fix(session-query): preserve typed query failures (round 5)

packages/session-query/session-query-sqlite/README.md

@@ -4,7 +4,7 @@ SQLite FTS5 implementation of `ctx.sessionSearch`. The service searches the live
 
 ## Search contract
 
-`searchSessions(request, exec?)` returns `SessionSearchHit` pages across the corpus; `searchEvents(request, exec?)` returns `SessionEventSearchHit` pages within one session. Queries are required, trimmed, whitespace-normalized literal phrases. FTS5 syntax such as quotes, `OR`, `NEAR`, and `*` is treated as data rather than executable MATCH syntax. Metadata filters are parameterized SQL predicates applied before ranking.
+`searchSessions(request, exec?)` returns `SessionSearchHit` pages across the corpus; `searchEvents(request, exec?)` returns `SessionEventSearchHit` pages within one session. Queries are required, trimmed, whitespace-normalized literal phrases. FTS5 syntax such as quotes, `OR`, `NEAR`, and `*` is treated as data rather than executable MATCH syntax. Metadata filters are parameterized SQL predicates applied before ranking. A request exceeding SQLite's portable limit of 32,766 total bindings, including fixed query and pagination values, fails with `SESSION_QUERY_INVALID_FILTER` before statement preparation.
 
 Relevance is source-comparable across persistent and TEMP tables: actual FTS5 highlighted-match span count descending, then stored document code-point length ascending. Event time, session id where applicable, and seq break remaining ties. Cross-session results expose the selected event as `bestMatch`; both scopes derive whitespace-normalized plain text from FTS5 highlight positions and bound it in Unicode code points. Cursors are opaque branded values, bind to the normalized request and service instance, and fail when the relevant generation changes. A within-session cursor survives unrelated-session changes; a cross-session cursor does not.
 

packages/session-query/session-query-sqlite/src/index.ts

@@ -559,6 +559,14 @@ export class SessionSearchSqlite extends SessionSearchService {
     const sessionWhere = buildSessionWhere(request.sessionFilters)
     const eventWhere = buildEventWhere(request.eventFilters)
     const where = [sessionWhere.sql, eventWhere.sql].filter(Boolean).join(' AND ')
+    const bindings = [
+      ...selectedDocumentsParams(request.query, persistenceBinding.service !== undefined),
+      ...sessionWhere.params,
+      ...eventWhere.params,
+      request.limit + 1,
+      offset,
+    ]
+    assertPortableBindingCount(bindings)
     return this._requireDb().prepare(`
       ${selected.sql},
       filtered AS (
@@ -575,13 +583,7 @@ export class SessionSearchSqlite extends SessionSearchService {
       WHERE event_rank = 1
       ORDER BY match_count DESC, document_length ASC, time DESC, session_id ASC, seq DESC
       LIMIT ? OFFSET ?
-    `).all(
-      ...selectedDocumentsParams(request.query, persistenceBinding.service !== undefined),
-      ...sessionWhere.params,
-      ...eventWhere.params,
-      request.limit + 1,
-      offset,
-    ) as unknown as SearchRow[]
+    `).all(...bindings) as unknown as SearchRow[]
   }
 
   private _queryEvents(
@@ -592,19 +594,21 @@ export class SessionSearchSqlite extends SessionSearchService {
     const selected = selectedDocumentsSql()
     const eventWhere = buildEventWhere(request.filters)
     const where = ['session_id = ?', eventWhere.sql].filter(Boolean).join(' AND ')
+    const bindings = [
+      ...selectedDocumentsParams(request.query, persistenceBinding.service !== undefined),
+      request.sessionId,
+      ...eventWhere.params,
+      request.limit + 1,
+      offset,
+    ]
+    assertPortableBindingCount(bindings)
     return this._requireDb().prepare(`
       ${selected.sql}
       SELECT * FROM matched
       WHERE ${where}
       ORDER BY match_count DESC, document_length ASC, time DESC, seq DESC
       LIMIT ? OFFSET ?
-    `).all(
-      ...selectedDocumentsParams(request.query, persistenceBinding.service !== undefined),
-      request.sessionId,
-      ...eventWhere.params,
-      request.limit + 1,
-      offset,
-    ) as unknown as SearchRow[]
+    `).all(...bindings) as unknown as SearchRow[]
   }
 
   private _targetGeneration(sessionId: SessionId, persistenceBinding: PersistenceBinding): string {
@@ -728,6 +732,19 @@ function selectedDocumentsParams(query: string, persistenceVisible: boolean): Ar
   ]
 }
 
+// SQLite builds may raise this ceiling; supported modern versions share 32,766
+// as the portable host-parameter limit.
+const SQLITE_PORTABLE_VARIABLE_LIMIT = 32_766
+
+function assertPortableBindingCount(bindings: readonly (string | number)[]): void {
+  if (bindings.length > SQLITE_PORTABLE_VARIABLE_LIMIT) {
+    throw new SessionQueryError(
+      `session-search request requires ${bindings.length} SQLite bindings; reduce filters to stay within the portable ${SQLITE_PORTABLE_VARIABLE_LIMIT}-variable limit`,
+      'SESSION_QUERY_INVALID_FILTER',
+    )
+  }
+}
+
 function observeLive(session: Session): ObservedSession {
   return observeSession(session.header, session.events)
 }
@@ -834,7 +851,7 @@ function decodeCursor(
     || decoded.instance !== instance
     || decoded.scope !== scope
     || decoded.fingerprint !== fingerprint
-    || !Number.isInteger(decoded.offset)
+    || !Number.isSafeInteger(decoded.offset)
     || decoded.offset === undefined
     || decoded.offset < 0
   ) {

packages/session-query/session-query-sqlite/tests/sqlite.spec.ts

@@ -53,6 +53,16 @@ function expectCode(code: SessionQueryErrorCode): Error {
   return expect.objectContaining({ code }) as Error
 }
 
+function replaceCursorOffset(
+  cursor: ReturnType<typeof SessionSearchCursor>,
+  offset: number,
+): ReturnType<typeof SessionSearchCursor> {
+  const payload = JSON.parse(
+    Buffer.from(cursor, 'base64url').toString('utf8'),
+  ) as Record<string, unknown>
+  return SessionSearchCursor(Buffer.from(JSON.stringify({ ...payload, offset }), 'utf8').toString('base64url'))
+}
+
 class TestPersistence extends SessionPersistence {
   static entries = new Map<SessionIdType, { meta: SessionHeader; events: SessionEvent[] }>()
   static revisions = new Map<SessionIdType, number>()
@@ -276,6 +286,14 @@ describe('SQLite session search', () => {
     expect(sessionPage.nextCursor).toEqual(expect.any(String))
     if (eventPage.nextCursor === undefined || sessionPage.nextCursor === undefined) throw new Error('expected cursors')
 
+    const unsafeOffsetCursor = replaceCursorOffset(eventPage.nextCursor, 1e100)
+    await expect(ctx.sessionSearch.searchEvents({
+      sessionId: target.id,
+      query: 'needle',
+      limit: 1,
+      cursor: unsafeOffsetCursor,
+    })).rejects.toThrow(expectCode('SESSION_QUERY_INVALID_CURSOR'))
+
     const eventKeys = eventPage.items.map(item => `${item.sessionId}:${item.seq}`)
     let eventCursor: ReturnType<typeof SessionSearchCursor> | undefined = eventPage.nextCursor
     while (eventCursor !== undefined) {
@@ -399,6 +417,34 @@ describe('SQLite session search', () => {
         .toThrow(expectCode('SESSION_QUERY_INVALID_CONFIG'))
     }
   })
+
+  it('rejects aggregate filter bindings above SQLite\'s portable variable limit', async () => {
+    const ctx = await liveContext()
+    const session = ctx.sessions.create(SessionId('binding-limit'), { seed: messageEvents('needle') })
+    // Each clause is below the ceiling; combined with its sibling and fixed
+    // query bindings, the complete statement is not portable.
+    const halfPortableLimit = 16_383
+    const ids = Array.from(
+      { length: halfPortableLimit },
+      (_, index) => SessionId(`binding-${index}`),
+    )
+    const types = Array.from({ length: halfPortableLimit }, () => 'user/message' as const)
+    const surfaces = Array.from({ length: halfPortableLimit }, () => 'current' as const)
+
+    await expect(ctx.sessionSearch.searchSessions({
+      query: 'needle',
+      sessionFilters: [{ kind: 'id', values: ids }],
+      eventFilters: [{ kind: 'type', values: types }],
+    })).rejects.toThrow(expectCode('SESSION_QUERY_INVALID_FILTER'))
+    await expect(ctx.sessionSearch.searchEvents({
+      sessionId: session.id,
+      query: 'needle',
+      filters: [
+        { kind: 'type', values: types },
+        { kind: 'surface', values: surfaces },
+      ],
+    })).rejects.toThrow(expectCode('SESSION_QUERY_INVALID_FILTER'))
+  })
 })
 
 describe('SQLite reconciliation and source lifecycle', () => {