@graphoria/server 0.2.3 → 0.4.0

package/src/databases/engines/mssql/connection.ts

@@ -6,32 +6,78 @@ import type { VariableDefinition } from "../../../analyzeQuery/types";
 import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
+import { MSSQLConnectionOptionsZod } from "../../../config/types/db";
 import { databasesConnections } from "../../../singletons/databases";
+import { getQueryTimeoutMs } from "../../../singletons/queryTimeout";
 import { logger } from "../../../logging";
 
-export const getPool = async (db: Database) => {
+// Every pool bound comes from the schema, which is the only place they are
+// declared and documented. Repeating them here as `?? n` fallbacks let the
+// documented default and the applied one drift apart, differently per engine.
+//
+// Defaults are overlaid rather than re-parsed: `connectionOptions` is an
+// undiscriminated union of the two engine shapes, and an object carrying
+// nothing MSSQL-specific — `{}` included — validates against the Bun SQL shape
+// even on an MSSQL database. A strict re-parse of one of those would reject the
+// Bun SQL keys and take the server down at boot.
+export const poolOptions = (db: Database, timeoutMs: number = getQueryTimeoutMs()) => {
   const ci = db.connection;
-  const opts = db.connectionOptions as MSSQLConnectionOptions | undefined;
-  const pool = new ConnectionPool({
+  const raw = db.connectionOptions as MSSQLConnectionOptions | undefined;
+
+  const defaults = MSSQLConnectionOptionsZod.parse({});
+  const opts = { ...defaults, ...raw, pool: { ...defaults.pool, ...raw?.pool } };
+
+  return {
     server: ci.host,
     port: ci.port,
     user: ci.user,
     password: ci.password,
     database: ci.database,
-    connectionTimeout: opts?.connectionTimeout ? opts.connectionTimeout * 1000 : undefined,
-    requestTimeout: opts?.requestTimeout ? opts.requestTimeout * 1000 : undefined,
+    connectionTimeout: opts.connectionTimeout * 1000,
+    // Only an omitted key falls through to the resolved timeout: reading it off
+    // `opts` cannot tell an operator who set 30 from Zod defaulting to 30, and
+    // silently overriding the first would break the slow report it was raised
+    // for. Seconds there, milliseconds here.
+    requestTimeout: raw?.requestTimeout !== undefined ? raw.requestTimeout * 1000 : timeoutMs,
+    // These three keep their code fallbacks rather than the schema's. Two of
+    // them default the opposite way there, so taking the schema value would
+    // turn certificate validation on and trusted connections off for every
+    // deployment that omits `connectionOptions` — a change to how a connection
+    // is secured, not to how the pool is sized.
     options: {
-      encrypt: opts?.encrypt ?? false,
-      trustServerCertificate: opts?.trustServerCertificate ?? true,
-      trustedConnection: opts?.trustedConnection ?? true,
+      encrypt: raw?.encrypt ?? false,
+      trustServerCertificate: raw?.trustServerCertificate ?? true,
+      trustedConnection: raw?.trustedConnection ?? true,
     },
     pool: {
-      max: opts?.pool?.max ?? 50,
-      min: opts?.pool?.min ?? 1,
-      idleTimeoutMillis: (opts?.pool?.idleTimeout ?? 30) * 1000,
+      max: opts.pool.max,
+      min: opts.pool.min,
+      idleTimeoutMillis: opts.pool.idleTimeout * 1000,
+      acquireTimeoutMillis: opts.pool.acquireTimeout * 1000,
     },
-    parseJSON: opts?.parseJSON ?? true,
-  });
+    parseJSON: opts.parseJSON,
+  };
+};
+
+/** The bound the pool already applies, so the executor can tell an override from the default. */
+export const poolRequestTimeoutMs = (db: Database) => poolOptions(db).requestTimeout;
+
+// `ConnectionPool.request` takes per-request overrides from mssql 12.7.0, which
+// is what the workspace pins, but `@types/mssql@12.3.0` still declares it with
+// no parameter. Narrowed to the one key used rather than cast wholesale, so the
+// day the types catch up this stops compiling and can be deleted.
+//
+// Not interchangeable with assigning `request.timeout`: that property does not
+// exist, and the pool default is used instead.
+type PoolWithRequestOverrides = {
+  request(overrides: { requestTimeout: number }): ReturnType<ConnectionPool["request"]>;
+};
+
+const requestWithTimeout = (pool: ConnectionPool, timeoutMs: number) =>
+  (pool as unknown as PoolWithRequestOverrides).request({ requestTimeout: timeoutMs });
+
+export const getPool = async (db: Database) => {
+  const pool = new ConnectionPool(poolOptions(db));
 
   await pool.connect(); // Connect to the database
 
@@ -52,6 +98,7 @@ export const executeQueryFactory =
     db: Database,
     variablesDefinition: VariableDefinition[] = [],
     params: Record<string, unknown> = {},
+    timeoutMs?: number,
   ) => {
     const pool = singleQuery ? await getPool(db) : await getPoolSingleton(db);
 
@@ -59,7 +106,10 @@ export const executeQueryFactory =
       await new Promise((resolve) => setTimeout(resolve, 1000));
     }
 
-    const request = pool!.request();
+    const request =
+      timeoutMs !== undefined && timeoutMs !== poolRequestTimeoutMs(db)
+        ? requestWithTimeout(pool!, timeoutMs)
+        : pool!.request();
 
     variablesDefinition.forEach((v, i) => {
       const varName = (i + 1).toString();
@@ -93,12 +143,14 @@ export const executeQueryJSONFactory =
     db: Database,
     variablesDefinition: VariableDefinition[] = [],
     params: Record<string, unknown> = {},
+    timeoutMs?: number,
   ): Promise<T> => {
     const result = await (singleQuery ? executeQuerySingle : executeQuery)(
       query,
       db,
       variablesDefinition,
       params,
+      timeoutMs,
     );
 
     return result[0] as T;
@@ -109,7 +161,6 @@ export const executeQueryJSONSingle = executeQueryJSONFactory(true);
 
 export const callStoredProcedure = async (
   sp: ProcedureResolver,
-  variablesDefinition: VariableDefinition[],
   variables: Record<string, unknown> = {},
 ) => {
   try {
@@ -118,8 +169,6 @@ export const callStoredProcedure = async (
     const request = pool!.request();
 
     for (const [key, value] of Object.entries(variables)) {
-      if (!value) continue;
-
       const paramFound = sp.parameters.find((p) => p.name === `@${key}`);
 
       if (paramFound?.dataType === "varchar") {

package/src/databases/engines/mssql/format.ts

@@ -2,6 +2,7 @@ import { format as sqlFormatter } from "sql-formatter";
 
 import type { AnalysisResult } from "../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../configuration/getSchemas/mergeEntities";
+import type { PageLimits } from "../../common";
 
 import { generateSQL } from "../../core/query-builder";
 
@@ -16,8 +17,9 @@ export const genSql = (
   query: AnalysisResult,
   variables: Record<string, unknown> = {},
   hash = false,
+  pageLimits: PageLimits | null = null,
 ) => {
-  const [[, sql]] = generateSQL(entitites, query, variables, hash);
+  const [[, sql]] = generateSQL(entitites, query, variables, hash, pageLimits);
 
   return format(sql);
 };

package/src/databases/engines/mssql/query/index.ts

@@ -4,7 +4,7 @@ import type {
   VariableDefinition,
 } from "../../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../../configuration/getSchemas/mergeEntities";
-import type { GroupByInfo } from "../../../common";
+import type { GroupByInfo, PageLimits } from "../../../common";
 
 import {
   buildOrderByClauseMSSQL,
@@ -164,6 +164,7 @@ export const generateSQL = (
   operation: OperationAnalysis,
   variables: Record<string, unknown> = {},
   forHashMethod: boolean = false,
+  pageLimits: PageLimits | null = null,
 ): string => {
   if (forHashMethod) {
     return `SELECT HASHBYTES('MD5', (
@@ -176,6 +177,7 @@ export const generateSQL = (
           null,
           1,
           {},
+          pageLimits,
         )})
     ) AS ResultHash`;
   }
@@ -238,6 +240,7 @@ export const generateSQL = (
       null,
       index + 1,
       {},
+      pageLimits,
     );
 
     fieldQueries.push(`(${fieldSQL}) as ${wrapIdentifierMSSQL(field.alias || field.name)}`);
@@ -261,6 +264,7 @@ export const buildSQLForField = (
   parentTableAlias: string | null,
   level: number,
   aliasMap: { [alias: string]: string },
+  pageLimits: PageLimits | null,
 ): string => {
   const tableAlias = generateTableAlias(level);
 
@@ -325,6 +329,7 @@ export const buildSQLForField = (
         tableAlias,
         level,
         aliasMap,
+        pageLimits,
       ),
     ([name, selector]) => `${selector} AS ${wrapIdentifierMSSQL(name)}`,
   );
@@ -332,7 +337,12 @@ export const buildSQLForField = (
   const fromClause = `FROM ${dottedQuotedName} ${tableAlias}`;
 
   const orderByClause = buildOrderByClauseMSSQL(entities, field, tableAlias);
-  const paginationClause = buildPaginationClauseMSSQL(field, variablesDefinition);
+  const paginationClause = buildPaginationClauseMSSQL(
+    field,
+    variablesDefinition,
+    variables,
+    pageLimits,
+  );
 
   const isArray = field.isArray;
   const forJson =

package/src/databases/engines/mysql/connection.ts

@@ -5,27 +5,45 @@ import type { VariableDefinition } from "../../../analyzeQuery/types";
 import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
+import { BunSQLConnectionOptionsZod } from "../../../config/types/db";
 import { databasesConnections } from "../../../singletons/databases";
+import { orderProcedureArguments } from "../../core/procedure-arguments";
 import { toMySQLPlaceholders } from "./placeholders";
 
-export const getPool = async (db: Database) => {
-  const opts = db.connectionOptions as BunSQLConnectionOptions | undefined;
-  const pool = new SQL({
+// Every pool bound comes from the schema, which is the only place they are
+// declared and documented. Repeating them here as `?? n` fallbacks let the
+// documented default and the applied one drift apart, differently per engine.
+//
+// Defaults are overlaid rather than re-parsed: `connectionOptions` is an
+// undiscriminated union of the two engine shapes, so an object can arrive
+// already validated against the other one, and a strict re-parse would reject
+// it at boot.
+export const poolOptions = (db: Database) => {
+  const opts = {
+    ...BunSQLConnectionOptionsZod.parse({}),
+    ...(db.connectionOptions as BunSQLConnectionOptions | undefined),
+  };
+
+  return {
     host: db.connection.host,
     port: db.connection.port,
     username: db.connection.user,
     password: db.connection.password,
     database: db.connection.database,
-    adapter: "mysql",
-    max: opts?.max ?? 50,
-    idleTimeout: opts?.idleTimeout ?? 30,
-    connectionTimeout: opts?.connectionTimeout,
-    maxLifetime: opts?.maxLifetime,
-    tls: opts?.tls,
-    allowPublicKeyRetrieval: opts?.allowPublicKeyRetrieval,
-    prepare: opts?.prepare,
-    bigint: opts?.bigint,
-  });
+    adapter: "mysql" as const,
+    max: opts.max,
+    idleTimeout: opts.idleTimeout,
+    connectionTimeout: opts.connectionTimeout,
+    maxLifetime: opts.maxLifetime,
+    tls: opts.tls,
+    allowPublicKeyRetrieval: opts.allowPublicKeyRetrieval,
+    prepare: opts.prepare,
+    bigint: opts.bigint,
+  };
+};
+
+export const getPool = async (db: Database) => {
+  const pool = new SQL(poolOptions(db));
 
   await pool.connect(); // Connect to the database
 
@@ -80,22 +98,24 @@ export const executeQueryJSONFactory =
 export const executeQueryJSON = executeQueryJSONFactory();
 export const executeQueryJSONSingle = executeQueryJSONFactory(true);
 
+// The generated schema types every stored procedure mutation as `Boolean!`, so
+// the call reports whether it ran, not what it selected. Returning the rows here
+// would put an array behind a field the schema promises is a boolean.
 export const callStoredProcedure = async (
   sp: ProcedureResolver,
-  variablesDefinition: VariableDefinition[],
   variables: Record<string, unknown>,
 ) => {
   try {
-    const data = await executeQuery(
-      `CALL ${sp.dottedQuotedName}(${Object.keys(variables)
-        .map((_, i) => `$${i + 1}`)
-        .join(", ")});`,
+    const args = orderProcedureArguments(sp, variables);
+
+    await executeQuery(
+      `CALL ${sp.dottedQuotedName}(${args.map((_, i) => `$${i + 1}`).join(", ")});`,
       sp.db!,
-      variablesDefinition,
+      args,
       variables,
     );
 
-    return data;
+    return true;
   } catch {
     return false;
   }

package/src/databases/engines/mysql/format.ts

@@ -2,6 +2,7 @@ import { format as sqlFormatter } from "sql-formatter";
 
 import type { AnalysisResult } from "../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../configuration/getSchemas/mergeEntities";
+import type { PageLimits } from "../../common";
 
 import { generateSQL } from "../../core/query-builder";
 
@@ -16,8 +17,9 @@ export const genSql = (
   query: AnalysisResult,
   variables: Record<string, unknown> = {},
   hash = false,
+  pageLimits: PageLimits | null = null,
 ) => {
-  const [[, sql]] = generateSQL(entitites, query, variables, hash);
+  const [[, sql]] = generateSQL(entitites, query, variables, hash, pageLimits);
 
   return format(sql);
 };

package/src/databases/engines/mysql/query/index.ts

@@ -4,7 +4,7 @@ import type {
   VariableDefinition,
 } from "../../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../../configuration/getSchemas/mergeEntities";
-import type { GroupByInfo } from "../../../common";
+import type { GroupByInfo, PageLimits } from "../../../common";
 
 import {
   buildOrderByClauseMySQL,
@@ -21,6 +21,7 @@ import {
 } from "../../../common";
 
 import { applyDirectives } from "../../../directives";
+import { getQueryTimeoutMs } from "../../../../singletons/queryTimeout";
 
 // Generate CTE for aggregations
 const buildAggregationCTE = (
@@ -157,9 +158,21 @@ export const generateSQL = (
   operation: OperationAnalysis,
   variables: Record<string, unknown> = {},
   forHashMethod: boolean = false,
+  pageLimits: PageLimits | null = null,
+  timeoutMs?: number,
 ): string => {
+  // Bun's MySQL adapter ignores the `connection` bag and exposes no
+  // per-connection init hook, so there is no pool-level route for
+  // max_execution_time: the bound has to ride in the SQL text. MySQL honours the
+  // hint only on the outermost SELECT — one placed inside a CTE is silently
+  // discarded — which is why it is emitted here, at each return, rather than
+  // spliced into the finished string by the executor.
+  const effectiveTimeoutMs = timeoutMs ?? getQueryTimeoutMs();
+  const timeoutHint =
+    effectiveTimeoutMs > 0 ? ` /*+ MAX_EXECUTION_TIME(${effectiveTimeoutMs}) */` : "";
+
   if (forHashMethod) {
-    return `SELECT MD5((${buildSQLForField(entities, operation.variables ?? [], variables, operation.fields[0], null, null, 1, {})})) AS ResultHash`;
+    return `SELECT${timeoutHint} MD5((${buildSQLForField(entities, operation.variables ?? [], variables, operation.fields[0], null, null, 1, {}, pageLimits)})) AS ResultHash`;
   }
 
   const variablesWithDefault = {
@@ -220,6 +233,7 @@ export const generateSQL = (
       null,
       index + 1,
       {},
+      pageLimits,
     );
 
     fieldQueries.push(`'${field.alias || field.name}', ${fieldSQL}`);
@@ -228,7 +242,7 @@ export const generateSQL = (
   const cteClause = ctes.length > 0 ? `WITH\n${ctes.join(",\n")}\n` : "";
 
   return `
-    ${cteClause}SELECT JSON_OBJECT(
+    ${cteClause}SELECT${timeoutHint} JSON_OBJECT(
       ${fieldQueries.join(",\n")}
     ) as json_result`;
 };
@@ -242,6 +256,7 @@ export const buildSQLForField = (
   parentTableAlias: string | null,
   level: number,
   aliasMap: { [alias: string]: string },
+  pageLimits: PageLimits | null,
 ): string => {
   const tableAlias = generateTableAlias(level);
 
@@ -306,6 +321,7 @@ export const buildSQLForField = (
         tableAlias,
         level,
         aliasMap,
+        pageLimits,
       ),
     ([name, selector]) => `'${name}', ${selector}`,
   );
@@ -313,7 +329,12 @@ export const buildSQLForField = (
   const fromClause = `FROM ${dottedQuotedName} ${tableAlias}`;
 
   const orderByClause = buildOrderByClauseMySQL(entities, field, tableAlias);
-  const paginationClause = buildPaginationClauseMySQL(field, variablesDefinition);
+  const paginationClause = buildPaginationClauseMySQL(
+    field,
+    variablesDefinition,
+    variables,
+    pageLimits,
+  );
 
   const isArraySelection = !!field.isArray && !withoutArrayWrapper;
 

package/src/databases/engines/postgresql/connection.ts

@@ -5,24 +5,52 @@ import type { VariableDefinition } from "../../../analyzeQuery/types";
 import type { Database } from "../../../types/configuration";
 import type { ProcedureResolver } from "../../../types/db";
 
+import { BunSQLConnectionOptionsZod } from "../../../config/types/db";
 import { databasesConnections } from "../../../singletons/databases";
+import { orderProcedureArguments } from "../../core/procedure-arguments";
+import { getQueryTimeoutMs } from "../../../singletons/queryTimeout";
+
+// Every pool bound comes from the schema, which is the only place they are
+// declared and documented. Repeating them here as `?? n` fallbacks let the
+// documented default and the applied one drift apart, differently per engine.
+//
+// Defaults are overlaid rather than re-parsed: `connectionOptions` is an
+// undiscriminated union of the two engine shapes, so an object can arrive
+// already validated against the other one, and a strict re-parse would reject
+// it at boot.
+export const poolOptions = (db: Database, timeoutMs: number = getQueryTimeoutMs()) => {
+  const opts = {
+    ...BunSQLConnectionOptionsZod.parse({}),
+    ...(db.connectionOptions as BunSQLConnectionOptions | undefined),
+  };
 
-export const getPool = async (db: Database) => {
-  const opts = db.connectionOptions as BunSQLConnectionOptions | undefined;
-  const pool = new SQL({
+  return {
     host: db.connection.host,
     port: db.connection.port,
     user: db.connection.user,
     password: db.connection.password,
     database: db.connection.database,
-    max: opts?.max ?? 5,
-    idleTimeout: opts?.idleTimeout ?? 30,
-    connectionTimeout: opts?.connectionTimeout,
-    maxLifetime: opts?.maxLifetime,
-    tls: opts?.tls,
-    prepare: opts?.prepare,
-    bigint: opts?.bigint,
-  });
+    max: opts.max,
+    idleTimeout: opts.idleTimeout,
+    connectionTimeout: opts.connectionTimeout,
+    maxLifetime: opts.maxLifetime,
+    tls: opts.tls,
+    prepare: opts.prepare,
+    bigint: opts.bigint,
+    // Applied once per pooled connection rather than per query, so it bounds
+    // everything that runs on the connection — auth and introspection included
+    // — at no per-query cost. Omitted at 0 rather than sent as "0", which
+    // Postgres reads as unlimited but still costs a round trip to set.
+    ...(timeoutMs > 0 ? { connection: { statement_timeout: String(timeoutMs) } } : {}),
+  };
+};
+
+/** The bound the pool already applies, so the executor can tell an override from the default. */
+export const poolStatementTimeoutMs = (db: Database) =>
+  Number(poolOptions(db).connection?.statement_timeout ?? 0);
+
+export const getPool = async (db: Database) => {
+  const pool = new SQL(poolOptions(db));
 
   await pool.connect(); // Connect to the database
 
@@ -31,6 +59,35 @@ export const getPool = async (db: Database) => {
 
 export const getPoolSingleton = async (db: Database) => databasesConnections[db.name] as SQL;
 
+// A timeout other than the pool's own has to be set on a connection, which
+// means pinning one for the duration. Only an override pays for that.
+const executeReserved = async <T>(
+  pool: SQL,
+  timeoutMs: number,
+  query: string,
+  params: unknown[],
+) => {
+  // SET takes no bind parameters, so the value is interpolated. It is an
+  // integer from the config schema; re-checked here so a widened type upstream
+  // cannot turn this line into an injection point.
+  if (!Number.isInteger(timeoutMs) || timeoutMs < 0) {
+    throw new Error(`Invalid statement timeout: ${timeoutMs}`);
+  }
+
+  const reserved = await pool.reserve();
+
+  try {
+    await reserved.unsafe(`SET statement_timeout = ${timeoutMs}`);
+
+    return await reserved.unsafe<T>(query, params);
+  } finally {
+    // The connection goes back to the pool carrying the pool's default again,
+    // not this query's override.
+    await reserved.unsafe("RESET statement_timeout");
+    await reserved.release();
+  }
+};
+
 export const executeQueryFactory =
   (singleQuery = false) =>
   async <T>(
@@ -38,13 +95,16 @@ export const executeQueryFactory =
     db: Database,
     variablesDefinition: VariableDefinition[],
     values: Record<string, unknown> = {},
+    timeoutMs?: number,
   ) => {
     const pool = singleQuery ? await getPool(db) : await getPoolSingleton(db);
+    const params = variablesDefinition.map((v) => values[v.name]);
 
-    const result = await pool.unsafe<T>(
-      query,
-      variablesDefinition.map((v) => values[v.name]),
-    );
+    const override = timeoutMs !== undefined && timeoutMs !== poolStatementTimeoutMs(db);
+
+    const result = override
+      ? await executeReserved<T>(pool, timeoutMs, query, params)
+      : await pool.unsafe<T>(query, params);
 
     if (singleQuery) {
       await pool.close();
@@ -63,12 +123,14 @@ export const executeQueryJSONFactory =
     db: Database,
     variablesDefinition: VariableDefinition[] = [],
     values: Record<string, unknown> = {},
+    timeoutMs?: number,
   ) => {
     const result = await (singleQuery ? executeQuerySingle : executeQuery)<[{ json_result: T }]>(
       query,
       db,
       variablesDefinition,
       values,
+      timeoutMs,
     );
 
     return result[0].json_result as T;
@@ -77,22 +139,24 @@ export const executeQueryJSONFactory =
 export const executeQueryJSON = executeQueryJSONFactory();
 export const executeQueryJSONSingle = executeQueryJSONFactory(true);
 
+// The generated schema types every stored procedure mutation as `Boolean!`, so
+// the call reports whether it ran, not what it selected. Returning the rows here
+// would put an array behind a field the schema promises is a boolean.
 export const callStoredProcedure = async (
   sp: ProcedureResolver,
-  variablesDefinition: VariableDefinition[],
   variables: Record<string, unknown>,
 ) => {
   try {
-    const data = await executeQuery(
-      `SELECT * FROM ${sp.dottedQuotedName}(${Object.keys(variables)
-        .map((_, i) => `$${i + 1}`)
-        .join(", ")});`,
+    const args = orderProcedureArguments(sp, variables);
+
+    await executeQuery(
+      `SELECT * FROM ${sp.dottedQuotedName}(${args.map((_, i) => `$${i + 1}`).join(", ")});`,
       sp.db!,
-      variablesDefinition,
+      args,
       variables,
     );
 
-    return data;
+    return true;
   } catch {
     return false;
   }

package/src/databases/engines/postgresql/format.ts

@@ -2,6 +2,7 @@ import { format as sqlFormatter } from "sql-formatter";
 
 import type { AnalysisResult } from "../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../configuration/getSchemas/mergeEntities";
+import type { PageLimits } from "../../common";
 
 import { generateSQL } from "../../core/query-builder";
 
@@ -16,8 +17,9 @@ export const genSql = (
   query: AnalysisResult,
   variables: Record<string, unknown> = {},
   hash = false,
+  pageLimits: PageLimits | null = null,
 ) => {
-  const [[, sql]] = generateSQL(entitites, query, variables, hash);
+  const [[, sql]] = generateSQL(entitites, query, variables, hash, pageLimits);
 
   return format(sql);
 };

package/src/databases/engines/postgresql/query/index.ts

@@ -4,7 +4,7 @@ import type {
   VariableDefinition,
 } from "../../../../analyzeQuery/types";
 import type { MergedEntities } from "../../../../configuration/getSchemas/mergeEntities";
-import type { GroupByInfo } from "../../../common";
+import type { GroupByInfo, PageLimits } from "../../../common";
 
 import {
   buildOrderByClausePG,
@@ -154,9 +154,10 @@ export const generateSQL = (
   operation: OperationAnalysis,
   variables: Record<string, unknown> = {},
   forHashMethod: boolean = false,
+  pageLimits: PageLimits | null = null,
 ): string => {
   if (forHashMethod) {
-    return `SELECT MD5((${buildSQLForField(entities, operation.variables ?? [], variables, operation.fields[0], null, null, 1, {})})::text) AS "ResultHash"`;
+    return `SELECT MD5((${buildSQLForField(entities, operation.variables ?? [], variables, operation.fields[0], null, null, 1, {}, pageLimits)})::text) AS "ResultHash"`;
   }
 
   const variablesWithDefault = {
@@ -217,6 +218,7 @@ export const generateSQL = (
       null,
       index + 1,
       {},
+      pageLimits,
     );
 
     fieldQueries.push(`'${field.alias || field.name}', ${fieldSQL}`);
@@ -239,6 +241,7 @@ export const buildSQLForField = (
   parentTableAlias: string | null,
   level: number,
   aliasMap: { [alias: string]: string },
+  pageLimits: PageLimits | null,
 ): string => {
   const tableAlias = generateTableAlias(level);
 
@@ -303,6 +306,7 @@ export const buildSQLForField = (
         tableAlias,
         level,
         aliasMap,
+        pageLimits,
       ),
     ([name, selector]) => `'${name}', ${selector}`,
   );
@@ -310,7 +314,12 @@ export const buildSQLForField = (
   const fromClause = `FROM ${dottedQuotedName} ${tableAlias}`;
 
   const orderByClause = buildOrderByClausePG(entities, field, tableAlias);
-  const paginationClause = buildPaginationClausePG(field, variablesDefinition);
+  const paginationClause = buildPaginationClausePG(
+    field,
+    variablesDefinition,
+    variables,
+    pageLimits,
+  );
 
   const isArraySelection = !!field.isArray && !withoutArrayWrapper;