@lenne.tech/nest-server 11.27.6 → 11.27.7

package/src/core/common/inputs/combined-filter.input.ts

@@ -1,57 +1,10 @@
-import { InputType } from '@nestjs/graphql';
-
-import { Restricted } from '../decorators/restricted.decorator';
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { LogicalOperatorEnum } from '../enums/logical-operator.enum';
-import { RoleEnum } from '../enums/role.enum';
-import { maps } from '../helpers/model.helper';
-import { CoreInput } from './core-input.input';
-import { FilterInput } from './filter.input';
-
-@InputType({
-  description: 'Combination of multiple filters via logical operator',
-})
-@Restricted(RoleEnum.S_EVERYONE)
-export class CombinedFilterInput extends CoreInput {
-  /**
-   * Logical Operator to combine filters
-   */
-  @UnifiedField({
-    description: 'Logical Operator to combine filters',
-    enum: LogicalOperatorEnum,
-    roles: RoleEnum.S_EVERYONE,
-  })
-  logicalOperator: LogicalOperatorEnum = undefined;
-
-  /**
-   * Filters to combine via logical operator
-   */
-  @UnifiedField({
-    description: 'Filters to combine via logical operator',
-    isOptional: true,
-    roles: RoleEnum.S_EVERYONE,
-    type: () => FilterInput,
-  })
-  filters: FilterInput[] = undefined;
-
-  // ===================================================================================================================
-  // Methods
-  // ===================================================================================================================
-
-  /**
-   * Mapping for Subtypes
-   */
-  override map(
-    data: Partial<this> | Record<string, any>,
-    options: {
-      cloneDeep?: boolean;
-      funcAllowed?: boolean;
-      mapId?: boolean;
-    } = {},
-  ): this {
-    super.map(data, options);
-    this.filters = maps(data.filters, FilterInput, options.cloneDeep);
-    Object.keys(this).forEach((key) => this[key] === undefined && delete this[key]);
-    return this;
-  }
-}
+/**
+ * `CombinedFilterInput` is declared in `./filter.input` — the two classes are mutually recursive
+ * and must live in one module, or the cycle between them crashes SWC-compiled builds with
+ * `ReferenceError: Cannot access 'CombinedFilterInput' before initialization`. See the docblock in
+ * `./filter.input` for the full analysis.
+ *
+ * This file remains only so existing deep imports of `.../inputs/combined-filter.input` keep
+ * resolving. Do NOT move the class back here.
+ */
+export { CombinedFilterInput } from './filter.input';

package/src/core/common/inputs/filter.input.ts

@@ -1,12 +1,103 @@
+/**
+ * Filter inputs.
+ *
+ * `CombinedFilterInput` and `FilterInput` are mutually recursive: a filter may contain a combined
+ * filter, and a combined filter contains a list of filters. They therefore live in ONE module, and
+ * `CombinedFilterInput` is declared FIRST — that ordering is load-bearing, not cosmetic.
+ *
+ * They used to sit in two files that imported each other. `FilterInput` referenced
+ * `CombinedFilterInput` EAGERLY — in a decorator argument (`type: CombinedFilterInput`) and in the
+ * `design:type` metadata `emitDecoratorMetadata` emits for `combinedFilter?: CombinedFilterInput`.
+ * Decorator arguments and that metadata are evaluated at CLASS-DEFINITION time, i.e. while the
+ * module is still initializing. On a cycle that reads a class binding still in its temporal dead
+ * zone, and under SWC → CommonJS it threw:
+ *
+ *   ReferenceError: Cannot access 'CombinedFilterInput' before initialization
+ *
+ * That was not hypothetical — `require('.../combined-filter.input.js')` crashed. It only stayed
+ * hidden because the package barrel happens to pull `filter.input` in first via other importers
+ * (`filter.args`, `filter.helper`), so entering through the barrel masked it. A deep import, a unit
+ * test importing the input directly, or a reordering of `src/index.ts` would all have detonated it.
+ *
+ * Making the reference lazy does NOT fix it: `type: () => CombinedFilterInput` still leaves the
+ * eager `design:type` metadata behind, and SWC's `typeof` guard does not protect the member
+ * expression it compiles to. The only real fix is to remove the import edge — hence one module.
+ *
+ * Within a single module the problem disappears: `FilterInput` reads `CombinedFilterInput` at
+ * definition time, and by then it is already initialized. The reverse direction is safe because
+ * `CombinedFilterInput` only reaches `FilterInput` lazily (a `() => FilterInput` thunk and a method
+ * body), never at definition time.
+ *
+ * `combined-filter.input.ts` remains as a re-export so existing deep imports keep working.
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)" for the general rule.
+ */
 import { InputType } from '@nestjs/graphql';
 
 import { Restricted } from '../decorators/restricted.decorator';
 import { UnifiedField } from '../decorators/unified-field.decorator';
+import { LogicalOperatorEnum } from '../enums/logical-operator.enum';
 import { RoleEnum } from '../enums/role.enum';
-import { CombinedFilterInput } from './combined-filter.input';
+import { maps } from '../helpers/model.helper';
 import { CoreInput } from './core-input.input';
 import { SingleFilterInput } from './single-filter.input';
 
+/**
+ * Combination of multiple filters via logical operator.
+ *
+ * Declared BEFORE `FilterInput` on purpose — `FilterInput` dereferences this class at
+ * class-definition time, so it must already be initialized. See the module docblock.
+ */
+@InputType({
+  description: 'Combination of multiple filters via logical operator',
+})
+@Restricted(RoleEnum.S_EVERYONE)
+export class CombinedFilterInput extends CoreInput {
+  /**
+   * Logical Operator to combine filters
+   */
+  @UnifiedField({
+    description: 'Logical Operator to combine filters',
+    enum: LogicalOperatorEnum,
+    roles: RoleEnum.S_EVERYONE,
+  })
+  logicalOperator: LogicalOperatorEnum = undefined;
+
+  /**
+   * Filters to combine via logical operator
+   *
+   * The `() => FilterInput` thunk is required: `FilterInput` is declared below, so an eager
+   * reference here would read it before initialization.
+   */
+  @UnifiedField({
+    description: 'Filters to combine via logical operator',
+    isOptional: true,
+    roles: RoleEnum.S_EVERYONE,
+    type: () => FilterInput,
+  })
+  filters: FilterInput[] = undefined;
+
+  // ===================================================================================================================
+  // Methods
+  // ===================================================================================================================
+
+  /**
+   * Mapping for Subtypes
+   */
+  override map(
+    data: Partial<this> | Record<string, any>,
+    options: {
+      cloneDeep?: boolean;
+      funcAllowed?: boolean;
+      mapId?: boolean;
+    } = {},
+  ): this {
+    super.map(data, options);
+    this.filters = maps(data.filters, FilterInput, options.cloneDeep);
+    Object.keys(this).forEach((key) => this[key] === undefined && delete this[key]);
+    return this;
+  }
+}
+
 /**
  * Input for filtering. The `singleFilter` will be ignored if the `combinedFilter` is set.
  */

package/src/core/common/services/config.service.ts

@@ -4,7 +4,10 @@ import { BehaviorSubject, firstValueFrom } from 'rxjs';
 import { filter, map } from 'rxjs/operators';
 
 import { merge } from '../helpers/config.helper';
-import { clone, deepFreeze } from '../helpers/input.helper';
+// Import from the clone.helper LEAF, never from input.helper: input.helper imports
+// restricted.decorator, which reaches back here via core-tenant.helpers — that cycle is what the
+// extraction removed. See clone.helper's docblock.
+import { clone, deepFreeze } from '../helpers/clone.helper';
 import { IServerOptions } from '../interfaces/server-options.interface';
 
 /**

package/src/core/modules/ai/core-ai.constants.ts

@@ -0,0 +1,92 @@
+/**
+ * Dependency-injection tokens of the AI module.
+ *
+ * They live in a dedicated, import-free leaf file — never in a service or in `core-ai.module.ts` —
+ * so that no file needing a token has to import the file that declares it, and no import cycle can
+ * form around one.
+ *
+ * On a cycle, a token read at MODULE-EVALUATION time — inside an `@Inject()` decorator argument, in
+ * the `design:paramtypes` metadata `emitDecoratorMetadata` emits, or in a static field initializer —
+ * reads a `const` still in its temporal dead zone, and SWC-compiled builds (`nest start -b swc`) die
+ * at startup with:
+ *
+ *   ReferenceError: Cannot access 'AI_CONNECTION_MODEL' before initialization
+ *
+ * These tokens were previously declared across eleven `*.service.ts` files, every one of which is
+ * imported by `core-ai.module.ts` and injects tokens through constructor decorators. Nothing had
+ * crashed — the graph happened to be acyclic — but a single back-import from any of those services
+ * would have armed it, and `tsc`, `pnpm test` and `oxlint` are ALL blind to that. Only
+ * `pnpm run check:swc-tdz` sees it.
+ *
+ * A file that imports nothing can never be mid-evaluation when someone imports it, in any module
+ * system, under any compiler. Keep this file import-free.
+ *
+ * The old locations re-export their tokens, so every existing import path still resolves.
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
+ */
+
+// ---- budget ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_BUDGET_LIMIT_CLASS = 'AI_BUDGET_LIMIT_CLASS';
+/** Mongoose injection token. */
+export const AI_BUDGET_LIMIT_MODEL = 'AiBudgetLimit';
+
+// ---- connection-preference ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONNECTION_PREFERENCE_CLASS = 'AI_CONNECTION_PREFERENCE_CLASS';
+/** Mongoose injection token. */
+export const AI_CONNECTION_PREFERENCE_MODEL = 'AiConnectionPreference';
+
+// ---- connection ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONNECTION_CLASS = 'AI_CONNECTION_CLASS';
+/** Mongoose injection token. */
+export const AI_CONNECTION_MODEL = 'AiConnection';
+
+// ---- conversation ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_CONVERSATION_CLASS = 'AI_CONVERSATION_CLASS';
+/** Mongoose injection token. */
+export const AI_CONVERSATION_MODEL = 'AiConversation';
+
+// ---- interaction ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_INTERACTION_CLASS = 'AI_INTERACTION_CLASS';
+/** Mongoose injection token. */
+export const AI_INTERACTION_MODEL = 'AiInteraction';
+
+// ---- mode ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_MODE_CLASS = 'AI_MODE_CLASS';
+/** Mongoose injection token. */
+export const AI_MODE_MODEL = 'AiMode';
+
+// ---- prompt-hint ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_PROMPT_HINT_CLASS = 'AI_PROMPT_HINT_CLASS';
+/** Mongoose injection token. */
+export const AI_PROMPT_HINT_MODEL = 'AiPromptHint';
+
+// ---- prompt ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_PROMPT_CLASS = 'AI_PROMPT_CLASS';
+/** Mongoose injection token. */
+export const AI_PROMPT_MODEL = 'AiPrompt';
+
+// ---- slot ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_SLOT_CLASS = 'AI_SLOT_CLASS';
+/** Mongoose injection token. */
+export const AI_SLOT_MODEL = 'AiSlot';
+
+// ---- tool-grant ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_TOOL_GRANT_CLASS = 'AI_TOOL_GRANT_CLASS';
+/** Mongoose injection token. */
+export const AI_TOOL_GRANT_MODEL = 'AiToolGrant';
+
+// ---- tool-policy ----
+/** DI token for the model constructor (used by CrudService mapping). */
+export const AI_TOOL_POLICY_CLASS = 'AI_TOOL_POLICY_CLASS';
+/** Mongoose injection token. */
+export const AI_TOOL_POLICY_MODEL = 'AiToolPolicy';

package/src/core/modules/ai/index.ts

@@ -20,6 +20,7 @@ export * from './inputs/core-ai-slot-update.input';
 export * from './inputs/core-ai-prompt.input';
 export * from './hooks/ai-hook.base';
 export * from './hooks/ai-hook.registry';
+export * from './interfaces/ai-interaction-record.interface';
 export * from './interfaces/ai-hook.interface';
 export * from './interfaces/ai-placeholder.interface';
 export * from './interfaces/ai-tool.interface';

package/src/core/modules/ai/interfaces/ai-interaction-record.interface.ts

@@ -0,0 +1,34 @@
+/**
+ * The record passed to `CoreAiService.audit()` for each prompt run.
+ *
+ * It lives here, in an import-free leaf, rather than in `core-ai.service.ts` — and that is
+ * load-bearing, not tidiness.
+ *
+ * `core-ai.service` imports `core-ai-interaction.service` (it needs the class), and
+ * `core-ai-interaction.service` needs this type back. Declared in the service, that pair forms an
+ * import cycle. It never crashed for exactly one reason: the type was pulled in with `import type`,
+ * which both tsc and SWC erase, so no `require()` was emitted and the cycle was never real at
+ * runtime.
+ *
+ * That is a single keyword of protection, on a file where `core-ai.service` has a constructor
+ * `@Inject`, so `emitDecoratorMetadata` emits `design:paramtypes` at module-evaluation time — the
+ * exact eval-time dereference that turns a cycle fatal. An IDE "organize imports" or a lint autofix
+ * widening `import type` to a plain `import` would have armed it silently, and `tsc`, `pnpm test`
+ * and `oxlint` are ALL blind to that (vitest runs SWC through Vite's cycle-tolerant module runner).
+ * Only `pnpm run check:swc-tdz` would have caught it — after the fact.
+ *
+ * Moving the type out removes the edge entirely, so the cycle no longer exists rather than merely
+ * being disarmed. `core-ai.service` re-exports it, so every existing import path still resolves.
+ *
+ * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
+ */
+export interface AiInteractionRecord {
+  actions: { name: string; success: boolean }[];
+  connectionId: string;
+  iterations: number;
+  prompt: string;
+  responseText: string;
+  tenantId?: string;
+  usage?: { completionTokens?: number; promptTokens?: number; totalTokens?: number };
+  userId?: string;
+}

package/src/core/modules/ai/services/core-ai-budget.service.ts

@@ -11,10 +11,14 @@ import { CoreAiBudgetLimitInput } from '../inputs/core-ai-budget-limit.input';
 import { AiBudgetLimitDocument, CoreAiBudgetLimit } from '../models/core-ai-budget-limit.model';
 import { CoreAiBudgetSummary, CoreAiUsageInfo, CoreAiUsageScope } from '../models/core-ai-usage-info.model';
 
-/** Mongoose injection token for the budget-limit model. */
-export const AI_BUDGET_LIMIT_MODEL = 'AiBudgetLimit';
-/** DI token for the budget-limit model constructor. */
-export const AI_BUDGET_LIMIT_CLASS = 'AI_BUDGET_LIMIT_CLASS';
+import { AI_BUDGET_LIMIT_CLASS, AI_BUDGET_LIMIT_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_BUDGET_LIMIT_CLASS, AI_BUDGET_LIMIT_MODEL } from '../core-ai.constants';
 
 /** Resolved effective limit for a scope. */
 export interface ResolvedAiBudgetLimit {

package/src/core/modules/ai/services/core-ai-connection-preference.service.ts

@@ -10,10 +10,14 @@ import {
   CoreAiConnectionPreference,
 } from '../models/core-ai-connection-preference.model';
 
-/** Mongoose injection token for the connection-preference model. */
-export const AI_CONNECTION_PREFERENCE_MODEL = 'AiConnectionPreference';
-/** DI token for the connection-preference model constructor. */
-export const AI_CONNECTION_PREFERENCE_CLASS = 'AI_CONNECTION_PREFERENCE_CLASS';
+import { AI_CONNECTION_PREFERENCE_CLASS, AI_CONNECTION_PREFERENCE_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_CONNECTION_PREFERENCE_CLASS, AI_CONNECTION_PREFERENCE_MODEL } from '../core-ai.constants';
 
 /**
  * CRUD + lookup for {@link CoreAiConnectionPreference} (tenant/user connection

package/src/core/modules/ai/services/core-ai-connection.service.ts

@@ -23,15 +23,14 @@ import { LlmProviderFactory } from '../providers/llm-provider.factory';
 import { AiCryptoService } from './ai-crypto.service';
 import { CoreAiConnectionPreferenceService } from './core-ai-connection-preference.service';
 
-/**
- * Mongoose injection token for the AI connection model.
- */
-export const AI_CONNECTION_MODEL = 'AiConnection';
+import { AI_CONNECTION_CLASS, AI_CONNECTION_MODEL } from '../core-ai.constants';
 
 /**
- * DI token for the AI connection model constructor (used by CrudService mapping).
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
  */
-export const AI_CONNECTION_CLASS = 'AI_CONNECTION_CLASS';
+export { AI_CONNECTION_CLASS, AI_CONNECTION_MODEL } from '../core-ai.constants';
 
 /**
  * CRUD service for {@link CoreAiConnection} — the database-backed LLM

package/src/core/modules/ai/services/core-ai-conversation.service.ts

@@ -8,15 +8,14 @@ import { CoreAiConversationCreateInput } from '../inputs/core-ai-conversation-cr
 import { CoreAiConversationInput } from '../inputs/core-ai-conversation.input';
 import { AiConversationDocument, CoreAiConversation } from '../models/core-ai-conversation.model';
 
-/**
- * Mongoose injection token for the AI conversation model.
- */
-export const AI_CONVERSATION_MODEL = 'AiConversation';
+import { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants';
 
 /**
- * DI token for the AI conversation model constructor.
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
  */
-export const AI_CONVERSATION_CLASS = 'AI_CONVERSATION_CLASS';
+export { AI_CONVERSATION_CLASS, AI_CONVERSATION_MODEL } from '../core-ai.constants';
 
 /**
  * CRUD service for multi-turn {@link CoreAiConversation}s.

package/src/core/modules/ai/services/core-ai-interaction.service.ts

@@ -5,17 +5,16 @@ import { Model } from 'mongoose';
 import { CrudService } from '../../../common/services/crud.service';
 import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
 import { AiInteractionDocument, CoreAiInteraction } from '../models/core-ai-interaction.model';
-import type { AiInteractionRecord } from './core-ai.service';
+import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
 
-/**
- * Mongoose injection token for the AI interaction model.
- */
-export const AI_INTERACTION_MODEL = 'AiInteraction';
+import { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants';
 
 /**
- * DI token for the AI interaction model constructor.
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
  */
-export const AI_INTERACTION_CLASS = 'AI_INTERACTION_CLASS';
+export { AI_INTERACTION_CLASS, AI_INTERACTION_MODEL } from '../core-ai.constants';
 
 /**
  * CRUD + write service for {@link CoreAiInteraction} audit records.

package/src/core/modules/ai/services/core-ai-mode.service.ts

@@ -6,8 +6,14 @@ import { CrudService } from '../../../common/services/crud.service';
 import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
 import { AiModeDocument, CoreAiMode } from '../models/core-ai-mode.model';
 
-export const AI_MODE_MODEL = 'AiMode';
-export const AI_MODE_CLASS = 'AI_MODE_CLASS';
+import { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_MODE_CLASS, AI_MODE_MODEL } from '../core-ai.constants';
 
 /**
  * Named-mode store. See {@link CoreAiMode}. Override via

package/src/core/modules/ai/services/core-ai-prompt-hint.service.ts

@@ -9,11 +9,14 @@ import { CoreAiPromptHintCreateInput } from '../inputs/core-ai-prompt-hint-creat
 import { CoreAiPromptHintInput } from '../inputs/core-ai-prompt-hint.input';
 import { AiPromptHintDocument, CoreAiPromptHint } from '../models/core-ai-prompt-hint.model';
 
-/** Mongoose injection token for the prompt-hint model. */
-export const AI_PROMPT_HINT_MODEL = 'AiPromptHint';
+import { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants';
 
-/** DI token for the prompt-hint model constructor. */
-export const AI_PROMPT_HINT_CLASS = 'AI_PROMPT_HINT_CLASS';
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_PROMPT_HINT_CLASS, AI_PROMPT_HINT_MODEL } from '../core-ai.constants';
 
 /** A failure signal recorded by the orchestrator for the learning loop. */
 export interface AiPromptFeedbackSignal {

package/src/core/modules/ai/services/core-ai-prompt.service.ts

@@ -10,8 +10,14 @@ import { CoreAiPromptCreateInput } from '../inputs/core-ai-prompt-create.input';
 import { CoreAiPromptUpdateInput } from '../inputs/core-ai-prompt-update.input';
 import { AiPromptDocument, CoreAiPrompt } from '../models/core-ai-prompt.model';
 
-export const AI_PROMPT_MODEL = 'AiPrompt';
-export const AI_PROMPT_CLASS = 'AI_PROMPT_CLASS';
+import { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_PROMPT_CLASS, AI_PROMPT_MODEL } from '../core-ai.constants';
 
 const VALID_SCOPES = new Set(['tenant', 'user']);
 

package/src/core/modules/ai/services/core-ai-slot.service.ts

@@ -11,11 +11,14 @@ import { CoreAiSlotCreateInput } from '../inputs/core-ai-slot-create.input';
 import { CoreAiSlotUpdateInput } from '../inputs/core-ai-slot-update.input';
 import { AiSlotDocument, CoreAiSlot } from '../models/core-ai-slot.model';
 
-/** Mongoose injection token for the slot model. */
-export const AI_SLOT_MODEL = 'AiSlot';
+import { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants';
 
-/** DI token for the slot model constructor. */
-export const AI_SLOT_CLASS = 'AI_SLOT_CLASS';
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_SLOT_CLASS, AI_SLOT_MODEL } from '../core-ai.constants';
 
 /** A resolved prompt fragment ready for placeholder rendering + assembly. */
 export interface ResolvedPromptFragment {

package/src/core/modules/ai/services/core-ai-tool-grant.service.ts

@@ -6,10 +6,14 @@ import { CrudService } from '../../../common/services/crud.service';
 import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
 import { AiToolGrantDocument, CoreAiToolGrant } from '../models/core-ai-tool-grant.model';
 
-/** Mongoose injection token. */
-export const AI_TOOL_GRANT_MODEL = 'AiToolGrant';
-/** DI token for the model constructor. */
-export const AI_TOOL_GRANT_CLASS = 'AI_TOOL_GRANT_CLASS';
+import { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
 
 /** Scope of a persisted permission decision. */
 export type AiToolGrantScope = 'conversation' | 'tenant' | 'user';

package/src/core/modules/ai/services/core-ai-tool-policy.service.ts

@@ -6,10 +6,14 @@ import { CrudService } from '../../../common/services/crud.service';
 import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
 import { AiToolPolicyDocument, CoreAiToolPolicy } from '../models/core-ai-tool-policy.model';
 
-/** Mongoose injection token. */
-export const AI_TOOL_POLICY_MODEL = 'AiToolPolicy';
-/** DI token for the model constructor. */
-export const AI_TOOL_POLICY_CLASS = 'AI_TOOL_POLICY_CLASS';
+import { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
+
+/**
+ * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
+ * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
+ * (SWC-safe — see core-ai.constants.ts).
+ */
+export { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
 
 export interface AiToolPolicyDecision {
   /** Final decision: 'allow', 'deny' or 'ask'. */

package/src/core/modules/ai/services/core-ai.service.ts

@@ -27,20 +27,17 @@ import { AiPromptFeedbackSignal, CoreAiPromptHintService } from './core-ai-promp
 import { AiToolGrantScope, CoreAiToolGrantService } from './core-ai-tool-grant.service';
 import { CoreAiToolPolicyService } from './core-ai-tool-policy.service';
 import { CoreAiModeService } from './core-ai-mode.service';
+import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
 
 /**
- * Record passed to {@link CoreAiService.audit} for each prompt run.
+ * @deprecated Import from `../interfaces/ai-interaction-record.interface` instead. Re-exported only
+ * so existing imports keep working.
+ *
+ * The type was moved out of this file because `core-ai-interaction.service` needs it while this file
+ * imports THAT service — an import cycle held apart only by an `import type`. See the interface's
+ * docblock.
  */
-export interface AiInteractionRecord {
-  actions: { name: string; success: boolean }[];
-  connectionId: string;
-  iterations: number;
-  prompt: string;
-  responseText: string;
-  tenantId?: string;
-  usage?: { completionTokens?: number; promptTokens?: number; totalTokens?: number };
-  userId?: string;
-}
+export type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
 
 /**
  * Event emitted by {@link CoreAiService.promptStream} over SSE.

package/src/core/modules/better-auth/better-auth-roles.guard.ts

@@ -13,7 +13,7 @@ import { ErrorCode } from '../error-code';
 import { isMultiTenancyActive, isSystemRole, mergeRolesMetadata } from '../tenant/core-tenant.helpers';
 import { BetterAuthTokenService } from './better-auth-token.service';
 import { BetterAuthenticatedUser } from './better-auth.types';
-import { CoreBetterAuthModule } from './core-better-auth.module';
+import { getBetterAuthTokenService } from './core-better-auth.registry';
 
 /**
  * BetterAuth Roles Guard
@@ -33,7 +33,8 @@ import { CoreBetterAuthModule } from './core-better-auth.module';
  * IMPORTANT: This guard has NO constructor dependencies. This is intentional because
  * NestJS DI has issues resolving Reflector/ModuleRef for APP_GUARD providers in dynamic modules.
  * Instead, we use Reflect.getMetadata directly to read decorator metadata, and access
- * BetterAuthTokenService via CoreBetterAuthModule static reference.
+ * BetterAuthTokenService via the core-better-auth.registry leaf module — NOT via
+ * CoreBetterAuthModule, which would make guard and module import each other.
  */
 @Injectable()
 export class BetterAuthRolesGuard implements CanActivate {
@@ -41,12 +42,17 @@ export class BetterAuthRolesGuard implements CanActivate {
   private tokenService: BetterAuthTokenService | null = null;
 
   /**
-   * Get BetterAuthTokenService lazily from CoreBetterAuthModule
-   * This avoids DI issues while still allowing token verification
+   * Get BetterAuthTokenService lazily from the better-auth registry.
+   * This avoids DI issues while still allowing token verification.
+   *
+   * The lookup goes through core-better-auth.registry.ts rather than
+   * CoreBetterAuthModule on purpose: importing the module here would make guard
+   * and module import each other, and that cycle is one decorator away from the
+   * SWC temporal-dead-zone crash documented in core-better-auth.constants.ts.
    */
   private getTokenService(): BetterAuthTokenService | null {
     if (!this.tokenService) {
-      this.tokenService = CoreBetterAuthModule.getTokenServiceInstance();
+      this.tokenService = getBetterAuthTokenService();
     }
     return this.tokenService;
   }

package/src/core/modules/better-auth/better-auth.config.ts

@@ -476,6 +476,22 @@ export function createBetterAuthInstance(options: CreateBetterAuthOptions): Crea
       finalConfig.advanced = {
         ...(betterAuthConfig.advanced as Record<string, unknown>),
         ...(optionsAdvanced as Record<string, unknown>),
+        // `defaultCookieAttributes` needs a DEEP merge, not the shallow spread above.
+        // It is the key that carries our restored `secure: true` (see the `useSecureCookies: false`
+        // block), so a consumer setting it for an entirely unrelated reason — `{ partitioned: true }`,
+        // `{ domain: … }` — would wholesale-replace the object and silently strip `Secure` from every
+        // session cookie the native handlers forward (2FA verify, social callback, magic link) on an
+        // https deployment. Session-establishing cookies, in the clear, with no error anywhere.
+        // Re-apply `secure: true` as the BASE and let the consumer's keys spread over it, so an
+        // EXPLICIT `secure: false` still wins while an unrelated key can no longer clobber it.
+        ...(secureCookies && {
+          defaultCookieAttributes: {
+            secure: true,
+            ...((optionsAdvanced as Record<string, unknown>).defaultCookieAttributes as
+              | Record<string, unknown>
+              | undefined),
+          },
+        }),
       };
     }
   } else {