@avytrix/nestjs-drizzle-crud 3.7.0 → 3.7.2

package/AGENT.md

@@ -390,8 +390,10 @@ consumer
 The scope is ANDed into every read, count and write (bulk, upsert, soft delete,
 restore, force delete, attach included) and written onto every created row, so
 another tenant's id is a 404. A missing context value is a 403, never an
-unscoped query. Do not add `tenant_id` to filters or DTOs by hand, and use
-`skipScope: true` only in trusted server code.
+unscoped query. A belongs-to key a write sets must point at a row of the
+caller's tenant when the related table has the scope columns; another tenant's
+row is the same 400 as a missing one. Do not add `tenant_id` to filters or DTOs
+by hand, and use `skipScope: true` only in trusted server code.
 
 # Optimistic locking
 
@@ -434,7 +436,8 @@ never reaches the caller as a 500: a unique violation is a 409, a value that is
 too long, fails a check, has the wrong type or is not a valid date is a 400 (on
 reads too), a foreign key pointing at a row that does not exist is a 400, and a
 delete blocked by dependent rows is a 409. The same holds on MySQL (strict mode
-errors included) and SQLite (constraint errors).
+errors included) and SQLite (constraint errors, and the `STRICT` and
+`SQLITE_MISMATCH` type errors).
 
 ---
 
@@ -453,6 +456,9 @@ whole set (plus one `SELECT` that checks the ids), so never loop `create` or
 `update` over an array yourself. The 400 from `BulkOperationException` lists
 only the failed items: `errors: [{ index | id, status, message }]`.
 `bulkMode: 'perItem'` runs one single-row call per item when a hook needs it.
+One statement may bind at most 65,535 values on PostgreSQL and MySQL, 32,766 on
+SQLite and 100 on Cloudflare D1; past that the call is a 400 before it runs, so
+split very large batches into chunks.
 
 To insert or update by a unique key, use
 `upsert(dto, { conflictTarget: 'email' })` or `massUpsert(rows, ...)` rather

package/CHANGELOG.md

@@ -11,6 +11,74 @@ restore, `ER_DUP_ENTRY` mapping, dialect locking) are tracked separately and unc
 3.3.1, 3.4.0, 3.5.0 and 3.5.2 were tagged but never published to npm. Their changes reached npm
 in 3.5.1 (3.3.1 to 3.5.0) and 3.6.0 (3.5.2). The unscoped `nestjs-drizzle-crud` stops at 3.3.0.
 
+## [3.7.2] - 2026-11-03
+
+Fixes from the 3.7.1 audit. The batch limit now counts the statement the database receives.
+
+### Changed
+
+- The bound parameter limit is checked per statement, against the database's own limit:
+  65,535 on PostgreSQL and MySQL, 32,766 on SQLite and libSQL, 100 on Cloudflare D1. The service
+  counts the parameters of every statement as Drizzle builds it, so two OR'd `IN` lists, the
+  version checks of a `massUpdate` with `expectedVersions`, the children of a nested create and
+  the targets of `attach` and `sync` all count, and a statement past the limit is a 400 that
+  names its count and the limit before it runs. Before, each input list was checked against
+  60,000 on its own: some of those calls still ended in a 500, a `massCreate` that would have fit
+  on PostgreSQL was refused (it counted four extra values per row), and on SQLite the cap sat
+  above the database's limit. The message changes from "Too many values in one call (n); the
+  limit is 60000" to "Too many values in one statement: n bound parameters, and PostgreSQL takes
+  at most 65535". `bindLimit(db)` is protected, for a server built with another limit.
+  `MAX_BATCH_PARAMETERS`, `assertBatchSize` and `insertParameters` stay for compatibility but are
+  deprecated and no longer used.
+- On a scoped entity, `create`, `update`, `upsert` and the mass writes check every belongs-to key
+  they set against the caller's tenant when the related table has the scope columns, the way
+  `attach` checks its targets: one `SELECT` per relation for the whole call. A key to another
+  tenant's row is the same 400 `ForeignKeyViolationException` as a key to a missing row, so the
+  answer no longer tells them apart, and a missing row is refused even without a database
+  foreign key. Calls with `skipScope: true` and related tables without the scope columns are
+  not checked.
+- On SQLite, `contains`, `startsWith` and `endsWith` with `sql.caseSensitive: true` compile to
+  `GLOB` and match case exactly. They used `LIKE`, which ignores ASCII case. The default
+  (case-insensitive) and the `like` operator are unchanged.
+- On MySQL, `connection.idleTimeout` also sets mysql2's `maxIdle` to one below the pool size.
+  mysql2 only reaps idle connections when `maxIdle` is below `connectionLimit`, so the timeout
+  had no effect before.
+- `forRootAsync` with more than one of `useFactory`, `useClass` and `useExisting` throws at
+  startup and names them. Before, `useFactory` won and the class was ignored.
+
+### Fixed
+
+- On SQLite, a `STRICT` table refusing a value of the wrong type (extended code 3091, which
+  libSQL reports as `UNKNOWN_SQLITE_ERROR_3091`) and `SQLITE_MISMATCH` (`"abc"` for an
+  `INTEGER PRIMARY KEY`) are a 400 `ValidationFailedException`, not a 500. The dialect contract
+  checks the same mapping on every dialect.
+- Filters inside `options.counts` get the same 32 level depth cap as a `findAll` filter. A very
+  deep one was a 500 (stack overflow).
+- The filter depth check no longer overflows the call stack on an `IN` list of a few hundred
+  thousand items.
+- A batch so large that Drizzle's own SQL builder overflows the call stack is the same 400 as
+  any other statement past the limit.
+- Full-text search over several columns no longer drops rows that have `NULL` in one of them.
+  The vector was `to_tsvector(cfg, a) || to_tsvector(cfg, b)`, and `x || NULL` is `NULL`, so
+  such a row never matched, in `fullTextSearch()` and in `search.mode: "fullText"` alike. Each
+  column is now wrapped in `coalesce(column, '')` when there is more than one. A GIN index on the
+  old multi-column expression no longer matches the query; recreate it with the `coalesce` (the
+  full-text search page has the exact `CREATE INDEX`). A single column is unchanged.
+
+### Docs
+
+- `AGENTS.md` names the package `@avytrix/nestjs-drizzle-crud`, and says that PGlite, the engine
+  of the unit and e2e specs, returns no rows above 32,767 bound parameters.
+
+## [3.7.1] - 2026-11-02
+
+### Fixed
+
+- The error for an upsert on a scoped entity on MySQL now reads "upsert on a scoped entity needs
+  PostgreSQL or SQLite". It said PostgreSQL only, though SQLite supports a scoped upsert since 3.7.0.
+- `?fields=` paths named `__proto__`, `constructor` or `prototype` are treated as plain names.
+  Before, they reached the select tree's object internals (CodeQL js/remote-property-injection).
+
 ## [3.7.0] - 2026-11-02
 
 SQLite support, MySQL connections built for you, and full-text search that works like `findAll`.

package/README.md

@@ -287,7 +287,7 @@ export class UsersController {
 |---|---|---|
 | `dialect` | `'postgresql' \| 'mysql' \| 'sqlite'` | **Required.** Database dialect. `'sqlite'` covers SQLite, libSQL and Cloudflare D1. |
 | `connectionString` | `string` | Connection string. The module builds the connection (PostgreSQL with `postgres`, MySQL with `mysql2`). |
-| `connection` | `{ poolSize?, idleTimeout?, ssl? }` | Pool size, idle timeout (seconds) and TLS for the connection built from `connectionString`. |
+| `connection` | `{ poolSize?, idleTimeout?, ssl? }` | Pool size, idle timeout (seconds) and TLS for the connection built from `connectionString`. On MySQL an idle timeout also sets mysql2's `maxIdle` one below the pool size, so idle connections really close. |
 | `db` | `Drizzle instance` | Alternatively, pass a Drizzle instance you built yourself (any dialect). |
 | `schema` | `Record<string, unknown>` | Drizzle schema, used when building from `connectionString`. |
 | `defaults.softDelete` | `boolean` | Enable soft delete for all entities (default `true`). |
@@ -334,7 +334,8 @@ DrizzleCrudModule.forRootAsync({
 ```
 
 `forRootAsync` also takes `useClass` or `useExisting` with a class that
-implements `DrizzleCrudOptionsFactory`:
+implements `DrizzleCrudOptionsFactory`. Give exactly one of the three; more than
+one is a startup error:
 
 ```typescript
 @Injectable()
@@ -542,7 +543,7 @@ await service.findAll({
 | `in` / `notIn` | `IN (...)` / `NOT IN (...)` |
 | `between` | `BETWEEN a AND b`, `[from, to]` |
 | `isNull` / `isNotNull` | `true` / `"true"` gives `IS NULL` / `IS NOT NULL`, `false` / `"false"` the opposite |
-| `startsWith` / `endsWith` / `contains` | escaped `LIKE`, case-insensitive unless `sql.caseSensitive` |
+| `startsWith` / `endsWith` / `contains` | escaped `LIKE`, case-insensitive unless `sql.caseSensitive` (then `GLOB` on SQLite, whose `LIKE` ignores case) |
 | `iStartsWith` / `iEndsWith` / `iContains` | escaped `ILIKE` (`LIKE` on MySQL), always case-insensitive |
 | `arrayContains` / `arrayOverlaps` | PostgreSQL arrays, `@>` / `&&` |
 | `jsonContains` | PostgreSQL `jsonb`, `@>` |
@@ -940,6 +941,11 @@ inside a savepoint that is rolled back, and the response body lists only them:
 
 `bulkMode: 'perItem'` runs the single-row method per item instead, as in 3.3.
 
+One statement may bind at most 65,535 values on PostgreSQL and MySQL, 32,766 on
+SQLite and 100 on Cloudflare D1. The service counts the real statement (every
+column, version check and OR'd list included) and answers one past the limit
+with a 400 that names both numbers, before it runs. Split larger batches.
+
 ---
 
 ## Upsert
@@ -1044,7 +1050,9 @@ await docs.findAll({}, {}, { context: { tenantId: 7 } });
 
 A missing context value is a 403 (`MissingScopeException`), never an unscoped
 query. A resolver that returns `null`, or `skipScope: true`, runs unscoped on
-purpose.
+purpose. A belongs-to key that a write sets must point at a row of the same
+tenant when the related table has the scope columns: another tenant's row is the
+same 400 `ForeignKeyViolationException` as a missing one.
 
 ---
 

package/dist/core/abstract/sql-base-crud.service.d.ts

@@ -35,6 +35,14 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     protected filterWritable(entity: Record<string, any>, operation: "create" | "update", options?: SqlOperationOptions): Record<string, any>;
     protected keyOf(value: unknown): string;
     constructor(config: SqlCrudConfig);
+    private readonly boundDbs;
+    protected dbFor(transaction?: any): any;
+    protected withBindLimit(db: any): any;
+    protected bindLimit(db: any): {
+        limit: number;
+        name: string;
+    };
+    protected isD1(db: any): boolean;
     private validateConfiguration;
     private validateColumns;
     private validateRelations;
@@ -146,6 +154,10 @@ export declare abstract class SqlBaseCrudService<T extends Record<string, any>,
     private takeNested;
     private insertNested;
     private relatedRow;
+    private keysOutsideScope;
+    private assertBatchKeysInScope;
+    private assertKeysInScope;
+    private missingParentException;
     private linkTargets;
     attach(id: any, relation: string, relatedIds: unknown[], options?: SqlOperationOptions): Promise<T>;
     detach(id: any, relation: string, relatedIds?: unknown[], options?: SqlOperationOptions): Promise<T>;

package/dist/core/abstract/sql-base-crud.service.js

@@ -11,6 +11,15 @@ const query_parser_1 = require("../utils/query-parser");
 const JOIN_KEY = "__crudJoinKey";
 const CURSOR_KEY = "__crudCursor";
 const ROLLBACK = Symbol("rollback");
+const BIND_LIMITS = {
+    postgresql: { limit: 65_535, name: "PostgreSQL" },
+    mysql: { limit: 65_535, name: "MySQL" },
+    sqlite: { limit: 32_766, name: "SQLite" },
+    d1: { limit: 100, name: "Cloudflare D1" },
+};
+class BindLimitException extends common_1.BadRequestException {
+}
+const CHECKED_DIALECTS = new WeakSet();
 const GROUP_KEYS = new Set(["and", "or", "not"]);
 const QUANTIFIERS = new Set(["some", "none", "every"]);
 const COUNT_KEY = "__crudCountKey";
@@ -273,6 +282,53 @@ class SqlBaseCrudService {
         this.config = (0, merge_config_1.mergeCrudConfig)(this.defaultConfig, config);
         this.validateConfiguration();
     }
+    boundDbs = new WeakMap();
+    dbFor(transaction) {
+        return this.withBindLimit(transaction || this.config.db);
+    }
+    withBindLimit(db) {
+        const dialect = db?.dialect;
+        if (typeof dialect?.sqlToQuery !== "function" ||
+            CHECKED_DIALECTS.has(dialect)) {
+            return db;
+        }
+        const cached = this.boundDbs.get(db);
+        if (cached)
+            return cached;
+        const { limit, name } = this.bindLimit(db);
+        const checked = Object.create(dialect);
+        const tooMany = (count) => new BindLimitException(`Too many values in one statement: ${count} bound parameters, and ${name} takes at most ${limit}. Split the batch.`);
+        checked.sqlToQuery = (...args) => {
+            let query;
+            try {
+                query = dialect.sqlToQuery(...args);
+            }
+            catch (error) {
+                if (error instanceof RangeError)
+                    throw tooMany(`more than ${limit}`);
+                throw error;
+            }
+            const count = query?.params?.length ?? 0;
+            if (count > limit)
+                throw tooMany(String(count));
+            return query;
+        };
+        CHECKED_DIALECTS.add(checked);
+        const view = Object.create(db, {
+            dialect: { value: checked, writable: true, configurable: true },
+        });
+        this.boundDbs.set(db, view);
+        return view;
+    }
+    bindLimit(db) {
+        if (this.isD1(db))
+            return BIND_LIMITS.d1;
+        return BIND_LIMITS[this.config.dialect] ?? BIND_LIMITS.postgresql;
+    }
+    isD1(db) {
+        const kind = db?.constructor?.[drizzle_orm_1.entityKind];
+        return kind === "D1Database" || kind === "D1Transaction";
+    }
     validateConfiguration() {
         if (!this.config.db)
             throw new Error("Database instance is required");
@@ -394,15 +450,19 @@ class SqlBaseCrudService {
         return roots;
     }
     parseSelect(select) {
-        const root = { base: [], relations: {} };
+        const tree = () => ({
+            base: [],
+            relations: Object.create(null),
+        });
+        const root = tree();
         for (const entry of select || []) {
             const segments = (entry || "").split(".").filter(Boolean);
             if (segments.length === 0)
                 continue;
             let node = root;
             for (const name of segments.slice(0, -1)) {
-                if (!node.relations[name])
-                    node.relations[name] = { base: [], relations: {} };
+                if (!Object.hasOwn(node.relations, name))
+                    node.relations[name] = tree();
                 node = node.relations[name];
             }
             node.base.push(segments[segments.length - 1]);
@@ -410,7 +470,9 @@ class SqlBaseCrudService {
         return root;
     }
     selectFor(select, name) {
-        return select.relations[name] ?? { base: [], relations: {} };
+        return Object.hasOwn(select.relations, name)
+            ? select.relations[name]
+            : { base: [], relations: {} };
     }
     keysForChildren(nodes, hostTable = this.config.table) {
         return nodes
@@ -825,8 +887,17 @@ class SqlBaseCrudService {
             if (typeof code === "string" && code.startsWith("SQLITE_CONSTRAINT_")) {
                 return code.slice("SQLITE_CONSTRAINT_".length);
             }
+            if (code === "UNKNOWN_SQLITE_ERROR_3091" || e?.rawCode === 3091) {
+                return "DATATYPE";
+            }
+            if (code === "SQLITE_MISMATCH")
+                return "MISMATCH";
         }
         const message = `${error?.cause?.message ?? ""} ${error?.message ?? ""}`;
+        if (/cannot store \S+ value in \S+ column/.test(message))
+            return "DATATYPE";
+        if (/datatype mismatch/.test(message))
+            return "MISMATCH";
         const m = message.match(/(UNIQUE|PRIMARY KEY|FOREIGN KEY|NOT NULL|CHECK) constraint failed/);
         return m?.[1]?.replace(" ", "");
     }
@@ -861,6 +932,8 @@ class SqlBaseCrudService {
     static SQLITE_DATA_ERRORS = {
         NOTNULL: "a required value is missing",
         CHECK: "a value violates a column check constraint",
+        DATATYPE: "a value does not match its column type",
+        MISMATCH: "a value does not match its column type",
     };
     dataErrorMessage(error) {
         const code = error?.code ?? error?.cause?.code;
@@ -893,7 +966,7 @@ class SqlBaseCrudService {
                 ? text.match(/column '([^']+)'/i)?.[1]
                 : undefined) ??
             (this.config.dialect === "sqlite"
-                ? text.match(/NOT NULL constraint failed: (?:[^.\s]+\.)?(\S+)/)?.[1]
+                ? text.match(/(?:NOT NULL constraint failed:|value in \S+ column) (?:[^.\s]+\.)?(\S+)/)?.[1]
                 : undefined);
         return new crud_exceptions_1.ValidationFailedException(column ? `${message}: ${column}` : message);
     }
@@ -960,7 +1033,9 @@ class SqlBaseCrudService {
             throw new common_1.BadRequestException(`Invalid full-text query mode: ${String(mode)} (expected 'plain' or 'websearch')`);
         }
         const parse = drizzle_orm_1.sql.raw(mode === "websearch" ? "websearch_to_tsquery" : "plainto_tsquery");
-        const vector = drizzle_orm_1.sql.join(columns.map((column) => (0, drizzle_orm_1.sql) `to_tsvector(${config}, ${column})`), (0, drizzle_orm_1.sql) ` || `);
+        const vector = drizzle_orm_1.sql.join(columns.map((column) => columns.length > 1
+            ? (0, drizzle_orm_1.sql) `to_tsvector(${config}, coalesce(${column}, ''))`
+            : (0, drizzle_orm_1.sql) `to_tsvector(${config}, ${column})`), (0, drizzle_orm_1.sql) ` || `);
         return { vector, query: (0, drizzle_orm_1.sql) `${parse}(${config}, ${term})` };
     }
     buildSearchCondition(search) {
@@ -1105,7 +1180,7 @@ class SqlBaseCrudService {
     }
     async findFirst(conditions, options) {
         const { transaction, relations = [], select = [] } = options || {};
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         const nodes = this.relationTree(relations);
         const joined = this.planJoins(nodes);
         const selection = this.parseSelect(select);
@@ -1127,7 +1202,7 @@ class SqlBaseCrudService {
     planList(filters, sortBy, sortOrder, options) {
         this.checkReadOptions(options);
         const { transaction, relations = [], select = [] } = options || {};
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         const nodes = this.relationTree(relations);
         const joined = this.planJoins(nodes);
         const selection = this.parseSelect(select);
@@ -1395,9 +1470,10 @@ class SqlBaseCrudService {
         this.checkReadOptions(options);
         const entityData = await this.prepareCreate(data, options);
         const nested = this.takeNested(entityData, options);
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         await this.emitEvent("before", "create", false, { input: data, transaction }, options);
         try {
+            await this.assertKeysInScope(db, entityData, options, nested.map((entry) => entry.name));
             const createdEntity = nested.length === 0
                 ? await this.insertOne(db, entityData, options)
                 : await this.executeSqlTransaction((tx) => this.insertNested(tx, entityData, nested, {
@@ -1520,6 +1596,55 @@ class SqlBaseCrudService {
         }
         return out;
     }
+    async keysOutsideScope(db, rows, options, skip = []) {
+        const failures = new Map();
+        if (!this.resolveScope(options))
+            return failures;
+        for (const [name, relation] of Object.entries(this.config.relations ?? {})) {
+            const local = relation.localKey;
+            if (!local || this.isCollection(relation) || skip.includes(name)) {
+                continue;
+            }
+            const scope = this.relatedScopeConditions(relation.table, options);
+            const referenced = relation.table[relation.references ?? "id"];
+            if (scope.length === 0 || !referenced)
+                continue;
+            const keys = this.uniqueValues(rows.map((row) => row[local]).filter((value) => value != null));
+            if (keys.length === 0)
+                continue;
+            const found = await db
+                .select({ id: referenced })
+                .from(relation.table)
+                .where((0, drizzle_orm_1.and)((0, drizzle_orm_1.inArray)(referenced, keys), ...scope));
+            const present = new Set(found.map((row) => this.valueKey(row.id)));
+            rows.forEach((row, index) => {
+                const value = row[local];
+                if (value == null || present.has(this.valueKey(value)))
+                    return;
+                if (!failures.has(index)) {
+                    failures.set(index, this.missingParentException(local));
+                }
+            });
+        }
+        return failures;
+    }
+    async assertBatchKeysInScope(db, rows, refs, message, options) {
+        const failures = await this.keysOutsideScope(db, rows, options);
+        if (failures.size === 0)
+            return;
+        throw new crud_exceptions_1.BulkOperationException(message, Array.from(failures, ([index, error]) => ({ ...refs[index], error })));
+    }
+    async assertKeysInScope(db, row, options, skip = []) {
+        const failure = (await this.keysOutsideScope(db, [row], options, skip)).get(0);
+        if (failure)
+            throw failure;
+    }
+    missingParentException(localKey) {
+        const field = this.config.dialect === "postgresql"
+            ? (this.columnOf(this.config.table, localKey)?.name ?? localKey)
+            : "reference";
+        return new crud_exceptions_1.ForeignKeyViolationException(this.getEntityName(), field);
+    }
     async linkTargets(tx, relation, parentValue, ids, options) {
         const wanted = this.uniqueValues(ids);
         if (wanted.length === 0)
@@ -1686,9 +1811,10 @@ class SqlBaseCrudService {
         if (this.config.timestamps?.updatedAt) {
             entityData[this.config.timestamps.updatedAt] = new Date();
         }
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         await this.emitEvent("before", "update", false, { ids: [id], input: data, transaction }, options);
         try {
+            await this.assertKeysInScope(db, entityData, opts);
             const [updatedEntity] = await this.updateWhereIn(db, this.withVersionBump(entityData), [id], opts);
             if (!updatedEntity) {
                 if (expected !== undefined) {
@@ -1751,7 +1877,7 @@ class SqlBaseCrudService {
         if (!hooks.skipBefore)
             await this.beforeSoftDelete(id);
         await this.emitEvent("before", "softDelete", false, { ids: [id], transaction }, options);
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         let updateQuery = db
             .update(this.config.table)
             .set(this.softDeleteSet(new Date()))
@@ -1793,7 +1919,7 @@ class SqlBaseCrudService {
         if (!hooks.skipBefore)
             await this.beforeRestore(id);
         await this.emitEvent("before", "restore", false, { ids: [id], transaction }, options);
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         const [restoredEntity] = await this.runRead(this.updateWhereIn(db, this.softDeleteSet(null), [id], options));
         if (!restoredEntity) {
             if (options?.expectedVersion != null && this.config.versionColumn) {
@@ -1815,7 +1941,7 @@ class SqlBaseCrudService {
         if (!hooks.skipBefore)
             await this.beforeDelete(id);
         await this.emitEvent("before", "delete", false, { ids: [id], transaction }, options);
-        const db = transaction || this.config.db;
+        const db = this.dbFor(transaction);
         const deleteQuery = db
             .delete(this.config.table)
             .where(this.writeWhere([id], options));
@@ -1846,10 +1972,11 @@ class SqlBaseCrudService {
     async upsert(data, upsert = {}, options) {
         this.checkReadOptions(options);
         const entityData = await this.prepareCreate(data, options);
-        const db = options?.transaction || this.config.db;
+        const db = this.dbFor(options?.transaction);
         await this.emitEvent("before", "upsert", false, { input: data, transaction: options?.transaction }, options);
         let row;
         try {
+            await this.assertKeysInScope(db, entityData, options);
             [row] = await this.upsertRows(db, [entityData], upsert, options);
         }
         catch (error) {
@@ -1869,7 +1996,6 @@ class SqlBaseCrudService {
     }
     async massUpsert(data, upsert = {}, options) {
         this.checkReadOptions(options);
-        this.assertBatchSize(this.insertParameters(data));
         const message = "Mass upsert errors";
         return this.executeSqlTransaction(async (tx) => {
             const opts = { ...options, transaction: tx };
@@ -1880,6 +2006,7 @@ class SqlBaseCrudService {
             if (rows.length === 0)
                 return [];
             await this.emitEvent("before", "upsert", true, { input: data, transaction: tx }, options);
+            await this.assertBatchKeysInScope(tx, rows, rows.map((_, index) => ({ index })), message, opts);
             const written = await this.runSet(tx, message, (sp) => this.upsertRows(sp, rows, upsert, opts), rows.map((row, index) => ({
                 index,
                 run: (sp) => this.upsertRows(sp, [row], upsert, opts),
@@ -1969,7 +2096,7 @@ class SqlBaseCrudService {
         let statement;
         if (this.config.dialect === "mysql") {
             if (scope) {
-                throw new common_1.BadRequestException("upsert on a scoped entity needs PostgreSQL");
+                throw new common_1.BadRequestException("upsert on a scoped entity needs PostgreSQL or SQLite");
             }
             statement = insert.onDuplicateKeyUpdate({ set });
         }
@@ -2004,7 +2131,6 @@ class SqlBaseCrudService {
             return this.massCreatePerItem(data, options);
         }
         this.checkReadOptions(options);
-        this.assertBatchSize(this.insertParameters(data));
         return this.executeSqlTransaction(async (tx) => {
             const opts = { ...options, transaction: tx };
             const rows = await this.eachItem(data.map((item, index) => ({
@@ -2014,6 +2140,7 @@ class SqlBaseCrudService {
             if (rows.length === 0)
                 return [];
             await this.emitEvent("before", "create", true, { input: data, transaction: tx }, options);
+            await this.assertBatchKeysInScope(tx, rows, rows.map((_, index) => ({ index })), "Mass create errors", opts);
             const created = await this.runSet(tx, "Mass create errors", (sp) => this.insertMany(sp, rows, opts), rows.map((row, index) => ({
                 index,
                 run: (sp) => this.insertOne(sp, row, opts),
@@ -2063,7 +2190,6 @@ class SqlBaseCrudService {
         if (options?.bulkMode === "perItem") {
             return this.massUpdatePerItem(ids, data, options);
         }
-        this.assertBatchSize(Array.isArray(ids) ? ids.length : 0);
         this.checkReadOptions(options);
         const message = "Mass update errors";
         return this.executeSqlTransaction(async (tx) => {
@@ -2084,6 +2210,7 @@ class SqlBaseCrudService {
                 },
             })), message);
             await this.emitEvent("before", "update", true, { ids: unique, input: data, transaction: tx }, options);
+            await this.assertBatchKeysInScope(tx, sets, unique.map((id) => ({ id })), message, opts);
             const now = new Date();
             const stamp = (set) => this.withVersionBump(this.config.timestamps?.updatedAt
                 ? { ...set, [this.config.timestamps.updatedAt]: now }
@@ -2131,7 +2258,6 @@ class SqlBaseCrudService {
         if (options?.bulkMode === "perItem") {
             return this.massSoftDeletePerItem(ids, options);
         }
-        this.assertBatchSize(Array.isArray(ids) ? ids.length : 0);
         const message = "Mass soft delete errors";
         return this.executeSqlTransaction(async (tx) => {
             const opts = {
@@ -2175,7 +2301,6 @@ class SqlBaseCrudService {
         if (options?.bulkMode === "perItem") {
             return this.massRestorePerItem(ids, options);
         }
-        this.assertBatchSize(Array.isArray(ids) ? ids.length : 0);
         this.checkReadOptions(options);
         const message = "Mass restore errors";
         return this.executeSqlTransaction(async (tx) => {
@@ -2213,7 +2338,6 @@ class SqlBaseCrudService {
         if (options?.bulkMode === "perItem") {
             return this.massDeletePerItem(ids, options);
         }
-        this.assertBatchSize(Array.isArray(ids) ? ids.length : 0);
         const message = "Mass delete errors";
         return this.executeSqlTransaction(async (tx) => {
             const opts = { ...options, transaction: tx };
@@ -2326,6 +2450,8 @@ class SqlBaseCrudService {
             return await this.savepoint(tx, statement);
         }
         catch (error) {
+            if (error instanceof BindLimitException)
+                throw error;
             const failures = await this.diagnose(tx, items, operation);
             if (failures.length > 0) {
                 throw new crud_exceptions_1.BulkOperationException(message, failures);
@@ -2391,7 +2517,7 @@ class SqlBaseCrudService {
     }
     savepoint(tx, run) {
         return typeof tx?.transaction === "function"
-            ? tx.transaction(run)
+            ? tx.transaction((sp) => run(this.withBindLimit(sp)))
             : run(tx);
     }
     async exists(id, options) {
@@ -2403,14 +2529,14 @@ class SqlBaseCrudService {
     }
     async count(filters, options) {
         this.checkReadOptions(options);
-        const db = options?.transaction || this.config.db;
+        const db = this.dbFor(options?.transaction);
         const { conditions, relations: filterRelations } = this.listConditions(filters, db, options);
         const result = await this.runRead(this.buildCountQuery(db, conditions, filterRelations, options));
         return parseInt(result[0]?.count?.toString() || "0", 10);
     }
     async countBy(column, filters, options) {
         this.checkReadOptions(options);
-        const db = options?.transaction || this.config.db;
+        const db = this.dbFor(options?.transaction);
         const spec = this.resolveGroupColumn(column, options);
         const { conditions, relations: filterRelations } = this.listConditions(filters, db, options);
         const joins = Array.from(new Set([...filterRelations, ...(spec.relation ? [spec.relation] : [])]));
@@ -2494,6 +2620,8 @@ class SqlBaseCrudService {
             const filter = !Array.isArray(counts) && (0, merge_config_1.isPlainObject)(counts?.[name])
                 ? counts?.[name]
                 : undefined;
+            if (filter)
+                (0, query_parser_1.assertFilterDepth)(filter);
             return { name, relation, filter };
         });
         const hosts = rows.filter((row) => row && typeof row === "object");
@@ -2550,7 +2678,6 @@ class SqlBaseCrudService {
     }
     pushColumnCondition(conditions, column, value, caseInsensitive = this.config.sql?.caseSensitive === false) {
         if (Array.isArray(value)) {
-            this.assertBatchSize(value.length);
             conditions.push((0, drizzle_orm_1.inArray)(column, value.map((item) => this.coerceFilterValue(column, item))));
         }
         else if ((0, merge_config_1.isPlainObject)(value)) {
@@ -2799,7 +2926,6 @@ class SqlBaseCrudService {
         if (!Array.isArray(raw)) {
             throw new common_1.BadRequestException(`Filter operator "${op}" expects an array`);
         }
-        this.assertBatchSize(raw.length);
         return raw;
     }
     static MAX_BATCH_PARAMETERS = 60_000;
@@ -2837,9 +2963,19 @@ class SqlBaseCrudService {
             : kind === "endsWith"
                 ? `%${escaped}`
                 : `%${escaped}%`;
-        return insensitive || this.config.sql?.caseSensitive === false
-            ? this.caseInsensitiveLike(column, pattern)
-            : this.likePattern(column, pattern);
+        if (insensitive || this.config.sql?.caseSensitive === false) {
+            return this.caseInsensitiveLike(column, pattern);
+        }
+        if (this.config.dialect === "sqlite") {
+            const literal = raw.replace(/[*?[]/g, "[$&]");
+            const glob = kind === "startsWith"
+                ? `${literal}*`
+                : kind === "endsWith"
+                    ? `*${literal}`
+                    : `*${literal}*`;
+            return (0, drizzle_orm_1.sql) `${column} glob ${glob}`;
+        }
+        return this.likePattern(column, pattern);
     }
     applyComplexFilter(conditions, column, filterObj) {
         const coerce = (value) => this.coerceFilterValue(column, value);
@@ -2930,15 +3066,15 @@ class SqlBaseCrudService {
     }
     async executeSqlTransaction(operation, existingTransaction) {
         this.assertTransactions(existingTransaction ?? this.config.db);
+        const run = (tx) => operation(this.withBindLimit(tx));
         if (existingTransaction)
-            return operation(existingTransaction);
-        return this.config.db.transaction(operation);
+            return run(existingTransaction);
+        return this.config.db.transaction(run);
     }
     assertTransactions(db) {
         if (this.config.dialect !== "sqlite")
             return;
-        const kind = db?.constructor?.[drizzle_orm_1.entityKind];
-        if (kind === "D1Database" || kind === "D1Transaction") {
+        if (this.isD1(db)) {
             throw new crud_exceptions_1.TransactionException("Cloudflare D1 has no interactive transactions, so mass writes, nested writes and attach/detach/sync are not available on it. Use the single-row methods, or db.batch() yourself.");
         }
         if (db?.resultKind === "sync") {