[bedtime-architecture] Deepen SQL parameter binding

[mmkal]

Summary

Deepens runtime parameter binding into a driver-neutral Module behind the Adapter seam.

• Adds packages/sqlfu/src/sql-params.ts for named SQL parameter scanning and driver bind-shape projection.
• Moves D1, Durable Objects, Expo SQLite, Turso serverless, sqlite-wasm, and Postgres onto that Module.
• Deletes the old sqlite-text named-param helper and the Postgres private ? to $N scanner, so Postgres named params now bind directly to $1, $2, etc. while preserving dollar-quoted SQL bodies.
• Removes the old root export for rewriteNamedParamsToPositional; this was adapter plumbing, not product surface.

Design Choice

The grill-you pass challenged whether Postgres should keep its private scanner. The decision was to use one extended scanner for binding, including Postgres dollar-quoted strings, because two scanners over the same authored SQL were the source of the architectural wart.

Checks

Passed:

• pnpm --filter sqlfu exec vitest run test/sql-params.test.ts test/adapters/pg.test.ts test/sqlite-text.test.ts
• pnpm --filter sqlfu exec vitest run test/adapters/d1.test.ts test/adapters/durable-object.test.ts test/adapters/expo-sqlite.test.ts test/adapters/sqlite-wasm.test.ts
• pnpm --filter sqlfu exec vitest run test/adapters/turso-remote.test.ts test/adapters/turso-database.test.ts
• pnpm --filter sqlfu typecheck
• pnpm --filter @sqlfu/ui build
• pnpm --filter sqlfu exec vitest run test/resolve-sqlfu-ui.test.ts
• git diff --check

Full pnpm --filter sqlfu test still fails test/import-surface.test.ts because the existing vendored TypeSQL bundle for sqlfu/analyze imports node:sqlite. That is outside this PR; the initial full run also needed @sqlfu/ui built before resolve-sqlfu-ui passed.

Replacement Compare Branches

Existing PR	Replacement compare	Strategy
#124 bedtime/2026-05-15-default-db-gitignore	comparison	clean merge
#123 bedtime/2026-05-15-pg-docs-followup	comparison	clean merge
#122 bedtime/2026-05-15-db-base-directory	comparison	clean merge
#121 bedtime/2026-05-15-improve-docs	comparison	clean merge
#120 bedtime/2026-05-15-landing-trace	comparison	clean merge
#119 bedtime/2026-05-15-cleanup-tasks	comparison	clean merge
#117 bedtime/2026-05-14-query-identity-manifest	comparison	clean merge
#114 bedtime/2026-05-14-generate-preflight	comparison	clean merge
#111 issue-110-sqlite3-parser-schemadiff	comparison	clean merge

Replacement checks: all replacement branches passed git diff --check; targeted tests/builds are recorded in tasks/architecture-2026-05-15.md.

Package size — packed 236.8 kB (+259 B, +0.1%)

Package size

	main	this PR	Δ
packed	236.5 kB	236.8 kB	+0.1%
unpacked	971.5 kB	974.5 kB	+0.3%
files	181	183	+2

dist/vendor/*.js bundles

	main	this PR	Δ
vendor/sha256.js	4.3 kB	4.3 kB	0
vendor/sql-formatter/*.js	58.3 kB	58.3 kB	0
vendor/sqlfu-sqlite-parser/*.js	17.2 kB	17.2 kB	0
vendor/standard-schema/*.js	2.8 kB	2.8 kB	0
vendor/typesql/*.js	134.6 kB	134.6 kB	0

Measured with npm pack --dry-run --json on sqlfu (0.0.3-7 on main vs 0.0.3-7 on this PR).

---

Note

Medium Risk
Touches SQL parameter rewriting/binding used by multiple runtime adapters (including Postgres), so subtle placeholder-scanning edge cases could change query behavior. Added targeted unit tests for Postgres and the new binder to reduce regression risk.

Overview
Moves SQL placeholder scanning and parameter binding into a new driver-neutral sql-params.ts, supporting ?-style positional, Postgres $N placeholders, and sqlite-wasm’s prefixed named binds.

Updates D1, Durable Objects, Expo SQLite, Turso serverless, sqlite-wasm, and the Postgres adapter to use the shared binder; Postgres drops its custom ?→$N conversion and now binds named params directly while preserving dollar-quoted strings, casts, and JSON ? operators.

Removes the adapter-plumbing export rewriteNamedParamsToPositional (and its tests) from sqlite-text.ts/root index.ts, and adds new unit tests covering the shared binder plus Postgres binding behavior.

^{Reviewed by Cursor Bugbot for commit 8780812. Bugbot is set up for automated code reviews on this repo. Configure here.}

Review Follow-up

Independent review found two Postgres scanner gaps after the first push: :param::type casts and JSONB ? / ?| / ?& operators. Both are fixed in 8780812 with regression tests in test/sql-params.test.ts and test/adapters/pg.test.ts. Replacement compare branches were refreshed by merging the updated architecture head and all replacement branches still pass git diff --check.

[pkg-pr-new]

Open in StackBlitz

npm i https://pkg.pr.new/sqlfu@125

commit: 8780812