@intentius/chant 0.101.0 → 0.104.0

package/src/op/activities/apply.test.ts

@@ -1,7 +1,7 @@
 import { describe, test, expect } from "vitest";
 import { applyResult } from "../../apply";
 import { defaultOutput, nativeApply, compensateApply, hasNativeRollback } from "./apply";
-import type { K8sApplier, AzureApplier, GcpApplier, FlyApplier, AwsApplier, AwsRollback } from "./apply";
+import type { K8sApplier, AzureApplier, GcpApplier, FlyApplier, GrafanaApplier, ClickHouseApplier, PostgresApplier, AwsApplier, AwsRollback } from "./apply";
 
 /**
  * The kubectl branch moved to the k8s lexicon in chant #1075, the arm branch to
@@ -415,6 +415,189 @@ describe("nativeApply: fly dispatches to the fly lexicon (chant #1449)", () => {
   });
 });
 
+describe("nativeApply: grafana dispatches to the grafana lexicon (chant #3011)", () => {
+  /** Records what the applier was handed, and reports an empty envelope. */
+  const spy = (): { calls: Array<Parameters<GrafanaApplier>[0]>; applier: GrafanaApplier } => {
+    const calls: Array<Parameters<GrafanaApplier>[0]> = [];
+    const applier: GrafanaApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  /** nativeApply with only the grafana applier injected. */
+  const applyGrafana = (args: Parameters<typeof nativeApply>[0], applier: GrafanaApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the index path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyGrafana({ target: "grafana", env: "prod", output: "dist/grafana.json" }, applier);
+    // env selects grafana.profiles.<env>; the ownership marker is read from
+    // chant.config.ts inside grafanaApply, so neither stack nor
+    // ownershipEnv crosses this seam.
+    expect(calls).toEqual([{ indexPath: "dist/grafana.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated ask the grafana applier to prune", async () => {
+    for (const deleteMode of ["owned-only", "gated"] as const) {
+      const { calls, applier } = spy();
+      await applyGrafana({ target: "grafana", env: "prod", deleteMode }, applier);
+      expect(calls[0].prune).toBe(true);
+    }
+  });
+
+  test("never (and the default) do not prune", async () => {
+    const explicit = spy();
+    await applyGrafana({ target: "grafana", env: "prod", deleteMode: "never" }, explicit.applier);
+    expect(explicit.calls[0].prune).toBe(false);
+
+    const defaulted = spy();
+    await applyGrafana({ target: "grafana", env: "prod" }, defaulted.applier);
+    expect(defaulted.calls[0].prune).toBe(false);
+  });
+
+  test("defaults the index path to dist/grafana.json", async () => {
+    const { calls, applier } = spy();
+    await applyGrafana({ target: "grafana", env: "prod" }, applier);
+    expect(calls[0].indexPath).toBe("dist/grafana.json");
+    expect(defaultOutput("grafana")).toBe("dist/grafana.json");
+  });
+
+  test("counts are preserved from the applier's envelope, not-prunable kinds included", async () => {
+    const applier: GrafanaApplier = async () =>
+      applyResult(
+        [
+          { kind: "Folder", name: "team-a", action: "created" },
+          { kind: "Dashboard", name: "api", action: "updated" },
+          { kind: "Dashboard", name: "db", action: "unchanged" },
+        ],
+        [{ kind: "Dashboard", name: "old", deleted: true }],
+        [{ kind: "LibraryPanel", name: "*", reason: "not-prunable", detail: "library panels carry no labels" }],
+      );
+    const result = await applyGrafana({ target: "grafana", env: "prod" }, applier);
+    expect(result).toEqual({ applied: 3, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real grafana lexicon's grafanaApply", async () => {
+    // An index path that does not exist fails inside grafanaApply's own read,
+    // reachable only if the dynamic import found the lexicon, and before any
+    // binding or HTTP call.
+    const err = await nativeApply({
+      target: "grafana",
+      env: "prod",
+      output: "/nonexistent/chant-3011-grafana.json",
+    }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
+describe("nativeApply: clickhouse dispatches to the sql lexicon (chant #3208)", () => {
+  const spy = (): { calls: Array<Parameters<ClickHouseApplier>[0]>; applier: ClickHouseApplier } => {
+    const calls: Array<Parameters<ClickHouseApplier>[0]> = [];
+    const applier: ClickHouseApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  const applyClickHouse = (args: Parameters<typeof nativeApply>[0], applier: ClickHouseApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the build path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyClickHouse({ target: "clickhouse", env: "prod", output: "dist/schema.json" }, applier);
+    expect(calls).toEqual([{ buildPath: "dist/schema.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated prune; never and the default do not", async () => {
+    for (const [deleteMode, prune] of [["owned-only", true], ["gated", true], ["never", false], [undefined, false]] as const) {
+      const { calls, applier } = spy();
+      await applyClickHouse({ target: "clickhouse", env: "prod", ...(deleteMode ? { deleteMode } : {}) }, applier);
+      expect(calls[0].prune).toBe(prune);
+    }
+  });
+
+  test("defaults the build path to dist/schema.json", async () => {
+    const { calls, applier } = spy();
+    await applyClickHouse({ target: "clickhouse", env: "prod" }, applier);
+    expect(calls[0].buildPath).toBe("dist/schema.json");
+    expect(defaultOutput("clickhouse")).toBe("dist/schema.json");
+  });
+
+  test("counts come from the envelope, a refused rebuild among the not-attempted", async () => {
+    const applier: ClickHouseApplier = async () =>
+      applyResult(
+        [
+          { kind: "ClickHouse::Database", name: "shop", action: "unchanged" },
+          { kind: "ClickHouse::Table", name: "shop.users", action: "updated" },
+        ],
+        [{ kind: "ClickHouse::Table", name: "shop.old", deleted: true }],
+        [{ kind: "ClickHouse::Table", name: "shop.events", reason: "unsupported-kind", detail: "needs a rebuild" }],
+      );
+    expect(await applyClickHouse({ target: "clickhouse", env: "prod" }, applier)).toEqual({ applied: 2, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real sql lexicon's clickhouseApply", async () => {
+    const err = await nativeApply({ target: "clickhouse", env: "prod", output: "/nonexistent/chant-3208-schema.json" }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
+describe("nativeApply: postgres dispatches to the sql lexicon (chant #3280)", () => {
+  const spy = (): { calls: Array<Parameters<PostgresApplier>[0]>; applier: PostgresApplier } => {
+    const calls: Array<Parameters<PostgresApplier>[0]> = [];
+    const applier: PostgresApplier = async (args) => {
+      calls.push(args);
+      return applyResult([]);
+    };
+    return { calls, applier };
+  };
+  const applyPostgres = (args: Parameters<typeof nativeApply>[0], applier: PostgresApplier) =>
+    nativeApply(args, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, undefined, applier);
+
+  test("output maps to the build path and env to the environment, and nothing else is passed", async () => {
+    const { calls, applier } = spy();
+    await applyPostgres({ target: "postgres", env: "prod", output: "dist/schema.json" }, applier);
+    expect(calls).toEqual([{ buildPath: "dist/schema.json", environment: "prod", prune: false }]);
+  });
+
+  test("owned-only and gated prune; never and the default do not", async () => {
+    for (const [deleteMode, prune] of [["owned-only", true], ["gated", true], ["never", false], [undefined, false]] as const) {
+      const { calls, applier } = spy();
+      await applyPostgres({ target: "postgres", env: "prod", ...(deleteMode ? { deleteMode } : {}) }, applier);
+      expect(calls[0].prune).toBe(prune);
+    }
+  });
+
+  test("defaults the build path to dist/schema.json", async () => {
+    const { calls, applier } = spy();
+    await applyPostgres({ target: "postgres", env: "prod" }, applier);
+    expect(calls[0].buildPath).toBe("dist/schema.json");
+    expect(defaultOutput("postgres")).toBe("dist/schema.json");
+  });
+
+  test("counts come from the envelope, a refused expand-and-contract change among the not-attempted", async () => {
+    const applier: PostgresApplier = async () =>
+      applyResult(
+        [
+          { kind: "Postgres::Schema", name: "app", action: "unchanged" },
+          { kind: "Postgres::Table", name: "app.users", action: "updated" },
+        ],
+        [{ kind: "Postgres::Table", name: "app.old", deleted: true }],
+        [{ kind: "Postgres::Table", name: "app.orders", reason: "unsupported-kind", detail: "SQLPG205 Rename a column" }],
+      );
+    expect(await applyPostgres({ target: "postgres", env: "prod" }, applier)).toEqual({ applied: 2, pruned: 1, notAttempted: 1 });
+  });
+
+  test("with nothing injected it resolves the real sql lexicon's postgresApply", async () => {
+    const err = await nativeApply({ target: "postgres", env: "prod", output: "/nonexistent/chant-3280-schema.json" }).catch((e: unknown) => e);
+    expect(String(err)).toMatch(/ENOENT|no such file/);
+    expect(String(err)).not.toMatch(/could not be loaded/);
+  });
+});
+
 describe("nativeApply: cloudformation dispatches to the aws lexicon (chant #1449)", () => {
   /** Records what the applier was handed, and reports a settled create. */
   const spy = (): { calls: Array<Parameters<AwsApplier>[0]>; applier: AwsApplier } => {
@@ -515,11 +698,11 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
     expect(result).toEqual({ command: "echo custom-rollback" });
   });
 
-  test("kubectl / kustomize / arm / gcp / fly without a command throw — the defensive branch (#1449)", async () => {
+  test("kubectl / kustomize / arm / gcp / fly / grafana / clickhouse / postgres without a command throw — the defensive branch (#1449)", async () => {
     // Unreachable from a built ApplyOp, which refuses this combination at
     // build time. A hand-assembled op that reaches it fails loudly rather than
     // returning a result that could read as a revert.
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       const err = await compensateApply({ target, env: "prod" }).catch((e: unknown) => e);
       expect(String(err)).toMatch(`no automatic rollback for target "${target}"`);
       expect(String(err)).toMatch(/NOT\s+reverted/);
@@ -529,7 +712,7 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
 
   test("hasNativeRollback: cloudformation only", () => {
     expect(hasNativeRollback("cloudformation")).toBe(true);
-    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly"] as const) {
+    for (const target of ["kubectl", "kustomize", "arm", "gcp", "fly", "grafana", "clickhouse", "postgres"] as const) {
       expect(hasNativeRollback(target)).toBe(false);
     }
   });
@@ -557,11 +740,12 @@ describe("compensateApply: cloudformation rolls back through the aws lexicon (ch
 });
 
 describe('defaultOutput (target-aware apply output)', () => {
-  test('kubectl → dist (dir); cloudformation/arm → template.json (file); gcp → dist/gcp.yaml; fly → dist/fly.json', () => {
+  test('kubectl → dist (dir); cloudformation/arm → template.json (file); gcp → dist/gcp.yaml; fly → dist/fly.json; grafana → dist/grafana.json', () => {
     expect(defaultOutput('kubectl')).toBe('dist');
     expect(defaultOutput('cloudformation')).toBe('template.json');
     expect(defaultOutput('arm')).toBe('template.json');
     expect(defaultOutput('gcp')).toBe('dist/gcp.yaml');
     expect(defaultOutput('fly')).toBe('dist/fly.json');
+    expect(defaultOutput('grafana')).toBe('dist/grafana.json');
   });
 });

package/src/op/activities/apply.ts

@@ -21,6 +21,14 @@
  * per-resource `gcpApply` and the fly lexicon's `flyApply`, which never had a
  * CLI in the path to begin with: gcp maps each CNRM kind to its REST API
  * itself, and fly speaks the Machines API (flaps) directly, no flyctl.
+ * `grafana` joined later (#3011): the grafana lexicon's `grafanaApply`, which
+ * writes folders, library panels and dashboards over Grafana's HTTP API.
+ * `clickhouse` joined after it (#3208): the sql lexicon's `clickhouseApply`,
+ * which sends a ClickHouse server the CREATE and ALTER statements a build's
+ * classified changes need, over its HTTP interface. `postgres` joined after
+ * that (#3280): the sql lexicon's `postgresApply`, which sends a Postgres
+ * server the statements a build's classified changes need, grouped into
+ * transactions, with `CONCURRENTLY` statements outside them.
  * **The dispatcher stayed here**, because "which
  * mechanism applies this target" is not any one product's knowledge — and
  * because the activity keeps its name, its arguments and its place in
@@ -40,7 +48,7 @@ import { importLexiconPackage } from "../../lexicon-module";
 const execAsync = promisify(exec);
 
 /** The native apply mechanism for a target. */
-export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly";
+export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "gcp" | "fly" | "grafana" | "clickhouse" | "postgres";
 
 /**
  * How apply treats resources no longer declared.
@@ -52,7 +60,16 @@ export type ApplyTarget = "cloudformation" | "kubectl" | "arm" | "kustomize" | "
  *   ownership label (via the gcp lexicon's `gcpApply` — only kinds it can
  *   list; the rest are reported not-prunable), `fly` prunes machines by the
  *   metadata marker and the metadata-less types (volumes/ips/certs/secrets)
- *   app-scoped under a managed app (via the fly lexicon's `flyApply`), and
+ *   app-scoped under a managed app (via the fly lexicon's `flyApply`),
+ *   `grafana` prunes dashboards and folders by the ownership labels (via the
+ *   grafana lexicon's `grafanaApply`; library panels, Grafana 11 and a project
+ *   with no ownership stack are reported not-prunable), `clickhouse` drops
+ *   tables, views and databases whose comment carries the project's marker
+ *   (via the sql lexicon's `clickhouseApply`; a project with no ownership
+ *   stack is reported not-prunable), `postgres` drops the objects in the
+ *   declared schemas whose comment carries the project's marker (via the sql
+ *   lexicon's `postgresApply`; never an object another tool keeps, and a
+ *   project with no ownership stack is reported not-prunable), and
  *   `cloudformation` is bounded by the stack — which holds, because a
  *   resource CFN did not create is not in the stack.
  * - `gated` — same delete scope as `owned-only`, but an approval gate precedes
@@ -66,7 +83,11 @@ export interface NativeApplyArgs {
   target: ApplyTarget;
   /** Environment. What it means is per target: the CFN stack name on
    * `cloudformation`, the ARM resource group on `arm`, the chant environment
-   * on `kubectl`/`kustomize`. On `gcp` and `fly` it is a log label only — the
+   * on `kubectl`/`kustomize`, and on `grafana` the chant environment whose
+   * `grafana.profiles.<env>` names the Grafana to write to, and on
+   * `clickhouse` and `postgres` the chant environment whose
+   * `sql.profiles.<env>` names the server. On `gcp` and
+   * `fly` it is a log label only — the
    * gcp applier resolves the project (`GOOGLE_CLOUD_PROJECT` env / CNRM
    * annotation) and endpoint (`GCP_ENDPOINT_URL` env) itself, and the fly
    * applier resolves its endpoint (`FLY_FLAPS_BASE_URL` env) and token
@@ -74,7 +95,9 @@ export interface NativeApplyArgs {
   env: string;
   /** Built manifest/template path. Default per target ({@link defaultOutput}):
    * `dist` (a dir) for kubectl, `template.json` (a file) for
-   * CloudFormation/ARM, `dist/gcp.yaml` for gcp, `dist/fly.json` for fly. */
+   * CloudFormation/ARM, `dist/gcp.yaml` for gcp, `dist/fly.json` for fly,
+   * `dist/grafana.json` (the build index) for grafana, `dist/schema.json`
+   * (the sql lexicon's build output) for clickhouse and postgres. */
   output?: string;
   /** Delete handling. Default: never. */
   deleteMode?: DeleteMode;
@@ -182,6 +205,57 @@ export type FlyApplier = (
   signal?: AbortSignal,
 ) => Promise<ApplyResult>;
 
+/**
+ * The grafana lexicon's API applier, as this module needs to call it (#3011):
+ * `grafanaApply` composed with the lexicon's own `toApplyResult` projection,
+ * so what crosses this seam is core's versioned apply envelope (#1446).
+ *
+ * `environment` selects `grafana.profiles.<environment>` (else `GRAFANA_URL`
+ * with `GRAFANA_TOKEN`), the binding observe and export use. The ownership
+ * marker is not passed: `grafanaApply` reads `ownership` from the project's
+ * `chant.config.ts` itself, and a prune without a stack declines as
+ * not-prunable rather than delete another project's dashboards.
+ */
+export type GrafanaApplier = (
+  args: {
+    indexPath: string;
+    environment?: string;
+    prune?: boolean;
+  },
+  signal?: AbortSignal,
+) => Promise<ApplyResult>;
+
+/**
+ * The sql lexicon's ClickHouse applier, as this module needs to call it
+ * (#3208): `clickhouseApply` composed with the lexicon's own `toApplyResult`
+ * projection, so what crosses this seam is core's versioned apply envelope
+ * (#1446). A rebuild-class change rides it as NOT-ATTEMPTED.
+ *
+ * `environment` selects `sql.profiles.<environment>` (else `CLICKHOUSE_URL`),
+ * the binding observe and import use. The ownership marker is not passed:
+ * `clickhouseApply` reads `ownership` from the project's `chant.config.ts`.
+ */
+export type ClickHouseApplier = (
+  args: {
+    buildPath: string;
+    environment?: string;
+    prune?: boolean;
+  },
+  signal?: AbortSignal,
+) => Promise<ApplyResult>;
+
+/**
+ * The sql lexicon's Postgres applier, as this module needs to call it
+ * (#3280): `postgresApply` composed with the lexicon's own `toApplyResult`,
+ * the same seam as {@link ClickHouseApplier}. An expand-and-contract change
+ * and a rolled-back transaction's objects ride it as NOT-ATTEMPTED.
+ *
+ * `environment` selects `sql.profiles.<environment>` (else `POSTGRES_URL`).
+ * The ownership marker and the timeouts are not passed: `postgresApply`
+ * reads `ownership` and the profile from the project's `chant.config.ts`.
+ */
+export type PostgresApplier = ClickHouseApplier;
+
 /**
  * The aws lexicon's CloudFormation applier, as this module needs to call it
  * (#1449). Structural, like {@link K8sApplier} and {@link AzureApplier}.
@@ -363,6 +437,102 @@ async function loadFlyApplier(): Promise<FlyApplier> {
   return async (args, signal) => toApplyResult(await flyApply(args, signal));
 }
 
+/**
+ * Load the grafana lexicon's `grafanaApply` (#3011). Same variable-specifier
+ * trick as {@link loadK8sApplier}, for the same reason. The activities subpath,
+ * not the package root or `op/builders`: those hold the typed step builder,
+ * while the activity itself (and its `toApplyResult`) lives here.
+ */
+async function loadGrafanaApplier(): Promise<GrafanaApplier> {
+  const spec = "@intentius/chant-lexicon-grafana/op/activities";
+  type GrafanaModule = {
+    grafanaApply?: (args: Parameters<GrafanaApplier>[0], signal?: AbortSignal) => Promise<unknown>;
+    toApplyResult?: (result: unknown) => ApplyResult;
+  };
+  let mod: GrafanaModule;
+  try {
+    mod = (await importLexiconPackage(spec)) as GrafanaModule;
+  } catch (err) {
+    throw new Error(
+      `apply target "grafana" needs @intentius/chant-lexicon-grafana, which could not be loaded ` +
+        `(${err instanceof Error ? err.message : String(err)}). Grafana applies go through the grafana ` +
+        `lexicon's API applier (chant #2948); install the grafana lexicon and list it in chant.config.ts.`,
+    );
+  }
+  const { grafanaApply, toApplyResult } = mod;
+  if (typeof grafanaApply !== "function") {
+    throw new Error(
+      "the installed @intentius/chant-lexicon-grafana exports no grafanaApply — it predates chant #2948",
+    );
+  }
+  if (typeof toApplyResult !== "function") {
+    throw new Error(
+      "the installed @intentius/chant-lexicon-grafana exports no toApplyResult — it predates chant #2948",
+    );
+  }
+  return async (args, signal) => toApplyResult(await grafanaApply(args, signal));
+}
+
+/**
+ * Load the sql lexicon's `clickhouseApply` (#3208). Same variable-specifier
+ * trick as {@link loadK8sApplier}, for the same reason.
+ */
+async function loadClickHouseApplier(): Promise<ClickHouseApplier> {
+  const spec = "@intentius/chant-lexicon-sql/op/activities";
+  type SqlModule = {
+    clickhouseApply?: (args: Parameters<ClickHouseApplier>[0], signal?: AbortSignal) => Promise<unknown>;
+    toApplyResult?: (result: unknown) => ApplyResult;
+  };
+  let mod: SqlModule;
+  try {
+    mod = (await importLexiconPackage(spec)) as SqlModule;
+  } catch (err) {
+    throw new Error(
+      `apply target "clickhouse" needs @intentius/chant-lexicon-sql, which could not be loaded ` +
+        `(${err instanceof Error ? err.message : String(err)}). ClickHouse applies go through the sql ` +
+        `lexicon's applier (chant #3208); install the sql lexicon and list it in chant.config.ts.`,
+    );
+  }
+  const { clickhouseApply, toApplyResult } = mod;
+  if (typeof clickhouseApply !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-sql exports no clickhouseApply — it predates chant #3208");
+  }
+  if (typeof toApplyResult !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-sql exports no toApplyResult — it predates chant #3208");
+  }
+  return async (args, signal) => toApplyResult(await clickhouseApply(args, signal));
+}
+
+/**
+ * Load the sql lexicon's `postgresApply` (#3280). Same variable-specifier
+ * trick as {@link loadK8sApplier}, for the same reason.
+ */
+async function loadPostgresApplier(): Promise<PostgresApplier> {
+  const spec = "@intentius/chant-lexicon-sql/op/activities";
+  type SqlModule = {
+    postgresApply?: (args: Parameters<PostgresApplier>[0], signal?: AbortSignal) => Promise<unknown>;
+    toApplyResult?: (result: unknown) => ApplyResult;
+  };
+  let mod: SqlModule;
+  try {
+    mod = (await importLexiconPackage(spec)) as SqlModule;
+  } catch (err) {
+    throw new Error(
+      `apply target "postgres" needs @intentius/chant-lexicon-sql, which could not be loaded ` +
+        `(${err instanceof Error ? err.message : String(err)}). Postgres applies go through the sql ` +
+        `lexicon's applier (chant #3280); install the sql lexicon and list it in chant.config.ts.`,
+    );
+  }
+  const { postgresApply, toApplyResult } = mod;
+  if (typeof postgresApply !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-sql exports no postgresApply — it predates chant #3280");
+  }
+  if (typeof toApplyResult !== "function") {
+    throw new Error("the installed @intentius/chant-lexicon-sql exports no toApplyResult — it predates chant #3208");
+  }
+  return async (args, signal) => toApplyResult(await postgresApply(args, signal));
+}
+
 /**
  * Load the aws lexicon's `awsApply` (#1449). Same variable-specifier trick as
  * {@link loadK8sApplier}, for the same reason.
@@ -418,8 +588,11 @@ async function loadAwsRollback(): Promise<AwsRollback> {
  * manifests), so `dist`; kustomize's "output" is the kustomization DIRECTORY
  * the render reads. The file targets take the file their lexicon's build
  * conventionally emits: `template.json` for CloudFormation/ARM, `dist/gcp.yaml`
- * (the CNRM manifest) for gcp, `dist/fly.json` (the serialized plan) for fly.
- * Pure — exported for testing.
+ * (the CNRM manifest) for gcp, `dist/fly.json` (the serialized plan) for fly,
+ * `dist/grafana.json` (the index the grafana serializer writes, with the
+ * dashboard files beside it) for grafana, `dist/schema.json` (the sql
+ * lexicon's build output) for clickhouse and postgres. Pure — exported for
+ * testing.
  */
 export function defaultOutput(target: ApplyTarget): string {
   switch (target) {
@@ -430,6 +603,11 @@ export function defaultOutput(target: ApplyTarget): string {
       return "dist/gcp.yaml";
     case "fly":
       return "dist/fly.json";
+    case "grafana":
+      return "dist/grafana.json";
+    case "clickhouse":
+    case "postgres":
+      return "dist/schema.json";
     default:
       return "template.json";
   }
@@ -469,7 +647,9 @@ function collapseEnvelope(envelope: ApplyResult, label: string): NativeApplyResu
  * Apply declared source to the cloud via the target's native mechanism.
  * Deletes (when enabled) ride that mechanism's own delete path — marker-scoped
  * on `kubectl`, tag-scoped on `arm`, label-scoped on `gcp`, marker- and
- * app-scoped on `fly`, and stack-scoped on `cloudformation`, where the deploy
+ * app-scoped on `fly`, label-scoped on `grafana`, comment-marker-scoped on
+ * `clickhouse` and `postgres`, and stack-scoped on
+ * `cloudformation`, where the deploy
  * itself removes resources dropped from the template and `deleteMode` changes
  * nothing: a resource CFN did not create is not in the stack. See
  * {@link DeleteMode}.
@@ -477,7 +657,7 @@ function collapseEnvelope(envelope: ApplyResult, label: string): NativeApplyResu
  * The appliers are injectable so this dispatcher can be tested without the
  * product lexicons present; production resolves them through
  * {@link loadK8sApplier} / {@link loadAzureApplier} / {@link loadAwsApplier} /
- * {@link loadGcpApplier} / {@link loadFlyApplier}.
+ * {@link loadGcpApplier} / {@link loadFlyApplier} / {@link loadGrafanaApplier}.
  */
 export async function nativeApply(
   args: NativeApplyArgs,
@@ -488,6 +668,9 @@ export async function nativeApply(
   awsApplier?: AwsApplier,
   gcpApplier?: GcpApplier,
   flyApplier?: FlyApplier,
+  grafanaApplier?: GrafanaApplier,
+  clickhouseApplier?: ClickHouseApplier,
+  postgresApplier?: PostgresApplier,
 ): Promise<NativeApplyResult> {
   const output = args.output ?? defaultOutput(args.target);
   const deleteMode = args.deleteMode ?? "never";
@@ -568,6 +751,45 @@ export async function nativeApply(
     return collapseEnvelope(envelope, args.env);
   }
 
+  if (args.target === "grafana") {
+    // grafana (#3011): the grafana lexicon's API applier. Unlike gcp and fly,
+    // env is not just a label here: it selects `grafana.profiles.<env>`, the
+    // Grafana observe and export already read. The ownership marker comes from
+    // the project's chant.config.ts inside grafanaApply.
+    const apply = grafanaApplier ?? (await loadGrafanaApplier());
+    const envelope = await apply(
+      { indexPath: output, environment: args.env, prune: deleteMode !== "never" },
+      signal,
+    );
+    // No binding or a refused token rides the envelope as NOT-ATTEMPTED for
+    // every resource, as do library panels and anything else prune could
+    // not consider.
+    return collapseEnvelope(envelope, args.env);
+  }
+
+  if (args.target === "clickhouse") {
+    // clickhouse (#3208): the sql lexicon's applier. env selects
+    // `sql.profiles.<env>`, the server observe and import read; the marker
+    // comes from the project's chant.config.ts inside clickhouseApply.
+    const apply = clickhouseApplier ?? (await loadClickHouseApplier());
+    const envelope = await apply({ buildPath: output, environment: args.env, prune: deleteMode !== "never" }, signal);
+    // A refused rebuild and a column drop an additive apply withholds ride the
+    // envelope as NOT-ATTEMPTED, so an Op can gate on them.
+    return collapseEnvelope(envelope, args.env);
+  }
+
+  if (args.target === "postgres") {
+    // postgres (#3280): the sql lexicon's applier. env selects
+    // `sql.profiles.<env>`; the marker and the lock and statement timeouts
+    // come from the project's chant.config.ts inside postgresApply.
+    const apply = postgresApplier ?? (await loadPostgresApplier());
+    const envelope = await apply({ buildPath: output, environment: args.env, prune: deleteMode !== "never" }, signal);
+    // A refused expand-and-contract change, a column drop an additive apply
+    // withholds, and the objects of a rolled-back transaction ride the
+    // envelope as NOT-ATTEMPTED, so an Op can gate on them.
+    return collapseEnvelope(envelope, args.env);
+  }
+
   // cloudformation (#1449): the aws lexicon's native applier. env is the stack
   // name and output the template path; endpoint resolution (#1694) and
   // capability derivation (#980) are awsApply's own, so nothing else is passed.