@intentius/chant-lexicon-sql 0.124.31 → 0.124.32

package/dist/lint/post-synth/sqlch125.js

@@ -0,0 +1,55 @@
+import { CODECS, CLICKHOUSE_VERSION } from "../../generated/clickhouse.js";
+import { checkOf, splitTop, tablesOf } from "./clickhouse-helpers.js";
+const NUMBER = /^-?\d+(\.\d+)?$/;
+/**
+ * SQLCH125: a codec's parameters do not fit it: more than the codec takes
+ * (`LZ4(1)`), a number outside its range (`ZSTD(99)`, `LZ4HC(13)`), or a
+ * value outside its set (`Delta(3)`; the byte width is 1, 2, 4 or 8).
+ *
+ * The parameters are the `CODEC_OVERLAY`'s; a codec marked `"unknown"` there
+ * (the experimental ones with undocumented parameters) is not checked. An
+ * unknown codec name is SQLCH114's.
+ */
+export const sqlch125 = checkOf({ id: "SQLCH125", description: "A codec parameter is outside what the codec takes" }, (ctx, report) => {
+    const codecs = CODECS;
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            if (!c.codec)
+                continue;
+            for (const part of splitTop(c.codec)) {
+                const m = /^([A-Za-z_]\w*)\s*(?:\(([\s\S]*)\))?$/.exec(part.trim());
+                if (!m)
+                    continue;
+                const name = m[1];
+                const spec = codecs[name] ?? Object.entries(codecs).find(([k]) => k.toLowerCase() === name.toLowerCase())?.[1];
+                if (!spec || spec.parameters === "unknown" || m[2] === undefined)
+                    continue;
+                const args = splitTop(m[2]);
+                const where = `${t.export} (${t.name}): column ${c.name} CODEC(${c.codec})`;
+                const expected = spec.parameters;
+                if (args.length > expected.length) {
+                    const takes = expected.length === 0 ? "takes no parameters" : `takes at most ${expected.length} (${expected.map((p) => p.name).join(", ")})`;
+                    report({ severity: "error", message: `${where}: ${name} ${takes}, and is given ${args.length}`, entity: t.export });
+                    continue;
+                }
+                args.forEach((arg, i) => {
+                    const p = expected[i];
+                    const text = arg.trim();
+                    if (p.values && !p.values.some((v) => v.toLowerCase() === text.toLowerCase())) {
+                        report({ severity: "error", message: `${where}: ${name} ${p.name} ${text} is not one of ${p.values.join(", ")}`, entity: t.export });
+                    }
+                    else if (p.range && NUMBER.test(text)) {
+                        const n = Number(text);
+                        if (n < p.range[0] || n > p.range[1]) {
+                            report({
+                                severity: "error",
+                                message: `${where}: ${name} ${p.name} ${text} is outside ${p.range[0]} to ${p.range[1]}, the range ClickHouse ${CLICKHOUSE_VERSION} takes`,
+                                entity: t.export,
+                            });
+                        }
+                    }
+                });
+            }
+        }
+    }
+});

package/dist/lint/post-synth/sqlch126.js

@@ -0,0 +1,62 @@
+import { bareName, checkOf, splitTop } from "./clickhouse-helpers.js";
+import { clickhouseObjects } from "./sql-helpers.js";
+/** The columns a grant can name on an object: each declared column, and `n.a` for a `Nested` column's fields. */
+function grantableColumns(o) {
+    const columns = (o.columns ?? []);
+    if (columns.length === 0)
+        return undefined;
+    const out = new Set();
+    for (const c of columns) {
+        out.add(c.name);
+        const nested = /^Nested\s*\(([\s\S]*)\)$/.exec(c.type?.trim() ?? "");
+        if (nested) {
+            for (const field of splitTop(nested[1])) {
+                const name = /^(`(?:[^`]|``)*`|[A-Za-z_]\w*)/.exec(field.trim())?.[1];
+                if (name)
+                    out.add(`${c.name}.${bareName(name) ?? name}`);
+            }
+        }
+    }
+    return out;
+}
+/**
+ * SQLCH126: a `GRANT` column list names a column the `${}` table does not
+ * declare: `GRANT SELECT(kindd) ON ${events}`. The server refuses the grant
+ * ("There is no column ...").
+ *
+ * Only a target the grant interpolates is checked, against the columns it
+ * declares; a target written as a plain name, or a view that infers its
+ * columns from its SELECT, is left to the server. ClickHouse has no declared
+ * `REVOKE`, so a grant is the only column list.
+ */
+export const sqlch126 = checkOf({ id: "SQLCH126", description: "A GRANT column list names a column the table does not declare" }, (ctx, report) => {
+    const objects = clickhouseObjects(ctx);
+    const byExport = new Map(objects.map((o) => [o.export, o]));
+    for (const g of objects) {
+        if (g.type !== "ClickHouse::Grant" || typeof g.on !== "string")
+            continue;
+        const target = (g.dependsOn ?? [])
+            .map((e) => byExport.get(e))
+            .find((o) => o !== undefined && (o.sqlName === g.on || (o.database ? `${o.database}.${o.name}` : o.name) === g.on));
+        if (!target)
+            continue;
+        const columns = grantableColumns(target);
+        if (!columns)
+            continue;
+        for (const privilege of (g.privileges ?? [])) {
+            const m = /^([A-Za-z_][A-Za-z_ ]*?)\s*\(([\s\S]*)\)\s*$/.exec(privilege.trim());
+            if (!m)
+                continue;
+            for (const element of splitTop(m[2])) {
+                const name = bareName(element);
+                if (name === undefined || columns.has(name))
+                    continue;
+                report({
+                    severity: "error",
+                    message: `${g.export}: GRANT ${m[1].toUpperCase()}(${name}) ON ${g.on} names column ${name}, which ${target.export} (${target.name}) does not declare`,
+                    entity: g.export,
+                });
+            }
+        }
+    }
+});

package/dist/lint/post-synth/sqlch127.js

@@ -0,0 +1,132 @@
+import { AGGREGATE_COMBINATORS, CLICKHOUSE_VERSION, FUNCTIONS, TABLE_FUNCTIONS } from "../../generated/clickhouse.js";
+import { isTrivia, tokenizeText } from "../../clickhouse/tokens.js";
+import { checkOf, isTable } from "./clickhouse-helpers.js";
+import { clickhouseObjects } from "./sql-helpers.js";
+const BY_NAME = FUNCTIONS;
+const FOLDED = new Map();
+for (const [name, spec] of Object.entries(BY_NAME))
+    if (spec?.caseInsensitive)
+        FOLDED.set(name.toLowerCase(), spec);
+/**
+ * Words followed by `(` that are not function calls: SQL keywords that take
+ * parentheses, and the names ClickHouse's parser reads with a syntax of their
+ * own (`EXTRACT(DAY FROM d)`, `TRIM(BOTH ' ' FROM s)`, `DATE_ADD(...)`), in
+ * any case.
+ */
+const NOT_CALLS = new Set(("and or not in is as on by to like ilike between case when then else end any all some global exists array interval " +
+    "extract substring position trim ltrim rtrim " +
+    "dateadd date_add timestamp_add timestampadd datesub date_sub timestamp_sub timestampsub datediff date_diff timestampdiff timestamp_diff " +
+    "grouping over filter where set delete group with select from values distinct using asc desc nulls").split(" "));
+/** `ZSTD(3)` after `CODEC` in a TTL `RECOMPRESS` is a codec, not a call. */
+const SKIPS_GROUP = new Set(["codec"]);
+const lookup = (name) => BY_NAME[name] ?? FOLDED.get(name.toLowerCase());
+const TABLE_FUNCTION_NAMES = new Set(TABLE_FUNCTIONS);
+/**
+ * A catalog function, or an aggregate function with combinator suffixes
+ * (`countIf`, `sumState`, `uniqMerge`). A table function (`numbers`) counts
+ * too: it is a name the server has, and where it does not belong is the
+ * server's to say.
+ */
+export function isKnownFunction(name) {
+    if (lookup(name) || TABLE_FUNCTION_NAMES.has(name))
+        return true;
+    // Strip combinators from the end, longest first, and look for an aggregate underneath.
+    const suffixes = [...AGGREGATE_COMBINATORS].sort((a, b) => b.length - a.length);
+    const seen = new Set();
+    const queue = [name];
+    while (queue.length > 0) {
+        const base = queue.pop();
+        for (const s of suffixes) {
+            if (base.length <= s.length || !base.endsWith(s))
+                continue;
+            const rest = base.slice(0, -s.length);
+            if (seen.has(rest))
+                continue;
+            seen.add(rest);
+            const spec = lookup(rest);
+            const aggregate = spec && (spec.aggregate || (spec.aliasOf !== undefined && lookup(spec.aliasOf)?.aggregate));
+            if (aggregate)
+                return true;
+            queue.push(rest);
+        }
+    }
+    return false;
+}
+/** The names an expression calls: an identifier directly followed by `(`, outside strings and quoted names. */
+export function calledNames(expr) {
+    let tokens;
+    try {
+        tokens = tokenizeText(expr, 0).filter((t) => !isTrivia(t));
+    }
+    catch {
+        return [];
+    }
+    const out = [];
+    for (let i = 0; i < tokens.length; i++) {
+        const t = tokens[i];
+        const next = tokens[i + 1];
+        if (t.kind !== "ident" || next?.kind !== "punct" || next.text !== "(")
+            continue;
+        const prev = tokens[i - 1];
+        if (prev?.kind === "punct" && prev.text === ".")
+            continue;
+        const lower = t.text.toLowerCase();
+        if (SKIPS_GROUP.has(lower)) {
+            let depth = 0;
+            for (i = i + 1; i < tokens.length; i++) {
+                const x = tokens[i];
+                if (x.kind === "punct" && x.text === "(")
+                    depth++;
+                else if (x.kind === "punct" && x.text === ")" && --depth === 0)
+                    break;
+            }
+            continue;
+        }
+        if (NOT_CALLS.has(lower))
+            continue;
+        out.push(t.text);
+    }
+    return out;
+}
+/**
+ * SQLCH127: an expression the table declares calls a function the pinned
+ * server does not have: `DEFAULT noww()`, `PARTITION BY toYYYYMMM(at)`.
+ *
+ * Read in each column's `DEFAULT`, `MATERIALIZED`, `ALIAS`, `EPHEMERAL` and
+ * TTL expression, in `ORDER BY`, `PRIMARY KEY`, `PARTITION BY`, `SAMPLE BY`
+ * and the table TTL, and in each skip index expression. A name counts when it
+ * is in `system.functions` (case as the catalog says, aliases included), is an
+ * aggregate function with combinator suffixes, or is a function the project
+ * declares with `func`.
+ */
+export const sqlch127 = checkOf({ id: "SQLCH127", description: "An expression calls a function the pinned server does not have" }, (ctx, report) => {
+    const objects = clickhouseObjects(ctx);
+    const declared = new Set(objects.filter((o) => o.type === "ClickHouse::Function").map((o) => o.name));
+    for (const t of objects.filter(isTable)) {
+        const places = [];
+        for (const c of t.columns) {
+            if (c.default?.expr)
+                places.push([`column ${c.name} ${c.default.kind}`, c.default.expr]);
+            if (c.ttl)
+                places.push([`column ${c.name} TTL`, c.ttl]);
+        }
+        places.push(["ORDER BY", t.orderBy], ["PRIMARY KEY", t.primaryKey], ["PARTITION BY", t.partitionBy], ["SAMPLE BY", t.sampleBy], ["TTL", t.ttl]);
+        for (const ix of t.indexes ?? [])
+            places.push([`index ${ix.name}`, ix.expr]);
+        for (const [where, expr] of places) {
+            if (!expr)
+                continue;
+            const reported = new Set();
+            for (const name of calledNames(expr)) {
+                if (reported.has(name) || declared.has(name) || isKnownFunction(name))
+                    continue;
+                reported.add(name);
+                report({
+                    severity: "error",
+                    message: `${t.export} (${t.name}): ${where} calls ${name}(), which ClickHouse ${CLICKHOUSE_VERSION} does not have and the project does not declare with func`,
+                    entity: t.export,
+                });
+            }
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg101.js

@@ -0,0 +1,25 @@
+import { checkOf, ownsColumns, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG101: a table with no primary key.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-constraints.html#DDL-CONSTRAINTS-PRIMARY-KEYS
+ * ("a primary key indicates that a column or group of columns can be used as a
+ * unique identifier for rows"). Without one, logical replication needs a
+ * REPLICA IDENTITY and rows cannot be addressed by identity. A partition, a
+ * typed table and a LIKE copy are skipped, and a UNIQUE constraint over NOT
+ * NULL columns counts as an identity.
+ */
+export const sqlpg101 = checkOf({ id: "SQLPG101", description: "A table declares no primary key" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        if (!ownsColumns(t) || t.primaryKey || t.like.length > 0)
+            continue;
+        const notNull = new Set(t.columns.filter((c) => c.notNull).map((c) => c.name));
+        if (t.uniques.some((u) => u.columns.length > 0 && u.columns.every((c) => notNull.has(c))))
+            continue;
+        report({
+            severity: "warning",
+            message: `${t.export} (${t.sqlName}) has no primary key; add one, or a UNIQUE constraint over NOT NULL columns`,
+            entity: t.export,
+        });
+    }
+});

package/dist/lint/post-synth/sqlpg102.js

@@ -0,0 +1,35 @@
+import { checkOf, indexesOf, leadingColumns, ownsColumns, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG102: a foreign key whose referencing columns no index leads with.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-constraints.html#DDL-CONSTRAINTS-FK
+ * ("it is often a good idea to index the referencing columns too ... a delete
+ * of a referenced row requires a scan of the referencing table"). The primary
+ * key, a UNIQUE constraint or an index covers the key when its leading columns
+ * are the foreign key's columns, in any order.
+ */
+export const sqlpg102 = checkOf({ id: "SQLPG102", description: "A foreign key's referencing columns have no index" }, (ctx, report) => {
+    const indexes = indexesOf(ctx);
+    const sameSet = (a, b) => a.length === b.length && a.every((c) => b.includes(c));
+    for (const t of tablesOf(ctx)) {
+        if (!ownsColumns(t))
+            continue;
+        const covers = [];
+        if (t.primaryKey)
+            covers.push(t.primaryKey.columns);
+        for (const u of t.uniques)
+            covers.push(u.columns);
+        for (const i of indexes)
+            if (i.tableName === t.sqlName && (i.method ?? "btree") === "btree")
+                covers.push(leadingColumns(i));
+        for (const fk of t.foreignKeys) {
+            if (covers.some((c) => c.length >= fk.columns.length && sameSet(c.slice(0, fk.columns.length), fk.columns)))
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export} (${t.sqlName}) has a foreign key on (${fk.columns.join(", ")}) to ${fk.refTable} with no index leading with those columns; deletes and updates of the referenced row scan the table`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg103.js

@@ -0,0 +1,23 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG103: a serial column where an identity column is preferred.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-numeric.html#DATATYPE-SERIAL
+ * (serial is a notational convenience that creates a sequence the column does
+ * not own as a constraint); https://www.postgresql.org/docs/18/sql-createtable.html
+ * documents GENERATED ... AS IDENTITY, the standard form. Prior art: squawk
+ * prefer-identity.
+ */
+export const sqlpg103 = checkOf({ id: "SQLPG103", description: "A serial column where an identity column is preferred" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            if (!/^(small|big)?serial[248]?$/.test(baseType(c.type)))
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is ${c.type}; declare it as an identity column (GENERATED ALWAYS AS IDENTITY)`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg104.js

@@ -0,0 +1,23 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG104: a timestamp column without time zone.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-datetime.html (timestamp
+ * without time zone ignores any zone in the input, so the value means
+ * different instants to clients in different zones); the Postgres wiki's
+ * "Don't Do This" says the same. Prior art: squawk prefer-timestamptz.
+ */
+export const sqlpg104 = checkOf({ id: "SQLPG104", description: "A timestamp column without time zone" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            const type = baseType(c.type);
+            if (type !== "timestamp" && type !== "timestamp without time zone")
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is ${c.type}; use timestamptz, which stores an instant`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg105.js

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG105: a json column where jsonb fits.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-json.html ("the jsonb data
+ * type is faster to process ... and supports indexing"; json has no equality
+ * operator, so SELECT DISTINCT, GROUP BY and UNION fail on it). Prior art:
+ * strong_migrations "Adding a json column".
+ */
+export const sqlpg105 = checkOf({ id: "SQLPG105", description: "A json column where jsonb fits" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            if (baseType(c.type) !== "json")
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is json; use jsonb unless the exact text, key order or duplicate keys must be kept`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg106.js

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG106: a char(n) column.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-character.html ("there is
+ * no performance advantage to character(n) ... it takes more storage because
+ * of the blank padding"). Prior art: squawk ban-char-field.
+ */
+export const sqlpg106 = checkOf({ id: "SQLPG106", description: "A char(n) column" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            const type = baseType(c.type);
+            if (type !== "char" && type !== "character" && type !== "bpchar")
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is ${c.type}, which pads with blanks; use text, or varchar(n) for a length rule`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg107.js

@@ -0,0 +1,22 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG107: a money column.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-money.html ("the output of
+ * this type depends on lc_monetary ... restoring a dump into a database with
+ * a different lc_monetary setting may not work"; it holds a fixed number of
+ * decimals and no currency). Use numeric(p, s).
+ */
+export const sqlpg107 = checkOf({ id: "SQLPG107", description: "A money column" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            if (baseType(c.type) !== "money")
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is money, whose rounding and output depend on lc_monetary; use numeric(p, s) and a currency column`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg108.js

@@ -0,0 +1,28 @@
+import { baseType, checkOf, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG108: a varchar(n) column whose limit no CHECK or domain explains.
+ *
+ * Doc: https://www.postgresql.org/docs/18/datatype-character.html ("there is
+ * no performance difference among these three types"; a length limit only
+ * buys the check, and raising it later takes a table rewrite on old majors).
+ * Reported only for a limit that is a round number such as 255, the habit of
+ * other databases. Prior art: squawk prefer-text-field.
+ */
+export const sqlpg108 = checkOf({ id: "SQLPG108", description: "A varchar(n) column with a habitual length limit" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        for (const c of t.columns) {
+            const type = (c.type ?? "").toLowerCase();
+            const m = /^(?:varchar|character varying)\s*\(\s*(\d+)\s*\)$/.exec(type.trim());
+            if (!m || baseType(type) !== "varchar" && baseType(type) !== "character varying")
+                continue;
+            const n = Number(m[1]);
+            if (![50, 100, 128, 200, 250, 255, 256, 500, 512, 1000, 1024].includes(n))
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} is varchar(${n}); text performs the same, and a CHECK states a real length rule`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg109.js

@@ -0,0 +1,39 @@
+import { checkOf, indexesOf, tablesOf } from "./postgres-helpers.js";
+const plain = (i) => (i.method ?? "btree") === "btree" && i.elements.every((e) => e.column);
+const keyOf = (i) => `${i.elements.map((e) => e.column).join(",")}|${i.where ?? ""}|${i.include ?? ""}`;
+/**
+ * SQLPG109: an index that duplicates a constraint's index, or another index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/indexes-unique.html ("PostgreSQL
+ * automatically creates a unique index when a unique constraint or a primary
+ * key is defined for a table"), so a second index on the same columns costs
+ * every write and serves no query. Two indexes with the same method, columns,
+ * INCLUDE and predicate are the same index.
+ */
+export const sqlpg109 = checkOf({ id: "SQLPG109", description: "An index duplicates a constraint or another index" }, (ctx, report) => {
+    const indexes = indexesOf(ctx).filter(plain);
+    for (const t of tablesOf(ctx)) {
+        const constraints = [];
+        if (t.primaryKey)
+            constraints.push({ label: "its primary key", cols: t.primaryKey.columns.join(",") });
+        for (const u of t.uniques)
+            constraints.push({ label: `its unique constraint${u.name ? ` ${u.name}` : ""}`, cols: u.columns.join(",") });
+        const mine = indexes.filter((i) => i.tableName === t.sqlName);
+        const seen = new Map();
+        for (const i of mine) {
+            const key = keyOf(i);
+            const cols = i.elements.map((e) => e.column).join(",");
+            const dup = constraints.find((c) => c.cols === cols && !i.where && !i.include);
+            if (dup) {
+                report({ severity: "warning", message: `${i.export} (${i.sqlName}) indexes (${cols}) on ${t.sqlName}, which ${dup.label} already indexes`, entity: i.export });
+                continue;
+            }
+            const first = seen.get(key);
+            if (first) {
+                report({ severity: "warning", message: `${i.export} (${i.sqlName}) duplicates ${first.export} (${first.sqlName}): same columns on ${t.sqlName}`, entity: i.export });
+            }
+            else
+                seen.set(key, i);
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg110.js

@@ -0,0 +1,38 @@
+import { checkOf, indexesOf, leadingColumns, tablesOf } from "./postgres-helpers.js";
+/**
+ * SQLPG110: a btree index whose columns are a leading prefix of another index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/indexes-multicolumn.html ("a
+ * multicolumn B-tree index can be used with query conditions that involve any
+ * subset of the index's columns, but the index is most efficient when there
+ * are constraints on the leading (leftmost) columns"). A plain index on (a)
+ * is served by one on (a, b) or by the primary key (a, b). A unique index
+ * enforces a rule and is kept.
+ */
+export const sqlpg110 = checkOf({ id: "SQLPG110", description: "A btree index is a prefix of another index" }, (ctx, report) => {
+    const indexes = indexesOf(ctx).filter((i) => (i.method ?? "btree") === "btree");
+    for (const t of tablesOf(ctx)) {
+        const wider = [];
+        if (t.primaryKey)
+            wider.push({ label: "the primary key", cols: t.primaryKey.columns });
+        for (const u of t.uniques)
+            wider.push({ label: "a unique constraint", cols: u.columns });
+        const mine = indexes.filter((i) => i.tableName === t.sqlName);
+        for (const i of mine)
+            if (!i.where)
+                wider.push({ label: i.sqlName, cols: leadingColumns(i) });
+        for (const i of mine) {
+            if (i.unique || i.where || i.include || !i.elements.every((e) => e.column))
+                continue;
+            const cols = i.elements.map((e) => e.column);
+            const cover = wider.find((w) => w.label !== i.sqlName && w.cols.length > cols.length && cols.every((c, n) => w.cols[n] === c));
+            if (!cover)
+                continue;
+            report({
+                severity: "warning",
+                message: `${i.export} (${i.sqlName}) on (${cols.join(", ")}) is a prefix of ${cover.label} (${cover.cols.join(", ")}); drop it`,
+                entity: i.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg111.js

@@ -0,0 +1,23 @@
+import { checkOf, indexesOf, isMaterializedView } from "./postgres-helpers.js";
+import { postgresObjects } from "./sql-helpers.js";
+/**
+ * SQLPG111: a materialized view with no unique index.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-refreshmaterializedview.html
+ * ("CONCURRENTLY ... is only allowed if there is at least one UNIQUE index on
+ * the materialized view which uses only column names and includes all rows").
+ * Without one, every refresh takes an ACCESS EXCLUSIVE lock and blocks readers.
+ */
+export const sqlpg111 = checkOf({ id: "SQLPG111", description: "A materialized view has no unique index, so it cannot refresh concurrently" }, (ctx, report) => {
+    const indexes = indexesOf(ctx);
+    for (const v of postgresObjects(ctx).filter(isMaterializedView)) {
+        const ok = indexes.some((i) => i.tableName === v.sqlName && i.unique && !i.where && i.elements.every((e) => e.column));
+        if (ok)
+            continue;
+        report({
+            severity: "warning",
+            message: `${v.export} (${v.sqlName}) has no unique index over plain columns; REFRESH MATERIALIZED VIEW CONCURRENTLY is refused and a plain refresh blocks readers`,
+            entity: v.export,
+        });
+    }
+});

package/dist/lint/post-synth/sqlpg112.js

@@ -0,0 +1,25 @@
+import { checkOf, tablesOf } from "./postgres-helpers.js";
+const SENSITIVE = /(^|_)(password|passwd|pwd|secret|token|api_?key|ssn|social_security|tax_id|credit_card|card_number|cvv|iban|passport|date_of_birth|dob|email|phone|address)(_|$)/i;
+/**
+ * SQLPG112: a secret- or PII-named column in a table with no comment.
+ *
+ * Doc: https://www.postgresql.org/docs/18/sql-comment.html. A COMMENT on the
+ * table or the column is where the retention, encryption or masking rule is
+ * written down, and where pg_dump, anonymizers and catalog scanners read it.
+ * A column or a table comment satisfies the check.
+ */
+export const sqlpg112 = checkOf({ id: "SQLPG112", description: "A secret- or PII-named column with no comment on it or its table" }, (ctx, report) => {
+    for (const t of tablesOf(ctx)) {
+        if (t.comment)
+            continue;
+        for (const c of t.columns) {
+            if (c.comment || !SENSITIVE.test(c.name))
+                continue;
+            report({
+                severity: "warning",
+                message: `${t.export}.${c.name} looks like a secret or personal data and neither it nor ${t.sqlName} has a COMMENT; say what it holds and how it is protected`,
+                entity: t.export,
+            });
+        }
+    }
+});

package/dist/lint/post-synth/sqlpg113.js

@@ -0,0 +1,29 @@
+import { checkOf } from "./postgres-helpers.js";
+import { postgresObjects } from "./sql-helpers.js";
+const PLACED = new Set(["Postgres::Table", "Postgres::View", "Postgres::MaterializedView", "Postgres::Sequence", "Postgres::Enum", "Postgres::CompositeType", "Postgres::RangeType", "Postgres::Domain"]);
+/**
+ * SQLPG113: an object in the public schema while the project declares schemas.
+ *
+ * Doc: https://www.postgresql.org/docs/18/ddl-schemas.html#DDL-SCHEMAS-PUBLIC
+ * and https://www.postgresql.org/docs/18/ddl-schemas.html#DDL-SCHEMAS-PATTERNS
+ * (the usage patterns recommend that applications not share `public`). An
+ * unqualified name is created in the first schema of search_path, usually
+ * public. Silent for a project that declares no schema.
+ */
+export const sqlpg113 = checkOf({ id: "SQLPG113", description: "An object is in the public schema though the project declares schemas" }, (ctx, report) => {
+    const objects = postgresObjects(ctx);
+    if (!objects.some((o) => o.type === "Postgres::Schema"))
+        return;
+    for (const o of objects) {
+        if (!PLACED.has(o.type))
+            continue;
+        const schema = o.schema ?? "public";
+        if (schema !== "public")
+            continue;
+        report({
+            severity: "warning",
+            message: `${o.export} (${o.sqlName}) is in the public schema; qualify it with one of the declared schemas`,
+            entity: o.export,
+        });
+    }
+});