turbine-orm 0.65.0 → 0.66.0

package/dist/prisma-compat.js

@@ -125,6 +125,7 @@ import { fingerprintPrismaSchema } from './prisma-schema-fingerprint.js';
 import { AGGREGATE_OPTIONS, applyNativeOptions, COUNT_OPTIONS, CREATE_MANY_OPTIONS, CREATE_OPTIONS, DELETE_MANY_OPTIONS, DELETE_OPTIONS, FIND_MANY_OPTIONS, FIND_UNIQUE_OPTIONS, GROUP_BY_OPTIONS, optionKeysOfKind, UNSAFE, UPDATE_MANY_OPTIONS, UPDATE_OPTIONS, UPSERT_OPTIONS, } from './query/index.js';
 import { suggestKey } from './query/utils.js';
 import { shouldWarnOnce, WARN_NS } from './query/warn-registry.js';
+import { assertWhereDepth, MAX_WHERE_DEPTH } from './query/where-compile.js';
 // ---------------------------------------------------------------------------
 // Prisma.sql-style raw fragments (local, minimal, never imports @prisma/client)
 // ---------------------------------------------------------------------------
@@ -270,7 +271,63 @@ function relTargetModel(ctx, mm, turbineRel) {
 // Argument translation
 // ---------------------------------------------------------------------------
 const COMBINATORS = new Set(['AND', 'OR', 'NOT']);
+/**
+ * The to-many half of the relation-filter wrapper list.
+ *
+ * DRIFT RISK, and this is the third copy of that list in the tree. The canonical
+ * NAMED one is `RELATION_FILTER_WRAPPERS` in `cli/pii-predicate-guard.ts`
+ * (`some`/`none`/`every`/`is`/`isNot`), and a second is inlined in
+ * `query/where-compile.ts` as `'some' in x || 'every' in x || …`. This copy is
+ * the worst of the three because it is SPLIT: the to-many quantifiers are here,
+ * and `is` / `isNot` are two inline `k === …` tests in
+ * {@link translateRelationFilter}, so half of it does not read as a list and a
+ * grep for the list will not find it. A wrapper the compiler learns and this set
+ * does not is a relation body that reaches core untranslated, i.e. with Prisma
+ * field names still in it.
+ *
+ * The fix is an export from `query/filters.ts` that all three import; until that
+ * exists, these comments are what hold them in step.
+ */
 const RELATION_QUANTIFIERS = new Set(['some', 'every', 'none']);
+/**
+ * Refuse a translation walk that has nested past {@link MAX_WHERE_DEPTH}.
+ *
+ * Core caps every WHERE / HAVING walk (`assertWhereDepth`), but this layer runs
+ * BEFORE core sees anything: `translateWhere` rebuilds the whole clause into
+ * turbine field names first, so on a deeply nested predicate the stack overflows
+ * HERE and core's guard is unreachable for every compat consumer. Measured on
+ * Node 24 against a wire-realistic body: a 1,000-deep `NOT` chain translated
+ * fine and a 4,000-deep one (a 32 KB body, comfortably under `express.json()`'s
+ * 100 KB default) threw `RangeError: Maximum call stack size exceeded`, which is
+ * not a {@link TurbineError} and so walks straight past the typed-error surface
+ * callers catch on.
+ *
+ * FIVE families needed the cap, not one. `where` and `having` have a core
+ * counterpart and DELEGATE to it, so a compat caller reads the byte-identical
+ * message a core caller reads at the byte-identical nesting. The other three
+ * have no core counterpart at all and are the sharper half:
+ *
+ *   - `orderBy` recurses on nested ARRAYS, and core ignores those entirely
+ *     (`normalizeOrderBy` reads one level), so there is no second line of
+ *     defense: `{"orderBy":[[[…]]]}` at 2,000 (a 4 KB body) was the cheapest
+ *     `RangeError` on the whole surface.
+ *   - `include` / `select` recurse through `translateWithOption`
+ *     (45 KB), and
+ *   - nested-write `data` recurses through `translateNestedWrite` (43 KB).
+ *
+ * The depth is core's, not a second convention: the same {@link MAX_WHERE_DEPTH}
+ * for all five, so nothing core would accept is refused here for depth alone.
+ */
+function assertTranslateDepth(depth, clause) {
+    if (depth <= MAX_WHERE_DEPTH)
+        return;
+    // The two clauses core also walks raise core's own error, verbatim.
+    if (clause === 'where' || clause === 'having')
+        assertWhereDepth(depth, clause);
+    throw new ValidationError(`[turbine] \`${clause}\` nests more than ${MAX_WHERE_DEPTH} levels deep. That is far past anything a real ` +
+        `query needs, and an unbounded walk over caller-supplied nesting is a stack-overflow surface, so it is ` +
+        `refused. If this is a generated argument, flatten it: a single array of N entries is one level, not N.`);
+}
 /** Whether a value is a plain object usable as a compound-unique selector. */
 function isPlainObject(v) {
     return (typeof v === 'object' &&
@@ -531,14 +588,25 @@ function mapRelationLoadStrategy(value) {
  * `none`) against the target model, and rewrites compound-unique selectors -
  * including custom `@@unique(name:)` names, into the core-derived selector form
  * so Turbine's `findUnique`-family expansion handles them uniformly.
+ *
+ * `depth` is incremented at exactly the two places core's `walkWhere` increments
+ * it, a combinator branch and a relation-filter descent (the wrapper body counts
+ * as its own level there, so it does here too). That is what makes the refusal
+ * land on the same clause at the same nesting whether a caller arrives through
+ * this layer or straight through core.
  */
-function translateWhere(ctx, mm, where) {
+function translateWhere(ctx, mm, where, depth = 0) {
+    assertTranslateDepth(depth, 'where');
     if (!isPlainObject(where))
         return where;
     const out = {};
     for (const [key, val] of Object.entries(where)) {
         if (COMBINATORS.has(key)) {
-            out[key] = Array.isArray(val) ? val.map((v) => translateWhere(ctx, mm, v)) : translateWhere(ctx, mm, val);
+            // An `AND` / `OR` array of N conditions is ONE level, not N: the elements
+            // are siblings, so they all translate at the same incremented depth.
+            out[key] = Array.isArray(val)
+                ? val.map((v) => translateWhere(ctx, mm, v, depth + 1))
+                : translateWhere(ctx, mm, val, depth + 1);
             continue;
         }
         // Compound-unique selector (custom or default Prisma name).
@@ -556,7 +624,7 @@ function translateWhere(ctx, mm, where) {
         const rel = mm.relations[key];
         if (rel) {
             const target = relTargetModel(ctx, mm, rel.name);
-            out[rel.name] = translateRelationFilter(ctx, target, val);
+            out[rel.name] = translateRelationFilter(ctx, target, val, depth + 1);
             continue;
         }
         // Scalar field, key renamed, value (literal or operator object) passes
@@ -565,7 +633,7 @@ function translateWhere(ctx, mm, where) {
     }
     return out;
 }
-function translateRelationFilter(ctx, target, val) {
+function translateRelationFilter(ctx, target, val, depth) {
     if (!isPlainObject(val))
         return val;
     const keys = Object.keys(val);
@@ -574,17 +642,32 @@ function translateRelationFilter(ctx, target, val) {
         const out = {};
         for (const [k, v] of Object.entries(val)) {
             out[k] =
-                target && (RELATION_QUANTIFIERS.has(k) || k === 'is' || k === 'isNot') ? translateWhere(ctx, target, v) : v;
+                target && (RELATION_QUANTIFIERS.has(k) || k === 'is' || k === 'isNot')
+                    ? translateWhere(ctx, target, v, depth + 1)
+                    : v;
         }
         return out;
     }
-    // A bare object filter on a to-one relation: translate its body.
-    return target ? translateWhere(ctx, target, val) : val;
+    // A bare object filter on a to-one relation: translate its body. Core wraps
+    // this shape in `{ is: … }` (`normalizeRelationFilter`) and charges it the
+    // same level the explicit wrapper above costs, so charge it here too.
+    return target ? translateWhere(ctx, target, val, depth + 1) : val;
 }
-/** Translate a Prisma `orderBy` (object / array) into a Turbine `orderBy`. */
-function translateOrderBy(ctx, mm, ob) {
+/**
+ * Translate a Prisma `orderBy` (object / array) into a Turbine `orderBy`.
+ *
+ * The ARRAY branch is the reason this walker has its own cap rather than relying
+ * on core's: `normalizeOrderBy` reads ONE level of array and never recurses, so
+ * core has no second line of defense here at all, and `[[[…]]]` at 2,000 (a 4 KB
+ * body) overflowed the stack. Nesting is what counts, not width: the elements of
+ * one array are siblings and all translate at the same incremented depth, so a
+ * legal `orderBy: [{ a: 'asc' }, { b: 'desc' }]` of any length is one level and
+ * only an array INSIDE an array pays for another.
+ */
+function translateOrderBy(ctx, mm, ob, depth = 0) {
+    assertTranslateDepth(depth, 'orderBy');
     if (Array.isArray(ob))
-        return ob.map((o) => translateOrderBy(ctx, mm, o));
+        return ob.map((o) => translateOrderBy(ctx, mm, o, depth + 1));
     if (!isPlainObject(ob))
         return ob;
     const out = {};
@@ -596,7 +679,8 @@ function translateOrderBy(ctx, mm, ob) {
         const rel = mm.relations[key];
         if (rel) {
             const target = relTargetModel(ctx, mm, rel.name);
-            out[rel.name] = isPlainObject(val) && !('_count' in val) && target ? translateOrderBy(ctx, target, val) : val;
+            out[rel.name] =
+                isPlainObject(val) && !('_count' in val) && target ? translateOrderBy(ctx, target, val, depth + 1) : val;
             continue;
         }
         out[renameField(mm, key)] = val;
@@ -645,8 +729,14 @@ function translateOmit(ctx, mm, omit) {
  * `select` narrows scalars and may also pull relations + `_count`. `include`
  * and `select` are mutually exclusive, and so are `select` and `omit` (a
  * narrowed projection minus fields is ambiguous; Prisma refuses the pair too).
+ *
+ * Mutually recursive with {@link translateWithOption}, one level per relation
+ * hop, and it was unbounded: a 1,000-hop `include` chain (a 45 KB body) threw
+ * `RangeError` here, before core's own depth-10 relation cap
+ * (`CircularRelationError`) could ever see the `with` clause it was building.
  */
-function translateProjection(ctx, mm, args) {
+function translateProjection(ctx, mm, args, depth = 0) {
+    assertTranslateDepth(depth, 'include');
     const include = args.include;
     const select = args.select;
     const omitArg = args.omit;
@@ -673,7 +763,7 @@ function translateProjection(ctx, mm, args) {
             if (!rel) {
                 throw new ValidationError(`[turbine] prisma-compat: unknown relation "${key}" in include on model "${modelName(ctx, mm)}".`);
             }
-            withClause[rel.name] = translateWithOption(ctx, mm, rel.name, val);
+            withClause[rel.name] = translateWithOption(ctx, mm, rel.name, val, depth + 1);
             hasWith = true;
         }
         return { omit, with: hasWith ? withClause : undefined };
@@ -691,7 +781,7 @@ function translateProjection(ctx, mm, args) {
             }
             const rel = mm.relations[key];
             if (rel) {
-                withClause[rel.name] = translateWithOption(ctx, mm, rel.name, val);
+                withClause[rel.name] = translateWithOption(ctx, mm, rel.name, val, depth + 1);
                 hasWith = true;
                 continue;
             }
@@ -825,8 +915,15 @@ function applyWriteProjection(proj, row) {
     }
     return row;
 }
-/** Translate a Prisma relation include payload into a Turbine `WithOptions`. */
-function translateWithOption(ctx, mm, turbineRel, val) {
+/**
+ * Translate a Prisma relation include payload into a Turbine `WithOptions`.
+ *
+ * `depth` is the relation hop count carried down from {@link translateProjection}
+ * and is charged to the nested `where` / `orderBy` too, so a payload that pads
+ * one arg with relation hops and then nests the other cannot spend two separate
+ * budgets to reach the same stack depth.
+ */
+function translateWithOption(ctx, mm, turbineRel, val, depth = 0) {
     if (val === true)
         return true;
     if (!isPlainObject(val))
@@ -834,16 +931,16 @@ function translateWithOption(ctx, mm, turbineRel, val) {
     const target = relTargetModel(ctx, mm, turbineRel);
     const opt = {};
     if (val.where !== undefined)
-        opt.where = target ? translateWhere(ctx, target, val.where) : val.where;
+        opt.where = target ? translateWhere(ctx, target, val.where, depth) : val.where;
     if (val.orderBy !== undefined)
-        opt.orderBy = target ? translateOrderBy(ctx, target, val.orderBy) : val.orderBy;
+        opt.orderBy = target ? translateOrderBy(ctx, target, val.orderBy, depth) : val.orderBy;
     if (val.take !== undefined)
         opt.limit = mapTake(val.take);
     if (val.skip !== undefined) {
         throw new UnsupportedFeatureError('skip (offset) on a nested relation include', 'prisma-compat', "Turbine's `with` clause has no offset, page the relation with a separate query.");
     }
     if (target && (val.select !== undefined || val.include !== undefined || val.omit !== undefined)) {
-        const proj = translateProjection(ctx, target, val);
+        const proj = translateProjection(ctx, target, val, depth);
         if (proj.select)
             opt.select = proj.select;
         // Same silent drop as the top level: a nested `omit` names the sensitive
@@ -1113,7 +1210,8 @@ const NESTED_WRITE_OPS = new Set([
  * renamed to their Turbine relation name and their nested-write payloads are
  * translated against the target model (op names match Prisma's).
  */
-function translateWriteData(ctx, mm, data) {
+function translateWriteData(ctx, mm, data, depth = 0) {
+    assertTranslateDepth(depth, 'data');
     if (!isPlainObject(data))
         return data;
     const out = {};
@@ -1121,39 +1219,50 @@ function translateWriteData(ctx, mm, data) {
         const rel = mm.relations[key];
         if (rel && isPlainObject(val) && Object.keys(val).some((k) => NESTED_WRITE_OPS.has(k))) {
             const target = relTargetModel(ctx, mm, rel.name);
-            out[rel.name] = translateNestedWrite(ctx, target, val);
+            out[rel.name] = translateNestedWrite(ctx, target, val, depth + 1);
             continue;
         }
         out[renameField(mm, key)] = val;
     }
     return out;
 }
-function translateNestedWrite(ctx, target, ops) {
+/**
+ * One relation's nested-write ops. `depth` is threaded into EVERY payload
+ * translator, the `where` ones included, so the budget is spent on total
+ * nesting rather than per-arg: a chain that alternates relation hops with
+ * combinator nesting reaches the same stack depth as either alone.
+ *
+ * Core's own nested-write engine caps at depth 10 (`nested-write.ts`), so this
+ * cap can only ever fire on a payload core was going to refuse anyway. What it
+ * changes is HOW: a typed refusal instead of a `RangeError` raised before core
+ * is reached at all (measured: a 1,000-hop `create` chain, a 43 KB body).
+ */
+function translateNestedWrite(ctx, target, ops, depth) {
     const out = {};
     for (const [op, payload] of Object.entries(ops)) {
         switch (op) {
             case 'create':
             case 'createMany':
-                out[op] = mapMaybeArray(payload, (p) => (target ? translateWriteData(ctx, target, p) : p));
+                out[op] = mapMaybeArray(payload, (p) => (target ? translateWriteData(ctx, target, p, depth + 1) : p));
                 break;
             case 'connect':
             case 'disconnect':
             case 'delete':
             case 'set':
-                out[op] = mapMaybeArray(payload, (p) => (target ? translateWhere(ctx, target, p) : p));
+                out[op] = mapMaybeArray(payload, (p) => (target ? translateWhere(ctx, target, p, depth + 1) : p));
                 break;
             case 'deleteMany':
             case 'updateMany':
-                out[op] = mapMaybeArray(payload, (p) => translateWhereDataPair(ctx, target, p));
+                out[op] = mapMaybeArray(payload, (p) => translateWhereDataPair(ctx, target, p, depth + 1));
                 break;
             case 'update':
-                out[op] = mapMaybeArray(payload, (p) => translateWhereDataPair(ctx, target, p));
+                out[op] = mapMaybeArray(payload, (p) => translateWhereDataPair(ctx, target, p, depth + 1));
                 break;
             case 'connectOrCreate':
-                out[op] = mapMaybeArray(payload, (p) => translateConnectOrCreate(ctx, target, p));
+                out[op] = mapMaybeArray(payload, (p) => translateConnectOrCreate(ctx, target, p, depth + 1));
                 break;
             case 'upsert':
-                out[op] = mapMaybeArray(payload, (p) => translateUpsertNested(ctx, target, p));
+                out[op] = mapMaybeArray(payload, (p) => translateUpsertNested(ctx, target, p, depth + 1));
                 break;
             default:
                 out[op] = payload;
@@ -1165,39 +1274,39 @@ function mapMaybeArray(val, fn) {
     return Array.isArray(val) ? val.map(fn) : fn(val);
 }
 /** A `{ where?, data }` pair (nested update/updateMany), or a bare data object. */
-function translateWhereDataPair(ctx, target, p) {
+function translateWhereDataPair(ctx, target, p, depth) {
     if (!isPlainObject(p))
         return p;
     if ('data' in p || 'where' in p) {
         const out = {};
         if (p.where !== undefined)
-            out.where = target ? translateWhere(ctx, target, p.where) : p.where;
+            out.where = target ? translateWhere(ctx, target, p.where, depth) : p.where;
         if (p.data !== undefined)
-            out.data = target ? translateWriteData(ctx, target, p.data) : p.data;
+            out.data = target ? translateWriteData(ctx, target, p.data, depth) : p.data;
         return out;
     }
-    return target ? translateWriteData(ctx, target, p) : p;
+    return target ? translateWriteData(ctx, target, p, depth) : p;
 }
-function translateConnectOrCreate(ctx, target, p) {
+function translateConnectOrCreate(ctx, target, p, depth) {
     if (!isPlainObject(p))
         return p;
     const out = {};
     if (p.where !== undefined)
-        out.where = target ? translateWhere(ctx, target, p.where) : p.where;
+        out.where = target ? translateWhere(ctx, target, p.where, depth) : p.where;
     if (p.create !== undefined)
-        out.create = target ? translateWriteData(ctx, target, p.create) : p.create;
+        out.create = target ? translateWriteData(ctx, target, p.create, depth) : p.create;
     return out;
 }
-function translateUpsertNested(ctx, target, p) {
+function translateUpsertNested(ctx, target, p, depth) {
     if (!isPlainObject(p))
         return p;
     const out = {};
     if (p.where !== undefined)
-        out.where = target ? translateWhere(ctx, target, p.where) : p.where;
+        out.where = target ? translateWhere(ctx, target, p.where, depth) : p.where;
     if (p.create !== undefined)
-        out.create = target ? translateWriteData(ctx, target, p.create) : p.create;
+        out.create = target ? translateWriteData(ctx, target, p.create, depth) : p.create;
     if (p.update !== undefined)
-        out.update = target ? translateWriteData(ctx, target, p.update) : p.update;
+        out.update = target ? translateWriteData(ctx, target, p.update, depth) : p.update;
     return out;
 }
 // --- aggregate / groupBy translation --------------------------------------
@@ -1260,13 +1369,23 @@ function renameAggBlock(mm, block, isCount) {
     }
     return out;
 }
-function renameHaving(mm, having) {
+/**
+ * Rename a groupBy `having` into turbine field names.
+ *
+ * Capped for the same reason and at the same depth as {@link translateWhere}:
+ * core caps its own HAVING walk (`assertWhereDepth(depth, 'having')` in
+ * `query/aggregates.ts`), but this rename runs first and was unbounded, so a
+ * 8,000-deep `NOT` chain (a 64 KB body) overflowed here and core's guard never
+ * ran.
+ */
+function renameHaving(mm, having, depth = 0) {
+    assertTranslateDepth(depth, 'having');
     if (!isPlainObject(having))
         return having;
     const out = {};
     for (const [key, val] of Object.entries(having)) {
         if (COMBINATORS.has(key)) {
-            out[key] = Array.isArray(val) ? val.map((v) => renameHaving(mm, v)) : renameHaving(mm, val);
+            out[key] = Array.isArray(val) ? val.map((v) => renameHaving(mm, v, depth + 1)) : renameHaving(mm, val, depth + 1);
             continue;
         }
         if (key === '_count') {

package/dist/query/aggregates.d.ts

@@ -104,7 +104,7 @@ export type HavingGroupKey = {
  * {@link HavingGroupKey}): a scalar filter is legal ONLY on a group key,
  * because a non-grouped column cannot be referenced in HAVING at all.
  */
-export declare function buildHavingClauses<T extends object>(qi: BuilderCtx, having: HavingClause<T>, params: unknown[], jsonAggExprs?: Map<string, string>, groupKeys?: Map<string, HavingGroupKey>): string[];
+export declare function buildHavingClauses<T extends object>(qi: BuilderCtx, having: HavingClause<T>, params: unknown[], jsonAggExprs?: Map<string, string>, groupKeys?: Map<string, HavingGroupKey>, depth?: number): string[];
 /**
  * Convert a single having aggregate filter into one or more parameterized SQL
  * comparisons against the given aggregate expression. A bare value is

package/dist/query/aggregates.js

@@ -10,10 +10,11 @@
  */
 import { UnsupportedFeatureError, ValidationError } from '../errors.js';
 import { snakeToCamel } from '../schema.js';
-import { isJsonPathOrderBy, isUnmatchedPlainObject, isVectorOrderBy, isWhereOperator, normalizeOrderBy, orderByEntries, } from './filters.js';
+import { dedupeColumnList, isJsonPathOrderBy, isUnmatchedPlainObject, isVectorOrderBy, isWhereOperator, normalizeOrderBy, orderByEntries, } from './filters.js';
 import { assertOrderDirection, resolveSkipGlobalFilters, resolveUnsafeFlag } from './types.js';
-import { isTemporalInfinity, ownLookup, unknownFieldMessage } from './utils.js';
+import { isTemporalInfinity, ownLookup, parseDbDate, unknownFieldMessage, warnRedundantSortTerm } from './utils.js';
 import * as whereMod from './where.js';
+import { assertWhereDepth } from './where-compile.js';
 /**
  * Enforce the PII contract on the aggregate surface. A PII-tagged
  * (`defineSchema` `pii: true`) column is excluded from every default
@@ -364,6 +365,32 @@ export function buildGroupByOrderBy(qi, orderBy, byOrderExprs, aggOrderExprs) {
         return keys.join(', ') || '(none)';
     };
     const parts = [];
+    // Redundant-sort-term dropping, groupBy's spelling of it (see
+    // `dedupeOrderEntries` in filters.ts for why this drops rather than refuses).
+    // The findMany rule compares the RESOLVED COLUMN because its keys are field
+    // names; here the keys are RESULT keys (by-fields, JSON group-key aliases,
+    // aggregate blocks) that have already been resolved into the exact SELECT
+    // expression they re-emit, so the expression IS the identity, and comparing
+    // it is both cheaper and stricter: an alias and a JSON group key that extract
+    // the same path collapse onto one term, which is what "sorts by the same
+    // thing" means. Direction is excluded for the same reason as in filters.ts: a
+    // second term on an expression the first already ordered by cannot move a row
+    // whichever way it points.
+    //
+    // Done in place rather than up front because groupBy does not go through the
+    // SQL-template cache at all, so there is no fingerprint for this to stay in
+    // step with; the compile path is the only path.
+    const seen = new Map();
+    const pushOrderTerm = (expr, label, value) => {
+        const first = seen.get(expr);
+        if (first !== undefined) {
+            warnRedundantSortTerm(qi.table, 'groupBy orderBy', [{ key: label, first, resolved: expr }]);
+            return;
+        }
+        seen.set(expr, label);
+        const { dir, nulls } = normalizeOrderBy(value);
+        parts.push(`${expr} ${dir}${qi.nullsSuffix(nulls)}`);
+    };
     for (const [key, value] of orderByEntries(orderBy)) {
         if (value === undefined)
             continue;
@@ -378,8 +405,7 @@ export function buildGroupByOrderBy(qi, orderBy, byOrderExprs, aggOrderExprs) {
                 // Refuse a direction that is neither asc nor desc BEFORE normalizeOrderBy,
                 // whose `=== 'desc' ? DESC : ASC` would silently sort ascending.
                 assertOrderDirection(value, `groupBy orderBy "_count" on table "${qi.table}"`);
-                const { dir, nulls } = normalizeOrderBy(value);
-                parts.push(`${expr} ${dir}${qi.nullsSuffix(nulls)}`);
+                pushOrderTerm(expr, '_count', value);
                 continue;
             }
             // `_sum` / `_avg` / `_min` / `_max`: an object of field → direction/spec.
@@ -396,8 +422,7 @@ export function buildGroupByOrderBy(qi, orderBy, byOrderExprs, aggOrderExprs) {
                         `that aggregate is not requested in this call. Orderable keys: ${validKeys()}.`);
                 }
                 assertOrderDirection(dirSpec, `groupBy orderBy "${key}.${field}" on table "${qi.table}"`);
-                const { dir, nulls } = normalizeOrderBy(dirSpec);
-                parts.push(`${expr} ${dir}${qi.nullsSuffix(nulls)}`);
+                pushOrderTerm(expr, `${key}.${field}`, dirSpec);
             }
             continue;
         }
@@ -408,8 +433,7 @@ export function buildGroupByOrderBy(qi, orderBy, byOrderExprs, aggOrderExprs) {
                 `Orderable keys: ${validKeys()}.`);
         }
         assertOrderDirection(value, `groupBy orderBy "${key}" on table "${qi.table}"`);
-        const { dir, nulls } = normalizeOrderBy(value);
-        parts.push(`${expr} ${dir}${qi.nullsSuffix(nulls)}`);
+        pushOrderTerm(expr, key, value);
     }
     return parts.join(', ');
 }
@@ -462,7 +486,14 @@ export function buildDistinctOnSource(qi, distinctOn, whereSql, params) {
         throw new ValidationError(`[turbine] groupBy distinctOn on table "${qi.table}" requires \`orderBy\` to pick ONE row per ` +
             "column combination deterministically (e.g. orderBy: { createdAt: 'desc' }).");
     }
-    const distinctCols = distinctOn.columns.map((c) => qi.q(qi.toColumn(c)));
+    // A repeated DISTINCT ON column is a no-op, so drop it rather than emit it
+    // twice (see `dedupeColumnList`). The orderBy below needs no equivalent: its
+    // keys come from an object, and the DISTINCT ON columns lead the ORDER BY, so
+    // a key repeating one of them is already merged by `orderParts`' construction.
+    const dedupedCols = dedupeColumnList(qi.tableMeta, distinctOn.columns);
+    if (dedupedCols)
+        warnRedundantSortTerm(qi.table, 'groupBy distinctOn.columns', dedupedCols.dropped);
+    const distinctCols = (dedupedCols?.columns ?? distinctOn.columns).map((c) => qi.q(qi.toColumn(c)));
     // DISTINCT ON expressions must lead the ORDER BY; the user's orderBy then
     // decides which row survives per combination.
     const orderParts = [...distinctCols];
@@ -521,7 +552,8 @@ const HAVING_AGGREGATE_FNS = {
  * {@link HavingGroupKey}): a scalar filter is legal ONLY on a group key,
  * because a non-grouped column cannot be referenced in HAVING at all.
  */
-export function buildHavingClauses(qi, having, params, jsonAggExprs, groupKeys) {
+export function buildHavingClauses(qi, having, params, jsonAggExprs, groupKeys, depth = 0) {
+    assertWhereDepth(depth, 'having');
     const clauses = [];
     for (const [key, value] of Object.entries(having)) {
         if (value === undefined)
@@ -533,7 +565,7 @@ export function buildHavingClauses(qi, having, params, jsonAggExprs, groupKeys)
         }
         // AND / OR / NOT, mixing scalar and aggregate predicates at any depth.
         if (key === 'AND' || key === 'OR' || key === 'NOT') {
-            clauses.push(...buildHavingCombinator(qi, key, value, params, jsonAggExprs, groupKeys));
+            clauses.push(...buildHavingCombinator(qi, key, value, params, jsonAggExprs, groupKeys, depth));
             continue;
         }
         // Otherwise `key` is a field name. Split its aggregate keys from its
@@ -603,15 +635,28 @@ function splitHavingField(qi, field, value) {
  * (the caller ANDs them), mirroring {@link buildWhereClause}'s combinator
  * shapes so HAVING and WHERE read the same way.
  */
-function buildHavingCombinator(qi, key, value, params, jsonAggExprs, groupKeys) {
+function buildHavingCombinator(qi, key, value, params, jsonAggExprs, groupKeys, depth = 0) {
     const conditions = Array.isArray(value) ? value : [value];
+    // Same variable-arity shape as the WHERE combinators: an ARRAY branch writes
+    // one parenthesized condition per element into the SQL text, so a
+    // caller-sized `having.OR` is a new statement per length.
+    //
+    // DEFENSIVE, not load-bearing, today: `buildGroupBy` and `buildAggregate`
+    // assemble their SQL directly and never go through `acquireSql`, so they
+    // carry no prepared-statement name for the mark to clear (asserted in
+    // prepared-statement-arity.test.ts). It is marked anyway so that routing
+    // them through the cache later cannot silently reopen the hole, and so the
+    // rule reads the same in both clause compilers. The DEPTH cap above is the
+    // half of this that bites here and now.
+    if (Array.isArray(value) && key !== 'NOT')
+        qi.markVariableArity();
     const parts = [];
     for (const condition of conditions) {
         if (!isUnmatchedPlainObject(condition)) {
             throw new ValidationError(`[turbine] Invalid having "${key}" on table "${qi.table}": expected ` +
                 `${key === 'OR' ? 'an array of having objects' : 'a having object (or an array of them)'}.`);
         }
-        const sub = buildHavingClauses(qi, condition, params, jsonAggExprs, groupKeys);
+        const sub = buildHavingClauses(qi, condition, params, jsonAggExprs, groupKeys, depth + 1);
         if (sub.length === 0)
             continue;
         parts.push(sub.length === 1 ? sub[0] : `(${sub.join(' AND ')})`);
@@ -763,13 +808,30 @@ export function buildHavingNumericClauses(qi, expr, filter, params) {
 function temporalAggValue(qi, col, value) {
     if (!qi.tableMeta.dateColumns.has(col))
         return value;
-    if (!isTemporalInfinity(value))
-        return value;
-    if (qi.temporalInfinity === 'null')
-        return null;
-    if (typeof value === 'number')
-        return value;
-    return value === '-infinity' ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY;
+    if (isTemporalInfinity(value)) {
+        if (qi.temporalInfinity === 'null')
+            return null;
+        if (typeof value === 'number')
+            return value;
+        return value === '-infinity' ? Number.NEGATIVE_INFINITY : Number.POSITIVE_INFINITY;
+    }
+    // A STRING on a temporal column means the driver handed the value back
+    // untyped, which is what every engine without pg's OID-keyed type parsers
+    // does. Verified on SQLite: `findMany` returned a `Date` for `at` and
+    // `groupBy` returned a `Date` for the same column used as a group key, while
+    // `aggregate({ _max: { at: true } })` returned the raw string
+    // '2024-01-15 12:00:00', so ONE column disagreed with itself across three
+    // read paths and with the `Date` the generated types promise. `_min`/`_max`
+    // are assembled from the RAW row here (they cannot go through `parseRow`,
+    // whose snake→camel mapping would collide with the `_min_` alias), so the
+    // coercion `parseRow` applies has to be applied here as well, on the same
+    // terms: offset-less text is pinned to UTC unless `utcTimestamps: false`.
+    //
+    // On PostgreSQL this branch is unreachable and the emitted values are
+    // unchanged: the driver's date/timestamp parsers already produce a `Date`.
+    if (typeof value === 'string')
+        return qi.utcTimestamps !== false ? parseDbDate(value) : new Date(value);
+    return value;
 }
 export function buildAggregate(qi, args) {
     qi.currentSkip = resolveSkipGlobalFilters(args.skipGlobalFilters);

package/dist/query/batched-loader.d.ts

@@ -54,6 +54,7 @@
  * @module
  */
 import type pg from 'pg';
+import type { PartitionLimitInput } from '../dialect.js';
 import { type RelationDef, type SchemaMetadata, type TableMetadata } from '../schema.js';
 import type { ReselectExecutor } from './builder.js';
 import type { SkipGlobalFilters, Unsafe, WithClause, WithCount } from './types.js';
@@ -123,6 +124,15 @@ export interface RelationLoadContext {
         clause: string;
         params: unknown[];
     } | null;
+    /**
+     * The active dialect's {@link Dialect.buildPartitionLimit}, when it has one.
+     * Absent means this engine cannot bound the follow-up per correlation key, so
+     * the loader falls back to fetching every child and slicing client-side. The
+     * same fallback runs, on every engine, for a relation whose ordering does not
+     * force which rows the limit keeps. See {@link partitionOrderBy} and
+     * {@link boundedChildQuery}.
+     */
+    buildPartitionLimit?: (input: PartitionLimitInput) => string;
 }
 /**
  * The default projection of `meta` expressed in FIELD names: which fields the