feat(googlesql/parser-ddl-spanner): CHANGE STREAM / SEQUENCE / ROLE / LOCALITY GROUP / PROTO BUNDLE + role GRANT (#246)

Implements the Spanner-specific object DDL the legacy ANTLR grammar has no
first-class rule for (it rides them on the generic-entity hook or rejects them):

  - CREATE/ALTER/DROP CHANGE STREAM  (truth1 DDL-024/025/026)
  - CREATE/ALTER/DROP SEQUENCE        (DDL-027/028/029)
  - CREATE/DROP ROLE                  (DDL-032/033)
  - role-based GRANT/REVOKE: `… TO/FROM ROLE r [, ...]` and
    `GRANT/REVOKE ROLE r [, ...] TO/FROM ROLE r [, ...]`, plus the Spanner
    comma-separated object list `ON TABLE t1, t2 TO ROLE r`  (DDL-034-037)
  - CREATE/ALTER/DROP LOCALITY GROUP  (DDL-041/042/043)
  - CREATE/ALTER PROTO BUNDLE          (DDL-046/047)

New AST nodes (parsenodes.go + nodetags.go + regenerated walk_generated.go) plus
a GranteeRole grantee kind and Roles/Paths fields on the shared GrantStmt/
RevokeStmt so one union parser serves both the legacy ZetaSQL string-grantee
dialect and the Spanner role dialect. Dispatch wired in create_table.go /
alter_table.go / drop.go (the CHANGE/LOCALITY bare-identifier words and the
SEQUENCE/PROTO keywords) and in grant_revoke.go (role-grant disambiguation +
comma-object head). analysis/classify.go classifies the new nodes as DDL.

Authoritative oracle: the live Cloud Spanner emulator (docs/migration/googlesql/
oracle.md). PROVE gate = spanner_ddl_oracle_test.go differential, both polarities
(81 fixtures, omni == emulator). Spanner is authoritative for these forms.

Owned divergences closed:
  - #112 INTERLEAVE IN PARENT ON DELETE made OPTIONAL (defaults to NO ACTION) in
    create_table.go — the original port over-rejected the documented default.
  - #8  inline column PRIMARY KEY already accepted (matches emulator) — guarded.
Flagged (oracle non-authoritative / docs-backed): #128 column-level GRANT, and the
central "Spanner object DDL is first-class, not generic-entity" dialect divergence.

Cross-model (Codex) review caught 3 real bugs (now fixed + regression-tested):
role-grant misroute of legacy `GRANT ROLE ON …`, over-permissive non-ROLE
role-grant target, and over-rejected comma-separated object lists. Oracle-driven
follow-ups: role names are single identifiers (CREATE ROLE rejects dotted; DROP
ROLE accepts), comma-object lists require a type keyword + ROLE grantees, and
PROTO BUNDLE lists allow a trailing comma (change-stream column lists do not).

go test ./googlesql/{parser,ast,analysis}/ green; differential green; vet clean.

Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: h3n4l

googlesql/analysis/classify.go

@@ -148,7 +148,15 @@ func Classify(node ast.Node, dialect Dialect) QueryType {
 		*ast.CreateMaterializedViewStmt, *ast.CreateSnapshotStmt,
 		*ast.SearchVectorIndexStmt, *ast.CreateRowAccessPolicyStmt,
 		*ast.CreateEntityStmt, *ast.BQAlterStmt, *ast.BQDropStmt,
-		*ast.DropAllRowAccessPoliciesStmt:
+		*ast.DropAllRowAccessPoliciesStmt,
+		// Spanner-only object DDL (parser-ddl-spanner node): CHANGE STREAM,
+		// SEQUENCE, ROLE, LOCALITY GROUP, PROTO BUNDLE. Same DDL classification as
+		// every other CREATE/ALTER/DROP form.
+		*ast.CreateChangeStreamStmt, *ast.AlterChangeStreamStmt, *ast.DropChangeStreamStmt,
+		*ast.CreateSequenceStmt, *ast.AlterSequenceStmt, *ast.DropSequenceStmt,
+		*ast.CreateRoleStmt, *ast.DropRoleStmt,
+		*ast.CreateLocalityGroupStmt, *ast.AlterLocalityGroupStmt, *ast.DropLocalityGroupStmt,
+		*ast.CreateProtoBundleStmt, *ast.AlterProtoBundleStmt:
 		return DDL
 
 	// DCL — GRANT / REVOKE are DDL in the legacy listener (its rule list groups

googlesql/analysis/classify_test.go

@@ -61,6 +61,25 @@ func TestClassifySQL(t *testing.T) {
 		{"drop all row access policies", "DROP ALL ROW ACCESS POLICIES ON ds.t", DDL},
 		{"drop capacity (generic entity)", "DROP CAPACITY `p.r.c`", DDL},
 
+		// --- DDL — Spanner-only objects (parser-ddl-spanner node). These now PARSE
+		// (previously over-rejected), so classification must report DDL, not Unknown. ---
+		{"create change stream", "CREATE CHANGE STREAM s FOR ALL", DDL},
+		{"alter change stream", "ALTER CHANGE STREAM s SET FOR ALL", DDL},
+		{"drop change stream", "DROP CHANGE STREAM s", DDL},
+		{"create sequence", "CREATE SEQUENCE q", DDL},
+		{"alter sequence", "ALTER SEQUENCE q SET OPTIONS (start_with_counter=1)", DDL},
+		{"drop sequence", "DROP SEQUENCE q", DDL},
+		{"create role", "CREATE ROLE analyst", DDL},
+		{"drop role", "DROP ROLE analyst", DDL},
+		{"create locality group", "CREATE LOCALITY GROUP g OPTIONS (storage='ssd')", DDL},
+		{"alter locality group", "ALTER LOCALITY GROUP g SET OPTIONS (storage='hdd')", DDL},
+		{"drop locality group", "DROP LOCALITY GROUP g", DDL},
+		{"create proto bundle", "CREATE PROTO BUNDLE (`a.b.C`)", DDL},
+		{"alter proto bundle", "ALTER PROTO BUNDLE INSERT (`a.b.C`)", DDL},
+		{"grant to role", "GRANT SELECT ON TABLE t TO ROLE r", DDL},
+		{"grant role to role", "GRANT ROLE a TO ROLE b", DDL},
+		{"revoke role from role", "REVOKE ROLE a FROM ROLE b", DDL},
+
 		// --- Unknown / empty ---
 		{"empty", "", Unknown},
 		{"whitespace only", "   \n  ", Unknown},

googlesql/ast/nodetags.go

@@ -142,6 +142,27 @@ const (
 	T_BQDropStmt
 	T_DropAllRowAccessPoliciesStmt
 
+	// Spanner-specific DDL (parser-ddl-spanner node): CHANGE STREAM, SEQUENCE,
+	// ROLE, LOCALITY GROUP, and PROTO BUNDLE CREATE/ALTER/DROP forms. These have
+	// no first-class rule in the legacy ANTLR grammar (it rides them on the
+	// generic-entity hook or rejects them); the omni parser models them directly,
+	// authoritatively verified against the live Cloud Spanner emulator. (Role-based
+	// GRANT/REVOKE reuses T_GrantStmt/T_RevokeStmt with the GranteeRole kind.)
+	T_ChangeStreamTrackedTable
+	T_CreateChangeStreamStmt
+	T_AlterChangeStreamStmt
+	T_DropChangeStreamStmt
+	T_CreateSequenceStmt
+	T_AlterSequenceStmt
+	T_DropSequenceStmt
+	T_CreateRoleStmt
+	T_DropRoleStmt
+	T_CreateLocalityGroupStmt
+	T_AlterLocalityGroupStmt
+	T_DropLocalityGroupStmt
+	T_CreateProtoBundleStmt
+	T_AlterProtoBundleStmt
+
 	// DML — INSERT / UPDATE / DELETE / MERGE / TRUNCATE (parser-dml node).
 	//
 	// The data-manipulation family for the BigQuery + Spanner union, plus their
@@ -361,6 +382,34 @@ func (t NodeTag) String() string {
 		return "BQDropStmt"
 	case T_DropAllRowAccessPoliciesStmt:
 		return "DropAllRowAccessPoliciesStmt"
+	case T_ChangeStreamTrackedTable:
+		return "ChangeStreamTrackedTable"
+	case T_CreateChangeStreamStmt:
+		return "CreateChangeStreamStmt"
+	case T_AlterChangeStreamStmt:
+		return "AlterChangeStreamStmt"
+	case T_DropChangeStreamStmt:
+		return "DropChangeStreamStmt"
+	case T_CreateSequenceStmt:
+		return "CreateSequenceStmt"
+	case T_AlterSequenceStmt:
+		return "AlterSequenceStmt"
+	case T_DropSequenceStmt:
+		return "DropSequenceStmt"
+	case T_CreateRoleStmt:
+		return "CreateRoleStmt"
+	case T_DropRoleStmt:
+		return "DropRoleStmt"
+	case T_CreateLocalityGroupStmt:
+		return "CreateLocalityGroupStmt"
+	case T_AlterLocalityGroupStmt:
+		return "AlterLocalityGroupStmt"
+	case T_DropLocalityGroupStmt:
+		return "DropLocalityGroupStmt"
+	case T_CreateProtoBundleStmt:
+		return "CreateProtoBundleStmt"
+	case T_AlterProtoBundleStmt:
+		return "AlterProtoBundleStmt"
 	case T_DefaultExpr:
 		return "DefaultExpr"
 	case T_InsertStmt: