@objectstack/service-analytics 17.2.0 → 17.4.0

package/dist/index.js

@@ -1,7 +1,14 @@
 // src/analytics-service.ts
 import { percentScaleOf } from "@objectstack/spec/data";
 import { resolveI18nLabel as resolveI18nLabel2 } from "@objectstack/spec/ui";
-import { createLogger, getEnv, bucketKeyToCalendarRange as bucketKeyToCalendarRange2, zonedDateStartToUtcMs } from "@objectstack/core";
+import {
+  createLogger,
+  getEnv,
+  bucketKeyToCalendarRange as bucketKeyToCalendarRange2,
+  zonedDateStartToUtcMs,
+  filterTokenContextFrom as filterTokenContextFrom2,
+  resolveFilterTokens as resolveFilterTokens2
+} from "@objectstack/core";
 import { matchMissingColumnOfRelation } from "@objectstack/types";
 
 // src/cube-registry.ts
@@ -44,14 +51,36 @@ var CubeRegistry = class {
     this.cubes.clear();
   }
   /**
-   * Auto-generate a cube definition from an object schema.
+   * Auto-generate a cube definition from an object's FIELD SCHEMA, and register
+   * it under `objectName`.
+   *
+   * ⚠️ Nothing in this repository calls this — the only in-tree caller is a unit
+   * test, and every cube the platform registers itself comes from one of the
+   * three sources named on the class above (#15019). That is not the same thing
+   * as unreachable: `CubeRegistry` is exported from the package entry and
+   * `AnalyticsService.cubeRegistry` is public, so a consumer of
+   * `@objectstack/service-analytics` can call it, and what it mints does reach
+   * the wire — `getMeta()` serves the labels below as `CubeMeta` titles. Whether
+   * this published method is removed or wired up as a real cube source is #15019.
    *
-   * Heuristic rules:
-   * - `number` fields → `sum`, `avg`, `min`, `max` measures
-   * - `boolean` fields → `count` measure (count where true)
-   * - All non-computed fields → dimensions
-   * - `date`/`datetime` fields → time dimensions with standard granularities
-   * - A default `count` measure is always added
+   * Heuristic rules, measured by driving the built package (the list this
+   * replaces claimed three behaviours the code does not have — `min`/`max`
+   * measures, a `count` measure for booleans, and a computed-field exclusion):
+   * - `number` / `currency` / `percent` fields → one `sum` and one `avg` measure
+   *   each, labelled with the field's label plus ` (Sum)` / ` (Avg)`. No `min`
+   *   or `max` measure is minted.
+   * - EVERY field becomes a dimension; there is no computed-field exclusion (the
+   *   `fields` parameter carries no flag one could exclude on).
+   * - `boolean` fields become a `boolean` DIMENSION and nothing else — no count
+   *   measure is minted for them.
+   * - `date` / `datetime` fields → `time` dimensions granulated
+   *   day/week/month/quarter/year.
+   * - A default `count` measure labelled `Count` is always added.
+   *
+   * Those three defaults (`Count`, and the two composites) are English literals
+   * with no i18n hook; #14492's ruling listed the `Count` one as a site to carry
+   * the `builtinAggregate` discriminator, and it was left alone because no
+   * in-repo path reaches it.
    *
    * @param objectName - The snake_case object name (used as table/cube name)
    * @param fields - Array of field descriptors `{ name, type, label? }`
@@ -119,6 +148,38 @@ var CubeRegistry = class {
   }
 };
 
+// src/measure-result-type.ts
+import {
+  REFERENCE_VALUE_TYPES,
+  SINGLE_OPTION_TYPES,
+  STRING_VALUE_TYPES
+} from "@objectstack/spec/data";
+var MEASURE_RESULT_TYPE_TEMPORAL = "time";
+var MEASURE_RESULT_TYPE_STRING = "string";
+var TEMPORAL_SOURCE_FIELD_TYPES = /* @__PURE__ */ new Set([
+  "date",
+  "datetime",
+  "time"
+]);
+var STRING_SOURCE_FIELD_TYPES = /* @__PURE__ */ new Set([
+  // Plain strings: text/textarea/email/url/phone/password/secret, the rich
+  // bodies (markdown/html/richtext/code), and color/signature/qrcode.
+  ...STRING_VALUE_TYPES,
+  // One declared option code — select/radio.
+  ...SINGLE_OPTION_TYPES,
+  // The referenced row's id — lookup/master_detail/tree/user.
+  ...REFERENCE_VALUE_TYPES,
+  // The rendered record number, zero-padded under the default `{0000}`.
+  "autonumber"
+]);
+function measureResultType(aggregate2, sourceFieldType) {
+  if (aggregate2 !== "min" && aggregate2 !== "max") return void 0;
+  if (sourceFieldType === void 0) return void 0;
+  if (TEMPORAL_SOURCE_FIELD_TYPES.has(sourceFieldType)) return MEASURE_RESULT_TYPE_TEMPORAL;
+  if (STRING_SOURCE_FIELD_TYPES.has(sourceFieldType)) return MEASURE_RESULT_TYPE_STRING;
+  return void 0;
+}
+
 // src/strategies/filter-normalizer.ts
 import { isFilterAST, parseFilterAST, VALID_AST_OPERATORS } from "@objectstack/spec/data";
 import { StandardErrorCode } from "@objectstack/spec/api";
@@ -662,6 +723,86 @@ function asciiLowerSqlExpr(expr) {
   return `translate(${expr}, '${ASCII_UPPER_LETTERS}', '${ASCII_LOWER_LETTERS}')`;
 }
 
+// src/text-match-sql.ts
+var KNOWN_DIALECTS = /* @__PURE__ */ new Set(["sqlite", "postgres", "mysql"]);
+function normalizeSqlDialect(name) {
+  return typeof name === "string" && KNOWN_DIALECTS.has(name) ? name : "unknown";
+}
+function sqlDialectFor(ctx, objectName) {
+  const hook = ctx.sqlDialect;
+  if (typeof hook !== "function") return "unknown";
+  return normalizeSqlDialect(hook.call(ctx, objectName));
+}
+function escapeGlobPattern(value) {
+  return String(value).replace(/[*?[]/g, "[$&]");
+}
+function wrapShape(escaped, shape, wildcard) {
+  if (shape === "starts") return `${escaped}${wildcard}`;
+  if (shape === "ends") return `${wildcard}${escaped}`;
+  return `${wildcard}${escaped}${wildcard}`;
+}
+function globPattern(shape, value) {
+  return wrapShape(escapeGlobPattern(value), shape, "*");
+}
+function mysqlAsciiLowerBinarySql(expr) {
+  return asciiLowerReplaceSql(`CAST(${expr} AS BINARY)`);
+}
+function asciiLowerReplaceSql(expr) {
+  let out = expr;
+  for (let i = 0; i < ASCII_UPPER_LETTERS.length; i++) {
+    out = `REPLACE(${out}, '${ASCII_UPPER_LETTERS[i]}', '${ASCII_LOWER_LETTERS[i]}')`;
+  }
+  return out;
+}
+function textMatchPredicateSql(req) {
+  const { dialect, column, shape, value, bind: bind2 } = req;
+  const negate = req.negate === true;
+  const fold = req.fold === true;
+  if (dialect === "sqlite") {
+    const lower = (expr) => fold ? `lower(${expr})` : expr;
+    return `${lower(column)} ${negate ? "NOT GLOB" : "GLOB"} ${lower(bind2(globPattern(shape, value)))}`;
+  }
+  const keyword = negate ? "NOT LIKE" : "LIKE";
+  if (dialect === "mysql") {
+    const binary = (expr) => fold ? mysqlAsciiLowerBinarySql(expr) : `CAST(${expr} AS BINARY)`;
+    return `${binary(column)} ${keyword} ${binary(bind2(likePattern(shape, value)))} ESCAPE ${bind2(LIKE_ESCAPE_CHAR)}`;
+  }
+  const asciiLower = dialect === "postgres" ? asciiLowerSqlExpr : asciiLowerReplaceSql;
+  const folded = (expr) => fold ? asciiLower(expr) : expr;
+  return `${folded(column)} ${keyword} ${folded(bind2(likePattern(shape, value)))} ESCAPE ${bind2(LIKE_ESCAPE_CHAR)}`;
+}
+
+// src/non-text-column.ts
+import { NON_TEXT_STORED_VALUE_TYPES } from "@objectstack/spec/data";
+function textOperatorPolarity(op) {
+  switch (op) {
+    case "$contains":
+    case "$startsWith":
+    case "$endsWith":
+    case "$icontains":
+    case "$like":
+    case "$ilike":
+    case "contains":
+    case "startsWith":
+    case "endsWith":
+    case "icontains":
+      return "positive";
+    case "$notContains":
+    case "notContains":
+      return "negative";
+    default:
+      return null;
+  }
+}
+function isNonTextDeclaredType(type) {
+  return typeof type === "string" && NON_TEXT_STORED_VALUE_TYPES.has(type);
+}
+function nonTextColumnResolver(ctx, objectName) {
+  const declared = ctx.declaredFieldType;
+  if (typeof declared !== "function") return void 0;
+  return (field) => isNonTextDeclaredType(declared.call(ctx, objectName, field));
+}
+
 // src/read-scope-sql.ts
 var IDENT = /^[a-z_][a-z0-9_]*$/i;
 var READ_SCOPE_COMPILE_FAILED = "READ_SCOPE_COMPILE_FAILED";
@@ -672,6 +813,7 @@ function readScopeCompileError(message) {
   return err;
 }
 var FALSE_CLAUSE = "1 = 0";
+var TRUE_CLAUSE = "1 = 1";
 function isFilterNode(v) {
   return v !== null && typeof v === "object" && !Array.isArray(v);
 }
@@ -681,18 +823,65 @@ function quoteIdent(name, kind) {
   }
   return `"${name}"`;
 }
-function compileScopedFilterToSql(filter, alias) {
+function compileScopedFilterToSql(filter, alias, options = {}) {
   const quotedAlias = quoteIdent(alias, "alias");
   const params = [];
-  const sql = compileNode(filter, quotedAlias, params);
+  const sql = compileNode(filter, quotedAlias, params, options);
   return { sql, params };
 }
-function compileSub(node, qAlias) {
+function emptyMembershipFinding(spec, negated, path) {
+  if (Array.isArray(spec)) {
+    return spec.length === 0 && negated ? { path: `${path}: []`, kind: "negatedIn" } : null;
+  }
+  if (spec === null || typeof spec !== "object") return null;
+  const rec = spec;
+  if (Array.isArray(rec.$nin) && rec.$nin.length === 0) return { path: `${path}.$nin`, kind: "nin" };
+  if (Array.isArray(rec.$in) && rec.$in.length === 0 && negated) {
+    return { path: `${path}.$in`, kind: "negatedIn" };
+  }
+  return null;
+}
+function findEmptyMembership(node, negated, path) {
+  if (node === null || typeof node !== "object" || Array.isArray(node)) return null;
+  const rec = node;
+  const bare = emptyMembershipFinding(rec, negated, path.length > 0 ? path : "<root>");
+  if (bare) return bare;
+  for (const [key, value] of Object.entries(rec)) {
+    const here = path.length > 0 ? `${path}.${key}` : key;
+    if (key === "$not") {
+      const found = findEmptyMembership(value, !negated, here);
+      if (found) return found;
+    } else if (key === "$and" || key === "$or") {
+      if (!Array.isArray(value)) continue;
+      for (let i = 0; i < value.length; i++) {
+        const found = findEmptyMembership(value[i], negated, `${here}[${i}]`);
+        if (found) return found;
+      }
+    } else if (!key.startsWith("$")) {
+      const found = emptyMembershipFinding(value, negated, here);
+      if (found) return found;
+    }
+  }
+  return null;
+}
+function assertReadScopeCannotVacate(scope, objectName) {
+  const found = findEmptyMembership(scope, false, "");
+  if (found === null) return;
+  if (found.kind === "nin") {
+    throw readScopeCompileError(
+      `[read-scope-sql] read scope for "${objectName}" has an empty $nin at ${found.path} \u2014 an empty exclusion excludes nothing, so the engine lowers that clause to constant TRUE and the scope does not bind as written. Refused at every polarity, matching this module's own $nin arm (fail-closed).`
+    );
+  }
+  throw readScopeCompileError(
+    `[read-scope-sql] read scope for "${objectName}" has an empty $in under negation at ${found.path} \u2014 an empty membership matches nothing, so its negation matches every row and the read scope admits the whole table (fail-closed).`
+  );
+}
+function compileSub(node, qAlias, opts) {
   const params = [];
-  const sql = compileNode(node, qAlias, params);
+  const sql = compileNode(node, qAlias, params, opts);
   return { sql, params };
 }
-function compileNode(node, qAlias, params) {
+function compileNode(node, qAlias, params, opts) {
   if (!isFilterNode(node)) {
     throw readScopeCompileError("[read-scope-sql] read scope must be a filter object (fail-closed).");
   }
@@ -706,7 +895,7 @@ function compileNode(node, qAlias, params) {
         if (key === "$or") clauses.push(FALSE_CLAUSE);
         continue;
       }
-      const compiled = value.map((child) => compileSub(child, qAlias));
+      const compiled = value.map((child) => compileSub(child, qAlias, opts));
       if (key === "$or" && compiled.some((c) => c.sql.length === 0)) continue;
       const kept = compiled.filter((c) => c.sql.length > 0);
       if (kept.length === 0) continue;
@@ -715,7 +904,7 @@ function compileNode(node, qAlias, params) {
       clauses.push(`(${kept.map((c) => c.sql).join(joiner)})`);
     } else if (key === "$not") {
       const operand = isFilterNode(value) ? nullSafeNegationOperand2(value) : value;
-      const inner = compileSub(operand, qAlias);
+      const inner = compileSub(operand, qAlias, opts);
       if (inner.sql.length === 0) {
         clauses.push(FALSE_CLAUSE);
       } else {
@@ -725,12 +914,12 @@ function compileNode(node, qAlias, params) {
     } else if (key.startsWith("$")) {
       throw readScopeCompileError(`[read-scope-sql] unsupported top-level operator "${key}" (fail-closed).`);
     } else {
-      clauses.push(compileField(key, value, qAlias, params));
+      clauses.push(compileField(key, value, qAlias, params, opts));
     }
   }
   return clauses.join(" AND ");
 }
-function compileField(field, value, qAlias, params) {
+function compileField(field, value, qAlias, params, opts) {
   const col = `${qAlias}.${quoteIdent(field, "field")}`;
   assertDefinedComparands2(field, value);
   assertBooleanFlagComparands(field, value);
@@ -750,7 +939,7 @@ function compileField(field, value, qAlias, params) {
   }
   const parts = [];
   for (const op of keys) {
-    parts.push(compileOperator(col, op, ops[op], field, params));
+    parts.push(compileOperator(col, op, ops[op], field, params, opts));
   }
   return parts.length === 1 ? parts[0] : `(${parts.join(" AND ")})`;
 }
@@ -758,8 +947,20 @@ function bind(params, v) {
   params.push(v);
   return "?";
 }
-function bindLike(params, pattern) {
-  return `${bind(params, pattern)} ESCAPE ${bind(params, LIKE_ESCAPE_CHAR)}`;
+function textMatch(col, shape, val, negate, params, opts, fold = false) {
+  return textMatchPredicateSql({
+    dialect: normalizeSqlDialect(opts.dialect),
+    column: col,
+    shape,
+    value: val,
+    negate,
+    fold,
+    bind: (v) => bind(params, v)
+  });
+}
+function textOverNonTextColumn(op, field, opts) {
+  if (!opts.nonTextColumn || !opts.nonTextColumn(field)) return null;
+  return textOperatorPolarity(op) === "negative" ? TRUE_CLAUSE : FALSE_CLAUSE;
 }
 function nullSafeNegative(col, test) {
   return `(${col} IS NULL OR ${test})`;
@@ -824,7 +1025,7 @@ function assertNoFieldReferenceComparand2(field, spec) {
     });
   }
 }
-function compileOperator(col, op, val, field, params) {
+function compileOperator(col, op, val, field, params, opts) {
   switch (op) {
     case "$eq":
       return val === null ? `${col} IS NULL` : `${col} = ${bind(params, val)}`;
@@ -848,7 +1049,7 @@ function compileOperator(col, op, val, field, params) {
     }
     case "$nin": {
       if (!Array.isArray(val)) throw readScopeCompileError(`[read-scope-sql] $nin for "${field}" needs an array (fail-closed).`);
-      if (val.length === 0) return "1 = 1";
+      if (val.length === 0) throw readScopeCompileError(`[read-scope-sql] $nin for "${field}" is empty \u2014 an empty exclusion excludes nothing and would compile the read scope to constant TRUE (fail-closed).`);
       assertCompilableMembers(op, field, val);
       return nullSafeNegative(col, `${col} NOT IN (${val.map((v) => bind(params, v)).join(", ")})`);
     }
@@ -858,12 +1059,19 @@ function compileOperator(col, op, val, field, params) {
       return `${col} BETWEEN ${bind(params, val[0])} AND ${bind(params, val[1])}`;
     }
     // [#5567] The comparand is a LITERAL, so it is escaped and the escape
-    // character is bound with it. See {@link bindLike}.
+    // character is bound with it. See {@link textMatch}.
     // [#5234] …and it must be a value `String()` can render, which is asserted
-    // BEFORE `likePattern` sees it — see {@link assertRenderableText}.
+    // BEFORE a pattern is built from it — see {@link assertRenderableText}.
+    // [#14079] Every text arm asks {@link textOverNonTextColumn} AFTER its
+    // comparand gate and BEFORE it binds: a comparand the contract refuses is
+    // still refused, and a column whose stored value is never text gets the
+    // contract's constant instead of a match over a number.
+    // [#15684] …and the four case-EXACT arms take their construct from the
+    // DIALECT ({@link textMatch}): a plain `LIKE` folds ASCII case on SQLite,
+    // so this scope ADMITTED rows the policy excludes — over-reach (#3948).
     case "$contains":
       assertRenderableText(op, field, val);
-      return `${col} LIKE ${bindLike(params, likePattern("contains", val))}`;
+      return textOverNonTextColumn(op, field, opts) ?? textMatch(col, "contains", val, false, params, opts);
     /**
      * [#6520] `$icontains` on the READ-SCOPE lowering — the one compiler in this
      * package where a wrong answer is an ADR-0021 scope over-reach rather than a
@@ -879,23 +1087,39 @@ function compileOperator(col, op, val, field, params) {
      * the rows already lower-case — and on a read scope that is a row set the
      * policy author never wrote, in the narrowing direction here but in the
      * WIDENING direction under a `$not`.
+     *
+     * [#15780] …and WHICH fold is the DIALECT's answer, exactly as the keyword
+     * is for the case-exact arms. This line used to spell its own binds and
+     * emit `translate()` unconditionally, on the reasoning that a
+     * case-INSENSITIVE operator never wants the per-dialect case-EXACT
+     * construct. The first half of that was right and the second half hid the
+     * defect: `translate()` is Postgres/Oracle, so on a SQLite datasource this
+     * read scope compiled to a statement the engine could not PARSE — an RLS
+     * policy that cannot be evaluated at all. It goes through
+     * {@link textMatch} now with `fold` set, which keeps `translate()` on
+     * Postgres, emits `lower(col) GLOB lower(?)` on SQLite, the nested-
+     * `REPLACE` binary fold on MySQL and — [#16028] — the same `REPLACE` chain
+     * without the cast on the `unknown` residue, because a datasource whose
+     * dialect nothing answered can BE SQLite and `translate()` failed to parse
+     * there just as loudly through this compiler as through the other two. The
+     * `ESCAPE`
+     * binding is still never folded — the construct table owns that, and the
+     * SQLite arm has no `ESCAPE` clause to bind at all.
      */
-    case "$icontains": {
+    case "$icontains":
       assertRenderableText(op, field, val);
-      const patternRef = asciiLowerSqlExpr(bind(params, likePattern("contains", val)));
-      return `${asciiLowerSqlExpr(col)} LIKE ${patternRef} ESCAPE ${bind(params, LIKE_ESCAPE_CHAR)}`;
-    }
+      return textOverNonTextColumn(op, field, opts) ?? textMatch(col, "contains", val, false, params, opts, true);
     // [#5298] NULL-safe: `NOT LIKE` is UNKNOWN for a NULL column, and "does not
     // contain" is true of a value that is not there.
     case "$notContains":
       assertRenderableText(op, field, val);
-      return nullSafeNegative(col, `${col} NOT LIKE ${bindLike(params, likePattern("contains", val))}`);
+      return textOverNonTextColumn(op, field, opts) ?? nullSafeNegative(col, textMatch(col, "contains", val, true, params, opts));
     case "$startsWith":
       assertRenderableText(op, field, val);
-      return `${col} LIKE ${bindLike(params, likePattern("starts", val))}`;
+      return textOverNonTextColumn(op, field, opts) ?? textMatch(col, "starts", val, false, params, opts);
     case "$endsWith":
       assertRenderableText(op, field, val);
-      return `${col} LIKE ${bindLike(params, likePattern("ends", val))}`;
+      return textOverNonTextColumn(op, field, opts) ?? textMatch(col, "ends", val, false, params, opts);
     // [#6387] `val` is a boolean here — {@link assertBooleanFlagComparands}
     // refused anything else at {@link compileField}, before this emitter runs.
     // So `=== true` is an exhaustive TWO-WAY choice over the declared domain,
@@ -1326,7 +1550,11 @@ var NativeSQLStrategy = class {
     if (typeof ctx.getReadScope !== "function") return;
     const filter = ctx.getReadScope(objectName);
     if (filter === void 0 || filter === null) return;
-    const { sql, params: scopeParams } = compileScopedFilterToSql(filter, alias);
+    const { sql, params: scopeParams } = compileScopedFilterToSql(filter, alias, {
+      nonTextColumn: nonTextColumnResolver(ctx, objectName),
+      dialect: sqlDialectFor(ctx, objectName)
+    });
+    assertReadScopeCannotVacate(filter, objectName);
     if (!sql) return;
     let i = 0;
     const rendered = sql.replace(/\?/g, () => {
@@ -1603,12 +1831,16 @@ var NativeSQLStrategy = class {
       gte: ">=",
       lt: "<",
       lte: "<=",
+      // [#15684 / #15780] For every text operator these entries are the
+      // OPERATOR GATE, not the emitted keyword: `text-match-sql.ts` picks
+      // `LIKE` or `GLOB` per dialect below. ⛔ Reading these five as the
+      // emitted SQL is exactly the mistake #15780 was — `$icontains` was the
+      // last row still emitting the keyword written here, together with a
+      // `translate()` fold SQLite cannot parse.
       contains: "LIKE",
       notContains: "NOT LIKE",
       startsWith: "LIKE",
       endsWith: "LIKE",
-      // [#6520] `$icontains` — `LIKE` like its neighbours; what separates it is
-      // the ASCII fold applied below, not the keyword.
       icontains: "LIKE"
     };
     const likeShape = {
@@ -1634,13 +1866,22 @@ var NativeSQLStrategy = class {
     if (!sqlOp || !values || values.length === 0) return null;
     const shape = likeShape[operator];
     if (shape) {
-      params.push(likePattern(shape, values[0]));
-      const patternRef = `$${params.length}`;
-      params.push(LIKE_ESCAPE_CHAR);
-      if (operator === "icontains") {
-        return `${asciiLowerSqlExpr(rawCol)} ${sqlOp} ${asciiLowerSqlExpr(patternRef)} ESCAPE $${params.length}`;
+      const polarity = textOperatorPolarity(operator);
+      if (polarity && nonTextColumnResolver(ctx, target.object)?.(target.field)) {
+        return polarity === "negative" ? SQL_CONST_TRUE : SQL_CONST_FALSE;
       }
-      return `${rawCol} ${sqlOp} ${patternRef} ESCAPE $${params.length}`;
+      return textMatchPredicateSql({
+        dialect: sqlDialectFor(ctx, target.object),
+        column: rawCol,
+        shape,
+        value: values[0],
+        negate: operator === "notContains",
+        fold: operator === "icontains",
+        bind: (v) => {
+          params.push(v);
+          return `$${params.length}`;
+        }
+      });
     }
     if (operator === "lte") {
       const nextDay = nextUtcCalendarDay(values[0]);
@@ -1741,15 +1982,25 @@ var SCALAR_SQL_OPS = {
   lte: "<="
 };
 var LIKE_SQL_OPS = {
-  contains: { sql: "LIKE", shape: "contains" },
-  notContains: { sql: "NOT LIKE", shape: "contains" },
-  startsWith: { sql: "LIKE", shape: "starts" },
-  endsWith: { sql: "LIKE", shape: "ends" },
-  // [#6520] `$icontains`: the same escaped pattern and bound `ESCAPE` as its
-  // four case-EXACT neighbours, with `fold` adding the ASCII-only case fold to
-  // both sides of the comparison. The flag is on this row alone — the family
-  // above it is case-sensitive by ruling (#4706 Q2 = A).
-  icontains: { sql: "LIKE", shape: "contains", fold: true }
+  // [#15684 / #15780] This table carries NO keyword, deliberately. Every row's
+  // construct comes from the DIALECT (`text-match-sql.ts`): `GLOB` on SQLite,
+  // `LIKE` over `CAST(… AS BINARY)` on MySQL, plain `LIKE` on Postgres, since a
+  // plain `LIKE` is case-exact on Postgres alone. #15684 kept a `sql` field
+  // here for the FOLDING row, which was the last row still emitting a keyword
+  // written locally — together with the `translate()` fold that could not parse
+  // on SQLite. #15780 moved that row onto the table too, so the field had no
+  // reader left, and a dead field named `sql` sitting beside a compiler is an
+  // invitation to read it as the emitted keyword.
+  //
+  // What survives here is only what the construct table cannot derive from the
+  // operator name: which POLARITY the row is (`negate`) and whether it FOLDS
+  // (`fold`), each spelled once. `fold` is on `icontains` ALONE — the four
+  // above it are case-SENSITIVE by ruling (#4706 Q2 = A).
+  contains: { shape: "contains" },
+  notContains: { shape: "contains", negate: true },
+  startsWith: { shape: "starts" },
+  endsWith: { shape: "ends" },
+  icontains: { shape: "contains", fold: true }
 };
 var ObjectQLStrategy = class {
   constructor() {
@@ -1780,11 +2031,16 @@ var ObjectQLStrategy = class {
     for (const [dim, gran] of granByDim) {
       groupBy.push({ field: this.resolveFieldName(cube, dim, "dimension"), dateGranularity: gran });
     }
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     const aggregations = [];
     if (query.measures && query.measures.length > 0) {
       for (const measure of query.measures) {
         const { field, method } = this.resolveMeasureAggregation(cube, measure);
-        aggregations.push({ field, method, alias: measure });
+        const measureFilter = datasetScope?.measureFilters?.[measure];
+        const filterCondition = measureFilter ? this.filterNodeToCondition(normalizeAnalyticsFilterTree({ where: measureFilter }), cube) : null;
+        aggregations.push(
+          filterCondition ? { field, method, alias: measure, filter: filterCondition } : { field, method, alias: measure }
+        );
       }
     }
     const filter = {};
@@ -1794,7 +2050,6 @@ var ObjectQLStrategy = class {
       const extra = this.mergeFilterOperand(filter, field, bounds);
       if (extra) conjuncts.push(extra);
     }
-    const datasetScope = ctx.getDatasetScope?.(query.cube);
     if (datasetScope?.filter) {
       const scopeCondition = this.filterNodeToCondition(
         normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
@@ -1883,6 +2138,7 @@ var ObjectQLStrategy = class {
     }
     const tableName = this.extractObjectName(cube);
     const plan = this.planCrossObject(cube, query, this.filterMemberView(cube, query, ctx));
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     const crossByDim = new Map((plan?.crossDims ?? []).map((cd) => [cd.outputName, cd]));
     const joinClauses = [];
     const dimExpr = (dim) => {
@@ -1913,7 +2169,9 @@ var ObjectQLStrategy = class {
     if (query.measures) {
       for (const m of query.measures) {
         const { field, method } = this.resolveMeasureAggregation(cube, m);
-        const aggSql = method === "count" ? "COUNT(*)" : method === "count_distinct" ? `COUNT(DISTINCT ${field})` : `${method.toUpperCase()}(${field})`;
+        const measureFilter = datasetScope?.measureFilters?.[m];
+        const predicate = measureFilter ? this.renderFilterNodeSql(normalizeAnalyticsFilterTree({ where: measureFilter }), cube, params, ctx) : null;
+        const aggSql = predicate ? this.conditionalAggregateSql(method, field, predicate) : method === "count" ? "COUNT(*)" : method === "count_distinct" ? `COUNT(DISTINCT ${field})` : `${method.toUpperCase()}(${field})`;
         selectParts.push(`${aggSql} AS "${m}"`);
       }
     }
@@ -1921,15 +2179,16 @@ var ObjectQLStrategy = class {
     const filterClause = this.renderFilterNodeSql(
       normalizeAnalyticsFilterTree(query),
       cube,
-      params
+      params,
+      ctx
     );
     if (filterClause) whereParts.push(filterClause);
-    const echoedDatasetFilter = ctx.getDatasetScope?.(query.cube)?.filter;
-    if (echoedDatasetFilter) {
+    if (datasetScope?.filter) {
       const scopeSql = this.renderFilterNodeSql(
-        normalizeAnalyticsFilterTree({ where: echoedDatasetFilter }),
+        normalizeAnalyticsFilterTree({ where: datasetScope.filter }),
         cube,
-        params
+        params,
+        ctx
       );
       if (scopeSql) whereParts.push(scopeSql);
     }
@@ -1942,7 +2201,11 @@ var ObjectQLStrategy = class {
     }
     const scope = ctx.getReadScope?.(tableName);
     if (scope != null) {
-      const { sql: scopeSql, params: scopeParams } = compileScopedFilterToSql(scope, tableName);
+      const { sql: scopeSql, params: scopeParams } = compileScopedFilterToSql(scope, tableName, {
+        nonTextColumn: nonTextColumnResolver(ctx, tableName),
+        dialect: sqlDialectFor(ctx, tableName)
+      });
+      assertReadScopeCannotVacate(scope, tableName);
       if (scopeSql) {
         let i = 0;
         const rendered = scopeSql.replace(/\?/g, () => {
@@ -1989,6 +2252,7 @@ var ObjectQLStrategy = class {
     if (typeof ctx.getReadScope !== "function") return userFilter;
     const scope = ctx.getReadScope(objectName);
     if (scope === void 0 || scope === null) return userFilter;
+    assertReadScopeCannotVacate(scope, objectName);
     const scopeFilter = markFilterSubtreeProvenance(scope, "policy");
     if (!userFilter) return scopeFilter;
     return { $and: [userFilter, scopeFilter] };
@@ -2017,7 +2281,7 @@ var ObjectQLStrategy = class {
    * the members inside were unreadable from the outside and the envelope check
    * could not reject what it could not see.
    *
-   * ## Two producers, one inventory (#10861)
+   * ## Three producers, one inventory (#10861, #11461)
    *
    * The caller's `where` is not the only thing that reaches `engine.aggregate`
    * as a predicate. Since PR #10758 the compiled dataset's own definition-level
@@ -2032,6 +2296,36 @@ var ObjectQLStrategy = class {
    * which driver will serve the dataset and would refuse a dataset that is
    * perfectly legal on a native-SQL deployment.
    *
+   * [#11461] #10413 phase 2 then added a THIRD producer with the same reach and
+   * none of the coverage: a compiled measure's own `filter`, lowered onto that
+   * measure's `aggregations[].filter` entry (#10576). This view enumerated two
+   * origins, so the third was invisible to the envelope check and the arm of
+   * `planCrossObject` that inspects `query.measures` reads only each measure's
+   * resolved FIELD, never its filter. Measured on the unfixed tree, one fixture,
+   * both doors:
+   *
+   * ```
+   * BEFORE  execute()     ACCEPTED -> aggregations: [{field:"*",method:"count",
+   *                                   alias:"west_count",
+   *                                   filter:{"account.region":"West"}}]
+   *                                -> rows [{stage:"won",total_count:3,west_count:0}]
+   *                                   (the truthful west_count is 2; total_count
+   *                                    is right, so the wrong number arrived in
+   *                                    the same response shape as the right one)
+   *         generateSql() ACCEPTED -> COUNT(CASE WHEN account.region = $1 THEN 1 END)
+   *                                   over a FROM with no join in it at all
+   * AFTER   both doors    REFUSED   INVALID_FIELD / 400, engine never reached
+   * ```
+   *
+   * The same maintainer ruling covers it — same hazard, same physical verdict,
+   * one more producer — so it folds in HERE for the #10861 reason and not into
+   * `dataset-compiler.ts`, which still cannot see which driver will serve the
+   * dataset. Only the REQUESTED measures are folded: both doors' aggregation
+   * loops read `measureFilters[m]` for `m of query.measures` and nothing else,
+   * so a filter declared on a measure this query never asks for reaches no
+   * engine, and refusing on it would reject a query for a member that was never
+   * going to be evaluated.
+   *
    * Structure is discarded on purpose — a member is cross-object or it is not,
    * and which branch of a disjunction it sits in cannot make
    * `engine.aggregate` able to join it. PROVENANCE is not discarded, because it
@@ -2041,9 +2335,12 @@ var ObjectQLStrategy = class {
    * `planCrossObject`. The value slot carries that and nothing else; it never
    * reaches a driver.
    *
-   * Dataset leaves are inserted FIRST so a member named by BOTH producers keeps
-   * the caller's provenance (last write wins on a duplicate key): if it is in
-   * the request too, the request is the actionable place to fix it.
+   * Insertion order is measure-filter, then dataset-filter, then `where`, and
+   * last write wins on a duplicate key. Two things follow, in that order of
+   * importance. A member named by the request too keeps the CALLER's provenance,
+   * because if it is in the request that is the actionable place to fix it. And
+   * every shape that was refused before #11461 keeps the exact message it had:
+   * the new origin can only ever win a key no older producer names.
    *
    * Time-dimension WINDOWS are deliberately absent (they live in
    * `dateRangeBounds`, not in `where`). They need no arm here: a cross-object
@@ -2053,13 +2350,21 @@ var ObjectQLStrategy = class {
    * diagnostic and the reason that loop runs first.
    */
   filterMemberView(cube, query, ctx) {
-    const datasetFilter = ctx.getDatasetScope?.(query.cube)?.filter;
+    const datasetScope = ctx.getDatasetScope?.(query.cube);
     const leaves = (node, origin) => collectFilterLeaves(node).map(
       (f) => [this.resolveFieldName(cube, f.member, "any"), origin]
     );
+    const measureLeaves = (query.measures ?? []).flatMap((m) => {
+      const measureFilter = datasetScope?.measureFilters?.[m];
+      return measureFilter ? leaves(
+        normalizeAnalyticsFilterTree({ where: measureFilter }),
+        { kind: "measure-filter", measure: m }
+      ) : [];
+    });
     return Object.fromEntries([
-      ...datasetFilter ? leaves(normalizeAnalyticsFilterTree({ where: datasetFilter }), "dataset-filter") : [],
-      ...leaves(normalizeAnalyticsFilterTree(query), "where")
+      ...measureLeaves,
+      ...datasetScope?.filter ? leaves(normalizeAnalyticsFilterTree({ where: datasetScope.filter }), { kind: "dataset-filter" }) : [],
+      ...leaves(normalizeAnalyticsFilterTree(query), { kind: "where" })
     ]);
   }
   /**
@@ -2074,18 +2379,20 @@ var ObjectQLStrategy = class {
    * THROWS for anything outside the envelope — a cross-object MEASURE or FILTER
    * (needs a real join to evaluate), a cross-object leaf in the DATASET's own
    * definition-level `filter` (#10861 — same join it does not have, arriving
-   * from the producer PR #10758 added), a MULTI-HOP dimension (`a.b.c`), or a
-   * non-recombinable measure (`avg`/`count_distinct`, whose sub-bucket values
-   * cannot be merged). A loud error beats the silent mis-bucket #3654 kills.
+   * from the producer PR #10758 added), a cross-object leaf in ONE MEASURE's own
+   * `filter` (#11461 — the same join again, arriving from the producer #10413
+   * phase 2 added), a MULTI-HOP dimension (`a.b.c`), or a non-recombinable
+   * measure (`avg`/`count_distinct`, whose sub-bucket values cannot be merged).
+   * A loud error beats the silent mis-bucket #3654 kills.
    * `generateSql()` calls this too, so the preview accepts/rejects the same set
    * — and since #10759 both callers derive `filter` from the one
    * {@link filterMemberView}, so that sentence is enforced by construction
    * instead of restated at two call sites.
    *
-   * [#5716] All five refusals below are `invalidMemberError` — `INVALID_FIELD` /
+   * [#5716] All six refusals below are `invalidMemberError` — `INVALID_FIELD` /
    * 400, naming the member — and the four that predate #10861 keep their
    * MESSAGES unchanged (they are good diagnostics, and #5923's tests read
-   * them). Each is decided by two facts and nothing else: a member that will
+   * them); so does #10861's own, which #11461 left untouched beside it. Each is decided by two facts and nothing else: a member that will
    * reach the engine's predicate, and whether that member resolves across a
    * join. Neither is an internal invariant — a cube where the member exists and
    * a driver that could serve it are both perfectly ordinary, which is exactly
@@ -2094,14 +2401,15 @@ var ObjectQLStrategy = class {
    * because the fix is always to change or drop ONE named member, and because
    * four of them fire on `/analytics/query` where no dataset exists.
    *
-   * [#10861] The fifth is the exception that proves the rule and is written to
-   * it: it can only fire where a dataset DOES exist, and it is the one refusal
-   * here whose member no request key named — so it carries `cube` and no
-   * `param`, and says in its own words which document to go and edit. It stays
+   * [#10861, #11461] The fifth and sixth are the exceptions that prove the rule
+   * and are written to it: they can only fire where a dataset DOES exist, and
+   * they are the two refusals here whose member no request key named — so each
+   * carries `cube` and no `param`, and says in its own words which document to
+   * go and edit, the sixth naming the MEASURE inside it as well. Both stay
    * `INVALID_FIELD` rather than becoming `DATASET_INVALID` because the verdict
-   * is the same physical one as its neighbour — this engine cannot join this
+   * is the same physical one as their neighbours — this engine cannot join this
    * member — and splitting the code by PROVENANCE would make a caller branch on
-   * two wire shapes for one capability limit.
+   * three wire shapes for one capability limit.
    *
    * Detection is on RESOLVED field names, so a dotted dimension the cube
    * flattens to a real column is treated as base, not cross-object.
@@ -2123,7 +2431,7 @@ var ObjectQLStrategy = class {
         member: m,
         field: this.resolveMeasureAggregation(cube, m).field
       })),
-      ...Object.entries(filter).filter(([, origin]) => origin === "where").map(([f]) => ({ where: "filter", member: f, field: f }))
+      ...Object.entries(filter).filter(([, origin]) => origin.kind === "where").map(([f]) => ({ where: "filter", member: f, field: f }))
     ].filter((r) => this.isCrossObjectField(cube, r.field, baseObject));
     if (nonDim.length > 0) {
       throw invalidMemberError(
@@ -2137,13 +2445,23 @@ var ObjectQLStrategy = class {
         }
       );
     }
-    const scopeCross = Object.entries(filter).filter(([field, origin]) => origin === "dataset-filter" && this.isCrossObjectField(cube, field, baseObject)).map(([field]) => field);
+    const scopeCross = Object.entries(filter).filter(([field, origin]) => origin.kind === "dataset-filter" && this.isCrossObjectField(cube, field, baseObject)).map(([field]) => field);
     if (scopeCross.length > 0) {
       throw invalidMemberError(
         `[Analytics] ObjectQLStrategy cannot evaluate the cross-object filter ("${scopeCross[0]}") that dataset "${cube.name}" declares at its definition level \u2014 the engine cannot join in an aggregate, so this predicate matches nothing and the answer would be neither the scoped number nor the unscoped one. Nothing in the request names it: remove the cross-object leaf from the dataset's own \`filter\`, or serve this dataset on a native-SQL driver, where the same definition is valid.`,
         { member: scopeCross[0], cube: cube.name }
       );
     }
+    const measureCross = Object.entries(filter).flatMap(
+      ([field, origin]) => origin.kind === "measure-filter" && this.isCrossObjectField(cube, field, baseObject) ? [{ field, measure: origin.measure }] : []
+    );
+    if (measureCross.length > 0) {
+      const { field, measure } = measureCross[0];
+      throw invalidMemberError(
+        `[Analytics] ObjectQLStrategy cannot evaluate the cross-object filter ("${field}") that dataset "${cube.name}" declares on its measure "${measure}" \u2014 the engine cannot join in an aggregate, so this measure would be counted over a predicate that matches nothing and would answer 0 rather than the scoped number. Remove the cross-object leaf from that measure's own \`filter\`, or serve this dataset on a native-SQL driver, where the same definition is valid.`,
+        { member: field, cube: cube.name }
+      );
+    }
     const crossDims = [];
     for (const dim of query.dimensions ?? []) {
       const field = this.resolveFieldName(cube, dim, "dimension");
@@ -2247,6 +2565,7 @@ var ObjectQLStrategy = class {
     if (fkValues.length === 0 || typeof ctx.executeAggregate !== "function") return map;
     const idFilter = { id: { $in: fkValues } };
     const scope = typeof ctx.getReadScope === "function" ? ctx.getReadScope(refObject) : null;
+    if (scope != null) assertReadScopeCannotVacate(scope, refObject);
     if (scope != null) markFilterSubtreeProvenance(scope, "policy");
     const filter = scope != null ? { $and: [idFilter, scope] } : idFilter;
     const rows = await ctx.executeAggregate(refObject, {
@@ -2260,6 +2579,45 @@ var ObjectQLStrategy = class {
     }
     return map;
   }
+  /**
+   * A measure's aggregate, restricted to the rows its own `filter` admits
+   * (#10413 phase 2) — the same six functions `generateSql`'s unconditional
+   * branch renders, wrapped in a `CASE WHEN`.
+   *
+   * Spelled `CASE WHEN` rather than SQL-standard `FILTER (WHERE …)`, mirroring
+   * `NativeSQLStrategy.CONDITIONAL_AGGREGATE_SQL`: this string is DOCUMENTATION
+   * of an execution that really goes through `engine.aggregate`'s per-driver
+   * `aggregations[].filter` lowering (#10576), not a statement this class runs
+   * itself, so there is no reason to pick a dialect-restricted spelling over
+   * the portable one the SQL-executing sibling already settled on.
+   *
+   * `count` over `*` counts a constant (`COUNT(CASE WHEN p THEN 1 END)`, since
+   * `COUNT(CASE WHEN p THEN * END)` is not valid SQL); over a real column it
+   * counts that column's non-null values among the admitted rows.
+   */
+  conditionalAggregateSql(method, col, pred) {
+    const target = col === "*" ? "1" : col;
+    switch (method) {
+      case "count":
+        return `COUNT(CASE WHEN ${pred} THEN ${target} END)`;
+      case "count_distinct":
+        return `COUNT(DISTINCT CASE WHEN ${pred} THEN ${col} END)`;
+      case "sum":
+        return `SUM(CASE WHEN ${pred} THEN ${col} END)`;
+      case "avg":
+        return `AVG(CASE WHEN ${pred} THEN ${col} END)`;
+      case "min":
+        return `MIN(CASE WHEN ${pred} THEN ${col} END)`;
+      case "max":
+        return `MAX(CASE WHEN ${pred} THEN ${col} END)`;
+      // Closed vocabulary, same posture as `resolveMeasureAggregation`'s
+      // callers: `method` comes only from that function, whose own aggTypes
+      // list is exactly these six, so this default is unreachable rather than
+      // a silent fallback for a method this table forgot.
+      default:
+        return `${method.toUpperCase()}(CASE WHEN ${pred} THEN ${col} END)`;
+    }
+  }
   /**
    * Render one normalized filter as a display SQL predicate for `generateSql`.
    *
@@ -2280,7 +2638,7 @@ var ObjectQLStrategy = class {
    * not render that operator": #5333 was exactly that conflation, and an
    * unrenderable operator now THROWS (see the exit below).
    */
-  buildFilterClauseSql(col, operator, values, params) {
+  buildFilterClauseSql(col, operator, values, params, target, ctx) {
     if (operator === "set") return `${col} IS NOT NULL`;
     if (operator === "notSet") return `${col} IS NULL`;
     if (!values || values.length === 0) return null;
@@ -2293,12 +2651,22 @@ var ObjectQLStrategy = class {
     }
     const like = LIKE_SQL_OPS[operator];
     if (like) {
-      params.push(likePattern(like.shape, values[0]));
-      const patternRef = `$${params.length}`;
-      params.push(LIKE_ESCAPE_CHAR);
-      const lhs = like.fold ? asciiLowerSqlExpr(col) : col;
-      const rhs = like.fold ? asciiLowerSqlExpr(patternRef) : patternRef;
-      return `${lhs} ${like.sql} ${rhs} ESCAPE $${params.length}`;
+      const polarity = textOperatorPolarity(operator);
+      if (polarity && target && ctx && nonTextColumnResolver(ctx, target.object)?.(target.field)) {
+        return polarity === "negative" ? SQL_CONST_TRUE : SQL_CONST_FALSE;
+      }
+      return textMatchPredicateSql({
+        dialect: target && ctx ? sqlDialectFor(ctx, target.object) : "unknown",
+        column: col,
+        shape: like.shape,
+        value: values[0],
+        negate: like.negate === true,
+        fold: like.fold === true,
+        bind: (v) => {
+          params.push(v);
+          return `$${params.length}`;
+        }
+      });
     }
     const op = SCALAR_SQL_OPS[operator];
     if (!op) {
@@ -2337,6 +2705,29 @@ var ObjectQLStrategy = class {
     }
     return void 0;
   }
+  /**
+   * [#14079] The (object, field) a filter member binds against — the echo's
+   * copy of `NativeSQLStrategy.resolveStorageTarget`, kept beside the
+   * `LIKE_SQL_OPS` table for the same reason that table is a copy: this file
+   * renders a description of the statement THAT compiler produces, and the
+   * declared-type test both apply is keyed by object and field. A dotted
+   * `sql` is a relationship path (ADR-0071): every segment but the last is a
+   * hop whose join alias is the dot-to-`__` spelling the dataset compiler keys
+   * `cube.joins` by, the last is the column.
+   */
+  resolveStorageTarget(cube, member, baseObject) {
+    const dim = this.lookupMember(cube, member, "dimension");
+    const measure = dim ? void 0 : this.lookupMember(cube, member, "measure");
+    const rawSql = dim?.sql ?? measure?.sql ?? (member.includes(".") ? member.split(".").slice(1).join(".") : member);
+    if (rawSql.includes(".")) {
+      const segments = rawSql.split(".");
+      const field = segments[segments.length - 1];
+      const relPath = segments.slice(0, -1).join(".");
+      const object = cube.joins?.[relPath.replace(/\./g, "__")]?.name ?? relPath;
+      return { object, field };
+    }
+    return { object: baseObject, field: rawSql.replace(/^\$/, "") };
+  }
   resolveFieldName(cube, member, kind) {
     if (kind === "dimension" || kind === "any") {
       const dim = this.lookupMember(cube, member, "dimension");
@@ -2351,8 +2742,20 @@ var ObjectQLStrategy = class {
   resolveMeasureAggregation(cube, measureName) {
     const direct = this.lookupMember(cube, measureName, "measure");
     if (direct) {
+      if (EXPRESSION_METRIC_TYPES.has(direct.type)) {
+        throw invalidMemberError(
+          `[Analytics] ObjectQLStrategy cannot evaluate the custom-SQL measure ("${measureName}") \u2014 its type "${direct.type}" declares a raw SQL expression, which the engine aggregate AST cannot carry; served anyway it would answer null for every bucket under the measure's own name. Use an aggregate measure (count/sum/avg/min/max/count_distinct), or run on a native-SQL driver.`,
+          { member: measureName, param: "measures", cube: cube.name }
+        );
+      }
       return {
         field: direct.sql.replace(/^\$/, ""),
+        // The assertion, not a parse: for a CubeSchema-legal cube the type
+        // partition above leaves exactly the six `AggregationFunction` values.
+        // An enum-INVALID type (host drift, the comment above) still flows
+        // through unchecked ON PURPOSE — adding a method allowlist here would
+        // re-blame the caller with a 400 for OUR bug, so the cast keeps the
+        // compile-time contract (#12776) without changing that posture.
         method: direct.type === "count_distinct" ? "count_distinct" : direct.type
       };
     }
@@ -2366,7 +2769,7 @@ var ObjectQLStrategy = class {
         if (candidate && candidate.type === type) {
           return {
             field: candidate.sql.replace(/^\$/, ""),
-            method: candidate.type === "count_distinct" ? "count_distinct" : candidate.type
+            method: type
           };
         }
       }
@@ -2464,7 +2867,7 @@ var ObjectQLStrategy = class {
    * exactly — including the invariant that a `null` return leaves `params`
    * untouched, so no comparand is left with no placeholder to consume it.
    */
-  renderFilterNodeSql(node, cube, params) {
+  renderFilterNodeSql(node, cube, params, ctx) {
     if (!node) return null;
     if (node.kind === "const") {
       return node.value ? SQL_CONST_TRUE : SQL_CONST_FALSE;
@@ -2474,17 +2877,23 @@ var ObjectQLStrategy = class {
         this.resolveFieldName(cube, node.member, "any"),
         node.operator,
         node.values,
-        params
+        params,
+        // [#14079] The (object, field) this member binds against, resolved the
+        // way `NativeSQLStrategy.resolveStorageTarget` resolves it, so the echo
+        // asks the declared-type hook the same question the executed statement
+        // asked and prints the same constant for a non-text column.
+        this.resolveStorageTarget(cube, node.member, this.extractObjectName(cube)),
+        ctx
       );
     }
     if (node.kind === "not") {
-      const inner = this.renderFilterNodeSql(node.child, cube, params);
+      const inner = this.renderFilterNodeSql(node.child, cube, params, ctx);
       return inner ? `NOT (${inner})` : SQL_CONST_FALSE;
     }
     const paramBase = params.length;
     const parts = [];
     for (const child of node.children) {
-      const clause = this.renderFilterNodeSql(child, cube, params);
+      const clause = this.renderFilterNodeSql(child, cube, params, ctx);
       if (clause === null) {
         if (node.kind !== "or") continue;
         params.length = paramBase;
@@ -3698,25 +4107,55 @@ function bucketDate(value, granularity, timezone) {
       return `${y}-${m}-${day}`;
   }
 }
-function aggregate(rows, metricType, field) {
-  if (metricType === "count" || field === "*") {
-    if (metricType === "countDistinct") {
-      return new Set(rows.map((r) => r[field]).filter((v) => v != null)).size;
+function numericOperand(v) {
+  if (typeof v === "number") return Number.isFinite(v) ? v : null;
+  if (typeof v === "string" && v.trim() !== "") {
+    const n = Number(v);
+    return Number.isFinite(n) ? n : null;
+  }
+  return null;
+}
+function compareOperands(a, b) {
+  const an = numericOperand(a);
+  const bn = numericOperand(b);
+  if (an !== null && bn !== null) return an - bn;
+  return compare(a, b);
+}
+function extremumOf(rows, field, kind) {
+  let winner;
+  let seen = false;
+  for (const r of rows) {
+    const v = r[field];
+    if (v == null) continue;
+    if (!seen) {
+      winner = v;
+      seen = true;
+      continue;
     }
-    return rows.length;
+    const c = compareOperands(v, winner);
+    if (kind === "min" ? c < 0 : c > 0) winner = v;
   }
+  return seen ? winner : null;
+}
+function aggregate(rows, metricType, field) {
+  if (metricType === "count" || field === "*") return rows.length;
   const nums = rows.map((r) => Number(r[field])).filter((n) => Number.isFinite(n));
   switch (metricType) {
-    case "countDistinct":
+    // The spec's spelling (`AggregationFunction`), which is what the compiler
+    // copies through. It used to be spelled `countDistinct` here — a word no
+    // producer mints — so the arm was UNREACHABLE and the measure fell to the
+    // numeric `default` below, answering a sum of coerced values (or a row
+    // count) under the author's `count_distinct` name.
+    case "count_distinct":
       return new Set(rows.map((r) => r[field]).filter((v) => v != null)).size;
     case "sum":
       return nums.reduce((a, b) => a + b, 0);
     case "avg":
       return nums.length ? nums.reduce((a, b) => a + b, 0) / nums.length : 0;
     case "min":
-      return nums.length ? Math.min(...nums) : 0;
+      return extremumOf(rows, field, "min");
     case "max":
-      return nums.length ? Math.max(...nums) : 0;
+      return extremumOf(rows, field, "max");
     default:
       return nums.length ? nums.reduce((a, b) => a + b, 0) : rows.length;
   }
@@ -3777,7 +4216,19 @@ function evaluateAnalyticsQueryOverRows(query, cube, rows) {
   return {
     rows: limited,
     fields: [
-      ...dimensions.map((d) => ({ name: d, type: "string" })),
+      // A dimension column is described by the CUBE dimension's own type — the
+      // same expression `NativeSQLStrategy.buildFieldMeta` and its ObjectQL
+      // sibling use (`d?.type || 'string'`), so a `date` dataset dimension is
+      // `'time'` here exactly as it is on the live path. Minting `'string'` for
+      // every dimension made the same column two different things depending
+      // only on whether a pending seed draft existed (#16203 (b)).
+      ...dimensions.map((d) => ({ name: d, type: String(cube.dimensions?.[d]?.type || "string") })),
+      // ⛔ A MEASURE column keeps the `'number'` every producer in the platform
+      // mints for it, live faces included. Correcting it is one rule owned by
+      // `measureResultType` (#15768/#16101) and applied at the ADR-0021
+      // descriptor pass; a second copy of it here would be two implementations
+      // free to drift, over a question this producer cannot answer anyway (it
+      // has the cube, not the source object's declared field types).
       ...query.measures.map((m) => ({ name: m, type: "number" }))
     ]
   };
@@ -3910,7 +4361,17 @@ var AnalyticsService = class {
       },
       coerceTemporalFilterValue: config.coerceTemporalFilterValue,
       coerceTemporalFilterColumn: config.coerceTemporalFilterColumn,
-      isExternalObject: config.isExternalObject
+      isExternalObject: config.isExternalObject,
+      // [#14079] The declared field type, read off the same `sourceFieldMeta`
+      // hook the display chains use — so the three SQL compilers can give a
+      // text operator over a numeric or boolean column the contract's answer
+      // at compile time. A host that wired no hook answers `undefined`, and
+      // the compilers keep the behaviour they had.
+      declaredFieldType: (object, field) => config.sourceFieldMeta?.(object, field)?.type,
+      // [#15684] The dialect that will run the compiled statement, so the
+      // case-EXACT text family picks a construct that IS case-exact there.
+      // Same tiering as the hook above: `undefined` keeps today's `LIKE`.
+      sqlDialect: (object) => config.sqlDialect?.(object)
     };
     const builtIn = [
       new NativeSQLStrategy(),
@@ -3930,15 +4391,59 @@ var AnalyticsService = class {
    * current request's ExecutionContext (ADR-0021 D-C). The strategy then sees a
    * `getReadScope(objectName)` that already knows the active tenant.
    */
-  async callCtx(query, context) {
-    if (!this.readScopeProvider) return { ...this.baseCtx, context };
+  async callCtx(query, context, tokenCtx) {
+    const getDatasetScope = this.resolvedDatasetScopeGetter(tokenCtx);
+    if (!this.readScopeProvider) return { ...this.baseCtx, context, getDatasetScope };
     const scopes = await this.resolveReadScopes(query, context);
     return {
       ...this.baseCtx,
       context,
+      getDatasetScope,
       getReadScope: (objectName) => scopes.get(objectName) ?? null
     };
   }
+  /**
+   * [#12230] Copy-on-write expansion of filter placeholders across everything
+   * a DIRECT analytics query compares on: `where` and each time dimension's
+   * `dateRange` — the same positions `DatasetExecutor.resolveSelectionTokens`
+   * covers for the dashboard door, minus the dataset-only channels it alone
+   * carries (measure filters ride the dataset-scope getter below).
+   *
+   * The input is never mutated: a query object can be caller-owned metadata
+   * (a saved report definition, a flow node's config) reused across requests,
+   * and resolving in place would bake one request's user id into every later
+   * render. Returns the SAME object when nothing resolved.
+   */
+  resolveQueryTokens(query, tokenCtx) {
+    const where = resolveFilterTokens2(query.where, tokenCtx);
+    const timeDimensions = query.timeDimensions?.map((td) => {
+      if (td.dateRange == null) return td;
+      const dateRange = resolveFilterTokens2(td.dateRange, tokenCtx);
+      return dateRange === td.dateRange ? td : { ...td, dateRange };
+    });
+    const tdChanged = timeDimensions !== void 0 && timeDimensions.some((td, i) => td !== query.timeDimensions[i]);
+    if (where === query.where && !tdChanged) return query;
+    const out = { ...query };
+    if (where !== query.where) out.where = where;
+    if (tdChanged) out.timeDimensions = timeDimensions;
+    return out;
+  }
+  /**
+   * [#12230] A per-request `getDatasetScope` whose answers have their filter
+   * placeholders resolved against THIS caller. See `callCtx` for why the
+   * registry's copy cannot be handed out raw. Token-free scopes pass through
+   * by reference — `resolveFilterTokens` returns its input unchanged when the
+   * tree holds no placeholder, so the common case allocates nothing.
+   */
+  resolvedDatasetScopeGetter(tokenCtx) {
+    return (cubeName) => {
+      const scope = this.baseCtx.getDatasetScope?.(cubeName);
+      if (!scope) return scope;
+      const filter = resolveFilterTokens2(scope.filter, tokenCtx);
+      const measureFilters = resolveFilterTokens2(scope.measureFilters, tokenCtx);
+      return filter === scope.filter && measureFilters === scope.measureFilters ? scope : { filter, measureFilters };
+    };
+  }
   /**
    * Resolve the read scope (tenant + RLS `FilterCondition`) for the base object
    * AND every joined object of the query's cube, keyed by object name. This is
@@ -3996,12 +4501,14 @@ var AnalyticsService = class {
    * aggregate bridge) instead of failing — or worse, fabricating empty rows.
    * Any other error propagates untouched.
    */
-  async query(query, context) {
-    if (!query.cube) {
+  async query(queryInput, context) {
+    if (!queryInput.cube) {
       throw new Error("Cube name is required in analytics query");
     }
+    const tokenCtx = filterTokenContextFrom2(context, /* @__PURE__ */ new Date());
+    const query = this.resolveQueryTokens(queryInput, tokenCtx);
     this.ensureCube(query);
-    const ctx = await this.callCtx(query, context);
+    const ctx = await this.callCtx(query, context, tokenCtx);
     let skip;
     for (; ; ) {
       const strategy = this.resolveStrategy(query, ctx, skip);
@@ -4080,10 +4587,10 @@ var AnalyticsService = class {
           query: async (q) => evaluateAnalyticsQueryOverRows(q, compiled.cube, seedRows)
         };
         const previewResult = await new DatasetExecutor(previewService).execute(compiled, selection, context);
+        this.enrichResultColumns(previewResult, dataset, selection, context);
         return previewResult;
       }
     }
-    const requestLocale = context?.locale;
     const provider = this.readScopeProvider;
     const resolveScope = provider ? (targetObject) => provider(targetObject, context) : void 0;
     const labelDeps = this.labelResolver ? withLabelFetchCache(this.labelResolver) : void 0;
@@ -4119,7 +4626,7 @@ var AnalyticsService = class {
       }
       throw err;
     }
-    const selectedDims = (selection.dimensions ?? []).map((name) => dataset.dimensions?.find((d) => d.name === name)).filter((d) => !!d);
+    const selectedDims = this.selectedDimensions(dataset, selection);
     const drillDims = selectedDims.filter((d) => !!d.field && d.type !== "date");
     if (drillDims.length && result.rows.length) {
       result.object = dataset.object;
@@ -4188,6 +4695,48 @@ var AnalyticsService = class {
         }
       }
     }
+    this.enrichResultColumns(result, dataset, selection, context);
+    return result;
+  }
+  /**
+   * The dataset dimensions this selection GROUPED THE GRID BY, resolved against
+   * the dataset definition. Shared by drill metadata, row-value label
+   * resolution and — through {@link enrichResultColumns} — the dimension column
+   * headers, so all three answer "which dimensions" the same way.
+   */
+  selectedDimensions(dataset, selection) {
+    return (selection.dimensions ?? []).map((name) => dataset.dimensions?.find((d) => d.name === name)).filter((d) => !!d);
+  }
+  /**
+   * ADR-0021 — describe the result's COLUMNS from the dataset's own authored
+   * definition: a measure's `label` / `format` / `currency` / `percentScale` /
+   * `builtinAggregate` and the `type` its aggregate really returns, then a
+   * dimension column's header `label`.
+   *
+   * **Every key here is read off the DATASET** (the authored measure or
+   * dimension) **and `sourceFieldMeta`** (the source object's declared field
+   * metadata). Not one is read off `result.rows`. That is what makes this one
+   * seam serve both paths that produce a dataset response — the live engine
+   * query and the ADR-0037 P3 draft-data preview — and it is why #16097 was a
+   * defect rather than a deliberate omission: the preview branch returns ~250
+   * lines before this ran, so a response over drafted seed rows carried none of
+   * these keys and a renderer fell back to humanizing the raw measure name and
+   * guessing a percent scale from magnitude — the exact failures #5537,
+   * objectui#3136 and #14492 each closed on the live path.
+   *
+   * Extracted rather than copied onto the second path, for the reason the
+   * `type` correction below already gives for living here at all: this is ONE
+   * rule holding both halves of the question, and a per-path copy would be two
+   * implementations of it, free to drift.
+   *
+   * ⛔ Not here, and deliberately: dimension VALUE label resolution
+   * ({@link resolveDimensionLabels}), which rewrites the grouped value in each
+   * ROW. That reads the rows, it is the one enrichment a seed-draft row set can
+   * make unnecessary, and the preview path skips it on purpose — see the note
+   * at that early return.
+   */
+  enrichResultColumns(result, dataset, selection, context) {
+    const requestLocale = context?.locale;
     if (result.fields?.length && dataset.measures?.length) {
       const measureByName = new Map(dataset.measures.map((m) => [m.name, m]));
       for (const f of result.fields) {
@@ -4197,6 +4746,7 @@ var AnalyticsService = class {
           const label = resolveI18nLabel2(m.label, requestLocale);
           if (label !== void 0) f.label = label;
         }
+        if (f.builtinAggregate == null && m.label == null && m.aggregate) f.builtinAggregate = m.aggregate;
         if (f.format == null && m.format) f.format = m.format;
         const fc = f;
         const mc = m;
@@ -4211,9 +4761,11 @@ var AnalyticsService = class {
         if (f.percentScale == null) {
           f.percentScale = m.derived?.op === "ratio" ? "fraction" : percentScaleOf(meta);
         }
+        const resultType = measureResultType(m.aggregate, meta?.type);
+        if (resultType) f.type = resultType;
       }
     }
-    const describableDims = [...selectedDims];
+    const describableDims = [...this.selectedDimensions(dataset, selection)];
     for (const t of selection.timeDimensions ?? []) {
       if (describableDims.some((d2) => d2.name === t.dimension)) continue;
       const d = dataset.dimensions?.find((x) => x.name === t.dimension);
@@ -4230,7 +4782,6 @@ var AnalyticsService = class {
         if (label !== void 0) f.label = label;
       }
     }
-    return result;
   }
   /**
    * Get cube metadata for discovery.
@@ -4255,12 +4806,14 @@ var AnalyticsService = class {
   /**
    * Generate SQL for a query without executing it (dry-run).
    */
-  async generateSql(query, context) {
-    if (!query.cube) {
+  async generateSql(queryInput, context) {
+    if (!queryInput.cube) {
       throw new Error("Cube name is required for SQL generation");
     }
+    const tokenCtx = filterTokenContextFrom2(context, /* @__PURE__ */ new Date());
+    const query = this.resolveQueryTokens(queryInput, tokenCtx);
     this.ensureCube(query);
-    const ctx = await this.callCtx(query, context);
+    const ctx = await this.callCtx(query, context, tokenCtx);
     const strategy = this.resolveStrategy(query, ctx);
     this.logger.debug(`[Analytics] generateSql on cube "${query.cube}" \u2192 ${strategy.name}`);
     return strategy.generateSql(query, ctx);
@@ -4774,6 +5327,16 @@ var FallbackDelegateStrategy = class {
 };
 
 // src/plugin.ts
+import { AggregationFunction as AggregationFunction2 } from "@objectstack/spec/data";
+function parseEngineAggregateFunction(method, alias) {
+  const parsed = AggregationFunction2.safeParse(method);
+  if (!parsed.success) {
+    throw new Error(
+      `[Analytics] The aggregate bridge cannot forward the aggregation "${alias}": "${method}" is not one of the engine's aggregate functions (${AggregationFunction2.options.join(", ")}). A custom-SQL measure is refused earlier, with a caller-facing diagnostic, by ObjectQLStrategy; reaching this point means the analytics layer produced a method the engine contract does not declare.`
+    );
+  }
+  return parsed.data;
+}
 var AnalyticsServicePlugin = class {
   constructor(options = {}) {
     this.name = "com.objectstack.service-analytics";
@@ -4831,10 +5394,58 @@ var AnalyticsServicePlugin = class {
         const rows = await engine.aggregate(objectName, {
           where: filter,
           groupBy,
+          // [#10413 phase 2 / #10576] `a.filter` is the per-aggregation
+          // predicate `ObjectQLStrategy` lowers a measure's own scoped
+          // `filter` into. This map already renames `method` → `function`
+          // for the engine's own vocabulary; dropping `filter` here — as this
+          // bridge did before this line existed — would have made the
+          // strategy's lowering a NO-OP on every real deployment that boots
+          // through this auto-bridge (the default path: `new
+          // AnalyticsServicePlugin({ cubes })` with no custom
+          // `executeAggregate`), passing every unit test that stubs
+          // `executeAggregate` directly while silently dropping the filter in
+          // production — the exact declared-≠-enforced shape Prime Directive
+          // #10 calls out. Omitted (not `filter: undefined`) when the
+          // aggregation carries none, matching the engine's own
+          // vacuous-filter convention.
           aggregations: aggregations?.map((a) => ({
-            function: a.method,
+            // [#11833] `function` is the engine contract's SIX-value
+            // `AggregationFunction`. This bridge's own input declared
+            // `method: string` when that history was written
+            // (`StrategyContext.executeAggregate`, spec
+            // `contracts/analytics-service.ts`), so the two ends of this
+            // rename spoke different vocabularies: narrowing the engine side
+            // to the contract turned the forward into a compile error — the
+            // correct signal, and the one the deleted structural type hid by
+            // declaring `function: string` on both sides.
+            //
+            // Since #12776 (contract) and #12940 (this plugin's own config
+            // mirror above), BOTH ends declare the enum, so the rename is
+            // enum-to-enum and the parse below is defence in depth behind a
+            // compile-time check rather than the only check — see
+            // `parseEngineAggregateFunction` for why erased types still leave
+            // it load-bearing.
+            //
+            // It was closed by PARSING with the spec enum itself rather than
+            // by widening back to `string` (what hid it) or casting past it
+            // (which keeps the hole and adds a lie). `AggregationFunction` is
+            // the same schema `AggregationNodeSchema.function` is built from,
+            // so there is one vocabulary, and its own error map already
+            // carries the `array_agg`/`string_agg` retirement prescriptions.
+            //
+            // TIERING, deliberately: the reachable producer of a non-aggregate
+            // method — a custom-SQL measure (`AggregationMetricType`
+            // `number`/`string`/`boolean`) — is already refused upstream with a
+            // caller-blaming 400 by `ObjectQLStrategy.resolveMeasureAggregation`
+            // (#12209). Anything still arriving here is host drift, which that
+            // refusal's docblock assigns to the undeclared-500 tier — so this
+            // throws rather than re-blaming the caller, and it answers loudly
+            // instead of letting the engine answer `null` per bucket under the
+            // author's own measure name (the #4157 class).
+            function: parseEngineAggregateFunction(a.method, a.alias),
             field: a.field,
-            alias: a.alias
+            alias: a.alias,
+            ...a.filter ? { filter: a.filter } : {}
           })),
           // ADR-0053 Phase 2: thread the reference tz so date buckets resolve on
           // that zone's calendar days (engine buckets in-memory when non-UTC).
@@ -4936,6 +5547,7 @@ var AnalyticsServicePlugin = class {
         const map = /* @__PURE__ */ new Map();
         const displayField = pickDisplayField(dataEngine()?.getObject?.(targetObject)?.fields);
         if (!displayField || !executeAggregate || ids.length === 0) return map;
+        if (scope) assertReadScopeCannotVacate(scope, targetObject);
         const CHUNK = 500;
         for (let i = 0; i < ids.length; i += CHUNK) {
           const idFilter = { id: { $in: ids.slice(i, i + CHUNK) } };
@@ -5003,6 +5615,16 @@ var AnalyticsServicePlugin = class {
       }
       return columnSql;
     };
+    const sqlDialect = (objectName) => {
+      try {
+        const svc = ctx.getService("data");
+        const driver = svc?.getDriverForObject?.(objectName);
+        const named = driver?.dialectName;
+        return typeof named === "string" ? named : void 0;
+      } catch {
+        return void 0;
+      }
+    };
     const config = {
       cubes: this.options.cubes,
       logger: ctx.logger,
@@ -5044,6 +5666,8 @@ var AnalyticsServicePlugin = class {
       // prevent: it drifts by one step, silently, and the drift only surfaces as
       // an error message pointing at the wrong database.
       getObjectDatasource: (objectName) => dataEngine()?.resolveEffectiveDatasource?.(objectName),
+      // [#15684] The executing driver's own dialect — see `sqlDialect` above.
+      sqlDialect,
       // ADR-0062 D6 — a federated object carries an `external` block (ADR-0015).
       // Reported so NativeSQLStrategy declines it (its hand-compiled FROM would
       // hit the wrong physical table) and the driver-correct ObjectQL path runs.