@open-mercato/shared 0.7.1-develop.7102.1.b41f7e3e51 → 0.7.1-develop.7104.1.1dd769bf1a

package/.turbo/turbo-build.log

@@ -1,2 +1,2 @@
-[build:shared] found 267 entry points
+[build:shared] found 268 entry points
 [build:shared] built successfully

package/AGENTS.md

@@ -253,6 +253,14 @@ MUST rules:
 - `message` is passed through verbatim and is never derived from an entity name — keep routing 404 copy through `translate(...)` so it stays translatable.
 - `assertFound` treats every falsy value as missing. Use it for entity/object lookups only, never to guard numbers or strings where `0`/`''` are valid results.
 
+### Query Parameter Parsing — MUST NOT rebuild the query object with `Object.fromEntries`
+
+```typescript
+import { buildQueryParams, readQueryParamList, toQueryValueList } from '@open-mercato/shared/lib/crud/query-params'
+```
+
+`Object.fromEntries(url.searchParams.entries())` keeps only the LAST value of a repeated key, so `?status=win&status=loose` silently becomes `'loose'` (#5548). `buildQueryParams(url.searchParams)` groups instead: a key seen once stays a string, a key seen twice or more becomes `string[]`. It never splits on commas, so `?ids=a,b` and free-text filters keep their literal value. Where a field's contract says a comma separates values, use `readQueryParamList(searchParams, key)` (or `toQueryValueList(raw)` on an already-parsed value) — they treat the repeated and comma forms as equivalent. MUST use these instead of a per-route `getAll` + split + trim copy.
+
 ### CRUD Multi-ID Filtering
 
 - Use `parseIdsParam()` and `mergeIdFilter()` from `@open-mercato/shared/lib/crud/ids` for factory-level `ids` query support.

package/dist/lib/crud/factory.js

@@ -48,6 +48,7 @@ import { getTranslationOverlayPlugin } from "@open-mercato/shared/lib/localizati
 import { applyResponseEnrichers, applyResponseEnricherToRecord, resolveListCacheEnricherPlan } from "./enricher-runner.js";
 import { runApiInterceptorsAfter, runApiInterceptorsBefore } from "./interceptor-runner.js";
 import { mergeIdFilter, parseIdsParam, isIdsParamProvided } from "./ids.js";
+import { buildQueryParams } from "./query-params.js";
 import { mergeAdvancedFilters } from "./advanced-filter-integration.js";
 import { parseExtensionHeaders } from "../umes/extension-headers.js";
 import { createGenericOptimisticLockReader } from "./optimistic-lock.js";
@@ -991,7 +992,7 @@ function makeCrudRoute(opts) {
         return json({ error: "Not implemented" }, { status: 501 });
       }
       const url = new URL(request.url);
-      const rawQueryParams = Object.fromEntries(url.searchParams.entries());
+      const rawQueryParams = buildQueryParams(url.searchParams);
       profiler.mark("query_parsed");
       let validated = opts.list.schema.parse(rawQueryParams);
       profiler.mark("query_validated");
@@ -2202,7 +2203,7 @@ function makeCrudRoute(opts) {
       if (useCommand) {
         const action = opts.actions.delete;
         const body = await request.json().catch(() => ({}));
-        const raw = { body, query: Object.fromEntries(url.searchParams.entries()) };
+        const raw = { body, query: buildQueryParams(url.searchParams) };
         const parsed = action.schema ? action.schema.parse(raw) : raw;
         const interceptorInput = parsed && typeof parsed === "object" && parsed.body && typeof parsed.body === "object" ? parsed.body : body;
         const beforeInterceptors2 = await applyInterceptorsBefore({
@@ -2218,7 +2219,7 @@ function makeCrudRoute(opts) {
         const interceptedBody = interceptorRequestPayload.body ?? {};
         const reparsedRaw = {
           body: interceptedBody,
-          query: Object.fromEntries(url.searchParams.entries())
+          query: buildQueryParams(url.searchParams)
         };
         const reparsed = action.schema ? action.schema.parse(reparsedRaw) : reparsedRaw;
         const input = action.mapInput ? await action.mapInput({ parsed: reparsed, raw: reparsedRaw, ctx }) : reparsed;
@@ -2321,7 +2322,7 @@ function makeCrudRoute(opts) {
         request,
         method: "DELETE",
         body: idFrom === "query" ? void 0 : { id },
-        query: idFrom === "query" ? Object.fromEntries(url.searchParams.entries()) : void 0
+        query: idFrom === "query" ? buildQueryParams(url.searchParams) : void 0
       });
       if (beforeInterceptors.errorResponse) return beforeInterceptors.errorResponse;
       interceptorRequestPayload = beforeInterceptors.requestPayload;