@strapi/utils 5.48.1 → 5.50.0

package/dist/sanitize/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../src/sanitize/index.ts"],"sourcesContent":["import { CurriedFunction1 } from 'lodash';\nimport { isArray, cloneDeep, omit, pick } from 'lodash/fp';\nimport type { z } from 'zod/v4';\n\nimport { constants, getNonWritableAttributes } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\n\nimport * as visitors from './visitors';\nimport * as sanitizers from './sanitizers';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort, traverseQueryPopulate } from '../traverse';\nimport type { Model, Data } from '../types';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, removes fields that are not declared in the schema (input) or keeps only allowed query param keys (query).\n   * Defaults to false for backward compatibility.\n   * TODO: In Strapi 6, strictParams will default to true (and may be removed as an option)\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated/sanitized with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Sanitizer {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface SanitizeFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<unknown>;\n}\n\nexport type SanitizeQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport type SanitizeBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport interface APIOptions {\n  sanitizers?: Sanitizers;\n  getModel: (model: string) => Model;\n}\n\nexport interface Sanitizers {\n  input?: Sanitizer[];\n  output?: Sanitizer[];\n}\n\nconst createAPISanitizers = (opts: APIOptions) => {\n  const { getModel } = opts;\n\n  const sanitizeInput: SanitizeFunc = (\n    data: unknown,\n    schema: Model,\n    { auth, strictParams = false, route } = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeInput');\n    }\n    if (isArray(data)) {\n      return Promise.all(\n        data.map((entry) => sanitizeInput(entry, schema, { auth, strictParams, route }))\n      );\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      // Remove first level ID in inputs\n      omit(constants.ID_ATTRIBUTE),\n      omit(constants.DOC_ID_ATTRIBUTE),\n      // Remove non-writable attributes\n      traverseEntity(visitors.removeRestrictedFields(nonWritableAttributes), { schema, getModel }),\n    ];\n\n    if (strictParams) {\n      // Remove unrecognized fields (allowedExtraRootKeys = registered input param keys)\n      transforms.push(\n        traverseEntity(visitors.removeUnrecognizedFields, {\n          schema,\n          getModel,\n          allowedExtraRootKeys,\n        })\n      );\n    }\n\n    if (auth) {\n      // Remove restricted relations\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.input?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    /**\n     * For each extra root key from the route's body schema present in data, run Zod safeParse.\n     * If parsing fails, the key is removed from the output.\n     *\n     * Content-api sends the document payload as body.data; the controller calls sanitizeInput(body.data, ctx),\n     * so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n     * The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n     * the main document payload is already sanitized above by traverseEntity (removeUnrecognizedFields, etc.);\n     * relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n     * Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n     */\n    const routeBodySanitizeTransform = async (data: Data): Promise<Data> => {\n      if (!data || typeof data !== 'object' || Array.isArray(data)) return data;\n      const obj = data as Record<string, unknown>;\n      const bodySchema = route?.request?.body?.['application/json'];\n      if (bodySchema && typeof bodySchema === 'object' && 'shape' in bodySchema) {\n        const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n        for (const key of Object.keys(shape)) {\n          if (key === 'data' || !(key in obj)) continue;\n          const zodSchema = shape[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(obj[key]);\n            if (result.success) {\n              obj[key] = result.data;\n            } else {\n              delete obj[key];\n            }\n          }\n        }\n      }\n      return data;\n    };\n    (transforms as Array<(data: Data) => Data | Promise<Data>>).push(routeBodySanitizeTransform);\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeOutput: SanitizeFunc = async (data, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeOutput');\n    }\n    if (isArray(data)) {\n      const res = new Array(data.length);\n      for (let i = 0; i < data.length; i += 1) {\n        res[i] = await sanitizeOutput(data[i], schema, { auth });\n      }\n      return res;\n    }\n\n    const transforms = [\n      (data: Data) => sanitizers.defaultSanitizeOutput({ schema, getModel }, data),\n    ];\n\n    if (auth) {\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.output?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeQuery');\n    }\n    const { filters, sort, fields, populate } = query;\n\n    const sanitizedQuery = cloneDeep(query);\n\n    if ('publicationFilter' in sanitizedQuery) {\n      validatePublicationFilterQueryParam(sanitizedQuery.publicationFilter);\n    }\n\n    if (filters) {\n      Object.assign(sanitizedQuery, { filters: await sanitizeFilters(filters, schema, { auth }) });\n    }\n\n    if (sort) {\n      Object.assign(sanitizedQuery, { sort: await sanitizeSort(sort, schema, { auth }) });\n    }\n\n    if (fields) {\n      Object.assign(sanitizedQuery, { fields: await sanitizeFields(fields, schema) });\n    }\n\n    if (populate) {\n      Object.assign(sanitizedQuery, { populate: await sanitizePopulate(populate, schema) });\n    }\n\n    const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n    const routeQuerySchema = route?.request?.query;\n    if (routeQuerySchema) {\n      for (const key of extraQueryKeys) {\n        if (key in query) {\n          const zodSchema = routeQuerySchema[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n            if (result.success) {\n              sanitizedQuery[key] = result.data;\n            } else {\n              delete sanitizedQuery[key];\n            }\n          }\n        }\n      }\n    }\n\n    if (strictParams) {\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      return pick(allowedKeys, sanitizedQuery) as Record<string, unknown>;\n    }\n\n    return sanitizedQuery;\n  };\n\n  const sanitizeFilters: SanitizeFunc = (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFilters');\n    }\n    if (isArray(filters)) {\n      return Promise.all(filters.map((filter) => sanitizeFilters(filter, schema, { auth })));\n    }\n\n    const transforms = [sanitizers.defaultSanitizeFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(filters);\n  };\n\n  const sanitizeSort: SanitizeFunc = (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeSort');\n    }\n    const transforms = [sanitizers.defaultSanitizeSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(sort);\n  };\n\n  const sanitizeFields: SanitizeFunc = (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFields');\n    }\n    const transforms = [sanitizers.defaultSanitizeFields({ schema, getModel })];\n\n    return pipeAsync(...transforms)(fields);\n  };\n\n  const sanitizePopulate: SanitizeFunc = (populate, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [sanitizers.defaultSanitizePopulate({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryPopulate(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(populate);\n  };\n\n  return {\n    input: sanitizeInput,\n    output: sanitizeOutput,\n    query: sanitizeQuery,\n    filters: sanitizeFilters,\n    sort: sanitizeSort,\n    fields: sanitizeFields,\n    populate: sanitizePopulate,\n  };\n};\n\nexport { createAPISanitizers, sanitizers, visitors };\n\nexport type APISanitiers = ReturnType<typeof createAPISanitizers>;\n"],"names":["createAPISanitizers","opts","getModel","sanitizeInput","data","schema","auth","strictParams","route","Error","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","omit","constants","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","traverseEntity","visitors","push","sanitizers","input","forEach","sanitizer","routeBodySanitizeTransform","Array","obj","bodySchema","request","body","shape","key","Object","keys","zodSchema","safeParse","result","success","pipeAsync","sanitizeOutput","res","length","i","output","sanitizeQuery","query","filters","sort","fields","populate","sanitizedQuery","cloneDeep","validatePublicationFilterQueryParam","publicationFilter","assign","sanitizeFilters","sanitizeSort","sanitizeFields","sanitizePopulate","extraQueryKeys","getExtraQueryKeysFromRoute","routeQuerySchema","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","pick","filter","traverseQueryFilters","traverseQuerySort","traverseQueryPopulate"],"mappings":";;;;;;;;;;;;;;;;;;;AAiEA,MAAMA,sBAAsB,CAACC,IAAAA,GAAAA;IAC3B,MAAM,EAAEC,QAAQ,EAAE,GAAGD,IAAAA;AAErB,IAAA,MAAME,aAAAA,GAA8B,CAClCC,IAAAA,EACAC,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAE,GAAG,EAAE,GAAA;AAE1C,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQN,IAAAA,CAAAA,EAAO;YACjB,OAAOO,OAAAA,CAAQC,GAAG,CAChBR,IAAAA,CAAKS,GAAG,CAAC,CAACC,KAAAA,GAAUX,aAAAA,CAAcW,KAAAA,EAAOT,MAAAA,EAAQ;AAAEC,oBAAAA,IAAAA;AAAMC,oBAAAA,YAAAA;AAAcC,oBAAAA;AAAM,iBAAA,CAAA,CAAA,CAAA;AAEjF,QAAA;AAEA,QAAA,MAAMO,uBAAuBC,mDAAAA,CAA8BR,KAAAA,CAAAA;AAE3D,QAAA,MAAMS,wBAAwBC,qCAAAA,CAAyBb,MAAAA,CAAAA;AAEvD,QAAA,MAAMc,UAAAA,GAAa;;AAEjBC,YAAAA,OAAAA,CAAKC,uBAAUC,YAAY,CAAA;AAC3BF,YAAAA,OAAAA,CAAKC,uBAAUE,gBAAgB,CAAA;;YAE/BC,cAAAA,CAAeC,sBAA+B,CAACR,qBAAAA,CAAAA,EAAwB;AAAEZ,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAC3F,SAAA;AAED,QAAA,IAAIK,YAAAA,EAAc;;AAEhBY,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,EAAE;AAChDpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAa,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAErF;;;;;;;;;;QAWA,MAAM0B,6BAA6B,OAAO3B,IAAAA,GAAAA;YACxC,IAAI,CAACA,QAAQ,OAAOA,IAAAA,KAAS,YAAY4B,KAAAA,CAAMtB,OAAO,CAACN,IAAAA,CAAAA,EAAO,OAAOA,IAAAA;AACrE,YAAA,MAAM6B,GAAAA,GAAM7B,IAAAA;AACZ,YAAA,MAAM8B,UAAAA,GAAa1B,KAAAA,EAAO2B,OAAAA,EAASC,IAAAA,GAAO,kBAAA,CAAmB;AAC7D,YAAA,IAAIF,UAAAA,IAAc,OAAOA,UAAAA,KAAe,QAAA,IAAY,WAAWA,UAAAA,EAAY;gBACzE,MAAMG,KAAAA,GAAQ,UAACH,CAAuDG,KAAK;AAC3E,gBAAA,KAAK,MAAMC,GAAAA,IAAOC,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,oBAAA,IAAIC,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOL,GAAE,CAAA,EAAI;oBACrC,MAAMQ,SAAAA,GAAYJ,KAAK,CAACC,GAAAA,CAAI;AAC5B,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACT,GAAG,CAACK,GAAAA,CAAI,CAAA;wBAC7D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBX,4BAAAA,GAAG,CAACK,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACxB,CAAA,MAAO;4BACL,OAAO6B,GAAG,CAACK,GAAAA,CAAI;AACjB,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;YACA,OAAOlC,IAAAA;AACT,QAAA,CAAA;AACCe,QAAAA,UAAAA,CAA2DO,IAAI,CAACK,0BAAAA,CAAAA;AAEjE,QAAA,OAAOc,cAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAM0C,cAAAA,GAA+B,OAAO1C,IAAAA,EAAMC,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQN,IAAAA,CAAAA,EAAO;AACjB,YAAA,MAAM2C,GAAAA,GAAM,IAAIf,KAAAA,CAAM5B,IAAAA,CAAK4C,MAAM,CAAA;YACjC,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAI7C,KAAK4C,MAAM,EAAEC,KAAK,CAAA,CAAG;gBACvCF,GAAG,CAACE,EAAE,GAAG,MAAMH,eAAe1C,IAAI,CAAC6C,CAAAA,CAAE,EAAE5C,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA;AACxD,YAAA;YACA,OAAOyC,GAAAA;AACT,QAAA;AAEA,QAAA,MAAM5B,UAAAA,GAAa;YACjB,CAACf,IAAAA,GAAeuB,gCAAgC,CAAC;AAAEtB,oBAAAA,MAAAA;AAAQH,oBAAAA;iBAAS,EAAGE,IAAAA;AACxE,SAAA;AAED,QAAA,IAAIE,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYuB,QAAQrB,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAEtF,QAAA,OAAOwC,cAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;AAEA,IAAA,MAAM+C,aAAAA,GAAgB,OACpBC,KAAAA,EACA/C,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QACA,MAAM,EAAE4C,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,KAAAA;AAE5C,QAAA,MAAMK,iBAAiBC,YAAAA,CAAUN,KAAAA,CAAAA;AAEjC,QAAA,IAAI,uBAAuBK,cAAAA,EAAgB;AACzCE,YAAAA,qDAAAA,CAAoCF,eAAeG,iBAAiB,CAAA;AACtE,QAAA;AAEA,QAAA,IAAIP,OAAAA,EAAS;YACXd,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEJ,OAAAA,EAAS,MAAMS,eAAAA,CAAgBT,OAAAA,EAAShD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AAC5F,QAAA;AAEA,QAAA,IAAIgD,IAAAA,EAAM;YACRf,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEH,IAAAA,EAAM,MAAMS,YAAAA,CAAaT,IAAAA,EAAMjD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AACnF,QAAA;AAEA,QAAA,IAAIiD,MAAAA,EAAQ;YACVhB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEF,MAAAA,EAAQ,MAAMS,eAAeT,MAAAA,EAAQlD,MAAAA;AAAQ,aAAA,CAAA;AAC/E,QAAA;AAEA,QAAA,IAAImD,QAAAA,EAAU;YACZjB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAED,QAAAA,EAAU,MAAMS,iBAAiBT,QAAAA,EAAUnD,MAAAA;AAAQ,aAAA,CAAA;AACrF,QAAA;AAEA,QAAA,MAAM6D,iBAAiBC,gDAAAA,CAA2B3D,KAAAA,CAAAA;QAClD,MAAM4D,gBAAAA,GAAmB5D,OAAO2B,OAAAA,EAASiB,KAAAA;AACzC,QAAA,IAAIgB,gBAAAA,EAAkB;YACpB,KAAK,MAAM9B,OAAO4B,cAAAA,CAAgB;AAChC,gBAAA,IAAI5B,OAAOc,KAAAA,EAAO;oBAChB,MAAMX,SAAAA,GAAY2B,gBAAgB,CAAC9B,GAAAA,CAAI;AACvC,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACU,KAAK,CAACd,GAAAA,CAAI,CAAA;wBAC/D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBa,4BAAAA,cAAc,CAACnB,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACnC,CAAA,MAAO;4BACL,OAAOqD,cAAc,CAACnB,GAAAA,CAAI;AAC5B,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;AAEA,QAAA,IAAI/B,YAAAA,EAAc;AAChB,YAAA,MAAM8D,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,4CAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,OAAOK,QAAKF,WAAAA,EAAaZ,cAAAA,CAAAA;AAC3B,QAAA;QAEA,OAAOA,cAAAA;AACT,IAAA,CAAA;IAEA,MAAMK,eAAAA,GAAgC,CAACT,OAAAA,EAAShD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQ2C,OAAAA,CAAAA,EAAU;YACpB,OAAO1C,OAAAA,CAAQC,GAAG,CAACyC,OAAAA,CAAQxC,GAAG,CAAC,CAAC2D,MAAAA,GAAWV,eAAAA,CAAgBU,MAAAA,EAAQnE,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACpF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACQ,YAAAA,iCAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACb+C,YAAAA,CAAqBhD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEtF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYkC,OAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,YAAAA,GAA6B,CAACT,IAAAA,EAAMjD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AACpE,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,8BAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbgD,SAAAA,CAAkBjD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEnF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYmC,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,cAAAA,GAA+B,CAACT,MAAAA,EAAQlD,MAAAA,GAAAA;AAC5C,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,gCAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE3E,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYoC,MAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,gBAAAA,GAAiC,CAACT,QAAAA,EAAUnD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,kCAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE7E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbiD,aAAAA,CAAsBlD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEvF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYqC,QAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,OAAO;QACL5B,KAAAA,EAAOzB,aAAAA;QACP+C,MAAAA,EAAQJ,cAAAA;QACRM,KAAAA,EAAOD,aAAAA;QACPE,OAAAA,EAASS,eAAAA;QACTR,IAAAA,EAAMS,YAAAA;QACNR,MAAAA,EAAQS,cAAAA;QACRR,QAAAA,EAAUS;AACZ,KAAA;AACF;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../src/sanitize/index.ts"],"sourcesContent":["import { CurriedFunction1 } from 'lodash';\nimport { isArray, cloneDeep, omit, pick } from 'lodash/fp';\nimport type { z } from 'zod/v4';\n\nimport { constants, getNonWritableAttributes } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\n\nimport * as visitors from './visitors';\nimport * as sanitizers from './sanitizers';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort, traverseQueryPopulate } from '../traverse';\nimport type { Model, Data } from '../types';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\nimport { hasSort } from '../sort-query';\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, removes fields that are not declared in the schema (input) or keeps only allowed query param keys (query).\n   * Defaults to false for backward compatibility.\n   * TODO: In Strapi 6, strictParams will default to true (and may be removed as an option)\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated/sanitized with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Sanitizer {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface SanitizeFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<unknown>;\n}\n\nexport type SanitizeQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport type SanitizeBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport interface APIOptions {\n  sanitizers?: Sanitizers;\n  getModel: (model: string) => Model;\n}\n\nexport interface Sanitizers {\n  input?: Sanitizer[];\n  output?: Sanitizer[];\n}\n\nconst createAPISanitizers = (opts: APIOptions) => {\n  const { getModel } = opts;\n\n  const sanitizeInput: SanitizeFunc = (\n    data: unknown,\n    schema: Model,\n    { auth, strictParams = false, route } = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeInput');\n    }\n    if (isArray(data)) {\n      return Promise.all(\n        data.map((entry) => sanitizeInput(entry, schema, { auth, strictParams, route }))\n      );\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      // Remove first level ID in inputs\n      omit(constants.ID_ATTRIBUTE),\n      omit(constants.DOC_ID_ATTRIBUTE),\n      // Remove non-writable attributes\n      traverseEntity(visitors.removeRestrictedFields(nonWritableAttributes), { schema, getModel }),\n    ];\n\n    if (strictParams) {\n      // Remove unrecognized fields (allowedExtraRootKeys = registered input param keys)\n      transforms.push(\n        traverseEntity(visitors.removeUnrecognizedFields, {\n          schema,\n          getModel,\n          allowedExtraRootKeys,\n        })\n      );\n    }\n\n    if (auth) {\n      // Remove restricted relations\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.input?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    /**\n     * For each extra root key from the route's body schema present in data, run Zod safeParse.\n     * If parsing fails, the key is removed from the output.\n     *\n     * Content-api sends the document payload as body.data; the controller calls sanitizeInput(body.data, ctx),\n     * so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n     * The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n     * the main document payload is already sanitized above by traverseEntity (removeUnrecognizedFields, etc.);\n     * relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n     * Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n     */\n    const routeBodySanitizeTransform = async (data: Data): Promise<Data> => {\n      if (!data || typeof data !== 'object' || Array.isArray(data)) return data;\n      const obj = data as Record<string, unknown>;\n      const bodySchema = route?.request?.body?.['application/json'];\n      if (bodySchema && typeof bodySchema === 'object' && 'shape' in bodySchema) {\n        const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n        for (const key of Object.keys(shape)) {\n          if (key === 'data' || !(key in obj)) continue;\n          const zodSchema = shape[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(obj[key]);\n            if (result.success) {\n              obj[key] = result.data;\n            } else {\n              delete obj[key];\n            }\n          }\n        }\n      }\n      return data;\n    };\n    (transforms as Array<(data: Data) => Data | Promise<Data>>).push(routeBodySanitizeTransform);\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeOutput: SanitizeFunc = async (data, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeOutput');\n    }\n    if (isArray(data)) {\n      const res = new Array(data.length);\n      for (let i = 0; i < data.length; i += 1) {\n        res[i] = await sanitizeOutput(data[i], schema, { auth });\n      }\n      return res;\n    }\n\n    const transforms = [\n      (data: Data) => sanitizers.defaultSanitizeOutput({ schema, getModel }, data),\n    ];\n\n    if (auth) {\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.output?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeQuery');\n    }\n    const { filters, sort, fields, populate } = query;\n\n    const sanitizedQuery = cloneDeep(query);\n\n    if ('publicationFilter' in sanitizedQuery) {\n      validatePublicationFilterQueryParam(sanitizedQuery.publicationFilter);\n    }\n\n    if (filters) {\n      Object.assign(sanitizedQuery, { filters: await sanitizeFilters(filters, schema, { auth }) });\n    }\n\n    if (hasSort(sort)) {\n      Object.assign(sanitizedQuery, { sort: await sanitizeSort(sort, schema, { auth }) });\n    } else if ('sort' in sanitizedQuery) {\n      delete sanitizedQuery.sort;\n    }\n\n    if (fields) {\n      Object.assign(sanitizedQuery, { fields: await sanitizeFields(fields, schema) });\n    }\n\n    if (populate) {\n      Object.assign(sanitizedQuery, { populate: await sanitizePopulate(populate, schema) });\n    }\n\n    const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n    const routeQuerySchema = route?.request?.query;\n    if (routeQuerySchema) {\n      for (const key of extraQueryKeys) {\n        if (key in query) {\n          const zodSchema = routeQuerySchema[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n            if (result.success) {\n              sanitizedQuery[key] = result.data;\n            } else {\n              delete sanitizedQuery[key];\n            }\n          }\n        }\n      }\n    }\n\n    if (strictParams) {\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      return pick(allowedKeys, sanitizedQuery) as Record<string, unknown>;\n    }\n\n    return sanitizedQuery;\n  };\n\n  const sanitizeFilters: SanitizeFunc = (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFilters');\n    }\n    if (isArray(filters)) {\n      return Promise.all(filters.map((filter) => sanitizeFilters(filter, schema, { auth })));\n    }\n\n    const transforms = [sanitizers.defaultSanitizeFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(filters);\n  };\n\n  const sanitizeSort: SanitizeFunc = (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeSort');\n    }\n    const transforms = [sanitizers.defaultSanitizeSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(sort);\n  };\n\n  const sanitizeFields: SanitizeFunc = (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFields');\n    }\n    const transforms = [sanitizers.defaultSanitizeFields({ schema, getModel })];\n\n    return pipeAsync(...transforms)(fields);\n  };\n\n  const sanitizePopulate: SanitizeFunc = (populate, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [sanitizers.defaultSanitizePopulate({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryPopulate(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(populate);\n  };\n\n  return {\n    input: sanitizeInput,\n    output: sanitizeOutput,\n    query: sanitizeQuery,\n    filters: sanitizeFilters,\n    sort: sanitizeSort,\n    fields: sanitizeFields,\n    populate: sanitizePopulate,\n  };\n};\n\nexport { createAPISanitizers, sanitizers, visitors };\n\nexport type APISanitiers = ReturnType<typeof createAPISanitizers>;\n"],"names":["createAPISanitizers","opts","getModel","sanitizeInput","data","schema","auth","strictParams","route","Error","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","omit","constants","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","traverseEntity","visitors","push","sanitizers","input","forEach","sanitizer","routeBodySanitizeTransform","Array","obj","bodySchema","request","body","shape","key","Object","keys","zodSchema","safeParse","result","success","pipeAsync","sanitizeOutput","res","length","i","output","sanitizeQuery","query","filters","sort","fields","populate","sanitizedQuery","cloneDeep","validatePublicationFilterQueryParam","publicationFilter","assign","sanitizeFilters","hasSort","sanitizeSort","sanitizeFields","sanitizePopulate","extraQueryKeys","getExtraQueryKeysFromRoute","routeQuerySchema","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","pick","filter","traverseQueryFilters","traverseQuerySort","traverseQueryPopulate"],"mappings":";;;;;;;;;;;;;;;;;;;;AAkEA,MAAMA,sBAAsB,CAACC,IAAAA,GAAAA;IAC3B,MAAM,EAAEC,QAAQ,EAAE,GAAGD,IAAAA;AAErB,IAAA,MAAME,aAAAA,GAA8B,CAClCC,IAAAA,EACAC,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAE,GAAG,EAAE,GAAA;AAE1C,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQN,IAAAA,CAAAA,EAAO;YACjB,OAAOO,OAAAA,CAAQC,GAAG,CAChBR,IAAAA,CAAKS,GAAG,CAAC,CAACC,KAAAA,GAAUX,aAAAA,CAAcW,KAAAA,EAAOT,MAAAA,EAAQ;AAAEC,oBAAAA,IAAAA;AAAMC,oBAAAA,YAAAA;AAAcC,oBAAAA;AAAM,iBAAA,CAAA,CAAA,CAAA;AAEjF,QAAA;AAEA,QAAA,MAAMO,uBAAuBC,mDAAAA,CAA8BR,KAAAA,CAAAA;AAE3D,QAAA,MAAMS,wBAAwBC,qCAAAA,CAAyBb,MAAAA,CAAAA;AAEvD,QAAA,MAAMc,UAAAA,GAAa;;AAEjBC,YAAAA,OAAAA,CAAKC,uBAAUC,YAAY,CAAA;AAC3BF,YAAAA,OAAAA,CAAKC,uBAAUE,gBAAgB,CAAA;;YAE/BC,cAAAA,CAAeC,sBAA+B,CAACR,qBAAAA,CAAAA,EAAwB;AAAEZ,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAC3F,SAAA;AAED,QAAA,IAAIK,YAAAA,EAAc;;AAEhBY,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,EAAE;AAChDpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAa,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAErF;;;;;;;;;;QAWA,MAAM0B,6BAA6B,OAAO3B,IAAAA,GAAAA;YACxC,IAAI,CAACA,QAAQ,OAAOA,IAAAA,KAAS,YAAY4B,KAAAA,CAAMtB,OAAO,CAACN,IAAAA,CAAAA,EAAO,OAAOA,IAAAA;AACrE,YAAA,MAAM6B,GAAAA,GAAM7B,IAAAA;AACZ,YAAA,MAAM8B,UAAAA,GAAa1B,KAAAA,EAAO2B,OAAAA,EAASC,IAAAA,GAAO,kBAAA,CAAmB;AAC7D,YAAA,IAAIF,UAAAA,IAAc,OAAOA,UAAAA,KAAe,QAAA,IAAY,WAAWA,UAAAA,EAAY;gBACzE,MAAMG,KAAAA,GAAQ,UAACH,CAAuDG,KAAK;AAC3E,gBAAA,KAAK,MAAMC,GAAAA,IAAOC,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,oBAAA,IAAIC,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOL,GAAE,CAAA,EAAI;oBACrC,MAAMQ,SAAAA,GAAYJ,KAAK,CAACC,GAAAA,CAAI;AAC5B,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACT,GAAG,CAACK,GAAAA,CAAI,CAAA;wBAC7D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBX,4BAAAA,GAAG,CAACK,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACxB,CAAA,MAAO;4BACL,OAAO6B,GAAG,CAACK,GAAAA,CAAI;AACjB,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;YACA,OAAOlC,IAAAA;AACT,QAAA,CAAA;AACCe,QAAAA,UAAAA,CAA2DO,IAAI,CAACK,0BAAAA,CAAAA;AAEjE,QAAA,OAAOc,cAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAM0C,cAAAA,GAA+B,OAAO1C,IAAAA,EAAMC,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQN,IAAAA,CAAAA,EAAO;AACjB,YAAA,MAAM2C,GAAAA,GAAM,IAAIf,KAAAA,CAAM5B,IAAAA,CAAK4C,MAAM,CAAA;YACjC,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAI7C,KAAK4C,MAAM,EAAEC,KAAK,CAAA,CAAG;gBACvCF,GAAG,CAACE,EAAE,GAAG,MAAMH,eAAe1C,IAAI,CAAC6C,CAAAA,CAAE,EAAE5C,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA;AACxD,YAAA;YACA,OAAOyC,GAAAA;AACT,QAAA;AAEA,QAAA,MAAM5B,UAAAA,GAAa;YACjB,CAACf,IAAAA,GAAeuB,gCAAgC,CAAC;AAAEtB,oBAAAA,MAAAA;AAAQH,oBAAAA;iBAAS,EAAGE,IAAAA;AACxE,SAAA;AAED,QAAA,IAAIE,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYuB,QAAQrB,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAEtF,QAAA,OAAOwC,cAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;AAEA,IAAA,MAAM+C,aAAAA,GAAgB,OACpBC,KAAAA,EACA/C,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QACA,MAAM,EAAE4C,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,KAAAA;AAE5C,QAAA,MAAMK,iBAAiBC,YAAAA,CAAUN,KAAAA,CAAAA;AAEjC,QAAA,IAAI,uBAAuBK,cAAAA,EAAgB;AACzCE,YAAAA,qDAAAA,CAAoCF,eAAeG,iBAAiB,CAAA;AACtE,QAAA;AAEA,QAAA,IAAIP,OAAAA,EAAS;YACXd,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEJ,OAAAA,EAAS,MAAMS,eAAAA,CAAgBT,OAAAA,EAAShD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AAC5F,QAAA;AAEA,QAAA,IAAIyD,kBAAQT,IAAAA,CAAAA,EAAO;YACjBf,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEH,IAAAA,EAAM,MAAMU,YAAAA,CAAaV,IAAAA,EAAMjD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;QACnF,CAAA,MAAO,IAAI,UAAUmD,cAAAA,EAAgB;AACnC,YAAA,OAAOA,eAAeH,IAAI;AAC5B,QAAA;AAEA,QAAA,IAAIC,MAAAA,EAAQ;YACVhB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEF,MAAAA,EAAQ,MAAMU,eAAeV,MAAAA,EAAQlD,MAAAA;AAAQ,aAAA,CAAA;AAC/E,QAAA;AAEA,QAAA,IAAImD,QAAAA,EAAU;YACZjB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAED,QAAAA,EAAU,MAAMU,iBAAiBV,QAAAA,EAAUnD,MAAAA;AAAQ,aAAA,CAAA;AACrF,QAAA;AAEA,QAAA,MAAM8D,iBAAiBC,gDAAAA,CAA2B5D,KAAAA,CAAAA;QAClD,MAAM6D,gBAAAA,GAAmB7D,OAAO2B,OAAAA,EAASiB,KAAAA;AACzC,QAAA,IAAIiB,gBAAAA,EAAkB;YACpB,KAAK,MAAM/B,OAAO6B,cAAAA,CAAgB;AAChC,gBAAA,IAAI7B,OAAOc,KAAAA,EAAO;oBAChB,MAAMX,SAAAA,GAAY4B,gBAAgB,CAAC/B,GAAAA,CAAI;AACvC,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACU,KAAK,CAACd,GAAAA,CAAI,CAAA;wBAC/D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBa,4BAAAA,cAAc,CAACnB,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACnC,CAAA,MAAO;4BACL,OAAOqD,cAAc,CAACnB,GAAAA,CAAI;AAC5B,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;AAEA,QAAA,IAAI/B,YAAAA,EAAc;AAChB,YAAA,MAAM+D,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,4CAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,OAAOK,QAAKF,WAAAA,EAAab,cAAAA,CAAAA;AAC3B,QAAA;QAEA,OAAOA,cAAAA;AACT,IAAA,CAAA;IAEA,MAAMK,eAAAA,GAAgC,CAACT,OAAAA,EAAShD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,WAAQ2C,OAAAA,CAAAA,EAAU;YACpB,OAAO1C,OAAAA,CAAQC,GAAG,CAACyC,OAAAA,CAAQxC,GAAG,CAAC,CAAC4D,MAAAA,GAAWX,eAAAA,CAAgBW,MAAAA,EAAQpE,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACpF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACQ,YAAAA,iCAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbgD,YAAAA,CAAqBjD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEtF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYkC,OAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,YAAAA,GAA6B,CAACV,IAAAA,EAAMjD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AACpE,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,8BAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbiD,SAAAA,CAAkBlD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEnF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYmC,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,cAAAA,GAA+B,CAACV,MAAAA,EAAQlD,MAAAA,GAAAA;AAC5C,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,gCAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE3E,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYoC,MAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,gBAAAA,GAAiC,CAACV,QAAAA,EAAUnD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,kCAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE7E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbkD,aAAAA,CAAsBnD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEvF,QAAA;AAEA,QAAA,OAAO2C,cAAa1B,UAAAA,CAAAA,CAAYqC,QAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,OAAO;QACL5B,KAAAA,EAAOzB,aAAAA;QACP+C,MAAAA,EAAQJ,cAAAA;QACRM,KAAAA,EAAOD,aAAAA;QACPE,OAAAA,EAASS,eAAAA;QACTR,IAAAA,EAAMU,YAAAA;QACNT,MAAAA,EAAQU,cAAAA;QACRT,QAAAA,EAAUU;AACZ,KAAA;AACF;;;;;;"}

package/dist/sanitize/index.mjs

@@ -14,6 +14,7 @@ import traverseQuerySort from '../traverse/query-sort.mjs';
 import traverseQueryPopulate from '../traverse/query-populate.mjs';
 import '../traverse/query-fields.mjs';
 import { validatePublicationFilterQueryParam } from '../publication-filter.mjs';
+import { hasSort } from '../sort-query.mjs';
 import removeUnrecognizedFields from './visitors/remove-unrecognized-fields.mjs';
 import removeRestrictedRelations from './visitors/remove-restricted-relations.mjs';
 import removeRestrictedFields from './visitors/remove-restricted-fields.mjs';
@@ -139,12 +140,14 @@ const createAPISanitizers = (opts)=>{
                 })
             });
         }
-        if (sort) {
+        if (hasSort(sort)) {
             Object.assign(sanitizedQuery, {
                 sort: await sanitizeSort(sort, schema, {
                     auth
                 })
             });
+        } else if ('sort' in sanitizedQuery) {
+            delete sanitizedQuery.sort;
         }
         if (fields) {
             Object.assign(sanitizedQuery, {

package/dist/sanitize/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../src/sanitize/index.ts"],"sourcesContent":["import { CurriedFunction1 } from 'lodash';\nimport { isArray, cloneDeep, omit, pick } from 'lodash/fp';\nimport type { z } from 'zod/v4';\n\nimport { constants, getNonWritableAttributes } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\n\nimport * as visitors from './visitors';\nimport * as sanitizers from './sanitizers';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort, traverseQueryPopulate } from '../traverse';\nimport type { Model, Data } from '../types';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, removes fields that are not declared in the schema (input) or keeps only allowed query param keys (query).\n   * Defaults to false for backward compatibility.\n   * TODO: In Strapi 6, strictParams will default to true (and may be removed as an option)\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated/sanitized with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Sanitizer {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface SanitizeFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<unknown>;\n}\n\nexport type SanitizeQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport type SanitizeBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport interface APIOptions {\n  sanitizers?: Sanitizers;\n  getModel: (model: string) => Model;\n}\n\nexport interface Sanitizers {\n  input?: Sanitizer[];\n  output?: Sanitizer[];\n}\n\nconst createAPISanitizers = (opts: APIOptions) => {\n  const { getModel } = opts;\n\n  const sanitizeInput: SanitizeFunc = (\n    data: unknown,\n    schema: Model,\n    { auth, strictParams = false, route } = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeInput');\n    }\n    if (isArray(data)) {\n      return Promise.all(\n        data.map((entry) => sanitizeInput(entry, schema, { auth, strictParams, route }))\n      );\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      // Remove first level ID in inputs\n      omit(constants.ID_ATTRIBUTE),\n      omit(constants.DOC_ID_ATTRIBUTE),\n      // Remove non-writable attributes\n      traverseEntity(visitors.removeRestrictedFields(nonWritableAttributes), { schema, getModel }),\n    ];\n\n    if (strictParams) {\n      // Remove unrecognized fields (allowedExtraRootKeys = registered input param keys)\n      transforms.push(\n        traverseEntity(visitors.removeUnrecognizedFields, {\n          schema,\n          getModel,\n          allowedExtraRootKeys,\n        })\n      );\n    }\n\n    if (auth) {\n      // Remove restricted relations\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.input?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    /**\n     * For each extra root key from the route's body schema present in data, run Zod safeParse.\n     * If parsing fails, the key is removed from the output.\n     *\n     * Content-api sends the document payload as body.data; the controller calls sanitizeInput(body.data, ctx),\n     * so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n     * The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n     * the main document payload is already sanitized above by traverseEntity (removeUnrecognizedFields, etc.);\n     * relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n     * Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n     */\n    const routeBodySanitizeTransform = async (data: Data): Promise<Data> => {\n      if (!data || typeof data !== 'object' || Array.isArray(data)) return data;\n      const obj = data as Record<string, unknown>;\n      const bodySchema = route?.request?.body?.['application/json'];\n      if (bodySchema && typeof bodySchema === 'object' && 'shape' in bodySchema) {\n        const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n        for (const key of Object.keys(shape)) {\n          if (key === 'data' || !(key in obj)) continue;\n          const zodSchema = shape[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(obj[key]);\n            if (result.success) {\n              obj[key] = result.data;\n            } else {\n              delete obj[key];\n            }\n          }\n        }\n      }\n      return data;\n    };\n    (transforms as Array<(data: Data) => Data | Promise<Data>>).push(routeBodySanitizeTransform);\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeOutput: SanitizeFunc = async (data, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeOutput');\n    }\n    if (isArray(data)) {\n      const res = new Array(data.length);\n      for (let i = 0; i < data.length; i += 1) {\n        res[i] = await sanitizeOutput(data[i], schema, { auth });\n      }\n      return res;\n    }\n\n    const transforms = [\n      (data: Data) => sanitizers.defaultSanitizeOutput({ schema, getModel }, data),\n    ];\n\n    if (auth) {\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.output?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeQuery');\n    }\n    const { filters, sort, fields, populate } = query;\n\n    const sanitizedQuery = cloneDeep(query);\n\n    if ('publicationFilter' in sanitizedQuery) {\n      validatePublicationFilterQueryParam(sanitizedQuery.publicationFilter);\n    }\n\n    if (filters) {\n      Object.assign(sanitizedQuery, { filters: await sanitizeFilters(filters, schema, { auth }) });\n    }\n\n    if (sort) {\n      Object.assign(sanitizedQuery, { sort: await sanitizeSort(sort, schema, { auth }) });\n    }\n\n    if (fields) {\n      Object.assign(sanitizedQuery, { fields: await sanitizeFields(fields, schema) });\n    }\n\n    if (populate) {\n      Object.assign(sanitizedQuery, { populate: await sanitizePopulate(populate, schema) });\n    }\n\n    const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n    const routeQuerySchema = route?.request?.query;\n    if (routeQuerySchema) {\n      for (const key of extraQueryKeys) {\n        if (key in query) {\n          const zodSchema = routeQuerySchema[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n            if (result.success) {\n              sanitizedQuery[key] = result.data;\n            } else {\n              delete sanitizedQuery[key];\n            }\n          }\n        }\n      }\n    }\n\n    if (strictParams) {\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      return pick(allowedKeys, sanitizedQuery) as Record<string, unknown>;\n    }\n\n    return sanitizedQuery;\n  };\n\n  const sanitizeFilters: SanitizeFunc = (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFilters');\n    }\n    if (isArray(filters)) {\n      return Promise.all(filters.map((filter) => sanitizeFilters(filter, schema, { auth })));\n    }\n\n    const transforms = [sanitizers.defaultSanitizeFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(filters);\n  };\n\n  const sanitizeSort: SanitizeFunc = (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeSort');\n    }\n    const transforms = [sanitizers.defaultSanitizeSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(sort);\n  };\n\n  const sanitizeFields: SanitizeFunc = (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFields');\n    }\n    const transforms = [sanitizers.defaultSanitizeFields({ schema, getModel })];\n\n    return pipeAsync(...transforms)(fields);\n  };\n\n  const sanitizePopulate: SanitizeFunc = (populate, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [sanitizers.defaultSanitizePopulate({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryPopulate(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(populate);\n  };\n\n  return {\n    input: sanitizeInput,\n    output: sanitizeOutput,\n    query: sanitizeQuery,\n    filters: sanitizeFilters,\n    sort: sanitizeSort,\n    fields: sanitizeFields,\n    populate: sanitizePopulate,\n  };\n};\n\nexport { createAPISanitizers, sanitizers, visitors };\n\nexport type APISanitiers = ReturnType<typeof createAPISanitizers>;\n"],"names":["createAPISanitizers","opts","getModel","sanitizeInput","data","schema","auth","strictParams","route","Error","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","omit","constants","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","traverseEntity","visitors","push","sanitizers","input","forEach","sanitizer","routeBodySanitizeTransform","Array","obj","bodySchema","request","body","shape","key","Object","keys","zodSchema","safeParse","result","success","pipeAsync","sanitizeOutput","res","length","i","output","sanitizeQuery","query","filters","sort","fields","populate","sanitizedQuery","cloneDeep","validatePublicationFilterQueryParam","publicationFilter","assign","sanitizeFilters","sanitizeSort","sanitizeFields","sanitizePopulate","extraQueryKeys","getExtraQueryKeysFromRoute","routeQuerySchema","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","pick","filter","traverseQueryFilters","traverseQuerySort","traverseQueryPopulate"],"mappings":";;;;;;;;;;;;;;;;;;;;AAiEA,MAAMA,sBAAsB,CAACC,IAAAA,GAAAA;IAC3B,MAAM,EAAEC,QAAQ,EAAE,GAAGD,IAAAA;AAErB,IAAA,MAAME,aAAAA,GAA8B,CAClCC,IAAAA,EACAC,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAE,GAAG,EAAE,GAAA;AAE1C,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQN,IAAAA,CAAAA,EAAO;YACjB,OAAOO,OAAAA,CAAQC,GAAG,CAChBR,IAAAA,CAAKS,GAAG,CAAC,CAACC,KAAAA,GAAUX,aAAAA,CAAcW,KAAAA,EAAOT,MAAAA,EAAQ;AAAEC,oBAAAA,IAAAA;AAAMC,oBAAAA,YAAAA;AAAcC,oBAAAA;AAAM,iBAAA,CAAA,CAAA,CAAA;AAEjF,QAAA;AAEA,QAAA,MAAMO,uBAAuBC,6BAAAA,CAA8BR,KAAAA,CAAAA;AAE3D,QAAA,MAAMS,wBAAwBC,wBAAAA,CAAyBb,MAAAA,CAAAA;AAEvD,QAAA,MAAMc,UAAAA,GAAa;;AAEjBC,YAAAA,IAAAA,CAAKC,UAAUC,YAAY,CAAA;AAC3BF,YAAAA,IAAAA,CAAKC,UAAUE,gBAAgB,CAAA;;YAE/BC,cAAAA,CAAeC,sBAA+B,CAACR,qBAAAA,CAAAA,EAAwB;AAAEZ,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAC3F,SAAA;AAED,QAAA,IAAIK,YAAAA,EAAc;;AAEhBY,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,EAAE;AAChDpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAa,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAErF;;;;;;;;;;QAWA,MAAM0B,6BAA6B,OAAO3B,IAAAA,GAAAA;YACxC,IAAI,CAACA,QAAQ,OAAOA,IAAAA,KAAS,YAAY4B,KAAAA,CAAMtB,OAAO,CAACN,IAAAA,CAAAA,EAAO,OAAOA,IAAAA;AACrE,YAAA,MAAM6B,GAAAA,GAAM7B,IAAAA;AACZ,YAAA,MAAM8B,UAAAA,GAAa1B,KAAAA,EAAO2B,OAAAA,EAASC,IAAAA,GAAO,kBAAA,CAAmB;AAC7D,YAAA,IAAIF,UAAAA,IAAc,OAAOA,UAAAA,KAAe,QAAA,IAAY,WAAWA,UAAAA,EAAY;gBACzE,MAAMG,KAAAA,GAAQ,UAACH,CAAuDG,KAAK;AAC3E,gBAAA,KAAK,MAAMC,GAAAA,IAAOC,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,oBAAA,IAAIC,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOL,GAAE,CAAA,EAAI;oBACrC,MAAMQ,SAAAA,GAAYJ,KAAK,CAACC,GAAAA,CAAI;AAC5B,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACT,GAAG,CAACK,GAAAA,CAAI,CAAA;wBAC7D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBX,4BAAAA,GAAG,CAACK,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACxB,CAAA,MAAO;4BACL,OAAO6B,GAAG,CAACK,GAAAA,CAAI;AACjB,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;YACA,OAAOlC,IAAAA;AACT,QAAA,CAAA;AACCe,QAAAA,UAAAA,CAA2DO,IAAI,CAACK,0BAAAA,CAAAA;AAEjE,QAAA,OAAOc,QAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAM0C,cAAAA,GAA+B,OAAO1C,IAAAA,EAAMC,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQN,IAAAA,CAAAA,EAAO;AACjB,YAAA,MAAM2C,GAAAA,GAAM,IAAIf,KAAAA,CAAM5B,IAAAA,CAAK4C,MAAM,CAAA;YACjC,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAI7C,KAAK4C,MAAM,EAAEC,KAAK,CAAA,CAAG;gBACvCF,GAAG,CAACE,EAAE,GAAG,MAAMH,eAAe1C,IAAI,CAAC6C,CAAAA,CAAE,EAAE5C,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA;AACxD,YAAA;YACA,OAAOyC,GAAAA;AACT,QAAA;AAEA,QAAA,MAAM5B,UAAAA,GAAa;YACjB,CAACf,IAAAA,GAAeuB,qBAAgC,CAAC;AAAEtB,oBAAAA,MAAAA;AAAQH,oBAAAA;iBAAS,EAAGE,IAAAA;AACxE,SAAA;AAED,QAAA,IAAIE,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYuB,QAAQrB,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAEtF,QAAA,OAAOwC,QAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;AAEA,IAAA,MAAM+C,aAAAA,GAAgB,OACpBC,KAAAA,EACA/C,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QACA,MAAM,EAAE4C,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,KAAAA;AAE5C,QAAA,MAAMK,iBAAiBC,SAAAA,CAAUN,KAAAA,CAAAA;AAEjC,QAAA,IAAI,uBAAuBK,cAAAA,EAAgB;AACzCE,YAAAA,mCAAAA,CAAoCF,eAAeG,iBAAiB,CAAA;AACtE,QAAA;AAEA,QAAA,IAAIP,OAAAA,EAAS;YACXd,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEJ,OAAAA,EAAS,MAAMS,eAAAA,CAAgBT,OAAAA,EAAShD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AAC5F,QAAA;AAEA,QAAA,IAAIgD,IAAAA,EAAM;YACRf,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEH,IAAAA,EAAM,MAAMS,YAAAA,CAAaT,IAAAA,EAAMjD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AACnF,QAAA;AAEA,QAAA,IAAIiD,MAAAA,EAAQ;YACVhB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEF,MAAAA,EAAQ,MAAMS,eAAeT,MAAAA,EAAQlD,MAAAA;AAAQ,aAAA,CAAA;AAC/E,QAAA;AAEA,QAAA,IAAImD,QAAAA,EAAU;YACZjB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAED,QAAAA,EAAU,MAAMS,iBAAiBT,QAAAA,EAAUnD,MAAAA;AAAQ,aAAA,CAAA;AACrF,QAAA;AAEA,QAAA,MAAM6D,iBAAiBC,0BAAAA,CAA2B3D,KAAAA,CAAAA;QAClD,MAAM4D,gBAAAA,GAAmB5D,OAAO2B,OAAAA,EAASiB,KAAAA;AACzC,QAAA,IAAIgB,gBAAAA,EAAkB;YACpB,KAAK,MAAM9B,OAAO4B,cAAAA,CAAgB;AAChC,gBAAA,IAAI5B,OAAOc,KAAAA,EAAO;oBAChB,MAAMX,SAAAA,GAAY2B,gBAAgB,CAAC9B,GAAAA,CAAI;AACvC,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACU,KAAK,CAACd,GAAAA,CAAI,CAAA;wBAC/D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBa,4BAAAA,cAAc,CAACnB,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACnC,CAAA,MAAO;4BACL,OAAOqD,cAAc,CAACnB,GAAAA,CAAI;AAC5B,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;AAEA,QAAA,IAAI/B,YAAAA,EAAc;AAChB,YAAA,MAAM8D,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,wBAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,OAAOK,KAAKF,WAAAA,EAAaZ,cAAAA,CAAAA;AAC3B,QAAA;QAEA,OAAOA,cAAAA;AACT,IAAA,CAAA;IAEA,MAAMK,eAAAA,GAAgC,CAACT,OAAAA,EAAShD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQ2C,OAAAA,CAAAA,EAAU;YACpB,OAAO1C,OAAAA,CAAQC,GAAG,CAACyC,OAAAA,CAAQxC,GAAG,CAAC,CAAC2D,MAAAA,GAAWV,eAAAA,CAAgBU,MAAAA,EAAQnE,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACpF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACQ,YAAAA,sBAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACb+C,oBAAAA,CAAqBhD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEtF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYkC,OAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,YAAAA,GAA6B,CAACT,IAAAA,EAAMjD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AACpE,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,mBAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbgD,iBAAAA,CAAkBjD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEnF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYmC,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,cAAAA,GAA+B,CAACT,MAAAA,EAAQlD,MAAAA,GAAAA;AAC5C,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,qBAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE3E,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYoC,MAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMU,gBAAAA,GAAiC,CAACT,QAAAA,EAAUnD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,uBAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE7E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbiD,qBAAAA,CAAsBlD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEvF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYqC,QAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,OAAO;QACL5B,KAAAA,EAAOzB,aAAAA;QACP+C,MAAAA,EAAQJ,cAAAA;QACRM,KAAAA,EAAOD,aAAAA;QACPE,OAAAA,EAASS,eAAAA;QACTR,IAAAA,EAAMS,YAAAA;QACNR,MAAAA,EAAQS,cAAAA;QACRR,QAAAA,EAAUS;AACZ,KAAA;AACF;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../src/sanitize/index.ts"],"sourcesContent":["import { CurriedFunction1 } from 'lodash';\nimport { isArray, cloneDeep, omit, pick } from 'lodash/fp';\nimport type { z } from 'zod/v4';\n\nimport { constants, getNonWritableAttributes } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\n\nimport * as visitors from './visitors';\nimport * as sanitizers from './sanitizers';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort, traverseQueryPopulate } from '../traverse';\nimport type { Model, Data } from '../types';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\nimport { hasSort } from '../sort-query';\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, removes fields that are not declared in the schema (input) or keeps only allowed query param keys (query).\n   * Defaults to false for backward compatibility.\n   * TODO: In Strapi 6, strictParams will default to true (and may be removed as an option)\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated/sanitized with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Sanitizer {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface SanitizeFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<unknown>;\n}\n\nexport type SanitizeQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport type SanitizeBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<unknown>;\n\nexport interface APIOptions {\n  sanitizers?: Sanitizers;\n  getModel: (model: string) => Model;\n}\n\nexport interface Sanitizers {\n  input?: Sanitizer[];\n  output?: Sanitizer[];\n}\n\nconst createAPISanitizers = (opts: APIOptions) => {\n  const { getModel } = opts;\n\n  const sanitizeInput: SanitizeFunc = (\n    data: unknown,\n    schema: Model,\n    { auth, strictParams = false, route } = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeInput');\n    }\n    if (isArray(data)) {\n      return Promise.all(\n        data.map((entry) => sanitizeInput(entry, schema, { auth, strictParams, route }))\n      );\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      // Remove first level ID in inputs\n      omit(constants.ID_ATTRIBUTE),\n      omit(constants.DOC_ID_ATTRIBUTE),\n      // Remove non-writable attributes\n      traverseEntity(visitors.removeRestrictedFields(nonWritableAttributes), { schema, getModel }),\n    ];\n\n    if (strictParams) {\n      // Remove unrecognized fields (allowedExtraRootKeys = registered input param keys)\n      transforms.push(\n        traverseEntity(visitors.removeUnrecognizedFields, {\n          schema,\n          getModel,\n          allowedExtraRootKeys,\n        })\n      );\n    }\n\n    if (auth) {\n      // Remove restricted relations\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.input?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    /**\n     * For each extra root key from the route's body schema present in data, run Zod safeParse.\n     * If parsing fails, the key is removed from the output.\n     *\n     * Content-api sends the document payload as body.data; the controller calls sanitizeInput(body.data, ctx),\n     * so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n     * The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n     * the main document payload is already sanitized above by traverseEntity (removeUnrecognizedFields, etc.);\n     * relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n     * Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n     */\n    const routeBodySanitizeTransform = async (data: Data): Promise<Data> => {\n      if (!data || typeof data !== 'object' || Array.isArray(data)) return data;\n      const obj = data as Record<string, unknown>;\n      const bodySchema = route?.request?.body?.['application/json'];\n      if (bodySchema && typeof bodySchema === 'object' && 'shape' in bodySchema) {\n        const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n        for (const key of Object.keys(shape)) {\n          if (key === 'data' || !(key in obj)) continue;\n          const zodSchema = shape[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(obj[key]);\n            if (result.success) {\n              obj[key] = result.data;\n            } else {\n              delete obj[key];\n            }\n          }\n        }\n      }\n      return data;\n    };\n    (transforms as Array<(data: Data) => Data | Promise<Data>>).push(routeBodySanitizeTransform);\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeOutput: SanitizeFunc = async (data, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeOutput');\n    }\n    if (isArray(data)) {\n      const res = new Array(data.length);\n      for (let i = 0; i < data.length; i += 1) {\n        res[i] = await sanitizeOutput(data[i], schema, { auth });\n      }\n      return res;\n    }\n\n    const transforms = [\n      (data: Data) => sanitizers.defaultSanitizeOutput({ schema, getModel }, data),\n    ];\n\n    if (auth) {\n      transforms.push(\n        traverseEntity(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    // Apply sanitizers from registry if exists\n    opts?.sanitizers?.output?.forEach((sanitizer: Sanitizer) => transforms.push(sanitizer(schema)));\n\n    return pipeAsync(...transforms)(data as Data);\n  };\n\n  const sanitizeQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeQuery');\n    }\n    const { filters, sort, fields, populate } = query;\n\n    const sanitizedQuery = cloneDeep(query);\n\n    if ('publicationFilter' in sanitizedQuery) {\n      validatePublicationFilterQueryParam(sanitizedQuery.publicationFilter);\n    }\n\n    if (filters) {\n      Object.assign(sanitizedQuery, { filters: await sanitizeFilters(filters, schema, { auth }) });\n    }\n\n    if (hasSort(sort)) {\n      Object.assign(sanitizedQuery, { sort: await sanitizeSort(sort, schema, { auth }) });\n    } else if ('sort' in sanitizedQuery) {\n      delete sanitizedQuery.sort;\n    }\n\n    if (fields) {\n      Object.assign(sanitizedQuery, { fields: await sanitizeFields(fields, schema) });\n    }\n\n    if (populate) {\n      Object.assign(sanitizedQuery, { populate: await sanitizePopulate(populate, schema) });\n    }\n\n    const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n    const routeQuerySchema = route?.request?.query;\n    if (routeQuerySchema) {\n      for (const key of extraQueryKeys) {\n        if (key in query) {\n          const zodSchema = routeQuerySchema[key];\n          if (zodSchema && typeof (zodSchema as z.ZodTypeAny).safeParse === 'function') {\n            const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n            if (result.success) {\n              sanitizedQuery[key] = result.data;\n            } else {\n              delete sanitizedQuery[key];\n            }\n          }\n        }\n      }\n    }\n\n    if (strictParams) {\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      return pick(allowedKeys, sanitizedQuery) as Record<string, unknown>;\n    }\n\n    return sanitizedQuery;\n  };\n\n  const sanitizeFilters: SanitizeFunc = (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFilters');\n    }\n    if (isArray(filters)) {\n      return Promise.all(filters.map((filter) => sanitizeFilters(filter, schema, { auth })));\n    }\n\n    const transforms = [sanitizers.defaultSanitizeFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(filters);\n  };\n\n  const sanitizeSort: SanitizeFunc = (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeSort');\n    }\n    const transforms = [sanitizers.defaultSanitizeSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(sort);\n  };\n\n  const sanitizeFields: SanitizeFunc = (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizeFields');\n    }\n    const transforms = [sanitizers.defaultSanitizeFields({ schema, getModel })];\n\n    return pipeAsync(...transforms)(fields);\n  };\n\n  const sanitizePopulate: SanitizeFunc = (populate, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [sanitizers.defaultSanitizePopulate({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryPopulate(visitors.removeRestrictedRelations(auth), { schema, getModel })\n      );\n    }\n\n    return pipeAsync(...transforms)(populate);\n  };\n\n  return {\n    input: sanitizeInput,\n    output: sanitizeOutput,\n    query: sanitizeQuery,\n    filters: sanitizeFilters,\n    sort: sanitizeSort,\n    fields: sanitizeFields,\n    populate: sanitizePopulate,\n  };\n};\n\nexport { createAPISanitizers, sanitizers, visitors };\n\nexport type APISanitiers = ReturnType<typeof createAPISanitizers>;\n"],"names":["createAPISanitizers","opts","getModel","sanitizeInput","data","schema","auth","strictParams","route","Error","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","omit","constants","ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","traverseEntity","visitors","push","sanitizers","input","forEach","sanitizer","routeBodySanitizeTransform","Array","obj","bodySchema","request","body","shape","key","Object","keys","zodSchema","safeParse","result","success","pipeAsync","sanitizeOutput","res","length","i","output","sanitizeQuery","query","filters","sort","fields","populate","sanitizedQuery","cloneDeep","validatePublicationFilterQueryParam","publicationFilter","assign","sanitizeFilters","hasSort","sanitizeSort","sanitizeFields","sanitizePopulate","extraQueryKeys","getExtraQueryKeysFromRoute","routeQuerySchema","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","pick","filter","traverseQueryFilters","traverseQuerySort","traverseQueryPopulate"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAkEA,MAAMA,sBAAsB,CAACC,IAAAA,GAAAA;IAC3B,MAAM,EAAEC,QAAQ,EAAE,GAAGD,IAAAA;AAErB,IAAA,MAAME,aAAAA,GAA8B,CAClCC,IAAAA,EACAC,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAE,GAAG,EAAE,GAAA;AAE1C,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQN,IAAAA,CAAAA,EAAO;YACjB,OAAOO,OAAAA,CAAQC,GAAG,CAChBR,IAAAA,CAAKS,GAAG,CAAC,CAACC,KAAAA,GAAUX,aAAAA,CAAcW,KAAAA,EAAOT,MAAAA,EAAQ;AAAEC,oBAAAA,IAAAA;AAAMC,oBAAAA,YAAAA;AAAcC,oBAAAA;AAAM,iBAAA,CAAA,CAAA,CAAA;AAEjF,QAAA;AAEA,QAAA,MAAMO,uBAAuBC,6BAAAA,CAA8BR,KAAAA,CAAAA;AAE3D,QAAA,MAAMS,wBAAwBC,wBAAAA,CAAyBb,MAAAA,CAAAA;AAEvD,QAAA,MAAMc,UAAAA,GAAa;;AAEjBC,YAAAA,IAAAA,CAAKC,UAAUC,YAAY,CAAA;AAC3BF,YAAAA,IAAAA,CAAKC,UAAUE,gBAAgB,CAAA;;YAE/BC,cAAAA,CAAeC,sBAA+B,CAACR,qBAAAA,CAAAA,EAAwB;AAAEZ,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAC3F,SAAA;AAED,QAAA,IAAIK,YAAAA,EAAc;;AAEhBY,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,EAAE;AAChDpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAa,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;AAEA,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAErF;;;;;;;;;;QAWA,MAAM0B,6BAA6B,OAAO3B,IAAAA,GAAAA;YACxC,IAAI,CAACA,QAAQ,OAAOA,IAAAA,KAAS,YAAY4B,KAAAA,CAAMtB,OAAO,CAACN,IAAAA,CAAAA,EAAO,OAAOA,IAAAA;AACrE,YAAA,MAAM6B,GAAAA,GAAM7B,IAAAA;AACZ,YAAA,MAAM8B,UAAAA,GAAa1B,KAAAA,EAAO2B,OAAAA,EAASC,IAAAA,GAAO,kBAAA,CAAmB;AAC7D,YAAA,IAAIF,UAAAA,IAAc,OAAOA,UAAAA,KAAe,QAAA,IAAY,WAAWA,UAAAA,EAAY;gBACzE,MAAMG,KAAAA,GAAQ,UAACH,CAAuDG,KAAK;AAC3E,gBAAA,KAAK,MAAMC,GAAAA,IAAOC,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,oBAAA,IAAIC,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOL,GAAE,CAAA,EAAI;oBACrC,MAAMQ,SAAAA,GAAYJ,KAAK,CAACC,GAAAA,CAAI;AAC5B,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACT,GAAG,CAACK,GAAAA,CAAI,CAAA;wBAC7D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBX,4BAAAA,GAAG,CAACK,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACxB,CAAA,MAAO;4BACL,OAAO6B,GAAG,CAACK,GAAAA,CAAI;AACjB,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;YACA,OAAOlC,IAAAA;AACT,QAAA,CAAA;AACCe,QAAAA,UAAAA,CAA2DO,IAAI,CAACK,0BAAAA,CAAAA;AAEjE,QAAA,OAAOc,QAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAM0C,cAAAA,GAA+B,OAAO1C,IAAAA,EAAMC,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQN,IAAAA,CAAAA,EAAO;AACjB,YAAA,MAAM2C,GAAAA,GAAM,IAAIf,KAAAA,CAAM5B,IAAAA,CAAK4C,MAAM,CAAA;YACjC,IAAK,IAAIC,IAAI,CAAA,EAAGA,CAAAA,GAAI7C,KAAK4C,MAAM,EAAEC,KAAK,CAAA,CAAG;gBACvCF,GAAG,CAACE,EAAE,GAAG,MAAMH,eAAe1C,IAAI,CAAC6C,CAAAA,CAAE,EAAE5C,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA;AACxD,YAAA;YACA,OAAOyC,GAAAA;AACT,QAAA;AAEA,QAAA,MAAM5B,UAAAA,GAAa;YACjB,CAACf,IAAAA,GAAeuB,qBAAgC,CAAC;AAAEtB,oBAAAA,MAAAA;AAAQH,oBAAAA;iBAAS,EAAGE,IAAAA;AACxE,SAAA;AAED,QAAA,IAAIE,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbF,cAAAA,CAAeC,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEhF,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYuB,QAAQrB,OAAAA,CAAQ,CAACC,YAAyBX,UAAAA,CAAWO,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;AAEtF,QAAA,OAAOwC,QAAa1B,UAAAA,CAAAA,CAAYf,IAAAA,CAAAA;AAClC,IAAA,CAAA;AAEA,IAAA,MAAM+C,aAAAA,GAAgB,OACpBC,KAAAA,EACA/C,MAAAA,EACA,EAAEC,IAAI,EAAEC,YAAAA,GAAe,KAAK,EAAEC,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QACA,MAAM,EAAE4C,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGJ,KAAAA;AAE5C,QAAA,MAAMK,iBAAiBC,SAAAA,CAAUN,KAAAA,CAAAA;AAEjC,QAAA,IAAI,uBAAuBK,cAAAA,EAAgB;AACzCE,YAAAA,mCAAAA,CAAoCF,eAAeG,iBAAiB,CAAA;AACtE,QAAA;AAEA,QAAA,IAAIP,OAAAA,EAAS;YACXd,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEJ,OAAAA,EAAS,MAAMS,eAAAA,CAAgBT,OAAAA,EAAShD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;AAC5F,QAAA;AAEA,QAAA,IAAIyD,QAAQT,IAAAA,CAAAA,EAAO;YACjBf,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEH,IAAAA,EAAM,MAAMU,YAAAA,CAAaV,IAAAA,EAAMjD,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA;AAAG,aAAA,CAAA;QACnF,CAAA,MAAO,IAAI,UAAUmD,cAAAA,EAAgB;AACnC,YAAA,OAAOA,eAAeH,IAAI;AAC5B,QAAA;AAEA,QAAA,IAAIC,MAAAA,EAAQ;YACVhB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAEF,MAAAA,EAAQ,MAAMU,eAAeV,MAAAA,EAAQlD,MAAAA;AAAQ,aAAA,CAAA;AAC/E,QAAA;AAEA,QAAA,IAAImD,QAAAA,EAAU;YACZjB,MAAAA,CAAOsB,MAAM,CAACJ,cAAAA,EAAgB;gBAAED,QAAAA,EAAU,MAAMU,iBAAiBV,QAAAA,EAAUnD,MAAAA;AAAQ,aAAA,CAAA;AACrF,QAAA;AAEA,QAAA,MAAM8D,iBAAiBC,0BAAAA,CAA2B5D,KAAAA,CAAAA;QAClD,MAAM6D,gBAAAA,GAAmB7D,OAAO2B,OAAAA,EAASiB,KAAAA;AACzC,QAAA,IAAIiB,gBAAAA,EAAkB;YACpB,KAAK,MAAM/B,OAAO6B,cAAAA,CAAgB;AAChC,gBAAA,IAAI7B,OAAOc,KAAAA,EAAO;oBAChB,MAAMX,SAAAA,GAAY4B,gBAAgB,CAAC/B,GAAAA,CAAI;AACvC,oBAAA,IAAIG,aAAa,OAAQA,SAAAA,CAA2BC,SAAS,KAAK,UAAA,EAAY;AAC5E,wBAAA,MAAMC,SAAS,SAACF,CAA2BC,SAAS,CAACU,KAAK,CAACd,GAAAA,CAAI,CAAA;wBAC/D,IAAIK,MAAAA,CAAOC,OAAO,EAAE;AAClBa,4BAAAA,cAAc,CAACnB,GAAAA,CAAI,GAAGK,MAAAA,CAAOvC,IAAI;wBACnC,CAAA,MAAO;4BACL,OAAOqD,cAAc,CAACnB,GAAAA,CAAI;AAC5B,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;AAEA,QAAA,IAAI/B,YAAAA,EAAc;AAChB,YAAA,MAAM+D,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,wBAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,OAAOK,KAAKF,WAAAA,EAAab,cAAAA,CAAAA;AAC3B,QAAA;QAEA,OAAOA,cAAAA;AACT,IAAA,CAAA;IAEA,MAAMK,eAAAA,GAAgC,CAACT,OAAAA,EAAShD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;AACA,QAAA,IAAIC,QAAQ2C,OAAAA,CAAAA,EAAU;YACpB,OAAO1C,OAAAA,CAAQC,GAAG,CAACyC,OAAAA,CAAQxC,GAAG,CAAC,CAAC4D,MAAAA,GAAWX,eAAAA,CAAgBW,MAAAA,EAAQpE,MAAAA,EAAQ;AAAEC,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACpF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACQ,YAAAA,sBAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbgD,oBAAAA,CAAqBjD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEtF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYkC,OAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,YAAAA,GAA6B,CAACV,IAAAA,EAAMjD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AACpE,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,mBAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbiD,iBAAAA,CAAkBlD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEnF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYmC,IAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,cAAAA,GAA+B,CAACV,MAAAA,EAAQlD,MAAAA,GAAAA;AAC5C,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,qBAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE3E,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYoC,MAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,MAAMW,gBAAAA,GAAiC,CAACV,QAAAA,EAAUnD,MAAAA,EAAe,EAAEC,IAAI,EAAE,GAAG,EAAE,GAAA;AAC5E,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMU,UAAAA,GAAa;AAACQ,YAAAA,uBAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE7E,QAAA,IAAII,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWO,IAAI,CACbkD,qBAAAA,CAAsBnD,yBAAkC,CAACnB,IAAAA,CAAAA,EAAO;AAAED,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA,CAAA;AAEvF,QAAA;AAEA,QAAA,OAAO2C,QAAa1B,UAAAA,CAAAA,CAAYqC,QAAAA,CAAAA;AAClC,IAAA,CAAA;IAEA,OAAO;QACL5B,KAAAA,EAAOzB,aAAAA;QACP+C,MAAAA,EAAQJ,cAAAA;QACRM,KAAAA,EAAOD,aAAAA;QACPE,OAAAA,EAASS,eAAAA;QACTR,IAAAA,EAAMU,YAAAA;QACNT,MAAAA,EAAQU,cAAAA;QACRT,QAAAA,EAAUU;AACZ,KAAA;AACF;;;;"}

package/dist/sanitize/sanitizers.d.ts

@@ -1,4 +1,3 @@
-/// <reference types="lodash" />
 import type { Model, Data } from '../types';
 import type { Parent } from '../traverse/factory';
 interface Context {

package/dist/sanitize/sanitizers.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sanitizers.d.ts","sourceRoot":"","sources":["../../src/sanitize/sanitizers.ts"],"names":[],"mappings":";AAsBA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,UAAU,OAAO;IACf,MAAM,EAAE,KAAK,CAAC;IACd,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,QAAA,MAAM,iBAAiB,QAAS,OAAO,cAAoB,IAAI,kBAM9D,CAAC;AAEF,QAAA,MAAM,qBAAqB,QAAe,OAAO,UAAU,IAAI,kBAa9D,CAAC;AAEF,QAAA,MAAM,sBAAsB,uEAsC1B,CAAC;AAEH,QAAA,MAAM,mBAAmB,uEAuCvB,CAAC;AAEH,QAAA,MAAM,qBAAqB,uEAyBzB,CAAC;AAEH,QAAA,MAAM,uBAAuB,uEAiC3B,CAAC;AAEH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,CAAC"}
+{"version":3,"file":"sanitizers.d.ts","sourceRoot":"","sources":["../../src/sanitize/sanitizers.ts"],"names":[],"mappings":"AAsBA,OAAO,KAAK,EAAE,KAAK,EAAE,IAAI,EAAE,MAAM,UAAU,CAAC;AAC5C,OAAO,KAAK,EAAE,MAAM,EAAE,MAAM,qBAAqB,CAAC;AAElD,UAAU,OAAO;IACf,MAAM,EAAE,KAAK,CAAC;IACd,QAAQ,EAAE,CAAC,KAAK,EAAE,MAAM,KAAK,KAAK,CAAC;IACnC,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB;AAID,QAAA,MAAM,iBAAiB,GAAI,KAAK,OAAO,MAAY,QAAQ,IAAI,kBAM9D,CAAC;AAEF,QAAA,MAAM,qBAAqB,GAAU,KAAK,OAAO,EAAE,QAAQ,IAAI,kBAa9D,CAAC;AAEF,QAAA,MAAM,sBAAsB,uEAsC1B,CAAC;AAEH,QAAA,MAAM,mBAAmB,uEAuCvB,CAAC;AAEH,QAAA,MAAM,qBAAqB,uEAyBzB,CAAC;AAEH,QAAA,MAAM,uBAAuB,uEAiC3B,CAAC;AAEH,OAAO,EACL,iBAAiB,EACjB,qBAAqB,EACrB,sBAAsB,EACtB,mBAAmB,EACnB,qBAAqB,EACrB,uBAAuB,GACxB,CAAC"}

package/dist/sanitize/visitors/remove-disallowed-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-disallowed-fields.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-disallowed-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;yCAEvB,MAAM,EAAE,GAAG,IAAI,KAAU,OAAO;AAA/D,wBAoEI"}
+{"version":3,"file":"remove-disallowed-fields.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-disallowed-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;yBAEtC,gBAAe,MAAM,EAAE,GAAG,IAAW,KAAG,OAAO;AAA/D,wBAoEI"}

package/dist/sanitize/visitors/remove-restricted-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-restricted-fields.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-restricted-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;4CAEpB,MAAM,EAAE,GAAG,IAAI,KAAU,OAAO;AAAlE,wBA4BI"}
+{"version":3,"file":"remove-restricted-fields.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-restricted-fields.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;yBAEtC,mBAAkB,MAAM,EAAE,GAAG,IAAW,KAAG,OAAO;AAAlE,wBA4BI"}

package/dist/sanitize/visitors/remove-restricted-relations.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"remove-restricted-relations.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-restricted-relations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;+BAShC,OAAO,KAAG,OAAO;AAAvC,wBA0HI"}
+{"version":3,"file":"remove-restricted-relations.d.ts","sourceRoot":"","sources":["../../../src/sanitize/visitors/remove-restricted-relations.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,OAAO,EAAE,MAAM,wBAAwB,CAAC;yBAStC,MAAM,OAAO,KAAG,OAAO;AAAvC,wBA0HI"}

package/dist/security.d.ts

@@ -17,7 +17,7 @@ export declare const extendMiddlewareConfiguration: (middlewares: (string | {
     name: string;
     config?: any;
 }) => (string | {
-    name?: string | undefined;
+    name?: string;
     config?: any;
 })[];
 //# sourceMappingURL=security.d.ts.map

package/dist/security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,gBAC3B,CAAC,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,EAAE,cAC7C;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,CAAA;CAAE;;aADO,GAAG;IAyBrD,CAAC"}
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../src/security.ts"],"names":[],"mappings":"AAEA,eAAO,MAAM,YAAY;;;;CAIf,CAAC;AAEX;;;;;;GAMG;AACH,eAAO,MAAM,6BAA6B,GACxC,aAAa,CAAC,MAAM,GAAG;IAAE,IAAI,CAAC,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,CAAA;CAAE,CAAC,EAAE,EACzD,YAAY;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,MAAM,CAAC,EAAE,GAAG,CAAA;CAAE;WADV,MAAM;aAAW,GAAG;IAyBrD,CAAC"}

package/dist/sessions.d.ts

@@ -0,0 +1,35 @@
+export interface SessionEntryLike {
+    sessionId: string;
+    deviceId?: string;
+    createdAt?: Date | string | null;
+    metadata?: Record<string, unknown> | null;
+}
+export interface SanitizedSessionEntry {
+    id: string;
+    deviceId?: string;
+    deviceName?: string;
+    current: boolean;
+    loginAt?: string;
+    lastActiveAt?: string;
+}
+export interface SessionDisplayEntry {
+    current: boolean;
+    lastActiveAt?: string;
+}
+/**
+ * Sanitizes a session record for client consumption (active devices UI/API).
+ * Never includes tokens or internal database identifiers.
+ */
+export declare const sanitizeSessionEntry: (session: SessionEntryLike, currentSessionId?: string) => SanitizedSessionEntry;
+/**
+ * Builds origin-defined session metadata from generic request context fields.
+ */
+export declare const buildSessionMetadata: (params: {
+    userAgent?: string | null;
+    loginAt?: string;
+}) => Record<string, unknown>;
+/**
+ * Sorts sessions for display: current session first, then most recently used.
+ */
+export declare const sortSessionsForDisplay: <T extends SessionDisplayEntry>(sessions: T[]) => T[];
+//# sourceMappingURL=sessions.d.ts.map

package/dist/sessions.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.d.ts","sourceRoot":"","sources":["../src/sessions.ts"],"names":[],"mappings":"AAEA,MAAM,WAAW,gBAAgB;IAC/B,SAAS,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,SAAS,CAAC,EAAE,IAAI,GAAG,MAAM,GAAG,IAAI,CAAC;IACjC,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,IAAI,CAAC;CAC3C;AAED,MAAM,WAAW,qBAAqB;IACpC,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAC;IACjB,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB;AAED;;;GAGG;AACH,eAAO,MAAM,oBAAoB,GAC/B,SAAS,gBAAgB,EACzB,mBAAmB,MAAM,KACxB,qBAaF,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,oBAAoB,GAAI,QAAQ;IAC3C,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,KAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAOzB,CAAC;AAEF;;GAEG;AACH,eAAO,MAAM,sBAAsB,GAAI,CAAC,SAAS,mBAAmB,EAAE,UAAU,CAAC,EAAE,KAAG,CAAC,EAOnF,CAAC"}

package/dist/sessions.js

@@ -0,0 +1,46 @@
+'use strict';
+
+var userAgent = require('./user-agent.js');
+
+/**
+ * Sanitizes a session record for client consumption (active devices UI/API).
+ * Never includes tokens or internal database identifiers.
+ */ const sanitizeSessionEntry = (session, currentSessionId)=>{
+    const metadata = session.metadata ?? {};
+    return {
+        id: session.sessionId,
+        deviceId: session.deviceId,
+        deviceName: typeof metadata.deviceName === 'string' ? metadata.deviceName : undefined,
+        current: Boolean(currentSessionId) && session.sessionId === currentSessionId,
+        loginAt: typeof metadata.loginAt === 'string' ? metadata.loginAt : undefined,
+        // The active record is re-created on each rotation, so its creation time is the
+        // best available "last used" signal without an extra write per request.
+        lastActiveAt: session.createdAt ? new Date(session.createdAt).toISOString() : undefined
+    };
+};
+/**
+ * Builds origin-defined session metadata from generic request context fields.
+ */ const buildSessionMetadata = (params)=>{
+    const deviceName = userAgent.getDeviceName(params.userAgent);
+    return {
+        loginAt: params.loginAt ?? new Date().toISOString(),
+        ...deviceName ? {
+            deviceName
+        } : {}
+    };
+};
+/**
+ * Sorts sessions for display: current session first, then most recently used.
+ */ const sortSessionsForDisplay = (sessions)=>[
+        ...sessions
+    ].sort((a, b)=>{
+        if (a.current !== b.current) {
+            return a.current ? -1 : 1;
+        }
+        return (b.lastActiveAt ?? '').localeCompare(a.lastActiveAt ?? '');
+    });
+
+exports.buildSessionMetadata = buildSessionMetadata;
+exports.sanitizeSessionEntry = sanitizeSessionEntry;
+exports.sortSessionsForDisplay = sortSessionsForDisplay;
+//# sourceMappingURL=sessions.js.map

package/dist/sessions.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.js","sources":["../src/sessions.ts"],"sourcesContent":["import { getDeviceName } from './user-agent';\n\nexport interface SessionEntryLike {\n  sessionId: string;\n  deviceId?: string;\n  createdAt?: Date | string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface SanitizedSessionEntry {\n  id: string;\n  deviceId?: string;\n  deviceName?: string;\n  current: boolean;\n  loginAt?: string;\n  lastActiveAt?: string;\n}\n\nexport interface SessionDisplayEntry {\n  current: boolean;\n  lastActiveAt?: string;\n}\n\n/**\n * Sanitizes a session record for client consumption (active devices UI/API).\n * Never includes tokens or internal database identifiers.\n */\nexport const sanitizeSessionEntry = (\n  session: SessionEntryLike,\n  currentSessionId?: string\n): SanitizedSessionEntry => {\n  const metadata = session.metadata ?? {};\n\n  return {\n    id: session.sessionId,\n    deviceId: session.deviceId,\n    deviceName: typeof metadata.deviceName === 'string' ? metadata.deviceName : undefined,\n    current: Boolean(currentSessionId) && session.sessionId === currentSessionId,\n    loginAt: typeof metadata.loginAt === 'string' ? metadata.loginAt : undefined,\n    // The active record is re-created on each rotation, so its creation time is the\n    // best available \"last used\" signal without an extra write per request.\n    lastActiveAt: session.createdAt ? new Date(session.createdAt).toISOString() : undefined,\n  };\n};\n\n/**\n * Builds origin-defined session metadata from generic request context fields.\n */\nexport const buildSessionMetadata = (params: {\n  userAgent?: string | null;\n  loginAt?: string;\n}): Record<string, unknown> => {\n  const deviceName = getDeviceName(params.userAgent);\n\n  return {\n    loginAt: params.loginAt ?? new Date().toISOString(),\n    ...(deviceName ? { deviceName } : {}),\n  };\n};\n\n/**\n * Sorts sessions for display: current session first, then most recently used.\n */\nexport const sortSessionsForDisplay = <T extends SessionDisplayEntry>(sessions: T[]): T[] =>\n  [...sessions].sort((a, b) => {\n    if (a.current !== b.current) {\n      return a.current ? -1 : 1;\n    }\n\n    return (b.lastActiveAt ?? '').localeCompare(a.lastActiveAt ?? '');\n  });\n"],"names":["sanitizeSessionEntry","session","currentSessionId","metadata","id","sessionId","deviceId","deviceName","undefined","current","Boolean","loginAt","lastActiveAt","createdAt","Date","toISOString","buildSessionMetadata","params","getDeviceName","userAgent","sortSessionsForDisplay","sessions","sort","a","b","localeCompare"],"mappings":";;;;AAuBA;;;AAGC,IACM,MAAMA,oBAAAA,GAAuB,CAClCC,OAAAA,EACAC,gBAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAWF,OAAAA,CAAQE,QAAQ,IAAI,EAAC;IAEtC,OAAO;AACLC,QAAAA,EAAAA,EAAIH,QAAQI,SAAS;AACrBC,QAAAA,QAAAA,EAAUL,QAAQK,QAAQ;AAC1BC,QAAAA,UAAAA,EAAY,OAAOJ,QAAAA,CAASI,UAAU,KAAK,QAAA,GAAWJ,QAAAA,CAASI,UAAU,GAAGC,SAAAA;AAC5EC,QAAAA,OAAAA,EAASC,OAAAA,CAAQR,gBAAAA,CAAAA,IAAqBD,OAAAA,CAAQI,SAAS,KAAKH,gBAAAA;AAC5DS,QAAAA,OAAAA,EAAS,OAAOR,QAAAA,CAASQ,OAAO,KAAK,QAAA,GAAWR,QAAAA,CAASQ,OAAO,GAAGH,SAAAA;;;QAGnEI,YAAAA,EAAcX,OAAAA,CAAQY,SAAS,GAAG,IAAIC,KAAKb,OAAAA,CAAQY,SAAS,CAAA,CAAEE,WAAW,EAAA,GAAKP;AAChF,KAAA;AACF;AAEA;;IAGO,MAAMQ,oBAAAA,GAAuB,CAACC,MAAAA,GAAAA;IAInC,MAAMV,UAAAA,GAAaW,uBAAAA,CAAcD,MAAAA,CAAOE,SAAS,CAAA;IAEjD,OAAO;AACLR,QAAAA,OAAAA,EAASM,MAAAA,CAAON,OAAO,IAAI,IAAIG,OAAOC,WAAW,EAAA;AACjD,QAAA,GAAIR,UAAAA,GAAa;AAAEA,YAAAA;AAAW,SAAA,GAAI;AACpC,KAAA;AACF;AAEA;;AAEC,IACM,MAAMa,sBAAAA,GAAyB,CAAgCC,QAAAA,GACpE;AAAIA,QAAAA,GAAAA;KAAS,CAACC,IAAI,CAAC,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;AACrB,QAAA,IAAID,CAAAA,CAAEd,OAAO,KAAKe,CAAAA,CAAEf,OAAO,EAAE;AAC3B,YAAA,OAAOc,CAAAA,CAAEd,OAAO,GAAG,EAAC,GAAI,CAAA;AAC1B,QAAA;QAEA,OAAQe,CAAAA,CAAAA,CAAEZ,YAAY,IAAI,EAAC,EAAGa,aAAa,CAACF,CAAAA,CAAEX,YAAY,IAAI,EAAA,CAAA;IAChE,CAAA;;;;;;"}

package/dist/sessions.mjs

@@ -0,0 +1,42 @@
+import { getDeviceName } from './user-agent.mjs';
+
+/**
+ * Sanitizes a session record for client consumption (active devices UI/API).
+ * Never includes tokens or internal database identifiers.
+ */ const sanitizeSessionEntry = (session, currentSessionId)=>{
+    const metadata = session.metadata ?? {};
+    return {
+        id: session.sessionId,
+        deviceId: session.deviceId,
+        deviceName: typeof metadata.deviceName === 'string' ? metadata.deviceName : undefined,
+        current: Boolean(currentSessionId) && session.sessionId === currentSessionId,
+        loginAt: typeof metadata.loginAt === 'string' ? metadata.loginAt : undefined,
+        // The active record is re-created on each rotation, so its creation time is the
+        // best available "last used" signal without an extra write per request.
+        lastActiveAt: session.createdAt ? new Date(session.createdAt).toISOString() : undefined
+    };
+};
+/**
+ * Builds origin-defined session metadata from generic request context fields.
+ */ const buildSessionMetadata = (params)=>{
+    const deviceName = getDeviceName(params.userAgent);
+    return {
+        loginAt: params.loginAt ?? new Date().toISOString(),
+        ...deviceName ? {
+            deviceName
+        } : {}
+    };
+};
+/**
+ * Sorts sessions for display: current session first, then most recently used.
+ */ const sortSessionsForDisplay = (sessions)=>[
+        ...sessions
+    ].sort((a, b)=>{
+        if (a.current !== b.current) {
+            return a.current ? -1 : 1;
+        }
+        return (b.lastActiveAt ?? '').localeCompare(a.lastActiveAt ?? '');
+    });
+
+export { buildSessionMetadata, sanitizeSessionEntry, sortSessionsForDisplay };
+//# sourceMappingURL=sessions.mjs.map

package/dist/sessions.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"sessions.mjs","sources":["../src/sessions.ts"],"sourcesContent":["import { getDeviceName } from './user-agent';\n\nexport interface SessionEntryLike {\n  sessionId: string;\n  deviceId?: string;\n  createdAt?: Date | string | null;\n  metadata?: Record<string, unknown> | null;\n}\n\nexport interface SanitizedSessionEntry {\n  id: string;\n  deviceId?: string;\n  deviceName?: string;\n  current: boolean;\n  loginAt?: string;\n  lastActiveAt?: string;\n}\n\nexport interface SessionDisplayEntry {\n  current: boolean;\n  lastActiveAt?: string;\n}\n\n/**\n * Sanitizes a session record for client consumption (active devices UI/API).\n * Never includes tokens or internal database identifiers.\n */\nexport const sanitizeSessionEntry = (\n  session: SessionEntryLike,\n  currentSessionId?: string\n): SanitizedSessionEntry => {\n  const metadata = session.metadata ?? {};\n\n  return {\n    id: session.sessionId,\n    deviceId: session.deviceId,\n    deviceName: typeof metadata.deviceName === 'string' ? metadata.deviceName : undefined,\n    current: Boolean(currentSessionId) && session.sessionId === currentSessionId,\n    loginAt: typeof metadata.loginAt === 'string' ? metadata.loginAt : undefined,\n    // The active record is re-created on each rotation, so its creation time is the\n    // best available \"last used\" signal without an extra write per request.\n    lastActiveAt: session.createdAt ? new Date(session.createdAt).toISOString() : undefined,\n  };\n};\n\n/**\n * Builds origin-defined session metadata from generic request context fields.\n */\nexport const buildSessionMetadata = (params: {\n  userAgent?: string | null;\n  loginAt?: string;\n}): Record<string, unknown> => {\n  const deviceName = getDeviceName(params.userAgent);\n\n  return {\n    loginAt: params.loginAt ?? new Date().toISOString(),\n    ...(deviceName ? { deviceName } : {}),\n  };\n};\n\n/**\n * Sorts sessions for display: current session first, then most recently used.\n */\nexport const sortSessionsForDisplay = <T extends SessionDisplayEntry>(sessions: T[]): T[] =>\n  [...sessions].sort((a, b) => {\n    if (a.current !== b.current) {\n      return a.current ? -1 : 1;\n    }\n\n    return (b.lastActiveAt ?? '').localeCompare(a.lastActiveAt ?? '');\n  });\n"],"names":["sanitizeSessionEntry","session","currentSessionId","metadata","id","sessionId","deviceId","deviceName","undefined","current","Boolean","loginAt","lastActiveAt","createdAt","Date","toISOString","buildSessionMetadata","params","getDeviceName","userAgent","sortSessionsForDisplay","sessions","sort","a","b","localeCompare"],"mappings":";;AAuBA;;;AAGC,IACM,MAAMA,oBAAAA,GAAuB,CAClCC,OAAAA,EACAC,gBAAAA,GAAAA;AAEA,IAAA,MAAMC,QAAAA,GAAWF,OAAAA,CAAQE,QAAQ,IAAI,EAAC;IAEtC,OAAO;AACLC,QAAAA,EAAAA,EAAIH,QAAQI,SAAS;AACrBC,QAAAA,QAAAA,EAAUL,QAAQK,QAAQ;AAC1BC,QAAAA,UAAAA,EAAY,OAAOJ,QAAAA,CAASI,UAAU,KAAK,QAAA,GAAWJ,QAAAA,CAASI,UAAU,GAAGC,SAAAA;AAC5EC,QAAAA,OAAAA,EAASC,OAAAA,CAAQR,gBAAAA,CAAAA,IAAqBD,OAAAA,CAAQI,SAAS,KAAKH,gBAAAA;AAC5DS,QAAAA,OAAAA,EAAS,OAAOR,QAAAA,CAASQ,OAAO,KAAK,QAAA,GAAWR,QAAAA,CAASQ,OAAO,GAAGH,SAAAA;;;QAGnEI,YAAAA,EAAcX,OAAAA,CAAQY,SAAS,GAAG,IAAIC,KAAKb,OAAAA,CAAQY,SAAS,CAAA,CAAEE,WAAW,EAAA,GAAKP;AAChF,KAAA;AACF;AAEA;;IAGO,MAAMQ,oBAAAA,GAAuB,CAACC,MAAAA,GAAAA;IAInC,MAAMV,UAAAA,GAAaW,aAAAA,CAAcD,MAAAA,CAAOE,SAAS,CAAA;IAEjD,OAAO;AACLR,QAAAA,OAAAA,EAASM,MAAAA,CAAON,OAAO,IAAI,IAAIG,OAAOC,WAAW,EAAA;AACjD,QAAA,GAAIR,UAAAA,GAAa;AAAEA,YAAAA;AAAW,SAAA,GAAI;AACpC,KAAA;AACF;AAEA;;AAEC,IACM,MAAMa,sBAAAA,GAAyB,CAAgCC,QAAAA,GACpE;AAAIA,QAAAA,GAAAA;KAAS,CAACC,IAAI,CAAC,CAACC,CAAAA,EAAGC,CAAAA,GAAAA;AACrB,QAAA,IAAID,CAAAA,CAAEd,OAAO,KAAKe,CAAAA,CAAEf,OAAO,EAAE;AAC3B,YAAA,OAAOc,CAAAA,CAAEd,OAAO,GAAG,EAAC,GAAI,CAAA;AAC1B,QAAA;QAEA,OAAQe,CAAAA,CAAAA,CAAEZ,YAAY,IAAI,EAAC,EAAGa,aAAa,CAACF,CAAAA,CAAEX,YAAY,IAAI,EAAA,CAAA;IAChE,CAAA;;;;"}

package/dist/set-creator-fields.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"set-creator-fields.d.ts","sourceRoot":"","sources":["../src/set-creator-fields.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,IAAI;IACZ,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,QAAA,MAAM,gBAAgB,8CACgC,OAAO,+CACjB,UAAU,eASnD,CAAC;AAEJ,eAAe,gBAAgB,CAAC"}
+{"version":3,"file":"set-creator-fields.d.ts","sourceRoot":"","sources":["../src/set-creator-fields.ts"],"names":[],"mappings":"AAKA,MAAM,WAAW,OAAO;IACtB,IAAI,EAAE,IAAI,CAAC;IACX,SAAS,CAAC,EAAE,OAAO,CAAC;CACrB;AAED,UAAU,IAAI;IACZ,EAAE,EAAE,MAAM,GAAG,MAAM,CAAC;CACrB;AAED,QAAA,MAAM,gBAAgB,GACnB,KAAK,SAAS,MAAM,EAAE,qBAA6B,OAAO,MAC1D,UAAU,SAAS,MAAM,GAAG,KAAK,EAAE,MAAM,UAAU,eASnD,CAAC;AAEJ,eAAe,gBAAgB,CAAC"}

package/dist/sort-query.js

@@ -2,7 +2,11 @@
 
 var _ = require('lodash');
 
-const isPlainObject = (value)=>_.isPlainObject(value);
+function _interopDefault (e) { return e && e.__esModule ? e : { default: e }; }
+
+var ___default = /*#__PURE__*/_interopDefault(_);
+
+const isPlainObject = (value)=>___default.default.isPlainObject(value);
 /**
  * Splits a REST sort string into trimmed segments with a non-empty field (drops '', ',', trailing commas).
  */ function getMeaningfulSortSegments(sort) {

package/dist/sort-query.js.map

@@ -1 +1 @@
-{"version":3,"file":"sort-query.js","sources":["../src/sort-query.ts"],"sourcesContent":["import _ from 'lodash';\n\nexport type SortOrder = 'asc' | 'desc';\n\nexport interface SortParamsObject {\n  [key: string]: SortOrder | SortParamsObject;\n}\n\nexport type SortParams = string | string[] | SortParamsObject | SortParamsObject[];\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => _.isPlainObject(value);\n\n/**\n * Splits a REST sort string into trimmed segments with a non-empty field (drops '', ',', trailing commas).\n */\nexport function getMeaningfulSortSegments(sort: string): string[] {\n  return sort\n    .split(',')\n    .map((segment) => segment.trim())\n    .filter((segment) => {\n      if (segment.length === 0) {\n        return false;\n      }\n\n      const [field] = segment.split(':');\n      return field.trim().length > 0;\n    });\n}\n\n/**\n * Whether a nested sort object ({ field: 'asc' } or { relation: { name: 'desc' } }) specifies\n * at least one field to sort on. Empty objects and keys with blank orders are treated as no sort.\n */\nfunction hasMeaningfulSortObject(sort: SortParamsObject): boolean {\n  return Object.keys(sort).some((key) => {\n    const order = sort[key];\n\n    if (typeof order === 'string') {\n      return order.length > 0;\n    }\n\n    if (isPlainObject(order)) {\n      return hasMeaningfulSortObject(order as SortParamsObject);\n    }\n\n    return false;\n  });\n}\n\n/** Whether a REST-style sort string contains at least one meaningful segment. */\nfunction hasMeaningfulStringSort(sort: string): boolean {\n  return getMeaningfulSortSegments(sort).length > 0;\n}\n\n/**\n * Whether `sort` carries a real ordering instruction. Empty or absent sort must stay undefined so\n * populated relations keep join-table connect order (GraphQL defaults nested sort to []; REST qs\n * `sort[]` with strictNullHandling parses to `[null]`).\n */\nexport function hasSort(sort?: unknown): sort is SortParams {\n  if (sort === undefined || sort === null) {\n    return false;\n  }\n\n  if (typeof sort === 'string') {\n    return hasMeaningfulStringSort(sort);\n  }\n\n  if (Array.isArray(sort)) {\n    if (sort.length === 0) {\n      return false;\n    }\n\n    return sort.some((item) => {\n      if (typeof item === 'string') {\n        return hasMeaningfulStringSort(item);\n      }\n\n      if (isPlainObject(item)) {\n        return hasMeaningfulSortObject(item as SortParamsObject);\n      }\n\n      return false;\n    });\n  }\n\n  if (isPlainObject(sort)) {\n    return hasMeaningfulSortObject(sort as SortParamsObject);\n  }\n\n  return false;\n}\n"],"names":["isPlainObject","value","_","getMeaningfulSortSegments","sort","split","map","segment","trim","filter","length","field","hasMeaningfulSortObject","Object","keys","some","key","order","hasMeaningfulStringSort","hasSort","undefined","Array","isArray","item"],"mappings":";;;;AAUA,MAAMA,aAAAA,GAAgB,CAACC,KAAAA,GAAqDC,CAAAA,CAAEF,aAAa,CAACC,KAAAA,CAAAA;AAE5F;;IAGO,SAASE,yBAAAA,CAA0BC,IAAY,EAAA;AACpD,IAAA,OAAOA,IAAAA,CACJC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,OAAAA,CAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAAC,CAACF,OAAAA,GAAAA;QACP,IAAIA,OAAAA,CAAQG,MAAM,KAAK,CAAA,EAAG;YACxB,OAAO,KAAA;AACT,QAAA;AAEA,QAAA,MAAM,CAACC,KAAAA,CAAM,GAAGJ,OAAAA,CAAQF,KAAK,CAAC,GAAA,CAAA;AAC9B,QAAA,OAAOM,KAAAA,CAAMH,IAAI,EAAA,CAAGE,MAAM,GAAG,CAAA;AAC/B,IAAA,CAAA,CAAA;AACJ;AAEA;;;IAIA,SAASE,wBAAwBR,IAAsB,EAAA;AACrD,IAAA,OAAOS,OAAOC,IAAI,CAACV,IAAAA,CAAAA,CAAMW,IAAI,CAAC,CAACC,GAAAA,GAAAA;QAC7B,MAAMC,KAAAA,GAAQb,IAAI,CAACY,GAAAA,CAAI;QAEvB,IAAI,OAAOC,UAAU,QAAA,EAAU;YAC7B,OAAOA,KAAAA,CAAMP,MAAM,GAAG,CAAA;AACxB,QAAA;AAEA,QAAA,IAAIV,cAAciB,KAAAA,CAAAA,EAAQ;AACxB,YAAA,OAAOL,uBAAAA,CAAwBK,KAAAA,CAAAA;AACjC,QAAA;QAEA,OAAO,KAAA;AACT,IAAA,CAAA,CAAA;AACF;AAEA,kFACA,SAASC,uBAAAA,CAAwBd,IAAY,EAAA;IAC3C,OAAOD,yBAAAA,CAA0BC,IAAAA,CAAAA,CAAMM,MAAM,GAAG,CAAA;AAClD;AAEA;;;;IAKO,SAASS,OAAAA,CAAQf,IAAc,EAAA;IACpC,IAAIA,IAAAA,KAASgB,SAAAA,IAAahB,IAAAA,KAAS,IAAA,EAAM;QACvC,OAAO,KAAA;AACT,IAAA;IAEA,IAAI,OAAOA,SAAS,QAAA,EAAU;AAC5B,QAAA,OAAOc,uBAAAA,CAAwBd,IAAAA,CAAAA;AACjC,IAAA;IAEA,IAAIiB,KAAAA,CAAMC,OAAO,CAAClB,IAAAA,CAAAA,EAAO;QACvB,IAAIA,IAAAA,CAAKM,MAAM,KAAK,CAAA,EAAG;YACrB,OAAO,KAAA;AACT,QAAA;QAEA,OAAON,IAAAA,CAAKW,IAAI,CAAC,CAACQ,IAAAA,GAAAA;YAChB,IAAI,OAAOA,SAAS,QAAA,EAAU;AAC5B,gBAAA,OAAOL,uBAAAA,CAAwBK,IAAAA,CAAAA;AACjC,YAAA;AAEA,YAAA,IAAIvB,cAAcuB,IAAAA,CAAAA,EAAO;AACvB,gBAAA,OAAOX,uBAAAA,CAAwBW,IAAAA,CAAAA;AACjC,YAAA;YAEA,OAAO,KAAA;AACT,QAAA,CAAA,CAAA;AACF,IAAA;AAEA,IAAA,IAAIvB,cAAcI,IAAAA,CAAAA,EAAO;AACvB,QAAA,OAAOQ,uBAAAA,CAAwBR,IAAAA,CAAAA;AACjC,IAAA;IAEA,OAAO,KAAA;AACT;;;;;"}
+{"version":3,"file":"sort-query.js","sources":["../src/sort-query.ts"],"sourcesContent":["import _ from 'lodash';\n\nexport type SortOrder = 'asc' | 'desc';\n\nexport interface SortParamsObject {\n  [key: string]: SortOrder | SortParamsObject;\n}\n\nexport type SortParams = string | string[] | SortParamsObject | SortParamsObject[];\n\nconst isPlainObject = (value: unknown): value is Record<string, unknown> => _.isPlainObject(value);\n\n/**\n * Splits a REST sort string into trimmed segments with a non-empty field (drops '', ',', trailing commas).\n */\nexport function getMeaningfulSortSegments(sort: string): string[] {\n  return sort\n    .split(',')\n    .map((segment) => segment.trim())\n    .filter((segment) => {\n      if (segment.length === 0) {\n        return false;\n      }\n\n      const [field] = segment.split(':');\n      return field.trim().length > 0;\n    });\n}\n\n/**\n * Whether a nested sort object ({ field: 'asc' } or { relation: { name: 'desc' } }) specifies\n * at least one field to sort on. Empty objects and keys with blank orders are treated as no sort.\n */\nfunction hasMeaningfulSortObject(sort: SortParamsObject): boolean {\n  return Object.keys(sort).some((key) => {\n    const order = sort[key];\n\n    if (typeof order === 'string') {\n      return order.length > 0;\n    }\n\n    if (isPlainObject(order)) {\n      return hasMeaningfulSortObject(order as SortParamsObject);\n    }\n\n    return false;\n  });\n}\n\n/** Whether a REST-style sort string contains at least one meaningful segment. */\nfunction hasMeaningfulStringSort(sort: string): boolean {\n  return getMeaningfulSortSegments(sort).length > 0;\n}\n\n/**\n * Whether `sort` carries a real ordering instruction. Empty or absent sort must stay undefined so\n * populated relations keep join-table connect order (GraphQL defaults nested sort to []; REST qs\n * `sort[]` with strictNullHandling parses to `[null]`).\n */\nexport function hasSort(sort?: unknown): sort is SortParams {\n  if (sort === undefined || sort === null) {\n    return false;\n  }\n\n  if (typeof sort === 'string') {\n    return hasMeaningfulStringSort(sort);\n  }\n\n  if (Array.isArray(sort)) {\n    if (sort.length === 0) {\n      return false;\n    }\n\n    return sort.some((item) => {\n      if (typeof item === 'string') {\n        return hasMeaningfulStringSort(item);\n      }\n\n      if (isPlainObject(item)) {\n        return hasMeaningfulSortObject(item as SortParamsObject);\n      }\n\n      return false;\n    });\n  }\n\n  if (isPlainObject(sort)) {\n    return hasMeaningfulSortObject(sort as SortParamsObject);\n  }\n\n  return false;\n}\n"],"names":["isPlainObject","value","_","getMeaningfulSortSegments","sort","split","map","segment","trim","filter","length","field","hasMeaningfulSortObject","Object","keys","some","key","order","hasMeaningfulStringSort","hasSort","undefined","Array","isArray","item"],"mappings":";;;;;;;;AAUA,MAAMA,aAAAA,GAAgB,CAACC,KAAAA,GAAqDC,kBAAAA,CAAEF,aAAa,CAACC,KAAAA,CAAAA;AAE5F;;IAGO,SAASE,yBAAAA,CAA0BC,IAAY,EAAA;AACpD,IAAA,OAAOA,IAAAA,CACJC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,OAAAA,CAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAAC,CAACF,OAAAA,GAAAA;QACP,IAAIA,OAAAA,CAAQG,MAAM,KAAK,CAAA,EAAG;YACxB,OAAO,KAAA;AACT,QAAA;AAEA,QAAA,MAAM,CAACC,KAAAA,CAAM,GAAGJ,OAAAA,CAAQF,KAAK,CAAC,GAAA,CAAA;AAC9B,QAAA,OAAOM,KAAAA,CAAMH,IAAI,EAAA,CAAGE,MAAM,GAAG,CAAA;AAC/B,IAAA,CAAA,CAAA;AACJ;AAEA;;;IAIA,SAASE,wBAAwBR,IAAsB,EAAA;AACrD,IAAA,OAAOS,OAAOC,IAAI,CAACV,IAAAA,CAAAA,CAAMW,IAAI,CAAC,CAACC,GAAAA,GAAAA;QAC7B,MAAMC,KAAAA,GAAQb,IAAI,CAACY,GAAAA,CAAI;QAEvB,IAAI,OAAOC,UAAU,QAAA,EAAU;YAC7B,OAAOA,KAAAA,CAAMP,MAAM,GAAG,CAAA;AACxB,QAAA;AAEA,QAAA,IAAIV,cAAciB,KAAAA,CAAAA,EAAQ;AACxB,YAAA,OAAOL,uBAAAA,CAAwBK,KAAAA,CAAAA;AACjC,QAAA;QAEA,OAAO,KAAA;AACT,IAAA,CAAA,CAAA;AACF;AAEA,kFACA,SAASC,uBAAAA,CAAwBd,IAAY,EAAA;IAC3C,OAAOD,yBAAAA,CAA0BC,IAAAA,CAAAA,CAAMM,MAAM,GAAG,CAAA;AAClD;AAEA;;;;IAKO,SAASS,OAAAA,CAAQf,IAAc,EAAA;IACpC,IAAIA,IAAAA,KAASgB,SAAAA,IAAahB,IAAAA,KAAS,IAAA,EAAM;QACvC,OAAO,KAAA;AACT,IAAA;IAEA,IAAI,OAAOA,SAAS,QAAA,EAAU;AAC5B,QAAA,OAAOc,uBAAAA,CAAwBd,IAAAA,CAAAA;AACjC,IAAA;IAEA,IAAIiB,KAAAA,CAAMC,OAAO,CAAClB,IAAAA,CAAAA,EAAO;QACvB,IAAIA,IAAAA,CAAKM,MAAM,KAAK,CAAA,EAAG;YACrB,OAAO,KAAA;AACT,QAAA;QAEA,OAAON,IAAAA,CAAKW,IAAI,CAAC,CAACQ,IAAAA,GAAAA;YAChB,IAAI,OAAOA,SAAS,QAAA,EAAU;AAC5B,gBAAA,OAAOL,uBAAAA,CAAwBK,IAAAA,CAAAA;AACjC,YAAA;AAEA,YAAA,IAAIvB,cAAcuB,IAAAA,CAAAA,EAAO;AACvB,gBAAA,OAAOX,uBAAAA,CAAwBW,IAAAA,CAAAA;AACjC,YAAA;YAEA,OAAO,KAAA;AACT,QAAA,CAAA,CAAA;AACF,IAAA;AAEA,IAAA,IAAIvB,cAAcI,IAAAA,CAAAA,EAAO;AACvB,QAAA,OAAOQ,uBAAAA,CAAwBR,IAAAA,CAAAA;AACjC,IAAA;IAEA,OAAO,KAAA;AACT;;;;;"}

package/dist/template.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,QAAA,MAAM,+BAA+B,yBAA0B,MAAM,EAAE,SAAS,MAAM,WAOrF,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,8BAA8B,UAAW,MAAM,WAAyC,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,CAAC"}
+{"version":3,"file":"template.d.ts","sourceRoot":"","sources":["../src/template.ts"],"names":[],"mappings":"AAAA;;GAEG;AACH,QAAA,MAAM,+BAA+B,GAAI,sBAAsB,MAAM,EAAE,EAAE,OAAO,MAAM,WAOrF,CAAC;AAEF;;GAEG;AACH,QAAA,MAAM,8BAA8B,GAAI,OAAO,MAAM,WAAyC,CAAC;AAE/F,OAAO,EAAE,+BAA+B,EAAE,8BAA8B,EAAE,CAAC"}

package/dist/traverse/factory.d.ts

@@ -75,15 +75,114 @@ interface Context<AttributeType = Attribute> {
 }
 declare const _default: () => {
     traverse: Traverse;
-    intercept<T>(predicate: Interceptor<T>['predicate'], handler: Interceptor<T>['handler']): any;
-    parse<T_1>(predicate: (data: unknown) => data is T_1, parser: (data: T_1) => ParseUtils<T_1>): any;
-    ignore(predicate: Ignore): any;
-    on(predicate: CommonHandler['predicate'], handler: CommonHandler['handler']): any;
-    onAttribute(predicate: AttributeHandler['predicate'], handler: AttributeHandler['handler']): any;
-    onRelation(handler: AttributeHandler<RelationalAttribute>['handler']): any;
-    onMedia(handler: AttributeHandler<RelationalAttribute>['handler']): any;
-    onComponent(handler: AttributeHandler<ComponentAttribute>['handler']): any;
-    onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>['handler']): any;
+    intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T_1>(predicate: Parser<T_1>["predicate"], parser: Parser<T_1>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): {
+        traverse: Traverse;
+        intercept<T_1>(predicate: Interceptor<T_1>["predicate"], handler: Interceptor<T_1>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    ignore(predicate: Ignore): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
+    onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): {
+        traverse: Traverse;
+        intercept<T>(predicate: Interceptor<T>["predicate"], handler: Interceptor<T>["handler"]): /*elided*/ any;
+        parse<T>(predicate: Parser<T>["predicate"], parser: Parser<T>["parser"]): /*elided*/ any;
+        ignore(predicate: Ignore): /*elided*/ any;
+        on(predicate: CommonHandler["predicate"], handler: CommonHandler["handler"]): /*elided*/ any;
+        onAttribute(predicate: AttributeHandler["predicate"], handler: AttributeHandler["handler"]): /*elided*/ any;
+        onRelation(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onMedia(handler: AttributeHandler<RelationalAttribute>["handler"]): /*elided*/ any;
+        onComponent(handler: AttributeHandler<ComponentAttribute>["handler"]): /*elided*/ any;
+        onDynamicZone(handler: AttributeHandler<DynamicZoneAttribute>["handler"]): /*elided*/ any;
+    };
 };
 export default _default;
 //# sourceMappingURL=factory.d.ts.map