@intentius/chant-lexicon-sql 0.124.19 → 0.124.22

package/src/clickhouse/plan/deep.ts

@@ -37,7 +37,7 @@ import { ACCESS_ENTITY_TYPES, ACCESS_UNMANAGED_DETAIL, accessOf, readLiveAccess,
 import { clickhouseQuery } from "../http";
 import { sqlString } from "../apply/statements";
 import { stripMarkerFromStatement } from "../ownership";
-import { database, dictionary, func, policy, role, table, user, view, CLICKHOUSE_ENTITY_TYPES, type ColumnDef } from "../entities";
+import { database, dictionary, func, policy, quota, role, settingsProfile, table, user, view, CLICKHOUSE_ENTITY_TYPES, type ColumnDef } from "../entities";
 import { canonicalObject, grantsObject, objectKey, type CanonicalColumn, type CanonicalObject } from "./normalize";
 import { grantStatement, grantsByGrantee, revokeStatement, type GrantAtom } from "../access";
 import { renderFor } from "../topology";
@@ -67,7 +67,11 @@ function liveProps(o: LiveObject): Props {
                 ? role
                 : o.type === CLICKHOUSE_ENTITY_TYPES.rowPolicy
                   ? policy
-                  : view;
+                  : o.type === CLICKHOUSE_ENTITY_TYPES.quota
+                    ? quota
+                    : o.type === CLICKHOUSE_ENTITY_TYPES.settingsProfile
+                      ? settingsProfile
+                      : view;
   const strings = Object.assign([o.statement], { raw: [o.statement] }) as unknown as TemplateStringsArray;
   return { ...(tag(strings).props as unknown as Props) };
 }
@@ -89,8 +93,10 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
   adopt("name", d.name === l.name);
   adopt("database", d.database === l.database);
   adopt("engine", same("engine"));
-  for (const k of ["orderBy", "primaryKey", "partitionBy", "sampleBy", "ttl", "comment", "select", "refresh", "dataSource", "layout", "lifetime", "range"] as const) adopt(k, same(k));
+  for (const k of ["orderBy", "primaryKey", "partitionBy", "sampleBy", "ttl", "comment", "select", "refresh", "dataSource", "layout", "lifetime", "range", "asFunction"] as const) adopt(k, same(k));
   adopt("settings", same("settings"));
+  // A view's DEFINER and SQL SECURITY are not compared by a plan; the server adds its own to a refreshable materialized view (#3911).
+  adopt("security", d.kind === "view" || d.kind === "materializedView");
   // A user's, role's or row policy's fields, compared as `../access.ts` reads them.
   if (d.kind === "user" || d.kind === "role" || d.kind === "rowPolicy") {
     for (const k of ["identified", "host", "validUntil", "defaultRole", "defaultDatabase", "grantees", "settings", "as", "for", "using", "to"]) {
@@ -100,6 +106,12 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
     // A user's authentication is the environment's unless the declaration says it.
     if (d.kind === "user" && declared.identified === undefined) delete out.identified;
   }
+  // A quota's or settings profile's fields; a quota's intervals are one prop, the same when every interval is.
+  if (d.kind === "quota" || d.kind === "settingsProfile") {
+    const fields = (o: CanonicalObject, pick: (k: string) => boolean) => JSON.stringify(Object.entries(o.access ?? {}).filter(([k]) => pick(k)));
+    for (const k of ["keyed", "settings", "to"]) adopt(k, d.access?.[k] === l.access?.[k]);
+    adopt("intervals", fields(d, (k) => k.startsWith("interval.")) === fields(l, (k) => k.startsWith("interval.")));
+  }
   // A function's parameters and expression are one lambda: the same lambda is the declaration's words.
   adopt("params", d.kind === "function" && same("lambda"));
   adopt("body", d.kind === "function" && same("lambda"));
@@ -108,8 +120,8 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
   adopt("constraints", same("constraints"));
 
   const declaredColumns = (declared.columns as ColumnDef[] | undefined) ?? [];
-  if (d.kind === "view" || d.kind === "materializedView") {
-    // The server infers a view's columns; a declaration that lists none is not drift.
+  if (d.kind === "view" || d.kind === "materializedView" || (d.kind === "table" && d.asFunction !== undefined && declaredColumns.length === 0)) {
+    // The server infers a view's columns, and a table function's (#3911); a declaration that lists none is not drift.
     if (declaredColumns.length === 0) out.columns = [];
   } else if (d.kind === "table" || d.kind === "dictionary") {
     const liveColumns = (live.columns as ColumnDef[] | undefined) ?? [];
@@ -124,7 +136,14 @@ export function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalO
 }
 
 /** The entity types that belong to no database. */
-const GLOBAL_TYPES: ReadonlySet<string> = new Set([CLICKHOUSE_ENTITY_TYPES.database, CLICKHOUSE_ENTITY_TYPES.function, CLICKHOUSE_ENTITY_TYPES.user, CLICKHOUSE_ENTITY_TYPES.role]);
+const GLOBAL_TYPES: ReadonlySet<string> = new Set([
+  CLICKHOUSE_ENTITY_TYPES.database,
+  CLICKHOUSE_ENTITY_TYPES.function,
+  CLICKHOUSE_ENTITY_TYPES.user,
+  CLICKHOUSE_ENTITY_TYPES.role,
+  CLICKHOUSE_ENTITY_TYPES.quota,
+  CLICKHOUSE_ENTITY_TYPES.settingsProfile,
+]);
 
 /** Whether the server's formatter prints two expressions the same. A formatter that cannot parse them says no. */
 async function sameExpression(target: ClickHouseTarget, a: string, b: string): Promise<boolean> {

package/src/clickhouse/plan/diff.ts

@@ -179,6 +179,17 @@ function diffObject(key: string, before: CanonicalObject, after: CanonicalObject
     return;
   }
 
+  if (before.kind === "quota" || before.kind === "settingsProfile") {
+    const rule = before.kind === "quota" ? "SQLCH275" : "SQLCH276";
+    const b = before.access ?? {};
+    const a = after.access ?? {};
+    // In the order the server prints them: the key, each interval by length, the settings, whom it applies to.
+    const rank = (f: string) => (f === "keyed" ? 0 : f.startsWith("interval.") ? 1 + Number(f.slice("interval.".length)) / 1e9 : f === "settings" ? 2 : 3);
+    const fields = [...new Set([...Object.keys(b), ...Object.keys(a)])].sort((x, y) => rank(x) - rank(y));
+    for (const field of fields) if (b[field] !== a[field]) out.push(change(key, field, rule, b[field], a[field]));
+    return;
+  }
+
   if (before.kind === "grants") {
     const b = before.access ?? {};
     const a = after.access ?? {};
@@ -212,6 +223,11 @@ function diffObject(key: string, before: CanonicalObject, after: CanonicalObject
     return;
   }
 
+  if (before.asFunction !== undefined || after.asFunction !== undefined) {
+    diffTableFunction(key, before, after, out);
+    return;
+  }
+
   // A table.
   if (before.engine !== after.engine) out.push(change(key, "engine", "SQLCH223", before.engine, after.engine));
   const added = diffColumns(key, before, after, out, hints);
@@ -244,6 +260,30 @@ function diffObject(key: string, before: CanonicalObject, after: CanonicalObject
   diffMap(key, "constraints", before.constraints, after.constraints, "SQLCH215", out);
 }
 
+/**
+ * A table over a table function (#3911), on either side. It stores nothing,
+ * so every change but its comment replaces it (SQLCH219); a table with data
+ * of its own becoming one would lose that data, which is a rebuild
+ * (SQLCH223). A declaration with no column list takes the columns the server
+ * infers, so they are compared only when it lists them.
+ */
+function diffTableFunction(key: string, before: CanonicalObject, after: CanonicalObject, out: Change[]): void {
+  if (before.asFunction === undefined) {
+    out.push(change(key, "asFunction", "SQLCH223", before.engine, `AS ${after.asFunction}`));
+    return;
+  }
+  if (before.asFunction !== after.asFunction) out.push(change(key, "asFunction", "SQLCH219", before.asFunction, after.asFunction));
+  if (after.asFunction !== undefined && after.columns.length === 0) return;
+  const column = (c: CanonicalColumn) => [c.type, c.nullable ? "NULL" : "", c.defaultKind ?? "", c.defaultExpr ?? "", c.codec ? `CODEC(${c.codec})` : "", c.comment ? `COMMENT ${c.comment}` : ""].filter(Boolean).join(" ");
+  const b = new Map(before.columns.map((c) => [c.name, column(c)]));
+  const a = new Map(after.columns.map((c) => [c.name, column(c)]));
+  for (const name of new Set([...b.keys(), ...a.keys()])) {
+    if (b.get(name) !== a.get(name)) out.push(change(key, `columns.${name}`, "SQLCH219", b.get(name), a.get(name)));
+  }
+  const order = (o: CanonicalObject) => o.columns.map((c) => c.name).join(", ");
+  if (order(before) !== order(after) && a.size === b.size && [...a.keys()].every((n) => b.has(n))) out.push(change(key, "columns.order", "SQLCH219", order(before), order(after)));
+}
+
 /** A dictionary: every change but its comment replaces it (SQLCH245). */
 function diffDictionary(key: string, before: CanonicalObject, after: CanonicalObject, out: Change[]): void {
   const attribute = (c: CanonicalColumn) =>
@@ -272,7 +312,7 @@ export function diffSchemas(before: readonly SchemaObject[], after: readonly Sch
   const matches = matchByIdentity(before, after, {
     qualified,
     // A function, a user, a role, a row policy and a grantee's grants are not renamed: one under a new name is a create.
-    previously: (o) => (o.kind === "function" || o.kind === "user" || o.kind === "role" || o.kind === "rowPolicy" || o.kind === "grants" ? undefined : o.previously),
+    previously: (o) => (o.kind === "function" || o.kind === "user" || o.kind === "role" || o.kind === "rowPolicy" || o.kind === "quota" || o.kind === "settingsProfile" || o.kind === "grants" ? undefined : o.previously),
     previousNames: (o, prev) => [prev, `${o.database}.${prev}`],
   });
   for (const m of matches) {

package/src/clickhouse/plan/normalize.ts

@@ -41,7 +41,7 @@ import { accessCanonical, grantsCanonical, isAccessStatement } from "../access";
 
 export { previouslyIn } from "../../core/normalize";
 
-export type ObjectKind = "database" | "table" | "view" | "materializedView" | "dictionary" | "function" | "user" | "role" | "rowPolicy" | "grants";
+export type ObjectKind = "database" | "table" | "view" | "materializedView" | "dictionary" | "function" | "user" | "role" | "rowPolicy" | "quota" | "settingsProfile" | "grants";
 
 export interface CanonicalColumn {
   name: string;
@@ -84,6 +84,8 @@ export interface CanonicalObject {
   select?: string;
   to?: string;
   refresh?: string;
+  /** A table over a table function (#3911): the call after `AS`. */
+  asFunction?: string;
   /** A dictionary's `SOURCE`, `LAYOUT`, `LIFETIME` and `RANGE`, each what is inside the parentheses. */
   dataSource?: string;
   layout?: string;
@@ -94,8 +96,9 @@ export interface CanonicalObject {
   /** A row policy's table. */
   table?: string;
   /**
-   * A user's, role's or row policy's fields (`../access.ts`), each absent at
-   * the server's default; a grantee's grants, by atom.
+   * A user's, role's, row policy's, quota's or settings profile's fields
+   * (`../access.ts`), each absent at the server's default; a grantee's
+   * grants, by atom.
    */
   access?: Record<string, string>;
   /** `-- previously: <name>` before the statement: the object's previous name. */
@@ -374,6 +377,7 @@ export function canonicalObject(ddl: string, defaultDatabase = "default"): Canon
   }
 
   if (node.statement === "table") {
+    if (node.asFunction) obj.asFunction = canonicalExpression(spanText(tokens, node.asFunction) ?? "", database);
     node.columns.forEach((c, i) => obj.columns.push(column(tokens, c, i, database)));
     for (const ix of node.indexes) {
       obj.indexes[ix.name] = [expr(ix.expr), "TYPE", expr(ix.type), ix.granularity ? `GRANULARITY ${expr(ix.granularity)}` : ""]
@@ -556,6 +560,8 @@ export function objectKey(o: { kind?: ObjectKind; type?: string; database?: stri
   if (kind === "function") return `function ${o.name}`;
   if (kind === "user") return `user ${o.name}`;
   if (kind === "role") return `role ${o.name}`;
+  if (kind === "quota") return `quota ${o.name}`;
+  if (kind === "settingsProfile") return `settings profile ${o.name}`;
   if (kind === "grants") return `grants ${o.name}`;
   if (kind === "rowPolicy") return `row policy ${o.name} ON ${o.database}.${o.table}`;
   return o.database !== undefined ? `${o.database}.${o.name}` : o.name;
@@ -566,6 +572,8 @@ const KIND_OF_TYPE: Record<string, ObjectKind> = {
   "ClickHouse::User": "user",
   "ClickHouse::Role": "role",
   "ClickHouse::RowPolicy": "rowPolicy",
+  "ClickHouse::Quota": "quota",
+  "ClickHouse::SettingsProfile": "settingsProfile",
   "ClickHouse::Grant": "grants",
 };
 
@@ -582,7 +590,7 @@ export function grantsObject(ddl: string, grantee: string, defaultDatabase = "de
  */
 export function scopeOf(o: { kind?: ObjectKind; type?: string; database?: string; name: string; table?: string }): string {
   const kind = o.kind ?? KIND_OF_TYPE[o.type ?? ""];
-  if (kind === "function" || kind === "user" || kind === "role" || kind === "grants") return objectKey(o);
+  if (kind === "function" || kind === "user" || kind === "role" || kind === "quota" || kind === "settingsProfile" || kind === "grants") return objectKey(o);
   return o.database ?? o.name;
 }
 

package/src/clickhouse/plan/rules.ts

@@ -35,7 +35,7 @@ const DOCS = "https://clickhouse.com/docs/sql-reference/statements";
 const rule = (id: string, cls: ChangeClass, title: string, restriction: string, cite: string): ClassifierRule => classifierRule(id, cls, title, restriction, cite);
 
 export const CLASSIFIER_RULES = {
-  SQLCH200: rule("SQLCH200", "create", "Create an object", "A new database, table, view, dictionary, function, user, role or row policy is created, or a grantee gets its first grants; nothing existing changes.", `${DOCS}/create`),
+  SQLCH200: rule("SQLCH200", "create", "Create an object", "A new database, table, view, dictionary, function, user, role, row policy, quota or settings profile is created, or a grantee gets its first grants; nothing existing changes.", `${DOCS}/create`),
   SQLCH201: rule(
     "SQLCH201",
     "metadata",
@@ -150,6 +150,13 @@ export const CLASSIFIER_RULES = {
     "A table setting the server marks read-only (such as index_granularity) is fixed when the table is created and needs a new table to change.",
     `${DOCS}/alter/setting`,
   ),
+  SQLCH219: rule(
+    "SQLCH219",
+    "metadata",
+    "Replace a table over a table function",
+    "A table declared AS a table function (numbers, remote, s3, url) stores no data of its own and has no ALTER for its function; CREATE OR REPLACE TABLE replaces its call and columns, and queries read through the new one.",
+    `${DOCS}/create/table#from-a-table-function`,
+  ),
   SQLCH220: rule(
     "SQLCH220",
     "rebuild",
@@ -278,6 +285,20 @@ export const CLASSIFIER_RULES = {
     "REVOKE takes a privilege or a role away, including one granted by hand to a grantee the build declares grants for; queries that relied on it fail from then on.",
     `${DOCS}/revoke`,
   ),
+  SQLCH275: rule(
+    "SQLCH275",
+    "metadata",
+    "Change a quota",
+    "ALTER QUOTA sets the quota's key, one interval's limits (NO LIMITS takes the interval away) or whom it applies to, on the quota that is there, so what names it still does.",
+    `${DOCS}/alter/quota`,
+  ),
+  SQLCH276: rule(
+    "SQLCH276",
+    "metadata",
+    "Change a settings profile",
+    "ALTER SETTINGS PROFILE replaces the profile's settings, constraints and inherited profiles, or whom it applies to; the users, roles and profiles that name it keep it. Sessions already open keep the old settings.",
+    `${DOCS}/alter/settings-profile`,
+  ),
   SQLCH290: rule(
     "SQLCH290",
     "rebuild",

package/src/clickhouse/quota-profile.test.ts

@@ -0,0 +1,186 @@
+/**
+ * Quotas and settings profiles (#3911): the `quota` and `settingsProfile`
+ * tags, each compared with what the pinned server prints for it, the
+ * `ALTER` each change takes, `ON CLUSTER` per topology, and reading them
+ * from a `.sql` file. `live/quota-profile.e2e.test.ts` runs them against a
+ * server.
+ */
+
+import { describe, expect, test } from "vitest";
+import { quota, role, settingsProfile, CLICKHOUSE_ENTITY_TYPES } from "./entities";
+import { canonicalObject, objectKey } from "./plan/normalize";
+import { diffSchemas } from "./plan/diff";
+import { planStatements, type DeclaredObject } from "./apply/statements";
+import { renderStatement } from "./topology";
+import { readClickHouse } from "../files/clickhouse";
+import { clickhouseTemplates } from "./import/generator";
+
+const t = (s: string) => [s] as unknown as TemplateStringsArray;
+
+describe("the tags", () => {
+  test("a quota: its key, its intervals as written, whom it applies to", () => {
+    const reader = role`CREATE ROLE reader`;
+    const q = quota`CREATE QUOTA IF NOT EXISTS per_user KEYED BY user_name FOR INTERVAL 1 hour MAX queries = 100, errors = 5, FOR RANDOMIZED INTERVAL 1 day TRACKING ONLY TO ${reader}`;
+    expect(q.entityType).toBe("ClickHouse::Quota");
+    expect(q.props).toMatchObject({
+      name: "per_user",
+      ifNotExists: true,
+      keyed: "user_name",
+      intervals: "FOR INTERVAL 1 hour MAX queries = 100, errors = 5, FOR RANDOMIZED INTERVAL 1 day TRACKING ONLY",
+      to: "reader",
+    });
+    expect(q.props.ddl).toBe("CREATE QUOTA IF NOT EXISTS per_user KEYED BY user_name FOR INTERVAL 1 hour MAX queries = 100, errors = 5, FOR RANDOMIZED INTERVAL 1 day TRACKING ONLY TO reader");
+  });
+
+  test("a settings profile, written either way, inheriting another", () => {
+    const base = settingsProfile`CREATE SETTINGS PROFILE base SETTINGS max_threads = 8`;
+    const p = settingsProfile`CREATE PROFILE analysts SETTINGS PROFILE ${base}, max_memory_usage = 10000000000 MIN 1000000 MAX 20000000000, readonly = 1 CONST TO ALL EXCEPT admin`;
+    expect(p.entityType).toBe("ClickHouse::SettingsProfile");
+    expect(p.props).toMatchObject({ name: "analysts", settings: "PROFILE base, max_memory_usage = 10000000000 MIN 1000000 MAX 20000000000, readonly = 1 CONST", to: "ALL EXCEPT admin" });
+    expect(p.dependsOn).toContain(base);
+  });
+
+  test("one per template, the wrong tag, and malformed intervals are refused", () => {
+    expect(() => quota(t("CREATE QUOTA a, b"))).toThrow(/one quota per template/);
+    expect(() => settingsProfile(t("CREATE SETTINGS PROFILE a, b"))).toThrow(/one settings profile per template/);
+    expect(() => quota(t("CREATE SETTINGS PROFILE p"))).toThrow(/holds a CREATE SETTINGS PROFILE; use the settingsProfile tag/);
+    expect(() => settingsProfile(t("CREATE QUOTA q"))).toThrow(/holds a CREATE QUOTA; use the quota tag/);
+    expect(() => role(t("CREATE QUOTA q"))).toThrow(/use the quota tag/);
+    expect(() => quota(t("CREATE QUOTA q KEYED BY user_name NOT KEYED"))).toThrow(/both written/);
+    expect(() => quota(t("CREATE QUOTA q FOR INTERVAL 1 hour MAX queries = 1 TO r FOR INTERVAL 1 day MAX queries = 2"))).toThrow(/FOR is written twice/);
+    expect(() => canonicalObject("CREATE QUOTA q FOR INTERVAL 1 fortnight MAX queries = 1")).toThrow(/whole number and a unit/);
+  });
+});
+
+describe("compared with what the server prints", () => {
+  const same = (declared: string, shown: string) => diffSchemas([{ key: "k", canonical: canonicalObject(shown) }], [{ key: "k", canonical: canonicalObject(declared) }]).changes;
+
+  test("a quota: units in seconds, limits sorted and lower case, numbers as the server keeps them, NO LIMITS as no interval", () => {
+    expect(
+      same(
+        "CREATE QUOTA q KEYED BY 'user_name' FOR INTERVAL 60 MINUTE MAX QUERIES 100, errors = 5, FOR RANDOMIZED INTERVAL 1 DAY MAX execution_time = 1000.0, read_bytes = 1e9, FOR INTERVAL 1 week NO LIMITS TO r1",
+        "CREATE QUOTA q KEYED BY user_name FOR INTERVAL 1 hour MAX queries = 100, errors = 5, FOR RANDOMIZED INTERVAL 1 day MAX read_bytes = 1000000000, execution_time = 1000 TO r1",
+      ),
+    ).toEqual([]);
+    // Three months are a quarter, as the server counts them.
+    expect(same("CREATE QUOTA q FOR INTERVAL 3 month MAX queries = 1", "CREATE QUOTA q FOR INTERVAL 1 quarter MAX queries = 1")).toEqual([]);
+    expect(same("CREATE QUOTA q NOT KEYED TO NONE", "CREATE QUOTA q")).toEqual([]);
+    // `KEY BY` is `KEYED BY`; an IP key's prefix bits are part of the key.
+    expect(same("CREATE QUOTA q KEY BY ip_address ipv6_prefix_bits 64", "CREATE QUOTA q KEYED BY ip_address IPV6_PREFIX_BITS 64")).toEqual([]);
+    expect(canonicalObject("CREATE QUOTA q KEYED BY ip_address ipv4_prefix_bits 16 ipv6_prefix_bits 48").access).toEqual({ keyed: "ip_address ipv4_prefix_bits 16 ipv6_prefix_bits 48" });
+    // A name may start with a digit, as the server's own tests write them.
+    expect(canonicalObject("CREATE SETTINGS PROFILE 02294_profile1 SETTINGS max_execution_time = 0.5 TO default").name).toBe("02294_profile1");
+    expect(canonicalObject("CREATE QUOTA `q x` KEYED BY client_key, user_name FOR INTERVAL 2 week MAX queries = 1 TO ALL").access).toEqual({
+      keyed: "client_key , user_name",
+      "interval.1209600": "MAX queries = 1",
+      to: "ALL",
+    });
+  });
+
+  test("a changed quota is SQLCH275 per field and per interval", () => {
+    expect(
+      same(
+        "CREATE QUOTA q KEYED BY ip_address FOR INTERVAL 1 hour MAX queries = 7, FOR INTERVAL 1 day TRACKING ONLY",
+        "CREATE QUOTA q KEYED BY user_name FOR INTERVAL 1 hour MAX queries = 5, errors = 2, FOR INTERVAL 1 week MAX queries = 1 TO r",
+      ).map((c) => [c.field, c.rule, c.before, c.after]),
+    ).toEqual([
+      ["keyed", "SQLCH275", "user_name", "ip_address"],
+      ["interval.3600", "SQLCH275", "MAX errors = 2 , queries = 5", "MAX queries = 7"],
+      ["interval.86400", "SQLCH275", undefined, "TRACKING ONLY"],
+      ["interval.604800", "SQLCH275", "MAX queries = 1", undefined],
+      ["to", "SQLCH275", "r", undefined],
+    ]);
+  });
+
+  test("a settings profile: READONLY as CONST, PROFILE 'x' as INHERIT x, the name quoted or not", () => {
+    expect(
+      same(
+        "CREATE PROFILE p2 SETTINGS PROFILE 'p1', readonly = 1, max_threads READONLY, max_memory_usage = 100 MIN 90 MAX 110 TO b, a",
+        "CREATE SETTINGS PROFILE `p2` SETTINGS INHERIT `p1`, readonly = 1, max_memory_usage = 100 MIN 90 MAX 110, max_threads CONST TO a, b",
+      ),
+    ).toEqual([]);
+    expect(same("CREATE SETTINGS PROFILE p SETTINGS max_threads = 4", "CREATE SETTINGS PROFILE `p` SETTINGS max_threads = 5 TO r").map((c) => [c.field, c.rule])).toEqual([
+      ["settings", "SQLCH276"],
+      ["to", "SQLCH276"],
+    ]);
+  });
+});
+
+describe("the statements", () => {
+  const decl = (type: string, ddl: string): DeclaredObject => {
+    const canonical = canonicalObject(ddl);
+    return { exportName: "x", type: type as DeclaredObject["type"], key: objectKey(canonical), ddl, canonical, dependsOn: [] };
+  };
+  const steps = (obj: DeclaredObject, shown?: string) => {
+    const live = shown === undefined ? undefined : canonicalObject(shown);
+    const changes = diffSchemas(live ? [{ key: obj.key, canonical: live }] : [], [{ key: obj.key, canonical: obj.canonical }]).changes;
+    const entry = planStatements({ declared: [obj], changes, current: new Map(live ? [[obj.key, live]] : []) }).objects[0]!;
+    return entry.verdict === "create" || entry.verdict === "alter" ? entry.steps.map((s) => s.sql) : [entry.verdict];
+  };
+
+  test("a quota is created as declared, then changed with ALTER QUOTA, never replaced", () => {
+    const q = decl(CLICKHOUSE_ENTITY_TYPES.quota, "CREATE QUOTA q KEYED BY ip_address FOR RANDOMIZED INTERVAL 1 hour MAX queries = 7, errors = 1 TO r");
+    expect(q.key).toBe("quota q");
+    expect(steps(q)).toEqual(["CREATE QUOTA q KEYED BY ip_address FOR RANDOMIZED INTERVAL 1 hour MAX queries = 7, errors = 1 TO r"]);
+    expect(steps(q, "CREATE QUOTA q FOR INTERVAL 1 hour MAX queries = 5, FOR INTERVAL 1 day MAX queries = 100")).toEqual([
+      "ALTER QUOTA `q` KEYED BY ip_address",
+      "ALTER QUOTA `q` FOR RANDOMIZED INTERVAL 3600 second MAX errors = 1, queries = 7",
+      "ALTER QUOTA `q` FOR INTERVAL 86400 second NO LIMITS",
+      "ALTER QUOTA `q` TO r",
+    ]);
+    expect(steps(decl(CLICKHOUSE_ENTITY_TYPES.quota, "CREATE QUOTA q"), "CREATE QUOTA q KEYED BY user_name TO r")).toEqual(["ALTER QUOTA `q` NOT KEYED", "ALTER QUOTA `q` TO NONE"]);
+  });
+
+  test("a settings profile is changed with ALTER SETTINGS PROFILE, so what inherits it keeps it", () => {
+    const p = decl(CLICKHOUSE_ENTITY_TYPES.settingsProfile, "CREATE SETTINGS PROFILE p SETTINGS max_threads = 4 TO r");
+    expect(p.key).toBe("settings profile p");
+    expect(steps(p, "CREATE SETTINGS PROFILE `p` SETTINGS max_threads = 8")).toEqual(["ALTER SETTINGS PROFILE `p` SETTINGS max_threads = 4", "ALTER SETTINGS PROFILE `p` TO r"]);
+    expect(steps(decl(CLICKHOUSE_ENTITY_TYPES.settingsProfile, "CREATE PROFILE p"), "CREATE SETTINGS PROFILE `p` SETTINGS max_threads = 8 TO r")).toEqual([
+      "ALTER SETTINGS PROFILE `p` SETTINGS NONE",
+      "ALTER SETTINGS PROFILE `p` TO NONE",
+    ]);
+  });
+
+  test("neither is ever dropped", () => {
+    const live = [
+      { key: "quota q", canonical: canonicalObject("CREATE QUOTA q") },
+      { key: "settings profile p", canonical: canonicalObject("CREATE SETTINGS PROFILE p") },
+    ];
+    const gone = diffSchemas(live, []).changes;
+    expect(planStatements({ declared: [], changes: gone, current: new Map(live.map((l) => [l.key, l.canonical])), allowDestructive: true }).drops).toEqual([]);
+  });
+
+  test("ON CLUSTER on a cluster, since neither is in a database", () => {
+    const cluster = { kind: "cluster" as const, cluster: "main" };
+    expect(renderStatement("CREATE QUOTA q KEYED BY user_name", cluster)).toBe("CREATE QUOTA q ON CLUSTER `main` KEYED BY user_name");
+    expect(renderStatement("CREATE SETTINGS PROFILE p SETTINGS max_threads = 1", cluster)).toBe("CREATE SETTINGS PROFILE p ON CLUSTER `main` SETTINGS max_threads = 1");
+    expect(renderStatement("CREATE PROFILE p", cluster)).toBe("CREATE PROFILE p ON CLUSTER `main`");
+    expect(renderStatement("ALTER QUOTA `q` TO r", cluster)).toBe("ALTER QUOTA `q` ON CLUSTER `main` TO r");
+    expect(renderStatement("ALTER SETTINGS PROFILE `p` SETTINGS NONE", cluster)).toBe("ALTER SETTINGS PROFILE `p` ON CLUSTER `main` SETTINGS NONE");
+  });
+});
+
+describe("import", () => {
+  test("a .sql file's quotas and settings profiles are read by their tags", () => {
+    const problems: string[] = [];
+    const objects = readClickHouse(
+      "CREATE SETTINGS PROFILE `p` SETTINGS max_threads = 4;\nCREATE QUOTA q KEYED BY user_name FOR INTERVAL 1 hour MAX queries = 5 TO r;\nCREATE NAMED COLLECTION c AS password = 'x';\n",
+      { origin: "access.sql" },
+      problems,
+    );
+    expect(objects.map((o) => [o.type, o.name])).toEqual([
+      ["ClickHouse::SettingsProfile", "p"],
+      ["ClickHouse::Quota", "q"],
+    ]);
+    expect(problems).toEqual([expect.stringMatching(/^named collection: chant cannot declare it \(a named collection holds credentials/)]);
+  });
+
+  test("the generator writes them with their tags, never as a relation another object names", () => {
+    const items = [
+      { exportName: "q", type: CLICKHOUSE_ENTITY_TYPES.quota, name: "q", ddl: "CREATE QUOTA q TO events" },
+      { exportName: "events", type: CLICKHOUSE_ENTITY_TYPES.table, database: "default", name: "events", ddl: "CREATE TABLE default.events (a UInt8) ENGINE = Log" },
+    ];
+    const { bodies } = clickhouseTemplates(items);
+    expect(bodies.get("q")!.refs).toEqual([]);
+  });
+});

package/src/clickhouse/table-function.test.ts

@@ -0,0 +1,54 @@
+/**
+ * A table over a table function (#3911): `CREATE TABLE t AS numbers(10)`,
+ * with or without its columns, as the tag reads it, as the server prints it
+ * back, and the one statement a change takes. `live/kinds.e2e.test.ts` runs
+ * it against a server.
+ */
+
+import { describe, expect, test } from "vitest";
+import { table, CLICKHOUSE_ENTITY_TYPES } from "./entities";
+import { canonicalObject, objectKey } from "./plan/normalize";
+import { diffSchemas } from "./plan/diff";
+import { planStatements, type DeclaredObject } from "./apply/statements";
+import { renderStatement } from "./topology";
+
+const shown = "CREATE TABLE default.nums\n(\n    `number` UInt64\n) AS numbers(10)\nCOMMENT 'counting'";
+
+describe("a table over a table function", () => {
+  test("the tag reads the call, and the columns when written", () => {
+    const bare = table`CREATE TABLE default.nums AS numbers(10) COMMENT 'counting'`;
+    expect(bare.props).toMatchObject({ name: "nums", database: "default", asFunction: "numbers(10)", columns: [], comment: "counting" });
+    expect(bare.props.engine).toBeUndefined();
+    const typed = table`CREATE TABLE default.nums (number UInt64) AS numbers(10)`;
+    expect(typed.props.columns.map((c) => [c.name, c.type])).toEqual([["number", "UInt64"]]);
+  });
+
+  test("a declaration with no columns agrees with the columns the server inferred; one that lists them is compared on them", () => {
+    const same = (declared: string) => diffSchemas([{ key: "k", canonical: canonicalObject(shown) }], [{ key: "k", canonical: canonicalObject(declared) }]).changes;
+    expect(same("CREATE TABLE default.nums AS numbers(10) COMMENT 'counting'")).toEqual([]);
+    expect(same("CREATE TABLE default.nums (number UInt64) AS numbers(10) COMMENT 'counting'")).toEqual([]);
+    expect(same("CREATE TABLE default.nums (number UInt32) AS numbers(20) COMMENT 'counting'").map((c) => [c.field, c.rule, c.class])).toEqual([
+      ["asFunction", "SQLCH219", "metadata"],
+      ["columns.number", "SQLCH219", "metadata"],
+    ]);
+  });
+
+  test("a change replaces it whole, its comment with it; a table with data becoming one is a rebuild", () => {
+    const ddl = "CREATE TABLE default.nums AS numbers(20)";
+    const canonical = canonicalObject(ddl);
+    const obj: DeclaredObject = { exportName: "nums", type: CLICKHOUSE_ENTITY_TYPES.table, key: objectKey(canonical), ddl, canonical, dependsOn: [] };
+    const live = canonicalObject(shown);
+    const changes = diffSchemas([{ key: obj.key, canonical: live }], [{ key: obj.key, canonical }]).changes;
+    expect(changes.map((c) => c.field)).toEqual(["comment", "asFunction"]);
+    const entry = planStatements({ declared: [obj], changes, current: new Map([[obj.key, live]]) }).objects[0]!;
+    expect(entry.verdict === "alter" ? entry.steps.map((s) => s.sql) : []).toEqual(["CREATE OR REPLACE TABLE default.nums AS numbers(20) COMMENT '[chant managed-by=chant]'"]);
+
+    const stored = canonicalObject("CREATE TABLE default.nums (number UInt64) ENGINE = MergeTree ORDER BY number");
+    const rebuild = diffSchemas([{ key: obj.key, canonical: stored }], [{ key: obj.key, canonical }]).changes;
+    expect(rebuild.map((c) => [c.field, c.rule, c.class])).toEqual([["asFunction", "SQLCH223", "rebuild"]]);
+  });
+
+  test("ON CLUSTER after the name", () => {
+    expect(renderStatement("CREATE TABLE default.nums AS numbers(10)", { kind: "cluster", cluster: "main" })).toBe("CREATE TABLE default.nums ON CLUSTER `main` AS numbers(10)");
+  });
+});

package/src/clickhouse/testdata/server-ddl-baseline.json

@@ -22,6 +22,14 @@
     "YEARS"
   ],
   "failures": [
+    "CREATE TABLE ... AS <table> is not declared: the server copies the other table's columns and engine and keeps no link to it. Declare them (a composite can share them), or write AS <table function>(...) for a table over a table function at 'AS'",
+    "CREATE TABLE ... AS <table> is not declared: the server copies the other table's columns and engine and keeps no link to it. Declare them (a composite can share them), or write AS <table function>(...) for a table over a table function at 'as'",
+    "CREATE TABLE ... AS SELECT is not declared: it creates the table and fills it once, and the server keeps the columns, not the query. Declare the table's columns and fill it with INSERT ... SELECT, or declare a materialized view at 'AS'",
+    "CREATE TABLE ... AS SELECT is not declared: it creates the table and fills it once, and the server keeps the columns, not the query. Declare the table's columns and fill it with INSERT ... SELECT, or declare a materialized view at 'as'",
+    "CREATE TABLE ... CLONE AS is not declared: it copies another table's columns, engine and data once. Declare the columns and engine at 'CLONE'",
+    "CREATE TABLE ... EMPTY AS SELECT is not declared: the server keeps the query's columns, not the query. Declare the columns at 'empty'",
+    "declare one quota per template at ','",
+    "declare one settings profile per template at ','",
     "expected ')' at 'WITH'",
     "expected '='",
     "expected '=' at '('",
@@ -48,20 +56,15 @@
     "expected an expression",
     "expected an expression at ')'",
     "expected an expression at 'TYPE'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'AS'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'CLONE'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'COMMENT'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'ENGINE'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'Engine'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'ORDER'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'SQL'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'TO'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'as'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'empty'",
-    "expected the column list (CREATE TABLE ... AS is not declared here) at 'engine'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'COMMENT'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'ENGINE'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'Engine'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'ORDER'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'SQL'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'TO'",
+    "expected the column list (a table declared without one, CREATE TABLE ... ENGINE = ... AS SELECT, is not declared: declare the columns) at 'engine'",
     "unexpected end of statement",
-    "unexpected token after the table definition at 'AS'",
-    "unexpected token after the table definition at 'SETTINGS'",
-    "unexpected token after the table definition at 'as'"
+    "unexpected ipv6_prefix_bits: expected IN, KEYED BY, KEY BY, NOT KEYED, FOR, TO at 'ipv6_prefix_bits'",
+    "unexpected token after the table definition at 'SETTINGS'"
   ]
 }

package/src/clickhouse/topology.ts

@@ -352,7 +352,7 @@ function renderOtherCreate(tokens: Token[], topology: Topology): string {
   if (w.accept("OR")) w.accept("REPLACE");
   w.accept("TEMPORARY");
   // Access control (`./access.ts`) belongs to no database: like a database's own DDL, it reaches every replica through the cluster.
-  if (w.accept("USER", "ROLE", "POLICY", "QUOTA") || w.acceptSeq("ROW", "POLICY") || w.acceptSeq("SETTINGS", "PROFILE")) {
+  if (w.accept("USER", "ROLE", "POLICY", "QUOTA", "PROFILE") || w.acceptSeq("ROW", "POLICY") || w.acceptSeq("SETTINGS", "PROFILE")) {
     w.acceptSeq("IF", "NOT", "EXISTS") || w.acceptSeq("OR", "REPLACE");
     if (!w.name()) return applyEdits(tokens, []);
     const edit = onClusterEdit(w, databaseCluster(topology, true), w.end());
@@ -430,7 +430,9 @@ export function renderStatement(sql: string, topology: Topology): string {
     if (word(head, "DROP", "DETACH", "ATTACH")) w.accept("TEMPORARY");
     if (w.accept("DATABASE")) return renderAfterName(tokens, w, databaseCluster(topology, word(head, "DROP")));
     // A function and access control belong to no database: like the database's own DDL, they reach every replica through the cluster.
-    if (w.accept("FUNCTION", "USER", "ROLE", "POLICY") || w.acceptSeq("ROW", "POLICY")) return renderAfterName(tokens, w, databaseCluster(topology, true));
+    if (w.accept("FUNCTION", "USER", "ROLE", "POLICY", "QUOTA", "PROFILE") || w.acceptSeq("ROW", "POLICY") || w.acceptSeq("SETTINGS", "PROFILE")) {
+      return renderAfterName(tokens, w, databaseCluster(topology, true));
+    }
     // `TRUNCATE t` may leave out TABLE.
     if (w.accept("TABLE", "VIEW", "DICTIONARY") || word(head, "TRUNCATE")) return renderAfterName(tokens, w, objectCluster(topology));
     return sql;

package/src/clickhouse.ts

@@ -18,6 +18,8 @@ export {
   role,
   policy,
   grant,
+  quota,
+  settingsProfile,
   literal,
   SqlLiteral,
   SqlTemplateError,
@@ -35,6 +37,10 @@ export {
   type ClickHouseRole,
   type ClickHouseRowPolicy,
   type ClickHouseGrant,
+  type ClickHouseQuota,
+  type ClickHouseSettingsProfile,
+  type QuotaProps,
+  type SettingsProfileProps,
   type UserProps,
   type RoleProps,
   type RowPolicyProps,

package/src/codegen/postgres-classifier-page.ts

@@ -72,7 +72,7 @@ Two rules change class across the supported majors: a STORED generated column's
 
 ## Identity and renames
 
-An object is identified by its export name between two builds, and by its schema-qualified name against a server, which has no export names. Tables, views, materialized views, sequences and indexes share one namespace per schema, types and domains another, and schemas and extensions are matched by name. Functions and procedures share a namespace of their own and are told apart by their input parameter types, so an overload is another object; a trigger is matched by its name on its table.
+An object is identified by its export name between two builds, and by its schema-qualified name against a server, which has no export names. Tables, views, materialized views, sequences and indexes share one namespace per schema, types and domains another, and schemas and extensions are matched by name. Functions, procedures and aggregates share a namespace of their own and are told apart by their input parameter types, so an overload is another object; composite and range types share the types' namespace, collations have one of their own, a cast is named by its two types and an event trigger by its name in the database; a trigger is matched by its name on its table.
 
 A rename is declared where it happens. Before a CREATE, \`-- previously: <old name>\` says the object had another name; on a column's line, it says the column did:
 

package/src/codegen/registry.ts

@@ -23,6 +23,8 @@ const KINDS: Record<string, string> = {
   Role: CLICKHOUSE_ENTITY_TYPES.role,
   RowPolicy: CLICKHOUSE_ENTITY_TYPES.rowPolicy,
   Grant: CLICKHOUSE_ENTITY_TYPES.grant,
+  Quota: CLICKHOUSE_ENTITY_TYPES.quota,
+  SettingsProfile: CLICKHOUSE_ENTITY_TYPES.settingsProfile,
   PostgresSchema: POSTGRES_ENTITY_TYPES.schema,
   PostgresTable: POSTGRES_ENTITY_TYPES.table,
   PostgresIndex: POSTGRES_ENTITY_TYPES.index,
@@ -30,7 +32,13 @@ const KINDS: Record<string, string> = {
   PostgresMaterializedView: POSTGRES_ENTITY_TYPES.materializedView,
   PostgresSequence: POSTGRES_ENTITY_TYPES.sequence,
   PostgresEnum: POSTGRES_ENTITY_TYPES.enum,
+  PostgresCompositeType: POSTGRES_ENTITY_TYPES.composite,
+  PostgresRangeType: POSTGRES_ENTITY_TYPES.range,
   PostgresDomain: POSTGRES_ENTITY_TYPES.domain,
+  PostgresAggregate: POSTGRES_ENTITY_TYPES.aggregate,
+  PostgresCollation: POSTGRES_ENTITY_TYPES.collation,
+  PostgresCast: POSTGRES_ENTITY_TYPES.cast,
+  PostgresEventTrigger: POSTGRES_ENTITY_TYPES.eventTrigger,
   PostgresExtension: POSTGRES_ENTITY_TYPES.extension,
   PostgresFunction: POSTGRES_ENTITY_TYPES.function,
   PostgresProcedure: POSTGRES_ENTITY_TYPES.procedure,