@solidxai/core 0.1.13-beta.9 → 0.1.13

package/dist/theme/theme-registry.js

@@ -0,0 +1,147 @@
+"use strict";
+var __importDefault = (this && this.__importDefault) || function (mod) {
+    return (mod && mod.__esModule) ? mod : { "default": mod };
+};
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.getThemeModeFromThemeKey = getThemeModeFromThemeKey;
+exports.getCoreThemes = getCoreThemes;
+exports.getRegisteredThemes = getRegisteredThemes;
+exports.getThemesByMode = getThemesByMode;
+exports.getDefaultThemeKey = getDefaultThemeKey;
+exports.isRegisteredThemeKey = isRegisteredThemeKey;
+const fs_1 = __importDefault(require("fs"));
+const path_1 = __importDefault(require("path"));
+const DEFAULT_THEME_KEYS = {
+    light: "solid-light-purple",
+    dark: "solid-dark-purple",
+};
+const THEME_MODE_TOKENS = {
+    light: "-light-",
+    dark: "-dark-",
+};
+const THEME_MODE_SUFFIXES = {
+    light: "-light",
+    dark: "-dark",
+};
+function normalizeThemeKey(value) {
+    const normalized = value?.trim().toLowerCase();
+    return normalized || null;
+}
+function matchesThemeMode(value, mode) {
+    return (value.includes(THEME_MODE_TOKENS[mode])
+        || value.endsWith(THEME_MODE_SUFFIXES[mode])
+        || value === mode);
+}
+function titleCase(value) {
+    return value
+        .split(/[-_\s]+/)
+        .filter(Boolean)
+        .map((token) => {
+        if (token.toLowerCase() === "solid")
+            return "SolidX";
+        return token.charAt(0).toUpperCase() + token.slice(1);
+    })
+        .join(" ");
+}
+function getThemeModeFromThemeKey(value) {
+    const normalized = normalizeThemeKey(value);
+    if (!normalized)
+        return null;
+    if (matchesThemeMode(normalized, "light"))
+        return "light";
+    if (matchesThemeMode(normalized, "dark"))
+        return "dark";
+    return null;
+}
+function createThemeDefinition(key, defaultTheme = false) {
+    const mode = getThemeModeFromThemeKey(key);
+    if (!mode) {
+        throw new Error(`Invalid theme key: ${key}`);
+    }
+    return {
+        key,
+        label: titleCase(key),
+        mode,
+        default: defaultTheme,
+    };
+}
+function createDefaultTheme(mode) {
+    return createThemeDefinition(DEFAULT_THEME_KEYS[mode], true);
+}
+function groupThemesByMode(themes, mode) {
+    return themes.filter((theme) => theme.mode === mode);
+}
+function pickDefaultThemeKey(themes, mode) {
+    const themesForMode = groupThemesByMode(themes, mode);
+    return (themesForMode.find((theme) => theme.default)?.key
+        ?? themesForMode[0]?.key
+        ?? DEFAULT_THEME_KEYS[mode]);
+}
+function resolveThemeDirectory() {
+    const themeDirectory = path_1.default.resolve(process.cwd(), "..", "solid-ui", "public", "themes");
+    try {
+        if (fs_1.default.existsSync(themeDirectory) && fs_1.default.statSync(themeDirectory).isDirectory()) {
+            return path_1.default.resolve(themeDirectory);
+        }
+    }
+    catch {
+        return null;
+    }
+    return null;
+}
+function isThemeDirectory(themeDirectory, entryName) {
+    return fs_1.default.existsSync(path_1.default.join(themeDirectory, entryName, "theme.css"));
+}
+function readThemesFromPath() {
+    const themeDirectory = resolveThemeDirectory();
+    if (!themeDirectory) {
+        return [];
+    }
+    try {
+        const directoryEntries = fs_1.default.readdirSync(themeDirectory, { withFileTypes: true });
+        return directoryEntries
+            .filter((entry) => entry.isDirectory())
+            .map((entry) => entry.name.trim())
+            .filter(Boolean)
+            .filter((entryName) => isThemeDirectory(themeDirectory, entryName))
+            .flatMap((entryName) => {
+            const mode = getThemeModeFromThemeKey(entryName);
+            if (!mode)
+                return [];
+            return [createThemeDefinition(entryName, entryName === DEFAULT_THEME_KEYS[mode])];
+        })
+            .sort((left, right) => left.label.localeCompare(right.label));
+    }
+    catch {
+        return [];
+    }
+}
+function getThemes() {
+    const discoveredThemes = readThemesFromPath();
+    if (discoveredThemes.length) {
+        return discoveredThemes;
+    }
+    return [createDefaultTheme("light"), createDefaultTheme("dark")];
+}
+function getCoreThemes() {
+    return getThemes();
+}
+function getRegisteredThemes() {
+    return getThemes();
+}
+function getThemesByMode(mode) {
+    return groupThemesByMode(getRegisteredThemes(), mode);
+}
+function getDefaultThemeKey(mode = "light") {
+    return pickDefaultThemeKey(getRegisteredThemes(), mode);
+}
+function isRegisteredThemeKey(value, mode) {
+    if (!value)
+        return false;
+    return getRegisteredThemes().some((theme) => {
+        if (theme.key !== value)
+            return false;
+        return mode ? theme.mode === mode : true;
+    });
+}
+//# sourceMappingURL=theme-registry.js.map

package/dist/theme/theme-registry.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"theme-registry.js","sourceRoot":"","sources":["../../src/theme/theme-registry.ts"],"names":[],"mappings":";;;;;AA8DA,4DAQC;AAuFD,sCAEC;AAED,kDAEC;AAED,0CAEC;AAED,gDAEC;AAED,oDAOC;AApLD,4CAAoB;AACpB,gDAAwB;AAsBxB,MAAM,kBAAkB,GAA8B;IACpD,KAAK,EAAE,oBAAoB;IAC3B,IAAI,EAAE,mBAAmB;CAC1B,CAAC;AAEF,MAAM,iBAAiB,GAA8B;IACnD,KAAK,EAAE,SAAS;IAChB,IAAI,EAAE,QAAQ;CACf,CAAC;AAEF,MAAM,mBAAmB,GAA8B;IACrD,KAAK,EAAE,QAAQ;IACf,IAAI,EAAE,OAAO;CACd,CAAC;AAEF,SAAS,iBAAiB,CAAC,KAAqB;IAC9C,MAAM,UAAU,GAAG,KAAK,EAAE,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;IAC/C,OAAO,UAAU,IAAI,IAAI,CAAC;AAC5B,CAAC;AAED,SAAS,gBAAgB,CAAC,KAAa,EAAE,IAAe;IACtD,OAAO,CACL,KAAK,CAAC,QAAQ,CAAC,iBAAiB,CAAC,IAAI,CAAC,CAAC;WACpC,KAAK,CAAC,QAAQ,CAAC,mBAAmB,CAAC,IAAI,CAAC,CAAC;WACzC,KAAK,KAAK,IAAI,CAClB,CAAC;AACJ,CAAC;AAED,SAAS,SAAS,CAAC,KAAa;IAC9B,OAAO,KAAK;SACT,KAAK,CAAC,SAAS,CAAC;SAChB,MAAM,CAAC,OAAO,CAAC;SACf,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE;QACb,IAAI,KAAK,CAAC,WAAW,EAAE,KAAK,OAAO;YAAE,OAAO,QAAQ,CAAC;QACrD,OAAO,KAAK,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,WAAW,EAAE,GAAG,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;IACxD,CAAC,CAAC;SACD,IAAI,CAAC,GAAG,CAAC,CAAC;AACf,CAAC;AAED,SAAgB,wBAAwB,CAAC,KAAqB;IAC5D,MAAM,UAAU,GAAG,iBAAiB,CAAC,KAAK,CAAC,CAAC;IAC5C,IAAI,CAAC,UAAU;QAAE,OAAO,IAAI,CAAC;IAE7B,IAAI,gBAAgB,CAAC,UAAU,EAAE,OAAO,CAAC;QAAE,OAAO,OAAO,CAAC;IAC1D,IAAI,gBAAgB,CAAC,UAAU,EAAE,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IAExD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,qBAAqB,CAAC,GAAW,EAAE,YAAY,GAAG,KAAK;IAC9D,MAAM,IAAI,GAAG,wBAAwB,CAAC,GAAG,CAAC,CAAC;IAC3C,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,MAAM,IAAI,KAAK,CAAC,sBAAsB,GAAG,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO;QACL,GAAG;QACH,KAAK,EAAE,SAAS,CAAC,GAAG,CAAC;QACrB,IAAI;QACJ,OAAO,EAAE,YAAY;KACtB,CAAC;AACJ,CAAC;AAED,SAAS,kBAAkB,CAAC,IAAe;IACzC,OAAO,qBAAqB,CAAC,kBAAkB,CAAC,IAAI,CAAC,EAAE,IAAI,CAAC,CAAC;AAC/D,CAAC;AAED,SAAS,iBAAiB,CAAC,MAA4B,EAAE,IAAe;IACtE,OAAO,MAAM,CAAC,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC;AACvD,CAAC;AAED,SAAS,mBAAmB,CAAC,MAA4B,EAAE,IAAe;IACxE,MAAM,aAAa,GAAG,iBAAiB,CAAC,MAAM,EAAE,IAAI,CAAC,CAAC;IAEtD,OAAO,CACL,aAAa,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,OAAO,CAAC,EAAE,GAAG;WAC9C,aAAa,CAAC,CAAC,CAAC,EAAE,GAAG;WACrB,kBAAkB,CAAC,IAAI,CAAC,CAC5B,CAAC;AACJ,CAAC;AAED,SAAS,qBAAqB;IAC5B,MAAM,cAAc,GAAG,cAAI,CAAC,OAAO,CAAC,OAAO,CAAC,GAAG,EAAE,EAAE,IAAI,EAAE,UAAU,EAAE,QAAQ,EAAE,QAAQ,CAAC,CAAC;IACzF,IAAI,CAAC;QACH,IAAI,YAAE,CAAC,UAAU,CAAC,cAAc,CAAC,IAAI,YAAE,CAAC,QAAQ,CAAC,cAAc,CAAC,CAAC,WAAW,EAAE,EAAE,CAAC;YAC/E,OAAO,cAAI,CAAC,OAAO,CAAC,cAAc,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IAED,OAAO,IAAI,CAAC;AACd,CAAC;AAED,SAAS,gBAAgB,CAAC,cAAsB,EAAE,SAAiB;IACjE,OAAO,YAAE,CAAC,UAAU,CAAC,cAAI,CAAC,IAAI,CAAC,cAAc,EAAE,SAAS,EAAE,WAAW,CAAC,CAAC,CAAC;AAC1E,CAAC;AAED,SAAS,kBAAkB;IACzB,MAAM,cAAc,GAAG,qBAAqB,EAAE,CAAC;IAC/C,IAAI,CAAC,cAAc,EAAE,CAAC;QACpB,OAAO,EAAE,CAAC;IACZ,CAAC;IAED,IAAI,CAAC;QACH,MAAM,gBAAgB,GAAG,YAAE,CAAC,WAAW,CAAC,cAAc,EAAE,EAAE,aAAa,EAAE,IAAI,EAAE,CAAC,CAAC;QAEjF,OAAO,gBAAgB;aACpB,MAAM,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,WAAW,EAAE,CAAC;aACtC,GAAG,CAAC,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,IAAI,CAAC,IAAI,EAAE,CAAC;aACjC,MAAM,CAAC,OAAO,CAAC;aACf,MAAM,CAAC,CAAC,SAAS,EAAE,EAAE,CAAC,gBAAgB,CAAC,cAAc,EAAE,SAAS,CAAC,CAAC;aAClE,OAAO,CAAC,CAAC,SAAS,EAAE,EAAE;YACrB,MAAM,IAAI,GAAG,wBAAwB,CAAC,SAAS,CAAC,CAAC;YACjD,IAAI,CAAC,IAAI;gBAAE,OAAO,EAAE,CAAC;YAErB,OAAO,CAAC,qBAAqB,CAAC,SAAS,EAAE,SAAS,KAAK,kBAAkB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC;QACpF,CAAC,CAAC;aACD,IAAI,CAAC,CAAC,IAAI,EAAE,KAAK,EAAE,EAAE,CAAC,IAAI,CAAC,KAAK,CAAC,aAAa,CAAC,KAAK,CAAC,KAAK,CAAC,CAAC,CAAC;IAClE,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,EAAE,CAAC;IACZ,CAAC;AACH,CAAC;AAED,SAAS,SAAS;IAChB,MAAM,gBAAgB,GAAG,kBAAkB,EAAE,CAAC;IAE9C,IAAI,gBAAgB,CAAC,MAAM,EAAE,CAAC;QAC5B,OAAO,gBAAgB,CAAC;IAC1B,CAAC;IAED,OAAO,CAAC,kBAAkB,CAAC,OAAO,CAAC,EAAE,kBAAkB,CAAC,MAAM,CAAC,CAAC,CAAC;AACnE,CAAC;AAED,SAAgB,aAAa;IAC3B,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,SAAgB,mBAAmB;IACjC,OAAO,SAAS,EAAE,CAAC;AACrB,CAAC;AAED,SAAgB,eAAe,CAAC,IAAe;IAC7C,OAAO,iBAAiB,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;AACxD,CAAC;AAED,SAAgB,kBAAkB,CAAC,OAAkB,OAAO;IAC1D,OAAO,mBAAmB,CAAC,mBAAmB,EAAE,EAAE,IAAI,CAAC,CAAC;AAC1D,CAAC;AAED,SAAgB,oBAAoB,CAAC,KAAqB,EAAE,IAAgB;IAC1E,IAAI,CAAC,KAAK;QAAE,OAAO,KAAK,CAAC;IAEzB,OAAO,mBAAmB,EAAE,CAAC,IAAI,CAAC,CAAC,KAAK,EAAE,EAAE;QAC1C,IAAI,KAAK,CAAC,GAAG,KAAK,KAAK;YAAE,OAAO,KAAK,CAAC;QACtC,OAAO,IAAI,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,KAAK,IAAI,CAAC,CAAC,CAAC,IAAI,CAAC;IAC3C,CAAC,CAAC,CAAC;AACL,CAAC","sourcesContent":["import fs from \"fs\";\nimport path from \"path\";\n\n/**\n * Backend theme registry.\n *\n * Responsibilities:\n * - discover theme folders from the filesystem\n * - classify each theme as light/dark from its key\n * - expose default and grouped theme helpers for backend settings\n *\n * Shared pure parsing helpers are intentionally mirrored in solid-core-ui,\n * but all filesystem discovery stays here.\n */\nexport type ThemeMode = \"light\" | \"dark\";\n\nexport type AppThemeDefinition = {\n  key: string;\n  label: string;\n  mode: ThemeMode;\n  default?: boolean;\n};\n\nconst DEFAULT_THEME_KEYS: Record<ThemeMode, string> = {\n  light: \"solid-light-purple\",\n  dark: \"solid-dark-purple\",\n};\n\nconst THEME_MODE_TOKENS: Record<ThemeMode, string> = {\n  light: \"-light-\",\n  dark: \"-dark-\",\n};\n\nconst THEME_MODE_SUFFIXES: Record<ThemeMode, string> = {\n  light: \"-light\",\n  dark: \"-dark\",\n};\n\nfunction normalizeThemeKey(value?: string | null): string | null {\n  const normalized = value?.trim().toLowerCase();\n  return normalized || null;\n}\n\nfunction matchesThemeMode(value: string, mode: ThemeMode): boolean {\n  return (\n    value.includes(THEME_MODE_TOKENS[mode])\n    || value.endsWith(THEME_MODE_SUFFIXES[mode])\n    || value === mode\n  );\n}\n\nfunction titleCase(value: string): string {\n  return value\n    .split(/[-_\\s]+/)\n    .filter(Boolean)\n    .map((token) => {\n      if (token.toLowerCase() === \"solid\") return \"SolidX\";\n      return token.charAt(0).toUpperCase() + token.slice(1);\n    })\n    .join(\" \");\n}\n\nexport function getThemeModeFromThemeKey(value?: string | null): ThemeMode | null {\n  const normalized = normalizeThemeKey(value);\n  if (!normalized) return null;\n\n  if (matchesThemeMode(normalized, \"light\")) return \"light\";\n  if (matchesThemeMode(normalized, \"dark\")) return \"dark\";\n\n  return null;\n}\n\nfunction createThemeDefinition(key: string, defaultTheme = false): AppThemeDefinition {\n  const mode = getThemeModeFromThemeKey(key);\n  if (!mode) {\n    throw new Error(`Invalid theme key: ${key}`);\n  }\n\n  return {\n    key,\n    label: titleCase(key),\n    mode,\n    default: defaultTheme,\n  };\n}\n\nfunction createDefaultTheme(mode: ThemeMode): AppThemeDefinition {\n  return createThemeDefinition(DEFAULT_THEME_KEYS[mode], true);\n}\n\nfunction groupThemesByMode(themes: AppThemeDefinition[], mode: ThemeMode): AppThemeDefinition[] {\n  return themes.filter((theme) => theme.mode === mode);\n}\n\nfunction pickDefaultThemeKey(themes: AppThemeDefinition[], mode: ThemeMode): string {\n  const themesForMode = groupThemesByMode(themes, mode);\n\n  return (\n    themesForMode.find((theme) => theme.default)?.key\n    ?? themesForMode[0]?.key\n    ?? DEFAULT_THEME_KEYS[mode]\n  );\n}\n\nfunction resolveThemeDirectory(): string | null {\n  const themeDirectory = path.resolve(process.cwd(), \"..\", \"solid-ui\", \"public\", \"themes\");\n  try {\n    if (fs.existsSync(themeDirectory) && fs.statSync(themeDirectory).isDirectory()) {\n      return path.resolve(themeDirectory);\n    }\n  } catch {\n    return null;\n  }\n\n  return null;\n}\n\nfunction isThemeDirectory(themeDirectory: string, entryName: string): boolean {\n  return fs.existsSync(path.join(themeDirectory, entryName, \"theme.css\"));\n}\n\nfunction readThemesFromPath(): AppThemeDefinition[] {\n  const themeDirectory = resolveThemeDirectory();\n  if (!themeDirectory) {\n    return [];\n  }\n\n  try {\n    const directoryEntries = fs.readdirSync(themeDirectory, { withFileTypes: true });\n\n    return directoryEntries\n      .filter((entry) => entry.isDirectory())\n      .map((entry) => entry.name.trim())\n      .filter(Boolean)\n      .filter((entryName) => isThemeDirectory(themeDirectory, entryName))\n      .flatMap((entryName) => {\n        const mode = getThemeModeFromThemeKey(entryName);\n        if (!mode) return [];\n\n        return [createThemeDefinition(entryName, entryName === DEFAULT_THEME_KEYS[mode])];\n      })\n      .sort((left, right) => left.label.localeCompare(right.label));\n  } catch {\n    return [];\n  }\n}\n\nfunction getThemes(): AppThemeDefinition[] {\n  const discoveredThemes = readThemesFromPath();\n\n  if (discoveredThemes.length) {\n    return discoveredThemes;\n  }\n\n  return [createDefaultTheme(\"light\"), createDefaultTheme(\"dark\")];\n}\n\nexport function getCoreThemes(): AppThemeDefinition[] {\n  return getThemes();\n}\n\nexport function getRegisteredThemes(): AppThemeDefinition[] {\n  return getThemes();\n}\n\nexport function getThemesByMode(mode: ThemeMode): AppThemeDefinition[] {\n  return groupThemesByMode(getRegisteredThemes(), mode);\n}\n\nexport function getDefaultThemeKey(mode: ThemeMode = \"light\"): string {\n  return pickDefaultThemeKey(getRegisteredThemes(), mode);\n}\n\nexport function isRegisteredThemeKey(value?: string | null, mode?: ThemeMode): value is string {\n  if (!value) return false;\n\n  return getRegisteredThemes().some((theme) => {\n    if (theme.key !== value) return false;\n    return mode ? theme.mode === mode : true;\n  });\n}\n"]}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@solidxai/core",
-  "version": "0.1.13-beta.9",
+  "version": "0.1.13",
   "description": "This module is a NestJS module containing all the required core providers required by a Solid application",
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -45,7 +45,7 @@
     "bcrypt": "^5.1.1",
     "bson": "^6.10.1",
     "cache-manager": "^5.5.2",
-    "cache-manager-redis-store": "^3.0.1",
+    "cache-manager-redis-yet": "^5.1.5",
     "class-transformer": "^0.5.1",
     "class-validator": "^0.14.1",
     "cron-parser": "^5.5.0",

package/src/commands/run-tests.command.ts

@@ -3,6 +3,7 @@ import { SubCommand, CommandRunner, Option } from 'nest-commander';
 import * as path from 'path';
 import { ModuleMetadataHelperService } from 'src/helpers/module-metadata-helper.service';
 import { ConsoleReporter } from 'src/testing/reporter/console-reporter';
+import { ProgressReporter } from 'src/testing/reporter/progress-reporter';
 import { WebhookReporter } from 'src/testing/reporter/webhook-reporter';
 import { runFromMetadata } from 'src/testing/runner/run-from-metadata';
 import type { TestingMetadata } from 'src/testing/contracts/testing-metadata.types';
@@ -27,6 +28,7 @@ interface TestRunCommandOptions {
   listSpecs?: boolean;
   printApiLogs?: boolean;
   runName?: string;
+  progress?: boolean;
 }
 
 @SubCommand({
@@ -106,9 +108,12 @@ export class TestRunCommand extends CommandRunner {
 
       const webhookUrl = process.env.SOLIDCTL_WEBHOOK_URL;
       const runName = options?.runName ?? `run-${Date.now()}`;
-      const reporter = webhookUrl
+      const baseReporter = webhookUrl
         ? new WebhookReporter(webhookUrl, runName)
         : new ConsoleReporter();
+      const reporter = options?.progress === false
+        ? baseReporter
+        : new ProgressReporter(baseReporter);
 
       try {
         await runFromMetadata({
@@ -138,8 +143,8 @@ export class TestRunCommand extends CommandRunner {
         console.error('Run tests command failed');
         process.exitCode = 1;
       } finally {
-        if (reporter instanceof WebhookReporter) {
-          await reporter.flush(Number(process.exitCode ?? 0));
+        if (baseReporter instanceof WebhookReporter) {
+          await baseReporter.flush(Number(process.exitCode ?? 0));
         }
       }
       return;
@@ -289,6 +294,15 @@ export class TestRunCommand extends CommandRunner {
   parseRunName(val: string): string {
     return val;
   }
+
+  @Option({
+    flags: '--no-progress',
+    description: 'Disable the interactive test progress footer.',
+    required: false,
+  })
+  parseNoProgress(): boolean {
+    return false;
+  }
 }
 
 function splitCsv(value?: string): string[] | undefined {

package/src/config/cache.options.ts

@@ -1,6 +1,14 @@
 import { CacheModuleAsyncOptions } from '@nestjs/cache-manager';
 import { ConfigModule, ConfigService } from '@nestjs/config';
-import { redisStore } from 'cache-manager-redis-store';
+// cache-manager-redis-yet, not cache-manager-redis-store. The latter stops at
+// 3.0.1 and implements the cache-manager v4 store contract: it expects an
+// options object and reads `options.ttl` in seconds. cache-manager v5 calls
+// `store.set(key, value, ttl)` with a bare number of milliseconds, so that
+// store found no `.ttl`, fell back to an unset default, and issued a plain
+// `SET` - silently discarding every TTL passed anywhere in the app and leaving
+// Redis keys that never expire. redis-yet implements the v5 contract and
+// writes with `PX`, so millisecond TTLs land correctly.
+import { redisStore } from 'cache-manager-redis-yet';
 import { isRedisConfigured } from 'src/helpers/environment.helper';
 
 export const CacheManagerOptions: CacheModuleAsyncOptions = {

package/src/constants/error-messages.ts

@@ -127,6 +127,20 @@ export const ERROR_MESSAGES = {
 
     DEFAULT_REGEX_PATTERN_NOT_MATCHING_ERROR_MSG: 'Invalid regex pattern.',
 
+    // MPIN errors.
+    // MPIN_INVALID is deliberately shared by "wrong MPIN" and "unknown handle",
+    // so a failed sign-in never reveals whether the credential handle was real.
+    // MPIN_REVOKED is separate and is returned for any attempt against a
+    // deactivated credential - it discloses nothing useful, since a dead
+    // credential grants no capability, and it lets the client stop retrying.
+    MPIN_INVALID: 'Invalid MPIN.',
+    MPIN_LOCKED: 'MPIN sign-in is temporarily locked due to repeated failed attempts.',
+    MPIN_REVOKED: 'MPIN sign-in has been disabled for this device. Please sign in normally.',
+    MPIN_NOT_ENABLED: 'MPIN sign-in is not enabled.',
+    MPIN_FORMAT_INVALID: 'MPIN does not meet the required format.',
+    MPIN_TOO_PREDICTABLE: 'MPIN is too easy to guess. Avoid repeated or sequential digits.',
+    MPIN_CREDENTIAL_NOT_FOUND: 'MPIN device credential not found.',
+
     PERMISSION_MESSAGES: {
     insertMany: (model?: string) =>
       `You do not have permission to import ${model ?? 'these'} records.`,

package/src/constants/media-file-types.ts

@@ -1,5 +1,7 @@
 export type MediaCategory = 'image' | 'audio' | 'video' | 'file' | 'pdf';
 
+export const MEDIA_CATEGORIES = ['image', 'audio', 'video', 'file', 'pdf'] as const;
+
 const IMAGE_EXTENSIONS = ['png', 'jpg', 'jpeg', 'webp', 'gif', 'bmp', 'tiff', 'heic', 'heif'];
 const AUDIO_EXTENSIONS = ['mp3', 'wav', 'ogg', 'aac', 'm4a', 'flac', 'webm'];
 const VIDEO_EXTENSIONS = ['mp4', 'mov', 'avi', 'mkv', 'mpeg', 'mpg', '3gp', '3g2', 'webm', 'ogg'];
@@ -15,6 +17,7 @@ export const DANGEROUS_EXTENSIONS = new Set([
     'html', 'htm', 'xhtml', 'svg', 'xml',
     'js', 'mjs', 'php', 'phtml', 'jsp', 'asp', 'aspx',
     'exe', 'sh', 'bat', 'cmd', 'ps1', 'jar', 'dll',
+    'msi', 'msix', 'msp', 'com', 'scr', 'vbs', 'vbe', 'wsf', 'wsh', 'hta', 'cpl', 'pif', 'reg',
 ]);
 
 
@@ -27,17 +30,92 @@ export const DANGEROUS_MIME_TYPES = new Set([
     'image/svg+xml', 'text/html', 'application/xhtml+xml',
 ]);
 
-export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+/**
+ * Percent-decodes a filename, repeating a bounded number of times so a double-encoded payload
+ * (`%252e` -> `%2e` -> `.`) survives a single pass through a proxy/framework that already
+ * decoded once. Malformed escape sequences are left as-is rather than thrown, since this runs
+ * on attacker-controlled input and a literal `%` in a filename (`100%done.pdf`) is legal.
+ */
+function decodePercentEncodingSafely(name: string): string {
+    let decoded = name;
+    for (let i = 0; i < 3; i++) {
+        let next: string;
+        try {
+            next = decodeURIComponent(decoded);
+        } catch {
+            return decoded;
+        }
+        if (next === decoded) {
+            return decoded;
+        }
+        decoded = next;
+    }
+    return decoded;
+}
+
+/**
+ * Reduces a client-supplied name to the name that will actually be resolved on disk, so
+ * extension checks can't be dodged by decorating it. Each step defends a known bypass:
+ *
+ *  - `evil.exe%2e`         -> percent-encoding a trailing dot (or anything else) hides the real
+ *                             extension from naive string matching; decode before inspecting it.
+ *  - `../../evil.exe`      -> only the final path segment is the file name.
+ *  - `evil.exe\0.png`      -> a NUL truncates the name at the syscall/filesystem layer, so
+ *                             anything after it is invisible to the OS but visible to naive
+ *                             validation.
+ *  - `evil.exe::$DATA`     -> NTFS alternate data stream suffix; the file on disk is evil.exe.
+ *  - `evil.exe.` / `.exe ` -> Windows silently strips trailing dots and spaces when resolving
+ *                             a path, so these land on disk as evil.exe.
+ */
+export function normalizeUploadedFileName(fileName?: string | null): string {
     if (!fileName) {
-        return undefined;
+        return '';
+    }
+
+    let name = decodePercentEncodingSafely(String(fileName));
+    name = name.split(/[/\\]/).pop() ?? '';
+
+    const nulIndex = name.indexOf('\0');
+    if (nulIndex >= 0) {
+        name = name.slice(0, nulIndex);
     }
 
-    const lastDotIndex = fileName.lastIndexOf('.');
-    if (lastDotIndex < 0 || lastDotIndex === fileName.length - 1) {
+    const streamIndex = name.indexOf(':');
+    if (streamIndex >= 0) {
+        name = name.slice(0, streamIndex);
+    }
+
+    return name.replace(/[\s.]+$/, '');
+}
+
+/**
+ * The effective extension - what the OS/browser will treat the file as. Used for media
+ * category resolution and inline-safety decisions. Always normalizes first, so
+ * `evil.exe.` resolves to `exe` rather than to nothing.
+ */
+export function getLowercaseFileExtension(fileName?: string | null): string | undefined {
+    const name = normalizeUploadedFileName(fileName);
+
+    const lastDotIndex = name.lastIndexOf('.');
+    if (lastDotIndex < 0 || lastDotIndex === name.length - 1) {
         return undefined;
     }
 
-    return fileName.slice(lastDotIndex + 1).toLowerCase();
+    return name.slice(lastDotIndex + 1).toLowerCase();
+}
+
+/**
+ * Every dot-delimited segment after the stem, lowercased. The danger check uses this rather
+ * than only the effective extension so a dangerous type buried in a double extension
+ * (`evil.exe.png`, `shell.php.jpg`) is still caught - several servers and browsers resolve
+ * such names by an earlier segment than the last one.
+ *
+ * The stem is skipped so an innocuous file that merely starts with a keyword (`exe.png`)
+ * isn't rejected.
+ */
+export function getLowercaseFileExtensionSegments(fileName?: string | null): string[] {
+    const segments = normalizeUploadedFileName(fileName).toLowerCase().split('.');
+    return segments.slice(1).filter(segment => segment.length > 0);
 }
 
 /** Minimal shape of an uploaded file, so this module stays free of framework imports. */
@@ -55,12 +133,12 @@ export function getUploadedFileName(file?: UploadedFileLike | null): string {
 /**
  * Single predicate for "must never be stored". Shared by every upload entry point
  * (MediaFieldCrudManager, chatter attachments) so the rules can't drift between them.
- * Extension is checked before mimetype so a spoofed Content-Type (e.g.
- * application/octet-stream on an .html file) can't bypass it.
+ * Extensions are checked before mimetype so a spoofed Content-Type (e.g.
+ * application/octet-stream, or image/png, on an .html file) can't bypass it.
  */
 export function isDangerousMediaFile(file?: UploadedFileLike | null): boolean {
-    const ext = getLowercaseFileExtension(getUploadedFileName(file));
-    if (ext && DANGEROUS_EXTENSIONS.has(ext)) {
+    const segments = getLowercaseFileExtensionSegments(getUploadedFileName(file));
+    if (segments.some(segment => DANGEROUS_EXTENSIONS.has(segment))) {
         return true;
     }
 

package/src/constants/success-messages.ts

@@ -6,6 +6,11 @@ export const SUCCESS_MESSAGES = {
     LOGOUT_SUCCESS: 'Logged out successfully',
     USER_REGISTERED: 'User registered successfully.',
 
+    // MPIN messages
+    MPIN_SETUP_SUCCESS: 'MPIN set up successfully.',
+    MPIN_CHANGED_SUCCESS: 'MPIN changed successfully.',
+    MPIN_DEVICE_REVOKED: 'MPIN sign-in removed for this device.',
+
     // CRUD service messages
     RECORD_RECOVERED: 'Record successfully recovered',
     SELECTED_RECORDS_RECOVERED: 'Selected records successfully recovered',

package/src/controllers/authentication.controller.ts

@@ -107,8 +107,11 @@ export class AuthenticationController {
     @Post('logout')
     @Public()
     @HttpCode(HttpStatus.OK)
-    async logout(@Body('refreshToken') refreshToken: string) {
-        return this.authService.logout(refreshToken);
+    async logout(
+        @Body('refreshToken') refreshToken: string,
+        @Body('allDevices') allDevices?: boolean,
+    ) {
+        return this.authService.logout(refreshToken, allDevices === true);
     }
 
     @ApiBearerAuth("jwt")

package/src/controllers/mpin-authentication.controller.ts

@@ -0,0 +1,67 @@
+import { Body, Controller, Delete, Get, HttpCode, HttpStatus, Param, ParseIntPipe, Post } from '@nestjs/common';
+import { ApiBearerAuth, ApiTags } from '@nestjs/swagger';
+import { ActiveUser } from '../decorators/active-user.decorator';
+import { Public } from '../decorators/public.decorator';
+import { ChangeMpinDto } from '../dtos/change-mpin.dto';
+import { MpinLoginDto } from '../dtos/mpin-login.dto';
+import { SetupMpinDto } from '../dtos/setup-mpin.dto';
+import { ActiveUserData } from '../interfaces/active-user-data.interface';
+import { MpinService } from '../services/mpin.service';
+
+/**
+ * There is deliberately no public "is MPIN set up for this identifier" route.
+ * That would reintroduce exactly the user-enumeration oracle the opaque
+ * credential handle removes. The client decides whether to show the MPIN
+ * screen from the presence of its own stored handle.
+ */
+@Controller('iam/mpin')
+@ApiTags('Solid Core')
+export class MpinAuthenticationController {
+    constructor(private readonly mpinService: MpinService) { }
+
+    @ApiBearerAuth('jwt')
+    @Post('setup')
+    @HttpCode(HttpStatus.OK)
+    setup(
+        @Body() setupMpinDto: SetupMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.setupMpin(activeUser, setupMpinDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Post('change')
+    @HttpCode(HttpStatus.OK)
+    change(
+        @Body() changeMpinDto: ChangeMpinDto,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.changeMpin(activeUser, changeMpinDto);
+    }
+
+    // Public by necessity - the caller has no session yet. The credential
+    // handle is unguessable, so this carries no enumeration surface.
+    @Public()
+    @Post('login')
+    @HttpCode(HttpStatus.OK)
+    login(@Body() mpinLoginDto: MpinLoginDto) {
+        return this.mpinService.loginWithMpin(mpinLoginDto);
+    }
+
+    @ApiBearerAuth('jwt')
+    @Get('devices')
+    listDevices(@ActiveUser() activeUser: ActiveUserData) {
+        return this.mpinService.listDevices(activeUser);
+    }
+
+    // By row id, never by credential handle, so the management UI never has to
+    // hold the secret.
+    @ApiBearerAuth('jwt')
+    @Delete('devices/:id')
+    revokeDevice(
+        @Param('id', ParseIntPipe) id: number,
+        @ActiveUser() activeUser: ActiveUserData,
+    ) {
+        return this.mpinService.revokeDevice(activeUser, id);
+    }
+}

package/src/dtos/change-mpin.dto.ts

@@ -0,0 +1,18 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+export class ChangeMpinDto {
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    currentMpin: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    newMpin: string;
+}

package/src/dtos/create-field-metadata.dto.ts

@@ -1,5 +1,6 @@
 import { ApiProperty } from '@nestjs/swagger';
 import { Transform, Type } from 'class-transformer';
+import { DANGEROUS_EXTENSIONS, MEDIA_CATEGORIES, MediaCategory } from '../constants/media-file-types';
 
 import {
   IsArray,
@@ -7,6 +8,7 @@ import {
   IsEnum,
   IsIn,
   IsInt,
+  IsNotIn,
   IsOptional,
   IsString,
   Matches,
@@ -155,13 +157,7 @@ export enum DecryptWhenType {
   afterTransit = 'after-transit',
 }
 
-export enum MediaType {
-  image = 'image',
-  audio = 'audio',
-  video = 'video',
-  // document = 'document',
-  file = 'file',
-}
+export type MediaType = MediaCategory;
 
 export enum RelationType {
   manyToOne = 'many-to-one',
@@ -308,7 +304,7 @@ export class CreateFieldMetadataDto {
   private: boolean;
 
   @ApiProperty({ description: 'Allowed media types for the field. Only for type=mediaSingle,mediaMultiple', })
-  @IsEnum(MediaType, { each: true })
+  @IsIn([...MEDIA_CATEGORIES], { each: true })
   @IsOptional()
   mediaTypes: MediaType[];
 
@@ -317,6 +313,18 @@ export class CreateFieldMetadataDto {
   @IsOptional()
   mediaMaxSizeKb: number;
 
+  @ApiProperty({ description: 'Explicit allowlist of file extensions (e.g. ["pdf","xlsx","png"]) permitted for this field, checked in addition to any mediaTypes category restriction — both must pass if both are set. For a strict allowlist, leave mediaTypes empty and use this alone. Only for type=mediaSingle,mediaMultiple', })
+  @Transform(({ value }) =>
+    Array.isArray(value)
+      ? value.map((ext: any) => String(ext).toLowerCase().trim().replace(/^\./, ''))
+      : value
+  )
+  @IsArray()
+  @IsString({ each: true })
+  @IsNotIn([...DANGEROUS_EXTENSIONS], { each: true })
+  @IsOptional()
+  mediaAllowedExtensions?: string[];
+
   @ApiProperty({ description: 'Configured Media storage provider. Only for type=mediaSingle,mediaMultiple', })
   @IsInt()
   @IsOptional()
@@ -464,4 +472,4 @@ export class CreateFieldMetadataDto {
   @ApiProperty({ description: 'Is Primary Key Field', })
   @IsBoolean()
   isPrimaryKey?: boolean;
-}
+}

package/src/dtos/create-model-sequence.dto.ts

@@ -35,7 +35,7 @@ export class CreateModelSequenceDto {
     @IsOptional()
     @IsInt()
     @ApiProperty()
-    currentValue: number;
+    currentValue?: number;
     @IsOptional()
     @IsString()
     @ApiProperty()

package/src/dtos/mpin-login.dto.ts

@@ -0,0 +1,24 @@
+import { IsNotEmpty, IsString, MaxLength } from 'class-validator';
+
+/**
+ * Deliberately carries no identifier - no mobile, email or username.
+ *
+ * `credentialRef` is a server-issued 256-bit handle that already points at a
+ * single credential row, and therefore at a single user. That is what removes
+ * the user-enumeration surface a public login route would otherwise have: an
+ * attacker cannot probe "does this phone number have MPIN?" because there is
+ * nowhere to put a phone number.
+ */
+export class MpinLoginDto {
+    // Bounded so a pathological payload never reaches the regex test or the
+    // hash comparison. The handle is always 64 hex characters.
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(128)
+    credentialRef: string;
+
+    @IsNotEmpty()
+    @IsString()
+    @MaxLength(32)
+    mpin: string;
+}