@lenne.tech/nest-server 11.43.3 → 12.0.0

package/src/core/modules/ai/services/core-ai-tool-grant.service.ts

@@ -2,18 +2,18 @@ import { Inject, Injectable, Logger } from '@nestjs/common';
 import { InjectModel } from '@nestjs/mongoose';
 import { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiToolGrantDocument, CoreAiToolGrant } from '../models/core-ai-tool-grant.model';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiToolGrantDocument, CoreAiToolGrant } from '../models/core-ai-tool-grant.model.js';
 
-import { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
+import { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants';
+export { AI_TOOL_GRANT_CLASS, AI_TOOL_GRANT_MODEL } from '../core-ai.constants.js';
 
 /** Scope of a persisted permission decision. */
 export type AiToolGrantScope = 'conversation' | 'tenant' | 'user';

package/src/core/modules/ai/services/core-ai-tool-policy.service.ts

@@ -2,18 +2,18 @@ import { Inject, Injectable, Logger } from '@nestjs/common';
 import { InjectModel } from '@nestjs/mongoose';
 import { Model } from 'mongoose';
 
-import { CrudService } from '../../../common/services/crud.service';
-import { CoreModelConstructor } from '../../../common/types/core-model-constructor.type';
-import { AiToolPolicyDocument, CoreAiToolPolicy } from '../models/core-ai-tool-policy.model';
+import { CrudService } from '../../../common/services/crud.service.js';
+import type { CoreModelConstructor } from '../../../common/types/core-model-constructor.type.js';
+import { AiToolPolicyDocument, CoreAiToolPolicy } from '../models/core-ai-tool-policy.model.js';
 
-import { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
+import { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants.js';
 
 /**
  * @deprecated Import from `../core-ai.constants` instead. Re-exported only so existing deep imports
  * keep working; the tokens are declared in an import-free leaf so no cycle can form around them
  * (SWC-safe — see core-ai.constants.ts).
  */
-export { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants';
+export { AI_TOOL_POLICY_CLASS, AI_TOOL_POLICY_MODEL } from '../core-ai.constants.js';
 
 export interface AiToolPolicyDecision {
   /** Final decision: 'allow', 'deny' or 'ask'. */

package/src/core/modules/ai/services/core-ai.service.ts

@@ -1,35 +1,39 @@
 import { HttpException, HttpStatus, Injectable, Logger, Optional } from '@nestjs/common';
 
-import { ServiceOptions } from '../../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../../common/services/config.service';
-import { CoreRedisService } from '../../../common/services/core-redis.service';
-import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../../common/services/rate-limit-store';
-import { RequestContext } from '../../../common/services/request-context.service';
-import { ErrorCode } from '../../error-code';
-import { AiToolAuthorization, AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
-import { LlmMessage, LlmResponse, LlmToolCall } from '../interfaces/llm-provider.interface';
-import { ResolvedAiConnection } from '../interfaces/resolved-ai-connection.interface';
-import { CoreAiAction } from '../models/core-ai-action.model';
-import { CoreAiResponse } from '../models/core-ai-response.model';
-import { CoreAiUsage } from '../models/core-ai-usage.model';
-import { CoreAiPromptInput } from '../inputs/core-ai-prompt.input';
-import { LlmProviderFactory } from '../providers/llm-provider.factory';
-import { AiHookRegistry } from '../hooks/ai-hook.registry';
-import { AiHookEvent } from '../interfaces/ai-hook.interface';
-import { AiToolRegistry } from '../tools/ai-tool.registry';
-import { ASK_USER_QUESTION_SENTINEL } from '../tools/ask-user-question.tool';
-import { CoreAiBudgetService } from './core-ai-budget.service';
-import { CoreAiConnectionResolverService } from './core-ai-connection-resolver.service';
-import { CoreAiConnectionService } from './core-ai-connection.service';
-import { CoreAiConversationService } from './core-ai-conversation.service';
-import { CoreAiInteractionService } from './core-ai-interaction.service';
-import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry';
-import { CoreAiPromptBuilderService } from './core-ai-prompt-builder.service';
-import { AiPromptFeedbackSignal, CoreAiPromptHintService } from './core-ai-prompt-hint.service';
-import { AiToolGrantScope, CoreAiToolGrantService } from './core-ai-tool-grant.service';
-import { CoreAiToolPolicyService } from './core-ai-tool-policy.service';
-import { CoreAiModeService } from './core-ai-mode.service';
-import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
+import { ServiceOptions } from '../../../common/interfaces/service-options.interface.js';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { CoreRedisService } from '../../../common/services/core-redis.service.js';
+import {
+  InMemoryRateLimitStore,
+  RateLimitStore,
+  RedisRateLimitStore,
+} from '../../../common/services/rate-limit-store.js';
+import { RequestContext } from '../../../common/services/request-context.service.js';
+import { ErrorCode } from '../../error-code/index.js';
+import { AiToolAuthorization, AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
+import { LlmMessage, LlmResponse, LlmToolCall } from '../interfaces/llm-provider.interface.js';
+import { ResolvedAiConnection } from '../interfaces/resolved-ai-connection.interface.js';
+import { CoreAiAction } from '../models/core-ai-action.model.js';
+import { CoreAiResponse } from '../models/core-ai-response.model.js';
+import { CoreAiUsage } from '../models/core-ai-usage.model.js';
+import { CoreAiPromptInput } from '../inputs/core-ai-prompt.input.js';
+import { LlmProviderFactory } from '../providers/llm-provider.factory.js';
+import { AiHookRegistry } from '../hooks/ai-hook.registry.js';
+import { AiHookEvent } from '../interfaces/ai-hook.interface.js';
+import { AiToolRegistry } from '../tools/ai-tool.registry.js';
+import { ASK_USER_QUESTION_SENTINEL } from '../tools/ask-user-question.tool.js';
+import { CoreAiBudgetService } from './core-ai-budget.service.js';
+import { CoreAiConnectionResolverService } from './core-ai-connection-resolver.service.js';
+import { CoreAiConnectionService } from './core-ai-connection.service.js';
+import { CoreAiConversationService } from './core-ai-conversation.service.js';
+import { CoreAiInteractionService } from './core-ai-interaction.service.js';
+import { CoreAiPlaceholderRegistry } from './core-ai-placeholder.registry.js';
+import { CoreAiPromptBuilderService } from './core-ai-prompt-builder.service.js';
+import { AiPromptFeedbackSignal, CoreAiPromptHintService } from './core-ai-prompt-hint.service.js';
+import { AiToolGrantScope, CoreAiToolGrantService } from './core-ai-tool-grant.service.js';
+import { CoreAiToolPolicyService } from './core-ai-tool-policy.service.js';
+import { CoreAiModeService } from './core-ai-mode.service.js';
+import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface.js';
 
 /**
  * @deprecated Import from `../interfaces/ai-interaction-record.interface` instead. Re-exported only
@@ -39,7 +43,7 @@ import type { AiInteractionRecord } from '../interfaces/ai-interaction-record.in
  * imports THAT service — an import cycle held apart only by an `import type`. See the interface's
  * docblock.
  */
-export type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface';
+export type { AiInteractionRecord } from '../interfaces/ai-interaction-record.interface.js';
 
 /**
  * Event emitted by {@link CoreAiService.promptStream} over SSE.
@@ -60,7 +64,7 @@ export type AiStreamEvent =
  * by the auto and plan execution modes.
  */
 export interface AiRunContext {
-  connection: import('../interfaces/resolved-ai-connection.interface').ResolvedAiConnection;
+  connection: import('../interfaces/resolved-ai-connection.interface.js').ResolvedAiConnection;
   context: AiToolContext;
   currentUser: ServiceOptions['currentUser'];
   history: { content: string; role: string }[];
@@ -74,7 +78,7 @@ export interface AiRunContext {
    * every action arrives in one burst after the work is already done.
    */
   onAction?: (action: CoreAiAction) => void;
-  provider: import('../interfaces/llm-provider.interface').ILlmProvider;
+  provider: import('../interfaces/llm-provider.interface.js').ILlmProvider;
   tenantId?: string;
   tools: IAiTool[];
 }

package/src/core/modules/ai/tools/ai-tool.base.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger, OnModuleInit } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult, IAiTool } from '../interfaces/ai-tool.interface.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Convenience base class for AI tools.

package/src/core/modules/ai/tools/ai-tool.registry.ts

@@ -1,15 +1,15 @@
 import { Injectable, Logger } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { ConfigService } from '../../../common/services/config.service';
-import { RequestContext } from '../../../common/services/request-context.service';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { ConfigService } from '../../../common/services/config.service.js';
+import { RequestContext } from '../../../common/services/request-context.service.js';
 import {
   checkRoleAccess,
   isMultiTenancyActive,
   resolveGlobalAndTenantRoles,
   tenantSatisfiableRoles,
-} from '../../tenant/core-tenant.helpers';
-import { IAiTool } from '../interfaces/ai-tool.interface';
+} from '../../tenant/core-tenant.helpers.js';
+import { IAiTool } from '../interfaces/ai-tool.interface.js';
 
 /**
  * Minimal shape of the current user needed for tool-visibility checks.

package/src/core/modules/ai/tools/ask-user-question.tool.ts

@@ -1,9 +1,9 @@
 import { Injectable } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
-import { AiTool } from './ai-tool.base';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface.js';
+import { AiTool } from './ai-tool.base.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Sentinel marker the orchestrator detects to short-circuit the loop with a

package/src/core/modules/ai/tools/search-tools.tool.ts

@@ -1,9 +1,9 @@
 import { Injectable } from '@nestjs/common';
 
-import { RoleEnum } from '../../../common/enums/role.enum';
-import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface';
-import { AiTool } from './ai-tool.base';
-import { AiToolRegistry } from './ai-tool.registry';
+import { RoleEnum } from '../../../common/enums/role.enum.js';
+import { AiToolContext, AiToolResult } from '../interfaces/ai-tool.interface.js';
+import { AiTool } from './ai-tool.base.js';
+import { AiToolRegistry } from './ai-tool.registry.js';
 
 /**
  * Built-in **meta-tool** for the "deferred tool-schemas" mode

package/src/core/modules/api-token/core-api-token.decorators.ts

@@ -1,6 +1,6 @@
 import { SetMetadata } from '@nestjs/common';
 
-import { API_TOKEN_SCOPES_KEY } from './core-api-token.constants';
+import { API_TOKEN_SCOPES_KEY } from './core-api-token.constants.js';
 
 /**
  * Method/class decorator that opens an endpoint to API tokens (`apiTokens` config).

package/src/core/modules/api-token/core-api-token.helpers.ts

@@ -2,19 +2,19 @@ import { createHash, createHmac, randomBytes, timingSafeEqual } from 'node:crypt
 
 import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
 
-import { isForbiddenMembershipRole, RoleEnum } from '../../common/enums/role.enum';
-import { isProductionLikeEnv } from '../../common/helpers/cookies.helper';
-import type { IApiTokens, IMultiTenancy } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { ErrorCode } from '../error-code/error-codes';
-import { DEFAULT_ROLE_HIERARCHY } from '../tenant/core-tenant.enums';
+import { isForbiddenMembershipRole, RoleEnum } from '../../common/enums/role.enum.js';
+import { isProductionLikeEnv } from '../../common/helpers/cookies.helper.js';
+import type { IApiTokens, IMultiTenancy } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { DEFAULT_ROLE_HIERARCHY } from '../tenant/core-tenant.enums.js';
 import {
   checkRoleAccess,
   isSystemRole,
   mergeRolesMetadata,
   tenantSatisfiableRoles,
-} from '../tenant/core-tenant.helpers';
-import { API_TOKEN_SCOPES_KEY, ApiTokenKind } from './core-api-token.constants';
+} from '../tenant/core-tenant.helpers.js';
+import { API_TOKEN_SCOPES_KEY, ApiTokenKind } from './core-api-token.constants.js';
 
 // =====================================================================================================================
 // Configuration

package/src/core/modules/api-token/core-api-token.middleware.ts

@@ -1,9 +1,9 @@
 import { HttpException, HttpStatus, Injectable, NestMiddleware, Optional, UnauthorizedException } from '@nestjs/common';
 import { NextFunction, Request, Response } from 'express';
 
-import { ErrorCode } from '../error-code/error-codes';
-import { getApiTokenConfig, getApiTokenContext, readApiTokenCredentialFromHeaders } from './core-api-token.helpers';
-import { CoreApiTokenService } from './core-api-token.service';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { getApiTokenConfig, getApiTokenContext, readApiTokenCredentialFromHeaders } from './core-api-token.helpers.js';
+import { CoreApiTokenService } from './core-api-token.service.js';
 
 /**
  * Authenticates requests that carry an API token or a signed assertion — `Authorization: Bearer …` or

package/src/core/modules/api-token/core-api-token.model.ts

@@ -1,16 +1,16 @@
 import { ObjectType } from '@nestjs/graphql';
 import { Schema } from '@nestjs/mongoose';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { accessDeniedException } from '../../common/exceptions/access-denied.exception';
-import { CorePersistenceModel } from '../../common/models/core-persistence.model';
-import { ConfigService } from '../../common/services/config.service';
-import { RequestContext } from '../../common/services/request-context.service';
-import { checkRoleAccess } from '../tenant/core-tenant.helpers';
-import { ApiTokenKind } from './core-api-token.constants';
-import { getApiTokenContext, getApiTokenManageRole } from './core-api-token.helpers';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { accessDeniedException } from '../../common/exceptions/access-denied.exception.js';
+import { CorePersistenceModel } from '../../common/models/core-persistence.model.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { RequestContext } from '../../common/services/request-context.service.js';
+import { checkRoleAccess } from '../tenant/core-tenant.helpers.js';
+import { ApiTokenKind } from './core-api-token.constants.js';
+import { getApiTokenContext, getApiTokenManageRole } from './core-api-token.helpers.js';
 
 /**
  * API token (`apiTokens` config): a USER token or a TENANT token, see {@link ApiTokenKind}.

package/src/core/modules/api-token/core-api-token.module.ts

@@ -1,10 +1,10 @@
 import { DynamicModule, Global, MiddlewareConsumer, Module, NestModule, Type } from '@nestjs/common';
 import { MongooseModule, SchemaFactory } from '@nestjs/mongoose';
 
-import { API_TOKEN_MODEL_TOKEN } from './core-api-token.constants';
-import { CoreApiTokenMiddleware } from './core-api-token.middleware';
-import { CoreApiTokenModel } from './core-api-token.model';
-import { CoreApiTokenService } from './core-api-token.service';
+import { API_TOKEN_MODEL_TOKEN } from './core-api-token.constants.js';
+import { CoreApiTokenMiddleware } from './core-api-token.middleware.js';
+import { CoreApiTokenModel } from './core-api-token.model.js';
+import { CoreApiTokenService } from './core-api-token.service.js';
 
 /**
  * Options for `CoreApiTokenModule.forRoot()`.

package/src/core/modules/api-token/core-api-token.service.ts

@@ -12,16 +12,16 @@ import {
   UnauthorizedException,
 } from '@nestjs/common';
 import { InjectConnection, InjectModel } from '@nestjs/mongoose';
-import { Connection, Model, Types } from 'mongoose';
-
-import { RoleEnum } from '../../common/enums/role.enum';
-import { ConfigService } from '../../common/services/config.service';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../common/services/rate-limit-store';
-import { ErrorCode } from '../error-code/error-codes';
-import { checkRoleAccess, getRoleHierarchy, resolveGlobalAndTenantRoles } from '../tenant/core-tenant.helpers';
-import { CoreTenantService } from '../tenant/core-tenant.service';
-import { API_TOKEN_MODEL_TOKEN, ApiTokenKind } from './core-api-token.constants';
+import { type Connection, Model, Types } from 'mongoose';
+
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { InMemoryRateLimitStore, RateLimitStore, RedisRateLimitStore } from '../../common/services/rate-limit-store.js';
+import { ErrorCode } from '../error-code/error-codes.js';
+import { checkRoleAccess, getRoleHierarchy, resolveGlobalAndTenantRoles } from '../tenant/core-tenant.helpers.js';
+import { CoreTenantService } from '../tenant/core-tenant.service.js';
+import { API_TOKEN_MODEL_TOKEN, ApiTokenKind } from './core-api-token.constants.js';
 import {
   assertApiTokenConfigIsUsable,
   attachApiTokenContext,
@@ -41,9 +41,9 @@ import {
   resolveApiTokenEncryptionKey,
   safeEqualHex,
   verifyApiTokenAssertionSignature,
-} from './core-api-token.helpers';
-import { CoreApiTokenModel } from './core-api-token.model';
-import { ApiTokenOwnerIdentity, setApiTokenRevoker } from './core-api-token.registry';
+} from './core-api-token.helpers.js';
+import { CoreApiTokenModel } from './core-api-token.model.js';
+import { ApiTokenOwnerIdentity, setApiTokenRevoker } from './core-api-token.registry.js';
 
 /** Fields a caller can never set through a create/update input. */
 const PROTECTED_FIELDS = new Set([

package/src/core/modules/auth/core-auth.controller.ts

@@ -8,26 +8,26 @@ import {
   ApiQuery,
   ApiTooManyRequestsResponse,
 } from '@nestjs/swagger';
-import { Response as ResponseType } from 'express';
+import type { Response as ResponseType } from 'express';
 
-import { ApiCommonErrorResponses } from '../../common/decorators/common-error.decorator';
-import { CurrentUser } from '../../common/decorators/current-user.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper';
-import type { ICookiesConfig } from '../../common/interfaces/server-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { CoreAuthModel } from './core-auth.model';
-import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception';
-import { AuthGuard } from './guards/auth.guard';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
-import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input';
-import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input';
-import { ICoreAuthUser } from './interfaces/core-auth-user.interface';
-import { CoreAuthService } from './services/core-auth.service';
-import { Tokens } from './tokens.decorator';
+import { ApiCommonErrorResponses } from '../../common/decorators/common-error.decorator.js';
+import { CurrentUser } from '../../common/decorators/current-user.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper.js';
+import type { ICookiesConfig } from '../../common/interfaces/server-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { CoreAuthModel } from './core-auth.model.js';
+import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception.js';
+import { AuthGuard } from './guards/auth.guard.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
+import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input.js';
+import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input.js';
+import type { ICoreAuthUser } from './interfaces/core-auth-user.interface.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { Tokens } from './tokens.decorator.js';
 
 /**
  * Authentication controller for REST endpoints

package/src/core/modules/auth/core-auth.model.ts

@@ -1,10 +1,10 @@
 import { ObjectType } from '@nestjs/graphql';
 
-import { Restricted } from '../../common/decorators/restricted.decorator';
-import { UnifiedField } from '../../common/decorators/unified-field.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { CoreModel } from '../../common/models/core-model.model';
-import { CoreUserModel } from '../user/core-user.model';
+import { Restricted } from '../../common/decorators/restricted.decorator.js';
+import { UnifiedField } from '../../common/decorators/unified-field.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { CoreModel } from '../../common/models/core-model.model.js';
+import { CoreUserModel } from '../user/core-user.model.js';
 
 /**
  * CoreAuth model for the response after the sign in

package/src/core/modules/auth/core-auth.module.ts

@@ -4,18 +4,18 @@ import { JwtModule, JwtModuleOptions } from '@nestjs/jwt';
 import { PassportModule } from '@nestjs/passport';
 import { PubSub } from 'graphql-subscriptions';
 
-import { CoreRedisPubSub } from '../../common/services/core-redis-pubsub';
-import { CoreRedisService } from '../../common/services/core-redis.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { RolesGuardRegistry } from './guards/roles-guard-registry';
-import { RolesGuard } from './guards/roles.guard';
-import { CoreAuthUserService } from './services/core-auth-user.service';
-import { CoreAuthService } from './services/core-auth.service';
-import { CoreLegacyAuthDeprecationInitializer } from './core-legacy-auth-deprecation.initializer';
-import { LegacyAuthRateLimiter } from './services/legacy-auth-rate-limiter.service';
-import { JwtRefreshStrategy } from './strategies/jwt-refresh.strategy';
-import { JwtStrategy } from './strategies/jwt.strategy';
+import { CoreRedisPubSub } from '../../common/services/core-redis-pubsub.js';
+import { CoreRedisService } from '../../common/services/core-redis.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { RolesGuardRegistry } from './guards/roles-guard-registry.js';
+import { RolesGuard } from './guards/roles.guard.js';
+import { CoreAuthUserService } from './services/core-auth-user.service.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { CoreLegacyAuthDeprecationInitializer } from './core-legacy-auth-deprecation.initializer.js';
+import { LegacyAuthRateLimiter } from './services/legacy-auth-rate-limiter.service.js';
+import { JwtRefreshStrategy } from './strategies/jwt-refresh.strategy.js';
+import { JwtStrategy } from './strategies/jwt.strategy.js';
 
 /**
  * CoreAuthModule to handle user authentication and enables Roles

package/src/core/modules/auth/core-auth.resolver.ts

@@ -2,25 +2,25 @@ import { UseGuards } from '@nestjs/common';
 import { Args, Context, Mutation, Resolver } from '@nestjs/graphql';
 import { Response as ResponseType } from 'express';
 
-import { CurrentUser } from '../../common/decorators/current-user.decorator';
-import { GraphQLServiceOptions } from '../../common/decorators/graphql-service-options.decorator';
-import { Roles } from '../../common/decorators/roles.decorator';
-import { RoleEnum } from '../../common/enums/role.enum';
-import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper';
-import type { ICookiesConfig } from '../../common/interfaces/server-options.interface';
-import { ServiceOptions } from '../../common/interfaces/service-options.interface';
-import { ConfigService } from '../../common/services/config.service';
-import { AuthGuardStrategy } from './auth-guard-strategy.enum';
-import { CoreAuthModel } from './core-auth.model';
-import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception';
-import { AuthGuard } from './guards/auth.guard';
-import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
-import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input';
-import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input';
-import { ICoreAuthUser } from './interfaces/core-auth-user.interface';
-import { CoreAuthService } from './services/core-auth.service';
-import { Tokens } from './tokens.decorator';
+import { CurrentUser } from '../../common/decorators/current-user.decorator.js';
+import { GraphQLServiceOptions } from '../../common/decorators/graphql-service-options.decorator.js';
+import { Roles } from '../../common/decorators/roles.decorator.js';
+import { RoleEnum } from '../../common/enums/role.enum.js';
+import { setLegacyAuthCookies } from '../../common/helpers/cookies.helper.js';
+import type { ICookiesConfig } from '../../common/interfaces/server-options.interface.js';
+import type { ServiceOptions } from '../../common/interfaces/service-options.interface.js';
+import { ConfigService } from '../../common/services/config.service.js';
+import { AuthGuardStrategy } from './auth-guard-strategy.enum.js';
+import { CoreAuthModel } from './core-auth.model.js';
+import { LegacyAuthDisabledException } from './exceptions/legacy-auth-disabled.exception.js';
+import { AuthGuard } from './guards/auth.guard.js';
+import { LegacyAuthRateLimitGuard } from './guards/legacy-auth-rate-limit.guard.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
+import { CoreAuthSignInInput } from './inputs/core-auth-sign-in.input.js';
+import { CoreAuthSignUpInput } from './inputs/core-auth-sign-up.input.js';
+import type { ICoreAuthUser } from './interfaces/core-auth-user.interface.js';
+import { CoreAuthService } from './services/core-auth.service.js';
+import { Tokens } from './tokens.decorator.js';
 
 /**
  * Authentication resolver for the sign in

package/src/core/modules/auth/core-legacy-auth-deprecation.initializer.ts

@@ -1,8 +1,8 @@
 import { Injectable, Logger, OnApplicationBootstrap, Optional } from '@nestjs/common';
 
-import { ConfigService } from '../../common/services/config.service';
-import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper';
-import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
+import { ConfigService } from '../../common/services/config.service.js';
+import { CoreBetterAuthUserMapper } from '../better-auth/core-better-auth-user.mapper.js';
+import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper.js';
 
 /**
  * Says out loud, once at boot, that this deployment still exposes Legacy Auth.
@@ -25,6 +25,15 @@ import { isLegacyEndpointEnabled } from './helpers/legacy-endpoints.helper';
  * default — the migration has to be finished before the door closes, and only the
  * operator can know when that is.
  */
+/**
+ * Applications already reported on, keyed by their (application-wide, singleton) `ConfigService`.
+ *
+ * The classic legacy server module passes `AuthModule.forRoot()` to `CoreModule.forRoot()` AND imports
+ * `AuthModule.forRoot()` itself, which registers `CoreAuthModule` — and this initializer — twice. Without
+ * this, every warning appeared twice per boot and the collection-scale status read ran twice.
+ */
+const reportedApplications = new WeakSet<object>();
+
 @Injectable()
 export class CoreLegacyAuthDeprecationInitializer implements OnApplicationBootstrap {
   protected readonly logger = new Logger(CoreLegacyAuthDeprecationInitializer.name);
@@ -35,6 +44,11 @@ export class CoreLegacyAuthDeprecationInitializer implements OnApplicationBootst
   ) {}
 
   onApplicationBootstrap(): void {
+    if (reportedApplications.has(this.configService)) {
+      return;
+    }
+    reportedApplications.add(this.configService);
+
     const legacyConfig = this.configService.getFastButReadOnly('auth')?.legacyEndpoints;
     const graphqlOn = isLegacyEndpointEnabled(legacyConfig, 'graphql');
     const restOn = isLegacyEndpointEnabled(legacyConfig, 'rest');

package/src/core/modules/auth/guards/auth.guard.ts

@@ -2,18 +2,46 @@ import { CanActivate, ExecutionContext, Logger, mixin, Optional } from '@nestjs/
 import { ModuleRef } from '@nestjs/core';
 import { GqlExecutionContext } from '@nestjs/graphql';
 import { AuthModuleOptions, Type } from '@nestjs/passport';
-import { defaultOptions } from '@nestjs/passport/dist/options.js';
-import { memoize } from '@nestjs/passport/dist/utils/memoize.util.js';
-import passport = require('passport');
-
-import { enforceApiTokenRoute, getApiTokenContext } from '../../api-token/core-api-token.helpers';
-import { BetterAuthTokenService } from '../../better-auth/better-auth-token.service';
-import { BetterAuthenticatedUser } from '../../better-auth/better-auth.types';
-import { CoreBetterAuthService } from '../../better-auth/core-better-auth.service';
-import { AuthGuardStrategy } from '../auth-guard-strategy.enum';
-import { ExpiredRefreshTokenException } from '../exceptions/expired-refresh-token.exception';
-import { ExpiredTokenException } from '../exceptions/expired-token.exception';
-import { InvalidTokenException } from '../exceptions/invalid-token.exception';
+import passport from 'passport';
+
+import { enforceApiTokenRoute, getApiTokenContext } from '../../api-token/core-api-token.helpers.js';
+import { BetterAuthTokenService } from '../../better-auth/better-auth-token.service.js';
+import { BetterAuthenticatedUser } from '../../better-auth/better-auth.types.js';
+import { CoreBetterAuthService } from '../../better-auth/core-better-auth.service.js';
+import { AuthGuardStrategy } from '../auth-guard-strategy.enum.js';
+import { ExpiredRefreshTokenException } from '../exceptions/expired-refresh-token.exception.js';
+import { ExpiredTokenException } from '../exceptions/expired-token.exception.js';
+import { InvalidTokenException } from '../exceptions/invalid-token.exception.js';
+
+/**
+ * Passport defaults, as `@nestjs/passport` applies them in its own AuthGuard.
+ *
+ * Kept here rather than imported: until 11.x this file read them from `@nestjs/passport/dist/options.js`
+ * and `memoize` from `dist/utils/memoize.util.js`. `@nestjs/passport` 12 declares an `exports` map
+ * that only allows the package root, and neither helper is exported there, so the deep imports fail
+ * with ERR_PACKAGE_PATH_NOT_EXPORTED.
+ */
+const defaultOptions = {
+  property: 'user',
+  session: false,
+};
+
+/**
+ * One guard class per strategy key, so `AuthGuard('jwt')` returns the same class on every call —
+ * NestJS caches guard instances by class, and a fresh class per call would defeat that.
+ * Same behaviour as `@nestjs/passport`'s internal `memoize`.
+ */
+function memoize<T>(fn: (key?: string | string[]) => T): (key?: string | string[]) => T {
+  const defaultKey = 'default';
+  const cache: Record<string, T> = {};
+  return (...args) => {
+    const key = (args[0] as string) || defaultKey;
+    if (!(key in cache)) {
+      cache[key] = fn(key === defaultKey ? undefined : args[0]);
+    }
+    return cache[key];
+  };
+}
 
 /**
  * Missing strategy error

package/src/core/modules/auth/guards/legacy-auth-rate-limit.guard.ts

@@ -1,7 +1,7 @@
 import { CanActivate, ExecutionContext, HttpException, HttpStatus, Injectable } from '@nestjs/common';
 import { GqlExecutionContext } from '@nestjs/graphql';
 
-import { LegacyAuthRateLimiter } from '../services/legacy-auth-rate-limiter.service';
+import { LegacyAuthRateLimiter } from '../services/legacy-auth-rate-limiter.service.js';
 
 /**
  * Guard for rate limiting Legacy Auth endpoints