postgrejs 2.23.1 → 3.0.1

package/util/decode-binaryarray.js

@@ -1,28 +1,37 @@
 import { BufferReader } from '../protocol/buffer-reader.js';
-export function decodeBinaryArray(buf, decoder, options = {}) {
+export function decodeBinaryArray(buf, offset, decoder, options = {}, fixedBinarySize) {
     if (!buf.length)
         return null;
     const io = new BufferReader(buf);
+    io.offset = offset;
     const ndims = io.readInt32BE();
     io.readInt32BE(); // hasNulls
     const elementOID = io.readInt32BE(); // element oid
     if (ndims === 0)
         return [];
     const dims = [];
+    const elementOptions = { ...options, elementOID };
+    const lastDim = ndims - 1;
     const readDim = (level) => {
         const elemCount = dims[level];
         const target = new Array(elemCount);
-        for (let i = 0; i < elemCount; i++) {
-            if (level < dims.length - 1) {
+        const isLeafLevel = level >= lastDim;
+        let i;
+        let len;
+        for (i = 0; i < elemCount; i++) {
+            if (!isLeafLevel) {
                 target[i] = readDim(level + 1);
                 continue;
             }
-            const len = io.readInt32BE();
+            len = io.readInt32BE();
             if (len === -1)
                 target[i] = null;
+            else if (fixedBinarySize != null) {
+                target[i] = decoder(buf, io.offset, elementOptions);
+                io.offset += len;
+            }
             else {
-                const b = io.readBuffer(len);
-                target[i] = decoder(b, { ...options, elementOID });
+                target[i] = decoder(io.readBuffer(len), 0, elementOptions);
             }
         }
         return target;

package/util/encode-binaryarray.js

@@ -9,16 +9,20 @@ export function encodeBinaryArray(io, value, itemOid, options, encode, encodeCal
     io.writeInt32BE(ndims) // Number of dimensions
         .writeInt32BE(0) // reserved for has-null flag
         .writeInt32BE(itemOid);
-    for (let d = 0; d < ndims; d++) {
+    let d;
+    for (d = 0; d < ndims; d++) {
         io.writeInt32BE(dim[d]); // Number of items in dimension
         io.writeInt32BE(0); // LBound always 0.
     }
     let hasNull = false;
     let pos;
+    const lastDim = ndims - 1;
     const writeDim = (arr, level) => {
         const elemCount = dim[level];
-        for (let i = 0; i < elemCount; i++) {
-            if (level < dim.length - 1) {
+        const isLeafLevel = level >= lastDim;
+        let i;
+        for (i = 0; i < elemCount; i++) {
+            if (!isLeafLevel) {
                 writeDim(arr && arr[i], level + 1);
                 continue;
             }

package/util/escape-identifier.d.ts

@@ -0,0 +1,14 @@
+/**
+ * Quotes a table, column or schema name so it can be written into a
+ * statement safely.
+ *
+ * Identifiers cannot be parameters - `$1` is always a value - so a dynamic
+ * name has to go into the SQL text itself, which is exactly where an
+ * injection would get in. Quoting is what closes that: the name is wrapped
+ * in double quotes and any embedded double quote is doubled, so whatever it
+ * contains stays a single identifier.
+ *
+ * Named after PostgreSQL's own `quote_ident()`. Ported from
+ * src/interfaces/libpq/fe-exec.c.
+ */
+export declare function escapeIdentifier(str: string): string;

package/util/escape-identifier.js

@@ -0,0 +1,32 @@
+/**
+ * Quotes a table, column or schema name so it can be written into a
+ * statement safely.
+ *
+ * Identifiers cannot be parameters - `$1` is always a value - so a dynamic
+ * name has to go into the SQL text itself, which is exactly where an
+ * injection would get in. Quoting is what closes that: the name is wrapped
+ * in double quotes and any embedded double quote is doubled, so whatever it
+ * contains stays a single identifier.
+ *
+ * Named after PostgreSQL's own `quote_ident()`. Ported from
+ * src/interfaces/libpq/fe-exec.c.
+ */
+export function escapeIdentifier(str) {
+    // A NUL byte would silently truncate the identifier at the protocol level
+    // - same reason escapeLiteral() refuses it.
+    if (str.indexOf('\0') >= 0) {
+        throw new Error('PostgreSQL identifiers cannot contain NUL (\\0) bytes');
+    }
+    let out = '"';
+    const l = str.length;
+    let i;
+    let c;
+    for (i = 0; i < l; i++) {
+        c = str[i];
+        if (c === '"')
+            out += c + c;
+        else
+            out += c;
+    }
+    return out + '"';
+}

package/util/escape-literal.js

@@ -1,5 +1,8 @@
 // Ported from PostgreSQL 9.2.4 source code in src/interfaces/libpq/fe-exec.c
 export function escapeLiteral(str) {
+    if (str.indexOf('\0') >= 0) {
+        throw new Error('PostgreSQL text values cannot contain NUL (\\0) bytes');
+    }
     let backSlash = false;
     let out = "'";
     let i;

package/util/fast-parseint.d.ts

@@ -1 +1,2 @@
 export declare function fastParseInt(str: string | number): number;
+export declare function fastParseIntBuffer(buf: Buffer, offset?: number, len?: number): number;

package/util/fast-parseint.js

@@ -1,28 +1,23 @@
 export function fastParseInt(str) {
-    /* istanbul ignore next */
+    /* c8 ignore next */
     if (typeof str === 'number')
         return Math.floor(str);
     // noinspection SuspiciousTypeOfGuard
     if (typeof str !== 'string')
         return NaN;
-    const strLength = str.length;
-    let res = 0;
-    let i = 0;
+    return parseInt(str, 10);
+}
+export function fastParseIntBuffer(buf, offset = 0, len = buf.length - offset) {
+    const end = offset + len;
+    let i = offset;
     let neg = false;
-    if (str.startsWith('-')) {
+    if (len > 0 && buf[offset] === 45 /* '-' */) {
         neg = true;
         i++;
     }
-    do {
-        const charCode = str.charCodeAt(i);
-        /* istanbul ignore next */
-        if (charCode === 46)
-            return res;
-        /* istanbul ignore next */
-        if (charCode < 48 || charCode > 57)
-            return NaN;
-        res *= 10;
-        res += charCode - 48;
-    } while (++i < strLength);
-    return neg ? -res : res;
+    let n = 0;
+    for (; i < end; i++) {
+        n = n * 10 + (buf[i] - 48);
+    }
+    return neg ? -n : n;
 }

package/util/format-datetime.d.ts

@@ -0,0 +1,10 @@
+import type { DataMappingOptions } from '../interfaces/data-mapping-options.js';
+export declare function formatDate(v: Date | number | string, options?: DataMappingOptions): string;
+export declare function formatTime(v: Date | number | string, options?: DataMappingOptions): string;
+export declare function formatTimestamp(v: Date | number | string, options?: DataMappingOptions): string;
+/**
+ * timestamptz is an absolute instant - its binary encoder uses getTime()
+ * with no time zone shift - so this writes UTC with an explicit offset and
+ * ignores `utcDates`, which only governs the zone-less types.
+ */
+export declare function formatTimestamptz(v: Date | number | string): string;

package/util/format-datetime.js

@@ -0,0 +1,71 @@
+/**
+ * Writes a Date as PostgreSQL's own text form, mirroring exactly what the
+ * matching encodeBinary() would have sent.
+ *
+ * That mirroring is the whole point: `date`, `time` and `timestamp` have no
+ * time zone, and their binary encoders read the JS Date's UTC components
+ * when `utcDates` is set and its local ones otherwise. A text encoder that
+ * chose differently would make the same statement mean two different
+ * instants depending on whether it went through query() or execute().
+ */
+function parts(v, options) {
+    return options?.utcDates
+        ? {
+            year: v.getUTCFullYear(),
+            month: v.getUTCMonth() + 1,
+            day: v.getUTCDate(),
+            hour: v.getUTCHours(),
+            minute: v.getUTCMinutes(),
+            second: v.getUTCSeconds(),
+            ms: v.getUTCMilliseconds(),
+        }
+        : {
+            year: v.getFullYear(),
+            month: v.getMonth() + 1,
+            day: v.getDate(),
+            hour: v.getHours(),
+            minute: v.getMinutes(),
+            second: v.getSeconds(),
+            ms: v.getMilliseconds(),
+        };
+}
+const pad = (n, len = 2) => String(n).padStart(len, '0');
+function coerce(v) {
+    // Infinity and -Infinity are values PostgreSQL accepts verbatim.
+    if (v === Infinity)
+        return 'infinity';
+    if (v === -Infinity)
+        return '-infinity';
+    return v instanceof Date ? v : new Date(v);
+}
+export function formatDate(v, options) {
+    const d = coerce(v);
+    if (typeof d === 'string')
+        return d;
+    const p = parts(d, options);
+    return `${pad(p.year, 4)}-${pad(p.month)}-${pad(p.day)}`;
+}
+export function formatTime(v, options) {
+    const d = coerce(v);
+    if (typeof d === 'string')
+        return d;
+    const p = parts(d, options);
+    return `${pad(p.hour)}:${pad(p.minute)}:${pad(p.second)}.${pad(p.ms, 3)}`;
+}
+export function formatTimestamp(v, options) {
+    const d = coerce(v);
+    if (typeof d === 'string')
+        return d;
+    return `${formatDate(d, options)} ${formatTime(d, options)}`;
+}
+/**
+ * timestamptz is an absolute instant - its binary encoder uses getTime()
+ * with no time zone shift - so this writes UTC with an explicit offset and
+ * ignores `utcDates`, which only governs the zone-less types.
+ */
+export function formatTimestamptz(v) {
+    const d = coerce(v);
+    if (typeof d === 'string')
+        return d;
+    return d.toISOString().replace('T', ' ').replace('Z', '+00');
+}

package/util/get-parsers.js

@@ -1,7 +1,8 @@
 import { DataFormat } from '../constants.js';
 import { decodeBinaryArray } from './decode-binaryarray.js';
 import { parsePostgresArray } from './parse-array.js';
-const DefaultColumnParser = (v) => v;
+const DefaultColumnParser = (data, offset, len) => data.subarray(offset, offset + len);
+const DefaultTextColumnParser = (data, offset, len) => data.toString('utf8', offset, offset + len);
 export function getParsers(typeMap, fields) {
     const parsers = new Array(fields.length);
     const l = fields.length;
@@ -13,26 +14,46 @@ export function getParsers(typeMap, fields) {
         if (dataTypeReg) {
             const isArray = !!dataTypeReg.elementsOID;
             if (f.format === DataFormat.binary) {
-                const decode = dataTypeReg.parseBinary;
+                const decode = dataTypeReg.decodeBinary;
                 if (decode) {
-                    parsers[i] = !isArray
-                        ? decode
-                        : (v, options) => decodeBinaryArray(v, decode, options);
+                    if (isArray) {
+                        parsers[i] = (data, offset, len, options) => decodeBinaryArray(data, offset, decode, options, dataTypeReg.fixedBinarySize);
+                    }
+                    else if (dataTypeReg.fixedBinarySize != null) {
+                        const fixedSize = dataTypeReg.fixedBinarySize;
+                        parsers[i] = (data, offset, len, options) => len === fixedSize
+                            ? decode(data, offset, options)
+                            : decode(data.subarray(offset, offset + len), 0, options);
+                    }
+                    else {
+                        parsers[i] = (data, offset, len, options) => decode(data.subarray(offset, offset + len), 0, options);
+                    }
                 }
             }
             else if (f.format === DataFormat.text) {
-                const parse = dataTypeReg.parseText;
+                const parse = dataTypeReg.decodeText;
                 if (parse) {
-                    parsers[i] = !isArray
-                        ? parse
-                        : (v, options) => parsePostgresArray(v, {
+                    const parseBuffer = dataTypeReg.decodeTextBuffer;
+                    if (!isArray && parseBuffer) {
+                        parsers[i] = (data, offset, len, options) => parseBuffer(data, offset, len, options);
+                    }
+                    else if (!isArray) {
+                        parsers[i] = (data, offset, len, options) => parse(data.toString('utf8', offset, offset + len), options);
+                    }
+                    else {
+                        parsers[i] = (data, offset, len, options) => parsePostgresArray(data.toString('utf8', offset, offset + len), {
                             transform: x => parse(x, options),
                             separator: dataTypeReg.arraySeparator,
                         });
+                    }
                 }
             }
         }
-        parsers[i] = parsers[i] || DefaultColumnParser;
+        parsers[i] =
+            parsers[i] ||
+                (f.format === DataFormat.text
+                    ? DefaultTextColumnParser
+                    : DefaultColumnParser);
     }
     return parsers;
 }

package/util/parse-array.js

@@ -39,8 +39,8 @@ export function parsePostgresArray(s, opts) {
                 token += c;
                 continue;
             }
-            if (c === '"' || c === "'") {
-                if (quote && quote === c) {
+            if (c === '"') {
+                if (quote) {
                     quote = '';
                 }
                 else {

package/util/parse-bytea.d.ts

@@ -0,0 +1,2 @@
+export declare function parseBytea(v: string): Buffer;
+export declare function parseByteaBuffer(buf: Buffer, offset: number, len: number): Buffer;

package/util/parse-bytea.js

@@ -0,0 +1,83 @@
+// Escape-format decode ported from the `postgres-bytea` npm package
+// (MIT License, Copyright (c) Ben Drucker <bvdrucker@gmail.com>) so the
+// hex fast path below doesn't need an external dependency for the rare
+// legacy fallback. bytea_output has defaulted to "hex" since PostgreSQL
+// 9.0 (2010); "escape" format is legacy and unlikely to appear in
+// practice, but PostgreSQL still supports emitting it.
+function parseByteaEscape(input) {
+    let output = '';
+    let i = 0;
+    const l = input.length;
+    while (i < l) {
+        if (input[i] !== '\\') {
+            output += input[i];
+            i++;
+        }
+        else if (/[0-7]{3}/.test(input.substring(i + 1, i + 4))) {
+            output += String.fromCharCode(parseInt(input.substring(i + 1, i + 4), 8));
+            i += 4;
+        }
+        else {
+            let backslashes = 1;
+            while (i + backslashes < l && input[i + backslashes] === '\\') {
+                backslashes++;
+            }
+            const u = Math.floor(backslashes / 2);
+            let k;
+            for (k = 0; k < u; k++)
+                output += '\\';
+            // An odd backslash count (a lone unescaped '\' the loop above
+            // couldn't pair up) advances 0 via the halving above - without the
+            // `|| 1` fallback, `i` never moves and this loops forever on the
+            // same position. Malformed/unexpected input for this legacy format,
+            // but must still make forward progress rather than hang.
+            i += u * 2 || 1;
+        }
+    }
+    return Buffer.from(output, 'binary');
+}
+export function parseBytea(v) {
+    // PostgreSQL's default bytea_output is "hex" (`\x`-prefixed) - check the
+    // two marker chars directly rather than a regex test, and hex-decode
+    // inline; this is the path almost every real value takes.
+    if (v.charCodeAt(0) === 92 /* '\' */ && v.charCodeAt(1) === 120 /* 'x' */)
+        return Buffer.from(v.slice(2), 'hex');
+    return parseByteaEscape(v);
+}
+// 256-entry lookup: ASCII byte -> hex nibble value (0-15), -1 if not a hex
+// digit. Built once at module load.
+const HEX_NIBBLE = (() => {
+    const t = new Int8Array(256).fill(-1);
+    for (let i = 0; i <= 9; i++)
+        t[48 + i] = i; // '0'-'9'
+    for (let i = 0; i <= 5; i++)
+        t[97 + i] = 10 + i; // 'a'-'f'
+    for (let i = 0; i <= 5; i++)
+        t[65 + i] = 10 + i; // 'A'-'F'
+    return t;
+})();
+// Parses straight from the raw wire bytes for the `\x`-prefixed hex fast
+// path, skipping both the buffer->string conversion AND the intermediate
+// hex-string Buffer.from(str,'hex') parse that parseBytea's own hex path
+// still needs - bytea values are typically the largest column values in a
+// row, so this is the single biggest per-column allocation avoided of any
+// type in this fast-path set. Falls back to the (rare, legacy) escape
+// format via a single 'latin1' string conversion - its own grammar (\ddd
+// octal triplets, ASCII digits, or a literal backslash) is pure ASCII, same
+// as the hex path, so 'latin1' is safe there too.
+export function parseByteaBuffer(buf, offset, len) {
+    if (buf[offset] === 0x5c /* '\' */ && buf[offset + 1] === 0x78 /* 'x' */) {
+        // Truncate a trailing odd nibble instead of throwing, matching
+        // Buffer.from(hexString, 'hex')'s own silent-truncate behavior today.
+        const outLen = (len - 2) >> 1;
+        const out = Buffer.allocUnsafe(outLen);
+        const start = offset + 2;
+        for (let i = 0; i < outLen; i++) {
+            out[i] =
+                (HEX_NIBBLE[buf[start + i * 2]] << 4) |
+                    HEX_NIBBLE[buf[start + i * 2 + 1]];
+        }
+        return out;
+    }
+    return parseByteaEscape(buf.toString('latin1', offset, offset + len));
+}

package/util/parse-datetime.d.ts

@@ -1 +1,3 @@
-export declare function parseDateTime(str: string, parseTime?: boolean, parseTimeZone?: boolean, utc?: boolean): Date | number;
+export declare function parseDate(str: string, utc?: boolean): Date | number;
+export declare function parseDateTime(str: string, utc?: boolean): Date | number;
+export declare function parseDateTimeTz(str: string, utc?: boolean): Date | number;

package/util/parse-datetime.js

@@ -2,27 +2,96 @@
 import { fastParseInt } from './fast-parseint.js';
 // noinspection RegExpUnnecessaryNonCapturingGroup
 const TIMESTAMP_PATTERN = /^(\d{4})-?(0[1-9]|1[012])?-?([123]0|[012][1-9]|31)?(?:[T ]?([01][0-9]|2[0-3]):?([0-5][0-9]):?([0-5][0-9])?(?:\.(\d+))?(?:(Z)|(?:([+-])([01]?[0-9]|2[0-3]):?([0-5][0-9])?))?)?$/;
-const INFINITY_PATTERN = /^-?infinity$/;
-export function parseDateTime(str, parseTime, parseTimeZone, utc) {
-    let m = str.match(TIMESTAMP_PATTERN);
-    if (!m) {
-        m = str.match(INFINITY_PATTERN);
-        if (m)
-            return Number(str.replace('i', 'I'));
-        return new Date('invalid');
-    }
-    const args = [
-        1970, 0, 1, 0, 0, 0, 0,
-    ];
-    const l = parseTime ? 7 : 3;
-    for (let i = 0; i < l; i++) {
+function noMatch(str) {
+    if (str === 'infinity' || str === 'Infinity')
+        return Infinity;
+    if (str === '-infinity' || str === '-Infinity')
+        return -Infinity;
+    return new Date('invalid');
+}
+function fillTimeArgs(m, args) {
+    for (let i = 3; i < 7; i++) {
         const s = m[i + 1];
-        args[i] = fastParseInt(s) || 0;
+        if (i === 6 && s) {
+            args[i] = fastParseInt((s + '000').slice(0, 3));
+        }
+        else {
+            args[i] = fastParseInt(s) || 0;
+        }
+    }
+}
+export function parseDate(str, utc) {
+    const m = str.match(TIMESTAMP_PATTERN);
+    if (!m)
+        return noMatch(str);
+    const args = [1970, 0, 1, 0, 0, 0, 0];
+    args[0] = fastParseInt(m[1]) || 0;
+    args[1] = fastParseInt(m[2]) || 0;
+    // Regression test: day defaults to 1 when omitted (a bare year or
+    // year-month string, both valid per TIMESTAMP_PATTERN) - `|| 0` used to
+    // leave it at 0, and Date.UTC()'s day is 1-indexed, so "day 0" silently
+    // rolled back to the last day of the *previous* month.
+    args[2] = fastParseInt(m[3]) || 1;
+    // Months start from 0
+    if (args[1] > 0)
+        args[1]--;
+    if (m[8] || utc)
+        return new Date(Date.UTC(...args));
+    return new Date(...args);
+}
+export function parseDateTime(str, utc) {
+    if (!utc) {
+        if (str === 'infinity')
+            return Infinity;
+        if (str === '-infinity')
+            return -Infinity;
+        const d = new Date(str);
+        if (!isNaN(d.getTime()))
+            return d;
     }
-    // Months starts from 0
+    const m = str.match(TIMESTAMP_PATTERN);
+    if (!m)
+        return noMatch(str);
+    const args = [1970, 0, 1, 0, 0, 0, 0];
+    args[0] = fastParseInt(m[1]) || 0;
+    args[1] = fastParseInt(m[2]) || 0;
+    // Regression test: day defaults to 1 when omitted (a bare year or
+    // year-month string, both valid per TIMESTAMP_PATTERN) - `|| 0` used to
+    // leave it at 0, and Date.UTC()'s day is 1-indexed, so "day 0" silently
+    // rolled back to the last day of the *previous* month.
+    args[2] = fastParseInt(m[3]) || 1;
+    // Months start from 0
+    if (args[1] > 0)
+        args[1]--;
+    fillTimeArgs(m, args);
+    if (m[8] || utc)
+        return new Date(Date.UTC(...args));
+    return new Date(...args);
+}
+export function parseDateTimeTz(str, utc) {
+    if (str === 'infinity')
+        return Infinity;
+    if (str === '-infinity')
+        return -Infinity;
+    const native = new Date(str);
+    if (!isNaN(native.getTime()))
+        return native;
+    const m = str.match(TIMESTAMP_PATTERN);
+    if (!m)
+        return noMatch(str);
+    const args = [1970, 0, 1, 0, 0, 0, 0];
+    args[0] = fastParseInt(m[1]) || 0;
+    args[1] = fastParseInt(m[2]) || 0;
+    // Regression test: day defaults to 1 when omitted (a bare year or
+    // year-month string, both valid per TIMESTAMP_PATTERN) - `|| 0` used to
+    // leave it at 0, and Date.UTC()'s day is 1-indexed, so "day 0" silently
+    // rolled back to the last day of the *previous* month.
+    args[2] = fastParseInt(m[3]) || 1;
+    // Months start from 0
     if (args[1] > 0)
         args[1]--;
-    if (parseTimeZone && parseTime && m[9]) {
+    fillTimeArgs(m, args);
+    if (m[9]) {
         const r = m[9] === '-' ? -1 : 1;
         args[3] -= (fastParseInt(m[10]) || 0) * r;
         args[4] -= (fastParseInt(m[11]) || 0) * r;

package/util/parse-row.d.ts

@@ -1,3 +1,5 @@
 import type { DataMappingOptions } from '../interfaces/data-mapping-options.js';
+import type { FieldInfo } from '../interfaces/field-info.js';
 import type { AnyParseFunction } from '../types.js';
-export declare function parseRow(parsers: AnyParseFunction[], row: any[], options: DataMappingOptions): void;
+export declare function parseRow(parsers: AnyParseFunction[], data: Buffer, columnCount: number, options: DataMappingOptions): any[];
+export declare function parseObjectRow(parsers: AnyParseFunction[], data: Buffer, columnCount: number, options: DataMappingOptions, fields: FieldInfo[]): object;

package/util/parse-row.js

@@ -1,8 +1,63 @@
-export function parseRow(parsers, row, options) {
-    const l = row.length;
+export function parseRow(parsers, data, columnCount, options) {
+    const row = new Array(columnCount);
+    let offset = 0;
+    let len;
     let i;
-    for (i = 0; i < l; i++) {
-        row[i] =
-            row[i] == null ? null : parsers[i].call(undefined, row[i], options);
+    for (i = 0; i < columnCount; i++) {
+        // The length of the column value, in bytes (this count does not
+        // include itself). Can be zero. As a special case, -1 indicates a
+        // NULL column value - no value bytes follow in that case.
+        len = data.readInt32BE(offset);
+        offset += 4;
+        if (len < 0) {
+            row[i] = null;
+        }
+        else {
+            // None of the parsers use `this`, so a direct call avoids .call()'s
+            // extra indirection (measured ~5.7x slower than invoking directly).
+            row[i] = parsers[i](data, offset, len, options);
+            offset += len;
+        }
     }
+    return row;
+}
+export function parseObjectRow(parsers, data, columnCount, options, fields) {
+    const row = {};
+    let offset = 0;
+    let len;
+    let i;
+    let value;
+    for (i = 0; i < columnCount; i++) {
+        // The length of the column value, in bytes (this count does not
+        // include itself). Can be zero. As a special case, -1 indicates a
+        // NULL column value - no value bytes follow in that case.
+        len = data.readInt32BE(offset);
+        offset += 4;
+        if (len < 0) {
+            value = null;
+        }
+        else {
+            // None of the parsers use `this`, so a direct call avoids .call()'s
+            // extra indirection (measured ~5.7x slower than invoking directly).
+            value = parsers[i](data, offset, len, options);
+            offset += len;
+        }
+        const name = fields[i].fieldName;
+        if (name === '__proto__') {
+            // `value`, not row[i] - nothing is ever assigned by numeric index
+            // here (row is a plain object keyed by field name), so reading row[i]
+            // handed defineProperty an undefined and silently dropped the
+            // column's actual value.
+            Object.defineProperty(row, name, {
+                value,
+                writable: true,
+                enumerable: true,
+                configurable: true,
+            });
+        }
+        else {
+            row[name] = value;
+        }
+    }
+    return row;
 }

package/util/parse-time.js

@@ -14,8 +14,15 @@ export function parseTime(str, parseTimeZone, utc) {
         const s = m[i];
         args[i + 2] = fastParseInt(s) || 0;
     }
+    // Fractional seconds (m[4]) were never read here at all - pad/truncate to
+    // exactly 3 digits, same reasoning as parse-datetime.ts's equivalent fix.
+    if (m[4])
+        args[6] = fastParseInt((m[4] + '000').slice(0, 3));
     if (parseTimeZone && m[6]) {
-        const r = m[9] === '-' ? -1 : 1;
+        // m[6] is the sign group itself ('+'/'-') - there is no m[9] in this
+        // pattern (only 8 capture groups), so the old `m[9] === '-'` check was
+        // always false, silently treating every offset as positive.
+        const r = m[6] === '-' ? -1 : 1;
         args[3] -= (fastParseInt(m[7]) || 0) * r;
         args[4] -= (fastParseInt(m[8]) || 0) * r;
         return new Date(Date.UTC(...args));