[aersam]

Summary

Moves OneSales' fetch_all into pgdevkit.db (0.13.0).

• fetch_all(query, params=None, *, model=None, row_mapper=None, con=None, pool=None, cancel=None)
• con= is borrowed: never committed, closed or returned to a pool. Without it a connection comes from pool= or the pool registered via set_default_pool() (single-database apps; pass pool= for several).
• model= (Pydantic) overload, row_mapper= overload, default list[dict]. t-string queries get params-less overloads (they carry their own values).
• query is typed LiteralString | sqlglot Expression | psycopg.sql Composable | t-string. sqlglot is imported lazily.
• cancel: asyncio.Event aborts the running query server-side (cancel_safe() -> QueryCanceled). Cancelling the awaiting task also cancels it server-side (CancelledError propagates), drained uninterruptibly so no orphaned task/query; if the cancel request itself fails the connection is closed.
• Skill + README updated; psycopg>=3.3 (t-strings).

Notes for reviewers

• A sqlglot expression is only as safe as the strings it was built from (its builders parse plain strings as SQL). _render rejects exp.Command and malformed placeholder names; the docs say to pass user values as exp.Placeholder + params. A bdt lint rule for non-literal args to sqlglot builders is a follow-up (the current lint trusts sqlglot-derived text).
• cancel= aborts whatever statement runs on the connection, so don't use it on a con shared by concurrent tasks (documented).
• bdt lint coverage for fetch_all/fetch_one/fetch_scalar is in feat(lint): apply SQL rules to pgdevkit fetch_all/fetch_one/fetch_scalar devtools#79.
• Live tests are requires_podman; I also ran them against a local Postgres (14 passed, stable over repeated runs).
• OneSales migration follows once this is released.