@minnowdb/core 0.3.0 → 0.4.1

package/dist/engine/query.js

@@ -1,3 +1,6 @@
+import { copyDate, dateIsoString, dateMilliseconds, dateUtcDate, dateUtcDay, dateUtcFullYear, dateUtcHours, dateUtcMinutes, dateUtcMonth, dateUtcSeconds, setDateUtcDate, setDateUtcMonth, } from "../date-value.js";
+import { assertWellFormedString, wellFormedUtf8ByteLength } from "../block-format/unicode.js";
+import { MAX_SQL_NESTING_DEPTH, MAX_SQL_PARAMETERS, MAX_SQL_SCALAR_RESULT_CHARACTERS, MAX_SQL_TEXT_CHARACTERS, MAX_SQL_TOKENS, } from "./cache-limits.js";
 import { SqlCompileError } from "./errors.js";
 import { cachedQueryTerms, ftsBm25Row, FtsStatsAccumulator, ftsMatchTruth, renderDocumentValue, tokenize as ftsTokenize, validateFtsQuery, } from "./fts.js";
 import { QueryMemoryContext } from "./memory.js";
@@ -6,7 +9,7 @@ import { stringArgument } from "./sql-semantics.js";
 import { jsonAtPath, jsonConstructor, jsonIsValid, jsonValueOf, parseJsonPath, } from "./sql-json.js";
 import { optimizePlan } from "./optimizer.js";
 import { compareSqlValues as compareValues, compileLikePattern, compileSimilarPattern, encodeSqlEqualityValue, roundSqlNumber, } from "./sql-semantics.js";
-import { arrayDomainValue, collatedDomainValue, exactNumericBinary, exactNumericValue, externalSqlDomainValue, intervalDomainValue, isExactNumeric, isSqlDomainValue, jsonDomainValue, normalizeSqlDomainValue, protectedSqlTextValue, timeDomainValue, uuidDomainValue, } from "./sql-domains.js";
+import { arrayDomainValue, boundedJsonText, collatedDomainValue, exactNumericBinary, exactNumericValue, externalSqlDomainValue, intervalDomainValue, isExactNumeric, isSqlDomainValue, jsonDomainValue, normalizeSqlDomainValue, protectedSqlTextValue, timeDomainValue, uuidDomainValue, } from "./sql-domains.js";
 import { columnarTableFromRows, prepareVectorQuery, } from "./vector.js";
 export const scalarFunctionNames = new Set([
     "ROUND",
@@ -148,7 +151,7 @@ function castValue(value, target) {
         if (typeof value === "boolean")
             return protectedSqlTextValue(value ? "true" : "false");
         if (value instanceof Date)
-            return protectedSqlTextValue(value.toISOString());
+            return protectedSqlTextValue(dateIsoString(value));
     }
     if (target === "number" || target === "number-integer") {
         let parsed;
@@ -198,7 +201,7 @@ function castValue(value, target) {
             return value;
         if (typeof value === "string" || typeof value === "number") {
             const parsed = new Date(value);
-            if (Number.isFinite(parsed.getTime()))
+            if (Number.isFinite(dateMilliseconds(parsed)))
                 return parsed;
             throw new TypeError(`Cannot cast this value to a datetime: ${String(value)}`);
         }
@@ -262,7 +265,7 @@ export function scalarFunctionValue(name, values) {
         // datetimes distinct, so the ordinary single-key hash join can safely carry a composite.
         if (values.some((value) => value === null || value === undefined))
             return null;
-        return JSON.stringify(values.map(encodeSqlEqualityValue));
+        return boundedJsonText(values.map(encodeSqlEqualityValue), false, "Composite key");
     }
     const first = values[0];
     if (first === null || first === undefined)
@@ -307,10 +310,16 @@ export function scalarFunctionValue(name, values) {
                 return null;
             if (values[2] === null || values[2] === undefined)
                 return null;
+            const source = stringArgument("REPLACE", first);
             const search = stringArgument("REPLACE", values[1]);
+            const replacement = stringArgument("REPLACE", values[2]);
+            assertScalarInputLength(source, "REPLACE source");
+            assertScalarInputLength(search, "REPLACE search text");
+            assertScalarInputLength(replacement, "REPLACE replacement text");
             if (search === "")
-                return stringArgument("REPLACE", first);
-            return protectedSqlTextValue(stringArgument("REPLACE", first).split(search).join(stringArgument("REPLACE", values[2])));
+                return source;
+            assertReplacementResultLength(source, search, replacement);
+            return protectedSqlTextValue(source.split(search).join(replacement));
         }
         case "INSTR": {
             if (values[1] === null || values[1] === undefined)
@@ -319,7 +328,7 @@ export function scalarFunctionValue(name, values) {
             const needle = stringArgument("INSTR", values[1]);
             const index = haystack.indexOf(needle);
             // 1-based character position, 0 when absent, counting codepoints like LENGTH.
-            return index === -1 ? 0 : Array.from(haystack.slice(0, index)).length + 1;
+            return index === -1 ? 0 : codePointLength(haystack, index) + 1;
         }
         case "EXTRACT":
             return extractDatePart(typeof first === "string" ? first : "", values[1]);
@@ -331,17 +340,23 @@ export function scalarFunctionValue(name, values) {
         }
         case "ABS":
             return Math.abs(numeric(first));
-        case "UPPER":
-            return protectedSqlTextValue(stringArgument("UPPER", first).toUpperCase());
-        case "LOWER":
-            return protectedSqlTextValue(stringArgument("LOWER", first).toLowerCase());
+        case "UPPER": {
+            const source = stringArgument("UPPER", first);
+            assertScalarInputLength(source, "UPPER input");
+            return boundedScalarResult(source.toUpperCase(), "UPPER result");
+        }
+        case "LOWER": {
+            const source = stringArgument("LOWER", first);
+            assertScalarInputLength(source, "LOWER input");
+            return boundedScalarResult(source.toLowerCase(), "LOWER result");
+        }
         case "TRIM":
             // SQL TRIM removes spaces, not general whitespace.
             return trimEnds("TRIM", first, values[1], "both");
         case "LENGTH":
-            return Array.from(stringArgument("LENGTH", first)).length;
+            return codePointLength(stringArgument("LENGTH", first));
         case "OCTET_LENGTH":
-            return new TextEncoder().encode(stringArgument("OCTET_LENGTH", first)).length;
+            return wellFormedUtf8ByteLength(stringArgument("OCTET_LENGTH", first), "OCTET_LENGTH input");
         case "IS_JSON": {
             const kind = values[1];
             return jsonIsValid(first, typeof kind === "string" ? kind : "value");
@@ -375,24 +390,24 @@ export function scalarFunctionValue(name, values) {
             if (!Number.isInteger(width) || width < 0) {
                 throw new TypeError(`${name} length must be a non-negative integer`);
             }
-            const text = Array.from(stringArgument(name, first));
-            if (text.length >= width)
-                return text.slice(0, width).join("");
+            if (width > MAX_SQL_SCALAR_RESULT_CHARACTERS) {
+                throw new RangeError(`${name} result exceeds ${String(MAX_SQL_SCALAR_RESULT_CHARACTERS)} characters`);
+            }
+            const source = stringArgument(name, first);
+            const text = codePointPrefix(source, width);
+            if (text.count >= width)
+                return boundedScalarResult(text.text, `${name} result`);
             let fill = " ";
             if (values.length > 2) {
                 if (values[2] === null || values[2] === undefined)
                     return null;
                 fill = stringArgument(name, values[2]);
             }
-            const filler = Array.from(fill);
             // An empty fill cannot pad, so the value passes through, matching PostgreSQL.
-            if (filler.length === 0)
-                return protectedSqlTextValue(text.join(""));
-            const padding = [];
-            while (padding.length < width - text.length) {
-                padding.push(filler[padding.length % filler.length] ?? "");
-            }
-            return protectedSqlTextValue(name === "LPAD" ? padding.join("") + text.join("") : text.join("") + padding.join(""));
+            const padding = repeatedCodePointPrefix(fill, width - text.count);
+            if (padding === "")
+                return protectedSqlTextValue(text.text);
+            return boundedScalarResult(name === "LPAD" ? padding + text.text : text.text + padding, `${name} result`);
         }
         case "OVERLAY": {
             // OVERLAY(s PLACING r FROM start [FOR length]) replaces `length` characters of `s`
@@ -402,8 +417,12 @@ export function scalarFunctionValue(name, values) {
                     return null;
                 }
             }
-            const text = Array.from(stringArgument("OVERLAY", first));
-            const replacement = Array.from(stringArgument("OVERLAY", values[1]));
+            const sourceText = stringArgument("OVERLAY", first);
+            const replacementText = stringArgument("OVERLAY", values[1]);
+            assertScalarInputLength(sourceText, "OVERLAY source");
+            assertScalarInputLength(replacementText, "OVERLAY replacement");
+            const text = Array.from(sourceText);
+            const replacement = Array.from(replacementText);
             const start = numeric(values[2]);
             if (!Number.isInteger(start) || start < 1) {
                 throw new TypeError("OVERLAY start must be a positive integer");
@@ -412,11 +431,11 @@ export function scalarFunctionValue(name, values) {
             if (!Number.isInteger(span) || span < 0) {
                 throw new TypeError("OVERLAY length must be a non-negative integer");
             }
-            return protectedSqlTextValue([
+            return boundedScalarResult([
                 ...text.slice(0, start - 1),
                 ...replacement,
                 ...text.slice(Math.min(start - 1 + span, text.length)),
-            ].join(""));
+            ].join(""), "OVERLAY result");
         }
         case "CAST":
             return castValue(first, typeof values[1] === "string" ? values[1] : "");
@@ -424,13 +443,13 @@ export function scalarFunctionValue(name, values) {
             // PostgreSQL SUBSTRING returns the characters whose positions fall in both the requested
             // window and the string, so a start before 1 shortens the result instead of shifting it,
             // and a window entirely off the string is empty rather than an error.
-            const text = Array.from(stringArgument("SUBSTR", first));
+            const source = stringArgument("SUBSTR", first);
             if (values[1] === null || values[1] === undefined)
                 return null;
             const start = numeric(values[1]);
             if (!Number.isInteger(start))
                 throw new TypeError("SUBSTR start must be an integer");
-            let until = text.length + 1;
+            let until = Number.POSITIVE_INFINITY;
             if (values.length > 2) {
                 if (values[2] === null || values[2] === undefined)
                     return null;
@@ -441,9 +460,109 @@ export function scalarFunctionValue(name, values) {
                 until = start + length;
             }
             const from = Math.max(start, 1);
-            const to = Math.min(until, text.length + 1);
-            return protectedSqlTextValue(to <= from ? "" : text.slice(from - 1, to - 1).join(""));
+            if (until <= from)
+                return "";
+            return boundedScalarResult(codePointSlice(source, from - 1, until - 1), "SUBSTR result");
+        }
+    }
+}
+function assertScalarInputLength(value, label) {
+    if (value.length > MAX_SQL_SCALAR_RESULT_CHARACTERS) {
+        throw new RangeError(`${label} exceeds ${String(MAX_SQL_SCALAR_RESULT_CHARACTERS)} characters`);
+    }
+}
+function boundedScalarResult(value, label) {
+    if (value.length > MAX_SQL_SCALAR_RESULT_CHARACTERS) {
+        throw new RangeError(`${label} exceeds ${String(MAX_SQL_SCALAR_RESULT_CHARACTERS)} characters`);
+    }
+    return protectedSqlTextValue(value);
+}
+function codePointLength(value, end = value.length) {
+    let count = 0;
+    for (let index = 0; index < end; index += 1) {
+        const first = value.charCodeAt(index);
+        if (first >= 0xd800 && first <= 0xdbff && index + 1 < end) {
+            const second = value.charCodeAt(index + 1);
+            if (second >= 0xdc00 && second <= 0xdfff)
+                index += 1;
+        }
+        count += 1;
+    }
+    return count;
+}
+function codePointPrefix(value, count) {
+    let index = 0;
+    let found = 0;
+    while (index < value.length && found < count) {
+        const first = value.charCodeAt(index);
+        index +=
+            first >= 0xd800 &&
+                first <= 0xdbff &&
+                index + 1 < value.length &&
+                value.charCodeAt(index + 1) >= 0xdc00 &&
+                value.charCodeAt(index + 1) <= 0xdfff
+                ? 2
+                : 1;
+        found += 1;
+    }
+    return { text: value.slice(0, index), count: found };
+}
+function repeatedCodePointPrefix(value, count) {
+    if (count <= 0 || value.length === 0)
+        return "";
+    const first = codePointPrefix(value, count);
+    if (first.count >= count)
+        return first.text;
+    const copies = Math.floor(count / first.count);
+    const remainder = count % first.count;
+    return first.text.repeat(copies) + codePointPrefix(first.text, remainder).text;
+}
+function codePointSlice(value, from, to) {
+    let codePoint = 0;
+    let index = 0;
+    let start = value.length;
+    let end = value.length;
+    while (index < value.length) {
+        if (codePoint === from)
+            start = index;
+        if (codePoint === to) {
+            end = index;
+            break;
         }
+        const first = value.charCodeAt(index);
+        index +=
+            first >= 0xd800 &&
+                first <= 0xdbff &&
+                index + 1 < value.length &&
+                value.charCodeAt(index + 1) >= 0xdc00 &&
+                value.charCodeAt(index + 1) <= 0xdfff
+                ? 2
+                : 1;
+        codePoint += 1;
+    }
+    if (codePoint < from)
+        return "";
+    if (to === Number.POSITIVE_INFINITY)
+        end = value.length;
+    const length = end - start;
+    if (length > MAX_SQL_SCALAR_RESULT_CHARACTERS) {
+        throw new RangeError(`SUBSTR result exceeds ${String(MAX_SQL_SCALAR_RESULT_CHARACTERS)} characters`);
+    }
+    return value.slice(start, end);
+}
+function assertReplacementResultLength(source, search, replacement) {
+    let matches = 0;
+    let from = 0;
+    for (;;) {
+        const index = source.indexOf(search, from);
+        if (index < 0)
+            break;
+        matches += 1;
+        from = index + search.length;
+    }
+    const resultLength = source.length + matches * (replacement.length - search.length);
+    if (!Number.isSafeInteger(resultLength) || resultLength > MAX_SQL_SCALAR_RESULT_CHARACTERS) {
+        throw new RangeError(`REPLACE result exceeds ${String(MAX_SQL_SCALAR_RESULT_CHARACTERS)} characters`);
     }
 }
 export const dateTruncUnits = new Set([
@@ -508,15 +627,15 @@ export function dateAddValue(value, months, milliseconds) {
     if (!(value instanceof Date))
         throw new TypeError("Date arithmetic requires a datetime value");
     const monthCount = Number(months ?? 0);
-    const shifted = new Date(value.getTime());
+    const shifted = copyDate(value);
     if (monthCount !== 0) {
-        const day = shifted.getUTCDate();
-        shifted.setUTCDate(1);
-        shifted.setUTCMonth(shifted.getUTCMonth() + monthCount);
-        const lastDay = new Date(Date.UTC(shifted.getUTCFullYear(), shifted.getUTCMonth() + 1, 0)).getUTCDate();
-        shifted.setUTCDate(Math.min(day, lastDay));
+        const day = dateUtcDate(shifted);
+        setDateUtcDate(shifted, 1);
+        setDateUtcMonth(shifted, dateUtcMonth(shifted) + monthCount);
+        const lastDay = new Date(Date.UTC(dateUtcFullYear(shifted), dateUtcMonth(shifted) + 1, 0));
+        setDateUtcDate(shifted, Math.min(day, dateUtcDate(lastDay)));
     }
-    return new Date(shifted.getTime() + Number(milliseconds ?? 0));
+    return new Date(dateMilliseconds(shifted) + Number(milliseconds ?? 0));
 }
 export function dateTruncValue(unit, value) {
     if (typeof unit !== "string" || !dateTruncUnits.has(unit.toLowerCase())) {
@@ -527,9 +646,9 @@ export function dateTruncValue(unit, value) {
     if (!(value instanceof Date))
         throw new TypeError("DATE_TRUNC requires a datetime value");
     const normalized = unit.toLowerCase();
-    const year = value.getUTCFullYear();
-    const month = value.getUTCMonth();
-    const day = value.getUTCDate();
+    const year = dateUtcFullYear(value);
+    const month = dateUtcMonth(value);
+    const day = dateUtcDate(value);
     switch (normalized) {
         case "year":
             return new Date(Date.UTC(year, 0, 1));
@@ -539,17 +658,17 @@ export function dateTruncValue(unit, value) {
             return new Date(Date.UTC(year, month, 1));
         case "week": {
             const start = new Date(Date.UTC(year, month, day));
-            start.setUTCDate(start.getUTCDate() - ((start.getUTCDay() + 6) % 7));
+            setDateUtcDate(start, dateUtcDate(start) - ((dateUtcDay(start) + 6) % 7));
             return start;
         }
         case "day":
             return new Date(Date.UTC(year, month, day));
         case "hour":
-            return new Date(Date.UTC(year, month, day, value.getUTCHours()));
+            return new Date(Date.UTC(year, month, day, dateUtcHours(value)));
         case "minute":
-            return new Date(Date.UTC(year, month, day, value.getUTCHours(), value.getUTCMinutes()));
+            return new Date(Date.UTC(year, month, day, dateUtcHours(value), dateUtcMinutes(value)));
         default:
-            return new Date(Date.UTC(year, month, day, value.getUTCHours(), value.getUTCMinutes(), value.getUTCSeconds()));
+            return new Date(Date.UTC(year, month, day, dateUtcHours(value), dateUtcMinutes(value), dateUtcSeconds(value)));
     }
 }
 /** The output column type of one window: rankings and most aggregates count, MIN/MAX carry. */
@@ -693,6 +812,7 @@ function throwLocated(error, offset, span) {
     throw error;
 }
 export function compileQuery(sql, options = {}) {
+    validateSqlSource(sql);
     const { text, offset } = normalizeSql(sql);
     if (text.length === 0)
         throw new SqlCompileError("Enter a SELECT query", offset, 0);
@@ -737,7 +857,7 @@ function columnDefaultFor(expression, sql) {
             return { kind: "literal", value };
         }
         if (value instanceof Date)
-            return { kind: "literal", value: new Date(value.getTime()) };
+            return { kind: "literal", value: copyDate(value) };
     }
     return { kind: "expression", sql };
 }
@@ -996,7 +1116,7 @@ function parseCreateTrigger(text, tokens) {
         if (compiled.kind === "insert" && compiled.onConflict !== undefined) {
             throw new TypeError("Trigger body INSERTs cannot carry ON CONFLICT");
         }
-        if (compiled.kind !== "insert" && compiled.returning !== undefined) {
+        if (compiled.returning !== undefined) {
             throw new TypeError("Trigger bodies cannot carry RETURNING");
         }
         if ((compiled.parameterCount ?? 0) !== bindings.length) {
@@ -1015,6 +1135,7 @@ function parseCreateTrigger(text, tokens) {
  * leading keyword fails explicitly.
  */
 export function compileStatement(sql) {
+    validateSqlSource(sql);
     const { text, offset } = normalizeSql(sql);
     if (text.length === 0)
         throw new SqlCompileError("Enter a SQL statement", offset, 0);
@@ -1378,7 +1499,7 @@ function validateParameters(count, params) {
             return;
         }
         if (value instanceof Date) {
-            if (!Number.isFinite(value.getTime())) {
+            if (!Number.isFinite(dateMilliseconds(value))) {
                 throw new TypeError(`Parameter ${label} must be a valid date`);
             }
             return;
@@ -1500,7 +1621,7 @@ function cloneTreeValue(value) {
     if (typeof value !== "object" || value === null)
         return value;
     if (value instanceof Date)
-        return new Date(value.getTime());
+        return copyDate(value);
     if (Array.isArray(value)) {
         const copy = new Array(value.length);
         for (let index = 0; index < value.length; index += 1)
@@ -2105,6 +2226,7 @@ function trimPreparedResults(prepared, trim) {
         },
         execute: () => trim(prepared.execute()),
         executeAsync: async (options) => trim(await prepared.executeAsync(options)),
+        executeBatches: (options, consume) => prepared.executeBatches(options, (batch) => consume(trim(batch))),
         close: () => {
             prepared.close();
         },
@@ -2129,21 +2251,25 @@ export function createPreparedQuery(plan, tables, options = {}) {
     // Every engine entry expands MATCH(*) exactly once, here against the row tables' own
     // columns; past this point no executor sees the "*" sentinel.
     plan = expandFtsColumns(plan, rowTableSearchableColumns(tables));
-    const resolution = subqueryResolutionSteps(plan);
-    for (const step of resolution.steps)
-        step.substitute(executeRowQueryInternal(step.block, tables));
-    plan = resolution.plan;
-    tables = resolveDerivedRowTables(plan, tables);
-    plan = expandDistinctWildcard(plan, wildcardRowColumns(tables));
     const memory = new QueryMemoryContext(options.executionMemoryBudgetBytes);
-    if ([...tables.values()].some((rows) => rows.length === 0)) {
-        if (options.executionMemoryBudgetBytes !== undefined) {
-            memory.close();
-            throw new TypeError("Query memory budgets require typed columnar schemas when an input table is empty");
-        }
-        return createPreparedRowQuery(plan, tables, memory);
-    }
     try {
+        // Scalar subqueries and derived row sources are materialized before the vector plan is
+        // prepared. They must share the same context: otherwise a tiny (or the finite default)
+        // budget would apply only after an arbitrarily large intermediate had already escaped the
+        // memory model.
+        const resolution = subqueryResolutionSteps(plan);
+        for (const step of resolution.steps) {
+            step.substitute(executeRowQueryInternal(step.block, tables, memory));
+        }
+        plan = resolution.plan;
+        tables = resolveDerivedRowTables(plan, tables, memory);
+        plan = expandDistinctWildcard(plan, wildcardRowColumns(tables));
+        if ([...tables.values()].some((rows) => rows.length === 0)) {
+            if (options.executionMemoryBudgetBytes !== undefined) {
+                throw new TypeError("Query memory budgets require typed columnar schemas when an input table is empty");
+            }
+            return createPreparedRowQuery(plan, tables, memory);
+        }
         return trimPreparedResults(createPreparedColumnarQuery(plan, normalizeColumnarTables(plan, tables), memory), externalizeQueryResult);
     }
     catch (error) {
@@ -2196,6 +2322,11 @@ export function createPreparedColumnarQuery(plan, tables, memory = new QueryMemo
                 throw new Error("Prepared query is closed");
             return markExternalizationState(await prepared.executeAsync(options), outputNeedsExternalization);
         },
+        executeBatches(options, consume) {
+            if (closed || prepared === undefined)
+                throw new Error("Prepared query is closed");
+            return prepared.executeBatches(options, (batch) => consume(markExternalizationState(batch, outputNeedsExternalization)));
+        },
         close() {
             if (closed)
                 return;
@@ -2218,12 +2349,47 @@ function createPreparedRowQuery(plan, tables, memory) {
         execute() {
             if (closed || rows === undefined)
                 throw new Error("Prepared query is closed");
-            return externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(rows)));
+            const executionMemory = memory.createChild();
+            try {
+                return externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(rows), executionMemory));
+            }
+            finally {
+                executionMemory.close();
+            }
         },
         async executeAsync() {
             if (closed || rows === undefined)
                 throw new Error("Prepared query is closed");
-            return externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(rows)));
+            const executionMemory = memory.createChild();
+            try {
+                return externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(rows), executionMemory));
+            }
+            finally {
+                executionMemory.close();
+            }
+        },
+        async executeBatches(options, consume) {
+            if (closed || rows === undefined)
+                throw new Error("Prepared query is closed");
+            if (!Number.isSafeInteger(options.batchRows) || options.batchRows <= 0) {
+                throw new RangeError("Query batch rows must be a positive whole number");
+            }
+            const executionMemory = memory.createChild();
+            let result;
+            try {
+                result = externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(rows), executionMemory));
+            }
+            finally {
+                executionMemory.close();
+            }
+            for (let start = 0; start < result.rows.length; start += options.batchRows) {
+                options.signal?.throwIfAborted();
+                await consume({
+                    columns: [...result.columns],
+                    rows: result.rows.slice(start, start + options.batchRows),
+                });
+            }
+            return result.columns;
         },
         close() {
             closed = true;
@@ -2238,7 +2404,7 @@ function cloneRowTables(tables, protectText = false) {
         rows.map((row) => Object.fromEntries(Object.entries(row).map(([column, value]) => [
             column,
             value instanceof Date
-                ? new Date(value.getTime())
+                ? copyDate(value)
                 : protectText && typeof value === "string"
                     ? protectedSqlTextValue(value)
                     : value,
@@ -2519,10 +2685,10 @@ export function mapBlockExpressions(block, map) {
 export function resolveStatementDatetimes(plan, now = new Date()) {
     if (plan.usesStatementDatetime !== true)
         return plan;
-    const iso = now.toISOString();
+    const iso = dateIsoString(now);
     const values = new Map([
         ["CURRENT_DATE", new Date(`${iso.slice(0, 10)}T00:00:00.000Z`)],
-        ["CURRENT_TIMESTAMP", new Date(now.getTime())],
+        ["CURRENT_TIMESTAMP", copyDate(now)],
         ["LOCALTIME", iso.slice(11, 19)],
     ]);
     const resolved = clonePlanTree(plan);
@@ -3111,7 +3277,7 @@ export function applyWindowFunctions(result, windows, options = {}) {
     };
 }
 /** Executes each derived or set-operation source with the row reference. */
-function resolveDerivedRowTables(plan, tables) {
+function resolveDerivedRowTables(plan, tables, memory) {
     const sources = [plan.base, ...plan.joins];
     const needsDual = sources.some((source) => source.derived === undefined && source.table === DUAL_TABLE);
     if (!needsDual &&
@@ -3127,28 +3293,28 @@ function resolveDerivedRowTables(plan, tables) {
     for (const source of sources) {
         if (source.recursive !== undefined) {
             const { reference, base, step, all } = source.recursive;
-            const state = createRecursiveCteState(executeRowQueryInternal(base, tables), all);
+            const state = createRecursiveCteState(executeRowQueryInternal(base, tables, memory), all);
             while (state.frontier.length > 0) {
                 const stepTables = new Map(tables);
                 stepTables.set(reference, state.frontier);
-                state.absorb(executeRowQueryInternal(step, stepTables));
+                state.absorb(executeRowQueryInternal(step, stepTables, memory));
             }
             resolved.set(source.table, state.rows);
             continue;
         }
         if (source.union !== undefined) {
-            const results = source.union.blocks.map((block) => executeRowQueryInternal(block, tables));
+            const results = source.union.blocks.map((block) => executeRowQueryInternal(block, tables, memory));
             resolved.set(source.table, combineUnionResults(results, source.union.ops).rows);
             continue;
         }
         if (source.windowed !== undefined) {
-            const inner = executeRowQueryInternal(source.windowed.block, tables);
+            const inner = executeRowQueryInternal(source.windowed.block, tables, memory);
             resolved.set(source.table, applyWindowFunctions(inner, source.windowed.windows).rows);
             continue;
         }
         if (source.derived === undefined)
             continue;
-        resolved.set(source.table, executeRowQueryInternal(source.derived, tables).rows);
+        resolved.set(source.table, executeRowQueryInternal(source.derived, tables, memory).rows);
     }
     return resolved;
 }
@@ -3170,7 +3336,7 @@ function normalizeColumnarTables(plan, tables) {
 export function executeRowQuery(plan, tables) {
     return externalizeQueryResult(executeRowQueryInternal(plan, cloneRowTables(tables, true)));
 }
-function executeRowQueryInternal(plan, tables) {
+function executeRowQueryInternal(plan, tables, memory) {
     assertTailParametersBound(plan);
     validateGrouping(plan);
     plan = resolveStatementDatetimes(plan);
@@ -3182,7 +3348,7 @@ function executeRowQueryInternal(plan, tables) {
     plan = expandFtsColumns(plan, rowTableSearchableColumns(tables));
     const resolution = subqueryResolutionSteps(plan);
     for (const step of resolution.steps) {
-        step.substitute(executeRowQueryInternal(step.block, tables));
+        step.substitute(executeRowQueryInternal(step.block, tables, memory));
     }
     // Stats annotation writes into the plan; when resolution had nothing to clone, the plan is
     // still the caller's (possibly cached) object, and frozen statistics would survive into later
@@ -3191,7 +3357,7 @@ function executeRowQueryInternal(plan, tables) {
         resolution.plan === plan && planContainsFts(plan, "bm25")
             ? structuredClone(plan)
             : resolution.plan;
-    tables = resolveDerivedRowTables(plan, tables);
+    tables = resolveDerivedRowTables(plan, tables, memory);
     plan = expandDistinctWildcard(plan, wildcardRowColumns(tables));
     annotateRowFtsStats(plan, tables);
     let contexts = (tables.get(plan.base.table) ?? []).map((row) => ({
@@ -3212,17 +3378,28 @@ function executeRowQueryInternal(plan, tables) {
             group.push(context);
             groups.set(key, group);
         }
-        rows = [...groups.values()]
-            .filter((group) => plan.having.every((predicate) => evaluateBooleanExpression({
-            kind: "condition",
-            operator: predicate.operator,
-            left: predicate.left,
-            right: predicate.right,
-        }, (nested) => evaluate(nested, group[0] ?? {}, group)) === true))
-            .map((group) => project(plan.select, group[0] ?? {}, group));
+        rows = [];
+        for (const group of groups.values()) {
+            if (!plan.having.every((predicate) => evaluateBooleanExpression({
+                kind: "condition",
+                operator: predicate.operator,
+                left: predicate.left,
+                right: predicate.right,
+            }, (nested) => evaluate(nested, group[0] ?? {}, group)) === true)) {
+                continue;
+            }
+            const row = project(plan.select, group[0] ?? {}, group);
+            memory?.tally(rowQueryPayloadBytes(row), "Row query result");
+            rows.push(row);
+        }
     }
     else {
-        rows = contexts.map((context) => project(plan.select, context));
+        rows = [];
+        for (const context of contexts) {
+            const row = project(plan.select, context);
+            memory?.tally(rowQueryPayloadBytes(row), "Row query result");
+            rows.push(row);
+        }
     }
     if (plan.orderBy.length > 0) {
         // Only a wildcard select needs the source shapes: every other select resolves against its
@@ -3260,6 +3437,25 @@ function executeRowQueryInternal(plan, tables) {
         : plan.select.map((item) => item.alias);
     return ties.trim({ columns, rows });
 }
+/** Matches the vector executor's deliberately inexpensive modeled result-payload accounting. */
+function rowQueryPayloadBytes(row) {
+    let total = 8;
+    for (const key in row) {
+        const value = row[key] ?? null;
+        total +=
+            value === null
+                ? 1
+                : typeof value === "boolean"
+                    ? 2
+                    : typeof value === "number" || value instanceof Date
+                        ? 9
+                        : 1 + value.length;
+    }
+    if (!Number.isSafeInteger(total) || total < 0) {
+        throw new RangeError("Row query result payload exceeds the safe integer range");
+    }
+    return total;
+}
 /**
  * Resolves one ORDER BY reference to the output column that carries its values, throwing when
  * nothing matches. Dropping an unresolved sort key silently would return rows in an arbitrary
@@ -3532,7 +3728,7 @@ function evaluate(expression, context, group) {
                 if (expression.distinct === true) {
                     const seen = new Set();
                     values = values.filter((value) => {
-                        const key = value instanceof Date ? ` d${String(value.getTime())}` : value;
+                        const key = value instanceof Date ? ` d${String(dateMilliseconds(value))}` : value;
                         if (seen.has(key))
                             return false;
                         seen.add(key);
@@ -3664,10 +3860,6 @@ export function cachedListMembership(node, items) {
     }
     return cached;
 }
-/** Compiles a LIKE pattern (% = any run, _ = any character) to an anchored RegExp, cached. */
-export function likeRegExp(pattern, caseInsensitive = false, escape) {
-    return compileLikePattern(pattern, caseInsensitive, escape);
-}
 const extractFields = new Set([
     "year",
     "quarter",
@@ -3695,70 +3887,38 @@ function extractDatePart(field, value) {
         throw new TypeError("EXTRACT requires a datetime value");
     switch (normalized) {
         case "year":
-            return value.getUTCFullYear();
+            return dateUtcFullYear(value);
         case "quarter":
-            return Math.floor(value.getUTCMonth() / 3) + 1;
+            return Math.floor(dateUtcMonth(value) / 3) + 1;
         case "month":
-            return value.getUTCMonth() + 1;
+            return dateUtcMonth(value) + 1;
         case "week": {
-            const date = new Date(Date.UTC(value.getUTCFullYear(), value.getUTCMonth(), value.getUTCDate()));
+            const date = new Date(Date.UTC(dateUtcFullYear(value), dateUtcMonth(value), dateUtcDate(value)));
             // ISO week: shift to the Thursday of this week, then count weeks from January 1st.
-            date.setUTCDate(date.getUTCDate() + 4 - (date.getUTCDay() || 7));
-            const yearStart = Date.UTC(date.getUTCFullYear(), 0, 1);
-            return Math.ceil(((date.getTime() - yearStart) / 86_400_000 + 1) / 7);
+            setDateUtcDate(date, dateUtcDate(date) + 4 - (dateUtcDay(date) || 7));
+            const yearStart = Date.UTC(dateUtcFullYear(date), 0, 1);
+            return Math.ceil(((dateMilliseconds(date) - yearStart) / 86_400_000 + 1) / 7);
         }
         case "day":
-            return value.getUTCDate();
+            return dateUtcDate(value);
         case "hour":
-            return value.getUTCHours();
+            return dateUtcHours(value);
         case "minute":
-            return value.getUTCMinutes();
+            return dateUtcMinutes(value);
         case "second":
-            return value.getUTCSeconds();
+            return dateUtcSeconds(value);
         case "epoch":
-            return value.getTime() / 1000;
+            return dateMilliseconds(value) / 1000;
         default:
-            return value.getUTCDay();
+            return dateUtcDay(value);
     }
 }
-const likeMatcherCache = new Map();
 /**
- * A compiled LIKE matcher. Patterns shaped `abc%`, `%abc`, `%abc%`, and `abc` skip the regular
- * expression entirely — prefix/suffix/containment string scans are several times faster and
- * dominate real workloads — and everything else falls back to the anchored RegExp.
+ * Shared bounded LIKE matcher. Compilation and the common literal prefix/suffix/containment
+ * fast paths are cached in sql-semantics; complex wildcard shapes have deterministic work caps.
  */
 export function likeMatches(pattern, value, caseInsensitive = false, escape) {
-    const key = `${caseInsensitive ? "i" : "s"}${escape ?? ""}\0${pattern}`;
-    let matcher = likeMatcherCache.get(key);
-    if (matcher === undefined) {
-        matcher = buildLikeMatcher(pattern, caseInsensitive, escape);
-        if (likeMatcherCache.size >= 128)
-            likeMatcherCache.clear();
-        likeMatcherCache.set(key, matcher);
-    }
-    return matcher(value);
-}
-function buildLikeMatcher(pattern, caseInsensitive, escape) {
-    if (escape === undefined && !pattern.includes("_")) {
-        const leading = pattern.startsWith("%");
-        const trailing = pattern.endsWith("%");
-        const body = pattern.slice(leading ? 1 : 0, trailing ? pattern.length - 1 : undefined);
-        if (!body.includes("%")) {
-            const needle = caseInsensitive ? body.toLowerCase() : body;
-            const fold = caseInsensitive
-                ? (value) => value.toLowerCase()
-                : (value) => value;
-            if (leading && trailing)
-                return (value) => fold(value).includes(needle);
-            if (trailing)
-                return (value) => fold(value).startsWith(needle);
-            if (leading)
-                return (value) => fold(value).endsWith(needle);
-            return (value) => fold(value) === needle;
-        }
-    }
-    const regExp = likeRegExp(pattern, caseInsensitive, escape);
-    return (value) => regExp.test(value);
+    return compileLikePattern(pattern, caseInsensitive, escape).test(value);
 }
 /** Splits a quantified operator like "> ANY" into its comparison and quantifier. */
 export function parseQuantified(operator) {
@@ -4087,7 +4247,7 @@ export function expressionAliases(expression) {
     return new Set(expressionColumns(expression).flatMap((reference) => reference.includes(".") ? [reference.split(".")[0] ?? ""] : []));
 }
 function comparable(value) {
-    return value instanceof Date ? value.getTime() : value;
+    return value instanceof Date ? dateMilliseconds(value) : value;
 }
 /**
  * Resolves NULL placement for one order term. An omitted placement follows PostgreSQL: NULLS LAST
@@ -6529,6 +6689,9 @@ class Parser {
                 throw new TypeError("Use either ? or $n placeholders in one statement, not both");
             }
             this.#positionalParameters += 1;
+            if (this.#positionalParameters > MAX_SQL_PARAMETERS) {
+                throw new RangeError(`A SQL statement cannot exceed ${String(MAX_SQL_PARAMETERS)} parameters`);
+            }
             return { kind: "parameter", index: this.#positionalParameters - 1 };
         }
         if (this.#positionalParameters > 0) {
@@ -6538,6 +6701,9 @@ class Parser {
         if (!Number.isInteger(number) || number < 1) {
             throw new TypeError(`Parameter numbers start at $1: $${token.text}`);
         }
+        if (number > MAX_SQL_PARAMETERS) {
+            throw new RangeError(`A SQL statement cannot exceed ${String(MAX_SQL_PARAMETERS)} parameters`);
+        }
         this.#highestNumberedParameter = Math.max(this.#highestNumberedParameter, number);
         return { kind: "parameter", index: number - 1 };
     }
@@ -6789,7 +6955,7 @@ class Parser {
         }
         if (upper === "DATE" && this.#peek().kind === "string") {
             const date = new Date(`${this.#take("string").text}T00:00:00.000Z`);
-            if (!Number.isFinite(date.getTime()))
+            if (!Number.isFinite(dateMilliseconds(date)))
                 throw new TypeError("Invalid DATE literal");
             return { kind: "literal", value: date };
         }
@@ -8245,8 +8411,9 @@ function jsonTableColumnValue(column, value) {
         date = new Date(value);
     else
         throw new TypeError("JSON_TABLE datetime is invalid");
-    if (!Number.isFinite(date.getTime()))
+    if (!Number.isFinite(dateMilliseconds(date))) {
         throw new TypeError("JSON_TABLE datetime is invalid");
+    }
     return date;
 }
 export function timestampLiteral(text) {
@@ -8257,8 +8424,9 @@ export function timestampLiteral(text) {
     const [, day, time = "00:00:00", zone = "Z"] = match;
     const seconds = time.length === 5 ? `${time}:00` : time;
     const date = new Date(`${String(day)}T${seconds}${zone === "Z" ? "Z" : zone}`);
-    if (!Number.isFinite(date.getTime()))
+    if (!Number.isFinite(dateMilliseconds(date))) {
         throw new TypeError(`Invalid TIMESTAMP literal: ${text}`);
+    }
     return date;
 }
 /** The parser's OFFSET range contract, shared with the typed builder. */
@@ -8433,6 +8601,24 @@ function validNumericLiteral(text, radix) {
 }
 function tokenize(sql) {
     const tokens = [];
+    let nestingDepth = 0;
+    const push = (token) => {
+        if (tokens.length >= MAX_SQL_TOKENS) {
+            throw new SqlCompileError(`A SQL statement cannot exceed ${String(MAX_SQL_TOKENS)} tokens`, token.start, Math.max(token.end - token.start, 1));
+        }
+        if (token.kind === "punctuation") {
+            if (token.text === "(" || token.text === "[") {
+                nestingDepth += 1;
+                if (nestingDepth > MAX_SQL_NESTING_DEPTH) {
+                    throw new SqlCompileError(`SQL nesting cannot exceed ${String(MAX_SQL_NESTING_DEPTH)} levels`, token.start, 1);
+                }
+            }
+            else if ((token.text === ")" || token.text === "]") && nestingDepth > 0) {
+                nestingDepth -= 1;
+            }
+        }
+        tokens.push(token);
+    };
     let index = 0;
     while (index < sql.length) {
         const character = sql[index] ?? "";
@@ -8444,7 +8630,7 @@ function tokenize(sql) {
             const start = index++;
             while (index < sql.length && /[A-Za-z0-9_]/.test(sql[index] ?? ""))
                 index += 1;
-            tokens.push({ kind: "identifier", text: sql.slice(start, index), start, end: index });
+            push({ kind: "identifier", text: sql.slice(start, index), start, end: index });
             continue;
         }
         if (/\d/.test(character)) {
@@ -8461,7 +8647,7 @@ function tokenize(sql) {
                 if (!validNumericLiteral(digits, radix) || !Number.isSafeInteger(value)) {
                     throw new SqlCompileError(`Invalid number: ${sql.slice(start, index)}`, start, index - start);
                 }
-                tokens.push({ kind: "number", text: String(value), start, end: index });
+                push({ kind: "number", text: String(value), start, end: index });
                 continue;
             }
             index += 1;
@@ -8471,7 +8657,7 @@ function tokenize(sql) {
             const text = sql.slice(start, index);
             if (!validNumericLiteral(text, 10))
                 throw new SqlCompileError(`Invalid number: ${text}`, start, index - start);
-            tokens.push({ kind: "number", text: text.replaceAll("_", ""), start, end: index });
+            push({ kind: "number", text: text.replaceAll("_", ""), start, end: index });
             continue;
         }
         if (character === "'") {
@@ -8493,7 +8679,7 @@ function tokenize(sql) {
             }
             if (!closed)
                 throw new SqlCompileError("Unterminated string literal", start, sql.length - start);
-            tokens.push({ kind: "string", text: value, start, end: index });
+            push({ kind: "string", text: value, start, end: index });
             continue;
         }
         if (character === '"') {
@@ -8519,11 +8705,11 @@ function tokenize(sql) {
             if (value.length === 0) {
                 throw new SqlCompileError("Quoted identifiers cannot be empty", start, index - start);
             }
-            tokens.push({ kind: "identifier", text: value, quoted: true, start, end: index });
+            push({ kind: "identifier", text: value, quoted: true, start, end: index });
             continue;
         }
         if (character === "?") {
-            tokens.push({ kind: "parameter", text: "", start: index, end: index + 1 });
+            push({ kind: "parameter", text: "", start: index, end: index + 1 });
             index += 1;
             continue;
         }
@@ -8535,7 +8721,7 @@ function tokenize(sql) {
             if (digits.length === 0) {
                 throw new SqlCompileError("Expected a parameter number after $", start, 1);
             }
-            tokens.push({ kind: "parameter", text: digits, start, end: index });
+            push({ kind: "parameter", text: digits, start, end: index });
             continue;
         }
         const pair = sql.slice(index, index + 2);
@@ -8557,19 +8743,19 @@ function tokenize(sql) {
         if (character === ";") {
             // Statement separators lex normally; the routers reject them everywhere except inside
             // a CREATE TRIGGER body, which is the one multi-statement construct.
-            tokens.push({ kind: "punctuation", text: ";", start: index, end: index + 1 });
+            push({ kind: "punctuation", text: ";", start: index, end: index + 1 });
             index += 1;
             continue;
         }
         if ([">=", "<=", "!=", "<>", "||"].includes(pair)) {
-            tokens.push({ kind: "operator", text: pair, start: index, end: index + 2 });
+            push({ kind: "operator", text: pair, start: index, end: index + 2 });
             index += 2;
             continue;
         }
         if (["+", "-", "*", "/", "%", "=", ">", "<"].includes(character))
-            tokens.push({ kind: "operator", text: character, start: index, end: index + 1 });
+            push({ kind: "operator", text: character, start: index, end: index + 1 });
         else if (["(", ")", "[", "]", ",", "."].includes(character))
-            tokens.push({ kind: "punctuation", text: character, start: index, end: index + 1 });
+            push({ kind: "punctuation", text: character, start: index, end: index + 1 });
         else
             throw new SqlCompileError(`Unsupported SQL character: ${character}`, index, 1);
         index += 1;
@@ -8577,4 +8763,11 @@ function tokenize(sql) {
     tokens.push({ kind: "eof", text: "", start: sql.length, end: sql.length });
     return tokens;
 }
-//# sourceMappingURL=query.js.map
+function validateSqlSource(sql) {
+    if (typeof sql !== "string")
+        throw new TypeError("SQL must be a string");
+    if (sql.length > MAX_SQL_TEXT_CHARACTERS) {
+        throw new RangeError(`SQL text cannot exceed ${String(MAX_SQL_TEXT_CHARACTERS)} characters`);
+    }
+    assertWellFormedString(sql, "SQL text");
+}