@open-mercato/shared 0.6.7-develop.6597.1.b8f069b7fe → 0.6.7-develop.6603.1.78e5b7a65d

package/dist/lib/crud/ids.js

@@ -38,8 +38,16 @@ function parseIdsParam(raw, maxIds = MAX_IDS_PER_REQUEST) {
   const parsed = normalizeIdList(raw.split(","));
   return parsed.slice(0, safeMax);
 }
-function mergeIdFilter(existingFilters, parsedIds) {
-  if (parsedIds.length === 0) return existingFilters;
+function isIdsParamProvided(raw) {
+  return typeof raw === "string" && raw.trim().length > 0;
+}
+function mergeIdFilter(existingFilters, parsedIds, options) {
+  if (parsedIds.length === 0) {
+    if (options?.idsParamProvided) {
+      return { ...existingFilters, id: { $in: [] } };
+    }
+    return existingFilters;
+  }
   const existingFilter = existingFilters.id;
   const existingIds = readExistingIds(existingFilter);
   if (!existingIds) {
@@ -57,6 +65,7 @@ function mergeIdFilter(existingFilters, parsedIds) {
 }
 export {
   MAX_IDS_PER_REQUEST,
+  isIdsParamProvided,
   mergeIdFilter,
   parseIdsParam
 };

package/dist/lib/crud/ids.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/ids.ts"],
-  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  if (typeof raw !== 'string' || raw.trim().length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(raw.split(','))\n  return parsed.slice(0, safeMax)\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n): Where<Fields> {\n  if (parsedIds.length === 0) return existingFilters\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
-  "mappings": "AAEO,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,IAAI,MAAM,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AAEO,SAAS,cACd,iBACA,WACe;AACf,MAAI,UAAU,WAAW,EAAG,QAAO;AAEnC,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  if (typeof raw !== 'string' || raw.trim().length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(raw.split(','))\n  return parsed.slice(0, safeMax)\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string), regardless\n * of whether any value survived UUID validation. Lets a caller tell \"no ids\n * filter requested\" apart from \"ids filter requested but every value was\n * malformed\" \u2014 the latter must match nothing, not fall back to the full list\n * (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  return typeof raw === 'string' && raw.trim().length > 0\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
+  "mappings": "AAEO,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,IAAI,MAAM,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AASO,SAAS,mBAAmB,KAAuB;AACxD,SAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS;AACxD;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.6.7-develop.6597.1.b8f069b7fe";
+const APP_VERSION = "0.6.7-develop.6603.1.78e5b7a65d";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6597.1.b8f069b7fe'\nexport const appVersion = APP_VERSION\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.6.7-develop.6603.1.78e5b7a65d'\nexport const appVersion = APP_VERSION\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.6.7-develop.6597.1.b8f069b7fe",
+  "version": "0.6.7-develop.6603.1.78e5b7a65d",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -97,7 +97,7 @@
     "@mikro-orm/core": "^7.1.5",
     "@mikro-orm/decorators": "^7.1.5",
     "@mikro-orm/postgresql": "^7.1.5",
-    "@open-mercato/cache": "0.6.7-develop.6597.1.b8f069b7fe",
+    "@open-mercato/cache": "0.6.7-develop.6603.1.78e5b7a65d",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",
     "pino": "^10.3.1",

package/src/lib/bootstrap/__tests__/dynamicLoader.commandInterceptors.test.ts

@@ -0,0 +1,76 @@
+/**
+ * @jest-environment node
+ *
+ * Regression guard for #4327: the CLI/queue-worker bootstrap path
+ * (loadBootstrapData) must load command-interceptors.generated.ts and expose
+ * `commandInterceptorEntries` in its BootstrapData. The interceptor registry is
+ * per-process, so a worker that omits the field silently no-ops every command
+ * interceptor while the Next.js runtime applies them — split behavior between
+ * web and queued execution of the same command.
+ *
+ * The test authors both the generated .ts sources and fresh compiled .mjs
+ * siblings, so compileAndImport takes its cache path and never invokes esbuild.
+ * The .mjs stubs use module.exports because Jest's CJS runtime handles the
+ * dynamic import() and does not transform .mjs files; the loader consumes the
+ * named exports identically either way.
+ */
+import fs from 'node:fs'
+import os from 'node:os'
+import path from 'node:path'
+import { loadBootstrapData } from '../dynamicLoader'
+
+const GENERATED_MODULES: Record<string, { ts: string; compiled: string }> = {
+  'entities.ids.generated': { ts: 'export const E = {}', compiled: 'module.exports = { E: {} }' },
+  'modules.cli.generated': { ts: 'export const modules = []', compiled: 'module.exports = { modules: [] }' },
+  'entities.generated': { ts: 'export const entities = []', compiled: 'module.exports = { entities: [] }' },
+  'di.generated': { ts: 'export const diRegistrars = []', compiled: 'module.exports = { diRegistrars: [] }' },
+  'command-interceptors.generated': {
+    ts: 'export const commandInterceptorEntries = []',
+    compiled: `module.exports = { commandInterceptorEntries: [
+      { moduleId: 'example', interceptors: [{ id: 'example.adjust-probability' }] },
+    ] }`,
+  },
+}
+
+function writeGeneratedModule(generatedDir: string, baseName: string, source: { ts: string; compiled: string }) {
+  fs.writeFileSync(path.join(generatedDir, `${baseName}.ts`), source.ts)
+  fs.writeFileSync(path.join(generatedDir, `${baseName}.mjs`), source.compiled)
+  const fresh = new Date(Date.now() + 60_000)
+  fs.utimesSync(path.join(generatedDir, `${baseName}.mjs`), fresh, fresh)
+}
+
+describe('loadBootstrapData — command interceptors reach worker/CLI bootstrap (#4327)', () => {
+  let appRoot: string
+
+  beforeAll(() => {
+    appRoot = fs.mkdtempSync(path.join(os.tmpdir(), 'om-bootstrap-4327-'))
+    const generatedDir = path.join(appRoot, '.mercato', 'generated')
+    fs.mkdirSync(generatedDir, { recursive: true })
+    for (const [baseName, source] of Object.entries(GENERATED_MODULES)) {
+      writeGeneratedModule(generatedDir, baseName, source)
+    }
+  })
+
+  afterAll(() => {
+    fs.rmSync(appRoot, { recursive: true, force: true })
+  })
+
+  it('returns commandInterceptorEntries from command-interceptors.generated', async () => {
+    const data = await loadBootstrapData(appRoot)
+
+    expect(data.commandInterceptorEntries).toEqual([
+      { moduleId: 'example', interceptors: [{ id: 'example.adjust-probability' }] },
+    ])
+  })
+
+  it('falls back to an empty array (not undefined) when the generated file is absent', async () => {
+    const generatedDir = path.join(appRoot, '.mercato', 'generated')
+    fs.rmSync(path.join(generatedDir, 'command-interceptors.generated.ts'))
+    fs.rmSync(path.join(generatedDir, 'command-interceptors.generated.mjs'))
+
+    const data = await loadBootstrapData(appRoot)
+
+    expect(data.commandInterceptorEntries).toEqual([])
+    expect(data.commandLoaderEntries).toEqual([])
+  })
+})

package/src/lib/bootstrap/dynamicLoader.ts

@@ -155,6 +155,7 @@ export async function loadBootstrapData(appRoot?: string): Promise<BootstrapData
     diModule,
     searchModule,
     commandLoadersModule,
+    commandInterceptorsModule,
     workflowsModule,
   ] = await Promise.all([
     compileAndImport(path.join(generatedDir, 'modules.cli.generated.ts')),
@@ -162,6 +163,7 @@ export async function loadBootstrapData(appRoot?: string): Promise<BootstrapData
     compileAndImport(path.join(generatedDir, 'di.generated.ts')),
     compileAndImport(path.join(generatedDir, 'search.generated.ts')).catch(() => ({ searchModuleConfigs: [] })),
     compileAndImport(path.join(generatedDir, 'command-loaders.generated.ts')).catch(() => ({ commandLoaderEntries: [] })),
+    compileAndImport(path.join(generatedDir, 'command-interceptors.generated.ts')).catch(() => ({ commandInterceptorEntries: [] })),
     compileAndImport(path.join(generatedDir, 'workflows.generated.ts')).catch(() => ({ allCodeWorkflows: [] })),
   ])
 
@@ -173,6 +175,12 @@ export async function loadBootstrapData(appRoot?: string): Promise<BootstrapData
     // Search configs are needed by workers for indexing
     searchModuleConfigs: (searchModule.searchModuleConfigs ?? []) as BootstrapData['searchModuleConfigs'],
     commandLoaderEntries: (commandLoadersModule.commandLoaderEntries ?? []) as BootstrapData['commandLoaderEntries'],
+    // Command interceptors must apply in worker/CLI processes too — the
+    // interceptor registry is per-process, so relying on the Next.js runtime's
+    // registration silently no-ops every interceptor for queued/CLI commands
+    // (#4327).
+    commandInterceptorEntries: (commandInterceptorsModule.commandInterceptorEntries ??
+      []) as BootstrapData['commandInterceptorEntries'],
     // Code workflow definitions are needed by workers to resume code-defined instances
     codeWorkflows: (workflowsModule.allCodeWorkflows ?? []) as BootstrapData['codeWorkflows'],
     // Empty UI-related data - not needed for CLI

package/src/lib/crud/__tests__/ids.test.ts

@@ -1,4 +1,4 @@
-import { MAX_IDS_PER_REQUEST, mergeIdFilter, parseIdsParam } from '@open-mercato/shared/lib/crud/ids'
+import { MAX_IDS_PER_REQUEST, mergeIdFilter, parseIdsParam, isIdsParamProvided } from '@open-mercato/shared/lib/crud/ids'
 
 describe('crud ids helpers', () => {
   const idA = '550e8400-e29b-41d4-a716-446655440001'
@@ -109,4 +109,34 @@ describe('crud ids helpers', () => {
       id: { $in: [idA] },
     })
   })
+
+  // #4143 Finding 3: `?ids=<garbage>` parsed to [] and silently dropped the
+  // filter, returning the full list — a record-count side channel. A supplied
+  // but fully-invalid ids param must match nothing, like a valid-unknown UUID.
+  it('isIdsParamProvided distinguishes a supplied param from an absent one', () => {
+    expect(isIdsParamProvided('not-a-uuid')).toBe(true)
+    expect(isIdsParamProvided(`${idA}`)).toBe(true)
+    expect(isIdsParamProvided('')).toBe(false)
+    expect(isIdsParamProvided('   ')).toBe(false)
+    expect(isIdsParamProvided(undefined)).toBe(false)
+    expect(isIdsParamProvided(null)).toBe(false)
+  })
+
+  it('mergeIdFilter matches nothing when ids param was provided but all invalid', () => {
+    // Malformed input: parseIdsParam yields [], but the param WAS provided.
+    expect(mergeIdFilter({}, parseIdsParam('not-a-uuid'), { idsParamProvided: true })).toEqual({
+      id: { $in: [] },
+    })
+    // Preserves any existing filters alongside the match-nothing id clause.
+    expect(
+      mergeIdFilter({ tenantId: 't1' } as any, [], { idsParamProvided: true }),
+    ).toEqual({ tenantId: 't1', id: { $in: [] } })
+  })
+
+  it('mergeIdFilter still no-ops on empty ids when the param was absent (BC)', () => {
+    expect(mergeIdFilter({ tenantId: 't1' } as any, [])).toEqual({ tenantId: 't1' })
+    expect(mergeIdFilter({ tenantId: 't1' } as any, [], { idsParamProvided: false })).toEqual({
+      tenantId: 't1',
+    })
+  })
 })

package/src/lib/crud/factory.ts

@@ -66,7 +66,7 @@ import { applyResponseEnrichers, applyResponseEnricherToRecord, resolveListCache
 import type { EnricherContext } from './response-enricher'
 import type { ApiInterceptorMethod, InterceptorRequest, InterceptorResponse } from './api-interceptor'
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from './interceptor-runner'
-import { mergeIdFilter, parseIdsParam } from './ids'
+import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from './ids'
 import { mergeAdvancedFilters } from './advanced-filter-integration'
 import { parseExtensionHeaders } from '../umes/extension-headers'
 import { createGenericOptimisticLockReader } from './optimistic-lock'
@@ -1445,6 +1445,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         ...(interceptorRequest.query ?? {}),
       } as Record<string, unknown>
       const parsedIds = parseIdsParam(queryParams.ids)
+      const idsParamProvided = isIdsParamProvided(queryParams.ids)
 
       await opts.hooks?.beforeList?.(validated as any, ctx)
       profiler.mark('before_list_hook')
@@ -1664,7 +1665,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         const filters = exportFullRequested
           ? baseFilters
           : mergeAdvancedFilters(baseFilters as Record<string, unknown>, validated as Record<string, unknown>) as Where<any>
-        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds)
+        const mergedFilters = exportFullRequested ? filters : mergeIdFilter(filters, parsedIds, { idsParamProvided })
         const withDeleted = parseBooleanToken((queryParams as any).withDeleted) === true
         profiler.mark('filters_ready', { withDeleted })
         if (
@@ -1951,7 +1952,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         : mergeAdvancedFilters(fallbackBaseFilters as Record<string, unknown>, validated as Record<string, unknown>) as Where<any>
       const mergedFallbackFilters = exportFullRequested
         ? fallbackFilters
-        : mergeIdFilter(fallbackFilters, parsedIds)
+        : mergeIdFilter(fallbackFilters, parsedIds, { idsParamProvided })
       const ormFilters = translateFiltersForOrm(
         mergedFallbackFilters as Record<string, any>,
         em,

package/src/lib/crud/ids.ts

@@ -49,11 +49,32 @@ export function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST
   return parsed.slice(0, safeMax)
 }
 
+/**
+ * Whether an `?ids=` param was supplied at all (a non-empty string), regardless
+ * of whether any value survived UUID validation. Lets a caller tell "no ids
+ * filter requested" apart from "ids filter requested but every value was
+ * malformed" — the latter must match nothing, not fall back to the full list
+ * (#4143 Finding 3).
+ */
+export function isIdsParamProvided(raw: unknown): boolean {
+  return typeof raw === 'string' && raw.trim().length > 0
+}
+
 export function mergeIdFilter<Fields extends Record<string, unknown>>(
   existingFilters: Where<Fields>,
   parsedIds: string[],
+  options?: { idsParamProvided?: boolean },
 ): Where<Fields> {
-  if (parsedIds.length === 0) return existingFilters
+  if (parsedIds.length === 0) {
+    // The `?ids=` param was supplied but nothing survived UUID validation.
+    // Match nothing, mirroring a valid-but-unknown id returning zero rows,
+    // rather than silently dropping the filter and returning the full list
+    // (record-count side channel — #4143 Finding 3).
+    if (options?.idsParamProvided) {
+      return { ...existingFilters, id: { $in: [] } }
+    }
+    return existingFilters
+  }
 
   const existingFilter = (existingFilters as Record<string, unknown>).id
   const existingIds = readExistingIds(existingFilter)