TypedQLiser MVP: working SQL type checker (Levels 1-5)

Real implementation using sqlparser-rs:
- Level 1: SQL parse validation (catches syntax errors)
- Level 2: Schema binding (catches missing tables and columns)
- Level 3: Type compatibility (catches type mismatches in operations)
- Level 4: Null safety (warns on nullable columns without handling)
- Level 5: Injection detection (flags string concatenation patterns)

Plugin architecture:
- QueryLanguagePlugin trait for language-agnostic checking
- SqlPlugin implementation with PostgreSQL/MySQL/SQLite dialect support
- Schema loading from JSON files (introspection planned)

Working example:
- examples/blog-api/ with schema.json, good-queries.sql, bad-queries.sql
- Demonstrates pass/fail across levels with real SQL

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

Author: hyperpolymath

Cargo.lock

@@ -19,6 +19,7 @@ anyhow = "1"
 thiserror = "2"
 walkdir = "2"
 glob = "0.3"
+sqlparser = "0.53"
 
 [dev-dependencies]
 tempfile = "3"

Cargo.toml

@@ -0,0 +1,13 @@
+-- These queries should FAIL at various levels
+
+-- Level 1 failure: syntax error
+SELEC * FORM users;
+
+-- Level 2 failure: nonexistent table
+SELECT * FROM nonexistent_table WHERE id = 1;
+
+-- Level 2 failure: nonexistent column
+SELECT id, full_name FROM users;
+
+-- Level 3 failure: comparing string to integer
+SELECT id FROM posts WHERE author_id = 'not_a_number';

examples/blog-api/bad-queries.sql

@@ -0,0 +1,13 @@
+-- These queries should all pass levels 1-5
+
+-- Simple select with known columns
+SELECT id, username, email FROM users WHERE id = $1;
+
+-- Join with qualified column references
+SELECT p.title, u.username FROM posts p JOIN users u ON p.author_id = u.id WHERE p.published = true;
+
+-- Parameterised insert (injection-safe)
+INSERT INTO comments (post_id, user_id, body) VALUES ($1, $2, $3);
+
+-- Type-compatible comparison: integer = integer
+SELECT id, title FROM posts WHERE author_id = $1 AND published = true;

examples/blog-api/good-queries.sql

@@ -0,0 +1,37 @@
+{
+  "tables": [
+    {
+      "name": "users",
+      "columns": [
+        { "name": "id", "type": "serial", "nullable": false, "primary_key": true },
+        { "name": "username", "type": "varchar(50)", "nullable": false },
+        { "name": "email", "type": "varchar(255)", "nullable": false },
+        { "name": "bio", "type": "text", "nullable": true },
+        { "name": "created_at", "type": "timestamp", "nullable": false }
+      ]
+    },
+    {
+      "name": "posts",
+      "columns": [
+        { "name": "id", "type": "serial", "nullable": false, "primary_key": true },
+        { "name": "author_id", "type": "integer", "nullable": false },
+        { "name": "title", "type": "varchar(200)", "nullable": false },
+        { "name": "body", "type": "text", "nullable": false },
+        { "name": "published", "type": "boolean", "nullable": false },
+        { "name": "category", "type": "varchar(50)", "nullable": true },
+        { "name": "created_at", "type": "timestamp", "nullable": false }
+      ]
+    },
+    {
+      "name": "comments",
+      "columns": [
+        { "name": "id", "type": "serial", "nullable": false, "primary_key": true },
+        { "name": "post_id", "type": "integer", "nullable": false },
+        { "name": "user_id", "type": "integer", "nullable": false },
+        { "name": "body", "type": "text", "nullable": false },
+        { "name": "parent_id", "type": "integer", "nullable": true },
+        { "name": "created_at", "type": "timestamp", "nullable": false }
+      ]
+    }
+  ]
+}

examples/blog-api/schema.json

@@ -0,0 +1,25 @@
+# TypedQLiser example: blog API
+# Run: cd examples/blog-api && typedqliser check
+
+[typedql]
+name = "blog-api"
+language = "sql"
+level = 4
+schema-source = "file"
+
+[database]
+target-db = "postgresql"
+schema-file = "schema.json"
+
+[paths]
+queries = ["*.sql"]
+embedding = "standalone"
+
+[output]
+proof-certificates = false
+error-format = "human"
+
+[levels]
+enforce = [1, 2, 3]
+warn = [4]
+skip = [5, 6, 7, 8, 9, 10]