Fix SQL injection, schema-sync data loss, and backup safety

Security:
- select: bind parameters instead of mysql.format (backslash escaping
  allowed injection on SQLite); drop the mysql dependency
- validate all interpolated identifiers, limit/offset/page, order
  strategy, operators, join types and raw equalities (new sql-safe.ts)
- quote identifiers and bind values in schema manager DDL/queries

Data loss:
- schema sync runs with foreign keys off inside a transaction, with
  foreign_key_check before commit (DROP TABLE no longer cascades)
- parentTableName tables: stop mutating the parent schema and copy
  inherited columns on rebuild
- keep column data on type changes (match columns by name)
- backups and schema snapshots use VACUUM INTO (includes WAL data);
  restore closes the DB, clears -wal/-shm, and swaps atomically
- backup listing/trimming only touches <db_name>-<timestamp> files

Correctness:
- update/delete use the generator's WHERE clause instead of a regex
- keep 0/""/false values; booleans stored as 0/1
- IN/NOT IN and BETWEEN arrays, NOT LIKE wrapping, AVG, select aliases
- OFFSET without LIMIT, count ignores pagination
- MATCH emits `field MATCH fn(?)` for sqlite-vec
- sql() returns rows for any row-producing statement
- targetId no longer mutates the caller's query
- init throws instead of process.exit; CLI reports errors

Co-Authored-By: Claude Opus 5.5 <[email protected]>

src/lib/grab-duplicate-safe-insert-sql.ts

@@ -1,4 +1,5 @@
 import init from "../functions/init";
+import { sqlIdent, sqlQuoteIdent } from "../utils/sql-safe";
 
 type Params = {
     sql: string;
@@ -13,9 +14,12 @@ export default async function ({ sql: passed_sql, table, data }: Params) {
     const now = Date.now();
 
     if (table_schema?.tableName) {
-        const set_sql_arr = Object.keys(
-            Array.isArray(data) ? data[0] : data,
-        ).map((field) => `${field} = excluded.${field}`);
+        const set_sql_arr = Object.keys(Array.isArray(data) ? data[0] : data)
+            .filter((field) => field !== "updated_at")
+            .map((field) => {
+                const column = sqlIdent(field, "column name");
+                return `${column} = excluded.${column}`;
+            });
 
         set_sql_arr.push(`updated_at = ${now}`);
 
@@ -25,13 +29,18 @@ export default async function ({ sql: passed_sql, table, data }: Params) {
 
         for (let i = 0; i < unique_fields.length; i++) {
             const field = unique_fields[i];
-            sql += ` ON CONFLICT(${field?.fieldName}) DO UPDATE SET ${set_sql}`;
+            if (!field?.fieldName) continue;
+            sql += ` ON CONFLICT(${sqlQuoteIdent(field.fieldName)}) DO UPDATE SET ${set_sql}`;
         }
 
         if (table_schema.uniqueConstraints?.[0]) {
             for (let i = 0; i < table_schema.uniqueConstraints.length; i++) {
                 const constraint = table_schema.uniqueConstraints[i];
-                sql += ` ON CONFLICT(${constraint?.constraintTableFields?.map((c) => c.value)?.join(", ")}) DO UPDATE SET ${set_sql}`;
+                const columns = constraint?.constraintTableFields
+                    ?.map((c) => sqlQuoteIdent(String(c.value)))
+                    ?.join(", ");
+                if (!columns) continue;
+                sql += ` ON CONFLICT(${columns}) DO UPDATE SET ${set_sql}`;
             }
         }
     }