feat(webapp,database): bound the arity of Prisma list filters

Prisma expands a list filter into one bind parameter per element, so every
distinct list length is a separate prepared statement. Where the length tracks
data volume, a single call site can mint hundreds of them. Those entries are
used once each, but inserting them evicts entries that were being reused, so
the cost lands on unrelated queries sharing the pooler's statement cache. An
unbounded list also risks the 65535 bind-parameter ceiling.

Adds boundedIn(), which pads a filter list to the next power of two by
repeating its last element. IN and NOT IN ignore duplicates, so results are
unchanged, and a call site drops from one statement per length to at most
log2(cap). It pads by repeating rather than with null because x NOT IN (a, b,
NULL) is never true. Lists above 32768 are returned unchanged so padding can
never push a query past the parameter limit.

Two oxlint rules require it: a list filter must be an inline array literal or a
boundedIn() call. The first covers filters reached through where/having/cursor
and deliberately never descends into data, create, update, set or equals, where
a key named "in" is user data rather than a predicate. The second covers bare
filter objects passed to where-building helpers, which the first cannot see.

Applies the helper to all 74 existing call sites.

Author: ericallam

.oxlintrc.json

@@ -1,9 +1,14 @@
 {
   "$schema": "./node_modules/oxlint/configuration_schema.json",
-  "plugins": ["typescript", "import", "react"],
+  "plugins": [
+    "typescript",
+    "import",
+    "react"
+  ],
   "jsPlugins": [
     "./oxlint-plugins/no-thrown-unawaited-redirect.mjs",
-    "./oxlint-plugins/runops-residency.mjs"
+    "./oxlint-plugins/runops-residency.mjs",
+    "./oxlint-plugins/prisma-in-filter.mjs"
   ],
   "ignorePatterns": [
     "**/dist/**",
@@ -30,28 +35,55 @@
     "no-empty-pattern": "off",
     "no-control-regex": "off",
     "typescript/no-non-null-asserted-optional-chain": "off",
-    "no-unused-expressions": ["warn", { "allowShortCircuit": true, "allowTernary": true }],
+    "no-unused-expressions": [
+      "warn",
+      {
+        "allowShortCircuit": true,
+        "allowTernary": true
+      }
+    ],
     "typescript/consistent-type-imports": "error",
     "import/no-duplicates": "error",
     "import/namespace": "off",
     "react-hooks/exhaustive-deps": "off",
     "react-hooks/rules-of-hooks": "off",
-    "trigger/no-thrown-unawaited-redirect": "error"
+    "trigger/no-thrown-unawaited-redirect": "error",
+    "trigger-prisma/no-unbounded-list-filter": "error",
+    "trigger-prisma/no-unbounded-list-filter-in-args-helper": "error"
   },
   "overrides": [
     {
-      "files": ["apps/webapp/app/**/*.ts", "apps/webapp/app/**/*.tsx"],
+      "files": [
+        "apps/webapp/app/**/*.ts",
+        "apps/webapp/app/**/*.tsx"
+      ],
       "rules": {
         "trigger-runops/no-control-plane-run-graph-access": "error",
         "trigger-runops/no-control-plane-in-runops-slot": "error"
       }
     },
     {
-      "files": ["apps/webapp/app/**/*.test.ts", "apps/webapp/app/**/*.test.tsx"],
+      "files": [
+        "apps/webapp/app/**/*.test.ts",
+        "apps/webapp/app/**/*.test.tsx"
+      ],
       "rules": {
         "trigger-runops/no-control-plane-run-graph-access": "off",
         "trigger-runops/no-control-plane-in-runops-slot": "off"
       }
+    },
+    {
+      "files": [
+        "**/*.test.ts",
+        "**/*.test.tsx",
+        "**/test/**",
+        "**/tests/**",
+        "**/e2e/**"
+      ],
+      "rules": {
+        "trigger-prisma/no-unbounded-list-filter": "off",
+        "trigger-prisma/no-unbounded-list-filter-in-args-helper": "off"
+      }
     }
   ]
 }

apps/webapp/app/models/vercelIntegration.server.ts

@@ -24,6 +24,7 @@ import {
 } from "~/v3/vercel/vercelProjectIntegrationSchema";
 import { EnvironmentVariablesRepository } from "~/v3/environmentVariables/environmentVariablesRepository.server";
 import { isReservedForExternalSync } from "~/v3/environmentVariableRules.server";
+import { boundedIn } from "@trigger.dev/database";
 import {
   callVercelWithRecovery,
   wrapVercelCallWithRecovery,
@@ -1415,7 +1416,7 @@ export class VercelIntegrationRepository {
                     variable: {
                       projectId: params.projectId,
                       key: {
-                        in: varsToSync.map((v) => v.key),
+                        in: boundedIn(varsToSync.map((v) => v.key)),
                       },
                     },
                   },

apps/webapp/app/presenters/v3/ApiBatchResultsPresenter.server.ts

@@ -12,6 +12,7 @@ import type { AuthenticatedEnvironment } from "~/services/apiAuth.server";
 import { runStore as defaultRunStore } from "~/v3/runStore.server";
 import { BasePresenter } from "./basePresenter.server";
 
+import { boundedIn } from "@trigger.dev/database";
 /**
  * Run-ops read-through wiring. All optional; absent (or `splitEnabled` falsy) collapses `call` to
  * passthrough. `legacyReplica` is a READ REPLICA handle only — there is NO legacy-primary field.
@@ -114,7 +115,7 @@ export class ApiBatchResultsPresenter extends BasePresenter {
 
     const taskRuns = await this.runStore.findRuns(
       {
-        where: { id: { in: taskRunIds } },
+        where: { id: { in: boundedIn(taskRunIds) } },
         select: memberRunSelect,
       },
       this._prisma
@@ -181,7 +182,7 @@ export class ApiBatchResultsPresenter extends BasePresenter {
     const taskRunIds = batchRun.items.map((item) => item.taskRunId);
 
     const newRows = (await newClient.taskRun.findMany({
-      where: { id: { in: taskRunIds } },
+      where: { id: { in: boundedIn(taskRunIds) } },
       select: memberRunSelect,
     })) as TaskRunWithAttempts[];
     const runsById = new Map(newRows.map((run) => [run.id, run]));
@@ -193,7 +194,7 @@ export class ApiBatchResultsPresenter extends BasePresenter {
     );
     if (legacyCandidateIds.length > 0) {
       const legacyRows = (await legacyReplica.taskRun.findMany({
-        where: { id: { in: legacyCandidateIds } },
+        where: { id: { in: boundedIn(legacyCandidateIds) } },
         select: memberRunSelect,
       })) as TaskRunWithAttempts[];
       for (const run of legacyRows) {

apps/webapp/app/presenters/v3/ApiRunListPresenter.server.ts

@@ -1,5 +1,10 @@
 import { MachinePresetName, parsePacket, RunStatus } from "@trigger.dev/core/v3";
-import { type Project, type RuntimeEnvironment, type TaskRunStatus } from "@trigger.dev/database";
+import {
+  type Project,
+  type RuntimeEnvironment,
+  type TaskRunStatus,
+  boundedIn,
+} from "@trigger.dev/database";
 import assertNever from "assert-never";
 import { z } from "zod";
 import type { API_VERSIONS } from "~/api/versions";
@@ -208,7 +213,7 @@ export class ApiRunListPresenter extends BasePresenter {
             where: {
               projectId: project.id,
               slug: {
-                in: searchParams["filter[env]"],
+                in: boundedIn(searchParams["filter[env]"]),
               },
             },
           });

apps/webapp/app/presenters/v3/EnvironmentVariablesPresenter.server.ts

@@ -8,6 +8,7 @@ import type { SyncEnvVarsMapping, EnvSlug } from "~/v3/vercel/vercelProjectInteg
 import { VercelIntegrationService } from "~/services/vercelIntegration.server";
 import { loadEnvironmentVariablesEnvironments } from "./environmentVariablesEnvironments.server";
 
+import { boundedIn } from "@trigger.dev/database";
 type Result = Awaited<ReturnType<EnvironmentVariablesPresenter["call"]>>;
 export type EnvironmentVariableWithSetValues = Result["environmentVariables"][number];
 
@@ -72,7 +73,7 @@ export class EnvironmentVariablesPresenter {
           },
           where: {
             environmentId: {
-              in: environmentIds,
+              in: boundedIn(environmentIds),
             },
           },
         },
@@ -103,7 +104,7 @@ export class EnvironmentVariablesPresenter {
         ? await this.#replicaClient.user.findMany({
             where: {
               id: {
-                in: Array.from(userIds),
+                in: boundedIn(Array.from(userIds)),
               },
             },
             select: {

apps/webapp/app/presenters/v3/ErrorsListPresenter.server.ts

@@ -9,7 +9,11 @@ const errorsListGranularity = new TimeGranularity([
   { max: "3 months", granularity: "1w" },
   { max: "Infinity", granularity: "30d" },
 ]);
-import { type ErrorGroupStatus, type PrismaClientOrTransaction } from "@trigger.dev/database";
+import {
+  type ErrorGroupStatus,
+  type PrismaClientOrTransaction,
+  boundedIn,
+} from "@trigger.dev/database";
 import { type Direction } from "~/components/ListPagination";
 import { timeFilterFromTo } from "~/components/runs/v3/SharedFilters";
 import { findDisplayableEnvironment } from "~/models/runtimeEnvironment.server";
@@ -457,7 +461,7 @@ export class ErrorsListPresenter extends BasePresenter {
 
     if (statuses.includes("UNRESOLVED")) {
       const excluded = await this.replica.errorGroupState.findMany({
-        where: { environmentId, status: { in: excludedStatuses } },
+        where: { environmentId, status: { in: boundedIn(excludedStatuses) } },
         select: { taskIdentifier: true, errorFingerprint: true },
       });
       if (excluded.length === 0) {
@@ -470,7 +474,7 @@ export class ErrorsListPresenter extends BasePresenter {
     }
 
     const included = await this.replica.errorGroupState.findMany({
-      where: { environmentId, status: { in: statuses } },
+      where: { environmentId, status: { in: boundedIn(statuses) } },
       select: { taskIdentifier: true, errorFingerprint: true },
     });
     if (included.length === 0) {

apps/webapp/app/presenters/v3/PlaygroundPresenter.server.ts

@@ -8,6 +8,7 @@ import { findCurrentWorkerFromEnvironment } from "~/v3/models/workerDeployment.s
 import { runStore } from "~/v3/runStore.server";
 import { isFinalRunStatus } from "~/v3/taskStatus";
 
+import { boundedIn } from "@trigger.dev/database";
 export type PlaygroundAgent = {
   slug: string;
   filePath: string;
@@ -135,7 +136,7 @@ export class PlaygroundPresenter {
     const runsById = new Map<string, { friendlyId: string; status: TaskRunStatus }>();
     if (runIds.length > 0) {
       const runs = await runStore.findRuns({
-        where: { id: { in: runIds } },
+        where: { id: { in: boundedIn(runIds) } },
         select: { id: true, friendlyId: true, status: true },
       });
       for (const run of runs) {

apps/webapp/app/presenters/v3/QueueListPresenter.server.ts

@@ -1,6 +1,6 @@
 import type { RunEngine } from "@internal/run-engine";
 import type { Prisma } from "@trigger.dev/database";
-import { TaskQueueType } from "@trigger.dev/database";
+import { TaskQueueType, boundedIn } from "@trigger.dev/database";
 import { type PrismaClientOrTransaction } from "~/db.server";
 import { type AuthenticatedEnvironment } from "~/services/apiAuth.server";
 import { clickhouseFactory } from "~/services/clickhouse/clickhouseFactoryInstance.server";
@@ -289,7 +289,7 @@ export class QueueListPresenter extends BasePresenter {
       // AND keeps the search's name filter intact alongside the exclusion (a spread
       // would overwrite one name condition with the other).
       tailQueues = await this._replica.taskQueue.findMany({
-        where: { AND: [where, { name: { notIn: excludedNames } }] },
+        where: { AND: [where, { name: { notIn: boundedIn(excludedNames) } }] },
         select: queueListSelect,
         orderBy: {
           orderableName: "asc",
@@ -321,7 +321,7 @@ export class QueueListPresenter extends BasePresenter {
       return [];
     }
     const queues = await this._replica.taskQueue.findMany({
-      where: { AND: [where, { name: { in: names } }] },
+      where: { AND: [where, { name: { in: boundedIn(names) } }] },
       select: queueListSelect,
     });
     const byName = new Map(queues.map((queue) => [queue.name, queue]));
@@ -401,7 +401,7 @@ export class QueueListPresenter extends BasePresenter {
     const overriddenByIds = queues.map((q) => q.concurrencyLimitOverriddenBy).filter(Boolean);
     const overriddenByUsers = await this._replica.user.findMany({
       where: {
-        id: { in: overriddenByIds },
+        id: { in: boundedIn(overriddenByIds) },
       },
     });
 

apps/webapp/app/presenters/v3/SessionListPresenter.server.ts

@@ -1,6 +1,10 @@
 import { type Span } from "@opentelemetry/api";
 import { type ClickHouse } from "@internal/clickhouse";
-import { type PrismaClient, type PrismaClientOrTransaction } from "@trigger.dev/database";
+import {
+  type PrismaClient,
+  type PrismaClientOrTransaction,
+  boundedIn,
+} from "@trigger.dev/database";
 import { type Direction } from "~/components/ListPagination";
 import { timeFilters } from "~/components/runs/v3/SharedFilters";
 import { findDisplayableEnvironment } from "~/models/runtimeEnvironment.server";
@@ -188,7 +192,7 @@ export class SessionListPresenter {
           ? runStore.findRuns(
               {
                 where: {
-                  id: { in: currentRunIds },
+                  id: { in: boundedIn(currentRunIds) },
                   projectId,
                   runtimeEnvironmentId: environmentId,
                 },

apps/webapp/app/presenters/v3/SessionPresenter.server.ts

@@ -1,5 +1,5 @@
 import { type Span } from "@opentelemetry/api";
-import { type PrismaClientOrTransaction } from "@trigger.dev/database";
+import { type PrismaClientOrTransaction, boundedIn } from "@trigger.dev/database";
 import { env } from "~/env.server";
 import { findDisplayableEnvironment } from "~/models/runtimeEnvironment.server";
 import { chatSnapshotStorageKey } from "~/services/realtime/chatSnapshot.server";
@@ -90,7 +90,7 @@ export class SessionPresenter {
       return runIds.length > 0
         ? runStore.findRuns(
             {
-              where: { id: { in: runIds } },
+              where: { id: { in: boundedIn(runIds) } },
               select: { id: true, friendlyId: true, status: true },
             },
             this.replica