@rvoh/dream 2.17.2 → 2.18.0

package/dist/cjs/src/dream/Query.js

@@ -1193,6 +1193,19 @@ export default class Query {
     get connectionName() {
         return this.dreamInstance.connectionName || 'default';
     }
+    /**
+     * @internal
+     *
+     * Resolves the effective page size for a pagination request: applies the
+     * configured default when no page size is requested, and clamps the result to
+     * the configured maximum (`paginationMaxPageSize`, default 200) so that a
+     * forwarded, attacker-controlled `pageSize` cannot force a full-table load.
+     */
+    clampedPaginationPageSize(requestedPageSize) {
+        const dreamApp = DreamApp.getOrFail();
+        const pageSize = Math.max(0, requestedPageSize ?? 0) || dreamApp.paginationPageSize;
+        return Math.min(pageSize, dreamApp.paginationMaxPageSize);
+    }
     /**
      * Paginates the results of your query, accepting a pageSize and page argument,
      * which it uses to segment your query into pages, leveraging limit and offset
@@ -1231,7 +1244,7 @@ export default class Query {
             throw new CannotPaginateWithLeftJoinPreload();
         const page = computedPaginatePage(options.page);
         const recordCount = await this.count();
-        const pageSize = Math.max(0, options.pageSize ?? 0) || DreamApp.getOrFail().paginationPageSize;
+        const pageSize = this.clampedPaginationPageSize(options.pageSize);
         const pageCount = Math.ceil(recordCount / pageSize);
         const query = this.orderStatements.length
             ? this
@@ -1323,7 +1336,7 @@ export default class Query {
      */
     async cursorPaginate(opts) {
         const options = opts;
-        const pageSize = Math.max(0, options.pageSize ?? 0) || DreamApp.getOrFail().paginationPageSize;
+        const pageSize = this.clampedPaginationPageSize(options.pageSize);
         if (options === null)
             return { cursor: null, results: [] };
         if (this.limitStatement)

package/dist/cjs/src/dream/QueryDriver/Kysely.js

@@ -14,6 +14,7 @@ import DreamCLI from '../../cli/index.js';
 import { CHECK_VIOLATION, COLUMN_OVERFLOW, INVALID_INPUT_SYNTAX, NOT_NULL_VIOLATION, pgErrorType, } from '../../db/errors.js';
 import syncDbTypesFiles from '../../db/helpers/syncDbTypesFiles.js';
 import { default as _db } from '../../db/index.js';
+import validateColumn from '../../db/validators/validateColumn.js';
 import associationToGetterSetterProp from '../../decorators/field/association/associationToGetterSetterProp.js';
 import PackageManager from '../../dream-app/helpers/PackageManager.js';
 import DreamApp from '../../dream-app/index.js';
@@ -551,6 +552,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         // that can exceed 63 bytes. Short aliases like "pluck0" avoid this entirely.
         const shortAliases = [];
         fields.forEach((field, index) => {
+            this.validatePlainColumn(this.dreamClass, field);
             const shortAlias = `pluck${index}`;
             shortAliases.push(shortAlias);
             //  namespace the selection so that when plucking the same column name from
@@ -719,6 +721,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         });
         if (this.query['orderStatements'].length && !bypassOrder) {
             this.query['orderStatements'].forEach(orderStatement => {
+                this.validatePlainColumn(this.dreamClass, orderStatement.column);
                 kyselyQuery = kyselyQuery.orderBy(this.namespaceColumn(orderStatement.column), this.orderByDirection(orderStatement.direction));
             });
         }
@@ -1034,6 +1037,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         if (query['whereStatements'].length ||
             query['whereNotStatements'].length ||
             query['whereAnyStatements'].length) {
+            this.validateBaseWhereStatementColumns(query);
             kyselyQuery = kyselyQuery.where((eb) => eb.and([
                 ...this.aliasWhereStatements(query['whereStatements'], query['baseSqlAlias']).map(whereStatement => this.whereStatementToExpressionWrapper(this.dreamClass, eb, whereStatement, {
                     disallowSimilarityOperator: false,
@@ -1368,6 +1372,66 @@ export default class KyselyQueryDriver extends QueryDriverBase {
     namespaceColumn(column, alias = this.query['baseSqlAlias']) {
         return namespaceColumn(column, alias);
     }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01): when a runtime column identifier is a
+     * plain, un-namespaced column name, validate it against the owning model's
+     * compiled schema so an unknown identifier throws a Dream `InvalidColumnName`
+     * error before it reaches the database (rather than surfacing as a raw
+     * Postgres error or a silent blind-ordering side-channel).
+     *
+     * Only bare identifiers are validated. Namespaced / table-aliased /
+     * association-namespaced identifiers (anything containing a `.`) are left on
+     * their existing path, because the segment before the `.` may be an
+     * association alias or table alias rather than a schema table name, and
+     * validating those safely is not possible here without risking rejection of
+     * currently-valid input.
+     */
+    validatePlainColumn(dreamClass, column) {
+        if (typeof column !== 'string')
+            return;
+        if (column.includes('.'))
+            return;
+        validateColumn(dreamClass.prototype.schema, dreamClass.table, column);
+    }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01) for the base model's dynamic `where` keys.
+     * These are the un-namespaced keys the developer passed to `where` /
+     * `whereNot` / `whereAny` on the root query (validated here, before
+     * `aliasWhereStatement` namespaces them with the base alias). Only plain
+     * column keys are validated. Deliberately skips:
+     *   - namespaced keys (contain a `.`) — the developer explicitly namespaced
+     *     them (e.g. `{ 'users.email': ... }` or a joined table), and the prefix
+     *     may be an association/table alias rather than a schema table name;
+     *   - association-name keys (e.g. `where({ user: userInstance })`), which are
+     *     resolved to foreign keys, not columns;
+     *   - `DreamConst.passthrough` / `DreamConst.required` sentinel values, whose
+     *     keys are resolved elsewhere.
+     *
+     * Join-and / association where statements (which target other tables and are
+     * pre-namespaced) are left on their existing path.
+     */
+    validateBaseWhereStatementColumns(query) {
+        const dreamClass = query['dreamClass'];
+        const whereStatements = [
+            ...query['whereStatements'],
+            ...query['whereNotStatements'],
+            ...query['whereAnyStatements'].flat(),
+        ];
+        whereStatements.forEach(whereStatement => Object.keys(whereStatement).forEach(attr => {
+            if (attr.includes('.'))
+                return;
+            const val = whereStatement[attr];
+            if (val === DreamConst.passthrough || val === DreamConst.required)
+                return;
+            if (dreamClass.associationNames.includes(attr))
+                return;
+            validateColumn(dreamClass.prototype.schema, dreamClass.table, attr);
+        }));
+    }
     /**
      * @internal
      *
@@ -1924,8 +1988,19 @@ export default class KyselyQueryDriver extends QueryDriverBase {
                     scopesQuery = tempQuery;
             }
         }
-        if (scopesQuery['whereStatements'].length) {
-            join = join.on((eb) => eb.and(scopesQuery['whereStatements'].flatMap(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false }))));
+        if (scopesQuery['whereStatements'].length ||
+            scopesQuery['whereNotStatements'].length ||
+            scopesQuery['whereAnyStatements'].length) {
+            // Mirror the base-table clause logic in QueryDriverBase#buildCommon so that default
+            // scopes expressed with whereNot(...)/whereAny(...) — not just where(...) — cross into
+            // association loads (preload/join/leftJoinPreload/innerJoin). Without the whereNot/whereAny
+            // branches below, such default scopes are silently dropped on association loads, leaking
+            // rows the app intended to hide.
+            join = join.on((eb) => eb.and([
+                ...scopesQuery['whereStatements'].map(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false })),
+                ...scopesQuery['whereNotStatements'].map(whereNotStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereNotStatement, tableNameOrAlias), { negate: true })),
+                ...scopesQuery['whereAnyStatements'].map(whereAnyStatements => eb.or(whereAnyStatements.map(whereAnyStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereAnyStatement, tableNameOrAlias))))),
+            ]));
         }
         return join;
     }

package/dist/cjs/src/dream-app/index.js

@@ -4,6 +4,7 @@ import validateTable from '../db/validators/validateTable.js';
 import Query from '../dream/Query.js';
 import PostgresQueryDriver from '../dream/QueryDriver/Postgres.js';
 import Encrypt from '../encrypt/index.js';
+import DreamAppInitInvalidEncryptionKey from '../errors/dream-app/DreamAppInitInvalidEncryptionKey.js';
 import DreamAppInitMissingCallToLoadModels from '../errors/dream-app/DreamAppInitMissingCallToLoadModels.js';
 import DreamAppInitMissingMissingProjectRoot from '../errors/dream-app/DreamAppInitMissingMissingProjectRoot.js';
 import DreamAppInitMissingPackageManager from '../errors/dream-app/DreamAppInitMissingPackageManager.js';
@@ -119,7 +120,9 @@ export default class DreamApp {
         if (!this.loadedModels)
             throw new DreamAppInitMissingCallToLoadModels();
         if (this.encryption?.columns?.current)
-            DreamApp.checkKey('columns', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+            DreamApp.checkKey('columns', 'current', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+        if (this.encryption?.columns?.legacy)
+            DreamApp.checkKey('columns', 'legacy', this.encryption.columns.legacy.key, this.encryption.columns.legacy.algorithm);
         if (!DreamAppAllowedPackageManagersEnumValues.includes(this.packageManager) &&
             !EnvInternal.boolean('DREAM_BYPASS_PACKAGE_MANAGER_CHECK'))
             throw new DreamAppInitMissingPackageManager();
@@ -148,22 +151,9 @@ export default class DreamApp {
             await dbDriverClass.setDatabaseTypeParsers(connectionName);
         }
     }
-    static checkKey(encryptionIdentifier, key, algorithm) {
+    static checkKey(encryptionIdentifier, keyType, key, algorithm) {
         if (!Encrypt.validateKey(key, algorithm))
-            // eslint-disable-next-line no-console
-            console.warn(`
-Your current key value for ${encryptionIdentifier} encryption is invalid.
-Try setting it to something valid, like:
-  ${Encrypt.generateKey(algorithm)}
-
-This was done by calling:
-  Encrypt.generateKey('${algorithm}'
-
-A new key can also be generated from the CLI:
-  % pnpm psy g:encryption-key
-  OR
-  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
-`);
+            throw new DreamAppInitInvalidEncryptionKey(encryptionIdentifier, keyType, algorithm);
     }
     /**
      * Returns the cached dream application if it has been set.
@@ -218,6 +208,10 @@ A new key can also be generated from the CLI:
     get paginationPageSize() {
         return this._paginationPageSize;
     }
+    _paginationMaxPageSize = 200;
+    get paginationMaxPageSize() {
+        return this._paginationMaxPageSize;
+    }
     _primaryKeyType = 'bigint';
     get primaryKeyType() {
         return this._primaryKeyType;
@@ -495,6 +489,9 @@ A new key can also be generated from the CLI:
             case 'paginationPageSize':
                 this._paginationPageSize = options;
                 break;
+            case 'paginationMaxPageSize':
+                this._paginationMaxPageSize = options;
+                break;
             default: {
                 // protection so that if a new ApplyOpt is ever added, this will throw a type error at build time
                 const _never = applyOption;

package/dist/cjs/src/encrypt/algorithms/aes-gcm/decryptAESGCM.js

@@ -23,8 +23,13 @@ export default function decryptAESGCM(algorithm, encrypted, key) {
     try {
         return JSON.parse(plaintext);
     }
-    catch (cause) {
-        throw Object.assign(new DecryptionParseError(), { cause });
+    catch {
+        // Intentionally drop the underlying SyntaxError as `cause`: its message embeds a
+        // snippet of the just-decrypted plaintext (e.g. `Unexpected token 'x', "secret..." is
+        // not valid JSON`). Carrying it would leak decrypted plaintext into any logger that
+        // serializes `error.cause`. DecryptionParseError's own message is generic and
+        // plaintext-free, which is all callers need to diagnose an encrypted-format mismatch.
+        throw new DecryptionParseError();
     }
 }
 function unpackPayloadOrFail(payload) {

package/dist/cjs/src/errors/MaxRecursiveStringCaseDepthExceeded.js

@@ -0,0 +1,14 @@
+export default class MaxRecursiveStringCaseDepthExceeded extends Error {
+    maxDepth;
+    constructor(maxDepth) {
+        super();
+        this.maxDepth = maxDepth;
+    }
+    get message() {
+        return `
+Maximum recursion depth (${this.maxDepth}) exceeded while string-casing an object.
+The input is nested more deeply than Dream will process, which usually means it is
+malformed or maliciously deeply-nested rather than legitimate application data.
+    `;
+    }
+}

package/dist/cjs/src/errors/dream-app/DreamAppInitInvalidEncryptionKey.js

@@ -0,0 +1,27 @@
+import Encrypt from '../../encrypt/index.js';
+export default class DreamAppInitInvalidEncryptionKey extends Error {
+    encryptionIdentifier;
+    keyType;
+    algorithm;
+    constructor(encryptionIdentifier, keyType, algorithm) {
+        super();
+        this.encryptionIdentifier = encryptionIdentifier;
+        this.keyType = keyType;
+        this.algorithm = algorithm;
+    }
+    get message() {
+        return `
+Your ${this.keyType} key value for ${this.encryptionIdentifier} encryption is invalid.
+Try setting it to something valid, like:
+  ${Encrypt.generateKey(this.algorithm)}
+
+This was done by calling:
+  Encrypt.generateKey('${this.algorithm}')
+
+A new key can also be generated from the CLI:
+  % pnpm psy g:encryption-key
+  OR
+  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
+`;
+    }
+}

package/dist/cjs/src/helpers/stringCasing.js

@@ -1,22 +1,34 @@
 import Dream from '../Dream.js';
+import MaxRecursiveStringCaseDepthExceeded from '../errors/MaxRecursiveStringCaseDepthExceeded.js';
 import BaseClockTime from '../utils/datetime/BaseClockTime.js';
 import CalendarDate from '../utils/datetime/CalendarDate.js';
 import { DateTime } from '../utils/datetime/DateTime.js';
 import isObject from './isObject.js';
+// Maximum object-nesting depth `recursiveStringCase` will traverse. Each nesting
+// level recurses once, so without a cap a deeply-nested input (e.g. a malicious
+// ~480KB JSON body under the request size limit) exhausts the call stack and
+// surfaces as an uncontrolled `RangeError` (500). The cap sits far below the
+// point at which this recursion overflows the stack (measured ~2,000+ levels)
+// while remaining far above any legitimate nesting depth, so real application
+// data — request params, serializer output, config objects — is never affected.
+const MAX_RECURSIVE_STRING_CASE_DEPTH = 500;
 export default function stringCase(target, stringCaser) {
     if (typeof target === 'string')
         return stringCaser(target);
-    return recursiveStringCase(target, stringCaser);
+    return recursiveStringCase(target, stringCaser, 0);
 }
-function recursiveStringCase(target, stringCaser) {
+function recursiveStringCase(target, stringCaser, depth) {
     if (target === null)
         return null;
     if (target === undefined)
         return undefined;
     if (typeof target === 'string')
         return target;
+    if (depth >= MAX_RECURSIVE_STRING_CASE_DEPTH) {
+        throw new MaxRecursiveStringCaseDepthExceeded(MAX_RECURSIVE_STRING_CASE_DEPTH);
+    }
     if (Array.isArray(target))
-        return target.map(s => recursiveStringCase(s, stringCaser));
+        return target.map(s => recursiveStringCase(s, stringCaser, depth + 1));
     if (isObject(target)) {
         if (target instanceof DateTime ||
             target instanceof CalendarDate ||
@@ -25,7 +37,7 @@ function recursiveStringCase(target, stringCaser) {
             return target;
         }
         return Object.keys(target).reduce((stringCasedObject, targetKey) => {
-            stringCasedObject[stringCaser(targetKey)] = recursiveStringCase(target[targetKey], stringCaser);
+            stringCasedObject[stringCaser(targetKey)] = recursiveStringCase(target[targetKey], stringCaser, depth + 1);
             return stringCasedObject;
         }, {});
     }

package/dist/esm/src/dream/Query.js

@@ -1193,6 +1193,19 @@ export default class Query {
     get connectionName() {
         return this.dreamInstance.connectionName || 'default';
     }
+    /**
+     * @internal
+     *
+     * Resolves the effective page size for a pagination request: applies the
+     * configured default when no page size is requested, and clamps the result to
+     * the configured maximum (`paginationMaxPageSize`, default 200) so that a
+     * forwarded, attacker-controlled `pageSize` cannot force a full-table load.
+     */
+    clampedPaginationPageSize(requestedPageSize) {
+        const dreamApp = DreamApp.getOrFail();
+        const pageSize = Math.max(0, requestedPageSize ?? 0) || dreamApp.paginationPageSize;
+        return Math.min(pageSize, dreamApp.paginationMaxPageSize);
+    }
     /**
      * Paginates the results of your query, accepting a pageSize and page argument,
      * which it uses to segment your query into pages, leveraging limit and offset
@@ -1231,7 +1244,7 @@ export default class Query {
             throw new CannotPaginateWithLeftJoinPreload();
         const page = computedPaginatePage(options.page);
         const recordCount = await this.count();
-        const pageSize = Math.max(0, options.pageSize ?? 0) || DreamApp.getOrFail().paginationPageSize;
+        const pageSize = this.clampedPaginationPageSize(options.pageSize);
         const pageCount = Math.ceil(recordCount / pageSize);
         const query = this.orderStatements.length
             ? this
@@ -1323,7 +1336,7 @@ export default class Query {
      */
     async cursorPaginate(opts) {
         const options = opts;
-        const pageSize = Math.max(0, options.pageSize ?? 0) || DreamApp.getOrFail().paginationPageSize;
+        const pageSize = this.clampedPaginationPageSize(options.pageSize);
         if (options === null)
             return { cursor: null, results: [] };
         if (this.limitStatement)

package/dist/esm/src/dream/QueryDriver/Kysely.js

@@ -14,6 +14,7 @@ import DreamCLI from '../../cli/index.js';
 import { CHECK_VIOLATION, COLUMN_OVERFLOW, INVALID_INPUT_SYNTAX, NOT_NULL_VIOLATION, pgErrorType, } from '../../db/errors.js';
 import syncDbTypesFiles from '../../db/helpers/syncDbTypesFiles.js';
 import { default as _db } from '../../db/index.js';
+import validateColumn from '../../db/validators/validateColumn.js';
 import associationToGetterSetterProp from '../../decorators/field/association/associationToGetterSetterProp.js';
 import PackageManager from '../../dream-app/helpers/PackageManager.js';
 import DreamApp from '../../dream-app/index.js';
@@ -551,6 +552,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         // that can exceed 63 bytes. Short aliases like "pluck0" avoid this entirely.
         const shortAliases = [];
         fields.forEach((field, index) => {
+            this.validatePlainColumn(this.dreamClass, field);
             const shortAlias = `pluck${index}`;
             shortAliases.push(shortAlias);
             //  namespace the selection so that when plucking the same column name from
@@ -719,6 +721,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         });
         if (this.query['orderStatements'].length && !bypassOrder) {
             this.query['orderStatements'].forEach(orderStatement => {
+                this.validatePlainColumn(this.dreamClass, orderStatement.column);
                 kyselyQuery = kyselyQuery.orderBy(this.namespaceColumn(orderStatement.column), this.orderByDirection(orderStatement.direction));
             });
         }
@@ -1034,6 +1037,7 @@ export default class KyselyQueryDriver extends QueryDriverBase {
         if (query['whereStatements'].length ||
             query['whereNotStatements'].length ||
             query['whereAnyStatements'].length) {
+            this.validateBaseWhereStatementColumns(query);
             kyselyQuery = kyselyQuery.where((eb) => eb.and([
                 ...this.aliasWhereStatements(query['whereStatements'], query['baseSqlAlias']).map(whereStatement => this.whereStatementToExpressionWrapper(this.dreamClass, eb, whereStatement, {
                     disallowSimilarityOperator: false,
@@ -1368,6 +1372,66 @@ export default class KyselyQueryDriver extends QueryDriverBase {
     namespaceColumn(column, alias = this.query['baseSqlAlias']) {
         return namespaceColumn(column, alias);
     }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01): when a runtime column identifier is a
+     * plain, un-namespaced column name, validate it against the owning model's
+     * compiled schema so an unknown identifier throws a Dream `InvalidColumnName`
+     * error before it reaches the database (rather than surfacing as a raw
+     * Postgres error or a silent blind-ordering side-channel).
+     *
+     * Only bare identifiers are validated. Namespaced / table-aliased /
+     * association-namespaced identifiers (anything containing a `.`) are left on
+     * their existing path, because the segment before the `.` may be an
+     * association alias or table alias rather than a schema table name, and
+     * validating those safely is not possible here without risking rejection of
+     * currently-valid input.
+     */
+    validatePlainColumn(dreamClass, column) {
+        if (typeof column !== 'string')
+            return;
+        if (column.includes('.'))
+            return;
+        validateColumn(dreamClass.prototype.schema, dreamClass.table, column);
+    }
+    /**
+     * @internal
+     *
+     * Defense-in-depth (DREAM-SQLI-01) for the base model's dynamic `where` keys.
+     * These are the un-namespaced keys the developer passed to `where` /
+     * `whereNot` / `whereAny` on the root query (validated here, before
+     * `aliasWhereStatement` namespaces them with the base alias). Only plain
+     * column keys are validated. Deliberately skips:
+     *   - namespaced keys (contain a `.`) — the developer explicitly namespaced
+     *     them (e.g. `{ 'users.email': ... }` or a joined table), and the prefix
+     *     may be an association/table alias rather than a schema table name;
+     *   - association-name keys (e.g. `where({ user: userInstance })`), which are
+     *     resolved to foreign keys, not columns;
+     *   - `DreamConst.passthrough` / `DreamConst.required` sentinel values, whose
+     *     keys are resolved elsewhere.
+     *
+     * Join-and / association where statements (which target other tables and are
+     * pre-namespaced) are left on their existing path.
+     */
+    validateBaseWhereStatementColumns(query) {
+        const dreamClass = query['dreamClass'];
+        const whereStatements = [
+            ...query['whereStatements'],
+            ...query['whereNotStatements'],
+            ...query['whereAnyStatements'].flat(),
+        ];
+        whereStatements.forEach(whereStatement => Object.keys(whereStatement).forEach(attr => {
+            if (attr.includes('.'))
+                return;
+            const val = whereStatement[attr];
+            if (val === DreamConst.passthrough || val === DreamConst.required)
+                return;
+            if (dreamClass.associationNames.includes(attr))
+                return;
+            validateColumn(dreamClass.prototype.schema, dreamClass.table, attr);
+        }));
+    }
     /**
      * @internal
      *
@@ -1924,8 +1988,19 @@ export default class KyselyQueryDriver extends QueryDriverBase {
                     scopesQuery = tempQuery;
             }
         }
-        if (scopesQuery['whereStatements'].length) {
-            join = join.on((eb) => eb.and(scopesQuery['whereStatements'].flatMap(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false }))));
+        if (scopesQuery['whereStatements'].length ||
+            scopesQuery['whereNotStatements'].length ||
+            scopesQuery['whereAnyStatements'].length) {
+            // Mirror the base-table clause logic in QueryDriverBase#buildCommon so that default
+            // scopes expressed with whereNot(...)/whereAny(...) — not just where(...) — cross into
+            // association loads (preload/join/leftJoinPreload/innerJoin). Without the whereNot/whereAny
+            // branches below, such default scopes are silently dropped on association loads, leaking
+            // rows the app intended to hide.
+            join = join.on((eb) => eb.and([
+                ...scopesQuery['whereStatements'].map(whereStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereStatement, tableNameOrAlias), { disallowSimilarityOperator: false })),
+                ...scopesQuery['whereNotStatements'].map(whereNotStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereNotStatement, tableNameOrAlias), { negate: true })),
+                ...scopesQuery['whereAnyStatements'].map(whereAnyStatements => eb.or(whereAnyStatements.map(whereAnyStatement => this.whereStatementToExpressionWrapper(dreamClass, eb, this.aliasWhereStatement(whereAnyStatement, tableNameOrAlias))))),
+            ]));
         }
         return join;
     }

package/dist/esm/src/dream-app/index.js

@@ -4,6 +4,7 @@ import validateTable from '../db/validators/validateTable.js';
 import Query from '../dream/Query.js';
 import PostgresQueryDriver from '../dream/QueryDriver/Postgres.js';
 import Encrypt from '../encrypt/index.js';
+import DreamAppInitInvalidEncryptionKey from '../errors/dream-app/DreamAppInitInvalidEncryptionKey.js';
 import DreamAppInitMissingCallToLoadModels from '../errors/dream-app/DreamAppInitMissingCallToLoadModels.js';
 import DreamAppInitMissingMissingProjectRoot from '../errors/dream-app/DreamAppInitMissingMissingProjectRoot.js';
 import DreamAppInitMissingPackageManager from '../errors/dream-app/DreamAppInitMissingPackageManager.js';
@@ -119,7 +120,9 @@ export default class DreamApp {
         if (!this.loadedModels)
             throw new DreamAppInitMissingCallToLoadModels();
         if (this.encryption?.columns?.current)
-            DreamApp.checkKey('columns', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+            DreamApp.checkKey('columns', 'current', this.encryption.columns.current.key, this.encryption.columns.current.algorithm);
+        if (this.encryption?.columns?.legacy)
+            DreamApp.checkKey('columns', 'legacy', this.encryption.columns.legacy.key, this.encryption.columns.legacy.algorithm);
         if (!DreamAppAllowedPackageManagersEnumValues.includes(this.packageManager) &&
             !EnvInternal.boolean('DREAM_BYPASS_PACKAGE_MANAGER_CHECK'))
             throw new DreamAppInitMissingPackageManager();
@@ -148,22 +151,9 @@ export default class DreamApp {
             await dbDriverClass.setDatabaseTypeParsers(connectionName);
         }
     }
-    static checkKey(encryptionIdentifier, key, algorithm) {
+    static checkKey(encryptionIdentifier, keyType, key, algorithm) {
         if (!Encrypt.validateKey(key, algorithm))
-            // eslint-disable-next-line no-console
-            console.warn(`
-Your current key value for ${encryptionIdentifier} encryption is invalid.
-Try setting it to something valid, like:
-  ${Encrypt.generateKey(algorithm)}
-
-This was done by calling:
-  Encrypt.generateKey('${algorithm}'
-
-A new key can also be generated from the CLI:
-  % pnpm psy g:encryption-key
-  OR
-  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
-`);
+            throw new DreamAppInitInvalidEncryptionKey(encryptionIdentifier, keyType, algorithm);
     }
     /**
      * Returns the cached dream application if it has been set.
@@ -218,6 +208,10 @@ A new key can also be generated from the CLI:
     get paginationPageSize() {
         return this._paginationPageSize;
     }
+    _paginationMaxPageSize = 200;
+    get paginationMaxPageSize() {
+        return this._paginationMaxPageSize;
+    }
     _primaryKeyType = 'bigint';
     get primaryKeyType() {
         return this._primaryKeyType;
@@ -495,6 +489,9 @@ A new key can also be generated from the CLI:
             case 'paginationPageSize':
                 this._paginationPageSize = options;
                 break;
+            case 'paginationMaxPageSize':
+                this._paginationMaxPageSize = options;
+                break;
             default: {
                 // protection so that if a new ApplyOpt is ever added, this will throw a type error at build time
                 const _never = applyOption;

package/dist/esm/src/encrypt/algorithms/aes-gcm/decryptAESGCM.js

@@ -23,8 +23,13 @@ export default function decryptAESGCM(algorithm, encrypted, key) {
     try {
         return JSON.parse(plaintext);
     }
-    catch (cause) {
-        throw Object.assign(new DecryptionParseError(), { cause });
+    catch {
+        // Intentionally drop the underlying SyntaxError as `cause`: its message embeds a
+        // snippet of the just-decrypted plaintext (e.g. `Unexpected token 'x', "secret..." is
+        // not valid JSON`). Carrying it would leak decrypted plaintext into any logger that
+        // serializes `error.cause`. DecryptionParseError's own message is generic and
+        // plaintext-free, which is all callers need to diagnose an encrypted-format mismatch.
+        throw new DecryptionParseError();
     }
 }
 function unpackPayloadOrFail(payload) {

package/dist/esm/src/errors/MaxRecursiveStringCaseDepthExceeded.js

@@ -0,0 +1,14 @@
+export default class MaxRecursiveStringCaseDepthExceeded extends Error {
+    maxDepth;
+    constructor(maxDepth) {
+        super();
+        this.maxDepth = maxDepth;
+    }
+    get message() {
+        return `
+Maximum recursion depth (${this.maxDepth}) exceeded while string-casing an object.
+The input is nested more deeply than Dream will process, which usually means it is
+malformed or maliciously deeply-nested rather than legitimate application data.
+    `;
+    }
+}

package/dist/esm/src/errors/dream-app/DreamAppInitInvalidEncryptionKey.js

@@ -0,0 +1,27 @@
+import Encrypt from '../../encrypt/index.js';
+export default class DreamAppInitInvalidEncryptionKey extends Error {
+    encryptionIdentifier;
+    keyType;
+    algorithm;
+    constructor(encryptionIdentifier, keyType, algorithm) {
+        super();
+        this.encryptionIdentifier = encryptionIdentifier;
+        this.keyType = keyType;
+        this.algorithm = algorithm;
+    }
+    get message() {
+        return `
+Your ${this.keyType} key value for ${this.encryptionIdentifier} encryption is invalid.
+Try setting it to something valid, like:
+  ${Encrypt.generateKey(this.algorithm)}
+
+This was done by calling:
+  Encrypt.generateKey('${this.algorithm}')
+
+A new key can also be generated from the CLI:
+  % pnpm psy g:encryption-key
+  OR
+  % pnpm psy g:encryption-key --algorithm=aes-256-gcm
+`;
+    }
+}