@cosmicdrift/kumiko-framework 0.387.0 → 0.388.0

package/dist/db/driver-value-preparation.js

@@ -0,0 +1,99 @@
+import { Temporal } from "@cosmicdrift/kumiko-types/temporal";
+import { isPiiCiphertext } from "../crypto/pii-ciphertext-format.js";
+import { SQL_EXPR_BRAND } from "./dialect.js";
+import { isTemporalInstant, isTemporalPlainDate, isTemporalPlainDateTimeLike, } from "./temporal-value-guards.js";
+// Checks the brand Symbol, not the `kind` string — a client-supplied jsonb
+// value can fake `kind: "sql-expr"` over JSON but can never carry a Symbol,
+// so request data can't be smuggled in as a raw SQL literal.
+export function isSqlExpression(v) {
+    return typeof v === "object" && v !== null && SQL_EXPR_BRAND in v;
+}
+// A `date` column takes a plain "yyyy-mm-dd" string (or PlainDate.toString())
+// as-is — no Instant detour. Postgres parses a DATE literal without ever
+// consulting the session timezone, so this is TZ-independent by construction
+// (verified empirically — see plainDateFromDriver above for the read side).
+// Compat cushion: code (this field used to be an Instant) may still
+// hand a Temporal.Instant into a where-filter or write on a `date` column —
+// same UTC anchor as plainDateFromDriver's read side, so a filter built with
+// `Temporal.Now.instant()` keeps working instead of binding a raw Instant the
+// driver can't serialize.
+function prepareDateValue(value) {
+    if (isTemporalPlainDate(value)) {
+        return { kind: "param", sql: "", bound: value.toString() };
+    }
+    if (isTemporalPlainDateTimeLike(value)) {
+        return { kind: "param", sql: "", bound: value.toPlainDate().toString() };
+    }
+    if (isTemporalInstant(value)) {
+        const day = value.toZonedDateTimeISO("UTC").toPlainDate();
+        return { kind: "param", sql: "", bound: day.toString() };
+    }
+    return undefined;
+}
+// structured values bind directly with an ::jsonb cast; JSON.stringify first
+// would produce a JSON-string scalar instead of the structured value.
+export function prepareJsonbValue(value) {
+    if (typeof value === "boolean") {
+        return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
+    }
+    if (typeof value !== "object" || isTemporalInstant(value)) {
+        return undefined;
+    }
+    if (!Array.isArray(value)) {
+        return { kind: "param", sql: "::jsonb", bound: value };
+    }
+    // All-boolean arrays are inferred as boolean[] by postgres-js; route via text::jsonb.
+    if (value.length > 0 && value.every((entry) => typeof entry === "boolean")) {
+        return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
+    }
+    return { kind: "param", sql: "::jsonb", bound: value };
+}
+const INTEGER_PG_TYPES = new Set([
+    "integer",
+    "int4",
+    "smallint",
+    "int2",
+    "bigint",
+    "int8",
+    "serial",
+    "bigserial",
+]);
+// Postgres rounds sub-millisecond params into timestamptz(3); truncating to ms here keeps the
+// stored instant identical across drivers and equal to what postgres.js sends via Date.
+export function instantToTimestamptzParam(instant) {
+    return Temporal.Instant.fromEpochMilliseconds(instant.epochMilliseconds).toString();
+}
+function prepareDriverNeutralScalar(value, pgType) {
+    if ((pgType === "timestamptz" || pgType === "timestamptz(3)") && isTemporalInstant(value)) {
+        return { kind: "param", sql: "", bound: instantToTimestamptzParam(value) };
+    }
+    // postgres.js sends text, so Postgres rejects 3.5 for an integer column instead of rounding it.
+    if (typeof value === "number" && pgType !== undefined && INTEGER_PG_TYPES.has(pgType)) {
+        return { kind: "param", sql: "", bound: String(value) };
+    }
+    return undefined;
+}
+export function prepareValue(value, pgType) {
+    if (isSqlExpression(value)) {
+        return { kind: "literal", literal: value.text };
+    }
+    // A PII-encrypted jsonb field is a JSON string scalar; a raw string bound to
+    // ::jsonb would be parsed as JSON text (or double-encoded).
+    if (pgType === "jsonb" && isPiiCiphertext(value)) {
+        return { kind: "param", sql: "::text::jsonb", bound: JSON.stringify(value) };
+    }
+    if (pgType === "jsonb" && value !== null) {
+        const prepared = prepareJsonbValue(value);
+        if (prepared)
+            return prepared;
+    }
+    const scalar = prepareDriverNeutralScalar(value, pgType);
+    if (scalar)
+        return scalar;
+    if (pgType === "date") {
+        const prepared = prepareDateValue(value);
+        if (prepared)
+            return prepared;
+    }
+    return { kind: "param", sql: "", bound: value };
+}

package/dist/db/entity-field-encryption.d.ts

@@ -3,6 +3,7 @@ import { type Logger } from "../logging/index.ts";
 import type { EnvelopeCipher } from "../secrets/envelope-cipher.ts";
 export declare function collectEncryptedFieldNames(entity: EntityDefinition): ReadonlySet<string>;
 export declare function isSensitiveLabelField(entity: EntityDefinition, field: string): boolean;
+export declare function holdsCiphertextOrSecret(entity: EntityDefinition, field: string): boolean;
 export declare function isListFilterAllowed(entity: EntityDefinition, field: string, filter: {
     readonly op: string;
     readonly value: unknown;

package/dist/db/entity-field-encryption.js

@@ -24,7 +24,7 @@ export function isSensitiveLabelField(entity, field) {
 }
 // A `sensitive` (find: "secret") field is never comparable either, even while its value is still
 // legacy plaintext.
-function holdsCiphertextOrSecret(entity, field) {
+export function holdsCiphertextOrSecret(entity, field) {
     const def = entity.fields[field];
     if (def === undefined)
         return false;

package/dist/db/entity-table-meta.js

@@ -210,30 +210,48 @@ export function resolveTableName(entityName, entity, featureName) {
 export function deriveEntityTableMeta(entityName, entity, options) {
     const tableName = resolveTableName(entityName, entity, options?.featureName);
     const source = options?.source ?? "managed";
-    if (source === "unmanaged") {
-        assertUnmanagedTableName(tableName, "deriveEntityTableMeta");
-    }
     const idType = entity.idType ?? "uuid";
-    if (source === "unmanaged" && idType === "serial") {
-        // Unmanaged direct-write stores bypass validateRecordOwnedSubjects (it only walks
-        // feature.entities), yet encryptForDirectWrite still keys recordOwned and
-        // whenAbsent: "self" fields as `record:<entity>:<id>`; forgetSubject requires a UUID,
-        // so the value could never be shredded.
-        const recordOwnedField = Object.entries(entity.fields).find(([, field]) => isRecordKeyedField(field));
-        if (recordOwnedField) {
-            throw new Error(`deriveEntityTableMeta("${entityName}", { source: "unmanaged" }): field "${recordOwnedField[0]}" is recordOwned (or whenAbsent: "self") but the entity declares idType: "serial" — the record subject key is "record:${entityName}:<id>" and forgetSubject validates that id as a UUID, so this field could never be shredded. Use idType: "uuid", or give the field a different personal stance.`);
-        }
+    if (source === "unmanaged")
+        assertUnmanagedRules(entityName, entity, tableName, idType);
+    const layout = collectEntityColumns(entity, idType);
+    const indexes = [
+        { name: `${tableName}_tenant_id_idx`, columns: ["tenant_id"] },
+        ...foreignKeyIndexes(tableName, entity, options?.relations, layout.fieldNameToSnake),
+        ...blindIndexIndexes(tableName, layout.bidxSnakeByFieldSnake),
+        ...declaredIndexes(tableName, entity, layout),
+    ];
+    const piiSubjectFields = collectPiiEncryptedFields(entity);
+    const meta = {
+        tableName,
+        columns: layout.columns,
+        indexes,
+        source,
+        ...(piiSubjectFields.length > 0 && { piiSubjectFields }),
+        ...(entity.tenancy === "global" && { tenancy: "global" }),
+    };
+    return source === "unmanaged" ? brandWritable(meta) : meta;
+}
+function assertUnmanagedRules(entityName, entity, tableName, idType) {
+    assertUnmanagedTableName(tableName, "deriveEntityTableMeta");
+    if (idType === "serial")
+        assertRecordSubjectsShreddable(entityName, entity);
+}
+// Unmanaged direct-write stores bypass validateRecordOwnedSubjects (it only walks
+// feature.entities), yet encryptForDirectWrite still keys recordOwned and
+// whenAbsent: "self" fields as `record:<entity>:<id>`; forgetSubject requires a UUID,
+// so the value could never be shredded.
+function assertRecordSubjectsShreddable(entityName, entity) {
+    const recordOwnedField = Object.entries(entity.fields).find(([, field]) => isRecordKeyedField(field));
+    if (recordOwnedField) {
+        throw new Error(`deriveEntityTableMeta("${entityName}", { source: "unmanaged" }): field "${recordOwnedField[0]}" is recordOwned (or whenAbsent: "self") but the entity declares idType: "serial" — the record subject key is "record:${entityName}:<id>" and forgetSubject validates that id as a UUID, so this field could never be shredded. Use idType: "uuid", or give the field a different personal stance.`);
     }
-    // Base columns first, then user-fields. User-fields with the same
-    // pg-name as a base-column OVERRIDE the base-column (last-wins, same
-    // behavior as drizzle's `{ ...base, ...fields }` spread in the table
-    // builder). Use case: user-session has `tenantId` as a field to enforce
-    // access control, fileRef has `insertedAt` as a field for sortable/
-    // filterable marking. The DB column stays the same, only the application
-    // metadata on the field side changes.
-    const baseCols = fullBaseColumns(idType, entity.softDelete === true);
+}
+// A field column with a base column's pg name overrides it in place (last wins,
+// like `{ ...base, ...fields }`): user-session declares `tenantId` for access
+// control, fileRef `insertedAt` for sort/filter flags; the DB column is unchanged.
+function collectEntityColumns(entity, idType) {
     const colByName = new Map();
-    for (const c of baseCols)
+    for (const c of fullBaseColumns(idType, entity.softDelete === true))
         colByName.set(c.name, c);
     const fieldNameToSnake = new Map();
     const bidxSnakeByFieldSnake = new Map();
@@ -242,8 +260,7 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         for (const c of fieldCols)
             colByName.set(c.name, c);
         // Multi-column fields map to their primary column when its name IS the
-        // field's snake (text+bidx, money+currency) — matches the toSnakeCase
-        // fallback below, so explicit indexes keep resolving.
+        // field's snake (text+bidx, money+currency), so explicit indexes keep resolving.
         const primary = fieldCols[0];
         if (primary && primary.name === toSnakeCase(name))
             fieldNameToSnake.set(name, primary.name);
@@ -251,101 +268,77 @@ export function deriveEntityTableMeta(entityName, entity, options) {
         if (primary && bidxCol)
             bidxSnakeByFieldSnake.set(primary.name, bidxCol.name);
     }
-    // Preserve base-col order, then any new user-col-names in fields-order.
-    const columns = [];
-    const seen = new Set();
-    for (const c of baseCols) {
-        const final = colByName.get(c.name);
-        if (final && !seen.has(final.name)) {
-            columns.push(final);
-            seen.add(final.name);
-        }
-    }
-    for (const c of colByName.values()) {
-        if (!seen.has(c.name)) {
-            columns.push(c);
-            seen.add(c.name);
-        }
-    }
-    const indexes = [{ name: `${tableName}_tenant_id_idx`, columns: ["tenant_id"] }];
-    // FK-Indexes: file/image-Felder + belongsTo-Relations
+    // Map insertion order keeps base columns first (overrides stay in place), then new field columns.
+    return { columns: [...colByName.values()], fieldNameToSnake, bidxSnakeByFieldSnake };
+}
+function foreignKeyIndexes(tableName, entity, relations, fieldNameToSnake) {
     const fkSnakeNames = new Set();
     for (const [name, field] of Object.entries(entity.fields)) {
         if (field.type === "file" || field.type === "image")
             fkSnakeNames.add(toSnakeCase(name));
     }
-    if (options?.relations) {
-        for (const rel of Object.values(options.relations)) {
-            if (rel.type === "belongsTo") {
-                const snake = fieldNameToSnake.get(rel.foreignKey) ?? toSnakeCase(rel.foreignKey);
-                fkSnakeNames.add(snake);
-            }
-        }
-    }
-    for (const snake of fkSnakeNames) {
-        indexes.push({ name: `${tableName}_${snake}_idx`, columns: [snake] });
-    }
-    // lookupable fields: index on the bidx column — the query compiler's
-    // OR rewrite hits it on every equality lookup.
-    for (const bidxSnake of bidxSnakeByFieldSnake.values()) {
-        indexes.push({ name: `${tableName}_${bidxSnake}_idx`, columns: [bidxSnake] });
-    }
-    // Explicitly declared indexes (EntityIndexDef). `def.where` is a
-    // SqlExpression (`sql\`…\`` from @cosmicdrift/kumiko-framework/db) —
-    // renderable via `.text`. Unknown where-shapes stay needsManualWhere.
-    for (const def of entity.indexes ?? []) {
-        const cols = def.columns.map((fieldName) => fieldNameToSnake.get(fieldName) ?? toSnakeCase(fieldName));
-        const suffix = def.unique === true ? "unique" : "idx";
-        const indexName = def.name ?? `${tableName}_${cols.join("_")}_${suffix}`;
-        const explicitWhereSql = sqlExpressionText(def.where);
-        // Soft-deleted rows keep their value, so a full unique index would
-        // permanently block reuse; kept in lock-step with table-builder.ts.
-        const whereSql = explicitWhereSql ??
-            (def.where === undefined && def.unique === true && entity.softDelete === true
-                ? SOFT_DELETE_LIVE_ROW_PREDICATE
-                : undefined);
-        indexes.push({
-            name: indexName,
-            columns: cols,
-            ...(def.unique === true && { unique: true }),
-            ...(whereSql !== undefined && { whereSql }),
-            ...(def.where !== undefined && explicitWhereSql === undefined && { needsManualWhere: true }),
-        });
-        // Unique index over lookupable columns: partial bidx counterpart, so
-        // uniqueness also holds for encrypted rows. The original stays
-        // for plaintext legacy rows; partial (IS NOT NULL) because bidx is
-        // NULL for erased/key-less rows.
-        if (def.unique === true && def.where === undefined) {
-            const bidxCols = cols.map((c) => bidxSnakeByFieldSnake.get(c) ?? c);
-            if (bidxCols.some((c, i) => c !== cols[i])) {
-                const notNullParts = bidxCols
-                    .filter((c, i) => c !== cols[i])
-                    .map((c) => `"${c}" IS NOT NULL`);
-                // Soft-deleted rows keep their bidx hash — without this, a restored
-                // row can't reuse a value a soft-deleted sibling still holds
-                // Kept in lock-step with table-builder.ts.
-                const whereParts = entity.softDelete === true
-                    ? [...notNullParts, SOFT_DELETE_LIVE_ROW_PREDICATE]
-                    : notNullParts;
-                indexes.push({
-                    name: `${indexName}_bidx`,
-                    columns: bidxCols,
-                    unique: true,
-                    whereSql: whereParts.join(" AND "),
-                });
-            }
+    for (const rel of Object.values(relations ?? {})) {
+        if (rel.type === "belongsTo") {
+            fkSnakeNames.add(fieldNameToSnake.get(rel.foreignKey) ?? toSnakeCase(rel.foreignKey));
         }
     }
-    const piiSubjectFields = collectPiiEncryptedFields(entity);
-    const meta = {
-        tableName,
-        columns,
-        indexes,
-        source,
-        ...(piiSubjectFields.length > 0 && { piiSubjectFields }),
-        ...(entity.tenancy === "global" && { tenancy: "global" }),
+    return [...fkSnakeNames].map((snake) => ({
+        name: `${tableName}_${snake}_idx`,
+        columns: [snake],
+    }));
+}
+// The query compiler's OR rewrite hits the bidx column on every equality lookup.
+function blindIndexIndexes(tableName, bidxSnakeByFieldSnake) {
+    return [...bidxSnakeByFieldSnake.values()].map((bidxSnake) => ({
+        name: `${tableName}_${bidxSnake}_idx`,
+        columns: [bidxSnake],
+    }));
+}
+function declaredIndexes(tableName, entity, layout) {
+    return (entity.indexes ?? []).flatMap((def) => declaredIndexWithBidxCounterpart(tableName, entity, def, layout));
+}
+// `def.where` is a SqlExpression renderable via `.text`; unknown where-shapes
+// stay needsManualWhere.
+function declaredIndexWithBidxCounterpart(tableName, entity, def, layout) {
+    const cols = def.columns.map((fieldName) => layout.fieldNameToSnake.get(fieldName) ?? toSnakeCase(fieldName));
+    const suffix = def.unique === true ? "unique" : "idx";
+    const indexName = def.name ?? `${tableName}_${cols.join("_")}_${suffix}`;
+    const explicitWhereSql = sqlExpressionText(def.where);
+    // Soft-deleted rows keep their value, so a full unique index would
+    // permanently block reuse; kept in lock-step with table-builder.ts.
+    const whereSql = explicitWhereSql ??
+        (def.where === undefined && def.unique === true && entity.softDelete === true
+            ? SOFT_DELETE_LIVE_ROW_PREDICATE
+            : undefined);
+    const declared = {
+        name: indexName,
+        columns: cols,
+        ...(def.unique === true && { unique: true }),
+        ...(whereSql !== undefined && { whereSql }),
+        ...(def.where !== undefined && explicitWhereSql === undefined && { needsManualWhere: true }),
+    };
+    if (def.unique !== true || def.where !== undefined)
+        return [declared];
+    const counterpart = bidxUniqueCounterpart(indexName, cols, entity.softDelete === true, layout.bidxSnakeByFieldSnake);
+    return counterpart ? [declared, counterpart] : [declared];
+}
+// Unique index over lookupable columns gets a partial bidx counterpart so
+// uniqueness also holds for encrypted rows; IS NOT NULL because bidx is NULL
+// for erased/key-less rows.
+function bidxUniqueCounterpart(indexName, cols, softDelete, bidxSnakeByFieldSnake) {
+    const bidxCols = cols.map((c) => bidxSnakeByFieldSnake.get(c) ?? c);
+    const notNullParts = bidxCols.filter((c, i) => c !== cols[i]).map((c) => `"${c}" IS NOT NULL`);
+    if (notNullParts.length === 0)
+        return undefined;
+    // Soft-deleted rows keep their bidx hash, so without the live-row predicate a
+    // restored row could not reuse a value a soft-deleted sibling still holds.
+    const whereParts = softDelete ? [...notNullParts, SOFT_DELETE_LIVE_ROW_PREDICATE] : notNullParts;
+    return {
+        name: `${indexName}_bidx`,
+        columns: bidxCols,
+        unique: true,
+        whereSql: whereParts.join(" AND "),
     };
-    return source === "unmanaged" ? brandWritable(meta) : meta;
 }
 function sqlExpressionText(where) {
     return isSqlExpression(where) ? where.text : undefined;

package/dist/db/event-store-executor-context.d.ts

@@ -1,3 +1,4 @@
+import type { ErasedSubjectHandling } from "../crypto/pii-field-encryption.ts";
 import type { WhereObject } from "../db/query.ts";
 import type { EntityDefinition, EntityId, SessionUser, TenantId } from "../engine/types/index.ts";
 import { type WriteFailure } from "../errors/index.ts";
@@ -62,7 +63,7 @@ export type ExecutorContext = {
         subjectSource?: Record<string, unknown>;
         keyTenantId?: TenantId | undefined;
         ownerFallback?: Record<string, unknown>;
-        onErasedSubject?: "sentinel";
+        onErasedSubject?: ErasedSubjectHandling;
     }) => Promise<Record<string, unknown>>;
     readonly decryptForRead: (row: Record<string, unknown>, opts?: DecryptForReadOptions) => Promise<Record<string, unknown>>;
     readonly ownerTransitionRekeys: (previous: Record<string, unknown>, mergedNew: Record<string, unknown>, submittedChanges: Record<string, unknown>) => Record<string, unknown>;

package/dist/db/event-store-executor-read-aggregate.d.ts

@@ -0,0 +1,8 @@
+import type { ListAggregatePayload, ListAggregateResult } from "@cosmicdrift/kumiko-types/list-aggregate-types";
+import type { SessionUser } from "../engine/types/index.ts";
+import type { ExecutorContext } from "./event-store-executor-context.ts";
+import { type ListRuntimeOptions, type ListWherePayload } from "./event-store-executor-read-where.ts";
+import type { TenantDb } from "./tenant-db.ts";
+export declare function aggregateList(ctx: ExecutorContext, payload: ListWherePayload & {
+    readonly aggregate: ListAggregatePayload;
+}, user: SessionUser, db: TenantDb, runtimeOptions: ListRuntimeOptions | undefined): Promise<ListAggregateResult>;

package/dist/db/event-store-executor-read-aggregate.js

@@ -0,0 +1,112 @@
+import { ValidationError } from "../errors/index.js";
+import { aggregateKeyOf, decodeListAggregateValue, emptyListAggregateValue, groupedKeyOrderLimitSql, isListAggregateGroupable, isListAggregateMeasureSupported, listAggregateKeySql, listAggregateMeasureSql, } from "./aggregate-sql.js";
+import { holdsCiphertextOrSecret } from "./entity-field-encryption.js";
+import { appendShiftedClause, bindShiftedClause, } from "./event-store-executor-read-filter.js";
+import { buildListWhere, createFieldReadClause, } from "./event-store-executor-read-where.js";
+import { executeRawQueryRead } from "./queries/raw-sql.js";
+import { schemaTableName } from "./table-introspection.js";
+import { tenantDbRunner } from "./tenant-db-runner.js";
+// One group more than the cap is fetched to tell "exactly 200" from "more".
+const MAX_AGGREGATE_GROUPS = 200;
+function rejectAggregate(path, field, hint) {
+    throw new ValidationError({
+        fields: [
+            {
+                path,
+                code: "field_not_aggregatable",
+                i18nKey: "errors.validation.invalid_value",
+                params: { field, hint },
+            },
+        ],
+    });
+}
+// Unknown and unreadable fields share one silent outcome so the response cannot
+// confirm that a field exists; only then are the sensitive-field and type gates applied.
+function gateField(ctx, fieldReadClause, field, path) {
+    const def = ctx.entity.fields[field];
+    if (def === undefined ||
+        !Object.hasOwn(ctx.entity.fields, field) ||
+        !Object.hasOwn(ctx.table, field))
+        return { kind: "silent" };
+    const clause = fieldReadClause(field);
+    if (clause.kind === "empty")
+        return { kind: "silent" };
+    if (holdsCiphertextOrSecret(ctx.entity, field)) {
+        rejectAggregate(path, field, "Encrypted, personal and secret fields cannot be aggregated.");
+    }
+    return { kind: "ok", def, clause };
+}
+function planAggregate(ctx, fieldReadClause, aggregate) {
+    const groupBy = aggregate.groupBy === undefined
+        ? undefined
+        : {
+            field: aggregate.groupBy,
+            gate: gateField(ctx, fieldReadClause, aggregate.groupBy, "aggregate.groupBy"),
+        };
+    if (groupBy?.gate.kind === "ok") {
+        const { def } = groupBy.gate;
+        const multiple = def.type === "reference" && def.multiple === true;
+        if (!isListAggregateGroupable(def.type, multiple)) {
+            rejectAggregate("aggregate.groupBy", groupBy.field, "This field type cannot be grouped by.");
+        }
+    }
+    const measures = aggregate.measures.map((m, i) => {
+        const path = `aggregate.measures.${i}`;
+        const gate = gateField(ctx, fieldReadClause, m.field, path);
+        if (gate.kind === "ok" && !isListAggregateMeasureSupported(m.kind, gate.def.type)) {
+            rejectAggregate(path, m.field, `"${m.kind}" is not supported on a ${gate.def.type} field.`);
+        }
+        return { kind: m.kind, field: m.field, gate };
+    });
+    return { groupBy, measures };
+}
+function emptyMeasureValues(plan) {
+    return plan.measures.map((m) => m.gate.kind === "silent" ? null : emptyListAggregateValue(m.kind));
+}
+function renderSelectList(plan, where) {
+    const parts = [];
+    if (plan.groupBy?.gate.kind === "ok") {
+        const { def, clause } = plan.groupBy.gate;
+        parts.push(listAggregateKeySql(def.type, where.colSql(plan.groupBy.field), "k0"));
+        // WHERE, not CASE: rows the viewer may not read must not collapse into the real NULL group.
+        if (clause.kind === "sql")
+            appendShiftedClause(where, clause);
+    }
+    parts.push("COUNT(*)::float8 AS c");
+    for (const [i, m] of plan.measures.entries()) {
+        if (m.gate.kind === "silent")
+            continue; // skip: an unreadable measure stays out of the SELECT and decodes to null
+        const filterSql = m.gate.clause.kind === "sql" ? bindShiftedClause(where.params, m.gate.clause) : undefined;
+        parts.push(`${listAggregateMeasureSql(m.kind, m.gate.def.type, where.colSql(m.field), filterSql)} AS m${i}`);
+    }
+    return parts.join(", ");
+}
+export async function aggregateList(ctx, payload, user, db, runtimeOptions) {
+    const plan = planAggregate(ctx, createFieldReadClause(ctx, user), payload.aggregate);
+    const grouped = plan.groupBy !== undefined;
+    if (plan.groupBy?.gate.kind === "silent")
+        return { groups: [] };
+    const built = await buildListWhere(ctx, payload, user, db, runtimeOptions);
+    if (built.kind === "empty") {
+        return {
+            groups: grouped ? [] : [{ key: null, count: 0, measures: emptyMeasureValues(plan) }],
+        };
+    }
+    const { where, searchTruncated } = built;
+    const selectList = renderSelectList(plan, where);
+    const whereText = where.whereSql.length > 0 ? ` WHERE ${where.whereSql.join(" AND ")}` : "";
+    const groupText = grouped ? groupedKeyOrderLimitSql(MAX_AGGREGATE_GROUPS + 1) : "";
+    const tableName = String(schemaTableName(ctx.table));
+    const rows = await executeRawQueryRead(tenantDbRunner(db), `SELECT ${selectList} FROM "${tableName}"${whereText}${groupText}`, where.params);
+    const truncated = rows.length > MAX_AGGREGATE_GROUPS;
+    const groups = rows.slice(0, MAX_AGGREGATE_GROUPS).map((row) => ({
+        key: grouped ? aggregateKeyOf(row["k0"]) : null,
+        count: Number(row["c"]),
+        measures: plan.measures.map((m, i) => m.gate.kind === "silent" ? null : decodeListAggregateValue(row[`m${i}`])),
+    }));
+    return {
+        groups,
+        ...(truncated && { truncated: true }),
+        ...(searchTruncated && { searchTruncated: true }),
+    };
+}

package/dist/db/event-store-executor-read-filter.d.ts

@@ -0,0 +1,31 @@
+import { type OwnershipClause } from "../engine/ownership.ts";
+import type { EntityDefinition } from "../engine/types/index.ts";
+import { type Table } from "./event-store-executor-context.ts";
+export type ListWhere = {
+    readonly whereSql: string[];
+    readonly params: unknown[];
+    readonly colSql: (field: string) => string;
+};
+export declare function bindShiftedClause(params: unknown[], clause: {
+    readonly sqlText: string;
+    readonly params: readonly unknown[];
+}): string;
+export declare function appendShiftedClause(where: ListWhere, clause: {
+    readonly sqlText: string;
+    readonly params: readonly unknown[];
+}): void;
+export declare function bindPlaceholders(params: unknown[], values: readonly unknown[]): string;
+export type ListFilter = {
+    readonly field: string;
+    readonly op: "eq" | "ne" | "lt" | "gt" | "lte" | "gte" | "in";
+    readonly value: unknown;
+};
+export declare function deriveParentNarrowTypes(entity: EntityDefinition, payload: {
+    readonly filter?: ListFilter;
+    readonly filters?: readonly ListFilter[];
+}): ReadonlySet<string> | undefined;
+export declare function collectListFilters(payload: {
+    readonly filter?: ListFilter | undefined;
+    readonly filters?: readonly ListFilter[] | undefined;
+}): readonly ListFilter[];
+export declare function applyListFilter(where: ListWhere, f: ListFilter, table: Table, entity: EntityDefinition, fieldReadClause: (field: string) => OwnershipClause): void;