@lenne.tech/nest-server 11.43.3 → 12.1.0

package/dist/core.module.js

@@ -1,4 +1,3 @@
-"use strict";
 var __decorate = (this && this.__decorate) || function (decorators, target, key, desc) {
     var c = arguments.length, r = c < 3 ? target : desc === null ? desc = Object.getOwnPropertyDescriptor(target, key) : desc, d;
     if (typeof Reflect === "object" && typeof Reflect.decorate === "function") r = Reflect.decorate(decorators, target, key, desc);
@@ -6,65 +5,70 @@ var __decorate = (this && this.__decorate) || function (decorators, target, key,
     return c > 3 && r && Object.defineProperty(target, key, r), r;
 };
 var CoreModule_1;
-Object.defineProperty(exports, "__esModule", { value: true });
-exports.CoreModule = void 0;
-const apollo_1 = require("@nestjs/apollo");
-const common_1 = require("@nestjs/common");
-const core_1 = require("@nestjs/core");
-const graphql_1 = require("@nestjs/graphql");
-const mongoose_1 = require("@nestjs/mongoose");
-const graphqlUploadExpress = require("graphql-upload/graphqlUploadExpress.js");
-const mongoose_2 = require("mongoose");
-const mongoose_cast_error_filter_1 = require("./core/common/filters/mongoose-cast-error.filter");
-const config_helper_1 = require("./core/common/helpers/config.helper");
-const graphql_ws_connection_helper_1 = require("./core/common/helpers/graphql-ws-connection.helper");
-const graphql_ws_context_helper_1 = require("./core/common/helpers/graphql-ws-context.helper");
-const check_response_interceptor_1 = require("./core/common/interceptors/check-response.interceptor");
-const check_security_interceptor_1 = require("./core/common/interceptors/check-security.interceptor");
-const response_model_interceptor_1 = require("./core/common/interceptors/response-model.interceptor");
-const translate_response_interceptor_1 = require("./core/common/interceptors/translate-response.interceptor");
-const cookies_helper_1 = require("./core/common/helpers/cookies.helper");
-const request_context_middleware_1 = require("./core/common/middleware/request-context.middleware");
-const security_headers_middleware_1 = require("./core/common/middlewares/security-headers.middleware");
-const map_and_validate_pipe_1 = require("./core/common/pipes/map-and-validate.pipe");
-const complexity_plugin_1 = require("./core/common/plugins/complexity.plugin");
-const mongoose_id_plugin_1 = require("./core/common/plugins/mongoose-id.plugin");
-const mongoose_audit_fields_plugin_1 = require("./core/common/plugins/mongoose-audit-fields.plugin");
-const mongoose_password_plugin_1 = require("./core/common/plugins/mongoose-password.plugin");
-const mongoose_role_guard_plugin_1 = require("./core/common/plugins/mongoose-role-guard.plugin");
-const mongoose_system_role_plugin_1 = require("./core/common/plugins/mongoose-system-role.plugin");
-const mongoose_tenant_plugin_1 = require("./core/common/plugins/mongoose-tenant.plugin");
-const config_service_1 = require("./core/common/services/config.service");
-const core_body_parser_initializer_1 = require("./core/common/services/core-body-parser.initializer");
-const core_cron_jobs_initializer_1 = require("./core/common/services/core-cron-jobs.initializer");
-const core_redis_service_1 = require("./core/common/services/core-redis.service");
-const core_s3_service_1 = require("./core/common/services/core-s3.service");
-const core_trust_proxy_initializer_1 = require("./core/common/services/core-trust-proxy.initializer");
-const email_service_1 = require("./core/common/services/email.service");
-const mailjet_service_1 = require("./core/common/services/mailjet.service");
-const model_doc_service_1 = require("./core/common/services/model-doc.service");
-const template_service_1 = require("./core/common/services/template.service");
-const core_ai_module_1 = require("./core/modules/ai/core-ai.module");
-const core_better_auth_token_helper_1 = require("./core/modules/better-auth/core-better-auth-token.helper");
-const core_better_auth_user_mapper_1 = require("./core/modules/better-auth/core-better-auth-user.mapper");
-const core_better_auth_module_1 = require("./core/modules/better-auth/core-better-auth.module");
-const core_better_auth_service_1 = require("./core/modules/better-auth/core-better-auth.service");
-const error_code_module_1 = require("./core/modules/error-code/error-code.module");
-const core_file_access_audit_initializer_1 = require("./core/modules/file/core-file-access-audit.initializer");
-const file_roles_helper_1 = require("./core/modules/file/file-roles.helper");
-const core_health_check_module_1 = require("./core/modules/health-check/core-health-check.module");
-const core_hub_module_1 = require("./core/modules/hub/core-hub.module");
-const hub_config_helper_1 = require("./core/modules/hub/hub-config.helper");
-const core_permissions_module_1 = require("./core/modules/permissions/core-permissions.module");
-const core_system_setup_module_1 = require("./core/modules/system-setup/core-system-setup.module");
-const core_api_token_module_1 = require("./core/modules/api-token/core-api-token.module");
-const core_tenant_module_1 = require("./core/modules/tenant/core-tenant.module");
+import { ApolloDriver } from '@nestjs/apollo';
+import { Global, Logger, Module, UnauthorizedException, } from '@nestjs/common';
+import { APP_FILTER, APP_INTERCEPTOR, APP_PIPE, DiscoveryModule } from '@nestjs/core';
+import { GraphQLModule } from '@nestjs/graphql';
+import graphqlUploadExpress from 'graphql-upload/graphqlUploadExpress.mjs';
+import { MongooseCastErrorFilter } from './core/common/filters/mongoose-cast-error.filter.js';
+import { merge } from './core/common/helpers/config.helper.js';
+import { refuseWsHandshake, registerWsConnection } from './core/common/helpers/graphql-ws-connection.helper.js';
+import { buildRequestContextAwareExecute, buildRequestContextAwareSubscribe, } from './core/common/helpers/graphql-ws-context.helper.js';
+import { CheckResponseInterceptor } from './core/common/interceptors/check-response.interceptor.js';
+import { CheckSecurityInterceptor } from './core/common/interceptors/check-security.interceptor.js';
+import { ResponseModelInterceptor } from './core/common/interceptors/response-model.interceptor.js';
+import { TranslateResponseInterceptor } from './core/common/interceptors/translate-response.interceptor.js';
+import { assertCookiesProductionSafe, buildCorsConfig, isCookiesEnabled, isCorsDisabled, isExposeTokenInBodyEnabled, } from './core/common/helpers/cookies.helper.js';
+import { RequestContextMiddleware } from './core/common/middleware/request-context.middleware.js';
+import { SecurityHeadersMiddleware } from './core/common/middlewares/security-headers.middleware.js';
+import { CorePersistenceLifecycle } from './core/common/persistence/core-persistence.lifecycle.js';
+import { CorePersistenceModule } from './core/common/persistence/core-persistence.module.js';
+import { assertDataSourcesSupported, DataSourceConfigError, hasSqlSource, usesMongoDb, resolveDataSources, } from './core/common/persistence/data-source.config.js';
+import { DataSourceRuntime } from './core/common/persistence/data-source.runtime.js';
+import { requireMongoPackages } from './core/common/persistence/mongo/mongo-packages.js';
+import { NoMongoConnectionModule } from './core/common/persistence/mongo/no-mongo-connection.module.js';
+import { setPersistenceRuntime } from './core/common/persistence/persistence-runtime.registry.js';
+import { MapAndValidatePipe } from './core/common/pipes/map-and-validate.pipe.js';
+import { ComplexityPlugin } from './core/common/plugins/complexity.plugin.js';
+import { mongooseIdPlugin } from './core/common/plugins/mongoose-id.plugin.js';
+import { mongooseAuditFieldsPlugin } from './core/common/plugins/mongoose-audit-fields.plugin.js';
+import { mongoosePasswordPlugin } from './core/common/plugins/mongoose-password.plugin.js';
+import { mongooseRoleGuardPlugin } from './core/common/plugins/mongoose-role-guard.plugin.js';
+import { mongooseSystemRolePlugin } from './core/common/plugins/mongoose-system-role.plugin.js';
+import { mongooseTenantPlugin } from './core/common/plugins/mongoose-tenant.plugin.js';
+import { ConfigService } from './core/common/services/config.service.js';
+import { CoreBodyParserInitializer } from './core/common/services/core-body-parser.initializer.js';
+import { CoreCronJobsInitializer } from './core/common/services/core-cron-jobs.initializer.js';
+import { CoreRedisService } from './core/common/services/core-redis.service.js';
+import { CoreS3Service } from './core/common/services/core-s3.service.js';
+import { CoreTrustProxyInitializer } from './core/common/services/core-trust-proxy.initializer.js';
+import { EmailService } from './core/common/services/email.service.js';
+import { MailjetService } from './core/common/services/mailjet.service.js';
+import { ModelDocService } from './core/common/services/model-doc.service.js';
+import { TemplateService } from './core/common/services/template.service.js';
+import { CoreAiModule } from './core/modules/ai/core-ai.module.js';
+import { isLegacyJwt } from './core/modules/better-auth/core-better-auth-token.helper.js';
+import { CoreBetterAuthUserMapper } from './core/modules/better-auth/core-better-auth-user.mapper.js';
+import { CoreBetterAuthModule } from './core/modules/better-auth/core-better-auth.module.js';
+import { CoreBetterAuthService } from './core/modules/better-auth/core-better-auth.service.js';
+import { ErrorCodeModule } from './core/modules/error-code/error-code.module.js';
+import { CoreFileAccessAuditInitializer } from './core/modules/file/core-file-access-audit.initializer.js';
+import { FILE_METADATA_MODELS } from './core/modules/file/file-metadata.models.js';
+import { applyFileRoles, warnOnPresignedDownloadsWithRestrictedRoles } from './core/modules/file/file-roles.helper.js';
+import { CoreHealthCheckModule } from './core/modules/health-check/core-health-check.module.js';
+import { CoreHubModule } from './core/modules/hub/core-hub.module.js';
+import { isHubEnabled, isHubQueriesEnabled } from './core/modules/hub/hub-config.helper.js';
+import { CorePermissionsModule } from './core/modules/permissions/core-permissions.module.js';
+import { CoreSystemSetupModule } from './core/modules/system-setup/core-system-setup.module.js';
+import { CoreApiTokenModule } from './core/modules/api-token/core-api-token.module.js';
+import { CoreTenantModule } from './core/modules/tenant/core-tenant.module.js';
+const coreModuleLogger = new Logger('CoreModule');
 let CoreModule = class CoreModule {
     static { CoreModule_1 = this; }
     static graphQlEnabled = true;
     configure(consumer) {
-        consumer.apply(request_context_middleware_1.RequestContextMiddleware).forRoutes('*');
-        consumer.apply(security_headers_middleware_1.SecurityHeadersMiddleware).forRoutes('*');
+        consumer.apply(RequestContextMiddleware).forRoutes('*');
+        consumer.apply(SecurityHeadersMiddleware).forRoutes('*');
         if (CoreModule_1.graphQlEnabled) {
             consumer.apply(graphqlUploadExpress()).forRoutes('graphql');
         }
@@ -88,8 +92,8 @@ let CoreModule = class CoreModule {
         const overrides = isIamOnlyMode
             ? authModuleOrUndefined
             : overridesOrUndefined;
-        (0, cookies_helper_1.assertCookiesProductionSafe)(options?.cookies, options?.env);
-        const cors = (0, cookies_helper_1.isCorsDisabled)(options?.cors) ? false : (0, cookies_helper_1.buildCorsConfig)(options);
+        assertCookiesProductionSafe(options?.cookies, options?.env);
+        const cors = isCorsDisabled(options?.cors) ? false : buildCorsConfig(options);
         const isGraphQlEnabled = options.graphQl !== false;
         CoreModule_1.graphQlEnabled = isGraphQlEnabled;
         const rawBetterAuth = options?.betterAuth;
@@ -102,7 +106,7 @@ let CoreModule = class CoreModule {
                     : this.buildIamOnlyGraphQlDriver(cors, options)
                 : this.buildLegacyGraphQlDriver(AuthService, AuthModule, cors, options);
         }
-        const config = (0, config_helper_1.merge)({
+        const config = merge({
             env: 'develop',
             ...(isGraphQlEnabled
                 ? {
@@ -115,7 +119,7 @@ let CoreModule = class CoreModule {
             mongoose: {
                 options: {
                     connectionFactory: (connection) => {
-                        connection.plugin(mongoose_id_plugin_1.mongooseIdPlugin);
+                        connection.plugin(mongooseIdPlugin);
                         return connection;
                     },
                 },
@@ -123,6 +127,18 @@ let CoreModule = class CoreModule {
             },
             port: Number(process.env.PORT) || 3000,
         }, options);
+        const dataSources = resolveDataSources({
+            database: options?.database,
+            explicitMongoose: !!options?.mongoose,
+            mongooseUri: config.mongoose?.uri,
+        });
+        assertDataSourcesSupported(dataSources);
+        const defaultSource = dataSources.defaultSource ? dataSources.sources[dataSources.defaultSource] : undefined;
+        if (defaultSource?.driver === 'mongodb') {
+            config.mongoose.uri = defaultSource.url;
+        }
+        const sqlSources = hasSqlSource(dataSources);
+        setPersistenceRuntime(sqlSources ? new DataSourceRuntime(dataSources) : undefined);
         const originalConnectionFactory = config.mongoose?.options?.connectionFactory;
         config.mongoose.options = config.mongoose.options || {};
         config.mongoose.options.connectionFactory = (connection, name) => {
@@ -130,122 +146,134 @@ let CoreModule = class CoreModule {
                 connection = originalConnectionFactory(connection, name);
             }
             if (config.security?.mongoosePasswordPlugin !== false) {
-                connection.plugin(mongoose_password_plugin_1.mongoosePasswordPlugin);
+                connection.plugin(mongoosePasswordPlugin);
             }
             if (config.security?.mongooseRoleGuardPlugin !== false) {
-                connection.plugin(mongoose_role_guard_plugin_1.mongooseRoleGuardPlugin);
+                connection.plugin(mongooseRoleGuardPlugin);
             }
-            connection.plugin(mongoose_system_role_plugin_1.mongooseSystemRolePlugin);
+            connection.plugin(mongooseSystemRolePlugin);
             if (config.security?.mongooseAuditFieldsPlugin !== false) {
-                connection.plugin(mongoose_audit_fields_plugin_1.mongooseAuditFieldsPlugin);
+                connection.plugin(mongooseAuditFieldsPlugin);
             }
             if (config.multiTenancy && config.multiTenancy.enabled !== false) {
-                connection.plugin(mongoose_tenant_plugin_1.mongooseTenantPlugin);
+                connection.plugin(mongooseTenantPlugin);
             }
             return connection;
         };
-        (0, file_roles_helper_1.applyFileRoles)(config.file);
-        (0, file_roles_helper_1.warnOnPresignedDownloadsWithRestrictedRoles)(config.s3, config.file);
+        applyFileRoles(config.file);
+        warnOnPresignedDownloadsWithRestrictedRoles(config.s3, config.file);
         const jwtConfig = config.jwt;
         if (jwtConfig?.secret && jwtConfig.secret && jwtConfig.refresh && jwtConfig.refresh.secret === jwtConfig.secret) {
-            console.warn('JWT secret and refresh secret are equal, this can lead to security vulnerabilities!');
+            coreModuleLogger.warn('JWT secret and refresh secret are equal, this can lead to security vulnerabilities!');
         }
         const providers = [
             {
-                provide: config_service_1.ConfigService,
-                useValue: new config_service_1.ConfigService(config),
+                provide: ConfigService,
+                useValue: new ConfigService(config),
             },
-            core_body_parser_initializer_1.CoreBodyParserInitializer,
-            core_cron_jobs_initializer_1.CoreCronJobsInitializer,
-            core_file_access_audit_initializer_1.CoreFileAccessAuditInitializer,
-            core_redis_service_1.CoreRedisService,
-            core_s3_service_1.CoreS3Service,
-            core_trust_proxy_initializer_1.CoreTrustProxyInitializer,
-            email_service_1.EmailService,
-            template_service_1.TemplateService,
-            mailjet_service_1.MailjetService,
+            CoreBodyParserInitializer,
+            CoreCronJobsInitializer,
+            CoreFileAccessAuditInitializer,
+            CoreRedisService,
+            CoreS3Service,
+            CoreTrustProxyInitializer,
+            EmailService,
+            TemplateService,
+            MailjetService,
         ];
+        if (sqlSources) {
+            providers.push(CorePersistenceLifecycle);
+        }
         if (!process.env.VITEST && isGraphQlEnabled) {
-            providers.push(complexity_plugin_1.ComplexityPlugin);
+            providers.push(ComplexityPlugin);
         }
         if (config.security?.checkResponseInterceptor ?? true) {
             providers.push({
-                provide: core_1.APP_INTERCEPTOR,
-                useClass: check_response_interceptor_1.CheckResponseInterceptor,
+                provide: APP_INTERCEPTOR,
+                useClass: CheckResponseInterceptor,
             });
         }
         if (config.security?.checkSecurityInterceptor ?? true) {
             providers.push({
-                provide: core_1.APP_INTERCEPTOR,
-                useClass: check_security_interceptor_1.CheckSecurityInterceptor,
+                provide: APP_INTERCEPTOR,
+                useClass: CheckSecurityInterceptor,
             });
         }
         if (config.security?.mapAndValidatePipe ?? true) {
             providers.push({
-                provide: core_1.APP_PIPE,
-                useClass: map_and_validate_pipe_1.MapAndValidatePipe,
+                provide: APP_PIPE,
+                useClass: MapAndValidatePipe,
             });
         }
         if (config.security?.translateResponseInterceptor !== false) {
             providers.push({
-                provide: core_1.APP_INTERCEPTOR,
-                useClass: translate_response_interceptor_1.TranslateResponseInterceptor,
+                provide: APP_INTERCEPTOR,
+                useClass: TranslateResponseInterceptor,
             });
         }
         if (config.security?.responseModelInterceptor !== false) {
             providers.push({
-                provide: core_1.APP_INTERCEPTOR,
-                useClass: response_model_interceptor_1.ResponseModelInterceptor,
+                provide: APP_INTERCEPTOR,
+                useClass: ResponseModelInterceptor,
             });
         }
         if (config.security?.mongooseCastErrorFilter !== false) {
             providers.push({
-                provide: core_1.APP_FILTER,
-                useClass: mongoose_cast_error_filter_1.MongooseCastErrorFilter,
+                provide: APP_FILTER,
+                useClass: MongooseCastErrorFilter,
             });
         }
         if (config.mongoose?.modelDocumentation) {
-            providers.push(model_doc_service_1.ModelDocService);
+            providers.push(ModelDocService);
         }
-        mongoose_2.default.set('strictQuery', config.mongoose.strictQuery || false);
-        if ((0, hub_config_helper_1.isHubQueriesEnabled)(config.hub)) {
+        const mongoPackages = usesMongoDb(dataSources)
+            ? requireMongoPackages('The MongoDB data source (the `mongoose` configuration, or `database` naming MongoDB)')
+            : undefined;
+        mongoPackages?.mongoose.set('strictQuery', config.mongoose.strictQuery || false);
+        if (isHubQueriesEnabled(config.hub)) {
             config.mongoose.options = config.mongoose.options || {};
             if (config.mongoose.options.monitorCommands === undefined) {
                 config.mongoose.options.monitorCommands = true;
             }
         }
-        const imports = [core_1.DiscoveryModule, mongoose_1.MongooseModule.forRoot(config.mongoose.uri, config.mongoose.options)];
+        const imports = [
+            DiscoveryModule,
+            mongoPackages
+                ? mongoPackages.nestMongoose.MongooseModule.forRoot(config.mongoose.uri, config.mongoose.options)
+                : NoMongoConnectionModule,
+            CorePersistenceModule.forFeature(FILE_METADATA_MODELS),
+        ];
         if (isGraphQlEnabled && config.graphQl) {
-            imports.push(graphql_1.GraphQLModule.forRootAsync(Object.assign({ driver: apollo_1.ApolloDriver }, config.graphQl.driver, config.graphQl.options)));
+            imports.push(GraphQLModule.forRootAsync(Object.assign({ driver: ApolloDriver }, config.graphQl.driver, config.graphQl.options)));
         }
         const errorCodeConfig = config.errorCode;
         const isErrorCodeAutoRegister = errorCodeConfig?.autoRegister !== false;
         if (!isErrorCodeAutoRegister && (overrides?.errorCode?.controller || overrides?.errorCode?.service)) {
-            console.warn('CoreModule: errorCode overrides are ignored because errorCode.autoRegister is false. ' +
+            coreModuleLogger.warn('CoreModule: errorCode overrides are ignored because errorCode.autoRegister is false. ' +
                 'Either remove autoRegister: false or pass controller/service to your own ErrorCodeModule.forRoot() call.');
         }
         if (isErrorCodeAutoRegister) {
-            imports.push(error_code_module_1.ErrorCodeModule.forRoot({
+            imports.push(ErrorCodeModule.forRoot({
                 additionalErrorRegistry: errorCodeConfig?.additionalErrorRegistry,
                 controller: overrides?.errorCode?.controller,
                 service: overrides?.errorCode?.service,
             }));
         }
         if (config.healthCheck && config.healthCheck.enabled !== false) {
-            imports.push(core_health_check_module_1.CoreHealthCheckModule);
+            imports.push(CoreHealthCheckModule);
         }
         const permissionsConfig = config.permissions;
         const permissionsEnabled = permissionsConfig === true || (typeof permissionsConfig === 'object' && permissionsConfig.enabled !== false);
         if (permissionsEnabled) {
-            imports.push(core_permissions_module_1.CorePermissionsModule.forRoot(permissionsConfig));
+            imports.push(CorePermissionsModule.forRoot(permissionsConfig));
         }
-        if ((0, hub_config_helper_1.isHubEnabled)(config.hub)) {
+        if (isHubEnabled(config.hub)) {
             const permissionsPath = permissionsEnabled && typeof permissionsConfig === 'object' && permissionsConfig.path
                 ? permissionsConfig.path
                 : permissionsEnabled
                     ? 'permissions'
                     : undefined;
-            imports.push(core_hub_module_1.CoreHubModule.forRoot({
+            imports.push(CoreHubModule.forRoot({
                 actionsController: overrides?.hub?.actionsController,
                 actionsService: overrides?.hub?.actionsService,
                 config: config.hub,
@@ -264,17 +292,21 @@ let CoreModule = class CoreModule {
         const isExplicitlyDisabled = betterAuthConfig === false || (typeof betterAuthConfig === 'object' && betterAuthConfig?.enabled === false);
         const isExplicitlyEnabled = betterAuthConfig === true || (typeof betterAuthConfig === 'object' && betterAuthConfig?.enabled !== false);
         const isBetterAuthEnabled = isIamOnlyMode ? !isExplicitlyDisabled : isExplicitlyEnabled;
+        if (dataSources.disabled && isBetterAuthEnabled) {
+            throw new DataSourceConfigError('`database: false` runs without a database, and Better-Auth keeps its users in one — set `betterAuth: false` ' +
+                'or configure a data source');
+        }
         const isAutoRegister = typeof betterAuthConfig === 'object' && betterAuthConfig?.autoRegister === true;
         const isAutoRegisterDisabled = typeof betterAuthConfig === 'object' && betterAuthConfig?.autoRegister === false;
         const configController = typeof betterAuthConfig === 'object' ? betterAuthConfig?.controller : undefined;
         const configResolver = typeof betterAuthConfig === 'object' ? betterAuthConfig?.resolver : undefined;
         if (isAutoRegisterDisabled && (overrides?.betterAuth?.controller || overrides?.betterAuth?.resolver)) {
-            console.warn('CoreModule: betterAuth overrides are ignored because betterAuth.autoRegister is false. ' +
+            coreModuleLogger.warn('CoreModule: betterAuth overrides are ignored because betterAuth.autoRegister is false. ' +
                 'Either remove autoRegister: false or pass controller/resolver to your own BetterAuthModule.forRoot() call.');
         }
         if (isBetterAuthEnabled) {
             if ((isIamOnlyMode && !isAutoRegisterDisabled) || isAutoRegister) {
-                imports.push(core_better_auth_module_1.CoreBetterAuthModule.forRoot({
+                imports.push(CoreBetterAuthModule.forRoot({
                     config: betterAuthConfig === true ? {} : betterAuthConfig || {},
                     controller: overrides?.betterAuth?.controller || configController,
                     fallbackSecrets: [config.jwt?.secret, config.jwt?.refresh?.secret],
@@ -287,11 +319,11 @@ let CoreModule = class CoreModule {
                 }));
             }
         }
-        if ((0, hub_config_helper_1.isHubEnabled)(config.hub)) {
+        if (isHubEnabled(config.hub)) {
             const hubIsGated = !(typeof config.hub === 'object' && config.hub.roles === false);
             const noBuiltInRolesGuard = isIamOnlyMode && !isBetterAuthEnabled;
             if (hubIsGated && noBuiltInRolesGuard) {
-                console.warn('CoreModule: the Hub is enabled and ADMIN-gated, but neither BetterAuth (IAM) nor the legacy ' +
+                coreModuleLogger.warn('CoreModule: the Hub is enabled and ADMIN-gated, but neither BetterAuth (IAM) nor the legacy ' +
                     'Auth module is active — so no built-in guard enforces its @Roles(ADMIN) metadata. Unless you ' +
                     'have registered your own APP_GUARD that reads @Roles, the Hub (including its destructive ' +
                     'migration/file-delete/cron actions) is reachable UNAUTHENTICATED. Enable an auth module or ' +
@@ -299,14 +331,14 @@ let CoreModule = class CoreModule {
             }
         }
         if (isBetterAuthEnabled && config.systemSetup?.enabled !== false) {
-            imports.push(core_system_setup_module_1.CoreSystemSetupModule);
+            imports.push(CoreSystemSetupModule);
         }
         const aiConfig = config.ai;
         const isAiEnabled = aiConfig === true || (typeof aiConfig === 'object' && aiConfig !== null && aiConfig.enabled !== false);
         if (isAiEnabled) {
             const aiObj = typeof aiConfig === 'object' && aiConfig !== null ? aiConfig : undefined;
             const mcpEnabled = aiObj?.mcp === true || (typeof aiObj?.mcp === 'object' && aiObj.mcp !== null && aiObj.mcp.enabled !== false);
-            imports.push(core_ai_module_1.CoreAiModule.forRoot({ ...overrides?.ai, mcpEnabled }));
+            imports.push(CoreAiModule.forRoot({ ...overrides?.ai, mcpEnabled }));
         }
         if (config.multiTenancy && config.multiTenancy.enabled !== false) {
             const membershipModelName = config.multiTenancy.membershipModel ?? 'TenantMember';
@@ -316,23 +348,23 @@ let CoreModule = class CoreModule {
             if (!config.multiTenancy.excludeSchemas.includes(membershipModelName)) {
                 config.multiTenancy.excludeSchemas.push(membershipModelName);
             }
-            imports.push(core_tenant_module_1.CoreTenantModule.forRoot({ modelName: membershipModelName }));
+            imports.push(CoreTenantModule.forRoot({ modelName: membershipModelName }));
         }
         const apiTokensConfig = config.apiTokens;
         if (apiTokensConfig === true ||
             (typeof apiTokensConfig === 'object' && apiTokensConfig !== null && apiTokensConfig.enabled !== false)) {
-            imports.push(core_api_token_module_1.CoreApiTokenModule.forRoot({ ...overrides?.apiToken }));
+            imports.push(CoreApiTokenModule.forRoot({ ...overrides?.apiToken }));
         }
         const exports = [
-            config_service_1.ConfigService,
-            core_redis_service_1.CoreRedisService,
-            core_s3_service_1.CoreS3Service,
-            email_service_1.EmailService,
-            template_service_1.TemplateService,
-            mailjet_service_1.MailjetService,
+            ConfigService,
+            CoreRedisService,
+            CoreS3Service,
+            EmailService,
+            TemplateService,
+            MailjetService,
         ];
         if (!process.env.VITEST && isGraphQlEnabled) {
-            exports.push(complexity_plugin_1.ComplexityPlugin);
+            exports.push(ComplexityPlugin);
         }
         return {
             exports,
@@ -344,16 +376,16 @@ let CoreModule = class CoreModule {
     static buildIamOnlyGraphQlDriver(cors, options) {
         const graphQlOpts = typeof options?.graphQl === 'object' ? options.graphQl : undefined;
         return {
-            imports: [core_better_auth_module_1.CoreBetterAuthModule],
-            inject: [core_better_auth_service_1.CoreBetterAuthService, core_better_auth_user_mapper_1.CoreBetterAuthUserMapper],
+            imports: [CoreBetterAuthModule],
+            inject: [CoreBetterAuthService, CoreBetterAuthUserMapper],
             useFactory: async (betterAuthService, userMapper) => Object.assign({
                 autoSchemaFile: 'schema.gql',
                 context: ({ req, res }) => ({ req, res }),
                 cors,
                 installSubscriptionHandlers: true,
                 subscriptions: {
-                    execute: (0, graphql_ws_context_helper_1.buildRequestContextAwareExecute)(),
-                    subscribe: (0, graphql_ws_context_helper_1.buildRequestContextAwareSubscribe)(),
+                    execute: buildRequestContextAwareExecute(),
+                    subscribe: buildRequestContextAwareSubscribe(),
                     'graphql-ws': {
                         context: ({ extra }) => extra,
                         onConnect: async (context) => {
@@ -365,11 +397,11 @@ let CoreModule = class CoreModule {
                                 if (authToken) {
                                     const user = await CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                                     if (!user) {
-                                        throw new common_1.UnauthorizedException('Invalid or expired session');
+                                        return refuseWsHandshake(extra.socket, 'Invalid or expired session');
                                     }
                                     extra.user = user;
                                     extra.headers = connectionParams ?? headers;
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
+                                    registerWsConnection({
                                         carrier: extra,
                                         reauthenticate: () => CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken),
                                         socket: extra.socket,
@@ -377,30 +409,7 @@ let CoreModule = class CoreModule {
                                     });
                                     return extra;
                                 }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
-                            }
-                        },
-                    },
-                    'subscriptions-transport-ws': {
-                        onConnect: async (connectionParams, webSocket) => {
-                            const enableAuth = graphQlOpts?.enableSubscriptionAuth ?? true;
-                            if (enableAuth) {
-                                const authToken = connectionParams?.Authorization?.split(' ')[1];
-                                if (authToken) {
-                                    const user = await CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken);
-                                    if (!user) {
-                                        throw new common_1.UnauthorizedException('Invalid or expired session');
-                                    }
-                                    const connectionContext = { headers: connectionParams, user };
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
-                                        carrier: connectionContext,
-                                        reauthenticate: () => CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken),
-                                        socket: webSocket,
-                                        user,
-                                    });
-                                    return connectionContext;
-                                }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
+                                return refuseWsHandshake(extra.socket, 'Missing authentication token');
                             }
                         },
                     },
@@ -417,29 +426,29 @@ let CoreModule = class CoreModule {
                 cors,
                 installSubscriptionHandlers: true,
                 subscriptions: {
-                    execute: (0, graphql_ws_context_helper_1.buildRequestContextAwareExecute)(),
-                    subscribe: (0, graphql_ws_context_helper_1.buildRequestContextAwareSubscribe)(),
+                    execute: buildRequestContextAwareExecute(),
+                    subscribe: buildRequestContextAwareSubscribe(),
                     'graphql-ws': {
                         context: ({ extra }) => extra,
                         onConnect: async (context) => {
                             const { connectionParams, extra } = context;
                             const enableAuth = graphQlOpts?.enableSubscriptionAuth ?? true;
                             if (enableAuth) {
-                                const betterAuthService = core_better_auth_module_1.CoreBetterAuthModule.getServiceInstance();
-                                const userMapper = core_better_auth_module_1.CoreBetterAuthModule.getUserMapperInstance();
+                                const betterAuthService = CoreBetterAuthModule.getServiceInstance();
+                                const userMapper = CoreBetterAuthModule.getUserMapperInstance();
                                 if (!betterAuthService || !userMapper) {
-                                    throw new common_1.UnauthorizedException('BetterAuth not initialized');
+                                    throw new UnauthorizedException('BetterAuth not initialized');
                                 }
                                 const headers = CoreModule_1.getHeaderFromArray(extra.request?.rawHeaders);
                                 const authToken = connectionParams?.Authorization?.split(' ')[1] ?? headers.Authorization?.split(' ')[1];
                                 if (authToken) {
                                     const user = await CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken);
                                     if (!user) {
-                                        throw new common_1.UnauthorizedException('Invalid or expired session');
+                                        return refuseWsHandshake(extra.socket, 'Invalid or expired session');
                                     }
                                     extra.user = user;
                                     extra.headers = connectionParams ?? headers;
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
+                                    registerWsConnection({
                                         carrier: extra,
                                         reauthenticate: () => CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken),
                                         socket: extra.socket,
@@ -447,35 +456,7 @@ let CoreModule = class CoreModule {
                                     });
                                     return extra;
                                 }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
-                            }
-                        },
-                    },
-                    'subscriptions-transport-ws': {
-                        onConnect: async (connectionParams, webSocket) => {
-                            const enableAuth = graphQlOpts?.enableSubscriptionAuth ?? true;
-                            if (enableAuth) {
-                                const betterAuthService = core_better_auth_module_1.CoreBetterAuthModule.getServiceInstance();
-                                const userMapper = core_better_auth_module_1.CoreBetterAuthModule.getUserMapperInstance();
-                                if (!betterAuthService || !userMapper) {
-                                    throw new common_1.UnauthorizedException('BetterAuth not initialized');
-                                }
-                                const authToken = connectionParams?.Authorization?.split(' ')[1];
-                                if (authToken) {
-                                    const user = await CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken);
-                                    if (!user) {
-                                        throw new common_1.UnauthorizedException('Invalid or expired session');
-                                    }
-                                    const connectionContext = { headers: connectionParams, user };
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
-                                        carrier: connectionContext,
-                                        reauthenticate: () => CoreModule_1.authenticateIamWsToken(betterAuthService, userMapper, authToken),
-                                        socket: webSocket,
-                                        user,
-                                    });
-                                    return connectionContext;
-                                }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
+                                return refuseWsHandshake(extra.socket, 'Missing authentication token');
                             }
                         },
                     },
@@ -495,8 +476,8 @@ let CoreModule = class CoreModule {
                 cors,
                 installSubscriptionHandlers: true,
                 subscriptions: {
-                    execute: (0, graphql_ws_context_helper_1.buildRequestContextAwareExecute)(),
-                    subscribe: (0, graphql_ws_context_helper_1.buildRequestContextAwareSubscribe)(),
+                    execute: buildRequestContextAwareExecute(),
+                    subscribe: buildRequestContextAwareSubscribe(),
                     'graphql-ws': {
                         context: ({ extra }) => extra,
                         onConnect: async (context) => {
@@ -507,11 +488,11 @@ let CoreModule = class CoreModule {
                                 if (authToken) {
                                     const user = await CoreModule_1.authenticateLegacyWsToken(authService, authToken);
                                     if (!user) {
-                                        throw new common_1.UnauthorizedException('No user found for token');
+                                        return refuseWsHandshake(extra.socket, 'No user found for token');
                                     }
                                     extra.user = user;
                                     extra.headers = connectionParams ?? headers;
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
+                                    registerWsConnection({
                                         carrier: extra,
                                         reauthenticate: () => CoreModule_1.authenticateLegacyWsToken(authService, authToken),
                                         socket: extra.socket,
@@ -519,29 +500,7 @@ let CoreModule = class CoreModule {
                                     });
                                     return extra;
                                 }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
-                            }
-                        },
-                    },
-                    'subscriptions-transport-ws': {
-                        onConnect: async (connectionParams, webSocket) => {
-                            if (enableSubscriptionAuth) {
-                                const authToken = connectionParams?.Authorization?.split(' ')[1];
-                                if (authToken) {
-                                    const user = await CoreModule_1.authenticateLegacyWsToken(authService, authToken);
-                                    if (!user) {
-                                        throw new common_1.UnauthorizedException('No user found for token');
-                                    }
-                                    const connectionContext = { headers: connectionParams, user };
-                                    (0, graphql_ws_connection_helper_1.registerWsConnection)({
-                                        carrier: connectionContext,
-                                        reauthenticate: () => CoreModule_1.authenticateLegacyWsToken(authService, authToken),
-                                        socket: webSocket,
-                                        user,
-                                    });
-                                    return connectionContext;
-                                }
-                                throw new common_1.UnauthorizedException('Missing authentication token');
+                                return refuseWsHandshake(extra.socket, 'Missing authentication token');
                             }
                         },
                     },
@@ -553,7 +512,7 @@ let CoreModule = class CoreModule {
         if (!authToken) {
             return null;
         }
-        if (authToken.split('.').length === 3 && !(0, core_better_auth_token_helper_1.isLegacyJwt)(authToken) && betterAuthService.isJwtEnabled()) {
+        if (authToken.split('.').length === 3 && !isLegacyJwt(authToken) && betterAuthService.isJwtEnabled()) {
             const payload = await betterAuthService.verifyJwtToken(authToken);
             if (payload?.sub) {
                 return userMapper.mapSessionUser({
@@ -584,7 +543,7 @@ let CoreModule = class CoreModule {
         else {
             if (!CoreModule_1.unverifiedLegacyWsTokenWarned) {
                 CoreModule_1.unverifiedLegacyWsTokenWarned = true;
-                new common_1.Logger('CoreModule').warn('The AuthService passed to CoreModule.forRoot() has no verifyJwt(): legacy WebSocket tokens are ' +
+                coreModuleLogger.warn('The AuthService passed to CoreModule.forRoot() has no verifyJwt(): legacy WebSocket tokens are ' +
                     'read WITHOUT checking signature or expiry. Extend CoreAuthService to close that.');
             }
             payload = authService.decodeJwt(authToken);
@@ -593,15 +552,15 @@ let CoreModule = class CoreModule {
     }
     static unverifiedLegacyWsTokenWarned = false;
     static isCookiesEnabled(cookies) {
-        return (0, cookies_helper_1.isCookiesEnabled)(cookies);
+        return isCookiesEnabled(cookies);
     }
     static isExposeTokenInBodyEnabled(cookies) {
-        return (0, cookies_helper_1.isExposeTokenInBodyEnabled)(cookies);
+        return isExposeTokenInBodyEnabled(cookies);
     }
 };
-exports.CoreModule = CoreModule;
-exports.CoreModule = CoreModule = CoreModule_1 = __decorate([
-    (0, common_1.Global)(),
-    (0, common_1.Module)({})
+CoreModule = CoreModule_1 = __decorate([
+    Global(),
+    Module({})
 ], CoreModule);
+export { CoreModule };
 //# sourceMappingURL=core.module.js.map