@dudousxd/nestjs-catalog 0.13.0 → 0.15.0

package/dist/catalog.controller.js

@@ -13,8 +13,9 @@ var __param = (this && this.__param) || function (paramIndex, decorator) {
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.createCatalogController = createCatalogController;
+const node_stream_1 = require("node:stream");
 const common_1 = require("@nestjs/common");
-const catalog_query_cache_1 = require("./catalog.query-cache");
+const catalog_csv_1 = require("./catalog.csv");
 const catalog_registry_base_1 = require("./catalog.registry.base");
 const catalog_route_auth_1 = require("./catalog.route-auth");
 const catalog_service_1 = require("./catalog.service");
@@ -191,7 +192,7 @@ function createCatalogController(path, guards, decorators = []) {
             return this.registry.getSnapshot();
         }
         /** One generic read endpoint for every type in the catalog. */
-        objects(name, page, size, search, sort, dir, snapshot) {
+        objects(name, page, size, search, sort, dir, snapshot, filter) {
             return this.service.readObjects(name, {
                 page: page ? Number(page) : undefined,
                 size: size ? Number(size) : undefined,
@@ -199,6 +200,7 @@ function createCatalogController(path, guards, decorators = []) {
                 sort,
                 dir: dir === 'desc' ? 'desc' : 'asc',
                 snapshot,
+                filters: repeatable(filter),
             });
         }
         /**
@@ -273,17 +275,60 @@ function createCatalogController(path, guards, decorators = []) {
             return this.service.runSavedQuery(id, body?.maxRows);
         }
         /**
-         * The same result as CSV.
+         * The same result as CSV, written out as the rows arrive.
          *
          * A GET, not a POST, so it can be a plain link — a download that only works
          * from JavaScript cannot be pasted into a mail or a scheduled job.
+         *
+         * **Nothing here holds the file.** This used to run the query, hold the
+         * result, build the whole CSV string and then answer — which is the shape
+         * that made a 981,469-row connector load never finish, and it is worse on an
+         * export than on a load, because an export has no row cap by design. Now
+         * `streamSavedQuery` hands over rows, {@link csvLines} turns each into a
+         * line, and the response is written from that.
+         *
+         * **`@Res({ passthrough: true })` is still right, and the returned value is
+         * what had to change.** Passthrough means "I am setting headers, you send
+         * the body", and that is exactly what this handler wants. What it must not
+         * return any more is a string: the express adapter answers a string body
+         * with `res.send()`, which sets `content-length` — and a length header is a
+         * promise about a body nobody has counted yet. A `StreamableFile` is the
+         * body shape the adapter pipes instead, and `applyStreamHeaders` sets a
+         * length only when the `StreamableFile` was given one, which this is not. So
+         * the response is chunked and carries no `content-length`. Taking the
+         * response over with a bare `@Res()` and pumping it by hand would work too,
+         * and would name a platform: this package peer-depends on `@nestjs/common`
+         * and `@nestjs/core` and on no adapter, so a hand-written `write`/`drain`
+         * loop would be one adapter's API written into a library that deliberately
+         * does not have one. A `StreamableFile` leaves the piping to whichever
+         * adapter the host mounted.
+         *
+         * The pipe is also what bounds the memory: `Readable.from` stops pulling
+         * from the generator once its buffer is full, the pipe stops reading once
+         * the socket says wait, and the generator stops pulling from the store. A
+         * client that reads slowly slows the database read down rather than filling
+         * this process with the rows it has not collected.
          */
         async exportSavedQuery(id, response) {
-            const { savedQuery, result } = await this.service.runSavedQuery(id);
+            const { savedQuery, columns, rows } = await this.service.streamSavedQuery(id);
             const filename = `${savedQuery.name.replace(/[^A-Za-z0-9_-]+/g, '-')}.csv`;
             response.setHeader('content-type', 'text/csv; charset=utf-8');
             response.setHeader('content-disposition', `attachment; filename="${filename}"`);
-            return (0, catalog_query_cache_1.toCsv)(result);
+            // Byte mode rather than object mode, so the readable's own high-water mark
+            // is measured in bytes: the lines coalesce into socket-sized writes on
+            // their way out, instead of one write per row for however many rows the
+            // table has.
+            const file = node_stream_1.Readable.from((0, catalog_csv_1.csvLines)(rows, columns), { objectMode: false });
+            // `pipe` unpipes a dead destination and leaves the SOURCE alone, which
+            // here means an operator who closes the download tab leaves this generator
+            // parked mid-`yield` — and with it, in the shipped MySQL store, an open
+            // read-only transaction on a pooled connection, for the life of the
+            // process. Destroying the readable is what calls the generator's `return`,
+            // which is what runs the `finally` the store put its rollback in. Fires on
+            // an ordinary completion too, where destroying a finished stream is a
+            // no-op.
+            response.on('close', () => file.destroy());
+            return new common_1.StreamableFile(file);
         }
         /**
          * Every SQL this query has ever been, newest first.
@@ -492,8 +537,9 @@ function createCatalogController(path, guards, decorators = []) {
         __param(4, (0, common_1.Query)('sort')),
         __param(5, (0, common_1.Query)('dir')),
         __param(6, (0, common_1.Query)('snapshot')),
+        __param(7, (0, common_1.Query)('filter')),
         __metadata("design:type", Function),
-        __metadata("design:paramtypes", [String, String, String, String, String, String, String]),
+        __metadata("design:paramtypes", [String, String, String, String, String, String, String, Object]),
         __metadata("design:returntype", void 0)
     ], CatalogController.prototype, "objects", null);
     __decorate([
@@ -739,6 +785,20 @@ function actorOf(request, claimed) {
         return resolved;
     return claimed?.trim() || 'console';
 }
+/**
+ * A query parameter that may appear once or many times, as a list either way.
+ *
+ * Unlike {@link parseOutcomes} below, nothing is split on commas and nothing is
+ * dropped. A filter's value is free text that may contain a comma — a
+ * description, a date range written by hand — and an unrecognised filter must
+ * reach the service so it can be refused by name rather than vanish into an
+ * unfiltered page.
+ */
+function repeatable(raw) {
+    if (raw === undefined)
+        return undefined;
+    return Array.isArray(raw) ? raw : [raw];
+}
 /**
  * `?outcome=failed`, `?outcome=failed,incomplete`, `?outcome=a&outcome=b`.
  *

package/dist/catalog.csv.d.ts

@@ -0,0 +1,89 @@
+/**
+ * CSV, for the export button.
+ *
+ * Two things here are not the obvious implementation, and both are here because
+ * the obvious one was wrong in production.
+ *
+ * **Rows are written as they arrive.** {@link csvLines} is a generator over an
+ * async row source, so the caller can hand each line to a socket and never hold
+ * the file. The buffered {@link toCsv} is still exported — it is public API and
+ * a caller with a result already in memory has nothing to gain from a stream —
+ * but it is now the special case rather than the only shape.
+ *
+ * **A cell that a spreadsheet would run is neutralised.** See
+ * {@link guardFormula}.
+ */
+/** One row of a result, as every store hands it over. */
+export type CsvRow = Record<string, unknown>;
+/**
+ * Stop a cell being executed when the file is opened.
+ *
+ * A CSV is not a document format, it is a program that a spreadsheet is willing
+ * to run. A cell whose value begins with one of {@link FORMULA_LEADERS} is
+ * evaluated on open, and the values in this file come from whatever the queried
+ * source contained — which for this catalog is other people's operational data,
+ * loaded by connectors, from systems nobody here controls. So the crafted cell
+ * is not a thought experiment: it is one row in a table an operator exports and
+ * opens.
+ *
+ * **The escape is a leading apostrophe, and it is not free.** Excel and Sheets
+ * both read `'` as "the rest is literal text" and do not show it in the cell;
+ * every other reader on earth — a parser, a `pandas.read_csv`, the next
+ * pipeline that ingests this export — sees an apostrophe that was not in the
+ * source. That is a real corruption, and it is why the guard is not applied to
+ * every cell that merely starts with a leader.
+ *
+ * **So a value that is plainly a number is left exactly as it was.** `-42` is
+ * not an injection vector: a spreadsheet evaluates it to the number -42, which
+ * is what it already was. Exempting it is what lets a machine read this file
+ * back and still get -42, and it costs no safety, because the population being
+ * defended against — `=`, `@`, an operator followed by anything that is not a
+ * number — is disjoint from it. Everything outside the exemption gets the
+ * apostrophe and reads differently to a parser than it did to the database.
+ * That trade is deliberate: a wrong apostrophe is a data-quality bug somebody
+ * can see, and a formula is code running on the machine of whoever opened the
+ * file.
+ *
+ * The apostrophe goes at position 0, in front of any leading blank, because
+ * that is the only position a spreadsheet honours it in.
+ */
+export declare function guardFormula(text: string): string;
+/**
+ * One cell, ready to sit in a row.
+ *
+ * Order matters and is the second thing people get wrong. The formula guard
+ * runs on the raw text, and the CSV quoting runs on the result — so a value that
+ * needs both comes out as `"'=1+1,x"`, with the apostrophe INSIDE the quotes and
+ * applied once. Doing it the other way round would put the apostrophe outside
+ * the quoting and produce a field no CSV reader can parse; doing it twice would
+ * put two apostrophes in a cell that needed one.
+ */
+export declare function csvCell(value: unknown): string;
+/**
+ * A CSV file, one line at a time, from a source that hands rows over as it has
+ * them.
+ *
+ * Each yield is a complete line including its terminator, so a consumer can
+ * write it and forget it. Nothing accumulates here: the generator holds one row
+ * and the column list, whatever the source is doing, which is the whole point —
+ * an export has no row cap by design, so the only bound available is that no
+ * stage keeps more than it is using.
+ *
+ * `columns` may be omitted, and then the header is taken from the keys of the
+ * first row — the same rule the buffered read uses, applied at the only moment a
+ * stream can apply it. A source that knows its columns up front should pass
+ * them, because it is the only way an empty result gets a header row at all.
+ */
+export declare function csvLines(rows: AsyncIterable<CsvRow>, columns?: readonly string[]): AsyncGenerator<string>;
+/**
+ * The whole file as a string.
+ *
+ * Kept because it is public API and because a caller holding a finished result
+ * gains nothing from a stream. It is NOT what the export route uses — see
+ * {@link csvLines} — and a caller reaching for it with an unbounded result is
+ * choosing to hold the file.
+ */
+export declare function toCsv(result: {
+    columns: string[];
+    rows: CsvRow[];
+}): string;

package/dist/catalog.csv.js

@@ -0,0 +1,163 @@
+"use strict";
+/**
+ * CSV, for the export button.
+ *
+ * Two things here are not the obvious implementation, and both are here because
+ * the obvious one was wrong in production.
+ *
+ * **Rows are written as they arrive.** {@link csvLines} is a generator over an
+ * async row source, so the caller can hand each line to a socket and never hold
+ * the file. The buffered {@link toCsv} is still exported — it is public API and
+ * a caller with a result already in memory has nothing to gain from a stream —
+ * but it is now the special case rather than the only shape.
+ *
+ * **A cell that a spreadsheet would run is neutralised.** See
+ * {@link guardFormula}.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.guardFormula = guardFormula;
+exports.csvCell = csvCell;
+exports.csvLines = csvLines;
+exports.toCsv = toCsv;
+/**
+ * The characters a spreadsheet reads as "what follows is a formula".
+ *
+ * `=` is the obvious one. `+`, `-` and `@` are the ones people forget: Excel and
+ * Sheets both accept a leading `+` or `-` as the start of an expression, and `@`
+ * introduces a function reference. `-2+3+cmd|' /C calc'!A0` is a working command
+ * execution in an unpatched Excel, and it starts with a minus sign.
+ */
+const FORMULA_LEADERS = new Set(['=', '+', '-', '@']);
+/**
+ * Blank a spreadsheet strips before it decides whether a cell is a formula.
+ *
+ * The reason this exists rather than a plain `text[0]` test: importers do not
+ * agree on whether leading blank is part of the value. Several strip it and then
+ * dispatch on what is left, so `  =1+1` is a formula to them and an innocent
+ * string to a guard that only looked at position zero. Guarding the stripped
+ * form costs nothing on values that were never formulas.
+ */
+const LEADING_BLANK = /^[\t\n\v\f\r  ]+/;
+/**
+ * A value a spreadsheet will read back as the number it already is.
+ *
+ * This is the exemption that keeps the guard from corrupting data — see
+ * {@link guardFormula}. Deliberately narrow: an optional sign, digits with at
+ * most one point, an optional exponent, and nothing else. `-42` matches.
+ * `-42abc` does not, `- 42` does not, and `-2+3+cmd|' /C calc'!A0` does not.
+ */
+const PLAIN_NUMBER = /^[+-]?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+)?$/;
+/**
+ * Stop a cell being executed when the file is opened.
+ *
+ * A CSV is not a document format, it is a program that a spreadsheet is willing
+ * to run. A cell whose value begins with one of {@link FORMULA_LEADERS} is
+ * evaluated on open, and the values in this file come from whatever the queried
+ * source contained — which for this catalog is other people's operational data,
+ * loaded by connectors, from systems nobody here controls. So the crafted cell
+ * is not a thought experiment: it is one row in a table an operator exports and
+ * opens.
+ *
+ * **The escape is a leading apostrophe, and it is not free.** Excel and Sheets
+ * both read `'` as "the rest is literal text" and do not show it in the cell;
+ * every other reader on earth — a parser, a `pandas.read_csv`, the next
+ * pipeline that ingests this export — sees an apostrophe that was not in the
+ * source. That is a real corruption, and it is why the guard is not applied to
+ * every cell that merely starts with a leader.
+ *
+ * **So a value that is plainly a number is left exactly as it was.** `-42` is
+ * not an injection vector: a spreadsheet evaluates it to the number -42, which
+ * is what it already was. Exempting it is what lets a machine read this file
+ * back and still get -42, and it costs no safety, because the population being
+ * defended against — `=`, `@`, an operator followed by anything that is not a
+ * number — is disjoint from it. Everything outside the exemption gets the
+ * apostrophe and reads differently to a parser than it did to the database.
+ * That trade is deliberate: a wrong apostrophe is a data-quality bug somebody
+ * can see, and a formula is code running on the machine of whoever opened the
+ * file.
+ *
+ * The apostrophe goes at position 0, in front of any leading blank, because
+ * that is the only position a spreadsheet honours it in.
+ */
+function guardFormula(text) {
+    if (text.length === 0)
+        return text;
+    // A literal tab or carriage return in first position is itself treated as a
+    // leader by some importers, which strip it and evaluate what follows.
+    const leadingControl = text[0] === '\t' || text[0] === '\r';
+    const body = text.replace(LEADING_BLANK, '');
+    if (body.length === 0)
+        return text;
+    if (!leadingControl && !FORMULA_LEADERS.has(body[0]))
+        return text;
+    return PLAIN_NUMBER.test(body) ? text : `'${text}`;
+}
+/**
+ * One cell, ready to sit in a row.
+ *
+ * Order matters and is the second thing people get wrong. The formula guard
+ * runs on the raw text, and the CSV quoting runs on the result — so a value that
+ * needs both comes out as `"'=1+1,x"`, with the apostrophe INSIDE the quotes and
+ * applied once. Doing it the other way round would put the apostrophe outside
+ * the quoting and produce a field no CSV reader can parse; doing it twice would
+ * put two apostrophes in a cell that needed one.
+ */
+function csvCell(value) {
+    if (value === null || value === undefined)
+        return '';
+    const text = typeof value === 'object' ? JSON.stringify(value) : String(value);
+    const guarded = guardFormula(text);
+    // Quote when the value could otherwise break the row apart. Doubling the
+    // quote is the CSV escape, not a backslash.
+    return /[",\n\r]/.test(guarded) ? `"${guarded.replace(/"/g, '""')}"` : guarded;
+}
+/** CRLF: Excel still treats a bare LF file as one long row in some locales. */
+const EOL = '\r\n';
+function csvLine(cells) {
+    return `${cells.join(',')}${EOL}`;
+}
+/**
+ * A CSV file, one line at a time, from a source that hands rows over as it has
+ * them.
+ *
+ * Each yield is a complete line including its terminator, so a consumer can
+ * write it and forget it. Nothing accumulates here: the generator holds one row
+ * and the column list, whatever the source is doing, which is the whole point —
+ * an export has no row cap by design, so the only bound available is that no
+ * stage keeps more than it is using.
+ *
+ * `columns` may be omitted, and then the header is taken from the keys of the
+ * first row — the same rule the buffered read uses, applied at the only moment a
+ * stream can apply it. A source that knows its columns up front should pass
+ * them, because it is the only way an empty result gets a header row at all.
+ */
+async function* csvLines(rows, columns) {
+    // A declared header goes out before the source is asked for anything, so an
+    // empty result is still a file that says which columns were empty rather than
+    // zero bytes.
+    let header = columns;
+    if (header !== undefined)
+        yield csvLine(header.map(csvCell));
+    for await (const row of rows) {
+        if (header === undefined) {
+            header = Object.keys(row);
+            yield csvLine(header.map(csvCell));
+        }
+        yield csvLine(header.map((column) => csvCell(row[column])));
+    }
+}
+/**
+ * The whole file as a string.
+ *
+ * Kept because it is public API and because a caller holding a finished result
+ * gains nothing from a stream. It is NOT what the export route uses — see
+ * {@link csvLines} — and a caller reaching for it with an unbounded result is
+ * choosing to hold the file.
+ */
+function toCsv(result) {
+    const lines = [csvLine(result.columns.map(csvCell))];
+    for (const row of result.rows) {
+        lines.push(csvLine(result.columns.map((column) => csvCell(row[column]))));
+    }
+    return lines.join('');
+}

package/dist/catalog.filters.d.ts

@@ -0,0 +1,174 @@
+import type { CatalogPropertyDef, ScalarType } from './catalog.types';
+/**
+ * Filtering a catalogued type, derived from the type.
+ *
+ * **Nothing here lists a filterable column, and nothing anywhere else may.** The
+ * types this catalog serves are created at runtime — `PUT publish/:type/schema`
+ * writes the properties and the store builds the physical columns from them — so
+ * a hand-maintained list of what is filterable is a list that goes quiet the day
+ * somebody publishes a column nobody edited it for. That is the failure mode this
+ * module exists to remove: the operators a column offers are a function of the
+ * column, computed by {@link filterOperatorsFor}, and both the server (deciding
+ * what it will accept) and the console (deciding what to draw) call that one
+ * function. A screen offering a control the server would refuse, or refusing one
+ * the server would take, is then not expressible.
+ *
+ * This is also why `@dudousxd/nestjs-filter` is not what is used here. That
+ * library derives its filters from entities and routes known at compile time, and
+ * these types do not exist at compile time.
+ *
+ * **The module is pure and imports nothing but types**, because it ships to the
+ * browser through `@dudousxd/nestjs-catalog/client` — the same reason
+ * `validateWorkflow` does. A second copy of the derivation living in the console
+ * is exactly the drift that entry point exists to prevent.
+ */
+/**
+ * Every operator, in the order a control should offer them.
+ *
+ * One list, so nothing narrows a stored or transmitted operator against a second
+ * hand-maintained copy of these names — the same argument
+ * `CATALOG_SNAPSHOT_MODES` makes one file over.
+ *
+ * There is no `between`. A range is `gte` and `lte` on one property, which is two
+ * filters that compose with everything else rather than one operator that needs
+ * its own wire form, its own second value and its own "what if the ends are the
+ * wrong way round" answer.
+ */
+export declare const CATALOG_FILTER_OPERATORS: readonly ["eq", "ne", "contains", "gte", "lte", "gt", "lt", "empty", "notEmpty"];
+export type CatalogFilterOperator = (typeof CATALOG_FILTER_OPERATORS)[number];
+export declare function isCatalogFilterOperator(value: string): value is CatalogFilterOperator;
+/**
+ * The operators that take no value.
+ *
+ * "Has no value" cannot be spelled as a comparison — `= NULL` matches nothing in
+ * SQL and `= ''` misses the NULLs — so it is an operator rather than a value a
+ * caller types, and a filter carrying one is complete without a `value`.
+ */
+export declare const VALUELESS_FILTER_OPERATORS: readonly ["empty", "notEmpty"];
+export declare function filterOperatorTakesValue(operator: CatalogFilterOperator): boolean;
+/** One filter as it crosses the wire: a property name, an operator, raw text. */
+export interface CatalogObjectFilter {
+    /**
+     * The property's `name`, which is its identity in the type — never its
+     * `columnName`, and never the column the view exposes.
+     *
+     * Three names can be in play for one field and only this one identifies it: a
+     * property called `Asset Id` is stored in a column called `Asset_Id`, is
+     * exposed by the SQL console under `Asset_Id`, and may carry any `columnName`
+     * its publisher chose. A filter naming any of the others resolves to no
+     * property at all. The store is what translates this into a column, which is
+     * the only place that translation belongs.
+     */
+    property: string;
+    op: CatalogFilterOperator;
+    /** Absent for {@link VALUELESS_FILTER_OPERATORS}. Text, as it was typed. */
+    value?: string;
+}
+/**
+ * The minimum a column has to say for the rule below to run on it.
+ *
+ * Structural rather than `CatalogPropertyDef`, because the console holds the
+ * *page's* columns rather than the type's — `CatalogObjectPage.columns` — and the
+ * whole point is that both sides ask the same function. Both shapes satisfy this.
+ */
+export interface CatalogFilterableColumn {
+    name: string;
+    type: ScalarType;
+    hidden?: boolean;
+    classification?: string;
+}
+/**
+ * What may be filtered on this column, derived from what the column is.
+ *
+ * An empty list means "not filterable", and there are three ways to get one.
+ *
+ * **Hidden** is the overlay saying a column is not part of the generic UI, and a
+ * filter is generic UI.
+ *
+ * **Classified** is the one worth stating out loud, because the column is
+ * otherwise perfectly filterable and the value is never rendered anyway. It is
+ * excluded for the reason `MikroOrmReadStore.buildWhere` already excludes it from
+ * SEARCH: a predicate over a classified column leaks it through row membership.
+ * Filtering is strictly worse than searching there — `gte`/`lte` let a reader
+ * binary-search a value they may not see, in as many requests as it takes.
+ *
+ * **`json`** because a blob has no useful comparison, and it is already dropped
+ * from the readable columns by `CatalogService.visibleColumns`.
+ */
+export declare function filterOperatorsFor(column: CatalogFilterableColumn): CatalogFilterOperator[];
+/** Which operators a column offers, once the store's own limits are applied. */
+export declare function offeredFilterOperators(column: CatalogFilterableColumn, supported: readonly CatalogFilterOperator[]): CatalogFilterOperator[];
+/**
+ * `property:op:value`, repeated once per filter.
+ *
+ * The value is everything after the second colon, so it may contain colons — a
+ * timestamp does. A property name containing one cannot be addressed by this
+ * form; that is refused by name in {@link resolveObjectFilters} rather than
+ * silently mis-parsed, because a filter that quietly does not apply is a screen
+ * showing every row as though it had been filtered.
+ */
+export declare function encodeObjectFilter(filter: CatalogObjectFilter): string;
+export declare function parseObjectFilter(raw: string): CatalogObjectFilter | undefined;
+/**
+ * A filter with the property it names already resolved to the type's own.
+ *
+ * The property is carried as the definition rather than as a string, and that is
+ * the guard rather than a nicety: a store builds a predicate out of a column
+ * name, and the only names it can be handed here are ones that came off the type.
+ * A caller's string never reaches SQL — it is matched against the type first, and
+ * the store then maps the property to its physical column exactly as `sort` and
+ * `search` already do, through the adapter's identifier rule.
+ */
+export interface CatalogResolvedFilter {
+    property: CatalogPropertyDef;
+    op: CatalogFilterOperator;
+    /** Coerced to the property's type. Absent for the valueless operators. */
+    value?: string | number | boolean | Date;
+}
+export interface CatalogFilterResolution {
+    filters: CatalogResolvedFilter[];
+    /** One sentence per filter that could not be honoured. Empty means all were. */
+    problems: string[];
+}
+/**
+ * How many filters one read may carry.
+ *
+ * A cap rather than none, because every filter is another conjunct in the two
+ * statements a paged read issues, and a caller that can send five hundred can
+ * make one request cost whatever it likes. Twenty is far past what a person
+ * builds by hand and far short of anything that would trouble the optimiser.
+ */
+export declare const CATALOG_FILTER_LIMIT = 20;
+/**
+ * Turn what arrived into what a store may be given, or say why not.
+ *
+ * **Unhonourable filters are reported, never dropped.** The neighbouring
+ * `parseOutcomes` on the controller drops an unrecognised trace outcome on
+ * purpose, and this goes the other way for a reason that is worth the two
+ * sentences: dropping there costs a filter, so a typo widens the result set and
+ * shows more traces than asked for. Dropping HERE would narrow nothing — the read
+ * would come back unfiltered and the screen would present the whole table as
+ * though it were the matching rows. A filter that silently does not apply is the
+ * one failure mode a filtering UI must not have.
+ *
+ * @param columns the properties this reader may see. Deliberately the visible,
+ * non-blob columns rather than `type.properties`: a filter is only ever resolved
+ * against what the same request would return.
+ */
+export declare function resolveObjectFilters(columns: readonly CatalogPropertyDef[], raw: readonly string[]): CatalogFilterResolution;
+/**
+ * A typed value, or the reason there is none.
+ *
+ * Refusing rather than passing the text through is the whole of this function's
+ * value. MySQL compares a string to a `DOUBLE` by coercing the string — `'abc'`
+ * becomes `0` — so `mileage >= abc` is not an error, it is `mileage >= 0`, and it
+ * comes back as a full page of rows that look filtered. The same is true of a
+ * date that does not parse.
+ */
+export declare function coerceFilterValue(type: ScalarType, value: string): {
+    ok: true;
+    value: string | number | boolean | Date;
+} | {
+    ok: false;
+    problem: string;
+};