} takes no type modifier`;
+  if (mods.length > numbers.length) return `${typeLabel(t)} takes at most ${numbers.length} modifier${numbers.length === 1 ? "" : "s"}`;
+  const values = mods.map(int);
+  for (let i = 0; i < mods.length; i++) {
+    const v = values[i];
+    const spec = numbers[i]!;
+    if (v === undefined || !spec.range) continue;
+    let [lo, hi] = spec.range;
+    // numeric's scale: 0 to the precision before 15, -1000 to 1000 since.
+    if (r.canonical === "numeric" && spec.name === "scale" && p.major < 15) {
+      lo = 0;
+      hi = values[0] ?? hi;
+    }
+    if (v < lo || v > hi) return `${spec.name} ${v} is outside ${lo} to ${hi}${r.canonical === "numeric" && spec.name === "scale" && p.major < 15 ? ` at Postgres ${p.major}` : ""}`;
+  }
+  return undefined;
+}

package/src/lint/post-synth/sqlpg121.ts

@@ -0,0 +1,32 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+import { parseType, projectOf, resolveType } from "./postgres-names";
+
+const IDENTITY_TYPES = new Set(["smallint", "integer", "bigint"]);
+
+/**
+ * SQLPG121: an identity column whose type is not `smallint`, `integer` or
+ * `bigint`.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createtable.html ("GENERATED {
+ * ALWAYS | BY DEFAULT } AS IDENTITY ... The column ... must be of type
+ * smallint, integer or bigint"). The server refuses `identity column type must
+ * be smallint, integer, or bigint` at CREATE. A declared type (a domain) is
+ * left to the server.
+ */
+export const sqlpg121 = checkOf({ id: "SQLPG121", description: "An identity column whose type is not smallint, integer or bigint" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  for (const t of tablesOf(ctx)) {
+    for (const c of t.columns) {
+      if (c.generated?.kind !== "identity") continue;
+      const parsed = parseType(c.type);
+      if (!parsed) continue;
+      const r = resolveType(p, parsed, { serial: true });
+      if (r.kind !== "builtin" || (IDENTITY_TYPES.has(r.canonical) && !parsed.array)) continue;
+      report({
+        severity: "error",
+        message: `${t.export} (${t.sqlName}) column ${c.name} is an identity column of type ${c.type}; an identity column must be smallint, integer or bigint`,
+        entity: t.export,
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg122.ts

@@ -0,0 +1,28 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+import { postgresObjects } from "./sql-helpers";
+
+const repeated = (xs: readonly string[]): string[] => [...new Set(xs.filter((x, i) => xs.indexOf(x) !== i))];
+
+/**
+ * SQLPG122: a table that declares a column twice, or an enum that lists a
+ * label twice.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createtable.html and
+ * https://www.postgresql.org/docs/18/sql-createtype.html. The server refuses
+ * `column "id" specified more than once` and `enum labels must be unique`.
+ * Column names are compared as Postgres folds them; labels as written, since
+ * they are case-sensitive strings.
+ */
+export const sqlpg122 = checkOf({ id: "SQLPG122", description: "A table declares a column twice, or an enum lists a label twice" }, (ctx, report) => {
+  for (const t of tablesOf(ctx)) {
+    for (const name of repeated(t.columns.map((c) => c.name))) {
+      report({ severity: "error", message: `${t.export} (${t.sqlName}) declares the column ${name} more than once`, entity: t.export });
+    }
+  }
+  for (const o of postgresObjects(ctx)) {
+    if (o.type !== "Postgres::Enum") continue;
+    for (const label of repeated((o.labels as string[] | undefined) ?? [])) {
+      report({ severity: "error", message: `${o.export} (${o.sqlName as string}) lists the enum label '${label}' more than once`, entity: o.export });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg123.ts

@@ -0,0 +1,63 @@
+import { checkOf, indexesOf, tablesOf } from "./postgres-helpers";
+import { columnsOf, includeColumns, interpolatedTable, projectOf } from "./postgres-names";
+
+/**
+ * SQLPG123: a bare column name in a key, index or grant column list that the
+ * table does not declare.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createtable.html,
+ * https://www.postgresql.org/docs/18/sql-createindex.html,
+ * https://www.postgresql.org/docs/18/sql-grant.html. The server refuses
+ * `column "idd" named in key does not exist` (or `column "emial" does not
+ * exist`) at CREATE or GRANT. Checked: `PRIMARY KEY`, `UNIQUE` and their
+ * `INCLUDE`, a foreign key's own columns, an index's bare columns and
+ * `INCLUDE` on a `${}` table, and a `GRANT`/`REVOKE` column list on a `${}`
+ * table. An expression (an index expression, a CHECK, a generated column) is
+ * left to the server, as is a table whose columns come from somewhere the
+ * build cannot see (`LIKE`, `OF type`, a plain-text parent).
+ */
+export const sqlpg123 = checkOf({ id: "SQLPG123", description: "A key, index or grant column list names a column the table does not declare" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  const verify = (entity: string, sqlName: string, where: string, tableName: string, names: readonly string[], cols: ReadonlyMap<string, unknown>) => {
+    for (const n of new Set(names)) {
+      if (cols.has(n)) continue;
+      report({ severity: "error", message: `${entity} (${sqlName}) ${where} names the column ${n}, which ${tableName} does not declare`, entity });
+    }
+  };
+  for (const t of tablesOf(ctx)) {
+    const cols = columnsOf(p, t);
+    if (!cols) continue;
+    if (t.primaryKey) {
+      verify(t.export, t.sqlName, "PRIMARY KEY", t.sqlName, t.primaryKey.columns, cols);
+      verify(t.export, t.sqlName, "PRIMARY KEY ... INCLUDE", t.sqlName, includeColumns(t.primaryKey.include), cols);
+    }
+    for (const u of t.uniques) {
+      verify(t.export, t.sqlName, "UNIQUE", t.sqlName, u.columns, cols);
+      verify(t.export, t.sqlName, "UNIQUE ... INCLUDE", t.sqlName, includeColumns(u.include), cols);
+    }
+    for (const fk of t.foreignKeys) verify(t.export, t.sqlName, `FOREIGN KEY to ${fk.refTable}`, t.sqlName, fk.columns, cols);
+  }
+  for (const i of indexesOf(ctx)) {
+    const t = interpolatedTable(p, i.table, i.tableName);
+    const cols = t && columnsOf(p, t);
+    if (!cols) continue;
+    verify(i.export, i.sqlName, `index on ${i.tableName}`, i.tableName, i.elements.flatMap((e) => (e.column ? [e.column] : [])), cols);
+    verify(i.export, i.sqlName, `index on ${i.tableName} INCLUDE`, i.tableName, includeColumns(i.include), cols);
+  }
+  for (const g of p.objects) {
+    if (g.type !== "Postgres::Grant" || g.on !== "table") continue;
+    const objects = (g.objects as unknown[]) ?? [];
+    const names = (g.objectNames as string[]) ?? [];
+    const privileges = (g.privileges as Array<{ privilege: string; columns?: string[] }>) ?? [];
+    objects.forEach((ref, n) => {
+      const t = interpolatedTable(p, ref, names[n]);
+      const cols = t && columnsOf(p, t);
+      if (!cols) return;
+      for (const priv of privileges) {
+        if (!priv.columns?.length) continue;
+        const action = g.action === "revoke" ? "REVOKE" : "GRANT";
+        verify(g.export, String(g.name), `${action} ${priv.privilege.toUpperCase()} on ${t!.sqlName}`, t!.sqlName, priv.columns, cols);
+      }
+    });
+  }
+});

package/src/lint/post-synth/sqlpg124.ts

@@ -0,0 +1,47 @@
+import { checkOf, tablesOf } from "./postgres-helpers";
+import { columnsOf, interpolatedTable, projectOf, typeIdentity } from "./postgres-names";
+
+/**
+ * SQLPG124: a foreign key to a `${}` table that names a column the table does
+ * not declare, or pairs columns whose types do not compare.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-constraints.html#DDL-CONSTRAINTS-FK
+ * and https://www.postgresql.org/docs/18/catalog-pg-type.html#CATALOG-TYPCATEGORY-TABLE.
+ * The server refuses `column "idd" referenced in foreign key constraint does
+ * not exist` and `Key columns "customer_id" and "id" are of incompatible
+ * types: text and bigint`. Types compare by their catalog category: `integer`
+ * to `bigint` (both numeric) passes, `text` to `bigint` fails. The
+ * user-defined category (`uuid`, `bytea`, `jsonb`...) compares by type; a
+ * domain by its base type; an enum by itself. A key to a table named in plain
+ * text, or a type outside the project, is left to the server.
+ */
+export const sqlpg124 = checkOf({ id: "SQLPG124", description: "A foreign key names a column the referenced table lacks, or one of another type category" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  for (const t of tablesOf(ctx)) {
+    const own = columnsOf(p, t);
+    for (const fk of t.foreignKeys) {
+      const ref = interpolatedTable(p, (fk as { references?: unknown }).references, fk.refTable);
+      const refCols = ref && columnsOf(p, ref);
+      if (!ref || !refCols) continue;
+      const targets = fk.refColumns.length > 0 ? fk.refColumns : (ref.primaryKey?.columns ?? []);
+      const missing = targets.filter((c) => !refCols.has(c));
+      for (const c of missing) {
+        report({ severity: "error", message: `${t.export} (${t.sqlName}) has a foreign key on (${fk.columns.join(", ")}) to ${ref.sqlName} (${c}), which ${ref.sqlName} does not declare`, entity: t.export });
+      }
+      if (missing.length > 0 || !own || targets.length !== fk.columns.length) continue;
+      fk.columns.forEach((c, n) => {
+        const mine = own.get(c);
+        const theirs = refCols.get(targets[n]!);
+        if (!mine || !theirs) return;
+        const a = typeIdentity(p, mine.type);
+        const b = typeIdentity(p, theirs.type);
+        if (a === undefined || b === undefined || a === b) return;
+        report({
+          severity: "error",
+          message: `${t.export} (${t.sqlName}) has a foreign key from ${c} (${mine.type}) to ${ref.sqlName} (${targets[n]}) (${theirs.type}); the types do not compare, so Postgres refuses the key`,
+          entity: t.export,
+        });
+      });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg125.ts

@@ -0,0 +1,40 @@
+import { checkOf, indexesOf } from "./postgres-helpers";
+import { parseIndexElement, projectOf, resolveMethod, resolveOpClass } from "./postgres-names";
+
+/**
+ * SQLPG125: an index access method or operator class the target major does
+ * not have, or an operator class that is not for the index's method.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-createindex.html and
+ * https://www.postgresql.org/docs/18/indexes-opclass.html. The server refuses
+ * `access method "btreee" does not exist` and `operator class "numeric_opz"
+ * does not exist for access method "btree"` at CREATE. Methods and operator
+ * classes come from the target major's catalog (`pg_am`, `pg_opclass`). The
+ * ones an extension adds (`gin_trgm_ops` from pg_trgm, `hnsw` from vector)
+ * pass when the project declares that extension and are an error naming it
+ * when it does not; one neither the catalog nor the extension overlay knows is
+ * a warning when the project declares any extension. An operator class
+ * qualified with a schema the project does not declare is left alone.
+ */
+export const sqlpg125 = checkOf({ id: "SQLPG125", description: "An index access method or operator class the target major does not have, or not for that method" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  for (const i of indexesOf(ctx)) {
+    const method = i.method ?? "btree";
+    const m = resolveMethod(p, method);
+    if (!m.ok) {
+      report({ severity: m.miss.severity, message: `${i.export} (${i.sqlName}) uses the index access method ${method}, which Postgres ${p.major} does not have${m.miss.note}`, entity: i.export });
+      continue;
+    }
+    for (const e of i.elements) {
+      const opclass = parseIndexElement(e.expr)?.opclass;
+      if (!opclass) continue;
+      const r = resolveOpClass(p, method, opclass);
+      if (r.ok) continue;
+      const label = `${opclass.schema ? `${opclass.schema}.` : ""}${opclass.name}`;
+      const message = r.otherMethods
+        ? `${i.export} (${i.sqlName}) uses the operator class ${label}, which is for ${r.otherMethods.join(", ")}, not ${method}`
+        : `${i.export} (${i.sqlName}) uses the operator class ${label}, which Postgres ${p.major} does not have for ${method}${r.miss.note}`;
+      report({ severity: r.miss.severity, message, entity: i.export });
+    }
+  }
+});

package/src/lint/post-synth/sqlpg126.ts

@@ -0,0 +1,37 @@
+import { checkOf } from "./postgres-helpers";
+import { callsIn, expressionsOf, projectOf, resolveCall } from "./postgres-names";
+
+/**
+ * SQLPG126: a call to a function the target major does not have, in a column
+ * `DEFAULT`, a generated column, a `CHECK` (a table's or a domain's), or an
+ * index expression.
+ *
+ * Doc: https://www.postgresql.org/docs/18/functions.html. The server refuses
+ * `function noww() does not exist` at CREATE. A name counts when it is in
+ * the target major's `pg_proc`, a function or procedure the project declares,
+ * a type name used as a cast (`int4(x)`), or qualified with a schema the
+ * project does not declare. Only a name directly followed by `(`, outside
+ * string literals, is a call; the grammar's own constructs that read like
+ * calls (`COALESCE`, `NULLIF`, `GREATEST`, `LEAST`, `CAST`, `EXTRACT`, `ROW`,
+ * `ARRAY`, `EXISTS`, `IN`, `ANY`, `ALL`, `SOME`, and the key word forms of
+ * `OVERLAY`, `POSITION`, `SUBSTRING` and `TRIM`) are reserved or column-name
+ * key words, not `pg_proc` names, and are skipped by their key word category.
+ * An error, or a warning when the project declares an extension.
+ */
+export const sqlpg126 = checkOf({ id: "SQLPG126", description: "An expression calls a function the target major does not have" }, (ctx, report) => {
+  const p = projectOf(ctx);
+  for (const o of p.objects) {
+    const seen = new Set<string>();
+    for (const { where, expr } of expressionsOf(o)) {
+      for (const c of callsIn(expr)) {
+        const label = `${c.schema ? `${c.schema}.` : ""}${c.name}`;
+        if (seen.has(`${where}\0${label}`)) continue;
+        seen.add(`${where}\0${label}`);
+        const r = resolveCall(p, c);
+        if (r.ok) continue;
+        const why = r.since !== undefined ? `, which needs Postgres ${r.since}; Postgres ${p.major} does not have it` : r.until !== undefined ? `, which Postgres removed after ${r.until}` : `, which Postgres ${p.major} does not have`;
+        report({ severity: r.miss.severity, message: `${o.export} (${o.sqlName as string}) ${where} calls ${label}()${why}${r.miss.note}`, entity: o.export });
+      }
+    }
+  }
+});

package/src/lint/rules/index.ts

@@ -2,12 +2,14 @@ import type { LintRule } from "@intentius/chant/lint/rule";
 import { sqlch001 } from "./sqlch001";
 import { sqlch002 } from "./sqlch002";
 import { sqlch003 } from "./sqlch003";
+import { sqlch004 } from "./sqlch004";
 import { sqlpg001 } from "./sqlpg001";
 import { sqlpg002 } from "./sqlpg002";
 import { sqlpg003 } from "./sqlpg003";
 import { sqlpg004 } from "./sqlpg004";
+import { sqlpg005 } from "./sqlpg005";
 
-export { sqlch001, sqlch002, sqlch003, sqlpg001, sqlpg002, sqlpg003, sqlpg004 };
+export { sqlch001, sqlch002, sqlch003, sqlch004, sqlpg001, sqlpg002, sqlpg003, sqlpg004, sqlpg005 };
 
 /** The lexicon's source-level lint rules, returned by `lintRules()`. */
-export const rules: LintRule[] = [sqlch001, sqlch002, sqlch003, sqlpg001, sqlpg002, sqlpg003, sqlpg004];
+export const rules: LintRule[] = [sqlch001, sqlch002, sqlch003, sqlch004, sqlpg001, sqlpg002, sqlpg003, sqlpg004, sqlpg005];