[Lojhan]

Summary

Imported SQL files currently sit outside query manifests and their verification, plan and migration-compatibility reports, and their factories only accept positional placeholders appearing once in order. Include literal SQL imports/re-exports from the configured TypeScript graph in those workflows and compile them through the same analysis used by runtime factories. Missing sources and stale manifests fail explicitly; artifacts retain original source locations without persisting SQL text or values.

Add named parameter objects across PostgreSQL, MySQL and SQLite and repeated/reordered numbered bindings. Factories bind repeated values independently, reject mixed styles, gaps and incompatible repeated contracts, and retain grammar-owned quoting, comment, SQL-mode and PostgreSQL array-slice behavior.

Add Brand, brandValue and withSchemaBrands for explicit scalar column/domain identities. Brands survive snapshot serialization, schema hashing, projections and column-context parameters; wire conversion and native verification continue to use the underlying scalar. External input must be validated before an application establishes a brand. Include a Changeset and public API contracts.

Document the complete SQL-file and identity workflow, including manifest, live-verification, plan and migration evidence. Add SQL parameter bindings and Branded application IDs playground lessons for PostgreSQL, MySQL and SQLite. The browser shares the compiler’s SQL-file binding analyzer and reads brand configuration as literal data without executing it. Keep stable SQL-file build integrations in the main integration navigation.

Verification

• pnpm verify passed: quality/catalog checks, typechecking, package/example/contract tests, coverage thresholds, production build, documentation build and performance budgets.
• pnpm test:pack passed with isolated packed-consumer installation.
• New tests cover all three grammars through manifests, verification candidates, plan capture and schema compatibility; stale/missing SQL sources; native TypeScript rejection of mismatched/unbranded IDs; original diagnostics and UTF-16 source spans; and generated-factory execution against native SQLite with an introspected branded v2 snapshot.
• All ten playground contract test files passed, including named/repeated/reordered bindings, branded rows and adapter results, rejected mismatched IDs, and configuration that never executes code. Both new lessons were checked in Chrome with clean diagnostics and the expected inferred types.
• Native TypeScript watch integration passed outside the sandbox, which is required for its file watchers. Node.js 24.10.0 was used locally.
• Real PostgreSQL/MySQL container E2E checks were not run: the existing Podman VM fails to start (vfkit exited unexpectedly with exit code 1). Native SQLite and the PostgreSQL/MySQL package suites passed. No real-server verification is claimed for the local run.

Release impact

• Changeset included
• Existing positional SQL factories retain their call convention. SQL assets can additionally use named objects and repeated/reordered numbered placeholders; unused numeric gaps remain diagnostics.
• Brand configuration uses exact snapshot identities and supports precise string, number and bigint scalars. It does not add database constraints, change the scalar wire format or implicitly brand foreign keys.

Correctness

• Unsupported SQL still fails safely as a diagnostic or Query<unknown>
• No driver dependency was added to core/compiler/grammar packages

Separate expansion requests are tracked in #253 (SQL Server), #254 (DuckDB), and #255 (SQLite Wasm adapter). These issues remain open and are not implemented by this PR.