feat: disallow using source-based fields with aggregate functions

[YoEight]

Summary

This feature adds comprehensive compile-time validation rules for aggregate functions (SUM, COUNT, AVG, UNIQUE, etc.) in EventQL queries. The static analyzer now enforces strict semantic constraints to ensure aggregate functions are used correctly and prevent queries that would produce ambiguous or undefined results.

Validation Rules

The feature implements three key validation rules:

1. Aggregate Functions Must Only Appear in PROJECT INTO Clauses

Aggregate functions can only be used within the PROJECT INTO clause. They are prohibited in:

• WHERE predicates
• GROUP BY expressions
• ORDER BY expressions

Rationale: Aggregate functions compute values across groups of events and only make semantic sense when projecting aggregated results.

Example - Invalid:

FROM e IN events
WHERE 3 > COUNT()  // Error: WrongAggFunUsage
PROJECT INTO e

Example - Valid:

FROM e IN events
PROJECT INTO { total: COUNT() }

2. Aggregate Functions Cannot Be Mixed with Source-Bound Fields

Within a single PROJECT INTO clause, you cannot mix aggregate functions with fields that reference individual source events.

Rationale: Aggregate functions operate at the group level (producing one value per group), while source-bound fields operate at the individual event level (producing one value per event). These two cardinalities cannot be reconciled in a single projection.

Example - Invalid:

FROM e IN events
PROJECT INTO {
    count: SUM(e.data.price),  // Aggregate: group-level
    id: e.id                    // Source field: event-level
}
// Error: UnallowedAggFuncUsageWithSrcField

Example - Valid:

FROM e IN events
PROJECT INTO {
    sum: SUM(e.data.count),
    label: "everything summed",  // Constant: OK
    randomvalue: RAND()          // Non-aggregate function: OK
}

3. Aggregate Function Arguments Must Be Source-Bound Fields

Arguments passed to aggregate functions must be fields derived from the source events being queried. They cannot be:

• Literal values (numbers, strings, booleans)
• Results from other function calls
• Constants

Rationale: Aggregate functions are designed to compute over event properties across multiple events. Passing constants or function results would produce meaningless aggregations.

Example - Invalid:

FROM e IN events
PROJECT INTO { sum: SUM(RAND()) }
// Error: ExpectSourceBoundProperty

Example - Valid:

FROM e IN events
PROJECT INTO { sum: SUM(e.data.price) }