fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});

.changeset/turso-remote-aggregation-alias-escaped.md

@@ -0,0 +1,36 @@
+---
+"@objectstack/driver-turso": patch
+---
+
+fix(driver-turso): escape the aggregation alias instead of gating it, so remote-mode analytics cube queries stop 500ing (#14113)
+
+`RemoteTransport.aggregate` (Turso **remote** mode) held the aggregation
+`alias` to `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that
+regex. Every analytics measure is named `<cube>.<measure>` on the wire and
+`ObjectQLStrategy` uses that name verbatim as the aggregation `alias`, so
+**every** cube query that reached this face threw
+`RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"` — a
+bare `Error` with no `code` and no `status`, which `mapDataError` then served
+as an opaque 500 for a query that is spelled correctly.
+
+The alias is now **escaped rather than gated**: it may be any string, and the
+quote character is doubled (`"` → `""`), the standard escape inside a quoted
+SQL identifier. This is the ALIAS half of the distinction `driver-sql` drew at
+**#13714**, where the same position routes through knex's `wrapIdentifier`
+(`SqlDriver.aliasIdentifierSql`) — a qualified **reference** must be
+validated, a single output **name** must be quoted and escaped.
+`AggregationNodeSchema` declares `alias: z.string()`, an output-column key,
+and the in-memory, MongoDB and (post-#13714) SQL faces all project it
+verbatim; this face was the outlier.
+
+⛔ **Not** "drop the check". The alias reaches the statement raw inside
+`AS "…"`, so an alias containing a `"` would close the quoting and continue as
+grammar. `bucket"; DROP TABLE deal; --` now compiles to the single inert
+column name `"bucket""; DROP TABLE deal; --"` and is returned as a column
+name, executed against a real SQLite-backed client rather than asserted as a
+string — the only instrument that tells "escaped" apart from "broke out".
+
+The `field` and `object` positions keep `assertSafeIdentifier` unchanged: those
+become column and table **references**, which are grammar. Default aliases are
+byte-identical (`count_all` still spells itself the same way), and the
+`groupBy` alias position is untouched by this change.

packages/drivers/driver-turso/src/remote-transport-aggregation-alias-quoting.test.ts

@@ -0,0 +1,295 @@
+// Copyright (c) 2026 ObjectStack. Licensed under the Apache-2.0 license.
+
+/**
+ * [#14113] The aggregation ALIAS is escaped, not gated — TursoDriver's REMOTE
+ * transport.
+ *
+ * ## The defect
+ *
+ * `RemoteTransport.aggregate` held the aggregation `alias` to
+ * `SAFE_IDENTIFIER` (`/^[a-zA-Z_][a-zA-Z0-9_]*$/`). A dot fails that regex.
+ * Every analytics measure is named `<cube>.<measure>` on the wire and
+ * `ObjectQLStrategy` uses that name verbatim as the aggregation `alias`
+ * (`objectql-strategy.ts`, `{ field, method, alias: measure }`), so EVERY cube
+ * query that reached this face threw:
+ *
+ * ```
+ * RemoteTransport: unsafe identifier rejected: "showcase_delivery.count"
+ * ```
+ *
+ * a bare `Error` with no `code` and no `status`, which `mapDataError` then
+ * serves as an opaque 500 — the #11455 / #8931 shape.
+ *
+ * ## Why the fix is escaping and NOT dropping the check
+ *
+ * The alias is interpolated RAW into `AS "${alias}"`, so an alias containing a
+ * `"` would close the quoting and continue as grammar. The repair is the
+ * standard doubled-quote escape inside a quoted SQL identifier (`"` → `""`) —
+ * the ALIAS half of the distinction #13714 drew one face over, where
+ * `SqlDriver.aliasIdentifierSql` routes the same position through knex's
+ * `wrapIdentifier`. A qualified REFERENCE must be validated; a single output
+ * NAME must be quoted and escaped. `AggregationNodeSchema` declares
+ * `alias: z.string()` — an output-column key — and the in-memory, MongoDB and
+ * (post-#13714) SQL faces all project it verbatim. This face was the outlier.
+ *
+ * ## Why a SQLite-backed client stub rather than a mocked `execute`
+ *
+ * Only EXECUTING the statement tells "escaped" apart from "broke out". A
+ * string assertion alone would pass on an alias that terminates the quoting,
+ * because the text still *looks* like a select list. libsql IS SQLite, so
+ * `makeLibsqlSqliteStub` runs what this transport emits: an alias that escaped
+ * its quoting is a syntax error (or a second statement better-sqlite3 refuses
+ * to prepare), and a green read of the value back under the literal alias is
+ * the proof. The emitted SQL is pinned too, so a future reader can see the
+ * doubled quote rather than infer it.
+ *
+ * ## Reverse verification — direction predicted BEFORE it was run
+ *
+ * Restore `this.assertSafeIdentifier(alias)` above the `selectParts.push` and
+ * emit `AS "${alias}"` again (the pre-#14113 two lines):
+ *
+ * - the dotted-alias cases (repro, emitted SQL, the un-bucketed cube shape)
+ * go RED by THROWING inside the call — `unsafe identifier rejected:
+ * "showcase_delivery.count"` — not on a comparison.
+ * - the quote-escape cases go RED by throwing the same sentence, naming
+ * `won"count` / the `DROP TABLE` text. They cannot go red on a broken-out
+ * statement, because the restored guard refuses that input before any SQL is
+ * built — which is exactly why the guard could not simply be deleted.
+ * - the `field`-position control and the groupBy-alias control stay GREEN:
+ * neither position is touched by this card, and that is what they are here
+ * to hold.
+ * - the default-alias case stays GREEN: `count_all` passes `SAFE_IDENTIFIER`
+ * either way, so it pins the byte-identical emission across the change.
+ *
+ * Measured after writing the above — see the PR body for the run.
+ */
+
+import { describe, it, expect, beforeAll, afterAll } from 'vitest';
+import { TursoDriver } from './turso-driver.js';
+import { makeLibsqlSqliteStub, asLibsqlClient, type LibsqlSqliteStub } from './libsql-sqlite-stub.testkit.js';
+
+/**
+ * Named for the cube in the field report the card was filed from, so the alias
+ * under test (`showcase_delivery.count`) is the real wire spelling rather than
+ * a stand-in.
+ */
+const DELIVERY_OBJECT = {
+ name: 'showcase_delivery',
+ fields: {
+ id: { type: 'string' },
+ region: { type: 'string' },
+ amount: { type: 'number' },
+ },
+};
+
+const ROWS = [
+ { id: '1', region: 'west', amount: 10 },
+ { id: '2', region: 'west', amount: 20 },
+ { id: '3', region: 'east', amount: 30 },
+];
+
+describe('[#14113] RemoteTransport — the aggregation alias is escaped, not gated', () => {
+ let driver: TursoDriver;
+ let stub: LibsqlSqliteStub;
+
+ beforeAll(async () => {
+ stub = makeLibsqlSqliteStub();
+ driver = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(stub) });
+ await driver.connect();
+ // The mode this suite is about — the one with its own hand-written SQL.
+ expect(driver.transportMode).toBe('remote');
+ await driver.syncSchema(DELIVERY_OBJECT.name, DELIVERY_OBJECT);
+ for (const row of ROWS) await driver.create(DELIVERY_OBJECT.name, { ...row });
+ });
+
+ afterAll(async () => {
+ await driver.disconnect();
+ stub.close();
+ });
+
+ /**
+ * A transport backed by the same database, capturing the statements it sends
+ * AND executing them — the capture alone would not prove the statement runs.
+ */
+ const capturing = async () => {
+ const seen: string[] = [];
+ const spy = {
+ ...stub,
+ execute: async (stmt: unknown) => {
+ seen.push((stmt as { sql: string }).sql);
+ return stub.execute(stmt);
+ },
+ };
+ const t = new TursoDriver({ url: 'libsql://alias-quoting.turso.io', client: asLibsqlClient(spy) });
+ await t.connect();
+ return { t, seen };
+ };
+
+ describe('direction 1 — a dotted `CUBE.MEASURE` alias now reaches the database', () => {
+ it('the exact alias the card measured is served, on rows', async () => {
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ // The value comes back under the caller's own key — a dot is inert
+ // inside a quoted identifier, which is the whole claim of this card.
+ expect(rows).toHaveLength(1);
+ expect((rows as Array<Record<string, unknown>>)[0]['showcase_delivery.count']).toBe(3);
+ });
+
+ it('compiles to ONE quoted identifier, dot and all', async () => {
+ const { t, seen } = await capturing();
+ await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "showcase_delivery.count" FROM "showcase_delivery"',
+ ]);
+ // ⛔ Not two segments. The failure this replaces is a face that treats an
+ // alias as a qualified reference; the dot must stay INSIDE the quotes.
+ expect(seen[0]).not.toContain('"showcase_delivery"."count"');
+ });
+
+ it('the un-bucketed cube shape — a grouped measure — is served end to end', async () => {
+ // The path that actually reaches `driver.aggregate`: remote mode
+ // publishes `queryDateGranularity: {}` (see `TursoDriver.supports`), so a
+ // BUCKETED query falls back to `find()` + in-memory bucketing and never
+ // arrives here. The UN-bucketed cube query is the one that ate the
+ // refusal, and it carries a dimension in `groupBy` beside the measure.
+ //
+ // ⭐ The groupBy FIELD is a bare column name here, not a dotted one, and
+ // that is measured rather than assumed: `ObjectQLStrategy.resolveFieldName`
+ // resolves a dimension to `member.sql` or `member.split('.')[1]`, so only
+ // the MEASURE arrives dotted. That asymmetry is why this card is confined
+ // to the alias position of `aggregations`.
+ const rows = await driver.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: ['region'],
+ aggregations: [
+ { function: 'count', alias: 'showcase_delivery.count' },
+ { function: 'sum', field: 'amount', alias: 'showcase_delivery.total_amount' },
+ ],
+ } as never);
+ const byRegion = Object.fromEntries(
+ (rows as Array<Record<string, unknown>>).map((r) => [
+ r.region,
+ [r['showcase_delivery.count'], r['showcase_delivery.total_amount']],
+ ]),
+ );
+ expect(byRegion).toEqual({ west: [2, 30], east: [1, 30] });
+ });
+ });
+
+ describe('direction 2 — an alias carrying a `"` is ESCAPED, not let through', () => {
+ it('doubles the quote and still runs, returning the value under the literal alias', async () => {
+ const alias = 'won"count';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "won""count" FROM "showcase_delivery"']);
+ // Executed, not merely emitted: an alias that broke out of its quoting
+ // would be a syntax error here rather than a row.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ });
+
+ it('an alias that tries to close the quoting and append a statement stays one name', async () => {
+ const alias = 'bucket"; DROP TABLE showcase_delivery; --';
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count', alias }],
+ } as never);
+ expect(seen).toEqual([
+ 'SELECT count(*) AS "bucket""; DROP TABLE showcase_delivery; --" FROM "showcase_delivery"',
+ ]);
+ // The whole payload came back as a COLUMN NAME — it was data, never
+ // grammar.
+ expect((rows as Array<Record<string, unknown>>)[0][alias]).toBe(3);
+ // And the table it named is still there, with every row.
+ expect(
+ stub.raw.prepare('select count(*) as c from showcase_delivery').all(),
+ ).toEqual([{ c: 3 }]);
+ });
+ });
+
+ describe('regression controls — the positions this card did NOT touch', () => {
+ it('the `field` position still refuses an unsafe identifier, and sends nothing', async () => {
+ // `SAFE_IDENTIFIER` is doing real work here: `field` becomes a column
+ // REFERENCE, which is grammar. Escaping is the answer for a NAME only.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'sum', field: 'amount"; DROP TABLE showcase_delivery; --', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe field'); },
+ (e) => e as Error,
+ );
+ // The OFFENDING TEXT, not just the sentence (#6144) — an alias that is
+ // itself safe is what makes this case reach the `field` check at all.
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('amount"; DROP TABLE showcase_delivery; --');
+ expect(seen).toEqual([]);
+ });
+
+ it('the `object` position still refuses an unsafe identifier', async () => {
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate('showcase_delivery"; DROP TABLE showcase_delivery; --', {
+ object: 'showcase_delivery"; DROP TABLE showcase_delivery; --',
+ aggregations: [{ function: 'count', alias: 'n' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the transport to refuse an unsafe object') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(seen).toEqual([]);
+ });
+
+ it('the groupBy alias position is UNCHANGED — still refused, and that is a separate card', async () => {
+ // ⚠️ Deliberate scope line, pinned so it cannot drift silently. The
+ // groupBy `alias` is the same class of thing (an output NAME) and
+ // `driver-sql` escapes it post-#13714 (`aliasIdentifierSql` at its
+ // groupBy select site), so this face diverges there too — but that
+ // position carries a LANDED pin (#6401, `remote-transport-groupby-node`)
+ // asserting the refusal, so reversing it is a judgement this card was not
+ // dispatched to make. Filed separately rather than patched inline; this
+ // control records the state it was left in.
+ //
+ // It is also NOT on the reproducing path: `ObjectQLStrategy` resolves a
+ // dimension to a bare column name, so no analytics query sends a dotted
+ // groupBy alias.
+ const { t, seen } = await capturing();
+ const err = await t
+ .aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ groupBy: [{ field: 'region', alias: 'showcase_delivery.region' }],
+ aggregations: [{ function: 'count', alias: 'showcase_delivery.count' }],
+ } as never)
+ .then(
+ () => { throw new Error('expected the groupBy alias to still be refused') },
+ (e) => e as Error,
+ );
+ expect(err.message).toContain('unsafe identifier rejected');
+ expect(err.message).toContain('showcase_delivery.region');
+ expect(seen).toEqual([]);
+ });
+
+ it('the default alias is byte-identical to what it was before', async () => {
+ // A caller who omits `alias` reads the result under `count_all` exactly
+ // as they did pre-#14113 — this change moves no default.
+ const { t, seen } = await capturing();
+ const rows = await t.aggregate(DELIVERY_OBJECT.name, {
+ object: DELIVERY_OBJECT.name,
+ aggregations: [{ function: 'count' }],
+ } as never);
+ expect(seen).toEqual(['SELECT count(*) AS "count_all" FROM "showcase_delivery"']);
+ expect((rows as Array<Record<string, unknown>>)[0].count_all).toBe(3);
+ });
+ });
+});