@solidxai/core 0.1.13-beta.16 → 0.1.13-beta.18

package/dist/constants/media-file-types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzE,eAAO,MAAM,gBAAgB,qDAAsD,CAAC;AAapF,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAcH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAkB1E;AAOD,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAStF;AAWD,wBAAgB,iCAAiC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAGpF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}
+{"version":3,"file":"media-file-types.d.ts","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,aAAa,GAAG,OAAO,GAAG,OAAO,GAAG,OAAO,GAAG,MAAM,GAAG,KAAK,CAAC;AAEzE,eAAO,MAAM,gBAAgB,qDAAsD,CAAC;AAapF,eAAO,MAAM,oBAAoB,aAI/B,CAAC;AAQH,eAAO,MAAM,oBAAoB,aAE/B,CAAC;AAuCH,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,CAmB1E;AAOD,wBAAgB,yBAAyB,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,GAAG,SAAS,CAStF;AAWD,wBAAgB,iCAAiC,CAAC,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,MAAM,EAAE,CAGpF;AAGD,MAAM,WAAW,gBAAgB;IAC7B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACrB;AAGD,wBAAgB,mBAAmB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,MAAM,CAE1E;AAQD,wBAAgB,oBAAoB,CAAC,IAAI,CAAC,EAAE,gBAAgB,GAAG,IAAI,GAAG,OAAO,CAO5E;AASD,eAAO,MAAM,iBAAiB,EAAE,MAAM,CAAC,MAAM,EAAE,aAAa,CAM3D,CAAC;AAMF,eAAO,MAAM,sBAAsB,aAKjC,CAAC"}

package/dist/constants/media-file-types.js

@@ -20,11 +20,29 @@ exports.DANGEROUS_EXTENSIONS = new Set([
 exports.DANGEROUS_MIME_TYPES = new Set([
     'image/svg+xml', 'text/html', 'application/xhtml+xml',
 ]);
+function decodePercentEncodingSafely(name) {
+    let decoded = name;
+    for (let i = 0; i < 3; i++) {
+        let next;
+        try {
+            next = decodeURIComponent(decoded);
+        }
+        catch {
+            return decoded;
+        }
+        if (next === decoded) {
+            return decoded;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
 function normalizeUploadedFileName(fileName) {
     if (!fileName) {
         return '';
     }
-    let name = String(fileName).split(/[/\\]/).pop() ?? '';
+    let name = decodePercentEncodingSafely(String(fileName));
+    name = name.split(/[/\\]/).pop() ?? '';
     const nulIndex = name.indexOf('\0');
     if (nulIndex >= 0) {
         name = name.slice(0, nulIndex);

package/dist/constants/media-file-types.js.map

@@ -1 +1 @@
-{"version":3,"file":"media-file-types.js","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":";;;AA2CA,8DAkBC;AAOD,8DASC;AAWD,8EAGC;AAUD,kDAEC;AAQD,oDAOC;AApHY,QAAA,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAEpF,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9F,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,KAAK,CAAC;AAOf,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IACpC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACjD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACjD,CAAC,CAAC;AAQU,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,eAAe,EAAE,WAAW,EAAE,uBAAuB;CACxD,CAAC,CAAC;AAcH,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,MAAM,CAAC,QAAQ,CAAC,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvD,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAWD,SAAgB,iCAAiC,CAAC,QAAwB;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAUD,SAAgB,mBAAmB,CAAC,IAA8B;IAC9D,OAAO,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,CAAC;AAQD,SAAgB,oBAAoB,CAAC,IAA8B;IAC/D,MAAM,QAAQ,GAAG,iCAAiC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,4BAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,4BAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AASY,QAAA,iBAAiB,GAAkC;IAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAe,CAAC,CAAC,CAAC;IAC/E,CAAC,aAAa,CAAC,EAAE,KAAK;CACzB,CAAC;AAMW,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,aAAa;CAChB,CAAC,CAAC","sourcesContent":["export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';\n\nexport const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;\n\nconst IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];\nconst AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];\nconst VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];\nconst DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];\nconst PDF_EXTENSION = 'pdf';\n\n/**\n * Extensions that must never be accepted as media uploads, regardless of declared mimetype or\n * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed\n * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.\n */\nexport const DANGEROUS_EXTENSIONS = new Set([\n    'html', 'htm', 'xhtml', 'svg', 'xml',\n    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',\n    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',\n]);\n\n\n/**\n * Mimetypes that are never safe to accept, regardless of extension. These render as active\n * content in a browser (svg can carry <script>), so they are rejected even when the filename\n * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.\n */\nexport const DANGEROUS_MIME_TYPES = new Set([\n    'image/svg+xml', 'text/html', 'application/xhtml+xml',\n]);\n\n/**\n * Reduces a client-supplied name to the name that will actually be resolved on disk, so\n * extension checks can't be dodged by decorating it. Each step defends a known bypass:\n *\n *  - `../../evil.exe`      -> only the final path segment is the file name.\n *  - `evil.exe\\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so\n *                             anything after it is invisible to the OS but visible to naive\n *                             validation.\n *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.\n *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving\n *                             a path, so these land on disk as evil.exe.\n */\nexport function normalizeUploadedFileName(fileName?: string | null): string {\n    if (!fileName) {\n        return '';\n    }\n\n    let name = String(fileName).split(/[/\\\\]/).pop() ?? '';\n\n    const nulIndex = name.indexOf('\\0');\n    if (nulIndex >= 0) {\n        name = name.slice(0, nulIndex);\n    }\n\n    const streamIndex = name.indexOf(':');\n    if (streamIndex >= 0) {\n        name = name.slice(0, streamIndex);\n    }\n\n    return name.replace(/[\\s.]+$/, '');\n}\n\n/**\n * The effective extension - what the OS/browser will treat the file as. Used for media\n * category resolution and inline-safety decisions. Always normalizes first, so\n * `evil.exe.` resolves to `exe` rather than to nothing.\n */\nexport function getLowercaseFileExtension(fileName?: string | null): string | undefined {\n    const name = normalizeUploadedFileName(fileName);\n\n    const lastDotIndex = name.lastIndexOf('.');\n    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {\n        return undefined;\n    }\n\n    return name.slice(lastDotIndex + 1).toLowerCase();\n}\n\n/**\n * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather\n * than only the effective extension so a dangerous type buried in a double extension\n * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve\n * such names by an earlier segment than the last one.\n *\n * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)\n * isn't rejected.\n */\nexport function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {\n    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');\n    return segments.slice(1).filter(segment => segment.length > 0);\n}\n\n/** Minimal shape of an uploaded file, so this module stays free of framework imports. */\nexport interface UploadedFileLike {\n    mimetype?: string;\n    originalname?: string;\n    filename?: string;\n}\n\n/** originalname is the client-supplied name; filename is multer's on-disk name. */\nexport function getUploadedFileName(file?: UploadedFileLike | null): string {\n    return file?.originalname ?? file?.filename ?? '';\n}\n\n/**\n * Single predicate for \"must never be stored\". Shared by every upload entry point\n * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.\n * Extensions are checked before mimetype so a spoofed Content-Type (e.g.\n * application/octet-stream, or image/png, on an .html file) can't bypass it.\n */\nexport function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {\n    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));\n    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {\n        return true;\n    }\n\n    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());\n}\n\n/**\n * Single source of truth for extension -> coarse media category. Shared by upload-time\n * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so\n * both agree on which extensions belong to which category and neither drifts out of sync.\n * webm/ogg are shared between AUDIO_EXTENSIONS and VIDEO_EXTENSIONS - last one wins here, they\n * default to 'video' since that's the more common upload case.\n */\nexport const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {\n    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),\n    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),\n    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),\n    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),\n    [PDF_EXTENSION]: 'pdf',\n};\n\n/**\n * Extensions safe to serve inline with their natural Content-Type; everything else served from\n * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.\n */\nexport const INLINE_SAFE_EXTENSIONS = new Set<string>([\n    ...IMAGE_EXTENSIONS,\n    ...AUDIO_EXTENSIONS,\n    ...VIDEO_EXTENSIONS,\n    PDF_EXTENSION,\n]);\n"]}
+{"version":3,"file":"media-file-types.js","sourceRoot":"","sources":["../../src/constants/media-file-types.ts"],"names":[],"mappings":";;;AAoEA,8DAmBC;AAOD,8DASC;AAWD,8EAGC;AAUD,kDAEC;AAQD,oDAOC;AA9IY,QAAA,gBAAgB,GAAG,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,CAAU,CAAC;AAEpF,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC9F,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,MAAM,CAAC,CAAC;AAC7E,MAAM,gBAAgB,GAAG,CAAC,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,CAAC,CAAC;AAClG,MAAM,mBAAmB,GAAG,CAAC,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,EAAE,KAAK,EAAE,KAAK,EAAE,IAAI,CAAC,CAAC;AAC1H,MAAM,aAAa,GAAG,KAAK,CAAC;AAOf,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,MAAM,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK;IACpC,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM;IACjD,KAAK,EAAE,IAAI,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK,EAAE,KAAK;CACjD,CAAC,CAAC;AAQU,QAAA,oBAAoB,GAAG,IAAI,GAAG,CAAC;IACxC,eAAe,EAAE,WAAW,EAAE,uBAAuB;CACxD,CAAC,CAAC;AAQH,SAAS,2BAA2B,CAAC,IAAY;IAC7C,IAAI,OAAO,GAAG,IAAI,CAAC;IACnB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,CAAC,EAAE,CAAC,EAAE,EAAE,CAAC;QACzB,IAAI,IAAY,CAAC;QACjB,IAAI,CAAC;YACD,IAAI,GAAG,kBAAkB,CAAC,OAAO,CAAC,CAAC;QACvC,CAAC;QAAC,MAAM,CAAC;YACL,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,IAAI,IAAI,KAAK,OAAO,EAAE,CAAC;YACnB,OAAO,OAAO,CAAC;QACnB,CAAC;QACD,OAAO,GAAG,IAAI,CAAC;IACnB,CAAC;IACD,OAAO,OAAO,CAAC;AACnB,CAAC;AAgBD,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,IAAI,CAAC,QAAQ,EAAE,CAAC;QACZ,OAAO,EAAE,CAAC;IACd,CAAC;IAED,IAAI,IAAI,GAAG,2BAA2B,CAAC,MAAM,CAAC,QAAQ,CAAC,CAAC,CAAC;IACzD,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC;IAEvC,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;IACpC,IAAI,QAAQ,IAAI,CAAC,EAAE,CAAC;QAChB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;IACnC,CAAC;IAED,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,GAAG,CAAC,CAAC;IACtC,IAAI,WAAW,IAAI,CAAC,EAAE,CAAC;QACnB,IAAI,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,WAAW,CAAC,CAAC;IACtC,CAAC;IAED,OAAO,IAAI,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;AACvC,CAAC;AAOD,SAAgB,yBAAyB,CAAC,QAAwB;IAC9D,MAAM,IAAI,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC;IAEjD,MAAM,YAAY,GAAG,IAAI,CAAC,WAAW,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,YAAY,GAAG,CAAC,IAAI,YAAY,KAAK,IAAI,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvD,OAAO,SAAS,CAAC;IACrB,CAAC;IAED,OAAO,IAAI,CAAC,KAAK,CAAC,YAAY,GAAG,CAAC,CAAC,CAAC,WAAW,EAAE,CAAC;AACtD,CAAC;AAWD,SAAgB,iCAAiC,CAAC,QAAwB;IACtE,MAAM,QAAQ,GAAG,yBAAyB,CAAC,QAAQ,CAAC,CAAC,WAAW,EAAE,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC;IAC9E,OAAO,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,OAAO,CAAC,EAAE,CAAC,OAAO,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;AACnE,CAAC;AAUD,SAAgB,mBAAmB,CAAC,IAA8B;IAC9D,OAAO,IAAI,EAAE,YAAY,IAAI,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC;AACtD,CAAC;AAQD,SAAgB,oBAAoB,CAAC,IAA8B;IAC/D,MAAM,QAAQ,GAAG,iCAAiC,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC,CAAC;IAC9E,IAAI,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,EAAE,CAAC,4BAAoB,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,EAAE,CAAC;QAC9D,OAAO,IAAI,CAAC;IAChB,CAAC;IAED,OAAO,4BAAoB,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,IAAI,EAAE,CAAC,CAAC,WAAW,EAAE,CAAC,IAAI,EAAE,CAAC,CAAC;AACjF,CAAC;AASY,QAAA,iBAAiB,GAAkC;IAC5D,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,gBAAgB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,OAAgB,CAAC,CAAC,CAAC;IAC7E,GAAG,MAAM,CAAC,WAAW,CAAC,mBAAmB,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC,GAAG,EAAE,MAAe,CAAC,CAAC,CAAC;IAC/E,CAAC,aAAa,CAAC,EAAE,KAAK;CACzB,CAAC;AAMW,QAAA,sBAAsB,GAAG,IAAI,GAAG,CAAS;IAClD,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,GAAG,gBAAgB;IACnB,aAAa;CAChB,CAAC,CAAC","sourcesContent":["export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';\n\nexport const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;\n\nconst IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];\nconst AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];\nconst VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];\nconst DOCUMENT_EXTENSIONS = ['txt', 'md', 'csv', 'json', 'doc', 'docx', 'xls', 'xlsx', 'ppt', 'pptx', 'zip', 'rar', '7z'];\nconst PDF_EXTENSION = 'pdf';\n\n/**\n * Extensions that must never be accepted as media uploads, regardless of declared mimetype or\n * admin-configured mediaTypes allowlist. Checked before any other resolution so a spoofed\n * Content-Type (e.g. application/octet-stream on an .html file) can't bypass this.\n */\nexport const DANGEROUS_EXTENSIONS = new Set([\n    'html', 'htm', 'xhtml', 'svg', 'xml',\n    'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',\n    'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',\n]);\n\n\n/**\n * Mimetypes that are never safe to accept, regardless of extension. These render as active\n * content in a browser (svg can carry <script>), so they are rejected even when the filename\n * looks harmless. Kept alongside DANGEROUS_EXTENSIONS so upload paths check both.\n */\nexport const DANGEROUS_MIME_TYPES = new Set([\n    'image/svg+xml', 'text/html', 'application/xhtml+xml',\n]);\n\n/**\n * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload\n * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already\n * decoded once. Malformed escape sequences are left as-is rather than thrown, since this runs\n * on attacker-controlled input and a literal `%` in a filename (`100%done.pdf`) is legal.\n */\nfunction decodePercentEncodingSafely(name: string): string {\n    let decoded = name;\n    for (let i = 0; i < 3; i++) {\n        let next: string;\n        try {\n            next = decodeURIComponent(decoded);\n        } catch {\n            return decoded;\n        }\n        if (next === decoded) {\n            return decoded;\n        }\n        decoded = next;\n    }\n    return decoded;\n}\n\n/**\n * Reduces a client-supplied name to the name that will actually be resolved on disk, so\n * extension checks can't be dodged by decorating it. Each step defends a known bypass:\n *\n *  - `evil.exe%2e`         -> percent-encoding a trailing dot (or anything else) hides the real\n *                             extension from naive string matching; decode before inspecting it.\n *  - `../../evil.exe`      -> only the final path segment is the file name.\n *  - `evil.exe\\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so\n *                             anything after it is invisible to the OS but visible to naive\n *                             validation.\n *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.\n *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving\n *                             a path, so these land on disk as evil.exe.\n */\nexport function normalizeUploadedFileName(fileName?: string | null): string {\n    if (!fileName) {\n        return '';\n    }\n\n    let name = decodePercentEncodingSafely(String(fileName));\n    name = name.split(/[/\\\\]/).pop() ?? '';\n\n    const nulIndex = name.indexOf('\\0');\n    if (nulIndex >= 0) {\n        name = name.slice(0, nulIndex);\n    }\n\n    const streamIndex = name.indexOf(':');\n    if (streamIndex >= 0) {\n        name = name.slice(0, streamIndex);\n    }\n\n    return name.replace(/[\\s.]+$/, '');\n}\n\n/**\n * The effective extension - what the OS/browser will treat the file as. Used for media\n * category resolution and inline-safety decisions. Always normalizes first, so\n * `evil.exe.` resolves to `exe` rather than to nothing.\n */\nexport function getLowercaseFileExtension(fileName?: string | null): string | undefined {\n    const name = normalizeUploadedFileName(fileName);\n\n    const lastDotIndex = name.lastIndexOf('.');\n    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {\n        return undefined;\n    }\n\n    return name.slice(lastDotIndex + 1).toLowerCase();\n}\n\n/**\n * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather\n * than only the effective extension so a dangerous type buried in a double extension\n * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve\n * such names by an earlier segment than the last one.\n *\n * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)\n * isn't rejected.\n */\nexport function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {\n    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');\n    return segments.slice(1).filter(segment => segment.length > 0);\n}\n\n/** Minimal shape of an uploaded file, so this module stays free of framework imports. */\nexport interface UploadedFileLike {\n    mimetype?: string;\n    originalname?: string;\n    filename?: string;\n}\n\n/** originalname is the client-supplied name; filename is multer's on-disk name. */\nexport function getUploadedFileName(file?: UploadedFileLike | null): string {\n    return file?.originalname ?? file?.filename ?? '';\n}\n\n/**\n * Single predicate for \"must never be stored\". Shared by every upload entry point\n * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.\n * Extensions are checked before mimetype so a spoofed Content-Type (e.g.\n * application/octet-stream, or image/png, on an .html file) can't bypass it.\n */\nexport function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {\n    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));\n    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {\n        return true;\n    }\n\n    return DANGEROUS_MIME_TYPES.has((file?.mimetype || '').toLowerCase().trim());\n}\n\n/**\n * Single source of truth for extension -> coarse media category. Shared by upload-time\n * validation (MediaFieldCrudManager) and serve-time header hardening (ServeStaticModule), so\n * both agree on which extensions belong to which category and neither drifts out of sync.\n * webm/ogg are shared between AUDIO_EXTENSIONS and VIDEO_EXTENSIONS - last one wins here, they\n * default to 'video' since that's the more common upload case.\n */\nexport const EXT_TO_MEDIA_TYPE: Record<string, MediaCategory> = {\n    ...Object.fromEntries(IMAGE_EXTENSIONS.map((ext) => [ext, 'image' as const])),\n    ...Object.fromEntries(AUDIO_EXTENSIONS.map((ext) => [ext, 'audio' as const])),\n    ...Object.fromEntries(VIDEO_EXTENSIONS.map((ext) => [ext, 'video' as const])),\n    ...Object.fromEntries(DOCUMENT_EXTENSIONS.map((ext) => [ext, 'file' as const])),\n    [PDF_EXTENSION]: 'pdf',\n};\n\n/**\n * Extensions safe to serve inline with their natural Content-Type; everything else served from\n * media-files-storage is forced to application/octet-stream + Content-Disposition: attachment.\n */\nexport const INLINE_SAFE_EXTENSIONS = new Set<string>([\n    ...IMAGE_EXTENSIONS,\n    ...AUDIO_EXTENSIONS,\n    ...VIDEO_EXTENSIONS,\n    PDF_EXTENSION,\n]);\n"]}

package/dist/helpers/bootstrap.helper.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAalE,OAAO,EAGL,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAyB3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IAEpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC,0BAA0B,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAM3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAgJjC;AAgBD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwCf"}
+{"version":3,"file":"bootstrap.helper.d.ts","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,MAAM,0BAA0B,CAAC;AAalE,OAAO,EAGL,uBAAuB,EACvB,oBAAoB,EACrB,MAAM,mBAAmB,CAAC;AAyB3B,MAAM,WAAW,mBAAmB;IAClC,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB;AAED,MAAM,WAAW,qBAAqB;IAEpC,YAAY,CAAC,EAAE,MAAM,CAAC;IAEtB,OAAO,CAAC,EAAE,mBAAmB,GAAG,KAAK,CAAC;IAEtC,0BAA0B,CAAC,EAAE,OAAO,CAAC,uBAAuB,CAAC,CAAC;IAE9D,QAAQ,CAAC,EAAE,oBAAoB,CAAC;IAEhC,gBAAgB,CAAC,EAAE,OAAO,CAAC;IAU3B,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB;AAeD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,EACpC,OAAO,GAAE,qBAA0B,GAClC,OAAO,CAAC,sBAAsB,CAAC,CAgJjC;AAgBD,wBAAsB,iBAAiB,CACrC,gBAAgB,EAAE,MAAM,OAAO,CAAC,GAAG,CAAC,GACnC,OAAO,CAAC,IAAI,CAAC,CAwCf"}

package/dist/helpers/bootstrap.helper.js

@@ -36,7 +36,7 @@ function registerGlobalProcessHandlers() {
 }
 async function bootstrapSolidApp(appModuleFactory, options = {}) {
     registerGlobalProcessHandlers();
-    const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, bodyLimit = '25mb', } = options;
+    const { globalPrefix = 'api', swagger = {}, permissionsPolicyOverrides = {}, security = {}, verboseBootstrap = false, bodyLimit = '10mb', } = options;
     const startTime = Date.now();
     const appModule = await appModuleFactory();
     const app = await core_1.NestFactory.create(appModule, {

package/dist/helpers/bootstrap.helper.js.map

@@ -1 +1 @@
-{"version":3,"file":"bootstrap.helper.js","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":";;;;;AAmFA,8CAmJC;AAgBD,8CA0CC;AAhSD,2CAA4E;AAC5E,uCAAsD;AAEtD,qDAAgD;AAChD,6CAAiE;AAEjE,oDAA4B;AAC5B,4CAAoB;AACpB,2BAAgC;AAChC,+BAA+B;AAC/B,+CAA2E;AAC3E,mDAAgD;AAChD,sDAA8D;AAC9D,yFAAoF;AACpF,+CAAwD;AACxD,uDAK2B;AAC3B,6DAAuD;AAIvD,SAAS,6BAA6B;IACpC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAGH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClI,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AA0CM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC,EACpC,UAAiC,EAAE;IAEnC,6BAA6B,EAAE,CAAC;IAEhC,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,OAAO,GAAG,EAAE,EACZ,0BAA0B,GAAG,EAAE,EAC/B,QAAQ,GAAG,EAAE,EACb,gBAAgB,GAAG,KAAK,EACxB,SAAS,GAAG,MAAM,GACnB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAyB,SAAS,EAAE;QAGtE,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,4BAAa,CAAC,YAAY,CAAC,EAAE,GAAG,IAAA,0CAAyB,GAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KACpH,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAA,oCAAe,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG;aACA,GAAG,CAAC,2CAA4B,CAAC;aACjC,GAAG,CAAC,kEAAkE,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAGjE,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,IAAA,mDAAiC,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAG7D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,KAAK,OAAO;QAChB,IAAI,KAAK,QAAQ;QACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,YAAY,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAGH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAA,8CAA4B,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC9F,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;IAEtC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAGD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,GAAG,YAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAKH,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAGtE,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE;KACrD,CAAC,CACH,CAAC;IAGF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QACzH,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,KAAK,CAAC;aACf,cAAc,CAAC,WAAW,CAAC;aAC3B,UAAU,CAAC,OAAO,CAAC;aACnB,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;aAClD,aAAa,CACZ;YACE,WAAW,EAAE,sDAAsD;YACnE,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,QAAQ;SACb,EACD,KAAK,CACN;aACA,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,uBAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAGD,GAAG,CAAC,qBAAqB,CACvB,IAAI,mCAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAS,CAAC,EAAE;QACjD,wBAAwB,EAAE,IAAI;KAE/B,CAAC,EACF,IAAI,mDAAuB,EAAE,CAC9B,CAAC;IAGF,GAAG,CAAC,UAAU,CAAC,IAAA,qCAAuB,GAAE,CAAC,CAAC;IAI1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAClC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,2CAA4B,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,OAAO,OAAO,YAAY,CAAC,CAAC;IAEvF,OAAO,GAAG,CAAC;AACb,CAAC;AAgBM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC;IAEpC,6BAA6B,EAAE,CAAC;IAEhC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,eAAe,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAGvC,MAAM,GAAG,GAAG,MAAM,+BAAc,CAAC,oBAAoB,CAAC,SAAS,EAAE;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;KACjF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,+BAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';\nimport { NestFactory, Reflector } from '@nestjs/core';\nimport { NestExpressApplication } from '@nestjs/platform-express';\nimport { WsAdapter } from '@nestjs/platform-ws';\nimport { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';\nimport { NextFunction, Request, Response } from 'express';\nimport helmet from 'helmet';\nimport qs from 'qs';\nimport { existsSync } from 'fs';\nimport { resolve } from 'path';\nimport { WINSTON_MODULE_NEST_PROVIDER, WinstonModule } from 'nest-winston';\nimport { CommandFactory } from 'nest-commander';\nimport { createWinstonLoggerConfig } from '../winston.logger';\nimport { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';\nimport { buildDefaultCorsOptions } from './cors.helper';\nimport {\n  buildDefaultSecurityHeaderOptions,\n  buildPermissionsPolicyHeader,\n  PermissionsPolicyConfig,\n  SolidSecurityOptions,\n} from './security.helper';\nimport { parseBooleanEnv } from './environment.helper';\n\n// ---- Shared process handlers ----\n\nfunction registerGlobalProcessHandlers() {\n  process.on('unhandledRejection', (reason, promise) => {\n    console.error('Unhandled Rejection at:', promise, 'reason:', reason);\n  });\n\n  process.on('uncaughtException', (err) => {\n    console.error('Uncaught Exception thrown:', err);\n  });\n\n  // Suppress pg deprecation warning caused by TypeORM's internal query scheduling\n  process.on('warning', (warning) => {\n    if (warning.name === 'DeprecationWarning' && (warning.message.includes('client.query()') || warning.message.includes('punycode'))) {\n      return;\n    }\n    console.warn(warning);\n  });\n}\n\n// ---- HTTP server bootstrap ----\n\nexport interface SolidSwaggerOptions {\n  title?: string;\n  description?: string;\n  version?: string;\n}\n\nexport interface SolidBootstrapOptions {\n  /** Global API prefix. Defaults to 'api'. Set to '' to disable. */\n  globalPrefix?: string;\n  /** Swagger configuration. Set to false to disable Swagger entirely. */\n  swagger?: SolidSwaggerOptions | false;\n  /** Permissions-Policy header overrides (merged with defaults). */\n  permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;\n  /** Security header overrides, including iframe frame-ancestor allowlists. */\n  security?: SolidSecurityOptions;\n  /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */\n  verboseBootstrap?: boolean;\n  /**\n   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible\n   * string (e.g. '25mb', '512kb'). Defaults to '25mb'.\n   * Note: does not apply to multipart uploads — those are governed by Multer.\n   */\n  bodyLimit?: string;\n}\n\n/**\n * Bootstraps a SolidX NestJS HTTP application with sensible defaults:\n * security headers, CORS, Winston logger, ValidationPipe,\n * WrapResponseInterceptor, qs deep query parsing, Swagger, and the\n * pg BIGINT type parser.\n *\n * @example\n * // main.ts\n * bootstrapSolidApp(() => AppModule.forRoot(), {\n *   swagger: { title: 'My API', description: 'My API description' },\n *   security: { frameAncestors: [\"'self'\", 'https://portal.example.com'] },\n * });\n */\nexport async function bootstrapSolidApp(\n  appModuleFactory: () => Promise<any>,\n  options: SolidBootstrapOptions = {},\n): Promise<NestExpressApplication> {\n  registerGlobalProcessHandlers();\n\n  const {\n    globalPrefix = 'api',\n    swagger = {},\n    permissionsPolicyOverrides = {},\n    security = {},\n    verboseBootstrap = false,\n    bodyLimit = '25mb',\n  } = options;\n\n  const startTime = Date.now();\n  const appModule = await appModuleFactory();\n  const app = await NestFactory.create<NestExpressApplication>(appModule, {\n    // Nest's default parsers are registered during init() with a 100kb limit, ahead of\n    // any module middleware. Disable them so the parsers below own the limit outright.\n    bodyParser: false,\n    logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),\n  });\n\n  const apiEnabled = parseBooleanEnv('API_ENABLED', true);\n\n  if (!apiEnabled) {\n    await app.init();\n    app\n      .get(WINSTON_MODULE_NEST_PROVIDER)\n      .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');\n    return app;\n  }\n\n  // Health check at root path\n  const server = app.getHttpAdapter().getInstance();\n  server.get('/', (_req, res) => res.status(200).send('SOLID OK'));\n\n  // Security headers\n  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));\n\n  // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.\n  const isSwaggerPath = (path: string) =>\n    path === '/docs' ||\n    path === '/docs/' ||\n    path.startsWith('/docs/') ||\n    path === '/docs-json' ||\n    path === '/docs-yaml';\n\n  app.use((req: Request, res: Response, next: NextFunction) => {\n    if (isSwaggerPath(req.path)) {\n      res.removeHeader('Content-Security-Policy');\n    }\n    next();\n  });\n\n  // Permissions-Policy header\n  app.use((_req: Request, res: Response, next: NextFunction) => {\n    res.setHeader('Permissions-Policy', buildPermissionsPolicyHeader(permissionsPolicyOverrides));\n    next();\n  });\n\n  const port = process.env.PORT || 3000;\n\n  if (globalPrefix) {\n    app.setGlobalPrefix(globalPrefix);\n  }\n\n  // qs-based deep query parsing (dot notation, nested objects, arrays)\n  app.use((req: Request, _res: Response, next: NextFunction) => {\n    if (req.query) {\n      req.query = qs.parse(req.url.split('?')[1], {\n        allowDots: true,\n        depth: 20,\n        arrayLimit: 100,\n      });\n    }\n    next();\n  });\n\n  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).\n  // Registered here so the middleware order Nest applied by default is preserved:\n  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.\n  app.useBodyParser('json', { limit: bodyLimit });\n  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });\n\n  // Global ValidationPipe\n  app.useGlobalPipes(\n    new ValidationPipe({\n      transform: true,\n      transformOptions: { enableImplicitConversion: true },\n    }),\n  );\n\n  // Swagger\n  if (swagger !== false) {\n    const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger;\n    const swaggerConfig = new DocumentBuilder()\n      .setTitle(title)\n      .setDescription(description)\n      .setVersion(version)\n      .setExternalDoc('Postman Collection', '/docs-json')\n      .addBearerAuth(\n        {\n          description: 'Please enter token in following format: Bearer <JWT>',\n          name: 'Authorization',\n          bearerFormat: 'Bearer',\n          scheme: 'Bearer',\n          type: 'http',\n          in: 'Header',\n        },\n        'jwt',\n      )\n      .build();\n    const document = SwaggerModule.createDocument(app, swaggerConfig);\n    SwaggerModule.setup('/docs', app, document);\n  }\n\n  // Global interceptor\n  app.useGlobalInterceptors(\n    new ClassSerializerInterceptor(app.get(Reflector), {\n      enableImplicitConversion: true, // optional but handy\n      // groups: ['client'], // if you use groups\n    }),\n    new WrapResponseInterceptor()\n  );\n\n  // CORS\n  app.enableCors(buildDefaultCorsOptions());\n\n  // Fix pg returning BIGINT columns as strings\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  const types = require('pg').types;\n  types.setTypeParser(types.builtins.INT8, (val: string) => parseInt(val));\n\n  app.useWebSocketAdapter(new WsAdapter(app));\n\n  await app.listen(port);\n\n  // Wire up Winston as the runtime logger only AFTER listen — this suppresses all\n  // framework init noise (route mapping, module deps, onModuleInit) during boot.\n  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));\n\n  const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);\n  process.stdout.write(`\\x1b[32mServer started on port ${port} in ${elapsed}s\\x1b[0m\\n`);\n\n  return app;\n}\n\n// ---- CLI bootstrap ----\n\n/**\n * Bootstraps a SolidX NestJS CLI application using nest-commander.\n * Handles verbose flag stripping, project root validation, and clean process exit.\n *\n * @example\n * // main-cli.ts\n * #!/usr/bin/env node\n * import { bootstrapSolidCli } from '@solidxai/core';\n * import { AppModule } from './app.module';\n *\n * bootstrapSolidCli(() => AppModule.forRoot());\n */\nexport async function bootstrapSolidCli(\n  appModuleFactory: () => Promise<any>,\n): Promise<void> {\n  registerGlobalProcessHandlers();\n\n  process.on('exit', (code) => {\n    if (code !== 0) {\n      console.error(`Exiting with error status code: ${code}`);\n    }\n  });\n\n  // Validate that cwd is a valid Solid API project\n  const packageJsonPath = resolve(process.cwd(), 'package.json');\n  if (!existsSync(packageJsonPath)) {\n    console.error('Does not seem to be a valid solid-api project.');\n    console.error('Exit reason: missing package.json in the current directory.');\n    process.exit(1);\n  }\n\n  // Strip --verbose / -v before nest-commander processes argv\n  const showLogs = process.argv.includes('--verbose') || process.argv.includes('-v');\n  for (const flag of ['--verbose', '-v']) {\n    const idx = process.argv.indexOf(flag);\n    if (idx !== -1) process.argv.splice(idx, 1);\n  }\n\n  const appModule = await appModuleFactory();\n  process.env.SOLID_CLI_RUNNING = 'true';\n\n  // @ts-ignore\n  const app = await CommandFactory.createWithoutRunning(appModule, {\n    logger: showLogs ? ['debug', 'error', 'fatal', 'log', 'verbose', 'warn'] : false,\n  });\n\n  try {\n    await CommandFactory.runApplication(app);\n  } catch (e) {\n    console.error('CLI exited abruptly due to an error:', e);\n    process.exit(1);\n  }\n\n  process.exit(0);\n}\n"]}
+{"version":3,"file":"bootstrap.helper.js","sourceRoot":"","sources":["../../src/helpers/bootstrap.helper.ts"],"names":[],"mappings":";;;;;AAuFA,8CAmJC;AAgBD,8CA0CC;AApSD,2CAA4E;AAC5E,uCAAsD;AAEtD,qDAAgD;AAChD,6CAAiE;AAEjE,oDAA4B;AAC5B,4CAAoB;AACpB,2BAAgC;AAChC,+BAA+B;AAC/B,+CAA2E;AAC3E,mDAAgD;AAChD,sDAA8D;AAC9D,yFAAoF;AACpF,+CAAwD;AACxD,uDAK2B;AAC3B,6DAAuD;AAIvD,SAAS,6BAA6B;IACpC,OAAO,CAAC,EAAE,CAAC,oBAAoB,EAAE,CAAC,MAAM,EAAE,OAAO,EAAE,EAAE;QACnD,OAAO,CAAC,KAAK,CAAC,yBAAyB,EAAE,OAAO,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC;IACvE,CAAC,CAAC,CAAC;IAEH,OAAO,CAAC,EAAE,CAAC,mBAAmB,EAAE,CAAC,GAAG,EAAE,EAAE;QACtC,OAAO,CAAC,KAAK,CAAC,4BAA4B,EAAE,GAAG,CAAC,CAAC;IACnD,CAAC,CAAC,CAAC;IAGH,OAAO,CAAC,EAAE,CAAC,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;QAChC,IAAI,OAAO,CAAC,IAAI,KAAK,oBAAoB,IAAI,CAAC,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,gBAAgB,CAAC,IAAI,OAAO,CAAC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAC,CAAC,EAAE,CAAC;YAClI,OAAO;QACT,CAAC;QACD,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;IACxB,CAAC,CAAC,CAAC;AACL,CAAC;AA8CM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC,EACpC,UAAiC,EAAE;IAEnC,6BAA6B,EAAE,CAAC;IAEhC,MAAM,EACJ,YAAY,GAAG,KAAK,EACpB,OAAO,GAAG,EAAE,EACZ,0BAA0B,GAAG,EAAE,EAC/B,QAAQ,GAAG,EAAE,EACb,gBAAgB,GAAG,KAAK,EACxB,SAAS,GAAG,MAAM,GACnB,GAAG,OAAO,CAAC;IAEZ,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,EAAE,CAAC;IAC7B,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,MAAM,GAAG,GAAG,MAAM,kBAAW,CAAC,MAAM,CAAyB,SAAS,EAAE;QAGtE,UAAU,EAAE,KAAK;QACjB,MAAM,EAAE,4BAAa,CAAC,YAAY,CAAC,EAAE,GAAG,IAAA,0CAAyB,GAAE,EAAE,KAAK,EAAE,gBAAgB,CAAC,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,OAAO,EAAE,CAAC;KACpH,CAAC,CAAC;IAEH,MAAM,UAAU,GAAG,IAAA,oCAAe,EAAC,aAAa,EAAE,IAAI,CAAC,CAAC;IAExD,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,MAAM,GAAG,CAAC,IAAI,EAAE,CAAC;QACjB,GAAG;aACA,GAAG,CAAC,2CAA4B,CAAC;aACjC,GAAG,CAAC,kEAAkE,EAAE,WAAW,CAAC,CAAC;QACxF,OAAO,GAAG,CAAC;IACb,CAAC;IAGD,MAAM,MAAM,GAAG,GAAG,CAAC,cAAc,EAAE,CAAC,WAAW,EAAE,CAAC;IAClD,MAAM,CAAC,GAAG,CAAC,GAAG,EAAE,CAAC,IAAI,EAAE,GAAG,EAAE,EAAE,CAAC,GAAG,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC,CAAC;IAGjE,GAAG,CAAC,GAAG,CAAC,IAAA,gBAAM,EAAC,IAAA,mDAAiC,EAAC,QAAQ,CAAC,CAAC,CAAC,CAAC;IAG7D,MAAM,aAAa,GAAG,CAAC,IAAY,EAAE,EAAE,CACrC,IAAI,KAAK,OAAO;QAChB,IAAI,KAAK,QAAQ;QACjB,IAAI,CAAC,UAAU,CAAC,QAAQ,CAAC;QACzB,IAAI,KAAK,YAAY;QACrB,IAAI,KAAK,YAAY,CAAC;IAExB,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC1D,IAAI,aAAa,CAAC,GAAG,CAAC,IAAI,CAAC,EAAE,CAAC;YAC5B,GAAG,CAAC,YAAY,CAAC,yBAAyB,CAAC,CAAC;QAC9C,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAGH,GAAG,CAAC,GAAG,CAAC,CAAC,IAAa,EAAE,GAAa,EAAE,IAAkB,EAAE,EAAE;QAC3D,GAAG,CAAC,SAAS,CAAC,oBAAoB,EAAE,IAAA,8CAA4B,EAAC,0BAA0B,CAAC,CAAC,CAAC;QAC9F,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAEH,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,IAAI,IAAI,IAAI,CAAC;IAEtC,IAAI,YAAY,EAAE,CAAC;QACjB,GAAG,CAAC,eAAe,CAAC,YAAY,CAAC,CAAC;IACpC,CAAC;IAGD,GAAG,CAAC,GAAG,CAAC,CAAC,GAAY,EAAE,IAAc,EAAE,IAAkB,EAAE,EAAE;QAC3D,IAAI,GAAG,CAAC,KAAK,EAAE,CAAC;YACd,GAAG,CAAC,KAAK,GAAG,YAAE,CAAC,KAAK,CAAC,GAAG,CAAC,GAAG,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,EAAE;gBAC1C,SAAS,EAAE,IAAI;gBACf,KAAK,EAAE,EAAE;gBACT,UAAU,EAAE,GAAG;aAChB,CAAC,CAAC;QACL,CAAC;QACD,IAAI,EAAE,CAAC;IACT,CAAC,CAAC,CAAC;IAKH,GAAG,CAAC,aAAa,CAAC,MAAM,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,CAAC,CAAC;IAChD,GAAG,CAAC,aAAa,CAAC,YAAY,EAAE,EAAE,KAAK,EAAE,SAAS,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC,CAAC;IAGtE,GAAG,CAAC,cAAc,CAChB,IAAI,uBAAc,CAAC;QACjB,SAAS,EAAE,IAAI;QACf,gBAAgB,EAAE,EAAE,wBAAwB,EAAE,IAAI,EAAE;KACrD,CAAC,CACH,CAAC;IAGF,IAAI,OAAO,KAAK,KAAK,EAAE,CAAC;QACtB,MAAM,EAAE,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,cAAc,EAAE,WAAW,GAAG,OAAO,CAAC,GAAG,CAAC,qBAAqB,EAAE,OAAO,GAAG,KAAK,EAAE,GAAG,OAAO,CAAC;QACzH,MAAM,aAAa,GAAG,IAAI,yBAAe,EAAE;aACxC,QAAQ,CAAC,KAAK,CAAC;aACf,cAAc,CAAC,WAAW,CAAC;aAC3B,UAAU,CAAC,OAAO,CAAC;aACnB,cAAc,CAAC,oBAAoB,EAAE,YAAY,CAAC;aAClD,aAAa,CACZ;YACE,WAAW,EAAE,sDAAsD;YACnE,IAAI,EAAE,eAAe;YACrB,YAAY,EAAE,QAAQ;YACtB,MAAM,EAAE,QAAQ;YAChB,IAAI,EAAE,MAAM;YACZ,EAAE,EAAE,QAAQ;SACb,EACD,KAAK,CACN;aACA,KAAK,EAAE,CAAC;QACX,MAAM,QAAQ,GAAG,uBAAa,CAAC,cAAc,CAAC,GAAG,EAAE,aAAa,CAAC,CAAC;QAClE,uBAAa,CAAC,KAAK,CAAC,OAAO,EAAE,GAAG,EAAE,QAAQ,CAAC,CAAC;IAC9C,CAAC;IAGD,GAAG,CAAC,qBAAqB,CACvB,IAAI,mCAA0B,CAAC,GAAG,CAAC,GAAG,CAAC,gBAAS,CAAC,EAAE;QACjD,wBAAwB,EAAE,IAAI;KAE/B,CAAC,EACF,IAAI,mDAAuB,EAAE,CAC9B,CAAC;IAGF,GAAG,CAAC,UAAU,CAAC,IAAA,qCAAuB,GAAE,CAAC,CAAC;IAI1C,MAAM,KAAK,GAAG,OAAO,CAAC,IAAI,CAAC,CAAC,KAAK,CAAC;IAClC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,QAAQ,CAAC,IAAI,EAAE,CAAC,GAAW,EAAE,EAAE,CAAC,QAAQ,CAAC,GAAG,CAAC,CAAC,CAAC;IAEzE,GAAG,CAAC,mBAAmB,CAAC,IAAI,uBAAS,CAAC,GAAG,CAAC,CAAC,CAAC;IAE5C,MAAM,GAAG,CAAC,MAAM,CAAC,IAAI,CAAC,CAAC;IAIvB,GAAG,CAAC,SAAS,CAAC,GAAG,CAAC,GAAG,CAAC,2CAA4B,CAAC,CAAC,CAAC;IAErD,MAAM,OAAO,GAAG,CAAC,CAAC,IAAI,CAAC,GAAG,EAAE,GAAG,SAAS,CAAC,GAAG,IAAI,CAAC,CAAC,OAAO,CAAC,CAAC,CAAC,CAAC;IAC7D,OAAO,CAAC,MAAM,CAAC,KAAK,CAAC,kCAAkC,IAAI,OAAO,OAAO,YAAY,CAAC,CAAC;IAEvF,OAAO,GAAG,CAAC;AACb,CAAC;AAgBM,KAAK,UAAU,iBAAiB,CACrC,gBAAoC;IAEpC,6BAA6B,EAAE,CAAC;IAEhC,OAAO,CAAC,EAAE,CAAC,MAAM,EAAE,CAAC,IAAI,EAAE,EAAE;QAC1B,IAAI,IAAI,KAAK,CAAC,EAAE,CAAC;YACf,OAAO,CAAC,KAAK,CAAC,mCAAmC,IAAI,EAAE,CAAC,CAAC;QAC3D,CAAC;IACH,CAAC,CAAC,CAAC;IAGH,MAAM,eAAe,GAAG,IAAA,cAAO,EAAC,OAAO,CAAC,GAAG,EAAE,EAAE,cAAc,CAAC,CAAC;IAC/D,IAAI,CAAC,IAAA,eAAU,EAAC,eAAe,CAAC,EAAE,CAAC;QACjC,OAAO,CAAC,KAAK,CAAC,gDAAgD,CAAC,CAAC;QAChE,OAAO,CAAC,KAAK,CAAC,6DAA6D,CAAC,CAAC;QAC7E,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAGD,MAAM,QAAQ,GAAG,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,IAAI,CAAC,QAAQ,CAAC,IAAI,CAAC,CAAC;IACnF,KAAK,MAAM,IAAI,IAAI,CAAC,WAAW,EAAE,IAAI,CAAC,EAAE,CAAC;QACvC,MAAM,GAAG,GAAG,OAAO,CAAC,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC;QACvC,IAAI,GAAG,KAAK,CAAC,CAAC;YAAE,OAAO,CAAC,IAAI,CAAC,MAAM,CAAC,GAAG,EAAE,CAAC,CAAC,CAAC;IAC9C,CAAC;IAED,MAAM,SAAS,GAAG,MAAM,gBAAgB,EAAE,CAAC;IAC3C,OAAO,CAAC,GAAG,CAAC,iBAAiB,GAAG,MAAM,CAAC;IAGvC,MAAM,GAAG,GAAG,MAAM,+BAAc,CAAC,oBAAoB,CAAC,SAAS,EAAE;QAC/D,MAAM,EAAE,QAAQ,CAAC,CAAC,CAAC,CAAC,OAAO,EAAE,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,SAAS,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC,KAAK;KACjF,CAAC,CAAC;IAEH,IAAI,CAAC;QACH,MAAM,+BAAc,CAAC,cAAc,CAAC,GAAG,CAAC,CAAC;IAC3C,CAAC;IAAC,OAAO,CAAC,EAAE,CAAC;QACX,OAAO,CAAC,KAAK,CAAC,sCAAsC,EAAE,CAAC,CAAC,CAAC;QACzD,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;IAClB,CAAC;IAED,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;AAClB,CAAC","sourcesContent":["import { ClassSerializerInterceptor, ValidationPipe } from '@nestjs/common';\nimport { NestFactory, Reflector } from '@nestjs/core';\nimport { NestExpressApplication } from '@nestjs/platform-express';\nimport { WsAdapter } from '@nestjs/platform-ws';\nimport { DocumentBuilder, SwaggerModule } from '@nestjs/swagger';\nimport { NextFunction, Request, Response } from 'express';\nimport helmet from 'helmet';\nimport qs from 'qs';\nimport { existsSync } from 'fs';\nimport { resolve } from 'path';\nimport { WINSTON_MODULE_NEST_PROVIDER, WinstonModule } from 'nest-winston';\nimport { CommandFactory } from 'nest-commander';\nimport { createWinstonLoggerConfig } from '../winston.logger';\nimport { WrapResponseInterceptor } from '../interceptors/wrap-response.interceptor';\nimport { buildDefaultCorsOptions } from './cors.helper';\nimport {\n  buildDefaultSecurityHeaderOptions,\n  buildPermissionsPolicyHeader,\n  PermissionsPolicyConfig,\n  SolidSecurityOptions,\n} from './security.helper';\nimport { parseBooleanEnv } from './environment.helper';\n\n// ---- Shared process handlers ----\n\nfunction registerGlobalProcessHandlers() {\n  process.on('unhandledRejection', (reason, promise) => {\n    console.error('Unhandled Rejection at:', promise, 'reason:', reason);\n  });\n\n  process.on('uncaughtException', (err) => {\n    console.error('Uncaught Exception thrown:', err);\n  });\n\n  // Suppress pg deprecation warning caused by TypeORM's internal query scheduling\n  process.on('warning', (warning) => {\n    if (warning.name === 'DeprecationWarning' && (warning.message.includes('client.query()') || warning.message.includes('punycode'))) {\n      return;\n    }\n    console.warn(warning);\n  });\n}\n\n// ---- HTTP server bootstrap ----\n\nexport interface SolidSwaggerOptions {\n  title?: string;\n  description?: string;\n  version?: string;\n}\n\nexport interface SolidBootstrapOptions {\n  /** Global API prefix. Defaults to 'api'. Set to '' to disable. */\n  globalPrefix?: string;\n  /** Swagger configuration. Set to false to disable Swagger entirely. */\n  swagger?: SolidSwaggerOptions | false;\n  /** Permissions-Policy header overrides (merged with defaults). */\n  permissionsPolicyOverrides?: Partial<PermissionsPolicyConfig>;\n  /** Security header overrides, including iframe frame-ancestor allowlists. */\n  security?: SolidSecurityOptions;\n  /** Show full NestJS init logs during bootstrap (route mapping, module deps, pollers). Defaults to false. */\n  verboseBootstrap?: boolean;\n  /**\n   * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible\n   * string (e.g. '10mb', '512kb'). Defaults to '10mb'.\n   *\n   * Does NOT apply to multipart/form-data uploads: body-parser matches on Content-Type,\n   * so multipart requests skip these parsers entirely and are handled by Multer. Raise\n   * this only for large structured JSON (e.g. /bulk arrays), bearing in mind the parsed\n   * object graph can retain several times the raw byte size.\n   */\n  bodyLimit?: string;\n}\n\n/**\n * Bootstraps a SolidX NestJS HTTP application with sensible defaults:\n * security headers, CORS, Winston logger, ValidationPipe,\n * WrapResponseInterceptor, qs deep query parsing, Swagger, and the\n * pg BIGINT type parser.\n *\n * @example\n * // main.ts\n * bootstrapSolidApp(() => AppModule.forRoot(), {\n *   swagger: { title: 'My API', description: 'My API description' },\n *   security: { frameAncestors: [\"'self'\", 'https://portal.example.com'] },\n * });\n */\nexport async function bootstrapSolidApp(\n  appModuleFactory: () => Promise<any>,\n  options: SolidBootstrapOptions = {},\n): Promise<NestExpressApplication> {\n  registerGlobalProcessHandlers();\n\n  const {\n    globalPrefix = 'api',\n    swagger = {},\n    permissionsPolicyOverrides = {},\n    security = {},\n    verboseBootstrap = false,\n    bodyLimit = '10mb',\n  } = options;\n\n  const startTime = Date.now();\n  const appModule = await appModuleFactory();\n  const app = await NestFactory.create<NestExpressApplication>(appModule, {\n    // Nest's default parsers are registered during init() with a 100kb limit, ahead of\n    // any module middleware. Disable them so the parsers below own the limit outright.\n    bodyParser: false,\n    logger: WinstonModule.createLogger({ ...createWinstonLoggerConfig(), level: verboseBootstrap ? 'debug' : 'error' }),\n  });\n\n  const apiEnabled = parseBooleanEnv('API_ENABLED', true);\n\n  if (!apiEnabled) {\n    await app.init();\n    app\n      .get(WINSTON_MODULE_NEST_PROVIDER)\n      .log('API server disabled via API_ENABLED=false. Skipping HTTP listen.', 'Bootstrap');\n    return app;\n  }\n\n  // Health check at root path\n  const server = app.getHttpAdapter().getInstance();\n  server.get('/', (_req, res) => res.status(200).send('SOLID OK'));\n\n  // Security headers\n  app.use(helmet(buildDefaultSecurityHeaderOptions(security)));\n\n  // Nest's Swagger UI HTML injects inline styles; keep CSP strict elsewhere.\n  const isSwaggerPath = (path: string) =>\n    path === '/docs' ||\n    path === '/docs/' ||\n    path.startsWith('/docs/') ||\n    path === '/docs-json' ||\n    path === '/docs-yaml';\n\n  app.use((req: Request, res: Response, next: NextFunction) => {\n    if (isSwaggerPath(req.path)) {\n      res.removeHeader('Content-Security-Policy');\n    }\n    next();\n  });\n\n  // Permissions-Policy header\n  app.use((_req: Request, res: Response, next: NextFunction) => {\n    res.setHeader('Permissions-Policy', buildPermissionsPolicyHeader(permissionsPolicyOverrides));\n    next();\n  });\n\n  const port = process.env.PORT || 3000;\n\n  if (globalPrefix) {\n    app.setGlobalPrefix(globalPrefix);\n  }\n\n  // qs-based deep query parsing (dot notation, nested objects, arrays)\n  app.use((req: Request, _res: Response, next: NextFunction) => {\n    if (req.query) {\n      req.query = qs.parse(req.url.split('?')[1], {\n        allowDots: true,\n        depth: 20,\n        arrayLimit: 100,\n      });\n    }\n    next();\n  });\n\n  // Body parsers — replaces Nest's default 100kb parsers (disabled via bodyParser: false).\n  // Registered here so the middleware order Nest applied by default is preserved:\n  // helmet -> CSP -> Permissions-Policy -> qs -> body parsers -> routes.\n  app.useBodyParser('json', { limit: bodyLimit });\n  app.useBodyParser('urlencoded', { limit: bodyLimit, extended: true });\n\n  // Global ValidationPipe\n  app.useGlobalPipes(\n    new ValidationPipe({\n      transform: true,\n      transformOptions: { enableImplicitConversion: true },\n    }),\n  );\n\n  // Swagger\n  if (swagger !== false) {\n    const { title = process.env.SOLID_APP_NAME, description = process.env.SOLID_APP_DESCRIPTION, version = '1.0' } = swagger;\n    const swaggerConfig = new DocumentBuilder()\n      .setTitle(title)\n      .setDescription(description)\n      .setVersion(version)\n      .setExternalDoc('Postman Collection', '/docs-json')\n      .addBearerAuth(\n        {\n          description: 'Please enter token in following format: Bearer <JWT>',\n          name: 'Authorization',\n          bearerFormat: 'Bearer',\n          scheme: 'Bearer',\n          type: 'http',\n          in: 'Header',\n        },\n        'jwt',\n      )\n      .build();\n    const document = SwaggerModule.createDocument(app, swaggerConfig);\n    SwaggerModule.setup('/docs', app, document);\n  }\n\n  // Global interceptor\n  app.useGlobalInterceptors(\n    new ClassSerializerInterceptor(app.get(Reflector), {\n      enableImplicitConversion: true, // optional but handy\n      // groups: ['client'], // if you use groups\n    }),\n    new WrapResponseInterceptor()\n  );\n\n  // CORS\n  app.enableCors(buildDefaultCorsOptions());\n\n  // Fix pg returning BIGINT columns as strings\n  // eslint-disable-next-line @typescript-eslint/no-var-requires\n  const types = require('pg').types;\n  types.setTypeParser(types.builtins.INT8, (val: string) => parseInt(val));\n\n  app.useWebSocketAdapter(new WsAdapter(app));\n\n  await app.listen(port);\n\n  // Wire up Winston as the runtime logger only AFTER listen — this suppresses all\n  // framework init noise (route mapping, module deps, onModuleInit) during boot.\n  app.useLogger(app.get(WINSTON_MODULE_NEST_PROVIDER));\n\n  const elapsed = ((Date.now() - startTime) / 1000).toFixed(2);\n  process.stdout.write(`\\x1b[32mServer started on port ${port} in ${elapsed}s\\x1b[0m\\n`);\n\n  return app;\n}\n\n// ---- CLI bootstrap ----\n\n/**\n * Bootstraps a SolidX NestJS CLI application using nest-commander.\n * Handles verbose flag stripping, project root validation, and clean process exit.\n *\n * @example\n * // main-cli.ts\n * #!/usr/bin/env node\n * import { bootstrapSolidCli } from '@solidxai/core';\n * import { AppModule } from './app.module';\n *\n * bootstrapSolidCli(() => AppModule.forRoot());\n */\nexport async function bootstrapSolidCli(\n  appModuleFactory: () => Promise<any>,\n): Promise<void> {\n  registerGlobalProcessHandlers();\n\n  process.on('exit', (code) => {\n    if (code !== 0) {\n      console.error(`Exiting with error status code: ${code}`);\n    }\n  });\n\n  // Validate that cwd is a valid Solid API project\n  const packageJsonPath = resolve(process.cwd(), 'package.json');\n  if (!existsSync(packageJsonPath)) {\n    console.error('Does not seem to be a valid solid-api project.');\n    console.error('Exit reason: missing package.json in the current directory.');\n    process.exit(1);\n  }\n\n  // Strip --verbose / -v before nest-commander processes argv\n  const showLogs = process.argv.includes('--verbose') || process.argv.includes('-v');\n  for (const flag of ['--verbose', '-v']) {\n    const idx = process.argv.indexOf(flag);\n    if (idx !== -1) process.argv.splice(idx, 1);\n  }\n\n  const appModule = await appModuleFactory();\n  process.env.SOLID_CLI_RUNNING = 'true';\n\n  // @ts-ignore\n  const app = await CommandFactory.createWithoutRunning(appModule, {\n    logger: showLogs ? ['debug', 'error', 'fatal', 'log', 'verbose', 'warn'] : false,\n  });\n\n  try {\n    await CommandFactory.runApplication(app);\n  } catch (e) {\n    console.error('CLI exited abruptly due to an error:', e);\n    process.exit(1);\n  }\n\n  process.exit(0);\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.13-beta.16",
+  "version": "0.1.13-beta.18",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",

package/src/constants/media-file-types.ts

@@ -29,10 +29,35 @@ export const DANGEROUS_MIME_TYPES = new Set([
     'image/svg+xml', 'text/html', 'application/xhtml+xml',
 ]);
 
+/**
+ * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload
+ * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already
+ * decoded once. Malformed escape sequences are left as-is rather than thrown, since this runs
+ * on attacker-controlled input and a literal `%` in a filename (`100%done.pdf`) is legal.
+ */
+function decodePercentEncodingSafely(name: string): string {
+    let decoded = name;
+    for (let i = 0; i < 3; i++) {
+        let next: string;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch {
+            return decoded;
+        }
+        if (next === decoded) {
+            return decoded;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
+
 /**
  * Reduces a client-supplied name to the name that will actually be resolved on disk, so
  * extension checks can't be dodged by decorating it. Each step defends a known bypass:
  *
+ *  - `evil.exe%2e`         -> percent-encoding a trailing dot (or anything else) hides the real
+ *                             extension from naive string matching; decode before inspecting it.
  *  - `../../evil.exe`      -> only the final path segment is the file name.
  *  - `evil.exe\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so
  *                             anything after it is invisible to the OS but visible to naive
@@ -46,7 +71,8 @@ export function normalizeUploadedFileName(fileName?: string | null): string {
         return '';
     }
 
-    let name = String(fileName).split(/[/\\]/).pop() ?? '';
+    let name = decodePercentEncodingSafely(String(fileName));
+    name = name.split(/[/\\]/).pop() ?? '';
 
     const nulIndex = name.indexOf('\0');
     if (nulIndex >= 0) {

package/src/helpers/bootstrap.helper.ts

@@ -62,8 +62,12 @@ export interface SolidBootstrapOptions {
   verboseBootstrap?: boolean;
   /**
    * Max request body size for JSON and urlencoded payloads, as a `bytes`-compatible
-   * string (e.g. '25mb', '512kb'). Defaults to '25mb'.
-   * Note: does not apply to multipart uploads — those are governed by Multer.
+   * string (e.g. '10mb', '512kb'). Defaults to '10mb'.
+   *
+   * Does NOT apply to multipart/form-data uploads: body-parser matches on Content-Type,
+   * so multipart requests skip these parsers entirely and are handled by Multer. Raise
+   * this only for large structured JSON (e.g. /bulk arrays), bearing in mind the parsed
+   * object graph can retain several times the raw byte size.
    */
   bodyLimit?: string;
 }
@@ -93,7 +97,7 @@ export async function bootstrapSolidApp(
     permissionsPolicyOverrides = {},
     security = {},
     verboseBootstrap = false,
-    bodyLimit = '25mb',
+    bodyLimit = '10mb',
   } = options;
 
   const startTime = Date.now();