scythe-codegen 0.15.0

// Auto-generated by test-generator. Do not edit.
// Category: lint

#[allow(unused_imports)]
use scythe_codegen as _codegen;
#[allow(unused_imports)]
use syn as _syn;

#[allow(dead_code)]
fn normalize_whitespace(s: &str) -> String {
    s.split_whitespace().collect::<Vec<_>>().join(" ")
}

#[test]
fn test_and_in_join_clean() {
    // From: testing_data/lint/antipattern/04_and_in_join_clean.json
    // "AND condition in JOIN ON clause should not trigger SC-A03"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserOrders\n-- @returns :many\nSELECT u.id, o.total FROM users u JOIN orders o ON u.id = o.user_id AND o.total > 0;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_equal_null_fires() {
    // From: testing_data/lint/antipattern/01_equal_null_fires.json
    // "Comparing with = NULL instead of IS NULL should trigger SC-A01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetNullStatus\n-- @returns :many\nSELECT id, name FROM users WHERE status = NULL;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(!_violations.is_empty(), "expected lint violations for equal_null_fires");
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-A01")),
        "expected violation SC-A01"
    );
}

#[test]
fn test_is_null_clean() {
    // From: testing_data/lint/antipattern/02_is_null_clean.json
    // "Using IS NULL instead of = NULL should not trigger SC-A01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetNullStatus\n-- @returns :many\nSELECT id, name FROM users WHERE status IS NULL;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_or_in_join_fires() {
    // From: testing_data/lint/antipattern/03_or_in_join_fires.json
    // "OR condition in JOIN ON clause should trigger SC-A03"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserOrders\n-- @returns :many\nSELECT u.id, o.total FROM users u JOIN orders o ON u.id = o.user_id OR u.name = o.total::text;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(!_violations.is_empty(), "expected lint violations for or_in_join_fires");
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-A03")),
        "expected violation SC-A03"
    );
}

#[test]
fn test_duplicate_query_names_fires() {
    // From: testing_data/lint/codegen/04_duplicate_query_names.json
    // "SC-C03 duplicate query name detection is handled at engine level, not per-fixture. This fixture verifies that a single query with a unique name passes without C03 violations."
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUser\n-- @returns :one\nSELECT id, name FROM users WHERE id = $1;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_exec_with_returning_fires() {
    // From: testing_data/lint/codegen/01_exec_with_returning_fires.json
    // ":exec with RETURNING clause should trigger SC-C02 (wasted RETURNING result)"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUser\n-- @returns :exec\nINSERT INTO users (name) VALUES ($1) RETURNING id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for exec_with_returning_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-C02")),
        "expected violation SC-C02"
    );
}

#[test]
fn test_exec_without_returning_clean() {
    // From: testing_data/lint/codegen/02_exec_without_returning_clean.json
    // ":exec without RETURNING clause should not trigger SC-C02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUser\n-- @returns :exec\nINSERT INTO users (name) VALUES ($1);";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_one_with_returning_clean() {
    // From: testing_data/lint/codegen/03_one_with_returning_clean.json
    // ":one with RETURNING clause is correct usage, should not trigger SC-C02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUser\n-- @returns :one\nINSERT INTO users (name) VALUES ($1) RETURNING id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_bad_query_name_fires() {
    // From: testing_data/lint/naming/03_bad_query_name_fires.json
    // "Query name in camelCase (not PascalCase) should trigger SC-N03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name doSomething\n-- @returns :many\nSELECT id, name FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for bad_query_name_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-N03")),
        "expected violation SC-N03"
    );
}

#[test]
fn test_good_query_name_clean() {
    // From: testing_data/lint/naming/04_good_query_name_clean.json
    // "Query name in PascalCase should not trigger SC-N03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUser\n-- @returns :many\nSELECT id, name FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_lowercase_alias_clean() {
    // From: testing_data/lint/naming/06_lowercase_alias_clean.json
    // "Lowercase table alias should not trigger SC-N04"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsers\n-- @returns :many\nSELECT id FROM users u;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_non_snake_case_alias_fires() {
    // From: testing_data/lint/naming/01_non_snake_case_alias_fires.json
    // "Column alias in camelCase should trigger SC-N01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsers\n-- @returns :many\nSELECT id AS userId FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for non_snake_case_alias_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-N01")),
        "expected violation SC-N01"
    );
}

#[test]
fn test_non_snake_case_table_fires() {
    // From: testing_data/lint/naming/07_non_snake_case_table_fires.json
    // "Table named in camelCase should trigger SC-N02 catalog check"
    let schema_sql = &["CREATE TABLE \"User-Profiles\" (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetProfiles\n-- @returns :many\nSELECT id, name FROM \"User-Profiles\";";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for non_snake_case_table_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-N02")),
        "expected violation SC-N02"
    );
}

#[test]
fn test_snake_case_alias_clean() {
    // From: testing_data/lint/naming/02_snake_case_alias_clean.json
    // "Column alias in snake_case should not trigger SC-N01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsers\n-- @returns :many\nSELECT id AS user_id FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_snake_case_table_clean() {
    // From: testing_data/lint/naming/08_snake_case_table_clean.json
    // "Table named in snake_case should not trigger SC-N02"
    let schema_sql = &["CREATE TABLE user_accounts (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetAccounts\n-- @returns :many\nSELECT id, name FROM user_accounts;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_uppercase_alias_fires() {
    // From: testing_data/lint/naming/05_uppercase_alias_fires.json
    // "Uppercase table alias should trigger SC-N04"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsers\n-- @returns :many\nSELECT id FROM users U;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for uppercase_alias_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-N04")),
        "expected violation SC-N04"
    );
}

#[test]
fn test_in_subquery_clean() {
    // From: testing_data/lint/performance/06_in_subquery_clean.json
    // "IN with subquery (not NOT IN) should not trigger SC-P03"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsersWithOrders\n-- @returns :many\nSELECT id, name FROM users WHERE id IN (SELECT user_id FROM orders);";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_like_leading_wildcard_fires() {
    // From: testing_data/lint/performance/03_like_wildcard_fires.json
    // "LIKE with leading wildcard should trigger SC-P02 (prevents index usage)"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name SearchUsers\n-- @returns :many\nSELECT id, name FROM users WHERE name LIKE '%test%';";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for like_leading_wildcard_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-P02")),
        "expected violation SC-P02"
    );
}

#[test]
fn test_like_suffix_wildcard_clean() {
    // From: testing_data/lint/performance/04_like_suffix_clean.json
    // "LIKE with only trailing wildcard should not trigger SC-P02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name SearchUsersByPrefix\n-- @returns :many\nSELECT id, name FROM users WHERE name LIKE 'test%';";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_not_in_subquery_fires() {
    // From: testing_data/lint/performance/05_not_in_subquery_fires.json
    // "NOT IN with subquery should trigger SC-P03 (prefer NOT EXISTS)"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsersWithoutOrders\n-- @returns :many\nSELECT id, name FROM users WHERE id NOT IN (SELECT user_id FROM orders);";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for not_in_subquery_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-P03")),
        "expected violation SC-P03"
    );
}

#[test]
fn test_order_with_limit_clean() {
    // From: testing_data/lint/performance/02_order_with_limit_clean.json
    // "ORDER BY with LIMIT should not trigger SC-P01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetTopUsers\n-- @returns :many\nSELECT id, name FROM users ORDER BY name LIMIT 10;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_order_without_limit_fires() {
    // From: testing_data/lint/performance/01_order_without_limit_fires.json
    // "ORDER BY without LIMIT should trigger SC-P01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsersSorted\n-- @returns :many\nSELECT id, name FROM users ORDER BY name;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for order_without_limit_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-P01")),
        "expected violation SC-P01"
    );
}

#[test]
fn test_all_params_used_clean() {
    // From: testing_data/lint/safety/12_all_params_used_clean.json
    // "Query with all parameters used consecutively should not trigger SC-S04"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserByNameAndStatus\n-- @returns :many\nSELECT id, name FROM users WHERE name = $1 AND status = $2;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ambiguous_column_fires() {
    // From: testing_data/lint/safety/09_ambiguous_column_fires.json
    // "Unqualified column in JOIN that exists in multiple tables should trigger SC-S06"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name GetUserOrders\n-- @returns :many\nSELECT u.id, name FROM users u JOIN orders o ON u.id = o.user_id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ambiguous_column_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S06")),
        "expected violation SC-S06"
    );
}

#[test]
fn test_delete_with_where_clean() {
    // From: testing_data/lint/safety/04_delete_with_where_clean.json
    // "DELETE with WHERE clause should not trigger SC-S02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteUser\n-- @returns :exec\nDELETE FROM users WHERE id = $1;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_delete_without_where_fires() {
    // From: testing_data/lint/safety/03_delete_without_where_fires.json
    // "DELETE without WHERE clause should trigger SC-S02 violation"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteAllUsers\n-- @returns :exec\nDELETE FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for delete_without_where_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S02")),
        "expected violation SC-S02"
    );
}

#[test]
fn test_has_returning_clean() {
    // From: testing_data/lint/safety/08_has_returning_clean.json
    // "INSERT with :one and RETURNING clause should not trigger SC-S05"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUser\n-- @returns :one\nINSERT INTO users (name) VALUES ($1) RETURNING id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_missing_returning_fires() {
    // From: testing_data/lint/safety/07_missing_returning_fires.json
    // "INSERT with :one but no RETURNING clause should trigger SC-S05"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUser\n-- @returns :one\nINSERT INTO users (name) VALUES ($1);";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for missing_returning_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S05")),
        "expected violation SC-S05"
    );
}

#[test]
fn test_qualified_column_clean() {
    // From: testing_data/lint/safety/10_qualified_column_clean.json
    // "Fully qualified column in JOIN should not trigger SC-S06"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name GetUserOrders\n-- @returns :many\nSELECT u.id FROM users u JOIN orders o ON u.id = o.user_id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_select_columns_clean() {
    // From: testing_data/lint/safety/06_select_columns_clean.json
    // "SELECT with explicit columns should not trigger SC-S03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUsers\n-- @returns :many\nSELECT id, name FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_select_star_fires() {
    // From: testing_data/lint/safety/05_select_star_fires.json
    // "SELECT * should trigger SC-S03 violation"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetAllUsers\n-- @returns :many\nSELECT * FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for select_star_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S03")),
        "expected violation SC-S03"
    );
}

#[test]
fn test_unused_params_fires() {
    // From: testing_data/lint/safety/11_unused_params_fires.json
    // "Query with gap in parameter numbering (unused $2) should trigger SC-S04"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name GetUserByName\n-- @returns :many\nSELECT id, name FROM users WHERE name = $1 AND id > $3;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for unused_params_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S04")),
        "expected violation SC-S04"
    );
}

#[test]
fn test_update_with_where_clean() {
    // From: testing_data/lint/safety/02_update_with_where_clean.json
    // "UPDATE with WHERE clause should not trigger SC-S01"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUser\n-- @returns :exec\nUPDATE users SET name = $1 WHERE id = $2;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_update_without_where_fires() {
    // From: testing_data/lint/safety/01_update_without_where_fires.json
    // "UPDATE without WHERE clause should trigger SC-S01 violation"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateAllUsers\n-- @returns :exec\nUPDATE users SET name = $1;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for update_without_where_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-S01")),
        "expected violation SC-S01"
    );
}

#[test]
fn test_adding_not_nullable_field_clean() {
    // From: testing_data/lint/security/58_adding_not_nullable_field_clean.json
    // "ALTER TABLE ADD COLUMN NOT NULL with DEFAULT should not trigger SC-MIG18"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUsersAddRequiredEmail\n-- @returns :exec\nALTER TABLE users ADD COLUMN email text NOT NULL DEFAULT ''";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_adding_not_nullable_field_fires() {
    // From: testing_data/lint/security/57_adding_not_nullable_field_fires.json
    // "ALTER TABLE ADD COLUMN NOT NULL without DEFAULT should trigger SC-MIG18"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name UpdateUsersAddRequiredEmail\n-- @returns :exec\nALTER TABLE users ADD COLUMN email text NOT NULL";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for adding_not_nullable_field_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG18")),
        "expected violation SC-MIG18"
    );
}

#[test]
fn test_adding_primary_key_constraint_clean() {
    // From: testing_data/lint/security/52_adding_primary_key_constraint_clean.json
    // "ALTER TABLE ADD CONSTRAINT PRIMARY KEY USING INDEX should not trigger SC-MIG15"
    let schema_sql = &["CREATE TABLE accounts (id bigint NOT NULL, balance bigint)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateAccountsAttachPrimaryKeyIndex\n-- @returns :exec\nALTER TABLE accounts ADD CONSTRAINT accounts_pk PRIMARY KEY USING INDEX accounts_pk_idx";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_adding_primary_key_constraint_fires() {
    // From: testing_data/lint/security/51_adding_primary_key_constraint_fires.json
    // "ALTER TABLE ADD CONSTRAINT PRIMARY KEY without USING INDEX should trigger SC-MIG15"
    let schema_sql = &["CREATE TABLE accounts (id bigint NOT NULL, balance bigint)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateAccountsAddPrimaryKey\n-- @returns :exec\nALTER TABLE accounts ADD CONSTRAINT accounts_pk PRIMARY KEY (id)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for adding_primary_key_constraint_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG15")),
        "expected violation SC-MIG15"
    );
}

#[test]
fn test_alter_column_type_clean() {
    // From: testing_data/lint/security/40_alter_column_type_clean.json
    // "ALTER COLUMN SET DEFAULT should not trigger SC-MIG09"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name UpdateUsersActiveDefault\n-- @returns :exec\nALTER TABLE users ALTER COLUMN active SET DEFAULT TRUE";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_alter_column_type_fires() {
    // From: testing_data/lint/security/39_alter_column_type_fires.json
    // "ALTER COLUMN TYPE should trigger SC-MIG09"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUsersIdToBigint\n-- @returns :exec\nALTER TABLE users ALTER COLUMN id TYPE bigint";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for alter_column_type_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG09")),
        "expected violation SC-MIG09"
    );
}

#[test]
fn test_ban_create_domain_with_constraint_clean() {
    // From: testing_data/lint/security/54_ban_create_domain_with_constraint_clean.json
    // "CREATE DOMAIN without constraints should not trigger SC-MIG16"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreatePositiveIntDomain\n-- @returns :exec\nCREATE DOMAIN positive_int AS integer";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_create_domain_with_constraint_fires() {
    // From: testing_data/lint/security/53_ban_create_domain_with_constraint_fires.json
    // "CREATE DOMAIN with a CHECK constraint should trigger SC-MIG16"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreatePositiveIntDomain\n-- @returns :exec\nCREATE DOMAIN positive_int AS integer CHECK (VALUE > 0)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_create_domain_with_constraint_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG16")),
        "expected violation SC-MIG16"
    );
}

#[test]
fn test_ban_drop_column_clean() {
    // From: testing_data/lint/security/26_ban_drop_column_clean.json
    // "ALTER TABLE … ADD COLUMN should not trigger SC-MIG02"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateNicknameColumn\n-- @returns :exec\nALTER TABLE users ADD COLUMN nickname text";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_drop_column_fires() {
    // From: testing_data/lint/security/25_ban_drop_column_fires.json
    // "ALTER TABLE … DROP COLUMN should trigger SC-MIG02"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteLegacyColumn\n-- @returns :exec\nALTER TABLE users DROP COLUMN legacy_id";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_drop_column_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG02")),
        "expected violation SC-MIG02"
    );
}

#[test]
fn test_ban_drop_database_clean() {
    // From: testing_data/lint/security/34_ban_drop_database_clean.json
    // "CREATE SCHEMA should not trigger SC-MIG06"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateReportingSchema\n-- @returns :exec\nCREATE SCHEMA reporting";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_drop_database_fires() {
    // From: testing_data/lint/security/33_ban_drop_database_fires.json
    // "DROP DATABASE should trigger SC-MIG06"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteLegacyAppDatabase\n-- @returns :exec\nDROP DATABASE legacy_app";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_drop_database_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG06")),
        "expected violation SC-MIG06"
    );
}

#[test]
fn test_ban_drop_not_null_clean() {
    // From: testing_data/lint/security/56_ban_drop_not_null_clean.json
    // "ALTER COLUMN SET NOT NULL is the inverse and should not trigger SC-MIG17"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY, email text)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name UpdateUsersRequireEmail\n-- @returns :exec\nALTER TABLE users ALTER COLUMN email SET NOT NULL";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_drop_not_null_fires() {
    // From: testing_data/lint/security/55_ban_drop_not_null_fires.json
    // "ALTER COLUMN DROP NOT NULL should trigger SC-MIG17"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY, email text NOT NULL)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name UpdateUsersAllowNullEmail\n-- @returns :exec\nALTER TABLE users ALTER COLUMN email DROP NOT NULL";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_drop_not_null_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG17")),
        "expected violation SC-MIG17"
    );
}

#[test]
fn test_ban_drop_table_clean() {
    // From: testing_data/lint/security/24_ban_drop_table_clean.json
    // "DROP VIEW should not trigger SC-MIG01"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteUserSummaryView\n-- @returns :exec\nDROP VIEW user_summary";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_drop_table_fires() {
    // From: testing_data/lint/security/23_ban_drop_table_fires.json
    // "DROP TABLE should trigger SC-MIG01"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteUsersTable\n-- @returns :exec\nDROP TABLE users";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_drop_table_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG01")),
        "expected violation SC-MIG01"
    );
}

#[test]
fn test_ban_truncate_cascade_clean() {
    // From: testing_data/lint/security/38_ban_truncate_cascade_clean.json
    // "TRUNCATE without CASCADE should not trigger SC-MIG08"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteAllUsers\n-- @returns :exec\nTRUNCATE TABLE users";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_ban_truncate_cascade_fires() {
    // From: testing_data/lint/security/37_ban_truncate_cascade_fires.json
    // "TRUNCATE … CASCADE should trigger SC-MIG08"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name DeleteAllUsersAndDependents\n-- @returns :exec\nTRUNCATE TABLE users CASCADE";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for ban_truncate_cascade_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG08")),
        "expected violation SC-MIG08"
    );
}

#[test]
fn test_cartesian_join_clean() {
    // From: testing_data/lint/security/08_cartesian_join_clean.json
    // "Explicit JOIN with ON condition should not trigger SC-SEC08"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name ListOrdersWithUser\n-- @returns :many\nSELECT users.id AS user_id, orders.id AS order_id FROM users JOIN orders ON orders.user_id = users.id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_cartesian_join_fires() {
    // From: testing_data/lint/security/07_cartesian_join_fires.json
    // "Comma-separated FROM with no WHERE should trigger SC-SEC08"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name ListAllUserOrderPairs\n-- @returns :many\nSELECT users.id AS user_id, orders.id AS order_id FROM users, orders;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for cartesian_join_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC08")),
        "expected violation SC-SEC08"
    );
}

#[test]
fn test_check_constraint_always_true_clean() {
    // From: testing_data/lint/security/70_check_constraint_always_true_clean.json
    // "CREATE TABLE with a real CHECK predicate should not trigger SC-CHK01"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAccountsTable\n-- @returns :exec\nCREATE TABLE accounts (id bigint PRIMARY KEY, balance numeric CHECK (balance >= 0))";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_check_constraint_always_true_fires() {
    // From: testing_data/lint/security/69_check_constraint_always_true_fires.json
    // "CREATE TABLE with a column-level CHECK (true) should trigger SC-CHK01"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAccountsTable\n-- @returns :exec\nCREATE TABLE accounts (id bigint PRIMARY KEY, balance numeric CHECK (true))";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for check_constraint_always_true_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-CHK01")),
        "expected violation SC-CHK01"
    );
}

#[test]
fn test_constraint_missing_not_valid_clean() {
    // From: testing_data/lint/security/32_constraint_missing_not_valid_clean.json
    // "ADD FOREIGN KEY with NOT VALID should not trigger SC-MIG05"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateOrdersUserFkNotValid\n-- @returns :exec\nALTER TABLE orders ADD CONSTRAINT orders_user_fk FOREIGN KEY (user_id) REFERENCES users (id) NOT VALID";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_constraint_missing_not_valid_fires() {
    // From: testing_data/lint/security/31_constraint_missing_not_valid_fires.json
    // "ADD FOREIGN KEY without NOT VALID should trigger SC-MIG05"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateOrdersUserFk\n-- @returns :exec\nALTER TABLE orders ADD CONSTRAINT orders_user_fk FOREIGN KEY (user_id) REFERENCES users (id)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for constraint_missing_not_valid_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG05")),
        "expected violation SC-MIG05"
    );
}

#[test]
fn test_dangerous_function_clean() {
    // From: testing_data/lint/security/02_dangerous_function_clean.json
    // "Ordinary function calls should not trigger SC-SEC01"
    let schema_sql = &["CREATE TABLE files (id SERIAL PRIMARY KEY, path TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CountFiles\n-- @returns :one\nSELECT count(*) AS total FROM files;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_dangerous_function_fires() {
    // From: testing_data/lint/security/01_dangerous_function_fires.json
    // "Calling pg_read_file should trigger SC-SEC01"
    let schema_sql = &["CREATE TABLE files (id SERIAL PRIMARY KEY, path TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetServerFileSize\n-- @returns :one\nSELECT length(pg_read_file('/etc/passwd')) AS sz;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for dangerous_function_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC01")),
        "expected violation SC-SEC01"
    );
}

#[test]
fn test_disallowed_unique_constraint_clean() {
    // From: testing_data/lint/security/50_disallowed_unique_constraint_clean.json
    // "ALTER TABLE ADD CONSTRAINT UNIQUE USING INDEX should not trigger SC-MIG14"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY, email text)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUsersAttachEmailUniqueIndex\n-- @returns :exec\nALTER TABLE users ADD CONSTRAINT users_email_uniq UNIQUE USING INDEX users_email_idx";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_disallowed_unique_constraint_fires() {
    // From: testing_data/lint/security/49_disallowed_unique_constraint_fires.json
    // "ALTER TABLE ADD CONSTRAINT UNIQUE without USING INDEX should trigger SC-MIG14"
    let schema_sql = &["CREATE TABLE users (id bigint PRIMARY KEY, email text)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUsersAddEmailUnique\n-- @returns :exec\nALTER TABLE users ADD CONSTRAINT users_email_uniq UNIQUE (email)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for disallowed_unique_constraint_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG14")),
        "expected violation SC-MIG14"
    );
}

#[test]
fn test_function_search_path_mutable_clean() {
    // From: testing_data/lint/security/60_function_search_path_mutable_clean.json
    // "CREATE FUNCTION with SET search_path should not trigger SC-SEC12"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAddOneFunction\n-- @returns :exec\nCREATE FUNCTION public.add_one(i int) RETURNS int LANGUAGE sql SET search_path = pg_catalog, public AS $$ SELECT i + 1 $$";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_function_search_path_mutable_fires() {
    // From: testing_data/lint/security/59_function_search_path_mutable_fires.json
    // "CREATE FUNCTION without SET search_path (and not SECURITY DEFINER) should trigger SC-SEC12"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAddOneFunction\n-- @returns :exec\nCREATE FUNCTION public.add_one(i int) RETURNS int LANGUAGE sql AS $$ SELECT i + 1 $$";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for function_search_path_mutable_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC12")),
        "expected violation SC-SEC12"
    );
}

#[test]
fn test_grant_all_clean() {
    // From: testing_data/lint/security/04_grant_all_clean.json
    // "GRANT with explicit privileges should not trigger SC-SEC02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateReadOnlyGrant\n-- @returns :exec\nGRANT SELECT ON users TO app_role;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_grant_all_fires() {
    // From: testing_data/lint/security/03_grant_all_fires.json
    // "GRANT ALL should trigger SC-SEC02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateGrantAll\n-- @returns :exec\nGRANT ALL ON users TO app_role;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(!_violations.is_empty(), "expected lint violations for grant_all_fires");
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC02")),
        "expected violation SC-SEC02"
    );
}

#[test]
fn test_grant_to_public_clean() {
    // From: testing_data/lint/security/06_grant_to_public_clean.json
    // "GRANT to a specific role should not trigger SC-SEC03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateRoleGrant\n-- @returns :exec\nGRANT SELECT ON users TO app_role;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_grant_to_public_fires() {
    // From: testing_data/lint/security/05_grant_to_public_fires.json
    // "GRANT … TO PUBLIC should trigger SC-SEC03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreatePublicGrant\n-- @returns :exec\nGRANT SELECT ON users TO PUBLIC;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for grant_to_public_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC03")),
        "expected violation SC-SEC03"
    );
}

#[test]
fn test_literal_password_clean() {
    // From: testing_data/lint/security/16_literal_password_clean.json
    // "CREATE ROLE with PASSWORD NULL should not trigger SC-SEC05"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateNopwdRole\n-- @returns :exec\nCREATE ROLE nopwd PASSWORD NULL";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_literal_password_fires() {
    // From: testing_data/lint/security/15_literal_password_fires.json
    // "CREATE ROLE with a literal password should trigger SC-SEC05"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAppRole\n-- @returns :exec\nCREATE ROLE appuser PASSWORD 'hunter2'";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for literal_password_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC05")),
        "expected violation SC-SEC05"
    );
}

#[test]
fn test_policy_always_permissive_clean() {
    // From: testing_data/lint/security/66_policy_always_permissive_clean.json
    // "SELECT-only policy with USING (true) is the intentional everyone-can-read pattern; SC-RLS02 must not fire"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateReadablePolicy\n-- @returns :exec\nCREATE POLICY readable ON tenants FOR SELECT USING (true)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_policy_always_permissive_fires() {
    // From: testing_data/lint/security/65_policy_always_permissive_fires.json
    // "Permissive RLS policy with USING (true) on UPDATE should trigger SC-RLS02"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateAllowAllUpdatePolicy\n-- @returns :exec\nCREATE POLICY allow_all ON tenants FOR UPDATE USING (true)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for policy_always_permissive_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-RLS02")),
        "expected violation SC-RLS02"
    );
}

#[test]
fn test_policy_references_user_metadata_clean() {
    // From: testing_data/lint/security/64_policy_references_user_metadata_clean.json
    // "RLS policy reading from app_metadata (server-set) should not trigger SC-RLS01"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY, tenant_id text)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateTrustJwtPolicy\n-- @returns :exec\nCREATE POLICY trust_jwt ON tenants USING ((select auth.jwt()) -> 'app_metadata' ->> 'tenant_id' = tenant_id)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_policy_references_user_metadata_fires() {
    // From: testing_data/lint/security/63_policy_references_user_metadata_fires.json
    // "RLS policy reading from user_metadata should trigger SC-RLS01"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY, tenant_id text)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateTrustJwtPolicy\n-- @returns :exec\nCREATE POLICY trust_jwt ON tenants USING (auth.jwt() -> 'user_metadata' ->> 'tenant_id' = tenant_id)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for policy_references_user_metadata_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-RLS01")),
        "expected violation SC-RLS01"
    );
}

#[test]
fn test_policy_uses_uncached_auth_function_clean() {
    // From: testing_data/lint/security/68_policy_uses_uncached_auth_function_clean.json
    // "Wrapped (select auth.uid()) in policy USING is the cached form; SC-RLS03 must not fire"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY, user_id uuid)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateTenantPolicy\n-- @returns :exec\nCREATE POLICY tenant ON tenants USING (user_id = (select auth.uid()))";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_policy_uses_uncached_auth_function_fires() {
    // From: testing_data/lint/security/67_policy_uses_uncached_auth_function_fires.json
    // "Bare auth.uid() in policy USING should trigger SC-RLS03"
    let schema_sql = &["CREATE TABLE tenants (id bigint PRIMARY KEY, user_id uuid)"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateTenantPolicy\n-- @returns :exec\nCREATE POLICY tenant ON tenants USING (user_id = auth.uid())";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for policy_uses_uncached_auth_function_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-RLS03")),
        "expected violation SC-RLS03"
    );
}

#[test]
fn test_prefer_bigint_over_int_clean() {
    // From: testing_data/lint/security/42_prefer_bigint_over_int_clean.json
    // "CREATE TABLE with bigint column should not trigger SC-MIG10"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateAccountsTable\n-- @returns :exec\nCREATE TABLE accounts (id bigint PRIMARY KEY, name text)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_prefer_bigint_over_int_fires() {
    // From: testing_data/lint/security/41_prefer_bigint_over_int_fires.json
    // "CREATE TABLE with int column should trigger SC-MIG10"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUsersTable\n-- @returns :exec\nCREATE TABLE users (id int PRIMARY KEY, name text)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for prefer_bigint_over_int_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG10")),
        "expected violation SC-MIG10"
    );
}

#[test]
fn test_prefer_identity_over_serial_clean() {
    // From: testing_data/lint/security/48_prefer_identity_over_serial_clean.json
    // "CREATE INDEX CONCURRENTLY should not trigger SC-MIG13"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateUserNameIndex\n-- @returns :exec\nCREATE INDEX CONCURRENTLY idx_users_name ON users (name)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_prefer_identity_over_serial_fires() {
    // From: testing_data/lint/security/47_prefer_identity_over_serial_fires.json
    // "CREATE TABLE with serial column should trigger SC-MIG13"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateOrdersTable\n-- @returns :exec\nCREATE TABLE orders (id serial PRIMARY KEY, total bigint)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for prefer_identity_over_serial_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG13")),
        "expected violation SC-MIG13"
    );
}

#[test]
fn test_prefer_text_over_varchar_clean() {
    // From: testing_data/lint/security/44_prefer_text_over_varchar_clean.json
    // "CREATE TABLE with text column should not trigger SC-MIG11"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateTagsTable\n-- @returns :exec\nCREATE TABLE tags (id bigint PRIMARY KEY, label text)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_prefer_text_over_varchar_fires() {
    // From: testing_data/lint/security/43_prefer_text_over_varchar_fires.json
    // "CREATE TABLE with varchar(n) column should trigger SC-MIG11"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateProductsTable\n-- @returns :exec\nCREATE TABLE products (id bigint PRIMARY KEY, name varchar(255))";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for prefer_text_over_varchar_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG11")),
        "expected violation SC-MIG11"
    );
}

#[test]
fn test_prefer_timestamptz_clean() {
    // From: testing_data/lint/security/46_prefer_timestamptz_clean.json
    // "CREATE TABLE with timestamptz column should not trigger SC-MIG12"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateSessionsTable\n-- @returns :exec\nCREATE TABLE sessions (id bigint PRIMARY KEY, started_at timestamptz)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_prefer_timestamptz_fires() {
    // From: testing_data/lint/security/45_prefer_timestamptz_fires.json
    // "CREATE TABLE with timestamp column should trigger SC-MIG12"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateEventsTable\n-- @returns :exec\nCREATE TABLE events (id bigint PRIMARY KEY, occurred_at timestamp)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for prefer_timestamptz_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG12")),
        "expected violation SC-MIG12"
    );
}

#[test]
fn test_renaming_column_clean() {
    // From: testing_data/lint/security/30_renaming_column_clean.json
    // "ALTER TABLE … ADD COLUMN should not trigger SC-MIG04"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUsernameColumn\n-- @returns :exec\nALTER TABLE users ADD COLUMN username text";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_renaming_column_fires() {
    // From: testing_data/lint/security/29_renaming_column_fires.json
    // "ALTER TABLE … RENAME COLUMN should trigger SC-MIG04"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name UpdateUserNickToUsername\n-- @returns :exec\nALTER TABLE users RENAME COLUMN nick TO username";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for renaming_column_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG04")),
        "expected violation SC-MIG04"
    );
}

#[test]
fn test_renaming_table_clean() {
    // From: testing_data/lint/security/36_renaming_table_clean.json
    // "ALTER TABLE … ADD COLUMN should not trigger SC-MIG07"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUsersEmailColumn\n-- @returns :exec\nALTER TABLE users ADD COLUMN email text";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_renaming_table_fires() {
    // From: testing_data/lint/security/35_renaming_table_fires.json
    // "ALTER TABLE … RENAME TO should trigger SC-MIG07"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name UpdateUsersTableToAccounts\n-- @returns :exec\nALTER TABLE users RENAME TO accounts";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for renaming_table_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG07")),
        "expected violation SC-MIG07"
    );
}

#[test]
fn test_require_concurrent_index_clean() {
    // From: testing_data/lint/security/28_require_concurrent_index_clean.json
    // "CREATE INDEX CONCURRENTLY should not trigger SC-MIG03"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUserEmailIndexConcurrent\n-- @returns :exec\nCREATE INDEX CONCURRENTLY idx_users_email ON users (email)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_require_concurrent_index_fires() {
    // From: testing_data/lint/security/27_require_concurrent_index_fires.json
    // "CREATE INDEX without CONCURRENTLY should trigger SC-MIG03"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateUserEmailIndex\n-- @returns :exec\nCREATE INDEX idx_users_email ON users (email)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for require_concurrent_index_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG03")),
        "expected violation SC-MIG03"
    );
}

#[test]
fn test_security_definer_clean() {
    // From: testing_data/lint/security/12_security_definer_clean.json
    // "SECURITY DEFINER with SET search_path should not trigger SC-SEC10"
    let schema_sql = &["CREATE TABLE audit_log (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateBumpAuditFnSafe\n-- @returns :exec\nCREATE FUNCTION bump_audit() RETURNS int AS $$ SELECT 1 $$ LANGUAGE SQL SECURITY DEFINER SET search_path = pg_catalog, public;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_security_definer_fires() {
    // From: testing_data/lint/security/11_security_definer_fires.json
    // "SECURITY DEFINER without SET search_path should trigger SC-SEC10"
    let schema_sql = &["CREATE TABLE audit_log (id SERIAL PRIMARY KEY);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateBumpAuditFn\n-- @returns :exec\nCREATE FUNCTION bump_audit() RETURNS int AS $$ SELECT 1 $$ LANGUAGE SQL SECURITY DEFINER;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for security_definer_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC10")),
        "expected violation SC-SEC10"
    );
}

#[test]
fn test_select_star_pii_clean() {
    // From: testing_data/lint/security/20_select_star_pii_clean.json
    // "SELECT * from a table with no PII columns — SC-SEC07 does not fire (SC-S03 SELECT * warning is separate)"
    let schema_sql = &["CREATE TABLE products (id SERIAL PRIMARY KEY, name TEXT NOT NULL, price NUMERIC NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name ListProducts\n-- @returns :many\nSELECT id, name, price FROM products";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_select_star_pii_fires() {
    // From: testing_data/lint/security/19_select_star_pii_fires.json
    // "SELECT * from a table with a password column should trigger SC-SEC07"
    let schema_sql =
        &["CREATE TABLE users (id SERIAL PRIMARY KEY, username TEXT NOT NULL, password TEXT NOT NULL, email TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetAllUsers\n-- @returns :many\nSELECT * FROM users";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for select_star_pii_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC07")),
        "expected violation SC-SEC07"
    );
}

#[test]
fn test_session_mutation_clean() {
    // From: testing_data/lint/security/22_session_mutation_clean.json
    // "SET search_path (not SET ROLE) should not trigger SC-SEC11"
    let schema_sql = &["CREATE TABLE orders (id SERIAL PRIMARY KEY, total NUMERIC NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name ListOrders\n-- @returns :many\nSELECT id, total FROM orders";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_session_mutation_fires() {
    // From: testing_data/lint/security/21_session_mutation_fires.json
    // "SET ROLE inside application SQL should trigger SC-SEC11"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name EscalateToAdmin\n-- @returns :exec\nSET ROLE admin";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for session_mutation_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC11")),
        "expected violation SC-SEC11"
    );
}

#[test]
fn test_superuser_role_clean() {
    // From: testing_data/lint/security/14_superuser_role_clean.json
    // "CREATE ROLE without SUPERUSER should not trigger SC-SEC04"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateReadonlyRole\n-- @returns :exec\nCREATE ROLE readonly NOSUPERUSER LOGIN";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_superuser_role_fires() {
    // From: testing_data/lint/security/13_superuser_role_fires.json
    // "CREATE ROLE with SUPERUSER should trigger SC-SEC04"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CreateSuperRole\n-- @returns :exec\nCREATE ROLE dba SUPERUSER";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for superuser_role_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC04")),
        "expected violation SC-SEC04"
    );
}

#[test]
fn test_unbounded_like_clean() {
    // From: testing_data/lint/security/10_unbounded_like_clean.json
    // "LIKE 'alice%' (anchored prefix) should not trigger SC-SEC09"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name SearchUsersPrefix\n-- @returns :many\nSELECT id FROM users WHERE name LIKE 'alice%';";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_unbounded_like_fires() {
    // From: testing_data/lint/security/09_unbounded_like_fires.json
    // "LIKE '%foo%' should trigger SC-SEC09"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name SearchUsersByName\n-- @returns :many\nSELECT id FROM users WHERE name LIKE '%alice%';";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for unbounded_like_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC09")),
        "expected violation SC-SEC09"
    );
}

#[test]
fn test_unsupported_reg_types_clean() {
    // From: testing_data/lint/security/62_unsupported_reg_types_clean.json
    // "Column declared as regclass (the exempt regtype) should not trigger SC-MIG19"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateMetaTable\n-- @returns :exec\nCREATE TABLE meta (id bigint PRIMARY KEY, rel regclass)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_unsupported_reg_types_fires() {
    // From: testing_data/lint/security/61_unsupported_reg_types_fires.json
    // "Column declared as regnamespace should trigger SC-MIG19"
    let schema_sql = &[];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CreateMetaTable\n-- @returns :exec\nCREATE TABLE meta (id bigint PRIMARY KEY, ns regnamespace)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for unsupported_reg_types_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-MIG19")),
        "expected violation SC-MIG19"
    );
}

#[test]
fn test_weak_hash_clean() {
    // From: testing_data/lint/security/18_weak_hash_clean.json
    // "md5() over a non-credential column should not trigger SC-SEC06"
    let schema_sql = &["CREATE TABLE documents (id SERIAL PRIMARY KEY, content TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name GetDocumentHash\n-- @returns :one\nSELECT md5(content) AS content_hash FROM documents WHERE id = $1";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_weak_hash_fires() {
    // From: testing_data/lint/security/17_weak_hash_fires.json
    // "md5() applied to a password column should trigger SC-SEC06"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, username TEXT NOT NULL, password TEXT NOT NULL);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql =
        "-- @name CheckUserPassword\n-- @returns :one\nSELECT id FROM users WHERE password_hash = md5(password)";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(!_violations.is_empty(), "expected lint violations for weak_hash_fires");
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-SEC06")),
        "expected violation SC-SEC06"
    );
}

#[test]
fn test_case_null_pattern_fires() {
    // From: testing_data/lint/style/05_case_null_pattern_fires.json
    // "CASE WHEN x IS NULL THEN y ELSE x END should trigger SC-T02 (use COALESCE)"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserStatus\n-- @returns :many\nSELECT id, CASE WHEN status IS NULL THEN 'unknown' ELSE status END AS display_status FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for case_null_pattern_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-T02")),
        "expected violation SC-T02"
    );
}

#[test]
fn test_coalesce_clean() {
    // From: testing_data/lint/style/06_coalesce_clean.json
    // "COALESCE usage should not trigger SC-T02"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserStatus\n-- @returns :many\nSELECT id, COALESCE(status, 'unknown') AS display_status FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_count_one_fires() {
    // From: testing_data/lint/style/03_count_one_fires.json
    // "COUNT(1) should trigger SC-T03 (prefer COUNT(*))"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CountUsers\n-- @returns :one\nSELECT COUNT(1) AS total FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(!_violations.is_empty(), "expected lint violations for count_one_fires");
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-T03")),
        "expected violation SC-T03"
    );
}

#[test]
fn test_count_star_clean() {
    // From: testing_data/lint/style/04_count_star_clean.json
    // "COUNT(*) should not trigger SC-T03"
    let schema_sql = &["CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);"];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name CountUsers\n-- @returns :one\nSELECT COUNT(*) AS total FROM users;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_explicit_join_clean() {
    // From: testing_data/lint/style/02_explicit_join_clean.json
    // "Explicit JOIN should not trigger SC-T01"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserOrders\n-- @returns :many\nSELECT users.id, orders.total FROM users JOIN orders ON users.id = orders.user_id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        _violations.is_empty(),
        "expected no lint violations but got {}",
        _violations.len()
    );
}

#[test]
fn test_implicit_join_fires() {
    // From: testing_data/lint/style/01_implicit_join_fires.json
    // "Implicit join using comma in FROM clause should trigger SC-T01"
    let schema_sql = &[
        "CREATE TABLE users (id SERIAL PRIMARY KEY, name TEXT NOT NULL, status TEXT);",
        "CREATE TABLE orders (id SERIAL PRIMARY KEY, user_id INT NOT NULL, total INT NOT NULL);",
    ];

    let catalog = scythe_core::catalog::Catalog::from_ddl(schema_sql).unwrap();
    let registry = scythe_lint::default_registry();
    let engine = scythe_lint::LintEngine::new(registry);
    let mut _violations: Vec<(scythe_lint::Violation, scythe_lint::Severity)> = Vec::new();

    _violations.extend(engine.check_catalog(&catalog));

    let query_sql = "-- @name GetUserOrders\n-- @returns :many\nSELECT users.id, orders.total FROM users, orders WHERE users.id = orders.user_id;";
    let query = scythe_core::parser::parse_query(query_sql).expect("fixture SQL must parse");
    let analyzed = scythe_core::analyzer::analyze(&catalog, &query).expect("fixture SQL must analyze");
    let ctx = scythe_lint::LintContext {
        sql: &query.sql,
        stmt: &query.stmt,
        analyzed: &analyzed,
        catalog: &catalog,
        annotations: &query.annotations,
        dialect: scythe_core::dialect::SqlDialect::PostgreSQL,
    };
    _violations.extend(engine.check_query(&ctx));
    assert!(
        !_violations.is_empty(),
        "expected lint violations for implicit_join_fires"
    );
    assert!(
        _violations.iter().any(|v| v.0.rule_id.contains("SC-T01")),
        "expected violation SC-T01"
    );
}