@askdb/core 1.0.0-beta.52 → 1.0.0-beta.54

package/dist/sql/tenant-guardrail.js

@@ -2,7 +2,7 @@ import { placeholderForTenantRoot, } from "../schema/v2/tenant-policy.js";
 import { SQLSERVER_DIALECT } from "./dialect-spec.js";
 import { decide, tenantFindings, throwIfDenied } from "./guardrail-decide.js";
 import { findPostgresOnlyForms } from "./lexer.js";
-import { mayBeSqlite, readSql, stringsSqliteReadsAsNames, tenantCodeReadings, tenantStatementReadings, unmatchedNonAsciiName, } from "./readings.js";
+import { mayBeSqlite, readSql, QUERY_START_WORDS, stringsSqliteReadsAsNames, tenantCodeReadings, tenantStatementReadings, nameEnginesFoldApart, unmatchedNonAsciiName, } from "./readings.js";
 import { EXPRESSION_KEYWORDS, EXPRESSION_PUNCTUATION } from "./tsql-batch.js";
 import { denylistFor } from "./validate.js";
 /**
@@ -24,10 +24,15 @@ import { denylistFor } from "./validate.js";
  * needs the same predicate on its tenant ID column. Down a join path, the predicate
  * must be on a column that carries the IDs of the path's root or one of its ancestors
  * in the hierarchy. A polymorphic table also needs `typeColumn = '<key>'` ANDed into
- * the same query block, with a `mapping` key of the root whose placeholder filters
- * its id column. It does not tie a predicate
- * to one table reference, so an unfiltered reference beside a filtered one can
- * still pass; database-side row-level security is the sound boundary.
+ * the same `SELECT`, with a `mapping` key of the root whose placeholder filters
+ * its id column. Each read of a table needs its own predicate in its own `SELECT`
+ * (#399): a CTE body, a derived table and a subquery are each their own, and a
+ * qualified predicate counts only for the read its qualifier names. A read in a
+ * derived table or CTE also counts as filtered when every reference to that source
+ * is filtered on the column, which the source passes through unrenamed without
+ * computing across its rows. It doesn't
+ * check which columns a join or an `IN (…)` subquery equates (#400); database-side
+ * row-level security is the sound boundary.
  *
  * **This is not a security boundary.** Its purpose is to catch model mistakes
  * (a forgotten or widened tenant filter, an unclassified table) early and
@@ -107,6 +112,15 @@ export function tenantRuleWarnings(sql, policy, scope, dialect, schemaNames) {
             "SQL Server reads names through its collation, which ignores some characters and reads others as ASCII letters, so the " +
             "tenant check can't tell which table or column it names. Spell the name exactly as the schema does."));
     }
+    // Some engine folds a few letters into ASCII ones (CockroachDB and MySQL read U+0130 as `i`), and
+    // CockroachDB normalizes a name to NFC, so the checks below can't match such a name the engines'
+    // way: unless the schema spells it exactly, refuse it.
+    const apart = nameEnginesFoldApart(read, dialect, knownNames(policy, schemaNames));
+    if (apart !== undefined) {
+        warnings.push(warn("UNICODE_ESCAPED_IDENTIFIER", "", `The SQL uses the name ${apart}, which holds a letter some database engines read as an ASCII letter (U+0130, U+0131, U+017F or U+212A) ` +
+            "or isn't in Unicode normalization form C, and isn't spelled that way in the schema. The tenant check can't tell which table or column it names. " +
+            "Spell the name exactly as the schema does."));
+    }
     // Past an E'…' string continued on a later line, Postgres and the checks below read different
     // strings, so a table or call could sit in what they take for a string: refuse it (#703).
     const continued = postgresOnly.escapeStringContinuation;
@@ -217,7 +231,7 @@ function checkPolymorphicTable(sql, pt, policy, warnings) {
         return;
     }
     // The id predicate filters by one root's IDs, so the discriminator must pick that root's
-    // rows: `owner_type = 'agency' AND owner_id = :tenant_agency_ids`, ANDed in the same block.
+    // rows: `owner_type = 'agency' AND owner_id = :tenant_agency_ids`, ANDed in the same `SELECT`.
     const paired = rootIds.map((rootId, i) => ({
         ...targets[i],
         discriminator: {
@@ -575,26 +589,43 @@ function codeView(sql, tokens, names) {
     return out.join("");
 }
 /**
- * A table counts as referenced when any reading sees its name in code, except as a word of
- * `ORDER BY` or `GROUP BY` (#828).
+ * A table counts as referenced when any reading sees its name in code, in any case and between
+ * characters that can't continue a name in any script, except as a word of `ORDER BY` or
+ * `GROUP BY` (#828).
  */
 function mentionsTable(views, tableName) {
-    const pattern = new RegExp(`\\b${escapeRegex(tableName)}\\b`, "gi");
+    // A name's edges are letters, digits, `_` or `$` in any script, matched in any case.
+    const pattern = new RegExp(`(?<![\\p{L}\\p{M}\\p{N}_$])${escapeRegex(tableName)}(?![\\p{L}\\p{M}\\p{N}_$])`, "giu");
     return views.some((view) => [...view.text.matchAll(pattern)].some((m) => !inOrderOrGroupBy(view.text, m.index, m.index + m[0].length)));
 }
 /**
  * Whether `text[start, end)` in a code view is a word of `ORDER BY` or `GROUP BY`. `ORDER` and
  * `GROUP` are reserved on every engine, so a table named after one is written quoted (`"order"`,
  * whose closing quote mark breaks the phrase) or qualified (`billing.order`, which Postgres takes
- * unquoted), and the `BY` after them is the keyword.
+ * unquoted), and the `BY` after them is the keyword. A `.` before the word makes it a name even with
+ * whitespace or a comment (blanked in the view) between them, as every engine reads `billing . order`.
  */
 function inOrderOrGroupBy(text, start, end) {
-    if (text[start - 1] === ".")
+    const afterDot = (at) => /\.\s*$/.test(text.slice(0, at));
+    if (afterDot(start))
         return false;
     const word = text.slice(start, end).toLowerCase();
     if (word === "order" || word === "group")
         return /^\s+by(?![\w$\u0080-\uffff])/i.test(text.slice(end));
-    return word === "by" && /(?:^|[^\w$\u0080-\uffff.\u0001])(?:order|group)\s+$/i.test(text.slice(0, start));
+    if (word !== "by")
+        return false;
+    const before = /(?:order|group)\s+$/i.exec(text.slice(0, start));
+    if (before === null || /[\w$\u0080-\uffff\u0001]/.test(text[before.index - 1] ?? ""))
+        return false;
+    return !afterDot(before.index);
+}
+/**
+ * Whether a reading sees `tableName` as a name of its own, not part of a longer one (`orders$archive`):
+ * anywhere in code, or inside a quoted name, except as a word of `ORDER BY` or `GROUP BY`.
+ */
+function mentionsAsName(view, tableName) {
+    const pattern = new RegExp(`(?<![\\w$\\u0080-\\uffff])${escapeRegex(tableName)}(?![\\w$\\u0080-\\uffff])`, "gi");
+    return [...view.text.matchAll(pattern)].some((m) => !inOrderOrGroupBy(view.text, m.index, m.index + m[0].length));
 }
 /** A tenant column counts only when every reading sees it in code. */
 function mentionsIdentifier(views, identifier) {
@@ -606,22 +637,48 @@ const TOKEN = /:[A-Za-z0-9_]+|::|\|\||<>|!=|<=|>=|[A-Za-z_\u0080-\uffff][\w$\u00
 const WORD_OR_NUMBER = /^[\w\u0080-\uffff]/;
 /**
  * Split a code view into tokens with their nesting depth. Strings and comments are already blanked.
- * A token is quoted when it lies inside a name the view reads as quoted, as the reading's lexer
- * spans it, so a {@link QUOTE_MARK} character written inside a quoted name changes nothing.
+ * A quoted identifier is one token, its whole name as the lexer reads it (escapes undone), so a
+ * space, dot or bracket inside it is never read as code, and a QUOTE_MARK character written inside
+ * it changes nothing. So is a string the reading takes as a name, as SQLite does (`FROM 'orders'`,
+ * `orders 'o'`): `'join'` there is a name, never the keyword.
  */
 function tokenize(view) {
     const tokens = [];
     const split = lexerWordEnds(view);
-    const quoted = view.quoted;
+    const foldsCase = view.reading.profile.id === "postgres" || view.reading.profile.id === "generic";
+    // Postgres folds only ASCII letters in an unquoted name and CockroachDB every letter: a name with
+    // an upper-case non-ASCII letter is read apart, so it names nothing ({@link READ_APART}).
+    const readsApart = view.reading.profile.id === "postgres";
+    const quotedAt = new Map();
+    for (const t of view.tokens) {
+        if (t.kind === "quoted_identifier")
+            quotedAt.set(t.start, { end: t.end, name: t.value });
+        else if (t.kind === "string" && view.quoted[t.start] === 1 && t.text.startsWith("'") && t.unterminated !== true) {
+            quotedAt.set(t.start, { end: t.end, name: t.text.slice(1, -1).replaceAll("''", "'") });
+        }
+    }
     let depth = 0;
+    let skipUntil = 0;
     for (const m of view.text.matchAll(TOKEN)) {
-        if (m[0] === QUOTE_MARK)
+        if (m.index < skipUntil)
             continue;
+        if (m[0] === QUOTE_MARK) {
+            const q = quotedAt.get(m.index);
+            if (q === undefined)
+                continue;
+            const name = q.name;
+            // A name spelled like a mark (`"."`, `[,]`) keeps a prefix, so it never reads as that mark.
+            const text = /^[^\w\u0080-\uffff]{1,2}$/.test(name) ? QUOTE_MARK + name : name;
+            tokens.push({ text, lower: name.toLowerCase(), name, kw: "", depth, offset: m.index + 1, quoted: true });
+            skipUntil = q.end;
+            continue;
+        }
         for (const [t, offset] of WORD_OR_NUMBER.test(m[0]) ? split(m[0], m.index) : [[m[0], m.index]]) {
             if (t === ")")
                 depth = Math.max(0, depth - 1);
             const lower = t.toLowerCase();
-            tokens.push({ text: t, lower, kw: quoted[offset] === 1 ? "" : lower, depth, offset });
+            const name = !foldsCase ? t : readsApart && lower !== asciiLower(t) ? `${READ_APART}${offset}` : asciiLower(t);
+            tokens.push({ text: t, lower, name, kw: lower, depth, offset });
             if (t === "(")
                 depth++;
         }
@@ -692,7 +749,7 @@ const CLAUSE_END = new Set([
 ]);
 /** Words that put a predicate somewhere other than a filter conjunct (select list, `CASE`, assignment, …). */
 const NOT_A_FILTER = new Set(["select", "from", "by", "when", "then", "else", "case", "end", "as", "set", "values", "distinct", "is"]);
-/** Keywords that combine query blocks; each block is checked on its own. */
+/** Keywords that combine `SELECT`s; each branch is checked on its own. */
 const SET_OPERATORS = new Set(["union", "intersect", "except", "minus"]);
 /** Words other than identifiers that the predicate forms use. */
 const PREDICATE_WORDS = new Set(["in", "any", "and", "or", "not", "xor"]);
@@ -700,53 +757,327 @@ const PREDICATE_WORDS = new Set(["in", "any", "and", "or", "not", "xor"]);
  * Whether the unquoted word at `i` is part of `ORDER BY` or `GROUP BY`. `ORDER` and `GROUP` are
  * reserved on every engine, so a table named after one is written quoted. Any other keyword may
  * name a table, unquoted, on some engine (`user` on MySQL, `lock` on Postgres), so its spelling
- * always counts as the table.
+ * always counts as the table. After a `.` (`billing.order by`), `order` is a table's name and
+ * `by` its alias.
  */
 function isOrderOrGroupBy(tokens, i) {
     const kw = tokens[i].kw;
     if (kw === "order" || kw === "group")
-        return tokens[i + 1]?.kw === "by";
-    return kw === "by" && (tokens[i - 1]?.kw === "order" || tokens[i - 1]?.kw === "group");
+        return tokens[i + 1]?.kw === "by" && tokens[i - 1]?.text !== ".";
+    return kw === "by" && (tokens[i - 1]?.kw === "order" || tokens[i - 1]?.kw === "group") && tokens[i - 2]?.text !== ".";
+}
+/** Words that start a query right after its `(`. */
+const QUERY_START = QUERY_START_WORDS;
+/** Words that end a row source with no alias under every reading: no engine takes one as an alias. */
+const ENDS_A_SOURCE = new Set([
+    "where", "group", "order", "having", "union", "intersect", "except", "join", "inner", "left", "right", "cross", "outer", "on",
+]);
+/** The words of a join, which put a second source in a `FROM`. */
+const JOIN_WORDS = new Set(["join", "inner", "left", "right", "full", "cross", "outer", "natural", "straight_join", "apply", "using"]);
+const analyses = new WeakMap();
+/** The view's tokens and `SELECT`s, read once per view. */
+function analyze(view) {
+    let analysis = analyses.get(view);
+    if (analysis === undefined) {
+        const tokens = tokenize(view);
+        analysis = { view, tokens, scopes: readScopes(tokens) };
+        analyses.set(view, analysis);
+    }
+    return analysis;
+}
+/** Whether the `(` at `open` opens a query: `SELECT`, `WITH`, `VALUES` or `TABLE` right after it, past any further `(`. */
+function opensQuery(tokens, open) {
+    let j = open + 1;
+    while (tokens[j]?.text === "(")
+        j++;
+    return QUERY_START.has(tokens[j]?.kw ?? "");
+}
+function readScopes(tokens) {
+    const of = [];
+    const close = new Map();
+    const branched = new Set();
+    const frames = [{ open: -1, branch: 0, depth: 0 }];
+    tokens.forEach((t, i) => {
+        let top = frames[frames.length - 1];
+        if (t.text === ")" && top.open >= 0 && t.depth === tokens[top.open].depth) {
+            close.set(top.open, i);
+            frames.pop();
+            top = frames[frames.length - 1];
+        }
+        of.push(scopeKey(top.open, top.branch));
+        if (SET_OPERATORS.has(t.kw) && t.depth === top.depth) {
+            top.branch++;
+            branched.add(top.open);
+        }
+        if (t.text === "(" && opensQuery(tokens, i))
+            frames.push({ open: i, branch: 0, depth: t.depth + 1 });
+    });
+    return { of, close, branched };
+}
+/** A `SELECT`'s key: the `(` that opens its query (-1 for the statement) and its set-operation branch. */
+function scopeKey(open, branch) {
+    return `${open}:${branch}`;
+}
+/** The `(` that opens a `SELECT`'s query, or -1 for the statement's (see {@link scopeKey}). */
+function scopeOpen(scope) {
+    return Number.parseInt(scope, 10);
 }
 /**
- * Whether the statement has a tenant predicate for `table` on every reading: a column
- * and placeholder from `targets`, compared as a conjunct of a filter clause. Every query
- * block that mentions the table needs its own: the statement, and each branch of every
- * `UNION` / `INTERSECT` / `EXCEPT`, at the top level or inside a derived table or CTE.
- * See {@link validateTenantGuardrails} for the rule.
+ * A token's name for matching a table or CTE: lower-cased, and for a quoted name without its
+ * trailing whitespace, which SQL Server ignores (`[orders ]` reads `orders`). Matching more
+ * spellings finds more reads, so the check only gets stricter on engines that keep it.
  */
-function hasTenantPredicate(views, table, targets) {
-    const name = table.toLowerCase();
-    return views.every((view) => {
-        const tokens = tokenize(view);
-        // Read the Postgres way, a column list after the table's alias renames its columns, and a quoted
-        // name is compared exactly.
-        const postgres = view.reading.profile.id === "postgres";
-        if (postgres && renamesColumns(tokens, name))
+function tableNameOf(t) {
+    return lowerEachLetter(t.quoted === true ? t.name.trimEnd() : t.text);
+}
+/**
+ * `name` with each letter lower-cased on its own, as CockroachDB lower-cases an unquoted name: a
+ * final capital sigma is `σ`, which `toLowerCase` writes `ς` at the end of a word.
+ */
+function lowerEachLetter(name) {
+    return Array.from(name, (c) => c.toLowerCase()).join("");
+}
+/** Whether `token` may be a name: a quoted name, whatever it holds, or a word that starts with a letter or `_`. */
+function isWord(token) {
+    return token !== undefined && (token.quoted === true || /^[A-Za-z_\u0080-\uffff]/.test(token.text));
+}
+/**
+ * Whether the token at `k`, right after a row source, ends that source with no alias in `view`'s
+ * reading: the end of the statement, `,`, `)`, `;`, a word in {@link ENDS_A_SOURCE}, a join word
+ * the reading's engine reserves (`FULL` but on MySQL, `NATURAL` and `USING` but on SQL Server,
+ * MySQL's `STRAIGHT_JOIN`), a SQL Server `WITH (` hint, or a MySQL `FORCE`/`USE`/`IGNORE INDEX`.
+ * Any other word may be an alias on some engine (`force`, `lock`, `qualify` are on Postgres).
+ */
+function endsSource(a, k) {
+    const t = a.tokens[k];
+    if (t === undefined || t.text === "," || t.text === ")" || t.text === ";")
+        return true;
+    const engine = a.view.reading.profile.id;
+    const next = a.tokens[k + 1];
+    switch (t.kw) {
+        case "full": return engine !== "mysql";
+        case "natural":
+        case "using": return engine !== "sqlserver";
+        case "straight_join": return engine === "mysql";
+        case "with": return next?.text === "(";
+        case "force":
+        case "use":
+        case "ignore": return next?.kw === "index" || next?.kw === "key";
+        default: return ENDS_A_SOURCE.has(t.kw);
+    }
+}
+/**
+ * The alias of the row source ending at `i`, in the only forms the check reads one: `orders o`,
+ * `orders AS o`, `) t`, where the alias is followed by what ends the source ({@link endsSource})
+ * or by its column list. Anything else (`orders TABLESAMPLE …`, `orders NOT INDEXED`) is no alias
+ * the check recognises, so it returns undefined and the caller fails closed.
+ */
+function aliasAt(a, i) {
+    const as = a.tokens[i + 1]?.kw === "as";
+    if (!as && endsSource(a, i + 1))
+        return undefined;
+    const alias = as ? i + 2 : i + 1;
+    if (!isWord(a.tokens[alias]))
+        return undefined;
+    return endsSource(a, alias + 1) || a.tokens[alias + 1]?.text === "(" ? alias : undefined;
+}
+/**
+ * The names the table reference at `i` goes by: its alias, or its own name when what follows ends
+ * it with no alias. Anything else after it is a form the check doesn't read, so the read gets no
+ * name and only an unqualified predicate filters it.
+ */
+function readNames(a, i) {
+    const end = sourceEnd(a, i);
+    if (hiddenByGroupAlias(a, end))
+        return new Set();
+    const alias = aliasAt(a, end);
+    if (alias !== undefined)
+        return a.tokens[alias + 1]?.text === "(" ? new Set() : new Set([a.tokens[alias].name]);
+    return endsSource(a, end + 1) ? new Set([a.tokens[i].name]) : new Set();
+}
+/**
+ * Whether the row source ending at `end` sits inside parentheses, in a source position, that
+ * something other than the source's end follows: an alias (`("order" x) AS y`,
+ * `(orders x CROSS JOIN s) AS j`) hides the names inside, so a predicate on `x` names another
+ * read. Any other word there is a form the check doesn't read, so it fails closed the same way.
+ */
+function hiddenByGroupAlias(a, end) {
+    const { tokens } = a;
+    for (let open = enclosing(tokens, end, "("); open >= 0; open = enclosing(tokens, open, "(")) {
+        if (opensQuery(tokens, open) || !inSourcePosition(tokens, open))
             return false;
-        // Every spelling of the name counts as the table, quoted or not, except the words of `ORDER BY`.
-        const mentions = (from, to) => {
-            for (let i = from; i < to; i++)
-                if (tokens[i].lower === name && !isOrderOrGroupBy(tokens, i))
-                    return true;
+        const close = enclosing(tokens, open + 1, ")");
+        if (close < 0 || !endsSource(a, close + 1))
+            return true;
+    }
+    return false;
+}
+/**
+ * Where the table reference at `i` ends: past the `)` of any parentheses that hold it alone
+ * (`ONLY (orders) a`, SQLite's `(orders) a`), since its alias follows them.
+ */
+function sourceEnd(a, i) {
+    let start = qualifiedStart(a.tokens, i);
+    let end = i;
+    // Only parentheses in a source position (after `FROM`, `JOIN`, `ONLY`, `,` or another `(`), not a call's.
+    const opensSource = (open) => {
+        const before = a.tokens[open - 1];
+        return before !== undefined && ((before.kw === "from" && opensFromClause(a.tokens, open - 1)) || ["join", "only", "lateral", "straight_join"].includes(before.kw) || before.text === "," || before.text === "(");
+    };
+    while (a.tokens[start - 1]?.text === "(" && a.tokens[end + 1]?.text === ")" && opensSource(start - 1)) {
+        start--;
+        end++;
+    }
+    return end;
+}
+/**
+ * Whether the `(` at `open` sits where a row source starts: right after `FROM`, a join word,
+ * `LATERAL`, `APPLY`, a comma of a `FROM` list, or another `(` that does.
+ */
+function inSourcePosition(tokens, open) {
+    const before = tokens[open - 1];
+    if (before === undefined)
+        return false;
+    if (before.kw === "from")
+        return opensFromClause(tokens, open - 1);
+    if (["join", "straight_join", "lateral", "apply"].includes(before.kw))
+        return true;
+    if (before.text === "(")
+        return !opensQuery(tokens, open - 1) && inSourcePosition(tokens, open - 1);
+    if (before.text !== ",")
+        return false;
+    for (let k = open - 2; k >= 0; k--) {
+        const t = tokens[k];
+        if (t.depth < before.depth)
             return false;
-        };
-        return queryBlocks(tokens)
-            .filter(([from, to]) => mentions(from, to))
-            .every(([from, to]) => {
-            for (let k = from; k < to; k++) {
-                for (const target of targets) {
-                    // A quoted name spelled like the placeholder is a name, which nothing binds.
-                    if (tokens[k].text !== target.placeholder || tokens[k].kw === "")
-                        continue;
-                    const span = predicateSpan(tokens, k, target, postgres);
-                    if (!span || !isFilterConjunct(tokens, span[0], span[1], view.reading))
-                        continue;
-                    if (!target.discriminator || hasDiscriminator(tokens, from, to, view, target))
-                        return true;
-                }
-            }
+        if (t.depth > before.depth)
+            continue;
+        if (t.kw === "from")
+            return opensFromClause(tokens, k);
+        if (t.kw === "select" || t.kw === "where" || t.kw === "having" || (CLAUSE_END.has(t.kw) && !JOIN_WORDS.has(t.kw)))
+            return false;
+    }
+    return false;
+}
+/**
+ * Whether a table read can start at `start`: right after a `SELECT`'s own `FROM`, a join word,
+ * `ONLY`, `LATERAL`, a comma of a `FROM` list, or a `(` in one of those places that opens no query.
+ * A whole-row reference in an expression (`json_agg(orders)`, `(orders).id`) starts none.
+ */
+function startsSource(tokens, start) {
+    const before = tokens[start - 1];
+    if (before === undefined)
+        return false;
+    if (before.kw === "from")
+        return opensFromClause(tokens, start - 1);
+    if (["join", "straight_join", "only", "lateral"].includes(before.kw))
+        return true;
+    if (before.text === "(")
+        return !opensQuery(tokens, start - 1) && startsSource(tokens, start - 1);
+    return before.text === "," && inSourcePosition(tokens, start);
+}
+/**
+ * Whether the `FROM` at `k` opens its `SELECT`'s own `FROM` clause: not `IS [NOT] DISTINCT FROM`,
+ * and not a `FROM` inside a call's parentheses (`EXTRACT(YEAR FROM d)`, `SUBSTRING(s FROM 2)`).
+ */
+function opensFromClause(tokens, k) {
+    if (tokens[k]?.kw !== "from" || tokens[k - 1]?.kw === "distinct")
+        return false;
+    const open = enclosing(tokens, k, "(");
+    return open < 0 || opensQuery(tokens, open);
+}
+/** Whether the alias of the row source ending at `i` has a column list (`x t (a, b)`), which renames its output. */
+function hasColumnList(a, i) {
+    const alias = aliasAt(a, i);
+    return alias !== undefined && a.tokens[alias + 1]?.text === "(";
+}
+/** Whether the `(` at `open` follows `AS` (or `AS [NOT] MATERIALIZED`), as a CTE body does. */
+function opensAfterAs(tokens, open) {
+    let k = open - 1;
+    if (tokens[k]?.kw === "materialized")
+        k -= tokens[k - 1]?.kw === "not" ? 2 : 1;
+    return tokens[k]?.kw === "as";
+}
+/**
+ * The CTE named before the `(` at `open` (`WITH x AS (`, `, x AS MATERIALIZED (`): its name and
+ * token. Undefined when it isn't one, or when a column list (`x (a, b) AS (`) renames its output.
+ */
+function cteAt(tokens, open) {
+    let k = open - 1;
+    if (tokens[k]?.kw === "materialized")
+        k -= tokens[k - 1]?.kw === "not" ? 2 : 1;
+    if (tokens[k]?.kw !== "as" || !isWord(tokens[k - 1]))
+        return undefined;
+    const before = tokens[k - 2];
+    if (!(before?.kw === "with" || before?.kw === "recursive" || before?.text === ","))
+        return undefined;
+    return { name: tableNameOf(tokens[k - 1]), at: k - 1 };
+}
+/**
+ * The reads of `name`: every spelling of it, quoted or not, except a word of `ORDER BY` or
+ * `GROUP BY` and a qualifier (`orders.id`), which refers to a read rather than being one. A read
+ * goes by its names ({@link readNames}): an alias only, once it has one, since the table's name
+ * then refers to another read, or to none.
+ */
+function readsOf(a, name) {
+    const reads = [];
+    a.tokens.forEach((t, i) => {
+        if (tableNameOf(t) !== name || isOrderOrGroupBy(a.tokens, i) || a.tokens[i + 1]?.text === ".")
+            return;
+        reads.push({ at: i, scope: a.scopes.of[i], names: readNames(a, i) });
+    });
+    return reads;
+}
+/** The qualifier of the column at `column` (`o` in `o.agency_id`), if any, as the reading compares names. */
+function qualifierOf(tokens, column) {
+    return tokens[column - 1]?.text === "." ? tokens[column - 2]?.name : undefined;
+}
+/** Every tenant predicate in the view for one of `targets`, with the `SELECT`s it filters. */
+function occurrences(a, targets) {
+    const found = [];
+    a.tokens.forEach((t, k) => {
+        for (const target of targets) {
+            // A quoted name spelled like the placeholder is a name, which nothing binds.
+            if (t.text !== target.placeholder || t.quoted === true)
+                continue;
+            const predicate = predicateAt(a.tokens, k, target.column, a.view.reading.profile.id);
+            if (!predicate)
+                continue;
+            const filters = filteredScopes(a, predicate.start, predicate.end, qualifierOf(a.tokens, predicate.column), predicate.column);
+            if (filters.length > 0)
+                found.push({ target, filters });
+        }
+    });
+    return found;
+}
+/**
+ * Whether every read of `table` is filtered, on every reading, by a predicate from `targets`
+ * (#399): a column and placeholder compared as a conjunct of a filter clause in the read's own
+ * `SELECT`, and tied to that read by its qualifier. Each branch of a `UNION` / `INTERSECT` /
+ * `EXCEPT` is its own `SELECT`, and so is every CTE body, derived table and subquery. A read in a
+ * derived table or CTE is also filtered from outside, when that source passes the column through
+ * unrenamed and every reference to it is filtered on it. See {@link validateTenantGuardrails}.
+ */
+function hasTenantPredicate(views, table, targets) {
+    const name = lowerEachLetter(table);
+    return views.every((view) => {
+        const a = analyze(view);
+        // Read the Postgres way, a column list after a read's alias, or after a parenthesized source it
+        // sits in, renames its columns, so the read can't be checked.
+        if (view.reading.profile.id === "postgres" && renamesColumns(a.tokens, name))
             return false;
+        const reads = readsOf(a, name);
+        // A reading that sees the table's name but no read of it (the name only inside a longer quoted
+        // name, or only as a qualifier) can't tell what filters it, so it fails closed.
+        if (reads.length === 0)
+            return !mentionsAsName(view, name);
+        const found = occurrences(a, targets);
+        const tableReads = reads.filter((r) => startsSource(a.tokens, qualifiedStart(a.tokens, r.at)));
+        return reads.every((read) => {
+            const sameSelect = tableReads.filter((r) => r.scope === read.scope);
+            return tableReads.includes(read) && sameSelect.length > 1
+                ? selfJoinReadFiltered(a, found, targets, read, name, sameSelect)
+                : readFiltered(a, found, targets, read, name);
         });
     });
 }
@@ -802,22 +1133,267 @@ function aliasWithColumnList(tokens, j) {
     return as || alias.kw === "" || !NOT_A_TABLE_ALIAS.has(alias.kw);
 }
 /**
- * Whether the block `tokens[from, to)` ANDs in `col = '<value>'` for `target.discriminator`:
- * its column (optionally qualified with the target's table or alias), `=`, and a plain
- * `'…'` literal, read from `view.source` at the offsets where the view blanked it, whose
- * value is one of the discriminator's values and which nothing but whitespace follows up
- * to the next token (no `''`-escape, no adjacent literal, no comment).
+ * A read of a table its `SELECT` reads more than once (a self-join): it counts as filtered only
+ * when every read of the table there is canonical (`table alias` or `table AS alias`, outside
+ * parentheses, with a plain unquoted alias no other read there shares, in any case) and a
+ * predicate qualified with its own alias filters it. Anything less can't tell the reads apart, so
+ * it fails closed.
+ */
+function selfJoinReadFiltered(a, found, targets, read, table, sameSelect) {
+    const aliases = sameSelect.map((r) => canonicalAlias(a, r));
+    if (aliases.some((alias) => alias === undefined))
+        return false;
+    if (new Set(aliases.map((alias) => alias.toLowerCase())).size !== aliases.length)
+        return false;
+    const mine = canonicalAlias(a, read);
+    return found.some((o) => o.filters.some((f) => f.scope === read.scope && f.qualifier === mine && targets.includes(o.target) &&
+        (!o.target.discriminator || hasDiscriminator(a, read, o.target))));
+}
+/** The plain alias of a read written `table alias` or `table AS alias`, at its `SELECT`'s own level; else undefined. */
+function canonicalAlias(a, read) {
+    const { tokens } = a;
+    const open = scopeOpen(read.scope);
+    const depth = open < 0 ? 0 : tokens[open].depth + 1;
+    if (tokens[read.at].depth !== depth || sourceEnd(a, read.at) !== read.at)
+        return undefined;
+    const at = aliasAt(a, read.at);
+    if (at === undefined || tokens[at].quoted === true || tokens[at + 1]?.text === "(")
+        return undefined;
+    return tokens[at].name;
+}
+function readFiltered(a, found, targets, read, table) {
+    for (const o of found) {
+        for (const f of o.filters) {
+            if (f.scope !== read.scope || !filtersRead(a, f, o.target, read, table))
+                continue;
+            if (o.target.discriminator && !hasDiscriminator(a, read, o.target))
+                continue;
+            return true;
+        }
+    }
+    return targets.some((target) => lowerEachLetter(target.table) === table && !target.discriminator && filteredFromOutside(a, found, read, target, 0));
+}
+/**
+ * Whether a predicate that filters `read`'s `SELECT` through `filter` filters `read` itself.
+ * Unqualified, it does: the read's table has the column, so the name resolves to it or the SQL is
+ * ambiguous. On the read's own column, its qualifier must name that read ({@link readNames});
+ * on another table's column (a root filtered through a column
+ * that carries its IDs), a read of that table. A qualifier that names no read the check sees,
+ * such as a table function's alias, counts for nothing. Through `col IN (…)`, which read of
+ * another table `col` filters is left to the join.
+ */
+function filtersRead(a, filter, target, read, table) {
+    const q = filter.qualifier;
+    if (q === undefined)
+        return filter.on === undefined || seenByOn(a.tokens, filter.on, read.at);
+    const owner = lowerEachLetter(target.table);
+    if (owner === table)
+        return read.names.has(q);
+    return !filter.ownSelect || readsOf(a, owner).some((r) => r.names.has(q));
+}
+/**
+ * Whether `read`, inside a derived table or CTE, is filtered from outside on `target`'s column:
+ * its `SELECT` is the source's whole body, the body passes the column through unrenamed, and
+ * every reference to the source is filtered on that column in its own `SELECT`, directly or,
+ * through a source around it, the same way. A set operation in the body, a column list on the
+ * source, a recursive CTE or a CTE nothing reads fails closed.
+ */
+function filteredFromOutside(a, found, read, target, depth) {
+    // Each source's answer is worked out once per call: re-exploring it once per path is exponential
+    // in a chain of sources that each read the one before several times.
+    let memo = outsideMemo.get(found);
+    if (memo === undefined)
+        outsideMemo.set(found, (memo = new Map()));
+    const key = `${read.scope}|${depth}|${[...read.names].join(" ")}|${target.table}|${target.column}|${target.placeholder}`;
+    const known = memo.get(key);
+    if (known !== undefined)
+        return known;
+    memo.set(key, false); // a cycle fails closed
+    const open = scopeOpen(read.scope);
+    let filtered = false;
+    if (depth <= 8 && open >= 0 && !a.scopes.branched.has(open)) {
+        const refs = sourceRefs(a, open);
+        filtered = refs !== undefined && refs.length > 0 && passesThrough(a, open, read.names, target.column) &&
+            refs.every((ref) => found.some((o) => o.target === target &&
+                o.filters.some((f) => f.ownSelect && f.scope === ref.scope && (f.qualifier === undefined ? f.on === undefined || seenByOn(a.tokens, f.on, ref.at) : ref.names.has(f.qualifier)))) ||
+                filteredFromOutside(a, found, ref, target, depth + 1));
+    }
+    memo.set(key, filtered);
+    return filtered;
+}
+const outsideMemo = new WeakMap();
+const sourceRefsMemo = new WeakMap();
+/**
+ * The references to the row source whose query opens at `open`, or undefined when it isn't a source
+ * this check follows: a column list on the source or on a reference to it renames its output.
+ */
+function sourceRefs(a, open) {
+    let memo = sourceRefsMemo.get(a);
+    if (memo === undefined)
+        sourceRefsMemo.set(a, (memo = new Map()));
+    if (!memo.has(open))
+        memo.set(open, readSourceRefs(a, open));
+    return memo.get(open);
+}
+function readSourceRefs(a, open) {
+    const { tokens, scopes } = a;
+    const close = scopes.close.get(open);
+    if (close === undefined || subqueryUse(tokens, open) !== "table")
+        return undefined;
+    // A derived table only in a source position: a subquery after `ON` or in an expression is no row source.
+    if (!opensAfterAs(tokens, open) && !inSourcePosition(tokens, open))
+        return undefined;
+    if (opensAfterAs(tokens, open)) {
+        const cte = cteAt(tokens, open);
+        if (cte === undefined)
+            return undefined; // a column list renames the output, or it's no CTE this check reads
+        const refs = [];
+        for (let j = 0; j < tokens.length; j++) {
+            if (j === cte.at || tableNameOf(tokens[j]) !== cte.name || tokens[j + 1]?.text === "." || isOrderOrGroupBy(tokens, j))
+                continue;
+            if (j > open && j < close)
+                return undefined; // recursive
+            if (tokens[j + 1]?.text === "(" || hasColumnList(a, sourceEnd(a, j)))
+                return undefined;
+            refs.push({ at: j, scope: scopes.of[j], names: readNames(a, j) });
+        }
+        return refs;
+    }
+    if (hasColumnList(a, close))
+        return undefined;
+    const alias = aliasAt(a, close);
+    const hidden = hiddenByGroupAlias(a, alias ?? close);
+    return [{ at: open, scope: scopes.of[open], names: new Set(alias === undefined || hidden ? [] : [tokens[alias].name]) }];
+}
+/** Clauses that compute over a source's rows, or pick some of them, before an outside filter runs. */
+const COMPUTES_OVER_ROWS = new Set(["group", "having", "window", "qualify", "limit", "offset", "fetch", "top", "over"]);
+/**
+ * Whether the body of the query at `open` passes `column` of the read named `names` through to
+ * its output unrenamed, and computes nothing across rows: every select-list item is a plain column
+ * (`col` or `q.col`, optionally aliased), `q.*` or `*`; exactly one yields that name, and it is the
+ * column itself, the read's `q.*`, or `*` over a single source; and the body has no `GROUP BY`,
+ * `HAVING`, window, `QUALIFY`, `LIMIT`, `OFFSET`, `FETCH` or `TOP`, which would run over every tenant's rows
+ * before the outside filter. An item with a string or comment in it, `DISTINCT ON` or a nested
+ * `WITH` fails closed. The column and the name it yields are compared as {@link namesColumn} reads
+ * them, and an item that yields the name in another case fails closed too.
+ */
+function passesThrough(a, open, names, column) {
+    const { tokens, scopes, view } = a;
+    const reading = view.reading.profile.id;
+    const scope = scopeKey(open, 0);
+    const depth = tokens[open].depth + 1;
+    const level = (i) => scopes.of[i] === scope && tokens[i].depth === depth;
+    const select = open + 1;
+    if (tokens[select]?.kw !== "select")
+        return false;
+    let from = select + 1;
+    while (from < tokens.length && !(level(from) && tokens[from].kw === "from"))
+        from++;
+    if (from >= tokens.length)
+        return false;
+    let first = select + 1;
+    if (tokens[first]?.kw === "all" || tokens[first]?.kw === "distinct")
+        first++;
+    if (tokens[first]?.kw === "on")
+        return false;
+    const end = scopes.close.get(open) ?? tokens.length;
+    for (let i = select; i < end; i++)
+        if (scopes.of[i] === scope && COMPUTES_OVER_ROWS.has(tokens[i].kw))
+            return false;
+    const items = [[]];
+    for (let i = first; i < from; i++) {
+        if (level(i) && tokens[i].text === ",")
+            items.push([]);
+        else
+            items[items.length - 1].push(i);
+    }
+    let yields = 0;
+    for (const item of items) {
+        if (item.length === 0)
+            return false;
+        // Text the view blanked (a string, a comment) could be part of the item, so don't guess.
+        const last = tokens[item[item.length - 1]];
+        for (let p = tokens[item[0]].offset; p < last.offset + last.text.length; p++) {
+            if (view.text[p] !== view.source[p] && view.text[p] !== QUOTE_MARK)
+                return false;
+        }
+        const ts = item.map((i) => tokens[i]);
+        const n = ts.length;
+        if (n === 1 && ts[0].text === "*") {
+            if (!singleSource(a, open, scope, depth))
+                return false;
+            yields++;
+            continue;
+        }
+        if (n === 3 && ts[1].text === "." && ts[2].text === "*") {
+            if (!names.has(ts[0].name))
+                return false;
+            yields++;
+            continue;
+        }
+        let alias;
+        let expr = ts;
+        if (n >= 3 && ts[n - 2].kw === "as" && isWord(ts[n - 1])) {
+            alias = ts[n - 1];
+            expr = ts.slice(0, n - 2);
+        }
+        else if (n >= 2 && isWord(ts[n - 1]) && (isWord(ts[n - 2]) || ts[n - 2].text === ")" || /^\d/.test(ts[n - 2].text))) {
+            alias = ts[n - 1];
+            expr = ts.slice(0, n - 1);
+        }
+        const isColumn = expr.length === 1 ? isWord(expr[0]) : expr.length === 3 && isWord(expr[0]) && expr[1].text === "." && isWord(expr[2]);
+        if (!isColumn)
+            return false; // an expression, a call or an aggregate
+        const name = expr[expr.length - 1];
+        // An item that yields the name in any case is a candidate; it must name the column the way the engine reads it.
+        if ((alias ?? name).lower !== column.toLowerCase())
+            continue;
+        if (!namesColumn(alias ?? name, column, reading) || !namesColumn(name, column, reading))
+            return false;
+        if (expr.length === 3 && !names.has(expr[0].name))
+            return false; // another expression named like the column
+        yields++;
+    }
+    return yields === 1;
+}
+/** Whether the `FROM` of the query at `open` has one source: no join and no comma before its next clause. */
+function singleSource(a, open, scope, depth) {
+    const { tokens, scopes } = a;
+    const end = scopes.close.get(open) ?? tokens.length;
+    let i = open + 1;
+    while (i < end && !(scopes.of[i] === scope && tokens[i].depth === depth && tokens[i].kw === "from"))
+        i++;
+    for (i++; i < end; i++) {
+        const t = tokens[i];
+        if (scopes.of[i] !== scope || t.depth !== depth)
+            continue;
+        if (t.text === "," || JOIN_WORDS.has(t.kw) || (t.text === "(" && !opensQuery(tokens, i)))
+            return false;
+        // Only a clause no engine takes as an alias ends the FROM: past `lock` or `qualify`, which
+        // may be the first source's alias, a second source can still follow.
+        if (ENDS_A_SOURCE.has(t.kw) && !JOIN_WORDS.has(t.kw))
+            return true;
+    }
+    return true;
+}
+/**
+ * Whether `read`'s `SELECT` ANDs in `col = '<value>'` for `target.discriminator`: its column, as
+ * {@link namesColumn} compares it (unqualified, or qualified with the read's table or alias), `=`, and a plain `'…'` literal,
+ * read from the statement at the offsets where the view blanked it, whose value is one of the
+ * discriminator's values and which nothing but whitespace follows up to the next token (no
+ * `''`-escape, no adjacent literal, no comment).
  */
-function hasDiscriminator(tokens, from, to, view, target) {
+function hasDiscriminator(a, read, target) {
     const { column, values } = target.discriminator;
+    const { tokens, view } = a;
     const source = view.source;
-    for (let i = from; i < to; i++) {
+    for (let i = 0; i < tokens.length; i++) {
         const t = tokens[i];
         const eq = tokens[i + 1];
-        if (!isIdentifier(t) || t.lower !== column.toLowerCase() || eq?.text !== "=")
+        if (a.scopes.of[i] !== read.scope || !isIdentifier(t) || !namesColumn(t, column, view.reading.profile.id) || eq?.text !== "=")
             continue;
-        const qualifier = tokens[i - 1]?.text === "." ? tokens[i - 2] : undefined;
-        if (qualifier !== undefined && namesOtherTable(tokens, qualifier.lower, target.table.toLowerCase()))
+        const qualifier = qualifierOf(tokens, i);
+        if (qualifier !== undefined && !read.names.has(qualifier))
             continue;
         let open = eq.offset + 1;
         while (/\s/.test(source[open] ?? ""))
@@ -834,38 +1410,15 @@ function hasDiscriminator(tokens, from, to, view, target) {
         const next = tokens[i + 2]?.offset ?? source.length;
         if (view.text.slice(open, close + 1).trim() !== "" || source.slice(close + 1, next).trim() !== "")
             continue;
-        if (isFilterConjunct(tokens, qualifiedStart(tokens, i), i + 1, view.reading))
+        const filters = filteredScopes(a, qualifiedStart(tokens, i), i + 1, qualifier, i);
+        if (filters.some((f) => f.ownSelect && f.scope === read.scope && (qualifier !== undefined || f.on === undefined || seenByOn(tokens, f.on, read.at))))
             return true;
     }
     return false;
 }
-/**
- * Token ranges `[from, to)` of the statement's query blocks: the whole statement, and
- * each branch of every set operation at any depth (bounded by the parentheses around it).
- */
-function queryBlocks(tokens) {
-    const blocks = [[0, tokens.length]];
-    const splits = new Map(); // enclosing "(" (or -1) → set-operator positions
-    tokens.forEach((t, i) => {
-        if (!SET_OPERATORS.has(t.kw))
-            return;
-        const open = enclosing(tokens, i, "(");
-        splits.set(open, [...(splits.get(open) ?? []), i]);
-    });
-    for (const [open, positions] of splits) {
-        const end = open < 0 ? tokens.length : enclosing(tokens, open + 1, ")");
-        let from = open + 1;
-        for (const at of positions) {
-            blocks.push([from, at]);
-            from = at + 1;
-        }
-        blocks.push([from, end < 0 ? tokens.length : end]);
-    }
-    return blocks;
-}
 /** An identifier token: a word that isn't one of the predicate forms' keywords. */
 function isIdentifier(token) {
-    return /^[A-Za-z_\u0080-\uffff]/.test(token.text) && !PREDICATE_WORDS.has(token.kw);
+    return token.quoted === true || (/^[A-Za-z_\u0080-\uffff]/.test(token.text) && !PREDICATE_WORDS.has(token.kw));
 }
 /**
  * A clause keyword used as a function name (`LEFT(status, 1)`, `RIGHT(…)`) is an identifier.
@@ -882,37 +1435,28 @@ function qualifiedStart(tokens, end) {
     return start;
 }
 /**
- * The token span `[start, end]` of a tenant predicate around the placeholder at `k`:
- * `col = P`, `P = col`, `col IN (P)` or `col = ANY (P)`, where `col` (the last part of a
- * possibly qualified name) is the target's column. A qualifier that names, or is the
- * alias of, a table other than the target's makes it no predicate for that table. With
- * `exactQuoted` (read the Postgres way, where a quoted name is compared exactly), a quoted
- * `col` counts only when spelled as the schema spells the column: `"AGENCY_ID"` is another
- * column there, which another source in the query may hold.
+ * The span `[start, end]` and column index of a tenant predicate around the placeholder at `k`:
+ * `col = P`, `P = col`, `col IN (P)` or `col = ANY (P)`, where `col` (the last part of a possibly
+ * qualified name) is `column`, as {@link namesColumn} compares them under `reading`. Which read
+ * the column belongs to is its qualifier's to say.
  */
-function predicateSpan(tokens, k, target, exactQuoted) {
+function predicateAt(tokens, k, column, reading) {
     const at = (i) => tokens[i];
-    const column = target.column.toLowerCase();
     const matches = (i) => {
         const t = at(i);
-        if (t === undefined || !isIdentifier(t) || t.lower !== column)
-            return false;
-        if (exactQuoted && t.kw === "" && t.text !== target.column)
-            return false;
-        const qualifier = at(i - 1)?.text === "." ? at(i - 2) : undefined;
-        return qualifier === undefined || !namesOtherTable(tokens, qualifier.lower, target.table.toLowerCase());
+        return t !== undefined && isIdentifier(t) && namesColumn(t, column, reading);
     };
     // col = P
     if (at(k - 1)?.text === "=" && matches(k - 2))
-        return [qualifiedStart(tokens, k - 2), k];
+        return { start: qualifiedStart(tokens, k - 2), end: k, column: k - 2 };
     const closed = at(k + 1)?.text === ")";
     // col IN ( P )
     if (closed && at(k - 1)?.text === "(" && at(k - 2)?.kw === "in" && matches(k - 3)) {
-        return [qualifiedStart(tokens, k - 3), k + 1];
+        return { start: qualifiedStart(tokens, k - 3), end: k + 1, column: k - 3 };
     }
     // col = ANY ( P )
     if (closed && at(k - 1)?.text === "(" && at(k - 2)?.kw === "any" && at(k - 3)?.text === "=" && matches(k - 4)) {
-        return [qualifiedStart(tokens, k - 4), k + 1];
+        return { start: qualifiedStart(tokens, k - 4), end: k + 1, column: k - 4 };
     }
     // P = col
     if (at(k + 1)?.text === "=") {
@@ -920,32 +1464,50 @@ function predicateSpan(tokens, k, target, exactQuoted) {
         while (at(end + 1)?.text === "." && at(end + 2) !== undefined && isIdentifier(at(end + 2)))
             end += 2;
         if (matches(end))
-            return [k, end];
+            return { start: k, end, column: end };
     }
     return undefined;
 }
 /**
- * Whether the qualifier `name` names a table other than `table`: `name` is that other
- * table, or is declared as its alias (`FROM appointments a`, `JOIN appointments AS a`).
- * A qualifier the statement doesn't declare (a derived table's or CTE's name) names no
- * known table, so it doesn't rule the predicate out.
+ * The name every engine that shares the `reading` reads for the written name `t`, to compare with a
+ * column's spelling ({@link namesColumn}) or with another written name ({@link sameName}); undefined
+ * when those engines read it apart, so it names no column. A name read as another column may be
+ * another source's, so it ties nothing to the policy's.
+ * - Read the Postgres way (`postgres`, `cockroachdb`): a quoted name exactly; an unquoted one with
+ *   its ASCII letters lower-cased, as Postgres folds it. CockroachDB lower-cases every letter, so an
+ *   unquoted name with an upper-case non-ASCII letter (`Égency_id`) is read apart.
+ * - Read the SQL Server way, as written: the database's collation may compare names
+ *   case-sensitively, and the check can't see it, so `agencyid` is another column than `agencyId`.
+ * - Read the MySQL way (MySQL and MariaDB) and otherwise (SQLite, the generic reading), with only
+ *   ASCII letters lower-cased, quoted or not: SQLite folds only those, and MariaDB keeps apart
+ *   letters Unicode lower-casing merges (U+212A KELVIN SIGN and `k`).
+ * A custom id or none is read every way, so a name has to match under each.
  */
-function namesOtherTable(tokens, name, table) {
-    if (name === table)
-        return false;
-    for (let i = 1; i < tokens.length; i++) {
-        if (tokens[i].lower !== name || !isIdentifier(tokens[i]))
-            continue;
-        const source = tokens[i - 1]?.kw === "as" ? i - 2 : i - 1;
-        const src = tokens[source];
-        if (src === undefined || !isIdentifier(src) || tokens[source + 1]?.text === ".")
-            continue;
-        const before = tokens[qualifiedStart(tokens, source) - 1];
-        if (before !== undefined && (before.kw === "from" || before.kw === "join" || before.text === ",")) {
-            return src.lower !== table;
-        }
-    }
-    return false;
+function engineName(t, reading) {
+    if (t.name.startsWith(READ_APART))
+        return undefined;
+    return reading === "sqlserver" || reading === "postgres" ? t.name : asciiLower(t.name);
+}
+/**
+ * The start of the name a token gets when the engines that share its reading read it apart (an
+ * unquoted name with an upper-case non-ASCII letter, read the Postgres way), followed by its
+ * offset: no other name equals it, so an alias, a qualifier or a column spelled that way names
+ * nothing ({@link engineName}).
+ */
+const READ_APART = "\u0000";
+/** Whether the written column `t` is the policy's `column`, whose spelling the policy writes as the schema does ({@link engineName}). */
+function namesColumn(t, column, reading) {
+    const name = engineName(t, reading);
+    return name !== undefined && name === (reading === "postgres" || reading === "sqlserver" ? column : asciiLower(column));
+}
+/** Whether the written names `t` and `u` are the same name for every engine that shares the `reading` ({@link engineName}). */
+function sameName(t, u, reading) {
+    const name = engineName(t, reading);
+    return name !== undefined && name === engineName(u, reading);
+}
+/** `name` with its ASCII letters lower-cased, as SQLite folds a name. */
+function asciiLower(name) {
+    return name.replace(/[A-Z]+/g, (s) => s.toLowerCase());
 }
 /**
  * Whether the subquery opened by the `(` at `open` is a row source (a derived table in
@@ -972,6 +1534,9 @@ function subqueryUse(tokens, open) {
         return tokens[open - 2] !== undefined && isIdentifier(tokens[open - 2]) ? "in" : "other";
     if (opener.kw === "as" || opener.kw === "lateral")
         return "table";
+    // A CTE body after `AS MATERIALIZED (` or `AS NOT MATERIALIZED (`.
+    if (opener.kw === "materialized" && (tokens[open - 2]?.kw === "as" || (tokens[open - 2]?.kw === "not" && tokens[open - 3]?.kw === "as")))
+        return "table";
     const depth = tokens[open].depth;
     for (let i = open - 1; i >= 0; i--) {
         const t = tokens[i];
@@ -1029,29 +1594,94 @@ function isOuterJoinOn(tokens, on) {
     }
     return false;
 }
+/** Join words that may take an `ON`: MySQL's `STRAIGHT_JOIN` may, so it counts as one. */
+const TAKES_ON = new Set(["join", "straight_join"]);
 /**
- * Whether the term `tokens[start..end]` is ANDed into a `WHERE`, `ON` (of an inner join)
- * or `HAVING` clause of the statement: at its own level and at every enclosing
- * parenthesized level up to that clause, it sits between `AND`s (or the clause's start
- * and end), with no `OR`, `XOR` (or MySQL's `||`) at that level and no `NOT` in front of
- * it. A clause inside a subquery counts only when the subquery is a row source (a
- * derived table or CTE), or when the whole `col IN (…)` around it is itself such a
- * conjunct; not inside `EXISTS (…)`, a scalar subquery, or a comparison. A level opened by a function call or a comparison doesn't count.
+ * Whether the read at `at` is among the operands of the join the `ON` at `on` closes: the only reads
+ * an unqualified column there can name. They run from the join's left operand up to the `ON`. Going
+ * left from the join's own `JOIN`, the left operand stops at `FROM`, at the `(` around the join, at
+ * a `FROM`-list comma (which binds looser than a join, though not on SQLite, where this only
+ * narrows the check), or at a `JOIN` whose `ON` or `USING` hasn't come yet (`a LEFT JOIN b JOIN c
+ * ON … ON …`). `CROSS JOIN`, `NATURAL JOIN` and `APPLY` take no `ON`, so the operand runs past them.
  */
-function isFilterConjunct(tokens, start, end, reading) {
-    const disjunction = (t) => t.kw === "or" || t.kw === "xor" || (t.text === "||" && reading.pipesAreOr);
+function seenByOn(tokens, on, at) {
+    if (at >= on)
+        return false;
+    const depth = tokens[on].depth;
+    let join = -1;
+    for (let i = on - 1; i >= 0 && join < 0; i--) {
+        const t = tokens[i];
+        if (t.depth < depth)
+            return false;
+        if (t.depth > depth)
+            continue;
+        if (t.kw === "from" || t.text === ",")
+            return false;
+        if (TAKES_ON.has(t.kw))
+            join = i;
+    }
+    if (join < 0)
+        return false;
+    let pending = 0; // ON or USING seen going left, each closing a JOIN further left
+    for (let i = join - 1; i >= 0; i--) {
+        const t = tokens[i];
+        if (t.depth < depth)
+            return at > i;
+        if (t.depth > depth)
+            continue;
+        if (t.kw === "from" || t.text === ",")
+            return at > i;
+        if (t.kw === "on" || t.kw === "using")
+            pending++;
+        else if (TAKES_ON.has(t.kw) && !takesNoOn(tokens, i)) {
+            if (pending === 0)
+                return at > i;
+            pending--;
+        }
+    }
+    return true;
+}
+/** Whether the `JOIN` at `join` is a `CROSS JOIN` or a `NATURAL … JOIN`, which take no `ON`. */
+function takesNoOn(tokens, join) {
+    const depth = tokens[join].depth;
+    for (let k = join - 1; k >= 0; k--) {
+        const w = tokens[k];
+        if (w.depth !== depth || BEFORE_A_JOIN.has(w.kw) || w.text === ",")
+            return false;
+        if ((w.kw === "cross" || w.kw === "natural") && tokens[k - 1]?.text !== "." && tokens[k + 1]?.text !== ".")
+            return true;
+    }
+    return false;
+}
+/**
+ * The `SELECT`s whose reads the term `tokens[start..end]` filters (#399), each with the qualifier
+ * that ties it to a read there. The term must be ANDed into a `WHERE`, `ON` (of an inner join) or
+ * `HAVING` clause: at its own level and at every enclosing parenthesized level up to that clause,
+ * it sits between `AND`s (or the clause's start and end), with no `OR`, `XOR` (or MySQL's `||`)
+ * at that level and no `NOT` in front of it. It then filters that clause's `SELECT`, through
+ * `qualifier`, its column's. When that `SELECT` is the whole right side of `col IN (…)` and the
+ * `col IN (…)` is itself such a conjunct, it filters the query around it too, through `col`'s
+ * qualifier. A level opened by a function call or a comparison doesn't count.
+ */
+function filteredScopes(a, start, end, qualifier, termColumn) {
+    const { tokens, scopes } = a;
+    const disjunction = (t) => t.kw === "or" || t.kw === "xor" || (t.text === "||" && a.view.reading.pipesAreOr);
     const endsClause = (i) => CLAUSE_END.has(tokens[i].kw) && !isFunctionCall(tokens, i);
+    const filters = [];
     let lo = start;
     let hi = end;
     let depth = tokens[start].depth;
+    let q = qualifier;
+    let ownSelect = true;
+    let column = termColumn;
     for (;;) {
         // What is directly around the term, at its level.
         const before = tokens[lo - 1];
         const after = tokens[hi + 1];
-        const leftOk = before !== undefined && (before.kw === "and" || before.text === "(" || FILTER_CLAUSE.has(before.kw));
+        const leftOk = before !== undefined && (conjunctAnd(tokens, lo - 1) || before.text === "(" || FILTER_CLAUSE.has(before.kw));
         const rightOk = after === undefined || after.kw === "and" || after.text === ")" || after.text === ";" || endsClause(hi + 1);
         if (!leftOk || !rightOk)
-            return false;
+            return filters;
         // Scan the rest of this level on both sides for a disjunction, a NOT, or the clause keyword.
         let clause = -1;
         let open = -1;
@@ -1064,13 +1694,13 @@ function isFilterConjunct(tokens, start, end, reading) {
             if (t.depth > depth)
                 continue;
             if (disjunction(t) || t.kw === "not")
-                return false;
+                return filters;
             if (FILTER_CLAUSE.has(t.kw)) {
                 clause = i;
                 break;
             }
             if ((endsClause(i) || NOT_A_FILTER.has(t.kw)) && !isFunctionCall(tokens, i))
-                return false;
+                return filters;
         }
         let close = tokens.length;
         for (let j = hi + 1; j < tokens.length; j++) {
@@ -1081,44 +1711,160 @@ function isFilterConjunct(tokens, start, end, reading) {
             }
             if (t.depth > depth)
                 continue;
-            if (t.text === ";" || endsClause(j))
+            if (t.text === ";" || endsFilterScan(tokens, j, a.view.reading.profile.id))
                 break;
             if (disjunction(t))
-                return false;
+                return filters;
         }
         if (clause >= 0) {
             if (tokens[clause].kw === "on" && isOuterJoinOn(tokens, clause))
-                return false;
-            if (depth === 0)
-                return true;
-            // The clause is inside a subquery: how does the query around it use that subquery?
-            const blockOpen = enclosing(tokens, clause, "(");
-            const blockClose = enclosing(tokens, clause, ")");
-            if (blockOpen < 0 || blockClose < 0)
-                return false;
-            const use = subqueryUse(tokens, blockOpen);
-            if (use === "table")
-                return true;
-            if (use === "other")
-                return false;
-            lo = qualifiedStart(tokens, blockOpen - 2); // `col IN (…)`
-            hi = blockClose;
-            depth = tokens[blockOpen].depth;
+                return filters;
+            if (tokens[clause].kw === "having" && !onGroupKey(a, clause, column))
+                return filters;
+            const scope = scopes.of[clause];
+            filters.push({ scope, qualifier: q, ownSelect, ...(tokens[clause].kw === "on" ? { on: clause } : {}) });
+            // `col IN (<this SELECT>)` limits the query around it to the rows this SELECT returns.
+            const query = scopeOpen(scope);
+            const queryClose = scopes.close.get(query);
+            if (query < 0 || queryClose === undefined || scopes.branched.has(query) || subqueryUse(tokens, query) !== "in")
+                return filters;
+            lo = qualifiedStart(tokens, query - 2);
+            hi = queryClose;
+            depth = tokens[query].depth;
+            q = qualifierOf(tokens, query - 2);
+            column = query - 2;
+            ownSelect = false;
             continue;
         }
         if (open < 0 || tokens[open].text !== "(" || close >= tokens.length || tokens[close].text !== ")")
-            return false;
+            return filters;
         // A parenthesized group counts only as a plain boolean conjunct: opened right after
         // WHERE/ON/HAVING, AND, or another "(". Anything else (`f(`, `IN (`, `EXISTS (`,
         // `NOT (`, `= (`) makes it something other than a filter conjunct.
         const opener = tokens[open - 1];
-        if (opener === undefined || !(FILTER_CLAUSE.has(opener.kw) || opener.kw === "and" || opener.text === "("))
-            return false;
+        if (opener === undefined || !(FILTER_CLAUSE.has(opener.kw) || conjunctAnd(tokens, open - 1) || opener.text === "("))
+            return filters;
         lo = open;
         hi = close;
         depth = tokens[open].depth;
     }
 }
+/** Whether the token at `i` is an `AND` that joins two conjuncts, not the `AND` of a `BETWEEN`. */
+function conjunctAnd(tokens, i) {
+    return tokens[i]?.kw === "and" && !andOfBetween(tokens, i);
+}
+/**
+ * Whether the `AND` at `and` closes a `BETWEEN` (`x BETWEEN 0 AND y`), so that what follows is the
+ * upper bound, not a conjunct: MySQL reads `0 BETWEEN 0 AND col IN (…)` with the `IN` inside the
+ * bound. Each `BETWEEN` at the `AND`'s level, from the start of its clause or parentheses, takes the
+ * first `AND` after it there, whatever its lower bound holds (`LEFT(…)`, a cast); an `AND` inside a
+ * `CASE … END` belongs to the `CASE`.
+ */
+function andOfBetween(tokens, and) {
+    const depth = tokens[and].depth;
+    // A word beside a `.` is a name (`o.and`, `o.end`), never the keyword.
+    const dotted = (i) => tokens[i - 1]?.text === "." || tokens[i + 1]?.text === ".";
+    let from = and - 1;
+    while (from >= 0) {
+        const t = tokens[from];
+        if (t.depth < depth || (t.depth === depth && !dotted(from) && (FILTER_CLAUSE.has(t.kw) || t.kw === "select")))
+            break;
+        from--;
+    }
+    let pending = 0;
+    let inCase = 0;
+    for (let i = from + 1; i < and; i++) {
+        const t = tokens[i];
+        if (t.depth !== depth || dotted(i))
+            continue;
+        if (t.kw === "case")
+            inCase++;
+        else if (t.kw === "end" && inCase > 0)
+            inCase--;
+        else if (inCase === 0 && t.kw === "between")
+            pending++;
+        else if (inCase === 0 && t.kw === "and" && pending > 0)
+            pending--;
+    }
+    return pending > 0;
+}
+/**
+ * Whether the word at `j` ends the scan for an `OR` beside a predicate: a clause start that every
+ * engine reserves (`WHERE`, `HAVING`, `GROUP BY`, `ORDER BY`, a set operation, `JOIN`), not beside a
+ * `.`, and MySQL's `STRAIGHT_JOIN` where the SQL is read as MySQL. Other clause words (`LIMIT`, `LOCK`,
+ * `QUALIFY`, `NATURAL`, `USING`, `WINDOW`) are names on some engine, so the scan goes on past them, and
+ * an `OR` after one still counts as beside the predicate.
+ */
+function endsFilterScan(tokens, j, engine) {
+    const t = tokens[j];
+    if (tokens[j - 1]?.text === "." || tokens[j + 1]?.text === "." || isFunctionCall(tokens, j))
+        return false;
+    if (t.kw === "group" || t.kw === "order")
+        return tokens[j + 1]?.kw === "by";
+    if (t.kw === "straight_join")
+        return engine === "mysql";
+    return ["where", "having", "union", "intersect", "except", "join"].includes(t.kw);
+}
+/**
+ * Whether a predicate on the column at `column`, ANDed into the `HAVING` at `having`, filters rows:
+ * only when that column is a plain key of its `SELECT`'s `GROUP BY` (`agency_id`, or `o.agency_id`
+ * written the same way, the name compared by {@link sameName}). On any other column, a group holds every row it covers, and SQLite and
+ * MariaDB take the column's value from one of them. Read the MySQL way, an unqualified column that a
+ * select-list item is aliased to never counts: MySQL and MariaDB resolve such a `HAVING` name to the
+ * alias in some forms and to the `GROUP BY` column in others, so the check refuses the name either way.
+ */
+function onGroupKey(a, having, column) {
+    const { tokens } = a;
+    const depth = tokens[having].depth;
+    let select = -1;
+    let groupBy = -1;
+    for (let i = having - 1; i >= 0 && select < 0; i--) {
+        const t = tokens[i];
+        if (t.depth < depth)
+            break;
+        if (t.depth > depth)
+            continue;
+        if (t.kw === "by" && tokens[i - 1]?.kw === "group" && groupBy < 0)
+            groupBy = i;
+        if (t.kw === "select")
+            select = i;
+    }
+    if (select < 0 || groupBy < 0)
+        return false;
+    const name = tokens[column].lower;
+    const qualifier = qualifierOf(tokens, column);
+    const itemRanges = (from, to) => {
+        const out = [];
+        let itemStart = from;
+        for (let i = from; i <= to; i++) {
+            const t = tokens[i];
+            if (i === to || (t?.depth === depth && t.text === ",")) {
+                if (i > itemStart)
+                    out.push([itemStart, i - 1]);
+                itemStart = i + 1;
+            }
+        }
+        return out;
+    };
+    if (a.view.reading.profile.id === "mysql" && qualifier === undefined) {
+        let from = select + 1;
+        while (tokens[from]?.kw === "distinct" || tokens[from]?.kw === "all")
+            from++;
+        let fromKw = from;
+        while (fromKw < having && !(tokens[fromKw].depth === depth && tokens[fromKw].kw === "from"))
+            fromKw++;
+        const aliased = itemRanges(from, fromKw).some(([s, e]) => e > s && tokens[e - 1]?.text !== "." && isIdentifier(tokens[e]) && tokens[e].lower === name);
+        if (aliased)
+            return false;
+    }
+    return itemRanges(groupBy + 1, having).some(([s, e]) => {
+        const last = tokens[e];
+        if (!isIdentifier(last) || !sameName(last, tokens[column], a.view.reading.profile.id))
+            return false;
+        const plain = e === s || (e === s + 2 && tokens[s + 1]?.text === ".");
+        return plain && qualifierOf(tokens, e) === qualifier;
+    });
+}
 /** Index of the `(` or `)` that encloses the token at `i`, or -1 at the top level. */
 function enclosing(tokens, i, paren) {
     const depth = tokens[i].depth;