@lenne.tech/nest-server 11.43.2 → 12.0.0

package/src/core/modules/permissions/core-permissions.service.ts

@@ -3,8 +3,8 @@ import * as fs from 'fs';
 import { existsSync } from 'fs';
 import { join } from 'path';
 
-import type { ModulePermissions, PermissionsReport } from './interfaces/permissions.interface';
-import { findProjectRoot, generateMarkdownReport, scanPermissions } from './permissions-scanner';
+import type { ModulePermissions, PermissionsReport } from './interfaces/permissions.interface.js';
+import { findProjectRoot, generateMarkdownReport, scanPermissions } from './permissions-scanner.js';
 
 @Injectable()
 export class CorePermissionsService implements OnModuleDestroy {

package/src/core/modules/permissions/permissions-scanner.ts

@@ -26,7 +26,7 @@ import type {
   SecurityCheckInfo,
   SecurityWarning,
   WarningsByType,
-} from './interfaces/permissions.interface';
+} from './interfaces/permissions.interface.js';
 
 // ─────────────────────────────────────────────────────────────────────────────
 // Public API

package/src/core/modules/system-setup/core-system-setup.controller.ts

@@ -2,9 +2,9 @@ import { Body, Controller, Get, Post } from '@nestjs/common';
 import { ApiBody, ApiOperation, ApiProperty, ApiResponse, ApiTags } from '@nestjs/swagger';
 import { IsEmail, IsNotEmpty, IsOptional, IsString, MinLength } from 'class-validator';
 
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CoreSystemSetupService, SystemSetupInitResult, SystemSetupStatus } from './core-system-setup.service';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CoreSystemSetupService, SystemSetupInitResult, SystemSetupStatus } from './core-system-setup.service.js';
 
 /**
  * DTO for system setup init request

package/src/core/modules/system-setup/core-system-setup.module.ts

@@ -1,7 +1,7 @@
 import { Module } from '@nestjs/common';
 
-import { CoreSystemSetupController } from './core-system-setup.controller';
-import { CoreSystemSetupService } from './core-system-setup.service';
+import { CoreSystemSetupController } from './core-system-setup.controller.js';
+import { CoreSystemSetupService } from './core-system-setup.service.js';
 
 /**
  * CoreSystemSetupModule provides initial admin creation for fresh deployments.

package/src/core/modules/system-setup/core-system-setup.service.ts

@@ -1,13 +1,13 @@
 import { ForbiddenException, Injectable, Logger, OnApplicationBootstrap } from '@nestjs/common';
 import { InjectConnection } from '@nestjs/mongoose';
 import { isEmail } from 'class-validator';
-import { Connection } from 'mongoose';
+import type { Connection } from 'mongoose';
 
-import { ConfigService } from '../../common/services/config.service';
-import { legacyCredentialAccountIssuer } from '../better-auth/core-better-auth-account-issuer.helper';
-import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper';
-import { CoreBetterAuthService } from '../better-auth/core-better-auth.service';
-import { ErrorCode } from '../error-code/error-codes';
+import { ConfigService } from '../../common/services/config.service.js';
+import { legacyCredentialAccountIssuer } from '../better-auth/core-better-auth-account-issuer.helper.js';
+import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper.js';
+import { CoreBetterAuthService } from '../better-auth/core-better-auth.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
 
 /**
  * Collection holding the bootstrap claim markers.

package/src/core/modules/tenant/core-role-scope.registry.ts

@@ -1,6 +1,6 @@
-import { GLOBAL_ONLY_ROLES, isSystemRole, looksLikeSystemRole } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums';
+import { GLOBAL_ONLY_ROLES, isSystemRole, looksLikeSystemRole } from '../../common/enums/role.enum.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums.js';
 
 /**
  * Where a role's authority comes from — and therefore which source may answer it.

package/src/core/modules/tenant/core-tenant-member.model.ts

@@ -1,14 +1,14 @@
 import { ObjectType } from '@nestjs/graphql';
 import { Schema } from '@nestjs/mongoose';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { CorePersistenceModel } from '../../common/models/core-persistence.model';
-import { RequestContext } from '../../common/services/request-context.service';
-import { DefaultHR, TenantMemberStatus } from './core-tenant.enums';
-import { checkRoleAccess } from './core-tenant.helpers';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { CorePersistenceModel } from '../../common/models/core-persistence.model.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { DefaultHR, TenantMemberStatus } from './core-tenant.enums.js';
+import { checkRoleAccess } from './core-tenant.helpers.js';
 
 /**
  * Core tenant member model (join table: User <-> Tenant).

package/src/core/modules/tenant/core-tenant-role.helper.ts

@@ -1,7 +1,7 @@
-import { looksLikeSystemRole } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { RequestContext } from '../../common/services/request-context.service';
-import { checkRoleAccess, resolveGlobalAndTenantRoles, tenantSatisfiableRoles } from './core-tenant.helpers';
+import { looksLikeSystemRole } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { checkRoleAccess, resolveGlobalAndTenantRoles, tenantSatisfiableRoles } from './core-tenant.helpers.js';
 
 /**
  * Service-level tenant role checks.

package/src/core/modules/tenant/core-tenant.decorators.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator, SetMetadata } from '@nestjs/common';
 
-import { RequestContext } from '../../common/services/request-context.service';
+import { RequestContext } from '../../common/services/request-context.service.js';
 
 /**
  * Metadata key for @SkipTenantCheck() decorator.

package/src/core/modules/tenant/core-tenant.guard.ts

@@ -14,28 +14,28 @@ import { GqlExecutionContext } from '@nestjs/graphql';
 import { InjectModel } from '@nestjs/mongoose';
 import { Model } from 'mongoose';
 
-import { RoleEnum } from '../../common/enums/role.enum';
-import { resolveGuardRequest } from '../../common/helpers/execution-context-request.helper';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { resolveGuardRequest } from '../../common/helpers/execution-context-request.helper.js';
 import {
   revalidateAllWsConnections,
   revalidateWsConnectionsForTenant,
   revalidateWsConnectionsOf,
-} from '../../common/helpers/graphql-ws-connection.helper';
-import { ConfigService } from '../../common/services/config.service';
-import { ResolvedTenantContext, setTenantContextResolver } from '../../common/services/core-tenant-context.registry';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { ApiTokenKind } from '../api-token/core-api-token.constants';
+} from '../../common/helpers/graphql-ws-connection.helper.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { ResolvedTenantContext, setTenantContextResolver } from '../../common/services/core-tenant-context.registry.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { ApiTokenKind } from '../api-token/core-api-token.constants.js';
 import {
   capApiTokenTenantRole,
   enforceApiTokenRoute,
   getApiTokenContext,
   getApiTokenTenantRestriction,
-} from '../api-token/core-api-token.helpers';
-import { ErrorCode } from '../error-code/error-codes';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { registerActiveTenantGuard } from './core-tenant-guard.registry';
-import { SKIP_TENANT_CHECK_KEY } from './core-tenant.decorators';
-import { TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums';
+} from '../api-token/core-api-token.helpers.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { registerActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { SKIP_TENANT_CHECK_KEY } from './core-tenant.decorators.js';
+import { TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums.js';
 import {
   checkRoleAccess,
   getMinRequiredLevel,
@@ -44,7 +44,8 @@ import {
   mergeRolesMetadata,
   resolveGlobalAndTenantRoles,
   tenantSatisfiableRoles,
-} from './core-tenant.helpers';
+} from './core-tenant.helpers.js';
+import { isBetterAuthHandlerClass } from '../better-auth/core-better-auth.registry.js';
 
 /**
  * Cached membership entry with TTL
@@ -181,6 +182,7 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     // GraphQL WebSocket. See core-tenant-context.registry.ts for why this is a registry and not DI.
     setTenantContextResolver({
       resolve: (user, headerTenantId) => this.resolveTenantContext(user, headerTenantId),
+      resolveMembership: (user, headerTenantId) => this.resolveMembershipContext(user, headerTenantId),
     });
 
     // Lets the role guards delegate non-system roles to this guard — only while it exists.
@@ -248,6 +250,39 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     return { tenantIds: carrier.tenantIds ?? [] };
   }
 
+  /**
+   * The tenant context `canActivate()` gives an `@Roles(S_EVERYONE)` route, for a caller it could not
+   * see: a route that authenticates its caller ITSELF, after the guards ran without a user.
+   *
+   * That is the MCP endpoint with an MCP OAuth access token — a credential nothing but its controller
+   * accepts, so the guard found no `request.user`, never checked the tenant header against a
+   * membership, and every tenant-scoped tool answered "Tenant context required" to a member of that
+   * very tenant. Answering through the same {@link memberTenantContext} as the guard's own branch is
+   * what keeps the result independent of which credential the caller used.
+   *
+   * Narrower than {@link resolveTenantContext} on purpose: that one answers for a transport whose every
+   * operation needs a scope (no admin bypass here, no list of all memberships without a header).
+   */
+  async resolveMembershipContext(
+    user: { id: string; roles?: string[] } | undefined,
+    headerTenantId?: string,
+  ): Promise<ResolvedTenantContext> {
+    const config = ConfigService.configFastButReadOnly?.multiTenancy;
+    if (!config || config.enabled === false) {
+      return {};
+    }
+    this.syncConfig(config);
+
+    const tenantId =
+      headerTenantId && typeof headerTenantId === 'string' && headerTenantId.length <= 128
+        ? headerTenantId.trim()
+        : undefined;
+    if (!tenantId || !user?.id) {
+      return {};
+    }
+    return (await this.memberTenantContext(user, tenantId)) ?? {};
+  }
+
   /**
    * Subscribe to the cross-replica cache invalidation channel.
    *
@@ -414,10 +449,10 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
       // Optionally enrich with tenant context when header is present and user is an active member.
       // Never block access — S_EVERYONE endpoints are always public.
       if (headerTenantId && request.user?.id) {
-        const membership = await this.findMembershipCached(request.user.id, headerTenantId);
-        if (membership && (await this.isTenantActive(headerTenantId))) {
-          request.tenantId = headerTenantId;
-          request.tenantRole = capApiTokenTenantRole(request.user, membership.role as string) ?? undefined;
+        const member = await this.memberTenantContext(request.user, headerTenantId);
+        if (member) {
+          request.tenantId = member.tenantId;
+          request.tenantRole = member.tenantRole;
         }
       }
       return true;
@@ -901,6 +936,22 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
     return active;
   }
 
+  /**
+   * The context an ACTIVE membership in an active tenant establishes, or undefined. Never the header
+   * alone: a freely chosen tenant id only becomes a scope once it names one of the caller's own tenants.
+   * Shared by the `S_EVERYONE` branch of `canActivate()` and {@link resolveMembershipContext}.
+   */
+  private async memberTenantContext(
+    user: { id: string; roles?: string[] },
+    tenantId: string,
+  ): Promise<{ tenantId: string; tenantRole?: string } | undefined> {
+    const membership = await this.findMembershipCached(user.id, tenantId);
+    if (!membership || !(await this.isTenantActive(tenantId))) {
+      return undefined;
+    }
+    return { tenantId, tenantRole: capApiTokenTenantRole(user, membership.role as string) ?? undefined };
+  }
+
   /** 403 for a deactivated tenant. */
   private async assertTenantActive(tenantId: string): Promise<void> {
     if (!(await this.isTenantActive(tenantId))) {
@@ -975,32 +1026,11 @@ export class CoreTenantGuard implements CanActivate, OnApplicationBootstrap, OnM
    * Check if the current request is handled by a BetterAuth (IAM) handler
    * (controller or resolver). Used for auto-skip tenant check on IAM endpoints.
    *
-   * Uses require() instead of import to avoid a circular dependency:
-   * tenant module → better-auth module (which may depend on tenant module indirectly).
-   * The require() is lazy and resolved only when needed (Node.js caches the result).
+   * Reads the classes from the better-auth registry leaf, where both register themselves as their files load: a
+   * direct import would put tenant and better-auth on an import cycle, and the lazy `require()` this used before
+   * exists only in CommonJS. A handler whose file was never loaded cannot be the current handler anyway.
    */
   private isBetterAuthHandler(context: ExecutionContext): boolean {
-    const handler = context.getClass();
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const { CoreBetterAuthController } =
-        require('../better-auth/core-better-auth.controller') as typeof import('../better-auth/core-better-auth.controller');
-      if (handler === CoreBetterAuthController || handler.prototype instanceof CoreBetterAuthController) {
-        return true;
-      }
-    } catch {
-      /* BetterAuth controller not available */
-    }
-    try {
-      // eslint-disable-next-line @typescript-eslint/no-require-imports
-      const { CoreBetterAuthResolver } =
-        require('../better-auth/core-better-auth.resolver') as typeof import('../better-auth/core-better-auth.resolver');
-      if (handler === CoreBetterAuthResolver || handler.prototype instanceof CoreBetterAuthResolver) {
-        return true;
-      }
-    } catch {
-      /* BetterAuth resolver not available */
-    }
-    return false;
+    return isBetterAuthHandlerClass(context.getClass());
   }
 }

package/src/core/modules/tenant/core-tenant.helpers.ts

@@ -1,10 +1,10 @@
 import { Logger } from '@nestjs/common';
 
-import { isForbiddenMembershipRole, isGlobalOnlyRole, looksLikeSystemRole } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { RoleScope, roleScopeRegistry, RoleScopeSource } from './core-role-scope.registry';
-import { hasActiveTenantGuard } from './core-tenant-guard.registry';
-import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums';
+import { isForbiddenMembershipRole, isGlobalOnlyRole, looksLikeSystemRole } from '../../common/enums/role.enum.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RoleScope, roleScopeRegistry, RoleScopeSource } from './core-role-scope.registry.js';
+import { hasActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { DEFAULT_ROLE_HIERARCHY } from './core-tenant.enums.js';
 
 /**
  * Merge handler-level and class-level @Roles() metadata arrays into a single flat array.
@@ -37,7 +37,7 @@ export {
   looksLikeGlobalOnlyRole,
   looksLikeSystemRole,
   SYSTEM_ROLE_PREFIX,
-} from '../../common/enums/role.enum';
+} from '../../common/enums/role.enum.js';
 
 /**
  * Feeds the role-scope registry from `multiTenancy` config.

package/src/core/modules/tenant/core-tenant.module.ts

@@ -3,13 +3,13 @@ import { APP_GUARD } from '@nestjs/core';
 import { MongooseModule, SchemaFactory, getModelToken } from '@nestjs/mongoose';
 import { Model } from 'mongoose';
 
-import { roleScopeRegistry } from './core-role-scope.registry';
-import { registerActiveTenantGuard } from './core-tenant-guard.registry';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { TENANT_MEMBER_MODEL_TOKEN } from './core-tenant.enums';
-import { assertRoleVocabularyIsCoherent, configRoleScopeSource } from './core-tenant.helpers';
-import { CoreTenantGuard } from './core-tenant.guard';
-import { CoreTenantService } from './core-tenant.service';
+import { roleScopeRegistry } from './core-role-scope.registry.js';
+import { registerActiveTenantGuard } from './core-tenant-guard.registry.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { TENANT_MEMBER_MODEL_TOKEN } from './core-tenant.enums.js';
+import { assertRoleVocabularyIsCoherent, configRoleScopeSource } from './core-tenant.helpers.js';
+import { CoreTenantGuard } from './core-tenant.guard.js';
+import { CoreTenantService } from './core-tenant.service.js';
 
 /**
  * Options for CoreTenantModule.forRoot().

package/src/core/modules/tenant/core-tenant.service.ts

@@ -2,12 +2,12 @@ import { BadRequestException, Injectable, Logger, NotFoundException, Optional }
 import { InjectModel } from '@nestjs/mongoose';
 import { Model } from 'mongoose';
 
-import { looksLikeGlobalOnlyRole, looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { RequestContext } from '../../common/services/request-context.service';
-import { CoreTenantMemberModel } from './core-tenant-member.model';
-import { DEFAULT_ROLE_HIERARCHY, TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums';
-import { CoreTenantGuard } from './core-tenant.guard';
+import { looksLikeGlobalOnlyRole, looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { CoreTenantMemberModel } from './core-tenant-member.model.js';
+import { DEFAULT_ROLE_HIERARCHY, TENANT_MEMBER_MODEL_TOKEN, TenantMemberStatus } from './core-tenant.enums.js';
+import { CoreTenantGuard } from './core-tenant.guard.js';
 
 /**
  * Core service for tenant membership operations.

package/src/core/modules/tus/core-tus.controller.ts

@@ -1,11 +1,11 @@
 import { All, Controller, Logger, Options, Req, Res } from '@nestjs/common';
-import { Request, Response } from 'express';
+import type { Request, Response } from 'express';
 
-import { ApiMethods } from '../../common/decorators/api-methods.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { SkipTenantCheck } from '../tenant/core-tenant.decorators';
-import { CoreTusService } from './core-tus.service';
+import { ApiMethods } from '../../common/decorators/api-methods.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { SkipTenantCheck } from '../tenant/core-tenant.decorators.js';
+import { CoreTusService } from './core-tus.service.js';
 
 /**
  * Core TUS Controller

package/src/core/modules/tus/core-tus.service.ts

@@ -3,32 +3,32 @@ import { ModuleRef } from '@nestjs/core';
 import { FileStore } from '@tus/file-store';
 import { Server, Upload } from '@tus/server';
 import * as fs from 'fs';
-import { Connection, mongo } from 'mongoose';
+import { type Connection, mongo } from 'mongoose';
 import * as path from 'path';
 import { Readable } from 'stream';
 
-import { GridFSHelper } from '../../common/helpers/gridfs.helper';
-import { ITusConfig } from '../../common/interfaces/server-options.interface';
-import { buildCorsConfig } from '../../common/helpers/cookies.helper';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { CoreS3Service } from '../../common/services/core-s3.service';
-import { getTenantContextResolver } from '../../common/services/core-tenant-context.registry';
-import { resolveFileStorage } from '../file/file-storage.helper';
+import { GridFSHelper } from '../../common/helpers/gridfs.helper.js';
+import { ITusConfig } from '../../common/interfaces/server-options.interface.js';
+import { buildCorsConfig } from '../../common/helpers/cookies.helper.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { CoreS3Service } from '../../common/services/core-s3.service.js';
+import { getTenantContextResolver } from '../../common/services/core-tenant-context.registry.js';
+import { resolveFileStorage } from '../file/file-storage.helper.js';
 import {
   DEFAULT_FILESYSTEM_DIR,
   FILESYSTEM_FILES_COLLECTION,
   FilesystemFileHelper,
-} from '../file/filesystem-file.helper';
-import { S3_FILES_COLLECTION, S3FileHelper } from '../file/s3-file.helper';
-import { TUS_FILE_ID_HEADER, TUS_OWNER_METADATA_KEY, TUS_TENANT_METADATA_KEY } from './tus.constants';
-import { TusRedisLocker } from './tus-redis-locker';
+} from '../file/filesystem-file.helper.js';
+import { S3_FILES_COLLECTION, S3FileHelper } from '../file/s3-file.helper.js';
+import { TUS_FILE_ID_HEADER, TUS_OWNER_METADATA_KEY, TUS_TENANT_METADATA_KEY } from './tus.constants.js';
+import { TusRedisLocker } from './tus-redis-locker.js';
 import {
   DEFAULT_TUS_ALLOWED_HEADERS,
   DEFAULT_TUS_CONFIG,
   normalizeTusConfig,
   parseExpirationTime,
-} from './interfaces/tus-config.interface';
+} from './interfaces/tus-config.interface.js';
 
 /**
  * Optional dependencies of CoreTusService.

package/src/core/modules/tus/index.ts

@@ -1,6 +1,6 @@
 // TUS Module exports
-export * from './core-tus.controller';
-export * from './core-tus.service';
-export * from './interfaces/tus-config.interface';
-export * from './tus.constants';
-export * from './tus.module';
+export * from './core-tus.controller.js';
+export * from './core-tus.service.js';
+export * from './interfaces/tus-config.interface.js';
+export * from './tus.constants.js';
+export * from './tus.module.js';

package/src/core/modules/tus/interfaces/tus-config.interface.ts

@@ -4,15 +4,15 @@
  * The interfaces are defined in server-options.interface.ts to avoid circular imports.
  * This file contains helper functions and defaults.
  */
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ITusConfig, ITusExpirationConfig } from '../../../common/interfaces/server-options.interface';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import type { ITusConfig, ITusExpirationConfig } from '../../../common/interfaces/server-options.interface.js';
 
-// Re-export for convenience
-export {
+// Re-export for convenience (type-only: an `export { … }` of a type is a value re-export in ESM and fails to link)
+export type {
   ITusConfig,
   ITusCreationConfig,
   ITusExpirationConfig,
-} from '../../../common/interfaces/server-options.interface';
+} from '../../../common/interfaces/server-options.interface.js';
 
 /**
  * Additional allowed headers for TUS requests (beyond @tus/server defaults).

package/src/core/modules/tus/tus-redis-locker.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@nestjs/common';
 import { randomUUID } from 'node:crypto';
 
-import { CoreRedisService } from '../../common/services/core-redis.service';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
 
 /** Release callback handed to the current lock holder when someone else wants the resource */
 type RequestRelease = () => Promise<void> | void;

package/src/core/modules/tus/tus.module.ts

@@ -2,16 +2,16 @@ import { DynamicModule, Global, Logger, Module, OnModuleInit, Type } from '@nest
 import { PATH_METADATA } from '@nestjs/common/constants';
 import { ModuleRef } from '@nestjs/core';
 import { getConnectionToken } from '@nestjs/mongoose';
-import { Connection } from 'mongoose';
+import type { Connection } from 'mongoose';
 
-import { ITusConfig } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { CoreS3Service } from '../../common/services/core-s3.service';
-import { CoreTusController } from './core-tus.controller';
-import { CoreTusService } from './core-tus.service';
-import { TUS_CONFIG } from './tus.constants';
-import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.interface';
+import { ITusConfig } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { CoreS3Service } from '../../common/services/core-s3.service.js';
+import { CoreTusController } from './core-tus.controller.js';
+import { CoreTusService } from './core-tus.service.js';
+import { TUS_CONFIG } from './tus.constants.js';
+import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.interface.js';
 
 /**
  * @deprecated Import from `./tus.constants` instead. Re-exported only so existing deep imports keep
@@ -20,7 +20,7 @@ import { DEFAULT_TUS_CONFIG, normalizeTusConfig } from './interfaces/tus-config.
  *
  * Do NOT import it from here inside the TUS module itself — that is what re-creates the cycle.
  */
-export { TUS_CONFIG } from './tus.constants';
+export { TUS_CONFIG } from './tus.constants.js';
 
 /**
  * Options for TusModule.forRoot()

package/src/core/modules/user/core-user.model.ts

@@ -3,11 +3,11 @@ import { Schema as MongooseSchema, Prop, raw } from '@nestjs/mongoose';
 import { ApiExtraModels, ApiProperty } from '@nestjs/swagger';
 import { Document } from 'mongoose';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CorePersistenceModel } from '../../common/models/core-persistence.model';
-import { CoreTokenData } from '../auth/interfaces/core-token-data.interface';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CorePersistenceModel } from '../../common/models/core-persistence.model.js';
+import { CoreTokenData } from '../auth/interfaces/core-token-data.interface.js';
 
 export type CoreUserModelDocument = CoreUserModel & Document;
 

package/src/core/modules/user/core-user.service.ts

@@ -1,26 +1,26 @@
 import { BadRequestException, Logger, NotFoundException, UnprocessableEntityException } from '@nestjs/common';
-import bcrypt = require('bcrypt');
-import crypto = require('crypto');
+import bcrypt from 'bcrypt';
+import * as crypto from 'crypto';
 import { sha256 } from 'js-sha256';
 import { Document, Model } from 'mongoose';
 
-import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper';
-import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper';
-import { maskEmail } from '../../common/helpers/logging.helper';
-import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper';
-import { ServiceOptions } from '../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { CrudService } from '../../common/services/crud.service';
-import { ErrorCode } from '../error-code/error-codes';
-import { EmailService } from '../../common/services/email.service';
-import { revokeApiTokensOfUser } from '../api-token/core-api-token.registry';
-import { CoreModelConstructor } from '../../common/types/core-model-constructor.type';
-import { CoreUserModel } from './core-user.model';
-import { CoreUserCreateInput } from './inputs/core-user-create.input';
-import { CoreUserInput } from './inputs/core-user.input';
-import { CoreUserServiceOptions } from './interfaces/core-user-service-options.interface';
+import { looksLikeSystemRole, SYSTEM_ROLE_PREFIX } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { resolveAppUrlFromConfig } from '../../common/helpers/cookies.helper.js';
+import { revalidateWsConnectionsOf } from '../../common/helpers/graphql-ws-connection.helper.js';
+import { maskEmail } from '../../common/helpers/logging.helper.js';
+import { assignPlain, isQueryableString, prepareServiceOptionsForCreate } from '../../common/helpers/input.helper.js';
+import { ServiceOptions } from '../../common/interfaces/service-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CrudService } from '../../common/services/crud.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { EmailService } from '../../common/services/email.service.js';
+import { revokeApiTokensOfUser } from '../api-token/core-api-token.registry.js';
+import { CoreModelConstructor } from '../../common/types/core-model-constructor.type.js';
+import { CoreUserModel } from './core-user.model.js';
+import { CoreUserCreateInput } from './inputs/core-user-create.input.js';
+import { CoreUserInput } from './inputs/core-user.input.js';
+import { CoreUserServiceOptions } from './interfaces/core-user-service-options.interface.js';
 
 /**
  * User service

package/src/core/modules/user/inputs/core-user-create.input.ts

@@ -1,10 +1,10 @@
 import { InputType } from '@nestjs/graphql';
 import { IsEmail } from 'class-validator';
 
-import { Restricted } from '../../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { CoreUserInput } from './core-user.input';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { CoreUserInput } from './core-user.input.js';
 
 /**
  * User input to create a new user

package/src/core/modules/user/inputs/core-user.input.ts

@@ -1,11 +1,11 @@
 import { InputType } from '@nestjs/graphql';
 import { IsEmail, IsString, Matches } from 'class-validator';
 
-import { Restricted } from '../../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../../common/decorators/unified-field.decorator';
-import { ProcessType } from '../../../common/enums/process-type.enum';
-import { RoleEnum, SYSTEM_ROLE_PREFIX, SYSTEM_ROLE_REJECT_PATTERN } from '../../../common/enums/role.enum';
-import { CoreInput } from '../../../common/inputs/core-input.input';
+import { Restricted } from '../../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../../common/decorators/unified-field.decorator.js';
+import { ProcessType } from '../../../common/enums/process-type.enum.js';
+import { RoleEnum, SYSTEM_ROLE_PREFIX, SYSTEM_ROLE_REJECT_PATTERN } from '../../../common/enums/role.enum.js';
+import { CoreInput } from '../../../common/inputs/core-input.input.js';
 
 /**
  * User input to update a user