@minnowdb/core 0.3.0 → 0.4.1

package/dist/block-format/column.js

@@ -1,3 +1,6 @@
+import { dateMilliseconds } from "../date-value.js";
+import { physicalColumnByteLength, validatePhysicalColumn } from "./physical.js";
+import { wellFormedUtf8ByteLength } from "./unicode.js";
 const textEncoder = new TextEncoder();
 const textDecoder = new TextDecoder("utf-8", { fatal: true });
 // The on-disk format is little-endian; bulk Float64 writes use platform order when they match.
@@ -17,37 +20,74 @@ export function encodeColumn(input) {
     // the validity bitmap from the value payload and persist a corrupt block. A hole reads as
     // undefined and is rejected like any other non-value.
     const rowCount = input.values.length;
-    const validity = new Uint8Array(bitmapLength(rowCount));
-    let nullCount = 0;
-    for (let index = 0; index < rowCount; index += 1) {
-        const value = input.values[index];
-        if (value === undefined)
-            throw new TypeError("Column values cannot be undefined");
-        if (value !== null)
-            setBit(validity, index);
-        else
-            nullCount += 1;
+    // Validate the fixed portion before allocation. Its format-level row cap bounds the largest
+    // fixed-width allocation to about 8 MiB, so boolean, number, and datetime columns validate and
+    // encode each accessor value in one pass. Reading them twice would both waste a full scan and
+    // introduce a needless time-of-check/time-of-use boundary for accessor-backed inputs.
+    physicalColumnByteLength(input.type, rowCount);
+    let stringContentByteLength = 0;
+    if (input.type === "string") {
+        // Variable-width output still needs an exact sizing pass before allocation. The encode pass
+        // below revalidates the local value it writes, so a changing accessor cannot smuggle invalid
+        // UTF-16 or make offsets disagree with the content buffer.
+        for (let index = 0; index < rowCount; index += 1) {
+            const value = input.values[index];
+            if (value === undefined)
+                throw new TypeError("Column values cannot be undefined");
+            if (value !== null) {
+                if (typeof value !== "string") {
+                    throw new TypeError("String columns accept only strings or null");
+                }
+                stringContentByteLength += wellFormedUtf8ByteLength(value);
+                if (!Number.isSafeInteger(stringContentByteLength)) {
+                    throw new RangeError("Invalid string content byte length");
+                }
+            }
+        }
     }
+    physicalColumnByteLength(input.type, rowCount, stringContentByteLength);
+    const validity = new Uint8Array(bitmapLength(rowCount));
     switch (input.type) {
         case "boolean": {
             const values = new Uint8Array(bitmapLength(rowCount));
+            let nullCount = 0;
             for (let index = 0; index < rowCount; index += 1) {
-                if (input.values[index] === true)
-                    setBit(values, index);
+                const value = input.values[index];
+                if (value === undefined)
+                    throw new TypeError("Column values cannot be undefined");
+                if (value !== null && typeof value !== "boolean") {
+                    throw new TypeError("Boolean columns accept only booleans or null");
+                }
+                if (value === null)
+                    nullCount += 1;
+                else {
+                    setBit(validity, index);
+                    if (value)
+                        setBit(values, index);
+                }
             }
             return { bytes: join(validity, values), metadata: {}, nullCount };
         }
         case "number": {
             const values = new Float64Array(rowCount);
             const view = PLATFORM_LITTLE_ENDIAN ? undefined : new DataView(values.buffer);
+            let nullCount = 0;
             let min = Number.POSITIVE_INFINITY;
             let max = Number.NEGATIVE_INFINITY;
             for (let index = 0; index < rowCount; index += 1) {
                 const value = input.values[index];
-                if (value === null || value === undefined)
+                if (value === undefined)
+                    throw new TypeError("Column values cannot be undefined");
+                if (value === null) {
+                    nullCount += 1;
                     continue;
+                }
+                if (typeof value !== "number") {
+                    throw new TypeError("Number columns accept only numbers or null");
+                }
                 if (!Number.isFinite(value))
                     throw new TypeError("Number values must be finite");
+                setBit(validity, index);
                 if (view === undefined)
                     values[index] = value;
                 else
@@ -61,15 +101,24 @@ export function encodeColumn(input) {
         case "datetime": {
             const values = new Float64Array(rowCount);
             const view = PLATFORM_LITTLE_ENDIAN ? undefined : new DataView(values.buffer);
+            let nullCount = 0;
             let min = Number.POSITIVE_INFINITY;
             let max = Number.NEGATIVE_INFINITY;
             for (let index = 0; index < rowCount; index += 1) {
                 const value = input.values[index];
-                if (value === null || value === undefined)
+                if (value === undefined)
+                    throw new TypeError("Column values cannot be undefined");
+                if (value === null) {
+                    nullCount += 1;
                     continue;
-                const milliseconds = value.getTime();
+                }
+                if (!(value instanceof Date)) {
+                    throw new TypeError("Datetime columns accept only Date objects or null");
+                }
+                const milliseconds = dateMilliseconds(value);
                 if (!Number.isFinite(milliseconds))
                     throw new TypeError("Datetime values must be valid Dates");
+                setBit(validity, index);
                 if (view === undefined)
                     values[index] = milliseconds;
                 else
@@ -81,25 +130,40 @@ export function encodeColumn(input) {
             return { bytes: join(validity, new Uint8Array(values.buffer)), metadata, nullCount };
         }
         case "string": {
-            // Every value UTF-8-encodes once, directly into a shared worst-case scratch (three bytes
-            // per UTF-16 code unit bounds any UTF-8 expansion) instead of allocating a throwaway
-            // buffer per string and copying it into place afterwards.
-            let capacity = 0;
-            for (let index = 0; index < rowCount; index += 1) {
-                const value = input.values[index];
-                if (value !== null && value !== undefined)
-                    capacity += value.length * 3;
-            }
+            // Measure exactly without allocating, both to reject lossy unpaired surrogates and to avoid
+            // the former 3x worst-case scratch for ASCII-heavy data. The complete 64 MiB format bound is
+            // checked before the content or offset arrays are allocated.
             const offsets = new Uint32Array(rowCount + 1);
-            const content = new Uint8Array(capacity);
+            // Some native encodeInto implementations stop at an internal chunk boundary when the
+            // destination has exactly two or three bytes left, even though the final code point fits.
+            // Three bytes of non-persisted tail room keeps the native fast path reliable; the returned
+            // physical payload still contains exactly `contentByteLength` content bytes.
+            const content = new Uint8Array(stringContentByteLength + 3);
             let offset = 0;
+            let nullCount = 0;
             for (let index = 0; index < rowCount; index += 1) {
                 const value = input.values[index];
-                if (value !== null && value !== undefined) {
-                    offset += textEncoder.encodeInto(value, content.subarray(offset)).written;
+                if (value === undefined)
+                    throw new TypeError("Column values cannot be undefined");
+                if (value === null)
+                    nullCount += 1;
+                else {
+                    if (typeof value !== "string") {
+                        throw new TypeError("String columns accept only strings or null");
+                    }
+                    const localByteLength = wellFormedUtf8ByteLength(value);
+                    setBit(validity, index);
+                    const result = textEncoder.encodeInto(value, content.subarray(offset));
+                    if (result.read !== value.length)
+                        throw new Error("UTF-8 output sizing mismatch");
+                    if (result.written !== localByteLength)
+                        throw new Error("UTF-8 output sizing mismatch");
+                    offset += result.written;
                 }
                 offsets[index + 1] = offset;
             }
+            if (offset !== stringContentByteLength)
+                throw new Error("UTF-8 output sizing mismatch");
             return {
                 bytes: join(validity, new Uint8Array(offsets.buffer), content.subarray(0, offset)),
                 metadata: {},
@@ -109,9 +173,12 @@ export function encodeColumn(input) {
     }
 }
 export function decodeColumn(type, bytes, rowCount) {
+    return decodeValidatedColumn(validatePhysicalColumn({ type, bytes, rowCount }));
+}
+/** Package-internal row materialization after the physical payload was already validated. */
+export function decodeValidatedColumn(column) {
+    const { type, bytes, rowCount } = column;
     const validityLength = bitmapLength(rowCount);
-    if (bytes.byteLength < validityLength)
-        throw new Error("Truncated validity bitmap");
     const validity = bytes.subarray(0, validityLength);
     const payload = bytes.subarray(validityLength);
     const values = [];
@@ -163,4 +230,3 @@ function join(...parts) {
     }
     return output;
 }
-//# sourceMappingURL=column.js.map

package/dist/block-format/index.d.ts

@@ -1,7 +1,7 @@
 export * from "./block.js";
 export * from "./checksum.js";
 export * from "./codecs.js";
-export * from "./column.js";
+export { decodeColumn, encodeColumn } from "./column.js";
 export * from "./physical.js";
 export * from "./types.js";
-//# sourceMappingURL=index.d.ts.map
+export * from "./unicode.js";

package/dist/block-format/index.js

@@ -1,7 +1,7 @@
 export * from "./block.js";
 export * from "./checksum.js";
 export * from "./codecs.js";
-export * from "./column.js";
+export { decodeColumn, encodeColumn } from "./column.js";
 export * from "./physical.js";
 export * from "./types.js";
-//# sourceMappingURL=index.js.map
+export * from "./unicode.js";

package/dist/block-format/physical.d.ts

@@ -1,7 +1,12 @@
 import type { LogicalType, PhysicalColumnMeasurement, PhysicalColumnPayload, PhysicalColumnRange, ValidatedPhysicalColumn } from "./types.js";
 export declare const MAX_PHYSICAL_COLUMN_BYTE_LENGTH: number;
+/**
+ * Hard row ceiling for one physical block. Bitmap columns otherwise fit 268 million rows under
+ * the byte limit, which would require an unsafe decoded JS array even for a valid block.
+ */
+export declare const MAX_BLOCK_ROW_COUNT = 1048576;
 export declare function physicalBitmapByteLength(rowCount: number): number;
-/** Returns the exact encoded byte length for a version-zero physical column. */
+/** Returns the exact encoded byte length for the canonical v2 physical column. */
 export declare function physicalColumnByteLength(type: LogicalType, rowCount: number, stringContentByteLength?: number): number;
 /**
  * Validates a physical payload without copying its bytes or materializing row
@@ -17,4 +22,5 @@ export declare function measurePhysicalColumnRanges<T extends LogicalType>(type:
 export declare function buildPhysicalColumnFromRanges<T extends LogicalType>(type: T, ranges: ReadonlyArray<PhysicalColumnRange<T>>): ValidatedPhysicalColumn<T>;
 export declare function slicePhysicalColumn<T extends LogicalType>(column: PhysicalColumnPayload<T>, start: number, end: number): ValidatedPhysicalColumn<T>;
 export declare function concatenatePhysicalColumns<T extends LogicalType>(type: T, columns: ReadonlyArray<PhysicalColumnPayload<T>>): ValidatedPhysicalColumn<T>;
-//# sourceMappingURL=physical.d.ts.map
+/** Validates the shared persisted-block row ceiling without allocating a physical payload. */
+export declare function assertBlockRowCount(rowCount: number): void;

package/dist/block-format/physical.js

@@ -1,10 +1,15 @@
 export const MAX_PHYSICAL_COLUMN_BYTE_LENGTH = 64 * 1024 * 1024;
+/**
+ * Hard row ceiling for one physical block. Bitmap columns otherwise fit 268 million rows under
+ * the byte limit, which would require an unsafe decoded JS array even for a valid block.
+ */
+export const MAX_BLOCK_ROW_COUNT = 1_048_576;
 const MAX_DATETIME_MILLISECONDS = 8_640_000_000_000_000;
 export function physicalBitmapByteLength(rowCount) {
     assertRowCount(rowCount);
     return Math.ceil(rowCount / 8);
 }
-/** Returns the exact encoded byte length for a version-zero physical column. */
+/** Returns the exact encoded byte length for the canonical v2 physical column. */
 export function physicalColumnByteLength(type, rowCount, stringContentByteLength = 0) {
     assertLogicalType(type);
     const validityByteLength = physicalBitmapByteLength(rowCount);
@@ -254,8 +259,7 @@ function preparePhysicalColumn(type, ranges) {
         }
         const rangeRowCount = range.end - range.start;
         rowCount = checkedAdd(rowCount, rangeRowCount, "row count");
-        if (rowCount > 0xffffffff)
-            throw new RangeError("Too many rows in one physical column");
+        assertBlockRowCount(rowCount);
         const sourceValidityLength = physicalBitmapByteLength(column.rowCount);
         const sourceValidity = column.bytes.subarray(0, sourceValidityLength);
         if (type === "string") {
@@ -404,8 +408,13 @@ function assertContinuation(bytes, index, end) {
 }
 function assertRowCount(rowCount) {
     assertNonnegativeSafeInteger(rowCount, "row count");
-    if (rowCount > 0xffffffff)
-        throw new RangeError("Too many rows in one physical column");
+    if (rowCount > MAX_BLOCK_ROW_COUNT) {
+        throw new RangeError("Physical column exceeds maximum row count");
+    }
+}
+/** Validates the shared persisted-block row ceiling without allocating a physical payload. */
+export function assertBlockRowCount(rowCount) {
+    assertRowCount(rowCount);
 }
 function assertLogicalType(type) {
     if (type !== "boolean" && type !== "number" && type !== "string" && type !== "datetime") {
@@ -436,4 +445,3 @@ function checkedMultiply(left, right, name) {
     }
     return left * right;
 }
-//# sourceMappingURL=physical.js.map

package/dist/block-format/types.d.ts

@@ -30,13 +30,18 @@ export interface BlockMetadata {
 }
 export interface BlockDescription {
     formatVersion: number;
+    headerLength: number;
+    metadataLength: number;
     type: LogicalType;
     compression: Compression;
     rowCount: number;
     nullCount: number;
     encodedLength: number;
     storedLength: number;
+    /** CRC32 of the uncompressed physical column bytes. */
     checksum: number;
+    /** CRC32 of the stored payload bytes, independently verifiable without decompression. */
+    storedChecksum: number;
     metadata: BlockMetadata;
 }
 export interface DecodedBlock<T extends LogicalType = LogicalType> {
@@ -46,8 +51,8 @@ export interface DecodedBlock<T extends LogicalType = LogicalType> {
     column: DecodedColumn<T>;
 }
 /**
- * An uncompressed physical column payload. `bytes` uses the version-zero
- * column encoding documented in `docs/BLOCK_FORMAT.md`.
+ * An uncompressed physical column payload. `bytes` uses the canonical v2 column encoding
+ * documented in `apps/site/content/docs/reference/architecture.mdx`.
  */
 export interface PhysicalColumnPayload<T extends LogicalType = LogicalType> {
     type: T;
@@ -90,4 +95,3 @@ export interface DecodedPhysicalBlock<T extends LogicalType = LogicalType> {
     column: ValidatedPhysicalColumn<T>;
 }
 export {};
-//# sourceMappingURL=types.d.ts.map

package/dist/block-format/types.js

@@ -1,2 +1 @@
 export const logicalTypes = ["boolean", "number", "string", "datetime"];
-//# sourceMappingURL=types.js.map

package/dist/block-format/unicode.d.ts

@@ -0,0 +1,11 @@
+/**
+ * Returns the exact UTF-8 byte length of a well-formed JavaScript string without allocating.
+ *
+ * UTF-8 cannot represent isolated UTF-16 surrogate code units. `TextEncoder` silently replaces
+ * them with U+FFFD, which would make persistence lossy and can collapse distinct index keys.
+ * Minnow rejects those strings instead, so every accepted string has one exact UTF-8 encoding
+ * and round-trips byte-for-byte through the block format.
+ */
+export declare function wellFormedUtf8ByteLength(value: string, context?: string): number;
+/** Rejects strings that cannot round-trip exactly through UTF-8 persistence. */
+export declare function assertWellFormedString(value: string, context?: string): void;

package/dist/block-format/unicode.js

@@ -0,0 +1,46 @@
+/**
+ * Returns the exact UTF-8 byte length of a well-formed JavaScript string without allocating.
+ *
+ * UTF-8 cannot represent isolated UTF-16 surrogate code units. `TextEncoder` silently replaces
+ * them with U+FFFD, which would make persistence lossy and can collapse distinct index keys.
+ * Minnow rejects those strings instead, so every accepted string has one exact UTF-8 encoding
+ * and round-trips byte-for-byte through the block format.
+ */
+export function wellFormedUtf8ByteLength(value, context = "String value") {
+    return measureWellFormedUtf8(value, context);
+}
+/** Rejects strings that cannot round-trip exactly through UTF-8 persistence. */
+export function assertWellFormedString(value, context = "String value") {
+    wellFormedUtf8ByteLength(value, context);
+}
+function measureWellFormedUtf8(value, context) {
+    if (typeof value !== "string")
+        throw new TypeError(`${context} must be a string`);
+    let byteLength = 0;
+    for (let index = 0; index < value.length; index += 1) {
+        const code = value.charCodeAt(index);
+        if (code <= 0x7f) {
+            byteLength += 1;
+        }
+        else if (code <= 0x7ff) {
+            byteLength += 2;
+        }
+        else if (code >= 0xd800 && code <= 0xdbff) {
+            const low = index + 1 < value.length ? value.charCodeAt(index + 1) : 0;
+            if (low < 0xdc00 || low > 0xdfff)
+                throw unpairedSurrogate(context, index);
+            byteLength += 4;
+            index += 1;
+        }
+        else if (code >= 0xdc00 && code <= 0xdfff) {
+            throw unpairedSurrogate(context, index);
+        }
+        else {
+            byteLength += 3;
+        }
+    }
+    return byteLength;
+}
+function unpairedSurrogate(context, index) {
+    return new TypeError(`${context} contains an unpaired surrogate at UTF-16 index ${String(index)}`);
+}

package/dist/date-value.d.ts

@@ -0,0 +1,15 @@
+/** Returns a Date's internal millisecond value without invoking an instance override. */
+export declare function dateMilliseconds(value: Date): number;
+/** Copies a Date by its internal value without invoking instance methods. */
+export declare function copyDate(value: Date): Date;
+/** Formats a Date's internal value without invoking an instance override. */
+export declare function dateIsoString(value: Date): string;
+export declare function dateUtcFullYear(value: Date): number;
+export declare function dateUtcMonth(value: Date): number;
+export declare function dateUtcDate(value: Date): number;
+export declare function dateUtcDay(value: Date): number;
+export declare function dateUtcHours(value: Date): number;
+export declare function dateUtcMinutes(value: Date): number;
+export declare function dateUtcSeconds(value: Date): number;
+export declare function setDateUtcDate(value: Date, day: number): number;
+export declare function setDateUtcMonth(value: Date, month: number): number;

package/dist/date-value.js

@@ -0,0 +1,64 @@
+// Capture the intrinsic once. A Date instance may shadow `getTime`; persistence, indexes, and
+// comparisons must all observe its internal [[DateValue]], not caller-controlled method code.
+// Capturing the intrinsic is the point: later Date.prototype mutations must not change values.
+// eslint-disable-next-line @typescript-eslint/unbound-method
+const intrinsicDateGetTime = Date.prototype.getTime;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- See the getTime capture above.
+const intrinsicDateToISOString = Date.prototype.toISOString;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcFullYear = Date.prototype.getUTCFullYear;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcMonth = Date.prototype.getUTCMonth;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcDate = Date.prototype.getUTCDate;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcDay = Date.prototype.getUTCDay;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcHours = Date.prototype.getUTCHours;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcMinutes = Date.prototype.getUTCMinutes;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateGetUtcSeconds = Date.prototype.getUTCSeconds;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateSetUtcDate = Date.prototype.setUTCDate;
+// eslint-disable-next-line @typescript-eslint/unbound-method -- Captured for the same reason.
+const intrinsicDateSetUtcMonth = Date.prototype.setUTCMonth;
+/** Returns a Date's internal millisecond value without invoking an instance override. */
+export function dateMilliseconds(value) {
+    return intrinsicDateGetTime.call(value);
+}
+/** Copies a Date by its internal value without invoking instance methods. */
+export function copyDate(value) {
+    return new Date(dateMilliseconds(value));
+}
+/** Formats a Date's internal value without invoking an instance override. */
+export function dateIsoString(value) {
+    return intrinsicDateToISOString.call(value);
+}
+export function dateUtcFullYear(value) {
+    return intrinsicDateGetUtcFullYear.call(value);
+}
+export function dateUtcMonth(value) {
+    return intrinsicDateGetUtcMonth.call(value);
+}
+export function dateUtcDate(value) {
+    return intrinsicDateGetUtcDate.call(value);
+}
+export function dateUtcDay(value) {
+    return intrinsicDateGetUtcDay.call(value);
+}
+export function dateUtcHours(value) {
+    return intrinsicDateGetUtcHours.call(value);
+}
+export function dateUtcMinutes(value) {
+    return intrinsicDateGetUtcMinutes.call(value);
+}
+export function dateUtcSeconds(value) {
+    return intrinsicDateGetUtcSeconds.call(value);
+}
+export function setDateUtcDate(value, day) {
+    return intrinsicDateSetUtcDate.call(value, day);
+}
+export function setDateUtcMonth(value, month) {
+    return intrinsicDateSetUtcMonth.call(value, month);
+}

package/dist/engine/artifact-cache.d.ts

@@ -21,4 +21,3 @@ export declare class ArtifactCache {
     clear(): void;
     stats(): ArtifactCacheStats;
 }
-//# sourceMappingURL=artifact-cache.d.ts.map

package/dist/engine/artifact-cache.js

@@ -70,4 +70,3 @@ export class ArtifactCache {
         };
     }
 }
-//# sourceMappingURL=artifact-cache.js.map

package/dist/engine/batch.d.ts

@@ -10,7 +10,11 @@
 export type BatchValue = boolean | number | string | Date | null;
 /** One row. A missing property is SQL omission; an explicit `null` remains SQL NULL. */
 export type BatchRow = Readonly<Record<string, BatchValue>>;
-/** The columnar form: one array per column, all of the same length, aligned by index. */
+/**
+ * The columnar form: one ordinary readonly array per column, all of the same length and aligned by
+ * index. The engine reads these arrays without copying while the asynchronous write is active;
+ * callers must not mutate them or use changing accessor/proxy values until the write settles.
+ */
 export interface ColumnarBatch {
     columns: Readonly<Record<string, readonly BatchValue[]>>;
     /**
@@ -30,4 +34,3 @@ export type InsertBatchInput = readonly BatchRow[] | ColumnarBatch;
 export declare function isColumnarBatch(input: InsertBatchInput): input is ColumnarBatch;
 /** Pivots rows into the engine's columnar form; a columnar batch passes straight through. */
 export declare function toColumnarBatch(input: InsertBatchInput): ColumnarBatch;
-//# sourceMappingURL=batch.d.ts.map

package/dist/engine/batch.js

@@ -46,4 +46,3 @@ export function toColumnarBatch(input) {
         rowCount: input.length,
     };
 }
-//# sourceMappingURL=batch.js.map

package/dist/engine/buffered-writer.d.ts

@@ -24,6 +24,8 @@ export interface LifecycleFlushOptions {
     document?: LifecycleDocumentTarget;
     page?: LifecyclePageTarget;
 }
+/** Maximum accepted `add()` calls that have not completed. Callers must await for backpressure. */
+export declare const MAX_BUFFERED_WRITER_PENDING_ADDS = 64;
 /** Batches row-oriented writes by row count, estimated bytes, or age. */
 export declare class BufferedTableWriter {
     #private;
@@ -40,4 +42,3 @@ export declare class BufferedTableWriter {
 }
 /** Requests a non-blocking flush when the browser hides or unloads the page. */
 export declare function attachLifecycleFlush(requester: LifecycleFlushRequester, options?: LifecycleFlushOptions): () => void;
-//# sourceMappingURL=buffered-writer.d.ts.map

package/dist/engine/buffered-writer.js

@@ -1,3 +1,6 @@
+import { copyDate } from "../date-value.js";
+/** Maximum accepted `add()` calls that have not completed. Callers must await for backpressure. */
+export const MAX_BUFFERED_WRITER_PENDING_ADDS = 64;
 /** Batches row-oriented writes by row count, estimated bytes, or age. */
 export class BufferedTableWriter {
     database;
@@ -11,6 +14,9 @@ export class BufferedTableWriter {
     #estimatedBytes = 0;
     #timer;
     #inFlight;
+    #addTail = Promise.resolve();
+    #pendingAddCount = 0;
+    #acceptingAdds = true;
     #closed = false;
     constructor(database, tableName, options = {}) {
         this.database = database;
@@ -29,14 +35,17 @@ export class BufferedTableWriter {
     }
     async add(row) {
         this.#assertOpen();
-        const copy = cloneRow(row);
-        this.#rows.push(copy);
-        this.#estimatedBytes += estimateRowBytes(copy);
-        this.#scheduleAgeFlush();
-        if (this.#rows.length >= this.#maxRows || this.#estimatedBytes >= this.#maxBytes) {
-            return this.flush();
+        if (!this.#acceptingAdds)
+            return Promise.reject(new Error("Buffered writer is closing"));
+        if (this.#pendingAddCount >= MAX_BUFFERED_WRITER_PENDING_ADDS) {
+            return Promise.reject(new RangeError(`Buffered writer cannot queue more than ${String(MAX_BUFFERED_WRITER_PENDING_ADDS)} adds; await add() for backpressure`));
         }
-        return undefined;
+        this.#pendingAddCount += 1;
+        const operation = this.#addTail.then(() => this.#addSerial(row));
+        this.#addTail = operation.then(() => undefined, () => undefined);
+        return operation.finally(() => {
+            this.#pendingAddCount -= 1;
+        });
     }
     async flush() {
         if (this.#inFlight !== undefined)
@@ -70,6 +79,8 @@ export class BufferedTableWriter {
     async close() {
         if (this.#closed)
             return undefined;
+        this.#acceptingAdds = false;
+        await this.#addTail;
         let result;
         while (this.#inFlight !== undefined || this.#rows.length > 0) {
             result = await this.flush();
@@ -82,6 +93,9 @@ export class BufferedTableWriter {
     }
     discard() {
         this.#assertOpen();
+        if (this.#pendingAddCount > 0) {
+            throw new Error("Cannot discard while buffered adds are pending");
+        }
         const discarded = this.#rows.length;
         this.#rows.length = 0;
         this.#estimatedBytes = 0;
@@ -96,6 +110,18 @@ export class BufferedTableWriter {
                 await this.flush();
         }
     }
+    async #addSerial(row) {
+        const copy = cloneRow(row);
+        this.#rows.push(copy);
+        this.#estimatedBytes += estimateRowBytes(copy);
+        this.#scheduleAgeFlush();
+        if (this.#rows.length < this.#maxRows && this.#estimatedBytes < this.#maxBytes) {
+            return undefined;
+        }
+        if (this.#inFlight !== undefined)
+            await this.#inFlight;
+        return this.flush();
+    }
     #scheduleAgeFlush() {
         if (this.#timer !== undefined || this.#rows.length === 0 || this.#closed)
             return;
@@ -140,7 +166,7 @@ function positiveWholeNumber(value, name) {
 function cloneRow(row) {
     return Object.fromEntries(Object.entries(row).map(([name, value]) => [
         name,
-        value instanceof Date ? new Date(value.getTime()) : value,
+        value instanceof Date ? copyDate(value) : value,
     ]));
 }
 function estimateRowBytes(row) {
@@ -155,4 +181,3 @@ function estimateRowBytes(row) {
     }
     return bytes;
 }
-//# sourceMappingURL=buffered-writer.js.map

package/dist/engine/cache-limits.d.ts

@@ -0,0 +1,25 @@
+/** Valid inputs beyond this length execute normally but are not retained in process-wide caches. */
+export declare const MAX_CACHEABLE_TEXT_CHARACTERS: number;
+/**
+ * Compilation happens before a query memory context exists. These limits therefore bound parser
+ * allocations and recursion independently of the execution budget. They are intentionally much
+ * larger than ordinary application SQL while remaining small enough for deterministic refusal.
+ */
+export declare const MAX_SQL_TEXT_CHARACTERS: number;
+export declare const MAX_SQL_TOKENS = 4096;
+export declare const MAX_SQL_NESTING_DEPTH = 128;
+export declare const MAX_SQL_PARAMETERS = 4096;
+/**
+ * Scalar functions that create a new string must not allocate an attacker-selected result before
+ * query memory accounting can observe it. Plain projection does not use this limit: a stored wide
+ * value can still be selected or streamed without asking a scalar function to expand it.
+ */
+export declare const MAX_SQL_SCALAR_RESULT_CHARACTERS: number;
+/** Bounds object/array walks performed before an execution memory context exists. */
+export declare const MAX_SQL_STRUCTURED_VALUE_ITEMS = 65536;
+export declare const MAX_SQL_STRUCTURED_VALUE_DEPTH = 128;
+/** SQL patterns compile outside the execution memory budget and may be retained in small caches. */
+export declare const MAX_SQL_PATTERN_CHARACTERS: number;
+/** Deterministic CPU ceiling for one non-trivial LIKE or SIMILAR TO match. */
+export declare const MAX_SQL_PATTERN_MATCH_STEPS: number;
+export declare const MAX_SQL_NUMERIC_DIGITS = 100000;