@strapi/utils 5.0.0-beta.0 → 5.0.0-beta.10

package/dist/index.mjs

@@ -1,14 +1,17 @@
-import _$1, { kebabCase } from "lodash";
-import { has, union, getOr, assoc, assign, cloneDeep, remove, eq, curry, isArray, isString, isNil, toPath, isObject, clone, pick, isEmpty, omit, trim, pipe as pipe$1, split, map as map$1, flatten, first, identity, constant, join, merge, mergeAll, get, toNumber, isInteger, defaults, trimChars, trimCharsEnd, trimCharsStart, isNumber } from "lodash/fp";
-import pMap from "p-map";
-import { HttpError } from "http-errors";
+import * as _ from "lodash";
+import ___default, { kebabCase } from "lodash";
+import * as dates$1 from "date-fns";
+import { has, union, getOr, assoc, assign, cloneDeep, remove, eq, curry, isObject, isNil, clone, isArray, isEmpty, toPath, defaults, isString, get, toNumber, isInteger, pick, omit, trim, pipe as pipe$1, split, map as map$1, flatten, first, identity, constant, join, merge, trimChars, trimCharsEnd, trimCharsStart, isNumber } from "lodash/fp";
 import { randomUUID } from "crypto";
 import { machineIdSync } from "node-machine-id";
 import * as yup$1 from "yup";
+import { HttpError } from "http-errors";
+import pMap from "p-map";
 import execa from "execa";
 import preferredPM from "preferred-pm";
 import { Writable } from "node:stream";
 import slugify from "@sindresorhus/slugify";
+import { z } from "zod";
 function _mergeNamespaces(n, m) {
   for (var i = 0; i < m.length; i++) {
     const e = m[i];
@@ -28,8 +31,6 @@ function _mergeNamespaces(n, m) {
   }
   return Object.freeze(Object.defineProperty(n, Symbol.toStringTag, { value: "Module" }));
 }
-const _ = require("lodash");
-const dates$1 = require("date-fns");
 const timeRegex = /^(2[0-3]|[01][0-9]):([0-5][0-9]):([0-5][0-9])(.[0-9]{1,3})?$/;
 const isDate = (v) => {
   return dates$1.isDate(v);
@@ -128,32 +129,32 @@ const parseType = (options) => {
   }
 };
 function envFn(key, defaultValue) {
-  return _$1.has(process.env, key) ? process.env[key] : defaultValue;
+  return ___default.has(process.env, key) ? process.env[key] : defaultValue;
 }
 function getKey(key) {
   return process.env[key] ?? "";
 }
 const utils = {
   int(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     return parseInt(getKey(key), 10);
   },
   float(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     return parseFloat(getKey(key));
   },
   bool(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     return getKey(key) === "true";
   },
   json(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     try {
@@ -166,7 +167,7 @@ const utils = {
     }
   },
   array(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     let value = getKey(key);
@@ -174,11 +175,11 @@ const utils = {
       value = value.substring(1, value.length - 1);
     }
     return value.split(",").map((v) => {
-      return _$1.trim(_$1.trim(v, " "), '"');
+      return ___default.trim(___default.trim(v, " "), '"');
     });
   },
   date(key, defaultValue) {
-    if (!_$1.has(process.env, key)) {
+    if (!___default.has(process.env, key)) {
       return defaultValue;
     }
     return new Date(getKey(key));
@@ -245,12 +246,12 @@ const getCreatorFields = (model) => {
 const getNonWritableAttributes = (model) => {
   if (!model)
     return [];
-  const nonWritableAttributes = _$1.reduce(
+  const nonWritableAttributes = ___default.reduce(
     model.attributes,
     (acc, attr, attrName) => attr.writable === false ? acc.concat(attrName) : acc,
     []
   );
-  return _$1.uniq([
+  return ___default.uniq([
     ID_ATTRIBUTE$4,
     DOC_ID_ATTRIBUTE$4,
     ...getTimestamps(model),
@@ -260,28 +261,37 @@ const getNonWritableAttributes = (model) => {
 const getWritableAttributes = (model) => {
   if (!model)
     return [];
-  return _$1.difference(Object.keys(model.attributes), getNonWritableAttributes(model));
+  return ___default.difference(Object.keys(model.attributes), getNonWritableAttributes(model));
 };
 const isWritableAttribute = (model, attributeName) => {
   return getWritableAttributes(model).includes(attributeName);
 };
 const getNonVisibleAttributes = (model) => {
-  const nonVisibleAttributes = _$1.reduce(
+  const nonVisibleAttributes = ___default.reduce(
     model.attributes,
     (acc, attr, attrName) => attr.visible === false ? acc.concat(attrName) : acc,
     []
   );
-  return _$1.uniq([ID_ATTRIBUTE$4, DOC_ID_ATTRIBUTE$4, ...getTimestamps(model), ...nonVisibleAttributes]);
+  return ___default.uniq([ID_ATTRIBUTE$4, DOC_ID_ATTRIBUTE$4, ...getTimestamps(model), ...nonVisibleAttributes]);
 };
 const getVisibleAttributes = (model) => {
-  return _$1.difference(_$1.keys(model.attributes), getNonVisibleAttributes(model));
+  return ___default.difference(___default.keys(model.attributes), getNonVisibleAttributes(model));
 };
 const isVisibleAttribute = (model, attributeName) => {
   return getVisibleAttributes(model).includes(attributeName);
 };
-const getOptions = (model) => _$1.assign({ draftAndPublish: false }, _$1.get(model, "options", {}));
-const hasDraftAndPublish = (model) => _$1.get(model, "options.draftAndPublish", false) === true;
-const isDraft = (data, model) => hasDraftAndPublish(model) && _$1.get(data, PUBLISHED_AT_ATTRIBUTE$1) === null;
+const getOptions = (model) => ___default.assign({ draftAndPublish: false }, ___default.get(model, "options", {}));
+const hasDraftAndPublish = (model) => ___default.get(model, "options.draftAndPublish", false) === true;
+const isDraft = (data, model) => hasDraftAndPublish(model) && ___default.get(data, PUBLISHED_AT_ATTRIBUTE$1) === null;
+const isSchema = (data) => {
+  return typeof data === "object" && data !== null && "modelType" in data && typeof data.modelType === "string" && ["component", "contentType"].includes(data.modelType);
+};
+const isComponentSchema = (data) => {
+  return isSchema(data) && data.modelType === "component";
+};
+const isContentTypeSchema = (data) => {
+  return isSchema(data) && data.modelType === "contentType";
+};
 const isSingleType = ({ kind = COLLECTION_TYPE }) => kind === SINGLE_TYPE;
 const isCollectionType = ({ kind = COLLECTION_TYPE }) => kind === COLLECTION_TYPE;
 const isKind = (kind) => (model) => model.kind === kind;
@@ -290,9 +300,9 @@ const getStoredPrivateAttributes = (model) => union(
   getOr([], "options.privateAttributes", model)
 );
 const getPrivateAttributes = (model) => {
-  return _$1.union(
+  return ___default.union(
     getStoredPrivateAttributes(model),
-    _$1.keys(_$1.pickBy(model.attributes, (attr) => !!attr.private))
+    ___default.keys(___default.pickBy(model.attributes, (attr) => !!attr.private))
   );
 };
 const isPrivateAttribute = (model, attributeName) => {
@@ -302,17 +312,22 @@ const isPrivateAttribute = (model, attributeName) => {
   return getStoredPrivateAttributes(model).includes(attributeName);
 };
 const isScalarAttribute = (attribute) => {
-  return !["media", "component", "relation", "dynamiczone"].includes(attribute?.type);
+  return attribute && !["media", "component", "relation", "dynamiczone"].includes(attribute.type);
+};
+const getDoesAttributeRequireValidation = (attribute) => {
+  return attribute.required || attribute.unique || Object.prototype.hasOwnProperty.call(attribute, "max") || Object.prototype.hasOwnProperty.call(attribute, "min") || Object.prototype.hasOwnProperty.call(attribute, "maxLength") || Object.prototype.hasOwnProperty.call(attribute, "minLength");
 };
 const isMediaAttribute = (attribute) => attribute?.type === "media";
 const isRelationalAttribute = (attribute) => attribute?.type === "relation";
+const HAS_RELATION_REORDERING = ["manyToMany", "manyToOne", "oneToMany"];
+const hasRelationReordering = (attribute) => isRelationalAttribute(attribute) && HAS_RELATION_REORDERING.includes(attribute.relation);
 const isComponentAttribute = (attribute) => ["component", "dynamiczone"].includes(attribute?.type);
-const isDynamicZoneAttribute = (attribute) => attribute?.type === "dynamiczone";
+const isDynamicZoneAttribute = (attribute) => !!attribute && attribute.type === "dynamiczone";
 const isMorphToRelationalAttribute = (attribute) => {
-  return isRelationalAttribute(attribute) && attribute?.relation?.startsWith?.("morphTo");
+  return !!attribute && isRelationalAttribute(attribute) && attribute.relation?.startsWith?.("morphTo");
 };
 const getComponentAttributes = (schema) => {
-  return _$1.reduce(
+  return ___default.reduce(
     schema.attributes,
     (acc, attr, attrName) => {
       if (isComponentAttribute(attr))
@@ -323,7 +338,7 @@ const getComponentAttributes = (schema) => {
   );
 };
 const getScalarAttributes = (schema) => {
-  return _$1.reduce(
+  return ___default.reduce(
     schema.attributes,
     (acc, attr, attrName) => {
       if (isScalarAttribute(attr))
@@ -333,11 +348,22 @@ const getScalarAttributes = (schema) => {
     []
   );
 };
+const getRelationalAttributes = (schema) => {
+  return ___default.reduce(
+    schema.attributes,
+    (acc, attr, attrName) => {
+      if (isRelationalAttribute(attr))
+        acc.push(attrName);
+      return acc;
+    },
+    []
+  );
+};
 const isTypedAttribute = (attribute, type) => {
-  return _$1.has(attribute, "type") && attribute.type === type;
+  return ___default.has(attribute, "type") && attribute.type === type;
 };
 const getContentTypeRoutePrefix = (contentType) => {
-  return isSingleType(contentType) ? _$1.kebabCase(contentType.info.singularName) : _$1.kebabCase(contentType.info.pluralName);
+  return isSingleType(contentType) ? ___default.kebabCase(contentType.info.singularName) : ___default.kebabCase(contentType.info.pluralName);
 };
 const contentTypes = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
@@ -345,17 +371,22 @@ const contentTypes = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   getComponentAttributes,
   getContentTypeRoutePrefix,
   getCreatorFields,
+  getDoesAttributeRequireValidation,
   getNonVisibleAttributes,
   getNonWritableAttributes,
   getOptions,
   getPrivateAttributes,
+  getRelationalAttributes,
   getScalarAttributes,
   getTimestamps,
   getVisibleAttributes,
   getWritableAttributes,
   hasDraftAndPublish,
+  hasRelationReordering,
   isCollectionType,
   isComponentAttribute,
+  isComponentSchema,
+  isContentTypeSchema,
   isDraft,
   isDynamicZoneAttribute,
   isKind,
@@ -364,6 +395,7 @@ const contentTypes = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.define
   isPrivateAttribute,
   isRelationalAttribute,
   isScalarAttribute,
+  isSchema,
   isSingleType,
   isTypedAttribute,
   isVisibleAttribute,
@@ -516,201 +548,33 @@ const providerFactory = (options = {}) => {
     }
   };
 };
-function pipe(...fns) {
-  const [firstFn, ...fnRest] = fns;
-  return async (...args) => {
-    let res = await firstFn.apply(firstFn, args);
-    for (let i = 0; i < fnRest.length; i += 1) {
-      res = await fnRest[i](res);
-    }
-    return res;
+const traverseEntity = async (visitor2, options, entity) => {
+  const { path = { raw: null, attribute: null }, schema, getModel } = options;
+  let parent = options.parent;
+  const traverseMorphRelationTarget = async (visitor22, path2, entry) => {
+    const targetSchema = getModel(entry.__type);
+    const traverseOptions = { schema: targetSchema, path: path2, getModel, parent };
+    return traverseEntity(visitor22, traverseOptions, entry);
   };
-}
-const map = curry(pMap);
-const reduce = (mixedArray) => async (iteratee, initialValue) => {
-  let acc = initialValue;
-  for (let i = 0; i < mixedArray.length; i += 1) {
-    acc = await iteratee(acc, await mixedArray[i], i);
-  }
-  return acc;
-};
-const async = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  map,
-  pipe,
-  reduce
-}, Symbol.toStringTag, { value: "Module" }));
-const visitor$8 = ({ key, attribute }, { remove: remove2 }) => {
-  if (attribute?.type === "password") {
-    remove2(key);
-  }
-};
-const visitor$7 = ({ schema, key, attribute }, { remove: remove2 }) => {
-  if (!attribute) {
-    return;
-  }
-  const isPrivate = attribute.private === true || isPrivateAttribute(schema, key);
-  if (isPrivate) {
-    remove2(key);
-  }
-};
-const ACTIONS_TO_VERIFY$1 = ["find"];
-const { CREATED_BY_ATTRIBUTE: CREATED_BY_ATTRIBUTE$1, UPDATED_BY_ATTRIBUTE: UPDATED_BY_ATTRIBUTE$1 } = constants$1;
-const removeRestrictedRelations = (auth) => async ({ data, key, attribute, schema }, { remove: remove2, set }) => {
-  if (!attribute) {
-    return;
-  }
-  const isRelation = attribute.type === "relation";
-  if (!isRelation) {
-    return;
-  }
-  const handleMorphRelation = async () => {
-    const newMorphValue = [];
-    for (const element of data[key]) {
-      const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${element.__type}.${action}`);
-      const isAllowed = await hasAccessToSomeScopes$1(scopes, auth);
-      if (isAllowed) {
-        newMorphValue.push(element);
-      }
-    }
-    if (newMorphValue.length === 0) {
-      remove2(key);
-    } else {
-      set(key, newMorphValue);
-    }
+  const traverseRelationTarget = (schema2) => async (visitor22, path2, entry) => {
+    const traverseOptions = { schema: schema2, path: path2, getModel, parent };
+    return traverseEntity(visitor22, traverseOptions, entry);
   };
-  const handleRegularRelation = async () => {
-    const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${attribute.target}.${action}`);
-    const isAllowed = await hasAccessToSomeScopes$1(scopes, auth);
-    if (!isAllowed) {
-      remove2(key);
-    }
+  const traverseMediaTarget = async (visitor22, path2, entry) => {
+    const targetSchemaUID = "plugin::upload.file";
+    const targetSchema = getModel(targetSchemaUID);
+    const traverseOptions = { schema: targetSchema, path: path2, getModel, parent };
+    return traverseEntity(visitor22, traverseOptions, entry);
+  };
+  const traverseComponent = async (visitor22, path2, schema2, entry) => {
+    const traverseOptions = { schema: schema2, path: path2, getModel, parent };
+    return traverseEntity(visitor22, traverseOptions, entry);
+  };
+  const visitDynamicZoneEntry = async (visitor22, path2, entry) => {
+    const targetSchema = getModel(entry.__component);
+    const traverseOptions = { schema: targetSchema, path: path2, getModel, parent };
+    return traverseEntity(visitor22, traverseOptions, entry);
   };
-  const isCreatorRelation = [CREATED_BY_ATTRIBUTE$1, UPDATED_BY_ATTRIBUTE$1].includes(key);
-  if (isMorphToRelationalAttribute(attribute)) {
-    await handleMorphRelation();
-    return;
-  }
-  if (isCreatorRelation && schema.options?.populateCreatorFields) {
-    return;
-  }
-  await handleRegularRelation();
-};
-const hasAccessToSomeScopes$1 = async (scopes, auth) => {
-  for (const scope of scopes) {
-    try {
-      await strapi.auth.verify(auth, { scope });
-      return true;
-    } catch {
-      continue;
-    }
-  }
-  return false;
-};
-const visitor$6 = ({ key, attribute }, { remove: remove2 }) => {
-  if (isMorphToRelationalAttribute(attribute)) {
-    remove2(key);
-  }
-};
-const visitor$5 = ({ key, attribute }, { remove: remove2 }) => {
-  if (isDynamicZoneAttribute(attribute)) {
-    remove2(key);
-  }
-};
-const removeDisallowedFields = (allowedFields = null) => ({ key, path: { attribute: path } }, { remove: remove2 }) => {
-  if (allowedFields === null) {
-    return;
-  }
-  if (!(isArray(allowedFields) && allowedFields.every(isString))) {
-    throw new TypeError(
-      `Expected array of strings for allowedFields but got "${typeof allowedFields}"`
-    );
-  }
-  if (isNil(path)) {
-    return;
-  }
-  const containedPaths = getContainedPaths$1(path);
-  const isPathAllowed = allowedFields.some(
-    (p) => containedPaths.includes(p) || p.startsWith(`${path}.`)
-  );
-  if (isPathAllowed) {
-    return;
-  }
-  remove2(key);
-};
-const getContainedPaths$1 = (path) => {
-  const parts = toPath(path);
-  return parts.reduce((acc, value, index2, list) => {
-    return [...acc, list.slice(0, index2 + 1).join(".")];
-  }, []);
-};
-const removeRestrictedFields = (restrictedFields = null) => ({ key, path: { attribute: path } }, { remove: remove2 }) => {
-  if (restrictedFields === null) {
-    remove2(key);
-    return;
-  }
-  if (!(isArray(restrictedFields) && restrictedFields.every(isString))) {
-    throw new TypeError(
-      `Expected array of strings for restrictedFields but got "${typeof restrictedFields}"`
-    );
-  }
-  if (restrictedFields.includes(path)) {
-    remove2(key);
-    return;
-  }
-  const isRestrictedNested = restrictedFields.some(
-    (allowedPath) => path?.toString().startsWith(`${allowedPath}.`)
-  );
-  if (isRestrictedNested) {
-    remove2(key);
-  }
-};
-const visitor$4 = ({ schema, key, value }, { set }) => {
-  if (key === "" && value === "*") {
-    const { attributes } = schema;
-    const newPopulateQuery = Object.entries(attributes).filter(
-      ([, attribute]) => ["relation", "component", "media", "dynamiczone"].includes(attribute.type)
-    ).reduce((acc, [key2]) => ({ ...acc, [key2]: true }), {});
-    set("", newPopulateQuery);
-  }
-};
-const visitors$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  expandWildcardPopulate: visitor$4,
-  removeDisallowedFields,
-  removeDynamicZones: visitor$5,
-  removeMorphToRelations: visitor$6,
-  removePassword: visitor$8,
-  removePrivate: visitor$7,
-  removeRestrictedFields,
-  removeRestrictedRelations
-}, Symbol.toStringTag, { value: "Module" }));
-const traverseMorphRelationTarget = async (visitor2, path, entry) => {
-  const targetSchema = strapi.getModel(entry.__type);
-  const traverseOptions = { schema: targetSchema, path };
-  return traverseEntity(visitor2, traverseOptions, entry);
-};
-const traverseRelationTarget = (schema) => async (visitor2, path, entry) => {
-  const traverseOptions = { schema, path };
-  return traverseEntity(visitor2, traverseOptions, entry);
-};
-const traverseMediaTarget = async (visitor2, path, entry) => {
-  const targetSchemaUID = "plugin::upload.file";
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const traverseOptions = { schema: targetSchema, path };
-  return traverseEntity(visitor2, traverseOptions, entry);
-};
-const traverseComponent = async (visitor2, path, schema, entry) => {
-  const traverseOptions = { schema, path };
-  return traverseEntity(visitor2, traverseOptions, entry);
-};
-const visitDynamicZoneEntry = async (visitor2, path, entry) => {
-  const targetSchema = strapi.getModel(entry.__component);
-  const traverseOptions = { schema: targetSchema, path };
-  return traverseEntity(visitor2, traverseOptions, entry);
-};
-const traverseEntity = async (visitor2, options, entity) => {
-  const { path = { raw: null, attribute: null }, schema } = options;
   if (!isObject(entity) || isNil(schema)) {
     return entity;
   }
@@ -720,9 +584,6 @@ const traverseEntity = async (visitor2, options, entity) => {
   for (let i = 0; i < keys.length; i += 1) {
     const key = keys[i];
     const attribute = schema.attributes[key];
-    if (isNil(attribute)) {
-      continue;
-    }
     const newPath = { ...path };
     newPath.raw = isNil(path.raw) ? key : `${path.raw}.${key}`;
     if (!isNil(attribute)) {
@@ -734,16 +595,19 @@ const traverseEntity = async (visitor2, options, entity) => {
       key,
       value: copy[key],
       attribute,
-      path: newPath
+      path: newPath,
+      getModel,
+      parent
     };
     await visitor2(visitorOptions, visitorUtils);
     const value = copy[key];
-    if (isNil(value)) {
+    if (isNil(value) || isNil(attribute)) {
       continue;
     }
+    parent = { schema, key, attribute, path: newPath };
     if (isRelationalAttribute(attribute)) {
       const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
-      const method = isMorphRelation ? traverseMorphRelationTarget : traverseRelationTarget(strapi.getModel(attribute.target));
+      const method = isMorphRelation ? traverseMorphRelationTarget : traverseRelationTarget(getModel(attribute.target));
       if (isArray(value)) {
         const res = new Array(value.length);
         for (let i2 = 0; i2 < value.length; i2 += 1) {
@@ -768,7 +632,7 @@ const traverseEntity = async (visitor2, options, entity) => {
       continue;
     }
     if (attribute.type === "component") {
-      const targetSchema = strapi.getModel(attribute.component);
+      const targetSchema = getModel(attribute.component);
       if (isArray(value)) {
         const res = new Array(value.length);
         for (let i2 = 0; i2 < value.length; i2 += 1) {
@@ -800,74 +664,859 @@ const createVisitorUtils = ({ data }) => ({
   }
 });
 const traverseEntity$1 = curry(traverseEntity);
-const DEFAULT_PATH = { raw: null, attribute: null };
-const traverseFactory = () => {
-  const state = {
-    parsers: [],
-    interceptors: [],
-    ignore: [],
-    handlers: {
-      attributes: [],
-      common: []
-    }
-  };
-  const traverse = async (visitor2, options, data) => {
-    const { path = DEFAULT_PATH, schema } = options ?? {};
-    for (const { predicate, handler } of state.interceptors) {
-      if (predicate(data)) {
-        return handler(visitor2, options, data, { recurse: traverse });
-      }
-    }
-    const parser = state.parsers.find((parser2) => parser2.predicate(data))?.parser;
-    const utils2 = parser?.(data);
-    if (!utils2) {
-      return data;
-    }
-    let out = utils2.transform(data);
-    const keys = utils2.keys(out);
-    for (const key of keys) {
-      const attribute = schema?.attributes?.[key] ?? // FIX: Needed to not break existing behavior on the API.
-      //      It looks for the attribute in the DB metadata when the key is in snake_case
-      schema?.attributes?.[strapi.db.metadata.get(schema?.uid).columnToAttribute[key]];
-      const newPath = { ...path };
-      newPath.raw = isNil(path.raw) ? key : `${path.raw}.${key}`;
-      if (!isNil(attribute)) {
-        newPath.attribute = isNil(path.attribute) ? key : `${path.attribute}.${key}`;
-      }
-      const visitorOptions = {
-        key,
-        value: utils2.get(key, out),
-        attribute,
-        schema,
-        path: newPath,
-        data: out
-      };
-      const transformUtils = {
-        remove(key2) {
-          out = utils2.remove(key2, out);
-        },
-        set(key2, value2) {
-          out = utils2.set(key2, value2, out);
-        },
-        recurse: traverse
-      };
-      await visitor2(visitorOptions, pick(["remove", "set"], transformUtils));
-      const value = utils2.get(key, out);
-      const createContext = () => ({
-        key,
-        value,
-        attribute,
-        schema,
-        path: newPath,
-        data: out,
-        visitor: visitor2
-      });
-      const ignoreCtx = createContext();
-      const shouldIgnore = state.ignore.some((predicate) => predicate(ignoreCtx));
-      if (shouldIgnore) {
-        continue;
-      }
-      const handlers = [...state.handlers.common, ...state.handlers.attributes];
+function importDefault(modName) {
+  const mod = require(modName);
+  return mod && mod.__esModule ? mod.default : mod;
+}
+const machineId = () => {
+  try {
+    const deviceId = machineIdSync();
+    return deviceId;
+  } catch (error) {
+    const deviceId = randomUUID();
+    return deviceId;
+  }
+};
+const formatYupInnerError = (yupError) => ({
+  path: toPath(yupError.path),
+  message: yupError.message,
+  name: yupError.name
+});
+const formatYupErrors = (yupError) => ({
+  errors: isEmpty(yupError.inner) ? [formatYupInnerError(yupError)] : yupError.inner.map(formatYupInnerError),
+  message: yupError.message
+});
+class ApplicationError extends Error {
+  name;
+  details;
+  message;
+  constructor(message = "An application error occured", details = {}) {
+    super();
+    this.name = "ApplicationError";
+    this.message = message;
+    this.details = details;
+  }
+}
+class ValidationError extends ApplicationError {
+  constructor(message, details) {
+    super(message, details);
+    this.name = "ValidationError";
+  }
+}
+class YupValidationError extends ValidationError {
+  constructor(yupError, message) {
+    super("Validation");
+    const { errors: errors2, message: yupMessage } = formatYupErrors(yupError);
+    this.message = message || yupMessage;
+    this.details = { errors: errors2 };
+  }
+}
+class PaginationError extends ApplicationError {
+  constructor(message = "Invalid pagination", details) {
+    super(message, details);
+    this.name = "PaginationError";
+    this.message = message;
+  }
+}
+class NotFoundError extends ApplicationError {
+  constructor(message = "Entity not found", details) {
+    super(message, details);
+    this.name = "NotFoundError";
+    this.message = message;
+  }
+}
+class ForbiddenError extends ApplicationError {
+  constructor(message = "Forbidden access", details) {
+    super(message, details);
+    this.name = "ForbiddenError";
+    this.message = message;
+  }
+}
+class UnauthorizedError extends ApplicationError {
+  constructor(message = "Unauthorized", details) {
+    super(message, details);
+    this.name = "UnauthorizedError";
+    this.message = message;
+  }
+}
+class RateLimitError extends ApplicationError {
+  constructor(message = "Too many requests, please try again later.", details) {
+    super(message, details);
+    this.name = "RateLimitError";
+    this.message = message;
+    this.details = details || {};
+  }
+}
+class PayloadTooLargeError extends ApplicationError {
+  constructor(message = "Entity too large", details) {
+    super(message, details);
+    this.name = "PayloadTooLargeError";
+    this.message = message;
+  }
+}
+class PolicyError extends ForbiddenError {
+  constructor(message = "Policy Failed", details) {
+    super(message, details);
+    this.name = "PolicyError";
+    this.message = message;
+    this.details = details || {};
+  }
+}
+class NotImplementedError extends ApplicationError {
+  constructor(message = "This feature is not implemented yet", details) {
+    super(message, details);
+    this.name = "NotImplementedError";
+    this.message = message;
+  }
+}
+const errors = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  ApplicationError,
+  ForbiddenError,
+  HttpError,
+  NotFoundError,
+  NotImplementedError,
+  PaginationError,
+  PayloadTooLargeError,
+  PolicyError,
+  RateLimitError,
+  UnauthorizedError,
+  ValidationError,
+  YupValidationError
+}, Symbol.toStringTag, { value: "Module" }));
+const handleYupError = (error, errorMessage) => {
+  throw new YupValidationError(error, errorMessage);
+};
+const defaultValidationParam = { strict: true, abortEarly: false };
+const validateYupSchema = (schema, options = {}) => async (body, errorMessage) => {
+  try {
+    const optionsWithDefaults = defaults(defaultValidationParam, options);
+    const result = await schema.validate(body, optionsWithDefaults);
+    return result;
+  } catch (e) {
+    if (e instanceof yup$1.ValidationError) {
+      handleYupError(e, errorMessage);
+    }
+    throw e;
+  }
+};
+const validateYupSchemaSync = (schema, options = {}) => (body, errorMessage) => {
+  try {
+    const optionsWithDefaults = defaults(defaultValidationParam, options);
+    return schema.validateSync(body, optionsWithDefaults);
+  } catch (e) {
+    if (e instanceof yup$1.ValidationError) {
+      handleYupError(e, errorMessage);
+    }
+    throw e;
+  }
+};
+const GROUP_OPERATORS = ["$and", "$or"];
+const WHERE_OPERATORS = [
+  "$not",
+  "$in",
+  "$notIn",
+  "$eq",
+  "$eqi",
+  "$ne",
+  "$nei",
+  "$gt",
+  "$gte",
+  "$lt",
+  "$lte",
+  "$null",
+  "$notNull",
+  "$between",
+  "$startsWith",
+  "$endsWith",
+  "$startsWithi",
+  "$endsWithi",
+  "$contains",
+  "$notContains",
+  "$containsi",
+  "$notContainsi",
+  // Experimental, only for internal use
+  "$jsonSupersetOf"
+];
+const CAST_OPERATORS = [
+  "$not",
+  "$in",
+  "$notIn",
+  "$eq",
+  "$ne",
+  "$gt",
+  "$gte",
+  "$lt",
+  "$lte",
+  "$between"
+];
+const ARRAY_OPERATORS = ["$in", "$notIn", "$between"];
+const OPERATORS = {
+  where: WHERE_OPERATORS,
+  cast: CAST_OPERATORS,
+  group: GROUP_OPERATORS,
+  array: ARRAY_OPERATORS
+};
+const OPERATORS_LOWERCASE = Object.fromEntries(
+  Object.entries(OPERATORS).map(([key, values]) => [
+    key,
+    values.map((value) => value.toLowerCase())
+  ])
+);
+const isObjKey = (key, obj) => {
+  return key in obj;
+};
+const isOperatorOfType = (type, key, ignoreCase = false) => {
+  if (ignoreCase) {
+    return OPERATORS_LOWERCASE[type]?.includes(key.toLowerCase()) ?? false;
+  }
+  if (isObjKey(type, OPERATORS)) {
+    return OPERATORS[type]?.includes(key) ?? false;
+  }
+  return false;
+};
+const isOperator = (key, ignoreCase = false) => {
+  return Object.keys(OPERATORS).some((type) => isOperatorOfType(type, key, ignoreCase));
+};
+const { ID_ATTRIBUTE: ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$3, PUBLISHED_AT_ATTRIBUTE } = constants$1;
+class InvalidOrderError extends Error {
+  constructor() {
+    super();
+    this.message = "Invalid order. order can only be one of asc|desc|ASC|DESC";
+  }
+}
+class InvalidSortError extends Error {
+  constructor() {
+    super();
+    this.message = "Invalid sort parameter. Expected a string, an array of strings, a sort object or an array of sort objects";
+  }
+}
+function validateOrder(order) {
+  if (!isString(order) || !["asc", "desc"].includes(order.toLocaleLowerCase())) {
+    throw new InvalidOrderError();
+  }
+}
+const convertCountQueryParams = (countQuery) => {
+  return parseType({ type: "boolean", value: countQuery });
+};
+const convertOrderingQueryParams = (ordering) => {
+  return ordering;
+};
+const isPlainObject = (value) => ___default.isPlainObject(value);
+const isStringArray$3 = (value) => isArray(value) && value.every(isString);
+const createTransformer = ({ getModel }) => {
+  const convertSortQueryParams = (sortQuery) => {
+    if (typeof sortQuery === "string") {
+      return convertStringSortQueryParam(sortQuery);
+    }
+    if (isStringArray$3(sortQuery)) {
+      return sortQuery.flatMap((sortValue) => convertStringSortQueryParam(sortValue));
+    }
+    if (Array.isArray(sortQuery)) {
+      return sortQuery.map((sortValue) => convertNestedSortQueryParam(sortValue));
+    }
+    if (isPlainObject(sortQuery)) {
+      return convertNestedSortQueryParam(sortQuery);
+    }
+    throw new InvalidSortError();
+  };
+  const convertStringSortQueryParam = (sortQuery) => {
+    return sortQuery.split(",").map((value) => convertSingleSortQueryParam(value));
+  };
+  const convertSingleSortQueryParam = (sortQuery) => {
+    if (!sortQuery) {
+      return {};
+    }
+    if (!isString(sortQuery)) {
+      throw new Error("Invalid sort query");
+    }
+    const [field, order = "asc"] = sortQuery.split(":");
+    if (field.length === 0) {
+      throw new Error("Field cannot be empty");
+    }
+    validateOrder(order);
+    return ___default.set({}, field, order);
+  };
+  const convertNestedSortQueryParam = (sortQuery) => {
+    const transformedSort = {};
+    for (const field of Object.keys(sortQuery)) {
+      const order = sortQuery[field];
+      if (isPlainObject(order)) {
+        transformedSort[field] = convertNestedSortQueryParam(order);
+      } else if (typeof order === "string") {
+        validateOrder(order);
+        transformedSort[field] = order;
+      } else {
+        throw Error(`Invalid sort type expected object or string got ${typeof order}`);
+      }
+    }
+    return transformedSort;
+  };
+  const convertStartQueryParams = (startQuery) => {
+    const startAsANumber = ___default.toNumber(startQuery);
+    if (!___default.isInteger(startAsANumber) || startAsANumber < 0) {
+      throw new Error(`convertStartQueryParams expected a positive integer got ${startAsANumber}`);
+    }
+    return startAsANumber;
+  };
+  const convertLimitQueryParams = (limitQuery) => {
+    const limitAsANumber = ___default.toNumber(limitQuery);
+    if (!___default.isInteger(limitAsANumber) || limitAsANumber !== -1 && limitAsANumber < 0) {
+      throw new Error(`convertLimitQueryParams expected a positive integer got ${limitAsANumber}`);
+    }
+    if (limitAsANumber === -1) {
+      return void 0;
+    }
+    return limitAsANumber;
+  };
+  const convertPageQueryParams = (page) => {
+    const pageVal = toNumber(page);
+    if (!isInteger(pageVal) || pageVal <= 0) {
+      throw new PaginationError(
+        `Invalid 'page' parameter. Expected an integer > 0, received: ${page}`
+      );
+    }
+    return pageVal;
+  };
+  const convertPageSizeQueryParams = (pageSize, page) => {
+    const pageSizeVal = toNumber(pageSize);
+    if (!isInteger(pageSizeVal) || pageSizeVal <= 0) {
+      throw new PaginationError(
+        `Invalid 'pageSize' parameter. Expected an integer > 0, received: ${page}`
+      );
+    }
+    return pageSizeVal;
+  };
+  const validatePaginationParams = (page, pageSize, start, limit) => {
+    const isPagePagination = !isNil(page) || !isNil(pageSize);
+    const isOffsetPagination = !isNil(start) || !isNil(limit);
+    if (isPagePagination && isOffsetPagination) {
+      throw new PaginationError(
+        "Invalid pagination attributes. You cannot use page and offset pagination in the same query"
+      );
+    }
+  };
+  class InvalidPopulateError extends Error {
+    constructor() {
+      super();
+      this.message = "Invalid populate parameter. Expected a string, an array of strings, a populate object";
+    }
+  }
+  const convertPopulateQueryParams = (populate2, schema, depth = 0) => {
+    if (depth === 0 && populate2 === "*") {
+      return true;
+    }
+    if (typeof populate2 === "string") {
+      return populate2.split(",").map((value) => ___default.trim(value));
+    }
+    if (Array.isArray(populate2)) {
+      return ___default.uniq(
+        populate2.flatMap((value) => {
+          if (typeof value !== "string") {
+            throw new InvalidPopulateError();
+          }
+          return value.split(",").map((value2) => ___default.trim(value2));
+        })
+      );
+    }
+    if (___default.isPlainObject(populate2)) {
+      return convertPopulateObject(populate2, schema);
+    }
+    throw new InvalidPopulateError();
+  };
+  const hasPopulateFragmentDefined = (populate2) => {
+    return typeof populate2 === "object" && "on" in populate2 && !isNil(populate2.on);
+  };
+  const hasCountDefined = (populate2) => {
+    return typeof populate2 === "object" && "count" in populate2 && typeof populate2.count === "boolean";
+  };
+  const convertPopulateObject = (populate2, schema) => {
+    if (!schema) {
+      return {};
+    }
+    const { attributes } = schema;
+    return Object.entries(populate2).reduce((acc, [key, subPopulate]) => {
+      if (___default.isString(subPopulate)) {
+        try {
+          const subPopulateAsBoolean = parseType({ type: "boolean", value: subPopulate });
+          return subPopulateAsBoolean === true ? { ...acc, [key]: true } : acc;
+        } catch {
+        }
+      }
+      if (___default.isBoolean(subPopulate)) {
+        return subPopulate === true ? { ...acc, [key]: true } : acc;
+      }
+      const attribute = attributes[key];
+      if (!attribute) {
+        return acc;
+      }
+      const isMorphLikeRelationalAttribute = isDynamicZoneAttribute(attribute) || isMorphToRelationalAttribute(attribute);
+      if (isMorphLikeRelationalAttribute) {
+        const hasInvalidProperties = Object.keys(subPopulate).some(
+          (key2) => !["on", "count"].includes(key2)
+        );
+        if (hasInvalidProperties) {
+          throw new Error(
+            `Invalid nested populate for ${schema.info?.singularName}.${key} (${schema.uid}). Expected a fragment ("on") or "count" but found ${JSON.stringify(subPopulate)}`
+          );
+        }
+        const newSubPopulate = {};
+        if (hasPopulateFragmentDefined(subPopulate)) {
+          Object.assign(newSubPopulate, {
+            on: Object.entries(subPopulate.on).reduce(
+              (acc2, [type, typeSubPopulate]) => ({
+                ...acc2,
+                [type]: convertNestedPopulate(typeSubPopulate, getModel(type))
+              }),
+              {}
+            )
+          });
+        }
+        if (hasCountDefined(subPopulate)) {
+          Object.assign(newSubPopulate, { count: subPopulate.count });
+        }
+        return { ...acc, [key]: newSubPopulate };
+      }
+      if (!isMorphLikeRelationalAttribute && hasPopulateFragmentDefined(subPopulate)) {
+        throw new Error(`Using fragments is not permitted to populate "${key}" in "${schema.uid}"`);
+      }
+      let targetSchemaUID;
+      if (attribute.type === "relation") {
+        targetSchemaUID = attribute.target;
+      } else if (attribute.type === "component") {
+        targetSchemaUID = attribute.component;
+      } else if (attribute.type === "media") {
+        targetSchemaUID = "plugin::upload.file";
+      } else {
+        return acc;
+      }
+      const targetSchema = getModel(targetSchemaUID);
+      if (!targetSchema) {
+        return acc;
+      }
+      const populateObject = convertNestedPopulate(subPopulate, targetSchema);
+      if (!populateObject) {
+        return acc;
+      }
+      return {
+        ...acc,
+        [key]: populateObject
+      };
+    }, {});
+  };
+  const convertNestedPopulate = (subPopulate, schema) => {
+    if (___default.isString(subPopulate)) {
+      return parseType({ type: "boolean", value: subPopulate, forceCast: true });
+    }
+    if (___default.isBoolean(subPopulate)) {
+      return subPopulate;
+    }
+    if (!isPlainObject(subPopulate)) {
+      throw new Error(`Invalid nested populate. Expected '*' or an object`);
+    }
+    const { sort: sort2, filters: filters2, fields: fields2, populate: populate2, count, ordering, page, pageSize, start, limit } = subPopulate;
+    const query = {};
+    if (sort2) {
+      query.orderBy = convertSortQueryParams(sort2);
+    }
+    if (filters2) {
+      query.where = convertFiltersQueryParams(filters2, schema);
+    }
+    if (fields2) {
+      query.select = convertFieldsQueryParams(fields2);
+    }
+    if (populate2) {
+      query.populate = convertPopulateQueryParams(populate2, schema);
+    }
+    if (count) {
+      query.count = convertCountQueryParams(count);
+    }
+    if (ordering) {
+      query.ordering = convertOrderingQueryParams(ordering);
+    }
+    validatePaginationParams(page, pageSize, start, limit);
+    if (!isNil(page)) {
+      query.page = convertPageQueryParams(page);
+    }
+    if (!isNil(pageSize)) {
+      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+    }
+    if (!isNil(start)) {
+      query.offset = convertStartQueryParams(start);
+    }
+    if (!isNil(limit)) {
+      query.limit = convertLimitQueryParams(limit);
+    }
+    return query;
+  };
+  const convertFieldsQueryParams = (fields2, depth = 0) => {
+    if (depth === 0 && fields2 === "*") {
+      return void 0;
+    }
+    if (typeof fields2 === "string") {
+      const fieldsValues = fields2.split(",").map((value) => ___default.trim(value));
+      return ___default.uniq([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3, ...fieldsValues]);
+    }
+    if (isStringArray$3(fields2)) {
+      const fieldsValues = fields2.flatMap((value) => convertFieldsQueryParams(value, depth + 1)).filter((v) => !isNil(v));
+      return ___default.uniq([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3, ...fieldsValues]);
+    }
+    throw new Error("Invalid fields parameter. Expected a string or an array of strings");
+  };
+  const isValidSchemaAttribute = (key, schema) => {
+    if ([DOC_ID_ATTRIBUTE$3, ID_ATTRIBUTE$3].includes(key)) {
+      return true;
+    }
+    if (!schema) {
+      return false;
+    }
+    return Object.keys(schema.attributes).includes(key);
+  };
+  const convertFiltersQueryParams = (filters2, schema) => {
+    if (!isObject(filters2)) {
+      throw new Error("The filters parameter must be an object or an array");
+    }
+    const filtersCopy = cloneDeep(filters2);
+    return convertAndSanitizeFilters(filtersCopy, schema);
+  };
+  const convertAndSanitizeFilters = (filters2, schema) => {
+    if (Array.isArray(filters2)) {
+      return filters2.map((filter) => convertAndSanitizeFilters(filter, schema)).filter((filter) => !isPlainObject(filter) || !isEmpty(filter));
+    }
+    if (!isPlainObject(filters2)) {
+      return filters2;
+    }
+    const removeOperator = (operator) => delete filters2[operator];
+    for (const [key, value] of Object.entries(filters2)) {
+      const attribute = get(key, schema?.attributes);
+      const validKey = isOperator(key) || isValidSchemaAttribute(key, schema);
+      if (!validKey) {
+        removeOperator(key);
+      } else if (attribute) {
+        if (attribute.type === "relation") {
+          filters2[key] = convertAndSanitizeFilters(value, getModel(attribute.target));
+        } else if (attribute.type === "component") {
+          filters2[key] = convertAndSanitizeFilters(value, getModel(attribute.component));
+        } else if (attribute.type === "media") {
+          filters2[key] = convertAndSanitizeFilters(value, getModel("plugin::upload.file"));
+        } else if (attribute.type === "dynamiczone") {
+          removeOperator(key);
+        } else if (attribute.type === "password") {
+          removeOperator(key);
+        } else {
+          filters2[key] = convertAndSanitizeFilters(value, schema);
+        }
+      } else if (["$null", "$notNull"].includes(key)) {
+        filters2[key] = parseType({ type: "boolean", value: filters2[key], forceCast: true });
+      } else if (isObject(value)) {
+        filters2[key] = convertAndSanitizeFilters(value, schema);
+      }
+      if (isPlainObject(filters2[key]) && isEmpty(filters2[key])) {
+        removeOperator(key);
+      }
+    }
+    return filters2;
+  };
+  const convertStatusParams = (status, query = {}) => {
+    query.filters = ({ meta }) => {
+      const contentType = getModel(meta.uid);
+      if (!contentType || !hasDraftAndPublish(contentType)) {
+        return {};
+      }
+      return { [PUBLISHED_AT_ATTRIBUTE]: { $null: status === "draft" } };
+    };
+  };
+  const transformQueryParams = (uid, params) => {
+    const schema = getModel(uid);
+    const query = {};
+    const { _q, sort: sort2, filters: filters2, fields: fields2, populate: populate2, page, pageSize, start, limit, status, ...rest } = params;
+    if (!isNil(status)) {
+      convertStatusParams(status, query);
+    }
+    if (!isNil(_q)) {
+      query._q = _q;
+    }
+    if (!isNil(sort2)) {
+      query.orderBy = convertSortQueryParams(sort2);
+    }
+    if (!isNil(filters2)) {
+      query.where = convertFiltersQueryParams(filters2, schema);
+    }
+    if (!isNil(fields2)) {
+      query.select = convertFieldsQueryParams(fields2);
+    }
+    if (!isNil(populate2)) {
+      query.populate = convertPopulateQueryParams(populate2, schema);
+    }
+    validatePaginationParams(page, pageSize, start, limit);
+    if (!isNil(page)) {
+      query.page = convertPageQueryParams(page);
+    }
+    if (!isNil(pageSize)) {
+      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+    }
+    if (!isNil(start)) {
+      query.offset = convertStartQueryParams(start);
+    }
+    if (!isNil(limit)) {
+      query.limit = convertLimitQueryParams(limit);
+    }
+    return {
+      ...rest,
+      ...query
+    };
+  };
+  return {
+    private_convertSortQueryParams: convertSortQueryParams,
+    private_convertStartQueryParams: convertStartQueryParams,
+    private_convertLimitQueryParams: convertLimitQueryParams,
+    private_convertPopulateQueryParams: convertPopulateQueryParams,
+    private_convertFiltersQueryParams: convertFiltersQueryParams,
+    private_convertFieldsQueryParams: convertFieldsQueryParams,
+    transformQueryParams
+  };
+};
+const convertQueryParams = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  createTransformer
+}, Symbol.toStringTag, { value: "Module" }));
+function pipe(...fns) {
+  const [firstFn, ...fnRest] = fns;
+  return async (...args) => {
+    let res = await firstFn.apply(firstFn, args);
+    for (let i = 0; i < fnRest.length; i += 1) {
+      res = await fnRest[i](res);
+    }
+    return res;
+  };
+}
+const map = curry(pMap);
+const reduce = (mixedArray) => async (iteratee, initialValue) => {
+  let acc = initialValue;
+  for (let i = 0; i < mixedArray.length; i += 1) {
+    acc = await iteratee(acc, await mixedArray[i], i);
+  }
+  return acc;
+};
+const async = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  map,
+  pipe,
+  reduce
+}, Symbol.toStringTag, { value: "Module" }));
+const visitor$8 = ({ key, attribute }, { remove: remove2 }) => {
+  if (attribute?.type === "password") {
+    remove2(key);
+  }
+};
+const visitor$7 = ({ schema, key, attribute }, { remove: remove2 }) => {
+  if (!attribute) {
+    return;
+  }
+  const isPrivate = attribute.private === true || isPrivateAttribute(schema, key);
+  if (isPrivate) {
+    remove2(key);
+  }
+};
+const ACTIONS_TO_VERIFY$1 = ["find"];
+const { CREATED_BY_ATTRIBUTE: CREATED_BY_ATTRIBUTE$1, UPDATED_BY_ATTRIBUTE: UPDATED_BY_ATTRIBUTE$1 } = constants$1;
+const removeRestrictedRelations = (auth) => async ({ data, key, attribute, schema }, { remove: remove2, set }) => {
+  if (!attribute) {
+    return;
+  }
+  const isRelation = attribute.type === "relation";
+  if (!isRelation) {
+    return;
+  }
+  const handleMorphRelation = async () => {
+    const newMorphValue = [];
+    for (const element of data[key]) {
+      const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${element.__type}.${action}`);
+      const isAllowed = await hasAccessToSomeScopes$1(scopes, auth);
+      if (isAllowed) {
+        newMorphValue.push(element);
+      }
+    }
+    if (newMorphValue.length === 0) {
+      remove2(key);
+    } else {
+      set(key, newMorphValue);
+    }
+  };
+  const handleRegularRelation = async () => {
+    const scopes = ACTIONS_TO_VERIFY$1.map((action) => `${attribute.target}.${action}`);
+    const isAllowed = await hasAccessToSomeScopes$1(scopes, auth);
+    if (!isAllowed) {
+      remove2(key);
+    }
+  };
+  const isCreatorRelation = [CREATED_BY_ATTRIBUTE$1, UPDATED_BY_ATTRIBUTE$1].includes(key);
+  if (isMorphToRelationalAttribute(attribute)) {
+    await handleMorphRelation();
+    return;
+  }
+  if (isCreatorRelation && schema.options?.populateCreatorFields) {
+    return;
+  }
+  await handleRegularRelation();
+};
+const hasAccessToSomeScopes$1 = async (scopes, auth) => {
+  for (const scope of scopes) {
+    try {
+      await strapi.auth.verify(auth, { scope });
+      return true;
+    } catch {
+      continue;
+    }
+  }
+  return false;
+};
+const visitor$6 = ({ key, attribute }, { remove: remove2 }) => {
+  if (isMorphToRelationalAttribute(attribute)) {
+    remove2(key);
+  }
+};
+const visitor$5 = ({ key, attribute }, { remove: remove2 }) => {
+  if (isDynamicZoneAttribute(attribute)) {
+    remove2(key);
+  }
+};
+const removeDisallowedFields = (allowedFields = null) => ({ key, path: { attribute: path } }, { remove: remove2 }) => {
+  if (allowedFields === null) {
+    return;
+  }
+  if (!(isArray(allowedFields) && allowedFields.every(isString))) {
+    throw new TypeError(
+      `Expected array of strings for allowedFields but got "${typeof allowedFields}"`
+    );
+  }
+  if (isNil(path)) {
+    return;
+  }
+  const containedPaths = getContainedPaths$1(path);
+  const isPathAllowed = allowedFields.some(
+    (p) => containedPaths.includes(p) || p.startsWith(`${path}.`)
+  );
+  if (isPathAllowed) {
+    return;
+  }
+  remove2(key);
+};
+const getContainedPaths$1 = (path) => {
+  const parts = toPath(path);
+  return parts.reduce((acc, value, index2, list) => {
+    return [...acc, list.slice(0, index2 + 1).join(".")];
+  }, []);
+};
+const removeRestrictedFields = (restrictedFields = null) => ({ key, path: { attribute: path } }, { remove: remove2 }) => {
+  if (restrictedFields === null) {
+    remove2(key);
+    return;
+  }
+  if (!(isArray(restrictedFields) && restrictedFields.every(isString))) {
+    throw new TypeError(
+      `Expected array of strings for restrictedFields but got "${typeof restrictedFields}"`
+    );
+  }
+  if (restrictedFields.includes(path)) {
+    remove2(key);
+    return;
+  }
+  const isRestrictedNested = restrictedFields.some(
+    (allowedPath) => path?.toString().startsWith(`${allowedPath}.`)
+  );
+  if (isRestrictedNested) {
+    remove2(key);
+  }
+};
+const visitor$4 = ({ schema, key, value }, { set }) => {
+  if (key === "" && value === "*") {
+    const { attributes } = schema;
+    const newPopulateQuery = Object.entries(attributes).filter(
+      ([, attribute]) => ["relation", "component", "media", "dynamiczone"].includes(attribute.type)
+    ).reduce((acc, [key2]) => ({ ...acc, [key2]: true }), {});
+    set("", newPopulateQuery);
+  }
+};
+const index$4 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  expandWildcardPopulate: visitor$4,
+  removeDisallowedFields,
+  removeDynamicZones: visitor$5,
+  removeMorphToRelations: visitor$6,
+  removePassword: visitor$8,
+  removePrivate: visitor$7,
+  removeRestrictedFields,
+  removeRestrictedRelations
+}, Symbol.toStringTag, { value: "Module" }));
+const DEFAULT_PATH = { raw: null, attribute: null };
+const traverseFactory = () => {
+  const state = {
+    parsers: [],
+    interceptors: [],
+    ignore: [],
+    handlers: {
+      attributes: [],
+      common: []
+    }
+  };
+  const traverse = async (visitor2, options, data) => {
+    const { path = DEFAULT_PATH, schema, getModel } = options ?? {};
+    for (const { predicate, handler } of state.interceptors) {
+      if (predicate(data)) {
+        return handler(visitor2, options, data, { recurse: traverse });
+      }
+    }
+    const parser = state.parsers.find((parser2) => parser2.predicate(data))?.parser;
+    const utils2 = parser?.(data);
+    if (!utils2) {
+      return data;
+    }
+    let out = utils2.transform(data);
+    const keys = utils2.keys(out);
+    for (const key of keys) {
+      const attribute = schema?.attributes?.[key];
+      const newPath = { ...path };
+      newPath.raw = isNil(path.raw) ? key : `${path.raw}.${key}`;
+      if (!isNil(attribute)) {
+        newPath.attribute = isNil(path.attribute) ? key : `${path.attribute}.${key}`;
+      }
+      const visitorOptions = {
+        key,
+        value: utils2.get(key, out),
+        attribute,
+        schema,
+        path: newPath,
+        data: out,
+        getModel
+      };
+      const transformUtils = {
+        remove(key2) {
+          out = utils2.remove(key2, out);
+        },
+        set(key2, value2) {
+          out = utils2.set(key2, value2, out);
+        },
+        recurse: traverse
+      };
+      await visitor2(visitorOptions, pick(["remove", "set"], transformUtils));
+      const value = utils2.get(key, out);
+      const createContext = () => ({
+        key,
+        value,
+        attribute,
+        schema,
+        path: newPath,
+        data: out,
+        visitor: visitor2,
+        getModel
+      });
+      const ignoreCtx = createContext();
+      const shouldIgnore = state.ignore.some((predicate) => predicate(ignoreCtx));
+      if (shouldIgnore) {
+        continue;
+      }
+      const handlers = [...state.handlers.common, ...state.handlers.attributes];
       for await (const handler of handlers) {
         const ctx = createContext();
         const pass = await handler.predicate(ctx);
@@ -949,33 +1598,33 @@ const filters = traverseFactory().intercept(
   }
 })).ignore(({ value }) => isNil(value)).on(
   ({ attribute }) => isNil(attribute),
-  async ({ key, visitor: visitor2, path, value, schema }, { set, recurse }) => {
-    set(key, await recurse(visitor2, { schema, path }, value));
+  async ({ key, visitor: visitor2, path, value, schema, getModel }, { set, recurse }) => {
+    set(key, await recurse(visitor2, { schema, path, getModel }, value));
   }
-).onRelation(async ({ key, attribute, visitor: visitor2, path, value }, { set, recurse }) => {
+).onRelation(async ({ key, attribute, visitor: visitor2, path, value, getModel }, { set, recurse }) => {
   const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
   if (isMorphRelation) {
     return;
   }
   const targetSchemaUID = attribute.target;
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+  const targetSchema = getModel(targetSchemaUID);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
-}).onComponent(async ({ key, attribute, visitor: visitor2, path, value }, { set, recurse }) => {
-  const targetSchema = strapi.getModel(attribute.component);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+}).onComponent(async ({ key, attribute, visitor: visitor2, path, value, getModel }, { set, recurse }) => {
+  const targetSchema = getModel(attribute.component);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
-}).onMedia(async ({ key, visitor: visitor2, path, value }, { set, recurse }) => {
+}).onMedia(async ({ key, visitor: visitor2, path, value, getModel }, { set, recurse }) => {
   const targetSchemaUID = "plugin::upload.file";
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+  const targetSchema = getModel(targetSchemaUID);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
 });
 const traverseQueryFilters = curry(filters.traverse);
 const ORDERS = { asc: "asc", desc: "desc" };
 const ORDER_VALUES = Object.values(ORDERS);
 const isSortOrder = (value) => ORDER_VALUES.includes(value.toLowerCase());
-const isStringArray$3 = (value) => Array.isArray(value) && value.every(isString);
+const isStringArray$2 = (value) => Array.isArray(value) && value.every(isString);
 const isObjectArray = (value) => Array.isArray(value) && value.every(isObject);
 const isNestedSorts = (value) => isString(value) && value.split(",").length > 1;
 const isObj$1 = (value) => isObject(value);
@@ -989,7 +1638,7 @@ const sort = traverseFactory().intercept(
   }
 ).intercept(
   // Array of strings ['foo', 'foo,bar'] => map(recurse), then filter out empty items
-  isStringArray$3,
+  isStringArray$2,
   async (visitor2, options, sort2, { recurse }) => {
     return Promise.all(sort2.map((nestedSort) => recurse(visitor2, options, nestedSort))).then(
       (res) => res.filter((nestedSort) => !isEmpty(nestedSort))
@@ -1056,23 +1705,23 @@ const sort = traverseFactory().intercept(
   get(key, data) {
     return data[key];
   }
-})).onRelation(async ({ key, value, attribute, visitor: visitor2, path }, { set, recurse }) => {
+})).onRelation(async ({ key, value, attribute, visitor: visitor2, path, getModel }, { set, recurse }) => {
   const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
   if (isMorphRelation) {
     return;
   }
   const targetSchemaUID = attribute.target;
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+  const targetSchema = getModel(targetSchemaUID);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
-}).onMedia(async ({ key, path, visitor: visitor2, value }, { recurse, set }) => {
+}).onMedia(async ({ key, path, visitor: visitor2, value, getModel }, { recurse, set }) => {
   const targetSchemaUID = "plugin::upload.file";
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+  const targetSchema = getModel(targetSchemaUID);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
-}).onComponent(async ({ key, value, visitor: visitor2, path, attribute }, { recurse, set }) => {
-  const targetSchema = strapi.getModel(attribute.component);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
+}).onComponent(async ({ key, value, visitor: visitor2, path, attribute, getModel }, { recurse, set }) => {
+  const targetSchema = getModel(attribute.component);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
   set(key, newValue);
 });
 const traverseQuerySort = curry(sort.traverse);
@@ -1081,9 +1730,9 @@ const isKeyword = (keyword) => {
     return !attribute && keyword === key;
   };
 };
-const isStringArray$2 = (value) => isArray(value) && value.every(isString);
+const isStringArray$1 = (value) => isArray(value) && value.every(isString);
 const isObj = (value) => isObject(value);
-const populate = traverseFactory().intercept(isStringArray$2, async (visitor2, options, populate2, { recurse }) => {
+const populate = traverseFactory().intercept(isStringArray$1, async (visitor2, options, populate2, { recurse }) => {
   const visitedPopulate = await Promise.all(
     populate2.map((nestedPopulate) => recurse(visitor2, options, nestedPopulate))
   );
@@ -1159,180 +1808,100 @@ const populate = traverseFactory().intercept(isStringArray$2, async (visitor2, o
   return ["sort", "filters", "fields"].includes(key) && !attribute;
 }).on(
   // Handle recursion on populate."populate"
-  isKeyword("populate"),
-  async ({ key, visitor: visitor2, path, value, schema }, { set, recurse }) => {
-    const newValue = await recurse(visitor2, { schema, path }, value);
-    set(key, newValue);
-  }
-).on(isKeyword("on"), async ({ key, visitor: visitor2, path, value }, { set, recurse }) => {
-  const newOn = {};
-  if (!isObj(value)) {
-    return;
-  }
-  for (const [uid, subPopulate] of Object.entries(value)) {
-    const model = strapi.getModel(uid);
-    const newPath = { ...path, raw: `${path.raw}[${uid}]` };
-    newOn[uid] = await recurse(visitor2, { schema: model, path: newPath }, subPopulate);
-  }
-  set(key, newOn);
-}).onRelation(async ({ key, value, attribute, visitor: visitor2, path, schema }, { set, recurse }) => {
-  if (isNil(value)) {
-    return;
-  }
-  if (isMorphToRelationalAttribute(attribute)) {
-    if (!isObject(value) || !("on" in value && isObject(value?.on))) {
-      return;
-    }
-    const newValue2 = await recurse(visitor2, { schema, path }, { on: value?.on });
-    set(key, { on: newValue2 });
-  }
-  const targetSchemaUID = attribute.target;
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
-  set(key, newValue);
-}).onMedia(async ({ key, path, visitor: visitor2, value }, { recurse, set }) => {
-  if (isNil(value)) {
-    return;
-  }
-  const targetSchemaUID = "plugin::upload.file";
-  const targetSchema = strapi.getModel(targetSchemaUID);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
-  set(key, newValue);
-}).onComponent(async ({ key, value, visitor: visitor2, path, attribute }, { recurse, set }) => {
-  if (isNil(value)) {
-    return;
-  }
-  const targetSchema = strapi.getModel(attribute.component);
-  const newValue = await recurse(visitor2, { schema: targetSchema, path }, value);
-  set(key, newValue);
-}).onDynamicZone(async ({ key, value, attribute, schema, visitor: visitor2, path }, { set, recurse }) => {
-  if (isNil(value)) {
-    return;
-  }
-  if (isObject(value)) {
-    const { components } = attribute;
-    const newValue = {};
-    let newProperties = omit("on", value);
-    for (const componentUID of components) {
-      const componentSchema = strapi.getModel(componentUID);
-      const properties = await recurse(visitor2, { schema: componentSchema, path }, value);
-      newProperties = merge(newProperties, properties);
-    }
-    Object.assign(newValue, newProperties);
-    if ("on" in value && value.on) {
-      const newOn = await recurse(visitor2, { schema, path }, { on: value.on });
-      Object.assign(newValue, newOn);
-    }
-    set(key, newValue);
-  } else {
-    const newValue = await recurse(visitor2, { schema, path }, value);
-    set(key, newValue);
-  }
-});
-const traverseQueryPopulate = curry(populate.traverse);
-const isStringArray$1 = (value) => isArray(value) && value.every(isString);
-const fields = traverseFactory().intercept(isStringArray$1, async (visitor2, options, fields2, { recurse }) => {
-  return Promise.all(fields2.map((field) => recurse(visitor2, options, field)));
-}).intercept((value) => eq("*", value), constant("*")).parse(isString, () => ({
-  transform: trim,
-  remove(key, data) {
-    return data === key ? void 0 : data;
-  },
-  set(_key, _value, data) {
-    return data;
-  },
-  keys(data) {
-    return [data];
-  },
-  get(key, data) {
-    return key === data ? data : void 0;
-  }
-}));
-const traverseQueryFields = curry(fields.traverse);
-const index$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
-  __proto__: null,
-  factory: traverseFactory,
-  traverseQueryFields,
-  traverseQueryFilters,
-  traverseQueryPopulate,
-  traverseQuerySort
-}, Symbol.toStringTag, { value: "Module" }));
-const GROUP_OPERATORS = ["$and", "$or"];
-const WHERE_OPERATORS = [
-  "$not",
-  "$in",
-  "$notIn",
-  "$eq",
-  "$eqi",
-  "$ne",
-  "$nei",
-  "$gt",
-  "$gte",
-  "$lt",
-  "$lte",
-  "$null",
-  "$notNull",
-  "$between",
-  "$startsWith",
-  "$endsWith",
-  "$startsWithi",
-  "$endsWithi",
-  "$contains",
-  "$notContains",
-  "$containsi",
-  "$notContainsi",
-  // Experimental, only for internal use
-  "$jsonSupersetOf"
-];
-const CAST_OPERATORS = [
-  "$not",
-  "$in",
-  "$notIn",
-  "$eq",
-  "$ne",
-  "$gt",
-  "$gte",
-  "$lt",
-  "$lte",
-  "$between"
-];
-const ARRAY_OPERATORS = ["$in", "$notIn", "$between"];
-const OPERATORS = {
-  where: WHERE_OPERATORS,
-  cast: CAST_OPERATORS,
-  group: GROUP_OPERATORS,
-  array: ARRAY_OPERATORS
-};
-const OPERATORS_LOWERCASE = Object.fromEntries(
-  Object.entries(OPERATORS).map(([key, values]) => [
-    key,
-    values.map((value) => value.toLowerCase())
-  ])
-);
-const isObjKey = (key, obj) => {
-  return key in obj;
-};
-const isOperatorOfType = (type, key, ignoreCase = false) => {
-  if (ignoreCase) {
-    return OPERATORS_LOWERCASE[type]?.includes(key.toLowerCase()) ?? false;
+  isKeyword("populate"),
+  async ({ key, visitor: visitor2, path, value, schema, getModel }, { set, recurse }) => {
+    const newValue = await recurse(visitor2, { schema, path, getModel }, value);
+    set(key, newValue);
   }
-  if (isObjKey(type, OPERATORS)) {
-    return OPERATORS[type]?.includes(key) ?? false;
+).on(isKeyword("on"), async ({ key, visitor: visitor2, path, value, getModel }, { set, recurse }) => {
+  const newOn = {};
+  if (!isObj(value)) {
+    return;
   }
-  return false;
-};
-const isOperator = (key, ignoreCase = false) => {
-  return Object.keys(OPERATORS).some((type) => isOperatorOfType(type, key, ignoreCase));
-};
-const { ID_ATTRIBUTE: ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$3 } = constants$1;
-const sanitizePasswords = (schema) => async (entity) => {
-  if (!schema) {
+  for (const [uid, subPopulate] of Object.entries(value)) {
+    const model = getModel(uid);
+    const newPath = { ...path, raw: `${path.raw}[${uid}]` };
+    newOn[uid] = await recurse(visitor2, { schema: model, path: newPath, getModel }, subPopulate);
+  }
+  set(key, newOn);
+}).onRelation(
+  async ({ key, value, attribute, visitor: visitor2, path, schema, getModel }, { set, recurse }) => {
+    if (isNil(value)) {
+      return;
+    }
+    if (isMorphToRelationalAttribute(attribute)) {
+      if (!isObject(value) || !("on" in value && isObject(value?.on))) {
+        return;
+      }
+      const newValue2 = await recurse(visitor2, { schema, path, getModel }, { on: value?.on });
+      set(key, newValue2);
+      return;
+    }
+    const targetSchemaUID = attribute.target;
+    const targetSchema = getModel(targetSchemaUID);
+    const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
+    set(key, newValue);
+  }
+).onMedia(async ({ key, path, visitor: visitor2, value, getModel }, { recurse, set }) => {
+  if (isNil(value)) {
+    return;
+  }
+  const targetSchemaUID = "plugin::upload.file";
+  const targetSchema = getModel(targetSchemaUID);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
+  set(key, newValue);
+}).onComponent(async ({ key, value, visitor: visitor2, path, attribute, getModel }, { recurse, set }) => {
+  if (isNil(value)) {
+    return;
+  }
+  const targetSchema = getModel(attribute.component);
+  const newValue = await recurse(visitor2, { schema: targetSchema, path, getModel }, value);
+  set(key, newValue);
+}).onDynamicZone(async ({ key, value, schema, visitor: visitor2, path, getModel }, { set, recurse }) => {
+  if (isNil(value) || !isObject(value)) {
+    return;
+  }
+  if ("on" in value && value.on) {
+    const newOn = await recurse(visitor2, { schema, path, getModel }, { on: value.on });
+    set(key, newOn);
+  }
+});
+const traverseQueryPopulate = curry(populate.traverse);
+const isStringArray = (value) => isArray(value) && value.every(isString);
+const fields = traverseFactory().intercept(isStringArray, async (visitor2, options, fields2, { recurse }) => {
+  return Promise.all(fields2.map((field) => recurse(visitor2, options, field)));
+}).intercept((value) => eq("*", value), constant("*")).parse(isString, () => ({
+  transform: trim,
+  remove(key, data) {
+    return data === key ? void 0 : data;
+  },
+  set(_key, _value, data) {
+    return data;
+  },
+  keys(data) {
+    return [data];
+  },
+  get(key, data) {
+    return key === data ? data : void 0;
+  }
+}));
+const traverseQueryFields = curry(fields.traverse);
+const index$3 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  traverseQueryFields,
+  traverseQueryFilters,
+  traverseQueryPopulate,
+  traverseQuerySort
+}, Symbol.toStringTag, { value: "Module" }));
+const { ID_ATTRIBUTE: ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$2 } = constants$1;
+const sanitizePasswords = (ctx) => async (entity) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in sanitizePasswords");
   }
-  return traverseEntity$1(visitor$8, { schema }, entity);
+  return traverseEntity$1(visitor$8, ctx, entity);
 };
-const defaultSanitizeOutput = async (schema, entity) => {
-  if (!schema) {
+const defaultSanitizeOutput = async (ctx, entity) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultSanitizeOutput");
   }
   return traverseEntity$1(
@@ -1340,139 +1909,121 @@ const defaultSanitizeOutput = async (schema, entity) => {
       visitor$8(...args);
       visitor$7(...args);
     },
-    { schema },
+    ctx,
     entity
   );
 };
-const defaultSanitizeFilters = curry((schema, filters2) => {
-  if (!schema) {
+const defaultSanitizeFilters = curry((ctx, filters2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultSanitizeFilters");
   }
   return pipe(
     // Remove keys that are not attributes or valid operators
-    traverseQueryFilters(
-      ({ key, attribute }, { remove: remove2 }) => {
-        const isAttribute = !!attribute;
-        if ([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3].includes(key)) {
-          return;
-        }
-        if (!isAttribute && !isOperator(key)) {
-          remove2(key);
-        }
-      },
-      { schema }
-    ),
+    traverseQueryFilters(({ key, attribute }, { remove: remove2 }) => {
+      const isAttribute = !!attribute;
+      if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
+        return;
+      }
+      if (!isAttribute && !isOperator(key)) {
+        remove2(key);
+      }
+    }, ctx),
     // Remove dynamic zones from filters
-    traverseQueryFilters(visitor$5, { schema }),
+    traverseQueryFilters(visitor$5, ctx),
     // Remove morpTo relations from filters
-    traverseQueryFilters(visitor$6, { schema }),
+    traverseQueryFilters(visitor$6, ctx),
     // Remove passwords from filters
-    traverseQueryFilters(visitor$8, { schema }),
+    traverseQueryFilters(visitor$8, ctx),
     // Remove private from filters
-    traverseQueryFilters(visitor$7, { schema }),
+    traverseQueryFilters(visitor$7, ctx),
     // Remove empty objects
-    traverseQueryFilters(
-      ({ key, value }, { remove: remove2 }) => {
-        if (isObject(value) && isEmpty(value)) {
-          remove2(key);
-        }
-      },
-      { schema }
-    )
+    traverseQueryFilters(({ key, value }, { remove: remove2 }) => {
+      if (isObject(value) && isEmpty(value)) {
+        remove2(key);
+      }
+    }, ctx)
   )(filters2);
 });
-const defaultSanitizeSort = curry((schema, sort2) => {
-  if (!schema) {
+const defaultSanitizeSort = curry((ctx, sort2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultSanitizeSort");
   }
   return pipe(
     // Remove non attribute keys
-    traverseQuerySort(
-      ({ key, attribute }, { remove: remove2 }) => {
-        if ([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3].includes(key)) {
-          return;
-        }
-        if (!attribute) {
-          remove2(key);
-        }
-      },
-      { schema }
-    ),
+    traverseQuerySort(({ key, attribute }, { remove: remove2 }) => {
+      if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
+        return;
+      }
+      if (!attribute) {
+        remove2(key);
+      }
+    }, ctx),
     // Remove dynamic zones from sort
-    traverseQuerySort(visitor$5, { schema }),
+    traverseQuerySort(visitor$5, ctx),
     // Remove morpTo relations from sort
-    traverseQuerySort(visitor$6, { schema }),
+    traverseQuerySort(visitor$6, ctx),
     // Remove private from sort
-    traverseQuerySort(visitor$7, { schema }),
+    traverseQuerySort(visitor$7, ctx),
     // Remove passwords from filters
-    traverseQuerySort(visitor$8, { schema }),
+    traverseQuerySort(visitor$8, ctx),
     // Remove keys for empty non-scalar values
-    traverseQuerySort(
-      ({ key, attribute, value }, { remove: remove2 }) => {
-        if ([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3].includes(key)) {
-          return;
-        }
-        if (!isScalarAttribute(attribute) && isEmpty(value)) {
-          remove2(key);
-        }
-      },
-      { schema }
-    )
+    traverseQuerySort(({ key, attribute, value }, { remove: remove2 }) => {
+      if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
+        return;
+      }
+      if (!isScalarAttribute(attribute) && isEmpty(value)) {
+        remove2(key);
+      }
+    }, ctx)
   )(sort2);
 });
-const defaultSanitizeFields = curry((schema, fields2) => {
-  if (!schema) {
+const defaultSanitizeFields = curry((ctx, fields2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultSanitizeFields");
   }
   return pipe(
     // Only keep scalar attributes
-    traverseQueryFields(
-      ({ key, attribute }, { remove: remove2 }) => {
-        if ([ID_ATTRIBUTE$3, DOC_ID_ATTRIBUTE$3].includes(key)) {
-          return;
-        }
-        if (isNil(attribute) || !isScalarAttribute(attribute)) {
-          remove2(key);
-        }
-      },
-      { schema }
-    ),
+    traverseQueryFields(({ key, attribute }, { remove: remove2 }) => {
+      if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
+        return;
+      }
+      if (isNil(attribute) || !isScalarAttribute(attribute)) {
+        remove2(key);
+      }
+    }, ctx),
     // Remove private fields
-    traverseQueryFields(visitor$7, { schema }),
+    traverseQueryFields(visitor$7, ctx),
     // Remove password fields
-    traverseQueryFields(visitor$8, { schema }),
+    traverseQueryFields(visitor$8, ctx),
     // Remove nil values from fields array
     (value) => isArray(value) ? value.filter((field) => !isNil(field)) : value
   )(fields2);
 });
-const defaultSanitizePopulate = curry((schema, populate2) => {
-  if (!schema) {
+const defaultSanitizePopulate = curry((ctx, populate2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultSanitizePopulate");
   }
   return pipe(
-    traverseQueryPopulate(visitor$4, { schema }),
-    traverseQueryPopulate(
-      async ({ key, value, schema: schema2, attribute }, { set }) => {
-        if (attribute) {
-          return;
-        }
-        if (key === "sort") {
-          set(key, await defaultSanitizeSort(schema2, value));
-        }
-        if (key === "filters") {
-          set(key, await defaultSanitizeFilters(schema2, value));
-        }
-        if (key === "fields") {
-          set(key, await defaultSanitizeFields(schema2, value));
-        }
-        if (key === "populate") {
-          set(key, await defaultSanitizePopulate(schema2, value));
-        }
-      },
-      { schema }
-    ),
+    traverseQueryPopulate(visitor$4, ctx),
+    traverseQueryPopulate(async ({ key, value, schema, attribute, getModel }, { set }) => {
+      if (attribute) {
+        return;
+      }
+      if (key === "sort") {
+        set(key, await defaultSanitizeSort({ schema, getModel }, value));
+      }
+      if (key === "filters") {
+        set(key, await defaultSanitizeFilters({ schema, getModel }, value));
+      }
+      if (key === "fields") {
+        set(key, await defaultSanitizeFields({ schema, getModel }, value));
+      }
+      if (key === "populate") {
+        set(key, await defaultSanitizePopulate({ schema, getModel }, value));
+      }
+    }, ctx),
     // Remove private fields
-    traverseQueryPopulate(visitor$7, { schema })
+    traverseQueryPopulate(visitor$7, ctx)
   )(populate2);
 });
 const sanitizers = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -1484,7 +2035,8 @@ const sanitizers = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   defaultSanitizeSort,
   sanitizePasswords
 }, Symbol.toStringTag, { value: "Module" }));
-const createContentAPISanitizers = () => {
+const createAPISanitizers = (opts) => {
+  const { getModel } = opts;
   const sanitizeInput = (data, schema, { auth } = {}) => {
     if (!schema) {
       throw new Error("Missing schema in sanitizeInput");
@@ -1498,12 +2050,14 @@ const createContentAPISanitizers = () => {
       omit(constants$1.ID_ATTRIBUTE),
       omit(constants$1.DOC_ID_ATTRIBUTE),
       // Remove non-writable attributes
-      traverseEntity$1(removeRestrictedFields(nonWritableAttributes), { schema })
+      traverseEntity$1(removeRestrictedFields(nonWritableAttributes), { schema, getModel })
     ];
     if (auth) {
-      transforms.push(traverseEntity$1(removeRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseEntity$1(removeRestrictedRelations(auth), { schema, getModel })
+      );
     }
-    strapi.sanitizers.get("content-api.input").forEach((sanitizer) => transforms.push(sanitizer(schema)));
+    opts?.sanitizers?.input?.forEach((sanitizer) => transforms.push(sanitizer(schema)));
     return pipe(...transforms)(data);
   };
   const sanitizeOutput = async (data, schema, { auth } = {}) => {
@@ -1517,11 +2071,15 @@ const createContentAPISanitizers = () => {
       }
       return res;
     }
-    const transforms = [(data2) => defaultSanitizeOutput(schema, data2)];
+    const transforms = [
+      (data2) => defaultSanitizeOutput({ schema, getModel }, data2)
+    ];
     if (auth) {
-      transforms.push(traverseEntity$1(removeRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseEntity$1(removeRestrictedRelations(auth), { schema, getModel })
+      );
     }
-    strapi.sanitizers.get("content-api.output").forEach((sanitizer) => transforms.push(sanitizer(schema)));
+    opts?.sanitizers?.output?.forEach((sanitizer) => transforms.push(sanitizer(schema)));
     return pipe(...transforms)(data);
   };
   const sanitizeQuery = async (query, schema, { auth } = {}) => {
@@ -1551,9 +2109,11 @@ const createContentAPISanitizers = () => {
     if (isArray(filters2)) {
       return Promise.all(filters2.map((filter) => sanitizeFilters(filter, schema, { auth })));
     }
-    const transforms = [defaultSanitizeFilters(schema)];
+    const transforms = [defaultSanitizeFilters({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQueryFilters(removeRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQueryFilters(removeRestrictedRelations(auth), { schema, getModel })
+      );
     }
     return pipe(...transforms)(filters2);
   };
@@ -1561,9 +2121,11 @@ const createContentAPISanitizers = () => {
     if (!schema) {
       throw new Error("Missing schema in sanitizeSort");
     }
-    const transforms = [defaultSanitizeSort(schema)];
+    const transforms = [defaultSanitizeSort({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQuerySort(removeRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQuerySort(removeRestrictedRelations(auth), { schema, getModel })
+      );
     }
     return pipe(...transforms)(sort2);
   };
@@ -1571,16 +2133,18 @@ const createContentAPISanitizers = () => {
     if (!schema) {
       throw new Error("Missing schema in sanitizeFields");
     }
-    const transforms = [defaultSanitizeFields(schema)];
+    const transforms = [defaultSanitizeFields({ schema, getModel })];
     return pipe(...transforms)(fields2);
   };
   const sanitizePopulate = (populate2, schema, { auth } = {}) => {
     if (!schema) {
       throw new Error("Missing schema in sanitizePopulate");
     }
-    const transforms = [defaultSanitizePopulate(schema)];
+    const transforms = [defaultSanitizePopulate({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQueryPopulate(removeRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQueryPopulate(removeRestrictedRelations(auth), { schema, getModel })
+      );
     }
     return pipe(...transforms)(populate2);
   };
@@ -1594,126 +2158,22 @@ const createContentAPISanitizers = () => {
     populate: sanitizePopulate
   };
 };
-const contentAPI$1 = createContentAPISanitizers();
-const index$1 = {
-  contentAPI: contentAPI$1,
-  sanitizers,
-  visitors: visitors$1
-};
-const formatYupInnerError = (yupError) => ({
-  path: toPath(yupError.path),
-  message: yupError.message,
-  name: yupError.name
-});
-const formatYupErrors = (yupError) => ({
-  errors: isEmpty(yupError.inner) ? [formatYupInnerError(yupError)] : yupError.inner.map(formatYupInnerError),
-  message: yupError.message
-});
-class ApplicationError extends Error {
-  name;
-  details;
-  message;
-  constructor(message = "An application error occured", details = {}) {
-    super();
-    this.name = "ApplicationError";
-    this.message = message;
-    this.details = details;
-  }
-}
-class ValidationError extends ApplicationError {
-  constructor(message, details) {
-    super(message, details);
-    this.name = "ValidationError";
-  }
-}
-class YupValidationError extends ValidationError {
-  constructor(yupError, message) {
-    super("Validation");
-    const { errors: errors2, message: yupMessage } = formatYupErrors(yupError);
-    this.message = message || yupMessage;
-    this.details = { errors: errors2 };
-  }
-}
-class PaginationError extends ApplicationError {
-  constructor(message = "Invalid pagination", details) {
-    super(message, details);
-    this.name = "PaginationError";
-    this.message = message;
-  }
-}
-class NotFoundError extends ApplicationError {
-  constructor(message = "Entity not found", details) {
-    super(message, details);
-    this.name = "NotFoundError";
-    this.message = message;
-  }
-}
-class ForbiddenError extends ApplicationError {
-  constructor(message = "Forbidden access", details) {
-    super(message, details);
-    this.name = "ForbiddenError";
-    this.message = message;
-  }
-}
-class UnauthorizedError extends ApplicationError {
-  constructor(message = "Unauthorized", details) {
-    super(message, details);
-    this.name = "UnauthorizedError";
-    this.message = message;
-  }
-}
-class RateLimitError extends ApplicationError {
-  constructor(message = "Too many requests, please try again later.", details) {
-    super(message, details);
-    this.name = "RateLimitError";
-    this.message = message;
-    this.details = details || {};
-  }
-}
-class PayloadTooLargeError extends ApplicationError {
-  constructor(message = "Entity too large", details) {
-    super(message, details);
-    this.name = "PayloadTooLargeError";
-    this.message = message;
-  }
-}
-class PolicyError extends ForbiddenError {
-  constructor(message = "Policy Failed", details) {
-    super(message, details);
-    this.name = "PolicyError";
-    this.message = message;
-    this.details = details || {};
-  }
-}
-class NotImplementedError extends ApplicationError {
-  constructor(message = "This feature is not implemented yet", details) {
-    super(message, details);
-    this.name = "NotImplementedError";
-    this.message = message;
-  }
-}
-const errors = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+const index$2 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
-  ApplicationError,
-  ForbiddenError,
-  HttpError,
-  NotFoundError,
-  NotImplementedError,
-  PaginationError,
-  PayloadTooLargeError,
-  PolicyError,
-  RateLimitError,
-  UnauthorizedError,
-  ValidationError,
-  YupValidationError
+  createAPISanitizers,
+  sanitizers,
+  visitors: index$4
 }, Symbol.toStringTag, { value: "Module" }));
-const throwInvalidParam = ({ key, path }) => {
-  const msg = path && path !== key ? `Invalid parameter ${key} at ${path}` : `Invalid parameter ${key}`;
-  throw new ValidationError(msg);
+const throwInvalidKey = ({ key, path }) => {
+  const msg = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;
+  throw new ValidationError(msg, {
+    key,
+    path
+  });
 };
 const visitor$3 = ({ key, attribute, path }) => {
   if (attribute?.type === "password") {
-    throwInvalidParam({ key, path: path.attribute });
+    throwInvalidKey({ key, path: path.attribute });
   }
 };
 const visitor$2 = ({ schema, key, attribute, path }) => {
@@ -1722,7 +2182,7 @@ const visitor$2 = ({ schema, key, attribute, path }) => {
   }
   const isPrivate = attribute.private === true || isPrivateAttribute(schema, key);
   if (isPrivate) {
-    throwInvalidParam({ key, path: path.attribute });
+    throwInvalidKey({ key, path: path.attribute });
   }
 };
 const ACTIONS_TO_VERIFY = ["find"];
@@ -1740,7 +2200,7 @@ const throwRestrictedRelations = (auth) => async ({ data, key, attribute, schema
       const scopes = ACTIONS_TO_VERIFY.map((action) => `${element.__type}.${action}`);
       const isAllowed = await hasAccessToSomeScopes(scopes, auth);
       if (!isAllowed) {
-        throwInvalidParam({ key, path: path.attribute });
+        throwInvalidKey({ key, path: path.attribute });
       }
     }
   };
@@ -1748,7 +2208,7 @@ const throwRestrictedRelations = (auth) => async ({ data, key, attribute, schema
     const scopes = ACTIONS_TO_VERIFY.map((action) => `${attribute.target}.${action}`);
     const isAllowed = await hasAccessToSomeScopes(scopes, auth);
     if (!isAllowed) {
-      throwInvalidParam({ key, path: path.attribute });
+      throwInvalidKey({ key, path: path.attribute });
     }
   };
   const isCreatorRelation = [CREATED_BY_ATTRIBUTE, UPDATED_BY_ATTRIBUTE].includes(key);
@@ -1774,12 +2234,12 @@ const hasAccessToSomeScopes = async (scopes, auth) => {
 };
 const visitor$1 = ({ key, attribute, path }) => {
   if (isMorphToRelationalAttribute(attribute)) {
-    throwInvalidParam({ key, path: path.attribute });
+    throwInvalidKey({ key, path: path.attribute });
   }
 };
 const visitor = ({ key, attribute, path }) => {
   if (isDynamicZoneAttribute(attribute)) {
-    throwInvalidParam({ key, path: path.attribute });
+    throwInvalidKey({ key, path: path.attribute });
   }
 };
 const throwDisallowedFields = (allowedFields = null) => ({ key, path: { attribute: path } }) => {
@@ -1801,7 +2261,7 @@ const throwDisallowedFields = (allowedFields = null) => ({ key, path: { attribut
   if (isPathAllowed) {
     return;
   }
-  throwInvalidParam({ key, path });
+  throwInvalidKey({ key, path });
 };
 const getContainedPaths = (path) => {
   const parts = toPath(path);
@@ -1811,7 +2271,7 @@ const getContainedPaths = (path) => {
 };
 const throwRestrictedFields = (restrictedFields = null) => ({ key, path: { attribute: path } }) => {
   if (restrictedFields === null) {
-    throwInvalidParam({ key, path });
+    throwInvalidKey({ key, path });
   }
   if (!(isArray(restrictedFields) && restrictedFields.every(isString))) {
     throw new TypeError(
@@ -1819,16 +2279,46 @@ const throwRestrictedFields = (restrictedFields = null) => ({ key, path: { attri
     );
   }
   if (restrictedFields.includes(path)) {
-    throwInvalidParam({ key, path });
+    throwInvalidKey({ key, path });
   }
   const isRestrictedNested = restrictedFields.some(
     (allowedPath) => path?.toString().startsWith(`${allowedPath}.`)
   );
   if (isRestrictedNested) {
-    throwInvalidParam({ key, path });
+    throwInvalidKey({ key, path });
+  }
+};
+const ID_FIELDS = [constants$1.DOC_ID_ATTRIBUTE, constants$1.DOC_ID_ATTRIBUTE];
+const ALLOWED_ROOT_LEVEL_FIELDS = [...ID_FIELDS];
+const MORPH_TO_ALLOWED_FIELDS = ["__type"];
+const DYNAMIC_ZONE_ALLOWED_FIELDS = ["__component"];
+const RELATION_REORDERING_FIELDS = ["connect", "disconnect", "set", "options"];
+const throwUnrecognizedFields = ({ key, attribute, path, schema, parent }) => {
+  if (attribute) {
+    return;
+  }
+  if (path.attribute === null) {
+    if (ALLOWED_ROOT_LEVEL_FIELDS.includes(key)) {
+      return;
+    }
+    return throwInvalidKey({ key, path: attribute });
+  }
+  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_ALLOWED_FIELDS.includes(key)) {
+    return;
+  }
+  if (isComponentSchema(schema) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_ALLOWED_FIELDS.includes(key)) {
+    return;
+  }
+  if (hasRelationReordering(parent?.attribute) && RELATION_REORDERING_FIELDS.includes(key)) {
+    return;
+  }
+  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute);
+  if (canUseID && !ID_FIELDS.includes(key)) {
+    return;
   }
+  throwInvalidKey({ key, path: attribute });
 };
-const visitors = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+const index$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   throwDisallowedFields,
   throwDynamicZones: visitor,
@@ -1836,133 +2326,155 @@ const visitors = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProp
   throwPassword: visitor$3,
   throwPrivate: visitor$2,
   throwRestrictedFields,
-  throwRestrictedRelations
+  throwRestrictedRelations,
+  throwUnrecognizedFields
 }, Symbol.toStringTag, { value: "Module" }));
-const { ID_ATTRIBUTE: ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$2 } = constants$1;
-const throwPasswords = (schema) => async (entity) => {
-  if (!schema) {
+const { ID_ATTRIBUTE: ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$1 } = constants$1;
+const throwPasswords = (ctx) => async (entity) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in throwPasswords");
   }
-  return traverseEntity$1(visitor$3, { schema }, entity);
+  return traverseEntity$1(visitor$3, ctx, entity);
 };
-const defaultValidateFilters = curry((schema, filters2) => {
-  if (!schema) {
+const defaultValidateFilters = curry((ctx, filters2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultValidateFilters");
   }
   return pipe(
     // keys that are not attributes or valid operators
-    traverseQueryFilters(
-      ({ key, attribute, path }) => {
-        if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
-          return;
-        }
-        const isAttribute = !!attribute;
-        if (!isAttribute && !isOperator(key)) {
-          throwInvalidParam({ key, path: path.attribute });
-        }
-      },
-      { schema }
-    ),
+    traverseQueryFilters(({ key, attribute, path }) => {
+      if ([ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1].includes(key)) {
+        return;
+      }
+      const isAttribute = !!attribute;
+      if (!isAttribute && !isOperator(key)) {
+        throwInvalidKey({ key, path: path.attribute });
+      }
+    }, ctx),
     // dynamic zones from filters
-    traverseQueryFilters(visitor, { schema }),
+    traverseQueryFilters(visitor, ctx),
     // morphTo relations from filters; because you can't have deep filtering on morph relations
-    traverseQueryFilters(visitor$1, { schema }),
+    traverseQueryFilters(visitor$1, ctx),
     // passwords from filters
-    traverseQueryFilters(visitor$3, { schema }),
+    traverseQueryFilters(visitor$3, ctx),
     // private from filters
-    traverseQueryFilters(visitor$2, { schema })
+    traverseQueryFilters(visitor$2, ctx)
     // we allow empty objects to validate and only sanitize them out, so that users may write "lazy" queries without checking their params exist
   )(filters2);
 });
-const defaultValidateSort = curry((schema, sort2) => {
-  if (!schema) {
+const defaultValidateSort = curry((ctx, sort2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultValidateSort");
   }
   return pipe(
     // non attribute keys
-    traverseQuerySort(
-      ({ key, attribute, path }) => {
-        if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
-          return;
-        }
-        if (!attribute) {
-          throwInvalidParam({ key, path: path.attribute });
-        }
-      },
-      { schema }
-    ),
+    traverseQuerySort(({ key, attribute, path }) => {
+      if ([ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1].includes(key)) {
+        return;
+      }
+      if (!attribute) {
+        throwInvalidKey({ key, path: path.attribute });
+      }
+    }, ctx),
     // dynamic zones from sort
-    traverseQuerySort(visitor, { schema }),
+    traverseQuerySort(visitor, ctx),
     // morphTo relations from sort
-    traverseQuerySort(visitor$1, { schema }),
+    traverseQuerySort(visitor$1, ctx),
     // private from sort
-    traverseQuerySort(visitor$2, { schema }),
+    traverseQuerySort(visitor$2, ctx),
     // passwords from filters
-    traverseQuerySort(visitor$3, { schema }),
+    traverseQuerySort(visitor$3, ctx),
     // keys for empty non-scalar values
-    traverseQuerySort(
-      ({ key, attribute, value, path }) => {
-        if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
-          return;
-        }
-        if (!isScalarAttribute(attribute) && isEmpty(value)) {
-          throwInvalidParam({ key, path: path.attribute });
-        }
-      },
-      { schema }
-    )
+    traverseQuerySort(({ key, attribute, value, path }) => {
+      if ([ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1].includes(key)) {
+        return;
+      }
+      if (!isScalarAttribute(attribute) && isEmpty(value)) {
+        throwInvalidKey({ key, path: path.attribute });
+      }
+    }, ctx)
   )(sort2);
 });
-const defaultValidateFields = curry((schema, fields2) => {
-  if (!schema) {
+const defaultValidateFields = curry((ctx, fields2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultValidateFields");
   }
   return pipe(
     // Only allow scalar attributes
-    traverseQueryFields(
-      ({ key, attribute, path }) => {
-        if ([ID_ATTRIBUTE$2, DOC_ID_ATTRIBUTE$2].includes(key)) {
-          return;
-        }
-        if (isNil(attribute) || !isScalarAttribute(attribute)) {
-          throwInvalidParam({ key, path: path.attribute });
-        }
-      },
-      { schema }
-    ),
+    traverseQueryFields(({ key, attribute, path }) => {
+      if ([ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE$1].includes(key)) {
+        return;
+      }
+      if (isNil(attribute) || !isScalarAttribute(attribute)) {
+        throwInvalidKey({ key, path: path.attribute });
+      }
+    }, ctx),
     // private fields
-    traverseQueryFields(visitor$2, { schema }),
+    traverseQueryFields(visitor$2, ctx),
     // password fields
-    traverseQueryFields(visitor$3, { schema })
+    traverseQueryFields(visitor$3, ctx)
   )(fields2);
 });
-const defaultValidatePopulate = curry((schema, populate2) => {
-  if (!schema) {
+const defaultValidatePopulate = curry((ctx, populate2) => {
+  if (!ctx.schema) {
     throw new Error("Missing schema in defaultValidatePopulate");
   }
   return pipe(
-    traverseQueryPopulate(
-      async ({ key, value, schema: schema2, attribute }, { set }) => {
-        if (attribute) {
-          return;
-        }
-        if (key === "sort") {
-          set(key, await defaultValidateSort(schema2, value));
-        }
-        if (key === "filters") {
-          set(key, await defaultValidateFilters(schema2, value));
-        }
-        if (key === "fields") {
-          set(key, await defaultValidateFields(schema2, value));
-        }
-        if (key === "populate") {
-          set(key, await defaultValidatePopulate(schema2, value));
-        }
-      },
-      { schema }
-    ),
+    traverseQueryPopulate(async ({ key, value, schema, attribute, getModel }, { set }) => {
+      if (attribute) {
+        return;
+      }
+      if (key === "sort") {
+        set(
+          key,
+          await defaultValidateSort(
+            {
+              schema,
+              getModel
+            },
+            value
+          )
+        );
+      }
+      if (key === "filters") {
+        set(
+          key,
+          await defaultValidateFilters(
+            {
+              schema,
+              getModel
+            },
+            value
+          )
+        );
+      }
+      if (key === "fields") {
+        set(
+          key,
+          await defaultValidateFields(
+            {
+              schema,
+              getModel
+            },
+            value
+          )
+        );
+      }
+      if (key === "populate") {
+        set(
+          key,
+          await defaultValidatePopulate(
+            {
+              schema,
+              getModel
+            },
+            value
+          )
+        );
+      }
+    }, ctx),
     // Remove private fields
-    traverseQueryPopulate(visitor$2, { schema })
+    traverseQueryPopulate(visitor$2, ctx)
   )(populate2);
 });
 const validators = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -1973,8 +2485,9 @@ const validators = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
   defaultValidateSort,
   throwPasswords
 }, Symbol.toStringTag, { value: "Module" }));
-const { ID_ATTRIBUTE: ID_ATTRIBUTE$1, DOC_ID_ATTRIBUTE: DOC_ID_ATTRIBUTE$1 } = constants$1;
-const createContentAPIValidators = () => {
+const { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants$1;
+const createAPIValidators = (opts) => {
+  const { getModel } = opts || {};
   const validateInput = async (data, schema, { auth } = {}) => {
     if (!schema) {
       throw new Error("Missing schema in validateInput");
@@ -1987,22 +2500,37 @@ const createContentAPIValidators = () => {
     const transforms = [
       (data2) => {
         if (isObject(data2)) {
-          if (ID_ATTRIBUTE$1 in data2) {
-            throwInvalidParam({ key: ID_ATTRIBUTE$1 });
+          if (ID_ATTRIBUTE in data2) {
+            throwInvalidKey({ key: ID_ATTRIBUTE });
           }
-          if (DOC_ID_ATTRIBUTE$1 in data2) {
-            throwInvalidParam({ key: DOC_ID_ATTRIBUTE$1 });
+          if (DOC_ID_ATTRIBUTE in data2) {
+            throwInvalidKey({ key: DOC_ID_ATTRIBUTE });
           }
         }
+        return data2;
       },
       // non-writable attributes
-      traverseEntity$1(throwRestrictedFields(nonWritableAttributes), { schema })
+      traverseEntity$1(throwRestrictedFields(nonWritableAttributes), { schema, getModel }),
+      // unrecognized attributes
+      traverseEntity$1(throwUnrecognizedFields, { schema, getModel })
     ];
     if (auth) {
-      transforms.push(traverseEntity$1(throwRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseEntity$1(throwRestrictedRelations(auth), {
+          schema,
+          getModel
+        })
+      );
+    }
+    opts?.validators?.input?.forEach((validator) => transforms.push(validator(schema)));
+    try {
+      await pipe(...transforms)(data);
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        e.details.source = "body";
+      }
+      throw e;
     }
-    strapi.validators.get("content-api.input").forEach((validator) => transforms.push(validator(schema)));
-    await pipe(...transforms)(data);
   };
   const validateQuery = async (query, schema, { auth } = {}) => {
     if (!schema) {
@@ -2030,38 +2558,85 @@ const createContentAPIValidators = () => {
       await Promise.all(filters2.map((filter) => validateFilters(filter, schema, { auth })));
       return;
     }
-    const transforms = [defaultValidateFilters(schema)];
+    const transforms = [defaultValidateFilters({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQueryFilters(throwRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQueryFilters(throwRestrictedRelations(auth), {
+          schema,
+          getModel
+        })
+      );
+    }
+    try {
+      await pipe(...transforms)(filters2);
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        e.details.source = "query";
+        e.details.param = "filters";
+      }
+      throw e;
     }
-    await pipe(...transforms)(filters2);
   };
   const validateSort = async (sort2, schema, { auth } = {}) => {
     if (!schema) {
       throw new Error("Missing schema in validateSort");
     }
-    const transforms = [defaultValidateSort(schema)];
+    const transforms = [defaultValidateSort({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQuerySort(throwRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQuerySort(throwRestrictedRelations(auth), {
+          schema,
+          getModel
+        })
+      );
+    }
+    try {
+      await pipe(...transforms)(sort2);
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        e.details.source = "query";
+        e.details.param = "sort";
+      }
+      throw e;
     }
-    await pipe(...transforms)(sort2);
   };
   const validateFields = async (fields2, schema) => {
     if (!schema) {
       throw new Error("Missing schema in validateFields");
     }
-    const transforms = [defaultValidateFields(schema)];
-    await pipe(...transforms)(fields2);
+    const transforms = [defaultValidateFields({ schema, getModel })];
+    try {
+      await pipe(...transforms)(fields2);
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        e.details.source = "query";
+        e.details.param = "fields";
+      }
+      throw e;
+    }
   };
   const validatePopulate = async (populate2, schema, { auth } = {}) => {
     if (!schema) {
       throw new Error("Missing schema in sanitizePopulate");
     }
-    const transforms = [defaultValidatePopulate(schema)];
+    const transforms = [defaultValidatePopulate({ schema, getModel })];
     if (auth) {
-      transforms.push(traverseQueryPopulate(throwRestrictedRelations(auth), { schema }));
+      transforms.push(
+        traverseQueryPopulate(throwRestrictedRelations(auth), {
+          schema,
+          getModel
+        })
+      );
+    }
+    try {
+      await pipe(...transforms)(populate2);
+    } catch (e) {
+      if (e instanceof ValidationError) {
+        e.details.source = "query";
+        e.details.param = "populate";
+      }
+      throw e;
     }
-    await pipe(...transforms)(populate2);
   };
   return {
     input: validateInput,
@@ -2072,436 +2647,12 @@ const createContentAPIValidators = () => {
     populate: validatePopulate
   };
 };
-const contentAPI = createContentAPIValidators();
-const index = {
-  contentAPI,
+const index = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
+  __proto__: null,
+  createAPIValidators,
   validators,
-  visitors
-};
-const { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE, PUBLISHED_AT_ATTRIBUTE } = constants$1;
-class InvalidOrderError extends Error {
-  constructor() {
-    super();
-    this.message = "Invalid order. order can only be one of asc|desc|ASC|DESC";
-  }
-}
-class InvalidSortError extends Error {
-  constructor() {
-    super();
-    this.message = "Invalid sort parameter. Expected a string, an array of strings, a sort object or an array of sort objects";
-  }
-}
-function validateOrder(order) {
-  if (!isString(order) || !["asc", "desc"].includes(order.toLocaleLowerCase())) {
-    throw new InvalidOrderError();
-  }
-}
-const convertCountQueryParams = (countQuery) => {
-  return parseType({ type: "boolean", value: countQuery });
-};
-const convertOrderingQueryParams = (ordering) => {
-  return ordering;
-};
-const isPlainObject = (value) => _$1.isPlainObject(value);
-const isStringArray = (value) => isArray(value) && value.every(isString);
-const convertSortQueryParams = (sortQuery) => {
-  if (typeof sortQuery === "string") {
-    return convertStringSortQueryParam(sortQuery);
-  }
-  if (isStringArray(sortQuery)) {
-    return sortQuery.flatMap((sortValue) => convertStringSortQueryParam(sortValue));
-  }
-  if (Array.isArray(sortQuery)) {
-    return sortQuery.map((sortValue) => convertNestedSortQueryParam(sortValue));
-  }
-  if (isPlainObject(sortQuery)) {
-    return convertNestedSortQueryParam(sortQuery);
-  }
-  throw new InvalidSortError();
-};
-const convertStringSortQueryParam = (sortQuery) => {
-  return sortQuery.split(",").map((value) => convertSingleSortQueryParam(value));
-};
-const convertSingleSortQueryParam = (sortQuery) => {
-  if (!sortQuery) {
-    return {};
-  }
-  if (!isString(sortQuery)) {
-    throw new Error("Invalid sort query");
-  }
-  const [field, order = "asc"] = sortQuery.split(":");
-  if (field.length === 0) {
-    throw new Error("Field cannot be empty");
-  }
-  validateOrder(order);
-  return _$1.set({}, field, order);
-};
-const convertNestedSortQueryParam = (sortQuery) => {
-  const transformedSort = {};
-  for (const field of Object.keys(sortQuery)) {
-    const order = sortQuery[field];
-    if (isPlainObject(order)) {
-      transformedSort[field] = convertNestedSortQueryParam(order);
-    } else if (typeof order === "string") {
-      validateOrder(order);
-      transformedSort[field] = order;
-    } else {
-      throw Error(`Invalid sort type expected object or string got ${typeof order}`);
-    }
-  }
-  return transformedSort;
-};
-const convertStartQueryParams = (startQuery) => {
-  const startAsANumber = _$1.toNumber(startQuery);
-  if (!_$1.isInteger(startAsANumber) || startAsANumber < 0) {
-    throw new Error(`convertStartQueryParams expected a positive integer got ${startAsANumber}`);
-  }
-  return startAsANumber;
-};
-const convertLimitQueryParams = (limitQuery) => {
-  const limitAsANumber = _$1.toNumber(limitQuery);
-  if (!_$1.isInteger(limitAsANumber) || limitAsANumber !== -1 && limitAsANumber < 0) {
-    throw new Error(`convertLimitQueryParams expected a positive integer got ${limitAsANumber}`);
-  }
-  if (limitAsANumber === -1) {
-    return void 0;
-  }
-  return limitAsANumber;
-};
-const convertPageQueryParams = (page) => {
-  const pageVal = toNumber(page);
-  if (!isInteger(pageVal) || pageVal <= 0) {
-    throw new PaginationError(
-      `Invalid 'page' parameter. Expected an integer > 0, received: ${page}`
-    );
-  }
-  return pageVal;
-};
-const convertPageSizeQueryParams = (pageSize, page) => {
-  const pageSizeVal = toNumber(pageSize);
-  if (!isInteger(pageSizeVal) || pageSizeVal <= 0) {
-    throw new PaginationError(
-      `Invalid 'pageSize' parameter. Expected an integer > 0, received: ${page}`
-    );
-  }
-  return pageSizeVal;
-};
-const validatePaginationParams = (page, pageSize, start, limit) => {
-  const isPagePagination = !isNil(page) || !isNil(pageSize);
-  const isOffsetPagination = !isNil(start) || !isNil(limit);
-  if (isPagePagination && isOffsetPagination) {
-    throw new PaginationError(
-      "Invalid pagination attributes. You cannot use page and offset pagination in the same query"
-    );
-  }
-};
-class InvalidPopulateError extends Error {
-  constructor() {
-    super();
-    this.message = "Invalid populate parameter. Expected a string, an array of strings, a populate object";
-  }
-}
-const convertPopulateQueryParams = (populate2, schema, depth = 0) => {
-  if (depth === 0 && populate2 === "*") {
-    return true;
-  }
-  if (typeof populate2 === "string") {
-    return populate2.split(",").map((value) => _$1.trim(value));
-  }
-  if (Array.isArray(populate2)) {
-    return _$1.uniq(
-      populate2.flatMap((value) => {
-        if (typeof value !== "string") {
-          throw new InvalidPopulateError();
-        }
-        return value.split(",").map((value2) => _$1.trim(value2));
-      })
-    );
-  }
-  if (_$1.isPlainObject(populate2)) {
-    return convertPopulateObject(populate2, schema);
-  }
-  throw new InvalidPopulateError();
-};
-const hasFragmentPopulateDefined = (populate2) => {
-  return typeof populate2 === "object" && "on" in populate2 && !isNil(populate2.on);
-};
-const convertPopulateObject = (populate2, schema) => {
-  if (!schema) {
-    return {};
-  }
-  const { attributes } = schema;
-  return Object.entries(populate2).reduce((acc, [key, subPopulate]) => {
-    if (_$1.isBoolean(subPopulate)) {
-      return { ...acc, [key]: subPopulate };
-    }
-    const attribute = attributes[key];
-    if (!attribute) {
-      return acc;
-    }
-    const isAllowedAttributeForFragmentPopulate = isDynamicZoneAttribute(attribute) || isMorphToRelationalAttribute(attribute);
-    if (isAllowedAttributeForFragmentPopulate && hasFragmentPopulateDefined(subPopulate)) {
-      return {
-        ...acc,
-        [key]: {
-          on: Object.entries(subPopulate.on).reduce(
-            (acc2, [type, typeSubPopulate]) => ({
-              ...acc2,
-              [type]: convertNestedPopulate(typeSubPopulate, strapi.getModel(type))
-            }),
-            {}
-          )
-        }
-      };
-    }
-    if (isDynamicZoneAttribute(attribute)) {
-      const populates = attribute.components.map((uid) => strapi.getModel(uid)).map((schema2) => convertNestedPopulate(subPopulate, schema2)).map((populate22) => populate22 === true ? {} : populate22).filter((populate22) => populate22 !== false);
-      if (isEmpty(populates)) {
-        return acc;
-      }
-      return {
-        ...acc,
-        [key]: mergeAll(populates)
-      };
-    }
-    if (isMorphToRelationalAttribute(attribute)) {
-      return { ...acc, [key]: convertNestedPopulate(subPopulate, void 0) };
-    }
-    let targetSchemaUID;
-    if (attribute.type === "relation") {
-      targetSchemaUID = attribute.target;
-    } else if (attribute.type === "component") {
-      targetSchemaUID = attribute.component;
-    } else if (attribute.type === "media") {
-      targetSchemaUID = "plugin::upload.file";
-    } else {
-      return acc;
-    }
-    const targetSchema = strapi.getModel(targetSchemaUID);
-    if (!targetSchema) {
-      return acc;
-    }
-    const populateObject = convertNestedPopulate(subPopulate, targetSchema);
-    if (!populateObject) {
-      return acc;
-    }
-    return {
-      ...acc,
-      [key]: populateObject
-    };
-  }, {});
-};
-const convertNestedPopulate = (subPopulate, schema) => {
-  if (_$1.isString(subPopulate)) {
-    return parseType({ type: "boolean", value: subPopulate, forceCast: true });
-  }
-  if (_$1.isBoolean(subPopulate)) {
-    return subPopulate;
-  }
-  if (!isPlainObject(subPopulate)) {
-    throw new Error(`Invalid nested populate. Expected '*' or an object`);
-  }
-  const { sort: sort2, filters: filters2, fields: fields2, populate: populate2, count, ordering, page, pageSize, start, limit } = subPopulate;
-  const query = {};
-  if (sort2) {
-    query.orderBy = convertSortQueryParams(sort2);
-  }
-  if (filters2) {
-    query.where = convertFiltersQueryParams(filters2, schema);
-  }
-  if (fields2) {
-    query.select = convertFieldsQueryParams(fields2);
-  }
-  if (populate2) {
-    query.populate = convertPopulateQueryParams(populate2, schema);
-  }
-  if (count) {
-    query.count = convertCountQueryParams(count);
-  }
-  if (ordering) {
-    query.ordering = convertOrderingQueryParams(ordering);
-  }
-  validatePaginationParams(page, pageSize, start, limit);
-  if (!isNil(page)) {
-    query.page = convertPageQueryParams(page);
-  }
-  if (!isNil(pageSize)) {
-    query.pageSize = convertPageSizeQueryParams(pageSize, page);
-  }
-  if (!isNil(start)) {
-    query.offset = convertStartQueryParams(start);
-  }
-  if (!isNil(limit)) {
-    query.limit = convertLimitQueryParams(limit);
-  }
-  return query;
-};
-const convertFieldsQueryParams = (fields2, depth = 0) => {
-  if (depth === 0 && fields2 === "*") {
-    return void 0;
-  }
-  if (typeof fields2 === "string") {
-    const fieldsValues = fields2.split(",").map((value) => _$1.trim(value));
-    return _$1.uniq([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE, ...fieldsValues]);
-  }
-  if (isStringArray(fields2)) {
-    const fieldsValues = fields2.flatMap((value) => convertFieldsQueryParams(value, depth + 1)).filter((v) => !isNil(v));
-    return _$1.uniq([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE, ...fieldsValues]);
-  }
-  throw new Error("Invalid fields parameter. Expected a string or an array of strings");
-};
-const isValidSchemaAttribute = (key, schema) => {
-  if ([DOC_ID_ATTRIBUTE, ID_ATTRIBUTE].includes(key)) {
-    return true;
-  }
-  if (!schema) {
-    return false;
-  }
-  return Object.keys(schema.attributes).includes(key);
-};
-const convertFiltersQueryParams = (filters2, schema) => {
-  if (!isObject(filters2)) {
-    throw new Error("The filters parameter must be an object or an array");
-  }
-  const filtersCopy = cloneDeep(filters2);
-  return convertAndSanitizeFilters(filtersCopy, schema);
-};
-const convertAndSanitizeFilters = (filters2, schema) => {
-  if (Array.isArray(filters2)) {
-    return filters2.map((filter) => convertAndSanitizeFilters(filter, schema)).filter((filter) => !isPlainObject(filter) || !isEmpty(filter));
-  }
-  if (!isPlainObject(filters2)) {
-    return filters2;
-  }
-  const removeOperator = (operator) => delete filters2[operator];
-  for (const [key, value] of Object.entries(filters2)) {
-    const attribute = get(key, schema?.attributes);
-    const validKey = isOperator(key) || isValidSchemaAttribute(key, schema);
-    if (!validKey) {
-      removeOperator(key);
-    } else if (attribute) {
-      if (attribute.type === "relation") {
-        filters2[key] = convertAndSanitizeFilters(value, strapi.getModel(attribute.target));
-      } else if (attribute.type === "component") {
-        filters2[key] = convertAndSanitizeFilters(value, strapi.getModel(attribute.component));
-      } else if (attribute.type === "media") {
-        filters2[key] = convertAndSanitizeFilters(value, strapi.getModel("plugin::upload.file"));
-      } else if (attribute.type === "dynamiczone") {
-        removeOperator(key);
-      } else if (attribute.type === "password") {
-        removeOperator(key);
-      } else {
-        filters2[key] = convertAndSanitizeFilters(value, schema);
-      }
-    } else if (["$null", "$notNull"].includes(key)) {
-      filters2[key] = parseType({ type: "boolean", value: filters2[key], forceCast: true });
-    } else if (isObject(value)) {
-      filters2[key] = convertAndSanitizeFilters(value, schema);
-    }
-    if (isPlainObject(filters2[key]) && isEmpty(filters2[key])) {
-      removeOperator(key);
-    }
-  }
-  return filters2;
-};
-const convertStatusParams = (status, query = {}) => {
-  query.filters = ({ meta }) => {
-    const contentType = strapi.contentTypes[meta.uid];
-    if (!contentType || !hasDraftAndPublish(contentType)) {
-      return {};
-    }
-    return { [PUBLISHED_AT_ATTRIBUTE]: { $null: status === "draft" } };
-  };
-};
-const transformParamsToQuery = (uid, params) => {
-  const schema = strapi.getModel(uid);
-  const query = {};
-  const { _q, sort: sort2, filters: filters2, fields: fields2, populate: populate2, page, pageSize, start, limit, status, ...rest } = params;
-  if (!isNil(status)) {
-    convertStatusParams(status, query);
-  }
-  if (!isNil(_q)) {
-    query._q = _q;
-  }
-  if (!isNil(sort2)) {
-    query.orderBy = convertSortQueryParams(sort2);
-  }
-  if (!isNil(filters2)) {
-    query.where = convertFiltersQueryParams(filters2, schema);
-  }
-  if (!isNil(fields2)) {
-    query.select = convertFieldsQueryParams(fields2);
-  }
-  if (!isNil(populate2)) {
-    query.populate = convertPopulateQueryParams(populate2, schema);
-  }
-  validatePaginationParams(page, pageSize, start, limit);
-  if (!isNil(page)) {
-    query.page = convertPageQueryParams(page);
-  }
-  if (!isNil(pageSize)) {
-    query.pageSize = convertPageSizeQueryParams(pageSize, page);
-  }
-  if (!isNil(start)) {
-    query.offset = convertStartQueryParams(start);
-  }
-  if (!isNil(limit)) {
-    query.limit = convertLimitQueryParams(limit);
-  }
-  return {
-    ...rest,
-    ...query
-  };
-};
-const convertQueryParams = {
-  convertSortQueryParams,
-  convertStartQueryParams,
-  convertLimitQueryParams,
-  convertPopulateQueryParams,
-  convertFiltersQueryParams,
-  convertFieldsQueryParams,
-  transformParamsToQuery
-};
-function importDefault(modName) {
-  const mod = require(modName);
-  return mod && mod.__esModule ? mod.default : mod;
-}
-const machineId = () => {
-  try {
-    const deviceId = machineIdSync();
-    return deviceId;
-  } catch (error) {
-    const deviceId = randomUUID();
-    return deviceId;
-  }
-};
-const handleYupError = (error, errorMessage) => {
-  throw new YupValidationError(error, errorMessage);
-};
-const defaultValidationParam = { strict: true, abortEarly: false };
-const validateYupSchema = (schema, options = {}) => async (body, errorMessage) => {
-  try {
-    const optionsWithDefaults = defaults(defaultValidationParam, options);
-    const result = await schema.validate(body, optionsWithDefaults);
-    return result;
-  } catch (e) {
-    if (e instanceof yup$1.ValidationError) {
-      handleYupError(e, errorMessage);
-    }
-    throw e;
-  }
-};
-const validateYupSchemaSync = (schema, options = {}) => (body, errorMessage) => {
-  try {
-    const optionsWithDefaults = defaults(defaultValidationParam, options);
-    return schema.validateSync(body, optionsWithDefaults);
-  } catch (e) {
-    if (e instanceof yup$1.ValidationError) {
-      handleYupError(e, errorMessage);
-    }
-    throw e;
-  }
-};
+  visitors: index$1
+}, Symbol.toStringTag, { value: "Module" }));
 const STRAPI_DEFAULTS = {
   offset: {
     start: 0,
@@ -2569,8 +2720,57 @@ const withDefaultPagination = (args, { defaults: defaults2 = {}, maxLimit = -1 }
   );
   return replacePaginationAttributes(args);
 };
+const transformPagedPaginationInfo = (paginationInfo, total) => {
+  if (!isNil(paginationInfo.page)) {
+    const page = paginationInfo.page;
+    const pageSize = paginationInfo.pageSize ?? total;
+    return {
+      page,
+      pageSize,
+      pageCount: pageSize > 0 ? Math.ceil(total / pageSize) : 0,
+      total
+    };
+  }
+  if (!isNil(paginationInfo.start)) {
+    const start = paginationInfo.start;
+    const limit = paginationInfo.limit ?? total;
+    return {
+      page: Math.floor(start / limit) + 1,
+      pageSize: limit,
+      pageCount: limit > 0 ? Math.ceil(total / limit) : 0,
+      total
+    };
+  }
+  return {
+    ...paginationInfo,
+    page: 1,
+    pageSize: 10,
+    pageCount: 1,
+    total
+  };
+};
+const transformOffsetPaginationInfo = (paginationInfo, total) => {
+  if (!isNil(paginationInfo.page)) {
+    const limit = paginationInfo.pageSize ?? total;
+    const start = (paginationInfo.page - 1) * limit;
+    return { start, limit, total };
+  }
+  if (!isNil(paginationInfo.start)) {
+    const start = paginationInfo.start;
+    const limit = paginationInfo.limit ?? total;
+    return { start, limit, total };
+  }
+  return {
+    ...paginationInfo,
+    start: 0,
+    limit: 10,
+    total
+  };
+};
 const pagination = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  transformOffsetPaginationInfo,
+  transformPagedPaginationInfo,
   withDefaultPagination
 }, Symbol.toStringTag, { value: "Module" }));
 const SUPPORTED_PACKAGE_MANAGERS = ["npm", "yarn"];
@@ -2653,72 +2853,6 @@ const file = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty
   streamToBuffer,
   writableDiscardStream
 }, Symbol.toStringTag, { value: "Module" }));
-const PLUGIN_PREFIX = "plugin::";
-const API_PREFIX = "api::";
-const parsePolicy = (policy2) => {
-  if (typeof policy2 === "string") {
-    return { policyName: policy2, config: {} };
-  }
-  const { name, config } = policy2;
-  return { policyName: name, config };
-};
-const searchLocalPolicy = (policyName, policyContext) => {
-  const { pluginName, apiName } = policyContext ?? {};
-  if (pluginName) {
-    return strapi.policy(`${PLUGIN_PREFIX}${pluginName}.${policyName}`);
-  }
-  if (apiName) {
-    return strapi.policy(`${API_PREFIX}${apiName}.${policyName}`);
-  }
-};
-const globalPolicy = ({ method, endpoint, controller, action, plugin }) => {
-  return async (ctx, next) => {
-    ctx.request.route = {
-      endpoint: `${method} ${endpoint}`,
-      controller: _$1.toLower(controller),
-      action: _$1.toLower(action),
-      verb: _$1.toLower(method),
-      plugin
-    };
-    await next();
-  };
-};
-const resolvePolicies = (config, policyContext) => {
-  const { pluginName, apiName } = policyContext ?? {};
-  return config.map((policyConfig) => {
-    return {
-      handler: getPolicy(policyConfig, { pluginName, apiName }),
-      config: typeof policyConfig === "object" && policyConfig.config || {}
-    };
-  });
-};
-const findPolicy = (name, policyContext) => {
-  const { pluginName, apiName } = policyContext ?? {};
-  const resolvedPolicy = strapi.policy(name);
-  if (resolvedPolicy !== void 0) {
-    return resolvedPolicy;
-  }
-  const localPolicy = searchLocalPolicy(name, { pluginName, apiName });
-  if (localPolicy !== void 0) {
-    return localPolicy;
-  }
-  throw new Error(`Could not find policy "${name}"`);
-};
-const getPolicy = (policyConfig, policyContext) => {
-  const { pluginName, apiName } = policyContext ?? {};
-  if (typeof policyConfig === "function") {
-    return policyConfig;
-  }
-  const { policyName, config } = parsePolicy(policyConfig);
-  const policy2 = findPolicy(policyName, { pluginName, apiName });
-  if (typeof policy2 === "function") {
-    return policy2;
-  }
-  if (policy2.validator) {
-    policy2.validator(config);
-  }
-  return policy2.handler;
-};
 const createPolicy = (options) => {
   const { name = "unnamed", validator, handler } = options;
   const wrappedValidator = (config) => {
@@ -2750,10 +2884,7 @@ const createPolicyContext = (type, ctx) => {
 const policy = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
   createPolicy,
-  createPolicyContext,
-  get: getPolicy,
-  globalPolicy,
-  resolve: resolvePolicies
+  createPolicyContext
 }, Symbol.toStringTag, { value: "Module" }));
 const nameToSlug = (name, options = { separator: "-" }) => slugify(name, options);
 const nameToCollectionName = (name) => slugify(name, { separator: "_" });
@@ -2763,9 +2894,9 @@ const toRegressedEnumValue = (value) => slugify(value, {
   separator: "_"
 });
 const getCommonPath = (...paths) => {
-  const [segments, ...otherSegments] = paths.map((it) => _$1.split(it, "/"));
-  return _$1.join(
-    _$1.takeWhile(segments, (str, index2) => otherSegments.every((it) => it[index2] === str)),
+  const [segments, ...otherSegments] = paths.map((it) => ___default.split(it, "/"));
+  return ___default.join(
+    ___default.takeWhile(segments, (str, index2) => otherSegments.every((it) => it[index2] === str)),
     "/"
   );
 };
@@ -2807,9 +2938,9 @@ const arrays = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProper
   __proto__: null,
   includesString
 }, Symbol.toStringTag, { value: "Module" }));
-const keysDeep = (obj, path = []) => !_$1.isObject(obj) ? [path.join(".")] : _$1.reduce(
+const keysDeep = (obj, path = []) => !___default.isObject(obj) ? [path.join(".")] : ___default.reduce(
   obj,
-  (acc, next, key) => _$1.concat(acc, keysDeep(next, [...path, key])),
+  (acc, next, key) => ___default.concat(acc, keysDeep(next, [...path, key])),
   []
 );
 const objects = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -2873,8 +3004,8 @@ function printValue(value, quoteStrings) {
   );
 }
 const strapiID = () => new StrapiIDSchema();
-const isNotNilTest = (value) => !_$1.isNil(value);
-const isNotNullTest = (value) => !_$1.isNull(value);
+const isNotNilTest = (value) => !___default.isNil(value);
+const isNotNullTest = (value) => !___default.isNull(value);
 yup$1.addMethod(yup$1.mixed, "notNil", function isNotNill(msg = "${path} must be defined.") {
   return this.test("defined", msg, isNotNilTest);
 });
@@ -2885,7 +3016,7 @@ yup$1.addMethod(yup$1.mixed, "isFunction", function isFunction(message = "${path
   return this.test(
     "is a function",
     message,
-    (value) => _$1.isUndefined(value) || _$1.isFunction(value)
+    (value) => ___default.isUndefined(value) || ___default.isFunction(value)
   );
 });
 yup$1.addMethod(
@@ -2917,7 +3048,7 @@ yup$1.addMethod(
     return this.test(
       "only contains functions",
       message,
-      (value) => _$1.isUndefined(value) || value && Object.values(value).every(_$1.isFunction)
+      (value) => ___default.isUndefined(value) || value && Object.values(value).every(___default.isFunction)
     );
   }
 );
@@ -2992,11 +3123,31 @@ const relations = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePro
   isManyToAny,
   isOneToAny
 }, Symbol.toStringTag, { value: "Module" }));
+const validateZod = (schema) => (data) => {
+  try {
+    return schema.parse(data);
+  } catch (error) {
+    if (error instanceof z.ZodError) {
+      const { message, errors: errors2 } = formatZodErrors(error);
+      throw new ValidationError(message, { errors: errors2 });
+    }
+    throw error;
+  }
+};
+const formatZodErrors = (zodError) => ({
+  errors: zodError.errors.map((error) => {
+    return {
+      path: error.path,
+      message: error.message,
+      name: "ValidationError"
+    };
+  }),
+  message: "Validation error"
+});
 export {
   arrays,
   async,
   contentTypes,
-  convertQueryParams,
   dates,
   env,
   errors,
@@ -3012,16 +3163,18 @@ export {
   parseType,
   policy,
   providerFactory,
+  convertQueryParams as queryParams,
   relations,
-  index$1 as sanitize,
+  index$2 as sanitize,
   setCreatorFields,
   strings,
   template,
-  index$2 as traverse,
+  index$3 as traverse,
   traverseEntity$1 as traverseEntity,
   index as validate,
   validateYupSchema,
   validateYupSchemaSync,
+  validateZod,
   yup
 };
 //# sourceMappingURL=index.mjs.map