@solidxai/core 0.1.10-beta.2 → 0.1.10-beta.22

package/src/dtos/update-mcp-audit-log.dto.ts

@@ -0,0 +1,83 @@
+import { ApiProperty } from '@nestjs/swagger';
+import { IsInt, IsNumber, IsOptional, IsString } from 'class-validator';
+
+export class UpdateMcpAuditLogDto {
+  @IsOptional()
+  @IsInt()
+  id: number;
+
+  @IsOptional()
+  @IsInt()
+  @ApiProperty()
+  userId: number;
+
+  @IsOptional()
+  @IsInt()
+  @ApiProperty()
+  apiKeyId: number;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  username: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  transport: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  mcpSessionId: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  clientAddr: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  method: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  requestId: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  toolName: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  requestParams: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  status: string;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  responseResult: string;
+
+  @IsOptional()
+  @IsInt()
+  @ApiProperty()
+  errorCode: number;
+
+  @IsOptional()
+  @IsString()
+  @ApiProperty()
+  errorMessage: string;
+
+  @IsOptional()
+  @IsNumber()
+  @ApiProperty()
+  durationMs: number;
+}

package/src/dtos/update-user.dto.ts

@@ -161,4 +161,8 @@ export class UpdateUserDto {
     @IsOptional()
     @ApiProperty()
     userViewMetadataCommand: string;
+    @IsOptional()
+    @IsInt()
+    @ApiProperty()
+    failedLoginAttempts: number;
 }

package/src/entities/chatter-message-details.entity.ts

@@ -18,7 +18,6 @@ export class ChatterMessageDetails extends CommonEntity {
     @Column({ type: "varchar", nullable: true })
     oldValueDisplay: string;
 
-    @Index()
     @Column({ type: "varchar", nullable: true })
     newValueDisplay: string;
 
@@ -30,4 +29,4 @@ export class ChatterMessageDetails extends CommonEntity {
 
     @Column({ type: "varchar", nullable: true })
     fieldType: string;
-}
+}

package/src/entities/mcp-audit-log.entity.ts

@@ -0,0 +1,55 @@
+import { Column, Entity, Index } from 'typeorm';
+import { CommonEntity } from 'src/entities/common.entity';
+import { getColumnType } from 'src/helpers/typeorm-db-helper';
+
+@Entity({ name: 'ss_mcp_audit_log' })
+export class McpAuditLog extends CommonEntity {
+  @Index()
+  @Column({ nullable: true })
+  userId: number;
+
+  @Column({ nullable: true })
+  apiKeyId: number;
+
+  @Column({ nullable: true, length: 128 })
+  username: string;
+
+  @Column({ length: 32 })
+  transport: string;
+
+  @Index()
+  @Column({ nullable: true, length: 64 })
+  mcpSessionId: string;
+
+  @Column({ nullable: true, length: 64 })
+  clientAddr: string;
+
+  @Index()
+  @Column({ length: 64 })
+  method: string;
+
+  @Column({ nullable: true, length: 64 })
+  requestId: string;
+
+  @Index()
+  @Column({ nullable: true, length: 128 })
+  toolName: string;
+
+  @Column({ nullable: true, ...getColumnType('longText') })
+  requestParams: string;
+
+  @Column({ length: 16 })
+  status: string;
+
+  @Column({ nullable: true, ...getColumnType('longText') })
+  responseResult: string;
+
+  @Column({ nullable: true })
+  errorCode: number;
+
+  @Column({ nullable: true, ...getColumnType('longText') })
+  errorMessage: string;
+
+  @Column({ nullable: true, ...getColumnType('decimal') })
+  durationMs: number;
+}

package/src/entities/user.entity.ts

@@ -177,7 +177,7 @@ export class User extends CommonEntity {
     @Column({ nullable: true })
     rehashedAt: Date;
 
-    // dont send to client
+    @Expose()
     @Column({ type: "int", default: 0 })
     failedLoginAttempts: number = 0;
 

package/src/factories/whatsapp.factory.ts

@@ -1,42 +1,43 @@
-import { Inject, Injectable, Logger } from "@nestjs/common";
-import { ConfigType } from "@nestjs/config";
+import { Injectable, Logger } from "@nestjs/common";
 import { ModuleRef } from "@nestjs/core";
 import { SolidRegistry } from "src/helpers/solid-registry";
 import { IWhatsAppTransport } from "src/interfaces";
 import { SettingService } from "src/services/setting.service";
 import type { SolidCoreSetting } from "src/services/settings/default-settings-provider.service";
 
-function norm(s?: string) {
-    return s?.trim().toLowerCase();
-}
-
-// This factory will be use to return a mail service instance, using the configured environment variables
 @Injectable()
 export class WhatsAppFactory {
-    private readonly logger = new Logger(this.constructor.name);
-    constructor(
-        private readonly moduleRef: ModuleRef, // Use the module ref to dynamically resolve the mail service
-        private readonly solidRegistry: SolidRegistry,
-        private readonly settingService: SettingService,
-    ) { }
-
-    getWhatsappService(name: string = null): IWhatsAppTransport {
-        // This is the default provider
-        const whatsappServiceName = name || this.settingService.getConfigValue<SolidCoreSetting>("whatsappProvider");
-        if (!whatsappServiceName) {
-            throw new Error("Unable to resolve whatsapp provider")
-        }
-        const whatsappProviders = this.solidRegistry.getWhatsappProviders();
-
-        // Return the instance which matches the whatsappServiceName
-        if (!whatsappProviders.length) {
-            // throw new Error("No mail providers are registered.");
-            this.logger.error("No whatsapp providers are registered.");
-        }
-
-        const whatsappServiceProvider = whatsappProviders.find(provider => provider.name === whatsappServiceName);
-
-        return whatsappServiceProvider.instance as IWhatsAppTransport;
+  private readonly logger = new Logger(WhatsAppFactory.name);
+
+  constructor(
+    private readonly moduleRef: ModuleRef,
+    private readonly solidRegistry: SolidRegistry,
+    private readonly settingService: SettingService,
+  ) {}
+
+  getWhatsappService(name?: string): IWhatsAppTransport {
+    const providerKey =
+      name ||
+      this.settingService.getConfigValue<SolidCoreSetting>("whatsappProvider");
+
+    if (!providerKey) {
+      throw new Error("Unable to resolve whatsapp provider");
+    }
+
+    const whatsappProviders = this.solidRegistry.getWhatsappProviders();
+
+    if (!whatsappProviders.length) {
+      throw new Error("No whatsapp providers are registered.");
+    }
+
+    const whatsappServiceProvider = whatsappProviders.find((provider) =>
+      provider.name?.toLowerCase().includes(providerKey.toLowerCase()),
+    );
+
+    if (!whatsappServiceProvider) {
+      throw new Error(`WhatsApp provider '${providerKey}' not found`);
     }
 
-}
+    return whatsappServiceProvider.instance as IWhatsAppTransport;
+  }
+}

package/src/helpers/bootstrap.helper.ts

@@ -1,5 +1,6 @@
 import { ValidationPipe } from '@nestjs/common';
 import { NestFactory } from '@nestjs/core';
+import { WsAdapter } from '@nestjs/platform-ws';
 import { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';
 import { NextFunction, Request, Response } from 'express';
 import helmet from 'helmet';
@@ -8,7 +9,7 @@ import { existsSync } from 'fs';
 import { resolve } from 'path';
 import { WINSTON_MODULE_NEST_PROVIDER, WinstonModule } from 'nest-winston';
 import { CommandFactory } from 'nest-commander';
-import { WinstonLoggerConfig } from '../winston.logger';
+import { createWinstonLoggerConfig } from '../winston.logger';
 import { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';
 import { buildDefaultCorsOptions } from './cors.helper';
 import { buildDefaultSecurityHeaderOptions, buildPermissionsPolicyHeader, PermissionsPolicyConfig } from './security.helper';
@@ -49,6 +50,8 @@ export interface SolidBootstrapOptions {
   swagger?: SolidSwaggerOptions | false;
   /** Permissions-Policy header overrides (merged with defaults). */
   permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
+  /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */
+  verboseBootstrap?: boolean;
 }
 
 /**
@@ -69,11 +72,12 @@ export async function bootstrapSolidApp(
 ): Promise<void> {
   registerGlobalProcessHandlers();
 
-  const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {} } = options;
+  const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, verboseBootstrap = false } = options;
 
+  const startTime = Date.now();
   const appModule = await appModuleFactory();
   const app = await NestFactory.create(appModule, {
-    logger: WinstonModule.createLogger(WinstonLoggerConfig),
+    logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),
   });
 
   const apiEnabled = parseBooleanEnv('API_ENABLED', true);
@@ -114,9 +118,6 @@ export async function bootstrapSolidApp(
     next();
   });
 
-  // Winston logger
-  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));
-
   const port = process.env.PORT || 3000;
 
   if (globalPrefix) {
@@ -178,7 +179,16 @@ export async function bootstrapSolidApp(
   const types = require('pg').types;
   types.setTypeParser(types.builtins.INT8, (val: string) => parseInt(val));
 
+  app.useWebSocketAdapter(new WsAdapter(app));
+
   await app.listen(port);
+
+  // Wire up Winston as the runtime logger only AFTER listen — this suppresses all
+  // framework init noise (route mapping, module deps, onModuleInit) during boot.
+  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));
+
+  const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);
+  process.stdout.write(`\x1b[32mServer started on port ${port} in ${elapsed}s\x1b[0m\n`);
 }
 
 // ---- CLI bootstrap ----

package/src/helpers/command.service.ts

@@ -4,6 +4,7 @@ import { spawn } from 'child_process';
 export type CommandWithArgs = {
   command: string;
   args: string[];
+  cwd?: string;
 };
 
 @Injectable()
@@ -43,6 +44,7 @@ export class CommandService {
       const child = spawn(command, spawnArgs, {
         shell: isWindows, // Use shell on Windows to handle .cmd files
         stdio: ['pipe', 'pipe', 'pipe'],
+        cwd: commandWithArgs.cwd,
       });
 
       let stdout = '';

package/src/helpers/field-crud-managers/BigIntFieldCrudManager.ts

@@ -20,7 +20,7 @@ export class BigIntFieldCrudManager implements FieldCrudManager {
                 if (typeof fieldValue === 'string' || typeof fieldValue === 'number') {
                     fieldValue = BigInt(fieldValue);
                 }
-            } catch (err) {
+            } catch (err: any) {
                 return [{ field: this.options.fieldName, error: 'Invalid numeric value' }];
             }
         }

package/src/helpers/field-crud-managers/SelectionDynamicFieldCrudManager.ts

@@ -119,7 +119,7 @@ export class SelectionDynamicFieldCrudManager implements FieldCrudManager {
             }
             return false;
         }
-        catch (error) {
+        catch (error: any) {
             // Use the values method as a fallback, if the value method is not implemented
             const values = await providerInstance.values('', ctxt);
             const isValid = values.some(v => v.value === fieldValue);

package/src/helpers/field-crud-managers/field-quality-check-fixes.md

@@ -0,0 +1,208 @@
+# Field Quality Checks And Fixes
+
+This checklist tracks backend issues and logical enhancements for each field type in `solid-core-module`.
+
+Use it for backend concerns only:
+
+- CRUD validation
+- transformation and normalization
+- persistence behavior
+- relation semantics
+- field-level correctness and consistency
+
+Frontend widget and rendering concerns belong in `solid-core-ui`.
+
+## `shortText`
+
+- [ ] Resolve the `length` versus `max` contract for `shortText` and document one clear meaning for each attribute.
+- [ ] Decide whether backend validation should also enforce `min`, so `shortText` constraints remain consistent even outside generated form flows.
+- [ ] Return the configured regex mismatch message when `regexPatternNotMatchingErrorMsg` is present instead of always using a generic regex error.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `shortText` field.
+- [ ] Decide whether `shortText` should support optional normalization such as trimming or whitespace collapsing, and keep that decision consistent across comparable text field types.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for partial update behavior, empty string versus null handling, regex validation, and max-length enforcement.
+- [ ] Review whether the text-oriented managers share enough behavior to justify a common validation utility or base manager without weakening field-specific semantics.
+
+## `longText`
+
+- [ ] Decide whether backend validation should also enforce `min` and `max`, so `longText` constraints remain consistent outside generated form flows.
+- [ ] Return the configured regex mismatch message when `regexPatternNotMatchingErrorMsg` is present instead of always using a generic regex error.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `longText` field.
+- [ ] Decide whether `longText` should support optional normalization such as trimming trailing whitespace while preserving intentional line breaks.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for multiline content, regex validation, partial updates, and empty string versus null handling.
+- [ ] Review whether the text-oriented managers share enough behavior to justify a common validation utility or base manager without weakening field-specific semantics.
+
+## `richText`
+
+- [ ] Decide whether backend validation should also enforce `min` and `max`, so `richText` constraints remain consistent outside generated form flows.
+- [ ] Return the configured regex mismatch message when `regexPatternNotMatchingErrorMsg` is present instead of always using a generic regex error.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `richText` field.
+- [ ] Decide whether `richText` should support optional normalization or sanitization at save time, and define that behavior explicitly.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for rich HTML-like content, regex validation, partial updates, and empty string versus null handling.
+- [ ] Review whether the text-oriented managers share enough behavior to justify a common validation utility or base manager without weakening field-specific semantics.
+
+## `json`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `json` field.
+- [ ] Decide whether backend validation should accept only stringified JSON or also handle already-parsed object and array payloads more explicitly.
+- [ ] Review whether the current JSON validation error should distinguish between invalid JSON syntax and unsupported runtime value shapes.
+- [ ] Decide whether normalization or canonical stringification should happen before persistence for comparable JSON values.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for object payloads, array payloads, stringified JSON payloads, invalid JSON, partial updates, and empty string versus null handling.
+
+## `int`
+
+- [ ] Fix the current min/max activation rule, because backend validation only applies numeric bounds when the configured value is greater than `0`, which skips valid `0` and negative thresholds.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits an `int` field.
+- [ ] Decide whether the CRUD layer should normalize numeric strings into integers more explicitly before validation and persistence.
+- [ ] Review whether integer fields should reject decimal-shaped inputs more clearly when values arrive from metadata-driven clients as strings.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `0`, negative values, numeric strings, invalid decimal-like input, min/max bounds, and partial update behavior.
+
+
+## `bigint`
+
+- [ ] Clarify the authored support surface for `bigint`, because the CRUD manager contains numeric bound logic while the authored field surface does not currently present `min` and `max` in the same way as `int` and `decimal`.
+- [ ] Fix or clarify the current numeric-bound activation rule if bigint bounds are intended to be supported, since the logic only applies bounds when the configured value is greater than `0`.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `bigint` field.
+- [ ] Decide what the canonical runtime contract should be for bigint inputs: native `bigint`, numeric strings, or finite JavaScript numbers.
+- [ ] Review whether accepting finite JavaScript numbers for bigint validation is sufficient when exact large-integer fidelity matters.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for numeric strings, very large values, invalid numeric input, bound handling, null handling, and partial update behavior.
+
+
+## `decimal`
+
+- [ ] Fix the current min/max activation rule, because backend validation only applies numeric bounds when the configured value is greater than `0`, which skips valid `0` and negative thresholds.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `decimal` field.
+- [ ] Decide whether the CRUD layer should normalize numeric strings into decimal numbers more explicitly before validation and persistence.
+- [ ] Review whether decimal fields need an explicit precision-and-scale contract instead of relying entirely on the persistence-layer `ormType`.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `0`, negative values, fractional values, numeric strings, invalid numeric input, min/max bounds, and partial update behavior.
+
+
+## `boolean`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `boolean` field.
+- [ ] Decide whether boolean CRUD validation should accept only runtime booleans or also normalize `"true"` and `"false"` string payloads when they arrive from metadata-driven clients.
+- [ ] Review whether the required validation path should distinguish more clearly between an omitted value and an explicit `false` value, especially for partial updates.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `true`, `false`, null, empty string, string booleans, and partial update behavior.
+
+## `date`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `date` field.
+- [ ] Review whether the CRUD layer should accept only runtime `Date` objects or also normalize common serialized date inputs more explicitly before validation.
+- [ ] Decide whether `date` and `datetime` should continue to share the same backend validation path or receive more distinct normalization and validation behavior.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `Date` objects, serialized date strings, null handling, invalid date inputs, and partial update behavior.
+
+## `datetime`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `datetime` field.
+- [ ] Review whether the CRUD layer should accept only runtime `Date` objects or also normalize common serialized datetime inputs more explicitly before validation.
+- [ ] Decide whether `date` and `datetime` should continue to share the same backend validation path or receive more distinct normalization and validation behavior.
+- [ ] Review whether timezone normalization rules should be documented and enforced more explicitly at save time.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `Date` objects, serialized datetime strings, null handling, timezone-sensitive values, invalid datetime inputs, and partial update behavior.
+
+## `time`
+
+- [ ] Add an explicit CRUD-manager path for `SolidFieldType.time`, since the field currently has core UI support but is not routed through a dedicated backend field manager.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `time` field.
+- [ ] Decide what canonical persisted shape `time` should use: pure time string, database-native time value, or a normalized timestamp-derived representation.
+- [ ] Review whether the CRUD layer should normalize common time inputs such as `HH:mm:ss`, ISO timestamps, and UI-submitted values more explicitly before validation and persistence.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for `HH:mm:ss` inputs, ISO-style inputs, invalid time values, null handling, and partial update behavior.
+
+## `email`
+
+- [ ] Decide whether backend validation should also enforce `min`, so email constraints remain consistent outside generated form flows.
+- [ ] Return the configured regex mismatch message when `regexPatternNotMatchingErrorMsg` is present instead of always using a generic regex error.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits an `email` field.
+- [ ] Decide whether email values should support optional normalization such as trimming and lowercasing before persistence.
+- [ ] Review whether uniqueness should receive any pre-save validation support at the CRUD layer or continue to rely entirely on persistence-layer constraints.
+- [ ] Add targeted coverage for max-length enforcement, regex overrides, invalid email formats, null handling, and partial update behavior.
+
+## `password`
+
+- [ ] Return the configured regex mismatch message when `regexPatternNotMatchingErrorMsg` is present instead of always using a generic password-regex error.
+- [ ] Review whether password validation should produce clearer error messages for min, max, regex, and confirm-password mismatch failures.
+- [ ] Clarify and implement the expected behavior for `defaultValue` on password fields, including whether it should be ignored entirely for secure create flows.
+- [ ] Review whether password hashing and password-update flows should share a more explicit single contract across create and update operations.
+- [ ] Decide whether password normalization should include trimming or whether exact raw user input should always be preserved before hashing.
+- [ ] Add targeted coverage for create-required behavior, update-optional behavior, confirm-password mismatch, hashing behavior, regex fallback behavior, and partial update behavior.
+
+## `selectionStatic`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `selectionStatic` field, especially for multi-select fields.
+- [ ] Decide whether the CRUD layer should normalize single-select and multi-select payloads into one consistent stored shape before persistence.
+- [ ] Review whether the current `selectionStaticValues` parsing should validate malformed `value:label` entries more explicitly instead of assuming a valid authored format.
+- [ ] Add clearer error messaging when the submitted value has the wrong type versus when it is simply not part of the authored option set.
+- [ ] Review whether numeric selection values need more explicit normalization, especially when values can arrive as strings from metadata-driven clients.
+- [ ] Add targeted coverage for single-select string values, single-select numeric values, JSON-stringified multi-select arrays, invalid option tokens, malformed arrays, and partial update behavior.
+
+## `selectionDynamic`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `selectionDynamic` field, especially for multi-select fields.
+- [ ] Review whether the CRUD layer should normalize single-select and multi-select payloads into one consistent stored shape before persistence.
+- [ ] Add clearer error messaging when the submitted value has the wrong type, when the provider rejects the value, and when the provider itself cannot be resolved.
+- [ ] Review whether numeric selection values need more explicit normalization, especially when values can arrive as strings from metadata-driven clients.
+- [ ] Clarify how `validateOnSave` in `selectionDynamicProviderCtxt` should be treated as part of the supported field contract and whether more provider-context keys should be validated.
+- [ ] Add targeted coverage for provider-backed single-select values, JSON-stringified multi-select arrays, invalid provider names, `validateOnSave: false`, invalid option values, and partial update behavior.
+
+## `many-to-one`
+
+- [ ] Clarify and document the preferred request contract for single relations, because accepting both `<fieldName>Id` and `<fieldName>UserKey` is useful but easy to apply inconsistently across clients.
+- [ ] Review whether the CRUD layer should normalize empty strings for `<fieldName>Id` and `<fieldName>UserKey` more explicitly before required validation runs.
+- [ ] Decide whether user-key-based lookup failures should return a more specific error message than generic required or invalid relation errors.
+- [ ] Review whether relation resolution should support optional fixed-filter enforcement at save time in addition to UI-level filtering.
+- [ ] Consider whether uniqueness on a `many-to-one` field should receive clearer pre-save validation when the authored intent effectively makes the relation one-to-one.
+- [ ] Add targeted coverage for id-based lookup, user-key-based lookup, missing required relations, invalid id shapes, invalid user keys, and partial update behavior.
+
+## `one-to-many`
+
+- [ ] Clarify and document the command contract for collection relations so `set`, `clear`, `link`, `unlink`, `create`, `update`, and `delete` are easier to use consistently from clients.
+- [ ] Review whether malformed or unsupported command values should return more specific validation errors than the current generic failure path.
+- [ ] Decide whether create-time and update-time collection mutation semantics should be normalized more explicitly, especially where some commands are intentionally update-only.
+- [ ] Review whether `relationCoModelFieldName` should be validated more aggressively, because this field is central to child binding and inverse resolution.
+- [ ] Consider whether `relationFieldFixedFilter` should be enforced during relation mutation so child records cannot be linked outside the authored collection scope.
+- [ ] Add targeted coverage for `set`, `clear`, `link`, `unlink`, `create`, `update`, `delete`, invalid command payloads, and partial update behavior.
+
+## `many-to-many`
+
+- [ ] Clarify and document owner-side versus inverse-side mutation semantics so clients understand which effective field names and id lists are honored during CRUD operations.
+- [ ] Review whether malformed owner-side metadata such as missing `isRelationManyToManyOwner` or mismatched inverse names should fail earlier and more clearly.
+- [ ] Decide whether `relationJoinTableName` and related ownership attrs need stronger validation at metadata authoring time to avoid ambiguous join behavior later.
+- [ ] Review whether `relationFieldFixedFilter` should be enforced during membership mutation so unsupported links cannot be created through direct payloads.
+- [ ] Consider whether create, update, and delete operations against related entities should be more clearly separated from plain membership operations such as `set`, `link`, and `unlink`.
+- [ ] Add targeted coverage for owner-side mutations, inverse-side mutations, `set`, `clear`, `link`, `unlink`, related-entity create/update/delete flows, and partial update behavior.
+
+## `mediaSingle`
+
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `mediaSingle` field, including whether the field should ever accept persisted references without a new upload.
+- [ ] Review whether media validation should normalize authored `mediaTypes` values more explicitly so unsupported tokens fail early and predictably.
+- [ ] Consider whether storage-provider resolution should fail with a clearer field-specific error when `mediaStorageProviderUserKey` is missing or invalid.
+- [ ] Review whether replace and delete semantics should be more explicit in the CRUD layer when an existing asset is being updated or removed.
+- [ ] Consider whether upload validation should be refactored into shared utilities so size, type, and required checks stay consistent across media field types.
+- [ ] Add targeted coverage for required create-time uploads, oversized files, unsupported media types, missing providers, replacement flows, and partial update behavior.
+
+## `mediaMultiple`
+
+- [ ] Align collection-level validation with the single-media path so `mediaTypes` and `mediaMaxSizeKb` are enforced consistently for every uploaded file.
+- [ ] Clarify and implement the expected behavior for `defaultValue` when a create payload omits a `mediaMultiple` field, including whether persisted media references should ever be accepted directly.
+- [ ] Review whether storage-provider resolution should fail with a clearer field-specific error when `mediaStorageProviderUserKey` is missing or invalid.
+- [ ] Decide what the canonical update semantics should be for attachment collections: append-only, replace-all, explicit remove, or a more command-style contract.
+- [ ] Consider whether media collection validation should report per-file errors more explicitly when one file fails and others succeed.
+- [ ] Add targeted coverage for required create-time collections, mixed valid and invalid uploads, oversized files, unsupported media types, missing providers, and partial update behavior.
+
+## `computed`
+
+- [ ] Clarify and document the supported provider contract more explicitly, including what a computed-field provider must return and how failures should be surfaced to callers.
+- [ ] Review whether `computedFieldValueProviderCtxt` should be validated as JSON earlier and with clearer error messaging before provider execution begins.
+- [ ] Decide whether inline computation should remain skipped on partial updates by default, or whether some computed fields need an opt-in recompute path during patch-style operations.
+- [ ] Review whether `computedFieldTriggerConfig` should be validated more aggressively so unsupported operations or malformed trigger definitions fail earlier.
+- [ ] Consider whether the CRUD layer should verify that the provider’s returned value matches `computedFieldValueType` before persistence.
+- [ ] Add targeted coverage for inline provider execution, malformed provider context, missing providers, trigger-configured fields, partial updates, and mismatched computed value types.

package/src/helpers/module-metadata-helper.service.ts

@@ -23,7 +23,7 @@ export class ModuleMetadataHelperService {
             const fileContent = await fs.readFile(configFilePath, 'utf8');
             return JSON.parse(fileContent);
         }
-        catch (error) {
+        catch (error: any) {
             this.logger.error(`module metadata configuration non existent at: ${configFilePath}`);
         }
 

package/src/index.ts

@@ -29,6 +29,7 @@ export * from './decorators/settings-provider.decorator'
 export * from './decorators/extension-user-creation-provider.decorator'
 
 export * from './dtos/post-chatter-message.dto'
+export * from './dtos/update-chatter-note-message.dto'
 export * from './dtos/security-rule-config.dto'
 export * from './dtos/basic-filters.dto'
 export * from './dtos/solid-request-context.dto'
@@ -49,6 +50,7 @@ export * from './dtos/create-mq-message-queue.dto'
 export * from './dtos/create-mq-message.dto'
 export * from './dtos/create-agent-session.dto'
 export * from './dtos/create-agent-event.dto'
+export * from './dtos/create-mcp-audit-log.dto'
 export * from './dtos/create-scheduled-job.dto'
 export * from './dtos/create-permission-metadata.dto'
 export * from './dtos/create-role-metadata.dto'
@@ -89,6 +91,7 @@ export * from './dtos/update-mq-message-queue.dto'
 export * from './dtos/update-mq-message.dto'
 export * from './dtos/update-agent-session.dto'
 export * from './dtos/update-agent-event.dto'
+export * from './dtos/update-mcp-audit-log.dto'
 export * from './dtos/update-scheduled-job.dto'
 export * from './dtos/update-permission-metadata.dto'
 export * from './dtos/update-role-metadata.dto'
@@ -122,6 +125,7 @@ export * from './entities/mq-message-queue.entity'
 export * from './entities/mq-message.entity'
 export * from './entities/agent-session.entity'
 export * from './entities/agent-event.entity'
+export * from './entities/mcp-audit-log.entity'
 export * from './entities/scheduled-job.entity'
 export * from './entities/permission-metadata.entity'
 export * from './entities/role-metadata.entity'
@@ -297,6 +301,7 @@ export * from './services/mq-message-queue.service'
 export * from './services/mq-message.service'
 export * from './services/agent-session.service'
 export * from './services/agent-event.service'
+export * from './services/mcp-audit-log.service'
 export * from './services/scheduled-job.service'
 export * from './services/pdf.service'
 export * from './services/permission-metadata.service'
@@ -318,6 +323,7 @@ export * from './services/solid-introspect.service'
 export * from './services/user.service'
 export * from './services/view-metadata.service'
 export * from './services/whatsapp/Msg91WhatsappService' //rename
+export * from './services/whatsapp/GupshupOtpWhatsappService'
 export * from './services/setting.service'
 export * from './services/encryption.service'
 export * from './services/info.service'

package/src/interfaces.ts

@@ -42,6 +42,7 @@ export interface ValidationError {
 export interface MediaStorageProvider<T> {
   store(files: Express.Multer.File[], entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]>;
   delete(entity: T, mediaFieldMetadata: FieldMetadata): Promise<void>;
+  deleteByMediaRecord(media: Media): Promise<void>;
   retrieve(entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]>;
   storeStreams(streamPairs: [Readable, string][], entity: T, mediaFieldMetadata: FieldMetadata): Promise<Media[]>;
   // delete(file: string): Promise<void>;
@@ -121,8 +122,6 @@ export interface CodeGenerationOptions {
   fieldIdsForRemoval?: number[];
   fieldNamesForRemoval?: string[];
   dryRun?: boolean;
-  fieldIdsForRefresh?: number[];
-  fieldNamesForRefresh?: string[];
 }
 
 export interface TriggerMcpClientOptions {
@@ -450,4 +449,3 @@ export interface AuditQueuePayload {
     updatedColumnNames?: string[];
     userId?: number | null;
 }
-