@strapi-community/plugin-io 5.3.1 → 5.3.3

package/dist/server/index.mjs

@@ -16,6 +16,7 @@ import require$$0$c from "constants";
 import { Writable } from "node:stream";
 import { z as z$1 } from "zod";
 import * as z from "zod/v4";
+import { z as z$2 } from "zod/v4";
 var commonjsGlobal = typeof globalThis !== "undefined" ? globalThis : typeof window !== "undefined" ? window : typeof global !== "undefined" ? global : typeof self !== "undefined" ? self : {};
 function getDefaultExportFromCjs(x) {
   return x && x.__esModule && Object.prototype.hasOwnProperty.call(x, "default") ? x["default"] : x;
@@ -51,10 +52,10 @@ const require$$0$3 = {
   strapi: strapi$1
 };
 const pluginPkg = require$$0$3;
-const pluginId$9 = pluginPkg.strapi.name;
-var pluginId_1 = { pluginId: pluginId$9 };
-const { pluginId: pluginId$8 } = pluginId_1;
-function getService$3({ name, plugin = pluginId$8, type: type2 = "plugin" }) {
+const pluginId$a = pluginPkg.strapi.name;
+var pluginId_1 = { pluginId: pluginId$a };
+const { pluginId: pluginId$9 } = pluginId_1;
+function getService$3({ name, plugin = pluginId$9, type: type2 = "plugin" }) {
   let serviceUID = `${type2}::${plugin}`;
   if (name && name.length) {
     serviceUID += `.${name}`;
@@ -97,7 +98,7 @@ async function handshake$2(socket, next) {
       room = strategyService["role"].getRoomName(role);
     }
     if (room) {
-      socket.join(room.replace(" ", "-"));
+      socket.join(room.replaceAll(" ", "-"));
     } else {
       throw new Error("No valid room found");
     }
@@ -124,7 +125,7 @@ var constants$7 = {
 const { Server } = require$$0$4;
 const { handshake } = middleware;
 const { getService: getService$1 } = getService_1;
-const { pluginId: pluginId$7 } = pluginId_1;
+const { pluginId: pluginId$8 } = pluginId_1;
 const { API_TOKEN_TYPE: API_TOKEN_TYPE$1 } = constants$7;
 let SocketIO$2 = class SocketIO {
   constructor(options) {
@@ -166,7 +167,7 @@ let SocketIO$2 = class SocketIO {
             });
             const roomName = strategy2.getRoomName(room);
             const data = transformService.response({ data: sanitizedData, schema: schema2 });
-            this._socket.to(roomName.replace(" ", "-")).emit(eventName, { ...data });
+            this._socket.to(roomName.replaceAll(" ", "-")).emit(eventName, { ...data });
             if (entityRoomName) {
               this._socket.to(entityRoomName).emit(eventName, { ...data });
             }
@@ -202,21 +203,25 @@ function requireSanitizeSensitiveFields() {
   hasRequiredSanitizeSensitiveFields = 1;
   const SENSITIVE_FIELDS = [
     "password",
+    "passwordHash",
     "resetPasswordToken",
     "registrationToken",
     "confirmationToken",
     "privateKey",
     "secretKey",
     "apiKey",
-    "secret",
-    "hash"
+    "secret"
   ];
-  function deepSanitize(obj) {
+  const MAX_SANITIZE_DEPTH = 20;
+  function deepSanitize(obj, depth2 = 0) {
     if (!obj || typeof obj !== "object") {
       return obj;
     }
+    if (depth2 >= MAX_SANITIZE_DEPTH) {
+      return obj;
+    }
     if (Array.isArray(obj)) {
-      return obj.map((item) => deepSanitize(item));
+      return obj.map((item) => deepSanitize(item, depth2 + 1));
     }
     const sanitized = {};
     for (const [key, value] of Object.entries(obj)) {
@@ -224,7 +229,7 @@ function requireSanitizeSensitiveFields() {
         continue;
       }
       if (value && typeof value === "object") {
-        sanitized[key] = deepSanitize(value);
+        sanitized[key] = deepSanitize(value, depth2 + 1);
       } else {
         sanitized[key] = value;
       }
@@ -244,11 +249,57 @@ function requireSanitizeSensitiveFields() {
   return sanitizeSensitiveFields;
 }
 const { SocketIO: SocketIO2 } = structures;
-const { pluginId: pluginId$6 } = pluginId_1;
+const { pluginId: pluginId$7 } = pluginId_1;
+const UUID_REGEX = /^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$/i;
+const MAX_FIELD_VALUE_SIZE = 1e5;
+function safeHandler(handler, expectsObject = true) {
+  return function(...args) {
+    try {
+      if (expectsObject) {
+        const data = args[0];
+        if (!data || typeof data !== "object" || Array.isArray(data)) {
+          const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+          if (callback) callback({ success: false, error: "Invalid payload" });
+          return;
+        }
+      }
+      const result = handler.apply(this, args);
+      if (result && typeof result.catch === "function") {
+        result.catch((err) => {
+          strapi.log.error(`socket.io: Unhandled error in event handler: ${err.message}`);
+          const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+          if (callback) callback({ success: false, error: "Internal error" });
+        });
+      }
+    } catch (err) {
+      strapi.log.error(`socket.io: Error in event handler: ${err.message}`);
+      const callback = typeof args[args.length - 1] === "function" ? args[args.length - 1] : null;
+      if (callback) callback({ success: false, error: "Internal error" });
+    }
+  };
+}
+function resolveClientIp(socket) {
+  const xff = socket.handshake.headers?.["x-forwarded-for"];
+  if (xff) {
+    return xff.split(",")[0].trim();
+  }
+  return socket.handshake.address;
+}
+function redactUrl(url) {
+  try {
+    const parsed = new URL(url);
+    if (parsed.password) {
+      parsed.password = "***";
+    }
+    return parsed.toString();
+  } catch {
+    return url.replace(/:([^@/]+)@/, ":***@");
+  }
+}
 async function bootstrapIO$1({ strapi: strapi2 }) {
-  const settingsService = strapi2.plugin(pluginId$6).service("settings");
+  const settingsService = strapi2.plugin(pluginId$7).service("settings");
   const settings2 = await settingsService.getSettings();
-  const monitoringService = strapi2.plugin(pluginId$6).service("monitoring");
+  const monitoringService = strapi2.plugin(pluginId$7).service("monitoring");
   const serverOptions = {
     cors: {
       origin: settings2.cors?.origins || ["http://localhost:3000"],
@@ -260,7 +311,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
     connectTimeout: settings2.connection?.connectionTimeout || 45e3,
     maxHttpBufferSize: 1e6,
     transports: ["websocket", "polling"],
-    allowEIO3: true
+    allowEIO3: settings2.connection?.allowEIO3 ?? false
   };
   if (settings2.redis?.enabled) {
     try {
@@ -272,13 +323,15 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       const subClient = pubClient.duplicate();
       await Promise.all([pubClient.connect(), subClient.connect()]);
       serverOptions.adapter = createAdapter(pubClient, subClient);
-      strapi2.log.info(`socket.io: Redis adapter enabled (${settings2.redis.url})`);
+      serverOptions._redisClients = { pubClient, subClient };
+      strapi2.log.info(`socket.io: Redis adapter enabled (${redactUrl(settings2.redis.url)})`);
     } catch (err) {
       strapi2.log.error(`socket.io: Redis adapter failed: ${err.message}`);
     }
   }
   const io2 = new SocketIO2(serverOptions);
   strapi2.$io = io2;
+  strapi2.$io._redisClients = serverOptions._redisClients || null;
   strapi2.$ioSettings = settings2;
   const sanitizeSensitiveFields2 = requireSanitizeSensitiveFields();
   sanitizeSensitiveFields2({ strapi: strapi2 });
@@ -304,7 +357,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
   }
   strapi2.$io.namespaces = namespaces;
   io2.server.use(async (socket, next) => {
-    const clientIp = socket.handshake.address;
+    const clientIp = resolveClientIp(socket);
     if (settings2.security?.ipWhitelist?.length > 0) {
       if (!settings2.security.ipWhitelist.includes(clientIp)) {
         return next(new Error("IP not whitelisted"));
@@ -317,30 +370,22 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
     if (currentConnections >= (settings2.connection?.maxConnections || 1e3)) {
       return next(new Error("Max connections reached"));
     }
-    const token = socket.handshake.auth?.token || socket.handshake.query?.token;
-    const strategy2 = socket.handshake.auth?.strategy;
-    const isAdmin = socket.handshake.auth?.isAdmin === true;
+    const token = socket.handshake.auth?.token;
     if (token) {
-      if (isAdmin || strategy2 === "admin-jwt") {
-        try {
-          const presenceController = strapi2.plugin(pluginId$6).controller("presence");
-          const session = presenceController.consumeSessionToken(token);
-          if (session) {
-            socket.user = {
-              id: session.userId,
-              username: `${session.user.firstname || ""} ${session.user.lastname || ""}`.trim() || `Admin ${session.userId}`,
-              email: session.user.email || `admin-${session.userId}`,
-              role: "strapi-super-admin",
-              isAdmin: true
-            };
-            socket.adminUser = session.user;
-            presenceController.registerSocket(socket.id, token);
-            strapi2.log.info(`socket.io: Admin authenticated - ${socket.user.username} (ID: ${session.userId})`);
-          } else {
-            strapi2.log.warn(`socket.io: Admin session token invalid or expired`);
-          }
-        } catch (err) {
-          strapi2.log.warn(`socket.io: Admin session verification failed: ${err.message}`);
+      const isAdminToken = UUID_REGEX.test(token);
+      if (isAdminToken) {
+        if (socket.adminUser) {
+          const admin2 = socket.adminUser;
+          socket.user = {
+            id: admin2.id,
+            username: `${admin2.firstname || ""} ${admin2.lastname || ""}`.trim() || `Admin ${admin2.id}`,
+            email: admin2.email || `admin-${admin2.id}`,
+            role: "strapi-super-admin",
+            isAdmin: true
+          };
+          strapi2.log.info(`socket.io: Admin connected - ${socket.user.username} (ID: ${admin2.id})`);
+        } else {
+          strapi2.log.warn("socket.io: Admin token present but handshake did not authenticate");
         }
       } else {
         try {
@@ -406,13 +451,13 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
     });
   }
-  const presenceService = strapi2.plugin(pluginId$6).service("presence");
-  const previewService = strapi2.plugin(pluginId$6).service("preview");
+  const presenceService = strapi2.plugin(pluginId$7).service("presence");
+  const previewService = strapi2.plugin(pluginId$7).service("preview");
   if (settings2.presence?.enabled !== false) {
     presenceService.startCleanupInterval();
   }
   io2.server.on("connection", (socket) => {
-    const clientIp = socket.handshake.address || "unknown";
+    const clientIp = resolveClientIp(socket);
     const username = socket.user?.username || "anonymous";
     if (settings2.monitoring?.enableConnectionLogging) {
       strapi2.log.info(`socket.io: Client connected (id: ${socket.id}, user: ${username}, ip: ${clientIp})`);
@@ -458,19 +503,24 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       if (callback) callback({ success: true, room: roomName });
     });
     socket.on("leave-room", (roomName, callback) => {
-      if (typeof roomName === "string" && roomName.length > 0) {
-        socket.leave(roomName);
-        strapi2.log.debug(`socket.io: Socket ${socket.id} left room: ${roomName}`);
-        if (callback) callback({ success: true, room: roomName });
-      } else {
+      if (typeof roomName !== "string" || roomName.length === 0) {
         if (callback) callback({ success: false, error: "Invalid room name" });
+        return;
+      }
+      const sanitizedRoom = roomName.replace(/[^a-zA-Z0-9\-_:]/g, "");
+      if (sanitizedRoom !== roomName) {
+        if (callback) callback({ success: false, error: "Room name contains invalid characters" });
+        return;
       }
+      socket.leave(roomName);
+      strapi2.log.debug(`socket.io: Socket ${socket.id} left room: ${roomName}`);
+      if (callback) callback({ success: true, room: roomName });
     });
     socket.on("get-rooms", (callback) => {
       const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id);
       if (callback) callback({ success: true, rooms });
     });
-    socket.on("presence:join", async ({ uid, documentId }, callback) => {
+    socket.on("presence:join", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
@@ -481,8 +531,8 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       const result = await presenceService.joinEntity(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("presence:leave", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("presence:leave", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
@@ -493,24 +543,26 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       const result = await presenceService.leaveEntity(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
+    }));
     socket.on("presence:heartbeat", (callback) => {
       const result = presenceService.heartbeat(socket.id);
       if (callback) callback(result);
     });
-    socket.on("presence:typing", ({ uid, documentId, fieldName }) => {
+    socket.on("presence:typing", safeHandler(({ uid, documentId, fieldName }) => {
       if (settings2.presence?.enabled === false) return;
+      if (!socket.user) return;
+      if (typeof fieldName !== "string" || fieldName.length > 200) return;
       presenceService.broadcastTyping(socket.id, uid, documentId, fieldName);
-    });
-    socket.on("presence:check", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("presence:check", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.presence?.enabled === false) {
         if (callback) callback({ success: false, error: "Presence is disabled" });
         return;
       }
       const editors = await presenceService.getEntityEditors(uid, documentId);
       if (callback) callback({ success: true, editors, isBeingEdited: editors.length > 0 });
-    });
-    socket.on("preview:subscribe", async ({ uid, documentId }, callback) => {
+    }));
+    socket.on("preview:subscribe", safeHandler(async ({ uid, documentId }, callback) => {
       if (settings2.livePreview?.enabled === false) {
         if (callback) callback({ success: false, error: "Live preview is disabled" });
         return;
@@ -519,22 +571,33 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
         if (callback) callback({ success: false, error: "uid and documentId are required" });
         return;
       }
+      const userRole = socket.userRole || "public";
+      const rolePerms = (settings2.rolePermissions || {})[userRole] || {};
+      const ctPerms = rolePerms.contentTypes?.[uid];
+      if (!ctPerms && settings2.security?.requireAuthentication) {
+        if (callback) callback({ success: false, error: "Permission denied" });
+        return;
+      }
       const result = await previewService.subscribe(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("preview:unsubscribe", ({ uid, documentId }, callback) => {
+    }));
+    socket.on("preview:unsubscribe", safeHandler(({ uid, documentId }, callback) => {
       if (!uid || !documentId) {
         if (callback) callback({ success: false, error: "uid and documentId are required" });
         return;
       }
       const result = previewService.unsubscribe(socket.id, uid, documentId);
       if (callback) callback(result);
-    });
-    socket.on("preview:field-change", ({ uid, documentId, fieldName, value }) => {
+    }));
+    socket.on("preview:field-change", safeHandler(({ uid, documentId, fieldName, value }) => {
       if (settings2.livePreview?.enabled === false) return;
+      if (!socket.user) return;
+      if (typeof fieldName !== "string" || fieldName.length > 200) return;
+      const serialized = typeof value === "string" ? value : JSON.stringify(value);
+      if (serialized && serialized.length > MAX_FIELD_VALUE_SIZE) return;
       previewService.emitFieldChange(socket.id, uid, documentId, fieldName, value);
-    });
-    socket.on("subscribe-entity", async ({ uid, id }, callback) => {
+    }));
+    socket.on("subscribe-entity", safeHandler(async ({ uid, id }, callback) => {
       if (settings2.entitySubscriptions?.enabled === false) {
         if (callback) callback({ success: false, error: "Entity subscriptions are disabled" });
         return;
@@ -609,8 +672,8 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       strapi2.log.debug(`socket.io: Socket ${socket.id} subscribed to entity: ${entityRoomName}`);
       if (callback) callback({ success: true, room: entityRoomName, uid, id });
-    });
-    socket.on("unsubscribe-entity", ({ uid, id }, callback) => {
+    }));
+    socket.on("unsubscribe-entity", safeHandler(({ uid, id }, callback) => {
       if (settings2.entitySubscriptions?.enabled === false) {
         if (callback) callback({ success: false, error: "Entity subscriptions are disabled" });
         return;
@@ -631,9 +694,9 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       }
       strapi2.log.debug(`socket.io: Socket ${socket.id} unsubscribed from entity: ${entityRoomName}`);
       if (callback) callback({ success: true, room: entityRoomName, uid, id });
-    });
+    }));
     socket.on("get-entity-subscriptions", (callback) => {
-      const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id && r.includes(":")).map((room) => {
+      const rooms = Array.from(socket.rooms).filter((r) => r !== socket.id && /^(api|plugin)::/.test(r) && !r.startsWith("presence:") && !r.startsWith("preview:")).map((room) => {
         const lastColonIndex = room.lastIndexOf(":");
         const uid = room.substring(0, lastColonIndex);
         const id = room.substring(lastColonIndex + 1);
@@ -641,7 +704,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       });
       if (callback) callback({ success: true, subscriptions: rooms });
     });
-    socket.on("private-message", ({ to, message }, callback) => {
+    socket.on("private-message", safeHandler(({ to, message }, callback) => {
       if (settings2.rooms?.enablePrivateRooms === false) {
         strapi2.log.warn(`socket.io: Private messages disabled for socket ${socket.id}`);
         if (callback) callback({ success: false, error: "Private messages are disabled" });
@@ -669,7 +732,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
       });
       strapi2.log.debug(`socket.io: Private message from ${socket.id} to ${to}`);
       if (callback) callback({ success: true });
-    });
+    }));
     socket.on("disconnect", async (reason) => {
       if (settings2.monitoring?.enableConnectionLogging) {
         strapi2.log.info(`socket.io: Client disconnected (id: ${socket.id}, user: ${username}, reason: ${reason})`);
@@ -686,7 +749,7 @@ async function bootstrapIO$1({ strapi: strapi2 }) {
         previewService.cleanupSocket(socket.id);
       }
       try {
-        const presenceController = strapi2.plugin(pluginId$6).controller("presence");
+        const presenceController = strapi2.plugin(pluginId$7).controller("presence");
         if (presenceController?.unregisterSocket) {
           presenceController.unregisterSocket(socket.id);
         }
@@ -954,7 +1017,7 @@ function getTransactionCtx() {
   }
   return transactionCtx;
 }
-const { pluginId: pluginId$5 } = pluginId_1;
+const { pluginId: pluginId$6 } = pluginId_1;
 function scheduleAfterTransaction(callback, delay = 0) {
   const runner = () => setTimeout(callback, delay);
   const ctx = getTransactionCtx();
@@ -1064,8 +1127,8 @@ async function bootstrapLifecycles$1({ strapi: strapi2 }) {
       const modelInfo = { singularName: event.model.singularName, uid: event.model.uid };
       scheduleAfterTransaction(() => {
         try {
-          const diffService = strapi2.plugin(pluginId$5).service("diff");
-          const previewService = strapi2.plugin(pluginId$5).service("preview");
+          const diffService = strapi2.plugin(pluginId$6).service("diff");
+          const previewService = strapi2.plugin(pluginId$6).service("preview");
           const fieldLevelEnabled = strapi2.$ioSettings?.fieldLevelChanges?.enabled !== false;
           let eventPayload;
           if (fieldLevelEnabled && previousData && diffService) {
@@ -1182,14 +1245,14 @@ var config$1 = {
   validator(config2) {
   }
 };
-const { pluginId: pluginId$4 } = pluginId_1;
+const { pluginId: pluginId$5 } = pluginId_1;
 var settings$3 = ({ strapi: strapi2 }) => ({
   /**
    * GET /io/settings
    * Retrieve current plugin settings
    */
   async getSettings(ctx) {
-    const settingsService = strapi2.plugin(pluginId$4).service("settings");
+    const settingsService = strapi2.plugin(pluginId$5).service("settings");
     const settings2 = await settingsService.getSettings();
     ctx.body = { data: settings2 };
   },
@@ -1198,8 +1261,33 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Update plugin settings and hot-reload Socket.IO
    */
   async updateSettings(ctx) {
-    const settingsService = strapi2.plugin(pluginId$4).service("settings");
+    const settingsService = strapi2.plugin(pluginId$5).service("settings");
     const { body } = ctx.request;
+    if (!body || typeof body !== "object" || Array.isArray(body)) {
+      return ctx.badRequest("Request body must be a JSON object");
+    }
+    const ALLOWED_KEYS = [
+      "enabled",
+      "cors",
+      "connection",
+      "security",
+      "contentTypes",
+      "events",
+      "rooms",
+      "entitySubscriptions",
+      "rolePermissions",
+      "redis",
+      "namespaces",
+      "middleware",
+      "monitoring",
+      "presence",
+      "livePreview",
+      "fieldLevelChanges"
+    ];
+    const unknownKeys = Object.keys(body).filter((k) => !ALLOWED_KEYS.includes(k));
+    if (unknownKeys.length > 0) {
+      return ctx.badRequest(`Unknown settings keys: ${unknownKeys.join(", ")}`);
+    }
     await settingsService.getSettings();
     const updatedSettings = await settingsService.setSettings(body);
     strapi2.$ioSettings = updatedSettings;
@@ -1231,7 +1319,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get connection and event statistics
    */
   async getStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const connectionStats = monitoringService.getConnectionStats();
     const eventStats = monitoringService.getEventStats();
     ctx.body = {
@@ -1246,7 +1334,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get recent event log
    */
   async getEventLog(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const limit = parseInt(ctx.query.limit) || 50;
     const log = monitoringService.getEventLog(limit);
     ctx.body = { data: log };
@@ -1256,10 +1344,11 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Send a test event
    */
   async sendTestEvent(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const { eventName, data } = ctx.request.body;
     try {
-      const result = monitoringService.sendTestEvent(eventName || "test", data || {});
+      const safeName = (eventName || "test").replace(/[^a-zA-Z0-9:._-]/g, "").substring(0, 50);
+      const result = monitoringService.sendTestEvent(safeName, data || {});
       ctx.body = { data: result };
     } catch (error2) {
       ctx.throw(500, error2.message);
@@ -1270,7 +1359,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Reset monitoring statistics
    */
   async resetStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     monitoringService.resetStats();
     ctx.body = { data: { success: true } };
   },
@@ -1294,7 +1383,7 @@ var settings$3 = ({ strapi: strapi2 }) => ({
    * Get lightweight stats for dashboard widget
    */
   async getMonitoringStats(ctx) {
-    const monitoringService = strapi2.plugin(pluginId$4).service("monitoring");
+    const monitoringService = strapi2.plugin(pluginId$5).service("monitoring");
     const connectionStats = monitoringService.getConnectionStats();
     const eventStats = monitoringService.getEventStats();
     ctx.body = {
@@ -1320,10 +1409,11 @@ const refreshThrottle = /* @__PURE__ */ new Map();
 const SESSION_TTL = 10 * 60 * 1e3;
 const REFRESH_COOLDOWN = 3 * 1e3;
 const CLEANUP_INTERVAL = 2 * 60 * 1e3;
+let tokenCleanupInterval = null;
 const hashToken = (token) => {
   return createHash("sha256").update(token).digest("hex");
 };
-setInterval(() => {
+const runTokenCleanup = () => {
   const now = Date.now();
   let cleaned = 0;
   for (const [tokenHash, session] of sessionTokens.entries()) {
@@ -1340,8 +1430,23 @@ setInterval(() => {
   if (cleaned > 0) {
     console.log(`[plugin-io] [CLEANUP] Removed ${cleaned} expired session tokens`);
   }
-}, CLEANUP_INTERVAL);
+};
+const startTokenCleanup = () => {
+  if (!tokenCleanupInterval) {
+    tokenCleanupInterval = setInterval(runTokenCleanup, CLEANUP_INTERVAL);
+  }
+};
+const stopTokenCleanup = () => {
+  if (tokenCleanupInterval) {
+    clearInterval(tokenCleanupInterval);
+    tokenCleanupInterval = null;
+  }
+};
 var presence$3 = ({ strapi: strapi2 }) => ({
+  /**
+   * Stops the background token cleanup interval (called on plugin destroy)
+   */
+  stopTokenCleanup,
   /**
    * Creates a session token for admin users to connect to Socket.IO
    * Implements rate limiting and secure token storage
@@ -1360,6 +1465,7 @@ var presence$3 = ({ strapi: strapi2 }) => ({
       strapi2.log.warn(`[plugin-io] Rate limit: User ${adminUser.id} must wait ${waitTime}s`);
       return ctx.tooManyRequests(`Please wait ${waitTime} seconds before requesting a new session`);
     }
+    startTokenCleanup();
     try {
       const token = randomUUID();
       const tokenHash = hashToken(token);
@@ -1460,6 +1566,26 @@ var presence$3 = ({ strapi: strapi2 }) => ({
     strapi2.log.info(`[plugin-io] Invalidated ${invalidated} sessions for user ${userId}`);
     return invalidated;
   },
+  /**
+   * Returns all active (non-expired) admin sessions
+   * Used by admin strategy for broadcasting to connected admin users
+   * @returns {Array} Array of active session objects
+   */
+  getActiveSessions() {
+    const now = Date.now();
+    const activeSessions = [];
+    for (const session of sessionTokens.values()) {
+      if (session.expiresAt > now) {
+        activeSessions.push({
+          userId: session.userId,
+          user: session.user,
+          createdAt: session.createdAt,
+          expiresAt: session.expiresAt
+        });
+      }
+    }
+    return activeSessions;
+  },
   /**
    * Gets session statistics (for monitoring) - internal method
    * @returns {object} Session statistics
@@ -1931,7 +2057,7 @@ lodash_min.exports;
     function Q(n2) {
       return n2.match(Fr) || [];
     }
-    var X, nn = "4.17.21", tn = 200, rn = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", en = "Expected a function", un = "Invalid `variable` option passed into `_.template`", on = "__lodash_hash_undefined__", fn = 500, cn = "__lodash_placeholder__", an = 1, ln = 2, sn = 4, hn = 1, pn = 2, _n = 1, vn = 2, gn = 4, yn = 8, dn = 16, bn = 32, wn = 64, mn = 128, xn = 256, jn = 512, An = 30, kn = "...", On = 800, In = 16, Rn = 1, zn = 2, En = 3, Sn = 1 / 0, Wn = 9007199254740991, Ln = 17976931348623157e292, Cn = NaN, Un = 4294967295, Bn = Un - 1, Tn = Un >>> 1, $n = [["ary", mn], ["bind", _n], ["bindKey", vn], ["curry", yn], ["curryRight", dn], ["flip", jn], ["partial", bn], ["partialRight", wn], ["rearg", xn]], Dn = "[object Arguments]", Mn = "[object Array]", Fn = "[object AsyncFunction]", Nn = "[object Boolean]", Pn = "[object Date]", qn = "[object DOMException]", Zn = "[object Error]", Kn = "[object Function]", Vn = "[object GeneratorFunction]", Gn = "[object Map]", Hn = "[object Number]", Jn = "[object Null]", Yn = "[object Object]", Qn = "[object Promise]", Xn = "[object Proxy]", nt = "[object RegExp]", tt = "[object Set]", rt = "[object String]", et = "[object Symbol]", ut = "[object Undefined]", it = "[object WeakMap]", ot = "[object WeakSet]", ft = "[object ArrayBuffer]", ct = "[object DataView]", at = "[object Float32Array]", lt = "[object Float64Array]", st = "[object Int8Array]", ht = "[object Int16Array]", pt = "[object Int32Array]", _t = "[object Uint8Array]", vt = "[object Uint8ClampedArray]", gt = "[object Uint16Array]", yt = "[object Uint32Array]", dt = /\b__p \+= '';/g, bt = /\b(__p \+=) '' \+/g, wt = /(__e\(.*?\)|\b__t\)) \+\n'';/g, mt = /&(?:amp|lt|gt|quot|#39);/g, xt = /[&<>"']/g, jt = RegExp(mt.source), At = RegExp(xt.source), kt = /<%-([\s\S]+?)%>/g, Ot = /<%([\s\S]+?)%>/g, It = /<%=([\s\S]+?)%>/g, Rt = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, zt = /^\w*$/, Et = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g, St = /[\\^$.*+?()[\]{}|]/g, Wt = RegExp(St.source), Lt = /^\s+/, Ct = /\s/, Ut = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/, Bt = /\{\n\/\* \[wrapped with (.+)\] \*/, Tt = /,? & /, $t = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g, Dt = /[()=,{}\[\]\/\s]/, Mt = /\\(\\)?/g, Ft = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g, Nt = /\w*$/, Pt = /^[-+]0x[0-9a-f]+$/i, qt = /^0b[01]+$/i, Zt = /^\[object .+?Constructor\]$/, Kt = /^0o[0-7]+$/i, Vt = /^(?:0|[1-9]\d*)$/, Gt = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g, Ht = /($^)/, Jt = /['\n\r\u2028\u2029\\]/g, Yt = "\\ud800-\\udfff", Qt = "\\u0300-\\u036f", Xt = "\\ufe20-\\ufe2f", nr = "\\u20d0-\\u20ff", tr = Qt + Xt + nr, rr = "\\u2700-\\u27bf", er = "a-z\\xdf-\\xf6\\xf8-\\xff", ur = "\\xac\\xb1\\xd7\\xf7", ir = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", or = "\\u2000-\\u206f", fr = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", cr = "A-Z\\xc0-\\xd6\\xd8-\\xde", ar = "\\ufe0e\\ufe0f", lr = ur + ir + or + fr, sr = "['’]", hr = "[" + Yt + "]", pr = "[" + lr + "]", _r = "[" + tr + "]", vr = "\\d+", gr = "[" + rr + "]", yr = "[" + er + "]", dr = "[^" + Yt + lr + vr + rr + er + cr + "]", br = "\\ud83c[\\udffb-\\udfff]", wr = "(?:" + _r + "|" + br + ")", mr = "[^" + Yt + "]", xr = "(?:\\ud83c[\\udde6-\\uddff]){2}", jr = "[\\ud800-\\udbff][\\udc00-\\udfff]", Ar = "[" + cr + "]", kr = "\\u200d", Or = "(?:" + yr + "|" + dr + ")", Ir = "(?:" + Ar + "|" + dr + ")", Rr = "(?:" + sr + "(?:d|ll|m|re|s|t|ve))?", zr = "(?:" + sr + "(?:D|LL|M|RE|S|T|VE))?", Er = wr + "?", Sr = "[" + ar + "]?", Wr = "(?:" + kr + "(?:" + [mr, xr, jr].join("|") + ")" + Sr + Er + ")*", Lr = "\\d*(?:1st|2nd|3rd|(?![123])\\dth)(?=\\b|[A-Z_])", Cr = "\\d*(?:1ST|2ND|3RD|(?![123])\\dTH)(?=\\b|[a-z_])", Ur = Sr + Er + Wr, Br = "(?:" + [gr, xr, jr].join("|") + ")" + Ur, Tr = "(?:" + [mr + _r + "?", _r, xr, jr, hr].join("|") + ")", $r = RegExp(sr, "g"), Dr = RegExp(_r, "g"), Mr = RegExp(br + "(?=" + br + ")|" + Tr + Ur, "g"), Fr = RegExp([Ar + "?" + yr + "+" + Rr + "(?=" + [pr, Ar, "$"].join("|") + ")", Ir + "+" + zr + "(?=" + [pr, Ar + Or, "$"].join("|") + ")", Ar + "?" + Or + "+" + Rr, Ar + "+" + zr, Cr, Lr, vr, Br].join("|"), "g"), Nr = RegExp("[" + kr + Yt + tr + ar + "]"), Pr = /[a-z][A-Z]|[A-Z]{2}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/, qr = ["Array", "Buffer", "DataView", "Date", "Error", "Float32Array", "Float64Array", "Function", "Int8Array", "Int16Array", "Int32Array", "Map", "Math", "Object", "Promise", "RegExp", "Set", "String", "Symbol", "TypeError", "Uint8Array", "Uint8ClampedArray", "Uint16Array", "Uint32Array", "WeakMap", "_", "clearTimeout", "isFinite", "parseInt", "setTimeout"], Zr = -1, Kr = {};
+    var X, nn = "4.17.23", tn = 200, rn = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", en = "Expected a function", un = "Invalid `variable` option passed into `_.template`", on = "__lodash_hash_undefined__", fn = 500, cn = "__lodash_placeholder__", an = 1, ln = 2, sn = 4, hn = 1, pn = 2, _n = 1, vn = 2, gn = 4, yn = 8, dn = 16, bn = 32, wn = 64, mn = 128, xn = 256, jn = 512, An = 30, kn = "...", On = 800, In = 16, Rn = 1, zn = 2, En = 3, Sn = 1 / 0, Wn = 9007199254740991, Ln = 17976931348623157e292, Cn = NaN, Un = 4294967295, Bn = Un - 1, Tn = Un >>> 1, $n = [["ary", mn], ["bind", _n], ["bindKey", vn], ["curry", yn], ["curryRight", dn], ["flip", jn], ["partial", bn], ["partialRight", wn], ["rearg", xn]], Dn = "[object Arguments]", Mn = "[object Array]", Fn = "[object AsyncFunction]", Nn = "[object Boolean]", Pn = "[object Date]", qn = "[object DOMException]", Zn = "[object Error]", Kn = "[object Function]", Vn = "[object GeneratorFunction]", Gn = "[object Map]", Hn = "[object Number]", Jn = "[object Null]", Yn = "[object Object]", Qn = "[object Promise]", Xn = "[object Proxy]", nt = "[object RegExp]", tt = "[object Set]", rt = "[object String]", et = "[object Symbol]", ut = "[object Undefined]", it = "[object WeakMap]", ot = "[object WeakSet]", ft = "[object ArrayBuffer]", ct = "[object DataView]", at = "[object Float32Array]", lt = "[object Float64Array]", st = "[object Int8Array]", ht = "[object Int16Array]", pt = "[object Int32Array]", _t = "[object Uint8Array]", vt = "[object Uint8ClampedArray]", gt = "[object Uint16Array]", yt = "[object Uint32Array]", dt = /\b__p \+= '';/g, bt = /\b(__p \+=) '' \+/g, wt = /(__e\(.*?\)|\b__t\)) \+\n'';/g, mt = /&(?:amp|lt|gt|quot|#39);/g, xt = /[&<>"']/g, jt = RegExp(mt.source), At = RegExp(xt.source), kt = /<%-([\s\S]+?)%>/g, Ot = /<%([\s\S]+?)%>/g, It = /<%=([\s\S]+?)%>/g, Rt = /\.|\[(?:[^[\]]*|(["'])(?:(?!\1)[^\\]|\\.)*?\1)\]/, zt = /^\w*$/, Et = /[^.[\]]+|\[(?:(-?\d+(?:\.\d+)?)|(["'])((?:(?!\2)[^\\]|\\.)*?)\2)\]|(?=(?:\.|\[\])(?:\.|\[\]|$))/g, St = /[\\^$.*+?()[\]{}|]/g, Wt = RegExp(St.source), Lt = /^\s+/, Ct = /\s/, Ut = /\{(?:\n\/\* \[wrapped with .+\] \*\/)?\n?/, Bt = /\{\n\/\* \[wrapped with (.+)\] \*/, Tt = /,? & /, $t = /[^\x00-\x2f\x3a-\x40\x5b-\x60\x7b-\x7f]+/g, Dt = /[()=,{}\[\]\/\s]/, Mt = /\\(\\)?/g, Ft = /\$\{([^\\}]*(?:\\.[^\\}]*)*)\}/g, Nt = /\w*$/, Pt = /^[-+]0x[0-9a-f]+$/i, qt = /^0b[01]+$/i, Zt = /^\[object .+?Constructor\]$/, Kt = /^0o[0-7]+$/i, Vt = /^(?:0|[1-9]\d*)$/, Gt = /[\xc0-\xd6\xd8-\xf6\xf8-\xff\u0100-\u017f]/g, Ht = /($^)/, Jt = /['\n\r\u2028\u2029\\]/g, Yt = "\\ud800-\\udfff", Qt = "\\u0300-\\u036f", Xt = "\\ufe20-\\ufe2f", nr = "\\u20d0-\\u20ff", tr = Qt + Xt + nr, rr = "\\u2700-\\u27bf", er = "a-z\\xdf-\\xf6\\xf8-\\xff", ur = "\\xac\\xb1\\xd7\\xf7", ir = "\\x00-\\x2f\\x3a-\\x40\\x5b-\\x60\\x7b-\\xbf", or = "\\u2000-\\u206f", fr = " \\t\\x0b\\f\\xa0\\ufeff\\n\\r\\u2028\\u2029\\u1680\\u180e\\u2000\\u2001\\u2002\\u2003\\u2004\\u2005\\u2006\\u2007\\u2008\\u2009\\u200a\\u202f\\u205f\\u3000", cr = "A-Z\\xc0-\\xd6\\xd8-\\xde", ar = "\\ufe0e\\ufe0f", lr = ur + ir + or + fr, sr = "['’]", hr = "[" + Yt + "]", pr = "[" + lr + "]", _r = "[" + tr + "]", vr = "\\d+", gr = "[" + rr + "]", yr = "[" + er + "]", dr = "[^" + Yt + lr + vr + rr + er + cr + "]", br = "\\ud83c[\\udffb-\\udfff]", wr = "(?:" + _r + "|" + br + ")", mr = "[^" + Yt + "]", xr = "(?:\\ud83c[\\udde6-\\uddff]){2}", jr = "[\\ud800-\\udbff][\\udc00-\\udfff]", Ar = "[" + cr + "]", kr = "\\u200d", Or = "(?:" + yr + "|" + dr + ")", Ir = "(?:" + Ar + "|" + dr + ")", Rr = "(?:" + sr + "(?:d|ll|m|re|s|t|ve))?", zr = "(?:" + sr + "(?:D|LL|M|RE|S|T|VE))?", Er = wr + "?", Sr = "[" + ar + "]?", Wr = "(?:" + kr + "(?:" + [mr, xr, jr].join("|") + ")" + Sr + Er + ")*", Lr = "\\d*(?:1st|2nd|3rd|(?![123])\\dth)(?=\\b|[A-Z_])", Cr = "\\d*(?:1ST|2ND|3RD|(?![123])\\dTH)(?=\\b|[a-z_])", Ur = Sr + Er + Wr, Br = "(?:" + [gr, xr, jr].join("|") + ")" + Ur, Tr = "(?:" + [mr + _r + "?", _r, xr, jr, hr].join("|") + ")", $r = RegExp(sr, "g"), Dr = RegExp(_r, "g"), Mr = RegExp(br + "(?=" + br + ")|" + Tr + Ur, "g"), Fr = RegExp([Ar + "?" + yr + "+" + Rr + "(?=" + [pr, Ar, "$"].join("|") + ")", Ir + "+" + zr + "(?=" + [pr, Ar + Or, "$"].join("|") + ")", Ar + "?" + Or + "+" + Rr, Ar + "+" + zr, Cr, Lr, vr, Br].join("|"), "g"), Nr = RegExp("[" + kr + Yt + tr + ar + "]"), Pr = /[a-z][A-Z]|[A-Z]{2}[a-z]|[0-9][a-zA-Z]|[a-zA-Z][0-9]|[^a-zA-Z0-9 ]/, qr = ["Array", "Buffer", "DataView", "Date", "Error", "Float32Array", "Float64Array", "Function", "Int8Array", "Int16Array", "Int32Array", "Map", "Math", "Object", "Promise", "RegExp", "Set", "String", "Symbol", "TypeError", "Uint8Array", "Uint8ClampedArray", "Uint16Array", "Uint32Array", "WeakMap", "_", "clearTimeout", "isFinite", "parseInt", "setTimeout"], Zr = -1, Kr = {};
     Kr[at] = Kr[lt] = Kr[st] = Kr[ht] = Kr[pt] = Kr[_t] = Kr[vt] = Kr[gt] = Kr[yt] = true, Kr[Dn] = Kr[Mn] = Kr[ft] = Kr[Nn] = Kr[ct] = Kr[Pn] = Kr[Zn] = Kr[Kn] = Kr[Gn] = Kr[Hn] = Kr[Yn] = Kr[nt] = Kr[tt] = Kr[rt] = Kr[it] = false;
     var Vr = {};
     Vr[Dn] = Vr[Mn] = Vr[ft] = Vr[ct] = Vr[Nn] = Vr[Pn] = Vr[at] = Vr[lt] = Vr[st] = Vr[ht] = Vr[pt] = Vr[Gn] = Vr[Hn] = Vr[Yn] = Vr[nt] = Vr[tt] = Vr[rt] = Vr[et] = Vr[_t] = Vr[vt] = Vr[gt] = Vr[yt] = true, Vr[Zn] = Vr[Kn] = Vr[it] = false;
@@ -2784,7 +2910,21 @@ lodash_min.exports;
         return a2;
       }
       function yu(n2, t2) {
-        return t2 = ku(t2, n2), n2 = Gi(n2, t2), null == n2 || delete n2[no(jo(t2))];
+        t2 = ku(t2, n2);
+        var r2 = -1, e2 = t2.length;
+        if (!e2) return true;
+        for (var u2 = null == n2 || "object" != typeof n2 && "function" != typeof n2; ++r2 < e2; ) {
+          var i2 = t2[r2];
+          if ("string" == typeof i2) {
+            if ("__proto__" === i2 && !bl.call(n2, "__proto__")) return false;
+            if ("constructor" === i2 && r2 + 1 < e2 && "string" == typeof t2[r2 + 1] && "prototype" === t2[r2 + 1]) {
+              if (u2 && 0 === r2) continue;
+              return false;
+            }
+          }
+        }
+        var o2 = Gi(n2, t2);
+        return null == o2 || delete o2[no(jo(t2))];
       }
       function du(n2, t2, r2, e2) {
         return fu(n2, t2, r2(_e2(n2, t2)), e2);
@@ -5636,7 +5776,7 @@ lodash.exports;
 (function(module, exports$1) {
   (function() {
     var undefined$1;
-    var VERSION = "4.17.21";
+    var VERSION = "4.17.23";
     var LARGE_ARRAY_SIZE2 = 200;
     var CORE_ERROR_TEXT = "Unsupported core-js use. Try https://npms.io/search?q=ponyfill.", FUNC_ERROR_TEXT2 = "Expected a function", INVALID_TEMPL_VAR_ERROR_TEXT = "Invalid `variable` option passed into `_.template`";
     var HASH_UNDEFINED2 = "__lodash_hash_undefined__";
@@ -7564,8 +7704,28 @@ lodash.exports;
       }
       function baseUnset(object2, path2) {
         path2 = castPath2(path2, object2);
-        object2 = parent(object2, path2);
-        return object2 == null || delete object2[toKey2(last(path2))];
+        var index2 = -1, length = path2.length;
+        if (!length) {
+          return true;
+        }
+        var isRootPrimitive = object2 == null || typeof object2 !== "object" && typeof object2 !== "function";
+        while (++index2 < length) {
+          var key = path2[index2];
+          if (typeof key !== "string") {
+            continue;
+          }
+          if (key === "__proto__" && !hasOwnProperty2.call(object2, "__proto__")) {
+            return false;
+          }
+          if (key === "constructor" && index2 + 1 < length && typeof path2[index2 + 1] === "string" && path2[index2 + 1] === "prototype") {
+            if (isRootPrimitive && index2 === 0) {
+              continue;
+            }
+            return false;
+          }
+        }
+        var obj = parent(object2, path2);
+        return obj == null || delete obj[toKey2(last(path2))];
       }
       function baseUpdate(object2, path2, updater, customizer) {
         return baseSet(object2, path2, updater(baseGet2(object2, path2)), customizer);
@@ -11218,73 +11378,76 @@ function envFn(key, defaultValue) {
 function getKey(key) {
   return process.env[key] ?? "";
 }
-const utils$9 = {
-  int(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return parseInt(getKey(key), 10);
-  },
-  float(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return parseFloat(getKey(key));
-  },
-  bool(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return getKey(key) === "true";
-  },
-  json(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    try {
-      return JSON.parse(getKey(key));
-    } catch (error2) {
-      if (error2 instanceof Error) {
-        throw new Error(`Invalid json environment variable ${key}: ${error2.message}`);
-      }
-      throw error2;
-    }
-  },
-  array(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    let value = getKey(key);
-    if (value.startsWith("[") && value.endsWith("]")) {
-      value = value.substring(1, value.length - 1);
-    }
-    return value.split(",").map((v) => {
-      return ___default.trim(___default.trim(v, " "), '"');
-    });
-  },
-  date(key, defaultValue) {
-    if (!___default.has(process.env, key)) {
-      return defaultValue;
-    }
-    return new Date(getKey(key));
-  },
-  /**
-  * Gets a value from env that matches oneOf provided values
-  * @param {string} key
-  * @param {string[]} expectedValues
-  * @param {string|undefined} defaultValue
-  * @returns {string|undefined}
-  */
-  oneOf(key, expectedValues, defaultValue) {
-    if (!expectedValues) {
-      throw new Error(`env.oneOf requires expectedValues`);
-    }
-    if (defaultValue && !expectedValues.includes(defaultValue)) {
-      throw new Error(`env.oneOf requires defaultValue to be included in expectedValues`);
+function int$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return parseInt(getKey(key), 10);
+}
+function float$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return parseFloat(getKey(key));
+}
+function bool$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  return getKey(key) === "true";
+}
+function json$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  try {
+    return JSON.parse(getKey(key));
+  } catch (error2) {
+    if (error2 instanceof Error) {
+      throw new Error(`Invalid json environment variable ${key}: ${error2.message}`);
     }
-    const rawValue = env(key, defaultValue);
-    return expectedValues.includes(rawValue) ? rawValue : defaultValue;
+    throw error2;
+  }
+}
+function array$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
+  }
+  let value = getKey(key);
+  if (value.startsWith("[") && value.endsWith("]")) {
+    value = value.substring(1, value.length - 1);
+  }
+  return value.split(",").map((v) => {
+    return ___default.trim(___default.trim(v, " "), '"');
+  });
+}
+function date$1(key, defaultValue) {
+  if (!___default.has(process.env, key)) {
+    return defaultValue;
   }
+  return new Date(getKey(key));
+}
+function oneOf(key, expectedValues, defaultValue) {
+  if (!expectedValues) {
+    throw new Error(`env.oneOf requires expectedValues`);
+  }
+  if (defaultValue && !expectedValues.includes(defaultValue)) {
+    throw new Error(`env.oneOf requires defaultValue to be included in expectedValues`);
+  }
+  const rawValue = env(key, defaultValue);
+  if (rawValue !== void 0 && expectedValues.includes(rawValue)) {
+    return rawValue;
+  }
+  return defaultValue;
+}
+const utils$9 = {
+  int: int$1,
+  float: float$1,
+  bool: bool$1,
+  json: json$1,
+  array: array$1,
+  date: date$1,
+  oneOf
 };
 const env = Object.assign(envFn, utils$9);
 const SINGLE_TYPE = "singleType";
@@ -11309,6 +11472,22 @@ const constants$6 = {
   SINGLE_TYPE,
   COLLECTION_TYPE
 };
+const ID_FIELDS = [
+  ID_ATTRIBUTE$4,
+  DOC_ID_ATTRIBUTE$4
+];
+const MORPH_TO_KEYS = [
+  "__type"
+];
+const DYNAMIC_ZONE_KEYS = [
+  "__component"
+];
+const RELATION_OPERATION_KEYS = [
+  "connect",
+  "disconnect",
+  "set",
+  "options"
+];
 const getTimestamps = (model) => {
   const attributes = [];
   if (fp.has(CREATED_AT_ATTRIBUTE, model.attributes)) {
@@ -11412,10 +11591,10 @@ const HAS_RELATION_REORDERING = [
   "oneToMany"
 ];
 const hasRelationReordering = (attribute) => isRelationalAttribute(attribute) && HAS_RELATION_REORDERING.includes(attribute.relation);
-const isComponentAttribute = (attribute) => [
+const isComponentAttribute = (attribute) => !!attribute && [
   "component",
   "dynamiczone"
-].includes(attribute?.type);
+].includes(attribute.type);
 const isDynamicZoneAttribute = (attribute) => !!attribute && attribute.type === "dynamiczone";
 const isMorphToRelationalAttribute = (attribute) => {
   return !!attribute && isRelationalAttribute(attribute) && attribute.relation?.startsWith?.("morphTo");
@@ -11452,6 +11631,10 @@ const getContentTypeRoutePrefix = (contentType) => {
 };
 const contentTypes$1 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  DYNAMIC_ZONE_KEYS,
+  ID_FIELDS,
+  MORPH_TO_KEYS,
+  RELATION_OPERATION_KEYS,
   constants: constants$6,
   getComponentAttributes,
   getContentTypeRoutePrefix,
@@ -11637,12 +11820,22 @@ const providerFactory = (options = {}) => {
     }
   };
 };
+const parallelWithOrderedErrors = async (promises) => {
+  const results = await Promise.allSettled(promises);
+  for (let i = 0; i < results.length; i += 1) {
+    const result = results[i];
+    if (result.status === "rejected") {
+      throw result.reason;
+    }
+  }
+  return results.map((r) => r.value);
+};
 const traverseEntity = async (visitor2, options, entity) => {
   const { path: path2 = {
     raw: null,
     attribute: null,
     rawWithIndices: null
-  }, schema: schema2, getModel } = options;
+  }, schema: schema2, getModel, allowedExtraRootKeys } = options;
   let parent = options.parent;
   const traverseMorphRelationTarget = async (visitor3, path3, entry) => {
     const targetSchema = getModel(entry.__type);
@@ -11650,7 +11843,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11659,7 +11853,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: schema3,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11670,7 +11865,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11679,7 +11875,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: schema3,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11689,7 +11886,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       schema: targetSchema,
       path: path3,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     return traverseEntity(visitor3, traverseOptions, entry);
   };
@@ -11720,7 +11918,8 @@ const traverseEntity = async (visitor2, options, entity) => {
       attribute,
       path: newPath,
       getModel,
-      parent
+      parent,
+      allowedExtraRootKeys
     };
     await visitor2(visitorOptions, visitorUtils);
     const value = copy[key];
@@ -11737,15 +11936,13 @@ const traverseEntity = async (visitor2, options, entity) => {
       const isMorphRelation = attribute.relation.toLowerCase().startsWith("morph");
       const method = isMorphRelation ? traverseMorphRelationTarget : traverseRelationTarget(getModel(attribute.target));
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await method(visitor2, arrayPath, value[i2]);
-        }
-        copy[key] = res;
+          return method(visitor2, arrayPath, item);
+        }));
       } else {
         copy[key] = await method(visitor2, newPath, value);
       }
@@ -11759,15 +11956,13 @@ const traverseEntity = async (visitor2, options, entity) => {
         path: newPath
       };
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await traverseMediaTarget(visitor2, arrayPath, value[i2]);
-        }
-        copy[key] = res;
+          return traverseMediaTarget(visitor2, arrayPath, item);
+        }));
       } else {
         copy[key] = await traverseMediaTarget(visitor2, newPath, value);
       }
@@ -11782,15 +11977,13 @@ const traverseEntity = async (visitor2, options, entity) => {
       };
       const targetSchema = getModel(attribute.component);
       if (fp.isArray(value)) {
-        const res = new Array(value.length);
-        for (let i2 = 0; i2 < value.length; i2 += 1) {
+        copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
           const arrayPath = {
             ...newPath,
             rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
           };
-          res[i2] = await traverseComponent(visitor2, arrayPath, targetSchema, value[i2]);
-        }
-        copy[key] = res;
+          return traverseComponent(visitor2, arrayPath, targetSchema, item);
+        }));
       } else {
         copy[key] = await traverseComponent(visitor2, newPath, targetSchema, value);
       }
@@ -11803,15 +11996,13 @@ const traverseEntity = async (visitor2, options, entity) => {
         attribute,
         path: newPath
       };
-      const res = new Array(value.length);
-      for (let i2 = 0; i2 < value.length; i2 += 1) {
+      copy[key] = await parallelWithOrderedErrors(value.map((item, i2) => {
         const arrayPath = {
           ...newPath,
           rawWithIndices: fp.isNil(newPath.rawWithIndices) ? `${i2}` : `${newPath.rawWithIndices}.${i2}`
         };
-        res[i2] = await visitDynamicZoneEntry(visitor2, arrayPath, value[i2]);
-      }
-      copy[key] = res;
+        return visitDynamicZoneEntry(visitor2, arrayPath, item);
+      }));
       continue;
     }
   }
@@ -12557,6 +12748,23 @@ const generateInstallId = (projectId, installId) => {
     return require$$1.randomUUID();
   }
 };
+const createModelCache = (getModelFn) => {
+  const cache = /* @__PURE__ */ new Map();
+  return {
+    getModel(uid) {
+      const cached = cache.get(uid);
+      if (cached) {
+        return cached;
+      }
+      const model = getModelFn(uid);
+      cache.set(uid, model);
+      return model;
+    },
+    clear() {
+      cache.clear();
+    }
+  };
+};
 var map$2;
 try {
   map$2 = Map;
@@ -14056,27 +14264,11 @@ Cache.prototype.set = function(key, value) {
   return this._values[key] = value;
 };
 var SPLIT_REGEX = /[^.^\]^[]+|(?=\[\]|\.\.)/g, DIGIT_REGEX = /^\d+$/, LEAD_DIGIT_REGEX = /^\d/, SPEC_CHAR_REGEX = /[~`!#$%\^&*+=\-\[\]\\';,/{}|\\":<>\?]/g, CLEAN_QUOTES_REGEX = /^\s*(['"]?)(.*?)(\1)\s*$/, MAX_CACHE_SIZE = 512;
-var pathCache = new Cache(MAX_CACHE_SIZE), setCache = new Cache(MAX_CACHE_SIZE), getCache = new Cache(MAX_CACHE_SIZE);
+var pathCache = new Cache(MAX_CACHE_SIZE);
+new Cache(MAX_CACHE_SIZE);
+var getCache = new Cache(MAX_CACHE_SIZE);
 var propertyExpr = {
-  Cache,
   split,
-  normalizePath,
-  setter: function(path2) {
-    var parts = normalizePath(path2);
-    return setCache.get(path2) || setCache.set(path2, function setter(obj, value) {
-      var index2 = 0;
-      var len = parts.length;
-      var data = obj;
-      while (index2 < len - 1) {
-        var part = parts[index2];
-        if (part === "__proto__" || part === "constructor" || part === "prototype") {
-          return obj;
-        }
-        data = data[parts[index2++]];
-      }
-      data[parts[index2]] = value;
-    });
-  },
   getter: function(path2, safe) {
     var parts = normalizePath(path2);
     return getCache.get(path2) || getCache.set(path2, function getter(data) {
@@ -14088,11 +14280,6 @@ var propertyExpr = {
       return data;
     });
   },
-  join: function(segments) {
-    return segments.reduce(function(path2, part) {
-      return path2 + (isQuoted(part) || DIGIT_REGEX.test(part) ? "[" + part + "]" : (path2 ? "." : "") + part);
-    }, "");
-  },
   forEach: function(path2, cb, thisArg) {
     forEach(Array.isArray(path2) ? path2 : split(path2), cb, thisArg);
   }
@@ -16922,10 +17109,10 @@ const createTransformer = ({ getModel }) => {
     }
     return pageVal;
   };
-  const convertPageSizeQueryParams = (pageSize, page) => {
+  const convertPageSizeQueryParams = (pageSize, _page) => {
     const pageSizeVal = fp.toNumber(pageSize);
     if (!fp.isInteger(pageSizeVal) || pageSizeVal <= 0) {
-      throw new PaginationError(`Invalid 'pageSize' parameter. Expected an integer > 0, received: ${page}`);
+      throw new PaginationError(`Invalid 'pageSize' parameter. Expected an integer > 0, received: ${pageSize}`);
     }
     return pageSizeVal;
   };
@@ -17100,7 +17287,7 @@ const createTransformer = ({ getModel }) => {
       query.page = convertPageQueryParams(page);
     }
     if (!fp.isNil(pageSize)) {
-      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+      query.pageSize = convertPageSizeQueryParams(pageSize);
     }
     if (!fp.isNil(start)) {
       query.offset = convertStartQueryParams(start);
@@ -17248,7 +17435,7 @@ const createTransformer = ({ getModel }) => {
       query.page = convertPageQueryParams(page);
     }
     if (!fp.isNil(pageSize)) {
-      query.pageSize = convertPageSizeQueryParams(pageSize, page);
+      query.pageSize = convertPageSizeQueryParams(pageSize);
     }
     if (!fp.isNil(start)) {
       query.offset = convertStartQueryParams(start);
@@ -17275,6 +17462,43 @@ const convertQueryParams = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.
   __proto__: null,
   createTransformer
 }, Symbol.toStringTag, { value: "Module" }));
+const SHARED_QUERY_PARAM_KEYS = [
+  "filters",
+  "sort",
+  "fields",
+  "populate",
+  "status",
+  "locale",
+  "page",
+  "pageSize",
+  "start",
+  "limit",
+  "_q",
+  "hasPublishedVersion"
+];
+const ALLOWED_QUERY_PARAM_KEYS = [
+  ...SHARED_QUERY_PARAM_KEYS,
+  "pagination",
+  "count",
+  "ordering"
+];
+const RESERVED_INPUT_PARAM_KEYS = [
+  constants$6.ID_ATTRIBUTE,
+  constants$6.DOC_ID_ATTRIBUTE
+];
+function getExtraQueryKeysFromRoute(route) {
+  if (!route?.request?.query) return [];
+  const coreKeys = new Set(ALLOWED_QUERY_PARAM_KEYS);
+  return Object.keys(route.request.query).filter((key) => !coreKeys.has(key));
+}
+function getExtraRootKeysFromRouteBody(route) {
+  const bodySchema = route?.request?.body?.["application/json"];
+  if (!bodySchema || typeof bodySchema !== "object") return [];
+  if ("shape" in bodySchema && typeof bodySchema.shape === "object") {
+    return Object.keys(bodySchema.shape);
+  }
+  return [];
+}
 var indentString$2 = (string2, count = 1, options) => {
   options = {
     indent: " ",
@@ -17662,6 +17886,35 @@ var removeRestrictedFields = (restrictedFields = null) => ({ key, path: { attrib
     remove(key);
   }
 };
+const removeUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent, allowedExtraRootKeys }, { remove }) => {
+  if (attribute) {
+    return;
+  }
+  if (path2.attribute === null) {
+    if (ID_FIELDS.includes(key)) {
+      return;
+    }
+    if (allowedExtraRootKeys?.includes(key)) {
+      return;
+    }
+    remove(key);
+    return;
+  }
+  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_KEYS.includes(key)) {
+    return;
+  }
+  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_KEYS.includes(key)) {
+    return;
+  }
+  if ((isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute)) && RELATION_OPERATION_KEYS.includes(key)) {
+    return;
+  }
+  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute) || isComponentAttribute(parent?.attribute);
+  if (canUseID && ID_FIELDS.includes(key)) {
+    return;
+  }
+  remove(key);
+};
 const visitor$4 = ({ schema: schema2, key, value }, { set: set2 }) => {
   if (key === "" && value === "*") {
     const { attributes } = schema2;
@@ -17686,7 +17939,8 @@ const index$5 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePrope
   removePassword: visitor$8,
   removePrivate: visitor$7,
   removeRestrictedFields,
-  removeRestrictedRelations
+  removeRestrictedRelations,
+  removeUnrecognizedFields
 }, Symbol.toStringTag, { value: "Module" }));
 const DEFAULT_PATH = {
   raw: null,
@@ -18537,15 +18791,18 @@ const sanitizers = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
 }, Symbol.toStringTag, { value: "Module" }));
 const createAPISanitizers = (opts) => {
   const { getModel } = opts;
-  const sanitizeInput = (data, schema2, { auth } = {}) => {
+  const sanitizeInput = (data, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in sanitizeInput");
     }
     if (fp.isArray(data)) {
       return Promise.all(data.map((entry) => sanitizeInput(entry, schema2, {
-        auth
+        auth,
+        strictParams,
+        route
       })));
     }
+    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);
     const nonWritableAttributes = getNonWritableAttributes(schema2);
     const transforms = [
       // Remove first level ID in inputs
@@ -18557,6 +18814,13 @@ const createAPISanitizers = (opts) => {
         getModel
       })
     ];
+    if (strictParams) {
+      transforms.push(traverseEntity$1(removeUnrecognizedFields, {
+        schema: schema2,
+        getModel,
+        allowedExtraRootKeys
+      }));
+    }
     if (auth) {
       transforms.push(traverseEntity$1(removeRestrictedRelations(auth), {
         schema: schema2,
@@ -18564,6 +18828,28 @@ const createAPISanitizers = (opts) => {
       }));
     }
     opts?.sanitizers?.input?.forEach((sanitizer) => transforms.push(sanitizer(schema2)));
+    const routeBodySanitizeTransform = async (data2) => {
+      if (!data2 || typeof data2 !== "object" || Array.isArray(data2)) return data2;
+      const obj = data2;
+      const bodySchema = route?.request?.body?.["application/json"];
+      if (bodySchema && typeof bodySchema === "object" && "shape" in bodySchema) {
+        const shape = bodySchema.shape;
+        for (const key of Object.keys(shape)) {
+          if (key === "data" || !(key in obj)) continue;
+          const zodSchema = shape[key];
+          if (zodSchema && typeof zodSchema.safeParse === "function") {
+            const result = zodSchema.safeParse(obj[key]);
+            if (result.success) {
+              obj[key] = result.data;
+            } else {
+              delete obj[key];
+            }
+          }
+        }
+      }
+      return data2;
+    };
+    transforms.push(routeBodySanitizeTransform);
     return pipe$1(...transforms)(data);
   };
   const sanitizeOutput = async (data, schema2, { auth } = {}) => {
@@ -18594,7 +18880,7 @@ const createAPISanitizers = (opts) => {
     opts?.sanitizers?.output?.forEach((sanitizer) => transforms.push(sanitizer(schema2)));
     return pipe$1(...transforms)(data);
   };
-  const sanitizeQuery = async (query, schema2, { auth } = {}) => {
+  const sanitizeQuery = async (query, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in sanitizeQuery");
     }
@@ -18624,6 +18910,30 @@ const createAPISanitizers = (opts) => {
         populate: await sanitizePopulate(populate2, schema2)
       });
     }
+    const extraQueryKeys = getExtraQueryKeysFromRoute(route);
+    const routeQuerySchema = route?.request?.query;
+    if (routeQuerySchema) {
+      for (const key of extraQueryKeys) {
+        if (key in query) {
+          const zodSchema = routeQuerySchema[key];
+          if (zodSchema && typeof zodSchema.safeParse === "function") {
+            const result = zodSchema.safeParse(query[key]);
+            if (result.success) {
+              sanitizedQuery[key] = result.data;
+            } else {
+              delete sanitizedQuery[key];
+            }
+          }
+        }
+      }
+    }
+    if (strictParams) {
+      const allowedKeys = [
+        ...ALLOWED_QUERY_PARAM_KEYS,
+        ...extraQueryKeys
+      ];
+      return fp.pick(allowedKeys, sanitizedQuery);
+    }
     return sanitizedQuery;
   };
   const sanitizeFilters = (filters2, schema2, { auth } = {}) => {
@@ -18926,54 +19236,38 @@ var throwRestrictedFields = (restrictedFields = null) => ({ key, path: { attribu
     });
   }
 };
-const ID_FIELDS = [
-  constants$6.DOC_ID_ATTRIBUTE,
-  constants$6.DOC_ID_ATTRIBUTE
-];
-const ALLOWED_ROOT_LEVEL_FIELDS = [
-  ...ID_FIELDS
-];
-const MORPH_TO_ALLOWED_FIELDS = [
-  "__type"
-];
-const DYNAMIC_ZONE_ALLOWED_FIELDS = [
-  "__component"
-];
-const RELATION_REORDERING_FIELDS = [
-  "connect",
-  "disconnect",
-  "set",
-  "options"
-];
-const throwUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent }) => {
+const throwUnrecognizedFields = ({ key, attribute, path: path2, schema: schema2, parent, allowedExtraRootKeys }, _visitorUtils) => {
   if (attribute) {
     return;
   }
   if (path2.attribute === null) {
-    if (ALLOWED_ROOT_LEVEL_FIELDS.includes(key)) {
+    if (ID_FIELDS.includes(key)) {
+      return;
+    }
+    if (allowedExtraRootKeys?.includes(key)) {
       return;
     }
     return throwInvalidKey({
       key,
-      path: attribute
+      path: path2.attribute
     });
   }
-  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_ALLOWED_FIELDS.includes(key)) {
+  if (isMorphToRelationalAttribute(parent?.attribute) && MORPH_TO_KEYS.includes(key)) {
     return;
   }
-  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_ALLOWED_FIELDS.includes(key)) {
+  if (isComponentSchema(schema2) && isDynamicZoneAttribute(parent?.attribute) && DYNAMIC_ZONE_KEYS.includes(key)) {
     return;
   }
-  if (hasRelationReordering(parent?.attribute) && RELATION_REORDERING_FIELDS.includes(key)) {
+  if ((isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute)) && RELATION_OPERATION_KEYS.includes(key)) {
     return;
   }
-  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute);
-  if (canUseID && !ID_FIELDS.includes(key)) {
+  const canUseID = isRelationalAttribute(parent?.attribute) || isMediaAttribute(parent?.attribute) || isComponentAttribute(parent?.attribute);
+  if (canUseID && ID_FIELDS.includes(key)) {
     return;
   }
   throwInvalidKey({
     key,
-    path: attribute
+    path: path2.attribute
   });
 };
 const index$3 = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
@@ -19295,16 +19589,16 @@ const validators = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.definePr
 const { ID_ATTRIBUTE, DOC_ID_ATTRIBUTE } = constants$6;
 const createAPIValidators = (opts) => {
   const { getModel } = opts || {};
-  const validateInput = async (data, schema2, { auth } = {}) => {
+  const validateInput = async (data, schema2, options = {}) => {
+    const { auth, route } = options;
     if (!schema2) {
       throw new Error("Missing schema in validateInput");
     }
     if (fp.isArray(data)) {
-      await Promise.all(data.map((entry) => validateInput(entry, schema2, {
-        auth
-      })));
+      await Promise.all(data.map((entry) => validateInput(entry, schema2, options)));
       return;
     }
+    const allowedExtraRootKeys = getExtraRootKeysFromRouteBody(route);
     const nonWritableAttributes = getNonWritableAttributes(schema2);
     const transforms = [
       (data2) => {
@@ -19327,10 +19621,11 @@ const createAPIValidators = (opts) => {
         schema: schema2,
         getModel
       }),
-      // unrecognized attributes
+      // unrecognized attributes (allowedExtraRootKeys = registered input param keys)
       traverseEntity$1(throwUnrecognizedFields, {
         schema: schema2,
-        getModel
+        getModel,
+        allowedExtraRootKeys
       })
     ];
     if (auth) {
@@ -19342,6 +19637,28 @@ const createAPIValidators = (opts) => {
     opts?.validators?.input?.forEach((validator) => transforms.push(validator(schema2)));
     try {
       await pipe$1(...transforms)(data);
+      if (fp.isObject(data) && route?.request?.body?.["application/json"]) {
+        const bodySchema = route.request.body["application/json"];
+        if (typeof bodySchema === "object" && "shape" in bodySchema) {
+          const shape = bodySchema.shape;
+          const dataObj = data;
+          for (const key of Object.keys(shape)) {
+            if (key === "data" || !(key in dataObj)) continue;
+            const zodSchema = shape[key];
+            if (zodSchema && typeof zodSchema.parse === "function") {
+              const result = zodSchema.safeParse(dataObj[key]);
+              if (!result.success) {
+                throw new ValidationError2(result.error?.message ?? "Validation failed", {
+                  key,
+                  path: null,
+                  source: "body",
+                  param: key
+                });
+              }
+            }
+          }
+        }
+      }
     } catch (e) {
       if (e instanceof ValidationError2) {
         e.details.source = "body";
@@ -19349,10 +19666,52 @@ const createAPIValidators = (opts) => {
       throw e;
     }
   };
-  const validateQuery = async (query, schema2, { auth } = {}) => {
+  const validateQuery = async (query, schema2, { auth, strictParams = false, route } = {}) => {
     if (!schema2) {
       throw new Error("Missing schema in validateQuery");
     }
+    if (strictParams) {
+      const extraQueryKeys = getExtraQueryKeysFromRoute(route);
+      const allowedKeys = [
+        ...ALLOWED_QUERY_PARAM_KEYS,
+        ...extraQueryKeys
+      ];
+      for (const key of Object.keys(query)) {
+        if (!allowedKeys.includes(key)) {
+          try {
+            throwInvalidKey({
+              key,
+              path: null
+            });
+          } catch (e) {
+            if (e instanceof ValidationError2) {
+              e.details.source = "query";
+              e.details.param = key;
+            }
+            throw e;
+          }
+        }
+      }
+      const routeQuerySchema = route?.request?.query;
+      if (routeQuerySchema) {
+        for (const key of extraQueryKeys) {
+          if (key in query) {
+            const zodSchema = routeQuerySchema[key];
+            if (zodSchema && typeof zodSchema.parse === "function") {
+              const result = zodSchema.safeParse(query[key]);
+              if (!result.success) {
+                throw new ValidationError2(result.error?.message ?? "Invalid query param", {
+                  key,
+                  path: null,
+                  source: "query",
+                  param: key
+                });
+              }
+            }
+          }
+        }
+      }
+    }
     const { filters: filters2, sort: sort2, fields: fields2, populate: populate2 } = query;
     if (filters2) {
       await validateFilters2(filters2, schema2, {
@@ -28088,7 +28447,14 @@ var preferredPm = async function preferredPM(pkgPath) {
     };
   }
   try {
-    if (typeof findYarnWorkspaceRoot(pkgPath) === "string") {
+    const workspaceRoot = findYarnWorkspaceRoot(pkgPath);
+    if (typeof workspaceRoot === "string") {
+      if (await pathExists(path.join(workspaceRoot, "package-lock.json"))) {
+        return {
+          name: "npm",
+          version: ">=7"
+        };
+      }
       return {
         name: "yarn",
         version: "*"
@@ -29814,13 +30180,17 @@ const extendMiddlewareConfiguration = (middlewares2, middleware2) => {
 };
 const dist = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty({
   __proto__: null,
+  ALLOWED_QUERY_PARAM_KEYS,
   AbstractRouteValidator,
   CSP_DEFAULTS,
+  RESERVED_INPUT_PARAM_KEYS,
+  SHARED_QUERY_PARAM_KEYS,
   arrays,
   async,
   augmentSchema,
   contentTypes: contentTypes$1,
   createContentApiRoutesFactory,
+  createModelCache,
   dates,
   env,
   errors,
@@ -29866,7 +30236,8 @@ const dist = /* @__PURE__ */ Object.freeze(/* @__PURE__ */ Object.defineProperty
   validateYupSchema,
   validateYupSchemaSync,
   validateZod,
-  yup
+  yup,
+  z: z$2
 }, Symbol.toStringTag, { value: "Module" }));
 const require$$0 = /* @__PURE__ */ getAugmentedNamespace(dist);
 const { castArray, isNil: isNil$1, pipe, every } = fp;
@@ -29936,6 +30307,40 @@ var strategies = ({ strapi: strapi2 }) => {
     },
     getRoomName: function(user) {
       return `${this.name}-user-${user.id}`;
+    },
+    /**
+     * Admin users have full access - verify always passes
+     * @param {object} auth - Auth object
+     * @param {object} config - Config with scope
+     */
+    verify: function(auth, config2) {
+      return;
+    },
+    /**
+     * Returns active admin sessions for broadcast
+     * Admin users have full access, so we return them with full_access permissions
+     * @returns {Promise<Array>} Array of admin session objects with permissions
+     */
+    getRooms: async function() {
+      try {
+        const presenceController = strapi2.plugin("io").controller("presence");
+        if (!presenceController?.getActiveSessions) {
+          return [];
+        }
+        const activeSessions = presenceController.getActiveSessions();
+        return activeSessions.map((session) => ({
+          id: session.userId,
+          name: `admin-${session.userId}`,
+          type: "full-access",
+          // Grants full access to all content types
+          permissions: [],
+          // Empty permissions array - full-access type bypasses permission check
+          ...session
+        }));
+      } catch (error2) {
+        strapi2.log.warn("[plugin-io] Admin getRooms error:", error2.message);
+        return [];
+      }
     }
   };
   const role = {
@@ -30174,12 +30579,12 @@ function transformEntry(entry, type2) {
     // meta: {},
   };
 }
-const { pluginId: pluginId$3 } = pluginId_1;
+const { pluginId: pluginId$4 } = pluginId_1;
 var settings$1 = ({ strapi: strapi2 }) => {
   const getPluginStore = () => {
     return strapi2.store({
       type: "plugin",
-      name: pluginId$3
+      name: pluginId$4
     });
   };
   const getDefaultSettings = () => ({
@@ -30319,6 +30724,19 @@ var settings$1 = ({ strapi: strapi2 }) => {
       // Maximum nesting depth for diff
     }
   });
+  const deepMerge = (target, source) => {
+    const result = { ...target };
+    for (const key of Object.keys(source)) {
+      const targetVal = target[key];
+      const sourceVal = source[key];
+      if (targetVal && sourceVal && typeof targetVal === "object" && !Array.isArray(targetVal) && typeof sourceVal === "object" && !Array.isArray(sourceVal)) {
+        result[key] = deepMerge(targetVal, sourceVal);
+      } else {
+        result[key] = sourceVal;
+      }
+    }
+    return result;
+  };
   return {
     /**
      * Get current settings (merged with defaults)
@@ -30341,10 +30759,7 @@ var settings$1 = ({ strapi: strapi2 }) => {
     async setSettings(newSettings) {
       const pluginStore = getPluginStore();
       const currentSettings = await this.getSettings();
-      const updatedSettings = {
-        ...currentSettings,
-        ...newSettings
-      };
+      const updatedSettings = deepMerge(currentSettings, newSettings);
       await pluginStore.set({
         key: "settings",
         value: updatedSettings
@@ -30357,7 +30772,7 @@ var settings$1 = ({ strapi: strapi2 }) => {
     getDefaultSettings
   };
 };
-const { pluginId: pluginId$2 } = pluginId_1;
+const { pluginId: pluginId$3 } = pluginId_1;
 var monitoring$1 = ({ strapi: strapi2 }) => {
   let eventLog = [];
   let eventStats = {
@@ -30463,8 +30878,10 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
      */
     getEventsPerSecond() {
       const now = Date.now();
-      const elapsed = (now - eventStats.lastReset) / 1e3;
-      return elapsed > 0 ? (eventStats.totalEvents / elapsed).toFixed(2) : 0;
+      const windowMs = 6e4;
+      const recentEvents = eventLog.filter((e) => now - e.timestamp < windowMs);
+      const elapsed = Math.min((now - eventStats.lastReset) / 1e3, windowMs / 1e3);
+      return elapsed > 0 ? Number((recentEvents.length / elapsed).toFixed(2)) : 0;
     },
     /**
      * Reset statistics
@@ -30485,13 +30902,14 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
       if (!io2) {
         throw new Error("Socket.IO not initialized");
       }
+      const safeName = `test:${eventName.replace(/[^a-zA-Z0-9:._-]/g, "")}`;
       const testData = {
         ...data,
         timestamp: Date.now(),
         test: true
       };
-      io2.emit(eventName, testData);
-      this.logEvent("test", { eventName, data: testData });
+      io2.emit(safeName, testData);
+      this.logEvent("test", { eventName: safeName, data: testData });
       return {
         success: true,
         eventName,
@@ -30501,7 +30919,7 @@ var monitoring$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const { pluginId: pluginId$1 } = pluginId_1;
+const { pluginId: pluginId$2 } = pluginId_1;
 var presence$1 = ({ strapi: strapi2 }) => {
   const activeConnections = /* @__PURE__ */ new Map();
   const entityEditors = /* @__PURE__ */ new Map();
@@ -30903,7 +31321,7 @@ var presence$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
-const { pluginId } = pluginId_1;
+const { pluginId: pluginId$1 } = pluginId_1;
 var preview$1 = ({ strapi: strapi2 }) => {
   const previewSubscribers = /* @__PURE__ */ new Map();
   const socketState = /* @__PURE__ */ new Map();
@@ -31165,22 +31583,23 @@ var diff$1 = ({ strapi: strapi2 }) => {
   const isPlainObject2 = (value) => {
     return value !== null && typeof value === "object" && !Array.isArray(value) && !(value instanceof Date);
   };
-  const isEqual2 = (a, b) => {
+  const isEqual2 = (a, b, depth2 = 0) => {
     if (a === b) return true;
     if (a === null || b === null) return a === b;
     if (typeof a !== typeof b) return false;
+    if (depth2 > 30) return JSON.stringify(a) === JSON.stringify(b);
     if (a instanceof Date && b instanceof Date) {
       return a.getTime() === b.getTime();
     }
     if (Array.isArray(a) && Array.isArray(b)) {
       if (a.length !== b.length) return false;
-      return a.every((item, index2) => isEqual2(item, b[index2]));
+      return a.every((item, index2) => isEqual2(item, b[index2], depth2 + 1));
     }
     if (isPlainObject2(a) && isPlainObject2(b)) {
       const keysA = Object.keys(a);
       const keysB = Object.keys(b);
       if (keysA.length !== keysB.length) return false;
-      return keysA.every((key) => isEqual2(a[key], b[key]));
+      return keysA.every((key) => isEqual2(a[key], b[key], depth2 + 1));
     }
     return false;
   };
@@ -31365,6 +31784,142 @@ var diff$1 = ({ strapi: strapi2 }) => {
     }
   };
 };
+var security = ({ strapi: strapi2 }) => {
+  const rateLimitStore = /* @__PURE__ */ new Map();
+  const connectionLimitStore = /* @__PURE__ */ new Map();
+  const cleanupInterval = setInterval(() => {
+    const now = Date.now();
+    const maxAge = 60 * 1e3;
+    for (const [key, value] of rateLimitStore.entries()) {
+      if (now - value.resetTime > maxAge) {
+        rateLimitStore.delete(key);
+      }
+    }
+    for (const [key, value] of connectionLimitStore.entries()) {
+      if (now - value.lastSeen > maxAge) {
+        connectionLimitStore.delete(key);
+      }
+    }
+  }, 60 * 1e3);
+  return {
+    /**
+     * Stops the background cleanup interval (called on plugin destroy)
+     */
+    stopCleanupInterval() {
+      clearInterval(cleanupInterval);
+    },
+    /**
+     * Check if request should be rate limited
+     * @param {string} identifier - Unique identifier (IP, user ID, etc.)
+     * @param {Object} options - Rate limit options
+     * @param {number} options.maxRequests - Maximum requests allowed
+     * @param {number} options.windowMs - Time window in milliseconds
+     * @returns {Object} - { allowed: boolean, remaining: number, resetTime: number }
+     */
+    checkRateLimit(identifier, options = {}) {
+      const { maxRequests = 100, windowMs = 60 * 1e3 } = options;
+      const now = Date.now();
+      const key = `ratelimit_${identifier}`;
+      let record = rateLimitStore.get(key);
+      if (!record || now - record.resetTime > windowMs) {
+        record = {
+          count: 1,
+          resetTime: now,
+          windowMs
+        };
+        rateLimitStore.set(key, record);
+        return {
+          allowed: true,
+          remaining: maxRequests - 1,
+          resetTime: now + windowMs
+        };
+      }
+      if (record.count >= maxRequests) {
+        return {
+          allowed: false,
+          remaining: 0,
+          resetTime: record.resetTime + windowMs,
+          retryAfter: record.resetTime + windowMs - now
+        };
+      }
+      record.count++;
+      rateLimitStore.set(key, record);
+      return {
+        allowed: true,
+        remaining: maxRequests - record.count,
+        resetTime: record.resetTime + windowMs
+      };
+    },
+    /**
+     * Check connection limits per IP/user
+     * @param {string} identifier - Unique identifier
+     * @param {number} maxConnections - Maximum allowed connections
+     * @returns {boolean} - Whether connection is allowed
+     */
+    checkConnectionLimit(identifier, maxConnections = 5) {
+      const key = `connlimit_${identifier}`;
+      const record = connectionLimitStore.get(key);
+      const now = Date.now();
+      if (!record) {
+        connectionLimitStore.set(key, {
+          count: 1,
+          lastSeen: now
+        });
+        return true;
+      }
+      if (record.count >= maxConnections) {
+        strapi2.log.warn(`[Socket.IO Security] Connection limit exceeded for ${identifier}`);
+        return false;
+      }
+      record.count++;
+      record.lastSeen = now;
+      connectionLimitStore.set(key, record);
+      return true;
+    },
+    /**
+     * Release a connection slot
+     * @param {string} identifier - Unique identifier
+     */
+    releaseConnection(identifier) {
+      const key = `connlimit_${identifier}`;
+      const record = connectionLimitStore.get(key);
+      if (record) {
+        record.count = Math.max(0, record.count - 1);
+        if (record.count === 0) {
+          connectionLimitStore.delete(key);
+        } else {
+          connectionLimitStore.set(key, record);
+        }
+      }
+    },
+    /**
+     * Validate event name to prevent injection
+     * @param {string} eventName - Event name to validate
+     * @returns {boolean} - Whether event name is valid
+     */
+    validateEventName(eventName) {
+      const validPattern = /^[a-zA-Z0-9:._-]+$/;
+      return validPattern.test(eventName) && eventName.length < 100;
+    },
+    /**
+     * Get current statistics
+     * @returns {Object} - Statistics object
+     */
+    getStats() {
+      return {
+        rateLimitEntries: rateLimitStore.size,
+        connectionLimitEntries: connectionLimitStore.size
+      };
+    },
+    /**
+     * Clear all rate limit data
+     */
+    clear() {
+      rateLimitStore.clear();
+      connectionLimitStore.clear();
+    }
+  };
+};
 const strategy = strategies;
 const sanitize = sanitize_1;
 const transform = transform$1;
@@ -31381,20 +31936,58 @@ var services$1 = {
   monitoring,
   presence,
   preview,
-  diff
+  diff,
+  security
 };
 const bootstrap = bootstrap_1;
 const config = config$1;
 const controllers = controllers$1;
 const routes = routes$1;
 const services = services$1;
-const destroy = async () => {
-};
+const { pluginId } = pluginId_1;
 const register = async () => {
 };
 const contentTypes = {};
 const middlewares = {};
 const policies = {};
+const destroy = async ({ strapi: strapi2 }) => {
+  try {
+    const presenceService = strapi2.plugin(pluginId)?.service("presence");
+    if (presenceService?.stopCleanupInterval) {
+      presenceService.stopCleanupInterval();
+    }
+    const presenceController = strapi2.plugin(pluginId)?.controller("presence");
+    if (presenceController?.stopTokenCleanup) {
+      presenceController.stopTokenCleanup();
+    }
+    const securityService = strapi2.plugin(pluginId)?.service("security");
+    if (securityService?.stopCleanupInterval) {
+      securityService.stopCleanupInterval();
+    }
+    const io2 = strapi2.$io?.server;
+    if (io2) {
+      io2.disconnectSockets(true);
+      await new Promise((resolve) => {
+        io2.close((err) => {
+          if (err) {
+            strapi2.log.warn(`socket.io: Error closing server: ${err.message}`);
+          }
+          resolve();
+        });
+      });
+    }
+    const redisClients = strapi2.$io?._redisClients;
+    if (redisClients) {
+      await Promise.allSettled([
+        redisClients.pubClient?.quit?.(),
+        redisClients.subClient?.quit?.()
+      ]);
+    }
+    strapi2.log.info("socket.io: Plugin destroyed – all handles released");
+  } catch (err) {
+    strapi2.log.error(`socket.io: Error during destroy: ${err.message}`);
+  }
+};
 var server = {
   register,
   bootstrap,