@servicelabsco/slabs-access-manager 1.0.69 → 1.0.71

package/dist/access/libraries/report.view.query.compiler.d.ts

@@ -6,6 +6,7 @@ export declare const DEFAULT_ROW_CAP = 500;
 export declare const OFFSET_CAP = 10000;
 export declare const GROUP_BY_CAP = 3;
 export declare const STATEMENT_TIMEOUT_MS = 2000;
+export declare const RELATIVE_DATE_TOKENS: readonly ["@today", "@today-Nd", "@today+Nd", "@today-Nw", "@today+Nw", "@today-Nm", "@today+Nm", "@today-Ny", "@today+Ny", "@month_start", "@quarter_start", "@fy_start"];
 export declare const REPORT_VIEW_GRAMMAR: {
     readonly operators: readonly [{
         readonly op: "eq";
@@ -48,10 +49,15 @@ export declare const REPORT_VIEW_GRAMMAR: {
     readonly buckets: readonly ["day", "week", "month", "quarter", "year"];
     readonly sort_dirs: readonly ["asc", "desc"];
     readonly relative_dates: {
-        readonly tokens: readonly ["@today", "@today-Nd", "@today+Nd"];
+        readonly tokens: readonly ["@today", "@today-Nd", "@today+Nd", "@today-Nw", "@today+Nw", "@today-Nm", "@today+Nm", "@today-Ny", "@today+Ny", "@month_start", "@quarter_start", "@fy_start"];
         readonly example: "@today-30d";
         readonly timezone: "Asia/Kolkata";
-        readonly note: "Resolved server-side to an ISO calendar date. Do not compute today in the client.";
+        readonly fy_anchor: "04-01";
+        readonly note: "Resolved server-side to an ISO calendar date in Asia/Kolkata. @fy_start is 1 April (Indian FY); in January–March that is last April. Do not compute today or period boundaries in the client.";
+    };
+    readonly caller: {
+        readonly tokens: readonly ["@me"];
+        readonly note: "Resolved server-side to the caller: user id on id-type columns, email on string columns. Incompatible columns return value_type_mismatch.";
     };
     readonly rails: {
         readonly tenancy: "injected";
@@ -60,6 +66,13 @@ export declare const REPORT_VIEW_GRAMMAR: {
         readonly offset_cap: 10000;
         readonly statement_timeout_ms: 2000;
     };
+    readonly join: {
+        readonly max: 1;
+        readonly cardinality: "many_to_one";
+        readonly columns: "<relationship>.<column>";
+        readonly semantics: "LEFT JOIN; unmatched rows yield nulls for <rel>.*";
+        readonly note: "Name a catalog-declared relationship from view_describe. Do not send ON conditions.";
+    };
 };
 export type ReportViewOp = (typeof OPS)[number];
 export type ReportViewAggFn = (typeof AGG_FNS)[number];
@@ -86,6 +99,9 @@ export type CatalogView = {
     grain?: string;
     domain?: string;
     tenancy_column: string;
+    user_scoped?: boolean;
+    user_column?: string;
+    view_kind?: 'view' | 'materialized';
     row_cap: number;
     last_run_time?: Date | string | null;
     example_queries?: Array<{
@@ -94,6 +110,7 @@ export type CatalogView = {
     }>;
     suggested_visualizations?: unknown[];
     columns: CatalogColumn[];
+    relationships?: CatalogRelationship[];
 };
 export type ReportViewFilter = {
     column?: string;
@@ -113,7 +130,17 @@ export type ReportViewSort = {
     by?: string;
     dir?: string;
 };
+export type CatalogRelationship = {
+    name: string;
+    view: string;
+    on: Record<string, string>;
+    when?: Record<string, unknown>;
+    cardinality: string;
+    description?: string;
+    target?: CatalogView;
+};
 export type ReportViewDsl = {
+    join?: string | string[];
     columns?: string[];
     filters?: ReportViewFilter[];
     group_by?: ReportViewGroupBy[];
@@ -140,6 +167,7 @@ export type CompiledQuery = {
         grain?: string;
         table_name: string;
         refreshed_at: Date | string | null;
+        live?: boolean;
     };
 };
 export declare class ReportViewQueryError extends Error {
@@ -148,6 +176,10 @@ export declare class ReportViewQueryError extends Error {
 }
 export type CompileOptions = {
     now?: Date;
+    user?: {
+        id: number;
+        email?: string;
+    };
 };
 export declare function compileReportViewQuery(view: CatalogView, dsl: ReportViewDsl, businessId: number, options?: CompileOptions): CompiledQuery;
 export declare function agentVisibleColumns(view: CatalogView): CatalogColumn[];
@@ -160,4 +192,5 @@ export declare const ReportViewQueryCompiler: {
     quoteIdent: typeof quoteIdent;
     resolveRelativeDate: typeof resolveRelativeDate;
     nearest: typeof nearest;
+    RELATIVE_DATE_TOKENS: readonly ["@today", "@today-Nd", "@today+Nd", "@today-Nw", "@today+Nw", "@today-Nm", "@today+Nm", "@today-Ny", "@today+Ny", "@month_start", "@quarter_start", "@fy_start"];
 };

package/dist/access/libraries/report.view.query.compiler.js

@@ -1,6 +1,6 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.ReportViewQueryCompiler = exports.ReportViewQueryError = exports.REPORT_VIEW_GRAMMAR = exports.STATEMENT_TIMEOUT_MS = exports.GROUP_BY_CAP = exports.OFFSET_CAP = exports.DEFAULT_ROW_CAP = exports.SORT_DIRS = exports.BUCKETS = exports.AGG_FNS = exports.OPS = void 0;
+exports.ReportViewQueryCompiler = exports.ReportViewQueryError = exports.REPORT_VIEW_GRAMMAR = exports.RELATIVE_DATE_TOKENS = exports.STATEMENT_TIMEOUT_MS = exports.GROUP_BY_CAP = exports.OFFSET_CAP = exports.DEFAULT_ROW_CAP = exports.SORT_DIRS = exports.BUCKETS = exports.AGG_FNS = exports.OPS = void 0;
 exports.compileReportViewQuery = compileReportViewQuery;
 exports.agentVisibleColumns = agentVisibleColumns;
 exports.quoteIdent = quoteIdent;
@@ -16,8 +16,23 @@ exports.GROUP_BY_CAP = 3;
 exports.STATEMENT_TIMEOUT_MS = 2000;
 const IDENT = /^[a-z][a-z0-9_]*$/;
 const NUMERIC_AGG = new Set(['sum', 'avg', 'min', 'max']);
-const RELATIVE_DATE = /^@today(?:([+-])(\d+)d)?$/;
+const RELATIVE_DATE = /^@(?:today(?:([+-])(\d+)([dwmy]))?|month_start|quarter_start|fy_start)$/;
 const RELATIVE_DATE_TZ = 'Asia/Kolkata';
+const FY_START_MONTH = 4;
+exports.RELATIVE_DATE_TOKENS = [
+    '@today',
+    '@today-Nd',
+    '@today+Nd',
+    '@today-Nw',
+    '@today+Nw',
+    '@today-Nm',
+    '@today+Nm',
+    '@today-Ny',
+    '@today+Ny',
+    '@month_start',
+    '@quarter_start',
+    '@fy_start',
+];
 exports.REPORT_VIEW_GRAMMAR = {
     operators: [
         { op: 'eq', value: 'scalar' },
@@ -40,10 +55,15 @@ exports.REPORT_VIEW_GRAMMAR = {
     buckets: [...exports.BUCKETS],
     sort_dirs: [...exports.SORT_DIRS],
     relative_dates: {
-        tokens: ['@today', '@today-Nd', '@today+Nd'],
+        tokens: [...exports.RELATIVE_DATE_TOKENS],
         example: '@today-30d',
         timezone: RELATIVE_DATE_TZ,
-        note: 'Resolved server-side to an ISO calendar date. Do not compute today in the client.',
+        fy_anchor: '04-01',
+        note: 'Resolved server-side to an ISO calendar date in Asia/Kolkata. @fy_start is 1 April (Indian FY); in January–March that is last April. Do not compute today or period boundaries in the client.',
+    },
+    caller: {
+        tokens: ['@me'],
+        note: 'Resolved server-side to the caller: user id on id-type columns, email on string columns. Incompatible columns return value_type_mismatch.',
     },
     rails: {
         tenancy: 'injected',
@@ -52,6 +72,13 @@ exports.REPORT_VIEW_GRAMMAR = {
         offset_cap: exports.OFFSET_CAP,
         statement_timeout_ms: exports.STATEMENT_TIMEOUT_MS,
     },
+    join: {
+        max: 1,
+        cardinality: 'many_to_one',
+        columns: '<relationship>.<column>',
+        semantics: 'LEFT JOIN; unmatched rows yield nulls for <rel>.*',
+        note: 'Name a catalog-declared relationship from view_describe. Do not send ON conditions.',
+    },
 };
 class ReportViewQueryError extends Error {
     constructor(code, message) {
@@ -68,7 +95,11 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
     const agentColumns = agentVisibleColumns(view);
     const byName = new Map(agentColumns.map((column) => [column.name, column]));
     const names = agentColumns.map((column) => column.name);
-    assertNoTenancyLeak(dsl, view, names);
+    const join = resolveJoin(view, dsl.join);
+    const targetColumns = join?.target ? agentVisibleColumns(join.target) : [];
+    const targetByName = new Map(targetColumns.map((column) => [column.name, column]));
+    const targetNames = targetColumns.map((column) => column.name);
+    assertNoInjectedColumnLeak(dsl, view, names, join);
     const aggregates = dsl.aggregates || [];
     const groupBy = dsl.group_by || [];
     const isAggregate = aggregates.length > 0 || groupBy.length > 0;
@@ -87,37 +118,47 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
         throw new ReportViewQueryError('limit', 'limit must be a positive integer.');
     const limit = Math.min(requested, rowCap);
     const now = options.now || new Date();
+    const user = options.user;
     const params = [businessId];
+    const joinSql = join ? compileJoin(view, join, params, user) : '';
     const select = [];
     const output = [];
     const selectNames = new Set();
-    const addOutput = (column) => {
+    const resolve = (name) => resolveColumn(name, view, join, byName, names, targetByName, targetNames);
+    const addOutput = (column, outputName = column.name) => {
         output.push({
-            name: column.name,
-            title: column.display_name || column.name,
+            name: outputName,
+            title: column.display_name || outputName,
             type: column.semantic_type || 'string',
             ...(column.format ? { format: column.format } : {}),
             ...(column.enum_map ? { enum_map: column.enum_map } : {}),
         });
-        selectNames.add(column.name);
+        selectNames.add(outputName);
+    };
+    const selectExpr = (column, bucket) => {
+        if (bucket)
+            return `date_trunc('${bucket}', ${column.sqlIdent}) AS ${quoteAlias(column.outputName)}`;
+        if (column.joined)
+            return `${column.sqlIdent} AS ${quoteAlias(column.outputName)}`;
+        return column.sqlIdent;
     };
     if (isAggregate) {
         for (const group of groupBy) {
-            const column = requireColumn(group.column, byName, names, view.catalog_name);
+            const column = resolve(group.column);
             if (column.groupable === false) {
-                throw new ReportViewQueryError('not_groupable', `not_groupable: column '${column.name}' cannot be grouped.`);
+                throw new ReportViewQueryError('not_groupable', `not_groupable: column '${column.outputName}' cannot be grouped.`);
             }
             if (group.bucket) {
                 if (column.bucketable !== true) {
-                    throw new ReportViewQueryError('not_bucketable', `not_bucketable: column '${column.name}' is not bucketable.`);
+                    throw new ReportViewQueryError('not_bucketable', `not_bucketable: column '${column.outputName}' is not bucketable.`);
                 }
                 const bucket = requireAllowlisted(group.bucket, exports.BUCKETS, 'bucket');
-                select.push(`date_trunc('${bucket}', ${quoteIdent(column.name)}) AS ${quoteIdent(column.name)}`);
+                select.push(selectExpr(column, bucket));
             }
             else {
-                select.push(quoteIdent(column.name));
+                select.push(selectExpr(column));
             }
-            addOutput(column);
+            addOutput(column, column.outputName);
         }
         for (const aggregate of aggregates) {
             const fn = requireAllowlisted(aggregate.fn, exports.AGG_FNS, 'aggregate');
@@ -129,14 +170,17 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
                 select.push(`COUNT(*) AS ${quoteIdent(alias)}`);
             }
             else {
-                const column = requireColumn(aggregate.column, byName, names, view.catalog_name);
+                const column = resolve(aggregate.column);
+                if (column.joined) {
+                    throw new ReportViewQueryError('join_aggregate_not_supported', `join_aggregate_not_supported: aggregating joined column '${column.outputName}' is not supported. Aggregate on the base view; filter or group by <rel>.* instead.`);
+                }
                 assertAggregatable(column, fn);
                 if (fn === 'count')
-                    select.push(`COUNT(${quoteIdent(column.name)}) AS ${quoteIdent(alias)}`);
+                    select.push(`COUNT(${column.sqlIdent}) AS ${quoteIdent(alias)}`);
                 else if (fn === 'count_distinct')
-                    select.push(`COUNT(DISTINCT ${quoteIdent(column.name)}) AS ${quoteIdent(alias)}`);
+                    select.push(`COUNT(DISTINCT ${column.sqlIdent}) AS ${quoteIdent(alias)}`);
                 else
-                    select.push(`${fn.toUpperCase()}(${quoteIdent(column.name)}) AS ${quoteIdent(alias)}`);
+                    select.push(`${fn.toUpperCase()}(${column.sqlIdent}) AS ${quoteIdent(alias)}`);
             }
             addOutput({ name: alias, display_name: alias, semantic_type: 'number' });
         }
@@ -150,24 +194,39 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
     else {
         const requestedCols = dsl.columns?.length ? dsl.columns : names;
         for (const name of requestedCols) {
-            const column = requireColumn(name, byName, names, view.catalog_name);
-            select.push(quoteIdent(column.name));
-            addOutput(column);
+            const column = resolve(name);
+            select.push(selectExpr(column));
+            addOutput(column, column.outputName);
         }
         if (!select.length) {
             throw new ReportViewQueryError('unknown_column', `unknown_column: view '${view.catalog_name}' has no selectable columns.`);
         }
     }
-    const where = [`${quoteIdent(view.tenancy_column)} = $1`];
+    const tenancyIdent = join ? `${quoteIdent(view.table_name)}.${quoteIdent(view.tenancy_column)}` : quoteIdent(view.tenancy_column);
+    const where = [`${tenancyIdent} = $1`];
+    if (view.user_scoped) {
+        const userCol = view.user_column;
+        if (!userCol || !IDENT.test(userCol)) {
+            throw new ReportViewQueryError('user_scope', 'user_scope: user_scoped views require a hidden user_column.');
+        }
+        if (!user?.id) {
+            throw new ReportViewQueryError('user_scope', 'user_scope: user_scoped views require an authenticated caller.');
+        }
+        const userIdent = join ? `${quoteIdent(view.table_name)}.${quoteIdent(userCol)}` : quoteIdent(userCol);
+        where.push(`${userIdent} = ${bind(params, user.id)}`);
+    }
     for (const filter of dsl.filters || []) {
-        const column = requireColumn(filter.column, byName, names, view.catalog_name);
+        const column = resolve(filter.column);
         if (column.filterable === false) {
-            throw new ReportViewQueryError('not_filterable', `not_filterable: column '${column.name}' cannot be filtered.`);
+            throw new ReportViewQueryError('not_filterable', `not_filterable: column '${column.outputName}' cannot be filtered.`);
         }
         const op = requireAllowlisted(filter.op, exports.OPS, 'op');
-        where.push(compileFilter(column, op, filter.value, params, now));
+        where.push(compileFilter(column, column.sqlIdent, op, filter.value, params, now, user));
     }
-    const sql = [`SELECT ${select.join(', ')}`, `FROM ${quoteIdent(view.table_name)}`, `WHERE ${where.join(' AND ')}`];
+    const sql = [`SELECT ${select.join(', ')}`, `FROM ${quoteIdent(view.table_name)}`];
+    if (joinSql)
+        sql.push(joinSql);
+    sql.push(`WHERE ${where.join(' AND ')}`);
     if (groupBy.length) {
         sql.push(`GROUP BY ${groupBy.map((_, index) => String(index + 1)).join(', ')}`);
     }
@@ -178,7 +237,7 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
                 throw unknownColumn(by, [...selectNames], view.catalog_name);
             }
             const dir = item.dir ? requireAllowlisted(String(item.dir).toLowerCase(), exports.SORT_DIRS, 'dir') : 'asc';
-            return `${quoteIdent(by)} ${dir.toUpperCase()}`;
+            return `${quoteAlias(by)} ${dir.toUpperCase()}`;
         });
         sql.push(`ORDER BY ${order.join(', ')}`);
     }
@@ -195,7 +254,8 @@ function compileReportViewQuery(view, dsl, businessId, options = {}) {
             name: view.catalog_name,
             grain: view.grain,
             table_name: view.table_name,
-            refreshed_at: view.last_run_time ?? null,
+            refreshed_at: view.view_kind === 'view' ? null : (view.last_run_time ?? null),
+            ...(view.view_kind === 'view' ? { live: true } : {}),
         },
     };
 }
@@ -203,6 +263,8 @@ function agentVisibleColumns(view) {
     return (view.columns || []).filter((column) => {
         if (!column?.name || column.name === view.tenancy_column || column.name === 'business_id')
             return false;
+        if (view.user_column && column.name === view.user_column)
+            return false;
         if (column.visibility === false)
             return false;
         if (column.sensitive === true)
@@ -215,17 +277,119 @@ function quoteIdent(name) {
         throw new ReportViewQueryError('unknown_column', `unknown_column: '${name}' is not a valid identifier.`);
     return `"${name}"`;
 }
-function requireColumn(name, byName, names, viewName) {
+function quoteAlias(name) {
+    if (!/^[a-z][a-z0-9_]*(\.[a-z][a-z0-9_]*)?$/.test(name)) {
+        throw new ReportViewQueryError('unknown_column', `unknown_column: '${name}' is not a valid identifier.`);
+    }
+    return `"${name}"`;
+}
+function declaredRelationshipNames(view) {
+    return (view.relationships || []).map((relationship) => relationship.name).filter(Boolean);
+}
+function resolveJoin(view, joinName) {
+    const name = normalizeJoinName(joinName);
+    if (name === undefined)
+        return undefined;
+    const declared = declaredRelationshipNames(view);
+    const listed = declared.length ? declared.join(', ') : '(none)';
+    const shown = IDENT.test(name) ? `'${name}'` : 'that name';
+    if (!IDENT.test(name)) {
+        throw new ReportViewQueryError('unknown_relationship', `unknown_relationship: ${shown} is not a declared relationship on ${view.catalog_name}. Declared: ${listed}.`);
+    }
+    const relationship = (view.relationships || []).find((candidate) => candidate.name === name);
+    if (!relationship) {
+        throw new ReportViewQueryError('unknown_relationship', `unknown_relationship: '${name}' is not a declared relationship on ${view.catalog_name}. Declared: ${listed}.`);
+    }
+    if (relationship.cardinality !== 'many_to_one' || !relationship.target) {
+        throw new ReportViewQueryError('relationship_unavailable', `relationship_unavailable: relationship '${relationship.name}' on ${view.catalog_name} is not available (target view '${relationship.view}' is not agent-visible or failed the catalog gate).`);
+    }
+    return relationship;
+}
+function normalizeJoinName(join) {
+    if (join === undefined || join === '')
+        return undefined;
+    if (Array.isArray(join)) {
+        if (!join.length)
+            return undefined;
+        if (join.length > 1) {
+            throw new ReportViewQueryError('join_limit', `join_limit: v1 supports exactly one relationship (got ${join.length}).`);
+        }
+        return join[0];
+    }
+    return join;
+}
+function compileJoin(view, relationship, params, user) {
+    const alias = quoteIdent(relationship.name);
+    const target = relationship.target;
+    const on = Object.entries(relationship.on || {});
+    if (!on.length) {
+        throw new ReportViewQueryError('relationship_unavailable', `relationship_unavailable: relationship '${relationship.name}' on ${view.catalog_name} is not available (target view '${relationship.view}' is not agent-visible or failed the catalog gate).`);
+    }
+    const conds = [];
+    for (const [sourceCol, targetCol] of on) {
+        conds.push(`${quoteIdent(view.table_name)}.${quoteIdent(sourceCol)} = ${alias}.${quoteIdent(String(targetCol))}`);
+    }
+    conds.push(`${alias}.${quoteIdent(target.tenancy_column || 'business_id')} = $1`);
+    if (target.user_scoped) {
+        const userCol = target.user_column;
+        if (!userCol || !IDENT.test(userCol) || !user?.id) {
+            throw new ReportViewQueryError('user_scope', `user_scope: joined view '${relationship.view}' is user-scoped and requires a hidden user_column plus an authenticated caller.`);
+        }
+        conds.push(`${alias}.${quoteIdent(userCol)} = ${bind(params, user.id)}`);
+    }
+    const byName = new Map((view.columns || []).map((column) => [column.name, column]));
+    for (const [sourceCol, value] of Object.entries(relationship.when || {})) {
+        if (sourceCol === view.tenancy_column || sourceCol === 'business_id')
+            continue;
+        const column = byName.get(sourceCol);
+        if (!column)
+            throw unknownColumn(sourceCol, [...byName.keys()], view.catalog_name);
+        conds.push(`${quoteIdent(view.table_name)}.${quoteIdent(sourceCol)} = ${bind(params, mapEnum(column, value))}`);
+    }
+    return `LEFT JOIN ${quoteIdent(target.table_name)} AS ${alias} ON ${conds.join(' AND ')}`;
+}
+function resolveColumn(name, view, join, byName, names, targetByName, targetNames) {
     const key = String(name || '');
-    if (key === 'business_id')
-        throw unknownColumn(key, names, viewName);
+    const parts = key.split('.');
+    if (parts.length > 2)
+        throw unknownColumn(key, names, view.catalog_name);
+    if (parts.length === 2) {
+        const [relName, columnName] = parts;
+        if (!join || join.name !== relName) {
+            const hint = join
+                ? ` Active join is '${join.name}'; address joined columns as ${join.name}.<column>.`
+                : ' Name a catalog-declared relationship with join first.';
+            throw new ReportViewQueryError('unknown_column', `unknown_column: '${key}' is not a column on ${view.catalog_name}.${hint}`);
+        }
+        if (columnName === 'business_id' || columnName === join.target?.tenancy_column || columnName === join.target?.user_column) {
+            throw unknownColumn(key, targetNames, join.view);
+        }
+        const column = targetByName.get(columnName);
+        if (!column)
+            throw unknownColumn(key, targetNames, join.view);
+        return {
+            ...column,
+            sqlIdent: `${quoteIdent(join.name)}.${quoteIdent(column.name)}`,
+            outputName: `${join.name}.${column.name}`,
+            joined: true,
+        };
+    }
+    if (key === 'business_id' || key === view.tenancy_column || (view.user_column && key === view.user_column)) {
+        throw unknownColumn(key, names, view.catalog_name);
+    }
     const column = byName.get(key);
     if (!column)
-        throw unknownColumn(key, names, viewName);
-    return column;
+        throw unknownColumn(key, names, view.catalog_name);
+    return {
+        ...column,
+        sqlIdent: join ? `${quoteIdent(view.table_name)}.${quoteIdent(column.name)}` : quoteIdent(column.name),
+        outputName: column.name,
+        joined: false,
+    };
 }
 function unknownColumn(name, names, viewName) {
-    const suggestions = nearest(name, names, 3);
+    const needle = name.includes('.') ? name.slice(name.lastIndexOf('.') + 1) : name;
+    const suggestions = nearest(needle, names, 3);
     const hint = suggestions.length ? ` Did you mean ${suggestions.join(', ')}?` : '';
     return new ReportViewQueryError('unknown_column', `unknown_column: '${name}' is not a column on ${viewName}.${hint}`);
 }
@@ -265,8 +429,7 @@ function assertAggregatable(column, fn) {
         throw new ReportViewQueryError('aggregate_not_allowed', `aggregate_not_allowed: ${fn} on ${column.name} — did you mean count?`);
     }
 }
-function compileFilter(column, op, value, params, now) {
-    const ident = quoteIdent(column.name);
+function compileFilter(column, ident, op, value, params, now, user) {
     if (op === 'is_null')
         return `${ident} IS NULL`;
     if (op === 'not_null')
@@ -275,7 +438,7 @@ function compileFilter(column, op, value, params, now) {
         const list = Array.isArray(value) ? value : null;
         if (!list?.length)
             throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: ${op} on ${column.name} needs a non-empty array.`);
-        const placeholders = list.map((item) => bind(params, mapEnum(column, resolveRelativeDate(item, now))));
+        const placeholders = list.map((item) => bind(params, mapEnum(column, resolveValue(item, column, now, user))));
         return op === 'in' ? `${ident} IN (${placeholders.join(', ')})` : `${ident} NOT IN (${placeholders.join(', ')})`;
     }
     if (op === 'between') {
@@ -283,35 +446,69 @@ function compileFilter(column, op, value, params, now) {
         if (pair?.length !== 2) {
             throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: between on ${column.name} needs [from, to].`);
         }
-        return `${ident} BETWEEN ${bind(params, mapEnum(column, resolveRelativeDate(pair[0], now)))} AND ${bind(params, mapEnum(column, resolveRelativeDate(pair[1], now)))}`;
+        return `${ident} BETWEEN ${bind(params, mapEnum(column, resolveValue(pair[0], column, now, user)))} AND ${bind(params, mapEnum(column, resolveValue(pair[1], column, now, user)))}`;
     }
     if (op === 'contains') {
         if (typeof value !== 'string') {
             throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: contains on ${column.name} needs a string.`);
         }
-        return `${ident} ILIKE ${bind(params, `%${escapeLike(value)}%`)} ESCAPE '\\\\'`;
+        return `${ident} ILIKE ${bind(params, `%${escapeLike(value)}%`)} ESCAPE '\\'`;
     }
     if (value === undefined || value === null || Array.isArray(value)) {
         throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: ${op} on ${column.name} needs a single value.`);
     }
-    const mapped = mapEnum(column, resolveRelativeDate(value, now));
+    const mapped = mapEnum(column, resolveValue(value, column, now, user));
     const sqlOp = { eq: '=', neq: '<>', gt: '>', gte: '>=', lt: '<', lte: '<=' }[op];
     return `${ident} ${sqlOp} ${bind(params, mapped)}`;
 }
+function resolveValue(value, column, now, user) {
+    if (value === '@me')
+        return resolveMe(column, user);
+    return resolveRelativeDate(value, now);
+}
+function resolveMe(column, user) {
+    if (!user?.id) {
+        throw new ReportViewQueryError('value_type_mismatch', 'value_type_mismatch: @me requires an authenticated caller.');
+    }
+    const type = column.semantic_type;
+    const idLike = type === 'id' || column.name === 'id' || /_id$/.test(column.name);
+    if (idLike)
+        return user.id;
+    if (type === 'money' || type === 'percent' || type === 'date' || type === 'enum') {
+        throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: @me is not valid on ${column.name} (${type || 'this type'}). Use an id or string column.`);
+    }
+    if (!user.email) {
+        throw new ReportViewQueryError('value_type_mismatch', 'value_type_mismatch: @me on a string column needs the caller email.');
+    }
+    return user.email;
+}
 function resolveRelativeDate(value, now) {
     if (typeof value !== 'string')
         return value;
     if (value.startsWith('@') && !RELATIVE_DATE.test(value)) {
-        throw new ReportViewQueryError('value_type_mismatch', 'value_type_mismatch: relative dates must be @today or @today±Nd (e.g. @today-30d). Do not compute today in the client.');
+        throw new ReportViewQueryError('value_type_mismatch', 'value_type_mismatch: relative dates must be @today, @today±N[d|w|m|y], @month_start, @quarter_start, or @fy_start (e.g. @today-3m, @fy_start). Do not compute today in the client.');
     }
     const match = value.match(RELATIVE_DATE);
     if (!match)
         return value;
     const today = calendarDate(now, RELATIVE_DATE_TZ);
+    if (value === '@month_start')
+        return monthStart(today);
+    if (value === '@quarter_start')
+        return quarterStart(today);
+    if (value === '@fy_start')
+        return fyStart(today);
     if (!match[1])
         return today;
     const delta = Number(match[2]) * (match[1] === '-' ? -1 : 1);
-    return addCalendarDays(today, delta);
+    const unit = match[3];
+    if (unit === 'd')
+        return addCalendarDays(today, delta);
+    if (unit === 'w')
+        return addCalendarDays(today, delta * 7);
+    if (unit === 'm')
+        return addCalendarMonths(today, delta);
+    return addCalendarMonths(today, delta * 12);
 }
 function calendarDate(now, timeZone) {
     return new Intl.DateTimeFormat('en-CA', { timeZone, year: 'numeric', month: '2-digit', day: '2-digit' }).format(now);
@@ -321,6 +518,28 @@ function addCalendarDays(isoDate, days) {
     const utc = new Date(Date.UTC(year, month - 1, day + days));
     return utc.toISOString().slice(0, 10);
 }
+function addCalendarMonths(isoDate, months) {
+    const [year, month, day] = isoDate.split('-').map(Number);
+    const total = year * 12 + (month - 1) + months;
+    const nextYear = Math.floor(total / 12);
+    const nextMonth = ((total % 12) + 12) % 12;
+    const lastDay = new Date(Date.UTC(nextYear, nextMonth + 1, 0)).getUTCDate();
+    const clamped = Math.min(day, lastDay);
+    return `${nextYear}-${String(nextMonth + 1).padStart(2, '0')}-${String(clamped).padStart(2, '0')}`;
+}
+function monthStart(isoDate) {
+    return `${isoDate.slice(0, 7)}-01`;
+}
+function quarterStart(isoDate) {
+    const month = Number(isoDate.slice(5, 7));
+    const start = Math.floor((month - 1) / 3) * 3 + 1;
+    return `${isoDate.slice(0, 4)}-${String(start).padStart(2, '0')}-01`;
+}
+function fyStart(isoDate) {
+    const year = Number(isoDate.slice(0, 4));
+    const month = Number(isoDate.slice(5, 7));
+    return month >= FY_START_MONTH ? `${year}-04-01` : `${year - 1}-04-01`;
+}
 function mapEnum(column, value) {
     const map = column.enum_map;
     if (!map || value === undefined || value === null || typeof value === 'object')
@@ -344,11 +563,19 @@ function assertInt(value, field) {
         throw new ReportViewQueryError('value_type_mismatch', `value_type_mismatch: ${field} must be an integer.`);
     return n;
 }
-function assertNoTenancyLeak(dsl, view, names) {
-    const banned = new Set([view.tenancy_column, 'business_id']);
+function assertNoInjectedColumnLeak(dsl, view, names, join) {
+    const banned = new Set([view.tenancy_column, 'business_id', view.user_column].filter(Boolean));
+    if (join?.target) {
+        banned.add(join.target.tenancy_column || 'business_id');
+        if (join.target.user_column)
+            banned.add(join.target.user_column);
+    }
     const check = (value) => {
         const key = String(value || '');
-        if (banned.has(key))
+        if (!key)
+            return;
+        const column = key.includes('.') ? key.slice(key.lastIndexOf('.') + 1) : key;
+        if (banned.has(key) || banned.has(column))
             throw unknownColumn(key, names, view.catalog_name);
     };
     (dsl.columns || []).forEach(check);
@@ -395,5 +622,6 @@ exports.ReportViewQueryCompiler = {
     quoteIdent,
     resolveRelativeDate,
     nearest,
+    RELATIVE_DATE_TOKENS: exports.RELATIVE_DATE_TOKENS,
 };
 //# sourceMappingURL=report.view.query.compiler.js.map