@intentius/chant-lexicon-sql 0.124.46 → 0.124.49

package/dist/rules/sqlch128.ts

@@ -0,0 +1,230 @@
+import { DATABASE_ENGINES, FORMATS, TABLE_ENGINES } from "../../generated/clickhouse";
+import { parseEngineSyntax } from "../../clickhouse/engine-syntax";
+import { COLLECTION_ENGINES, engineCollection } from "../../clickhouse/named-collections";
+import { isTrivia, tokenizeText, type Token } from "../../clickhouse/tokens";
+import { checkOf, splitTop } from "./clickhouse-helpers";
+import { clickhouseObjects, type OutputObject } from "./sql-helpers";
+
+/** A syntax-line argument that holds a secret: `password`, `secret_access_key`, `account_key`, `session_token`, `oauth_token`. */
+const SECRET_ARGUMENT = /password|secret|account_key|session_token|oauth_token/i;
+
+/** A `key = value` argument or a setting that holds a secret: the above, and `kafka_sasl_password`, `nats_token`. */
+const SECRET_KEY = /password|secret|account_key|session_token|oauth_token|(?:^|_)token$|private_key/i;
+
+/** Credentials written inside another value: a URL's `user:password@`, an Azure connection string's key or signature. */
+const EMBEDDED = [
+  { re: /^[a-z][a-z0-9+.-]*:\/\/[^/@:\s]+:[^/@\s]+@/i, what: "a URL with a password in it" },
+  { re: /(?:^|;)\s*(?:AccountKey|SharedAccessSignature)\s*=/i, what: "a connection string with an account key or signature in it" },
+];
+
+/** Compression methods the integration engines take after the format. */
+const COMPRESSION = new Set(["none", "auto", "gzip", "gz", "deflate", "br", "brotli", "xz", "lzma", "zstd", "zst", "lz4", "bz2", "snappy"]);
+const FORMAT_NAMES = new Set(FORMATS.map((f) => f.toLowerCase()));
+
+/** The table functions whose arguments follow an engine's syntax line, lower case, by engine. */
+const FUNCTION_ENGINE: Readonly<Record<string, string>> = {
+  s3: "S3",
+  gcs: "S3",
+  oss: "S3",
+  cosn: "S3",
+  url: "URL",
+  mysql: "MySQL",
+  postgresql: "PostgreSQL",
+  mongodb: "MongoDB",
+  azureblobstorage: "AzureBlobStorage",
+  iceberg: "Iceberg",
+  icebergs3: "IcebergS3",
+  icebergazure: "IcebergAzure",
+  deltalake: "DeltaLake",
+  deltalakes3: "DeltaLakeS3",
+  deltalakeazure: "DeltaLakeAzure",
+  hudi: "Hudi",
+  paimon: "Paimon",
+  paimons3: "PaimonS3",
+  arrowflight: "ArrowFlight",
+  ytsaurus: "YTsaurus",
+};
+
+/** `remote('addresses', db, table, 'user', 'password')`: no syntax line says it, so its password's position is written here. */
+const FUNCTION_SECRETS: Readonly<Record<string, Array<{ name: string; position: number }>>> = {
+  remote: [{ name: "password", position: 4 }],
+  remotesecure: [{ name: "password", position: 4 }],
+};
+
+const ENGINE_SYNTAX = { ...TABLE_ENGINES, ...DATABASE_ENGINES } as Readonly<Record<string, { syntax: string } | undefined>>;
+
+/** The secret arguments an engine's syntax line names, with their positions. */
+function secretPositions(engine: string): Array<{ name: string; position: number }> {
+  const syntax = ENGINE_SYNTAX[engine]?.syntax;
+  const parsed = syntax ? parseEngineSyntax(syntax) : undefined;
+  if (!parsed) return [];
+  return parsed.args
+    .filter((a) => !a.named && a.name.split("|").some((n) => SECRET_ARGUMENT.test(n)))
+    .map((a) => ({ name: a.name.split("|").find((n) => SECRET_ARGUMENT.test(n))!, position: a.position }));
+}
+
+/** The text of a string literal, or undefined for anything else. */
+function stringValue(text: string): string | undefined {
+  const t = text.trim();
+  if (!/^'(?:[^'\\]|\\.|'')*'$/.test(t)) return undefined;
+  return t.slice(1, -1).replace(/\\(.)/g, "$1").replace(/''/g, "'");
+}
+
+/**
+ * Whether the arguments before `position` leave it where the syntax line puts
+ * it. An optional group (`[, access_key_id, secret_access_key]`) may be left
+ * out, and the format and compression move up into its place:
+ * `S3('url', 'Parquet', 'gzip')`. When a format, a compression method or
+ * `NOSIGN` comes earlier, the position says nothing.
+ */
+function aligned(args: readonly string[], position: number): boolean {
+  for (const a of args.slice(1, position)) {
+    const t = a.trim();
+    if (t.toUpperCase() === "NOSIGN") return false;
+    const v = stringValue(t)?.toLowerCase();
+    if (v !== undefined && (FORMAT_NAMES.has(v) || COMPRESSION.has(v))) return false;
+  }
+  return true;
+}
+
+interface Finding {
+  where: string;
+  what: string;
+  masked: boolean;
+}
+
+/** The literal credentials in one engine's or table function's arguments. */
+function argumentFindings(label: string, args: readonly string[], secrets: ReadonlyArray<{ name: string; position: number }>, collection: boolean): Finding[] {
+  const out: Finding[] = [];
+  const add = (where: string, what: string, value: string) => out.push({ where, what, masked: value === "[HIDDEN]" });
+  // After a named collection, the arguments are `key = value` overrides, not positions.
+  if (!collection) {
+    for (const s of secrets) {
+      const arg = args[s.position];
+      const value = arg !== undefined ? stringValue(arg) : undefined;
+      if (value && aligned(args, s.position)) add(`${label} argument ${s.name}`, "a literal credential", value);
+    }
+  }
+  args.forEach((arg, i) => {
+    const kv = /^\s*([A-Za-z_][A-Za-z0-9_]*)\s*=\s*([\s\S]+)$/.exec(arg);
+    if (kv) {
+      const value = stringValue(kv[2]!);
+      if (value && SECRET_KEY.test(kv[1]!)) add(`${label} argument ${kv[1]}`, "a literal credential", value);
+      return;
+    }
+    const value = stringValue(arg);
+    if (!value) return;
+    for (const e of EMBEDDED) if (e.re.test(value)) add(`${label} argument ${i + 1}`, e.what, value);
+  });
+  return out;
+}
+
+/** Each table function call in a SQL text, with its arguments as written. */
+function functionCalls(text: string): Array<{ name: string; args: string[] }> {
+  let tokens: Token[];
+  try {
+    tokens = tokenizeText(text, 0);
+  } catch {
+    return [];
+  }
+  const sig = tokens.map((t, i) => ({ t, i })).filter(({ t }) => !isTrivia(t));
+  const out: Array<{ name: string; args: string[] }> = [];
+  for (let k = 0; k + 1 < sig.length; k++) {
+    const fn = sig[k]!.t;
+    const open = sig[k + 1]!;
+    if (fn.kind !== "ident" || open.t.kind !== "punct" || open.t.text !== "(") continue;
+    const lower = fn.text.toLowerCase();
+    const base = lower.endsWith("cluster") ? lower.slice(0, -"cluster".length) : lower;
+    if (!(base in FUNCTION_ENGINE) && !(base in FUNCTION_SECRETS)) continue;
+    let depth = 0;
+    let end = open.i;
+    for (let j = open.i; j < tokens.length; j++) {
+      const t = tokens[j]!;
+      if (t.kind === "punct" && t.text === "(") depth++;
+      else if (t.kind === "punct" && t.text === ")" && --depth === 0) {
+        end = j;
+        break;
+      }
+    }
+    const inner = tokens
+      .slice(open.i + 1, end)
+      .map((t) => t.text)
+      .join("");
+    out.push({ name: fn.text, args: inner.trim() === "" ? [] : splitTop(inner) });
+  }
+  return out;
+}
+
+/** The literal credentials in each table function call a SQL text makes. */
+function callFindings(text: string): Finding[] {
+  return functionCalls(text).flatMap((call) => {
+    const lower = call.name.toLowerCase();
+    const clustered = lower.endsWith("cluster") && !(lower in FUNCTION_ENGINE);
+    const base = clustered ? lower.slice(0, -"cluster".length) : lower;
+    // `s3Cluster(cluster, url, ...)`: the cluster comes first.
+    const args = clustered ? call.args.slice(1) : call.args;
+    const engine = FUNCTION_ENGINE[base];
+    const secrets = engine ? secretPositions(engine) : (FUNCTION_SECRETS[base] ?? []);
+    const collection = args[0] !== undefined && /^\s*(?:[A-Za-z_][A-Za-z0-9_]*|`[^`]+`)\s*$/.test(args[0]) && args[0].trim().toUpperCase() !== "NOSIGN";
+    return argumentFindings(`${call.name}()`, args, secrets, collection);
+  });
+}
+
+/** The literal credentials in a table's or database's engine and its settings. */
+function engineFindings(o: OutputObject & { settings?: Record<string, string> }): Finding[] {
+  const engine = o.engine;
+  if (!engine) return [];
+  const out = argumentFindings(`ENGINE = ${engine.name}`, engine.args ?? [], secretPositions(engine.name), engineCollection(engine) !== undefined);
+  if (COLLECTION_ENGINES.has(engine.name)) {
+    for (const [key, raw] of Object.entries(o.settings ?? {})) {
+      const value = stringValue(raw);
+      if (value && SECRET_KEY.test(key)) out.push({ where: `${engine.name} setting ${key}`, what: "a literal credential", masked: value === "[HIDDEN]" });
+    }
+  }
+  return out;
+}
+
+/** `PASSWORD 'secret'` in a dictionary's source. */
+function sourceFindings(dataSource: string): Finding[] {
+  const m = /\bPASSWORD\s+('(?:[^'\\]|\\.|'')*')/i.exec(dataSource);
+  const value = m ? stringValue(m[1]!) : undefined;
+  return value ? [{ where: "SOURCE PASSWORD", what: "a literal credential", masked: value === "[HIDDEN]" }] : [];
+}
+
+/**
+ * SQLCH128: an integration engine's or table function's argument holds a
+ * literal credential (#4395): `ENGINE = S3('https://...', 'AKIA...', 'secret')`,
+ * `mysql('db:3306', 'shop', 'orders', 'app', 'secret')`, a Kafka table's
+ * `kafka_sasl_password` setting, a dictionary source's `PASSWORD`.
+ *
+ * A credential is the environment's, so it does not belong in a declaration,
+ * the build output or `clickhouse.sql`, as `IDENTIFIED BY` does not on a
+ * user (`../../clickhouse/access.ts`). The secret arguments are found by name
+ * from each engine's syntax line in the pinned catalog (`password`,
+ * `secret_access_key`, `account_key`, `session_token`, `oauth_token`), as
+ * `key = value` overrides and settings by the same names, and inside a URL
+ * (`user:password@`) or an Azure connection string (`AccountKey=`). The fix
+ * is a named collection the environment creates, named in place of the
+ * arguments: `ENGINE = S3(lake_creds, format = 'Parquet')`.
+ */
+export const sqlch128 = checkOf({ id: "SQLCH128", description: "An integration engine or table function argument holds a literal credential" }, (ctx, report) => {
+  for (const o of clickhouseObjects(ctx)) {
+    const props = o as OutputObject & { settings?: Record<string, string>; asFunction?: string; select?: string; dataSource?: string };
+    const findings = [
+      ...engineFindings(props),
+      ...(props.asFunction ? callFindings(props.asFunction) : []),
+      ...(props.select ? callFindings(props.select) : []),
+      ...(props.dataSource ? sourceFindings(props.dataSource) : []),
+    ];
+    for (const f of findings) {
+      const held = f.masked ? "holds '[HIDDEN]', the server's mask for a credential, in place of one" : `holds ${f.what}, which is the environment's`;
+      report({
+        severity: "error",
+        message:
+          `${o.export} (${o.name}): ${f.where} ${held}. ` +
+          "Create a named collection with the credentials on the server and name it in place of the arguments (ENGINE = S3(lake_creds, format = 'Parquet'), s3(lake_creds), SOURCE(MYSQL(NAME mysql_creds))); chant sql plan checks that it exists",
+        entity: o.export,
+      });
+    }
+  }
+});

package/dist/serializer.d.ts

@@ -21,6 +21,11 @@
  * of each. Two databases of different dialects are two projects (two
  * workspace members, #3047 question 1).
  *
+ * A ClickHouse object that names a named collection (an engine's first
+ * argument, a table function's, a dictionary source's `NAME`) carries
+ * `namedCollections`, and the document lists every one the build names, so
+ * a plan can check each exists on the server (#4395).
+ *
  * A Postgres document also carries `postgresMajor`, the major the project
  * targets (`sql.postgresMajor`, else the newest pinned major). Post-synth
  * checks and the lock classifier read it; ClickHouse output has no such field.

package/dist/serializer.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAgCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAYjF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAkBnF;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAqEhD,eAAO,MAAM,aAAa,EAAE,UAyC3B,CAAC"}
+{"version":3,"file":"serializer.d.ts","sourceRoot":"","sources":["../src/serializer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GAqCG;AAEH,OAAO,KAAK,EAAE,UAAU,EAAE,UAAU,EAAoB,MAAM,kBAAkB,CAAC;AAajF,OAAO,EAAE,UAAU,EAAE,MAAM,mBAAmB,CAAC;AAE/C;;;;;GAKG;AACH,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,GAAG,MAAM,EAAE,CAkBnF;AAED,yEAAyE;AACzE,eAAO,MAAM,mBAAmB,mBAAmB,CAAC;AAEpD,gEAAgE;AAChE,eAAO,MAAM,iBAAiB,iBAAiB,CAAC;AAsEhD,eAAO,MAAM,aAAa,EAAE,UA6C3B,CAAC"}

package/dist/serializer.js

@@ -21,6 +21,11 @@
  * of each. Two databases of different dialects are two projects (two
  * workspace members, #3047 question 1).
  *
+ * A ClickHouse object that names a named collection (an engine's first
+ * argument, a table function's, a dictionary source's `NAME`) carries
+ * `namedCollections`, and the document lists every one the build names, so
+ * a plan can check each exists on the server (#4395).
+ *
  * A Postgres document also carries `postgresMajor`, the major the project
  * targets (`sql.postgresMajor`, else the newest pinned major). Post-synth
  * checks and the lock classifier read it; ClickHouse output has no such field.
@@ -39,6 +44,7 @@ import { applyOrder, lineageJson, referenceName } from "./core/references.js";
 import { sqlFileLineOf, sqlFileOf, sqlFileReferences } from "./sql-files.js";
 import { relative } from "node:path";
 import { getProvenance } from "@intentius/chant/provenance";
+import { namedCollectionReferences } from "./clickhouse/named-collections.js";
 export { applyOrder } from "./core/references.js";
 /**
  * A warning for each clause chant's parser does not know (#3872): where it
@@ -81,7 +87,8 @@ function objectJson(name, obj, names, extra = []) {
         props.lineage = lineageJson(props.lineage, names);
     }
     const dependsOn = [...new Set([...obj.dependsOn.map((r) => referenceName(r, names)).filter((n) => n !== undefined), ...extra])];
-    return JSON.parse(JSON.stringify({ export: name, type: obj.entityType, sqlName: obj.sqlName, ...props, dependsOn, ddl }));
+    const collections = namedCollectionReferences(props);
+    return JSON.parse(JSON.stringify({ export: name, type: obj.entityType, sqlName: obj.sqlName, ...props, dependsOn, ...(collections.length > 0 ? { namedCollections: collections } : {}), ddl }));
 }
 /** A props value with every entity and column reference in it written as its export name (`users`, `users.id`). */
 function postgresJsonValue(v, names) {
@@ -153,10 +160,14 @@ export const sqlSerializer = {
             names.set(entity, name);
         const extra = sqlFileReferences("clickhouse", objects);
         const order = applyOrder(objects, names, extra);
+        const json = order.map((n) => objectJson(n, objects.get(n), names, extra.get(n)));
+        // The named collections the build references (#4395), each once, by name: a plan checks each exists.
+        const collections = [...new Set(json.flatMap((o) => o.namedCollections ?? []))].sort();
         const doc = {
             dialect: "clickhouse",
             applyOrder: order,
-            objects: order.map((n) => objectJson(n, objects.get(n), names, extra.get(n))),
+            ...(collections.length > 0 ? { namedCollections: collections } : {}),
+            objects: json,
         };
         const ddl = order
             .map((n) => `${objects.get(n).props.ddl};`)

package/dist/sql-types-command.d.ts

@@ -13,7 +13,20 @@
  * the file instead of writing it: exit 1, naming the file, when they differ.
  */
 import type { CommandGroupContext } from "@intentius/chant/cli/command-group";
+export interface ProjectLocation {
+    config: Awaited<ReturnType<typeof import("@intentius/chant/config").loadChantConfigUpward>>["config"];
+    projectDir: string;
+    sourceDir: string;
+}
 /** The file tsc would read instead of `path`: `sql-types.ts` beside `sql-types.d.ts`. */
 export declare function shadowingSource(path: string): string | undefined;
+/** The project the working directory belongs to: its config, its root and its source directory. */
+export declare function loadProject(cwd: string): Promise<ProjectLocation>;
+/**
+ * The fold build's entities: what `chant build` declares, `.sql` files and
+ * composite members included. Prints the build's errors and returns
+ * undefined when it fails.
+ */
+export declare function buildFolded(project: ProjectLocation, command: string, consequence: string): Promise<import("@intentius/chant").BuildResult | undefined>;
 export declare function runTypes(ctx: CommandGroupContext): Promise<number>;
 //# sourceMappingURL=sql-types-command.d.ts.map

package/dist/sql-types-command.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-types-command.d.ts","sourceRoot":"","sources":["../src/sql-types-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAqB9E,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAqDxE"}
+{"version":3,"file":"sql-types-command.d.ts","sourceRoot":"","sources":["../src/sql-types-command.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;GAaG;AAIH,OAAO,KAAK,EAAE,mBAAmB,EAAE,MAAM,oCAAoC,CAAC;AAG9E,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,OAAO,CAAC,UAAU,CAAC,cAAc,yBAAyB,EAAE,qBAAqB,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC;IACtG,UAAU,EAAE,MAAM,CAAC;IACnB,SAAS,EAAE,MAAM,CAAC;CACnB;AAoBD,yFAAyF;AACzF,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAIhE;AAED,mGAAmG;AACnG,wBAAsB,WAAW,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,eAAe,CAAC,CAKvE;AAED;;;;GAIG;AACH,wBAAsB,WAAW,CAAC,OAAO,EAAE,eAAe,EAAE,OAAO,EAAE,MAAM,EAAE,WAAW,EAAE,MAAM,+DAe/F;AAED,wBAAsB,QAAQ,CAAC,GAAG,EAAE,mBAAmB,GAAG,OAAO,CAAC,MAAM,CAAC,CAuCxE"}

package/dist/sql-types-command.js

@@ -43,37 +43,52 @@ export function shadowingSource(path) {
     const source = `${path.slice(0, -".d.ts".length)}.ts`;
     return existsSync(source) ? source : undefined;
 }
-export async function runTypes(ctx) {
-    const args = parseArgs(ctx.rawArgs);
-    if ("error" in args) {
-        console.error(`${args.error}\n${USAGE}`);
-        return 1;
-    }
-    const cwd = process.cwd();
+/** The project the working directory belongs to: its config, its root and its source directory. */
+export async function loadProject(cwd) {
     const { loadChantConfigUpward } = await import("@intentius/chant/config");
     const { config, configPath } = await loadChantConfigUpward(cwd);
     const projectDir = configPath ? dirname(configPath) : cwd;
-    const sourceDir = resolve(projectDir, config.sourceDir ?? ".");
-    const output = args.output !== undefined ? resolve(cwd, args.output) : join(sourceDir, SQL_TYPES_FILE);
-    const shadow = shadowingSource(output);
-    if (shadow) {
-        console.error(`chant sql types: ${relative(cwd, shadow) || basename(shadow)} sits beside ${relative(cwd, output) || basename(output)}, and tsc reads it instead of the declarations; rename one`);
-        return 1;
-    }
+    return { config, projectDir, sourceDir: resolve(projectDir, config.sourceDir ?? ".") };
+}
+/**
+ * The fold build's entities: what `chant build` declares, `.sql` files and
+ * composite members included. Prints the build's errors and returns
+ * undefined when it fails.
+ */
+export async function buildFolded(project, command, consequence) {
+    const { config, projectDir, sourceDir } = project;
     const { build } = await import("@intentius/chant/build");
     const { resolveBuildModes, resolveProjectBuildOptions } = await import("@intentius/chant/cli/build-options");
     const { loadPlugins, resolveProjectLexicons } = await import("@intentius/chant/cli/plugins");
     const { sqlSerializer } = await import("./serializer.js");
     const plugins = await loadPlugins(await resolveProjectLexicons(projectDir, { lexicon: "sql" }));
-    // The fold build's entities: what `chant build` declares, `.sql` files and composite members included.
     const options = resolveProjectBuildOptions({ config, configDir: projectDir, plugins, modes: resolveBuildModes(config, { fold: true }) });
     const result = await build(sourceDir, [sqlSerializer], undefined, options);
     if (result.errors.length > 0) {
         for (const e of result.errors)
             console.error(e instanceof Error ? e.message : String(e));
-        console.error("chant sql types: the build failed, so nothing was written");
+        console.error(`${command}: the build failed, so ${consequence}`);
+        return undefined;
+    }
+    return result;
+}
+export async function runTypes(ctx) {
+    const args = parseArgs(ctx.rawArgs);
+    if ("error" in args) {
+        console.error(`${args.error}\n${USAGE}`);
         return 1;
     }
+    const cwd = process.cwd();
+    const { config, projectDir, sourceDir } = await loadProject(cwd);
+    const output = args.output !== undefined ? resolve(cwd, args.output) : join(sourceDir, SQL_TYPES_FILE);
+    const shadow = shadowingSource(output);
+    if (shadow) {
+        console.error(`chant sql types: ${relative(cwd, shadow) || basename(shadow)} sits beside ${relative(cwd, output) || basename(output)}, and tsc reads it instead of the declarations; rename one`);
+        return 1;
+    }
+    const result = await buildFolded({ config, projectDir, sourceDir }, "chant sql types", "nothing was written");
+    if (!result)
+        return 1;
     const text = renderSqlTypes(result.entities, { projectDir, config: config });
     const shown = relative(cwd, output);
     const named = shown && !shown.startsWith("..") ? shown : output;

package/dist/sql-types.d.ts

@@ -30,6 +30,8 @@
  */
 import type { Declarable } from "@intentius/chant/declarable";
 import type { SqlDialect } from "./dialects.js";
+import { type PgProject } from "./lint/post-synth/postgres-names.js";
+import type { OutputObject } from "./lint/post-synth/sql-helpers.js";
 /** The file `chant sql types` writes, in the project's source directory. */
 export declare const SQL_TYPES_FILE = "sql-types.d.ts";
 /**
@@ -47,6 +49,26 @@ export interface RenderSqlTypesOptions {
     /** The project's config: `sql.postgresMajor` for the catalog, `sql.dialect` when nothing is declared. */
     config?: Record<string, unknown>;
 }
+/** The names a relation's `.columns` record holds at run time, in order. */
+export declare const runtimeColumns: (entity: Declarable | undefined) => string[];
+/** A view's column that passes one column through: that column's export and name. */
+export declare function passthrough(o: OutputObject, name: string, quote: (c: string) => string): {
+    export: string;
+    column: string;
+} | undefined;
+/** A Postgres type's spelling, row type, and whether the type itself forbids NULL (a serial, a NOT NULL domain). */
+export declare function pgType(p: PgProject, text: string | undefined, depth?: number): {
+    sqlType: string;
+    ts: string;
+    notNull: boolean;
+};
+/** The dialect a build's entities declare, else the config's, else ClickHouse. */
+export declare function dialectOf(entities: ReadonlyMap<string, Declarable>, config: Record<string, unknown>): SqlDialect;
+/** The build's sql output as `chant build` writes it: the objects, and the Postgres major they were built for. */
+export declare function serializedObjects(entities: ReadonlyMap<string, Declarable>, config: Record<string, unknown>): {
+    objects: OutputObject[];
+    postgresMajor?: number;
+};
 /**
  * The `sql-types.d.ts` for a build's entities: one module that augments the
  * dialect's `SqlSchema` with each table, view and dictionary, in key order.

package/dist/sql-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-types.d.ts","sourceRoot":"","sources":["../src/sql-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAW9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAQ7C,4EAA4E;AAC5E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAGpG;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,qBAA0B,GAC/B,SAAS,GAAG,OAAO,GAAG,SAAS,CASjC;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA+OD;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAiClH"}
+{"version":3,"file":"sql-types.d.ts","sourceRoot":"","sources":["../src/sql-types.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAIH,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,6BAA6B,CAAC;AAW9D,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,YAAY,CAAC;AAK7C,OAAO,EAA6E,KAAK,SAAS,EAAE,MAAM,kCAAkC,CAAC;AAC7I,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,+BAA+B,CAAC;AAElE,4EAA4E;AAC5E,eAAO,MAAM,cAAc,mBAAmB,CAAC;AAE/C;;;GAGG;AACH,wBAAgB,YAAY,CAAC,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,SAAS,GAAG,MAAM,CAGpG;AAED,kGAAkG;AAClG,wBAAgB,aAAa,CAC3B,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EACzC,IAAI,EAAE,MAAM,EACZ,IAAI,GAAE,qBAA0B,GAC/B,SAAS,GAAG,OAAO,GAAG,SAAS,CASjC;AAED,6DAA6D;AAC7D,eAAO,MAAM,gBAAgB,EAAE,QAAQ,CAAC,MAAM,CAAC,UAAU,EAAE,MAAM,CAAC,CAGjE,CAAC;AAEF,MAAM,WAAW,qBAAqB;IACpC,yGAAyG;IACzG,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,yGAAyG;IACzG,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAClC;AA2CD,4EAA4E;AAC5E,eAAO,MAAM,cAAc,GAAI,QAAQ,UAAU,GAAG,SAAS,KAAG,MAAM,EAA8E,CAAC;AAcrJ,qFAAqF;AACrF,wBAAgB,WAAW,CAAC,CAAC,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,CAAC,CAAC,EAAE,MAAM,KAAK,MAAM,GAAG;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,CAQvI;AAoBD,oHAAoH;AACpH,wBAAgB,MAAM,CAAC,CAAC,EAAE,SAAS,EAAE,IAAI,EAAE,MAAM,GAAG,SAAS,EAAE,KAAK,SAAI,GAAG;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,EAAE,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,OAAO,CAAA;CAAE,CAwB3H;AAsHD,kFAAkF;AAClF,wBAAgB,SAAS,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,UAAU,CAMhH;AAED,kHAAkH;AAClH,wBAAgB,iBAAiB,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG;IAAE,OAAO,EAAE,YAAY,EAAE,CAAC;IAAC,aAAa,CAAC,EAAE,MAAM,CAAA;CAAE,CAGjK;AAED;;;;GAIG;AACH,wBAAgB,cAAc,CAAC,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE,UAAU,CAAC,EAAE,IAAI,GAAE,qBAA0B,GAAG,MAAM,CAgClH"}

package/dist/sql-types.js

@@ -90,14 +90,14 @@ function originOf(entity, exportName, projectDir) {
     return `${file ? posix(file) : "?"}: ${exportName}${composite}`;
 }
 /** The names a relation's `.columns` record holds at run time, in order. */
-const runtimeColumns = (entity) => Object.keys(entity?.columns ?? {});
+export const runtimeColumns = (entity) => Object.keys(entity?.columns ?? {});
 /** Whether `expr` is the column `column` alone, bare or qualified (`o.user_id`). */
 function isBareColumn(expr, quoted) {
     const unqualified = expr.trim().replace(/^(?:"(?:[^"]|"")+"|`(?:[^`]|``)+`|[A-Za-z_][\w$]*)\./, "");
     return unqualified === quoted;
 }
 /** A view's column that passes one column through: that column's export and name. */
-function passthrough(o, name, quote) {
+export function passthrough(o, name, quote) {
     const edge = (o.lineage ?? []).find((e) => e.output === name);
     const ref = edge?.from.length === 1 ? edge.from[0] : undefined;
     if (!edge || !ref)
@@ -124,7 +124,7 @@ function spell(canonical, t) {
 }
 const arrayOf = (ts) => `${/[|&]/.test(ts) && !/^\{.*\}$/s.test(ts) ? `(${ts})` : ts}[]`;
 /** A Postgres type's spelling, row type, and whether the type itself forbids NULL (a serial, a NOT NULL domain). */
-function pgType(p, text, depth = 0) {
+export function pgType(p, text, depth = 0) {
     const t = parseType(text);
     if (!t || depth > 5)
         return { sqlType: text?.trim() || "unknown", ts: "unknown", notNull: false };
@@ -268,7 +268,7 @@ function renderEntry(e, lines) {
     lines.push("    };");
 }
 /** The dialect a build's entities declare, else the config's, else ClickHouse. */
-function dialectOf(entities, config) {
+export function dialectOf(entities, config) {
     try {
         return filesDialect(entities, config);
     }
@@ -276,6 +276,11 @@ function dialectOf(entities, config) {
         return "clickhouse";
     }
 }
+/** The build's sql output as `chant build` writes it: the objects, and the Postgres major they were built for. */
+export function serializedObjects(entities, config) {
+    const out = sqlSerializer.serialize(new Map(entities), undefined, { config });
+    return JSON.parse(typeof out === "string" ? out : out.primary);
+}
 /**
  * The `sql-types.d.ts` for a build's entities: one module that augments the
  * dialect's `SqlSchema` with each table, view and dictionary, in key order.
@@ -288,8 +293,7 @@ export function renderSqlTypes(entities, opts = {}) {
     const sqlEntities = new Map([...entities].filter(([, e]) => isPostgresObject(e) || isClickHouseObject(e)));
     let entries = [];
     if (sqlEntities.size > 0) {
-        const out = sqlSerializer.serialize(new Map(entities), undefined, { config });
-        const doc = JSON.parse(typeof out === "string" ? out : out.primary);
+        const doc = serializedObjects(entities, config);
         entries = dialect === "postgres" ? postgresEntries(doc.objects, doc.postgresMajor ?? PINNED_MAJOR, entities, projectDir) : clickhouseEntries(doc.objects, entities, projectDir);
     }
     const byKey = new Map();

package/dist/sqlserver/lexer.d.ts

@@ -0,0 +1,37 @@
+/**
+ * A T-SQL tokenizer for the statements `chant import` reads from SQL Server.
+ *
+ * T-SQL differs from the lexers the other dialects use in four places: an
+ * identifier can be `[bracketed]` (a `]` inside is written `]]`) or
+ * "double quoted", a string can carry an `N` prefix, a line holding only `GO`
+ * ends a batch (it is a client command, not a statement), and statements need
+ * no terminating `;`. Comments (`--` and nestable `/* *\/`) are dropped; each
+ * token keeps its 1-based line and column in the source.
+ */
+export type TokenKind = "word" | "qident" | "string" | "number" | "variable" | "punct" | "go";
+export interface Token {
+    kind: TokenKind;
+    /** As written: a `qident` keeps its brackets; a string its quotes. */
+    text: string;
+    /** A `qident`'s name, a string's value, a word's text. */
+    value: string;
+    line: number;
+    column: number;
+    /** Offset of the first character. */
+    start: number;
+    /** Offset after the last. */
+    end: number;
+}
+export declare class TsqlLexError extends Error {
+    readonly line: number;
+    readonly column: number;
+    constructor(message: string, line: number, column: number);
+}
+/** Tokenize a file. A `GO` on a line of its own (optionally with a count) becomes one `go` token. */
+export declare function tokenize(text: string): Token[];
+/** Tokens split into batches at `go` tokens; empty batches are dropped. */
+export declare function batches(tokens: readonly Token[]): Token[][];
+export declare const upper: (t: Token | undefined) => string;
+/** The source text of a run of tokens, from the first token's start to the last token's end. */
+export declare function sourceOf(text: string, tokens: readonly Token[]): string;
+//# sourceMappingURL=lexer.d.ts.map

package/dist/sqlserver/lexer.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"lexer.d.ts","sourceRoot":"","sources":["../../src/sqlserver/lexer.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,MAAM,MAAM,SAAS,GAAG,MAAM,GAAG,QAAQ,GAAG,QAAQ,GAAG,QAAQ,GAAG,UAAU,GAAG,OAAO,GAAG,IAAI,CAAC;AAE9F,MAAM,WAAW,KAAK;IACpB,IAAI,EAAE,SAAS,CAAC;IAChB,sEAAsE;IACtE,IAAI,EAAE,MAAM,CAAC;IACb,0DAA0D;IAC1D,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,MAAM,EAAE,MAAM,CAAC;IACf,qCAAqC;IACrC,KAAK,EAAE,MAAM,CAAC;IACd,6BAA6B;IAC7B,GAAG,EAAE,MAAM,CAAC;CACb;AAED,qBAAa,YAAa,SAAQ,KAAK;IAGnC,QAAQ,CAAC,IAAI,EAAE,MAAM;IACrB,QAAQ,CAAC,MAAM,EAAE,MAAM;gBAFvB,OAAO,EAAE,MAAM,EACN,IAAI,EAAE,MAAM,EACZ,MAAM,EAAE,MAAM;CAK1B;AAKD,qGAAqG;AACrG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,GAAG,KAAK,EAAE,CA4K9C;AAyBD,2EAA2E;AAC3E,wBAAgB,OAAO,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,KAAK,EAAE,EAAE,CAW3D;AAED,eAAO,MAAM,KAAK,GAAI,GAAG,KAAK,GAAG,SAAS,KAAG,MAA+D,CAAC;AAE7G,gGAAgG;AAChG,wBAAgB,QAAQ,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,KAAK,EAAE,GAAG,MAAM,CAGvE"}