@open-mercato/shared 0.7.0 → 0.7.1-develop.7103.1.41ff100d93

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -12,6 +12,16 @@ import {
 import { loadCustomFieldDefinitionIndex } from '@open-mercato/shared/lib/crud/custom-fields'
 import { registerMutationGuards } from '@open-mercato/shared/lib/crud/mutation-guard-store'
 import { CommandInterceptorError } from '@open-mercato/shared/lib/commands/errors'
+import {
+  registerLoggerExtension,
+  resetLoggerExtension,
+  type LoggerExtensionRecord,
+} from '@open-mercato/shared/lib/logger'
+import {
+  registerTelemetryRuntime,
+  resetTelemetryRuntime,
+  type TelemetryRuntime,
+} from '@open-mercato/shared/lib/telemetry/runtime'
 import { z } from 'zod'
 
 // Keep the real custom-field helpers but spy on the definition loader so we can
@@ -268,6 +278,28 @@ describe('CRUD Factory', () => {
     }))
   })
 
+  it('GET spreads totalIsCapped only when the engine reports a capped count', async () => {
+    queryEngine.query.mockResolvedValueOnce({
+      items: [{ id: 'id-1', title: 'A', is_done: false }],
+      total: 10_000,
+      page: 1,
+      pageSize: 10,
+      meta: { listCountCapWarning: { entity: 'example.todo', cap: 10_000 } },
+    })
+    const res = await route.GET(new Request('http://x/api/example/todos?page=1&pageSize=10&sortField=id&sortDir=asc'))
+    expect(res.status).toBe(200)
+    const body = await res.json()
+    expect(body.total).toBe(10_000)
+    expect(body.totalIsCapped).toBe(true)
+    expect(body.meta.listCountCapWarning).toEqual({ entity: 'example.todo', cap: 10_000 })
+  })
+
+  it('GET omits totalIsCapped entirely for exact totals', async () => {
+    const res = await route.GET(new Request('http://x/api/example/todos?page=1&pageSize=10&sortField=id&sortDir=asc'))
+    const body = await res.json()
+    expect('totalIsCapped' in body).toBe(false)
+  })
+
   const makeDecoratedRoute = () => makeCrudRoute({
     metadata: { GET: { requireAuth: true } },
     orm: { entity: Todo, idField: 'id', orgField: 'organizationId', tenantField: 'tenantId', softDeleteField: 'deletedAt' },
@@ -338,6 +370,77 @@ describe('CRUD Factory', () => {
     })
   })
 
+  describe('repeated query parameters (#5548)', () => {
+    const makeFilterRoute = () => {
+      const seen: { status?: string | string[]; search?: string | string[] }[] = []
+      const route = makeCrudRoute({
+        metadata: { GET: { requireAuth: true } },
+        orm: { entity: Todo, idField: 'id', orgField: 'organizationId', tenantField: 'tenantId', softDeleteField: 'deletedAt' },
+        indexer: { entityType: 'example.todo' },
+        list: {
+          schema: querySchema.extend({
+            status: z.union([z.string(), z.array(z.string())]).optional(),
+            search: z.string().optional(),
+          }),
+          entityId: 'example.todo',
+          fields: ['id', 'title'],
+          buildFilters: (query) => {
+            seen.push({ status: (query as any).status, search: (query as any).search })
+            return {} as any
+          },
+        },
+      })
+      return { route, seen }
+    }
+
+    it('hands the list schema every value of a repeated key', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win&status=loose'))
+      expect(seen.at(-1)?.status).toEqual(['win', 'loose'])
+    })
+
+    it('still hands a plain string to a key that occurs once', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win'))
+      expect(seen.at(-1)?.status).toBe('win')
+    })
+
+    it('leaves a comma-bearing scalar untouched so free-text filters survive', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request(`http://x/api/example/todos?search=${encodeURIComponent('Smith, John')}&status=win`))
+      expect(seen.at(-1)?.search).toBe('Smith, John')
+      expect(seen.at(-1)?.status).toBe('win')
+    })
+
+    it('rejects a repeated occurrence of a single-valued param with 400 instead of silently keeping one value', async () => {
+      const { route, seen } = makeFilterRoute()
+      const res = await route.GET(new Request('http://x/api/example/todos?search=Smith&search=John'))
+      expect(res.status).toBe(400)
+      const body = await res.json()
+      expect(body.error).toBe('Invalid input')
+      expect(
+        (body.details as { path: (string | number)[] }[]).some((issue) => issue.path.includes('search')),
+      ).toBe(true)
+      expect(seen).toHaveLength(0)
+    })
+
+    it('resolves each ordering of the same repeated filter to the values that ordering sent', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win&status=loose'))
+      await route.GET(new Request('http://x/api/example/todos?status=loose&status=win'))
+      expect(seen.at(-2)?.status).toEqual(['win', 'loose'])
+      expect(seen.at(-1)?.status).toEqual(['loose', 'win'])
+    })
+
+    it('keeps a repeated ids filter instead of dropping it entirely', async () => {
+      const idA = '550e8400-e29b-41d4-a716-446655440001'
+      const idB = '550e8400-e29b-41d4-a716-446655440002'
+      await route.GET(new Request(`http://x/api/example/todos?ids=${idA}&ids=${idB}`))
+      const queryArgs = queryEngine.query.mock.calls.at(-1)?.[1]
+      expect(queryArgs?.filters).toEqual({ id: { $in: [idA, idB] } })
+    })
+  })
+
   it('GET resolves a function-form list.fields projection per request (#2233)', async () => {
     const fieldsResolver = jest.fn((query: any) =>
       query?.id ? ['id', 'title', 'is_done', 'snapshot'] : ['id', 'title'],
@@ -1054,6 +1157,7 @@ describe('CRUD Factory', () => {
     await expect(res.json()).resolves.toEqual({
       error: 'Internal server error',
       message: 'Something went wrong. Please try again later.',
+      requestId: expect.any(String),
     })
   })
 
@@ -1092,6 +1196,138 @@ describe('CRUD Factory', () => {
     await expect(res.json()).resolves.toEqual({
       error: 'Internal server error',
       message: 'Something went wrong. Please try again later.',
+      requestId: expect.any(String),
+    })
+  })
+
+  // Issue #5608 — a generic 500 must carry a requestId the client/support can cite, and
+  // that same id must appear on the server log line so the two can be correlated.
+  describe('generic 500 requestId correlation', () => {
+    const logRecords: LoggerExtensionRecord[] = []
+    const reportError = jest.fn()
+
+    const postWithRequestId = (requestId: string) => interceptorErrorRoute().POST(
+      new Request('http://x/api/example/todos/command', {
+        method: 'POST',
+        body: JSON.stringify({ title: 'A' }),
+        headers: { 'content-type': 'application/json', 'x-request-id': requestId },
+      }),
+    )
+
+    beforeEach(() => {
+      logRecords.length = 0
+      reportError.mockClear()
+      registerLoggerExtension({ emit: (record) => logRecords.push(record) })
+      registerTelemetryRuntime({
+        canUseGlobalTracePropagation: () => false,
+        captureTraceContext: () => ({}),
+        continueTrace: (_carrier, _name, fn) => fn(),
+        recordHttpDuration: () => {},
+        reportError,
+        shutdown: async () => {},
+      } satisfies TelemetryRuntime)
+    })
+
+    afterEach(() => {
+      resetLoggerExtension()
+      resetTelemetryRuntime()
+    })
+
+    it('includes a requestId in the body that matches the server log line', async () => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postInterceptorErrorRequest(interceptorErrorRoute())
+      const body = await res.json()
+
+      expect(res.status).toBe(500)
+      expect(typeof body.requestId).toBe('string')
+      expect(body.requestId.length).toBeGreaterThan(0)
+
+      const logRecord = logRecords.find((record) => record.message === 'Unexpected CRUD error')
+      expect(logRecord?.fields.requestId).toBe(body.requestId)
+    })
+
+    it('echoes the requestId on an x-request-id response header', async () => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postInterceptorErrorRequest(interceptorErrorRoute())
+      const body = await res.json()
+
+      expect(res.headers.get('x-request-id')).toBe(body.requestId)
+    })
+
+    it('reuses an inbound x-request-id header instead of generating a new one', async () => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postWithRequestId('req-fixed-123')
+      const body = await res.json()
+
+      expect(res.status).toBe(500)
+      expect(body.requestId).toBe('req-fixed-123')
+      const logRecord = logRecords.find((record) => record.message === 'Unexpected CRUD error')
+      expect(logRecord?.fields.requestId).toBe('req-fixed-123')
+    })
+
+    // `Headers.get()` returns '' for an empty or whitespace-only header, which a plain
+    // `?? randomUUID()` would hand straight through as a blank correlation id.
+    it.each([
+      ['an empty inbound header', ''],
+      ['a whitespace-only inbound header', '   '],
+    ])('generates a fresh id for %s', async (_label, inbound) => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postWithRequestId(inbound)
+      const body = await res.json()
+
+      expect(res.status).toBe(500)
+      expect(typeof body.requestId).toBe('string')
+      expect(body.requestId.length).toBeGreaterThan(0)
+      const logRecord = logRecords.find((record) => record.message === 'Unexpected CRUD error')
+      expect(logRecord?.fields.requestId).toBe(body.requestId)
+    })
+
+    // A caller-controlled id lands verbatim in the unquoted `key=value` log line, so an
+    // over-long one or one carrying spaces/`=` is discarded rather than echoed.
+    it.each([
+      ['a value carrying log-field separators', 'a=1 tenantId=victim'],
+      ['an over-long value', 'x'.repeat(129)],
+    ])('discards %s in favor of a generated id', async (_label, inbound) => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postWithRequestId(inbound)
+      const body = await res.json()
+
+      expect(res.status).toBe(500)
+      expect(body.requestId).not.toBe(inbound)
+      expect(body.requestId).toMatch(/^[A-Za-z0-9-]{36}$/)
+    })
+
+    it('reports the error to telemetry with the same requestId', async () => {
+      commandBus.execute.mockRejectedValue(new Error('boom'))
+
+      const res = await postWithRequestId('req-fixed-123')
+      const body = await res.json()
+
+      expect(body.requestId).toBe('req-fixed-123')
+      expect(reportError).toHaveBeenCalledTimes(1)
+      expect(reportError).toHaveBeenCalledWith(
+        expect.any(Error),
+        { module: 'crud', attributes: { requestId: 'req-fixed-123', errorName: 'Error' } },
+      )
+    })
+
+    // The 503/422 branches deliberately stay outside this change (issue #5608) — lock that
+    // in so a later refactor cannot quietly widen the correlation id across every branch.
+    it('leaves the interceptor-rejection branch without a requestId', async () => {
+      commandBus.execute.mockRejectedValue(
+        new CommandInterceptorError('Missing required fields: VAT id', { status: 422 }),
+      )
+
+      const res = await postWithRequestId('req-fixed-123')
+
+      expect(res.status).toBe(422)
+      await expect(res.json()).resolves.toEqual({ error: 'Missing required fields: VAT id' })
+      expect(res.headers.get('x-request-id')).toBeNull()
     })
   })
 

package/src/lib/crud/__tests__/ids.test.ts

@@ -122,6 +122,35 @@ describe('crud ids helpers', () => {
     expect(isIdsParamProvided(null)).toBe(false)
   })
 
+  // #5548: once the factory groups repeated params, `?ids=a&ids=b` reaches these
+  // helpers as an array. Treating that as "not supplied" would silently drop the
+  // filter and return the full list — the same side channel #4143 closed.
+  it('parseIdsParam accepts the repeated-parameter form', () => {
+    expect(parseIdsParam([idA, idB])).toEqual([idA, idB])
+    expect(parseIdsParam([`${idA},${idB}`, idC])).toEqual([idA, idB, idC])
+    expect(parseIdsParam([idA, idA])).toEqual([idA])
+    expect(parseIdsParam([idA, idB, idC], 2)).toEqual([idA, idB])
+    expect(parseIdsParam([])).toEqual([])
+    expect(parseIdsParam(['invalid', 'also-invalid'])).toEqual([])
+  })
+
+  it('isIdsParamProvided recognizes the repeated-parameter form', () => {
+    expect(isIdsParamProvided([idA, idB])).toBe(true)
+    expect(isIdsParamProvided(['not-a-uuid'])).toBe(true)
+    expect(isIdsParamProvided([])).toBe(false)
+    expect(isIdsParamProvided(['', '  '])).toBe(false)
+  })
+
+  // "Supplied" is about the raw occurrence, not about what survives parsing:
+  // `?ids=,,,` carries no usable value but was still requested, so it must match
+  // nothing rather than fall back to the unfiltered list.
+  it('isIdsParamProvided treats a value that parses to nothing as still supplied', () => {
+    expect(isIdsParamProvided(',,,')).toBe(true)
+    expect(parseIdsParam(',,,')).toEqual([])
+    expect(isIdsParamProvided([',', ','])).toBe(true)
+    expect(parseIdsParam([',', ','])).toEqual([])
+  })
+
   it('mergeIdFilter matches nothing when ids param was provided but all invalid', () => {
     // Malformed input: parseIdsParam yields [], but the param WAS provided.
     expect(mergeIdFilter({}, parseIdsParam('not-a-uuid'), { idsParamProvided: true })).toEqual({

package/src/lib/crud/__tests__/query-params.test.ts

@@ -0,0 +1,98 @@
+import { buildQueryParams, readQueryParamList, toQueryValueList } from '@open-mercato/shared/lib/crud/query-params'
+
+describe('buildQueryParams', () => {
+  it('keeps a key that occurs once as a plain string', () => {
+    const params = new URLSearchParams('status=win&page=2')
+    expect(buildQueryParams(params)).toEqual({ status: 'win', page: '2' })
+  })
+
+  it('keeps every value of a repeated key instead of the last one (#5548)', () => {
+    const params = new URLSearchParams('status=win&status=loose')
+    expect(buildQueryParams(params)).toEqual({ status: ['win', 'loose'] })
+  })
+
+  it('preserves the order the values were supplied in', () => {
+    expect(buildQueryParams(new URLSearchParams('status=loose&status=win'))).toEqual({
+      status: ['loose', 'win'],
+    })
+  })
+
+  it('does not split a single value on commas, so comma contracts stay intact', () => {
+    const params = new URLSearchParams('ids=a,b&search=Smith, John')
+    expect(buildQueryParams(params)).toEqual({ ids: 'a,b', search: 'Smith, John' })
+  })
+
+  it('returns an empty object for an empty query string', () => {
+    expect(buildQueryParams(new URLSearchParams(''))).toEqual({})
+  })
+
+  it('keeps an empty repeated value so the caller can decide what it means', () => {
+    expect(buildQueryParams(new URLSearchParams('status=&status=win'))).toEqual({
+      status: ['', 'win'],
+    })
+  })
+
+  // A plain `out[key] = value` assignment runs the `__proto__` setter, which
+  // would swap the returned object's prototype for the array and drop the key.
+  // `Object.fromEntries` defines own data properties, matching what the parse
+  // site did before this change.
+  it('carries a __proto__ key as an own property instead of touching the prototype', () => {
+    const repeated = buildQueryParams(new URLSearchParams('__proto__=a&__proto__=b'))
+    expect(Object.getPrototypeOf(repeated)).toBe(Object.prototype)
+    expect(Object.prototype.hasOwnProperty.call(repeated, '__proto__')).toBe(true)
+    expect(Object.getOwnPropertyDescriptor(repeated, '__proto__')?.value).toEqual(['a', 'b'])
+
+    const single = buildQueryParams(new URLSearchParams('__proto__=a'))
+    expect(Object.getPrototypeOf(single)).toBe(Object.prototype)
+    expect(Object.getOwnPropertyDescriptor(single, '__proto__')?.value).toBe('a')
+  })
+
+  it('rejects the Object.fromEntries shape this replaced', () => {
+    // Regression guard: reverting the parse site to
+    // `Object.fromEntries(url.searchParams.entries())` makes this fail.
+    const params = new URLSearchParams('status=win&status=loose')
+    expect(buildQueryParams(params)).not.toEqual(Object.fromEntries(params.entries()))
+  })
+})
+
+describe('toQueryValueList', () => {
+  it('turns a single string into a one-entry list', () => {
+    expect(toQueryValueList('win')).toEqual(['win'])
+  })
+
+  it('splits the comma form', () => {
+    expect(toQueryValueList('win,loose')).toEqual(['win', 'loose'])
+  })
+
+  it('flattens repeated values', () => {
+    expect(toQueryValueList(['win', 'loose'])).toEqual(['win', 'loose'])
+  })
+
+  it('treats the mixed form as one flat list', () => {
+    expect(toQueryValueList(['a,b', 'c'])).toEqual(['a', 'b', 'c'])
+  })
+
+  it('trims entries and drops empty ones', () => {
+    expect(toQueryValueList([' win ', '', ' , ', 'loose'])).toEqual(['win', 'loose'])
+  })
+
+  it('ignores non-string input', () => {
+    expect(toQueryValueList(undefined)).toEqual([])
+    expect(toQueryValueList(null)).toEqual([])
+    expect(toQueryValueList(42)).toEqual([])
+    expect(toQueryValueList([1, 'win'])).toEqual(['win'])
+  })
+})
+
+describe('readQueryParamList', () => {
+  it('reads the repeated and the comma form as the same list', () => {
+    const repeated = new URLSearchParams('status=win&status=loose')
+    const comma = new URLSearchParams('status=win,loose')
+    expect(readQueryParamList(repeated, 'status')).toEqual(['win', 'loose'])
+    expect(readQueryParamList(comma, 'status')).toEqual(['win', 'loose'])
+  })
+
+  it('returns an empty list for a key that was not supplied', () => {
+    expect(readQueryParamList(new URLSearchParams('status=win'), 'ownerUserId')).toEqual([])
+  })
+})

package/src/lib/crud/factory.ts

@@ -69,12 +69,15 @@ import type { EnricherContext } from './response-enricher'
 import type { ApiInterceptorMethod, InterceptorRequest, InterceptorResponse } from './api-interceptor'
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from './interceptor-runner'
 import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from './ids'
+import { buildQueryParams } from './query-params'
 import { mergeAdvancedFilters } from './advanced-filter-integration'
 import { parseExtensionHeaders } from '../umes/extension-headers'
 import { createGenericOptimisticLockReader } from './optimistic-lock'
 import { registerOptimisticLockReaderIfAbsent } from './optimistic-lock-store'
 import { createLogger } from '../logger'
 import { isTransientDbError } from '../db/pg-errors'
+import { getTelemetryRuntime } from '../telemetry/runtime'
+import { randomUUID } from 'node:crypto'
 
 type RbacServiceLike = {
   getGrantedFeatures: (userId: string, opts: { tenantId: string | null; organizationId: string | null }) => Promise<string[]>
@@ -594,7 +597,19 @@ function attachOperationHeader(res: Response, logEntry: any) {
   return res
 }
 
-function handleError(err: unknown): Response {
+// An inbound `x-request-id` is caller-controlled, so it is only reused when it still
+// looks like an id. `Headers.get()` yields '' for an empty or whitespace-only header —
+// which `??` would not replace — and an unbounded value carrying spaces or `=` would
+// forge fields in the unquoted `key=value` log line this id exists to be read from.
+const INBOUND_REQUEST_ID_PATTERN = /^[A-Za-z0-9._-]{1,128}$/
+
+function resolveRequestId(request?: Request): string {
+  const inbound = request?.headers.get('x-request-id')?.trim()
+  if (inbound && INBOUND_REQUEST_ID_PATTERN.test(inbound)) return inbound
+  return randomUUID()
+}
+
+function handleError(err: unknown, request?: Request): Response {
   if (err instanceof Response) return err
   if (isCrudHttpError(err)) return json(err.body, { status: err.status })
   // A command interceptor that blocked with an explicit status is a deliberate business
@@ -618,14 +633,25 @@ function handleError(err: unknown): Response {
     )
   }
 
+  // Unexpected exceptions still collapse into a generic 500 for the client (no internal
+  // detail leaked), but a requestId ties that response to this log line and to whatever
+  // reaches APM, so a client/support ticket citing it can be correlated with server-side
+  // detail (issue #5608).
   const message = err instanceof Error ? err.message : undefined
   const stack = err instanceof Error ? err.stack : undefined
-  logger.error('Unexpected CRUD error', { message, stack, err })
+  const errorName = err instanceof Error ? err.name : undefined
+  const requestId = resolveRequestId(request)
+  logger.error('Unexpected CRUD error', { message, stack, err, requestId })
+  getTelemetryRuntime()?.reportError(err, {
+    module: 'crud',
+    attributes: { requestId, errorName },
+  })
   const body: Record<string, unknown> = {
     error: 'Internal server error',
     message: 'Something went wrong. Please try again later.',
+    requestId,
   }
-  return json(body, { status: 500 })
+  return json(body, { status: 500, headers: { 'x-request-id': requestId } })
 }
 
 const LIFECYCLE_ACTION_MAP: Record<string, { before: string; after: string }> = {
@@ -1491,7 +1517,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         return json({ error: 'Not implemented' }, { status: 501 })
       }
       const url = new URL(request.url)
-      const rawQueryParams = Object.fromEntries(url.searchParams.entries())
+      const rawQueryParams = buildQueryParams(url.searchParams)
       profiler.mark('query_parsed')
       let validated = opts.list.schema.parse(rawQueryParams)
       profiler.mark('query_validated')
@@ -1941,6 +1967,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
           page: page.page || requestedPage,
           pageSize: page.pageSize || requestedPageSize,
           totalPages: Math.ceil(res.total / (Number(page.pageSize) || 1)),
+          ...(res.meta?.listCountCapWarning ? { totalIsCapped: true } : {}),
           ...(res.meta ? { meta: res.meta } : {}),
         }
         await opts.hooks?.afterList?.(payload, { ...ctx, query: validated as any })
@@ -2162,7 +2189,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       return response
     } catch (e) {
       finishProfile({ result: 'error' })
-      return handleError(e)
+      return handleError(e, request)
     }
   }
 
@@ -2476,7 +2503,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       payload = await enrichSingleRecord(payload, ctx)
       return json(payload, { status: 201 })
     } catch (e) {
-      return handleError(e)
+      return handleError(e, request)
     }
   }
 
@@ -2814,7 +2841,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       }
       return json(payload)
     } catch (e) {
-      return handleError(e)
+      return handleError(e, request)
     }
   }
 
@@ -2844,7 +2871,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (useCommand) {
         const action = opts.actions!.delete!
         const body = await request.json().catch(() => ({}))
-        const raw = { body, query: Object.fromEntries(url.searchParams.entries()) }
+        const raw = { body, query: buildQueryParams(url.searchParams) }
         const parsed = action.schema ? action.schema.parse(raw) : raw
         const interceptorInput =
           parsed && typeof parsed === 'object' && (parsed as Record<string, unknown>).body && typeof (parsed as Record<string, unknown>).body === 'object'
@@ -2863,7 +2890,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         const interceptedBody = interceptorRequestPayload.body ?? {}
         const reparsedRaw = {
           body: interceptedBody,
-          query: Object.fromEntries(url.searchParams.entries()),
+          query: buildQueryParams(url.searchParams),
         }
         const reparsed = action.schema ? action.schema.parse(reparsedRaw) : reparsedRaw
         const input = action.mapInput ? await action.mapInput({ parsed: reparsed, raw: reparsedRaw, ctx }) : reparsed
@@ -2980,7 +3007,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         request,
         method: 'DELETE',
         body: idFrom === 'query' ? undefined : ({ id } as Record<string, unknown>),
-        query: idFrom === 'query' ? Object.fromEntries(url.searchParams.entries()) : undefined,
+        query: idFrom === 'query' ? buildQueryParams(url.searchParams) : undefined,
       })
       if (beforeInterceptors.errorResponse) return beforeInterceptors.errorResponse
       interceptorRequestPayload = beforeInterceptors.requestPayload
@@ -3103,7 +3130,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       }
       return json(payload)
     } catch (e) {
-      return handleError(e)
+      return handleError(e, request)
     }
   }
 

package/src/lib/crud/ids.ts

@@ -1,4 +1,5 @@
 import type { Where } from '@open-mercato/shared/lib/query/types'
+import { toQueryValueList } from './query-params'
 
 export const MAX_IDS_PER_REQUEST = 200
 
@@ -43,21 +44,23 @@ function readExistingIds(filter: unknown): string[] | null {
 }
 
 export function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {
-  if (typeof raw !== 'string' || raw.trim().length === 0) return []
+  const values = toQueryValueList(raw)
+  if (values.length === 0) return []
   const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST
-  const parsed = normalizeIdList(raw.split(','))
+  const parsed = normalizeIdList(values)
   return parsed.slice(0, safeMax)
 }
 
 /**
- * Whether an `?ids=` param was supplied at all (a non-empty string), regardless
- * of whether any value survived UUID validation. Lets a caller tell "no ids
- * filter requested" apart from "ids filter requested but every value was
- * malformed" — the latter must match nothing, not fall back to the full list
- * (#4143 Finding 3).
+ * Whether an `?ids=` param was supplied at all (a non-empty string, or repeated
+ * `?ids=` occurrences), regardless of whether any value survived UUID
+ * validation. Lets a caller tell "no ids filter requested" apart from "ids
+ * filter requested but every value was malformed" — the latter must match
+ * nothing, not fall back to the full list (#4143 Finding 3).
  */
 export function isIdsParamProvided(raw: unknown): boolean {
-  return typeof raw === 'string' && raw.trim().length > 0
+  const occurrences = Array.isArray(raw) ? raw : [raw]
+  return occurrences.some((value) => typeof value === 'string' && value.trim().length > 0)
 }
 
 export function mergeIdFilter<Fields extends Record<string, unknown>>(

package/src/lib/crud/query-params.ts

@@ -0,0 +1,75 @@
+/**
+ * Query-string parsing helpers shared by every `makeCrudRoute` handler and by
+ * routes that read `URLSearchParams` directly.
+ *
+ * `Object.fromEntries(url.searchParams.entries())` keeps only the last value of
+ * a repeated key, so `?status=win&status=loose` reached route schemas as
+ * `'loose'` and every earlier selection was dropped before validation ran
+ * (#5548). `buildQueryParams` groups repeats instead.
+ */
+
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
+
+export type QueryParamValue = string | string[]
+
+/**
+ * Group a query string into a plain object, preserving repeated keys.
+ *
+ * A key that occurs once keeps its raw string value — that is what today's
+ * `z.string()` schemas expect and nothing about them has to change. A key that
+ * occurs two or more times becomes the array of its values, which is what a
+ * `z.array(z.string())` (or `z.union([z.string(), z.array(z.string())])`)
+ * branch has always advertised.
+ *
+ * Values are never split on commas here: `?ids=a,b` and `?search=foo,bar` carry
+ * comma semantics that belong to the individual route, not to the generic
+ * parser. Use `readQueryParamList` / `toQueryValueList` where a field's contract
+ * says a comma separates values.
+ *
+ * Repeated values are treated as a set by the list response cache: its key
+ * serializer sorts them, so `?k=a&k=b` and `?k=b&k=a` share one entry even
+ * though the schema now receives `['a','b']` and `['b','a']` respectively. Do
+ * not declare a repeated param whose order carries meaning.
+ *
+ * The result is assembled with `Object.fromEntries`, which defines own data
+ * properties. Assigning into an object literal instead would run the
+ * `__proto__` setter, so `?__proto__=a&__proto__=b` would replace the returned
+ * object's prototype and drop the key rather than carrying it to the schema.
+ */
+export function buildQueryParams(searchParams: URLSearchParams): Record<string, QueryParamValue> {
+  const grouped = new Map<string, string[]>()
+  searchParams.forEach((value, key) => {
+    const existing = grouped.get(key)
+    if (existing) existing.push(value)
+    else grouped.set(key, [value])
+  })
+  return Object.fromEntries(
+    Array.from(grouped, ([key, values]): [string, QueryParamValue] => [
+      key,
+      values.length === 1 ? values[0] : values,
+    ]),
+  )
+}
+
+/**
+ * Normalize a raw query value — a single string, an array of repeated values,
+ * or nothing — into the list it stands for. Comma-separated and repeated forms
+ * are equivalent here, so `?k=a,b&k=c` yields `['a', 'b', 'c']`.
+ */
+export function toQueryValueList(raw: unknown): string[] {
+  const candidates = Array.isArray(raw) ? raw : [raw]
+  const out: string[] = []
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') continue
+    out.push(...parseCommaSeparatedList(candidate))
+  }
+  return out
+}
+
+/**
+ * Read every value supplied for `key`, accepting both the repeated
+ * (`?k=a&k=b`) and the comma-separated (`?k=a,b`) form.
+ */
+export function readQueryParamList(searchParams: URLSearchParams, key: string): string[] {
+  return toQueryValueList(searchParams.getAll(key))
+}