@solidxai/core 0.1.13-beta.14 → 0.1.13-beta.16

package/dist/constants/media-file-types.d.ts

@@ -2,7 +2,9 @@ export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
 export declare const MEDIA_CATEGORIES: readonly ["image", "audio", "video", "file", "pdf"];
 export declare const DANGEROUS_EXTENSIONS: Set<string>;
 export declare const DANGEROUS_MIME_TYPES: Set<string>;
+export declare function normalizeUploadedFileName(fileName?: string | null): string;
 export declare function getLowercaseFileExtension(fileName?: string | null): string | undefined;
+export declare function getLowercaseFileExtensionSegments(fileName?: string | null): string[];
 export interface UploadedFileLike {
     mimetype?: string;
     originalname?: string;

package/dist/constants/media-file-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzE,eAAO,MAAM,gBAAgB,qDAAsD,CAAC;AAapF,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAEH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAWtF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}
+{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzE,eAAO,MAAM,gBAAgB,qDAAsD,CAAC;AAapF,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAcH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAkB1E;AAOD,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAStF;AAWD,wBAAgB,iCAAiC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAGpF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}

package/dist/constants/media-file-types.js

@@ -1,7 +1,9 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.INLINE_SAFE_EXTENSIONS = exports.EXT_TO_MEDIA_TYPE = exports.DANGEROUS_MIME_TYPES = exports.DANGEROUS_EXTENSIONS = exports.MEDIA_CATEGORIES = void 0;
+exports.normalizeUploadedFileName = normalizeUploadedFileName;
 exports.getLowercaseFileExtension = getLowercaseFileExtension;
+exports.getLowercaseFileExtensionSegments = getLowercaseFileExtensionSegments;
 exports.getUploadedFileName = getUploadedFileName;
 exports.isDangerousMediaFile = isDangerousMediaFile;
 exports.MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'];
@@ -18,22 +20,39 @@ exports.DANGEROUS_EXTENSIONS = new Set([
 exports.DANGEROUS_MIME_TYPES = new Set([
     'image/svg+xml', 'text/html', 'application/xhtml+xml',
 ]);
-function getLowercaseFileExtension(fileName) {
+function normalizeUploadedFileName(fileName) {
     if (!fileName) {
-        return undefined;
+        return '';
+    }
+    let name = String(fileName).split(/[/\\]/).pop() ?? '';
+    const nulIndex = name.indexOf('\0');
+    if (nulIndex >= 0) {
+        name = name.slice(0, nulIndex);
+    }
+    const streamIndex = name.indexOf(':');
+    if (streamIndex >= 0) {
+        name = name.slice(0, streamIndex);
     }
-    const lastDotIndex = fileName.lastIndexOf('.');
-    if (lastDotIndex < 0 || lastDotIndex === fileName.length - 1) {
+    return name.replace(/[\s.]+$/, '');
+}
+function getLowercaseFileExtension(fileName) {
+    const name = normalizeUploadedFileName(fileName);
+    const lastDotIndex = name.lastIndexOf('.');
+    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {
         return undefined;
     }
-    return fileName.slice(lastDotIndex + 1).toLowerCase();
+    return name.slice(lastDotIndex + 1).toLowerCase();
+}
+function getLowercaseFileExtensionSegments(fileName) {
+    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');
+    return segments.slice(1).filter(segment => segment.length > 0);
 }
 function getUploadedFileName(file) {
     return file?.originalname ?? file?.filename ?? '';
 }
 function isDangerousMediaFile(file) {
-    const ext = getLowercaseFileExtension(getUploadedFileName(file));
-    if (ext && exports.DANGEROUS_EXTENSIONS.has(ext)) {
+    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));
+    if (segments.some(segment => exports.DANGEROUS_EXTENSIONS.has(segment))) {
         return true;
     }
     return exports.DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());

package/dist/constants/media-file-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-file-types.js","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":";;;AA+BA,8DAWC;AAUD,kDAEC;AAQD,oDAOC;AAnEY,QAAA,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAEpF,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9F,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,KAAK,CAAC;AAOf,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IACpC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACjD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACjD,CAAC,CAAC;AAQU,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,eAAe,EAAE,WAAW,EAAE,uBAAuB;CACxD,CAAC,CAAC;AAEH,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,MAAM,YAAY,GAAG,QAAQ,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC/C,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,KAAK,QAAQ,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QAC3D,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,QAAQ,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AAC1D,CAAC;AAUD,SAAgB,mBAAmB,CAAC,IAA8B;IAC9D,OAAO,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,CAAC;AAQD,SAAgB,oBAAoB,CAAC,IAA8B;IAC/D,MAAM,GAAG,GAAG,yBAAyB,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,IAAI,GAAG,IAAI,4BAAoB,CAAC,GAAG,CAAC,GAAG,CAAC,EAAE,CAAC;QACvC,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,4BAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AASY,QAAA,iBAAiB,GAAkC;IAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAe,CAAC,CAAC,CAAC;IAC/E,CAAC,aAAa,CAAC,EAAE,KAAK;CACzB,CAAC;AAMW,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,aAAa;CAChB,CAAC,CAAC","sourcesContent":["export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';\n\nexport const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;\n\nconst IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];\nconst AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];\nconst VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];\nconst DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];\nconst PDF_EXTENSION = 'pdf';\n\n/**\n * Extensions that must never be accepted as media uploads, regardless of declared mimetype or\n * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed\n * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.\n */\nexport const DANGEROUS_EXTENSIONS = new Set([\n    'html', 'htm', 'xhtml', 'svg', 'xml',\n    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',\n    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',\n]);\n\n\n/**\n * Mimetypes that are never safe to accept, regardless of extension. These render as active\n * content in a browser (svg can carry <script>), so they are rejected even when the filename\n * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.\n */\nexport const DANGEROUS_MIME_TYPES = new Set([\n    'image/svg+xml', 'text/html', 'application/xhtml+xml',\n]);\n\nexport function getLowercaseFileExtension(fileName?: string | null): string | undefined {\n    if (!fileName) {\n        return undefined;\n    }\n\n    const lastDotIndex = fileName.lastIndexOf('.');\n    if (lastDotIndex < 0 || lastDotIndex === fileName.length - 1) {\n        return undefined;\n    }\n\n    return fileName.slice(lastDotIndex + 1).toLowerCase();\n}\n\n/** Minimal shape of an uploaded file, so this module stays free of framework imports. */\nexport interface UploadedFileLike {\n    mimetype?: string;\n    originalname?: string;\n    filename?: string;\n}\n\n/** originalname is the client-supplied name; filename is multer's on-disk name. */\nexport function getUploadedFileName(file?: UploadedFileLike | null): string {\n    return file?.originalname ?? file?.filename ?? '';\n}\n\n/**\n * Single predicate for \"must never be stored\". Shared by every upload entry point\n * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.\n * Extension is checked before mimetype so a spoofed Content-Type (e.g.\n * application/octet-stream on an .html file) can't bypass it.\n */\nexport function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {\n    const ext = getLowercaseFileExtension(getUploadedFileName(file));\n    if (ext && DANGEROUS_EXTENSIONS.has(ext)) {\n        return true;\n    }\n\n    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());\n}\n\n/**\n * Single source of truth for extension -> coarse media category. Shared by upload-time\n * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so\n * both agree on which extensions belong to which category and neither drifts out of sync.\n * webm/ogg are shared between AUDIO_EXTENSIONS and VIDEO_EXTENSIONS - last one wins here, they\n * default to 'video' since that's the more common upload case.\n */\nexport const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {\n    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),\n    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),\n    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),\n    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),\n    [PDF_EXTENSION]: 'pdf',\n};\n\n/**\n * Extensions safe to serve inline with their natural Content-Type; everything else served from\n * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.\n */\nexport const INLINE_SAFE_EXTENSIONS = new Set<string>([\n    ...IMAGE_EXTENSIONS,\n    ...AUDIO_EXTENSIONS,\n    ...VIDEO_EXTENSIONS,\n    PDF_EXTENSION,\n]);\n"]}
+{"version":3,"file":"media-file-types.js","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":";;;AA2CA,8DAkBC;AAOD,8DASC;AAWD,8EAGC;AAUD,kDAEC;AAQD,oDAOC;AApHY,QAAA,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAEpF,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9F,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,KAAK,CAAC;AAOf,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IACpC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACjD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACjD,CAAC,CAAC;AAQU,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,eAAe,EAAE,WAAW,EAAE,uBAAuB;CACxD,CAAC,CAAC;AAcH,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAWD,SAAgB,iCAAiC,CAAC,QAAwB;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAUD,SAAgB,mBAAmB,CAAC,IAA8B;IAC9D,OAAO,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,CAAC;AAQD,SAAgB,oBAAoB,CAAC,IAA8B;IAC/D,MAAM,QAAQ,GAAG,iCAAiC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,4BAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,4BAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AASY,QAAA,iBAAiB,GAAkC;IAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAe,CAAC,CAAC,CAAC;IAC/E,CAAC,aAAa,CAAC,EAAE,KAAK;CACzB,CAAC;AAMW,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,aAAa;CAChB,CAAC,CAAC","sourcesContent":["export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';\n\nexport const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;\n\nconst IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];\nconst AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];\nconst VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];\nconst DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];\nconst PDF_EXTENSION = 'pdf';\n\n/**\n * Extensions that must never be accepted as media uploads, regardless of declared mimetype or\n * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed\n * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.\n */\nexport const DANGEROUS_EXTENSIONS = new Set([\n    'html', 'htm', 'xhtml', 'svg', 'xml',\n    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',\n    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',\n]);\n\n\n/**\n * Mimetypes that are never safe to accept, regardless of extension. These render as active\n * content in a browser (svg can carry <script>), so they are rejected even when the filename\n * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.\n */\nexport const DANGEROUS_MIME_TYPES = new Set([\n    'image/svg+xml', 'text/html', 'application/xhtml+xml',\n]);\n\n/**\n * Reduces a client-supplied name to the name that will actually be resolved on disk, so\n * extension checks can't be dodged by decorating it. Each step defends a known bypass:\n *\n *  - `../../evil.exe`      -> only the final path segment is the file name.\n *  - `evil.exe\\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so\n *                             anything after it is invisible to the OS but visible to naive\n *                             validation.\n *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.\n *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving\n *                             a path, so these land on disk as evil.exe.\n */\nexport function normalizeUploadedFileName(fileName?: string | null): string {\n    if (!fileName) {\n        return '';\n    }\n\n    let name = String(fileName).split(/[/\\\\]/).pop() ?? '';\n\n    const nulIndex = name.indexOf('\\0');\n    if (nulIndex >= 0) {\n        name = name.slice(0, nulIndex);\n    }\n\n    const streamIndex = name.indexOf(':');\n    if (streamIndex >= 0) {\n        name = name.slice(0, streamIndex);\n    }\n\n    return name.replace(/[\\s.]+$/, '');\n}\n\n/**\n * The effective extension - what the OS/browser will treat the file as. Used for media\n * category resolution and inline-safety decisions. Always normalizes first, so\n * `evil.exe.` resolves to `exe` rather than to nothing.\n */\nexport function getLowercaseFileExtension(fileName?: string | null): string | undefined {\n    const name = normalizeUploadedFileName(fileName);\n\n    const lastDotIndex = name.lastIndexOf('.');\n    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {\n        return undefined;\n    }\n\n    return name.slice(lastDotIndex + 1).toLowerCase();\n}\n\n/**\n * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather\n * than only the effective extension so a dangerous type buried in a double extension\n * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve\n * such names by an earlier segment than the last one.\n *\n * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)\n * isn't rejected.\n */\nexport function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {\n    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');\n    return segments.slice(1).filter(segment => segment.length > 0);\n}\n\n/** Minimal shape of an uploaded file, so this module stays free of framework imports. */\nexport interface UploadedFileLike {\n    mimetype?: string;\n    originalname?: string;\n    filename?: string;\n}\n\n/** originalname is the client-supplied name; filename is multer's on-disk name. */\nexport function getUploadedFileName(file?: UploadedFileLike | null): string {\n    return file?.originalname ?? file?.filename ?? '';\n}\n\n/**\n * Single predicate for \"must never be stored\". Shared by every upload entry point\n * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.\n * Extensions are checked before mimetype so a spoofed Content-Type (e.g.\n * application/octet-stream, or image/png, on an .html file) can't bypass it.\n */\nexport function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {\n    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));\n    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {\n        return true;\n    }\n\n    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());\n}\n\n/**\n * Single source of truth for extension -> coarse media category. Shared by upload-time\n * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so\n * both agree on which extensions belong to which category and neither drifts out of sync.\n * webm/ogg are shared between AUDIO_EXTENSIONS and VIDEO_EXTENSIONS - last one wins here, they\n * default to 'video' since that's the more common upload case.\n */\nexport const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {\n    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),\n    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),\n    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),\n    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),\n    [PDF_EXTENSION]: 'pdf',\n};\n\n/**\n * Extensions safe to serve inline with their natural Content-Type; everything else served from\n * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.\n */\nexport const INLINE_SAFE_EXTENSIONS = new Set<string>([\n    ...IMAGE_EXTENSIONS,\n    ...AUDIO_EXTENSIONS,\n    ...VIDEO_EXTENSIONS,\n    PDF_EXTENSION,\n]);\n"]}

package/dist/filters/http-exception.filter.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"http-exception.filter.d.ts","sourceRoot":"","sources":["../../src/filters/http-exception.filter.ts"],"names":[],"mappings":"AACA,OAAO,EACH,eAAe,EAEf,aAAa,EAIhB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,qBAEa,mBAAoB,YAAW,eAAe;IAG3C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAFxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;gBAElC,WAAW,EAAE,kBAAkB;IAI5D,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa;CA0C5C"}
+{"version":3,"file":"http-exception.filter.d.ts","sourceRoot":"","sources":["../../src/filters/http-exception.filter.ts"],"names":[],"mappings":"AACA,OAAO,EACH,eAAe,EAEf,aAAa,EAIhB,MAAM,gBAAgB,CAAC;AAGxB,OAAO,EAAE,kBAAkB,EAAE,MAAM,kCAAkC,CAAC;AAItE,qBAEa,mBAAoB,YAAW,eAAe;IAG3C,OAAO,CAAC,QAAQ,CAAC,WAAW;IAFxC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAwC;gBAElC,WAAW,EAAE,kBAAkB;IAI5D,KAAK,CAAC,SAAS,EAAE,GAAG,EAAE,IAAI,EAAE,aAAa;CAoD5C"}

package/dist/filters/http-exception.filter.js

@@ -26,10 +26,14 @@ let HttpExceptionFilter = HttpExceptionFilter_1 = class HttpExceptionFilter {
         const request = ctx.getRequest();
         const isHttp = exception instanceof common_1.HttpException;
         const explicitStatus = isHttp ? exception.getStatus() : undefined;
+        const rawStatus = exception?.status ?? exception?.statusCode;
+        const derivedStatus = typeof rawStatus === 'number' && rawStatus >= 400 && rawStatus < 600
+            ? rawStatus
+            : undefined;
         const code = this.errorMapper.mapException(exception);
         const defaultStatus = this.errorMapper.getHttpStatus(code);
         const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);
-        const status = explicitStatus ?? defaultStatus ?? 500;
+        const status = explicitStatus ?? derivedStatus ?? defaultStatus ?? 500;
         this.logger.error(`[${status} ${logging_interceptor_1.HttpStatusCodeMessages[status] || 'Internal Server Error'}] ${request?.method} ${request?.url} - ${exception?.message || message} [code=${code}]`);
         if (exception?.stack) {
             this.logger.error(exception.stack);

package/dist/filters/http-exception.filter.js.map

@@ -1 +1 @@
-{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../../src/filters/http-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,2CAOwB;AAExB,6EAA6E;AAC7E,0EAAsE;AAM/D,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAG5B,YAA6B,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;QAF3C,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAG3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAc,EAAE,IAAmB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAW,CAAC;QAE1C,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa,CAAC;QAClD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAGlE,MAAM,IAAI,GAAc,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAE9G,MAAM,MAAM,GAAG,cAAc,IAAI,aAAa,IAAI,GAAG,CAAC;QAGtD,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,IAAI,MAAM,IAAI,4CAAsB,CAAC,MAAM,CAAC,IAAI,uBAAuB,KAAK,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,OAAO,IAAI,OAAO,UAAU,IAAI,GAAG,CAClK,CAAC;QACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAGD,MAAM,KAAK,GACP,CAAC,MAAM,IAAK,SAAS,CAAC,WAAW,EAAE,EAAU,CAAC;YAC9C,SAAS,EAAE,QAAQ;YACnB,EAAE,CAAC;QAGP,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACzB,UAAU,EAAE,MAAM;YAClB,iBAAiB,EAAE,4CAAsB,CAAC,MAAM,CAAC,IAAI,uBAAuB;YAE5E,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,OAAO;YAGd,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AAjDY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,cAAK,GAAE;IACP,IAAA,mBAAU,GAAE;qCAIiC,yCAAkB;GAHnD,mBAAmB,CAiD/B","sourcesContent":["// src/common/filters/http-exception.filter.ts\nimport {\n    ExceptionFilter,\n    Catch,\n    ArgumentsHost,\n    Logger,\n    Injectable,\n    HttpException,\n} from '@nestjs/common';\nimport { Response, Request } from 'express';\nimport { HttpStatusCodeMessages } from '../interceptors/logging.interceptor';\nimport { ErrorMapperService } from 'src/helpers/error-mapper.service';\nimport { ErrorCode } from 'src/interfaces';\n\n\n@Catch()\n@Injectable()\nexport class HttpExceptionFilter implements ExceptionFilter {\n    private readonly logger = new Logger(HttpExceptionFilter.name);\n\n    constructor(private readonly errorMapper: ErrorMapperService) {\n        this.logger.debug('HttpExceptionFilter initialized');\n    }\n\n    catch(exception: any, host: ArgumentsHost) {\n        const ctx = host.switchToHttp();\n        const response = ctx.getResponse<Response>();\n        const request = ctx.getRequest<Request>();\n\n        const isHttp = exception instanceof HttpException;\n        const explicitStatus = isHttp ? exception.getStatus() : undefined;\n\n        // Canonical code + static message\n        const code: ErrorCode = this.errorMapper.mapException(exception);\n        const defaultStatus = this.errorMapper.getHttpStatus(code);\n        const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);\n\n        const status = explicitStatus ?? defaultStatus ?? 500;\n\n        // Logging\n        this.logger.error(\n            `[${status} ${HttpStatusCodeMessages[status] || 'Internal Server Error'}] ${request?.method} ${request?.url} - ${exception?.message || message} [code=${code}]`,\n        );\n        if (exception?.stack) {\n            this.logger.error(exception.stack);\n        }\n\n        // Preserve any extra data the exception carried (optional)\n        const extra =\n            (isHttp && (exception.getResponse?.() as any)) ??\n            exception?.response ??\n            {};\n\n        // Keep your legacy shape; add canonical code\n        response.status(status).json({\n            statusCode: status,\n            statusCodeMessage: HttpStatusCodeMessages[status] || 'Internal Server Error',\n            // Keeping this for backward compatibility..\n            message: message,\n            errorCode: code,\n            error: message,\n            // We can make this conditional based on whether we are running in prod mode or dev mode...\n            // errorStack: exception.stack,\n            data: extra,\n        });\n    }\n}"]}
+{"version":3,"file":"http-exception.filter.js","sourceRoot":"","sources":["../../src/filters/http-exception.filter.ts"],"names":[],"mappings":";;;;;;;;;;;;;AACA,2CAOwB;AAExB,6EAA6E;AAC7E,0EAAsE;AAM/D,IAAM,mBAAmB,2BAAzB,MAAM,mBAAmB;IAG5B,YAA6B,WAA+B;QAA/B,gBAAW,GAAX,WAAW,CAAoB;QAF3C,WAAM,GAAG,IAAI,eAAM,CAAC,qBAAmB,CAAC,IAAI,CAAC,CAAC;QAG3D,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,iCAAiC,CAAC,CAAC;IACzD,CAAC;IAED,KAAK,CAAC,SAAc,EAAE,IAAmB;QACrC,MAAM,GAAG,GAAG,IAAI,CAAC,YAAY,EAAE,CAAC;QAChC,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAY,CAAC;QAC7C,MAAM,OAAO,GAAG,GAAG,CAAC,UAAU,EAAW,CAAC;QAE1C,MAAM,MAAM,GAAG,SAAS,YAAY,sBAAa,CAAC;QAClD,MAAM,cAAc,GAAG,MAAM,CAAC,CAAC,CAAC,SAAS,CAAC,SAAS,EAAE,CAAC,CAAC,CAAC,SAAS,CAAC;QAIlE,MAAM,SAAS,GAAG,SAAS,EAAE,MAAM,IAAI,SAAS,EAAE,UAAU,CAAC;QAC7D,MAAM,aAAa,GACf,OAAO,SAAS,KAAK,QAAQ,IAAI,SAAS,IAAI,GAAG,IAAI,SAAS,GAAG,GAAG;YAChE,CAAC,CAAC,SAAS;YACX,CAAC,CAAC,SAAS,CAAC;QAGpB,MAAM,IAAI,GAAc,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,SAAS,CAAC,CAAC;QACjE,MAAM,aAAa,GAAG,IAAI,CAAC,WAAW,CAAC,aAAa,CAAC,IAAI,CAAC,CAAC;QAC3D,MAAM,OAAO,GAAG,IAAI,KAAK,sBAAsB,CAAC,CAAC,CAAC,GAAG,SAAS,EAAE,OAAO,EAAE,CAAC,CAAC,CAAC,IAAI,CAAC,WAAW,CAAC,UAAU,CAAC,IAAI,CAAC,CAAC;QAI9G,MAAM,MAAM,GAAG,cAAc,IAAI,aAAa,IAAI,aAAa,IAAI,GAAG,CAAC;QAGvE,IAAI,CAAC,MAAM,CAAC,KAAK,CACb,IAAI,MAAM,IAAI,4CAAsB,CAAC,MAAM,CAAC,IAAI,uBAAuB,KAAK,OAAO,EAAE,MAAM,IAAI,OAAO,EAAE,GAAG,MAAM,SAAS,EAAE,OAAO,IAAI,OAAO,UAAU,IAAI,GAAG,CAClK,CAAC;QACF,IAAI,SAAS,EAAE,KAAK,EAAE,CAAC;YACnB,IAAI,CAAC,MAAM,CAAC,KAAK,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;QACvC,CAAC;QAGD,MAAM,KAAK,GACP,CAAC,MAAM,IAAK,SAAS,CAAC,WAAW,EAAE,EAAU,CAAC;YAC9C,SAAS,EAAE,QAAQ;YACnB,EAAE,CAAC;QAGP,QAAQ,CAAC,MAAM,CAAC,MAAM,CAAC,CAAC,IAAI,CAAC;YACzB,UAAU,EAAE,MAAM;YAClB,iBAAiB,EAAE,4CAAsB,CAAC,MAAM,CAAC,IAAI,uBAAuB;YAE5E,OAAO,EAAE,OAAO;YAChB,SAAS,EAAE,IAAI;YACf,KAAK,EAAE,OAAO;YAGd,IAAI,EAAE,KAAK;SACd,CAAC,CAAC;IACP,CAAC;CACJ,CAAA;AA3DY,kDAAmB;8BAAnB,mBAAmB;IAF/B,IAAA,cAAK,GAAE;IACP,IAAA,mBAAU,GAAE;qCAIiC,yCAAkB;GAHnD,mBAAmB,CA2D/B","sourcesContent":["// src/common/filters/http-exception.filter.ts\nimport {\n    ExceptionFilter,\n    Catch,\n    ArgumentsHost,\n    Logger,\n    Injectable,\n    HttpException,\n} from '@nestjs/common';\nimport { Response, Request } from 'express';\nimport { HttpStatusCodeMessages } from '../interceptors/logging.interceptor';\nimport { ErrorMapperService } from 'src/helpers/error-mapper.service';\nimport { ErrorCode } from 'src/interfaces';\n\n\n@Catch()\n@Injectable()\nexport class HttpExceptionFilter implements ExceptionFilter {\n    private readonly logger = new Logger(HttpExceptionFilter.name);\n\n    constructor(private readonly errorMapper: ErrorMapperService) {\n        this.logger.debug('HttpExceptionFilter initialized');\n    }\n\n    catch(exception: any, host: ArgumentsHost) {\n        const ctx = host.switchToHttp();\n        const response = ctx.getResponse<Response>();\n        const request = ctx.getRequest<Request>();\n\n        const isHttp = exception instanceof HttpException;\n        const explicitStatus = isHttp ? exception.getStatus() : undefined;\n\n        // Errors from http-errors-style libraries (e.g. body-parser's PayloadTooLargeError)\n        // are plain Errors carrying their own status. Honour it rather than collapsing to 500.\n        const rawStatus = exception?.status ?? exception?.statusCode;\n        const derivedStatus =\n            typeof rawStatus === 'number' && rawStatus >= 400 && rawStatus < 600\n                ? rawStatus\n                : undefined;\n\n        // Canonical code + static message\n        const code: ErrorCode = this.errorMapper.mapException(exception);\n        const defaultStatus = this.errorMapper.getHttpStatus(code);\n        const message = code === 'solidx-unknown-error' ? `${exception?.message}` : this.errorMapper.getMessage(code);\n\n        // derivedStatus must precede defaultStatus: getHttpStatus() returns a hard 500\n        // for unmatched codes, so it is never undefined and would always win otherwise.\n        const status = explicitStatus ?? derivedStatus ?? defaultStatus ?? 500;\n\n        // Logging\n        this.logger.error(\n            `[${status} ${HttpStatusCodeMessages[status] || 'Internal Server Error'}] ${request?.method} ${request?.url} - ${exception?.message || message} [code=${code}]`,\n        );\n        if (exception?.stack) {\n            this.logger.error(exception.stack);\n        }\n\n        // Preserve any extra data the exception carried (optional)\n        const extra =\n            (isHttp && (exception.getResponse?.() as any)) ??\n            exception?.response ??\n            {};\n\n        // Keep your legacy shape; add canonical code\n        response.status(status).json({\n            statusCode: status,\n            statusCodeMessage: HttpStatusCodeMessages[status] || 'Internal Server Error',\n            // Keeping this for backward compatibility..\n            message: message,\n            errorCode: code,\n            error: message,\n            // We can make this conditional based on whether we are running in prod mode or dev mode...\n            // errorStack: exception.stack,\n            data: extra,\n        });\n    }\n}"]}

package/dist/helpers/bootstrap.helper.d.ts

@@ -1,3 +1,4 @@
+import { NestExpressApplication } from '@nestjs/platform-express';
 import { PermissionsPolicyConfig, SolidSecurityOptions } from './security.helper';
 export interface SolidSwaggerOptions {
     title?: string;
@@ -10,7 +11,8 @@ export interface SolidBootstrapOptions {
     permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;
     security?: SolidSecurityOptions;
     verboseBootstrap?: boolean;
+    bodyLimit?: string;
 }
-export declare function bootstrapSolidApp(appModuleFactory: () => Promise<any>, options?: SolidBootstrapOptions): Promise<void>;
+export declare function bootstrapSolidApp(appModuleFactory: () => Promise<any>, options?: SolidBootstrapOptions): Promise<NestExpressApplication>;
 export declare function bootstrapSolidCli(appModuleFactory: () => Promise<any>): Promise<void>;
 //# sourceMappingURL=bootstrap.helper.d.ts.map

package/dist/helpers/bootstrap.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":"AAcA,OAAO,EAGL,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAyB3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IAEpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC,0BAA0B,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC,gBAAgB,CAAC,EAAE,OAAO,CAAC;CAC5B;AAeD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,IAAI,CAAC,CAoIf;AAgBD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwCf"}
+{"version":3,"file":"bootstrap.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAalE,OAAO,EAGL,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAyB3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IAEpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC,0BAA0B,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAM3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAgJjC;AAgBD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/helpers/bootstrap.helper.js

@@ -36,10 +36,11 @@ function registerGlobalProcessHandlers() {
 }
 async function bootstrapSolidApp(appModuleFactory, options = {}) {
     registerGlobalProcessHandlers();
-    const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, } = options;
+    const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, bodyLimit = '25mb', } = options;
     const startTime = Date.now();
     const appModule = await appModuleFactory();
     const app = await core_1.NestFactory.create(appModule, {
+        bodyParser: false,
         logger: nest_winston_1.WinstonModule.createLogger({ ...(0, winston_logger_1.createWinstonLoggerConfig)(), level: verboseBootstrap ? 'debug' : 'error' }),
     });
     const apiEnabled = (0, environment_helper_1.parseBooleanEnv)('API_ENABLED', true);
@@ -48,7 +49,7 @@ async function bootstrapSolidApp(appModuleFactory, options = {}) {
         app
             .get(nest_winston_1.WINSTON_MODULE_NEST_PROVIDER)
             .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');
-        return;
+        return app;
     }
     const server = app.getHttpAdapter().getInstance();
     server.get('/', (_req, res) => res.status(200).send('SOLID OK'));
@@ -82,6 +83,8 @@ async function bootstrapSolidApp(appModuleFactory, options = {}) {
         }
         next();
     });
+    app.useBodyParser('json', { limit: bodyLimit });
+    app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });
     app.useGlobalPipes(new common_1.ValidationPipe({
         transform: true,
         transformOptions: { enableImplicitConversion: true },
@@ -116,6 +119,7 @@ async function bootstrapSolidApp(appModuleFactory, options = {}) {
     app.useLogger(app.get(nest_winston_1.WINSTON_MODULE_NEST_PROVIDER));
     const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);
     process.stdout.write(`\x1b[32mServer started on port ${port} in ${elapsed}s\x1b[0m\n`);
+    return app;
 }
 async function bootstrapSolidCli(appModuleFactory) {
     registerGlobalProcessHandlers();

package/dist/helpers/bootstrap.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.helper.js","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":";;;;;AA4EA,8CAuIC;AAgBD,8CA0CC;AA7QD,2CAA4E;AAC5E,uCAAsD;AACtD,qDAAgD;AAChD,6CAAiE;AAEjE,oDAA4B;AAC5B,4CAAoB;AACpB,2BAAgC;AAChC,+BAA+B;AAC/B,+CAA2E;AAC3E,mDAAgD;AAChD,sDAA8D;AAC9D,yFAAoF;AACpF,+CAAwD;AACxD,uDAK2B;AAC3B,6DAAuD;AAIvD,SAAS,6BAA6B;IACpC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAGH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClI,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AAoCM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC,EACpC,UAAiC,EAAE;IAEnC,6BAA6B,EAAE,CAAC;IAEhC,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,OAAO,GAAG,EAAE,EACZ,0BAA0B,GAAG,EAAE,EAC/B,QAAQ,GAAG,EAAE,EACb,gBAAgB,GAAG,KAAK,GACzB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAC,SAAS,EAAE;QAC9C,MAAM,EAAE,4BAAa,CAAC,YAAY,CAAC,EAAE,GAAG,IAAA,0CAAyB,GAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KACpH,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAA,oCAAe,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG;aACA,GAAG,CAAC,2CAA4B,CAAC;aACjC,GAAG,CAAC,kEAAkE,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO;IACT,CAAC;IAGD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAGjE,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,IAAA,mDAAiC,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAG7D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,KAAK,OAAO;QAChB,IAAI,KAAK,QAAQ;QACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,YAAY,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAGH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAA,8CAA4B,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC9F,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;IAEtC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAGD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,GAAG,YAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAGH,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE;KACrD,CAAC,CACH,CAAC;IAGF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QACzH,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,KAAK,CAAC;aACf,cAAc,CAAC,WAAW,CAAC;aAC3B,UAAU,CAAC,OAAO,CAAC;aACnB,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;aAClD,aAAa,CACZ;YACE,WAAW,EAAE,sDAAsD;YACnE,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,QAAQ;SACb,EACD,KAAK,CACN;aACA,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,uBAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAGD,GAAG,CAAC,qBAAqB,CACvB,IAAI,mCAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAS,CAAC,EAAE;QACjD,wBAAwB,EAAE,IAAI;KAE/B,CAAC,EACF,IAAI,mDAAuB,EAAE,CAC9B,CAAC;IAGF,GAAG,CAAC,UAAU,CAAC,IAAA,qCAAuB,GAAE,CAAC,CAAC;IAI1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAClC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,2CAA4B,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,OAAO,OAAO,YAAY,CAAC,CAAC;AACzF,CAAC;AAgBM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC;IAEpC,6BAA6B,EAAE,CAAC;IAEhC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,eAAe,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAGvC,MAAM,GAAG,GAAG,MAAM,+BAAc,CAAC,oBAAoB,CAAC,SAAS,EAAE;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;KACjF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,+BAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';\nimport { NestFactory, Reflector } from '@nestjs/core';\nimport { WsAdapter } from '@nestjs/platform-ws';\nimport { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';\nimport { NextFunction, Request, Response } from 'express';\nimport helmet from 'helmet';\nimport qs from 'qs';\nimport { existsSync } from 'fs';\nimport { resolve } from 'path';\nimport { WINSTON_MODULE_NEST_PROVIDER, WinstonModule } from 'nest-winston';\nimport { CommandFactory } from 'nest-commander';\nimport { createWinstonLoggerConfig } from '../winston.logger';\nimport { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';\nimport { buildDefaultCorsOptions } from './cors.helper';\nimport {\n  buildDefaultSecurityHeaderOptions,\n  buildPermissionsPolicyHeader,\n  PermissionsPolicyConfig,\n  SolidSecurityOptions,\n} from './security.helper';\nimport { parseBooleanEnv } from './environment.helper';\n\n// ---- Shared process handlers ----\n\nfunction registerGlobalProcessHandlers() {\n  process.on('unhandledRejection', (reason, promise) => {\n    console.error('Unhandled Rejection at:', promise, 'reason:', reason);\n  });\n\n  process.on('uncaughtException', (err) => {\n    console.error('Uncaught Exception thrown:', err);\n  });\n\n  // Suppress pg deprecation warning caused by TypeORM's internal query scheduling\n  process.on('warning', (warning) => {\n    if (warning.name === 'DeprecationWarning' && (warning.message.includes('client.query()') || warning.message.includes('punycode'))) {\n      return;\n    }\n    console.warn(warning);\n  });\n}\n\n// ---- HTTP server bootstrap ----\n\nexport interface SolidSwaggerOptions {\n  title?: string;\n  description?: string;\n  version?: string;\n}\n\nexport interface SolidBootstrapOptions {\n  /** Global API prefix. Defaults to 'api'. Set to '' to disable. */\n  globalPrefix?: string;\n  /** Swagger configuration. Set to false to disable Swagger entirely. */\n  swagger?: SolidSwaggerOptions | false;\n  /** Permissions-Policy header overrides (merged with defaults). */\n  permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;\n  /** Security header overrides, including iframe frame-ancestor allowlists. */\n  security?: SolidSecurityOptions;\n  /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */\n  verboseBootstrap?: boolean;\n}\n\n/**\n * Bootstraps a SolidX NestJS HTTP application with sensible defaults:\n * security headers, CORS, Winston logger, ValidationPipe,\n * WrapResponseInterceptor, qs deep query parsing, Swagger, and the\n * pg BIGINT type parser.\n *\n * @example\n * // main.ts\n * bootstrapSolidApp(() => AppModule.forRoot(), {\n *   swagger: { title: 'My API', description: 'My API description' },\n *   security: { frameAncestors: [\"'self'\", 'https://portal.example.com'] },\n * });\n */\nexport async function bootstrapSolidApp(\n  appModuleFactory: () => Promise<any>,\n  options: SolidBootstrapOptions = {},\n): Promise<void> {\n  registerGlobalProcessHandlers();\n\n  const {\n    globalPrefix = 'api',\n    swagger = {},\n    permissionsPolicyOverrides = {},\n    security = {},\n    verboseBootstrap = false,\n  } = options;\n\n  const startTime = Date.now();\n  const appModule = await appModuleFactory();\n  const app = await NestFactory.create(appModule, {\n    logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),\n  });\n\n  const apiEnabled = parseBooleanEnv('API_ENABLED', true);\n\n  if (!apiEnabled) {\n    await app.init();\n    app\n      .get(WINSTON_MODULE_NEST_PROVIDER)\n      .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');\n    return;\n  }\n\n  // Health check at root path\n  const server = app.getHttpAdapter().getInstance();\n  server.get('/', (_req, res) => res.status(200).send('SOLID OK'));\n\n  // Security headers\n  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));\n\n  // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.\n  const isSwaggerPath = (path: string) =>\n    path === '/docs' ||\n    path === '/docs/' ||\n    path.startsWith('/docs/') ||\n    path === '/docs-json' ||\n    path === '/docs-yaml';\n\n  app.use((req: Request, res: Response, next: NextFunction) => {\n    if (isSwaggerPath(req.path)) {\n      res.removeHeader('Content-Security-Policy');\n    }\n    next();\n  });\n\n  // Permissions-Policy header\n  app.use((_req: Request, res: Response, next: NextFunction) => {\n    res.setHeader('Permissions-Policy', buildPermissionsPolicyHeader(permissionsPolicyOverrides));\n    next();\n  });\n\n  const port = process.env.PORT || 3000;\n\n  if (globalPrefix) {\n    app.setGlobalPrefix(globalPrefix);\n  }\n\n  // qs-based deep query parsing (dot notation, nested objects, arrays)\n  app.use((req: Request, _res: Response, next: NextFunction) => {\n    if (req.query) {\n      req.query = qs.parse(req.url.split('?')[1], {\n        allowDots: true,\n        depth: 20,\n        arrayLimit: 100,\n      });\n    }\n    next();\n  });\n\n  // Global ValidationPipe\n  app.useGlobalPipes(\n    new ValidationPipe({\n      transform: true,\n      transformOptions: { enableImplicitConversion: true },\n    }),\n  );\n\n  // Swagger\n  if (swagger !== false) {\n    const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger;\n    const swaggerConfig = new DocumentBuilder()\n      .setTitle(title)\n      .setDescription(description)\n      .setVersion(version)\n      .setExternalDoc('Postman Collection', '/docs-json')\n      .addBearerAuth(\n        {\n          description: 'Please enter token in following format: Bearer <JWT>',\n          name: 'Authorization',\n          bearerFormat: 'Bearer',\n          scheme: 'Bearer',\n          type: 'http',\n          in: 'Header',\n        },\n        'jwt',\n      )\n      .build();\n    const document = SwaggerModule.createDocument(app, swaggerConfig);\n    SwaggerModule.setup('/docs', app, document);\n  }\n\n  // Global interceptor\n  app.useGlobalInterceptors(\n    new ClassSerializerInterceptor(app.get(Reflector), {\n      enableImplicitConversion: true, // optional but handy\n      // groups: ['client'], // if you use groups\n    }),\n    new WrapResponseInterceptor()\n  );\n\n  // CORS\n  app.enableCors(buildDefaultCorsOptions());\n\n  // Fix pg returning BIGINT columns as strings\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  const types = require('pg').types;\n  types.setTypeParser(types.builtins.INT8, (val: string) => parseInt(val));\n\n  app.useWebSocketAdapter(new WsAdapter(app));\n\n  await app.listen(port);\n\n  // Wire up Winston as the runtime logger only AFTER listen — this suppresses all\n  // framework init noise (route mapping, module deps, onModuleInit) during boot.\n  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));\n\n  const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);\n  process.stdout.write(`\\x1b[32mServer started on port ${port} in ${elapsed}s\\x1b[0m\\n`);\n}\n\n// ---- CLI bootstrap ----\n\n/**\n * Bootstraps a SolidX NestJS CLI application using nest-commander.\n * Handles verbose flag stripping, project root validation, and clean process exit.\n *\n * @example\n * // main-cli.ts\n * #!/usr/bin/env node\n * import { bootstrapSolidCli } from '@solidxai/core';\n * import { AppModule } from './app.module';\n *\n * bootstrapSolidCli(() => AppModule.forRoot());\n */\nexport async function bootstrapSolidCli(\n  appModuleFactory: () => Promise<any>,\n): Promise<void> {\n  registerGlobalProcessHandlers();\n\n  process.on('exit', (code) => {\n    if (code !== 0) {\n      console.error(`Exiting with error status code: ${code}`);\n    }\n  });\n\n  // Validate that cwd is a valid Solid API project\n  const packageJsonPath = resolve(process.cwd(), 'package.json');\n  if (!existsSync(packageJsonPath)) {\n    console.error('Does not seem to be a valid solid-api project.');\n    console.error('Exit reason: missing package.json in the current directory.');\n    process.exit(1);\n  }\n\n  // Strip --verbose / -v before nest-commander processes argv\n  const showLogs = process.argv.includes('--verbose') || process.argv.includes('-v');\n  for (const flag of ['--verbose', '-v']) {\n    const idx = process.argv.indexOf(flag);\n    if (idx !== -1) process.argv.splice(idx, 1);\n  }\n\n  const appModule = await appModuleFactory();\n  process.env.SOLID_CLI_RUNNING = 'true';\n\n  // @ts-ignore\n  const app = await CommandFactory.createWithoutRunning(appModule, {\n    logger: showLogs ? ['debug', 'error', 'fatal', 'log', 'verbose', 'warn'] : false,\n  });\n\n  try {\n    await CommandFactory.runApplication(app);\n  } catch (e) {\n    console.error('CLI exited abruptly due to an error:', e);\n    process.exit(1);\n  }\n\n  process.exit(0);\n}\n"]}
+{"version":3,"file":"bootstrap.helper.js","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":";;;;;AAmFA,8CAmJC;AAgBD,8CA0CC;AAhSD,2CAA4E;AAC5E,uCAAsD;AAEtD,qDAAgD;AAChD,6CAAiE;AAEjE,oDAA4B;AAC5B,4CAAoB;AACpB,2BAAgC;AAChC,+BAA+B;AAC/B,+CAA2E;AAC3E,mDAAgD;AAChD,sDAA8D;AAC9D,yFAAoF;AACpF,+CAAwD;AACxD,uDAK2B;AAC3B,6DAAuD;AAIvD,SAAS,6BAA6B;IACpC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAGH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClI,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AA0CM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC,EACpC,UAAiC,EAAE;IAEnC,6BAA6B,EAAE,CAAC;IAEhC,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,OAAO,GAAG,EAAE,EACZ,0BAA0B,GAAG,EAAE,EAC/B,QAAQ,GAAG,EAAE,EACb,gBAAgB,GAAG,KAAK,EACxB,SAAS,GAAG,MAAM,GACnB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAyB,SAAS,EAAE;QAGtE,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,4BAAa,CAAC,YAAY,CAAC,EAAE,GAAG,IAAA,0CAAyB,GAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KACpH,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAA,oCAAe,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG;aACA,GAAG,CAAC,2CAA4B,CAAC;aACjC,GAAG,CAAC,kEAAkE,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAGjE,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,IAAA,mDAAiC,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAG7D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,KAAK,OAAO;QAChB,IAAI,KAAK,QAAQ;QACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,YAAY,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAGH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAA,8CAA4B,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC9F,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;IAEtC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAGD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,GAAG,YAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAKH,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAGtE,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE;KACrD,CAAC,CACH,CAAC;IAGF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QACzH,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,KAAK,CAAC;aACf,cAAc,CAAC,WAAW,CAAC;aAC3B,UAAU,CAAC,OAAO,CAAC;aACnB,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;aAClD,aAAa,CACZ;YACE,WAAW,EAAE,sDAAsD;YACnE,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,QAAQ;SACb,EACD,KAAK,CACN;aACA,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,uBAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAGD,GAAG,CAAC,qBAAqB,CACvB,IAAI,mCAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAS,CAAC,EAAE;QACjD,wBAAwB,EAAE,IAAI;KAE/B,CAAC,EACF,IAAI,mDAAuB,EAAE,CAC9B,CAAC;IAGF,GAAG,CAAC,UAAU,CAAC,IAAA,qCAAuB,GAAE,CAAC,CAAC;IAI1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAClC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,2CAA4B,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,OAAO,OAAO,YAAY,CAAC,CAAC;IAEvF,OAAO,GAAG,CAAC;AACb,CAAC;AAgBM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC;IAEpC,6BAA6B,EAAE,CAAC;IAEhC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,eAAe,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAGvC,MAAM,GAAG,GAAG,MAAM,+BAAc,CAAC,oBAAoB,CAAC,SAAS,EAAE;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;KACjF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,+BAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';\nimport { NestFactory, Reflector } from '@nestjs/core';\nimport { NestExpressApplication } from '@nestjs/platform-express';\nimport { WsAdapter } from '@nestjs/platform-ws';\nimport { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';\nimport { NextFunction, Request, Response } from 'express';\nimport helmet from 'helmet';\nimport qs from 'qs';\nimport { existsSync } from 'fs';\nimport { resolve } from 'path';\nimport { WINSTON_MODULE_NEST_PROVIDER, WinstonModule } from 'nest-winston';\nimport { CommandFactory } from 'nest-commander';\nimport { createWinstonLoggerConfig } from '../winston.logger';\nimport { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';\nimport { buildDefaultCorsOptions } from './cors.helper';\nimport {\n  buildDefaultSecurityHeaderOptions,\n  buildPermissionsPolicyHeader,\n  PermissionsPolicyConfig,\n  SolidSecurityOptions,\n} from './security.helper';\nimport { parseBooleanEnv } from './environment.helper';\n\n// ---- Shared process handlers ----\n\nfunction registerGlobalProcessHandlers() {\n  process.on('unhandledRejection', (reason, promise) => {\n    console.error('Unhandled Rejection at:', promise, 'reason:', reason);\n  });\n\n  process.on('uncaughtException', (err) => {\n    console.error('Uncaught Exception thrown:', err);\n  });\n\n  // Suppress pg deprecation warning caused by TypeORM's internal query scheduling\n  process.on('warning', (warning) => {\n    if (warning.name === 'DeprecationWarning' && (warning.message.includes('client.query()') || warning.message.includes('punycode'))) {\n      return;\n    }\n    console.warn(warning);\n  });\n}\n\n// ---- HTTP server bootstrap ----\n\nexport interface SolidSwaggerOptions {\n  title?: string;\n  description?: string;\n  version?: string;\n}\n\nexport interface SolidBootstrapOptions {\n  /** Global API prefix. Defaults to 'api'. Set to '' to disable. */\n  globalPrefix?: string;\n  /** Swagger configuration. Set to false to disable Swagger entirely. */\n  swagger?: SolidSwaggerOptions | false;\n  /** Permissions-Policy header overrides (merged with defaults). */\n  permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;\n  /** Security header overrides, including iframe frame-ancestor allowlists. */\n  security?: SolidSecurityOptions;\n  /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */\n  verboseBootstrap?: boolean;\n  /**\n   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible\n   * string (e.g. '25mb', '512kb'). Defaults to '25mb'.\n   * Note: does not apply to multipart uploads — those are governed by Multer.\n   */\n  bodyLimit?: string;\n}\n\n/**\n * Bootstraps a SolidX NestJS HTTP application with sensible defaults:\n * security headers, CORS, Winston logger, ValidationPipe,\n * WrapResponseInterceptor, qs deep query parsing, Swagger, and the\n * pg BIGINT type parser.\n *\n * @example\n * // main.ts\n * bootstrapSolidApp(() => AppModule.forRoot(), {\n *   swagger: { title: 'My API', description: 'My API description' },\n *   security: { frameAncestors: [\"'self'\", 'https://portal.example.com'] },\n * });\n */\nexport async function bootstrapSolidApp(\n  appModuleFactory: () => Promise<any>,\n  options: SolidBootstrapOptions = {},\n): Promise<NestExpressApplication> {\n  registerGlobalProcessHandlers();\n\n  const {\n    globalPrefix = 'api',\n    swagger = {},\n    permissionsPolicyOverrides = {},\n    security = {},\n    verboseBootstrap = false,\n    bodyLimit = '25mb',\n  } = options;\n\n  const startTime = Date.now();\n  const appModule = await appModuleFactory();\n  const app = await NestFactory.create<NestExpressApplication>(appModule, {\n    // Nest's default parsers are registered during init() with a 100kb limit, ahead of\n    // any module middleware. Disable them so the parsers below own the limit outright.\n    bodyParser: false,\n    logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),\n  });\n\n  const apiEnabled = parseBooleanEnv('API_ENABLED', true);\n\n  if (!apiEnabled) {\n    await app.init();\n    app\n      .get(WINSTON_MODULE_NEST_PROVIDER)\n      .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');\n    return app;\n  }\n\n  // Health check at root path\n  const server = app.getHttpAdapter().getInstance();\n  server.get('/', (_req, res) => res.status(200).send('SOLID OK'));\n\n  // Security headers\n  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));\n\n  // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.\n  const isSwaggerPath = (path: string) =>\n    path === '/docs' ||\n    path === '/docs/' ||\n    path.startsWith('/docs/') ||\n    path === '/docs-json' ||\n    path === '/docs-yaml';\n\n  app.use((req: Request, res: Response, next: NextFunction) => {\n    if (isSwaggerPath(req.path)) {\n      res.removeHeader('Content-Security-Policy');\n    }\n    next();\n  });\n\n  // Permissions-Policy header\n  app.use((_req: Request, res: Response, next: NextFunction) => {\n    res.setHeader('Permissions-Policy', buildPermissionsPolicyHeader(permissionsPolicyOverrides));\n    next();\n  });\n\n  const port = process.env.PORT || 3000;\n\n  if (globalPrefix) {\n    app.setGlobalPrefix(globalPrefix);\n  }\n\n  // qs-based deep query parsing (dot notation, nested objects, arrays)\n  app.use((req: Request, _res: Response, next: NextFunction) => {\n    if (req.query) {\n      req.query = qs.parse(req.url.split('?')[1], {\n        allowDots: true,\n        depth: 20,\n        arrayLimit: 100,\n      });\n    }\n    next();\n  });\n\n  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).\n  // Registered here so the middleware order Nest applied by default is preserved:\n  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.\n  app.useBodyParser('json', { limit: bodyLimit });\n  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });\n\n  // Global ValidationPipe\n  app.useGlobalPipes(\n    new ValidationPipe({\n      transform: true,\n      transformOptions: { enableImplicitConversion: true },\n    }),\n  );\n\n  // Swagger\n  if (swagger !== false) {\n    const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger;\n    const swaggerConfig = new DocumentBuilder()\n      .setTitle(title)\n      .setDescription(description)\n      .setVersion(version)\n      .setExternalDoc('Postman Collection', '/docs-json')\n      .addBearerAuth(\n        {\n          description: 'Please enter token in following format: Bearer <JWT>',\n          name: 'Authorization',\n          bearerFormat: 'Bearer',\n          scheme: 'Bearer',\n          type: 'http',\n          in: 'Header',\n        },\n        'jwt',\n      )\n      .build();\n    const document = SwaggerModule.createDocument(app, swaggerConfig);\n    SwaggerModule.setup('/docs', app, document);\n  }\n\n  // Global interceptor\n  app.useGlobalInterceptors(\n    new ClassSerializerInterceptor(app.get(Reflector), {\n      enableImplicitConversion: true, // optional but handy\n      // groups: ['client'], // if you use groups\n    }),\n    new WrapResponseInterceptor()\n  );\n\n  // CORS\n  app.enableCors(buildDefaultCorsOptions());\n\n  // Fix pg returning BIGINT columns as strings\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  const types = require('pg').types;\n  types.setTypeParser(types.builtins.INT8, (val: string) => parseInt(val));\n\n  app.useWebSocketAdapter(new WsAdapter(app));\n\n  await app.listen(port);\n\n  // Wire up Winston as the runtime logger only AFTER listen — this suppresses all\n  // framework init noise (route mapping, module deps, onModuleInit) during boot.\n  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));\n\n  const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);\n  process.stdout.write(`\\x1b[32mServer started on port ${port} in ${elapsed}s\\x1b[0m\\n`);\n\n  return app;\n}\n\n// ---- CLI bootstrap ----\n\n/**\n * Bootstraps a SolidX NestJS CLI application using nest-commander.\n * Handles verbose flag stripping, project root validation, and clean process exit.\n *\n * @example\n * // main-cli.ts\n * #!/usr/bin/env node\n * import { bootstrapSolidCli } from '@solidxai/core';\n * import { AppModule } from './app.module';\n *\n * bootstrapSolidCli(() => AppModule.forRoot());\n */\nexport async function bootstrapSolidCli(\n  appModuleFactory: () => Promise<any>,\n): Promise<void> {\n  registerGlobalProcessHandlers();\n\n  process.on('exit', (code) => {\n    if (code !== 0) {\n      console.error(`Exiting with error status code: ${code}`);\n    }\n  });\n\n  // Validate that cwd is a valid Solid API project\n  const packageJsonPath = resolve(process.cwd(), 'package.json');\n  if (!existsSync(packageJsonPath)) {\n    console.error('Does not seem to be a valid solid-api project.');\n    console.error('Exit reason: missing package.json in the current directory.');\n    process.exit(1);\n  }\n\n  // Strip --verbose / -v before nest-commander processes argv\n  const showLogs = process.argv.includes('--verbose') || process.argv.includes('-v');\n  for (const flag of ['--verbose', '-v']) {\n    const idx = process.argv.indexOf(flag);\n    if (idx !== -1) process.argv.splice(idx, 1);\n  }\n\n  const appModule = await appModuleFactory();\n  process.env.SOLID_CLI_RUNNING = 'true';\n\n  // @ts-ignore\n  const app = await CommandFactory.createWithoutRunning(appModule, {\n    logger: showLogs ? ['debug', 'error', 'fatal', 'log', 'verbose', 'warn'] : false,\n  });\n\n  try {\n    await CommandFactory.runApplication(app);\n  } catch (e) {\n    console.error('CLI exited abruptly due to an error:', e);\n    process.exit(1);\n  }\n\n  process.exit(0);\n}\n"]}

package/dist/helpers/file-download.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"file-download.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/file-download.helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IAEjB,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAEtC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAMD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAe9F"}
+{"version":3,"file":"file-download.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/file-download.helper.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,MAAM,WAAW,yBAAyB;IACxC,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IAEjB,WAAW,CAAC,EAAE,QAAQ,GAAG,YAAY,CAAC;IAEtC,yBAAyB,CAAC,EAAE,OAAO,CAAC;CACrC;AAoBD,wBAAgB,sBAAsB,CAAC,GAAG,EAAE,QAAQ,EAAE,OAAO,EAAE,yBAAyB,GAAG,IAAI,CAe9F"}

package/dist/helpers/file-download.helper.js

@@ -1,9 +1,14 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.setFileDownloadHeaders = setFileDownloadHeaders;
+function buildContentDisposition(disposition, fileName) {
+    const name = (fileName || "file").replace(/[\r\n]/g, "");
+    const asciiFallback = name.replace(/[^\x20-\x7E]/g, "_").replace(/["\\]/g, "_") || "file";
+    return `${disposition}; filename="${asciiFallback}"; filename*=UTF-8''${encodeURIComponent(name)}`;
+}
 function setFileDownloadHeaders(res, options) {
     const disposition = options.disposition ?? "attachment";
-    res.setHeader("Content-Disposition", `${disposition}; filename="${options.fileName}"`);
+    res.setHeader("Content-Disposition", buildContentDisposition(disposition, options.fileName));
     res.setHeader("Content-Type", options.mimeType);
     res.setHeader("Access-Control-Expose-Headers", "Content-Disposition, Content-Type");
     res.setHeader("X-Content-Type-Options", "nosniff");

package/dist/helpers/file-download.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"file-download.helper.js","sourceRoot":"","sources":["../../src/helpers/file-download.helper.ts"],"names":[],"mappings":";;AAeA,wDAeC;AAfD,SAAgB,sBAAsB,CAAC,GAAa,EAAE,OAAkC;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IAExD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,GAAG,WAAW,eAAe,OAAO,CAAC,QAAQ,GAAG,CAAC,CAAC;IACvF,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;IAKpF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;QACtC,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;AACH,CAAC","sourcesContent":["import type { Response } from \"express\";\n\nexport interface FileDownloadHeaderOptions {\n  fileName: string;\n  mimeType: string;\n  /** Defaults to 'attachment'; only pass 'inline' for types known safe to render. */\n  disposition?: \"inline\" | \"attachment\";\n  /** Opt in for assets loaded cross-origin by the UI (e.g. media served to :3000). */\n  crossOriginResourcePolicy?: boolean;\n}\n\n/**\n * Single place that stamps the response headers for every streamed file download, so the\n * security headers can't be applied to one endpoint and forgotten on the next.\n */\nexport function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {\n  const disposition = options.disposition ?? \"attachment\";\n\n  res.setHeader(\"Content-Disposition\", `${disposition}; filename=\"${options.fileName}\"`);\n  res.setHeader(\"Content-Type\", options.mimeType);\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Content-Disposition, Content-Type\");\n\n  // Prevent the browser from ever content-sniffing a served file into something more\n  // dangerous than its declared Content-Type (e.g. rendering a mislabeled upload as HTML\n  // and executing embedded script).\n  res.setHeader(\"X-Content-Type-Options\", \"nosniff\");\n\n  if (options.crossOriginResourcePolicy) {\n    res.setHeader(\"Cross-Origin-Resource-Policy\", \"cross-origin\");\n  }\n}\n"]}
+{"version":3,"file":"file-download.helper.js","sourceRoot":"","sources":["../../src/helpers/file-download.helper.ts"],"names":[],"mappings":";;AA6BA,wDAeC;AA1BD,SAAS,uBAAuB,CAAC,WAAoC,EAAE,QAAgB;IACrF,MAAM,IAAI,GAAG,CAAC,QAAQ,IAAI,MAAM,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;IACzD,MAAM,aAAa,GAAG,IAAI,CAAC,OAAO,CAAC,eAAe,EAAE,GAAG,CAAC,CAAC,OAAO,CAAC,QAAQ,EAAE,GAAG,CAAC,IAAI,MAAM,CAAC;IAE1F,OAAO,GAAG,WAAW,eAAe,aAAa,uBAAuB,kBAAkB,CAAC,IAAI,CAAC,EAAE,CAAC;AACrG,CAAC;AAMD,SAAgB,sBAAsB,CAAC,GAAa,EAAE,OAAkC;IACtF,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,YAAY,CAAC;IAExD,GAAG,CAAC,SAAS,CAAC,qBAAqB,EAAE,uBAAuB,CAAC,WAAW,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC;IAC7F,GAAG,CAAC,SAAS,CAAC,cAAc,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC;IAChD,GAAG,CAAC,SAAS,CAAC,+BAA+B,EAAE,mCAAmC,CAAC,CAAC;IAKpF,GAAG,CAAC,SAAS,CAAC,wBAAwB,EAAE,SAAS,CAAC,CAAC;IAEnD,IAAI,OAAO,CAAC,yBAAyB,EAAE,CAAC;QACtC,GAAG,CAAC,SAAS,CAAC,8BAA8B,EAAE,cAAc,CAAC,CAAC;IAChE,CAAC;AACH,CAAC","sourcesContent":["import type { Response } from \"express\";\n\nexport interface FileDownloadHeaderOptions {\n  fileName: string;\n  mimeType: string;\n  /** Defaults to 'attachment'; only pass 'inline' for types known safe to render. */\n  disposition?: \"inline\" | \"attachment\";\n  /** Opt in for assets loaded cross-origin by the UI (e.g. media served to :3000). */\n  crossOriginResourcePolicy?: boolean;\n}\n\n/**\n * Builds an RFC 6266 Content-Disposition value. The file name is attacker-controlled (it comes\n * from the uploaded originalFileName), so it can't be interpolated raw: a quote would close the\n * quoted-string early and let the rest of the name forge further header parameters. The ASCII\n * fallback is stripped to a safe subset and the real name is carried in the RFC 5987\n * `filename*` parameter, which is also what preserves non-ASCII names correctly.\n */\nfunction buildContentDisposition(disposition: \"inline\" | \"attachment\", fileName: string): string {\n  const name = (fileName || \"file\").replace(/[\\r\\n]/g, \"\");\n  const asciiFallback = name.replace(/[^\\x20-\\x7E]/g, \"_\").replace(/[\"\\\\]/g, \"_\") || \"file\";\n\n  return `${disposition}; filename=\"${asciiFallback}\"; filename*=UTF-8''${encodeURIComponent(name)}`;\n}\n\n/**\n * Single place that stamps the response headers for every streamed file download, so the\n * security headers can't be applied to one endpoint and forgotten on the next.\n */\nexport function setFileDownloadHeaders(res: Response, options: FileDownloadHeaderOptions): void {\n  const disposition = options.disposition ?? \"attachment\";\n\n  res.setHeader(\"Content-Disposition\", buildContentDisposition(disposition, options.fileName));\n  res.setHeader(\"Content-Type\", options.mimeType);\n  res.setHeader(\"Access-Control-Expose-Headers\", \"Content-Disposition, Content-Type\");\n\n  // Prevent the browser from ever content-sniffing a served file into something more\n  // dangerous than its declared Content-Type (e.g. rendering a mislabeled upload as HTML\n  // and executing embedded script).\n  res.setHeader(\"X-Content-Type-Options\", \"nosniff\");\n\n  if (options.crossOriginResourcePolicy) {\n    res.setHeader(\"Cross-Origin-Resource-Policy\", \"cross-origin\");\n  }\n}\n"]}

package/dist/services/media-storage.utils.d.ts

@@ -12,6 +12,7 @@ export interface MediaRecordCreateInput {
     fileSize?: number;
     originalFileName?: string;
 }
+export declare function sanitizeStoredMediaFileName(originalName?: string | null): string;
 export declare function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string;
 export declare function buildDiskMediaPath(fileName: string, settingService: Pick<SettingService, 'getConfigValue'>, storageProvider?: Pick<MediaStorageProviderMetadata, 'localPath' | 'isPublic'>): string;
 export declare function getEffectiveS3Region(configService: Pick<ConfigService, 'get'>, providerRegion?: string): string | undefined;

package/dist/services/media-storage.utils.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-storage.utils.d.ts","sourceRoot":"","sources":["../../src/services/media-storage.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAK9D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,8BAA8B,EAAE,MAAM,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAGD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,MAAM,CAE7G;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAC,eAAe,CAAC,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,GAAG,UAAU,CAAC,GAAI,MAAM,CAYlM;AAGD,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3H;AAGD,wBAAgB,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,GAAG,OAAO,GAAG,SAAS,CAM1H;AAGD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnF,eAAe,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,EACzD,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,aAAa,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,iBAAiB,GAAG,gCAAgC,GAAG,iBAAiB,GAAG,aAAa,CAAC,CAAC,GAC/I,sBAAsB,CAQxB"}
+{"version":3,"file":"media-storage.utils.d.ts","sourceRoot":"","sources":["../../src/services/media-storage.utils.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,aAAa,EAAE,MAAM,gBAAgB,CAAC;AAE/C,OAAO,EAAE,aAAa,EAAE,MAAM,oCAAoC,CAAC;AACnE,OAAO,EAAE,4BAA4B,EAAE,MAAM,qDAAqD,CAAC;AACnG,OAAO,EAAE,cAAc,EAAE,MAAM,8BAA8B,CAAC;AAU9D,MAAM,WAAW,sBAAsB;IACrC,QAAQ,EAAE,MAAM,CAAC;IACjB,eAAe,EAAE,MAAM,CAAC;IACxB,8BAA8B,EAAE,MAAM,CAAC;IACvC,eAAe,EAAE,MAAM,CAAC;IACxB,WAAW,EAAE,MAAM,CAAC;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAWD,wBAAgB,2BAA2B,CAAC,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAShF;AAGD,wBAAgB,wBAAwB,CAAC,IAAI,EAAE,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,IAAI,EAAE,UAAU,GAAG,cAAc,CAAC,GAAG,MAAM,CAE7G;AAGD,wBAAgB,kBAAkB,CAAC,QAAQ,EAAE,MAAM,EAAC,cAAc,EAAE,IAAI,CAAC,cAAc,EAAE,gBAAgB,CAAC,EAAC,eAAe,CAAC,EAAE,IAAI,CAAC,4BAA4B,EAAE,WAAW,GAAG,UAAU,CAAC,GAAI,MAAM,CAYlM;AAGD,wBAAgB,oBAAoB,CAAC,aAAa,EAAE,IAAI,CAAC,aAAa,EAAE,KAAK,CAAC,EAAE,cAAc,CAAC,EAAE,MAAM,GAAG,MAAM,GAAG,SAAS,CAE3H;AAGD,wBAAgB,oBAAoB,CAAC,eAAe,CAAC,EAAE,IAAI,CAAC,4BAA4B,EAAE,UAAU,CAAC,GAAG,OAAO,GAAG,SAAS,CAM1H;AAGD,wBAAgB,2BAA2B,CACzC,QAAQ,EAAE,MAAM,EAChB,kBAAkB,EAAE,IAAI,CAAC,aAAa,EAAE,IAAI,GAAG,OAAO,CAAC,GAAG;IAAE,KAAK,EAAE;QAAE,EAAE,EAAE,MAAM,CAAA;KAAE,CAAA;CAAE,EACnF,eAAe,EAAE,IAAI,CAAC,4BAA4B,EAAE,IAAI,CAAC,EACzD,SAAS,EAAE,IAAI,CAAC,sBAAsB,EAAE,aAAa,CAAC,GAClD,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,iBAAiB,GAAG,gCAAgC,GAAG,iBAAiB,GAAG,aAAa,CAAC,CAAC,GAC/I,sBAAsB,CAQxB"}

package/dist/services/media-storage.utils.js

@@ -33,6 +33,7 @@ var __importStar = (this && this.__importStar) || (function () {
     };
 })();
 Object.defineProperty(exports, "__esModule", { value: true });
+exports.sanitizeStoredMediaFileName = sanitizeStoredMediaFileName;
 exports.buildStoredMediaFileName = buildStoredMediaFileName;
 exports.buildDiskMediaPath = buildDiskMediaPath;
 exports.getEffectiveS3Region = getEffectiveS3Region;
@@ -40,8 +41,18 @@ exports.resolveMediaIsPublic = resolveMediaIsPublic;
 exports.buildMediaRecordCreateInput = buildMediaRecordCreateInput;
 const path = __importStar(require("path"));
 const default_settings_provider_service_1 = require("./settings/default-settings-provider.service");
+const media_file_types_1 = require("../constants/media-file-types");
+const MAX_STORED_FILE_NAME_LENGTH = 150;
+function sanitizeStoredMediaFileName(originalName) {
+    const sanitized = (0, media_file_types_1.normalizeUploadedFileName)(originalName)
+        .replace(/[^A-Za-z0-9._-]/g, '_')
+        .replace(/\.{2,}/g, '.')
+        .replace(/^[._-]+/, '')
+        .slice(0, MAX_STORED_FILE_NAME_LENGTH);
+    return sanitized || 'file';
+}
 function buildStoredMediaFileName(file) {
-    return `${file.filename}-${file.originalname}`;
+    return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;
 }
 function buildDiskMediaPath(fileName, settingService, storageProvider) {
     const publicBase = settingService.getConfigValue('fileStorageDir') || default_settings_provider_service_1.DEFAULT_MEDIA_FILE_STORAGE_DIR;

package/dist/services/media-storage.utils.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-storage.utils.js","sourceRoot":"","sources":["../../src/services/media-storage.utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAqBA,4DAEC;AAGD,gDAYC;AAGD,oDAEC;AAGD,oDAMC;AAGD,kEAcC;AApED,2CAA6B;AAI7B,oGAAyG;AAgBzG,SAAgB,wBAAwB,CAAC,IAA4D;IACnG,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,IAAI,CAAC,YAAY,EAAE,CAAC;AACjD,CAAC;AAGD,SAAgB,kBAAkB,CAAC,QAAgB,EAAC,cAAsD,EAAC,eAA8E;IACvL,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAmB,gBAAgB,CAAC,IAAI,kEAA8B,CAAC;IACvH,MAAM,WAAW,GAAG,GAAG,UAAU,UAAU,CAAC;IAG5C,MAAM,YAAY,GAAG,eAAe,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;IAEnF,IAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAG,CAAC;QACnH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;AACvC,CAAC;AAGD,SAAgB,oBAAoB,CAAC,aAAyC,EAAE,cAAuB;IACrG,OAAO,cAAc,IAAI,aAAa,CAAC,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,eAAgE;IACnG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC5C,CAAC;AAGD,SAAgB,2BAA2B,CACzC,QAAgB,EAChB,kBAAmF,EACnF,eAAyD,EACzD,SACgJ;IAEhJ,OAAO;QACL,QAAQ;QACR,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC5C,8BAA8B,EAAE,eAAe,CAAC,EAAE;QAClD,eAAe,EAAE,kBAAkB,CAAC,EAAE;QACtC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC","sourcesContent":["import { ConfigService } from '@nestjs/config';\nimport * as path from 'path';\nimport { FieldMetadata } from 'src/entities/field-metadata.entity';\nimport { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';\nimport { SettingService } from 'src/services/setting.service';\nimport { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\n\n\nexport interface MediaRecordCreateInput {\n  entityId: number;\n  modelMetadataId: number;\n  mediaStorageProviderMetadataId: number;\n  fieldMetadataId: number;\n  relativeUri: string;\n  mimeType?: string;\n  fileSize?: number;\n  originalFileName?: string;\n}\n\n// Builds the stored file name format shared by media storage implementations.\nexport function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {\n  return `${file.filename}-${file.originalname}`;\n}\n\n// Resolves the on-disk path for a media file based on settings and provider visibility.\nexport function buildDiskMediaPath(fileName: string,settingService: Pick<SettingService, 'getConfigValue'>,storageProvider?: Pick<MediaStorageProviderMetadata, 'localPath' | 'isPublic'>,): string {\n  const publicBase = settingService.getConfigValue<SolidCoreSetting>('fileStorageDir') || DEFAULT_MEDIA_FILE_STORAGE_DIR;\n  const privateBase = `${publicBase}-private`;\n  // const localPath = storageProvider?.localPath;\n  // const isUsingLegacyDefaultPath = localPath === publicBase || localPath === privateBase || localPath === privateBase;\n  const providerBase = storageProvider?.isPublic === false ? privateBase : publicBase\n\n  if ( path.isAbsolute(fileName) || fileName.startsWith(`${publicBase}/`) || fileName.startsWith(`${privateBase}/`) ) {\n    return fileName;\n  }\n\n  return `${providerBase}/${fileName}`;\n}\n\n// Returns the S3 region from the provider when present, otherwise falls back to app config.\nexport function getEffectiveS3Region(configService: Pick<ConfigService, 'get'>, providerRegion?: string): string | undefined {\n  return providerRegion || configService.get<string>('S3_AWS_REGION_NAME');\n}\n\n// Resolves the effective public/private flag for a media storage provider.\nexport function resolveMediaIsPublic(storageProvider?: Pick<MediaStorageProviderMetadata, 'isPublic'>): boolean | undefined {\n  if (!storageProvider) {\n    return undefined;\n  }\n\n  return storageProvider.isPublic !== false;\n}\n\n// Builds the shared media record payload used before saving media metadata to the database.\nexport function buildMediaRecordCreateInput(\n  entityId: number,\n  mediaFieldMetadata: Pick<FieldMetadata, 'id' | 'model'> & { model: { id: number } },\n  storageProvider: Pick<MediaStorageProviderMetadata, 'id'>,\n  overrides: Pick<MediaRecordCreateInput, 'relativeUri'>\n    & Partial<Omit<MediaRecordCreateInput, 'entityId' | 'modelMetadataId' | 'mediaStorageProviderMetadataId' | 'fieldMetadataId' | 'relativeUri'>>,\n): MediaRecordCreateInput {\n  return {\n    entityId,\n    modelMetadataId: mediaFieldMetadata.model.id,\n    mediaStorageProviderMetadataId: storageProvider.id,\n    fieldMetadataId: mediaFieldMetadata.id,\n    ...overrides,\n  };\n}\n"]}
+{"version":3,"file":"media-storage.utils.js","sourceRoot":"","sources":["../../src/services/media-storage.utils.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;AAkCA,kEASC;AAGD,4DAEC;AAGD,gDAYC;AAGD,oDAEC;AAGD,oDAMC;AAGD,kEAcC;AA7FD,2CAA6B;AAI7B,oGAAyG;AAEzG,oEAA2E;AAI3E,MAAM,2BAA2B,GAAG,GAAG,CAAC;AAuBxC,SAAgB,2BAA2B,CAAC,YAA4B;IACtE,MAAM,SAAS,GAAG,IAAA,4CAAyB,EAAC,YAAY,CAAC;SACtD,OAAO,CAAC,kBAAkB,EAAE,GAAG,CAAC;SAEhC,OAAO,CAAC,SAAS,EAAE,GAAG,CAAC;SACvB,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC;SACtB,KAAK,CAAC,CAAC,EAAE,2BAA2B,CAAC,CAAC;IAEzC,OAAO,SAAS,IAAI,MAAM,CAAC;AAC7B,CAAC;AAGD,SAAgB,wBAAwB,CAAC,IAA4D;IACnG,OAAO,GAAG,IAAI,CAAC,QAAQ,IAAI,2BAA2B,CAAC,IAAI,CAAC,YAAY,CAAC,EAAE,CAAC;AAC9E,CAAC;AAGD,SAAgB,kBAAkB,CAAC,QAAgB,EAAC,cAAsD,EAAC,eAA8E;IACvL,MAAM,UAAU,GAAG,cAAc,CAAC,cAAc,CAAmB,gBAAgB,CAAC,IAAI,kEAA8B,CAAC;IACvH,MAAM,WAAW,GAAG,GAAG,UAAU,UAAU,CAAC;IAG5C,MAAM,YAAY,GAAG,eAAe,EAAE,QAAQ,KAAK,KAAK,CAAC,CAAC,CAAC,WAAW,CAAC,CAAC,CAAC,UAAU,CAAA;IAEnF,IAAK,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,UAAU,GAAG,CAAC,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,WAAW,GAAG,CAAC,EAAG,CAAC;QACnH,OAAO,QAAQ,CAAC;IAClB,CAAC;IAED,OAAO,GAAG,YAAY,IAAI,QAAQ,EAAE,CAAC;AACvC,CAAC;AAGD,SAAgB,oBAAoB,CAAC,aAAyC,EAAE,cAAuB;IACrG,OAAO,cAAc,IAAI,aAAa,CAAC,GAAG,CAAS,oBAAoB,CAAC,CAAC;AAC3E,CAAC;AAGD,SAAgB,oBAAoB,CAAC,eAAgE;IACnG,IAAI,CAAC,eAAe,EAAE,CAAC;QACrB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,OAAO,eAAe,CAAC,QAAQ,KAAK,KAAK,CAAC;AAC5C,CAAC;AAGD,SAAgB,2BAA2B,CACzC,QAAgB,EAChB,kBAAmF,EACnF,eAAyD,EACzD,SACgJ;IAEhJ,OAAO;QACL,QAAQ;QACR,eAAe,EAAE,kBAAkB,CAAC,KAAK,CAAC,EAAE;QAC5C,8BAA8B,EAAE,eAAe,CAAC,EAAE;QAClD,eAAe,EAAE,kBAAkB,CAAC,EAAE;QACtC,GAAG,SAAS;KACb,CAAC;AACJ,CAAC","sourcesContent":["import { ConfigService } from '@nestjs/config';\nimport * as path from 'path';\nimport { FieldMetadata } from 'src/entities/field-metadata.entity';\nimport { MediaStorageProviderMetadata } from 'src/entities/media-storage-provider-metadata.entity';\nimport { SettingService } from 'src/services/setting.service';\nimport { DEFAULT_MEDIA_FILE_STORAGE_DIR } from 'src/services/settings/default-settings-provider.service';\nimport type { SolidCoreSetting } from 'src/services/settings/default-settings-provider.service';\nimport { normalizeUploadedFileName } from 'src/constants/media-file-types';\n\n// Keeps the joined path well clear of filesystem NAME_MAX (255 on ext4/APFS) once the\n// multer hash prefix and separator are added.\nconst MAX_STORED_FILE_NAME_LENGTH = 150;\n\n\nexport interface MediaRecordCreateInput {\n  entityId: number;\n  modelMetadataId: number;\n  mediaStorageProviderMetadataId: number;\n  fieldMetadataId: number;\n  relativeUri: string;\n  mimeType?: string;\n  fileSize?: number;\n  originalFileName?: string;\n}\n\n/**\n * Reduces a client-supplied name to something safe to interpolate into a filesystem path.\n * `originalname` is fully attacker-controlled, so without this a name like\n * `../../../../tmp/pwned.png` escapes the media storage directory entirely - the multer hash\n * prefix does not contain it, because the leading `..` simply cancels the prefix segment.\n *\n * Everything outside a conservative allowlist becomes `_`; the result can never contain a\n * path separator, so the joined path always stays inside the storage root.\n */\nexport function sanitizeStoredMediaFileName(originalName?: string | null): string {\n  const sanitized = normalizeUploadedFileName(originalName)\n    .replace(/[^A-Za-z0-9._-]/g, '_')\n    // Collapse any run of dots so no `..` segment can survive.\n    .replace(/\\.{2,}/g, '.')\n    .replace(/^[._-]+/, '')\n    .slice(0, MAX_STORED_FILE_NAME_LENGTH);\n\n  return sanitized || 'file';\n}\n\n// Builds the stored file name format shared by media storage implementations.\nexport function buildStoredMediaFileName(file: Pick<Express.Multer.File, 'filename' | 'originalname'>): string {\n  return `${file.filename}-${sanitizeStoredMediaFileName(file.originalname)}`;\n}\n\n// Resolves the on-disk path for a media file based on settings and provider visibility.\nexport function buildDiskMediaPath(fileName: string,settingService: Pick<SettingService, 'getConfigValue'>,storageProvider?: Pick<MediaStorageProviderMetadata, 'localPath' | 'isPublic'>,): string {\n  const publicBase = settingService.getConfigValue<SolidCoreSetting>('fileStorageDir') || DEFAULT_MEDIA_FILE_STORAGE_DIR;\n  const privateBase = `${publicBase}-private`;\n  // const localPath = storageProvider?.localPath;\n  // const isUsingLegacyDefaultPath = localPath === publicBase || localPath === privateBase || localPath === privateBase;\n  const providerBase = storageProvider?.isPublic === false ? privateBase : publicBase\n\n  if ( path.isAbsolute(fileName) || fileName.startsWith(`${publicBase}/`) || fileName.startsWith(`${privateBase}/`) ) {\n    return fileName;\n  }\n\n  return `${providerBase}/${fileName}`;\n}\n\n// Returns the S3 region from the provider when present, otherwise falls back to app config.\nexport function getEffectiveS3Region(configService: Pick<ConfigService, 'get'>, providerRegion?: string): string | undefined {\n  return providerRegion || configService.get<string>('S3_AWS_REGION_NAME');\n}\n\n// Resolves the effective public/private flag for a media storage provider.\nexport function resolveMediaIsPublic(storageProvider?: Pick<MediaStorageProviderMetadata, 'isPublic'>): boolean | undefined {\n  if (!storageProvider) {\n    return undefined;\n  }\n\n  return storageProvider.isPublic !== false;\n}\n\n// Builds the shared media record payload used before saving media metadata to the database.\nexport function buildMediaRecordCreateInput(\n  entityId: number,\n  mediaFieldMetadata: Pick<FieldMetadata, 'id' | 'model'> & { model: { id: number } },\n  storageProvider: Pick<MediaStorageProviderMetadata, 'id'>,\n  overrides: Pick<MediaRecordCreateInput, 'relativeUri'>\n    & Partial<Omit<MediaRecordCreateInput, 'entityId' | 'modelMetadataId' | 'mediaStorageProviderMetadataId' | 'fieldMetadataId' | 'relativeUri'>>,\n): MediaRecordCreateInput {\n  return {\n    entityId,\n    modelMetadataId: mediaFieldMetadata.model.id,\n    mediaStorageProviderMetadataId: storageProvider.id,\n    fieldMetadataId: mediaFieldMetadata.id,\n    ...overrides,\n  };\n}\n"]}

package/dist/services/module-metadata.service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"module-metadata.service.d.ts","sourceRoot":"","sources":["../../src/services/module-metadata.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAQpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AACpD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAEL,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAA+B,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,qBACa,qBAAqB;IAK9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAEzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,2BAA2B;IAlB9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAI9C,UAAU,EAAE,UAAU,EAGtB,kBAAkB,EAAE,wBAAwB,EAC5C,iBAAiB,EAAE,iBAAiB,EACpC,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,EAAE,cAAc,EAC9B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,EAE9B,wBAAwB,EAAE,+BAA+B,EAEzD,oBAAoB,EAAE,oBAAoB,EAC1C,aAAa,EAAE,aAAa,EAC5B,2BAA2B,EAAE,2BAA2B;IAGrE,QAAQ,CAAC,cAAc,EAAE,cAAc;;;;;;;;;;;IAgCvC,IAAI,CAAC,cAAc,EAAE,cAAc;;;;;;;;;;;IAInC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,KAAK;IAa7C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,KAAK;IAgBlC,MAAM,CAAC,SAAS,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAe5E,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAWxG,YAAY,CAAC,MAAM,EAAE,cAAc;IAqEnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAetG,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAoBlI,YAAY,CAAC,MAAM,EAAE,cAAc;IAmDnC,MAAM,CAAC,uBAAuB,EAAE,uBAAuB;IAqBvD,YAAY,CAAC,IAAI,EAAE,MAAM;IAQzB,MAAM,CAAC,EAAE,EAAE,MAAM;IAOjB,eAAe,CAAC,cAAc,EAAE,MAAM;YA8C9B,gCAAgC;YAiDhC,yBAAyB;IA6CjC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAyBvC,iBAAiB;IAMjB,sBAAsB,CAAC,QAAQ,EAAE,MAAM;;;;;IAyBvC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;YAuBrD,qBAAqB;YAgBrB,yBAAyB;IAkBvC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,WAAW;CAIpB"}
+{"version":3,"file":"module-metadata.service.d.ts","sourceRoot":"","sources":["../../src/services/module-metadata.service.ts"],"names":[],"mappings":"AAIA,OAAO,EAAE,UAAU,EAAE,aAAa,EAA0B,MAAM,SAAS,CAAC;AAE5E,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAE7E,OAAO,EAAE,cAAc,EAAE,MAAM,oCAAoC,CAAC;AAQpE,OAAO,EAAE,2BAA2B,EAAE,MAAM,4CAA4C,CAAC;AACzF,OAAO,EAAE,wBAAwB,EAAE,MAAM,2CAA2C,CAAC;AACrF,OAAO,EAAE,+BAA+B,EAAE,MAAM,gDAAgD,CAAC;AACjG,OAAO,EAAE,eAAe,EAAE,MAAM,mBAAmB,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,MAAM,2BAA2B,CAAC;AAC3D,OAAO,EAAE,uBAAuB,EAAE,MAAM,oCAAoC,CAAC;AAC7E,OAAO,EAEL,gBAAgB,EACjB,MAAM,8BAA8B,CAAC;AACtC,OAAO,EAAE,cAAc,EAAE,MAAM,4BAA4B,CAAC;AAC5D,OAAO,EAAE,aAAa,EAAE,MAAM,2BAA2B,CAAC;AAC1D,OAAO,EAAE,qBAAqB,EAA+B,MAAM,eAAe,CAAC;AACnF,OAAO,EAAE,iBAAiB,EAAE,MAAM,uBAAuB,CAAC;AAC1D,OAAO,EAAE,oBAAoB,EAAE,MAAM,0BAA0B,CAAC;AAChE,OAAO,EAAE,cAAc,EAAE,MAAM,mBAAmB,CAAC;AAEnD,qBACa,qBAAqB;IAK9B,OAAO,CAAC,QAAQ,CAAC,UAAU;IAG3B,OAAO,CAAC,QAAQ,CAAC,kBAAkB;IACnC,OAAO,CAAC,QAAQ,CAAC,iBAAiB;IAClC,OAAO,CAAC,QAAQ,CAAC,gBAAgB;IACjC,OAAO,CAAC,QAAQ,CAAC,cAAc;IAC/B,OAAO,CAAC,QAAQ,CAAC,WAAW;IAC5B,OAAO,CAAC,QAAQ,CAAC,cAAc;IAE/B,OAAO,CAAC,QAAQ,CAAC,wBAAwB;IAEzC,OAAO,CAAC,QAAQ,CAAC,oBAAoB;IACrC,OAAO,CAAC,QAAQ,CAAC,aAAa;IAC9B,OAAO,CAAC,QAAQ,CAAC,2BAA2B;IAlB9C,OAAO,CAAC,QAAQ,CAAC,MAAM,CAA0C;gBAI9C,UAAU,EAAE,UAAU,EAGtB,kBAAkB,EAAE,wBAAwB,EAC5C,iBAAiB,EAAE,iBAAiB,EACpC,gBAAgB,EAAE,gBAAgB,EAClC,cAAc,EAAE,cAAc,EAC9B,WAAW,EAAE,eAAe,EAC5B,cAAc,EAAE,cAAc,EAE9B,wBAAwB,EAAE,+BAA+B,EAEzD,oBAAoB,EAAE,oBAAoB,EAC1C,aAAa,EAAE,aAAa,EAC5B,2BAA2B,EAAE,2BAA2B;IAGrE,QAAQ,CAAC,cAAc,EAAE,cAAc;;;;;;;;;;;IAgCvC,IAAI,CAAC,cAAc,EAAE,cAAc;;;;;;;;;;;IAInC,gBAAgB,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,KAAK;IAa7C,OAAO,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,KAAK;IAgBlC,MAAM,CAAC,SAAS,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAe5E,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,SAAS,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAWxG,YAAY,CAAC,MAAM,EAAE,cAAc;IAqEnC,MAAM,CAAC,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAetG,UAAU,CAAC,OAAO,EAAE,aAAa,EAAE,EAAE,EAAE,MAAM,EAAE,uBAAuB,EAAE,uBAAuB,EAAE,KAAK,GAAE,OAAO,CAAC,MAAM,CAAC,IAAI,EAAO;IAoBlI,YAAY,CAAC,MAAM,EAAE,cAAc;IAmDnC,MAAM,CAAC,uBAAuB,EAAE,uBAAuB;IAqBvD,YAAY,CAAC,IAAI,EAAE,MAAM;IAQzB,MAAM,CAAC,EAAE,EAAE,MAAM;IAOjB,eAAe,CAAC,cAAc,EAAE,MAAM;YA8C9B,gCAAgC;YAiDhC,yBAAyB;IA6CjC,UAAU,CAAC,GAAG,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,GAAG,CAAC;IAyBvC,iBAAiB;IAMjB,sBAAsB,CAAC,QAAQ,EAAE,MAAM;;;;;IAyBvC,kBAAkB,CAAC,QAAQ,EAAE,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAUrD,YAAY,CAAC,OAAO,EAAE,qBAAqB,GAAG,OAAO,CAAC,MAAM,CAAC;YAuBrD,qBAAqB;YAgBrB,yBAAyB;IAkBvC,OAAO,CAAC,sBAAsB;IAS9B,OAAO,CAAC,WAAW;CAKpB"}

package/dist/services/module-metadata.service.js

@@ -63,6 +63,7 @@ const module_metadata_helper_service_1 = require("../helpers/module-metadata-hel
 const module_metadata_repository_1 = require("../repository/module-metadata.repository");
 const permission_metadata_seeder_service_1 = require("../seeders/permission-metadata-seeder.service");
 const file_1 = require("./file");
+const media_storage_utils_1 = require("./media-storage.utils");
 const schematic_service_1 = require("../helpers/schematic.service");
 const command_service_1 = require("../helpers/command.service");
 const solid_registry_1 = require("../helpers/solid-registry");
@@ -544,7 +545,7 @@ let ModuleMetadataService = ModuleMetadataService_1 = class ModuleMetadataServic
         return `${base}/${fileName}`;
     }
     getFileName(file) {
-        return `${file.filename}-${file.originalname}`;
+        return `${file.filename}-${(0, media_storage_utils_1.sanitizeStoredMediaFileName)(file.originalname)}`;
     }
 };
 exports.ModuleMetadataService = ModuleMetadataService;