@open-mercato/shared 0.8.1-develop.7275.1.f772b944d4 → 0.8.1-develop.7295.1.d0e0e33014

package/src/lib/query/__tests__/engine.test.ts

@@ -287,7 +287,13 @@ describe('BasicQueryEngine (Kysely)', () => {
     })
     expect(hasTenantFilter).toBe(true)
     const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'users')
-    const hasCfOrder = baseCall._ops.orderBys.some((o: any) => o[0] === 'cf_vip')
+    // The sort rides its own dedicated `__sort` alias, not the jsonb projection
+    // alias `cf_vip` — see the dedicated-alias test above (#5674).
+    const hasCfOrder = baseCall._ops.orderBys.some((o: any) => {
+      const expr = o[0]
+      return typeof expr?.toOperationNode === 'function'
+        && JSON.stringify(expr.toOperationNode()).includes('cf_vip__sort')
+    })
     expect(hasCfOrder).toBe(true)
     const hasExtJoin = baseCall._ops.joins.length > 0
     expect(hasExtJoin).toBe(true)
@@ -303,13 +309,102 @@ describe('BasicQueryEngine (Kysely)', () => {
       tenantId: 't1',
     })
     const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'users')
-    expect(baseCall._ops.orderBys).toContainEqual(['cf_vip', 'asc'])
+    // The sort rides its own dedicated scalar alias, never the jsonb projection
+    // alias — ordering by `to_jsonb(...)` compares arrays after every scalar
+    // string regardless of contents (#5674). Trailing entry is the stable `id`
+    // tiebreak appended when the sort didn't already end on `id`.
+    expect(baseCall._ops.orderBys).toHaveLength(2)
+    const [sortExpr] = baseCall._ops.orderBys[0]
+    expect(JSON.stringify(sortExpr.toOperationNode())).toContain('cf_vip__sort')
+    expect(baseCall._ops.orderBys[1]).toEqual(['users.id', 'asc'])
     // Ordering by an alias the query never selected is a Postgres 42703, so the
     // sort has to bring its own projection and joins along (#5521).
-    expect(selectAliases(baseCall)).toContain('cf_vip')
+    expect(selectAliases(baseCall)).toContain('cf_vip__sort')
     expect(baseCall._ops.joins.length).toBeGreaterThan(0)
   })
 
+  test('a numeric-kind cf sort casts to numeric instead of ordering as text (#5674)', async () => {
+    const fakeDb = createFakeKysely({
+      custom_field_defs: [
+        { key: 'rank', entity_id: 'auth:user', is_active: true, config_json: '{}', kind: 'float' },
+      ],
+    })
+    const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
+    await engine.query('auth:user', {
+      fields: ['id', 'email'],
+      sort: [{ field: 'cf:rank', dir: SortDir.Asc }],
+      organizationId: '1',
+      tenantId: 't1',
+    })
+    const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'users')
+    // The cast lives on the dedicated sort projection, not the ORDER BY clause,
+    // which just references that projection's alias by name.
+    const sortSelect = baseCall._ops.selects.find((s: any) => String(s?.alias ?? '') === 'cf_rank__sort')
+    expect(sortSelect).toBeTruthy()
+    const serialized = JSON.stringify(sortSelect.toOperationNode())
+    expect(serialized).toContain('::numeric')
+    expect(serialized).toContain('value_float')
+    expect(baseCall._ops.orderBys).toHaveLength(2)
+    const [orderExpr] = baseCall._ops.orderBys[0]
+    expect(JSON.stringify(orderExpr.toOperationNode())).toContain('NULLS LAST')
+    expect(baseCall._ops.orderBys[1]).toEqual(['users.id', 'asc'])
+  })
+
+  test('an encrypted base sort combined with a cf: sort still orders by the cf value, and the __sort alias never leaks into returned rows (#5674)', async () => {
+    const fakeDb = createFakeKysely({
+      users: [
+        // '1' and '2' decrypt to the same email — only the cf:vip tiebreak can
+        // put them in the right relative order. '3' decrypts to a later email
+        // so it sorts last regardless of its cf:vip value.
+        { id: '1', tenant_id: 't1', organization_id: 'org1', email: 'cipher-1', cf_vip__sort: 'b' },
+        { id: '2', tenant_id: 't1', organization_id: 'org1', email: 'cipher-2', cf_vip__sort: 'a' },
+        { id: '3', tenant_id: 't1', organization_id: 'org1', email: 'cipher-3', cf_vip__sort: 'z' },
+      ],
+      'information_schema.columns': [
+        { table_name: 'users', column_name: 'id' },
+        { table_name: 'users', column_name: 'tenant_id' },
+        { table_name: 'users', column_name: 'organization_id' },
+        { table_name: 'users', column_name: 'deleted_at' },
+        { table_name: 'users', column_name: 'email' },
+      ],
+    })
+    const emailById: Record<string, string> = {
+      '1': 'dup@example.com',
+      '2': 'dup@example.com',
+      '3': 'zzz@example.com',
+    }
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({
+        isEnabled: () => true,
+        getEncryptedFieldNames: async () => ['email'],
+        decryptEntityPayload: async (_entityId, payload) => ({
+          email: emailById[String(payload.id)],
+        }),
+      }),
+    )
+
+    const result = await engine.query('auth:user', {
+      tenantId: 't1',
+      organizationId: 'org1',
+      fields: ['id', 'email'],
+      sort: [{ field: 'email', dir: SortDir.Asc }, { field: 'cf:vip', dir: SortDir.Asc }],
+      page: { page: 1, pageSize: 3 },
+    })
+
+    // Before the fix, `sortRowsInMemory` read `cf:vip` through candidates that
+    // never included the dedicated `cf_vip__sort` projection alias, so the value
+    // came back `undefined` and the cf: sort silently dropped out of the
+    // ordering — '1' and '2' would then only tie-break by `id`.
+    expect(result.items.map((item: any) => item.id)).toEqual(['2', '1', '3'])
+    // The synthetic sort alias is internal-only — it must never leak into a
+    // returned row as a phantom custom field `vip__sort` (#5674 review).
+    for (const item of result.items) {
+      expect(item).not.toHaveProperty('cf_vip__sort')
+    }
+  })
+
   test('a cf sort that resolves to no definition is dropped, not ordered by', async () => {
     const fakeDb = createFakeKysely()
     const engine = new BasicQueryEngine({} as any, () => fakeDb as any)
@@ -322,8 +417,9 @@ describe('BasicQueryEngine (Kysely)', () => {
     const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'users')
     // Dropping an unresolvable sort is what the base-column branch already does;
     // the alternative here was an ORDER BY over a column that is never selected.
+    // No cf sort survived, so there is nothing to tiebreak either.
     expect(baseCall._ops.orderBys).toEqual([])
-    expect(selectAliases(baseCall)).not.toContain('cf_no_such_key')
+    expect(selectAliases(baseCall)).not.toContain('cf_no_such_key__sort')
   })
 
   test('customFieldSources join additional profiles for custom fields', async () => {
@@ -1041,7 +1137,12 @@ describe('BasicQueryEngine (Kysely)', () => {
     })
 
     const baseCall = fakeDb._calls.find((call: any) => call._ops.table === 'customer_entities')
-    expect(baseCall._ops.orderBys).toEqual([['customer_entities.display_name', 'asc']])
+    // A trailing `id` tiebreak is appended when the sort didn't already end on
+    // `id`, so ties/NULLs don't reorder arbitrarily across pages (#5674).
+    expect(baseCall._ops.orderBys).toEqual([
+      ['customer_entities.display_name', 'asc'],
+      ['customer_entities.id', 'asc'],
+    ])
     expect(baseCall._ops.limits).toBe(10)
     expect(baseCall._ops.offsets).toBe(10)
   })
@@ -1302,9 +1403,9 @@ describe('BasicQueryEngine entity-extension joins', () => {
 })
 
 describe('BasicQueryEngine like/ilike routing by column encryption', () => {
-  // The gate is opt-in: OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS defaults to false and the
-  // legacy rewrite-everything behavior stays. These cases flip it on; the last one pins the
-  // default off.
+  // The gate stays off by default per #5383, so these cases opt in explicitly to pin the
+  // declared-ILIKE behavior a deployment gets by setting the switch; the last one flips it back
+  // off and pins the legacy rewrite-everything behavior that is the shipped default.
   beforeEach(() => {
     process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS = 'true'
   })
@@ -1327,7 +1428,15 @@ describe('BasicQueryEngine like/ilike routing by column encryption', () => {
     ],
   })
 
-  test('a plaintext base column keeps exact SQL ILIKE even when tokens are available', async () => {
+  const ilikePatternsFor = (fakeDb: any, table: string, column: string): string[] => {
+    const baseCall = fakeDb._calls.find((b: any) => b._ops.table === table)
+    if (!baseCall) return []
+    return baseCall._ops.wheres
+      .filter((w: any) => Array.isArray(w) && String(w[0]).includes(column) && w[1] === 'ilike')
+      .map((w: any) => String(w[2]))
+  }
+
+  test('a plaintext base column runs as SQL ILIKE even when tokens are available', async () => {
     const fakeDb = fakeDbWithTokens()
     const engine = new BasicQueryEngine(
       {} as any,
@@ -1344,12 +1453,33 @@ describe('BasicQueryEngine like/ilike routing by column encryption', () => {
     })
 
     expect(applySearchTokensSpy).not.toHaveBeenCalled()
-    const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'customer_entities')
-    expect(baseCall).toBeTruthy()
-    const ilikeWhere = baseCall._ops.wheres.some(
-      (w: any) => Array.isArray(w) && String(w[0]).includes('display_name') && w[1] === 'ilike' && w[2] === '%ZK 1/2026%',
+    // Multi-word terms are ANDed per word rather than matched as one literal substring -- see the
+    // TC-RESO-009 case below for why that distinction is the whole point of the reroute.
+    expect(ilikePatternsFor(fakeDb, 'customer_entities', 'display_name')).toEqual(['%ZK%', '%1/2026%'])
+  })
+
+  // #5803 regression guard, reported by CI on the first shape of this fix. The token subquery
+  // matched a value carrying EVERY token in any order with anything in between, so
+  // `?search=Warehouse <stamp>` matched `Warehouse A <stamp>`; TC-RESO-009 pins that as required
+  // behavior. One verbatim `ILIKE '%Warehouse <stamp>%'` would not match -- the `A ` sits between
+  // the words -- so the reroute has to AND one containment predicate per word to be a fix rather
+  // than a trade of one broken search for another.
+  test('a multi-word term matches words in order-independent positions, as the token path did', async () => {
+    const fakeDb = fakeDbWithTokens()
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({ getEncryptedFieldNames: async () => [] }) as any,
     )
-    expect(ilikeWhere).toBe(true)
+
+    await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      fields: ['id'],
+      filters: { display_name: { $ilike: '%Warehouse 1757%' } },
+      page: { page: 1, pageSize: 10 },
+    })
+
+    expect(ilikePatternsFor(fakeDb, 'customer_entities', 'display_name')).toEqual(['%Warehouse%', '%1757%'])
   })
 
   test('an encrypted base column still routes through search tokens', async () => {
@@ -1433,8 +1563,70 @@ describe('BasicQueryEngine like/ilike routing by column encryption', () => {
     expect(applySearchTokensSpy).toHaveBeenCalled()
   })
 
-  test('with the flag off (default) the token rewrite is kept even for plaintext columns', () => {
-    delete process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS
+  // #5803: the reported regression. `2026-08` and `2026-01` tokenize to the identical set
+  // {202, 2026} because the fragment that tells them apart is shorter than minTokenLength, so the
+  // token rewrite answered a search for one period with the other one. The declared predicate has
+  // to reach SQL verbatim for the exact row to come back at all.
+  test('a search term whose distinguishing fragment is dropped by the tokenizer still reaches SQL verbatim', async () => {
+    const fakeDb = createFakeKysely({
+      accounting_periods: [],
+      search_tokens: [{ one: 1 }],
+      'information_schema.tables': [{ table_name: 'search_tokens' }],
+      'information_schema.columns': [
+        { table_name: 'accounting_periods', column_name: 'tenant_id' },
+        { table_name: 'accounting_periods', column_name: 'period_code' },
+      ],
+    })
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({ getEncryptedFieldNames: async () => [] }) as any,
+    )
+    const applySearchTokensSpy = jest.spyOn(engine as any, 'applySearchTokens')
+
+    await engine.query('accounting:accounting_period', {
+      tenantId: 't1',
+      fields: ['id'],
+      filters: { period_code: { $ilike: '%2026-08%' } },
+      page: { page: 1, pageSize: 10 },
+    })
+
+    expect(applySearchTokensSpy).not.toHaveBeenCalled()
+    const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'accounting_periods')
+    expect(baseCall).toBeTruthy()
+    const ilikeWhere = baseCall._ops.wheres.some(
+      (w: any) => Array.isArray(w) && String(w[0]).includes('period_code') && w[1] === 'ilike' && w[2] === '%2026-08%',
+    )
+    expect(ilikeWhere).toBe(true)
+  })
+
+  // #5803: `08` tokenizes to nothing at all, and the token path answered that with "no predicate"
+  // -- every row in the table. A filter that matches everything is never the honest reading of a
+  // declared containment predicate.
+  test('a term too short to tokenize filters instead of being dropped', async () => {
+    const fakeDb = fakeDbWithTokens()
+    const engine = new BasicQueryEngine(
+      {} as any,
+      () => fakeDb as any,
+      () => ({ getEncryptedFieldNames: async () => [] }) as any,
+    )
+
+    await engine.query('customers:customer_entity', {
+      tenantId: 't1',
+      fields: ['id'],
+      filters: { display_name: { $ilike: '%08%' } },
+      page: { page: 1, pageSize: 10 },
+    })
+
+    const baseCall = fakeDb._calls.find((b: any) => b._ops.table === 'customer_entities')
+    const ilikeWhere = baseCall._ops.wheres.some(
+      (w: any) => Array.isArray(w) && String(w[0]).includes('display_name') && w[1] === 'ilike' && w[2] === '%08%',
+    )
+    expect(ilikeWhere).toBe(true)
+  })
+
+  test('with the flag explicitly off the token rewrite is kept even for plaintext columns', () => {
+    process.env.OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS = 'false'
     const fakeDb = fakeDbWithTokens()
     const engine = new BasicQueryEngine(
       {} as any,

package/src/lib/query/encrypted-sort.ts

@@ -20,7 +20,14 @@ export function fieldNameCandidates(field: string): string[] {
   const raw = String(field || '').trim()
   if (!raw) return []
   const candidates = [raw, toSnakeCase(raw), toCamelCase(raw)]
-  if (raw.startsWith('cf:')) candidates.push(raw.replace(/[^a-zA-Z0-9_]/g, '_'))
+  if (raw.startsWith('cf:')) {
+    const sanitized = raw.replace(/[^a-zA-Z0-9_]/g, '_')
+    // The ORM query engine's plaintext-sort candidate scan projects a `cf:`
+    // sort key only under its dedicated `<alias>__sort` projection alias, never
+    // the plain jsonb-aggregate alias — so the in-memory sort needs that exact
+    // name to find the value on the phase-1 candidate rows (#5674 review).
+    candidates.push(sanitized, `${sanitized}__sort`)
+  }
   return Array.from(new Set(candidates))
 }
 

package/src/lib/query/engine.ts

@@ -20,13 +20,16 @@ import {
   type SearchTokenProbeQueryBuilder,
 } from '../search/availability'
 import { tokenizeText } from '../search/tokenize'
+import { buildContainmentPatterns } from '../search/containment'
 import { fieldNameCandidates } from './encrypted-sort'
 import { isTenantDataEncryptionEnabled } from '../encryption/toggles'
 import { runBeforeQueryPipeline, runAfterQueryPipeline, type QueryExtensionContext } from './query-extension-runner'
 import {
   buildCustomFieldDefinitionIndexFromRows,
+  normalizeDefinitionKey,
   resolveCfDefIndexOrgCandidates,
   type CustomFieldDefinitionRow,
+  type CustomFieldDefinitionSummary,
   type ResolvedCustomFieldDefinitions,
 } from '../crud/custom-field-definition-index'
 import { warnOnCiphertextLikeFallback } from './ciphertext-search-warning'
@@ -293,6 +296,25 @@ function buildFilterableCustomFieldJoins(
   })
 }
 
+/** Custom field kinds stored numerically (`custom_field_values.value_int`/`value_float`) — sort numerically, not as text (#5674). */
+const NUMERIC_CF_SORT_KINDS = new Set(['integer', 'float'])
+
+/**
+ * Pick the winning `kind` for a `cf:` sort key from an already-resolved
+ * definition list — org-scoped beats tenant-wide beats global, same
+ * precedence as the dedicated sort-kind lookup (#5674 review).
+ */
+function pickCfSortKind(defs: CustomFieldDefinitionSummary[] | undefined): string | null {
+  if (!defs || !defs.length) return null
+  let winner: { kind: string; specificity: number } | null = null
+  for (const def of defs) {
+    if (!def.kind) continue
+    const specificity = def.organizationId != null ? 2 : def.tenantId != null ? 1 : 0
+    if (!winner || specificity >= winner.specificity) winner = { kind: def.kind, specificity }
+  }
+  return winner?.kind ?? null
+}
+
 function computeCustomFieldScore(cfg: Record<string, unknown>, kind: string, entityIndex: number) {
   const listVisibleScore = cfg.listVisible === false ? 0 : 1
   const formEditableScore = cfg.formEditable === false ? 0 : 1
@@ -446,9 +468,9 @@ export class BasicQueryEngine implements QueryEngine {
       ? await this.searchAvailability().hasTokens(String(entity), opts.tenantId ?? null, orgScope)
       : false
     const searchActive = searchEnabled && hasSearchTokens
-    // Opt-in via OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS (default false: the pre-existing
-    // rewrite-everything behavior is kept). When enabled, base-column like/ilike is rerouted
-    // through search tokens ONLY for encrypted columns, where
+    // Gated on OM_SEARCH_USE_ILIKE_FOR_NON_ENCRYPTED_FIELDS (default false per #5383; set it to
+    // true to opt into the #5803 fix ahead of that follow-up). When enabled, base-column
+    // like/ilike is rerouted through search tokens ONLY for encrypted columns, where
     // ILIKE against ciphertext cannot match. On a plaintext column SQL ILIKE is exact, and the token
     // rewrite silently changes the result set: tokenization splits on non-alphanumerics and drops
     // tokens shorter than minTokenLength, so a document-number search like "ZK 1/2026" degrades to
@@ -617,6 +639,27 @@ export class BasicQueryEngine implements QueryEngine {
           })
         }
       }
+      // A PLAINTEXT base column the gate above kept off the token path: apply the declared
+      // containment once per word so the token subquery's word-order-independent matching survives
+      // the reroute (#5803 / TC-RESO-009). Chained `where`s ARE the AND the token
+      // `having count(distinct)` did. `fieldName` is required, so this never fires for a JOINed
+      // column — `applyJoinFilters` calls `applyFilterOp` without it (below), and that predicate
+      // keeps its pre-existing literal-containment behavior unchanged.
+      if (
+        (op === 'like' || op === 'ilike') &&
+        typeof value === 'string' &&
+        searchActive &&
+        fieldName &&
+        encryptedLikeFields !== null &&
+        !isEncryptedLikeField(encryptedLikeFields, fieldName)
+      ) {
+        const patterns = buildContainmentPatterns(value)
+        if (patterns.length > 1) {
+          let next = builder
+          for (const pattern of patterns) next = this.applyColumnOp(next, column, op, pattern)
+          return next
+        }
+      }
       return this.applyColumnOp(builder, column, op, value)
     }
 
@@ -703,6 +746,7 @@ export class BasicQueryEngine implements QueryEngine {
       hasJoinedAggregates: boolean
       cfJsonAliases: Set<string>
       cfMultiAliasByAlias: Map<string, string>
+      cfSortAliases: string[]
       resolvedCustomFieldDefinitions: ResolvedCustomFieldDefinitions | undefined
     }
 
@@ -994,10 +1038,70 @@ export class BasicQueryEngine implements QueryEngine {
         }
       }
 
+      // A `cf:` sort needs to know the field's declared `kind` so the ORDER BY
+      // expression can cast numeric kinds instead of ordering by jsonb text
+      // (#5674). Org-scoped beats tenant-wide beats global for the same key —
+      // a same-key definition from an unrelated organization in the tenant
+      // never gets to decide the kind (#5674 review).
+      const cfSortKeys = Array.from(new Set(
+        resolvedSorts.filter((sort) => sort.field.startsWith('cf:')).map((sort) => sort.field.slice(3))
+      ))
+      const cfSortKinds = new Map<string, string>()
+      if (cfSortKeys.length > 0) {
+        // `includeCustomFields === true` already resolved every definition for
+        // these entities into `resolvedCustomFieldDefinitions` above — reuse it
+        // instead of a second `custom_field_defs` round trip (#5674 review).
+        const keysNeedingQuery: string[] = []
+        for (const key of cfSortKeys) {
+          const kind = resolvedCustomFieldDefinitions
+            ? pickCfSortKind(resolvedCustomFieldDefinitions.index.get(normalizeDefinitionKey(key)))
+            : null
+          if (kind) cfSortKinds.set(key, kind)
+          else keysNeedingQuery.push(key)
+        }
+        if (keysNeedingQuery.length > 0) {
+          const sortEntityIds = Array.from(new Set(
+            keysNeedingQuery
+              .map((key) => keySource.get(key)?.entityId)
+              .filter((id): id is EntityId => Boolean(id))
+              .map((id) => String(id))
+          ))
+          if (sortEntityIds.length > 0) {
+            const cfSortOrgCandidates = resolveCfDefIndexOrgCandidates(opts.organizationIds, opts.organizationId ?? null)
+            const kindRows = await db
+              .selectFrom('custom_field_defs' as any)
+              .select(['key' as any, 'kind' as any, 'organization_id' as any, 'tenant_id' as any])
+              .where('entity_id' as any, 'in', sortEntityIds)
+              .where('key' as any, 'in', keysNeedingQuery)
+              .where('is_active' as any, '=', true)
+              .where((eb: any) => eb.or([
+                eb('tenant_id' as any, '=', tenantId),
+                eb('tenant_id' as any, 'is', null),
+              ]))
+              .where((eb: any) => cfSortOrgCandidates.length
+                ? eb.or([
+                    eb('organization_id' as any, 'is', null),
+                    eb('organization_id' as any, 'in', cfSortOrgCandidates),
+                  ])
+                : eb('organization_id' as any, 'is', null))
+              .execute() as Array<{ key: string; kind: string | null; organization_id: string | null; tenant_id: string | null }>
+            const winners = new Map<string, { kind: string; specificity: number }>()
+            for (const row of kindRows) {
+              if (!row.kind) continue
+              const specificity = row.organization_id != null ? 2 : row.tenant_id != null ? 1 : 0
+              const existing = winners.get(row.key)
+              if (!existing || specificity >= existing.specificity) winners.set(row.key, { kind: row.kind, specificity })
+            }
+            for (const [key, entry] of winners) cfSortKinds.set(key, entry.kind)
+          }
+        }
+      }
+
       const cfValueExprByKey: Record<string, RawBuilder<string | null>> = {}
       const cfSelectedAliases: string[] = []
       const cfJsonAliases = new Set<string>()
       const cfMultiAliasByAlias = new Map<string, string>()
+      const cfSortAliases: string[] = []
       for (const key of cfKeys) {
         const source = keySource.get(key)
         if (!source) continue
@@ -1127,6 +1231,12 @@ export class BasicQueryEngine implements QueryEngine {
       // field covered by an encryption map such a leaf therefore compares against
       // ciphertext and will not match.
       //
+      // This also means the #5803 plaintext-containment split (lib/search/containment) does not
+      // apply here: `buildColumnOpExpression` below keeps a multi-word `like`/`ilike` leaf as one
+      // literal pattern, so an OR-grouped search (e.g. `customers/api/people`'s multi-field
+      // fallback) loses word-order independence on Basic while the Hybrid engine's OR groups
+      // apply the split. Pre-existing divergence between the two engines; not tracked by an issue.
+      //
       // The count shape never populates cfValueExprByKey (it joins no cf tables), so
       // its applicability test is key resolution itself — the same condition that
       // gates the full shape's expression map — and a cf leaf compiles to a
@@ -1200,30 +1310,57 @@ export class BasicQueryEngine implements QueryEngine {
         }
       }
 
-      // Sorting: base fields and cf:* (use aggregated alias for cf)
+      // Sorting: base fields and cf:* (a dedicated scalar alias, never the jsonb
+      // projection alias — ordering by `to_jsonb(...)` compares arrays after every
+      // scalar string regardless of contents, and a numeric kind must cast to
+      // numeric instead of ordering the text CASE expression lexicographically (#5674)).
+      let lastEmittedSortField: string | null = null
       for (const s of isCountProjection ? [] : resolvedSorts) {
         if (s.field.startsWith('cf:')) {
           const key = s.field.slice(3)
-          const alias = sanitize(`cf:${key}`)
-          // Ensure included in projection to sort by
-          if (!cfSelectedAliases.includes(alias)) {
-            const expr = cfValueExprByKey[key]
-            if (expr) {
-              q = q.select(sql<string | null>`max(${expr})`.as(alias))
-              cfSelectedAliases.push(alias)
+          const sortAlias = sanitize(`cf:${key}__sort`)
+          if (!cfSortAliases.includes(sortAlias)) {
+            const source = keySource.get(key)
+            const kind = cfSortKinds.get(key)
+            let sortExpr: RawBuilder<unknown> | null = null
+            if (source && kind && NUMERIC_CF_SORT_KINDS.has(kind)) {
+              const sourceAliasSafe = sanitize(source.alias || 'src')
+              const keyAliasSafe = sanitize(key)
+              const valAlias = `cfv_${sourceAliasSafe}_${keyAliasSafe}`
+              const numericColumn = kind === 'integer' ? 'value_int' : 'value_float'
+              sortExpr = sql<string | null>`max((${sql.ref(`${valAlias}.${numericColumn}`)})::numeric)`
+            } else {
+              const expr = cfValueExprByKey[key]
+              if (expr) sortExpr = sql<string | null>`max(${expr})`
+            }
+            if (sortExpr) {
+              q = q.select(sortExpr.as(sortAlias))
+              cfSortAliases.push(sortAlias)
             }
           }
-          // Only order by an alias the projection actually carries. A key that
-          // resolved to no expression is dropped rather than emitted as an
-          // unselected alias, which is what the base-column branch above already
-          // does when `resolveBaseColumn` returns null.
-          if (!requiresPlaintextSort && cfSelectedAliases.includes(alias)) {
-            q = q.orderBy(alias, (s.dir ?? 'asc') as any)
+          // Only order by an alias the query actually selects. A key that resolved
+          // to no expression is dropped rather than emitted as an unselected alias,
+          // which is what the base-column branch below already does when
+          // `resolveBaseColumn` returns null.
+          if (!requiresPlaintextSort && cfSortAliases.includes(sortAlias)) {
+            const direction = sql.raw((s.dir ?? 'asc') === 'desc' ? 'desc' : 'asc')
+            q = q.orderBy(sql`${sql.ref(sortAlias)} ${direction} NULLS LAST`)
+            lastEmittedSortField = s.field
           }
         } else {
-          if (!requiresPlaintextSort) q = q.orderBy(qualify(s.field), (s.dir ?? 'asc') as any)
+          if (!requiresPlaintextSort) {
+            q = q.orderBy(qualify(s.field), (s.dir ?? 'asc') as any)
+            lastEmittedSortField = s.field
+          }
         }
       }
+      // Stable tiebreak so ties (or NULLs) don't reorder arbitrarily across pages
+      // (#5674). Only appended when a sort term actually made it into the ORDER
+      // BY — an entirely unresolved cf sort must stay a no-op, not gain an
+      // incidental `id` ordering the caller never asked for.
+      if (!isCountProjection && lastEmittedSortField !== null && lastEmittedSortField !== 'id') {
+        q = q.orderBy(qualify('id'), 'asc' as any)
+      }
 
       // Deduplicate if we joined CFs or extensions by grouping on base id. The count
       // shape has neither, and must stay barrier-free for its LIMIT to bind.
@@ -1235,7 +1372,7 @@ export class BasicQueryEngine implements QueryEngine {
         q = q.groupBy(`${table}.id`)
       }
 
-      return { builder: q, hasJoinedAggregates, cfJsonAliases, cfMultiAliasByAlias, resolvedCustomFieldDefinitions }
+      return { builder: q, hasJoinedAggregates, cfJsonAliases, cfMultiAliasByAlias, cfSortAliases, resolvedCustomFieldDefinitions }
     }
 
     // Pagination
@@ -1247,6 +1384,7 @@ export class BasicQueryEngine implements QueryEngine {
       hasJoinedAggregates,
       cfJsonAliases,
       cfMultiAliasByAlias,
+      cfSortAliases,
       resolvedCustomFieldDefinitions,
     } = await buildQuery('full')
 
@@ -1330,6 +1468,19 @@ export class BasicQueryEngine implements QueryEngine {
       }
     }
 
+    // The `cf:<key>__sort` alias exists only to give a `cf:` sort's ORDER BY
+    // something to reference (and, for a numeric kind, to host the cast) — it
+    // is never a requested output field. Strip it before rows leave this
+    // function so it doesn't leak into API responses as a phantom custom field
+    // `<key>__sort` (unlike `__is_multi`, which `normalizeCfJsonAliases`
+    // already deletes) (#5674 review).
+    const stripCfSortAliases = (rows: ResultRow[]) => {
+      if (cfSortAliases.length === 0) return
+      for (const row of rows) {
+        for (const alias of cfSortAliases) delete row[alias]
+      }
+    }
+
     let pagedItems: ResultRow[]
     let encryptedSortRowCapWarning: EncryptedSortRowCapWarning | undefined
 
@@ -1372,6 +1523,7 @@ export class BasicQueryEngine implements QueryEngine {
       } else {
         const pageRows = await qFull.where(qualify('id'), 'in', pageIds).execute() as ResultRow[]
         normalizeCfJsonAliases(pageRows)
+        stripCfSortAliases(pageRows)
         const decryptedPageRows = decryptPayload
           ? await mapWithConcurrency(pageRows, DECRYPT_CONCURRENCY, decryptRow)
           : pageRows
@@ -1384,6 +1536,7 @@ export class BasicQueryEngine implements QueryEngine {
       const dataQuery = qFull.limit(pageSize).offset((page - 1) * pageSize)
       const items = await dataQuery.execute() as ResultRow[]
       normalizeCfJsonAliases(items)
+      stripCfSortAliases(items)
       pagedItems = decryptPayload
         ? await mapWithConcurrency(items, DECRYPT_CONCURRENCY, decryptRow)
         : items

package/src/lib/schedule/__tests__/interval.test.ts

@@ -0,0 +1,37 @@
+import {
+  MIN_SCHEDULE_INTERVAL_MS,
+  isValidScheduleInterval,
+  parseScheduleInterval,
+} from '../interval'
+
+describe('parseScheduleInterval', () => {
+  it('converts each documented unit to milliseconds', () => {
+    expect(parseScheduleInterval('90s')).toBe(90 * 1000)
+    expect(parseScheduleInterval('15m')).toBe(15 * 60 * 1000)
+    expect(parseScheduleInterval('6h')).toBe(6 * 60 * 60 * 1000)
+    expect(parseScheduleInterval('1d')).toBe(24 * 60 * 60 * 1000)
+  })
+
+  it('rejects a value that carries no unit', () => {
+    expect(() => parseScheduleInterval('3600')).toThrow('Invalid interval format: 3600')
+  })
+})
+
+describe('isValidScheduleInterval', () => {
+  it.each(['1h', '6h', '24h', '15m', '60s', '1d'])('accepts the documented format %s', (interval) => {
+    expect(isValidScheduleInterval(interval)).toBe(true)
+  })
+
+  it.each(['3600', '', ' 1h', '1h ', '1.5h', '-1h', 'hourly', '1w', '1H'])(
+    'rejects %p, which the scheduler could never run',
+    (interval) => {
+      expect(isValidScheduleInterval(interval)).toBe(false)
+    },
+  )
+
+  it('rejects an interval shorter than the enforced minimum', () => {
+    expect(MIN_SCHEDULE_INTERVAL_MS).toBe(60 * 1000)
+    expect(isValidScheduleInterval('30s')).toBe(false)
+    expect(isValidScheduleInterval('0m')).toBe(false)
+  })
+})