@geodedb/client 1.0.0-alpha.21 → 1.0.0-alpha.25

package/dist/index.js

@@ -17,6 +17,30 @@ var __export = (target, all) => {
 };
 
 // src/errors.ts
+function ErrClosed() {
+  return new Error(ERR_CLOSED_MESSAGE);
+}
+function ErrQueryInProgress() {
+  return new Error(ERR_QUERY_IN_PROGRESS_MESSAGE);
+}
+function ErrTxInProgress() {
+  return new Error(ERR_TX_IN_PROGRESS_MESSAGE);
+}
+function ErrNoTx() {
+  return new Error(ERR_NO_TX_MESSAGE);
+}
+function ErrTxDone() {
+  return new Error(ERR_TX_DONE_MESSAGE);
+}
+function ErrRowsClosed() {
+  return new Error(ERR_ROWS_CLOSED_MESSAGE);
+}
+function ErrBadConn() {
+  return new Error(ERR_BAD_CONN_MESSAGE);
+}
+function isSentinelError(err, message) {
+  return err instanceof Error && err.message === message;
+}
 function isDriverError(err) {
   return err instanceof DriverError;
 }
@@ -29,7 +53,7 @@ function isRetryableError(err) {
   }
   return false;
 }
-var StatusClass, DriverError, TransportError, SENSITIVE_CONFIG_FIELDS, ConfigError, SecurityError, StateError, ErrClosed, ErrQueryInProgress, ErrTxInProgress, ErrNoTx, ErrTxDone, ErrRowsClosed, ErrBadConn;
+var StatusClass, DriverError, TransportError, SENSITIVE_CONFIG_FIELDS, ConfigError, SecurityError, StateError, ERR_CLOSED_MESSAGE, ERR_QUERY_IN_PROGRESS_MESSAGE, ERR_TX_IN_PROGRESS_MESSAGE, ERR_NO_TX_MESSAGE, ERR_TX_DONE_MESSAGE, ERR_ROWS_CLOSED_MESSAGE, ERR_BAD_CONN_MESSAGE;
 var init_errors = __esm({
   "src/errors.ts"() {
     StatusClass = {
@@ -145,13 +169,13 @@ var init_errors = __esm({
         return false;
       }
     };
-    ErrClosed = new Error("geode: connection closed");
-    ErrQueryInProgress = new Error("geode: query already in progress");
-    ErrTxInProgress = new Error("geode: transaction already in progress");
-    ErrNoTx = new Error("geode: no transaction in progress");
-    ErrTxDone = new Error("geode: transaction already committed or rolled back");
-    ErrRowsClosed = new Error("geode: rows closed");
-    ErrBadConn = new Error("geode: bad connection");
+    ERR_CLOSED_MESSAGE = "geode: connection closed";
+    ERR_QUERY_IN_PROGRESS_MESSAGE = "geode: query already in progress";
+    ERR_TX_IN_PROGRESS_MESSAGE = "geode: transaction already in progress";
+    ERR_NO_TX_MESSAGE = "geode: no transaction in progress";
+    ERR_TX_DONE_MESSAGE = "geode: transaction already committed or rolled back";
+    ERR_ROWS_CLOSED_MESSAGE = "geode: rows closed";
+    ERR_BAD_CONN_MESSAGE = "geode: bad connection";
   }
 });
 
@@ -537,6 +561,108 @@ var init_config = __esm({
     SUPPORTED_SCHEMES = ["quic", "grpc"];
   }
 });
+function checkAgainstBlocklist(normalizedPath, fieldName) {
+  const lowerPath = normalizedPath.toLowerCase();
+  for (const sensitive of SENSITIVE_PATHS) {
+    if (lowerPath.includes(sensitive)) {
+      throw new SecurityError({
+        type: "input",
+        message: `${fieldName} path refers to a restricted system file`
+      });
+    }
+  }
+}
+function validateTLSCertPathSync(path2, fieldName) {
+  if (!path2) {
+    throw new SecurityError({
+      type: "input",
+      message: `${fieldName} path cannot be empty`
+    });
+  }
+  if (path2.includes("\0")) {
+    throw new SecurityError({
+      type: "input",
+      message: `${fieldName} path contains null bytes`
+    });
+  }
+  const normalizedPath = path2.replace(/\\/g, "/").replace(/\/+/g, "/");
+  if (normalizedPath.includes("/../") || normalizedPath.endsWith("/..")) {
+    throw new SecurityError({
+      type: "input",
+      message: `${fieldName} path contains directory traversal sequence`
+    });
+  }
+  if (normalizedPath.startsWith("../") || normalizedPath === "..") {
+    throw new SecurityError({
+      type: "input",
+      message: `${fieldName} path contains directory traversal sequence`
+    });
+  }
+  if (/%2e%2e/i.test(path2) || /%252e/i.test(path2)) {
+    throw new SecurityError({
+      type: "input",
+      message: `${fieldName} path contains encoded traversal sequence`
+    });
+  }
+  checkAgainstBlocklist(normalizedPath, fieldName);
+}
+async function validateTLSCertPath(path2, fieldName) {
+  validateTLSCertPathSync(path2, fieldName);
+  try {
+    await fs.promises.access(path2);
+    const stats = await fs.promises.lstat(path2);
+    if (stats.isSymbolicLink()) {
+      const resolvedPath = await fs.promises.realpath(path2);
+      const normalizedResolved = resolvedPath.replace(/\\/g, "/").replace(/\/+/g, "/");
+      checkAgainstBlocklist(normalizedResolved, fieldName);
+      if (normalizedResolved.includes("/../") || normalizedResolved.endsWith("/..")) {
+        throw new SecurityError({
+          type: "input",
+          message: `${fieldName} symlink resolves to a path with directory traversal`
+        });
+      }
+    }
+  } catch (e) {
+    if (e instanceof SecurityError) {
+      throw e;
+    }
+  }
+}
+var SENSITIVE_PATHS;
+var init_validate_tls = __esm({
+  "src/validate-tls.ts"() {
+    init_errors();
+    SENSITIVE_PATHS = [
+      // System files
+      "/etc/passwd",
+      "/etc/shadow",
+      "/etc/hosts",
+      "/proc/",
+      "/sys/",
+      "/dev/",
+      // Root home directory
+      "/root/",
+      // SSH keys
+      "/.ssh/",
+      // Kubernetes secrets
+      "/var/run/secrets/",
+      "/run/secrets/",
+      // AWS credentials
+      "/.aws/",
+      "/credentials",
+      // GCP credentials
+      "/.config/gcloud/",
+      "/gcloud/",
+      // Azure credentials
+      "/.azure/",
+      // Environment files
+      "/.env",
+      "/env"
+    ];
+  }
+});
+
+// src/validate.ts
 function validateQuery(query2) {
   if (!query2) {
     throw new SecurityError({
@@ -814,6 +940,9 @@ function validateRLSAction(action) {
 function validateRoleName(name) {
   validateIdentifier(name, "variable", false);
 }
+function validateUsername(username) {
+  validateIdentifier(username, "variable", false);
+}
 function escapeGQLIdentifier(identifier, type) {
   validateIdentifier(identifier, type, false);
   if (GQL_IDENTIFIER_PATTERN.test(identifier)) {
@@ -902,76 +1031,12 @@ function validateRLSPredicate(predicate2) {
     });
   }
 }
-function checkAgainstBlocklist(normalizedPath, fieldName) {
-  const lowerPath = normalizedPath.toLowerCase();
-  for (const sensitive of SENSITIVE_PATHS) {
-    if (lowerPath.includes(sensitive)) {
-      throw new SecurityError({
-        type: "input",
-        message: `${fieldName} path refers to a restricted system file`
-      });
-    }
-  }
-}
-function validateTLSCertPath(path2, fieldName) {
-  if (!path2) {
-    throw new SecurityError({
-      type: "input",
-      message: `${fieldName} path cannot be empty`
-    });
-  }
-  if (path2.includes("\0")) {
-    throw new SecurityError({
-      type: "input",
-      message: `${fieldName} path contains null bytes`
-    });
-  }
-  const normalizedPath = path2.replace(/\\/g, "/").replace(/\/+/g, "/");
-  if (normalizedPath.includes("/../") || normalizedPath.endsWith("/..")) {
-    throw new SecurityError({
-      type: "input",
-      message: `${fieldName} path contains directory traversal sequence`
-    });
-  }
-  if (normalizedPath.startsWith("../") || normalizedPath === "..") {
-    throw new SecurityError({
-      type: "input",
-      message: `${fieldName} path contains directory traversal sequence`
-    });
-  }
-  if (/%2e%2e/i.test(path2) || /%252e/i.test(path2)) {
-    throw new SecurityError({
-      type: "input",
-      message: `${fieldName} path contains encoded traversal sequence`
-    });
-  }
-  checkAgainstBlocklist(normalizedPath, fieldName);
-  try {
-    if (fs.existsSync(path2)) {
-      const stats = fs.lstatSync(path2);
-      if (stats.isSymbolicLink()) {
-        const resolvedPath = fs.realpathSync(path2);
-        const normalizedResolved = resolvedPath.replace(/\\/g, "/").replace(/\/+/g, "/");
-        checkAgainstBlocklist(normalizedResolved, fieldName);
-        if (normalizedResolved.includes("/../") || normalizedResolved.endsWith("/..")) {
-          throw new SecurityError({
-            type: "input",
-            message: `${fieldName} symlink resolves to a path with directory traversal`
-          });
-        }
-      }
-    }
-  } catch (e) {
-    if (e instanceof SecurityError) {
-      throw e;
-    }
-  }
-}
-var PARAM_NAME_PATTERN, GQL_IDENTIFIER_PATTERN, MAX_IDENTIFIER_LENGTH, ALLOWED_PERMISSION_ACTIONS, ALLOWED_PERMISSION_RESOURCES, ALLOWED_RLS_ACTIONS, RESERVED_KEYWORDS, RLS_PREDICATE_DANGEROUS_PATTERNS, SENSITIVE_PATHS;
+var PARAM_NAME_PATTERN, GQL_IDENTIFIER_PATTERN, MAX_IDENTIFIER_LENGTH, ALLOWED_PERMISSION_ACTIONS, ALLOWED_PERMISSION_RESOURCES, ALLOWED_RLS_ACTIONS, RESERVED_KEYWORDS, RLS_PREDICATE_DANGEROUS_PATTERNS;
 var init_validate = __esm({
   "src/validate.ts"() {
     init_errors();
     init_config();
+    init_validate_tls();
     PARAM_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]{0,127}$/;
     GQL_IDENTIFIER_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]{0,127}$/;
     MAX_IDENTIFIER_LENGTH = 128;
@@ -1075,97 +1140,687 @@ var init_validate = __esm({
       // Multiple statements
       /\}\s*\{/
     ];
-    SENSITIVE_PATHS = [
-      // System files
-      "/etc/passwd",
-      "/etc/shadow",
-      "/etc/hosts",
-      "/proc/",
-      "/sys/",
-      "/dev/",
-      // Root home directory
-      "/root/",
-      // SSH keys
-      "/.ssh/",
-      // Kubernetes secrets
-      "/var/run/secrets/",
-      "/run/secrets/",
-      // AWS credentials
-      "/.aws/",
-      "/credentials",
-      // GCP credentials
-      "/.config/gcloud/",
-      "/gcloud/",
-      // Azure credentials
-      "/.azure/",
-      // Environment files
-      "/.env",
-      "/env"
-    ];
   }
 });
-async function initProto() {
-  if (protoRoot) return;
-  protoRoot = await protobuf.load(PROTO_PATH);
-  QuicClientMessageType = protoRoot.lookupType("geode.QuicClientMessage");
-  QuicServerMessageType = protoRoot.lookupType("geode.QuicServerMessage");
+
+// src/gql-value.ts
+function isSafeObjectKey(key) {
+  return !DANGEROUS_KEYS.has(key);
 }
-function initProtoSync() {
-  if (protoRoot) return;
-  protoRoot = protobuf.loadSync(PROTO_PATH);
-  QuicClientMessageType = protoRoot.lookupType("geode.QuicClientMessage");
-  QuicServerMessageType = protoRoot.lookupType("geode.QuicServerMessage");
+function isDecimal(value) {
+  return value !== null && typeof value === "object" && "toFixed" in value && "toNumber" in value;
 }
-async function ensureProtoInitialized() {
-  if (!protoRoot) {
-    await initProto();
-  }
+function createDecimal(value) {
+  if (isDecimal(value)) return value;
+  return new DecimalClass(value);
 }
-function jsToProtoValue(value) {
-  if (value === null || value === void 0) {
-    return { nullVal: {} };
-  }
-  if (typeof value === "boolean") {
-    return { boolVal: value };
-  }
-  if (typeof value === "number") {
-    if (Number.isInteger(value)) {
-      return { intVal: { value, kind: 1 } };
-    }
-    return { doubleVal: { value, kind: 1 } };
-  }
-  if (typeof value === "bigint") {
-    return { intVal: { value, kind: 3 } };
-  }
-  if (typeof value === "string") {
-    return { stringVal: { value, kind: 1 } };
-  }
-  if (Array.isArray(value)) {
-    return {
-      listVal: {
-        values: value.map(jsToProtoValue)
+var DANGEROUS_KEYS, DecimalClass, GQLValue;
+var init_gql_value = __esm({
+  async "src/gql-value.ts"() {
+    DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
+    DecimalClass = // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Module type is incompatible
+    (await import('decimal.js-light')).default;
+    GQLValue = class _GQLValue {
+      kind;
+      _intValue;
+      _floatValue;
+      _boolValue;
+      _stringValue;
+      _decimalValue;
+      _arrayValue;
+      _objectValue;
+      _bytesValue;
+      _dateValue;
+      _rangeValue;
+      _nodeValue;
+      _edgeValue;
+      _pathValue;
+      _rawValue;
+      constructor(kind) {
+        this.kind = kind;
       }
-    };
-  }
-  if (value instanceof Uint8Array || Buffer.isBuffer(value)) {
-    return { bytesVal: { value, kind: 1 } };
-  }
-  if (typeof value === "object") {
-    const entries = [];
-    for (const [k, v] of Object.entries(value)) {
-      entries.push({ key: k, value: jsToProtoValue(v) });
-    }
-    return { mapVal: { entries } };
-  }
-  return { stringVal: { value: String(value), kind: 1 } };
-}
-function protoValueToJS(val) {
-  if (val.nullVal !== void 0) return null;
-  if (val.boolVal !== void 0) return val.boolVal;
-  if (val.intVal !== void 0) {
-    const n = val.intVal.value;
-    if (typeof n === "bigint") {
-      if (n >= BigInt(Number.MIN_SAFE_INTEGER) && n <= BigInt(Number.MAX_SAFE_INTEGER)) {
+      // Factory methods
+      static null() {
+        return new _GQLValue("NULL");
+      }
+      static bool(value) {
+        const v = new _GQLValue("BOOL");
+        v._boolValue = value;
+        return v;
+      }
+      static int(value) {
+        const v = new _GQLValue("INT");
+        v._intValue = typeof value === "bigint" ? value : BigInt(Math.trunc(value));
+        return v;
+      }
+      static float(value) {
+        const v = new _GQLValue("FLOAT");
+        v._floatValue = value;
+        return v;
+      }
+      static string(value) {
+        const v = new _GQLValue("STRING");
+        v._stringValue = value;
+        return v;
+      }
+      static decimal(value) {
+        const v = new _GQLValue("DECIMAL");
+        v._decimalValue = createDecimal(value);
+        return v;
+      }
+      static array(values) {
+        const v = new _GQLValue("ARRAY");
+        v._arrayValue = values;
+        return v;
+      }
+      static object(values) {
+        const v = new _GQLValue("OBJECT");
+        v._objectValue = values instanceof Map ? values : new Map(Object.entries(values));
+        return v;
+      }
+      static bytes(value) {
+        const v = new _GQLValue("BYTEA");
+        v._bytesValue = value instanceof Uint8Array ? value : new Uint8Array(value);
+        return v;
+      }
+      static date(value) {
+        const v = new _GQLValue("DATE");
+        v._dateValue = value;
+        return v;
+      }
+      static time(value) {
+        const v = new _GQLValue("TIME");
+        v._dateValue = value;
+        return v;
+      }
+      static timestamp(value) {
+        const v = new _GQLValue("TIMESTAMP");
+        v._dateValue = value;
+        return v;
+      }
+      static uuid(value) {
+        const v = new _GQLValue("UUID");
+        v._stringValue = value;
+        return v;
+      }
+      static json(value) {
+        const v = new _GQLValue("JSON");
+        v._rawValue = value;
+        return v;
+      }
+      static node(value) {
+        const v = new _GQLValue("NODE");
+        v._nodeValue = value;
+        return v;
+      }
+      static edge(value) {
+        const v = new _GQLValue("EDGE");
+        v._edgeValue = value;
+        return v;
+      }
+      static path(value) {
+        const v = new _GQLValue("PATH");
+        v._pathValue = value;
+        return v;
+      }
+      static range(value) {
+        const v = new _GQLValue("RANGE");
+        v._rangeValue = value;
+        return v;
+      }
+      static unknown(value) {
+        const v = new _GQLValue("UNKNOWN");
+        v._rawValue = value;
+        return v;
+      }
+      // Type-safe accessors
+      get isNull() {
+        return this.kind === "NULL";
+      }
+      get asBool() {
+        if (this.kind !== "BOOL") {
+          throw new TypeError(`Cannot convert ${this.kind} to boolean`);
+        }
+        return this._boolValue;
+      }
+      get asInt() {
+        if (this.kind !== "INT") {
+          throw new TypeError(`Cannot convert ${this.kind} to int`);
+        }
+        return this._intValue;
+      }
+      get asNumber() {
+        if (this.kind === "INT") {
+          return Number(this._intValue);
+        }
+        if (this.kind === "FLOAT") {
+          return this._floatValue;
+        }
+        if (this.kind === "DECIMAL") {
+          return this._decimalValue?.toNumber() ?? 0;
+        }
+        throw new TypeError(`Cannot convert ${this.kind} to number`);
+      }
+      get asFloat() {
+        if (this.kind !== "FLOAT") {
+          throw new TypeError(`Cannot convert ${this.kind} to float`);
+        }
+        return this._floatValue;
+      }
+      get asString() {
+        if (this.kind === "STRING" || this.kind === "UUID") {
+          return this._stringValue;
+        }
+        return this.toString();
+      }
+      get asDecimal() {
+        if (this.kind !== "DECIMAL") {
+          throw new TypeError(`Cannot convert ${this.kind} to decimal`);
+        }
+        return this._decimalValue;
+      }
+      get asArray() {
+        if (this.kind !== "ARRAY") {
+          throw new TypeError(`Cannot convert ${this.kind} to array`);
+        }
+        return this._arrayValue;
+      }
+      get asObject() {
+        if (this.kind !== "OBJECT" && this.kind !== "NODE" && this.kind !== "EDGE") {
+          throw new TypeError(`Cannot convert ${this.kind} to object`);
+        }
+        return this._objectValue ?? /* @__PURE__ */ new Map();
+      }
+      get asBytes() {
+        if (this.kind !== "BYTEA") {
+          throw new TypeError(`Cannot convert ${this.kind} to bytes`);
+        }
+        return this._bytesValue;
+      }
+      get asDate() {
+        if (this.kind !== "DATE" && this.kind !== "TIME" && this.kind !== "TIMETZ" && this.kind !== "TIMESTAMP" && this.kind !== "TIMESTAMPTZ") {
+          throw new TypeError(`Cannot convert ${this.kind} to date`);
+        }
+        return this._dateValue;
+      }
+      get asNode() {
+        if (this.kind !== "NODE") {
+          throw new TypeError(`Cannot convert ${this.kind} to node`);
+        }
+        return this._nodeValue;
+      }
+      get asEdge() {
+        if (this.kind !== "EDGE") {
+          throw new TypeError(`Cannot convert ${this.kind} to edge`);
+        }
+        return this._edgeValue;
+      }
+      get asPath() {
+        if (this.kind !== "PATH") {
+          throw new TypeError(`Cannot convert ${this.kind} to path`);
+        }
+        return this._pathValue;
+      }
+      get asRange() {
+        if (this.kind !== "RANGE") {
+          throw new TypeError(`Cannot convert ${this.kind} to range`);
+        }
+        return this._rangeValue;
+      }
+      get asJSON() {
+        if (this.kind !== "JSON" && this.kind !== "JSONB") {
+          throw new TypeError(`Cannot convert ${this.kind} to JSON`);
+        }
+        return this._rawValue;
+      }
+      get raw() {
+        return this._rawValue;
+      }
+      toString() {
+        switch (this.kind) {
+          case "NULL":
+            return "null";
+          case "BOOL":
+            return (this._boolValue ?? false).toString();
+          case "INT":
+            return (this._intValue ?? 0n).toString();
+          case "FLOAT":
+            return (this._floatValue ?? 0).toString();
+          case "STRING":
+          case "UUID":
+            return this._stringValue ?? "";
+          case "DECIMAL":
+            return this._decimalValue?.toString() ?? "0";
+          case "ARRAY":
+            return `[${(this._arrayValue ?? []).map((v) => v.toString()).join(", ")}]`;
+          case "OBJECT":
+            return `{${[...(this._objectValue ?? /* @__PURE__ */ new Map()).entries()].map(([k, v]) => `${k}: ${v.toString()}`).join(", ")}}`;
+          case "BYTEA":
+            return `<bytes:${(this._bytesValue ?? new Uint8Array()).length}>`;
+          case "DATE":
+          case "TIME":
+          case "TIMETZ":
+          case "TIMESTAMP":
+          case "TIMESTAMPTZ":
+            return this._dateValue?.toISOString() ?? "";
+          case "NODE":
+            return `(${this._nodeValue?.labels.join(":")} {${JSON.stringify(this._nodeValue?.properties)}})`;
+          case "EDGE":
+            return `[${this._edgeValue?.type} {${JSON.stringify(this._edgeValue?.properties)}}]`;
+          case "PATH":
+            return `<path:${this._pathValue?.nodes.length} nodes>`;
+          case "JSON":
+          case "JSONB":
+            return JSON.stringify(this._rawValue);
+          default:
+            return String(this._rawValue ?? "");
+        }
+      }
+      /**
+       * Convert to a plain JavaScript value.
+       */
+      toJS() {
+        switch (this.kind) {
+          case "NULL":
+            return null;
+          case "BOOL":
+            return this._boolValue ?? false;
+          case "INT": {
+            const intVal = this._intValue ?? 0n;
+            if (intVal >= Number.MIN_SAFE_INTEGER && intVal <= Number.MAX_SAFE_INTEGER) {
+              return Number(intVal);
+            }
+            return intVal;
+          }
+          case "FLOAT":
+            return this._floatValue ?? 0;
+          case "STRING":
+          case "UUID":
+            return this._stringValue ?? "";
+          case "DECIMAL":
+            return this._decimalValue?.toString();
+          case "ARRAY":
+            return (this._arrayValue ?? []).map((v) => v.toJS());
+          case "OBJECT": {
+            const obj = /* @__PURE__ */ Object.create(null);
+            for (const [k, v] of (this._objectValue ?? /* @__PURE__ */ new Map()).entries()) {
+              if (!isSafeObjectKey(k)) {
+                throw new Error(
+                  `Object contains dangerous key that could cause prototype pollution: keys like '__proto__', 'constructor', or 'prototype' are not allowed`
+                );
+              }
+              obj[k] = v.toJS();
+            }
+            return obj;
+          }
+          case "BYTEA":
+            return this._bytesValue ?? new Uint8Array();
+          case "DATE":
+          case "TIME":
+          case "TIMETZ":
+          case "TIMESTAMP":
+          case "TIMESTAMPTZ":
+            return this._dateValue;
+          case "NODE":
+            return this._nodeValue;
+          case "EDGE":
+            return this._edgeValue;
+          case "PATH":
+            return this._pathValue;
+          case "RANGE":
+            return this._rangeValue;
+          case "JSON":
+          case "JSONB":
+            return this._rawValue;
+          default:
+            return this._rawValue;
+        }
+      }
+      /**
+       * Convert to JSON-serializable format.
+       */
+      toJSON() {
+        return this.toJS();
+      }
+    };
+  }
+});
+
+// src/types.ts
+function parseGQLType(typeStr) {
+  const upper = typeStr.toUpperCase();
+  switch (upper) {
+    case "INT":
+    case "INTEGER":
+    case "BIGINT":
+    case "INT8":
+    case "INT16":
+    case "INT32":
+    case "INT64":
+    case "UINT8":
+    case "UINT16":
+    case "UINT32":
+    case "UINT64":
+    case "SMALLINT":
+    case "TINYINT":
+      return "INT";
+    case "FLOAT":
+    case "DOUBLE":
+    case "REAL":
+    case "FLOAT32":
+    case "FLOAT64":
+      return "FLOAT";
+    case "DECIMAL":
+    case "NUMERIC":
+      return "DECIMAL";
+    case "STRING":
+    case "VARCHAR":
+    case "TEXT":
+      return "STRING";
+    case "BOOL":
+    case "BOOLEAN":
+      return "BOOL";
+    case "NULL":
+      return "NULL";
+    case "LIST":
+    case "ARRAY":
+      return "ARRAY";
+    case "MAP":
+    case "RECORD":
+    case "OBJECT":
+      return "OBJECT";
+    case "NODE":
+      return "NODE";
+    case "EDGE":
+    case "RELATIONSHIP":
+      return "EDGE";
+    case "PATH":
+      return "PATH";
+    case "BYTEA":
+    case "BINARY":
+      return "BYTEA";
+    case "DATE":
+      return "DATE";
+    case "TIME":
+      return "TIME";
+    case "TIMETZ":
+    case "TIME WITH TIME ZONE":
+      return "TIMETZ";
+    case "TIMESTAMP":
+      return "TIMESTAMP";
+    case "TIMESTAMPTZ":
+    case "TIMESTAMP WITH TIME ZONE":
+      return "TIMESTAMPTZ";
+    case "INTERVAL":
+      return "INTERVAL";
+    case "JSON":
+      return "JSON";
+    case "JSONB":
+      return "JSONB";
+    case "XML":
+      return "XML";
+    case "UUID":
+      return "UUID";
+    case "URL":
+      return "URL";
+    case "DOMAIN":
+      return "DOMAIN";
+    case "ENUM":
+      return "ENUM";
+    case "BIT":
+    case "VARBIT":
+      return "BIT_STRING";
+    default:
+      if (upper.includes("RANGE")) {
+        return "RANGE";
+      }
+      return "UNKNOWN";
+  }
+}
+function fromJSON(value, typeHint) {
+  if (value === null || value === void 0) {
+    return GQLValue.null();
+  }
+  if (typeHint) {
+    return convertWithType(value, typeHint);
+  }
+  if (typeof value === "boolean") {
+    return GQLValue.bool(value);
+  }
+  if (typeof value === "number") {
+    if (Number.isInteger(value)) {
+      return GQLValue.int(value);
+    }
+    return GQLValue.float(value);
+  }
+  if (typeof value === "bigint") {
+    return GQLValue.int(value);
+  }
+  if (typeof value === "string") {
+    return GQLValue.string(value);
+  }
+  if (Array.isArray(value)) {
+    return GQLValue.array(value.map((v) => fromJSON(v)));
+  }
+  if (typeof value === "object") {
+    const obj = value;
+    if ("id" in obj && "labels" in obj && "properties" in obj) {
+      return GQLValue.node(obj);
+    }
+    if ("id" in obj && "type" in obj) {
+      const hasStartEnd = "startNode" in obj && "endNode" in obj;
+      const hasFromTo = "from" in obj && "to" in obj;
+      if (hasStartEnd || hasFromTo) {
+        const rawEdge = obj;
+        const normalizedEdge = {
+          id: rawEdge.id,
+          type: rawEdge.type,
+          startNode: rawEdge.startNode ?? rawEdge.from ?? "",
+          endNode: rawEdge.endNode ?? rawEdge.to ?? "",
+          properties: rawEdge.properties ?? {}
+        };
+        return GQLValue.edge(normalizedEdge);
+      }
+    }
+    if ("nodes" in obj && "edges" in obj && Array.isArray(obj.nodes)) {
+      return GQLValue.path(obj);
+    }
+    const map = /* @__PURE__ */ new Map();
+    for (const [k, v] of Object.entries(obj)) {
+      map.set(k, fromJSON(v));
+    }
+    return GQLValue.object(map);
+  }
+  return GQLValue.unknown(value);
+}
+function convertWithType(value, type) {
+  switch (type) {
+    case "NULL":
+      return GQLValue.null();
+    case "BOOL":
+      if (typeof value === "string") {
+        const lower = value.toLowerCase();
+        return GQLValue.bool(lower === "true" || lower === "1" || lower === "t");
+      }
+      return GQLValue.bool(Boolean(value));
+    case "INT":
+      if (typeof value === "number") {
+        return GQLValue.int(value);
+      }
+      if (typeof value === "bigint") {
+        return GQLValue.int(value);
+      }
+      if (typeof value === "string") {
+        const trimmed = value.trim();
+        if (trimmed === "" || isNaN(Number(trimmed))) {
+          return GQLValue.int(0);
+        }
+        return GQLValue.int(BigInt(trimmed));
+      }
+      return GQLValue.int(0);
+    case "FLOAT":
+      return GQLValue.float(Number(value));
+    case "DECIMAL":
+      return GQLValue.decimal(String(value));
+    case "STRING":
+      if (typeof value !== "string") {
+        return fromJSON(value);
+      }
+      return GQLValue.string(value);
+    case "UUID":
+      return GQLValue.uuid(String(value));
+    case "BYTEA":
+      if (value instanceof Uint8Array) {
+        return GQLValue.bytes(value);
+      }
+      if (typeof value === "string") {
+        return GQLValue.bytes(Buffer.from(value, "base64"));
+      }
+      return GQLValue.bytes(new Uint8Array());
+    case "DATE":
+      return GQLValue.date(value instanceof Date ? value : new Date(String(value)));
+    case "TIME":
+    case "TIMETZ":
+      return GQLValue.time(value instanceof Date ? value : new Date(String(value)));
+    case "TIMESTAMP":
+    case "TIMESTAMPTZ":
+      return GQLValue.timestamp(value instanceof Date ? value : new Date(String(value)));
+    case "JSON":
+    case "JSONB":
+      return GQLValue.json(value);
+    case "ARRAY":
+      if (Array.isArray(value)) {
+        return GQLValue.array(value.map((v) => fromJSON(v)));
+      }
+      if (typeof value === "string") {
+        try {
+          const parsed = JSON.parse(value);
+          if (Array.isArray(parsed)) {
+            return GQLValue.array(parsed.map((v) => fromJSON(v)));
+          }
+        } catch {
+        }
+      }
+      return GQLValue.array([]);
+    case "OBJECT":
+      if (typeof value === "string") {
+        try {
+          const parsed = JSON.parse(value);
+          if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
+            return fromJSON(parsed);
+          }
+        } catch {
+        }
+      }
+      return fromJSON(value);
+    case "NODE":
+      return GQLValue.node(value);
+    case "EDGE": {
+      const rawEdge = value;
+      const normalizedEdge = {
+        id: rawEdge.id,
+        type: rawEdge.type,
+        startNode: rawEdge.startNode ?? rawEdge.from ?? "",
+        endNode: rawEdge.endNode ?? rawEdge.to ?? "",
+        properties: rawEdge.properties ?? {}
+      };
+      return GQLValue.edge(normalizedEdge);
+    }
+    case "PATH":
+      return GQLValue.path(value);
+    default:
+      return fromJSON(value);
+  }
+}
+function parseRow(raw, columns) {
+  const row = /* @__PURE__ */ new Map();
+  for (const col of columns) {
+    const value = raw[col.name];
+    row.set(col.name, fromJSON(value, col.kind));
+  }
+  return row;
+}
+function rowToObject(row) {
+  const obj = /* @__PURE__ */ Object.create(null);
+  for (const [key, value] of row) {
+    if (!isSafeObjectKey(key)) {
+      throw new Error(
+        `Row contains dangerous key that could cause prototype pollution: column names like '__proto__', 'constructor', or 'prototype' are not allowed`
+      );
+    }
+    obj[key] = value.toJS();
+  }
+  return obj;
+}
+var init_types = __esm({
+  async "src/types.ts"() {
+    await init_gql_value();
+    await init_gql_value();
+    await init_gql_value();
+  }
+});
+async function initProto() {
+  if (protoRoot) return;
+  protoRoot = await protobuf.load(PROTO_PATH);
+  QuicClientMessageType = protoRoot.lookupType("geode.QuicClientMessage");
+  QuicServerMessageType = protoRoot.lookupType("geode.QuicServerMessage");
+}
+function initProtoSync() {
+  if (protoRoot) return;
+  protoRoot = protobuf.loadSync(PROTO_PATH);
+  QuicClientMessageType = protoRoot.lookupType("geode.QuicClientMessage");
+  QuicServerMessageType = protoRoot.lookupType("geode.QuicServerMessage");
+}
+async function ensureProtoInitialized() {
+  if (!protoRoot) {
+    await initProto();
+  }
+}
+function jsToProtoValue(value) {
+  if (value === null || value === void 0) {
+    return { nullVal: {} };
+  }
+  if (typeof value === "boolean") {
+    return { boolVal: value };
+  }
+  if (typeof value === "number") {
+    if (Number.isInteger(value)) {
+      return { intVal: { value, kind: 1 } };
+    }
+    return { doubleVal: { value, kind: 1 } };
+  }
+  if (typeof value === "bigint") {
+    return { intVal: { value, kind: 3 } };
+  }
+  if (typeof value === "string") {
+    return { stringVal: { value, kind: 1 } };
+  }
+  if (Array.isArray(value)) {
+    return {
+      listVal: {
+        values: value.map(jsToProtoValue)
+      }
+    };
+  }
+  if (value instanceof Uint8Array || Buffer.isBuffer(value)) {
+    return { bytesVal: { value, kind: 1 } };
+  }
+  if (typeof value === "object") {
+    const entries = [];
+    for (const [k, v] of Object.entries(value)) {
+      entries.push({ key: k, value: jsToProtoValue(v) });
+    }
+    return { mapVal: { entries } };
+  }
+  return { stringVal: { value: String(value), kind: 1 } };
+}
+function protoValueToJS(val) {
+  if (val.nullVal !== void 0) return null;
+  if (val.boolVal !== void 0) return val.boolVal;
+  if (val.intVal !== void 0) {
+    const n = val.intVal.value;
+    if (typeof n === "bigint") {
+      if (n >= BigInt(Number.MIN_SAFE_INTEGER) && n <= BigInt(Number.MAX_SAFE_INTEGER)) {
         return Number(n);
       }
       return n;
@@ -1182,16 +1837,26 @@ function protoValueToJS(val) {
     return val.listVal.values.map(protoValueToJS);
   }
   if (val.mapVal !== void 0) {
-    const obj = {};
+    const obj = /* @__PURE__ */ Object.create(null);
     for (const entry of val.mapVal.entries) {
+      if (!isSafeObjectKey(entry.key)) {
+        throw new Error(
+          `Map contains dangerous key that could cause prototype pollution: keys like '__proto__', 'constructor', or 'prototype' are not allowed`
+        );
+      }
       obj[entry.key] = protoValueToJS(entry.value);
     }
     return obj;
   }
   if (val.nodeVal !== void 0) {
     const node2 = val.nodeVal;
-    const props = {};
+    const props = /* @__PURE__ */ Object.create(null);
     for (const entry of node2.properties) {
+      if (!isSafeObjectKey(entry.key)) {
+        throw new Error(
+          `Node property contains dangerous key that could cause prototype pollution: keys like '__proto__', 'constructor', or 'prototype' are not allowed`
+        );
+      }
       props[entry.key] = protoValueToJS(entry.value);
     }
     return {
@@ -1202,8 +1867,13 @@ function protoValueToJS(val) {
   }
   if (val.edgeVal !== void 0) {
     const edge2 = val.edgeVal;
-    const props = {};
+    const props = /* @__PURE__ */ Object.create(null);
     for (const entry of edge2.properties) {
+      if (!isSafeObjectKey(entry.key)) {
+        throw new Error(
+          `Edge property contains dangerous key that could cause prototype pollution: keys like '__proto__', 'constructor', or 'prototype' are not allowed`
+        );
+      }
       props[entry.key] = protoValueToJS(entry.value);
     }
     return {
@@ -1349,10 +2019,15 @@ function buildRollbackToRequest(name, sessionId) {
   };
 }
 function rowToRecord(row, columns) {
-  const record = {};
+  const record = /* @__PURE__ */ Object.create(null);
   for (let i = 0; i < columns.length && i < row.values.length; i++) {
     const col = columns[i];
     const val = row.values[i];
+    if (!isSafeObjectKey(col.name)) {
+      throw new Error(
+        `Row contains dangerous column name that could cause prototype pollution: column names like '__proto__', 'constructor', or 'prototype' are not allowed`
+      );
+    }
     record[col.name] = protoValueToJS(val);
   }
   return record;
@@ -1362,14 +2037,14 @@ function getProtoPath() {
 }
 var __filename$1, __dirname$1, PROTO_PATH, protoRoot, QuicClientMessageType, QuicServerMessageType;
 var init_proto = __esm({
-  "src/proto.ts"() {
+  async "src/proto.ts"() {
+    await init_types();
     __filename$1 = fileURLToPath(import.meta.url);
     __dirname$1 = path.dirname(__filename$1);
     PROTO_PATH = path.resolve(__dirname$1, "..", "proto", "geode.proto");
     protoRoot = null;
     QuicClientMessageType = null;
     QuicServerMessageType = null;
-    initProtoSync();
   }
 });
 
@@ -1379,36 +2054,31 @@ __export(grpc_transport_exports, {
   GrpcTransport: () => GrpcTransport
 });
 async function buildGrpcSslOptions(cfg) {
-  let rootCerts = null;
-  let privateKey = null;
-  let certChain = null;
-  if (cfg.tlsCACert) {
-    rootCerts = Buffer.from(cfg.tlsCACert);
-  } else if (cfg.tlsCA) {
-    validateTLSCertPath(cfg.tlsCA, "tlsCA");
-    rootCerts = await fs.promises.readFile(cfg.tlsCA);
-  }
-  if (cfg.tlsCertPEM) {
-    certChain = Buffer.from(cfg.tlsCertPEM);
-  } else if (cfg.tlsCert) {
-    validateTLSCertPath(cfg.tlsCert, "tlsCert");
-    certChain = await fs.promises.readFile(cfg.tlsCert);
-  }
-  if (cfg.tlsKeyPEM) {
-    privateKey = Buffer.from(cfg.tlsKeyPEM);
-  } else if (cfg.tlsKey) {
-    validateTLSCertPath(cfg.tlsKey, "tlsKey");
-    privateKey = await fs.promises.readFile(cfg.tlsKey);
-  }
-  return { rootCerts, privateKey, certChain };
+  const tlsConfig = await buildTLSConfig(cfg);
+  const toBuffer = (value) => {
+    if (value === void 0 || value === null) return null;
+    if (Buffer.isBuffer(value)) return value;
+    if (typeof value === "string") return Buffer.from(value);
+    if (Array.isArray(value)) {
+      return Buffer.concat(
+        value.map((v) => Buffer.isBuffer(v) ? v : Buffer.from(String(v)))
+      );
+    }
+    return null;
+  };
+  return {
+    rootCerts: toBuffer(tlsConfig.ca),
+    privateKey: toBuffer(tlsConfig.key),
+    certChain: toBuffer(tlsConfig.cert)
+  };
 }
-var PROTO_PATH2, PROTO_LOADER_OPTIONS, GrpcTransport;
+var PROTO_PATH2, PROTO_LOADER_OPTIONS, DEFAULT_BACKPRESSURE_THRESHOLD, DEFAULT_STREAM_TIMEOUT_MS, GrpcTransport;
 var init_grpc_transport = __esm({
-  "src/grpc-transport.ts"() {
+  async "src/grpc-transport.ts"() {
     init_config();
     init_errors();
-    init_validate();
-    init_proto();
+    await init_proto();
+    await init_transport();
     PROTO_PATH2 = getProtoPath();
     PROTO_LOADER_OPTIONS = {
       keepCase: false,
@@ -1417,12 +2087,20 @@ var init_grpc_transport = __esm({
       defaults: true,
       oneofs: true
     };
+    DEFAULT_BACKPRESSURE_THRESHOLD = 2;
+    DEFAULT_STREAM_TIMEOUT_MS = 12e4;
     GrpcTransport = class _GrpcTransport {
       _client = null;
       _closed = false;
       _address;
       _pendingResponses = [];
+      _pendingProtoReads = [];
       _activeStream = null;
+      _streamPaused = false;
+      _backpressureThreshold = DEFAULT_BACKPRESSURE_THRESHOLD;
+      _streamTimeoutMs = DEFAULT_STREAM_TIMEOUT_MS;
+      _streamTimeoutTimer = null;
+      _streamComplete = false;
       constructor(address) {
         this._address = address;
       }
@@ -1432,6 +2110,9 @@ var init_grpc_transport = __esm({
       static async connect(cfg) {
         const address = getAddress(cfg);
         const transport = new _GrpcTransport(address);
+        if (cfg.requestTimeout !== void 0) {
+          transport._streamTimeoutMs = cfg.requestTimeout;
+        }
         try {
           const packageDefinition = await protoLoader.load(PROTO_PATH2, PROTO_LOADER_OPTIONS);
           const protoDescriptor = grpc.loadPackageDefinition(packageDefinition);
@@ -1439,9 +2120,23 @@ var init_grpc_transport = __esm({
           if (cfg.tls === false) {
             credentials2 = grpc.credentials.createInsecure();
           } else if (cfg.insecureSkipVerify) {
+            const isProduction = process.env["NODE_ENV"] === "production" || process.env["GEODE_ENV"] === "production";
+            if (isProduction) {
+              console.warn(
+                "SECURITY WARNING: insecureSkipVerify is enabled in production environment. This disables TLS certificate verification and exposes the connection to MITM attacks. Set GEODE_ALLOW_INSECURE_PRODUCTION=true to override this warning."
+              );
+              if (process.env["GEODE_ALLOW_INSECURE_PRODUCTION"] !== "true") {
+                throw new TransportError({
+                  operation: "connect",
+                  cause: new Error(
+                    "insecureSkipVerify is not allowed in production. Configure proper TLS certificates or set GEODE_ALLOW_INSECURE_PRODUCTION=true to override."
+                  )
+                });
+              }
+            }
             let rootCerts = null;
             if (cfg.tlsCA) {
-              rootCerts = await import('fs').then((fs4) => fs4.promises.readFile(cfg.tlsCA));
+              rootCerts = await import('fs').then((fs3) => fs3.promises.readFile(cfg.tlsCA));
             } else if (cfg.tlsCACert) {
               rootCerts = Buffer.from(cfg.tlsCACert);
             }
@@ -1457,9 +2152,9 @@ var init_grpc_transport = __esm({
             );
           }
           const options = {
-            "grpc.max_receive_message_length": 100 * 1024 * 1024,
-            // 100MB
-            "grpc.max_send_message_length": 100 * 1024 * 1024,
+            "grpc.max_receive_message_length": 16 * 1024 * 1024,
+            // 16 MiB (matches QUIC transport)
+            "grpc.max_send_message_length": 16 * 1024 * 1024,
             "grpc.keepalive_time_ms": cfg.keepAliveInterval ?? 1e4,
             "grpc.keepalive_timeout_ms": 5e3,
             "grpc.keepalive_permit_without_calls": 1
@@ -1490,45 +2185,55 @@ var init_grpc_transport = __esm({
         try {
           if (msg.hello) {
             const response = await this.callUnary("handshake", msg.hello, signal);
-            this._pendingResponses.push({ hello: response });
+            this.enqueueResponse({ hello: response });
           } else if (msg.execute) {
             await this.callServerStream(msg.execute, signal);
           } else if (msg.pull) {
-            if (this._pendingResponses.length === 0) {
-              this._pendingResponses.push({
-                execute: {
-                  status: {
-                    statusClass: "00000",
-                    statusSubclass: "",
-                    additionalStatuses: [],
-                    flaggerFindings: []
-                  },
-                  payload: "page",
-                  page: { rows: [], final: true, ordered: false, orderKeys: [] }
-                }
-              });
+            if (this._pendingResponses.length === 0 && this._pendingProtoReads.length === 0) {
+              if (this._activeStream && this._streamPaused) {
+                this._streamPaused = false;
+                this._activeStream.resume();
+              }
+              if (this._streamComplete || !this._activeStream) {
+                this.enqueueResponse({
+                  execute: {
+                    status: {
+                      statusClass: "00000",
+                      statusSubclass: "",
+                      additionalStatuses: [],
+                      flaggerFindings: []
+                    },
+                    payload: "page",
+                    page: { rows: [], final: true, ordered: false, orderKeys: [] }
+                  }
+                });
+              }
             }
           } else if (msg.ping) {
             const response = await this.callUnary("ping", msg.ping, signal);
-            this._pendingResponses.push({ ping: response });
+            this.enqueueResponse({ ping: response });
           } else if (msg.begin) {
             const response = await this.callUnary("begin", msg.begin, signal);
-            this._pendingResponses.push({ begin: response });
+            this.enqueueResponse({ begin: response });
           } else if (msg.commit) {
             const response = await this.callUnary("commit", msg.commit, signal);
-            this._pendingResponses.push({ commit: response });
+            this.enqueueResponse({ commit: response });
           } else if (msg.rollback) {
             const response = await this.callUnary("rollback", msg.rollback, signal);
-            this._pendingResponses.push({ rollback: response });
+            this.enqueueResponse({ rollback: response });
           } else if (msg.savepoint) {
-            throw new TransportError({
-              operation: "sendProto",
-              cause: new Error("Savepoint is not supported over gRPC transport")
+            throw new DriverError({
+              statusClass: StatusClass.SYSTEM,
+              subclass: "",
+              code: "58000",
+              message: "Savepoint operations are not supported over gRPC transport. Use QUIC transport (quic://) for savepoint support."
             });
           } else if (msg.rollbackTo) {
-            throw new TransportError({
-              operation: "sendProto",
-              cause: new Error("RollbackTo is not supported over gRPC transport")
+            throw new DriverError({
+              statusClass: StatusClass.SYSTEM,
+              subclass: "",
+              code: "58000",
+              message: "Savepoint operations are not supported over gRPC transport. Use QUIC transport (quic://) for savepoint support."
             });
           } else {
             throw new TransportError({
@@ -1537,7 +2242,7 @@ var init_grpc_transport = __esm({
             });
           }
         } catch (e) {
-          if (e instanceof TransportError) throw e;
+          if (e instanceof TransportError || e instanceof DriverError) throw e;
           throw new TransportError({
             operation: "sendProto",
             address: this._address,
@@ -1547,8 +2252,8 @@ var init_grpc_transport = __esm({
       }
       /**
        * Receive a protobuf message from the queue.
+       * If no response is buffered, waits for the next streamed message.
        */
-      // eslint-disable-next-line @typescript-eslint/require-await -- Method must be async for interface compatibility
       async receiveProto(signal) {
         this.checkClosed();
         if (signal?.aborted) {
@@ -1556,33 +2261,37 @@ var init_grpc_transport = __esm({
         }
         const response = this._pendingResponses.shift();
         if (response) {
+          if (this._activeStream && this._streamPaused && this._pendingResponses.length < this._backpressureThreshold) {
+            this._streamPaused = false;
+            this._activeStream.resume();
+          }
           return response;
         }
+        if (this._activeStream && !this._streamComplete) {
+          return new Promise((resolve2, reject) => {
+            const pendingRead = { resolve: resolve2, reject };
+            this._pendingProtoReads.push(pendingRead);
+            if (this._activeStream && this._streamPaused) {
+              this._streamPaused = false;
+              this._activeStream.resume();
+            }
+            if (signal) {
+              const onAbort = () => {
+                const idx = this._pendingProtoReads.indexOf(pendingRead);
+                if (idx !== -1) {
+                  this._pendingProtoReads.splice(idx, 1);
+                }
+                reject(new TransportError({ operation: "receiveProto", cause: new Error("Aborted") }));
+              };
+              signal.addEventListener("abort", onAbort, { once: true });
+            }
+          });
+        }
         throw new TransportError({
           operation: "receiveProto",
           cause: new Error("No response available")
         });
       }
-      /**
-       * Legacy JSON send (not supported for gRPC).
-       */
-      // eslint-disable-next-line @typescript-eslint/require-await
-      async send(_msg, _signal) {
-        throw new TransportError({
-          operation: "send",
-          cause: new Error("JSON mode not supported for gRPC transport")
-        });
-      }
-      /**
-       * Legacy JSON receive (not supported for gRPC).
-       */
-      // eslint-disable-next-line @typescript-eslint/require-await
-      async receive(_signal) {
-        throw new TransportError({
-          operation: "receive",
-          cause: new Error("JSON mode not supported for gRPC transport")
-        });
-      }
       /**
        * Close the transport.
        */
@@ -1590,10 +2299,16 @@ var init_grpc_transport = __esm({
       async close() {
         if (this._closed) return;
         this._closed = true;
+        this.clearStreamTimeout();
         if (this._activeStream) {
           this._activeStream.cancel();
           this._activeStream = null;
         }
+        const pendingReads = this._pendingProtoReads;
+        this._pendingProtoReads = [];
+        for (const p of pendingReads) {
+          p.reject(ErrClosed());
+        }
         if (this._client) {
           this._client.close();
           this._client = null;
@@ -1611,6 +2326,17 @@ var init_grpc_transport = __esm({
       getAddress() {
         return this._address;
       }
+      /**
+       * Enqueue a response, resolving a pending read if one exists.
+       */
+      enqueueResponse(response) {
+        const pending = this._pendingProtoReads.shift();
+        if (pending) {
+          pending.resolve(response);
+        } else {
+          this._pendingResponses.push(response);
+        }
+      }
       /**
        * Make a unary RPC call.
        */
@@ -1649,660 +2375,597 @@ var init_grpc_transport = __esm({
       }
       /**
        * Call the server-streaming Execute RPC.
-       * Collects all streamed ExecutionResponse messages into _pendingResponses.
+       * Uses backpressure to prevent unbounded buffering: pauses the stream when
+       * the pending response buffer exceeds the threshold, resumes when drained.
+       * Enforces a configurable timeout that fires when no data arrives within the period.
        */
       callServerStream(request, signal) {
         return new Promise((resolve2, reject) => {
           if (!this._client) {
             reject(new Error("No client"));
             return;
-          }
-          if (this._activeStream) {
-            this._activeStream.cancel();
-            this._activeStream = null;
-          }
-          const stream = this._client.execute(request);
-          this._activeStream = stream;
-          stream.on("data", (response) => {
-            this._pendingResponses.push({ execute: response });
-          });
-          stream.on("end", () => {
-            this._activeStream = null;
-            resolve2();
-          });
-          stream.on("error", (error) => {
-            this._activeStream = null;
-            reject(
-              new TransportError({
-                operation: "execute",
-                address: this._address,
-                cause: new Error(`gRPC error ${error.code}: ${error.message}`)
-              })
-            );
-          });
-          if (signal) {
-            const onAbort = () => {
-              stream.cancel();
-              reject(new TransportError({ operation: "execute", cause: new Error("Aborted") }));
-            };
-            signal.addEventListener("abort", onAbort, { once: true });
-          }
-        });
-      }
-      /**
-       * Check if closed and throw if so.
-       */
-      checkClosed() {
-        if (this._closed) {
-          throw ErrClosed;
-        }
-      }
-    };
-  }
-});
-
-// src/types.ts
-function isDecimal(value) {
-  return value !== null && typeof value === "object" && "toFixed" in value && "toNumber" in value;
-}
-function createDecimal(value) {
-  if (isDecimal(value)) return value;
-  return new DecimalClass(value);
-}
-function parseGQLType(typeStr) {
-  const upper = typeStr.toUpperCase();
-  switch (upper) {
-    case "INT":
-    case "INTEGER":
-    case "BIGINT":
-    case "INT8":
-    case "INT16":
-    case "INT32":
-    case "INT64":
-    case "UINT8":
-    case "UINT16":
-    case "UINT32":
-    case "UINT64":
-    case "SMALLINT":
-    case "TINYINT":
-      return "INT";
-    case "FLOAT":
-    case "DOUBLE":
-    case "REAL":
-    case "FLOAT32":
-    case "FLOAT64":
-      return "FLOAT";
-    case "DECIMAL":
-    case "NUMERIC":
-      return "DECIMAL";
-    case "STRING":
-    case "VARCHAR":
-    case "TEXT":
-      return "STRING";
-    case "BOOL":
-    case "BOOLEAN":
-      return "BOOL";
-    case "NULL":
-      return "NULL";
-    case "LIST":
-    case "ARRAY":
-      return "ARRAY";
-    case "MAP":
-    case "RECORD":
-    case "OBJECT":
-      return "OBJECT";
-    case "NODE":
-      return "NODE";
-    case "EDGE":
-    case "RELATIONSHIP":
-      return "EDGE";
-    case "PATH":
-      return "PATH";
-    case "BYTEA":
-    case "BINARY":
-      return "BYTEA";
-    case "DATE":
-      return "DATE";
-    case "TIME":
-      return "TIME";
-    case "TIMETZ":
-    case "TIME WITH TIME ZONE":
-      return "TIMETZ";
-    case "TIMESTAMP":
-      return "TIMESTAMP";
-    case "TIMESTAMPTZ":
-    case "TIMESTAMP WITH TIME ZONE":
-      return "TIMESTAMPTZ";
-    case "INTERVAL":
-      return "INTERVAL";
-    case "JSON":
-      return "JSON";
-    case "JSONB":
-      return "JSONB";
-    case "XML":
-      return "XML";
-    case "UUID":
-      return "UUID";
-    case "URL":
-      return "URL";
-    case "DOMAIN":
-      return "DOMAIN";
-    case "ENUM":
-      return "ENUM";
-    case "BIT":
-    case "VARBIT":
-      return "BIT_STRING";
-    default:
-      if (upper.includes("RANGE")) {
-        return "RANGE";
-      }
-      return "UNKNOWN";
-  }
-}
-function fromJSON(value, typeHint) {
-  if (value === null || value === void 0) {
-    return GQLValue.null();
-  }
-  if (typeHint) {
-    return convertWithType(value, typeHint);
-  }
-  if (typeof value === "boolean") {
-    return GQLValue.bool(value);
-  }
-  if (typeof value === "number") {
-    if (Number.isInteger(value)) {
-      return GQLValue.int(value);
-    }
-    return GQLValue.float(value);
-  }
-  if (typeof value === "bigint") {
-    return GQLValue.int(value);
-  }
-  if (typeof value === "string") {
-    if (/^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i.test(value)) {
-      return GQLValue.uuid(value);
-    }
-    if (/^\d{4}-\d{2}-\d{2}(T\d{2}:\d{2}:\d{2})?/.test(value)) {
-      const date = new Date(value);
-      if (!isNaN(date.getTime())) {
-        return GQLValue.timestamp(date);
-      }
-    }
-    return GQLValue.string(value);
-  }
-  if (Array.isArray(value)) {
-    return GQLValue.array(value.map((v) => fromJSON(v)));
-  }
-  if (typeof value === "object") {
-    const obj = value;
-    if ("id" in obj && "labels" in obj && "properties" in obj) {
-      return GQLValue.node(obj);
-    }
-    if ("id" in obj && "type" in obj) {
-      const hasStartEnd = "startNode" in obj && "endNode" in obj;
-      const hasFromTo = "from" in obj && "to" in obj;
-      if (hasStartEnd || hasFromTo) {
-        const rawEdge = obj;
-        const normalizedEdge = {
-          id: rawEdge.id,
-          type: rawEdge.type,
-          startNode: rawEdge.startNode ?? rawEdge.from ?? "",
-          endNode: rawEdge.endNode ?? rawEdge.to ?? "",
-          properties: rawEdge.properties ?? {}
-        };
-        return GQLValue.edge(normalizedEdge);
-      }
-    }
-    if ("nodes" in obj && "edges" in obj && Array.isArray(obj.nodes)) {
-      return GQLValue.path(obj);
-    }
-    const map = /* @__PURE__ */ new Map();
-    for (const [k, v] of Object.entries(obj)) {
-      map.set(k, fromJSON(v));
-    }
-    return GQLValue.object(map);
-  }
-  return GQLValue.unknown(value);
-}
-function convertWithType(value, type) {
-  switch (type) {
-    case "NULL":
-      return GQLValue.null();
-    case "BOOL":
-      if (typeof value === "string") {
-        const lower = value.toLowerCase();
-        return GQLValue.bool(lower === "true" || lower === "1" || lower === "t");
-      }
-      return GQLValue.bool(Boolean(value));
-    case "INT":
-      if (typeof value === "number") {
-        return GQLValue.int(value);
-      }
-      if (typeof value === "bigint") {
-        return GQLValue.int(value);
-      }
-      if (typeof value === "string") {
-        const trimmed = value.trim();
-        if (trimmed === "" || isNaN(Number(trimmed))) {
-          return GQLValue.int(0);
-        }
-        return GQLValue.int(BigInt(trimmed));
-      }
-      return GQLValue.int(0);
-    case "FLOAT":
-      return GQLValue.float(Number(value));
-    case "DECIMAL":
-      return GQLValue.decimal(String(value));
-    case "STRING":
-      if (typeof value !== "string") {
-        return fromJSON(value);
-      }
-      return GQLValue.string(value);
-    case "UUID":
-      return GQLValue.uuid(String(value));
-    case "BYTEA":
-      if (value instanceof Uint8Array) {
-        return GQLValue.bytes(value);
-      }
-      if (typeof value === "string") {
-        return GQLValue.bytes(Buffer.from(value, "base64"));
-      }
-      return GQLValue.bytes(new Uint8Array());
-    case "DATE":
-      return GQLValue.date(value instanceof Date ? value : new Date(String(value)));
-    case "TIME":
-    case "TIMETZ":
-      return GQLValue.time(value instanceof Date ? value : new Date(String(value)));
-    case "TIMESTAMP":
-    case "TIMESTAMPTZ":
-      return GQLValue.timestamp(value instanceof Date ? value : new Date(String(value)));
-    case "JSON":
-    case "JSONB":
-      return GQLValue.json(value);
-    case "ARRAY":
-      if (Array.isArray(value)) {
-        return GQLValue.array(value.map((v) => fromJSON(v)));
+          }
+          if (this._activeStream) {
+            this._activeStream.cancel();
+            this._activeStream = null;
+          }
+          this._streamComplete = false;
+          this._streamPaused = false;
+          let resolved = false;
+          const stream = this._client.execute(request);
+          this._activeStream = stream;
+          this.resetStreamTimeout(stream, reject, () => {
+            resolved = true;
+          });
+          stream.on("data", (response) => {
+            this.resetStreamTimeout(stream, reject, () => {
+              resolved = true;
+            });
+            this.enqueueResponse({ execute: response });
+            if (this._pendingResponses.length >= this._backpressureThreshold) {
+              this._streamPaused = true;
+              stream.pause();
+            }
+            if (!resolved) {
+              resolved = true;
+              resolve2();
+            }
+          });
+          stream.on("end", () => {
+            this.clearStreamTimeout();
+            this._activeStream = null;
+            this._streamComplete = true;
+            if (!resolved) {
+              resolved = true;
+              resolve2();
+            }
+          });
+          stream.on("error", (error) => {
+            this.clearStreamTimeout();
+            this._activeStream = null;
+            this._streamComplete = true;
+            const transportError = new TransportError({
+              operation: "execute",
+              address: this._address,
+              cause: new Error(`gRPC error ${error.code}: ${error.message}`)
+            });
+            const pendingReads = this._pendingProtoReads;
+            this._pendingProtoReads = [];
+            for (const p of pendingReads) {
+              p.reject(transportError);
+            }
+            if (!resolved) {
+              resolved = true;
+              reject(transportError);
+            }
+          });
+          if (signal) {
+            const onAbort = () => {
+              this.clearStreamTimeout();
+              stream.cancel();
+              if (!resolved) {
+                resolved = true;
+                reject(new TransportError({ operation: "execute", cause: new Error("Aborted") }));
+              }
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+          }
+        });
       }
-      if (typeof value === "string") {
-        try {
-          const parsed = JSON.parse(value);
-          if (Array.isArray(parsed)) {
-            return GQLValue.array(parsed.map((v) => fromJSON(v)));
+      /**
+       * Reset the stream inactivity timeout. If no data arrives within
+       * _streamTimeoutMs, the stream is cancelled and the promise rejected.
+       */
+      resetStreamTimeout(stream, reject, markResolved) {
+        this.clearStreamTimeout();
+        if (this._streamTimeoutMs <= 0) return;
+        this._streamTimeoutTimer = setTimeout(() => {
+          this._streamTimeoutTimer = null;
+          this._activeStream = null;
+          this._streamComplete = true;
+          stream.cancel();
+          const timeoutError = new TransportError({
+            operation: "execute",
+            address: this._address,
+            cause: new Error(
+              `gRPC stream timed out: no data received within ${this._streamTimeoutMs}ms`
+            )
+          });
+          const pendingReads = this._pendingProtoReads;
+          this._pendingProtoReads = [];
+          for (const p of pendingReads) {
+            p.reject(timeoutError);
           }
-        } catch {
+          markResolved();
+          reject(timeoutError);
+        }, this._streamTimeoutMs);
+      }
+      /**
+       * Clear any active stream inactivity timeout.
+       */
+      clearStreamTimeout() {
+        if (this._streamTimeoutTimer !== null) {
+          clearTimeout(this._streamTimeoutTimer);
+          this._streamTimeoutTimer = null;
         }
       }
-      return GQLValue.array([]);
-    case "OBJECT":
-      if (typeof value === "string") {
-        try {
-          const parsed = JSON.parse(value);
-          if (typeof parsed === "object" && parsed !== null && !Array.isArray(parsed)) {
-            return fromJSON(parsed);
-          }
-        } catch {
+      /**
+       * Check if closed and throw if so.
+       */
+      checkClosed() {
+        if (this._closed) {
+          throw ErrClosed();
         }
       }
-      return fromJSON(value);
-    case "NODE":
-      return GQLValue.node(value);
-    case "EDGE": {
-      const rawEdge = value;
-      const normalizedEdge = {
-        id: rawEdge.id,
-        type: rawEdge.type,
-        startNode: rawEdge.startNode ?? rawEdge.from ?? "",
-        endNode: rawEdge.endNode ?? rawEdge.to ?? "",
-        properties: rawEdge.properties ?? {}
-      };
-      return GQLValue.edge(normalizedEdge);
+    };
+  }
+});
+async function buildTLSConfig(cfg) {
+  const options = {
+    minVersion: "TLSv1.3",
+    maxVersion: "TLSv1.3"
+  };
+  if (cfg.tlsCACert) {
+    options.ca = cfg.tlsCACert;
+  } else if (cfg.tlsCA) {
+    await validateTLSCertPath(cfg.tlsCA, "tlsCA");
+    try {
+      options.ca = await fs.promises.readFile(cfg.tlsCA, "utf-8");
+    } catch (e) {
+      throw new TransportError({
+        operation: "load_ca_cert",
+        cause: e instanceof Error ? e : new Error(String(e))
+      });
     }
-    case "PATH":
-      return GQLValue.path(value);
-    default:
-      return fromJSON(value);
   }
-}
-function parseRow(raw, columns) {
-  const row = /* @__PURE__ */ new Map();
-  for (const col of columns) {
-    const value = raw[col.name];
-    row.set(col.name, fromJSON(value, col.kind));
+  if (cfg.tlsCertPEM) {
+    options.cert = cfg.tlsCertPEM;
+  } else if (cfg.tlsCert) {
+    await validateTLSCertPath(cfg.tlsCert, "tlsCert");
+    try {
+      options.cert = await fs.promises.readFile(cfg.tlsCert, "utf-8");
+    } catch (e) {
+      throw new TransportError({
+        operation: "load_client_cert",
+        cause: e instanceof Error ? e : new Error(String(e))
+      });
+    }
   }
-  return row;
-}
-function isSafeObjectKey(key) {
-  return !DANGEROUS_KEYS.has(key);
-}
-function rowToObject(row) {
-  const obj = /* @__PURE__ */ Object.create(null);
-  for (const [key, value] of row) {
-    if (!isSafeObjectKey(key)) {
-      throw new Error(
-        `Row contains dangerous key that could cause prototype pollution: column names like '__proto__', 'constructor', or 'prototype' are not allowed`
-      );
+  if (cfg.tlsKeyPEM) {
+    options.key = cfg.tlsKeyPEM;
+  } else if (cfg.tlsKey) {
+    await validateTLSCertPath(cfg.tlsKey, "tlsKey");
+    try {
+      options.key = await fs.promises.readFile(cfg.tlsKey, "utf-8");
+    } catch (e) {
+      throw new TransportError({
+        operation: "load_client_key",
+        cause: e instanceof Error ? e : new Error(String(e))
+      });
     }
-    obj[key] = value.toJS();
   }
-  return obj;
+  return options;
 }
-var DecimalClass, GQLValue, DANGEROUS_KEYS;
-var init_types = __esm({
-  async "src/types.ts"() {
-    DecimalClass = // eslint-disable-next-line @typescript-eslint/no-explicit-any -- Module type is incompatible
-    (await import('decimal.js-light')).default;
-    GQLValue = class _GQLValue {
-      kind;
-      _intValue = 0n;
-      _floatValue = 0;
-      _boolValue = false;
-      _stringValue = "";
-      _decimalValue;
-      _arrayValue = [];
-      _objectValue = /* @__PURE__ */ new Map();
-      _bytesValue = new Uint8Array();
-      _dateValue;
-      _rangeValue;
-      _nodeValue;
-      _edgeValue;
-      _pathValue;
-      _rawValue;
-      constructor(kind) {
-        this.kind = kind;
-      }
-      // Factory methods
-      static null() {
-        return new _GQLValue("NULL");
-      }
-      static bool(value) {
-        const v = new _GQLValue("BOOL");
-        v._boolValue = value;
-        return v;
-      }
-      static int(value) {
-        const v = new _GQLValue("INT");
-        v._intValue = typeof value === "bigint" ? value : BigInt(Math.trunc(value));
-        return v;
-      }
-      static float(value) {
-        const v = new _GQLValue("FLOAT");
-        v._floatValue = value;
-        return v;
-      }
-      static string(value) {
-        const v = new _GQLValue("STRING");
-        v._stringValue = value;
-        return v;
-      }
-      static decimal(value) {
-        const v = new _GQLValue("DECIMAL");
-        v._decimalValue = createDecimal(value);
-        return v;
-      }
-      static array(values) {
-        const v = new _GQLValue("ARRAY");
-        v._arrayValue = values;
-        return v;
-      }
-      static object(values) {
-        const v = new _GQLValue("OBJECT");
-        v._objectValue = values instanceof Map ? values : new Map(Object.entries(values));
-        return v;
-      }
-      static bytes(value) {
-        const v = new _GQLValue("BYTEA");
-        v._bytesValue = value instanceof Uint8Array ? value : new Uint8Array(value);
-        return v;
-      }
-      static date(value) {
-        const v = new _GQLValue("DATE");
-        v._dateValue = value;
-        return v;
-      }
-      static time(value) {
-        const v = new _GQLValue("TIME");
-        v._dateValue = value;
-        return v;
-      }
-      static timestamp(value) {
-        const v = new _GQLValue("TIMESTAMP");
-        v._dateValue = value;
-        return v;
-      }
-      static uuid(value) {
-        const v = new _GQLValue("UUID");
-        v._stringValue = value;
-        return v;
-      }
-      static json(value) {
-        const v = new _GQLValue("JSON");
-        v._rawValue = value;
-        return v;
-      }
-      static node(value) {
-        const v = new _GQLValue("NODE");
-        v._nodeValue = value;
-        return v;
-      }
-      static edge(value) {
-        const v = new _GQLValue("EDGE");
-        v._edgeValue = value;
-        return v;
-      }
-      static path(value) {
-        const v = new _GQLValue("PATH");
-        v._pathValue = value;
-        return v;
-      }
-      static range(value) {
-        const v = new _GQLValue("RANGE");
-        v._rangeValue = value;
-        return v;
-      }
-      static unknown(value) {
-        const v = new _GQLValue("UNKNOWN");
-        v._rawValue = value;
-        return v;
+async function createTransport(cfg) {
+  if (cfg.transport === "grpc") {
+    const { GrpcTransport: GrpcTransport2 } = await init_grpc_transport().then(() => grpc_transport_exports);
+    return GrpcTransport2.connect(cfg);
+  }
+  return QuicTransport.connect(cfg);
+}
+var GEODE_ALPN, DEFAULT_MAX_MESSAGE_SIZE, DEFAULT_MAX_BUFFER_BYTES, BaseTransport, QuicTransport, MockTransport;
+var init_transport = __esm({
+  async "src/transport.ts"() {
+    init_config();
+    init_errors();
+    init_validate();
+    await init_proto();
+    GEODE_ALPN = ["geode/1"];
+    DEFAULT_MAX_MESSAGE_SIZE = 16 * 1024 * 1024;
+    DEFAULT_MAX_BUFFER_BYTES = 64 * 1024 * 1024;
+    BaseTransport = class {
+      _closed = false;
+      _address;
+      constructor(address) {
+        this._address = address;
       }
-      // Type-safe accessors
-      get isNull() {
-        return this.kind === "NULL";
+      isClosed() {
+        return this._closed;
       }
-      get asBool() {
-        if (this.kind !== "BOOL") {
-          throw new TypeError(`Cannot convert ${this.kind} to boolean`);
-        }
-        return this._boolValue;
+      getAddress() {
+        return this._address;
       }
-      get asInt() {
-        if (this.kind !== "INT") {
-          throw new TypeError(`Cannot convert ${this.kind} to int`);
+      checkClosed() {
+        if (this._closed) {
+          throw ErrClosed();
         }
-        return this._intValue;
       }
-      get asNumber() {
-        if (this.kind === "INT") {
-          return Number(this._intValue);
-        }
-        if (this.kind === "FLOAT") {
-          return this._floatValue;
-        }
-        if (this.kind === "DECIMAL") {
-          return this._decimalValue?.toNumber() ?? 0;
-        }
-        throw new TypeError(`Cannot convert ${this.kind} to number`);
+    };
+    QuicTransport = class _QuicTransport extends BaseTransport {
+      _client = null;
+      _stream = null;
+      _chunks = [];
+      _totalLength = 0;
+      _maxMessageSize;
+      _maxBufferBytes;
+      _pendingProtoReads = [];
+      constructor(address, maxMessageSize = DEFAULT_MAX_MESSAGE_SIZE, maxBufferBytes = DEFAULT_MAX_BUFFER_BYTES) {
+        super(address);
+        this._maxMessageSize = maxMessageSize;
+        this._maxBufferBytes = maxBufferBytes;
       }
-      get asFloat() {
-        if (this.kind !== "FLOAT") {
-          throw new TypeError(`Cannot convert ${this.kind} to float`);
+      /**
+       * Connect to the Geode server using QUIC.
+       */
+      static async connect(cfg) {
+        const address = getAddress(cfg);
+        const transport = new _QuicTransport(address);
+        try {
+          const { QUICClient } = await import('@matrixai/quic');
+          const [host = "localhost", portStr] = address.includes("[") ? [address.slice(1, address.lastIndexOf("]")), address.slice(address.lastIndexOf(":") + 1)] : address.split(":");
+          const port = parseInt(portStr ?? "3141", 10);
+          const cryptoOps = {
+            ops: {
+              randomBytes: (data) => {
+                const buf = Buffer.from(data);
+                crypto.randomFillSync(buf);
+                return Promise.resolve();
+              }
+            }
+          };
+          const tlsConfig = await buildTLSConfig(cfg);
+          const config = {
+            applicationProtos: GEODE_ALPN,
+            maxIdleTimeout: cfg.maxIdleTime ?? 3e4,
+            initialMaxData: 1e7,
+            initialMaxStreamDataBidiLocal: 1e6,
+            initialMaxStreamDataBidiRemote: 1e6,
+            initialMaxStreamsBidi: 100
+          };
+          if (cfg.insecureSkipVerify) {
+            const isProduction = process.env["NODE_ENV"] === "production" || process.env["GEODE_ENV"] === "production";
+            if (isProduction) {
+              console.warn(
+                "SECURITY WARNING: insecureSkipVerify is enabled in production environment. This disables TLS certificate verification and exposes the connection to MITM attacks. Set GEODE_ALLOW_INSECURE_PRODUCTION=true to override this warning."
+              );
+              if (process.env["GEODE_ALLOW_INSECURE_PRODUCTION"] !== "true") {
+                throw new TransportError({
+                  operation: "connect",
+                  cause: new Error(
+                    "insecureSkipVerify is not allowed in production. Configure proper TLS certificates or set GEODE_ALLOW_INSECURE_PRODUCTION=true to override."
+                  )
+                });
+              }
+            }
+            config.verifyPeer = false;
+          }
+          if (tlsConfig.ca) {
+            config.caCerts = [tlsConfig.ca];
+          }
+          if (tlsConfig.cert && tlsConfig.key) {
+            config.cert = tlsConfig.cert;
+            config.key = tlsConfig.key;
+          }
+          const client = await QUICClient.createQUICClient(
+            {
+              host,
+              port,
+              serverName: cfg.serverName ?? host,
+              crypto: cryptoOps,
+              config
+            },
+            { timer: cfg.connectTimeout ?? 3e4 }
+          );
+          transport._client = client;
+          const connection = client.connection;
+          const stream = await connection.newStream();
+          transport._stream = stream;
+          transport.startReading();
+          return transport;
+        } catch (e) {
+          await transport.close();
+          throw new TransportError({
+            operation: "connect",
+            address,
+            cause: e instanceof Error ? e : new Error(String(e))
+          });
         }
-        return this._floatValue;
       }
-      get asString() {
-        if (this.kind === "STRING" || this.kind === "UUID") {
-          return this._stringValue;
-        }
-        return this.toString();
+      /**
+       * Start reading from the stream in the background.
+       */
+      startReading() {
+        if (!this._stream) return;
+        const stream = this._stream;
+        const reader = stream.readable.getReader();
+        const read = async () => {
+          try {
+            while (!this._closed) {
+              const { done, value } = await reader.read();
+              if (done) {
+                this.rejectPendingReads(
+                  new TransportError({
+                    operation: "read",
+                    cause: new Error("Stream ended unexpectedly")
+                  })
+                );
+                break;
+              }
+              if (value) {
+                this.processData(Buffer.from(value));
+              }
+            }
+          } catch (err) {
+            if (!this._closed) {
+              this.rejectPendingReads(
+                new TransportError({
+                  operation: "read",
+                  cause: err instanceof Error ? err : new Error(String(err))
+                })
+              );
+            }
+          } finally {
+            reader.releaseLock();
+          }
+        };
+        void read();
       }
-      get asDecimal() {
-        if (this.kind !== "DECIMAL") {
-          throw new TypeError(`Cannot convert ${this.kind} to decimal`);
+      /**
+       * Reject all pending reads with an error.
+       */
+      rejectPendingReads(error) {
+        const pending = this._pendingProtoReads;
+        this._pendingProtoReads = [];
+        for (const p of pending) {
+          p.reject(error);
         }
-        return this._decimalValue;
       }
-      get asArray() {
-        if (this.kind !== "ARRAY") {
-          throw new TypeError(`Cannot convert ${this.kind} to array`);
+      /**
+       * Consolidate the chunk list into a single buffer.
+       * Called only when we know we have enough data for at least one operation.
+       */
+      consolidateChunks() {
+        if (this._chunks.length === 0) {
+          return Buffer.alloc(0);
         }
-        return this._arrayValue;
-      }
-      get asObject() {
-        if (this.kind !== "OBJECT" && this.kind !== "NODE" && this.kind !== "EDGE") {
-          throw new TypeError(`Cannot convert ${this.kind} to object`);
+        if (this._chunks.length === 1) {
+          return this._chunks[0];
         }
-        return this._objectValue;
+        const consolidated = Buffer.concat(this._chunks, this._totalLength);
+        this._chunks = [consolidated];
+        return consolidated;
       }
-      get asBytes() {
-        if (this.kind !== "BYTEA") {
-          throw new TypeError(`Cannot convert ${this.kind} to bytes`);
+      /**
+       * Process received data (length-prefixed protobuf messages).
+       *
+       * Uses a chunk list pattern instead of Buffer.concat on every call
+       * to avoid O(n^2) copying of the accumulated buffer.
+       */
+      processData(data) {
+        this._chunks.push(data);
+        this._totalLength += data.length;
+        if (this._totalLength > this._maxBufferBytes) {
+          this.handleOversize("buffer");
         }
-        return this._bytesValue;
-      }
-      get asDate() {
-        if (this.kind !== "DATE" && this.kind !== "TIME" && this.kind !== "TIMETZ" && this.kind !== "TIMESTAMP" && this.kind !== "TIMESTAMPTZ") {
-          throw new TypeError(`Cannot convert ${this.kind} to date`);
+        while (this._totalLength >= 4) {
+          const buf = this.consolidateChunks();
+          const msgLen = decodeLengthPrefix(buf);
+          if (msgLen > this._maxMessageSize) {
+            this.handleOversize("message");
+          }
+          const totalLen = 4 + msgLen;
+          if (this._totalLength < totalLen) {
+            break;
+          }
+          const msgData = buf.subarray(4, totalLen);
+          const remaining = buf.subarray(totalLen);
+          if (remaining.length > 0) {
+            this._chunks = [remaining];
+          } else {
+            this._chunks = [];
+          }
+          this._totalLength = remaining.length;
+          try {
+            const msg = decodeQuicServerMessage(msgData);
+            const pending = this._pendingProtoReads.shift();
+            if (pending) {
+              pending.resolve(msg);
+            }
+          } catch (err) {
+            const pending = this._pendingProtoReads.shift();
+            if (pending) {
+              pending.reject(
+                new TransportError({
+                  operation: "decode",
+                  cause: err instanceof Error ? err : new Error(String(err))
+                })
+              );
+            }
+          }
         }
-        return this._dateValue;
       }
-      get asNode() {
-        if (this.kind !== "NODE") {
-          throw new TypeError(`Cannot convert ${this.kind} to node`);
-        }
-        return this._nodeValue;
+      /**
+       * Handle oversized data by closing the transport.
+       */
+      handleOversize(kind) {
+        const error = new TransportError({
+          operation: "receive",
+          cause: new Error(`Received ${kind} exceeds maximum allowed size`)
+        });
+        this._chunks = [];
+        this._totalLength = 0;
+        this.rejectPendingReads(error);
+        void this.close();
+        throw error;
       }
-      get asEdge() {
-        if (this.kind !== "EDGE") {
-          throw new TypeError(`Cannot convert ${this.kind} to edge`);
+      /**
+       * Send a protobuf message with length prefix.
+       */
+      async sendProto(msg, signal) {
+        this.checkClosed();
+        if (signal?.aborted) {
+          throw new TransportError({ operation: "sendProto", cause: new Error("Aborted") });
         }
-        return this._edgeValue;
-      }
-      get asPath() {
-        if (this.kind !== "PATH") {
-          throw new TypeError(`Cannot convert ${this.kind} to path`);
+        if (!this._stream) {
+          throw new TransportError({ operation: "sendProto", cause: new Error("No stream") });
+        }
+        const data = encodeWithLengthPrefix(msg);
+        try {
+          const stream = this._stream;
+          const writer = stream.writable.getWriter();
+          await writer.write(new Uint8Array(data));
+          writer.releaseLock();
+        } catch (e) {
+          throw new TransportError({
+            operation: "sendProto",
+            address: this._address,
+            cause: e instanceof Error ? e : new Error(String(e))
+          });
         }
-        return this._pathValue;
       }
-      get asRange() {
-        if (this.kind !== "RANGE") {
-          throw new TypeError(`Cannot convert ${this.kind} to range`);
+      /**
+       * Receive a protobuf message.
+       */
+      async receiveProto(signal) {
+        this.checkClosed();
+        if (signal?.aborted) {
+          throw new TransportError({ operation: "receiveProto", cause: new Error("Aborted") });
         }
-        return this._rangeValue;
+        return new Promise((resolve2, reject) => {
+          let onAbort = null;
+          const pendingRead = {
+            resolve: (value) => {
+              if (onAbort && signal) {
+                signal.removeEventListener("abort", onAbort);
+              }
+              resolve2(value);
+            },
+            reject: (error) => {
+              if (onAbort && signal) {
+                signal.removeEventListener("abort", onAbort);
+              }
+              reject(error);
+            }
+          };
+          this._pendingProtoReads.push(pendingRead);
+          if (signal) {
+            onAbort = () => {
+              const idx = this._pendingProtoReads.indexOf(pendingRead);
+              if (idx !== -1) {
+                this._pendingProtoReads.splice(idx, 1);
+              }
+              reject(new TransportError({ operation: "receiveProto", cause: new Error("Aborted") }));
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+          }
+        });
       }
-      get asJSON() {
-        if (this.kind !== "JSON" && this.kind !== "JSONB") {
-          throw new TypeError(`Cannot convert ${this.kind} to JSON`);
+      async close() {
+        if (this._closed) return;
+        this._closed = true;
+        for (const pending of this._pendingProtoReads) {
+          pending.reject(ErrClosed());
         }
-        return this._rawValue;
+        this._pendingProtoReads = [];
+        this._chunks = [];
+        this._totalLength = 0;
+        if (this._client) {
+          try {
+            const client = this._client;
+            await client.destroy();
+          } catch {
+          }
+          this._client = null;
+        }
+        this._stream = null;
       }
-      get raw() {
-        return this._rawValue;
+    };
+    MockTransport = class extends BaseTransport {
+      _protoSendQueue = [];
+      _protoReceiveQueue = [];
+      _pendingProtoReads = [];
+      constructor(address = "mock:3141") {
+        super(address);
       }
-      toString() {
-        switch (this.kind) {
-          case "NULL":
-            return "null";
-          case "BOOL":
-            return this._boolValue.toString();
-          case "INT":
-            return this._intValue.toString();
-          case "FLOAT":
-            return this._floatValue.toString();
-          case "STRING":
-          case "UUID":
-            return this._stringValue;
-          case "DECIMAL":
-            return this._decimalValue?.toString() ?? "0";
-          case "ARRAY":
-            return `[${this._arrayValue.map((v) => v.toString()).join(", ")}]`;
-          case "OBJECT":
-            return `{${[...this._objectValue.entries()].map(([k, v]) => `${k}: ${v.toString()}`).join(", ")}}`;
-          case "BYTEA":
-            return `<bytes:${this._bytesValue.length}>`;
-          case "DATE":
-          case "TIME":
-          case "TIMETZ":
-          case "TIMESTAMP":
-          case "TIMESTAMPTZ":
-            return this._dateValue?.toISOString() ?? "";
-          case "NODE":
-            return `(${this._nodeValue?.labels.join(":")} {${JSON.stringify(this._nodeValue?.properties)}})`;
-          case "EDGE":
-            return `[${this._edgeValue?.type} {${JSON.stringify(this._edgeValue?.properties)}}]`;
-          case "PATH":
-            return `<path:${this._pathValue?.nodes.length} nodes>`;
-          case "JSON":
-          case "JSONB":
-            return JSON.stringify(this._rawValue);
-          default:
-            return String(this._rawValue ?? "");
+      /**
+       * Queue a protobuf response.
+       */
+      queueProtoResponse(response) {
+        const pending = this._pendingProtoReads.shift();
+        if (pending) {
+          pending.resolve(response);
+        } else {
+          this._protoReceiveQueue.push(response);
         }
       }
       /**
-       * Convert to a plain JavaScript value.
+       * Get all sent protobuf messages.
        */
-      toJS() {
-        switch (this.kind) {
-          case "NULL":
-            return null;
-          case "BOOL":
-            return this._boolValue;
-          case "INT":
-            if (this._intValue >= Number.MIN_SAFE_INTEGER && this._intValue <= Number.MAX_SAFE_INTEGER) {
-              return Number(this._intValue);
-            }
-            return this._intValue;
-          case "FLOAT":
-            return this._floatValue;
-          case "STRING":
-          case "UUID":
-            return this._stringValue;
-          case "DECIMAL":
-            return this._decimalValue?.toString();
-          case "ARRAY":
-            return this._arrayValue.map((v) => v.toJS());
-          case "OBJECT":
-            return Object.fromEntries([...this._objectValue.entries()].map(([k, v]) => [k, v.toJS()]));
-          case "BYTEA":
-            return this._bytesValue;
-          case "DATE":
-          case "TIME":
-          case "TIMETZ":
-          case "TIMESTAMP":
-          case "TIMESTAMPTZ":
-            return this._dateValue;
-          case "NODE":
-            return this._nodeValue;
-          case "EDGE":
-            return this._edgeValue;
-          case "PATH":
-            return this._pathValue;
-          case "RANGE":
-            return this._rangeValue;
-          case "JSON":
-          case "JSONB":
-            return this._rawValue;
-          default:
-            return this._rawValue;
+      getSentProtoMessages() {
+        return [...this._protoSendQueue];
+      }
+      /**
+       * Clear sent messages.
+       */
+      clearSentMessages() {
+        this._protoSendQueue = [];
+      }
+      // eslint-disable-next-line @typescript-eslint/require-await
+      async sendProto(msg, signal) {
+        this.checkClosed();
+        if (signal?.aborted) {
+          throw new TransportError({ operation: "sendProto", cause: new Error("Aborted") });
+        }
+        this._protoSendQueue.push(msg);
+      }
+      async receiveProto(signal) {
+        this.checkClosed();
+        if (signal?.aborted) {
+          throw new TransportError({ operation: "receiveProto", cause: new Error("Aborted") });
+        }
+        const queued = this._protoReceiveQueue.shift();
+        if (queued) {
+          return queued;
         }
+        return new Promise((resolve2, reject) => {
+          let onAbort = null;
+          const pendingRead = {
+            resolve: (value) => {
+              if (onAbort && signal) {
+                signal.removeEventListener("abort", onAbort);
+              }
+              resolve2(value);
+            },
+            reject: (error) => {
+              if (onAbort && signal) {
+                signal.removeEventListener("abort", onAbort);
+              }
+              reject(error);
+            }
+          };
+          this._pendingProtoReads.push(pendingRead);
+          if (signal) {
+            onAbort = () => {
+              const idx = this._pendingProtoReads.indexOf(pendingRead);
+              if (idx !== -1) {
+                this._pendingProtoReads.splice(idx, 1);
+              }
+              reject(new TransportError({ operation: "receiveProto", cause: new Error("Aborted") }));
+            };
+            signal.addEventListener("abort", onAbort, { once: true });
+          }
+        });
       }
-      /**
-       * Convert to JSON-serializable format.
-       */
-      toJSON() {
-        return this.toJS();
+      // eslint-disable-next-line @typescript-eslint/require-await
+      async close() {
+        if (this._closed) return;
+        this._closed = true;
+        for (const pending of this._pendingProtoReads) {
+          pending.reject(ErrClosed());
+        }
+        this._pendingProtoReads = [];
       }
     };
-    DANGEROUS_KEYS = /* @__PURE__ */ new Set(["__proto__", "constructor", "prototype"]);
   }
 });
 
@@ -2392,16 +3055,22 @@ var init_prepared = __esm({
       _query;
       _parameters;
       _closed = false;
+      _onClose;
       /**
        * Create a new prepared statement.
        *
+       * @param conn - Connection to use for execution
+       * @param query - Query text with parameters
+       * @param onClose - Optional callback invoked when close() is called (e.g., to release a pooled connection)
+       *
        * @internal Use Connection.prepare() instead.
        */
-      constructor(conn, query2) {
+      constructor(conn, query2, onClose) {
         validateQuery(query2);
         this._conn = conn;
         this._query = query2;
         this._parameters = extractParameters(query2);
+        this._onClose = onClose;
       }
       /**
        * Get the query text.
@@ -2488,9 +3157,18 @@ var init_prepared = __esm({
        * Close the prepared statement.
        *
        * After closing, the statement cannot be executed.
+       * If a release callback was provided (e.g., to return a pooled connection),
+       * it is invoked exactly once on the first call to close().
        */
       close() {
+        if (this._closed) {
+          return;
+        }
         this._closed = true;
+        if (this._onClose) {
+          this._onClose();
+          this._onClose = void 0;
+        }
       }
       /**
        * Resolve and validate parameters.
@@ -2771,10 +3449,10 @@ function formatBytes(bytes) {
   return `${value.toFixed(2)} ${units[unitIndex]}`;
 }
 var init_explain = __esm({
-  "src/explain.ts"() {
+  async "src/explain.ts"() {
     init_validate();
     init_errors();
-    init_proto();
+    await init_proto();
   }
 });
 
@@ -2788,6 +3466,10 @@ __export(batch_exports, {
   batchParallel: () => batchParallel
 });
 async function batch(conn, queries, options) {
+  const concurrency = options?.concurrency ?? 1;
+  if (concurrency > 1) {
+    return batchParallel(conn, queries, { ...options, concurrency });
+  }
   const results = [];
   const startTime = Date.now();
   let successful = 0;
@@ -2909,7 +3591,8 @@ async function batchMap(conn, queryTemplate, items, options) {
   return batch(conn, queries, options);
 }
 async function batchParallel(conn, queries, options) {
-  const concurrency = options?.concurrency ?? 5;
+  const requestedConcurrency = options?.concurrency ?? 5;
+  const concurrency = Math.max(1, Math.min(requestedConcurrency, 1));
   const results = [];
   const startTime = Date.now();
   let successful = 0;
@@ -3003,18 +3686,38 @@ var init_auth = __esm({
     AuthClient = class {
       _conn;
       _passwordPolicy;
+      _onClose;
+      _closed = false;
       /**
        * Create a new auth client.
        *
        * @param conn - Connection to use
        * @param passwordPolicy - Optional password policy configuration
+       * @param onClose - Optional callback invoked when close() is called (e.g., to release a pooled connection)
        */
-      constructor(conn, passwordPolicy) {
+      constructor(conn, passwordPolicy, onClose) {
         this._conn = conn;
         this._passwordPolicy = {
           ...DEFAULT_PASSWORD_POLICY,
           ...passwordPolicy
         };
+        this._onClose = onClose;
+      }
+      /**
+       * Close the auth client and release the underlying connection.
+       *
+       * If a release callback was provided (e.g., to return a pooled connection),
+       * it is invoked exactly once on the first call to close().
+       */
+      close() {
+        if (this._closed) {
+          return;
+        }
+        this._closed = true;
+        if (this._onClose) {
+          this._onClose();
+          this._onClose = void 0;
+        }
       }
       /**
        * Get the current password policy.
@@ -3032,14 +3735,9 @@ var init_auth = __esm({
         };
       }
       // User Management
-      /**
-       * Create a new user.
-       *
-       * @param username - Username for the new user
-       * @param options - User creation options
-       */
+      /** Create a new user. */
       async createUser(username, options) {
-        this.validateUsername(username);
+        validateUsername(username);
         this.validatePassword(options.password);
         if (options.roles) {
           for (const role of options.roles) {
@@ -3061,25 +3759,16 @@ var init_auth = __esm({
           }
         });
       }
-      /**
-       * Delete a user.
-       *
-       * @param username - Username to delete
-       */
+      /** Delete a user. */
       async deleteUser(username) {
-        this.validateUsername(username);
+        validateUsername(username);
         await this._conn.exec("DROP USER $username", {
           params: { username }
         });
       }
-      /**
-       * Get user information.
-       *
-       * @param username - Username to look up
-       * @returns User information or null if not found
-       */
+      /** Get user information, or null if not found. */
       async getUser(username) {
-        this.validateUsername(username);
+        validateUsername(username);
         const result = await this._conn.queryAll("SHOW USER $username", { params: { username } });
         if (result.length === 0) {
           return null;
@@ -3097,11 +3786,7 @@ var init_auth = __esm({
           metadata: row["metadata"]
         };
       }
-      /**
-       * List all users.
-       *
-       * @returns Array of users
-       */
+      /** List all users. */
       async listUsers() {
         const result = await this._conn.queryAll("SHOW USERS");
         return result.map((row) => ({
@@ -3112,50 +3797,32 @@ var init_auth = __esm({
           lastLoginAt: row["last_login"] ? new Date(row["last_login"]) : void 0
         }));
       }
-      /**
-       * Change a user's password.
-       *
-       * @param username - Username
-       * @param newPassword - New password
-       */
+      /** Change a user's password. */
       async changePassword(username, newPassword) {
-        this.validateUsername(username);
+        validateUsername(username);
         this.validatePassword(newPassword);
         await this._conn.exec("ALTER USER $username SET password = $password", {
           params: { username, password: newPassword }
         });
       }
-      /**
-       * Activate a user.
-       *
-       * @param username - Username to activate
-       */
+      /** Activate a user. */
       async activateUser(username) {
-        this.validateUsername(username);
+        validateUsername(username);
         await this._conn.exec("ALTER USER $username SET active = true", {
           params: { username }
         });
       }
-      /**
-       * Deactivate a user.
-       *
-       * @param username - Username to deactivate
-       */
+      /** Deactivate a user. */
       async deactivateUser(username) {
-        this.validateUsername(username);
+        validateUsername(username);
         await this._conn.exec("ALTER USER $username SET active = false", {
           params: { username }
         });
       }
       // Role Management
-      /**
-       * Create a new role.
-       *
-       * @param name - Role name
-       * @param options - Role creation options
-       */
+      /** Create a new role. */
       async createRole(name, options) {
-        this.validateRoleName(name);
+        validateRoleName(name);
         let query2 = "CREATE ROLE $name";
         if (options?.description) {
           query2 += " SET description = $description";
@@ -3172,25 +3839,16 @@ var init_auth = __esm({
           }
         }
       }
-      /**
-       * Delete a role.
-       *
-       * @param name - Role name to delete
-       */
+      /** Delete a role. */
       async deleteRole(name) {
-        this.validateRoleName(name);
+        validateRoleName(name);
         await this._conn.exec("DROP ROLE $name", {
           params: { name }
         });
       }
-      /**
-       * Get role information.
-       *
-       * @param name - Role name
-       * @returns Role information or null if not found
-       */
+      /** Get role information, or null if not found. */
       async getRole(name) {
-        this.validateRoleName(name);
+        validateRoleName(name);
         const result = await this._conn.queryAll("SHOW ROLE $name", { params: { name } });
         const row = result[0];
         if (!row) {
@@ -3203,11 +3861,7 @@ var init_auth = __esm({
           system: row["system"]
         };
       }
-      /**
-       * List all roles.
-       *
-       * @returns Array of roles
-       */
+      /** List all roles. */
       async listRoles() {
         const result = await this._conn.queryAll("SHOW ROLES");
         return result.map((row) => ({
@@ -3217,40 +3871,25 @@ var init_auth = __esm({
           system: row["system"]
         }));
       }
-      /**
-       * Assign a role to a user.
-       *
-       * @param username - Username
-       * @param roleName - Role to assign
-       */
+      /** Assign a role to a user. */
       async assignRole(username, roleName) {
-        this.validateUsername(username);
-        this.validateRoleName(roleName);
+        validateUsername(username);
+        validateRoleName(roleName);
         await this._conn.exec("GRANT ROLE $role TO $user", {
           params: { role: roleName, user: username }
         });
       }
-      /**
-       * Revoke a role from a user.
-       *
-       * @param username - Username
-       * @param roleName - Role to revoke
-       */
+      /** Revoke a role from a user. */
       async revokeRole(username, roleName) {
-        this.validateUsername(username);
-        this.validateRoleName(roleName);
+        validateUsername(username);
+        validateRoleName(roleName);
         await this._conn.exec("REVOKE ROLE $role FROM $user", {
           params: { role: roleName, user: username }
         });
       }
-      /**
-       * Grant a permission to a role.
-       *
-       * @param roleName - Role name
-       * @param permission - Permission to grant
-       */
+      /** Grant a permission to a role. */
       async grantPermission(roleName, permission) {
-        this.validateRoleName(roleName);
+        validateRoleName(roleName);
         validatePermissionAction(permission.action);
         validatePermissionResource(permission.resource);
         if (permission.label) {
@@ -3265,14 +3904,9 @@ var init_auth = __esm({
           params: { role: roleName }
         });
       }
-      /**
-       * Revoke a permission from a role.
-       *
-       * @param roleName - Role name
-       * @param permission - Permission to revoke
-       */
+      /** Revoke a permission from a role. */
       async revokePermission(roleName, permission) {
-        this.validateRoleName(roleName);
+        validateRoleName(roleName);
         validatePermissionAction(permission.action);
         validatePermissionResource(permission.resource);
         if (permission.label) {
@@ -3432,538 +4066,121 @@ var init_auth = __esm({
         validatePermissionResource(resource);
         validatePermissionAction(action);
         if (label) {
-          validateLabel(label);
-        }
-        const target = label ? `${resource}:${label}` : resource;
-        const result = await this._conn.queryAll("RETURN has_permission($target, $action) AS allowed", {
-          params: { target, action }
-        });
-        return result[0]?.["allowed"] ?? false;
-      }
-      // Validation helpers
-      validateUsername(username) {
-        if (!username || username.length === 0) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Username cannot be empty"
-          });
-        }
-        if (username.length > 128) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Username too long (max 128 characters)"
-          });
-        }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(username)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Invalid username format"
-          });
-        }
-      }
-      validatePassword(password) {
-        const policy = this._passwordPolicy;
-        if (!password || password.length < policy.minLength) {
-          throw new SecurityError({
-            type: "validation",
-            message: `Password must be at least ${policy.minLength} characters`
-          });
-        }
-        if (password.length > policy.maxLength) {
-          throw new SecurityError({
-            type: "validation",
-            message: `Password too long (max ${policy.maxLength} characters)`
-          });
-        }
-        if (policy.requireUppercase && !/[A-Z]/.test(password)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Password must contain at least one uppercase letter"
-          });
-        }
-        if (policy.requireLowercase && !/[a-z]/.test(password)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Password must contain at least one lowercase letter"
-          });
-        }
-        if (policy.requireDigit && !/[0-9]/.test(password)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Password must contain at least one digit"
-          });
-        }
-        if (policy.requireSpecialChar) {
-          const specialCharsEscaped = policy.specialChars.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
-          const specialRegex = new RegExp(`[${specialCharsEscaped}]`);
-          if (!specialRegex.test(password)) {
-            throw new SecurityError({
-              type: "validation",
-              message: `Password must contain at least one special character (${policy.specialChars})`
-            });
-          }
-        }
-      }
-      validateRoleName(name) {
-        if (!name || name.length === 0) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Role name cannot be empty"
-          });
-        }
-        if (name.length > 128) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Role name too long (max 128 characters)"
-          });
-        }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Invalid role name format"
-          });
-        }
-      }
-      validatePolicyName(name) {
-        if (!name || name.length === 0) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Policy name cannot be empty"
-          });
-        }
-        if (name.length > 128) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Policy name too long (max 128 characters)"
-          });
-        }
-        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
-          throw new SecurityError({
-            type: "validation",
-            message: "Invalid policy name format"
-          });
-        }
-      }
-    };
-  }
-});
-
-// src/connection.ts
-init_config();
-init_errors();
-
-// src/transport.ts
-init_config();
-init_errors();
-init_validate();
-init_proto();
-var GEODE_ALPN = ["geode/1"];
-async function buildTLSConfig(cfg) {
-  const options = {
-    minVersion: "TLSv1.3",
-    maxVersion: "TLSv1.3"
-  };
-  if (cfg.tlsCACert) {
-    options.ca = cfg.tlsCACert;
-  } else if (cfg.tlsCA) {
-    validateTLSCertPath(cfg.tlsCA, "tlsCA");
-    try {
-      options.ca = await fs.promises.readFile(cfg.tlsCA, "utf-8");
-    } catch (e) {
-      throw new TransportError({
-        operation: "load_ca_cert",
-        cause: e instanceof Error ? e : new Error(String(e))
-      });
-    }
-  }
-  if (cfg.tlsCertPEM) {
-    options.cert = cfg.tlsCertPEM;
-  } else if (cfg.tlsCert) {
-    validateTLSCertPath(cfg.tlsCert, "tlsCert");
-    try {
-      options.cert = await fs.promises.readFile(cfg.tlsCert, "utf-8");
-    } catch (e) {
-      throw new TransportError({
-        operation: "load_client_cert",
-        cause: e instanceof Error ? e : new Error(String(e))
-      });
-    }
-  }
-  if (cfg.tlsKeyPEM) {
-    options.key = cfg.tlsKeyPEM;
-  } else if (cfg.tlsKey) {
-    validateTLSCertPath(cfg.tlsKey, "tlsKey");
-    try {
-      options.key = await fs.promises.readFile(cfg.tlsKey, "utf-8");
-    } catch (e) {
-      throw new TransportError({
-        operation: "load_client_key",
-        cause: e instanceof Error ? e : new Error(String(e))
-      });
-    }
-  }
-  return options;
-}
-var BaseTransport = class {
-  _closed = false;
-  _address;
-  constructor(address) {
-    this._address = address;
-  }
-  isClosed() {
-    return this._closed;
-  }
-  getAddress() {
-    return this._address;
-  }
-  checkClosed() {
-    if (this._closed) {
-      throw ErrClosed;
-    }
-  }
-};
-var QuicTransport = class _QuicTransport extends BaseTransport {
-  _client = null;
-  _stream = null;
-  _protoBuffer = Buffer.alloc(0);
-  _pendingProtoReads = [];
-  constructor(address) {
-    super(address);
-  }
-  /**
-   * Connect to the Geode server using QUIC.
-   */
-  static async connect(cfg) {
-    const address = getAddress(cfg);
-    const transport = new _QuicTransport(address);
-    try {
-      const { QUICClient } = await import('@matrixai/quic');
-      const [host = "localhost", portStr] = address.includes("[") ? [address.slice(1, address.lastIndexOf("]")), address.slice(address.lastIndexOf(":") + 1)] : address.split(":");
-      const port = parseInt(portStr ?? "3141", 10);
-      const cryptoOps = {
-        ops: {
-          randomBytes: (data) => {
-            const buf = Buffer.from(data);
-            crypto.randomFillSync(buf);
-            return Promise.resolve();
-          }
+          validateLabel(label);
         }
-      };
-      const tlsConfig = await buildTLSConfig(cfg);
-      const config = {
-        applicationProtos: GEODE_ALPN,
-        maxIdleTimeout: cfg.maxIdleTime ?? 3e4,
-        initialMaxData: 1e7,
-        initialMaxStreamDataBidiLocal: 1e6,
-        initialMaxStreamDataBidiRemote: 1e6,
-        initialMaxStreamsBidi: 100
-      };
-      if (cfg.insecureSkipVerify) {
-        const isProduction = process.env["NODE_ENV"] === "production" || process.env["GEODE_ENV"] === "production";
-        if (isProduction) {
-          console.warn(
-            "SECURITY WARNING: insecureSkipVerify is enabled in production environment. This disables TLS certificate verification and exposes the connection to MITM attacks. Set GEODE_ALLOW_INSECURE_PRODUCTION=true to override this warning."
-          );
-          if (process.env["GEODE_ALLOW_INSECURE_PRODUCTION"] !== "true") {
-            throw new TransportError({
-              operation: "connect",
-              cause: new Error(
-                "insecureSkipVerify is not allowed in production. Configure proper TLS certificates or set GEODE_ALLOW_INSECURE_PRODUCTION=true to override."
-              )
-            });
-          }
+        const target = label ? `${resource}:${label}` : resource;
+        const result = await this._conn.queryAll("RETURN has_permission($target, $action) AS allowed", {
+          params: { target, action }
+        });
+        return result[0]?.["allowed"] ?? false;
+      }
+      // Validation helpers
+      validatePassword(password) {
+        const policy = this._passwordPolicy;
+        if (!password || password.length < policy.minLength) {
+          throw new SecurityError({
+            type: "validation",
+            message: `Password must be at least ${policy.minLength} characters`
+          });
         }
-        config.verifyPeer = false;
-      }
-      if (tlsConfig.ca) {
-        config.caCerts = [tlsConfig.ca];
-      }
-      if (tlsConfig.cert && tlsConfig.key) {
-        config.cert = tlsConfig.cert;
-        config.key = tlsConfig.key;
-      }
-      const client = await QUICClient.createQUICClient(
-        {
-          host,
-          port,
-          serverName: cfg.serverName ?? host,
-          crypto: cryptoOps,
-          config
-        },
-        { timer: cfg.connectTimeout ?? 3e4 }
-      );
-      transport._client = client;
-      const connection = client.connection;
-      const stream = await connection.newStream();
-      transport._stream = stream;
-      transport.startReading();
-      return transport;
-    } catch (e) {
-      await transport.close();
-      throw new TransportError({
-        operation: "connect",
-        address,
-        cause: e instanceof Error ? e : new Error(String(e))
-      });
-    }
-  }
-  /**
-   * Start reading from the stream in the background.
-   */
-  startReading() {
-    if (!this._stream) return;
-    const stream = this._stream;
-    const reader = stream.readable.getReader();
-    const read = async () => {
-      try {
-        while (!this._closed) {
-          const { done, value } = await reader.read();
-          if (done) {
-            this.rejectPendingReads(
-              new TransportError({
-                operation: "read",
-                cause: new Error("Stream ended unexpectedly")
-              })
-            );
-            break;
-          }
-          if (value) {
-            this.processData(Buffer.from(value));
-          }
+        if (password.length > policy.maxLength) {
+          throw new SecurityError({
+            type: "validation",
+            message: `Password too long (max ${policy.maxLength} characters)`
+          });
         }
-      } catch (err) {
-        if (!this._closed) {
-          this.rejectPendingReads(
-            new TransportError({
-              operation: "read",
-              cause: err instanceof Error ? err : new Error(String(err))
-            })
-          );
+        if (policy.requireUppercase && !/[A-Z]/.test(password)) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Password must contain at least one uppercase letter"
+          });
         }
-      } finally {
-        reader.releaseLock();
-      }
-    };
-    void read();
-  }
-  /**
-   * Reject all pending reads with an error.
-   */
-  rejectPendingReads(error) {
-    const pending = this._pendingProtoReads;
-    this._pendingProtoReads = [];
-    for (const p of pending) {
-      p.reject(error);
-    }
-  }
-  /**
-   * Process received data (length-prefixed protobuf messages).
-   */
-  processData(data) {
-    this._protoBuffer = Buffer.concat([this._protoBuffer, data]);
-    while (this._protoBuffer.length >= 4) {
-      const msgLen = decodeLengthPrefix(this._protoBuffer);
-      const totalLen = 4 + msgLen;
-      if (this._protoBuffer.length < totalLen) {
-        break;
-      }
-      const msgData = this._protoBuffer.subarray(4, totalLen);
-      this._protoBuffer = this._protoBuffer.subarray(totalLen);
-      try {
-        const msg = decodeQuicServerMessage(msgData);
-        const pending = this._pendingProtoReads.shift();
-        if (pending) {
-          pending.resolve(msg);
+        if (policy.requireLowercase && !/[a-z]/.test(password)) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Password must contain at least one lowercase letter"
+          });
         }
-      } catch (err) {
-        const pending = this._pendingProtoReads.shift();
-        if (pending) {
-          pending.reject(
-            new TransportError({
-              operation: "decode",
-              cause: err instanceof Error ? err : new Error(String(err))
-            })
-          );
+        if (policy.requireDigit && !/[0-9]/.test(password)) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Password must contain at least one digit"
+          });
         }
-      }
-    }
-  }
-  /**
-   * Send a protobuf message with length prefix.
-   */
-  async sendProto(msg, signal) {
-    this.checkClosed();
-    if (signal?.aborted) {
-      throw new TransportError({ operation: "sendProto", cause: new Error("Aborted") });
-    }
-    if (!this._stream) {
-      throw new TransportError({ operation: "sendProto", cause: new Error("No stream") });
-    }
-    const data = encodeWithLengthPrefix(msg);
-    try {
-      const stream = this._stream;
-      const writer = stream.writable.getWriter();
-      await writer.write(new Uint8Array(data));
-      writer.releaseLock();
-    } catch (e) {
-      throw new TransportError({
-        operation: "sendProto",
-        address: this._address,
-        cause: e instanceof Error ? e : new Error(String(e))
-      });
-    }
-  }
-  /**
-   * Receive a protobuf message.
-   */
-  async receiveProto(signal) {
-    this.checkClosed();
-    if (signal?.aborted) {
-      throw new TransportError({ operation: "receiveProto", cause: new Error("Aborted") });
-    }
-    return new Promise((resolve2, reject) => {
-      let onAbort = null;
-      const pendingRead = {
-        resolve: (value) => {
-          if (onAbort && signal) {
-            signal.removeEventListener("abort", onAbort);
-          }
-          resolve2(value);
-        },
-        reject: (error) => {
-          if (onAbort && signal) {
-            signal.removeEventListener("abort", onAbort);
+        if (policy.requireSpecialChar) {
+          const specialCharsEscaped = policy.specialChars.replace(/[.*+?^${}()|[\]\\-]/g, "\\$&");
+          const specialRegex = new RegExp(`[${specialCharsEscaped}]`);
+          if (!specialRegex.test(password)) {
+            throw new SecurityError({
+              type: "validation",
+              message: `Password must contain at least one special character (${policy.specialChars})`
+            });
           }
-          reject(error);
         }
-      };
-      this._pendingProtoReads.push(pendingRead);
-      if (signal) {
-        onAbort = () => {
-          const idx = this._pendingProtoReads.indexOf(pendingRead);
-          if (idx !== -1) {
-            this._pendingProtoReads.splice(idx, 1);
-          }
-          reject(new TransportError({ operation: "receiveProto", cause: new Error("Aborted") }));
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
       }
-    });
-  }
-  async close() {
-    if (this._closed) return;
-    this._closed = true;
-    for (const pending of this._pendingProtoReads) {
-      pending.reject(ErrClosed);
-    }
-    this._pendingProtoReads = [];
-    if (this._client) {
-      try {
-        const client = this._client;
-        await client.destroy();
-      } catch {
+      validatePolicyName(name) {
+        if (!name || name.length === 0) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Policy name cannot be empty"
+          });
+        }
+        if (name.length > 128) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Policy name too long (max 128 characters)"
+          });
+        }
+        if (!/^[a-zA-Z_][a-zA-Z0-9_]*$/.test(name)) {
+          throw new SecurityError({
+            type: "validation",
+            message: "Invalid policy name format"
+          });
+        }
       }
-      this._client = null;
-    }
-    this._stream = null;
-  }
-};
-var MockTransport = class extends BaseTransport {
-  _protoSendQueue = [];
-  _protoReceiveQueue = [];
-  _pendingProtoReads = [];
-  constructor(address = "mock:3141") {
-    super(address);
-  }
-  /**
-   * Queue a protobuf response.
-   */
-  queueProtoResponse(response) {
-    const pending = this._pendingProtoReads.shift();
-    if (pending) {
-      pending.resolve(response);
-    } else {
-      this._protoReceiveQueue.push(response);
-    }
-  }
-  /**
-   * Get all sent protobuf messages.
-   */
-  getSentProtoMessages() {
-    return [...this._protoSendQueue];
+    };
   }
-  /**
-   * Clear sent messages.
-   */
-  clearSentMessages() {
-    this._protoSendQueue = [];
+});
+
+// src/abort-utils.ts
+function withAbortTimeout(signal, timeoutMs) {
+  const effectiveTimeout = timeoutMs ?? 0;
+  if (!effectiveTimeout || effectiveTimeout <= 0) {
+    return { signal, cleanup: () => {
+    } };
+  }
+  const controller = new AbortController();
+  const timeoutId = setTimeout(() => controller.abort(), effectiveTimeout);
+  if (signal?.aborted) {
+    controller.abort();
+    return {
+      signal: controller.signal,
+      cleanup: () => {
+        clearTimeout(timeoutId);
+      }
+    };
   }
-  // eslint-disable-next-line @typescript-eslint/require-await
-  async sendProto(msg, signal) {
-    this.checkClosed();
-    if (signal?.aborted) {
-      throw new TransportError({ operation: "sendProto", cause: new Error("Aborted") });
-    }
-    this._protoSendQueue.push(msg);
+  let onAbort = null;
+  if (signal) {
+    onAbort = () => controller.abort();
+    signal.addEventListener("abort", onAbort, { once: true });
   }
-  async receiveProto(signal) {
-    this.checkClosed();
-    if (signal?.aborted) {
-      throw new TransportError({ operation: "receiveProto", cause: new Error("Aborted") });
-    }
-    const queued = this._protoReceiveQueue.shift();
-    if (queued) {
-      return queued;
-    }
-    return new Promise((resolve2, reject) => {
-      let onAbort = null;
-      const pendingRead = {
-        resolve: (value) => {
-          if (onAbort && signal) {
-            signal.removeEventListener("abort", onAbort);
-          }
-          resolve2(value);
-        },
-        reject: (error) => {
-          if (onAbort && signal) {
-            signal.removeEventListener("abort", onAbort);
-          }
-          reject(error);
-        }
-      };
-      this._pendingProtoReads.push(pendingRead);
-      if (signal) {
-        onAbort = () => {
-          const idx = this._pendingProtoReads.indexOf(pendingRead);
-          if (idx !== -1) {
-            this._pendingProtoReads.splice(idx, 1);
-          }
-          reject(new TransportError({ operation: "receiveProto", cause: new Error("Aborted") }));
-        };
-        signal.addEventListener("abort", onAbort, { once: true });
+  return {
+    signal: controller.signal,
+    cleanup: () => {
+      clearTimeout(timeoutId);
+      if (signal && onAbort) {
+        signal.removeEventListener("abort", onAbort);
       }
-    });
-  }
-  // eslint-disable-next-line @typescript-eslint/require-await
-  async close() {
-    if (this._closed) return;
-    this._closed = true;
-    for (const pending of this._pendingProtoReads) {
-      pending.reject(ErrClosed);
     }
-    this._pendingProtoReads = [];
-  }
-};
-async function createTransport(cfg) {
-  if (cfg.transport === "grpc") {
-    const { GrpcTransport: GrpcTransport2 } = await Promise.resolve().then(() => (init_grpc_transport(), grpc_transport_exports));
-    return GrpcTransport2.connect(cfg);
-  }
-  return QuicTransport.connect(cfg);
+  };
 }
 
 // src/connection.ts
-init_proto();
+init_config();
+init_errors();
+await init_transport();
+await init_proto();
 init_validate();
 
 // src/transaction.ts
@@ -4080,10 +4297,10 @@ var Transaction = class {
    */
   checkDone() {
     if (this._done) {
-      throw ErrTxDone;
+      throw ErrTxDone();
     }
     if (!this._conn.inTransaction) {
-      throw ErrNoTx;
+      throw ErrNoTx();
     }
   }
 };
@@ -4187,6 +4404,38 @@ var QueryResult = class {
       this.close();
     }
   }
+  /**
+   * Collect all remaining rows as raw records without GQLValue conversion.
+   * This is the fast path used by queryAll() to avoid double-conversion.
+   */
+  async _collectRawRecords() {
+    try {
+      const records = [];
+      while (!this._closed) {
+        if (this._signal?.aborted) {
+          break;
+        }
+        while (this._bufferIndex < this._buffer.length) {
+          const rawRow = this._buffer[this._bufferIndex];
+          if (rawRow) {
+            this._bufferIndex++;
+            this._rowCount++;
+            records.push(rawRow);
+          }
+        }
+        if (this._final) {
+          break;
+        }
+        const { rows, final } = await this._conn._fetchNextPage(this._pageSize, this._signal);
+        this._buffer = rows;
+        this._bufferIndex = 0;
+        this._final = final;
+      }
+      return records;
+    } finally {
+      this.close();
+    }
+  }
   /**
    * Get all remaining rows as an array.
    */
@@ -4379,39 +4628,27 @@ var Connection = class _Connection {
     await conn.hello();
     return conn;
   }
-  /**
-   * Get connection configuration.
-   */
+  /** Get connection configuration. */
   get config() {
     return this._config;
   }
-  /**
-   * Get current connection state.
-   */
+  /** Get current connection state. */
   get state() {
     return this._state;
   }
-  /**
-   * Check if connection is in a transaction.
-   */
+  /** Check if connection is in a transaction. */
   get inTransaction() {
     return this._inTransaction;
   }
-  /**
-   * Check if connection is closed.
-   */
+  /** Check if connection is closed. */
   get isClosed() {
     return this._state === "closed" || this._transport.isClosed();
   }
-  /**
-   * Get session ID.
-   */
+  /** Get session ID. */
   get sessionId() {
     return this._sessionId;
   }
-  /**
-   * Perform the HELLO handshake.
-   */
+  /** Perform the HELLO handshake. */
   async hello() {
     const msg = buildHelloRequest(
       this._config.username ?? "",
@@ -4420,8 +4657,8 @@ var Connection = class _Connection {
       this._config.helloVersion,
       this._config.conformance
     );
-    await this._transport.sendProto(msg);
-    const response = await this._transport.receiveProto();
+    await this._sendWithTimeout(msg);
+    const response = await this._receiveWithTimeout();
     if (response.hello) {
       if (!response.hello.success) {
         const hasCredentials = Boolean(this._config.username) || Boolean(this._config.password);
@@ -4444,9 +4681,7 @@ var Connection = class _Connection {
       });
     }
   }
-  /**
-   * Execute a query that returns rows.
-   */
+  /** Execute a query that returns rows. */
   async query(query2, options) {
     this.checkState("query");
     validateQuery(query2);
@@ -4455,11 +4690,14 @@ var Connection = class _Connection {
       validateParamValue(value);
     }
     const signal = options?.signal;
+    if (options?.pageSize !== void 0) {
+      validatePageSize(options.pageSize);
+    }
     try {
       this._state = "fetching";
       const msg = buildExecuteRequest(this._sessionId, query2, params);
-      await this._transport.sendProto(msg, signal);
-      const response = await this._transport.receiveProto(signal);
+      await this._sendWithTimeout(msg, signal);
+      const response = await this._receiveWithTimeout(signal);
       if (!response.execute) {
         this._state = this._inTransaction ? "in_transaction" : "idle";
         throw new TransportError({
@@ -4503,9 +4741,10 @@ var Connection = class _Connection {
       if (!isFinal && initialRows.length === 0) {
         this._requestId++;
         const pageSize = options?.pageSize ?? this._config.pageSize;
+        validatePageSize(pageSize);
         const pullMsg = buildPullRequest(this._requestId, pageSize, this._sessionId);
-        await this._transport.sendProto(pullMsg, signal);
-        const pullResponse = await this._transport.receiveProto(signal);
+        await this._sendWithTimeout(pullMsg, signal);
+        const pullResponse = await this._receiveWithTimeout(signal);
         const pullExec = pullResponse.pull?.response ?? pullResponse.execute;
         if (pullExec) {
           if (isErrorResponse(pullExec)) {
@@ -4521,6 +4760,8 @@ var Connection = class _Connection {
           }
         }
       }
+      const resultPageSize = options?.pageSize ?? this._config.pageSize;
+      validatePageSize(resultPageSize);
       const result = new QueryResult(
         this,
         columns,
@@ -4528,7 +4769,7 @@ var Connection = class _Connection {
         isFinal,
         isOrdered,
         orderKeys,
-        options?.pageSize ?? this._config.pageSize,
+        resultPageSize,
         signal
       );
       this._activeResult = result;
@@ -4538,25 +4779,12 @@ var Connection = class _Connection {
       throw e;
     }
   }
-  /**
-   * Execute a query and return all rows as an array.
-   */
+  /** Execute a query and return all rows as an array. */
   async queryAll(query2, options) {
     const result = await this.query(query2, options);
-    const rows = [];
-    for await (const row of result) {
-      const obj = {};
-      for (const col of result.columns) {
-        const value = row.get(col.name);
-        obj[col.name] = value?.toJS();
-      }
-      rows.push(obj);
-    }
-    return rows;
+    return result._collectRawRecords();
   }
-  /**
-   * Execute a query that doesn't return rows.
-   */
+  /** Execute a query that doesn't return rows. */
   async exec(query2, options) {
     this.checkState("exec");
     validateQuery(query2);
@@ -4568,8 +4796,8 @@ var Connection = class _Connection {
     try {
       this._state = "executing";
       const msg = buildExecuteRequest(this._sessionId, query2, params);
-      await this._transport.sendProto(msg, signal);
-      const response = await this._transport.receiveProto(signal);
+      await this._sendWithTimeout(msg, signal);
+      const response = await this._receiveWithTimeout(signal);
       if (!response.execute) {
         throw new TransportError({
           operation: "exec",
@@ -4583,25 +4811,29 @@ var Connection = class _Connection {
       if (isSchemaResponse(execResp)) {
         this._columns = execResp.schema.columns;
         const inlineResponse = await this._tryReceiveInline(signal);
-        if (inlineResponse?.execute && isErrorResponse(inlineResponse.execute)) {
-          throw protoErrorToDriverError(
-            inlineResponse.execute,
-            inlineResponse.execute.status?.statusClass
-          );
+        if (inlineResponse?.execute) {
+          if (isErrorResponse(inlineResponse.execute)) {
+            throw protoErrorToDriverError(
+              inlineResponse.execute,
+              inlineResponse.execute.status?.statusClass
+            );
+          }
+          if (isDataPageResponse(inlineResponse.execute) && !inlineResponse.execute.page.final) {
+            await this._drainRemainingPages(signal);
+          }
         }
       }
     } finally {
       this._state = this._inTransaction ? "in_transaction" : "idle";
     }
   }
-  /**
-   * Fetch the next page of results (internal).
-   */
+  /** @internal Fetch the next page of results. Called by QueryResult. */
   async _fetchNextPage(pageSize, signal) {
+    validatePageSize(pageSize);
     this._requestId++;
     const pullMsg = buildPullRequest(this._requestId, pageSize, this._sessionId);
-    await this._transport.sendProto(pullMsg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(pullMsg, signal);
+    const response = await this._receiveWithTimeout(signal);
     const execResp = response.pull?.response ?? response.execute;
     if (!execResp) {
       return { rows: [], final: true };
@@ -4618,47 +4850,63 @@ var Connection = class _Connection {
     }
     return { rows: [], final: true };
   }
-  /**
-   * Try to receive an inline response with short timeout.
-   */
+  /** Try to receive an inline response with short timeout. */
   async _tryReceiveInline(signal) {
     if (signal?.aborted) {
       return null;
     }
-    const controller = new AbortController();
-    const timeoutId = setTimeout(() => controller.abort(), 5e3);
+    const inlineTimeoutMs = this._config.inlineTimeout ?? 5e3;
+    const { signal: timeoutSignal, cleanup } = withAbortTimeout(signal, inlineTimeoutMs);
     try {
-      const response = await this._transport.receiveProto(controller.signal);
-      return response;
+      return await this._transport.receiveProto(timeoutSignal);
     } catch (err) {
       if (err instanceof TransportError && err.cause?.message === "Aborted") {
         return null;
       }
-      throw err;
-    } finally {
-      clearTimeout(timeoutId);
+      throw err;
+    } finally {
+      cleanup();
+    }
+  }
+  /** Drain remaining data pages until final=true to prevent query corruption (QUAL-T7). */
+  async _drainRemainingPages(signal) {
+    let done = false;
+    while (!done) {
+      this._requestId++;
+      const pageSize = this._config.pageSize;
+      const pullMsg = buildPullRequest(this._requestId, pageSize, this._sessionId);
+      await this._sendWithTimeout(pullMsg, signal);
+      const response = await this._receiveWithTimeout(signal);
+      const pullExec = response.pull?.response ?? response.execute;
+      if (!pullExec) {
+        break;
+      }
+      if (isErrorResponse(pullExec)) {
+        throw protoErrorToDriverError(pullExec, pullExec.status?.statusClass);
+      }
+      if (isDataPageResponse(pullExec)) {
+        done = pullExec.page.final;
+      } else {
+        done = true;
+      }
     }
   }
-  /**
-   * Release active result (internal).
-   */
+  /** @internal Release the active result, returning the connection to idle. */
   _releaseResult(result) {
     if (this._activeResult === result) {
       this._activeResult = null;
       this._state = this._inTransaction ? "in_transaction" : "idle";
     }
   }
-  /**
-   * Begin a transaction.
-   */
+  /** Begin a transaction. */
   async begin(signal) {
     this.checkState("begin");
     if (this._inTransaction) {
-      throw ErrTxInProgress;
+      throw ErrTxInProgress();
     }
     const msg = buildBeginRequest(false, this._sessionId);
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (response.begin) {
       if (response.begin.sessionId) {
         this._sessionId = response.begin.sessionId;
@@ -4673,13 +4921,11 @@ var Connection = class _Connection {
     this._state = "in_transaction";
     return new Transaction(this);
   }
-  /**
-   * Commit the current transaction (internal).
-   */
+  /** @internal Commit the current transaction. Called by Transaction. */
   async _commit(signal) {
     const msg = buildCommitRequest(this._sessionId);
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (!response.commit) {
       throw new TransportError({
         operation: "commit",
@@ -4697,13 +4943,11 @@ var Connection = class _Connection {
     this._inTransaction = false;
     this._state = "idle";
   }
-  /**
-   * Rollback the current transaction (internal).
-   */
+  /** @internal Rollback the current transaction. Called by Transaction. */
   async _rollback(signal) {
     const msg = buildRollbackRequest(this._sessionId);
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (!response.rollback) {
       throw new TransportError({
         operation: "rollback",
@@ -4713,14 +4957,12 @@ var Connection = class _Connection {
     this._inTransaction = false;
     this._state = "idle";
   }
-  /**
-   * Create a savepoint (internal).
-   */
+  /** @internal Create a named savepoint. Called by Transaction. */
   async _savepoint(name, signal) {
     validateSavepointName(name);
     const msg = buildSavepointRequest(name, this._sessionId);
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (!response.savepoint) {
       throw new TransportError({
         operation: "savepoint",
@@ -4736,14 +4978,12 @@ var Connection = class _Connection {
       });
     }
   }
-  /**
-   * Rollback to a savepoint (internal).
-   */
+  /** @internal Rollback to a previously created savepoint. Called by Transaction. */
   async _rollbackTo(name, signal) {
     validateSavepointName(name);
     const msg = buildRollbackToRequest(name, this._sessionId);
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (!response.rollbackTo) {
       throw new TransportError({
         operation: "rollback_to",
@@ -4759,16 +4999,14 @@ var Connection = class _Connection {
       });
     }
   }
-  /**
-   * Ping the server to check connection health.
-   */
+  /** Ping the server to check connection health. */
   async ping(signal) {
     if (this._state === "closed") {
-      throw ErrClosed;
+      throw ErrClosed();
     }
     const msg = buildPingRequest();
-    await this._transport.sendProto(msg, signal);
-    const response = await this._transport.receiveProto(signal);
+    await this._sendWithTimeout(msg, signal);
+    const response = await this._receiveWithTimeout(signal);
     if (!response.ping) {
       throw new TransportError({
         operation: "ping",
@@ -4782,12 +5020,10 @@ var Connection = class _Connection {
       });
     }
   }
-  /**
-   * Reset the connection session.
-   */
+  /** Reset the connection session. */
   async reset(signal) {
     if (this._state === "closed") {
-      throw ErrClosed;
+      throw ErrClosed();
     }
     if (this._inTransaction) {
       await this._rollback(signal);
@@ -4795,9 +5031,7 @@ var Connection = class _Connection {
     this._state = "idle";
     this._activeResult = null;
   }
-  /**
-   * Close the connection.
-   */
+  /** Close the connection. */
   async close() {
     if (this._state === "closed") {
       return;
@@ -4809,48 +5043,60 @@ var Connection = class _Connection {
     }
     await this._transport.close();
   }
-  /**
-   * Create a prepared statement.
-   */
+  /** Create a prepared statement. */
   async prepare(query2) {
     const { PreparedStatement: PreparedStatement2 } = await Promise.resolve().then(() => (init_prepared(), prepared_exports));
     return new PreparedStatement2(this, query2);
   }
-  /**
-   * Get the query execution plan without executing.
-   */
+  /** Get the query execution plan without executing. */
   async explain(query2, options) {
-    const { explain: doExplain } = await Promise.resolve().then(() => (init_explain(), explain_exports));
+    const { explain: doExplain } = await init_explain().then(() => explain_exports);
     return doExplain(this, query2, options);
   }
-  /**
-   * Execute a query with profiling.
-   */
+  /** Execute a query with profiling. */
   async profile(query2, options) {
-    const { profile: doProfile } = await Promise.resolve().then(() => (init_explain(), explain_exports));
+    const { profile: doProfile } = await init_explain().then(() => explain_exports);
     return doProfile(this, query2, options);
   }
-  /**
-   * Execute multiple queries in a batch.
-   */
+  /** Execute multiple queries in a batch. */
   async batch(queries, options) {
     const { batch: doBatch } = await init_batch().then(() => batch_exports);
     return doBatch(this, queries, options);
   }
-  /**
-   * Check connection state before operation.
-   */
+  /** Check connection state before operation. */
   checkState(operation) {
     if (this._state === "closed") {
-      throw ErrClosed;
+      throw ErrClosed();
     }
     if (this._state === "fetching" || this._activeResult) {
-      throw ErrQueryInProgress;
+      throw ErrQueryInProgress();
     }
     if (operation === "begin" && this._inTransaction) {
-      throw ErrTxInProgress;
+      throw ErrTxInProgress();
+    }
+  }
+  /** Send a protobuf message with request timeout enforcement. */
+  async _sendWithTimeout(msg, signal) {
+    const { signal: timeoutSignal, cleanup } = this._withRequestTimeout(signal);
+    try {
+      await this._transport.sendProto(msg, timeoutSignal);
+    } finally {
+      cleanup();
     }
   }
+  /** Receive a protobuf message with request timeout enforcement. */
+  async _receiveWithTimeout(signal) {
+    const { signal: timeoutSignal, cleanup } = this._withRequestTimeout(signal);
+    try {
+      return await this._transport.receiveProto(timeoutSignal);
+    } finally {
+      cleanup();
+    }
+  }
+  /** Create a combined abort signal from requestTimeout and optional caller signal (CWE-703). */
+  _withRequestTimeout(signal) {
+    return withAbortTimeout(signal, this._config.requestTimeout);
+  }
 };
 
 // src/pool.ts
@@ -4938,6 +5184,9 @@ var ConnectionPool = class _ConnectionPool {
     this._maintenanceInterval = setInterval(() => {
       this.maintenance();
     }, 1e4);
+    if (this._maintenanceInterval.unref) {
+      this._maintenanceInterval.unref();
+    }
   }
   /**
    * Create a new connection pool.
@@ -4960,11 +5209,16 @@ var ConnectionPool = class _ConnectionPool {
    * Get pool statistics.
    */
   get stats() {
-    const available = this._connections.filter((c) => !c.inUse).length;
-    const inUse = this._connections.filter((c) => c.inUse).length;
+    let inUse = 0;
+    for (const c of this._connections) {
+      if (c.inUse) {
+        inUse++;
+      }
+    }
+    const total = this._connections.length;
     return {
-      total: this._connections.length,
-      available,
+      total,
+      available: total - inUse,
       inUse,
       waiting: this._waitQueue.length
     };
@@ -4980,7 +5234,7 @@ var ConnectionPool = class _ConnectionPool {
    */
   async acquire(signal) {
     if (this._closed) {
-      throw ErrClosed;
+      throw ErrClosed();
     }
     if (signal?.aborted) {
       throw new TransportError({ operation: "acquire", cause: new Error("Aborted") });
@@ -5016,24 +5270,25 @@ var ConnectionPool = class _ConnectionPool {
           })
         );
       }, this._acquireTimeout);
+      let onAbort = null;
       const cleanup = () => {
         clearTimeout(timeout);
+        if (signal && onAbort) {
+          signal.removeEventListener("abort", onAbort);
+        }
       };
       if (signal) {
-        signal.addEventListener(
-          "abort",
-          () => {
-            cleanup();
-            const idx = this._waitQueue.findIndex(
-              (w) => w.resolve === resolve2 && w.reject === reject
-            );
-            if (idx !== -1) {
-              this._waitQueue.splice(idx, 1);
-            }
-            reject(new TransportError({ operation: "acquire", cause: new Error("Aborted") }));
-          },
-          { once: true }
-        );
+        onAbort = () => {
+          cleanup();
+          const idx = this._waitQueue.findIndex(
+            (w) => w.resolve === resolve2 && w.reject === reject
+          );
+          if (idx !== -1) {
+            this._waitQueue.splice(idx, 1);
+          }
+          reject(new TransportError({ operation: "acquire", cause: new Error("Aborted") }));
+        };
+        signal.addEventListener("abort", onAbort, { once: true });
       }
       this._waitQueue.push({
         resolve: (conn) => {
@@ -5126,7 +5381,7 @@ var ConnectionPool = class _ConnectionPool {
       this._maintenanceInterval = void 0;
     }
     for (const waiter of this._waitQueue) {
-      waiter.reject(ErrClosed);
+      waiter.reject(ErrClosed());
     }
     this._waitQueue = [];
     const closePromises = this._connections.map(async (c) => {
@@ -5142,6 +5397,9 @@ var ConnectionPool = class _ConnectionPool {
    * Add a new connection to the pool with rate limiting and exponential backoff.
    */
   async addConnection() {
+    if (this._connections.length >= this._maxConnections) {
+      return;
+    }
     if (!this._rateLimiter.isAllowed()) {
       throw new TransportError({
         operation: "connect",
@@ -5186,7 +5444,8 @@ var ConnectionPool = class _ConnectionPool {
     }
     const now = Date.now();
     const idleConnections = this._connections.filter((c) => !c.inUse && now - c.lastUsedAt > this._idleTimeout).sort((a, b) => a.lastUsedAt - b.lastUsedAt);
-    const toRemove = Math.max(0, idleConnections.length - this._minConnections);
+    const activeCount = this._connections.filter((c) => !c.connection.isClosed).length;
+    const toRemove = Math.max(0, activeCount - this._minConnections);
     for (let i = 0; i < toRemove; i++) {
       const conn = idleConnections[i];
       if (conn) {
@@ -5221,10 +5480,8 @@ var GeodeClient = class _GeodeClient {
    * Create a new client from a DSN string.
    */
   static async connect(dsn, options) {
-    const config = parseDSN(dsn);
-    if (options) {
-      Object.assign(config, options);
-    }
+    const baseConfig = parseDSN(dsn);
+    const config = options ? { ...baseConfig, ...options } : baseConfig;
     const usePool = options?.pooling ?? true;
     const client = new _GeodeClient(config);
     if (usePool) {
@@ -5337,10 +5594,27 @@ var GeodeClient = class _GeodeClient {
   }
   /**
    * Execute multiple statements.
+   *
+   * When a connection pool is available, all queries are executed within a
+   * single transaction to reduce round-trips (one BEGIN + N queries + COMMIT
+   * instead of N independent round-trips with connection acquire/release).
+   *
+   * For non-pooled (single connection) clients, queries are executed
+   * sequentially without an implicit transaction wrapper, preserving the
+   * caller's control over transaction boundaries.
    */
   async execBatch(queries) {
-    for (const q of queries) {
-      await this.exec(q.query, { params: q.params });
+    if (queries.length === 0) return;
+    if (this._pool) {
+      await this.withTransaction(async (tx) => {
+        for (const q of queries) {
+          await tx.exec(q.query, { params: q.params });
+        }
+      });
+    } else {
+      for (const q of queries) {
+        await this.exec(q.query, { params: q.params });
+      }
     }
   }
   /**
@@ -5564,11 +5838,16 @@ var GeodeClient = class _GeodeClient {
    * ```
    */
   async prepare(query2) {
+    const { PreparedStatement: PreparedStatement2 } = await Promise.resolve().then(() => (init_prepared(), prepared_exports));
     const conn = await this.getConnection();
     try {
-      return conn.prepare(query2);
-    } finally {
+      const stmt = new PreparedStatement2(conn, query2, () => {
+        void this.releaseConnection(conn);
+      });
+      return stmt;
+    } catch (err) {
       await this.releaseConnection(conn);
+      throw err;
     }
   }
   /**
@@ -5652,25 +5931,242 @@ var GeodeClient = class _GeodeClient {
   async auth() {
     const { AuthClient: AuthClient2 } = await Promise.resolve().then(() => (init_auth(), auth_exports));
     const conn = await this.getConnection();
-    return new AuthClient2(conn);
+    return new AuthClient2(conn, void 0, () => {
+      void this.releaseConnection(conn);
+    });
+  }
+};
+async function createClient(dsn, options) {
+  return GeodeClient.connect(dsn, options);
+}
+async function createClientWithConfig(config, options) {
+  return GeodeClient.connectWithConfig(config, options);
+}
+
+// src/index.ts
+init_config();
+await init_types();
+init_errors();
+await init_transport();
+await init_grpc_transport();
+init_validate();
+
+// src/query-builder.ts
+init_validate();
+
+// src/predicate-builder.ts
+init_validate();
+var _predicateRawWarned = false;
+var PredicateBuilder = class {
+  _predicates = [];
+  _params = {};
+  _paramCounter = 0;
+  /**
+   * Add a comparison predicate.
+   */
+  compare(left, op, right) {
+    if (op === "IS NULL") {
+      this._predicates.push(`${left} IS NULL`);
+    } else if (op === "IS NOT NULL") {
+      this._predicates.push(`${left} IS NOT NULL`);
+    } else {
+      const paramName = this.nextParam();
+      this._predicates.push(`${left} ${op} $${paramName}`);
+      this._params[paramName] = right;
+    }
+    return this;
+  }
+  /**
+   * Add an equality predicate.
+   */
+  eq(left, right) {
+    return this.compare(left, "=", right);
+  }
+  /**
+   * Add a not-equal predicate.
+   */
+  neq(left, right) {
+    return this.compare(left, "<>", right);
+  }
+  /**
+   * Add a less-than predicate.
+   */
+  lt(left, right) {
+    return this.compare(left, "<", right);
+  }
+  /**
+   * Add a less-than-or-equal predicate.
+   */
+  lte(left, right) {
+    return this.compare(left, "<=", right);
+  }
+  /**
+   * Add a greater-than predicate.
+   */
+  gt(left, right) {
+    return this.compare(left, ">", right);
+  }
+  /**
+   * Add a greater-than-or-equal predicate.
+   */
+  gte(left, right) {
+    return this.compare(left, ">=", right);
+  }
+  /**
+   * Add an IN predicate.
+   */
+  in(left, values) {
+    const paramName = this.nextParam();
+    this._predicates.push(`${left} IN $${paramName}`);
+    this._params[paramName] = values;
+    return this;
+  }
+  /**
+   * Add a NOT IN predicate.
+   */
+  notIn(left, values) {
+    const paramName = this.nextParam();
+    this._predicates.push(`${left} NOT IN $${paramName}`);
+    this._params[paramName] = values;
+    return this;
+  }
+  /**
+   * Add a CONTAINS predicate.
+   */
+  contains(left, value) {
+    return this.compare(left, "CONTAINS", value);
+  }
+  /**
+   * Add a STARTS WITH predicate.
+   */
+  startsWith(left, value) {
+    return this.compare(left, "STARTS WITH", value);
+  }
+  /**
+   * Add an ENDS WITH predicate.
+   */
+  endsWith(left, value) {
+    return this.compare(left, "ENDS WITH", value);
+  }
+  /**
+   * Add an IS NULL predicate.
+   */
+  isNull(expr) {
+    return this.compare(expr, "IS NULL", null);
+  }
+  /**
+   * Add an IS NOT NULL predicate.
+   */
+  isNotNull(expr) {
+    return this.compare(expr, "IS NOT NULL", null);
+  }
+  /**
+   * Add a raw predicate expression.
+   *
+   * **SECURITY WARNING: This method bypasses all input validation.**
+   *
+   * Using raw() with user-supplied input can lead to GQL injection attacks.
+   * Only use this method when:
+   * 1. The expression is entirely constructed from trusted, hardcoded strings
+   * 2. All dynamic values are passed via the `params` argument (using $paramName syntax)
+   *
+   * @example
+   * ```typescript
+   * // SAFE: Using parameters for dynamic values
+   * predicate().raw('n.custom_field CONTAINS $pattern', { pattern: userInput })
+   *
+   * // UNSAFE: Never interpolate user input directly
+   * predicate().raw(`n.name = '${userInput}'`) // VULNERABLE TO INJECTION!
+   * ```
+   *
+   * Consider using the typed predicate methods (eq, gt, contains, etc.) instead.
+   *
+   * @param expr - Raw predicate expression (MUST be trusted input)
+   * @param params - Parameters to bind (safe for user input)
+   * @deprecated Consider using typed predicate methods instead for better security.
+   */
+  raw(expr, params) {
+    if (!_predicateRawWarned) {
+      _predicateRawWarned = true;
+      process.emitWarning(
+        "PredicateBuilder.raw() is deprecated and bypasses input validation. Use typed predicate methods (eq, gt, contains, etc.) instead.",
+        "DeprecationWarning"
+      );
+    }
+    this._predicates.push(expr);
+    if (params) {
+      this._params = { ...this._params, ...params };
+    }
+    return this;
+  }
+  /**
+   * Combine predicates with AND.
+   */
+  and(builder) {
+    const sub = builder.build();
+    if (sub.predicate) {
+      this._predicates.push(`(${sub.predicate})`);
+      this._params = { ...this._params, ...sub.params };
+    }
+    return this;
+  }
+  /**
+   * Combine predicates with OR.
+   */
+  or(builder) {
+    const sub = builder.build();
+    if (sub.predicate) {
+      if (this._predicates.length > 0) {
+        const current = this._predicates.join(" AND ");
+        this._predicates = [`(${current}) OR (${sub.predicate})`];
+      } else {
+        this._predicates.push(sub.predicate);
+      }
+      this._params = { ...this._params, ...sub.params };
+    }
+    return this;
+  }
+  /**
+   * Build the predicate.
+   */
+  build() {
+    return {
+      predicate: this._predicates.join(" AND "),
+      params: this._params
+    };
+  }
+  nextParam() {
+    return `pred_${++this._paramCounter}`;
   }
 };
-async function createClient(dsn, options) {
-  return GeodeClient.connect(dsn, options);
+function propsToGQL(props) {
+  const entries = Object.entries(props).map(([k, v]) => {
+    validatePropertyName(k);
+    return `${k}: ${valueToGQL(v)}`;
+  });
+  return `{${entries.join(", ")}}`;
 }
-async function createClientWithConfig(config, options) {
-  return GeodeClient.connectWithConfig(config, options);
+function valueToGQL(value) {
+  if (value === null || value === void 0) {
+    return "null";
+  }
+  if (typeof value === "string") {
+    return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
+  }
+  if (typeof value === "number" || typeof value === "boolean") {
+    return String(value);
+  }
+  if (Array.isArray(value)) {
+    return `[${value.map(valueToGQL).join(", ")}]`;
+  }
+  if (typeof value === "object") {
+    return propsToGQL(value);
+  }
+  return String(value);
 }
 
-// src/index.ts
-init_config();
-await init_types();
-init_errors();
-init_grpc_transport();
-init_validate();
-
 // src/query-builder.ts
-init_validate();
+var _queryRawWarned = false;
 var NodePatternBuilder = class {
   _variable;
   _labels = [];
@@ -5716,7 +6212,7 @@ var NodePatternBuilder = class {
     for (const key of Object.keys(properties)) {
       validatePropertyName(key);
     }
-    Object.assign(this._properties, properties);
+    this._properties = { ...this._properties, ...properties };
     return this;
   }
   /**
@@ -5812,7 +6308,7 @@ var EdgePatternBuilder = class {
     for (const key of Object.keys(properties)) {
       validatePropertyName(key);
     }
-    Object.assign(this._properties, properties);
+    this._properties = { ...this._properties, ...properties };
     return this;
   }
   /**
@@ -5936,181 +6432,6 @@ var PatternBuilder = class {
     return result;
   }
 };
-var PredicateBuilder = class {
-  _predicates = [];
-  _params = {};
-  _paramCounter = 0;
-  /**
-   * Add a comparison predicate.
-   */
-  compare(left, op, right) {
-    if (op === "IS NULL") {
-      this._predicates.push(`${left} IS NULL`);
-    } else if (op === "IS NOT NULL") {
-      this._predicates.push(`${left} IS NOT NULL`);
-    } else {
-      const paramName = this.nextParam();
-      this._predicates.push(`${left} ${op} $${paramName}`);
-      this._params[paramName] = right;
-    }
-    return this;
-  }
-  /**
-   * Add an equality predicate.
-   */
-  eq(left, right) {
-    return this.compare(left, "=", right);
-  }
-  /**
-   * Add a not-equal predicate.
-   */
-  neq(left, right) {
-    return this.compare(left, "<>", right);
-  }
-  /**
-   * Add a less-than predicate.
-   */
-  lt(left, right) {
-    return this.compare(left, "<", right);
-  }
-  /**
-   * Add a less-than-or-equal predicate.
-   */
-  lte(left, right) {
-    return this.compare(left, "<=", right);
-  }
-  /**
-   * Add a greater-than predicate.
-   */
-  gt(left, right) {
-    return this.compare(left, ">", right);
-  }
-  /**
-   * Add a greater-than-or-equal predicate.
-   */
-  gte(left, right) {
-    return this.compare(left, ">=", right);
-  }
-  /**
-   * Add an IN predicate.
-   */
-  in(left, values) {
-    const paramName = this.nextParam();
-    this._predicates.push(`${left} IN $${paramName}`);
-    this._params[paramName] = values;
-    return this;
-  }
-  /**
-   * Add a NOT IN predicate.
-   */
-  notIn(left, values) {
-    const paramName = this.nextParam();
-    this._predicates.push(`${left} NOT IN $${paramName}`);
-    this._params[paramName] = values;
-    return this;
-  }
-  /**
-   * Add a CONTAINS predicate.
-   */
-  contains(left, value) {
-    return this.compare(left, "CONTAINS", value);
-  }
-  /**
-   * Add a STARTS WITH predicate.
-   */
-  startsWith(left, value) {
-    return this.compare(left, "STARTS WITH", value);
-  }
-  /**
-   * Add an ENDS WITH predicate.
-   */
-  endsWith(left, value) {
-    return this.compare(left, "ENDS WITH", value);
-  }
-  /**
-   * Add an IS NULL predicate.
-   */
-  isNull(expr) {
-    return this.compare(expr, "IS NULL", null);
-  }
-  /**
-   * Add an IS NOT NULL predicate.
-   */
-  isNotNull(expr) {
-    return this.compare(expr, "IS NOT NULL", null);
-  }
-  /**
-   * Add a raw predicate expression.
-   *
-   * **⚠️ SECURITY WARNING: This method bypasses all input validation.**
-   *
-   * Using raw() with user-supplied input can lead to GQL injection attacks.
-   * Only use this method when:
-   * 1. The expression is entirely constructed from trusted, hardcoded strings
-   * 2. All dynamic values are passed via the `params` argument (using $paramName syntax)
-   *
-   * @example
-   * ```typescript
-   * // SAFE: Using parameters for dynamic values
-   * predicate().raw('n.custom_field CONTAINS $pattern', { pattern: userInput })
-   *
-   * // UNSAFE: Never interpolate user input directly
-   * predicate().raw(`n.name = '${userInput}'`) // VULNERABLE TO INJECTION!
-   * ```
-   *
-   * Consider using the typed predicate methods (eq, gt, contains, etc.) instead.
-   *
-   * @param expr - Raw predicate expression (MUST be trusted input)
-   * @param params - Parameters to bind (safe for user input)
-   * @deprecated Consider using typed predicate methods instead for better security.
-   */
-  raw(expr, params) {
-    this._predicates.push(expr);
-    if (params) {
-      Object.assign(this._params, params);
-    }
-    return this;
-  }
-  /**
-   * Combine predicates with AND.
-   */
-  and(builder) {
-    const sub = builder.build();
-    if (sub.predicate) {
-      this._predicates.push(`(${sub.predicate})`);
-      Object.assign(this._params, sub.params);
-    }
-    return this;
-  }
-  /**
-   * Combine predicates with OR.
-   */
-  or(builder) {
-    const sub = builder.build();
-    if (sub.predicate) {
-      if (this._predicates.length > 0) {
-        const current = this._predicates.join(" AND ");
-        this._predicates = [`(${current}) OR (${sub.predicate})`];
-      } else {
-        this._predicates.push(sub.predicate);
-      }
-      Object.assign(this._params, sub.params);
-    }
-    return this;
-  }
-  /**
-   * Build the predicate.
-   */
-  build() {
-    return {
-      predicate: this._predicates.join(" AND "),
-      params: this._params
-    };
-  }
-  nextParam() {
-    return `pred_${++this._paramCounter}`;
-  }
-};
 var QueryBuilder = class {
   _clauses = [];
   _params = {};
@@ -6132,37 +6453,17 @@ var QueryBuilder = class {
   }
   /**
    * Add a WHERE clause.
-   *
-   * **⚠️ SECURITY WARNING when using string predicates:**
-   *
-   * When passing a string predicate, this method does NOT validate or sanitize input.
-   * Using string predicates with user-supplied data can lead to GQL injection attacks.
-   *
-   * @example
-   * ```typescript
-   * // RECOMMENDED: Use PredicateBuilder for type-safe, injection-resistant queries
-   * query().where(predicate().eq('n.name', userInput))
-   *
-   * // SAFE: Using parameters with string predicates
-   * query().where('n.name = $name', { name: userInput })
-   *
-   * // UNSAFE: Never interpolate user input directly in string predicates
-   * query().where(`n.name = '${userInput}'`) // VULNERABLE TO INJECTION!
-   * ```
-   *
-   * @param predicate - A PredicateBuilder (recommended) or raw predicate string
-   * @param params - Parameters to bind when using string predicates
    */
   where(predicate2, params) {
     if (typeof predicate2 === "string") {
       this._clauses.push(`WHERE ${predicate2}`);
       if (params) {
-        Object.assign(this._params, params);
+        this._params = { ...this._params, ...params };
       }
     } else {
       const built = predicate2.build();
       this._clauses.push(`WHERE ${built.predicate}`);
-      Object.assign(this._params, built.params);
+      this._params = { ...this._params, ...built.params };
     }
     return this;
   }
@@ -6261,32 +6562,23 @@ var QueryBuilder = class {
   /**
    * Add a raw GQL clause.
    *
-   * **⚠️ SECURITY WARNING: This method bypasses all input validation.**
-   *
-   * Using raw() with user-supplied input can lead to GQL injection attacks.
-   * Only use this method when:
-   * 1. The clause is entirely constructed from trusted, hardcoded strings
-   * 2. All dynamic values are passed via the `params` argument (using $paramName syntax)
-   *
-   * @example
-   * ```typescript
-   * // SAFE: Using parameters for dynamic values
-   * query().raw('CALL db.index.fulltext.queryNodes("idx", $term)', { term: userInput })
-   *
-   * // UNSAFE: Never interpolate user input directly
-   * query().raw(`MATCH (n:${userLabel})`) // VULNERABLE TO INJECTION!
-   * ```
-   *
-   * Consider using the typed query builder methods instead.
+   * **SECURITY WARNING: This method bypasses all input validation.**
    *
    * @param clause - Raw GQL clause (MUST be trusted input)
    * @param params - Parameters to bind (safe for user input)
    * @deprecated Consider using typed query builder methods instead for better security.
    */
   raw(clause, params) {
+    if (!_queryRawWarned) {
+      _queryRawWarned = true;
+      process.emitWarning(
+        "QueryBuilder.raw() is deprecated and bypasses input validation. Use typed query builder methods instead.",
+        "DeprecationWarning"
+      );
+    }
     this._clauses.push(clause);
     if (params) {
-      Object.assign(this._params, params);
+      this._params = { ...this._params, ...params };
     }
     return this;
   }
@@ -6294,14 +6586,14 @@ var QueryBuilder = class {
    * Add a parameter.
    */
   param(name, value) {
-    this._params[name] = value;
+    this._params = { ...this._params, [name]: value };
     return this;
   }
   /**
    * Add multiple parameters.
    */
   params(params) {
-    Object.assign(this._params, params);
+    this._params = { ...this._params, ...params };
     return this;
   }
   /**
@@ -6326,28 +6618,6 @@ var QueryBuilder = class {
     return { ...this._params };
   }
 };
-function propsToGQL(props) {
-  const entries = Object.entries(props).map(([k, v]) => `${k}: ${valueToGQL(v)}`);
-  return `{${entries.join(", ")}}`;
-}
-function valueToGQL(value) {
-  if (value === null || value === void 0) {
-    return "null";
-  }
-  if (typeof value === "string") {
-    return `'${value.replace(/\\/g, "\\\\").replace(/'/g, "\\'")}'`;
-  }
-  if (typeof value === "number" || typeof value === "boolean") {
-    return String(value);
-  }
-  if (Array.isArray(value)) {
-    return `[${value.map(valueToGQL).join(", ")}]`;
-  }
-  if (typeof value === "object") {
-    return propsToGQL(value);
-  }
-  return String(value);
-}
 function nodePatternToGQL(pattern2) {
   let result = "(";
   if (pattern2.variable) {
@@ -6414,11 +6684,11 @@ function edge() {
 
 // src/index.ts
 init_prepared();
-init_explain();
+await init_explain();
 await init_batch();
 init_auth();
-init_proto();
+await init_proto();
 
-export { AuthClient, BaseTransport, ConfigError, Connection, ConnectionPool, DEFAULT_CONFORMANCE, DEFAULT_GRPC_PORT, DEFAULT_HELLO_NAME, DEFAULT_HELLO_VERSION, DEFAULT_PAGE_SIZE, DEFAULT_PORT, DriverError, EdgePatternBuilder, ErrBadConn, ErrClosed, ErrNoTx, ErrQueryInProgress, ErrRowsClosed, ErrTxDone, ErrTxInProgress, GQLValue, GeodeClient, GrpcTransport, MAX_PAGE_SIZE, MAX_QUERY_LENGTH, MockTransport, NodePatternBuilder, PatternBuilder, PredicateBuilder, PreparedStatement, QueryBuilder, QueryResult, QueryResultIterator, QuicTransport, QuicTransport as QuicheTransport, SUPPORTED_SCHEMES, SecurityError, StateError, StatusClass, Transaction, TransportError, batch, batchAll, batchFirst, batchMap, batchParallel, buildBeginRequest, buildCommitRequest, buildExecuteRequest, buildHelloRequest, buildPingRequest, buildPullRequest, buildRollbackRequest, buildRollbackToRequest, buildSavepointRequest, buildTLSConfig, cloneConfig, createAuthClient, createClient, createClientWithConfig, createTransport, decodeLengthPrefix, decodeQuicServerMessage, defaultConfig, edge, encodeQuicClientMessage, encodeWithLengthPrefix, ensureProtoInitialized, explain, extractParameters, formatPlan, formatProfile, fromJSON, getAddress, getProtoPath, isDriverError, isGeodeError, isRetryableError, jsToProtoValue, node, parseDSN, parseGQLType, parseRow, pattern, predicate, prepare, profile, protoValueToJS, query, redactConfig, redactDSN, rowToObject, rowToRecord, sanitizeForLog, validateConfig, validateHostname, validatePageSize, validateParamName, validateParamValue, validatePort, validateQuery, validateSavepointName, withTransaction };
+export { AuthClient, BaseTransport, ConfigError, Connection, ConnectionPool, DEFAULT_CONFORMANCE, DEFAULT_GRPC_PORT, DEFAULT_HELLO_NAME, DEFAULT_HELLO_VERSION, DEFAULT_PAGE_SIZE, DEFAULT_PORT, DriverError, ERR_BAD_CONN_MESSAGE, ERR_CLOSED_MESSAGE, ERR_NO_TX_MESSAGE, ERR_QUERY_IN_PROGRESS_MESSAGE, ERR_ROWS_CLOSED_MESSAGE, ERR_TX_DONE_MESSAGE, ERR_TX_IN_PROGRESS_MESSAGE, EdgePatternBuilder, ErrBadConn, ErrClosed, ErrNoTx, ErrQueryInProgress, ErrRowsClosed, ErrTxDone, ErrTxInProgress, GQLValue, GeodeClient, GrpcTransport, MAX_PAGE_SIZE, MAX_QUERY_LENGTH, MockTransport, NodePatternBuilder, PatternBuilder, PredicateBuilder, PreparedStatement, QueryBuilder, QueryResult, QueryResultIterator, QuicTransport, QuicTransport as QuicheTransport, SUPPORTED_SCHEMES, SecurityError, StateError, StatusClass, Transaction, TransportError, batch, batchAll, batchFirst, batchMap, batchParallel, buildBeginRequest, buildCommitRequest, buildExecuteRequest, buildHelloRequest, buildPingRequest, buildPullRequest, buildRollbackRequest, buildRollbackToRequest, buildSavepointRequest, buildTLSConfig, cloneConfig, createAuthClient, createClient, createClientWithConfig, createTransport, decodeLengthPrefix, decodeQuicServerMessage, defaultConfig, edge, encodeQuicClientMessage, encodeWithLengthPrefix, ensureProtoInitialized, explain, extractParameters, formatPlan, formatProfile, fromJSON, getAddress, getProtoPath, initProtoSync, isDriverError, isGeodeError, isRetryableError, isSentinelError, jsToProtoValue, node, parseDSN, parseGQLType, parseRow, pattern, predicate, prepare, profile, protoValueToJS, query, redactConfig, redactDSN, rowToObject, rowToRecord, sanitizeForLog, validateConfig, validateHostname, validatePageSize, validateParamName, validateParamValue, validatePort, validateQuery, validateSavepointName, withTransaction };
 //# sourceMappingURL=index.js.map
 //# sourceMappingURL=index.js.map