@intentius/chant-lexicon-sql 0.124.45 → 0.124.48

package/dist/lint/post-synth/sqlch128.js

@@ -0,0 +1,222 @@
+import { DATABASE_ENGINES, FORMATS, TABLE_ENGINES } from "../../generated/clickhouse.js";
+import { parseEngineSyntax } from "../../clickhouse/engine-syntax.js";
+import { COLLECTION_ENGINES, engineCollection } from "../../clickhouse/named-collections.js";
+import { isTrivia, tokenizeText } from "../../clickhouse/tokens.js";
+import { checkOf, splitTop } from "./clickhouse-helpers.js";
+import { clickhouseObjects } from "./sql-helpers.js";
+/** A syntax-line argument that holds a secret: `password`, `secret_access_key`, `account_key`, `session_token`, `oauth_token`. */
+const SECRET_ARGUMENT = /password|secret|account_key|session_token|oauth_token/i;
+/** A `key = value` argument or a setting that holds a secret: the above, and `kafka_sasl_password`, `nats_token`. */
+const SECRET_KEY = /password|secret|account_key|session_token|oauth_token|(?:^|_)token$|private_key/i;
+/** Credentials written inside another value: a URL's `user:password@`, an Azure connection string's key or signature. */
+const EMBEDDED = [
+    { re: /^[a-z][a-z0-9+.-]*:\/\/[^/@:\s]+:[^/@\s]+@/i, what: "a URL with a password in it" },
+    { re: /(?:^|;)\s*(?:AccountKey|SharedAccessSignature)\s*=/i, what: "a connection string with an account key or signature in it" },
+];
+/** Compression methods the integration engines take after the format. */
+const COMPRESSION = new Set(["none", "auto", "gzip", "gz", "deflate", "br", "brotli", "xz", "lzma", "zstd", "zst", "lz4", "bz2", "snappy"]);
+const FORMAT_NAMES = new Set(FORMATS.map((f) => f.toLowerCase()));
+/** The table functions whose arguments follow an engine's syntax line, lower case, by engine. */
+const FUNCTION_ENGINE = {
+    s3: "S3",
+    gcs: "S3",
+    oss: "S3",
+    cosn: "S3",
+    url: "URL",
+    mysql: "MySQL",
+    postgresql: "PostgreSQL",
+    mongodb: "MongoDB",
+    azureblobstorage: "AzureBlobStorage",
+    iceberg: "Iceberg",
+    icebergs3: "IcebergS3",
+    icebergazure: "IcebergAzure",
+    deltalake: "DeltaLake",
+    deltalakes3: "DeltaLakeS3",
+    deltalakeazure: "DeltaLakeAzure",
+    hudi: "Hudi",
+    paimon: "Paimon",
+    paimons3: "PaimonS3",
+    arrowflight: "ArrowFlight",
+    ytsaurus: "YTsaurus",
+};
+/** `remote('addresses', db, table, 'user', 'password')`: no syntax line says it, so its password's position is written here. */
+const FUNCTION_SECRETS = {
+    remote: [{ name: "password", position: 4 }],
+    remotesecure: [{ name: "password", position: 4 }],
+};
+const ENGINE_SYNTAX = { ...TABLE_ENGINES, ...DATABASE_ENGINES };
+/** The secret arguments an engine's syntax line names, with their positions. */
+function secretPositions(engine) {
+    const syntax = ENGINE_SYNTAX[engine]?.syntax;
+    const parsed = syntax ? parseEngineSyntax(syntax) : undefined;
+    if (!parsed)
+        return [];
+    return parsed.args
+        .filter((a) => !a.named && a.name.split("|").some((n) => SECRET_ARGUMENT.test(n)))
+        .map((a) => ({ name: a.name.split("|").find((n) => SECRET_ARGUMENT.test(n)), position: a.position }));
+}
+/** The text of a string literal, or undefined for anything else. */
+function stringValue(text) {
+    const t = text.trim();
+    if (!/^'(?:[^'\\]|\\.|'')*'$/.test(t))
+        return undefined;
+    return t.slice(1, -1).replace(/\\(.)/g, "$1").replace(/''/g, "'");
+}
+/**
+ * Whether the arguments before `position` leave it where the syntax line puts
+ * it. An optional group (`[, access_key_id, secret_access_key]`) may be left
+ * out, and the format and compression move up into its place:
+ * `S3('url', 'Parquet', 'gzip')`. When a format, a compression method or
+ * `NOSIGN` comes earlier, the position says nothing.
+ */
+function aligned(args, position) {
+    for (const a of args.slice(1, position)) {
+        const t = a.trim();
+        if (t.toUpperCase() === "NOSIGN")
+            return false;
+        const v = stringValue(t)?.toLowerCase();
+        if (v !== undefined && (FORMAT_NAMES.has(v) || COMPRESSION.has(v)))
+            return false;
+    }
+    return true;
+}
+/** The literal credentials in one engine's or table function's arguments. */
+function argumentFindings(label, args, secrets, collection) {
+    const out = [];
+    const add = (where, what, value) => out.push({ where, what, masked: value === "[HIDDEN]" });
+    // After a named collection, the arguments are `key = value` overrides, not positions.
+    if (!collection) {
+        for (const s of secrets) {
+            const arg = args[s.position];
+            const value = arg !== undefined ? stringValue(arg) : undefined;
+            if (value && aligned(args, s.position))
+                add(`${label} argument ${s.name}`, "a literal credential", value);
+        }
+    }
+    args.forEach((arg, i) => {
+        const kv = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*([\s\S]+)$/.exec(arg);
+        if (kv) {
+            const value = stringValue(kv[2]);
+            if (value && SECRET_KEY.test(kv[1]))
+                add(`${label} argument ${kv[1]}`, "a literal credential", value);
+            return;
+        }
+        const value = stringValue(arg);
+        if (!value)
+            return;
+        for (const e of EMBEDDED)
+            if (e.re.test(value))
+                add(`${label} argument ${i + 1}`, e.what, value);
+    });
+    return out;
+}
+/** Each table function call in a SQL text, with its arguments as written. */
+function functionCalls(text) {
+    let tokens;
+    try {
+        tokens = tokenizeText(text, 0);
+    }
+    catch {
+        return [];
+    }
+    const sig = tokens.map((t, i) => ({ t, i })).filter(({ t }) => !isTrivia(t));
+    const out = [];
+    for (let k = 0; k + 1 < sig.length; k++) {
+        const fn = sig[k].t;
+        const open = sig[k + 1];
+        if (fn.kind !== "ident" || open.t.kind !== "punct" || open.t.text !== "(")
+            continue;
+        const lower = fn.text.toLowerCase();
+        const base = lower.endsWith("cluster") ? lower.slice(0, -"cluster".length) : lower;
+        if (!(base in FUNCTION_ENGINE) && !(base in FUNCTION_SECRETS))
+            continue;
+        let depth = 0;
+        let end = open.i;
+        for (let j = open.i; j < tokens.length; j++) {
+            const t = tokens[j];
+            if (t.kind === "punct" && t.text === "(")
+                depth++;
+            else if (t.kind === "punct" && t.text === ")" && --depth === 0) {
+                end = j;
+                break;
+            }
+        }
+        const inner = tokens
+            .slice(open.i + 1, end)
+            .map((t) => t.text)
+            .join("");
+        out.push({ name: fn.text, args: inner.trim() === "" ? [] : splitTop(inner) });
+    }
+    return out;
+}
+/** The literal credentials in each table function call a SQL text makes. */
+function callFindings(text) {
+    return functionCalls(text).flatMap((call) => {
+        const lower = call.name.toLowerCase();
+        const clustered = lower.endsWith("cluster") && !(lower in FUNCTION_ENGINE);
+        const base = clustered ? lower.slice(0, -"cluster".length) : lower;
+        // `s3Cluster(cluster, url, ...)`: the cluster comes first.
+        const args = clustered ? call.args.slice(1) : call.args;
+        const engine = FUNCTION_ENGINE[base];
+        const secrets = engine ? secretPositions(engine) : (FUNCTION_SECRETS[base] ?? []);
+        const collection = args[0] !== undefined && /^\s*(?:[A-Za-z_][A-Za-z0-9_]*|`[^`]+`)\s*$/.test(args[0]) && args[0].trim().toUpperCase() !== "NOSIGN";
+        return argumentFindings(`${call.name}()`, args, secrets, collection);
+    });
+}
+/** The literal credentials in a table's or database's engine and its settings. */
+function engineFindings(o) {
+    const engine = o.engine;
+    if (!engine)
+        return [];
+    const out = argumentFindings(`ENGINE = ${engine.name}`, engine.args ?? [], secretPositions(engine.name), engineCollection(engine) !== undefined);
+    if (COLLECTION_ENGINES.has(engine.name)) {
+        for (const [key, raw] of Object.entries(o.settings ?? {})) {
+            const value = stringValue(raw);
+            if (value && SECRET_KEY.test(key))
+                out.push({ where: `${engine.name} setting ${key}`, what: "a literal credential", masked: value === "[HIDDEN]" });
+        }
+    }
+    return out;
+}
+/** `PASSWORD 'secret'` in a dictionary's source. */
+function sourceFindings(dataSource) {
+    const m = /\bPASSWORD\s+('(?:[^'\\]|\\.|'')*')/i.exec(dataSource);
+    const value = m ? stringValue(m[1]) : undefined;
+    return value ? [{ where: "SOURCE PASSWORD", what: "a literal credential", masked: value === "[HIDDEN]" }] : [];
+}
+/**
+ * SQLCH128: an integration engine's or table function's argument holds a
+ * literal credential (#4395): `ENGINE = S3('https://...', 'AKIA...', 'secret')`,
+ * `mysql('db:3306', 'shop', 'orders', 'app', 'secret')`, a Kafka table's
+ * `kafka_sasl_password` setting, a dictionary source's `PASSWORD`.
+ *
+ * A credential is the environment's, so it does not belong in a declaration,
+ * the build output or `clickhouse.sql`, as `IDENTIFIED BY` does not on a
+ * user (`../../clickhouse/access.ts`). The secret arguments are found by name
+ * from each engine's syntax line in the pinned catalog (`password`,
+ * `secret_access_key`, `account_key`, `session_token`, `oauth_token`), as
+ * `key = value` overrides and settings by the same names, and inside a URL
+ * (`user:password@`) or an Azure connection string (`AccountKey=`). The fix
+ * is a named collection the environment creates, named in place of the
+ * arguments: `ENGINE = S3(lake_creds, format = 'Parquet')`.
+ */
+export const sqlch128 = checkOf({ id: "SQLCH128", description: "An integration engine or table function argument holds a literal credential" }, (ctx, report) => {
+    for (const o of clickhouseObjects(ctx)) {
+        const props = o;
+        const findings = [
+            ...engineFindings(props),
+            ...(props.asFunction ? callFindings(props.asFunction) : []),
+            ...(props.select ? callFindings(props.select) : []),
+            ...(props.dataSource ? sourceFindings(props.dataSource) : []),
+        ];
+        for (const f of findings) {
+            const held = f.masked ? "holds '[HIDDEN]', the server's mask for a credential, in place of one" : `holds ${f.what}, which is the environment's`;
+            report({
+                severity: "error",
+                message: `${o.export} (${o.name}): ${f.where} ${held}. ` +
+                    "Create a named collection with the credentials on the server and name it in place of the arguments (ENGINE = S3(lake_creds, format = 'Parquet'), s3(lake_creds), SOURCE(MYSQL(NAME mysql_creds))); chant sql plan checks that it exists",
+                entity: o.export,
+            });
+        }
+    }
+});

package/dist/lint/rules/postgres-templates.js

@@ -12,12 +12,12 @@ export const POSTGRES_TEMPLATE_SOURCES = [
     {
         dialect: "postgres",
         modules: ["@intentius/chant-lexicon-sql/postgres"],
-        tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "collation", "cast", "policy", "role", "grant"],
+        tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "operator", "statistics", "foreignDataWrapper", "foreignServer", "publication", "collation", "cast", "policy", "role", "grant"],
     },
     {
         dialect: "postgres",
         modules: ["@intentius/chant-lexicon-sql"],
-        tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "collation", "cast", "policy", "role", "grant"],
+        tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "operator", "statistics", "foreignDataWrapper", "foreignServer", "publication", "collation", "cast", "policy", "role", "grant"],
     },
 ];
 /** Every Postgres template in the file. */

package/dist/lsp/postgres-template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres-template.d.ts","sourceRoot":"","sources":["../../src/lsp/postgres-template.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAoD,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAChI,OAAO,EAAY,KAAK,OAAO,IAAI,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE/E,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,eAAe,GAAG,SAAS,CAE7G;AAED,wHAAwH;AACxH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,SAAS,CAOpH;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,cAAc,GAAG,MAAM,GAAG,mBAAmB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AASnI,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAoCvG;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAQ7E;AAID,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAWD,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,gBAAgB,EAAE,CAsE9F"}
+{"version":3,"file":"postgres-template.d.ts","sourceRoot":"","sources":["../../src/lsp/postgres-template.ts"],"names":[],"mappings":"AAAA;;;;GAIG;AAGH,OAAO,EAAsB,KAAK,KAAK,EAAE,MAAM,oBAAoB,CAAC;AAEpE,OAAO,KAAK,EAAE,WAAW,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAoD,KAAK,qBAAqB,EAAE,MAAM,kCAAkC,CAAC;AAChI,OAAO,EAAY,KAAK,OAAO,IAAI,WAAW,EAAE,MAAM,wBAAwB,CAAC;AAE/E,MAAM,MAAM,eAAe,GAAG,WAAW,CAAC,WAAW,CAAC,CAAC;AAEvD,+EAA+E;AAC/E,wBAAgB,cAAc,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,eAAe,GAAG,SAAS,CAE7G;AAED,wHAAwH;AACxH,wBAAgB,oBAAoB,CAAC,KAAK,EAAE,qBAAqB,EAAE,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,GAAG,KAAK,EAAE,GAAG,SAAS,CAOpH;AAED,MAAM,MAAM,cAAc,GAAG,cAAc,GAAG,cAAc,GAAG,MAAM,GAAG,mBAAmB,GAAG,WAAW,GAAG,UAAU,GAAG,SAAS,CAAC;AASnI,6FAA6F;AAC7F,wBAAgB,mBAAmB,CAAC,GAAG,EAAE,SAAS,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,cAAc,GAAG,SAAS,CAoCvG;AAED,qEAAqE;AACrE,wBAAgB,aAAa,CAAC,GAAG,EAAE,SAAS,KAAK,EAAE,EAAE,GAAG,EAAE,WAAW,GAAG,MAAM,CAQ7E;AAID,MAAM,WAAW,gBAAgB;IAC/B,0CAA0C;IAC1C,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,WAAW,CAAC;IACjB,gFAAgF;IAChF,IAAI,EAAE,MAAM,CAAC;IACb,kFAAkF;IAClF,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,CAAC,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CACjD;AAWD,qGAAqG;AACrG,wBAAgB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,QAAQ,SAAY,GAAG,gBAAgB,EAAE,CAiF9F"}

package/dist/lsp/postgres-template.js

@@ -139,6 +139,17 @@ export function postgresDeclarations(content, fileName = "file.ts") {
                     sqlName = text(node.name.span);
                     kind = "event trigger";
                     break;
+                case "operator":
+                    sqlName = text(node.name.span);
+                    kind = "operator";
+                    break;
+                case "statistics":
+                case "foreignDataWrapper":
+                case "foreignServer":
+                case "publication":
+                    sqlName = text(node.name.span);
+                    kind = { statistics: "statistics", foreignDataWrapper: "foreign data wrapper", foreignServer: "foreign server", publication: "publication" }[node.statement];
+                    break;
                 case "index":
                     sqlName = node.name ? text(node.name.span) : undefined;
                     break;

package/dist/manifest.json

@@ -1,6 +1,6 @@
 {
   "name": "sql",
-  "version": "0.124.45",
+  "version": "0.124.48",
   "chantVersion": ">=0.1.0",
   "namespace": "SQL",
   "intrinsics": [],

package/dist/mcp/postgres.js

@@ -75,7 +75,7 @@ export function postgresSearch(params) {
         results: hits.slice(0, limit).map((r) => ({ name: r.name, ...(r.summary ? { summary: r.summary } : {}), ...(r.since ? { since: r.since } : {}), ...(r.until ? { until: r.until } : {}) })),
     };
 }
-const TAGS = { schema: pg.schema, table: pg.table, index: pg.index, view: pg.view, sequence: pg.sequence, type: pg.type, domain: pg.domain, extension: pg.extension, func: pg.func, procedure: pg.procedure, aggregate: pg.aggregate, trigger: pg.trigger, eventTrigger: pg.eventTrigger, collation: pg.collation, cast: pg.cast, policy: pg.policy, role: pg.role, grant: pg.grant };
+const TAGS = { schema: pg.schema, table: pg.table, index: pg.index, view: pg.view, sequence: pg.sequence, type: pg.type, domain: pg.domain, extension: pg.extension, func: pg.func, procedure: pg.procedure, aggregate: pg.aggregate, trigger: pg.trigger, eventTrigger: pg.eventTrigger, operator: pg.operator, statistics: pg.statistics, foreignDataWrapper: pg.foreignDataWrapper, foreignServer: pg.foreignServer, publication: pg.publication, collation: pg.collation, cast: pg.cast, policy: pg.policy, role: pg.role, grant: pg.grant };
 export const POSTGRES_TAGS = Object.keys(TAGS);
 /** Parse one statement with the Postgres tag; an error comes back as SQLPG001 with its line and column. */
 export function postgresParse(tag, ddl, position) {

package/dist/meta.json

@@ -129,6 +129,31 @@
     "kind": "resource",
     "lexicon": "sql"
   },
+  "PostgresOperator": {
+    "resourceType": "Postgres::Operator",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresStatistics": {
+    "resourceType": "Postgres::Statistics",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresForeignDataWrapper": {
+    "resourceType": "Postgres::ForeignDataWrapper",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresForeignServer": {
+    "resourceType": "Postgres::ForeignServer",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresPublication": {
+    "resourceType": "Postgres::Publication",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
   "PostgresExtension": {
     "resourceType": "Postgres::Extension",
     "kind": "resource",

package/dist/migrate/from-postgres/detect.d.ts

@@ -0,0 +1,4 @@
+/** Kept apart from the translator so the plugin can ask it without loading the translator. */
+/** Text that looks like Postgres DDL or like a Postgres declaration, and not like ClickHouse or T-SQL. */
+export declare function looksLikePostgres(content: string): boolean;
+//# sourceMappingURL=detect.d.ts.map

package/dist/migrate/from-postgres/detect.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"detect.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-postgres/detect.ts"],"names":[],"mappings":"AAAA,8FAA8F;AAE9F,0GAA0G;AAC1G,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,MAAM,GAAG,OAAO,CAG1D"}

package/dist/migrate/from-postgres/detect.js

@@ -0,0 +1,7 @@
+/** Kept apart from the translator so the plugin can ask it without loading the translator. */
+/** Text that looks like Postgres DDL or like a Postgres declaration, and not like ClickHouse or T-SQL. */
+export function looksLikePostgres(content) {
+    if (/\bENGINE\s*=/i.test(content) || /^\s*GO\s*$/im.test(content))
+        return false;
+    return /\bCREATE\s+(?:UNLOGGED\s+|TEMP(?:ORARY)?\s+)?TABLE\b/i.test(content) || /@intentius\/chant-lexicon-sql\/postgres/.test(content);
+}

package/dist/migrate/from-postgres/emit.d.ts

@@ -0,0 +1,26 @@
+/**
+ * A {@link Mirror} as text: ClickHouse DDL, the TypeScript declarations that
+ * write it, or the statements a server runs (#4399).
+ *
+ * With `composite`, a mirror is a `CdcMirror` call (`../../composites/cdc-mirror.ts`)
+ * that adds the version and deleted columns and the view of live rows
+ * itself. Without it, a mirror is a `table` declaration with the engine and
+ * the two columns written out, and no view.
+ */
+import type { ImportedObject } from "../../clickhouse/import/ir.js";
+import { type Mirror } from "./translate.js";
+/** `id Int64`, `email String COMMENT '...'`. */
+export declare const columnSql: (c: Mirror["columns"][number]) => string;
+/** The sort key as `CdcMirror`'s `primaryKey` and `ORDER BY` write it. */
+export declare const orderBySql: (m: Mirror) => string;
+/** The `columns` string of a `CdcMirror` call. */
+export declare const mirrorColumns: (m: Mirror) => string;
+/** The table as a bare `CREATE TABLE`, constraint comments first. */
+export declare function tableSql(m: Mirror): string;
+/** The statements a server runs for the mirrors, in creation order. */
+export declare function mirrorObjects(mirrors: readonly Mirror[], composite: boolean): ImportedObject[];
+/** `--emit sql`: the statements, each ended with a semicolon. */
+export declare function emitSql(mirrors: readonly Mirror[], composite: boolean): string;
+/** `--emit ts`: the declarations, as a file of `CdcMirror` calls or of `table` templates. */
+export declare function emitTs(mirrors: readonly Mirror[], composite: boolean): string;
+//# sourceMappingURL=emit.d.ts.map

package/dist/migrate/from-postgres/emit.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"emit.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-postgres/emit.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAIH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAEjE,OAAO,EAAkB,KAAK,MAAM,EAAE,MAAM,aAAa,CAAC;AAM1D,gDAAgD;AAChD,eAAO,MAAM,SAAS,GAAI,GAAG,MAAM,CAAC,SAAS,CAAC,CAAC,MAAM,CAAC,KAAG,MAAoG,CAAC;AAE9J,0EAA0E;AAC1E,eAAO,MAAM,UAAU,GAAI,GAAG,MAAM,KAAG,MAAmJ,CAAC;AAE3L,kDAAkD;AAClD,eAAO,MAAM,aAAa,GAAI,GAAG,MAAM,KAAG,MAA6C,CAAC;AAExF,qEAAqE;AACrE,wBAAgB,QAAQ,CAAC,CAAC,EAAE,MAAM,GAAG,MAAM,CAc1C;AAOD,uEAAuE;AACvE,wBAAgB,aAAa,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,cAAc,EAAE,CAa9F;AAED,iEAAiE;AACjE,wBAAgB,OAAO,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAK9E;AAKD,6FAA6F;AAC7F,wBAAgB,MAAM,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,EAAE,SAAS,EAAE,OAAO,GAAG,MAAM,CAgB7E"}

package/dist/migrate/from-postgres/emit.js

@@ -0,0 +1,86 @@
+/**
+ * A {@link Mirror} as text: ClickHouse DDL, the TypeScript declarations that
+ * write it, or the statements a server runs (#4399).
+ *
+ * With `composite`, a mirror is a `CdcMirror` call (`../../composites/cdc-mirror.ts`)
+ * that adds the version and deleted columns and the view of live rows
+ * itself. Without it, a mirror is a `table` declaration with the engine and
+ * the two columns written out, and no view.
+ */
+import { CdcMirror } from "../../composites/cdc-mirror.js";
+import { CLICKHOUSE_ENTITY_TYPES } from "../../clickhouse/entities.js";
+import { engineReview } from "../../clickhouse/review-catalog.js";
+import { MIRROR_COLUMNS } from "./translate.js";
+const ident = (name) => (/^[A-Za-z_][A-Za-z0-9_]*$/.test(name) ? name : `\`${name.replace(/\\/g, "\\\\").replace(/`/g, "\\`")}\``);
+const chString = (s) => `'${s.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+const oneLine = (s) => s.replace(/\s+/g, " ").trim();
+/** `id Int64`, `email String COMMENT '...'`. */
+export const columnSql = (c) => `${ident(c.name)} ${c.type}${c.comment ? ` COMMENT ${chString(oneLine(c.comment))}` : ""}`;
+/** The sort key as `CdcMirror`'s `primaryKey` and `ORDER BY` write it. */
+export const orderBySql = (m) => (m.primaryKey.length === 0 ? "tuple()" : m.primaryKey.length === 1 ? ident(m.primaryKey[0]) : `(${m.primaryKey.map(ident).join(", ")})`);
+/** The `columns` string of a `CdcMirror` call. */
+export const mirrorColumns = (m) => m.columns.map(columnSql).join(", ");
+/** The table as a bare `CREATE TABLE`, constraint comments first. */
+export function tableSql(m) {
+    const engine = engineReview({ object: m.name, mode: "cdc", cdcColumns: { version: MIRROR_COLUMNS.version, deleted: MIRROR_COLUMNS.deleted } });
+    const settings = Object.entries(m.settings).map(([k, v]) => `${k} = ${v}`);
+    return [
+        ...m.constraintComments,
+        `CREATE TABLE ${ident(m.name)}`,
+        "(",
+        [...m.columns.map(columnSql), ...engine.extraColumns.map((c) => `${c.name} ${c.type}`)].map((l) => `    ${l}`).join(",\n"),
+        ")",
+        `ENGINE = ${engine.engine}`,
+        `ORDER BY ${orderBySql(m)}`,
+        ...(settings.length > 0 ? [`SETTINGS ${settings.join(", ")}`] : []),
+        ...(m.comment ? [`COMMENT ${chString(oneLine(m.comment))}`] : []),
+    ].join("\n");
+}
+/** The call's props, for `CdcMirror` and for the TypeScript that writes it. */
+function callProps(m) {
+    return { name: m.name, columns: mirrorColumns(m), primaryKey: orderBySql(m) };
+}
+/** The statements a server runs for the mirrors, in creation order. */
+export function mirrorObjects(mirrors, composite) {
+    const out = [];
+    for (const m of mirrors) {
+        if (!composite) {
+            out.push({ type: CLICKHOUSE_ENTITY_TYPES.table, name: m.name, ddl: tableSql(m) });
+            continue;
+        }
+        // The composite writes the DDL: what is validated is what `chant build` makes of the call.
+        const { table, current } = CdcMirror(callProps(m));
+        out.push({ type: CLICKHOUSE_ENTITY_TYPES.table, name: m.name, ddl: table.props.ddl });
+        out.push({ type: CLICKHOUSE_ENTITY_TYPES.view, name: `${m.name}_current`, ddl: current.props.ddl });
+    }
+    return out;
+}
+/** `--emit sql`: the statements, each ended with a semicolon. */
+export function emitSql(mirrors, composite) {
+    const objects = mirrorObjects(mirrors, composite);
+    // A constraint comment sits in the table's own text, so a statement is the object's ddl as it is.
+    const comments = composite ? new Map(mirrors.map((m) => [m.name, m.constraintComments])) : new Map();
+    return `${objects.map((o) => `${(comments.get(o.name) ?? []).map((c) => `${c}\n`).join("")}${o.ddl.replace(/\s+$/, "")};`).join("\n\n")}\n`;
+}
+const str = (s) => JSON.stringify(s);
+const templateSafe = (s) => s.replace(/\\/g, "\\\\").replace(/`/g, "\\`").replace(/\$\{/g, "\\${");
+/** `--emit ts`: the declarations, as a file of `CdcMirror` calls or of `table` templates. */
+export function emitTs(mirrors, composite) {
+    const lines = [];
+    if (composite) {
+        lines.push(`import { CdcMirror } from "@intentius/chant-lexicon-sql/clickhouse";`, "");
+        for (const m of mirrors) {
+            for (const c of m.constraintComments)
+                lines.push(`//${c.slice(2)}`);
+            const p = callProps(m);
+            lines.push(`export const ${m.export} = CdcMirror({`, `  name: ${str(p.name)},`, `  columns: ${str(p.columns)},`, `  primaryKey: ${str(p.primaryKey)},`, `});`, "");
+        }
+    }
+    else {
+        lines.push(`import { table } from "@intentius/chant-lexicon-sql/clickhouse";`, "");
+        for (const m of mirrors) {
+            lines.push(`export const ${m.export} = table\``, ...tableSql(m).split("\n").map((l) => `  ${templateSafe(l)}`), "`;", "");
+        }
+    }
+    return `${lines.join("\n").replace(/\n+$/, "")}\n`;
+}

package/dist/migrate/from-postgres/index.d.ts

@@ -0,0 +1,51 @@
+/**
+ * `chant migrate --from sql/postgres --to sql/clickhouse <file or member>`
+ * (#4399): the Postgres tables a CDC pipeline mirrors, as the ClickHouse
+ * tables that receive them.
+ *
+ * ## Naming
+ *
+ * A `chant migrate` side names a lexicon, and the sql lexicon holds two
+ * dialects whose builds never mix, so a side is `<lexicon>/<dialect>`:
+ * `sql/postgres` and `sql/clickhouse`. `--to sql/clickhouse` loads the sql
+ * lexicon and asks it for `migrationSource("sql/postgres", "sql/clickhouse")`.
+ * The same shape would name a later pair (`sql/clickhouse` to `sql/postgres`)
+ * without a new flag. A side with no slash is a lexicon alone, as for
+ * `--from github --to gitlab`.
+ *
+ * ## The source
+ *
+ * - a `.sql` file of Postgres DDL;
+ * - a TypeScript file or a member directory of `table` declarations, read by
+ *   a folded build of the project it belongs to (`chant sql types` reads the
+ *   same way), so `${shop}.customers` and other interpolations resolve.
+ *
+ * ## What it writes
+ *
+ * `--emit ts` (the default here) writes declarations: `table` templates, or
+ * `CdcMirror` calls with `--use-composites`. `--emit sql` writes the DDL.
+ * Every decision that is not the type map is a finding from the shared
+ * catalog (`../../clickhouse/review-catalog.ts`), reported as SARIF with
+ * `--report`, and a `warning` fails the run under `--strict`.
+ *
+ * `links` names the Postgres output each mirrored column reads
+ * (`shop.customers.email`). In a workspace, `chant migrate` writes them as
+ * `links` of the ClickHouse member (`../../../../packages/core/src/workspace/migrate-links.ts`),
+ * so `chant workspace check` fails when the Postgres declaration drops or
+ * renames one.
+ *
+ * `--validate` creates the emitted DDL on a throwaway server of the pinned
+ * ClickHouse image (`../../sqlserver/validate.ts` runs it).
+ */
+import type { Declarable } from "@intentius/chant/declarable";
+import type { MigrateOptions, MigrationResult, MigrationSource } from "@intentius/chant/lexicon";
+export declare const FROM_POSTGRES = "sql/postgres";
+export declare const TO_CLICKHOUSE = "sql/clickhouse";
+/** Whether `from` and `to` name this pair. */
+export declare const isPostgresToClickHouse: (from: string, to?: string) => boolean;
+/** The Postgres declarations at `sourceFile`: a `.sql` file read as DDL, else a folded build of its project. */
+export declare function loadPostgresEntities(content: string, sourceFile: string | undefined): Promise<Map<string, Declarable>>;
+export declare function transform(content: string, opts: MigrateOptions): Promise<MigrationResult>;
+/** The `migrationSource` of the sql lexicon for this pair. */
+export declare function postgresToClickHouseSource(): MigrationSource;
+//# sourceMappingURL=index.d.ts.map

package/dist/migrate/from-postgres/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/migrate/from-postgres/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAsCG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAC9D,OAAO,KAAK,EAAE,cAAc,EAAE,eAAe,EAAE,eAAe,EAAE,MAAM,0BAA0B,CAAC;AAKjG,eAAO,MAAM,aAAa,iBAAiB,CAAC;AAC5C,eAAO,MAAM,aAAa,mBAAmB,CAAC;AAE9C,8CAA8C;AAC9C,eAAO,MAAM,sBAAsB,GAAI,MAAM,MAAM,EAAE,KAAK,MAAM,KAAG,OAA+E,CAAC;AAEnJ,gHAAgH;AAChH,wBAAsB,oBAAoB,CAAC,OAAO,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,GAAG,SAAS,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC,CAW5H;AAgBD,wBAAsB,SAAS,CAAC,OAAO,EAAE,MAAM,EAAE,IAAI,EAAE,cAAc,GAAG,OAAO,CAAC,eAAe,CAAC,CA8B/F;AAED,8DAA8D;AAC9D,wBAAgB,0BAA0B,IAAI,eAAe,CAM5D"}

package/dist/migrate/from-postgres/index.js

@@ -0,0 +1,115 @@
+/**
+ * `chant migrate --from sql/postgres --to sql/clickhouse <file or member>`
+ * (#4399): the Postgres tables a CDC pipeline mirrors, as the ClickHouse
+ * tables that receive them.
+ *
+ * ## Naming
+ *
+ * A `chant migrate` side names a lexicon, and the sql lexicon holds two
+ * dialects whose builds never mix, so a side is `<lexicon>/<dialect>`:
+ * `sql/postgres` and `sql/clickhouse`. `--to sql/clickhouse` loads the sql
+ * lexicon and asks it for `migrationSource("sql/postgres", "sql/clickhouse")`.
+ * The same shape would name a later pair (`sql/clickhouse` to `sql/postgres`)
+ * without a new flag. A side with no slash is a lexicon alone, as for
+ * `--from github --to gitlab`.
+ *
+ * ## The source
+ *
+ * - a `.sql` file of Postgres DDL;
+ * - a TypeScript file or a member directory of `table` declarations, read by
+ *   a folded build of the project it belongs to (`chant sql types` reads the
+ *   same way), so `${shop}.customers` and other interpolations resolve.
+ *
+ * ## What it writes
+ *
+ * `--emit ts` (the default here) writes declarations: `table` templates, or
+ * `CdcMirror` calls with `--use-composites`. `--emit sql` writes the DDL.
+ * Every decision that is not the type map is a finding from the shared
+ * catalog (`../../clickhouse/review-catalog.ts`), reported as SARIF with
+ * `--report`, and a `warning` fails the run under `--strict`.
+ *
+ * `links` names the Postgres output each mirrored column reads
+ * (`shop.customers.email`). In a workspace, `chant migrate` writes them as
+ * `links` of the ClickHouse member (`../../../../packages/core/src/workspace/migrate-links.ts`),
+ * so `chant workspace check` fails when the Postgres declaration drops or
+ * renames one.
+ *
+ * `--validate` creates the emitted DDL on a throwaway server of the pinned
+ * ClickHouse image (`../../sqlserver/validate.ts` runs it).
+ */
+import { existsSync, statSync } from "node:fs";
+import { dirname } from "node:path";
+import { looksLikePostgres } from "./detect.js";
+import { emitSql, emitTs, mirrorObjects } from "./emit.js";
+import { translatePostgres } from "./translate.js";
+export const FROM_POSTGRES = "sql/postgres";
+export const TO_CLICKHOUSE = "sql/clickhouse";
+/** Whether `from` and `to` name this pair. */
+export const isPostgresToClickHouse = (from, to) => from === FROM_POSTGRES && (to === undefined || to === TO_CLICKHOUSE);
+/** The Postgres declarations at `sourceFile`: a `.sql` file read as DDL, else a folded build of its project. */
+export async function loadPostgresEntities(content, sourceFile) {
+    const isDir = sourceFile !== undefined && existsSync(sourceFile) && statSync(sourceFile).isDirectory();
+    if (!isDir && (sourceFile === undefined || sourceFile.endsWith(".sql"))) {
+        const { sqlFileEntities } = await import("../../sql-files.js");
+        return sqlFileEntities("postgres", [{ ddl: content, origin: sourceFile ?? "the DDL" }], { known: new Map() });
+    }
+    const { buildFolded, loadProject } = await import("../../sql-types-command.js");
+    const project = await loadProject(isDir ? sourceFile : dirname(sourceFile));
+    const result = await buildFolded(project, "chant migrate", "nothing was translated");
+    if (!result)
+        throw new Error(`the build of ${sourceFile} failed`);
+    return new Map(result.entities);
+}
+/** A finding as the lint diagnostic `chant migrate` writes as SARIF. */
+function toDiagnostic(file, d, strict) {
+    return {
+        file,
+        line: d.line ?? 1,
+        column: d.column ?? 1,
+        ruleId: d.ruleId,
+        // Under --strict a warning is an error, which is what fails the run (core reads the severity).
+        severity: strict && d.severity === "warning" ? "error" : d.severity,
+        message: d.message,
+        ...(d.entity ? { entity: d.entity } : {}),
+    };
+}
+export async function transform(content, opts) {
+    const emit = opts.emit ?? "ts";
+    if (emit === "yaml")
+        throw new Error("--emit yaml has no meaning here; use --emit ts or --emit sql");
+    const composite = opts.useComposites === true;
+    const file = opts.sourceFile ?? "schema.sql";
+    const entities = await loadPostgresEntities(content, opts.sourceFile);
+    const translation = translatePostgres(entities, { composite });
+    if (translation.mirrors.length === 0) {
+        const refused = translation.diagnostics.filter((d) => d.severity === "error").map((d) => d.message);
+        throw new Error(`no Postgres table to mirror in ${file}${refused.length > 0 ? `: ${refused.join(" ")}` : ""}`);
+    }
+    const output = emit === "sql" ? emitSql(translation.mirrors, composite) : emitTs(translation.mirrors, composite);
+    const diagnostics = translation.diagnostics.map((d) => toDiagnostic(file, d, opts.strict === true));
+    const provenance = translation.mirrors.map((m) => ({
+        sourceKey: `${m.source.schema}.${m.source.table}`,
+        rule: composite ? "SQLMIG-CDC-MIRROR" : "SQLMIG-TABLE",
+        category: "translated",
+        note: `${String(m.columns.length)} columns; ORDER BY ${m.primaryKey.length === 0 ? "tuple()" : `(${m.primaryKey.join(", ")})`}`,
+    }));
+    return {
+        output,
+        provenance,
+        diagnostics,
+        links: translation.outputs,
+        validate: async () => {
+            const [{ objectsToIR }, { validateOnEmulator }] = await Promise.all([import("../../clickhouse/import/ir.js"), import("../../sqlserver/validate.js")]);
+            const found = await validateOnEmulator(objectsToIR(mirrorObjects(translation.mirrors, composite)));
+            return found.map((d) => ({ file, line: 1, column: 1, ruleId: d.ruleId, severity: d.severity, message: d.message, ...(d.entity ? { entity: d.entity } : {}) }));
+        },
+    };
+}
+/** The `migrationSource` of the sql lexicon for this pair. */
+export function postgresToClickHouseSource() {
+    return {
+        detect: looksLikePostgres,
+        directory: true,
+        transform,
+    };
+}