perf(database): skip numeric rewrites inside quoted SQL

Remove quoted values before number replacement so discarded digits do not
create intermediate strings. Outside numeric word boundaries stay unchanged.

Bun 1.4.1 focused medians in ns/op: short literal 681 to 502, long numeric
literal 12052 to 1339, prepared-query control 502 to 511. These are developer
laptop measurements, not an HTTP throughput claim.

Verified 337715 generated normalization cases, 1816 tests, framework types,
and lint. HTTP validation returned 367633 successful requests with matching
persisted query logs. Added quote-boundary cases and a persistence assertion
containing digits inside a quoted value.

Author: chrisbbreuer

storage/framework/core/database/src/query-parser.ts

@@ -133,14 +133,15 @@ export function normalizeQuery(sql: string): string {
   try {
     let normalizedSql = sql
 
+    // Remove quoted values before scanning numbers so their discarded digits
+    // are never rewritten. Quote boundaries and ? are both non-word characters.
+    normalizedSql = normalizedSql.replace(/'[^']*(?:''[^']*)*'/g, '?')
+    normalizedSql = normalizedSql.replace(/"[^"]*(?:""[^"]*)*"/g, '?')
+
     // Word boundaries already exclude adjacent ASCII letters and underscores,
     // keeping digits in identifiers intact without redundant lookarounds.
     normalizedSql = normalizedSql.replace(/\b\d+\b/g, '?')
 
-    // Replace string literals with ?
-    normalizedSql = normalizedSql.replace(/'[^']*(?:''[^']*)*'/g, '?')
-    normalizedSql = normalizedSql.replace(/"[^"]*(?:""[^"]*)*"/g, '?')
-
     // Replace boolean and NULL literals in one pass.
     normalizedSql = normalizedSql.replace(/\b(?:true|false|null)\b/gi, '?')
 

storage/framework/core/database/tests/fixtures/query-logger-dispatch.ts

@@ -106,7 +106,7 @@ try {
     await queryWithDiagnostics('query_logger_after_failed_store')
 
     const { logQuery } = await import('../../src/query-logger')
-    const literalQuery = "SELECT 42 AS total, 'Ada' AS name, TRUE AS active, NULL AS missing FROM query_logger_fixture"
+    const literalQuery = "SELECT 42 AS total, 'Ada 123' AS name, TRUE AS active, NULL AS missing FROM query_logger_fixture"
     await logQuery({ query: { sql: literalQuery }, queryDurationMillis: 1 })
     const normalized = await db.unsafe('SELECT normalized_query FROM query_logs WHERE query = ?', [literalQuery]).execute()
     if (normalized.length !== 1 || normalized[0]?.normalized_query !== 'SELECT ? AS total, ? AS name, ? AS active, ? AS missing FROM query_logger_fixture')

storage/framework/core/database/tests/query-normalization.test.ts

@@ -3,6 +3,11 @@ import { normalizeQuery, parseQuery } from '../src/query-parser'
 
 describe('query normalization', () => {
   it.each([
+    ["SELECT '123'456, \"789\"10, a'12'34, _\"56\"78", 'SELECT ??, ??, a??, _??'],
+    ["SELECT '12'x34, \"56\"_78, a12'34', _56\"78\"", 'SELECT ?x34, ?_78, a12?, _56?'],
+    ["SELECT '12''34, \"56\"\"78", "SELECT ?'?, ?\"?"],
+    ["SELECT '12\"34', \"56'78\", -90, 1.23", 'SELECT ?, ?, -?, ?.?'],
+    [`INSERT INTO items (payload) VALUES ('${'1 22 333 4444 '.repeat(128)}')`, 'INSERT INTO items (payload) VALUES (?)'],
     ["SELECT 'it''s', \"a\"\"b\", '', \"\"", 'SELECT ?, ?, ?, ?'],
     ["SELECT 'unterminated", "SELECT 'unterminated"],
     ['SELECT "unterminated', 'SELECT "unterminated'],