pgdevkit 0.11.0__tar.gz → 0.12.0__tar.gz

{pgdevkit-0.11.0 → pgdevkit-0.12.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: pgdevkit
-Version: 0.11.0
+Version: 0.12.0
 Summary: A helper for developing with Postgres
 Requires-Python: >=3.14
 Requires-Dist: docker>=7.1.0
@@ -73,6 +73,12 @@ Requires the `mssql` extra: `pip install pgdevkit[mssql]` (pulls in
 own driver — no system ODBC driver install needed). MSSQL has no composite
 type or native enum equivalent, so those areas of a `database/` tree don't
 have a direct equivalent on this backend — see `docs/database-layout.md`.
+
+`pgdb compare --dialect mssql --entra-user <identity>` appends
+`Authentication=ActiveDirectoryDefault` to the connection string so mssql-python
+gets an Entra ID token via `DefaultAzureCredential` (also install the `azure`
+extra). The identity is whatever that credential chain resolves; the flag's
+value only switches Entra auth on.
 Current Azure SQL/SQL Server (2025+) does have a native `json` column type,
 which parses/introspects/diffs like any other column type; see
 "`pgdevkit.db` — helpers for application code" below for how JSON values are
@@ -324,16 +330,46 @@ REPL.
 ## `pgdb migrate`
 
 Applies numbered, forward-only SQL migration files from a directory to a live
-Postgres database, tracking each one in a `schema.table` (default
-`public.schema_migrations`) so repeat runs only apply what's pending. Postgres only —
-not available for `--dialect mssql`.
+Postgres or MSSQL database, tracking each one in a `schema.table` (default
+`public.schema_migrations`, `dbo.schema_migrations` for MSSQL) so repeat runs only
+apply what's pending.
 
 ```bash
 pgdb migrate check  path/to/database/_migration_scripts --url postgresql://user:pass@host:port/db
 pgdb migrate apply  path/to/database/_migration_scripts --url postgresql://user:pass@host:port/db
 ```
 
-`--entra-user` works the same as `pgdb compare` (see above). The tracking
+### MSSQL
+
+Pass `--dialect mssql` (needs the `mssql` extra) to both `check` and `apply`, with
+`--url` as an ODBC connection string:
+
+```bash
+pgdb migrate apply path/to/database/_migration_scripts --dialect mssql \
+    --url "Server=host,1433;Database=db;UID=user;PWD=pass"
+```
+
+- Migration files are T-SQL: they are split into batches on standalone `GO` lines
+  (needed for e.g. `CREATE VIEW`, which must be first in its batch), and all batches
+  of one file run in a single transaction that is rolled back if any batch fails
+  (including a failure in a later statement of a multi-statement batch). `GO <count>`
+  is not honored: the batch runs once.
+- The tracking table needs `filename nvarchar(450) primary key, applied_at
+  datetimeoffset not null default sysdatetimeoffset(), applied_by nvarchar(128) not
+  null default suser_sname()`. As on Postgres, a migration creating it can bootstrap it.
+  Override its name with `mssql_migrations_table` in `[tool.pgdevkit]` (the Postgres
+  `migrations_table` key is deliberately ignored for MSSQL) or with `--tracking-table`.
+- `--ask` auto-detects "already done" for single-statement `GO` batches that create a
+  table, view or schema, or add a column; anything else is asked about.
+- Post-apply verification checks every `CREATE TABLE` target via `OBJECT_ID`.
+- `--entra-user` appends `Authentication=ActiveDirectoryDefault` to the connection
+  string, so mssql-python fetches an Entra ID token through azure-identity's
+  `DefaultAzureCredential` (install `pgdevkit[mssql,azure]`). The identity is whatever
+  that credential chain resolves — the flag's value only switches Entra auth on. It
+  can't be combined with an `Authentication=` already in the connection string.
+- `pgdevkit.migrate.missing_privileges` is not available for MSSQL.
+
+For Postgres, `--entra-user` works the same as `pgdb compare` (see above). The tracking
 table needs `filename text primary key, applied_at timestamptz not null
 default now(), applied_by text not null default current_user` (a migration
 file that creates it, in the same directory, is the usual way to bootstrap
@@ -373,7 +409,7 @@ for a real one.
 `pgdevkit.migrate` is also usable directly as a library — `list_migration_files`,
 `applied_migrations`, `pending_migrations`, and `apply_migration` are the same
 functions the CLI calls, so a project can script around them without shelling
-out.
+out. The database-touching ones take `dialect="postgres" | "mssql"`.
 
 ## `pgdevkit.db` — helpers for application code
 

{pgdevkit-0.11.0 → pgdevkit-0.12.0}/README.md

@@ -52,6 +52,12 @@ Requires the `mssql` extra: `pip install pgdevkit[mssql]` (pulls in
 own driver — no system ODBC driver install needed). MSSQL has no composite
 type or native enum equivalent, so those areas of a `database/` tree don't
 have a direct equivalent on this backend — see `docs/database-layout.md`.
+
+`pgdb compare --dialect mssql --entra-user <identity>` appends
+`Authentication=ActiveDirectoryDefault` to the connection string so mssql-python
+gets an Entra ID token via `DefaultAzureCredential` (also install the `azure`
+extra). The identity is whatever that credential chain resolves; the flag's
+value only switches Entra auth on.
 Current Azure SQL/SQL Server (2025+) does have a native `json` column type,
 which parses/introspects/diffs like any other column type; see
 "`pgdevkit.db` — helpers for application code" below for how JSON values are
@@ -303,16 +309,46 @@ REPL.
 ## `pgdb migrate`
 
 Applies numbered, forward-only SQL migration files from a directory to a live
-Postgres database, tracking each one in a `schema.table` (default
-`public.schema_migrations`) so repeat runs only apply what's pending. Postgres only —
-not available for `--dialect mssql`.
+Postgres or MSSQL database, tracking each one in a `schema.table` (default
+`public.schema_migrations`, `dbo.schema_migrations` for MSSQL) so repeat runs only
+apply what's pending.
 
 ```bash
 pgdb migrate check  path/to/database/_migration_scripts --url postgresql://user:pass@host:port/db
 pgdb migrate apply  path/to/database/_migration_scripts --url postgresql://user:pass@host:port/db
 ```
 
-`--entra-user` works the same as `pgdb compare` (see above). The tracking
+### MSSQL
+
+Pass `--dialect mssql` (needs the `mssql` extra) to both `check` and `apply`, with
+`--url` as an ODBC connection string:
+
+```bash
+pgdb migrate apply path/to/database/_migration_scripts --dialect mssql \
+    --url "Server=host,1433;Database=db;UID=user;PWD=pass"
+```
+
+- Migration files are T-SQL: they are split into batches on standalone `GO` lines
+  (needed for e.g. `CREATE VIEW`, which must be first in its batch), and all batches
+  of one file run in a single transaction that is rolled back if any batch fails
+  (including a failure in a later statement of a multi-statement batch). `GO <count>`
+  is not honored: the batch runs once.
+- The tracking table needs `filename nvarchar(450) primary key, applied_at
+  datetimeoffset not null default sysdatetimeoffset(), applied_by nvarchar(128) not
+  null default suser_sname()`. As on Postgres, a migration creating it can bootstrap it.
+  Override its name with `mssql_migrations_table` in `[tool.pgdevkit]` (the Postgres
+  `migrations_table` key is deliberately ignored for MSSQL) or with `--tracking-table`.
+- `--ask` auto-detects "already done" for single-statement `GO` batches that create a
+  table, view or schema, or add a column; anything else is asked about.
+- Post-apply verification checks every `CREATE TABLE` target via `OBJECT_ID`.
+- `--entra-user` appends `Authentication=ActiveDirectoryDefault` to the connection
+  string, so mssql-python fetches an Entra ID token through azure-identity's
+  `DefaultAzureCredential` (install `pgdevkit[mssql,azure]`). The identity is whatever
+  that credential chain resolves — the flag's value only switches Entra auth on. It
+  can't be combined with an `Authentication=` already in the connection string.
+- `pgdevkit.migrate.missing_privileges` is not available for MSSQL.
+
+For Postgres, `--entra-user` works the same as `pgdb compare` (see above). The tracking
 table needs `filename text primary key, applied_at timestamptz not null
 default now(), applied_by text not null default current_user` (a migration
 file that creates it, in the same directory, is the usual way to bootstrap
@@ -352,7 +388,7 @@ for a real one.
 `pgdevkit.migrate` is also usable directly as a library — `list_migration_files`,
 `applied_migrations`, `pending_migrations`, and `apply_migration` are the same
 functions the CLI calls, so a project can script around them without shelling
-out.
+out. The database-touching ones take `dialect="postgres" | "mssql"`.
 
 ## `pgdevkit.db` — helpers for application code
 

{pgdevkit-0.11.0 → pgdevkit-0.12.0}/pgdevkit/cli.py

@@ -9,13 +9,14 @@ from pathlib import Path
 import psycopg
 import typer
 from rich.console import Console
+from rich.markup import escape
 from rich.table import Table
 from rich import box
 from tqdm import tqdm
 
-from . import migrate, stats, testdb
+from . import migrate, migrate_mssql, stats, testdb
 from .backends import get_backend
-from .connection import build_conninfo
+from .connection import build_conninfo, build_mssql_conninfo
 from .diff import DiffKind, compute_diff
 from .fetch_missing import SUBFOLDER, find_missing_objects, layer_folder_for, reconstruct_ddl
 from .parser import parse_directory
@@ -47,6 +48,9 @@ _TESTDB_ENV_OPTION = typer.Option(
     "--env",
     help="Environment to apply: skips any <name>.<other-env>.sql file (e.g. grants.prod.sql); untagged files always apply",
 )
+_MIGRATE_DIALECT_OPTION = typer.Option(
+    "postgres", "--dialect", help="postgres (default) or mssql; mssql needs the mssql extra and uses --url as an ODBC connection string"
+)
 _MIGRATE_ENV_OPTION = typer.Option(
     None,
     "--env",
@@ -70,7 +74,12 @@ app.add_typer(migrate_app, name="migrate")
 @app.command()
 def compare(
     url: str = typer.Option(..., "--url", help="PostgreSQL DSN (postgresql://user:pass@host:port/db)"),
-    entra_user: str | None = typer.Option(None, "--entra-user", help="Azure Entra user (triggers token auth)"),
+    entra_user: str | None = typer.Option(
+        None,
+        "--entra-user",
+        help="Azure Entra user (triggers token auth); with --dialect mssql this adds "
+        "Authentication=ActiveDirectoryDefault and the value itself is not used",
+    ),
     databricks_workspace_host: str | None = typer.Option(
         None,
         "--databricks-workspace-host",
@@ -100,18 +109,21 @@ def compare(
         )
 
     try:
-        conninfo = build_conninfo(
-            url,
-            entra_user,
-            databricks_workspace_host=databricks_workspace_host,
-            databricks_instance=databricks_instance,
-        )
+        backend = get_backend(dialect)
     except ValueError as e:
         err_console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(2)
 
     try:
-        backend = get_backend(dialect)
+        if backend.dialect.name == "mssql":
+            conninfo = build_mssql_conninfo(url, entra_user)
+        else:
+            conninfo = build_conninfo(
+                url,
+                entra_user,
+                databricks_workspace_host=databricks_workspace_host,
+                databricks_instance=databricks_instance,
+            )
     except ValueError as e:
         err_console.print(f"[red]Error:[/red] {e}")
         raise typer.Exit(2)
@@ -376,30 +388,78 @@ def testdb_list_orphaned() -> None:
         console.print(name)
 
 
+def _describe_target(url: str, dialect: str) -> str:
+    """Where a migrate command points, without credentials: host/db for a Postgres URL,
+    Server/Database only for an MSSQL connection string (never UID/PWD)."""
+    if dialect == "mssql":
+        parts = dict(
+            (k.strip().lower(), v.strip()) for k, _, v in (p.partition("=") for p in url.split(";")) if k.strip()
+        )
+        server = parts.get("server") or parts.get("data source") or "?"
+        database = parts.get("database") or parts.get("initial catalog")
+        return f"{server}/{database}" if database else server
+    return url.rsplit("@", 1)[-1] if "@" in url else url
+
+
+def _migrate_target(
+    url: str, entra_user: str | None, dialect: str, tracking_table: str | None, migrations_dir: Path
+) -> tuple[str, str, str]:
+    """Resolve (conninfo, dialect name, tracking table) for a migrate command."""
+    try:
+        resolved = get_backend(dialect).dialect
+    except ValueError as e:
+        err_console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(2)
+    if resolved.name == "mssql":
+        try:
+            migrate_mssql.require_driver()
+        except ImportError as e:
+            err_console.print(f"[red]Error:[/red] {escape(str(e))}")
+            raise typer.Exit(2)
+    try:
+        conninfo = (build_mssql_conninfo if resolved.name == "mssql" else build_conninfo)(url, entra_user)
+    except ValueError as e:
+        err_console.print(f"[red]Error:[/red] {e}")
+        raise typer.Exit(2)
+    tracking_table = tracking_table or migrate.default_tracking_table(migrations_dir, dialect=resolved)
+    return conninfo, resolved.name, tracking_table
+
+
 @migrate_app.command("check")
 def migrate_check(
     migrations_dir: Path = typer.Argument(..., help="Directory of numbered .sql migration files"),
-    url: str = typer.Option(..., "--url", help="PostgreSQL DSN (postgresql://user:pass@host:port/db)"),
-    entra_user: str | None = typer.Option(None, "--entra-user", help="Azure Entra user (triggers token auth)"),
+    url: str = typer.Option(
+        ...,
+        "--url",
+        help="PostgreSQL DSN (postgresql://user:pass@host:port/db), or with --dialect mssql "
+        "a connection string (Server=host,1433;Database=db;UID=user;PWD=pass)",
+    ),
+    entra_user: str | None = typer.Option(
+        None,
+        "--entra-user",
+        help="Azure Entra user (triggers token auth); with --dialect mssql this adds "
+        "Authentication=ActiveDirectoryDefault and the value itself is not used",
+    ),
     tracking_table: str | None = typer.Option(
         None,
         "--tracking-table",
         help="schema.table recording applied migrations "
-        "(default: tool.pgdevkit.migrations_table in pyproject.toml, else public.schema_migrations)",
+        "(default: tool.pgdevkit.migrations_table in pyproject.toml, else public.schema_migrations "
+        "-- dbo.schema_migrations with --dialect mssql)",
     ),
     area: list[str] = _AREA_OPTION,
     exclude_area: list[str] = _EXCLUDE_AREA_OPTION,
     schema: list[str] = _SCHEMA_OPTION,
     exclude_schema: list[str] = _EXCLUDE_SCHEMA_OPTION,
     env: str | None = _MIGRATE_ENV_OPTION,
+    dialect: str = _MIGRATE_DIALECT_OPTION,
 ) -> None:
     """List which migration files under migrations_dir are applied vs. pending."""
     if not migrations_dir.is_dir():
         err_console.print(f"[red]Error:[/red] {migrations_dir} is not a directory")
         raise typer.Exit(2)
 
-    conninfo = build_conninfo(url, entra_user)
-    tracking_table = tracking_table or migrate.default_tracking_table(migrations_dir)
+    conninfo, dialect, tracking_table = _migrate_target(url, entra_user, dialect, tracking_table, migrations_dir)
     local_files = migrate.list_migration_files(
         migrations_dir,
         areas=_as_set(area),
@@ -409,7 +469,7 @@ def migrate_check(
         env=env,
     )
     try:
-        applied = migrate.applied_migrations(conninfo, tracking_table)
+        applied = migrate.applied_migrations(conninfo, tracking_table, dialect)
     except migrate.TrackingTableMissing:
         err_console.print(f"[yellow]⚠[/yellow]  {tracking_table} not found — nothing recorded as applied yet")
         applied = {}
@@ -433,13 +493,24 @@ def migrate_check(
 @migrate_app.command("apply")
 def migrate_apply(
     migrations_dir: Path = typer.Argument(..., help="Directory of numbered .sql migration files"),
-    url: str = typer.Option(..., "--url", help="PostgreSQL DSN (postgresql://user:pass@host:port/db)"),
-    entra_user: str | None = typer.Option(None, "--entra-user", help="Azure Entra user (triggers token auth)"),
+    url: str = typer.Option(
+        ...,
+        "--url",
+        help="PostgreSQL DSN (postgresql://user:pass@host:port/db), or with --dialect mssql "
+        "a connection string (Server=host,1433;Database=db;UID=user;PWD=pass)",
+    ),
+    entra_user: str | None = typer.Option(
+        None,
+        "--entra-user",
+        help="Azure Entra user (triggers token auth); with --dialect mssql this adds "
+        "Authentication=ActiveDirectoryDefault and the value itself is not used",
+    ),
     tracking_table: str | None = typer.Option(
         None,
         "--tracking-table",
         help="schema.table recording applied migrations "
-        "(default: tool.pgdevkit.migrations_table in pyproject.toml, else public.schema_migrations)",
+        "(default: tool.pgdevkit.migrations_table in pyproject.toml, else public.schema_migrations "
+        "-- dbo.schema_migrations with --dialect mssql)",
     ),
     file: str | None = typer.Option(
         None, "--file", help="Apply only this one filename (relative to migrations_dir) instead of all pending"
@@ -451,17 +522,17 @@ def migrate_apply(
     schema: list[str] = _SCHEMA_OPTION,
     exclude_schema: list[str] = _EXCLUDE_SCHEMA_OPTION,
     env: str | None = _MIGRATE_ENV_OPTION,
+    dialect: str = _MIGRATE_DIALECT_OPTION,
 ) -> None:
     """Apply pending migration files, in filename order, tracking each in tracking_table."""
     if not migrations_dir.is_dir():
         err_console.print(f"[red]Error:[/red] {migrations_dir} is not a directory")
         raise typer.Exit(2)
 
-    conninfo = build_conninfo(url, entra_user)
-    tracking_table = tracking_table or migrate.default_tracking_table(migrations_dir)
+    conninfo, dialect, tracking_table = _migrate_target(url, entra_user, dialect, tracking_table, migrations_dir)
     areas, exclude_areas = _as_set(area), _as_set(exclude_area)
     schemas, exclude_schemas = _as_set(schema), _as_set(exclude_schema)
-    target_desc = url.rsplit("@", 1)[-1] if "@" in url else url
+    target_desc = _describe_target(url, dialect)
     if not yes:
         typer.confirm(f"About to run migrations against {target_desc}. Continue?", abort=True)
 
@@ -478,6 +549,7 @@ def migrate_apply(
                 schemas=schemas,
                 exclude_schemas=exclude_schemas,
                 env=env,
+                dialect=dialect,
             )
         except migrate.TrackingTableMissing:
             err_console.print(
@@ -517,7 +589,9 @@ def migrate_apply(
         for path, already_done in iter(work_q.get, None):
             if not stop.is_set():
                 try:
-                    result = migrate.apply_migration(conninfo, path, tracking_table, already_done=already_done)
+                    result = migrate.apply_migration(
+                        conninfo, path, tracking_table, already_done=already_done, dialect=dialect
+                    )
                 except Exception as e:  # noqa: BLE001
                     failure = e
                     stop.set()
@@ -544,7 +618,7 @@ def migrate_apply(
             break
         already_done = False
         if ask:
-            already_done = migrate.already_fully_applied(conninfo, path)
+            already_done = migrate.already_fully_applied(conninfo, path, dialect)
             if already_done:
                 bar_write(f"Auto: {path.name} is already fully present in the database — marking as already done")
             else:

{pgdevkit-0.11.0 → pgdevkit-0.12.0}/pgdevkit/connection.py

@@ -1,5 +1,6 @@
 from __future__ import annotations
 
+import re
 from typing import Literal
 from urllib.parse import quote, urlparse, urlunparse
 
@@ -67,6 +68,21 @@ def get_azure_postgres_password(
     return token.token
 
 
+def build_mssql_conninfo(conn_str: str, entra_user: str | None = None) -> str:
+    """MSSQL counterpart of `build_conninfo`. Without `entra_user` the ODBC connection
+    string is used as-is. With it, `Authentication=ActiveDirectoryDefault` is appended so
+    mssql-python acquires an Entra ID token itself via azure-identity's
+    `DefaultAzureCredential` (needs the `azure` extra); the identity is whatever that
+    credential chain resolves, so `entra_user` only switches Entra auth on and is not
+    sent to the server. A connection string that already sets `Authentication` is left
+    to speak for itself and rejected here to avoid ambiguity."""
+    if entra_user is None:
+        return conn_str
+    if re.search(r"(^|;)\s*Authentication\s*=", conn_str, re.IGNORECASE):
+        raise ValueError("--entra-user can't be combined with an Authentication= setting in the connection string")
+    return f"{conn_str.rstrip().rstrip(';')};Authentication=ActiveDirectoryDefault"
+
+
 def build_conninfo(
     url: str,
     entra_user: str | None = None,

{pgdevkit-0.11.0 → pgdevkit-0.12.0}/pgdevkit/migrate.py

@@ -1,7 +1,9 @@
 """Apply numbered, forward-only SQL migration files to a live Postgres database,
 tracked in a `schema.table` (default `public.schema_migrations`) so re-runs only
-apply what's pending. Ported from a hand-rolled per-project script — MSSQL is not
-supported yet.
+apply what's pending. Ported from a hand-rolled per-project script. Every function that
+touches a database takes `dialect="postgres"` (default) or `"mssql"`; the MSSQL
+implementation lives in `.migrate_mssql` and is only imported when asked for, so the
+`mssql` extra stays optional.
 """
 
 from __future__ import annotations
@@ -19,12 +21,12 @@ from psycopg import errors as pg_errors
 from psycopg import sql as pg_sql
 
 from .areas import filter_by_area
+from .dialect import Dialect, resolve_dialect
 from .envtag import env_allowed
 from .schemas import filter_by_schema
 from .sql_text import strip_line_comments
 
 _IDENTIFIER = r"[A-Za-z_][A-Za-z0-9_]*"
-_DEFAULT_TRACKING_TABLE = "public.schema_migrations"
 
 
 class MigrationVerificationError(RuntimeError):
@@ -47,6 +49,10 @@ def _tracking_table_identifier(tracking_table: str) -> pg_sql.Identifier:
     return pg_sql.Identifier(schema, table)
 
 
+def _is_mssql(dialect: str | Dialect) -> bool:
+    return resolve_dialect(dialect).name == "mssql"
+
+
 def _find_pyproject(start: Path) -> Path | None:
     for directory in [start, *start.parents]:
         candidate = directory / "pyproject.toml"
@@ -55,17 +61,20 @@ def _find_pyproject(start: Path) -> Path | None:
     return None
 
 
-def default_tracking_table(start: Path | None = None) -> str:
+def default_tracking_table(start: Path | None = None, dialect: str | Dialect = "postgres") -> str:
     """The project's configured tracking table: `[tool.pgdevkit].migrations_table` in the
     nearest pyproject.toml at or above `start` (default: cwd), or "public.schema_migrations"
-    if neither is set. Lets a project fix its tracking table once instead of passing
+    if neither is set. For MSSQL the key is `mssql_migrations_table` (default
+    "dbo.schema_migrations"), so a Postgres-style `migrations_table` never leaks into it. Lets a project fix its tracking table once instead of passing
     --tracking-table on every `pgdb migrate` invocation."""
+    default = f"{resolve_dialect(dialect).default_schema}.schema_migrations"
     pyproject = _find_pyproject((start or Path.cwd()).resolve())
     if pyproject is None:
-        return _DEFAULT_TRACKING_TABLE
+        return default
     data = tomllib.loads(pyproject.read_text(encoding="utf-8"))
     section = data.get("tool", {}).get("pgdevkit", {})
-    return section.get("migrations_table", _DEFAULT_TRACKING_TABLE)
+    key = "mssql_migrations_table" if resolve_dialect(dialect).name == "mssql" else "migrations_table"
+    return section.get(key, default)
 
 
 def _split_sql(sql: str) -> list[str]:
@@ -213,13 +222,22 @@ def _target_exists(con: psycopg.Connection, target: tuple[str, ...]) -> bool:
     return bool(row and row[0])
 
 
-def already_fully_applied(conninfo: str, path: Path) -> bool:
+def already_fully_applied(conninfo: str, path: Path, dialect: str | Dialect = "postgres") -> bool:
     """Whether every statement in this migration is a recognized create-if-missing shape
     (table/index/sequence/view/schema, or add-column) AND its target already exists in the
     database — i.e. re-running the migration would do nothing. Used by `--ask` to
     auto-answer "already done" without prompting, so migrations that are trivially no-ops
     don't interrupt review. A single unrecognized or not-yet-applied statement means
-    False — this never guesses."""
+    False — this never guesses. For MSSQL the unit is a `GO`-separated batch and the
+    recognized shapes are table, view, schema and ADD column."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        batches = migrate_mssql.split_batches(path.read_text(encoding="utf-8"))
+        mssql_targets = [migrate_mssql.idempotent_target(b) for b in batches]
+        if not batches or any(t is None for t in mssql_targets):
+            return False
+        return migrate_mssql.targets_exist(conninfo, cast(list[tuple[str, ...]], mssql_targets))
     stmts = _split_sql(path.read_text(encoding="utf-8"))
     if not stmts:
         return False
@@ -250,8 +268,14 @@ def list_migration_files(
     return [f for f in files if env_allowed(f, env)]
 
 
-def applied_migrations(conninfo: str, tracking_table: str) -> dict[str, tuple[datetime, str]]:
+def applied_migrations(
+    conninfo: str, tracking_table: str, dialect: str | Dialect = "postgres"
+) -> dict[str, tuple[datetime, str]]:
     """Filename -> (applied_at, applied_by) for every migration recorded in the tracking table."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        return migrate_mssql.applied_migrations(conninfo, tracking_table)
     table = _tracking_table_identifier(tracking_table)
     with psycopg.connect(conninfo) as con:
         try:
@@ -273,8 +297,9 @@ def pending_migrations(
     schemas: frozenset[str] | None = None,
     exclude_schemas: frozenset[str] | None = None,
     env: str | None = None,
+    dialect: str | Dialect = "postgres",
 ) -> list[Path]:
-    applied = applied_migrations(conninfo, tracking_table)
+    applied = applied_migrations(conninfo, tracking_table, dialect)
     files = list_migration_files(
         migrations_dir,
         areas=areas,
@@ -286,9 +311,15 @@ def pending_migrations(
     return [p for p in files if p.name not in applied]
 
 
-def record_applied(conninfo: str, tracking_table: str, filename: str) -> bool:
+def record_applied(
+    conninfo: str, tracking_table: str, filename: str, dialect: str | Dialect = "postgres"
+) -> bool:
     """Best-effort insert into the tracking table. Returns False without raising if the
     tracking table doesn't exist yet — e.g. this migration is the one that creates it."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        return migrate_mssql.record_applied(conninfo, tracking_table, filename)
     table = _tracking_table_identifier(tracking_table)
     with psycopg.connect(conninfo) as con:
         try:
@@ -303,17 +334,25 @@ def record_applied(conninfo: str, tracking_table: str, filename: str) -> bool:
             return False
 
 
-def created_table_names(sql: str) -> list[str]:
+def created_table_names(sql: str, dialect: str | Dialect = "postgres") -> list[str]:
     """Table names any CREATE TABLE statement in this raw SQL script targets. Public
     wrapper around the same detection `apply_migration` uses internally, for callers that
     run a script directly (e.g. via `execute_sql_script`) instead of through a tracked
     migration file, and still want to know what tables -- if any -- it created."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        return migrate_mssql.created_table_names(migrate_mssql.split_batches(sql))
     return _created_table_names(_split_sql(sql))
 
 
-def verify_created_tables(conninfo: str, stmts: list[str]) -> list[str]:
+def verify_created_tables(conninfo: str, stmts: list[str], dialect: str | Dialect = "postgres") -> list[str]:
     """Table names from this migration's CREATE TABLE statements that do NOT exist in the
-    database. Empty means everything landed."""
+    database. Empty means everything landed. For MSSQL, `stmts` are `GO`-separated batches."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        return migrate_mssql.missing_tables(conninfo, migrate_mssql.created_table_names(stmts))
     tables = _created_table_names(stmts)
     if not tables:
         return []
@@ -326,12 +365,16 @@ def verify_created_tables(conninfo: str, stmts: list[str]) -> list[str]:
     return missing
 
 
-def missing_privileges(conninfo: str, role: str, tables: list[str], privilege: str = "select") -> list[str]:
+def missing_privileges(
+    conninfo: str, role: str, tables: list[str], privilege: str = "select", dialect: str | Dialect = "postgres"
+) -> list[str]:
     """Table names from `tables` that `role` cannot currently exercise `privilege` on
     (checked via Postgres's own `has_table_privilege`). Empty means the role can access
     all of them. For guarding against the classic "migration creates a table, nobody
     grants it to the app's runtime role" gap: check the tables a migration just created
     against the role that will actually query them at runtime."""
+    if _is_mssql(dialect):
+        raise NotImplementedError("missing_privileges is only available for the postgres dialect")
     if not tables:
         return []
     missing = []
@@ -350,12 +393,18 @@ def _execute_stmts(conninfo: str, stmts: list[str]) -> None:
         con.commit()
 
 
-def execute_sql_script(conninfo: str, sql: str) -> None:
+def execute_sql_script(conninfo: str, sql: str, dialect: str | Dialect = "postgres") -> None:
     """Run a raw SQL script as one committed transaction, split into statements the same
     statement-boundary-safe way apply_migration is (dollar-quoted blocks, string literals,
     and line comments never get split mid-statement). Unlike apply_migration, this does
     no tracking-table bookkeeping and isn't forward-only -- for scripts meant to re-run
-    every time, like an idempotent `GRANT ... ON ALL TABLES IN SCHEMA` privilege sync."""
+    every time, like an idempotent `GRANT ... ON ALL TABLES IN SCHEMA` privilege sync.
+    For MSSQL the script is split on `GO` lines instead and runs as one transaction."""
+    if _is_mssql(dialect):
+        from . import migrate_mssql
+
+        migrate_mssql.execute_batches(conninfo, migrate_mssql.split_batches(sql))
+        return
     _execute_stmts(conninfo, _split_sql(sql))
 
 
@@ -372,25 +421,36 @@ def apply_migration(
     tracking_table: str,
     *,
     already_done: bool = False,
+    dialect: str | Dialect = "postgres",
 ) -> ApplyResult:
     sql = path.read_text(encoding="utf-8")
     filename = path.name
-    stmts = _split_sql(sql)
+    mssql = _is_mssql(dialect)
+    if mssql:
+        from . import migrate_mssql
+
+        stmts = migrate_mssql.split_batches(sql)
+    else:
+        stmts = _split_sql(sql)
 
     if not already_done:
-        _execute_stmts(conninfo, stmts)
+        if mssql:
+            migrate_mssql.execute_batches(conninfo, stmts)
+        else:
+            _execute_stmts(conninfo, stmts)
 
     # Tracking insert is a separate connection/transaction so a missing tracking table
     # never rolls back the DDL that was just applied.
-    record_applied(conninfo, tracking_table, filename)
+    record_applied(conninfo, tracking_table, filename, dialect)
 
     if already_done:
         return ApplyResult(filename, executed=False, verified_tables=[])
 
-    missing = verify_created_tables(conninfo, stmts)
+    missing = verify_created_tables(conninfo, stmts, dialect)
     if missing:
         raise MigrationVerificationError(
             f"{filename}: table(s) not found after apply — migration may have rolled back: "
             + ", ".join(missing)
         )
-    return ApplyResult(filename, executed=True, verified_tables=_created_table_names(stmts))
+    created = migrate_mssql.created_table_names(stmts) if mssql else _created_table_names(stmts)
+    return ApplyResult(filename, executed=True, verified_tables=created)