@strapi/core 5.52.0 → 5.52.2

package/dist/migrations/database/serialize-json-columns.d.ts

@@ -0,0 +1,12 @@
+/**
+ * Re-serializes JSON/blocks columns in a row before INSERT.
+ *
+ * mysql2 and node-pg parse JSON/JSONB columns on SELECT into JS objects; knex
+ * does not re-serialize those objects on INSERT. Stringify object/array values
+ * for json and blocks attributes. Values that are already strings (typical of
+ * SQLite) are left unchanged.
+ */
+export declare const serializeJsonColumns: (row: Record<string, any>, meta: {
+    attributes?: Record<string, any>;
+} | null | undefined) => Record<string, any>;
+//# sourceMappingURL=serialize-json-columns.d.ts.map

package/dist/migrations/database/serialize-json-columns.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-json-columns.d.ts","sourceRoot":"","sources":["../../../src/migrations/database/serialize-json-columns.ts"],"names":[],"mappings":"AAEA;;;;;;;GAOG;AACH,eAAO,MAAM,oBAAoB,GAC/B,KAAK,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,EACxB,MAAM;IAAE,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAA;CAAE,GAAG,IAAI,GAAG,SAAS,KAC5D,MAAM,CAAC,MAAM,EAAE,GAAG,CAsBpB,CAAC"}

package/dist/migrations/database/serialize-json-columns.js

@@ -0,0 +1,35 @@
+'use strict';
+
+const JSON_ATTRIBUTE_TYPES = new Set([
+    'json',
+    'blocks'
+]);
+/**
+ * Re-serializes JSON/blocks columns in a row before INSERT.
+ *
+ * mysql2 and node-pg parse JSON/JSONB columns on SELECT into JS objects; knex
+ * does not re-serialize those objects on INSERT. Stringify object/array values
+ * for json and blocks attributes. Values that are already strings (typical of
+ * SQLite) are left unchanged.
+ */ const serializeJsonColumns = (row, meta)=>{
+    if (!meta?.attributes) {
+        return row;
+    }
+    for (const attribute of Object.values(meta.attributes)){
+        if (!JSON_ATTRIBUTE_TYPES.has(attribute.type)) {
+            continue;
+        }
+        const columnName = attribute.columnName;
+        if (!columnName || !(columnName in row)) {
+            continue;
+        }
+        const value = row[columnName];
+        if (value != null && typeof value === 'object') {
+            row[columnName] = JSON.stringify(value);
+        }
+    }
+    return row;
+};
+
+exports.serializeJsonColumns = serializeJsonColumns;
+//# sourceMappingURL=serialize-json-columns.js.map

package/dist/migrations/database/serialize-json-columns.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-json-columns.js","sources":["../../../src/migrations/database/serialize-json-columns.ts"],"sourcesContent":["const JSON_ATTRIBUTE_TYPES = new Set(['json', 'blocks']);\n\n/**\n * Re-serializes JSON/blocks columns in a row before INSERT.\n *\n * mysql2 and node-pg parse JSON/JSONB columns on SELECT into JS objects; knex\n * does not re-serialize those objects on INSERT. Stringify object/array values\n * for json and blocks attributes. Values that are already strings (typical of\n * SQLite) are left unchanged.\n */\nexport const serializeJsonColumns = (\n  row: Record<string, any>,\n  meta: { attributes?: Record<string, any> } | null | undefined\n): Record<string, any> => {\n  if (!meta?.attributes) {\n    return row;\n  }\n\n  for (const attribute of Object.values(meta.attributes) as any[]) {\n    if (!JSON_ATTRIBUTE_TYPES.has(attribute.type)) {\n      continue;\n    }\n\n    const columnName = attribute.columnName;\n    if (!columnName || !(columnName in row)) {\n      continue;\n    }\n\n    const value = row[columnName];\n    if (value != null && typeof value === 'object') {\n      row[columnName] = JSON.stringify(value);\n    }\n  }\n\n  return row;\n};\n"],"names":["JSON_ATTRIBUTE_TYPES","Set","serializeJsonColumns","row","meta","attributes","attribute","Object","values","has","type","columnName","value","JSON","stringify"],"mappings":";;AAAA,MAAMA,oBAAAA,GAAuB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA;AAAS,CAAA,CAAA;AAEvD;;;;;;;AAOC,IACM,MAAMC,oBAAAA,GAAuB,CAClCC,GAAAA,EACAC,IAAAA,GAAAA;IAEA,IAAI,CAACA,MAAMC,UAAAA,EAAY;QACrB,OAAOF,GAAAA;AACT,IAAA;AAEA,IAAA,KAAK,MAAMG,SAAAA,IAAaC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,CAAKC,UAAU,CAAA,CAAY;AAC/D,QAAA,IAAI,CAACL,oBAAAA,CAAqBS,GAAG,CAACH,SAAAA,CAAUI,IAAI,CAAA,EAAG;AAC7C,YAAA;AACF,QAAA;QAEA,MAAMC,UAAAA,GAAaL,UAAUK,UAAU;AACvC,QAAA,IAAI,CAACA,UAAAA,IAAc,EAAEA,UAAAA,IAAcR,GAAE,CAAA,EAAI;AACvC,YAAA;AACF,QAAA;QAEA,MAAMS,KAAAA,GAAQT,GAAG,CAACQ,UAAAA,CAAW;AAC7B,QAAA,IAAIC,KAAAA,IAAS,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;AAC9CT,YAAAA,GAAG,CAACQ,UAAAA,CAAW,GAAGE,IAAAA,CAAKC,SAAS,CAACF,KAAAA,CAAAA;AACnC,QAAA;AACF,IAAA;IAEA,OAAOT,GAAAA;AACT;;;;"}

package/dist/migrations/database/serialize-json-columns.mjs

@@ -0,0 +1,33 @@
+const JSON_ATTRIBUTE_TYPES = new Set([
+    'json',
+    'blocks'
+]);
+/**
+ * Re-serializes JSON/blocks columns in a row before INSERT.
+ *
+ * mysql2 and node-pg parse JSON/JSONB columns on SELECT into JS objects; knex
+ * does not re-serialize those objects on INSERT. Stringify object/array values
+ * for json and blocks attributes. Values that are already strings (typical of
+ * SQLite) are left unchanged.
+ */ const serializeJsonColumns = (row, meta)=>{
+    if (!meta?.attributes) {
+        return row;
+    }
+    for (const attribute of Object.values(meta.attributes)){
+        if (!JSON_ATTRIBUTE_TYPES.has(attribute.type)) {
+            continue;
+        }
+        const columnName = attribute.columnName;
+        if (!columnName || !(columnName in row)) {
+            continue;
+        }
+        const value = row[columnName];
+        if (value != null && typeof value === 'object') {
+            row[columnName] = JSON.stringify(value);
+        }
+    }
+    return row;
+};
+
+export { serializeJsonColumns };
+//# sourceMappingURL=serialize-json-columns.mjs.map

package/dist/migrations/database/serialize-json-columns.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"serialize-json-columns.mjs","sources":["../../../src/migrations/database/serialize-json-columns.ts"],"sourcesContent":["const JSON_ATTRIBUTE_TYPES = new Set(['json', 'blocks']);\n\n/**\n * Re-serializes JSON/blocks columns in a row before INSERT.\n *\n * mysql2 and node-pg parse JSON/JSONB columns on SELECT into JS objects; knex\n * does not re-serialize those objects on INSERT. Stringify object/array values\n * for json and blocks attributes. Values that are already strings (typical of\n * SQLite) are left unchanged.\n */\nexport const serializeJsonColumns = (\n  row: Record<string, any>,\n  meta: { attributes?: Record<string, any> } | null | undefined\n): Record<string, any> => {\n  if (!meta?.attributes) {\n    return row;\n  }\n\n  for (const attribute of Object.values(meta.attributes) as any[]) {\n    if (!JSON_ATTRIBUTE_TYPES.has(attribute.type)) {\n      continue;\n    }\n\n    const columnName = attribute.columnName;\n    if (!columnName || !(columnName in row)) {\n      continue;\n    }\n\n    const value = row[columnName];\n    if (value != null && typeof value === 'object') {\n      row[columnName] = JSON.stringify(value);\n    }\n  }\n\n  return row;\n};\n"],"names":["JSON_ATTRIBUTE_TYPES","Set","serializeJsonColumns","row","meta","attributes","attribute","Object","values","has","type","columnName","value","JSON","stringify"],"mappings":"AAAA,MAAMA,oBAAAA,GAAuB,IAAIC,GAAAA,CAAI;AAAC,IAAA,MAAA;AAAQ,IAAA;AAAS,CAAA,CAAA;AAEvD;;;;;;;AAOC,IACM,MAAMC,oBAAAA,GAAuB,CAClCC,GAAAA,EACAC,IAAAA,GAAAA;IAEA,IAAI,CAACA,MAAMC,UAAAA,EAAY;QACrB,OAAOF,GAAAA;AACT,IAAA;AAEA,IAAA,KAAK,MAAMG,SAAAA,IAAaC,MAAAA,CAAOC,MAAM,CAACJ,IAAAA,CAAKC,UAAU,CAAA,CAAY;AAC/D,QAAA,IAAI,CAACL,oBAAAA,CAAqBS,GAAG,CAACH,SAAAA,CAAUI,IAAI,CAAA,EAAG;AAC7C,YAAA;AACF,QAAA;QAEA,MAAMC,UAAAA,GAAaL,UAAUK,UAAU;AACvC,QAAA,IAAI,CAACA,UAAAA,IAAc,EAAEA,UAAAA,IAAcR,GAAE,CAAA,EAAI;AACvC,YAAA;AACF,QAAA;QAEA,MAAMS,KAAAA,GAAQT,GAAG,CAACQ,UAAAA,CAAW;AAC7B,QAAA,IAAIC,KAAAA,IAAS,IAAA,IAAQ,OAAOA,KAAAA,KAAU,QAAA,EAAU;AAC9CT,YAAAA,GAAG,CAACQ,UAAAA,CAAW,GAAGE,IAAAA,CAAKC,SAAS,CAACF,KAAAA,CAAAA;AACnC,QAAA;AACF,IAAA;IAEA,OAAOT,GAAAA;AACT;;;;"}

package/dist/package.json.js

@@ -3,7 +3,7 @@
 Object.defineProperty(exports, '__esModule', { value: true });
 
 var name = "@strapi/core";
-var version = "5.52.0";
+var version = "5.52.2";
 var description = "Core of Strapi";
 var homepage = "https://strapi.io";
 var bugs = {
@@ -65,15 +65,15 @@ var dependencies = {
     "@koa/router": "12.0.2",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@paralleldrive/cuid2": "2.2.2",
-    "@strapi/admin": "5.52.0",
-    "@strapi/database": "5.52.0",
-    "@strapi/generators": "5.52.0",
-    "@strapi/logger": "5.52.0",
-    "@strapi/openapi": "5.52.0",
-    "@strapi/permissions": "5.52.0",
-    "@strapi/types": "5.52.0",
-    "@strapi/typescript-utils": "5.52.0",
-    "@strapi/utils": "5.52.0",
+    "@strapi/admin": "5.52.2",
+    "@strapi/database": "5.52.2",
+    "@strapi/generators": "5.52.2",
+    "@strapi/logger": "5.52.2",
+    "@strapi/openapi": "5.52.2",
+    "@strapi/permissions": "5.52.2",
+    "@strapi/types": "5.52.2",
+    "@strapi/typescript-utils": "5.52.2",
+    "@strapi/utils": "5.52.2",
     "@vercel/stega": "0.1.2",
     bcryptjs: "2.4.3",
     boxen: "5.1.2",
@@ -117,7 +117,7 @@ var dependencies = {
     typescript: "5.9.3",
     undici: "6.28.0",
     yup: "0.32.9",
-    zod: "3.25.76"
+    zod: "4.4.3"
 };
 var devDependencies = {
     "@swc/core": "1.13.5",
@@ -137,12 +137,12 @@ var devDependencies = {
     "@types/mime-types": "2.1.1",
     "@types/node": "20.19.41",
     "@types/node-schedule": "2.1.7",
-    "eslint-config-custom": "5.52.0",
+    "eslint-config-custom": "5.52.2",
     jest: "29.6.0",
     supertest: "7.2.2",
-    tsconfig: "5.52.0",
+    tsconfig: "5.52.2",
     vitest: "catalog:",
-    "vitest-config": "5.52.0"
+    "vitest-config": "5.52.2"
 };
 var engines = {
     node: ">=20.0.0 <=26.x.x",

package/dist/package.json.mjs

@@ -1,5 +1,5 @@
 var name = "@strapi/core";
-var version = "5.52.0";
+var version = "5.52.2";
 var description = "Core of Strapi";
 var homepage = "https://strapi.io";
 var bugs = {
@@ -61,15 +61,15 @@ var dependencies = {
     "@koa/router": "12.0.2",
     "@modelcontextprotocol/sdk": "1.30.0",
     "@paralleldrive/cuid2": "2.2.2",
-    "@strapi/admin": "5.52.0",
-    "@strapi/database": "5.52.0",
-    "@strapi/generators": "5.52.0",
-    "@strapi/logger": "5.52.0",
-    "@strapi/openapi": "5.52.0",
-    "@strapi/permissions": "5.52.0",
-    "@strapi/types": "5.52.0",
-    "@strapi/typescript-utils": "5.52.0",
-    "@strapi/utils": "5.52.0",
+    "@strapi/admin": "5.52.2",
+    "@strapi/database": "5.52.2",
+    "@strapi/generators": "5.52.2",
+    "@strapi/logger": "5.52.2",
+    "@strapi/openapi": "5.52.2",
+    "@strapi/permissions": "5.52.2",
+    "@strapi/types": "5.52.2",
+    "@strapi/typescript-utils": "5.52.2",
+    "@strapi/utils": "5.52.2",
     "@vercel/stega": "0.1.2",
     bcryptjs: "2.4.3",
     boxen: "5.1.2",
@@ -113,7 +113,7 @@ var dependencies = {
     typescript: "5.9.3",
     undici: "6.28.0",
     yup: "0.32.9",
-    zod: "3.25.76"
+    zod: "4.4.3"
 };
 var devDependencies = {
     "@swc/core": "1.13.5",
@@ -133,12 +133,12 @@ var devDependencies = {
     "@types/mime-types": "2.1.1",
     "@types/node": "20.19.41",
     "@types/node-schedule": "2.1.7",
-    "eslint-config-custom": "5.52.0",
+    "eslint-config-custom": "5.52.2",
     jest: "29.6.0",
     supertest: "7.2.2",
-    tsconfig: "5.52.0",
+    tsconfig: "5.52.2",
     vitest: "catalog:",
-    "vitest-config": "5.52.0"
+    "vitest-config": "5.52.2"
 };
 var engines = {
     node: ">=20.0.0 <=26.x.x",

package/dist/services/content-api/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/content-api/index.ts"],"names":[],"mappings":"AACA,OAAO,EACL,QAAQ,EACR,QAAQ,EAIT,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAO,MAAM,eAAe,CAAC;AAiHxD;;GAEG;AACH,QAAA,MAAM,gBAAgB,GAAI,QAAQ,IAAI,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+HAhFhB,CAAC;;;;;;;;+HAZ6C,CAAA;;;;;;8BAsIxC,OAAO,CAAC,UAAU,CAAC,qBAAqB;8BAQxC,OAAO,CAAC,UAAU,CAAC,qBAAqB;uCAK/B,IAAI,CAAC,KAAK,EAAE,KAAG,IAAI;CA2F9D,CAAC;AAEF,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/services/content-api/index.ts"],"names":[],"mappings":"AAAA,OAAO,EACL,QAAQ,EACR,QAAQ,EAIT,MAAM,eAAe,CAAC;AAGvB,OAAO,KAAK,EAAE,IAAI,EAAE,OAAO,EAAO,MAAM,eAAe,CAAC;AA8HxD;;GAEG;AACH,QAAA,MAAM,gBAAgB,GAAI,QAAQ,IAAI,CAAC,MAAM;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;+HAxFL,CAAA;;;;;;;;+HAJjC,CAAC;;;;;;8BAsI2B,OAAO,CAAC,UAAU,CAAC,qBAAqB;8BAQxC,OAAO,CAAC,UAAU,CAAC,qBAAqB;uCAK/B,IAAI,CAAC,KAAK,EAAE,KAAG,IAAI;CAqF9D,CAAC;AAEF,eAAe,gBAAgB,CAAC"}

package/dist/services/content-api/index.js

@@ -1,12 +1,10 @@
 'use strict';
 
-var _ = require('lodash');
 var strapiUtils = require('@strapi/utils');
 var z = require('zod/v4');
+var zod = require('../../utils/zod.js');
 var index = require('./permissions/index.js');
 
-function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
-
 function _interopNamespace(e) {
   if (e && e.__esModule) return e;
   var n = Object.create(null);
@@ -25,7 +23,6 @@ function _interopNamespace(e) {
   return Object.freeze(n);
 }
 
-var ___default = /*#__PURE__*/_interopDefault(_);
 var z__namespace = /*#__PURE__*/_interopNamespace(z);
 
 const transformRoutePrefixFor = (pluginName)=>(route)=>{
@@ -41,33 +38,35 @@ const filterContentAPI = (route)=>route.info.type === 'content-api';
  * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).
  * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,
  * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration
- * time instead of a later failure in validate/sanitize. This list is intentionally tied to Zod v4
- * constructor names; if Zod changes internals, this may need updating.
- * Compatibility: Zod 3 and Zod 4 Classic (zod/v4) both use these constructor names and
- * expose ._def with .innerType / .element for Optional/Default/Array. Zod 4 Core/Mini use
- * ._zod.def instead; we only accept schemas from the same zod/v4 instance used here.
- */ const ALLOWED_QUERY_SCHEMA_NAMES = new Set([
-    'ZodString',
-    'ZodNumber',
-    'ZodBoolean',
-    'ZodEnum',
-    'ZodOptional',
-    'ZodDefault',
-    'ZodArray'
+ * time instead of a later failure in validate/sanitize.
+ */ const ALLOWED_QUERY_SCHEMA_TYPES = new Set([
+    'string',
+    'number',
+    'boolean',
+    'enum'
 ]);
+const formatZodSchemaName = (type)=>{
+    if (type.length === 0) {
+        return '';
+    }
+    return `Zod${type.split('_').map((part)=>`${part.charAt(0).toUpperCase()}${part.slice(1)}`).join('')}`;
+};
 function assertQueryParamSchema(schema, param) {
-    const name = schema?.constructor?.name ?? '';
-    if (!ALLOWED_QUERY_SCHEMA_NAMES.has(name)) {
+    if (!zod.isZodType(schema)) {
+        const name = typeof schema === 'object' && schema !== null ? schema.constructor?.name ?? 'Object' : typeof schema;
         throw new Error(`contentAPI.addQueryParams: param "${param}" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`);
     }
-    if (name === 'ZodOptional' || name === 'ZodDefault') {
-        const inner = schema?._def?.innerType;
-        if (inner) assertQueryParamSchema(inner, param);
+    const inspection = zod.inspectZodSchema(schema);
+    if (inspection.type === 'optional' || inspection.type === 'default') {
+        assertQueryParamSchema(inspection.innerType, param);
+        return;
+    }
+    if (inspection.type === 'array') {
+        assertQueryParamSchema(inspection.element, param);
         return;
     }
-    if (name === 'ZodArray') {
-        const element = schema?._def?.element;
-        if (element) assertQueryParamSchema(element, param);
+    if (!ALLOWED_QUERY_SCHEMA_TYPES.has(inspection.type)) {
+        throw new Error(`contentAPI.addQueryParams: param "${param}" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${formatZodSchemaName(inspection.type)}. Use addInputParams for nested objects.`);
     }
 }
 function resolveSchema(schemaOrFactory) {
@@ -183,37 +182,30 @@ const mergeOneInputParamIntoRoute = (route, param, schema, matchRoute)=>{
     };
     const getRoutesMap = async ()=>{
         const routesMap = {};
-        ___default.default.forEach(strapi.apis, (api, apiName)=>{
-            const routes = ___default.default.flatMap(api.routes, (route)=>{
-                if ('routes' in route) {
-                    return route.routes;
-                }
-                return route;
-            }).filter(filterContentAPI);
+        for (const [apiName, api] of Object.entries(strapi.apis)){
+            const routes = Object.values(api.routes).flatMap((route)=>'routes' in route ? route.routes : route).filter(filterContentAPI);
             if (routes.length === 0) {
-                return;
+                continue;
             }
             const apiPrefix = strapi.config.get('api.rest.prefix');
             routesMap[`api::${apiName}`] = routes.map((route)=>({
                     ...route,
                     path: `${apiPrefix}${route.path}`
                 }));
-        });
-        ___default.default.forEach(strapi.plugins, (plugin, pluginName)=>{
+        }
+        for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
             const transformPrefix = transformRoutePrefixFor(pluginName);
-            if (Array.isArray(plugin.routes)) {
-                return plugin.routes.map(transformPrefix).filter(filterContentAPI);
-            }
-            const routes = ___default.default.flatMap(plugin.routes, (route)=>route.routes.map(transformPrefix)).filter(filterContentAPI);
+            const pluginRoutes = Array.isArray(plugin.routes) ? plugin.routes : Object.values(plugin.routes).flatMap((route)=>route.routes);
+            const routes = pluginRoutes.map(transformPrefix).filter(filterContentAPI);
             if (routes.length === 0) {
-                return;
+                continue;
             }
             const apiPrefix = strapi.config.get('api.rest.prefix');
             routesMap[`plugin::${pluginName}`] = routes.map((route)=>({
                     ...route,
                     path: `${apiPrefix}${route.path}`
                 }));
-        });
+        }
         return strapiUtils.sanitizeRoutesMapForSerialization(routesMap);
     };
     const sanitizer = strapiUtils.sanitize.createAPISanitizers({

package/dist/services/content-api/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../../src/services/content-api/index.ts"],"sourcesContent":["import _ from 'lodash';\nimport {\n  sanitize,\n  validate,\n  sanitizeRoutesMapForSerialization,\n  ALLOWED_QUERY_PARAM_KEYS,\n  RESERVED_INPUT_PARAM_KEYS,\n} from '@strapi/utils';\nimport * as z from 'zod/v4';\n\nimport type { Core, Modules, UID } from '@strapi/types';\n\nimport instantiatePermissionsUtilities from './permissions';\n\nconst transformRoutePrefixFor = (pluginName: string) => (route: Core.Route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nconst filterContentAPI = (route: Core.Route) => route.info.type === 'content-api';\n\n/**\n * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).\n * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,\n * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration\n * time instead of a later failure in validate/sanitize. This list is intentionally tied to Zod v4\n * constructor names; if Zod changes internals, this may need updating.\n * Compatibility: Zod 3 and Zod 4 Classic (zod/v4) both use these constructor names and\n * expose ._def with .innerType / .element for Optional/Default/Array. Zod 4 Core/Mini use\n * ._zod.def instead; we only accept schemas from the same zod/v4 instance used here.\n */\nconst ALLOWED_QUERY_SCHEMA_NAMES = new Set([\n  'ZodString',\n  'ZodNumber',\n  'ZodBoolean',\n  'ZodEnum',\n  'ZodOptional',\n  'ZodDefault',\n  'ZodArray',\n]);\n\nfunction assertQueryParamSchema(schema: unknown, param: string): void {\n  const name = (schema as { constructor?: { name?: string } })?.constructor?.name ?? '';\n  if (!ALLOWED_QUERY_SCHEMA_NAMES.has(name)) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`\n    );\n  }\n  if (name === 'ZodOptional' || name === 'ZodDefault') {\n    const inner = (schema as { _def?: { innerType?: unknown } })?._def?.innerType;\n    if (inner) assertQueryParamSchema(inner, param);\n    return;\n  }\n  if (name === 'ZodArray') {\n    const element = (schema as { _def?: { element?: unknown } })?._def?.element;\n    if (element) assertQueryParamSchema(element, param);\n  }\n}\n\nfunction resolveSchema<T>(schemaOrFactory: T | ((zInstance: typeof z) => T)): T {\n  if (typeof schemaOrFactory === 'function') {\n    return (schemaOrFactory as (zInstance: typeof z) => T)(z);\n  }\n  return schemaOrFactory;\n}\n\nconst mergeOneQueryParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const query = { ...route.request?.query };\n  if (param in query) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  route.request = { ...route.request, query: { ...query, [param]: schema } };\n};\n\nconst mergeOneInputParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const jsonKey = 'application/json';\n  type RouteBody = NonNullable<NonNullable<Core.Route['request']>['body']>;\n  const body: RouteBody = route.request?.body ? { ...route.request.body } : ({} as RouteBody);\n  const existing = body[jsonKey];\n  const base =\n    existing && typeof existing === 'object' && 'shape' in existing\n      ? (existing as { shape: Record<string, z.ZodType> }).shape\n      : {};\n  if (param in base) {\n    throw new Error(\n      `contentAPI.addInputParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  body[jsonKey] = z.object({ ...base, [param]: schema }) as RouteBody[keyof RouteBody];\n  route.request = { ...route.request, body };\n};\n\n/** Stored options with schema always resolved (never a function). */\ntype ResolvedQueryParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\ntype ResolvedInputParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\n\n/**\n * Create a content API container that holds logic, tools and utils. (eg: permissions, ...)\n */\nconst createContentAPI = (strapi: Core.Strapi) => {\n  const extraQueryParams: ResolvedQueryParamEntry[] = [];\n  const extraInputParams: ResolvedInputParamEntry[] = [];\n\n  const addQueryParam = (options: Modules.ContentAPI.QueryParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    assertQueryParamSchema(schema, param);\n    if ((ALLOWED_QUERY_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addQueryParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraQueryParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addQueryParams: param \"${param}\" has already been added`);\n    }\n    extraQueryParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n    // We do not merge here: at register() time routes may not exist yet (lazy creation), and\n    // merging here would cause double-merge when initRouting runs and 400 \"invalid param\" or\n    // \"param already exists\" errors.\n  };\n\n  const addInputParam = (options: Modules.ContentAPI.InputParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    if ((RESERVED_INPUT_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addInputParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraInputParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addInputParams: param \"${param}\" has already been added`);\n    }\n    extraInputParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n  };\n\n  /**\n   * Register extra query params. Keys = param names; values = { schema, matchRoute? }.\n   * Schemas must be Zod scalar or array-of-scalars (enforced at runtime via assertQueryParamSchema).\n   */\n  const addQueryParams = (options: Modules.ContentAPI.AddQueryParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addQueryParam({ param, ...rest }));\n  };\n\n  /**\n   * Register extra input params (root-level body.data). Keys = param names; values = { schema, matchRoute? }.\n   * Any Zod type allowed; enforced at registration time.\n   */\n  const addInputParams = (options: Modules.ContentAPI.AddInputParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addInputParam({ param, ...rest }));\n  };\n\n  /** Merge all registered extra params into the given routes (mutates in place). Called at route registration. Throws if a param key already exists. */\n  const applyExtraParamsToRoutes = (routes: Core.Route[]): void => {\n    routes.forEach((route) => {\n      for (const { param, schema, matchRoute } of extraQueryParams) {\n        mergeOneQueryParamIntoRoute(route, param, schema, matchRoute);\n      }\n      for (const { param, schema, matchRoute } of extraInputParams) {\n        mergeOneInputParamIntoRoute(route, param, schema, matchRoute);\n      }\n    });\n  };\n\n  const getRoutesMap = async () => {\n    const routesMap: Record<string, Core.Route[]> = {};\n\n    _.forEach(strapi.apis, (api, apiName) => {\n      const routes = _.flatMap(api.routes, (route) => {\n        if ('routes' in route) {\n          return route.routes;\n        }\n\n        return route;\n      }).filter(filterContentAPI);\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    _.forEach(strapi.plugins, (plugin, pluginName) => {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      if (Array.isArray(plugin.routes)) {\n        return plugin.routes.map(transformPrefix).filter(filterContentAPI);\n      }\n\n      const routes = _.flatMap(plugin.routes, (route) => route.routes.map(transformPrefix)).filter(\n        filterContentAPI\n      );\n\n      if (routes.length === 0) {\n        return;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    });\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  };\n\n  const sanitizer = sanitize.createAPISanitizers({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get sanitizers() {\n      return {\n        input: strapi.sanitizers.get('content-api.input'),\n        output: strapi.sanitizers.get('content-api.output'),\n      };\n    },\n  });\n\n  const validator = validate.createAPIValidators({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get validators() {\n      return {\n        input: strapi.validators.get('content-api.input'),\n      };\n    },\n  });\n\n  return {\n    permissions: instantiatePermissionsUtilities(strapi),\n    getRoutesMap,\n    sanitize: sanitizer,\n    validate: validator,\n    addQueryParams,\n    addInputParams,\n    applyExtraParamsToRoutes,\n  };\n};\n\nexport default createContentAPI;\n"],"names":["transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","filterContentAPI","info","type","ALLOWED_QUERY_SCHEMA_NAMES","Set","assertQueryParamSchema","schema","param","name","has","Error","inner","_def","innerType","element","resolveSchema","schemaOrFactory","z","mergeOneQueryParamIntoRoute","matchRoute","query","request","method","mergeOneInputParamIntoRoute","jsonKey","body","existing","base","shape","object","createContentAPI","strapi","extraQueryParams","extraInputParams","addQueryParam","options","ALLOWED_QUERY_PARAM_KEYS","includes","some","o","push","addInputParam","RESERVED_INPUT_PARAM_KEYS","addQueryParams","Object","entries","forEach","rest","addInputParams","applyExtraParamsToRoutes","routes","getRoutesMap","routesMap","_","apis","api","apiName","flatMap","filter","length","apiPrefix","get","map","plugins","plugin","transformPrefix","Array","isArray","sanitizeRoutesMapForSerialization","sanitizer","sanitize","createAPISanitizers","getModel","uid","sanitizers","input","output","validator","validate","createAPIValidators","validators","permissions","instantiatePermissionsUtilities"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAcA,MAAMA,uBAAAA,GAA0B,CAACC,UAAAA,GAAuB,CAACC,KAAAA,GAAAA;AACvD,QAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,QAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;QAE5F,OAAO;AACL,YAAA,GAAGH,KAAK;AACRG,YAAAA;AACF,SAAA;AACF,IAAA,CAAA;AAEA,MAAME,mBAAmB,CAACL,KAAAA,GAAsBA,MAAMM,IAAI,CAACC,IAAI,KAAK,aAAA;AAEpE;;;;;;;;;IAUA,MAAMC,0BAAAA,GAA6B,IAAIC,GAAAA,CAAI;AACzC,IAAA,WAAA;AACA,IAAA,WAAA;AACA,IAAA,YAAA;AACA,IAAA,SAAA;AACA,IAAA,aAAA;AACA,IAAA,YAAA;AACA,IAAA;AACD,CAAA,CAAA;AAED,SAASC,sBAAAA,CAAuBC,MAAe,EAAEC,KAAa,EAAA;AAC5D,IAAA,MAAMC,IAAAA,GAAQF,MAAAA,EAAgD,WAAA,EAAaE,IAAAA,IAAQ,EAAA;AACnF,IAAA,IAAI,CAACL,0BAAAA,CAA2BM,GAAG,CAACD,IAAAA,CAAAA,EAAO;QACzC,MAAM,IAAIE,KAAAA,CACR,CAAC,kCAAkC,EAAEH,MAAM,mFAAmF,EAAEC,IAAAA,CAAK,wCAAwC,CAAC,CAAA;AAElL,IAAA;IACA,IAAIA,IAAAA,KAAS,aAAA,IAAiBA,IAAAA,KAAS,YAAA,EAAc;QACnD,MAAMG,KAAAA,GAASL,QAA+CM,IAAAA,EAAMC,SAAAA;QACpE,IAAIF,KAAAA,EAAON,uBAAuBM,KAAAA,EAAOJ,KAAAA,CAAAA;AACzC,QAAA;AACF,IAAA;AACA,IAAA,IAAIC,SAAS,UAAA,EAAY;QACvB,MAAMM,OAAAA,GAAWR,QAA6CM,IAAAA,EAAME,OAAAA;QACpE,IAAIA,OAAAA,EAAST,uBAAuBS,OAAAA,EAASP,KAAAA,CAAAA;AAC/C,IAAA;AACF;AAEA,SAASQ,cAAiBC,eAAiD,EAAA;IACzE,IAAI,OAAOA,oBAAoB,UAAA,EAAY;AACzC,QAAA,OAAO,eAACA,CAA+CC,YAAAA,CAAAA;AACzD,IAAA;IACA,OAAOD,eAAAA;AACT;AAEA,MAAME,2BAAAA,GAA8B,CAClCvB,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAMyB,KAAAA,GAAQ;QAAE,GAAGzB,KAAAA,CAAM0B,OAAO,EAAED;AAAM,KAAA;AACxC,IAAA,IAAIb,SAASa,KAAAA,EAAO;AAClB,QAAA,MAAM,IAAIV,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACAH,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;QAAED,KAAAA,EAAO;AAAE,YAAA,GAAGA,KAAK;AAAE,YAAA,CAACb,QAAQD;AAAO;AAAE,KAAA;AAC3E,CAAA;AAEA,MAAMiB,2BAAAA,GAA8B,CAClC5B,KAAAA,EACAY,KAAAA,EACAD,MAAAA,EACAa,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWxB,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAM6B,OAAAA,GAAU,kBAAA;AAEhB,IAAA,MAAMC,IAAAA,GAAkB9B,KAAAA,CAAM0B,OAAO,EAAEI,IAAAA,GAAO;QAAE,GAAG9B,KAAAA,CAAM0B,OAAO,CAACI;AAAK,KAAA,GAAK,EAAC;IAC5E,MAAMC,QAAAA,GAAWD,IAAI,CAACD,OAAAA,CAAQ;IAC9B,MAAMG,IAAAA,GACJD,QAAAA,IAAY,OAAOA,QAAAA,KAAa,QAAA,IAAY,OAAA,IAAWA,QAAAA,GACnD,QAACA,CAAkDE,KAAK,GACxD,EAAC;AACP,IAAA,IAAIrB,SAASoB,IAAAA,EAAM;AACjB,QAAA,MAAM,IAAIjB,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAEZ,KAAAA,CAAM2B,MAAM,CAAC,CAAC,EAAE3B,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACA2B,IAAAA,IAAI,CAACD,OAAAA,CAAQ,GAAGP,YAAAA,CAAEY,MAAM,CAAC;AAAE,QAAA,GAAGF,IAAI;AAAE,QAAA,CAACpB,QAAQD;AAAO,KAAA,CAAA;AACpDX,IAAAA,KAAAA,CAAM0B,OAAO,GAAG;AAAE,QAAA,GAAG1B,MAAM0B,OAAO;AAAEI,QAAAA;AAAK,KAAA;AAC3C,CAAA;AAcA;;IAGA,MAAMK,mBAAmB,CAACC,MAAAA,GAAAA;AACxB,IAAA,MAAMC,mBAA8C,EAAE;AACtD,IAAA,MAAMC,mBAA8C,EAAE;AAEtD,IAAA,MAAMC,gBAAgB,CAACC,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7BX,QAAAA,sBAAAA,CAAuBC,MAAAA,EAAQC,KAAAA,CAAAA;AAC/B,QAAA,IAAI6B,oCAACA,CAA+CC,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACnE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAIyB,gBAAAA,CAAiBM,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACAyB,QAAAA,gBAAAA,CAAiBQ,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;;;;AAKpD,IAAA,CAAA;AAEA,IAAA,MAAMsB,gBAAgB,CAACN,OAAAA,GAAAA;QACrB,MAAM,EAAE5B,KAAK,EAAED,MAAAA,EAAQU,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM7B,SAASS,aAAAA,CAAcC,eAAAA,CAAAA;AAC7B,QAAA,IAAI0B,qCAACA,CAAgDL,QAAQ,CAAC9B,KAAAA,CAAAA,EAAQ;AACpE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAI0B,gBAAAA,CAAiBK,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEhC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACA0B,QAAAA,gBAAAA,CAAiBO,IAAI,CAAC;AAAEjC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQa,YAAAA;AAAW,SAAA,CAAA;;AAEpD,IAAA,CAAA;AAEA;;;MAIA,MAAMwB,iBAAiB,CAACR,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKb,aAAAA,CAAc;AAAE3B,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;AAEA;;;MAIA,MAAMC,iBAAiB,CAACb,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACvC,KAAAA,EAAOwC,IAAAA,CAAK,GAAKN,aAAAA,CAAc;AAAElC,gBAAAA,KAAAA;AAAO,gBAAA,GAAGwC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;2JAGA,MAAME,wBAAAA,GAA2B,CAACC,MAAAA,GAAAA;QAChCA,MAAAA,CAAOJ,OAAO,CAAC,CAACnD,KAAAA,GAAAA;YACd,KAAK,MAAM,EAAEY,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIa,gBAAAA,CAAkB;gBAC5Dd,2BAAAA,CAA4BvB,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;YACA,KAAK,MAAM,EAAEZ,KAAK,EAAED,MAAM,EAAEa,UAAU,EAAE,IAAIc,gBAAAA,CAAkB;gBAC5DV,2BAAAA,CAA4B5B,KAAAA,EAAOY,OAAOD,MAAAA,EAAQa,UAAAA,CAAAA;AACpD,YAAA;AACF,QAAA,CAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,YAAAA,GAAe,UAAA;AACnB,QAAA,MAAMC,YAA0C,EAAC;AAEjDC,QAAAA,kBAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOuB,IAAI,EAAE,CAACC,GAAAA,EAAKC,OAAAA,GAAAA;AAC3B,YAAA,MAAMN,SAASG,kBAAAA,CAAEI,OAAO,CAACF,GAAAA,CAAIL,MAAM,EAAE,CAACvD,KAAAA,GAAAA;AACpC,gBAAA,IAAI,YAAYA,KAAAA,EAAO;AACrB,oBAAA,OAAOA,MAAMuD,MAAM;AACrB,gBAAA;gBAEA,OAAOvD,KAAAA;AACT,YAAA,CAAA,CAAA,CAAG+D,MAAM,CAAC1D,gBAAAA,CAAAA;YAEV,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,KAAK,EAAEI,OAAAA,CAAAA,CAAS,CAAC,GAAGN,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AACpD,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEAuD,QAAAA,kBAAAA,CAAEP,OAAO,CAACf,MAAAA,CAAOgC,OAAO,EAAE,CAACC,MAAAA,EAAQtE,UAAAA,GAAAA;AACjC,YAAA,MAAMuE,kBAAkBxE,uBAAAA,CAAwBC,UAAAA,CAAAA;AAEhD,YAAA,IAAIwE,KAAAA,CAAMC,OAAO,CAACH,MAAAA,CAAOd,MAAM,CAAA,EAAG;AAChC,gBAAA,OAAOc,OAAOd,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAiBP,MAAM,CAAC1D,gBAAAA,CAAAA;AACnD,YAAA;AAEA,YAAA,MAAMkD,SAASG,kBAAAA,CAAEI,OAAO,CAACO,MAAAA,CAAOd,MAAM,EAAE,CAACvD,KAAAA,GAAUA,KAAAA,CAAMuD,MAAM,CAACY,GAAG,CAACG,eAAAA,CAAAA,CAAAA,CAAkBP,MAAM,CAC1F1D,gBAAAA,CAAAA;YAGF,IAAIkD,MAAAA,CAAOS,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAMC,SAAAA,GAAY7B,MAAAA,CAAOlC,MAAM,CAACgE,GAAG,CAAC,iBAAA,CAAA;AACpCT,YAAAA,SAAS,CAAC,CAAC,QAAQ,EAAE1D,UAAAA,CAAAA,CAAY,CAAC,GAAGwD,MAAAA,CAAOY,GAAG,CAAC,CAACnE,KAAAA,IAAW;AAC1D,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAG8D,SAAAA,CAAAA,EAAYjE,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA,CAAA,CAAA;AAEA,QAAA,OAAOsE,6CAAAA,CAAkChB,SAAAA,CAAAA;AAC3C,IAAA,CAAA;IAEA,MAAMiB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CC,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIC,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLC,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,mBAAA,CAAA;AAC7Be,gBAAAA,MAAAA,EAAQ7C,MAAAA,CAAO2C,UAAU,CAACb,GAAG,CAAC,oBAAA;AAChC,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,MAAMgB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CP,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAO1C,MAAAA,CAAOyC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIO,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLL,gBAAAA,KAAAA,EAAO5C,MAAAA,CAAOiD,UAAU,CAACnB,GAAG,CAAC,mBAAA;AAC/B,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,OAAO;AACLoB,QAAAA,WAAAA,EAAaC,KAAAA,CAAgCnD,MAAAA,CAAAA;AAC7CoB,QAAAA,YAAAA;QACAmB,QAAAA,EAAUD,SAAAA;QACVS,QAAAA,EAAUD,SAAAA;AACVlC,QAAAA,cAAAA;AACAK,QAAAA,cAAAA;AACAC,QAAAA;AACF,KAAA;AACF;;;;"}
+{"version":3,"file":"index.js","sources":["../../../src/services/content-api/index.ts"],"sourcesContent":["import {\n  sanitize,\n  validate,\n  sanitizeRoutesMapForSerialization,\n  ALLOWED_QUERY_PARAM_KEYS,\n  RESERVED_INPUT_PARAM_KEYS,\n} from '@strapi/utils';\nimport * as z from 'zod/v4';\n\nimport type { Core, Modules, UID } from '@strapi/types';\n\nimport { inspectZodSchema, isZodType } from '../../utils/zod';\n\nimport instantiatePermissionsUtilities from './permissions';\n\nconst transformRoutePrefixFor = (pluginName: string) => (route: Core.Route) => {\n  const prefix = route.config && route.config.prefix;\n  const path = prefix !== undefined ? `${prefix}${route.path}` : `/${pluginName}${route.path}`;\n\n  return {\n    ...route,\n    path,\n  };\n};\n\nconst filterContentAPI = (route: Core.Route) => route.info.type === 'content-api';\n\n/**\n * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).\n * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,\n * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration\n * time instead of a later failure in validate/sanitize.\n */\nconst ALLOWED_QUERY_SCHEMA_TYPES = new Set(['string', 'number', 'boolean', 'enum']);\n\nconst formatZodSchemaName = (type: string): string => {\n  if (type.length === 0) {\n    return '';\n  }\n\n  return `Zod${type\n    .split('_')\n    .map((part) => `${part.charAt(0).toUpperCase()}${part.slice(1)}`)\n    .join('')}`;\n};\n\nfunction assertQueryParamSchema(schema: unknown, param: string): void {\n  if (!isZodType(schema)) {\n    const name =\n      typeof schema === 'object' && schema !== null\n        ? ((schema as { constructor?: { name?: string } }).constructor?.name ?? 'Object')\n        : typeof schema;\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`\n    );\n  }\n\n  const inspection = inspectZodSchema(schema);\n\n  if (inspection.type === 'optional' || inspection.type === 'default') {\n    assertQueryParamSchema(inspection.innerType, param);\n    return;\n  }\n\n  if (inspection.type === 'array') {\n    assertQueryParamSchema(inspection.element, param);\n    return;\n  }\n\n  if (!ALLOWED_QUERY_SCHEMA_TYPES.has(inspection.type)) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${formatZodSchemaName(inspection.type)}. Use addInputParams for nested objects.`\n    );\n  }\n}\n\nfunction resolveSchema<T>(schemaOrFactory: T | ((zInstance: typeof z) => T)): T {\n  if (typeof schemaOrFactory === 'function') {\n    return (schemaOrFactory as (zInstance: typeof z) => T)(z);\n  }\n  return schemaOrFactory;\n}\n\nconst mergeOneQueryParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const query = { ...route.request?.query };\n  if (param in query) {\n    throw new Error(\n      `contentAPI.addQueryParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  route.request = { ...route.request, query: { ...query, [param]: schema } };\n};\n\nconst mergeOneInputParamIntoRoute = (\n  route: Core.Route,\n  param: string,\n  schema: z.ZodType,\n  matchRoute?: (route: Core.Route) => boolean\n): void => {\n  if (matchRoute && !matchRoute(route)) return;\n  const jsonKey = 'application/json';\n  type RouteBody = NonNullable<NonNullable<Core.Route['request']>['body']>;\n  const body: RouteBody = route.request?.body ? { ...route.request.body } : ({} as RouteBody);\n  const existing = body[jsonKey];\n  const base =\n    existing && typeof existing === 'object' && 'shape' in existing\n      ? (existing as { shape: Record<string, z.ZodType> }).shape\n      : {};\n  if (param in base) {\n    throw new Error(\n      `contentAPI.addInputParams: param \"${param}\" already exists on route ${route.method} ${route.path}`\n    );\n  }\n  body[jsonKey] = z.object({ ...base, [param]: schema }) as RouteBody[keyof RouteBody];\n  route.request = { ...route.request, body };\n};\n\n/** Stored options with schema always resolved (never a function). */\ntype ResolvedQueryParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\ntype ResolvedInputParamEntry = {\n  param: string;\n  schema: z.ZodType;\n  matchRoute?: (route: Core.Route) => boolean;\n};\n\n/**\n * Create a content API container that holds logic, tools and utils. (eg: permissions, ...)\n */\nconst createContentAPI = (strapi: Core.Strapi) => {\n  const extraQueryParams: ResolvedQueryParamEntry[] = [];\n  const extraInputParams: ResolvedInputParamEntry[] = [];\n\n  const addQueryParam = (options: Modules.ContentAPI.QueryParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    assertQueryParamSchema(schema, param);\n    if ((ALLOWED_QUERY_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addQueryParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraQueryParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addQueryParams: param \"${param}\" has already been added`);\n    }\n    extraQueryParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n    // We do not merge here: at register() time routes may not exist yet (lazy creation), and\n    // merging here would cause double-merge when initRouting runs and 400 \"invalid param\" or\n    // \"param already exists\" errors.\n  };\n\n  const addInputParam = (options: Modules.ContentAPI.InputParamEntry & { param: string }) => {\n    const { param, schema: schemaOrFactory, matchRoute } = options;\n    const schema = resolveSchema(schemaOrFactory);\n    if ((RESERVED_INPUT_PARAM_KEYS as readonly string[]).includes(param)) {\n      throw new Error(\n        `contentAPI.addInputParams: param \"${param}\" is reserved by Strapi; use a different name`\n      );\n    }\n    if (extraInputParams.some((o) => o.param === param)) {\n      throw new Error(`contentAPI.addInputParams: param \"${param}\" has already been added`);\n    }\n    extraInputParams.push({ param, schema, matchRoute });\n    // Params are merged into routes when initRouting() runs (applyExtraParamsToRoutes).\n  };\n\n  /**\n   * Register extra query params. Keys = param names; values = { schema, matchRoute? }.\n   * Schemas must be Zod scalar or array-of-scalars (enforced at runtime via assertQueryParamSchema).\n   */\n  const addQueryParams = (options: Modules.ContentAPI.AddQueryParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addQueryParam({ param, ...rest }));\n  };\n\n  /**\n   * Register extra input params (root-level body.data). Keys = param names; values = { schema, matchRoute? }.\n   * Any Zod type allowed; enforced at registration time.\n   */\n  const addInputParams = (options: Modules.ContentAPI.AddInputParamsOptions) => {\n    Object.entries(options).forEach(([param, rest]) => addInputParam({ param, ...rest }));\n  };\n\n  /** Merge all registered extra params into the given routes (mutates in place). Called at route registration. Throws if a param key already exists. */\n  const applyExtraParamsToRoutes = (routes: Core.Route[]): void => {\n    routes.forEach((route) => {\n      for (const { param, schema, matchRoute } of extraQueryParams) {\n        mergeOneQueryParamIntoRoute(route, param, schema, matchRoute);\n      }\n      for (const { param, schema, matchRoute } of extraInputParams) {\n        mergeOneInputParamIntoRoute(route, param, schema, matchRoute);\n      }\n    });\n  };\n\n  const getRoutesMap = async () => {\n    const routesMap: Record<string, Core.Route[]> = {};\n\n    for (const [apiName, api] of Object.entries(strapi.apis)) {\n      const routes = Object.values(api.routes)\n        .flatMap((route) => ('routes' in route ? route.routes : route))\n        .filter(filterContentAPI);\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`api::${apiName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    }\n\n    for (const [pluginName, plugin] of Object.entries(strapi.plugins)) {\n      const transformPrefix = transformRoutePrefixFor(pluginName);\n\n      const pluginRoutes = Array.isArray(plugin.routes)\n        ? plugin.routes\n        : Object.values(plugin.routes).flatMap((route) => route.routes);\n\n      const routes = pluginRoutes.map(transformPrefix).filter(filterContentAPI);\n\n      if (routes.length === 0) {\n        continue;\n      }\n\n      const apiPrefix = strapi.config.get('api.rest.prefix');\n      routesMap[`plugin::${pluginName}`] = routes.map((route) => ({\n        ...route,\n        path: `${apiPrefix}${route.path}`,\n      }));\n    }\n\n    return sanitizeRoutesMapForSerialization(routesMap);\n  };\n\n  const sanitizer = sanitize.createAPISanitizers({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get sanitizers() {\n      return {\n        input: strapi.sanitizers.get('content-api.input'),\n        output: strapi.sanitizers.get('content-api.output'),\n      };\n    },\n  });\n\n  const validator = validate.createAPIValidators({\n    getModel(uid: string) {\n      return strapi.getModel(uid as UID.Schema);\n    },\n    get validators() {\n      return {\n        input: strapi.validators.get('content-api.input'),\n      };\n    },\n  });\n\n  return {\n    permissions: instantiatePermissionsUtilities(strapi),\n    getRoutesMap,\n    sanitize: sanitizer,\n    validate: validator,\n    addQueryParams,\n    addInputParams,\n    applyExtraParamsToRoutes,\n  };\n};\n\nexport default createContentAPI;\n"],"names":["transformRoutePrefixFor","pluginName","route","prefix","config","path","undefined","filterContentAPI","info","type","ALLOWED_QUERY_SCHEMA_TYPES","Set","formatZodSchemaName","length","split","map","part","charAt","toUpperCase","slice","join","assertQueryParamSchema","schema","param","isZodType","name","Error","inspection","inspectZodSchema","innerType","element","has","resolveSchema","schemaOrFactory","z","mergeOneQueryParamIntoRoute","matchRoute","query","request","method","mergeOneInputParamIntoRoute","jsonKey","body","existing","base","shape","object","createContentAPI","strapi","extraQueryParams","extraInputParams","addQueryParam","options","ALLOWED_QUERY_PARAM_KEYS","includes","some","o","push","addInputParam","RESERVED_INPUT_PARAM_KEYS","addQueryParams","Object","entries","forEach","rest","addInputParams","applyExtraParamsToRoutes","routes","getRoutesMap","routesMap","apiName","api","apis","values","flatMap","filter","apiPrefix","get","plugin","plugins","transformPrefix","pluginRoutes","Array","isArray","sanitizeRoutesMapForSerialization","sanitizer","sanitize","createAPISanitizers","getModel","uid","sanitizers","input","output","validator","validate","createAPIValidators","validators","permissions","instantiatePermissionsUtilities"],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;AAeA,MAAMA,uBAAAA,GAA0B,CAACC,UAAAA,GAAuB,CAACC,KAAAA,GAAAA;AACvD,QAAA,MAAMC,SAASD,KAAAA,CAAME,MAAM,IAAIF,KAAAA,CAAME,MAAM,CAACD,MAAM;AAClD,QAAA,MAAME,IAAAA,GAAOF,MAAAA,KAAWG,SAAAA,GAAY,CAAA,EAAGH,SAASD,KAAAA,CAAMG,IAAI,CAAA,CAAE,GAAG,CAAC,CAAC,EAAEJ,UAAAA,CAAAA,EAAaC,KAAAA,CAAMG,IAAI,CAAA,CAAE;QAE5F,OAAO;AACL,YAAA,GAAGH,KAAK;AACRG,YAAAA;AACF,SAAA;AACF,IAAA,CAAA;AAEA,MAAME,mBAAmB,CAACL,KAAAA,GAAsBA,MAAMM,IAAI,CAACC,IAAI,KAAK,aAAA;AAEpE;;;;;IAMA,MAAMC,0BAAAA,GAA6B,IAAIC,GAAAA,CAAI;AAAC,IAAA,QAAA;AAAU,IAAA,QAAA;AAAU,IAAA,SAAA;AAAW,IAAA;AAAO,CAAA,CAAA;AAElF,MAAMC,sBAAsB,CAACH,IAAAA,GAAAA;IAC3B,IAAIA,IAAAA,CAAKI,MAAM,KAAK,CAAA,EAAG;QACrB,OAAO,EAAA;AACT,IAAA;IAEA,OAAO,CAAC,GAAG,EAAEJ,IAAAA,CACVK,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,IAAAA,GAAS,CAAA,EAAGA,KAAKC,MAAM,CAAC,CAAA,CAAA,CAAGC,WAAW,EAAA,CAAA,EAAKF,IAAAA,CAAKG,KAAK,CAAC,CAAA,CAAA,CAAA,CAAI,CAAA,CAC/DC,IAAI,CAAC,EAAA,CAAA,CAAA,CAAK;AACf,CAAA;AAEA,SAASC,sBAAAA,CAAuBC,MAAe,EAAEC,KAAa,EAAA;IAC5D,IAAI,CAACC,cAAUF,MAAAA,CAAAA,EAAS;AACtB,QAAA,MAAMG,IAAAA,GACJ,OAAOH,MAAAA,KAAW,QAAA,IAAYA,MAAAA,KAAW,IAAA,GACpC,MAACA,CAA+C,WAAW,EAAEG,IAAAA,IAAQ,QAAA,GACtE,OAAOH,MAAAA;QACb,MAAM,IAAII,KAAAA,CACR,CAAC,kCAAkC,EAAEH,MAAM,mFAAmF,EAAEE,IAAAA,CAAK,wCAAwC,CAAC,CAAA;AAElL,IAAA;AAEA,IAAA,MAAME,aAAaC,oBAAAA,CAAiBN,MAAAA,CAAAA;AAEpC,IAAA,IAAIK,WAAWlB,IAAI,KAAK,cAAckB,UAAAA,CAAWlB,IAAI,KAAK,SAAA,EAAW;QACnEY,sBAAAA,CAAuBM,UAAAA,CAAWE,SAAS,EAAEN,KAAAA,CAAAA;AAC7C,QAAA;AACF,IAAA;IAEA,IAAII,UAAAA,CAAWlB,IAAI,KAAK,OAAA,EAAS;QAC/BY,sBAAAA,CAAuBM,UAAAA,CAAWG,OAAO,EAAEP,KAAAA,CAAAA;AAC3C,QAAA;AACF,IAAA;AAEA,IAAA,IAAI,CAACb,0BAAAA,CAA2BqB,GAAG,CAACJ,UAAAA,CAAWlB,IAAI,CAAA,EAAG;AACpD,QAAA,MAAM,IAAIiB,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,mFAAmF,EAAEX,mBAAAA,CAAoBe,UAAAA,CAAWlB,IAAI,CAAA,CAAE,wCAAwC,CAAC,CAAA;AAElN,IAAA;AACF;AAEA,SAASuB,cAAiBC,eAAiD,EAAA;IACzE,IAAI,OAAOA,oBAAoB,UAAA,EAAY;AACzC,QAAA,OAAO,eAACA,CAA+CC,YAAAA,CAAAA;AACzD,IAAA;IACA,OAAOD,eAAAA;AACT;AAEA,MAAME,2BAAAA,GAA8B,CAClCjC,KAAAA,EACAqB,KAAAA,EACAD,MAAAA,EACAc,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWlC,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAMmC,KAAAA,GAAQ;QAAE,GAAGnC,KAAAA,CAAMoC,OAAO,EAAED;AAAM,KAAA;AACxC,IAAA,IAAId,SAASc,KAAAA,EAAO;AAClB,QAAA,MAAM,IAAIX,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAErB,KAAAA,CAAMqC,MAAM,CAAC,CAAC,EAAErC,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACAH,IAAAA,KAAAA,CAAMoC,OAAO,GAAG;AAAE,QAAA,GAAGpC,MAAMoC,OAAO;QAAED,KAAAA,EAAO;AAAE,YAAA,GAAGA,KAAK;AAAE,YAAA,CAACd,QAAQD;AAAO;AAAE,KAAA;AAC3E,CAAA;AAEA,MAAMkB,2BAAAA,GAA8B,CAClCtC,KAAAA,EACAqB,KAAAA,EACAD,MAAAA,EACAc,UAAAA,GAAAA;IAEA,IAAIA,UAAAA,IAAc,CAACA,UAAAA,CAAWlC,KAAAA,CAAAA,EAAQ;AACtC,IAAA,MAAMuC,OAAAA,GAAU,kBAAA;AAEhB,IAAA,MAAMC,IAAAA,GAAkBxC,KAAAA,CAAMoC,OAAO,EAAEI,IAAAA,GAAO;QAAE,GAAGxC,KAAAA,CAAMoC,OAAO,CAACI;AAAK,KAAA,GAAK,EAAC;IAC5E,MAAMC,QAAAA,GAAWD,IAAI,CAACD,OAAAA,CAAQ;IAC9B,MAAMG,IAAAA,GACJD,QAAAA,IAAY,OAAOA,QAAAA,KAAa,QAAA,IAAY,OAAA,IAAWA,QAAAA,GACnD,QAACA,CAAkDE,KAAK,GACxD,EAAC;AACP,IAAA,IAAItB,SAASqB,IAAAA,EAAM;AACjB,QAAA,MAAM,IAAIlB,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,0BAA0B,EAAErB,KAAAA,CAAMqC,MAAM,CAAC,CAAC,EAAErC,KAAAA,CAAMG,IAAI,CAAA,CAAE,CAAA;AAEvG,IAAA;AACAqC,IAAAA,IAAI,CAACD,OAAAA,CAAQ,GAAGP,YAAAA,CAAEY,MAAM,CAAC;AAAE,QAAA,GAAGF,IAAI;AAAE,QAAA,CAACrB,QAAQD;AAAO,KAAA,CAAA;AACpDpB,IAAAA,KAAAA,CAAMoC,OAAO,GAAG;AAAE,QAAA,GAAGpC,MAAMoC,OAAO;AAAEI,QAAAA;AAAK,KAAA;AAC3C,CAAA;AAcA;;IAGA,MAAMK,mBAAmB,CAACC,MAAAA,GAAAA;AACxB,IAAA,MAAMC,mBAA8C,EAAE;AACtD,IAAA,MAAMC,mBAA8C,EAAE;AAEtD,IAAA,MAAMC,gBAAgB,CAACC,OAAAA,GAAAA;QACrB,MAAM,EAAE7B,KAAK,EAAED,MAAAA,EAAQW,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM9B,SAASU,aAAAA,CAAcC,eAAAA,CAAAA;AAC7BZ,QAAAA,sBAAAA,CAAuBC,MAAAA,EAAQC,KAAAA,CAAAA;AAC/B,QAAA,IAAI8B,oCAACA,CAA+CC,QAAQ,CAAC/B,KAAAA,CAAAA,EAAQ;AACnE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAI0B,gBAAAA,CAAiBM,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEjC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACA0B,QAAAA,gBAAAA,CAAiBQ,IAAI,CAAC;AAAElC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQc,YAAAA;AAAW,SAAA,CAAA;;;;;AAKpD,IAAA,CAAA;AAEA,IAAA,MAAMsB,gBAAgB,CAACN,OAAAA,GAAAA;QACrB,MAAM,EAAE7B,KAAK,EAAED,MAAAA,EAAQW,eAAe,EAAEG,UAAU,EAAE,GAAGgB,OAAAA;AACvD,QAAA,MAAM9B,SAASU,aAAAA,CAAcC,eAAAA,CAAAA;AAC7B,QAAA,IAAI0B,qCAACA,CAAgDL,QAAQ,CAAC/B,KAAAA,CAAAA,EAAQ;AACpE,YAAA,MAAM,IAAIG,KAAAA,CACR,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,6CAA6C,CAAC,CAAA;AAE7F,QAAA;QACA,IAAI2B,gBAAAA,CAAiBK,IAAI,CAAC,CAACC,IAAMA,CAAAA,CAAEjC,KAAK,KAAKA,KAAAA,CAAAA,EAAQ;AACnD,YAAA,MAAM,IAAIG,KAAAA,CAAM,CAAC,kCAAkC,EAAEH,KAAAA,CAAM,wBAAwB,CAAC,CAAA;AACtF,QAAA;AACA2B,QAAAA,gBAAAA,CAAiBO,IAAI,CAAC;AAAElC,YAAAA,KAAAA;AAAOD,YAAAA,MAAAA;AAAQc,YAAAA;AAAW,SAAA,CAAA;;AAEpD,IAAA,CAAA;AAEA;;;MAIA,MAAMwB,iBAAiB,CAACR,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACxC,KAAAA,EAAOyC,IAAAA,CAAK,GAAKb,aAAAA,CAAc;AAAE5B,gBAAAA,KAAAA;AAAO,gBAAA,GAAGyC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;AAEA;;;MAIA,MAAMC,iBAAiB,CAACb,OAAAA,GAAAA;QACtBS,MAAAA,CAAOC,OAAO,CAACV,OAAAA,CAAAA,CAASW,OAAO,CAAC,CAAC,CAACxC,KAAAA,EAAOyC,IAAAA,CAAK,GAAKN,aAAAA,CAAc;AAAEnC,gBAAAA,KAAAA;AAAO,gBAAA,GAAGyC;AAAK,aAAA,CAAA,CAAA;AACpF,IAAA,CAAA;2JAGA,MAAME,wBAAAA,GAA2B,CAACC,MAAAA,GAAAA;QAChCA,MAAAA,CAAOJ,OAAO,CAAC,CAAC7D,KAAAA,GAAAA;YACd,KAAK,MAAM,EAAEqB,KAAK,EAAED,MAAM,EAAEc,UAAU,EAAE,IAAIa,gBAAAA,CAAkB;gBAC5Dd,2BAAAA,CAA4BjC,KAAAA,EAAOqB,OAAOD,MAAAA,EAAQc,UAAAA,CAAAA;AACpD,YAAA;YACA,KAAK,MAAM,EAAEb,KAAK,EAAED,MAAM,EAAEc,UAAU,EAAE,IAAIc,gBAAAA,CAAkB;gBAC5DV,2BAAAA,CAA4BtC,KAAAA,EAAOqB,OAAOD,MAAAA,EAAQc,UAAAA,CAAAA;AACpD,YAAA;AACF,QAAA,CAAA,CAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAMgC,YAAAA,GAAe,UAAA;AACnB,QAAA,MAAMC,YAA0C,EAAC;QAEjD,KAAK,MAAM,CAACC,OAAAA,EAASC,GAAAA,CAAI,IAAIV,OAAOC,OAAO,CAACd,MAAAA,CAAOwB,IAAI,CAAA,CAAG;AACxD,YAAA,MAAML,SAASN,MAAAA,CAAOY,MAAM,CAACF,GAAAA,CAAIJ,MAAM,EACpCO,OAAO,CAAC,CAACxE,KAAAA,GAAW,YAAYA,KAAAA,GAAQA,KAAAA,CAAMiE,MAAM,GAAGjE,KAAAA,CAAAA,CACvDyE,MAAM,CAACpE,gBAAAA,CAAAA;YAEV,IAAI4D,MAAAA,CAAOtD,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAM+D,SAAAA,GAAY5B,MAAAA,CAAO5C,MAAM,CAACyE,GAAG,CAAC,iBAAA,CAAA;AACpCR,YAAAA,SAAS,CAAC,CAAC,KAAK,EAAEC,OAAAA,CAAAA,CAAS,CAAC,GAAGH,MAAAA,CAAOpD,GAAG,CAAC,CAACb,KAAAA,IAAW;AACpD,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAGuE,SAAAA,CAAAA,EAAY1E,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA;QAEA,KAAK,MAAM,CAACJ,UAAAA,EAAY6E,MAAAA,CAAO,IAAIjB,OAAOC,OAAO,CAACd,MAAAA,CAAO+B,OAAO,CAAA,CAAG;AACjE,YAAA,MAAMC,kBAAkBhF,uBAAAA,CAAwBC,UAAAA,CAAAA;YAEhD,MAAMgF,YAAAA,GAAeC,MAAMC,OAAO,CAACL,OAAOX,MAAM,CAAA,GAC5CW,OAAOX,MAAM,GACbN,OAAOY,MAAM,CAACK,OAAOX,MAAM,CAAA,CAAEO,OAAO,CAAC,CAACxE,KAAAA,GAAUA,KAAAA,CAAMiE,MAAM,CAAA;AAEhE,YAAA,MAAMA,SAASc,YAAAA,CAAalE,GAAG,CAACiE,eAAAA,CAAAA,CAAiBL,MAAM,CAACpE,gBAAAA,CAAAA;YAExD,IAAI4D,MAAAA,CAAOtD,MAAM,KAAK,CAAA,EAAG;AACvB,gBAAA;AACF,YAAA;AAEA,YAAA,MAAM+D,SAAAA,GAAY5B,MAAAA,CAAO5C,MAAM,CAACyE,GAAG,CAAC,iBAAA,CAAA;AACpCR,YAAAA,SAAS,CAAC,CAAC,QAAQ,EAAEpE,UAAAA,CAAAA,CAAY,CAAC,GAAGkE,MAAAA,CAAOpD,GAAG,CAAC,CAACb,KAAAA,IAAW;AAC1D,oBAAA,GAAGA,KAAK;AACRG,oBAAAA,IAAAA,EAAM,CAAA,EAAGuE,SAAAA,CAAAA,EAAY1E,KAAAA,CAAMG,IAAI,CAAA;iBACjC,CAAA,CAAA;AACF,QAAA;AAEA,QAAA,OAAO+E,6CAAAA,CAAkCf,SAAAA,CAAAA;AAC3C,IAAA,CAAA;IAEA,MAAMgB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CC,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAOzC,MAAAA,CAAOwC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIC,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLC,gBAAAA,KAAAA,EAAO3C,MAAAA,CAAO0C,UAAU,CAACb,GAAG,CAAC,mBAAA,CAAA;AAC7Be,gBAAAA,MAAAA,EAAQ5C,MAAAA,CAAO0C,UAAU,CAACb,GAAG,CAAC,oBAAA;AAChC,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,MAAMgB,SAAAA,GAAYC,oBAAAA,CAASC,mBAAmB,CAAC;AAC7CP,QAAAA,QAAAA,CAAAA,CAASC,GAAW,EAAA;YAClB,OAAOzC,MAAAA,CAAOwC,QAAQ,CAACC,GAAAA,CAAAA;AACzB,QAAA,CAAA;AACA,QAAA,IAAIO,UAAAA,CAAAA,GAAa;YACf,OAAO;AACLL,gBAAAA,KAAAA,EAAO3C,MAAAA,CAAOgD,UAAU,CAACnB,GAAG,CAAC,mBAAA;AAC/B,aAAA;AACF,QAAA;AACF,KAAA,CAAA;IAEA,OAAO;AACLoB,QAAAA,WAAAA,EAAaC,KAAAA,CAAgClD,MAAAA,CAAAA;AAC7CoB,QAAAA,YAAAA;QACAkB,QAAAA,EAAUD,SAAAA;QACVS,QAAAA,EAAUD,SAAAA;AACVjC,QAAAA,cAAAA;AACAK,QAAAA,cAAAA;AACAC,QAAAA;AACF,KAAA;AACF;;;;"}

package/dist/services/content-api/index.mjs

@@ -1,6 +1,6 @@
-import _ from 'lodash';
 import { sanitize, validate, sanitizeRoutesMapForSerialization, RESERVED_INPUT_PARAM_KEYS, ALLOWED_QUERY_PARAM_KEYS } from '@strapi/utils';
 import * as z from 'zod/v4';
+import { isZodType, inspectZodSchema } from '../../utils/zod.mjs';
 import instantiatePermissionsUtilities from './permissions/index.mjs';
 
 const transformRoutePrefixFor = (pluginName)=>(route)=>{
@@ -16,33 +16,35 @@ const filterContentAPI = (route)=>route.info.type === 'content-api';
  * Runtime check for addQueryParams: we only allow scalar or array-of-scalar schemas (no nested objects).
  * We keep this in addition to the ZodQueryParamSchema type because: (1) TypeScript can be bypassed (JS,
  * any, or schema from another Zod instance); (2) it gives a clear, immediate error at registration
- * time instead of a later failure in validate/sanitize. This list is intentionally tied to Zod v4
- * constructor names; if Zod changes internals, this may need updating.
- * Compatibility: Zod 3 and Zod 4 Classic (zod/v4) both use these constructor names and
- * expose ._def with .innerType / .element for Optional/Default/Array. Zod 4 Core/Mini use
- * ._zod.def instead; we only accept schemas from the same zod/v4 instance used here.
- */ const ALLOWED_QUERY_SCHEMA_NAMES = new Set([
-    'ZodString',
-    'ZodNumber',
-    'ZodBoolean',
-    'ZodEnum',
-    'ZodOptional',
-    'ZodDefault',
-    'ZodArray'
+ * time instead of a later failure in validate/sanitize.
+ */ const ALLOWED_QUERY_SCHEMA_TYPES = new Set([
+    'string',
+    'number',
+    'boolean',
+    'enum'
 ]);
+const formatZodSchemaName = (type)=>{
+    if (type.length === 0) {
+        return '';
+    }
+    return `Zod${type.split('_').map((part)=>`${part.charAt(0).toUpperCase()}${part.slice(1)}`).join('')}`;
+};
 function assertQueryParamSchema(schema, param) {
-    const name = schema?.constructor?.name ?? '';
-    if (!ALLOWED_QUERY_SCHEMA_NAMES.has(name)) {
+    if (!isZodType(schema)) {
+        const name = typeof schema === 'object' && schema !== null ? schema.constructor?.name ?? 'Object' : typeof schema;
         throw new Error(`contentAPI.addQueryParams: param "${param}" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${name}. Use addInputParams for nested objects.`);
     }
-    if (name === 'ZodOptional' || name === 'ZodDefault') {
-        const inner = schema?._def?.innerType;
-        if (inner) assertQueryParamSchema(inner, param);
+    const inspection = inspectZodSchema(schema);
+    if (inspection.type === 'optional' || inspection.type === 'default') {
+        assertQueryParamSchema(inspection.innerType, param);
         return;
     }
-    if (name === 'ZodArray') {
-        const element = schema?._def?.element;
-        if (element) assertQueryParamSchema(element, param);
+    if (inspection.type === 'array') {
+        assertQueryParamSchema(inspection.element, param);
+        return;
+    }
+    if (!ALLOWED_QUERY_SCHEMA_TYPES.has(inspection.type)) {
+        throw new Error(`contentAPI.addQueryParams: param "${param}" schema must be a scalar (string, number, boolean, enum) or array of scalars; got ${formatZodSchemaName(inspection.type)}. Use addInputParams for nested objects.`);
     }
 }
 function resolveSchema(schemaOrFactory) {
@@ -158,37 +160,30 @@ const mergeOneInputParamIntoRoute = (route, param, schema, matchRoute)=>{
     };
     const getRoutesMap = async ()=>{
         const routesMap = {};
-        _.forEach(strapi.apis, (api, apiName)=>{
-            const routes = _.flatMap(api.routes, (route)=>{
-                if ('routes' in route) {
-                    return route.routes;
-                }
-                return route;
-            }).filter(filterContentAPI);
+        for (const [apiName, api] of Object.entries(strapi.apis)){
+            const routes = Object.values(api.routes).flatMap((route)=>'routes' in route ? route.routes : route).filter(filterContentAPI);
             if (routes.length === 0) {
-                return;
+                continue;
             }
             const apiPrefix = strapi.config.get('api.rest.prefix');
             routesMap[`api::${apiName}`] = routes.map((route)=>({
                     ...route,
                     path: `${apiPrefix}${route.path}`
                 }));
-        });
-        _.forEach(strapi.plugins, (plugin, pluginName)=>{
+        }
+        for (const [pluginName, plugin] of Object.entries(strapi.plugins)){
             const transformPrefix = transformRoutePrefixFor(pluginName);
-            if (Array.isArray(plugin.routes)) {
-                return plugin.routes.map(transformPrefix).filter(filterContentAPI);
-            }
-            const routes = _.flatMap(plugin.routes, (route)=>route.routes.map(transformPrefix)).filter(filterContentAPI);
+            const pluginRoutes = Array.isArray(plugin.routes) ? plugin.routes : Object.values(plugin.routes).flatMap((route)=>route.routes);
+            const routes = pluginRoutes.map(transformPrefix).filter(filterContentAPI);
             if (routes.length === 0) {
-                return;
+                continue;
             }
             const apiPrefix = strapi.config.get('api.rest.prefix');
             routesMap[`plugin::${pluginName}`] = routes.map((route)=>({
                     ...route,
                     path: `${apiPrefix}${route.path}`
                 }));
-        });
+        }
         return sanitizeRoutesMapForSerialization(routesMap);
     };
     const sanitizer = sanitize.createAPISanitizers({