feat(stdlib): Sqlite.affine codegen foundation — db-theory #1a (6 externs wired Deno-ESM end-to-end)

[hyperpolymath]

Summary

First step of the db-theory programme. SQLite's surface looked partial in the roadmap but was actually vapourware: 6 externs declared in stdlib/Sqlite.affine, zero codegen / zero adapter / zero tests / zero consumers. This PR lands the foundation so the extension PR (#1b — prepared statements, schema introspection, bulk I/O) has a real pathway.

Changes

• lib/codegen_deno.ml deno_builtins — 6 new entries lowering each extern to its __as_db* JS helper.
• lib/codegen_deno.ml prelude — // ---- Sqlite ---- block with 6 const __as_db* helpers delegating to globalThis.__as_sqlite. Same shape as Motion / Pixi / PixiSound (only Tier-2 binding without it). Inline comment gives the Deno (jsr:@db/sqlite) and Node (better-sqlite3) adapter recipes.
• tests/codegen-deno/sqlite_smoke.{affine,harness.mjs} — 3 smoke functions exercising full lifecycle, WHERE id = ? param-bound projection, and ordered multi-row retrieval. Harness installs an in-memory SQL mock (CREATE / INSERT / SELECT / WHERE / ORDER BY / COUNT(*) subset) explicitly marked as smoke-only.

Verification

• dune build bin/main.exe: clean
• dune runtest: 357 / 357 green
• tools/run_codegen_deno_tests.sh: all 31 harnesses pass (was 30)

Next (db-theory #1b — separate PR)

• Stmt opaque type + db_prepare / db_bind_* / db_step / db_column_* / db_finalize
• db_schema_tables() + db_schema_columns(table) introspection
• db_import_csv / db_export_csv bulk I/O
• Typed DbError + Result<T, DbError> returns

Test plan

• dune build clean
• dune runtest 357 / 357 green (codegen ⊆ stdlib consistency picks up the 6 new builtins)
• tools/run_codegen_deno_tests.sh 31 / 31 harnesses pass
• sqlite_smoke mock validates all three smoke functions

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 89 issues detected

Severity	Count
🔴 Critical	2
🟠 High	16
🟡 Medium	71

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence