@intentius/chant-lexicon-sql 0.124.46 → 0.124.48

package/dist/postgres/secret-options.js

@@ -0,0 +1,9 @@
+/**
+ * Options that hold a credential. A foreign data wrapper's or server's
+ * `OPTIONS (...)` can carry any name, and a password in one would be written
+ * into a schema file by import and sent to every reader of the plan. The
+ * environment supplies credentials, in a user mapping (which is not declared)
+ * or its own secret store, as for a role's password (`./entities.ts`).
+ */
+/** Whether an option name reads as a credential: `password`, `sslpassword`, `secret_key`, `api_token`. */
+export const isSecretOption = (name) => /pass(word|wd)?|secret|token|api[_-]?key|credential/i.test(name);

package/dist/postgres/testing/roundtrip-schema.d.ts

@@ -5,9 +5,10 @@
  * sequence options, storage parameters, comments), an extension and the
  * domain over its type, a collation, composite and range types (and a
  * multirange column), plain and ordered-set aggregates, a cast and an event
- * trigger (#3911), a partitioned table and a partition, an ORM's
+ * trigger, an operator, extended statistics, a foreign data wrapper and server, and a
+ * publication (#3911), a partitioned table and a partition, an ORM's
  * revision table that import leaves out, and an object carrying chant's
  * ownership trailer.
  */
-export declare const ROUNDTRIP_SCHEMA = "\nCREATE SCHEMA app;\nCOMMENT ON SCHEMA app IS 'The shop';\nCREATE EXTENSION citext WITH SCHEMA app;\nCREATE TYPE app.order_status AS ENUM ('placed', 'paid', 'shipped');\nCREATE DOMAIN app.email AS app.citext CONSTRAINT email_shape CHECK (VALUE LIKE '%@%');\nCOMMENT ON CONSTRAINT email_shape ON DOMAIN app.email IS 'needs an @';\nCREATE SEQUENCE app.invoice_seq AS integer START WITH 1000 CACHE 10;\nCREATE TABLE app.users (\n  id bigint GENERATED ALWAYS AS IDENTITY (START WITH 10) PRIMARY KEY,\n  email app.email NOT NULL UNIQUE,\n  plan text NOT NULL DEFAULT 'free' CHECK (plan IN ('free', 'pro')),\n  created_at timestamptz NOT NULL DEFAULT now()\n) WITH (fillfactor = 90);\nCOMMENT ON TABLE app.users IS 'Accounts [chant managed-by=chant stack=shop env=e2e]';\nCOMMENT ON COLUMN app.users.email IS 'Login name';\nCREATE TABLE app.orders (\n  id serial PRIMARY KEY,\n  user_id bigint NOT NULL REFERENCES app.users (id) ON DELETE CASCADE,\n  invoice_no integer NOT NULL DEFAULT nextval('app.invoice_seq'),\n  status app.order_status NOT NULL DEFAULT 'placed',\n  amount numeric(12, 2) NOT NULL CONSTRAINT amount_positive CHECK (amount >= 0),\n  discount int DEFAULT -1,\n  total numeric GENERATED ALWAYS AS (amount * 2) STORED,\n  placed_at timestamp(3) without time zone\n);\nCREATE INDEX orders_user_idx ON app.orders (user_id, placed_at DESC) WHERE status <> 'shipped';\nCREATE UNIQUE INDEX orders_invoice_idx ON app.orders USING btree (invoice_no) INCLUDE (amount);\nCREATE TABLE app.measures (ts date NOT NULL, v double precision) PARTITION BY RANGE (ts);\nCREATE TABLE app.measures_2026 PARTITION OF app.measures FOR VALUES FROM ('2026-01-01') TO ('2027-01-01');\nCREATE VIEW app.order_totals AS\n  SELECT u.id AS user_id, u.email, count(o.id) AS n, coalesce(sum(o.amount), 0) AS total\n  FROM app.users u LEFT JOIN app.orders o ON o.user_id = u.id\n  GROUP BY u.id, u.email;\nCREATE MATERIALIZED VIEW app.daily AS SELECT placed_at::date AS day, count(*) AS n FROM app.orders GROUP BY 1 WITH NO DATA;\nCREATE COLLATION app.ci (provider = icu, locale = 'und-u-ks-level2', deterministic = false);\nCOMMENT ON COLLATION app.ci IS 'Case-insensitive';\nCREATE TYPE app.pair AS (a integer, b text COLLATE \"C\");\nCOMMENT ON TYPE app.pair IS 'Two values';\nCREATE TYPE app.floatrange AS RANGE (SUBTYPE = float8, SUBTYPE_DIFF = float8mi);\nCREATE TABLE app.people (id integer PRIMARY KEY, nick text COLLATE app.ci, span app.floatrange, tags app.floatmultirange);\nCREATE FUNCTION app.add2(a integer, b integer) RETURNS integer LANGUAGE sql IMMUTABLE AS $$ SELECT a + b $$;\nCREATE AGGREGATE app.total(integer) (SFUNC = app.add2, STYPE = integer, INITCOND = '0', PARALLEL = SAFE);\nCOMMENT ON AGGREGATE app.total(integer) IS 'A sum';\nCREATE FUNCTION app.middle(v double precision[]) RETURNS double precision LANGUAGE sql IMMUTABLE AS $$ SELECT v[(array_length(v, 1) + 1) / 2] $$;\nCREATE AGGREGATE app.median_of(ORDER BY double precision) (SFUNC = pg_catalog.array_append, STYPE = double precision[], FINALFUNC = app.middle);\nCREATE FUNCTION app.pair_text(p app.pair) RETURNS text LANGUAGE sql IMMUTABLE AS $$ SELECT p.a || ':' || p.b $$;\nCREATE CAST (app.pair AS text) WITH FUNCTION app.pair_text(app.pair) AS ASSIGNMENT;\nCOMMENT ON CAST (app.pair AS text) IS 'a:b';\nCREATE FUNCTION app.audit() RETURNS event_trigger LANGUAGE plpgsql AS $$ BEGIN END $$;\nCREATE EVENT TRIGGER app_audit ON ddl_command_end WHEN TAG IN ('CREATE TABLE') EXECUTE FUNCTION app.audit();\nCREATE TABLE public._prisma_migrations (id varchar(36) PRIMARY KEY, checksum varchar(64) NOT NULL);\n";
+export declare const ROUNDTRIP_SCHEMA = "\nCREATE SCHEMA app;\nCOMMENT ON SCHEMA app IS 'The shop';\nCREATE EXTENSION citext WITH SCHEMA app;\nCREATE TYPE app.order_status AS ENUM ('placed', 'paid', 'shipped');\nCREATE DOMAIN app.email AS app.citext CONSTRAINT email_shape CHECK (VALUE LIKE '%@%');\nCOMMENT ON CONSTRAINT email_shape ON DOMAIN app.email IS 'needs an @';\nCREATE SEQUENCE app.invoice_seq AS integer START WITH 1000 CACHE 10;\nCREATE TABLE app.users (\n  id bigint GENERATED ALWAYS AS IDENTITY (START WITH 10) PRIMARY KEY,\n  email app.email NOT NULL UNIQUE,\n  plan text NOT NULL DEFAULT 'free' CHECK (plan IN ('free', 'pro')),\n  created_at timestamptz NOT NULL DEFAULT now()\n) WITH (fillfactor = 90);\nCOMMENT ON TABLE app.users IS 'Accounts [chant managed-by=chant stack=shop env=e2e]';\nCOMMENT ON COLUMN app.users.email IS 'Login name';\nCREATE TABLE app.orders (\n  id serial PRIMARY KEY,\n  user_id bigint NOT NULL REFERENCES app.users (id) ON DELETE CASCADE,\n  invoice_no integer NOT NULL DEFAULT nextval('app.invoice_seq'),\n  status app.order_status NOT NULL DEFAULT 'placed',\n  amount numeric(12, 2) NOT NULL CONSTRAINT amount_positive CHECK (amount >= 0),\n  discount int DEFAULT -1,\n  total numeric GENERATED ALWAYS AS (amount * 2) STORED,\n  placed_at timestamp(3) without time zone\n);\nCREATE INDEX orders_user_idx ON app.orders (user_id, placed_at DESC) WHERE status <> 'shipped';\nCREATE UNIQUE INDEX orders_invoice_idx ON app.orders USING btree (invoice_no) INCLUDE (amount);\nCREATE TABLE app.measures (ts date NOT NULL, v double precision) PARTITION BY RANGE (ts);\nCREATE TABLE app.measures_2026 PARTITION OF app.measures FOR VALUES FROM ('2026-01-01') TO ('2027-01-01');\nCREATE VIEW app.order_totals AS\n  SELECT u.id AS user_id, u.email, count(o.id) AS n, coalesce(sum(o.amount), 0) AS total\n  FROM app.users u LEFT JOIN app.orders o ON o.user_id = u.id\n  GROUP BY u.id, u.email;\nCREATE MATERIALIZED VIEW app.daily AS SELECT placed_at::date AS day, count(*) AS n FROM app.orders GROUP BY 1 WITH NO DATA;\nCREATE COLLATION app.ci (provider = icu, locale = 'und-u-ks-level2', deterministic = false);\nCOMMENT ON COLLATION app.ci IS 'Case-insensitive';\nCREATE TYPE app.pair AS (a integer, b text COLLATE \"C\");\nCOMMENT ON TYPE app.pair IS 'Two values';\nCREATE TYPE app.floatrange AS RANGE (SUBTYPE = float8, SUBTYPE_DIFF = float8mi);\nCREATE TABLE app.people (id integer PRIMARY KEY, nick text COLLATE app.ci, span app.floatrange, tags app.floatmultirange);\nCREATE FUNCTION app.add2(a integer, b integer) RETURNS integer LANGUAGE sql IMMUTABLE AS $$ SELECT a + b $$;\nCREATE AGGREGATE app.total(integer) (SFUNC = app.add2, STYPE = integer, INITCOND = '0', PARALLEL = SAFE);\nCOMMENT ON AGGREGATE app.total(integer) IS 'A sum';\nCREATE FUNCTION app.middle(v double precision[]) RETURNS double precision LANGUAGE sql IMMUTABLE AS $$ SELECT v[(array_length(v, 1) + 1) / 2] $$;\nCREATE AGGREGATE app.median_of(ORDER BY double precision) (SFUNC = pg_catalog.array_append, STYPE = double precision[], FINALFUNC = app.middle);\nCREATE FUNCTION app.pair_text(p app.pair) RETURNS text LANGUAGE sql IMMUTABLE AS $$ SELECT p.a || ':' || p.b $$;\nCREATE CAST (app.pair AS text) WITH FUNCTION app.pair_text(app.pair) AS ASSIGNMENT;\nCOMMENT ON CAST (app.pair AS text) IS 'a:b';\nCREATE FUNCTION app.audit() RETURNS event_trigger LANGUAGE plpgsql AS $$ BEGIN END $$;\nCREATE EVENT TRIGGER app_audit ON ddl_command_end WHEN TAG IN ('CREATE TABLE') EXECUTE FUNCTION app.audit();\nCREATE FUNCTION app.int_same(a integer, b integer) RETURNS boolean LANGUAGE sql IMMUTABLE AS $$ SELECT a = b $$;\nCREATE OPERATOR app.=== (FUNCTION = app.int_same, LEFTARG = integer, RIGHTARG = integer, COMMUTATOR = OPERATOR(app.===), RESTRICT = eqsel, JOIN = eqjoinsel, HASHES, MERGES);\nCOMMENT ON OPERATOR app.===(integer, integer) IS 'Same value';\nCREATE STATISTICS app.orders_stats (dependencies) ON user_id, status FROM app.orders;\nCOMMENT ON STATISTICS app.orders_stats IS 'Users and their order states';\nCREATE FOREIGN DATA WRAPPER app_fdw OPTIONS (debug 'true');\nCOMMENT ON FOREIGN DATA WRAPPER app_fdw IS 'Remote tables';\nCREATE SERVER app_replica TYPE 'pg' VERSION '16' FOREIGN DATA WRAPPER app_fdw OPTIONS (host 'db.internal', port '5432');\nCOMMENT ON SERVER app_replica IS 'The read replica';\nCREATE PUBLICATION app_pub FOR TABLE app.orders, app.users WITH (publish = 'insert, update');\nCOMMENT ON PUBLICATION app_pub IS 'Order changes';\nCREATE TABLE public._prisma_migrations (id varchar(36) PRIMARY KEY, checksum varchar(64) NOT NULL);\n";
 //# sourceMappingURL=roundtrip-schema.d.ts.map

package/dist/postgres/testing/roundtrip-schema.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"roundtrip-schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/roundtrip-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;GAUG;AACH,eAAO,MAAM,gBAAgB,2/GAoD5B,CAAC"}
+{"version":3,"file":"roundtrip-schema.d.ts","sourceRoot":"","sources":["../../../src/postgres/testing/roundtrip-schema.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;GAWG;AACH,eAAO,MAAM,gBAAgB,27IA+D5B,CAAC"}

package/dist/postgres/testing/roundtrip-schema.js

@@ -5,7 +5,8 @@
  * sequence options, storage parameters, comments), an extension and the
  * domain over its type, a collation, composite and range types (and a
  * multirange column), plain and ordered-set aggregates, a cast and an event
- * trigger (#3911), a partitioned table and a partition, an ORM's
+ * trigger, an operator, extended statistics, a foreign data wrapper and server, and a
+ * publication (#3911), a partitioned table and a partition, an ORM's
  * revision table that import leaves out, and an object carrying chant's
  * ownership trailer.
  */
@@ -60,5 +61,16 @@ CREATE CAST (app.pair AS text) WITH FUNCTION app.pair_text(app.pair) AS ASSIGNME
 COMMENT ON CAST (app.pair AS text) IS 'a:b';
 CREATE FUNCTION app.audit() RETURNS event_trigger LANGUAGE plpgsql AS $$ BEGIN END $$;
 CREATE EVENT TRIGGER app_audit ON ddl_command_end WHEN TAG IN ('CREATE TABLE') EXECUTE FUNCTION app.audit();
+CREATE FUNCTION app.int_same(a integer, b integer) RETURNS boolean LANGUAGE sql IMMUTABLE AS $$ SELECT a = b $$;
+CREATE OPERATOR app.=== (FUNCTION = app.int_same, LEFTARG = integer, RIGHTARG = integer, COMMUTATOR = OPERATOR(app.===), RESTRICT = eqsel, JOIN = eqjoinsel, HASHES, MERGES);
+COMMENT ON OPERATOR app.===(integer, integer) IS 'Same value';
+CREATE STATISTICS app.orders_stats (dependencies) ON user_id, status FROM app.orders;
+COMMENT ON STATISTICS app.orders_stats IS 'Users and their order states';
+CREATE FOREIGN DATA WRAPPER app_fdw OPTIONS (debug 'true');
+COMMENT ON FOREIGN DATA WRAPPER app_fdw IS 'Remote tables';
+CREATE SERVER app_replica TYPE 'pg' VERSION '16' FOREIGN DATA WRAPPER app_fdw OPTIONS (host 'db.internal', port '5432');
+COMMENT ON SERVER app_replica IS 'The read replica';
+CREATE PUBLICATION app_pub FOR TABLE app.orders, app.users WITH (publish = 'insert, update');
+COMMENT ON PUBLICATION app_pub IS 'Order changes';
 CREATE TABLE public._prisma_migrations (id varchar(36) PRIMARY KEY, checksum varchar(64) NOT NULL);
 `;

package/dist/postgres.d.ts

@@ -5,7 +5,7 @@
  * the statements are Postgres's own DDL, parsed at build time into entities,
  * and the names fold and quote as Postgres folds and quotes them.
  */
-export { schema, table, index, view, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, collation, cast, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresCompositeType, type PostgresRangeType, type PostgresType, type PostgresDomain, type PostgresAggregate, type PostgresCollation, type PostgresCast, type PostgresEventTrigger, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type PostgresPolicy, type PostgresRole, type PostgresGrant, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type CompositeTypeProps, type CompositeAttributeDef, type RangeTypeProps, type AggregateProps, type AggregateArgDef, type CollationProps, type CastProps, type EventTriggerProps, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type PolicyProps, type RoleProps, type GrantProps, type DefaultPrivilegesProps, type PrivilegeDef, type LineageEdge, type SqlSchema, type RowOf, type Column, type ColumnTraits, type AnyColumn, type UncheckedColumn, type KeyColumn, type NotNullColumn, type Named, type Unnamed, } from "./postgres/entities.js";
+export { schema, table, index, view, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, operator, statistics, foreignDataWrapper, foreignServer, publication, collation, cast, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, type PostgresEntityType, type PostgresSchema, type PostgresRelation, type PostgresTable, type PostgresView, type PostgresIndex, type PostgresSequence, type PostgresEnum, type PostgresCompositeType, type PostgresRangeType, type PostgresType, type PostgresDomain, type PostgresAggregate, type PostgresCollation, type PostgresCast, type PostgresEventTrigger, type PostgresOperator, type PostgresStatistics, type PostgresForeignDataWrapper, type PostgresForeignServer, type PostgresPublication, type PostgresExtension, type PostgresFunction, type PostgresProcedure, type PostgresTrigger, type PostgresPolicy, type PostgresRole, type PostgresGrant, type ColumnDef, type KeyDef, type CheckDef, type ForeignKeyDef, type ExclusionDef, type SchemaProps, type TableProps, type IndexProps, type ViewProps, type SequenceProps, type EnumProps, type CompositeTypeProps, type CompositeAttributeDef, type RangeTypeProps, type AggregateProps, type AggregateArgDef, type CollationProps, type CastProps, type EventTriggerProps, type OperatorProps, type StatisticsProps, type ForeignDataWrapperProps, type ForeignServerProps, type PublicationProps, type PublicationTableDef, type DomainProps, type ExtensionProps, type RoutineProps, type RoutineArgDef, type FunctionProps, type ProcedureProps, type TriggerProps, type PolicyProps, type RoleProps, type GrantProps, type DefaultPrivilegesProps, type PrivilegeDef, type LineageEdge, type SqlSchema, type RowOf, type Column, type ColumnTraits, type AnyColumn, type UncheckedColumn, type KeyColumn, type NotNullColumn, type Named, type Unnamed, } from "./postgres/entities.js";
 export { POSTGRES_PROVIDERS, COMMON_REFUSED, providerData, isPostgresProvider, providerAllowsExtension, isProviderOwned, refusedStatement, normalizeStatement, type PostgresProvider, type ProviderData, type ProviderSource, type RefusedStatement, type LiveObjectRef, } from "./postgres/providers/index.js";
 export { PostgresMigrationOp, type PostgresMigrationOpConfig, type PostgresMigrationOpResources, type PostgresMigrationArgs, } from "./postgres/migrate/op.js";
 export { POSTGRES_RECEIPTS_TABLE } from "./postgres/migrate/receipts.js";

package/dist/postgres.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,SAAS,EACT,OAAO,EACP,YAAY,EACZ,SAAS,EACT,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,KAAK,EACV,KAAK,OAAO,GACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC;AAItC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"postgres.d.ts","sourceRoot":"","sources":["../src/postgres.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EACL,MAAM,EACN,KAAK,EACL,KAAK,EACL,IAAI,EACJ,QAAQ,EACR,IAAI,EACJ,MAAM,EACN,SAAS,EACT,IAAI,EACJ,SAAS,EACT,SAAS,EACT,OAAO,EACP,YAAY,EACZ,QAAQ,EACR,UAAU,EACV,kBAAkB,EAClB,aAAa,EACb,WAAW,EACX,SAAS,EACT,IAAI,EACJ,MAAM,EACN,IAAI,EACJ,KAAK,EACL,OAAO,EACP,UAAU,EACV,gBAAgB,EAChB,cAAc,EACd,qBAAqB,EACrB,gBAAgB,EAChB,WAAW,EACX,UAAU,EACV,KAAK,kBAAkB,EACvB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,iBAAiB,EACtB,KAAK,iBAAiB,EACtB,KAAK,YAAY,EACjB,KAAK,oBAAoB,EACzB,KAAK,gBAAgB,EACrB,KAAK,kBAAkB,EACvB,KAAK,0BAA0B,EAC/B,KAAK,qBAAqB,EAC1B,KAAK,mBAAmB,EACxB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,EACrB,KAAK,iBAAiB,EACtB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,MAAM,EACX,KAAK,QAAQ,EACb,KAAK,aAAa,EAClB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,UAAU,EACf,KAAK,UAAU,EACf,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,SAAS,EACd,KAAK,kBAAkB,EACvB,KAAK,qBAAqB,EAC1B,KAAK,cAAc,EACnB,KAAK,cAAc,EACnB,KAAK,eAAe,EACpB,KAAK,cAAc,EACnB,KAAK,SAAS,EACd,KAAK,iBAAiB,EACtB,KAAK,aAAa,EAClB,KAAK,eAAe,EACpB,KAAK,uBAAuB,EAC5B,KAAK,kBAAkB,EACvB,KAAK,gBAAgB,EACrB,KAAK,mBAAmB,EACxB,KAAK,WAAW,EAChB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,aAAa,EAClB,KAAK,aAAa,EAClB,KAAK,cAAc,EACnB,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,UAAU,EACf,KAAK,sBAAsB,EAC3B,KAAK,YAAY,EACjB,KAAK,WAAW,EAChB,KAAK,SAAS,EACd,KAAK,KAAK,EACV,KAAK,MAAM,EACX,KAAK,YAAY,EACjB,KAAK,SAAS,EACd,KAAK,eAAe,EACpB,KAAK,SAAS,EACd,KAAK,aAAa,EAClB,KAAK,KAAK,EACV,KAAK,OAAO,GACb,MAAM,qBAAqB,CAAC;AAE7B,OAAO,EACL,kBAAkB,EAClB,cAAc,EACd,YAAY,EACZ,kBAAkB,EAClB,uBAAuB,EACvB,eAAe,EACf,gBAAgB,EAChB,kBAAkB,EAClB,KAAK,gBAAgB,EACrB,KAAK,YAAY,EACjB,KAAK,cAAc,EACnB,KAAK,gBAAgB,EACrB,KAAK,aAAa,GACnB,MAAM,sBAAsB,CAAC;AAE9B,OAAO,EACL,mBAAmB,EACnB,KAAK,yBAAyB,EAC9B,KAAK,4BAA4B,EACjC,KAAK,qBAAqB,GAC3B,MAAM,uBAAuB,CAAC;AAC/B,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,cAAc,uBAAuB,CAAC;AAItC,OAAO,EACL,YAAY,EACZ,qBAAqB,EACrB,KAAK,YAAY,EACjB,KAAK,iBAAiB,EACtB,KAAK,kBAAkB,EACvB,KAAK,iBAAiB,EACtB,KAAK,gBAAgB,GACtB,MAAM,iBAAiB,CAAC"}

package/dist/postgres.js

@@ -5,7 +5,7 @@
  * the statements are Postgres's own DDL, parsed at build time into entities,
  * and the names fold and quote as Postgres folds and quotes them.
  */
-export { schema, table, index, view, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, collation, cast, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, } from "./postgres/entities.js";
+export { schema, table, index, view, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, operator, statistics, foreignDataWrapper, foreignServer, publication, collation, cast, policy, role, grant, literal, SqlLiteral, SqlTemplateError, PostgresObject, POSTGRES_ENTITY_TYPES, isPostgresObject, isColumnRef, quoteIdent, } from "./postgres/entities.js";
 export { POSTGRES_PROVIDERS, COMMON_REFUSED, providerData, isPostgresProvider, providerAllowsExtension, isProviderOwned, refusedStatement, normalizeStatement, } from "./postgres/providers/index.js";
 export { PostgresMigrationOp, } from "./postgres/migrate/op.js";
 export { POSTGRES_RECEIPTS_TABLE } from "./postgres/migrate/receipts.js";

package/dist/rules/audit-entries.ts

@@ -33,4 +33,5 @@ export const sqlPostSynthAuditEntries: Record<string, RuleMeta> = {
   SQLCH125: auditRule("SQLCH125", "merge-worthy", "guidance", "A codec parameter is outside what the codec takes", "Give the codec a parameter within its range or set, or drop the parameter for the default.", { category: "correctness" }),
   SQLCH126: auditRule("SQLCH126", "merge-worthy", "guidance", "A GRANT column list names a column the table does not declare", "Fix the column name, or declare the column on the table.", { category: "correctness" }),
   SQLCH127: auditRule("SQLCH127", "merge-worthy", "guidance", "An expression calls a function the pinned server does not have", "Fix the function name, use one from the pinned server's system.functions, or declare it with func.", { category: "correctness" }),
+  SQLCH128: auditRule("SQLCH128", "merge-worthy", "guidance", "An integration engine or table function argument holds a literal credential", "Create a named collection with the credentials on the server and name it in place of the arguments: ENGINE = S3(lake_creds, format = 'Parquet').", { category: "security" }),
 };

package/dist/rules/postgres-templates.ts

@@ -17,12 +17,12 @@ export const POSTGRES_TEMPLATE_SOURCES: readonly TemplateSource<PostgresTag>[] =
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql/postgres"],
-    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "collation", "cast", "policy", "role", "grant"],
+    tags: ["schema", "table", "index", "view", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "operator", "statistics", "foreignDataWrapper", "foreignServer", "publication", "collation", "cast", "policy", "role", "grant"],
   },
   {
     dialect: "postgres",
     modules: ["@intentius/chant-lexicon-sql"],
-    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "collation", "cast", "policy", "role", "grant"],
+    tags: ["schema", "index", "sequence", "type", "domain", "extension", "func", "procedure", "aggregate", "trigger", "eventTrigger", "operator", "statistics", "foreignDataWrapper", "foreignServer", "publication", "collation", "cast", "policy", "role", "grant"],
   },
 ];
 

package/dist/rules/sqlch128.ts

@@ -0,0 +1,230 @@
+import { DATABASE_ENGINES, FORMATS, TABLE_ENGINES } from "../../generated/clickhouse";
+import { parseEngineSyntax } from "../../clickhouse/engine-syntax";
+import { COLLECTION_ENGINES, engineCollection } from "../../clickhouse/named-collections";
+import { isTrivia, tokenizeText, type Token } from "../../clickhouse/tokens";
+import { checkOf, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects, type OutputObject } from "./sql-helpers";
+
+/** A syntax-line argument that holds a secret: `password`, `secret_access_key`, `account_key`, `session_token`, `oauth_token`. */
+const SECRET_ARGUMENT = /password|secret|account_key|session_token|oauth_token/i;
+
+/** A `key = value` argument or a setting that holds a secret: the above, and `kafka_sasl_password`, `nats_token`. */
+const SECRET_KEY = /password|secret|account_key|session_token|oauth_token|(?:^|_)token$|private_key/i;
+
+/** Credentials written inside another value: a URL's `user:password@`, an Azure connection string's key or signature. */
+const EMBEDDED = [
+  { re: /^[a-z][a-z0-9+.-]*:\/\/[^/@:\s]+:[^/@\s]+@/i, what: "a URL with a password in it" },
+  { re: /(?:^|;)\s*(?:AccountKey|SharedAccessSignature)\s*=/i, what: "a connection string with an account key or signature in it" },
+];
+
+/** Compression methods the integration engines take after the format. */
+const COMPRESSION = new Set(["none", "auto", "gzip", "gz", "deflate", "br", "brotli", "xz", "lzma", "zstd", "zst", "lz4", "bz2", "snappy"]);
+const FORMAT_NAMES = new Set(FORMATS.map((f) => f.toLowerCase()));
+
+/** The table functions whose arguments follow an engine's syntax line, lower case, by engine. */
+const FUNCTION_ENGINE: Readonly<Record<string, string>> = {
+  s3: "S3",
+  gcs: "S3",
+  oss: "S3",
+  cosn: "S3",
+  url: "URL",
+  mysql: "MySQL",
+  postgresql: "PostgreSQL",
+  mongodb: "MongoDB",
+  azureblobstorage: "AzureBlobStorage",
+  iceberg: "Iceberg",
+  icebergs3: "IcebergS3",
+  icebergazure: "IcebergAzure",
+  deltalake: "DeltaLake",
+  deltalakes3: "DeltaLakeS3",
+  deltalakeazure: "DeltaLakeAzure",
+  hudi: "Hudi",
+  paimon: "Paimon",
+  paimons3: "PaimonS3",
+  arrowflight: "ArrowFlight",
+  ytsaurus: "YTsaurus",
+};
+
+/** `remote('addresses', db, table, 'user', 'password')`: no syntax line says it, so its password's position is written here. */
+const FUNCTION_SECRETS: Readonly<Record<string, Array<{ name: string; position: number }>>> = {
+  remote: [{ name: "password", position: 4 }],
+  remotesecure: [{ name: "password", position: 4 }],
+};
+
+const ENGINE_SYNTAX = { ...TABLE_ENGINES, ...DATABASE_ENGINES } as Readonly<Record<string, { syntax: string } | undefined>>;
+
+/** The secret arguments an engine's syntax line names, with their positions. */
+function secretPositions(engine: string): Array<{ name: string; position: number }> {
+  const syntax = ENGINE_SYNTAX[engine]?.syntax;
+  const parsed = syntax ? parseEngineSyntax(syntax) : undefined;
+  if (!parsed) return [];
+  return parsed.args
+    .filter((a) => !a.named && a.name.split("|").some((n) => SECRET_ARGUMENT.test(n)))
+    .map((a) => ({ name: a.name.split("|").find((n) => SECRET_ARGUMENT.test(n))!, position: a.position }));
+}
+
+/** The text of a string literal, or undefined for anything else. */
+function stringValue(text: string): string | undefined {
+  const t = text.trim();
+  if (!/^'(?:[^'\\]|\\.|'')*'$/.test(t)) return undefined;
+  return t.slice(1, -1).replace(/\\(.)/g, "$1").replace(/''/g, "'");
+}
+
+/**
+ * Whether the arguments before `position` leave it where the syntax line puts
+ * it. An optional group (`[, access_key_id, secret_access_key]`) may be left
+ * out, and the format and compression move up into its place:
+ * `S3('url', 'Parquet', 'gzip')`. When a format, a compression method or
+ * `NOSIGN` comes earlier, the position says nothing.
+ */
+function aligned(args: readonly string[], position: number): boolean {
+  for (const a of args.slice(1, position)) {
+    const t = a.trim();
+    if (t.toUpperCase() === "NOSIGN") return false;
+    const v = stringValue(t)?.toLowerCase();
+    if (v !== undefined && (FORMAT_NAMES.has(v) || COMPRESSION.has(v))) return false;
+  }
+  return true;
+}
+
+interface Finding {
+  where: string;
+  what: string;
+  masked: boolean;
+}
+
+/** The literal credentials in one engine's or table function's arguments. */
+function argumentFindings(label: string, args: readonly string[], secrets: ReadonlyArray<{ name: string; position: number }>, collection: boolean): Finding[] {
+  const out: Finding[] = [];
+  const add = (where: string, what: string, value: string) => out.push({ where, what, masked: value === "[HIDDEN]" });
+  // After a named collection, the arguments are `key = value` overrides, not positions.
+  if (!collection) {
+    for (const s of secrets) {
+      const arg = args[s.position];
+      const value = arg !== undefined ? stringValue(arg) : undefined;
+      if (value && aligned(args, s.position)) add(`${label} argument ${s.name}`, "a literal credential", value);
+    }
+  }
+  args.forEach((arg, i) => {
+    const kv = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*([\s\S]+)$/.exec(arg);
+    if (kv) {
+      const value = stringValue(kv[2]!);
+      if (value && SECRET_KEY.test(kv[1]!)) add(`${label} argument ${kv[1]}`, "a literal credential", value);
+      return;
+    }
+    const value = stringValue(arg);
+    if (!value) return;
+    for (const e of EMBEDDED) if (e.re.test(value)) add(`${label} argument ${i + 1}`, e.what, value);
+  });
+  return out;
+}
+
+/** Each table function call in a SQL text, with its arguments as written. */
+function functionCalls(text: string): Array<{ name: string; args: string[] }> {
+  let tokens: Token[];
+  try {
+    tokens = tokenizeText(text, 0);
+  } catch {
+    return [];
+  }
+  const sig = tokens.map((t, i) => ({ t, i })).filter(({ t }) => !isTrivia(t));
+  const out: Array<{ name: string; args: string[] }> = [];
+  for (let k = 0; k + 1 < sig.length; k++) {
+    const fn = sig[k]!.t;
+    const open = sig[k + 1]!;
+    if (fn.kind !== "ident" || open.t.kind !== "punct" || open.t.text !== "(") continue;
+    const lower = fn.text.toLowerCase();
+    const base = lower.endsWith("cluster") ? lower.slice(0, -"cluster".length) : lower;
+    if (!(base in FUNCTION_ENGINE) && !(base in FUNCTION_SECRETS)) continue;
+    let depth = 0;
+    let end = open.i;
+    for (let j = open.i; j < tokens.length; j++) {
+      const t = tokens[j]!;
+      if (t.kind === "punct" && t.text === "(") depth++;
+      else if (t.kind === "punct" && t.text === ")" && --depth === 0) {
+        end = j;
+        break;
+      }
+    }
+    const inner = tokens
+      .slice(open.i + 1, end)
+      .map((t) => t.text)
+      .join("");
+    out.push({ name: fn.text, args: inner.trim() === "" ? [] : splitTop(inner) });
+  }
+  return out;
+}
+
+/** The literal credentials in each table function call a SQL text makes. */
+function callFindings(text: string): Finding[] {
+  return functionCalls(text).flatMap((call) => {
+    const lower = call.name.toLowerCase();
+    const clustered = lower.endsWith("cluster") && !(lower in FUNCTION_ENGINE);
+    const base = clustered ? lower.slice(0, -"cluster".length) : lower;
+    // `s3Cluster(cluster, url, ...)`: the cluster comes first.
+    const args = clustered ? call.args.slice(1) : call.args;
+    const engine = FUNCTION_ENGINE[base];
+    const secrets = engine ? secretPositions(engine) : (FUNCTION_SECRETS[base] ?? []);
+    const collection = args[0] !== undefined && /^\s*(?:[A-Za-z_][A-Za-z0-9_]*|`[^`]+`)\s*$/.test(args[0]) && args[0].trim().toUpperCase() !== "NOSIGN";
+    return argumentFindings(`${call.name}()`, args, secrets, collection);
+  });
+}
+
+/** The literal credentials in a table's or database's engine and its settings. */
+function engineFindings(o: OutputObject & { settings?: Record<string, string> }): Finding[] {
+  const engine = o.engine;
+  if (!engine) return [];
+  const out = argumentFindings(`ENGINE = ${engine.name}`, engine.args ?? [], secretPositions(engine.name), engineCollection(engine) !== undefined);
+  if (COLLECTION_ENGINES.has(engine.name)) {
+    for (const [key, raw] of Object.entries(o.settings ?? {})) {
+      const value = stringValue(raw);
+      if (value && SECRET_KEY.test(key)) out.push({ where: `${engine.name} setting ${key}`, what: "a literal credential", masked: value === "[HIDDEN]" });
+    }
+  }
+  return out;
+}
+
+/** `PASSWORD 'secret'` in a dictionary's source. */
+function sourceFindings(dataSource: string): Finding[] {
+  const m = /\bPASSWORD\s+('(?:[^'\\]|\\.|'')*')/i.exec(dataSource);
+  const value = m ? stringValue(m[1]!) : undefined;
+  return value ? [{ where: "SOURCE PASSWORD", what: "a literal credential", masked: value === "[HIDDEN]" }] : [];
+}
+
+/**
+ * SQLCH128: an integration engine's or table function's argument holds a
+ * literal credential (#4395): `ENGINE = S3('https://...', 'AKIA...', 'secret')`,
+ * `mysql('db:3306', 'shop', 'orders', 'app', 'secret')`, a Kafka table's
+ * `kafka_sasl_password` setting, a dictionary source's `PASSWORD`.
+ *
+ * A credential is the environment's, so it does not belong in a declaration,
+ * the build output or `clickhouse.sql`, as `IDENTIFIED BY` does not on a
+ * user (`../../clickhouse/access.ts`). The secret arguments are found by name
+ * from each engine's syntax line in the pinned catalog (`password`,
+ * `secret_access_key`, `account_key`, `session_token`, `oauth_token`), as
+ * `key = value` overrides and settings by the same names, and inside a URL
+ * (`user:password@`) or an Azure connection string (`AccountKey=`). The fix
+ * is a named collection the environment creates, named in place of the
+ * arguments: `ENGINE = S3(lake_creds, format = 'Parquet')`.
+ */
+export const sqlch128 = checkOf({ id: "SQLCH128", description: "An integration engine or table function argument holds a literal credential" }, (ctx, report) => {
+  for (const o of clickhouseObjects(ctx)) {
+    const props = o as OutputObject & { settings?: Record<string, string>; asFunction?: string; select?: string; dataSource?: string };
+    const findings = [
+      ...engineFindings(props),
+      ...(props.asFunction ? callFindings(props.asFunction) : []),
+      ...(props.select ? callFindings(props.select) : []),
+      ...(props.dataSource ? sourceFindings(props.dataSource) : []),
+    ];
+    for (const f of findings) {
+      const held = f.masked ? "holds '[HIDDEN]', the server's mask for a credential, in place of one" : `holds ${f.what}, which is the environment's`;
+      report({
+        severity: "error",
+        message:
+          `${o.export} (${o.name}): ${f.where} ${held}. ` +
+          "Create a named collection with the credentials on the server and name it in place of the arguments (ENGINE = S3(lake_creds, format = 'Parquet'), s3(lake_creds), SOURCE(MYSQL(NAME mysql_creds))); chant sql plan checks that it exists",
+        entity: o.export,
+      });
+    }
+  }
+});

package/dist/serializer.d.ts

@@ -21,6 +21,11 @@
  * of each. Two databases of different dialects are two projects (two
  * workspace members, #3047 question 1).
  *
+ * A ClickHouse object that names a named collection (an engine's first
+ * argument, a table function's, a dictionary source's `NAME`) carries
+ * `namedCollections`, and the document lists every one the build names, so
+ * a plan can check each exists on the server (#4395).
+ *
  * A Postgres document also carries `postgresMajor`, the major the project
  * targets (`sql.postgresMajor`, else the newest pinned major). Post-synth
  * checks and the lock classifier read it; ClickHouse output has no such field.

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAYjF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAkBnF;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAqEhD,eAAO,MAAM,aAAa,EAAE,UAyC3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAajF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAkBnF;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAsEhD,eAAO,MAAM,aAAa,EAAE,UA6C3B,CAAC"}

package/dist/serializer.js

@@ -21,6 +21,11 @@
  * of each. Two databases of different dialects are two projects (two
  * workspace members, #3047 question 1).
  *
+ * A ClickHouse object that names a named collection (an engine's first
+ * argument, a table function's, a dictionary source's `NAME`) carries
+ * `namedCollections`, and the document lists every one the build names, so
+ * a plan can check each exists on the server (#4395).
+ *
  * A Postgres document also carries `postgresMajor`, the major the project
  * targets (`sql.postgresMajor`, else the newest pinned major). Post-synth
  * checks and the lock classifier read it; ClickHouse output has no such field.
@@ -39,6 +44,7 @@ import { applyOrder, lineageJson, referenceName } from "./core/references.js";
 import { sqlFileLineOf, sqlFileOf, sqlFileReferences } from "./sql-files.js";
 import { relative } from "node:path";
 import { getProvenance } from "@intentius/chant/provenance";
+import { namedCollectionReferences } from "./clickhouse/named-collections.js";
 export { applyOrder } from "./core/references.js";
 /**
  * A warning for each clause chant's parser does not know (#3872): where it
@@ -81,7 +87,8 @@ function objectJson(name, obj, names, extra = []) {
         props.lineage = lineageJson(props.lineage, names);
     }
     const dependsOn = [...new Set([...obj.dependsOn.map((r) => referenceName(r, names)).filter((n) => n !== undefined), ...extra])];
-    return JSON.parse(JSON.stringify({ export: name, type: obj.entityType, sqlName: obj.sqlName, ...props, dependsOn, ddl }));
+    const collections = namedCollectionReferences(props);
+    return JSON.parse(JSON.stringify({ export: name, type: obj.entityType, sqlName: obj.sqlName, ...props, dependsOn, ...(collections.length > 0 ? { namedCollections: collections } : {}), ddl }));
 }
 /** A props value with every entity and column reference in it written as its export name (`users`, `users.id`). */
 function postgresJsonValue(v, names) {
@@ -153,10 +160,14 @@ export const sqlSerializer = {
             names.set(entity, name);
         const extra = sqlFileReferences("clickhouse", objects);
         const order = applyOrder(objects, names, extra);
+        const json = order.map((n) => objectJson(n, objects.get(n), names, extra.get(n)));
+        // The named collections the build references (#4395), each once, by name: a plan checks each exists.
+        const collections = [...new Set(json.flatMap((o) => o.namedCollections ?? []))].sort();
         const doc = {
             dialect: "clickhouse",
             applyOrder: order,
-            objects: order.map((n) => objectJson(n, objects.get(n), names, extra.get(n))),
+            ...(collections.length > 0 ? { namedCollections: collections } : {}),
+            objects: json,
         };
         const ddl = order
             .map((n) => `${objects.get(n).props.ddl};`)

package/dist/sql-types-command.d.ts

@@ -13,7 +13,20 @@
  * the file instead of writing it: exit 1, naming the file, when they differ.
  */
 import type { CommandGroupContext } from "@intentius/chant/cli/command-group";
+export interface ProjectLocation {
+    config: Awaited<ReturnType<typeof import("@intentius/chant/config").loadChantConfigUpward>>["config"];
+    projectDir: string;
+    sourceDir: string;
+}
 /** The file tsc would read instead of `path`: `sql-types.ts` beside `sql-types.d.ts`. */
 export declare function shadowingSource(path: string): string | undefined;
+/** The project the working directory belongs to: its config, its root and its source directory. */
+export declare function loadProject(cwd: string): Promise<ProjectLocation>;
+/**
+ * The fold build's entities: what `chant build` declares, `.sql` files and
+ * composite members included. Prints the build's errors and returns
+ * undefined when it fails.
+ */
+export declare function buildFolded(project: ProjectLocation, command: string, consequence: string): Promise<import("@intentius/chant").BuildResult | undefined>;
 export declare function runTypes(ctx: CommandGroupContext): Promise<number>;
 //# sourceMappingURL=sql-types-command.d.ts.map

package/dist/sql-types-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-types-command.d.ts","sourceRoot":"","sources":["../src/sql-types-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAqB9E,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqDxE"}
+{"version":3,"file":"sql-types-command.d.ts","sourceRoot":"","sources":["../src/sql-types-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAG9E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtG,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAoBD,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,mGAAmG;AACnG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAKvE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,+DAe/F;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCxE"}

package/dist/sql-types-command.js

@@ -43,37 +43,52 @@ export function shadowingSource(path) {
     const source = `${path.slice(0, -".d.ts".length)}.ts`;
     return existsSync(source) ? source : undefined;
 }
-export async function runTypes(ctx) {
-    const args = parseArgs(ctx.rawArgs);
-    if ("error" in args) {
-        console.error(`${args.error}\n${USAGE}`);
-        return 1;
-    }
-    const cwd = process.cwd();
+/** The project the working directory belongs to: its config, its root and its source directory. */
+export async function loadProject(cwd) {
     const { loadChantConfigUpward } = await import("@intentius/chant/config");
     const { config, configPath } = await loadChantConfigUpward(cwd);
     const projectDir = configPath ? dirname(configPath) : cwd;
-    const sourceDir = resolve(projectDir, config.sourceDir ?? ".");
-    const output = args.output !== undefined ? resolve(cwd, args.output) : join(sourceDir, SQL_TYPES_FILE);
-    const shadow = shadowingSource(output);
-    if (shadow) {
-        console.error(`chant sql types: ${relative(cwd, shadow) || basename(shadow)} sits beside ${relative(cwd, output) || basename(output)}, and tsc reads it instead of the declarations; rename one`);
-        return 1;
-    }
+    return { config, projectDir, sourceDir: resolve(projectDir, config.sourceDir ?? ".") };
+}
+/**
+ * The fold build's entities: what `chant build` declares, `.sql` files and
+ * composite members included. Prints the build's errors and returns
+ * undefined when it fails.
+ */
+export async function buildFolded(project, command, consequence) {
+    const { config, projectDir, sourceDir } = project;
     const { build } = await import("@intentius/chant/build");
     const { resolveBuildModes, resolveProjectBuildOptions } = await import("@intentius/chant/cli/build-options");
     const { loadPlugins, resolveProjectLexicons } = await import("@intentius/chant/cli/plugins");
     const { sqlSerializer } = await import("./serializer.js");
     const plugins = await loadPlugins(await resolveProjectLexicons(projectDir, { lexicon: "sql" }));
-    // The fold build's entities: what `chant build` declares, `.sql` files and composite members included.
     const options = resolveProjectBuildOptions({ config, configDir: projectDir, plugins, modes: resolveBuildModes(config, { fold: true }) });
     const result = await build(sourceDir, [sqlSerializer], undefined, options);
     if (result.errors.length > 0) {
         for (const e of result.errors)
             console.error(e instanceof Error ? e.message : String(e));
-        console.error("chant sql types: the build failed, so nothing was written");
+        console.error(`${command}: the build failed, so ${consequence}`);
+        return undefined;
+    }
+    return result;
+}
+export async function runTypes(ctx) {
+    const args = parseArgs(ctx.rawArgs);
+    if ("error" in args) {
+        console.error(`${args.error}\n${USAGE}`);
         return 1;
     }
+    const cwd = process.cwd();
+    const { config, projectDir, sourceDir } = await loadProject(cwd);
+    const output = args.output !== undefined ? resolve(cwd, args.output) : join(sourceDir, SQL_TYPES_FILE);
+    const shadow = shadowingSource(output);
+    if (shadow) {
+        console.error(`chant sql types: ${relative(cwd, shadow) || basename(shadow)} sits beside ${relative(cwd, output) || basename(output)}, and tsc reads it instead of the declarations; rename one`);
+        return 1;
+    }
+    const result = await buildFolded({ config, projectDir, sourceDir }, "chant sql types", "nothing was written");
+    if (!result)
+        return 1;
     const text = renderSqlTypes(result.entities, { projectDir, config: config });
     const shown = relative(cwd, output);
     const named = shown && !shown.startsWith("..") ? shown : output;

package/dist/sql-types.d.ts

@@ -30,6 +30,8 @@
  */
 import type { Declarable } from "@intentius/chant/declarable";
 import type { SqlDialect } from "./dialects.js";
+import { type PgProject } from "./lint/post-synth/postgres-names.js";
+import type { OutputObject } from "./lint/post-synth/sql-helpers.js";
 /** The file `chant sql types` writes, in the project's source directory. */
 export declare const SQL_TYPES_FILE = "sql-types.d.ts";
 /**
@@ -47,6 +49,26 @@ export interface RenderSqlTypesOptions {
     /** The project's config: `sql.postgresMajor` for the catalog, `sql.dialect` when nothing is declared. */
     config?: Record<string, unknown>;
 }
+/** The names a relation's `.columns` record holds at run time, in order. */
+export declare const runtimeColumns: (entity: Declarable | undefined) => string[];
+/** A view's column that passes one column through: that column's export and name. */
+export declare function passthrough(o: OutputObject, name: string, quote: (c: string) => string): {
+    export: string;
+    column: string;
+} | undefined;
+/** A Postgres type's spelling, row type, and whether the type itself forbids NULL (a serial, a NOT NULL domain). */
+export declare function pgType(p: PgProject, text: string | undefined, depth?: number): {
+    sqlType: string;
+    ts: string;
+    notNull: boolean;
+};
+/** The dialect a build's entities declare, else the config's, else ClickHouse. */
+export declare function dialectOf(entities: ReadonlyMap<string, Declarable>, config: Record<string, unknown>): SqlDialect;
+/** The build's sql output as `chant build` writes it: the objects, and the Postgres major they were built for. */
+export declare function serializedObjects(entities: ReadonlyMap<string, Declarable>, config: Record<string, unknown>): {
+    objects: OutputObject[];
+    postgresMajor?: number;
+};
 /**
  * The `sql-types.d.ts` for a build's entities: one module that augments the
  * dialect's `SqlSchema` with each table, view and dictionary, in key order.

package/dist/sql-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-types.d.ts","sourceRoot":"","sources":["../src/sql-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAW9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAGpG;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,qBAA0B,GAC/B,SAAS,GAAG,OAAO,GAAG,SAAS,CASjC;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA+OD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAiClH"}
+{"version":3,"file":"sql-types.d.ts","sourceRoot":"","sources":["../src/sql-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAW9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,OAAO,EAA6E,KAAK,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7I,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,4EAA4E;AAC5E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAGpG;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,qBAA0B,GAC/B,SAAS,GAAG,OAAO,GAAG,SAAS,CASjC;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA2CD,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,QAAQ,UAAU,GAAG,SAAS,KAAG,MAAM,EAA8E,CAAC;AAcrJ,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQvI;AAoBD,oHAAoH;AACpH,wBAAgB,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,SAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAwB3H;AAsHD,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAMhH;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAGjK;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAgClH"}