@airoom/nextmin-node 0.1.2 → 0.1.4

package/LICENSE

@@ -1,49 +1,21 @@
-Nextmin Proprietary License v1.0
+MIT License
 
 Copyright (c) 2025 GSCodes
-All rights reserved.
 
-1. Definitions
-“Software” means the package and all accompanying files under the package name(s) @airoom/nextmin-react and @airoom/nextmin-node, including any updates provided by Licensor.
-“Licensor” means GSCodes.
-“Licensee” means the person or entity that obtains the Software.
-
-2. Grant of License
-Subject to full compliance with this License, Licensor grants Licensee a limited, non-exclusive, non-transferable, non-sublicensable license to:
-  a) install and use the Software internally, solely for evaluating or running Licensee’s own applications; and
-  b) make a reasonable number of copies solely for internal backup and archival purposes.
-
-3. Restrictions
-Except as expressly permitted in Section 2, Licensee must NOT:
-  a) copy, publish, distribute, sell, rent, lease, lend, sublicense, or otherwise make the Software available to any third party;
-  b) modify, translate, adapt, create derivative works of, or merge the Software with other software;
-  c) reverse engineer, decompile, disassemble, or otherwise attempt to derive source code or underlying ideas, except to the extent such restrictions are expressly prohibited by applicable law;
-  d) remove, obscure, or alter any proprietary notices or markings; or
-  e) use the Software to train, fine-tune, or improve any artificial intelligence or machine learning model.
-
-4. Ownership
-The Software is licensed, not sold. Licensor retains all right, title, and interest in and to the Software, including all intellectual property rights and all copies.
-
-5. Confidentiality
-The Software and any non-public information provided by Licensor shall be treated as confidential and not disclosed to any third party without Licensor’s prior written consent, except as required by law.
-
-6. Term and Termination
-This License is effective until terminated. Licensor may terminate this License immediately upon notice if Licensee breaches any term. Upon termination, Licensee must cease all use and destroy all copies of the Software. Sections 3–10 survive termination.
-
-7. Updates; No Support Obligation
-Licensor may, but is not obligated to, provide updates, bug fixes, or support. Any updates are governed by this License unless accompanied by a different license.
-
-8. No Warranty
-THE SOFTWARE IS PROVIDED “AS IS” AND “AS AVAILABLE,” WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE, TITLE, AND NON-INFRINGEMENT. USE IS AT LICENSEE’S SOLE RISK.
-
-9. Limitation of Liability
-TO THE MAXIMUM EXTENT PERMITTED BY LAW, IN NO EVENT SHALL LICENSOR BE LIABLE FOR ANY INDIRECT, INCIDENTAL, SPECIAL, CONSEQUENTIAL, EXEMPLARY, OR PUNITIVE DAMAGES, OR FOR ANY LOSS OF PROFITS, REVENUE, DATA, GOODWILL, OR BUSINESS INTERRUPTION, EVEN IF ADVISED OF THE POSSIBILITY OF SUCH DAMAGES. LICENSOR’S TOTAL LIABILITY FOR ALL CLAIMS SHALL NOT EXCEED THE AMOUNT PAID BY LICENSEE FOR THE SOFTWARE (IF ANY) IN THE TWELVE (12) MONTHS PRECEDING THE CLAIM.
-
-10. Governing Law; Venue
-This License is governed by the laws of State of California, USA, without regard to its conflict of laws principles. The parties submit to the exclusive jurisdiction and venue of the courts located in San Francisco County, California, USA.
-
-11. Commercial Licensing
-For commercial use, redistribution, or other rights not expressly granted, contact: tareqaziz0065@gmail.com.
-
-12. Entire Agreement
-This License constitutes the entire agreement with respect to the Software and supersedes all prior or contemporaneous agreements or understandings on the subject matter.
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

package/dist/api/apiRouter.js

@@ -375,6 +375,77 @@ class APIRouter {
                     const salt = await bcrypt_1.default.genSalt(10);
                     payload.password = await bcrypt_1.default.hash(String(payload.password) + this.jwtSecret, salt);
                 }
+                // Extended schema handling: split into base + child
+                if (schema.extends) {
+                    const baseName = String(schema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseSchema = this.getSchema(baseLC);
+                    const baseModel = this.getModel(baseLC);
+                    // Partition payload by base attributes
+                    const basePayload = {};
+                    const childPayload = {};
+                    for (const [k, v] of Object.entries(payload)) {
+                        if (baseSchema.attributes[k])
+                            basePayload[k] = v;
+                        else
+                            childPayload[k] = v;
+                    }
+                    // Unique checks per collection
+                    const baseConflicts = await this.checkUniqueFields(baseSchema, basePayload);
+                    if (baseConflicts && baseConflicts.length > 0) {
+                        return res.status(400).json({
+                            error: true,
+                            fields: baseConflicts.map((field) => ({
+                                field,
+                                error: true,
+                                message: `You cannot use this ${field}. It's already been used.`,
+                            })),
+                        });
+                    }
+                    const childConflicts = await this.checkUniqueFields(schema, childPayload);
+                    if (childConflicts && childConflicts.length > 0) {
+                        return res.status(400).json({
+                            error: true,
+                            fields: childConflicts.map((field) => ({
+                                field,
+                                error: true,
+                                message: `You cannot use this ${field}. It's already been used.`,
+                            })),
+                        });
+                    }
+                    // Hash password if base is Users
+                    if (baseLC === 'users' && basePayload.password && this.jwtSecret) {
+                        const salt = await bcrypt_1.default.genSalt(10);
+                        basePayload.password = await bcrypt_1.default.hash(String(basePayload.password) + this.jwtSecret, salt);
+                    }
+                    // Create base first
+                    const baseCreated = await baseModel.create(basePayload);
+                    // Then create child linking to base
+                    const linkField = 'baseId';
+                    const childToCreate = { ...childPayload, [linkField]: baseCreated.id };
+                    const childCreated = await model.create(childToCreate);
+                    // Merge docs for response (child overrides base on conflicts)
+                    let resultDoc = { ...baseCreated, ...childCreated };
+                    delete resultDoc.baseId;
+                    if (cdec.exposePrivate && childCreated?.id) {
+                        // Re-fetch both with private if needed
+                        const [refChild] = await model.read({ id: childCreated.id }, 1, 0, true);
+                        const [refBase] = await baseModel.read({ id: baseCreated.id }, 1, 0, true);
+                        if (refChild && refBase) {
+                            resultDoc = { ...refBase, ...refChild };
+                            delete resultDoc.baseId;
+                        }
+                    }
+                    const masked = cdec.exposePrivate
+                        ? (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.sensitiveMask)
+                        : (0, authorize_1.applyReadMaskOne)(resultDoc, cdec.readMask);
+                    return res.status(201).json({
+                        success: true,
+                        message: `${schema.modelName} has been created successfully.`,
+                        data: masked,
+                    });
+                }
+                // Default (non-extended)
                 const created = await model.create(payload);
                 let resultDoc = created;
                 if (cdec.exposePrivate && created?.id) {
@@ -577,11 +648,14 @@ class APIRouter {
                 const totalRows = await model.count(finalFilter);
                 // try DB-level sort (preferred). Fallback to in-memory if adapter lacks sort support.
                 let rawRows = [];
+                // Ensure we can hydrate: baseId is private, so read with private when extended
+                const needPrivateForHydrate = !!schema.extends;
+                const exposePrivateForRead = needPrivateForHydrate || !!rdec.exposePrivate;
                 try {
-                    rawRows = await model.read(finalFilter, limit + 1, page * limit, !!rdec.exposePrivate, { sort });
+                    rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead, { sort });
                 }
                 catch {
-                    rawRows = await model.read(finalFilter, limit + 1, page * limit, !!rdec.exposePrivate);
+                    rawRows = await model.read(finalFilter, limit + 1, page * limit, exposePrivateForRead);
                     if (sort && Object.keys(sort).length) {
                         const orderKeys = Object.keys(sort);
                         rawRows.sort((a, b) => {
@@ -611,6 +685,29 @@ class APIRouter {
                         .filter((r) => String(r?.id) !== String(currentUserId))
                         .slice(0, limit)
                     : rawRows.slice(0, limit);
+                // If extended, hydrate with base data using baseId
+                if (schema.extends) {
+                    const baseName = String(schema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseModel = this.getModel(baseLC);
+                    const hydrated = [];
+                    for (const row of rows) {
+                        const baseId = row?.baseId;
+                        if (baseId) {
+                            const [baseDoc] = await baseModel.read({ id: baseId }, 1, 0, !!rdec.exposePrivate);
+                            if (baseDoc) {
+                                const merged = { ...baseDoc, ...row };
+                                delete merged.baseId;
+                                hydrated.push(merged);
+                                continue;
+                            }
+                        }
+                        const fallback = { ...row };
+                        delete fallback.baseId;
+                        hydrated.push(fallback);
+                    }
+                    rows = hydrated;
+                }
                 const data = rdec.exposePrivate
                     ? (0, authorize_1.applyReadMaskMany)(rows, rdec.sensitiveMask)
                     : (0, authorize_1.applyReadMaskMany)(rows, rdec.readMask);
@@ -645,7 +742,10 @@ class APIRouter {
                     access: schema.access,
                 };
                 const decForInclude = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, ctx);
-                const recordArr = await model.read({ id: req.params.id }, 1, 0, !!decForInclude.exposePrivate);
+                // Ensure we can hydrate: baseId is private, so read with private when extended
+                const needPrivateForHydrate2 = !!schema.extends;
+                const exposePrivateForRead2 = needPrivateForHydrate2 || !!decForInclude.exposePrivate;
+                const recordArr = await model.read({ id: req.params.id }, 1, 0, exposePrivateForRead2);
                 const doc = recordArr?.[0];
                 if (!doc) {
                     return res
@@ -655,9 +755,23 @@ class APIRouter {
                 const dec = (0, authorize_1.authorize)(modelNameLC, 'read', schemaPolicy, ctx, doc);
                 if (!dec.allow)
                     return res.status(403).json({ error: true, message: 'forbidden' });
+                let toReturn = doc;
+                if (schema.extends) {
+                    const baseName = String(schema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseModel = this.getModel(baseLC);
+                    const baseId = doc?.baseId;
+                    if (baseId) {
+                        const [baseDoc] = await baseModel.read({ id: baseId }, 1, 0, !!dec.exposePrivate);
+                        if (baseDoc) {
+                            toReturn = { ...baseDoc, ...doc };
+                            delete toReturn.baseId;
+                        }
+                    }
+                }
                 const data = dec.exposePrivate
-                    ? (0, authorize_1.applyReadMaskOne)(doc, dec.sensitiveMask)
-                    : (0, authorize_1.applyReadMaskOne)(doc, dec.readMask);
+                    ? (0, authorize_1.applyReadMaskOne)(toReturn, dec.sensitiveMask)
+                    : (0, authorize_1.applyReadMaskOne)(toReturn, dec.readMask);
                 return res.status(200).json({
                     success: true,
                     message: `${schema.modelName} found`,
@@ -720,6 +834,83 @@ class APIRouter {
                         message: `Missing required fields: ${missing.join(', ')}`,
                     });
                 }
+                // Extended schema update handling
+                if (schema.extends) {
+                    const baseName = String(schema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseSchema = this.getSchema(baseLC);
+                    const baseModel = this.getModel(baseLC);
+                    const baseId = before?.baseId;
+                    if (!baseId) {
+                        return res.status(400).json({ error: true, message: 'Invalid extended record: missing baseId' });
+                    }
+                    // Partition update
+                    const baseUpd = {};
+                    const childUpd = {};
+                    for (const [k, v] of Object.entries(upd)) {
+                        if (k === 'baseId')
+                            continue; // never allow changing link
+                        if (baseSchema.attributes[k])
+                            baseUpd[k] = v;
+                        else
+                            childUpd[k] = v;
+                    }
+                    // Unique checks per collection
+                    const baseConflicts = await this.checkUniqueFields(baseSchema, baseUpd, String(baseId));
+                    if (baseConflicts && baseConflicts.length > 0) {
+                        return res.status(400).json({
+                            error: true,
+                            message: 'There are some error while updating record.',
+                            fields: baseConflicts.map((field) => ({
+                                field,
+                                error: true,
+                                message: `You cannot use this ${field}. It's already been used.`,
+                            })),
+                        });
+                    }
+                    const childConflicts = await this.checkUniqueFields(schema, childUpd, req.params.id);
+                    if (childConflicts && childConflicts.length > 0) {
+                        return res.status(400).json({
+                            error: true,
+                            message: 'There are some error while updating record.',
+                            fields: childConflicts.map((field) => ({
+                                field,
+                                error: true,
+                                message: `You cannot use this ${field}. It's already been used.`,
+                            })),
+                        });
+                    }
+                    // Hash password if base is Users and provided
+                    if (baseLC === 'users' &&
+                        Object.prototype.hasOwnProperty.call(baseUpd, 'password')) {
+                        if (!baseUpd.password) {
+                            delete baseUpd.password;
+                        }
+                        else if (this.jwtSecret) {
+                            const salt = await bcrypt_1.default.genSalt(10);
+                            baseUpd.password = await bcrypt_1.default.hash(String(baseUpd.password) + this.jwtSecret, salt);
+                        }
+                    }
+                    // Perform updates
+                    let updatedChild = before;
+                    if (Object.keys(childUpd).length) {
+                        updatedChild = await model.update(req.params.id, childUpd);
+                    }
+                    if (Object.keys(baseUpd).length) {
+                        await baseModel.update(String(baseId), baseUpd);
+                    }
+                    // Re-read and merge
+                    const [refChild] = await model.read({ id: updatedChild.id }, 1, 0, true);
+                    const [refBase] = await baseModel.read({ id: String(baseId) }, 1, 0, true);
+                    let responseDoc = refChild && refBase ? { ...refBase, ...refChild } : updatedChild;
+                    if (responseDoc)
+                        delete responseDoc.baseId;
+                    const masked = udec.exposePrivate
+                        ? (0, authorize_1.applyReadMaskOne)(responseDoc, udec.sensitiveMask)
+                        : (0, authorize_1.applyReadMaskOne)(responseDoc, udec.readMask);
+                    return res.json(masked);
+                }
+                // Default (non-extended)
                 const conflicts = await this.checkUniqueFields(schema, upd, req.params.id);
                 if (conflicts && conflicts.length > 0) {
                     return res.status(400).json({
@@ -773,6 +964,36 @@ class APIRouter {
                 const ddec = (0, authorize_1.authorize)(modelNameLC, 'delete', schemaPolicy, ctx, doc);
                 if (!ddec.allow)
                     return res.status(403).json({ error: true, message: 'forbidden' });
+                // Extended delete: remove child then base
+                if (schema.extends) {
+                    const baseName = String(schema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseModel = this.getModel(baseLC);
+                    const baseId = doc?.baseId;
+                    const deletedChild = await model.delete(req.params.id);
+                    if (baseId) {
+                        try {
+                            await baseModel.delete(String(baseId));
+                        }
+                        catch (e) {
+                            // ignore if already missing
+                        }
+                    }
+                    const merged = baseId
+                        ? (() => {
+                            // Try to include base snapshot for response if available
+                            return { ...deletedChild, baseId: undefined };
+                        })()
+                        : deletedChild;
+                    const masked = ddec.exposePrivate
+                        ? (0, authorize_1.applyReadMaskOne)(merged, ddec.sensitiveMask)
+                        : (0, authorize_1.applyReadMaskOne)(merged, ddec.readMask);
+                    return res.json({
+                        success: true,
+                        message: `We have deleted the record successfully.`,
+                        data: masked,
+                    });
+                }
                 const deletedRecord = await model.delete(req.params.id);
                 if (!deletedRecord) {
                     return res
@@ -975,6 +1196,31 @@ class APIRouter {
                     // fallback (BaseModel.read); note: no projection/sort
                     items = await this.getModel(targetLC).read({ id: { $in: ids } }, limit, skip, !!tDec.exposePrivate);
                 }
+                // If extended, hydrate with base data using baseId before masking
+                if (targetSchema.extends && Array.isArray(items) && items.length) {
+                    const baseName = String(targetSchema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseModel = this.getModel(baseLC);
+                    const baseIds = Array.from(new Set(items.map((it) => it?.baseId).filter(Boolean)));
+                    if (baseIds.length) {
+                        const baseDocs = await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!tDec.exposePrivate);
+                        const baseMap = new Map(baseDocs.map((b) => [String(b?.id ?? b?._id), b]));
+                        items = items.map((it) => {
+                            const bid = String(it?.baseId || '');
+                            const b = bid ? baseMap.get(bid) : null;
+                            const merged = b ? { ...b, ...it } : { ...it };
+                            delete merged.baseId;
+                            return merged;
+                        });
+                    }
+                    else {
+                        items = items.map((it) => {
+                            const copy = { ...it };
+                            delete copy.baseId;
+                            return copy;
+                        });
+                    }
+                }
                 const masked = tDec.exposePrivate
                     ? (0, authorize_1.applyReadMaskMany)(items, tDec.sensitiveMask)
                     : (0, authorize_1.applyReadMaskMany)(items, tDec.readMask);
@@ -1050,6 +1296,31 @@ class APIRouter {
                     totalRows = all.length;
                     items = all.slice(skip, skip + limit);
                 }
+                // If extended, hydrate with base data using baseId before masking
+                if (targetSchema.extends && Array.isArray(items) && items.length) {
+                    const baseName = String(targetSchema.extends);
+                    const baseLC = baseName.toLowerCase();
+                    const baseModel = this.getModel(baseLC);
+                    const baseIds = Array.from(new Set(items.map((it) => it?.baseId).filter(Boolean)));
+                    if (baseIds.length) {
+                        const baseDocs = await baseModel.read({ id: { $in: baseIds } }, baseIds.length, 0, !!tDec.exposePrivate);
+                        const baseMap = new Map(baseDocs.map((b) => [String(b?.id ?? b?._id), b]));
+                        items = items.map((it) => {
+                            const bid = String(it?.baseId || '');
+                            const b = bid ? baseMap.get(bid) : null;
+                            const merged = b ? { ...b, ...it } : { ...it };
+                            delete merged.baseId;
+                            return merged;
+                        });
+                    }
+                    else {
+                        items = items.map((it) => {
+                            const copy = { ...it };
+                            delete copy.baseId;
+                            return copy;
+                        });
+                    }
+                }
                 const masked = tDec.exposePrivate
                     ? (0, authorize_1.applyReadMaskMany)(items, tDec.sensitiveMask)
                     : (0, authorize_1.applyReadMaskMany)(items, tDec.readMask);
@@ -1467,8 +1738,28 @@ class APIRouter {
         const isEmpty = (v) => v === undefined ||
             v === null ||
             (typeof v === 'string' && v.trim() === '');
+        // If this is an extended schema, skip validating base fields here
+        let baseKeys = null;
+        const baseName = schema?.extends;
+        if (baseName) {
+            try {
+                const baseLC = baseName.toLowerCase();
+                const baseSchema = this.getSchema(baseLC);
+                baseKeys = new Set(Object.keys(baseSchema.attributes || {}));
+            }
+            catch {
+                baseKeys = null;
+            }
+        }
         for (const [key, attribute] of Object.entries(schema.attributes)) {
-            const req = attribute && !Array.isArray(attribute) && attribute.required;
+            // Skip array defs here (arrays wrap inner type), and skip private fields entirely from client-required validation
+            if (Array.isArray(attribute))
+                continue;
+            if (attribute?.private)
+                continue;
+            if (baseKeys && key !== 'baseId' && baseKeys.has(key))
+                continue; // do not require base fields on child
+            const req = Boolean(attribute?.required);
             if (!req)
                 continue;
             if (mode === 'create') {

package/dist/database/MongoAdapter.js

@@ -136,7 +136,19 @@ class MongoAdapter {
     /** Build a fresh Mongoose schema from our NextMin schema definition. */
     buildMongooseSchema(def) {
         const shape = {};
+        // If this schema extends a base, only include child-own attributes for storage
+        let baseKeys = null;
+        const baseName = def?.extends;
+        if (baseName) {
+            const baseSchema = this.getSchema(baseName);
+            if (baseSchema) {
+                baseKeys = new Set(Object.keys(baseSchema.attributes || {}));
+            }
+        }
         for (const [key, attr] of Object.entries(def.attributes)) {
+            // Exclude base attributes from child storage schema; always allow link field
+            if (baseKeys && key !== 'baseId' && baseKeys.has(key))
+                continue;
             shape[key] = this.mapAttribute(attr);
         }
         const s = new mongoose_1.Schema(shape, { timestamps: true });

package/dist/models/BaseModel.d.ts

@@ -19,6 +19,7 @@ export interface Attributes {
 }
 export interface Schema {
     modelName: string;
+    showCount: boolean;
     attributes: {
         [key: string]: Attributes;
     };

package/dist/utils/SchemaLoader.d.ts

@@ -3,6 +3,7 @@ import { FieldIndexSpec } from '../database/DatabaseAdapter';
 type PublicAttributes = Record<string, any>;
 type PublicSchema = Omit<Schema, 'attributes'> & {
     modelName: string;
+    showCount: boolean;
     attributes: PublicAttributes;
     allowedMethods: Schema['allowedMethods'];
 };

package/dist/utils/SchemaLoader.js

@@ -125,8 +125,10 @@ class SchemaLoader {
         }
         for (const schema of Object.values(schemas)) {
             if (schema.extends) {
-                const baseSchema = schemas[schema.extends];
+                const baseName = schema.extends;
+                const baseSchema = schemas[baseName];
                 if (baseSchema) {
+                    // Merge attributes and methods for READ surface
                     schema.attributes = {
                         ...baseSchema.attributes,
                         ...schema.attributes,
@@ -135,6 +137,17 @@ class SchemaLoader {
                         ...baseSchema.allowedMethods,
                         ...schema.allowedMethods,
                     };
+                    // Inject hidden link field to base (used for storage join)
+                    const linkField = 'baseId';
+                    if (!schema.attributes[linkField]) {
+                        schema.attributes[linkField] = {
+                            type: 'ObjectId',
+                            ref: baseName,
+                            private: true,
+                            // Not required on create; server auto-fills for extended creates.
+                            // Presence is enforced for existing docs on update.
+                        };
+                    }
                 }
                 else {
                     throw new Error(`Base schema ${schema.extends} not found for ${schema.modelName}`);
@@ -237,6 +250,7 @@ class SchemaLoader {
             };
             out[name] = {
                 modelName: s.modelName,
+                showCount: s.showCount,
                 allowedMethods: s.allowedMethods,
                 attributes: attributesWithTimestamps,
             };
@@ -261,19 +275,29 @@ class SchemaLoader {
             if (Array.isArray(attr)) {
                 const elem = attr[0];
                 if (elem && typeof elem === 'object') {
-                    // Keep as an array with a single shallow-cloned descriptor, preserving flags like `private`, `sensitive`, `writeOnly`
-                    out[key] = [{ ...elem }];
+                    // If the inner descriptor is private, omit this field entirely from public schema
+                    if (elem.private) {
+                        continue;
+                    }
+                    // Keep as an array with a single shallow-cloned descriptor (without leaking private flag)
+                    const { private: _omit, ...rest } = elem;
+                    out[key] = [{ ...rest }];
                 }
                 else {
-                    // Fallback: keep as-is
+                    // Fallback: keep as-is (no private flag to check)
                     out[key] = attr;
                 }
                 continue;
             }
             // Single attribute object
             if (attr && typeof attr === 'object') {
-                // Keep `private`, `sensitive`, `writeOnly`, etc.
-                out[key] = { ...attr };
+                // If marked private, omit from public schema entirely
+                if (attr.private) {
+                    continue;
+                }
+                // Shallow clone and drop the private flag if present
+                const { private: _omit, ...rest } = attr;
+                out[key] = { ...rest };
                 continue;
             }
             // Unexpected primitives — pass through

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@airoom/nextmin-node",
-  "version": "0.1.2",
-  "license": "SEE LICENSE IN LICENSE",
+  "version": "0.1.4",
+  "license": "MIT",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
   "scripts": {