feat: add bounded semantic SQL completion

[Light2Dark]

Summary

• infer provable CTE, derived-table, relation-alias, and first-set-arm output columns without parser AST coupling
• complete later set-operation arms, bounded DML targets/sources (including WITH-prefixed DML and BigQuery optional INTO), and exact JOIN USING intersections
• compose local and physical columns with exact provenance, cancellation-safe partial evidence, cached inference, and hard per-relation/aggregate limits
• add PostgreSQL, BigQuery, and DuckDB semantic corpora, real CodeMirror browser coverage, demo scenarios, migration docs, and performance/bundle gates

Safety and performance

• opaque template structure remains recovered/partial and never becomes authoritative
• local relation names never cross the physical column-provider boundary
• query output: 65,536-byte / 256-column bounds; aggregate local completion: 4,096 items
• parser-free core: 53,612 gzip bytes under a 54 KiB fail-closed ceiling

Validation

• 1,809 unit tests
• global coverage: 97.60% statements, 96.28% branches, 99.37% functions, 97.85% lines
• changed production files: >95% statements/branches/functions/lines per file
• strict typecheck and zero-warning lint
• 5 performance gates and 18 Chromium browser tests
• demo build, test-integrity, packed-package/SSR smoke, and worker-placement/parser-isolation smoke
• exactly two final adversarial reviewers; all findings resolved; both confirmed no remaining findings

Dependency

Stacked on #204. Change the base to main after #204 merges.

Roadmap: #169

---

Summary by cubic

Adds bounded semantic SQL completion to @marimo-team/codemirror-sql. It now infers safe CTE/derived outputs, completes later set-operation arms and DML relation sites, and limits JOIN USING suggestions to shared columns.

• New Features

  • Infers local output names from explicit CTE column lists, explicit aliases, and simple column references; stars and unaliased expressions stay partial.
  • Combines local outputs with physical catalog columns with exact provenance, cached inference, and strict bounds (256 columns, 65,536 bytes).
  • Completes relation sites in later set-operation arms; the first arm defines output names.
  • Adds bounded DML completion for INSERT, UPDATE, DELETE, MERGE, including WITH-prefixed DML and BigQuery’s optional INTO.
  • Ships PostgreSQL, BigQuery, and DuckDB semantic corpora, CodeMirror browser coverage (including CTE output completion), and performance gates; parser-free core stays under a 54 KiB gzip ceiling.

• Bug Fixes

  • Improves fail-closed handling for set operations, nested/embedded query fragments, and invalid tokens.
  • Deduplicates completion issues and preserves partial evidence when outputs are unavailable.
  • Tightens USING completion to immediate shared columns and stabilizes derived/table-function representation.

^{Written for commit 4691df8. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 32 files

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>