feat: dialect-aware folding, MERGE, live introspection, VS Code, audit fixes

This commit bundles a stack of related work on the validation core, the
schema layer, and the editor surface; see ROADMAP.md for the resulting
status.

Validation core:
- Thread `Dialect` through the validation layer; replace ad-hoc ASCII
  lowercasing with `fold_ident` / `fold_str` / `qualified_key` so
  Postgres preserves quoted-identifier case while every other dialect
  keeps the prior case-insensitive behavior.
- Convert `Extras` to an owned `HashMap<String, HashSet<String>>` keyed
  by dialect-folded names; eliminates lifetime juggling and ad-hoc
  case-insensitive scans.
- Add `Statement::Merge` support (target / source / ON / WHEN MATCHED /
  WHEN NOT MATCHED) in `validation/clauses/merge.rs`.
- 3-part qualified column refs (`schema.table.col`).
- Ambiguity detection: flag unqualified columns visible in 2+ relations;
  `JOIN ... USING(col)` keeps the legacy non-ambiguous resolution since
  shared-name presence is the whole point of USING.
- NATURAL JOIN: warn when the right-hand factor shares no column with
  the accumulated left-hand scope (most engines silently degrade to a
  Cartesian product, which is rarely intended).
- Set-op (UNION / INTERSECT / EXCEPT) column-arity check; wildcard
  branches are skipped since their arity isn't known statically.

Schema:
- Schema parser folds identifiers per dialect on ingest so query-side
  and schema-side keys collide deterministically.

Live introspection:
- New `sqlshield-introspect` crate reads schemas directly from a running
  Postgres or SQLite; CLI `--db-url` accepts a connection string in
  place of `--schema`. MySQL is left for a follow-up: `mysql_common`
  uses unstable `let`-chain syntax that hasn't reached the project's
  pinned toolchain.

Editor surface:
- LSP polls the schema file's mtime before each validation pass and
  reloads on change — picks up schema edits without restarting.
- LSP `.sql` path drops the redundant first-pass empty-schema validation
  and parses + validates once against the cached schema.
- New `editors/vscode` extension wraps `sqlshield-lsp` over stdio for a
  first-party VS Code experience.

Tests cover each new behavior (set-op arity, 3-part qualifier, NATURAL
JOIN happy + sad path, ambiguity, USING-not-ambiguous, MERGE, Postgres
quoted-vs-unquoted folding, wildcard expansion).

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: davidsmfreire

Cargo.lock

@@ -3,6 +3,7 @@ resolver = "2"
 members = [
   "sqlshield",
   "sqlshield-cli",
+  "sqlshield-introspect",
   "sqlshield-lsp",
   "sqlshield-py",
 ]

Cargo.toml

@@ -2,32 +2,38 @@
 
 ## Done
 
-- Schema-aware validation across SELECT / INSERT / UPDATE / DELETE,
-  CTEs (incl. `WITH RECURSIVE`), set ops, derived tables, JOIN ON /
-  USING, scope-aware subqueries.
+- Schema-aware validation across SELECT / INSERT / UPDATE / DELETE /
+  MERGE, CTEs (incl. `WITH RECURSIVE`), set ops, derived tables,
+  JOIN ON / USING / NATURAL, scope-aware subqueries.
 - Schema ingestion: `CREATE TABLE`, `ALTER TABLE` (ADD/DROP/RENAME
   COLUMN), `CREATE VIEW`, `CREATE TABLE … AS SELECT`.
-- 12 SQL dialects via `--dialect`.
-- ASCII case-insensitive identifier matching.
+- 12 SQL dialects via `--dialect`; Postgres quoted-vs-unquoted
+  identifier folding (other dialects keep ASCII case-insensitive
+  matching).
+- 3-part qualified column refs (`schema.table.col`).
+- Ambiguity detection for unqualified columns visible in 2+ relations.
+- Set-op (UNION / INTERSECT / EXCEPT) column-arity check.
+- `SELECT *` / `SELECT t.*` projection expansion in CTEs and derived
+  tables (resolves outer references and outer `ORDER BY`).
 - Output formats: text + JSON; split exit codes; `--stdin` mode.
 - `.sqlshield.toml` configuration with CLI override layering.
 - Parallel file walker (rayon) with default ignore list.
 - Language Server (`sqlshield-lsp`) for inline editor diagnostics
-  in `.py` / `.rs` / `.sql`.
+  in `.py` / `.rs` / `.sql`; auto-reload on schema-file changes.
+- First-party VS Code extension (`editors/vscode`) wrapping
+  `sqlshield-lsp` over stdio.
+- Live database introspection (`sqlshield-introspect`, exposed via
+  `--db-url`): read schema directly from a running Postgres or SQLite
+  instance.
 - Python bindings (`sqlshield-py`).
 
 ## Considering
 
-- **Live database introspection** — connect to Postgres / MySQL /
-  Sqlite and read the schema directly, no SQL dump required.
-- **Postgres quoted-vs-unquoted identifier folding** — currently we
-  treat all identifiers as case-insensitive; a quoted-aware mode
-  would match Postgres semantics more precisely.
-- **`MERGE` support** — would round out the DML coverage.
+- **MySQL live introspection** — pending: `mysql_common` uses unstable
+  Rust features that haven't reached the project's pinned toolchain.
+  A toolchain bump or a different sync driver would unblock this.
 - **More language extractors** — Go, TypeScript, Java string literals.
   Each is a small `finder/<lang>.rs` module + tree-sitter grammar.
-- **First-party VS Code extension** — currently the LSP is wired via
-  generic LSP-client extensions.
 
 ## Not planned
 

ROADMAP.md

@@ -0,0 +1,3 @@
+node_modules/
+out/
+*.vsix

editors/vscode/.gitignore

@@ -0,0 +1,9 @@
+.vscode/**
+.vscode-test/**
+src/**
+.gitignore
+.eslintrc.json
+**/tsconfig.json
+**/*.map
+**/*.ts
+node_modules

editors/vscode/.vscodeignore

@@ -0,0 +1,34 @@
+# sqlshield for VS Code
+
+First-party VS Code integration for [sqlshield](https://github.com/davidsmfreire/sqlshield) —
+a schema-aware static linter for raw SQL embedded in `.py`, `.rs`, and `.sql`
+files.
+
+## Requirements
+
+The extension wraps the `sqlshield-lsp` binary; install it first:
+
+```bash
+cargo install sqlshield-lsp
+```
+
+If `sqlshield-lsp` is not on `PATH`, set `sqlshield.serverPath` to the
+absolute path.
+
+## How it works
+
+The extension spawns `sqlshield-lsp` over stdio and forwards diagnostics
+to the editor as you type. A `.sqlshield.toml` at the workspace root
+configures schema location and dialect; see the project README for the
+full set of options.
+
+## Commands
+
+* **sqlshield: Restart Language Server** — restart the server without
+  reloading the window. Useful after editing the schema or
+  `.sqlshield.toml` from outside VS Code.
+
+## Settings
+
+* `sqlshield.serverPath` — binary path (default: `sqlshield-lsp`).
+* `sqlshield.trace.server` — log LSP traffic for debugging.

editors/vscode/README.md

@@ -0,0 +1,73 @@
+{
+  "name": "sqlshield-vscode",
+  "displayName": "sqlshield",
+  "description": "Schema-aware static linter for raw SQL embedded in Python, Rust, and .sql files.",
+  "version": "0.0.1",
+  "publisher": "davidsmfreire",
+  "license": "MIT",
+  "repository": {
+    "type": "git",
+    "url": "https://github.com/davidsmfreire/sqlshield"
+  },
+  "engines": {
+    "vscode": "^1.85.0"
+  },
+  "categories": [
+    "Linters",
+    "Programming Languages"
+  ],
+  "keywords": [
+    "sql",
+    "linter",
+    "postgres",
+    "mysql",
+    "sqlite",
+    "schema"
+  ],
+  "activationEvents": [
+    "onLanguage:sql",
+    "onLanguage:python",
+    "onLanguage:rust",
+    "workspaceContains:**/.sqlshield.toml",
+    "workspaceContains:**/schema.sql"
+  ],
+  "main": "./out/extension.js",
+  "contributes": {
+    "configuration": {
+      "title": "sqlshield",
+      "properties": {
+        "sqlshield.serverPath": {
+          "type": "string",
+          "default": "sqlshield-lsp",
+          "description": "Path to the sqlshield-lsp binary. Defaults to 'sqlshield-lsp' on PATH."
+        },
+        "sqlshield.trace.server": {
+          "type": "string",
+          "scope": "window",
+          "enum": ["off", "messages", "verbose"],
+          "default": "off",
+          "description": "Trace LSP traffic between VS Code and the sqlshield language server."
+        }
+      }
+    },
+    "commands": [
+      {
+        "command": "sqlshield.restartServer",
+        "title": "sqlshield: Restart Language Server"
+      }
+    ]
+  },
+  "scripts": {
+    "vscode:prepublish": "npm run compile",
+    "compile": "tsc -p ./",
+    "watch": "tsc -watch -p ./"
+  },
+  "dependencies": {
+    "vscode-languageclient": "^9.0.1"
+  },
+  "devDependencies": {
+    "@types/node": "^20.0.0",
+    "@types/vscode": "^1.85.0",
+    "typescript": "^5.4.0"
+  }
+}