@strapi/utils 5.58.0 → 5.59.0

package/dist/validate/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sources":["../../src/validate/index.ts"],"sourcesContent":["import { CurriedFunction1, isObject } from 'lodash';\nimport type { z } from 'zod/v4';\n\nimport { getNonWritableAttributes, constants } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\nimport { throwInvalidKey } from './utils';\n\nimport * as visitors from './visitors';\nimport * as validators from './validators';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort } from '../traverse';\n\nimport { Model, Data } from '../types';\nimport { ValidationError } from '../errors';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, validateQuery throws when the query has any top-level key not in the allowed list.\n   * Defaults to false for backward compatibility.\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Validator {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface ValidateFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<void>;\n}\n\nexport type ValidateQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\nexport type ValidateBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\ninterface APIOptions {\n  validators?: Validators;\n  getModel: (model: string) => Model;\n}\n\nexport interface Validators {\n  input?: Validator[];\n}\n\nconst createAPIValidators = (opts: APIOptions) => {\n  const { getModel } = opts || {};\n\n  const validateInput: ValidateFunc = async (data: unknown, schema: Model, options = {}) => {\n    const { auth, route } = options;\n    if (!schema) {\n      throw new Error('Missing schema in validateInput');\n    }\n\n    if (Array.isArray(data)) {\n      await Promise.all(data.map((entry) => validateInput(entry, schema, options)));\n      return;\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      (data: unknown) => {\n        if (isObject(data)) {\n          if (ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: ID_ATTRIBUTE });\n          }\n\n          if (DOC_ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: DOC_ID_ATTRIBUTE });\n          }\n        }\n        return data;\n      },\n      // non-writable attributes\n      traverseEntity(visitors.throwRestrictedFields(nonWritableAttributes), { schema, getModel }),\n      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)\n      traverseEntity(visitors.throwUnrecognizedFields, {\n        schema,\n        getModel,\n        allowedExtraRootKeys,\n      }),\n    ];\n\n    if (auth) {\n      // restricted relations\n      transforms.push(\n        traverseEntity(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    // Apply validators from registry if exists\n    opts?.validators?.input?.forEach((validator: Validator) => transforms.push(validator(schema)));\n\n    try {\n      await pipeAsync(...transforms)(data as Data);\n\n      // Validate extra root keys from route's body schema with Zod (throw on failure).\n      //\n      // Content-api sends the document payload as body.data; the controller calls validateInput(body.data, ctx),\n      // so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n      // The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n      // the main document payload is already validated above by traverseEntity (throwUnrecognizedFields, etc.);\n      // relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n      // Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n      if (isObject(data) && route?.request?.body?.['application/json']) {\n        const bodySchema = route.request.body['application/json'];\n        if (typeof bodySchema === 'object' && 'shape' in bodySchema) {\n          const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n          const dataObj = data as Record<string, unknown>;\n          for (const key of Object.keys(shape)) {\n            if (key === 'data' || !(key in dataObj)) continue;\n            const zodSchema = shape[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(dataObj[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Validation failed',\n                  { key, path: null, source: 'body', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'body';\n      }\n      throw e;\n    }\n  };\n\n  const validateQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateQuery');\n    }\n\n    // Core allowlisted params are not covered by route.request.query Zod (see getExtraQueryKeysFromRoute).\n    if ('publicationFilter' in query) {\n      validatePublicationFilterQueryParam(query.publicationFilter);\n    }\n\n    if (strictParams) {\n      const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      for (const key of Object.keys(query)) {\n        if (!allowedKeys.includes(key)) {\n          try {\n            throwInvalidKey({ key, path: null });\n          } catch (e) {\n            if (e instanceof ValidationError) {\n              e.details.source = 'query';\n              e.details.param = key;\n            }\n            throw e;\n          }\n        }\n      }\n      // Validate extra query keys from route's request schema with Zod (throw on failure)\n      const routeQuerySchema = route?.request?.query;\n      if (routeQuerySchema) {\n        for (const key of extraQueryKeys) {\n          if (key in query) {\n            const zodSchema = routeQuerySchema[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Invalid query param',\n                  { key, path: null, source: 'query', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    }\n\n    const { filters, sort, fields, populate } = query;\n\n    if (filters) {\n      await validateFilters(filters, schema, { auth });\n    }\n\n    if (sort) {\n      await validateSort(sort, schema, { auth });\n    }\n\n    if (fields) {\n      await validateFields(fields, schema);\n    }\n\n    // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n    if (populate && populate !== '*') {\n      await validatePopulate(populate, schema);\n    }\n  };\n\n  const validateFilters: ValidateFunc = async (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFilters');\n    }\n    if (Array.isArray(filters)) {\n      await Promise.all(filters.map((filter) => validateFilters(filter, schema, { auth })));\n      return;\n    }\n\n    const transforms = [validators.defaultValidateFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(filters);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'filters';\n      }\n      throw e;\n    }\n  };\n\n  const validateSort: ValidateFunc = async (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateSort');\n    }\n    const transforms = [validators.defaultValidateSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(sort);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'sort';\n      }\n      throw e;\n    }\n  };\n\n  const validateFields: ValidateFunc = async (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFields');\n    }\n    const transforms = [validators.defaultValidateFields({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(fields);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'fields';\n      }\n      throw e;\n    }\n  };\n\n  const validatePopulate: ValidateFunc = async (populate, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [validators.defaultValidatePopulate({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(populate);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'populate';\n      }\n      throw e;\n    }\n  };\n\n  return {\n    input: validateInput,\n    query: validateQuery,\n    filters: validateFilters,\n    sort: validateSort,\n    fields: validateFields,\n    populate: validatePopulate,\n  };\n};\n\nexport { createAPIValidators, validators, visitors };\n\nexport type APIValidators = ReturnType<typeof createAPIValidators>;\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","createAPIValidators","opts","getModel","validateInput","data","schema","options","auth","route","Error","Array","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","isObject","throwInvalidKey","key","traverseEntity","visitors","push","validators","input","forEach","validator","pipeAsync","request","body","bodySchema","shape","dataObj","Object","keys","zodSchema","parse","result","safeParse","success","ValidationError","error","message","path","source","param","e","details","validateQuery","query","strictParams","validatePublicationFilterQueryParam","publicationFilter","extraQueryKeys","getExtraQueryKeysFromRoute","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","includes","routeQuerySchema","filters","sort","fields","populate","validateFilters","validateSort","validateFields","validatePopulate","filter","traverseQueryFilters","traverseQuerySort"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,sBAAAA;AA4C3C,MAAMC,sBAAsB,CAACC,IAAAA,GAAAA;AAC3B,IAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,QAAQ,EAAC;AAE9B,IAAA,MAAME,gBAA8B,OAAOC,IAAAA,EAAeC,MAAAA,EAAeC,OAAAA,GAAU,EAAE,GAAA;AACnF,QAAA,MAAM,EAAEC,IAAI,EAAEC,KAAK,EAAE,GAAGF,OAAAA;AACxB,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QAEA,IAAIC,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAAA,EAAO;YACvB,MAAMQ,OAAAA,CAAQC,GAAG,CAACT,IAAAA,CAAKU,GAAG,CAAC,CAACC,KAAAA,GAAUZ,aAAAA,CAAcY,KAAAA,EAAOV,MAAAA,EAAQC,OAAAA,CAAAA,CAAAA,CAAAA;AACnE,YAAA;AACF,QAAA;AAEA,QAAA,MAAMU,uBAAuBC,mDAAAA,CAA8BT,KAAAA,CAAAA;AAE3D,QAAA,MAAMU,wBAAwBC,qCAAAA,CAAyBd,MAAAA,CAAAA;AAEvD,QAAA,MAAMe,UAAAA,GAAa;YACjB,CAAChB,IAAAA,GAAAA;AACC,gBAAA,IAAIiB,WAASjB,IAAAA,CAAAA,EAAO;AAClB,oBAAA,IAAIP,gBAAgBO,IAAAA,EAAM;wBACxBkB,qBAAAA,CAAgB;4BAAEC,GAAAA,EAAK1B;AAAa,yBAAA,CAAA;AACtC,oBAAA;AAEA,oBAAA,IAAIC,oBAAoBM,IAAAA,EAAM;wBAC5BkB,qBAAAA,CAAgB;4BAAEC,GAAAA,EAAKzB;AAAiB,yBAAA,CAAA;AAC1C,oBAAA;AACF,gBAAA;gBACA,OAAOM,IAAAA;AACT,YAAA,CAAA;;YAEAoB,cAAAA,CAAeC,qBAA8B,CAACP,qBAAAA,CAAAA,EAAwB;AAAEb,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA;;YAEzFsB,cAAAA,CAAeC,uBAAgC,EAAE;AAC/CpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAc,gBAAAA;AACF,aAAA;AACD,SAAA;AAED,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWM,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACtDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBV,UAAAA,CAAWM,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;QAErF,IAAI;AACF,YAAA,MAAM0B,cAAaX,UAAAA,CAAAA,CAAYhB,IAAAA,CAAAA;;;;;;;;;AAU/B,YAAA,IAAIiB,WAASjB,IAAAA,CAAAA,IAASI,KAAAA,EAAOwB,SAASC,IAAAA,GAAO,mBAAmB,EAAE;AAChE,gBAAA,MAAMC,aAAa1B,KAAAA,CAAMwB,OAAO,CAACC,IAAI,CAAC,kBAAA,CAAmB;AACzD,gBAAA,IAAI,OAAOC,UAAAA,KAAe,QAAA,IAAY,OAAA,IAAWA,UAAAA,EAAY;oBAC3D,MAAMC,KAAAA,GAAQ,UAACD,CAAuDC,KAAK;AAC3E,oBAAA,MAAMC,OAAAA,GAAUhC,IAAAA;AAChB,oBAAA,KAAK,MAAMmB,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,wBAAA,IAAIZ,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOa,OAAM,CAAA,EAAI;wBACzC,MAAMG,SAAAA,GAAYJ,KAAK,CAACZ,GAAAA,CAAI;AAC5B,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACN,OAAO,CAACb,GAAAA,CAAI,CAAA;4BACjE,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,sBAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,mBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,MAAA;oCAAQC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAElD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAO2B,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,MAAA;AACrB,YAAA;YACA,MAAME,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAME,aAAAA,GAAgB,OACpBC,KAAAA,EACAhD,MAAAA,EACA,EAAEE,IAAI,EAAE+C,YAAAA,GAAe,KAAK,EAAE9C,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;;AAGA,QAAA,IAAI,uBAAuB4C,KAAAA,EAAO;AAChCE,YAAAA,qDAAAA,CAAoCF,MAAMG,iBAAiB,CAAA;AAC7D,QAAA;AAEA,QAAA,IAAIF,YAAAA,EAAc;AAChB,YAAA,MAAMG,iBAAiBC,gDAAAA,CAA2BlD,KAAAA,CAAAA;AAClD,YAAA,MAAMmD,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,4CAAAA;AAA6BH,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,KAAK,MAAMlC,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACe,KAAAA,CAAAA,CAAQ;AACpC,gBAAA,IAAI,CAACM,WAAAA,CAAYE,QAAQ,CAACtC,GAAAA,CAAAA,EAAM;oBAC9B,IAAI;wBACFD,qBAAAA,CAAgB;AAAEC,4BAAAA,GAAAA;4BAAKwB,IAAAA,EAAM;AAAK,yBAAA,CAAA;AACpC,oBAAA,CAAA,CAAE,OAAOG,CAAAA,EAAG;AACV,wBAAA,IAAIA,aAAaN,sBAAAA,EAAiB;4BAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;4BACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG1B,GAAAA;AACpB,wBAAA;wBACA,MAAM2B,CAAAA;AACR,oBAAA;AACF,gBAAA;AACF,YAAA;;YAEA,MAAMY,gBAAAA,GAAmBtD,OAAOwB,OAAAA,EAASqB,KAAAA;AACzC,YAAA,IAAIS,gBAAAA,EAAkB;gBACpB,KAAK,MAAMvC,OAAOkC,cAAAA,CAAgB;AAChC,oBAAA,IAAIlC,OAAO8B,KAAAA,EAAO;wBAChB,MAAMd,SAAAA,GAAYuB,gBAAgB,CAACvC,GAAAA,CAAI;AACvC,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACW,KAAK,CAAC9B,GAAAA,CAAI,CAAA;4BAC/D,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,sBAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,qBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,OAAA;oCAASC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAEnD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;QAEA,MAAM,EAAEwC,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGb,KAAAA;AAE5C,QAAA,IAAIU,OAAAA,EAAS;YACX,MAAMI,eAAAA,CAAgBJ,SAAS1D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAChD,QAAA;AAEA,QAAA,IAAIyD,IAAAA,EAAM;YACR,MAAMI,YAAAA,CAAaJ,MAAM3D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAC1C,QAAA;AAEA,QAAA,IAAI0D,MAAAA,EAAQ;AACV,YAAA,MAAMI,eAAeJ,MAAAA,EAAQ5D,MAAAA,CAAAA;AAC/B,QAAA;;QAGA,IAAI6D,QAAAA,IAAYA,aAAa,GAAA,EAAK;AAChC,YAAA,MAAMI,iBAAiBJ,QAAAA,EAAU7D,MAAAA,CAAAA;AACnC,QAAA;AACF,IAAA,CAAA;IAEA,MAAM8D,eAAAA,GAAgC,OAAOJ,OAAAA,EAAS1D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAChF,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;QACA,IAAIC,KAAAA,CAAMC,OAAO,CAACoD,OAAAA,CAAAA,EAAU;YAC1B,MAAMnD,OAAAA,CAAQC,GAAG,CAACkD,OAAAA,CAAQjD,GAAG,CAAC,CAACyD,MAAAA,GAAWJ,eAAAA,CAAgBI,MAAAA,EAAQlE,MAAAA,EAAQ;AAAEE,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACjF,YAAA;AACF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACO,YAAAA,iCAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb8C,YAAAA,CAAqB/C,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AAC5DF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY2C,OAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOb,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,SAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMkB,YAAAA,GAA6B,OAAOJ,IAAAA,EAAM3D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,8BAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb+C,SAAAA,CAAkBhD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACzDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY4C,IAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOd,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,MAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMmB,cAAAA,GAA+B,OAAOJ,MAAAA,EAAQ5D,MAAAA,GAAAA;AAClD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,gCAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE3E,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY6C,MAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOf,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,QAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMoB,gBAAAA,GAAiC,OAAOJ,QAAAA,EAAU7D,MAAAA,GAAAA;AACtD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,kCAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE7E,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY8C,QAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOhB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,UAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,OAAO;QACLtB,KAAAA,EAAOzB,aAAAA;QACPkD,KAAAA,EAAOD,aAAAA;QACPW,OAAAA,EAASI,eAAAA;QACTH,IAAAA,EAAMI,YAAAA;QACNH,MAAAA,EAAQI,cAAAA;QACRH,QAAAA,EAAUI;AACZ,KAAA;AACF;;;;;;"}
+{"version":3,"file":"index.js","sources":["../../src/validate/index.ts"],"sourcesContent":["import { CurriedFunction1, isObject } from 'lodash';\nimport type { z } from 'zod/v4';\n\nimport { getNonWritableAttributes, constants } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\nimport { throwInvalidKey } from './utils';\n\nimport * as visitors from './visitors';\nimport * as validators from './validators';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort } from '../traverse';\n\nimport { Model, Data } from '../types';\nimport { ValidationError } from '../errors';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, validateQuery throws when the query has any top-level key not in the allowed list.\n   * Defaults to false for backward compatibility.\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Validator {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface ValidateFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<void>;\n}\n\nexport type ValidateQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\nexport type ValidateBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\ninterface APIOptions {\n  validators?: Validators;\n  getModel: (model: string) => Model;\n}\n\nexport interface Validators {\n  input?: Validator[];\n}\n\nconst createAPIValidators = (opts: APIOptions) => {\n  const { getModel } = opts || {};\n\n  const validateInput: ValidateFunc = async (data: unknown, schema: Model, options = {}) => {\n    const { auth, route } = options;\n    if (!schema) {\n      throw new Error('Missing schema in validateInput');\n    }\n\n    if (Array.isArray(data)) {\n      await Promise.all(data.map((entry) => validateInput(entry, schema, options)));\n      return;\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      (data: unknown) => {\n        if (isObject(data)) {\n          if (ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: ID_ATTRIBUTE });\n          }\n\n          if (DOC_ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: DOC_ID_ATTRIBUTE });\n          }\n        }\n        return data;\n      },\n      // non-writable attributes\n      traverseEntity(visitors.throwRestrictedFields(nonWritableAttributes), { schema, getModel }),\n      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)\n      traverseEntity(visitors.throwUnrecognizedFields, {\n        schema,\n        getModel,\n        allowedExtraRootKeys,\n      }),\n    ];\n\n    if (auth) {\n      // restricted relations\n      transforms.push(\n        traverseEntity(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    // Apply validators from registry if exists\n    opts?.validators?.input?.forEach((validator: Validator) => transforms.push(validator(schema)));\n\n    try {\n      await pipeAsync(...transforms)(data as Data);\n\n      // Validate extra root keys from route's body schema with Zod (throw on failure).\n      //\n      // Content-api sends the document payload as body.data; the controller calls validateInput(body.data, ctx),\n      // so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n      // The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n      // the main document payload is already validated above by traverseEntity (throwUnrecognizedFields, etc.);\n      // relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n      // Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n      if (isObject(data) && route?.request?.body?.['application/json']) {\n        const bodySchema = route.request.body['application/json'];\n        if (typeof bodySchema === 'object' && 'shape' in bodySchema) {\n          const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n          const dataObj = data as Record<string, unknown>;\n          for (const key of Object.keys(shape)) {\n            if (key === 'data' || !(key in dataObj)) continue;\n            const zodSchema = shape[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(dataObj[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Validation failed',\n                  { key, path: null, source: 'body', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'body';\n      }\n      throw e;\n    }\n  };\n\n  const validateQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateQuery');\n    }\n\n    // Core allowlisted params are not covered by route.request.query Zod (see getExtraQueryKeysFromRoute).\n    if ('publicationFilter' in query) {\n      validatePublicationFilterQueryParam(query.publicationFilter);\n    }\n\n    if (strictParams) {\n      const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n      const allowedKeys = new Set([...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys]);\n      for (const key of Object.keys(query)) {\n        if (!allowedKeys.has(key)) {\n          try {\n            throwInvalidKey({ key, path: null });\n          } catch (e) {\n            if (e instanceof ValidationError) {\n              e.details.source = 'query';\n              e.details.param = key;\n            }\n            throw e;\n          }\n        }\n      }\n      // Validate extra query keys from route's request schema with Zod (throw on failure)\n      const routeQuerySchema = route?.request?.query;\n      if (routeQuerySchema) {\n        for (const key of extraQueryKeys) {\n          if (key in query) {\n            const zodSchema = routeQuerySchema[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Invalid query param',\n                  { key, path: null, source: 'query', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    }\n\n    const { filters, sort, fields, populate } = query;\n\n    if (filters) {\n      await validateFilters(filters, schema, { auth });\n    }\n\n    if (sort) {\n      await validateSort(sort, schema, { auth });\n    }\n\n    if (fields) {\n      await validateFields(fields, schema);\n    }\n\n    // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n    if (populate && populate !== '*') {\n      await validatePopulate(populate, schema);\n    }\n  };\n\n  const validateFilters: ValidateFunc = async (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFilters');\n    }\n    if (Array.isArray(filters)) {\n      await Promise.all(filters.map((filter) => validateFilters(filter, schema, { auth })));\n      return;\n    }\n\n    const transforms = [validators.defaultValidateFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(filters);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'filters';\n      }\n      throw e;\n    }\n  };\n\n  const validateSort: ValidateFunc = async (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateSort');\n    }\n    const transforms = [validators.defaultValidateSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(sort);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'sort';\n      }\n      throw e;\n    }\n  };\n\n  const validateFields: ValidateFunc = async (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFields');\n    }\n    const transforms = [validators.defaultValidateFields({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(fields);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'fields';\n      }\n      throw e;\n    }\n  };\n\n  const validatePopulate: ValidateFunc = async (populate, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [validators.defaultValidatePopulate({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(populate);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'populate';\n      }\n      throw e;\n    }\n  };\n\n  return {\n    input: validateInput,\n    query: validateQuery,\n    filters: validateFilters,\n    sort: validateSort,\n    fields: validateFields,\n    populate: validatePopulate,\n  };\n};\n\nexport { createAPIValidators, validators, visitors };\n\nexport type APIValidators = ReturnType<typeof createAPIValidators>;\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","createAPIValidators","opts","getModel","validateInput","data","schema","options","auth","route","Error","Array","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","isObject","throwInvalidKey","key","traverseEntity","visitors","push","validators","input","forEach","validator","pipeAsync","request","body","bodySchema","shape","dataObj","Object","keys","zodSchema","parse","result","safeParse","success","ValidationError","error","message","path","source","param","e","details","validateQuery","query","strictParams","validatePublicationFilterQueryParam","publicationFilter","extraQueryKeys","getExtraQueryKeysFromRoute","allowedKeys","Set","ALLOWED_QUERY_PARAM_KEYS","has","routeQuerySchema","filters","sort","fields","populate","validateFilters","validateSort","validateFields","validatePopulate","filter","traverseQueryFilters","traverseQuerySort"],"mappings":";;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,sBAAAA;AA4C3C,MAAMC,sBAAsB,CAACC,IAAAA,GAAAA;AAC3B,IAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,QAAQ,EAAC;AAE9B,IAAA,MAAME,gBAA8B,OAAOC,IAAAA,EAAeC,MAAAA,EAAeC,OAAAA,GAAU,EAAE,GAAA;AACnF,QAAA,MAAM,EAAEC,IAAI,EAAEC,KAAK,EAAE,GAAGF,OAAAA;AACxB,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QAEA,IAAIC,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAAA,EAAO;YACvB,MAAMQ,OAAAA,CAAQC,GAAG,CAACT,IAAAA,CAAKU,GAAG,CAAC,CAACC,KAAAA,GAAUZ,aAAAA,CAAcY,KAAAA,EAAOV,MAAAA,EAAQC,OAAAA,CAAAA,CAAAA,CAAAA;AACnE,YAAA;AACF,QAAA;AAEA,QAAA,MAAMU,uBAAuBC,mDAAAA,CAA8BT,KAAAA,CAAAA;AAE3D,QAAA,MAAMU,wBAAwBC,qCAAAA,CAAyBd,MAAAA,CAAAA;AAEvD,QAAA,MAAMe,UAAAA,GAAa;YACjB,CAAChB,IAAAA,GAAAA;AACC,gBAAA,IAAIiB,WAASjB,IAAAA,CAAAA,EAAO;AAClB,oBAAA,IAAIP,gBAAgBO,IAAAA,EAAM;wBACxBkB,qBAAAA,CAAgB;4BAAEC,GAAAA,EAAK1B;AAAa,yBAAA,CAAA;AACtC,oBAAA;AAEA,oBAAA,IAAIC,oBAAoBM,IAAAA,EAAM;wBAC5BkB,qBAAAA,CAAgB;4BAAEC,GAAAA,EAAKzB;AAAiB,yBAAA,CAAA;AAC1C,oBAAA;AACF,gBAAA;gBACA,OAAOM,IAAAA;AACT,YAAA,CAAA;;YAEAoB,cAAAA,CAAeC,qBAA8B,CAACP,qBAAAA,CAAAA,EAAwB;AAAEb,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA;;YAEzFsB,cAAAA,CAAeC,uBAAgC,EAAE;AAC/CpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAc,gBAAAA;AACF,aAAA;AACD,SAAA;AAED,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWM,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACtDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBV,UAAAA,CAAWM,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;QAErF,IAAI;AACF,YAAA,MAAM0B,cAAaX,UAAAA,CAAAA,CAAYhB,IAAAA,CAAAA;;;;;;;;;AAU/B,YAAA,IAAIiB,WAASjB,IAAAA,CAAAA,IAASI,KAAAA,EAAOwB,SAASC,IAAAA,GAAO,mBAAmB,EAAE;AAChE,gBAAA,MAAMC,aAAa1B,KAAAA,CAAMwB,OAAO,CAACC,IAAI,CAAC,kBAAA,CAAmB;AACzD,gBAAA,IAAI,OAAOC,UAAAA,KAAe,QAAA,IAAY,OAAA,IAAWA,UAAAA,EAAY;oBAC3D,MAAMC,KAAAA,GAAQ,UAACD,CAAuDC,KAAK;AAC3E,oBAAA,MAAMC,OAAAA,GAAUhC,IAAAA;AAChB,oBAAA,KAAK,MAAMmB,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,wBAAA,IAAIZ,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOa,OAAM,CAAA,EAAI;wBACzC,MAAMG,SAAAA,GAAYJ,KAAK,CAACZ,GAAAA,CAAI;AAC5B,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACN,OAAO,CAACb,GAAAA,CAAI,CAAA;4BACjE,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,sBAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,mBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,MAAA;oCAAQC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAElD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAO2B,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,MAAA;AACrB,YAAA;YACA,MAAME,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAME,aAAAA,GAAgB,OACpBC,KAAAA,EACAhD,MAAAA,EACA,EAAEE,IAAI,EAAE+C,YAAAA,GAAe,KAAK,EAAE9C,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;;AAGA,QAAA,IAAI,uBAAuB4C,KAAAA,EAAO;AAChCE,YAAAA,qDAAAA,CAAoCF,MAAMG,iBAAiB,CAAA;AAC7D,QAAA;AAEA,QAAA,IAAIF,YAAAA,EAAc;AAChB,YAAA,MAAMG,iBAAiBC,gDAAAA,CAA2BlD,KAAAA,CAAAA;YAClD,MAAMmD,WAAAA,GAAc,IAAIC,GAAAA,CAAI;AAAIC,gBAAAA,GAAAA,4CAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA,CAAA;AAC5E,YAAA,KAAK,MAAMlC,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACe,KAAAA,CAAAA,CAAQ;AACpC,gBAAA,IAAI,CAACM,WAAAA,CAAYG,GAAG,CAACvC,GAAAA,CAAAA,EAAM;oBACzB,IAAI;wBACFD,qBAAAA,CAAgB;AAAEC,4BAAAA,GAAAA;4BAAKwB,IAAAA,EAAM;AAAK,yBAAA,CAAA;AACpC,oBAAA,CAAA,CAAE,OAAOG,CAAAA,EAAG;AACV,wBAAA,IAAIA,aAAaN,sBAAAA,EAAiB;4BAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;4BACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG1B,GAAAA;AACpB,wBAAA;wBACA,MAAM2B,CAAAA;AACR,oBAAA;AACF,gBAAA;AACF,YAAA;;YAEA,MAAMa,gBAAAA,GAAmBvD,OAAOwB,OAAAA,EAASqB,KAAAA;AACzC,YAAA,IAAIU,gBAAAA,EAAkB;gBACpB,KAAK,MAAMxC,OAAOkC,cAAAA,CAAgB;AAChC,oBAAA,IAAIlC,OAAO8B,KAAAA,EAAO;wBAChB,MAAMd,SAAAA,GAAYwB,gBAAgB,CAACxC,GAAAA,CAAI;AACvC,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACW,KAAK,CAAC9B,GAAAA,CAAI,CAAA;4BAC/D,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,sBAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,qBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,OAAA;oCAASC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAEnD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;QAEA,MAAM,EAAEyC,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGd,KAAAA;AAE5C,QAAA,IAAIW,OAAAA,EAAS;YACX,MAAMI,eAAAA,CAAgBJ,SAAS3D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAChD,QAAA;AAEA,QAAA,IAAI0D,IAAAA,EAAM;YACR,MAAMI,YAAAA,CAAaJ,MAAM5D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAC1C,QAAA;AAEA,QAAA,IAAI2D,MAAAA,EAAQ;AACV,YAAA,MAAMI,eAAeJ,MAAAA,EAAQ7D,MAAAA,CAAAA;AAC/B,QAAA;;QAGA,IAAI8D,QAAAA,IAAYA,aAAa,GAAA,EAAK;AAChC,YAAA,MAAMI,iBAAiBJ,QAAAA,EAAU9D,MAAAA,CAAAA;AACnC,QAAA;AACF,IAAA,CAAA;IAEA,MAAM+D,eAAAA,GAAgC,OAAOJ,OAAAA,EAAS3D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAChF,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;QACA,IAAIC,KAAAA,CAAMC,OAAO,CAACqD,OAAAA,CAAAA,EAAU;YAC1B,MAAMpD,OAAAA,CAAQC,GAAG,CAACmD,OAAAA,CAAQlD,GAAG,CAAC,CAAC0D,MAAAA,GAAWJ,eAAAA,CAAgBI,MAAAA,EAAQnE,MAAAA,EAAQ;AAAEE,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACjF,YAAA;AACF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACO,YAAAA,iCAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb+C,YAAAA,CAAqBhD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AAC5DF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY4C,OAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOd,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,SAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMmB,YAAAA,GAA6B,OAAOJ,IAAAA,EAAM5D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,8BAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACbgD,SAAAA,CAAkBjD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACzDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY6C,IAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOf,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,MAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMoB,cAAAA,GAA+B,OAAOJ,MAAAA,EAAQ7D,MAAAA,GAAAA;AAClD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,gCAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE3E,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY8C,MAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOhB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,QAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMqB,gBAAAA,GAAiC,OAAOJ,QAAAA,EAAU9D,MAAAA,GAAAA;AACtD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,kCAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE7E,IAAI;AACF,YAAA,MAAM6B,cAAaX,UAAAA,CAAAA,CAAY+C,QAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOjB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,sBAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,UAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,OAAO;QACLtB,KAAAA,EAAOzB,aAAAA;QACPkD,KAAAA,EAAOD,aAAAA;QACPY,OAAAA,EAASI,eAAAA;QACTH,IAAAA,EAAMI,YAAAA;QACNH,MAAAA,EAAQI,cAAAA;QACRH,QAAAA,EAAUI;AACZ,KAAA;AACF;;;;;;"}

package/dist/validate/index.mjs

@@ -120,12 +120,12 @@ const createAPIValidators = (opts)=>{
         }
         if (strictParams) {
             const extraQueryKeys = getExtraQueryKeysFromRoute(route);
-            const allowedKeys = [
+            const allowedKeys = new Set([
                 ...ALLOWED_QUERY_PARAM_KEYS,
                 ...extraQueryKeys
-            ];
+            ]);
             for (const key of Object.keys(query)){
-                if (!allowedKeys.includes(key)) {
+                if (!allowedKeys.has(key)) {
                     try {
                         throwInvalidKey({
                             key,

package/dist/validate/index.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"index.mjs","sources":["../../src/validate/index.ts"],"sourcesContent":["import { CurriedFunction1, isObject } from 'lodash';\nimport type { z } from 'zod/v4';\n\nimport { getNonWritableAttributes, constants } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\nimport { throwInvalidKey } from './utils';\n\nimport * as visitors from './visitors';\nimport * as validators from './validators';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort } from '../traverse';\n\nimport { Model, Data } from '../types';\nimport { ValidationError } from '../errors';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, validateQuery throws when the query has any top-level key not in the allowed list.\n   * Defaults to false for backward compatibility.\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Validator {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface ValidateFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<void>;\n}\n\nexport type ValidateQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\nexport type ValidateBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\ninterface APIOptions {\n  validators?: Validators;\n  getModel: (model: string) => Model;\n}\n\nexport interface Validators {\n  input?: Validator[];\n}\n\nconst createAPIValidators = (opts: APIOptions) => {\n  const { getModel } = opts || {};\n\n  const validateInput: ValidateFunc = async (data: unknown, schema: Model, options = {}) => {\n    const { auth, route } = options;\n    if (!schema) {\n      throw new Error('Missing schema in validateInput');\n    }\n\n    if (Array.isArray(data)) {\n      await Promise.all(data.map((entry) => validateInput(entry, schema, options)));\n      return;\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      (data: unknown) => {\n        if (isObject(data)) {\n          if (ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: ID_ATTRIBUTE });\n          }\n\n          if (DOC_ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: DOC_ID_ATTRIBUTE });\n          }\n        }\n        return data;\n      },\n      // non-writable attributes\n      traverseEntity(visitors.throwRestrictedFields(nonWritableAttributes), { schema, getModel }),\n      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)\n      traverseEntity(visitors.throwUnrecognizedFields, {\n        schema,\n        getModel,\n        allowedExtraRootKeys,\n      }),\n    ];\n\n    if (auth) {\n      // restricted relations\n      transforms.push(\n        traverseEntity(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    // Apply validators from registry if exists\n    opts?.validators?.input?.forEach((validator: Validator) => transforms.push(validator(schema)));\n\n    try {\n      await pipeAsync(...transforms)(data as Data);\n\n      // Validate extra root keys from route's body schema with Zod (throw on failure).\n      //\n      // Content-api sends the document payload as body.data; the controller calls validateInput(body.data, ctx),\n      // so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n      // The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n      // the main document payload is already validated above by traverseEntity (throwUnrecognizedFields, etc.);\n      // relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n      // Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n      if (isObject(data) && route?.request?.body?.['application/json']) {\n        const bodySchema = route.request.body['application/json'];\n        if (typeof bodySchema === 'object' && 'shape' in bodySchema) {\n          const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n          const dataObj = data as Record<string, unknown>;\n          for (const key of Object.keys(shape)) {\n            if (key === 'data' || !(key in dataObj)) continue;\n            const zodSchema = shape[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(dataObj[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Validation failed',\n                  { key, path: null, source: 'body', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'body';\n      }\n      throw e;\n    }\n  };\n\n  const validateQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateQuery');\n    }\n\n    // Core allowlisted params are not covered by route.request.query Zod (see getExtraQueryKeysFromRoute).\n    if ('publicationFilter' in query) {\n      validatePublicationFilterQueryParam(query.publicationFilter);\n    }\n\n    if (strictParams) {\n      const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n      const allowedKeys = [...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys];\n      for (const key of Object.keys(query)) {\n        if (!allowedKeys.includes(key)) {\n          try {\n            throwInvalidKey({ key, path: null });\n          } catch (e) {\n            if (e instanceof ValidationError) {\n              e.details.source = 'query';\n              e.details.param = key;\n            }\n            throw e;\n          }\n        }\n      }\n      // Validate extra query keys from route's request schema with Zod (throw on failure)\n      const routeQuerySchema = route?.request?.query;\n      if (routeQuerySchema) {\n        for (const key of extraQueryKeys) {\n          if (key in query) {\n            const zodSchema = routeQuerySchema[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Invalid query param',\n                  { key, path: null, source: 'query', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    }\n\n    const { filters, sort, fields, populate } = query;\n\n    if (filters) {\n      await validateFilters(filters, schema, { auth });\n    }\n\n    if (sort) {\n      await validateSort(sort, schema, { auth });\n    }\n\n    if (fields) {\n      await validateFields(fields, schema);\n    }\n\n    // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n    if (populate && populate !== '*') {\n      await validatePopulate(populate, schema);\n    }\n  };\n\n  const validateFilters: ValidateFunc = async (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFilters');\n    }\n    if (Array.isArray(filters)) {\n      await Promise.all(filters.map((filter) => validateFilters(filter, schema, { auth })));\n      return;\n    }\n\n    const transforms = [validators.defaultValidateFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(filters);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'filters';\n      }\n      throw e;\n    }\n  };\n\n  const validateSort: ValidateFunc = async (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateSort');\n    }\n    const transforms = [validators.defaultValidateSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(sort);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'sort';\n      }\n      throw e;\n    }\n  };\n\n  const validateFields: ValidateFunc = async (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFields');\n    }\n    const transforms = [validators.defaultValidateFields({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(fields);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'fields';\n      }\n      throw e;\n    }\n  };\n\n  const validatePopulate: ValidateFunc = async (populate, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [validators.defaultValidatePopulate({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(populate);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'populate';\n      }\n      throw e;\n    }\n  };\n\n  return {\n    input: validateInput,\n    query: validateQuery,\n    filters: validateFilters,\n    sort: validateSort,\n    fields: validateFields,\n    populate: validatePopulate,\n  };\n};\n\nexport { createAPIValidators, validators, visitors };\n\nexport type APIValidators = ReturnType<typeof createAPIValidators>;\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","createAPIValidators","opts","getModel","validateInput","data","schema","options","auth","route","Error","Array","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","isObject","throwInvalidKey","key","traverseEntity","visitors","push","validators","input","forEach","validator","pipeAsync","request","body","bodySchema","shape","dataObj","Object","keys","zodSchema","parse","result","safeParse","success","ValidationError","error","message","path","source","param","e","details","validateQuery","query","strictParams","validatePublicationFilterQueryParam","publicationFilter","extraQueryKeys","getExtraQueryKeysFromRoute","allowedKeys","ALLOWED_QUERY_PARAM_KEYS","includes","routeQuerySchema","filters","sort","fields","populate","validateFilters","validateSort","validateFields","validatePopulate","filter","traverseQueryFilters","traverseQuerySort"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AA4C3C,MAAMC,sBAAsB,CAACC,IAAAA,GAAAA;AAC3B,IAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,QAAQ,EAAC;AAE9B,IAAA,MAAME,gBAA8B,OAAOC,IAAAA,EAAeC,MAAAA,EAAeC,OAAAA,GAAU,EAAE,GAAA;AACnF,QAAA,MAAM,EAAEC,IAAI,EAAEC,KAAK,EAAE,GAAGF,OAAAA;AACxB,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QAEA,IAAIC,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAAA,EAAO;YACvB,MAAMQ,OAAAA,CAAQC,GAAG,CAACT,IAAAA,CAAKU,GAAG,CAAC,CAACC,KAAAA,GAAUZ,aAAAA,CAAcY,KAAAA,EAAOV,MAAAA,EAAQC,OAAAA,CAAAA,CAAAA,CAAAA;AACnE,YAAA;AACF,QAAA;AAEA,QAAA,MAAMU,uBAAuBC,6BAAAA,CAA8BT,KAAAA,CAAAA;AAE3D,QAAA,MAAMU,wBAAwBC,wBAAAA,CAAyBd,MAAAA,CAAAA;AAEvD,QAAA,MAAMe,UAAAA,GAAa;YACjB,CAAChB,IAAAA,GAAAA;AACC,gBAAA,IAAIiB,SAASjB,IAAAA,CAAAA,EAAO;AAClB,oBAAA,IAAIP,gBAAgBO,IAAAA,EAAM;wBACxBkB,eAAAA,CAAgB;4BAAEC,GAAAA,EAAK1B;AAAa,yBAAA,CAAA;AACtC,oBAAA;AAEA,oBAAA,IAAIC,oBAAoBM,IAAAA,EAAM;wBAC5BkB,eAAAA,CAAgB;4BAAEC,GAAAA,EAAKzB;AAAiB,yBAAA,CAAA;AAC1C,oBAAA;AACF,gBAAA;gBACA,OAAOM,IAAAA;AACT,YAAA,CAAA;;YAEAoB,cAAAA,CAAeC,qBAA8B,CAACP,qBAAAA,CAAAA,EAAwB;AAAEb,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA;;YAEzFsB,cAAAA,CAAeC,uBAAgC,EAAE;AAC/CpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAc,gBAAAA;AACF,aAAA;AACD,SAAA;AAED,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWM,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACtDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBV,UAAAA,CAAWM,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;QAErF,IAAI;AACF,YAAA,MAAM0B,QAAaX,UAAAA,CAAAA,CAAYhB,IAAAA,CAAAA;;;;;;;;;AAU/B,YAAA,IAAIiB,SAASjB,IAAAA,CAAAA,IAASI,KAAAA,EAAOwB,SAASC,IAAAA,GAAO,mBAAmB,EAAE;AAChE,gBAAA,MAAMC,aAAa1B,KAAAA,CAAMwB,OAAO,CAACC,IAAI,CAAC,kBAAA,CAAmB;AACzD,gBAAA,IAAI,OAAOC,UAAAA,KAAe,QAAA,IAAY,OAAA,IAAWA,UAAAA,EAAY;oBAC3D,MAAMC,KAAAA,GAAQ,UAACD,CAAuDC,KAAK;AAC3E,oBAAA,MAAMC,OAAAA,GAAUhC,IAAAA;AAChB,oBAAA,KAAK,MAAMmB,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,wBAAA,IAAIZ,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOa,OAAM,CAAA,EAAI;wBACzC,MAAMG,SAAAA,GAAYJ,KAAK,CAACZ,GAAAA,CAAI;AAC5B,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACN,OAAO,CAACb,GAAAA,CAAI,CAAA;4BACjE,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,eAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,mBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,MAAA;oCAAQC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAElD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAO2B,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,MAAA;AACrB,YAAA;YACA,MAAME,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAME,aAAAA,GAAgB,OACpBC,KAAAA,EACAhD,MAAAA,EACA,EAAEE,IAAI,EAAE+C,YAAAA,GAAe,KAAK,EAAE9C,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;;AAGA,QAAA,IAAI,uBAAuB4C,KAAAA,EAAO;AAChCE,YAAAA,mCAAAA,CAAoCF,MAAMG,iBAAiB,CAAA;AAC7D,QAAA;AAEA,QAAA,IAAIF,YAAAA,EAAc;AAChB,YAAA,MAAMG,iBAAiBC,0BAAAA,CAA2BlD,KAAAA,CAAAA;AAClD,YAAA,MAAMmD,WAAAA,GAAc;AAAIC,gBAAAA,GAAAA,wBAAAA;AAA6BH,gBAAAA,GAAAA;AAAe,aAAA;AACpE,YAAA,KAAK,MAAMlC,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACe,KAAAA,CAAAA,CAAQ;AACpC,gBAAA,IAAI,CAACM,WAAAA,CAAYE,QAAQ,CAACtC,GAAAA,CAAAA,EAAM;oBAC9B,IAAI;wBACFD,eAAAA,CAAgB;AAAEC,4BAAAA,GAAAA;4BAAKwB,IAAAA,EAAM;AAAK,yBAAA,CAAA;AACpC,oBAAA,CAAA,CAAE,OAAOG,CAAAA,EAAG;AACV,wBAAA,IAAIA,aAAaN,eAAAA,EAAiB;4BAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;4BACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG1B,GAAAA;AACpB,wBAAA;wBACA,MAAM2B,CAAAA;AACR,oBAAA;AACF,gBAAA;AACF,YAAA;;YAEA,MAAMY,gBAAAA,GAAmBtD,OAAOwB,OAAAA,EAASqB,KAAAA;AACzC,YAAA,IAAIS,gBAAAA,EAAkB;gBACpB,KAAK,MAAMvC,OAAOkC,cAAAA,CAAgB;AAChC,oBAAA,IAAIlC,OAAO8B,KAAAA,EAAO;wBAChB,MAAMd,SAAAA,GAAYuB,gBAAgB,CAACvC,GAAAA,CAAI;AACvC,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACW,KAAK,CAAC9B,GAAAA,CAAI,CAAA;4BAC/D,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,eAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,qBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,OAAA;oCAASC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAEnD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;QAEA,MAAM,EAAEwC,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGb,KAAAA;AAE5C,QAAA,IAAIU,OAAAA,EAAS;YACX,MAAMI,eAAAA,CAAgBJ,SAAS1D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAChD,QAAA;AAEA,QAAA,IAAIyD,IAAAA,EAAM;YACR,MAAMI,YAAAA,CAAaJ,MAAM3D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAC1C,QAAA;AAEA,QAAA,IAAI0D,MAAAA,EAAQ;AACV,YAAA,MAAMI,eAAeJ,MAAAA,EAAQ5D,MAAAA,CAAAA;AAC/B,QAAA;;QAGA,IAAI6D,QAAAA,IAAYA,aAAa,GAAA,EAAK;AAChC,YAAA,MAAMI,iBAAiBJ,QAAAA,EAAU7D,MAAAA,CAAAA;AACnC,QAAA;AACF,IAAA,CAAA;IAEA,MAAM8D,eAAAA,GAAgC,OAAOJ,OAAAA,EAAS1D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAChF,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;QACA,IAAIC,KAAAA,CAAMC,OAAO,CAACoD,OAAAA,CAAAA,EAAU;YAC1B,MAAMnD,OAAAA,CAAQC,GAAG,CAACkD,OAAAA,CAAQjD,GAAG,CAAC,CAACyD,MAAAA,GAAWJ,eAAAA,CAAgBI,MAAAA,EAAQlE,MAAAA,EAAQ;AAAEE,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACjF,YAAA;AACF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACO,YAAAA,sBAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb8C,oBAAAA,CAAqB/C,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AAC5DF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY2C,OAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOb,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,SAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMkB,YAAAA,GAA6B,OAAOJ,IAAAA,EAAM3D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,mBAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb+C,iBAAAA,CAAkBhD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACzDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY4C,IAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOd,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,MAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMmB,cAAAA,GAA+B,OAAOJ,MAAAA,EAAQ5D,MAAAA,GAAAA;AAClD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,qBAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE3E,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY6C,MAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOf,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,QAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMoB,gBAAAA,GAAiC,OAAOJ,QAAAA,EAAU7D,MAAAA,GAAAA;AACtD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,uBAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE7E,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY8C,QAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOhB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,UAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,OAAO;QACLtB,KAAAA,EAAOzB,aAAAA;QACPkD,KAAAA,EAAOD,aAAAA;QACPW,OAAAA,EAASI,eAAAA;QACTH,IAAAA,EAAMI,YAAAA;QACNH,MAAAA,EAAQI,cAAAA;QACRH,QAAAA,EAAUI;AACZ,KAAA;AACF;;;;"}
+{"version":3,"file":"index.mjs","sources":["../../src/validate/index.ts"],"sourcesContent":["import { CurriedFunction1, isObject } from 'lodash';\nimport type { z } from 'zod/v4';\n\nimport { getNonWritableAttributes, constants } from '../content-types';\nimport { ALLOWED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport {\n  type RouteLike,\n  getExtraQueryKeysFromRoute,\n  getExtraRootKeysFromRouteBody,\n} from '../content-api-route-params';\nimport { pipe as pipeAsync } from '../async';\nimport { throwInvalidKey } from './utils';\n\nimport * as visitors from './visitors';\nimport * as validators from './validators';\nimport traverseEntity from '../traverse-entity';\n\nimport { traverseQueryFilters, traverseQuerySort } from '../traverse';\n\nimport { Model, Data } from '../types';\nimport { ValidationError } from '../errors';\nimport { validatePublicationFilterQueryParam } from '../publication-filter';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\nexport interface Options {\n  auth?: unknown;\n  /**\n   * If true, validateQuery throws when the query has any top-level key not in the allowed list.\n   * Defaults to false for backward compatibility.\n   */\n  strictParams?: boolean;\n  /**\n   * When set, extra query/input params are derived from the route's request schema (and validated with Zod).\n   * When absent, no extra params are allowed in strict mode.\n   */\n  route?: RouteLike;\n}\n\nexport interface Validator {\n  (schema: Model): CurriedFunction1<Data, Promise<Data>>;\n}\nexport interface ValidateFunc {\n  (data: unknown, schema: Model, options?: Options): Promise<void>;\n}\n\nexport type ValidateQueryParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\nexport type ValidateBodyParamHandler = (\n  value: unknown,\n  schema: Model,\n  options?: Options\n) => Promise<void>;\n\ninterface APIOptions {\n  validators?: Validators;\n  getModel: (model: string) => Model;\n}\n\nexport interface Validators {\n  input?: Validator[];\n}\n\nconst createAPIValidators = (opts: APIOptions) => {\n  const { getModel } = opts || {};\n\n  const validateInput: ValidateFunc = async (data: unknown, schema: Model, options = {}) => {\n    const { auth, route } = options;\n    if (!schema) {\n      throw new Error('Missing schema in validateInput');\n    }\n\n    if (Array.isArray(data)) {\n      await Promise.all(data.map((entry) => validateInput(entry, schema, options)));\n      return;\n    }\n\n    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);\n\n    const nonWritableAttributes = getNonWritableAttributes(schema);\n\n    const transforms = [\n      (data: unknown) => {\n        if (isObject(data)) {\n          if (ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: ID_ATTRIBUTE });\n          }\n\n          if (DOC_ID_ATTRIBUTE in data) {\n            throwInvalidKey({ key: DOC_ID_ATTRIBUTE });\n          }\n        }\n        return data;\n      },\n      // non-writable attributes\n      traverseEntity(visitors.throwRestrictedFields(nonWritableAttributes), { schema, getModel }),\n      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)\n      traverseEntity(visitors.throwUnrecognizedFields, {\n        schema,\n        getModel,\n        allowedExtraRootKeys,\n      }),\n    ];\n\n    if (auth) {\n      // restricted relations\n      transforms.push(\n        traverseEntity(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    // Apply validators from registry if exists\n    opts?.validators?.input?.forEach((validator: Validator) => transforms.push(validator(schema)));\n\n    try {\n      await pipeAsync(...transforms)(data as Data);\n\n      // Validate extra root keys from route's body schema with Zod (throw on failure).\n      //\n      // Content-api sends the document payload as body.data; the controller calls validateInput(body.data, ctx),\n      // so the input we receive here is the inner payload (keys like \"relatedMedia\", \"name\"), not the full body.\n      // The route's body schema is z.object({ data: ... }), so its shape includes \"data\". We skip \"data\" because\n      // the main document payload is already validated above by traverseEntity (throwUnrecognizedFields, etc.);\n      // relation ops (connect/disconnect/set) are handled there, not by the route's Zod schema. We only run\n      // Zod here for truly extra root keys added via addInputParams (e.g. clientMutationId).\n      if (isObject(data) && route?.request?.body?.['application/json']) {\n        const bodySchema = route.request.body['application/json'];\n        if (typeof bodySchema === 'object' && 'shape' in bodySchema) {\n          const shape = (bodySchema as { shape: Record<string, z.ZodTypeAny> }).shape;\n          const dataObj = data as Record<string, unknown>;\n          for (const key of Object.keys(shape)) {\n            if (key === 'data' || !(key in dataObj)) continue;\n            const zodSchema = shape[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(dataObj[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Validation failed',\n                  { key, path: null, source: 'body', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'body';\n      }\n      throw e;\n    }\n  };\n\n  const validateQuery = async (\n    query: Record<string, unknown>,\n    schema: Model,\n    { auth, strictParams = false, route }: Options = {}\n  ) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateQuery');\n    }\n\n    // Core allowlisted params are not covered by route.request.query Zod (see getExtraQueryKeysFromRoute).\n    if ('publicationFilter' in query) {\n      validatePublicationFilterQueryParam(query.publicationFilter);\n    }\n\n    if (strictParams) {\n      const extraQueryKeys = getExtraQueryKeysFromRoute(route);\n      const allowedKeys = new Set([...ALLOWED_QUERY_PARAM_KEYS, ...extraQueryKeys]);\n      for (const key of Object.keys(query)) {\n        if (!allowedKeys.has(key)) {\n          try {\n            throwInvalidKey({ key, path: null });\n          } catch (e) {\n            if (e instanceof ValidationError) {\n              e.details.source = 'query';\n              e.details.param = key;\n            }\n            throw e;\n          }\n        }\n      }\n      // Validate extra query keys from route's request schema with Zod (throw on failure)\n      const routeQuerySchema = route?.request?.query;\n      if (routeQuerySchema) {\n        for (const key of extraQueryKeys) {\n          if (key in query) {\n            const zodSchema = routeQuerySchema[key];\n            if (zodSchema && typeof (zodSchema as z.ZodTypeAny).parse === 'function') {\n              const result = (zodSchema as z.ZodTypeAny).safeParse(query[key]);\n              if (!result.success) {\n                throw new ValidationError(\n                  (result.error?.message as string) ?? 'Invalid query param',\n                  { key, path: null, source: 'query', param: key }\n                );\n              }\n            }\n          }\n        }\n      }\n    }\n\n    const { filters, sort, fields, populate } = query;\n\n    if (filters) {\n      await validateFilters(filters, schema, { auth });\n    }\n\n    if (sort) {\n      await validateSort(sort, schema, { auth });\n    }\n\n    if (fields) {\n      await validateFields(fields, schema);\n    }\n\n    // a wildcard is always valid; its conversion will be handled by the entity service and can be optimized with sanitizer\n    if (populate && populate !== '*') {\n      await validatePopulate(populate, schema);\n    }\n  };\n\n  const validateFilters: ValidateFunc = async (filters, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFilters');\n    }\n    if (Array.isArray(filters)) {\n      await Promise.all(filters.map((filter) => validateFilters(filter, schema, { auth })));\n      return;\n    }\n\n    const transforms = [validators.defaultValidateFilters({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQueryFilters(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(filters);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'filters';\n      }\n      throw e;\n    }\n  };\n\n  const validateSort: ValidateFunc = async (sort, schema: Model, { auth } = {}) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateSort');\n    }\n    const transforms = [validators.defaultValidateSort({ schema, getModel })];\n\n    if (auth) {\n      transforms.push(\n        traverseQuerySort(visitors.throwRestrictedRelations(auth), {\n          schema,\n          getModel,\n        })\n      );\n    }\n\n    try {\n      await pipeAsync(...transforms)(sort);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'sort';\n      }\n      throw e;\n    }\n  };\n\n  const validateFields: ValidateFunc = async (fields, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in validateFields');\n    }\n    const transforms = [validators.defaultValidateFields({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(fields);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'fields';\n      }\n      throw e;\n    }\n  };\n\n  const validatePopulate: ValidateFunc = async (populate, schema: Model) => {\n    if (!schema) {\n      throw new Error('Missing schema in sanitizePopulate');\n    }\n    const transforms = [validators.defaultValidatePopulate({ schema, getModel })];\n\n    try {\n      await pipeAsync(...transforms)(populate);\n    } catch (e) {\n      if (e instanceof ValidationError) {\n        e.details.source = 'query';\n        e.details.param = 'populate';\n      }\n      throw e;\n    }\n  };\n\n  return {\n    input: validateInput,\n    query: validateQuery,\n    filters: validateFilters,\n    sort: validateSort,\n    fields: validateFields,\n    populate: validatePopulate,\n  };\n};\n\nexport { createAPIValidators, validators, visitors };\n\nexport type APIValidators = ReturnType<typeof createAPIValidators>;\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","createAPIValidators","opts","getModel","validateInput","data","schema","options","auth","route","Error","Array","isArray","Promise","all","map","entry","allowedExtraRootKeys","getExtraRootKeysFromRouteBody","nonWritableAttributes","getNonWritableAttributes","transforms","isObject","throwInvalidKey","key","traverseEntity","visitors","push","validators","input","forEach","validator","pipeAsync","request","body","bodySchema","shape","dataObj","Object","keys","zodSchema","parse","result","safeParse","success","ValidationError","error","message","path","source","param","e","details","validateQuery","query","strictParams","validatePublicationFilterQueryParam","publicationFilter","extraQueryKeys","getExtraQueryKeysFromRoute","allowedKeys","Set","ALLOWED_QUERY_PARAM_KEYS","has","routeQuerySchema","filters","sort","fields","populate","validateFilters","validateSort","validateFields","validatePopulate","filter","traverseQueryFilters","traverseQuerySort"],"mappings":";;;;;;;;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;AA4C3C,MAAMC,sBAAsB,CAACC,IAAAA,GAAAA;AAC3B,IAAA,MAAM,EAAEC,QAAQ,EAAE,GAAGD,QAAQ,EAAC;AAE9B,IAAA,MAAME,gBAA8B,OAAOC,IAAAA,EAAeC,MAAAA,EAAeC,OAAAA,GAAU,EAAE,GAAA;AACnF,QAAA,MAAM,EAAEC,IAAI,EAAEC,KAAK,EAAE,GAAGF,OAAAA;AACxB,QAAA,IAAI,CAACD,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;QAEA,IAAIC,KAAAA,CAAMC,OAAO,CAACP,IAAAA,CAAAA,EAAO;YACvB,MAAMQ,OAAAA,CAAQC,GAAG,CAACT,IAAAA,CAAKU,GAAG,CAAC,CAACC,KAAAA,GAAUZ,aAAAA,CAAcY,KAAAA,EAAOV,MAAAA,EAAQC,OAAAA,CAAAA,CAAAA,CAAAA;AACnE,YAAA;AACF,QAAA;AAEA,QAAA,MAAMU,uBAAuBC,6BAAAA,CAA8BT,KAAAA,CAAAA;AAE3D,QAAA,MAAMU,wBAAwBC,wBAAAA,CAAyBd,MAAAA,CAAAA;AAEvD,QAAA,MAAMe,UAAAA,GAAa;YACjB,CAAChB,IAAAA,GAAAA;AACC,gBAAA,IAAIiB,SAASjB,IAAAA,CAAAA,EAAO;AAClB,oBAAA,IAAIP,gBAAgBO,IAAAA,EAAM;wBACxBkB,eAAAA,CAAgB;4BAAEC,GAAAA,EAAK1B;AAAa,yBAAA,CAAA;AACtC,oBAAA;AAEA,oBAAA,IAAIC,oBAAoBM,IAAAA,EAAM;wBAC5BkB,eAAAA,CAAgB;4BAAEC,GAAAA,EAAKzB;AAAiB,yBAAA,CAAA;AAC1C,oBAAA;AACF,gBAAA;gBACA,OAAOM,IAAAA;AACT,YAAA,CAAA;;YAEAoB,cAAAA,CAAeC,qBAA8B,CAACP,qBAAAA,CAAAA,EAAwB;AAAEb,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA,CAAA;;YAEzFsB,cAAAA,CAAeC,uBAAgC,EAAE;AAC/CpB,gBAAAA,MAAAA;AACAH,gBAAAA,QAAAA;AACAc,gBAAAA;AACF,aAAA;AACD,SAAA;AAED,QAAA,IAAIT,IAAAA,EAAM;;AAERa,YAAAA,UAAAA,CAAWM,IAAI,CACbF,cAAAA,CAAeC,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACtDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;;QAGAD,IAAAA,EAAM0B,UAAAA,EAAYC,OAAOC,OAAAA,CAAQ,CAACC,YAAyBV,UAAAA,CAAWM,IAAI,CAACI,SAAAA,CAAUzB,MAAAA,CAAAA,CAAAA,CAAAA;QAErF,IAAI;AACF,YAAA,MAAM0B,QAAaX,UAAAA,CAAAA,CAAYhB,IAAAA,CAAAA;;;;;;;;;AAU/B,YAAA,IAAIiB,SAASjB,IAAAA,CAAAA,IAASI,KAAAA,EAAOwB,SAASC,IAAAA,GAAO,mBAAmB,EAAE;AAChE,gBAAA,MAAMC,aAAa1B,KAAAA,CAAMwB,OAAO,CAACC,IAAI,CAAC,kBAAA,CAAmB;AACzD,gBAAA,IAAI,OAAOC,UAAAA,KAAe,QAAA,IAAY,OAAA,IAAWA,UAAAA,EAAY;oBAC3D,MAAMC,KAAAA,GAAQ,UAACD,CAAuDC,KAAK;AAC3E,oBAAA,MAAMC,OAAAA,GAAUhC,IAAAA;AAChB,oBAAA,KAAK,MAAMmB,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACH,KAAAA,CAAAA,CAAQ;AACpC,wBAAA,IAAIZ,QAAQ,MAAA,IAAU,EAAEA,GAAAA,IAAOa,OAAM,CAAA,EAAI;wBACzC,MAAMG,SAAAA,GAAYJ,KAAK,CAACZ,GAAAA,CAAI;AAC5B,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACN,OAAO,CAACb,GAAAA,CAAI,CAAA;4BACjE,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,eAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,mBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,MAAA;oCAAQC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAElD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA,CAAA,CAAE,OAAO2B,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,MAAA;AACrB,YAAA;YACA,MAAME,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;AAEA,IAAA,MAAME,aAAAA,GAAgB,OACpBC,KAAAA,EACAhD,MAAAA,EACA,EAAEE,IAAI,EAAE+C,YAAAA,GAAe,KAAK,EAAE9C,KAAK,EAAW,GAAG,EAAE,GAAA;AAEnD,QAAA,IAAI,CAACH,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,iCAAA,CAAA;AAClB,QAAA;;AAGA,QAAA,IAAI,uBAAuB4C,KAAAA,EAAO;AAChCE,YAAAA,mCAAAA,CAAoCF,MAAMG,iBAAiB,CAAA;AAC7D,QAAA;AAEA,QAAA,IAAIF,YAAAA,EAAc;AAChB,YAAA,MAAMG,iBAAiBC,0BAAAA,CAA2BlD,KAAAA,CAAAA;YAClD,MAAMmD,WAAAA,GAAc,IAAIC,GAAAA,CAAI;AAAIC,gBAAAA,GAAAA,wBAAAA;AAA6BJ,gBAAAA,GAAAA;AAAe,aAAA,CAAA;AAC5E,YAAA,KAAK,MAAMlC,GAAAA,IAAOc,MAAAA,CAAOC,IAAI,CAACe,KAAAA,CAAAA,CAAQ;AACpC,gBAAA,IAAI,CAACM,WAAAA,CAAYG,GAAG,CAACvC,GAAAA,CAAAA,EAAM;oBACzB,IAAI;wBACFD,eAAAA,CAAgB;AAAEC,4BAAAA,GAAAA;4BAAKwB,IAAAA,EAAM;AAAK,yBAAA,CAAA;AACpC,oBAAA,CAAA,CAAE,OAAOG,CAAAA,EAAG;AACV,wBAAA,IAAIA,aAAaN,eAAAA,EAAiB;4BAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;4BACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG1B,GAAAA;AACpB,wBAAA;wBACA,MAAM2B,CAAAA;AACR,oBAAA;AACF,gBAAA;AACF,YAAA;;YAEA,MAAMa,gBAAAA,GAAmBvD,OAAOwB,OAAAA,EAASqB,KAAAA;AACzC,YAAA,IAAIU,gBAAAA,EAAkB;gBACpB,KAAK,MAAMxC,OAAOkC,cAAAA,CAAgB;AAChC,oBAAA,IAAIlC,OAAO8B,KAAAA,EAAO;wBAChB,MAAMd,SAAAA,GAAYwB,gBAAgB,CAACxC,GAAAA,CAAI;AACvC,wBAAA,IAAIgB,aAAa,OAAQA,SAAAA,CAA2BC,KAAK,KAAK,UAAA,EAAY;AACxE,4BAAA,MAAMC,SAAS,SAACF,CAA2BG,SAAS,CAACW,KAAK,CAAC9B,GAAAA,CAAI,CAAA;4BAC/D,IAAI,CAACkB,MAAAA,CAAOE,OAAO,EAAE;AACnB,gCAAA,MAAM,IAAIC,eAAAA,CACPH,OAAOI,KAAK,EAAEC,WAAsB,qBAAA,EACrC;AAAEvB,oCAAAA,GAAAA;oCAAKwB,IAAAA,EAAM,IAAA;oCAAMC,MAAAA,EAAQ,OAAA;oCAASC,KAAAA,EAAO1B;AAAI,iCAAA,CAAA;AAEnD,4BAAA;AACF,wBAAA;AACF,oBAAA;AACF,gBAAA;AACF,YAAA;AACF,QAAA;QAEA,MAAM,EAAEyC,OAAO,EAAEC,IAAI,EAAEC,MAAM,EAAEC,QAAQ,EAAE,GAAGd,KAAAA;AAE5C,QAAA,IAAIW,OAAAA,EAAS;YACX,MAAMI,eAAAA,CAAgBJ,SAAS3D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAChD,QAAA;AAEA,QAAA,IAAI0D,IAAAA,EAAM;YACR,MAAMI,YAAAA,CAAaJ,MAAM5D,MAAAA,EAAQ;AAAEE,gBAAAA;AAAK,aAAA,CAAA;AAC1C,QAAA;AAEA,QAAA,IAAI2D,MAAAA,EAAQ;AACV,YAAA,MAAMI,eAAeJ,MAAAA,EAAQ7D,MAAAA,CAAAA;AAC/B,QAAA;;QAGA,IAAI8D,QAAAA,IAAYA,aAAa,GAAA,EAAK;AAChC,YAAA,MAAMI,iBAAiBJ,QAAAA,EAAU9D,MAAAA,CAAAA;AACnC,QAAA;AACF,IAAA,CAAA;IAEA,MAAM+D,eAAAA,GAAgC,OAAOJ,OAAAA,EAAS3D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAChF,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,mCAAA,CAAA;AAClB,QAAA;QACA,IAAIC,KAAAA,CAAMC,OAAO,CAACqD,OAAAA,CAAAA,EAAU;YAC1B,MAAMpD,OAAAA,CAAQC,GAAG,CAACmD,OAAAA,CAAQlD,GAAG,CAAC,CAAC0D,MAAAA,GAAWJ,eAAAA,CAAgBI,MAAAA,EAAQnE,MAAAA,EAAQ;AAAEE,oBAAAA;AAAK,iBAAA,CAAA,CAAA,CAAA;AACjF,YAAA;AACF,QAAA;AAEA,QAAA,MAAMa,UAAAA,GAAa;AAACO,YAAAA,sBAAiC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAE5E,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACb+C,oBAAAA,CAAqBhD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AAC5DF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY4C,OAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOd,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,SAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMmB,YAAAA,GAA6B,OAAOJ,IAAAA,EAAM5D,MAAAA,EAAe,EAAEE,IAAI,EAAE,GAAG,EAAE,GAAA;AAC1E,QAAA,IAAI,CAACF,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,gCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,mBAA8B,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;AAEzE,QAAA,IAAIK,IAAAA,EAAM;AACRa,YAAAA,UAAAA,CAAWM,IAAI,CACbgD,iBAAAA,CAAkBjD,wBAAiC,CAAClB,IAAAA,CAAAA,EAAO;AACzDF,gBAAAA,MAAAA;AACAH,gBAAAA;AACF,aAAA,CAAA,CAAA;AAEJ,QAAA;QAEA,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY6C,IAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOf,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,MAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMoB,cAAAA,GAA+B,OAAOJ,MAAAA,EAAQ7D,MAAAA,GAAAA;AAClD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,kCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,qBAAgC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE3E,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY8C,MAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOhB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,QAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,MAAMqB,gBAAAA,GAAiC,OAAOJ,QAAAA,EAAU9D,MAAAA,GAAAA;AACtD,QAAA,IAAI,CAACA,MAAAA,EAAQ;AACX,YAAA,MAAM,IAAII,KAAAA,CAAM,oCAAA,CAAA;AAClB,QAAA;AACA,QAAA,MAAMW,UAAAA,GAAa;AAACO,YAAAA,uBAAkC,CAAC;AAAEtB,gBAAAA,MAAAA;AAAQH,gBAAAA;AAAS,aAAA;AAAG,SAAA;QAE7E,IAAI;AACF,YAAA,MAAM6B,QAAaX,UAAAA,CAAAA,CAAY+C,QAAAA,CAAAA;AACjC,QAAA,CAAA,CAAE,OAAOjB,CAAAA,EAAG;AACV,YAAA,IAAIA,aAAaN,eAAAA,EAAiB;gBAChCM,CAAAA,CAAEC,OAAO,CAACH,MAAM,GAAG,OAAA;gBACnBE,CAAAA,CAAEC,OAAO,CAACF,KAAK,GAAG,UAAA;AACpB,YAAA;YACA,MAAMC,CAAAA;AACR,QAAA;AACF,IAAA,CAAA;IAEA,OAAO;QACLtB,KAAAA,EAAOzB,aAAAA;QACPkD,KAAAA,EAAOD,aAAAA;QACPY,OAAAA,EAASI,eAAAA;QACTH,IAAAA,EAAMI,YAAAA;QACNH,MAAAA,EAAQI,cAAAA;QACRH,QAAAA,EAAUI;AACZ,KAAA;AACF;;;;"}

package/dist/validate/utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/validate/utils.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,eAAe,GAAI,wBAI7B;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAG,KAQH,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EAC/C,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAC7B,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAS/B,CAAC"}
+{"version":3,"file":"utils.d.ts","sourceRoot":"","sources":["../../src/validate/utils.ts"],"names":[],"mappings":"AAMA,eAAO,MAAM,eAAe,GAAI,wBAI7B;IACD,GAAG,EAAE,MAAM,CAAC;IACZ,IAAI,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACrB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,KAAG,KAQH,CAAC;AAEF,eAAO,MAAM,UAAU,GAAI,CAAC,SAAS,OAAO,EAAE,EAAE,CAAC,EAC/C,IAAI,CAAC,GAAG,IAAI,EAAE,CAAC,KAAK,OAAO,CAAC,CAAC,CAAC,KAC7B,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,CAAC,CAAC,CAAC,KAAK,GAAG,CAAoD,CAAC"}

package/dist/validate/utils.js

@@ -1,5 +1,6 @@
 'use strict';
 
+var curry = require('../curry.js');
 var errors = require('../errors.js');
 
 // Keep asynchronous return values in the types of partially applied functions.
@@ -12,15 +13,7 @@ const throwInvalidKey = ({ key, path, reason })=>{
         path
     });
 };
-const asyncCurry = (fn)=>{
-    const curried = (...args)=>{
-        if (args.length >= fn.length) {
-            return fn(...args);
-        }
-        return (...moreArgs)=>curried(...args, ...moreArgs);
-    };
-    return curried;
-};
+const asyncCurry = (fn)=>curry.curry(fn);
 
 exports.asyncCurry = asyncCurry;
 exports.throwInvalidKey = throwInvalidKey;

package/dist/validate/utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"utils.js","sources":["../../src/validate/utils.ts"],"sourcesContent":["// Keep asynchronous return values in the types of partially applied functions.\n// TODO: Export this from root @strapi/utils so we don't have copies of it between packages\n\nimport { ValidationError } from '../errors';\n\nexport const throwInvalidKey = ({\n  key,\n  path,\n  reason,\n}: {\n  key: string;\n  path?: string | null;\n  reason?: string;\n}): never => {\n  const location = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n  const msg = reason ? `${location}: ${reason}` : location;\n\n  throw new ValidationError(msg, {\n    key,\n    path,\n  });\n};\n\nexport const asyncCurry = <A extends unknown[], R>(\n  fn: (...args: A) => Promise<R>\n): ((...args: Partial<A>) => any) => {\n  const curried = (...args: unknown[]): unknown => {\n    if (args.length >= fn.length) {\n      return fn(...(args as A));\n    }\n    return (...moreArgs: unknown[]) => curried(...args, ...moreArgs);\n  };\n\n  return curried;\n};\n"],"names":["throwInvalidKey","key","path","reason","location","msg","ValidationError","asyncCurry","fn","curried","args","length","moreArgs"],"mappings":";;;;AAAA;AACA;AAIO,MAAMA,kBAAkB,CAAC,EAC9BC,GAAG,EACHC,IAAI,EACJC,MAAM,EAKP,GAAA;AACC,IAAA,MAAMC,QAAAA,GAAWF,IAAAA,IAAQA,IAAAA,KAASD,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAAA,CAAI,IAAI,EAAEC,IAAAA,CAAAA,CAAM,GAAG,CAAC,YAAY,EAAED,GAAAA,CAAAA,CAAK;AAC9F,IAAA,MAAMI,MAAMF,MAAAA,GAAS,CAAA,EAAGC,SAAS,EAAE,EAAED,QAAQ,GAAGC,QAAAA;IAEhD,MAAM,IAAIE,uBAAgBD,GAAAA,EAAK;AAC7BJ,QAAAA,GAAAA;AACAC,QAAAA;AACF,KAAA,CAAA;AACF;AAEO,MAAMK,aAAa,CACxBC,EAAAA,GAAAA;IAEA,MAAMC,OAAAA,GAAU,CAAC,GAAGC,IAAAA,GAAAA;AAClB,QAAA,IAAIA,IAAAA,CAAKC,MAAM,IAAIH,EAAAA,CAAGG,MAAM,EAAE;AAC5B,YAAA,OAAOH,EAAAA,CAAAA,GAAOE,IAAAA,CAAAA;AAChB,QAAA;AACA,QAAA,OAAO,CAAC,GAAGE,QAAAA,GAAwBH,OAAAA,CAAAA,GAAWC,IAAAA,EAAAA,GAASE,QAAAA,CAAAA;AACzD,IAAA,CAAA;IAEA,OAAOH,OAAAA;AACT;;;;;"}
+{"version":3,"file":"utils.js","sources":["../../src/validate/utils.ts"],"sourcesContent":["// Keep asynchronous return values in the types of partially applied functions.\n// TODO: Export this from root @strapi/utils so we don't have copies of it between packages\n\nimport { curry } from '../curry';\nimport { ValidationError } from '../errors';\n\nexport const throwInvalidKey = ({\n  key,\n  path,\n  reason,\n}: {\n  key: string;\n  path?: string | null;\n  reason?: string;\n}): never => {\n  const location = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n  const msg = reason ? `${location}: ${reason}` : location;\n\n  throw new ValidationError(msg, {\n    key,\n    path,\n  });\n};\n\nexport const asyncCurry = <A extends unknown[], R>(\n  fn: (...args: A) => Promise<R>\n): ((...args: Partial<A>) => any) => curry(fn as (...args: unknown[]) => Promise<R>);\n"],"names":["throwInvalidKey","key","path","reason","location","msg","ValidationError","asyncCurry","fn","curry"],"mappings":";;;;;AAAA;AACA;AAKO,MAAMA,kBAAkB,CAAC,EAC9BC,GAAG,EACHC,IAAI,EACJC,MAAM,EAKP,GAAA;AACC,IAAA,MAAMC,QAAAA,GAAWF,IAAAA,IAAQA,IAAAA,KAASD,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAAA,CAAI,IAAI,EAAEC,IAAAA,CAAAA,CAAM,GAAG,CAAC,YAAY,EAAED,GAAAA,CAAAA,CAAK;AAC9F,IAAA,MAAMI,MAAMF,MAAAA,GAAS,CAAA,EAAGC,SAAS,EAAE,EAAED,QAAQ,GAAGC,QAAAA;IAEhD,MAAM,IAAIE,uBAAgBD,GAAAA,EAAK;AAC7BJ,QAAAA,GAAAA;AACAC,QAAAA;AACF,KAAA,CAAA;AACF;AAEO,MAAMK,UAAAA,GAAa,CACxBC,EAAAA,GACmCC,YAAMD,EAAAA;;;;;"}

package/dist/validate/utils.mjs

@@ -1,3 +1,4 @@
+import { curry } from '../curry.mjs';
 import { ValidationError } from '../errors.mjs';
 
 // Keep asynchronous return values in the types of partially applied functions.
@@ -10,15 +11,7 @@ const throwInvalidKey = ({ key, path, reason })=>{
         path
     });
 };
-const asyncCurry = (fn)=>{
-    const curried = (...args)=>{
-        if (args.length >= fn.length) {
-            return fn(...args);
-        }
-        return (...moreArgs)=>curried(...args, ...moreArgs);
-    };
-    return curried;
-};
+const asyncCurry = (fn)=>curry(fn);
 
 export { asyncCurry, throwInvalidKey };
 //# sourceMappingURL=utils.mjs.map

package/dist/validate/utils.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"utils.mjs","sources":["../../src/validate/utils.ts"],"sourcesContent":["// Keep asynchronous return values in the types of partially applied functions.\n// TODO: Export this from root @strapi/utils so we don't have copies of it between packages\n\nimport { ValidationError } from '../errors';\n\nexport const throwInvalidKey = ({\n  key,\n  path,\n  reason,\n}: {\n  key: string;\n  path?: string | null;\n  reason?: string;\n}): never => {\n  const location = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n  const msg = reason ? `${location}: ${reason}` : location;\n\n  throw new ValidationError(msg, {\n    key,\n    path,\n  });\n};\n\nexport const asyncCurry = <A extends unknown[], R>(\n  fn: (...args: A) => Promise<R>\n): ((...args: Partial<A>) => any) => {\n  const curried = (...args: unknown[]): unknown => {\n    if (args.length >= fn.length) {\n      return fn(...(args as A));\n    }\n    return (...moreArgs: unknown[]) => curried(...args, ...moreArgs);\n  };\n\n  return curried;\n};\n"],"names":["throwInvalidKey","key","path","reason","location","msg","ValidationError","asyncCurry","fn","curried","args","length","moreArgs"],"mappings":";;AAAA;AACA;AAIO,MAAMA,kBAAkB,CAAC,EAC9BC,GAAG,EACHC,IAAI,EACJC,MAAM,EAKP,GAAA;AACC,IAAA,MAAMC,QAAAA,GAAWF,IAAAA,IAAQA,IAAAA,KAASD,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAAA,CAAI,IAAI,EAAEC,IAAAA,CAAAA,CAAM,GAAG,CAAC,YAAY,EAAED,GAAAA,CAAAA,CAAK;AAC9F,IAAA,MAAMI,MAAMF,MAAAA,GAAS,CAAA,EAAGC,SAAS,EAAE,EAAED,QAAQ,GAAGC,QAAAA;IAEhD,MAAM,IAAIE,gBAAgBD,GAAAA,EAAK;AAC7BJ,QAAAA,GAAAA;AACAC,QAAAA;AACF,KAAA,CAAA;AACF;AAEO,MAAMK,aAAa,CACxBC,EAAAA,GAAAA;IAEA,MAAMC,OAAAA,GAAU,CAAC,GAAGC,IAAAA,GAAAA;AAClB,QAAA,IAAIA,IAAAA,CAAKC,MAAM,IAAIH,EAAAA,CAAGG,MAAM,EAAE;AAC5B,YAAA,OAAOH,EAAAA,CAAAA,GAAOE,IAAAA,CAAAA;AAChB,QAAA;AACA,QAAA,OAAO,CAAC,GAAGE,QAAAA,GAAwBH,OAAAA,CAAAA,GAAWC,IAAAA,EAAAA,GAASE,QAAAA,CAAAA;AACzD,IAAA,CAAA;IAEA,OAAOH,OAAAA;AACT;;;;"}
+{"version":3,"file":"utils.mjs","sources":["../../src/validate/utils.ts"],"sourcesContent":["// Keep asynchronous return values in the types of partially applied functions.\n// TODO: Export this from root @strapi/utils so we don't have copies of it between packages\n\nimport { curry } from '../curry';\nimport { ValidationError } from '../errors';\n\nexport const throwInvalidKey = ({\n  key,\n  path,\n  reason,\n}: {\n  key: string;\n  path?: string | null;\n  reason?: string;\n}): never => {\n  const location = path && path !== key ? `Invalid key ${key} at ${path}` : `Invalid key ${key}`;\n  const msg = reason ? `${location}: ${reason}` : location;\n\n  throw new ValidationError(msg, {\n    key,\n    path,\n  });\n};\n\nexport const asyncCurry = <A extends unknown[], R>(\n  fn: (...args: A) => Promise<R>\n): ((...args: Partial<A>) => any) => curry(fn as (...args: unknown[]) => Promise<R>);\n"],"names":["throwInvalidKey","key","path","reason","location","msg","ValidationError","asyncCurry","fn","curry"],"mappings":";;;AAAA;AACA;AAKO,MAAMA,kBAAkB,CAAC,EAC9BC,GAAG,EACHC,IAAI,EACJC,MAAM,EAKP,GAAA;AACC,IAAA,MAAMC,QAAAA,GAAWF,IAAAA,IAAQA,IAAAA,KAASD,GAAAA,GAAM,CAAC,YAAY,EAAEA,GAAAA,CAAI,IAAI,EAAEC,IAAAA,CAAAA,CAAM,GAAG,CAAC,YAAY,EAAED,GAAAA,CAAAA,CAAK;AAC9F,IAAA,MAAMI,MAAMF,MAAAA,GAAS,CAAA,EAAGC,SAAS,EAAE,EAAED,QAAQ,GAAGC,QAAAA;IAEhD,MAAM,IAAIE,gBAAgBD,GAAAA,EAAK;AAC7BJ,QAAAA,GAAAA;AACAC,QAAAA;AACF,KAAA,CAAA;AACF;AAEO,MAAMK,UAAAA,GAAa,CACxBC,EAAAA,GACmCC,MAAMD,EAAAA;;;;"}

package/dist/validate/validators.mjs

@@ -1,15 +1,15 @@
-import { isEmpty, isObject } from 'lodash';
+import { isObject, isEmpty } from 'lodash';
 import { pipe } from '../async.mjs';
 import { constants, isScalarAttribute, isDynamicZoneAttribute, isMorphToRelationalAttribute } from '../content-types.mjs';
 import traverseQueryFilters from '../traverse/query-filters.mjs';
 import traverseQuerySort from '../traverse/query-sort.mjs';
 import traverseQueryPopulate from '../traverse/query-populate.mjs';
 import traverseQueryFields from '../traverse/query-fields.mjs';
-import visitor$2 from './visitors/throw-password.mjs';
-import visitor$3 from './visitors/throw-private.mjs';
+import visitor$1 from './visitors/throw-password.mjs';
+import visitor from './visitors/throw-private.mjs';
 import './visitors/throw-restricted-relations.mjs';
-import visitor$1 from './visitors/throw-morph-to-relations.mjs';
-import visitor from './visitors/throw-dynamic-zones.mjs';
+import visitor$3 from './visitors/throw-morph-to-relations.mjs';
+import visitor$2 from './visitors/throw-dynamic-zones.mjs';
 import { asyncCurry, throwInvalidKey } from './utils.mjs';
 import { isOperator } from '../operators.mjs';
 import { isBooleanLike } from '../parse-type.mjs';
@@ -50,16 +50,16 @@ const validateFilters = asyncCurry(async (ctx, filters, include)=>{
         }, ctx));
     }
     if (include.includes('dynamicZones')) {
-        functionsToApply.push(traverseQueryFilters(visitor, ctx));
+        functionsToApply.push(traverseQueryFilters(visitor$2, ctx));
     }
     if (include.includes('morphRelations')) {
-        functionsToApply.push(traverseQueryFilters(visitor$1, ctx));
+        functionsToApply.push(traverseQueryFilters(visitor$3, ctx));
     }
     if (include.includes('passwords')) {
-        functionsToApply.push(traverseQueryFilters(visitor$2, ctx));
+        functionsToApply.push(traverseQueryFilters(visitor$1, ctx));
     }
     if (include.includes('private')) {
-        functionsToApply.push(traverseQueryFilters(visitor$3, ctx));
+        functionsToApply.push(traverseQueryFilters(visitor, ctx));
     }
     // Return directly if no validation functions are provided
     if (functionsToApply.length === 0) {
@@ -109,19 +109,19 @@ const validateSort = asyncCurry(async (ctx, sort, include)=>{
     }
     // Validate dynamic zones from sort
     if (include.includes('dynamicZones')) {
-        functionsToApply.push(traverseQuerySort(visitor, ctx));
+        functionsToApply.push(traverseQuerySort(visitor$2, ctx));
     }
     // Validate morphTo relations from sort
     if (include.includes('morphRelations')) {
-        functionsToApply.push(traverseQuerySort(visitor$1, ctx));
+        functionsToApply.push(traverseQuerySort(visitor$3, ctx));
     }
     // Validate passwords from sort
     if (include.includes('passwords')) {
-        functionsToApply.push(traverseQuerySort(visitor$2, ctx));
+        functionsToApply.push(traverseQuerySort(visitor$1, ctx));
     }
     // Validate private from sort
     if (include.includes('private')) {
-        functionsToApply.push(traverseQuerySort(visitor$3, ctx));
+        functionsToApply.push(traverseQuerySort(visitor, ctx));
     }
     // Validate non-scalar empty keys
     if (include.includes('nonScalarEmptyKeys')) {
@@ -183,11 +183,11 @@ const validateFields = asyncCurry(async (ctx, fields, include)=>{
     }
     // Private fields
     if (include.includes('privateFields')) {
-        functionsToApply.push(traverseQueryFields(visitor$3, ctx));
+        functionsToApply.push(traverseQueryFields(visitor, ctx));
     }
     // Password fields
     if (include.includes('passwordFields')) {
-        functionsToApply.push(traverseQueryFields(visitor$2, ctx));
+        functionsToApply.push(traverseQueryFields(visitor$1, ctx));
     }
     // Return directly if no validation functions are provided
     if (functionsToApply.length === 0) {
@@ -356,7 +356,7 @@ const validatePopulate = asyncCurry(async (ctx, populate, includes)=>{
             getModel: ctx.getModel
         }, populate);
         if (includes?.populate?.includes('private')) {
-            return traverseQueryPopulate(visitor$3, ctx)(populate);
+            return traverseQueryPopulate(visitor, ctx)(populate);
         }
         return populate;
     }
@@ -488,7 +488,7 @@ const validatePopulate = asyncCurry(async (ctx, populate, includes)=>{
     }, ctx));
     // Conditionally traverse for private fields only if 'private' is included
     if (includes?.populate?.includes('private')) {
-        functionsToApply.push(traverseQueryPopulate(visitor$3, ctx));
+        functionsToApply.push(traverseQueryPopulate(visitor, ctx));
     }
     // Return directly if no validation functions are provided
     if (functionsToApply.length === 0) {

package/dist/validate/validators.mjs.map

@@ -1 +1 @@
-{"version":3,"file":"validators.mjs","sources":["../../src/validate/validators.ts"],"sourcesContent":["import { isEmpty, isObject } from 'lodash';\n\nimport { pipe as pipeAsync } from '../async';\nimport {\n  isScalarAttribute,\n  constants,\n  isDynamicZoneAttribute,\n  isMorphToRelationalAttribute,\n} from '../content-types';\nimport {\n  traverseQueryFilters,\n  traverseQuerySort,\n  traverseQueryFields,\n  traverseQueryPopulate,\n} from '../traverse';\nimport { throwPassword, throwPrivate, throwDynamicZones, throwMorphToRelations } from './visitors';\nimport { isOperator } from '../operators';\nimport { asyncCurry, throwInvalidKey } from './utils';\nimport type { Attribute, Model } from '../types';\nimport { isBooleanLike } from '../parse-type';\nimport type { SHARED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport type { Parent, Path } from '../traverse/factory';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\ninterface Context {\n  schema: Model;\n  getModel: (model: string) => Model;\n}\n\ninterface PopulateContext extends Context {\n  path?: Path;\n  parent?: Parent;\n}\n\ntype AnyFunc = (...args: any[]) => any;\n\nexport const FILTER_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n];\n\nexport const validateFilters = asyncCurry(\n  async (ctx: Context, filters: unknown, include: (typeof FILTER_TRAVERSALS)[number][]) => {\n    // TODO: schema checks should check that it is a valid schema with yup\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFilters');\n    }\n\n    // Build the list of functions conditionally\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // keys that are not attributes or valid operators\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQueryFilters(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          const isAttribute = !!attribute;\n\n          if (!isAttribute && !isOperator(key)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQueryFilters(throwDynamicZones, ctx));\n    }\n\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQueryFilters(throwMorphToRelations, ctx));\n    }\n\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQueryFilters(throwPassword, ctx));\n    }\n\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQueryFilters(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return filters;\n    }\n\n    return pipeAsync(...functionsToApply)(filters);\n  }\n);\n\nexport const defaultValidateFilters = asyncCurry(async (ctx: Context, filters: unknown) => {\n  return validateFilters(ctx, filters, FILTER_TRAVERSALS);\n});\n\nexport const SORT_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n  'nonScalarEmptyKeys',\n];\n\nexport const validateSort = asyncCurry(\n  async (ctx: Context, sort: unknown, include: (typeof SORT_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateSort');\n    }\n\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Validate non attribute keys\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          // status is a virtual sort key for D&P-enabled content types\n          if (key === 'status' && ctx.schema?.options?.draftAndPublish) {\n            return;\n          }\n\n          if (!attribute) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Validate dynamic zones from sort\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQuerySort(throwDynamicZones, ctx));\n    }\n\n    // Validate morphTo relations from sort\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQuerySort(throwMorphToRelations, ctx));\n    }\n\n    // Validate passwords from sort\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQuerySort(throwPassword, ctx));\n    }\n\n    // Validate private from sort\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQuerySort(throwPrivate, ctx));\n    }\n\n    // Validate non-scalar empty keys\n    if (include.includes('nonScalarEmptyKeys')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, value, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (!isScalarAttribute(attribute) && isEmpty(value)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return sort;\n    }\n\n    return pipeAsync(...functionsToApply)(sort);\n  }\n);\n\nexport const defaultValidateSort = asyncCurry(async (ctx: Context, sort: unknown) => {\n  return validateSort(ctx, sort, SORT_TRAVERSALS);\n});\n\nexport const FIELDS_TRAVERSALS = ['scalarAttributes', 'privateFields', 'passwordFields'];\n\nexport const validateFields = asyncCurry(\n  async (ctx: Context, fields: unknown, include: (typeof FIELDS_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFields');\n    }\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Only allow scalar attributes\n    if (include.includes('scalarAttributes')) {\n      functionsToApply.push(\n        traverseQueryFields(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not throwing because of it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (attribute == null || !isScalarAttribute(attribute)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Private fields\n    if (include.includes('privateFields')) {\n      functionsToApply.push(traverseQueryFields(throwPrivate, ctx));\n    }\n\n    // Password fields\n    if (include.includes('passwordFields')) {\n      functionsToApply.push(traverseQueryFields(throwPassword, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return fields;\n    }\n\n    return pipeAsync(...functionsToApply)(fields);\n  }\n);\n\nexport const defaultValidateFields = asyncCurry(async (ctx: Context, fields: unknown) => {\n  return validateFields(ctx, fields, FIELDS_TRAVERSALS);\n});\n\nconst isMorphLikeAttribute = (attribute?: Attribute) =>\n  isDynamicZoneAttribute(attribute) || isMorphToRelationalAttribute(attribute);\n\nconst isPopulatableAttribute = (attribute?: Attribute) =>\n  !!attribute && ['relation', 'dynamiczone', 'component', 'media'].includes(attribute.type);\n\nconst isDotNotationPopulate = (populate: unknown): populate is string | string[] => {\n  if (populate === '*') {\n    return false;\n  }\n\n  if (typeof populate === 'string') {\n    return true;\n  }\n\n  return (\n    Array.isArray(populate) && populate.length > 0 && populate.every((p) => typeof p === 'string')\n  );\n};\n\nconst flattenDotPopulatePaths = (populate: string | string[]) => {\n  const items = Array.isArray(populate) ? populate : [populate];\n\n  return items.flatMap((item) =>\n    item\n      .split(',')\n      .map((segment) => segment.trim())\n      .filter(Boolean)\n  );\n};\n\nconst validatePopulateDotPathSegments = (\n  { schema, getModel }: { schema: Model; getModel: (uid: string) => Model },\n  segments: string[],\n  pathPrefix: string\n) => {\n  if (!segments.length) {\n    return;\n  }\n\n  const [head, ...tail] = segments;\n  const fullPath = pathPrefix ? `${pathPrefix}.${head}` : head;\n  const attribute = schema.attributes[head];\n\n  if (!attribute || !isPopulatableAttribute(attribute)) {\n    throwInvalidKey({ key: head, path: fullPath });\n  }\n\n  if (!tail.length) {\n    return;\n  }\n\n  if (attribute.type === 'component') {\n    if (!attribute.component) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    validatePopulateDotPathSegments(\n      { schema: getModel(attribute.component), getModel },\n      tail,\n      fullPath\n    );\n    return;\n  }\n\n  if (attribute.type === 'relation') {\n    if (isMorphLikeAttribute(attribute)) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    if (!attribute.target) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    validatePopulateDotPathSegments(\n      { schema: getModel(attribute.target!), getModel },\n      tail,\n      fullPath\n    );\n    return;\n  }\n\n  if (attribute.type === 'media') {\n    throwInvalidKey({ key: head, path: fullPath });\n  }\n\n  if (attribute.type === 'dynamiczone') {\n    const [nextSegment, ...rest] = tail;\n    const nextPath = `${fullPath}.${nextSegment}`;\n    const candidates = (attribute.components ?? [])\n      .map((uid) => getModel(uid))\n      .filter((model) => model?.attributes?.[nextSegment]);\n\n    if (!candidates.length) {\n      throwInvalidKey({ key: nextSegment, path: nextPath });\n    }\n\n    let validated = false;\n\n    for (const componentSchema of candidates) {\n      const nestedAttribute = componentSchema.attributes[nextSegment];\n\n      try {\n        if (!rest.length) {\n          if (nestedAttribute) {\n            validated = true;\n            break;\n          }\n        } else if (nestedAttribute?.type === 'component' && nestedAttribute.component) {\n          validatePopulateDotPathSegments(\n            { schema: getModel(nestedAttribute.component), getModel },\n            rest,\n            nextPath\n          );\n          validated = true;\n          break;\n        } else if (\n          nestedAttribute?.type === 'relation' &&\n          !isMorphLikeAttribute(nestedAttribute) &&\n          nestedAttribute.target\n        ) {\n          validatePopulateDotPathSegments(\n            { schema: getModel(nestedAttribute.target), getModel },\n            rest,\n            nextPath\n          );\n          validated = true;\n          break;\n        }\n      } catch {\n        // Try the next dynamic-zone component type.\n      }\n    }\n\n    if (!validated) {\n      throwInvalidKey({ key: nextSegment, path: nextPath });\n    }\n  }\n};\n\nconst validatePopulateDotPaths = (\n  ctx: { schema: Model; getModel: (uid: string) => Model },\n  populate: string | string[]\n) => {\n  for (const path of flattenDotPopulatePaths(populate)) {\n    const segments = path\n      .split('.')\n      .map((segment) => segment.trim())\n      .filter(Boolean);\n\n    validatePopulateDotPathSegments(ctx, segments, '');\n  }\n};\n\nconst validateMorphLikeNestedPopulate = (\n  populateValue: unknown,\n  { path }: { path: string | null }\n) => {\n  // Keep in sync with convert-query-params polymorphic nested populate handling.\n  if (populateValue != null && populateValue !== '*') {\n    throwInvalidKey({ key: 'populate', path });\n  }\n};\n\nexport const POPULATE_TRAVERSALS = ['nonAttributesOperators', 'private'];\n\n// Query params that only apply at the root of a query. They are inherited by populated\n// relations, so they are rejected inside `populate` with an explanation (see #21911).\nconst ROOT_ONLY_QUERY_PARAMS: ReadonlyArray<(typeof SHARED_QUERY_PARAM_KEYS)[number]> = [\n  'status',\n  'publicationFilter',\n  'hasPublishedVersion',\n];\n\nexport const validatePopulate = asyncCurry(\n  async (\n    ctx: PopulateContext,\n    populate: unknown,\n    includes: {\n      fields?: (typeof FIELDS_TRAVERSALS)[number][];\n      sort?: (typeof SORT_TRAVERSALS)[number][];\n      filters?: (typeof FILTER_TRAVERSALS)[number][];\n      populate?: (typeof POPULATE_TRAVERSALS)[number][];\n    }\n  ) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidatePopulate');\n    }\n\n    if (isDotNotationPopulate(populate)) {\n      validatePopulateDotPaths({ schema: ctx.schema, getModel: ctx.getModel }, populate);\n\n      if (includes?.populate?.includes('private')) {\n        return traverseQueryPopulate(throwPrivate, ctx)(populate);\n      }\n\n      return populate;\n    }\n\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Always include the main traversal function\n    functionsToApply.push(\n      traverseQueryPopulate(\n        async ({ key, path, value, schema, attribute, getModel, parent }, { set }) => {\n          /**\n           * NOTE: The parent check is done to support \"filters\" (and the rest of keys) as valid attribute names.\n           *\n           * The parent will not be an attribute when its a \"populate\" / \"filters\" / \"sort\" ... key.\n           * Only in those scenarios the node will be an attribute.\n           */\n          if (!parent?.attribute && attribute) {\n            const isPopulatableAttribute = [\n              'relation',\n              'dynamiczone',\n              'component',\n              'media',\n            ].includes(attribute.type);\n\n            if (isMorphLikeAttribute(attribute) && isObject(value) && 'populate' in value) {\n              validateMorphLikeNestedPopulate((value as Record<string, unknown>).populate, {\n                path: path.raw,\n              });\n            }\n\n            // Throw on non-populate attributes\n            if (!isPopulatableAttribute) {\n              throwInvalidKey({ key, path: path.raw });\n            }\n\n            // Valid populatable attribute, so return\n            return;\n          }\n\n          // If we're looking at a populate fragment, ensure its target is valid\n          if (key === 'on') {\n            // Populate fragment should always be an object\n            if (!isObject(value)) {\n              return throwInvalidKey({ key, path: path.raw });\n            }\n\n            const targets = Object.keys(value);\n\n            for (const target of targets) {\n              const model = getModel(target);\n\n              // If a target is invalid (no matching model), then raise an error\n              if (!model) {\n                throwInvalidKey({ key: target, path: `${path.raw}.${target}` });\n              }\n            }\n\n            // If the fragment's target is fine, then let it pass\n            return;\n          }\n\n          // Ignore plain wildcards\n          if (key === '' && value === '*') {\n            return;\n          }\n\n          // Ensure count is a boolean\n          if (key === 'count') {\n            if (isBooleanLike(value)) {\n              return;\n            }\n\n            throwInvalidKey({ key, path: path.attribute });\n          }\n\n          // Allowed boolean-like keywords should be ignored.\n          //\n          // Asked as a predicate rather than by catching `parseType`'s error: this runs\n          // once per populate key, and almost no key is boolean-like, so the previous\n          // try/catch built and threw away an Error — including a stack capture — on\n          // essentially every key of every populate tree of every request.\n          if (isBooleanLike(key)) {\n            return;\n          }\n\n          // Handle nested `sort` validation with custom or default traversals\n          if (key === 'sort') {\n            set(\n              key,\n              await validateSort(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the sort value\n                includes?.sort || SORT_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `filters` validation with custom or default traversals\n          if (key === 'filters') {\n            set(\n              key,\n              await validateFilters(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the filters value\n                includes?.filters || FILTER_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `fields` validation with custom or default traversals\n          if (key === 'fields') {\n            set(\n              key,\n              await validateFields(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the fields value\n                includes?.fields || FIELDS_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle recursive nested `populate` validation with the same include object\n          if (key === 'populate') {\n            set(\n              key,\n              await validatePopulate(\n                {\n                  schema,\n                  getModel,\n                  parent: { key, path, schema, attribute },\n                  path,\n                },\n                value, // pass the nested populate value\n                includes // pass down the same includes object\n              )\n            );\n            return;\n          }\n\n          // Throw an error if non-attribute operators are included in the populate array\n          if (includes?.populate?.includes('nonAttributesOperators')) {\n            throwInvalidKey({\n              key,\n              path: path.attribute,\n              reason: ROOT_ONLY_QUERY_PARAMS.some((param) => param === key)\n                ? `${key} is only accepted at the root of the query, and it also applies to populated relations`\n                : undefined,\n            });\n          }\n        },\n        ctx\n      )\n    );\n\n    // Conditionally traverse for private fields only if 'private' is included\n    if (includes?.populate?.includes('private')) {\n      functionsToApply.push(traverseQueryPopulate(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return populate;\n    }\n\n    return pipeAsync(...functionsToApply)(populate);\n  }\n);\n\nexport const defaultValidatePopulate = asyncCurry(async (ctx: Context, populate: unknown) => {\n  if (!ctx.schema) {\n    throw new Error('Missing schema in defaultValidatePopulate');\n  }\n\n  // Call validatePopulate and include all validations by passing in full traversal arrays\n  return validatePopulate(ctx, populate, {\n    filters: FILTER_TRAVERSALS,\n    sort: SORT_TRAVERSALS,\n    fields: FIELDS_TRAVERSALS,\n    populate: POPULATE_TRAVERSALS,\n  });\n});\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","FILTER_TRAVERSALS","validateFilters","asyncCurry","ctx","filters","include","schema","Error","functionsToApply","includes","push","traverseQueryFilters","key","attribute","path","isAttribute","isOperator","throwInvalidKey","throwDynamicZones","throwMorphToRelations","throwPassword","throwPrivate","length","pipeAsync","defaultValidateFilters","SORT_TRAVERSALS","validateSort","sort","traverseQuerySort","options","draftAndPublish","value","isScalarAttribute","isEmpty","defaultValidateSort","FIELDS_TRAVERSALS","validateFields","fields","traverseQueryFields","defaultValidateFields","isMorphLikeAttribute","isDynamicZoneAttribute","isMorphToRelationalAttribute","isPopulatableAttribute","type","isDotNotationPopulate","populate","Array","isArray","every","p","flattenDotPopulatePaths","items","flatMap","item","split","map","segment","trim","filter","Boolean","validatePopulateDotPathSegments","getModel","segments","pathPrefix","head","tail","fullPath","attributes","component","target","nextSegment","rest","nextPath","candidates","components","uid","model","validated","componentSchema","nestedAttribute","validatePopulateDotPaths","validateMorphLikeNestedPopulate","populateValue","POPULATE_TRAVERSALS","ROOT_ONLY_QUERY_PARAMS","validatePopulate","traverseQueryPopulate","parent","set","isObject","raw","targets","Object","keys","isBooleanLike","reason","some","param","undefined","defaultValidatePopulate"],"mappings":";;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;MAc9BC,iBAAAA,GAAoB;AAC/B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA;;AAGK,MAAMC,eAAAA,GAAkBC,UAAAA,CAC7B,OAAOC,KAAcC,OAAAA,EAAkBC,OAAAA,GAAAA;;IAErC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,0CAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAAA,CAAA,EAA2B;QAC9CD,gBAAAA,CAAiBE,IAAI,CACnBC,oBAAAA,CAAqB,CAAC,EAAEC,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG5C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;YAEA,MAAMG,WAAAA,GAAc,CAAC,CAACF,SAAAA;AAEtB,YAAA,IAAI,CAACE,WAAAA,IAAe,CAACC,UAAAA,CAAWJ,GAAAA,CAAAA,EAAM;gBACpCK,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAA,CAAA,EAAiB;QACpCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBO,OAAAA,EAAmBf,GAAAA,CAAAA,CAAAA;AAChE,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBQ,SAAAA,EAAuBhB,GAAAA,CAAAA,CAAAA;AACpE,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAA,CAAA,EAAc;QACjCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBS,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AAC5D,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAA,CAAA,EAAY;QAC/BD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBU,SAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC3D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOlB,OAAAA;AACT,IAAA;AAEA,IAAA,OAAOmB,QAAaf,gBAAAA,CAAAA,CAAkBJ,OAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMoB,sBAAAA,GAAyBtB,UAAAA,CAAW,OAAOC,GAAAA,EAAcC,OAAAA,GAAAA;IACpE,OAAOH,eAAAA,CAAgBE,KAAKC,OAAAA,EAASJ,iBAAAA,CAAAA;AACvC,CAAA;MAEayB,eAAAA,GAAkB;AAC7B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA;;AAGK,MAAMC,YAAAA,GAAexB,UAAAA,CAC1B,OAAOC,KAAcwB,IAAAA,EAAetB,OAAAA,GAAAA;IAClC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,uCAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAAA,CAAA,EAA2B;QAC9CD,gBAAAA,CAAiBE,IAAI,CACnBkB,iBAAAA,CAAkB,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAGzC,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;;AAGA,YAAA,IAAIA,QAAQ,QAAA,IAAYT,GAAAA,CAAIG,MAAM,EAAEuB,SAASC,eAAAA,EAAiB;AAC5D,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACjB,SAAAA,EAAW;gBACdI,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAA,CAAA,EAAiB;QACpCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBV,OAAAA,EAAmBf,GAAAA,CAAAA,CAAAA;AAC7D,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBT,SAAAA,EAAuBhB,GAAAA,CAAAA,CAAAA;AACjE,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAA,CAAA,EAAc;QACjCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBR,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AACzD,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAA,CAAA,EAAY;QAC/BD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBP,SAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AACxD,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,oBAAA,CAAA,EAAuB;AAC1CD,QAAAA,gBAAAA,CAAiBE,IAAI,CACnBkB,iBAAAA,CAAkB,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEkB,KAAK,EAAEjB,IAAI,EAAE,GAAA;;;YAGhD,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACoB,iBAAAA,CAAkBnB,SAAAA,CAAAA,IAAcoB,OAAAA,CAAQF,KAAAA,CAAAA,EAAQ;gBACnDd,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOK,IAAAA;AACT,IAAA;AAEA,IAAA,OAAOJ,QAAaf,gBAAAA,CAAAA,CAAkBmB,IAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMO,mBAAAA,GAAsBhC,UAAAA,CAAW,OAAOC,GAAAA,EAAcwB,IAAAA,GAAAA;IACjE,OAAOD,YAAAA,CAAavB,KAAKwB,IAAAA,EAAMF,eAAAA,CAAAA;AACjC,CAAA;MAEaU,iBAAAA,GAAoB;AAAC,IAAA,kBAAA;AAAoB,IAAA,eAAA;AAAiB,IAAA;;AAEhE,MAAMC,cAAAA,GAAiBlC,UAAAA,CAC5B,OAAOC,KAAckC,MAAAA,EAAiBhC,OAAAA,GAAAA;IACpC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,yCAAA,CAAA;AAClB,IAAA;;AAEA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,kBAAA,CAAA,EAAqB;QACxCD,gBAAAA,CAAiBE,IAAI,CACnB4B,mBAAAA,CAAoB,CAAC,EAAE1B,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG3C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;AAEA,YAAA,IAAIC,SAAAA,IAAa,IAAA,IAAQ,CAACmB,iBAAAA,CAAkBnB,SAAAA,CAAAA,EAAY;gBACtDI,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,eAAA,CAAA,EAAkB;QACrCD,gBAAAA,CAAiBE,IAAI,CAAC4B,mBAAAA,CAAoBjB,SAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC1D,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAAC4B,mBAAAA,CAAoBlB,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AAC3D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOe,MAAAA;AACT,IAAA;AAEA,IAAA,OAAOd,QAAaf,gBAAAA,CAAAA,CAAkB6B,MAAAA,CAAAA;AACxC,CAAA;AAGK,MAAME,qBAAAA,GAAwBrC,UAAAA,CAAW,OAAOC,GAAAA,EAAckC,MAAAA,GAAAA;IACnE,OAAOD,cAAAA,CAAejC,KAAKkC,MAAAA,EAAQF,iBAAAA,CAAAA;AACrC,CAAA;AAEA,MAAMK,oBAAAA,GAAuB,CAAC3B,SAAAA,GAC5B4B,sBAAAA,CAAuB5B,cAAc6B,4BAAAA,CAA6B7B,SAAAA,CAAAA;AAEpE,MAAM8B,sBAAAA,GAAyB,CAAC9B,SAAAA,GAC9B,CAAC,CAACA,SAAAA,IAAa;AAAC,QAAA,UAAA;AAAY,QAAA,aAAA;AAAe,QAAA,WAAA;AAAa,QAAA;KAAQ,CAACJ,QAAQ,CAACI,SAAAA,CAAU+B,IAAI,CAAA;AAE1F,MAAMC,wBAAwB,CAACC,QAAAA,GAAAA;AAC7B,IAAA,IAAIA,aAAa,GAAA,EAAK;QACpB,OAAO,KAAA;AACT,IAAA;IAEA,IAAI,OAAOA,aAAa,QAAA,EAAU;QAChC,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,KAAAA,CAAMC,OAAO,CAACF,QAAAA,CAAAA,IAAaA,SAASxB,MAAM,GAAG,CAAA,IAAKwB,QAAAA,CAASG,KAAK,CAAC,CAACC,CAAAA,GAAM,OAAOA,CAAAA,KAAM,QAAA,CAAA;AAEzF,CAAA;AAEA,MAAMC,0BAA0B,CAACL,QAAAA,GAAAA;AAC/B,IAAA,MAAMM,KAAAA,GAAQL,KAAAA,CAAMC,OAAO,CAACF,YAAYA,QAAAA,GAAW;AAACA,QAAAA;AAAS,KAAA;AAE7D,IAAA,OAAOM,MAAMC,OAAO,CAAC,CAACC,IAAAA,GACpBA,KACGC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,QAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAACC,OAAAA,CAAAA,CAAAA;AAEd,CAAA;AAEA,MAAMC,+BAAAA,GAAkC,CACtC,EAAEvD,MAAM,EAAEwD,QAAQ,EAAuD,EACzEC,QAAAA,EACAC,UAAAA,GAAAA;IAEA,IAAI,CAACD,QAAAA,CAASzC,MAAM,EAAE;AACpB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,CAAC2C,IAAAA,EAAM,GAAGC,IAAAA,CAAK,GAAGH,QAAAA;AACxB,IAAA,MAAMI,WAAWH,UAAAA,GAAa,CAAA,EAAGA,WAAW,CAAC,EAAEC,MAAM,GAAGA,IAAAA;AACxD,IAAA,MAAMpD,SAAAA,GAAYP,MAAAA,CAAO8D,UAAU,CAACH,IAAAA,CAAK;AAEzC,IAAA,IAAI,CAACpD,SAAAA,IAAa,CAAC8B,sBAAAA,CAAuB9B,SAAAA,CAAAA,EAAY;QACpDI,eAAAA,CAAgB;YAAEL,GAAAA,EAAKqD,IAAAA;YAAMnD,IAAAA,EAAMqD;AAAS,SAAA,CAAA;AAC9C,IAAA;IAEA,IAAI,CAACD,IAAAA,CAAK5C,MAAM,EAAE;AAChB,QAAA;AACF,IAAA;IAEA,IAAIT,SAAAA,CAAU+B,IAAI,KAAK,WAAA,EAAa;QAClC,IAAI,CAAC/B,SAAAA,CAAUwD,SAAS,EAAE;YACxBpD,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEAN,+BAAAA,CACE;YAAEvD,MAAAA,EAAQwD,QAAAA,CAASjD,UAAUwD,SAAS,CAAA;AAAGP,YAAAA;AAAS,SAAA,EAClDI,IAAAA,EACAC,QAAAA,CAAAA;AAEF,QAAA;AACF,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,UAAA,EAAY;AACjC,QAAA,IAAIJ,qBAAqB3B,SAAAA,CAAAA,EAAY;YACnCI,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEA,IAAI,CAACtD,SAAAA,CAAUyD,MAAM,EAAE;YACrBrD,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEAN,+BAAAA,CACE;YAAEvD,MAAAA,EAAQwD,QAAAA,CAASjD,UAAUyD,MAAM,CAAA;AAAIR,YAAAA;AAAS,SAAA,EAChDI,IAAAA,EACAC,QAAAA,CAAAA;AAEF,QAAA;AACF,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,OAAA,EAAS;QAC9B3B,eAAAA,CAAgB;YAAEL,GAAAA,EAAKqD,IAAAA;YAAMnD,IAAAA,EAAMqD;AAAS,SAAA,CAAA;AAC9C,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,aAAA,EAAe;AACpC,QAAA,MAAM,CAAC2B,WAAAA,EAAa,GAAGC,IAAAA,CAAK,GAAGN,IAAAA;AAC/B,QAAA,MAAMO,QAAAA,GAAW,CAAA,EAAGN,QAAAA,CAAS,CAAC,EAAEI,WAAAA,CAAAA,CAAa;QAC7C,MAAMG,UAAAA,GAAa,CAAC7D,SAAAA,CAAU8D,UAAU,IAAI,EAAE,EAC3CnB,GAAG,CAAC,CAACoB,GAAAA,GAAQd,QAAAA,CAASc,MACtBjB,MAAM,CAAC,CAACkB,KAAAA,GAAUA,KAAAA,EAAOT,UAAAA,GAAaG,WAAAA,CAAY,CAAA;QAErD,IAAI,CAACG,UAAAA,CAAWpD,MAAM,EAAE;YACtBL,eAAAA,CAAgB;gBAAEL,GAAAA,EAAK2D,WAAAA;gBAAazD,IAAAA,EAAM2D;AAAS,aAAA,CAAA;AACrD,QAAA;AAEA,QAAA,IAAIK,SAAAA,GAAY,KAAA;QAEhB,KAAK,MAAMC,mBAAmBL,UAAAA,CAAY;AACxC,YAAA,MAAMM,eAAAA,GAAkBD,eAAAA,CAAgBX,UAAU,CAACG,WAAAA,CAAY;YAE/D,IAAI;gBACF,IAAI,CAACC,IAAAA,CAAKlD,MAAM,EAAE;AAChB,oBAAA,IAAI0D,eAAAA,EAAiB;wBACnBF,SAAAA,GAAY,IAAA;AACZ,wBAAA;AACF,oBAAA;AACF,gBAAA,CAAA,MAAO,IAAIE,eAAAA,EAAiBpC,IAAAA,KAAS,WAAA,IAAeoC,eAAAA,CAAgBX,SAAS,EAAE;oBAC7ER,+BAAAA,CACE;wBAAEvD,MAAAA,EAAQwD,QAAAA,CAASkB,gBAAgBX,SAAS,CAAA;AAAGP,wBAAAA;AAAS,qBAAA,EACxDU,IAAAA,EACAC,QAAAA,CAAAA;oBAEFK,SAAAA,GAAY,IAAA;AACZ,oBAAA;gBACF,CAAA,MAAO,IACLE,iBAAiBpC,IAAAA,KAAS,UAAA,IAC1B,CAACJ,oBAAAA,CAAqBwC,eAAAA,CAAAA,IACtBA,eAAAA,CAAgBV,MAAM,EACtB;oBACAT,+BAAAA,CACE;wBAAEvD,MAAAA,EAAQwD,QAAAA,CAASkB,gBAAgBV,MAAM,CAAA;AAAGR,wBAAAA;AAAS,qBAAA,EACrDU,IAAAA,EACAC,QAAAA,CAAAA;oBAEFK,SAAAA,GAAY,IAAA;AACZ,oBAAA;AACF,gBAAA;AACF,YAAA,CAAA,CAAE,OAAM;;AAER,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAACA,SAAAA,EAAW;YACd7D,eAAAA,CAAgB;gBAAEL,GAAAA,EAAK2D,WAAAA;gBAAazD,IAAAA,EAAM2D;AAAS,aAAA,CAAA;AACrD,QAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMQ,wBAAAA,GAA2B,CAC/B9E,GAAAA,EACA2C,QAAAA,GAAAA;IAEA,KAAK,MAAMhC,IAAAA,IAAQqC,uBAAAA,CAAwBL,QAAAA,CAAAA,CAAW;AACpD,QAAA,MAAMiB,QAAAA,GAAWjD,IAAAA,CACdyC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,OAAAA,CAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAACC,OAAAA,CAAAA;AAEVC,QAAAA,+BAAAA,CAAgC1D,KAAK4D,QAAAA,EAAU,EAAA,CAAA;AACjD,IAAA;AACF,CAAA;AAEA,MAAMmB,+BAAAA,GAAkC,CACtCC,aAAAA,EACA,EAAErE,IAAI,EAA2B,GAAA;;IAGjC,IAAIqE,aAAAA,IAAiB,IAAA,IAAQA,aAAAA,KAAkB,GAAA,EAAK;QAClDlE,eAAAA,CAAgB;YAAEL,GAAAA,EAAK,UAAA;AAAYE,YAAAA;AAAK,SAAA,CAAA;AAC1C,IAAA;AACF,CAAA;MAEasE,mBAAAA,GAAsB;AAAC,IAAA,wBAAA;AAA0B,IAAA;;AAE9D;AACA;AACA,MAAMC,sBAAAA,GAAkF;AACtF,IAAA,QAAA;AACA,IAAA,mBAAA;AACA,IAAA;AACD,CAAA;AAEM,MAAMC,gBAAAA,GAAmBpF,UAAAA,CAC9B,OACEC,KACA2C,QAAAA,EACArC,QAAAA,GAAAA;IAOA,IAAI,CAACN,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,2CAAA,CAAA;AAClB,IAAA;AAEA,IAAA,IAAIsC,sBAAsBC,QAAAA,CAAAA,EAAW;QACnCmC,wBAAAA,CAAyB;AAAE3E,YAAAA,MAAAA,EAAQH,IAAIG,MAAM;AAAEwD,YAAAA,QAAAA,EAAU3D,IAAI2D;SAAS,EAAGhB,QAAAA,CAAAA;QAEzE,IAAIrC,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,SAAA,CAAA,EAAY;YAC3C,OAAO8E,qBAAAA,CAAsBlE,WAAclB,GAAAA,CAAAA,CAAK2C,QAAAA,CAAAA;AAClD,QAAA;QAEA,OAAOA,QAAAA;AACT,IAAA;;AAGA,IAAA,MAAMtC,mBAAmC,EAAE;;IAG3CA,gBAAAA,CAAiBE,IAAI,CACnB6E,qBAAAA,CACE,OAAO,EAAE3E,GAAG,EAAEE,IAAI,EAAEiB,KAAK,EAAEzB,MAAM,EAAEO,SAAS,EAAEiD,QAAQ,EAAE0B,MAAM,EAAE,EAAE,EAAEC,GAAG,EAAE,GAAA;AACvE;;;;;AAKC,cACD,IAAI,CAACD,MAAAA,EAAQ3E,SAAAA,IAAaA,SAAAA,EAAW;AACnC,YAAA,MAAM8B,sBAAAA,GAAyB;AAC7B,gBAAA,UAAA;AACA,gBAAA,aAAA;AACA,gBAAA,WAAA;AACA,gBAAA;aACD,CAAClC,QAAQ,CAACI,SAAAA,CAAU+B,IAAI,CAAA;AAEzB,YAAA,IAAIJ,oBAAAA,CAAqB3B,SAAAA,CAAAA,IAAc6E,QAAAA,CAAS3D,KAAAA,CAAAA,IAAU,cAAcA,KAAAA,EAAO;gBAC7EmD,+BAAAA,CAAiCnD,KAAAA,CAAkCe,QAAQ,EAAE;AAC3EhC,oBAAAA,IAAAA,EAAMA,KAAK6E;AACb,iBAAA,CAAA;AACF,YAAA;;AAGA,YAAA,IAAI,CAAChD,sBAAAA,EAAwB;gBAC3B1B,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAK6E;AAAI,iBAAA,CAAA;AACxC,YAAA;;AAGA,YAAA;AACF,QAAA;;AAGA,QAAA,IAAI/E,QAAQ,IAAA,EAAM;;YAEhB,IAAI,CAAC8E,SAAS3D,KAAAA,CAAAA,EAAQ;AACpB,gBAAA,OAAOd,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAK6E;AAAI,iBAAA,CAAA;AAC/C,YAAA;YAEA,MAAMC,OAAAA,GAAUC,MAAAA,CAAOC,IAAI,CAAC/D,KAAAA,CAAAA;YAE5B,KAAK,MAAMuC,UAAUsB,OAAAA,CAAS;AAC5B,gBAAA,MAAMf,QAAQf,QAAAA,CAASQ,MAAAA,CAAAA;;AAGvB,gBAAA,IAAI,CAACO,KAAAA,EAAO;oBACV5D,eAAAA,CAAgB;wBAAEL,GAAAA,EAAK0D,MAAAA;AAAQxD,wBAAAA,IAAAA,EAAM,GAAGA,IAAAA,CAAK6E,GAAG,CAAC,CAAC,EAAErB,MAAAA,CAAAA;AAAS,qBAAA,CAAA;AAC/D,gBAAA;AACF,YAAA;;AAGA,YAAA;AACF,QAAA;;QAGA,IAAI1D,GAAAA,KAAQ,EAAA,IAAMmB,KAAAA,KAAU,GAAA,EAAK;AAC/B,YAAA;AACF,QAAA;;AAGA,QAAA,IAAInB,QAAQ,OAAA,EAAS;AACnB,YAAA,IAAImF,cAAchE,KAAAA,CAAAA,EAAQ;AACxB,gBAAA;AACF,YAAA;YAEAd,eAAAA,CAAgB;AAAEL,gBAAAA,GAAAA;AAAKE,gBAAAA,IAAAA,EAAMA,KAAKD;AAAU,aAAA,CAAA;AAC9C,QAAA;;;;;;;AAQA,QAAA,IAAIkF,cAAcnF,GAAAA,CAAAA,EAAM;AACtB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIA,QAAQ,MAAA,EAAQ;YAClB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMc,YAAAA,CACJ;AACEpB,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAUkB,IAAAA,IAAQF,eAAAA,CAAAA,CAAAA;AAGtB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIb,QAAQ,SAAA,EAAW;YACrB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMX,eAAAA,CACJ;AACEK,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAUL,OAAAA,IAAWJ,iBAAAA,CAAAA,CAAAA;AAGzB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIY,QAAQ,QAAA,EAAU;YACpB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMwB,cAAAA,CACJ;AACE9B,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAU4B,MAAAA,IAAUF,iBAAAA,CAAAA,CAAAA;AAGxB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIvB,QAAQ,UAAA,EAAY;YACtB6E,GAAAA,CACE7E,GAAAA,EACA,MAAM0E,gBAAAA,CACJ;AACEhF,gBAAAA,MAAAA;AACAwD,gBAAAA,QAAAA;gBACA0B,MAAAA,EAAQ;AAAE5E,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA;AAAMR,oBAAAA,MAAAA;AAAQO,oBAAAA;AAAU,iBAAA;AACvCC,gBAAAA;aACF,EACAiB,KAAAA,EACAtB;;AAGJ,YAAA;AACF,QAAA;;QAGA,IAAIA,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,wBAAA,CAAA,EAA2B;YAC1DQ,eAAAA,CAAgB;AACdL,gBAAAA,GAAAA;AACAE,gBAAAA,IAAAA,EAAMA,KAAKD,SAAS;gBACpBmF,MAAAA,EAAQX,sBAAAA,CAAuBY,IAAI,CAAC,CAACC,KAAAA,GAAUA,KAAAA,KAAUtF,GAAAA,CAAAA,GACrD,CAAA,EAAGA,GAAAA,CAAI,sFAAsF,CAAC,GAC9FuF;AACN,aAAA,CAAA;AACF,QAAA;IACF,CAAA,EACAhG,GAAAA,CAAAA,CAAAA;;IAKJ,IAAIM,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,SAAA,CAAA,EAAY;QAC3CD,gBAAAA,CAAiBE,IAAI,CAAC6E,qBAAAA,CAAsBlE,SAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC5D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOwB,QAAAA;AACT,IAAA;AAEA,IAAA,OAAOvB,QAAaf,gBAAAA,CAAAA,CAAkBsC,QAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMsD,uBAAAA,GAA0BlG,UAAAA,CAAW,OAAOC,GAAAA,EAAc2C,QAAAA,GAAAA;IACrE,IAAI,CAAC3C,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,2CAAA,CAAA;AAClB,IAAA;;IAGA,OAAO+E,gBAAAA,CAAiBnF,KAAK2C,QAAAA,EAAU;QACrC1C,OAAAA,EAASJ,iBAAAA;QACT2B,IAAAA,EAAMF,eAAAA;QACNY,MAAAA,EAAQF,iBAAAA;QACRW,QAAAA,EAAUsC;AACZ,KAAA,CAAA;AACF,CAAA;;;;"}
+{"version":3,"file":"validators.mjs","sources":["../../src/validate/validators.ts"],"sourcesContent":["import { isEmpty, isObject } from 'lodash';\n\nimport { pipe as pipeAsync } from '../async';\nimport {\n  isScalarAttribute,\n  constants,\n  isDynamicZoneAttribute,\n  isMorphToRelationalAttribute,\n} from '../content-types';\nimport {\n  traverseQueryFilters,\n  traverseQuerySort,\n  traverseQueryFields,\n  traverseQueryPopulate,\n} from '../traverse';\nimport { throwPassword, throwPrivate, throwDynamicZones, throwMorphToRelations } from './visitors';\nimport { isOperator } from '../operators';\nimport { asyncCurry, throwInvalidKey } from './utils';\nimport type { Attribute, Model } from '../types';\nimport { isBooleanLike } from '../parse-type';\nimport type { SHARED_QUERY_PARAM_KEYS } from '../content-api-constants';\nimport type { Parent, Path } from '../traverse/factory';\n\nconst { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants;\n\ninterface Context {\n  schema: Model;\n  getModel: (model: string) => Model;\n}\n\ninterface PopulateContext extends Context {\n  path?: Path;\n  parent?: Parent;\n}\n\ntype AnyFunc = (...args: any[]) => any;\n\nexport const FILTER_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n];\n\nexport const validateFilters = asyncCurry(\n  async (ctx: Context, filters: unknown, include: (typeof FILTER_TRAVERSALS)[number][]) => {\n    // TODO: schema checks should check that it is a valid schema with yup\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFilters');\n    }\n\n    // Build the list of functions conditionally\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // keys that are not attributes or valid operators\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQueryFilters(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          const isAttribute = !!attribute;\n\n          if (!isAttribute && !isOperator(key)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQueryFilters(throwDynamicZones, ctx));\n    }\n\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQueryFilters(throwMorphToRelations, ctx));\n    }\n\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQueryFilters(throwPassword, ctx));\n    }\n\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQueryFilters(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return filters;\n    }\n\n    return pipeAsync(...functionsToApply)(filters);\n  }\n);\n\nexport const defaultValidateFilters = asyncCurry(async (ctx: Context, filters: unknown) => {\n  return validateFilters(ctx, filters, FILTER_TRAVERSALS);\n});\n\nexport const SORT_TRAVERSALS = [\n  'nonAttributesOperators',\n  'dynamicZones',\n  'morphRelations',\n  'passwords',\n  'private',\n  'nonScalarEmptyKeys',\n];\n\nexport const validateSort = asyncCurry(\n  async (ctx: Context, sort: unknown, include: (typeof SORT_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateSort');\n    }\n\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Validate non attribute keys\n    if (include.includes('nonAttributesOperators')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          // status is a virtual sort key for D&P-enabled content types\n          if (key === 'status' && ctx.schema?.options?.draftAndPublish) {\n            return;\n          }\n\n          if (!attribute) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Validate dynamic zones from sort\n    if (include.includes('dynamicZones')) {\n      functionsToApply.push(traverseQuerySort(throwDynamicZones, ctx));\n    }\n\n    // Validate morphTo relations from sort\n    if (include.includes('morphRelations')) {\n      functionsToApply.push(traverseQuerySort(throwMorphToRelations, ctx));\n    }\n\n    // Validate passwords from sort\n    if (include.includes('passwords')) {\n      functionsToApply.push(traverseQuerySort(throwPassword, ctx));\n    }\n\n    // Validate private from sort\n    if (include.includes('private')) {\n      functionsToApply.push(traverseQuerySort(throwPrivate, ctx));\n    }\n\n    // Validate non-scalar empty keys\n    if (include.includes('nonScalarEmptyKeys')) {\n      functionsToApply.push(\n        traverseQuerySort(({ key, attribute, value, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not removing it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (!isScalarAttribute(attribute) && isEmpty(value)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return sort;\n    }\n\n    return pipeAsync(...functionsToApply)(sort);\n  }\n);\n\nexport const defaultValidateSort = asyncCurry(async (ctx: Context, sort: unknown) => {\n  return validateSort(ctx, sort, SORT_TRAVERSALS);\n});\n\nexport const FIELDS_TRAVERSALS = ['scalarAttributes', 'privateFields', 'passwordFields'];\n\nexport const validateFields = asyncCurry(\n  async (ctx: Context, fields: unknown, include: (typeof FIELDS_TRAVERSALS)[number][]) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidateFields');\n    }\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Only allow scalar attributes\n    if (include.includes('scalarAttributes')) {\n      functionsToApply.push(\n        traverseQueryFields(({ key, attribute, path }) => {\n          // ID is not an attribute per se, so we need to make\n          // an extra check to ensure we're not throwing because of it\n          if ([ID_ATTRIBUTE, DOC_ID_ATTRIBUTE].includes(key)) {\n            return;\n          }\n\n          if (attribute == null || !isScalarAttribute(attribute)) {\n            throwInvalidKey({ key, path: path.attribute });\n          }\n        }, ctx)\n      );\n    }\n\n    // Private fields\n    if (include.includes('privateFields')) {\n      functionsToApply.push(traverseQueryFields(throwPrivate, ctx));\n    }\n\n    // Password fields\n    if (include.includes('passwordFields')) {\n      functionsToApply.push(traverseQueryFields(throwPassword, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return fields;\n    }\n\n    return pipeAsync(...functionsToApply)(fields);\n  }\n);\n\nexport const defaultValidateFields = asyncCurry(async (ctx: Context, fields: unknown) => {\n  return validateFields(ctx, fields, FIELDS_TRAVERSALS);\n});\n\nconst isMorphLikeAttribute = (attribute?: Attribute) =>\n  isDynamicZoneAttribute(attribute) || isMorphToRelationalAttribute(attribute);\n\nconst isPopulatableAttribute = (attribute?: Attribute) =>\n  !!attribute && ['relation', 'dynamiczone', 'component', 'media'].includes(attribute.type);\n\nconst isDotNotationPopulate = (populate: unknown): populate is string | string[] => {\n  if (populate === '*') {\n    return false;\n  }\n\n  if (typeof populate === 'string') {\n    return true;\n  }\n\n  return (\n    Array.isArray(populate) && populate.length > 0 && populate.every((p) => typeof p === 'string')\n  );\n};\n\nconst flattenDotPopulatePaths = (populate: string | string[]) => {\n  const items = Array.isArray(populate) ? populate : [populate];\n\n  return items.flatMap((item) =>\n    item\n      .split(',')\n      .map((segment) => segment.trim())\n      .filter(Boolean)\n  );\n};\n\nconst validatePopulateDotPathSegments = (\n  { schema, getModel }: { schema: Model; getModel: (uid: string) => Model },\n  segments: string[],\n  pathPrefix: string\n) => {\n  if (!segments.length) {\n    return;\n  }\n\n  const [head, ...tail] = segments;\n  const fullPath = pathPrefix ? `${pathPrefix}.${head}` : head;\n  const attribute = schema.attributes[head];\n\n  if (!attribute || !isPopulatableAttribute(attribute)) {\n    throwInvalidKey({ key: head, path: fullPath });\n  }\n\n  if (!tail.length) {\n    return;\n  }\n\n  if (attribute.type === 'component') {\n    if (!attribute.component) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    validatePopulateDotPathSegments(\n      { schema: getModel(attribute.component), getModel },\n      tail,\n      fullPath\n    );\n    return;\n  }\n\n  if (attribute.type === 'relation') {\n    if (isMorphLikeAttribute(attribute)) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    if (!attribute.target) {\n      throwInvalidKey({ key: head, path: fullPath });\n    }\n\n    validatePopulateDotPathSegments(\n      { schema: getModel(attribute.target!), getModel },\n      tail,\n      fullPath\n    );\n    return;\n  }\n\n  if (attribute.type === 'media') {\n    throwInvalidKey({ key: head, path: fullPath });\n  }\n\n  if (attribute.type === 'dynamiczone') {\n    const [nextSegment, ...rest] = tail;\n    const nextPath = `${fullPath}.${nextSegment}`;\n    const candidates = (attribute.components ?? [])\n      .map((uid) => getModel(uid))\n      .filter((model) => model?.attributes?.[nextSegment]);\n\n    if (!candidates.length) {\n      throwInvalidKey({ key: nextSegment, path: nextPath });\n    }\n\n    let validated = false;\n\n    for (const componentSchema of candidates) {\n      const nestedAttribute = componentSchema.attributes[nextSegment];\n\n      try {\n        if (!rest.length) {\n          if (nestedAttribute) {\n            validated = true;\n            break;\n          }\n        } else if (nestedAttribute?.type === 'component' && nestedAttribute.component) {\n          validatePopulateDotPathSegments(\n            { schema: getModel(nestedAttribute.component), getModel },\n            rest,\n            nextPath\n          );\n          validated = true;\n          break;\n        } else if (\n          nestedAttribute?.type === 'relation' &&\n          !isMorphLikeAttribute(nestedAttribute) &&\n          nestedAttribute.target\n        ) {\n          validatePopulateDotPathSegments(\n            { schema: getModel(nestedAttribute.target), getModel },\n            rest,\n            nextPath\n          );\n          validated = true;\n          break;\n        }\n      } catch {\n        // Try the next dynamic-zone component type.\n      }\n    }\n\n    if (!validated) {\n      throwInvalidKey({ key: nextSegment, path: nextPath });\n    }\n  }\n};\n\nconst validatePopulateDotPaths = (\n  ctx: { schema: Model; getModel: (uid: string) => Model },\n  populate: string | string[]\n) => {\n  for (const path of flattenDotPopulatePaths(populate)) {\n    const segments = path\n      .split('.')\n      .map((segment) => segment.trim())\n      .filter(Boolean);\n\n    validatePopulateDotPathSegments(ctx, segments, '');\n  }\n};\n\nconst validateMorphLikeNestedPopulate = (\n  populateValue: unknown,\n  { path }: { path: string | null }\n) => {\n  // Keep in sync with convert-query-params polymorphic nested populate handling.\n  if (populateValue != null && populateValue !== '*') {\n    throwInvalidKey({ key: 'populate', path });\n  }\n};\n\nexport const POPULATE_TRAVERSALS = ['nonAttributesOperators', 'private'];\n\n// Query params that only apply at the root of a query. They are inherited by populated\n// relations, so they are rejected inside `populate` with an explanation (see #21911).\nconst ROOT_ONLY_QUERY_PARAMS: ReadonlyArray<(typeof SHARED_QUERY_PARAM_KEYS)[number]> = [\n  'status',\n  'publicationFilter',\n  'hasPublishedVersion',\n];\n\nexport const validatePopulate = asyncCurry(\n  async (\n    ctx: PopulateContext,\n    populate: unknown,\n    includes: {\n      fields?: (typeof FIELDS_TRAVERSALS)[number][];\n      sort?: (typeof SORT_TRAVERSALS)[number][];\n      filters?: (typeof FILTER_TRAVERSALS)[number][];\n      populate?: (typeof POPULATE_TRAVERSALS)[number][];\n    }\n  ) => {\n    if (!ctx.schema) {\n      throw new Error('Missing schema in defaultValidatePopulate');\n    }\n\n    if (isDotNotationPopulate(populate)) {\n      validatePopulateDotPaths({ schema: ctx.schema, getModel: ctx.getModel }, populate);\n\n      if (includes?.populate?.includes('private')) {\n        return traverseQueryPopulate(throwPrivate, ctx)(populate);\n      }\n\n      return populate;\n    }\n\n    // Build the list of functions conditionally based on the include array\n    const functionsToApply: Array<AnyFunc> = [];\n\n    // Always include the main traversal function\n    functionsToApply.push(\n      traverseQueryPopulate(\n        async ({ key, path, value, schema, attribute, getModel, parent }, { set }) => {\n          /**\n           * NOTE: The parent check is done to support \"filters\" (and the rest of keys) as valid attribute names.\n           *\n           * The parent will not be an attribute when its a \"populate\" / \"filters\" / \"sort\" ... key.\n           * Only in those scenarios the node will be an attribute.\n           */\n          if (!parent?.attribute && attribute) {\n            const isPopulatableAttribute = [\n              'relation',\n              'dynamiczone',\n              'component',\n              'media',\n            ].includes(attribute.type);\n\n            if (isMorphLikeAttribute(attribute) && isObject(value) && 'populate' in value) {\n              validateMorphLikeNestedPopulate((value as Record<string, unknown>).populate, {\n                path: path.raw,\n              });\n            }\n\n            // Throw on non-populate attributes\n            if (!isPopulatableAttribute) {\n              throwInvalidKey({ key, path: path.raw });\n            }\n\n            // Valid populatable attribute, so return\n            return;\n          }\n\n          // If we're looking at a populate fragment, ensure its target is valid\n          if (key === 'on') {\n            // Populate fragment should always be an object\n            if (!isObject(value)) {\n              return throwInvalidKey({ key, path: path.raw });\n            }\n\n            const targets = Object.keys(value);\n\n            for (const target of targets) {\n              const model = getModel(target);\n\n              // If a target is invalid (no matching model), then raise an error\n              if (!model) {\n                throwInvalidKey({ key: target, path: `${path.raw}.${target}` });\n              }\n            }\n\n            // If the fragment's target is fine, then let it pass\n            return;\n          }\n\n          // Ignore plain wildcards\n          if (key === '' && value === '*') {\n            return;\n          }\n\n          // Ensure count is a boolean\n          if (key === 'count') {\n            if (isBooleanLike(value)) {\n              return;\n            }\n\n            throwInvalidKey({ key, path: path.attribute });\n          }\n\n          // Allowed boolean-like keywords should be ignored.\n          //\n          // Asked as a predicate rather than by catching `parseType`'s error: this runs\n          // once per populate key, and almost no key is boolean-like, so the previous\n          // try/catch built and threw away an Error — including a stack capture — on\n          // essentially every key of every populate tree of every request.\n          if (isBooleanLike(key)) {\n            return;\n          }\n\n          // Handle nested `sort` validation with custom or default traversals\n          if (key === 'sort') {\n            set(\n              key,\n              await validateSort(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the sort value\n                includes?.sort || SORT_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `filters` validation with custom or default traversals\n          if (key === 'filters') {\n            set(\n              key,\n              await validateFilters(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the filters value\n                includes?.filters || FILTER_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle nested `fields` validation with custom or default traversals\n          if (key === 'fields') {\n            set(\n              key,\n              await validateFields(\n                {\n                  schema,\n                  getModel,\n                },\n                value, // pass the fields value\n                includes?.fields || FIELDS_TRAVERSALS\n              )\n            );\n            return;\n          }\n\n          // Handle recursive nested `populate` validation with the same include object\n          if (key === 'populate') {\n            set(\n              key,\n              await validatePopulate(\n                {\n                  schema,\n                  getModel,\n                  parent: { key, path, schema, attribute },\n                  path,\n                },\n                value, // pass the nested populate value\n                includes // pass down the same includes object\n              )\n            );\n            return;\n          }\n\n          // Throw an error if non-attribute operators are included in the populate array\n          if (includes?.populate?.includes('nonAttributesOperators')) {\n            throwInvalidKey({\n              key,\n              path: path.attribute,\n              reason: ROOT_ONLY_QUERY_PARAMS.some((param) => param === key)\n                ? `${key} is only accepted at the root of the query, and it also applies to populated relations`\n                : undefined,\n            });\n          }\n        },\n        ctx\n      )\n    );\n\n    // Conditionally traverse for private fields only if 'private' is included\n    if (includes?.populate?.includes('private')) {\n      functionsToApply.push(traverseQueryPopulate(throwPrivate, ctx));\n    }\n\n    // Return directly if no validation functions are provided\n    if (functionsToApply.length === 0) {\n      return populate;\n    }\n\n    return pipeAsync(...functionsToApply)(populate);\n  }\n);\n\nexport const defaultValidatePopulate = asyncCurry(async (ctx: Context, populate: unknown) => {\n  if (!ctx.schema) {\n    throw new Error('Missing schema in defaultValidatePopulate');\n  }\n\n  // Call validatePopulate and include all validations by passing in full traversal arrays\n  return validatePopulate(ctx, populate, {\n    filters: FILTER_TRAVERSALS,\n    sort: SORT_TRAVERSALS,\n    fields: FIELDS_TRAVERSALS,\n    populate: POPULATE_TRAVERSALS,\n  });\n});\n"],"names":["ID_ATTRIBUTE","DOC_ID_ATTRIBUTE","constants","FILTER_TRAVERSALS","validateFilters","asyncCurry","ctx","filters","include","schema","Error","functionsToApply","includes","push","traverseQueryFilters","key","attribute","path","isAttribute","isOperator","throwInvalidKey","throwDynamicZones","throwMorphToRelations","throwPassword","throwPrivate","length","pipeAsync","defaultValidateFilters","SORT_TRAVERSALS","validateSort","sort","traverseQuerySort","options","draftAndPublish","value","isScalarAttribute","isEmpty","defaultValidateSort","FIELDS_TRAVERSALS","validateFields","fields","traverseQueryFields","defaultValidateFields","isMorphLikeAttribute","isDynamicZoneAttribute","isMorphToRelationalAttribute","isPopulatableAttribute","type","isDotNotationPopulate","populate","Array","isArray","every","p","flattenDotPopulatePaths","items","flatMap","item","split","map","segment","trim","filter","Boolean","validatePopulateDotPathSegments","getModel","segments","pathPrefix","head","tail","fullPath","attributes","component","target","nextSegment","rest","nextPath","candidates","components","uid","model","validated","componentSchema","nestedAttribute","validatePopulateDotPaths","validateMorphLikeNestedPopulate","populateValue","POPULATE_TRAVERSALS","ROOT_ONLY_QUERY_PARAMS","validatePopulate","traverseQueryPopulate","parent","set","isObject","raw","targets","Object","keys","isBooleanLike","reason","some","param","undefined","defaultValidatePopulate"],"mappings":";;;;;;;;;;;;;;;;AAuBA,MAAM,EAAEA,YAAY,EAAEC,gBAAgB,EAAE,GAAGC,SAAAA;MAc9BC,iBAAAA,GAAoB;AAC/B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA;;AAGK,MAAMC,eAAAA,GAAkBC,UAAAA,CAC7B,OAAOC,KAAcC,OAAAA,EAAkBC,OAAAA,GAAAA;;IAErC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,0CAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAAA,CAAA,EAA2B;QAC9CD,gBAAAA,CAAiBE,IAAI,CACnBC,oBAAAA,CAAqB,CAAC,EAAEC,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG5C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;YAEA,MAAMG,WAAAA,GAAc,CAAC,CAACF,SAAAA;AAEtB,YAAA,IAAI,CAACE,WAAAA,IAAe,CAACC,UAAAA,CAAWJ,GAAAA,CAAAA,EAAM;gBACpCK,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAA,CAAA,EAAiB;QACpCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBO,SAAAA,EAAmBf,GAAAA,CAAAA,CAAAA;AAChE,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBQ,SAAAA,EAAuBhB,GAAAA,CAAAA,CAAAA;AACpE,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAA,CAAA,EAAc;QACjCD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBS,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AAC5D,IAAA;IAEA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAA,CAAA,EAAY;QAC/BD,gBAAAA,CAAiBE,IAAI,CAACC,oBAAAA,CAAqBU,OAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC3D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOlB,OAAAA;AACT,IAAA;AAEA,IAAA,OAAOmB,QAAaf,gBAAAA,CAAAA,CAAkBJ,OAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMoB,sBAAAA,GAAyBtB,UAAAA,CAAW,OAAOC,GAAAA,EAAcC,OAAAA,GAAAA;IACpE,OAAOH,eAAAA,CAAgBE,KAAKC,OAAAA,EAASJ,iBAAAA,CAAAA;AACvC,CAAA;MAEayB,eAAAA,GAAkB;AAC7B,IAAA,wBAAA;AACA,IAAA,cAAA;AACA,IAAA,gBAAA;AACA,IAAA,WAAA;AACA,IAAA,SAAA;AACA,IAAA;;AAGK,MAAMC,YAAAA,GAAexB,UAAAA,CAC1B,OAAOC,KAAcwB,IAAAA,EAAetB,OAAAA,GAAAA;IAClC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,uCAAA,CAAA;AAClB,IAAA;;AAGA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,wBAAA,CAAA,EAA2B;QAC9CD,gBAAAA,CAAiBE,IAAI,CACnBkB,iBAAAA,CAAkB,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAGzC,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;;AAGA,YAAA,IAAIA,QAAQ,QAAA,IAAYT,GAAAA,CAAIG,MAAM,EAAEuB,SAASC,eAAAA,EAAiB;AAC5D,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACjB,SAAAA,EAAW;gBACdI,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,cAAA,CAAA,EAAiB;QACpCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBV,SAAAA,EAAmBf,GAAAA,CAAAA,CAAAA;AAC7D,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBT,SAAAA,EAAuBhB,GAAAA,CAAAA,CAAAA;AACjE,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,WAAA,CAAA,EAAc;QACjCD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBR,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AACzD,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,SAAA,CAAA,EAAY;QAC/BD,gBAAAA,CAAiBE,IAAI,CAACkB,iBAAAA,CAAkBP,OAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AACxD,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,oBAAA,CAAA,EAAuB;AAC1CD,QAAAA,gBAAAA,CAAiBE,IAAI,CACnBkB,iBAAAA,CAAkB,CAAC,EAAEhB,GAAG,EAAEC,SAAS,EAAEkB,KAAK,EAAEjB,IAAI,EAAE,GAAA;;;YAGhD,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;AAEA,YAAA,IAAI,CAACoB,iBAAAA,CAAkBnB,SAAAA,CAAAA,IAAcoB,OAAAA,CAAQF,KAAAA,CAAAA,EAAQ;gBACnDd,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOK,IAAAA;AACT,IAAA;AAEA,IAAA,OAAOJ,QAAaf,gBAAAA,CAAAA,CAAkBmB,IAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMO,mBAAAA,GAAsBhC,UAAAA,CAAW,OAAOC,GAAAA,EAAcwB,IAAAA,GAAAA;IACjE,OAAOD,YAAAA,CAAavB,KAAKwB,IAAAA,EAAMF,eAAAA,CAAAA;AACjC,CAAA;MAEaU,iBAAAA,GAAoB;AAAC,IAAA,kBAAA;AAAoB,IAAA,eAAA;AAAiB,IAAA;;AAEhE,MAAMC,cAAAA,GAAiBlC,UAAAA,CAC5B,OAAOC,KAAckC,MAAAA,EAAiBhC,OAAAA,GAAAA;IACpC,IAAI,CAACF,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,yCAAA,CAAA;AAClB,IAAA;;AAEA,IAAA,MAAMC,mBAAmC,EAAE;;IAG3C,IAAIH,OAAAA,CAAQI,QAAQ,CAAC,kBAAA,CAAA,EAAqB;QACxCD,gBAAAA,CAAiBE,IAAI,CACnB4B,mBAAAA,CAAoB,CAAC,EAAE1B,GAAG,EAAEC,SAAS,EAAEC,IAAI,EAAE,GAAA;;;YAG3C,IAAI;AAACjB,gBAAAA,YAAAA;AAAcC,gBAAAA;aAAiB,CAACW,QAAQ,CAACG,GAAAA,CAAAA,EAAM;AAClD,gBAAA;AACF,YAAA;AAEA,YAAA,IAAIC,SAAAA,IAAa,IAAA,IAAQ,CAACmB,iBAAAA,CAAkBnB,SAAAA,CAAAA,EAAY;gBACtDI,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAKD;AAAU,iBAAA,CAAA;AAC9C,YAAA;QACF,CAAA,EAAGV,GAAAA,CAAAA,CAAAA;AAEP,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,eAAA,CAAA,EAAkB;QACrCD,gBAAAA,CAAiBE,IAAI,CAAC4B,mBAAAA,CAAoBjB,OAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC1D,IAAA;;IAGA,IAAIE,OAAAA,CAAQI,QAAQ,CAAC,gBAAA,CAAA,EAAmB;QACtCD,gBAAAA,CAAiBE,IAAI,CAAC4B,mBAAAA,CAAoBlB,SAAAA,EAAejB,GAAAA,CAAAA,CAAAA;AAC3D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOe,MAAAA;AACT,IAAA;AAEA,IAAA,OAAOd,QAAaf,gBAAAA,CAAAA,CAAkB6B,MAAAA,CAAAA;AACxC,CAAA;AAGK,MAAME,qBAAAA,GAAwBrC,UAAAA,CAAW,OAAOC,GAAAA,EAAckC,MAAAA,GAAAA;IACnE,OAAOD,cAAAA,CAAejC,KAAKkC,MAAAA,EAAQF,iBAAAA,CAAAA;AACrC,CAAA;AAEA,MAAMK,oBAAAA,GAAuB,CAAC3B,SAAAA,GAC5B4B,sBAAAA,CAAuB5B,cAAc6B,4BAAAA,CAA6B7B,SAAAA,CAAAA;AAEpE,MAAM8B,sBAAAA,GAAyB,CAAC9B,SAAAA,GAC9B,CAAC,CAACA,SAAAA,IAAa;AAAC,QAAA,UAAA;AAAY,QAAA,aAAA;AAAe,QAAA,WAAA;AAAa,QAAA;KAAQ,CAACJ,QAAQ,CAACI,SAAAA,CAAU+B,IAAI,CAAA;AAE1F,MAAMC,wBAAwB,CAACC,QAAAA,GAAAA;AAC7B,IAAA,IAAIA,aAAa,GAAA,EAAK;QACpB,OAAO,KAAA;AACT,IAAA;IAEA,IAAI,OAAOA,aAAa,QAAA,EAAU;QAChC,OAAO,IAAA;AACT,IAAA;AAEA,IAAA,OACEC,KAAAA,CAAMC,OAAO,CAACF,QAAAA,CAAAA,IAAaA,SAASxB,MAAM,GAAG,CAAA,IAAKwB,QAAAA,CAASG,KAAK,CAAC,CAACC,CAAAA,GAAM,OAAOA,CAAAA,KAAM,QAAA,CAAA;AAEzF,CAAA;AAEA,MAAMC,0BAA0B,CAACL,QAAAA,GAAAA;AAC/B,IAAA,MAAMM,KAAAA,GAAQL,KAAAA,CAAMC,OAAO,CAACF,YAAYA,QAAAA,GAAW;AAACA,QAAAA;AAAS,KAAA;AAE7D,IAAA,OAAOM,MAAMC,OAAO,CAAC,CAACC,IAAAA,GACpBA,KACGC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,QAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAACC,OAAAA,CAAAA,CAAAA;AAEd,CAAA;AAEA,MAAMC,+BAAAA,GAAkC,CACtC,EAAEvD,MAAM,EAAEwD,QAAQ,EAAuD,EACzEC,QAAAA,EACAC,UAAAA,GAAAA;IAEA,IAAI,CAACD,QAAAA,CAASzC,MAAM,EAAE;AACpB,QAAA;AACF,IAAA;AAEA,IAAA,MAAM,CAAC2C,IAAAA,EAAM,GAAGC,IAAAA,CAAK,GAAGH,QAAAA;AACxB,IAAA,MAAMI,WAAWH,UAAAA,GAAa,CAAA,EAAGA,WAAW,CAAC,EAAEC,MAAM,GAAGA,IAAAA;AACxD,IAAA,MAAMpD,SAAAA,GAAYP,MAAAA,CAAO8D,UAAU,CAACH,IAAAA,CAAK;AAEzC,IAAA,IAAI,CAACpD,SAAAA,IAAa,CAAC8B,sBAAAA,CAAuB9B,SAAAA,CAAAA,EAAY;QACpDI,eAAAA,CAAgB;YAAEL,GAAAA,EAAKqD,IAAAA;YAAMnD,IAAAA,EAAMqD;AAAS,SAAA,CAAA;AAC9C,IAAA;IAEA,IAAI,CAACD,IAAAA,CAAK5C,MAAM,EAAE;AAChB,QAAA;AACF,IAAA;IAEA,IAAIT,SAAAA,CAAU+B,IAAI,KAAK,WAAA,EAAa;QAClC,IAAI,CAAC/B,SAAAA,CAAUwD,SAAS,EAAE;YACxBpD,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEAN,+BAAAA,CACE;YAAEvD,MAAAA,EAAQwD,QAAAA,CAASjD,UAAUwD,SAAS,CAAA;AAAGP,YAAAA;AAAS,SAAA,EAClDI,IAAAA,EACAC,QAAAA,CAAAA;AAEF,QAAA;AACF,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,UAAA,EAAY;AACjC,QAAA,IAAIJ,qBAAqB3B,SAAAA,CAAAA,EAAY;YACnCI,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEA,IAAI,CAACtD,SAAAA,CAAUyD,MAAM,EAAE;YACrBrD,eAAAA,CAAgB;gBAAEL,GAAAA,EAAKqD,IAAAA;gBAAMnD,IAAAA,EAAMqD;AAAS,aAAA,CAAA;AAC9C,QAAA;QAEAN,+BAAAA,CACE;YAAEvD,MAAAA,EAAQwD,QAAAA,CAASjD,UAAUyD,MAAM,CAAA;AAAIR,YAAAA;AAAS,SAAA,EAChDI,IAAAA,EACAC,QAAAA,CAAAA;AAEF,QAAA;AACF,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,OAAA,EAAS;QAC9B3B,eAAAA,CAAgB;YAAEL,GAAAA,EAAKqD,IAAAA;YAAMnD,IAAAA,EAAMqD;AAAS,SAAA,CAAA;AAC9C,IAAA;IAEA,IAAItD,SAAAA,CAAU+B,IAAI,KAAK,aAAA,EAAe;AACpC,QAAA,MAAM,CAAC2B,WAAAA,EAAa,GAAGC,IAAAA,CAAK,GAAGN,IAAAA;AAC/B,QAAA,MAAMO,QAAAA,GAAW,CAAA,EAAGN,QAAAA,CAAS,CAAC,EAAEI,WAAAA,CAAAA,CAAa;QAC7C,MAAMG,UAAAA,GAAa,CAAC7D,SAAAA,CAAU8D,UAAU,IAAI,EAAE,EAC3CnB,GAAG,CAAC,CAACoB,GAAAA,GAAQd,QAAAA,CAASc,MACtBjB,MAAM,CAAC,CAACkB,KAAAA,GAAUA,KAAAA,EAAOT,UAAAA,GAAaG,WAAAA,CAAY,CAAA;QAErD,IAAI,CAACG,UAAAA,CAAWpD,MAAM,EAAE;YACtBL,eAAAA,CAAgB;gBAAEL,GAAAA,EAAK2D,WAAAA;gBAAazD,IAAAA,EAAM2D;AAAS,aAAA,CAAA;AACrD,QAAA;AAEA,QAAA,IAAIK,SAAAA,GAAY,KAAA;QAEhB,KAAK,MAAMC,mBAAmBL,UAAAA,CAAY;AACxC,YAAA,MAAMM,eAAAA,GAAkBD,eAAAA,CAAgBX,UAAU,CAACG,WAAAA,CAAY;YAE/D,IAAI;gBACF,IAAI,CAACC,IAAAA,CAAKlD,MAAM,EAAE;AAChB,oBAAA,IAAI0D,eAAAA,EAAiB;wBACnBF,SAAAA,GAAY,IAAA;AACZ,wBAAA;AACF,oBAAA;AACF,gBAAA,CAAA,MAAO,IAAIE,eAAAA,EAAiBpC,IAAAA,KAAS,WAAA,IAAeoC,eAAAA,CAAgBX,SAAS,EAAE;oBAC7ER,+BAAAA,CACE;wBAAEvD,MAAAA,EAAQwD,QAAAA,CAASkB,gBAAgBX,SAAS,CAAA;AAAGP,wBAAAA;AAAS,qBAAA,EACxDU,IAAAA,EACAC,QAAAA,CAAAA;oBAEFK,SAAAA,GAAY,IAAA;AACZ,oBAAA;gBACF,CAAA,MAAO,IACLE,iBAAiBpC,IAAAA,KAAS,UAAA,IAC1B,CAACJ,oBAAAA,CAAqBwC,eAAAA,CAAAA,IACtBA,eAAAA,CAAgBV,MAAM,EACtB;oBACAT,+BAAAA,CACE;wBAAEvD,MAAAA,EAAQwD,QAAAA,CAASkB,gBAAgBV,MAAM,CAAA;AAAGR,wBAAAA;AAAS,qBAAA,EACrDU,IAAAA,EACAC,QAAAA,CAAAA;oBAEFK,SAAAA,GAAY,IAAA;AACZ,oBAAA;AACF,gBAAA;AACF,YAAA,CAAA,CAAE,OAAM;;AAER,YAAA;AACF,QAAA;AAEA,QAAA,IAAI,CAACA,SAAAA,EAAW;YACd7D,eAAAA,CAAgB;gBAAEL,GAAAA,EAAK2D,WAAAA;gBAAazD,IAAAA,EAAM2D;AAAS,aAAA,CAAA;AACrD,QAAA;AACF,IAAA;AACF,CAAA;AAEA,MAAMQ,wBAAAA,GAA2B,CAC/B9E,GAAAA,EACA2C,QAAAA,GAAAA;IAEA,KAAK,MAAMhC,IAAAA,IAAQqC,uBAAAA,CAAwBL,QAAAA,CAAAA,CAAW;AACpD,QAAA,MAAMiB,QAAAA,GAAWjD,IAAAA,CACdyC,KAAK,CAAC,GAAA,CAAA,CACNC,GAAG,CAAC,CAACC,OAAAA,GAAYA,OAAAA,CAAQC,IAAI,EAAA,CAAA,CAC7BC,MAAM,CAACC,OAAAA,CAAAA;AAEVC,QAAAA,+BAAAA,CAAgC1D,KAAK4D,QAAAA,EAAU,EAAA,CAAA;AACjD,IAAA;AACF,CAAA;AAEA,MAAMmB,+BAAAA,GAAkC,CACtCC,aAAAA,EACA,EAAErE,IAAI,EAA2B,GAAA;;IAGjC,IAAIqE,aAAAA,IAAiB,IAAA,IAAQA,aAAAA,KAAkB,GAAA,EAAK;QAClDlE,eAAAA,CAAgB;YAAEL,GAAAA,EAAK,UAAA;AAAYE,YAAAA;AAAK,SAAA,CAAA;AAC1C,IAAA;AACF,CAAA;MAEasE,mBAAAA,GAAsB;AAAC,IAAA,wBAAA;AAA0B,IAAA;;AAE9D;AACA;AACA,MAAMC,sBAAAA,GAAkF;AACtF,IAAA,QAAA;AACA,IAAA,mBAAA;AACA,IAAA;AACD,CAAA;AAEM,MAAMC,gBAAAA,GAAmBpF,UAAAA,CAC9B,OACEC,KACA2C,QAAAA,EACArC,QAAAA,GAAAA;IAOA,IAAI,CAACN,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,2CAAA,CAAA;AAClB,IAAA;AAEA,IAAA,IAAIsC,sBAAsBC,QAAAA,CAAAA,EAAW;QACnCmC,wBAAAA,CAAyB;AAAE3E,YAAAA,MAAAA,EAAQH,IAAIG,MAAM;AAAEwD,YAAAA,QAAAA,EAAU3D,IAAI2D;SAAS,EAAGhB,QAAAA,CAAAA;QAEzE,IAAIrC,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,SAAA,CAAA,EAAY;YAC3C,OAAO8E,qBAAAA,CAAsBlE,SAAclB,GAAAA,CAAAA,CAAK2C,QAAAA,CAAAA;AAClD,QAAA;QAEA,OAAOA,QAAAA;AACT,IAAA;;AAGA,IAAA,MAAMtC,mBAAmC,EAAE;;IAG3CA,gBAAAA,CAAiBE,IAAI,CACnB6E,qBAAAA,CACE,OAAO,EAAE3E,GAAG,EAAEE,IAAI,EAAEiB,KAAK,EAAEzB,MAAM,EAAEO,SAAS,EAAEiD,QAAQ,EAAE0B,MAAM,EAAE,EAAE,EAAEC,GAAG,EAAE,GAAA;AACvE;;;;;AAKC,cACD,IAAI,CAACD,MAAAA,EAAQ3E,SAAAA,IAAaA,SAAAA,EAAW;AACnC,YAAA,MAAM8B,sBAAAA,GAAyB;AAC7B,gBAAA,UAAA;AACA,gBAAA,aAAA;AACA,gBAAA,WAAA;AACA,gBAAA;aACD,CAAClC,QAAQ,CAACI,SAAAA,CAAU+B,IAAI,CAAA;AAEzB,YAAA,IAAIJ,oBAAAA,CAAqB3B,SAAAA,CAAAA,IAAc6E,QAAAA,CAAS3D,KAAAA,CAAAA,IAAU,cAAcA,KAAAA,EAAO;gBAC7EmD,+BAAAA,CAAiCnD,KAAAA,CAAkCe,QAAQ,EAAE;AAC3EhC,oBAAAA,IAAAA,EAAMA,KAAK6E;AACb,iBAAA,CAAA;AACF,YAAA;;AAGA,YAAA,IAAI,CAAChD,sBAAAA,EAAwB;gBAC3B1B,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAK6E;AAAI,iBAAA,CAAA;AACxC,YAAA;;AAGA,YAAA;AACF,QAAA;;AAGA,QAAA,IAAI/E,QAAQ,IAAA,EAAM;;YAEhB,IAAI,CAAC8E,SAAS3D,KAAAA,CAAAA,EAAQ;AACpB,gBAAA,OAAOd,eAAAA,CAAgB;AAAEL,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA,EAAMA,KAAK6E;AAAI,iBAAA,CAAA;AAC/C,YAAA;YAEA,MAAMC,OAAAA,GAAUC,MAAAA,CAAOC,IAAI,CAAC/D,KAAAA,CAAAA;YAE5B,KAAK,MAAMuC,UAAUsB,OAAAA,CAAS;AAC5B,gBAAA,MAAMf,QAAQf,QAAAA,CAASQ,MAAAA,CAAAA;;AAGvB,gBAAA,IAAI,CAACO,KAAAA,EAAO;oBACV5D,eAAAA,CAAgB;wBAAEL,GAAAA,EAAK0D,MAAAA;AAAQxD,wBAAAA,IAAAA,EAAM,GAAGA,IAAAA,CAAK6E,GAAG,CAAC,CAAC,EAAErB,MAAAA,CAAAA;AAAS,qBAAA,CAAA;AAC/D,gBAAA;AACF,YAAA;;AAGA,YAAA;AACF,QAAA;;QAGA,IAAI1D,GAAAA,KAAQ,EAAA,IAAMmB,KAAAA,KAAU,GAAA,EAAK;AAC/B,YAAA;AACF,QAAA;;AAGA,QAAA,IAAInB,QAAQ,OAAA,EAAS;AACnB,YAAA,IAAImF,cAAchE,KAAAA,CAAAA,EAAQ;AACxB,gBAAA;AACF,YAAA;YAEAd,eAAAA,CAAgB;AAAEL,gBAAAA,GAAAA;AAAKE,gBAAAA,IAAAA,EAAMA,KAAKD;AAAU,aAAA,CAAA;AAC9C,QAAA;;;;;;;AAQA,QAAA,IAAIkF,cAAcnF,GAAAA,CAAAA,EAAM;AACtB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIA,QAAQ,MAAA,EAAQ;YAClB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMc,YAAAA,CACJ;AACEpB,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAUkB,IAAAA,IAAQF,eAAAA,CAAAA,CAAAA;AAGtB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIb,QAAQ,SAAA,EAAW;YACrB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMX,eAAAA,CACJ;AACEK,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAUL,OAAAA,IAAWJ,iBAAAA,CAAAA,CAAAA;AAGzB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIY,QAAQ,QAAA,EAAU;YACpB6E,GAAAA,CACE7E,GAAAA,EACA,MAAMwB,cAAAA,CACJ;AACE9B,gBAAAA,MAAAA;AACAwD,gBAAAA;aACF,EACA/B,KAAAA,EACAtB,UAAU4B,MAAAA,IAAUF,iBAAAA,CAAAA,CAAAA;AAGxB,YAAA;AACF,QAAA;;AAGA,QAAA,IAAIvB,QAAQ,UAAA,EAAY;YACtB6E,GAAAA,CACE7E,GAAAA,EACA,MAAM0E,gBAAAA,CACJ;AACEhF,gBAAAA,MAAAA;AACAwD,gBAAAA,QAAAA;gBACA0B,MAAAA,EAAQ;AAAE5E,oBAAAA,GAAAA;AAAKE,oBAAAA,IAAAA;AAAMR,oBAAAA,MAAAA;AAAQO,oBAAAA;AAAU,iBAAA;AACvCC,gBAAAA;aACF,EACAiB,KAAAA,EACAtB;;AAGJ,YAAA;AACF,QAAA;;QAGA,IAAIA,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,wBAAA,CAAA,EAA2B;YAC1DQ,eAAAA,CAAgB;AACdL,gBAAAA,GAAAA;AACAE,gBAAAA,IAAAA,EAAMA,KAAKD,SAAS;gBACpBmF,MAAAA,EAAQX,sBAAAA,CAAuBY,IAAI,CAAC,CAACC,KAAAA,GAAUA,KAAAA,KAAUtF,GAAAA,CAAAA,GACrD,CAAA,EAAGA,GAAAA,CAAI,sFAAsF,CAAC,GAC9FuF;AACN,aAAA,CAAA;AACF,QAAA;IACF,CAAA,EACAhG,GAAAA,CAAAA,CAAAA;;IAKJ,IAAIM,QAAAA,EAAUqC,QAAAA,EAAUrC,QAAAA,CAAS,SAAA,CAAA,EAAY;QAC3CD,gBAAAA,CAAiBE,IAAI,CAAC6E,qBAAAA,CAAsBlE,OAAAA,EAAclB,GAAAA,CAAAA,CAAAA;AAC5D,IAAA;;IAGA,IAAIK,gBAAAA,CAAiBc,MAAM,KAAK,CAAA,EAAG;QACjC,OAAOwB,QAAAA;AACT,IAAA;AAEA,IAAA,OAAOvB,QAAaf,gBAAAA,CAAAA,CAAkBsC,QAAAA,CAAAA;AACxC,CAAA;AAGK,MAAMsD,uBAAAA,GAA0BlG,UAAAA,CAAW,OAAOC,GAAAA,EAAc2C,QAAAA,GAAAA;IACrE,IAAI,CAAC3C,GAAAA,CAAIG,MAAM,EAAE;AACf,QAAA,MAAM,IAAIC,KAAAA,CAAM,2CAAA,CAAA;AAClB,IAAA;;IAGA,OAAO+E,gBAAAA,CAAiBnF,KAAK2C,QAAAA,EAAU;QACrC1C,OAAAA,EAASJ,iBAAAA;QACT2B,IAAAA,EAAMF,eAAAA;QACNY,MAAAA,EAAQF,iBAAAA;QACRW,QAAAA,EAAUsC;AACZ,KAAA,CAAA;AACF,CAAA;;;;"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@strapi/utils",
-  "version": "5.58.0",
+  "version": "5.59.0",
   "description": "Shared utilities for the Strapi packages",
   "keywords": [
     "strapi",
@@ -65,13 +65,13 @@
     "@types/jest": "29.5.2",
     "@types/koa": "2.15.2",
     "@types/node": "20.19.41",
-    "eslint-config-custom": "5.58.0",
+    "eslint-config-custom": "5.59.0",
     "jest": "29.6.0",
     "koa": "2.16.4",
     "koa-body": "6.0.1",
-    "tsconfig": "5.58.0",
+    "tsconfig": "5.59.0",
     "vitest": "catalog:",
-    "vitest-config": "5.58.0"
+    "vitest-config": "5.59.0"
   },
   "engines": {
     "node": ">=20.0.0 <=26.x.x",