@lenne.tech/nest-server 11.43.3 → 12.0.0

package/package.json

@@ -1,6 +1,7 @@
 {
   "name": "@lenne.tech/nest-server",
-  "version": "11.43.3",
+  "version": "12.0.0",
+  "type": "module",
   "description": "Modern, fast, powerful Node.js web framework in TypeScript based on Nest with a GraphQL API and a connection to MongoDB (or other databases).",
   "keywords": [
     "node",
@@ -15,7 +16,7 @@
   "license": "MIT",
   "scripts": {
     "build": "rimraf dist && nest build && pnpm run build:copy-types && pnpm run build:copy-templates && pnpm run build:add-type-references && pnpm run build:framework-api",
-    "build:add-type-references": "node scripts/add-type-references.js",
+    "build:add-type-references": "node scripts/add-type-references.cjs",
     "build:copy-templates": "node scripts/copy-build-assets.mjs templates",
     "build:copy-types": "node scripts/copy-build-assets.mjs types",
     "build:dev": "pnpm run build",
@@ -25,22 +26,23 @@
     "cf": "pnpm run check:fix",
     "check": "node scripts/check.mjs",
     "check:consumer": "node scripts/check-consumer.mjs",
-    "check:fix": "pnpm install && pnpm run spectaql:sync && pnpm audit --fix && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:esm": "node scripts/check-esm-core.mjs",
+    "check:fix": "pnpm install && pnpm run spectaql:sync && pnpm audit --fix && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
     "check:manifest": "node scripts/check-package-manifest.mjs",
     "check:mutations": "node scripts/check-mutations.mjs",
-    "check:naf": "pnpm install && pnpm run spectaql:sync && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:naf": "pnpm install && pnpm run spectaql:sync && pnpm run check:overrides && pnpm peers check && pnpm run format && pnpm run lint:fix && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
     "check:overrides": "node scripts/check-overrides.mjs",
-    "check:raw": "pnpm install --frozen-lockfile && pnpm run spectaql:sync && pnpm audit && pnpm run check:overrides && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run typecheck:tests && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
+    "check:raw": "pnpm install --frozen-lockfile && pnpm run spectaql:sync && pnpm audit && pnpm run check:overrides && pnpm peers check && pnpm run format:check && pnpm run lint && pnpm run typecheck:tests && pnpm run typecheck:vendor && pnpm run check:esm && pnpm run check:swc-tdz && pnpm test && pnpm run build && pnpm run check:manifest && pnpm run check:server-start",
     "check:server-start": "cross-env NODE_ENV=local node scripts/check-server-start.mjs --entry=dist/main.js --port-env=NSC__PORT --ready=\"Server starte[dt] at\" --path=/",
     "check:swc-tdz": "nest build -b swc -p tsconfig.swc-tdz.json && node scripts/check-swc-tdz.mjs",
     "cnaf": "pnpm run check:naf",
     "docs": "pnpm run docs:ci && node scripts/open.mjs http://127.0.0.1:8080/ ./public/index.html && compodoc -p tsconfig.json -s",
     "docs:bootstrap": "node extras/update-spectaql-version.mjs && node scripts/run-spectaql.mjs",
-    "docs:ci": "ts-node ./scripts/init-server.ts && pnpm run docs:bootstrap && compodoc -p tsconfig.json",
+    "docs:ci": "node -r ./src/core/modules/migrate/helpers/ts-compiler.js ./scripts/init-server.ts && pnpm run docs:bootstrap && compodoc -p tsconfig.json",
     "format": "oxfmt --write src/ scripts/",
     "format:check": "oxfmt --check src/ scripts/",
-    "lint": "oxlint --ignore-path .oxlintignore src/ tests/ scripts/",
-    "lint:fix": "oxlint --fix --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint": "oxlint --type-aware --ignore-path .oxlintignore src/ tests/ scripts/",
+    "lint:fix": "oxlint --type-aware --fix --ignore-path .oxlintignore src/ tests/ scripts/",
     "prepack": "pnpm run prestart:prod",
     "prepublishOnly": "pnpm run lint && pnpm run test:ci",
     "prestart:prod": "pnpm run build",
@@ -55,7 +57,6 @@
     "start:dev:swc": "nest start -b swc -w --type-check",
     "start:local": "cross-env NODE_ENV=local nodemon",
     "start:local:swc": "cross-env NODE_ENV=local nest start -b swc -w --type-check",
-    "start:nodemon": "ts-node -r tsconfig-paths/register src/main.ts",
     "start:prod": "cross-env NODE_ENV=production node dist/main.js",
     "test": "pnpm run vitest:unit && pnpm run vitest",
     "test:ci": "pnpm run vitest:unit && pnpm run vitest:ci",
@@ -66,15 +67,16 @@
     "test:infra:down": "node scripts/test-infra.mjs down",
     "test:infra:status": "node scripts/test-infra.mjs status",
     "test:types": "tsc --noEmit --skipLibCheck -p tests/types/tsconfig.json",
-    "test:unit:watch": "vitest --config vitest.config.ts",
+    "test:unit:watch": "vitest --config vitest.config.mts",
     "typecheck:tests": "tsc --noEmit -p tsconfig.tests.json",
-    "vitest": "cross-env NODE_ENV=e2e vitest run --config vitest-e2e.config.ts",
-    "vitest:ci": "cross-env NODE_ENV=ci vitest run --config vitest-e2e.config.ts",
-    "vitest:cov": "cross-env NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.ts",
-    "vitest:unit": "vitest run --config vitest.config.ts",
-    "vitest:unit:cov": "vitest run --coverage --config vitest.config.ts",
-    "vitest:watch": "cross-env NODE_ENV=e2e vitest --config vitest-e2e.config.ts",
-    "watch": "npm-watch"
+    "typecheck:vendor": "node scripts/check-vendor-declarations.mjs",
+    "vitest": "cross-env NODE_ENV=e2e vitest run --config vitest-e2e.config.mts",
+    "vitest:ci": "cross-env NODE_ENV=ci vitest run --config vitest-e2e.config.mts",
+    "vitest:cov": "cross-env NODE_ENV=e2e vitest run --coverage --config vitest-e2e.config.mts",
+    "vitest:unit": "vitest run --config vitest.config.mts",
+    "vitest:unit:cov": "vitest run --coverage --config vitest.config.mts",
+    "vitest:watch": "cross-env NODE_ENV=e2e vitest --config vitest-e2e.config.mts",
+    "watch": "nodemon --watch src --ext ts,ejs,json --exec \"pnpm run build:dev\""
   },
   "repository": {
     "type": "git",
@@ -92,18 +94,18 @@
     "@apollo/server": "5.5.1",
     "@as-integrations/express5": "1.1.2",
     "@getbrevo/brevo": "6.2.0",
-    "@modelcontextprotocol/sdk": "1.32.1",
-    "@nestjs/apollo": "13.4.5",
-    "@nestjs/common": "11.2.7",
-    "@nestjs/core": "11.2.7",
-    "@nestjs/graphql": "13.4.5",
-    "@nestjs/jwt": "11.0.2",
-    "@nestjs/mongoose": "11.0.4",
-    "@nestjs/passport": "11.0.5",
-    "@nestjs/platform-express": "11.2.7",
-    "@nestjs/schedule": "6.1.3",
-    "@nestjs/swagger": "11.4.7",
-    "@nestjs/terminus": "11.1.1",
+    "@modelcontextprotocol/sdk": "1.32.2",
+    "@nestjs/apollo": "14.0.3",
+    "@nestjs/common": "12.2.0",
+    "@nestjs/core": "12.2.0",
+    "@nestjs/graphql": "14.0.3",
+    "@nestjs/jwt": "12.0.3",
+    "@nestjs/mongoose": "12.0.0",
+    "@nestjs/passport": "12.0.0",
+    "@nestjs/platform-express": "12.2.0",
+    "@nestjs/schedule": "12.0.2",
+    "@nestjs/swagger": "12.0.4",
+    "@nestjs/terminus": "12.1.0",
     "@tus/file-store": "2.1.1",
     "@tus/server": "2.4.6",
     "@types/supertest": "7.2.1",
@@ -113,23 +115,23 @@
     "compression": "1.8.2",
     "cookie-parser": "1.4.7",
     "cron": "4.4.0",
-    "dotenv": "17.4.2",
-    "ejs": "6.0.1",
-    "express": "5.2.1",
+    "dotenv": "18.0.9",
+    "ejs": "7.0.2",
+    "express": "5.3.0",
     "graphql": "16.14.2",
     "graphql-query-complexity": "2.0.0",
     "graphql-subscriptions": "3.0.0",
     "graphql-upload": "15.0.2",
-    "graphql-ws": "6.2.1",
-    "jose": "6.2.12",
+    "graphql-ws": "6.3.0",
+    "jose": "6.2.13",
     "js-sha256": "1.0.0",
     "json-to-graphql-query": "2.3.0",
     "lodash": "4.18.1",
     "mongodb": "7.7.0",
-    "mongoose": "9.11.2",
-    "multer": "2.4.0",
+    "mongoose": "9.11.4",
+    "multer": "2.5.0",
     "node-mailjet": "6.0.11",
-    "nodemailer": "10.1.2",
+    "nodemailer": "10.2.1",
     "passport": "0.7.0",
     "passport-jwt": "4.0.1",
     "reflect-metadata": "0.2.2",
@@ -138,17 +140,18 @@
     "supertest": "7.3.1",
     "ts-morph": "28.0.0",
     "undici": "7.30.1",
-    "ws": "8.21.3",
+    "ws": "8.22.0",
     "yuml-diagram": "1.2.0"
   },
   "peerDependencies": {
     "@aws-sdk/client-s3": ">=3.1045.0 <4",
     "@aws-sdk/lib-storage": ">=3.1045.0 <4",
     "@aws-sdk/s3-request-presigner": ">=3.1045.0 <4",
-    "@better-auth/core": ">=1.7.7 <1.8.0",
-    "@better-auth/passkey": ">=1.7.7 <1.8.0",
+    "@better-auth/core": ">=1.7.12 <1.8.0",
+    "@better-auth/passkey": ">=1.7.12 <1.8.0",
+    "@swc/core": ">=1.10.0 <2",
     "@tus/s3-store": ">=2.0.5 <3",
-    "better-auth": ">=1.7.7 <1.8.0",
+    "better-auth": ">=1.7.12 <1.8.0",
     "bullmq": ">=5.16.0 <7",
     "ioredis": ">=5.0.0 <7"
   },
@@ -168,6 +171,9 @@
     "@better-auth/passkey": {
       "optional": false
     },
+    "@swc/core": {
+      "optional": true
+    },
     "@tus/s3-store": {
       "optional": true
     },
@@ -182,47 +188,44 @@
     }
   },
   "devDependencies": {
-    "@aws-sdk/client-s3": "3.1152.0",
-    "@aws-sdk/lib-storage": "3.1152.0",
-    "@aws-sdk/s3-request-presigner": "3.1152.0",
-    "@better-auth/core": "1.7.7",
-    "@better-auth/passkey": "1.7.7",
+    "@aws-sdk/client-s3": "3.1156.0",
+    "@aws-sdk/lib-storage": "3.1156.0",
+    "@aws-sdk/s3-request-presigner": "3.1156.0",
+    "@better-auth/core": "1.7.13",
+    "@better-auth/passkey": "1.7.13",
     "@compodoc/compodoc": "2.0.0",
-    "@nestjs/cli": "11.0.24",
-    "@nestjs/schematics": "11.1.0",
-    "@nestjs/testing": "11.2.7",
+    "@nestjs/cli": "12.0.10",
+    "@nestjs/schematics": "12.0.10",
+    "@nestjs/testing": "12.2.0",
     "@swc/cli": "0.8.1",
-    "@swc/core": "1.16.18",
-    "@tus/s3-store": "2.0.8",
+    "@swc/core": "1.16.20",
+    "@tus/s3-store": "2.0.9",
     "@types/compression": "1.8.1",
     "@types/cookie-parser": "1.4.10",
     "@types/ejs": "3.1.5",
     "@types/express": "5.0.6",
-    "@types/lodash": "4.17.26",
+    "@types/lodash": "4.17.27",
     "@types/multer": "2.3.0",
     "@types/node": "26.6.5",
     "@types/passport": "1.0.17",
-    "@vitest/coverage-v8": "4.1.12",
-    "better-auth": "1.7.7",
-    "bullmq": "6.3.16",
+    "@vitest/coverage-v8": "5.0.5",
+    "better-auth": "1.7.13",
+    "bullmq": "6.4.2",
     "cross-env": "10.1.0",
     "ioredis": "6.0.0",
     "nodemon": "3.1.14",
-    "npm-watch": "0.13.0",
     "otpauth": "9.5.2",
-    "oxfmt": "0.73.0",
-    "oxlint": "1.88.0",
+    "oxfmt": "0.74.0",
+    "oxlint": "1.89.0",
+    "oxlint-tsgolint": "7.0.2005",
     "rimraf": "6.1.3",
-    "smtp-server": "3.19.23",
-    "ts-node": "10.9.2",
-    "tsconfig-paths": "4.2.0",
+    "smtp-server": "3.21.1",
     "tsx": "4.23.15",
     "tus-js-client": "4.3.1",
-    "typescript": "5.9.3",
+    "typescript": "6.0.3",
     "unplugin-swc": "2.0.0",
     "vite": "8.3.4",
-    "vite-plugin-node": "8.0.0",
-    "vitest": "4.1.12"
+    "vitest": "5.0.5"
   },
   "main": "dist/index.js",
   "types": "dist/index.d.ts",
@@ -239,8 +242,5 @@
     ".claude/rules/**/*",
     "docs/**/*",
     "migration-guides/**/*"
-  ],
-  "watch": {
-    "build:dev": "src"
-  }
+  ]
 }

package/src/config.env.ts

@@ -2,9 +2,9 @@ import { CronExpression } from '@nestjs/schedule';
 import * as dotenv from 'dotenv';
 import { join } from 'path';
 
-import { RoleEnum } from './core/common/enums/role.enum';
-import { getEnvironmentConfig, resolveSmtpSecure } from './core/common/helpers/config.helper';
-import { IServerOptions } from './core/common/interfaces/server-options.interface';
+import { RoleEnum } from './core/common/enums/role.enum.js';
+import { getEnvironmentConfig, resolveSmtpSecure } from './core/common/helpers/config.helper.js';
+import { IServerOptions } from './core/common/interfaces/server-options.interface.js';
 
 /**
  * Configuration for the different environments
@@ -80,9 +80,11 @@ const config: { [env: string]: IServerOptions } = {
     cookies: { exposeTokenInBody: true },
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -106,10 +108,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'ci',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // File access — the COARSE gate on the two inherited download routes
     // (`GET /files/id/:id`, `GET /files/:filename`), which `FileController` inherits
@@ -174,7 +172,8 @@ const config: { [env: string]: IServerOptions } = {
         expiresIn: '15m',
       },
     },
-    loadLocalConfig: true,
+    // Off for test runs: a developer's local config.json must not change what the suite tests.
+    loadLocalConfig: false,
     logExceptions: true,
     mongoose: {
       collation: {
@@ -204,11 +203,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -334,11 +333,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -389,9 +388,11 @@ const config: { [env: string]: IServerOptions } = {
     cookies: { exposeTokenInBody: true },
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -415,10 +416,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'e2e',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // Coarse download gate widened to any signed-in user; the per-file rule lives in
     // `FileService.checkRights()`. Full rationale in the `ci` block above.
@@ -456,7 +453,8 @@ const config: { [env: string]: IServerOptions } = {
         expiresIn: '15m',
       },
     },
-    loadLocalConfig: true,
+    // Off for test runs: a developer's local config.json must not change what the suite tests.
+    loadLocalConfig: false,
     logExceptions: true,
     mongoose: {
       collation: {
@@ -486,11 +484,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -538,6 +536,12 @@ const config: { [env: string]: IServerOptions } = {
       legacyEndpoints: { enabled: true },
     },
     automaticObjectIdFiltering: true,
+    // Explicit, so Better-Auth does not warn about running on a fallback secret at every boot. The default
+    // is the value it used as that fallback until now (the local refresh-token secret below — the JWT secret
+    // is too short), so `jwks` keys already persisted in a local database stay readable.
+    betterAuth: {
+      secret: process.env.BETTER_AUTH_SECRET || process.env.JWT_REFRESH_SECRET || 'SECRET_OR_PRIVATE_KEY_LOCAL_REFRESH',
+    },
     // Brevo transactional API — optional overlay for template-based emails.
     // Activated only when BREVO_API_KEY is set; otherwise SMTP handles everything.
     ...(process.env.BREVO_API_KEY
@@ -554,9 +558,11 @@ const config: { [env: string]: IServerOptions } = {
     compression: true,
     cors: { allowAll: true },
     cronJobs: {
+      // Sample job (src/server/common/services/cron-jobs.service.ts). Off like in the starter: enabled it
+      // fires every 10 s, and a test app or a nodemon restart then waits for a running tick on shutdown.
       sayHello: {
         cronTime: CronExpression.EVERY_10_SECONDS,
-        disabled: false,
+        disabled: true,
         runOnInit: false,
         runParallel: 1,
         throwException: false,
@@ -580,10 +586,6 @@ const config: { [env: string]: IServerOptions } = {
       },
     },
     env: 'local',
-    // Disable auto-registration to allow Server ErrorCodeModule with SRV_* codes
-    errorCode: {
-      autoRegister: false,
-    },
     execAfterInit: 'pnpm run docs:bootstrap',
     // Coarse download gate widened to any signed-in user; the per-file rule lives in
     // `FileService.checkRights()`. Full rationale in the `ci` block above.
@@ -654,11 +656,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 
@@ -810,11 +812,11 @@ const config: { [env: string]: IServerOptions } = {
     sha256: true,
     staticAssets: {
       options: { prefix: '' },
-      path: join(__dirname, '..', 'public'),
+      path: join(import.meta.dirname, '..', 'public'),
     },
     templates: {
       engine: 'ejs',
-      path: join(__dirname, 'templates'),
+      path: join(import.meta.dirname, 'templates'),
     },
   },
 };

package/src/core/common/args/filter.args.ts

@@ -1,8 +1,8 @@
 import { ArgsType } from '@nestjs/graphql';
 
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { FilterInput } from '../inputs/filter.input';
-import { PaginationArgs } from './pagination.args';
+import { UnifiedField } from '../decorators/unified-field.decorator.js';
+import { FilterInput } from '../inputs/filter.input.js';
+import { PaginationArgs } from './pagination.args.js';
 
 @ArgsType()
 export class FilterArgs extends PaginationArgs {

package/src/core/common/args/pagination.args.ts

@@ -1,9 +1,9 @@
 import { ArgsType, Int } from '@nestjs/graphql';
 
-import { UnifiedField } from '../decorators/unified-field.decorator';
-import { maps } from '../helpers/model.helper';
-import { CoreInput } from '../inputs/core-input.input';
-import { SortInput } from '../inputs/sort.input';
+import { UnifiedField } from '../decorators/unified-field.decorator.js';
+import { maps } from '../helpers/model.helper.js';
+import { CoreInput } from '../inputs/core-input.input.js';
+import { SortInput } from '../inputs/sort.input.js';
 
 @ArgsType()
 export class PaginationArgs extends CoreInput {

package/src/core/common/decorators/current-user.decorator.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator } from '@nestjs/common';
 
-import { currentUserDec } from '../helpers/decorator.helper';
+import { currentUserDec } from '../helpers/decorator.helper.js';
 
 /**
  * Decorator to get current user for Controller (http context) and Resolver (graphql context)

package/src/core/common/decorators/graphql-populate.decorator.ts

@@ -1,6 +1,6 @@
 import { createParamDecorator } from '@nestjs/common';
 
-import { graphqlPopulateDec } from '../helpers/decorator.helper';
+import { graphqlPopulateDec } from '../helpers/decorator.helper.js';
 
 /**
  * Get Mongoose populate configuration for result type of GraphQL request

package/src/core/common/decorators/graphql-service-options.decorator.ts

@@ -1,8 +1,8 @@
 import { createParamDecorator, ExecutionContext } from '@nestjs/common';
 import { GqlExecutionContext } from '@nestjs/graphql';
 
-import { currentUserDec, graphqlPopulateDec } from '../helpers/decorator.helper';
-import { ServiceOptions } from '../interfaces/service-options.interface';
+import { currentUserDec, graphqlPopulateDec } from '../helpers/decorator.helper.js';
+import { ServiceOptions } from '../interfaces/service-options.interface.js';
 
 /**
  * Get standard ServiceOptions for GraphQL-Requests

package/src/core/common/decorators/response-model.decorator.ts

@@ -1,6 +1,6 @@
 import { SetMetadata } from '@nestjs/common';
 
-import { CoreModel } from '../models/core-model.model';
+import { CoreModel } from '../models/core-model.model.js';
 
 /**
  * Metadata key used to store the explicit response model class on a handler.

package/src/core/common/decorators/rest-service-options.decorator.ts

@@ -1,7 +1,7 @@
 import { createParamDecorator, ExecutionContext } from '@nestjs/common';
 
-import { currentUserDec } from '../helpers/decorator.helper';
-import { ServiceOptions } from '../interfaces/service-options.interface';
+import { currentUserDec } from '../helpers/decorator.helper.js';
+import { ServiceOptions } from '../interfaces/service-options.interface.js';
 
 /**
  * Get standard ServiceOptions for REST-Requests

package/src/core/common/decorators/restricted.decorator.ts

@@ -23,36 +23,36 @@
  */
 import 'reflect-metadata';
 import { Logger } from '@nestjs/common';
-import _ = require('lodash');
+import _ from 'lodash';
 
-import { ProcessType } from '../enums/process-type.enum';
+import { ProcessType } from '../enums/process-type.enum.js';
 // isSystemRole comes from the role.enum LEAF (import-free), not from core-tenant.helpers, so this
 // adds no new import edge to a file whose TDZ-immunity is a deliberate safety property.
-import { isSystemRole, RoleEnum } from '../enums/role.enum';
-import { accessDeniedException } from '../exceptions/access-denied.exception';
+import { isSystemRole, RoleEnum } from '../enums/role.enum.js';
+import { accessDeniedException } from '../exceptions/access-denied.exception.js';
 // From the import-free LEAF, never from unified-field.decorator: that file imports THIS one for
 // `@Restricted`, so reading the map from there would put this file back on an import cycle.
-import { resolveNestedType } from './nested-type.registry';
+import { resolveNestedType } from './nested-type.registry.js';
 // From an import-free LEAF: the marker is read here and in both interceptors, and this file's
 // position on zero import cycles is a defended property.
 import {
   hasRestrictionsCheckedMarker,
   hasUnrecognizedRestrictionsFlag,
   RESTRICTIONS_CHECKED_KEY,
-} from './restrictions-checked.marker';
+} from './restrictions-checked.marker.js';
 // Import from the id.helper LEAF, never from db.helper: db.helper imports input.helper, which
 // imports this file back — that cycle is what the extraction removed. See id.helper's docblock.
-import { equalIds, getIncludedIds } from '../helpers/id.helper';
-import { RequestContext } from '../services/request-context.service';
-import { RequireAtLeastOne } from '../types/required-at-least-one.type';
-import { checkRoleAccess, resolveGlobalAndTenantRoles } from '../../modules/tenant/core-tenant.helpers';
+import { equalIds, getIncludedIds } from '../helpers/id.helper.js';
+import { RequestContext } from '../services/request-context.service.js';
+import { RequireAtLeastOne } from '../types/required-at-least-one.type.js';
+import { checkRoleAccess, resolveGlobalAndTenantRoles } from '../../modules/tenant/core-tenant.helpers.js';
 
 export {
   hasRestrictionsCheckedMarker,
   hasUnrecognizedRestrictionsFlag,
   markRestrictionsChecked,
   RESTRICTIONS_CHECKED_KEY,
-} from './restrictions-checked.marker';
+} from './restrictions-checked.marker.js';
 
 /**
  * Restricted meta key

package/src/core/common/decorators/unified-field.decorator.ts

@@ -1,8 +1,6 @@
-import { Field, FieldOptions, HideField } from '@nestjs/graphql';
-import { TypeMetadataStorage } from '@nestjs/graphql/dist/schema-builder/storages/type-metadata.storage.js';
+import { Field, FieldOptions, HideField, TypeMetadataStorage } from '@nestjs/graphql';
 import { Prop, PropOptions } from '@nestjs/mongoose';
 import { ApiHideProperty, ApiProperty, ApiPropertyOptions } from '@nestjs/swagger';
-import type { EnumAllowedTypes } from '@nestjs/swagger/dist/interfaces/schema-object-metadata.interface.js';
 import { Type } from 'class-transformer';
 import {
   IsArray,
@@ -21,13 +19,20 @@ import {
 } from 'class-validator';
 import { GraphQLScalarType, isEnumType } from 'graphql';
 
-import { RoleEnum } from '../enums/role.enum';
+import { RoleEnum } from '../enums/role.enum.js';
 // Re-exported below so no import path broke. The map moved into an import-free leaf because
 // `restricted.decorator` — which this file imports — now READS it; see that leaf's docblock.
-import { nestedTypeRegistry } from './nested-type.registry';
-import { Restricted, RestrictedType } from './restricted.decorator';
+import { nestedTypeRegistry } from './nested-type.registry.js';
+import { Restricted, RestrictedType } from './restricted.decorator.js';
 
-export { nestedTypeRegistry, resolveNestedType } from './nested-type.registry';
+/**
+ * The value shapes `@ApiProperty({ enum })` accepts. Derived from the public `ApiPropertyOptions`
+ * because `@nestjs/swagger` 12 declares an `exports` map that no longer lets the type be imported
+ * from `dist/interfaces/schema-object-metadata.interface.js`, where it is defined.
+ */
+type EnumAllowedTypes = NonNullable<ApiPropertyOptions['enum']>;
+
+export { nestedTypeRegistry, resolveNestedType } from './nested-type.registry.js';
 
 /**
  * Registry to map enum objects to their names.

package/src/core/common/exceptions/access-denied.exception.ts

@@ -1,6 +1,6 @@
 import { ForbiddenException, UnauthorizedException } from '@nestjs/common';
 
-import { ErrorCode } from '../../modules/error-code/error-codes';
+import { ErrorCode } from '../../modules/error-code/error-codes.js';
 
 /**
  * Creates the access error that matches the requester's auth state (RFC 9110, mirrors RolesGuard):

package/src/core/common/filters/http-exception-log.filter.ts

@@ -1,7 +1,21 @@
-import { ArgumentsHost, Catch, ExceptionFilter, HttpException, ServiceUnavailableException } from '@nestjs/common';
+import {
+  ArgumentsHost,
+  Catch,
+  ExceptionFilter,
+  HttpException,
+  Logger,
+  ServiceUnavailableException,
+} from '@nestjs/common';
 import { GqlContextType } from '@nestjs/graphql';
 import { Response } from 'express';
 
+/**
+ * Nest's logger rather than `console.debug` (12.0.0): the stack carries the filter as its context, honours the
+ * application's log levels and JSON mode, and stays out of test output where those levels are narrowed. Module
+ * level, not a class member, so a project subclass that declares its own `logger` keeps compiling.
+ */
+const exceptionLogger = new Logger('HttpExceptionLogFilter');
+
 @Catch(HttpException)
 export class HttpExceptionLogFilter implements ExceptionFilter {
   /**
@@ -9,7 +23,7 @@ export class HttpExceptionLogFilter implements ExceptionFilter {
    */
   catch(exception: HttpException, host: ArgumentsHost) {
     // Log
-    console.debug(exception.stack);
+    exceptionLogger.debug(exception.stack);
 
     // GraphQL
     const type = host.getType<GqlContextType>();