@lenne.tech/nest-server 11.43.2 → 12.0.0

package/src/core/common/filters/mongoose-cast-error.filter.ts

@@ -10,7 +10,7 @@ import {
 } from '@nestjs/common';
 import { Error as MongooseError } from 'mongoose';
 
-import { ErrorCode } from '../../modules/error-code/error-codes';
+import { ErrorCode } from '../../modules/error-code/error-codes.js';
 
 import type { GqlContextType } from '@nestjs/graphql';
 import type { Request, Response } from 'express';

package/src/core/common/helpers/clone.helper.ts

@@ -27,8 +27,8 @@
  * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
  */
 import * as inspector from 'inspector';
-import _ = require('lodash');
-import rfdc = require('rfdc');
+import _ from 'lodash';
+import rfdc from 'rfdc';
 import * as util from 'util';
 
 /**

package/src/core/common/helpers/config.helper.ts

@@ -1,7 +1,9 @@
 import * as dotenv from 'dotenv';
-import _ = require('lodash');
+import _ from 'lodash';
+import { existsSync, readFileSync } from 'node:fs';
+import { createRequire } from 'node:module';
 import * as process from 'node:process';
-import { join } from 'path';
+import { join, resolve } from 'path';
 
 /**
  * Helper class for configurations
@@ -27,6 +29,41 @@ export default class Config {
   }
 }
 
+/**
+ * The local configuration `loadLocalConfig` names, read SYNCHRONOUSLY — or `undefined` when there is none.
+ *
+ * - `true`: `config.json` in the working directory, then `src/config.json` (the project, never this package).
+ * - a path: relative paths resolve against the working directory. `.json` is read as JSON, anything else is loaded
+ *   as a module (`require`, which also loads ESM without top-level await) and its default export is used.
+ *
+ * Until 12.0.0 this used `import()`, relative to THIS helper's own directory: in npm mode that searched
+ * `node_modules/@lenne.tech/nest-server/dist/…`, a JSON file needs an import attribute that was never passed (under
+ * `module: nodenext` the `import()` stays native), and the merge landed after the configuration had been returned.
+ *
+ * @param loadLocalConfig the `loadLocalConfig` setting
+ * @param cwd the directory relative paths and the `true` search start from (default: `process.cwd()`)
+ */
+export function loadLocalConfigFile(
+  loadLocalConfig: boolean | string,
+  cwd: string = process.cwd(),
+): Record<string, any> | undefined {
+  const candidates =
+    typeof loadLocalConfig === 'string'
+      ? [resolve(cwd, loadLocalConfig)]
+      : loadLocalConfig
+        ? [join(cwd, 'config.json'), join(cwd, 'src', 'config.json')]
+        : [];
+  const file = candidates.find((candidate) => existsSync(candidate));
+  if (!file) {
+    return undefined;
+  }
+  if (file.endsWith('.json')) {
+    return JSON.parse(readFileSync(file, 'utf8'));
+  }
+  const loaded = createRequire(join(cwd, 'package.json'))(file);
+  return loaded?.default ?? loaded;
+}
+
 /**
  * Get environment configuration (deeply merged into config object set via options)
  *
@@ -60,34 +97,15 @@ export function getEnvironmentConfig(options: { config?: Record<string, any>; de
 
   // Merge with localConfig (e.g. config.json)
   if (envConfig.loadLocalConfig) {
-    let localConfig: Record<string, any>;
-    if (typeof envConfig.loadLocalConfig === 'string') {
-      import(envConfig.loadLocalConfig)
-        .then((loadedConfig) => {
-          localConfig = loadedConfig.default || loadedConfig;
-          merge(envConfig, localConfig);
-        })
-        .catch(() => {
-          console.info(`Configuration ${envConfig.loadLocalConfig} not found!`);
-        });
+    const localConfig = loadLocalConfigFile(envConfig.loadLocalConfig);
+    if (localConfig) {
+      merge(envConfig, localConfig);
+    } else if (typeof envConfig.loadLocalConfig === 'string') {
+      console.warn(
+        `Local configuration ${envConfig.loadLocalConfig} (loadLocalConfig) not found — continuing without it`,
+      );
     } else {
-      // get config from src directory
-      import(join(__dirname, 'config.json'))
-        .then((loadedConfig) => {
-          localConfig = loadedConfig.default || loadedConfig;
-          merge(envConfig, localConfig);
-        })
-        .catch(() => {
-          // if not found try to find in project directory
-          import(join(__dirname, '..', 'config.json'))
-            .then((loadedConfig) => {
-              localConfig = loadedConfig.default || loadedConfig;
-              merge(envConfig, localConfig);
-            })
-            .catch(() => {
-              console.info('No local config.json found!');
-            });
-        });
+      console.info('No local config.json (loadLocalConfig) — using the environment configuration only');
     }
   }
 

package/src/core/common/helpers/cookies.helper.ts

@@ -1,6 +1,6 @@
 import type { Response } from 'express';
 
-import type { ICookiesConfig, ICorsConfig, IServerOptions } from '../interfaces/server-options.interface';
+import type { ICookiesConfig, ICorsConfig, IServerOptions } from '../interfaces/server-options.interface.js';
 
 /**
  * Module-scoped cache of `process.env.NODE_ENV === 'production'`.

package/src/core/common/helpers/db.helper.ts

@@ -1,13 +1,13 @@
 import { FieldNode, GraphQLResolveInfo, SelectionNode } from 'graphql';
 import { Document, Model, PopulateOptions, Query, Types } from 'mongoose';
 
-import { ResolveSelector } from '../interfaces/resolve-selector.interface';
-import { CoreModel } from '../models/core-model.model';
-import { FieldSelection } from '../types/field-selection.type';
-import { IdsType } from '../types/ids.type';
-import { StringOrObjectId } from '../types/string-or-object-id.type';
-import { equalIds, getObjectIds, getStringIds } from './id.helper';
-import { removePropertiesDeep } from './input.helper';
+import { ResolveSelector } from '../interfaces/resolve-selector.interface.js';
+import { CoreModel } from '../models/core-model.model.js';
+import { FieldSelection } from '../types/field-selection.type.js';
+import { IdsType } from '../types/ids.type.js';
+import { StringOrObjectId } from '../types/string-or-object-id.type.js';
+import { equalIds, getObjectIds, getStringIds } from './id.helper.js';
+import { removePropertiesDeep } from './input.helper.js';
 
 /**
  * The ID helpers moved to `./id.helper` and are re-exported here so every existing import path keeps
@@ -17,7 +17,7 @@ import { removePropertiesDeep } from './input.helper';
  * line away from an SWC temporal-dead-zone crash. `id.helper` imports no framework code, so it can
  * never be part of a cycle. Do NOT move them back.
  */
-export { equalIds, getIncludedIds, getObjectIds, getStringIds } from './id.helper';
+export { equalIds, getIncludedIds, getObjectIds, getStringIds } from './id.helper.js';
 
 // =====================================================================================================================
 // Export functions

package/src/core/common/helpers/decorator.helper.ts

@@ -2,8 +2,8 @@ import { ExecutionContext } from '@nestjs/common';
 import { GqlContextType, GqlExecutionContext } from '@nestjs/graphql';
 import { PopulateOptions } from 'mongoose';
 
-import { getPopulateOptions } from './db.helper';
-import { removePropertiesDeep } from './input.helper';
+import { getPopulateOptions } from './db.helper.js';
+import { removePropertiesDeep } from './input.helper.js';
 
 /**
  * Decorator function to get current user for Controller (http context) and Resolver (graphql context)

package/src/core/common/helpers/execution-context-request.helper.ts

@@ -85,8 +85,8 @@ export function resolveGuardRequest(
   }
 
   if (isSubscriptionContext(gqlContext)) {
-    // Normalize the two names the transports use, so a guard reads `headers` unconditionally:
-    // `graphql-ws` gets them from CoreModule's onConnect, `subscriptions-transport-ws` from its own,
+    // Normalize the names a context may carry, so a guard reads `headers` unconditionally:
+    // `graphql-ws` gets them from CoreModule's onConnect, a custom onConnect may set `headers` itself,
     // and the raw upgrade request is the fallback for a custom onConnect that forwards neither.
     if (!gqlContext.headers) {
       gqlContext.headers = gqlContext.connectionParams ?? gqlContext.request?.headers ?? {};

package/src/core/common/helpers/file.helper.ts

@@ -5,7 +5,7 @@ import { diskStorage, memoryStorage } from 'multer';
 import { extname } from 'path';
 import { Readable } from 'stream';
 
-import type { FileUploadSource } from '../../modules/file/interfaces/file-upload.interface';
+import type { FileUploadSource } from '../../modules/file/interfaces/file-upload.interface.js';
 
 /**
  * What an upload endpoint accepts: exact mimetypes and exact file extensions.

package/src/core/common/helpers/filter.helper.ts

@@ -1,14 +1,14 @@
 import { QueryFilter, QueryOptions } from 'mongoose';
 
-import { FilterArgs } from '../args/filter.args';
-import { ComparisonOperatorEnum } from '../enums/comparison-operator.enum';
-import { LogicalOperatorEnum } from '../enums/logical-operator.enum';
-import { SortOrderEnum } from '../enums/sort-order.emum';
-import { FilterInput } from '../inputs/filter.input';
-import { SortInput } from '../inputs/sort.input';
-import { ConfigService } from '../services/config.service';
-import { checkStringIds, getObjectIds } from './db.helper';
-import { assignPlain, clone } from './input.helper';
+import { FilterArgs } from '../args/filter.args.js';
+import { ComparisonOperatorEnum } from '../enums/comparison-operator.enum.js';
+import { LogicalOperatorEnum } from '../enums/logical-operator.enum.js';
+import { SortOrderEnum } from '../enums/sort-order.emum.js';
+import { FilterInput } from '../inputs/filter.input.js';
+import { SortInput } from '../inputs/sort.input.js';
+import { ConfigService } from '../services/config.service.js';
+import { checkStringIds, getObjectIds } from './db.helper.js';
+import { assignPlain, clone } from './input.helper.js';
 
 /**
  * Helper for filter handling

package/src/core/common/helpers/graceful-shutdown.helper.ts

@@ -1,6 +1,6 @@
 import { INestApplication, Logger } from '@nestjs/common';
 
-import { ConfigService } from '../services/config.service';
+import { ConfigService } from '../services/config.service.js';
 
 /** Signals an orchestrator uses to ask a container to stop */
 const SHUTDOWN_SIGNALS: NodeJS.Signals[] = ['SIGTERM', 'SIGINT'];

package/src/core/common/helpers/graphql-ws-connection.helper.ts

@@ -1,7 +1,7 @@
 import { Logger } from '@nestjs/common';
 
-import { ConfigService } from '../services/config.service';
-import { getTenantContextResolver, ResolvedTenantContext } from '../services/core-tenant-context.registry';
+import { ConfigService } from '../services/config.service.js';
+import { getTenantContextResolver, ResolvedTenantContext } from '../services/core-tenant-context.registry.js';
 
 /**
  * The authorization lifecycle of an OPEN GraphQL WebSocket connection.
@@ -41,6 +41,30 @@ import { getTenantContextResolver, ResolvedTenantContext } from '../services/cor
  */
 export const WS_AUTHORIZATION_CHANGED_CLOSE_CODE = 4403;
 
+/**
+ * Close code for a handshake whose credential does not authenticate: graphql-ws's `CloseCode.Unauthorized`.
+ * Unlike 4403 its client does NOT retry it — the same credential would only be refused again.
+ */
+export const WS_UNAUTHORIZED_CLOSE_CODE = 4401;
+
+/**
+ * Refuse a graphql-ws handshake from `onConnect` because its credential does not authenticate. Returns
+ * `false`, which `onConnect` must return.
+ *
+ * graphql-ws offers two ways to refuse, and neither fits: returning `false` closes with 4403, which its
+ * client retries — with the same refused credential, again and again — and throwing makes its ws adapter
+ * log "Internal error occurred during message handling. Please check your implementation." and close
+ * with 4500, a SERVER error for a client's expired token. Until 12.0.0 `onConnect` threw, so every
+ * expired token printed that line with a stack trace, in production too. Closing with 4401 first turns
+ * the close graphql-ws issues after a `false` into a no-op on a socket that is already closing.
+ *
+ * Without a socket (a transport that hands none to `onConnect`) the `false` alone refuses, with 4403.
+ */
+export function refuseWsHandshake(socket: IWsConnectionSocket | undefined, reason = 'Unauthorized'): false {
+  socket?.close(WS_UNAUTHORIZED_CLOSE_CODE, reason);
+  return false;
+}
+
 /** Default for `graphQl.subscriptionRevalidationMs`. */
 export const DEFAULT_SUBSCRIPTION_REVALIDATION_MS = 30_000;
 
@@ -53,8 +77,8 @@ export interface IWsConnectionSocket {
 export interface IWsConnectionRegistration {
   /**
    * The object every operation of the connection receives as its GraphQL context: `extra` for
-   * graphql-ws, the object `onConnect` returns for subscriptions-transport-ws (which copies it per
-   * operation — the registration survives that copy).
+   * graphql-ws, or whatever object a project's own transport hands each operation — the registration
+   * survives a shallow per-operation copy of it.
    */
   carrier: object;
 
@@ -106,8 +130,9 @@ export interface WsConnection {
 /**
  * Module-private and not `Symbol.for()`: nothing a client sends — `connectionParams` are JSON — can
  * produce it, so a registration cannot be forged or overwritten from outside. Enumerable on purpose:
- * subscriptions-transport-ws hands each operation an `Object.assign` copy of the connection context,
- * and only enumerable own properties survive that.
+ * a transport that hands each operation an `Object.assign` copy of the connection context (as
+ * subscriptions-transport-ws did until `@nestjs/graphql` 14 removed it) keeps only enumerable own
+ * properties.
  */
 const WS_CONNECTION = Symbol('ltWsConnection');
 

package/src/core/common/helpers/graphql-ws-context.helper.ts

@@ -3,17 +3,17 @@
 // to a second copy of the module (a bundler's interop namespace, or a duplicated install), and the
 // wrapper would then reject the very schema it was handed. The repo already uses this form for
 // `graphql-upload` and `lodash` for the same reason.
-import graphql = require('graphql');
+import * as graphql from 'graphql';
 
-import { getTenantContextResolver, ResolvedTenantContext } from '../services/core-tenant-context.registry';
-import { IRequestContext, RequestContext } from '../services/request-context.service';
+import { getTenantContextResolver, ResolvedTenantContext } from '../services/core-tenant-context.registry.js';
+import { IRequestContext, RequestContext } from '../services/request-context.service.js';
 import {
   ensureWsConnectionCurrent,
   getWsConnection,
   noteWsConnectionTenant,
   readWsTenantHeader,
   WsConnection,
-} from './graphql-ws-connection.helper';
+} from './graphql-ws-connection.helper.js';
 
 /**
  * A `RequestContext` for GraphQL operations that arrive over a WEBSOCKET.
@@ -33,8 +33,8 @@ import {
  * schema is touched without a tenant) never fired, because there was no context to notice.
  *
  * WHERE IT HOOKS IN: `GqlSubscriptionService` reads `execute` and `subscribe` off the GraphQL module
- * options and hands them to BOTH WebSocket transports (`graphql-ws` and `subscriptions-transport-ws`),
- * defaulting to graphql-js's own. Those two functions are the only place where the whole WS operation
+ * options and hands them to the graphql-ws server — the only WebSocket transport since
+ * `@nestjs/graphql` 14 removed `subscriptions-transport-ws` — defaulting to graphql-js's own. Those two functions are the only place where the whole WS operation
  * — including every field resolver and the `resolve`/`filter` callbacks of a subscription — is
  * reachable as one call. HTTP does not go through them (Apollo runs its own pipeline), so wrapping
  * them touches the WS path only.
@@ -64,11 +64,10 @@ type ExecuteFn = (args: GraphQlArgs) => any;
 /**
  * Read the tenant header out of whatever the transport left on the context.
  *
- * Both WS transports are covered, and the reason there are three sources is that they genuinely
- * differ: `graphql-ws` gets `extra.headers` from `CoreModule`'s `onConnect` (the client's
- * `connectionParams`), `subscriptions-transport-ws` returns `{ headers }` from its own `onConnect`,
- * and the raw upgrade request is the fallback for a project with a custom `onConnect` that forwards
- * neither. Header names are matched case-insensitively — `connectionParams` are client-supplied JSON
+ * There are three sources because the shapes genuinely differ: `graphql-ws` gets `extra.headers`
+ * from `CoreModule`'s `onConnect` (the client's `connectionParams`), a project's own `onConnect` may
+ * return `{ headers }` (the shape `subscriptions-transport-ws` used until `@nestjs/graphql` 14 removed
+ * it), and the raw upgrade request is the fallback for a custom `onConnect` that forwards neither. Header names are matched case-insensitively — `connectionParams` are client-supplied JSON
  * and arrive with whatever casing the client used, unlike Node's lower-cased HTTP headers.
  *
  * Lives in `graphql-ws-connection.helper.ts`, because a connection's re-check has to resolve the

package/src/core/common/helpers/graphql.helper.ts

@@ -12,7 +12,7 @@ import {
   ValueNode,
   VariableNode,
 } from 'graphql';
-import _ = require('lodash');
+import _ from 'lodash';
 
 /**
  * Interface for GraphQLFieldsConfig

package/src/core/common/helpers/id.helper.ts

@@ -28,10 +28,10 @@
  * `db.helper` re-exports all four public functions, so every existing import path keeps working.
  * See .claude/rules/architecture.md → "DI Token Placement (SWC-Safe)".
  */
-import _ = require('lodash');
+import _ from 'lodash';
 import { Types } from 'mongoose';
 
-import { IdsType } from '../types/ids.type';
+import { IdsType } from '../types/ids.type.js';
 
 /**
  * Checks if all IDs are equal

package/src/core/common/helpers/input.helper.ts

@@ -1,17 +1,17 @@
 import { BadRequestException, ForbiddenException } from '@nestjs/common';
 import { plainToInstance } from 'class-transformer';
 import { validate } from 'class-validator';
-import { ValidatorOptions } from 'class-validator/types/validation/ValidatorOptions';
-import { Kind } from 'graphql/index';
+import type { ValidatorOptions } from 'class-validator';
+import { Kind } from 'graphql';
 
-import { checkRestricted } from '../decorators/restricted.decorator';
-import { ProcessType } from '../enums/process-type.enum';
-import { RoleEnum } from '../enums/role.enum';
-import { accessDeniedException } from '../exceptions/access-denied.exception';
-import { ErrorCode } from '../../modules/error-code/error-codes';
-import { clone } from './clone.helper';
-import { merge } from './config.helper';
-import { equalIds } from './id.helper';
+import { checkRestricted } from '../decorators/restricted.decorator.js';
+import { ProcessType } from '../enums/process-type.enum.js';
+import { RoleEnum } from '../enums/role.enum.js';
+import { accessDeniedException } from '../exceptions/access-denied.exception.js';
+import { ErrorCode } from '../../modules/error-code/error-codes.js';
+import { clone } from './clone.helper.js';
+import { merge } from './config.helper.js';
+import { equalIds } from './id.helper.js';
 
 /**
  * `clone` and `deepFreeze` moved to `./clone.helper` and are re-exported here so every existing
@@ -21,7 +21,7 @@ import { equalIds } from './id.helper';
  * that is one top-level line away from an SWC temporal-dead-zone crash. `clone.helper` imports no
  * framework code, so it can never be part of a cycle. Do NOT move them back.
  */
-export { clone, deepFreeze } from './clone.helper';
+export { clone, deepFreeze } from './clone.helper.js';
 
 /**
  * Helper class for inputs

package/src/core/common/helpers/interceptor.helper.ts

@@ -1,8 +1,8 @@
 import { ExecutionContext } from '@nestjs/common';
-import { GqlExecutionContext } from '@nestjs/graphql';
+import { GqlExecutionContext, TypeMetadataStorage } from '@nestjs/graphql';
 
-import { RESPONSE_MODEL_KEY } from '../decorators/response-model.decorator';
-import { CoreModel } from '../models/core-model.model';
+import { RESPONSE_MODEL_KEY } from '../decorators/response-model.decorator.js';
+import { CoreModel } from '../models/core-model.model.js';
 
 // Cache: handler function → resolved model class (or null)
 // Handler references are stable per route, so the cache is bounded by the number of routes.
@@ -66,12 +66,9 @@ function resolveResponseModelClassUncached(
  */
 function resolveFromGraphQlMetadata(context: ExecutionContext): (new (...args: any[]) => CoreModel) | null {
   try {
-    // Uses @nestjs/graphql internal path to access TypeMetadataStorage — the only way to resolve
-    // @Query/@Mutation return types at runtime. This path has been stable since @nestjs/graphql v10.
-    // Wrapped in try/catch so a path change in a future version degrades gracefully (returns null).
-    // eslint-disable-next-line @typescript-eslint/no-require-imports
-    const { TypeMetadataStorage } = require('@nestjs/graphql/dist/schema-builder/storages/type-metadata.storage.js');
-
+    // TypeMetadataStorage from the package root (public export, the same instance the deep
+    // `dist/schema-builder/storages/type-metadata.storage.js` path held — that one existed only for `require()`).
+    // Wrapped in try/catch so a shape change in a future version degrades gracefully (returns null).
     const handler = context.getHandler();
     const target = context.getClass();
     const methodName = handler.name;

package/src/core/common/helpers/model.helper.ts

@@ -1,6 +1,6 @@
 import { Types } from 'mongoose';
 
-import { clone, plainToInstanceClean } from './input.helper';
+import { clone, plainToInstanceClean } from './input.helper.js';
 
 /**
  * Helper class for models

package/src/core/common/helpers/module-location.helper.ts

@@ -0,0 +1,33 @@
+import { dirname } from 'node:path';
+import { fileURLToPath } from 'node:url';
+
+/**
+ * Directory of the file that calls this function — the replacement for `__dirname` in the core.
+ *
+ * The core's source must be valid as CommonJS (this package, CommonJS projects) AND as ESM (ESM projects that
+ * vendor it). `__dirname` exists only in CommonJS, `import.meta.dirname` only in ESM, and `tsc` refuses
+ * `import.meta` in a file it emits as CommonJS (TS1470) — so neither can be written in source that has to be
+ * both. V8 knows the calling file either way: as a path (CommonJS, and a TypeScript source run) or as a `file:`
+ * URL (ESM).
+ *
+ * Call it synchronously from the module whose location you need — after an `await` the caller's frame is gone.
+ *
+ * @param depth how many further frames up to go: 0 = the caller, 1 = the caller's caller (for a helper that
+ *   resolves paths on behalf of whoever called IT)
+ */
+export function callerDirectory(depth = 0): string {
+  const original = Error.prepareStackTrace;
+  let file: null | string | undefined;
+  try {
+    Error.prepareStackTrace = (_error, frames) => frames;
+    const holder: { stack?: unknown } = {};
+    Error.captureStackTrace(holder, callerDirectory);
+    file = (holder.stack as NodeJS.CallSite[] | undefined)?.[depth]?.getFileName();
+  } finally {
+    Error.prepareStackTrace = original;
+  }
+  if (!file) {
+    throw new Error(`callerDirectory(): no calling file at depth ${depth}`);
+  }
+  return dirname(file.startsWith('file:') ? fileURLToPath(file) : file);
+}

package/src/core/common/helpers/outbound-url.helper.ts

@@ -2,8 +2,8 @@ import { lookup as dnsLookup, type LookupAddress } from 'node:dns';
 import { BlockList, isIP } from 'node:net';
 import { Agent, buildConnector, fetch as undiciFetch } from 'undici';
 
-import { ConfigService } from '../services/config.service';
-import { isLocalEnv } from './cookies.helper';
+import { ConfigService } from '../services/config.service.js';
+import { isLocalEnv } from './cookies.helper.js';
 
 /**
  * Requests to a URL a USER entered — a webhook, an export target, an ERP address.

package/src/core/common/helpers/process-diagnostics.helper.ts

@@ -62,7 +62,7 @@
 
 import { writeSync } from 'node:fs';
 
-import { redactSensitiveText } from './logging.helper';
+import { redactSensitiveText } from './logging.helper.js';
 
 /**
  * Hard cap for a single diagnostic line.

package/src/core/common/helpers/register-enum.helper.ts

@@ -1,6 +1,6 @@
 import { registerEnumType } from '@nestjs/graphql';
 
-import { enumNameRegistry } from '../decorators/unified-field.decorator';
+import { enumNameRegistry } from '../decorators/unified-field.decorator.js';
 
 /**
  * Tracks which enum objects have been registered for GraphQL via registerEnum/registerEnums.

package/src/core/common/helpers/scim.helper.ts

@@ -1,7 +1,7 @@
-import type { Comparator } from '../types/scim-comparator.type';
-import type { LogicalOperator } from '../types/scim-logical-operator.type';
+import type { Comparator } from '../types/scim-comparator.type.js';
+import type { LogicalOperator } from '../types/scim-logical-operator.type.js';
 
-import { ScimNode } from '../types/scim-node.type';
+import { ScimNode } from '../types/scim-node.type.js';
 
 export function scimToMongo(scim: string): any {
   if (!scim) {

package/src/core/common/helpers/service.helper.ts

@@ -1,17 +1,17 @@
-import bcrypt = require('bcrypt');
+import bcrypt from 'bcrypt';
 import { sha256 } from 'js-sha256';
-import _ = require('lodash');
+import _ from 'lodash';
 import { Types } from 'mongoose';
 
-import { RoleEnum } from '../enums/role.enum';
-import { accessDeniedException } from '../exceptions/access-denied.exception';
-import { PrepareInputOptions } from '../interfaces/prepare-input-options.interface';
-import { PrepareOutputOptions } from '../interfaces/prepare-output-options.interface';
-import { ResolveSelector } from '../interfaces/resolve-selector.interface';
-import { ServiceOptions } from '../interfaces/service-options.interface';
-import { ConfigService } from '../services/config.service';
-import { getStringIds } from './db.helper';
-import { clone, plainToInstanceClean, processDeep } from './input.helper';
+import { RoleEnum } from '../enums/role.enum.js';
+import { accessDeniedException } from '../exceptions/access-denied.exception.js';
+import { PrepareInputOptions } from '../interfaces/prepare-input-options.interface.js';
+import { PrepareOutputOptions } from '../interfaces/prepare-output-options.interface.js';
+import { ResolveSelector } from '../interfaces/resolve-selector.interface.js';
+import { ServiceOptions } from '../interfaces/service-options.interface.js';
+import { ConfigService } from '../services/config.service.js';
+import { getStringIds } from './db.helper.js';
+import { clone, plainToInstanceClean, processDeep } from './input.helper.js';
 
 // Secret field names for recursive removal in prepareOutput — allocated once, never change.
 // Only fields that are NEVER needed internally (hashed passwords, one-time tokens).