@open-mercato/shared 0.7.1-develop.7102.1.b41f7e3e51 → 0.7.1-develop.7103.1.41ff100d93

package/dist/lib/crud/ids.js

@@ -1,3 +1,4 @@
+import { toQueryValueList } from "./query-params.js";
 const MAX_IDS_PER_REQUEST = 200;
 const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i;
 function isUuid(value) {
@@ -33,13 +34,15 @@ function readExistingIds(filter) {
   return null;
 }
 function parseIdsParam(raw, maxIds = MAX_IDS_PER_REQUEST) {
-  if (typeof raw !== "string" || raw.trim().length === 0) return [];
+  const values = toQueryValueList(raw);
+  if (values.length === 0) return [];
   const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST;
-  const parsed = normalizeIdList(raw.split(","));
+  const parsed = normalizeIdList(values);
   return parsed.slice(0, safeMax);
 }
 function isIdsParamProvided(raw) {
-  return typeof raw === "string" && raw.trim().length > 0;
+  const occurrences = Array.isArray(raw) ? raw : [raw];
+  return occurrences.some((value) => typeof value === "string" && value.trim().length > 0);
 }
 function mergeIdFilter(existingFilters, parsedIds, options) {
   if (parsedIds.length === 0) {

package/dist/lib/crud/ids.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../../src/lib/crud/ids.ts"],
-  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  if (typeof raw !== 'string' || raw.trim().length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(raw.split(','))\n  return parsed.slice(0, safeMax)\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string), regardless\n * of whether any value survived UUID validation. Lets a caller tell \"no ids\n * filter requested\" apart from \"ids filter requested but every value was\n * malformed\" \u2014 the latter must match nothing, not fall back to the full list\n * (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  return typeof raw === 'string' && raw.trim().length > 0\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
-  "mappings": "AAEO,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,MAAI,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,WAAW,EAAG,QAAO,CAAC;AAChE,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,IAAI,MAAM,GAAG,CAAC;AAC7C,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AASO,SAAS,mBAAmB,KAAuB;AACxD,SAAO,OAAO,QAAQ,YAAY,IAAI,KAAK,EAAE,SAAS;AACxD;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
+  "sourcesContent": ["import type { Where } from '@open-mercato/shared/lib/query/types'\nimport { toQueryValueList } from './query-params'\n\nexport const MAX_IDS_PER_REQUEST = 200\n\nconst UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[1-8][0-9a-f]{3}-[89ab][0-9a-f]{3}-[0-9a-f]{12}$/i\n\nfunction isUuid(value: unknown): value is string {\n  return typeof value === 'string' && UUID_REGEX.test(value)\n}\n\nfunction normalizeIdList(values: string[]): string[] {\n  if (values.length === 0) return values\n  const deduped = new Set<string>()\n  for (const value of values) {\n    const trimmed = value.trim()\n    if (!trimmed || !isUuid(trimmed)) continue\n    deduped.add(trimmed)\n  }\n  return Array.from(deduped)\n}\n\nfunction readExistingIds(filter: unknown): string[] | null {\n  if (typeof filter === 'string') {\n    return isUuid(filter) ? [filter] : null\n  }\n  if (Array.isArray(filter)) {\n    return normalizeIdList(\n      filter.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n  if (!filter || typeof filter !== 'object') return null\n\n  const operators = filter as Record<string, unknown>\n  if (isUuid(operators.$eq)) return [operators.$eq]\n\n  if (Array.isArray(operators.$in)) {\n    return normalizeIdList(\n      operators.$in.filter((value): value is string => typeof value === 'string'),\n    )\n  }\n\n  return null\n}\n\nexport function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {\n  const values = toQueryValueList(raw)\n  if (values.length === 0) return []\n  const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST\n  const parsed = normalizeIdList(values)\n  return parsed.slice(0, safeMax)\n}\n\n/**\n * Whether an `?ids=` param was supplied at all (a non-empty string, or repeated\n * `?ids=` occurrences), regardless of whether any value survived UUID\n * validation. Lets a caller tell \"no ids filter requested\" apart from \"ids\n * filter requested but every value was malformed\" \u2014 the latter must match\n * nothing, not fall back to the full list (#4143 Finding 3).\n */\nexport function isIdsParamProvided(raw: unknown): boolean {\n  const occurrences = Array.isArray(raw) ? raw : [raw]\n  return occurrences.some((value) => typeof value === 'string' && value.trim().length > 0)\n}\n\nexport function mergeIdFilter<Fields extends Record<string, unknown>>(\n  existingFilters: Where<Fields>,\n  parsedIds: string[],\n  options?: { idsParamProvided?: boolean },\n): Where<Fields> {\n  if (parsedIds.length === 0) {\n    // The `?ids=` param was supplied but nothing survived UUID validation.\n    // Match nothing, mirroring a valid-but-unknown id returning zero rows,\n    // rather than silently dropping the filter and returning the full list\n    // (record-count side channel \u2014 #4143 Finding 3).\n    if (options?.idsParamProvided) {\n      return { ...existingFilters, id: { $in: [] } }\n    }\n    return existingFilters\n  }\n\n  const existingFilter = (existingFilters as Record<string, unknown>).id\n  const existingIds = readExistingIds(existingFilter)\n\n  if (!existingIds) {\n    // No existing narrowing \u2014 safe to install the user-supplied `$in`.\n    if (existingFilter === undefined || existingFilter === null) {\n      return { ...existingFilters, id: { $in: parsedIds } }\n    }\n    // Existing `id` filter is in a shape we do not recognise. Fail closed:\n    // preserve the existing filter instead of widening to `parsedIds`. Adding\n    // a new recognised shape to `readExistingIds` is preferable to silently\n    // dropping a narrowing that another caller put in place.\n    return existingFilters\n  }\n\n  const allowed = new Set(parsedIds)\n  const intersection = existingIds.filter((id) => allowed.has(id))\n  return {\n    ...existingFilters,\n    id: { $in: intersection },\n  }\n}\n"],
+  "mappings": "AACA,SAAS,wBAAwB;AAE1B,MAAM,sBAAsB;AAEnC,MAAM,aAAa;AAEnB,SAAS,OAAO,OAAiC;AAC/C,SAAO,OAAO,UAAU,YAAY,WAAW,KAAK,KAAK;AAC3D;AAEA,SAAS,gBAAgB,QAA4B;AACnD,MAAI,OAAO,WAAW,EAAG,QAAO;AAChC,QAAM,UAAU,oBAAI,IAAY;AAChC,aAAW,SAAS,QAAQ;AAC1B,UAAM,UAAU,MAAM,KAAK;AAC3B,QAAI,CAAC,WAAW,CAAC,OAAO,OAAO,EAAG;AAClC,YAAQ,IAAI,OAAO;AAAA,EACrB;AACA,SAAO,MAAM,KAAK,OAAO;AAC3B;AAEA,SAAS,gBAAgB,QAAkC;AACzD,MAAI,OAAO,WAAW,UAAU;AAC9B,WAAO,OAAO,MAAM,IAAI,CAAC,MAAM,IAAI;AAAA,EACrC;AACA,MAAI,MAAM,QAAQ,MAAM,GAAG;AACzB,WAAO;AAAA,MACL,OAAO,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IACrE;AAAA,EACF;AACA,MAAI,CAAC,UAAU,OAAO,WAAW,SAAU,QAAO;AAElD,QAAM,YAAY;AAClB,MAAI,OAAO,UAAU,GAAG,EAAG,QAAO,CAAC,UAAU,GAAG;AAEhD,MAAI,MAAM,QAAQ,UAAU,GAAG,GAAG;AAChC,WAAO;AAAA,MACL,UAAU,IAAI,OAAO,CAAC,UAA2B,OAAO,UAAU,QAAQ;AAAA,IAC5E;AAAA,EACF;AAEA,SAAO;AACT;AAEO,SAAS,cAAc,KAAc,SAAiB,qBAA+B;AAC1F,QAAM,SAAS,iBAAiB,GAAG;AACnC,MAAI,OAAO,WAAW,EAAG,QAAO,CAAC;AACjC,QAAM,UAAU,OAAO,SAAS,MAAM,KAAK,SAAS,IAAI,KAAK,MAAM,MAAM,IAAI;AAC7E,QAAM,SAAS,gBAAgB,MAAM;AACrC,SAAO,OAAO,MAAM,GAAG,OAAO;AAChC;AASO,SAAS,mBAAmB,KAAuB;AACxD,QAAM,cAAc,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AACnD,SAAO,YAAY,KAAK,CAAC,UAAU,OAAO,UAAU,YAAY,MAAM,KAAK,EAAE,SAAS,CAAC;AACzF;AAEO,SAAS,cACd,iBACA,WACA,SACe;AACf,MAAI,UAAU,WAAW,GAAG;AAK1B,QAAI,SAAS,kBAAkB;AAC7B,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,CAAC,EAAE,EAAE;AAAA,IAC/C;AACA,WAAO;AAAA,EACT;AAEA,QAAM,iBAAkB,gBAA4C;AACpE,QAAM,cAAc,gBAAgB,cAAc;AAElD,MAAI,CAAC,aAAa;AAEhB,QAAI,mBAAmB,UAAa,mBAAmB,MAAM;AAC3D,aAAO,EAAE,GAAG,iBAAiB,IAAI,EAAE,KAAK,UAAU,EAAE;AAAA,IACtD;AAKA,WAAO;AAAA,EACT;AAEA,QAAM,UAAU,IAAI,IAAI,SAAS;AACjC,QAAM,eAAe,YAAY,OAAO,CAAC,OAAO,QAAQ,IAAI,EAAE,CAAC;AAC/D,SAAO;AAAA,IACL,GAAG;AAAA,IACH,IAAI,EAAE,KAAK,aAAa;AAAA,EAC1B;AACF;",
   "names": []
 }

package/dist/lib/crud/query-params.js

@@ -0,0 +1,33 @@
+import { parseCommaSeparatedList } from "@open-mercato/shared/lib/string";
+function buildQueryParams(searchParams) {
+  const grouped = /* @__PURE__ */ new Map();
+  searchParams.forEach((value, key) => {
+    const existing = grouped.get(key);
+    if (existing) existing.push(value);
+    else grouped.set(key, [value]);
+  });
+  return Object.fromEntries(
+    Array.from(grouped, ([key, values]) => [
+      key,
+      values.length === 1 ? values[0] : values
+    ])
+  );
+}
+function toQueryValueList(raw) {
+  const candidates = Array.isArray(raw) ? raw : [raw];
+  const out = [];
+  for (const candidate of candidates) {
+    if (typeof candidate !== "string") continue;
+    out.push(...parseCommaSeparatedList(candidate));
+  }
+  return out;
+}
+function readQueryParamList(searchParams, key) {
+  return toQueryValueList(searchParams.getAll(key));
+}
+export {
+  buildQueryParams,
+  readQueryParamList,
+  toQueryValueList
+};
+//# sourceMappingURL=query-params.js.map

package/dist/lib/crud/query-params.js.map

@@ -0,0 +1,7 @@
+{
+  "version": 3,
+  "sources": ["../../../src/lib/crud/query-params.ts"],
+  "sourcesContent": ["/**\n * Query-string parsing helpers shared by every `makeCrudRoute` handler and by\n * routes that read `URLSearchParams` directly.\n *\n * `Object.fromEntries(url.searchParams.entries())` keeps only the last value of\n * a repeated key, so `?status=win&status=loose` reached route schemas as\n * `'loose'` and every earlier selection was dropped before validation ran\n * (#5548). `buildQueryParams` groups repeats instead.\n */\n\nimport { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'\n\nexport type QueryParamValue = string | string[]\n\n/**\n * Group a query string into a plain object, preserving repeated keys.\n *\n * A key that occurs once keeps its raw string value \u2014 that is what today's\n * `z.string()` schemas expect and nothing about them has to change. A key that\n * occurs two or more times becomes the array of its values, which is what a\n * `z.array(z.string())` (or `z.union([z.string(), z.array(z.string())])`)\n * branch has always advertised.\n *\n * Values are never split on commas here: `?ids=a,b` and `?search=foo,bar` carry\n * comma semantics that belong to the individual route, not to the generic\n * parser. Use `readQueryParamList` / `toQueryValueList` where a field's contract\n * says a comma separates values.\n *\n * Repeated values are treated as a set by the list response cache: its key\n * serializer sorts them, so `?k=a&k=b` and `?k=b&k=a` share one entry even\n * though the schema now receives `['a','b']` and `['b','a']` respectively. Do\n * not declare a repeated param whose order carries meaning.\n *\n * The result is assembled with `Object.fromEntries`, which defines own data\n * properties. Assigning into an object literal instead would run the\n * `__proto__` setter, so `?__proto__=a&__proto__=b` would replace the returned\n * object's prototype and drop the key rather than carrying it to the schema.\n */\nexport function buildQueryParams(searchParams: URLSearchParams): Record<string, QueryParamValue> {\n  const grouped = new Map<string, string[]>()\n  searchParams.forEach((value, key) => {\n    const existing = grouped.get(key)\n    if (existing) existing.push(value)\n    else grouped.set(key, [value])\n  })\n  return Object.fromEntries(\n    Array.from(grouped, ([key, values]): [string, QueryParamValue] => [\n      key,\n      values.length === 1 ? values[0] : values,\n    ]),\n  )\n}\n\n/**\n * Normalize a raw query value \u2014 a single string, an array of repeated values,\n * or nothing \u2014 into the list it stands for. Comma-separated and repeated forms\n * are equivalent here, so `?k=a,b&k=c` yields `['a', 'b', 'c']`.\n */\nexport function toQueryValueList(raw: unknown): string[] {\n  const candidates = Array.isArray(raw) ? raw : [raw]\n  const out: string[] = []\n  for (const candidate of candidates) {\n    if (typeof candidate !== 'string') continue\n    out.push(...parseCommaSeparatedList(candidate))\n  }\n  return out\n}\n\n/**\n * Read every value supplied for `key`, accepting both the repeated\n * (`?k=a&k=b`) and the comma-separated (`?k=a,b`) form.\n */\nexport function readQueryParamList(searchParams: URLSearchParams, key: string): string[] {\n  return toQueryValueList(searchParams.getAll(key))\n}\n"],
+  "mappings": "AAUA,SAAS,+BAA+B;AA4BjC,SAAS,iBAAiB,cAAgE;AAC/F,QAAM,UAAU,oBAAI,IAAsB;AAC1C,eAAa,QAAQ,CAAC,OAAO,QAAQ;AACnC,UAAM,WAAW,QAAQ,IAAI,GAAG;AAChC,QAAI,SAAU,UAAS,KAAK,KAAK;AAAA,QAC5B,SAAQ,IAAI,KAAK,CAAC,KAAK,CAAC;AAAA,EAC/B,CAAC;AACD,SAAO,OAAO;AAAA,IACZ,MAAM,KAAK,SAAS,CAAC,CAAC,KAAK,MAAM,MAAiC;AAAA,MAChE;AAAA,MACA,OAAO,WAAW,IAAI,OAAO,CAAC,IAAI;AAAA,IACpC,CAAC;AAAA,EACH;AACF;AAOO,SAAS,iBAAiB,KAAwB;AACvD,QAAM,aAAa,MAAM,QAAQ,GAAG,IAAI,MAAM,CAAC,GAAG;AAClD,QAAM,MAAgB,CAAC;AACvB,aAAW,aAAa,YAAY;AAClC,QAAI,OAAO,cAAc,SAAU;AACnC,QAAI,KAAK,GAAG,wBAAwB,SAAS,CAAC;AAAA,EAChD;AACA,SAAO;AACT;AAMO,SAAS,mBAAmB,cAA+B,KAAuB;AACvF,SAAO,iBAAiB,aAAa,OAAO,GAAG,CAAC;AAClD;",
+  "names": []
+}

package/dist/lib/version.js

@@ -1,4 +1,4 @@
-const APP_VERSION = "0.7.1-develop.7102.1.b41f7e3e51";
+const APP_VERSION = "0.7.1-develop.7103.1.41ff100d93";
 const appVersion = APP_VERSION;
 export {
   APP_VERSION,

package/dist/lib/version.js.map

@@ -1,7 +1,7 @@
 {
   "version": 3,
   "sources": ["../../src/lib/version.ts"],
-  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7102.1.b41f7e3e51';\nexport const appVersion = APP_VERSION;\n"],
+  "sourcesContent": ["// Build-time generated version\nexport const APP_VERSION = '0.7.1-develop.7103.1.41ff100d93';\nexport const appVersion = APP_VERSION;\n"],
   "mappings": "AACO,MAAM,cAAc;AACpB,MAAM,aAAa;",
   "names": []
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@open-mercato/shared",
-  "version": "0.7.1-develop.7102.1.b41f7e3e51",
+  "version": "0.7.1-develop.7103.1.41ff100d93",
   "license": "MIT",
   "type": "module",
   "main": "./dist/index.js",
@@ -109,7 +109,7 @@
     "@mikro-orm/core": "^7.1.8",
     "@mikro-orm/decorators": "^7.1.8",
     "@mikro-orm/postgresql": "^7.1.8",
-    "@open-mercato/cache": "0.7.1-develop.7102.1.b41f7e3e51",
+    "@open-mercato/cache": "0.7.1-develop.7103.1.41ff100d93",
     "@types/html-to-text": "^9.0.4",
     "@types/sanitize-html": "^2.16.1",
     "dotenv": "^17.4.2",

package/src/lib/crud/__tests__/crud-factory.test.ts

@@ -370,6 +370,77 @@ describe('CRUD Factory', () => {
     })
   })
 
+  describe('repeated query parameters (#5548)', () => {
+    const makeFilterRoute = () => {
+      const seen: { status?: string | string[]; search?: string | string[] }[] = []
+      const route = makeCrudRoute({
+        metadata: { GET: { requireAuth: true } },
+        orm: { entity: Todo, idField: 'id', orgField: 'organizationId', tenantField: 'tenantId', softDeleteField: 'deletedAt' },
+        indexer: { entityType: 'example.todo' },
+        list: {
+          schema: querySchema.extend({
+            status: z.union([z.string(), z.array(z.string())]).optional(),
+            search: z.string().optional(),
+          }),
+          entityId: 'example.todo',
+          fields: ['id', 'title'],
+          buildFilters: (query) => {
+            seen.push({ status: (query as any).status, search: (query as any).search })
+            return {} as any
+          },
+        },
+      })
+      return { route, seen }
+    }
+
+    it('hands the list schema every value of a repeated key', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win&status=loose'))
+      expect(seen.at(-1)?.status).toEqual(['win', 'loose'])
+    })
+
+    it('still hands a plain string to a key that occurs once', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win'))
+      expect(seen.at(-1)?.status).toBe('win')
+    })
+
+    it('leaves a comma-bearing scalar untouched so free-text filters survive', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request(`http://x/api/example/todos?search=${encodeURIComponent('Smith, John')}&status=win`))
+      expect(seen.at(-1)?.search).toBe('Smith, John')
+      expect(seen.at(-1)?.status).toBe('win')
+    })
+
+    it('rejects a repeated occurrence of a single-valued param with 400 instead of silently keeping one value', async () => {
+      const { route, seen } = makeFilterRoute()
+      const res = await route.GET(new Request('http://x/api/example/todos?search=Smith&search=John'))
+      expect(res.status).toBe(400)
+      const body = await res.json()
+      expect(body.error).toBe('Invalid input')
+      expect(
+        (body.details as { path: (string | number)[] }[]).some((issue) => issue.path.includes('search')),
+      ).toBe(true)
+      expect(seen).toHaveLength(0)
+    })
+
+    it('resolves each ordering of the same repeated filter to the values that ordering sent', async () => {
+      const { route, seen } = makeFilterRoute()
+      await route.GET(new Request('http://x/api/example/todos?status=win&status=loose'))
+      await route.GET(new Request('http://x/api/example/todos?status=loose&status=win'))
+      expect(seen.at(-2)?.status).toEqual(['win', 'loose'])
+      expect(seen.at(-1)?.status).toEqual(['loose', 'win'])
+    })
+
+    it('keeps a repeated ids filter instead of dropping it entirely', async () => {
+      const idA = '550e8400-e29b-41d4-a716-446655440001'
+      const idB = '550e8400-e29b-41d4-a716-446655440002'
+      await route.GET(new Request(`http://x/api/example/todos?ids=${idA}&ids=${idB}`))
+      const queryArgs = queryEngine.query.mock.calls.at(-1)?.[1]
+      expect(queryArgs?.filters).toEqual({ id: { $in: [idA, idB] } })
+    })
+  })
+
   it('GET resolves a function-form list.fields projection per request (#2233)', async () => {
     const fieldsResolver = jest.fn((query: any) =>
       query?.id ? ['id', 'title', 'is_done', 'snapshot'] : ['id', 'title'],

package/src/lib/crud/__tests__/ids.test.ts

@@ -122,6 +122,35 @@ describe('crud ids helpers', () => {
     expect(isIdsParamProvided(null)).toBe(false)
   })
 
+  // #5548: once the factory groups repeated params, `?ids=a&ids=b` reaches these
+  // helpers as an array. Treating that as "not supplied" would silently drop the
+  // filter and return the full list — the same side channel #4143 closed.
+  it('parseIdsParam accepts the repeated-parameter form', () => {
+    expect(parseIdsParam([idA, idB])).toEqual([idA, idB])
+    expect(parseIdsParam([`${idA},${idB}`, idC])).toEqual([idA, idB, idC])
+    expect(parseIdsParam([idA, idA])).toEqual([idA])
+    expect(parseIdsParam([idA, idB, idC], 2)).toEqual([idA, idB])
+    expect(parseIdsParam([])).toEqual([])
+    expect(parseIdsParam(['invalid', 'also-invalid'])).toEqual([])
+  })
+
+  it('isIdsParamProvided recognizes the repeated-parameter form', () => {
+    expect(isIdsParamProvided([idA, idB])).toBe(true)
+    expect(isIdsParamProvided(['not-a-uuid'])).toBe(true)
+    expect(isIdsParamProvided([])).toBe(false)
+    expect(isIdsParamProvided(['', '  '])).toBe(false)
+  })
+
+  // "Supplied" is about the raw occurrence, not about what survives parsing:
+  // `?ids=,,,` carries no usable value but was still requested, so it must match
+  // nothing rather than fall back to the unfiltered list.
+  it('isIdsParamProvided treats a value that parses to nothing as still supplied', () => {
+    expect(isIdsParamProvided(',,,')).toBe(true)
+    expect(parseIdsParam(',,,')).toEqual([])
+    expect(isIdsParamProvided([',', ','])).toBe(true)
+    expect(parseIdsParam([',', ','])).toEqual([])
+  })
+
   it('mergeIdFilter matches nothing when ids param was provided but all invalid', () => {
     // Malformed input: parseIdsParam yields [], but the param WAS provided.
     expect(mergeIdFilter({}, parseIdsParam('not-a-uuid'), { idsParamProvided: true })).toEqual({

package/src/lib/crud/__tests__/query-params.test.ts

@@ -0,0 +1,98 @@
+import { buildQueryParams, readQueryParamList, toQueryValueList } from '@open-mercato/shared/lib/crud/query-params'
+
+describe('buildQueryParams', () => {
+  it('keeps a key that occurs once as a plain string', () => {
+    const params = new URLSearchParams('status=win&page=2')
+    expect(buildQueryParams(params)).toEqual({ status: 'win', page: '2' })
+  })
+
+  it('keeps every value of a repeated key instead of the last one (#5548)', () => {
+    const params = new URLSearchParams('status=win&status=loose')
+    expect(buildQueryParams(params)).toEqual({ status: ['win', 'loose'] })
+  })
+
+  it('preserves the order the values were supplied in', () => {
+    expect(buildQueryParams(new URLSearchParams('status=loose&status=win'))).toEqual({
+      status: ['loose', 'win'],
+    })
+  })
+
+  it('does not split a single value on commas, so comma contracts stay intact', () => {
+    const params = new URLSearchParams('ids=a,b&search=Smith, John')
+    expect(buildQueryParams(params)).toEqual({ ids: 'a,b', search: 'Smith, John' })
+  })
+
+  it('returns an empty object for an empty query string', () => {
+    expect(buildQueryParams(new URLSearchParams(''))).toEqual({})
+  })
+
+  it('keeps an empty repeated value so the caller can decide what it means', () => {
+    expect(buildQueryParams(new URLSearchParams('status=&status=win'))).toEqual({
+      status: ['', 'win'],
+    })
+  })
+
+  // A plain `out[key] = value` assignment runs the `__proto__` setter, which
+  // would swap the returned object's prototype for the array and drop the key.
+  // `Object.fromEntries` defines own data properties, matching what the parse
+  // site did before this change.
+  it('carries a __proto__ key as an own property instead of touching the prototype', () => {
+    const repeated = buildQueryParams(new URLSearchParams('__proto__=a&__proto__=b'))
+    expect(Object.getPrototypeOf(repeated)).toBe(Object.prototype)
+    expect(Object.prototype.hasOwnProperty.call(repeated, '__proto__')).toBe(true)
+    expect(Object.getOwnPropertyDescriptor(repeated, '__proto__')?.value).toEqual(['a', 'b'])
+
+    const single = buildQueryParams(new URLSearchParams('__proto__=a'))
+    expect(Object.getPrototypeOf(single)).toBe(Object.prototype)
+    expect(Object.getOwnPropertyDescriptor(single, '__proto__')?.value).toBe('a')
+  })
+
+  it('rejects the Object.fromEntries shape this replaced', () => {
+    // Regression guard: reverting the parse site to
+    // `Object.fromEntries(url.searchParams.entries())` makes this fail.
+    const params = new URLSearchParams('status=win&status=loose')
+    expect(buildQueryParams(params)).not.toEqual(Object.fromEntries(params.entries()))
+  })
+})
+
+describe('toQueryValueList', () => {
+  it('turns a single string into a one-entry list', () => {
+    expect(toQueryValueList('win')).toEqual(['win'])
+  })
+
+  it('splits the comma form', () => {
+    expect(toQueryValueList('win,loose')).toEqual(['win', 'loose'])
+  })
+
+  it('flattens repeated values', () => {
+    expect(toQueryValueList(['win', 'loose'])).toEqual(['win', 'loose'])
+  })
+
+  it('treats the mixed form as one flat list', () => {
+    expect(toQueryValueList(['a,b', 'c'])).toEqual(['a', 'b', 'c'])
+  })
+
+  it('trims entries and drops empty ones', () => {
+    expect(toQueryValueList([' win ', '', ' , ', 'loose'])).toEqual(['win', 'loose'])
+  })
+
+  it('ignores non-string input', () => {
+    expect(toQueryValueList(undefined)).toEqual([])
+    expect(toQueryValueList(null)).toEqual([])
+    expect(toQueryValueList(42)).toEqual([])
+    expect(toQueryValueList([1, 'win'])).toEqual(['win'])
+  })
+})
+
+describe('readQueryParamList', () => {
+  it('reads the repeated and the comma form as the same list', () => {
+    const repeated = new URLSearchParams('status=win&status=loose')
+    const comma = new URLSearchParams('status=win,loose')
+    expect(readQueryParamList(repeated, 'status')).toEqual(['win', 'loose'])
+    expect(readQueryParamList(comma, 'status')).toEqual(['win', 'loose'])
+  })
+
+  it('returns an empty list for a key that was not supplied', () => {
+    expect(readQueryParamList(new URLSearchParams('status=win'), 'ownerUserId')).toEqual([])
+  })
+})

package/src/lib/crud/factory.ts

@@ -69,6 +69,7 @@ import type { EnricherContext } from './response-enricher'
 import type { ApiInterceptorMethod, InterceptorRequest, InterceptorResponse } from './api-interceptor'
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from './interceptor-runner'
 import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from './ids'
+import { buildQueryParams } from './query-params'
 import { mergeAdvancedFilters } from './advanced-filter-integration'
 import { parseExtensionHeaders } from '../umes/extension-headers'
 import { createGenericOptimisticLockReader } from './optimistic-lock'
@@ -1516,7 +1517,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         return json({ error: 'Not implemented' }, { status: 501 })
       }
       const url = new URL(request.url)
-      const rawQueryParams = Object.fromEntries(url.searchParams.entries())
+      const rawQueryParams = buildQueryParams(url.searchParams)
       profiler.mark('query_parsed')
       let validated = opts.list.schema.parse(rawQueryParams)
       profiler.mark('query_validated')
@@ -2870,7 +2871,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
       if (useCommand) {
         const action = opts.actions!.delete!
         const body = await request.json().catch(() => ({}))
-        const raw = { body, query: Object.fromEntries(url.searchParams.entries()) }
+        const raw = { body, query: buildQueryParams(url.searchParams) }
         const parsed = action.schema ? action.schema.parse(raw) : raw
         const interceptorInput =
           parsed && typeof parsed === 'object' && (parsed as Record<string, unknown>).body && typeof (parsed as Record<string, unknown>).body === 'object'
@@ -2889,7 +2890,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         const interceptedBody = interceptorRequestPayload.body ?? {}
         const reparsedRaw = {
           body: interceptedBody,
-          query: Object.fromEntries(url.searchParams.entries()),
+          query: buildQueryParams(url.searchParams),
         }
         const reparsed = action.schema ? action.schema.parse(reparsedRaw) : reparsedRaw
         const input = action.mapInput ? await action.mapInput({ parsed: reparsed, raw: reparsedRaw, ctx }) : reparsed
@@ -3006,7 +3007,7 @@ export function makeCrudRoute<TCreate = any, TUpdate = any, TList = any>(opts: C
         request,
         method: 'DELETE',
         body: idFrom === 'query' ? undefined : ({ id } as Record<string, unknown>),
-        query: idFrom === 'query' ? Object.fromEntries(url.searchParams.entries()) : undefined,
+        query: idFrom === 'query' ? buildQueryParams(url.searchParams) : undefined,
       })
       if (beforeInterceptors.errorResponse) return beforeInterceptors.errorResponse
       interceptorRequestPayload = beforeInterceptors.requestPayload

package/src/lib/crud/ids.ts

@@ -1,4 +1,5 @@
 import type { Where } from '@open-mercato/shared/lib/query/types'
+import { toQueryValueList } from './query-params'
 
 export const MAX_IDS_PER_REQUEST = 200
 
@@ -43,21 +44,23 @@ function readExistingIds(filter: unknown): string[] | null {
 }
 
 export function parseIdsParam(raw: unknown, maxIds: number = MAX_IDS_PER_REQUEST): string[] {
-  if (typeof raw !== 'string' || raw.trim().length === 0) return []
+  const values = toQueryValueList(raw)
+  if (values.length === 0) return []
   const safeMax = Number.isFinite(maxIds) && maxIds > 0 ? Math.floor(maxIds) : MAX_IDS_PER_REQUEST
-  const parsed = normalizeIdList(raw.split(','))
+  const parsed = normalizeIdList(values)
   return parsed.slice(0, safeMax)
 }
 
 /**
- * Whether an `?ids=` param was supplied at all (a non-empty string), regardless
- * of whether any value survived UUID validation. Lets a caller tell "no ids
- * filter requested" apart from "ids filter requested but every value was
- * malformed" — the latter must match nothing, not fall back to the full list
- * (#4143 Finding 3).
+ * Whether an `?ids=` param was supplied at all (a non-empty string, or repeated
+ * `?ids=` occurrences), regardless of whether any value survived UUID
+ * validation. Lets a caller tell "no ids filter requested" apart from "ids
+ * filter requested but every value was malformed" — the latter must match
+ * nothing, not fall back to the full list (#4143 Finding 3).
  */
 export function isIdsParamProvided(raw: unknown): boolean {
-  return typeof raw === 'string' && raw.trim().length > 0
+  const occurrences = Array.isArray(raw) ? raw : [raw]
+  return occurrences.some((value) => typeof value === 'string' && value.trim().length > 0)
 }
 
 export function mergeIdFilter<Fields extends Record<string, unknown>>(

package/src/lib/crud/query-params.ts

@@ -0,0 +1,75 @@
+/**
+ * Query-string parsing helpers shared by every `makeCrudRoute` handler and by
+ * routes that read `URLSearchParams` directly.
+ *
+ * `Object.fromEntries(url.searchParams.entries())` keeps only the last value of
+ * a repeated key, so `?status=win&status=loose` reached route schemas as
+ * `'loose'` and every earlier selection was dropped before validation ran
+ * (#5548). `buildQueryParams` groups repeats instead.
+ */
+
+import { parseCommaSeparatedList } from '@open-mercato/shared/lib/string'
+
+export type QueryParamValue = string | string[]
+
+/**
+ * Group a query string into a plain object, preserving repeated keys.
+ *
+ * A key that occurs once keeps its raw string value — that is what today's
+ * `z.string()` schemas expect and nothing about them has to change. A key that
+ * occurs two or more times becomes the array of its values, which is what a
+ * `z.array(z.string())` (or `z.union([z.string(), z.array(z.string())])`)
+ * branch has always advertised.
+ *
+ * Values are never split on commas here: `?ids=a,b` and `?search=foo,bar` carry
+ * comma semantics that belong to the individual route, not to the generic
+ * parser. Use `readQueryParamList` / `toQueryValueList` where a field's contract
+ * says a comma separates values.
+ *
+ * Repeated values are treated as a set by the list response cache: its key
+ * serializer sorts them, so `?k=a&k=b` and `?k=b&k=a` share one entry even
+ * though the schema now receives `['a','b']` and `['b','a']` respectively. Do
+ * not declare a repeated param whose order carries meaning.
+ *
+ * The result is assembled with `Object.fromEntries`, which defines own data
+ * properties. Assigning into an object literal instead would run the
+ * `__proto__` setter, so `?__proto__=a&__proto__=b` would replace the returned
+ * object's prototype and drop the key rather than carrying it to the schema.
+ */
+export function buildQueryParams(searchParams: URLSearchParams): Record<string, QueryParamValue> {
+  const grouped = new Map<string, string[]>()
+  searchParams.forEach((value, key) => {
+    const existing = grouped.get(key)
+    if (existing) existing.push(value)
+    else grouped.set(key, [value])
+  })
+  return Object.fromEntries(
+    Array.from(grouped, ([key, values]): [string, QueryParamValue] => [
+      key,
+      values.length === 1 ? values[0] : values,
+    ]),
+  )
+}
+
+/**
+ * Normalize a raw query value — a single string, an array of repeated values,
+ * or nothing — into the list it stands for. Comma-separated and repeated forms
+ * are equivalent here, so `?k=a,b&k=c` yields `['a', 'b', 'c']`.
+ */
+export function toQueryValueList(raw: unknown): string[] {
+  const candidates = Array.isArray(raw) ? raw : [raw]
+  const out: string[] = []
+  for (const candidate of candidates) {
+    if (typeof candidate !== 'string') continue
+    out.push(...parseCommaSeparatedList(candidate))
+  }
+  return out
+}
+
+/**
+ * Read every value supplied for `key`, accepting both the repeated
+ * (`?k=a&k=b`) and the comma-separated (`?k=a,b`) form.
+ */
+export function readQueryParamList(searchParams: URLSearchParams, key: string): string[] {
+  return toQueryValueList(searchParams.getAll(key))
+}