@objectstack/service-analytics 17.1.0 → 17.2.0

package/dist/index.d.cts

@@ -1308,6 +1308,11 @@ declare class NativeSQLStrategy implements AnalyticsStrategy {
      */
     private lookupMember;
     private resolveDimensionSql;
+    /**
+     * @param predicate - The measure's own scoped filter, already compiled to a
+     *   SQL boolean (`null` = the measure declares none, or declares one that
+     *   constrains nothing — `compileFilterNode`'s TRUE). #10298.
+     */
     private resolveMeasureSql;
     private resolveFieldSql;
     /**
@@ -1443,6 +1448,59 @@ declare class ObjectQLStrategy implements AnalyticsStrategy {
     private withReadScope;
     /** Is `field` a resolved cross-object (relationship-traversal) reference? */
     private isCrossObjectField;
+    /**
+     * The member view {@link planCrossObject} judges a filter by: EVERY member
+     * that will end up in the engine's predicate, structure discarded, keyed by
+     * RESOLVED field name (#10759), valued by WHERE THE MEMBER CAME FROM
+     * (#10861).
+     *
+     * Both call sites — `execute()` and `generateSql()` — are handed this and
+     * nothing else, which is what makes the invariant `planCrossObject` states
+     * for itself ("the preview accepts/rejects the same set") structural rather
+     * than a coincidence maintained by hand. They used to build the view
+     * separately: the echo flattened the tree, `execute()` passed the ENGINE
+     * FILTER, and a filter record answers a different question — it is a
+     * predicate to evaluate, not an inventory of members. An `$or`, a `$not` or
+     * an unmergeable nested `$and` travels in it as one opaque `$and` entry, so
+     * the members inside were unreadable from the outside and the envelope check
+     * could not reject what it could not see.
+     *
+     * ## Two producers, one inventory (#10861)
+     *
+     * The caller's `where` is not the only thing that reaches `engine.aggregate`
+     * as a predicate. Since PR #10758 the compiled dataset's own definition-level
+     * `filter` is lowered onto `execute()`'s `conjuncts` and rendered by
+     * `generateSql()`, so a dataset declaring `filter: { 'account.region': 'West' }`
+     * sent `{"$and":[{"account.region":"West"}]}` to an engine that cannot join —
+     * measured on both doors, which AGREED in accepting it, so #10759's
+     * preview/execution symmetry had nothing to restore. Refusing it is a
+     * widening of the refusal set, ruled by the maintainer on 2026-08-22 (Option
+     * A, query-time refusal): fold the scope's leaves in HERE, where driver
+     * capability is known, rather than in `dataset-compiler.ts`, which cannot see
+     * which driver will serve the dataset and would refuse a dataset that is
+     * perfectly legal on a native-SQL deployment.
+     *
+     * Structure is discarded on purpose — a member is cross-object or it is not,
+     * and which branch of a disjunction it sits in cannot make
+     * `engine.aggregate` able to join it. PROVENANCE is not discarded, because it
+     * decides what the refusal can tell the caller to go fix: `AnalyticsRequestKey`
+     * is the analytics REQUEST vocabulary and a dataset's `filter` is not in it,
+     * so a scope-borne member must not be reported as `param: 'where'` — see
+     * `planCrossObject`. The value slot carries that and nothing else; it never
+     * reaches a driver.
+     *
+     * Dataset leaves are inserted FIRST so a member named by BOTH producers keeps
+     * the caller's provenance (last write wins on a duplicate key): if it is in
+     * the request too, the request is the actionable place to fix it.
+     *
+     * Time-dimension WINDOWS are deliberately absent (they live in
+     * `dateRangeBounds`, not in `where`). They need no arm here: a cross-object
+     * time dimension is refused by `planCrossObject`'s own first loop, over
+     * `query.timeDimensions`, and refused as the time dimension the author wrote
+     * rather than as the lowered predicate it becomes — which is the better
+     * diagnostic and the reason that loop runs first.
+     */
+    private filterMemberView;
     /**
      * Plan how to serve cross-object references on this join-less path (#3654).
      *
@@ -1453,21 +1511,36 @@ declare class ObjectQLStrategy implements AnalyticsStrategy {
      * query (direct path), a plan for an in-envelope cross-object query.
      *
      * THROWS for anything outside the envelope — a cross-object MEASURE or FILTER
-     * (needs a real join to evaluate), a MULTI-HOP dimension (`a.b.c`), or a
+     * (needs a real join to evaluate), a cross-object leaf in the DATASET's own
+     * definition-level `filter` (#10861 — same join it does not have, arriving
+     * from the producer PR #10758 added), a MULTI-HOP dimension (`a.b.c`), or a
      * non-recombinable measure (`avg`/`count_distinct`, whose sub-bucket values
      * cannot be merged). A loud error beats the silent mis-bucket #3654 kills.
-     * `generateSql()` calls this too, so the preview accepts/rejects the same set.
-     *
-     * [#5716] All four refusals below are `invalidMemberError` — `INVALID_FIELD` /
-     * 400, naming the member — and the MESSAGES are unchanged (they are good
-     * diagnostics, and #5923's tests read them). Each is decided by two caller-side
-     * facts and nothing else: a member the query named, and whether that member
-     * resolves across a join. Neither is an internal invariant — a cube where the
-     * member exists and a driver that could serve it are both perfectly ordinary,
-     * which is exactly what the "run this on a native-SQL driver" half of each
-     * message says. They are member-level rather than dataset-level (hence not
-     * `datasetInvalidError`) because the fix is always to change or drop ONE named
-     * member, and because they fire on `/analytics/query` where no dataset exists.
+     * `generateSql()` calls this too, so the preview accepts/rejects the same set
+     * — and since #10759 both callers derive `filter` from the one
+     * {@link filterMemberView}, so that sentence is enforced by construction
+     * instead of restated at two call sites.
+     *
+     * [#5716] All five refusals below are `invalidMemberError` — `INVALID_FIELD` /
+     * 400, naming the member — and the four that predate #10861 keep their
+     * MESSAGES unchanged (they are good diagnostics, and #5923's tests read
+     * them). Each is decided by two facts and nothing else: a member that will
+     * reach the engine's predicate, and whether that member resolves across a
+     * join. Neither is an internal invariant — a cube where the member exists and
+     * a driver that could serve it are both perfectly ordinary, which is exactly
+     * what the "run this on a native-SQL driver" half of every message says. They
+     * are member-level rather than dataset-level (hence not `datasetInvalidError`)
+     * because the fix is always to change or drop ONE named member, and because
+     * four of them fire on `/analytics/query` where no dataset exists.
+     *
+     * [#10861] The fifth is the exception that proves the rule and is written to
+     * it: it can only fire where a dataset DOES exist, and it is the one refusal
+     * here whose member no request key named — so it carries `cube` and no
+     * `param`, and says in its own words which document to go and edit. It stays
+     * `INVALID_FIELD` rather than becoming `DATASET_INVALID` because the verdict
+     * is the same physical one as its neighbour — this engine cannot join this
+     * member — and splitting the code by PROVENANCE would make a caller branch on
+     * two wire shapes for one capability limit.
      *
      * Detection is on RESOLVED field names, so a dotted dimension the cube
      * flattens to a real column is treated as base, not cross-object.

package/dist/index.d.ts

@@ -1308,6 +1308,11 @@ declare class NativeSQLStrategy implements AnalyticsStrategy {
      */
     private lookupMember;
     private resolveDimensionSql;
+    /**
+     * @param predicate - The measure's own scoped filter, already compiled to a
+     *   SQL boolean (`null` = the measure declares none, or declares one that
+     *   constrains nothing — `compileFilterNode`'s TRUE). #10298.
+     */
     private resolveMeasureSql;
     private resolveFieldSql;
     /**
@@ -1443,6 +1448,59 @@ declare class ObjectQLStrategy implements AnalyticsStrategy {
     private withReadScope;
     /** Is `field` a resolved cross-object (relationship-traversal) reference? */
     private isCrossObjectField;
+    /**
+     * The member view {@link planCrossObject} judges a filter by: EVERY member
+     * that will end up in the engine's predicate, structure discarded, keyed by
+     * RESOLVED field name (#10759), valued by WHERE THE MEMBER CAME FROM
+     * (#10861).
+     *
+     * Both call sites — `execute()` and `generateSql()` — are handed this and
+     * nothing else, which is what makes the invariant `planCrossObject` states
+     * for itself ("the preview accepts/rejects the same set") structural rather
+     * than a coincidence maintained by hand. They used to build the view
+     * separately: the echo flattened the tree, `execute()` passed the ENGINE
+     * FILTER, and a filter record answers a different question — it is a
+     * predicate to evaluate, not an inventory of members. An `$or`, a `$not` or
+     * an unmergeable nested `$and` travels in it as one opaque `$and` entry, so
+     * the members inside were unreadable from the outside and the envelope check
+     * could not reject what it could not see.
+     *
+     * ## Two producers, one inventory (#10861)
+     *
+     * The caller's `where` is not the only thing that reaches `engine.aggregate`
+     * as a predicate. Since PR #10758 the compiled dataset's own definition-level
+     * `filter` is lowered onto `execute()`'s `conjuncts` and rendered by
+     * `generateSql()`, so a dataset declaring `filter: { 'account.region': 'West' }`
+     * sent `{"$and":[{"account.region":"West"}]}` to an engine that cannot join —
+     * measured on both doors, which AGREED in accepting it, so #10759's
+     * preview/execution symmetry had nothing to restore. Refusing it is a
+     * widening of the refusal set, ruled by the maintainer on 2026-08-22 (Option
+     * A, query-time refusal): fold the scope's leaves in HERE, where driver
+     * capability is known, rather than in `dataset-compiler.ts`, which cannot see
+     * which driver will serve the dataset and would refuse a dataset that is
+     * perfectly legal on a native-SQL deployment.
+     *
+     * Structure is discarded on purpose — a member is cross-object or it is not,
+     * and which branch of a disjunction it sits in cannot make
+     * `engine.aggregate` able to join it. PROVENANCE is not discarded, because it
+     * decides what the refusal can tell the caller to go fix: `AnalyticsRequestKey`
+     * is the analytics REQUEST vocabulary and a dataset's `filter` is not in it,
+     * so a scope-borne member must not be reported as `param: 'where'` — see
+     * `planCrossObject`. The value slot carries that and nothing else; it never
+     * reaches a driver.
+     *
+     * Dataset leaves are inserted FIRST so a member named by BOTH producers keeps
+     * the caller's provenance (last write wins on a duplicate key): if it is in
+     * the request too, the request is the actionable place to fix it.
+     *
+     * Time-dimension WINDOWS are deliberately absent (they live in
+     * `dateRangeBounds`, not in `where`). They need no arm here: a cross-object
+     * time dimension is refused by `planCrossObject`'s own first loop, over
+     * `query.timeDimensions`, and refused as the time dimension the author wrote
+     * rather than as the lowered predicate it becomes — which is the better
+     * diagnostic and the reason that loop runs first.
+     */
+    private filterMemberView;
     /**
      * Plan how to serve cross-object references on this join-less path (#3654).
      *
@@ -1453,21 +1511,36 @@ declare class ObjectQLStrategy implements AnalyticsStrategy {
      * query (direct path), a plan for an in-envelope cross-object query.
      *
      * THROWS for anything outside the envelope — a cross-object MEASURE or FILTER
-     * (needs a real join to evaluate), a MULTI-HOP dimension (`a.b.c`), or a
+     * (needs a real join to evaluate), a cross-object leaf in the DATASET's own
+     * definition-level `filter` (#10861 — same join it does not have, arriving
+     * from the producer PR #10758 added), a MULTI-HOP dimension (`a.b.c`), or a
      * non-recombinable measure (`avg`/`count_distinct`, whose sub-bucket values
      * cannot be merged). A loud error beats the silent mis-bucket #3654 kills.
-     * `generateSql()` calls this too, so the preview accepts/rejects the same set.
-     *
-     * [#5716] All four refusals below are `invalidMemberError` — `INVALID_FIELD` /
-     * 400, naming the member — and the MESSAGES are unchanged (they are good
-     * diagnostics, and #5923's tests read them). Each is decided by two caller-side
-     * facts and nothing else: a member the query named, and whether that member
-     * resolves across a join. Neither is an internal invariant — a cube where the
-     * member exists and a driver that could serve it are both perfectly ordinary,
-     * which is exactly what the "run this on a native-SQL driver" half of each
-     * message says. They are member-level rather than dataset-level (hence not
-     * `datasetInvalidError`) because the fix is always to change or drop ONE named
-     * member, and because they fire on `/analytics/query` where no dataset exists.
+     * `generateSql()` calls this too, so the preview accepts/rejects the same set
+     * — and since #10759 both callers derive `filter` from the one
+     * {@link filterMemberView}, so that sentence is enforced by construction
+     * instead of restated at two call sites.
+     *
+     * [#5716] All five refusals below are `invalidMemberError` — `INVALID_FIELD` /
+     * 400, naming the member — and the four that predate #10861 keep their
+     * MESSAGES unchanged (they are good diagnostics, and #5923's tests read
+     * them). Each is decided by two facts and nothing else: a member that will
+     * reach the engine's predicate, and whether that member resolves across a
+     * join. Neither is an internal invariant — a cube where the member exists and
+     * a driver that could serve it are both perfectly ordinary, which is exactly
+     * what the "run this on a native-SQL driver" half of every message says. They
+     * are member-level rather than dataset-level (hence not `datasetInvalidError`)
+     * because the fix is always to change or drop ONE named member, and because
+     * four of them fire on `/analytics/query` where no dataset exists.
+     *
+     * [#10861] The fifth is the exception that proves the rule and is written to
+     * it: it can only fire where a dataset DOES exist, and it is the one refusal
+     * here whose member no request key named — so it carries `cube` and no
+     * `param`, and says in its own words which document to go and edit. It stays
+     * `INVALID_FIELD` rather than becoming `DATASET_INVALID` because the verdict
+     * is the same physical one as its neighbour — this engine cannot join this
+     * member — and splitting the code by PROVENANCE would make a caller branch on
+     * two wire shapes for one capability limit.
      *
      * Detection is on RESOLVED field names, so a dotted dimension the cube
      * flattens to a real column is treated as base, not cross-object.

package/dist/index.js

@@ -1026,14 +1026,31 @@ function invalidMemberError(message, meta) {
 // src/strategies/native-sql-strategy.ts
 import { nextUtcCalendarDay } from "@objectstack/core";
 var AGGREGATE_SQL = {
-  "count": () => "COUNT(*)",
+  // [#10298] `count` takes its COLUMN when the measure declares one. The
+  // wrapper used to discard `col` and always emit `COUNT(*)`, so a measure
+  // written `{ aggregate: 'count', field: 'resolved_by_article' }` counted
+  // ROWS instead of non-null values — and a deflection rate built as
+  // `kb_resolved_count / closed_count` read 100% where the truth was 12.5%,
+  // with the numerator and denominator printed beside it as 8 and 8. `*` is
+  // still `COUNT(*)`: the compiler writes `sql: m.field ?? '*'`, so the star
+  // IS the "no field declared" spelling and must keep counting rows.
+  "count": (col) => col === "*" ? "COUNT(*)" : `COUNT(${col})`,
   "sum": (col) => `SUM(${col})`,
   "avg": (col) => `AVG(${col})`,
   "min": (col) => `MIN(${col})`,
   "max": (col) => `MAX(${col})`,
   "count_distinct": (col) => `COUNT(DISTINCT ${col})`
 };
+var CONDITIONAL_AGGREGATE_SQL = {
+  "count": (col, pred) => `COUNT(CASE WHEN ${pred} THEN ${col === "*" ? "1" : col} END)`,
+  "sum": (col, pred) => `SUM(CASE WHEN ${pred} THEN ${col} END)`,
+  "avg": (col, pred) => `AVG(CASE WHEN ${pred} THEN ${col} END)`,
+  "min": (col, pred) => `MIN(CASE WHEN ${pred} THEN ${col} END)`,
+  "max": (col, pred) => `MAX(CASE WHEN ${pred} THEN ${col} END)`,
+  "count_distinct": (col, pred) => `COUNT(DISTINCT CASE WHEN ${pred} THEN ${col} END)`
+};
 var SUPPORTED_AGGREGATE_SQL_KEYS = Object.keys(AGGREGATE_SQL);
+var CONDITIONAL_AGGREGATE_SQL_KEYS = Object.keys(CONDITIONAL_AGGREGATE_SQL);
 var EXPRESSION_METRIC_TYPES = /* @__PURE__ */ new Set(["number", "string", "boolean"]);
 var IDENTIFIER_PATH = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
 var NativeSQLStrategy = class {
@@ -1199,9 +1216,19 @@ var NativeSQLStrategy = class {
         groupByClauses.push(colExpr);
       }
     }
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     if (query.measures && query.measures.length > 0) {
       for (const measure of query.measures) {
-        const aggExpr = this.resolveMeasureSql(cube, measure, tableName, joins);
+        const measureFilter = datasetScope?.measureFilters?.[measure];
+        const predicate = measureFilter ? this.compileFilterNode(
+          normalizeAnalyticsFilterTree({ where: measureFilter }),
+          cube,
+          tableName,
+          joins,
+          params,
+          ctx
+        ) : null;
+        const aggExpr = this.resolveMeasureSql(cube, measure, tableName, joins, predicate);
         selectClauses.push(`${aggExpr} AS "${measure}"`);
       }
     }
@@ -1215,6 +1242,17 @@ var NativeSQLStrategy = class {
       ctx
     );
     if (filterSql) whereClauses.push(filterSql);
+    if (datasetScope?.filter) {
+      const scopeSql = this.compileFilterNode(
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
+        cube,
+        tableName,
+        joins,
+        params,
+        ctx
+      );
+      if (scopeSql) whereClauses.push(scopeSql);
+    }
     if (query.timeDimensions && query.timeDimensions.length > 0) {
       for (const td of query.timeDimensions) {
         const colExpr = this.resolveFieldSql(cube, td.dimension, tableName, joins);
@@ -1388,7 +1426,12 @@ var NativeSQLStrategy = class {
     const raw = dim ? dim.sql : member.includes(".") ? member.split(".")[1] : member;
     return this.qualifyAndRegisterJoin(raw, parentTable, joins, cube);
   }
-  resolveMeasureSql(cube, member, parentTable, joins) {
+  /**
+   * @param predicate - The measure's own scoped filter, already compiled to a
+   *   SQL boolean (`null` = the measure declares none, or declares one that
+   *   constrains nothing — `compileFilterNode`'s TRUE). #10298.
+   */
+  resolveMeasureSql(cube, member, parentTable, joins, predicate = null) {
     const measure = this.lookupMember(cube, member, "measure");
     if (!measure) {
       const declared = Object.keys(cube.measures ?? {});
@@ -1398,6 +1441,13 @@ var NativeSQLStrategy = class {
       );
     }
     const col = measure.sql === "*" ? "*" : this.qualifyAndRegisterJoin(measure.sql, parentTable, joins, cube);
+    if (predicate !== null) {
+      const wrapConditional = CONDITIONAL_AGGREGATE_SQL[measure.type];
+      if (wrapConditional) return wrapConditional(col, predicate);
+      throw new Error(
+        `[native-sql-strategy] measure "${member}" on cube "${cube.name}" carries a scoped filter, but its type "${measure.type}" has no conditional form (conditional: ${CONDITIONAL_AGGREGATE_SQL_KEYS.join(", ")}).`
+      );
+    }
     const wrap = AGGREGATE_SQL[measure.type];
     if (wrap) return wrap(col);
     if (EXPRESSION_METRIC_TYPES.has(measure.type)) return col;
@@ -1744,10 +1794,18 @@ var ObjectQLStrategy = class {
       const extra = this.mergeFilterOperand(filter, field, bounds);
       if (extra) conjuncts.push(extra);
     }
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
+    if (datasetScope?.filter) {
+      const scopeCondition = this.filterNodeToCondition(
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
+        cube
+      );
+      if (scopeCondition) conjuncts.push(scopeCondition);
+    }
     if (conjuncts.length > 0) {
       filter.$and = [...Array.isArray(filter.$and) ? filter.$and : [], ...conjuncts];
     }
-    const plan = this.planCrossObject(cube, query, filter);
+    const plan = this.planCrossObject(cube, query, this.filterMemberView(cube, query, ctx));
     if (plan) {
       return this.executeCrossObject(cube, query, aggregations, filter, plan, ctx);
     }
@@ -1824,9 +1882,7 @@ var ObjectQLStrategy = class {
       if (td.granularity) granByDim.set(td.dimension, td.granularity);
     }
     const tableName = this.extractObjectName(cube);
-    const plan = this.planCrossObject(cube, query, Object.fromEntries(
-      collectFilterLeaves(normalizeAnalyticsFilterTree(query)).map((f) => [this.resolveFieldName(cube, f.member, "any"), true])
-    ));
+    const plan = this.planCrossObject(cube, query, this.filterMemberView(cube, query, ctx));
     const crossByDim = new Map((plan?.crossDims ?? []).map((cd) => [cd.outputName, cd]));
     const joinClauses = [];
     const dimExpr = (dim) => {
@@ -1868,6 +1924,15 @@ var ObjectQLStrategy = class {
       params
     );
     if (filterClause) whereParts.push(filterClause);
+    const echoedDatasetFilter = ctx.getDatasetScope?.(query.cube)?.filter;
+    if (echoedDatasetFilter) {
+      const scopeSql = this.renderFilterNodeSql(
+        normalizeAnalyticsFilterTree({ where: echoedDatasetFilter }),
+        cube,
+        params
+      );
+      if (scopeSql) whereParts.push(scopeSql);
+    }
     for (const { field, bounds } of this.dateRangeBounds(cube, query)) {
       const nextDay = nextUtcCalendarDay2(bounds.$lte);
       params.push(bounds.$gte, nextDay ?? bounds.$lte);
@@ -1935,6 +2000,68 @@ var ObjectQLStrategy = class {
     const joinedObject = cube.joins?.[alias]?.name ?? alias;
     return joinedObject !== baseObject;
   }
+  /**
+   * The member view {@link planCrossObject} judges a filter by: EVERY member
+   * that will end up in the engine's predicate, structure discarded, keyed by
+   * RESOLVED field name (#10759), valued by WHERE THE MEMBER CAME FROM
+   * (#10861).
+   *
+   * Both call sites — `execute()` and `generateSql()` — are handed this and
+   * nothing else, which is what makes the invariant `planCrossObject` states
+   * for itself ("the preview accepts/rejects the same set") structural rather
+   * than a coincidence maintained by hand. They used to build the view
+   * separately: the echo flattened the tree, `execute()` passed the ENGINE
+   * FILTER, and a filter record answers a different question — it is a
+   * predicate to evaluate, not an inventory of members. An `$or`, a `$not` or
+   * an unmergeable nested `$and` travels in it as one opaque `$and` entry, so
+   * the members inside were unreadable from the outside and the envelope check
+   * could not reject what it could not see.
+   *
+   * ## Two producers, one inventory (#10861)
+   *
+   * The caller's `where` is not the only thing that reaches `engine.aggregate`
+   * as a predicate. Since PR #10758 the compiled dataset's own definition-level
+   * `filter` is lowered onto `execute()`'s `conjuncts` and rendered by
+   * `generateSql()`, so a dataset declaring `filter: { 'account.region': 'West' }`
+   * sent `{"$and":[{"account.region":"West"}]}` to an engine that cannot join —
+   * measured on both doors, which AGREED in accepting it, so #10759's
+   * preview/execution symmetry had nothing to restore. Refusing it is a
+   * widening of the refusal set, ruled by the maintainer on 2026-08-22 (Option
+   * A, query-time refusal): fold the scope's leaves in HERE, where driver
+   * capability is known, rather than in `dataset-compiler.ts`, which cannot see
+   * which driver will serve the dataset and would refuse a dataset that is
+   * perfectly legal on a native-SQL deployment.
+   *
+   * Structure is discarded on purpose — a member is cross-object or it is not,
+   * and which branch of a disjunction it sits in cannot make
+   * `engine.aggregate` able to join it. PROVENANCE is not discarded, because it
+   * decides what the refusal can tell the caller to go fix: `AnalyticsRequestKey`
+   * is the analytics REQUEST vocabulary and a dataset's `filter` is not in it,
+   * so a scope-borne member must not be reported as `param: 'where'` — see
+   * `planCrossObject`. The value slot carries that and nothing else; it never
+   * reaches a driver.
+   *
+   * Dataset leaves are inserted FIRST so a member named by BOTH producers keeps
+   * the caller's provenance (last write wins on a duplicate key): if it is in
+   * the request too, the request is the actionable place to fix it.
+   *
+   * Time-dimension WINDOWS are deliberately absent (they live in
+   * `dateRangeBounds`, not in `where`). They need no arm here: a cross-object
+   * time dimension is refused by `planCrossObject`'s own first loop, over
+   * `query.timeDimensions`, and refused as the time dimension the author wrote
+   * rather than as the lowered predicate it becomes — which is the better
+   * diagnostic and the reason that loop runs first.
+   */
+  filterMemberView(cube, query, ctx) {
+    const datasetFilter = ctx.getDatasetScope?.(query.cube)?.filter;
+    const leaves = (node, origin) => collectFilterLeaves(node).map(
+      (f) => [this.resolveFieldName(cube, f.member, "any"), origin]
+    );
+    return Object.fromEntries([
+      ...datasetFilter ? leaves(normalizeAnalyticsFilterTree({ where: datasetFilter }), "dataset-filter") : [],
+      ...leaves(normalizeAnalyticsFilterTree(query), "where")
+    ]);
+  }
   /**
    * Plan how to serve cross-object references on this join-less path (#3654).
    *
@@ -1945,21 +2072,36 @@ var ObjectQLStrategy = class {
    * query (direct path), a plan for an in-envelope cross-object query.
    *
    * THROWS for anything outside the envelope — a cross-object MEASURE or FILTER
-   * (needs a real join to evaluate), a MULTI-HOP dimension (`a.b.c`), or a
+   * (needs a real join to evaluate), a cross-object leaf in the DATASET's own
+   * definition-level `filter` (#10861 — same join it does not have, arriving
+   * from the producer PR #10758 added), a MULTI-HOP dimension (`a.b.c`), or a
    * non-recombinable measure (`avg`/`count_distinct`, whose sub-bucket values
    * cannot be merged). A loud error beats the silent mis-bucket #3654 kills.
-   * `generateSql()` calls this too, so the preview accepts/rejects the same set.
+   * `generateSql()` calls this too, so the preview accepts/rejects the same set
+   * — and since #10759 both callers derive `filter` from the one
+   * {@link filterMemberView}, so that sentence is enforced by construction
+   * instead of restated at two call sites.
    *
-   * [#5716] All four refusals below are `invalidMemberError` — `INVALID_FIELD` /
-   * 400, naming the member — and the MESSAGES are unchanged (they are good
-   * diagnostics, and #5923's tests read them). Each is decided by two caller-side
-   * facts and nothing else: a member the query named, and whether that member
-   * resolves across a join. Neither is an internal invariant — a cube where the
-   * member exists and a driver that could serve it are both perfectly ordinary,
-   * which is exactly what the "run this on a native-SQL driver" half of each
-   * message says. They are member-level rather than dataset-level (hence not
-   * `datasetInvalidError`) because the fix is always to change or drop ONE named
-   * member, and because they fire on `/analytics/query` where no dataset exists.
+   * [#5716] All five refusals below are `invalidMemberError` — `INVALID_FIELD` /
+   * 400, naming the member — and the four that predate #10861 keep their
+   * MESSAGES unchanged (they are good diagnostics, and #5923's tests read
+   * them). Each is decided by two facts and nothing else: a member that will
+   * reach the engine's predicate, and whether that member resolves across a
+   * join. Neither is an internal invariant — a cube where the member exists and
+   * a driver that could serve it are both perfectly ordinary, which is exactly
+   * what the "run this on a native-SQL driver" half of every message says. They
+   * are member-level rather than dataset-level (hence not `datasetInvalidError`)
+   * because the fix is always to change or drop ONE named member, and because
+   * four of them fire on `/analytics/query` where no dataset exists.
+   *
+   * [#10861] The fifth is the exception that proves the rule and is written to
+   * it: it can only fire where a dataset DOES exist, and it is the one refusal
+   * here whose member no request key named — so it carries `cube` and no
+   * `param`, and says in its own words which document to go and edit. It stays
+   * `INVALID_FIELD` rather than becoming `DATASET_INVALID` because the verdict
+   * is the same physical one as its neighbour — this engine cannot join this
+   * member — and splitting the code by PROVENANCE would make a caller branch on
+   * two wire shapes for one capability limit.
    *
    * Detection is on RESOLVED field names, so a dotted dimension the cube
    * flattens to a real column is treated as base, not cross-object.
@@ -1981,7 +2123,7 @@ var ObjectQLStrategy = class {
         member: m,
         field: this.resolveMeasureAggregation(cube, m).field
       })),
-      ...Object.keys(filter).map((f) => ({ where: "filter", member: f, field: f }))
+      ...Object.entries(filter).filter(([, origin]) => origin === "where").map(([f]) => ({ where: "filter", member: f, field: f }))
     ].filter((r) => this.isCrossObjectField(cube, r.field, baseObject));
     if (nonDim.length > 0) {
       throw invalidMemberError(
@@ -1995,6 +2137,13 @@ var ObjectQLStrategy = class {
         }
       );
     }
+    const scopeCross = Object.entries(filter).filter(([field, origin]) => origin === "dataset-filter" && this.isCrossObjectField(cube, field, baseObject)).map(([field]) => field);
+    if (scopeCross.length > 0) {
+      throw invalidMemberError(
+        `[Analytics] ObjectQLStrategy cannot evaluate the cross-object filter ("${scopeCross[0]}") that dataset "${cube.name}" declares at its definition level \u2014 the engine cannot join in an aggregate, so this predicate matches nothing and the answer would be neither the scoped number nor the unscoped one. Nothing in the request names it: remove the cross-object leaf from the dataset's own \`filter\`, or serve this dataset on a native-SQL driver, where the same definition is valid.`,
+        { member: scopeCross[0], cube: cube.name }
+      );
+    }
     const crossDims = [];
     for (const dim of query.dimensions ?? []) {
       const field = this.resolveFieldName(cube, dim, "dimension");
@@ -3749,6 +3898,16 @@ var AnalyticsService = class {
       // Prefer a compiled dataset's declared relationships (D-C join allowlist);
       // fall back to any explicitly-configured provider for legacy cubes.
       getAllowedRelationships: (cubeName) => this.datasetRegistry.get(cubeName)?.allowedRelationships ?? config.getAllowedRelationships?.(cubeName),
+      // [#10298] The compiled dataset's definition-level filter and its
+      // per-measure filters — the half of the declaration the Cube model has
+      // no room for. Same shape and same registry as `getAllowedRelationships`
+      // directly above: answered for a cube that IS a compiled dataset,
+      // `undefined` for every other cube.
+      getDatasetScope: (cubeName) => {
+        const compiled = this.datasetRegistry.get(cubeName);
+        if (!compiled) return void 0;
+        return { filter: compiled.filter, measureFilters: compiled.measureFilters };
+      },
       coerceTemporalFilterValue: config.coerceTemporalFilterValue,
       coerceTemporalFilterColumn: config.coerceTemporalFilterColumn,
       isExternalObject: config.isExternalObject