@@ -0,0 +1,6 @@
+---
+area: webapp
+type: fix
+---
+
+Queries using `WITH <expression> AS <name>` now run instead of failing with a syntax error, and the name can be used in the rest of the query. The name can't reuse a table alias used anywhere in the query.
@@ -295,6 +295,83 @@ describe("TSQL Integration Tests", () => {
     }
   );
 
+  clickhouseTest(
+    "should not let a WITH alias replace a tenant guard in another scope",
+    async ({ clickhouseContainer }) => {
+      const client = new ClickhouseClient({
+        name: "test",
+        url: clickhouseContainer.getConnectionUrl(),
+      });
+
+      const insert = insertTaskRuns(client, { async_insert: 0 });
+
+      await insert([
+        createTaskRun({
+          run_id: "run_tenant1_a",
+          organization_id: "org_tenant1",
+          project_id: "proj_tenant1",
+          environment_id: "env_tenant1",
+        }),
+        createTaskRun({
+          run_id: "run_tenant2_a",
+          organization_id: "org_tenant2",
+          project_id: "proj_tenant2",
+          environment_id: "env_tenant2",
+        }),
+      ]);
+
+      const enforcedWhereClause = {
+        organization_id: { op: "eq" as const, value: "org_tenant1" },
+        project_id: { op: "eq" as const, value: "proj_tenant1" },
+        environment_id: { op: "eq" as const, value: "env_tenant1" },
+      };
+      const ownTenant = `JSONExtract('{"organization_id":"org_tenant1","project_id":"proj_tenant1","environment_id":"env_tenant1"}', 'Tuple(organization_id String, project_id String, environment_id String)')`;
+
+      // ClickHouse carries a WITH alias into every UNION branch, where it would replace the
+      // branch's guards, so a WITH alias may not reuse a table alias anywhere in the query.
+      for (const query of [
+        `WITH ${ownTenant} AS r SELECT run_id FROM task_runs AS q UNION ALL SELECT run_id FROM task_runs AS r`,
+        `WITH ${ownTenant} AS task_runs SELECT 'x' AS run_id UNION ALL SELECT run_id FROM task_runs`,
+        `WITH ${ownTenant} AS r SELECT run_id FROM (SELECT run_id FROM task_runs AS r)`,
+        `WITH ${ownTenant} AS task_runs SELECT run_id FROM (SELECT run_id FROM task_runs)`,
+        `WITH (SELECT ${ownTenant}) AS task_runs SELECT run_id FROM task_runs AS q WHERE run_id IN (SELECT run_id FROM task_runs)`,
+      ]) {
+        const [error, result] = await executeTSQL(client, {
+          name: "test-outer-with-shadowing",
+          query,
+          schema: z.object({ run_id: z.string() }),
+          enforcedWhereClause,
+          tableSchema: [taskRunsSchema],
+        });
+
+        expect(error?.message).toMatch(/conflicts with the table alias/);
+        expect(result).toBeNull();
+      }
+
+      const [withError, withResult] = await executeTSQL(client, {
+        name: "test-with-expression-alias",
+        query: "WITH 1 AS x SELECT x",
+        schema: z.object({ x: z.coerce.number() }),
+        enforcedWhereClause,
+        tableSchema: [taskRunsSchema],
+      });
+
+      expect(withError).toBeNull();
+      expect(withResult?.rows).toEqual([{ x: 1 }]);
+
+      const [tableError, tableResult] = await executeTSQL(client, {
+        name: "test-with-expression-alias-and-table",
+        query: "WITH 1 AS x SELECT run_id, x FROM task_runs WHERE x = 1",
+        schema: z.object({ run_id: z.string(), x: z.coerce.number() }),
+        enforcedWhereClause,
+        tableSchema: [taskRunsSchema],
+      });
+
+      expect(tableError).toBeNull();
+      expect(tableResult?.rows).toEqual([{ run_id: "run_tenant1_a", x: 1 }]);
+    }
+  );
+
   clickhouseTest(
     "should not allow cross-tenant access even with malicious WHERE",
     async ({ clickhouseContainer }) => {
 
@@ -1506,6 +1506,21 @@ describe("ClickHousePrinter", () => {
     });
   });
 
+  describe("WITH clauses", () => {
+    it("should print a column CTE as an expression alias", () => {
+      const { sql } = printQuery("WITH 1 AS x SELECT x");
+
+      expect(sql).toBe("WITH 1 AS x SELECT x LIMIT 10000");
+    });
+
+    it("should let a column CTE be selected alongside a table", () => {
+      const { sql } = printQuery("WITH 1 AS x SELECT id, x FROM task_runs WHERE x = 1");
+
+      expect(sql).toMatch(/^WITH 1 AS x SELECT id, x FROM /);
+      expect(sql).toContain("equals(x, 1)");
+    });
+  });
+
   describe("UNION queries", () => {
     it("should print UNION ALL", () => {
       const { sql } = printQuery(`
@@ -3000,6 +3015,25 @@ describe("Unknown column blocking", () => {
       }).toThrow(QueryError);
     });
 
+    it("should resolve WITH expression aliases against the table schema", () => {
+      const schema = createSchemaRegistry([runsSchema]);
+      const ctx = createPrinterContext({
+        schema,
+        enforcedWhereClause: {
+          organization_id: { op: "eq", value: "org_test" },
+          project_id: { op: "eq", value: "proj_test" },
+          environment_id: { op: "eq", value: "env_test" },
+        },
+      });
+
+      expect(() => {
+        printQuery("WITH created_at AS x SELECT x FROM runs", ctx);
+      }).toThrow(QueryError);
+      expect(printQuery("WITH created AS x SELECT x FROM runs", ctx).sql).toMatch(
+        /^WITH created_at AS x SELECT x FROM /
+      );
+    });
+
     it("should suggest TSQL column name when user types ClickHouse column name", () => {
       // The schema exposes 'created' but the internal ClickHouse column is 'created_at'
       // When user types 'created_at', we should suggest 'created'
@@ -3305,6 +3339,13 @@ describe("Internal-only column blocking", () => {
       }).toThrow(/not available for querying/i);
     });
 
+    it("should throw error when a WITH alias reads a hidden tenant column", () => {
+      const ctx = createHiddenTenantContext();
+      expect(() => {
+        printQuery("WITH organization_id AS x SELECT id, x FROM hidden_tenant_runs", ctx);
+      }).toThrow(/not available for querying/i);
+    });
+
     it("should throw error when selecting hidden tenant column (project_id)", () => {
       const ctx = createHiddenTenantContext();
       expect(() => {
 
@@ -156,6 +156,7 @@ export class ClickHousePrinter {
   print(node: SelectQuery | SelectSetQuery): PrintResult {
     this.outputColumns = [];
     this.hiddenColumns = [];
+    this.validateColumnCtesDoNotShadowTables(node);
     const sql = this.visit(node);
     const result: PrintResult = {
       sql,
@@ -359,11 +360,16 @@ export class ClickHousePrinter {
     // Build WHERE clause starting with any existing where
     let where: Expression | undefined = node.where;
 
-    // Process CTEs
-    const cteStrings: string[] = [];
+    // Process subquery CTEs; column CTEs are printed after the joins below
+    const printedCtes = new Map<string, string>();
     if (node.ctes) {
       for (const [name, cte] of Object.entries(node.ctes)) {
-        cteStrings.push(`${this.printIdentifier(name)} AS (${this.visit(cte.expr)})`);
+        printedCtes.set(
+          name,
+          cte.cte_type === "column"
+            ? ""
+            : `${this.printIdentifier(name)} AS (${this.visit(cte.expr)})`
+        );
       }
     }
 
@@ -403,6 +409,21 @@ export class ClickHousePrinter {
       }
     }
 
+    // Process column CTEs after the joins so they resolve fields against this scope's tables,
+    // with the same internal-only column rules as SELECT
+    if (node.ctes) {
+      for (const cte of Object.values(node.ctes)) {
+        if (cte.cte_type === "column") this.selectAliases.set(cte.name.toLowerCase(), cte.name);
+      }
+      for (const [name, cte] of Object.entries(node.ctes)) {
+        if (cte.cte_type !== "column") continue;
+        this.inProjectionContext = true;
+        printedCtes.set(name, `${this.visit(cte.expr)} AS ${this.printIdentifier(name)}`);
+        this.inProjectionContext = false;
+      }
+    }
+    const cteStrings = [...printedCtes.values()];
+
     // Track if query has GROUP BY for JSON subfield type hint decisions
     // (ClickHouse requires .:String for Dynamic types in GROUP BY, and SELECT must match)
     const savedQueryHasGroupBy = this.queryHasGroupBy;
@@ -1954,6 +1975,52 @@ export class ClickHousePrinter {
     }
   }
 
+  /**
+   * Reject a column CTE (`WITH expr AS name`) whose name, or dotted prefix, matches a table
+   * alias anywhere in the query. ClickHouse carries a WITH alias into every branch of a UNION,
+   * where it would replace that branch's tenant guards, so a per-scope check is not enough.
+   */
+  private validateColumnCtesDoNotShadowTables(root: SelectQuery | SelectSetQuery): void {
+    const tableAliases = new Map<string, string>();
+    const cteNames: string[] = [];
+    const seen = new WeakSet<object>();
+    const walk = (expr: unknown): void => {
+      if (expr === null || typeof expr !== "object" || seen.has(expr)) return;
+      seen.add(expr);
+      if (Array.isArray(expr)) {
+        for (const item of expr) walk(item);
+        return;
+      }
+      const candidate = expr as Partial<JoinExpr> & Partial<CTE> & { expression_type?: string };
+      if (candidate.expression_type === "join_expr") {
+        const table = candidate.table as Field | undefined;
+        if (table?.expression_type === "field" && typeof table.chain[0] === "string") {
+          const alias = candidate.alias || table.chain[0];
+          tableAliases.set(alias.toLowerCase(), alias);
+        }
+      } else if (candidate.expression_type === "cte" && candidate.cte_type === "column") {
+        if (typeof candidate.name === "string") cteNames.push(candidate.name);
+      }
+      for (const [property, value] of Object.entries(expr)) {
+        if (property === "type" || property === "parent") continue;
+        walk(value);
+      }
+    };
+    walk(root);
+
+    for (const name of cteNames) {
+      const lowerName = name.toLowerCase();
+      for (const [lowerTableAlias, original] of tableAliases) {
+        if (lowerName === lowerTableAlias || lowerName.startsWith(`${lowerTableAlias}.`)) {
+          throw new QueryError(
+            `Alias '${name}' conflicts with the table alias '${original}'. ` +
+              `Choose a different alias.`
+          );
+        }
+      }
+    }
+  }
+
   private findShadowingAlias(
     expr: unknown,
     tableAliases: Map<string, string>,
 
@@ -233,6 +233,22 @@ describe("Cross-Tenant Security", () => {
         "a joined table's alias",
         `SELECT r.id, ${ownTenant} AS e FROM task_runs AS r JOIN task_events AS e ON r.id = e.run_id`,
       ],
+      [
+        "a WITH alias carried into a UNION branch",
+        `WITH ${ownTenant} AS r SELECT id FROM task_runs AS q UNION ALL SELECT id FROM task_runs AS r`,
+      ],
+      [
+        "a WITH alias carried into a UNION branch's implicit table alias",
+        `WITH ${ownTenant} AS task_runs SELECT 'x' AS id UNION ALL SELECT id FROM task_runs`,
+      ],
+      [
+        "a WITH alias around a FROM subquery",
+        `WITH ${ownTenant} AS r SELECT id FROM (SELECT id FROM task_runs AS r)`,
+      ],
+      [
+        "a dotted WITH alias around an IN subquery",
+        "WITH 'org_tenant1' AS `task_runs.organization_id` SELECT 1 AS x WHERE 1 IN (SELECT 1 FROM task_runs)",
+      ],
     ])("should reject %s", (_, query) => {
       expect(() => compile(query)).toThrow(/conflicts with the table alias/);
     });