npm - @strapi-community/plugin-io - Versions diffs - 5.3.1 → 5.3.3 - Mend

@strapi-community/plugin-io 5.3.1 → 5.3.3

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.

Files changed (15) hide show

package/dist/server/index.js CHANGED Viewed

@@ -83,10 +83,10 @@ const require$$0$3 = {
   strapi: strapi$1
 };
 const pluginPkg = require$$0$3;
-const pluginId$9 = pluginPkg.strapi.name;
-var pluginId_1 = { pluginId: pluginId$9 };
-const { pluginId: pluginId$8 } = pluginId_1;
-function getService$3({ name, plugin = pluginId$8, type: type2 = "plugin" }) {
+const pluginId$a = pluginPkg.strapi.name;
+var pluginId_1 = { pluginId: pluginId$a };
+const { pluginId: pluginId$9 } = pluginId_1;
+function getService$3({ name, plugin = pluginId$9, type: type2 = "plugin" }) {
   let serviceUID = `${type2}::${plugin}`;
   if (name && name.length) {
     serviceUID += `.${name}`;
@@ -129,7 +129,7 @@ async function handshake$2(socket, next) {
       room = strategyService["role"].getRoomName(role);
     }
     if (room) {
-      socket.join(room.replace(" ", "-"));
+      socket.join(room.replaceAll(" ", "-"));
     } else {
       throw new Error("No valid room found");
     }
@@ -156,7 +156,7 @@ var constants$7 = {
 const { Server } = require$$0__default.default;
 const { handshake } = middleware;
 const { getService: getService$1 } = getService_1;
-const { pluginId: pluginId$7 } = pluginId_1;
+const { pluginId: pluginId$8 } = pluginId_1;
 const { API_TOKEN_TYPE: API_TOKEN_TYPE$1 } = constants$7;
 let SocketIO$2 = class SocketIO {
   constructor(options) {
@@ -198,7 +198,7 @@ let SocketIO$2 = class SocketIO {
             });
             const roomName = strategy2.getRoomName(room);
             const data = transformService.response({ data: sanitizedData, schema: schema2 });
-            this._socket.to(roomName.replace(" ", "-")).emit(eventName, { ...data });
+            this._socket.to(roomName.replaceAll(" ", "-")).emit(eventName, { ...data });
             if (entityRoomName) {
               this._socket.to(entityRoomName).emit(eventName, { ...data });
             }
@@ -234,21 +234,25 @@ function requireSanitizeSensitiveFields() {
   hasRequiredSanitizeSensitiveFields = 1;
   const SENSITIVE_FIELDS = [
     "password",
+    "passwordHash",
     "resetPasswordToken",
     "registrationToken",
     "confirmationToken",
     "privateKey",
     "secretKey",
     "apiKey",
-    "secret",
-    "hash"
+    "secret"
   ];
-  function deepSanitize(obj) {
+  const MAX_SANITIZE_DEPTH = 20;
+  function deepSanitize(obj, depth2 = 0) {
     if (!obj || typeof obj !== "object") {
       return obj;
     }
+    if (depth2 >= MAX_SANITIZE_DEPTH) {
+      return obj;
+    }
     if (Array.isArray(obj)) {
-      return obj.map((item) => deepSanitize(item));
+      return obj.map((item) => deepSanitize(item, depth2 + 1));
     }
     const sanitized = {};
     for (const [key, value] of Object.entries(obj)) {
@@ -256,7 +260,7 @@ function requireSanitizeSensitiveFields() {
         continue;
       }
       if (value && typeof value === "object") {
-        sanitized[key] = deepSanitize(value);
+        sanitized[key] = deepSanitize(value, depth2 + 1);
       } else {
         sanitized[key] = value;
       }
@@ -276,11 +280,57 @@ function requireSanitizeSensitiveFields() {
   return sanitizeSensitiveFields;
 }
 const { SocketIO: SocketIO2 } = structures;
-const { pluginId: pluginId$6 } = pluginId_1;
+const { pluginId: pluginId$7 } = pluginId_1;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_FIELD_VALUE_SIZE = 1e5;
+function safeHandler(handler, expectsObject = true) {
+  return function(...args) {
+    try {
+      if (expectsObject) {
+        const data = args[0];
+        if (!data || typeof data !== "object" || Array.isArray(data)) {
+          const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+          if (callback) callback({ success: false, error: "Invalid payload" });
+          return;
+        }
+      }
+      const result = handler.apply(this, args);
+      if (result && typeof result.catch === "function") {
+        result.catch((err) => {
+          strapi.log.error(`socket.io: Unhandled error in event handler: ${err.message}`);
+          const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+          if (callback) callback({ success: false, error: "Internal error" });
+        });
+      }
+    } catch (err) {
+      strapi.log.error(`socket.io: Error in event handler: ${err.message}`);
+      const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+      if (callback) callback({ success: false, error: "Internal error" });
+    }
+  };
+}
+function resolveClientIp(socket) {
+  const xff = socket.handshake.headers?.["x-forwarded-for"];
+  if (xff) {
+    return xff.split(",")[0].trim();
+  }
+  return socket.handshake.address;
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.password) {
+      parsed.password = "***";
+    }
+    return parsed.toString();
+  } catch {
+    return url.replace(/:([^@/]+)@/, ":***@");
+  }
+}
 async function bootstrapIO$1({ strapi: strapi2 }) {
-  const settingsService = strapi2.plugin(pluginId$6).service("settings");
+  const settingsService = strapi2.plugin(pluginId$7).service("settings");
   const settings2 = await settingsService.getSettings();
-  const monitoringService = strapi2.plugin(pluginId$6).service("monitoring");
+  const monitoringService = strapi2.plugin(pluginId$7).service("monitoring");
   const serverOptions = {
     cors: {
       origin: settings2.cors?.origins || ["http://localhost:3000"],
@@ -292,7 +342,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
     connectTimeout: settings2.connection?.connectionTimeout || 45e3,
     maxHttpBufferSize: 1e6,
     transports: ["websocket", "polling"],
-    allowEIO3: true
+    allowEIO3: settings2.connection?.allowEIO3 ?? false
   };
   if (settings2.redis?.enabled) {
     try {
@@ -304,13 +354,15 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       const subClient = pubClient.duplicate();
       await Promise.all([pubClient.connect(), subClient.connect()]);
       serverOptions.adapter = createAdapter(pubClient, subClient);
-      strapi2.log.info(`socket.io: Redis adapter enabled (${settings2.redis.url})`);
+      serverOptions._redisClients = { pubClient, subClient };
+      strapi2.log.info(`socket.io: Redis adapter enabled (${redactUrl(settings2.redis.url)})`);
     } catch (err) {
       strapi2.log.error(`socket.io: Redis adapter failed: ${err.message}`);
     }
   }
   const io2 = new SocketIO2(serverOptions);
   strapi2.$io = io2;
+  strapi2.$io._redisClients = serverOptions._redisClients || null;
   strapi2.$ioSettings = settings2;
   const sanitizeSensitiveFields2 = requireSanitizeSensitiveFields();
   sanitizeSensitiveFields2({ strapi: strapi2 });
@@ -336,7 +388,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
   }
   strapi2.$io.namespaces = namespaces;
   io2.server.use(async (socket, next) => {
-    const clientIp = socket.handshake.address;
+    const clientIp = resolveClientIp(socket);
     if (settings2.security?.ipWhitelist?.length > 0) {
       if (!settings2.security.ipWhitelist.includes(clientIp)) {
         return next(new Error("IP not whitelisted"));
@@ -349,30 +401,22 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
     if (currentConnections >= (settings2.connection?.maxConnections || 1e3)) {
       return next(new Error("Max connections reached"));
     }
-    const token = socket.handshake.auth?.token || socket.handshake.query?.token;
-    const strategy2 = socket.handshake.auth?.strategy;
-    const isAdmin = socket.handshake.auth?.isAdmin === true;
+    const token = socket.handshake.auth?.token;
     if (token) {
-      if (isAdmin || strategy2 === "admin-jwt") {
-        try {
-          const presenceController = strapi2.plugin(pluginId$6).controller("presence");
-          const session = presenceController.consumeSessionToken(token);
-          if (session) {
-            socket.user = {
-              id: session.userId,
-              username: `${session.user.firstname || ""} ${session.user.lastname || ""}`.trim() || `Admin ${session.userId}`,
-              email: session.user.email || `admin-${session.userId}`,
-              role: "strapi-super-admin",
-              isAdmin: true
-            };
-            socket.adminUser = session.user;
-            presenceController.registerSocket(socket.id, token);
-            strapi2.log.info(`socket.io: Admin authenticated - ${socket.user.username} (ID: ${session.userId})`);
-          } else {
-            strapi2.log.warn(`socket.io: Admin session token invalid or expired`);
-          }
-        } catch (err) {
-          strapi2.log.warn(`socket.io: Admin session verification failed: ${err.message}`);
+      const isAdminToken = UUID_REGEX.test(token);
+      if (isAdminToken) {
+        if (socket.adminUser) {
+          const admin2 = socket.adminUser;
+          socket.user = {
+            id: admin2.id,
+            username: `${admin2.firstname || ""} ${admin2.lastname || ""}`.trim() || `Admin ${admin2.id}`,
+            email: admin2.email || `admin-${admin2.id}`,
+            role: "strapi-super-admin",
+            isAdmin: true
+          };
+          strapi2.log.info(`socket.io: Admin connected - ${socket.user.username} (ID: ${admin2.id})`);
+        } else {
+          strapi2.log.warn("socket.io: Admin token present but handshake did not authenticate");
         }
       } else {
         try {
@@ -438,13 +482,13 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
     });
   }
-  const presenceService = strapi2.plugin(pluginId$6).service("presence");
-  const previewService = strapi2.plugin(pluginId$6).service("preview");
+  const presenceService = strapi2.plugin(pluginId$7).service("presence");
+  const previewService = strapi2.plugin(pluginId$7).service("preview");
   if (settings2.presence?.enabled !== false) {
     presenceService.startCleanupInterval();
   }
   io2.server.on("connection", (socket) => {
-    const clientIp = socket.handshake.address || "unknown";
+    const clientIp = resolveClientIp(socket);
     const username = socket.user?.username || "anonymous";
     if (settings2.monitoring?.enableConnectionLogging) {
       strapi2.log.info(`socket.io: Client connected (id: ${socket.id}, user: ${username}, ip: ${clientIp})`);
@@ -490,19 +534,24 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       if (callback) callback({ success: true, room: roomName });
     });
     socket.on("leave-room", (roomName, callback) => {
-      if (typeof roomName === "string" && roomName.length > 0) {
-        socket.leave(roomName);
-        strapi2.log.debug(`socket.io: Socket ${socket.id} left room: ${roomName}`);
-        if (callback) callback({ success: true, room: roomName });
-      } else {
+      if (typeof roomName !== "string" || roomName.length === 0) {
         if (callback) callback({ success: false, error: "Invalid room name" });
+        return;
+      }
+      const sanitizedRoom = roomName.replace(/[^a-zA-Z0-9\-_:]/g, "");
+      if (sanitizedRoom !== roomName) {
+        if (callback) callback({ success: false, error: "Room name contains invalid characters" });
+        return;
       }
+      socket.leave(roomName);
+      strapi2.log.debug(`socket.io: Socket ${socket.id} left room: ${roomName}`);
+      if (callback) callback({ success: true, room: roomName });
     });
     socket.on("get-rooms", (callback) => {
       const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id);
       if (callback) callback({ success: true, rooms });
     });
-    socket.on("presence:join", async ({ uid, documentId }, callback) => {
+    socket.on("presence:join", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
@@ -513,8 +562,8 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       const result = await presenceService.joinEntity(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("presence:leave", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("presence:leave", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
@@ -525,24 +574,26 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       const result = await presenceService.leaveEntity(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
+    }));
     socket.on("presence:heartbeat", (callback) => {
       const result = presenceService.heartbeat(socket.id);
       if (callback) callback(result);
     });
-    socket.on("presence:typing", ({ uid, documentId, fieldName }) => {
+    socket.on("presence:typing", safeHandler(({ uid, documentId, fieldName }) => {
       if (settings2.presence?.enabled === false) return;
+      if (!socket.user) return;
+      if (typeof fieldName !== "string" || fieldName.length > 200) return;
       presenceService.broadcastTyping(socket.id, uid, documentId, fieldName);
-    });
-    socket.on("presence:check", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("presence:check", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
       }
       const editors = await presenceService.getEntityEditors(uid, documentId);
       if (callback) callback({ success: true, editors, isBeingEdited: editors.length > 0 });
-    });
-    socket.on("preview:subscribe", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("preview:subscribe", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.livePreview?.enabled === false) {
         if (callback) callback({ success: false, error: "Live preview is disabled" });
         return;
@@ -551,22 +602,33 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
         if (callback) callback({ success: false, error: "uid and documentId are required" });
         return;
       }
+      const userRole = socket.userRole || "public";
+      const rolePerms = (settings2.rolePermissions || {})[userRole] || {};
+      const ctPerms = rolePerms.contentTypes?.[uid];
+      if (!ctPerms && settings2.security?.requireAuthentication) {
+        if (callback) callback({ success: false, error: "Permission denied" });
+        return;
+      }
       const result = await previewService.subscribe(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("preview:unsubscribe", ({ uid, documentId }, callback) => {
+    }));
+    socket.on("preview:unsubscribe", safeHandler(({ uid, documentId }, callback) => {
       if (!uid || !documentId) {
         if (callback) callback({ success: false, error: "uid and documentId are required" });
         return;
       }
       const result = previewService.unsubscribe(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("preview:field-change", ({ uid, documentId, fieldName, value }) => {
+    }));
+    socket.on("preview:field-change", safeHandler(({ uid, documentId, fieldName, value }) => {
       if (settings2.livePreview?.enabled === false) return;
+      if (!socket.user) return;
+      if (typeof fieldName !== "string" || fieldName.length > 200) return;
+      const serialized = typeof value === "string" ? value : JSON.stringify(value);
+      if (serialized && serialized.length > MAX_FIELD_VALUE_SIZE) return;
       previewService.emitFieldChange(socket.id, uid, documentId, fieldName, value);
-    });
-    socket.on("subscribe-entity", async ({ uid, id }, callback) => {
+    }));
+    socket.on("subscribe-entity", safeHandler(async ({ uid, id }, callback) => {
       if (settings2.entitySubscriptions?.enabled === false) {
         if (callback) callback({ success: false, error: "Entity subscriptions are disabled" });
         return;
@@ -641,8 +703,8 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       strapi2.log.debug(`socket.io: Socket ${socket.id} subscribed to entity: ${entityRoomName}`);
       if (callback) callback({ success: true, room: entityRoomName, uid, id });
-    });
-    socket.on("unsubscribe-entity", ({ uid, id }, callback) => {
+    }));
+    socket.on("unsubscribe-entity", safeHandler(({ uid, id }, callback) => {
       if (settings2.entitySubscriptions?.enabled === false) {
         if (callback) callback({ success: false, error: "Entity subscriptions are disabled" });
         return;
@@ -663,9 +725,9 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       strapi2.log.debug(`socket.io: Socket ${socket.id} unsubscribed from entity: ${entityRoomName}`);
       if (callback) callback({ success: true, room: entityRoomName, uid, id });
-    });
+    }));
     socket.on("get-entity-subscriptions", (callback) => {
-      const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id && r.includes(":")).map((room) => {
+      const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id && /^(api|plugin)::/.test(r) && !r.startsWith("presence:") && !r.startsWith("preview:")).map((room) => {
         const lastColonIndex = room.lastIndexOf(":");
         const uid = room.substring(0, lastColonIndex);
         const id = room.substring(lastColonIndex + 1);
@@ -673,7 +735,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       });
       if (callback) callback({ success: true, subscriptions: rooms });
     });
-    socket.on("private-message", ({ to, message }, callback) => {
+    socket.on("private-message", safeHandler(({ to, message }, callback) => {
       if (settings2.rooms?.enablePrivateRooms === false) {
         strapi2.log.warn(`socket.io: Private messages disabled for socket ${socket.id}`);
         if (callback) callback({ success: false, error: "Private messages are disabled" });
@@ -701,7 +763,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       });
       strapi2.log.debug(`socket.io: Private message from ${socket.id} to ${to}`);
       if (callback) callback({ success: true });
-    });
+    }));
     socket.on("disconnect", async (reason) => {
       if (settings2.monitoring?.enableConnectionLogging) {
         strapi2.log.info(`socket.io: Client disconnected (id: ${socket.id}, user: ${username}, reason: ${reason})`);
@@ -718,7 +780,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
         previewService.cleanupSocket(socket.id);
       }
       try {
-        const presenceController = strapi2.plugin(pluginId$6).controller("presence");
+        const presenceController = strapi2.plugin(pluginId$7).controller("presence");
         if (presenceController?.unregisterSocket) {
           presenceController.unregisterSocket(socket.id);
         }
@@ -986,7 +1048,7 @@ function getTransactionCtx() {
   }
   return transactionCtx;
 }
-const { pluginId: pluginId$5 } = pluginId_1;
+const { pluginId: pluginId$6 } = pluginId_1;
 function scheduleAfterTransaction(callback, delay = 0) {
   const runner = () => setTimeout(callback, delay);
   const ctx = getTransactionCtx();
@@ -1096,8 +1158,8 @@ async function bootstrapLifecycles$1({ strapi: strapi2 }) {
       const modelInfo = { singularName: event.model.singularName, uid: event.model.uid };
       scheduleAfterTransaction(() => {
         try {
-          const diffService = strapi2.plugin(pluginId$5).service("diff");
-          const previewService = strapi2.plugin(pluginId$5).service("preview");
+          const diffService = strapi2.plugin(pluginId$6).service("diff");
+          const previewService = strapi2.plugin(pluginId$6).service("preview");
           const fieldLevelEnabled = strapi2.$ioSettings?.fieldLevelChanges?.enabled !== false;
           let eventPayload;
           if (fieldLevelEnabled && previousData && diffService) {
@@ -1214,14 +1276,14 @@ var config$1 = {
   validator(config2) {
   }
 };
-const { pluginId: pluginId$4 } = pluginId_1;
+const { pluginId: pluginId$5 } = pluginId_1;
 var settings$3 = ({ strapi: strapi2 }) => ({
   /**
    * GET /io/settings
    * Retrieve current plugin settings
    */
   async getSettings(ctx) {
-    const settingsService = strapi2.plugin(pluginId$4).service("settings");
+    const settingsService = strapi2.plugin(pluginId$5).service("settings");
     const settings2 = await settingsService.getSettings();
     ctx.body = { data: settings2 };
   },
@@ -1230,8 +1292,33 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Update plugin settings and hot-reload Socket.IO
    */
   async updateSettings(ctx) {
-    const settingsService = strapi2.plugin(pluginId$4).service("settings");
+    const settingsService = strapi2.plugin(pluginId$5).service("settings");
     const { body } = ctx.request;
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return ctx.badRequest("Request body must be a JSON object");
+    }
+    const ALLOWED_KEYS = [
+      "enabled",
+      "cors",
+      "connection",
+      "security",
+      "contentTypes",
+      "events",
+      "rooms",
+      "entitySubscriptions",
+      "rolePermissions",
+      "redis",
+      "namespaces",
+      "middleware",
+      "monitoring",
+      "presence",
+      "livePreview",
+      "fieldLevelChanges"
+    ];
+    const unknownKeys = Object.keys(body).filter((k) => !ALLOWED_KEYS.includes(k));
+    if (unknownKeys.length > 0) {
+      return ctx.badRequest(`Unknown settings keys: ${unknownKeys.join(", ")}`);
+    }
     await settingsService.getSettings();
     const updatedSettings = await settingsService.setSettings(body);
     strapi2.$ioSettings = updatedSettings;
@@ -1263,7 +1350,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get connection and event statistics
    */
   async getStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const connectionStats = monitoringService.getConnectionStats();
     const eventStats = monitoringService.getEventStats();
     ctx.body = {
@@ -1278,7 +1365,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get recent event log
    */
   async getEventLog(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const limit = parseInt(ctx.query.limit) || 50;
     const log = monitoringService.getEventLog(limit);
     ctx.body = { data: log };
@@ -1288,10 +1375,11 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Send a test event
    */
   async sendTestEvent(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const { eventName, data } = ctx.request.body;
     try {
-      const result = monitoringService.sendTestEvent(eventName || "test", data || {});
+      const safeName = (eventName || "test").replace(/[^a-zA-Z0-9:._-]/g, "").substring(0, 50);
+      const result = monitoringService.sendTestEvent(safeName, data || {});
       ctx.body = { data: result };
     } catch (error2) {
       ctx.throw(500, error2.message);
@@ -1302,7 +1390,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Reset monitoring statistics
    */
   async resetStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     monitoringService.resetStats();
     ctx.body = { data: { success: true } };
   },
@@ -1326,7 +1414,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get lightweight stats for dashboard widget
    */
   async getMonitoringStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const connectionStats = monitoringService.getConnectionStats();
     const eventStats = monitoringService.getEventStats();
     ctx.body = {
@@ -1352,10 +1440,11 @@ const refreshThrottle = /* @__PURE__ */ new Map();
 const SESSION_TTL = 10 * 60 * 1e3;
 const REFRESH_COOLDOWN = 3 * 1e3;
 const CLEANUP_INTERVAL = 2 * 60 * 1e3;
+let tokenCleanupInterval = null;
 const hashToken = (token) => {
   return createHash("sha256").update(token).digest("hex");
 };
-setInterval(() => {
+const runTokenCleanup = () => {
   const now = Date.now();
   let cleaned = 0;
   for (const [tokenHash, session] of sessionTokens.entries()) {
@@ -1372,8 +1461,23 @@ setInterval(() => {
   if (cleaned > 0) {
     console.log(`[plugin-io] [CLEANUP] Removed ${cleaned} expired session tokens`);
   }
-}, CLEANUP_INTERVAL);
+};
+const startTokenCleanup = () => {
+  if (!tokenCleanupInterval) {
+    tokenCleanupInterval = setInterval(runTokenCleanup, CLEANUP_INTERVAL);
+  }
+};
+const stopTokenCleanup = () => {
+  if (tokenCleanupInterval) {
+    clearInterval(tokenCleanupInterval);
+    tokenCleanupInterval = null;
+  }
+};
 var presence$3 = ({ strapi: strapi2 }) => ({
+  /**
+   * Stops the background token cleanup interval (called on plugin destroy)
+   */
+  stopTokenCleanup,
   /**
    * Creates a session token for admin users to connect to Socket.IO
    * Implements rate limiting and secure token storage
@@ -1392,6 +1496,7 @@ var presence$3 = ({ strapi: strapi2 }) => ({
       strapi2.log.warn(`[plugin-io] Rate limit: User ${adminUser.id} must wait ${waitTime}s`);
       return ctx.tooManyRequests(`Please wait ${waitTime} seconds before requesting a new session`);
     }
+    startTokenCleanup();
     try {
       const token = randomUUID();
       const tokenHash = hashToken(token);
@@ -1492,6 +1597,26 @@ var presence$3 = ({ strapi: strapi2 }) => ({
     strapi2.log.info(`[plugin-io] Invalidated ${invalidated} sessions for user ${userId}`);
     return invalidated;
   },
+  /**
+   * Returns all active (non-expired) admin sessions
+   * Used by admin strategy for broadcasting to connected admin users
+   * @returns {Array} Array of active session objects
+   */
+  getActiveSessions() {
+    const now = Date.now();
+    const activeSessions = [];
+    for (const session of sessionTokens.values()) {
+      if (session.expiresAt > now) {
+        activeSessions.push({
+          userId: session.userId,
+          user: session.user,
+          createdAt: session.createdAt,
+          expiresAt: session.expiresAt
+        });
+      }
+    }
+    return activeSessions;
+  },
   /**
    * Gets session statistics (for monitoring) - internal method
    * @returns {object} Session statistics
@@ -1963,7 +2088,7 @@ lodash_min.exports;
     function Q(n2) {
       return n2.match(Fr) || [];
     }
-    var X, nn = "4.17.21", tn = 200, rn = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", en = "Expected a function", un = "Invalid `variable` option passed into `_.template`", on = "__lodash_hash_undefined__", fn = 500, cn = "__lodash_placeholder__", an = 1, ln = 2, sn = 4, hn = 1, pn = 2, _n = 1, vn = 2, gn = 4, yn = 8, dn = 16, bn = 32, wn = 64, mn = 128, xn = 256, jn = 512, An = 30, kn = "...", On = 800, In = 16, Rn = 1, zn = 2, En = 3, Sn = 1 / 0, Wn = 9007199254740991, Ln = 17976931348623157e292, Cn = NaN, Un = 4294967295, Bn = Un - 1, Tn = Un >>> 1, $n = [["ary", mn], ["bind", _n], ["bindKey", vn], ["curry", yn], ["curryRight", dn], ["flip", jn], ["partial", bn], ["partialRight", wn], ["rearg", xn]], Dn = "[object Arguments]", Mn = "[object Array]", Fn = "[object AsyncFunction]", Nn = "[object Boolean]", Pn = "[object Date]", qn = "[object DOMException]", Zn = "[object Error]", Kn = "[object Function]", Vn = "[object GeneratorFunction]", Gn = "[object Map]", Hn = "[object Number]", Jn = "[object Null]", Yn = "[object Object]", Qn = "[object Promise]", Xn = "[object Proxy]", nt = "[object RegExp]", tt = "[object Set]", rt = "[object String]", et = "[object Symbol]", ut = "[object Undefined]", it = "[object WeakMap]", ot = "[object WeakSet]", ft = "[object ArrayBuffer]", ct = "[object DataView]", at = "[object Float32Array]", lt = "[object Float64Array]", st = "[object Int8Array]", ht = "[object Int16Array]", pt = "[object Int32Array]", _t = "[object Uint8Array]", vt = "[object Uint8ClampedArray]", gt = "[object Uint16Array]", yt = "[object Uint32Array]", dt = /\b__p \+= '';/g, bt = /\b(__p \+=) '' \+/g, wt = /(__e\(.*?\)|\b__t\)) \+\n'';/g, mt = /&(?:amp|lt|gt|quot|#39);/g, xt = /[&<>"']/g, jt = RegExp(mt.source), At = RegExp(xt.source), kt = /<%-([\s\S]+?)%>/g, Ot = /<%([\s\S]+?)%>/g, It = /<%=([\s\S]+?)%>/g, Rt = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, zt = /^\w*$/, Et = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g, St = /[\\^$.*+?()[\]{}|]/g, Wt = RegExp(St.source), Lt = /^\s+/, Ct = /\s/, Ut = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/, Bt = /\{\n\/\* \[wrapped with (.+)\] \*/, Tt = /,? & /, $t = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g, Dt = /[()=,{}\[\]\/\s]/, Mt = /\\(\\)?/g, Ft = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g, Nt = /\w*$/, Pt = /^[-+]0x[0-9a-f]+$/i, qt = /^0b[01]+$/i, Zt = /^\[object .+?Constructor\]$/, Kt = /^0o[0-7]+$/i, Vt = /^(?:0|[1-9]\d*)$/, Gt = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g, Ht = /($^)/, Jt = /['\n\r\u2028\u2029\\]/g, Yt = "\\ud800-\\udfff", Qt = "\\u0300-\\u036f", Xt = "\\ufe20-\\ufe2f", nr = "\\u20d0-\\u20ff", tr = Qt + Xt + nr, rr = "\\u2700-\\u27bf", er = "a-z\\xdf-\\xf6\\xf8-\\xff", ur = "\\xac\\xb1\\xd7\\xf7", ir = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", or = "\\u2000-\\u206f", fr = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", cr = "A-Z\\xc0-\\xd6\\xd8-\\xde", ar = "\\ufe0e\\ufe0f", lr = ur + ir + or + fr, sr = "['’]", hr = "[" + Yt + "]", pr = "[" + lr + "]", _r = "[" + tr + "]", vr = "\\d+", gr = "[" + rr + "]", yr = "[" + er + "]", dr = "[^" + Yt + lr + vr + rr + er + cr + "]", br = "\\ud83c[\\udffb-\\udfff]", wr = "(?:" + _r + "|" + br + ")", mr = "[^" + Yt + "]", xr = "(?:\\ud83c[\\udde6-\\uddff]){2}", jr = "[\\ud800-\\udbff][\\udc00-\\udfff]", Ar = "[" + cr + "]", kr = "\\u200d", Or = "(?:" + yr + "|" + dr + ")", Ir = "(?:" + Ar + "|" + dr + ")", Rr = "(?:" + sr + "(?:d|ll|m|re|s|t|ve))?", zr = "(?:" + sr + "(?:D|LL|M|RE|S|T|VE))?", Er = wr + "?", Sr = "[" + ar + "]?", Wr = "(?:" + kr + "(?:" + [mr, xr, jr].join("|") + ")" + Sr + Er + ")*", Lr = "\\d*(?:1st|2nd|3rd|(?![123])\\dth)(?=\\b|[A-Z_])", Cr = "\\d*(?:1ST|2ND|3RD|(?![123])\\dTH)(?=\\b|[a-z_])", Ur = Sr + Er + Wr, Br = "(?:" + [gr, xr, jr].join("|") + ")" + Ur, Tr = "(?:" + [mr + _r + "?", _r, xr, jr, hr].join("|") + ")", $r = RegExp(sr, "g"), Dr = RegExp(_r, "g"), Mr = RegExp(br + "(?=" + br + ")|" + Tr + Ur, "g"), Fr = RegExp([Ar + "?" + yr + "+" + Rr + "(?=" + [pr, Ar, "$"].join("|") + ")", Ir + "+" + zr + "(?=" + [pr, Ar + Or, "$"].join("|") + ")", Ar + "?" + Or + "+" + Rr, Ar + "+" + zr, Cr, Lr, vr, Br].join("|"), "g"), Nr = RegExp("[" + kr + Yt + tr + ar + "]"), Pr = /[a-z][A-Z]|[A-Z]{2}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/, qr = ["Array", "Buffer", "DataView", "Date", "Error", "Float32Array", "Float64Array", "Function", "Int8Array", "Int16Array", "Int32Array", "Map", "Math", "Object", "Promise", "RegExp", "Set", "String", "Symbol", "TypeError", "Uint8Array", "Uint8ClampedArray", "Uint16Array", "Uint32Array", "WeakMap", "_", "clearTimeout", "isFinite", "parseInt", "setTimeout"], Zr = -1, Kr = {};
+    var X, nn = "4.17.23", tn = 200, rn = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", en = "Expected a function", un = "Invalid `variable` option passed into `_.template`", on = "__lodash_hash_undefined__", fn = 500, cn = "__lodash_placeholder__", an = 1, ln = 2, sn = 4, hn = 1, pn = 2, _n = 1, vn = 2, gn = 4, yn = 8, dn = 16, bn = 32, wn = 64, mn = 128, xn = 256, jn = 512, An = 30, kn = "...", On = 800, In = 16, Rn = 1, zn = 2, En = 3, Sn = 1 / 0, Wn = 9007199254740991, Ln = 17976931348623157e292, Cn = NaN, Un = 4294967295, Bn = Un - 1, Tn = Un >>> 1, $n = [["ary", mn], ["bind", _n], ["bindKey", vn], ["curry", yn], ["curryRight", dn], ["flip", jn], ["partial", bn], ["partialRight", wn], ["rearg", xn]], Dn = "[object Arguments]", Mn = "[object Array]", Fn = "[object AsyncFunction]", Nn = "[object Boolean]", Pn = "[object Date]", qn = "[object DOMException]", Zn = "[object Error]", Kn = "[object Function]", Vn = "[object GeneratorFunction]", Gn = "[object Map]", Hn = "[object Number]", Jn = "[object Null]", Yn = "[object Object]", Qn = "[object Promise]", Xn = "[object Proxy]", nt = "[object RegExp]", tt = "[object Set]", rt = "[object String]", et = "[object Symbol]", ut = "[object Undefined]", it = "[object WeakMap]", ot = "[object WeakSet]", ft = "[object ArrayBuffer]", ct = "[object DataView]", at = "[object Float32Array]", lt = "[object Float64Array]", st = "[object Int8Array]", ht = "[object Int16Array]", pt = "[object Int32Array]", _t = "[object Uint8Array]", vt = "[object Uint8ClampedArray]", gt = "[object Uint16Array]", yt = "[object Uint32Array]", dt = /\b__p \+= '';/g, bt = /\b(__p \+=) '' \+/g, wt = /(__e\(.*?\)|\b__t\)) \+\n'';/g, mt = /&(?:amp|lt|gt|quot|#39);/g, xt = /[&<>"']/g, jt = RegExp(mt.source), At = RegExp(xt.source), kt = /<%-([\s\S]+?)%>/g, Ot = /<%([\s\S]+?)%>/g, It = /<%=([\s\S]+?)%>/g, Rt = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, zt = /^\w*$/, Et = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g, St = /[\\^$.*+?()[\]{}|]/g, Wt = RegExp(St.source), Lt = /^\s+/, Ct = /\s/, Ut = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/, Bt = /\{\n\/\* \[wrapped with (.+)\] \*/, Tt = /,? & /, $t = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g, Dt = /[()=,{}\[\]\/\s]/, Mt = /\\(\\)?/g, Ft = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g, Nt = /\w*$/, Pt = /^[-+]0x[0-9a-f]+$/i, qt = /^0b[01]+$/i, Zt = /^\[object .+?Constructor\]$/, Kt = /^0o[0-7]+$/i, Vt = /^(?:0|[1-9]\d*)$/, Gt = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g, Ht = /($^)/, Jt = /['\n\r\u2028\u2029\\]/g, Yt = "\\ud800-\\udfff", Qt = "\\u0300-\\u036f", Xt = "\\ufe20-\\ufe2f", nr = "\\u20d0-\\u20ff", tr = Qt + Xt + nr, rr = "\\u2700-\\u27bf", er = "a-z\\xdf-\\xf6\\xf8-\\xff", ur = "\\xac\\xb1\\xd7\\xf7", ir = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", or = "\\u2000-\\u206f", fr = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", cr = "A-Z\\xc0-\\xd6\\xd8-\\xde", ar = "\\ufe0e\\ufe0f", lr = ur + ir + or + fr, sr = "['’]", hr = "[" + Yt + "]", pr = "[" + lr + "]", _r = "[" + tr + "]", vr = "\\d+", gr = "[" + rr + "]", yr = "[" + er + "]", dr = "[^" + Yt + lr + vr + rr + er + cr + "]", br = "\\ud83c[\\udffb-\\udfff]", wr = "(?:" + _r + "|" + br + ")", mr = "[^" + Yt + "]", xr = "(?:\\ud83c[\\udde6-\\uddff]){2}", jr = "[\\ud800-\\udbff][\\udc00-\\udfff]", Ar = "[" + cr + "]", kr = "\\u200d", Or = "(?:" + yr + "|" + dr + ")", Ir = "(?:" + Ar + "|" + dr + ")", Rr = "(?:" + sr + "(?:d|ll|m|re|s|t|ve))?", zr = "(?:" + sr + "(?:D|LL|M|RE|S|T|VE))?", Er = wr + "?", Sr = "[" + ar + "]?", Wr = "(?:" + kr + "(?:" + [mr, xr, jr].join("|") + ")" + Sr + Er + ")*", Lr = "\\d*(?:1st|2nd|3rd|(?![123])\\dth)(?=\\b|[A-Z_])", Cr = "\\d*(?:1ST|2ND|3RD|(?![123])\\dTH)(?=\\b|[a-z_])", Ur = Sr + Er + Wr, Br = "(?:" + [gr, xr, jr].join("|") + ")" + Ur, Tr = "(?:" + [mr + _r + "?", _r, xr, jr, hr].join("|") + ")", $r = RegExp(sr, "g"), Dr = RegExp(_r, "g"), Mr = RegExp(br + "(?=" + br + ")|" + Tr + Ur, "g"), Fr = RegExp([Ar + "?" + yr + "+" + Rr + "(?=" + [pr, Ar, "$"].join("|") + ")", Ir + "+" + zr + "(?=" + [pr, Ar + Or, "$"].join("|") + ")", Ar + "?" + Or + "+" + Rr, Ar + "+" + zr, Cr, Lr, vr, Br].join("|"), "g"), Nr = RegExp("[" + kr + Yt + tr + ar + "]"), Pr = /[a-z][A-Z]|[A-Z]{2}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/, qr = ["Array", "Buffer", "DataView", "Date", "Error", "Float32Array", "Float64Array", "Function", "Int8Array", "Int16Array", "Int32Array", "Map", "Math", "Object", "Promise", "RegExp", "Set", "String", "Symbol", "TypeError", "Uint8Array", "Uint8ClampedArray", "Uint16Array", "Uint32Array", "WeakMap", "_", "clearTimeout", "isFinite", "parseInt", "setTimeout"], Zr = -1, Kr = {};
     Kr[at] = Kr[lt] = Kr[st] = Kr[ht] = Kr[pt] = Kr[_t] = Kr[vt] = Kr[gt] = Kr[yt] = true, Kr[Dn] = Kr[Mn] = Kr[ft] = Kr[Nn] = Kr[ct] = Kr[Pn] = Kr[Zn] = Kr[Kn] = Kr[Gn] = Kr[Hn] = Kr[Yn] = Kr[nt] = Kr[tt] = Kr[rt] = Kr[it] = false;
     var Vr = {};
     Vr[Dn] = Vr[Mn] = Vr[ft] = Vr[ct] = Vr[Nn] = Vr[Pn] = Vr[at] = Vr[lt] = Vr[st] = Vr[ht] = Vr[pt] = Vr[Gn] = Vr[Hn] = Vr[Yn] = Vr[nt] = Vr[tt] = Vr[rt] = Vr[et] = Vr[_t] = Vr[vt] = Vr[gt] = Vr[yt] = true, Vr[Zn] = Vr[Kn] = Vr[it] = false;
@@ -2816,7 +2941,21 @@ lodash_min.exports;
         return a2;
       }
       function yu(n2, t2) {
-        return t2 = ku(t2, n2), n2 = Gi(n2, t2), null == n2 || delete n2[no(jo(t2))];
+        t2 = ku(t2, n2);
+        var r2 = -1, e2 = t2.length;
+        if (!e2) return true;
+        for (var u2 = null == n2 || "object" != typeof n2 && "function" != typeof n2; ++r2 < e2; ) {
+          var i2 = t2[r2];
+          if ("string" == typeof i2) {
+            if ("__proto__" === i2 && !bl.call(n2, "__proto__")) return false;
+            if ("constructor" === i2 && r2 + 1 < e2 && "string" == typeof t2[r2 + 1] && "prototype" === t2[r2 + 1]) {
+              if (u2 && 0 === r2) continue;
+              return false;
+            }
+          }
+        }
+        var o2 = Gi(n2, t2);
+        return null == o2 || delete o2[no(jo(t2))];
       }
       function du(n2, t2, r2, e2) {
         return fu(n2, t2, r2(_e2(n2, t2)), e2);
@@ -5668,7 +5807,7 @@ lodash.exports;
 (function(module2, exports$1) {
   (function() {
     var undefined$1;
-    var VERSION = "4.17.21";
+    var VERSION = "4.17.23";
     var LARGE_ARRAY_SIZE2 = 200;
     var CORE_ERROR_TEXT = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", FUNC_ERROR_TEXT2 = "Expected a function", INVALID_TEMPL_VAR_ERROR_TEXT = "Invalid `variable` option passed into `_.template`";
     var HASH_UNDEFINED2 = "__lodash_hash_undefined__";
@@ -7596,8 +7735,28 @@ lodash.exports;
       }
       function baseUnset(object2, path2) {
         path2 = castPath2(path2, object2);
-        object2 = parent(object2, path2);
-        return object2 == null || delete object2[toKey2(last(path2))];
+        var index2 = -1, length = path2.length;
+        if (!length) {
+          return true;
+        }
+        var isRootPrimitive = object2 == null || typeof object2 !== "object" && typeof object2 !== "function";
+        while (++index2 < length) {
+          var key = path2[index2];
+          if (typeof key !== "string") {
+            continue;
+          }
+          if (key === "__proto__" && !hasOwnProperty2.call(object2, "__proto__")) {
+            return false;
+          }
+          if (key === "constructor" && index2 + 1 < length && typeof path2[index2 + 1] === "string" && path2[index2 + 1] === "prototype") {
+            if (isRootPrimitive && index2 === 0) {
+              continue;
+            }
+            return false;
+          }
+        }
+        var obj = parent(object2, path2);
+        return obj == null || delete obj[toKey2(last(path2))];
       }
       function baseUpdate(object2, path2, updater, customizer) {
         return baseSet(object2, path2, updater(baseGet2(object2, path2)), customizer);
@@ -11250,73 +11409,76 @@ function envFn(key, defaultValue) {
 function getKey(key) {
   return process.env[key] ?? "";
 }
-const utils$9 = {
-  int(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return parseInt(getKey(key), 10);
-  },
-  float(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return parseFloat(getKey(key));
-  },
-  bool(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return getKey(key) === "true";
-  },
-  json(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    try {
-      return JSON.parse(getKey(key));
-    } catch (error2) {
-      if (error2 instanceof Error) {
-        throw new Error(`Invalid json environment variable ${key}: ${error2.message}`);
-      }
-      throw error2;
-    }
-  },
-  array(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    let value = getKey(key);
-    if (value.startsWith("[") && value.endsWith("]")) {
-      value = value.substring(1, value.length - 1);
-    }
-    return value.split(",").map((v) => {
-      return ___default.trim(___default.trim(v, " "), '"');
-    });
-  },
-  date(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return new Date(getKey(key));
-  },
-  /**
-  * Gets a value from env that matches oneOf provided values
-  * @param {string} key
-  * @param {string[]} expectedValues
-  * @param {string|undefined} defaultValue
-  * @returns {string|undefined}
-  */
-  oneOf(key, expectedValues, defaultValue) {
-    if (!expectedValues) {
-      throw new Error(`env.oneOf requires expectedValues`);
-    }
-    if (defaultValue && !expectedValues.includes(defaultValue)) {
-      throw new Error(`env.oneOf requires defaultValue to be included in expectedValues`);
+function int$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return parseInt(getKey(key), 10);
+}
+function float$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return parseFloat(getKey(key));
+}
+function bool$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return getKey(key) === "true";
+}
+function json$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  try {
+    return JSON.parse(getKey(key));
+  } catch (error2) {
+    if (error2 instanceof Error) {
+      throw new Error(`Invalid json environment variable ${key}: ${error2.message}`);
     }
-    const rawValue = env(key, defaultValue);
-    return expectedValues.includes(rawValue) ? rawValue : defaultValue;
+    throw error2;
+  }
+}
+function array$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  let value = getKey(key);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    value = value.substring(1, value.length - 1);
+  }
+  return value.split(",").map((v) => {
+    return ___default.trim(___default.trim(v, " "), '"');
+  });
+}
+function date$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
   }
+  return new Date(getKey(key));
+}
+function oneOf(key, expectedValues, defaultValue) {
+  if (!expectedValues) {
+    throw new Error(`env.oneOf requires expectedValues`);
+  }
+  if (defaultValue && !expectedValues.includes(defaultValue)) {
+    throw new Error(`env.oneOf requires defaultValue to be included in expectedValues`);
+  }
+  const rawValue = env(key, defaultValue);
+  if (rawValue !== void 0 && expectedValues.includes(rawValue)) {
+    return rawValue;
+  }
+  return defaultValue;
+}
+const utils$9 = {
+  int: int$1,
+  float: float$1,
+  bool: bool$1,
+  json: json$1,
+  array: array$1,
+  date: date$1,
+  oneOf
 };
 const env = Object.assign(envFn, utils$9);
 const SINGLE_TYPE = "singleType";
@@ -11341,6 +11503,22 @@ const constants$6 = {
   SINGLE_TYPE,
   COLLECTION_TYPE
 };
+const ID_FIELDS = [
+  ID_ATTRIBUTE$4,
+  DOC_ID_ATTRIBUTE$4
+];
+const MORPH_TO_KEYS = [
+  "__type"
+];
+const DYNAMIC_ZONE_KEYS = [
+  "__component"
+];
+const RELATION_OPERATION_KEYS = [
+  "connect",
+  "disconnect",
+  "set",
+  "options"
+];
 const getTimestamps = (model) => {
   const attributes = [];
   if (fp.has(CREATED_AT_ATTRIBUTE, model.attributes)) {
@@ -11444,10 +11622,10 @@ const HAS_RELATION_REORDERING = [
   "oneToMany"
 ];
 const hasRelationReordering = (attribute) => isRelationalAttribute(attribute) && HAS_RELATION_REORDERING.includes(attribute.relation);
-const isComponentAttribute = (attribute) => [
+const isComponentAttribute = (attribute) => !!attribute && [
   "component",
   "dynamiczone"
-].includes(attribute?.type);
+].includes(attribute.type);
 const isDynamicZoneAttribute = (attribute) => !!attribute && attribute.type === "dynamiczone";
 const isMorphToRelationalAttribute = (attribute) => {
   return !!attribute && isRelationalAttribute(attribute) && attribute.relation?.startsWith?.("morphTo");
@@ -11484,6 +11662,10 @@ const getContentTypeRoutePrefix = (contentType) => {
 };
 const contentTypes$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  DYNAMIC_ZONE_KEYS,
+  ID_FIELDS,
+  MORPH_TO_KEYS,
+  RELATION_OPERATION_KEYS,
   constants: constants$6,
   getComponentAttributes,
   getContentTypeRoutePrefix,
@@ -11669,12 +11851,22 @@ const providerFactory = (options = {}) => {
     }
   };
 };
+const parallelWithOrderedErrors = async (promises) => {
+  const results = await Promise.allSettled(promises);
+  for (let i = 0; i < results.length; i += 1) {
+    const result = results[i];
+    if (result.status === "rejected") {
+      throw result.reason;
+    }
+  }
+  return results.map((r) => r.value);
+};
 const traverseEntity = async (visitor2, options, entity) => {
   const { path: path2 = {
     raw: null,
     attribute: null,
     rawWithIndices: null
-  }, schema: schema2, getModel } = options;
+  }, schema: schema2, getModel, allowedExtraRootKeys } = options;
   let parent = options.parent;
   const traverseMorphRelationTarget = async (visitor3, path3, entry) => {
     const targetSchema = getModel(entry.__type);
@@ -11682,7 +11874,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11691,7 +11884,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: schema3,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11702,7 +11896,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11711,7 +11906,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: schema3,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11721,7 +11917,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11752,7 +11949,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       attribute,
       path: newPath,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     await visitor2(visitorOptions, visitorUtils);
     const value = copy[key];
@@ -11769,15 +11967,13 @@ const traverseEntity = async (visitor2, options, entity) => {
       const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
       const method = isMorphRelation ? traverseMorphRelationTarget : traverseRelationTarget(getModel(attribute.target));
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await method(visitor2, arrayPath, value[i2]);
-        }
-        copy[key] = res;
+          return method(visitor2, arrayPath, item);
+        }));
       } else {
         copy[key] = await method(visitor2, newPath, value);
       }
@@ -11791,15 +11987,13 @@ const traverseEntity = async (visitor2, options, entity) => {
         path: newPath
       };
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await traverseMediaTarget(visitor2, arrayPath, value[i2]);
-        }
-        copy[key] = res;
+          return traverseMediaTarget(visitor2, arrayPath, item);
+        }));
       } else {
         copy[key] = await traverseMediaTarget(visitor2, newPath, value);
       }
@@ -11814,15 +12008,13 @@ const traverseEntity = async (visitor2, options, entity) => {
       };
       const targetSchema = getModel(attribute.component);
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await traverseComponent(visitor2, arrayPath, targetSchema, value[i2]);
-        }
-        copy[key] = res;
+          return traverseComponent(visitor2, arrayPath, targetSchema, item);
+        }));
       } else {
         copy[key] = await traverseComponent(visitor2, newPath, targetSchema, value);
       }
@@ -11835,15 +12027,13 @@ const traverseEntity = async (visitor2, options, entity) => {
         attribute,
         path: newPath
       };
-      const res = new Array(value.length);
-      for (let i2 = 0; i2 < value.length; i2 += 1) {
+      copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
         const arrayPath = {
           ...newPath,
           rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
         };
-        res[i2] = await visitDynamicZoneEntry(visitor2, arrayPath, value[i2]);
-      }
-      copy[key] = res;
+        return visitDynamicZoneEntry(visitor2, arrayPath, item);
+      }));
       continue;
     }
   }
@@ -12589,6 +12779,23 @@ const generateInstallId = (projectId, installId) => {
     return require$$1__default.default.randomUUID();
   }
 };
+const createModelCache = (getModelFn) => {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    getModel(uid) {
+      const cached = cache.get(uid);
+      if (cached) {
+        return cached;
+      }
+      const model = getModelFn(uid);
+      cache.set(uid, model);
+      return model;
+    },
+    clear() {
+      cache.clear();
+    }
+  };
+};
 var map$2;
 try {
   map$2 = Map;
@@ -14088,27 +14295,11 @@ Cache.prototype.set = function(key, value) {
   return this._values[key] = value;
 };
 var SPLIT_REGEX = /[^.^\]^[]+|(?=\[\]|\.\.)/g, DIGIT_REGEX = /^\d+$/, LEAD_DIGIT_REGEX = /^\d/, SPEC_CHAR_REGEX = /[~`!#$%\^&*+=\-\[\]\\';,/{}|\\":<>\?]/g, CLEAN_QUOTES_REGEX = /^\s*(['"]?)(.*?)(\1)\s*$/, MAX_CACHE_SIZE = 512;
-var pathCache = new Cache(MAX_CACHE_SIZE), setCache = new Cache(MAX_CACHE_SIZE), getCache = new Cache(MAX_CACHE_SIZE);
+var pathCache = new Cache(MAX_CACHE_SIZE);
+new Cache(MAX_CACHE_SIZE);
+var getCache = new Cache(MAX_CACHE_SIZE);
 var propertyExpr = {
-  Cache,
   split,
-  normalizePath,
-  setter: function(path2) {
-    var parts = normalizePath(path2);
-    return setCache.get(path2) || setCache.set(path2, function setter(obj, value) {
-      var index2 = 0;
-      var len = parts.length;
-      var data = obj;
-      while (index2 < len - 1) {
-        var part = parts[index2];
-        if (part === "__proto__" || part === "constructor" || part === "prototype") {
-          return obj;
-        }
-        data = data[parts[index2++]];
-      }
-      data[parts[index2]] = value;
-    });
-  },
   getter: function(path2, safe) {
     var parts = normalizePath(path2);
     return getCache.get(path2) || getCache.set(path2, function getter(data) {
@@ -14120,11 +14311,6 @@ var propertyExpr = {
       return data;
     });
   },
-  join: function(segments) {
-    return segments.reduce(function(path2, part) {
-      return path2 + (isQuoted(part) || DIGIT_REGEX.test(part) ? "[" + part + "]" : (path2 ? "." : "") + part);
-    }, "");
-  },
   forEach: function(path2, cb, thisArg) {
     forEach(Array.isArray(path2) ? path2 : split(path2), cb, thisArg);
   }
@@ -16954,10 +17140,10 @@ const createTransformer = ({ getModel }) => {
     }
     return pageVal;
   };
-  const convertPageSizeQueryParams = (pageSize, page) => {
+  const convertPageSizeQueryParams = (pageSize, _page) => {
     const pageSizeVal = fp.toNumber(pageSize);
     if (!fp.isInteger(pageSizeVal) || pageSizeVal <= 0) {
-      throw new PaginationError(`Invalid 'pageSize' parameter. Expected an integer > 0, received: ${page}`);
+      throw new PaginationError(`Invalid 'pageSize' parameter. Expected an integer > 0, received: ${pageSize}`);
     }
     return pageSizeVal;
   };
@@ -17132,7 +17318,7 @@ const createTransformer = ({ getModel }) => {
       query.page = convertPageQueryParams(page);
     }
     if (!fp.isNil(pageSize)) {
-      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+      query.pageSize = convertPageSizeQueryParams(pageSize);
     }
     if (!fp.isNil(start)) {
       query.offset = convertStartQueryParams(start);
@@ -17280,7 +17466,7 @@ const createTransformer = ({ getModel }) => {
       query.page = convertPageQueryParams(page);
     }
     if (!fp.isNil(pageSize)) {
-      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+      query.pageSize = convertPageSizeQueryParams(pageSize);
     }
     if (!fp.isNil(start)) {
       query.offset = convertStartQueryParams(start);
@@ -17307,6 +17493,43 @@ const convertQueryParams = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.
   __proto__: null,
   createTransformer
 }, Symbol.toStringTag, { value: "Module" }));
+const SHARED_QUERY_PARAM_KEYS = [
+  "filters",
+  "sort",
+  "fields",
+  "populate",
+  "status",
+  "locale",
+  "page",
+  "pageSize",
+  "start",
+  "limit",
+  "_q",
+  "hasPublishedVersion"
+];
+const ALLOWED_QUERY_PARAM_KEYS = [
+  ...SHARED_QUERY_PARAM_KEYS,
+  "pagination",
+  "count",
+  "ordering"
+];
+const RESERVED_INPUT_PARAM_KEYS = [
+  constants$6.ID_ATTRIBUTE,
+  constants$6.DOC_ID_ATTRIBUTE
+];
+function getExtraQueryKeysFromRoute(route) {
+  if (!route?.request?.query) return [];
+  const coreKeys = new Set(ALLOWED_QUERY_PARAM_KEYS);
+  return Object.keys(route.request.query).filter((key) => !coreKeys.has(key));
+}
+function getExtraRootKeysFromRouteBody(route) {
+  const bodySchema = route?.request?.body?.["application/json"];
+  if (!bodySchema || typeof bodySchema !== "object") return [];
+  if ("shape" in bodySchema && typeof bodySchema.shape === "object") {
+    return Object.keys(bodySchema.shape);
+  }
+  return [];
+}
 var indentString$2 = (string2, count = 1, options) => {
   options = {
     indent: " ",
@@ -17694,6 +17917,35 @@ var removeRestrictedFields = (restrictedFields = null) => ({ key, path: { attrib
     remove(key);
   }
 };
+const removeUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent, allowedExtraRootKeys }, { remove }) => {
+  if (attribute) {
+    return;
+  }
+  if (path2.attribute === null) {
+    if (ID_FIELDS.includes(key)) {
+      return;
+    }
+    if (allowedExtraRootKeys?.includes(key)) {
+      return;
+    }
+    remove(key);
+    return;
+  }
+  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_KEYS.includes(key)) {
+    return;
+  }
+  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_KEYS.includes(key)) {
+    return;
+  }
+  if ((isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute)) && RELATION_OPERATION_KEYS.includes(key)) {
+    return;
+  }
+  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute) || isComponentAttribute(parent?.attribute);
+  if (canUseID && ID_FIELDS.includes(key)) {
+    return;
+  }
+  remove(key);
+};
 const visitor$4 = ({ schema: schema2, key, value }, { set: set2 }) => {
   if (key === "" && value === "*") {
     const { attributes } = schema2;
@@ -17718,7 +17970,8 @@ const index$5 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePrope
   removePassword: visitor$8,
   removePrivate: visitor$7,
   removeRestrictedFields,
-  removeRestrictedRelations
+  removeRestrictedRelations,
+  removeUnrecognizedFields
 }, Symbol.toStringTag, { value: "Module" }));
 const DEFAULT_PATH = {
   raw: null,
@@ -18569,15 +18822,18 @@ const sanitizers = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
 }, Symbol.toStringTag, { value: "Module" }));
 const createAPISanitizers = (opts) => {
   const { getModel } = opts;
-  const sanitizeInput = (data, schema2, { auth } = {}) => {
+  const sanitizeInput = (data, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in sanitizeInput");
     }
     if (fp.isArray(data)) {
       return Promise.all(data.map((entry) => sanitizeInput(entry, schema2, {
-        auth
+        auth,
+        strictParams,
+        route
       })));
     }
+    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);
     const nonWritableAttributes = getNonWritableAttributes(schema2);
     const transforms = [
       // Remove first level ID in inputs
@@ -18589,6 +18845,13 @@ const createAPISanitizers = (opts) => {
         getModel
       })
     ];
+    if (strictParams) {
+      transforms.push(traverseEntity$1(removeUnrecognizedFields, {
+        schema: schema2,
+        getModel,
+        allowedExtraRootKeys
+      }));
+    }
     if (auth) {
       transforms.push(traverseEntity$1(removeRestrictedRelations(auth), {
         schema: schema2,
@@ -18596,6 +18859,28 @@ const createAPISanitizers = (opts) => {
       }));
     }
     opts?.sanitizers?.input?.forEach((sanitizer) => transforms.push(sanitizer(schema2)));
+    const routeBodySanitizeTransform = async (data2) => {
+      if (!data2 || typeof data2 !== "object" || Array.isArray(data2)) return data2;
+      const obj = data2;
+      const bodySchema = route?.request?.body?.["application/json"];
+      if (bodySchema && typeof bodySchema === "object" && "shape" in bodySchema) {
+        const shape = bodySchema.shape;
+        for (const key of Object.keys(shape)) {
+          if (key === "data" || !(key in obj)) continue;
+          const zodSchema = shape[key];
+          if (zodSchema && typeof zodSchema.safeParse === "function") {
+            const result = zodSchema.safeParse(obj[key]);
+            if (result.success) {
+              obj[key] = result.data;
+            } else {
+              delete obj[key];
+            }
+          }
+        }
+      }
+      return data2;
+    };
+    transforms.push(routeBodySanitizeTransform);
     return pipe$1(...transforms)(data);
   };
   const sanitizeOutput = async (data, schema2, { auth } = {}) => {
@@ -18626,7 +18911,7 @@ const createAPISanitizers = (opts) => {
     opts?.sanitizers?.output?.forEach((sanitizer) => transforms.push(sanitizer(schema2)));
     return pipe$1(...transforms)(data);
   };
-  const sanitizeQuery = async (query, schema2, { auth } = {}) => {
+  const sanitizeQuery = async (query, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in sanitizeQuery");
     }
@@ -18656,6 +18941,30 @@ const createAPISanitizers = (opts) => {
         populate: await sanitizePopulate(populate2, schema2)
       });
     }
+    const extraQueryKeys = getExtraQueryKeysFromRoute(route);
+    const routeQuerySchema = route?.request?.query;
+    if (routeQuerySchema) {
+      for (const key of extraQueryKeys) {
+        if (key in query) {
+          const zodSchema = routeQuerySchema[key];
+          if (zodSchema && typeof zodSchema.safeParse === "function") {
+            const result = zodSchema.safeParse(query[key]);
+            if (result.success) {
+              sanitizedQuery[key] = result.data;
+            } else {
+              delete sanitizedQuery[key];
+            }
+          }
+        }
+      }
+    }
+    if (strictParams) {
+      const allowedKeys = [
+        ...ALLOWED_QUERY_PARAM_KEYS,
+        ...extraQueryKeys
+      ];
+      return fp.pick(allowedKeys, sanitizedQuery);
+    }
     return sanitizedQuery;
   };
   const sanitizeFilters = (filters2, schema2, { auth } = {}) => {
@@ -18958,54 +19267,38 @@ var throwRestrictedFields = (restrictedFields = null) => ({ key, path: { attribu
     });
   }
 };
-const ID_FIELDS = [
-  constants$6.DOC_ID_ATTRIBUTE,
-  constants$6.DOC_ID_ATTRIBUTE
-];
-const ALLOWED_ROOT_LEVEL_FIELDS = [
-  ...ID_FIELDS
-];
-const MORPH_TO_ALLOWED_FIELDS = [
-  "__type"
-];
-const DYNAMIC_ZONE_ALLOWED_FIELDS = [
-  "__component"
-];
-const RELATION_REORDERING_FIELDS = [
-  "connect",
-  "disconnect",
-  "set",
-  "options"
-];
-const throwUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent }) => {
+const throwUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent, allowedExtraRootKeys }, _visitorUtils) => {
   if (attribute) {
     return;
   }
   if (path2.attribute === null) {
-    if (ALLOWED_ROOT_LEVEL_FIELDS.includes(key)) {
+    if (ID_FIELDS.includes(key)) {
+      return;
+    }
+    if (allowedExtraRootKeys?.includes(key)) {
       return;
     }
     return throwInvalidKey({
       key,
-      path: attribute
+      path: path2.attribute
     });
   }
-  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_ALLOWED_FIELDS.includes(key)) {
+  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_KEYS.includes(key)) {
     return;
   }
-  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_ALLOWED_FIELDS.includes(key)) {
+  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_KEYS.includes(key)) {
     return;
   }
-  if (hasRelationReordering(parent?.attribute) && RELATION_REORDERING_FIELDS.includes(key)) {
+  if ((isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute)) && RELATION_OPERATION_KEYS.includes(key)) {
     return;
   }
-  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute);
-  if (canUseID && !ID_FIELDS.includes(key)) {
+  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute) || isComponentAttribute(parent?.attribute);
+  if (canUseID && ID_FIELDS.includes(key)) {
     return;
   }
   throwInvalidKey({
     key,
-    path: attribute
+    path: path2.attribute
   });
 };
 const index$3 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -19327,16 +19620,16 @@ const validators = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
 const { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants$6;
 const createAPIValidators = (opts) => {
   const { getModel } = opts || {};
-  const validateInput = async (data, schema2, { auth } = {}) => {
+  const validateInput = async (data, schema2, options = {}) => {
+    const { auth, route } = options;
     if (!schema2) {
       throw new Error("Missing schema in validateInput");
     }
     if (fp.isArray(data)) {
-      await Promise.all(data.map((entry) => validateInput(entry, schema2, {
-        auth
-      })));
+      await Promise.all(data.map((entry) => validateInput(entry, schema2, options)));
       return;
     }
+    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);
     const nonWritableAttributes = getNonWritableAttributes(schema2);
     const transforms = [
       (data2) => {
@@ -19359,10 +19652,11 @@ const createAPIValidators = (opts) => {
         schema: schema2,
         getModel
       }),
-      // unrecognized attributes
+      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)
       traverseEntity$1(throwUnrecognizedFields, {
         schema: schema2,
-        getModel
+        getModel,
+        allowedExtraRootKeys
       })
     ];
     if (auth) {
@@ -19374,6 +19668,28 @@ const createAPIValidators = (opts) => {
     opts?.validators?.input?.forEach((validator) => transforms.push(validator(schema2)));
     try {
       await pipe$1(...transforms)(data);
+      if (fp.isObject(data) && route?.request?.body?.["application/json"]) {
+        const bodySchema = route.request.body["application/json"];
+        if (typeof bodySchema === "object" && "shape" in bodySchema) {
+          const shape = bodySchema.shape;
+          const dataObj = data;
+          for (const key of Object.keys(shape)) {
+            if (key === "data" || !(key in dataObj)) continue;
+            const zodSchema = shape[key];
+            if (zodSchema && typeof zodSchema.parse === "function") {
+              const result = zodSchema.safeParse(dataObj[key]);
+              if (!result.success) {
+                throw new ValidationError2(result.error?.message ?? "Validation failed", {
+                  key,
+                  path: null,
+                  source: "body",
+                  param: key
+                });
+              }
+            }
+          }
+        }
+      }
     } catch (e) {
       if (e instanceof ValidationError2) {
         e.details.source = "body";
@@ -19381,10 +19697,52 @@ const createAPIValidators = (opts) => {
       throw e;
     }
   };
-  const validateQuery = async (query, schema2, { auth } = {}) => {
+  const validateQuery = async (query, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in validateQuery");
     }
+    if (strictParams) {
+      const extraQueryKeys = getExtraQueryKeysFromRoute(route);
+      const allowedKeys = [
+        ...ALLOWED_QUERY_PARAM_KEYS,
+        ...extraQueryKeys
+      ];
+      for (const key of Object.keys(query)) {
+        if (!allowedKeys.includes(key)) {
+          try {
+            throwInvalidKey({
+              key,
+              path: null
+            });
+          } catch (e) {
+            if (e instanceof ValidationError2) {
+              e.details.source = "query";
+              e.details.param = key;
+            }
+            throw e;
+          }
+        }
+      }
+      const routeQuerySchema = route?.request?.query;
+      if (routeQuerySchema) {
+        for (const key of extraQueryKeys) {
+          if (key in query) {
+            const zodSchema = routeQuerySchema[key];
+            if (zodSchema && typeof zodSchema.parse === "function") {
+              const result = zodSchema.safeParse(query[key]);
+              if (!result.success) {
+                throw new ValidationError2(result.error?.message ?? "Invalid query param", {
+                  key,
+                  path: null,
+                  source: "query",
+                  param: key
+                });
+              }
+            }
+          }
+        }
+      }
+    }
     const { filters: filters2, sort: sort2, fields: fields2, populate: populate2 } = query;
     if (filters2) {
       await validateFilters2(filters2, schema2, {
@@ -28120,7 +28478,14 @@ var preferredPm = async function preferredPM(pkgPath) {
     };
   }
   try {
-    if (typeof findYarnWorkspaceRoot(pkgPath) === "string") {
+    const workspaceRoot = findYarnWorkspaceRoot(pkgPath);
+    if (typeof workspaceRoot === "string") {
+      if (await pathExists(path.join(workspaceRoot, "package-lock.json"))) {
+        return {
+          name: "npm",
+          version: ">=7"
+        };
+      }
       return {
         name: "yarn",
         version: "*"
@@ -29846,13 +30211,17 @@ const extendMiddlewareConfiguration = (middlewares2, middleware2) => {
 };
 const dist = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  ALLOWED_QUERY_PARAM_KEYS,
   AbstractRouteValidator,
   CSP_DEFAULTS,
+  RESERVED_INPUT_PARAM_KEYS,
+  SHARED_QUERY_PARAM_KEYS,
   arrays,
   async,
   augmentSchema,
   contentTypes: contentTypes$1,
   createContentApiRoutesFactory,
+  createModelCache,
   dates,
   env,
   errors,
@@ -29898,7 +30267,8 @@ const dist = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty
   validateYupSchema,
   validateYupSchemaSync,
   validateZod,
-  yup
+  yup,
+  z: z.z
 }, Symbol.toStringTag, { value: "Module" }));
 const require$$0 = /* @__PURE__ */ getAugmentedNamespace(dist);
 const { castArray, isNil: isNil$1, pipe, every } = fp;
@@ -29968,6 +30338,40 @@ var strategies = ({ strapi: strapi2 }) => {
     },
     getRoomName: function(user) {
       return `${this.name}-user-${user.id}`;
+    },
+    /**
+     * Admin users have full access - verify always passes
+     * @param {object} auth - Auth object
+     * @param {object} config - Config with scope
+     */
+    verify: function(auth, config2) {
+      return;
+    },
+    /**
+     * Returns active admin sessions for broadcast
+     * Admin users have full access, so we return them with full_access permissions
+     * @returns {Promise<Array>} Array of admin session objects with permissions
+     */
+    getRooms: async function() {
+      try {
+        const presenceController = strapi2.plugin("io").controller("presence");
+        if (!presenceController?.getActiveSessions) {
+          return [];
+        }
+        const activeSessions = presenceController.getActiveSessions();
+        return activeSessions.map((session) => ({
+          id: session.userId,
+          name: `admin-${session.userId}`,
+          type: "full-access",
+          // Grants full access to all content types
+          permissions: [],
+          // Empty permissions array - full-access type bypasses permission check
+          ...session
+        }));
+      } catch (error2) {
+        strapi2.log.warn("[plugin-io] Admin getRooms error:", error2.message);
+        return [];
+      }
     }
   };
   const role = {
@@ -30206,12 +30610,12 @@ function transformEntry(entry, type2) {
     // meta: {},
   };
 }
-const { pluginId: pluginId$3 } = pluginId_1;
+const { pluginId: pluginId$4 } = pluginId_1;
 var settings$1 = ({ strapi: strapi2 }) => {
   const getPluginStore = () => {
     return strapi2.store({
       type: "plugin",
-      name: pluginId$3
+      name: pluginId$4
     });
   };
   const getDefaultSettings = () => ({
@@ -30351,6 +30755,19 @@ var settings$1 = ({ strapi: strapi2 }) => {
       // Maximum nesting depth for diff
     }
   });
+  const deepMerge = (target, source) => {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+      const targetVal = target[key];
+      const sourceVal = source[key];
+      if (targetVal && sourceVal && typeof targetVal === "object" && !Array.isArray(targetVal) && typeof sourceVal === "object" && !Array.isArray(sourceVal)) {
+        result[key] = deepMerge(targetVal, sourceVal);
+      } else {
+        result[key] = sourceVal;
+      }
+    }
+    return result;
+  };
   return {
     /**
      * Get current settings (merged with defaults)
@@ -30373,10 +30790,7 @@ var settings$1 = ({ strapi: strapi2 }) => {
     async setSettings(newSettings) {
       const pluginStore = getPluginStore();
       const currentSettings = await this.getSettings();
-      const updatedSettings = {
-        ...currentSettings,
-        ...newSettings
-      };
+      const updatedSettings = deepMerge(currentSettings, newSettings);
       await pluginStore.set({
         key: "settings",
         value: updatedSettings
@@ -30389,7 +30803,7 @@ var settings$1 = ({ strapi: strapi2 }) => {
     getDefaultSettings
   };
 };
-const { pluginId: pluginId$2 } = pluginId_1;
+const { pluginId: pluginId$3 } = pluginId_1;
 var monitoring$1 = ({ strapi: strapi2 }) => {
   let eventLog = [];
   let eventStats = {
@@ -30495,8 +30909,10 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
      */
     getEventsPerSecond() {
       const now = Date.now();
-      const elapsed = (now - eventStats.lastReset) / 1e3;
-      return elapsed > 0 ? (eventStats.totalEvents / elapsed).toFixed(2) : 0;
+      const windowMs = 6e4;
+      const recentEvents = eventLog.filter((e) => now - e.timestamp < windowMs);
+      const elapsed = Math.min((now - eventStats.lastReset) / 1e3, windowMs / 1e3);
+      return elapsed > 0 ? Number((recentEvents.length / elapsed).toFixed(2)) : 0;
     },
     /**
      * Reset statistics
@@ -30517,13 +30933,14 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
       if (!io2) {
         throw new Error("Socket.IO not initialized");
       }
+      const safeName = `test:${eventName.replace(/[^a-zA-Z0-9:._-]/g, "")}`;
       const testData = {
         ...data,
         timestamp: Date.now(),
         test: true
       };
-      io2.emit(eventName, testData);
-      this.logEvent("test", { eventName, data: testData });
+      io2.emit(safeName, testData);
+      this.logEvent("test", { eventName: safeName, data: testData });
       return {
         success: true,
         eventName,
@@ -30533,7 +30950,7 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const { pluginId: pluginId$1 } = pluginId_1;
+const { pluginId: pluginId$2 } = pluginId_1;
 var presence$1 = ({ strapi: strapi2 }) => {
   const activeConnections = /* @__PURE__ */ new Map();
   const entityEditors = /* @__PURE__ */ new Map();
@@ -30935,7 +31352,7 @@ var presence$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const { pluginId } = pluginId_1;
+const { pluginId: pluginId$1 } = pluginId_1;
 var preview$1 = ({ strapi: strapi2 }) => {
   const previewSubscribers = /* @__PURE__ */ new Map();
   const socketState = /* @__PURE__ */ new Map();
@@ -31197,22 +31614,23 @@ var diff$1 = ({ strapi: strapi2 }) => {
   const isPlainObject2 = (value) => {
     return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
   };
-  const isEqual2 = (a, b) => {
+  const isEqual2 = (a, b, depth2 = 0) => {
     if (a === b) return true;
     if (a === null || b === null) return a === b;
     if (typeof a !== typeof b) return false;
+    if (depth2 > 30) return JSON.stringify(a) === JSON.stringify(b);
     if (a instanceof Date && b instanceof Date) {
       return a.getTime() === b.getTime();
     }
     if (Array.isArray(a) && Array.isArray(b)) {
       if (a.length !== b.length) return false;
-      return a.every((item, index2) => isEqual2(item, b[index2]));
+      return a.every((item, index2) => isEqual2(item, b[index2], depth2 + 1));
     }
     if (isPlainObject2(a) && isPlainObject2(b)) {
       const keysA = Object.keys(a);
       const keysB = Object.keys(b);
       if (keysA.length !== keysB.length) return false;
-      return keysA.every((key) => isEqual2(a[key], b[key]));
+      return keysA.every((key) => isEqual2(a[key], b[key], depth2 + 1));
     }
     return false;
   };
@@ -31397,6 +31815,142 @@ var diff$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
+var security = ({ strapi: strapi2 }) => {
+  const rateLimitStore = /* @__PURE__ */ new Map();
+  const connectionLimitStore = /* @__PURE__ */ new Map();
+  const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    const maxAge = 60 * 1e3;
+    for (const [key, value] of rateLimitStore.entries()) {
+      if (now - value.resetTime > maxAge) {
+        rateLimitStore.delete(key);
+      }
+    }
+    for (const [key, value] of connectionLimitStore.entries()) {
+      if (now - value.lastSeen > maxAge) {
+        connectionLimitStore.delete(key);
+      }
+    }
+  }, 60 * 1e3);
+  return {
+    /**
+     * Stops the background cleanup interval (called on plugin destroy)
+     */
+    stopCleanupInterval() {
+      clearInterval(cleanupInterval);
+    },
+    /**
+     * Check if request should be rate limited
+     * @param {string} identifier - Unique identifier (IP, user ID, etc.)
+     * @param {Object} options - Rate limit options
+     * @param {number} options.maxRequests - Maximum requests allowed
+     * @param {number} options.windowMs - Time window in milliseconds
+     * @returns {Object} - { allowed: boolean, remaining: number, resetTime: number }
+     */
+    checkRateLimit(identifier, options = {}) {
+      const { maxRequests = 100, windowMs = 60 * 1e3 } = options;
+      const now = Date.now();
+      const key = `ratelimit_${identifier}`;
+      let record = rateLimitStore.get(key);
+      if (!record || now - record.resetTime > windowMs) {
+        record = {
+          count: 1,
+          resetTime: now,
+          windowMs
+        };
+        rateLimitStore.set(key, record);
+        return {
+          allowed: true,
+          remaining: maxRequests - 1,
+          resetTime: now + windowMs
+        };
+      }
+      if (record.count >= maxRequests) {
+        return {
+          allowed: false,
+          remaining: 0,
+          resetTime: record.resetTime + windowMs,
+          retryAfter: record.resetTime + windowMs - now
+        };
+      }
+      record.count++;
+      rateLimitStore.set(key, record);
+      return {
+        allowed: true,
+        remaining: maxRequests - record.count,
+        resetTime: record.resetTime + windowMs
+      };
+    },
+    /**
+     * Check connection limits per IP/user
+     * @param {string} identifier - Unique identifier
+     * @param {number} maxConnections - Maximum allowed connections
+     * @returns {boolean} - Whether connection is allowed
+     */
+    checkConnectionLimit(identifier, maxConnections = 5) {
+      const key = `connlimit_${identifier}`;
+      const record = connectionLimitStore.get(key);
+      const now = Date.now();
+      if (!record) {
+        connectionLimitStore.set(key, {
+          count: 1,
+          lastSeen: now
+        });
+        return true;
+      }
+      if (record.count >= maxConnections) {
+        strapi2.log.warn(`[Socket.IO Security] Connection limit exceeded for ${identifier}`);
+        return false;
+      }
+      record.count++;
+      record.lastSeen = now;
+      connectionLimitStore.set(key, record);
+      return true;
+    },
+    /**
+     * Release a connection slot
+     * @param {string} identifier - Unique identifier
+     */
+    releaseConnection(identifier) {
+      const key = `connlimit_${identifier}`;
+      const record = connectionLimitStore.get(key);
+      if (record) {
+        record.count = Math.max(0, record.count - 1);
+        if (record.count === 0) {
+          connectionLimitStore.delete(key);
+        } else {
+          connectionLimitStore.set(key, record);
+        }
+      }
+    },
+    /**
+     * Validate event name to prevent injection
+     * @param {string} eventName - Event name to validate
+     * @returns {boolean} - Whether event name is valid
+     */
+    validateEventName(eventName) {
+      const validPattern = /^[a-zA-Z0-9:._-]+$/;
+      return validPattern.test(eventName) && eventName.length < 100;
+    },
+    /**
+     * Get current statistics
+     * @returns {Object} - Statistics object
+     */
+    getStats() {
+      return {
+        rateLimitEntries: rateLimitStore.size,
+        connectionLimitEntries: connectionLimitStore.size
+      };
+    },
+    /**
+     * Clear all rate limit data
+     */
+    clear() {
+      rateLimitStore.clear();
+      connectionLimitStore.clear();
+    }
+  };
+};
 const strategy = strategies;
 const sanitize = sanitize_1;
 const transform = transform$1;
@@ -31413,20 +31967,58 @@ var services$1 = {
   monitoring,
   presence,
   preview,
-  diff
+  diff,
+  security
 };
 const bootstrap = bootstrap_1;
 const config = config$1;
 const controllers = controllers$1;
 const routes = routes$1;
 const services = services$1;
-const destroy = async () => {
-};
+const { pluginId } = pluginId_1;
 const register = async () => {
 };
 const contentTypes = {};
 const middlewares = {};
 const policies = {};
+const destroy = async ({ strapi: strapi2 }) => {
+  try {
+    const presenceService = strapi2.plugin(pluginId)?.service("presence");
+    if (presenceService?.stopCleanupInterval) {
+      presenceService.stopCleanupInterval();
+    }
+    const presenceController = strapi2.plugin(pluginId)?.controller("presence");
+    if (presenceController?.stopTokenCleanup) {
+      presenceController.stopTokenCleanup();
+    }
+    const securityService = strapi2.plugin(pluginId)?.service("security");
+    if (securityService?.stopCleanupInterval) {
+      securityService.stopCleanupInterval();
+    }
+    const io2 = strapi2.$io?.server;
+    if (io2) {
+      io2.disconnectSockets(true);
+      await new Promise((resolve) => {
+        io2.close((err) => {
+          if (err) {
+            strapi2.log.warn(`socket.io: Error closing server: ${err.message}`);
+          }
+          resolve();
+        });
+      });
+    }
+    const redisClients = strapi2.$io?._redisClients;
+    if (redisClients) {
+      await Promise.allSettled([
+        redisClients.pubClient?.quit?.(),
+        redisClients.subClient?.quit?.()
+      ]);
+    }
+    strapi2.log.info("socket.io: Plugin destroyed – all handles released");
+  } catch (err) {
+    strapi2.log.error(`socket.io: Error during destroy: ${err.message}`);
+  }
+};
 var server = {
   register,
   bootstrap,