@blamejs/core 0.16.15 → 0.16.16

package/CHANGELOG.md

@@ -8,6 +8,8 @@ upgrading across more than a few patches at a time.
 
 ## v0.16.x
 
+- v0.16.16 (2026-07-12) — **Build the data-subject-request ticket store's SQL through the shared b.sql query builder instead of hand-assembled statements, and add a static check that keeps db-handle primitives composing b.sql.** A maintainability change with no behavior difference for operators. The b.dsr ticket store built its reads and writes by concatenating table and column names into SQL strings passed to db.prepare, re-implementing the identifier quoting and sealed-field handling that b.sql — the same builder b.db.from() uses — already provides. That hand-rolled shape is how b.tenant.quota's storage query drifted from the query builder and accrued a run of parity defects fixed in 0.16.15 (reserved-word names, schema-qualified names, sealed-column filtering). The store's DML now composes b.sql (its schema DDL, which is not a b.sql concern, stays as direct statements), so its SQL cannot diverge from the builder. A new codebase-patterns check flags any db-handle primitive that passes an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql, directing it to compose b.sql instead, so this class of drift cannot recur. **Changed:** *b.dsr ticket store composes b.sql for its reads and writes* — The data-subject-request ticket store (insert / get / list / update / delete / purge and the legacy re-seal backfill) now builds its DML with the b.sql query builder — sql.select / insert / update / delete(table, { dialect, quoteName }).…toSql() — and prepares the resulting statement, rather than concatenating identifiers into SQL strings by hand. This removes a hand-rolled identifier-quoting surface that could drift from what b.db.from() accepts. Schema provisioning (CREATE TABLE / INDEX, ALTER, PRAGMA) is not a b.sql concern and remains as direct statements. One behavior change: on a store backed by a vault, a ticket payload is AEAD-sealed and base64-encoded (~4/3 expansion) before it is bound, and the bound cell must fit the query builder's 64 MiB per-value ceiling — so the payload is now capped at an expansion-safe plaintext size (~48 MiB) and a larger ticket is refused with dsr/ticket-too-large (route large access/portability exports through chunked storage rather than one giant sealed cell). Plaintext stores keep the full 64 MiB limit. When a vault is first enabled on a table that already holds an over-cap legacy plaintext row, the one-time re-seal backfill still migrates that row's subject columns and derived hashes — so it stays findable by subject lookup and erasable by the data-subject erasure purge — and leaves only the over-cap payload plaintext (still under the read ceiling, DB-encrypted at rest, and removed when the row is erased), rather than failing provisioning with a query-builder error. **Detectors:** *Static check: db-handle primitives must compose b.sql for DML* — A new codebase-patterns check flags any primitive holding a db handle that runs DML by passing an inline SELECT / INSERT / UPDATE / DELETE string literal to db.prepare / runSql — the shape that lets a query drift from b.sql's identifier quoting and sealed-field rewrite (the b.tenant.quota storage defect class). It directs authors to build the query with b.sql and prepare the resulting string. DDL and PRAGMA (not b.sql verbs) and queries already built through a b.sql variable are out of scope.
+
 - v0.16.15 (2026-07-11) — **Restore break-glass certificate key escrow, hand a failed production-security assertion its real diagnostic message, and make tenant storage-byte quotas actually enforce — three defects surfaced by broadening test coverage and fixed at the root.** Three primitives had defects that only a hostile or previously-untested path reached. b.cert key escrow — the optional break-glass path that seals a renewed private key to an operator's offline recipient — never worked: writeEscrow called a b.crypto method that does not exist, so any certificate configured with keyEscrow threw the moment renewal tried to seal the key. It now seals via b.crypto.encrypt (ML-KEM-1024, plus the P-384 hybrid leg when the recipient supplies an ecPublicKey) and the operator recovers the key offline with b.crypto.decrypt; the recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(). b.security.assertProduction constructed its error with the code and message transposed, so a failed production-security assertion threw with a bare token (BAD_OPT / ASSERT_FAILED) as its .message and buried the human-readable explanation in .code — operators now get the full diagnostic where they read it. And b.tenant.quota storage-byte accounting was broken several ways: the per-tenant byte sum issued a query the builder rejects, so snapshot / assert / list always threw once a storage cap was set; it read rows through the auto-unsealing ORM, so a sealed column was measured as its small decrypted plaintext rather than the larger on-disk vault envelope (letting sealed-column tenants slip under the cap); when the tenant identifier itself was a sealed column, the plaintext lookup matched no rows at all and the cap silently counted zero; and BLOB columns (handed back as Uint8Array by node:sqlite) were stringified before measuring, roughly tripling their counted size and refusing writes far below the real cap. All are fixed — the sum now filters a sealed tenant id by its derived-hash blind index, reads the raw stored rows, and measures true on-disk byte lengths — so storage quotas enforce at the configured limit. **Fixed:** *b.cert break-glass key escrow seals the renewed key instead of throwing* — A certificate configured with keyEscrow forwarded the private key to writeEscrow, which called a b.crypto.encryptEnvelope method that does not exist — so escrow threw on every renewal and the break-glass recovery path was unusable. It now seals the key to the operator's offline recipient with b.crypto.encrypt: ML-KEM-1024 always, plus a P-384 hybrid leg when the recipient carries an ecPublicKey. The recipient accepts an ML-KEM-1024 public-key PEM string or a { publicKey, ecPublicKey } pair from b.crypto.generateEncryptionKeyPair(); the sealed key is never decrypted by the framework and is recovered offline with b.crypto.decrypt and the matching private key(s). · *b.security.assertProduction throws with the diagnostic in .message* — SecurityAssertError was constructed with its code and message arguments transposed, so a failed production-security assertion surfaced a bare token (BAD_OPT / ASSERT_FAILED) as its .message while the explanatory text — including the per-assertion failure list — landed in .code. Operators catching the error now read the full diagnostic in .message and the stable token in .code, as documented. · *b.tenant.quota enforces storage-byte caps at the configured limit* — The per-tenant storage-bytes accounting had several defects. It issued a query the query builder rejects (a literal '*' column), so snapshot / assert / list threw as soon as a storage cap was configured — the storage half of tenant quotas never ran against a real database. It read rows through the ORM, which auto-unseals sealed columns, so a sealed cell was measured as its small decrypted plaintext rather than the much larger vault envelope actually on disk — a tenant whose data lives in sealed columns could sail under the cap. When the tenant identifier column itself was sealed, the plaintext lookup compared against the on-disk envelope and matched no rows, so the cap silently counted zero for those tenants. And BLOB columns, which node:sqlite returns as a Uint8Array rather than a Node Buffer, were stringified before measuring: String(uint8array) is the decimal-joined bytes, roughly a 3x overcount that refused writes well below the real cap. The sum now filters a sealed tenant identifier by its derived-hash blind index (as the query builder does), reads the raw stored rows (no unseal), and counts text as its UTF-8 byte length and typed-array views by their true byte length, so a storage cap — including data in sealed columns — enforces at the limit operators set.
 
 - v0.16.14 (2026-07-11) — **Make the object-store single-backend shorthand work for remote backends, and return a string time zone (not an array) when importing an iCalendar event — two defects found by covering previously-untested configuration and import branches.** Covering more configuration and import branches surfaced two genuine defects, now fixed at the root. The documented object-store single-backend shorthand — b.storage.init({ backend: 'sigv4' | 'gcs' | 'azure-blob' | 'http-put', ... }) — never worked for a remote backend: it forwarded the caller's options with the backend key intact, but the object-store backend builder resolves protocol, so the backend was constructed with no protocol and initialization threw a missing-protocol error. Only the local shorthand (which happens to name the key correctly) worked. The shorthand now translates backend to protocol, so all four remote backends construct as documented. And b.calendar.fromIcal mapped a DTSTART;TZID=<zone> parameter to a JSCalendar timeZone that was an array (['America/New_York']) instead of the string RFC 8984 §4.7.1 requires — it only round-tripped by accident because a single-element array coerces to a string; the parameter is now unwrapped to a scalar string. **Fixed:** *b.storage remote single-backend shorthand constructs the backend* — b.storage.init({ backend: 'sigv4' | 'gcs' | 'azure-blob' | 'http-put', ... }) forwarded the options with the backend key, but the object-store backend builder reads protocol — so the default backend had no protocol and initialization threw a missing-protocol ObjectStoreError. The remote shorthand never worked (only the { backend: 'local' } form, which names protocol correctly under the hood, did). The shorthand now maps backend to protocol and drops the backend key, so all four remote backends build as documented. · *b.calendar.fromIcal returns a string time zone for DTSTART/DUE;TZID* — An imported event's DTSTART;TZID=<zone> (or a task's DUE;TZID) mapped to a JSCalendar timeZone that was a single-element array rather than the string RFC 8984 §4.7.1 requires. It happened to round-trip back through toIcal because a one-element array coerces to a string, but consumers reading timeZone as a string saw an array. The property parameter is now unwrapped to its scalar first value.

package/lib/dsr.js

@@ -116,6 +116,7 @@ var bCrypto = require("./crypto");
 var lazyRequire = require("./lazy-require");
 var validateOpts = require("./validate-opts");
 var safeSql = require("./safe-sql");
+var sql = require("./sql");
 var safeJson = require("./safe-json");
 var boundedMap = require("./bounded-map");
 var { defineClass } = require("./framework-error");
@@ -124,6 +125,13 @@ var DsrError = defineClass("DsrError", { alwaysPermanent: true });
 
 var audit = lazyRequire(function () { return require("./audit"); });
 var observability = lazyRequire(function () { return require("./observability"); });
+
+// A vaulted store AEAD-seals + base64-encodes the payload before binding it
+// (~4/3 expansion), and the bound cell must fit b.sql's 64 MiB per-value
+// ceiling. Cap the plaintext at an expansion-safe size — leave a KiB for the
+// vault nonce / tag / prefix — so the sealed cell binds through b.sql; a
+// plaintext store keeps the full read ceiling (safeJson.ABSOLUTE_MAX_BYTES).
+var VAULTED_SEAL_SAFE_MAX_BYTES = Math.floor(safeJson.ABSOLUTE_MAX_BYTES * 3 / 4) - C.BYTES.kib(1);
 // cryptoField + vault lazy-required: dbTicketStore seals subject PII + the
 // full ticket payload at rest so a GDPR Art 17 erasure leaves no
 // decryptable copy. Lazy so the module loads in vault-less / test-tooling
@@ -1027,6 +1035,12 @@ function dbTicketStore(opts) {
   validateOpts.requireMethods(db, ["runSql", "prepare"],
     "dbTicketStore: opts.db (b.db-shaped handle)", DsrError, "dsr/bad-db");
   var tableRaw = opts.table || "dsr_tickets";
+  // b.sql builder opts for the DML below — quoteName quotes the operator-
+  // supplied table name exactly as db.from() does (reserved words, schema-
+  // qualified "schema.table"), so the store composes b.sql instead of
+  // hand-rolling identifier quoting. DDL (CREATE/ALTER) stays hand-rolled —
+  // b.sql is a DML builder, not a schema tool.
+  var SQL_OPTS = { dialect: "sqlite", quoteName: true };
   var qTable, qEmailIdx, qStatusIdx;
   try {
     qTable     = safeSql.quoteIdentifier(tableRaw, "sqlite");
@@ -1109,32 +1123,57 @@ function dbTicketStore(opts) {
     // selected) and cheap (an empty scan) once migrated.
     if (vault().isInitialized()) {
       _ensureDsrSealTable();
-      var legacyRows = db.prepare(
-        "SELECT id, subject_id, subject_email, subject_phone, payload FROM " + qTable +
-        " WHERE (subject_email IS NOT NULL AND subject_email_hash IS NULL)" +
-        " OR (subject_id IS NOT NULL AND subject_id_hash IS NULL)").all({});
+      // The grouped-OR predicate has no operator input; it is a fixed
+      // structural condition, so it rides through b.sql's whereRaw escape
+      // (allow:hand-rolled-sql — a static, param-free legacy-detection filter
+      // b.sql's structured where() cannot express as one OR-of-ANDs group).
+      var legacySel = sql.select(tableRaw, SQL_OPTS)
+        .columns(["id", "subject_id", "subject_email", "subject_phone", "payload"])
+        .whereRaw("(subject_email IS NOT NULL AND subject_email_hash IS NULL) OR (subject_id IS NOT NULL AND subject_id_hash IS NULL)")
+        .toSql();
+      var legacyStmt = db.prepare(legacySel.sql);
+      var legacyRows = legacyStmt.all.apply(legacyStmt, legacySel.params);
       for (var bi = 0; bi < (legacyRows || []).length; bi++) {
         var lrow = legacyRows[bi];
         var lEmailDerived = cryptoField().computeDerived(DSR_SEAL_TABLE, "subject_email", lrow.subject_email);
         var lIdDerived    = cryptoField().computeDerived(DSR_SEAL_TABLE, "subject_id", lrow.subject_id);
-        var lSealed = cryptoField().sealRow(DSR_SEAL_TABLE, {
+        // A legacy plaintext payload above the expansion-safe cap cannot be
+        // sealed (its sealed form would exceed b.sql's per-value ceiling). The
+        // row must still become findable + erasable, so ALWAYS seal the (small)
+        // subject columns and populate the derived hashes — otherwise, in
+        // vaulted mode, _subjectConds filters only on the hash columns and
+        // list({ subject }) / the erasure purge would never see this prior
+        // ticket, leaving its PII un-erasable. When the payload is over-cap,
+        // keep it plaintext (still ≤ the read ceiling, so it binds; it is
+        // DB-encrypted at rest and removed when the row is erased) and surface
+        // it so the operator can chunk-migrate it.
+        var payloadTooBig = Buffer.byteLength(String(lrow.payload == null ? "" : lrow.payload), "utf8") > VAULTED_SEAL_SAFE_MAX_BYTES;
+        if (payloadTooBig) {
+          try {
+            observability().safeEvent("dsr.backfill.payload_left_plaintext", 1, { table: tableRaw });
+          } catch (_e) { /* drop-silent */ }
+        }
+        // Omit the payload from the seal input when it is over-cap — sealRow
+        // skips absent fields, so only the subject columns are sealed and the
+        // plaintext payload is written back below.
+        var lSealInput = {
           id:            lrow.id,
           subject_id:    lrow.subject_id,
           subject_email: lrow.subject_email,
           subject_phone: lrow.subject_phone,
-          payload:       lrow.payload,
-        });
-        db.prepare("UPDATE " + qTable + " SET subject_id = $sid, subject_email = $email," +
-          " subject_phone = $phone, payload = $payload, subject_email_hash = $emailHash," +
-          " subject_id_hash = $idHash WHERE id = $id").run({
-          $id:        lrow.id,
-          $sid:       lSealed.subject_id,
-          $email:     lSealed.subject_email,
-          $phone:     lSealed.subject_phone,
-          $payload:   lSealed.payload,
-          $emailHash: lEmailDerived ? lEmailDerived.value : null,
-          $idHash:    lIdDerived ? lIdDerived.value : null,
-        });
+        };
+        if (!payloadTooBig) lSealInput.payload = lrow.payload;
+        var lSealed = cryptoField().sealRow(DSR_SEAL_TABLE, lSealInput);
+        var lUpd = sql.update(tableRaw, SQL_OPTS).set({
+          subject_id:         lSealed.subject_id,
+          subject_email:      lSealed.subject_email,
+          subject_phone:      lSealed.subject_phone,
+          payload:            payloadTooBig ? lrow.payload : lSealed.payload,
+          subject_email_hash: lEmailDerived ? lEmailDerived.value : null,
+          subject_id_hash:    lIdDerived ? lIdDerived.value : null,
+        }).where("id", "=", lrow.id).toSql();
+        var lUpdStmt = db.prepare(lUpd.sql);
+        lUpdStmt.run.apply(lUpdStmt, lUpd.params);
       }
     }
   }
@@ -1146,15 +1185,23 @@ function dbTicketStore(opts) {
   // it stores plaintext (matching the agent-* fallback).
   function _sealColumns(id, ticket) {
     // The payload column is read back through safeJson.parse, whose hard
-    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept.
-    // Refuse a ticket whose serialized form exceeds that same ceiling on
-    // write so the store never holds a payload it cannot read back later
-    // (write cap == read cap, measured the same way: UTF-8 byte length).
+    // ceiling (safeJson.ABSOLUTE_MAX_BYTES) caps what any read can accept, so
+    // the plaintext must not exceed it on write either. When a vault is
+    // configured the payload is AEAD-sealed and base64-encoded before it is
+    // bound, which expands it ~4/3; the bound (sealed) cell must still fit the
+    // query builder's per-value binding ceiling (b.sql's MAX_PARAM_BYTES, the
+    // same 64 MiB). Cap the plaintext at an expansion-safe size when vaulted so
+    // an oversized ticket is refused here with the store's own error rather
+    // than a SqlBuilderError deep in the insert — and route large exports to
+    // chunked storage rather than binding one giant sealed cell.
     var serializedPayload = JSON.stringify(ticket);
-    if (Buffer.byteLength(serializedPayload, "utf8") > safeJson.ABSOLUTE_MAX_BYTES) {
+    var vaulted = vault().isInitialized();
+    var maxPlaintextBytes = vaulted ? VAULTED_SEAL_SAFE_MAX_BYTES : safeJson.ABSOLUTE_MAX_BYTES;
+    if (Buffer.byteLength(serializedPayload, "utf8") > maxPlaintextBytes) {
       throw new DsrError("dsr/ticket-too-large",
-        "_sealColumns: ticket " + id + " payload exceeds the " +
-          safeJson.ABSOLUTE_MAX_BYTES + "-byte store limit");
+        "_sealColumns: ticket " + id + " payload exceeds the " + maxPlaintextBytes +
+          "-byte store limit" +
+          (vaulted ? " (sealing expands it; store large exports via chunked storage)" : ""));
     }
     var row = {
       id:            id,
@@ -1205,7 +1252,8 @@ function dbTicketStore(opts) {
     { key: "email",     plainCol: "subject_email", sealField: "subject_email", hashCol: "subject_email_hash", param: "$email" },
     { key: "subjectId", plainCol: "subject_id",    sealField: "subject_id",    hashCol: "subject_id_hash",    param: "$sid" },
   ];
-  function _subjectConds(filter, conds, params) {
+  // AND the subject-match predicate(s) onto a b.sql select builder.
+  function _subjectConds(filter, qb) {
     if (!filter.subject) return;
     var vaulted = vault().isInitialized();
     if (vaulted) _ensureDsrSealTable();
@@ -1213,8 +1261,7 @@ function dbTicketStore(opts) {
       var supplied = filter.subject[spec.key];
       if (!supplied) return;
       if (!vaulted) {
-        conds.push(spec.plainCol + " = " + spec.param);
-        params[spec.param] = supplied;
+        qb.where(spec.plainCol, "=", supplied);
         return;
       }
       // Vaulted: match BOTH the active keyed-MAC digest AND the legacy
@@ -1226,111 +1273,99 @@ function dbTicketStore(opts) {
       var cand = cryptoField().lookupHashCandidates(DSR_SEAL_TABLE, spec.sealField, supplied);
       var values = cand && cand.values ? cand.values : [];
       if (values.length === 0) return;
-      var placeholders = values.map(function (v, i) {
-        var p = spec.param + "_" + i;
-        params[p] = v;
-        return p;
-      });
-      conds.push(spec.hashCol + " IN (" + placeholders.join(", ") + ")");
+      qb.whereIn(spec.hashCol, values);
     });
   }
 
   return {
     insert: async function (ticket) {
       var cols = _sealColumns(ticket.id, ticket);
-      var stmt = db.prepare("INSERT INTO " + qTable +
-        " (id, type, status, subject_id, subject_email, subject_phone, " +
-        "  subject_email_hash, subject_id_hash, " +
-        "  submitted_at, deadline_at, processed_at, verification_level, posture, payload) " +
-        " VALUES ($id, $type, $status, $sid, $email, $phone, " +
-        "         $emailHash, $idHash, $submittedAt, " +
-        "         $deadlineAt, $processedAt, $verLevel, $posture, $payload)");
-      stmt.run({
-        $id:           ticket.id,
-        $type:         ticket.type,
-        $status:       ticket.status,
-        $sid:          cols.$sid,
-        $email:        cols.$email,
-        $phone:        cols.$phone,
-        $emailHash:    cols.$emailHash,
-        $idHash:       cols.$idHash,
-        $submittedAt:  ticket.submittedAt,
-        $deadlineAt:   ticket.deadlineAt,
-        $processedAt:  ticket.processedAt || null,
-        $verLevel:     ticket.verificationLevel || null,
-        $posture:      ticket.posture || null,
-        $payload:      cols.$payload,
-      });
+      var built = sql.insert(tableRaw, SQL_OPTS).values({
+        id:                 ticket.id,
+        type:               ticket.type,
+        status:             ticket.status,
+        subject_id:         cols.$sid,
+        subject_email:      cols.$email,
+        subject_phone:      cols.$phone,
+        subject_email_hash: cols.$emailHash,
+        subject_id_hash:    cols.$idHash,
+        submitted_at:       ticket.submittedAt,
+        deadline_at:        ticket.deadlineAt,
+        processed_at:       ticket.processedAt || null,
+        verification_level: ticket.verificationLevel || null,
+        posture:            ticket.posture || null,
+        payload:            cols.$payload,
+      }).toSql();
+      var stmt = db.prepare(built.sql);
+      stmt.run.apply(stmt, built.params);
     },
     get: async function (id) {
-      var rows = db.prepare("SELECT id, payload FROM " + qTable + " WHERE id = $id")
-                   .all({ $id: id });
+      var built = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"]).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       if (!rows || rows.length === 0) return null;
       return safeJson.parse(_unsealPayload(rows[0].payload, rows[0].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
     },
     list: async function (filter) {
       filter = filter || {};
-      var sql = "SELECT id, payload FROM " + qTable;
-      var conds = [];
-      var params = {};
-      if (filter.status) {
-        conds.push("status = $status");
-        params.$status = filter.status;
-      }
-      _subjectConds(filter, conds, params);
-      if (conds.length > 0) sql += " WHERE " + conds.join(" AND ");
-      sql += " ORDER BY submitted_at DESC";
-      var rows = db.prepare(sql).all(params);
+      var qb = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"]);
+      if (filter.status) qb.where("status", "=", filter.status);
+      _subjectConds(filter, qb);
+      qb.orderBy("submitted_at", "DESC");
+      var built = qb.toSql();
+      var stmt = db.prepare(built.sql);
+      var rows = stmt.all.apply(stmt, built.params);
       return rows.map(function (r) { return safeJson.parse(_unsealPayload(r.payload, r.id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES }); });
     },
     update: async function (id, ticket) {
       var cols = _sealColumns(id, ticket);
-      var stmt = db.prepare("UPDATE " + qTable + " SET " +
-        " type = $type, status = $status, subject_id = $sid, " +
-        " subject_email = $email, subject_phone = $phone, " +
-        " subject_email_hash = $emailHash, subject_id_hash = $idHash, " +
-        " submitted_at = $submittedAt, deadline_at = $deadlineAt, " +
-        " processed_at = $processedAt, verification_level = $verLevel, " +
-        " posture = $posture, payload = $payload " +
-        " WHERE id = $id");
-      var info = stmt.run({
-        $id:           id,
-        $type:         ticket.type,
-        $status:       ticket.status,
-        $sid:          cols.$sid,
-        $email:        cols.$email,
-        $phone:        cols.$phone,
-        $emailHash:    cols.$emailHash,
-        $idHash:       cols.$idHash,
-        $submittedAt:  ticket.submittedAt,
-        $deadlineAt:   ticket.deadlineAt,
-        $processedAt:  ticket.processedAt || null,
-        $verLevel:     ticket.verificationLevel || null,
-        $posture:      ticket.posture || null,
-        $payload:      cols.$payload,
-      });
+      var built = sql.update(tableRaw, SQL_OPTS).set({
+        type:               ticket.type,
+        status:             ticket.status,
+        subject_id:         cols.$sid,
+        subject_email:      cols.$email,
+        subject_phone:      cols.$phone,
+        subject_email_hash: cols.$emailHash,
+        subject_id_hash:    cols.$idHash,
+        submitted_at:       ticket.submittedAt,
+        deadline_at:        ticket.deadlineAt,
+        processed_at:       ticket.processedAt || null,
+        verification_level: ticket.verificationLevel || null,
+        posture:            ticket.posture || null,
+        payload:            cols.$payload,
+      }).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var info = stmt.run.apply(stmt, built.params);
       if (info && info.changes === 0) {
         throw new DsrError("dsr/ticket-not-found",
           "dbTicketStore: ticket " + id + " not found for update");
       }
     },
     delete: async function (id) {
-      var info = db.prepare("DELETE FROM " + qTable + " WHERE id = $id").run({ $id: id });
+      var built = sql.delete(tableRaw, SQL_OPTS).where("id", "=", id).toSql();
+      var stmt = db.prepare(built.sql);
+      var info = stmt.run.apply(stmt, built.params);
       return !!(info && info.changes > 0);
     },
     purgeExpired: async function (asOfMs) {
       // Bulk-delete tickets in terminal states whose retentionUntil
       // is in the past. Returns the number of rows removed.
       var asOf = (typeof asOfMs === "number" && isFinite(asOfMs)) ? asOfMs : Date.now();
-      var rows = db.prepare("SELECT id, payload FROM " + qTable +
-                            " WHERE status IN ('completed','partially_completed','cancelled','rejected','expired')").all({});
+      var selBuilt = sql.select(tableRaw, SQL_OPTS).columns(["id", "payload"])
+        .whereIn("status", ["completed", "partially_completed", "cancelled", "rejected", "expired"])
+        .toSql();
+      var selStmt = db.prepare(selBuilt.sql);
+      var rows = selStmt.all.apply(selStmt, selBuilt.params);
       var purged = 0;
-      var del = db.prepare("DELETE FROM " + qTable + " WHERE id = $id");
       for (var i = 0; i < rows.length; i++) {
         try {
           var t = safeJson.parse(_unsealPayload(rows[i].payload, rows[i].id), { maxBytes: safeJson.ABSOLUTE_MAX_BYTES });
           if (t.retentionUntil && t.retentionUntil < asOf) {
-            del.run({ $id: rows[i].id });
+            // The delete SQL string is identical every iteration, so db.prepare
+            // returns the same cached statement — composing per-row is free.
+            var dBuilt = sql.delete(tableRaw, SQL_OPTS).where("id", "=", rows[i].id).toSql();
+            var dStmt = db.prepare(dBuilt.sql);
+            dStmt.run.apply(dStmt, dBuilt.params);
             purged += 1;
           }
         } catch (_e) { /* malformed payload — leave it */ }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blamejs/core",
-  "version": "0.16.15",
+  "version": "0.16.16",
   "description": "The Node framework that owns its stack.",
   "license": "Apache-2.0",
   "author": "blamejs contributors",

package/sbom.cdx.json

@@ -2,10 +2,10 @@
   "$schema": "http://cyclonedx.org/schema/bom-1.5.schema.json",
   "bomFormat": "CycloneDX",
   "specVersion": "1.5",
-  "serialNumber": "urn:uuid:1618a7b7-f477-422c-99bb-f941a8827acf",
+  "serialNumber": "urn:uuid:4536f3b2-ce54-4f57-930f-5250f9a34d41",
   "version": 1,
   "metadata": {
-    "timestamp": "2026-07-12T01:36:29.373Z",
+    "timestamp": "2026-07-12T04:34:36.482Z",
     "lifecycles": [
       {
         "phase": "build"
@@ -19,14 +19,14 @@
       }
     ],
     "component": {
-      "bom-ref": "@blamejs/core@0.16.15",
+      "bom-ref": "@blamejs/core@0.16.16",
       "type": "application",
       "name": "blamejs",
-      "version": "0.16.15",
+      "version": "0.16.16",
       "scope": "required",
       "author": "blamejs contributors",
       "description": "The Node framework that owns its stack.",
-      "purl": "pkg:npm/%40blamejs/core@0.16.15",
+      "purl": "pkg:npm/%40blamejs/core@0.16.16",
       "properties": [],
       "externalReferences": [
         {
@@ -54,7 +54,7 @@
   "components": [],
   "dependencies": [
     {
-      "ref": "@blamejs/core@0.16.15",
+      "ref": "@blamejs/core@0.16.16",
       "dependsOn": []
     }
   ]