prisma-sql 1.58.0 → 1.59.0

package/dist/index.cjs

@@ -187,7 +187,8 @@ var REGEX_CACHE = {
 var LIMITS = Object.freeze({
   MAX_QUERY_DEPTH: 50,
   MAX_ARRAY_SIZE: 1e4,
-  MAX_STRING_LENGTH: 1e4
+  MAX_STRING_LENGTH: 1e4,
+  MAX_HAVING_DEPTH: 50
 });
 
 // src/utils/normalize-value.ts
@@ -250,6 +251,15 @@ function setGlobalDialect(dialect) {
 function getGlobalDialect() {
   return globalDialect;
 }
+function withDialect(dialect, fn) {
+  const prev = globalDialect;
+  globalDialect = dialect;
+  try {
+    return fn();
+  } finally {
+    globalDialect = prev;
+  }
+}
 function assertNonEmpty(value, name) {
   if (!value || value.trim().length === 0) {
     throw new Error(`${name} is required and cannot be empty`);
@@ -484,73 +494,6 @@ function createError(message, ctx, code = "VALIDATION_ERROR") {
   return new SqlBuilderError(parts.join("\n"), code, ctx);
 }
 
-// src/builder/shared/model-field-cache.ts
-var MODEL_CACHE = /* @__PURE__ */ new WeakMap();
-function quote(id) {
-  const needsQuoting2 = !/^[a-z_][a-z0-9_]*$/.test(id) || /^(select|from|where|having|order|group|limit|offset|join|inner|left|right|outer|cross|full|and|or|not|by|as|on|union|intersect|except|case|when|then|else|end|user|users|table|column|index|values|in|like|between|is|exists|null|true|false|all|any|some|update|insert|delete|create|drop|alter|truncate|grant|revoke|exec|execute)$/i.test(
-    id
-  );
-  if (needsQuoting2) {
-    return `"${id.replace(/"/g, '""')}"`;
-  }
-  return id;
-}
-function ensureFullCache(model) {
-  let cache = MODEL_CACHE.get(model);
-  if (!cache) {
-    const fieldInfo = /* @__PURE__ */ new Map();
-    const scalarFields = /* @__PURE__ */ new Set();
-    const relationFields = /* @__PURE__ */ new Set();
-    const columnMap = /* @__PURE__ */ new Map();
-    const fieldByName = /* @__PURE__ */ new Map();
-    const quotedColumns = /* @__PURE__ */ new Map();
-    for (const f of model.fields) {
-      const info = {
-        name: f.name,
-        dbName: f.dbName || f.name,
-        type: f.type,
-        isRelation: !!f.isRelation,
-        isRequired: !!f.isRequired
-      };
-      fieldInfo.set(f.name, info);
-      fieldByName.set(f.name, f);
-      if (info.isRelation) {
-        relationFields.add(f.name);
-      } else {
-        scalarFields.add(f.name);
-        const dbName = info.dbName;
-        columnMap.set(f.name, dbName);
-        quotedColumns.set(f.name, quote(dbName));
-      }
-    }
-    cache = {
-      fieldInfo,
-      scalarFields,
-      relationFields,
-      columnMap,
-      fieldByName,
-      quotedColumns
-    };
-    MODEL_CACHE.set(model, cache);
-  }
-  return cache;
-}
-function getFieldInfo(model, fieldName) {
-  return ensureFullCache(model).fieldInfo.get(fieldName);
-}
-function getScalarFieldSet(model) {
-  return ensureFullCache(model).scalarFields;
-}
-function getRelationFieldSet(model) {
-  return ensureFullCache(model).relationFields;
-}
-function getColumnMap(model) {
-  return ensureFullCache(model).columnMap;
-}
-function getQuotedColumn(model, fieldName) {
-  return ensureFullCache(model).quotedColumns.get(fieldName);
-}
-
 // src/builder/shared/validators/sql-validators.ts
 function isValidWhereClause(clause) {
   return isNotNullish(clause) && clause.trim().length > 0 && clause !== DEFAULT_WHERE_CLAUSE;
@@ -694,6 +637,78 @@ function needsQuoting(identifier) {
   return false;
 }
 
+// src/builder/shared/model-field-cache.ts
+var MODEL_CACHE = /* @__PURE__ */ new WeakMap();
+function quoteIdent(id) {
+  if (typeof id !== "string" || id.trim().length === 0) {
+    throw new Error("quoteIdent: identifier is required and cannot be empty");
+  }
+  if (/[\u0000-\u001F\u007F]/.test(id)) {
+    throw new Error(
+      `quoteIdent: identifier contains invalid characters: ${JSON.stringify(id)}`
+    );
+  }
+  if (needsQuoting(id)) {
+    return `"${id.replace(/"/g, '""')}"`;
+  }
+  return id;
+}
+function ensureFullCache(model) {
+  let cache = MODEL_CACHE.get(model);
+  if (!cache) {
+    const fieldInfo = /* @__PURE__ */ new Map();
+    const scalarFields = /* @__PURE__ */ new Set();
+    const relationFields = /* @__PURE__ */ new Set();
+    const columnMap = /* @__PURE__ */ new Map();
+    const fieldByName = /* @__PURE__ */ new Map();
+    const quotedColumns = /* @__PURE__ */ new Map();
+    for (const f of model.fields) {
+      const info = {
+        name: f.name,
+        dbName: f.dbName || f.name,
+        type: f.type,
+        isRelation: !!f.isRelation,
+        isRequired: !!f.isRequired
+      };
+      fieldInfo.set(f.name, info);
+      fieldByName.set(f.name, f);
+      if (info.isRelation) {
+        relationFields.add(f.name);
+      } else {
+        scalarFields.add(f.name);
+        const dbName = info.dbName;
+        columnMap.set(f.name, dbName);
+        quotedColumns.set(f.name, quoteIdent(dbName));
+      }
+    }
+    cache = {
+      fieldInfo,
+      scalarFields,
+      relationFields,
+      columnMap,
+      fieldByName,
+      quotedColumns
+    };
+    MODEL_CACHE.set(model, cache);
+  }
+  return cache;
+}
+function getFieldInfo(model, fieldName) {
+  return ensureFullCache(model).fieldInfo.get(fieldName);
+}
+function getScalarFieldSet(model) {
+  return ensureFullCache(model).scalarFields;
+}
+function getRelationFieldSet(model) {
+  return ensureFullCache(model).relationFields;
+}
+function getColumnMap(model) {
+  return ensureFullCache(model).columnMap;
+}
+function getQuotedColumn(model, fieldName) {
+  return ensureFullCache(model).quotedColumns.get(fieldName);
+}
+
 // src/builder/shared/sql-utils.ts
 function containsControlChars(s) {
   return /[\u0000-\u001F\u007F]/.test(s);
@@ -836,7 +851,7 @@ function assertSafeQualifiedName(input) {
     }
   }
 }
-function quote2(id) {
+function quote(id) {
   if (isEmptyString(id)) {
     throw new Error("quote: identifier is required and cannot be empty");
   }
@@ -856,13 +871,13 @@ function resolveColumnName(model, fieldName) {
   return columnMap.get(fieldName) || fieldName;
 }
 function quoteColumn(model, fieldName) {
-  if (!model) return quote2(fieldName);
+  if (!model) return quote(fieldName);
   const cached = getQuotedColumn(model, fieldName);
-  return cached || quote2(fieldName);
+  return cached || quote(fieldName);
 }
 function col(alias, field, model) {
   const columnName = model ? getColumnMap(model).get(field) || field : field;
-  const quoted = model ? getQuotedColumn(model, field) || quote2(columnName) : quote2(columnName);
+  const quoted = model ? getQuotedColumn(model, field) || quote(columnName) : quote(columnName);
   return alias + "." + quoted;
 }
 function colWithAlias(alias, field, model) {
@@ -873,9 +888,9 @@ function colWithAlias(alias, field, model) {
     throw new Error("colWithAlias: field is required and cannot be empty");
   }
   const columnName = resolveColumnName(model, field);
-  const columnRef = alias + "." + (model ? getQuotedColumn(model, field) || quote2(columnName) : quote2(columnName));
+  const columnRef = alias + "." + (model ? getQuotedColumn(model, field) || quote(columnName) : quote(columnName));
   if (columnName !== field) {
-    return columnRef + " AS " + quote2(field);
+    return columnRef + " AS " + quote(field);
   }
   return columnRef;
 }
@@ -898,7 +913,7 @@ function buildTableReference(schemaName, tableName, dialect) {
   }
   const d = dialect != null ? dialect : "postgres";
   if (d === "sqlite") {
-    return quote2(tableName);
+    return quote(tableName);
   }
   if (isEmptyString(schemaName)) {
     throw new Error(
@@ -1563,6 +1578,7 @@ function buildOrderEntries(orderBy) {
   }
   return entries;
 }
+var MAX_NOT_DEPTH = 50;
 function buildNotComposite(expr, val, params, dialect, buildOp, separator) {
   const entries = Object.entries(val).filter(
     ([k, v]) => k !== "mode" && v !== void 0
@@ -1577,13 +1593,18 @@ function buildNotComposite(expr, val, params, dialect, buildOp, separator) {
   if (clauses.length === 1) return `${SQL_TEMPLATES.NOT} ${clauses[0]}`;
   return `${SQL_TEMPLATES.NOT} (${clauses.join(separator)})`;
 }
-function buildScalarOperator(expr, op, val, params, mode, fieldType, dialect) {
+function buildScalarOperator(expr, op, val, params, mode, fieldType, dialect, depth = 0) {
   if (val === void 0) return "";
+  if (depth > MAX_NOT_DEPTH) {
+    throw new Error(
+      `NOT operator nesting too deep (max ${MAX_NOT_DEPTH} levels). This usually indicates a circular reference or adversarial input.`
+    );
+  }
   if (val === null) {
     return handleNullValue(expr, op);
   }
   if (op === Ops.NOT && isPlainObject(val)) {
-    return handleNotOperator(expr, val, params, mode, fieldType, dialect);
+    return handleNotOperator(expr, val, params, mode, fieldType, dialect, depth);
   }
   if (op === Ops.NOT) {
     const placeholder = params.addAuto(val);
@@ -1629,7 +1650,7 @@ function normalizeMode(v) {
   if (v === Modes.DEFAULT) return Modes.DEFAULT;
   return void 0;
 }
-function handleNotOperator(expr, val, params, outerMode, fieldType, dialect) {
+function handleNotOperator(expr, val, params, outerMode, fieldType, dialect, depth = 0) {
   const innerMode = normalizeMode(val.mode);
   const effectiveMode = innerMode != null ? innerMode : outerMode;
   const entries = Object.entries(val).filter(
@@ -1646,7 +1667,8 @@ function handleNotOperator(expr, val, params, outerMode, fieldType, dialect) {
         params,
         effectiveMode,
         fieldType,
-        void 0
+        void 0,
+        depth + 1
       );
       if (sub && sub.trim().length > 0) clauses.push(`(${sub})`);
     }
@@ -1659,23 +1681,20 @@ function handleNotOperator(expr, val, params, outerMode, fieldType, dialect) {
     val,
     params,
     dialect,
-    (e, subOp, subVal, p, d) => buildScalarOperator(e, subOp, subVal, p, effectiveMode, fieldType, d),
+    (e, subOp, subVal, p, d) => buildScalarOperator(
+      e,
+      subOp,
+      subVal,
+      p,
+      effectiveMode,
+      fieldType,
+      d,
+      depth + 1
+    ),
     ` ${SQL_TEMPLATES.AND} `
   );
 }
-function buildDynamicLikePattern(op, placeholder, dialect) {
-  if (dialect === "postgres") {
-    switch (op) {
-      case Ops.CONTAINS:
-        return `('%' || ${placeholder} || '%')`;
-      case Ops.STARTS_WITH:
-        return `(${placeholder} || '%')`;
-      case Ops.ENDS_WITH:
-        return `('%' || ${placeholder})`;
-      default:
-        return placeholder;
-    }
-  }
+function buildDynamicLikePattern(op, placeholder) {
   switch (op) {
     case Ops.CONTAINS:
       return `('%' || ${placeholder} || '%')`;
@@ -1691,7 +1710,7 @@ function handleLikeOperator(expr, op, val, params, mode, dialect) {
   if (val === void 0) return "";
   if (schemaParser.isDynamicParameter(val)) {
     const placeholder2 = params.addAuto(val);
-    const patternExpr = buildDynamicLikePattern(op, placeholder2, dialect);
+    const patternExpr = buildDynamicLikePattern(op, placeholder2);
     if (mode === Modes.INSENSITIVE) {
       return caseInsensitiveLike(expr, patternExpr, dialect);
     }
@@ -1977,7 +1996,7 @@ function freezeJoins(items) {
 function isListRelation(fieldType) {
   return typeof fieldType === "string" && fieldType.endsWith("[]");
 }
-function buildToOneNullCheck(field, parentAlias, relTable, relAlias, join, wantNull) {
+function buildToOneNullCheck(field, parentModel, parentAlias, relTable, relAlias, join, wantNull) {
   const isLocal = field.isForeignKeyLocal === true;
   const fkFields = normalizeKeyList(field.foreignKey);
   if (isLocal) {
@@ -1987,8 +2006,7 @@ function buildToOneNullCheck(field, parentAlias, relTable, relAlias, join, wantN
       });
     }
     const parts = fkFields.map((fk) => {
-      const safe = fk.replace(/"/g, '""');
-      const expr = `${parentAlias}."${safe}"`;
+      const expr = `${parentAlias}.${quoteColumn(parentModel, fk)}`;
       return wantNull ? `${expr} ${SQL_TEMPLATES.IS_NULL}` : `${expr} ${SQL_TEMPLATES.IS_NOT_NULL}`;
     });
     if (parts.length === 1) return parts[0];
@@ -2033,7 +2051,7 @@ function buildListRelationFilters(args) {
       ) || relModel.fields.find((f) => !f.isRelation && f.name === "id");
       if (checkField) {
         const leftJoinSql = `LEFT JOIN ${relTable} ${relAlias} ON ${join}`;
-        const whereClause = `${relAlias}.${quote2(checkField.name)} IS NULL`;
+        const whereClause = `${relAlias}.${quote(checkField.name)} IS NULL`;
         return Object.freeze({
           clause: whereClause,
           joins: freezeJoins([leftJoinSql])
@@ -2126,6 +2144,7 @@ function buildToOneRelationFilters(args) {
     const wantNull = filterKey === "is";
     const clause2 = buildToOneNullCheck(
       field,
+      ctx.model,
       ctx.alias,
       relTable,
       relAlias,
@@ -2355,7 +2374,8 @@ function buildWhereInternal(where, ctx, builder) {
   }
   const allJoins = [];
   const clauses = [];
-  for (const [key, value] of Object.entries(where)) {
+  for (const key in where) {
+    const value = where[key];
     if (value === void 0) continue;
     const result = buildWhereEntry(key, value, ctx, builder);
     appendResult(result, clauses, allJoins);
@@ -2605,8 +2625,6 @@ function createStoreInternal(startIndex, initialParams = [], initialMappings = [
   }
   let dirty = true;
   let cachedSnapshot = null;
-  let frozenParams = null;
-  let frozenMappings = null;
   function assertCanAdd() {
     if (index > MAX_PARAM_INDEX) {
       throw new Error(
@@ -2658,17 +2676,13 @@ function createStoreInternal(startIndex, initialParams = [], initialMappings = [
   }
   function snapshot() {
     if (!dirty && cachedSnapshot) return cachedSnapshot;
-    if (!frozenParams) frozenParams = Object.freeze(params.slice());
-    if (!frozenMappings) frozenMappings = Object.freeze(mappings.slice());
     const snap = {
       index,
-      params: frozenParams,
-      mappings: frozenMappings
+      params: params.slice(),
+      mappings: mappings.slice()
     };
     cachedSnapshot = snap;
     dirty = false;
-    frozenParams = null;
-    frozenMappings = null;
     return snap;
   }
   return {
@@ -3598,7 +3612,7 @@ function buildDistinctColumns(distinct, fromAlias, model) {
 }
 function buildOutputColumns(scalarNames, includeNames, hasCount) {
   const outputCols = hasCount ? [...scalarNames, ...includeNames, "_count"] : [...scalarNames, ...includeNames];
-  const formatted = outputCols.map((n) => quote2(n)).join(SQL_SEPARATORS.FIELD_LIST);
+  const formatted = outputCols.map((n) => quote(n)).join(SQL_SEPARATORS.FIELD_LIST);
   if (!isNonEmptyString(formatted)) {
     throw new Error("distinct emulation requires at least one output column");
   }
@@ -3694,7 +3708,7 @@ function buildIncludeColumns(spec) {
         dialect
       );
       if (countBuild.jsonPairs) {
-        countCols = jsonBuildObject(countBuild.jsonPairs, dialect) + " " + SQL_TEMPLATES.AS + " " + quote2("_count");
+        countCols = jsonBuildObject(countBuild.jsonPairs, dialect) + " " + SQL_TEMPLATES.AS + " " + quote("_count");
       }
       countJoins = countBuild.joins;
     }
@@ -3707,7 +3721,7 @@ function buildIncludeColumns(spec) {
   const emptyJson = dialect === "postgres" ? `'[]'::json` : `json('[]')`;
   const includeCols = hasIncludes ? includes.map((inc) => {
     const expr = inc.isOneToOne ? "(" + inc.sql + ")" : "COALESCE((" + inc.sql + "), " + emptyJson + ")";
-    return expr + " " + SQL_TEMPLATES.AS + " " + quote2(inc.name);
+    return expr + " " + SQL_TEMPLATES.AS + " " + quote(inc.name);
   }).join(SQL_SEPARATORS.FIELD_LIST) : "";
   const allCols = joinNonEmpty(
     [includeCols, countCols],
@@ -4072,6 +4086,7 @@ function buildComparisons(expr, filter, params, dialect, builder, excludeKeys =
 }
 
 // src/builder/aggregates.ts
+var MAX_NOT_DEPTH2 = 50;
 var AGGREGATES = [
   ["_sum", "SUM"],
   ["_avg", "AVG"],
@@ -4186,8 +4201,13 @@ function buildBinaryComparison(expr, op, val, params) {
   const placeholder = addHavingParam(params, op, val);
   return expr + " " + sqlOp + " " + placeholder;
 }
-function buildSimpleComparison(expr, op, val, params, dialect) {
+function buildSimpleComparison(expr, op, val, params, dialect, depth = 0) {
   assertHavingOp(op);
+  if (depth > MAX_NOT_DEPTH2) {
+    throw new Error(
+      `NOT operator nesting too deep in HAVING (max ${MAX_NOT_DEPTH2} levels).`
+    );
+  }
   if (val === null) return buildNullComparison(expr, op);
   if (op === Ops.NOT && isPlainObject(val)) {
     return buildNotComposite(
@@ -4195,7 +4215,7 @@ function buildSimpleComparison(expr, op, val, params, dialect) {
       val,
       params,
       dialect,
-      buildSimpleComparison,
+      (e, subOp, subVal, p, d) => buildSimpleComparison(e, subOp, subVal, p, d, depth + 1),
       SQL_SEPARATORS.CONDITION_AND
     );
   }
@@ -4212,23 +4232,36 @@ function combineLogical(key, subClauses) {
   if (key === LogicalOps.NOT) return negateClauses(subClauses);
   return subClauses.join(" " + key + " ");
 }
-function buildHavingNode(node, alias, params, dialect, model) {
+function buildHavingNode(node, alias, params, dialect, model, depth = 0) {
+  if (depth > LIMITS.MAX_HAVING_DEPTH) {
+    throw new Error(
+      `HAVING clause nesting too deep (max ${LIMITS.MAX_HAVING_DEPTH} levels). This usually indicates a circular reference.`
+    );
+  }
   const clauses = [];
   for (const key in node) {
     if (!Object.prototype.hasOwnProperty.call(node, key)) continue;
     const value = node[key];
-    const built = buildHavingEntry(key, value, alias, params, dialect, model);
+    const built = buildHavingEntry(
+      key,
+      value,
+      alias,
+      params,
+      dialect,
+      model,
+      depth
+    );
     for (const c of built) {
       if (c && c.length > 0) clauses.push(c);
     }
   }
   return clauses.join(SQL_SEPARATORS.CONDITION_AND);
 }
-function buildLogicalClause2(key, value, alias, params, dialect, model) {
+function buildLogicalClause2(key, value, alias, params, dialect, model, depth = 0) {
   const items = normalizeLogicalValue2(key, value);
   const subClauses = [];
   for (const it of items) {
-    const c = buildHavingNode(it, alias, params, dialect, model);
+    const c = buildHavingNode(it, alias, params, dialect, model, depth + 1);
     if (c && c.length > 0) subClauses.push("(" + c + ")");
   }
   if (subClauses.length === 0) return "";
@@ -4287,7 +4320,7 @@ function buildHavingForFieldFirstShape(fieldName, target, alias, params, dialect
   }
   return out;
 }
-function buildHavingEntry(key, value, alias, params, dialect, model) {
+function buildHavingEntry(key, value, alias, params, dialect, model, depth = 0) {
   if (isLogicalKey(key)) {
     const logical = buildLogicalClause2(
       key,
@@ -4295,7 +4328,8 @@ function buildHavingEntry(key, value, alias, params, dialect, model) {
       alias,
       params,
       dialect,
-      model
+      model,
+      depth
     );
     return logical ? [logical] : [];
   }
@@ -4322,7 +4356,7 @@ function buildHavingClause(having, alias, params, model, dialect) {
   if (!isNotNullish(having)) return "";
   const d = dialect != null ? dialect : getGlobalDialect();
   if (!isPlainObject(having)) throw new Error("having must be an object");
-  return buildHavingNode(having, alias, params, d, model);
+  return buildHavingNode(having, alias, params, d, model, 0);
 }
 function normalizeCountArg(v) {
   if (!isNotNullish(v)) return void 0;
@@ -4332,13 +4366,13 @@ function normalizeCountArg(v) {
 }
 function pushCountAllField(fields) {
   fields.push(
-    SQL_TEMPLATES.COUNT_ALL + " " + SQL_TEMPLATES.AS + " " + quote2("_count._all")
+    SQL_TEMPLATES.COUNT_ALL + " " + SQL_TEMPLATES.AS + " " + quote("_count._all")
   );
 }
 function pushCountField(fields, alias, fieldName, model) {
   const outAlias = "_count." + fieldName;
   fields.push(
-    "COUNT(" + col(alias, fieldName, model) + ") " + SQL_TEMPLATES.AS + " " + quote2(outAlias)
+    "COUNT(" + col(alias, fieldName, model) + ") " + SQL_TEMPLATES.AS + " " + quote(outAlias)
   );
 }
 function addCountFields(fields, countArg, alias, model) {
@@ -4375,7 +4409,7 @@ function assertAggregatableScalarField(model, agg, fieldName) {
 function pushAggregateFieldSql(fields, aggFn, alias, agg, fieldName, model) {
   const outAlias = agg + "." + fieldName;
   fields.push(
-    aggFn + "(" + col(alias, fieldName, model) + ") " + SQL_TEMPLATES.AS + " " + quote2(outAlias)
+    aggFn + "(" + col(alias, fieldName, model) + ") " + SQL_TEMPLATES.AS + " " + quote(outAlias)
   );
 }
 function addAggregateFields(fields, args, alias, model) {
@@ -4522,7 +4556,7 @@ function buildCountSql(whereResult, tableName, alias, skip, _dialect) {
     SQL_TEMPLATES.SELECT,
     SQL_TEMPLATES.COUNT_ALL,
     SQL_TEMPLATES.AS,
-    quote2("_count._all"),
+    quote("_count._all"),
     SQL_TEMPLATES.FROM,
     tableName,
     alias
@@ -4563,15 +4597,21 @@ function buildSqlResult(args) {
     return buildAggregateSql(processed, whereResult, tableName, alias, modelDef);
   }
   if (method === "groupBy") {
-    return buildGroupBySql(processed, whereResult, tableName, alias, modelDef);
+    return buildGroupBySql(
+      processed,
+      whereResult,
+      tableName,
+      alias,
+      modelDef,
+      dialect
+    );
   }
   if (method === "count") {
     return buildCountSql(
       whereResult,
       tableName,
       alias,
-      processed.skip
-    );
+      processed.skip);
   }
   return buildSelectSql({
     method,
@@ -4611,22 +4651,23 @@ function normalizeSqlAndMappingsForDialect(sql, paramMappings, dialect) {
 }
 function buildParamsFromMappings(mappings) {
   const sorted = [...mappings].sort((a, b) => a.index - b.index);
-  return sorted.reduce(
-    (acc, m) => {
-      if (m.dynamicName !== void 0) {
-        acc.dynamicKeys.push(m.dynamicName);
-        return acc;
-      }
-      if (m.value !== void 0) {
-        acc.staticParams.push(m.value);
-        return acc;
-      }
+  const staticParams = [];
+  const dynamicKeys = [];
+  let paramOrder = "";
+  for (const m of sorted) {
+    if (m.dynamicName !== void 0) {
+      dynamicKeys.push(m.dynamicName);
+      paramOrder += "d";
+    } else if (m.value !== void 0) {
+      staticParams.push(m.value);
+      paramOrder += "s";
+    } else {
       throw new Error(
         `CRITICAL: ParamMap ${m.index} has neither dynamicName nor value`
       );
-    },
-    { staticParams: [], dynamicKeys: [] }
-  );
+    }
+  }
+  return { staticParams, dynamicKeys, paramOrder };
 }
 function resolveModelContext(directive) {
   const { model, datamodel } = directive.context;
@@ -4692,12 +4733,13 @@ function finalizeDirective(args) {
     return (_a = m.value) != null ? _a : void 0;
   });
   validateParamConsistencyByDialect(normalizedSql, params, dialect);
-  const { staticParams, dynamicKeys } = buildParamsFromMappings(normalizedMappings);
+  const { staticParams, dynamicKeys, paramOrder } = buildParamsFromMappings(normalizedMappings);
   return {
     method: directive.method,
     sql: normalizedSql,
     staticParams,
     dynamicKeys,
+    paramOrder,
     paramMappings: normalizedMappings,
     originalDirective: directive
   };
@@ -5017,49 +5059,100 @@ function makeAlias(name) {
 }
 function toSqliteParams(sql, params) {
   const reorderedParams = [];
-  let lastIndex = 0;
-  const parts = [];
-  for (let i = 0; i < sql.length; i++) {
-    if (sql[i] === "$" && i + 1 < sql.length) {
-      let num = 0;
-      let j = i + 1;
-      while (j < sql.length && sql[j] >= "0" && sql[j] <= "9") {
-        num = num * 10 + (sql.charCodeAt(j) - 48);
-        j++;
+  const n = sql.length;
+  let i = 0;
+  let out = "";
+  let mode = "normal";
+  while (i < n) {
+    const ch = sql.charCodeAt(i);
+    if (mode === "normal") {
+      if (ch === 39) {
+        out += sql[i];
+        mode = "single";
+        i++;
+        continue;
+      }
+      if (ch === 34) {
+        out += sql[i];
+        mode = "double";
+        i++;
+        continue;
       }
-      if (j > i + 1) {
-        parts.push(sql.substring(lastIndex, i));
-        parts.push("?");
-        reorderedParams.push(params[num - 1]);
-        i = j - 1;
-        lastIndex = j;
+      if (ch === 36) {
+        let j = i + 1;
+        let num = 0;
+        let hasDigit = false;
+        while (j < n) {
+          const d = sql.charCodeAt(j);
+          if (d >= 48 && d <= 57) {
+            num = num * 10 + (d - 48);
+            hasDigit = true;
+            j++;
+          } else {
+            break;
+          }
+        }
+        if (hasDigit && num >= 1) {
+          out += "?";
+          reorderedParams.push(params[num - 1]);
+          i = j;
+          continue;
+        }
       }
+      out += sql[i];
+      i++;
+      continue;
     }
+    if (mode === "single") {
+      out += sql[i];
+      if (ch === 39) {
+        if (i + 1 < n && sql.charCodeAt(i + 1) === 39) {
+          out += sql[i + 1];
+          i += 2;
+          continue;
+        }
+        mode = "normal";
+      }
+      i++;
+      continue;
+    }
+    if (mode === "double") {
+      out += sql[i];
+      if (ch === 34) {
+        if (i + 1 < n && sql.charCodeAt(i + 1) === 34) {
+          out += sql[i + 1];
+          i += 2;
+          continue;
+        }
+        mode = "normal";
+      }
+      i++;
+      continue;
+    }
+    out += sql[i];
+    i++;
   }
-  parts.push(sql.substring(lastIndex));
-  return { sql: parts.join(""), params: reorderedParams };
+  return { sql: out, params: reorderedParams };
 }
-function canonicalizeQuery(modelName, method, args, dialect) {
-  function normalize(obj) {
-    if (obj === null || obj === void 0) return obj;
-    if (obj instanceof Date) {
-      return "__DATE_PARAM__";
-    }
-    if (Array.isArray(obj)) {
-      return obj.map(normalize);
-    }
-    if (typeof obj === "object") {
-      const sorted = {};
-      for (const key of Object.keys(obj).sort()) {
-        const value = obj[key];
-        sorted[key] = schemaParser.isDynamicParameter(value) ? "__DYN__" : normalize(value);
+function canonicalizeReplacer(key, value) {
+  if (typeof value === "bigint") return `__bigint__${value.toString()}`;
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    const obj = value;
+    const sorted = {};
+    for (const k of Object.keys(obj).sort()) {
+      const v = obj[k];
+      if (v && typeof v === "object" && !Array.isArray(v) && Object.keys(v).length === 0) {
+        continue;
       }
-      return sorted;
+      sorted[k] = v;
     }
-    return obj;
+    return sorted;
   }
-  const canonical = normalize(args);
-  return `${dialect}:${modelName}:${method}:${JSON.stringify(canonical)}`;
+  return value;
+}
+function canonicalizeQuery(modelName, method, args, dialect) {
+  if (!args) return `${dialect}:${modelName}:${method}:{}`;
+  return `${dialect}:${modelName}:${method}:${JSON.stringify(args, canonicalizeReplacer)}`;
 }
 function buildSQLFull(model, models, method, args, dialect) {
   const tableName = buildTableReference(
@@ -5123,46 +5216,20 @@ function buildSQLFull(model, models, method, args, dialect) {
 }
 function buildSQLWithCache(model, models, method, args, dialect) {
   const cacheKey = canonicalizeQuery(model.name, method, args, dialect);
-  const cachedSql = queryCache.get(cacheKey);
-  if (cachedSql) {
-    const result2 = buildSQLFull(model, models, method, args, dialect);
-    return { sql: cachedSql, params: result2.params };
+  const cached = queryCache.get(cacheKey);
+  if (cached) {
+    return { sql: cached.sql, params: [...cached.params] };
   }
   const result = buildSQLFull(model, models, method, args, dialect);
-  queryCache.set(cacheKey, result.sql);
+  queryCache.set(cacheKey, result);
   queryCache.size;
   return result;
 }
 
 // src/batch.ts
-function assertNoControlChars2(label, s) {
-  for (let i = 0; i < s.length; i++) {
-    const c = s.charCodeAt(i);
-    if (c <= 31 || c === 127) {
-      throw new Error(`${label} contains control characters`);
-    }
-  }
-}
-function assertSafeIdentifier(label, s) {
-  const raw = String(s);
-  if (raw.trim() !== raw) {
-    throw new Error(`${label} must not contain leading/trailing whitespace`);
-  }
-  if (raw.length === 0) throw new Error(`${label} cannot be empty`);
-  assertNoControlChars2(label, raw);
-  if (/[ \t\r\n]/.test(raw)) {
-    throw new Error(`${label} must not contain whitespace`);
-  }
-  if (raw.includes(";")) {
-    throw new Error(`${label} must not contain semicolons`);
-  }
-  if (raw.includes("--") || raw.includes("/*") || raw.includes("*/")) {
-    throw new Error(`${label} must not contain SQL comment tokens`);
-  }
-}
-function quoteIdent(id) {
+function quoteBatchIdent(id) {
   const raw = String(id);
-  assertSafeIdentifier("Identifier", raw);
+  assertSafeAlias(raw);
   return `"${raw.replace(/"/g, '""')}"`;
 }
 function makeBatchAlias(i) {
@@ -5324,6 +5391,14 @@ function replacePgPlaceholders(sql, replace) {
   }
   return out;
 }
+function containsPgPlaceholder(sql) {
+  let found = false;
+  replacePgPlaceholders(sql, (oldIndex) => {
+    found = true;
+    return `$${oldIndex}`;
+  });
+  return found;
+}
 function reindexParams(sql, params, offset) {
   if (!Number.isInteger(offset) || offset < 0) {
     throw new Error(`Invalid param offset: ${offset}`);
@@ -5347,7 +5422,7 @@ function reindexParams(sql, params, offset) {
   return { sql: reindexed, params: newParams };
 }
 function wrapQueryForMethod(method, cteName, resultAlias) {
-  const outKey = quoteIdent(resultAlias);
+  const outKey = quoteBatchIdent(resultAlias);
   switch (method) {
     case "findMany":
     case "groupBy":
@@ -5381,9 +5456,6 @@ function looksTooComplexForFilter(sql) {
   if (s.includes(" distinct ")) return true;
   return false;
 }
-function containsPgPlaceholder(sql) {
-  return /\$[1-9][0-9]*/.test(sql);
-}
 function parseSimpleCountSql(sql) {
   const trimmed = sql.trim().replace(/;$/, "").trim();
   const lower = trimmed.toLowerCase();
@@ -5431,7 +5503,7 @@ function buildMergedCountBatchSql(queries, keys, aliasesByKey, modelMap, models,
         if (built.params.length > 0) return null;
         if (sharedFrom === null) sharedFrom = parsed.fromSql;
         if (sharedFrom !== parsed.fromSql) return null;
-        expressions.push(`count(*) AS ${quoteIdent(alias2)}`);
+        expressions.push(`count(*) AS ${quoteBatchIdent(alias2)}`);
         localKeys.push(key);
         localAliases.push(alias2);
         continue;
@@ -5445,7 +5517,7 @@ function buildMergedCountBatchSql(queries, keys, aliasesByKey, modelMap, models,
       );
       for (let p = 0; p < re.params.length; p++) localParams.push(re.params[p]);
       expressions.push(
-        `count(*) FILTER (WHERE ${re.sql}) AS ${quoteIdent(alias2)}`
+        `count(*) FILTER (WHERE ${re.sql}) AS ${quoteBatchIdent(alias2)}`
       );
       localKeys.push(key);
       localAliases.push(alias2);
@@ -5478,7 +5550,7 @@ function buildMergedCountBatchSql(queries, keys, aliasesByKey, modelMap, models,
     for (let k = 0; k < sq.aliases.length; k++) {
       const outAlias = sq.aliases[k];
       selectParts.push(
-        `${sq.alias}.${quoteIdent(outAlias)} AS ${quoteIdent(outAlias)}`
+        `${sq.alias}.${quoteBatchIdent(outAlias)} AS ${quoteBatchIdent(outAlias)}`
       );
     }
   }
@@ -5585,7 +5657,7 @@ function buildBatchCountSql(queries, modelMap, models, dialect) {
     const cteName = `count_${i}`;
     const resultKey = `count_${i}`;
     ctes[i] = `${cteName} AS (${reindexedSql})`;
-    selects[i] = `(SELECT * FROM ${cteName}) AS ${quoteIdent(resultKey)}`;
+    selects[i] = `(SELECT * FROM ${cteName}) AS ${quoteBatchIdent(resultKey)}`;
   }
   const sql = `WITH ${ctes.join(", ")} SELECT ${selects.join(", ")}`;
   return { sql, params: allParams };
@@ -5702,6 +5774,20 @@ function isolationLevelToPostgresKeyword(level) {
       return void 0;
   }
 }
+function validateTimeout(timeout) {
+  if (typeof timeout !== "number") {
+    throw new Error(
+      `Transaction timeout must be a number, got ${typeof timeout}`
+    );
+  }
+  if (!Number.isFinite(timeout)) {
+    throw new Error(`Transaction timeout must be finite, got ${timeout}`);
+  }
+  if (timeout < 0) {
+    throw new Error(`Transaction timeout must be non-negative, got ${timeout}`);
+  }
+  return Math.floor(timeout);
+}
 function createTransactionExecutor(deps) {
   const { modelMap, allModels, dialect, executeRaw, postgresClient } = deps;
   return {
@@ -5724,10 +5810,11 @@ function createTransactionExecutor(deps) {
               `SET TRANSACTION ISOLATION LEVEL ${isolationLevel.toUpperCase()}`
             );
           }
-          if (options == null ? void 0 : options.timeout) {
-            yield sql.unsafe(
-              `SET LOCAL statement_timeout = ${Math.floor(options.timeout)}`
-            );
+          if ((options == null ? void 0 : options.timeout) !== void 0 && options.timeout !== null) {
+            const validatedTimeout = validateTimeout(options.timeout);
+            yield sql.unsafe(`SET LOCAL statement_timeout = $1`, [
+              validatedTimeout
+            ]);
           }
           for (const q of queries) {
             const model = modelMap.get(q.model);
@@ -5753,6 +5840,124 @@ function createTransactionExecutor(deps) {
     }
   };
 }
+
+// src/fast-path.ts
+function getIdField(model) {
+  const idField = model.fields.find((f) => f.name === "id" && !f.isRelation);
+  if (!idField) return null;
+  return {
+    name: "id",
+    dbName: idField.dbName || "id"
+  };
+}
+function buildColumnList(model) {
+  const cols = [];
+  for (const f of model.fields) {
+    if (f.isRelation) continue;
+    if (f.name.startsWith("@") || f.name.startsWith("//")) continue;
+    const dbName = f.dbName || f.name;
+    if (dbName !== f.name) {
+      cols.push(`${quote(dbName)} AS ${quote(f.name)}`);
+    } else {
+      cols.push(quote(dbName));
+    }
+  }
+  return cols.join(", ");
+}
+function buildSimpleQuery(model, dialect, where, params, suffix = "") {
+  const tableName = buildTableReference(
+    SQL_TEMPLATES.PUBLIC_SCHEMA,
+    model.tableName,
+    dialect
+  );
+  const columns = buildColumnList(model);
+  const sql = `SELECT ${columns} FROM ${tableName} ${where}${suffix}`;
+  return { sql, params };
+}
+function norm(value) {
+  return normalizeValue(value);
+}
+function tryFastPath(model, method, args, dialect) {
+  const where = args.where;
+  if (method === "findUnique" && isPlainObject(where) && Object.keys(where).length === 1 && "id" in where && !args.select && !args.include) {
+    const idField = getIdField(model);
+    if (!idField) return null;
+    const whereClause = dialect === "sqlite" ? `WHERE ${quote(idField.dbName)} = ?` : `WHERE ${quote(idField.dbName)} = $1`;
+    return buildSimpleQuery(
+      model,
+      dialect,
+      whereClause,
+      [norm(where.id)],
+      " LIMIT 1"
+    );
+  }
+  if (method === "findMany" && isPlainObject(where) && Object.keys(where).length === 1 && "id" in where && !args.select && !args.include && !args.orderBy && !args.take && !args.skip && !args.distinct && !args.cursor) {
+    const idField = getIdField(model);
+    if (!idField) return null;
+    const whereClause = dialect === "sqlite" ? `WHERE ${quote(idField.dbName)} = ?` : `WHERE ${quote(idField.dbName)} = $1`;
+    return buildSimpleQuery(model, dialect, whereClause, [norm(where.id)]);
+  }
+  if (method === "count" && (!where || Object.keys(where).length === 0) && !args.select && !args.skip) {
+    const tableName = buildTableReference(
+      SQL_TEMPLATES.PUBLIC_SCHEMA,
+      model.tableName,
+      dialect
+    );
+    const sql = `SELECT COUNT(*) AS ${quote("_count._all")} FROM ${tableName}`;
+    return { sql, params: [] };
+  }
+  if (method === "findMany" && (!where || Object.keys(where).length === 0) && !args.select && !args.include && !args.orderBy && !args.skip && !args.distinct && !args.cursor && typeof args.take === "number") {
+    const tableName = buildTableReference(
+      SQL_TEMPLATES.PUBLIC_SCHEMA,
+      model.tableName,
+      dialect
+    );
+    const columns = buildColumnList(model);
+    const sql = dialect === "sqlite" ? `SELECT ${columns} FROM ${tableName} LIMIT ?` : `SELECT ${columns} FROM ${tableName} LIMIT $1`;
+    return { sql, params: [norm(args.take)] };
+  }
+  if (method === "findFirst" && isPlainObject(where) && Object.keys(where).length === 1 && !args.select && !args.include && !args.orderBy && !args.skip) {
+    const field = Object.keys(where)[0];
+    const value = where[field];
+    if (value !== null && typeof value !== "object") {
+      const fieldDef = model.fields.find((f) => f.name === field);
+      if (fieldDef && !fieldDef.isRelation) {
+        const columnName = fieldDef.dbName || field;
+        const whereClause = dialect === "sqlite" ? `WHERE ${quote(columnName)} = ?` : `WHERE ${quote(columnName)} = $1`;
+        return buildSimpleQuery(
+          model,
+          dialect,
+          whereClause,
+          [norm(value)],
+          " LIMIT 1"
+        );
+      }
+    }
+  }
+  if (method === "findMany" && isPlainObject(where) && Object.keys(where).length === 1 && !args.select && !args.include && !args.orderBy && !args.take && !args.skip && !args.distinct && !args.cursor) {
+    const field = Object.keys(where)[0];
+    const value = where[field];
+    if (value !== null && typeof value !== "object") {
+      const fieldDef = model.fields.find((f) => f.name === field);
+      if (fieldDef && !fieldDef.isRelation) {
+        const columnName = fieldDef.dbName || field;
+        const whereClause = dialect === "sqlite" ? `WHERE ${quote(columnName)} = ?` : `WHERE ${quote(columnName)} = $1`;
+        return buildSimpleQuery(model, dialect, whereClause, [norm(value)]);
+      }
+    }
+  }
+  if (method === "findMany" && (!where || Object.keys(where).length === 0) && !args.select && !args.include && !args.orderBy && !args.take && !args.skip && !args.distinct && !args.cursor) {
+    const tableName = buildTableReference(
+      SQL_TEMPLATES.PUBLIC_SCHEMA,
+      model.tableName,
+      dialect
+    );
+    const columns = buildColumnList(model);
+    const sql = `SELECT ${columns} FROM ${tableName}`;
+    return { sql, params: [] };
+  }
+  return null;
+}
 var ACCELERATED_METHODS = /* @__PURE__ */ new Set([
   "findMany",
   "findFirst",
@@ -5832,8 +6037,13 @@ function createExecuteQuery(client, dialect) {
   });
 }
 function logAcceleratedError(debug, dialect, modelName, method, error) {
-  if (!debug) return;
-  console.error(`[${dialect}] ${modelName}.${method} failed:`, error);
+  const msg = error instanceof Error ? error.message : String(error);
+  console.warn(
+    `[prisma-sql] ${modelName}.${method} acceleration failed, falling back to Prisma: ${msg}`
+  );
+  if (debug && error instanceof Error && error.stack) {
+    console.warn(error.stack);
+  }
 }
 function canAccelerate(deps, modelName, method) {
   if (!ACCELERATED_METHODS.has(method)) return false;
@@ -5842,18 +6052,34 @@ function canAccelerate(deps, modelName, method) {
 }
 function runAccelerated(deps, modelName, method, model, args) {
   return __async(this, null, function* () {
-    const results = yield executeWithTiming({
-      modelName,
-      method,
-      model,
-      allModels: deps.allModels,
-      args: args || {},
-      dialect: deps.dialect,
-      debug: deps.debug,
-      executeQuery: deps.executeQuery,
-      onQuery: deps.onQuery
-    });
-    return transformQueryResults(method, results);
+    return withDialect(deps.dialect, () => __async(null, null, function* () {
+      const fastPath = tryFastPath(model, method, args || {}, deps.dialect);
+      if (fastPath) {
+        if (deps.debug) {
+          console.log(`[${deps.dialect}] ${modelName}.${method} \u26A1 FAST PATH`);
+          console.log("SQL:", fastPath.sql);
+          console.log("Params:", fastPath.params);
+        }
+        const results2 = yield deps.executeQuery(
+          method,
+          fastPath.sql,
+          fastPath.params
+        );
+        return transformQueryResults(method, results2);
+      }
+      const results = yield executeWithTiming({
+        modelName,
+        method,
+        model,
+        allModels: deps.allModels,
+        args: args || {},
+        dialect: deps.dialect,
+        debug: deps.debug,
+        executeQuery: deps.executeQuery,
+        onQuery: deps.onQuery
+      });
+      return transformQueryResults(method, results);
+    }));
   });
 }
 function handleMethodCall(ctx, method, args, deps) {