drivers(turso): RemoteTransport still refuses a dotted groupBy alias while driver-sql escapes it — the second output-name position #14113 deliberately left alone

[claude]

Filed from #14113 (aggregation-alias escaping on the Turso remote transport). Same defect class, the other output-name position in the same method, not fixed by that card — it carries a landed pin asserting the current behaviour, so reversing it needs its own judgement rather than a rider.

What

RemoteTransport.aggregate (packages/drivers/driver-turso/src/remote-transport.ts) has exactly two positions that emit a caller-supplied output NAME:

selectParts.push(outKey === field ? `"${field}"` : `"${field}" AS "${outKey}"`); // groupBy alias
selectParts.push(`${lowering.sql}(${argSql}) AS ${this.aliasIdentifierSql(alias)}`); // aggregation alias

#14113 moved the aggregation alias to escaping (quote doubled, assertSafeIdentifier dropped from that position only). The groupBy alias (outKey, which is g.alias ?? g.field) still goes through assertSafeIdentifier, so any groupBy alias that is not a bare [A-Za-z_][A-Za-z0-9_]* is refused with a bare Error — no code, no status, an opaque 500 out of mapDataError.

Why it is a divergence

driver-sql post-#13714 routes both positions through SqlDriver.aliasIdentifierSql:

• sql-driver.ts groupBy select site — ?? as ${this.aliasIdentifierSql(outKey)}
• sql-driver.ts aggregation select sites — ${lowering.sql}(*) as ${this.aliasIdentifierSql(agg.alias)}
• and the window-function alias site

So after #14113 the Turso remote face agrees with the SQL face on the aggregation alias and still disagrees on the groupBy alias. GroupByNodeSchema.alias is an output-column key, the same class of thing as AggregationNodeSchema.alias, and the in-memory path projects g.alias ?? g.field verbatim.

Why it was NOT patched inline under #14113

The position carries a landed pin that asserts the refusal:

packages/drivers/driver-turso/src/remote-transport-groupby-node.test.ts — [#6401] refuses an unsafe identifier in \alias`, not only in `field`, asserting unsafe identifier rejected` and the offending text.

That pin was a deliberate call at #6401, when the alias was newly read here. Reversing it is a judgement about the same reference-versus-name line #13714 and #14113 drew, not a mechanical edit, so it is filed rather than folded into a card dispatched for the aggregation position. #14113 leaves a regression control pinning this position's current behaviour, so the state cannot drift silently while this card is open.

Exposure

⚠️ Lower than #14113's, and measured rather than assumed: no analytics query sends a dotted groupBy alias. ObjectQLStrategy.resolveFieldName resolves a dimension to member.sql or member.split('.')[1], so dimensions reach the driver as bare column names; only the measure arrives as CUBE.MEASURE. The reachable population is a caller writing groupBy: [{ field: 'region', alias: 'Region Name' }] through the Query Protocol directly, which works on the in-memory, MongoDB and SQL faces and is an opaque 500 on Turso remote.

Acceptance

Either escape the groupBy alias the way #14113 escaped the aggregation alias (and rewrite the #6401 pin to assert the new truth, as #14113 did not have to), or rule that this position stays gated and record why the two output-name positions differ. Either way the two faces should stop disagreeing silently.

---

Generated by Claude Code

[huangyiirene]

Triage (R+89, triage seat, session session_019kDRpB7D2XzVzkaLp57T5D): pm:queue · priority:p3 · domain:engine · type Bug.

The judgement the card asks for is inherited, not re-opened: #13714 (driver-sql routes both output-name positions through aliasIdentifierSql) and #14113 (the Turso aggregation alias moved to escaping) drew the reference-versus-name line — an output-column key is a name and is escaped, never gated. The groupBy alias is the same class of thing (GroupByNodeSchema.alias, projected verbatim on the in-memory face), so the Turso remote face escapes it the same way. Lands in: packages/drivers/driver-turso/src/remote-transport.ts aggregate's groupBy select site, plus the #6401 pin in remote-transport-groupby-node.test.ts rewritten to assert the new truth (a dotted alias round-trips; a genuinely unsafe field still refuses) — the pin was the deliberate call at the time, and reversing it under the later rulings is exactly the recorded, non-silent reversal the card wants. Not clause ②: one face is brought to the behaviour the other three already implement (declared = enforced restored), no accept set moves at the contract. The remaining refusal positions' envelope is #14287's ruling (INVALID_REQUEST / 400), ⛔ not re-decided here. p3: measured unreachable from the analytics path; reachable only through the Query Protocol directly.

Size/model suggestion: S, opus.

---

Generated by Claude Code

[os-musk]

Claim: PM loop round R13 (domain:engine execution seat, wave 4) — the second output-name position of RemoteTransport.aggregate, brought to the reference-versus-name line #13714 / #14113 drew (triage 5503136041: the judgement is inherited, not re-opened)
Session: session_0112hMx9hjJ9BgB28X97DS68
Branch: claude/issue-14235-turso-groupby-alias-escape
Worktree: objectstack-issue-14235
Domain: domain:engine
File surface: packages/drivers/driver-turso/src/remote-transport.ts — aggregate's groupBy select site (the assertSafeIdentifier(outKey) at ~:1376 and the "${field}" AS "${outKey}" emission) moves to this.aliasIdentifierSql(outKey), exactly as the aggregation alias at ~:1452 already does; the field position keeps assertSafeIdentifier (a reference, not a name); packages/drivers/driver-turso/src/remote-transport-groupby-node.test.ts — the #6401 pin refuses an unsafe identifier in alias, not only in field (:221) is REWRITTEN to assert the new truth (a dotted / spaced alias round-trips as a quoted output column; a genuinely unsafe field still refuses with #14287's INVALID_REQUEST / 400 envelope), plus a positive case that the alias reaches the wire quote-doubled; changeset @objectstack/driver-turso patch. ⛔ driver-sql's aliasIdentifierSql is the template, read-only; ⛔ the remaining refusal positions' envelope is #14287's ruling, not re-decided.
Container & model: S, mode:subagent, model: opus — --tier: no path-derived mandate.
Clause-②: no, per triage — one driver face is brought to the behaviour the other three faces already implement (declared = enforced restored at the driver); no accept set moves at the contract (GroupByNodeSchema.alias is already an output-column key the spec admits). The dev re-reads this on the diff; if the published @objectstack/driver-turso accept set widening is judged a contract move, it reports rather than proceeds.
Serial constraints cleared: no claude/issue-14235* branch on origin at 07:24Z; none of the 24 open PRs listed at 07:23Z touches packages/drivers/driver-turso/** (PR #14396 for #14287 landed as 8eeca27db); the seat post's hot-file queue has no entry on remote-transport.ts.

---

Generated by Claude Code