cursedbelt-server 4.38.0 → 4.39.0

package/dist/server/d1/limits.d.ts

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -31,12 +38,29 @@ export declare const LIMITS: {
     readonly columnsPerTable: 100;
     /** Wall-clock milliseconds one query may take. */
     readonly queryDurationMs: 30000;
+    /** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+    readonly compoundSelectTerms: 5;
 };
 /**
  * Refuse a statement that D1 would refuse — checked on BOTH drivers, at `bind()` time, so
  * the failure lands on the call site that built the query rather than in production.
  */
 export declare function assertWithinLimits(sql: string, params: readonly D1LikeBindable[]): void;
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export declare function maxCompoundSelectTerms(sql: string): number;
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export declare function assertCompoundSelectTerms(sql: string): void;
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export declare function assertBatchSize(count: number): void;
 /**

package/dist/server/d1/limits.js

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -31,6 +38,8 @@ export const LIMITS = {
     columnsPerTable: 100,
     /** Wall-clock milliseconds one query may take. */
     queryDurationMs: 30_000,
+    /** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+    compoundSelectTerms: 5,
 };
 const byteLength = (v) => {
     if (typeof v === 'string')
@@ -61,6 +70,91 @@ export function assertWithinLimits(sql, params) {
         }
     }
 }
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export function maxCompoundSelectTerms(sql) {
+    const stack = [0];
+    let max = 0;
+    let i = 0;
+    const n = sql.length;
+    const skipQuoted = (close) => {
+        i++;
+        while (i < n) {
+            if (sql[i] === close) {
+                // A doubled quote is an escaped one, inside the same literal.
+                if (sql[i + 1] === close && close !== ']') {
+                    i += 2;
+                    continue;
+                }
+                break;
+            }
+            i++;
+        }
+        i++;
+    };
+    while (i < n) {
+        const c = sql[i];
+        if (c === "'" || c === '"' || c === '`')
+            skipQuoted(c);
+        else if (c === '[')
+            skipQuoted(']');
+        else if (c === '-' && sql[i + 1] === '-') {
+            while (i < n && sql[i] !== '\n')
+                i++;
+        }
+        else if (c === '/' && sql[i + 1] === '*') {
+            const end = sql.indexOf('*/', i + 2);
+            i = end === -1 ? n : end + 2;
+        }
+        else if (c === '(') {
+            stack.push(0);
+            i++;
+        }
+        else if (c === ')') {
+            if (stack.length > 1)
+                stack.pop();
+            i++;
+        }
+        else if (c === ';') {
+            stack.length = 1;
+            stack[0] = 0;
+            i++;
+        }
+        else if (/[A-Za-z_]/.test(c)) {
+            let j = i + 1;
+            while (j < n && /[A-Za-z0-9_$]/.test(sql[j]))
+                j++;
+            const word = sql.slice(i, j).toUpperCase();
+            if (word === 'UNION' || word === 'INTERSECT' || word === 'EXCEPT') {
+                const top = stack.length - 1;
+                stack[top] = stack[top] + 1;
+                max = Math.max(max, stack[top]);
+            }
+            i = j;
+        }
+        else
+            i++;
+    }
+    return max + 1;
+}
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export function assertCompoundSelectTerms(sql) {
+    const terms = maxCompoundSelectTerms(sql);
+    if (terms > LIMITS.compoundSelectTerms) {
+        throw new D1LimitError('terms in one compound SELECT', terms, LIMITS.compoundSelectTerms, 'D1 answers `too many terms in compound SELECT`. Fold extra terms into a subquery — ' +
+            '`SELECT id FROM (a UNION b UNION c)` is one term of the outer compound.');
+    }
+}
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export function assertBatchSize(count) {
     if (count > LIMITS.queriesPerInvocation) {

package/dist/server/d1/local.js

@@ -13,7 +13,7 @@
  * refused here exactly as it is refused remotely. The point of a local driver is to fail
  * the same way, early and on a laptop.
  */
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import { D1UnsupportedError, } from './types.js';
 import { isPureReadSql, makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 /** Shared clock, so `meta.duration` means the same thing on both sides of the seam. */
@@ -133,6 +133,7 @@ export function createLocalD1(db) {
     return {
         flavor: 'local',
         prepare(sql) {
+            assertCompoundSelectTerms(sql);
             return new LocalStatement(db, sql);
         },
         /**

package/dist/server/d1/remote.js

@@ -14,7 +14,7 @@
  * a real binding satisfies it without a cast, and the test suite can satisfy it with a
  * fake that has no `workerd` in sight.
  */
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import { D1UnsupportedError, } from './types.js';
 import { makeMeta, normalizeBinds, normalizeRows, normalizeValue } from './values.js';
 /**
@@ -91,6 +91,7 @@ export function createRemoteD1(binding) {
     return {
         flavor: 'd1',
         prepare(sql) {
+            assertCompoundSelectTerms(sql);
             return new RemoteStatement(binding.prepare(sql), sql);
         },
         async batch(statements) {

package/package.json

@@ -1,6 +1,6 @@
 {
 	"name": "cursedbelt-server",
-	"version": "4.38.0",
+	"version": "4.39.0",
 	"license": "ISC",
 	"type": "module",
 	"description": "The app-facing Bun/Hono server tier of the cursedbelt split — storage, sharing, activity, guard, sync. React-free; cursedbelt-core below it.",

package/src/server/d1/limits.spec.ts

@@ -1,7 +1,15 @@
 import { Database } from 'bun:sqlite';
 import { describe, expect, test } from 'bun:test';
-import { assertBatchSize, assertWithinLimits, chunkForBind, inArray, LIMITS } from './limits.js';
+import {
+	assertBatchSize,
+	assertWithinLimits,
+	chunkForBind,
+	inArray,
+	LIMITS,
+	maxCompoundSelectTerms,
+} from './limits.js';
 import { createLocalD1 } from './local.js';
+import { createRemoteD1 } from './remote.js';
 import { D1LimitError } from './types.js';
 
 describe('D1 limits are enforced on the LOCAL driver too', () => {
@@ -52,6 +60,57 @@ describe('D1 limits are enforced on the LOCAL driver too', () => {
 		expect(() => assertWithinLimits(sql, [])).toThrow(/SQL statement length/);
 	});
 
+	describe('five terms per compound SELECT — measured against production D1, 2026-09-26', () => {
+		const union = (terms: number): string =>
+			Array.from({ length: terms }, (_, k) => `SELECT ${k + 1}`).join(' UNION ');
+
+		test('six terms are refused at prepare(), before anything is bound', () => {
+			const db = createLocalD1(new Database(':memory:'));
+			expect(() => db.prepare(union(6))).toThrow(D1LimitError);
+			expect(() => db.prepare(union(6))).toThrow(/compound SELECT/);
+		});
+
+		test('five terms run — the cap is not off by one', async () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const out = await db.prepare(union(5)).all();
+			expect(out.results).toHaveLength(5);
+		});
+
+		test('a recursive CTE counts its seed AND recursive terms — the shape that broke `family`', () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const six = `WITH RECURSIVE r(x) AS (SELECT 1 UNION SELECT 2 UNION SELECT 3 UNION SELECT 4
+				UNION SELECT x + 1 FROM r WHERE x < 3 UNION SELECT x + 2 FROM r WHERE x < 3) SELECT x FROM r`;
+			expect(() => db.prepare(six)).toThrow(D1LimitError);
+		});
+
+		test('a subquery is ONE term of the outer compound — the documented remedy passes', async () => {
+			const db = createLocalD1(new Database(':memory:'));
+			const folded = `WITH RECURSIVE r(x) AS (SELECT x FROM (SELECT 1 AS x UNION SELECT 2 UNION SELECT 3 UNION SELECT 4)
+				UNION SELECT x + 10 FROM r WHERE x < 3 UNION SELECT x + 20 FROM r WHERE x < 3) SELECT x FROM r`;
+			expect(maxCompoundSelectTerms(folded)).toBe(4);
+			const out = await db.prepare(folded).all();
+			expect(out.results.length).toBeGreaterThan(4);
+		});
+
+		test('UNION inside a string, a quoted name or a comment is not a term', () => {
+			const sql = `SELECT 'a UNION b UNION c UNION d UNION e UNION f' AS "UNION UNION UNION UNION UNION"
+				-- UNION UNION UNION UNION UNION
+				/* UNION UNION UNION UNION UNION */ FROM [UNION UNION UNION UNION UNION]`;
+			expect(maxCompoundSelectTerms(sql)).toBe(1);
+		});
+
+		test('separate statements and sibling subqueries are counted apart', () => {
+			expect(maxCompoundSelectTerms(`${union(3)}; ${union(3)}`)).toBe(3);
+			expect(maxCompoundSelectTerms(`SELECT * FROM (${union(3)}) JOIN (${union(3)})`)).toBe(3);
+			expect(maxCompoundSelectTerms(`SELECT 1 UNION ALL SELECT 2 INTERSECT SELECT 3 EXCEPT SELECT 4`)).toBe(4);
+		});
+
+		test('the remote driver refuses too, so a Worker fails with the remedy rather than D1\'s bare error', () => {
+			const binding = { prepare: () => ({}) } as unknown as Parameters<typeof createRemoteD1>[0];
+			expect(() => createRemoteD1(binding).prepare(union(6))).toThrow(D1LimitError);
+		});
+	});
+
 	test('a batch over 1,000 statements is refused', () => {
 		expect(() => assertBatchSize(1_001)).toThrow(D1LimitError);
 		expect(() => assertBatchSize(1_000)).not.toThrow();

package/src/server/d1/limits.ts

@@ -10,6 +10,13 @@
  *   · **100 bound parameters per query.** Any seed, import or bulk insert hits this. Use
  *     {@link chunkForBind}, which does the arithmetic rather than leaving it to a guess.
  *   · **2 MB per string / BLOB / row.** Nothing may store a media byte in D1.
+ *   · **5 terms per compound SELECT** — `UNION`, `UNION ALL`, `INTERSECT`, `EXCEPT`, and
+ *     every term of a recursive CTE counts. SQLite's own default is 500, so a sixth term is
+ *     green here and `too many terms in compound SELECT` on D1. Measured against production
+ *     D1 on 2026-09-26: five terms answer, six are refused, inside a CTE exactly as outside
+ *     one. `family`'s "Both families" viewport was a six-term recursive CTE, and every read
+ *     it scoped failed in production from the D1 cutover until then. Wrap extra seed terms in
+ *     a subquery — `SELECT id FROM (… UNION …)` is ONE term of the outer compound.
  *
  * The limits are asserted by the LOCAL driver as well as the remote one, which is the
  * whole point: a bulk insert that would fail in production fails on the laptop, at the
@@ -33,6 +40,8 @@ export const LIMITS = {
 	columnsPerTable: 100,
 	/** Wall-clock milliseconds one query may take. */
 	queryDurationMs: 30_000,
+	/** Terms in one compound SELECT, recursive CTEs included. SQLite's default is 500. */
+	compoundSelectTerms: 5,
 } as const;
 
 const byteLength = (v: D1LikeBindable): number => {
@@ -78,6 +87,86 @@ export function assertWithinLimits(sql: string, params: readonly D1LikeBindable[
 	}
 }
 
+/**
+ * The most terms any ONE compound SELECT in `sql` has — `1` for a plain SELECT.
+ *
+ * Lexical, because `bun:sqlite` exposes no `sqlite3_limit`: string literals, quoted
+ * identifiers and comments are skipped, and every parenthesis opens its own count, since a
+ * parenthesised subquery or CTE body is a compound of its own. A `;` ends a statement.
+ * Multi-row `VALUES` is not counted — SQLite stopped counting it against this limit in 3.8.8.
+ */
+export function maxCompoundSelectTerms(sql: string): number {
+	const stack: number[] = [0];
+	let max = 0;
+	let i = 0;
+	const n = sql.length;
+	const skipQuoted = (close: string): void => {
+		i++;
+		while (i < n) {
+			if (sql[i] === close) {
+				// A doubled quote is an escaped one, inside the same literal.
+				if (sql[i + 1] === close && close !== ']') {
+					i += 2;
+					continue;
+				}
+				break;
+			}
+			i++;
+		}
+		i++;
+	};
+	while (i < n) {
+		const c = sql[i] as string;
+		if (c === "'" || c === '"' || c === '`') skipQuoted(c);
+		else if (c === '[') skipQuoted(']');
+		else if (c === '-' && sql[i + 1] === '-') {
+			while (i < n && sql[i] !== '\n') i++;
+		} else if (c === '/' && sql[i + 1] === '*') {
+			const end = sql.indexOf('*/', i + 2);
+			i = end === -1 ? n : end + 2;
+		} else if (c === '(') {
+			stack.push(0);
+			i++;
+		} else if (c === ')') {
+			if (stack.length > 1) stack.pop();
+			i++;
+		} else if (c === ';') {
+			stack.length = 1;
+			stack[0] = 0;
+			i++;
+		} else if (/[A-Za-z_]/.test(c)) {
+			let j = i + 1;
+			while (j < n && /[A-Za-z0-9_$]/.test(sql[j] as string)) j++;
+			const word = sql.slice(i, j).toUpperCase();
+			if (word === 'UNION' || word === 'INTERSECT' || word === 'EXCEPT') {
+				const top = stack.length - 1;
+				stack[top] = (stack[top] as number) + 1;
+				max = Math.max(max, stack[top] as number);
+			}
+			i = j;
+		} else i++;
+	}
+	return max + 1;
+}
+
+/**
+ * Refuse a statement whose compound SELECT has more terms than D1 allows — see
+ * `LIMITS.compoundSelectTerms`. Called at `prepare()`, because a statement with nothing to
+ * bind never reaches {@link assertWithinLimits}.
+ */
+export function assertCompoundSelectTerms(sql: string): void {
+	const terms = maxCompoundSelectTerms(sql);
+	if (terms > LIMITS.compoundSelectTerms) {
+		throw new D1LimitError(
+			'terms in one compound SELECT',
+			terms,
+			LIMITS.compoundSelectTerms,
+			'D1 answers `too many terms in compound SELECT`. Fold extra terms into a subquery — ' +
+				'`SELECT id FROM (a UNION b UNION c)` is one term of the outer compound.',
+		);
+	}
+}
+
 /** Refuse a `batch()` bigger than one Worker invocation may issue. */
 export function assertBatchSize(count: number): void {
 	if (count > LIMITS.queriesPerInvocation) {

package/src/server/d1/local.ts

@@ -15,7 +15,7 @@
  */
 
 import type { Database } from 'bun:sqlite';
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -171,6 +171,7 @@ export function createLocalD1(db: Database): D1LikeDatabase {
 		flavor: 'local',
 
 		prepare(sql: string): D1LikeStatement {
+			assertCompoundSelectTerms(sql);
 			return new LocalStatement(db, sql);
 		},
 

package/src/server/d1/remote.ts

@@ -15,7 +15,7 @@
  * fake that has no `workerd` in sight.
  */
 
-import { assertBatchSize, assertWithinLimits } from './limits.js';
+import { assertBatchSize, assertCompoundSelectTerms, assertWithinLimits } from './limits.js';
 import {
 	type D1LikeBindable,
 	type D1LikeDatabase,
@@ -141,6 +141,7 @@ export function createRemoteD1(binding: D1BindingLike): D1LikeDatabase {
 		flavor: 'd1',
 
 		prepare(sql: string): D1LikeStatement {
+			assertCompoundSelectTerms(sql);
 			return new RemoteStatement(binding.prepare(sql), sql);
 		},