feat(stdlib): Sqlite prepared statements — db-theory #1b (Stmt + 10 typed externs)

[hyperpolymath]

Summary

Layers the prepared-statement surface on top of the #522 convenience surface. Use this for anything carrying user input, anything iterating over more than a handful of rows, and anything where typed value marshalling matters (Int / Text / NULL).

New stdlib surface (stdlib/Sqlite.affine)

extern	purpose
extern type Stmt	opaque statement handle
db_prepare(d, sql) -> Stmt	compile SQL with ? placeholders
db_bind_int(s, idx, v) -> Int	bind 1-indexed param (sqlite3 convention)
db_bind_text(s, idx, v) -> Int	bind text
db_bind_null(s, idx) -> Int	bind NULL
db_step(s) -> Int	1 = SQLITE_ROW, 0 = SQLITE_DONE
db_column_count(s) -> Int	current-row width
db_column_int(s, idx) -> Int	0-indexed read; NULL → 0
db_column_text(s, idx) -> String	0-indexed read; NULL → ""
db_reset(s) -> Int	re-step from row 0 without recompiling
db_finalize(s) -> Int	release

Bind-index is 1-based, column-index is 0-based — matches both jsr:@db/sqlite and better-sqlite3 (the two reference __as_sqlite adapters). NULL coercion happens at the JS-helper layer; callers needing NULL/value-zero discrimination use the convenience db_query_one path.

Smoke harness (tests/codegen-deno/sqlite_prepared.{affine,harness.mjs})

smoke fn	exercises
smoke_prepare_bind_int_step_finalize	INSERT(?, ?) with two int binds + finalize + query-back
smoke_step_iteration	SELECT N rows, loop db_step until 0, accumulate via db_column_int
smoke_text_bind_and_column	bind_text → step → column_text round-trip
smoke_null_bind	bind_null → column_int coerces to 0
smoke_reset_and_reuse	prepare once + bind/step + reset + re-bind/step → 2 rows
smoke_column_count_basic	SELECT a, b, c FROM t → column_count = 3

Mock extends #522's in-memory adapter with 10 statement-side methods; production adapters (jsr:@db/sqlite / better-sqlite3) provide near-1:1 wrappers.

Verification

• dune build bin/main.exe: clean
• dune runtest: 363 / 363 green (codegen ⊆ stdlib consistency picks up the 10 new builtins; all match stdlib/Sqlite.affine)
• tools/run_codegen_deno_tests.sh: 32 / 32 harnesses pass (was 31)

Stacked on #522

#522 merged 12:43Z; this branch forks from the resulting main HEAD. Clean diff.

db-theory #1c (next PR, separate)

• Schema introspection (db_schema_tables, db_schema_columns)
• Bulk I/O (db_import_csv, db_export_csv)
• Typed DbError + Result<T, DbError> variants

Test plan

• dune build clean
• dune runtest 363/363 green
• tools/run_codegen_deno_tests.sh 32/32 pass
• 6 prepared-statement smoke assertions pass

🤖 Generated with Claude Code

[github-actions]

🔍 Hypatia Security Scan

Findings: 88 issues detected

Severity	Count
🔴 Critical	2
🟠 High	16
🟡 Medium	70

⚠️ Action Required: Critical security issues found!

View findings

[
  {
    "reason": "Action perpolymath/standards/.github/workflows/governance-reusable.yml@main\n needs attention",
    "type": "unpinned_action",
    "file": "governance.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action ons/checkout@v6\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Action land/setup-deno@v2\n    needs attention",
    "type": "unpinned_action",
    "file": "publish-jsr.yml",
    "action": "pin_sha",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in affine-vscode-publish.yml",
    "type": "missing_timeout_minutes",
    "file": "affine-vscode-publish.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in casket-pages.yml",
    "type": "missing_timeout_minutes",
    "file": "casket-pages.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  },
  {
    "reason": "Issue in ci.yml",
    "type": "missing_timeout_minutes",
    "file": "ci.yml",
    "action": "flag",
    "rule_module": "workflow_audit",
    "severity": "medium"
  }
]

Powered by Hypatia Neurosymbolic CI/CD Intelligence