Safe Access InlineOne API, 10 Formats, PHP + JS/TS

Safely access deeply nested data with dot notation — no exceptions, no surprises.

Zero Surprises

get() never throws — missing keys, null data, or wrong types always return your safe default. Production-safe by design.

Quick start

10 Formats

JSON · XML · YAML · TOML · INI · CSV · ENV · NDJSON · Array · Object — one unified API, zero boilerplate.

See all formats

Immutable by Design

Every write returns a new instance. Enable deep-frozen readonly mode with { readonly: true } to block all mutations at runtime.

API reference

Powerful Queries

Wildcards (*.name) · Filters ([?price>20]) · Recursive descent (..key) · Slices ([0:5:2]) · Multi-index ([0,2,4]) · Filter functions (length, match, keys)

Path syntax

Security-First

Prototype pollution guard · SSRF + IPv6 blocking · XML XXE prevention · CSV injection sanitizer · 16 built-in sensitive-key auto-mask patterns.

Security docs

Schema Validation

Built-in adapters for Zod, Valibot, Yup, and JSON Schema. Set a global adapter via SchemaRegistry or supply one per call.

Schema adapters

Extensible

Override any parser or serializer via PluginRegistry. Integrations for Laravel, Symfony, NestJS, and Vite out of the box.

Plugin guide

TypeScript Types

Deep path inference with DeepPaths<T> and ValueAtPath<T, P>. Fully typed get() calls — no casting, no guessing.

TypeScript docs

PHP ↔ JS Parity

Identical API in both languages. Same paths, same results, same behavior — pick your stack.

PHP docs