@intentius/chant-lexicon-sql 0.124.54 → 0.124.55

package/dist/ci-setup.d.ts

@@ -0,0 +1,34 @@
+import type { CiService } from "@intentius/chant/components/ci-services";
+export type SqlCiDialect = "clickhouse" | "postgres";
+/** The profile the replay check runs on, as sql-yodeler names it. */
+export declare const REPLAY_PROFILE = "replay";
+/** The oldest Node the lexicon and chant run on. */
+export declare const SQL_CI_NODE_MAJOR = 22;
+/** Fails the job, naming the version, when the image's Node is older than {@link SQL_CI_NODE_MAJOR}. */
+export declare const NODE_CHECK_LINE: string;
+/**
+ * The project's packages, unless the lexicon is already installed (an image
+ * that carries them pays nothing), and their bins on PATH: exported for the
+ * rest of a GitLab script, appended to `$GITHUB_PATH` for a GitHub or
+ * Forgejo job's later steps.
+ */
+export declare const PACKAGES_INSTALL_LINE = "{ [ -d node_modules/@intentius/chant-lexicon-sql ] || npm ci; } && export PATH=\"$PWD/node_modules/.bin:$PATH\" && if [ -n \"${GITHUB_PATH:-}\" ]; then echo \"$PWD/node_modules/.bin\" >> \"$GITHUB_PATH\"; fi";
+/** The replay server of each dialect: the emulator's pinned image, under a prefixed name. */
+export declare function replayService(dialect: SqlCiDialect): CiService;
+/**
+ * The dialects the config names (`dialect: "postgres"`, or a list), in
+ * {@link SqlCiDialect} order; ClickHouse, the lexicon's default, when it
+ * names none.
+ */
+export declare function sqlDialectsOf(text: string): SqlCiDialect[];
+/** Whether the config declares the `replay` profile, the one the replay check runs on. */
+export declare function declaresReplay(text: string): boolean;
+/** The setup lines for the project at `dir`: none when it has no config naming the sql lexicon's settings. */
+export declare function sqlCiSetup(ctx: {
+    dir: string;
+}): string[];
+/** The replay service per dialect for the project at `dir`, when its config declares the `replay` profile. */
+export declare function sqlCiServices(ctx: {
+    dir: string;
+}): CiService[];
+//# sourceMappingURL=ci-setup.d.ts.map

package/dist/ci-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"ci-setup.d.ts","sourceRoot":"","sources":["../src/ci-setup.ts"],"names":[],"mappings":"AAyBA,OAAO,KAAK,EAAE,SAAS,EAAE,MAAM,yCAAyC,CAAC;AAIzE,MAAM,MAAM,YAAY,GAAG,YAAY,GAAG,UAAU,CAAC;AAErD,qEAAqE;AACrE,eAAO,MAAM,cAAc,WAAW,CAAC;AAEvC,oDAAoD;AACpD,eAAO,MAAM,iBAAiB,KAAK,CAAC;AAEpC,wGAAwG;AACxG,eAAO,MAAM,eAAe,QAA4P,CAAC;AAEzR;;;;;GAKG;AACH,eAAO,MAAM,qBAAqB,oNACyK,CAAC;AAE5M,6FAA6F;AAC7F,wBAAgB,aAAa,CAAC,OAAO,EAAE,YAAY,GAAG,SAAS,CAqB9D;AAgBD;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,IAAI,EAAE,MAAM,GAAG,YAAY,EAAE,CAM1D;AAED,0FAA0F;AAC1F,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,8GAA8G;AAC9G,wBAAgB,UAAU,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,MAAM,EAAE,CAEzD;AAED,8GAA8G;AAC9G,wBAAgB,aAAa,CAAC,GAAG,EAAE;IAAE,GAAG,EAAE,MAAM,CAAA;CAAE,GAAG,SAAS,EAAE,CAI/D"}

package/dist/ci-setup.js

@@ -0,0 +1,106 @@
+/**
+ * What a SQL project's CI jobs need from the sql lexicon (#4572, over
+ * #4550's `LexiconPlugin.ciSetup`): the setup lines for chant's default
+ * image, and the replay server per dialect as a job service
+ * (`LexiconPlugin.ciServices`). sql-yodeler's own versions were
+ * `src/ci/render.ts` (`installLines`, `REPLAY_SERVICE`, `waitFor`), which
+ * now come from here.
+ *
+ * The lines: a Node check, since the lexicon and chant run on Node 22, then
+ * the project's packages with `npm ci` unless the lexicon is already
+ * installed, with `node_modules/.bin` put on PATH for the job's later
+ * steps. That one install carries the dialect's client too: Postgres is the
+ * lexicon's own `pg` dependency and ClickHouse is spoken over HTTP, so no
+ * separate client goes into the image. A token source needs no cloud
+ * command line in CI either: in a job that traded its OIDC token through
+ * chant's `ci.identity`, `./token-source.ts` mints from what the trade left.
+ *
+ * The replay server is the image the lexicon's emulator runs, at the same
+ * pin (`./spec/pin.ts`, `./spec/postgres-pin.ts`), so a replay in CI and
+ * `chant emulator up` on a laptop run one server. It is a throwaway: the
+ * replay resets it. The dialects are read from the text of the project's
+ * `chant.config.ts`, never by running it, as lexicon detection reads source.
+ */
+import { existsSync, readFileSync } from "node:fs";
+import { join } from "node:path";
+import { clickhouseImage } from "./spec/pin.js";
+import { POSTGRES_LATEST_MAJOR, postgresImage } from "./spec/postgres-pin.js";
+/** The profile the replay check runs on, as sql-yodeler names it. */
+export const REPLAY_PROFILE = "replay";
+/** The oldest Node the lexicon and chant run on. */
+export const SQL_CI_NODE_MAJOR = 22;
+/** Fails the job, naming the version, when the image's Node is older than {@link SQL_CI_NODE_MAJOR}. */
+export const NODE_CHECK_LINE = `node -e 'const m = Number(process.versions.node.split(".")[0]); if (m < ${String(SQL_CI_NODE_MAJOR)}) { console.error("the sql lexicon needs Node ${String(SQL_CI_NODE_MAJOR)} or newer; this image has " + process.versions.node); process.exit(1); }'`;
+/**
+ * The project's packages, unless the lexicon is already installed (an image
+ * that carries them pays nothing), and their bins on PATH: exported for the
+ * rest of a GitLab script, appended to `$GITHUB_PATH` for a GitHub or
+ * Forgejo job's later steps.
+ */
+export const PACKAGES_INSTALL_LINE = '{ [ -d node_modules/@intentius/chant-lexicon-sql ] || npm ci; } && export PATH="$PWD/node_modules/.bin:$PATH" && if [ -n "${GITHUB_PATH:-}" ]; then echo "$PWD/node_modules/.bin" >> "$GITHUB_PATH"; fi';
+/** The replay server of each dialect: the emulator's pinned image, under a prefixed name. */
+export function replayService(dialect) {
+    if (dialect === "clickhouse") {
+        return {
+            name: "replay-clickhouse",
+            image: clickhouseImage(),
+            port: 8123,
+            // The default user, with no password, from outside the container.
+            env: { CLICKHOUSE_SKIP_USER_SETUP: "1" },
+            health: "clickhouse-client --query 'SELECT 1'",
+            jobEnv: { REPLAY_CLICKHOUSE_URL: "http://replay-clickhouse:8123" },
+        };
+    }
+    return {
+        name: "replay-postgres",
+        image: postgresImage(POSTGRES_LATEST_MAJOR),
+        port: 5432,
+        env: { POSTGRES_PASSWORD: "replay" },
+        // Over TCP: during its first start the image runs a server on the socket only, then restarts.
+        health: "pg_isready -h 127.0.0.1 -U postgres",
+        jobEnv: { REPLAY_POSTGRES_URL: "postgres://replay-postgres:5432/postgres", REPLAY_POSTGRES_USER: "postgres", REPLAY_POSTGRES_PASSWORD: "replay" },
+    };
+}
+/** The text of the project's config, or undefined without one. */
+function configText(dir) {
+    for (const name of ["chant.config.ts", "chant.config.mts", "chant.config.js"]) {
+        const file = join(dir, name);
+        if (!existsSync(file))
+            continue;
+        try {
+            return readFileSync(file, "utf-8");
+        }
+        catch {
+            return undefined;
+        }
+    }
+    return undefined;
+}
+/**
+ * The dialects the config names (`dialect: "postgres"`, or a list), in
+ * {@link SqlCiDialect} order; ClickHouse, the lexicon's default, when it
+ * names none.
+ */
+export function sqlDialectsOf(text) {
+    const m = /\bdialect\s*:\s*(\[[^\]]*\]|["'][a-z]+["'])/.exec(text);
+    if (!m)
+        return ["clickhouse"];
+    const named = new Set([...m[1].matchAll(/["']([a-z]+)["']/g)].map((x) => x[1]));
+    const out = ["clickhouse", "postgres"].filter((d) => named.has(d));
+    return out.length > 0 ? [...out] : ["clickhouse"];
+}
+/** Whether the config declares the `replay` profile, the one the replay check runs on. */
+export function declaresReplay(text) {
+    return new RegExp(`(^|[\\s{,])["']?${REPLAY_PROFILE}["']?\\s*:`).test(text);
+}
+/** The setup lines for the project at `dir`: none when it has no config naming the sql lexicon's settings. */
+export function sqlCiSetup(ctx) {
+    return configText(ctx.dir) === undefined ? [] : [NODE_CHECK_LINE, PACKAGES_INSTALL_LINE];
+}
+/** The replay service per dialect for the project at `dir`, when its config declares the `replay` profile. */
+export function sqlCiServices(ctx) {
+    const text = configText(ctx.dir);
+    if (text === undefined || !declaresReplay(text))
+        return [];
+    return sqlDialectsOf(text).map(replayService);
+}

package/dist/clickhouse/access.d.ts

@@ -116,6 +116,26 @@ export declare function atomKey(a: GrantAtom): string;
 export declare function foldAtoms(atoms: readonly GrantAtom[]): GrantAtom[];
 /** A grantee's grants as a plan compares them: each atom's key, mapped to the atom. */
 export declare function grantsCanonical(ddl: string, grantee: string, defaultDatabase?: string): Record<string, string>;
+/**
+ * The atoms one grant declaration gives, one per grantee (#4582): `key` is
+ * the atom as the declaration spells its target (a bare table stays bare),
+ * which is how the deep diff addresses it on both sides; `atom` has the
+ * target qualified with `defaultDatabase`, which is what the server is asked
+ * about.
+ */
+export declare function declaredGrantAtoms(ddl: string, defaultDatabase?: string): Array<{
+    grantee: string;
+    key: string;
+    atom: GrantAtom;
+}>;
+/**
+ * Whether a grantee holding `have` (its `SHOW GRANTS` atoms) holds `a`: the
+ * same atom, or one the server folds it under (the table's privilege for a
+ * column's, the database's for a table's, `*.*` for any), with a grant or
+ * admin option at least as wide, and no partial revoke the server holds
+ * taking part of it back.
+ */
+export declare function holdsAtom(have: readonly GrantAtom[], a: GrantAtom): boolean;
 /** Every grantee a grant statement names. */
 export declare function granteesOf(ddl: string): string[];
 /** The statement that gives `grantee` one atom. */

package/dist/clickhouse/access.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/clickhouse/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA0B,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAiB,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAG1D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAEpG,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,IAAI,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACvC,oDAAoD;IACpD,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,0BAA0B;IAC1B,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,kDAAkD;IAClD,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC/B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA6LD,oGAAoG;AACpG,eAAO,MAAM,UAAU,aAAqF,CAAC;AAoB7G,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAEvD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAStD;AA6ED,4HAA4H;AAC5H,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASnE,CAAC;AASF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6ClF;AAyBD,gIAAgI;AAChI,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,iBAAiB,CAAC;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,SAAY,GAAG,eAAe,CAmDzF;AAID,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,iHAAiH;AACjH,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAG5C;AAyDD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAmBlE;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,SAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjH;AAED,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhD;AAaD,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAqB/K;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAcnM;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,GAAG,KAAK,CAAC;IAC3I,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC,CAaD"}
+{"version":3,"file":"access.d.ts","sourceRoot":"","sources":["../../src/clickhouse/access.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;GA2BG;AAEH,OAAO,EAA0B,KAAK,KAAK,EAAE,MAAM,UAAU,CAAC;AAC9D,OAAO,EAAiB,KAAK,IAAI,EAAE,MAAM,gBAAgB,CAAC;AAG1D,MAAM,MAAM,eAAe,GAAG,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,iBAAiB,GAAG,OAAO,CAAC;AAEpG,oFAAoF;AACpF,MAAM,WAAW,UAAU;IACzB,SAAS,EAAE,eAAe,CAAC;IAC3B,SAAS,EAAE,OAAO,CAAC;IACnB,WAAW,EAAE,OAAO,CAAC;IACrB,4FAA4F;IAC5F,IAAI,CAAC,EAAE,IAAI,CAAC;IACZ,SAAS,CAAC,EAAE,IAAI,CAAC;IACjB,0CAA0C;IAC1C,KAAK,CAAC,EAAE,IAAI,CAAC;IACb;;;;;OAKG;IACH,OAAO,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC,CAAC;IACvC,oDAAoD;IACpD,KAAK,EAAE,IAAI,EAAE,CAAC;IACd,wDAAwD;IACxD,MAAM,CAAC,EAAE,IAAI,CAAC;IACd,0BAA0B;IAC1B,QAAQ,EAAE,IAAI,EAAE,CAAC;IACjB,kDAAkD;IAClD,UAAU,CAAC,EAAE,OAAO,GAAG,OAAO,CAAC;IAC/B,iFAAiF;IACjF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AA6LD,oGAAoG;AACpG,eAAO,MAAM,UAAU,aAAqF,CAAC;AAoB7G,oFAAoF;AACpF,wBAAgB,WAAW,CAAC,MAAM,EAAE,KAAK,EAAE,GAAG,UAAU,CAEvD;AAED,2EAA2E;AAC3E,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAStD;AA6ED,4HAA4H;AAC5H,eAAO,MAAM,sBAAsB,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASnE,CAAC;AASF;;;;;;;GAOG;AACH,wBAAgB,cAAc,CAAC,MAAM,EAAE,KAAK,EAAE,EAAE,IAAI,EAAE,IAAI,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CA6ClF;AAyBD,gIAAgI;AAChI,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,GAAG,MAAM,GAAG,WAAW,GAAG,OAAO,GAAG,iBAAiB,CAAC;IAClE,IAAI,EAAE,MAAM,CAAC;IACb,uCAAuC;IACvC,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4BAA4B;IAC5B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAChC;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,SAAY,GAAG,eAAe,CAmDzF;AAID,+DAA+D;AAC/D,MAAM,WAAW,SAAS;IACxB,8EAA8E;IAC9E,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,8CAA8C;IAC9C,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,yEAAyE;IACzE,MAAM,CAAC,EAAE,OAAO,CAAC;IACjB,sFAAsF;IACtF,MAAM,CAAC,EAAE,OAAO,CAAC;CAClB;AAED,iHAAiH;AACjH,wBAAgB,OAAO,CAAC,CAAC,EAAE,SAAS,GAAG,MAAM,CAG5C;AA0DD;;;;;GAKG;AACH,wBAAgB,SAAS,CAAC,KAAK,EAAE,SAAS,SAAS,EAAE,GAAG,SAAS,EAAE,CAmBlE;AAED,uFAAuF;AACvF,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,EAAE,OAAO,EAAE,MAAM,EAAE,eAAe,SAAY,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CASjH;AAED;;;;;;GAMG;AACH,wBAAgB,kBAAkB,CAAC,GAAG,EAAE,MAAM,EAAE,eAAe,SAAY,GAAG,KAAK,CAAC;IAAE,OAAO,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,SAAS,CAAA;CAAE,CAAC,CAUrI;AAED;;;;;;GAMG;AACH,wBAAgB,SAAS,CAAC,IAAI,EAAE,SAAS,SAAS,EAAE,EAAE,CAAC,EAAE,SAAS,GAAG,OAAO,CAkB3E;AAED,6CAA6C;AAC7C,wBAAgB,UAAU,CAAC,GAAG,EAAE,MAAM,GAAG,MAAM,EAAE,CAEhD;AAaD,mDAAmD;AACnD,wBAAgB,cAAc,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAKvE;AAED,wDAAwD;AACxD,wBAAgB,eAAe,CAAC,IAAI,EAAE,SAAS,EAAE,OAAO,EAAE,MAAM,GAAG,MAAM,CAIxE;AAED;;;GAGG;AACH,wBAAgB,gBAAgB,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAqB/K;AAED;;;;;;;;;;GAUG;AACH,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,OAAO,GAAG,iBAAiB,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,eAAe,CAAC,QAAQ,CAAC,EAAE,YAAY,EAAE,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,GAAG,MAAM,CAcnM;AAED,sFAAsF;AACtF,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAS7E;AAED;;;;;GAKG;AACH,wBAAgB,eAAe,CAAC,OAAO,EAAE,aAAa,CAAC;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAC;IAAC,GAAG,EAAE,MAAM,CAAC;IAAC,SAAS,CAAC,EAAE,SAAS,MAAM,EAAE,CAAA;CAAE,CAAC,GAAG,KAAK,CAAC;IAC3I,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,EAAE,MAAM,EAAE,CAAC;CACrB,CAAC,CAaD"}

package/dist/clickhouse/access.js

@@ -520,6 +520,7 @@ export function atomKey(a) {
         return `ROLE ${a.role}${a.option ? " WITH ADMIN OPTION" : ""}`;
     return `${a.revoke ? "REVOKE " : ""}${a.privilege}${a.column !== undefined ? `(${a.column})` : ""} ON ${a.target}${a.option ? " WITH GRANT OPTION" : ""}`;
 }
+/** Each statement's grantees and atoms. A bare table is qualified with `defaultDatabase`, or left bare when it is undefined. */
 function grantAtoms(ddl, defaultDatabase) {
     const out = [];
     for (const statement of splitLines(ddl)) {
@@ -534,7 +535,7 @@ function grantAtoms(ddl, defaultDatabase) {
             const parts = sigOf(tokens, node.target)
                 .filter((t) => !(t.kind === "punct" && t.text === "."))
                 .map((t) => unquote(t.text));
-            target = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0] === "*" ? "*" : `${defaultDatabase}.${parts[0]}`;
+            target = parts.length >= 2 ? `${parts[0]}.${parts[1]}` : parts[0] === "*" || defaultDatabase === undefined ? parts[0] : `${defaultDatabase}.${parts[0]}`;
         }
         for (const item of node.items) {
             const sig = sigOf(tokens, item);
@@ -603,6 +604,46 @@ export function grantsCanonical(ddl, grantee, defaultDatabase = "default") {
         .map((a) => [atomKey(a), JSON.stringify(a)])
         .sort(([a], [b]) => (a < b ? -1 : a > b ? 1 : 0)));
 }
+/**
+ * The atoms one grant declaration gives, one per grantee (#4582): `key` is
+ * the atom as the declaration spells its target (a bare table stays bare),
+ * which is how the deep diff addresses it on both sides; `atom` has the
+ * target qualified with `defaultDatabase`, which is what the server is asked
+ * about.
+ */
+export function declaredGrantAtoms(ddl, defaultDatabase = "default") {
+    const spelled = grantAtoms(ddl, undefined);
+    const resolved = grantAtoms(ddl, defaultDatabase);
+    const out = [];
+    spelled.forEach((g, i) => {
+        for (const grantee of g.grantees) {
+            g.atoms.forEach((a, j) => out.push({ grantee, key: atomKey(a), atom: resolved[i].atoms[j] }));
+        }
+    });
+    return out;
+}
+/**
+ * Whether a grantee holding `have` (its `SHOW GRANTS` atoms) holds `a`: the
+ * same atom, or one the server folds it under (the table's privilege for a
+ * column's, the database's for a table's, `*.*` for any), with a grant or
+ * admin option at least as wide, and no partial revoke the server holds
+ * taking part of it back.
+ */
+export function holdsAtom(have, a) {
+    if (a.role !== undefined)
+        return have.some((b) => b.role === a.role && (b.option ?? false) >= (a.option ?? false));
+    const granted = have.some((b) => !b.revoke &&
+        b.role === undefined &&
+        b.privilege === a.privilege &&
+        (b.option ?? false) >= (a.option ?? false) &&
+        ((b.target === a.target && (b.column === undefined || b.column === a.column)) || (b.column === undefined && covers(b.target, a.target))));
+    if (!granted)
+        return false;
+    return !have.some((r) => r.revoke === true &&
+        r.privilege === a.privilege &&
+        (r.target === a.target || (a.column === undefined && covers(a.target, r.target))) &&
+        (a.column === undefined || r.column === undefined || r.column === a.column));
+}
 /** Every grantee a grant statement names. */
 export function granteesOf(ddl) {
     return [...new Set(grantAtoms(ddl, "default").flatMap((g) => g.grantees))];

package/dist/clickhouse/live/describe-resources.d.ts

@@ -1,6 +1,8 @@
 /**
  * `describeResources()` for the ClickHouse dialect: which declared databases,
- * tables and views exist on the environment's server.
+ * tables and views exist on the environment's server. A grant declaration is
+ * present when the server has every grantee it names, and missing when it
+ * lacks one (#4582); which privileges the grantee holds is the deep diff's.
  *
  * One read of `system.databases`, `system.tables` and `system.functions` per
  * run, then a lookup per declared entity, so N entities are three queries,

package/dist/clickhouse/live/describe-resources.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../../../src/clickhouse/live/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAA6C,KAAK,WAAW,EAAyB,MAAM,QAAQ,CAAC;AAY5G,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAapH;AAkDD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAMlC"}
+{"version":3,"file":"describe-resources.d.ts","sourceRoot":"","sources":["../../../src/clickhouse/live/describe-resources.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;GAkBG;AAEH,OAAO,EAEL,KAAK,cAAc,EACnB,KAAK,uBAAuB,EAG7B,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAA6C,KAAK,WAAW,EAAyB,MAAM,QAAQ,CAAC;AAa5G,6DAA6D;AAC7D,wBAAgB,eAAe,CAAC,MAAM,EAAE,cAAc,EAAE,eAAe,EAAE,MAAM,GAAG;IAAE,QAAQ,CAAC,EAAE,MAAM,CAAC;IAAC,IAAI,EAAE,MAAM,CAAA;CAAE,CAapH;AA6DD,wBAAsB,iBAAiB,CACrC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;IAC9E,mEAAmE;IACnE,KAAK,CAAC,EAAE,OAAO,CAAC;CACjB,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,uBAAuB,CAAC,CAgBlC"}

package/dist/clickhouse/live/describe-resources.js

@@ -1,6 +1,8 @@
 /**
  * `describeResources()` for the ClickHouse dialect: which declared databases,
- * tables and views exist on the environment's server.
+ * tables and views exist on the environment's server. A grant declaration is
+ * present when the server has every grantee it names, and missing when it
+ * lacks one (#4582); which privileges the grantee holds is the deep diff's.
  *
  * One read of `system.databases`, `system.tables` and `system.functions` per
  * run, then a lookup per declared entity, so N entities are three queries,
@@ -19,6 +21,7 @@ import { observeEntities, } from "@intentius/chant/observation";
 import { bindClickHouse, classifyClickHouseFailure } from "./bind.js";
 import { ACCESS_ENTITY_TYPES, ACCESS_UNMANAGED_DETAIL, accessOf, readLiveAccess, readLiveSchema } from "./catalog.js";
 import { CLICKHOUSE_ENTITY_TYPES } from "../entities.js";
+import { granteesOf } from "../access.js";
 import { objectKey } from "../plan/normalize.js";
 import { isChantManaged, readMarker, stripMarker } from "../ownership.js";
 /** The database and name a declared entity is created as. */
@@ -54,7 +57,21 @@ function adapter(options) {
                 return { unobserved: { reason: "filtered", detail: ACCESS_UNMANAGED_DETAIL } };
             }
             if (entity.type === CLICKHOUSE_ENTITY_TYPES.grant) {
-                return { unobserved: { reason: "unsupported-kind", detail: "a grant is compared as part of its grantees' grants, which chant sql plan reports" } };
+                let grantees;
+                try {
+                    grantees = granteesOf(String(entity.props.ddl ?? ""));
+                }
+                catch (err) {
+                    return { unobserved: { reason: "read-failed", detail: `the grant does not parse: ${err.message}` } };
+                }
+                const gone = grantees.find((g) => !byKey.has(objectKey({ type: entity.type, name: g })));
+                const queried = `${target.endpoint.url} grants ${gone ?? grantees.join(", ")}`;
+                if (gone !== undefined || grantees.length === 0)
+                    return { absent: true, queried };
+                // A grant carries no comment, so no marker: like a user or a role, it is never chant's by marker.
+                if (options.owned)
+                    return { unobserved: { reason: "filtered", detail: "a grant carries no chant ownership marker and owned was requested" }, queried };
+                return { present: { type: entity.type, physicalId: `grants ${grantees.join(", ")}`, status: "", ownership: "foreign" }, queried };
             }
             const { database, name } = declaredAddress(entity, target.defaultDatabase);
             const queried = `${target.endpoint.url} ${database ? `${database}.` : ""}${name}`;
@@ -87,5 +104,16 @@ export async function describeResources(options) {
         const entity = options.entities.get(name);
         return { name, type: entity?.entityType ?? "", props: entity?.props ?? {} };
     });
-    return observeEntities(declared, adapter({ ...options, access: (db) => accessOf(options.entities, db) }));
+    const grantees = [...options.entities.values()]
+        .filter((e) => e.entityType === CLICKHOUSE_ENTITY_TYPES.grant)
+        .flatMap((e) => {
+        try {
+            return granteesOf(String(e.props.ddl ?? ""));
+        }
+        catch {
+            return [];
+        }
+    });
+    const access = (db) => [...accessOf(options.entities, db), ...[...new Set(grantees)].map((name) => ({ kind: "grants", name }))];
+    return observeEntities(declared, adapter({ ...options, access }));
 }

package/dist/clickhouse/plan/deep.d.ts

@@ -18,15 +18,35 @@
  * server's, that copy is what is reported, with the server in `observedOn`,
  * which the drift report prints as `seen on`.
  *
- * Where the profile manages access, the grants an apply would give or take
- * from each declared grantee are reported as `pending` (#3733), the same
- * statements `chant sql plan` plans (SQLCH273, SQLCH274), so a privilege
- * granted or revoked by hand after an approval moves the plan digest.
+ * Where the profile manages access, each grant declaration is read as
+ * `grants.<grantee>.<atom>` (#4582): a privilege or role it declares that the
+ * grantee does not hold (revoked by hand, SQLCH273) is `absent` drift on that
+ * declaration. A grant declaration whose grantee the server does not have is
+ * not read here; the thin diff reports it missing. A privilege a grantee holds
+ * that no declaration gives (granted by hand, SQLCH274) belongs to no one
+ * declaration, so it is reported as `pending` (#3733) with every statement an
+ * apply would send that grantee, as `chant sql plan` plans them. Either way a
+ * privilege granted or revoked by hand after an approval moves the plan digest.
  */
 import { type DeepObservationResult, type DeepPendingChange, type DeepNormalizationHooks } from "@intentius/chant/deep-observation";
 import { type BindOptions, type ClickHouseTarget } from "../live/bind.js";
 import { type CanonicalObject } from "./normalize.js";
+import { type GrantAtom } from "../access.js";
 type Props = Record<string, unknown>;
+/**
+ * A grant declaration's tree as the diff compares it (#4582):
+ * `{ grants: { <grantee>: { <atom>: "granted" } } }`, each atom as the
+ * declaration spells it. The reader writes the live side in the same shape,
+ * with the atoms the grantee holds. Undefined when the statement does not
+ * parse as a grant.
+ */
+export declare function declaredGrantTree(ddl: string): Props | undefined;
+/**
+ * A grant declaration's live tree (#4582): each atom it declares that the
+ * grantee holds, keyed as {@link declaredGrantTree} keys it. Undefined when
+ * the server does not have one of its grantees.
+ */
+export declare function liveGrantTree(ddl: string, held: ReadonlyMap<string, readonly GrantAtom[]>, defaultDatabase: string): Props | undefined;
 export declare const sqlDeepNormalizationHooks: DeepNormalizationHooks;
 /** The live props, with each field the declaration means the same as written the declaration's way. */
 export declare function inDeclaredVocabulary(declared: Props, live: Props, d: CanonicalObject, l: CanonicalObject): Props;
@@ -39,16 +59,27 @@ export declare function observeResourcesDeep(options: {
     }>;
 } & Omit<BindOptions, "environment">): Promise<DeepObservationResult>;
 /**
- * The grants an apply would give or take from each declared grantee (#3733),
- * as `chant sql plan` compares them: the declared grants against what
- * `SHOW GRANTS FOR` prints, atom by atom. One change per grantee, its
- * REVOKEs before its GRANTs as the applier sends them, with the grant
- * declarations behind it. A grantee the server does not hold yet is given
- * every declared grant.
+ * What the server holds for each declared grantee, as `SHOW GRANTS FOR`
+ * prints it, folded into atoms. A grantee the server does not have is left
+ * out.
+ */
+export declare function heldGrants(target: ClickHouseTarget, entities: ReadonlyMap<string, {
+    entityType: string;
+    props: Record<string, unknown>;
+}>): Promise<Map<string, GrantAtom[]>>;
+/**
+ * The grantees holding a privilege or role no declaration gives them
+ * (#3733), as `chant sql plan` compares them: the declared grants against
+ * what `SHOW GRANTS FOR` prints, atom by atom. One change per such grantee,
+ * every statement an apply would send it, its REVOKEs before its GRANTs as
+ * the applier sends them, with the grant declarations behind it. A grantee
+ * that only lacks declared grants has nothing pending: each declaration
+ * reports those as `absent` drift of its own (#4582). A grantee the server
+ * does not have is the thin diff's missing.
  */
 export declare function pendingGrants(target: ClickHouseTarget, entities: ReadonlyMap<string, {
     entityType: string;
     props: Record<string, unknown>;
-}>): Promise<DeepPendingChange[]>;
+}>, held?: ReadonlyMap<string, readonly GrantAtom[]>): Promise<DeepPendingChange[]>;
 export {};
 //# sourceMappingURL=deep.d.ts.map

package/dist/clickhouse/plan/deep.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"deep.d.ts","sourceRoot":"","sources":["../../../src/clickhouse/plan/deep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;GAwBG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAEtB,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAA6C,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMlH,OAAO,EAAkE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AAInH,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAKrC,eAAO,MAAM,yBAAyB,EAAE,sBAEvC,CAAC;AAgCF,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,KAAK,CAmDhH;AA4FD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAkGhC;AAED;;;;;;;GAOG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GACpF,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAsB9B"}
+{"version":3,"file":"deep.d.ts","sourceRoot":"","sources":["../../../src/clickhouse/plan/deep.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;;;;;;;;;;;;;;;;GA6BG;AAEH,OAAO,EAEL,KAAK,qBAAqB,EAC1B,KAAK,iBAAiB,EAEtB,KAAK,sBAAsB,EAC5B,MAAM,mCAAmC,CAAC;AAE3C,OAAO,EAA6C,KAAK,WAAW,EAAE,KAAK,gBAAgB,EAAE,MAAM,cAAc,CAAC;AAMlH,OAAO,EAAkE,KAAK,eAAe,EAAE,MAAM,aAAa,CAAC;AACnH,OAAO,EAA4F,KAAK,SAAS,EAAE,MAAM,WAAW,CAAC;AAGrI,KAAK,KAAK,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;AAQrC;;;;;;GAMG;AACH,wBAAgB,iBAAiB,CAAC,GAAG,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAQhE;AAED;;;;GAIG;AACH,wBAAgB,aAAa,CAAC,GAAG,EAAE,MAAM,EAAE,IAAI,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC,EAAE,eAAe,EAAE,MAAM,GAAG,KAAK,GAAG,SAAS,CAQtI;AAED,eAAO,MAAM,yBAAyB,EAAE,sBAOvC,CAAC;AAgCF,uGAAuG;AACvG,wBAAgB,oBAAoB,CAAC,QAAQ,EAAE,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,CAAC,EAAE,eAAe,EAAE,CAAC,EAAE,eAAe,GAAG,KAAK,CAmDhH;AA4FD,wBAAsB,oBAAoB,CACxC,OAAO,EAAE;IACP,WAAW,EAAE,MAAM,CAAC;IACpB,WAAW,EAAE,MAAM,EAAE,CAAC;IACtB,QAAQ,EAAE,GAAG,CAAC,MAAM,EAAE;QAAE,UAAU,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;KAAE,CAAC,CAAC;CAC/E,GAAG,IAAI,CAAC,WAAW,EAAE,aAAa,CAAC,GACnC,OAAO,CAAC,qBAAqB,CAAC,CAuGhC;AAKD;;;;GAIG;AACH,wBAAsB,UAAU,CAAC,MAAM,EAAE,gBAAgB,EAAE,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,GAAG,OAAO,CAAC,GAAG,CAAC,MAAM,EAAE,SAAS,EAAE,CAAC,CAAC,CASnL;AAED;;;;;;;;;GASG;AACH,wBAAsB,aAAa,CACjC,MAAM,EAAE,gBAAgB,EACxB,QAAQ,EAAE,WAAW,CAAC,MAAM,EAAE;IAAE,UAAU,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAA;CAAE,CAAC,EACrF,IAAI,CAAC,EAAE,WAAW,CAAC,MAAM,EAAE,SAAS,SAAS,EAAE,CAAC,GAC/C,OAAO,CAAC,iBAAiB,EAAE,CAAC,CAqB9B"}

package/dist/clickhouse/plan/deep.js

@@ -18,10 +18,15 @@
  * server's, that copy is what is reported, with the server in `observedOn`,
  * which the drift report prints as `seen on`.
  *
- * Where the profile manages access, the grants an apply would give or take
- * from each declared grantee are reported as `pending` (#3733), the same
- * statements `chant sql plan` plans (SQLCH273, SQLCH274), so a privilege
- * granted or revoked by hand after an approval moves the plan digest.
+ * Where the profile manages access, each grant declaration is read as
+ * `grants.<grantee>.<atom>` (#4582): a privilege or role it declares that the
+ * grantee does not hold (revoked by hand, SQLCH273) is `absent` drift on that
+ * declaration. A grant declaration whose grantee the server does not have is
+ * not read here; the thin diff reports it missing. A privilege a grantee holds
+ * that no declaration gives (granted by hand, SQLCH274) belongs to no one
+ * declaration, so it is reported as `pending` (#3733) with every statement an
+ * apply would send that grantee, as `chant sql plan` plans them. Either way a
+ * privilege granted or revoked by hand after an approval moves the plan digest.
  */
 import { deepObservation, } from "@intentius/chant/deep-observation";
 import { bindClickHouse, classifyClickHouseFailure } from "../live/bind.js";
@@ -31,12 +36,54 @@ import { sqlString } from "../apply/statements.js";
 import { stripMarkerFromStatement } from "../ownership.js";
 import { database, dictionary, func, policy, quota, role, settingsProfile, table, user, view, CLICKHOUSE_ENTITY_TYPES } from "../entities.js";
 import { canonicalObject, grantsObject, objectKey } from "./normalize.js";
-import { grantStatement, grantsByGrantee, revokeStatement } from "../access.js";
+import { atomKey, declaredGrantAtoms, grantStatement, grantsByGrantee, holdsAtom, revokeStatement } from "../access.js";
 import { renderFor } from "../topology.js";
 // `concurrently` is how a Postgres index is created, not a property of it.
 const PRUNED = new Set(["ddl", "source", "lineage", "reads", "to", "orReplace", "ifNotExists", "concurrently"]);
+/** What a held grant atom reads as, on both sides of the diff. */
+const GRANTED = "granted";
+/**
+ * A grant declaration's tree as the diff compares it (#4582):
+ * `{ grants: { <grantee>: { <atom>: "granted" } } }`, each atom as the
+ * declaration spells it. The reader writes the live side in the same shape,
+ * with the atoms the grantee holds. Undefined when the statement does not
+ * parse as a grant.
+ */
+export function declaredGrantTree(ddl) {
+    try {
+        const grants = {};
+        for (const { grantee, key } of declaredGrantAtoms(ddl))
+            (grants[grantee] ?? (grants[grantee] = {}))[key] = GRANTED;
+        return { grants };
+    }
+    catch {
+        return undefined;
+    }
+}
+/**
+ * A grant declaration's live tree (#4582): each atom it declares that the
+ * grantee holds, keyed as {@link declaredGrantTree} keys it. Undefined when
+ * the server does not have one of its grantees.
+ */
+export function liveGrantTree(ddl, held, defaultDatabase) {
+    const grants = {};
+    for (const { grantee, key, atom } of declaredGrantAtoms(ddl, defaultDatabase)) {
+        const have = held.get(grantee);
+        if (!have)
+            return undefined;
+        if (holdsAtom(have, atom))
+            (grants[grantee] ?? (grants[grantee] = {}))[key] = GRANTED;
+    }
+    return Object.keys(grants).length > 0 ? { grants } : {};
+}
 export const sqlDeepNormalizationHooks = {
     prune: (node) => PRUNED.has(node.pattern.split(/[.[]/)[0]),
+    // A grant declaration is compared atom by atom (#4582); the reader writes the live side in this shape.
+    prepare: (tree, { entityType, side }) => {
+        if (entityType !== CLICKHOUSE_ENTITY_TYPES.grant || side !== "declared" || typeof tree.ddl !== "string")
+            return tree;
+        return declaredGrantTree(tree.ddl) ?? tree;
+    },
 };
 function liveProps(o) {
     const tag = o.type === CLICKHOUSE_ENTITY_TYPES.database
@@ -235,9 +282,11 @@ export async function observeResourcesDeep(options) {
         return deepObservation({}, unobserved);
     }
     const pending = [];
+    let held;
     if (target.access === true) {
         try {
-            pending.push(...(await pendingGrants(target, options.entities)));
+            held = await heldGrants(target, options.entities);
+            pending.push(...(await pendingGrants(target, options.entities, held)));
         }
         catch (err) {
             const why = classifyClickHouseFailure(err);
@@ -259,13 +308,18 @@ export async function observeResourcesDeep(options) {
             continue;
         }
         if (entity.entityType === CLICKHOUSE_ENTITY_TYPES.grant) {
-            if (unobserved[name])
+            if (unobserved[name] || !held)
                 continue;
-            unobserved[name] = {
-                type: entity.entityType,
-                reason: "unsupported-kind",
-                detail: "a grant is compared as part of its grantees' grants: what an apply would grant or revoke is listed as pending (SQLCH273, SQLCH274)",
-            };
+            const ddl = String(entity.props.ddl ?? "");
+            try {
+                const properties = liveGrantTree(ddl, held, target.defaultDatabase);
+                // A grantee the server does not have: the thin diff reports the declaration missing.
+                if (properties)
+                    resources[name] = { type: entity.entityType, physicalId: `grants ${[...new Set(declaredGrantAtoms(ddl).map((a) => a.grantee))].join(", ")}`, properties };
+            }
+            catch (err) {
+                unobserved[name] = { type: entity.entityType, reason: "read-failed", detail: `the grant does not parse: ${err.message}` };
+            }
             continue;
         }
         const props = entity.props;
@@ -310,36 +364,53 @@ export async function observeResourcesDeep(options) {
     }
     return deepObservation(resources, unobserved, pending);
 }
+const grantDeclarations = (entities) => grantsByGrantee([...entities].map(([name, e]) => ({ export: name, type: e.entityType, ddl: String(e.props.ddl ?? "") })));
 /**
- * The grants an apply would give or take from each declared grantee (#3733),
- * as `chant sql plan` compares them: the declared grants against what
- * `SHOW GRANTS FOR` prints, atom by atom. One change per grantee, its
- * REVOKEs before its GRANTs as the applier sends them, with the grant
- * declarations behind it. A grantee the server does not hold yet is given
- * every declared grant.
+ * What the server holds for each declared grantee, as `SHOW GRANTS FOR`
+ * prints it, folded into atoms. A grantee the server does not have is left
+ * out.
  */
-export async function pendingGrants(target, entities) {
-    const declared = grantsByGrantee([...entities].map(([name, e]) => ({ export: name, type: e.entityType, ddl: String(e.props.ddl ?? "") })));
+export async function heldGrants(target, entities) {
+    const declared = grantDeclarations(entities);
     if (declared.length === 0)
-        return [];
+        return new Map();
     const live = await readLiveAccess(target, declared.map((g) => ({ kind: "grants", name: g.grantee })));
-    const held = new Map(live.filter((o) => o.type === CLICKHOUSE_ENTITY_TYPES.grant).map((o) => [o.name, grantsObject(o.statement, o.name, target.defaultDatabase).access ?? {}]));
+    return new Map(live
+        .filter((o) => o.type === CLICKHOUSE_ENTITY_TYPES.grant)
+        .map((o) => [o.name, Object.values(grantsObject(o.statement, o.name, target.defaultDatabase).access ?? {}).map((json) => JSON.parse(json))]));
+}
+/**
+ * The grantees holding a privilege or role no declaration gives them
+ * (#3733), as `chant sql plan` compares them: the declared grants against
+ * what `SHOW GRANTS FOR` prints, atom by atom. One change per such grantee,
+ * every statement an apply would send it, its REVOKEs before its GRANTs as
+ * the applier sends them, with the grant declarations behind it. A grantee
+ * that only lacks declared grants has nothing pending: each declaration
+ * reports those as `absent` drift of its own (#4582). A grantee the server
+ * does not have is the thin diff's missing.
+ */
+export async function pendingGrants(target, entities, held) {
+    const declared = grantDeclarations(entities);
+    if (declared.length === 0)
+        return [];
+    const live = held ?? (await heldGrants(target, entities));
     const atom = (json) => JSON.parse(json);
     const out = [];
     for (const g of declared) {
+        const atoms = live.get(g.grantee);
+        if (!atoms)
+            continue;
+        const have = Object.fromEntries(atoms.map((a) => [atomKey(a), JSON.stringify(a)]));
         const want = grantsObject(g.ddl, g.grantee, target.defaultDatabase).access ?? {};
-        const have = held.get(g.grantee) ?? {};
-        const statements = [
-            ...Object.keys(have)
-                .filter((k) => !(k in want))
-                .map((k) => revokeStatement(atom(have[k]), g.grantee)),
-            ...Object.keys(want)
-                .filter((k) => !(k in have))
-                .map((k) => grantStatement(atom(want[k]), g.grantee)),
-        ];
-        if (statements.length === 0)
+        const revokes = Object.keys(have)
+            .filter((k) => !(k in want))
+            .map((k) => revokeStatement(atom(have[k]), g.grantee));
+        if (revokes.length === 0)
             continue;
-        out.push({ subject: `grants ${g.grantee}`, change: statements.join("; "), entities: [...g.exports].sort() });
+        const grants = Object.keys(want)
+            .filter((k) => !(k in have))
+            .map((k) => grantStatement(atom(want[k]), g.grantee));
+        out.push({ subject: `grants ${g.grantee}`, change: [...revokes, ...grants].join("; "), entities: [...g.exports].sort() });
     }
     return out;
 }