@blamejs/core 0.14.27 → 0.15.0

package/lib/safe-sql.js

@@ -175,7 +175,7 @@ function validateIdentifier(name, opts) {
 
 /**
  * @primitive b.safeSql.quoteIdentifier
- * @signature b.safeSql.quoteIdentifier(name, dialect?)
+ * @signature b.safeSql.quoteIdentifier(name, dialect?, opts?)
  * @since     0.1.0
  * @status    stable
  * @related   b.safeSql.validateIdentifier, b.safeSql.quoteQualified
@@ -185,6 +185,17 @@ function validateIdentifier(name, opts) {
  * MySQL. Default dialect is `"sqlite"`. Throws `SafeSqlError` if the
  * identifier fails `validateIdentifier`.
  *
+ * `opts` is forwarded to `validateIdentifier` — pass
+ * `{ allowReserved: true }` to quote a name that collides with a SQL
+ * keyword (a column literally named `from` / `select`). Quoting is
+ * exactly what makes a reserved word safe in identifier position, so the
+ * query builder (`b.sql`) routes every identifier through here with
+ * `allowReserved` on; the default still rejects reserved words so a bare
+ * caller catches the likely typo.
+ *
+ * @opts
+ *   allowReserved:  boolean,   // default: false — permit SQL-keyword names (safe once quoted)
+ *
  * @example
  *   var b = require("blamejs");
  *   b.safeSql.quoteIdentifier("users");
@@ -193,11 +204,14 @@ function validateIdentifier(name, opts) {
  *   b.safeSql.quoteIdentifier("Order", "postgres");
  *   // → '"Order"'
  *
+ *   b.safeSql.quoteIdentifier("from", "postgres", { allowReserved: true });
+ *   // → '"from"'
+ *
  *   b.safeSql.quoteIdentifier("users", "mysql");
  *   // → "`users`"
  */
-function quoteIdentifier(name, dialect) {
-  validateIdentifier(name);
+function quoteIdentifier(name, dialect, opts) {
+  validateIdentifier(name, opts);
   dialect = (dialect || "sqlite").toLowerCase();
   if (dialect === "mysql") return "`" + name + "`";
   // sqlite + postgres both use double-quote per SQL standard
@@ -258,6 +272,53 @@ function quoteQualified(parts, dialect) {
   return quoted.join(".");
 }
 
+/**
+ * @primitive b.safeSql.quoteList
+ * @signature b.safeSql.quoteList(names, dialect?, opts?)
+ * @since     0.15.0
+ * @status    stable
+ * @related   b.safeSql.quoteIdentifier, b.safeSql.quoteQualified, b.sql
+ *
+ * Quote a list of identifiers into a comma-joined fragment — each name
+ * validated + quoted via `quoteIdentifier`. The "many" companion to
+ * `quoteIdentifier` (one) and `quoteQualified` (a dotted name): use it for
+ * SELECT projections and INSERT column lists so the recurring
+ * `cols.map(quoteIdentifier).join(", ")` shape is composed, not hand-rolled.
+ *
+ * There is deliberately NO value/string-literal quoter in this module:
+ * values flow as bound placeholders (`?` / `$N`), never interpolated, which
+ * is what makes the injection class structurally impossible. Quoting a
+ * literal would reopen it — use the query builder's parameter binding.
+ *
+ * `opts` is forwarded to each `quoteIdentifier` (e.g.
+ * `{ allowReserved: true }` for column lists that may contain SQL-keyword
+ * names, as `b.sql` does).
+ *
+ * Throws `SafeSqlError` (`sql/empty`) on an empty array and (per
+ * `quoteIdentifier`) on any invalid identifier.
+ *
+ * @opts
+ *   allowReserved:  boolean,   // default: false — forwarded to quoteIdentifier
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeSql.quoteList(["id", "createdAt"], "postgres");
+ *   // → '"id", "createdAt"'
+ *
+ *   b.safeSql.quoteList(["queueName", "status"], "mysql");
+ *   // → "`queueName`, `status`"
+ */
+function quoteList(names, dialect, opts) {
+  if (!Array.isArray(names) || names.length === 0) {
+    throw new SafeSqlError("quoteList requires a non-empty array of identifiers", "sql/empty");
+  }
+  var out = [];
+  for (var i = 0; i < names.length; i++) {
+    out.push(quoteIdentifier(names[i], dialect, opts));
+  }
+  return out.join(", ");
+}
+
 /**
  * @primitive b.safeSql.assertOneOf
  * @signature b.safeSql.assertOneOf(name, allowlist)
@@ -310,6 +371,64 @@ function assertOneOf(name, allowlist) {
   return name;
 }
 
+/**
+ * @primitive b.safeSql.countPlaceholders
+ * @signature b.safeSql.countPlaceholders(sql)
+ * @since     0.14.29
+ * @status    stable
+ * @related   b.safeSql.quoteIdentifier, b.safeSql.validateIdentifier
+ *
+ * Count the bound `?` placeholders in a SQL string, skipping any `?`
+ * that appears inside a string literal (`'...'` / `"..."`, doubled-quote
+ * escape aware) or inside a line or block comment. The canonical quote-
+ * and comment-aware scanner the query builder uses to check placeholder /
+ * param parity and the residency write-gate uses to align bound values;
+ * both compose this so the skip rules live in one place.
+ *
+ * @example
+ *   var b = require("blamejs");
+ *   b.safeSql.countPlaceholders("a = ? AND b = ?");
+ *   // → 2
+ *
+ *   b.safeSql.countPlaceholders("note = 'is ? literal' AND id = ?");
+ *   // → 1
+ */
+function countPlaceholders(sql) {
+  var count = 0;
+  var i = 0;
+  var len = sql.length;
+  while (i < len) {
+    var ch = sql.charAt(i);
+    var next = i + 1 < len ? sql.charAt(i + 1) : "";
+    if (ch === "'" || ch === '"') {
+      var quote = ch;
+      i += 1;
+      while (i < len) {
+        if (sql.charAt(i) === quote) {
+          // SQL doubles the quote char to escape it within a literal.
+          if (sql.charAt(i + 1) === quote) { i += 2; continue; }
+          i += 1; break;
+        }
+        i += 1;
+      }
+      continue;
+    }
+    if (ch === "-" && next === "-") {
+      while (i < len && sql.charAt(i) !== "\n") i += 1;
+      continue;
+    }
+    if (ch === "/" && next === "*") {
+      i += 2;
+      while (i < len && !(sql.charAt(i) === "*" && sql.charAt(i + 1) === "/")) i += 1;
+      i += 2;
+      continue;
+    }
+    if (ch === "?") count += 1;
+    i += 1;
+  }
+  return count;
+}
+
 /**
  * @primitive b.safeSql.DEFAULT_IDENTIFIER_RE
  * @signature b.safeSql.DEFAULT_IDENTIFIER_RE
@@ -355,7 +474,9 @@ module.exports = {
   validateIdentifier:  validateIdentifier,
   quoteIdentifier:     quoteIdentifier,
   quoteQualified:      quoteQualified,
+  quoteList:           quoteList,
   assertOneOf:         assertOneOf,
+  countPlaceholders:   countPlaceholders,
   SafeSqlError:        SafeSqlError,
   // Exposed so consumers can compose their own validators
   DEFAULT_IDENTIFIER_RE: DEFAULT_IDENTIFIER_RE,

package/lib/safe-vcard.js

@@ -63,6 +63,7 @@
 
 var C = require("./constants");
 var { defineClass } = require("./framework-error");
+var gateContract = require("./gate-contract");
 
 var SafeVcardError = defineClass("SafeVcardError", { alwaysPermanent: true });
 
@@ -90,12 +91,7 @@ var PROFILES = Object.freeze({
   }),
 });
 
-var COMPLIANCE_POSTURES = Object.freeze({
-  hipaa:     "strict",
-  "pci-dss": "strict",
-  gdpr:      "strict",
-  soc2:      "strict",
-});
+var COMPLIANCE_POSTURES = gateContract.ALL_STRICT_POSTURES;
 
 // Property-name allowlist per RFC 6350 §6 (vCard 4.0 property
 // registry) + RFC 2426 §3 (legacy 3.0 properties retained for
@@ -217,24 +213,6 @@ function parse(text, opts) {
   return { vcards: vcards };
 }
 
-/**
- * @primitive b.safeVcard.compliancePosture
- * @signature b.safeVcard.compliancePosture(name)
- * @since     0.9.81
- * @status    stable
- * @related   b.safeVcard.parse
- *
- * Map a compliance-posture name to its profile. Returns the profile
- * string for a known posture, `null` for unknown names.
- *
- * @example
- *   b.safeVcard.compliancePosture("hipaa");   // -> "strict"
- *   b.safeVcard.compliancePosture("loose");   // -> null
- */
-function compliancePosture(name) {
-  return COMPLIANCE_POSTURES[name] || null;
-}
-
 // ---- Internal ----
 
 function _resolveCaps(opts) {
@@ -462,12 +440,19 @@ function _preview(s) {
   return s.length > 64 ? s.slice(0, 64) + "..." : s;                                                       // log-preview length cap
 }
 
-module.exports = {
-  parse:               parse,
-  compliancePosture:   compliancePosture,
-  PROFILES:            PROFILES,
-  COMPLIANCE_POSTURES: COMPLIANCE_POSTURES,
-  KNOWN_PROPERTIES:    KNOWN_PROPERTIES,
-  EMBED_PROPERTIES:    EMBED_PROPERTIES,
-  SafeVcardError:      SafeVcardError,
-};
+// compliancePosture is assembled by gateContract.defineParser below; its
+// wiki section renders from the single-sourced @abiTemplate (defineParser)
+// block in gate-contract.js, instantiated for this guard by the page
+// generator.
+module.exports = gateContract.defineParser({
+  name:       "vcard",
+  entry:      parse,
+  entryName:  "parse",
+  errorClass: SafeVcardError,
+  profiles:   PROFILES,
+  postures:   COMPLIANCE_POSTURES,
+  extra: {
+    KNOWN_PROPERTIES: KNOWN_PROPERTIES,
+    EMBED_PROPERTIES: EMBED_PROPERTIES,
+  },
+});

package/lib/scheduler.js

@@ -43,6 +43,7 @@ var lazyRequire = require("./lazy-require");
 var audit  = lazyRequire(function () { return require("./audit"); });
 var log    = lazyRequire(function () { return require("./log").boot("scheduler"); });
 var clusterStorage = require("./cluster-storage");
+var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var C = require("./constants");
 var { SchedulerError } = require("./framework-error");
@@ -51,6 +52,18 @@ var DEFAULT_MAX_JOB_MS             = C.TIME.minutes(10);
 var DEFAULT_TICK_RETENTION_MS      = C.TIME.days(7);
 var DEFAULT_TICK_PRUNE_INTERVAL_MS = C.TIME.minutes(1);
 
+// b.sql opts for every _blamejs_scheduler_ticks statement: thread the ACTIVE
+// backend dialect (clusterStorage.dialect() — "sqlite" single-node,
+// "postgres" | "mysql" in cluster mode) so the emitted identifier quoting +
+// dialect idioms (ON CONFLICT DO NOTHING vs the MySQL no-op fold) match the
+// backend the SQL dispatches to. Defaulting to "sqlite" works on Postgres
+// only by accident (both double-quote identifiers) and emits the wrong
+// quoting on MySQL. clusterStorage.execute still rewrites the bare table name
+// + translates `?` placeholders at dispatch; this controls only the builder-
+// side quoting + idiom selection. The table name stays BARE (no quoteName)
+// so clusterStorage's prefix rewrite still fires.
+function _ticksSqlOpts() { return { dialect: clusterStorage.dialect() }; }
+
 // ---- Cron parsing ----
 
 var CRON_SHORTHANDS = {
@@ -497,7 +510,7 @@ function create(opts) {
         task.nextRun = Date.now() + spec.every;
       }
       task.exprDesc = "every " + spec.every + "ms" +
-                      (spec.baseline ? " from " + spec.baseline : "") +
+                      (spec.baseline ? " anchored " + spec.baseline : "") +
                       (tz ? " " + tz : "");
     }
 
@@ -562,13 +575,23 @@ function create(opts) {
       var tickKey = task.name + ":" + nominalRun;
       var claimedBy = (typeof clusterInstance.currentNodeId === "function")
         ? clusterInstance.currentNodeId() : "unknown";
-      clusterStorage.execute(
-        "INSERT INTO _blamejs_scheduler_ticks " +
-        "(tickKey, name, scheduledAtUnix, claimedAtUnix, claimedBy) " +
-        "VALUES (?, ?, ?, ?, ?) " +
-        "ON CONFLICT (tickKey) DO NOTHING",
-        [tickKey, task.name, nominalRun, Date.now(), claimedBy]
-      ).then(function (result) {
+      // BARE logical table name — clusterStorage rewrites _blamejs_scheduler_ticks
+      // to the configured prefix and placeholderizes the ? markers. The
+      // PRIMARY KEY race on tickKey deduplicates the split-brain window; the
+      // loser's ON CONFLICT DO NOTHING reports zero rowCount and skips.
+      var claimBuilt = sql.upsert("_blamejs_scheduler_ticks", _ticksSqlOpts())   // allow:hand-rolled-sql — bare logical name for clusterStorage rewrite
+        .columns(["tickKey", "name", "scheduledAtUnix", "claimedAtUnix", "claimedBy"])
+        .values({
+          tickKey:         tickKey,
+          name:            task.name,
+          scheduledAtUnix: nominalRun,
+          claimedAtUnix:   Date.now(),
+          claimedBy:       claimedBy,
+        })
+        .onConflict(["tickKey"])
+        .doNothing()
+        .toSql();
+      clusterStorage.execute(claimBuilt.sql, claimBuilt.params).then(function (result) {
         var won = (result && result.rowCount > 0);
         if (won) {
           _runFire(task);
@@ -604,10 +627,10 @@ function create(opts) {
     var threshold = Date.now() - (
       typeof olderThanMs === "number" ? olderThanMs : tickRetentionMs
     );
-    var result = await clusterStorage.execute(
-      "DELETE FROM _blamejs_scheduler_ticks WHERE scheduledAtUnix < ?",
-      [threshold]
-    );
+    var pruneBuilt = sql.delete("_blamejs_scheduler_ticks", _ticksSqlOpts())   // allow:hand-rolled-sql — bare logical name for clusterStorage rewrite
+      .where("scheduledAtUnix", "<", threshold)
+      .toSql();
+    var result = await clusterStorage.execute(pruneBuilt.sql, pruneBuilt.params);
     var removed = (result && result.rowCount) || 0;
     if (removed > 0) {
       _emit("system.scheduler.tick.pruned", {

package/lib/seeders.js

@@ -58,10 +58,13 @@ var nodePath = require("node:path");
 var atomicFile = require("./atomic-file");
 var C = require("./constants");
 var dbSchema = require("./db-schema");
+var frameworkSchema = require("./framework-schema");
 var lazyRequire = require("./lazy-require");
 var { boot } = require("./log");
 var migrationFiles = require("./migration-files");
 var requestHelpers = require("./request-helpers");
+var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var validateOpts = require("./validate-opts");
 var { SeederError } = require("./framework-error");
 
@@ -72,13 +75,29 @@ var observability = lazyRequire(function () { return require("./observability");
 
 var _err = SeederError.factory;
 
-var SEEDERS_TABLE = "_blamejs_seeders";
-var LOCK_TABLE    = "_blamejs_seeders_lock";
-// Pre-quoted forms used at every SQL interpolation site — defense in
-// depth so a future rename to a reserved-word or whitespace-bearing
-// table name doesn't silently break the query.
-var Q_SEEDERS_TABLE = '"' + SEEDERS_TABLE + '"';
-var Q_LOCK_TABLE    = '"' + LOCK_TABLE    + '"';
+// Logical framework-table names, resolved to the configured prefix via
+// frameworkSchema.tableName at every call site. These run against the
+// local node:sqlite handle directly (no clusterStorage rewrite in the
+// path), so b.sql is built with quoteName: true on the resolved name —
+// the `"name"` identifier form the single-node path always prepares.
+var SEEDERS_TABLE = "_blamejs_seeders";       // allow:hand-rolled-sql — logical name declaration; physical name + prefix resolve via frameworkSchema.tableName below
+var LOCK_TABLE    = "_blamejs_seeders_lock";  // allow:hand-rolled-sql — logical name declaration; physical name + prefix resolve via frameworkSchema.tableName below
+
+// b.sql opts for the local single-node handle: the resolved table name,
+// quoted by construction. tableName() applies the configurable prefix
+// (byte-identical to the literal under the default _blamejs_ prefix).
+function _seedersTable() { return frameworkSchema.tableName(SEEDERS_TABLE); }
+function _lockTable() { return frameworkSchema.tableName(LOCK_TABLE); }
+// b.sql opts resolved from the handle's dialect (sqlite by default; an
+// operator's own Postgres / MySQL handle declares `handle.dialect`).
+// quoteName forces the resolved framework name to quote. The
+// handle-dialect / opts / key-text-type resolution is shared with
+// db-schema's reconciler + migrations.js, so it is composed from db-schema
+// rather than re-derived here. The historical default (sqlite) is
+// byte-identical for every local-handle caller.
+var _handleDialect = dbSchema.handleDialect;
+var _sqlOpts = dbSchema.sqlOpts;
+var _keyTextType = dbSchema.keyTextType;
 
 // Filename grammar: leading numeric prefix (any width), '-', non-empty
 // body of [A-Za-z0-9_-], '.js'. Same shape as migrations to avoid
@@ -279,48 +298,63 @@ function _ensureTables(db) {
   // Both _blamejs_seeders + _blamejs_seeders_lock are part of
   // FRAMEWORK_SCHEMA so db.js creates them at boot. The CREATE IF NOT
   // EXISTS here is defensive for tests that hand-seed a fresh
-  // node:sqlite Database without going through b.db.
-  _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + Q_SEEDERS_TABLE + " (" +
-    "  env         TEXT NOT NULL," +
-    "  name        TEXT NOT NULL," +
-    "  description TEXT," +
-    "  appliedAt   TEXT NOT NULL," +
-    "  rerunnable  INTEGER NOT NULL DEFAULT 0," +
-    "  PRIMARY KEY (env, name)" +
-    ")"
-  );
-  _runSql(db,
-    "CREATE TABLE IF NOT EXISTS " + Q_LOCK_TABLE + " (" +
-    "  scope     TEXT PRIMARY KEY CHECK (scope = 'lock')," +
-    "  lockedAt  INTEGER NOT NULL," +
-    "  lockedBy  TEXT NOT NULL" +
-    ")"
-  );
+  // node:sqlite Database without going through b.db. Built through b.sql
+  // so the identifiers quote by construction (composite PK + the single-
+  // row CHECK fence on the lock table mirror db.js's FRAMEWORK_SCHEMA).
+  // env + name are the composite PRIMARY KEY, so both take the key-safe
+  // text type (VARCHAR on mysql, TEXT elsewhere). The lock's scope CHECK
+  // quotes the column under the handle dialect (backtick on mysql); lockedAt
+  // is ms-epoch (`int` → BIGINT on Postgres/MySQL, INTEGER on SQLite).
+  var dialect = _handleDialect(db);
+  var kt = _keyTextType(db);
+  var scopeCheck = "CHECK (" + safeSql.quoteIdentifier("scope", dialect, { allowReserved: true }) + " = 'lock')";
+  var seedersDdl = sql.createTable(_seedersTable(), [
+    { name: "env",         type: kt,     notNull: true },
+    { name: "name",        type: kt,     notNull: true },
+    { name: "description", type: "text" },
+    { name: "appliedAt",   type: "text", notNull: true },
+    { name: "rerunnable",  type: "int",  notNull: true, default: 0 },
+  ], { quoteName: true, primaryKey: ["env", "name"], dialect: dialect });
+  _runSql(db, seedersDdl.sql);
+  var lockDdl = sql.createTable(_lockTable(), [
+    { name: "scope",    type: kt,     primaryKey: true, constraints: scopeCheck },
+    { name: "lockedAt", type: "int",  notNull: true },
+    { name: "lockedBy", type: "text", notNull: true },
+  ], { quoteName: true, dialect: dialect });
+  _runSql(db, lockDdl.sql);
 }
 
 function _lockHolderId() {
   return String(process.pid) + "@" + (require("node:os").hostname() || "unknown");
 }
 
+// b.sql-built statements for the single advisory-lock row. Each binds
+// every value as a placeholder (the constant scope "lock" included) and
+// quotes the resolved table name by construction.
+function _lockInsertSql(db, nowMs, holder) {
+  return sql.insert(_lockTable(), _sqlOpts(db))
+    .values({ scope: "lock", lockedAt: nowMs, lockedBy: holder }).toSql();
+}
+
 function _acquireLock(db, lockStaleAfterMs, clock) {
   var holder = _lockHolderId();
   var nowMs = clock();
   try {
-    db.prepare(
-      "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-    ).run(nowMs, holder);
+    var ins = _lockInsertSql(db, nowMs, holder);
+    var insStmt = db.prepare(ins.sql);
+    insStmt.run.apply(insStmt, ins.params);
     return holder;
   } catch (_e) {
-    var existing = db.prepare(
-      "SELECT lockedAt, lockedBy FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock'"
-    ).get();
+    var selBuilt = sql.select(_lockTable(), _sqlOpts(db))
+      .columns(["lockedAt", "lockedBy"]).where("scope", "lock").toSql();
+    var selStmt = db.prepare(selBuilt.sql);
+    var existing = selStmt.get.apply(selStmt, selBuilt.params);
     if (!existing) {
       // Race window between INSERT failure and SELECT — try once more.
       try {
-        db.prepare(
-          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-        ).run(nowMs, holder);
+        var ins2 = _lockInsertSql(db, nowMs, holder);
+        var ins2Stmt = db.prepare(ins2.sql);
+        ins2Stmt.run.apply(ins2Stmt, ins2.params);
         return holder;
       } catch (e2) {
         throw _err("LOCK_BUSY",
@@ -329,23 +363,32 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
     }
     var ageMs = nowMs - Number(existing.lockedAt);
     if (lockStaleAfterMs > 0 && ageMs > lockStaleAfterMs) {
-      _runSql(db, "BEGIN IMMEDIATE");
+      // Force-replace the stale lock atomically. The transaction boundary
+      // is dialect-aware: only SQLite has the `BEGIN IMMEDIATE`
+      // write-lock-up-front form — Postgres + MySQL reject the `IMMEDIATE`
+      // keyword, so the shared runInTransaction helper emits a plain
+      // portable `BEGIN`/`COMMIT`/`ROLLBACK` there.
+      var lockMode = _handleDialect(db) === "sqlite" ? "IMMEDIATE" : null;
       try {
-        db.prepare("DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedAt = ?")
-          .run(existing.lockedAt);
-        db.prepare(
-          "INSERT INTO " + Q_LOCK_TABLE + " (scope, lockedAt, lockedBy) VALUES ('lock', ?, ?)"
-        ).run(nowMs, holder);
-        _runSql(db, "COMMIT");
-        return holder;
+        return dbSchema.runInTransaction(db, function () {
+          var delBuilt = sql.delete(_lockTable(), _sqlOpts(db))
+            .where("scope", "lock").where("lockedAt", existing.lockedAt).toSql();
+          var delStmt = db.prepare(delBuilt.sql);
+          delStmt.run.apply(delStmt, delBuilt.params);
+          var insForce = _lockInsertSql(db, nowMs, holder);
+          var insForceStmt = db.prepare(insForce.sql);
+          insForceStmt.run.apply(insForceStmt, insForce.params);
+          return holder;
+        }, {
+          lockMode: lockMode,
+          onRollbackFail: function (rollbackErr) {
+            log.debug("rollback-failed", {
+              op: "lock-stale-replace",
+              error: rollbackErr && rollbackErr.message,
+            });
+          },
+        });
       } catch (forceErr) {
-        try { _runSql(db, "ROLLBACK"); }
-        catch (rollbackErr) {
-          log.debug("rollback-failed", {
-            op: "lock-stale-replace",
-            error: rollbackErr && rollbackErr.message,
-          });
-        }
         throw _err("LOCK_STALE_REPLACE_FAILED",
           "seeders: could not replace stale lock: " +
           ((forceErr && forceErr.message) || String(forceErr)));
@@ -359,9 +402,10 @@ function _acquireLock(db, lockStaleAfterMs, clock) {
 
 function _releaseLock(db, holder) {
   try {
-    db.prepare(
-      "DELETE FROM " + Q_LOCK_TABLE + " WHERE scope = 'lock' AND lockedBy = ?"
-    ).run(holder);
+    var built = sql.delete(_lockTable(), _sqlOpts(db))
+      .where("scope", "lock").where("lockedBy", holder).toSql();
+    var stmt = db.prepare(built.sql);
+    stmt.run.apply(stmt, built.params);
   } catch (_e) { /* best-effort */ }
 }
 
@@ -406,10 +450,13 @@ function create(opts) {
   }
 
   function _appliedRows(db, env) {
-    return db.prepare(
-      "SELECT name, description, appliedAt, rerunnable FROM " + Q_SEEDERS_TABLE +
-      " WHERE env = ? ORDER BY appliedAt ASC, name ASC"
-    ).all(env);
+    var built = sql.select(_seedersTable(), _sqlOpts(db))
+      .columns(["name", "description", "appliedAt", "rerunnable"])
+      .where("env", env)
+      .orderBy("appliedAt", "asc").orderBy("name", "asc")
+      .toSql();
+    var stmt = db.prepare(built.sql);
+    return stmt.all.apply(stmt, built.params);
   }
 
   function status(callerOpts) {
@@ -469,8 +516,11 @@ function create(opts) {
 
     var holder = _acquireLock(db, lockStaleAfterMs, clock);
     try {
+      var appliedSelBuilt = sql.select(_seedersTable(), _sqlOpts(db))
+        .columns(["name"]).where("env", env).toSql();
+      var appliedSelStmt = db.prepare(appliedSelBuilt.sql);
       var appliedSet = new Set(
-        db.prepare("SELECT name FROM " + Q_SEEDERS_TABLE + " WHERE env = ?").all(env)
+        appliedSelStmt.all.apply(appliedSelStmt, appliedSelBuilt.params)
           .map(function (r) { return r.name; })
       );
 
@@ -503,27 +553,25 @@ function create(opts) {
             _runSql(db, "BEGIN");
             try {
               await mod.run(db, ctx);
+              var nowIso = new Date(clock()).toISOString();
+              var writeBuilt;
               if (alreadyApplied && mod.rerunnable) {
-                db.prepare(
-                  "UPDATE " + Q_SEEDERS_TABLE +
-                  " SET appliedAt = ?, description = ?, rerunnable = ?" +
-                  " WHERE env = ? AND name = ?"
-                ).run(new Date(clock()).toISOString(), mod.description || "",
-                      mod.rerunnable ? 1 : 0, env, name);
+                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                  .set({ appliedAt: nowIso, description: mod.description || "",
+                         rerunnable: mod.rerunnable ? 1 : 0 })
+                  .where("env", env).where("name", name).toSql();
               } else if (alreadyApplied && force) {
-                db.prepare(
-                  "UPDATE " + Q_SEEDERS_TABLE +
-                  " SET appliedAt = ?, description = ?" +
-                  " WHERE env = ? AND name = ?"
-                ).run(new Date(clock()).toISOString(), mod.description || "",
-                      env, name);
+                writeBuilt = sql.update(_seedersTable(), _sqlOpts(db))
+                  .set({ appliedAt: nowIso, description: mod.description || "" })
+                  .where("env", env).where("name", name).toSql();
               } else {
-                db.prepare(
-                  "INSERT INTO " + Q_SEEDERS_TABLE +
-                  " (env, name, description, appliedAt, rerunnable) VALUES (?, ?, ?, ?, ?)"
-                ).run(env, name, mod.description || "",
-                      new Date(clock()).toISOString(), mod.rerunnable ? 1 : 0);
+                writeBuilt = sql.insert(_seedersTable(), _sqlOpts(db))
+                  .values({ env: env, name: name, description: mod.description || "",
+                            appliedAt: nowIso, rerunnable: mod.rerunnable ? 1 : 0 })
+                  .toSql();
               }
+              var writeStmt = db.prepare(writeBuilt.sql);
+              writeStmt.run.apply(writeStmt, writeBuilt.params);
               _runSql(db, "COMMIT");
             } catch (e) {
               try { _runSql(db, "ROLLBACK"); }