@dbsp/nql 1.0.1 → 1.0.2

package/dist/index.d.ts

@@ -438,6 +438,8 @@ interface NqlCompilerOptions {
     readonly recursiveKeywords?: readonly string[];
     /** BATCH-001: Named parameters for ANY(:param) expressions */
     readonly params?: Readonly<Record<string, unknown>>;
+    /** Maximum number of items allowed in an ANY(:param) array. Defaults to MAX_ANY_ITEMS (10000). */
+    readonly maxAnyItems?: number;
 }
 
 /**

package/dist/index.js

@@ -787,6 +787,7 @@ function getISOWeekCount(year) {
 }
 
 // src/compiler/compile-expression.ts
+var MAX_ANY_ITEMS = 1e4;
 function compileLogical(expr, ctx, fns, aliasContext, outerAliases) {
   if (expr.type === "binary") {
     const binary = expr;
@@ -961,7 +962,19 @@ function compileMembership(expr, ctx, fns, aliasContext, outerAliases) {
     }
     validateWhereField(ctx, field2, aliasContext, anyExpr.column);
     const rawValues = ctx.params[anyExpr.paramName];
-    const values2 = Array.isArray(rawValues) ? rawValues : [];
+    if (!Array.isArray(rawValues)) {
+      throw new NqlSemanticException(
+        NqlErrorCodes.SEM_INVALID_SYNTAX,
+        `ANY(:${anyExpr.paramName}) requires an array argument but received ${rawValues === void 0 ? "undefined (parameter not bound)" : typeof rawValues}`
+      );
+    }
+    if (rawValues.length > ctx.maxAnyItems) {
+      throw new NqlSemanticException(
+        NqlErrorCodes.SEM_INVALID_SYNTAX,
+        `ANY(:${anyExpr.paramName}) array length ${rawValues.length} exceeds maximum of ${ctx.maxAnyItems}`
+      );
+    }
+    const values2 = rawValues;
     return { kind: "any", field: field2, values: values2 };
   }
   const inExpr = expr;
@@ -1900,13 +1913,22 @@ var NqlCompiler = class {
     const recursive = options?.recursiveKeywords ?? DEFAULT_RECURSIVE_KEYWORDS;
     const recursiveKeywords = new Set(recursive.map((k) => k.toLowerCase()));
     const validator = schema ? new ColumnValidator(schema) : null;
+    const maxAnyItemsRaw = options?.maxAnyItems;
+    if (maxAnyItemsRaw !== void 0) {
+      if (!Number.isSafeInteger(maxAnyItemsRaw) || maxAnyItemsRaw <= 0) {
+        throw new Error(
+          `Invalid maxAnyItems: ${maxAnyItemsRaw}. Must be a positive integer.`
+        );
+      }
+    }
     this.ctx = {
       currentFromTable: void 0,
       currentRelationTarget: void 0,
       pseudoColumnKeywords,
       recursiveKeywords,
       validator,
-      params: options?.params ?? {}
+      params: options?.params ?? {},
+      maxAnyItems: maxAnyItemsRaw ?? MAX_ANY_ITEMS
     };
     this.fns = {
       compileQuery: (query, ctx) => compileQuery(query, ctx, this.fns),