[cuibonobo]

Summary

Closes #462.

Durable Object SQLite limits a statement to 100 bound parameters and 100 KB of SQL text. The shared declaration promises contentByType and contentFieldByType at 64 keys, but each arm and entry bound its own parameters and text, so a query within the cap failed on DO. So did a plain filter.content with a few deep paths, which no cap bounds.

This PR doesn't give DO lower caps. Instead, every SQLite engine follows one rule: a statement's text and bound parameters never grow with how many entries a query's keys hold. One primitive implements it: rows(), a JSON array of tuples. Each one is registered on the statement as a named, materialized table, so it binds first and its JSON is parsed once per statement. The batched element read in record-logic.ts uses the same table shape (rowsTable()).

• Lists are rows of one column. A one-value list still binds as = ?, so an index keeps yielding rows in order. This is the rule's one carve-out, and the spec states it.
• Permission sets are rows of elements, each naming its set and that set's size.
• contentFieldByType is two tables: Types ordered by a field, and Types ordered by a constant.
• Content conditions are one table. It covers filter.content, filter.contentPresent and every contentByType arm. Each row holds a path, an op (equals / present / isNull), a value with its JSON kind, and the Type it applies to (none for filter.content). A record matches when every row that applies to it holds. One recursive walk per row, holds(c, r), matches a segment per step and collects everything the op needs.

Per-Type shapes are flags. With the statement limits gone, nothing justified a count, and nothing else a query carries is counted:

• filter.contentByType and sort.contentFieldByType are now booleans, like filter.contentPresent. A server bounds the cost of an n-arm query by its query deadline, the same way it bounds n content keys.
• A collection facing false queries its handle's version alone and reports skipped, as it did at a cap of 0. Partial narrowing (k of n versions) is gone.
• What needs the POST /records/query body (contentPresent and both per-Type flags) is false beside filter.content: 'none', because a server reaching no content doesn't serve that endpoint. This depends on the endpoint, not on filtering: sort.contentField travels as a query parameter, so it doesn't depend on it. It is established where capabilities enter: the conformance suite checks local adapters' declarations, and normalizeCapabilities() applies it to discovery responses, now including contentPresent.

The path cap is MAX_VALIDATION_DEPTH + 1 (33). A top-level field sits at depth 0, so 33 segments reach the deepest value a write accepts.

Matching follows matchesContent() in core, which is the reference reading:

• A value matches only a value of its own JSON type, as === does. Booleans now keep their type through the walk. On main, a filter for 1 matched a stored true.
• A path reaching a null beside a value satisfies both isNull and present.

Spec

• New docs/spec/adapters.md § Statement size holds the rule. § Querying within a reach points to it.
• § Adapter capabilities: the per-Type entries are flags that hold any number of keys, and a server bounds their cost like everything else. What needs the query body is false below 'none', enforced where capabilities enter.
• docs/spec/data-model.md:
  • § Content queries across versions: a false flag gets the handle-only query.
  • § Content by type and § Capability-gated filters: the shape is gated, not counted.
  • § Nested content paths: the cap is 33 segments, derived from the nesting cap.
  • § Filter: a value matches only its own JSON type, and an object or array filter value never matches.
• docs/spec/wire-format.md: the discovery example uses true, a server declaring false refuses with 400, and § Bounding query cost covers per-Type arms.
• The discovery fixtures use booleans.
• I trimmed fix(core): scope every gate by one reach per verb, and queries inside the adapter #461's pending changeset, which said per-Type arms "stay bounded by the declared caps".

Verification

• pnpm run format:check, check:refs, lint, test, build and typecheck all pass.
• New conformance tests apply to every adapter:
  • A multi-valued path satisfies both contentPresent and a null filter.
  • A filter value matches only its own JSON type (true, 1, '1').
  • Both failed on SQLite before the fixes.
  • Everything that needs the query body is false below 'none', checked in one test.
• New workerd tests send contentByType and contentFieldByType queries with 200 keys, and a content filter far past both DO limits. All three failed on main.
• A Stack test writes content nested to the deepest accepted level and matches it with a 33-segment path. Content one level deeper is refused at write, and a 34-segment path is refused at query.
• wire-types tests: a per-Type flag reads true only when stated true, and every query-body flag reads false beside 'none'.
• I checked EXPLAIN QUERY PLAN by hand:
  • idx_content_index_sort, idx_records_type_id and idx_permissions_element still drive their queries.
  • The by-Type sort's absent partition materializes its table once, and looks up content_index by (record_id, field).

Notes for reviewers

• Cost: a content filter that scans the whole table is about 2.5× slower for equals and present (132 ms → ~300 ms on 50k records, node SQLite). Paged queries are unaffected. Walking once per condition made isNull 1.4–2× faster than walking twice. This was accepted in exchange for the single shape; the alternatives were a per-engine segment budget, or a second, faster matching path to keep in sync with the first.

🤖 Generated with Claude Code

https://claude.ai/code/session_01Mf3p8BVtrQJLZx1JFCHchC

[changeset-bot]

🦋 Changeset detected

Latest commit: 1c8b178

The changes in this PR will be included in the next version bump.

This PR includes changesets to release 11 packages

Name	Type
@haverstack/record-adapter-do-sqlite	Minor
@haverstack/record-adapter-sqlite	Minor
@haverstack/adapter-conformance	Minor
@haverstack/core	Minor
@haverstack/wire-types	Minor
@haverstack/conformance-fixtures	Minor
@haverstack/adapter-local	Minor
@haverstack/blob-adapter-disk	Patch
@haverstack/adapter-api	Patch
@haverstack/blob-adapter-s3	Patch
@haverstack/commons	Patch

Not sure what this means? Click here to learn what changesets are.

Click here if you're a maintainer who wants to add another changeset to this PR