fix(drizzle): ignore empty in/not_in operands instead of passing them to typed columns

[creativoma]

What?

sanitizeQueryValue only coerced in / not_in / all operands when the incoming value was a comma-delineated string. When the same value arrives as an array — which is what an indexed query string produces — the coercion was skipped entirely, so an operand that cannot be cast to the column's type reached the driver as-is.

This moves the existing numeric coercion below the array normalisation so it applies in both cases, drops operands that are not numbers, and adds the equivalent for uuid id columns.

Why?

Payload's own relationship field asks for its options with the already-selected ids excluded, and it still sends the parameter when nothing is selected yet:

GET /api/roles?where[and][0][id][not_in][0]=

qs parses that into not_in: ['']. Because the value is an array, no coercion ran, and the empty string was bound straight to the id column:

select count(*) from "roles" where "roles"."id" not in ($1)   -- params: ['']

error: invalid input syntax for type integer: ""

The endpoint 500s and the field spins on "Loading…" with nothing surfaced to the user. On a uuid adapter the same query fails with invalid input syntax for type uuid: "". Every collection is affected, not only the one where we hit it.

Where it actually shows up is an install whose users table is empty while the data to select already exists — the create-first-user screen — because that is when nothing is selected yet. Local development rarely reproduces it, since those databases already have users.

Related issues:

• When all selections are made, DB will give an error if there is no id. #7909 — the same driver error, from where[...][id][not_equals]=. It was closed by removing the empty parameter at that one call site rather than in the adapter, which is why this variant still reproduces.
• Relationship field filters generate invalid database queries #14204 — the NaN sibling of the same problem. Not addressed in general here, but '5,,6' no longer produces [5, NaN, 6].
• Create-first-user - relationship not populated with seeded data #14257 — same screen, different cause (the client-side permissions guard), closed as expected behaviour. This is not that: the failure here is server-side and happens for any caller, authenticated or not.

How?

The coercion moved below the Array.isArray normalisation and gained a filter:

if (field.type === 'number') {
  formattedValue = formattedValue
    .map((arrayVal) => parseFloat(arrayVal))
    .filter((arrayVal) => !Number.isNaN(arrayVal))
} else if (isUUID) {
  formattedValue = formattedValue.filter((arrayVal) => uuidValidate(arrayVal))
}

Dropping the operand is semantics-preserving rather than lenient: a value that cannot be cast to the column's type can never equal any row, so removing it leaves the result set identical for both operators. Filtering down to an empty list stays correct as well — drizzle compiles inArray(col, []) to false (matches nothing) and notInArray(col, []) to true (excludes nothing), which is exactly what an in / not_in of nothing means.

isUUID is only true when the column really is a PgUUID, so the uuid filter cannot narrow a plain text id column.

Tests

• packages/drizzle/src/queries/sanitizeQueryValue.spec.ts — new unit spec covering both id types, including that valid operands are left untouched.
• test/database/int.spec.ts — one integration test under describe('id type'), tagged { db: 'drizzle' }. It asserts the semantics rather than just the absence of a throw: not_in: [''] excludes nothing, in: [''] matches nothing.

Without this change that integration test fails with the driver error above: invalid input syntax for type integer: "" on postgres, and invalid input syntax for type uuid: "" on postgres-uuid.

Verified locally: test:unit, test:types, build:core, and the database int suite on postgres, postgres-uuid and sqlite.

---

This targets main (v4). The 3.x branch carries the identical block, so the fix applies there unchanged if you would like a backport.