@intentius/chant-lexicon-sql 0.124.46 → 0.124.48

package/src/files/clickhouse.ts

@@ -21,7 +21,8 @@ import { isAccessStatement, parseAccess, type AccessNode } from "../clickhouse/a
 import type { Token } from "../clickhouse/tokens";
 import { CLICKHOUSE_TAG_OF } from "../clickhouse/import/generator";
 import { describeStatement, type ImportedObject } from "../clickhouse/import/ir";
-import { fileUnparsed, firstLine, lineAt, quoteBare, splitTokens, tokensText, undeclarableStatement, type FileLine, type ReadOptions } from "./common";
+import { fileUnparsed, firstLine, lineAt, quoteBare, referencedStatement, splitTokens, tokensText, undeclarableStatement, type FileLine, type ReadOptions } from "./common";
+import { createdCollectionName } from "../clickhouse/named-collections";
 import { templateSafe, templateStrings } from "./postgres";
 
 type Tag = (strings: TemplateStringsArray, ...values: unknown[]) => Declarable;
@@ -95,6 +96,12 @@ export function readClickHouse(ddl: string, options: ReadOptions, problems: stri
   for (const stmt of splitTokens(tokenizeText(ddl, 0), isTrivia)) {
     let sql = tokensText(stmt);
     const line = lineAt(ddl, stmt[0]!.start);
+    const referenced = options.prerequisites ? referencedStatement("clickhouse", sql) : undefined;
+    const collection = referenced ? createdCollectionName(sql) : undefined;
+    if (referenced && collection !== undefined) {
+      options.prerequisites!.push({ kind: referenced.kind, name: collection });
+      continue;
+    }
     const undeclarable = undeclarableStatement("clickhouse", sql);
     if (undeclarable) {
       (options.undeclarable ?? problems).push(undeclarable);

package/src/files/common.ts

@@ -3,7 +3,7 @@
 import type { Token } from "../core/tokens";
 import type { UnknownClause } from "../core/cursor";
 import type { SqlDialect } from "../dialects";
-import { statementKind } from "../coverage";
+import { statementKind, type KindRow } from "../coverage";
 
 export interface ReadOptions {
   /** Names the DDL in errors: a file's path, a command. */
@@ -19,6 +19,19 @@ export interface ReadOptions {
    * --parser-option skipUndeclarable` lists them as warnings.
    */
   undeclarable?: string[];
+  /**
+   * Where a statement of a referenced kind goes (#4395), as the name it
+   * creates: `chant import` lists a named collection's `CREATE` as an
+   * environment prerequisite. Without it, such a statement is a problem, as
+   * in a build's `.sql` file, which never declares one.
+   */
+  prerequisites?: Array<{ kind: string; name: string }>;
+}
+
+/** The coverage row of a `CREATE` of a referenced kind (#4395), or undefined for any other statement. */
+export function referencedStatement(dialect: SqlDialect, sql: string): KindRow | undefined {
+  const row = statementKind(dialect, sql);
+  return row?.status === "referenced" ? row : undefined;
 }
 
 /**

package/src/files/postgres.ts

@@ -138,7 +138,7 @@ export function readPostgres(ddl: string, options: ReadOptions, problems: string
     };
     switch (node.statement) {
       case "comment":
-        if (!["SCHEMA", "EXTENSION", "ROLE", "TRIGGER", "POLICY", "CONSTRAINT", "COLUMN", "CAST", "EVENT TRIGGER"].includes(node.objectType)) mark(node.target);
+        if (!["SCHEMA", "EXTENSION", "ROLE", "TRIGGER", "POLICY", "CONSTRAINT", "COLUMN", "CAST", "EVENT TRIGGER", "FOREIGN DATA WRAPPER", "SERVER", "PUBLICATION"].includes(node.objectType)) mark(node.target);
         if (node.objectType === "COLUMN" && nameOf(tokens, node.target).length === 2 && options.schema) {
           const first = tokens.slice(node.target.span.from, node.target.span.to).find((t) => !isTrivia(t));
           if (first) inserts.add(tokens.indexOf(first));
@@ -177,7 +177,7 @@ export function readPostgres(ddl: string, options: ReadOptions, problems: string
       problems.push(`an index with no name (its declaration needs one): ${firstLine(tokensText(tokens))}`);
       continue;
     }
-    const ownName = !["schema", "extension", "index", "trigger", "policy", "role", "grant", "cast", "eventTrigger"].includes(node.statement);
+    const ownName = !["schema", "extension", "index", "trigger", "policy", "role", "grant", "cast", "eventTrigger", "foreignDataWrapper", "foreignServer", "publication"].includes(node.statement);
     if (ownName && "name" in node) mark(node.name);
     const object: PgFileObject = { node, statements: [rewrite(tokens, inserts, options.schema)], constraints: [], line, unparsed: fileUnparsed("unknown" in node ? node.unknown : undefined, tokens, tokensText(tokens), line) };
     objects.push(object);
@@ -279,6 +279,10 @@ function ownerKey(node: StatementNode, tokens: Token[], nameOf: NameOf, qualify:
       return `${node.statement} ${nameOf(tokens, node.name).at(-1) ?? ""} ON ${qkey(qualify(nameOf(tokens, node.table)))}`;
     case "eventTrigger":
       return `eventTrigger ${nameOf(tokens, node.name).at(-1) ?? ""}`;
+    case "foreignDataWrapper":
+    case "foreignServer":
+    case "publication":
+      return `${node.statement} ${nameOf(tokens, node.name).at(-1) ?? ""}`;
     case "cast":
       return `cast ${castKey(tokens, node.source, node.target)}`;
     case "grant":
@@ -311,6 +315,12 @@ function followOnOwner(node: StatementNode, tokens: Token[], nameOf: NameOf, qua
       return node.on ? `${node.objectType.toLowerCase()} ${target.at(-1) ?? ""} ON ${qkey(qualify(nameOf(tokens, node.on)))}` : undefined;
     case "EVENT TRIGGER":
       return `eventTrigger ${target.at(-1) ?? ""}`;
+    case "FOREIGN DATA WRAPPER":
+      return `foreignDataWrapper ${target.at(-1) ?? ""}`;
+    case "SERVER":
+      return `foreignServer ${target.at(-1) ?? ""}`;
+    case "PUBLICATION":
+      return `publication ${target.at(-1) ?? ""}`;
     case "CAST":
       return node.cast ? `cast ${castKey(tokens, node.cast.source, node.cast.target)}` : undefined;
     case "CONSTRAINT":

package/src/generated/clickhouse.ts

@@ -2177,6 +2177,9 @@ export const AGGREGATE_COMBINATORS: readonly string[] = ["ArgMax","ArgMin","Arra
 /** The table functions (`system.table_functions`): `numbers`, `remote`, `s3`. */
 export const TABLE_FUNCTIONS: readonly string[] = ["SQLStandardValues","arrowFlight","arrowflight","azureBlobStorage","azureBlobStorageCluster","bigquery","cluster","clusterAllReplicas","cosn","deltaLake","deltaLakeAzure","deltaLakeAzureCluster","deltaLakeCluster","deltaLakeLocal","deltaLakeS3","deltaLakeS3Cluster","dictionary","eval","executable","file","fileCluster","filesystem","format","fuzzJSON","fuzzQuery","gcs","generateRandom","generateSeries","generate_series","hdfs","hdfsCluster","hive","hudi","hudiCluster","iceberg","icebergAzure","icebergAzureCluster","icebergCluster","icebergHDFS","icebergHDFSCluster","icebergLocal","icebergLocalCluster","icebergS3","icebergS3Cluster","input","jdbc","loop","merge","mergeTreeAnalyzeIndexes","mergeTreeAnalyzeIndexesUUID","mergeTreeCodecBlockCounts","mergeTreeIndex","mergeTreeProjection","mergeTreeTextIndex","mongodb","mysql","null","numbers","numbers_mt","odbc","oss","paimon","paimonAzure","paimonAzureCluster","paimonCluster","paimonHDFS","paimonHDFSCluster","paimonLocal","paimonS3","paimonS3Cluster","postgresql","primes","prometheusQuery","prometheusQueryRange","redis","remote","remoteSecure","s3","s3Cluster","sqlite","timeSeriesData","timeSeriesMetrics","timeSeriesSamples","timeSeriesSelector","timeSeriesTags","url","urlCluster","values","view","viewExplain","viewIfPermitted","ytsaurus","zeros","zeros_mt"];
 
+/** The input and output formats (`system.formats`): `Parquet`, `JSONEachRow`. */
+export const FORMATS: readonly string[] = ["Arrow","ArrowStream","Avro","AvroConfluent","BSONEachRow","Buffers","CSV","CSVWithNames","CSVWithNamesAndTypes","CapnProto","CustomSeparated","CustomSeparatedIgnoreSpaces","CustomSeparatedIgnoreSpacesWithNames","CustomSeparatedIgnoreSpacesWithNamesAndTypes","CustomSeparatedWithNames","CustomSeparatedWithNamesAndTypes","DWARF","Form","GeoJSON","Hash","HiveText","JSON","JSONAsObject","JSONAsString","JSONColumns","JSONColumnsWithMetadata","JSONCompact","JSONCompactColumns","JSONCompactEachRow","JSONCompactEachRowWithNames","JSONCompactEachRowWithNamesAndTypes","JSONCompactEachRowWithProgress","JSONCompactStrings","JSONCompactStringsEachRow","JSONCompactStringsEachRowWithNames","JSONCompactStringsEachRowWithNamesAndTypes","JSONCompactStringsEachRowWithProgress","JSONEachRow","JSONEachRowWithProgress","JSONL","JSONLines","JSONObjectEachRow","JSONStrings","JSONStringsEachRow","JSONStringsEachRowWithProgress","LineAsString","LineAsStringWithNames","LineAsStringWithNamesAndTypes","MD","Markdown","MsgPack","MySQLDump","MySQLWire","NDJSON","Native","Npy","Null","ODBCDriver2","ORC","One","PNG","Parquet","ParquetMetadata","PostgreSQLWire","Pretty","PrettyCompact","PrettyCompactMonoBlock","PrettyCompactNoEscapes","PrettyCompactNoEscapesMonoBlock","PrettyJSONEachRow","PrettyJSONLines","PrettyMonoBlock","PrettyNDJSON","PrettyNoEscapes","PrettyNoEscapesMonoBlock","PrettySpace","PrettySpaceMonoBlock","PrettySpaceNoEscapes","PrettySpaceNoEscapesMonoBlock","Prometheus","Protobuf","ProtobufList","ProtobufSingle","Puffin","PuffinMetadata","Raw","RawBLOB","RawWithNames","RawWithNamesAndTypes","Regexp","RowBinary","RowBinaryWithDefaults","RowBinaryWithNames","RowBinaryWithNamesAndTypes","RowBinaryWithNamesAndTypesAndDefaults","SQLInsert","TSKV","TSV","TSVRaw","TSVRawWithNames","TSVRawWithNamesAndTypes","TSVWithNames","TSVWithNamesAndTypes","TabSeparated","TabSeparatedRaw","TabSeparatedRawWithNames","TabSeparatedRawWithNamesAndTypes","TabSeparatedWithNames","TabSeparatedWithNamesAndTypes","Template","TemplateIgnoreSpaces","Values","Vertical","XML"];
+
 export const SKIP_INDEX_TYPES: Readonly<Record<SkipIndexType, SkipIndexSpec>> = {
   bloom_filter: {"syntax":"INDEX name expr TYPE bloom_filter([false_positive_rate]) GRANULARITY g","args":[{"name":"false_positive_rate","position":0,"optional":true,"repeated":false,"named":false,"kind":"number","range":[0,1],"note":"Exclusive of 0 and 1; 0.025 when omitted."}],"summary":"A Bloom filter over the values of the index expression, for speeding up equality and IN conditions on columns, including Array and Map elements."},
   hypothesis: {"syntax":"INDEX name expr TYPE hypothesis GRANULARITY g","args":[],"summary":"Deprecated and no longer supported. It is retained only so that tables which still reference it can be attached."},

package/src/generated/lexicon-sql.json

@@ -129,6 +129,31 @@
     "kind": "resource",
     "lexicon": "sql"
   },
+  "PostgresOperator": {
+    "resourceType": "Postgres::Operator",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresStatistics": {
+    "resourceType": "Postgres::Statistics",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresForeignDataWrapper": {
+    "resourceType": "Postgres::ForeignDataWrapper",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresForeignServer": {
+    "resourceType": "Postgres::ForeignServer",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
+  "PostgresPublication": {
+    "resourceType": "Postgres::Publication",
+    "kind": "resource",
+    "lexicon": "sql"
+  },
   "PostgresExtension": {
     "resourceType": "Postgres::Extension",
     "kind": "resource",

package/src/import-parser.sqlserver.test.ts

@@ -0,0 +1,92 @@
+import { describe, expect, test } from "vitest";
+import { resolveParserOptions } from "@intentius/chant/import/parser-options";
+import { guessDialect, looksLikeTSql, sourceOption } from "./import-parser";
+import { sqlPlugin } from "./plugin";
+
+const TSQL = `SET ANSI_NULLS ON
+GO
+CREATE TABLE [dbo].[Orders] (
+    [OrderID] INT IDENTITY (1, 1) NOT NULL,
+    [Note] NVARCHAR (200) NULL,
+    CONSTRAINT [PK_Orders] PRIMARY KEY CLUSTERED ([OrderID] ASC)
+);
+GO`;
+
+const parse = (text: string, entries: string[] = []) => {
+  const resolved = resolveParserOptions(sqlPlugin, entries);
+  if ("error" in resolved) throw new Error(resolved.error);
+  return sqlPlugin.templateParser!(resolved.options).parse(text);
+};
+const types = (ir: { resources: Array<{ type: string }> }) => [...new Set(ir.resources.map((r) => r.type))];
+
+describe("a T-SQL file is not read as Postgres", () => {
+  test("the dialect guess alone would have said Postgres, which is why the markers exist", () => {
+    expect(guessDialect(TSQL)).toBe("postgres");
+    expect(looksLikeTSql(TSQL)).toBe(true);
+  });
+
+  test("with no option, a T-SQL file is read as SQL Server and gives ClickHouse objects and diagnostics", () => {
+    const ir = parse(TSQL);
+    expect(types(ir)).toEqual(["ClickHouse::Table"]);
+    expect(ir.diagnostics?.length).toBeGreaterThan(0);
+    expect(ir.metadata).toMatchObject({ source: "sqlserver" });
+  });
+
+  test.each([
+    ["a GO line", "CREATE TABLE a (x int)\nGO\n"],
+    ["CLUSTERED", "CREATE CLUSTERED INDEX ix ON a (x)"],
+    ["COLUMNSTORE", "CREATE CLUSTERED COLUMNSTORE INDEX cci ON a"],
+    ["a bracketed name", "CREATE TABLE [a] (x int)"],
+    ["nvarchar", "CREATE TABLE a (x nvarchar(5))"],
+    ["IDENTITY(1,1)", "CREATE TABLE a (x int IDENTITY(1,1))"],
+    ["an SSMS preamble", "SET QUOTED_IDENTIFIER ON\nCREATE TABLE a (x int)"],
+    ["sp_addextendedproperty", "EXEC sp_addextendedproperty @name = N'a'"],
+  ])("%s marks a file as T-SQL", (_, text) => {
+    expect(looksLikeTSql(text)).toBe(true);
+  });
+
+  test.each([
+    ["Postgres with arrays and a quoted name", 'CREATE TABLE "a" (x int[], y text[3], z int GENERATED ALWAYS AS IDENTITY, PRIMARY KEY (x))'],
+    ["Postgres with a subscript", "CREATE FUNCTION f(a int[]) RETURNS int AS $$ SELECT a[1] $$ LANGUAGE sql"],
+    ["ClickHouse", "CREATE TABLE a (x UInt8) ENGINE = MergeTree ORDER BY x"],
+    ["ClickHouse naming a clustered column", "CREATE TABLE clustered (x UInt8) ENGINE = Memory"],
+    ["a plain index", "CREATE INDEX ix ON a (x)"],
+  ])("%s is not", (_, text) => {
+    expect(looksLikeTSql(text)).toBe(false);
+  });
+
+  test("Postgres and ClickHouse files import as before", () => {
+    expect(types(parse("CREATE TABLE a (x int PRIMARY KEY, y text)"))).toEqual(["Postgres::Table"]);
+    expect(types(parse("CREATE TABLE a (x UInt8) ENGINE = MergeTree ORDER BY x"))).toEqual(["ClickHouse::Table"]);
+    expect(parse("CREATE TABLE a (x int PRIMARY KEY)").diagnostics).toBeUndefined();
+  });
+
+  test("a dialect named by the author is kept: dialect=postgres on T-SQL fails as Postgres, it is not rerouted", () => {
+    expect(() => parse(TSQL, ["dialect=postgres"])).toThrow(/Postgres DDL/);
+  });
+});
+
+describe("--parser-option from=sqlserver", () => {
+  test("is declared with the other options", () => {
+    expect(sqlPlugin.parserOptions!().map((o) => o.name)).toEqual(["dialect", "from", "skipUndeclarable"]);
+    expect(resolveParserOptions(sqlPlugin, ["from=sqlserver"])).toEqual({ options: { from: "sqlserver" } });
+  });
+
+  test("forces the T-SQL source on a file without markers", () => {
+    const ir = parse("CREATE TABLE a (x int NOT NULL)", ["from=sqlserver"]);
+    expect(types(ir)).toEqual(["ClickHouse::Table"]);
+    expect(ir.diagnostics!.map((d) => d.ruleId)).toEqual(["SQLRV001", "SQLRV002"]);
+  });
+
+  test("a source other than sqlserver is refused, naming what is accepted", () => {
+    expect(() => sourceOption({ from: "mysql" })).toThrow("expected sqlserver, got mysql");
+  });
+
+  test("cannot be combined with dialect", () => {
+    expect(() => sourceOption({ from: "sqlserver", dialect: "clickhouse" })).toThrow(/cannot be combined with dialect/);
+  });
+
+  test("a lexing error is reported as an import error naming the position", () => {
+    expect(() => parse("CREATE TABLE [a (x int)", ["from=sqlserver"])).toThrow(/unterminated \[identifier\] \(line 1, column 14\)/);
+  });
+});

package/src/import-parser.ts

@@ -1,6 +1,16 @@
 /**
  * `chant import schema.sql`: a file of DDL into the import IR, in either
- * dialect. `--parser-option dialect=postgres` (or `clickhouse`) names it;
+ * dialect, or a SQL Server (T-SQL) schema into ClickHouse declarations.
+ *
+ * `--parser-option from=sqlserver` (#4398) reads the file as T-SQL and
+ * translates it to ClickHouse (`./sqlserver/translate.ts`). SQL Server is an
+ * import source, not a dialect: nothing is declared in it, and a build never
+ * holds one. A file with T-SQL's own markers (`[bracketed]` names, a `GO`
+ * line, `CLUSTERED` or `COLUMNSTORE`, `nvarchar`, `IDENTITY(1,1)`) is read
+ * the same way without the option, so it is not taken for Postgres.
+ * `from=sqlserver` with `dialect=...` is refused: the target is ClickHouse.
+ *
+ * `--parser-option dialect=postgres` (or `clickhouse`) names the dialect;
  * without one it is read off the statements: an `ENGINE =` clause, a
  * `CREATE DATABASE`, a `CREATE DICTIONARY` or a lambda `CREATE FUNCTION f AS
  * (x) -> ...` is ClickHouse, a statement
@@ -22,6 +32,9 @@ import { readPostgres } from "./files/postgres";
 import { SqlFileError } from "./files/common";
 import { objectsToIR as chObjectsToIR } from "./clickhouse/import/ir";
 import { objectsToIR as pgObjectsToIR } from "./postgres/import/ir";
+import { namedCollectionPrerequisites } from "./clickhouse/named-collections";
+import { translateSqlServer } from "./sqlserver/translate";
+import { TsqlLexError } from "./sqlserver/lexer";
 
 const CLICKHOUSE_ONLY = [
   /\bENGINE\s*=/i,
@@ -37,6 +50,31 @@ const POSTGRES_ONLY = [
   /^\s*CREATE\s+TABLE\b/im,
 ];
 
+/**
+ * Markers only T-SQL has. Each is rare enough in Postgres and ClickHouse DDL
+ * that one is enough: a bracketed name after CREATE TABLE or ON, a `GO`
+ * batch line, `CLUSTERED`/`COLUMNSTORE`, T-SQL type names, `IDENTITY(n, n)`,
+ * the `SET ANSI_NULLS` preamble of an SSMS script.
+ */
+const TSQL_MARKERS = [
+  /^\s*GO\s*$/im,
+  /\bCREATE\s+(?:UNIQUE\s+)?(?:NONCLUSTERED\s+|CLUSTERED\s+)(?:COLUMNSTORE\s+)?INDEX\b/i,
+  /\bCREATE\s+(?:NONCLUSTERED\s+|CLUSTERED\s+)?COLUMNSTORE\s+INDEX\b/i,
+  /\bPRIMARY\s+KEY\s+(?:NON)?CLUSTERED\b/i,
+  /\b(?:CREATE\s+TABLE|ALTER\s+TABLE|\bON|REFERENCES)\s+\[[^\]\n]+\]/i,
+  /\b(?:NVARCHAR|NCHAR|UNIQUEIDENTIFIER|DATETIME2|DATETIMEOFFSET|SMALLDATETIME|SMALLMONEY|ROWVERSION)\b/i,
+  /\bIDENTITY\s*\(\s*\d+\s*,\s*\d+\s*\)/i,
+  /^\s*SET\s+(?:ANSI_NULLS|QUOTED_IDENTIFIER|NOCOUNT|ANSI_PADDING)\b/im,
+  /\bEXEC(?:UTE)?\s+sp_addextendedproperty\b/i,
+];
+
+/** True when the DDL has a marker only T-SQL has and no ClickHouse-only clause. */
+export function looksLikeTSql(content: string): boolean {
+  const text = content.replace(/--[^\n]*/g, "");
+  if (CLICKHOUSE_ONLY.some((re) => re.test(text))) return false;
+  return TSQL_MARKERS.some((re) => re.test(text));
+}
+
 /** The dialect a file of DDL is written in, read off its statements. */
 export function guessDialect(content: string): SqlDialect {
   const text = content.replace(/--[^\n]*/g, "");
@@ -53,20 +91,56 @@ export function dialectOption(options: ParserOptions | undefined): SqlDialect |
   return d as SqlDialect;
 }
 
+/** Sources other than a dialect that `--parser-option from=` names. */
+export const IMPORT_SOURCES = ["sqlserver"] as const;
+export type ImportSource = (typeof IMPORT_SOURCES)[number];
+
+/** The `from` parser option, checked. */
+export function sourceOption(options: ParserOptions | undefined): ImportSource | undefined {
+  const f = options?.from;
+  if (f === undefined) return undefined;
+  if (typeof f !== "string" || !(IMPORT_SOURCES as readonly string[]).includes(f)) throw new Error(`--parser-option from: expected ${IMPORT_SOURCES.join(" or ")}, got ${String(f)}`);
+  if (options?.dialect !== undefined) throw new Error(`--parser-option from=${f} cannot be combined with dialect: a ${f} schema is translated to ClickHouse`);
+  return f as ImportSource;
+}
+
 export class SqlFileParser implements TemplateParser {
   constructor(
     private readonly dialect?: SqlDialect,
-    private readonly options: { skipUndeclarable?: boolean } = {},
+    private readonly options: { skipUndeclarable?: boolean; from?: ImportSource } = {},
   ) {}
 
   parse(content: string): TemplateIR {
+    if (this.options.from === "sqlserver" || (this.dialect === undefined && looksLikeTSql(content))) return this.parseSqlServer(content);
     const dialect = this.dialect ?? guessDialect(content);
     const problems: string[] = [];
     const skipped: string[] = [];
-    const read = { origin: "the DDL", ...(this.options.skipUndeclarable ? { undeclarable: skipped } : {}) };
+    const prerequisites: Array<{ kind: string; name: string }> = [];
+    const read = { origin: "the DDL", prerequisites, ...(this.options.skipUndeclarable ? { undeclarable: skipped } : {}) };
     const ir = dialect === "postgres" ? pgObjectsToIR(readPostgres(content, read, problems)) : chObjectsToIR(readClickHouse(content, read, problems));
     if (problems.length > 0) throw new SqlFileError(`the ${dialect === "postgres" ? "Postgres" : "ClickHouse"} DDL`, problems);
-    if (skipped.length === 0) return ir;
-    return { ...ir, warnings: [...(ir.warnings ?? []), ...skipped.map((s) => `left out (skipUndeclarable): ${s}`)] };
+    // A named collection is the environment's (#4395): its CREATE, or a declaration naming one, is a prerequisite, its values never imported.
+    const objects = ir.resources.map((r) => r.properties as { database?: string; name: string; ddl: string });
+    const prereq =
+      dialect === "clickhouse"
+        ? namedCollectionPrerequisites(prerequisites, objects, { found: "the DDL creates it", unseen: "the DDL does not create it" })
+        : { prerequisites: [], warnings: [] };
+    const warnings = [...(ir.warnings ?? []), ...prereq.warnings, ...skipped.map((s) => `left out (skipUndeclarable): ${s}`)];
+    const out = prereq.prerequisites.length > 0 ? { ...ir, metadata: { ...ir.metadata, prerequisites: prereq.prerequisites } } : ir;
+    return warnings.length > 0 ? { ...out, warnings } : out;
+  }
+
+  /** A T-SQL schema as ClickHouse objects, with a finding for each judgment call (#4398). */
+  private parseSqlServer(content: string): TemplateIR {
+    let t;
+    try {
+      t = translateSqlServer(content, { skipUnreadable: this.options.skipUndeclarable === true });
+    } catch (e) {
+      if (e instanceof TsqlLexError) throw new SqlFileError("the SQL Server DDL", [e.message]);
+      throw e;
+    }
+    if (t.problems.length > 0) throw new SqlFileError("the SQL Server DDL", t.problems);
+    const ir = chObjectsToIR(t.objects);
+    return { ...ir, diagnostics: t.diagnostics, metadata: { ...ir.metadata, source: "sqlserver" } };
   }
 }

package/src/index.ts

@@ -18,7 +18,7 @@ export { database, table, view, dictionary, user, role, policy, quota, settingsP
 // A tag folds as the function its file imports, so `table` imported from
 // `@intentius/chant-lexicon-sql/postgres` is Postgres's. Declarations import
 // them from the dialect subpath.
-export { schema, index, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, collation, cast } from "./postgres/entities";
+export { schema, index, sequence, type, domain, extension, func, procedure, aggregate, trigger, eventTrigger, operator, statistics, foreignDataWrapper, foreignServer, publication, collation, cast } from "./postgres/entities";
 
 // A schema change's statements between two builds, rendered offline for a
 // migration file (#3644); also at `@intentius/chant-lexicon-sql/migration-statements`.

package/src/lint/post-synth/audit-entries.ts

@@ -33,4 +33,5 @@ export const sqlPostSynthAuditEntries: Record<string, RuleMeta> = {
   SQLCH125: auditRule("SQLCH125", "merge-worthy", "guidance", "A codec parameter is outside what the codec takes", "Give the codec a parameter within its range or set, or drop the parameter for the default.", { category: "correctness" }),
   SQLCH126: auditRule("SQLCH126", "merge-worthy", "guidance", "A GRANT column list names a column the table does not declare", "Fix the column name, or declare the column on the table.", { category: "correctness" }),
   SQLCH127: auditRule("SQLCH127", "merge-worthy", "guidance", "An expression calls a function the pinned server does not have", "Fix the function name, use one from the pinned server's system.functions, or declare it with func.", { category: "correctness" }),
+  SQLCH128: auditRule("SQLCH128", "merge-worthy", "guidance", "An integration engine or table function argument holds a literal credential", "Create a named collection with the credentials on the server and name it in place of the arguments: ENGINE = S3(lake_creds, format = 'Parquet').", { category: "security" }),
 };

package/src/lint/post-synth/index.ts

@@ -29,6 +29,7 @@ import { sqlch124 } from "./sqlch124";
 import { sqlch125 } from "./sqlch125";
 import { sqlch126 } from "./sqlch126";
 import { sqlch127 } from "./sqlch127";
+import { sqlch128 } from "./sqlch128";
 import { sqlpg101 } from "./sqlpg101";
 import { sqlpg102 } from "./sqlpg102";
 import { sqlpg103 } from "./sqlpg103";
@@ -86,6 +87,7 @@ export const postSynthChecks: PostSynthCheck[] = [
   sqlch125,
   sqlch126,
   sqlch127,
+  sqlch128,
   sqlpg101,
   sqlpg102,
   sqlpg103,

package/src/lint/post-synth/sqlch128.test.ts

@@ -0,0 +1,107 @@
+/**
+ * SQLCH128 (#4395): a literal credential in an integration engine's or table
+ * function's arguments. Each flagged case builds today and writes its secret
+ * into the build output and `clickhouse.sql`; each clean case keeps it out.
+ */
+import { describe, expect, test } from "vitest";
+import { makePostSynthCtx } from "@intentius/chant-test-utils";
+import type { SerializerResult } from "@intentius/chant/serializer";
+import { sqlSerializer } from "../../serializer";
+import { database, dictionary, table, view } from "../../clickhouse/entities";
+import { sqlAuditCatalog } from "../audit-catalog";
+import { postSynthChecks } from "./index";
+
+function run(entities: Record<string, unknown>) {
+  const check = postSynthChecks.find((c) => c.id === "SQLCH128")!;
+  const out = sqlSerializer.serialize(new Map(Object.entries(entities)) as never) as SerializerResult;
+  return check.check(makePostSynthCtx("sql", out.primary));
+}
+
+/** The findings' messages, in the build's apply order (by export name here). */
+const messages = (entities: Record<string, unknown>) => {
+  const diags = run(entities);
+  for (const d of diags) expect(d).toMatchObject({ checkId: "SQLCH128", lexicon: "sql", severity: "error" });
+  return diags.map((d) => d.message);
+};
+
+test("SQLCH128 is registered with an audit entry", () => {
+  expect(postSynthChecks.map((c) => c.id)).toContain("SQLCH128");
+  expect(sqlAuditCatalog.SQLCH128).toBeDefined();
+});
+
+describe("an inline secret fails", () => {
+  test("S3: the secret access key", () => {
+    const t = table`CREATE TABLE lake (a Int32) ENGINE = S3('https://bucket.s3.amazonaws.com/x.parquet', 'AKIAEXAMPLE', 'wJalrXUtnFEMI', 'Parquet')`;
+    expect(messages({ t })).toEqual([
+      expect.stringMatching(
+        /^t \(lake\): ENGINE = S3 argument secret_access_key holds a literal credential, which is the environment's\. Create a named collection .*ENGINE = S3\(lake_creds, format = 'Parquet'\)/,
+      ),
+    ]);
+  });
+
+  test("Kafka: kafka_sasl_password, a setting", () => {
+    const t = table`CREATE TABLE k (a String) ENGINE = Kafka() SETTINGS kafka_broker_list = 'kafka:9092', kafka_topic_list = 'events', kafka_group_name = 'g', kafka_format = 'JSONEachRow', kafka_sasl_username = 'app', kafka_sasl_password = 'hunter2'`;
+    expect(messages({ t })).toEqual([expect.stringMatching(/^t \(k\): Kafka setting kafka_sasl_password holds a literal credential/)]);
+  });
+
+  test("PostgreSQL and MySQL: the password", () => {
+    const pg = table`CREATE TABLE pg (id Int32) ENGINE = PostgreSQL('db:5432', 'shop', 'orders', 'app', 'hunter2')`;
+    const my = table`CREATE TABLE my (id Int32) ENGINE = MySQL('db:3306', 'shop', 'orders', 'app', 'hunter2')`;
+    expect(messages({ pg, my })).toEqual([
+      expect.stringMatching(/^my \(my\): ENGINE = MySQL argument password holds a literal credential/),
+      expect.stringMatching(/^pg \(pg\): ENGINE = PostgreSQL argument password holds a literal credential/),
+    ]);
+  });
+
+  test("a database engine, a key = value override after a collection, a URL with a password", () => {
+    const db = database`CREATE DATABASE mirror ENGINE = MySQL('db:3306', 'shop', 'app', 'hunter2')`;
+    const s3 = table`CREATE TABLE s (a Int32) ENGINE = S3(lake_creds, secret_access_key = 'override', format = 'Parquet')`;
+    const u = table`CREATE TABLE u (a Int32) ENGINE = URL('https://app:hunter2@example.com/data.csv', 'CSV')`;
+    expect(messages({ db, s3, u })).toEqual([
+      expect.stringMatching(/^db \(mirror\): ENGINE = MySQL argument password holds a literal credential/),
+      expect.stringMatching(/^s3 \(s\): ENGINE = S3 argument secret_access_key holds a literal credential/),
+      expect.stringMatching(/^u \(u\): ENGINE = URL argument 1 holds a URL with a password in it/),
+    ]);
+  });
+
+  test("a table function, in a table over it and in a view's SELECT", () => {
+    const over = table`CREATE TABLE over AS s3('https://bucket/x.csv', 'AKIAEXAMPLE', 'wJalrXUtnFEMI', 'CSV')`;
+    const v = view`CREATE VIEW v AS SELECT * FROM mysql('db:3306', 'shop', 'orders', 'app', 'hunter2')`;
+    const r = view`CREATE VIEW r AS SELECT * FROM remote('h:9000', 'shop', 'orders', 'app', 'hunter2')`;
+    expect(messages({ over, v, r })).toEqual([
+      expect.stringMatching(/^over \(over\): s3\(\) argument secret_access_key holds a literal credential/),
+      expect.stringMatching(/^r \(r\): remote\(\) argument password holds a literal credential/),
+      expect.stringMatching(/^v \(v\): mysql\(\) argument password holds a literal credential/),
+    ]);
+  });
+
+  test("a dictionary source's PASSWORD", () => {
+    const d = dictionary`CREATE DICTIONARY d (id UInt64, name String) PRIMARY KEY id SOURCE(MYSQL(HOST 'db' PORT 3306 USER 'app' PASSWORD 'hunter2' DB 'shop' TABLE 'names')) LAYOUT(HASHED()) LIFETIME(300)`;
+    expect(messages({ d })).toEqual([expect.stringMatching(/^d \(d\): SOURCE PASSWORD holds a literal credential/)]);
+  });
+
+  test("the server's '[HIDDEN]' mask, as an import of SHOW CREATE writes it, is named as such", () => {
+    const t = table`CREATE TABLE lake (a Int32) ENGINE = S3('https://bucket/x.parquet', 'AKIAEXAMPLE', '[HIDDEN]')`;
+    expect(messages({ t })).toEqual([expect.stringMatching(/secret_access_key holds '\[HIDDEN\]', the server's mask for a credential, in place of one/)]);
+  });
+});
+
+describe("no secret, no finding", () => {
+  test("a named collection in place of the arguments", () => {
+    const s3 = table`CREATE TABLE lake (a Int32) ENGINE = S3(lake_creds, url = 'https://bucket/x.parquet', format = 'Parquet')`;
+    const k = table`CREATE TABLE k (a String) ENGINE = Kafka(kafka_creds, kafka_format = 'JSONEachRow')`;
+    const pg = table`CREATE TABLE pg (id Int32) ENGINE = PostgreSQL(pg_creds, table = 'orders')`;
+    const v = view`CREATE VIEW v AS SELECT * FROM mysql(mysql_creds, table = 'orders')`;
+    const d = dictionary`CREATE DICTIONARY d (id UInt64, name String) PRIMARY KEY id SOURCE(MYSQL(NAME mysql_creds)) LAYOUT(HASHED()) LIFETIME(300)`;
+    expect(messages({ s3, k, pg, v, d })).toEqual([]);
+  });
+
+  test("an S3 table with a format and a compression where the keys would be, NOSIGN, or an empty password", () => {
+    const fmt = table`CREATE TABLE f (a Int32) ENGINE = S3('https://bucket/x.csv.gz', 'CSV', 'gzip')`;
+    const nosign = table`CREATE TABLE n (a Int32) ENGINE = S3('https://bucket/x.csv', NOSIGN, 'CSV')`;
+    const az = table`CREATE TABLE az (a Int32) ENGINE = AzureBlobStorage('https://acct.blob.core.windows.net', 'c', 'p.csv', 'CSV', 'gzip')`;
+    const d = dictionary`CREATE DICTIONARY d (id UInt64, name String) PRIMARY KEY id SOURCE(CLICKHOUSE(TABLE 'names' USER 'default' PASSWORD '')) LAYOUT(HASHED()) LIFETIME(300)`;
+    const mt = table`CREATE TABLE m (password String) ENGINE = MergeTree ORDER BY tuple()`;
+    expect(messages({ fmt, nosign, az, d, mt })).toEqual([]);
+  });
+});