@isrd-isi-edu/ermrestjs 2.9.1 → 2.11.0

package/js/hatrac.js

@@ -4,7 +4,7 @@ import { ArrayBuffer } from 'spark-md5';
 
 // models
 // import DeferredPromise from '@isrd-isi-edu/ermrestjs/src/models/deferred-promise';
-import { MalformedURIError } from '@isrd-isi-edu/ermrestjs/src/models/errors';
+import { InvalidInputError, MalformedURIError } from '@isrd-isi-edu/ermrestjs/src/models/errors';
 
 // services
 import ErrorService from '@isrd-isi-edu/ermrestjs/src/services/error';
@@ -231,7 +231,7 @@ Upload.prototype.validateURL = function (row, linkedData, templateVariables) {
     // TODO is this needed?
     // make sure to add raw columns too.
     ignoredColumns.forEach(function (col) {
-      ignoredColumns.push("_" + col);
+      ignoredColumns.push('_' + col);
     });
 
     var keyValues = _getFormattedKeyValues(this.reference.table, this.reference._context, row, linkedData);
@@ -503,7 +503,12 @@ Upload.prototype.start = function (startChunkIdx, onProgress) {
     this.chunks = [];
 
     if (this.file.size === 0) {
-      deferred.resolve(this.url);
+      // empty (0-byte) uploads are rejected unless the asset annotation opts in via allow_empty_file
+      if (this.column.allowEmptyFile) {
+        deferred.resolve(this.url);
+      } else {
+        deferred.reject(new InvalidInputError(`The file "${this.file.name}" is empty (0 bytes). Empty files are not allowed.`));
+      }
       return deferred.promise;
     } else {
       while (start < this.file.size) {

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@isrd-isi-edu/ermrestjs",
   "description": "ERMrest client library in JavaScript",
-  "version": "2.9.1",
+  "version": "2.11.0",
   "license": "Apache-2.0",
   "engines": {
     "node": ">= 20.0.0",
@@ -55,31 +55,32 @@
     "@types/lodash-es": "^4.17.12",
     "@types/markdown-it": "^14.1.2",
     "@types/q": "^1.5.8",
-    "axios": "1.16.0",
+    "axios": "1.18.1",
     "handlebars": "4.7.9",
     "lodash-es": "^4.18.1",
     "lz-string": "^1.5.0",
-    "markdown-it": "12.3.2",
+    "markdown-it": "14.2.0",
+    "markdown-it-attrs": "5.0.0",
     "moment": "2.29.4",
     "moment-timezone": "0.5.48",
     "mustache": "x",
     "q": "1.5.1",
     "spark-md5": "^3.0.0",
     "terser": "^5.44.1",
-    "typescript": "~5.9.3",
-    "vite": "^8.0.16",
+    "typescript": "~6.0.3",
+    "vite": "^8.1.2",
     "vite-plugin-compression2": "^2.5.3"
   },
   "devDependencies": {
     "@commitlint/cli": "^20.2.0",
     "@commitlint/config-conventional": "^20.2.0",
-    "@eslint/js": "^9.39.2",
+    "@eslint/js": "^10.0.1",
     "@isrd-isi-edu/ermrest-data-utils": "0.0.5",
-    "@types/node": "^25.0.3",
-    "eslint": "^9.39.2",
+    "@types/node": "^26.1.0",
+    "eslint": "^10.6.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-prettier": "^5.5.4",
-    "globals": "^17.4.0",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
     "jasmine": "2.5.3",
     "jasmine-expect": "3.7.1",
@@ -88,6 +89,6 @@
     "prettier": "^3.8.1",
     "require-reload": "^0.2.2",
     "rollup-plugin-visualizer": "^6.0.3",
-    "typescript-eslint": "^8.51.0"
+    "typescript-eslint": "^8.62.1"
   }
 }

package/src/models/reference/reference.ts

@@ -930,18 +930,22 @@ export class Reference {
     if (isDetailed) {
       this.generateRelatedList(tuple).forEach((rel, i) => {
         const rc = rel.pseudoColumn?.resolvedCondition;
+        // source hash of this related entity, used by the consolidation pass to match
+        // data consumers (wait_fors, citation, condition sources) of the same source.
+        // Mirrors how generateRelatedList computes fkName.
+        const relSourceName = rel.pseudoColumn ? rel.pseudoColumn.name : (_sourceColumnHelpers.generateForeignKeyName(rel.origFKR, true) as string);
         /**
          * if there's a condition, we have to capture the requests generated for the related entity as its dependencies.
-         * So when the condition is evaludated, we can decide whether to run those requests or not.
+         * So when the condition is evaluated, we can decide whether to run those requests or not.
          */
         const addRelatedToDeps = (deps: Array<ActiveListRequest | ActiveListRelatedEntityRequest>) => {
-          deps.push({ related: true, index: i });
+          deps.push({ related: true, index: i, entitysetSourceName: relSourceName });
           rel.pseudoColumn?.waitFor.forEach((wf) => {
             builder.addColToDependent(deps, wf, true, ActiveListRequestTypes.RELATED, i);
           });
         };
         if (tryCondition(rc, { related: true, index: i }, addRelatedToDeps)) return;
-        builder.requests.push({ related: true, index: i });
+        builder.requests.push({ related: true, index: i, entitysetSourceName: relSourceName });
         rel.pseudoColumn?.waitFor.forEach((wf) => {
           builder.addCol(wf, true, ActiveListRequestTypes.RELATED, i);
         });

package/src/models/reference-column/asset-pseudo-column.ts

@@ -41,6 +41,7 @@ type AssetMetadata = {
  * @property {(Column|boolean|null)} md5 if it's string, then it is the name of column we want to store md5 inside of it. If it's true, that means we must use md5.
  * @property {(Column|boolean|null)} sha256 if it's string, then it is the name of column we want to store sha256 inside of it. If it's true, that means we must use sha256.
  * @property {(string[]|null)} filenameExtFilter set of filename extension filters for use by upload agents to indicate to the user the acceptable filename patterns.
+ * @property {boolean} allowEmptyFile whether empty (0-byte) file uploads are allowed. Defaults to false.
  *
  * @desc
  * Constructor for AssetPseudoColumn.
@@ -73,6 +74,7 @@ export class AssetPseudoColumn extends ReferenceColumn {
   private _filenamePattern?: string;
   private _filenameExtFilter?: string[];
   private _filenameExtRegexp?: string[];
+  private _allowEmptyFile?: boolean;
   private _displayImagePreview?: boolean;
   private _filePreview?: FilePreviewConfig | null;
 
@@ -438,6 +440,17 @@ export class AssetPseudoColumn extends ReferenceColumn {
     return this._filenameExtRegexp;
   }
 
+  /**
+   * Whether empty (0-byte) file uploads are allowed for this asset column.
+   * Defaults to false, meaning empty files are rejected.
+   */
+  get allowEmptyFile(): boolean {
+    if (this._allowEmptyFile === undefined) {
+      this._allowEmptyFile = this._annotation.allow_empty_file === true;
+    }
+    return this._allowEmptyFile;
+  }
+
   /**
    * whether we should show the image preview or not
    */

package/src/services/active-list.ts

@@ -68,6 +68,18 @@ export type ActiveListRelatedEntityRequest = {
   related?: boolean;
   /** the index of the related entity in the reference.related array */
   index: number;
+  /**
+   * the source hash (pseudo-column name) of the displayed entity set. Set so the
+   * consolidation pass can match data consumers (values, wait_fors, citation,
+   * condition sources) of the same source onto this display request.
+   */
+  entitysetSourceName?: string;
+  /**
+   * consumers folded onto this display request by the consolidation pass. When
+   * present, chaise routes the display read's page to these consumers instead of
+   * issuing a separate fetch. Mirrors `ActiveListRequest.objects`.
+   */
+  objects?: Array<ActiveListRequestObject>;
 };
 
 /**
@@ -333,7 +345,7 @@ export class ActiveListBuilder {
    */
   addInline(col: VisibleColumn, i: number): void {
     if (isRelatedColumn(col)) {
-      this.requests.push({ inline: true, index: i });
+      this.requests.push({ inline: true, index: i, entitysetSourceName: col.name });
     } else {
       this.addCol(col, false, ActiveListRequestTypes.COLUMN, i);
     }
@@ -346,7 +358,7 @@ export class ActiveListBuilder {
   /** Same as addInline but adds to dependent requests in a conditional group */
   addInlineToDependent(dependentRequests: Array<ActiveListRequest | ActiveListRelatedEntityRequest>, col: VisibleColumn, i: number): void {
     if (isRelatedColumn(col)) {
-      dependentRequests.push({ inline: true, index: i });
+      dependentRequests.push({ inline: true, index: i, entitysetSourceName: col.name });
     } else {
       this.addColToDependent(dependentRequests, col, false, ActiveListRequestTypes.COLUMN, i);
     }
@@ -423,10 +435,90 @@ export class ActiveListBuilder {
     this.allOutBounds.push(fkCol);
   }
 
+  /**
+   * consolidates the requests in this.requests and this.conditionalGroups.dependentRequests
+   * to avoid duplicate reads for the same source.
+   *
+   * - Uses similar dedup logic as `consideredSets` / `consideredAggregates`
+   * (group by source hash, first request wins, the rest attach their `objects`),
+   * plus one clause: a display (visible inline or related entities) wins when one exists,
+   * so a source that is both displayed and consumed is read once.
+   * - Runs as a final pass rather than an inline map because related displays are registered
+   * after the consumers that reference them, so at consumer time the display does not exist yet.
+   * - A fold removes the duplicate from wherever it lives (`requests` or a group's
+   * `dependentRequests`); a deferred merge target is promoted into `requests` when any
+   * request for its source is unconditional, so the read happens on load. Nothing is ever
+   * added to a group's `dependentRequests`.
+   */
+  private consolidateRequests(): void {
+    if (!this.isDetailed) return;
+
+    type LocatedRequest = {
+      requestList: Array<ActiveListRequest | ActiveListRelatedEntityRequest>;
+      req: ActiveListRequest & ActiveListRelatedEntityRequest;
+      isRelatedOrInline: boolean;
+      isUnconditional: boolean;
+    };
+
+    // capture all the requests that we have (conditioned + unconditioned).
+    // null-prototype so a schema-controlled source hash like `__proto__` is a plain key.
+    const requestsBySource: { [hash: string]: LocatedRequest[] } = Object.create(null);
+    const collect = (requestList: Array<ActiveListRequest | ActiveListRelatedEntityRequest>, isUnconditional: boolean) => {
+      requestList.forEach((r) => {
+        const req = r as ActiveListRequest & ActiveListRelatedEntityRequest;
+        const isRelatedOrInline = !!(req.inline || req.related);
+        const hash = isRelatedOrInline ? req.entitysetSourceName : req.column?.name;
+        if (typeof hash !== 'string') return;
+        if (!(hash in requestsBySource)) requestsBySource[hash] = [];
+        requestsBySource[hash].push({ requestList, req, isRelatedOrInline, isUnconditional });
+      });
+    };
+    collect(this.requests, true);
+    this.conditionalGroups.forEach((group) => collect(group.dependentRequests, false));
+
+    Object.keys(requestsBySource).forEach((hash) => {
+      const entries = requestsBySource[hash];
+      if (entries.length < 2) return;
+
+      /**
+       * Prefer a display as the merge target (even a conditional one): it renders the
+       * table AND yields the rows the data consumers need, so everyone reuses its read.
+       * A conditional display is promoted to run on load below when needed. With no
+       * display and no unconditional consumer there is no safe target, so skip: e.g.
+       * condition A gates column X and condition B gates column Y, both X and Y valued
+       * from the same entity set `H`. Folding B's `H` onto A would gate Y behind A, so
+       * if A is false but B is true, Y loses its data. Leave them as two reads.
+       */
+      const displays = entries.filter((e) => e.isRelatedOrInline);
+      const mergeTarget = displays.find((e) => e.isUnconditional) || displays[0] || entries.find((e) => e.isUnconditional);
+      if (!mergeTarget) return;
+
+      const anyUnconditional = entries.some((e) => e.isUnconditional);
+      entries.forEach((e) => {
+        if (e === mergeTarget) return;
+        // when the merge target is deferred, only fold unconditional requests or ones in
+        // the merge target's own list (never another group's dependent)
+        if (!mergeTarget.isUnconditional && !e.isUnconditional && e.requestList !== mergeTarget.requestList) return;
+        if (!mergeTarget.req.objects) mergeTarget.req.objects = [];
+        if (Array.isArray(e.req.objects)) mergeTarget.req.objects.push(...e.req.objects);
+        const idx = e.requestList.indexOf(e.req);
+        if (idx !== -1) e.requestList.splice(idx, 1);
+      });
+
+      // a deferred merge target that has an unconditional request must run on load.
+      if (!mergeTarget.isUnconditional && anyUnconditional) {
+        const idx = mergeTarget.requestList.indexOf(mergeTarget.req);
+        if (idx !== -1) mergeTarget.requestList.splice(idx, 1);
+        this.requests.push(mergeTarget.req);
+      }
+    });
+  }
+
   /**
    * Return the built ActiveList object. After calling this method, the builder should not be used anymore.
    */
   build(): ActiveList {
+    this.consolidateRequests();
     return {
       requests: this.requests,
       conditionalGroups: this.conditionalGroups,

package/src/services/handlebars.ts

@@ -400,7 +400,16 @@ export default class HandlebarsService {
           precision = options.hash.precision;
           tooltip = options.hash.tooltip;
         }
-        return _formatUtils.humanizeBytes(value, mode, precision, tooltip);
+
+        /**
+         * humanizeBytes generates markup like this:
+         * :span:1.23 KB:/span:{data-chaise-tooltip="1.23 KB"}
+         * So we have to make sure handlebars is not HTML-escaping it. Doing so breaks the attribute markup.
+         * NOTE: this is safe only because humanizeBytes derives its output entirely from the numeric byte value
+         * (no user-provided text). If we ever let users supply their own tooltip text, the SafeString would expose
+         * an HTML-injection vector and we'd need a different solution (escape the user portion before returning).
+         */
+        return new Handlebars.SafeString(_formatUtils.humanizeBytes(value, mode, precision, tooltip));
       },
 
       /**
@@ -422,7 +431,16 @@ export default class HandlebarsService {
           direction = options.hash.direction;
           tooltip = options.hash.tooltip;
         }
-        return _formatUtils.datetimeDuration(start, end, unit, fraction, direction, tooltip);
+
+        /**
+         * datetimeDuration generates markup like this:
+         * :span:+1.1 months:/span:{data-chaise-tooltip="1.1 months"}
+         * So we have to make sure handlebars is not HTML-escaping it. Doing so breaks the attribute markup.
+         * NOTE: this is safe only because datetimeDuration derives its output entirely from the start/end values
+         * (no user-provided text). If we ever let users supply their own tooltip text, the SafeString would expose
+         * an HTML-injection vector and we'd need a different solution (escape the user portion before returning).
+         */
+        return new Handlebars.SafeString(_formatUtils.datetimeDuration(start, end, unit, fraction, direction, tooltip));
       },
 
       /**
@@ -629,6 +647,20 @@ export default class HandlebarsService {
         return Array.isArray(array) && array.includes(value);
       },
 
+      /**
+       * {{#if (overlaps arrayCol "a" "b")}}
+       * {{#if (overlaps arrayCol someArray)}}
+       * {{#if (overlaps arrayCol (pluck $self "values.type"))}}
+       *
+       * Variadic candidate args; any array argument is flattened one level.
+       * @returns true if `array` shares at least one element with the candidates
+       */
+      overlaps: function (array: unknown, ...args: unknown[]) {
+        if (!Array.isArray(array)) return false;
+        const candidates = flattenVariadicArgs(args);
+        return array.some((v) => candidates.includes(v));
+      },
+
       /**
        * {{pluck $self "values.type"}}
        *

package/src/services/http.ts

@@ -304,8 +304,10 @@ export default class HTTPService {
                 }
               } else {
                 // If we get an HTTP error with HTML in it, this means something the server returned as an error.
-                // Ermrest never produces HTML errors, so this was produced by the server itself
-                if (contentType && contentType.indexOf('html') > -1) {
+                // Ermrest never produces HTML errors, so this was produced by the server itself.
+                // Callers that hit non-ermrest endpoints (e.g. checking an arbitrary image URL) can set
+                // `skipHTTPErrorStatusReplacement` to keep the raw status instead of masking it as 500.
+                if (contentType && contentType.indexOf('html') > -1 && !config.skipHTTPErrorStatusReplacement) {
                   response.status = _http_status_codes.internal_server_error;
                   // keep response.data the way it is, so client can provide more info to users
                 }

package/src/utils/constants.ts

@@ -298,6 +298,7 @@ export const _handlebarsHelpersList = [
   // list/array helpers
   'memberOf',
   'hasMember',
+  'overlaps',
   'pluck',
 ];
 
@@ -480,6 +481,8 @@ export const _classNames = Object.freeze({
   showInPrintMode: 'video-info-in-print',
   colorPreview: 'chaise-color-preview',
   imagePreview: 'chaise-image-preview',
+  // chaise attaches an onerror handler to images with this class to show a fallback
+  imageFallback: 'chaise-image-fallback',
 });
 
 export const _specialSourceDefinitions = Object.freeze({

package/src/utils/format-utils.ts

@@ -573,6 +573,9 @@ export function printColor(value: any, options?: any): string {
  *                   output in a Chaise tooltip span showing the raw byte
  *                   count and the unit conversion factor
  * @returns the humanized byte string
+ *
+ * SECURITY: Do NOT interpolate raw, user-controlled strings into the output without escaping/validating them first.
+ * The handlebars `humanizeBytes` helper returns this output as a Handlebars.SafeString (unescaped).
  */
 export function humanizeBytes(value: any, mode?: any, precision?: any, withTooltip?: any): string {
   // we cannot use parseInt here since it won't allow larger numbers.
@@ -642,6 +645,9 @@ export function humanizeBytes(value: any, mode?: any, precision?: any, withToolt
  *                   tooltip body would conflict with the calendar walk
  *                   already visible in line 1)
  * @returns the formatted duration string
+ *
+ * SECURITY: Do NOT interpolate raw, user-controlled strings into the output without escaping/validating them first.
+ * The handlebars `datetimeDuration` helper returns this output as a Handlebars.SafeString (unescaped).
  */
 export function datetimeDuration(start: any, end: any, unit?: any, fraction?: any, direction?: any, withTooltip?: any): string {
   const startM = moment(start);

package/src/utils/markdown-utils.ts

@@ -12,9 +12,11 @@ import markdownItSub from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-sub.min';
 import markdownItSup from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-sup.min';
 import markdownItSpan from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-span';
 import markdownItEscape from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-escape';
-import markdownItAttrs from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-attrs';
 import MarkdownItContainer from '@isrd-isi-edu/ermrestjs/vendor/markdown-it-container.min';
 
+// npm package (replaces the previously vendored markdown-it-attrs)
+import markdownItAttrs from 'markdown-it-attrs';
+
 let _markdownItDefaultImageRenderer: any = null;
 export const MarkdownIt = markdownit({ typographer: true, breaks: true })
   .use(markdownItSub)
@@ -32,11 +34,48 @@ _bindCustomMarkdownTags(MarkdownIt);
  * @param throwError if true, it will throw the error instead of swalloing it
  */
 export function renderMarkdown(value: string, inline?: boolean, throwError?: boolean) {
+  /*
+   * markdown-it-attrs 5.x catches errors thrown while applying an attribute
+   * block and only reports them via `console.error` (it has no error callback
+   * or opt-out). To preserve the old "if anything fails, show the raw value"
+   * behavior, trap that signal during the render and treat it as a failure so
+   * we fall back to the raw value below instead of returning a partial render.
+   */
+  let attrsError: string | null = null;
+  // message of the failure we just captured; used to recognize its stack-trace follow-up
+  let pendingMessage: string | null = null;
+  const consoleError = console.error;
+  console.error = (...args: any[]) => {
+    if (typeof args[0] === 'string' && args[0].indexOf('markdown-it-attrs:') === 0) {
+      attrsError = args[0];
+      /*
+       * markdown-it-attrs logs the message above and then `console.error(error.stack)`
+       * on the very next call (see its index.js: the two calls are consecutive and
+       * synchronous). error.stack is a string, not an Error, so we match it by content:
+       * the stack embeds the same `error.message` that trails this message.
+       */
+      pendingMessage = args[0].replace(/^markdown-it-attrs: Error in pattern '.*?': /, '');
+      return;
+    }
+    // swallow only that stack-trace follow-up; anything else is unrelated and must pass through
+    if (pendingMessage !== null) {
+      const message = pendingMessage;
+      pendingMessage = null;
+      if (message.length > 0 && typeof args[0] === 'string' && args[0].indexOf(message) !== -1) {
+        return;
+      }
+    }
+    consoleError.apply(console, args);
+  };
+
   try {
-    if (inline) {
-      return MarkdownIt.renderInline(value);
+    const rendered = inline ? MarkdownIt.renderInline(value) : MarkdownIt.render(value);
+    pendingMessage = null; // render is done; don't let a dangling flag swallow our own catch logging
+    // markdown-it-attrs only logs (never throws), so re-throw here to fall back to the raw value
+    if (attrsError !== null) {
+      throw new Error(attrsError);
     }
-    return MarkdownIt.render(value);
+    return rendered;
   } catch (e) {
     if (throwError) {
       throw e;
@@ -45,6 +84,8 @@ export function renderMarkdown(value: string, inline?: boolean, throwError?: boo
     $log.error(`Couldn't parse the given markdown value: ${value}`);
     $log.error(e);
     return value;
+  } finally {
+    console.error = consoleError;
   }
 }
 
@@ -476,8 +517,9 @@ function _bindCustomMarkdownTags(md: typeof MarkdownIt) {
           if (attrs[0].children[0].type == 'link_open') {
             let imageHTML = '<img ';
             const openingLink = attrs[0].children[0];
-            let enlargeLink,
-              posTop = true;
+            let enlargeLink;
+            let posTop = true;
+            let imageClass = _classNames.imageFallback;
 
             // Add all attributes to the image
             openingLink.attrs!.forEach(function (attr) {
@@ -497,12 +539,15 @@ function _bindCustomMarkdownTags(md: typeof MarkdownIt) {
                 case 'pos':
                   posTop = attr[1].toLowerCase() == 'bottom' ? false : true;
                   break;
+                case 'class':
+                  imageClass += ' ' + attr[1];
+                  break;
                 default:
                   imageHTML += attr[0] + '="' + attr[1] + '" ';
               }
             });
 
-            html += imageHTML + '/>';
+            html += imageHTML + 'class="' + imageClass + '" />';
 
             let captionHTML = '';
 
@@ -918,16 +963,17 @@ function _bindCustomMarkdownTags(md: typeof MarkdownIt) {
       };
   }
 
-  // the class that we should add
-  const className = _classNames.postLoad;
+  // the classes that we should add (post-load for layout, image-fallback so chaise
+  // can swap in a fallback image when the image fails to load)
+  const imgClassName = _classNames.postLoad + ' ' + _classNames.imageFallback;
   md.renderer.rules.image = function (tokens, idx, options, env, self) {
     const token = tokens[idx];
 
     const cIndex = token.attrIndex('class');
     if (cIndex < 0) {
-      token.attrPush(['class', className]);
+      token.attrPush(['class', imgClassName]);
     } else {
-      token.attrs![cIndex][1] += ' ' + className;
+      token.attrs![cIndex][1] += ' ' + imgClassName;
     }
 
     return _markdownItDefaultImageRenderer(tokens, idx, options, env, self);

package/src/utils/template-utils.ts

@@ -60,6 +60,18 @@ export function buildSelfTemplateVariables(column: ReferenceColumn, mainTuple: T
     };
   }
 
+  // InboundForeignKeyPseudoColumn: a single-inbound-FK entity set. Like the
+  // isPathColumn entityset case, use the fetched page's templateVariables.
+  if ((column as any).isInboundForeignKey) {
+    if (columnValue && columnValue.templateVariables) {
+      if (Array.isArray(columnValue.templateVariables)) {
+        return { $self: columnValue.templateVariables };
+      }
+      return columnValue.templateVariables;
+    }
+    return {};
+  }
+
   // PseudoColumn (path-based source column)
   if ((column as any).isPathColumn) {
     const pseudoCol = column as PseudoColumn;
@@ -88,8 +100,14 @@ export function buildSelfTemplateVariables(column: ReferenceColumn, mainTuple: T
       };
     }
 
-    // entityset: use templateVariables from the page result
+    // entityset vs aggregate value:
+    // - an entityset's value is the page, whose templateVariables is the bare array
+    //   of per-row template variables -> wrap it as $self.
+    // - an aggregate value already carries { $self, $_self } (chaise builds it) -> use as-is.
     if (columnValue && columnValue.templateVariables) {
+      if (Array.isArray(columnValue.templateVariables)) {
+        return { $self: columnValue.templateVariables };
+      }
       return columnValue.templateVariables;
     }
 

package/tsconfig.json

@@ -23,7 +23,8 @@
     "noUnusedLocals": false,
     "noUnusedParameters": false, // TODO change this back
     "noFallthroughCasesInSwitch": true,
-    "noUncheckedSideEffectImports": true
+    "noUncheckedSideEffectImports": true,
+    "types": ["node"]
   },
   "include": ["src"]
 }