dzql 0.6.37 → 0.7.0

package/src/cli/compiler/paths.ts

@@ -1,17 +1,46 @@
 /**
  * Path Expression Parser and Compiler
  *
- * Shared module for parsing permission and notification path expressions.
- * Provides unified path parsing with different output modes:
- * - EXISTS: For permission checks (returns boolean)
- * - SELECT: For notification resolution (returns user_id array)
+ * Shared by permission checks, subscribe checks and notification resolution, so a
+ * rule means the same thing wherever it is written. Output modes:
+ * - EXISTS: for permission checks (returns boolean)
+ * - SELECT: for notification resolution (returns user ids)
+ *
+ * Grammar:
+ *   rule   := TRUE | FALSE | AUTHENTICATED | @field | @field == @user_id | chain
+ *   chain  := start ('->' hop)+
+ *   start  := @field | table '[' filters ']' conds? '.' field     (table-first)
+ *   hop    := table ('[' filters ']')? conds? ('.' field)?
+ *   filters:= field '=' value (',' field '=' value)*
+ *   conds  := '{' cond (',' cond)* '}'
+ *
+ * Each hop after the start joins on the previous value: on its `$` filter if it
+ * has brackets, otherwise on its id. A hop's `.field` is the value passed on;
+ * the last hop's `.field` is compared with the user. Every hop compiles to a
+ * nested EXISTS, so a hop that matches several rows (occasion_promoters for an
+ * occasion) is followed correctly.
+ *
+ * A path that can't be compiled throws PathCompileError. There is no fallback.
  */
 
+export class PathCompileError extends Error {
+  constructor(message: string, public path?: string) {
+    super(path !== undefined ? `${message} in path '${path}'` : message);
+    this.name = 'PathCompileError';
+  }
+}
+
+export interface FilterPart {
+  field: string;
+  value: string;   // '$', '@field', or a literal as written
+}
+
 export interface PathHop {
   type: 'field' | 'table' | 'final';
   table?: string;
   field?: string;
-  filter?: { field: string; value: string };  // e.g., org_id=$
+  filter?: FilterPart;                        // the join filter ($), or the first filter
+  filters?: FilterPart[];                     // every filter inside [ ]
   conditions?: ConditionPart[];               // e.g., {active} or {role=admin}
   outputField?: string;                       // The .field at the end
 }
@@ -20,495 +49,386 @@ export interface ConditionPart {
   type: 'boolean' | 'equality' | 'temporal';
   field: string;
   value?: string;
+  op?: string;                                // temporal comparison operator
 }
 
+export type PathLiteral = 'TRUE' | 'FALSE' | 'AUTHENTICATED';
+
 export interface ParsedPath {
   hops: PathHop[];
   startField?: string;      // For @field patterns
   tableFirst?: boolean;     // For table[filter].field patterns
+  literal?: PathLiteral;
+  path?: string;
   isValid: boolean;
   error?: string;
 }
 
 /**
- * Parse a path expression into structured hops
+ * Where the row being checked comes from:
+ * - jsonb: a JSONB variable such as p_data or v_old_data
+ * - row: a table name or alias in scope, or a RECORD variable such as v_root.
+ *   fieldMap renames fields (a subscribable's key param maps to the root's id).
  */
+export type RowSource =
+  | { kind: 'jsonb'; name: string }
+  | { kind: 'row'; name: string; fieldMap?: Record<string, string> };
+
+const IDENT = '[a-zA-Z_][a-zA-Z0-9_]*';
+const IDENT_RE = new RegExp(`^${IDENT}$`);
+const HOP_RE = new RegExp(`^(${IDENT})(?:\\[([^\\]]*)\\])?(?:\\{([^}]*)\\})?(?:\\.(${IDENT}))?$`);
+const LITERAL_VALUE_RE = /^(-?\d+(\.\d+)?|'(?:[^']|'')*'|NULL|null|true|false|[a-zA-Z_][a-zA-Z0-9_]*)$/;
+const TEMPORAL_RE = new RegExp(
+  `^(${IDENT})\\s*(<=|>=|<>|!=|<|>)\\s*(now\\(\\)|current_date|current_timestamp|NULL|-?\\d+(?:\\.\\d+)?|'(?:[^']|'')*')$`, 'i');
+const INT_TYPE_RE = /^\s*(int|integer|int2|int4|int8|smallint|bigint|serial|bigserial|smallserial)\b/i;
+
+/** True if a schema type string is an integer key type. */
+export function isIntegerType(type: string | undefined): boolean {
+  return !!type && INT_TYPE_RE.test(type);
+}
+
+const invalid = (path: string, error: string): ParsedPath => ({ hops: [], isValid: false, error, path });
+
+/** Parse a path expression into structured hops */
 export function parsePath(path: string): ParsedPath {
-  path = path.trim();
+  path = (path ?? '').trim();
 
-  // Literal TRUE/FALSE
-  if (path === 'TRUE' || path === 'true') {
-    return { hops: [], isValid: true };
-  }
-  if (path === 'FALSE' || path === 'false') {
-    return { hops: [], isValid: true };
+  if (path === 'TRUE' || path === 'true') return { hops: [], isValid: true, literal: 'TRUE', path };
+  if (path === 'FALSE' || path === 'false') return { hops: [], isValid: true, literal: 'FALSE', path };
+  if (path === 'AUTHENTICATED' || path === 'authenticated') {
+    return { hops: [], isValid: true, literal: 'AUTHENTICATED', path };
   }
 
   // Simple field reference: @author_id
-  if (path.match(/^@[a-zA-Z0-9_]+$/) && !path.includes('->')) {
-    return {
-      hops: [{ type: 'field', field: path.slice(1) }],
-      startField: path.slice(1),
-      isValid: true
-    };
+  const fieldMatch = path.match(new RegExp(`^@(${IDENT})$`));
+  if (fieldMatch) {
+    return { hops: [{ type: 'field', field: fieldMatch[1] }], startField: fieldMatch[1], isValid: true, path };
   }
 
   // Explicit comparison: @field == @user_id
-  const comparisonMatch = path.match(/^@([a-zA-Z0-9_]+)\s*==\s*@user_id$/);
+  const comparisonMatch = path.match(new RegExp(`^@(${IDENT})\\s*==\\s*@user_id$`));
   if (comparisonMatch) {
-    return {
-      hops: [{ type: 'field', field: comparisonMatch[1] }],
-      startField: comparisonMatch[1],
-      isValid: true
-    };
+    return { hops: [{ type: 'field', field: comparisonMatch[1] }], startField: comparisonMatch[1], isValid: true, path };
   }
 
-  // Traversal paths (with ->)
   if (path.includes('->')) {
-    return parseTraversalPath(path);
+    try {
+      return parseChain(path, path.split('->'));
+    } catch (e) {
+      if (e instanceof PathCompileError) return invalid(path, e.message);
+      throw e;
+    }
   }
 
-  // Table-first without traversal (edge case)
-  const tableFirstMatch = path.match(/^([a-zA-Z0-9_]+)\[([^\]]+)\]/);
-  if (tableFirstMatch) {
-    return parseTableFirstPath(path);
+  // Table-first without traversal: rights[package_id=@package_id].user_id
+  if (new RegExp(`^${IDENT}\\[`).test(path)) {
+    try {
+      return parseChain(path, [path]);
+    } catch (e) {
+      if (e instanceof PathCompileError) return invalid(path, e.message);
+      throw e;
+    }
   }
 
-  return {
-    hops: [],
-    isValid: false,
-    error: `Unrecognized path format: ${path}`
-  };
+  return invalid(path, `Unrecognized path format: ${path}`);
 }
 
-/**
- * Parse a traversal path with -> operators
- */
-function parseTraversalPath(path: string): ParsedPath {
-  const rawHops = path.split('->');
-  const hops: PathHop[] = [];
-
-  if (rawHops.length < 2) {
-    return { hops: [], isValid: false, error: 'Traversal path must have at least 2 hops' };
+function parseChain(path: string, segments: string[]): ParsedPath {
+  const raw = segments.map(s => s.trim());
+  if (raw.some(s => s === '')) {
+    throw new PathCompileError(`Empty hop`);
   }
 
-  const firstHop = rawHops[0];
+  const hops: PathHop[] = [];
   let tableFirst = false;
+  let startField: string | undefined;
 
-  // Check if first hop is table-first pattern
-  if (!firstHop.startsWith('@')) {
+  if (raw[0].startsWith('@')) {
+    if (raw.length < 2) throw new PathCompileError(`A traversal needs at least one hop after ${raw[0]}`);
+    startField = raw[0].slice(1);
+    if (!IDENT_RE.test(startField)) throw new PathCompileError(`Cannot parse start '${raw[0]}'`);
+    hops.push({ type: 'field', field: startField });
+  } else {
     tableFirst = true;
-    const parsed = parseTableFirstHop(firstHop);
-    if (!parsed) {
-      return { hops: [], isValid: false, error: `Cannot parse table-first hop: ${firstHop}` };
+    const first = parseHop(raw[0], raw.length === 1 ? 'final' : 'table');
+    if (!first.filters?.length || !first.outputField) {
+      throw new PathCompileError(`A table-first hop needs [filters] and a .field: '${raw[0]}'`);
     }
-    hops.push(parsed);
-  } else {
-    // Field reference: @venue_id
-    const field = firstHop.slice(1);
-    hops.push({ type: 'field', field });
-  }
-
-  // Process intermediate hops (all but last)
-  for (let i = 1; i < rawHops.length - 1; i++) {
-    const hop = rawHops[i];
-    const parsed = parseIntermediateHop(hop);
-    if (!parsed) {
-      return { hops: [], isValid: false, error: `Cannot parse intermediate hop: ${hop}` };
+    if (first.filters.some(f => f.value === '$')) {
+      throw new PathCompileError(`$ has nothing to join to in the first hop '${raw[0]}'`);
     }
-    hops.push(parsed);
+    hops.push(first);
   }
 
-  // Process final hop
-  const finalHop = rawHops[rawHops.length - 1];
-  const parsed = parseFinalHop(finalHop);
-  if (!parsed) {
-    return { hops: [], isValid: false, error: `Cannot parse final hop: ${finalHop}` };
+  for (let i = 1; i < raw.length; i++) {
+    const isFinal = i === raw.length - 1;
+    const hop = parseHop(raw[i], isFinal ? 'final' : 'table');
+    if (hop.filters && hop.filters.length > 0) {
+      const joins = hop.filters.filter(f => f.value === '$');
+      if (joins.length === 0) {
+        throw new PathCompileError(`Hop '${raw[i]}' has [filters] so it must join on $`);
+      }
+      if (joins.length > 1) {
+        throw new PathCompileError(`Hop '${raw[i]}' has more than one $`);
+      }
+    }
+    hops.push(hop);
   }
-  hops.push(parsed);
 
-  return {
-    hops,
-    startField: !tableFirst ? firstHop.slice(1) : undefined,
-    tableFirst,
-    isValid: true
-  };
+  return { hops, startField, tableFirst, isValid: true, path };
 }
 
-/**
- * Parse table-first pattern: contractor_rights[package_id=@package_id]{active}.contractor_org_id
- */
-function parseTableFirstHop(hop: string): PathHop | null {
-  const match = hop.match(/^([a-zA-Z0-9_]+)\[([^\]]+)\](\{[^}]+\})?\.([a-zA-Z0-9_]+)$/);
-  if (!match) return null;
-
-  const [, table, filterExpr, condExpr, outputField] = match;
+function parseHop(text: string, type: 'table' | 'final'): PathHop {
+  const m = text.match(HOP_RE);
+  if (!m) throw new PathCompileError(`Cannot parse hop '${text}'`);
+  const [, table, filterExpr, condExpr, outputField] = m;
 
-  // Parse filter: field=@value or field=$
-  const filterMatch = filterExpr.match(/([a-zA-Z0-9_]+)=(@?[a-zA-Z0-9_$]+)/);
-  if (!filterMatch) return null;
-
-  const filter = {
-    field: filterMatch[1],
-    value: filterMatch[2]
-  };
+  if (type === 'final' && !outputField) {
+    throw new PathCompileError(`The final hop '${text}' needs a .field to compare with the user`);
+  }
+  if (type === 'table' && !outputField && (filterExpr !== undefined || condExpr !== undefined)) {
+    throw new PathCompileError(`Hop '${text}' needs a .field to pass on`);
+  }
 
-  const conditions = condExpr ? parseConditions(condExpr) : [];
+  const filters = filterExpr !== undefined ? parseFilters(filterExpr) : undefined;
+  const conditions = condExpr !== undefined ? parseConditions(condExpr) : [];
+  const filter = filters?.find(f => f.value === '$') ?? filters?.[0];
 
   return {
-    type: 'table',
+    type,
     table,
     filter,
+    filters,
     conditions,
-    outputField
+    outputField: outputField ?? 'id',
   };
 }
 
-/**
- * Parse table-first path (without traversal)
- */
-function parseTableFirstPath(path: string): ParsedPath {
-  const parsed = parseTableFirstHop(path);
-  if (!parsed) {
-    return { hops: [], isValid: false, error: `Cannot parse table-first path: ${path}` };
-  }
-  return {
-    hops: [parsed],
-    tableFirst: true,
-    isValid: true
-  };
-}
-
-/**
- * Parse intermediate hop: table.field
- */
-function parseIntermediateHop(hop: string): PathHop | null {
-  const dotMatch = hop.match(/^([a-zA-Z0-9_]+)\.([a-zA-Z0-9_]+)$/);
-  if (dotMatch) {
-    return {
-      type: 'table',
-      table: dotMatch[1],
-      outputField: dotMatch[2]
-    };
-  }
-
-  // Just table name - use id
-  if (hop.match(/^[a-zA-Z0-9_]+$/)) {
-    return {
-      type: 'table',
-      table: hop,
-      outputField: 'id'
-    };
+/** Split on commas that are not inside single quotes */
+function splitTopLevel(text: string): string[] {
+  const parts: string[] = [];
+  let cur = '';
+  let inQuote = false;
+  for (const ch of text) {
+    if (ch === "'") inQuote = !inQuote;
+    if (ch === ',' && !inQuote) {
+      parts.push(cur.trim());
+      cur = '';
+    } else {
+      cur += ch;
+    }
   }
-
-  return null;
+  parts.push(cur.trim());
+  return parts;
 }
 
-/**
- * Parse final hop: table[filter=$]{conditions}.user_id
- */
-function parseFinalHop(hop: string): PathHop | null {
-  // Full pattern: acts_for[org_id=$]{active,role=admin}.user_id
-  const fullMatch = hop.match(/^([a-zA-Z0-9_]+)(?:\[([^\]]+)\])?(?:\{([^}]+)\})?\.([a-zA-Z0-9_]+)$/);
-  if (!fullMatch) return null;
-
-  const [, table, filterExpr, condExpr, outputField] = fullMatch;
-
-  let filter: { field: string; value: string } | undefined;
-  if (filterExpr) {
-    const filterMatch = filterExpr.match(/([a-zA-Z0-9_]+)=(\$|@?[a-zA-Z0-9_]+)/);
-    if (filterMatch) {
-      filter = {
-        field: filterMatch[1],
-        value: filterMatch[2]
-      };
+function parseFilters(expr: string): FilterPart[] {
+  return splitTopLevel(expr).map(part => {
+    const m = part.match(new RegExp(`^(${IDENT})\\s*=\\s*(.+)$`));
+    if (!m) throw new PathCompileError(`Cannot parse filter '${part}'`);
+    const value = m[2].trim();
+    if (value !== '$' && !new RegExp(`^@${IDENT}$`).test(value) && !LITERAL_VALUE_RE.test(value)) {
+      throw new PathCompileError(`Cannot parse filter value '${value}'`);
     }
-  }
-
-  const conditions = condExpr ? parseConditions(condExpr) : [];
-
-  return {
-    type: 'final',
-    table,
-    filter,
-    conditions,
-    outputField
-  };
+    return { field: m[1], value };
+  });
 }
 
 /**
  * Parse condition expression: {active} or {active,role=admin} or {valid_from<=now(),valid_to=NULL}
  */
-function parseConditions(condExpr: string): ConditionPart[] {
-  const inner = condExpr.replace(/[{}]/g, '');
-  const parts = inner.split(',').map(p => p.trim());
-  const conditions: ConditionPart[] = [];
-
-  for (const part of parts) {
+function parseConditions(expr: string): ConditionPart[] {
+  return splitTopLevel(expr).map(part => {
     // Boolean field: {active}
-    if (part.match(/^[a-zA-Z0-9_]+$/)) {
-      conditions.push({ type: 'boolean', field: part });
-      continue;
-    }
-
-    // Equality: {role=admin} or {role='admin'}
-    const eqMatch = part.match(/^([a-zA-Z0-9_]+)=(.+)$/);
-    if (eqMatch) {
-      const field = eqMatch[1];
-      let value = eqMatch[2];
+    if (IDENT_RE.test(part)) return { type: 'boolean', field: part } as ConditionPart;
 
-      // Special case: NULL
+    // Equality: {role=admin} or {role='admin'} or {valid_to=NULL}
+    const eq = part.match(new RegExp(`^(${IDENT})\\s*=\\s*(.+)$`));
+    if (eq && LITERAL_VALUE_RE.test(eq[2].trim())) {
+      let value = eq[2].trim();
       if (value.toUpperCase() === 'NULL') {
-        conditions.push({ type: 'equality', field, value: 'NULL' });
-      } else {
-        // Remove quotes if present
-        if (value.startsWith("'") && value.endsWith("'")) {
-          value = value.slice(1, -1);
-        }
-        conditions.push({ type: 'equality', field, value });
+        value = 'NULL';
+      } else if (value.startsWith("'") && value.endsWith("'")) {
+        value = value.slice(1, -1).replace(/''/g, "'");
       }
-      continue;
+      return { type: 'equality', field: eq[1], value } as ConditionPart;
     }
 
-    // Temporal: {valid_from<=now()} - treat as raw expression
-    conditions.push({ type: 'temporal', field: part });
-  }
+    // Comparison: {valid_from<=now()}
+    const cmp = part.match(TEMPORAL_RE);
+    if (cmp) return { type: 'temporal', field: cmp[1], op: cmp[2], value: cmp[3] } as ConditionPart;
 
-  return conditions;
+    throw new PathCompileError(`Cannot parse condition '${part}'`);
+  });
 }
 
-/**
- * Compile a parsed path to SQL for permission checks (EXISTS)
- */
-export function compilePathToExists(
-  parsed: ParsedPath,
-  dataVar: string = 'p_data',
-  userVar: string = 'p_user_id'
-): string {
-  if (!parsed.isValid) {
-    console.warn(`[Compiler] Invalid path: ${parsed.error}`);
-    return 'FALSE';
-  }
-
-  if (parsed.hops.length === 0) {
-    // TRUE/FALSE literal was parsed
-    return 'FALSE';
-  }
-
-  const isJsonb = dataVar.startsWith('p_') || dataVar.startsWith('v_');
-  const fieldAccess = (field: string) =>
-    isJsonb ? `(${dataVar}->>'${field}')::int` : `${dataVar}.${field}`;
+// === SQL generation ===
 
-  // Simple field reference
-  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
-    const field = parsed.hops[0].field!;
-    return `${fieldAccess(field)} = ${userVar}`;
-  }
-
-  // Build value expression through the hops
-  let valueExpr: string;
-
-  // Handle table-first vs field-first
-  if (parsed.tableFirst) {
-    const firstHop = parsed.hops[0];
-    valueExpr = buildTableLookup(firstHop, dataVar, isJsonb);
-  } else {
-    valueExpr = fieldAccess(parsed.startField!);
-  }
-
-  // Process intermediate hops
-  const startIdx = parsed.tableFirst ? 1 : 1;
-  for (let i = startIdx; i < parsed.hops.length - 1; i++) {
-    const hop = parsed.hops[i];
-    valueExpr = `(SELECT ${hop.outputField} FROM ${hop.table} WHERE id = ${valueExpr})`;
-  }
-
-  // Final hop - build EXISTS check
-  const finalHop = parsed.hops[parsed.hops.length - 1];
-  return buildExistsCheck(finalHop, valueExpr, userVar);
+function toSource(source: string | RowSource): RowSource {
+  if (typeof source !== 'string') return source;
+  return source.startsWith('p_') || source.startsWith('v_')
+    ? { kind: 'jsonb', name: source }
+    : { kind: 'row', name: source };
 }
 
-/**
- * Compile a parsed path to SQL for notification resolution (SELECT user_ids)
- */
-export function compilePathToSelect(
-  parsed: ParsedPath,
-  dataVar: string = 'p_data'
-): string {
-  if (!parsed.isValid) {
-    console.warn(`[Notification] Invalid path: ${parsed.error}`);
-    return `SELECT NULL::int WHERE FALSE`;
-  }
-
-  if (parsed.hops.length === 0) {
-    return `SELECT NULL::int WHERE FALSE`;
-  }
-
-  const isJsonb = dataVar.startsWith('p_') || dataVar.startsWith('v_');
-  const fieldAccess = (field: string) =>
-    isJsonb ? `(${dataVar}->>'${field}')::int` : `${dataVar}.${field}`;
-
-  // Simple field reference - direct user_id
-  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
-    const field = parsed.hops[0].field!;
-    return `SELECT ${fieldAccess(field)} WHERE (${dataVar}->>'${field}') IS NOT NULL`;
-  }
-
-  // Build value expression through the hops
-  let valueExpr: string;
-
-  // Handle table-first vs field-first
-  if (parsed.tableFirst) {
-    const firstHop = parsed.hops[0];
-    valueExpr = buildTableLookup(firstHop, dataVar, isJsonb);
-  } else {
-    valueExpr = fieldAccess(parsed.startField!);
-  }
+function fieldAccessor(source: RowSource): (field: string) => string {
+  if (source.kind === 'jsonb') return (field) => `(${source.name}->>'${field}')::int`;
+  return (field) => `${source.name}.${source.fieldMap?.[field] ?? field}`;
+}
 
-  // Process intermediate hops
-  const startIdx = parsed.tableFirst ? 1 : 1;
-  for (let i = startIdx; i < parsed.hops.length - 1; i++) {
-    const hop = parsed.hops[i];
-    valueExpr = `(SELECT ${hop.outputField} FROM ${hop.table} WHERE id = ${valueExpr})`;
-  }
+const quote = (s: string) => `'${s.replace(/'/g, "''")}'`;
 
-  // Final hop - build SELECT for user_ids
-  const finalHop = parsed.hops[parsed.hops.length - 1];
-  return buildSelectUsers(finalHop, valueExpr);
+/** SQL for a literal as written in a filter or condition */
+function literalSQL(value: string): string {
+  if (/^-?\d+(\.\d+)?$/.test(value)) return value;
+  if (value === 'true' || value === 'false') return value;
+  if (value.startsWith("'") && value.endsWith("'")) return quote(value.slice(1, -1).replace(/''/g, "'"));
+  return quote(value);
 }
 
-/**
- * Build a table lookup subquery for table-first patterns
- */
-function buildTableLookup(hop: PathHop, dataVar: string, isJsonb: boolean): string {
-  const { table, filter, conditions, outputField } = hop;
+/** Picks an alias for each table so no hop shadows the row being checked or another hop */
+function aliaser(source: RowSource) {
+  const used = new Set<string>(source.kind === 'row' ? [source.name] : []);
+  return (table: string): string => {
+    if (!used.has(table)) {
+      used.add(table);
+      return table;
+    }
+    let n = 1;
+    while (used.has(`${table}_${n}`)) n++;
+    used.add(`${table}_${n}`);
+    return `${table}_${n}`;
+  };
+}
 
-  if (!filter || !table || !outputField) {
-    return 'NULL';
+/** WHERE clauses for one hop: its join on prev, its other filters, its conditions */
+function hopClauses(hop: PathHop, alias: string, prev: string | null, field: (f: string) => string): string[] {
+  const clauses: string[] = [];
+  if (hop.filters && hop.filters.length > 0) {
+    for (const f of hop.filters) {
+      const col = `${alias}.${f.field}`;
+      if (f.value === '$') clauses.push(`${col} = ${prev}`);
+      else if (f.value.startsWith('@')) clauses.push(`${col} = ${field(f.value.slice(1))}`);
+      else if (f.value.toUpperCase() === 'NULL') clauses.push(`${col} IS NULL`);
+      else clauses.push(`${col} = ${literalSQL(f.value)}`);
+    }
+  } else if (prev !== null) {
+    clauses.push(`${alias}.id = ${prev}`);
   }
-
-  // Build filter value
-  let filterValue: string;
-  if (filter.value === '$') {
-    // $ is not valid for first hop - use the field name
-    filterValue = 'NULL';
-  } else if (filter.value.startsWith('@')) {
-    const refField = filter.value.slice(1);
-    filterValue = isJsonb ? `(${dataVar}->>'${refField}')::int` : `${dataVar}.${refField}`;
-  } else {
-    filterValue = filter.value;
+  for (const cond of hop.conditions || []) {
+    clauses.push(conditionSQL(alias, cond));
   }
-
-  // Build conditions
-  const condClauses: string[] = [`${table}.${filter.field} = ${filterValue}`];
-
-  for (const cond of conditions || []) {
-    condClauses.push(buildConditionClause(table, cond));
-  }
-
-  return `(SELECT ${outputField} FROM ${table} WHERE ${condClauses.join(' AND ')})`;
+  return clauses;
 }
 
-/**
- * Build condition clause for a table
- */
-function buildConditionClause(table: string, cond: ConditionPart): string {
+function conditionSQL(alias: string, cond: ConditionPart): string {
   switch (cond.type) {
     case 'boolean':
-      return `${table}.${cond.field} = true`;
+      return `${alias}.${cond.field} = true`;
     case 'equality':
-      if (cond.value === 'NULL') {
-        return `${table}.${cond.field} IS NULL`;
-      }
-      // Quote string values, leave numbers as-is
-      const value = cond.value!.match(/^\d+$/) ? cond.value : `'${cond.value}'`;
-      return `${table}.${cond.field} = ${value}`;
+      if (cond.value === 'NULL') return `${alias}.${cond.field} IS NULL`;
+      return `${alias}.${cond.field} = ${/^-?\d+(\.\d+)?$/.test(cond.value!) ? cond.value : quote(cond.value!)}`;
     case 'temporal':
-      // Raw expression
-      return `${table}.${cond.field}`;
-    default:
-      return 'TRUE';
+      return `${alias}.${cond.field} ${cond.op} ${cond.value}`;
   }
 }
 
+function requireValid(parsed: ParsedPath): void {
+  if (!parsed.isValid) throw new PathCompileError(parsed.error ?? 'Invalid path', parsed.path);
+}
+
+/** The hops a chain walks, and the value the first of them joins on */
+function chainSteps(parsed: ParsedPath, field: (f: string) => string): { steps: PathHop[]; start: string | null } {
+  return parsed.tableFirst
+    ? { steps: parsed.hops, start: null }
+    : { steps: parsed.hops.slice(1), start: field(parsed.startField!) };
+}
+
 /**
- * Build EXISTS check for permission verification
+ * Compile a parsed path to SQL for permission checks (EXISTS)
  */
-function buildExistsCheck(hop: PathHop, valueExpr: string, userVar: string): string {
-  const { table, filter, conditions, outputField } = hop;
+export function compilePathToExists(
+  parsed: ParsedPath,
+  dataVar: string | RowSource = 'p_data',
+  userVar: string = 'p_user_id'
+): string {
+  requireValid(parsed);
 
-  if (!table) return 'FALSE';
+  if (parsed.literal === 'TRUE') return 'TRUE';
+  if (parsed.literal === 'FALSE') return 'FALSE';
+  if (parsed.literal === 'AUTHENTICATED') return `${userVar} IS NOT NULL`;
 
-  const condClauses: string[] = [];
+  const source = toSource(dataVar);
+  const field = fieldAccessor(source);
 
-  // Join condition
-  if (filter) {
-    if (filter.value === '$') {
-      condClauses.push(`${table}.${filter.field} = ${valueExpr}`);
-    } else {
-      condClauses.push(`${table}.${filter.field} = ${filter.value}`);
-    }
-  } else {
-    condClauses.push(`${table}.id = ${valueExpr}`);
+  // Simple field reference
+  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
+    return `${field(parsed.hops[0].field!)} = ${userVar}`;
   }
 
-  // Additional conditions
-  for (const cond of conditions || []) {
-    condClauses.push(buildConditionClause(table, cond));
-  }
+  const alias = aliaser(source);
+  const { steps, start } = chainSteps(parsed, field);
 
-  // User check
-  if (outputField === 'user_id') {
-    condClauses.push(`${table}.user_id = ${userVar}`);
-  } else if (outputField) {
-    condClauses.push(`${table}.${outputField} = ${userVar}`);
-  }
+  const build = (i: number, prev: string | null): string => {
+    const hop = steps[i];
+    const a = alias(hop.table!);
+    const clauses = hopClauses(hop, a, prev, field);
+    if (i === steps.length - 1) {
+      clauses.push(`${a}.${hop.outputField} = ${userVar}`);
+    } else {
+      clauses.push(build(i + 1, `${a}.${hop.outputField}`));
+    }
+    const from = a === hop.table ? hop.table : `${hop.table} ${a}`;
+    return `EXISTS (SELECT 1 FROM ${from} WHERE ${clauses.join(' AND ')})`;
+  };
 
-  return `EXISTS (SELECT 1 FROM ${table} WHERE ${condClauses.join(' AND ')})`;
+  return build(0, start);
 }
 
 /**
- * Build SELECT query for notification user resolution
+ * Compile a parsed path to SQL for notification resolution (SELECT user_ids)
  */
-function buildSelectUsers(hop: PathHop, valueExpr: string): string {
-  const { table, filter, conditions, outputField } = hop;
+export function compilePathToSelect(
+  parsed: ParsedPath,
+  dataVar: string | RowSource = 'p_data'
+): string {
+  requireValid(parsed);
 
-  if (!table || !outputField) {
-    return `SELECT NULL::int WHERE FALSE`;
+  if (parsed.literal) {
+    throw new PathCompileError(`A notification path must lead to users, not ${parsed.literal}`, parsed.path);
   }
 
-  const condClauses: string[] = [];
+  const source = toSource(dataVar);
+  const field = fieldAccessor(source);
 
-  // Join condition
-  if (filter) {
-    if (filter.value === '$') {
-      condClauses.push(`${table}.${filter.field} = ${valueExpr}`);
-    } else {
-      condClauses.push(`${table}.${filter.field} = ${filter.value}`);
-    }
-  } else {
-    condClauses.push(`${table}.id = ${valueExpr}`);
+  // Simple field reference - direct user_id
+  if (parsed.hops.length === 1 && parsed.hops[0].type === 'field') {
+    const value = field(parsed.hops[0].field!);
+    return `SELECT ${value} WHERE ${value} IS NOT NULL`;
   }
 
-  // Additional conditions
-  for (const cond of conditions || []) {
-    condClauses.push(buildConditionClause(table, cond));
+  const alias = aliaser(source);
+  const { steps, start } = chainSteps(parsed, field);
+  const froms: string[] = [];
+  const clauses: string[] = [];
+  let prev = start;
+  let last = '';
+
+  for (const hop of steps) {
+    const a = alias(hop.table!);
+    froms.push(a === hop.table ? hop.table! : `${hop.table} ${a}`);
+    clauses.push(...hopClauses(hop, a, prev, field));
+    prev = `${a}.${hop.outputField}`;
+    last = prev;
   }
 
-  return `SELECT ${table}.${outputField} FROM ${table} WHERE ${condClauses.join(' AND ')}`;
+  return `SELECT ${last} FROM ${froms.join(', ')} WHERE ${clauses.join(' AND ')}`;
 }
 
 /**
- * Validate a path expression and return detailed errors
+ * Validate a path expression's syntax and return detailed errors
  */
 export function validatePath(path: string, entityName?: string): { valid: boolean; error?: string } {
   const parsed = parsePath(path);
-
-  if (!parsed.isValid) {
-    return { valid: false, error: parsed.error };
-  }
-
-  // Additional validation could check table/column existence
-  // For now just validate syntax
-  return { valid: true };
+  return parsed.isValid ? { valid: true } : { valid: false, error: parsed.error };
 }