… 2a)

xavier loop: iteration 2 — Phase 2 dimensions + filter engine.

GROUP BY ALL for dimensions; recursive 12-operator filter engine
(equals/notEquals/in/notIn/gt/gte/lt/lte/contains/notContains/set/notSet)
with every value bound as a :f_<idx> named parameter — never interpolated.
member/dimension gated by DIMENSION_NAME_PATTERN; AND/OR composition; depth
capped at 8, enforced twice (iterative pre-Zod preCheckFilterDepth + renderer
re-check). Static (registration-free) request schema: operator enum,
per-operator value cardinality, group/values/limit caps. No name allowlist.

timeGrain application deliberately held (parsed + grammar-gated, not yet
applied) pending the grain-target decision — lands in phase 2b.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

xavier loop: iteration 2 — Phase 2 grain slice.

Resolves the grain-target gap: PR2 drops the registry that #341 used to infer
which dimension was temporal, so the grain's target is named explicitly. New
optional `timeDimension` request field; when `timeGrain` is set, that column
renders as date_trunc('<grain>', <col>) AS <col> (grain single-quoted literal
gated by TIME_GRAIN_PATTERN; column gated by DIMENSION_NAME_PATTERN — neither
can be a bind param). Other dimensions render bare. Two 400 rules in the
request schema superRefine: timeGrain without timeDimension; timeDimension not
in dimensions. Warehouse remains the authority on column temporality.

Deviates from the PRD's "date_trunc on time-typed dimensions" wording (which
presupposed the deleted registry) — the explicit-field shape is the runtime
query shape PR2 settles; PR5's hook contract inherits the timeDimension arg.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

xavier loop: iteration 3 — Phase 3, completes PR2.

Lane dispatch from the registration (metric-views.json executor), not a URL
segment: OBO-lane metrics run on-behalf-of the requesting user via asUser(req)
with a per-user cache scope; SP-lane metrics run as the app service principal
with a shared scope. Executor + key computed inside a try so a missing/
whitespace OBO identity (from asUser/resolveUserId/deriveMetricExecutorKey)
lands on the canonical 401 envelope, not an uncaught 500.

composeMetricCacheKey builds metric:{key}:{argsHash}:{executorKey} over
canonicalized args (sorted measures/dimensions, order-independent filter
fingerprint via canonicalizeFilter, grain, timeDimension, limit).
deriveMetricExecutorKey returns "sp" for SP and a sha256 of the trimmed user
identity for OBO — the raw email/principal never enters the cache layer.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

…rmat

Four defensive fixes to the PR2 metric-view runtime surfaced by adversarial
review:

- Registry lookup (B): build the registry with a null prototype and gate the
  route read with Object.hasOwn, so a metric key colliding with an inherited
  Object.prototype member (__proto__, constructor, toString, …) can no longer
  resolve to a truthy non-registration and bypass the unknown-key 404.

- Measure/dimension uniqueness (C): reject a name that repeats within measures,
  within dimensions, or across both. Measures and dimensions alias to their own
  name in the SELECT list (MEASURE(x) AS x, x), so a duplicate collapses to one
  row-object key and silently drops a value during row materialization.

- Filter sort key (D): delimit the (member, operator) sort key with "/" instead
  of a bare concatenation, so two distinct pairs cannot map to the same key and
  fork the cache on semantically equal filters. Matches the delimiter
  canonicalizeFilter already uses for its leaf fingerprint.

- Format (F): reject any format other than JSON_ARRAY (legacy aliases
  normalized first). The metric route delivers JSON rows only at v1; an Arrow
  request previously returned JSON silently instead of failing loud.

Adds 10 tests covering all four.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

The runtime, the shared schema, and the type-generator disagreed on what a
metric-view `source` FQN may contain. The shared schema and typegen accept the
full UC quoted-identifier grammar (hyphens, non-ASCII) and typegen backtick-
quotes before interpolation; the runtime used a narrower ASCII allowlist
(assertSafeFqn) AND interpolated the FQN UNQUOTED. So a documented-legal UC
name like `prod-data.analytics.revenue` passed config + type generation but
threw (or, if the pattern were widened, emitted invalid SQL) at request time.

Converge on one grammar + one escaper:

- Move `isValidFqn` (three-part UC predicate) and `quoteFqnForSql` (backtick
  escaper) into the shared zod-free leaf `metric-fqn.ts`, beside
  `UC_FQN_PATTERN`. Grammar and quoting now have a single home both the
  type-generator and the analytics runtime import. `describe.ts` and
  `config.ts` import them back; `mv-registry.test.ts` imports the escaper from
  the leaf.
- Runtime `buildMetricSql` replaces the narrow `assertSafeFqn` regex with
  `quoteSafeFqn`: validate via `isValidFqn`, then interpolate the
  `quoteFqnForSql`-escaped FQN. Quoting is the injection boundary, so the
  runtime accepts exactly what UC (and the schema, and typegen) accept.
- `UC_THREE_PART_FQN_PATTERN` stays in `metric-source.ts` so zod still emits a
  JSON-schema `pattern`; it derives from the same per-segment charset as
  `isValidFqn`, so the two shapes cannot diverge.

Also folds in cache-key hardening (in-flight): salt the metric cache key with
`source` so repointing a metric key to a different FQN cannot stale-serve, and
only salt `timeDimension` when `timeGrain` is set (it has no SQL effect
otherwise). `renderDimensionClause` re-gates the grain against
TIME_GRAIN_PATTERN at its interpolation point.

Tests: requote the ~13 emitted-FROM assertions; add regression tests that a
hyphenated FQN is accepted+quoted and that a backtick-bearing segment is
neutralized by doubling.

Co-authored-by: Isaac
Signed-off-by: Atila Fassina <atila@fassina.eu>

Signed-off-by: Atila Fassina <atila@fassina.eu>