db-agent-kit 0.2.0__py3-none-any.whl

db_agent/engines/sqlserver/rdl.py

@@ -0,0 +1,269 @@
+"""Parse SSRS report definitions (RDL 2008, 2010, 2016) and shared datasets/data sources.
+
+Namespace-agnostic: element names are compared without the namespace, so one code path handles
+every schema version. Connection strings are reduced to server and database names; passwords
+are never kept (only a flag that one was present).
+"""
+
+from __future__ import annotations
+
+import re
+from dataclasses import dataclass, field
+from pathlib import Path
+from typing import Any
+
+from lxml import etree
+
+RDL_NAMESPACES = {
+    "http://schemas.microsoft.com/sqlserver/reporting/2016/01/reportdefinition": "2016",
+    "http://schemas.microsoft.com/sqlserver/reporting/2010/01/reportdefinition": "2010",
+    "http://schemas.microsoft.com/sqlserver/reporting/2008/01/reportdefinition": "2008",
+    "http://schemas.microsoft.com/sqlserver/reporting/2005/01/reportdefinition": "2005",
+}
+INTERACTIVE_ELEMENTS = {"Chart", "GaugePanel", "Map", "Indicator", "Sparkline", "DataBar", "CustomReportItem"}
+LAYOUT_ELEMENTS = {"Tablix", "Textbox", "Image", "Rectangle", "Line", "Subreport"} | INTERACTIVE_ELEMENTS
+NON_SQL_PROVIDERS = {"OLEDB-MD", "SSAS", "ESSBASE", "SAPBW", "XML", "SHAREPOINTLIST", "ODATA", "AZUREBLOB"}
+LOOKUP_RE = re.compile(r"\b(Lookup|LookupSet|MultiLookup)\s*\(", re.IGNORECASE)
+CODE_CALL_RE = re.compile(r"\bCode\.\w+", re.IGNORECASE)
+
+
+@dataclass
+class DataSource:
+    name: str
+    shared_reference: str | None = None
+    provider: str | None = None
+    server: str | None = None
+    database: str | None = None
+    integrated_security: bool | None = None
+    embedded_credentials: bool = False
+
+
+@dataclass
+class DataSet:
+    name: str
+    data_source: str | None = None
+    command_type: str = "Text"  # Text | StoredProcedure | TableDirect
+    command_text: str = ""
+    query_parameters: list[dict[str, str]] = field(default_factory=list)
+    shared_dataset_reference: str | None = None
+    field_count: int = 0
+
+
+@dataclass
+class Report:
+    file: str
+    name: str
+    folder: str
+    path: str  # /Folder/Name, the form SSRS uses
+    rdl_version: str = "unknown"
+    data_sources: list[DataSource] = field(default_factory=list)
+    datasets: list[DataSet] = field(default_factory=list)
+    parameters: list[dict[str, Any]] = field(default_factory=list)
+    subreports: list[str] = field(default_factory=list)
+    drillthrough: list[str] = field(default_factory=list)
+    has_custom_code: bool = False
+    custom_code_lines: int = 0
+    custom_assemblies: bool = False
+    embedded_images: int = 0
+    expressions: int = 0
+    complex_expressions: int = 0
+    layout: dict[str, int] = field(default_factory=dict)
+    has_page_header_footer: bool = False
+    toggles: int = 0
+    parse_error: str | None = None
+
+
+def _local(el: etree._Element) -> str:
+    return etree.QName(el).localname if isinstance(el.tag, str) else ""
+
+
+def _children(el: etree._Element, name: str) -> list[etree._Element]:
+    return [c for c in el if _local(c) == name]
+
+
+def _child(el: etree._Element, name: str) -> etree._Element | None:
+    for c in el:
+        if _local(c) == name:
+            return c
+    return None
+
+
+def _text(el: etree._Element | None, name: str | None = None) -> str | None:
+    node = _child(el, name) if (el is not None and name) else el
+    if node is None or node.text is None:
+        return None
+    return node.text.strip()
+
+
+def _iter(el: etree._Element, name: str):
+    for n in el.iter():
+        if _local(n) == name:
+            yield n
+
+
+def _parse_connect_string(cs: str | None) -> tuple[str | None, str | None, bool | None, bool]:
+    """Return (server, database, integrated_security, had_password). The string is not kept."""
+    if not cs or cs.strip().startswith("="):
+        return None, None, None, False  # an expression: cannot be resolved statically
+    pairs = {k.strip().lower(): v.strip() for k, _, v in (p.partition("=") for p in cs.split(";")) if k.strip()}
+    server = pairs.get("data source") or pairs.get("server") or pairs.get("address") or pairs.get("addr")
+    database = pairs.get("initial catalog") or pairs.get("database")
+    integ = pairs.get("integrated security") or pairs.get("trusted_connection")
+    integrated = None if integ is None else integ.lower() in ("true", "yes", "sspi")
+    had_pw = any(k in pairs for k in ("password", "pwd")) and bool(pairs.get("password") or pairs.get("pwd"))
+    return server, database, integrated, had_pw
+
+
+def _parse_datasources(root: etree._Element) -> list[DataSource]:
+    out: list[DataSource] = []
+    holder = _child(root, "DataSources")
+    for ds in _children(holder, "DataSource") if holder is not None else []:
+        item = DataSource(name=ds.get("Name", ""))
+        item.shared_reference = _text(ds, "DataSourceReference")
+        conn = _child(ds, "ConnectionProperties")
+        if conn is not None:
+            item.provider = _text(conn, "DataProvider")
+            item.server, item.database, item.integrated_security, item.embedded_credentials = _parse_connect_string(
+                _text(conn, "ConnectString")
+            )
+            if _text(conn, "IntegratedSecurity"):
+                item.integrated_security = _text(conn, "IntegratedSecurity").lower() == "true"
+        out.append(item)
+    return out
+
+
+def _parse_dataset(ds: etree._Element) -> DataSet:
+    item = DataSet(name=ds.get("Name", ""))
+    q = _child(ds, "Query")
+    if q is not None:
+        item.data_source = _text(q, "DataSourceName")
+        item.command_type = _text(q, "CommandType") or "Text"
+        item.command_text = _text(q, "CommandText") or ""
+        qp = _child(q, "QueryParameters")
+        for p in _children(qp, "QueryParameter") if qp is not None else []:
+            item.query_parameters.append({"name": p.get("Name", ""), "value": _text(p, "Value") or ""})
+    shared = _child(ds, "SharedDataSet")
+    if shared is not None:
+        item.shared_dataset_reference = _text(shared, "SharedDataSetReference")
+    fields = _child(ds, "Fields")
+    item.field_count = len(_children(fields, "Field")) if fields is not None else 0
+    return item
+
+
+def _count_expressions(root: etree._Element) -> tuple[int, int]:
+    total = complex_ = 0
+    for el in root.iter():
+        if not isinstance(el.tag, str) or el.text is None:
+            continue
+        t = el.text.strip()
+        if t.startswith("=") and _local(el) not in ("CommandText", "Code"):
+            total += 1
+            if CODE_CALL_RE.search(t) or LOOKUP_RE.search(t):
+                complex_ += 1
+    return total, complex_
+
+
+def parse_rdl_bytes(data: bytes, file: str, base: Path | None = None) -> Report:
+    p = Path(file)
+    rel = p.relative_to(base) if base and p.is_absolute() and str(p).startswith(str(base)) else p
+    folder = "/" + "/".join(rel.parent.parts) if rel.parent.parts else "/"
+    name = rel.stem
+    path = (folder.rstrip("/") + "/" + name) if folder != "/" else "/" + name
+    rep = Report(file=str(rel), name=name, folder=folder, path=path)
+    try:
+        parser = etree.XMLParser(resolve_entities=False, no_network=True, huge_tree=False)
+        root = etree.fromstring(data, parser)
+    except etree.XMLSyntaxError as exc:
+        rep.parse_error = f"invalid XML: {str(exc)[:120]}"
+        return rep
+    if _local(root) != "Report":
+        rep.parse_error = f"not a report definition (root element {_local(root)})"
+        return rep
+    rep.rdl_version = RDL_NAMESPACES.get(etree.QName(root).namespace or "", "unknown")
+    rep.data_sources = _parse_datasources(root)
+    ds_holder = _child(root, "DataSets")
+    rep.datasets = [_parse_dataset(d) for d in _children(ds_holder, "DataSet")] if ds_holder is not None else []
+    params = _child(root, "ReportParameters")
+    for rp in _children(params, "ReportParameter") if params is not None else []:
+        default = None
+        dv = _child(rp, "DefaultValue")
+        if dv is not None:
+            vals = _child(dv, "Values")
+            first = _children(vals, "Value")[0] if vals is not None and _children(vals, "Value") else None
+            default = first.text.strip() if first is not None and first.text else None
+        rep.parameters.append(
+            {
+                "name": rp.get("Name", ""),
+                "type": _text(rp, "DataType"),
+                "prompt": _text(rp, "Prompt"),
+                "multi_value": (_text(rp, "MultiValue") or "").lower() == "true",
+                "hidden": (_text(rp, "Hidden") or "").lower() == "true",
+                "default": default,
+                "default_from_query": _child(dv, "DataSetReference") is not None if dv is not None else False,
+            }
+        )
+    rep.subreports = [_text(s, "ReportName") or "" for s in _iter(root, "Subreport")]
+    rep.drillthrough = [_text(d, "ReportName") or "" for d in _iter(root, "Drillthrough")]
+    code = _child(root, "Code")
+    if code is not None and (code.text or "").strip():
+        rep.has_custom_code = True
+        rep.custom_code_lines = len([ln for ln in code.text.splitlines() if ln.strip()])
+    rep.custom_assemblies = _child(root, "CodeModules") is not None or _child(root, "Classes") is not None
+    rep.embedded_images = len(list(_iter(_child(root, "EmbeddedImages"), "EmbeddedImage"))) if _child(root, "EmbeddedImages") is not None else 0
+    rep.expressions, rep.complex_expressions = _count_expressions(root)
+    counts: dict[str, int] = {}
+    for el in root.iter():
+        n = _local(el)
+        if n in LAYOUT_ELEMENTS:
+            counts[n] = counts.get(n, 0) + 1
+    rep.layout = counts
+    rep.has_page_header_footer = any(True for _ in _iter(root, "PageHeader")) or any(True for _ in _iter(root, "PageFooter"))
+    rep.toggles = len(list(_iter(root, "ToggleItem")))
+    return rep
+
+
+def parse_rdl_file(path: Path, base: Path | None = None) -> Report:
+    try:
+        data = path.read_bytes()
+    except OSError as exc:
+        p = Path(path)
+        rel = p.relative_to(base) if base else p
+        return Report(file=str(rel), name=p.stem, folder="/", path="/" + p.stem, parse_error=f"cannot read file: {exc.strerror}")
+    return parse_rdl_bytes(data, str(path), base)
+
+
+def parse_shared_dataset_bytes(data: bytes) -> DataSet | None:
+    try:
+        root = etree.fromstring(data, etree.XMLParser(resolve_entities=False, no_network=True))
+    except etree.XMLSyntaxError:
+        return None
+    ds = _child(root, "DataSet")
+    return _parse_dataset(ds) if ds is not None else None
+
+
+def parse_shared_datasource_bytes(data: bytes) -> DataSource | None:
+    try:
+        root = etree.fromstring(data, etree.XMLParser(resolve_entities=False, no_network=True))
+    except etree.XMLSyntaxError:
+        return None
+    ds = DataSource(name="")
+    ds.provider = _text(root, "Extension")
+    cs = _text(root, "ConnectString")
+    ds.server, ds.database, ds.integrated_security, ds.embedded_credentials = _parse_connect_string(cs)
+    return ds
+
+
+def layout_hint(rep: Report) -> str:
+    """Hint only: 'paginated' if the report is tabular and printable, 'interactive' if it leans on
+    charts, gauges, maps or show/hide toggles, 'unknown' when it cannot be told."""
+    if rep.parse_error:
+        return "unknown"
+    if any(k in rep.layout for k in INTERACTIVE_ELEMENTS) or rep.toggles:
+        return "interactive"
+    if rep.layout.get("Tablix") or rep.has_page_header_footer:
+        return "paginated"
+    return "unknown"
+
+
+def non_sql_sources(rep: Report) -> list[str]:
+    return sorted({(d.provider or "").upper() for d in rep.data_sources if (d.provider or "").upper() in NON_SQL_PROVIDERS})

db_agent/engines/sqlserver/report.py

@@ -0,0 +1,120 @@
+"""Combine inventory, ssrs and validate outputs into one client-ready summary.html and workbook."""
+
+from __future__ import annotations
+
+import json
+from collections import Counter
+from datetime import date
+from importlib import resources
+from pathlib import Path
+from typing import Any
+
+from jinja2 import Environment, select_autoescape
+
+from . import __version__
+from .outputs import eos_info, order_workbook, update_sheet
+
+FOOTER = "Generated with db-agent. Need the upgrade and report move done for you at a fixed price? becloudready.com/sql-server"
+
+
+def _load(path: Path) -> Any:
+    return json.loads(path.read_text(encoding="utf-8")) if path.exists() else None
+
+
+def build_summary(out: Path, today: date | None = None) -> dict[str, Any]:
+    inv, risks = _load(out / "inventory.json"), _load(out / "risks.json") or []
+    ssrs, val = _load(out / "reports.json"), _load(out / "validation.json")
+    s: dict[str, Any] = {"generated": (today or date.today()).isoformat(), "version": __version__, "footer": FOOTER,
+                         "have_inventory": inv is not None, "have_ssrs": ssrs is not None, "have_validation": val is not None}
+    if inv:
+        user_dbs = [d for d in inv["databases"] if d["name"] not in ("master", "model", "msdb", "tempdb")]
+        s["server"] = inv["server"]
+        s["eos"] = eos_info(inv["server"]["product_version"], today)
+        s["db_count"] = len(user_dbs)
+        s["db_size_gb"] = round(sum((d["data_mb"] or 0) + (d["log_mb"] or 0) for d in user_dbs) / 1024, 1)
+        s["databases"] = user_dbs
+        s["risk_counts"] = dict(Counter(r["severity"] for r in risks))
+        grouped: dict[tuple[str, str], list[dict]] = {}
+        for r in risks:
+            grouped.setdefault((r["severity"], r["title"]), []).append(r)
+        order = {"high": 0, "medium": 1, "low": 2, "info": 3}
+        top = sorted(grouped.items(), key=lambda kv: (order[kv[0][0]], -len(kv[1])))[:10]
+        s["top_risks"] = [{"severity": k[0], "title": k[1], "count": len(v), "example": f"{v[0]['database']}: {v[0]['object']}".strip(": "),
+                           "detail": v[0]["detail"][:160], "doc": v[0]["doc"]} for k, v in top]
+        s["azure_blockers"] = sum(1 for r in risks if r.get("azure_sql_database_only"))
+        s["warnings"] = inv.get("warnings", [])
+    if ssrs:
+        reps = ssrs["reports"]
+        used = [r for r in reps if (r["runs_365"] or 0) > 0]
+        s["ssrs"] = {
+            "total": ssrs["report_count"], "counts": ssrs["classification_counts"], "used": len(used),
+            "unused": ssrs["report_count"] - len(used), "usage": ssrs["usage"], "subscriptions_known": ssrs["subscriptions_known"],
+            "top_used": sorted(used, key=lambda r: -(r["runs_365"] or 0))[:20],
+            "tables": ssrs["table_usage"][:15],
+            "hard": {
+                "custom_code": sum(1 for r in reps if r["custom_code"]), "subreports": sum(1 for r in reps if r["subreports"]),
+                "drillthrough": sum(1 for r in reps if r["drillthrough"]), "subscriptions": sum(1 for r in reps if r["subscriptions"]),
+                "custom_assemblies": sum(1 for r in reps if r["custom_assemblies"]), "parse_problems": sum(1 for r in reps if r["parse_error"] or r["ref_confidence"] == "low"),
+            },
+            "review": [r for r in reps if r["classification"] == "review"],
+            "retire": [r for r in reps if r["classification"] == "retire"],
+            "paginated_hint": sum(1 for r in reps if r["layout_hint"] == "paginated"),
+            "interactive_hint": sum(1 for r in reps if r["layout_hint"] == "interactive"),
+        }
+    if val:
+        s["validation"] = {"counts": dict(Counter(v["status"] for v in val)), "rows": val}
+    s["next_steps"] = _next_steps(s)
+    return s
+
+
+def _next_steps(s: dict[str, Any]) -> list[str]:
+    steps: list[str] = []
+    eos = s.get("eos")
+    if eos and eos.get("days") is not None:
+        if eos["days"] < 0:
+            steps.append(f"{eos['name']} is out of support. Pick the upgrade target and a date; Extended Security Updates are a stop-gap, not a plan.")
+        else:
+            steps.append(f"{eos['name']} loses support on {eos['date']}. Pick the upgrade target and schedule it before then.")
+    if s.get("risk_counts", {}).get("high"):
+        steps.append("Fix or plan around the high-severity risks first. They are features that are removed or not available in the target.")
+    if s.get("azure_blockers"):
+        steps.append("If the target is Azure SQL Database, review the risks marked 'Azure SQL Database only'. Managed Instance or SQL Server 2022 avoids most of them.")
+    ss = s.get("ssrs")
+    if ss:
+        if ss["counts"].get("retire"):
+            steps.append(f"Confirm the {ss['counts']['retire']} retire candidate(s) with their owners and drop them from the move.")
+        if ss["counts"].get("review"):
+            steps.append(f"Walk through the {ss['counts']['review']} review report(s). Each has a stated reason.")
+        if ss["counts"].get("move"):
+            steps.append(f"Start the move with the {ss['counts']['move']} plain report(s), then run `validate` to compare results.")
+        if (ss["usage"].get("log_window_days") or 0) < 365:
+            steps.append("Extend the SSRS execution log retention (ExecutionLogDaysKept) so the next run can prove which reports are unused.")
+    if s.get("have_ssrs") and not s.get("have_validation"):
+        steps.append("After the first reports are moved, run `validate` against the old and new servers.")
+    return steps
+
+
+def write_report(out: Path, today: date | None = None) -> list[str]:
+    s = build_summary(out, today)
+    tpl = resources.files("db_agent.engines.sqlserver").joinpath("templates/summary.html.j2").read_text(encoding="utf-8")
+    env = Environment(autoescape=select_autoescape(default=True, default_for_string=True))
+    (out / "summary.html").write_text(env.from_string(tpl).render(s=s), encoding="utf-8")
+    rows: list[dict[str, Any]] = [{"item": "Generated", "value": s["generated"]}]
+    if s.get("server"):
+        rows += [{"item": "SQL Server", "value": f"{s['server']['product_version']} {s['server']['edition']}"},
+                 {"item": "End of support", "value": s["eos"]["text"]},
+                 {"item": "User databases", "value": f"{s['db_count']} ({s['db_size_gb']} GB)"},
+                 {"item": "Risks", "value": ", ".join(f"{k}: {v}" for k, v in s["risk_counts"].items()) or "none"}]
+    if s.get("ssrs"):
+        c = s["ssrs"]["counts"]
+        rows += [{"item": "Reports", "value": s["ssrs"]["total"]}, {"item": "Move", "value": c.get("move", 0)},
+                 {"item": "Review", "value": c.get("review", 0)}, {"item": "Retire", "value": c.get("retire", 0)},
+                 {"item": "Used in last 365 days", "value": s["ssrs"]["used"]},
+                 {"item": "Usage log reaches back (days)", "value": s["ssrs"]["usage"].get("log_window_days")}]
+    if s.get("validation"):
+        rows += [{"item": f"Validation {k}", "value": v} for k, v in s["validation"]["counts"].items()]
+    rows += [{"item": f"Next step {i}", "value": t} for i, t in enumerate(s["next_steps"], 1)]
+    rows += [{"item": "", "value": ""}, {"item": "", "value": FOOTER}]
+    update_sheet(out, "Summary", rows, ["item", "value"])
+    order_workbook(out)
+    return ["summary.html", "db-agent-sqlserver.xlsx (Summary)"]

db_agent/engines/sqlserver/risks.py

@@ -0,0 +1,184 @@
+"""Turn an inventory into upgrade risks. Pure functions: no database access."""
+
+from __future__ import annotations
+
+import re
+from dataclasses import asdict, dataclass
+from typing import Any
+
+from .inventory import major_version
+from .rules import (
+    COMPAT_BY_MAJOR,
+    DOC_AZURE_DIFF,
+    DOC_COMPAT,
+    DOC_DEPRECATED,
+    DOC_DISCONTINUED,
+    scan_code,
+)
+
+SEVERITY_ORDER = {"high": 0, "medium": 1, "low": 2, "info": 3}
+DEPRECATED_TYPES = {"text", "ntext", "image"}
+
+
+@dataclass
+class Risk:
+    id: str
+    severity: str
+    category: str
+    title: str
+    database: str
+    object: str
+    detail: str
+    doc: str
+    azure_sql_database_only: bool = False
+
+    def as_dict(self) -> dict[str, Any]:
+        return asdict(self)
+
+
+def _fmt(schema: str | None, name: str) -> str:
+    return f"{schema}.{name}" if schema else name
+
+
+def assess(inv: dict[str, Any], target_major: int = 16) -> list[Risk]:
+    """target_major: 15 = SQL Server 2019, 16 = SQL Server 2022."""
+    risks: list[Risk] = []
+    known_dbs = {d["name"].lower() for d in inv["databases"]}
+    server_major = major_version(inv["server"]["product_version"])
+    target_compat = COMPAT_BY_MAJOR.get(target_major, 160)
+
+    for d in inv["databases"]:
+        lvl = d["compatibility_level"]
+        if d["name"] in ("master", "model", "msdb", "tempdb"):
+            continue
+        if lvl <= 100:
+            risks.append(Risk("compat-deprecated", "high", "compatibility", f"Compatibility level {lvl} is deprecated",
+                              d["name"], "", f"Level {lvl} is deprecated and removed in a future version. Test the application at {target_compat}.", DOC_COMPAT))
+        elif lvl < target_compat:
+            sev = "medium" if lvl <= 120 else "low"
+            risks.append(Risk("compat-below-target", sev, "compatibility", f"Compatibility level {lvl} is below {target_compat}",
+                              d["name"], "", f"Levels 110 and 120 are marked for deprecation. Moving to {target_compat} changes query behaviour (cardinality estimator). Test before and after.", DOC_COMPAT))
+        if d["name"].upper() == "DQS_MAIN":
+            risks.append(Risk("dqs", "medium", "feature", "Data Quality Services database found", d["name"], "",
+                              "DQS is deprecated since SQL Server 2016 and removed in SQL Server 2025.", DOC_DISCONTINUED))
+        if d.get("is_published") or d.get("is_merge_published") or d.get("is_subscribed") or d.get("is_distributor"):
+            risks.append(Risk("replication", "medium", "feature", "Replication is configured", d["name"], "",
+                              "Replication needs a plan for the upgrade order (distributor, publisher, subscriber). Azure SQL Database can only be a subscriber.", DOC_AZURE_DIFF, True))
+
+    for ls in inv.get("linked_servers", []):
+        risks.append(Risk("linked-server", "medium", "dependency", "Linked server", "(server)", ls["name"],
+                          f"Provider {ls.get('provider')}. Linked servers are not available in Azure SQL Database. Check the provider (SQLOLEDB is deprecated).",
+                          DOC_AZURE_DIFF, True))
+        if str(ls.get("provider", "")).upper() == "SQLOLEDB":
+            risks.append(Risk("dep-sqloledb", "medium", "deprecated", "Linked server uses the SQLOLEDB provider", "(server)", ls["name"],
+                              "Use Microsoft OLE DB Driver for SQL Server.", DOC_DEPRECATED))
+
+    for m in inv.get("mirroring", []):
+        risks.append(Risk("mirroring", "high", "deprecated", "Database mirroring in use", m["database_name"], "",
+                          "Database mirroring is deprecated. Use Always On availability groups or log shipping.", DOC_DEPRECATED))
+    for e in inv.get("soap_endpoints", []):
+        risks.append(Risk("soap-endpoint", "high", "deprecated", "SOAP endpoint", "(server)", e["name"],
+                          "Native XML web services (SOAP endpoints) are deprecated. Use WCF or ASP.NET.", DOC_DEPRECATED))
+    for c in inv.get("deprecated_feature_counters", []):
+        m = re.fullmatch(r"Database compatibility level (\d+)", c["feature"].strip(), re.IGNORECASE)
+        if m and int(m.group(1)) > 120:
+            continue  # only levels 100, 110 and 120 are on Microsoft's deprecated list
+        risks.append(Risk("runtime-deprecated-feature", "medium", "deprecated", f"Deprecated feature used since last restart: {c['feature']}",
+                          "(server)", c["feature"], f"Used {c['uses_since_restart']} time(s) since the instance last restarted, by the server's own count. "
+                          "This can include management tools and the server itself, so check the code that uses it.",
+                          DOC_DEPRECATED))
+
+    for dbname, db in inv.get("objects", {}).items():
+        for t in db["tables"]:
+            for c in t["columns"]:
+                if c["type_name"] in DEPRECATED_TYPES:
+                    risks.append(Risk("dep-text-ntext-image", "medium", "deprecated", f"Deprecated data type {c['type_name']}", dbname,
+                                      f"{_fmt(t['schema'], t['name'])}.{c['column_name']}", "Use varchar(max), nvarchar(max) or varbinary(max).", DOC_DEPRECATED))
+        for s in db["stretch_tables"]:
+            risks.append(Risk("stretch", "high", "discontinued", "Stretch Database is enabled", dbname, _fmt(s["schema_name"], s["table_name"]),
+                              "Stretch Database was discontinued in July 2024 in all supported versions. Data in Azure must be brought back on premises.", DOC_DISCONTINUED))
+        for a in db["assemblies"]:
+            risks.append(Risk("clr", "medium", "feature", "CLR assembly", dbname, a["name"],
+                              f"Permission set {a['permission_set_desc']}. CLR is not available in Azure SQL Database (Managed Instance supports it). Review the code before an upgrade.", DOC_AZURE_DIFF, True))
+        for q in db["service_broker_queues"]:
+            risks.append(Risk("service-broker", "medium", "feature", "Service Broker queue", dbname, q["name"],
+                              "Service Broker is not available in Azure SQL Database.", DOC_AZURE_DIFF, True))
+        for f in db["fulltext_catalogs"]:
+            risks.append(Risk("fulltext", "low", "feature", "Full-text catalog", dbname, f["name"],
+                              "Rebuild and test full-text indexes after an upgrade.", DOC_AZURE_DIFF))
+        if db["filestream_columns"]:
+            risks.append(Risk("filestream", "medium", "feature", "FILESTREAM columns", dbname, "",
+                              f"{db['filestream_columns']} column(s). Not available in Azure SQL Database.", DOC_AZURE_DIFF, True))
+        for x in db["standalone_defaults_rules"]:
+            risks.append(Risk("dep-create-default-rule", "low", "deprecated", f"Stand-alone {x['type_desc']}", dbname, _fmt(x["schema_name"], x["name"]),
+                              "Use DEFAULT and CHECK constraints.", DOC_DEPRECATED))
+        for x in db["cross_references"]:
+            target = ".".join(p for p in (x["referenced_server_name"], x["referenced_database_name"], x["referenced_schema_name"], x["referenced_entity_name"]) if p)
+            if x["referenced_server_name"]:
+                risks.append(Risk("cross-server-ref", "high", "dependency", "Reference through a linked server", dbname,
+                                  _fmt(x["referencing_schema"], x["referencing_object"]), f"References {target}.", DOC_AZURE_DIFF, True))
+            elif x["referenced_database_name"] and x["referenced_database_name"].lower() != dbname.lower():
+                if x["referenced_database_name"].lower() in known_dbs:
+                    risks.append(Risk("cross-db-ref", "medium", "dependency", "Cross-database reference", dbname,
+                                      _fmt(x["referencing_schema"], x["referencing_object"]), f"References {target}. Cross-database queries are not supported in Azure SQL Database.", DOC_AZURE_DIFF, True))
+                else:
+                    # The dependency view also lists XML method calls (for example Resume.ref.value) as if they were
+                    # database references, so a name that is not a database here cannot be called a dependency with
+                    # certainty. It can also be a real database that is missing from, or lives outside, this server.
+                    risks.append(Risk("cross-db-ref-unresolved", "low", "dependency", "Reference to a name that is not a database on this server",
+                                      dbname, _fmt(x["referencing_schema"], x["referencing_object"]),
+                                      f"References {target}. Either a database that lives elsewhere (check it is moved too) or an XML method call that the "
+                                      "dependency view lists as a database reference.", DOC_AZURE_DIFF))
+        for s in db["synonyms"]:
+            parts = re.sub(r"[\[\]]", "", s["base_object_name"] or "").split(".")
+            if len(parts) >= 4:
+                risks.append(Risk("synonym-linked-server", "high", "dependency", "Synonym points through a linked server", dbname, s["name"], s["base_object_name"], DOC_AZURE_DIFF, True))
+            elif len(parts) == 3 and parts[0].lower() != dbname.lower():
+                risks.append(Risk("synonym-cross-db", "medium", "dependency", "Synonym points to another database", dbname, s["name"], s["base_object_name"], DOC_AZURE_DIFF, True))
+        for m in db["modules"]:
+            obj = _fmt(m["schema"], m["name"])
+            if m["encrypted"]:
+                risks.append(Risk("encrypted-module", "info", "coverage", "Module is encrypted, code could not be scanned", dbname, obj,
+                                  f"{m['type']} created WITH ENCRYPTION. Ask the vendor or owner.", DOC_DEPRECATED))
+                continue
+            if m["uses_ansi_nulls"] == 0:
+                risks.append(Risk("dep-set-ansi-off", "medium", "deprecated", "Module stored with ANSI_NULLS OFF", dbname, obj,
+                                  "ANSI_NULLS OFF is deprecated and will always be ON in a future version.", DOC_DEPRECATED))
+            seen: set[tuple[str, int]] = set()
+            for rule, line, text in scan_code(m["definition"] or ""):
+                if (rule.id, line) in seen:
+                    continue
+                seen.add((rule.id, line))
+                risks.append(Risk(rule.id, rule.severity, "deprecated", rule.title, dbname, obj,
+                                  f"Line {line}: {text[:80]}. {rule.replacement}", rule.doc))
+            if re.search(r"\bxp_cmdshell\b", m["definition"] or "", re.IGNORECASE):
+                risks.append(Risk("xp-cmdshell", "medium", "feature", "Uses xp_cmdshell", dbname, obj,
+                                  "Not available in Azure SQL Database. Review the security implications.", DOC_AZURE_DIFF, True))
+
+    for job in inv.get("agent_jobs", []):
+        cmd = job.get("command") or ""
+        label = f"{job['job_name']} step {job['step_id']}"
+        if job.get("subsystem") == "TSQL":
+            for rule, line, text in scan_code(cmd):
+                risks.append(Risk(rule.id, rule.severity, "deprecated", rule.title, job.get("database_name") or "(agent)", label,
+                                  f"Line {line}: {text[:80]}. {rule.replacement}", rule.doc))
+    if inv.get("agent_jobs"):
+        names = {j["job_name"] for j in inv["agent_jobs"]}
+        risks.append(Risk("agent-jobs", "low", "feature", f"{len(names)} SQL Server Agent job(s)", "(msdb)", "",
+                          "SQL Server Agent is not available in Azure SQL Database (use elastic jobs or another scheduler). Move the jobs with the databases.", DOC_AZURE_DIFF, True))
+
+    if server_major in (13, 14):
+        risks.append(Risk("end-of-support", "high", "lifecycle", f"SQL Server {inv['server']['product_version']} is at or near end of support",
+                          "(server)", "", "See the lifecycle dates in the summary.", "https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2016"
+                          if server_major == 13 else "https://learn.microsoft.com/en-us/lifecycle/products/sql-server-2017"))
+    risks.sort(key=lambda r: (SEVERITY_ORDER[r.severity], r.category, r.database, r.object))
+    return risks
+
+
+def strip_secrets(inv: dict[str, Any]) -> dict[str, Any]:
+    """Return a copy safe to save: Agent step commands and linked-server data sources are dropped
+    (they can hold credentials). Module code is kept in a separate file by the caller."""
+    safe = {k: v for k, v in inv.items() if k not in ("agent_jobs",)}
+    safe["agent_jobs"] = [{k: v for k, v in j.items() if k != "command"} for j in inv.get("agent_jobs", [])]
+    safe["linked_servers"] = [{k: v for k, v in ls.items() if k != "data_source"} for ls in inv.get("linked_servers", [])]
+    return safe