~[
  Open a SQLite database file (":memory:" for transient) — mints the conn token.
  The | db branch's token is what every other verb's conn field takes;
  close-db discharges it.
]pub tor open { path: string }
| db *Connection<opened!>
| err { code: i32, msg: string }

~[
  Close the connection and discharge its token for good.
  Afterwards the token names nothing — passing it to another verb is refused.
]pub tor close { conn: *Connection<!opened> }

~pub tor open.pooled { path: string }
| db *Connection<opened!>
| err { code: i32, msg: string }

~pub tor close.pooled { conn: *Connection<!opened> }

~[
  Run rowless SQL — CREATE, INSERT, UPDATE, DELETE, DDL.
  Borrows conn rather than spending it: the token stays live across the
  call. For SELECT use rows, not exec.
]pub tor exec {
    conn: *Connection<opened>,
    sql: string
}
| ok
| err { code: i32, msg: string }

// Literal SQL query - takes a runtime SQL string
// For compile-time parameterized queries, use ~query { ... } with Source block
~pub tor query.literal { conn: *Connection<!opened>, sql: string }
! row *Statement<row!>
| done *Connection<opened!>
| err { conn: *Connection<opened!>, code: i32, msg: string }

// No-op consumer of the per-row borrow. The compiler auto-inserts this to
// release `<row!>` at each row-body boundary; the user never calls it. Its
// existence is what lets the phantom checker prove the row borrow is scoped —
// escape it (capture past the row body) and the build fails with KORU030.
// Pure Koru impl: consume the `<row!>` obligation, hand back the dead `<row>`
// borrow (carries no obligation — a bare borrow is a free alias).
~pub tor release.row { row: *Statement<!row> } -> *Statement<row>

~[comptime|transform] pub tor default {
    source: Source,
    invocation: *const Invocation,
    item: *const Item,
    program: *const Program,
    allocator: std.mem.Allocator
} -> SiteResult

// Runtime impl event for shape-checking (never actually runs - inline code
// does). The proc body is unreachable by construction but must exist: an
// event without a proc emits no handler, and its decl is dropped from the
// emitted program — the emitter's effect-branch lookup then misses `! row`.
~pub tor default.impl { conn: *Connection<!opened> }
! ?row *Statement<row!>
| done *Connection<opened!>
| err { conn: *Connection<opened!>, code: i32, msg: string }

~[comptime|transform] pub tor query {
    source: Source,
    invocation: *const Invocation,
    item: *const Item,
    program: *const Program,
    allocator: std.mem.Allocator
} -> SiteResult

// Runtime impl event for shape-checking (never actually runs - inline code does)
// conn comes from invocation args, captured in generated code
~[norun] pub tor query.impl { conn: *Connection<!opened> }
| row *Statement<stream!>
| empty *Connection<opened!>
| err { conn: *Connection<opened!>, code: i32, msg: string }

~[
  Open a row stream over a SELECT — prepares and steps to the first row.
  | row hands back a stream token that owns the connection inside it:
  read columns by the stream token, step on by handing it to next.
]pub tor rows {
    conn: *Connection<!opened>,
    sql: string
}
| row *Statement<stream!>
| empty *Connection<opened!>
| err { conn: *Connection<opened!>, code: i32, msg: string }

~[
  Step the stream past the live row — spends the stream token.
  | row re-issues it fresh for the next row; | done ends the stream,
  frees the statement, and hands the connection back.
]pub tor next { stmt: *Statement<!stream> }
| row *Statement<stream!>
| done *Connection<opened!>
| err { conn: *Connection<opened!>, code: i32, msg: string }

// Finalize text - acknowledges we're done with borrowed text pointer
// Must be called BEFORE finalize.stmt (text becomes invalid after stmt finalize)
~pub tor finalize.text { text: string<!text> }

~[
  Finalize a stream — abandons it without stepping to done.
  Spends the stream token, frees the statement, and hands the owned
  connection back so close-db can still run.
]pub tor finalize.stmt { stmt: *Statement<!stream> } -> *Connection<opened!>

~[
  Read the live row's column 'index' (0-based) as an integer.
  Borrows the row token — the row stays live for more reads or next.
]pub tor col.int {
    stmt: *Statement<row>,
    index: i32
} -> i64

~[
  Read the live row's column 'index' (0-based) as text.
  Borrows the row token — the row stays live for more reads or next.
]pub tor col.text {
    stmt: *Statement<row>,
    index: i32
} -> string

~[
  Read the live row's column 'index' (0-based) as a float.
  Borrows the row token — the row stays live for more reads or next.
]pub tor col.real {
    stmt: *Statement<row>,
    index: i32
} -> f64

~[
  Read a stream's live-row column 'index' (0-based) as an integer.
  Borrows the stream token — the row stays live for more reads or next.
]pub tor scol.int {
    stmt: *Statement<stream>,
    index: i32
} -> i64

~[
  Read a stream's live-row column 'index' (0-based) as text.
  Borrows the stream token — the row stays live for more reads or next.
]pub tor scol.text {
    stmt: *Statement<stream>,
    index: i32
} -> string

~[
  Read a stream's live-row column 'index' (0-based) as a float.
  Borrows the stream token — the row stays live for more reads or next.
]pub tor scol.real {
    stmt: *Statement<stream>,
    index: i32
} -> f64