@objectstack/service-analytics 17.1.0 → 17.3.0

package/dist/index.cjs

@@ -724,6 +724,53 @@ function compileScopedFilterToSql(filter, alias) {
   const sql = compileNode(filter, quotedAlias, params);
   return { sql, params };
 }
+function emptyMembershipFinding(spec, negated, path) {
+  if (Array.isArray(spec)) {
+    return spec.length === 0 && negated ? { path: `${path}: []`, kind: "negatedIn" } : null;
+  }
+  if (spec === null || typeof spec !== "object") return null;
+  const rec = spec;
+  if (Array.isArray(rec.$nin) && rec.$nin.length === 0) return { path: `${path}.$nin`, kind: "nin" };
+  if (Array.isArray(rec.$in) && rec.$in.length === 0 && negated) {
+    return { path: `${path}.$in`, kind: "negatedIn" };
+  }
+  return null;
+}
+function findEmptyMembership(node, negated, path) {
+  if (node === null || typeof node !== "object" || Array.isArray(node)) return null;
+  const rec = node;
+  const bare = emptyMembershipFinding(rec, negated, path.length > 0 ? path : "<root>");
+  if (bare) return bare;
+  for (const [key, value] of Object.entries(rec)) {
+    const here = path.length > 0 ? `${path}.${key}` : key;
+    if (key === "$not") {
+      const found = findEmptyMembership(value, !negated, here);
+      if (found) return found;
+    } else if (key === "$and" || key === "$or") {
+      if (!Array.isArray(value)) continue;
+      for (let i = 0; i < value.length; i++) {
+        const found = findEmptyMembership(value[i], negated, `${here}[${i}]`);
+        if (found) return found;
+      }
+    } else if (!key.startsWith("$")) {
+      const found = emptyMembershipFinding(value, negated, here);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function assertReadScopeCannotVacate(scope, objectName) {
+  const found = findEmptyMembership(scope, false, "");
+  if (found === null) return;
+  if (found.kind === "nin") {
+    throw readScopeCompileError(
+      `[read-scope-sql] read scope for "${objectName}" has an empty $nin at ${found.path} \u2014 an empty exclusion excludes nothing, so the engine lowers that clause to constant TRUE and the scope does not bind as written. Refused at every polarity, matching this module's own $nin arm (fail-closed).`
+    );
+  }
+  throw readScopeCompileError(
+    `[read-scope-sql] read scope for "${objectName}" has an empty $in under negation at ${found.path} \u2014 an empty membership matches nothing, so its negation matches every row and the read scope admits the whole table (fail-closed).`
+  );
+}
 function compileSub(node, qAlias) {
   const params = [];
   const sql = compileNode(node, qAlias, params);
@@ -885,7 +932,7 @@ function compileOperator(col, op, val, field, params) {
     }
     case "$nin": {
       if (!Array.isArray(val)) throw readScopeCompileError(`[read-scope-sql] $nin for "${field}" needs an array (fail-closed).`);
-      if (val.length === 0) return "1 = 1";
+      if (val.length === 0) throw readScopeCompileError(`[read-scope-sql] $nin for "${field}" is empty \u2014 an empty exclusion excludes nothing and would compile the read scope to constant TRUE (fail-closed).`);
       assertCompilableMembers(op, field, val);
       return nullSafeNegative(col, `${col} NOT IN (${val.map((v) => bind(params, v)).join(", ")})`);
     }
@@ -1063,14 +1110,31 @@ function invalidMemberError(message, meta) {
 // src/strategies/native-sql-strategy.ts
 var import_core2 = require("@objectstack/core");
 var AGGREGATE_SQL = {
-  "count": () => "COUNT(*)",
+  // [#10298] `count` takes its COLUMN when the measure declares one. The
+  // wrapper used to discard `col` and always emit `COUNT(*)`, so a measure
+  // written `{ aggregate: 'count', field: 'resolved_by_article' }` counted
+  // ROWS instead of non-null values — and a deflection rate built as
+  // `kb_resolved_count / closed_count` read 100% where the truth was 12.5%,
+  // with the numerator and denominator printed beside it as 8 and 8. `*` is
+  // still `COUNT(*)`: the compiler writes `sql: m.field ?? '*'`, so the star
+  // IS the "no field declared" spelling and must keep counting rows.
+  "count": (col) => col === "*" ? "COUNT(*)" : `COUNT(${col})`,
   "sum": (col) => `SUM(${col})`,
   "avg": (col) => `AVG(${col})`,
   "min": (col) => `MIN(${col})`,
   "max": (col) => `MAX(${col})`,
   "count_distinct": (col) => `COUNT(DISTINCT ${col})`
 };
+var CONDITIONAL_AGGREGATE_SQL = {
+  "count": (col, pred) => `COUNT(CASE WHEN ${pred} THEN ${col === "*" ? "1" : col} END)`,
+  "sum": (col, pred) => `SUM(CASE WHEN ${pred} THEN ${col} END)`,
+  "avg": (col, pred) => `AVG(CASE WHEN ${pred} THEN ${col} END)`,
+  "min": (col, pred) => `MIN(CASE WHEN ${pred} THEN ${col} END)`,
+  "max": (col, pred) => `MAX(CASE WHEN ${pred} THEN ${col} END)`,
+  "count_distinct": (col, pred) => `COUNT(DISTINCT CASE WHEN ${pred} THEN ${col} END)`
+};
 var SUPPORTED_AGGREGATE_SQL_KEYS = Object.keys(AGGREGATE_SQL);
+var CONDITIONAL_AGGREGATE_SQL_KEYS = Object.keys(CONDITIONAL_AGGREGATE_SQL);
 var EXPRESSION_METRIC_TYPES = /* @__PURE__ */ new Set(["number", "string", "boolean"]);
 var IDENTIFIER_PATH = /^[A-Za-z_][A-Za-z0-9_]*(\.[A-Za-z_][A-Za-z0-9_]*)*$/;
 var NativeSQLStrategy = class {
@@ -1236,9 +1300,19 @@ var NativeSQLStrategy = class {
         groupByClauses.push(colExpr);
       }
     }
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     if (query.measures && query.measures.length > 0) {
       for (const measure of query.measures) {
-        const aggExpr = this.resolveMeasureSql(cube, measure, tableName, joins);
+        const measureFilter = datasetScope?.measureFilters?.[measure];
+        const predicate = measureFilter ? this.compileFilterNode(
+          normalizeAnalyticsFilterTree({ where: measureFilter }),
+          cube,
+          tableName,
+          joins,
+          params,
+          ctx
+        ) : null;
+        const aggExpr = this.resolveMeasureSql(cube, measure, tableName, joins, predicate);
         selectClauses.push(`${aggExpr} AS "${measure}"`);
       }
     }
@@ -1252,6 +1326,17 @@ var NativeSQLStrategy = class {
       ctx
     );
     if (filterSql) whereClauses.push(filterSql);
+    if (datasetScope?.filter) {
+      const scopeSql = this.compileFilterNode(
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
+        cube,
+        tableName,
+        joins,
+        params,
+        ctx
+      );
+      if (scopeSql) whereClauses.push(scopeSql);
+    }
     if (query.timeDimensions && query.timeDimensions.length > 0) {
       for (const td of query.timeDimensions) {
         const colExpr = this.resolveFieldSql(cube, td.dimension, tableName, joins);
@@ -1326,6 +1411,7 @@ var NativeSQLStrategy = class {
     const filter = ctx.getReadScope(objectName);
     if (filter === void 0 || filter === null) return;
     const { sql, params: scopeParams } = compileScopedFilterToSql(filter, alias);
+    assertReadScopeCannotVacate(filter, objectName);
     if (!sql) return;
     let i = 0;
     const rendered = sql.replace(/\?/g, () => {
@@ -1425,7 +1511,12 @@ var NativeSQLStrategy = class {
     const raw = dim ? dim.sql : member.includes(".") ? member.split(".")[1] : member;
     return this.qualifyAndRegisterJoin(raw, parentTable, joins, cube);
   }
-  resolveMeasureSql(cube, member, parentTable, joins) {
+  /**
+   * @param predicate - The measure's own scoped filter, already compiled to a
+   *   SQL boolean (`null` = the measure declares none, or declares one that
+   *   constrains nothing — `compileFilterNode`'s TRUE). #10298.
+   */
+  resolveMeasureSql(cube, member, parentTable, joins, predicate = null) {
     const measure = this.lookupMember(cube, member, "measure");
     if (!measure) {
       const declared = Object.keys(cube.measures ?? {});
@@ -1435,6 +1526,13 @@ var NativeSQLStrategy = class {
       );
     }
     const col = measure.sql === "*" ? "*" : this.qualifyAndRegisterJoin(measure.sql, parentTable, joins, cube);
+    if (predicate !== null) {
+      const wrapConditional = CONDITIONAL_AGGREGATE_SQL[measure.type];
+      if (wrapConditional) return wrapConditional(col, predicate);
+      throw new Error(
+        `[native-sql-strategy] measure "${member}" on cube "${cube.name}" carries a scoped filter, but its type "${measure.type}" has no conditional form (conditional: ${CONDITIONAL_AGGREGATE_SQL_KEYS.join(", ")}).`
+      );
+    }
     const wrap = AGGREGATE_SQL[measure.type];
     if (wrap) return wrap(col);
     if (EXPRESSION_METRIC_TYPES.has(measure.type)) return col;
@@ -1767,11 +1865,16 @@ var ObjectQLStrategy = class {
     for (const [dim, gran] of granByDim) {
       groupBy.push({ field: this.resolveFieldName(cube, dim, "dimension"), dateGranularity: gran });
     }
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     const aggregations = [];
     if (query.measures && query.measures.length > 0) {
       for (const measure of query.measures) {
         const { field, method } = this.resolveMeasureAggregation(cube, measure);
-        aggregations.push({ field, method, alias: measure });
+        const measureFilter = datasetScope?.measureFilters?.[measure];
+        const filterCondition = measureFilter ? this.filterNodeToCondition(normalizeAnalyticsFilterTree({ where: measureFilter }), cube) : null;
+        aggregations.push(
+          filterCondition ? { field, method, alias: measure, filter: filterCondition } : { field, method, alias: measure }
+        );
       }
     }
     const filter = {};
@@ -1781,10 +1884,17 @@ var ObjectQLStrategy = class {
       const extra = this.mergeFilterOperand(filter, field, bounds);
       if (extra) conjuncts.push(extra);
     }
+    if (datasetScope?.filter) {
+      const scopeCondition = this.filterNodeToCondition(
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
+        cube
+      );
+      if (scopeCondition) conjuncts.push(scopeCondition);
+    }
     if (conjuncts.length > 0) {
       filter.$and = [...Array.isArray(filter.$and) ? filter.$and : [], ...conjuncts];
     }
-    const plan = this.planCrossObject(cube, query, filter);
+    const plan = this.planCrossObject(cube, query, this.filterMemberView(cube, query, ctx));
     if (plan) {
       return this.executeCrossObject(cube, query, aggregations, filter, plan, ctx);
     }
@@ -1861,9 +1971,8 @@ var ObjectQLStrategy = class {
       if (td.granularity) granByDim.set(td.dimension, td.granularity);
     }
     const tableName = this.extractObjectName(cube);
-    const plan = this.planCrossObject(cube, query, Object.fromEntries(
-      collectFilterLeaves(normalizeAnalyticsFilterTree(query)).map((f) => [this.resolveFieldName(cube, f.member, "any"), true])
-    ));
+    const plan = this.planCrossObject(cube, query, this.filterMemberView(cube, query, ctx));
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     const crossByDim = new Map((plan?.crossDims ?? []).map((cd) => [cd.outputName, cd]));
     const joinClauses = [];
     const dimExpr = (dim) => {
@@ -1894,7 +2003,9 @@ var ObjectQLStrategy = class {
     if (query.measures) {
       for (const m of query.measures) {
         const { field, method } = this.resolveMeasureAggregation(cube, m);
-        const aggSql = method === "count" ? "COUNT(*)" : method === "count_distinct" ? `COUNT(DISTINCT ${field})` : `${method.toUpperCase()}(${field})`;
+        const measureFilter = datasetScope?.measureFilters?.[m];
+        const predicate = measureFilter ? this.renderFilterNodeSql(normalizeAnalyticsFilterTree({ where: measureFilter }), cube, params) : null;
+        const aggSql = predicate ? this.conditionalAggregateSql(method, field, predicate) : method === "count" ? "COUNT(*)" : method === "count_distinct" ? `COUNT(DISTINCT ${field})` : `${method.toUpperCase()}(${field})`;
         selectParts.push(`${aggSql} AS "${m}"`);
       }
     }
@@ -1905,6 +2016,14 @@ var ObjectQLStrategy = class {
       params
     );
     if (filterClause) whereParts.push(filterClause);
+    if (datasetScope?.filter) {
+      const scopeSql = this.renderFilterNodeSql(
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
+        cube,
+        params
+      );
+      if (scopeSql) whereParts.push(scopeSql);
+    }
     for (const { field, bounds } of this.dateRangeBounds(cube, query)) {
       const nextDay = (0, import_core3.nextUtcCalendarDay)(bounds.$lte);
       params.push(bounds.$gte, nextDay ?? bounds.$lte);
@@ -1915,6 +2034,7 @@ var ObjectQLStrategy = class {
     const scope = ctx.getReadScope?.(tableName);
     if (scope != null) {
       const { sql: scopeSql, params: scopeParams } = compileScopedFilterToSql(scope, tableName);
+      assertReadScopeCannotVacate(scope, tableName);
       if (scopeSql) {
         let i = 0;
         const rendered = scopeSql.replace(/\?/g, () => {
@@ -1961,6 +2081,7 @@ var ObjectQLStrategy = class {
     if (typeof ctx.getReadScope !== "function") return userFilter;
     const scope = ctx.getReadScope(objectName);
     if (scope === void 0 || scope === null) return userFilter;
+    assertReadScopeCannotVacate(scope, objectName);
     const scopeFilter = (0, import_data3.markFilterSubtreeProvenance)(scope, "policy");
     if (!userFilter) return scopeFilter;
     return { $and: [userFilter, scopeFilter] };
@@ -1972,6 +2093,109 @@ var ObjectQLStrategy = class {
     const joinedObject = cube.joins?.[alias]?.name ?? alias;
     return joinedObject !== baseObject;
   }
+  /**
+   * The member view {@link planCrossObject} judges a filter by: EVERY member
+   * that will end up in the engine's predicate, structure discarded, keyed by
+   * RESOLVED field name (#10759), valued by WHERE THE MEMBER CAME FROM
+   * (#10861).
+   *
+   * Both call sites — `execute()` and `generateSql()` — are handed this and
+   * nothing else, which is what makes the invariant `planCrossObject` states
+   * for itself ("the preview accepts/rejects the same set") structural rather
+   * than a coincidence maintained by hand. They used to build the view
+   * separately: the echo flattened the tree, `execute()` passed the ENGINE
+   * FILTER, and a filter record answers a different question — it is a
+   * predicate to evaluate, not an inventory of members. An `$or`, a `$not` or
+   * an unmergeable nested `$and` travels in it as one opaque `$and` entry, so
+   * the members inside were unreadable from the outside and the envelope check
+   * could not reject what it could not see.
+   *
+   * ## Three producers, one inventory (#10861, #11461)
+   *
+   * The caller's `where` is not the only thing that reaches `engine.aggregate`
+   * as a predicate. Since PR #10758 the compiled dataset's own definition-level
+   * `filter` is lowered onto `execute()`'s `conjuncts` and rendered by
+   * `generateSql()`, so a dataset declaring `filter: { 'account.region': 'West' }`
+   * sent `{"$and":[{"account.region":"West"}]}` to an engine that cannot join —
+   * measured on both doors, which AGREED in accepting it, so #10759's
+   * preview/execution symmetry had nothing to restore. Refusing it is a
+   * widening of the refusal set, ruled by the maintainer on 2026-08-22 (Option
+   * A, query-time refusal): fold the scope's leaves in HERE, where driver
+   * capability is known, rather than in `dataset-compiler.ts`, which cannot see
+   * which driver will serve the dataset and would refuse a dataset that is
+   * perfectly legal on a native-SQL deployment.
+   *
+   * [#11461] #10413 phase 2 then added a THIRD producer with the same reach and
+   * none of the coverage: a compiled measure's own `filter`, lowered onto that
+   * measure's `aggregations[].filter` entry (#10576). This view enumerated two
+   * origins, so the third was invisible to the envelope check and the arm of
+   * `planCrossObject` that inspects `query.measures` reads only each measure's
+   * resolved FIELD, never its filter. Measured on the unfixed tree, one fixture,
+   * both doors:
+   *
+   * ```
+   * BEFORE  execute()     ACCEPTED -> aggregations: [{field:"*",method:"count",
+   *                                   alias:"west_count",
+   *                                   filter:{"account.region":"West"}}]
+   *                                -> rows [{stage:"won",total_count:3,west_count:0}]
+   *                                   (the truthful west_count is 2; total_count
+   *                                    is right, so the wrong number arrived in
+   *                                    the same response shape as the right one)
+   *         generateSql() ACCEPTED -> COUNT(CASE WHEN account.region = $1 THEN 1 END)
+   *                                   over a FROM with no join in it at all
+   * AFTER   both doors    REFUSED   INVALID_FIELD / 400, engine never reached
+   * ```
+   *
+   * The same maintainer ruling covers it — same hazard, same physical verdict,
+   * one more producer — so it folds in HERE for the #10861 reason and not into
+   * `dataset-compiler.ts`, which still cannot see which driver will serve the
+   * dataset. Only the REQUESTED measures are folded: both doors' aggregation
+   * loops read `measureFilters[m]` for `m of query.measures` and nothing else,
+   * so a filter declared on a measure this query never asks for reaches no
+   * engine, and refusing on it would reject a query for a member that was never
+   * going to be evaluated.
+   *
+   * Structure is discarded on purpose — a member is cross-object or it is not,
+   * and which branch of a disjunction it sits in cannot make
+   * `engine.aggregate` able to join it. PROVENANCE is not discarded, because it
+   * decides what the refusal can tell the caller to go fix: `AnalyticsRequestKey`
+   * is the analytics REQUEST vocabulary and a dataset's `filter` is not in it,
+   * so a scope-borne member must not be reported as `param: 'where'` — see
+   * `planCrossObject`. The value slot carries that and nothing else; it never
+   * reaches a driver.
+   *
+   * Insertion order is measure-filter, then dataset-filter, then `where`, and
+   * last write wins on a duplicate key. Two things follow, in that order of
+   * importance. A member named by the request too keeps the CALLER's provenance,
+   * because if it is in the request that is the actionable place to fix it. And
+   * every shape that was refused before #11461 keeps the exact message it had:
+   * the new origin can only ever win a key no older producer names.
+   *
+   * Time-dimension WINDOWS are deliberately absent (they live in
+   * `dateRangeBounds`, not in `where`). They need no arm here: a cross-object
+   * time dimension is refused by `planCrossObject`'s own first loop, over
+   * `query.timeDimensions`, and refused as the time dimension the author wrote
+   * rather than as the lowered predicate it becomes — which is the better
+   * diagnostic and the reason that loop runs first.
+   */
+  filterMemberView(cube, query, ctx) {
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
+    const leaves = (node, origin) => collectFilterLeaves(node).map(
+      (f) => [this.resolveFieldName(cube, f.member, "any"), origin]
+    );
+    const measureLeaves = (query.measures ?? []).flatMap((m) => {
+      const measureFilter = datasetScope?.measureFilters?.[m];
+      return measureFilter ? leaves(
+        normalizeAnalyticsFilterTree({ where: measureFilter }),
+        { kind: "measure-filter", measure: m }
+      ) : [];
+    });
+    return Object.fromEntries([
+      ...measureLeaves,
+      ...datasetScope?.filter ? leaves(normalizeAnalyticsFilterTree({ where: datasetScope.filter }), { kind: "dataset-filter" }) : [],
+      ...leaves(normalizeAnalyticsFilterTree(query), { kind: "where" })
+    ]);
+  }
   /**
    * Plan how to serve cross-object references on this join-less path (#3654).
    *
@@ -1982,21 +2206,39 @@ var ObjectQLStrategy = class {
    * query (direct path), a plan for an in-envelope cross-object query.
    *
    * THROWS for anything outside the envelope — a cross-object MEASURE or FILTER
-   * (needs a real join to evaluate), a MULTI-HOP dimension (`a.b.c`), or a
-   * non-recombinable measure (`avg`/`count_distinct`, whose sub-bucket values
-   * cannot be merged). A loud error beats the silent mis-bucket #3654 kills.
-   * `generateSql()` calls this too, so the preview accepts/rejects the same set.
+   * (needs a real join to evaluate), a cross-object leaf in the DATASET's own
+   * definition-level `filter` (#10861 — same join it does not have, arriving
+   * from the producer PR #10758 added), a cross-object leaf in ONE MEASURE's own
+   * `filter` (#11461 — the same join again, arriving from the producer #10413
+   * phase 2 added), a MULTI-HOP dimension (`a.b.c`), or a non-recombinable
+   * measure (`avg`/`count_distinct`, whose sub-bucket values cannot be merged).
+   * A loud error beats the silent mis-bucket #3654 kills.
+   * `generateSql()` calls this too, so the preview accepts/rejects the same set
+   * — and since #10759 both callers derive `filter` from the one
+   * {@link filterMemberView}, so that sentence is enforced by construction
+   * instead of restated at two call sites.
+   *
+   * [#5716] All six refusals below are `invalidMemberError` — `INVALID_FIELD` /
+   * 400, naming the member — and the four that predate #10861 keep their
+   * MESSAGES unchanged (they are good diagnostics, and #5923's tests read
+   * them); so does #10861's own, which #11461 left untouched beside it. Each is decided by two facts and nothing else: a member that will
+   * reach the engine's predicate, and whether that member resolves across a
+   * join. Neither is an internal invariant — a cube where the member exists and
+   * a driver that could serve it are both perfectly ordinary, which is exactly
+   * what the "run this on a native-SQL driver" half of every message says. They
+   * are member-level rather than dataset-level (hence not `datasetInvalidError`)
+   * because the fix is always to change or drop ONE named member, and because
+   * four of them fire on `/analytics/query` where no dataset exists.
    *
-   * [#5716] All four refusals below are `invalidMemberError` — `INVALID_FIELD` /
-   * 400, naming the member — and the MESSAGES are unchanged (they are good
-   * diagnostics, and #5923's tests read them). Each is decided by two caller-side
-   * facts and nothing else: a member the query named, and whether that member
-   * resolves across a join. Neither is an internal invariant — a cube where the
-   * member exists and a driver that could serve it are both perfectly ordinary,
-   * which is exactly what the "run this on a native-SQL driver" half of each
-   * message says. They are member-level rather than dataset-level (hence not
-   * `datasetInvalidError`) because the fix is always to change or drop ONE named
-   * member, and because they fire on `/analytics/query` where no dataset exists.
+   * [#10861, #11461] The fifth and sixth are the exceptions that prove the rule
+   * and are written to it: they can only fire where a dataset DOES exist, and
+   * they are the two refusals here whose member no request key named — so each
+   * carries `cube` and no `param`, and says in its own words which document to
+   * go and edit, the sixth naming the MEASURE inside it as well. Both stay
+   * `INVALID_FIELD` rather than becoming `DATASET_INVALID` because the verdict
+   * is the same physical one as their neighbours — this engine cannot join this
+   * member — and splitting the code by PROVENANCE would make a caller branch on
+   * three wire shapes for one capability limit.
    *
    * Detection is on RESOLVED field names, so a dotted dimension the cube
    * flattens to a real column is treated as base, not cross-object.
@@ -2018,7 +2260,7 @@ var ObjectQLStrategy = class {
         member: m,
         field: this.resolveMeasureAggregation(cube, m).field
       })),
-      ...Object.keys(filter).map((f) => ({ where: "filter", member: f, field: f }))
+      ...Object.entries(filter).filter(([, origin]) => origin.kind === "where").map(([f]) => ({ where: "filter", member: f, field: f }))
     ].filter((r) => this.isCrossObjectField(cube, r.field, baseObject));
     if (nonDim.length > 0) {
       throw invalidMemberError(
@@ -2032,6 +2274,23 @@ var ObjectQLStrategy = class {
         }
       );
     }
+    const scopeCross = Object.entries(filter).filter(([field, origin]) => origin.kind === "dataset-filter" && this.isCrossObjectField(cube, field, baseObject)).map(([field]) => field);
+    if (scopeCross.length > 0) {
+      throw invalidMemberError(
+        `[Analytics] ObjectQLStrategy cannot evaluate the cross-object filter ("${scopeCross[0]}") that dataset "${cube.name}" declares at its definition level \u2014 the engine cannot join in an aggregate, so this predicate matches nothing and the answer would be neither the scoped number nor the unscoped one. Nothing in the request names it: remove the cross-object leaf from the dataset's own \`filter\`, or serve this dataset on a native-SQL driver, where the same definition is valid.`,
+        { member: scopeCross[0], cube: cube.name }
+      );
+    }
+    const measureCross = Object.entries(filter).flatMap(
+      ([field, origin]) => origin.kind === "measure-filter" && this.isCrossObjectField(cube, field, baseObject) ? [{ field, measure: origin.measure }] : []
+    );
+    if (measureCross.length > 0) {
+      const { field, measure } = measureCross[0];
+      throw invalidMemberError(
+        `[Analytics] ObjectQLStrategy cannot evaluate the cross-object filter ("${field}") that dataset "${cube.name}" declares on its measure "${measure}" \u2014 the engine cannot join in an aggregate, so this measure would be counted over a predicate that matches nothing and would answer 0 rather than the scoped number. Remove the cross-object leaf from that measure's own \`filter\`, or serve this dataset on a native-SQL driver, where the same definition is valid.`,
+        { member: field, cube: cube.name }
+      );
+    }
     const crossDims = [];
     for (const dim of query.dimensions ?? []) {
       const field = this.resolveFieldName(cube, dim, "dimension");
@@ -2135,6 +2394,7 @@ var ObjectQLStrategy = class {
     if (fkValues.length === 0 || typeof ctx.executeAggregate !== "function") return map;
     const idFilter = { id: { $in: fkValues } };
     const scope = typeof ctx.getReadScope === "function" ? ctx.getReadScope(refObject) : null;
+    if (scope != null) assertReadScopeCannotVacate(scope, refObject);
     if (scope != null) (0, import_data3.markFilterSubtreeProvenance)(scope, "policy");
     const filter = scope != null ? { $and: [idFilter, scope] } : idFilter;
     const rows = await ctx.executeAggregate(refObject, {
@@ -2148,6 +2408,45 @@ var ObjectQLStrategy = class {
     }
     return map;
   }
+  /**
+   * A measure's aggregate, restricted to the rows its own `filter` admits
+   * (#10413 phase 2) — the same six functions `generateSql`'s unconditional
+   * branch renders, wrapped in a `CASE WHEN`.
+   *
+   * Spelled `CASE WHEN` rather than SQL-standard `FILTER (WHERE …)`, mirroring
+   * `NativeSQLStrategy.CONDITIONAL_AGGREGATE_SQL`: this string is DOCUMENTATION
+   * of an execution that really goes through `engine.aggregate`'s per-driver
+   * `aggregations[].filter` lowering (#10576), not a statement this class runs
+   * itself, so there is no reason to pick a dialect-restricted spelling over
+   * the portable one the SQL-executing sibling already settled on.
+   *
+   * `count` over `*` counts a constant (`COUNT(CASE WHEN p THEN 1 END)`, since
+   * `COUNT(CASE WHEN p THEN * END)` is not valid SQL); over a real column it
+   * counts that column's non-null values among the admitted rows.
+   */
+  conditionalAggregateSql(method, col, pred) {
+    const target = col === "*" ? "1" : col;
+    switch (method) {
+      case "count":
+        return `COUNT(CASE WHEN ${pred} THEN ${target} END)`;
+      case "count_distinct":
+        return `COUNT(DISTINCT CASE WHEN ${pred} THEN ${col} END)`;
+      case "sum":
+        return `SUM(CASE WHEN ${pred} THEN ${col} END)`;
+      case "avg":
+        return `AVG(CASE WHEN ${pred} THEN ${col} END)`;
+      case "min":
+        return `MIN(CASE WHEN ${pred} THEN ${col} END)`;
+      case "max":
+        return `MAX(CASE WHEN ${pred} THEN ${col} END)`;
+      // Closed vocabulary, same posture as `resolveMeasureAggregation`'s
+      // callers: `method` comes only from that function, whose own aggTypes
+      // list is exactly these six, so this default is unreachable rather than
+      // a silent fallback for a method this table forgot.
+      default:
+        return `${method.toUpperCase()}(CASE WHEN ${pred} THEN ${col} END)`;
+    }
+  }
   /**
    * Render one normalized filter as a display SQL predicate for `generateSql`.
    *
@@ -2239,8 +2538,20 @@ var ObjectQLStrategy = class {
   resolveMeasureAggregation(cube, measureName) {
     const direct = this.lookupMember(cube, measureName, "measure");
     if (direct) {
+      if (EXPRESSION_METRIC_TYPES.has(direct.type)) {
+        throw invalidMemberError(
+          `[Analytics] ObjectQLStrategy cannot evaluate the custom-SQL measure ("${measureName}") \u2014 its type "${direct.type}" declares a raw SQL expression, which the engine aggregate AST cannot carry; served anyway it would answer null for every bucket under the measure's own name. Use an aggregate measure (count/sum/avg/min/max/count_distinct), or run on a native-SQL driver.`,
+          { member: measureName, param: "measures", cube: cube.name }
+        );
+      }
       return {
         field: direct.sql.replace(/^\$/, ""),
+        // The assertion, not a parse: for a CubeSchema-legal cube the type
+        // partition above leaves exactly the six `AggregationFunction` values.
+        // An enum-INVALID type (host drift, the comment above) still flows
+        // through unchecked ON PURPOSE — adding a method allowlist here would
+        // re-blame the caller with a 400 for OUR bug, so the cast keeps the
+        // compile-time contract (#12776) without changing that posture.
         method: direct.type === "count_distinct" ? "count_distinct" : direct.type
       };
     }
@@ -2254,7 +2565,7 @@ var ObjectQLStrategy = class {
         if (candidate && candidate.type === type) {
           return {
             field: candidate.sql.replace(/^\$/, ""),
-            method: candidate.type === "count_distinct" ? "count_distinct" : candidate.type
+            method: type
           };
         }
       }
@@ -3786,6 +4097,16 @@ var AnalyticsService = class {
       // Prefer a compiled dataset's declared relationships (D-C join allowlist);
       // fall back to any explicitly-configured provider for legacy cubes.
       getAllowedRelationships: (cubeName) => this.datasetRegistry.get(cubeName)?.allowedRelationships ?? config.getAllowedRelationships?.(cubeName),
+      // [#10298] The compiled dataset's definition-level filter and its
+      // per-measure filters — the half of the declaration the Cube model has
+      // no room for. Same shape and same registry as `getAllowedRelationships`
+      // directly above: answered for a cube that IS a compiled dataset,
+      // `undefined` for every other cube.
+      getDatasetScope: (cubeName) => {
+        const compiled = this.datasetRegistry.get(cubeName);
+        if (!compiled) return void 0;
+        return { filter: compiled.filter, measureFilters: compiled.measureFilters };
+      },
       coerceTemporalFilterValue: config.coerceTemporalFilterValue,
       coerceTemporalFilterColumn: config.coerceTemporalFilterColumn,
       isExternalObject: config.isExternalObject
@@ -3808,15 +4129,59 @@ var AnalyticsService = class {
    * current request's ExecutionContext (ADR-0021 D-C). The strategy then sees a
    * `getReadScope(objectName)` that already knows the active tenant.
    */
-  async callCtx(query, context) {
-    if (!this.readScopeProvider) return { ...this.baseCtx, context };
+  async callCtx(query, context, tokenCtx) {
+    const getDatasetScope = this.resolvedDatasetScopeGetter(tokenCtx);
+    if (!this.readScopeProvider) return { ...this.baseCtx, context, getDatasetScope };
     const scopes = await this.resolveReadScopes(query, context);
     return {
       ...this.baseCtx,
       context,
+      getDatasetScope,
       getReadScope: (objectName) => scopes.get(objectName) ?? null
     };
   }
+  /**
+   * [#12230] Copy-on-write expansion of filter placeholders across everything
+   * a DIRECT analytics query compares on: `where` and each time dimension's
+   * `dateRange` — the same positions `DatasetExecutor.resolveSelectionTokens`
+   * covers for the dashboard door, minus the dataset-only channels it alone
+   * carries (measure filters ride the dataset-scope getter below).
+   *
+   * The input is never mutated: a query object can be caller-owned metadata
+   * (a saved report definition, a flow node's config) reused across requests,
+   * and resolving in place would bake one request's user id into every later
+   * render. Returns the SAME object when nothing resolved.
+   */
+  resolveQueryTokens(query, tokenCtx) {
+    const where = (0, import_core6.resolveFilterTokens)(query.where, tokenCtx);
+    const timeDimensions = query.timeDimensions?.map((td) => {
+      if (td.dateRange == null) return td;
+      const dateRange = (0, import_core6.resolveFilterTokens)(td.dateRange, tokenCtx);
+      return dateRange === td.dateRange ? td : { ...td, dateRange };
+    });
+    const tdChanged = timeDimensions !== void 0 && timeDimensions.some((td, i) => td !== query.timeDimensions[i]);
+    if (where === query.where && !tdChanged) return query;
+    const out = { ...query };
+    if (where !== query.where) out.where = where;
+    if (tdChanged) out.timeDimensions = timeDimensions;
+    return out;
+  }
+  /**
+   * [#12230] A per-request `getDatasetScope` whose answers have their filter
+   * placeholders resolved against THIS caller. See `callCtx` for why the
+   * registry's copy cannot be handed out raw. Token-free scopes pass through
+   * by reference — `resolveFilterTokens` returns its input unchanged when the
+   * tree holds no placeholder, so the common case allocates nothing.
+   */
+  resolvedDatasetScopeGetter(tokenCtx) {
+    return (cubeName) => {
+      const scope = this.baseCtx.getDatasetScope?.(cubeName);
+      if (!scope) return scope;
+      const filter = (0, import_core6.resolveFilterTokens)(scope.filter, tokenCtx);
+      const measureFilters = (0, import_core6.resolveFilterTokens)(scope.measureFilters, tokenCtx);
+      return filter === scope.filter && measureFilters === scope.measureFilters ? scope : { filter, measureFilters };
+    };
+  }
   /**
    * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
    * AND every joined object of the query's cube, keyed by object name. This is
@@ -3874,12 +4239,14 @@ var AnalyticsService = class {
    * aggregate bridge) instead of failing — or worse, fabricating empty rows.
    * Any other error propagates untouched.
    */
-  async query(query, context) {
-    if (!query.cube) {
+  async query(queryInput, context) {
+    if (!queryInput.cube) {
       throw new Error("Cube name is required in analytics query");
     }
+    const tokenCtx = (0, import_core6.filterTokenContextFrom)(context, /* @__PURE__ */ new Date());
+    const query = this.resolveQueryTokens(queryInput, tokenCtx);
     this.ensureCube(query);
-    const ctx = await this.callCtx(query, context);
+    const ctx = await this.callCtx(query, context, tokenCtx);
     let skip;
     for (; ; ) {
       const strategy = this.resolveStrategy(query, ctx, skip);
@@ -4075,6 +4442,7 @@ var AnalyticsService = class {
           const label = (0, import_ui2.resolveI18nLabel)(m.label, requestLocale);
           if (label !== void 0) f.label = label;
         }
+        if (f.builtinAggregate == null && m.label == null && m.aggregate) f.builtinAggregate = m.aggregate;
         if (f.format == null && m.format) f.format = m.format;
         const fc = f;
         const mc = m;
@@ -4133,12 +4501,14 @@ var AnalyticsService = class {
   /**
    * Generate SQL for a query without executing it (dry-run).
    */
-  async generateSql(query, context) {
-    if (!query.cube) {
+  async generateSql(queryInput, context) {
+    if (!queryInput.cube) {
       throw new Error("Cube name is required for SQL generation");
     }
+    const tokenCtx = (0, import_core6.filterTokenContextFrom)(context, /* @__PURE__ */ new Date());
+    const query = this.resolveQueryTokens(queryInput, tokenCtx);
     this.ensureCube(query);
-    const ctx = await this.callCtx(query, context);
+    const ctx = await this.callCtx(query, context, tokenCtx);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] generateSql on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.generateSql(query, ctx);
@@ -4652,6 +5022,16 @@ var FallbackDelegateStrategy = class {
 };
 
 // src/plugin.ts
+var import_data7 = require("@objectstack/spec/data");
+function parseEngineAggregateFunction(method, alias) {
+  const parsed = import_data7.AggregationFunction.safeParse(method);
+  if (!parsed.success) {
+    throw new Error(
+      `[Analytics] The aggregate bridge cannot forward the aggregation "${alias}": "${method}" is not one of the engine's aggregate functions (${import_data7.AggregationFunction.options.join(", ")}). A custom-SQL measure is refused earlier, with a caller-facing diagnostic, by ObjectQLStrategy; reaching this point means the analytics layer produced a method the engine contract does not declare.`
+    );
+  }
+  return parsed.data;
+}
 var AnalyticsServicePlugin = class {
   constructor(options = {}) {
     this.name = "com.objectstack.service-analytics";
@@ -4709,10 +5089,58 @@ var AnalyticsServicePlugin = class {
         const rows = await engine.aggregate(objectName, {
           where: filter,
           groupBy,
+          // [#10413 phase 2 / #10576] `a.filter` is the per-aggregation
+          // predicate `ObjectQLStrategy` lowers a measure's own scoped
+          // `filter` into. This map already renames `method` → `function`
+          // for the engine's own vocabulary; dropping `filter` here — as this
+          // bridge did before this line existed — would have made the
+          // strategy's lowering a NO-OP on every real deployment that boots
+          // through this auto-bridge (the default path: `new
+          // AnalyticsServicePlugin({ cubes })` with no custom
+          // `executeAggregate`), passing every unit test that stubs
+          // `executeAggregate` directly while silently dropping the filter in
+          // production — the exact declared-≠-enforced shape Prime Directive
+          // #10 calls out. Omitted (not `filter: undefined`) when the
+          // aggregation carries none, matching the engine's own
+          // vacuous-filter convention.
           aggregations: aggregations?.map((a) => ({
-            function: a.method,
+            // [#11833] `function` is the engine contract's SIX-value
+            // `AggregationFunction`. This bridge's own input declared
+            // `method: string` when that history was written
+            // (`StrategyContext.executeAggregate`, spec
+            // `contracts/analytics-service.ts`), so the two ends of this
+            // rename spoke different vocabularies: narrowing the engine side
+            // to the contract turned the forward into a compile error — the
+            // correct signal, and the one the deleted structural type hid by
+            // declaring `function: string` on both sides.
+            //
+            // Since #12776 (contract) and #12940 (this plugin's own config
+            // mirror above), BOTH ends declare the enum, so the rename is
+            // enum-to-enum and the parse below is defence in depth behind a
+            // compile-time check rather than the only check — see
+            // `parseEngineAggregateFunction` for why erased types still leave
+            // it load-bearing.
+            //
+            // It was closed by PARSING with the spec enum itself rather than
+            // by widening back to `string` (what hid it) or casting past it
+            // (which keeps the hole and adds a lie). `AggregationFunction` is
+            // the same schema `AggregationNodeSchema.function` is built from,
+            // so there is one vocabulary, and its own error map already
+            // carries the `array_agg`/`string_agg` retirement prescriptions.
+            //
+            // TIERING, deliberately: the reachable producer of a non-aggregate
+            // method — a custom-SQL measure (`AggregationMetricType`
+            // `number`/`string`/`boolean`) — is already refused upstream with a
+            // caller-blaming 400 by `ObjectQLStrategy.resolveMeasureAggregation`
+            // (#12209). Anything still arriving here is host drift, which that
+            // refusal's docblock assigns to the undeclared-500 tier — so this
+            // throws rather than re-blaming the caller, and it answers loudly
+            // instead of letting the engine answer `null` per bucket under the
+            // author's own measure name (the #4157 class).
+            function: parseEngineAggregateFunction(a.method, a.alias),
             field: a.field,
-            alias: a.alias
+            alias: a.alias,
+            ...a.filter ? { filter: a.filter } : {}
           })),
           // ADR-0053 Phase 2: thread the reference tz so date buckets resolve on
           // that zone's calendar days (engine buckets in-memory when non-UTC).
@@ -4814,6 +5242,7 @@ var AnalyticsServicePlugin = class {
         const map = /* @__PURE__ */ new Map();
         const displayField = pickDisplayField(dataEngine()?.getObject?.(targetObject)?.fields);
         if (!displayField || !executeAggregate || ids.length === 0) return map;
+        if (scope) assertReadScopeCannotVacate(scope, targetObject);
         const CHUNK = 500;
         for (let i = 0; i < ids.length; i += CHUNK) {
           const idFilter = { id: { $in: ids.slice(i, i + CHUNK) } };