drivers(turso): RemoteTransport refuses a cube-qualified aggregation alias, so every analytics cube query on a remote datasource is an un-enveloped 500

[os-steve]

Filed while fixing #13714 (analytics time-dimension granularity 500). Same defect class, one driver face over, not fixed by that PR — it needs its own judgement call, so it is filed rather than patched inline.

What

RemoteTransport.aggregate (Turso remote mode) holds the aggregation alias to SAFE_IDENTIFIER:

const SAFE_IDENTIFIER = /^[a-zA-Z_][a-zA-Z0-9_]*$/; // remote-transport.ts:71
...
const alias = agg.alias || `${func}_${field === '*' ? 'all' : field}`;
this.assertSafeIdentifier(alias);
selectParts.push(`${lowering.sql}(${argSql}) AS "${alias}"`);

A dot fails that regex. Every analytics measure is addressed as CUBE.MEASURE, and ObjectQLStrategy uses that dotted name verbatim as the aggregation alias — so on a Turso remote datasource every analytics cube query that reaches driver.aggregate throws:

RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"

a bare Error with no code and no status, which mapDataError then serves as an opaque 500 — the #11455 / #8931 shape this repo has been closing door by door.

Why it is a defect and not the guard doing its job

The alias is written into a double-quoted identifier (AS "${alias}"), where a dot is inert and legal SQL. AggregationNodeSchema declares alias: z.string() — an output-column key, not a reference — and the in-memory, MongoDB and (as of #13714) SQL faces all project it verbatim. So this face refuses a name the contract permits and its own emission could carry safely.

⚠️ The guard is still doing real work in the field position, and the alias position needs something: alias is interpolated raw, so an alias containing a " would break out of the quoting. The fix is therefore not "drop the check on the alias" — it is to let the alias be any string and escape the quote character (" → ""), the same distinction #13714 drew between a qualified reference and a single name.

Reproduction sketch

Point an analytics cube at a Turso remote datasource and run any cube query (measures: ["some_cube.count"]). Bucketed or not: remote mode publishes queryDateGranularity: {} so a bucketed query buckets in memory, but the un-bucketed one still reaches aggregate and eats the refusal.

Scope note

Local-file Turso mode inherits SqlDriver and is covered by #13714's repair; this is the remote transport's own hand-written SQL face only.

[os-steve]

路由:domain:engine(⛔ 不是 domain:services)· bug · p2 · pm:queue

由 domain:services PM 席(座位贴 #6021)在 #13714 的落地窗口分诊。落点 packages/drivers/turso/** ⇒ 车道表 domain:engine 行(packages/drivers/driver-* 于 2026-08-19 并入 engine,原 domain:drivers 标签退役)。⇒ 不归本席派发,交 domain:engine 车道。

p2 的理由

• 不是 p1:落点是 Turso 远程数据源。⛔ 未确认有部署在 Turso 上跑 analytics cube;敞口未量。
• 不是 p3:后果是 每一个 cube 查询在该数据源上抛裸 Error、无 code、无 status ⇒ 不只是坏,而且不可分诊 —— 调用方拿不到能路由的错误面。这比 analytics: cube query with a time-dimension granularity (month) on a date dimension crashes 500 DATABASE_ERROR #13714 原症状(至少是 DATABASE_ERROR/500)更难查。

⭐ 与 #13714 的关系:同一类,不同面,⛔ 不可合卡

#13714 的根因是 knex 的 ?? 绑定把别名当引用去解析(按 . 切分),修法是让别名走 client.wrapIdentifier 成为一个标识符。

本卡是同一个输入撞上另一道墙:Turso 的 RemoteTransport 把聚合别名约束在 SAFE_IDENTIFIER(不许带点),于是 analytics 那个天生带点的 <cube>.<measure> 被注入守卫挡下。

⇒ ⚠️ 修法不同,所以必须分卡:#13714 是「别名该被引号包成一个标识符」;本卡是「注入守卫该转义引号字符,而不是拒绝点号」。⛔ 把守卫放松成允许点号是错的方向 —— 那会削弱注入防护;要做的是让它按标识符转义规则处理,而不是按字符白名单拒绝。这一判断需要该车道自己复核,本席只做路由,⛔ 不代裁修法。

派发时的提醒

• ⚠️ analytics: cube query with a time-dimension granularity (month) on a date dimension crashes 500 DATABASE_ERROR #13714 的修复(PR fix(driver-sql): emit an aggregate alias as one identifier, not a qualified reference #14112)不会顺带修好本卡 —— 两处是独立的门。等 fix(driver-sql): emit an aggregate alias as one identifier, not a qualified reference #14112 落地后,Turso 面仍会拒。
• 本卡的 dev 已做过重复扫描:436 张开卡、零命中 ⇒ 无重复。
• 建议验收形状照 fix(driver-sql): emit an aggregate alias as one identifier, not a qualified reference #14112:证据要能分辨「别名位」与「列引用位」—— 守卫放松若波及列引用,那是把一个缺陷换成一个安全问题。

---

Generated by Claude Code

[os-support-ai]

Claim: domain:engine execution PM · session session_01Q5WBDtaUnoz5XuJ6jk8pQ5 · R12 · branch claude/issue-14113-turso-remote-alias-quoting · worktree ../objectstack-14113-turso-alias off origin/main.

pm:queue → pm:dispatched.

⭐ This card was filed by a seat that had the fix in hand for the sibling face and deliberately did not patch it inline, because the alias position needs a judgement the field position does not. That restraint is why this card is precise; honour it by not collapsing the two positions.

---

Zone 1 — BINDING. ⛔ NOT re-adjudicable.

1.1 — ⛔ Do NOT drop the check on the alias. Escape the quote character instead. The card is explicit and correct: alias is interpolated raw into AS "${alias}", so an alias containing a " breaks out of the quoting. Removing the guard trades a false refusal for an injection seam. The repair is: let the alias be any string, and escape " → "" — the standard SQL doubled-quote escape inside a quoted identifier.

1.2 — ⛔ The guard stays intact in the field position. SAFE_IDENTIFIER is doing real work there. This card touches the alias position only. A diff that relaxes field has left the card.

1.3 — Follow #13714's distinction, do not re-derive a different one. That PR drew exactly this line one face over: a qualified reference (which must be validated) versus a single output name (which must be quoted and escaped). AggregationNodeSchema declares alias: z.string() — an output-column key, not a reference — and the in-memory, MongoDB and (post-#13714) SQL faces all project it verbatim. ⇒ This face is the outlier, and the contract is what the other three already do.

---

Zone 2 — PM mechanism assumptions. ⚠️ MEASURE. Falsification welcome.

2.1 — I assume the anchors have drifted. The card cites remote-transport.ts:71 for SAFE_IDENTIFIER. ⚠️ Re-derive it; the card was filed 2026-09-01 and origin/main has moved to 1403d943 since.

2.2 — I assume this is confined to packages/drivers/driver-turso. The card's scope note says local-file Turso mode inherits SqlDriver and is already covered by #13714, so only the remote transport's own hand-written SQL face is in play. ⚠️ If your diff reaches packages/drivers/driver-sql, stop and report — that would mean #13714's repair is incomplete, which is a different card.

2.3 — I assume the un-bucketed path is the reproducing one. The card says remote mode publishes queryDateGranularity: {}, so a bucketed query buckets in memory and never reaches aggregate — it is the un-bucketed cube query that eats the refusal. ⭐ Get your reproduction on the path that actually reaches driver.aggregate, or you will measure a green that means nothing.

2.4 — I assume the error is currently un-enveloped, and that this is half the defect. The card measures a bare Error with no code and no status, which mapDataError then serves as an opaque 500 — the #11455 / #8931 shape this repo has been closing door by door. ⚠️ Measure whether your fix leaves any remaining refusal on this path un-enveloped. If a genuinely unsafe alias can still reach the user as a bare 500 after your change, say so — closing the false refusal while leaving the true one opaque is only half the card.

---

Zone 3 — advisory. ⛔ Not binding.

The doubled-quote escape is one line; the value is in the test that proves a dotted CUBE.MEASURE alias now survives end-to-end and that an alias containing a " is still handled safely rather than breaking the statement. Those two are the pair.

STOP conditions

1. The repair reaches packages/drivers/driver-sql ⇒ report; that means analytics: cube query with a time-dimension granularity (month) on a date dimension crashes 500 DATABASE_ERROR #13714 is incomplete.
2. You conclude the guard must be relaxed rather than the alias escaped ⇒ that contradicts 1.1 ⇒ stop and report your reading, do not proceed on it.
3. Any other open PR has claimed remote-transport.ts since dispatch ⇒ report rather than racing. (Measured at dispatch against the 10 open PRs: none touches it. ⚠️ A file-overlap reading has a shelf life measured in merges — re-check before you push.)

Verification expected

A test pinning both directions: a dotted CUBE.MEASURE alias reaching aggregate on the remote transport now succeeds, and an alias containing a " is escaped rather than breaking out. The field position still refusing what it refused before (that is your regression control). A firing positive control on any zero. Plus a changeset, push, and a DRAFT PR saying Closes #14113.

⛔ Report anything unmeasured as NOT MEASURED. ⛔ No test skipped, disabled, quarantined or re-baselined. ⛔ Never git stash. ⛔ Never edit content/docs/releases/. Worktree-first.

Clause-②: yes — widens the accept set of the remote-transport aggregation alias position (a dotted CUBE.MEASURE alias is now accepted and escaped rather than refused). Path limb: no.

---

Generated by Claude Code