@lenne.tech/nest-server 11.27.5 → 11.27.7

package/src/core/common/helpers/id.helper.ts

@@ -0,0 +1,198 @@
+/**
+ * ID helpers.
+ *
+ * These live in their own file — instead of `db.helper.ts` — so that files which need nothing but
+ * ID comparison can reach them without importing `db.helper`, which drags in GraphQL, Mongoose
+ * models and `input.helper` behind it.
+ *
+ * That was not an aesthetic choice. `restricted.decorator.ts` needs exactly two of these functions
+ * (`equalIds`, `getIncludedIds`), and importing them from `db.helper` put it on a real runtime
+ * cycle:
+ *
+ *   restricted.decorator → db.helper → input.helper → restricted.decorator
+ *
+ * `input.helper` therefore evaluated while `restricted.decorator` was still initializing. Nothing
+ * crashed, but only because every cross-cycle dereference happened to sit inside a function body:
+ * a single top-level line in `input.helper` (a module-level alias, an `@Restricted`-decorated class,
+ * `design:type` metadata) would have thrown under SWC → CommonJS:
+ *
+ *   ReferenceError: Cannot access 'checkRestricted' before initialization
+ *
+ * …in the file that drives field-level access control, on a compiler this repo's default build never
+ * runs. Moving the ID cluster into this leaf removes the `restricted.decorator → db.helper` edge
+ * outright, so the cycle no longer exists rather than merely being disarmed.
+ *
+ * This file imports only Mongoose's `Types`, lodash, and a type — no framework code — so it can
+ * never be part of a cycle itself. Keep it that way.
+ *
+ * `db.helper` re-exports all four public functions, so every existing import path keeps working.
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
+ */
+import _ = require('lodash');
+import { Types } from 'mongoose';
+
+import { IdsType } from '../types/ids.type';
+
+/**
+ * Checks if all IDs are equal
+ */
+export function equalIds(...ids: IdsType[]): boolean {
+  if (!ids) {
+    return false;
+  }
+  const compare = getStringIds(ids[0]);
+  if (!compare) {
+    return false;
+  }
+  return ids.every((id) => getStringIds(id) === compare);
+}
+
+/**
+ * Get included ids
+ * @param includes IdsType, which should be checked if it contains the ID
+ * @param ids IdsType, which should be included
+ * @param convert If set the result array will be converted to pure type String array or ObjectId array
+ * @return IdsType with IDs which are included, undefined if includes or ids are missing or null if none is included
+ */
+export function getIncludedIds(includes: IdsType, ids: IdsType, convert?: 'string'): string[];
+export function getIncludedIds(includes: IdsType, ids: IdsType, convert?: 'object'): Types.ObjectId[];
+
+export function getIncludedIds<T = IdsType>(
+  includes: IdsType,
+  ids: IdsType | T,
+  convert?: 'object' | 'string',
+): null | T[] | undefined {
+  if (!includes || !ids) {
+    return undefined;
+  }
+
+  if (!Array.isArray(includes)) {
+    includes = [includes];
+  }
+
+  if (!Array.isArray(ids)) {
+    ids = [ids];
+  }
+
+  let result = [];
+  const includesStrings = getStringIds(includes);
+  for (const id of ids) {
+    if (includesStrings.includes(getStringIds(id))) {
+      result.push(id);
+    }
+  }
+
+  if (convert) {
+    result = convert === 'string' ? getStringIds(result) : getObjectIds(result);
+  }
+
+  return result.length ? result : null;
+}
+
+/**
+ * Convert string(s) to ObjectId(s)
+ */
+export function getObjectIds(ids: any[]): Types.ObjectId[];
+export function getObjectIds(ids: any): Types.ObjectId;
+export function getObjectIds<T extends any | any[]>(ids: T): Types.ObjectId | Types.ObjectId[] {
+  if (Array.isArray(ids)) {
+    return ids.map((id) => new Types.ObjectId(getStringId(id)));
+  }
+  return new Types.ObjectId(getStringId(ids));
+}
+
+/**
+ * Get IDs from string of ObjectId array in a flat string array
+ */
+export function getStringIds(elements: any[], options?: { deep?: boolean; unique?: boolean }): string[];
+
+export function getStringIds(elements: any, options?: { deep?: boolean; unique?: boolean }): string;
+
+export function getStringIds<T extends any | any[]>(
+  elements: T,
+  options?: { deep?: boolean; unique?: boolean },
+): string | string[] {
+  // Process options
+  const { deep, unique } = {
+    deep: false,
+    unique: false,
+    ...options,
+  };
+
+  // Check elements
+  if (!elements) {
+    return elements as any;
+  }
+
+  // Init ids
+  let ids = [];
+
+  // Process non array
+  if (!Array.isArray(elements)) {
+    return getStringId(elements);
+  }
+
+  // Process array
+  for (const element of elements) {
+    if (Array.isArray(element)) {
+      if (deep) {
+        ids = ids.concat(getStringIds(element, { deep }));
+      }
+    } else {
+      const id = getStringId(element);
+      if (id) {
+        ids.push(id);
+      }
+    }
+  }
+
+  // Return (unique) ID array
+  return unique ? _.uniq(ids) : ids;
+}
+
+// =====================================================================================================================
+// Not exported helper functions
+// =====================================================================================================================
+
+/**
+ * Get ID of element as string
+ */
+function getStringId(element: any): string {
+  // Check element
+  if (!element) {
+    return element;
+  }
+
+  // Buffer handling
+  if (element instanceof Buffer) {
+    return element.toString();
+  }
+
+  // String handling
+  if (typeof element === 'string') {
+    return element;
+  }
+
+  // Object handling
+  if (typeof element === 'object') {
+    if (element instanceof Types.ObjectId) {
+      return element.toHexString();
+    }
+
+    if (element.id) {
+      if (element.id instanceof Buffer && element.toHexString) {
+        return element.toHexString();
+      }
+      return getStringId(element.id);
+    } else if (element._id) {
+      return getStringId(element._id);
+    }
+  }
+
+  // Other types
+  if (typeof element.toString === 'function') {
+    return element.toString();
+  }
+
+  return undefined;
+}

package/src/core/common/helpers/input.helper.ts

@@ -3,16 +3,23 @@ import { plainToInstance } from 'class-transformer';
 import { validate } from 'class-validator';
 import { ValidatorOptions } from 'class-validator/types/validation/ValidatorOptions';
 import { Kind } from 'graphql/index';
-import * as inspector from 'inspector';
-import _ = require('lodash');
-import rfdc = require('rfdc');
-import * as util from 'util';
 
 import { checkRestricted } from '../decorators/restricted.decorator';
 import { ProcessType } from '../enums/process-type.enum';
 import { RoleEnum } from '../enums/role.enum';
+import { clone } from './clone.helper';
 import { merge } from './config.helper';
-import { equalIds } from './db.helper';
+import { equalIds } from './id.helper';
+
+/**
+ * `clone` and `deepFreeze` moved to `./clone.helper` and are re-exported here so every existing
+ * import path keeps working. They were extracted because `config.service` needs `clone`/`deepFreeze`,
+ * and pulling them from HERE put it on a runtime import cycle
+ * (restricted.decorator → core-tenant.helpers → config.service → input.helper → restricted.decorator)
+ * that is one top-level line away from an SWC temporal-dead-zone crash. `clone.helper` imports no
+ * framework code, so it can never be part of a cycle. Do NOT move them back.
+ */
+export { clone, deepFreeze } from './clone.helper';
 
 /**
  * Helper class for inputs
@@ -341,68 +348,6 @@ export function checkAndGetDate(input: any): Date {
   return date;
 }
 
-/**
- * Clone object
- * @param object Any object
- * @param options Finetuning of rfdc cloning
- * @param options.checkResult Whether to compare object and cloned object via JSON.stringify and try alternative cloning
- *                            methods if they are not equal
- * @param options.circles Keeping track of circular references will slow down performance with an additional 25% overhead.
- *                        Even if an object doesn't have any circular references, the tracking overhead is the cost.
- *                        By default if an object with a circular reference is passed to rfdc, it will throw
- *                        (similar to how JSON.stringify would throw). Use the circles option to detect and preserve
- *                        circular references in the object. If performance is important, try removing the circular
- *                        reference from the object (set to undefined) and then add it back manually after cloning
- *                        instead of using this option.
- * @param options.debug Whether to shoe console.debug messages
- * @param options.proto Copy prototype properties as well as own properties into the new object.
- *                      It's marginally faster to allow enumerable properties on the prototype to be copied into the
- *                      cloned object (not onto it's prototype, directly onto the object).
- */
-export function clone(object: any, options?: { checkResult?: boolean; circles?: boolean; proto?: boolean }) {
-  const config = {
-    checkResult: true,
-    circles: true,
-    debug: inspector.url() !== undefined,
-    proto: false,
-    ...options,
-  };
-
-  try {
-    const cloned = rfdc(config)(object);
-    if (config.checkResult && !util.isDeepStrictEqual(object, cloned)) {
-      throw new Error('Cloned object differs from original object');
-    }
-    return cloned;
-  } catch (e) {
-    if (!config.circles) {
-      if (config.debug) {
-        console.debug(e, config, object, 'automatic try to use rfdc with circles');
-      }
-      try {
-        const clonedWithCircles = rfdc({
-          ...config,
-          circles: true,
-        })(object);
-        if (config.checkResult && !util.isDeepStrictEqual(object, clonedWithCircles)) {
-          throw new Error('Cloned object differs from original object', { cause: e });
-        }
-        return clonedWithCircles;
-      } catch (innerError) {
-        if (config.debug) {
-          console.debug(innerError, 'rfcd with circles did not work => automatic use of _.clone!');
-        }
-        return _.cloneDeep(object);
-      }
-    } else {
-      if (config.debug) {
-        console.debug(e, config, object, 'automatic try to use _.clone instead rfdc');
-      }
-      return _.cloneDeep(object);
-    }
-  }
-}
-
 /**
  * Combines objects to a new single plain object and ignores undefined
  */
@@ -410,23 +355,6 @@ export function combinePlain(...args: Record<any, any>[]): any {
   return assignPlain({}, ...args);
 }
 
-/**
- * Get deep frozen object
- */
-export function deepFreeze(object: any, visited: WeakSet<object> = new WeakSet()) {
-  if (!object || typeof object !== 'object') {
-    return object;
-  }
-  if (visited.has(object)) {
-    return object;
-  }
-  visited.add(object);
-  for (const [key, value] of Object.entries(object)) {
-    object[key] = deepFreeze(value, visited);
-  }
-  return Object.freeze(object);
-}
-
 /**
  * Standard error function
  */

package/src/core/common/inputs/combined-filter.input.ts

@@ -1,57 +1,10 @@
-import { InputType } from '@nestjs/graphql';
-
-import { Restricted } from '../decorators/restricted.decorator';
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { LogicalOperatorEnum } from '../enums/logical-operator.enum';
-import { RoleEnum } from '../enums/role.enum';
-import { maps } from '../helpers/model.helper';
-import { CoreInput } from './core-input.input';
-import { FilterInput } from './filter.input';
-
-@InputType({
-  description: 'Combination of multiple filters via logical operator',
-})
-@Restricted(RoleEnum.S_EVERYONE)
-export class CombinedFilterInput extends CoreInput {
-  /**
-   * Logical Operator to combine filters
-   */
-  @UnifiedField({
-    description: 'Logical Operator to combine filters',
-    enum: LogicalOperatorEnum,
-    roles: RoleEnum.S_EVERYONE,
-  })
-  logicalOperator: LogicalOperatorEnum = undefined;
-
-  /**
-   * Filters to combine via logical operator
-   */
-  @UnifiedField({
-    description: 'Filters to combine via logical operator',
-    isOptional: true,
-    roles: RoleEnum.S_EVERYONE,
-    type: () => FilterInput,
-  })
-  filters: FilterInput[] = undefined;
-
-  // ===================================================================================================================
-  // Methods
-  // ===================================================================================================================
-
-  /**
-   * Mapping for Subtypes
-   */
-  override map(
-    data: Partial<this> | Record<string, any>,
-    options: {
-      cloneDeep?: boolean;
-      funcAllowed?: boolean;
-      mapId?: boolean;
-    } = {},
-  ): this {
-    super.map(data, options);
-    this.filters = maps(data.filters, FilterInput, options.cloneDeep);
-    Object.keys(this).forEach((key) => this[key] === undefined && delete this[key]);
-    return this;
-  }
-}
+/**
+ * `CombinedFilterInput` is declared in `./filter.input` — the two classes are mutually recursive
+ * and must live in one module, or the cycle between them crashes SWC-compiled builds with
+ * `ReferenceError: Cannot access 'CombinedFilterInput' before initialization`. See the docblock in
+ * `./filter.input` for the full analysis.
+ *
+ * This file remains only so existing deep imports of `.../inputs/combined-filter.input` keep
+ * resolving. Do NOT move the class back here.
+ */
+export { CombinedFilterInput } from './filter.input';

package/src/core/common/inputs/filter.input.ts

@@ -1,12 +1,103 @@
+/**
+ * Filter inputs.
+ *
+ * `CombinedFilterInput` and `FilterInput` are mutually recursive: a filter may contain a combined
+ * filter, and a combined filter contains a list of filters. They therefore live in ONE module, and
+ * `CombinedFilterInput` is declared FIRST — that ordering is load-bearing, not cosmetic.
+ *
+ * They used to sit in two files that imported each other. `FilterInput` referenced
+ * `CombinedFilterInput` EAGERLY — in a decorator argument (`type: CombinedFilterInput`) and in the
+ * `design:type` metadata `emitDecoratorMetadata` emits for `combinedFilter?: CombinedFilterInput`.
+ * Decorator arguments and that metadata are evaluated at CLASS-DEFINITION time, i.e. while the
+ * module is still initializing. On a cycle that reads a class binding still in its temporal dead
+ * zone, and under SWC → CommonJS it threw:
+ *
+ *   ReferenceError: Cannot access 'CombinedFilterInput' before initialization
+ *
+ * That was not hypothetical — `require('.../combined-filter.input.js')` crashed. It only stayed
+ * hidden because the package barrel happens to pull `filter.input` in first via other importers
+ * (`filter.args`, `filter.helper`), so entering through the barrel masked it. A deep import, a unit
+ * test importing the input directly, or a reordering of `src/index.ts` would all have detonated it.
+ *
+ * Making the reference lazy does NOT fix it: `type: () => CombinedFilterInput` still leaves the
+ * eager `design:type` metadata behind, and SWC's `typeof` guard does not protect the member
+ * expression it compiles to. The only real fix is to remove the import edge — hence one module.
+ *
+ * Within a single module the problem disappears: `FilterInput` reads `CombinedFilterInput` at
+ * definition time, and by then it is already initialized. The reverse direction is safe because
+ * `CombinedFilterInput` only reaches `FilterInput` lazily (a `() => FilterInput` thunk and a method
+ * body), never at definition time.
+ *
+ * `combined-filter.input.ts` remains as a re-export so existing deep imports keep working.
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)" for the general rule.
+ */
 import { InputType } from '@nestjs/graphql';
 
 import { Restricted } from '../decorators/restricted.decorator';
 import { UnifiedField } from '../decorators/unified-field.decorator';
+import { LogicalOperatorEnum } from '../enums/logical-operator.enum';
 import { RoleEnum } from '../enums/role.enum';
-import { CombinedFilterInput } from './combined-filter.input';
+import { maps } from '../helpers/model.helper';
 import { CoreInput } from './core-input.input';
 import { SingleFilterInput } from './single-filter.input';
 
+/**
+ * Combination of multiple filters via logical operator.
+ *
+ * Declared BEFORE `FilterInput` on purpose — `FilterInput` dereferences this class at
+ * class-definition time, so it must already be initialized. See the module docblock.
+ */
+@InputType({
+  description: 'Combination of multiple filters via logical operator',
+})
+@Restricted(RoleEnum.S_EVERYONE)
+export class CombinedFilterInput extends CoreInput {
+  /**
+   * Logical Operator to combine filters
+   */
+  @UnifiedField({
+    description: 'Logical Operator to combine filters',
+    enum: LogicalOperatorEnum,
+    roles: RoleEnum.S_EVERYONE,
+  })
+  logicalOperator: LogicalOperatorEnum = undefined;
+
+  /**
+   * Filters to combine via logical operator
+   *
+   * The `() => FilterInput` thunk is required: `FilterInput` is declared below, so an eager
+   * reference here would read it before initialization.
+   */
+  @UnifiedField({
+    description: 'Filters to combine via logical operator',
+    isOptional: true,
+    roles: RoleEnum.S_EVERYONE,
+    type: () => FilterInput,
+  })
+  filters: FilterInput[] = undefined;
+
+  // ===================================================================================================================
+  // Methods
+  // ===================================================================================================================
+
+  /**
+   * Mapping for Subtypes
+   */
+  override map(
+    data: Partial<this> | Record<string, any>,
+    options: {
+      cloneDeep?: boolean;
+      funcAllowed?: boolean;
+      mapId?: boolean;
+    } = {},
+  ): this {
+    super.map(data, options);
+    this.filters = maps(data.filters, FilterInput, options.cloneDeep);
+    Object.keys(this).forEach((key) => this[key] === undefined && delete this[key]);
+    return this;
+  }
+}
+
 /**
  * Input for filtering. The `singleFilter` will be ignored if the `combinedFilter` is set.
  */

package/src/core/common/interfaces/server-options.interface.ts

@@ -1012,8 +1012,17 @@ export interface ICorsConfig {
    * Convenient for development but NOT recommended for production as it enables
    * CSRF-like attacks from any domain.
    *
-   * When true, overrides `allowedOrigins`. Also propagates to BetterAuth
-   * (trustedOrigins is set to undefined, allowing all origins).
+   * When true, overrides `allowedOrigins`.
+   *
+   * **This does NOT disable BetterAuth's origin check.** BetterAuth keeps
+   * verifying the `Origin` header against its `trustedOrigins`, which are derived
+   * from `appUrl` (and the passkey config). Leaving `trustedOrigins` empty would
+   * not "allow everything" — BetterAuth then trusts only its own `baseURL`, and
+   * origin-checked endpoints such as `two-factor/enable` or passkey registration
+   * answer `403 INVALID_ORIGIN` for a separately hosted frontend.
+   *
+   * To accept arbitrary origins for auth as well, set `betterAuth.trustedOrigins`
+   * explicitly — an origin check has no meaningful "allow everything" mode.
    *
    * @default false
    */
@@ -1337,13 +1346,19 @@ export interface IServerOptions {
    * - Frontend redirect URLs
    *
    * **Auto-Detection from `baseUrl`:**
-   * If not set, `appUrl` is derived from `baseUrl`:
+   * If not set, `appUrl` is derived from `baseUrl` (the port is preserved):
    * - `https://api.example.com` → `https://example.com` (removes 'api.' prefix)
    * - `https://example.com` → `https://example.com` (unchanged)
    *
    * **Localhost Environment Defaults:**
-   * When `env` is 'local', 'ci', or 'e2e' and neither `baseUrl` nor `appUrl` is set:
-   * - `appUrl` defaults to `http://localhost:3001`
+   * When `env` is 'local', 'ci', or 'e2e', `appUrl` is not set, and `baseUrl` is unset or points at
+   * localhost, `appUrl` defaults to `http://localhost:3001`. These defaults encode a PORT split:
+   * one host, API on `:3000`, app on `:3001`.
+   *
+   * A localhost `baseUrl` whose `api.` label strips to a SIBLING host is a HOST split and is
+   * derived instead — `https://api.crm.localhost` → `https://crm.localhost`, as served by
+   * `lt dev up` behind Caddy. `https://api.localhost` strips to the bare `localhost` the API
+   * already answers on, so it keeps the `http://localhost:3001` default.
    *
    * **Environment Variable:** `APP_URL` (only needed if not auto-derivable from `BASE_URL`)
    *
@@ -1362,6 +1377,11 @@ export interface IServerOptions {
    * env: 'local', // or 'ci' or 'e2e'
    * // baseUrl defaults to 'http://localhost:3000'
    * // appUrl defaults to 'http://localhost:3001'
+   *
+   * // Local/CI/E2E behind `lt dev up` (host split — appUrl auto-derived)
+   * env: 'local',
+   * baseUrl: 'https://api.crm.localhost',
+   * // → appUrl auto-derived: 'https://crm.localhost'
    * ```
    */
   appUrl?: string;
@@ -2784,7 +2804,8 @@ interface IBetterAuthBase {
    *   },
    *   advanced: {
    *     cookiePrefix: 'my-app',
-   *     useSecureCookies: true,
+   *     useSecureCookies: true, // re-enables the __Secure- prefix; safe ONLY when Better-Auth
+   *                             // fully manages your cookies — see the note below.
    *     crossSubDomainCookies: {
    *       domain: 'example.com', // Cookies shared across *.example.com
    *     },
@@ -2795,6 +2816,14 @@ interface IBetterAuthBase {
    * **Note on `advanced` options:** The `advanced` object is deep-merged with internal defaults
    * (e.g., `cookiePrefix` derived from `basePath`). You do not need to re-specify `cookiePrefix`
    * when adding other `advanced` options like `crossSubDomainCookies`.
+   *
+   * **`useSecureCookies` is pinned to `false` by default (since v11.27.6).** The framework keeps
+   * Better-Auth's native handlers on the same UNPREFIXED cookie name the nest-server cookie helper
+   * writes; the `Secure` attribute is still applied on an `https://` baseURL via
+   * `advanced.defaultCookieAttributes`, so transport security is unchanged. Only set
+   * `useSecureCookies: true` if Better-Auth manages your session cookies entirely (not the
+   * nest-server helper) — otherwise its native handlers look for a `__Secure-`-prefixed cookie the
+   * helper never writes and answer `401` on 2FA / passkey / `/token`.
    */
   options?: Record<string, unknown>;
 

package/src/core/common/services/config.service.ts

@@ -4,7 +4,10 @@ import { BehaviorSubject, firstValueFrom } from 'rxjs';
 import { filter, map } from 'rxjs/operators';
 
 import { merge } from '../helpers/config.helper';
-import { clone, deepFreeze } from '../helpers/input.helper';
+// Import from the clone.helper LEAF, never from input.helper: input.helper imports
+// restricted.decorator, which reaches back here via core-tenant.helpers — that cycle is what the
+// extraction removed. See clone.helper's docblock.
+import { clone, deepFreeze } from '../helpers/clone.helper';
 import { IServerOptions } from '../interfaces/server-options.interface';
 
 /**

package/src/core/modules/ai/core-ai.constants.ts

@@ -0,0 +1,92 @@
+/**
+ * Dependency-injection tokens of the AI module.
+ *
+ * They live in a dedicated, import-free leaf file — never in a service or in `core-ai.module.ts` —
+ * so that no file needing a token has to import the file that declares it, and no import cycle can
+ * form around one.
+ *
+ * On a cycle, a token read at MODULE-EVALUATION time — inside an `@Inject()` decorator argument, in
+ * the `design:paramtypes` metadata `emitDecoratorMetadata` emits, or in a static field initializer —
+ * reads a `const` still in its temporal dead zone, and SWC-compiled builds (`nest start -b swc`) die
+ * at startup with:
+ *
+ *   ReferenceError: Cannot access 'AI_CONNECTION_MODEL' before initialization
+ *
+ * These tokens were previously declared across eleven `*.service.ts` files, every one of which is
+ * imported by `core-ai.module.ts` and injects tokens through constructor decorators. Nothing had
+ * crashed — the graph happened to be acyclic — but a single back-import from any of those services
+ * would have armed it, and `tsc`, `pnpm test` and `oxlint` are ALL blind to that. Only
+ * `pnpm run check:swc-tdz` sees it.
+ *
+ * A file that imports nothing can never be mid-evaluation when someone imports it, in any module
+ * system, under any compiler. Keep this file import-free.
+ *
+ * The old locations re-export their tokens, so every existing import path still resolves.
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
+ */
+
+// ---- budget ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_BUDGET_LIMIT_CLASS = 'AI_BUDGET_LIMIT_CLASS';
+/** Mongoose injection token. */
+export const AI_BUDGET_LIMIT_MODEL = 'AiBudgetLimit';
+
+// ---- connection-preference ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONNECTION_PREFERENCE_CLASS = 'AI_CONNECTION_PREFERENCE_CLASS';
+/** Mongoose injection token. */
+export const AI_CONNECTION_PREFERENCE_MODEL = 'AiConnectionPreference';
+
+// ---- connection ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONNECTION_CLASS = 'AI_CONNECTION_CLASS';
+/** Mongoose injection token. */
+export const AI_CONNECTION_MODEL = 'AiConnection';
+
+// ---- conversation ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONVERSATION_CLASS = 'AI_CONVERSATION_CLASS';
+/** Mongoose injection token. */
+export const AI_CONVERSATION_MODEL = 'AiConversation';
+
+// ---- interaction ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_INTERACTION_CLASS = 'AI_INTERACTION_CLASS';
+/** Mongoose injection token. */
+export const AI_INTERACTION_MODEL = 'AiInteraction';
+
+// ---- mode ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_MODE_CLASS = 'AI_MODE_CLASS';
+/** Mongoose injection token. */
+export const AI_MODE_MODEL = 'AiMode';
+
+// ---- prompt-hint ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_PROMPT_HINT_CLASS = 'AI_PROMPT_HINT_CLASS';
+/** Mongoose injection token. */
+export const AI_PROMPT_HINT_MODEL = 'AiPromptHint';
+
+// ---- prompt ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_PROMPT_CLASS = 'AI_PROMPT_CLASS';
+/** Mongoose injection token. */
+export const AI_PROMPT_MODEL = 'AiPrompt';
+
+// ---- slot ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_SLOT_CLASS = 'AI_SLOT_CLASS';
+/** Mongoose injection token. */
+export const AI_SLOT_MODEL = 'AiSlot';
+
+// ---- tool-grant ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_TOOL_GRANT_CLASS = 'AI_TOOL_GRANT_CLASS';
+/** Mongoose injection token. */
+export const AI_TOOL_GRANT_MODEL = 'AiToolGrant';
+
+// ---- tool-policy ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_TOOL_POLICY_CLASS = 'AI_TOOL_POLICY_CLASS';
+/** Mongoose injection token. */
+export const AI_TOOL_POLICY_MODEL = 'AiToolPolicy';