yayson 4.1.0 → 4.3.0

package/build/{symbols-DSjKJ8vh.mjs → symbols-BfU4k1el.mjs}

@@ -10,6 +10,9 @@ var Adapter = class {
 		if (id == null) return;
 		return `${id}`;
 	}
+	static has(model, key) {
+		return key in model;
+	}
 };
 var adapter_default = Adapter;
 
@@ -23,4 +26,4 @@ const REL_META = Symbol("yayson.rel-meta");
 
 //#endregion
 export { TYPE as a, REL_META as i, META as n, adapter_default as o, REL_LINKS as r, LINKS as t };
-//# sourceMappingURL=symbols-DSjKJ8vh.mjs.map
+//# sourceMappingURL=symbols-BfU4k1el.mjs.map

package/build/symbols-BfU4k1el.mjs.map

@@ -0,0 +1 @@
+{"version":3,"file":"symbols-BfU4k1el.mjs","names":[],"sources":["../src/yayson/adapter.ts","../src/yayson/symbols.ts"],"sourcesContent":["export type ModelLike = object\n\nclass Adapter {\n  static get(model: ModelLike): Record<string, unknown>\n  static get(model: ModelLike, key: string): unknown\n  static get(model: ModelLike, key?: string): unknown {\n    // eslint-disable-next-line @typescript-eslint/consistent-type-assertions -- ModelLike is object for flexibility, cast for dynamic access\n    const obj = model as Record<string, unknown>\n    if (key) {\n      return obj[key]\n    }\n    return obj\n  }\n\n  static id(model: ModelLike): string | undefined {\n    const id = this.get(model, 'id')\n    if (id == null) {\n      return undefined\n    }\n    return `${id}`\n  }\n\n  static has(model: ModelLike, key: string): boolean {\n    return key in model\n  }\n}\n\nexport default Adapter\n","export const TYPE: unique symbol = Symbol('yayson.type')\nexport const LINKS: unique symbol = Symbol('yayson.links')\nexport const META: unique symbol = Symbol('yayson.meta')\nexport const REL_LINKS: unique symbol = Symbol('yayson.rel-links')\nexport const REL_META: unique symbol = Symbol('yayson.rel-meta')\n"],"mappings":";AAEA,IAAM,UAAN,MAAc;CAGZ,OAAO,IAAI,OAAkB,KAAuB;EAElD,MAAM,MAAM;AACZ,MAAI,IACF,QAAO,IAAI;AAEb,SAAO;;CAGT,OAAO,GAAG,OAAsC;EAC9C,MAAM,KAAK,KAAK,IAAI,OAAO,KAAK;AAChC,MAAI,MAAM,KACR;AAEF,SAAO,GAAG;;CAGZ,OAAO,IAAI,OAAkB,KAAsB;AACjD,SAAO,OAAO;;;AAIlB,sBAAe;;;;AC3Bf,MAAa,OAAsB,OAAO,cAAc;AACxD,MAAa,QAAuB,OAAO,eAAe;AAC1D,MAAa,OAAsB,OAAO,cAAc;AACxD,MAAa,YAA2B,OAAO,mBAAmB;AAClE,MAAa,WAA0B,OAAO,kBAAkB"}

package/build/{types-NiKV-lj-.d.cts → types-KZiF6x7A.d.mts}

@@ -4,6 +4,7 @@ declare class Adapter {
   static get(model: ModelLike): Record<string, unknown>;
   static get(model: ModelLike, key: string): unknown;
   static id(model: ModelLike): string | undefined;
+  static has(model: ModelLike, key: string): boolean;
 }
 //#endregion
 //#region src/yayson/symbols.d.ts
@@ -46,6 +47,17 @@ interface JsonApiRelationship {
   links?: JsonApiLink;
   meta?: Record<string, unknown>;
 }
+/**
+ * Extended relationship descriptor for `relationships()` return values.
+ * `hasMany: true` renders empty/missing as `data: []` (spec-compliant to-many).
+ * `optional: true` omits the relationship when its key is absent on the instance
+ * (or renders `links` only); explicit `null`/`[]` still render normally.
+ */
+interface RelationshipConfig<P> {
+  presenter: P;
+  hasMany?: boolean;
+  optional?: boolean;
+}
 interface JsonApiRelationships {
   [key: string]: JsonApiRelationship;
 }
@@ -125,5 +137,5 @@ interface LegacyStoreOptions<S extends SchemaRegistry = SchemaRegistry> {
   strict?: boolean;
 }
 //#endregion
-export { REL_META as C, ModelLike as E, REL_LINKS as S, Adapter as T, StoreResult as _, JsonApiRelationship as a, LINKS as b, LegacyPresenterOptions as c, SchemaRegistry as d, StoreModel as f, StoreRecord as g, StoreOptions as h, JsonApiLinks as i, LegacyStoreOptions as l, StoreModels as m, JsonApiDocument as n, JsonApiRelationships as o, StoreModelWithOptionalId as p, JsonApiLink as r, JsonApiResource as s, InferModelType as t, PresenterOptions as u, ValidationError as v, TYPE as w, META as x, ZodLikeSchema as y };
-//# sourceMappingURL=types-NiKV-lj-.d.cts.map
+export { REL_LINKS as C, ModelLike as D, Adapter as E, META as S, TYPE as T, StoreRecord as _, JsonApiRelationship as a, ZodLikeSchema as b, LegacyPresenterOptions as c, RelationshipConfig as d, SchemaRegistry as f, StoreOptions as g, StoreModels as h, JsonApiLinks as i, LegacyStoreOptions as l, StoreModelWithOptionalId as m, JsonApiDocument as n, JsonApiRelationships as o, StoreModel as p, JsonApiLink as r, JsonApiResource as s, InferModelType as t, PresenterOptions as u, StoreResult as v, REL_META as w, LINKS as x, ValidationError as y };
+//# sourceMappingURL=types-KZiF6x7A.d.mts.map

package/build/types-KZiF6x7A.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-KZiF6x7A.d.mts","names":[],"sources":["../../../../../../yayson/adapter.ts","../../../../../../yayson/symbols.ts","../../../../../../yayson/schema.ts","../../../../../../yayson/types.ts"],"mappings":";KAAY,SAAA;AAAA,cAEN,OAAA;EAAA,OACG,GAAA,CAAI,KAAA,EAAO,SAAA,GAAY,MAAA;EAAA,OACvB,GAAA,CAAI,KAAA,EAAO,SAAA,EAAW,GAAA;EAAA,OAUtB,EAAA,CAAG,KAAA,EAAO,SAAA;EAAA,OAQV,GAAA,CAAI,KAAA,EAAO,SAAA,EAAW,GAAA;AAAA;;;cCtBlB,IAAA;AAAA,cACA,KAAA;AAAA,cACA,IAAA;AAAA,cACA,SAAA;AAAA,cACA,QAAA;;;;ADJb;;;UEIiB,aAAA;EACf,KAAA,GAAQ,IAAA;EACR,SAAA,GAAY,IAAA;IAAoB,OAAA;IAAe,IAAA;EAAA;IAAoB,OAAA;IAAgB,KAAA;EAAA;AAAA;;;UCHpE,WAAA,SAAoB,MAAA;EACnC,IAAA;EACA,OAAA;AAAA;AAAA,UAGe,YAAA;EAAA,CACd,GAAA,WAAc,WAAA;AAAA;AAAA,UAGA,yBAAA;EACf,EAAA;EACA,IAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA,GAAO,yBAAA,GAA4B,yBAAA;EACnC,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;;;;;;;UASQ,kBAAA;EACf,SAAA,EAAW,CAAA;EACX,OAAA;EACA,QAAA;AAAA;AAAA,UAGe,oBAAA;EAAA,CACd,GAAA,WAAc,mBAAA;AAAA;AAAA,UAGA,eAAA;EACf,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,eAAA;EACf,IAAA,EAAM,eAAA,GAAkB,eAAA;EACxB,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,gBAAA;EACf,IAAA,GAAO,MAAA;EACP,KAAA,GAAQ,YAAA;EACR,OAAA;AAAA;AAAA,UAGe,sBAAA,SAA+B,gBAAA;EAC9C,aAAA;AAAA;AAAA,UAGe,WAAA;EACf,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,UAAA,SAAmB,MAAA;EAClC,EAAA;EAAA,CACC,IAAA;EAAA,CACA,KAAA,IAAS,WAAA;EAAA,CACT,IAAA,IAAQ,MAAA;EAAA,CACR,SAAA,IAAa,WAAA;EAAA,CACb,QAAA,IAAY,MAAA;AAAA;;UAIE,wBAAA,SAAiC,MAAA;EAChD,EAAA;EAAA,CACC,IAAA;EAAA,CACA,KAAA,IAAS,WAAA;EAAA,CACT,IAAA,IAAQ,MAAA;AAAA;AAAA,UAGM,WAAA;EAAA,CACd,IAAA;IAAA,CACE,EAAA,WAAa,UAAA;EAAA;AAAA;AAAA,UAID,cAAA;EAAA,CACd,IAAA,WAAe,aAAA;AAAA;AAAA,KAIN,eAAA,WAA0B,MAAA;EACpC,KAAA,GAAQ,IAAA;EACR,SAAA,GAAY,IAAA;AAAA,IAEV,UAAA;AAAA,KAGQ,cAAA,sCAAoD,QAAA,SAAiB,cAAA,GAC7E,QAAA,eAAuB,QAAA,GACrB,eAAA,CAAgB,QAAA,CAAS,QAAA,KACzB,UAAA,GACF,UAAA;AAAA,UAEa,WAAA,KAAgB,UAAA,UAAoB,KAAA,CAAM,CAAA;EAAA,CACxD,IAAA,IAAQ,MAAA;AAAA;AAAA,UAGM,YAAA,WAAuB,cAAA,GAAiB,cAAA;EACvD,OAAA,GAAU,CAAA;EACV,MAAA;AAAA;AAAA,UAGe,eAAA;EACf,IAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,UAGe,kBAAA,WAA6B,cAAA,GAAiB,cAAA;EAC7D,KAAA,GAAQ,MAAA;EACR,OAAA,GAAU,CAAA;EACV,MAAA;AAAA"}

package/build/{types-Do2flKZX.d.mts → types-iC38_iCI.d.cts}

@@ -4,6 +4,7 @@ declare class Adapter {
   static get(model: ModelLike): Record<string, unknown>;
   static get(model: ModelLike, key: string): unknown;
   static id(model: ModelLike): string | undefined;
+  static has(model: ModelLike, key: string): boolean;
 }
 //#endregion
 //#region src/yayson/symbols.d.ts
@@ -46,6 +47,17 @@ interface JsonApiRelationship {
   links?: JsonApiLink;
   meta?: Record<string, unknown>;
 }
+/**
+ * Extended relationship descriptor for `relationships()` return values.
+ * `hasMany: true` renders empty/missing as `data: []` (spec-compliant to-many).
+ * `optional: true` omits the relationship when its key is absent on the instance
+ * (or renders `links` only); explicit `null`/`[]` still render normally.
+ */
+interface RelationshipConfig<P> {
+  presenter: P;
+  hasMany?: boolean;
+  optional?: boolean;
+}
 interface JsonApiRelationships {
   [key: string]: JsonApiRelationship;
 }
@@ -125,5 +137,5 @@ interface LegacyStoreOptions<S extends SchemaRegistry = SchemaRegistry> {
   strict?: boolean;
 }
 //#endregion
-export { REL_META as C, ModelLike as E, REL_LINKS as S, Adapter as T, StoreResult as _, JsonApiRelationship as a, LINKS as b, LegacyPresenterOptions as c, SchemaRegistry as d, StoreModel as f, StoreRecord as g, StoreOptions as h, JsonApiLinks as i, LegacyStoreOptions as l, StoreModels as m, JsonApiDocument as n, JsonApiRelationships as o, StoreModelWithOptionalId as p, JsonApiLink as r, JsonApiResource as s, InferModelType as t, PresenterOptions as u, ValidationError as v, TYPE as w, META as x, ZodLikeSchema as y };
-//# sourceMappingURL=types-Do2flKZX.d.mts.map
+export { REL_LINKS as C, ModelLike as D, Adapter as E, META as S, TYPE as T, StoreRecord as _, JsonApiRelationship as a, ZodLikeSchema as b, LegacyPresenterOptions as c, RelationshipConfig as d, SchemaRegistry as f, StoreOptions as g, StoreModels as h, JsonApiLinks as i, LegacyStoreOptions as l, StoreModelWithOptionalId as m, JsonApiDocument as n, JsonApiRelationships as o, StoreModel as p, JsonApiLink as r, JsonApiResource as s, InferModelType as t, PresenterOptions as u, StoreResult as v, REL_META as w, LINKS as x, ValidationError as y };
+//# sourceMappingURL=types-iC38_iCI.d.cts.map

package/build/types-iC38_iCI.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types-iC38_iCI.d.cts","names":[],"sources":["../../../../../../yayson/adapter.ts","../../../../../../yayson/symbols.ts","../../../../../../yayson/schema.ts","../../../../../../yayson/types.ts"],"mappings":";KAAY,SAAA;AAAA,cAEN,OAAA;EAAA,OACG,GAAA,CAAI,KAAA,EAAO,SAAA,GAAY,MAAA;EAAA,OACvB,GAAA,CAAI,KAAA,EAAO,SAAA,EAAW,GAAA;EAAA,OAUtB,EAAA,CAAG,KAAA,EAAO,SAAA;EAAA,OAQV,GAAA,CAAI,KAAA,EAAO,SAAA,EAAW,GAAA;AAAA;;;cCtBlB,IAAA;AAAA,cACA,KAAA;AAAA,cACA,IAAA;AAAA,cACA,SAAA;AAAA,cACA,QAAA;;;;ADJb;;;UEIiB,aAAA;EACf,KAAA,GAAQ,IAAA;EACR,SAAA,GAAY,IAAA;IAAoB,OAAA;IAAe,IAAA;EAAA;IAAoB,OAAA;IAAgB,KAAA;EAAA;AAAA;;;UCHpE,WAAA,SAAoB,MAAA;EACnC,IAAA;EACA,OAAA;AAAA;AAAA,UAGe,YAAA;EAAA,CACd,GAAA,WAAc,WAAA;AAAA;AAAA,UAGA,yBAAA;EACf,EAAA;EACA,IAAA;AAAA;AAAA,UAGe,mBAAA;EACf,IAAA,GAAO,yBAAA,GAA4B,yBAAA;EACnC,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;;;;;;;UASQ,kBAAA;EACf,SAAA,EAAW,CAAA;EACX,OAAA;EACA,QAAA;AAAA;AAAA,UAGe,oBAAA;EAAA,CACd,GAAA,WAAc,mBAAA;AAAA;AAAA,UAGA,eAAA;EACf,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,eAAA;EACf,IAAA,EAAM,eAAA,GAAkB,eAAA;EACxB,QAAA,GAAW,eAAA;EACX,KAAA,GAAQ,YAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,gBAAA;EACf,IAAA,GAAO,MAAA;EACP,KAAA,GAAQ,YAAA;EACR,OAAA;AAAA;AAAA,UAGe,sBAAA,SAA+B,gBAAA;EAC9C,aAAA;AAAA;AAAA,UAGe,WAAA;EACf,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;AAAA;AAAA,UAGQ,UAAA,SAAmB,MAAA;EAClC,EAAA;EAAA,CACC,IAAA;EAAA,CACA,KAAA,IAAS,WAAA;EAAA,CACT,IAAA,IAAQ,MAAA;EAAA,CACR,SAAA,IAAa,WAAA;EAAA,CACb,QAAA,IAAY,MAAA;AAAA;;UAIE,wBAAA,SAAiC,MAAA;EAChD,EAAA;EAAA,CACC,IAAA;EAAA,CACA,KAAA,IAAS,WAAA;EAAA,CACT,IAAA,IAAQ,MAAA;AAAA;AAAA,UAGM,WAAA;EAAA,CACd,IAAA;IAAA,CACE,EAAA,WAAa,UAAA;EAAA;AAAA;AAAA,UAID,cAAA;EAAA,CACd,IAAA,WAAe,aAAA;AAAA;AAAA,KAIN,eAAA,WAA0B,MAAA;EACpC,KAAA,GAAQ,IAAA;EACR,SAAA,GAAY,IAAA;AAAA,IAEV,UAAA;AAAA,KAGQ,cAAA,sCAAoD,QAAA,SAAiB,cAAA,GAC7E,QAAA,eAAuB,QAAA,GACrB,eAAA,CAAgB,QAAA,CAAS,QAAA,KACzB,UAAA,GACF,UAAA;AAAA,UAEa,WAAA,KAAgB,UAAA,UAAoB,KAAA,CAAM,CAAA;EAAA,CACxD,IAAA,IAAQ,MAAA;AAAA;AAAA,UAGM,YAAA,WAAuB,cAAA,GAAiB,cAAA;EACvD,OAAA,GAAU,CAAA;EACV,MAAA;AAAA;AAAA,UAGe,eAAA;EACf,IAAA;EACA,EAAA;EACA,KAAA;AAAA;AAAA,UAGe,kBAAA,WAA6B,cAAA,GAAiB,cAAA;EAC7D,KAAA,GAAQ,MAAA;EACR,OAAA,GAAU,CAAA;EACV,MAAA;AAAA"}

package/build/utils.cjs

@@ -1,4 +1,4 @@
-const require_symbols = require('./symbols-nFs99aEX.cjs');
+const require_symbols = require('./symbols-B--FS78o.cjs');
 
 //#region src/utils.ts
 function getType(model) {

package/build/utils.d.cts

@@ -1,4 +1,4 @@
-import { C as REL_META, E as ModelLike, S as REL_LINKS, T as Adapter, b as LINKS, f as StoreModel, r as JsonApiLink, w as TYPE, x as META } from "./types-NiKV-lj-.cjs";
+import { C as REL_LINKS, D as ModelLike, E as Adapter, S as META, T as TYPE, p as StoreModel, r as JsonApiLink, w as REL_META, x as LINKS } from "./types-iC38_iCI.cjs";
 
 //#region src/utils.d.ts
 declare function getType(model: StoreModel): string | undefined;

package/build/utils.d.mts

@@ -1,4 +1,4 @@
-import { C as REL_META, E as ModelLike, S as REL_LINKS, T as Adapter, b as LINKS, f as StoreModel, r as JsonApiLink, w as TYPE, x as META } from "./types-Do2flKZX.mjs";
+import { C as REL_LINKS, D as ModelLike, E as Adapter, S as META, T as TYPE, p as StoreModel, r as JsonApiLink, w as REL_META, x as LINKS } from "./types-KZiF6x7A.mjs";
 
 //#region src/utils.d.ts
 declare function getType(model: StoreModel): string | undefined;

package/build/utils.mjs

@@ -1,4 +1,4 @@
-import { a as TYPE, i as REL_META, n as META, o as adapter_default, r as REL_LINKS, t as LINKS } from "./symbols-DSjKJ8vh.mjs";
+import { a as TYPE, i as REL_META, n as META, o as adapter_default, r as REL_LINKS, t as LINKS } from "./symbols-BfU4k1el.mjs";
 
 //#region src/utils.ts
 function getType(model) {

package/build/{yayson-l2JKseMH.cjs → yayson-B51EJfRP.cjs}

@@ -1,4 +1,4 @@
-const require_symbols = require('./symbols-nFs99aEX.cjs');
+const require_symbols = require('./symbols-B--FS78o.cjs');
 
 //#region src/yayson/adapters/sequelize.ts
 function isSequelizeModel(model) {
@@ -8,6 +8,10 @@ var SequelizeAdapter = class extends require_symbols.adapter_default {
 	static get(model, key) {
 		if (isSequelizeModel(model)) return model.get(key);
 	}
+	static has(model, key) {
+		if (isSequelizeModel(model)) return model.get(key) !== void 0;
+		return false;
+	}
 	static id(model) {
 		const pkFields = model.constructor && "primaryKeys" in model.constructor ? Object.keys(model.constructor.primaryKeys) : ["id"];
 		if (pkFields.length > 1) throw new Error("YAYSON does not support Sequelize models with composite primary keys. You can only use one column for your primary key. Currently using: " + pkFields.join(","));
@@ -69,23 +73,32 @@ function createPresenter(adapter) {
 			const result = [];
 			if (!relationships) return result;
 			for (const key in relationships) {
-				const factory = relationships[key];
-				if (!factory) throw new Error(`Presenter for ${key} in ${this.constructor.type} is not defined`);
-				const presenter = new factory(scope);
+				const entry = relationships[key];
+				if (!entry) throw new Error(`Presenter for ${key} in ${this.constructor.type} is not defined`);
+				const presenter = new (typeof entry === "function" ? entry : entry.presenter)(scope);
 				const data = this.constructor.adapter.get(instance, key);
 				result.push(presenter.toJSON(data, { include: true }));
 			}
 			return result;
 		}
-		buildRelationships(instance) {
+		buildRelationships(instance, options = {}) {
 			if (instance == null) return null;
 			const rels = this.relationships();
 			const links = this.links(instance) || {};
+			const isPayload = options.payload === true;
 			let relationships = null;
 			if (!rels) return null;
 			for (const key in rels) {
+				const entry = rels[key];
+				if (!entry) continue;
+				const isConfig = typeof entry !== "function";
+				const presenter = isConfig ? entry.presenter : entry;
+				const hasMany = isConfig ? entry.hasMany : void 0;
+				const optional = isConfig ? entry.optional ?? false : false;
+				const linkValue = links[key];
+				const hasLinks = linkValue != null;
 				const data = this.constructor.adapter.get(instance, key);
-				const presenter = rels[key];
+				const keyPresent = this.constructor.adapter.has(instance, key);
 				const buildData = (d) => {
 					const id = this.constructor.adapter.id(d);
 					if (!id) throw new Error(`Model of type ${presenter.type} is missing an id (relationship '${key}' of ${this.constructor.type})`);
@@ -94,19 +107,21 @@ function createPresenter(adapter) {
 						type: presenter.type
 					};
 				};
-				const build = (d) => {
-					const rel = {};
-					if (d != null) rel.data = buildData(d);
-					if (links[key] != null) rel.links = buildLinks(links[key]);
-					else if (d == null) rel.data = null;
-					return rel;
-				};
+				if (optional && !keyPresent && !isPayload) {
+					if (hasLinks) {
+						if (!relationships) relationships = {};
+						relationships[key] = { links: buildLinks(linkValue) };
+					}
+					continue;
+				}
 				if (!relationships) relationships = {};
-				if (!relationships[key]) relationships[key] = {};
-				if (Array.isArray(data)) {
-					relationships[key].data = data.map(buildData);
-					if (links[key] != null) relationships[key].links = buildLinks(links[key]);
-				} else relationships[key] = build(data);
+				const rel = {};
+				if (Array.isArray(data)) rel.data = data.map(buildData);
+				else if (data != null) rel.data = buildData(data);
+				else if (hasMany === true) rel.data = [];
+				else if (!hasLinks) rel.data = null;
+				if (hasLinks) rel.links = buildLinks(linkValue);
+				relationships[key] = rel;
 			}
 			return relationships;
 		}
@@ -159,7 +174,7 @@ function createPresenter(adapter) {
 			};
 			const id = this.id(instance);
 			if (id != null) model.id = id;
-			const relationships = this.buildRelationships(instance);
+			const relationships = this.buildRelationships(instance, { payload: true });
 			if (relationships != null) model.relationships = relationships;
 			const result = { data: model };
 			const opts = options ?? {};
@@ -208,6 +223,42 @@ function validate(schema, data, strict) {
 	}
 }
 
+//#endregion
+//#region src/yayson/safe.ts
+/**
+* Defenses against prototype pollution, since yayson keys lookup tables and
+* model objects by strings from untrusted documents (`type`, `id`, member
+* names). Per MDN's guidance
+* (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution):
+* caches use null-prototype objects, and "__proto__"/"constructor"/"prototype"
+* are rejected as member names.
+*/
+/** Null-prototype lookup table (MDN's `Object.create(null)`, never `obj.__proto__`). */
+function safeObject() {
+	return Object.create(null);
+}
+/**
+* Normalize a caller-supplied cache to a null-prototype object, so a public
+* `models` argument that happens to be a plain `{}` can't let type="__proto__"
+* resolve through Object.prototype. Already-null-prototype caches pass through
+* unchanged (preserving identity/memoization).
+*/
+function safeCache(cache) {
+	if (cache === void 0) return safeObject();
+	if (Object.getPrototypeOf(cache) === null) return cache;
+	const safe = safeObject();
+	Object.assign(safe, cache);
+	return safe;
+}
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isUnsafeKey(key) {
+	return UNSAFE_KEYS.has(key);
+}
+
 //#endregion
 //#region src/yayson/store.ts
 function hasId(model) {
@@ -249,7 +300,7 @@ var Store = class Store {
 		return stub;
 	}
 	#createModel(resource, options) {
-		const models = options?.models ?? {};
+		const models = options?.models ?? safeObject();
 		const model = { ...resource.attributes || {} };
 		if (resource.id != null) model.id = resource.id;
 		const type = resource.type;
@@ -258,7 +309,7 @@ var Store = class Store {
 		if (resource.links != null) model[require_symbols.LINKS] = resource.links;
 		if (hasId(model)) {
 			const idStr = String(model.id);
-			if (!models[type]) models[type] = {};
+			if (!models[type]) models[type] = safeObject();
 			if (!models[type][idStr]) models[type][idStr] = model;
 		}
 		if (resource.relationships != null) {
@@ -271,7 +322,8 @@ var Store = class Store {
 	}
 	#resolveRelationships(model, relationships, resolver, options) {
 		const includeRelMeta = options?.includeRelMeta ?? true;
-		for (const key in relationships) {
+		for (const key of Object.keys(relationships)) {
+			if (isUnsafeKey(key)) continue;
 			const { data, links, meta } = relationships[key];
 			model[key] = null;
 			if (data == null && links == null) continue;
@@ -293,7 +345,7 @@ var Store = class Store {
 		}
 	}
 	toModel(rec, type, models) {
-		const model = this.#createModel(rec, { models });
+		const model = this.#createModel(rec, { models: safeCache(models) });
 		if (this.schemas && this.schemas[rec.type]) {
 			const schema = this.schemas[rec.type];
 			const result = validate(schema, model, this.strict);
@@ -326,14 +378,14 @@ var Store = class Store {
 		return this.toModel(rec, type, models);
 	}
 	find(type, id, models) {
-		return this.#findModel(type, id, models ?? {});
+		return this.#findModel(type, id, safeCache(models));
 	}
 	findAll(type, models) {
-		const modelsObj = models ?? {};
+		const modelsObj = safeCache(models);
 		const recs = this.findRecords(type);
 		if (recs == null) return [];
 		recs.forEach((rec) => {
-			if (!modelsObj[type]) modelsObj[type] = {};
+			if (!modelsObj[type]) modelsObj[type] = safeObject();
 			return this.toModel(rec, type, modelsObj);
 		});
 		return Object.values(modelsObj[type] || {});
@@ -382,7 +434,7 @@ var Store = class Store {
 		try {
 			syncData(body.included);
 			const recs = syncData(body.data);
-			const models = {};
+			const models = safeObject();
 			const result = recs.map((rec) => this.toModel(rec, rec.type, models));
 			if (body.meta != null) result[require_symbols.META] = body.meta;
 			return result;
@@ -454,6 +506,24 @@ Object.defineProperty(exports, 'filterByFields', {
     return filterByFields;
   }
 });
+Object.defineProperty(exports, 'isUnsafeKey', {
+  enumerable: true,
+  get: function () {
+    return isUnsafeKey;
+  }
+});
+Object.defineProperty(exports, 'safeCache', {
+  enumerable: true,
+  get: function () {
+    return safeCache;
+  }
+});
+Object.defineProperty(exports, 'safeObject', {
+  enumerable: true,
+  get: function () {
+    return safeObject;
+  }
+});
 Object.defineProperty(exports, 'validate', {
   enumerable: true,
   get: function () {

package/build/{yayson-3UYKq2H5.d.cts → yayson-BvwMr4Ad.d.mts}

@@ -1,4 +1,4 @@
-import { E as ModelLike, T as Adapter, _ as StoreResult, d as SchemaRegistry, f as StoreModel, g as StoreRecord$1, h as StoreOptions, i as JsonApiLinks, m as StoreModels, n as JsonApiDocument, o as JsonApiRelationships, p as StoreModelWithOptionalId, r as JsonApiLink, t as InferModelType, u as PresenterOptions, v as ValidationError } from "./types-NiKV-lj-.cjs";
+import { D as ModelLike, E as Adapter, _ as StoreRecord$1, d as RelationshipConfig, f as SchemaRegistry, g as StoreOptions, h as StoreModels, i as JsonApiLinks, m as StoreModelWithOptionalId, n as JsonApiDocument, o as JsonApiRelationships, p as StoreModel, r as JsonApiLink, t as InferModelType, u as PresenterOptions, v as StoreResult, y as ValidationError } from "./types-KZiF6x7A.mjs";
 
 //#region src/yayson/presenter.d.ts
 declare function createPresenter(adapter: typeof Adapter): {
@@ -8,10 +8,12 @@ declare function createPresenter(adapter: typeof Adapter): {
     id(instance: ModelLike): string | undefined;
     selfLinks(_instance: ModelLike): JsonApiLink | string | undefined;
     links(_instance?: ModelLike): JsonApiLinks | undefined;
-    relationships(): Record<string, /*elided*/any>;
+    relationships(): Record<string, /*elided*/any | RelationshipConfig< /*elided*/any>>;
     attributes(instance: ModelLike | null): Record<string, unknown>;
     includeRelationships(scope: JsonApiDocument, instance: ModelLike): unknown[];
-    buildRelationships(instance: ModelLike | null): JsonApiRelationships | null;
+    buildRelationships(instance: ModelLike | null, options?: {
+      payload?: boolean;
+    }): JsonApiRelationships | null;
     buildSelfLink(instance: ModelLike): JsonApiLink | undefined;
     toJSON(instanceOrCollection: ModelLike | ModelLike[] | null | undefined, options?: PresenterOptions): JsonApiDocument;
     payload(instance: ModelLike, options?: PresenterOptions): JsonApiDocument;
@@ -78,4 +80,4 @@ interface YaysonResult {
 declare function yayson(options?: YaysonOptions): YaysonResult;
 //#endregion
 export { Presenter as i, YaysonResult as n, yayson as r, YaysonOptions as t };
-//# sourceMappingURL=yayson-3UYKq2H5.d.cts.map
+//# sourceMappingURL=yayson-BvwMr4Ad.d.mts.map

package/build/yayson-BvwMr4Ad.d.mts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yayson-BvwMr4Ad.d.mts","names":[],"sources":["../../../../../../yayson/presenter.ts","../../../../../../yayson/store.ts","../../../../../../yayson.ts"],"mappings":";;;iBA0BwB,eAAA,CAAgB,OAAA,SAAgB,OAAA;EAAA,aAUhC,eAAA;iBAVe;WAQ5B,eAAA;iBAMM,SAAA;yBAIQ,SAAA,GAAY,WAAA;sBAIf,SAAA,GAAY,YAAA;qBAIb,MAAA,SAZJ,gBAYsC,kBAAA,EAZtC;yBAgBQ,SAAA,UAAmB,MAAA;gCAiBZ,eAAA,EAAe,QAAA,EAAY,SAAA;iCAqB1B,SAAA,SAAgB,OAAA;MAAa,OAAA;IAAA,IAA2B,oBAAA;4BAuE7D,SAAA,GAAY,WAAA;iCAKZ,SAAA,GAAY,SAAA,uBAA8B,OAAA,GACtD,gBAAA,GACT,eAAA;sBA8Ee,SAAA,EAAS,OAAA,GAAY,gBAAA,GAAmB,eAAA;iCA0B7B,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;EAAA;;;;+BAItD,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;+BAI7D,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;oBAIxE,SAAA,EAAS,OAAA,GAAY,gBAAA,GAAmB,eAAA;AAAA;AAAA,KAQzD,SAAA,GAAY,UAAA,QAAkB,eAAA;;;cCjRpC,WAAA,YAAuB,aAAA;EAC3B,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;cAEK,OAAA,EAAS,aAAA;AAAA;AAAA,cAUF,KAAA,WAAgB,cAAA,GAAiB,cAAA;EAAA;EACpD,OAAA,EAAS,WAAA;EACT,OAAA,GAAU,CAAA;EACV,MAAA;EACA,gBAAA,EAAkB,eAAA;cAEN,OAAA,GAAU,YAAA,CAAa,CAAA;EAMnC,KAAA,CAAA;EAuGA,OAAA,CAAQ,GAAA,EAAK,WAAA,EAAa,IAAA,UAAc,MAAA,EAAQ,WAAA,GAAc,UAAA;EA+B9D,UAAA,CAAW,IAAA,UAAc,EAAA,oBAAsB,WAAA;EAK/C,WAAA,CAAY,IAAA,WAAe,WAAA;EAiB3B,IAAA,kBAAA,CAAuB,IAAA,EAAM,CAAA,EAAG,EAAA,mBAAqB,MAAA,GAAS,WAAA,GAAc,cAAA,CAAe,CAAA,EAAG,CAAA;EAM9F,OAAA,kBAAA,CAA0B,IAAA,EAAM,CAAA,EAAG,MAAA,GAAS,WAAA,GAAc,cAAA,CAAe,CAAA,EAAG,CAAA;EAgB5E,MAAA,CAAO,IAAA,UAAc,EAAA;EAkBrB,OAAA,CAAQ,IAAA,EAAM,eAAA,GAAkB,WAAA;EA8DhC,IAAA,CAAK,IAAA,EAAM,eAAA,GAAkB,UAAA,GAAa,WAAA;ED5I5B;;;;;;;EAAA,OC+JP,KAAA,CAAM,IAAA,EAAM,eAAA,GAAkB,wBAAA;EAIrC,KAAA,CAAM,IAAA,EAAM,eAAA,GAAkB,wBAAA;EAQ9B,QAAA,kBAAA,CAA2B,IAAA,EAAM,CAAA,EAAG,IAAA,EAAM,eAAA,GAAkB,cAAA,CAAe,CAAA,EAAG,CAAA;EAW9E,WAAA,kBAAA,CAA8B,IAAA,EAAM,CAAA,EAAG,IAAA,EAAM,eAAA,GAAkB,WAAA,CAAY,cAAA,CAAe,CAAA,EAAG,CAAA;AAAA;;;KC9U1F,aAAA,mBAAgC,OAAA;AAAA,UAE3B,aAAA;EACR,OAAA,GAAU,aAAA;AAAA;AAAA,UAGF,YAAA;EACR,KAAA,SAAc,KAAA;EACd,SAAA,EAAW,SAAA;EACX,OAAA,SAAgB,OAAA;AAAA;AAAA,iBAgBT,MAAA,CAAO,OAAA,GAAU,aAAA,GAAgB,YAAA"}

package/build/{yayson-Ce5uGpgU.d.mts → yayson-DTMLeA5k.d.cts}

@@ -1,4 +1,4 @@
-import { E as ModelLike, T as Adapter, _ as StoreResult, d as SchemaRegistry, f as StoreModel, g as StoreRecord$1, h as StoreOptions, i as JsonApiLinks, m as StoreModels, n as JsonApiDocument, o as JsonApiRelationships, p as StoreModelWithOptionalId, r as JsonApiLink, t as InferModelType, u as PresenterOptions, v as ValidationError } from "./types-Do2flKZX.mjs";
+import { D as ModelLike, E as Adapter, _ as StoreRecord$1, d as RelationshipConfig, f as SchemaRegistry, g as StoreOptions, h as StoreModels, i as JsonApiLinks, m as StoreModelWithOptionalId, n as JsonApiDocument, o as JsonApiRelationships, p as StoreModel, r as JsonApiLink, t as InferModelType, u as PresenterOptions, v as StoreResult, y as ValidationError } from "./types-iC38_iCI.cjs";
 
 //#region src/yayson/presenter.d.ts
 declare function createPresenter(adapter: typeof Adapter): {
@@ -8,10 +8,12 @@ declare function createPresenter(adapter: typeof Adapter): {
     id(instance: ModelLike): string | undefined;
     selfLinks(_instance: ModelLike): JsonApiLink | string | undefined;
     links(_instance?: ModelLike): JsonApiLinks | undefined;
-    relationships(): Record<string, /*elided*/any>;
+    relationships(): Record<string, /*elided*/any | RelationshipConfig< /*elided*/any>>;
     attributes(instance: ModelLike | null): Record<string, unknown>;
     includeRelationships(scope: JsonApiDocument, instance: ModelLike): unknown[];
-    buildRelationships(instance: ModelLike | null): JsonApiRelationships | null;
+    buildRelationships(instance: ModelLike | null, options?: {
+      payload?: boolean;
+    }): JsonApiRelationships | null;
     buildSelfLink(instance: ModelLike): JsonApiLink | undefined;
     toJSON(instanceOrCollection: ModelLike | ModelLike[] | null | undefined, options?: PresenterOptions): JsonApiDocument;
     payload(instance: ModelLike, options?: PresenterOptions): JsonApiDocument;
@@ -78,4 +80,4 @@ interface YaysonResult {
 declare function yayson(options?: YaysonOptions): YaysonResult;
 //#endregion
 export { Presenter as i, YaysonResult as n, yayson as r, YaysonOptions as t };
-//# sourceMappingURL=yayson-Ce5uGpgU.d.mts.map
+//# sourceMappingURL=yayson-DTMLeA5k.d.cts.map

package/build/yayson-DTMLeA5k.d.cts.map

@@ -0,0 +1 @@
+{"version":3,"file":"yayson-DTMLeA5k.d.cts","names":[],"sources":["../../../../../../yayson/presenter.ts","../../../../../../yayson/store.ts","../../../../../../yayson.ts"],"mappings":";;;iBA0BwB,eAAA,CAAgB,OAAA,SAAgB,OAAA;EAAA,aAUhC,eAAA;iBAVe;WAQ5B,eAAA;iBAMM,SAAA;yBAIQ,SAAA,GAAY,WAAA;sBAIf,SAAA,GAAY,YAAA;qBAIb,MAAA,SAZJ,gBAYsC,kBAAA,EAZtC;yBAgBQ,SAAA,UAAmB,MAAA;gCAiBZ,eAAA,EAAe,QAAA,EAAY,SAAA;iCAqB1B,SAAA,SAAgB,OAAA;MAAa,OAAA;IAAA,IAA2B,oBAAA;4BAuE7D,SAAA,GAAY,WAAA;iCAKZ,SAAA,GAAY,SAAA,uBAA8B,OAAA,GACtD,gBAAA,GACT,eAAA;sBA8Ee,SAAA,EAAS,OAAA,GAAY,gBAAA,GAAmB,eAAA;iCA0B7B,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;EAAA;;;;+BAItD,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;+BAI7D,SAAA,GAAY,SAAA,WAAkB,OAAA,GAAY,gBAAA,GAAmB,eAAA;oBAIxE,SAAA,EAAS,OAAA,GAAY,gBAAA,GAAmB,eAAA;AAAA;AAAA,KAQzD,SAAA,GAAY,UAAA,QAAkB,eAAA;;;cCjRpC,WAAA,YAAuB,aAAA;EAC3B,EAAA;EACA,IAAA;EACA,UAAA,GAAa,MAAA;EACb,aAAA,GAAgB,oBAAA;EAChB,KAAA,GAAQ,WAAA;EACR,IAAA,GAAO,MAAA;cAEK,OAAA,EAAS,aAAA;AAAA;AAAA,cAUF,KAAA,WAAgB,cAAA,GAAiB,cAAA;EAAA;EACpD,OAAA,EAAS,WAAA;EACT,OAAA,GAAU,CAAA;EACV,MAAA;EACA,gBAAA,EAAkB,eAAA;cAEN,OAAA,GAAU,YAAA,CAAa,CAAA;EAMnC,KAAA,CAAA;EAuGA,OAAA,CAAQ,GAAA,EAAK,WAAA,EAAa,IAAA,UAAc,MAAA,EAAQ,WAAA,GAAc,UAAA;EA+B9D,UAAA,CAAW,IAAA,UAAc,EAAA,oBAAsB,WAAA;EAK/C,WAAA,CAAY,IAAA,WAAe,WAAA;EAiB3B,IAAA,kBAAA,CAAuB,IAAA,EAAM,CAAA,EAAG,EAAA,mBAAqB,MAAA,GAAS,WAAA,GAAc,cAAA,CAAe,CAAA,EAAG,CAAA;EAM9F,OAAA,kBAAA,CAA0B,IAAA,EAAM,CAAA,EAAG,MAAA,GAAS,WAAA,GAAc,cAAA,CAAe,CAAA,EAAG,CAAA;EAgB5E,MAAA,CAAO,IAAA,UAAc,EAAA;EAkBrB,OAAA,CAAQ,IAAA,EAAM,eAAA,GAAkB,WAAA;EA8DhC,IAAA,CAAK,IAAA,EAAM,eAAA,GAAkB,UAAA,GAAa,WAAA;ED5I5B;;;;;;;EAAA,OC+JP,KAAA,CAAM,IAAA,EAAM,eAAA,GAAkB,wBAAA;EAIrC,KAAA,CAAM,IAAA,EAAM,eAAA,GAAkB,wBAAA;EAQ9B,QAAA,kBAAA,CAA2B,IAAA,EAAM,CAAA,EAAG,IAAA,EAAM,eAAA,GAAkB,cAAA,CAAe,CAAA,EAAG,CAAA;EAW9E,WAAA,kBAAA,CAA8B,IAAA,EAAM,CAAA,EAAG,IAAA,EAAM,eAAA,GAAkB,WAAA,CAAY,cAAA,CAAe,CAAA,EAAG,CAAA;AAAA;;;KC9U1F,aAAA,mBAAgC,OAAA;AAAA,UAE3B,aAAA;EACR,OAAA,GAAU,aAAA;AAAA;AAAA,UAGF,YAAA;EACR,KAAA,SAAc,KAAA;EACd,SAAA,EAAW,SAAA;EACX,OAAA,SAAgB,OAAA;AAAA;AAAA,iBAgBT,MAAA,CAAO,OAAA,GAAU,aAAA,GAAgB,YAAA"}

package/build/{yayson-CwZg5FNt.mjs → yayson-RzT9zsdx.mjs}

@@ -1,4 +1,4 @@
-import { a as TYPE, i as REL_META, n as META, o as adapter_default, r as REL_LINKS, t as LINKS } from "./symbols-DSjKJ8vh.mjs";
+import { a as TYPE, i as REL_META, n as META, o as adapter_default, r as REL_LINKS, t as LINKS } from "./symbols-BfU4k1el.mjs";
 
 //#region src/yayson/adapters/sequelize.ts
 function isSequelizeModel(model) {
@@ -8,6 +8,10 @@ var SequelizeAdapter = class extends adapter_default {
 	static get(model, key) {
 		if (isSequelizeModel(model)) return model.get(key);
 	}
+	static has(model, key) {
+		if (isSequelizeModel(model)) return model.get(key) !== void 0;
+		return false;
+	}
 	static id(model) {
 		const pkFields = model.constructor && "primaryKeys" in model.constructor ? Object.keys(model.constructor.primaryKeys) : ["id"];
 		if (pkFields.length > 1) throw new Error("YAYSON does not support Sequelize models with composite primary keys. You can only use one column for your primary key. Currently using: " + pkFields.join(","));
@@ -69,23 +73,32 @@ function createPresenter(adapter) {
 			const result = [];
 			if (!relationships) return result;
 			for (const key in relationships) {
-				const factory = relationships[key];
-				if (!factory) throw new Error(`Presenter for ${key} in ${this.constructor.type} is not defined`);
-				const presenter = new factory(scope);
+				const entry = relationships[key];
+				if (!entry) throw new Error(`Presenter for ${key} in ${this.constructor.type} is not defined`);
+				const presenter = new (typeof entry === "function" ? entry : entry.presenter)(scope);
 				const data = this.constructor.adapter.get(instance, key);
 				result.push(presenter.toJSON(data, { include: true }));
 			}
 			return result;
 		}
-		buildRelationships(instance) {
+		buildRelationships(instance, options = {}) {
 			if (instance == null) return null;
 			const rels = this.relationships();
 			const links = this.links(instance) || {};
+			const isPayload = options.payload === true;
 			let relationships = null;
 			if (!rels) return null;
 			for (const key in rels) {
+				const entry = rels[key];
+				if (!entry) continue;
+				const isConfig = typeof entry !== "function";
+				const presenter = isConfig ? entry.presenter : entry;
+				const hasMany = isConfig ? entry.hasMany : void 0;
+				const optional = isConfig ? entry.optional ?? false : false;
+				const linkValue = links[key];
+				const hasLinks = linkValue != null;
 				const data = this.constructor.adapter.get(instance, key);
-				const presenter = rels[key];
+				const keyPresent = this.constructor.adapter.has(instance, key);
 				const buildData = (d) => {
 					const id = this.constructor.adapter.id(d);
 					if (!id) throw new Error(`Model of type ${presenter.type} is missing an id (relationship '${key}' of ${this.constructor.type})`);
@@ -94,19 +107,21 @@ function createPresenter(adapter) {
 						type: presenter.type
 					};
 				};
-				const build = (d) => {
-					const rel = {};
-					if (d != null) rel.data = buildData(d);
-					if (links[key] != null) rel.links = buildLinks(links[key]);
-					else if (d == null) rel.data = null;
-					return rel;
-				};
+				if (optional && !keyPresent && !isPayload) {
+					if (hasLinks) {
+						if (!relationships) relationships = {};
+						relationships[key] = { links: buildLinks(linkValue) };
+					}
+					continue;
+				}
 				if (!relationships) relationships = {};
-				if (!relationships[key]) relationships[key] = {};
-				if (Array.isArray(data)) {
-					relationships[key].data = data.map(buildData);
-					if (links[key] != null) relationships[key].links = buildLinks(links[key]);
-				} else relationships[key] = build(data);
+				const rel = {};
+				if (Array.isArray(data)) rel.data = data.map(buildData);
+				else if (data != null) rel.data = buildData(data);
+				else if (hasMany === true) rel.data = [];
+				else if (!hasLinks) rel.data = null;
+				if (hasLinks) rel.links = buildLinks(linkValue);
+				relationships[key] = rel;
 			}
 			return relationships;
 		}
@@ -159,7 +174,7 @@ function createPresenter(adapter) {
 			};
 			const id = this.id(instance);
 			if (id != null) model.id = id;
-			const relationships = this.buildRelationships(instance);
+			const relationships = this.buildRelationships(instance, { payload: true });
 			if (relationships != null) model.relationships = relationships;
 			const result = { data: model };
 			const opts = options ?? {};
@@ -208,6 +223,42 @@ function validate(schema, data, strict) {
 	}
 }
 
+//#endregion
+//#region src/yayson/safe.ts
+/**
+* Defenses against prototype pollution, since yayson keys lookup tables and
+* model objects by strings from untrusted documents (`type`, `id`, member
+* names). Per MDN's guidance
+* (https://developer.mozilla.org/en-US/docs/Web/Security/Attacks/Prototype_pollution):
+* caches use null-prototype objects, and "__proto__"/"constructor"/"prototype"
+* are rejected as member names.
+*/
+/** Null-prototype lookup table (MDN's `Object.create(null)`, never `obj.__proto__`). */
+function safeObject() {
+	return Object.create(null);
+}
+/**
+* Normalize a caller-supplied cache to a null-prototype object, so a public
+* `models` argument that happens to be a plain `{}` can't let type="__proto__"
+* resolve through Object.prototype. Already-null-prototype caches pass through
+* unchanged (preserving identity/memoization).
+*/
+function safeCache(cache) {
+	if (cache === void 0) return safeObject();
+	if (Object.getPrototypeOf(cache) === null) return cache;
+	const safe = safeObject();
+	Object.assign(safe, cache);
+	return safe;
+}
+const UNSAFE_KEYS = new Set([
+	"__proto__",
+	"constructor",
+	"prototype"
+]);
+function isUnsafeKey(key) {
+	return UNSAFE_KEYS.has(key);
+}
+
 //#endregion
 //#region src/yayson/store.ts
 function hasId(model) {
@@ -249,7 +300,7 @@ var Store = class Store {
 		return stub;
 	}
 	#createModel(resource, options) {
-		const models = options?.models ?? {};
+		const models = options?.models ?? safeObject();
 		const model = { ...resource.attributes || {} };
 		if (resource.id != null) model.id = resource.id;
 		const type = resource.type;
@@ -258,7 +309,7 @@ var Store = class Store {
 		if (resource.links != null) model[LINKS] = resource.links;
 		if (hasId(model)) {
 			const idStr = String(model.id);
-			if (!models[type]) models[type] = {};
+			if (!models[type]) models[type] = safeObject();
 			if (!models[type][idStr]) models[type][idStr] = model;
 		}
 		if (resource.relationships != null) {
@@ -271,7 +322,8 @@ var Store = class Store {
 	}
 	#resolveRelationships(model, relationships, resolver, options) {
 		const includeRelMeta = options?.includeRelMeta ?? true;
-		for (const key in relationships) {
+		for (const key of Object.keys(relationships)) {
+			if (isUnsafeKey(key)) continue;
 			const { data, links, meta } = relationships[key];
 			model[key] = null;
 			if (data == null && links == null) continue;
@@ -293,7 +345,7 @@ var Store = class Store {
 		}
 	}
 	toModel(rec, type, models) {
-		const model = this.#createModel(rec, { models });
+		const model = this.#createModel(rec, { models: safeCache(models) });
 		if (this.schemas && this.schemas[rec.type]) {
 			const schema = this.schemas[rec.type];
 			const result = validate(schema, model, this.strict);
@@ -326,14 +378,14 @@ var Store = class Store {
 		return this.toModel(rec, type, models);
 	}
 	find(type, id, models) {
-		return this.#findModel(type, id, models ?? {});
+		return this.#findModel(type, id, safeCache(models));
 	}
 	findAll(type, models) {
-		const modelsObj = models ?? {};
+		const modelsObj = safeCache(models);
 		const recs = this.findRecords(type);
 		if (recs == null) return [];
 		recs.forEach((rec) => {
-			if (!modelsObj[type]) modelsObj[type] = {};
+			if (!modelsObj[type]) modelsObj[type] = safeObject();
 			return this.toModel(rec, type, modelsObj);
 		});
 		return Object.values(modelsObj[type] || {});
@@ -382,7 +434,7 @@ var Store = class Store {
 		try {
 			syncData(body.included);
 			const recs = syncData(body.data);
-			const models = {};
+			const models = safeObject();
 			const result = recs.map((rec) => this.toModel(rec, rec.type, models));
 			if (body.meta != null) result[META] = body.meta;
 			return result;
@@ -448,5 +500,5 @@ function yayson(options) {
 var yayson_default = yayson;
 
 //#endregion
-export { validate as n, filterByFields as r, yayson_default as t };
-//# sourceMappingURL=yayson-CwZg5FNt.mjs.map
+export { validate as a, safeObject as i, isUnsafeKey as n, filterByFields as o, safeCache as r, yayson_default as t };
+//# sourceMappingURL=yayson-RzT9zsdx.mjs.map