@@ -0,0 +1,14 @@
+---
+'@objectstack/client': patch
+---
+
+fix(client): `data.find` refuses a `select` that names no field before the request, with the list door's own answer, instead of sending `?select=`
+
+Clause-②: no — the calls refused are exactly the ones the list door already refuses (`400 VALIDATION_ERROR`); the caller gets the same `code`, `httpStatus` and message, only without the round trip. Nothing is widened and no call that was served is refused.
+Metadata-protocol: none
+
+An empty array is truthy, so `client.data.find(object, { select: [] })` (or `{ fields: [] }`) put `?select=` on the wire and came back as a `400 VALIDATION_ERROR` from a door the caller cannot see. Both `ObjectStackClient.data.find` and `environment(id).data.find` now refuse that call, and a `select` whose every member is blank, before any request:
+
+- The error carries `code: 'VALIDATION_ERROR'`, `httpStatus: 400` and the door's sentence (`Query parameter 'select' names no field; …`), so an existing `err.code` branch fires the same way.
+- The parameter is never dropped: an absent projection reads every column, which is the widening the door refuses.
+- A `select` naming at least one field is sent exactly as before, blank members included (the door keeps the named ones).
@@ -309,6 +309,33 @@ describe('ObjectStackClient (with Hono Server)', () => {
         expect(resultsResponse.records[0].name).toBe('Hono User');
     });
 
+    // `data.find` refuses a projection naming no field before the request, with
+    // a restated copy of the list door's sentence (the door's own is private to
+    // the server). This holds the copy equal to the REAL door: the same request
+    // sent raw through the client's transport — which is what `find` did before
+    // it refused — must fail with the same message, code and status.
+    it('refuses an empty select with the list door\'s own answer, before the request', async () => {
+        const client = new ObjectStackClient({ baseUrl });
+        await client.connect();
+
+        for (const select of [[], ['', ' ']]) {
+            const wire = new URLSearchParams({ select: select.join(',') }).toString();
+            const door = await client._fetch(`${baseUrl}/api/v1/data/customer?${wire}`).then(
+                () => { throw new Error(`the door served ?${wire}`); },
+                (err: any) => err,
+            );
+            expect(door.httpStatus).toBe(400);
+            expect(door.code).toBe('VALIDATION_ERROR');
+
+            const refused = await client.data.find('customer', { select }).then(
+                () => { throw new Error('find resolved'); },
+                (err: any) => err,
+            );
+            expect({ message: refused.message, code: refused.code, httpStatus: refused.httpStatus })
+                .toEqual({ message: door.message, code: door.code, httpStatus: door.httpStatus });
+        }
+    });
+
     // [#5638] The one method whose declared return shape this suite never
     // exercised — and the one that was wrong. `DeleteDataResult` claimed
     // `deleted: boolean`; the schema it names declares `success`. This is the
 
@@ -2045,6 +2045,62 @@ describe('data.find() — canonical/legacy transport parameters (both copies)',
         );
         expect(b.fetchMock).not.toHaveBeenCalled();
     });
+
+    /**
+     * A projection that names no field is refused before the request, on both
+     * copies — never dropped.
+     *
+     * An empty array is truthy, so `{ select: [] }` used to reach the wire as
+     * `?select=`, and the list door refused it with `400 VALIDATION_ERROR`
+     * after the round trip. Dropping the parameter instead would be worse: an
+     * absent projection reads every column, the widening the door refuses.
+     * The client now answers what the door would have answered — the same
+     * `code`, `httpStatus` and sentence (parity with the real door is pinned
+     * in `client.hono.test.ts`) — and sends nothing.
+     */
+    const EMPTY_PROJECTIONS: Record<string, { options: QueryOptions | QueryOptionsV2; wire: string }> = {
+        'legacy { select: [] }': { options: { select: [] }, wire: '' },
+        'canonical { fields: [] }': { options: { fields: [] }, wire: '' },
+        'legacy, every member blank': { options: { select: ['', ' '] }, wire: ', ' },
+        'canonical, every member blank': { options: { fields: [' '] }, wire: ' ' },
+    };
+
+    for (const [name, row] of Object.entries(EMPTY_PROJECTIONS)) {
+        it(`refuses an empty projection before any request on both copies: ${name}`, async () => {
+            const expected = {
+                code: 'VALIDATION_ERROR',
+                httpStatus: 400,
+                message: `Query parameter 'select' names no field; got ${JSON.stringify(row.wire)}. The query was not run: `
+                    + 'an empty projection was read as no projection, which answers every column. Name at least one '
+                    + 'field, or leave the parameter out to read every column.',
+            };
+
+            const a = createMockClient({ success: true, data: { object: 'task', records: [] } });
+            await expect(a.client.data.find('task', row.options)).rejects.toMatchObject(expected);
+            expect(a.fetchMock).not.toHaveBeenCalled();
+
+            const b = createMockClient({ success: true, data: { object: 'task', records: [] } });
+            await expect(b.client.environment('env-1').data.find('task', row.options)).rejects.toMatchObject(expected);
+            expect(b.fetchMock).not.toHaveBeenCalled();
+        });
+    }
+
+    it('still sends a projection that names at least one field, blank members and all, on both copies', async () => {
+        const body = { success: true, data: { object: 'task', records: [], total: 0 } };
+        for (const options of [{ select: ['a', 'b'] }, { fields: ['a', 'b'] }] as const) {
+            const a = createMockClient(body);
+            await a.client.data.find('task', options);
+            expect(queryOf(a.fetchMock.mock.calls[0][0] as string)).toBe('select=a%2Cb');
+            const b = createMockClient(body);
+            await b.client.environment('env-1').data.find('task', options);
+            expect(queryOf(b.fetchMock.mock.calls[0][0] as string)).toBe('select=a%2Cb');
+        }
+        // The door splits, trims and keeps the named members, so this one is
+        // served — the client sends it exactly as before.
+        const { direct, scoped } = await driveBoth({ select: ['a', ''] });
+        expect(direct).toBe('select=a%2C');
+        expect(scoped).toBe('select=a%2C');
+    });
 });
 
 describe('QueryBuilder — offset() alias', () => {
 
@@ -417,6 +417,39 @@ function canonicalExpandParam(expand: QueryOptionsV2['expand']): string | undefi
   return names.length > 0 ? names.join(',') : undefined;
 }
 
+/**
+ * The `select` value `data.find()` puts on the wire, or the list door's own
+ * refusal, raised before any request.
+ *
+ * The door (`findData` in `@objectstack/metadata-protocol`) splits `select` on
+ * commas, trims each member and refuses a value naming NO field with
+ * `400 VALIDATION_ERROR`: an empty projection read as no projection answers
+ * every column. An empty array is truthy, so `{ select: [] }` used to reach the
+ * wire as `?select=` and come back as that 400 after a round trip. Dropping
+ * the parameter instead is the one thing this must never do — absent means
+ * "every column", the widening the door exists to refuse.
+ *
+ * The rule and the sentence are the door's, applied to the exact value this
+ * client would have sent, so the caller gets the same `code`, `httpStatus`
+ * and message either way. The sentence is restated here because the door's
+ * copy is private to a server package this SDK does not depend on;
+ * `client.hono.test.ts` holds the two equal against the real door.
+ *
+ * Shared by both `data.find` copies so they cannot diverge.
+ */
+function projectionSelectParam(select: readonly string[]): string {
+  const value = select.join(',');
+  if (value.split(',').some((name) => name.trim() !== '')) return value;
+  const error = new Error(
+    `Query parameter 'select' names no field; got ${JSON.stringify(value)}. The query was not run: `
+    + 'an empty projection was read as no projection, which answers every column. Name at least one '
+    + 'field, or leave the parameter out to read every column.',
+  ) as Error & { code: string; httpStatus: number };
+  error.code = 'VALIDATION_ERROR';
+  error.httpStatus = 400;
+  throw error;
+}
+
 export interface PaginatedResult<T = any> {
   /** Spec-compliant: array of matching records */
   records: T[];
@@ -7056,9 +7089,10 @@ export class ObjectStackClient {
             }
         }
 
-        // 3. Handle Select
+        // 3. Handle Select — a projection naming no field is refused here,
+        // never dropped (see projectionSelectParam).
         if (normalizedOptions.select) {
-            queryParams.set('select', normalizedOptions.select.join(','));
+            queryParams.set('select', projectionSelectParam(normalizedOptions.select));
         }
 
         // 4. Handle Filters (Simple vs AST)
@@ -7944,7 +7978,7 @@ export class ScopedEnvironmentClient {
         }
       }
       if (normalizedOptions.select) {
-        queryParams.set('select', normalizedOptions.select.join(','));
+        queryParams.set('select', projectionSelectParam(normalizedOptions.select));
       }
       const filterValue = normalizedOptions.filter ?? normalizedOptions.filters;
       if (filterValue) {