@freighttech/ui 0.13.18

package/dist/backend/dynamic-table/server/aggregate.js

@@ -0,0 +1,261 @@
+import { isAggregationFn } from "../types/grouping.js";
+import { coerceAggregateValue } from "../utils/formatAggregate.js";
+const MAX_AGGREGATE_ENTRIES = 12;
+const MAX_AGGREGATE_PARAM_LENGTH = 500;
+class AggregateSpecError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AggregateSpecError";
+  }
+}
+class AggregateScopeError extends Error {
+  constructor(message) {
+    super(message);
+    this.name = "AggregateScopeError";
+  }
+}
+function aggregateKey(field, fn) {
+  return `${field}:${fn}`;
+}
+function parseAggregateSpec(raw, fieldMap) {
+  if (raw === null || raw === void 0) return [];
+  if (typeof raw !== "string") throw new AggregateSpecError("aggregate must be a string");
+  const trimmed = raw.trim();
+  if (!trimmed) return [];
+  if (trimmed.length > MAX_AGGREGATE_PARAM_LENGTH) {
+    throw new AggregateSpecError(`aggregate must be at most ${MAX_AGGREGATE_PARAM_LENGTH} characters`);
+  }
+  const parts = trimmed.split(",").map((p) => p.trim()).filter(Boolean);
+  if (parts.length > MAX_AGGREGATE_ENTRIES) {
+    throw new AggregateSpecError(`aggregate accepts at most ${MAX_AGGREGATE_ENTRIES} entries`);
+  }
+  const seen = /* @__PURE__ */ new Set();
+  const out = [];
+  for (const part of parts) {
+    const idx = part.indexOf(":");
+    if (idx <= 0 || idx === part.length - 1) {
+      throw new AggregateSpecError(`Malformed aggregate entry: "${part}" (expected field:fn)`);
+    }
+    const field = part.slice(0, idx).trim();
+    const rest = part.slice(idx + 1).trim();
+    const dimIdx = rest.indexOf(":");
+    const fn = (dimIdx < 0 ? rest : rest.slice(0, dimIdx)).trim();
+    const dimension = dimIdx < 0 ? "" : rest.slice(dimIdx + 1).trim();
+    if (!field) throw new AggregateSpecError(`Malformed aggregate entry: "${part}"`);
+    if (!isAggregationFn(fn)) throw new AggregateSpecError(`Unknown aggregate function: "${fn}"`);
+    const property = Object.prototype.hasOwnProperty.call(fieldMap, field) ? fieldMap[field] : void 0;
+    if (!property || typeof property !== "string") {
+      throw new AggregateSpecError(`Unknown aggregate field: "${field}"`);
+    }
+    let dimensionProperty;
+    if (dimIdx >= 0) {
+      if (!dimension) {
+        throw new AggregateSpecError(`Malformed aggregate entry: "${part}" (empty dimension)`);
+      }
+      const dimProp = Object.prototype.hasOwnProperty.call(fieldMap, dimension) ? fieldMap[dimension] : void 0;
+      if (!dimProp || typeof dimProp !== "string") {
+        throw new AggregateSpecError(`Unknown aggregate dimension: "${dimension}"`);
+      }
+      dimensionProperty = dimProp;
+    }
+    const key = aggregateKey(field, fn);
+    if (seen.has(key)) continue;
+    seen.add(key);
+    out.push(
+      dimensionProperty ? { field, fn, property, dimension, dimensionProperty } : { field, fn, property }
+    );
+  }
+  return out;
+}
+function buildAggregateWhere(where, tenancy) {
+  const orgField = tenancy.orgField === void 0 ? "organizationId" : tenancy.orgField;
+  const tenantField = tenancy.tenantField === void 0 ? "tenantId" : tenancy.tenantField;
+  const softDeleteField = tenancy.softDeleteField === void 0 ? "deletedAt" : tenancy.softDeleteField;
+  if (orgField) {
+    const ids = (tenancy.organizationIds ?? []).filter((id) => typeof id === "string" && id);
+    if (ids.length === 0) {
+      throw new AggregateScopeError(
+        "Refusing to aggregate without an organization scope \u2014 an unscoped aggregate leaks other tenants\u2019 totals."
+      );
+    }
+  }
+  if (tenantField && !tenancy.tenantId) {
+    throw new AggregateScopeError("Refusing to aggregate without a tenant id.");
+  }
+  const merged = { ...where };
+  if (softDeleteField) merged[softDeleteField] = null;
+  if (tenantField) merged[tenantField] = tenancy.tenantId;
+  if (orgField) merged[orgField] = { $in: [...new Set(tenancy.organizationIds)] };
+  return merged;
+}
+function tenancyFromRouteContext(ctx, orm = {}) {
+  return {
+    orgField: orm.orgField,
+    organizationIds: [...ctx.allowedOrgIds],
+    tenantField: orm.tenantField,
+    tenantId: ctx.tenantId,
+    softDeleteField: orm.softDeleteField
+  };
+}
+function sqlForFn(fn, column) {
+  switch (fn) {
+    case "sum":
+      return `sum(${column})`;
+    case "avg":
+      return `avg(${column})`;
+    case "min":
+      return `min(${column})`;
+    case "max":
+      return `max(${column})`;
+    case "count":
+      return `count(${column})`;
+    case "countDistinct":
+      return `count(distinct ${column})`;
+  }
+}
+const SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/;
+function buildAggregateSelect(entries, columnOf, tableAlias) {
+  if (!SAFE_IDENTIFIER.test(tableAlias)) {
+    throw new AggregateSpecError(`Unsafe table alias: "${tableAlias}"`);
+  }
+  const expressions = [];
+  const aliasToKey = {};
+  entries.forEach((entry, i) => {
+    const column = columnOf(entry.property);
+    if (!column) throw new AggregateSpecError(`Unmapped aggregate field: "${entry.field}"`);
+    if (!SAFE_IDENTIFIER.test(column)) {
+      throw new AggregateSpecError(`Unsafe column name for field "${entry.field}"`);
+    }
+    const alias = `agg_${i}`;
+    expressions.push(`${sqlForFn(entry.fn, `"${tableAlias}"."${column}"`)} as "${alias}"`);
+    aliasToKey[alias] = aggregateKey(entry.field, entry.fn);
+  });
+  const totalAlias = "agg_total";
+  expressions.push(`count(*) as "${totalAlias}"`);
+  return { expressions, aliasToKey, totalAlias };
+}
+function mapAggregateRow(row, plan) {
+  const values = {};
+  for (const [alias, key] of Object.entries(plan.aliasToKey)) {
+    values[key] = coerceAggregateValue(row?.[alias]);
+  }
+  return {
+    scope: "dataset",
+    total: coerceAggregateValue(row?.[plan.totalAlias]) ?? 0,
+    values
+  };
+}
+function makeColumnResolver(em, entity) {
+  const anyEm = em;
+  let properties;
+  try {
+    const metadata = anyEm.getMetadata?.();
+    const meta = metadata?.find?.(entity) ?? metadata?.get?.(typeof entity === "string" ? entity : entity?.name);
+    properties = meta?.properties;
+  } catch {
+    properties = void 0;
+  }
+  return (property) => {
+    const prop = properties?.[property];
+    const fromMeta = prop?.fieldNames?.[0];
+    if (typeof fromMeta === "string" && fromMeta) return fromMeta;
+    if (properties) return void 0;
+    return property.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`);
+  };
+}
+let rawFragment = null;
+async function getRawFragment() {
+  if (!rawFragment) {
+    const mod = await import("@mikro-orm/core");
+    if (typeof mod?.raw !== "function") {
+      throw new Error("@mikro-orm/core does not export raw(); cannot build an aggregate query");
+    }
+    rawFragment = (sql) => mod.raw(sql);
+  }
+  return rawFragment;
+}
+async function runAggregate(options) {
+  const { em, entity, where, tenancy, entries } = options;
+  const tableAlias = options.tableAlias ?? "dta";
+  const scopedWhere = buildAggregateWhere(where, tenancy);
+  if (entries.length === 0) {
+    const total = await em.count(entity, scopedWhere);
+    return { scope: "dataset", total, values: {} };
+  }
+  const columnOf = makeColumnResolver(em, entity);
+  const plan = buildAggregateSelect(entries, columnOf, tableAlias);
+  const raw = await getRawFragment();
+  const compileWith = (expressions, groupByColumn) => {
+    const qb = em.createQueryBuilder(entity, tableAlias);
+    qb.select("*");
+    qb.where(scopedWhere);
+    const native = qb.getNativeQuery();
+    native.clear("select");
+    native.select(expressions.map((expr) => raw(expr)));
+    if (groupByColumn) native.groupBy([raw(`"${tableAlias}"."${groupByColumn}"`)]);
+    return native.compile();
+  };
+  const { sql, params } = compileWith(plan.expressions);
+  const row = await em.getConnection().execute(sql, params, "get");
+  const result = mapAggregateRow(row, plan);
+  const dimensioned = entries.filter((e) => e.dimension && e.dimensionProperty);
+  if (dimensioned.length > 0) {
+    const breakdowns = {};
+    const byDimension = /* @__PURE__ */ new Map();
+    for (const entry of dimensioned) {
+      const list = byDimension.get(entry.dimensionProperty);
+      if (list) list.push(entry);
+      else byDimension.set(entry.dimensionProperty, [entry]);
+    }
+    for (const [dimensionProperty, group] of byDimension) {
+      const dimColumn = columnOf(dimensionProperty);
+      if (!dimColumn) throw new AggregateSpecError(`Unmapped aggregate dimension: "${group[0].dimension}"`);
+      if (!SAFE_IDENTIFIER.test(dimColumn)) {
+        throw new AggregateSpecError(`Unsafe column name for dimension "${group[0].dimension}"`);
+      }
+      const expressions = [`"${tableAlias}"."${dimColumn}" as "agg_dim"`];
+      const aliasToKey = {};
+      group.forEach((entry, i) => {
+        const column = columnOf(entry.property);
+        if (!column) throw new AggregateSpecError(`Unmapped aggregate field: "${entry.field}"`);
+        if (!SAFE_IDENTIFIER.test(column)) {
+          throw new AggregateSpecError(`Unsafe column name for field "${entry.field}"`);
+        }
+        const alias = `agg_d_${i}`;
+        expressions.push(`${sqlForFn(entry.fn, `"${tableAlias}"."${column}"`)} as "${alias}"`);
+        aliasToKey[alias] = aggregateKey(entry.field, entry.fn);
+      });
+      const compiled = compileWith(expressions, dimColumn);
+      const rows = await em.getConnection().execute(
+        compiled.sql,
+        compiled.params,
+        "all"
+      );
+      for (const key of Object.values(aliasToKey)) breakdowns[key] = [];
+      for (const r of rows ?? []) {
+        const dimValue = r?.["agg_dim"];
+        const dimKey = dimValue === null || dimValue === void 0 ? "" : String(dimValue);
+        for (const [alias, key] of Object.entries(aliasToKey)) {
+          breakdowns[key].push({ key: dimKey, value: coerceAggregateValue(r?.[alias]) });
+        }
+      }
+    }
+    result.breakdowns = breakdowns;
+  }
+  return result;
+}
+export {
+  AggregateScopeError,
+  AggregateSpecError,
+  MAX_AGGREGATE_ENTRIES,
+  MAX_AGGREGATE_PARAM_LENGTH,
+  aggregateKey,
+  buildAggregateSelect,
+  buildAggregateWhere,
+  makeColumnResolver,
+  mapAggregateRow,
+  parseAggregateSpec,
+  runAggregate,
+  tenancyFromRouteContext
+};
+//# sourceMappingURL=aggregate.js.map

package/dist/backend/dynamic-table/server/aggregate.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/backend/dynamic-table/server/aggregate.ts"],
+  "sourcesContent": ["// server/aggregate.ts\n//\n// Shared server-side aggregation helper for DynamicTable list routes.\n//\n// The whole point of this file is one structural rule:\n//\n//   THE AGGREGATE RUNS OVER THE SAME `WHERE` CLAUSE AS THE ROW QUERY.\n//\n// A total computed from a separately-built filter object describes a different\n// set of rows than the ones on screen \u2014 and if that separate build forgets\n// `organization_id`, it describes every tenant's rows. So the caller hands over\n// the *same* filters object it passed to `findAndCount`, and this helper\n// re-asserts tenancy on top of it as defence in depth.\n\nimport type { EntityManager } from '@mikro-orm/postgresql'\nimport type { AggregationFn, AggregateResult, AggregateBreakdownEntry } from '../types/grouping'\nimport { isAggregationFn } from '../types/grouping'\nimport { coerceAggregateValue } from '../utils/formatAggregate'\n\n/** Hard cap on how many aggregates one request may ask for. */\nexport const MAX_AGGREGATE_ENTRIES = 12\n\n/** Hard cap on the raw `aggregate=` string length. */\nexport const MAX_AGGREGATE_PARAM_LENGTH = 500\n\nexport interface AggregateEntry {\n  /** Client-facing column key (the `ColumnDef.data` value). */\n  field: string\n  fn: AggregationFn\n  /** ORM property name the field resolves to, via the route's `fieldMap`. */\n  property: string\n  /** Client-facing key of the optional partition column. */\n  dimension?: string\n  /** ORM property the dimension resolves to, via the same `fieldMap`. */\n  dimensionProperty?: string\n}\n\nexport class AggregateSpecError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AggregateSpecError'\n  }\n}\n\nexport class AggregateScopeError extends Error {\n  constructor(message: string) {\n    super(message)\n    this.name = 'AggregateScopeError'\n  }\n}\n\n/** `${field}:${fn}` \u2014 the key an `AggregateResult.values` entry is filed under. */\nexport function aggregateKey(field: string, fn: AggregationFn): string {\n  return `${field}:${fn}`\n}\n\n// \u2500\u2500\u2500 Spec parsing \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/**\n * Parse `aggregate=grossAmount:sum,netAmount:avg,id:count`.\n *\n * An entry may carry an OPTIONAL third segment \u2014 `grossAmount:sum:currencyCode`\n * \u2014 naming a column to partition the aggregate by. That yields one figure per\n * distinct value instead of a single scalar, which is what stops a `sum` from\n * silently adding amounts in different currencies together (HEDGE-147). Two-part\n * entries are unchanged, so already-deployed clients and routes are unaffected.\n *\n * Every field \u2014 the aggregated one AND the dimension \u2014 is resolved through the\n * route's `fieldMap` allow-list, so an unknown or hostile field name never\n * becomes SQL; it is a 400. `fn` is a closed union. Throws `AggregateSpecError`;\n * callers map that to a 400.\n */\nexport function parseAggregateSpec(\n  raw: string | null | undefined,\n  fieldMap: Record<string, string>,\n): AggregateEntry[] {\n  if (raw === null || raw === undefined) return []\n  if (typeof raw !== 'string') throw new AggregateSpecError('aggregate must be a string')\n  const trimmed = raw.trim()\n  if (!trimmed) return []\n  if (trimmed.length > MAX_AGGREGATE_PARAM_LENGTH) {\n    throw new AggregateSpecError(`aggregate must be at most ${MAX_AGGREGATE_PARAM_LENGTH} characters`)\n  }\n\n  const parts = trimmed.split(',').map((p) => p.trim()).filter(Boolean)\n  if (parts.length > MAX_AGGREGATE_ENTRIES) {\n    throw new AggregateSpecError(`aggregate accepts at most ${MAX_AGGREGATE_ENTRIES} entries`)\n  }\n\n  const seen = new Set<string>()\n  const out: AggregateEntry[] = []\n  for (const part of parts) {\n    const idx = part.indexOf(':')\n    if (idx <= 0 || idx === part.length - 1) {\n      throw new AggregateSpecError(`Malformed aggregate entry: \"${part}\" (expected field:fn)`)\n    }\n    const field = part.slice(0, idx).trim()\n    const rest = part.slice(idx + 1).trim()\n    const dimIdx = rest.indexOf(':')\n    const fn = (dimIdx < 0 ? rest : rest.slice(0, dimIdx)).trim()\n    const dimension = dimIdx < 0 ? '' : rest.slice(dimIdx + 1).trim()\n    if (!field) throw new AggregateSpecError(`Malformed aggregate entry: \"${part}\"`)\n    if (!isAggregationFn(fn)) throw new AggregateSpecError(`Unknown aggregate function: \"${fn}\"`)\n\n    // Allow-list: the field must be a column this route publishes.\n    const property = Object.prototype.hasOwnProperty.call(fieldMap, field) ? fieldMap[field] : undefined\n    if (!property || typeof property !== 'string') {\n      throw new AggregateSpecError(`Unknown aggregate field: \"${field}\"`)\n    }\n\n    // Same allow-list for the partition column \u2014 it reaches SQL as a GROUP BY\n    // identifier, so it gets exactly the treatment the aggregated field gets.\n    let dimensionProperty: string | undefined\n    if (dimIdx >= 0) {\n      if (!dimension) {\n        throw new AggregateSpecError(`Malformed aggregate entry: \"${part}\" (empty dimension)`)\n      }\n      const dimProp = Object.prototype.hasOwnProperty.call(fieldMap, dimension)\n        ? fieldMap[dimension]\n        : undefined\n      if (!dimProp || typeof dimProp !== 'string') {\n        throw new AggregateSpecError(`Unknown aggregate dimension: \"${dimension}\"`)\n      }\n      dimensionProperty = dimProp\n    }\n\n    const key = aggregateKey(field, fn)\n    if (seen.has(key)) continue\n    seen.add(key)\n    out.push(\n      dimensionProperty\n        ? { field, fn, property, dimension, dimensionProperty }\n        : { field, fn, property },\n    )\n  }\n  return out\n}\n\n// \u2500\u2500\u2500 Tenancy \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface AggregateTenancy {\n  /** ORM property holding the organization id. `null` opts an unscoped entity out. */\n  orgField?: string | null\n  /**\n   * The organization scope is a SET, not a single id \u2014 `buildScopeFilters`\n   * emits `{ $in: [...] }` because a user may see several organizations.\n   */\n  organizationIds: string[]\n  /** ORM property holding the tenant id. `null` opts out. */\n  tenantField?: string | null\n  tenantId?: string | null\n  /** ORM property for soft deletion. `null` opts out. */\n  softDeleteField?: string | null\n}\n\n/**\n * Merge the row query's `where` with the tenancy scope, and refuse to build an\n * aggregate that isn't scoped.\n *\n * The row query already carries these keys; re-applying identical values is a\n * no-op, and the throw is what turns \"someone forgot\" from a silent\n * cross-tenant total into a failed request.\n */\nexport function buildAggregateWhere(\n  where: Record<string, unknown>,\n  tenancy: AggregateTenancy,\n): Record<string, unknown> {\n  const orgField = tenancy.orgField === undefined ? 'organizationId' : tenancy.orgField\n  const tenantField = tenancy.tenantField === undefined ? 'tenantId' : tenancy.tenantField\n  const softDeleteField =\n    tenancy.softDeleteField === undefined ? 'deletedAt' : tenancy.softDeleteField\n\n  if (orgField) {\n    const ids = (tenancy.organizationIds ?? []).filter((id) => typeof id === 'string' && id)\n    if (ids.length === 0) {\n      throw new AggregateScopeError(\n        'Refusing to aggregate without an organization scope \u2014 an unscoped aggregate leaks other tenants\u2019 totals.',\n      )\n    }\n  }\n  if (tenantField && !tenancy.tenantId) {\n    throw new AggregateScopeError('Refusing to aggregate without a tenant id.')\n  }\n\n  const merged: Record<string, unknown> = { ...where }\n  if (softDeleteField) merged[softDeleteField] = null\n  if (tenantField) merged[tenantField] = tenancy.tenantId\n  if (orgField) merged[orgField] = { $in: [...new Set(tenancy.organizationIds)] }\n  return merged\n}\n\n/**\n * Adapt a `makeDynamicTableRoute` context + ORM config into `AggregateTenancy`.\n *\n * Structurally typed so this file never has to import the route factory. Note\n * `allowedOrgIds` is a **Set** \u2014 the visible organization scope is a set of ids\n * (`buildScopeFilters` emits `{ $in: [...] }`), not one id, and collapsing it\n * to `ctx.organizationId` would silently narrow or widen the aggregate.\n */\nexport function tenancyFromRouteContext(\n  ctx: { tenantId: string | null; allowedOrgIds: Set<string> },\n  orm: { orgField?: string | null; tenantField?: string | null; softDeleteField?: string | null } = {},\n): AggregateTenancy {\n  return {\n    orgField: orm.orgField,\n    organizationIds: [...ctx.allowedOrgIds],\n    tenantField: orm.tenantField,\n    tenantId: ctx.tenantId,\n    softDeleteField: orm.softDeleteField,\n  }\n}\n\n// \u2500\u2500\u2500 SQL construction \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\n/** SQL template per function. `%s` is the (metadata-derived) qualified column. */\nfunction sqlForFn(fn: AggregationFn, column: string): string {\n  switch (fn) {\n    case 'sum':\n      return `sum(${column})`\n    case 'avg':\n      return `avg(${column})`\n    case 'min':\n      return `min(${column})`\n    case 'max':\n      return `max(${column})`\n    case 'count':\n      return `count(${column})`\n    case 'countDistinct':\n      return `count(distinct ${column})`\n  }\n}\n\nconst SAFE_IDENTIFIER = /^[A-Za-z_][A-Za-z0-9_]*$/\n\nexport interface AggregateSelectPlan {\n  /** Raw `select` expressions, in entry order, plus the trailing row count. */\n  expressions: string[]\n  /** Generated alias -> the `AggregateResult.values` key it fills. */\n  aliasToKey: Record<string, string>\n  /** Alias of the `count(*)` expression. */\n  totalAlias: string\n}\n\n/**\n * Build the select list.\n *\n * Injection safety, three layers deep: `field` was already resolved through the\n * route's `fieldMap` allow-list; `columnOf` maps the ORM property to a real\n * column name taken from ORM metadata (never from the request); and the result\n * is re-checked against `SAFE_IDENTIFIER` before it is concatenated. Aliases\n * are generated (`agg_0`, `agg_1`, \u2026), never derived from user input.\n */\nexport function buildAggregateSelect(\n  entries: AggregateEntry[],\n  columnOf: (property: string) => string | undefined,\n  tableAlias: string,\n): AggregateSelectPlan {\n  if (!SAFE_IDENTIFIER.test(tableAlias)) {\n    throw new AggregateSpecError(`Unsafe table alias: \"${tableAlias}\"`)\n  }\n\n  const expressions: string[] = []\n  const aliasToKey: Record<string, string> = {}\n\n  entries.forEach((entry, i) => {\n    const column = columnOf(entry.property)\n    if (!column) throw new AggregateSpecError(`Unmapped aggregate field: \"${entry.field}\"`)\n    if (!SAFE_IDENTIFIER.test(column)) {\n      throw new AggregateSpecError(`Unsafe column name for field \"${entry.field}\"`)\n    }\n    const alias = `agg_${i}`\n    expressions.push(`${sqlForFn(entry.fn, `\"${tableAlias}\".\"${column}\"`)} as \"${alias}\"`)\n    aliasToKey[alias] = aggregateKey(entry.field, entry.fn)\n  })\n\n  const totalAlias = 'agg_total'\n  expressions.push(`count(*) as \"${totalAlias}\"`)\n  return { expressions, aliasToKey, totalAlias }\n}\n\n/**\n * Turn one raw aggregate row (all values arrive as STRINGS from pg: `int8` for\n * counts, `numeric` for sums) into the transport shape.\n */\nexport function mapAggregateRow(\n  row: Record<string, unknown> | null | undefined,\n  plan: AggregateSelectPlan,\n): AggregateResult {\n  const values: Record<string, number | null> = {}\n  for (const [alias, key] of Object.entries(plan.aliasToKey)) {\n    values[key] = coerceAggregateValue(row?.[alias])\n  }\n  return {\n    scope: 'dataset',\n    total: coerceAggregateValue(row?.[plan.totalAlias]) ?? 0,\n    values,\n  }\n}\n\n// \u2500\u2500\u2500 Execution \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n\nexport interface RunAggregateOptions {\n  em: EntityManager\n  entity: any\n  /**\n   * The EXACT filters object handed to the row query. Passing a freshly built\n   * one is the bug this helper exists to prevent.\n   */\n  where: Record<string, unknown>\n  tenancy: AggregateTenancy\n  entries: AggregateEntry[]\n  /** SQL table alias. Generated, never user input. */\n  tableAlias?: string\n}\n\n/**\n * Resolve an ORM property name to its physical column, from ENTITY METADATA.\n * Never from the request \u2014 that is what keeps the identifier trustworthy.\n * A property the metadata does not know is rejected rather than guessed.\n */\nexport function makeColumnResolver(\n  em: EntityManager,\n  entity: any,\n): (property: string) => string | undefined {\n  const anyEm = em as any\n  let properties: Record<string, any> | undefined\n  try {\n    const metadata = anyEm.getMetadata?.()\n    const meta =\n      metadata?.find?.(entity) ?? metadata?.get?.(typeof entity === 'string' ? entity : entity?.name)\n    properties = meta?.properties\n  } catch {\n    properties = undefined\n  }\n  return (property: string) => {\n    const prop = properties?.[property]\n    const fromMeta = prop?.fieldNames?.[0]\n    if (typeof fromMeta === 'string' && fromMeta) return fromMeta\n    if (properties) return undefined\n    // No metadata at all (unit tests, unusual driver): fall back to the\n    // conventional camelCase \u2192 snake_case mapping. Still gated by\n    // SAFE_IDENTIFIER in `buildAggregateSelect`.\n    return property.replace(/[A-Z]/g, (c) => `_${c.toLowerCase()}`)\n  }\n}\n\n/**\n * `raw()` lives in `@mikro-orm/core`, which this package does not depend on\n * directly. It is imported lazily so that (a) the pure spec/SQL helpers above\n * stay importable in a jsdom unit test, and (b) nothing pulls the ORM into a\n * client bundle. Resolution happens inside the host app, which always has it.\n */\nlet rawFragment: ((sql: string) => unknown) | null = null\nasync function getRawFragment(): Promise<(sql: string) => unknown> {\n  if (!rawFragment) {\n    const mod: any = await import('@mikro-orm/core')\n    if (typeof mod?.raw !== 'function') {\n      throw new Error('@mikro-orm/core does not export raw(); cannot build an aggregate query')\n    }\n    rawFragment = (sql: string) => mod.raw(sql)\n  }\n  return rawFragment\n}\n\n/**\n * Run the aggregate. Returns `scope: 'dataset'` \u2014 it is computed over the whole\n * filtered set, which is the entire reason this exists.\n *\n * The query builder is seeded with the SAME `where` the row query used (plus a\n * re-assertion of tenancy), then its select list is swapped for the aggregate\n * expressions. Same builder, same clause, same rows.\n */\nexport async function runAggregate(options: RunAggregateOptions): Promise<AggregateResult> {\n  const { em, entity, where, tenancy, entries } = options\n  const tableAlias = options.tableAlias ?? 'dta'\n\n  const scopedWhere = buildAggregateWhere(where, tenancy)\n\n  if (entries.length === 0) {\n    const total = await em.count(entity, scopedWhere as any)\n    return { scope: 'dataset', total, values: {} }\n  }\n\n  const columnOf = makeColumnResolver(em, entity)\n  const plan = buildAggregateSelect(entries, columnOf, tableAlias)\n  const raw = await getRawFragment()\n\n  const compileWith = (expressions: string[], groupByColumn?: string) => {\n    const qb: any = em.createQueryBuilder(entity as any, tableAlias)\n    qb.select('*')\n    qb.where(scopedWhere as any)\n\n    // Take the compiled row query and swap ONLY its select list. The FROM and the\n    // WHERE (including tenancy) are whatever the row query produced \u2014 that is the\n    // structural guarantee that the total describes the rows on screen.\n    const native: any = qb.getNativeQuery()\n    native.clear('select')\n    native.select(expressions.map((expr) => raw(expr)))\n    // MikroORM v7 dropped knex: `getNativeQuery()` returns the ORM's own\n    // `NativeQueryBuilder`, whose signature is\n    // `groupBy(groupBy: (string | RawQueryFragment)[])` \u2014 an ARRAY, and there\n    // is no `groupByRaw`. Passing a bare fragment (or calling `groupByRaw`)\n    // throws, and `runAggregate`'s caller swallows that into \"no total\", so the\n    // footer silently degrades to page scope instead of erroring. Both parts of\n    // the name are `SAFE_IDENTIFIER`-checked and metadata-derived above.\n    if (groupByColumn) native.groupBy([raw(`\"${tableAlias}\".\"${groupByColumn}\"`)])\n    return native.compile()\n  }\n\n  const { sql, params } = compileWith(plan.expressions)\n  const row = (await (em.getConnection() as any).execute(sql, params, 'get')) as\n    | Record<string, unknown>\n    | null\n    | undefined\n\n  const result = mapAggregateRow(row, plan)\n\n  // \u2500\u2500 Per-dimension breakdowns \u2500\u2500\n  //\n  // One extra grouped query per distinct partition column, reusing the SAME\n  // `where`. Kept separate from the scalar query so that adding a dimension can\n  // never change the ungrouped `total`, and so a route/driver that cannot do\n  // this degrades to \"no breakdown\" rather than to a wrong grand total.\n  const dimensioned = entries.filter((e) => e.dimension && e.dimensionProperty)\n  if (dimensioned.length > 0) {\n    const breakdowns: Record<string, AggregateBreakdownEntry[]> = {}\n    const byDimension = new Map<string, AggregateEntry[]>()\n    for (const entry of dimensioned) {\n      const list = byDimension.get(entry.dimensionProperty!)\n      if (list) list.push(entry)\n      else byDimension.set(entry.dimensionProperty!, [entry])\n    }\n\n    for (const [dimensionProperty, group] of byDimension) {\n      const dimColumn = columnOf(dimensionProperty)\n      if (!dimColumn) throw new AggregateSpecError(`Unmapped aggregate dimension: \"${group[0].dimension}\"`)\n      if (!SAFE_IDENTIFIER.test(dimColumn)) {\n        throw new AggregateSpecError(`Unsafe column name for dimension \"${group[0].dimension}\"`)\n      }\n\n      const expressions: string[] = [`\"${tableAlias}\".\"${dimColumn}\" as \"agg_dim\"`]\n      const aliasToKey: Record<string, string> = {}\n      group.forEach((entry, i) => {\n        const column = columnOf(entry.property)\n        if (!column) throw new AggregateSpecError(`Unmapped aggregate field: \"${entry.field}\"`)\n        if (!SAFE_IDENTIFIER.test(column)) {\n          throw new AggregateSpecError(`Unsafe column name for field \"${entry.field}\"`)\n        }\n        const alias = `agg_d_${i}`\n        expressions.push(`${sqlForFn(entry.fn, `\"${tableAlias}\".\"${column}\"`)} as \"${alias}\"`)\n        aliasToKey[alias] = aggregateKey(entry.field, entry.fn)\n      })\n\n      const compiled = compileWith(expressions, dimColumn)\n      const rows = (await (em.getConnection() as any).execute(\n        compiled.sql,\n        compiled.params,\n        'all',\n      )) as Record<string, unknown>[] | null | undefined\n\n      for (const key of Object.values(aliasToKey)) breakdowns[key] = []\n      for (const r of rows ?? []) {\n        const dimValue = r?.['agg_dim']\n        const dimKey = dimValue === null || dimValue === undefined ? '' : String(dimValue)\n        for (const [alias, key] of Object.entries(aliasToKey)) {\n          breakdowns[key].push({ key: dimKey, value: coerceAggregateValue(r?.[alias]) })\n        }\n      }\n    }\n    result.breakdowns = breakdowns\n  }\n\n  return result\n}\n"],
+  "mappings": "AAgBA,SAAS,uBAAuB;AAChC,SAAS,4BAA4B;AAG9B,MAAM,wBAAwB;AAG9B,MAAM,6BAA6B;AAcnC,MAAM,2BAA2B,MAAM;AAAA,EAC5C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAEO,MAAM,4BAA4B,MAAM;AAAA,EAC7C,YAAY,SAAiB;AAC3B,UAAM,OAAO;AACb,SAAK,OAAO;AAAA,EACd;AACF;AAGO,SAAS,aAAa,OAAe,IAA2B;AACrE,SAAO,GAAG,KAAK,IAAI,EAAE;AACvB;AAkBO,SAAS,mBACd,KACA,UACkB;AAClB,MAAI,QAAQ,QAAQ,QAAQ,OAAW,QAAO,CAAC;AAC/C,MAAI,OAAO,QAAQ,SAAU,OAAM,IAAI,mBAAmB,4BAA4B;AACtF,QAAM,UAAU,IAAI,KAAK;AACzB,MAAI,CAAC,QAAS,QAAO,CAAC;AACtB,MAAI,QAAQ,SAAS,4BAA4B;AAC/C,UAAM,IAAI,mBAAmB,6BAA6B,0BAA0B,aAAa;AAAA,EACnG;AAEA,QAAM,QAAQ,QAAQ,MAAM,GAAG,EAAE,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACpE,MAAI,MAAM,SAAS,uBAAuB;AACxC,UAAM,IAAI,mBAAmB,6BAA6B,qBAAqB,UAAU;AAAA,EAC3F;AAEA,QAAM,OAAO,oBAAI,IAAY;AAC7B,QAAM,MAAwB,CAAC;AAC/B,aAAW,QAAQ,OAAO;AACxB,UAAM,MAAM,KAAK,QAAQ,GAAG;AAC5B,QAAI,OAAO,KAAK,QAAQ,KAAK,SAAS,GAAG;AACvC,YAAM,IAAI,mBAAmB,+BAA+B,IAAI,uBAAuB;AAAA,IACzF;AACA,UAAM,QAAQ,KAAK,MAAM,GAAG,GAAG,EAAE,KAAK;AACtC,UAAM,OAAO,KAAK,MAAM,MAAM,CAAC,EAAE,KAAK;AACtC,UAAM,SAAS,KAAK,QAAQ,GAAG;AAC/B,UAAM,MAAM,SAAS,IAAI,OAAO,KAAK,MAAM,GAAG,MAAM,GAAG,KAAK;AAC5D,UAAM,YAAY,SAAS,IAAI,KAAK,KAAK,MAAM,SAAS,CAAC,EAAE,KAAK;AAChE,QAAI,CAAC,MAAO,OAAM,IAAI,mBAAmB,+BAA+B,IAAI,GAAG;AAC/E,QAAI,CAAC,gBAAgB,EAAE,EAAG,OAAM,IAAI,mBAAmB,gCAAgC,EAAE,GAAG;AAG5F,UAAM,WAAW,OAAO,UAAU,eAAe,KAAK,UAAU,KAAK,IAAI,SAAS,KAAK,IAAI;AAC3F,QAAI,CAAC,YAAY,OAAO,aAAa,UAAU;AAC7C,YAAM,IAAI,mBAAmB,6BAA6B,KAAK,GAAG;AAAA,IACpE;AAIA,QAAI;AACJ,QAAI,UAAU,GAAG;AACf,UAAI,CAAC,WAAW;AACd,cAAM,IAAI,mBAAmB,+BAA+B,IAAI,qBAAqB;AAAA,MACvF;AACA,YAAM,UAAU,OAAO,UAAU,eAAe,KAAK,UAAU,SAAS,IACpE,SAAS,SAAS,IAClB;AACJ,UAAI,CAAC,WAAW,OAAO,YAAY,UAAU;AAC3C,cAAM,IAAI,mBAAmB,iCAAiC,SAAS,GAAG;AAAA,MAC5E;AACA,0BAAoB;AAAA,IACtB;AAEA,UAAM,MAAM,aAAa,OAAO,EAAE;AAClC,QAAI,KAAK,IAAI,GAAG,EAAG;AACnB,SAAK,IAAI,GAAG;AACZ,QAAI;AAAA,MACF,oBACI,EAAE,OAAO,IAAI,UAAU,WAAW,kBAAkB,IACpD,EAAE,OAAO,IAAI,SAAS;AAAA,IAC5B;AAAA,EACF;AACA,SAAO;AACT;AA2BO,SAAS,oBACd,OACA,SACyB;AACzB,QAAM,WAAW,QAAQ,aAAa,SAAY,mBAAmB,QAAQ;AAC7E,QAAM,cAAc,QAAQ,gBAAgB,SAAY,aAAa,QAAQ;AAC7E,QAAM,kBACJ,QAAQ,oBAAoB,SAAY,cAAc,QAAQ;AAEhE,MAAI,UAAU;AACZ,UAAM,OAAO,QAAQ,mBAAmB,CAAC,GAAG,OAAO,CAAC,OAAO,OAAO,OAAO,YAAY,EAAE;AACvF,QAAI,IAAI,WAAW,GAAG;AACpB,YAAM,IAAI;AAAA,QACR;AAAA,MACF;AAAA,IACF;AAAA,EACF;AACA,MAAI,eAAe,CAAC,QAAQ,UAAU;AACpC,UAAM,IAAI,oBAAoB,4CAA4C;AAAA,EAC5E;AAEA,QAAM,SAAkC,EAAE,GAAG,MAAM;AACnD,MAAI,gBAAiB,QAAO,eAAe,IAAI;AAC/C,MAAI,YAAa,QAAO,WAAW,IAAI,QAAQ;AAC/C,MAAI,SAAU,QAAO,QAAQ,IAAI,EAAE,KAAK,CAAC,GAAG,IAAI,IAAI,QAAQ,eAAe,CAAC,EAAE;AAC9E,SAAO;AACT;AAUO,SAAS,wBACd,KACA,MAAkG,CAAC,GACjF;AAClB,SAAO;AAAA,IACL,UAAU,IAAI;AAAA,IACd,iBAAiB,CAAC,GAAG,IAAI,aAAa;AAAA,IACtC,aAAa,IAAI;AAAA,IACjB,UAAU,IAAI;AAAA,IACd,iBAAiB,IAAI;AAAA,EACvB;AACF;AAKA,SAAS,SAAS,IAAmB,QAAwB;AAC3D,UAAQ,IAAI;AAAA,IACV,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,OAAO,MAAM;AAAA,IACtB,KAAK;AACH,aAAO,SAAS,MAAM;AAAA,IACxB,KAAK;AACH,aAAO,kBAAkB,MAAM;AAAA,EACnC;AACF;AAEA,MAAM,kBAAkB;AAoBjB,SAAS,qBACd,SACA,UACA,YACqB;AACrB,MAAI,CAAC,gBAAgB,KAAK,UAAU,GAAG;AACrC,UAAM,IAAI,mBAAmB,wBAAwB,UAAU,GAAG;AAAA,EACpE;AAEA,QAAM,cAAwB,CAAC;AAC/B,QAAM,aAAqC,CAAC;AAE5C,UAAQ,QAAQ,CAAC,OAAO,MAAM;AAC5B,UAAM,SAAS,SAAS,MAAM,QAAQ;AACtC,QAAI,CAAC,OAAQ,OAAM,IAAI,mBAAmB,8BAA8B,MAAM,KAAK,GAAG;AACtF,QAAI,CAAC,gBAAgB,KAAK,MAAM,GAAG;AACjC,YAAM,IAAI,mBAAmB,iCAAiC,MAAM,KAAK,GAAG;AAAA,IAC9E;AACA,UAAM,QAAQ,OAAO,CAAC;AACtB,gBAAY,KAAK,GAAG,SAAS,MAAM,IAAI,IAAI,UAAU,MAAM,MAAM,GAAG,CAAC,QAAQ,KAAK,GAAG;AACrF,eAAW,KAAK,IAAI,aAAa,MAAM,OAAO,MAAM,EAAE;AAAA,EACxD,CAAC;AAED,QAAM,aAAa;AACnB,cAAY,KAAK,gBAAgB,UAAU,GAAG;AAC9C,SAAO,EAAE,aAAa,YAAY,WAAW;AAC/C;AAMO,SAAS,gBACd,KACA,MACiB;AACjB,QAAM,SAAwC,CAAC;AAC/C,aAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,KAAK,UAAU,GAAG;AAC1D,WAAO,GAAG,IAAI,qBAAqB,MAAM,KAAK,CAAC;AAAA,EACjD;AACA,SAAO;AAAA,IACL,OAAO;AAAA,IACP,OAAO,qBAAqB,MAAM,KAAK,UAAU,CAAC,KAAK;AAAA,IACvD;AAAA,EACF;AACF;AAuBO,SAAS,mBACd,IACA,QAC0C;AAC1C,QAAM,QAAQ;AACd,MAAI;AACJ,MAAI;AACF,UAAM,WAAW,MAAM,cAAc;AACrC,UAAM,OACJ,UAAU,OAAO,MAAM,KAAK,UAAU,MAAM,OAAO,WAAW,WAAW,SAAS,QAAQ,IAAI;AAChG,iBAAa,MAAM;AAAA,EACrB,QAAQ;AACN,iBAAa;AAAA,EACf;AACA,SAAO,CAAC,aAAqB;AAC3B,UAAM,OAAO,aAAa,QAAQ;AAClC,UAAM,WAAW,MAAM,aAAa,CAAC;AACrC,QAAI,OAAO,aAAa,YAAY,SAAU,QAAO;AACrD,QAAI,WAAY,QAAO;AAIvB,WAAO,SAAS,QAAQ,UAAU,CAAC,MAAM,IAAI,EAAE,YAAY,CAAC,EAAE;AAAA,EAChE;AACF;AAQA,IAAI,cAAiD;AACrD,eAAe,iBAAoD;AACjE,MAAI,CAAC,aAAa;AAChB,UAAM,MAAW,MAAM,OAAO,iBAAiB;AAC/C,QAAI,OAAO,KAAK,QAAQ,YAAY;AAClC,YAAM,IAAI,MAAM,wEAAwE;AAAA,IAC1F;AACA,kBAAc,CAAC,QAAgB,IAAI,IAAI,GAAG;AAAA,EAC5C;AACA,SAAO;AACT;AAUA,eAAsB,aAAa,SAAwD;AACzF,QAAM,EAAE,IAAI,QAAQ,OAAO,SAAS,QAAQ,IAAI;AAChD,QAAM,aAAa,QAAQ,cAAc;AAEzC,QAAM,cAAc,oBAAoB,OAAO,OAAO;AAEtD,MAAI,QAAQ,WAAW,GAAG;AACxB,UAAM,QAAQ,MAAM,GAAG,MAAM,QAAQ,WAAkB;AACvD,WAAO,EAAE,OAAO,WAAW,OAAO,QAAQ,CAAC,EAAE;AAAA,EAC/C;AAEA,QAAM,WAAW,mBAAmB,IAAI,MAAM;AAC9C,QAAM,OAAO,qBAAqB,SAAS,UAAU,UAAU;AAC/D,QAAM,MAAM,MAAM,eAAe;AAEjC,QAAM,cAAc,CAAC,aAAuB,kBAA2B;AACrE,UAAM,KAAU,GAAG,mBAAmB,QAAe,UAAU;AAC/D,OAAG,OAAO,GAAG;AACb,OAAG,MAAM,WAAkB;AAK3B,UAAM,SAAc,GAAG,eAAe;AACtC,WAAO,MAAM,QAAQ;AACrB,WAAO,OAAO,YAAY,IAAI,CAAC,SAAS,IAAI,IAAI,CAAC,CAAC;AAQlD,QAAI,cAAe,QAAO,QAAQ,CAAC,IAAI,IAAI,UAAU,MAAM,aAAa,GAAG,CAAC,CAAC;AAC7E,WAAO,OAAO,QAAQ;AAAA,EACxB;AAEA,QAAM,EAAE,KAAK,OAAO,IAAI,YAAY,KAAK,WAAW;AACpD,QAAM,MAAO,MAAO,GAAG,cAAc,EAAU,QAAQ,KAAK,QAAQ,KAAK;AAKzE,QAAM,SAAS,gBAAgB,KAAK,IAAI;AAQxC,QAAM,cAAc,QAAQ,OAAO,CAAC,MAAM,EAAE,aAAa,EAAE,iBAAiB;AAC5E,MAAI,YAAY,SAAS,GAAG;AAC1B,UAAM,aAAwD,CAAC;AAC/D,UAAM,cAAc,oBAAI,IAA8B;AACtD,eAAW,SAAS,aAAa;AAC/B,YAAM,OAAO,YAAY,IAAI,MAAM,iBAAkB;AACrD,UAAI,KAAM,MAAK,KAAK,KAAK;AAAA,UACpB,aAAY,IAAI,MAAM,mBAAoB,CAAC,KAAK,CAAC;AAAA,IACxD;AAEA,eAAW,CAAC,mBAAmB,KAAK,KAAK,aAAa;AACpD,YAAM,YAAY,SAAS,iBAAiB;AAC5C,UAAI,CAAC,UAAW,OAAM,IAAI,mBAAmB,kCAAkC,MAAM,CAAC,EAAE,SAAS,GAAG;AACpG,UAAI,CAAC,gBAAgB,KAAK,SAAS,GAAG;AACpC,cAAM,IAAI,mBAAmB,qCAAqC,MAAM,CAAC,EAAE,SAAS,GAAG;AAAA,MACzF;AAEA,YAAM,cAAwB,CAAC,IAAI,UAAU,MAAM,SAAS,gBAAgB;AAC5E,YAAM,aAAqC,CAAC;AAC5C,YAAM,QAAQ,CAAC,OAAO,MAAM;AAC1B,cAAM,SAAS,SAAS,MAAM,QAAQ;AACtC,YAAI,CAAC,OAAQ,OAAM,IAAI,mBAAmB,8BAA8B,MAAM,KAAK,GAAG;AACtF,YAAI,CAAC,gBAAgB,KAAK,MAAM,GAAG;AACjC,gBAAM,IAAI,mBAAmB,iCAAiC,MAAM,KAAK,GAAG;AAAA,QAC9E;AACA,cAAM,QAAQ,SAAS,CAAC;AACxB,oBAAY,KAAK,GAAG,SAAS,MAAM,IAAI,IAAI,UAAU,MAAM,MAAM,GAAG,CAAC,QAAQ,KAAK,GAAG;AACrF,mBAAW,KAAK,IAAI,aAAa,MAAM,OAAO,MAAM,EAAE;AAAA,MACxD,CAAC;AAED,YAAM,WAAW,YAAY,aAAa,SAAS;AACnD,YAAM,OAAQ,MAAO,GAAG,cAAc,EAAU;AAAA,QAC9C,SAAS;AAAA,QACT,SAAS;AAAA,QACT;AAAA,MACF;AAEA,iBAAW,OAAO,OAAO,OAAO,UAAU,EAAG,YAAW,GAAG,IAAI,CAAC;AAChE,iBAAW,KAAK,QAAQ,CAAC,GAAG;AAC1B,cAAM,WAAW,IAAI,SAAS;AAC9B,cAAM,SAAS,aAAa,QAAQ,aAAa,SAAY,KAAK,OAAO,QAAQ;AACjF,mBAAW,CAAC,OAAO,GAAG,KAAK,OAAO,QAAQ,UAAU,GAAG;AACrD,qBAAW,GAAG,EAAE,KAAK,EAAE,KAAK,QAAQ,OAAO,qBAAqB,IAAI,KAAK,CAAC,EAAE,CAAC;AAAA,QAC/E;AAAA,MACF;AAAA,IACF;AACA,WAAO,aAAa;AAAA,EACtB;AAEA,SAAO;AACT;",
+  "names": []
+}

package/dist/backend/dynamic-table/server/dateWindows.js

@@ -0,0 +1,105 @@
+const ISO_DATE_RE = /^\d{4}-\d{2}-\d{2}$/;
+function parseIsoDay(value) {
+  if (typeof value !== "string" || !ISO_DATE_RE.test(value)) return null;
+  const [y, m, d] = value.split("-").map(Number);
+  const date = new Date(y, m - 1, d, 0, 0, 0, 0);
+  return Number.isNaN(date.getTime()) ? null : date;
+}
+function startOfDay(date) {
+  return new Date(date.getFullYear(), date.getMonth(), date.getDate(), 0, 0, 0, 0);
+}
+function endOfDay(date) {
+  return new Date(date.getFullYear(), date.getMonth(), date.getDate(), 23, 59, 59, 999);
+}
+function addUnit(base, n, unit) {
+  if (unit === "weeks") {
+    return new Date(base.getFullYear(), base.getMonth(), base.getDate() + n * 7);
+  }
+  if (unit === "months") {
+    const targetFirst = new Date(base.getFullYear(), base.getMonth() + n, 1);
+    const daysInTarget = new Date(targetFirst.getFullYear(), targetFirst.getMonth() + 1, 0).getDate();
+    return new Date(targetFirst.getFullYear(), targetFirst.getMonth(), Math.min(base.getDate(), daysInTarget));
+  }
+  return new Date(base.getFullYear(), base.getMonth(), base.getDate() + n);
+}
+function parseUnit(value) {
+  return value === "weeks" || value === "months" ? value : "days";
+}
+function isoWeekday(date) {
+  const wd = date.getDay();
+  return wd === 0 ? 7 : wd;
+}
+function startOfWeek(date) {
+  return startOfDay(addUnit(date, 1 - isoWeekday(date), "days"));
+}
+function endOfWeek(date) {
+  return endOfDay(addUnit(date, 7 - isoWeekday(date), "days"));
+}
+function parsePositiveInt(value) {
+  const n = typeof value === "number" ? value : Number(String(value ?? "").trim());
+  return Number.isInteger(n) && n >= 1 ? n : null;
+}
+const DATE_WINDOW_OPERATORS = [
+  "is_between",
+  "is_in_next",
+  "is_in_last",
+  "is_overdue",
+  "is_today",
+  "is_tomorrow",
+  "is_this_week",
+  "is_next_week"
+];
+const WINDOW_OPERATOR_SET = new Set(DATE_WINDOW_OPERATORS);
+function isDateWindowOperator(operator) {
+  return WINDOW_OPERATOR_SET.has(operator);
+}
+function resolveDateWindow(operator, values, now = /* @__PURE__ */ new Date()) {
+  switch (operator) {
+    case "is_between": {
+      const from = parseIsoDay(values[0]);
+      const to = parseIsoDay(values[1]);
+      if (!from && !to) return null;
+      return { from: from ? startOfDay(from) : null, to: to ? endOfDay(to) : null };
+    }
+    case "is_in_next": {
+      const count = parsePositiveInt(values[0]);
+      if (count === null) return null;
+      return { from: startOfDay(now), to: endOfDay(addUnit(now, count, parseUnit(values[1]))) };
+    }
+    case "is_in_last": {
+      const count = parsePositiveInt(values[0]);
+      if (count === null) return null;
+      return { from: startOfDay(addUnit(now, -count, parseUnit(values[1]))), to: endOfDay(now) };
+    }
+    case "is_overdue":
+      return { from: null, to: startOfDay(now), toExclusive: true };
+    case "is_today":
+      return { from: startOfDay(now), to: endOfDay(now) };
+    case "is_tomorrow": {
+      const t = addUnit(now, 1, "days");
+      return { from: startOfDay(t), to: endOfDay(t) };
+    }
+    case "is_this_week":
+      return { from: startOfDay(now), to: endOfWeek(now) };
+    case "is_next_week": {
+      const nextWeek = addUnit(now, 7, "days");
+      return { from: startOfWeek(nextWeek), to: endOfWeek(nextWeek) };
+    }
+    default:
+      return null;
+  }
+}
+export {
+  DATE_WINDOW_OPERATORS,
+  addUnit,
+  endOfDay,
+  endOfWeek,
+  isDateWindowOperator,
+  parseIsoDay,
+  parsePositiveInt,
+  parseUnit,
+  resolveDateWindow,
+  startOfDay,
+  startOfWeek
+};
+//# sourceMappingURL=dateWindows.js.map

package/dist/backend/dynamic-table/server/dateWindows.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/backend/dynamic-table/server/dateWindows.ts"],
+  "sourcesContent": ["/**\n * Date-window resolution for DynamicTable filter operators \u2014 ONE implementation,\n * shared by every list route regardless of how it applies filters.\n *\n * ## Why this file exists (workshop item A14)\n *\n * There are two kinds of list route in this repo:\n *\n *  - **DB-backed** routes push filters into SQL through {@link parseFilterRow}\n *    (`filterParser.ts`). Those understood the now-relative operators.\n *  - **In-memory** routes (the folders Files list, the Transport list) denormalise\n *    rows first and match with their own `applyColumnFilters`. Those did **not**.\n *    Their parser dropped any rule whose right-hand side was empty, and every\n *    preset (`is_today`, `is_tomorrow`, `is_this_week`, `is_next_week`,\n *    `is_overdue`) is deliberately value-less \u2014 so picking \"tomorrow\" on ETD\n *    silently returned the **entire unfiltered table**. `is_in_next` /\n *    `is_in_last` survived the drop but fell through to a substring match, so\n *    \"next 7 days\" matched every row whose ISO timestamp contained a \"7\".\n *\n * Both were invisible: a filter that changes nothing looks like \"no shipments\n * match today\", not like a bug. Resolving the operator to a concrete\n * `[from, to]` window here, once, means the preset and the explicit\n * `is_between` range are the *same mechanism* on every list \u2014 which is the\n * requirement: one operator whose window happens to be computed, the other\n * whose window is typed.\n *\n * All arithmetic is local-time (matching how operators read a calendar) and\n * day-bounded, so a row stored at `2026-06-12 14:30` matches `is_today` on\n * 2026-06-12.\n */\n\nexport type RelativeUnit = 'days' | 'weeks' | 'months'\n\n/**\n * A resolved filter window. `from` is always an inclusive lower bound.\n * `to` is inclusive unless {@link DateWindow.toExclusive} is set \u2014 `is_overdue`\n * is \"strictly before the start of today\", which is not expressible as an\n * inclusive end-of-day bound without an off-by-one-millisecond fudge.\n * Either side may be `null`, meaning unbounded.\n */\nexport type DateWindow = {\n  from: Date | null\n  to: Date | null\n  toExclusive?: boolean\n}\n\nconst ISO_DATE_RE = /^\\d{4}-\\d{2}-\\d{2}$/\n\n/** Parse `YYYY-MM-DD` into a local Date at the start of that day. */\nexport function parseIsoDay(value: unknown): Date | null {\n  if (typeof value !== 'string' || !ISO_DATE_RE.test(value)) return null\n  const [y, m, d] = value.split('-').map(Number)\n  const date = new Date(y, m - 1, d, 0, 0, 0, 0)\n  return Number.isNaN(date.getTime()) ? null : date\n}\n\nexport function startOfDay(date: Date): Date {\n  return new Date(date.getFullYear(), date.getMonth(), date.getDate(), 0, 0, 0, 0)\n}\n\nexport function endOfDay(date: Date): Date {\n  return new Date(date.getFullYear(), date.getMonth(), date.getDate(), 23, 59, 59, 999)\n}\n\n/**\n * Add `n` units to `base` (n may be negative). Days/weeks are plain day\n * arithmetic; months are calendar months with an end-of-month clamp so the\n * result is always a real date instead of a JS Date overflow:\n *   May 31 minus 1 month -> Apr 30   (not May 1)\n *   Jan 31 plus 1 month  -> Feb 28/29 (not Mar 2/3)\n */\nexport function addUnit(base: Date, n: number, unit: RelativeUnit): Date {\n  if (unit === 'weeks') {\n    return new Date(base.getFullYear(), base.getMonth(), base.getDate() + n * 7)\n  }\n  if (unit === 'months') {\n    const targetFirst = new Date(base.getFullYear(), base.getMonth() + n, 1)\n    const daysInTarget = new Date(targetFirst.getFullYear(), targetFirst.getMonth() + 1, 0).getDate()\n    return new Date(targetFirst.getFullYear(), targetFirst.getMonth(), Math.min(base.getDate(), daysInTarget))\n  }\n  return new Date(base.getFullYear(), base.getMonth(), base.getDate() + n)\n}\n\n/** Coerce a stored relative unit value, defaulting to days. */\nexport function parseUnit(value: unknown): RelativeUnit {\n  return value === 'weeks' || value === 'months' ? value : 'days'\n}\n\n/** ISO weekday: Monday = 1 \u2026 Sunday = 7. */\nfunction isoWeekday(date: Date): number {\n  const wd = date.getDay()\n  return wd === 0 ? 7 : wd\n}\n\n/** Monday 00:00 of the ISO week containing `date`. */\nexport function startOfWeek(date: Date): Date {\n  return startOfDay(addUnit(date, 1 - isoWeekday(date), 'days'))\n}\n\n/** Sunday 23:59 of the ISO week containing `date`. */\nexport function endOfWeek(date: Date): Date {\n  return endOfDay(addUnit(date, 7 - isoWeekday(date), 'days'))\n}\n\n/**\n * Coerce a stored relative count to a positive integer, or null if invalid.\n * Uses `Number` (not `parseInt`) so fractional/garbage input like \"1.5\" or\n * \"5abc\" is rejected outright rather than silently truncated.\n */\nexport function parsePositiveInt(value: unknown): number | null {\n  const n = typeof value === 'number' ? value : Number(String(value ?? '').trim())\n  return Number.isInteger(n) && n >= 1 ? n : null\n}\n\n/**\n * Every operator that resolves to a `[from, to]` window.\n *\n * `is_between` is in this list ON PURPOSE. Agnieszka works date-first on an\n * explicit range (\"szybciej mi jest operowa\u0107 na zakresie dat\") and declined\n * more presets; Klaudiusz lives on \"tomorrow\". Both mechanisms must coexist in\n * the same operator list, and the cheapest way to guarantee they never diverge\n * is for them to produce the same shape.\n */\nexport const DATE_WINDOW_OPERATORS = [\n  'is_between',\n  'is_in_next',\n  'is_in_last',\n  'is_overdue',\n  'is_today',\n  'is_tomorrow',\n  'is_this_week',\n  'is_next_week',\n] as const\n\nexport type DateWindowOperator = (typeof DATE_WINDOW_OPERATORS)[number]\n\nconst WINDOW_OPERATOR_SET: ReadonlySet<string> = new Set<string>(DATE_WINDOW_OPERATORS)\n\nexport function isDateWindowOperator(operator: string): operator is DateWindowOperator {\n  return WINDOW_OPERATOR_SET.has(operator)\n}\n\n/**\n * Resolve a window operator + its stored `values` into a concrete\n * `[from, to]` range, anchored to `now`.\n *\n * Returns `null` when the rule cannot produce a window \u2014 an unknown operator,\n * an `is_between` with neither end filled, or an `is_in_next` whose count is\n * missing or not a positive integer. A `null` return means \"drop this rule\",\n * never \"match nothing\".\n *\n * `now` is injected (and re-read per request by callers) so a saved\n * perspective holding `is_tomorrow` keeps meaning *tomorrow*, not the day\n * after it was saved.\n */\nexport function resolveDateWindow(\n  operator: string,\n  values: readonly unknown[],\n  now: Date = new Date(),\n): DateWindow | null {\n  switch (operator) {\n    case 'is_between': {\n      // Explicit range from the two FilterDatePickers \u2014 values = [from, to].\n      // A half-open range (only one end filled) is still a useful filter, so\n      // the missing side is left unbounded rather than dropping the rule.\n      const from = parseIsoDay(values[0])\n      const to = parseIsoDay(values[1])\n      if (!from && !to) return null\n      return { from: from ? startOfDay(from) : null, to: to ? endOfDay(to) : null }\n    }\n    case 'is_in_next': {\n      // Moving window anchored to today: [start of today, end of today + N units].\n      const count = parsePositiveInt(values[0])\n      if (count === null) return null\n      return { from: startOfDay(now), to: endOfDay(addUnit(now, count, parseUnit(values[1]))) }\n    }\n    case 'is_in_last': {\n      const count = parsePositiveInt(values[0])\n      if (count === null) return null\n      return { from: startOfDay(addUnit(now, -count, parseUnit(values[1]))), to: endOfDay(now) }\n    }\n    case 'is_overdue':\n      // Strictly before today \u2014 a date that has already passed.\n      return { from: null, to: startOfDay(now), toExclusive: true }\n    case 'is_today':\n      return { from: startOfDay(now), to: endOfDay(now) }\n    case 'is_tomorrow': {\n      const t = addUnit(now, 1, 'days')\n      return { from: startOfDay(t), to: endOfDay(t) }\n    }\n    case 'is_this_week':\n      // Today through the end of the current ISO week (upcoming, not past days).\n      return { from: startOfDay(now), to: endOfWeek(now) }\n    case 'is_next_week': {\n      const nextWeek = addUnit(now, 7, 'days')\n      return { from: startOfWeek(nextWeek), to: endOfWeek(nextWeek) }\n    }\n    default:\n      return null\n  }\n}\n"],
+  "mappings": "AA8CA,MAAM,cAAc;AAGb,SAAS,YAAY,OAA6B;AACvD,MAAI,OAAO,UAAU,YAAY,CAAC,YAAY,KAAK,KAAK,EAAG,QAAO;AAClE,QAAM,CAAC,GAAG,GAAG,CAAC,IAAI,MAAM,MAAM,GAAG,EAAE,IAAI,MAAM;AAC7C,QAAM,OAAO,IAAI,KAAK,GAAG,IAAI,GAAG,GAAG,GAAG,GAAG,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,KAAK,QAAQ,CAAC,IAAI,OAAO;AAC/C;AAEO,SAAS,WAAW,MAAkB;AAC3C,SAAO,IAAI,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,GAAG,GAAG,GAAG,GAAG,CAAC;AACjF;AAEO,SAAS,SAAS,MAAkB;AACzC,SAAO,IAAI,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,GAAG,IAAI,IAAI,IAAI,GAAG;AACtF;AASO,SAAS,QAAQ,MAAY,GAAW,MAA0B;AACvE,MAAI,SAAS,SAAS;AACpB,WAAO,IAAI,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,IAAI,IAAI,CAAC;AAAA,EAC7E;AACA,MAAI,SAAS,UAAU;AACrB,UAAM,cAAc,IAAI,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,IAAI,GAAG,CAAC;AACvE,UAAM,eAAe,IAAI,KAAK,YAAY,YAAY,GAAG,YAAY,SAAS,IAAI,GAAG,CAAC,EAAE,QAAQ;AAChG,WAAO,IAAI,KAAK,YAAY,YAAY,GAAG,YAAY,SAAS,GAAG,KAAK,IAAI,KAAK,QAAQ,GAAG,YAAY,CAAC;AAAA,EAC3G;AACA,SAAO,IAAI,KAAK,KAAK,YAAY,GAAG,KAAK,SAAS,GAAG,KAAK,QAAQ,IAAI,CAAC;AACzE;AAGO,SAAS,UAAU,OAA8B;AACtD,SAAO,UAAU,WAAW,UAAU,WAAW,QAAQ;AAC3D;AAGA,SAAS,WAAW,MAAoB;AACtC,QAAM,KAAK,KAAK,OAAO;AACvB,SAAO,OAAO,IAAI,IAAI;AACxB;AAGO,SAAS,YAAY,MAAkB;AAC5C,SAAO,WAAW,QAAQ,MAAM,IAAI,WAAW,IAAI,GAAG,MAAM,CAAC;AAC/D;AAGO,SAAS,UAAU,MAAkB;AAC1C,SAAO,SAAS,QAAQ,MAAM,IAAI,WAAW,IAAI,GAAG,MAAM,CAAC;AAC7D;AAOO,SAAS,iBAAiB,OAA+B;AAC9D,QAAM,IAAI,OAAO,UAAU,WAAW,QAAQ,OAAO,OAAO,SAAS,EAAE,EAAE,KAAK,CAAC;AAC/E,SAAO,OAAO,UAAU,CAAC,KAAK,KAAK,IAAI,IAAI;AAC7C;AAWO,MAAM,wBAAwB;AAAA,EACnC;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,EACA;AACF;AAIA,MAAM,sBAA2C,IAAI,IAAY,qBAAqB;AAE/E,SAAS,qBAAqB,UAAkD;AACrF,SAAO,oBAAoB,IAAI,QAAQ;AACzC;AAeO,SAAS,kBACd,UACA,QACA,MAAY,oBAAI,KAAK,GACF;AACnB,UAAQ,UAAU;AAAA,IAChB,KAAK,cAAc;AAIjB,YAAM,OAAO,YAAY,OAAO,CAAC,CAAC;AAClC,YAAM,KAAK,YAAY,OAAO,CAAC,CAAC;AAChC,UAAI,CAAC,QAAQ,CAAC,GAAI,QAAO;AACzB,aAAO,EAAE,MAAM,OAAO,WAAW,IAAI,IAAI,MAAM,IAAI,KAAK,SAAS,EAAE,IAAI,KAAK;AAAA,IAC9E;AAAA,IACA,KAAK,cAAc;AAEjB,YAAM,QAAQ,iBAAiB,OAAO,CAAC,CAAC;AACxC,UAAI,UAAU,KAAM,QAAO;AAC3B,aAAO,EAAE,MAAM,WAAW,GAAG,GAAG,IAAI,SAAS,QAAQ,KAAK,OAAO,UAAU,OAAO,CAAC,CAAC,CAAC,CAAC,EAAE;AAAA,IAC1F;AAAA,IACA,KAAK,cAAc;AACjB,YAAM,QAAQ,iBAAiB,OAAO,CAAC,CAAC;AACxC,UAAI,UAAU,KAAM,QAAO;AAC3B,aAAO,EAAE,MAAM,WAAW,QAAQ,KAAK,CAAC,OAAO,UAAU,OAAO,CAAC,CAAC,CAAC,CAAC,GAAG,IAAI,SAAS,GAAG,EAAE;AAAA,IAC3F;AAAA,IACA,KAAK;AAEH,aAAO,EAAE,MAAM,MAAM,IAAI,WAAW,GAAG,GAAG,aAAa,KAAK;AAAA,IAC9D,KAAK;AACH,aAAO,EAAE,MAAM,WAAW,GAAG,GAAG,IAAI,SAAS,GAAG,EAAE;AAAA,IACpD,KAAK,eAAe;AAClB,YAAM,IAAI,QAAQ,KAAK,GAAG,MAAM;AAChC,aAAO,EAAE,MAAM,WAAW,CAAC,GAAG,IAAI,SAAS,CAAC,EAAE;AAAA,IAChD;AAAA,IACA,KAAK;AAEH,aAAO,EAAE,MAAM,WAAW,GAAG,GAAG,IAAI,UAAU,GAAG,EAAE;AAAA,IACrD,KAAK,gBAAgB;AACnB,YAAM,WAAW,QAAQ,KAAK,GAAG,MAAM;AACvC,aAAO,EAAE,MAAM,YAAY,QAAQ,GAAG,IAAI,UAAU,QAAQ,EAAE;AAAA,IAChE;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;",
+  "names": []
+}

package/dist/backend/dynamic-table/server/filterParser.js

@@ -0,0 +1,97 @@
+import { escapeLikePattern } from "@open-mercato/shared/lib/db/escapeLikePattern";
+import {
+  endOfDay,
+  parseIsoDay,
+  resolveDateWindow,
+  startOfDay
+} from "./dateWindows.js";
+function parseFilterRow(row, fieldMap, now = /* @__PURE__ */ new Date()) {
+  const field = fieldMap[row.field];
+  if (!field) return null;
+  const val = row.values[0];
+  const hasValue = val !== void 0 && val !== null && val !== "";
+  const hasValues = Array.isArray(row.values) && row.values.length > 0;
+  switch (row.operator) {
+    case "is_any_of":
+      if (!hasValues) return null;
+      return { [field]: { $in: row.values } };
+    case "is_not_any_of":
+      if (!hasValues) return null;
+      return { [field]: { $nin: row.values } };
+    case "contains":
+      if (!hasValue) return null;
+      return { [field]: { $ilike: `%${escapeLikePattern(String(val))}%` } };
+    case "is_empty":
+      return { [field]: { $eq: null } };
+    case "is_not_empty":
+      return { [field]: { $ne: null } };
+    case "equals": {
+      if (!hasValue) return null;
+      const day = parseIsoDay(val);
+      if (day) return { [field]: { $gte: startOfDay(day), $lte: endOfDay(day) } };
+      return { [field]: { $eq: val } };
+    }
+    case "not_equals":
+      if (!hasValue) return null;
+      return { [field]: { $ne: val } };
+    case "is_true":
+      return { [field]: { $eq: true } };
+    case "is_false":
+      return { [field]: { $eq: false } };
+    case "greater_than":
+      if (!hasValue) return null;
+      return { [field]: { $gt: val } };
+    case "less_than":
+      if (!hasValue) return null;
+      return { [field]: { $lt: val } };
+    case "is_before": {
+      if (!hasValue) return null;
+      const day = parseIsoDay(val);
+      return { [field]: { $lt: day ?? val } };
+    }
+    case "is_after": {
+      if (!hasValue) return null;
+      const day = parseIsoDay(val);
+      return { [field]: { $gt: day ? endOfDay(day) : val } };
+    }
+    case "is_on_or_before": {
+      if (!hasValue) return null;
+      const day = parseIsoDay(val);
+      return { [field]: { $lte: day ? endOfDay(day) : val } };
+    }
+    case "is_on_or_after": {
+      if (!hasValue) return null;
+      const day = parseIsoDay(val);
+      return { [field]: { $gte: day ? startOfDay(day) : val } };
+    }
+    // ── Windowed date operators ───────────────────────────────────────────────
+    // `is_between` (explicit range) and every now-relative preset / moving
+    // window resolve through ONE shared resolver, so the DB-backed lists and
+    // the in-memory lists can never drift apart on what "tomorrow" means.
+    case "is_between":
+    case "is_in_next":
+    case "is_in_last":
+    case "is_overdue":
+    case "is_today":
+    case "is_tomorrow":
+    case "is_this_week":
+    case "is_next_week": {
+      const window = resolveDateWindow(row.operator, row.values, now);
+      if (!window) return null;
+      const range = {};
+      if (window.from) range.$gte = window.from;
+      if (window.to) range[window.toExclusive ? "$lt" : "$lte"] = window.to;
+      return { [field]: range };
+    }
+    default:
+      return null;
+  }
+}
+function parseDynamicTableFilters(filterRows, fieldMap, now = /* @__PURE__ */ new Date()) {
+  return filterRows.map((row) => parseFilterRow(row, fieldMap, now)).filter((f) => f !== null);
+}
+export {
+  parseDynamicTableFilters,
+  parseFilterRow
+};
+//# sourceMappingURL=filterParser.js.map

package/dist/backend/dynamic-table/server/filterParser.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../../src/backend/dynamic-table/server/filterParser.ts"],
+  "sourcesContent": ["import { escapeLikePattern } from '@open-mercato/shared/lib/db/escapeLikePattern'\nimport {\n  endOfDay,\n  parseIsoDay,\n  resolveDateWindow,\n  startOfDay,\n} from './dateWindows'\n\nexport interface DynamicTableFilterRow {\n  field: string\n  operator: string\n  values: unknown[]\n}\n\n/**\n * Parse a single DynamicTable FilterRow into a MikroORM Where clause.\n * Returns null if the row cannot be parsed (unknown field, missing value, etc.)\n *\n * Date semantics: when an operator is date-typed (`is_before` / `is_after` /\n * `is_on_or_before` / `is_on_or_after` / `is_between`) or when `equals` is\n * given an ISO `YYYY-MM-DD` value, the parser converts the right-hand side\n * into Date objects and uses day-bounded ranges so timestamp columns compare\n * correctly. The on/between/equals operators expand to a [start-of-day,\n * end-of-day] window so a row stored as `2026-05-11 14:30` matches a filter\n * for `equals 2026-05-11`.\n */\nexport function parseFilterRow(\n  row: DynamicTableFilterRow,\n  fieldMap: Record<string, string>,\n  now: Date = new Date()\n): Record<string, unknown> | null {\n  const field = fieldMap[row.field]\n  if (!field) return null\n\n  const val = row.values[0]\n  const hasValue = val !== undefined && val !== null && val !== ''\n  const hasValues = Array.isArray(row.values) && row.values.length > 0\n\n  switch (row.operator) {\n    case 'is_any_of':\n      if (!hasValues) return null\n      return { [field]: { $in: row.values } }\n    case 'is_not_any_of':\n      if (!hasValues) return null\n      return { [field]: { $nin: row.values } }\n    case 'contains':\n      if (!hasValue) return null\n      return { [field]: { $ilike: `%${escapeLikePattern(String(val))}%` } }\n    case 'is_empty':\n      return { [field]: { $eq: null } }\n    case 'is_not_empty':\n      return { [field]: { $ne: null } }\n    case 'equals': {\n      if (!hasValue) return null\n      // Same-day equality for ISO date values; exact-match otherwise.\n      const day = parseIsoDay(val)\n      if (day) return { [field]: { $gte: startOfDay(day), $lte: endOfDay(day) } }\n      return { [field]: { $eq: val } }\n    }\n    case 'not_equals':\n      if (!hasValue) return null\n      return { [field]: { $ne: val } }\n    case 'is_true':\n      return { [field]: { $eq: true } }\n    case 'is_false':\n      return { [field]: { $eq: false } }\n    case 'greater_than':\n      if (!hasValue) return null\n      return { [field]: { $gt: val } }\n    case 'less_than':\n      if (!hasValue) return null\n      return { [field]: { $lt: val } }\n    case 'is_before': {\n      if (!hasValue) return null\n      const day = parseIsoDay(val)\n      // Strictly before the picked day starts.\n      return { [field]: { $lt: day ?? val } }\n    }\n    case 'is_after': {\n      if (!hasValue) return null\n      const day = parseIsoDay(val)\n      // Strictly after the picked day ends.\n      return { [field]: { $gt: day ? endOfDay(day) : val } }\n    }\n    case 'is_on_or_before': {\n      if (!hasValue) return null\n      const day = parseIsoDay(val)\n      // Anywhere on the picked day or earlier.\n      return { [field]: { $lte: day ? endOfDay(day) : val } }\n    }\n    case 'is_on_or_after': {\n      if (!hasValue) return null\n      const day = parseIsoDay(val)\n      return { [field]: { $gte: day ? startOfDay(day) : val } }\n    }\n    // \u2500\u2500 Windowed date operators \u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\u2500\n    // `is_between` (explicit range) and every now-relative preset / moving\n    // window resolve through ONE shared resolver, so the DB-backed lists and\n    // the in-memory lists can never drift apart on what \"tomorrow\" means.\n    case 'is_between':\n    case 'is_in_next':\n    case 'is_in_last':\n    case 'is_overdue':\n    case 'is_today':\n    case 'is_tomorrow':\n    case 'is_this_week':\n    case 'is_next_week': {\n      const window = resolveDateWindow(row.operator, row.values, now)\n      if (!window) return null\n      const range: Record<string, Date> = {}\n      if (window.from) range.$gte = window.from\n      if (window.to) range[window.toExclusive ? '$lt' : '$lte'] = window.to\n      return { [field]: range }\n    }\n    default:\n      return null\n  }\n}\n\n/**\n * Convert an array of DynamicTable FilterRows into MikroORM Where clauses.\n * Filters out rows that cannot be parsed (unknown field, missing value, etc.)\n */\nexport function parseDynamicTableFilters(\n  filterRows: DynamicTableFilterRow[],\n  fieldMap: Record<string, string>,\n  now: Date = new Date()\n): Record<string, unknown>[] {\n  return filterRows\n    .map((row) => parseFilterRow(row, fieldMap, now))\n    .filter((f): f is Record<string, unknown> => f !== null)\n}\n"],
+  "mappings": "AAAA,SAAS,yBAAyB;AAClC;AAAA,EACE;AAAA,EACA;AAAA,EACA;AAAA,EACA;AAAA,OACK;AAoBA,SAAS,eACd,KACA,UACA,MAAY,oBAAI,KAAK,GACW;AAChC,QAAM,QAAQ,SAAS,IAAI,KAAK;AAChC,MAAI,CAAC,MAAO,QAAO;AAEnB,QAAM,MAAM,IAAI,OAAO,CAAC;AACxB,QAAM,WAAW,QAAQ,UAAa,QAAQ,QAAQ,QAAQ;AAC9D,QAAM,YAAY,MAAM,QAAQ,IAAI,MAAM,KAAK,IAAI,OAAO,SAAS;AAEnE,UAAQ,IAAI,UAAU;AAAA,IACpB,KAAK;AACH,UAAI,CAAC,UAAW,QAAO;AACvB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,IAAI,OAAO,EAAE;AAAA,IACxC,KAAK;AACH,UAAI,CAAC,UAAW,QAAO;AACvB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,IAAI,OAAO,EAAE;AAAA,IACzC,KAAK;AACH,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,QAAQ,IAAI,kBAAkB,OAAO,GAAG,CAAC,CAAC,IAAI,EAAE;AAAA,IACtE,KAAK;AACH,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE;AAAA,IAClC,KAAK;AACH,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE;AAAA,IAClC,KAAK,UAAU;AACb,UAAI,CAAC,SAAU,QAAO;AAEtB,YAAM,MAAM,YAAY,GAAG;AAC3B,UAAI,IAAK,QAAO,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,WAAW,GAAG,GAAG,MAAM,SAAS,GAAG,EAAE,EAAE;AAC1E,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE;AAAA,IACjC;AAAA,IACA,KAAK;AACH,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE;AAAA,IACjC,KAAK;AACH,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,KAAK,EAAE;AAAA,IAClC,KAAK;AACH,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,EAAE;AAAA,IACnC,KAAK;AACH,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE;AAAA,IACjC,KAAK;AACH,UAAI,CAAC,SAAU,QAAO;AACtB,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,IAAI,EAAE;AAAA,IACjC,KAAK,aAAa;AAChB,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,MAAM,YAAY,GAAG;AAE3B,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,OAAO,IAAI,EAAE;AAAA,IACxC;AAAA,IACA,KAAK,YAAY;AACf,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,MAAM,YAAY,GAAG;AAE3B,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,KAAK,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE;AAAA,IACvD;AAAA,IACA,KAAK,mBAAmB;AACtB,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,MAAM,YAAY,GAAG;AAE3B,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,MAAM,SAAS,GAAG,IAAI,IAAI,EAAE;AAAA,IACxD;AAAA,IACA,KAAK,kBAAkB;AACrB,UAAI,CAAC,SAAU,QAAO;AACtB,YAAM,MAAM,YAAY,GAAG;AAC3B,aAAO,EAAE,CAAC,KAAK,GAAG,EAAE,MAAM,MAAM,WAAW,GAAG,IAAI,IAAI,EAAE;AAAA,IAC1D;AAAA;AAAA;AAAA;AAAA;AAAA,IAKA,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK;AAAA,IACL,KAAK,gBAAgB;AACnB,YAAM,SAAS,kBAAkB,IAAI,UAAU,IAAI,QAAQ,GAAG;AAC9D,UAAI,CAAC,OAAQ,QAAO;AACpB,YAAM,QAA8B,CAAC;AACrC,UAAI,OAAO,KAAM,OAAM,OAAO,OAAO;AACrC,UAAI,OAAO,GAAI,OAAM,OAAO,cAAc,QAAQ,MAAM,IAAI,OAAO;AACnE,aAAO,EAAE,CAAC,KAAK,GAAG,MAAM;AAAA,IAC1B;AAAA,IACA;AACE,aAAO;AAAA,EACX;AACF;AAMO,SAAS,yBACd,YACA,UACA,MAAY,oBAAI,KAAK,GACM;AAC3B,SAAO,WACJ,IAAI,CAAC,QAAQ,eAAe,KAAK,UAAU,GAAG,CAAC,EAC/C,OAAO,CAAC,MAAoC,MAAM,IAAI;AAC3D;",
+  "names": []
+}

package/dist/backend/dynamic-table/server/filterSuggestions.js

@@ -0,0 +1,70 @@
+const IDENTIFIER = /^[a-z_][a-z0-9_]*$/i;
+function assertIdentifier(kind, value) {
+  if (!IDENTIFIER.test(value)) {
+    throw new Error(`Unsafe ${kind} identifier for filter suggestions: ${JSON.stringify(value)}`);
+  }
+  return `"${value}"`;
+}
+async function distinctColumnValues(opts) {
+  const limit = Math.min(Math.max(opts.limit ?? 50, 1), 200);
+  const base = assertIdentifier("table", opts.table);
+  const columns = (Array.isArray(opts.column) ? opts.column : [opts.column]).map((c) => assertIdentifier("column", c));
+  if (columns.length === 0) return [];
+  const params = [];
+  const where = [];
+  let from = `${base} AS t`;
+  let prefix = "t";
+  if (opts.join) {
+    const jt = assertIdentifier("table", opts.join.table);
+    const on = assertIdentifier("column", opts.join.on);
+    const foreign = assertIdentifier("column", opts.join.foreign);
+    from = `${base} AS t INNER JOIN ${jt} AS j ON j.${foreign} = t.${on}`;
+    prefix = "j";
+  }
+  const target = columns.length === 1 ? `${prefix}.${columns[0]}` : `unnest(ARRAY[${columns.map((c) => `${prefix}.${c}::text`).join(", ")}])`;
+  for (const [rawColumn, value] of Object.entries(opts.scope ?? {})) {
+    if (value === void 0) continue;
+    const scoped = `t.${assertIdentifier("column", rawColumn)}`;
+    if (value === null) {
+      where.push(`${scoped} IS NULL`);
+    } else if (Array.isArray(value)) {
+      if (value.length === 0) return [];
+      const holes = value.map((entry) => {
+        params.push(entry);
+        return "?";
+      });
+      where.push(`${scoped} IN (${holes.join(", ")})`);
+    } else {
+      params.push(value);
+      where.push(`${scoped} = ?`);
+    }
+  }
+  const needle = (opts.query ?? "").trim();
+  const scopeWhere = where.length > 0 ? `WHERE ${where.join(" AND ")} ` : "";
+  const outer = ["value IS NOT NULL", "btrim(value) <> ''"];
+  let sql;
+  if (columns.length === 1) {
+    if (needle) params.push(`%${needle}%`);
+    const outerSql = [...outer, ...needle ? ["value ILIKE ?"] : []].join(" AND ");
+    sql = `SELECT DISTINCT value FROM (SELECT ${target}::text AS value FROM ${from} ${scopeWhere}) s WHERE ${outerSql} ORDER BY value ASC LIMIT ?`;
+  } else {
+    if (needle) params.push(`%${needle}%`);
+    const outerSql = [...outer, ...needle ? ["value ILIKE ?"] : []].join(" AND ");
+    sql = `SELECT DISTINCT value FROM (SELECT ${target} AS value FROM ${from} ${scopeWhere}) s WHERE ${outerSql} ORDER BY value ASC LIMIT ?`;
+  }
+  params.push(limit);
+  try {
+    const rows = await opts.em.getConnection().execute(sql, params);
+    return Array.isArray(rows) ? rows.map((r) => r.value).filter(Boolean) : [];
+  } catch (err) {
+    console.error(
+      `[filter-suggestions] query failed for ${opts.table}.${opts.column}:`,
+      err instanceof Error ? err.message : err
+    );
+    return [];
+  }
+}
+export {
+  distinctColumnValues
+};
+//# sourceMappingURL=filterSuggestions.js.map