@solidxai/core 0.1.13-beta.13 → 0.1.13-beta.14

package/CHANGELOG.md

@@ -1,5 +1,578 @@
 # Changelog
 
+## [0.1.13-beta.14] - 2026-08-06
+
+### Added
+
+- add security header options for iframe embedding and customize frame-ancestors
+- add createdAt field to PostChatterMessageDto and set default in service
+- implement transaction handling for unpublishing records and restore previous version
+- add progress reporting functionality to test runner and reporters
+- add viewWidget attribute for fileSize in metadata
+- add configurable UI timeouts for testing steps and update documentation
+- enhance internationalisation by adding applyCreateDefaults method for localeName on create DTOs
+- implement promoteRecoveredDraftPublishVersion method and integrate with CRUDService for soft-deleted records
+- add default locale name for internationalised entries in test data seeding
+- implement draft/publish versioning support and refactor related services
+- add DraftPublishHelperService for managing draft and publish workflows
+- add workflow field data provider support and related interfaces
+- add asynchronous execution for workflows and enhance execution status retrieval
+- implement WorkflowSecret management with CRUD operations and integrate into workflow execution
+- enhance workflow definition management and add Python runtime node
+- add SolidX integration nodes for login, email, and SMS
+- add support for versioning and publishing in CRUD operations, including new fields in entities and filters
+- enhance http.request node with query parameters and body modes
+- refactor node structure and add sequential and switch nodes
+- update workflow execution and definition handling
+- implement workflow execution services and nodes
+- implement API key generation for system admin users in ModuleMetadataSeederService
+- enhance ModuleMetadataSeederService to generate and store API keys for system admin users
+- add fieldConfig property to DatasourceIntrospectionMappingColumnDto and enhance field sanitization in DatasourceIntrospectionService
+- enhance migration process with build and seed commands
+- enhance datasource introspection with primary key detection and migration support
+- enhance role creation with module linkage and resolve module metadata
+- enhance action, role, and view metadata services with change detection and JSON normalization
+- add introspection services for MSSQL, MySQL, and PostgreSQL
+- add new dashboard controller actions to permissions
+- simplify queue health permissions by consolidating patterns
+- implement explicit widget permissions and unauthorized response handling
+- enhance widget permission checks and add unauthorized response handling
+- add Queue SLA heatmap provider and update metadata
+- update queue health menu item and reorder messages
+- add various dashboard providers and runtime services
+- implement WhatsApp Cloud API integration
+- add gupshup whatsapp provider
+- add deleteByMediaRecord method to MediaStorageProvider implementations
+- add updateCustomNoteMessage action to ChatterMessageController
+- add secure custom-note edit API with attachment add/remove support
+- implemented social media oath for facebook and microsoft
+- add partialUpdate endpoint to menu-item-metadata controller and update metadata seeder relation field name
+- implemented social media oath for facebook and microsoft
+- add Message Tree Action and corresponding view for mqMessage
+- implement processing timeout for RabbitMQ subscriber
+- Add a composite index to `ChatterMessage` on `coModelName` and `coModelEntityId`, and an index to `chatterMessage` in `ChatterMessageDetails`.
+- Migrate date/time transformers to UtcDateTimeTransformer.
+- simplify S3 URL resolution DTO, and remove unused S3 resolution logic.
+
+### Fixed
+
+- make currentValue optional in CreateModelSequenceDto and update seeding logic to exclude it
+- change matched column type from bit to default nullable boolean
+- improve error message for media deletion restriction
+- use transactions entitymanager for all subscribers only for embedded db projects
+- update consuming project name resolution to use parent directory
+- update solidx directory path to include consuming project name
+- correct package name in model generation command and update error handling in module metadata retrieval
+- username
+- remove type specification for encrypted column in Setting entity, to work in mssql also
+- handle null or empty security rule configuration strings in repository
+
+### Changed
+
+- update media type handling in CreateFieldMetadataDto and FieldMetadataService
+- remove onDelete cascade option from ManyToOne relationships in entity definitions
+- unify datetime column types across entities using helper function
+- remove explicit timestamp type for nullable date columns across entities
+- update CommonEntity properties to be optional and adjust types in WorkflowTriggerExecution
+- rename create-draft-publish-helper.service to draft-publish-helper.service and update imports
+- inject InternationalisationHelperService in ModuleTestDataService and CrudHelperService
+- separate generic delete from draft-publish and i18n cleanup in CRUDService
+- remove unused boolean type and related system column definitions from DatasourceIntrospectionService
+- update CrudHelperService to initialize DraftPublishHelperService directly in the class refactor: remove publishedAt sorting logic from getLayout method in ViewMetadataService
+- simplify published version filtering in CRUDService
+- remove handleSeedLocales method to streamline locale seeding process
+- remove legacy dashboard files and add new dashboarding architecture guide
+- remove unused dashboard question and variable providers, SQL expression resolver, and related subscribers
+- remove redundant null check in resolveSecurityRuleConfig
+- update body column type to longText using getColumnType helper in SmsTemplate entity
+- update legacy entity fields to be nullable and support null types
+- replace DTO introspection with explicit isUpdate flag in MediaFieldCrudManager
+- make password scheme and failed login attempt columns non-nullable in UserEntity.
+- make passwordScheme, passwordSchemeVersion, and failedLoginAttempts fields nullable in the User entity.
+
+### Documentation
+
+- update expired discord link
+
+### Other
+
+- Comment out countGroupedRecords method implementation for refactoring
+- show theme toggle
+- changes to support passing an explicit createdAt while posting a chatter message
+- Enhance countGroupedRecords and passed  internationalisation and draft publish workflow parameters in executeGroupPipeline
+- rename theme registry
+- remove add permisson from permisson-list-view
+- removed indexes on username and mobile since it is a conditional index and it breaks for mssql since multiple nulls are not allowed on unique columns
+- readme changes
+- removed hardcoded type against a boolean type
+- changes to the default testing setting timeout to pick from env as well
+- remove duplicate code
+- refactoring around chatter media security fix
+- add media extension  support for post chatter
+- Add media upload action and validation in MediaService
+- add media extension  support for post chatter
+- changes to ensure only id and field are returned while populating the user in chatter
+- Update defaultValue types in solid-core-metadata.json to strings
+- 1. changes to ensure user populated for chatter and createdBy/updatedBy has only id and fullName populate 2. Added Exclude at property level on user to exclude sensitive fields by default without having to add an exclude at the class level
+- Add getMentionableUsers permission
+- Add endpoint to retrieve mentionable users with search and limit options
+- Add error handling nodes and enhance workflow node definitions
+- Add skipHooks option to seed command and related services
+- Remove type specification for matched column in WorkflowTriggerExecution entity
+- Enhance workflow node definitions and runtime context handling
+- remvoing redundent code
+- Remove onDelete cascade option from ManyToOne relationships in SavedFilters entity
+- changes
+- changes
+- sql injection vulnerability closed in filter queries
+- Remove LocalPath
+- revert changes
+- revert changes
+- revert changes
+- re revert
+- revert changes
+- private-file-cleanup
+- add downlaodurl
+- changes to allow overriding the is allowed api keys flag thru extension user
+- Revert "user enumeration"
+- remove validation from username and mobile
+- user create validation bugs
+- add normalize for otp based also
+- Disable metadata pruning by default in seed command configuration
+- Update seed command to enable metadata pruning by default
+- handle-case-sensitive-for-email
+- Add delete permissions for ImportTransactionController in solid-core metadata
+- Add permissions for import/export functionality in solid-core metadata
+- Refactor role assignment for admin users to handle capability roles individually
+- discard changes
+- add support for  static file
+- Add capability roles for admin users in module metadata seeder
+- Enhance module metadata seeder with event emission for start and finish; add options interface for seeding configuration
+- attachment
+- Add new roles and permissions for import/export functionality; refactor role permission handling
+- make isPublic default true
+- changes to show the image inline
+- cleanup againts media's
+- inline role crate false
+- Implement chatter mention notification system with email templates and queue handling
+- Add messageBodyMentions field to chatter message DTOs and entity
+- fix-audit-bug
+- changes to include signed url token for private media
+- Revert "Revert "rename function name""
+- Revert "Revert "add private media support""
+- Add media file type constants and enhance security for media uploads
+- remove some unusable code
+- some changes
+- handle technical error messages due to missing resource in static resources folder
+- Revert "add private media support"
+- Revert "rename function name"
+- rename function name
+- add private media support
+- some fixes
+- solidx session invalid changes
+- add validation on get chatter message
+- updatedAt value is updating now
+- fix to allow linking a  userKey belonging to the parent model while seeding a child model
+- add security against chatter
+- chatter message endpoint made public
+- removed embedded db support
+- Add default sorting by ID if not explicitly specified in order options
+- solidx theme settings
+- add icons across all the models in solid core
+- media upload added behind auth
+- Refactor module path resolution to use kebab-case and extract migration file writing logic into a separate method
+- Implement cleanup for TypeORM datasource entities and enhance file handling in SolidTsMorphService
+- class serializer interceptor added for impact of Exclude and Expose
+- Enhance datasource introspection with primary key validation and user key resolution
+- Concurrent Login Feature
+- user enumeration
+- add  helper text key on settings object .........
+- changes to handle case insenstive filter operations if the values are other than string by casting
+- menus item fix
+- changes to ensure entity manager does not get serialized as part of the message for the computed field queue
+- added nodemon heartbeat to allow in-process db query execution for code generation for embedded db
+- display name changed
+- name changed
+- added settings for configure the row click on solid list view
+- Revert "Fix for this issue > stop applying lower for numeric fields."
+- fixed legacy entity files names
+- view metadata type field - selection static and roles required false from menu-item
+- Fix for this issue > stop applying lower for numeric fields.
+- refactor and add migration command
+- Handling for audit subscriber to defer audit publish when in embedded db mode
+- Fixed the one genuine mid-transaction second-connection case and hardened the latent spots (for embedded db)
+- changes to take in option for seeding with modules in current seed method
+- Fix validation logic to parse string field values as integers before applying validations
+- remove computed field from instruction add one remove field command fix many-to-many on chatter log
+- ad changes
+- Add locale seeding functionality and enhance locale management
+- subscribers now use the event’s own transaction connection instead of a second pooled one (helpful for embedded db)
+- changes to avoid extra module checks before dynamically loading it
+- defaulted to modulemetadataseederservice if no seeder provided
+- Add Date field in Instructions Response
+- ai interaction cleanup changes
+- enabling create,edit,import,export on permission and lov modules
+- added module to rolemetadata list view
+- roles group by module changes
+- Refactor dashboard providers to utilize new bucket expression and normalization functions
+- Implement Datasource Management functionality with controller, service, and DTO
+- added index to fields newly added as sortable and searchable
+- Add archiver package to dependencies
+- removed unnecessary seed file
+- Add TypeORM migration helper functions and export in index
+- fixes
+- reverted accidental removal of the layout builder root menu
+- pending cleanup of solid core menu items
+- Refactor metadata: remove standalone menu items and add scheduled jobs and saved filters tree views
+- Remove ChatterMessageDetails and ImportTransactionErrorLog menu items; add Chatter Messages tree view and action. Other menu sub menus cleanup done
+- Add model sequence and list of values tree views to metadata, other cleanup changes
+- changes for IAM
+- Add clearPackageRuntime functionality and corresponding metadata action
+- Add archiver dependency and implement module package export functionality
+- Refactor menu cleanup logic in ModelMetadataService and ModuleMetadataService; improve error handling for file deletion and update build commands in ModulePackageService to use solidctl.
+- Update solid-core-metadata.json to disable create, edit, and delete actions, and set searchable attributes to false for specific fields for media storage provider
+- Add media tree view and action & media view cleanup, enhance file storage provider with file size tracking, implemented storeStreams for s3
+- Remove cleanup procedures for module metadata across all SQL dialects and implement menu and action cleanup in the service layer.
+- Remove unused database bootstrap service and related SQL cleanup procedures
+- cleanup
+- Add view and action metadata tree views with updated permissions and searchable fields
+- Add view and action metadata tree views with updated permissions and searchable fields
+- menu item model cleanup
+- Add resumable import handling and transaction management in module package service
+- Add method to retrieve Solid UI module path and enhance cleanup logging
+- Enhance module metadata seeder: add validation for module name, streamline array handling for scheduled jobs, saved filters, list of values, security rules, sms templates, email templates, menus, actions, views, users, roles, media storage providers, model sequences, and models metadata.
+- Implement module package management: add controller, service, and DTOs for import, export, and build operations.
+- many to one left join issue fixed
+- Refactor field metadata actions and views: update action types, enhance searchability, and adjust permissions for create, edit, and delete operations.
+- Refactor CRUD and model metadata services to enhance group filtering and pagination; streamline response handling and improve query structure. configuration changes to support tree view in model metadata
+- Update solid-core metadata: remove import/export options, rename fields, and add sortable attribute
+- Enhance solid-core metadata structure for module mdtadata by removing import/export options and adding sortable attributes for fields
+- Implement module metadata explorer with CRUD operations and search functionality
+- Refactor module metadata paths to use a consistent directory structure and improve file resolution logic
+- Bug fixs
+- added frontend base url as well to the default settings
+- minor cleanup
+- changes to cleanup legacy table related fields
+- changes for new dashboards functionality
+- always print server startup line regardless of log level
+- Add field quality checks and fixes checklist for backend validation
+- typeo issue
+- Agent table clean up
+- Add manual interaction step for Playwright and update README
+- provision made to unlink data rather than having to teardown everything
+- provision made to unlink data rather than having to teardown everything
+- changes to colour the server startup line
+- Agent table clean up
+- changes to avoid too many initialization logs. controlled thru the verboseBootstrap option to the boostrap helper
+- removed id command options and retained the singular name option only for consistency purposes
+- changes to route genertion commands thru solidctl. The refresh-module & refresh-model commands are what are eventually called and end up calling the services only, keeping calling consistent and ensuring everything is route thru solidctl generate
+- got rid of fieldNamesForRefresh and fieldIdsForRefresh dead chain since it is not used now, due to fields being read in the code builder from the metadata json directly
+- MCP table solid changes
+- playwrite added as dependency instead
+- changes to the test runner
+- chatter message user resolution chagnes
+- bug fix in chatter message user resolution after we moved to queues.
+- moved back to beta3
+- failed login attempts field added to the json and update dto and exposed in entity
+- removed un-necessary index on newvalue display
+- ts changes error: any
+- auto addition of menus happens at the bottom now. list view layout changes for security access rules + enabled delete made welcome email & sms SystemAdminEditable
+- changed model metadata service default form layout to be single column
+- added typing to catch blocks + authentication service bug fixes for private registration flow
+- added typing to catch blocks + authentication service bug fixes for private registration flow
+- normalised @ApiTags
+- enum for passwordless modes
+- bug fix in how alternative actions are rendered
+- queue related bug fixes
+- changes to add a websocket adaptor to the bootstrap server routine
+- license changes
+- type fixes
+- removed min and max from long text mapping
+- bug fix for shortext field mapping
+- changes to post the testing results to a webhook api with a test payload
+- added import multer this fixes un-necessary ts errors in vscode
+- ts errors fixed
+- bug fix in rabbitmq subscriber optimisation in all subscribers to default to role both if not specified
+- formatting changes
+- facebook oauth
+- Status required false
+- updated gitignore
+- dleete un-necessary docs
+- deleted un-necessary files
+- changes related to more grooming
+- api added in cors
+- refactor Oauth strategy
+- Revert "Ft social media login"
+- bug fix
+- bug fix
+- add new api me endpoint and role based settings
+- setting changes for new ui architecture
+- changes for new settings structure
+- chatter task subtype and related changes
+- bug fix
+- fixes
+- changes to get rid of angular schematics for helping with string case transformation for consistency  purpose i.e (lodash is being used on frontend too) and avoid edge cases
+- changes to handle import logs as well, thru configured winston log level
+- change isMultiSelect to true in solid-core-metadata.json
+- change isMultiSelect to false and set visibility for cronExpression, dayOfWeek, and dayOfMonth fields to false
+- tightened up queue subscriber interface + fixed core subscribers that were not returning anything. all subscribers must either return a promise or if not async then the actual value
+- removed authTheme setting, auth pages dark - light is now controlled by the same local storage as the rest of the app shell
+- bug fix: passwordless registration should create a user with active false
+- apikeys attribute was not exposed
+- refactor Oauth strategy
+- changes to avoid sending out encrypted setting in api responses. also removed menu item and action entries for ai settings. (temporary fix, since setting ui to be revamped soon)
+- bug fix
+- null check on role
+- made provision to seed custom permissions
+- handled seed scenario too
+- upload File and expectHidden changes
+- extension user cleanup and checks added
+- fixed types for cleanup
+- added tsc-alias as well to ensure clean imports in dist as an extra cleanup measure
+- fixes bare shell imports with relative imports
+- dynamic import fix
+- removed unnecessary file
+- fixes for 1. throw exception if extension user and no provider configured 2. fixed roles method in the extensionUserProvider interface to make it mandatory
+- removed base abstract class
+- added interface too
+- changes
+- changes to test data seeding & fixed the type for authenticationService.signup method
+- changes to user dto to include the api keys toggle
+- add default role to the user only if there are no roles resolved against a user
+- changes to replace current extension user custom user creation logic with the use of dynamic extension user provider. cleans up creation of an extension user
+- Only forward --debug when explicitly enabled.
+- toolOutput field changes to json
+- adding user api key entity to export
+- minor optimisation to how dynamic modules are loaded
+- Add Discord badge to top of README
+- Fix broken BSL license link and add Discord link to README
+- Add BSL 1.1 license and update package.json license field
+- Seed user and roles in testing data
+- removed readme.txt
+- moved type and interfaces in interfaces.ts and refactored accordingly
+- changed to md
+- added readme
+- Ai setting model change
+- changes to allow encrypting setting keys
+- form view clean up
+- Agent table list view changes
+- synchronize false
+- changes to resolve the selection dynamic provider by name and token both
+- changes to bypass swagger urls from csp policy
+- changes to create a seperate endpoint for admin users to generate api key + custom repository created for userApiKey
+- changes to fix issue around isAllowedToGenerateApiKeys not getting saved during user creation
+- changes to implement the sso code and sso exchange use cases
+- removed orm types / exported api key entity
+- added provision to control if api key creation is allowed for the user
+- api key changes for backend
+- changes to bootstrap helper to read from standard env variables and avoid redundantly passing swagger options
+- fix to call addRoles only if role names are present
+- Revert "revert: refactor: update legacy entity fields to be nullable and support null types"
+- refactor: update legacy entity fields to be nullable and support null types
+- Json structure change
+- Agent table metadata clean up changes
+- longtext
+- longtext changes
+- Agent tables clean up
+- fixes to seed many-to-many relation for tests
+- changes to seed media in testing data
+- Chatter modelUserkey and excel many to one issue
+- keeping the default selectionValueType as string since this is a good default
+- bug fixes around how media is done
+- bug fixes
+- try catch inside logEvent
+- media has card based metadata
+- Refresh token activity
+- changes to implement the sso code and sso exchange use cases
+- cleanup
+- enabled kanban view on mq message
+- Agent table changes
+- changes to disallow deleting a model or module in production
+- changelog version bumped
+- changelog added
+- changes to control the logging using env variables & set appropriate defaults basis environment
+- chnages for logging
+- Chatter queue fixs
+- one more "beta" for ozzy
+- additional loggging in cors helper
+- changes
+- Redis Queue component  and rabbitMQ folder changes
+- changes to track old and new fields as part of the delete entity operation
+- optimizations done for audit subcriber
+- changes to optimize audit subscriber code to use background jobs entirely instead of partially
+- changes to push all work/processing to the chatter queue subscriber to better manage workloads & db pooling utilization
+- formatting changes
+- performance optimisations 1. created by updated by subscriber is not querying users again and again 2. rabbit pub / sub can now optinally switch off db persistence
+- qs depth config increased
+- changes to move the shouldTrackAudit check into registry to avoid unnecessary checks during runtime
+- cached model metadata queries
+- changse
+- disabled extra loggign
+- chagnes
+- reduced concurrency in computed fields
+- additional loggign
+- added indexes to mobile & email since those are frequently queries upon
+- changes to optimize the permission service methods used in the hotspot load paths within auth and access token guards
+- Redis background job changes
+- Chatter Rationalizing
+- changes
+- changes
+- changes to merge the entityId sequence computed provider into the existing sequence number provider
+- changes to export bootstrap helpers for server & cli nest applications
+- changes to toggle the validation for selection dynamic provider. Also changes to export a bootstrap helper function
+- registered the EntityIdSequenceNumComputedFieldProvider computation provider as a nest provider
+- Added EntityIdSequenceNumComputedFieldProvider as an alternative simpler provider which uses the modelSequence configuration and relies on the id persisted during creation for an entity
+- added index on message id in mq message table
+- changes around sequence num computed field being a post computation provider error logging in rabbit mq
+- changes to save model sequence id as part of post compute instead of pre compute
+- changse
+- Revert "High concurrency fix for alpha num and sequence num computed fields"
+- High concurrency fix for alpha num and sequence num computed fields
+- bug fix in cron evalutaion
+- tighter logging around roles
+- scheduler now supports env based specific jobs starting and others not
+- reverting back to text (i.e since it is good enough for mysql too) i.e 64kb for these fields
+- revert cross db changes for view-metadata-entity
+- fixes
+- changes to handle cross-db compatibility
+- added type as simple-json
+- Remove isValidateForUpdate hack that relied on checking dto.id !== undefined
+- Revert "Merge branch 'media-update' into 'main'"
+- Mysql related changes
+- ts-morph and media storage fix
+- dashboard layout menu item added
+- dashboard changes
+- scheduler bug fix
+- made provision to execute scheduled jobs manually
+- changes
+- cleanup
+- logging related changes and made user activity history tree view
+- changes to return the wall clock time as utc for chatter as well to keep it...
+- changes around dashboard question refactoring
+- default tree view and action added on code generation
+- Date time format changes in audit
+- user activity history on otp login
+- changes
+- changelog added
+- reverted legacy and common entity to use local date time transformer only
+- added changelog
+- made playwright dependency lazy
+- ai interaction table user is nullable now
+- rabbitmq subscriber does a prefetch now allowing for more concurrency
+- formatting changes
+- Version info changes
+- dummy otp can now be enabled on a per user basis
+- jwt token optimisation
+- optimised the authentication flow in microservice adapter to cache access token
+- deleted file containing secrets
+- changes
+- optimisation around how dummy otp is managed
+- isSeeded added
+- bug fix for fetch layouts
+- view modes added in layout
+- One to many crud manager fixes
+- one-to-many-crud-manager-fixes
+- Many to many crud field manager fixes
+- patch endpoint added in role controller
+- many-to-many field fixes
+- modelSequenceFormViewChangeHandler added on field change
+- changes to convert the passwordlessRegistrationValidateWhat from array to string
+- changes to format group values consistently
+- fixes for normalizing group values
+- Revert "changes to return groupValue in the group meta response as well. groupValue is..."
+- changes to return groupValue in the group meta response as well. groupValue is...
+- changes to return groupValue in the group meta response as well. groupValue is...
+- filter_field_granularity_supported_added_for_date_fields
+- password registration/login cleanup + max failed login attempts checks added
+- removed unsafe inline from CSP
+- removed incorrect comment
+- changes
+- Revert "replaced playwright with lazy dependency"
+- replaced playwright with lazy dependency
+- count and average
+- fixes to solid core metadata configuration
+- make `s3Key` and `isPrivate` properties mandatory in `ResolveS3UrlDto`.
+- solid seed now prints proper exception stack trace
+- added playwright dependencies as peer dependencies
+- changed playwright import to make it lazy
+- issue fixes
+- formatting changes
+- formatting changes
+- changes for test setup
+- package changes
+- Changes to generate an SA user with the default password for simpler experience during setup
+- more changes to support form data based uploads
+- changes
+- changes around testing workflow
+- unified testing utitlities
+- added comments to the slug code
+- refactored queue namespacign
+- queue namespacing related chanes
+- removed todo
+- queue name related changes
+- cag
+- changrs
+- queues names are now namespaced by service naem
+- enabled logs
+- debug logs
+- testing docs updated
+- changes
+- cleanup
+- removed old testing related fiels
+- testing infra now supports data based interpolation
+- testing changes: now we support fully custom test specs
+- changes for test automation
+- changes to tsconfig for playwright tests
+- exporting typeorm db helper
+- removed the files section
+- changes for playwright testing
+- changes to disable service controller seed method
+- formatting changes
+- oom issue
+- logger added for chatter
+- changed arg to kebab case instead of came case in schematic service
+- default menu icons added
+- rabbitmq subscriber: add retries, DLX queues, reconnects, and docs
+- removed un-necessary log
+- fix for handling non existence of fieldNamesForRemoval arg
+- foirmatting canges
+- Archived/solidstarters main
+- version changes
+- changed org : @solidstarters -> @solidxai
+- removed publish script, since it is replaced with solidctl release
+- chanes
+- Revert "@solidstarters namespace changed to @solidx"
+- @solidstarters namespace changed to @solidx
+- file service interface changes
+- CR in s3 file service, url options now supports isPrivateBucket allowing one to generate signed and un-signed URLs using the getUrl method
+- changes to the publish script to support: 1.reverse merging main to dev to ensure latest package version is synced with dev post publish. 2. added guardrail to allow publishing from main branch only 3. added dry run option and force option i.e (in case we want to publish from another branch, but is hidden) 4. script now pushes the git version tags as well
+- changes to pass minimal parameters to the schematics project and pick the rest from the metadata configuration json file (avoid long shell commands)
+- test data workflow
+- test-data command
+- seed command updated
+- changes
+- changes
+- seed command changes to support pruning, test-data-setup and test-data-teardown.
+- seeding now supports seedData allowing us to seed fixtures for testing.
+- precomputations now skip computation if value is already provided
+- added utility for findOneByUserKey
+- pruning related chagnes
+- changes
+- more changes related to pruning metadata
+- pruen logs added
+- module metadata seeder now does prune also
+- reformatting to improve readability
+- changes
+- file type not allowed. Allowed: image, document, pdf. Received mimetype: application/pdf (mapped to file)
+- bug fixes
+- changes to cleanup the implementation by having the write method of file service return the url post write
+- changes to support using the region specified in a media storage provider, instead only the default while creating an s3 client
+- fixes for using the default-aws-s3 bucket for storing the settings media if default file service is s3
+- changes to settings media storage logic i.e copy multer path to  file service implementation write
+- file service abstraction cleanup
+- chagnes
+- Dashboard Question Responsive
+
 ## [0.1.13-beta.13] - 2026-08-05
 
 ### Added

package/README.md

@@ -160,6 +160,25 @@ export class AppModule {}
 
 For full configuration options — environment variables, storage providers, queue setup, and OAuth credentials — see the [Developer Documentation](https://docs.solidxai.com/docs).
 
+### Security headers and iframe embedding
+
+`bootstrapSolidApp` applies security headers through Helmet. The `frame-ancestors` CSP directive controls which origins are allowed to embed responses from the API in an iframe. This is relevant when rendering PDFs or other protected resources in the browser's built-in viewer.
+
+By default, the bootstrap helper allows the current origin and local development origins (`localhost`, `127.0.0.1`, and `::1`) over HTTP or HTTPS on any port. This supports common setups where the UI and API run on different local ports, such as `localhost:3001` embedding a PDF served by `localhost:3000`.
+
+To customize the allowlist, pass `security.frameAncestors` when bootstrapping the API. The configured list replaces the default list, so include every origin that should be allowed:
+
+```typescript
+bootstrapSolidApp(() => AppModule.forRoot(), {
+  swagger: { title: 'My API', description: 'My API description' },
+  security: {
+    frameAncestors: ["'self'", 'https://portal.example.com'],
+  },
+});
+```
+
+For a fully restricted application, use `frameAncestors: ["'none'"]`. When cross-origin ancestors are allowed, `@solidxai/core` omits the legacy `X-Frame-Options` header because that header cannot express an origin allowlist; the CSP directive remains the source of truth.
+
 
 ## Technology Stack
 

package/dist/constants/media-file-types.d.ts

@@ -1,4 +1,5 @@
 export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
+export declare const MEDIA_CATEGORIES: readonly ["image", "audio", "video", "file", "pdf"];
 export declare const DANGEROUS_EXTENSIONS: Set<string>;
 export declare const DANGEROUS_MIME_TYPES: Set<string>;
 export declare function getLowercaseFileExtension(fileName?: string | null): string | undefined;

package/dist/constants/media-file-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAazE,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAEH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAWtF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}
+{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzE,eAAO,MAAM,gBAAgB,qDAAsD,CAAC;AAapF,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAEH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAWtF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}

package/dist/constants/media-file-types.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.INLINE_SAFE_EXTENSIONS = exports.EXT_TO_MEDIA_TYPE = exports.DANGEROUS_MIME_TYPES = exports.DANGEROUS_EXTENSIONS = void 0;
+exports.INLINE_SAFE_EXTENSIONS = exports.EXT_TO_MEDIA_TYPE = exports.DANGEROUS_MIME_TYPES = exports.DANGEROUS_EXTENSIONS = exports.MEDIA_CATEGORIES = void 0;
 exports.getLowercaseFileExtension = getLowercaseFileExtension;
 exports.getUploadedFileName = getUploadedFileName;
 exports.isDangerousMediaFile = isDangerousMediaFile;
+exports.MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'];
 const IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];
 const AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];
 const VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];