@lenne.tech/nest-server 11.43.2 → 12.0.0

package/FRAMEWORK-API.md

@@ -1,302 +1,302 @@
 # @lenne.tech/nest-server — Framework API Reference
 
-> Auto-generated from source code as of 2026-10-20 (v11.43.2)
+> Auto-generated from source code as of 2026-10-22 (v12.0.0)
 > File: `FRAMEWORK-API.md` — compact, machine-readable API surface for Claude Code
 
 ## CoreModule.forRoot()
 
-- `CoreModule.forRoot(options: Partial<IServerOptions>, overrides?: ICoreModuleOverrides | undefined)`: `DynamicModule`
-- ~~`CoreModule.forRoot(AuthService: any, AuthModule: any, options: Partial<IServerOptions>, overrides?: ICoreModuleOverrides | undefined)`: `DynamicModule`~~ *(deprecated)*
+- `CoreModule.forRoot(options: Partial<IServerOptions>, overrides?: ICoreModuleOverrides)`: `DynamicModule`
+- ~~`CoreModule.forRoot(AuthService: any, AuthModule: any, options: Partial<IServerOptions>, overrides?: ICoreModuleOverrides)`: `DynamicModule`~~ *(deprecated)*
 
 ## Configuration Interfaces
 
 ### IServerOptions
 
-  - `ai?`: `boolean | IAi | undefined` — Configuration for the AI assistant module.
-  - `appUrl?`: `string | undefined` — Base URL of the frontend/app application.
-  - `apiTokens?`: `boolean | IApiTokens | undefined` (default: `undefined (disabled)`) — API tokens: bearer credentials for machine clients and embedded pages that cannot carry a session
-  - `auth?`: `IAuth | undefined` — Authentication system configuration
-  - `automaticObjectIdFiltering?`: `boolean | undefined` — Automatically detect ObjectIds in string values in FilterQueries
-  - `baseUrl?`: `string | undefined` — Base URL of the API server.
-  - `betterAuth?`: `boolean | IBetterAuth | undefined` (default: `undefined (enabled with defaults)`) — Configuration for better-auth authentication framework.
-  - `bodyParser?`: `IBodyParserConfig | undefined` — Size limits for request bodies.
+  - `ai?`: `boolean | IAi` — Configuration for the AI assistant module.
+  - `appUrl?`: `string` — Base URL of the frontend/app application.
+  - `apiTokens?`: `boolean | IApiTokens` (default: `undefined (disabled)`) — API tokens: bearer credentials for machine clients and embedded pages that cannot carry a session
+  - `auth?`: `IAuth` — Authentication system configuration
+  - `automaticObjectIdFiltering?`: `boolean` — Automatically detect ObjectIds in string values in FilterQueries
+  - `baseUrl?`: `string` — Base URL of the API server.
+  - `betterAuth?`: `boolean | IBetterAuth` (default: `undefined (enabled with defaults)`) — Configuration for better-auth authentication framework.
+  - `bodyParser?`: `IBodyParserConfig` — Size limits for request bodies.
   - `brevo?`: `{ apiKey: string; exclude?: RegExp; maxRetries?: number; sender: { email: str...` — Configuration for Brevo
-  - `compression?`: `boolean | compression.CompressionOptions | undefined` — Whether to use the compression middleware package to enable gzip compression.
-  - `cookies?`: `boolean | ICookiesConfig | undefined` (default: `true`) — Cookie configuration for authentication handling.
-  - `cors?`: `boolean | ICorsConfig | undefined` (default: `undefined (enabled with auto-derived origins)`) — CORS (Cross-Origin Resource Sharing) configuration.
+  - `compression?`: `boolean | compression.CompressionOptions` — Whether to use the compression middleware package to enable gzip compression.
+  - `cookies?`: `boolean | ICookiesConfig` (default: `true`) — Cookie configuration for authentication handling.
+  - `cors?`: `boolean | ICorsConfig` (default: `undefined (enabled with auto-derived origins)`) — CORS (Cross-Origin Resource Sharing) configuration.
   - `cronJobs?`: `Record<string, string | false | 0 | CronJobConfigWithTimeZone<null, null> | C...` — Cron jobs configuration object with the name of the cron job function as key
-  - `debugProcessInput?`: `boolean | undefined` (default: `false`) — When true, logs a debug message when prepareInput() changes the input type during process().
+  - `debugProcessInput?`: `boolean` (default: `false`) — When true, logs a debug message when prepareInput() changes the input type during process().
   - `email?`: `{ defaultSender?: { email?: string; name?: string; }; mailjet?: MailjetOption...` — SMTP and template configuration for sending emails
-  - `env?`: `string | undefined` — Environment
-  - `version?`: `string | undefined` — Semantic version of the running build (e.g. from package.json / meta.json).
-  - `errorCode?`: `IErrorCode | undefined` — Configuration for the error code module
-  - `execAfterInit?`: `string | undefined` — Exec a command after server is initialized
-  - `file?`: `IFileConfig | undefined` — Configuration of the file module: where the bytes live (`storage`) and who
-  - `filter?`: `{ maxLimit?: number; } | undefined` — Filter configuration and defaults
+  - `env?`: `string` — Environment
+  - `version?`: `string` — Semantic version of the running build (e.g. from package.json / meta.json).
+  - `errorCode?`: `IErrorCode` — Configuration for the error code module
+  - `execAfterInit?`: `string` — Exec a command after server is initialized
+  - `file?`: `IFileConfig` — Configuration of the file module: where the bytes live (`storage`) and who
+  - `filter?`: `{ maxLimit?: number; }` — Filter configuration and defaults
   - `graphQl?`: `false | { driver?: ApolloDriverConfig; enableSubscriptionAuth?: boolean; maxC...` — Configuration of the GraphQL module
   - `healthCheck?`: `{ configs?: { build?: { enabled?: boolean; }; database?: { enabled?: boolean;...` — Whether to activate health check endpoints
-  - `hostname?`: `string | undefined` — Hostname of the server
-  - `hub?`: `boolean | IHubConfig | undefined` (default: `undefined (disabled)`) — Hub admin area (operator cockpit).
-  - `ignoreSelectionsForPopulate?`: `boolean | undefined` — Ignore selections in fieldSelection
-  - `jwt?`: `(IJwt & JwtModuleOptions & { refresh?: IJwt & { renewal?: boolean; }; sameTok...` — Configuration of JavaScript Web Token (JWT) module
-  - `loadLocalConfig?`: `string | boolean | undefined` — Load local configuration
-  - `logExceptions?`: `boolean | undefined` — Log exceptions (for better debugging)
+  - `hostname?`: `string` — Hostname of the server
+  - `hub?`: `boolean | IHubConfig` (default: `undefined (disabled)`) — Hub admin area (operator cockpit).
+  - `ignoreSelectionsForPopulate?`: `boolean` — Ignore selections in fieldSelection
+  - `jwt?`: `IJwt & JwtModuleOptions & { refresh?: IJwt & { renewal?: boolean; }; sameToke...` — Configuration of JavaScript Web Token (JWT) module
+  - `loadLocalConfig?`: `string | boolean` (default: `false`) — Load a local configuration file and merge it over this environment's configuration
+  - `logExceptions?`: `boolean` — Log exceptions (for better debugging)
   - `mongoose?`: `{ collation?: CollationOptions; modelDocumentation?: boolean; options?: Mongo...` — Configuration for Mongoose
-  - `multiTenancy?`: `IMultiTenancy | undefined` (default: `undefined (disabled)`) — Multi-tenancy configuration for tenant-based data isolation.
-  - `permissions?`: `boolean | IPermissions | undefined` (default: `undefined (disabled)`) — Permissions report module (development tool).
-  - `port?`: `number | undefined` — Port number of the server
-  - `redis?`: `boolean | IRedisConfig | undefined` (default: `undefined (disabled)`) — Optional central Redis connection used by all distributed features
-  - `s3?`: `IS3Config | undefined` (default: `undefined (disabled)`) — Optional central S3-compatible object storage (AWS S3, MinIO, ...).
+  - `multiTenancy?`: `IMultiTenancy` (default: `undefined (disabled)`) — Multi-tenancy configuration for tenant-based data isolation.
+  - `permissions?`: `boolean | IPermissions` (default: `undefined (disabled)`) — Permissions report module (development tool).
+  - `port?`: `number` — Port number of the server
+  - `redis?`: `boolean | IRedisConfig` (default: `undefined (disabled)`) — Optional central Redis connection used by all distributed features
+  - `s3?`: `IS3Config` (default: `undefined (disabled)`) — Optional central S3-compatible object storage (AWS S3, MinIO, ...).
   - `security?`: `{ allowPrivateOutboundTargets?: boolean; checkResponseInterceptor?: boolean |...` — Configuration for security pipes and interceptors
-  - `sha256?`: `boolean | undefined` — Whether to enable verification and automatic encryption for received passwords that are not in sha256 format
-  - `shutdownDelayMs?`: `number | undefined` (default: `0 (no delay)`) — Delay in milliseconds between receiving a shutdown signal and starting the
-  - `staticAssets?`: `{ options?: ServeStaticOptions; path?: string; } | undefined` — Configuration for useStaticAssets
-  - `systemSetup?`: `ISystemSetup | undefined` — System setup configuration for initial admin creation.
-  - `templates?`: `{ engine?: string; path?: string; } | undefined` — Templates
-  - `trustProxy?`: `string | number | boolean | string[] | undefined` (default: `false (Express default — the forwarded chain is not trusted)`) — Express `trust proxy` setting — how far up the `X-Forwarded-For` chain this app believes.
-  - `tus?`: `boolean | ITusConfig | undefined` — TUS resumable upload configuration.
+  - `sha256?`: `boolean` — Whether to enable verification and automatic encryption for received passwords that are not in sha256 format
+  - `shutdownDelayMs?`: `number` (default: `0 (no delay)`) — Delay in milliseconds between receiving a shutdown signal and starting the
+  - `staticAssets?`: `{ options?: ServeStaticOptions; path?: string; }` — Configuration for useStaticAssets
+  - `systemSetup?`: `ISystemSetup` — System setup configuration for initial admin creation.
+  - `templates?`: `{ engine?: string; path?: string; }` — Templates
+  - `trustProxy?`: `string | number | boolean | string[]` (default: `false (Express default — the forwarded chain is not trusted)`) — Express `trust proxy` setting — how far up the `X-Forwarded-For` chain this app believes.
+  - `tus?`: `boolean | ITusConfig` — TUS resumable upload configuration.
 
 ### IBetterAuth (type alias: IBetterAuthWithoutPasskey | IBetterAuthWithPasskey)
 
 When `passkey` is enabled, `trustedOrigins` is required (compile-time enforcement).
 
   - `passkey?`: `IBetterAuthPasskeyDisabled` — Passkey/WebAuthn configuration (DISABLED or not configured).
-  - `trustedOrigins?`: `string[] | undefined` — Trusted origins for CORS configuration.
+  - `trustedOrigins?`: `string[]` — Trusted origins for CORS configuration.
 
 ### IAuth
 
-  - `legacyEndpoints?`: `IAuthLegacyEndpoints | undefined` — Configuration for legacy auth endpoints
-  - `preventUserEnumeration?`: `boolean | undefined` (default: `false (backward compatible - specific error messages)`) — Prevent user enumeration via unified error messages
-  - `passwordReset?`: `IAuthPasswordReset | undefined` — Password-reset request behaviour.
-  - `rateLimit?`: `IAuthRateLimit | undefined` (default: `{ enabled: false }`) — Rate limiting configuration for Legacy Auth endpoints
+  - `legacyEndpoints?`: `IAuthLegacyEndpoints` — Configuration for legacy auth endpoints
+  - `preventUserEnumeration?`: `boolean` (default: `false (backward compatible - specific error messages)`) — Prevent user enumeration via unified error messages
+  - `passwordReset?`: `IAuthPasswordReset` — Password-reset request behaviour.
+  - `rateLimit?`: `IAuthRateLimit` (default: `{ enabled: false }`) — Rate limiting configuration for Legacy Auth endpoints
 
 ### IMultiTenancy
 
-  - `enabled?`: `boolean | undefined` (default: `true (when config object is present)`) — Explicitly disable multi-tenancy even when config is present.
-  - `excludeSchemas?`: `string[] | undefined` (default: `[]`) — Model names (NOT collection names) to exclude from tenant filtering.
-  - `headerName?`: `string | undefined` (default: `'x-tenant-id'`) — Header name for tenant selection.
-  - `membershipModel?`: `string | undefined` (default: `'TenantMember'`) — Mongoose model name for the membership collection.
-  - `adminBypass?`: `boolean | undefined` (default: `true`) — Whether system admins (RoleEnum.ADMIN) bypass the membership check.
-  - `roleHierarchy?`: `Record<string, number> | undefined` (default: `{ member: 1, manager: 2, owner: 3 }`) — Custom role hierarchy for tenant membership roles.
-  - `globalOnlyRoles?`: `string[] | undefined` (default: `[] (only RoleEnum.ADMIN is global)`) — Project-defined roles that carry GLOBAL (platform-wide) authority.
-  - `strictMembershipRoles?`: `boolean | undefined` (default: `false`) — Refuse membership roles that are not declared anywhere (deny by default).
-  - `additionalMembershipRoles?`: `string[] | undefined` (default: `[]`) — Membership roles that are valid but carry no hierarchy level (exact-match roles).
-  - `cacheTtlMs?`: `number | undefined` (default: `30000 (30 seconds)`) — TTL in milliseconds for the tenant guard's in-memory membership cache.
-  - `isTenantActive?`: `((tenantId: string, context: { connection: Connection; }) => boolean | Promis...` (default: `undefined (every tenant is active)`) — Whether a tenant may be used at all — the hook that makes a DEACTIVATED tenant stop working.
+  - `enabled?`: `boolean` (default: `true (when config object is present)`) — Explicitly disable multi-tenancy even when config is present.
+  - `excludeSchemas?`: `string[]` (default: `[]`) — Model names (NOT collection names) to exclude from tenant filtering.
+  - `headerName?`: `string` (default: `'x-tenant-id'`) — Header name for tenant selection.
+  - `membershipModel?`: `string` (default: `'TenantMember'`) — Mongoose model name for the membership collection.
+  - `adminBypass?`: `boolean` (default: `true`) — Whether system admins (RoleEnum.ADMIN) bypass the membership check.
+  - `roleHierarchy?`: `Record<string, number>` (default: `{ member: 1, manager: 2, owner: 3 }`) — Custom role hierarchy for tenant membership roles.
+  - `globalOnlyRoles?`: `string[]` (default: `[] (only RoleEnum.ADMIN is global)`) — Project-defined roles that carry GLOBAL (platform-wide) authority.
+  - `strictMembershipRoles?`: `boolean` (default: `false`) — Refuse membership roles that are not declared anywhere (deny by default).
+  - `additionalMembershipRoles?`: `string[]` (default: `[]`) — Membership roles that are valid but carry no hierarchy level (exact-match roles).
+  - `cacheTtlMs?`: `number` (default: `30000 (30 seconds)`) — TTL in milliseconds for the tenant guard's in-memory membership cache.
+  - `isTenantActive?`: `(tenantId: string, context: { connection: Connection; }) => boolean | Promise...` (default: `undefined (every tenant is active)`) — Whether a tenant may be used at all — the hook that makes a DEACTIVATED tenant stop working.
 
 ### IErrorCode
 
   - `additionalErrorRegistry?`: `Record<string, { code: string; message: string; translations: { [locale: stri...` — Additional error registry to merge with core LTNS_* errors
-  - `autoRegister?`: `boolean | undefined` (default: `true`) — Automatically register the ErrorCodeModule in CoreModule
+  - `autoRegister?`: `boolean` (default: `true`) — Automatically register the ErrorCodeModule in CoreModule
 
 ### IJwt
 
-  - `privateKey?`: `string | undefined` — Private key
-  - `publicKey?`: `string | undefined` — Public key
-  - `secret?`: `string | undefined` — Secret to encrypt the JWT
-  - `secretOrKeyProvider?`: `((request: Record<string, any>, rawJwtToken: string, done: (err: any, secret:...` — JWT Provider
-  - `secretOrPrivateKey?`: `string | undefined` — Alias of secret (for backwards compatibility)
-  - `signInOptions?`: `JwtSignOptions | undefined` — SignIn Options like expiresIn
+  - `privateKey?`: `string` — Private key
+  - `publicKey?`: `string` — Public key
+  - `secret?`: `string` — Secret to encrypt the JWT
+  - `secretOrKeyProvider?`: `(request: Record<string, any>, rawJwtToken: string, done: (err: any, secret: ...` — JWT Provider
+  - `secretOrPrivateKey?`: `string` — Alias of secret (for backwards compatibility)
+  - `signInOptions?`: `JwtSignOptions` — SignIn Options like expiresIn
 
 ### ICookiesConfig
 
-  - `enabled?`: `boolean | undefined` (default: `true`) — Whether cookies are enabled.
-  - `exposeTokenInBody?`: `boolean | undefined` (default: `false`) — Whether to include the session token in the response body when cookies are enabled.
+  - `enabled?`: `boolean` (default: `true`) — Whether cookies are enabled.
+  - `exposeTokenInBody?`: `boolean` (default: `false`) — Whether to include the session token in the response body when cookies are enabled.
 
 ### ICorsConfig
 
-  - `allowAll?`: `boolean | undefined` (default: `false`) — Allow all origins by mirroring the request Origin header back.
-  - `allowedOrigins?`: `string[] | undefined` — Additional allowed origins beyond `appUrl` and `baseUrl`.
-  - `deriveAppUrl?`: `boolean | undefined` (default: `true`) — Whether `appUrl` may be auto-derived from `baseUrl` when it is not set explicitly.
-  - `enabled?`: `boolean | undefined` (default: `true`) — Whether CORS is enabled.
+  - `allowAll?`: `boolean` (default: `false`) — Allow all origins by mirroring the request Origin header back.
+  - `allowedOrigins?`: `string[]` — Additional allowed origins beyond `appUrl` and `baseUrl`.
+  - `deriveAppUrl?`: `boolean` (default: `true`) — Whether `appUrl` may be auto-derived from `baseUrl` when it is not set explicitly.
+  - `enabled?`: `boolean` (default: `true`) — Whether CORS is enabled.
 
 ### IAi
 
-  - `allowedBaseUrlHosts?`: `string | string[] | undefined` — Optional SSRF allowlist for connection base URLs. When set (non-empty), the
-  - `audit?`: `boolean | undefined` (default: `false`) — Persist an audit record (`aiInteractions`) for every prompt run (admin-readable).
+  - `allowedBaseUrlHosts?`: `string | string[]` — Optional SSRF allowlist for connection base URLs. When set (non-empty), the
+  - `audit?`: `boolean` (default: `false`) — Persist an audit record (`aiInteractions`) for every prompt run (admin-readable).
   - `budget?`: `{ period?: "day" | "month" | "none"; tenant?: { maxPrompts?: number; maxToken...` — Token/prompt budgets for AI prompts, enforced before a run (HTTP 429 + translated
-  - `capabilityDriftCheck?`: `boolean | undefined` (default: `false`) — Opt-in boot self-check: after startup, probe each enabled connection that declares
-  - `confirmation?`: `{ mutating?: { default?: boolean; enforced?: boolean; }; } | undefined` — Confirmation policy for mutating tool actions (create/update/delete).
-  - `documentation?`: `string | undefined` — System documentation injected into the system prompt to inform the LLM
-  - `defaultConnection?`: `IAiDefaultConnection | undefined` — Optional one-time seed for a default connection (see {@link IAiDefaultConnection}).
-  - `defaultMode?`: `"auto" | "plan" | undefined` (default: `'auto'`) — Default execution mode when the client does not specify one.
-  - `enabled?`: `boolean | undefined` — Explicitly disable while keeping the config (default: enabled when present).
-  - `encryptionSecret?`: `string | undefined` — Pass-phrase used to derive the AES-256-GCM key for encrypting connection API
-  - `contextWindow?`: `number | undefined` (default: `8192`) — Fallback total context window (input + output tokens) used to budget the
-  - `claudeCli?`: `{ bin?: string; extraArgs?: string[]; maxBudgetUsd?: number; } | undefined` — Optional config for the `ClaudeCliProvider` (LLM backend that invokes a local
-  - `compaction?`: `boolean | undefined` (default: `true`) — LLM-driven context compaction: when a session would overflow the connection's
-  - `deferToolSchemas?`: `boolean | undefined` (default: `false`) — Defer the parameter schemas of tools out of the system prompt. With many tools
-  - `deferToolSummaryChars?`: `number | undefined` (default: `0`) — Maximum characters per tool description in the DEFERRED catalog
-  - `maxIterations?`: `number | undefined` (default: `5`) — Maximum number of agent-loop iterations (tool round-trips).
-  - `maxRunMs?`: `number | undefined` (default: `0`) — Wall-clock ceiling for ONE prompt run, in milliseconds. Checked before each
-  - `maxToolResultChars?`: `number | undefined` (default: `12000`) — Maximum characters of a tool-results payload fed back to the model.
-  - `promptLearning?`: `{ autoApply?: boolean; enabled?: boolean; minOccurrences?: number; } | undefined` — Governed self-improvement loop for the system prompt. The orchestrator records
+  - `capabilityDriftCheck?`: `boolean` (default: `false`) — Opt-in boot self-check: after startup, probe each enabled connection that declares
+  - `confirmation?`: `{ mutating?: { default?: boolean; enforced?: boolean; }; }` — Confirmation policy for mutating tool actions (create/update/delete).
+  - `documentation?`: `string` — System documentation injected into the system prompt to inform the LLM
+  - `defaultConnection?`: `IAiDefaultConnection` — Optional one-time seed for a default connection (see {@link IAiDefaultConnection}).
+  - `defaultMode?`: `"auto" | "plan"` (default: `'auto'`) — Default execution mode when the client does not specify one.
+  - `enabled?`: `boolean` — Explicitly disable while keeping the config (default: enabled when present).
+  - `encryptionSecret?`: `string` — Pass-phrase used to derive the AES-256-GCM key for encrypting connection API
+  - `contextWindow?`: `number` (default: `8192`) — Fallback total context window (input + output tokens) used to budget the
+  - `claudeCli?`: `{ bin?: string; extraArgs?: string[]; maxBudgetUsd?: number; }` — Optional config for the `ClaudeCliProvider` (LLM backend that invokes a local
+  - `compaction?`: `boolean` (default: `true`) — LLM-driven context compaction: when a session would overflow the connection's
+  - `deferToolSchemas?`: `boolean` (default: `false`) — Defer the parameter schemas of tools out of the system prompt. With many tools
+  - `deferToolSummaryChars?`: `number` (default: `0`) — Maximum characters per tool description in the DEFERRED catalog
+  - `maxIterations?`: `number` (default: `5`) — Maximum number of agent-loop iterations (tool round-trips).
+  - `maxRunMs?`: `number` (default: `0`) — Wall-clock ceiling for ONE prompt run, in milliseconds. Checked before each
+  - `maxToolResultChars?`: `number` (default: `12000`) — Maximum characters of a tool-results payload fed back to the model.
+  - `promptLearning?`: `{ autoApply?: boolean; enabled?: boolean; minOccurrences?: number; }` — Governed self-improvement loop for the system prompt. The orchestrator records
   - `mcp?`: `boolean | { enabled?: boolean; oauth?: boolean; oauthBaseUrl?: string; oauthL...` (default: `false`) — Expose the tool registry as an MCP server at `/ai/mcp` (Streamable HTTP) for
-  - `rateLimit?`: `IAiRateLimit | undefined` — Rate limiting for prompts.
-  - `systemPrompt?`: `string | undefined` — Base system prompt prepended to every conversation.
+  - `rateLimit?`: `IAiRateLimit` — Rate limiting for prompts.
+  - `systemPrompt?`: `string` — Base system prompt prepended to every conversation.
 
 ### IAiRateLimit
 
-  - `enabled?`: `boolean | undefined` — Explicitly disable while keeping the config (default: enabled when present).
-  - `max?`: `number | undefined` (default: `20`) — Maximum number of prompts per window per user.
-  - `windowSeconds?`: `number | undefined` (default: `60`) — Window length in seconds.
+  - `enabled?`: `boolean` — Explicitly disable while keeping the config (default: enabled when present).
+  - `max?`: `number` (default: `20`) — Maximum number of prompts per window per user.
+  - `windowSeconds?`: `number` (default: `60`) — Window length in seconds.
 
 ### IAiDefaultConnection
 
-  - `apiKey?`: `string | undefined` — Inline plaintext API key (encrypted on seed). Prefer `apiKeyEnv` instead.
-  - `apiKeyEnv?`: `string | undefined` — Name of an environment variable holding the API key (e.g. 'AI_API_KEY').
+  - `apiKey?`: `string` — Inline plaintext API key (encrypted on seed). Prefer `apiKeyEnv` instead.
+  - `apiKeyEnv?`: `string` — Name of an environment variable holding the API key (e.g. 'AI_API_KEY').
   - `baseUrl`: `string` — Base URL of the OpenAI-compatible endpoint.
-  - `capabilities?`: `string[] | undefined` — Capability tags (free-form, e.g. 'analysis', 'vision').
-  - `contextWindow?`: `number | undefined` — Total context window (input + output tokens) the model supports. Drives the
-  - `defaultMaxTokens?`: `number | undefined` — Default maximum number of tokens for completions.
-  - `defaultTemperature?`: `number | undefined` — Default sampling temperature.
-  - `description?`: `string | undefined` — Human-readable description.
+  - `capabilities?`: `string[]` — Capability tags (free-form, e.g. 'analysis', 'vision').
+  - `contextWindow?`: `number` — Total context window (input + output tokens) the model supports. Drives the
+  - `defaultMaxTokens?`: `number` — Default maximum number of tokens for completions.
+  - `defaultTemperature?`: `number` — Default sampling temperature.
+  - `description?`: `string` — Human-readable description.
   - `model`: `string` — Model id sent to the backend (e.g. 'gpt-oss-120b').
   - `name`: `string` — Human-readable connection name.
-  - `providerType?`: `string | undefined` — Provider type (default 'openai-compatible').
-  - `supportsJsonResponse?`: `boolean | undefined` — Native JSON / structured-output support. Omit to auto-detect by probing the
-  - `supportsNativeTools?`: `boolean | undefined` — Native function/tool-calling support. Omit to auto-detect by probing the
-  - `supportsVision?`: `boolean | undefined` — Whether the model supports image input.
+  - `providerType?`: `string` — Provider type (default 'openai-compatible').
+  - `supportsJsonResponse?`: `boolean` — Native JSON / structured-output support. Omit to auto-detect by probing the
+  - `supportsNativeTools?`: `boolean` — Native function/tool-calling support. Omit to auto-detect by probing the
+  - `supportsVision?`: `boolean` — Whether the model supports image input.
 
 ### IFileConfig
 
-  - `access?`: `"authenticated" | "custom" | "owner" | "public" | "tenant" | undefined` (default: `'custom'`) — WHICH PROJECT CLASS this deployment is — the per-file rule, as a declaration instead of code.
-  - `deleteRoles?`: `string[] | undefined` (default: `['admin']`) — Roles allowed to DELETE files (`deleteFile` mutation).
-  - `downloadRoles?`: `string[] | undefined` (default: `['admin']`) — Roles allowed to DOWNLOAD files and read file info
-  - `storage?`: `"filesystem" | "gridfs" | "s3" | undefined` (default: `derived — see above`) — Storage driver for CoreFileService. Three equivalent options:
-  - `storageDir?`: `string | undefined` (default: `'uploads/files'`) — Directory for the `'filesystem'` storage driver.
-  - `uploadRoles?`: `string[] | undefined` (default: `['admin']`) — Roles allowed to UPLOAD files (`uploadFile` / `uploadFiles` mutations).
+  - `access?`: `"authenticated" | "custom" | "owner" | "public" | "tenant"` (default: `'custom'`) — WHICH PROJECT CLASS this deployment is — the per-file rule, as a declaration instead of code.
+  - `deleteRoles?`: `string[]` (default: `['admin']`) — Roles allowed to DELETE files (`deleteFile` mutation).
+  - `downloadRoles?`: `string[]` (default: `['admin']`) — Roles allowed to DOWNLOAD files and read file info
+  - `storage?`: `"filesystem" | "gridfs" | "s3"` (default: `derived — see above`) — Storage driver for CoreFileService. Three equivalent options:
+  - `storageDir?`: `string` (default: `'uploads/files'`) — Directory for the `'filesystem'` storage driver.
+  - `uploadRoles?`: `string[]` (default: `['admin']`) — Roles allowed to UPLOAD files (`uploadFile` / `uploadFiles` mutations).
 
 ### IRedisConfig
 
-  - `db?`: `number | undefined` (default: `0`) — Redis database index
-  - `enabled?`: `boolean | undefined` (default: `true (when config object is present)`) — Whether Redis is enabled.
-  - `host?`: `string | undefined` (default: `'localhost'`) — Redis host
-  - `keyPrefix?`: `string | undefined` (default: `the slugified `name` from package.json, or 'nest-server' if unreadable`) — Prefix prepended to every framework-managed Redis key
-  - `options?`: `Record<string, unknown> | undefined` (default: `undefined`) — Additional ioredis options passed through to the client constructor
-  - `password?`: `string | undefined` (default: `undefined (no auth)`) — Redis password
-  - `port?`: `number | undefined` (default: `6379`) — Redis port
-  - `url?`: `string | undefined` (default: `undefined`) — Full Redis connection URL (e.g. 'redis://user:pass@host:6379/0').
-  - `username?`: `string | undefined` (default: `undefined`) — Redis username (Redis 6+ ACL)
+  - `db?`: `number` (default: `0`) — Redis database index
+  - `enabled?`: `boolean` (default: `true (when config object is present)`) — Whether Redis is enabled.
+  - `host?`: `string` (default: `'localhost'`) — Redis host
+  - `keyPrefix?`: `string` (default: `the slugified `name` from package.json, or 'nest-server' if unreadable`) — Prefix prepended to every framework-managed Redis key
+  - `options?`: `Record<string, unknown>` (default: `undefined`) — Additional ioredis options passed through to the client constructor
+  - `password?`: `string` (default: `undefined (no auth)`) — Redis password
+  - `port?`: `number` (default: `6379`) — Redis port
+  - `url?`: `string` (default: `undefined`) — Full Redis connection URL (e.g. 'redis://user:pass@host:6379/0').
+  - `username?`: `string` (default: `undefined`) — Redis username (Redis 6+ ACL)
 
 ### IS3Config
 
-  - `accessKeyId?`: `string | undefined` (default: `undefined`) — Access key ID.
-  - `autoCreateBucket?`: `boolean | undefined` (default: `false`) — Create the configured buckets at startup when they do not exist.
+  - `accessKeyId?`: `string` (default: `undefined`) — Access key ID.
+  - `autoCreateBucket?`: `boolean` (default: `false`) — Create the configured buckets at startup when they do not exist.
   - `bucket`: `string` — Bucket for files stored via CoreFileService
-  - `enabled?`: `boolean | undefined` (default: `true (when config object is present)`) — Whether S3 is enabled.
-  - `endpoint?`: `string | undefined` (default: `undefined`) — Custom endpoint URL for S3-compatible services (MinIO, RustFS, ...).
-  - `forcePathStyle?`: `boolean | undefined` (default: `false`) — Use path-style addressing (required by most self-hosted S3 services).
-  - `presignedDownloads?`: `boolean | { enabled?: boolean; expiresInSeconds?: number; } | undefined` (default: `false`) — Serve downloads as presigned URL redirects instead of streaming
-  - `region?`: `string | undefined` (default: `'us-east-1'`) — AWS region
-  - `secretAccessKey?`: `string | undefined` (default: `undefined`) — Secret access key.
-  - `stagingBucket?`: `string | undefined` (default: `same as `bucket``) — Bucket used as staging area for resumable TUS uploads.
+  - `enabled?`: `boolean` (default: `true (when config object is present)`) — Whether S3 is enabled.
+  - `endpoint?`: `string` (default: `undefined`) — Custom endpoint URL for S3-compatible services (MinIO, RustFS, ...).
+  - `forcePathStyle?`: `boolean` (default: `false`) — Use path-style addressing (required by most self-hosted S3 services).
+  - `presignedDownloads?`: `boolean | { enabled?: boolean; expiresInSeconds?: number; }` (default: `false`) — Serve downloads as presigned URL redirects instead of streaming
+  - `region?`: `string` (default: `'us-east-1'`) — AWS region
+  - `secretAccessKey?`: `string` (default: `undefined`) — Secret access key.
+  - `stagingBucket?`: `string` (default: `same as `bucket``) — Bucket used as staging area for resumable TUS uploads.
 
 ### ITusConfig
 
-  - `allowedHeaders?`: `string[] | undefined` (default: `[] (no additional headers needed)`) — Additional allowed HTTP headers for TUS requests (beyond
-  - `allowedOrigins?`: `string[] | undefined` (default: `undefined (derived from the API CORS configuration)`) — Origins the tus handler may answer a cross-origin request with (`Access-Control-Allow-Origin`).
-  - `allowedTypes?`: `string[] | undefined` (default: `undefined (all types allowed)`) — Allowed MIME types for uploads.
-  - `checksum?`: `boolean | undefined` (default: `true`) — Checksum extension configuration.
-  - `concatenation?`: `boolean | undefined` (default: `true`) — Concatenation extension configuration.
-  - `creation?`: `boolean | ITusCreationConfig | undefined` (default: `true`) — Creation extension configuration.
-  - `creationWithUpload?`: `boolean | undefined` (default: `true`) — Creation With Upload extension configuration.
-  - `enabled?`: `boolean | undefined` (default: `true (enabled by default)`) — Whether tus uploads are enabled.
-  - `expiration?`: `boolean | ITusExpirationConfig | undefined` (default: `{ expiresIn: '24h' }`) — Expiration extension configuration.
-  - `maxSize?`: `number | undefined` (default: `50 * 1024 * 1024 * 1024 (50 GB)`) — Maximum upload size in bytes
-  - `path?`: `string | undefined` (default: `'/tus'`) — Base path for tus endpoints (11.42.9+):
-  - `relativeLocation?`: `boolean | undefined` (default: `false`) — Hand out upload URLs (`Location`) without scheme and host — `/tus/<id>` instead of
-  - `roles?`: `string[] | undefined` (default: `['s_user']`) — Roles allowed to use the tus endpoints (create, write, read offset, terminate).
-  - `s3Staging?`: `boolean | undefined` (default: `true (when S3 is usable)`) — Stage upload chunks in the configured S3 bucket (`IServerOptions.s3`,
-  - `termination?`: `boolean | undefined` (default: `true`) — Termination extension configuration.
-  - `uploadDir?`: `string | undefined` (default: `'uploads/tus'`) — Directory for temporary upload chunks.
+  - `allowedHeaders?`: `string[]` (default: `[] (no additional headers needed)`) — Additional allowed HTTP headers for TUS requests (beyond
+  - `allowedOrigins?`: `string[]` (default: `undefined (derived from the API CORS configuration)`) — Origins the tus handler may answer a cross-origin request with (`Access-Control-Allow-Origin`).
+  - `allowedTypes?`: `string[]` (default: `undefined (all types allowed)`) — Allowed MIME types for uploads.
+  - `checksum?`: `boolean` (default: `true`) — Checksum extension configuration.
+  - `concatenation?`: `boolean` (default: `true`) — Concatenation extension configuration.
+  - `creation?`: `boolean | ITusCreationConfig` (default: `true`) — Creation extension configuration.
+  - `creationWithUpload?`: `boolean` (default: `true`) — Creation With Upload extension configuration.
+  - `enabled?`: `boolean` (default: `true (enabled by default)`) — Whether tus uploads are enabled.
+  - `expiration?`: `boolean | ITusExpirationConfig` (default: `{ expiresIn: '24h' }`) — Expiration extension configuration.
+  - `maxSize?`: `number` (default: `50 * 1024 * 1024 * 1024 (50 GB)`) — Maximum upload size in bytes
+  - `path?`: `string` (default: `'/tus'`) — Base path for tus endpoints (11.42.9+):
+  - `relativeLocation?`: `boolean` (default: `false`) — Hand out upload URLs (`Location`) without scheme and host — `/tus/<id>` instead of
+  - `roles?`: `string[]` (default: `['s_user']`) — Roles allowed to use the tus endpoints (create, write, read offset, terminate).
+  - `s3Staging?`: `boolean` (default: `true (when S3 is usable)`) — Stage upload chunks in the configured S3 bucket (`IServerOptions.s3`,
+  - `termination?`: `boolean` (default: `true`) — Termination extension configuration.
+  - `uploadDir?`: `string` (default: `'uploads/tus'`) — Directory for temporary upload chunks.
 
 ### ICoreModuleOverrides
 
-  - `apiToken?`: `{ model?: Type<any>; service?: Type<any>; } | undefined` — Override API token collaborators with project-specific subclasses (`apiTokens` config).
+  - `apiToken?`: `{ model?: Type<any>; service?: Type<any>; }` — Override API token collaborators with project-specific subclasses (`apiTokens` config).
   - `ai?`: `{ budgetService?: Type<any>; connectionResolver?: Type<any>; connectionServic...` — Override AI module collaborators with project-specific subclasses.
-  - `betterAuth?`: `{ controller?: Type<any>; resolver?: Type<any>; } | undefined` — Override BetterAuth controller and/or resolver.
-  - `errorCode?`: `{ controller?: Type<any>; service?: Type<any>; } | undefined` — Override ErrorCode controller and/or service.
+  - `betterAuth?`: `{ controller?: Type<any>; resolver?: Type<any>; }` — Override BetterAuth controller and/or resolver.
+  - `errorCode?`: `{ controller?: Type<any>; service?: Type<any>; }` — Override ErrorCode controller and/or service.
   - `hub?`: `{ actionsController?: Type<any>; actionsService?: Type<any>; controller?: Typ...` — Override Hub controllers and/or services with project-specific subclasses.
 
 ### IBetterAuthPasskeyConfig
 
-  - `authenticatorAttachment?`: `"cross-platform" | "platform" | undefined` (default: `undefined (both allowed)`) — Authenticator attachment preference.
-  - `challengeStorage?`: `"cookie" | "database" | undefined` (default: `'database'`) — Where to store WebAuthn challenges.
-  - `challengeTtlSeconds?`: `number | undefined` (default: `300 (5 minutes)`) — TTL in seconds for database-stored challenges.
-  - `enabled?`: `boolean | undefined` (default: `true (when config block is present)`) — Whether passkey authentication is enabled.
-  - `origin?`: `string | undefined` — Origin URL for WebAuthn.
-  - `residentKey?`: `"discouraged" | "preferred" | "required" | undefined` (default: `'preferred'`) — Resident key (discoverable credential) requirement.
-  - `rpId?`: `string | undefined` — Relying Party ID (usually the domain without protocol).
-  - `rpName?`: `string | undefined` — Relying Party Name (displayed to users)
-  - `userVerification?`: `"discouraged" | "preferred" | "required" | undefined` (default: `'preferred'`) — User verification requirement.
-  - `webAuthnChallengeCookie?`: `string | undefined` (default: `'better-auth-passkey'`) — Custom cookie name for WebAuthn challenge storage.
+  - `authenticatorAttachment?`: `"cross-platform" | "platform"` (default: `undefined (both allowed)`) — Authenticator attachment preference.
+  - `challengeStorage?`: `"cookie" | "database"` (default: `'database'`) — Where to store WebAuthn challenges.
+  - `challengeTtlSeconds?`: `number` (default: `300 (5 minutes)`) — TTL in seconds for database-stored challenges.
+  - `enabled?`: `boolean` (default: `true (when config block is present)`) — Whether passkey authentication is enabled.
+  - `origin?`: `string` — Origin URL for WebAuthn.
+  - `residentKey?`: `"discouraged" | "preferred" | "required"` (default: `'preferred'`) — Resident key (discoverable credential) requirement.
+  - `rpId?`: `string` — Relying Party ID (usually the domain without protocol).
+  - `rpName?`: `string` — Relying Party Name (displayed to users)
+  - `userVerification?`: `"discouraged" | "preferred" | "required"` (default: `'preferred'`) — User verification requirement.
+  - `webAuthnChallengeCookie?`: `string` (default: `'better-auth-passkey'`) — Custom cookie name for WebAuthn challenge storage.
 
 ### IBetterAuthTwoFactorConfig
 
-  - `appName?`: `string | undefined` (default: `'Nest Server'`) — App name shown in authenticator apps.
-  - `enabled?`: `boolean | undefined` (default: `true (enabled by default when BetterAuth is active)`) — Whether 2FA is enabled.
+  - `appName?`: `string` (default: `'Nest Server'`) — App name shown in authenticator apps.
+  - `enabled?`: `boolean` (default: `true (enabled by default when BetterAuth is active)`) — Whether 2FA is enabled.
 
 ### IBetterAuthJwtConfig
 
-  - `enabled?`: `boolean | undefined` (default: `true (enabled by default when BetterAuth is active)`) — Whether JWT plugin is enabled.
-  - `expiresIn?`: `string | undefined` (default: `'15m'`) — JWT expiration time
+  - `enabled?`: `boolean` (default: `true (enabled by default when BetterAuth is active)`) — Whether JWT plugin is enabled.
+  - `expiresIn?`: `string` (default: `'15m'`) — JWT expiration time
 
 ### IBetterAuthEmailVerificationConfig
 
-  - `autoSignInAfterVerification?`: `boolean | undefined` (default: `true`) — Whether to automatically sign in the user after email verification.
-  - `brevoTemplateId?`: `number | undefined` (default: `undefined (uses SMTP/EJS templates)`) — Brevo template ID for verification emails.
-  - `callbackURL?`: `string | undefined` (default: `undefined (backend-handled verification)`) — Frontend callback URL for email verification.
-  - `enabled?`: `boolean | undefined` (default: `true (enabled by default when BetterAuth is active)`) — Whether email verification is enabled.
-  - `expiresIn?`: `number | undefined` (default: `86400 (24 hours)`) — Time in seconds until the verification link expires.
-  - `locale?`: `string | undefined` (default: `'en'`) — Locale for the verification email template.
-  - `passwordResetBrevoTemplateId?`: `number | undefined` (default: `undefined (uses SMTP/EJS templates)`) — Brevo transactional template ID for the PASSWORD-RESET mail.
-  - `passwordResetLink?`: `string | false | undefined` (default: ``<appUrl>/auth/reset-password?token={token}``) — Where the password-reset mail sends the recipient.
-  - `resendCooldownSeconds?`: `number | undefined` (default: `60`) — Cooldown in seconds between resend requests for the same email address.
-  - `template?`: `string | undefined` (default: `'email-verification'`) — Custom template name for the verification email.
+  - `autoSignInAfterVerification?`: `boolean` (default: `true`) — Whether to automatically sign in the user after email verification.
+  - `brevoTemplateId?`: `number` (default: `undefined (uses SMTP/EJS templates)`) — Brevo template ID for verification emails.
+  - `callbackURL?`: `string` (default: `undefined (backend-handled verification)`) — Frontend callback URL for email verification.
+  - `enabled?`: `boolean` (default: `true (enabled by default when BetterAuth is active)`) — Whether email verification is enabled.
+  - `expiresIn?`: `number` (default: `86400 (24 hours)`) — Time in seconds until the verification link expires.
+  - `locale?`: `string` (default: `'en'`) — Locale for the verification email template.
+  - `passwordResetBrevoTemplateId?`: `number` (default: `undefined (uses SMTP/EJS templates)`) — Brevo transactional template ID for the PASSWORD-RESET mail.
+  - `passwordResetLink?`: `string | false` (default: ``<appUrl>/auth/reset-password?token={token}``) — Where the password-reset mail sends the recipient.
+  - `resendCooldownSeconds?`: `number` (default: `60`) — Cooldown in seconds between resend requests for the same email address.
+  - `template?`: `string` (default: `'email-verification'`) — Custom template name for the verification email.
 
 ### IBetterAuthRateLimit
 
-  - `enabled?`: `boolean | undefined` (default: `true when a `rateLimit` object is present, false when it is absent`) — Whether rate limiting is enabled.
-  - `max?`: `number | undefined` (default: `10`) — Maximum number of requests within the time window
-  - `maxEntries?`: `number | undefined` (default: `10000`) — Maximum number of distinct counters this limiter may hold — the bound on the keyspace a
-  - `message?`: `string | undefined` — Custom message when rate limit is exceeded
-  - `skipEndpoints?`: `string[] | undefined` — Endpoints to skip rate limiting entirely
-  - `strictEndpoints?`: `string[] | undefined` — Endpoints to apply stricter rate limiting (e.g., sign-in, sign-up)
-  - `windowSeconds?`: `number | undefined` — Time window in seconds
+  - `enabled?`: `boolean` (default: `true when a `rateLimit` object is present, false when it is absent`) — Whether rate limiting is enabled.
+  - `max?`: `number` (default: `10`) — Maximum number of requests within the time window
+  - `maxEntries?`: `number` (default: `10000`) — Maximum number of distinct counters this limiter may hold — the bound on the keyspace a
+  - `message?`: `string` — Custom message when rate limit is exceeded
+  - `skipEndpoints?`: `string[]` — Endpoints to skip rate limiting entirely
+  - `strictEndpoints?`: `string[]` — Endpoints to apply stricter rate limiting (e.g., sign-in, sign-up)
+  - `windowSeconds?`: `number` — Time window in seconds
 
 ### IBetterAuthSignUpChecksConfig
 
-  - `enabled?`: `boolean | undefined` (default: `true (enabled by default when BetterAuth is active)`) — Whether sign-up checks are enabled.
-  - `requiredFields?`: `string[] | undefined` (default: `['termsAndPrivacyAccepted']`) — Fields that must be provided and truthy during sign-up.
+  - `enabled?`: `boolean` (default: `true (enabled by default when BetterAuth is active)`) — Whether sign-up checks are enabled.
+  - `requiredFields?`: `string[]` (default: `['termsAndPrivacyAccepted']`) — Fields that must be provided and truthy during sign-up.
 
 ### IBetterAuthUserField
 
   - `defaultValue?`: `unknown` — Default value for the field
-  - `fieldName?`: `string | undefined` — Database field name (if different from key)
-  - `input?`: `boolean | undefined` (default: `true (Better-Auth default when omitted)`) — Whether a client may supply this field's value via Better-Auth's native input parsing
-  - `required?`: `boolean | undefined` — Whether this field is required
+  - `fieldName?`: `string` — Database field name (if different from key)
+  - `input?`: `boolean` (default: `true (Better-Auth default when omitted)`) — Whether a client may supply this field's value via Better-Auth's native input parsing
+  - `required?`: `boolean` — Whether this field is required
   - `type`: `BetterAuthFieldType` — Field type
 
 ### ServiceOptions
 
-  - `checkRights?`: `boolean | undefined`
-  - `collation?`: `CollationOptions | undefined`
-  - `create?`: `boolean | undefined`
-  - `currentUser?`: `{ [key: string]: any; id: string; roles?: string[]; } | undefined`
-  - `fieldSelection?`: `FieldSelection | undefined`
-  - `force?`: `boolean | undefined`
-  - `inputType?`: `(new (...params: any[]) => any) | undefined`
-  - `outputType?`: `(new (...params: any[]) => any) | undefined`
-  - `populate?`: `string | PopulateOptions | (string | PopulateOptions)[] | undefined`
-  - `prepareInput?`: `PrepareInputOptions | undefined`
-  - `prepareOutput?`: `PrepareOutputOptions | undefined`
+  - `checkRights?`: `boolean`
+  - `collation?`: `CollationOptions`
+  - `create?`: `boolean`
+  - `currentUser?`: `{ [key: string]: any; id: string; roles?: string[]; }`
+  - `fieldSelection?`: `FieldSelection`
+  - `force?`: `boolean`
+  - `inputType?`: `new (...params: any[]) => any`
+  - `outputType?`: `new (...params: any[]) => any`
+  - `populate?`: `string | PopulateOptions | (string | PopulateOptions)[]`
+  - `prepareInput?`: `PrepareInputOptions`
+  - `prepareOutput?`: `PrepareOutputOptions`
   - `processFieldSelection?`: `{ dbModel?: Model<any>; ignoreSelections?: boolean; model?: new (...args: any...`
-  - `pubSub?`: `boolean | undefined`
-  - `raw?`: `boolean | undefined`
-  - `roles?`: `string | string[] | undefined`
-  - `select?`: `string | string[] | Record<string, number | boolean | object> | undefined`
-  - `setCreateOrUpdateUserId?`: `boolean | undefined`
+  - `pubSub?`: `boolean`
+  - `raw?`: `boolean`
+  - `roles?`: `string | string[]`
+  - `select?`: `string | string[] | Record<string, number | boolean | object>`
+  - `setCreateOrUpdateUserId?`: `boolean`
 
 ## CrudService Methods
 
@@ -304,44 +304,44 @@ Base class for all services. Located at `src/core/common/services/crud.service.t
 
 Generic: `CrudService<Model, CreateInput, UpdateInput>`
 
-- `async aggregate(pipeline: PipelineStage[], serviceOptions?: (ServiceOptions & { aggregateOptions?: AggregateOptions; }) | undefined)`: `Promise<T>` — Aggregate
+- `async aggregate(pipeline: PipelineStage[], serviceOptions?: ServiceOptions & { aggregateOptions?: AggregateOptions; })`: `Promise<T>` — Aggregate
 - `async aggregateForce(pipeline: PipelineStage[], serviceOptions?: ServiceOptions)`: `Promise<T>` — Aggregate without checks or restrictions
 - `async aggregateRaw(pipeline: PipelineStage[], serviceOptions?: ServiceOptions)`: `Promise<T>` — Aggregate without checks, restrictions or preparations
-- `async create(input: PlainObject<CreateInput>, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Create item
+- `async create(input: PlainObject<CreateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Create item
 - `async createForce(input: PlainObject<CreateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Create item without checks or restrictions
 - `async createRaw(input: PlainObject<CreateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Create item without checks, restrictions or preparations
 - `distinct(property: string)`: `Promise<string[]>` — Get distinct values of a property
-- `async get(id: string, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Get item by ID
+- `async get(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Get item by ID
 - `async getForce(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Get item by ID without checks or restrictions
 - `async getRaw(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Get item by ID without checks, restrictions or preparations
-- `async find(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions | undefined)`: `Promise<Model[]>` — Get items via filter
+- `async find(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Get items via filter
 - `async findForce(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Get items via filter without checks or restrictions
 - `async findRaw(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Get items via filter without checks, restrictions or preparations
-- `async findAndCount(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions | undefined)`: `Promise<{ items: Model[]; pagination: PaginationInfo; totalCount: number; }>` — Get items and total count via filter
+- `async findAndCount(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<{ items: Model[]; pagination: PaginationInfo; totalCount: number; }>` — Get items and total count via filter
 - `async findAndCountForce(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<{ items: Model[]; pagination: PaginationInfo; totalCount: number; }>` — Get items and total count via filter without checks or restrictions
 - `async findAndCountRaw(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<{ items: Model[]; pagination: PaginationInfo; totalCount: number; }>` — Get items and total count via filter without checks, restrictions or preparations
-- `async findAndUpdate(filter: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., update: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model[]>` — Find and update
+- `async findAndUpdate(filter: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., update: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Find and update
 - `async findAndUpdateForce(filter: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., update: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Find and update without checks or restrictions
 - `async findAndUpdateRaw(filter: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., update: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model[]>` — Find and update without checks, restrictions or preparations
-- `async findOne(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; }..., serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Find one item via filter
+- `async findOne(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; }, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Find one item via filter
 - `async findOneForce(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<Model>` — Find one item via filter without checks or restrictions
 - `async findOneRaw(filter?: FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryOptions; s..., serviceOptions?: ServiceOptions)`: `Promise<Model>` — Find one item via filter without checks, restrictions or preparations
 - `getModel()`: `MongooseModel<Document<Types.ObjectId, any, any, Record<string, any>, {}> & M...` — Get service model to process queries directly.
 - `getNativeCollection(reason: string)`: `Collection<Document>` — Get the native MongoDB Collection, bypassing all Mongoose plugins.
 - `getNativeConnection(reason: string)`: `Connection` — Get the Mongoose Connection (which provides access to the native MongoDB Db and MongoClient).
 - `validateNativeAccessReason(reason: string, method: string)`: `void`
-- `async read(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions | undefined)`: `Promise<Model | Model[]>` — CRUD alias for get or find
-- `async readForce(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions | undefined)`: `Promise<Model | Model[]>` — CRUD alias for getForce or findForce
-- `async readRaw(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions | undefined)`: `Promise<Model | Model[]>` — CRUD alias for getRaw or findRaw
-- `async update(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Update item via ID
-- `async updateForce(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Update item via ID without checks or restrictions
-- `async updateRaw(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Update item via ID without checks, restrictions or preparations
-- `async delete(id: string, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Delete item via ID
-- `async deleteForce(id: string, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Delete item via ID without checks or restrictions
-- `async deleteRaw(id: string, serviceOptions?: ServiceOptions | undefined)`: `Promise<Model>` — Delete item via ID without checks, restrictions or preparations
-- `async pushToArray(id: string | Types.ObjectId | { id?: any; _id?: any; }, field: string, items: any, options?: { $slice?: number; $position?: number; $sort?: Record<string, 1 | -1>; } | un...)`: `Promise<void>` — Append items to an array field without loading the full array.
+- `async read(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions)`: `Promise<Model | Model[]>` — CRUD alias for get or find
+- `async readForce(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions)`: `Promise<Model | Model[]>` — CRUD alias for getForce or findForce
+- `async readRaw(input: string | FilterArgs | { filterQuery?: QueryFilter<any>; queryOptions?: QueryO..., serviceOptions?: ServiceOptions)`: `Promise<Model | Model[]>` — CRUD alias for getRaw or findRaw
+- `async update(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Update item via ID
+- `async updateForce(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Update item via ID without checks or restrictions
+- `async updateRaw(id: string, input: PlainObject<UpdateInput>, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Update item via ID without checks, restrictions or preparations
+- `async delete(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Delete item via ID
+- `async deleteForce(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Delete item via ID without checks or restrictions
+- `async deleteRaw(id: string, serviceOptions?: ServiceOptions)`: `Promise<Model>` — Delete item via ID without checks, restrictions or preparations
+- `async pushToArray(id: string | Types.ObjectId | { id?: any; _id?: any; }, field: string, items: any, options?: { $slice?: number; $position?: number; $sort?: Record<string, 1 | -1>; })`: `Promise<void>` — Append items to an array field without loading the full array.
 - `async pullFromArray(id: string | Types.ObjectId | { id?: any; _id?: any; }, field: string, condition: any)`: `Promise<void>` — Remove items from an array field.
-- `async processQueryOrDocument(queryOrDocument: Document<Types.ObjectId, any, any, Record<string, any>, {}> | Document<Types...., serviceOptions?: ServiceOptions | undefined)`: `Promise<T>` — Execute, populate and map Mongoose query or document(s) with serviceOptions
+- `async processQueryOrDocument(queryOrDocument: Document<Types.ObjectId, any, any, Record<string, any>, {}> | Document<Types...., serviceOptions?: ServiceOptions)`: `Promise<T>` — Execute, populate and map Mongoose query or document(s) with serviceOptions
 
 **Variants:** Each method has three variants:
 - `method()` — Standard: applies `securityCheck()`, respects permissions